The Great Services Refactor (#594)

* Hooks registration, discovery and retrieval module

Will discover @hooks.register decorated functions inside
the auth_hooks module in any installed django app.

* Class to register modular service apps

* Register service modules URLs

* Example service module

* Refactor services into modules

Each service type has been split out into its own django app/module. A
hook mechanism is provided to register a subclass of the ServiceHook
class. The modules then overload functions defined in ServiceHook as
required to provide interoperability with alliance auth. Service modules
provide their own urls and views for user registration and account
management and a partial template to display on the services page. Where
possible, new modules should provide their own models for local data
storage.

* Added menu items hooks and template tags

* Added menu item hook for broadcasts

* Added str method to ServicesHook

* Added exception handling to hook iterators

* Refactor mumble migration and table name

Upgrading will require `migrate mumble --fake-initial` to be run first
and then `migrate mumble` to rename the table.

* Refactor teamspeak3 migration and rename table

Upgrading will require `migrate teamspeak3 --fake-initial`

* Added module models and migrations for refactoring AuthServicesInfo

* Migrate AuthServiceInfo fields to service modules models

* Added helper for getting a users main character

* Added new style celery instance

* Changed Discord from AuthServicesInfo to DiscordUser model

* Switch celery tasks to staticmethods

* Changed Discourse from AuthServicesInfo to DiscourseUser model

* Changed IPBoard from AuthServicesInfo to IpboardUser model

* Changed Ips4 from AuthServicesInfo to Ips4User model

Also added disable service task.

This service still needs some love though. Was always missing a
deactivate services hook (before refactoring) for reasons I'm unsure of
so I'm reluctant to add it without knowing why.

* Changed Market from AuthServicesInfo to MarketUser model

* Changed Mumble from AuthServicesInfo to MumbleUser model

Switched user foreign key to one to one relationship.
Removed implicit password change on user exists.
Combined regular and blue user creation.

* Changed Openfire from AuthServicesInfo to OpenfireUser model

* Changed SMF from AuthServicesInfo to SmfUser model

Added disable task

* Changed Phpbb3 from AuthServicesInfo to Phpbb3User model

* Changed XenForo from AuthServicesInfo to XenforoUser model

* Changed Teamspeak3 from AuthServicesInfo to Teamspeak3User model

* Remove obsolete manager functions

* Standardise URL format

This will break some callback URLs
Discord changes from /discord_callback/ to /discord/callback/

* Removed unnecessary imports

* Mirror upstream decorator change

* Setup for unit testing

* Unit tests for discord service

* Added add main character helper

* Added Discourse unit tests

* Added Ipboard unit tests

* Added Ips4 unit tests

* Fix naming of market manager, switch to use class methods

* Remove unused hook functions

* Added market service unit tests

* Added corp ticker to add main character helper

* Added mumble unit tests

* Fix url name and remove namespace

* Fix missing return and add missing URL

* Added openfire unit tests

* Added missing return

* Added phpbb3 unit tests

* Fix SmfManager naming inconsistency and switch to classmethods

* Added smf unit tests

* Remove unused functions, Added missing return

* Added xenforo unit tests

* Added missing return

* Fixed reference to old model

* Fixed error preventing groups from syncing on reset request

* Added teamspeak3 unit tests

* Added nose as test runner and some test settings

* Added package requirements for running tests

* Added unit tests for services signals and tasks

* Remove unused tests file

* Fix teamspeak3 service signals

* Added unit tests for teamspeak3 signals

Changed other unit tests setUp to inert signals

* Fix password gen and hashing python3 compatibility

Fixes #630

Adds unit tests to check the password functions run on both platforms.

* Fix unit test to not rely on checking url params

* Add Travis CI settings file

* Remove default blank values from services models

* Added dynamic user model admin actions for syncing service groups

* Remove unused search fields

* Add hook function for syncing nicknames

* Added discord hook for sync nickname

* Added user admin model menu actions for sync nickname hook

* Remove obsolete code

* Rename celery config app to avoid package name clash

* Added new style celerybeat schedule configuration

periodic_task decorator is depreciated

* Added string representations

* Added admin pages for services user models

* Removed legacy code

* Move link discord button to correct template

* Remove blank default fields from example model

* Disallow empty django setting

* Fix typos

* Added coverage configuration file

* Add coverage and coveralls to travis config

Should probably use nose's built in coverage, but this works for now.

* Replace AuthServicesInfo get_or_create instances with get

Reflects upstream changes to AuthServicesInfo behaviour.

* Update mumble user table name

* Split out mumble authenticator requirements

zeroc-ice seems to cause long build times on travis-ci and isn't
required for the core projects functionality or testing.

services/admin.py

@@ -1,17 +1,5 @@
 from __future__ import unicode_literals
 from django.contrib import admin
-from services.models import AuthTS
-from services.models import MumbleUser
 from services.models import GroupCache
 
-
-class AuthTSgroupAdmin(admin.ModelAdmin):
-    fields = ['auth_group', 'ts_group']
-    filter_horizontal = ('ts_group',)
-
-
-admin.site.register(AuthTS, AuthTSgroupAdmin)
-
-admin.site.register(MumbleUser)
-
 admin.site.register(GroupCache)

services/forms.py

@@ -1,14 +1,9 @@
 from __future__ import unicode_literals
+
 from django import forms
-from services.managers.teamspeak3_manager import Teamspeak3Manager
 from django.utils.translation import ugettext_lazy as _
 
 
-class JabberBroadcastForm(forms.Form):
-    group = forms.ChoiceField(label=_('Group'), widget=forms.Select)
-    message = forms.CharField(label=_('Message'), widget=forms.Textarea)
-
-
 class FleetFormatterForm(forms.Form):
     fleet_name = forms.CharField(label=_('Name of Fleet:'), required=True)
     fleet_commander = forms.CharField(label=_('Fleet Commander:'), required=True)
@@ -26,12 +21,6 @@ class FleetFormatterForm(forms.Form):
     comments = forms.CharField(label=_('Comments'), widget=forms.Textarea, required=False)
 
 
-class DiscordForm(forms.Form):
-    email = forms.CharField(label=_("Email Address"), required=True)
-    password = forms.CharField(label=_("Password"), required=True, widget=forms.PasswordInput)
-    update_avatar = forms.BooleanField(label=_("Update Avatar"), required=False, initial=True)
-
-
 class ServicePasswordForm(forms.Form):
     password = forms.CharField(label=_("Password"), required=True)
 
@@ -40,12 +29,3 @@ class ServicePasswordForm(forms.Form):
         if not len(password) >= 8:
             raise forms.ValidationError(_("Password must be at least 8 characters long."))
         return password
-
-
-class TeamspeakJoinForm(forms.Form):
-    username = forms.CharField(widget=forms.HiddenInput())
-
-    def clean(self):
-        if Teamspeak3Manager._get_userid(self.cleaned_data['username']):
-            return self.cleaned_data
-        raise forms.ValidationError(_("Unable to locate user %s on server") % self.cleaned_data['username'])

services/hooks.py

@@ -0,0 +1,134 @@
+from __future__ import unicode_literals
+
+from django.template.loader import render_to_string
+from django.utils.safestring import mark_safe
+
+from authentication.states import MEMBER_STATE, BLUE_STATE
+from authentication.models import AuthServicesInfo
+
+
+class ServicesHook:
+    """
+    Abstract base class for creating a compatible services
+    hook. Decorate with @register('services_hook') to have the
+    services module registered for callbacks. Must be in
+    auth_hook(.py) sub module
+    """
+    def __init__(self):
+        self.name = 'Undefined'
+        self.urlpatterns = []
+        self.service_ctrl_template = 'registered/services_ctrl.html'
+
+    @property
+    def title(self):
+        """
+        A nicely formatted title of the service, for client facing
+        display.
+        :return: str
+        """
+        return self.name.title()
+
+    def delete_user(self, user, notify_user=False):
+        """
+        Delete the users service account, optionally notify them
+        that the service has been disabled
+        :param user: Django.contrib.auth.models.User
+        :param notify_user: Whether the service should sent a
+        notification to the user about the disabling of their
+        service account.
+        :return: True if the service account has been disabled,
+        or False if it doesnt exist.
+        """
+        pass
+
+    def validate_user(self, user):
+        pass
+
+    def sync_nickname(self, user):
+        """
+        Sync the users nickname
+        :param user: Django.contrib.auth.models.User
+        :return: None
+        """
+        pass
+
+    def update_groups(self, user):
+        """
+        Update the users group membership
+        :param user: Django.contrib.auth.models.User
+        :return: None
+        """
+        pass
+
+    def update_all_groups(self):
+        """
+        Iterate through and update all users groups
+        :return: None
+        """
+        pass
+
+    def service_enabled_members(self):
+        """
+        Return setting config for service enabled for members
+        :return: bool True if enabled
+        """
+        return False
+
+    def service_enabled_blues(self):
+        """
+        Return setting config for service enabled for Blues
+        :return: bool True if enabled
+        """
+        return False
+
+    def service_active_for_user(self, user):
+        state = AuthServicesInfo.objects.get(user=user).state
+        return (
+            (state == MEMBER_STATE and self.service_enabled_members()) or
+            (state == BLUE_STATE and self.service_enabled_blues())
+        )
+
+    def show_service_ctrl(self, user, state):
+        """
+        Whether the service control should be displayed to the given user
+        who has the given service state. Usually this function wont
+        require overloading.
+        :param user: django.contrib.auth.models.User
+        :param state: auth user state
+        :return: bool True if the service should be shown
+        """
+        return (self.service_enabled_members() and (
+            state == MEMBER_STATE or user.is_superuser)) or (
+                self.service_enabled_blues() and (state == BLUE_STATE or user.is_superuser))
+
+    def render_services_ctrl(self, request):
+        """
+        Render the services control template row
+        :param request:
+        :return:
+        """
+        return ''
+
+    def __str__(self):
+        return self.name or 'Unknown Service Module'
+
+    class Urls:
+        def __init__(self):
+            self.auth_activate = ''
+            self.auth_set_password = ''
+            self.auth_reset_password = ''
+            self.auth_deactivate = ''
+
+
+class MenuItemHook:
+    def __init__(self, text, classes, url_name, order=None):
+        self.text = text
+        self.classes = classes
+        self.url_name = url_name
+        self.template = 'public/menuitem.html'
+        self.order = order if order is not None else 9999
+
+    def render(self, request):
+        return render_to_string(self.template,
+                                {'item': self},
+                                request=request)

services/managers/fleetup_manager.py

@@ -1,178 +0,0 @@
-from __future__ import unicode_literals
-from django.conf import settings
-from datetime import datetime
-
-import logging
-import requests
-import json
-
-logger = logging.getLogger(__name__)
-
-appkey = settings.FLEETUP_APP_KEY
-userid = settings.FLEETUP_USER_ID
-apiid = settings.FLEETUP_API_ID
-groupid = settings.FLEETUP_GROUP_ID
-
-
-class FleetUpManager:
-    def __init__(self):
-        pass
-
-    @staticmethod
-    def get_fleetup_members():
-        url = "http://api.fleet-up.com/Api.svc/" + str(appkey) + "/" + str(userid) + "/" + str(
-            apiid) + "/GroupCharacters/" + str(groupid) + ""
-        try:
-            jsondata = requests.get(url).content
-            fmembers = json.loads(jsondata.decode())
-            return {row["UserId"]: {"user_id": row["UserId"],
-                                    "char_name": row["EveCharName"],
-                                    "char_id": row["EveCharId"],
-                                    "corporation": row["Corporation"]} for row in fmembers["Data"]}
-        except requests.exceptions.ConnectionError:
-            logger.warn("Can't connect to Fleet-Up API, is it offline?!")
-        except (ValueError, UnicodeDecodeError, TypeError):
-            logger.debug("No fleetup members retrieved.")
-        return {}
-
-    @staticmethod
-    def get_fleetup_operations():
-        url = "http://api.fleet-up.com/Api.svc/" + str(appkey) + "/" + str(userid) + "/" + str(
-            apiid) + "/Operations/" + str(groupid) + ""
-        try:
-            jsondata = requests.get(url).content
-            foperations = json.loads(jsondata.decode())
-            return {row["StartString"]: {"subject": row["Subject"],
-                                         "start": (datetime.strptime(row["StartString"], "%Y-%m-%d %H:%M:%S")),
-                                         "end": (datetime.strptime(row["EndString"], "%Y-%m-%d %H:%M:%S")),
-                                         "operation_id": row["OperationId"],
-                                         "location": row["Location"],
-                                         "location_info": row["LocationInfo"],
-                                         "details": row["Details"],
-                                         "url": row["Url"],
-                                         "doctrine": row["Doctrines"],
-                                         "organizer": row["Organizer"]} for row in foperations["Data"]}
-        except requests.exceptions.ConnectionError:
-            logger.warn("Can't connect to Fleet-Up API, is it offline?!")
-        except (ValueError, UnicodeDecodeError):
-            logger.debug("No fleetup operations retrieved.")
-        return {}
-
-    @staticmethod
-    def get_fleetup_timers():
-        url = "http://api.fleet-up.com/Api.svc/" + str(appkey) + "/" + str(userid) + "/" + str(
-            apiid) + "/Timers/" + str(groupid) + ""
-        try:
-            jsondata = requests.get(url).content
-            ftimers = json.loads(jsondata.decode())
-            return {row["ExpiresString"]: {"solarsystem": row["SolarSystem"],
-                                           "planet": row["Planet"],
-                                           "moon": row["Moon"],
-                                           "owner": row["Owner"],
-                                           "type": row["Type"],
-                                           "timer_type": row["TimerType"],
-                                           "expires": (datetime.strptime(row["ExpiresString"], "%Y-%m-%d %H:%M:%S")),
-                                           "notes": row["Notes"]} for row in ftimers["Data"]}
-        except requests.exceptions.ConnectionError:
-            logger.warn("Can't connect to Fleet-Up API, is it offline?!")
-        except (ValueError, UnicodeDecodeError, TypeError):
-            logger.debug("No fleetup timers retrieved.")
-        return {}
-
-    @staticmethod
-    def get_fleetup_doctrines():
-        url = "http://api.fleet-up.com/Api.svc/" + str(appkey) + "/" + str(userid) + "/" + str(
-            apiid) + "/Doctrines/" + str(groupid) + ""
-        try:
-            jsondata = requests.get(url).content
-            fdoctrines = json.loads(jsondata.decode())
-            return {"fleetup_doctrines": fdoctrines["Data"]}
-        except requests.exceptions.ConnectionError:
-            logger.warn("Can't connect to Fleet-Up API, is it offline?!")
-        except (ValueError, UnicodeDecodeError):
-            logger.debug("No fleetup doctrines retrieved.")
-        return {"fleetup_doctrines": []}
-
-    @staticmethod
-    def get_fleetup_doctrine(doctrinenumber):
-        url = "http://api.fleet-up.com/Api.svc/" + str(appkey) + "/" + str(userid) + "/" + str(
-            apiid) + "/DoctrineFittings/%s" % doctrinenumber
-        try:
-            jsondata = requests.get(url).content
-            fdoctrine = json.loads(jsondata.decode())
-            return {"fitting_doctrine": fdoctrine}
-        except requests.exceptions.ConnectionError:
-            logger.warn("Can't connect to Fleet-Up API, is it offline?!")
-        except (ValueError, UnicodeDecodeError):
-            logger.warn("Fleetup doctrine number %s not found" % doctrinenumber)
-        return {"fitting_doctrine": {}}
-
-    @staticmethod
-    def get_fleetup_fittings():
-        url = "http://api.fleet-up.com/Api.svc/" + str(appkey) + "/" + str(userid) + "/" + str(
-            apiid) + "/Fittings/" + str(groupid) + ""
-        try:
-            jsondata = requests.get(url).content
-            ffittings = json.loads(jsondata.decode())
-            return {row["FittingId"]: {"fitting_id": row["FittingId"],
-                                       "name": row["Name"],
-                                       "icon_id": row["EveTypeId"],
-                                       "hull": row["HullType"],
-                                       "shiptype": row["ShipType"],
-                                       "estimated": row["EstPrice"],
-                                       "faction": row["Faction"],
-                                       "categories": row["Categories"],
-                                       "last_update": (
-                                       datetime.strptime(row["LastUpdatedString"], "%Y-%m-%d %H:%M:%S"))} for row in
-                    ffittings["Data"]}
-        except requests.exceptions.ConnectionError:
-            logger.warn("Can't connect to Fleet-Up API, is it offline?!")
-        except (ValueError, UnicodeDecodeError, TypeError):
-            logger.debug("No fleetup fittings retrieved.")
-        return {}
-
-    @staticmethod
-    def get_fleetup_fitting(fittingnumber):
-        url = "http://api.fleet-up.com/Api.svc/" + str(appkey) + "/" + str(userid) + "/" + str(
-            apiid) + "/Fitting/%s" % fittingnumber
-        try:
-            jsondata = requests.get(url).content
-            ffitting = json.loads(jsondata.decode())
-            return {"fitting_data": ffitting["Data"]}
-        except requests.exceptions.ConnectionError:
-            logger.warn("Can't connect to Fleet-Up API, is it offline?!")
-        except (ValueError, UnicodeDecodeError):
-            logger.warn("Fleetup fitting number %s not found" % fittingnumber)
-        except KeyError:
-            logger.warn("Failed to retrieve fleetup fitting number %s" % fittingnumber)
-        return {"fitting_data": {}}
-
-    @staticmethod
-    def get_fleetup_doctrineid(fittingnumber):
-        url = "http://api.fleet-up.com/Api.svc/" + str(appkey) + "/" + str(userid) + "/" + str(
-            apiid) + "/Fitting/%s" % fittingnumber
-        try:
-            jsondata = requests.get(url).content
-            fdoctrineid = json.loads(jsondata.decode())
-            return fdoctrineid['Data']['Doctrines'][0]['DoctrineId']
-        except requests.exceptions.ConnectionError:
-            logger.warn("Can't connect to Fleet-Up API, is it offline?!")
-        except (ValueError, UnicodeDecodeError):
-            logger.warn("Fleetup doctrine number not found for fitting number %s" % fittingnumber)
-        except (KeyError, IndexError):
-            logger.debug("Fleetup fitting number %s not in a doctrine." % fittingnumber)
-        return None
-
-    @staticmethod
-    def get_fleetup_fitting_eft(fittingnumber):
-        url = "http://api.fleet-up.com/Api.svc/" + str(appkey) + "/" + str(userid) + "/" + str(
-            apiid) + "/Fitting/%s/eft" % fittingnumber
-        try:
-            jsondata = requests.get(url).content
-            ffittingeft = json.loads(jsondata.decode())
-            return {"fitting_eft": ffittingeft["Data"]["FittingData"]}
-        except requests.exceptions.ConnectionError:
-            logger.warn("Can't connect to Fleet-Up API, is it offline?!")
-        except (ValueError, UnicodeDecodeError):
-            logger.warn("Fleetup fitting eft not found for fitting number %s" % fittingnumber)
-        return {"fitting_eft": {}}

