fixing users, default admin can now be deleted. Last admin user cannot be deleted. If no admin user exists, on webui start, the default admin user will be created

Author: Nuo Yan

chef-server-api/lib/chef-server-api.rb

@@ -77,17 +77,6 @@ def self.activate
 
           Chef::Log.info('Loading roles')
           Chef::Role.sync_from_disk_to_couchdb
-          
-          # Create the default WebUI admin user "admin" if not already exists
-          begin
-            user = Chef::WebUIUser.load(Chef::Config[:web_ui_admin_user_name])
-          rescue Chef::Exceptions::CouchDBNotFound => e
-            user = Chef::WebUIUser.new
-            user.name = Chef::Config[:web_ui_admin_user_name]
-            user.set_password(Chef::Config[:web_ui_admin_default_password])
-            user.admin = true
-            user.save
-          end
 
           # Create the signing key and certificate 
           Chef::Certificate.generate_signing_ca

chef-server-webui/app/controllers/application.rb

@@ -89,6 +89,26 @@ def logout_and_redirect_to_login
     redirect(slice_url(:users_login), {:message => { :error => $! }, :permanent => true})
   end 
 
+  
+  def is_admin(name)
+    user = Chef::WebUIUser.load(name)
+    return user.admin
+  end 
+  
+  #return true if there is only one admin left, false otehrwise
+  def is_last_admin
+    count = 0
+    users = Chef::WebUIUser.list
+    users.each do |u|
+      user = Chef::WebUIUser.load(u)
+      if user.admin
+        count = count + 1
+        return false if count == 2
+      end
+    end
+    true
+  end
+  
   def authorized_node
   #  if session[:level] == :admin
   #    Chef::Log.debug("Authorized as Administrator")

chef-server-webui/app/controllers/users.rb

@@ -151,7 +151,7 @@ def logout
 
   def destroy
     begin
-      raise Forbidden, "The default admin user cannot be deleted" if params[:user_id] == Chef::Config[:web_ui_admin_user_name]
+      raise Forbidden, "The last admin user cannot be deleted" if (is_admin(params[:user_id]) && is_last_admin)
       raise Forbidden, "A non-admin user can only delete itself" if (params[:user_id] != session[:user] && session[:level] != :admin)
       @user = Chef::WebUIUser.load(params[:user_id])
       @user.destroy

chef-server-webui/lib/chef-server-webui.rb

@@ -132,11 +132,13 @@ def self.setup_router(scope)
     begin
       user = Chef::WebUIUser.load(Chef::Config[:web_ui_admin_user_name])
     rescue Chef::Exceptions::CouchDBNotFound => e
-      user = Chef::WebUIUser.new
-      user.name = Chef::Config[:web_ui_admin_user_name]
-      user.set_password(Chef::Config[:web_ui_admin_default_password])
-      user.admin = true
-      user.save
+      unless Chef::WebUIUser.admin_exist
+        user = Chef::WebUIUser.new
+        user.name = Chef::Config[:web_ui_admin_user_name]
+        user.set_password(Chef::Config[:web_ui_admin_default_password])
+        user.admin = true
+        user.save
+      end 
     end
 
   end

chef/lib/chef/webui_user.rb

@@ -152,6 +152,18 @@ def self.create_design_document
       Chef::CouchDB.new.create_design_document("users", DESIGN_DOCUMENT)
     end
 
+    #return true if an admin user exists. this is pretty expensive (O(n)), should think of a better way (nuo)
+    def self.admin_exist
+      users = self.list
+      users.each do |u|
+        user = self.load(u)
+        if user.admin
+          return user.name
+        end
+      end
+      nil
+    end
+    
     protected
 
       def generate_salt