X-Git-Url: http://git.freeside.biz/gitweb/?p=freeside.git;a=blobdiff_plain;f=FS%2FFS%2Fsvc_acct.pm;h=71c47d6cdb8d522227fd41603dac7d88b667d570;hp=85b4888b27c1588f877f9d1b01f64fa18d02e965;hb=44e51a5c50be350fa698bcdcf86ad5c01a7631a2;hpb=a9ec5a5c02a137cadd9f2a522fba904d945ddbe3

diff --git a/FS/FS/svc_acct.pm b/FS/FS/svc_acct.pm
index 85b4888b2..71c47d6cd 100644
--- a/FS/FS/svc_acct.pm
+++ b/FS/FS/svc_acct.pm
@@ -3,18 +3,24 @@ package FS::svc_acct;
 use strict;
 use vars qw( @ISA $nossh_hack $conf $dir_prefix @shells $usernamemin
              $usernamemax $passwordmin $username_letter $username_letterfirst
-             $shellmachine $useradd $usermod $userdel 
+             $username_noperiod $username_uppercase
+             $shellmachine $useradd $usermod $userdel $mydomain
+             $cyrus_server $cyrus_admin_user $cyrus_admin_pass
+             $dirhash
+             $icradius_dbh
              @saltset @pw_set);
 use Carp;
 use FS::Conf;
-use FS::Record qw( qsearch qsearchs fields );
+use FS::Record qw( qsearch qsearchs fields dbh );
 use FS::svc_Common;
-use Net::SSH qw(ssh);
+use Net::SSH;
 use FS::part_svc;
 use FS::svc_acct_pop;
 use FS::svc_acct_sm;
 use FS::cust_main_invoice;
 use FS::svc_domain;
+use FS::raddb;
+use FS::queue;
 
 @ISA = qw( FS::svc_Common );
 
@@ -50,6 +56,25 @@ $FS::UID::callback{'FS::svc_acct'} = sub {
   }
   $username_letter = $conf->exists('username-letter');
   $username_letterfirst = $conf->exists('username-letterfirst');
+  $username_noperiod = $conf->exists('username-noperiod');
+  $username_uppercase = $conf->exists('username-uppercase');
+  $mydomain = $conf->config('domain');
+  if ( $conf->exists('cyrus') ) {
+    ($cyrus_server, $cyrus_admin_user, $cyrus_admin_pass) =
+      $conf->config('cyrus');
+    eval "use Cyrus::IMAP::Admin;"
+  } else {
+    $cyrus_server = '';
+    $cyrus_admin_user = '';
+    $cyrus_admin_pass = '';
+  }
+  if ( $conf->exists('icradius_secrets') ) {
+    $icradius_dbh = DBI->connect($conf->config('icradius_secrets'))
+      or die $DBI::errstr;
+  } else {
+    $icradius_dbh = '';
+  }
+  $dirhash = $conf->config('dirhash') || 0;
 };
 
 @saltset = ( 'a'..'z' , 'A'..'Z' , '0'..'9' , '.' , '/' );
@@ -117,6 +142,10 @@ FS::svc_Common.  The following fields are currently supported:
 
 =item slipip - IP address
 
+=item seconds - 
+
+=item domsvc - svcnum from svc_domain
+
 =item radius_I<Radius_Attribute> - I<Radius-Attribute>
 
 =item domsvc - service number of svc_domain with which to associate
@@ -145,7 +174,8 @@ defined.  An FS::cust_svc record will be created and inserted.
 
 If the configuration value (see L<FS::Conf>) shellmachine exists, and the 
 username, uid, and dir fields are defined, the command(s) specified in
-the shellmachine-useradd configuration are exectued on shellmachine via ssh.
+the shellmachine-useradd configuration are added to the job queue (see
+L<FS::queue> and L<freeside-queued>) to be exectued on shellmachine via ssh.
 This behaviour can be surpressed by setting $FS::svc_acct::nossh_hack true.
 If the shellmachine-useradd configuration file does not exist,
 
@@ -160,6 +190,8 @@ is the default instead.  Otherwise the contents of the file are treated as
 a double-quoted perl string, with the following variables available:
 $username, $uid, $gid, $dir, and $shell.
 
