feat: RBAC + SAML support

files/admin.py

@@ -1,4 +1,10 @@
+from django import forms
+from django.conf import settings
 from django.contrib import admin
+from django.core.exceptions import ValidationError
+from django.db import transaction
+
+from rbac.models import RBACGroup
 
 from .models import (
     Category,
@@ -49,12 +55,126 @@ class MediaAdmin(admin.ModelAdmin):
     get_comments_count.short_description = "Comments count"
 
 
+class CategoryAdminForm(forms.ModelForm):
+    rbac_groups = forms.ModelMultipleChoiceField(queryset=RBACGroup.objects.all(), required=False, widget=admin.widgets.FilteredSelectMultiple('Groups', False))
+
+    class Meta:
+        model = Category
+        fields = '__all__'
+
+    def clean(self):
+        cleaned_data = super().clean()
+        is_rbac_category = cleaned_data.get('is_rbac_category')
+        identity_provider = cleaned_data.get('identity_provider')
+        # Check if this category has any RBAC groups
+        if self.instance.pk:
+            has_rbac_groups = cleaned_data.get('rbac_groups')
+        else:
+            has_rbac_groups = False
+
+        if not is_rbac_category:
+            if has_rbac_groups:
+                cleaned_data['is_rbac_category'] = True
+                # self.add_error('is_rbac_category', ValidationError('This category has RBAC groups assigned. "Is RBAC Category" must be enabled.'))
+
+        for rbac_group in cleaned_data.get('rbac_groups'):
+            if rbac_group.identity_provider != identity_provider:
+                self.add_error('rbac_groups', ValidationError('Chosen Groups are associated with a different Identity Provider than the one selected here.'))
+
+        return cleaned_data
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+
+        if self.instance.pk:
+            self.fields['rbac_groups'].initial = self.instance.rbac_groups.all()
+
+    def save(self, commit=True):
+        category = super().save(commit=True)
+
+        if commit:
+            self.save_m2m()
+
+        if self.instance.rbac_groups.exists() or self.cleaned_data.get('rbac_groups'):
+            if not self.cleaned_data['is_rbac_category']:
+                category.is_rbac_category = True
+                category.save(update_fields=['is_rbac_category'])
+        return category
+
+    @transaction.atomic
+    def save_m2m(self):
+        if self.instance.pk:
+            rbac_groups = self.cleaned_data['rbac_groups']
+            self._update_rbac_groups(rbac_groups)
+
+    def _update_rbac_groups(self, rbac_groups):
+        new_rbac_group_ids = RBACGroup.objects.filter(pk__in=rbac_groups).values_list('pk', flat=True)
+
+        existing_rbac_groups = RBACGroup.objects.filter(categories=self.instance)
+        existing_rbac_groups_ids = existing_rbac_groups.values_list('pk', flat=True)
+
+        rbac_groups_to_add = RBACGroup.objects.filter(pk__in=new_rbac_group_ids).exclude(pk__in=existing_rbac_groups_ids)
+        rbac_groups_to_remove = existing_rbac_groups.exclude(pk__in=new_rbac_group_ids)
+
+        for rbac_group in rbac_groups_to_add:
+            rbac_group.categories.add(self.instance)
+
+        for rbac_group in rbac_groups_to_remove:
+            rbac_group.categories.remove(self.instance)
+
+
 class CategoryAdmin(admin.ModelAdmin):
-    search_fields = ["title"]
-    list_display = ["title", "user", "add_date", "is_global", "media_count"]
-    list_filter = ["is_global"]
+    form = CategoryAdminForm
+
+    search_fields = ["title", "uid"]
+    list_display = ["title", "user", "add_date", "media_count"]
+    list_filter = []
     ordering = ("-add_date",)
     readonly_fields = ("user", "media_count")
+    change_form_template = 'admin/files/category/change_form.html'
+
+    def get_list_filter(self, request):
+        list_filter = list(self.list_filter)
+
+        if getattr(settings, 'USE_RBAC', False):
+            list_filter.insert(0, "is_rbac_category")
+        if getattr(settings, 'USE_IDENTITY_PROVIDERS', False):
+            list_filter.insert(-1, "identity_provider")
+
+        return list_filter
+
+    def get_list_display(self, request):
+        list_display = list(self.list_display)
+        if getattr(settings, 'USE_RBAC', False):
+            list_display.insert(-1, "is_rbac_category")
+        if getattr(settings, 'USE_IDENTITY_PROVIDERS', False):
+            list_display.insert(-1, "identity_provider")
+
+        return list_display
+
+    def get_fieldsets(self, request, obj=None):
+        basic_fieldset = [
+            (
+                'Category Information',
+                {
+                    'fields': ['uid', 'title', 'description', 'user', 'media_count', 'thumbnail', 'listings_thumbnail'],
+                },
+            ),
+        ]
+
+        if getattr(settings, 'USE_RBAC', False):
+            rbac_fieldset = [
+                ('RBAC Settings', {'fields': ['is_rbac_category'], 'classes': ['tab'], 'description': 'Role-Based Access Control settings'}),
+                ('Group Access', {'fields': ['rbac_groups'], 'description': 'Select the Groups that have access to category'}),
+            ]
+            if getattr(settings, 'USE_IDENTITY_PROVIDERS', False):
+                rbac_fieldset = [
+                    ('RBAC Settings', {'fields': ['is_rbac_category', 'identity_provider'], 'classes': ['tab'], 'description': 'Role-Based Access Control settings'}),
+                    ('Group Access', {'fields': ['rbac_groups'], 'description': 'Select the Groups that have access to category'}),
+                ]
+            return basic_fieldset + rbac_fieldset
+        else:
+            return basic_fieldset
 
