##// END OF EJS Templates
chore: fixed merge conflicts
chore: fixed merge conflicts

File last commit:

r5340:d43cbc34 default
r5546:50cf7822 merge v5.2.0 stable
Show More
auth.py
2538 lines | 94.6 KiB | text/x-python | PythonLexer
copyrights: updated for 2023
r5088 # Copyright (C) 2010-2023 RhodeCode GmbH
project: added all source files and assets
r1 #
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License, version 3
# (only), as published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
# This program is dual-licensed. If you wish to learn more about the
# RhodeCode Enterprise Edition, including its added features, Support services,
# and proprietary license terms, please see https://rhodecode.com/licenses/
"""
authentication and permission libraries
"""
auth: make the perms decorators and function pyramid compatible.
r1494 import os
core: added user-notice logic to push notice messages....
r4300
auth: update logging for permission calculation function
r2813 import time
project: added all source files and assets
r1 import collections
import fnmatch
import itertools
import logging
import random
import traceback
from functools import wraps
auth: auth code changes for python3
r5080 import bcrypt
project: added all source files and assets
r1 import ipaddress
pylons: remove pylons as dependency...
r2351
security: use 404 instead of 403 code on permission decorator to prevent resource discovery attacks.
r1817 from pyramid.httpexceptions import HTTPForbidden, HTTPFound, HTTPNotFound
project: added all source files and assets
r1 from sqlalchemy.orm.exc import ObjectDeletedError
from sqlalchemy.orm import joinedload
from zope.cachedescriptors.property import Lazy as LazyProperty
import rhodecode
from rhodecode.model import meta
from rhodecode.model.meta import Session
from rhodecode.model.user import UserModel
from rhodecode.model.db import (
core: added user-notice logic to push notice messages....
r4300 false, User, Repository, Permission, UserToPerm, UserGroupToPerm, UserGroupMember,
UserIpMap, UserApiKeys, RepoGroup, UserGroup, UserNotice)
caches: rewrite of auth/permission caches to dogpile.
r2845 from rhodecode.lib import rc_cache
project: added all source files and assets
r1 from rhodecode.lib.utils import (
get_repo_slug, get_repo_group_slug, get_user_group_slug)
auth: re-orginize imports use hashlib helpers
r4958 from rhodecode.lib.type_utils import aslist
from rhodecode.lib.hash_utils import sha1, sha256, md5
from rhodecode.lib.str_utils import ascii_bytes, safe_str, safe_int, safe_bytes
project: added all source files and assets
r1 from rhodecode.lib.caching_query import FromCache
auth: re-orginize imports use hashlib helpers
r4958
project: added all source files and assets
r1 log = logging.getLogger(__name__)
csrf_token_key = "csrf_token"
class PasswordGenerator(object):
"""
This is a simple class for generating password from different sets of
characters
usage::
passwd_gen = PasswordGenerator()
#print 8-letter password containing only big and small letters
of alphabet
passwd_gen.gen_password(8, passwd_gen.ALPHABETS_BIG_SMALL)
"""
ALPHABETS_NUM = r'''1234567890'''
ALPHABETS_SMALL = r'''qwertyuiopasdfghjklzxcvbnm'''
ALPHABETS_BIG = r'''QWERTYUIOPASDFGHJKLZXCVBNM'''
ALPHABETS_SPECIAL = r'''`-=[]\;',./~!@#$%^&*()_+{}|:"<>?'''
ALPHABETS_FULL = ALPHABETS_BIG + ALPHABETS_SMALL \
+ ALPHABETS_NUM + ALPHABETS_SPECIAL
ALPHABETS_ALPHANUM = ALPHABETS_BIG + ALPHABETS_SMALL + ALPHABETS_NUM
ALPHABETS_BIG_SMALL = ALPHABETS_BIG + ALPHABETS_SMALL
ALPHABETS_ALPHANUM_BIG = ALPHABETS_BIG + ALPHABETS_NUM
ALPHABETS_ALPHANUM_SMALL = ALPHABETS_SMALL + ALPHABETS_NUM
def __init__(self, passwd=''):
self.passwd = passwd
def gen_password(self, length, type_=None):
if type_ is None:
type_ = self.ALPHABETS_FULL
auth: code style, more python3 compat changes.
r2822 self.passwd = ''.join([random.choice(type_) for _ in range(length)])
project: added all source files and assets
r1 return self.passwd
class _RhodeCodeCryptoBase(object):
auth-tokens: updated logic of authentication to a common shared user method.
r1421 ENC_PREF = None
project: added all source files and assets
r1
def hash_create(self, str_):
"""
hash the string using
:param str_: password to hash
"""
raise NotImplementedError
auth: auth code changes for python3
r5080 def hash_check_with_upgrade(self, password: bytes, hashed: bytes):
project: added all source files and assets
r1 """
Returns tuple in which first element is boolean that states that
given password matches it's hashed version, and the second is new hash
of the password, in case this password should be migrated to new
cipher.
"""
auth: auth code changes for python3
r5080 self._assert_bytes(password)
project: added all source files and assets
r1 checked_hash = self.hash_check(password, hashed)
return checked_hash, None
def hash_check(self, password, hashed):
"""
Checks matching password with it's hashed value.