+(TODOC: cyrus config file, L<FS::queue> and L<freeside-queued>)
+
 =cut
 
 sub insert {
@@ -173,6 +205,12 @@ sub insert {
   local $SIG{TSTP} = 'IGNORE';
   local $SIG{PIPE} = 'IGNORE';
 
+  my $oldAutoCommit = $FS::UID::AutoCommit;
+  local $FS::UID::AutoCommit = 0;
+  my $dbh = dbh;
+
+  my $amount = 0;
+
   $error = $self->check;
   return $error if $error;
 
@@ -184,13 +222,16 @@ sub insert {
   my $part_svc = qsearchs( 'part_svc', { 'svcpart' => $self->svcpart } );
   return "Unknown svcpart" unless $part_svc;
   return "uid in use"
-    if $part_svc->svc_acct__uid_flag ne 'F'
+    if $part_svc->part_svc_column('uid')->columnflag ne 'F'
       && qsearchs( 'svc_acct', { 'uid' => $self->uid } )
       && $self->username !~ /^(hyla)?fax$/
     ;
 
   $error = $self->SUPER::insert;
-  return $error if $error;
+  if ( $error ) {
+    $dbh->rollback if $oldAutoCommit;
+    return $error;
+  }
 
   my( $username, $uid, $gid, $dir, $shell ) = (
     $self->username,
@@ -200,12 +241,103 @@ sub insert {
     $self->shell,
   );
   if ( $username && $uid && $dir && $shellmachine && ! $nossh_hack ) {
-    ssh("root\@$shellmachine", eval qq("$useradd") );
+    my $queue = new FS::queue { 'job' => 'FS::svc_acct::ssh' };
+    $error = $queue->insert("root\@$shellmachine", eval qq("$useradd") );
+    if ( $error ) {
+      $dbh->rollback if $oldAutoCommit;
+      return "queueing job (transaction rolled back): $error";
+    }
+  }
+
+  if ( $cyrus_server ) {
+    my $queue = new FS::queue { 'job' => 'FS::svc_acct::cyrus_insert' };
+    $error = $queue->insert($self->username, $self->quota);
+    if ( $error ) {
+      $dbh->rollback if $oldAutoCommit;
+      return "queueing job (transaction rolled back): $error";
+    }
+  }
+  if ( $icradius_dbh ) {
+    my $queue = new FS::queue { 'job' => 'FS::svc_acct::icradius_rc_insert' };
+    $error = $queue->insert( $self->username,
+                             $self->_password,
+                             $self->radius_check
+                           );
+    if ( $error ) {
+      $dbh->rollback if $oldAutoCommit;
+      return "queueing job (transaction rolled back): $error";
+    }
   }
 
+  $dbh->commit or die $dbh->errstr if $oldAutoCommit;
   ''; #no error
 }
 
+sub cyrus_insert {
+  my( $username, $quota ) = @_;
+
+  warn "cyrus_insert: starting for user $username, quota $quota\n";
+
+  warn "cyrus_insert: connecting to $cyrus_server\n";
+  my $client = Cyrus::IMAP::Admin->new($cyrus_server);
+
+  warn "cyrus_insert: authentication as $cyrus_admin_user\n";
+  $client->authenticate(
+    -user      => $cyrus_admin_user,
+    -mechanism => "login",       
+    -password  => $cyrus_admin_pass
+  );
+
+  warn "cyrus_insert: creating user.$username\n";
+  my $rc = $client->create("user.$username");
+  my $error = $client->error;
+  die "cyrus_insert: error creating user.$username: $error" if $error;
+
+  warn "cyrus_insert: setacl user.$username, $username => all\n";
+  $rc = $client->setacl("user.$username", $username => 'all' );
+  $error = $client->error;
+  die "cyrus_insert: error setacl user.$username: $error" if $error;
+
+  if ( $quota ) {
+    warn "cyrus_insert: setquota user.$username, STORAGE => $quota\n";
+    $rc = $client->setquota("user.$username", 'STORAGE' => $quota );
+    $error = $client->error;
+    die "cyrus_insert: error setquota user.$username: $error" if $error;
+  }
+
+  1;
+}
+
+sub icradius_rc_insert {
+  my( $username, $password, %radcheck ) = @_;
+  
+  my $sth = $icradius_dbh->prepare(
+    "INSERT INTO radcheck ( id, UserName, Attribute, Value ) VALUES ( ".
+    join(", ", map { $icradius_dbh->quote($_) } (
+      '',
+      $username,
+      "Password",
+      $password,
+    ) ). " )"
+  );
+  $sth->execute or die "can't insert into radcheck table: ". $sth->errstr;
+
+  foreach my $attribute ( keys %radcheck ) {
+    my $sth = $icradius_dbh->prepare(
+      "INSERT INTO radcheck ( id, UserName, Attribute, Value ) VALUES ( ".
+      join(", ", map { $icradius_dbh->quote($_) } (
+        '',
+        $username,
+        $attribute,
+        $radcheck{$attribute},
+      ) ). " )"
+    );
+    $sth->execute or die "can't insert into radcheck table: ". $sth->errstr;
+  }
+
+  1;
+}
+
 =item delete
 