 
 class TagAdmin(admin.ModelAdmin):
@@ -102,3 +222,5 @@ admin.site.register(Category, CategoryAdmin)
 admin.site.register(Tag, TagAdmin)
 admin.site.register(Subtitle, SubtitleAdmin)
 admin.site.register(Language, LanguageAdmin)
+
+Media._meta.app_config.verbose_name = "Media"

files/context_processors.py

@@ -34,6 +34,7 @@ def stuff(request):
     ret["RSS_URL"] = "/rss"
     ret["TRANSLATION"] = get_translation(request.LANGUAGE_CODE)
     ret["REPLACEMENTS"] = get_translation_strings(request.LANGUAGE_CODE)
+    ret["USE_SAML"] = settings.USE_SAML
     if request.user.is_superuser:
         ret["DJANGO_ADMIN_URL"] = settings.DJANGO_ADMIN_URL
 

files/forms.py

@@ -1,7 +1,8 @@
 from django import forms
+from django.conf import settings
 
 from .methods import get_next_state, is_mediacms_editor
-from .models import Media, Subtitle
+from .models import Category, Media, Subtitle
 
 
 class MultipleSelect(forms.CheckboxSelectMultiple):
@@ -41,6 +42,25 @@ class MediaForm(forms.ModelForm):
             self.fields.pop("featured")
             self.fields.pop("reported_times")
             self.fields.pop("is_reviewed")
+        #           if settings.PORTAL_WORKFLOW == 'private':
+        #                self.fields.pop("state")
+
+        if getattr(settings, 'USE_RBAC', False) and 'category' in self.fields:
+            if is_mediacms_editor(user):
+                pass
+            else:
+                self.fields['category'].initial = self.instance.category.all()
+
+                non_rbac_categories = Category.objects.filter(is_rbac_category=False)
+                rbac_categories = user.get_rbac_categories_as_contributor()
+                combined_category_ids = list(non_rbac_categories.values_list('id', flat=True)) + list(rbac_categories.values_list('id', flat=True))
+
+                if self.instance.pk:
+                    instance_category_ids = list(self.instance.category.all().values_list('id', flat=True))
+                    combined_category_ids = list(set(combined_category_ids + instance_category_ids))
+
+                self.fields['category'].queryset = Category.objects.filter(id__in=combined_category_ids).order_by('title')
+
         self.fields["new_tags"].initial = ", ".join([tag.title for tag in self.instance.tags.all()])
 
     def clean_uploaded_poster(self):

files/migrations/0004_alter_subtitle_options_category_identity_provider_and_more.py

