feat(user): implement alumni command

middle step before offboarding/deletion

Author: thekaveman

compiler_admin/commands/user/__init__.py

@@ -1,5 +1,6 @@
 from argparse import Namespace
 
+from compiler_admin.commands.user.alumni import alumni  # noqa: F401
 from compiler_admin.commands.user.create import create  # noqa: F401
 from compiler_admin.commands.user.convert import convert  # noqa: F401
 from compiler_admin.commands.user.delete import delete  # noqa: F401

compiler_admin/commands/user/alumni.py

@@ -0,0 +1,71 @@
+from argparse import Namespace
+
+from compiler_admin import RESULT_FAILURE, RESULT_SUCCESS
+from compiler_admin.commands.user.reset import reset
+from compiler_admin.services.google import (
+    OU_ALUMNI,
+    CallGAMCommand,
+    move_user_ou,
+    user_account_name,
+    user_exists,
+)
+
+
+def alumni(args: Namespace) -> int:
+    """Convert a user to a Compiler alumni.
+
+    Optionally notify an email address with the new randomly generated password.
+
+    Args:
+        username (str): the user account to convert.
+
+        notify (str): an email address to send the new password notification.
+    Returns:
+        A value indicating if the operation succeeded or failed.
+    """
+    if not hasattr(args, "username"):
+        raise ValueError("username is required")
+
+    account = user_account_name(args.username)
+
+    if not user_exists(account):
+        print(f"User does not exist: {account}")
+        return RESULT_FAILURE
+
+    if getattr(args, "force", False) is False:
+        cont = input(f"Convert account to alumni for {account}? (Y/n)")
+        if not cont.lower().startswith("y"):
+            print("Aborting conversion.")
+            return RESULT_SUCCESS
+
+    res = RESULT_SUCCESS
+
+    print("Removing from groups")
+    res += CallGAMCommand(("user", account, "delete", "groups"))
+
+    print(f"Moving to OU: {OU_ALUMNI}")
+    res += move_user_ou(account, OU_ALUMNI)
+
+    # reset password, sign out
+    res += reset(args)
+
+    print("Clearing user profile info")
+    for prop in ["address", "location", "otheremail", "phone"]:
+        command = ("update", "user", account, prop, "clear")
+        res += CallGAMCommand(command)
+
+    print("Resetting recovery email")
+    recovery = getattr(args, "recovery_email", "")
+    command = ("update", "user", account, "recoveryemail", recovery)
+    res += CallGAMCommand(command)
+
+    print("Resetting recovery phone")
+    recovery = getattr(args, "recovery_phone", "")
+    command = ("update", "user", account, "recoveryphone", recovery)
+    res += CallGAMCommand(command)
+
+    print("Turning off 2FA")
+    command = ("user", account, "turnoff2sv")
+    res += CallGAMCommand(command)
+
+    return res

compiler_admin/main.py

@@ -133,6 +133,12 @@ def setup_user_command(cmd_parsers: _SubParsersAction):
     user_cmd.set_defaults(func=user)
     user_subcmds = add_sub_cmd_parser(user_cmd, help="The user command to run.")
 
+    user_alumni = add_sub_cmd_with_username_arg(user_subcmds, "alumni", help="Convert a user account to a Compiler alumni.")
+    user_alumni.add_argument("--notify", help="An email address to send the alumni's new password.")
+    user_alumni.add_argument(
+        "--force", action="store_true", default=False, help="Don't ask for confirmation before conversion."
+    )
+
     user_create = add_sub_cmd_with_username_arg(user_subcmds, "create", help="Create a new user in the Compiler domain.")
     user_create.add_argument("--notify", help="An email address to send the newly created account info.")
 

compiler_admin/services/google.py

@@ -17,6 +17,7 @@
 DOMAIN = "compiler.la"
 
 # Org structure
+OU_ALUMNI = "alumni"
 OU_CONTRACTORS = "contractors"
 OU_STAFF = "staff"
 OU_PARTNERS = f"{OU_STAFF}/partners"
@@ -77,7 +78,7 @@ def add_user_to_group(username: str, group: str) -> int:
 
 
 def move_user_ou(username: str, ou: str) -> int:
-    """Remove a user from a group."""
+    """Move a user into a new OU."""
     return CallGAMCommand(("update", "ou", ou, "move", username))
 
