.gitlab-ci.yml

@@ -10,18 +10,17 @@ variables:
 stages:
     - test
 
+variables:
+    LD_LIBRARY_PATH: /opt/sqlite-compat-django/lib/
+
 before_script:
     - apt-get update -qqy
     - apt-get install -qqy python-dev
     - pip install tox
 
-#api-test-py3:
-#    stage: test
-#    script: tox -e py36
-#    coverage: '/^TOTAL.*\s+(\d+\.\d\%)\s*$/'
-#    allow_failure: true
-
-api-test-py2:
+api-test-py3:
     stage: test
-    script: tox -e py27
+    script: tox -e py36
     coverage: '/^TOTAL.*\s+(\d+\.\d\%)\s*$/'
+#    allow_failure: true
+

api/management/commands/auth_test.py

@@ -26,7 +26,7 @@ class Command(BaseCommand):
                 continue
 
             try:
-                url = user.remote_reverse("health")
+                url = user.remote_reverse("api:health")
                 r = requests.get(url, headers=headers, timeout=5)
 
                 if r.status_code == 200:

api/management/commands/check_health.py

@@ -44,7 +44,7 @@ class Command(BaseCommand):
             token = user.token()
             headers = {'Authorization': 'token ' + str(token)}
             try:
-                url = user.remote_reverse("health")
+                url = user.remote_reverse("api:health")
                 r = requests.get(url, headers=headers, timeout=5)
                 if r.status_code == 200:
                     logger.info("{} OK".format(user.username))

api/management/commands/sync_from_csv.py

 # -*- coding: utf-8 -*-
 from __future__ import unicode_literals
 
-from datetime import date, timedelta, datetime
-
-from django.conf import settings
 from django.core.management import BaseCommand
 from django.db import transaction
-from django.utils import timezone
 
-from api.models import Resource, UserType
-from api.utils.queue_utils import dispatch_deletion_sync
+from api.utils.csv_handling import sync_from_csv_data
 
 
 class Command(BaseCommand):
@@ -22,37 +17,5 @@ class Command(BaseCommand):
     def handle(self, *args, **options):
         path = options["csv"]
         date_format = options["date"]
-        eppn_dict = {}
-        with open(path, "r") as csv:
-            for line in csv.readlines():
-                line.strip()
-                eppn, d = line.strip().split(",")
-                exp_date = timezone.make_aware(datetime.strptime(d, date_format))
-                eppn_dict[eppn] = exp_date
-        # iterate over all local resources
-        for res in Resource.objects.filter(realm_idp=settings.SERVER_REALM)\
-                .select_related("sp", "sp__localresourcepolicy"):
-            try:
-                exp_date = eppn_dict[res.eppn]
-            except KeyError:
-                # eppn does no longer exist, we need to make sure that
-                #   the resource will be locked immediately
-                # deletion and purging happens as usual
-                exp_date = min(res.expiry_date, timezone.now() - timedelta(days=1))
-            delete_date = exp_date + timedelta(days=res.sp.delete_after_days)
-            purge_date = delete_date + timedelta(days=res.sp.purge_api_data_after_days)
-
-            if purge_date < timezone.now():
-                uuid = res.uuid
-                is_local_sp = res.sp.is_local
-                res.delete()
-                # if this resource belongs to a remote sp, we need to notify
-                # the sp that we deleted the resource record
-                if not is_local_sp:
-                    dispatch_deletion_sync(res, uuid)
-            else:
-                if res.expiry_date != exp_date or res.deletion_date != delete_date:
-                    res.update_attribute([
-                        {"name": "expiry_date", "value": exp_date.isoformat()},
-                        {"name": "deletion_date", "value": delete_date.isoformat()},
-                    ], user_type=UserType.TYPE_IDP)
+        with open(path, "rb") as csv:
+            sync_from_csv_data(csv, date_format)

api/migrations/0001_initial.py

@@ -100,17 +100,17 @@ class Migration(migrations.Migration):
         migrations.AddField(
             model_name='resource',
             name='sp',
-            field=models.ForeignKey(verbose_name=b'SP', to='api.ServiceProvider'),
+            field=models.ForeignKey(verbose_name=b'SP', to='api.ServiceProvider', on_delete=models.PROTECT),
         ),
         migrations.AddField(
             model_name='attribute',
             name='resource',
-            field=models.ForeignKey(related_name='attributes', to='api.Resource'),
+            field=models.ForeignKey(related_name='attributes', to='api.Resource', on_delete=models.CASCADE),
         ),
         migrations.AddField(
             model_name='tokenauthuser',
             name='sp',
-            field=models.ForeignKey(blank=True, to='api.ServiceProvider', help_text=b'Must be set for type SP!', null=True, verbose_name=b'SP'),
+            field=models.ForeignKey(blank=True, to='api.ServiceProvider', help_text=b'Must be set for type SP!', null=True, verbose_name=b'SP', on_delete=models.PROTECT),
         ),
         migrations.AddField(
             model_name='tokenauthuser',

api/migrations/0002_auto_20161215_1151.py

@@ -47,6 +47,6 @@ class Migration(migrations.Migration):
         migrations.AddField(
             model_name='localresourcepolicy',
             name='sp',
-            field=models.OneToOneField(verbose_name=b'SP', to='api.ServiceProvider'),
+            field=models.OneToOneField(verbose_name=b'SP', to='api.ServiceProvider', on_delete=models.CASCADE),
         ),
     ]

api/models.py

@@ -29,7 +29,7 @@ from django.core.exceptions import ValidationError
 from django.db import transaction, models
 from django.contrib.auth.models import AbstractUser
 from django.conf import settings
-from django.core.urlresolvers import get_script_prefix
+from django.urls import get_script_prefix
 from django.db.models.signals import post_save
 from django.dispatch import receiver
 from django_choice_object import Choice
@@ -138,7 +138,7 @@ class ServiceProvider(models.Model):
 
 
 class LocalResourcePolicy(models.Model):
-    sp = models.OneToOneField(ServiceProvider, verbose_name="SP")
+    sp = models.OneToOneField(ServiceProvider, verbose_name="SP", on_delete=models.CASCADE)
     delete_after_days = models.IntegerField(
         default=90,
         verbose_name="Default delete policy for resources",
@@ -169,7 +169,7 @@ class Resource(models.Model):
     updated = models.DateTimeField(auto_now=True)
     expiry_date = models.DateTimeField(db_index=True)
     deletion_date = models.DateTimeField(db_index=True)
-    sp = models.ForeignKey(ServiceProvider, verbose_name="SP")
+    sp = models.ForeignKey(ServiceProvider, verbose_name="SP", on_delete=models.PROTECT)
     sp_primary_key = models.CharField(max_length=255,
                                       blank=True,
                                       verbose_name="Primary Key of resource in SP software")
@@ -246,7 +246,9 @@ class Resource(models.Model):
 
                 if self.reject_request(is_sp_local, local_attrib, rmt_attrib, user_type):
                     attrib_dict.update({
-                        "status": "rejected"
+                        "status": "rejected",
+                        "vec_sp": local_attrib.vec_sp,
+                        "vec_idp": local_attrib.vec_idp,
                     })
                     res.append({attrib_name: attrib_dict})
                 else:
@@ -275,10 +277,10 @@ class Resource(models.Model):
         return res
 