services/managers/mumble_manager.py

@@ -1,121 +0,0 @@
-from __future__ import unicode_literals
-import os
-import hashlib
-
-from services.models import MumbleUser
-
-import logging
-
-logger = logging.getLogger(__name__)
-
-
-class MumbleManager:
-    def __init__(self):
-        pass
-
-    @staticmethod
-    def __santatize_username(username):
-        sanatized = username.replace(" ", "_")
-        return sanatized
-
-    @staticmethod
-    def __generate_random_pass():
-        return os.urandom(8).encode('hex')
-
-    @staticmethod
-    def __generate_username(username, corp_ticker):
-        return "[" + corp_ticker + "]" + username
-
-    @staticmethod
-    def __generate_username_blue(username, corp_ticker):
-        return "[BLUE][" + corp_ticker + "]" + username
-
-    @staticmethod
-    def _gen_pwhash(password):
-        return hashlib.sha1(password).hexdigest()
-
-    @staticmethod
-    def create_user(corp_ticker, username):
-        logger.debug("Creating mumble user with username %s and ticker %s" % (username, corp_ticker))
-        username_clean = MumbleManager.__santatize_username(MumbleManager.__generate_username(username, corp_ticker))
-        password = MumbleManager.__generate_random_pass()
-        pwhash = MumbleManager._gen_pwhash(password)
-        logger.debug("Proceeding with mumble user creation: clean username %s, pwhash starts with %s" % (
-            username_clean, pwhash[0:5]))
-        if MumbleUser.objects.filter(username=username_clean).exists() is False:
-            logger.info("Creating mumble user %s" % username_clean)
-            MumbleUser.objects.create(username=username_clean, pwhash=pwhash)
-            return username_clean, password
-        else:
-            logger.warn("Mumble user %s already exists. Updating password")
-            model = MumbleUser.objects.get(username=username_clean)
-            model.pwhash = pwhash
-            model.save()
-            logger.info("Updated mumble user %s" % username_clean)
-            return username_clean, password
-
-    @staticmethod
-    def create_blue_user(corp_ticker, username):
-        logger.debug("Creating mumble blue user with username %s and ticker %s" % (username, corp_ticker))
-        username_clean = MumbleManager.__santatize_username(
-            MumbleManager.__generate_username_blue(username, corp_ticker))
-        password = MumbleManager.__generate_random_pass()
-        pwhash = MumbleManager._gen_pwhash(password)
-        logger.debug("Proceeding with mumble user creation: clean username %s, pwhash starts with %s" % (
-            username_clean, pwhash[0:5]))
-        if MumbleUser.objects.filter(username=username_clean).exists() is False:
-            logger.info("Creating mumble user %s" % username_clean)
-            MumbleUser.objects.create(username=username_clean, pwhash=pwhash)
-            return username_clean, password
-        else:
-            logger.warn("Mumble user %s already exists. Updating password")
-            model = MumbleUser.objects.get(username=username_clean)
-            model.pwhash = pwhash
-            model.save()
-            logger.info("Updated mumble user %s" % username_clean)
-            return username_clean, password
-
-    @staticmethod
-    def delete_user(username):
-        logger.debug("Deleting user %s from mumble." % username)
-        if MumbleUser.objects.filter(username=username).exists():
-            MumbleUser.objects.filter(username=username).delete()
-            logger.info("Deleted user %s from mumble" % username)
-            return True
-        logger.error("Unable to delete user %s from mumble: MumbleUser model not found" % username)
-        return False
-
-    @staticmethod
-    def update_user_password(username, password=None):
-        logger.debug("Updating mumble user %s password." % username)
-        if not password:
-            password = MumbleManager.__generate_random_pass()
-        pwhash = MumbleManager._gen_pwhash(password)
-        logger.debug("Proceeding with mumble user %s password update - pwhash starts with %s" % (username, pwhash[0:5]))
-        if MumbleUser.objects.filter(username=username).exists():
-            model = MumbleUser.objects.get(username=username)
-            model.pwhash = pwhash
-            model.save()
-            return password
-        logger.error("User %s not found on mumble. Unable to update password." % username)
-        return ""
-
-    @staticmethod
-    def update_groups(username, groups):
-        logger.debug("Updating mumble user %s groups %s" % (username, groups))
-        safe_groups = list(set([g.replace(' ', '-') for g in groups]))
-        groups = ''
-        for g in safe_groups:
-            groups = groups + g + ','
-        groups = groups.strip(',')
-        if MumbleUser.objects.filter(username=username).exists():
-            logger.info("Updating mumble user %s groups to %s" % (username, safe_groups))
-            model = MumbleUser.objects.get(username=username)
-            model.groups = groups
-            model.save()
-        else:
-            logger.error("User %s not found on mumble. Unable to update groups." % username)
-
-    @staticmethod
-    def user_exists(username):
-        return MumbleUser.objects.filter(username=username).exists()

services/migrations/0001_initial.py

@@ -17,16 +17,6 @@ class Migration(migrations.Migration):
     ]
 
     operations = [
-        migrations.CreateModel(
-            name='AuthTS',
-            fields=[
-                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
-                ('auth_group', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to='auth.Group')),
-            ],
-            options={
-                'verbose_name': 'Auth / TS Group',
-            },
-        ),
         migrations.CreateModel(
             name='DiscordAuthToken',
             fields=[
@@ -45,39 +35,4 @@ class Migration(migrations.Migration):
                 ('service', models.CharField(choices=[(b'discourse', b'discourse'), (b'discord', b'discord')], max_length=254, unique=True)),
             ],
         ),
-        migrations.CreateModel(
-            name='MumbleUser',
-            fields=[
-                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
-                ('username', models.CharField(max_length=254, unique=True)),
-                ('pwhash', models.CharField(max_length=40)),
-                ('groups', models.TextField(blank=True, null=True)),
-            ],
-        ),
-        migrations.CreateModel(
-            name='TSgroup',
-            fields=[
-                ('ts_group_id', models.IntegerField(primary_key=True, serialize=False)),
-                ('ts_group_name', models.CharField(max_length=30)),
-            ],
-            options={
-                'verbose_name': 'TS Group',
-            },
-        ),
-        migrations.CreateModel(
-            name='UserTSgroup',
-            fields=[
-                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
-                ('ts_group', models.ManyToManyField(to='services.TSgroup')),
-                ('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to=settings.AUTH_USER_MODEL)),
-            ],
-            options={
-                'verbose_name': 'User TS Group',
-            },
-        ),
-        migrations.AddField(
-            model_name='authts',
-            name='ts_group',
-            field=models.ManyToManyField(to='services.TSgroup'),
-        ),
     ]

services/models.py

@@ -3,52 +3,6 @@ from django.utils.encoding import python_2_unicode_compatible
 from django.db import models
 
 
-@python_2_unicode_compatible
-class TSgroup(models.Model):
-    ts_group_id = models.IntegerField(primary_key=True)
-    ts_group_name = models.CharField(max_length=30)
-
-    class Meta:
-        verbose_name = 'TS Group'
-
-    def __str__(self):
-        return self.ts_group_name
-
-
-@python_2_unicode_compatible
-class AuthTS(models.Model):
-    auth_group = models.ForeignKey('auth.Group')
-    ts_group = models.ManyToManyField(TSgroup)
-
-    class Meta:
-        verbose_name = 'Auth / TS Group'
-
-    def __str__(self):
-        return self.auth_group.name
-
-
-@python_2_unicode_compatible
-class UserTSgroup(models.Model):
-    user = models.ForeignKey('auth.User')
-    ts_group = models.ManyToManyField(TSgroup)
-
-    class Meta:
-        verbose_name = 'User TS Group'
-
-    def __str__(self):
-        return self.user.name
-
-
-@python_2_unicode_compatible
-class MumbleUser(models.Model):
-    username = models.CharField(max_length=254, unique=True)
-    pwhash = models.CharField(max_length=40)
-    groups = models.TextField(blank=True, null=True)
-
-    def __str__(self):
-        return self.username
-
-
 @python_2_unicode_compatible
 class GroupCache(models.Model):
     SERVICE_CHOICES = (

services/modules/discord/admin.py

@@ -0,0 +1,10 @@
+from __future__ import unicode_literals
+from django.contrib import admin
+from .models import DiscordUser
+
+
+class DiscordUserAdmin(admin.ModelAdmin):
+        list_display = ('user', 'uid')
+        search_fields = ('user__username', 'uid')
+
+admin.site.register(DiscordUser, DiscordUserAdmin)

services/modules/discord/apps.py

@@ -0,0 +1,7 @@
+from __future__ import unicode_literals
+
+from django.apps import AppConfig
+
+
+class DiscordServiceConfig(AppConfig):
+    name = 'discord'

services/modules/discord/auth_hooks.py

@@ -0,0 +1,59 @@
+from __future__ import unicode_literals
+
+import logging
+
+from django.conf import settings
+from django.template.loader import render_to_string
+
+from alliance_auth import hooks
+from services.hooks import ServicesHook
+from .tasks import DiscordTasks
+from .urls import urlpatterns
+
+logger = logging.getLogger(__name__)
+
+
+class DiscordService(ServicesHook):
+    def __init__(self):
+        ServicesHook.__init__(self)
+        self.urlpatterns = urlpatterns
+        self.name = 'discord'
+        self.service_ctrl_template = 'registered/discord_service_ctrl.html'
+
+    def delete_user(self, user, notify_user=False):
+        logger.debug('Deleting user %s %s account' % (user, self.name))
+        return DiscordTasks.delete_user(user, notify_user=notify_user)
+
+    def update_groups(self, user):
+        logger.debug('Processing %s groups for %s' % (self.name, user))
+        if DiscordTasks.has_account(user):
+            DiscordTasks.update_groups.delay(user.pk)
+
+    def validate_user(self, user):
+        logger.debug('Validating user %s %s account' % (user, self.name))
+        if DiscordTasks.has_account(user) and not self.service_active_for_user(user):
+            self.delete_user(user, notify_user=True)
+
+    def sync_nickname(self, user):
+        logger.debug('Syncing %s nickname for user %s' % (self.name, user))
+        DiscordTasks.update_nickname.delay(user.pk)
+
+    def update_all_groups(self):
+        logger.debug('Update all %s groups called' % self.name)
+        DiscordTasks.update_all_groups.delay()
+
+    def service_enabled_members(self):
+        return settings.ENABLE_AUTH_DISCORD or False
+
+    def service_enabled_blues(self):
+        return settings.ENABLE_BLUE_DISCORD or False
+
+    def render_services_ctrl(self, request):
+        return render_to_string(self.service_ctrl_template, {
+            'discord_uid': request.user.discord.uid if DiscordTasks.has_account(request.user) else None,
+        }, request=request)
+
+
+@hooks.register('services_hook')
+def register_service():
+    return DiscordService()

services/modules/discord/migrations/0001_initial.py

@@ -0,0 +1,26 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.10.2 on 2016-12-12 03:14
+from __future__ import unicode_literals
+
+from django.conf import settings
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        ('auth', '0008_alter_user_username_max_length'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='DiscordUser',
+            fields=[
+                ('user', models.OneToOneField(on_delete=django.db.models.deletion.CASCADE, primary_key=True, related_name='discord', serialize=False, to=settings.AUTH_USER_MODEL)),
+                ('uid', models.CharField(max_length=254)),
+            ],
+        ),
+    ]

services/modules/discord/models.py

@@ -0,0 +1,15 @@
+from __future__ import unicode_literals
+from django.utils.encoding import python_2_unicode_compatible
+from django.contrib.auth.models import User
+from django.db import models
+
+
+class DiscordUser(models.Model):
+    user = models.OneToOneField(User,
+                                primary_key=True,
+                                on_delete=models.CASCADE,
+                                related_name='discord')
+    uid = models.CharField(max_length=254)
+
+    def __str__(self):
+        return "{} - {}".format(self.user.username, self.uid)

services/modules/discord/tasks.py

@@ -0,0 +1,131 @@
+from __future__ import unicode_literals
+
+import logging
+
+from alliance_auth.celeryapp import app
+from django.conf import settings
+from django.contrib.auth.models import User
+from django.core.exceptions import ObjectDoesNotExist
+
+from eveonline.managers import EveManager
+from notifications import notify
+from services.modules.discord.manager import DiscordOAuthManager
+from services.tasks import only_one
+from .models import DiscordUser
+
+logger = logging.getLogger(__name__)
+
+
+class DiscordTasks:
+    def __init__(self):
+        pass
+
+    @classmethod
+    def add_user(cls, user, code):
+        user_id = DiscordOAuthManager.add_user(code)
+        if user_id:
+            discord_user = DiscordUser()
+            discord_user.user = user
+            discord_user.uid = user_id
+            discord_user.save()
+            if settings.DISCORD_SYNC_NAMES:
+                cls.update_nickname.delay(user.pk)
+            cls.update_groups.delay(user.pk)
+            return True
+        return False
+
+    @classmethod
+    def delete_user(cls, user, notify_user=False):
+        if cls.has_account(user):
+            logger.debug("User %s has discord account %s. Deleting." % (user, user.discord.uid))
+            if DiscordOAuthManager.delete_user(user.discord.uid):
+                user.discord.delete()
+                if notify_user:
+                    notify(user, 'Discord Account Disabled', level='danger')
+                return True
+        return False
+
+    @classmethod
+    def has_account(cls, user):
+        """
+        Check if the user has an account (has a DiscordUser record)
+        :param user: django.contrib.auth.models.User
+        :return: bool
+        """
+        try:
+            user.discord
+        except ObjectDoesNotExist:
+            return False
+        else:
+            return True
+
+    @staticmethod
+    @app.task(bind=True)
+    def update_groups(task_self, pk):
+        user = User.objects.get(pk=pk)
+        logger.debug("Updating discord groups for user %s" % user)
+        if DiscordTasks.has_account(user):
+            groups = []
+            for group in user.groups.all():
+                groups.append(str(group.name))
+            if len(groups) == 0:
+                logger.debug("No syncgroups found for user. Adding empty group.")
+                groups.append('empty')
+            logger.debug("Updating user %s discord groups to %s" % (user, groups))
+            try:
+                DiscordOAuthManager.update_groups(user.discord.uid, groups)
+            except Exception as e:
+                if task_self:
+                    logger.exception("Discord group sync failed for %s, retrying in 10 mins" % user)
+                    raise task_self.retry(countdown=60 * 10)
+                else:
+                    # Rethrow
+                    raise e
+            logger.debug("Updated user %s discord groups." % user)
+        else:
+            logger.debug("User does not have a discord account, skipping")
+
+    @staticmethod
+    @app.task
+    def update_all_groups():
+        logger.debug("Updating ALL discord groups")
+        for discord_user in DiscordUser.objects.exclude(uid__exact=''):
+            DiscordTasks.update_groups.delay(discord_user.user.pk)
+
+    @staticmethod
+    @app.task(bind=True)
+    def update_nickname(self, pk):
+        user = User.objects.get(pk=pk)
+        logger.debug("Updating discord nickname for user %s" % user)
+        if DiscordTasks.has_account(user):
+            character = EveManager.get_main_character(user)
+            logger.debug("Updating user %s discord nickname to %s" % (user, character.character_name))
+            try:
+                DiscordOAuthManager.update_nickname(user.discord.uid, character.character_name)
+            except Exception as e:
+                if self:
+                    logger.exception("Discord nickname sync failed for %s, retrying in 10 mins" % user)
+                    raise self.retry(countdown=60 * 10)
+                else:
+                    # Rethrow
+                    raise e
+            logger.debug("Updated user %s discord nickname." % user)
+        else:
+            logger.debug("User %s does not have a discord account" % user)
+
+    @staticmethod
+    @app.task
+    def update_all_nicknames():
+        logger.debug("Updating ALL discord nicknames")
+        for discord_user in DiscordUser.objects.exclude(uid__exact=''):
+            DiscordTasks.update_nickname.delay(discord_user.user.user_id)
+
+    @classmethod
+    def disable(cls):
+        if settings.ENABLE_AUTH_DISCORD:
+            logger.warn(
+                "ENABLE_AUTH_DISCORD still True, after disabling users will still be able to link Discord accounts")
+        if settings.ENABLE_BLUE_DISCORD:
+            logger.warn(
+                "ENABLE_BLUE_DISCORD still True, after disabling blues will still be able to link Discord accounts")
+        DiscordUser.objects.all().delete()

services/modules/discord/templates/registered/discord_service_ctrl.html

@@ -0,0 +1,27 @@
+{% load i18n %}
+
+
+<tr>
+    <td class="text-center">Discord</td>
+    <td class="text-center"></td>
+    <td class="text-center"><a href="https://discordapp.com/channels/{{ DISCORD_SERVER_ID }}/{{ DISCORD_SERVER_ID}}">https://discordapp.com</a></td>
+    <td class="text-center">
+        {% if not discord_uid %}
+            <a href="{% url 'auth_activate_discord' %}" class="btn btn-warning">
+                <span class="glyphicon glyphicon-ok"></span>
+            </a>
+        {% else %}
+            <a href="{% url 'auth_reset_discord' %}" class="btn btn-primary">
+                <span class="glyphicon glyphicon-refresh"></span>
+            </a>
+            <a href="{% url 'auth_deactivate_discord' %}" class="btn btn-danger">
+                <span class="glyphicon glyphicon-remove"></span>
+            </a>
+        {% endif %}
+        {% if request.user.is_superuser %}
+            <div class="text-center" style="padding-top:5px;">
+                <a type="button" class="btn btn-success" href="{% url 'auth_discord_add_bot' %}">{% trans "Link Discord" %} Server</a>
+            </div>
+        {% endif %}
+    </td>
+</tr>

services/modules/discord/tests.py

@@ -0,0 +1,193 @@
+from __future__ import unicode_literals
+
+try:
+    # Py3
+    from unittest import mock
+except ImportError:
+    # Py2
+    import mock
+
+from django.test import TestCase, RequestFactory
+from django.conf import settings
+from django.contrib.auth.models import User
+from django.core.exceptions import ObjectDoesNotExist
+
+from alliance_auth.tests.auth_utils import AuthUtils
+
+from .auth_hooks import DiscordService
+from .models import DiscordUser
+from .tasks import DiscordTasks
+
+MODULE_PATH = 'services.modules.discord'
+
+
+class DiscordHooksTestCase(TestCase):
+    def setUp(self):
+        self.member = 'member_user'
+        member = AuthUtils.create_member(self.member)
+        DiscordUser.objects.create(user=member, uid='12345')
+        self.blue = 'blue_user'
+        blue = AuthUtils.create_blue(self.blue)
+        DiscordUser.objects.create(user=blue, uid='67891')
+        self.none_user = 'none_user'
+        none_user = AuthUtils.create_user(self.none_user)
+        self.service = DiscordService
+
+    def test_has_account(self):
+        member = User.objects.get(username=self.member)
+        blue = User.objects.get(username=self.blue)
+        none_user = User.objects.get(username=self.none_user)
+        self.assertTrue(DiscordTasks.has_account(member))
+        self.assertTrue(DiscordTasks.has_account(blue))
+        self.assertFalse(DiscordTasks.has_account(none_user))
+
+    def test_service_enabled(self):
+        service = self.service()
+        member = User.objects.get(username=self.member)
+        blue = User.objects.get(username=self.blue)
+        none_user = User.objects.get(username=self.none_user)
+        self.assertTrue(service.service_enabled_members())
+        self.assertTrue(service.service_enabled_blues())
+
+        self.assertTrue(service.service_active_for_user(member))
+        self.assertTrue(service.service_active_for_user(blue))
+        self.assertFalse(service.service_active_for_user(none_user))
+
+    @mock.patch(MODULE_PATH + '.tasks.DiscordOAuthManager')
+    def test_update_all_groups(self, manager):
+        service = self.service()
+        service.update_all_groups()
+        # Check member and blue user have groups updated
+        self.assertTrue(manager.update_groups.called)
+        self.assertEqual(manager.update_groups.call_count, 2)
+
+    def test_update_groups(self):
+        # Check member has Member group updated
+        with mock.patch(MODULE_PATH + '.tasks.DiscordOAuthManager') as manager:
+            service = self.service()
+            member = User.objects.get(username=self.member)
+            service.update_groups(member)
+            self.assertTrue(manager.update_groups.called)
+            args, kwargs = manager.update_groups.call_args
+            user_id, groups = args
+            self.assertIn(settings.DEFAULT_AUTH_GROUP, groups)
+            self.assertEqual(user_id, member.discord.uid)
+
+        # Check none user does not have groups updated
+        with mock.patch(MODULE_PATH + '.tasks.DiscordOAuthManager') as manager:
+            service = self.service()
+            none_user = User.objects.get(username=self.none_user)
+            service.update_groups(none_user)
+            self.assertFalse(manager.update_groups.called)
+
+    @mock.patch(MODULE_PATH + '.tasks.DiscordOAuthManager')
+    def test_validate_user(self, manager):
+        service = self.service()
+        # Test member is not deleted
+        member = User.objects.get(username=self.member)
+        service.validate_user(member)
+        self.assertTrue(member.discord)
+
+        # Test none user is deleted
+        none_user = User.objects.get(username=self.none_user)
+        DiscordUser.objects.create(user=none_user, uid='abc123')
+        service.validate_user(none_user)
+        self.assertTrue(manager.delete_user.called)
+        with self.assertRaises(ObjectDoesNotExist):
+            none_discord = User.objects.get(username=self.none_user).discord
+
+    @mock.patch(MODULE_PATH + '.tasks.DiscordOAuthManager')
+    def test_sync_nickname(self, manager):
+        service = self.service()
+        member = User.objects.get(username=self.member)
+        AuthUtils.add_main_character(member, 'test user', '12345', corp_ticker='AAUTH')
+
+        service.sync_nickname(member)
+
+        self.assertTrue(manager.update_nickname.called)
+        args, kwargs = manager.update_nickname.call_args
+        self.assertEqual(args[0], member.discord.uid)
+        self.assertEqual(args[1], 'test user')
+
+    @mock.patch(MODULE_PATH + '.tasks.DiscordOAuthManager')
+    def test_delete_user(self, manager):
+        member = User.objects.get(username=self.member)
+
+        service = self.service()
+        result = service.delete_user(member)
+
+        self.assertTrue(result)
+        self.assertTrue(manager.delete_user.called)
+        with self.assertRaises(ObjectDoesNotExist):
+            discord_user = User.objects.get(username=self.member).discord
+
+    def test_render_services_ctrl(self):
+        service = self.service()
+        member = User.objects.get(username=self.member)
+        request = RequestFactory().get('/en/services/')
+        request.user = member
+
+        response = service.render_services_ctrl(request)
+        self.assertTemplateUsed(service.service_ctrl_template)
+        self.assertIn('/discord/reset/', response)
+        self.assertIn('/discord/deactivate/', response)
+
+        # Test register becomes available
+        member.discord.delete()
+        member = User.objects.get(username=self.member)
+        request.user = member
+        response = service.render_services_ctrl(request)
+        self.assertIn('/discord/activate/', response)
+
+    # TODO: Test update nicknames
+
+
+class DiscordViewsTestCase(TestCase):
+    def setUp(self):
+        self.member = AuthUtils.create_member('auth_member')
+        self.member.set_password('password')
+        self.member.save()
+
+    def login(self):
+        self.client.login(username=self.member.username, password='password')
+
+    @mock.patch(MODULE_PATH + '.views.DiscordOAuthManager')
+    def test_activate(self, manager):
+        self.login()
+        manager.generate_oauth_redirect_url.return_value = '/example.com/oauth/'
+        response = self.client.get('/discord/activate/', follow=False)
+        self.assertRedirects(response, expected_url='/example.com/oauth/', target_status_code=404)
+
+    @mock.patch(MODULE_PATH + '.tasks.DiscordOAuthManager')
+    def test_callback(self, manager):
+        self.login()
+        manager.add_user.return_value = '1234'
+        response = self.client.get('/discord/callback/', data={'code': '1234'})
+
+        self.assertTrue(manager.add_user.called)
+        self.assertEqual(manager.update_nickname.called, settings.DISCORD_SYNC_NAMES)
+        self.assertEqual(self.member.discord.uid, '1234')
+        self.assertRedirects(response, expected_url='/en/services/', target_status_code=200)
+
+    @mock.patch(MODULE_PATH + '.tasks.DiscordOAuthManager')
+    def test_reset(self, manager):
+        self.login()
+        DiscordUser.objects.create(user=self.member, uid='12345')
+        manager.delete_user.return_value = True
+
+        response = self.client.get('/discord/reset/')
+
+        self.assertRedirects(response, expected_url='/discord/activate/', target_status_code=302)
+
+    @mock.patch(MODULE_PATH + '.tasks.DiscordOAuthManager')
+    def test_deactivate(self, manager):
+        self.login()
+        DiscordUser.objects.create(user=self.member, uid='12345')
+        manager.delete_user.return_value = True
+
+        response = self.client.get('/discord/deactivate/')
+
+        self.assertTrue(manager.delete_user.called)
+        self.assertRedirects(response, expected_url='/en/services/', target_status_code=200)
+        with self.assertRaises(ObjectDoesNotExist):
+            discord_user = User.objects.get(pk=self.member.pk).discord