 

tests/commands/user/test_alumni.py

@@ -0,0 +1,102 @@
+from argparse import Namespace
+import pytest
+
+from compiler_admin import RESULT_FAILURE, RESULT_SUCCESS
+from compiler_admin.commands.user.alumni import alumni, __name__ as MODULE
+from compiler_admin.services.google import OU_ALUMNI
+
+
+@pytest.fixture
+def mock_commands_reset(mock_commands_reset):
+    return mock_commands_reset(MODULE)
+
+
+@pytest.fixture
+def mock_input_yes(mock_input):
+    fix = mock_input(MODULE)
+    fix.return_value = "y"
+    return fix
+
+
+@pytest.fixture
+def mock_input_no(mock_input):
+    fix = mock_input(MODULE)
+    fix.return_value = "n"
+    return fix
+
+
+@pytest.fixture
+def mock_google_CallGAMCommand(mock_google_CallGAMCommand):
+    return mock_google_CallGAMCommand(MODULE)
+
+
+@pytest.fixture
+def mock_google_move_user_ou(mock_google_move_user_ou):
+    return mock_google_move_user_ou(MODULE)
+
+
+@pytest.fixture
+def mock_google_remove_user_from_group(mock_google_remove_user_from_group):
+    return mock_google_remove_user_from_group(MODULE)
+
+
+@pytest.fixture
+def mock_google_user_exists(mock_google_user_exists):
+    return mock_google_user_exists(MODULE)
+
+
+def test_alumni_username_required():
+    args = Namespace()
+
+    with pytest.raises(ValueError, match="username is required"):
+        alumni(args)
+
+
+def test_alumni_user_does_not_exists(mock_google_user_exists, mock_google_CallGAMCommand):
+    mock_google_user_exists.return_value = False
+
+    args = Namespace(username="username")
+    res = alumni(args)
+
+    assert res == RESULT_FAILURE
+    mock_google_CallGAMCommand.assert_not_called()
+
+
+@pytest.mark.usefixtures("mock_input_yes")
+def test_alumni_confirm_yes(
+    mock_google_user_exists, mock_google_CallGAMCommand, mock_commands_reset, mock_google_move_user_ou
+):
+    mock_google_user_exists.return_value = True
+
+    args = Namespace(username="username", force=False)
+    res = alumni(args)
+
+    assert res == RESULT_SUCCESS
+    mock_google_CallGAMCommand.assert_called()
+    mock_google_move_user_ou.assert_called_once_with("[email protected]", OU_ALUMNI)
+    mock_commands_reset.assert_called_once_with(args)
+
+
+@pytest.mark.usefixtures("mock_input_no")
+def test_alumni_confirm_no(mock_google_user_exists, mock_google_CallGAMCommand, mock_commands_reset, mock_google_move_user_ou):
+    mock_google_user_exists.return_value = True
+
+    args = Namespace(username="username", force=False)
+    res = alumni(args)
+
+    assert res == RESULT_SUCCESS
+    mock_google_CallGAMCommand.assert_not_called()
+    mock_commands_reset.assert_not_called()
+    mock_google_move_user_ou.assert_not_called()
+
+
+def test_alumni_force(mock_google_user_exists, mock_google_CallGAMCommand, mock_commands_reset, mock_google_move_user_ou):
+    mock_google_user_exists.return_value = True
+
+    args = Namespace(username="username", force=True)
+    res = alumni(args)
+
+    assert res == RESULT_SUCCESS
+    mock_google_CallGAMCommand.assert_called()
+    mock_google_move_user_ou.assert_called_once_with("[email protected]", OU_ALUMNI)
+    mock_commands_reset.assert_called_once_with(args)

tests/test_main.py

@@ -252,6 +252,53 @@ def test_main_time_convert_output(mock_commands_time):
     )
 
 
+def test_main_user_alumni(mock_commands_user):
+    main(argv=["user", "alumni", "username"])
+
+    mock_commands_user.assert_called_once()
+    call_args = mock_commands_user.call_args.args
+    assert (
+        Namespace(func=mock_commands_user, command="user", subcommand="alumni", username="username", force=False, notify=None)
+        in call_args
+    )
+
+
+def test_main_user_alumni_notify(mock_commands_user):
+    main(argv=["user", "alumni", "username", "--notify", "notification"])
+
+    mock_commands_user.assert_called_once()
+    call_args = mock_commands_user.call_args.args
+    assert (
+        Namespace(
+            func=mock_commands_user,
+            command="user",
+            subcommand="alumni",
+            username="username",
+            force=False,
+            notify="notification",
+        )
+        in call_args
+    )
+
+
+def test_main_user_alumni_force(mock_commands_user):
+    main(argv=["user", "alumni", "username", "--force"])
+
+    mock_commands_user.assert_called_once()
+    call_args = mock_commands_user.call_args.args
+    assert (
+        Namespace(
+            func=mock_commands_user,
+            command="user",
+            subcommand="alumni",
+            username="username",
+            force=True,
+            notify=None,
+        )
+        in call_args
+    )
+
+
 def test_main_user_create(mock_commands_user):
     main(argv=["user", "create", "username"])