     def reject_request(self, is_sp_local, local_attrib, rmt_attrib, user_type):
+        local_vec = VersionVector(local_attrib.vec_sp, local_attrib.vec_idp)
+        remote_vec = VersionVector(rmt_attrib.get("vec_sp"), rmt_attrib.get("vec_idp"))
         reject_request = False
         if user_type == UserType.TYPE_SYNC:
-            local_vec = VersionVector(local_attrib.vec_sp, local_attrib.vec_idp)
-            remote_vec = VersionVector(rmt_attrib.get("vec_sp"), rmt_attrib.get("vec_idp"))
             if local_vec.concurrent_to(remote_vec) or remote_vec.happened_before(local_vec):
                 # As this is represents a conflict situation - depending on prioritization -
                 # we might have to reject this request in order to keep ours dominant
@@ -289,7 +291,29 @@ class Resource(models.Model):
                 if local_attrib.prio == PriorityRole.ROLE_IDP and not is_sp_local:
                     # We are IdP and this attribute prioritizes IdP
                     reject_request = True
-        # else: Local changes only require incrementing our local component
+            # jetzt müssen wir noch testen, dass die andere Seite nicht fälschlicherweise unseren Teil der Vektoruhr updatet
+            if is_sp_local:
+                if remote_vec.sp and remote_vec.sp != local_vec.sp:
+                    reject_request = True
+            else:
+                if remote_vec.idp and remote_vec.idp != local_vec.idp:
+                    reject_request = True
+
+        else:  # Local changes only require incrementing our local component
+            if remote_vec.idp and remote_vec.sp:
+                if local_vec.concurrent_to(remote_vec) or remote_vec.happened_before(local_vec):
+                    reject_request = True
+            if remote_vec.idp and remote_vec.idp < local_vec.idp:
+                reject_request = True
+            if remote_vec.sp and remote_vec.sp < local_vec.sp:
+                reject_request = True
+            if remote_vec.sp and user_type == UserType.TYPE_IDP and remote_vec.sp != local_vec.sp:
+                # IDP Darf SP Wert nicht verändern
+                reject_request = True
+            if remote_vec.idp and user_type == UserType.TYPE_SP and remote_vec.idp != local_vec.idp:
+                # SP Darf IDP Wert nicht verändern
+                reject_request = True
+
 
         return reject_request
 
@@ -332,7 +356,7 @@ class Attribute(models.Model):
     name = models.CharField(max_length=100, db_index=True)
     default_value = models.CharField(max_length=100, blank=True)
     value = models.CharField(max_length=100)
-    resource = models.ForeignKey(Resource, related_name="attributes")
+    resource = models.ForeignKey(Resource, related_name="attributes", on_delete=models.CASCADE)
     vec_sp = models.IntegerField(verbose_name="VV (SP)", default=1)
     vec_idp = models.IntegerField(verbose_name="VV (IdP)", default=0)
     prio = models.CharField(verbose_name="Priority role",
@@ -358,7 +382,9 @@ class TokenAuthUser(AbstractUser):
                            verbose_name="SP",
                            blank=True,
                            null=True,
-                           help_text="Must be set for type SP!")
+                           help_text="Must be set for type SP!",
+                           on_delete=models.PROTECT,
+                          )
     realm = models.CharField(verbose_name="Realm",
                              max_length=100,
                              blank=True,

api/tests/test_attributes.py

@@ -51,7 +51,7 @@ class AttributeUpdateTest(APITestCase):
                                               )
 
     def test_attribute_update(self):
-        url = reverse('resource_attributes', args=[self.res.uuid])
+        url = reverse('api:resource_attributes', args=[self.res.uuid])
 
         user = TokenAuthUser.objects.get(username='a_super')
         self.client.force_authenticate(user=user, token=user.token())
@@ -93,7 +93,7 @@ class AttributeUpdateTest(APITestCase):
         self.assertEqual(2, QueueJob.objects.count())
 
     def test_attribute_update_as_sp(self):
-        url = reverse('resource_attributes', args=[self.res.uuid])
+        url = reverse('api:resource_attributes', args=[self.res.uuid])
 
         user = TokenAuthUser.objects.get(username='testservice')
         self.client.force_authenticate(user=user, token=user.token())
@@ -134,7 +134,7 @@ class AttributeUpdateTest(APITestCase):
         self.assertEqual(2, QueueJob.objects.count())
 
     def test_attribute_update_rejected(self):
-        url = reverse('resource_attributes', args=[self.res.uuid])
+        url = reverse('api:resource_attributes', args=[self.res.uuid])
 
         user = TokenAuthUser.objects.get(username='b_sync')
         self.client.force_authenticate(user=user, token=user.token())

api/tests/test_commands.py

@@ -25,7 +25,7 @@ class AuthTestCommandTest(TestCase):
     def test_success(self):
         out = StringIO()
         with requests_mock.Mocker() as m:
-            m.register_uri("GET", self.user.remote_reverse("health"), status_code=200)
+            m.register_uri("GET", self.user.remote_reverse("api:health"), status_code=200)
             call_command("auth_test", stdout=out)
         self.assertTrue(m.called)
         self.assertEqual(out.getvalue(), "1 passed, 0 failed.\n")
@@ -33,7 +33,7 @@ class AuthTestCommandTest(TestCase):
     def test_failed(self):
         out = StringIO()
         with requests_mock.Mocker() as m:
-            m.register_uri("GET", self.user.remote_reverse("health"), status_code=500)
+            m.register_uri("GET", self.user.remote_reverse("api:health"), status_code=500)
             call_command("auth_test", stdout=out)
         self.assertTrue(m.called)
         self.assertEqual(out.getvalue(), "0 passed, 1 failed.\n\nFailed:\nb_sync\n")
@@ -41,7 +41,7 @@ class AuthTestCommandTest(TestCase):
     def test_connection_failed(self):
         out = StringIO()
         with requests_mock.Mocker() as m:
-            m.register_uri("GET", self.user.remote_reverse("health"), exc=requests.exceptions.ConnectTimeout)
+            m.register_uri("GET", self.user.remote_reverse("api:health"), exc=requests.exceptions.ConnectTimeout)
             call_command("auth_test", stdout=out)
         self.assertTrue(m.called)
         self.assertEqual(out.getvalue(), "0 passed, 1 failed.\n\nFailed:\nb_sync\n")
@@ -51,7 +51,7 @@ class AuthTestCommandTest(TestCase):
         self.user.save()
         out = StringIO()
         with requests_mock.Mocker() as m:
-            m.register_uri("GET", self.user.remote_reverse("health"))
+            m.register_uri("GET", self.user.remote_reverse("api:health"))
             call_command("auth_test", stdout=out)
         self.assertFalse(m.called)
         self.assertEqual(out.getvalue(), "0 passed, 1 failed.\n\nFailed:\nb_sync\n")

api/tests/test_health.py

@@ -32,7 +32,7 @@ class AttributeUpdateTest(APITestCase):
                                                realm="b.edu")
 
     def test_health(self):
-        url = reverse('health')
+        url = reverse('api:health')
 