 Deletes this account from the database.  If there is an error, returns the
@@ -215,7 +347,8 @@ The corresponding FS::cust_svc record will be deleted as well.
 
 If the configuration value (see L<FS::Conf>) shellmachine exists, the
 command(s) specified in the shellmachine-userdel configuration file are
-executed on shellmachine via ssh.  This behavior can be surpressed by setting
+added to the job queue (see L<FS::queue> and L<freeside-queued>) to be executed
+on shellmachine via ssh.  This behavior can be surpressed by setting
 $FS::svc_acct::nossh_hack true.  If the shellmachine-userdel configuration
 file does not exist,
 
@@ -230,13 +363,17 @@ is the default instead.  Otherwise the contents of the file are treated as a
 double-quoted perl string, with the following variables available:
 $username and $dir.
 
+(TODOC: cyrus config file)
+
 =cut
 
 sub delete {
   my $self = shift;
 
-  return "Can't delete an account which has (svc_acct_sm) mail aliases!"
-    if $self->uid && qsearch( 'svc_acct_sm', { 'domuid' => $self->uid } );
+  if ( defined( $FS::Record::dbdef->table('svc_acct_sm') ) ) {
+    return "Can't delete an account which has (svc_acct_sm) mail aliases!"
+      if $self->uid && qsearch( 'svc_acct_sm', { 'domuid' => $self->uid } );
+  }
 
   return "Can't delete an account which is a (svc_forward) source!"
     if qsearch( 'svc_forward', { 'srcsvc' => $self->svcnum } );
@@ -263,6 +400,9 @@ sub delete {
   foreach my $cust_main_invoice (
     qsearch( 'cust_main_invoice', { 'dest' => $self->svcnum } )
   ) {
+    #next unless defined; #wtf is up with qsearch?
+    warn $cust_main_invoice;
+    next unless defined $cust_main_invoice;
     my %hash = $cust_main_invoice->hash;
     $hash{'dest'} = $self->email;
     my $new = new FS::cust_main_invoice \%hash;
@@ -292,19 +432,74 @@ sub delete {
     return $error;
   }
 
-  $dbh->commit or die $dbh->errstr if $oldAutoCommit;
-
   my( $username, $dir ) = (
     $self->username,
     $self->dir,
   );
   if ( $username && $shellmachine && ! $nossh_hack ) {
-    ssh("root\@$shellmachine", eval qq("$userdel") );
+    my $queue = new FS::queue { 'job' => 'FS::svc_acct::ssh' };
+    $error = $queue->insert("root\@$shellmachine", eval qq("$userdel") );
+    if ( $error ) {
+      $dbh->rollback if $oldAutoCommit;
+      return "queueing job (transaction rolled back): $error";
+    }
+
+  }
+
+  if ( $cyrus_server ) {
+    my $queue = new FS::queue { 'job' => 'FS::svc_acct::cyrus_delete' };
+    $error = $queue->insert($self->username);
+    if ( $error ) {
+      $dbh->rollback if $oldAutoCommit;
+      return "queueing job (transaction rolled back): $error";
+    }
+  }
+  if ( $icradius_dbh ) {
+    my $queue = new FS::queue { 'job' => 'FS::svc_acct::icradius_rc_delete' };
+    $error = $queue->insert( $self->username );
+    if ( $error ) {
+      $dbh->rollback if $oldAutoCommit;
+      return "queueing job (transaction rolled back): $error";
+    }
   }
 
