ldap: is an the worst kind of DB ever -_-

YunoHost · Feb 23, 2025 · 6455bd5 · 6455bd5
1 parent e174505
commit 6455bd5
Show file tree

Hide file tree

Showing 3 changed files with 37 additions and 21 deletions.
diff --git a/conf/slapd/permission.ldif b/conf/slapd/permission.ldif
@@ -24,15 +24,19 @@ olcAttributeTypes: ( 1.3.6.1.4.1.17953.9.1.5 NAME 'additionalUrls'
   SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} )
 olcAttributeTypes: ( 1.3.6.1.4.1.17953.9.1.6 NAME 'authHeader'
   DESC 'YunoHost application, enable authentication header' OBSOLETE
+  EQUALITY booleanMatch
   SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
 olcAttributeTypes: ( 1.3.6.1.4.1.17953.9.1.7 NAME 'label'
   DESC 'YunoHost permission label, also used for the tile name in the SSO' OBSOLETE
+  EQUALITY caseExactMatch
   SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} SINGLE-VALUE )
 olcAttributeTypes: ( 1.3.6.1.4.1.17953.9.1.8 NAME 'showTile'
   DESC 'YunoHost application, show/hide the tile in the SSO for this permission' OBSOLETE
+  EQUALITY booleanMatch
   SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
 olcAttributeTypes: ( 1.3.6.1.4.1.17953.9.1.9 NAME 'isProtected'
   DESC 'YunoHost application permission protection' OBSOLETE
+  EQUALITY booleanMatch
   SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
 # OBJECTCLASS
 # For Applications

diff --git a/hooks/conf_regen/06-slapd b/hooks/conf_regen/06-slapd
@@ -186,4 +186,9 @@ objectClass: top"
     systemctl force-reload slapd
 }
 
-do_$1_regen ${@:2}
+if [[ "$1" == _regenerate_slapd_conf ]]
+then
+    _regenerate_slapd_conf
+else
+    do_$1_regen ${@:2}
+fi
diff --git a/src/migrations/0033_rework_permission_infos.py b/src/migrations/0033_rework_permission_infos.py
@@ -146,24 +146,31 @@ def read_legacy_permissions(self):
 
     def delete_legacy_permissions(self):
 
-        ldap = _get_ldap_interface()
-        permissions_infos = ldap.search(
-            "ou=permission",
-            "(objectclass=permissionYnh)",
-            ["cn"],
-        )
-        for infos in permissions_infos:
-            # LDAP won't delete the old, obsolete info,
-            # we have to do it ourselves ~_~
-            ldap.update(
-                f'cn={infos["cn"][0]},ou=permission',
-                {
-                    "label": [],
-                    "authHeader": [],
-                    "showTile": [],
-                    "isProtected": [],
-                    "URL": [],
-                    "additionalUrls": [],
-                    "groupPermission": [],
-                },
+        try:
+            ldap = _get_ldap_interface()
+            permissions_infos = ldap.search(
+                "ou=permission",
+                "(objectclass=permissionYnh)",
+                ["cn"],
             )
+            # LDAP is fucking stupid, therefore we have to un-mark the attributes as obsolete
+            # to be able to empty them ...
+            # (and yeah why is this all so fucking complex why can't we just drop the column like a real DB or something...)
+            os.system("sed -i 's@ OBSOLETE$@@g' /etc/ldap/schema/permission.ldif")
+            os.system("/usr/share/yunohost/hooks/conf_regen/06-slapd _regenerate_slapd_conf")
+            os.system("systemctl restart slapd")
+            for infos in permissions_infos:
+                ldap.update(
+                    f'cn={infos["cn"][0]},ou=permission',
+                    {
+                        "label": [],
+                        "authHeader": [],
+                        "showTile": [],
+                        "isProtected": [],
+                        "URL": [],
+                        "additionalUrls": [],
+                        "groupPermission": [],
+                    },
+                )
+        finally:
+            regen_conf(["slapd"], force=True)