         user = TokenAuthUser.objects.get(username='a_super')
         token = Token.objects.get(user_id=user)
@@ -83,7 +83,7 @@ class TestHealthCommand(TestCase):
         remote_user.save()
 
         with requests_mock.Mocker() as m:
-            m.register_uri("GET", remote_user.remote_reverse("health"), status_code=500)
+            m.register_uri("GET", remote_user.remote_reverse("api:health"), status_code=500)
             with self.assertRaises(SystemExit) as ex:
                 call_command("check_health")
         self.assertEqual(ex.exception.code, 1)
@@ -97,7 +97,7 @@ class TestHealthCommand(TestCase):
         remote_user.save()
 
         with requests_mock.Mocker() as m:
-            m.register_uri("GET", remote_user.remote_reverse("health"), exc=requests.exceptions.ConnectTimeout)
+            m.register_uri("GET", remote_user.remote_reverse("api:health"), exc=requests.exceptions.ConnectTimeout)
             with self.assertRaises(SystemExit) as ex:
                 call_command("check_health")
         self.assertEqual(ex.exception.code, 1)

api/tests/test_model.py

@@ -18,6 +18,6 @@ class TokenAuthUserTest(APITestCase):
                                                     realm="a.edu")
     def test_remote_reverse(self):
         self.assertEqual(
-            self.a_super.remote_reverse("health"),
+            self.a_super.remote_reverse("api:health"),
             "http://api.a.edu:7000/foobar/health/"
         )

api/tests/test_queue.py

@@ -63,7 +63,7 @@ class SyncResourceTest(TestCase):
         """
         transfer_data = '{"foo": "bar"}'
         with requests_mock.Mocker() as m:
-            m.register_uri('POST', self.remote_user.remote_reverse("resource_list"), status_code=201)
+            m.register_uri('POST', self.remote_user.remote_reverse("api:resource_list"), status_code=201)
             queue_utils.sync_resource(self.remote_user, transfer_data)
         self.assertTrue(m.called)
         # content matches
@@ -77,7 +77,7 @@ class SyncResourceTest(TestCase):
         """
         transfer_data = '{"foo": "bar"}'
         with requests_mock.Mocker() as m:
-            m.register_uri('POST', self.remote_user.remote_reverse("resource_list"), status_code=500)
+            m.register_uri('POST', self.remote_user.remote_reverse("api:resource_list"), status_code=500)
             with self.assertRaises(queue_utils.SyncException):
                 queue_utils.sync_resource(self.remote_user, transfer_data)
         self.assertTrue(m.called)
@@ -86,8 +86,8 @@ class SyncResourceTest(TestCase):
         transfer_data = '{"foo": "bar", "uuid": "12345"}'
         uuid = '12345'
         with requests_mock.Mocker() as m:
-            m.register_uri('POST', self.remote_user.remote_reverse("resource_list"), status_code=400)
-            m.register_uri('GET', self.remote_user.remote_reverse("resource_detail", args=(uuid, )), status_code=200)
+            m.register_uri('POST', self.remote_user.remote_reverse("api:resource_list"), status_code=400)
+            m.register_uri('GET', self.remote_user.remote_reverse("api:resource_detail", args=(uuid, )), status_code=200)
             queue_utils.sync_resource(self.remote_user, transfer_data)
         self.assertTrue(m.called)
 
@@ -95,8 +95,8 @@ class SyncResourceTest(TestCase):
         transfer_data = '{"foo": "bar", "uuid": "12345"}'
         uuid = '12345'
         with requests_mock.Mocker() as m:
-            m.register_uri('POST', self.remote_user.remote_reverse("resource_list"), status_code=400)
-            m.register_uri('GET', self.remote_user.remote_reverse("resource_detail", args=(uuid, )), status_code=404)
+            m.register_uri('POST', self.remote_user.remote_reverse("api:resource_list"), status_code=400)
+            m.register_uri('GET', self.remote_user.remote_reverse("api:resource_detail", args=(uuid, )), status_code=404)
             with self.assertRaises(queue_utils.SyncException):
                 queue_utils.sync_resource(self.remote_user, transfer_data)
         self.assertTrue(m.called)
@@ -131,7 +131,7 @@ class SyncAttributesTest(TestCase):
             }
         ])
         with requests_mock.Mocker() as m:
-            m.register_uri('PUT', self.remote_user.remote_reverse("resource_attributes", args=(self.r.pk, )), status_code=200, text=answer)
+            m.register_uri('PUT', self.remote_user.remote_reverse("api:resource_attributes", args=(self.r.pk, )), status_code=200, text=answer)
             queue_utils.sync_attributes(self.remote_user, transfer_data, str(self.r.pk))
         foo = Attribute.objects.get(pk=self.foo.pk)
         self.assertEquals(foo.vec_idp, 2)
@@ -145,7 +145,7 @@ class SyncAttributesTest(TestCase):
             }
         ])
         with requests_mock.Mocker() as m:
-            m.register_uri('PUT', self.remote_user.remote_reverse("resource_attributes", args=(self.r.pk, )), status_code=404, text=answer)
+            m.register_uri('PUT', self.remote_user.remote_reverse("api:resource_attributes", args=(self.r.pk, )), status_code=404, text=answer)
             with self.assertRaises(queue_utils.SyncException):
                 queue_utils.sync_attributes(self.remote_user, transfer_data, str(self.r.pk))
 
@@ -162,18 +162,18 @@ class DeleteResourceTest(TestCase):
     def test_success(self):
         uuid = "12345"
         with requests_mock.Mocker() as m:
-            m.register_uri('DELETE', self.remote_user.remote_reverse("resource_detail", args=(uuid, )), status_code=200)
+            m.register_uri('DELETE', self.remote_user.remote_reverse("api:resource_detail", args=(uuid, )), status_code=200)
             queue_utils.delete_resource(self.remote_user, uuid)
 
     def test_not_found(self):
         uuid = "12345"
         with requests_mock.Mocker() as m:
-            m.register_uri('DELETE', self.remote_user.remote_reverse("resource_detail", args=(uuid, )), status_code=404)
+            m.register_uri('DELETE', self.remote_user.remote_reverse("api:resource_detail", args=(uuid, )), status_code=404)
             queue_utils.delete_resource(self.remote_user, uuid)
 
     def test_failure(self):
         uuid = "12345"
         with requests_mock.Mocker() as m:
-            m.register_uri('DELETE', self.remote_user.remote_reverse("resource_detail", args=(uuid, )), status_code=500)
+            m.register_uri('DELETE', self.remote_user.remote_reverse("api:resource_detail", args=(uuid, )), status_code=500)
             with self.assertRaises(queue_utils.SyncException):
                 queue_utils.delete_resource(self.remote_user, uuid)

api/tests/test_signals.py

@@ -60,7 +60,7 @@ class ResourceUpdatedTest(APITestCase):
         self.resource_update_signals.append((sender, resource, user_type))
 
     def test_attribute_update(self):
-        url = reverse('resource_attributes', args=[self.res.uuid])
+        url = reverse('api:resource_attributes', args=[self.res.uuid])
 
