Merge branch 'main' into delete-events

Author: simonLeary42

.github/workflows/lint.yml

@@ -29,7 +29,7 @@ jobs:
       - name: Set up PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: "7.4"
+          php-version: "8.3"
           coverage: none
           tools: phpcs
 

CONTRIBUTING.md

@@ -8,7 +8,7 @@ When submitting pull requests, the pull request should be made to the version yo
 
 ## Conventions
 
-This code base is currently using PHP version 7.4. All files are required to be linted with PSR-12 standard. This repository will automatically check PRs for linting compliance.
+This code base is currently using PHP version 8.3. All files are required to be linted with PSR-12 standard. This repository will automatically check PRs for linting compliance.
 
 ## Development Environment
 
@@ -33,8 +33,6 @@ The test environment ships with a number of users that can be used for testing.
 
 The following users are available for testing:
 
-* `[email protected]` - admin user who is a member of pi_user1_domain_edu
-* `[email protected]` - admin user
 * `[email protected]` - user who is the owner of pi_user1_domain_edu
 * `[email protected]` - user who is the owner of pi_user2_domain_edu
 * `[email protected]` - user who is a member of pi_user1_domain_edu
@@ -51,4 +49,4 @@ The following users are available for testing:
 
 ### Changes to Dev Environment
 
-Should the default schema of the web portal change, the `ldap/bootstrap.ldif` and `sql/bootstrap.sql` must be updated for the LDAP server and the MySQL server, respectively.
+Should the default schema of the web portal change, the `ldap/bootstrap.ldif` and `sql/bootstrap.sql` must be updated for the LDAP server and the MySQL server, respectively.

README.md

@@ -22,17 +22,17 @@ Unity Web Portal is a PHP application built in top of MariaDB and LDAP which act
     1. Composer (`apt install composer` on Ubuntu)
     1. PHP Extensions
         1. `php-ldap`
-        2. `php-curl`
-        3. `php-redis`
-        4. `php-cli`
-        5. `php-mysql`
-        6. `php-pdo`
-2. Composer packages
+        1. `php-curl`
+        1. `php-redis`
+        1. `php-cli`
+        1. `php-mysql`
+        1. `php-pdo`
+1. Composer packages
     1. `cd` to this repository
-    2. Install packages `composer update`
-3. Setup config file `config/config.ini` according to your site deployment
-4. Setup branding file `config/branding/config.ini` according to your site deployment
-5. Point your web server's document root to `webroot` in this repo
+    1. Install packages `sudo composer update --no-plugins --no-scripts`
+1. Deployment:
+    1. configure the files in `deployment/` according to their respective `README.md` files
+1. Point your web server's document root to `webroot` in this repo
 
 The scope of this project ends at being responsible for the LDAP user database. We recommend production deployments to set up scripts which detect changes in LDAP and then perform further actions. For example, a script can be used to create Slurm scheduler accounting roles based on the LDAP information created by this website.
 
@@ -46,7 +46,7 @@ The update process is similar to the installation process:
 
 1. Clone the release and follow installation instructions 1 and 2 from above.
 2. Copy the following folders from the old installation to the new one:
-    1. `config`
+    1. `deployment`
     2. `webroot/assets/footer_logos`
 
 We recommend a deployment where each version of the portal is its own clone, then just change a symlink to point to the new version. This way a rollback is much easier.

defaults/config.ini.default

@@ -21,7 +21,7 @@ user_ou = "ou=users,dc=unityhpc,dc=test"  ; User organizational unit
 group_ou = "ou=groups,dc=unityhpc,dc=test"  ; Group organizational unit
 pigroup_ou = "ou=pi_groups,dc=unityhpc,dc=test"  ; PI Group organizational unit
 orggroup_ou = "ou=org_groups,dc=unityhpc,dc=test"  ; ORG group organizational unit
-admin_group = "cn=sudo,dc=unityhpc,dc=test"  ; admin dn (members of this group are admins on the web portal)
+admin_group = "cn=web_admins,dc=unityhpc,dc=test"  ; admin dn (members of this group are admins on the web portal)
 def_user_shell = "/bin/bash"  ; Default shell for new users
 