+  $dbh->commit or die $dbh->errstr if $oldAutoCommit;
   '';
 }
 
+sub cyrus_delete {
+  my $username = shift; 
+
+  my $client = Cyrus::IMAP::Admin->new($cyrus_server);
+  $client->authenticate(
+    -user      => $cyrus_admin_user,
+    -mechanism => "login",       
+    -password  => $cyrus_admin_pass
+  );
+
+  my $rc = $client->setacl("user.$username", $cyrus_admin_user => 'all' );
+  my $error = $client->error;
+  die $error if $error;
+
+  $rc = $client->delete("user.$username");
+  $error = $client->error;
+  die $error if $error;
+
+  1;
+}
+
+sub icradius_rc_delete {
+  my $username = shift;
+  
+  my $sth = $icradius_dbh->prepare(
+    'DELETE FROM radcheck WHERE UserName = ?'
+  );
+  $sth->execute($username)
+    or die "can't delete from radcheck table: ". $sth->errstr;
+
+  1;
+}
+
 =item replace OLD_RECORD
 
 Replaces OLD_RECORD with this one in the database.  If there is an error,
@@ -312,9 +507,10 @@ returns the error, otherwise returns false.
 
 If the configuration value (see L<FS::Conf>) shellmachine exists, and the 
 dir field has changed, the command(s) specified in the shellmachine-usermod
-configuraiton file are executed on shellmachine via ssh.  This behavior can
+configuraiton file are added to the job queue (see L<FS::queue> and
+L<freeside-queued>) to be executed on shellmachine via ssh.  This behavior can
 be surpressed by setting $FS::svc-acct::nossh_hack true.  If the
-shellmachine-userdel configuration file does not exist or is empty, :
+shellmachine-userdel configuration file does not exist or is empty,
 
   [ -d $old_dir ] && mv $old_dir $new_dir || (
     chmod u+t $old_dir;
@@ -326,8 +522,8 @@ shellmachine-userdel configuration file does not exist or is empty, :
     rm -rf $old_dir
   )
 
-is executed on shellmachine via ssh.  This behaviour can be surpressed by
-setting $FS::svc_acct::nossh_hack true.
+is the default.  This behaviour can be surpressed by setting
+$FS::svc_acct::nossh_hack true.
 
 =cut
 
@@ -341,6 +537,9 @@ sub replace {
 
   return "Can't change uid!" if $old->uid != $new->uid;
 
+  return "can't change username using Cyrus"
+    if $cyrus_server && $old->username ne $new->username;
+
   #change homdir when we change username
   $new->setfield('dir', '') if $old->username ne $new->username;
 
@@ -351,8 +550,15 @@ sub replace {
   local $SIG{TSTP} = 'IGNORE';
   local $SIG{PIPE} = 'IGNORE';
 
+  my $oldAutoCommit = $FS::UID::AutoCommit;
+  local $FS::UID::AutoCommit = 0;
+  my $dbh = dbh;
+
   $error = $new->SUPER::replace($old);
-  return $error if $error;
+  if ( $error ) {
+    $dbh->rollback if $oldAutoCommit;
+    return $error if $error;
+  }
 
   my ( $old_dir, $new_dir, $uid, $gid ) = (
     $old->getfield('dir'),
@@ -361,12 +567,41 @@ sub replace {
     $new->getfield('gid'),
   );
   if ( $old_dir && $new_dir && $old_dir ne $new_dir && ! $nossh_hack ) {
-    ssh("root\@$shellmachine", eval qq("$usermod") );
+    my $queue = new FS::queue { 'job' => 'FS::svc_acct::ssh' };
+    $error = $queue->insert("root\@$shellmachine", eval qq("$usermod") );
+    if ( $error ) {
+      $dbh->rollback if $oldAutoCommit;
+      return "queueing job (transaction rolled back): $error";
+    }
+  }
+
+  if ( $icradius_dbh ) {
+    my $queue = new FS::queue { 'job' => 'FS::svc_acct::icradius_rc_replace' };
+    $error = $queue->insert( $new->username,
+                             $new->_password,
+                           );
+    if ( $error ) {
+      $dbh->rollback if $oldAutoCommit;
+      return "queueing job (transaction rolled back): $error";
+    }
   }
 