services/modules/discord/urls.py

@@ -0,0 +1,17 @@
+from __future__ import unicode_literals
+from django.conf.urls import url, include
+
+from . import views
+
+module_urls = [
+    # Discord Service Control
+    url(r'^activate/$', views.activate_discord, name='auth_activate_discord'),
+    url(r'^deactivate/$', views.deactivate_discord, name='auth_deactivate_discord'),
+    url(r'^reset/$', views.reset_discord, name='auth_reset_discord'),
+    url(r'^callback/$', views.discord_callback, name='auth_discord_callback'),
+    url(r'^add_bot/$', views.discord_add_bot, name='auth_discord_add_bot'),
+]
+
+urlpatterns = [
+    url(r'^discord/', include(module_urls))
+]

services/modules/discord/views.py

@@ -0,0 +1,71 @@
+from __future__ import unicode_literals
+
+import logging
+
+from django.contrib import messages
+from django.contrib.auth.decorators import login_required
+from django.contrib.auth.decorators import user_passes_test
+from django.shortcuts import redirect
+
+from authentication.decorators import members_and_blues
+from .manager import DiscordOAuthManager
+from .tasks import DiscordTasks
+from services.views import superuser_test
+
+
+logger = logging.getLogger(__name__)
+
+
+@login_required
+@members_and_blues()
+def deactivate_discord(request):
+    logger.debug("deactivate_discord called by user %s" % request.user)
+    if DiscordTasks.delete_user(request.user):
+        logger.info("Successfully deactivated discord for user %s" % request.user)
+        messages.success(request, 'Deactivated Discord account.')
+    else:
+        logger.error("Unsuccessful attempt to deactivate discord for user %s" % request.user)
+        messages.error(request, 'An error occurred while processing your Discord account.')
+    return redirect("auth_services")
+
+
+@login_required
+@members_and_blues()
+def reset_discord(request):
+    logger.debug("reset_discord called by user %s" % request.user)
+    if DiscordTasks.delete_user(request.user):
+        logger.info("Successfully deleted discord user for user %s - forwarding to discord activation." % request.user)
+        return redirect("auth_activate_discord")
+    logger.error("Unsuccessful attempt to reset discord for user %s" % request.user)
+    messages.error(request, 'An error occurred while processing your Discord account.')
+    return redirect("auth_services")
+
+
+@login_required
+@members_and_blues()
+def activate_discord(request):
+    logger.debug("activate_discord called by user %s" % request.user)
+    return redirect(DiscordOAuthManager.generate_oauth_redirect_url())
+
+
+@login_required
+@members_and_blues()
+def discord_callback(request):
+    logger.debug("Received Discord callback for activation of user %s" % request.user)
+    code = request.GET.get('code', None)
+    if not code:
+        logger.warn("Did not receive OAuth code from callback of user %s" % request.user)
+        return redirect("auth_services")
+    if DiscordTasks.add_user(request.user, code):
+        logger.info("Successfully activated Discord for user %s" % request.user)
+        messages.success(request, 'Activated Discord account.')
+    else:
+        logger.error("Failed to activate Discord for user %s" % request.user)
+        messages.error(request, 'An error occurred while processing your Discord account.')
+    return redirect("auth_services")
+
+
+@login_required
+@user_passes_test(superuser_test)
+def discord_add_bot(request):
+    return redirect(DiscordOAuthManager.generate_bot_add_url())

services/modules/discourse/admin.py

@@ -0,0 +1,10 @@
+from __future__ import unicode_literals
+from django.contrib import admin
+from .models import DiscourseUser
+
+
+class DiscourseUserAdmin(admin.ModelAdmin):
+        list_display = ('user',)
+        search_fields = ('user__username',)
+
+admin.site.register(DiscourseUser, DiscourseUserAdmin)

services/modules/discourse/apps.py

@@ -0,0 +1,7 @@
+from __future__ import unicode_literals
+
+from django.apps import AppConfig
+
+
+class DiscourseServiceConfig(AppConfig):
+    name = 'discourse'

services/modules/discourse/auth_hooks.py

@@ -0,0 +1,57 @@
+from __future__ import unicode_literals
+
+from django.conf import settings
+from django.template.loader import render_to_string
+
+from services.hooks import ServicesHook
+from alliance_auth import hooks
+from eveonline.managers import EveManager
+
+from .urls import urlpatterns
+from .tasks import DiscourseTasks
+
+import logging
+
+logger = logging.getLogger(__name__)
+
+
+class DiscourseService(ServicesHook):
+    def __init__(self):
+        ServicesHook.__init__(self)
+        self.urlpatterns = urlpatterns
+        self.name = 'discourse'
+        self.service_ctrl_template = 'registered/discourse_service_ctrl.html'
+
+    def delete_user(self, user, notify_user=False):
+        logger.debug('Deleting user %s %s account' % (user, self.name))
+        return DiscourseTasks.delete_user(user, notify_user=notify_user)
+
+    def update_groups(self, user):
+        logger.debug('Processing %s groups for %s' % (self.name, user))
+        if DiscourseTasks.has_account(user):
+            DiscourseTasks.update_groups.delay(user.pk)
+
+    def validate_user(self, user):
+        logger.debug('Validating user %s %s account' % (user, self.name))
+        if DiscourseTasks.has_account(user) and not self.service_active_for_user(user):
+            self.delete_user(user, notify_user=True)
+
+    def update_all_groups(self):
+        logger.debug('Update all %s groups called' % self.name)
+        DiscourseTasks.update_all_groups.delay()
+
+    def service_enabled_members(self):
+        return settings.ENABLE_AUTH_DISCOURSE or False
+
+    def service_enabled_blues(self):
+        return settings.ENABLE_BLUE_DISCOURSE or False
+
+    def render_services_ctrl(self, request):
+        return render_to_string(self.service_ctrl_template, {
+            'char': EveManager.get_main_character(request.user)
+        }, request=request)
+
+
+@hooks.register('services_hook')
+def register_service():
+    return DiscourseService()

services/modules/discourse/manager.py

@@ -1,7 +1,8 @@
 from __future__ import unicode_literals
 import logging
 import requests
-import os
+import random
+import string
 import datetime
 import json
 import re
@@ -11,10 +12,12 @@ from services.models import GroupCache
 
 logger = logging.getLogger(__name__)
 
+
 class DiscourseError(Exception):
     def __init__(self, endpoint, errors):
         self.endpoint = endpoint
         self.errors = errors
+
     def __str__(self):
         return "API execution failed.\nErrors: %s\nEndpoint: %s" % (self.errors, self.endpoint)
 
@@ -188,7 +191,7 @@ class DiscourseManager:
 
     @staticmethod
     def __generate_random_pass():
-        return os.urandom(8).encode('hex')
+        return ''.join([random.choice(string.ascii_letters + string.digits) for n in range(16)])
 
     @staticmethod
     def __get_groups():

services/modules/discourse/migrations/0001_initial.py

@@ -0,0 +1,26 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.10.2 on 2016-12-12 03:15
+from __future__ import unicode_literals
+
+from django.conf import settings
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        ('auth', '0008_alter_user_username_max_length'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='DiscourseUser',
+            fields=[
+                ('user', models.OneToOneField(on_delete=django.db.models.deletion.CASCADE, primary_key=True, related_name='discourse', serialize=False, to=settings.AUTH_USER_MODEL)),
+                ('enabled', models.BooleanField()),
+            ],
+        ),
+    ]

services/modules/discourse/models.py

@@ -0,0 +1,15 @@
+from __future__ import unicode_literals
+from django.utils.encoding import python_2_unicode_compatible
+from django.contrib.auth.models import User
+from django.db import models
+
+
+class DiscourseUser(models.Model):
+    user = models.OneToOneField(User,
+                                primary_key=True,
+                                on_delete=models.CASCADE,
+                                related_name='discourse')
+    enabled = models.BooleanField()
+
+    def __str__(self):
+        return self.user.username

services/modules/discourse/tasks.py

@@ -0,0 +1,62 @@
+from __future__ import unicode_literals
+
+from alliance_auth.celeryapp import app
+from django.contrib.auth.models import User
+from django.core.exceptions import ObjectDoesNotExist
+from notifications import notify
+
+from services.tasks import only_one
+
+from .manager import DiscourseManager
+from .models import DiscourseUser
+
+import logging
+
+logger = logging.getLogger(__name__)
+
+
+class DiscourseTasks:
+    def __init__(self):
+        pass
+
+    @classmethod
+    def delete_user(cls, user, notify_user=False):
+        if cls.has_account(user) and user.discourse.enabled:
+            logger.debug("User %s has a Discourse account. Disabling login." % user)
+            if DiscourseManager.disable_user(user):
+                user.discourse.delete()
+                if notify_user:
+                    notify(user, 'Discourse Account Disabled', level='danger')
+                return True
+        return False
+
+    @staticmethod
+    def has_account(user):
+        """
+        Check if the user has a discourse account
+        :param user: django.contrib.auth.models.User
+        :return: bool
+        """
+        try:
+            return user.discourse.enabled
+        except ObjectDoesNotExist:
+            return False
+
+    @staticmethod
+    @app.task(bind=True)
+    def update_groups(self, pk):
+        user = User.objects.get(pk=pk)
+        logger.debug("Updating discourse groups for user %s" % user)
+        try:
+            DiscourseManager.update_groups(user)
+        except:
+            logger.warn("Discourse group sync failed for %s, retrying in 10 mins" % user)
+            raise self.retry(countdown=60 * 10)
+        logger.debug("Updated user %s discourse groups." % user)
+
+    @staticmethod
+    @app.task
+    def update_all_groups():
+        logger.debug("Updating ALL discourse groups")
+        for discourse_user in DiscourseUser.objects.filter(enabled=True):
+            DiscourseTasks.update_groups.delay(discourse_user.user.pk)

services/modules/discourse/templates/registered/discourse_service_ctrl.html

@@ -0,0 +1,8 @@
+{% load i18n %}
+
+<td class="text-center">Discourse</td>
+<td class="text-center">{{ char.character_name }}</td>
+<td class="text-center"><a href="{{ DISCOURSE_URL }}">{{ DISCOURSE_URL }}</a></td>
+<td class="text-center">
+    <a class="btn btn-success" href="{{ DISCOURSE_URL }}"><span class="glyphicon glyphicon-arrow-right"></span></a>
+</td>

services/modules/discourse/tests.py

@@ -0,0 +1,135 @@
+from __future__ import unicode_literals
+
+try:
+    # Py3
+    from unittest import mock
+except ImportError:
+    # Py2
+    import mock
+
+from django.test import TestCase, RequestFactory
+from django.conf import settings
+from django.contrib.auth.models import User
+from django.core.exceptions import ObjectDoesNotExist
+
+from alliance_auth.tests.auth_utils import AuthUtils
+
+from .auth_hooks import DiscourseService
+from .models import DiscourseUser
+from .tasks import DiscourseTasks
+
+MODULE_PATH = 'services.modules.discourse'
+
+
+class DiscourseHooksTestCase(TestCase):
+    def setUp(self):
+        self.member = 'member_user'
+        member = AuthUtils.create_member(self.member)
+        DiscourseUser.objects.create(user=member, enabled=True)
+        self.blue = 'blue_user'
+        blue = AuthUtils.create_blue(self.blue)
+        DiscourseUser.objects.create(user=blue, enabled=True)
+        self.none_user = 'none_user'
+        none_user = AuthUtils.create_user(self.none_user)
+        self.service = DiscourseService
+
+    def test_has_account(self):
+        member = User.objects.get(username=self.member)
+        blue = User.objects.get(username=self.blue)
+        none_user = User.objects.get(username=self.none_user)
+        self.assertTrue(DiscourseTasks.has_account(member))
+        self.assertTrue(DiscourseTasks.has_account(blue))
+        self.assertFalse(DiscourseTasks.has_account(none_user))
+
+    def test_service_enabled(self):
+        service = self.service()
+        member = User.objects.get(username=self.member)
+        blue = User.objects.get(username=self.blue)
+        none_user = User.objects.get(username=self.none_user)
+        self.assertTrue(service.service_enabled_members())
+        self.assertTrue(service.service_enabled_blues())
+
+        self.assertEqual(service.service_active_for_user(member), settings.ENABLE_AUTH_DISCOURSE)
+        self.assertEqual(service.service_active_for_user(blue), settings.ENABLE_BLUE_DISCOURSE)
+        self.assertFalse(service.service_active_for_user(none_user))
+
+    @mock.patch(MODULE_PATH + '.tasks.DiscourseManager')
+    def test_update_all_groups(self, manager):
+        service = self.service()
+        service.update_all_groups()
+        # Check member and blue user have groups updated
+        self.assertTrue(manager.update_groups.called)
+        self.assertEqual(manager.update_groups.call_count, 2)
+
+    def test_update_groups(self):
+        # Check member has Member group updated
+        with mock.patch(MODULE_PATH + '.tasks.DiscourseManager') as manager:
+            service = self.service()
+            member = User.objects.get(username=self.member)
+            service.update_groups(member)
+            self.assertTrue(manager.update_groups.called)
+            args, kwargs = manager.update_groups.call_args
+            user, = args
+            self.assertEqual(user, member)
+
+        # Check none user does not have groups updated
+        with mock.patch(MODULE_PATH + '.tasks.DiscourseManager') as manager:
+            service = self.service()
+            none_user = User.objects.get(username=self.none_user)
+            service.update_groups(none_user)
+            self.assertFalse(manager.update_groups.called)
+
+    @mock.patch(MODULE_PATH + '.tasks.DiscourseManager')
+    def test_validate_user(self, manager):
+        service = self.service()
+        # Test member is not deleted
+        member = User.objects.get(username=self.member)
+        service.validate_user(member)
+        self.assertTrue(member.discourse)
+
+        # Test none user is deleted
+        none_user = User.objects.get(username=self.none_user)
+        DiscourseUser.objects.create(user=none_user, enabled=True)
+        service.validate_user(none_user)
+        self.assertTrue(manager.disable_user.called)
+        with self.assertRaises(ObjectDoesNotExist):
+            none_discourse = User.objects.get(username=self.none_user).discourse
+
+    @mock.patch(MODULE_PATH + '.tasks.DiscourseManager')
+    def test_delete_user(self, manager):
+        member = User.objects.get(username=self.member)
+
+        service = self.service()
+        result = service.delete_user(member)
+
+        self.assertTrue(result)
+        self.assertTrue(manager.disable_user.called)
+        with self.assertRaises(ObjectDoesNotExist):
+            discourse_user = User.objects.get(username=self.member).discourse
+
+    def test_render_services_ctrl(self):
+        service = self.service()
+        member = User.objects.get(username=self.member)
+        request = RequestFactory().get('/en/services/')
+        request.user = member
+
+        response = service.render_services_ctrl(request)
+        self.assertTemplateUsed(service.service_ctrl_template)
+        self.assertIn('href="%s"' % settings.DISCOURSE_URL, response)
+
+
+class DiscourseViewsTestCase(TestCase):
+    def setUp(self):
+        self.member = AuthUtils.create_member('auth_member')
+        self.member.set_password('password')
+        self.member.save()
+        AuthUtils.add_main_character(self.member, 'auth_member', '12345', corp_id='111', corp_name='Test Corporation')
+
+    @mock.patch(MODULE_PATH + '.tasks.DiscourseManager')
+    def test_sso_member(self, manager):
+        self.client.login(username=self.member.username, password='password')
+        data = {'sso': 'bm9uY2U9Y2I2ODI1MWVlZmI1MjExZTU4YzAwZmYxMzk1ZjBjMGI%3D%0A',
+                'sig': '2828aa29899722b35a2f191d34ef9b3ce695e0e6eeec47deb46d588d70c7cb56'}
+        response = self.client.get('/discourse/sso', data=data, follow=False)
+        self.assertEqual(response.status_code, 302)
+        self.assertEqual(response.url[:37], 'https://example.com/session/sso_login')

services/modules/discourse/urls.py

@@ -0,0 +1,9 @@
+from __future__ import unicode_literals
+from django.conf.urls import url
+
+from . import views
+
+urlpatterns = [
+    # Discourse Service Control
+    url(r'^discourse/sso$', views.discourse_sso, name='auth_discourse_sso'),
+]