 [sql]

resources/lib/UnityUser.php

@@ -555,7 +555,7 @@ public function getHomeDir($ignorecache = false)
     }
 
     /**
-     * Checks if the current account is an admin (in the sudo group)
+     * Checks if the current account is an admin (in the web_admins group)
      *
      * @return boolean true if admin, false if not
      */
@@ -572,7 +572,7 @@ public function isAdmin()
      */
     public function isPI()
     {
-        return $this->getPIGroup()->exists();
+        return @$this->getPIGroup()->exists();
     }
 
     public function getPIGroup()

tools/docker-dev/build.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
-
+set -e
 cd "$(dirname "$0")"
 
 docker-compose down
 docker-compose build --no-cache
-docker image prune
+docker image prune

tools/docker-dev/identity/bootstrap.ldif

@@ -11,9 +11,10 @@ objectclass: top
 objectclass: simpleSecurityObject
 objectclass: organizationalRole
 userPassword: {SSHA}d6WBSm5wjlNpMwil1KQY+Uo4o/vc6PnR
+description: for LDAP server administration purposes, not a valid login to web portal
 
-dn: cn=sudo,dc=unityhpc,dc=test
-cn: sudo
+dn: cn=web_admins,dc=unityhpc,dc=test
+cn: web_admins
 gidnumber: 500
 memberuid: user1_org1_test
 memberuid: user2_org1_test

tools/docker-dev/run.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-
+set -e
 cd "$(dirname "$0")"
 
-docker-compose up
+docker-compose up

tools/docker-dev/sql/Dockerfile

@@ -5,11 +5,12 @@ RUN apt-get update && apt-get install -y \
     mariadb-server \
     mariadb-client \
     apache2 \
+    php8.3 \
     phpmyadmin
 RUN sed -i '/bind-address/c\bind-address = 0.0.0.0' /etc/mysql/mariadb.conf.d/50-server.cnf
 COPY bootstrap.sql /tmp/bootstrap.sql
 
-RUN service mysql start; \
+RUN service mariadb start; \
     mariadb -e "CREATE DATABASE unity"; \
     mariadb -e "CREATE USER 'unity'@'%' IDENTIFIED BY 'password'"; \
     mariadb -e "GRANT ALL PRIVILEGES ON unity.* TO 'unity'@'%'"; \
@@ -28,4 +29,4 @@ RUN echo "ServerName 127.0.0.1" >> /etc/apache2/apache2.conf
 EXPOSE 80
 EXPOSE 3306
 
-CMD apache2ctl -D FOREGROUND & mysqld
+CMD apache2ctl -D FOREGROUND & mysqld --user=root

tools/docker-dev/sql/bootstrap.sql

@@ -24,59 +24,64 @@ SET time_zone = "+00:00";
 CREATE TABLE `account_deletion_requests` (
   `id` int(11) NOT NULL,
   `timestamp` timestamp NOT NULL DEFAULT current_timestamp(),
-  `uid` varchar(1000) NOT NULL
+  `uid` varchar(128) NOT NULL
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
 
 CREATE TABLE `audit_log` (
   `id` int(11) NOT NULL,
   `timestamp` timestamp NOT NULL DEFAULT current_timestamp(),
-  `operator` varchar(1000) NOT NULL,
-  `operator_ip` varchar(1000) NOT NULL,
-  `action_type` varchar(1000) NOT NULL,
-  `recipient` varchar(1000) NOT NULL
+  `operator` varchar(128) NOT NULL,
+  `operator_ip` varchar(15) NOT NULL,
+  `action_type` varchar(768) NOT NULL,
+  `recipient` varchar(128) NOT NULL
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
+
+CREATE TABLE user_last_logins (
+    `operator` varchar(128) NOT NULL,
+    `last_login` timestamp  NOT NULL
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
 
 CREATE TABLE `groupJoinRequests` (
   `id` int(11) NOT NULL,
-  `group_name` varchar(1000) NOT NULL,
-  `requestor` varchar(1000) NOT NULL,
+  `group_name` varchar(768) NOT NULL,
+  `requestor` varchar(768) NOT NULL,
   `requested_on` timestamp NOT NULL DEFAULT current_timestamp()
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
 
