324 lines
13 KiB
Python
324 lines
13 KiB
Python
"""
|
|
Datenzugriffsschicht fuer die ITSM-Plattform (PostgreSQL, mandantenfaehig).
|
|
|
|
Ersetzt die fruehere JSON-Datei-Ablage. Grund: Betrieb unter ISO 27001, DSGVO
|
|
und NIS 2 verlangt belastbare Zugriffskontrolle, Nachvollziehbarkeit (Audit-Log)
|
|
und geordnete Backup-/Wiederherstellungsfaehigkeit -- das leistet eine Datei-
|
|
Ablage nicht.
|
|
|
|
ENV:
|
|
DATABASE_URL postgresql://user:pass@host:5432/dbname
|
|
"""
|
|
import os
|
|
import json
|
|
import datetime as _dt
|
|
from contextlib import contextmanager
|
|
|
|
import psycopg2
|
|
import psycopg2.extras
|
|
import psycopg2.pool
|
|
|
|
DATABASE_URL = os.getenv("DATABASE_URL", "")
|
|
|
|
_pool = None
|
|
|
|
|
|
def _get_pool():
|
|
global _pool
|
|
if _pool is None:
|
|
_pool = psycopg2.pool.SimpleConnectionPool(1, 10, dsn=DATABASE_URL)
|
|
return _pool
|
|
|
|
|
|
@contextmanager
|
|
def get_conn():
|
|
pool = _get_pool()
|
|
conn = pool.getconn()
|
|
try:
|
|
yield conn
|
|
conn.commit()
|
|
except Exception:
|
|
conn.rollback()
|
|
raise
|
|
finally:
|
|
pool.putconn(conn)
|
|
|
|
|
|
def _dict_cursor(conn):
|
|
return conn.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
|
|
|
|
|
|
def init_db():
|
|
"""Legt das Schema an (idempotent). Wird beim App-Start aufgerufen."""
|
|
here = os.path.dirname(os.path.abspath(__file__))
|
|
schema_path = os.path.join(here, "schema.sql")
|
|
with open(schema_path, "r", encoding="utf-8") as f:
|
|
ddl = f.read()
|
|
with get_conn() as conn:
|
|
with conn.cursor() as cur:
|
|
cur.execute(ddl)
|
|
|
|
|
|
def any_tenant_exists():
|
|
with get_conn() as conn:
|
|
with conn.cursor() as cur:
|
|
cur.execute("SELECT 1 FROM tenants LIMIT 1")
|
|
return cur.fetchone() is not None
|
|
|
|
|
|
# ── Tenants / Ersteinrichtung ──────────────────────────────────────────────────
|
|
def create_tenant(name, dsb_name, dsb_email, retention_tickets_days,
|
|
retention_audit_days, sla_antwort_minuten, sla_loesung_minuten):
|
|
with get_conn() as conn:
|
|
with _dict_cursor(conn) as cur:
|
|
cur.execute(
|
|
"""INSERT INTO tenants
|
|
(name, dsb_name, dsb_email, retention_tickets_days,
|
|
retention_audit_days, sla_antwort_minuten, sla_loesung_minuten)
|
|
VALUES (%s,%s,%s,%s,%s,%s,%s) RETURNING id""",
|
|
(name, dsb_name, dsb_email, retention_tickets_days,
|
|
retention_audit_days, sla_antwort_minuten, sla_loesung_minuten),
|
|
)
|
|
return cur.fetchone()["id"]
|
|
|
|
|
|
def get_tenant(tenant_id):
|
|
with get_conn() as conn:
|
|
with _dict_cursor(conn) as cur:
|
|
cur.execute("SELECT * FROM tenants WHERE id=%s", (tenant_id,))
|
|
return cur.fetchone()
|
|
|
|
|
|
def update_tenant_settings(tenant_id, dsb_name, dsb_email, retention_tickets_days,
|
|