         user = TokenAuthUser.objects.get(username='a_super')
         self.client.force_authenticate(user=user, token=user.token())
@@ -94,7 +94,7 @@ class ResourceUpdatedTest(APITestCase):
         self.assertEqual(self.resource_update_signals[0][2], user.user_type)
 
     def test_attribute_update_from_sp(self):
-        url = reverse('resource_attributes', args=[self.res.uuid])
+        url = reverse('api:resource_attributes', args=[self.res.uuid])
 
         user = TokenAuthUser.objects.get(username='sp_foo')
         self.client.force_authenticate(user=user, token=user.token())
@@ -151,7 +151,7 @@ class ResourceCreatedTest(APITestCase):
         self.created_signal_calls.append((sender, resource, user_type))
 
     def test_create_resource(self):
-        url = reverse('resource_list')
+        url = reverse('api:resource_list')
         user = TokenAuthUser.objects.get(username='a_super')
         self.client.force_authenticate(user=user, token=user.token())
 

api/tests/test_view_sync_new_resource.py

@@ -43,7 +43,7 @@ class SyncNewResourceTest(APITestCase):
                                                vec_idp=0)
 
     def test_sync_new_resource(self):
-        url = reverse('resource_list')
+        url = reverse('api:resource_list')
         
         user = TokenAuthUser.objects.get(username='b_sync')
         self.client.force_authenticate(user=user, token=user.token())

api/tests/test_views.py

 # -*- coding: utf-8 -*-
 from __future__ import unicode_literals, print_function
 
-import json
+from datetime import datetime
+from datetime import timedelta
 import uuid
 from unittest import skip
 
+from django.core.files.uploadedfile import SimpleUploadedFile
+from django.conf import settings
 from django.test import override_settings
 from django.utils import timezone
+from django.test.client import encode_multipart
 from rest_framework.renderers import JSONRenderer
 from rest_framework.reverse import reverse
 from rest_framework.test import APITestCase
-from api.models import QueueJob, Resource, ServiceProvider, TokenAuthUser, UserType
+from api.models import Attribute, QueueJob, Resource, ServiceProvider, TokenAuthUser, UserType
 from api.serializers import ResourceSerializer
 
 
@@ -79,7 +83,7 @@ class ResourceDeleteTest(APITestCase):
     def _test_delete(self, res, user, queue_delta):
         qlen = QueueJob.objects.filter(res_uuid=res.uuid).count()
         self.client.force_authenticate(user=user, token=user.token())
-        self.client.delete(reverse('resource_detail', kwargs={'uuid': res.uuid}))
+        self.client.delete(reverse('api:resource_detail', kwargs={'uuid': res.uuid}))
         # resource has been deleted
         self.assertEqual(Resource.objects.filter(uuid=res.uuid).count(), 0)
         # no queueJob has been created
@@ -147,7 +151,7 @@ class ResourceCreateTest(APITestCase):
             sp=self.local_sp,
             sp_primary_key="usera@a.edu",
         )
-        self.url = reverse('resource_list')
+        self.url = reverse('api:resource_list')
         self.res = Resource()
         self.queue_data = JSONRenderer().render(ResourceSerializer(self.localResource).data)
 
@@ -200,14 +204,14 @@ class ResourceGetTest(APITestCase):
 
     def test_unauthenticated(self):
         invalid_uuid = str(uuid.uuid4())
-        url = reverse("resource_detail", args=(invalid_uuid,))
+        url = reverse("api:resource_detail", args=(invalid_uuid,))
         r = self.client.get(url)
         self.assertEqual(r.status_code, 401)
 
     def test_not_exist(self):
         invalid_uuid = str(uuid.uuid4())
         self.client.force_authenticate(self.sp_user)
-        url = reverse("resource_detail", args=(invalid_uuid,))
+        url = reverse("api:resource_detail", args=(invalid_uuid,))
         r = self.client.get(url)
         self.assertEqual(r.status_code, 404)
 
@@ -216,11 +220,236 @@ class ResourceGetTest(APITestCase):
         r.full_clean()
         r.save()
         self.client.force_authenticate(self.sp_user)
-        url = reverse("resource_detail", args=(r.pk,))
+        url = reverse("api:resource_detail", args=(r.pk,))
         r = self.client.get(url)
         self.assertEqual(r.status_code, 200)
 