services/modules/discourse/views.py

@@ -0,0 +1,119 @@
+from __future__ import unicode_literals
+
+from django.conf import settings
+from django.contrib import messages
+from django.contrib.auth.decorators import login_required
+from django.shortcuts import render, redirect
+from authentication.states import MEMBER_STATE, BLUE_STATE, NONE_STATE
+from eveonline.models import EveCharacter
+from eveonline.managers import EveManager
+from authentication.models import AuthServicesInfo
+
+from .manager import DiscourseManager
+from .tasks import DiscourseTasks
+from .models import DiscourseUser
+
+import base64
+import hmac
+import hashlib
+
+try:
+    from urllib import unquote, urlencode
+except ImportError: #py3
+    from urllib.parse import unquote, urlencode
+try:
+    from urlparse import parse_qs
+except ImportError: #py3
+    from urllib.parse import parse_qs
+
+import logging
+
+logger = logging.getLogger(__name__)
+
+
+@login_required
+def discourse_sso(request):
+
+    ## Check if user has access
+
+    auth = AuthServicesInfo.objects.get(user=request.user)
+    if not request.user.is_superuser:
+        if not settings.ENABLE_AUTH_DISCOURSE and auth.state == MEMBER_STATE:
+            messages.error(request, 'Members are not authorized to access Discourse.')
+            return redirect('auth_dashboard')
+        elif not settings.ENABLE_BLUE_DISCOURSE and auth.state == BLUE_STATE:
+            messages.error(request, 'Blues are not authorized to access Discourse.')
+            return redirect('auth_dashboard')
+        elif auth.state == NONE_STATE:
+            messages.error(request, 'You are not authorized to access Discourse.')
+            return redirect('auth_dashboard')
+
+    if not auth.main_char_id:
+        messages.error(request, "You must have a main character set to access Discourse.")
+        return redirect('auth_characters')
+
+    main_char = EveManager.get_main_character(request.user)
+    if main_char is None:
+        messages.error(request, "Your main character is missing a database model. Please select a new one.")
+        return redirect('auth_characters')
+
+    payload = request.GET.get('sso')
+    signature = request.GET.get('sig')
+
+    if None in [payload, signature]:
+        messages.error(request, 'No SSO payload or signature. Please contact support if this problem persists.')
+        return redirect('auth_dashboard')
+
+    ## Validate the payload
+
+    try:
+        payload = unquote(payload).encode('utf-8')
+        decoded = base64.decodestring(payload).decode('utf-8')
+        assert 'nonce' in decoded
+        assert len(payload) > 0
+    except AssertionError:
+        messages.error(request, 'Invalid payload. Please contact support if this problem persists.')
+        return redirect('auth_dashboard')
+
+    key = str(settings.DISCOURSE_SSO_SECRET).encode('utf-8')
+    h = hmac.new(key, payload, digestmod=hashlib.sha256)
+    this_signature = h.hexdigest()
+
+    if this_signature != signature:
+        messages.error(request, 'Invalid payload. Please contact support if this problem persists.')
+        return redirect('auth_dashboard')
+
+    ## Build the return payload
+
+    username = DiscourseManager._sanitize_username(main_char.character_name)
+
+    qs = parse_qs(decoded)
+    params = {
+        'nonce': qs['nonce'][0],
+        'email': request.user.email,
+        'external_id': request.user.pk,
+        'username': username,
+        'name': username,
+    }
+
+    if auth.main_char_id:
+        params['avatar_url'] = 'https://image.eveonline.com/Character/%s_256.jpg' % auth.main_char_id
+
+    return_payload = base64.encodestring(urlencode(params).encode('utf-8'))
+    h = hmac.new(key, return_payload, digestmod=hashlib.sha256)
+    query_string = urlencode({'sso': return_payload, 'sig': h.hexdigest()})
+
+    ## Record activation and queue group sync
+
+    if not DiscourseTasks.has_account(request.user):
+        discourse_user = DiscourseUser()
+        discourse_user.user = request.user
+        discourse_user.enabled = True
+        discourse_user.save()
+        DiscourseTasks.update_groups.apply_async(args=[request.user.pk], countdown=30) # wait 30s for new user creation on Discourse
+
+    ## Redirect back to Discourse
+
+    url = '%s/session/sso_login' % settings.DISCOURSE_URL
+    return redirect('%s?%s' % (url, query_string))
+

services/modules/example/apps.py

@@ -0,0 +1,7 @@
+from __future__ import unicode_literals
+
+from django.apps import AppConfig
+
+
+class ExampleServiceConfig(AppConfig):
+    name = 'example_service'

services/modules/example/auth_hooks.py

@@ -0,0 +1,44 @@
+from __future__ import unicode_literals
+
+from django.template.loader import render_to_string
+
+from services.hooks import ServicesHook
+from alliance_auth import hooks
+
+from .urls import urlpatterns
+
+
+class ExampleService(ServicesHook):
+    def __init__(self):
+        ServicesHook.__init__(self)
+        self.urlpatterns = urlpatterns
+        self.service_url = 'http://exampleservice.example.com'
+
+    """
+    Overload base methods here to implement functionality
+    """
+
+    def render_services_ctrl(self, request):
+        """
+        Example for rendering the service control panel row
+        You can override the default template and create a
+        custom one if you wish.
+        :param request:
+        :return:
+        """
+        urls = self.Urls()
+        urls.auth_activate = 'auth_example_activate'
+        urls.auth_deactivate = 'auth_example_deactivate'
+        urls.auth_reset_password = 'auth_example_reset_password'
+        urls.auth_set_password = 'auth_example_set_password'
+        return render_to_string(self.service_ctrl_template, {
+            'service_name': self.title,
+            'urls': urls,
+            'service_url': self.service_url,
+            'username': 'example username'
+        }, request=request)
+
+
+@hooks.register('services_hook')
+def register_service():
+    return ExampleService()

services/modules/example/models.py

@@ -0,0 +1,16 @@
+from __future__ import unicode_literals
+from django.utils.encoding import python_2_unicode_compatible
+from django.contrib.auth.models import User
+from django.db import models
+
+
+@python_2_unicode_compatible
+class ExampleUser(models.Model):
+    user = models.OneToOneField(User,
+                                primary_key=True,
+                                on_delete=models.CASCADE,
+                                related_name='example')
+    username = models.CharField(max_length=254)
+
+    def __str__(self):
+        return self.username

services/modules/example/urls.py

@@ -0,0 +1,10 @@
+from __future__ import unicode_literals
+from django.conf.urls import url, include
+
+module_urls = [
+    # Add your module URLs here
+]
+
+urlpatterns = [
+    url(r'^example/', include(module_urls)),
+]

services/modules/example/views.py

@@ -0,0 +1 @@
+# Add your Views here

services/modules/ipboard/admin.py

@@ -0,0 +1,10 @@
+from __future__ import unicode_literals
+from django.contrib import admin
+from .models import IpboardUser
+
+
+class IpboardUserAdmin(admin.ModelAdmin):
+        list_display = ('user', 'username')
+        search_fields = ('user__username', 'username')
+
+admin.site.register(IpboardUser, IpboardUserAdmin)

services/modules/ipboard/apps.py

@@ -0,0 +1,7 @@
+from __future__ import unicode_literals
+
+from django.apps import AppConfig
+
+
+class IpboardServiceConfig(AppConfig):
+    name = 'ipboard'

services/modules/ipboard/auth_hooks.py

@@ -0,0 +1,68 @@
+from __future__ import unicode_literals
+
+from django.conf import settings
+from django.template.loader import render_to_string
+
+from services.hooks import ServicesHook
+from alliance_auth import hooks
+
+from .urls import urlpatterns
+from .tasks import IpboardTasks
+
+import logging
+
+logger = logging.getLogger(__name__)
+
+
+class IpboardService(ServicesHook):
+    def __init__(self):
+        ServicesHook.__init__(self)
+        self.name = 'ipboard'
+        self.service_url = settings.IPBOARD_ENDPOINT
+        self.urlpatterns = urlpatterns
+
+    @property
+    def title(self):
+        return 'IPBoard Forums'
+
+    def delete_user(self, user, notify_user=False):
+        logger.debug('Deleting user %s %s account' % (user, self.name))
+        return IpboardTasks.delete_user(user, notify_user=notify_user)
+
+    def update_groups(self, user):
+        logger.debug("Updating %s groups for %s" % (self.name, user))
+        if IpboardTasks.has_account(user):
+            IpboardTasks.update_groups.delay(user.pk)
+
+    def validate_user(self, user):
+        logger.debug('Validating user %s %s account' % (user, self.name))
+        if IpboardTasks.has_account(user) and not self.service_active_for_user(user):
+            self.delete_user(user, notify_user=True)
+
+    def update_all_groups(self):
+        logger.debug('Update all %s groups called' % self.name)
+        IpboardTasks.update_all_groups.delay()
+
+    def service_enabled_members(self):
+        return settings.ENABLE_AUTH_IPBOARD or False
+
+    def service_enabled_blues(self):
+        return settings.ENABLE_BLUE_IPBOARD or False
+
+    def render_services_ctrl(self, request):
+        urls = self.Urls()
+        urls.auth_activate = 'auth_activate_ipboard'
+        urls.auth_deactivate = 'auth_deactivate_ipboard'
+        urls.auth_reset_password = 'auth_reset_ipboard_password'
+        urls.auth_set_password = 'auth_set_ipboard_password'
+        return render_to_string(self.service_ctrl_template, {
+            'service_name': self.title,
+            'urls': urls,
+            'service_url': self.service_url,
+            'username': request.user.ipboard.username if IpboardTasks.has_account(request.user) else '',
+        }, request=request)
+
+
+@hooks.register('services_hook')
+def register_service():
+    return IpboardService()

services/modules/ipboard/manager.py

@@ -1,5 +1,6 @@
 from __future__ import unicode_literals
-import os
+import random
+import string
 import re
 from hashlib import md5
 try:
@@ -27,7 +28,11 @@ class IPBoardManager:
 
     @staticmethod
     def __generate_random_pass():
-        return os.urandom(8).encode('hex')
+        return ''.join([random.choice(string.ascii_letters + string.digits) for n in range(16)])
+
+    @staticmethod
+    def _gen_pwhash(password):
+        return md5(password.encode('utf-8')).hexdigest()
 
     @staticmethod
     def _sanitize_groupname(name):
@@ -49,13 +54,13 @@ class IPBoardManager:
         except:
             return {}
 
-    @staticmethod
-    def add_user(username, email):
+    @classmethod
+    def add_user(cls, username, email):
         """ Add user to service """
         sanatized = str(IPBoardManager.__santatize_username(username))
         logger.debug("Adding user to IPBoard with username %s" % sanatized)
         plain_password = IPBoardManager.__generate_random_pass()
-        password = md5(plain_password).hexdigest()
+        password = cls._gen_pwhash(plain_password)
         IPBoardManager.exec_xmlrpc('createUser', username=sanatized, email=str(email), display_name=sanatized,
                                    md5_passwordHash=password)
         logger.info("Added IPBoard user with username %s" % sanatized)
@@ -75,10 +80,10 @@ class IPBoardManager:
         logger.info("Disabled IPBoard user with username %s" % username)
         return username
 
-    @staticmethod
-    def update_user(username, email, password):
+    @classmethod
+    def update_user(cls, username, email, password):
         """ Add user to service """
-        password = md5(password).hexdigest()
+        password = cls._gen_pwhash(password)
         logger.debug("Updating IPBoard username %s with email %s and password hash starting with %s" % (
             username, email, password[0:5]))
         IPBoardManager.exec_xmlrpc('updateUser', username=username, email=email, md5_passwordHash=password)

services/modules/ipboard/migrations/0001_initial.py

@@ -0,0 +1,26 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.10.2 on 2016-12-12 03:27
+from __future__ import unicode_literals
+
+from django.conf import settings
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        ('auth', '0008_alter_user_username_max_length'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='IpboardUser',
+            fields=[
+                ('user', models.OneToOneField(on_delete=django.db.models.deletion.CASCADE, primary_key=True, related_name='ipboard', serialize=False, to=settings.AUTH_USER_MODEL)),
+                ('username', models.CharField(max_length=254)),
+            ],
+        ),
+    ]

services/modules/ipboard/models.py

@@ -0,0 +1,16 @@
+from __future__ import unicode_literals
+from django.utils.encoding import python_2_unicode_compatible
+from django.contrib.auth.models import User
+from django.db import models
+
+
+@python_2_unicode_compatible
+class IpboardUser(models.Model):
+    user = models.OneToOneField(User,
+                                primary_key=True,
+                                on_delete=models.CASCADE,
+                                related_name='ipboard')
+    username = models.CharField(max_length=254)
+
+    def __str__(self):
+        return self.username

services/modules/ipboard/tasks.py

@@ -0,0 +1,73 @@
+from __future__ import unicode_literals
+
+from alliance_auth.celeryapp import app
+from django.conf import settings
+from django.contrib.auth.models import User
+from django.core.exceptions import ObjectDoesNotExist
+from notifications import notify
+
+from .manager import IPBoardManager
+from .models import IpboardUser
+
+import logging
+
+logger = logging.getLogger(__name__)
+
+
+class IpboardTasks:
+    def __init__(self):
+        pass
+
+    @classmethod
+    def delete_user(cls, user, notify_user=False):
+        if cls.has_account(user):
+            if IPBoardManager.disable_user(user.ipboard.username):
+                user.ipboard.delete()
+                if notify_user:
+                    notify(user, 'IPBoard Account Disabled', level='danger')
+                return True
+        return False
+
+    @staticmethod
+    def has_account(user):
+        try:
+            return user.ipboard.username != ''
+        except ObjectDoesNotExist:
+            return False
+
+    @staticmethod
+    @app.task(bind=True)
+    def update_groups(self, pk):
+        user = User.objects.get(pk=pk)
+        logger.debug("Updating user %s ipboard groups." % user)
+        groups = []
+        for group in user.groups.all():
+            groups.append(str(group.name))
+        if len(groups) == 0:
+            groups.append('empty')
+        logger.debug("Updating user %s ipboard groups to %s" % (user, groups))
+        try:
+            IPBoardManager.update_groups(user.ipboard.username, groups)
+        except:
+            logger.exception("IPBoard group sync failed for %s, retrying in 10 mins" % user)
+            raise self.retry(countdown=60 * 10)
+        logger.debug("Updated user %s ipboard groups." % user)
+
+    @staticmethod
+    @app.task
+    def update_all_groups():
+        logger.debug("Updating ALL ipboard groups")
+        for ipboard_user in IpboardUser.objects.exclude(username__exact=''):
+            IpboardTasks.update_groups.delay(ipboard_user.user.pk)
+
+    @staticmethod
+    @app.task
+    def disable():
+        if settings.ENABLE_AUTH_IPBOARD:
+            logger.warn(
+                "ENABLE_AUTH_IPBOARD still True, after disabling users will still be able to create IPBoard accounts")
+        if settings.ENABLE_BLUE_IPBOARD:
+            logger.warn(
+                "ENABLE_BLUE_IPBOARD still True, after disabling blues will still be able to create IPBoard accounts")
+        logger.debug("Deleting all Ipboard Users")
+        IpboardUser.objects.all().delete()

services/modules/ipboard/tests.py

@@ -0,0 +1,207 @@
+from __future__ import unicode_literals
+
+try:
+    # Py3
+    from unittest import mock
+except ImportError:
+    # Py2
+    import mock
+
+from django.test import TestCase, RequestFactory
+from django.conf import settings
+from django.contrib.auth.models import User
+from django import urls
+from django.core.exceptions import ObjectDoesNotExist
+
+from alliance_auth.tests.auth_utils import AuthUtils
+
+from .auth_hooks import IpboardService
+from .models import IpboardUser
+from .tasks import IpboardTasks
+from .manager import IPBoardManager
+
+MODULE_PATH = 'services.modules.ipboard'
+
+
+class IpboardHooksTestCase(TestCase):
+    def setUp(self):
+        self.member = 'member_user'
+        member = AuthUtils.create_member(self.member)
+        IpboardUser.objects.create(user=member, username=self.member)
+        self.blue = 'blue_user'
+        blue = AuthUtils.create_blue(self.blue)
+        IpboardUser.objects.create(user=blue, username=self.blue)
+        self.none_user = 'none_user'
+        none_user = AuthUtils.create_user(self.none_user)
+        self.service = IpboardService
+
+    def test_has_account(self):
+        member = User.objects.get(username=self.member)
+        blue = User.objects.get(username=self.blue)
+        none_user = User.objects.get(username=self.none_user)
+        self.assertTrue(IpboardTasks.has_account(member))
+        self.assertTrue(IpboardTasks.has_account(blue))
+        self.assertFalse(IpboardTasks.has_account(none_user))
+
+    def test_service_enabled(self):
+        service = self.service()
+        member = User.objects.get(username=self.member)
+        blue = User.objects.get(username=self.blue)
+        none_user = User.objects.get(username=self.none_user)
+        self.assertTrue(service.service_enabled_members())
+        self.assertTrue(service.service_enabled_blues())
+
+        self.assertEqual(service.service_active_for_user(member), settings.ENABLE_AUTH_IPBOARD)
+        self.assertEqual(service.service_active_for_user(blue), settings.ENABLE_BLUE_IPBOARD)
+        self.assertFalse(service.service_active_for_user(none_user))
+
+    @mock.patch(MODULE_PATH + '.tasks.IPBoardManager')
+    def test_update_all_groups(self, manager):
+        service = self.service()
+        service.update_all_groups()
+        # Check member and blue user have groups updated
+        self.assertTrue(manager.update_groups.called)
+        self.assertEqual(manager.update_groups.call_count, 2)
+
+    def test_update_groups(self):
+        # Check member has Member group updated
+        with mock.patch(MODULE_PATH + '.tasks.IPBoardManager') as manager:
+            service = self.service()
+            member = User.objects.get(username=self.member)
+            service.update_groups(member)
+            self.assertTrue(manager.update_groups.called)
+
+        # Check none user does not have groups updated
+        with mock.patch(MODULE_PATH + '.tasks.IPBoardManager') as manager:
+            service = self.service()
+            none_user = User.objects.get(username=self.none_user)
+            service.update_groups(none_user)
+            self.assertFalse(manager.update_groups.called)
+
+    @mock.patch(MODULE_PATH + '.tasks.IPBoardManager')
+    def test_validate_user(self, manager):
+        service = self.service()
+        # Test member is not deleted
+        member = User.objects.get(username=self.member)
+        service.validate_user(member)
+        self.assertTrue(User.objects.get(username=self.member).ipboard)
+
+        # Test none user is deleted
+        none_user = User.objects.get(username=self.none_user)
+        IpboardUser.objects.create(user=none_user, username='none_user')
+        service.validate_user(none_user)
+        self.assertTrue(manager.disable_user.called)
+        with self.assertRaises(ObjectDoesNotExist):
+            none_ipboard = User.objects.get(username=self.none_user).ipboard
+
+    @mock.patch(MODULE_PATH + '.tasks.IPBoardManager')
+    def test_delete_user(self, manager):
+        member = User.objects.get(username=self.member)
+
+        service = self.service()
+        result = service.delete_user(member)
+
+        self.assertTrue(result)
+        self.assertTrue(manager.disable_user.called)
+        with self.assertRaises(ObjectDoesNotExist):
+            Ipboard_user = User.objects.get(username=self.member).ipboard
+
+    def test_render_services_ctrl(self):
+        service = self.service()
+        member = User.objects.get(username=self.member)
+        request = RequestFactory().get('/en/services/')
+        request.user = member
+
+        response = service.render_services_ctrl(request)
+        self.assertTemplateUsed(service.service_ctrl_template)
+        self.assertIn('/ipboard/set_password/', response)
+        self.assertIn('/ipboard/reset_password/', response)
+        self.assertIn('/ipboard/deactivate/', response)
+
+        # Test register becomes available
+        member.ipboard.delete()
+        member = User.objects.get(username=self.member)
+        request.user = member
+        response = service.render_services_ctrl(request)
+        self.assertIn('/ipboard/activate/', response)
+
+
+class IpboardViewsTestCase(TestCase):
+    def setUp(self):
+        self.member = AuthUtils.create_member('auth_member')
+        self.member.set_password('password')
+        self.member.email = 'auth_member@example.com'
+        self.member.save()
+        AuthUtils.add_main_character(self.member, 'auth_member', '12345', corp_id='111', corp_name='Test Corporation')
+
+    def login(self):
+        self.client.login(username=self.member.username, password='password')
+
+    @mock.patch(MODULE_PATH + '.views.IPBoardManager')
+    def test_activate(self, manager):
+        self.login()
+        expected_username = 'auth_member'
+        expected_password = 'abc123'
+        manager.add_user.return_value = (expected_username, expected_password)
+        response = self.client.get(urls.reverse('auth_activate_ipboard'), follow=False)
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, expected_username)
+        self.assertContains(response, expected_password)
+        self.assertTrue(manager.add_user.called)
+        args, kwargs = manager.add_user.call_args
+        self.assertEqual(args[0], 'auth_member')  # Character name
+        self.assertEqual(args[1], self.member.email)
+        self.assertEqual(self.member.ipboard.username, expected_username)
+
+    @mock.patch(MODULE_PATH + '.tasks.IPBoardManager')
+    def test_deactivate(self, manager):
+        self.login()
+        IpboardUser.objects.create(user=self.member, username='12345')
+        manager.disable_user.return_value = True
+
+        response = self.client.get(urls.reverse('auth_deactivate_ipboard'))
+
+        self.assertTrue(manager.disable_user.called)
+        self.assertRedirects(response, expected_url=urls.reverse('auth_services'), target_status_code=200)
+        with self.assertRaises(ObjectDoesNotExist):
+            ipboard_user = User.objects.get(pk=self.member.pk).ipboard
+
+    @mock.patch(MODULE_PATH + '.views.IPBoardManager')
+    def test_set_password(self, manager):
+        self.login()
+        IpboardUser.objects.create(user=self.member, username='12345')
+        expected_password = 'password'
+        manager.update_user_password.return_value = expected_password
+
+        response = self.client.post(urls.reverse('auth_set_ipboard_password'), data={'password': expected_password})
+
+        self.assertTrue(manager.update_user_password.called)
+        args, kwargs = manager.update_user_password.call_args
+        self.assertEqual(kwargs['plain_password'], expected_password)
+        self.assertRedirects(response, expected_url=urls.reverse('auth_services'), target_status_code=200)
+
+    @mock.patch(MODULE_PATH + '.views.IPBoardManager')
+    def test_reset_password(self, manager):
+        self.login()
+        IpboardUser.objects.create(user=self.member, username='12345')
+
+        response = self.client.get(urls.reverse('auth_reset_ipboard_password'))
+
+        self.assertTrue(manager.update_user_password.called)
+        self.assertTemplateUsed(response, 'registered/service_credentials.html')
+
+
+class IpboardManagerTestCase(TestCase):
+    def setUp(self):
+        self.manager = IPBoardManager
+
+    def test_generate_random_password(self):
+        password = self.manager._IPBoardManager__generate_random_pass()
+
+        self.assertEqual(len(password), 16)
+        self.assertIsInstance(password, type(''))
+
+    def test_gen_pwhash(self):
+        pwhash = self.manager._gen_pwhash('test')
+
+        self.assertEqual(pwhash, '098f6bcd4621d373cade4e832627b4f6')

