user_manager
Users, administrators, and groups stored as flat files.
keys/admins/<username>: the administrator's public key PEM.keys/users/<username>: a--- Settings ---YAML block followed by a--- Public Key ---PEM block, empty for a user who signs in only through an identity provider (seesso.py).groups/<name>: YAML settings its members get (seeget_effective_settings).
A user in no group is judged by DEFAULT_GROUP, which has no file: the
settings are the user's own, DEFAULT_USER_SETTINGS where the record sets
nothing, and the access lists of applications, VPN profiles, and pools may
name it. A user a sign-in created while sso_hold_new_users was on carries
approved: false and is held (held) until placed in a group, approved by an
administrator (approve), or named in a group by the provider.
All three are objects of the shared store (store.MOUNTS), read into memory
after every change here and whenever the store reports one made elsewhere or
by hand. The built-in administrator admin needs none: the root key signs
them in on the web and in the companion apps, and the key file the first
start writes is the same account's for the key-file clients.
attributelogger= logging.getLogger(__name__)attributeUSER_DATAdict[str, dict[str, Any]]= {}attributeGROUP_DATAdict[str, dict[str, Any]]= {}attributeADMIN= 'admin'attributeRECORD_KEYS= ('auth', 'provider_groups', 'approved', 'web_sign_in')attributeDEFAULT_GROUP= 'default'attributeRESERVED_GROUP_NAMES= (DEFAULT_GROUP, 'all', 'none')attributeDEFAULT_USER_SETTINGSdict[str, Any]= {'active': True, 'group': DEFAULT_GROUP, 'groups': [], 'admin': False, 'persistent_storage': True, 'public_sharing': False, 'harden_container': False, 'harden_openbox': False, 'edit_templates': False, 'gpu': True, 'gpu_share': True, 'home_migration': True, 'storage_limit': -1, 'session_limit': -1, 'session_cpus': -1, 'session_memory_mb': -1, 'session_hours': -1, 'allowance_hours': -1, 'allowance_period': 'month', 'pools': [], 'pools_denied': [], 'proot_catalog': None, 'vpn': True, 'application_keys': True, 'application_key_clients': list(APP_KEY_CLIENTS), 'application_key_days': -1, 'application_key_dormant_hours': -1, 'application_key_follow_sign_in': False}attributeSWITCHESdict[str, bool]= {'active': False, 'admin': False, 'persistent_storage': False, 'public_sharing': False, 'edit_templates': False, 'gpu': False, 'gpu_share': False, 'home_migration': False, 'vpn': False, 'harden_container': True, 'harden_openbox': True, 'application_keys': False, 'application_key_follow_sign_in': True}attributeLIMITS= ('storage_limit', 'session_limit', 'session_cpus', 'session_memory_mb', 'session_hours', 'allowance_hours', 'application_key_days', 'application_key_dormant_hours')attributeAPP_KEY_SETTINGS= ('application_keys', 'application_key_clients', 'application_key_days', 'application_key_dormant_hours', 'application_key_follow_sign_in')attributeWEB_SIGN_IN_RENEW_SECONDS= 600attributeSERVER_PUBLIC_KEY_PEMstr | None= NoneattributeEXTERNAL_API_PORTint= getattr(settings, 'api_port', 8000)attributeEXTERNAL_SESSION_PORTint= getattr(settings, 'session_port', 8443)