 
+class ResourceUpdateTest(APITestCase):
+    def setUp(self):
+        self.sp = ServiceProvider.objects.create(
+            name="TestService",
+            expiry_date=timezone.now(),
+            realm="a.edu"
+        )
+        self.sp_user = TokenAuthUser.objects.create_superuser(
+            username='sp',
+            email='foo@bar.com',
+            password='sp',
+            user_type=UserType.TYPE_SP,
+            api_url="http://api.a.edu:7000/",
+            realm="a.edu",
+            sp=self.sp,
+        )
+        self.idp_user = TokenAuthUser.objects.create_superuser(
+            username='idp',
+            email='foo@bar.com',
+            password='idp',
+            user_type=UserType.TYPE_IDP,
+            api_url="http://api.b.edu:7000/",
+            realm="b.edu",
+        )
+        self.sync_user = TokenAuthUser.objects.create_superuser(
+            username='sync',
+            email='foo@bar.com',
+            password='idp',
+            user_type=UserType.TYPE_SYNC,
+            api_url="http://api.b.edu:7000/",
+            realm="b.edu",
+        )
+        self.r = Resource(sp=self.sp, expiry_date=timezone.now(), deletion_date=timezone.now(), setup_token="1234", eppn="foo@b.edu")
+        self.r.full_clean()
+        self.r.save()
+        self.attr1 = Attribute(name='test', value='foo', vec_sp=3, vec_idp=1, resource=self.r)
+        self.attr1.full_clean()
+        self.attr1.save()
+        self.attr2 = Attribute(name='other', value='bar', vec_sp=5, vec_idp=2, resource=self.r)
+        self.attr2.full_clean()
+        self.attr2.save()
+    
+    def test_get(self):
+        self.client.force_authenticate(self.sp_user)
+        r = self.client.get(reverse('api:resource_list'))
+        self.maxDiff=None
+        self.assertEqual(r.status_code, 200)
+        self.assertEqual(r.json(),[{
+            'uuid': str(self.r.uuid),
+            'added': self.r.added.astimezone(timezone.get_default_timezone()).isoformat(),
+            'updated': self.r.updated.astimezone(timezone.get_default_timezone()).isoformat(),
+            'deletion_date': self.r.deletion_date.astimezone(timezone.get_default_timezone()).isoformat(),
+            'expiry_date': self.r.expiry_date.astimezone(timezone.get_default_timezone()).isoformat(),
+            'eppn': 'foo@b.edu',
+            'realm_idp': 'b.edu',
+            'setup_token': '1234',
+            'sp': str(self.sp.uuid),
+            'sp_primary_key': '',
+            'attributes': [
+                {
+                    'name': 'test',
+                    'value': 'foo',
+                    'default_value': '',
+                    'vec_sp': 3,
+                    'vec_idp': 1
+                },
+                {
+                    'name': 'other',
+                    'value': 'bar',
+                    'default_value': '',
+                    'vec_sp': 5,
+                    'vec_idp': 2
+                },
+            ]
+        }])
+
+    def _run_test_update(self, vec_sp, vec_idp):
+        self._run_test_update_with_result(vec_sp, vec_idp, 200, vec_sp, vec_idp, 'updated')
+
+    def _run_test_update_with_result(self, vec_sp, vec_idp, expected_status_code, expected_vec_sp, expected_vec_idp, expected_status):
+        data = [
+            {
+               'name': 'other',
+               'value': 'bar2',
+               'default_value': '',
+               'vec_sp': vec_sp,
+               'vec_idp': vec_idp
+            },
+        ]
+        url = reverse("api:resource_attributes", args=(self.r.pk,))
+        res = self.client.put(url, data, format='json')
+        self.assertEqual(res.status_code, expected_status_code)
+        result_data = res.json()
+        result_dict = result_data[0]['other']
+        self.assertEqual(result_dict, {
+            'status': expected_status,
+            'vec_sp': expected_vec_sp,
+            'vec_idp': expected_vec_idp,
+        })
+        attr = Attribute.objects.get(pk=self.attr2.pk)
+        self.assertEqual({
+            'vec_sp': attr.vec_sp,
+            'vec_idp': attr.vec_idp,
+        }, {
+            'vec_sp': expected_vec_sp,
+            'vec_idp': expected_vec_idp,
+        })
+        if vec_sp == expected_vec_sp and vec_idp == expected_vec_idp:
+            self.assertEqual(attr.value, 'bar2')
+        else:
+            self.assertEqual(attr.value, 'bar')
+
+    def test_update_ok_as_sp(self):
+        self.assertEqual(self.sp.is_local, True)
+        self.client.force_authenticate(self.sp_user)
+        self._run_test_update(6, 2)
+
+    def test_update_conflict_as_sp(self):
+        """
+        Dieses Update muss fehlschlagen, weil es eine Nebenläufigkeit der Vektoruhren gibt.
+        """
+        self.assertEqual(self.sp.is_local, True)
+        self.client.force_authenticate(self.sp_user)
+        self._run_test_update_with_result(6, 1, 200, 5, 2, 'rejected')
+
+    def test_update_too_old_as_sp(self):
+        """
+        Dieses Update muss fehlschlagen, weil der SP Nutzer auf der SP Instanz
+        versucht, einen Wert zu aktualisieren, obwohl der mitgeschickte vec_sp
+        Zähler zu alt ist
+        """
+        self.assertEqual(self.sp.is_local, True)
+        self.client.force_authenticate(self.sp_user)
+        self._run_test_update_with_result(4, 2, 200, 5, 2, 'rejected')
+
+    def test_update_sp_must_not_incement_idp(self):
+        """
+        Dieses Update muss fehlschlagen, weil der SP den Zähler vom IDP nicht erhöhen darf.
+        """
+        self.assertEqual(self.sp.is_local, True)
+        self.client.force_authenticate(self.sp_user)
+        self._run_test_update_with_result(6, 3, 200, 5, 2, 'rejected')
+        self._run_test_update_with_result(5, 3, 200, 5, 2, 'rejected')
+
+
+    @override_settings(SERVER_REALM="b.edu")
+    def test_update_ok_as_idp(self):
+        self.assertEqual(self.sp.is_local, False)
+        self.client.force_authenticate(self.idp_user)
+        self._run_test_update(5, 3)
+
+    @override_settings(SERVER_REALM="b.edu")
+    def test_conflict_as_idp(self):
+        """
+        Dieses Update muss fehlschlagen, weil es eine Nebenläufigkeit der Vektoruhren gibt.
+        """
+        self.assertEqual(self.sp.is_local, False)
+        self.client.force_authenticate(self.idp_user)
+        self._run_test_update_with_result(4, 3, 200, 5, 2, 'rejected')
+
+    @override_settings(SERVER_REALM="b.edu")
+    def test_too_old_as_idp(self):
+        """
+        Dieses Update muss fehlschlagen, weil der IDP Nutzer auf der IDP Instanz
+        versucht, einen Wert zu aktualisieren, obwohl der mitgeschickte vec_idp
+        Zähler zu alt ist
+        """
+        self.assertEqual(self.sp.is_local, False)
+        self.client.force_authenticate(self.idp_user)
+        self._run_test_update_with_result(5, 1, 200, 5, 2, 'rejected')
+
+    def test_update_idp_must_not_incement_sp(self):
+        """
+        Dieses Update muss fehlschlagen, weil der IDP den Zähler vom SP nicht erhöhen darf.
+        """
+        self.assertEqual(self.sp.is_local, True)
+        self.client.force_authenticate(self.idp_user)
+        self._run_test_update_with_result(6, 3, 200, 5, 2, 'rejected')
+        self._run_test_update_with_result(6, 2, 200, 5, 2, 'rejected')
+
+    @override_settings(SERVER_REALM="b.edu")
+    def test_ok_sync_from_sp_side(self):
+        # Hier testen wir, ob die Vektoruhr richtig gesetzt wird, wenn ein sync
+        # update vin der Seite des SPs beim IdP aufgerufen wird, also der SP ein
+        # Attribut geändert hat
+        self.assertEqual(self.sp.is_local, False)
+        self.client.force_authenticate(self.sync_user)
+        self._run_test_update(6, 2)
+
+    @override_settings(SERVER_REALM="b.edu")
+    def test_conflict_sync_from_sp_side(self):
+        self.assertEqual(self.sp.is_local, False)
+        self.client.force_authenticate(self.sync_user)
+        # nebenläufig
+        self._run_test_update_with_result(6, 1, 200, 5, 2, 'rejected')
+        # IdP Wert geändert
+        self._run_test_update_with_result(6, 3, 200, 5, 2, 'rejected')
+        # SP Wert Lokal schon neuer
+        self._run_test_update_with_result(4, 1, 200, 5, 2, 'rejected')
+        # IdP Wert geändert, SP Wert lokal schon neuer
+        self._run_test_update_with_result(4, 3, 200, 5, 2, 'rejected')
+
+    def test_ok_sync_from_idp_side(self):
+        """
+        hier testen wir, ob die Vektoruhr richtig gesetzt wird, wenn ein sync
+        update von der Seite des IdPs beim SP aufgerufen wird, also der IdP
+        ein Attribut geändert hat und dass es beim SP richtig aktualisiert wird
+        """
+        self.assertEqual(self.sp.is_local, True)
+        self.client.force_authenticate(self.sync_user)
+        self._run_test_update(5, 3)
+
+    def test_conflict_sync_from_idp_side(self):
+        """
+        Das muss fehlschlagen, weil es hier eine Nebenläufigkeit der Vektoruhren
+        gibt.
+        """
+        self.assertEqual(self.sp.is_local, True)
+        self.client.force_authenticate(self.sync_user)
+        self._run_test_update_with_result(4, 3, 200, 5, 2, 'rejected')
+        self._run_test_update_with_result(6, 3, 200, 5, 2, 'rejected')
+        self._run_test_update_with_result(4, 2, 200, 5, 2, 'rejected')
+        self._run_test_update_with_result(6, 2, 200, 5, 2, 'rejected')
+
+
 class AttributesTest(APITestCase):
     def setUp(self):
         self.local_sp = ServiceProvider.objects.create(
@@ -240,14 +469,14 @@ class AttributesTest(APITestCase):
 
     def test_unauthenticated(self):
         invalid_uuid = str(uuid.uuid4())
-        url = reverse("resource_attributes", args=(invalid_uuid,))
+        url = reverse("api:resource_attributes", args=(invalid_uuid,))
         r = self.client.get(url)
         self.assertEqual(r.status_code, 401)
 
     def test_not_exist(self):
         invalid_uuid = str(uuid.uuid4())
         self.client.force_authenticate(self.sp_user)
-        url = reverse("resource_attributes", args=(invalid_uuid,))
+        url = reverse("api:resource_attributes", args=(invalid_uuid,))
         r = self.client.get(url)
         self.assertEqual(r.status_code, 404)
 