services/modules/ipboard/urls.py

@@ -0,0 +1,16 @@
+from __future__ import unicode_literals
+from django.conf.urls import url, include
+
+from . import views
+
+module_urls = [
+    # Ipboard service control
+    url(r'^activate/$', views.activate_ipboard_forum, name='auth_activate_ipboard'),
+    url(r'^deactivate/$', views.deactivate_ipboard_forum, name='auth_deactivate_ipboard'),
+    url(r'^reset_password/$', views.reset_ipboard_password, name='auth_reset_ipboard_password'),
+    url(r'^set_password/$', views.set_ipboard_password, name='auth_set_ipboard_password'),
+]
+
+urlpatterns = [
+    url(r'^ipboard/', include(module_urls))
+]

services/modules/ipboard/views.py

@@ -0,0 +1,110 @@
+from __future__ import unicode_literals
+
+from django.contrib import messages
+from django.contrib.auth.decorators import login_required
+from django.shortcuts import render, redirect
+
+from authentication.decorators import members_and_blues
+from services.forms import ServicePasswordForm
+from eveonline.managers import EveManager
+
+from .manager import IPBoardManager
+from .tasks import IpboardTasks
+from .models import IpboardUser
+
+import logging
+
+logger = logging.getLogger(__name__)
+
+
+@login_required
+@members_and_blues()
+def activate_ipboard_forum(request):
+    logger.debug("activate_ipboard_forum called by user %s" % request.user)
+    character = EveManager.get_main_character(request.user)
+    logger.debug("Adding ipboard user for user %s with main character %s" % (request.user, character))
+    result = IPBoardManager.add_user(character.character_name, request.user.email)
+    if result[0] != "":
+        ipboard_user = IpboardUser()
+        ipboard_user.user = request.user
+        ipboard_user.username = result[0]
+        ipboard_user.save()
+        logger.debug("Updated authserviceinfo for user %s with ipboard credentials. Updating groups." % request.user)
+        IpboardTasks.update_groups.delay(request.user.pk)
+        logger.info("Successfully activated ipboard for user %s" % request.user)
+        messages.success(request, 'Activated IPBoard account.')
+        credentials = {
+            'username': result[0],
+            'password': result[1],
+        }
+        return render(request, 'registered/service_credentials.html',
+                      context={'credentials': credentials, 'service': 'IPBoard'})
+    else:
+        logger.error("Unsuccessful attempt to activate ipboard for user %s" % request.user)
+        messages.error(request, 'An error occurred while processing your IPBoard account.')
+    return redirect("auth_services")
+
+
+@login_required
+@members_and_blues()
+def deactivate_ipboard_forum(request):
+    logger.debug("deactivate_ipboard_forum called by user %s" % request.user)
+    # false we failed
+    if IpboardTasks.delete_user(request.user):
+        logger.info("Successfully deactivated ipboard for user %s" % request.user)
+        messages.success(request, 'Deactivated IPBoard account.')
+    else:
+        logger.error("Unsuccessful attempt to deactviate ipboard for user %s" % request.user)
+        messages.error(request, 'An error occurred while processing your IPBoard account.')
+    return redirect("auth_services")
+
+
+@login_required
+@members_and_blues()
+def set_ipboard_password(request):
+    logger.debug("set_ipboard_password called by user %s" % request.user)
+    error = None
+    if request.method == 'POST':
+        logger.debug("Received POST request with form.")
+        form = ServicePasswordForm(request.POST)
+        logger.debug("Form is valid: %s" % form.is_valid())
+        if form.is_valid() and IpboardTasks.has_account(request.user):
+            password = form.cleaned_data['password']
+            logger.debug("Form contains password of length %s" % len(password))
+            result = IPBoardManager.update_user_password(request.user.ipboard.username, request.user.email,
+                                                         plain_password=password)
+            if result != "":
+                logger.info("Successfully set IPBoard password for user %s" % request.user)
+                messages.success(request, 'Set IPBoard password.')
+            else:
+                logger.error("Failed to install custom ipboard password for user %s" % request.user)
+                messages.error(request, 'An error occurred while processing your IPBoard account.')
+            return redirect("auth_services")
+    else:
+        logger.debug("Request is not type POST - providing empty form.")
+        form = ServicePasswordForm()
+
+    logger.debug("Rendering form for user %s" % request.user)
+    context = {'form': form, 'service': 'IPBoard', 'error': error}
+    return render(request, 'registered/service_password.html', context=context)
+
+
+@login_required
+@members_and_blues()
+def reset_ipboard_password(request):
+    logger.debug("reset_ipboard_password called by user %s" % request.user)
+    if IpboardTasks.has_account(request.user):
+        result = IPBoardManager.update_user_password(request.user.ipboard.username, request.user.email)
+        if result != "":
+            logger.info("Successfully reset ipboard password for user %s" % request.user)
+            messages.success(request, 'Reset IPBoard password.')
+            credentials = {
+                'username': request.user.ipboard.username,
+                'password': result,
+            }
+            return render(request, 'registered/service_credentials.html',
+                          context={'credentials': credentials, 'service': 'IPBoard'})
+
+    logger.error("Unsuccessful attempt to reset ipboard password for user %s" % request.user)
+    messages.error(request, 'An error occurred while processing your IPBoard account.')
+    return redirect("auth_services")

services/modules/ips4/admin.py

@@ -0,0 +1,10 @@
+from __future__ import unicode_literals
+from django.contrib import admin
+from .models import Ips4User
+
+
+class Ips4UserAdmin(admin.ModelAdmin):
+        list_display = ('user', 'username', 'id')
+        search_fields = ('user__username', 'username', 'id')
+
+admin.site.register(Ips4User, Ips4UserAdmin)

services/modules/ips4/apps.py

@@ -0,0 +1,7 @@
+from __future__ import unicode_literals
+
+from django.apps import AppConfig
+
+
+class Ips4ServiceConfig(AppConfig):
+    name = 'ips4'

services/modules/ips4/auth_hooks.py

@@ -0,0 +1,53 @@
+from __future__ import unicode_literals
+
+from django.conf import settings
+from django.template.loader import render_to_string
+
+from services.hooks import ServicesHook
+from alliance_auth import hooks
+
+from .urls import urlpatterns
+from .tasks import Ips4Tasks
+
+
+class Ips4Service(ServicesHook):
+    def __init__(self):
+        ServicesHook.__init__(self)
+        self.name = 'ips4'
+        self.urlpatterns = urlpatterns
+        self.service_url = settings.IPS4_URL
+
+    @property
+    def title(self):
+        return 'IPS4'
+
+    def service_enabled_members(self):
+        return settings.ENABLE_AUTH_IPS4 or False
+
+    def service_enabled_blues(self):
+        return settings.ENABLE_BLUE_IPS4 or False
+
+    def render_services_ctrl(self, request):
+        """
+        Example for rendering the service control panel row
+        You can override the default template and create a
+        custom one if you wish.
+        :param request:
+        :return:
+        """
+        urls = self.Urls()
+        urls.auth_activate = 'auth_activate_ips4'
+        urls.auth_deactivate = 'auth_deactivate_ips4'
+        urls.auth_reset_password = 'auth_reset_ips4_password'
+        urls.auth_set_password = 'auth_set_ips4_password'
+        return render_to_string(self.service_ctrl_template, {
+            'service_name': self.title,
+            'urls': urls,
+            'service_url': self.service_url,
+            'username': request.user.ips4.username if Ips4Tasks.has_account(request.user) else ''
+        }, request=request)
+
+
+@hooks.register('services_hook')
+def register_service():
+    return Ips4Service()

services/modules/ips4/manager.py

@@ -1,6 +1,8 @@
 from __future__ import unicode_literals
 import logging
-import os
+import random
+import string
+import re
 from django.db import connections
 from passlib.hash import bcrypt
 
@@ -16,18 +18,16 @@ class Ips4Manager:
 
     MEMBER_GROUP_ID = 3
 
-    @staticmethod
-    def add_user(username, email):
+    @classmethod
+    def add_user(cls, username, email):
         logger.debug("Adding new IPS4 user %s" % username)
-        plain_password = Ips4Manager.__generate_random_pass()
-        hash = bcrypt.encrypt(plain_password, rounds=13)
-        hash_result = hash
-        rounds_striped = hash_result.strip('$2a$13$')
-        salt = rounds_striped[:22]
-        group = Ips4Manager.MEMBER_GROUP_ID
+        plain_password = cls.__generate_random_pass()
+        hash = cls._gen_pwhash(plain_password)
+        salt = cls._get_salt(hash)
+        group = cls.MEMBER_GROUP_ID
         cursor = connections['ips4'].cursor()
-        cursor.execute(Ips4Manager.SQL_ADD_USER, [username, email, hash, salt, group])
-        member_id = Ips4Manager.get_user_id(username)
+        cursor.execute(cls.SQL_ADD_USER, [username, email, hash, salt, group])
+        member_id = cls.get_user_id(username)
         return username, plain_password, member_id
 
     @staticmethod
@@ -44,7 +44,17 @@ class Ips4Manager:
 
     @staticmethod
     def __generate_random_pass():
-        return os.urandom(8).encode('hex')
+        return ''.join([random.choice(string.ascii_letters + string.digits) for n in range(16)])
+
+    @staticmethod
+    def _gen_pwhash(password):
+        return bcrypt.encrypt(password.encode('utf-8'), rounds=13)
+
+    @staticmethod
+    def _get_salt(pw_hash):
+        search = re.compile(r"^\$2[a-z]?\$([0-9]+)\$(.{22})(.{31})$")
+        match = re.match(search, pw_hash)
+        return match.group(2)
 
     @staticmethod
     def delete_user(id):
@@ -58,17 +68,15 @@ class Ips4Manager:
             logger.exception("Failed to delete IPS4 user id %s" % id)
             return False
 
-    @staticmethod
-    def update_user_password(username):
+    @classmethod
+    def update_user_password(cls, username):
         logger.debug("Updating IPS4 user id %s password" % id)
-        if Ips4Manager.check_user(username):
+        if cls.check_user(username):
             plain_password = Ips4Manager.__generate_random_pass()
-            hash = bcrypt.encrypt(plain_password, rounds=13)
-            hash_result = hash
-            rounds_striped = hash_result.strip('$2a$13$')
-            salt = rounds_striped[:22]
+            hash = cls._gen_pwhash(plain_password)
+            salt = cls._get_salt(hash)
             cursor = connections['ips4'].cursor()
-            cursor.execute(Ips4Manager.SQL_UPDATE_PASSWORD, [hash, salt, username])
+            cursor.execute(cls.SQL_UPDATE_PASSWORD, [hash, salt, username])
             return plain_password
         else:
             logger.error("Unable to update ips4 user %s password" % username)
@@ -86,16 +94,14 @@ class Ips4Manager:
         logger.debug("User %s not found on IPS4" % username)
         return False
 
-    @staticmethod
-    def update_custom_password(username, plain_password):
+    @classmethod
+    def update_custom_password(cls, username, plain_password):
         logger.debug("Updating IPS4 user id %s password" % id)
-        if Ips4Manager.check_user(username):
-            hash = bcrypt.encrypt(plain_password, rounds=13)
-            hash_result = hash
-            rounds_striped = hash_result.strip('$2a$13$')
-            salt = rounds_striped[:22]
+        if cls.check_user(username):
+            hash = cls._gen_pwhash(plain_password)
+            salt = cls._get_salt(hash)
             cursor = connections['ips4'].cursor()
-            cursor.execute(Ips4Manager.SQL_UPDATE_PASSWORD, [hash, salt, username])
+            cursor.execute(cls.SQL_UPDATE_PASSWORD, [hash, salt, username])
             return plain_password
         else:
             logger.error("Unable to update ips4 user %s password" % username)

services/modules/ips4/migrations/0001_initial.py

@@ -0,0 +1,27 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.10.2 on 2016-12-12 03:27
+from __future__ import unicode_literals
+
+from django.conf import settings
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        ('auth', '0008_alter_user_username_max_length'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='Ips4User',
+            fields=[
+                ('user', models.OneToOneField(on_delete=django.db.models.deletion.CASCADE, primary_key=True, related_name='ips4', serialize=False, to=settings.AUTH_USER_MODEL)),
+                ('username', models.CharField(max_length=254)),
+                ('id', models.CharField(max_length=254)),
+            ],
+        ),
+    ]

services/modules/ips4/models.py

@@ -0,0 +1,17 @@
+from __future__ import unicode_literals
+from django.utils.encoding import python_2_unicode_compatible
+from django.contrib.auth.models import User
+from django.db import models
+
+
+@python_2_unicode_compatible
+class Ips4User(models.Model):
+    user = models.OneToOneField(User,
+                                primary_key=True,
+                                on_delete=models.CASCADE,
+                                related_name='ips4')
+    username = models.CharField(max_length=254)
+    id = models.CharField(max_length=254)
+
+    def __str__(self):
+        return self.username

services/modules/ips4/tasks.py

@@ -0,0 +1,43 @@
+from __future__ import unicode_literals, absolute_import
+
+from django.conf import settings
+from django.core.exceptions import ObjectDoesNotExist
+
+from .manager import Ips4Manager
+from .models import Ips4User
+
+import logging
+
+logger = logging.getLogger(__name__)
+
+
+class Ips4Tasks:
+    def __init__(self):
+        pass
+
+    @classmethod
+    def delete_user(cls, user):
+        logging.debug("Attempting to delete IPS4 account for %s" % user)
+        if cls.has_account(user) and Ips4Manager.delete_user(user.ips4.id):
+            user.ips4.delete()
+            logger.info("Successfully deactivated IPS4 for user %s" % user)
+            return True
+        return False
+
+    @staticmethod
+    def has_account(user):
+        try:
+            return user.ips4.id != ''
+        except ObjectDoesNotExist:
+            return False
+
+    @staticmethod
+    def disable():
+        if settings.ENABLE_AUTH_IPS4:
+            logger.warn(
+                "ENABLE_AUTH_IPS4 still True, after disabling users will still be able to create IPS4 accounts")
+        if settings.ENABLE_BLUE_IPS4:
+            logger.warn(
+                "ENABLE_BLUE_IPS4 still True, after disabling blues will still be able to create IPS4 accounts")
+        logging.debug("Deleting all IPS4 users")
+        Ips4User.objects.all().delete()

services/modules/ips4/tests.py

@@ -0,0 +1,164 @@
+from __future__ import unicode_literals
+
+try:
+    # Py3
+    from unittest import mock
+except ImportError:
+    # Py2
+    import mock
+
+from django.test import TestCase, RequestFactory
+from django.conf import settings
+from django import urls
+from django.contrib.auth.models import User
+from django.core.exceptions import ObjectDoesNotExist
+
+from alliance_auth.tests.auth_utils import AuthUtils
+
+from .auth_hooks import Ips4Service
+from .models import Ips4User
+from .tasks import Ips4Tasks
+
+MODULE_PATH = 'services.modules.ips4'
+
+
+class Ips4HooksTestCase(TestCase):
+    def setUp(self):
+        self.member = 'member_user'
+        member = AuthUtils.create_member(self.member)
+        Ips4User.objects.create(user=member, id='12345', username=self.member)
+        self.blue = 'blue_user'
+        blue = AuthUtils.create_blue(self.blue)
+        Ips4User.objects.create(user=blue, id='67891', username=self.blue)
+        self.none_user = 'none_user'
+        none_user = AuthUtils.create_user(self.none_user)
+        self.service = Ips4Service
+
+    def test_has_account(self):
+        member = User.objects.get(username=self.member)
+        blue = User.objects.get(username=self.blue)
+        none_user = User.objects.get(username=self.none_user)
+        self.assertTrue(Ips4Tasks.has_account(member))
+        self.assertTrue(Ips4Tasks.has_account(blue))
+        self.assertFalse(Ips4Tasks.has_account(none_user))
+
+    def test_service_enabled(self):
+        service = self.service()
+        member = User.objects.get(username=self.member)
+        blue = User.objects.get(username=self.blue)
+        none_user = User.objects.get(username=self.none_user)
+        self.assertTrue(service.service_enabled_members())
+        self.assertTrue(service.service_enabled_blues())
+
+        self.assertEqual(service.service_active_for_user(member), settings.ENABLE_AUTH_IPS4)
+        self.assertEqual(service.service_active_for_user(blue), settings.ENABLE_BLUE_IPS4)
+        self.assertFalse(service.service_active_for_user(none_user))
+
+    def test_render_services_ctrl(self):
+        service = self.service()
+        member = User.objects.get(username=self.member)
+        request = RequestFactory().get('/en/services/')
+        request.user = member
+
+        response = service.render_services_ctrl(request)
+        self.assertTemplateUsed(service.service_ctrl_template)
+        self.assertIn(urls.reverse('auth_set_ips4_password'), response)
+        self.assertIn(urls.reverse('auth_reset_ips4_password'), response)
+        self.assertIn(urls.reverse('auth_deactivate_ips4'), response)
+
+        # Test register becomes available
+        member.ips4.delete()
+        member = User.objects.get(username=self.member)
+        request.user = member
+        response = service.render_services_ctrl(request)
+        self.assertIn(urls.reverse('auth_activate_ips4'), response)
+
+
+class Ips4ViewsTestCase(TestCase):
+    def setUp(self):
+        self.member = AuthUtils.create_member('auth_member')
+        self.member.set_password('password')
+        self.member.email = 'auth_member@example.com'
+        self.member.save()
+        AuthUtils.add_main_character(self.member, 'auth_member', '12345', corp_id='111', corp_name='Test Corporation')
+
+    def login(self):
+        self.client.login(username=self.member.username, password='password')
+
+    @mock.patch(MODULE_PATH + '.views.Ips4Manager')
+    def test_activate(self, manager):
+        self.login()
+        expected_username = 'auth_member'
+        expected_password = 'password'
+        expected_id = '1234'
+
+        manager.add_user.return_value = (expected_username, expected_password, expected_id)
+
+        response = self.client.get(urls.reverse('auth_activate_ips4'), follow=False)
+
+        self.assertTrue(manager.add_user.called)
+        args, kwargs = manager.add_user.call_args
+        self.assertEqual(args[0], expected_username)
+        self.assertEqual(args[1], self.member.email)
+
+        self.assertTemplateUsed(response, 'registered/service_credentials.html')
+        self.assertContains(response, expected_username)
+        self.assertContains(response, expected_password)
+
+    @mock.patch(MODULE_PATH + '.tasks.Ips4Manager')
+    def test_deactivate(self, manager):
+        self.login()
+        Ips4User.objects.create(user=self.member, username='12345', id='1234')
+        manager.delete_user.return_value = True
+
+        response = self.client.get(urls.reverse('auth_deactivate_ips4'))
+
+        self.assertTrue(manager.delete_user.called)
+        self.assertRedirects(response, expected_url=urls.reverse('auth_services'), target_status_code=200)
+        with self.assertRaises(ObjectDoesNotExist):
+            ips4_user = User.objects.get(pk=self.member.pk).ips4
+
+    @mock.patch(MODULE_PATH + '.views.Ips4Manager')
+    def test_set_password(self, manager):
+        self.login()
+        Ips4User.objects.create(user=self.member, username='12345', id='1234')
+        expected_password = 'password'
+        manager.update_user_password.return_value = expected_password
+
+        response = self.client.post(urls.reverse('auth_set_ips4_password'), data={'password': expected_password})
+
+        self.assertTrue(manager.update_custom_password.called)
+        args, kwargs = manager.update_custom_password.call_args
+        self.assertEqual(kwargs['plain_password'], expected_password)
+        self.assertRedirects(response, expected_url=urls.reverse('auth_services'), target_status_code=200)
+
+    @mock.patch(MODULE_PATH + '.views.Ips4Manager')
+    def test_reset_password(self, manager):
+        self.login()
+        Ips4User.objects.create(user=self.member, username='12345', id='1234')
+
+        response = self.client.get(urls.reverse('auth_reset_ips4_password'))
+
+        self.assertTrue(manager.update_user_password.called)
+        self.assertTemplateUsed(response, 'registered/service_credentials.html')
+
+
+class Ips4ManagerTestCase(TestCase):
+    def setUp(self):
+        from .manager import Ips4Manager
+        self.manager = Ips4Manager
+
+    def test_generate_random_password(self):
+        password = self.manager._Ips4Manager__generate_random_pass()
+
+        self.assertEqual(len(password), 16)
+        self.assertIsInstance(password, type(''))
+
+    def test_gen_pwhash(self):
+        pwhash = self.manager._gen_pwhash('test')
+        salt = self.manager._get_salt(pwhash)
+
+        self.assertIsInstance(pwhash, str)
+        self.assertGreaterEqual(len(pwhash), 59)
+        self.assertIsInstance(salt, str)
+        self.assertEqual(len(salt), 22)