@@ -0,0 +1,41 @@
+# Generated by Django 5.1.6 on 2025-03-18 17:40
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ('files', '0003_auto_20210927_1245'),
+        ('socialaccount', '0006_alter_socialaccount_extra_data'),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name='subtitle',
+            options={'ordering': ['language__title']},
+        ),
+        migrations.AddField(
+            model_name='category',
+            name='identity_provider',
+            field=models.ForeignKey(
+                blank=True,
+                help_text='If category is related with a specific Identity Provider',
+                null=True,
+                on_delete=django.db.models.deletion.CASCADE,
+                related_name='categories',
+                to='socialaccount.socialapp',
+                verbose_name='IDP Config Name',
+            ),
+        ),
+        migrations.AddField(
+            model_name='category',
+            name='is_rbac_category',
+            field=models.BooleanField(db_index=True, default=False, help_text='If access to Category is controlled by role based membership of Groups'),
+        ),
+        migrations.AlterField(
+            model_name='media',
+            name='state',
+            field=models.CharField(choices=[('private', 'Private'), ('public', 'Public'), ('unlisted', 'Unlisted')], db_index=True, default='private', help_text='state of Media', max_length=20),
+        ),
+    ]

files/migrations/0005_alter_category_uid.py

@@ -0,0 +1,19 @@
+# Generated by Django 5.1.6 on 2025-03-25 14:13
+
+from django.db import migrations, models
+
+import files.models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ('files', '0004_alter_subtitle_options_category_identity_provider_and_more'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='category',
+            name='uid',
+            field=models.CharField(default=files.models.generate_uid, max_length=36, unique=True),
+        ),
+    ]

files/migrations/0006_alter_category_title.py

@@ -0,0 +1,17 @@
+# Generated by Django 5.1.6 on 2025-03-27 09:11
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ('files', '0005_alter_category_uid'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='category',
+            name='title',
+            field=models.CharField(db_index=True, max_length=100),
+        ),
+    ]

files/models.py

@@ -18,6 +18,7 @@ from django.db.models.signals import m2m_changed, post_delete, post_save, pre_de
 from django.dispatch import receiver
 from django.urls import reverse
 from django.utils import timezone
+from django.utils.crypto import get_random_string
 from django.utils.html import strip_tags
 from imagekit.models import ProcessedImageField
 from imagekit.processors import ResizeToFit
@@ -83,6 +84,10 @@ ENCODE_EXTENSIONS_KEYS = [extension for extension, name in ENCODE_EXTENSIONS]
 ENCODE_RESOLUTIONS_KEYS = [resolution for resolution, name in ENCODE_RESOLUTIONS]
 
 
+def generate_uid():
+    return get_random_string(length=16)
+
+
 def original_media_file_path(instance, filename):
     """Helper function to place original media file"""
     file_name = "{0}.{1}".format(instance.uid.hex, helpers.get_file_name(filename))
@@ -957,11 +962,11 @@ class License(models.Model):
 class Category(models.Model):
     """A Category base model"""
 
-    uid = models.UUIDField(unique=True, default=uuid.uuid4)
+    uid = models.CharField(unique=True, max_length=36, default=generate_uid)
 
     add_date = models.DateTimeField(auto_now_add=True)
 
-    title = models.CharField(max_length=100, unique=True, db_index=True)
+    title = models.CharField(max_length=100, db_index=True)
 
     description = models.TextField(blank=True)
 
@@ -981,6 +986,18 @@ class Category(models.Model):
 
     listings_thumbnail = models.CharField(max_length=400, blank=True, null=True, help_text="Thumbnail to show on listings")
 
+    is_rbac_category = models.BooleanField(default=False, db_index=True, help_text='If access to Category is controlled by role based membership of Groups')
+
+    identity_provider = models.ForeignKey(
+        'socialaccount.SocialApp',
+        blank=True,
+        null=True,
+        on_delete=models.CASCADE,
+        related_name='categories',
+        help_text='If category is related with a specific Identity Provider',
+        verbose_name='IDP Config Name',
+    )
+
     def __str__(self):
         return self.title
 
@@ -994,7 +1011,11 @@ class Category(models.Model):
     def update_category_media(self):
         """Set media_count"""
 