 CREATE TABLE `groupRequests` (
   `id` int(11) NOT NULL,
-  `group_type` varchar(1000) NOT NULL,
-  `group_name` varchar(1000) NOT NULL,
-  `requestor` varchar(1000) NOT NULL,
+  `group_type` varchar(768) NOT NULL,
+  `group_name` varchar(768) NOT NULL,
+  `requestor` varchar(128) NOT NULL,
   `requested_on` timestamp NOT NULL DEFAULT current_timestamp(),
   `start_date` timestamp NOT NULL DEFAULT '0000-00-00 00:00:00',
   `end_date` timestamp NOT NULL DEFAULT '0000-00-00 00:00:00'
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
 
 CREATE TABLE `groupRoleAssignments` (
   `id` int(11) NOT NULL,
-  `user` varchar(1000) NOT NULL,
-  `role` varchar(1000) NOT NULL,
-  `group` varchar(1000) NOT NULL
+  `user` varchar(128) NOT NULL,
+  `role` varchar(768) NOT NULL,
+  `group` varchar(768) NOT NULL
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
 
 CREATE TABLE `groupRoles` (
   `id` int(11) NOT NULL,
-  `name` varchar(1000) NOT NULL,
-  `slug` varchar(1000) NOT NULL,
+  `name` varchar(768) NOT NULL,
+  `slug` varchar(768) NOT NULL,
   `priority` int(11) NOT NULL,
-  `color` varchar(1000) NOT NULL,
-  `perms` varchar(1000) NOT NULL
+  `color` varchar(768) NOT NULL,
+  `perms` varchar(768) NOT NULL
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
 
 CREATE TABLE `groupTypes` (
   `id` int(11) NOT NULL,
-  `name` varchar(1000) NOT NULL,
-  `slug` varchar(1000) NOT NULL,
-  `color` varchar(1000) NOT NULL,
+  `name` varchar(768) NOT NULL,
+  `slug` varchar(768) NOT NULL,
+  `color` varchar(768) NOT NULL,
   `time_limited` tinyint(1) NOT NULL,
-  `def_role` varchar(1000) NOT NULL,
-  `av_roles` varchar(1000) NOT NULL,
+  `def_role` varchar(768) NOT NULL,
+  `av_roles` varchar(768) NOT NULL,
   `can_request` tinyint(1) NOT NULL
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
 
@@ -98,20 +103,21 @@ CREATE TABLE `pages` (
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
 