services/modules/ips4/urls.py

@@ -0,0 +1,16 @@
+from __future__ import unicode_literals
+from django.conf.urls import url, include
+
+from . import views
+
+module_urls = [
+    # IPS4 Service Control
+    url(r'^activate/$', views.activate_ips4, name='auth_activate_ips4'),
+    url(r'^deactivate/$', views.deactivate_ips4, name='auth_deactivate_ips4'),
+    url(r'^reset_password/$', views.reset_ips4_password, name='auth_reset_ips4_password'),
+    url(r'^set_password/$', views.set_ips4_password, name='auth_set_ips4_password'),
+]
+
+urlpatterns = [
+    url(r'^ips4/', include(module_urls))
+]

services/modules/ips4/views.py

@@ -0,0 +1,107 @@
+from __future__ import unicode_literals
+
+from django.contrib import messages
+from django.contrib.auth.decorators import login_required
+from django.shortcuts import render, redirect
+
+from authentication.decorators import members_and_blues
+from eveonline.managers import EveManager
+from services.forms import ServicePasswordForm
+
+from .manager import Ips4Manager
+from .models import Ips4User
+from .tasks import Ips4Tasks
+
+import logging
+
+logger = logging.getLogger(__name__)
+
+
+@login_required
+@members_and_blues()
+def activate_ips4(request):
+    logger.debug("activate_ips4 called by user %s" % request.user)
+    character = EveManager.get_main_character(request.user)
+    logger.debug("Adding IPS4 user for user %s with main character %s" % (request.user, character))
+    result = Ips4Manager.add_user(character.character_name, request.user.email)
+    # if empty we failed
+    if result[0] != "" and not Ips4Tasks.has_account(request.user):
+        ips_user = Ips4User.objects.create(user=request.user, id=result[2], username=result[0])
+        logger.debug("Updated authserviceinfo for user %s with IPS4 credentials." % request.user)
+        # update_ips4_groups.delay(request.user.pk)
+        logger.info("Successfully activated IPS4 for user %s" % request.user)
+        messages.success(request, 'Activated IPSuite4 account.')
+        credentials = {
+            'username': result[0],
+            'password': result[1],
+        }
+        return render(request, 'registered/service_credentials.html',
+                      context={'credentials': credentials, 'service': 'IPSuite4'})
+    else:
+        logger.error("Unsuccessful attempt to activate IPS4 for user %s" % request.user)
+        messages.error(request, 'An error occurred while processing your IPSuite4 account.')
+    return redirect("auth_services")
+
+
+@login_required
+@members_and_blues()
+def reset_ips4_password(request):
+    logger.debug("reset_ips4_password called by user %s" % request.user)
+    if Ips4Tasks.has_account(request.user):
+        result = Ips4Manager.update_user_password(request.user.ips4.username)
+        # false we failed
+        if result != "":
+            logger.info("Successfully reset IPS4 password for user %s" % request.user)
+            messages.success(request, 'Reset IPSuite4 password.')
+            credentials = {
+                'username': request.user.ips4.username,
+                'password': result,
+            }
+            return render(request, 'registered/service_credentials.html',
+                          context={'credentials': credentials, 'service': 'IPSuite4'})
+
+    logger.error("Unsuccessful attempt to reset IPS4 password for user %s" % request.user)
+    messages.error(request, 'An error occurred while processing your IPSuite4 account.')
+    return redirect("auth_services")
+
+
+@login_required
+@members_and_blues()
+def set_ips4_password(request):
+    logger.debug("set_ips4_password called by user %s" % request.user)
+    if request.method == 'POST':
+        logger.debug("Received POST request with form.")
+        form = ServicePasswordForm(request.POST)
+        logger.debug("Form is valid: %s" % form.is_valid())
+        if form.is_valid() and Ips4Tasks.has_account(request.user):
+            password = form.cleaned_data['password']
+            logger.debug("Form contains password of length %s" % len(password))
+            result = Ips4Manager.update_custom_password(request.user.ips4.username, plain_password=password)
+            if result != "":
+                logger.info("Successfully set IPS4 password for user %s" % request.user)
+                messages.success(request, 'Set IPSuite4 password.')
+            else:
+                logger.error("Failed to install custom IPS4 password for user %s" % request.user)
+                messages.error(request, 'An error occurred while processing your IPSuite4 account.')
+            return redirect('auth_services')
+    else:
+        logger.debug("Request is not type POST - providing empty form.")
+        form = ServicePasswordForm()
+
+    logger.debug("Rendering form for user %s" % request.user)
+    context = {'form': form, 'service': 'IPS4'}
+    return render(request, 'registered/service_password.html', context=context)
+
+
+@login_required
+@members_and_blues()
+def deactivate_ips4(request):
+    logger.debug("deactivate_ips4 called by user %s" % request.user)
+    if Ips4Tasks.delete_user(request.user):
+        logger.info("Successfully deactivated IPS4 for user %s" % request.user)
+        messages.success(request, 'Deactivated IPSuite4 account.')
+    else:
+        logger.error("Unsuccessful attempt to deactivate IPS4 for user %s" % request.user)
+        messages.error(request, 'An error occurred while processing your IPSuite4 account.')
+    return redirect("auth_services")
+

services/modules/market/admin.py

@@ -0,0 +1,10 @@
+from __future__ import unicode_literals
+from django.contrib import admin
+from .models import MarketUser
+
+
+class MarketUserAdmin(admin.ModelAdmin):
+        list_display = ('user', 'username')
+        search_fields = ('user__username', 'username')
+
+admin.site.register(MarketUser, MarketUserAdmin)

services/modules/market/apps.py

@@ -0,0 +1,7 @@
+from __future__ import unicode_literals
+
+from django.apps import AppConfig
+
+
+class MarketServiceConfig(AppConfig):
+    name = 'market'

services/modules/market/auth_hooks.py

@@ -0,0 +1,59 @@
+from __future__ import unicode_literals
+
+from django.conf import settings
+from django.template.loader import render_to_string
+
+from services.hooks import ServicesHook
+from alliance_auth import hooks
+
+from .urls import urlpatterns
+from .tasks import MarketTasks
+
+import logging
+
+logger = logging.getLogger(__name__)
+
+
+class MarketService(ServicesHook):
+    def __init__(self):
+        ServicesHook.__init__(self)
+        self.name = 'market'
+        self.urlpatterns = urlpatterns
+        self.service_url = settings.MARKET_URL
+
+    @property
+    def title(self):
+        return "Alliance Market"
+
+    def delete_user(self, user, notify_user=False):
+        logger.debug('Deleting user %s %s account' % (user, self.name))
+        return MarketTasks.delete_user(user, notify_user=notify_user)
+
+    def validate_user(self, user):
+        logger.debug('Validating user %s %s account' % (user, self.name))
+        if MarketTasks.has_account(user) and self.service_active_for_user(user):
+            self.delete_user(user)
+
+    def service_enabled_members(self):
+        return settings.ENABLE_AUTH_MARKET or False
+
+    def service_enabled_blues(self):
+        return settings.ENABLE_BLUE_MARKET or False
+
+    def render_services_ctrl(self, request):
+        urls = self.Urls()
+        urls.auth_activate = 'auth_activate_market'
+        urls.auth_deactivate = 'auth_deactivate_market'
+        urls.auth_reset_password = 'auth_reset_market_password'
+        urls.auth_set_password = 'auth_set_market_password'
+        return render_to_string(self.service_ctrl_template, {
+            'service_name': self.title,
+            'urls': urls,
+            'service_url': self.service_url,
+            'username': request.user.market.username if MarketTasks.has_account(request.user) else ''
+        }, request=request)
+
+
+@hooks.register('services_hook')
+def register_service():
+    return MarketService()

services/modules/market/manager.py

@@ -1,6 +1,8 @@
 from __future__ import unicode_literals
 import logging
-import os
+import random
+import string
+import re
 
 from django.db import connections
 from passlib.hash import bcrypt
@@ -10,7 +12,7 @@ from passlib.hash import bcrypt
 logger = logging.getLogger(__name__)
 
 
-class marketManager:
+class MarketManager:
     def __init__(self):
         pass
 
@@ -32,13 +34,23 @@ class marketManager:
 
     @staticmethod
     def __generate_random_pass():
-        return os.urandom(8).encode('hex')
+        return ''.join([random.choice(string.ascii_letters + string.digits) for n in range(16)])
 
     @staticmethod
-    def check_username(username):
+    def _gen_pwhash(password):
+        return bcrypt.encrypt(password.encode('utf-8'), rounds=13)
+
+    @staticmethod
+    def _get_salt(pw_hash):
+        search = re.compile(r"^\$2[a-z]?\$([0-9]+)\$(.{22})(.{31})$")
+        match = re.match(search, pw_hash)
+        return match.group(2)
+
+    @classmethod
+    def check_username(cls, username):
         logger.debug("Checking alliance market username %s" % username)
         cursor = connections['market'].cursor()
-        cursor.execute(marketManager.SQL_CHECK_USERNAME, [marketManager.__santatize_username(username)])
+        cursor.execute(cls.SQL_CHECK_USERNAME, [cls.__santatize_username(username)])
         row = cursor.fetchone()
         if row:
             logger.debug("Found user %s on alliance market" % username)
@@ -46,11 +58,11 @@ class marketManager:
         logger.debug("User %s not found on alliance market" % username)
         return False
 
-    @staticmethod
-    def check_user_email(username, email):
+    @classmethod
+    def check_user_email(cls, username, email):
         logger.debug("Checking if alliance market email exists for user %s" % username)
         cursor = connections['market'].cursor()
-        cursor.execute(marketManager.SQL_CHECK_EMAIL, [email])
+        cursor.execute(cls.SQL_CHECK_EMAIL, [email])
         row = cursor.fetchone()
         if row:
             logger.debug("Found user %s email address on alliance market" % username)
@@ -58,21 +70,19 @@ class marketManager:
         logger.debug("User %s email address not found on alliance market" % username)
         return False
 
-    @staticmethod
-    def add_user(username, email, characterid, charactername):
+    @classmethod
+    def add_user(cls, username, email, characterid, charactername):
         logger.debug("Adding new market user %s" % username)
-        plain_password = marketManager.__generate_random_pass()
-        hash = bcrypt.encrypt(plain_password, rounds=13)
-        hash_result = hash
-        rounds_striped = hash_result.strip('$2a$13$')
-        salt = rounds_striped[:22]
-        username_clean = marketManager.__santatize_username(username)
-        if not marketManager.check_username(username):
-            if not marketManager.check_user_email(username, email):
+        plain_password = cls.__generate_random_pass()
+        hash = cls._gen_pwhash(plain_password)
+        salt = cls._get_salt(hash)
+        username_clean = cls.__santatize_username(username)
+        if not cls.check_username(username):
+            if not cls.check_user_email(username, email):
                 try:
                     logger.debug("Adding user %s to alliance market" % username)
                     cursor = connections['market'].cursor()
-                    cursor.execute(marketManager.SQL_ADD_USER, [username_clean, username_clean, email, email, salt,
+                    cursor.execute(cls.SQL_ADD_USER, [username_clean, username_clean, email, email, salt,
                                                                 hash, characterid, charactername])
                     return username_clean, plain_password
                 except:
@@ -80,65 +90,59 @@ class marketManager:
                     return "", ""
             else:
                 logger.debug("Alliance market email %s already exists Updating instead" % email)
-                username_clean, password = marketManager.update_user_info(username)
+                username_clean, password = cls.update_user_info(username)
                 return username_clean, password
         else:
             logger.debug("Alliance market username %s already exists Updating instead" % username)
-            username_clean, password = marketManager.update_user_info(username)
+            username_clean, password = cls.update_user_info(username)
             return username_clean, password
 
-    @staticmethod
-    def disable_user(username):
+    @classmethod
+    def disable_user(cls, username):
         logger.debug("Disabling alliance market user %s " % username)
         cursor = connections['market'].cursor()
-        cursor.execute(marketManager.SQL_DISABLE_USER, [username])
+        cursor.execute(cls.SQL_DISABLE_USER, [username])
         return True
 
-    @staticmethod
-    def update_custom_password(username, plain_password):
+    @classmethod
+    def update_custom_password(cls, username, plain_password):
         logger.debug("Updating alliance market user %s password" % username)
-        if marketManager.check_username(username):
-            username_clean = marketManager.__santatize_username(username)
-            hash = bcrypt.encrypt(plain_password, rounds=13)
-            hash_result = hash
-            rounds_striped = hash_result.strip('$2a$13$')
-            salt = rounds_striped[:22]
+        if cls.check_username(username):
+            username_clean = cls.__santatize_username(username)
+            hash = cls._gen_pwhash(plain_password)
+            salt = cls._get_salt(hash)
             cursor = connections['market'].cursor()
-            cursor.execute(marketManager.SQL_UPDATE_PASSWORD, [hash, salt, username_clean])
+            cursor.execute(cls.SQL_UPDATE_PASSWORD, [hash, salt, username_clean])
             return plain_password
         else:
             logger.error("Unable to update alliance market user %s password" % username)
             return ""
 
-    @staticmethod
-    def update_user_password(username):
+    @classmethod
+    def update_user_password(cls, username):
         logger.debug("Updating alliance market user %s password" % username)
-        if marketManager.check_username(username):
-            username_clean = marketManager.__santatize_username(username)
-            plain_password = marketManager.__generate_random_pass()
-            hash = bcrypt.encrypt(plain_password, rounds=13)
-            hash_result = hash
-            rounds_striped = hash_result.strip('$2a$13$')
-            salt = rounds_striped[:22]
+        if cls.check_username(username):
+            username_clean = cls.__santatize_username(username)
+            plain_password = cls.__generate_random_pass()
+            hash = cls._gen_pwhash(plain_password)
+            salt = cls._get_salt(hash)
             cursor = connections['market'].cursor()
-            cursor.execute(marketManager.SQL_UPDATE_PASSWORD, [hash, salt, username_clean])
+            cursor.execute(cls.SQL_UPDATE_PASSWORD, [hash, salt, username_clean])
             return plain_password
         else:
             logger.error("Unable to update alliance market user %s password" % username)
             return ""
 
-    @staticmethod
-    def update_user_info(username):
+    @classmethod
+    def update_user_info(cls, username):
         logger.debug("Updating alliance market user %s" % username)
         try:
-            username_clean = marketManager.__santatize_username(username)
-            plain_password = marketManager.__generate_random_pass()
-            hash = bcrypt.encrypt(plain_password, rounds=13)
-            hash_result = hash
-            rounds_striped = hash_result.strip('$2a$13$')
-            salt = rounds_striped[:22]
+            username_clean = cls.__santatize_username(username)
+            plain_password = cls.__generate_random_pass()
+            hash = cls._gen_pwhash(plain_password)
+            salt = cls._get_salt(hash)
             cursor = connections['market'].cursor()
-            cursor.execute(marketManager.SQL_UPDATE_USER, [hash, salt, username_clean])
+            cursor.execute(cls.SQL_UPDATE_USER, [hash, salt, username_clean])
             return username_clean, plain_password
         except:
             logger.debug("Alliance market update user failed for %s" % username)

services/modules/market/migrations/0001_initial.py

@@ -0,0 +1,26 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.10.2 on 2016-12-12 03:27
+from __future__ import unicode_literals
+
+from django.conf import settings
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        ('auth', '0008_alter_user_username_max_length'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='MarketUser',
+            fields=[
+                ('user', models.OneToOneField(on_delete=django.db.models.deletion.CASCADE, primary_key=True, related_name='market', serialize=False, to=settings.AUTH_USER_MODEL)),
+                ('username', models.CharField(max_length=254)),
+            ],
+        ),
+    ]

services/modules/market/models.py

@@ -0,0 +1,16 @@
+from __future__ import unicode_literals
+from django.utils.encoding import python_2_unicode_compatible
+from django.contrib.auth.models import User
+from django.db import models
+
+
+@python_2_unicode_compatible
+class MarketUser(models.Model):
+    user = models.OneToOneField(User,
+                                primary_key=True,
+                                on_delete=models.CASCADE,
+                                related_name='market')
+    username = models.CharField(max_length=254)
+
+    def __str__(self):
+        return self.username

services/modules/market/tasks.py

@@ -0,0 +1,44 @@
+from __future__ import unicode_literals
+
+from django.conf import settings
+from django.core.exceptions import ObjectDoesNotExist
+from notifications import notify
+
+from .models import MarketUser
+from .manager import MarketManager
+
+
+import logging
+
+logger = logging.getLogger(__name__)
+
+
+class MarketTasks:
+    def __init__(self):
+        pass
+
+    @classmethod
+    def delete_user(cls, user, notify_user=False):
+        if cls.has_account(user):
+            logger.debug("User %s has a Market account %s. Deleting." % (user, user.market.username))
+            if MarketManager.disable_user(user.market.username):
+                user.market.delete()
+                if notify_user:
+                    notify(user, 'Alliance Market Account Disabled', level='danger')
+                return True
+        return False
+
+    @staticmethod
+    def has_account(user):
+        try:
+            return user.market.username != ''
+        except ObjectDoesNotExist:
+            return False
+
+    @staticmethod
+    def disable():
+        if settings.ENABLE_AUTH_MARKET:
+            logger.warn("ENABLE_AUTH_MARKET still True, after disabling users will still be able to activate Market accounts")
+        if settings.ENABLE_BLUE_MARKET:
+            logger.warn("ENABLE_BLUE_MARKET still True, after disabling blues will still be able to activate Market accounts")
+        MarketUser.objects.all().delete()