@@ -256,7 +485,7 @@ class AttributesTest(APITestCase):
         r.full_clean()
         r.save()
         self.client.force_authenticate(self.sp_user)
-        url = reverse("resource_attributes", args=(r.pk,))
+        url = reverse("api:resource_attributes", args=(r.pk,))
         r = self.client.get(url)
         self.assertEqual(r.status_code, 200)
 
@@ -280,19 +509,136 @@ class ServiceProviderGetTest(APITestCase):
 
     def test_unauthenticated(self):
         invalid_uuid = str(uuid.uuid4())
-        url = reverse("service_detail", args=(invalid_uuid,))
+        url = reverse("api:service_detail", args=(invalid_uuid,))
         r = self.client.get(url)
         self.assertEqual(r.status_code, 401)
 
     def test_not_exist(self):
         invalid_uuid = str(uuid.uuid4())
         self.client.force_authenticate(self.sp_user)
-        url = reverse("service_detail", args=(invalid_uuid,))
+        url = reverse("api:service_detail", args=(invalid_uuid,))
         r = self.client.get(url)
         self.assertEqual(r.status_code, 404)
 
     def test_regular(self):
         self.client.force_authenticate(self.sp_user)
-        url = reverse("service_detail", args=(self.local_sp.pk,))
+        url = reverse("api:service_detail", args=(self.local_sp.pk,))
         r = self.client.get(url)
         self.assertEqual(r.status_code, 200)
+
+
+class CsvUploadViewTest(APITestCase):
+    fixtures = ['csv_import_data.json']
+
+    def upload_csv(self, data):
+        csv_data = "\n".join([
+            "{},{}".format(d[0].eppn, d[1]) for d in data
+        ]).encode("utf-8")
+        upload = SimpleUploadedFile('data.csv', csv_data, 'text/csv')
+        data = {'csv': upload}
+        content = encode_multipart('BoUnDaRyStRiNg', data)
+        content_type = 'multipart/form-data; boundary=BoUnDaRyStRiNg'
+        #print(content)
+        r = self.client.post(self.url, content, content_type=content_type)
+        return r
+
+    def setUp(self):
+        self.user1 = Resource.objects.get(eppn="user1@a.edu")
+        self.user2 = Resource.objects.get(eppn="user2@a.edu")
+        self.user3 = Resource.objects.get(eppn="user3@a.edu")
+        self.user_extern = Resource.objects.get(eppn="user3@b.edu")
+        self.idp_user = TokenAuthUser.objects.create_superuser(
+            username='api',
+            email='foo@bar.com',
+            password='api',
+            user_type=UserType.TYPE_API,
+            api_url="http://api.a.edu:7000/",
+            realm="a.edu",
+        )
+        self.local_sp = ServiceProvider.objects.create(
+            name="TestService",
+            expiry_date=timezone.now(),
+            realm="a.edu"
+        )
+        self.sp_user = TokenAuthUser.objects.create_superuser(
+            username='sp',
+            email='foo@bar.com',
+            password='sp',
+            user_type=UserType.TYPE_SP,
+            api_url="http://api.a.edu:7000/",
+            realm="a.edu",
+            sp=self.local_sp,
+        )
+
+        self.url = reverse('api:csv_upload')
+
+    def test_upload_unauthenticated(self):
+        now = timezone.now()
+        data = (
+            (self.user1, '31.12.%s' % now.year),
+        )
+        r = self.upload_csv(data)
+        self.assertEqual(r.status_code, 401)
+
+    def test_unauthorized(self):
+        now = timezone.now()
+        data = (
+            (self.user1, '31.12.%s' % now.year),
+        )
+        self.client.force_authenticate(self.sp_user)
+        r = self.upload_csv(data)
+        self.assertEqual(r.status_code, 403)
+
+    def test_modify(self):
+        now = timezone.now()
+        data = (
+            (self.user1, '31.12.%s' % now.year),
+        )
+        self.client.force_authenticate(self.idp_user)
+        r = self.upload_csv(data)
+        self.assertEqual(r.status_code, 200)
+        self.assertEqual(
+            Resource.objects.get(pk=self.user1.pk).expiry_date,
+            timezone.make_aware(datetime.strptime("%s-12-31T00:00:00" % now.year, "%Y-%m-%dT%H:%M:%S"))
+        )
+
+    def test_do_not_modify(self):
+        self.assertEqual(0, QueueJob.objects.count())
+        now = timezone.now()
+        today = timezone.make_aware(datetime.strptime("{}-{}-{}T00:00:00".format(now.year, now.month, now.day), "%Y-%m-%dT%H:%M:%S"))
+        Resource.objects.update(expiry_date=today, deletion_date=today + timedelta(days=30))
+        self.user1 = Resource.objects.get(eppn="user1@a.edu")
+        u1_ex = self.user1.expiry_date
+        data = [
+            (res, res.expiry_date.astimezone(timezone.get_default_timezone()).strftime("%d.%m.%Y"))
+            for res in Resource.objects.filter(realm_idp=settings.SERVER_REALM)
+        ]
+        self.client.force_authenticate(self.idp_user)
+        r = self.upload_csv(data)
+        self.assertEqual(r.status_code, 200)
+
+        self.assertEqual(u1_ex, Resource.objects.get(pk=self.user1.pk).expiry_date)
+        self.assertEqual(0, QueueJob.objects.count())
+
+    def test_dont_touch_external_users(self):
+        data = (
+            (self.user_extern, '31.12.2016'),
+        )
+        self.client.force_authenticate(self.idp_user)
+        r = self.upload_csv(data)
+        self.assertEqual(r.status_code, 200)
+        self.assertEqual(
+            Resource.objects.get(pk=self.user_extern.pk).expiry_date,
+            self.user_extern.expiry_date
+        )
+
+    def test_trigger_sync_for_external_services(self):
+        data = (
+            (self.user3, '31.12.2016'),
+        )
+        self.client.force_authenticate(self.idp_user)
+        r = self.upload_csv(data)
+        self.assertEqual(r.status_code, 200)
+        self.assertEqual(1, QueueJob.objects.count())
+        q = QueueJob.objects.first()
+        self.assertEqual(q.res_uuid, self.user3.pk)

api/urls.py

@@ -9,6 +9,7 @@ from api import views
 urlpatterns = [
     url(r'^$', views.WelcomeView.as_view()),
     url(r'^health/$', views.Health.as_view(), name='health'),
+    url(r'^csv_upload/$', views.CsvUploadView.as_view(), name='csv_upload'),
     url(r'^services/$', views.ServiceList.as_view(), name='service_list'),
     url(r'^services/(?P<uuid>[^/]+)/$',
         views.ServiceDetail.as_view(), name='service_detail'),
@@ -20,3 +21,4 @@ urlpatterns = [
 ]
 