 INSERT INTO `pages` (`id`, `page`, `content`) VALUES
-(1, 'support', '<h3>Docmentation and FAQ</h3>\r\n<p>You can find our documentation <a href=\"https://esdconfluence.it.umass.edu/confluence/display/UNITY/Unity+Cluster+Documentation+Home\" target=\"_blank\">here</a>. We also have an <a target=\"_blank\" href=\"https://esdconfluence.it.umass.edu/confluence/display/UNITY/Frequently+Asked+Questions\">FAQ</a> page which could help answer quick questions.\r\n\r\n<h3>Office Hours</h3>\r\n<p>We offer office hours every week on <strong>Tuesdays 2-4 PM</strong> in-person at <strong>W.E.B. DuBois Library 786</strong> or remote on <strong><a target=\"_blank\" href=\"https://umass-amherst.zoom.us/j/95663998309\">Zoom</a></strong>. Be sure to check the <a href=\"<?php echo $CONFIG[\"site\"][\"prefix\"]; ?>/index.php\">cluster notes</a> page for up-to-date information on any canceled/delayed office hours.</p>\r\n\r\n<h3>Support Email</h3>\r\n<p>You can create a support ticket by emailing <a target=\"_blank\" href=\"mailto:[email protected]\">[email protected]</a>. We will do our best to reply as fast as possible!</p>'),
-(2, 'policy', '<p>By using resources associated with Unity, you agree to comply with the following conditions of use.  This is an extension of the University of Massachussetts Amherst Information Technology Acceptable Use Policy, which can be found <a target=\"_blank\" href=\"https://www.umass.edu/it/security/acceptable-use-policy\">here</a>.</p>\r\n\r\n<ol>\r\n    <li>You will not use Unity resources for illicit financial gain, such as virtual currency mining, or any unlawful purpose, nor attempt to breach or circumvent any Unity administrative or security controls. You will comply with all applicable laws, working with your home institution and the specific Unity service providers utilized to determine what constraints may be placed on you by any relevant regulations such as export control law or HIPAA.</li>\r\n    <li>You will respect intellectual property rights and observe confidentiality agreements.</li>\r\n    <li>You will protect the access credentials (e.g., passwords, private keys, and/or tokens) issued to you or generated to access Unity resources; these are issued to you for your sole use.</li>\r\n    <li>You will immediately report any known or suspected security breach or loss or misuse of Unity access credentials to <a href=\"mailto:[email protected]\">[email protected]</a>.</li>\r\n    <li>You will have only one Unity User account and will keep your profile information up-to-date.</li>\r\n    <li>Use of resources and services through Unity is at your own risk. There are no guarantees that resources and services will be available, that they will suit every purpose, or that data will never be lost or corrupted. Users are responsible for backing up critical data.</li>\r\n    <li>Logged information, including information provided by you for registration purposes, is used for administrative, operational, accounting, monitoring and security purposes. This information may be disclosed, via secured mechanisms, only for the same purposes and only as far as necessary to other organizations cooperating with Unity .</li>\r\n</ol>\r\n\r\n<p>The Unity team reserves the right to restrict access to any individual/group found to be in breach of the above.</p>');
+(1, 'home', '<h3>Docmentation and FAQ</h3>\r\n<p>You can find our documentation <a href=\"https://esdconfluence.it.umass.edu/confluence/display/UNITY/Unity+Cluster+Documentation+Home\" target=\"_blank\">here</a>. We also have an <a target=\"_blank\" href=\"https://esdconfluence.it.umass.edu/confluence/display/UNITY/Frequently+Asked+Questions\">FAQ</a> page which could help answer quick questions.\r\n\r\n<h3>Office Hours</h3>\r\n<p>We offer office hours every week on <strong>Tuesdays 2-4 PM</strong> in-person at <strong>W.E.B. DuBois Library 786</strong> or remote on <strong><a target=\"_blank\" href=\"https://umass-amherst.zoom.us/j/95663998309\">Zoom</a></strong>. Be sure to check the <a href=\"<?php echo $CONFIG[\"site\"][\"prefix\"]; ?>/index.php\">cluster notes</a> page for up-to-date information on any canceled/delayed office hours.</p>\r\n\r\n<h3>Support Email</h3>\r\n<p>You can create a support ticket by emailing <a target=\"_blank\" href=\"mailto:[email protected]\">[email protected]</a>. We will do our best to reply as fast as possible!</p>'),
+(2, 'support', '<h3>Docmentation and FAQ</h3>\r\n<p>You can find our documentation <a href=\"https://esdconfluence.it.umass.edu/confluence/display/UNITY/Unity+Cluster+Documentation+Home\" target=\"_blank\">here</a>. We also have an <a target=\"_blank\" href=\"https://esdconfluence.it.umass.edu/confluence/display/UNITY/Frequently+Asked+Questions\">FAQ</a> page which could help answer quick questions.\r\n\r\n<h3>Office Hours</h3>\r\n<p>We offer office hours every week on <strong>Tuesdays 2-4 PM</strong> in-person at <strong>W.E.B. DuBois Library 786</strong> or remote on <strong><a target=\"_blank\" href=\"https://umass-amherst.zoom.us/j/95663998309\">Zoom</a></strong>. Be sure to check the <a href=\"<?php echo $CONFIG[\"site\"][\"prefix\"]; ?>/index.php\">cluster notes</a> page for up-to-date information on any canceled/delayed office hours.</p>\r\n\r\n<h3>Support Email</h3>\r\n<p>You can create a support ticket by emailing <a target=\"_blank\" href=\"mailto:[email protected]\">[email protected]</a>. We will do our best to reply as fast as possible!</p>'),
+(3, 'policy', '<p>By using resources associated with Unity, you agree to comply with the following conditions of use.  This is an extension of the University of Massachussetts Amherst Information Technology Acceptable Use Policy, which can be found <a target=\"_blank\" href=\"https://www.umass.edu/it/security/acceptable-use-policy\">here</a>.</p>\r\n\r\n<ol>\r\n    <li>You will not use Unity resources for illicit financial gain, such as virtual currency mining, or any unlawful purpose, nor attempt to breach or circumvent any Unity administrative or security controls. You will comply with all applicable laws, working with your home institution and the specific Unity service providers utilized to determine what constraints may be placed on you by any relevant regulations such as export control law or HIPAA.</li>\r\n    <li>You will respect intellectual property rights and observe confidentiality agreements.</li>\r\n    <li>You will protect the access credentials (e.g., passwords, private keys, and/or tokens) issued to you or generated to access Unity resources; these are issued to you for your sole use.</li>\r\n    <li>You will immediately report any known or suspected security breach or loss or misuse of Unity access credentials to <a href=\"mailto:[email protected]\">[email protected]</a>.</li>\r\n    <li>You will have only one Unity User account and will keep your profile information up-to-date.</li>\r\n    <li>Use of resources and services through Unity is at your own risk. There are no guarantees that resources and services will be available, that they will suit every purpose, or that data will never be lost or corrupted. Users are responsible for backing up critical data.</li>\r\n    <li>Logged information, including information provided by you for registration purposes, is used for administrative, operational, accounting, monitoring and security purposes. This information may be disclosed, via secured mechanisms, only for the same purposes and only as far as necessary to other organizations cooperating with Unity .</li>\r\n</ol>\r\n\r\n<p>The Unity team reserves the right to restrict access to any individual/group found to be in breach of the above.</p>');
 