services/modules/market/tests.py

@@ -0,0 +1,176 @@
+from __future__ import unicode_literals
+
+try:
+    # Py3
+    from unittest import mock
+except ImportError:
+    # Py2
+    import mock
+
+from django.test import TestCase, RequestFactory
+from django.conf import settings
+from django import urls
+from django.contrib.auth.models import User
+from django.core.exceptions import ObjectDoesNotExist
+
+from alliance_auth.tests.auth_utils import AuthUtils
+
+from .auth_hooks import MarketService
+from .models import MarketUser
+from .tasks import MarketTasks
+
+MODULE_PATH = 'services.modules.market'
+
+
+class MarketHooksTestCase(TestCase):
+    def setUp(self):
+        self.member = 'member_user'
+        member = AuthUtils.create_member(self.member)
+        MarketUser.objects.create(user=member, username=self.member)
+        self.blue = 'blue_user'
+        blue = AuthUtils.create_blue(self.blue)
+        MarketUser.objects.create(user=blue, username=self.blue)
+        self.none_user = 'none_user'
+        none_user = AuthUtils.create_user(self.none_user)
+        self.service = MarketService
+
+    def test_has_account(self):
+        member = User.objects.get(username=self.member)
+        blue = User.objects.get(username=self.blue)
+        none_user = User.objects.get(username=self.none_user)
+        self.assertTrue(MarketTasks.has_account(member))
+        self.assertTrue(MarketTasks.has_account(blue))
+        self.assertFalse(MarketTasks.has_account(none_user))
+
+    def test_service_enabled(self):
+        service = self.service()
+        member = User.objects.get(username=self.member)
+        blue = User.objects.get(username=self.blue)
+        none_user = User.objects.get(username=self.none_user)
+        self.assertTrue(service.service_enabled_members())
+        self.assertTrue(service.service_enabled_blues())
+
+        self.assertEqual(service.service_active_for_user(member), settings.ENABLE_AUTH_MARKET)
+        self.assertEqual(service.service_active_for_user(blue), settings.ENABLE_BLUE_MARKET)
+        self.assertFalse(service.service_active_for_user(none_user))
+
+    @mock.patch(MODULE_PATH + '.tasks.MarketManager')
+    def test_delete_user(self, manager):
+        member = User.objects.get(username=self.member)
+
+        service = self.service()
+        result = service.delete_user(member)
+
+        self.assertTrue(result)
+        self.assertTrue(manager.disable_user.called)
+        with self.assertRaises(ObjectDoesNotExist):
+            market_user = User.objects.get(username=self.member).market
+
+    def test_render_services_ctrl(self):
+        service = self.service()
+        member = User.objects.get(username=self.member)
+        request = RequestFactory().get('/en/services/')
+        request.user = member
+
+        response = service.render_services_ctrl(request)
+        self.assertTemplateUsed(service.service_ctrl_template)
+        self.assertIn(urls.reverse('auth_set_market_password'), response)
+        self.assertIn(urls.reverse('auth_reset_market_password'), response)
+        self.assertIn(urls.reverse('auth_deactivate_market'), response)
+
+        # Test register becomes available
+        member.market.delete()
+        member = User.objects.get(username=self.member)
+        request.user = member
+        response = service.render_services_ctrl(request)
+        self.assertIn(urls.reverse('auth_activate_market'), response)
+
+
+class MarketViewsTestCase(TestCase):
+    def setUp(self):
+        self.member = AuthUtils.create_member('auth_member')
+        self.member.set_password('password')
+        self.member.email = 'auth_member@example.com'
+        self.member.save()
+        AuthUtils.add_main_character(self.member, 'auth_member', '12345', corp_id='111', corp_name='Test Corporation')
+
+    def login(self):
+        self.client.login(username=self.member.username, password='password')
+
+    @mock.patch(MODULE_PATH + '.views.MarketManager')
+    def test_activate(self, manager):
+        self.login()
+        expected_username = 'auth_member'
+        expected_password = 'password'
+        expected_id = '1234'
+
+        manager.add_user.return_value = (expected_username, expected_password, expected_id)
+
+        response = self.client.get(urls.reverse('auth_activate_market'), follow=False)
+
+        self.assertTrue(manager.add_user.called)
+        args, kwargs = manager.add_user.call_args
+        self.assertEqual(args[0], expected_username)
+        self.assertEqual(args[1], self.member.email)
+
+        self.assertTemplateUsed(response, 'registered/service_credentials.html')
+        self.assertContains(response, expected_username)
+        self.assertContains(response, expected_password)
+
+    @mock.patch(MODULE_PATH + '.tasks.MarketManager')
+    def test_deactivate(self, manager):
+        self.login()
+        MarketUser.objects.create(user=self.member, username='12345')
+        manager.disable_user.return_value = True
+
+        response = self.client.get(urls.reverse('auth_deactivate_market'))
+
+        self.assertTrue(manager.disable_user.called)
+        self.assertRedirects(response, expected_url=urls.reverse('auth_services'), target_status_code=200)
+        with self.assertRaises(ObjectDoesNotExist):
+            market_user = User.objects.get(pk=self.member.pk).market
+
+    @mock.patch(MODULE_PATH + '.views.MarketManager')
+    def test_set_password(self, manager):
+        self.login()
+        MarketUser.objects.create(user=self.member, username='12345')
+        expected_password = 'password'
+        manager.update_user_password.return_value = expected_password
+
+        response = self.client.post(urls.reverse('auth_set_market_password'), data={'password': expected_password})
+
+        self.assertTrue(manager.update_custom_password.called)
+        args, kwargs = manager.update_custom_password.call_args
+        self.assertEqual(args[1], expected_password)
+        self.assertRedirects(response, expected_url=urls.reverse('auth_services'), target_status_code=200)
+
+    @mock.patch(MODULE_PATH + '.views.MarketManager')
+    def test_reset_password(self, manager):
+        self.login()
+        MarketUser.objects.create(user=self.member, username='12345')
+
+        response = self.client.get(urls.reverse('auth_reset_market_password'))
+
+        self.assertTrue(manager.update_user_password.called)
+        self.assertTemplateUsed(response, 'registered/service_credentials.html')
+
+
+class MarketManagerTestCase(TestCase):
+    def setUp(self):
+        from .manager import MarketManager
+        self.manager = MarketManager
+
+    def test_generate_random_password(self):
+        password = self.manager._MarketManager__generate_random_pass()
+
+        self.assertEqual(len(password), 16)
+        self.assertIsInstance(password, type(''))
+
+    def test_gen_pwhash(self):
+        pwhash = self.manager._gen_pwhash('test')
+        salt = self.manager._get_salt(pwhash)
+
+        self.assertIsInstance(pwhash, str)
+        self.assertGreaterEqual(len(pwhash), 59)
+        self.assertIsInstance(salt, str)
+        self.assertEqual(len(salt), 22)

services/modules/market/urls.py

@@ -0,0 +1,16 @@
+from __future__ import unicode_literals
+from django.conf.urls import url, include
+
+from . import views
+
+module_urls = [
+    # Alliance Market Control
+    url(r'^activate/$', views.activate_market, name='auth_activate_market'),
+    url(r'^deactivate/$', views.deactivate_market, name='auth_deactivate_market'),
+    url(r'^reset_password/$', views.reset_market_password, name='auth_reset_market_password'),
+    url(r'^set_password/$', views.set_market_password, name='auth_set_market_password'),
+]
+
+urlpatterns = [
+    url(r'^market/', include(module_urls))
+]

services/modules/market/views.py

@@ -0,0 +1,107 @@
+from __future__ import unicode_literals
+
+from django.contrib import messages
+from django.contrib.auth.decorators import login_required
+from django.shortcuts import render, redirect
+
+from authentication.decorators import members_and_blues
+from services.forms import ServicePasswordForm
+from eveonline.managers import EveManager
+
+from .manager import MarketManager
+from .models import MarketUser
+from .tasks import MarketTasks
+
+import logging
+
+logger = logging.getLogger(__name__)
+
+
+@login_required
+@members_and_blues()
+def activate_market(request):
+    logger.debug("activate_market called by user %s" % request.user)
+    character = EveManager.get_main_character(request.user)
+    if character is not None:
+        logger.debug("Adding market user for user %s with main character %s" % (request.user, character))
+        result = MarketManager.add_user(character.character_name, request.user.email, character.character_id,
+                                        character.character_name)
+        # if empty we failed
+        if result[0] != "":
+            MarketUser.objects.create(user=request.user, username=result[0])
+            logger.debug("Updated authserviceinfo for user %s with market credentials." % request.user)
+            logger.info("Successfully activated market for user %s" % request.user)
+            messages.success(request, 'Activated Alliance Market account.')
+            credentials = {
+                'username': result[0],
+                'password': result[1],
+            }
+            return render(request, 'registered/service_credentials.html',
+                          context={'credentials': credentials, 'service': 'Alliance Market'})
+    logger.error("Unsuccessful attempt to activate market for user %s" % request.user)
+    messages.error(request, 'An error occurred while processing your Alliance Market account.')
+    return redirect("auth_services")
+
+
+@login_required
+@members_and_blues()
+def deactivate_market(request):
+    logger.debug("deactivate_market called by user %s" % request.user)
+    # false we failed
+    if MarketTasks.delete_user(request.user):
+        logger.info("Successfully deactivated market for user %s" % request.user)
+        messages.success(request, 'Deactivated Alliance Market account.')
+    else:
+        logger.error("Unsuccessful attempt to activate market for user %s" % request.user)
+        messages.error(request, 'An error occurred while processing your Alliance Market account.')
+    return redirect("auth_services")
+
+
+@login_required
+@members_and_blues()
+def reset_market_password(request):
+    logger.debug("reset_market_password called by user %s" % request.user)
+    if MarketTasks.has_account(request.user):
+        result = MarketManager.update_user_password(request.user.market.username)
+        # false we failed
+        if result != "":
+            logger.info("Successfully reset market password for user %s" % request.user)
+            messages.success(request, 'Reset Alliance Market password.')
+            credentials = {
+                'username': request.user.market.username,
+                'password': result,
+            }
+            return render(request, 'registered/service_credentials.html',
+                          context={'credentials': credentials, 'service': 'Alliance Market'})
+
+    logger.error("Unsuccessful attempt to reset market password for user %s" % request.user)
+    messages.error(request, 'An error occurred while processing your Alliance Market account.')
+    return redirect("auth_services")
+
+
+@login_required
+@members_and_blues()
+def set_market_password(request):
+    logger.debug("set_market_password called by user %s" % request.user)
+    if request.method == 'POST':
+        logger.debug("Received POST request with form.")
+        form = ServicePasswordForm(request.POST)
+        logger.debug("Form is valid: %s" % form.is_valid())
+        if form.is_valid() and MarketTasks.has_account(request.user):
+            password = form.cleaned_data['password']
+            logger.debug("Form contains password of length %s" % len(password))
+            result = MarketManager.update_custom_password(request.user.market.username, password)
+            if result != "":
+                logger.info("Successfully reset market password for user %s" % request.user)
+                messages.success(request, 'Set Alliance Market password.')
+            else:
+                logger.error("Failed to install custom market password for user %s" % request.user)
+                messages.error(request, 'An error occurred while processing your Alliance Market account.')
+            return redirect("auth_services")
+    else:
+        logger.debug("Request is not type POST - providing empty form.")
+        form = ServicePasswordForm()
+
+    logger.debug("Rendering form for user %s" % request.user)
+    context = {'form': form, 'service': 'Market'}
+    return render(request, 'registered/service_password.html', context=context)

services/modules/mumble/admin.py

@@ -0,0 +1,11 @@
+from __future__ import unicode_literals
+from django.contrib import admin
+from .models import MumbleUser
+
+
+class MumbleUserAdmin(admin.ModelAdmin):
+        fields = ('user', 'username', 'groups')  # pwhash is hidden from admin panel
+        list_display = ('user', 'username', 'groups')
+        search_fields = ('user__username', 'username', 'groups')
+
+admin.site.register(MumbleUser, MumbleUserAdmin)

services/modules/mumble/apps.py

@@ -0,0 +1,7 @@
+from __future__ import unicode_literals
+
+from django.apps import AppConfig
+
+
+class MumbleServiceConfig(AppConfig):
+    name = 'mumble'

services/modules/mumble/auth_hooks.py

@@ -0,0 +1,68 @@
+from __future__ import unicode_literals
+from django.template.loader import render_to_string
+from django.conf import settings
+from notifications import notify
+
+from alliance_auth import hooks
+from services.hooks import ServicesHook
+from .tasks import MumbleTasks
+from .manager import MumbleManager
+from .urls import urlpatterns
+
+import logging
+
+logger = logging.getLogger(__name__)
+
+
+class MumbleService(ServicesHook):
+    def __init__(self):
+        ServicesHook.__init__(self)
+        self.name = 'mumble'
+        self.urlpatterns = urlpatterns
+        self.service_url = settings.MUMBLE_URL
+
+    def delete_user(self, user, notify_user=False):
+        logging.debug("Deleting user %s %s account" % (user, self.name))
+        if MumbleManager.delete_user(user):
+            if notify_user:
+                notify(user, 'Mumble Account Disabled', level='danger')
+            return True
+        return False
+
+    def update_groups(self, user):
+        logger.debug("Updating %s groups for %s" % (self.name, user))
+        if MumbleTasks.has_account(user):
+            MumbleTasks.update_groups.delay(user.pk)
+
+    def validate_user(self, user):
+        if MumbleTasks.has_account(user) and not self.service_active_for_user(user):
+            self.delete_user(user, notify_user=True)
+
+    def update_all_groups(self):
+        logger.debug("Updating all %s groups" % self.name)
+        MumbleTasks.update_all_groups.delay()
+
+    def service_enabled_members(self):
+        return settings.ENABLE_AUTH_MUMBLE or False
+
+    def service_enabled_blues(self):
+        return settings.ENABLE_BLUE_MUMBLE or False
+
+    def render_services_ctrl(self, request):
+        urls = self.Urls()
+        urls.auth_activate = 'auth_activate_mumble'
+        urls.auth_deactivate = 'auth_deactivate_mumble'
+        urls.auth_reset_password = 'auth_reset_mumble_password'
+        urls.auth_set_password = 'auth_set_mumble_password'
+
+        return render_to_string(self.service_ctrl_template, {
+            'service_name': self.title,
+            'urls': urls,
+            'service_url': self.service_url,
+            'username': request.user.mumble.username if MumbleTasks.has_account(request.user) else '',
+        }, request=request)
+
+
+@hooks.register('services_hook')
+def register_mumble_service():
+    return MumbleService()

services/modules/mumble/manager.py

@@ -0,0 +1,105 @@
+from __future__ import unicode_literals
+import random
+import string
+import hashlib
+
+from django.core.exceptions import ObjectDoesNotExist
+
+from .models import MumbleUser
+
+import logging
+
+logger = logging.getLogger(__name__)
+
+
+class MumbleManager:
+    def __init__(self):
+        pass
+
+    @staticmethod
+    def __santatize_username(username):
+        sanatized = username.replace(" ", "_")
+        return sanatized
+
+    @staticmethod
+    def __generate_random_pass():
+        return ''.join([random.choice(string.ascii_letters + string.digits) for n in range(16)])
+
+    @staticmethod
+    def __generate_username(username, corp_ticker):
+        return "[" + corp_ticker + "]" + username
+
+    @staticmethod
+    def __generate_username_blue(username, corp_ticker):
+        return "[BLUE][" + corp_ticker + "]" + username
+
+    @staticmethod
+    def _gen_pwhash(password):
+        return hashlib.sha1(password.encode('utf-8')).hexdigest()
+
+    @staticmethod
+    def create_user(user, corp_ticker, username, blue=False):
+        logger.debug("Creating%s mumble user with username %s and ticker %s" % (' blue' if blue else '',
+                                                                                username, corp_ticker))
+        username_clean = MumbleManager.__santatize_username(
+            MumbleManager.__generate_username_blue(username, corp_ticker) if blue else
+            MumbleManager.__generate_username(username, corp_ticker))
+        password = MumbleManager.__generate_random_pass()
+        pwhash = MumbleManager._gen_pwhash(password)
+        logger.debug("Proceeding with mumble user creation: clean username %s, pwhash starts with %s" % (
+            username_clean, pwhash[0:5]))
+        if not MumbleUser.objects.filter(username=username_clean).exists():
+            logger.info("Creating mumble user %s" % username_clean)
+            MumbleUser.objects.create(user=user, username=username_clean, pwhash=pwhash)
+            return username_clean, password
+        else:
+            logger.warn("Mumble user %s already exists.")
+            return False
+
+    @staticmethod
+    def delete_user(user):
+        logger.debug("Deleting user %s from mumble." % user)
+        if MumbleUser.objects.filter(user=user).exists():
+            MumbleUser.objects.filter(user=user).delete()
+            logger.info("Deleted user %s from mumble" % user)
+            return True
+        logger.error("Unable to delete user %s from mumble: MumbleUser model not found" % user)
+        return False
+
+    @staticmethod
+    def update_user_password(user, password=None):
+        logger.debug("Updating mumble user %s password." % user)
+        if not password:
+            password = MumbleManager.__generate_random_pass()
+        pwhash = MumbleManager._gen_pwhash(password)
+        logger.debug("Proceeding with mumble user %s password update - pwhash starts with %s" % (user, pwhash[0:5]))
+        try:
+            model = MumbleUser.objects.get(user=user)
+            model.pwhash = pwhash
+            model.save()
+            return password
+        except ObjectDoesNotExist:
+            logger.error("User %s not found on mumble. Unable to update password." % user)
+            return False
+
+    @staticmethod
+    def update_groups(user, groups):
+        logger.debug("Updating mumble user %s groups %s" % (user, groups))
+        safe_groups = list(set([g.replace(' ', '-') for g in groups]))
+        groups = ''
+        for g in safe_groups:
+            groups = groups + g + ','
+        groups = groups.strip(',')
+        if MumbleUser.objects.filter(user=user).exists():
+            logger.info("Updating mumble user %s groups to %s" % (user, safe_groups))
+            model = MumbleUser.objects.get(user=user)
+            model.groups = groups
+            model.save()
+            return True
+        else:
+            logger.error("User %s not found on mumble. Unable to update groups." % user)
+            return False
+
+    @staticmethod
+    def user_exists(username):
+        return MumbleUser.objects.filter(username=username).exists()

services/modules/mumble/migrations/0001_initial.py

@@ -0,0 +1,28 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.10.2 on 2016-12-12 00:58
+from __future__ import unicode_literals
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='MumbleUser',
+            fields=[
+                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('username', models.CharField(max_length=254, unique=True)),
+                ('pwhash', models.CharField(max_length=40)),
+                ('groups', models.TextField(blank=True, null=True)),
+            ],
+            options={
+                'db_table': 'services_mumbleuser',
+            },
+        ),
+    ]

services/modules/mumble/migrations/0002_auto_20161212_0100.py

@@ -0,0 +1,19 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.10.2 on 2016-12-12 01:00
+from __future__ import unicode_literals
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('mumble', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AlterModelTable(
+            name='mumbleuser',
+            table=None,
+        ),
+    ]

services/modules/mumble/migrations/0003_mumbleuser_user.py

@@ -0,0 +1,23 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.10.2 on 2016-12-12 03:31
+from __future__ import unicode_literals
+
+from django.conf import settings
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+        ('mumble', '0002_auto_20161212_0100'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='mumbleuser',
+            name='user',
+            field=models.ForeignKey(null=True, on_delete=django.db.models.deletion.CASCADE, related_name='mumble', to=settings.AUTH_USER_MODEL),
+        ),
+    ]

services/modules/mumble/migrations/0004_auto_20161214_1024.py

@@ -0,0 +1,22 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.10.4 on 2016-12-14 10:24
+from __future__ import unicode_literals
+
+from django.conf import settings
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('mumble', '0003_mumbleuser_user'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='mumbleuser',
+            name='user',
+            field=models.OneToOneField(null=True, on_delete=django.db.models.deletion.CASCADE, related_name='mumble', to=settings.AUTH_USER_MODEL),
+        ),
+    ]

services/modules/mumble/models.py

@@ -0,0 +1,14 @@
+from __future__ import unicode_literals
+from django.utils.encoding import python_2_unicode_compatible
+from django.db import models
+
+
+@python_2_unicode_compatible
+class MumbleUser(models.Model):
+    user = models.OneToOneField('auth.User', related_name='mumble', null=True)
+    username = models.CharField(max_length=254, unique=True)
+    pwhash = models.CharField(max_length=40)
+    groups = models.TextField(blank=True, null=True)
+
+    def __str__(self):
+        return self.username