 urlpatterns = format_suffix_patterns(urlpatterns)
+app_name = 'api'

api/utils/csv_handling.py

+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+from __future__ import division, print_function, unicode_literals
+# -*- coding: utf-8 -*-
+from __future__ import unicode_literals, print_function
+
+from datetime import timedelta, datetime
+
+from django.conf import settings
+from django.db import transaction
+from django.utils import timezone
+
+from api.models import Resource, UserType
+from api.utils.queue_utils import dispatch_deletion_sync
+
+
+@transaction.atomic()
+def sync_from_csv_data(file_obj, date_format):
+    eppn_dict = {}
+
+    for line in file_obj:
+        eppn, d = line.decode("utf-8").strip().split(",")
+        exp_date = timezone.make_aware(datetime.strptime(d, date_format))
+        eppn_dict[eppn] = exp_date
+    # iterate over all local resources
+    for res in Resource.objects.filter(realm_idp=settings.SERVER_REALM)\
+            .select_related("sp", "sp__localresourcepolicy"):
+        try:
+            exp_date = eppn_dict[res.eppn]
+        except KeyError:
+            # eppn does no longer exist, we need to make sure that
+            #   the resource will be locked immediately
+            # deletion and purging happens as usual
+            exp_date = min(res.expiry_date, timezone.now() - timedelta(days=1))
+        delete_date = exp_date + timedelta(days=res.sp.delete_after_days)
+        purge_date = delete_date + timedelta(days=res.sp.purge_api_data_after_days)
+
+        if purge_date < timezone.now():
+            uuid = res.uuid
+            is_local_sp = res.sp.is_local
+            res.delete()
+            # if this resource belongs to a remote sp, we need to notify
+            # the sp that we deleted the resource record
+            if not is_local_sp:
+                dispatch_deletion_sync(res, uuid)
+        else:
+            if res.expiry_date != exp_date or res.deletion_date != delete_date:
+                res.update_attribute([
+                    {"name": "expiry_date", "value": exp_date.isoformat()},
+                    {"name": "deletion_date", "value": delete_date.isoformat()},
+                ], user_type=UserType.TYPE_IDP)

api/utils/queue_utils.py

@@ -32,7 +32,7 @@ def dispatch_resource_sync(resource):
 
 
 def sync_resource(sync_user, resource_json):
-    url = sync_user.remote_reverse("resource_list")
+    url = sync_user.remote_reverse("api:resource_list")
     token = sync_user.token()
     headers = {'Authorization': 'token ' + str(token),
                'Content-type': 'application/json'}
@@ -43,7 +43,7 @@ def sync_resource(sync_user, resource_json):
         # status code could mean, resource exists on remote side
         # try to fetch it an compare.
         uuid = json.loads(resource_json)['uuid']
-        detail_url = sync_user.remote_reverse("resource_detail", args=(uuid,))
+        detail_url = sync_user.remote_reverse("api:resource_detail", args=(uuid,))
         r2 = requests.get(detail_url, headers=headers)
         if r2.status_code == 200:
             logger.info("Resource {} already exists on remote side".format(uuid))
@@ -78,7 +78,7 @@ def dispatch_attributes_sync(attributes, res_uuid, dates):
 
 
 def sync_attributes(sync_user, attributes_json, res_uuid):
-    url = sync_user.remote_reverse("resource_attributes", args=[res_uuid])
+    url = sync_user.remote_reverse("api:resource_attributes", args=[res_uuid])
     token = sync_user.token()
     headers = {'Authorization': 'token ' + str(token),
                'Content-type': 'application/json'}
@@ -118,7 +118,7 @@ def dispatch_deletion_sync(resource, res_uuid):
 
 
 def delete_resource(sync_user, res_uuid):
-    url = sync_user.remote_reverse("resource_detail", args=[res_uuid])
+    url = sync_user.remote_reverse("api:resource_detail", args=[res_uuid])
     token = sync_user.token()
     headers = {'Authorization': 'token ' + str(token),
                'Content-type': 'application/json'}

api/utils/user_utils.py

@@ -8,7 +8,7 @@ except ImportError:
     from urllib.parse import urljoin
 
 from django.conf import settings
-from django.core.urlresolvers import get_script_prefix
+from django.urls import get_script_prefix
 from rest_framework.authtoken.models import Token
 from rest_framework.reverse import reverse
 

api/utils/vector_clock.py

@@ -24,7 +24,7 @@ class VectorClock(object):
             return found_one
 
         else:
-            raise NotImplementedError
+            raise NotImplementedError  # pragma: no cover
 
     def concurrent_to(self, other):
         if isinstance(other, VectorClock) and len(self.comp) == len(self.comp):
@@ -33,7 +33,7 @@ class VectorClock(object):
 
             return False
         else:
-            raise NotImplementedError
+            raise NotImplementedError  # pragma: no cover
 
     def merge(self, other):  # Side effect func
         if isinstance(other, VectorClock) and len(self.comp) == len(self.comp):
@@ -48,7 +48,7 @@ class VectorClock(object):
 
             return self.comp
         else:
-            raise NotImplementedError
+            raise NotImplementedError  # pragma: no cover
 
     def __str__(self):
         return str(self.comp)
@@ -62,4 +62,11 @@ class VersionVector(VectorClock):
     Since the only difference relies in how VV's are updated,
     no implementation changes are necessary at this place.
     """
-    pass
+
+    @property
+    def sp(self):
+        return self.comp[0]
+
+    @property
+    def idp(self):
+        return self.comp[1]

api/views.py

@@ -23,7 +23,7 @@ from rest_framework import status
 from rest_framework.authentication import TokenAuthentication
 from rest_framework.authtoken.models import Token
 from rest_framework.exceptions import PermissionDenied, ParseError
-from rest_framework.parsers import JSONParser
+from rest_framework.parsers import JSONParser, MultiPartParser
 from rest_framework.permissions import IsAuthenticated
 from rest_framework.response import Response
 from rest_framework.views import APIView
@@ -31,6 +31,7 @@ from rest_framework.views import APIView
 from api.models import Resource, ServiceProvider, Attribute, UserType
 from api.serializers import ServiceSerializer, ResourceSerializer, AttributeSerializer
 from api.signals import resource_created
+from api.utils.csv_handling import sync_from_csv_data
 from api.utils.queue_utils import dispatch_resource_sync, dispatch_deletion_sync
 from api.utils.user_utils import local_reverse
 from api.utils.validation_utils import validate_uuid4
@@ -120,7 +121,7 @@ class ResourceList(AuthAPIView):
             if sp_primary_key:
                 try:
                     obj = Resource.objects.get(sp=request.user.sp, sp_primary_key=sp_primary_key)
-                    location = local_reverse("resource_detail", args=[str(obj.uuid)])
+                    location = local_reverse("api:resource_detail", args=[str(obj.uuid)])
                     return Response(status=status.HTTP_201_CREATED, headers={"Location": location})
                 except Resource.DoesNotExist:
                     pass
@@ -136,7 +137,7 @@ class ResourceList(AuthAPIView):
                         if not ServiceProvider.objects.filter(uuid=request.data["sp"]).exists():
                             # That is the case, thus fetching that SP entry is now a priority
                             foreign_api_url = request.user\
-                                .remote_reverse('service_detail', args=[request.data["sp"]])
+                                    .remote_reverse('api:service_detail', args=[request.data["sp"]])
                             headers = {'Authorization': 'token ' + str(request.auth)}
                             r = requests.get(foreign_api_url, headers=headers, timeout=5)
 
