Remove invalid VPN endpoints when the subnets change

coin/vpn/models.py

@@ -31,10 +31,13 @@ class VPNSubscription(CoinLdapSyncModel):
 
     # These two methods are part of the general configuration interface.
     def save_subnet(self, subnet, creation):
-        self.sync_to_ldap(False)
+        self.check_endpoints(delete=True)
+        # We potentially changed the endpoints, so we need to save.
+        self.full_clean()
+        self.save()
 
     def delete_subnet(self, subnet):
-        self.sync_to_ldap(False)
+        self.save_subnet(subnet, False)
 
     def get_subnets(self, version):
         subnets = self.administrative_subscription.ip_subnet.all()
@@ -85,15 +88,25 @@ class VPNSubscription(CoinLdapSyncModel):
                 updated = True
         return updated
 
-    def check_endpoints(self):
+    def check_endpoints(self, delete=False):
         """Check that the IP endpoints are included in one of the attributed IP
         subnets.
+
+        If [delete] is True, then simply delete the faulty endpoints
+        instead of raising an exception.
         """
         subnets = self.administrative_subscription.ip_subnet.all()
-        for endpoint in [self.ipv4_endpoint, self.ipv6_endpoint]:
-            if endpoint:
-                if not any([endpoint in subnet.inet for subnet in subnets]):
-                    raise ValidationError("Endpoint {} is not in an attributed range".format(endpoint))
+        is_faulty = lambda endpoint : endpoint and not any([endpoint in subnet.inet for subnet in subnets])
+        if is_faulty(self.ipv4_endpoint):
+            if delete:
+                self.ipv4_endpoint = None
+            else:
+                raise ValidationError("Endpoint {} is not in an attributed range".format(self.ipv4_endpoint))
+        if is_faulty(self.ipv6_endpoint):
+            if delete:
+                self.ipv6_endpoint = None
+            else:
+                raise ValidationError("Endpoint {} is not in an attributed range".format(self.ipv6_endpoint))
 
     def clean(self):
         # Hash password if needed