retention_audit_days, sla_antwort_minuten, sla_loesung_minuten):
|
|
with get_conn() as conn:
|
|
with conn.cursor() as cur:
|
|
cur.execute(
|
|
"""UPDATE tenants SET dsb_name=%s, dsb_email=%s,
|
|
retention_tickets_days=%s, retention_audit_days=%s,
|
|
sla_antwort_minuten=%s, sla_loesung_minuten=%s
|
|
WHERE id=%s""",
|
|
(dsb_name, dsb_email, retention_tickets_days, retention_audit_days,
|
|
sla_antwort_minuten, sla_loesung_minuten, tenant_id),
|
|
)
|
|
|
|
|
|
# ── Users ───────────────────────────────────────────────────────────────────────
|
|
def create_user(tenant_id, email, password_hash, role="admin"):
|
|
with get_conn() as conn:
|
|
with _dict_cursor(conn) as cur:
|
|
cur.execute(
|
|
"""INSERT INTO users (tenant_id, email, password_hash, role)
|
|
VALUES (%s,%s,%s,%s) RETURNING id""",
|
|
(tenant_id, email, password_hash, role),
|
|
)
|
|
return cur.fetchone()["id"]
|
|
|
|
|
|
def get_user_by_email(email):
|
|
with get_conn() as conn:
|
|
with _dict_cursor(conn) as cur:
|
|
cur.execute("SELECT * FROM users WHERE email=%s AND active=TRUE", (email,))
|
|
return cur.fetchone()
|
|
|
|
|
|
def touch_last_login(user_id):
|
|
with get_conn() as conn:
|
|
with conn.cursor() as cur:
|
|
cur.execute("UPDATE users SET last_login_at=now() WHERE id=%s", (user_id,))
|
|
|
|
|
|
def email_exists(email):
|
|
with get_conn() as conn:
|
|
with conn.cursor() as cur:
|
|
cur.execute("SELECT 1 FROM users WHERE email=%s", (email,))
|
|
return cur.fetchone() is not None
|
|
|
|
|
|
# ── Audit-Log ───────────────────────────────────────────────────────────────────
|
|
def log_audit(tenant_id, user_id, aktion, entity_typ=None, entity_id=None, details=None, ip=None):
|
|
with get_conn() as conn:
|
|
with conn.cursor() as cur:
|
|
cur.execute(
|
|
"""INSERT INTO audit_log (tenant_id, user_id, aktion, entity_typ, entity_id, details, ip)
|
|
VALUES (%s,%s,%s,%s,%s,%s,%s)""",
|
|
(tenant_id, user_id, aktion, entity_typ, entity_id,
|
|
json.dumps(details) if details is not None else None, ip),
|
|
)
|
|
|
|
|
|
def list_audit(tenant_id, limit=200):
|
|
with get_conn() as conn:
|
|
with _dict_cursor(conn) as cur:
|
|
cur.execute(
|
|
"""SELECT a.*, u.email AS user_email FROM audit_log a
|
|
LEFT JOIN users u ON u.id = a.user_id
|
|
WHERE a.tenant_id=%s ORDER BY a.zeit DESC LIMIT %s""",
|
|
(tenant_id, limit),
|
|
)
|
|
return cur.fetchall()
|
|
|
|
|
|
# ── Services ────────────────────────────────────────────────────────────────────
|
|
def create_service(tenant_id, name, beschreibung, kategorie, gebucht, endpoint):
|
|
with get_conn() as conn:
|
|
with _dict_cursor(conn) as cur:
|
|
cur.execute(
|
|
"""INSERT INTO services (tenant_id, name, beschreibung, kategorie, gebucht, endpoint)
|
|
VALUES (%s,%s,%s,%s,%s,%s) RETURNING id""",
|
|