@@ -171,7 +172,7 @@ class ResourceList(AuthAPIView):
                             # Dispatch resource sync procedure in queue
                             dispatch_resource_sync(obj)
 
-                    location = local_reverse("resource_detail", args=[str(obj.uuid)])
+                    location = local_reverse("api:resource_detail", args=[str(obj.uuid)])
                     return Response(status=status.HTTP_201_CREATED, headers={"Location": location})
                 return Response(ser.errors, status=status.HTTP_400_BAD_REQUEST)
         except requests.exceptions.Timeout:
@@ -254,10 +255,24 @@ class ResourceAttributes(AuthAPIView):
 
         res = resource.update_attribute(request.data, request.user.user_type)
 
-        location = local_reverse("resource_attributes", args=[str(uuid)])
+        location = local_reverse("api:resource_attributes", args=[str(uuid)])
         return Response(data=res, status=status.HTTP_200_OK, headers={"Location": location})
 
 
 class WelcomeView(APIView):
     def get(self, request):
         return Response(data="FRMS-API-0.1")
+
+
+class CsvUploadView(AuthAPIView):
+    parser_classes = [MultiPartParser]
+
+    def post(self, request):
+        if request.user.user_type != UserType.TYPE_API:
+            raise PermissionDenied()
+        csv_file = request.data.get('csv', None)
+        if not csv_file:
+            return Response("csv parameter required", status=Response.HTTP_400_BAD_REQUEST)
+        date_format = request.data.get('date_format', '%d.%m.%Y')
+        sync_from_csv_data(csv_file, date_format)
+        return Response('ok')

docker/Dockerfile

+FROM debian:buster
+RUN apt-get update && apt-get -y upgrade
+RUN apt-get install -y uwsgi python3.7 uwsgi-plugin-python3 python3-venv git libpq-dev libmariadb-dev libmariadb-dev-compat gcc python3-dev libev-dev
+COPY install.sh /tmp/install.sh
+COPY frms.ini /etc/uwsgi/apps-enabled
+COPY startsync.sh /var/www/django/frms/startsync.sh
+COPY startuwsgi.sh /var/www/django/frms/startuwsgi.sh
+COPY manage.py.sh /usr/bin/manage.py
+RUN chmod 755 /var/www/django/frms/startsync.sh
+RUN chmod 755 /var/www/django/frms/startuwsgi.sh
+RUN chmod 755 /usr/bin/manage.py
+RUN bash /tmp/install.sh
+EXPOSE 8000
+ENV DOCKER=1
+VOLUME ["/var/www/django/frms/logs", "/var/www/django/frms/private"]
+ENTRYPOINT ["/var/www/django/frms/startuwsgi.sh"]

docker/README.md

+Betrieb mit Docker
+==================
+
+Image bauen
+-----------
+
+automatisch: 
+```bash
+    buildimage.sh
+```
+
+Container starten
+-----------------
+
+* Es muss eine MariaDB oder PostgreSQL Datenbank vorhanden sein
+* Es muss eine Minimalkonfiguration erstellt werden. Als Vorlage gibt es
+  * [docker/example-settings/postgresql/settings_docker.py]
+  * [docker/example-settings/mariadb/settings_docker.py]
+  Für die Konfiguration kann ein beliebiges Verzeichnis auf dem Hostsystem gewählt werden, das gebackupt wird.
+* Apache mit SSL muss eingerichtet sein. Außerdem ist [mod_proxy_uwsgi](https://httpd.apache.org/docs/2.4/mod/mod_proxy_uwsgi.html) notwendig. Der UWSGI im Container lauscht auf Port 8000 mit UWSGI Protokoll.
+* Beim Start des Containers werden Datenbankmigrationen durchgeführt und die Datei `django_secret.txt` im Konfigurationsverzeichnis angelegt, wenn noch nicht vorhanden. Dort wird das Django Secret gespeichert, mit dem Cookies verschlüsselt werden.
+
+Angenommen, die Konfiguration befindet sich unter `/etc/frms`, dann sollte der Container folgendermaßen gestartet werden:
+```bash
+    docker run --name frms --rm -v /etc/frms/:/var/www/django/frms/private/ -d -p 127.0.0.1:8000:8000 frms
+```
+
+Im Apache reicht dann folgende Konfiguration im passenden Virtualhost:
+
+```
+    ProxyPass /api uwsgi://127.0.0.1:8000/frms
+    ProxyPass /static uwsgi://127.0.0.1:8000/frms/static
+```
+
+Testen
+------
+
+Die Container können gleich mit zum Testen der Funktionalität genutzt werden. Dazu muss lokal ein passender Container gebaut werden und die Tests gestartet werden.
+Zur Ausführung der Tests wird docker-compose genutzt.
+
+~~~bash
+./buildimage.sh
+./test.sh
+~~~

docker/buildimage.sh

+#!/usr/bin/env bash
+docker pull debian:buster
+datum=$(date +%Y-%m-%d)
+docker build -t frms:${datum} .
+docker build -t frms:latest .

docker/docker-compose.yml

+version: "3"
+services:
+    db1: 
+        image: postgres
+        environment:
+            POSTGRES_PASSWORD: frms1
+            POSTGRES_USER: frms1
+    db2:
+        image: postgres
+        environment:
+            POSTGRES_PASSWORD: frms2
+            POSTGRES_USER: frms2
+
+    frms1:
+        #build: .
+        image: frms:latest
+        entrypoint: /root/prepare_and_run_frms1.sh
+        volumes:
+            - ./tests/config/frms1/:/var/www/django/frms/private/
+            - ./tests/prepare_and_run_frms1.sh:/root/prepare_and_run_frms1.sh
+        depends_on:
+            - db1
+    frms1-web:
+        image: httpd:2.4
+        volumes:
+            - ./tests/config/httpd1.conf:/usr/local/apache2/conf/httpd.conf
+        depends_on: 
+            - frms1
+        ports: 
+            - "8000:80"
+
+    frms2:
+        #build: .
+        image: frms:latest
+        entrypoint: /root/prepare_and_run_frms2.sh
+        volumes:
+            - ./tests/config/frms2/:/var/www/django/frms/private/
+            - ./tests/prepare_and_run_frms2.sh:/root/prepare_and_run_frms2.sh
+        depends_on:
+            - db2
+    frms2-web:
+        image: httpd:2.4
+        volumes:
+            - ./tests/config/httpd2.conf:/usr/local/apache2/conf/httpd.conf
+        depends_on: 
+            - frms2
+        ports: 
+            - "8001:80"

docker/example-settings/mariadb/settings_docker.py

+# -*- coding: utf-8 -*-
+