services/modules/mumble/tasks.py

@@ -0,0 +1,63 @@
+from __future__ import unicode_literals
+
+from alliance_auth.celeryapp import app
+from django.conf import settings
+from django.contrib.auth.models import User
+from django.core.exceptions import ObjectDoesNotExist
+
+from .models import MumbleUser
+from .manager import MumbleManager
+
+import logging
+
+logger = logging.getLogger(__name__)
+
+
+class MumbleTasks:
+    def __init__(self):
+        pass
+
+    @staticmethod
+    def has_account(user):
+        try:
+            return user.mumble.username != ''
+        except ObjectDoesNotExist:
+            return False
+
+    @staticmethod
+    def disable_mumble():
+        if settings.ENABLE_AUTH_MUMBLE:
+            logger.warn("ENABLE_AUTH_MUMBLE still True, after disabling users will still be able to create mumble accounts")
+        if settings.ENABLE_BLUE_MUMBLE:
+            logger.warn("ENABLE_BLUE_MUMBLE still True, after disabling blues will still be able to create mumble accounts")
+        logger.info("Deleting all MumbleUser models")
+        MumbleUser.objects.all().delete()
+
+    @staticmethod
+    @app.task(bind=True)
+    def update_groups(self, pk):
+        user = User.objects.get(pk=pk)
+        logger.debug("Updating mumble groups for user %s" % user)
+        if MumbleTasks.has_account(user):
+            groups = []
+            for group in user.groups.all():
+                groups.append(str(group.name))
+            if len(groups) == 0:
+                groups.append('empty')
+            logger.debug("Updating user %s mumble groups to %s" % (user, groups))
+            try:
+                if not MumbleManager.update_groups(user, groups):
+                    raise Exception("Group sync failed")
+            except:
+                logger.exception("Mumble group sync failed for %s, retrying in 10 mins" % user)
+                raise self.retry(countdown=60 * 10)
+            logger.debug("Updated user %s mumble groups." % user)
+        else:
+            logger.debug("User %s does not have a mumble account, skipping" % user)
+
+    @staticmethod
+    @app.task
+    def update_all_groups():
+        logger.debug("Updating ALL mumble groups")
+        for mumble_user in MumbleUser.objects.exclude(username__exact=''):
+            MumbleTasks.update_groups.delay(mumble_user.user.pk)

services/modules/mumble/tests.py

@@ -0,0 +1,201 @@
+from __future__ import unicode_literals
+
+try:
+    # Py3
+    from unittest import mock
+except ImportError:
+    # Py2
+    import mock
+
+from django.test import TestCase, RequestFactory
+from django.conf import settings
+from django import urls
+from django.contrib.auth.models import User
+from django.core.exceptions import ObjectDoesNotExist
+
+from alliance_auth.tests.auth_utils import AuthUtils
+
+from .auth_hooks import MumbleService
+from .models import MumbleUser
+from .tasks import MumbleTasks
+
+import hashlib
+
+MODULE_PATH = 'services.modules.mumble'
+
+
+def gen_pwhash(password):
+    return hashlib.sha1(password).hexdigest()
+
+
+class MumbleHooksTestCase(TestCase):
+    def setUp(self):
+        self.member = 'member_user'
+        member = AuthUtils.create_member(self.member)
+        MumbleUser.objects.create(user=member, username=self.member, pwhash='password', groups='Member')
+        self.blue = 'blue_user'
+        blue = AuthUtils.create_blue(self.blue)
+        MumbleUser.objects.create(user=blue, username=self.blue, pwhash='password', groups='Blue')
+        self.none_user = 'none_user'
+        none_user = AuthUtils.create_user(self.none_user)
+        self.service = MumbleService
+
+    def test_has_account(self):
+        member = User.objects.get(username=self.member)
+        blue = User.objects.get(username=self.blue)
+        none_user = User.objects.get(username=self.none_user)
+        self.assertTrue(MumbleTasks.has_account(member))
+        self.assertTrue(MumbleTasks.has_account(blue))
+        self.assertFalse(MumbleTasks.has_account(none_user))
+
+    def test_service_enabled(self):
+        service = self.service()
+        member = User.objects.get(username=self.member)
+        blue = User.objects.get(username=self.blue)
+        none_user = User.objects.get(username=self.none_user)
+        self.assertTrue(service.service_enabled_members())
+        self.assertTrue(service.service_enabled_blues())
+
+        self.assertEqual(service.service_active_for_user(member), settings.ENABLE_AUTH_MUMBLE)
+        self.assertEqual(service.service_active_for_user(blue), settings.ENABLE_BLUE_MUMBLE)
+        self.assertFalse(service.service_active_for_user(none_user))
+
+    @mock.patch(MODULE_PATH + '.tasks.MumbleManager')
+    def test_update_all_groups(self, manager):
+        service = self.service()
+        service.update_all_groups()
+        # Check member and blue user have groups updated
+        self.assertTrue(manager.update_groups.called)
+        self.assertEqual(manager.update_groups.call_count, 2)
+
+    def test_update_groups(self):
+        # Check member has Member group updated
+        service = self.service()
+        member = User.objects.get(username=self.member)
+        member.mumble.groups = ''  # Remove the group set in setUp
+        member.mumble.save()
+
+        service.update_groups(member)
+
+        mumble_user = MumbleUser.objects.get(user=member)
+        self.assertIn(settings.DEFAULT_AUTH_GROUP, mumble_user.groups)
+
+        # Check none user does not have groups updated
+        with mock.patch(MODULE_PATH + '.tasks.MumbleManager') as manager:
+            service = self.service()
+            none_user = User.objects.get(username=self.none_user)
+            service.update_groups(none_user)
+            self.assertFalse(manager.update_groups.called)
+
+    def test_validate_user(self):
+        service = self.service()
+        # Test member is not deleted
+        member = User.objects.get(username=self.member)
+        service.validate_user(member)
+        self.assertTrue(member.mumble)
+
+        # Test none user is deleted
+        none_user = User.objects.get(username=self.none_user)
+        MumbleUser.objects.create(user=none_user, username='mr no-name', pwhash='password', groups='Blue,Orange')
+        service.validate_user(none_user)
+        with self.assertRaises(ObjectDoesNotExist):
+            none_mumble = User.objects.get(username=self.none_user).mumble
+
+    def test_delete_user(self):
+        member = User.objects.get(username=self.member)
+
+        service = self.service()
+        result = service.delete_user(member)
+
+        self.assertTrue(result)
+        with self.assertRaises(ObjectDoesNotExist):
+            mumble_user = User.objects.get(username=self.member).mumble
+
+    def test_render_services_ctrl(self):
+        service = self.service()
+        member = User.objects.get(username=self.member)
+        request = RequestFactory().get('/en/services/')
+        request.user = member
+
+        response = service.render_services_ctrl(request)
+        self.assertTemplateUsed(service.service_ctrl_template)
+        self.assertIn(urls.reverse('auth_deactivate_mumble'), response)
+        self.assertIn(urls.reverse('auth_reset_mumble_password'), response)
+        self.assertIn(urls.reverse('auth_set_mumble_password'), response)
+
+        # Test register becomes available
+        member.mumble.delete()
+        member = User.objects.get(username=self.member)
+        request.user = member
+        response = service.render_services_ctrl(request)
+        self.assertIn(urls.reverse('auth_activate_mumble'), response)
+
+
+class MumbleViewsTestCase(TestCase):
+    def setUp(self):
+        self.member = AuthUtils.create_member('auth_member')
+        self.member.set_password('password')
+        self.member.email = 'auth_member@example.com'
+        self.member.save()
+        AuthUtils.add_main_character(self.member, 'auth_member', '12345', corp_id='111', corp_name='Test Corporation',
+                                     corp_ticker='TESTR')
+
+    def login(self):
+        self.client.login(username=self.member.username, password='password')
+
+    def test_activate(self):
+        self.login()
+        expected_username = '[TESTR]auth_member'
+        response = self.client.get(urls.reverse('auth_activate_mumble'), follow=False)
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, expected_username)
+        mumble_user = MumbleUser.objects.get(user=self.member)
+        self.assertEqual(mumble_user.username, expected_username)
+        self.assertTrue(mumble_user.pwhash)
+        self.assertEqual(self.member.mumble.username, expected_username)
+
+    def test_deactivate(self):
+        self.login()
+        MumbleUser.objects.create(user=self.member, username='some member')
+
+        response = self.client.get(urls.reverse('auth_deactivate_mumble'))
+
+        self.assertRedirects(response, expected_url=urls.reverse('auth_services'), target_status_code=200)
+        with self.assertRaises(ObjectDoesNotExist):
+            mumble_user = User.objects.get(pk=self.member.pk).mumble
+
+    def test_set_password(self):
+        self.login()
+        MumbleUser.objects.create(user=self.member, username='some member', pwhash='old')
+
+        response = self.client.post(urls.reverse('auth_set_mumble_password'), data={'password': '1234asdf'})
+
+        self.assertNotEqual(MumbleUser.objects.get(user=self.member).pwhash, 'old')
+        self.assertRedirects(response, expected_url=urls.reverse('auth_services'), target_status_code=200)
+
+    def test_reset_password(self):
+        self.login()
+        MumbleUser.objects.create(user=self.member, username='some member', pwhash='old')
+
+        response = self.client.get(urls.reverse('auth_reset_mumble_password'))
+
+        self.assertNotEqual(MumbleUser.objects.get(user=self.member).pwhash, 'old')
+        self.assertTemplateUsed(response, 'registered/service_credentials.html')
+        self.assertContains(response, 'some member')
+
+
+class MumbleManagerTestCase(TestCase):
+    def setUp(self):
+        from .manager import MumbleManager
+        self.manager = MumbleManager
+
+    def test_generate_random_password(self):
+        password = self.manager._MumbleManager__generate_random_pass()
+
+        self.assertEqual(len(password), 16)
+        self.assertIsInstance(password, type(''))
+
+    def test_gen_pwhash(self):
+        pwhash = self.manager._gen_pwhash('test')
+
+        self.assertEqual(pwhash, 'a94a8fe5ccb19ba61c4c0873d391e987982fbbd3')

services/modules/mumble/urls.py

@@ -0,0 +1,17 @@
+from __future__ import unicode_literals
+from django.conf.urls import url, include
+
+from . import views
+
+module_urls = [
+    # Mumble service control
+    url(r'^activate/$', views.activate_mumble, name='auth_activate_mumble'),
+    url(r'^deactivate/$', views.deactivate_mumble, name='auth_deactivate_mumble'),
+    url(r'^reset_password/$', views.reset_mumble_password,
+        name='auth_reset_mumble_password'),
+    url(r'^set_password/$', views.set_mumble_password, name='auth_set_mumble_password'),
+]
+
+urlpatterns = [
+    url(r'^mumble/', include(module_urls))
+]

services/modules/mumble/views.py

@@ -0,0 +1,120 @@
+from __future__ import unicode_literals
+from django.contrib.auth.decorators import login_required
+from django.shortcuts import render, redirect
+from django.contrib import messages
+
+from authentication.decorators import members_and_blues
+from eveonline.managers import EveManager
+from eveonline.models import EveAllianceInfo
+from authentication.states import MEMBER_STATE, BLUE_STATE, NONE_STATE
+from authentication.models import AuthServicesInfo
+
+from services.forms import ServicePasswordForm
+
+from .manager import MumbleManager
+from .tasks import MumbleTasks
+from .models import MumbleUser
+
+import logging
+
+logger = logging.getLogger(__name__)
+
+
+@login_required
+@members_and_blues()
+def activate_mumble(request):
+    logger.debug("activate_mumble called by user %s" % request.user)
+    authinfo = AuthServicesInfo.objects.get(user=request.user)
+    character = EveManager.get_main_character(request.user)
+    ticker = character.corporation_ticker
+
+    if authinfo.state == BLUE_STATE:
+        logger.debug("Adding mumble user for blue user %s with main character %s" % (request.user, character))
+        # Blue members should have alliance ticker (if in alliance)
+        if EveAllianceInfo.objects.filter(alliance_id=character.alliance_id).exists():
+            alliance = EveAllianceInfo.objects.filter(alliance_id=character.alliance_id)[0]
+            ticker = alliance.alliance_ticker
+        result = MumbleManager.create_user(request.user, ticker, character.character_name, blue=True)
+    else:
+        logger.debug("Adding mumble user for user %s with main character %s" % (request.user, character))
+        result = MumbleManager.create_user(request.user, ticker, character.character_name)
+
+    if result:
+        logger.debug("Updated authserviceinfo for user %s with mumble credentials. Updating groups." % request.user)
+        MumbleTasks.update_groups.apply(request.user.pk)  # Run synchronously to prevent timing issues
+        logger.info("Successfully activated mumble for user %s" % request.user)
+        messages.success(request, 'Activated Mumble account.')
+        credentials = {
+            'username': result[0],
+            'password': result[1],
+        }
+        return render(request, 'registered/service_credentials.html',
+                      context={'credentials': credentials, 'service': 'Mumble'})
+    else:
+        logger.error("Unsuccessful attempt to activate mumble for user %s" % request.user)
+        messages.error(request, 'An error occurred while processing your Mumble account.')
+    return redirect("auth_services")
+
+
+@login_required
+@members_and_blues()
+def deactivate_mumble(request):
+    logger.debug("deactivate_mumble called by user %s" % request.user)
+    # if we successfully remove the user or the user is already removed
+    if MumbleManager.delete_user(request.user):
+        logger.info("Successfully deactivated mumble for user %s" % request.user)
+        messages.success(request, 'Deactivated Mumble account.')
+    else:
+        logger.error("Unsuccessful attempt to deactivate mumble for user %s" % request.user)
+        messages.error(request, 'An error occurred while processing your Mumble account.')
+    return redirect("auth_services")
+
+
+@login_required
+@members_and_blues()
+def reset_mumble_password(request):
+    logger.debug("reset_mumble_password called by user %s" % request.user)
+    result = MumbleManager.update_user_password(request.user)
+
+    # if blank we failed
+    if result != "":
+        logger.info("Successfully reset mumble password for user %s" % request.user)
+        messages.success(request, 'Reset Mumble password.')
+        credentials = {
+            'username': request.user.mumble.username,
+            'password': result,
+        }
+        return render(request, 'registered/service_credentials.html',
+                      context={'credentials': credentials, 'service': 'Mumble'})
+    else:
+        logger.error("Unsuccessful attempt to reset mumble password for user %s" % request.user)
+        messages.error(request, 'An error occurred while processing your Mumble account.')
+    return redirect("auth_services")
+
+
+@login_required
+@members_and_blues()
+def set_mumble_password(request):
+    logger.debug("set_mumble_password called by user %s" % request.user)
+    if request.method == 'POST':
+        logger.debug("Received POST request with form.")
+        form = ServicePasswordForm(request.POST)
+        logger.debug("Form is valid: %s" % form.is_valid())
+        if form.is_valid() and MumbleTasks.has_account(request.user):
+            password = form.cleaned_data['password']
+            logger.debug("Form contains password of length %s" % len(password))
+            result = MumbleManager.update_user_password(request.user, password=password)
+            if result != "":
+                logger.info("Successfully reset forum password for user %s" % request.user)
+                messages.success(request, 'Set Mumble password.')
+            else:
+                logger.error("Failed to install custom mumble password for user %s" % request.user)
+                messages.error(request, 'An error occurred while processing your Mumble account.')
+            return redirect("auth_services")
+    else:
+        logger.debug("Request is not type POST - providing empty form.")
+        form = ServicePasswordForm()
+
+    logger.debug("Rendering form for user %s" % request.user)
+    context = {'form': form, 'service': 'Mumble'}
+    return render(request, 'registered/service_password.html', context=context)

services/modules/openfire/admin.py

@@ -0,0 +1,10 @@
+from __future__ import unicode_literals
+from django.contrib import admin
+from .models import OpenfireUser
+
+
+class OpenfireUserAdmin(admin.ModelAdmin):
+        list_display = ('user', 'username')
+        search_fields = ('user__username', 'username')
+
+admin.site.register(OpenfireUser, OpenfireUserAdmin)

services/modules/openfire/apps.py

@@ -0,0 +1,7 @@
+from __future__ import unicode_literals
+
+from django.apps import AppConfig
+
+
+class OpenfireServiceConfig(AppConfig):
+    name = 'openfire'

services/modules/openfire/auth_hooks.py

@@ -0,0 +1,93 @@
+from __future__ import unicode_literals
+
+from django.conf import settings
+from django.template.loader import render_to_string
+
+from services.hooks import ServicesHook, MenuItemHook
+from alliance_auth import hooks
+
+from .urls import urlpatterns
+from .tasks import OpenfireTasks
+
+import logging
+
+logger = logging.getLogger(__name__)
+
+
+class OpenfireService(ServicesHook):
+    def __init__(self):
+        ServicesHook.__init__(self)
+        self.name = 'openfire'
+        self.urlpatterns = urlpatterns
+        self.service_url = settings.JABBER_URL
+
+    @property
+    def title(self):
+        return "Jabber"
+
+    def delete_user(self, user, notify_user=False):
+        logger.debug('Deleting user %s %s account' % (user, self.name))
+        return OpenfireTasks.delete_user(user, notify_user=notify_user)
+
+    def validate_user(self, user):
+        logger.debug('Validating user %s %s account' % (user, self.name))
+        if OpenfireTasks.has_account(user) and not self.service_active_for_user(user):
+            self.delete_user(user, notify_user=True)
+
+    def update_groups(self, user):
+        logger.debug('Updating %s groups for %s' % (self.name, user))
+        if OpenfireTasks.has_account(user):
+            OpenfireTasks.update_groups.delay(user.pk)
+
+    def update_all_groups(self):
+        logger.debug('Update all %s groups called' % self.name)
+        OpenfireTasks.update_all_groups.delay()
+
+    def service_enabled_members(self):
+        return settings.ENABLE_AUTH_JABBER or False  # TODO: Rename this setting
+
+    def service_enabled_blues(self):
+        return settings.ENABLE_BLUE_JABBER or False  # TODO: Rename this setting
+
+    def render_services_ctrl(self, request):
+        """
+        Example for rendering the service control panel row
+        You can override the default template and create a
+        custom one if you wish.
+        :param request:
+        :return:
+        """
+        urls = self.Urls()
+        urls.auth_activate = 'auth_activate_openfire'
+        urls.auth_deactivate = 'auth_deactivate_openfire'
+        urls.auth_set_password = 'auth_set_openfire_password'
+        urls.auth_reset_password = 'auth_reset_openfire_password'
+        return render_to_string(self.service_ctrl_template, {
+            'service_name': self.title,
+            'urls': urls,
+            'service_url': self.service_url,
+            'username': request.user.openfire.username if OpenfireTasks.has_account(request.user) else ''
+        }, request=request)
+
+
+@hooks.register('services_hook')
+def register_service():
+    return OpenfireService()
+
+
+class JabberBroadcast(MenuItemHook):
+    def __init__(self):
+        MenuItemHook.__init__(self,
+                              'Jabber Broadcast',
+                              'fa fa-lock fa-fw fa-bullhorn grayiconecolor',
+                              'auth_jabber_broadcast_view')
+
+    def render(self, request):
+        if request.user.has_perm('auth.jabber_broadcast'):
+            return MenuItemHook.render(self, request)
+        return ''
+
+
+@hooks.register('menu_util_hook')
+def register_menu():
+    return JabberBroadcast()

services/modules/openfire/forms.py

@@ -0,0 +1,9 @@
+from __future__ import unicode_literals
+
+from django import forms
+from django.utils.translation import ugettext_lazy as _
+
+
+class JabberBroadcastForm(forms.Form):
+    group = forms.ChoiceField(label=_('Group'), widget=forms.Select)
+    message = forms.CharField(label=_('Message'), widget=forms.Textarea)

services/modules/openfire/manager.py

@@ -1,7 +1,8 @@
 from __future__ import unicode_literals
 from django.utils import six
 import re
-import os
+import random
+import string
 try:
     from urlparse import urlparse
 except ImportError:
@@ -42,7 +43,7 @@ class OpenfireManager:
 
     @staticmethod
     def __generate_random_pass():
-        return os.urandom(8).encode('hex')
+        return ''.join([random.choice(string.ascii_letters + string.digits) for n in range(16)])
 
     @staticmethod
     def _sanitize_groupname(name):

services/modules/openfire/migrations/0001_initial.py

@@ -0,0 +1,26 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.10.2 on 2016-12-12 03:27
+from __future__ import unicode_literals
+
+from django.conf import settings
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        ('auth', '0008_alter_user_username_max_length'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='OpenfireUser',
+            fields=[
+                ('user', models.OneToOneField(on_delete=django.db.models.deletion.CASCADE, primary_key=True, related_name='openfire', serialize=False, to=settings.AUTH_USER_MODEL)),
+                ('username', models.CharField(max_length=254)),
+            ],
+        ),
+    ]

services/modules/openfire/models.py

@@ -0,0 +1,15 @@
+from __future__ import unicode_literals
+from django.utils.encoding import python_2_unicode_compatible
+from django.db import models
+
+
+@python_2_unicode_compatible
+class OpenfireUser(models.Model):
+    user = models.OneToOneField('auth.User',
+                                primary_key=True,
+                                on_delete=models.CASCADE,
+                                related_name='openfire')
+    username = models.CharField(max_length=254)
+
+    def __str__(self):
+        return self.username