(tenant_id, name, beschreibung, kategorie, gebucht, endpoint),
|
|
)
|
|
return cur.fetchone()["id"]
|
|
|
|
|
|
def list_services(tenant_id):
|
|
with get_conn() as conn:
|
|
with _dict_cursor(conn) as cur:
|
|
cur.execute("SELECT * FROM services WHERE tenant_id=%s ORDER BY id", (tenant_id,))
|
|
return cur.fetchall()
|
|
|
|
|
|
# ── Tickets ─────────────────────────────────────────────────────────────────────
|
|
def _next_ticket_nr(tenant_id):
|
|
year = _dt.datetime.utcnow().year
|
|
prefix = "TKT-%d-" % year
|
|
with get_conn() as conn:
|
|
with conn.cursor() as cur:
|
|
cur.execute(
|
|
"""SELECT ticket_nr FROM tickets
|
|
WHERE tenant_id=%s AND ticket_nr LIKE %s
|
|
ORDER BY ticket_nr DESC LIMIT 1""",
|
|
(tenant_id, prefix + "%"),
|
|
)
|
|
row = cur.fetchone()
|
|
seq = 1
|
|
if row:
|
|
try:
|
|
seq = int(row[0].split("-")[-1]) + 1
|
|
except Exception:
|
|
seq = 1
|
|
return "%s%06d" % (prefix, seq)
|
|
|
|
|
|
def create_ticket(tenant_id, titel, beschreibung, service_id, prioritaet, kategorie,
|
|
zugewiesen_an, ersteller_id, sla_antwort_minuten, sla_loesung_minuten,
|
|
actor_label):
|
|
ticket_nr = _next_ticket_nr(tenant_id)
|
|
with get_conn() as conn:
|
|
with _dict_cursor(conn) as cur:
|
|
cur.execute(
|
|
"""INSERT INTO tickets
|
|
(tenant_id, ticket_nr, titel, beschreibung, service_id, prioritaet,
|
|
kategorie, zugewiesen_an, ersteller_id, sla_antwort_minuten, sla_loesung_minuten)
|
|
VALUES (%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s) RETURNING id""",
|
|
(tenant_id, ticket_nr, titel, beschreibung, service_id, prioritaet,
|
|
kategorie, zugewiesen_an, ersteller_id, sla_antwort_minuten, sla_loesung_minuten),
|
|
)
|
|
tid = cur.fetchone()["id"]
|
|
cur.execute(
|
|
"""INSERT INTO ticket_timeline (ticket_id, tenant_id, akteur, text)
|
|
VALUES (%s,%s,%s,%s)""",
|
|
(tid, tenant_id, actor_label, "Ticket angelegt."),
|
|
)
|
|
return tid, ticket_nr
|
|
|
|
|
|
def list_tickets(tenant_id):
|
|
with get_conn() as conn:
|
|
with _dict_cursor(conn) as cur:
|
|
cur.execute(
|
|
"""SELECT t.*, s.name AS service_name FROM tickets t
|
|
LEFT JOIN services s ON s.id = t.service_id
|
|
WHERE t.tenant_id=%s ORDER BY t.updated_at DESC""",
|
|
(tenant_id,),
|
|
)
|
|
return cur.fetchall()
|
|
|
|
|
|
def get_ticket(tenant_id, ticket_id):
|
|
with get_conn() as conn:
|
|
with _dict_cursor(conn) as cur:
|
|
cur.execute(
|
|
"""SELECT t.*, s.name AS service_name FROM tickets t
|
|
LEFT JOIN services s ON s.id = t.service_id
|
|
WHERE t.tenant_id=%s AND t.id=%s""",
|
|
(tenant_id, ticket_id),
|
|
)
|
|
ticket = cur.fetchone()
|
|
if not ticket:
|
|
return None
|
|
cur.execute(
|
|
"SELECT * FROM ticket_timeline WHERE ticket_id=%s ORDER BY zeit DESC",
|
|
(ticket_id,),
|
|
)
|
|
ticket = dict(ticket)
|
|
