202 lines
8.0 KiB
Python
202 lines
8.0 KiB
Python
"""
|
|
Management command to set up initial security data
|
|
"""
|
|
from django.core.management.base import BaseCommand
|
|
from django.contrib.auth.models import Permission, ContentType
|
|
from django.contrib.contenttypes.models import ContentType
|
|
|
|
from security.models import DataClassification, Role, User
|
|
|
|
|
|
class Command(BaseCommand):
|
|
help = 'Set up initial security data (classifications, roles, permissions)'
|
|
|
|
def handle(self, *args, **options):
|
|
self.stdout.write('Setting up security data...')
|
|
|
|
# Create data classifications
|
|
self.create_data_classifications()
|
|
|
|
# Create basic roles
|
|
self.create_basic_roles()
|
|
|
|
# Create superuser if none exists
|
|
self.create_superuser()
|
|
|
|
self.stdout.write(
|
|
self.style.SUCCESS('Security data setup completed successfully!')
|
|
)
|
|
|
|
def create_data_classifications(self):
|
|
"""Create data classification levels"""
|
|
classifications = [
|
|
{
|
|
'name': 'PUBLIC',
|
|
'level': 1,
|
|
'description': 'Public information that can be freely shared',
|
|
'color_code': '#28a745',
|
|
'requires_clearance': False
|
|
},
|
|
{
|
|
'name': 'INTERNAL',
|
|
'level': 2,
|
|
'description': 'Internal company information',
|
|
'color_code': '#17a2b8',
|
|
'requires_clearance': False
|
|
},
|
|
{
|
|
'name': 'CONFIDENTIAL',
|
|
'level': 3,
|
|
'description': 'Confidential information requiring protection',
|
|
'color_code': '#ffc107',
|
|
'requires_clearance': True
|
|
},
|
|
{
|
|
'name': 'RESTRICTED',
|
|
'level': 4,
|
|
'description': 'Restricted information with limited access',
|
|
'color_code': '#fd7e14',
|
|
'requires_clearance': True
|
|
},
|
|
{
|
|
'name': 'TOP_SECRET',
|
|
'level': 5,
|
|
'description': 'Top secret information with highest protection',
|
|
'color_code': '#dc3545',
|
|
'requires_clearance': True
|
|
}
|
|
]
|
|
|
|
for classification_data in classifications:
|
|
classification, created = DataClassification.objects.get_or_create(
|
|
name=classification_data['name'],
|
|
defaults=classification_data
|
|
)
|
|
|
|
if created:
|
|
self.stdout.write(f'Created classification: {classification.name}')
|
|
else:
|
|
self.stdout.write(f'Classification already exists: {classification.name}')
|
|
|
|
def create_basic_roles(self):
|
|
"""Create basic roles with permissions"""
|
|
# Get content types for permissions
|
|
user_content_type = ContentType.objects.get_for_model(User)
|
|
classification_content_type = ContentType.objects.get_for_model(DataClassification)
|
|
role_content_type = ContentType.objects.get_for_model(Role)
|
|
|
|
# Create permissions if they don't exist
|
|
permissions_data = [
|
|
('view_user', 'Can view user', user_content_type),
|
|
('add_user', 'Can add user', user_content_type),
|
|
('change_user', 'Can change user', user_content_type),
|
|
('delete_user', 'Can delete user', user_content_type),
|
|
('view_classification', 'Can view data classification', classification_content_type),
|
|
('add_classification', 'Can add data classification', classification_content_type),
|
|
('change_classification', 'Can change data classification', classification_content_type),
|
|
('delete_classification', 'Can delete data classification', classification_content_type),
|
|
('view_role', 'Can view role', role_content_type),
|
|
('add_role', 'Can add role', role_content_type),
|
|
('change_role', 'Can change role', role_content_type),
|
|
('delete_role', 'Can delete role', role_content_type),
|
|
]
|
|
|
|
permissions = {}
|
|
for codename, name, content_type in permissions_data:
|
|
permission, created = Permission.objects.get_or_create(
|
|
codename=codename,
|
|
content_type=content_type,
|
|
defaults={'name': name}
|
|
)
|
|
permissions[codename] = permission
|
|
|
|
if created:
|
|
self.stdout.write(f'Created permission: {permission.name}')
|
|
|
|
# Create roles
|
|
roles_data = [
|
|
{
|
|
'name': 'Incident Manager',
|
|
'description': 'Can manage incidents and assign to team members',
|
|
'permissions': ['view_user', 'view_classification', 'view_role'],
|
|
'classifications': ['PUBLIC', 'INTERNAL', 'CONFIDENTIAL']
|
|
},
|
|
{
|
|
'name': 'Security Admin',
|
|
'description': 'Can manage security settings and user access',
|
|
'permissions': [
|
|
'view_user', 'add_user', 'change_user', 'delete_user',
|
|
'view_classification', 'add_classification', 'change_classification', 'delete_classification',
|
|
'view_role', 'add_role', 'change_role', 'delete_role'
|
|
],
|
|
'classifications': ['PUBLIC', 'INTERNAL', 'CONFIDENTIAL', 'RESTRICTED']
|
|
},
|
|
{
|
|
'name': 'Analyst',
|
|
'description': 'Can view and analyze incidents',
|
|
'permissions': ['view_user', 'view_classification', 'view_role'],
|
|
'classifications': ['PUBLIC', 'INTERNAL']
|
|
},
|
|
{
|
|
'name': 'Viewer',
|
|
'description': 'Can view public and internal incidents only',
|
|
'permissions': ['view_classification'],
|
|
'classifications': ['PUBLIC', 'INTERNAL']
|
|
}
|
|
]
|
|
|
|
for role_data in roles_data:
|
|
role, created = Role.objects.get_or_create(
|
|
name=role_data['name'],
|
|
defaults={
|
|
'description': role_data['description'],
|
|
'is_active': True
|
|
}
|
|
)
|
|
|
|
if created:
|
|
# Add permissions
|
|
role_permissions = [permissions[p] for p in role_data['permissions'] if p in permissions]
|
|
role.permissions.set(role_permissions)
|
|
|
|
# Add data classifications
|
|
classifications = DataClassification.objects.filter(
|
|
name__in=role_data['classifications']
|
|
)
|
|
role.data_classification_access.set(classifications)
|
|
|
|
self.stdout.write(f'Created role: {role.name}')
|
|
else:
|
|
self.stdout.write(f'Role already exists: {role.name}')
|
|
|
|
def create_superuser(self):
|
|
"""Create superuser if none exists"""
|
|
if not User.objects.filter(is_superuser=True).exists():
|
|
self.stdout.write('Creating superuser...')
|
|
|
|
# Get the highest clearance level
|
|
top_secret = DataClassification.objects.filter(name='TOP_SECRET').first()
|
|
|
|
superuser = User.objects.create_superuser(
|
|
username='admin',
|
|
email='admin@etb-incident-management.com',
|
|
password='admin123',
|
|
first_name='System',
|
|
last_name='Administrator',
|
|
clearance_level=top_secret,
|
|
employee_id='ADMIN001'
|
|
)
|
|
|
|
self.stdout.write(
|
|
self.style.WARNING(
|
|
f'Created superuser: {superuser.username} (password: admin123)'
|
|
)
|
|
)
|
|
self.stdout.write(
|
|
self.style.WARNING(
|
|
'Please change the default password immediately!'
|
|
)
|
|
)
|
|
else:
|
|
self.stdout.write('Superuser already exists')
|