 CREATE TABLE `requests` (
   `id` int(11) NOT NULL,
-  `request_for` varchar(1000) NOT NULL,
-  `uid` varchar(1000) NOT NULL,
+  `request_for` varchar(131) NOT NULL,
+  `uid` varchar(128) NOT NULL,
   `timestamp` timestamp NOT NULL DEFAULT current_timestamp()
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
 
 CREATE TABLE `sitevars` (
   `id` int(11) NOT NULL,
-  `name` varchar(1000) NOT NULL,
-  `value` varchar(1000) NOT NULL
+  `name` varchar(768) NOT NULL,
+  `value` varchar(768) NOT NULL
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
 
 CREATE TABLE `sso_log` (
@@ -129,6 +135,9 @@ ALTER TABLE `account_deletion_requests`
 ALTER TABLE `audit_log`
   ADD PRIMARY KEY (`id`);
 
+ALTER TABLE `user_last_logins`
+  ADD PRIMARY KEY (`operator`);
+
 ALTER TABLE `groupJoinRequests`
   ADD PRIMARY KEY (`id`);
 
@@ -196,6 +205,24 @@ ALTER TABLE `sso_log`
   MODIFY `id` int(10) NOT NULL AUTO_INCREMENT, AUTO_INCREMENT=8;
 COMMIT;
 
+-- --------------------------------------------------------
+
+--
+-- automatically update `user_last_logins` from `audit_log`
+--
+DELIMITER //
+CREATE TRIGGER update_last_login
+AFTER INSERT ON audit_log
+FOR EACH ROW
+BEGIN
+    IF NEW.action_type = 'user_login' THEN
+        INSERT INTO user_last_logins (operator, last_login)
+        VALUES (NEW.operator, NEW.timestamp)
+        ON DUPLICATE KEY UPDATE last_login = NEW.timestamp;
+    END IF;
+END;//
+DELIMITER ;
+
 /*!40101 SET CHARACTER_SET_CLIENT=@OLD_CHARACTER_SET_CLIENT */;
 /*!40101 SET CHARACTER_SET_RESULTS=@OLD_CHARACTER_SET_RESULTS */;
 /*!40101 SET COLLATION_CONNECTION=@OLD_COLLATION_CONNECTION */;