ticket["timeline"] = cur.fetchall()
|
|
return ticket
|
|
|
|
|
|
def update_ticket_status(tenant_id, ticket_id, status, actor_label):
|
|
with get_conn() as conn:
|
|
with conn.cursor() as cur:
|
|
cur.execute(
|
|
"""UPDATE tickets SET status=%s, updated_at=now(),
|
|
fortschritt = CASE WHEN %s IN ('Geloest','Geschlossen') THEN 100 ELSE fortschritt END
|
|
WHERE tenant_id=%s AND id=%s""",
|
|
(status, status, tenant_id, ticket_id),
|
|
)
|
|
cur.execute(
|
|
"""INSERT INTO ticket_timeline (ticket_id, tenant_id, akteur, text)
|
|
VALUES (%s,%s,%s,%s)""",
|
|
(ticket_id, tenant_id, actor_label, "Status geaendert auf '%s'." % status),
|
|
)
|
|
|
|
|
|
# ── Aufbewahrungsfrist-Bereinigung (DSGVO Speicherbegrenzung) ─────────────────
|
|
_RETENTION_LOCK_KEY = 727271 # feste Postgres-Advisory-Lock-ID fuer diesen Job
|
|
|
|
|
|
def run_retention_cleanup():
|
|
"""Loescht abgeschlossene Tickets und Audit-Log-Eintraege, die aelter sind
|
|
als die pro Mandant hinterlegte Aufbewahrungsfrist (retention_tickets_days /
|
|
retention_audit_days). Offene/laufende Tickets werden NIE geloescht, nur
|
|
solche im Status 'Geloest'/'Geschlossen'.
|
|
|
|
Nutzt einen Postgres-Advisory-Lock: laeuft der Job bereits (z. B. durch
|
|
einen anderen Worker-Prozess), wird dieser Aufruf uebersprungen statt
|
|
parallel zu loeschen.
|
|
"""
|
|
with get_conn() as conn:
|
|
with conn.cursor() as cur:
|
|
cur.execute("SELECT pg_try_advisory_lock(%s)", (_RETENTION_LOCK_KEY,))
|
|
got_lock = cur.fetchone()[0]
|
|
if not got_lock:
|
|
return {"skipped": "lock_not_acquired"}
|
|
try:
|
|
with _dict_cursor(conn) as cur:
|
|
cur.execute("SELECT id, name, retention_tickets_days, retention_audit_days FROM tenants")
|
|
tenants = cur.fetchall()
|
|
summary = []
|
|
for t in tenants:
|
|
tid = t["id"]
|
|
with conn.cursor() as cur:
|
|
cur.execute(
|
|
"""DELETE FROM tickets WHERE tenant_id=%s AND status IN ('Geloest','Geschlossen')
|
|
AND updated_at < now() - (%s || ' days')::interval""",
|
|
(tid, t["retention_tickets_days"]),
|
|
)
|
|
tickets_deleted = cur.rowcount
|
|
cur.execute(
|
|
"""DELETE FROM audit_log WHERE tenant_id=%s AND aktion <> 'retention_cleanup'
|
|
AND zeit < now() - (%s || ' days')::interval""",
|
|
(tid, t["retention_audit_days"]),
|
|
)
|
|
audit_deleted = cur.rowcount
|
|
if tickets_deleted or audit_deleted:
|
|
log_audit(tid, None, "retention_cleanup", "tenant", str(tid),
|
|
{"tickets_deleted": tickets_deleted, "audit_log_deleted": audit_deleted})
|
|
summary.append({"tenant_id": tid, "tenant": t["name"],
|
|
"tickets_deleted": tickets_deleted, "audit_log_deleted": audit_deleted})
|
|
return {"summary": summary}
|
|
finally:
|
|
with conn.cursor() as cur:
|
|
cur.execute("SELECT pg_advisory_unlock(%s)", (_RETENTION_LOCK_KEY,))
|