-        self.media_count = Media.objects.filter(listable=True, category=self).count()
+        if getattr(settings, 'USE_RBAC', False) and self.is_rbac_category:
+            self.media_count = Media.objects.filter(category=self).count()
+        else:
+            self.media_count = Media.objects.filter(listable=True, category=self).count()
+
         self.save(update_fields=["media_count"])
         return True
 

files/serializers.py

@@ -1,5 +1,7 @@
+from django.conf import settings
 from rest_framework import serializers
 
+from .methods import is_mediacms_editor
 from .models import Category, Comment, EncodeProfile, Media, Playlist, Tag
 
 # TODO: put them in a more DRY way
@@ -76,8 +78,25 @@ class MediaSerializer(serializers.ModelSerializer):
             "featured",
             "user_featured",
             "size",
+            # "category",
         )
 
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        request = self.context.get('request')
+
+        if False and request and 'category' in self.fields:
+            # this is not working
+            user = request.user
+            if is_mediacms_editor(user):
+                pass
+            else:
+                if getattr(settings, 'USE_RBAC', False):
+                    # Filter category queryset based on user permissions
+                    non_rbac_categories = Category.objects.filter(is_rbac_category=False)
+                    rbac_categories = user.get_rbac_categories_as_contributor()
+                    self.fields['category'].queryset = non_rbac_categories.union(rbac_categories)
+
 
 class SingleMediaSerializer(serializers.ModelSerializer):
     user = serializers.ReadOnlyField(source="user.username")

files/urls.py

@@ -1,3 +1,4 @@
+from allauth.account.views import LoginView
 from django.conf import settings
 from django.conf.urls import include
 from django.conf.urls.static import static
@@ -93,5 +94,14 @@ urlpatterns = [
     re_path(r"^manage/users$", views.manage_users, name="manage_users"),
 ] + static(settings.MEDIA_URL, document_root=settings.MEDIA_ROOT)
 
+if hasattr(settings, "USE_SAML") and settings.USE_SAML:
+    urlpatterns.append(re_path(r"^saml/metadata", views.saml_metadata, name="saml-metadata"))
+
+if hasattr(settings, "USE_IDENTITY_PROVIDERS") and settings.USE_IDENTITY_PROVIDERS:
+    urlpatterns.append(path('accounts/login_system', LoginView.as_view(), name='login_system'))
+    urlpatterns.append(re_path(r"^accounts/login", views.custom_login_view, name='login'))
+else:
+    urlpatterns.append(path('accounts/login', LoginView.as_view(), name='login_system'))
+
 if hasattr(settings, "GENERATE_SITEMAP") and settings.GENERATE_SITEMAP:
     urlpatterns.append(path("sitemap.xml", views.sitemap, name="sitemap"))

files/views.py

@@ -1,13 +1,15 @@
 from datetime import datetime, timedelta
 
+from allauth.socialaccount.models import SocialApp
 from django.conf import settings
 from django.contrib import messages
 from django.contrib.auth.decorators import login_required
 from django.contrib.postgres.search import SearchQuery
 from django.core.mail import EmailMessage
 from django.db.models import Q
-from django.http import HttpResponse, HttpResponseRedirect
-from django.shortcuts import get_object_or_404, render
+from django.http import Http404, HttpResponse, HttpResponseRedirect
+from django.shortcuts import get_object_or_404, redirect, render
+from django.urls import reverse
 from drf_yasg import openapi as openapi
 from drf_yasg.utils import swagger_auto_schema
 from rest_framework import permissions, status
@@ -30,6 +32,8 @@ from cms.permissions import (
     IsUserOrEditor,
     user_allowed_to_upload,
 )
+from cms.version import VERSION
+from identity_providers.models import LoginOption
 from users.models import User
 
 from .forms import ContactForm, EditSubtitleForm, MediaForm, SubtitleForm
@@ -77,7 +81,7 @@ VALID_USER_ACTIONS = [action for action, name in USER_MEDIA_ACTIONS]
 def about(request):
     """About view"""
 
-    context = {}
+    context = {"VERSION": VERSION}
     return render(request, "cms/about.html", context)
 
 
@@ -387,6 +391,7 @@ def tos(request):
     return render(request, "cms/tos.html", context)
 