+  $dbh->commit or die $dbh->errstr if $oldAutoCommit;
   ''; #no error
 }
 
+sub icradius_rc_replace {
+  my( $username, $new_password ) = @_;
+ 
+   my $sth = $icradius_dbh->prepare(
+     "UPDATE radcheck SET Value = ? WHERE UserName = ? and Attribute = ?"
+   );
+   $sth->execute($new_password, $username, 'Password' )
+     or die "can't update radcheck table: ". $sth->errstr;
+
+  1;
+}
+
 =item suspend
 
 Suspends this account by prefixing *SUSPENDED* to the password.  If there is an
@@ -440,14 +675,24 @@ sub check {
   return $error if $error;
 
   my $ulen = $usernamemax || $self->dbdef_table->column('username')->length;
-  $recref->{username} =~ /^([a-z0-9_\-\.]{$usernamemin,$ulen})$/
-    or return "Illegal username";
-  $recref->{username} = $1;
+  if ( $username_uppercase ) {
+    $recref->{username} =~ /^([a-z0-9_\-\.]{$usernamemin,$ulen})$/i
+      or return "Illegal username: ". $recref->{username};
+    $recref->{username} = $1;
+  } else {
+    $recref->{username} =~ /^([a-z0-9_\-\.]{$usernamemin,$ulen})$/
+      or return "Illegal username: ". $recref->{username};
+    $recref->{username} = $1;
+  }
+
   if ( $username_letterfirst ) {
     $recref->{username} =~ /^[a-z]/ or return "Illegal username";
   } elsif ( $username_letter ) {
     $recref->{username} =~ /[a-z]/ or return "Illegal username";
   }
+  if ( $username_noperiod ) {
+    $recref->{username} =~ /\./ and return "Illegal username";
+  }
 
   $recref->{popnum} =~ /^(\d*)$/ or return "Illegal popnum: ".$recref->{popnum};
   $recref->{popnum} = $1;
@@ -455,7 +700,7 @@ sub check {
     ! $recref->{popnum} ||
     qsearchs('svc_acct_pop',{'popnum'=> $recref->{popnum} } );
 
-  unless ( $part_svc->getfield('svc_acct__uid_flag') eq 'F' ) {
+  unless ( $part_svc->part_svc_column('uid')->columnflag eq 'F' ) {
 
     $recref->{uid} =~ /^(\d*)$/ or return "Illegal uid";
     $recref->{uid} = $1 eq '' ? $self->unique('uid') : $1;
@@ -468,15 +713,30 @@ sub check {
     return "Only root can have uid 0"
       if $recref->{uid} == 0 && $recref->{username} ne 'root';
 
-    $error = $self->ut_textn('finger');
-    return $error if $error;
+#    $error = $self->ut_textn('finger');
+#    return $error if $error;
+    $self->getfield('finger') =~
+      /^([\w \t\!\@\#\$\%\&\(\)\-\+\;\:\'\"\,\.\?\/\*\<\>]*)$/
+        or return "Illegal finger: ". $self->getfield('finger');
+    $self->setfield('finger', $1);
 
     $recref->{dir} =~ /^([\/\w\-]*)$/
       or return "Illegal directory";
-    $recref->{dir} = $1 || 
-      $dir_prefix . '/' . $recref->{username}
-      #$dir_prefix . '/' . substr($recref->{username},0,1). '/' . $recref->{username}
+    $recref->{dir} = $1;
+    unless ( $recref->{dir} ) {
+      $recref->{dir} = $dir_prefix . '/';
+      if ( $dirhash > 0 ) {
+        for my $h ( 1 .. $dirhash ) {
+          $recref->{dir} .= substr($recref->{username}, $h-1, 1). '/';
+        }
+      } elsif ( $dirhash < 0 ) {
+        for my $h ( reverse $dirhash .. -1 ) {
+          $recref->{dir} .= substr($recref->{username}, $h, 1). '/';
+        }
+      }
+      $recref->{dir} .= $recref->{username};
     ;
+    }
 
     unless ( $recref->{username} eq 'sync' ) {
       if ( grep $_ eq $recref->{shell}, @shells ) {
@@ -505,7 +765,7 @@ sub check {
       return "Can't have quota without uid" : ( $recref->{quota}='' );
   }
 
-  unless ( $part_svc->getfield('svc_acct__slipip_flag') eq 'F' ) {
+  unless ( $part_svc->part_svc_column('slipip')->columnflag eq 'F' ) {
     unless ( $recref->{slipip} eq '0e0' ) {
       $recref->{slipip} =~ /^(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/
         or return "Illegal slipip". $self->slipip;
@@ -575,8 +835,8 @@ sub radius_reply {
   map {
     /^(radius_(.*))$/;
     my($column, $attrib) = ($1, $2);
-    $attrib =~ s/_/\-/g;
-    ( $attrib, $self->getfield($column) );
+    #$attrib =~ s/_/\-/g;
+    ( $FS::raddb::attrib{lc($attrib)}, $self->getfield($column) );
   } grep { /^radius_/ && $self->getfield($_) } fields( $self->table );
 }
 
@@ -595,8 +855,8 @@ sub radius_check {
   map {
     /^(rc_(.*))$/;
     my($column, $attrib) = ($1, $2);
-    $attrib =~ s/_/\-/g;
-    ( $attrib, $self->getfield($column) );
+    #$attrib =~ s/_/\-/g;
+    ( $FS::raddb::attrib{lc($attrib)}, $self->getfield($column) );
   } grep { /^rc_/ && $self->getfield($_) } fields( $self->table );
 }
 
@@ -604,13 +864,17 @@ sub radius_check {
 
 Returns the domain associated with this account.
 
--cut
+=cut
 
 sub domain {
   my $self = shift;
-  my $svc_domain = qsearchs( 'svc_domain', { 'svcnum' => $self->domsvc } )
-    or die "svc_acct.domsvc ". $self->domsvc." not found in svc_domain.svcnum";
-  $svc_domain->domain;
+  if ( $self->domsvc ) {
+    my $svc_domain = qsearchs( 'svc_domain', { 'svcnum' => $self->domsvc } )
+      or die "no svc_domain.svcnum for svc_acct.domsvc ". $self->domsvc;
+    $svc_domain->domain;
+  } else {
+    $mydomain or die "svc_acct.domsvc is null and no legacy domain config file";
+  }
 }
 
 =item email
@@ -624,11 +888,39 @@ sub email {
   $self->username. '@'. $self->domain;
 }
 
+=item ssh
+
+=cut
+
+sub ssh {
+  my ( $host, @cmd_and_args ) = @_;
+
+  use IO::File;
+  my $reader = IO::File->new();
+  my $writer = IO::File->new();
+  my $error = IO::File->new();
+
+  &Net::SSH::sshopen3( $host, $reader, $writer, $error, @cmd_and_args) or die $!;
+
+  local $/ = undef;
+  my $output_stream = <$writer>;
+  my $error_stream = <$error>;
+  if ( length $error_stream ) {
+    #warn "[FS::svc_acct::ssh] STDERR $error_stream";
+    die "[FS::svc_acct::ssh] STDERR $error_stream";
+  }
+  if ( length $output_stream ) {
+    warn "[FS::svc_acct::ssh] STDOUT $output_stream";
+  }
+
+#  &Net::SSH::ssh(@args,">>/usr/local/etc/freeside/sshoutput 2>&1");
+}
+
 =back
 
 =head1 VERSION
 
-$Id: svc_acct.pm,v 1.26 2001-08-20 11:04:38 ivan Exp $
+$Id: svc_acct.pm,v 1.50 2001-10-02 11:10:19 ivan Exp $
 
 =head1 BUGS
 
@@ -644,7 +936,8 @@ counterintuitive.
 =head1 SEE ALSO
 
 L<FS::svc_Common>, L<FS::Record>, L<FS::Conf>, L<FS::cust_svc>,
-L<FS::part_svc>, L<FS::cust_pkg>, L<Net::SSH>, L<ssh>, L<FS::svc_acct_pop>,
+L<FS::part_svc>, L<FS::cust_pkg>, L<FS::queue>, L<freeside-queued>),
+L<Net::SSH>, L<ssh>, L<FS::svc_acct_pop>,
 schema.html from the base documentation.
 
 =cut