 
+@login_required
 def upload_media(request):
     """Upload media view"""
 
@@ -535,9 +540,10 @@ class MediaDetail(APIView):
             # this need be explicitly called, and will call
             # has_object_permission() after has_permission has succeeded
             self.check_object_permissions(self.request, media)
-
             if media.state == "private" and not (self.request.user == media.user or is_mediacms_editor(self.request.user)):
-                if (not password) or (not media.password) or (password != media.password):
+                if getattr(settings, 'USE_RBAC', False) and self.request.user.is_authenticated and self.request.user.has_member_access_to_media(media):
+                    pass
+                elif (not password) or (not media.password) or (password != media.password):
                     return Response(
                         {"detail": "media is private"},
                         status=status.HTTP_401_UNAUTHORIZED,
@@ -812,7 +818,7 @@ class MediaActions(APIView):
 
 class MediaSearch(APIView):
     """
-    Retrieve results for searc
+    Retrieve results for search
     Only GET is implemented here
     """
 
@@ -872,6 +878,11 @@ class MediaSearch(APIView):
 
         if category:
             media = media.filter(category__title__contains=category)
+            if getattr(settings, 'USE_RBAC', False) and request.user.is_authenticated:
+                c_object = Category.objects.filter(title=category, is_rbac_category=True).first()
+                if c_object and request.user.has_member_access_to_category(c_object):
+                    # show all media where user has access based on RBAC
+                    media = Media.objects.filter(category=c_object)
 
         if media_type:
             media = media.filter(media_type=media_type)
@@ -1416,7 +1427,17 @@ class CategoryList(APIView):
         },
     )
     def get(self, request, format=None):
-        categories = Category.objects.filter().order_by("title")
+        if is_mediacms_editor(request.user):
+            categories = Category.objects.filter()
+        else:
+            categories = Category.objects.filter(is_rbac_category=False)
+
+            if getattr(settings, 'USE_RBAC', False) and request.user.is_authenticated:
+                rbac_categories = request.user.get_rbac_categories_as_member()
+                categories = categories.union(rbac_categories)
+
+        categories = categories.order_by("title")
+
         serializer = CategorySerializer(categories, many=True, context={"request": request})
         ret = serializer.data
         return Response(ret)
@@ -1484,3 +1505,38 @@ class TaskDetail(APIView):
         # This is not imported!
         # revoke(uid, terminate=True)
         return Response(status=status.HTTP_204_NO_CONTENT)
+
+
+def saml_metadata(request):
+    if not (hasattr(settings, "USE_SAML") and settings.USE_SAML):
+        raise Http404
+
+    xml_parts = ['<?xml version="1.0"?>']
+    saml_social_apps = SocialApp.objects.filter(provider='saml')
+    entity_id = f"{settings.FRONTEND_HOST}/saml/metadata/"
+    xml_parts.append(f'<md:EntitiesDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" Name="{entity_id}">')  # noqa
+    xml_parts.append(f'    <md:EntityDescriptor entityID="{entity_id}">')  # noqa
+    xml_parts.append('        <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">')  # noqa
+
+    # Add multiple AssertionConsumerService elements with different indices
+    for index, app in enumerate(saml_social_apps, start=1):
+        xml_parts.append(
+            f'            <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" '  # noqa
+            f'Location="{settings.FRONTEND_HOST}/accounts/saml/{app.client_id}/acs/" index="{index}"/>'  # noqa
+        )
+
+    xml_parts.append('        </md:SPSSODescriptor>')  # noqa
+    xml_parts.append('    </md:EntityDescriptor>')  # noqa
+    xml_parts.append('</md:EntitiesDescriptor>')  # noqa
+    metadata_xml = '\n'.join(xml_parts)
+    return HttpResponse(metadata_xml, content_type='application/xml')
+
+
+def custom_login_view(request):
+    if not (hasattr(settings, "USE_IDENTITY_PROVIDERS") and settings.USE_IDENTITY_PROVIDERS):
+        return redirect(reverse('login_system'))
+
+    login_options = []
+    for option in LoginOption.objects.filter(active=True):
+        login_options.append({'url': option.url, 'title': option.title})
+    return render(request, 'account/custom_login_selector.html', {'login_options': login_options})