:param password: password
:param hashed: password in hashed form
"""
raise NotImplementedError
auth: auth code changes for python3
r5080 @classmethod
def _assert_bytes(cls, value):
project: added all source files and assets
r1 """
auth: auth code changes for python3
r5080 Passing in an `unicode` object can lead too hard to detect issues
project: added all source files and assets
r1 if passwords contain non-ascii characters. Doing a type check
during runtime, so that such mistakes are detected early on.
"""
auth: auth code changes for python3
r5080 if not isinstance(value, bytes):
raise TypeError(f"Bytestring required as input, got {type(value)}.")
project: added all source files and assets
r1
class _RhodeCodeCryptoBCrypt(_RhodeCodeCryptoBase):
auth: the correct prefixes for python bcrypt are $2a or $2b....
r1626 ENC_PREF = ('$2a$10', '$2b$10')
project: added all source files and assets
r1
def hash_create(self, str_):
self._assert_bytes(str_)
return bcrypt.hashpw(str_, bcrypt.gensalt(10))
auth: auth code changes for python3
r5080 def hash_check_with_upgrade(self, password: bytes, hashed: bytes):
project: added all source files and assets
r1 """
Returns tuple in which first element is boolean that states that
given password matches it's hashed version, and the second is new hash
of the password, in case this password should be migrated to new
cipher.
This implements special upgrade logic which works like that:
- check if the given password == bcrypted hash, if yes then we
properly used password and it was already in bcrypt. Proceed
without any changes
- if bcrypt hash check is not working try with sha256. If hash compare
is ok, it means we using correct but old hashed password. indicate
hash change and proceed
"""
auth: auth code changes for python3
r5080 self._assert_bytes(password)
project: added all source files and assets
r1 new_hash = None
# regular pw check
password_match_bcrypt = self.hash_check(password, hashed)
# now we want to know if the password was maybe from sha256
# basically calling _RhodeCodeCryptoSha256().hash_check()
if not password_match_bcrypt:
auth: auth code changes for python3
r5080 if _RhodeCodeCryptoSha256().hash_check(password, hashed): # match by OLD algo
new_hash = self.hash_create(password) # make new bcrypt hash, aka "migrate" hash
project: added all source files and assets
r1 password_match_bcrypt = True
return password_match_bcrypt, new_hash
auth: auth code changes for python3
r5080 def hash_check(self, password: bytes, hashed: bytes) -> bool:
project: added all source files and assets
r1 """
Checks matching password with it's hashed value.
:param password: password
:param hashed: password in hashed form
"""
self._assert_bytes(password)
try:
return bcrypt.hashpw(password, hashed) == hashed
except ValueError as e:
# we're having a invalid salt here probably, we should not crash
# just return with False as it would be a wrong password.
log.debug('Failed to check password hash using bcrypt %s',
safe_str(e))
return False
class _RhodeCodeCryptoSha256(_RhodeCodeCryptoBase):
auth: auth code changes for python3
r5080 """
Legacy CryptoBackend used in OLD versions on Windows. Now it's just here to
Migrate passwords to new backend bcrypt
"""
auth-tokens: updated logic of authentication to a common shared user method.
r1421 ENC_PREF = '_'
project: added all source files and assets
r1
def hash_create(self, str_):
self._assert_bytes(str_)
auth: re-orginize imports use hashlib helpers
r4958 return sha256(str_)
project: added all source files and assets
r1
auth: auth code changes for python3
r5080 def hash_check(self, password: bytes, hashed: bytes) -> bool:
project: added all source files and assets
r1 """
Checks matching password with it's hashed value.
:param password: password
:param hashed: password in hashed form
"""
self._assert_bytes(password)
auth: re-orginize imports use hashlib helpers
r4958 return sha256(password) == hashed
project: added all source files and assets
r1
tests: don't use md5 for testing crypto for compliance reasons.
r2836 class _RhodeCodeCryptoTest(_RhodeCodeCryptoBase):
auth-tokens: updated logic of authentication to a common shared user method.
r1421 ENC_PREF = '_'
project: added all source files and assets
r1
def hash_create(self, str_):
self._assert_bytes(str_)
tests: don't use md5 for testing crypto for compliance reasons.
r2836 return sha1(str_)
project: added all source files and assets
r1
auth: auth code changes for python3
r5080 def hash_check(self, password: bytes, hashed: bytes) -> bool:
project: added all source files and assets
r1 """
Checks matching password with it's hashed value.
:param password: password
:param hashed: password in hashed form
"""
self._assert_bytes(password)
tests: don't use md5 for testing crypto for compliance reasons.
r2836 return sha1(password) == hashed
project: added all source files and assets
r1
def crypto_backend():
"""
Return the matching crypto backend.
tests: don't use md5 for testing crypto for compliance reasons.
r2836 Selection is based on if we run tests or not, we pick sha1-test backend to run
project: added all source files and assets
r1 tests faster since BCRYPT is expensive to calculate
"""
if rhodecode.is_test:
tests: don't use md5 for testing crypto for compliance reasons.
r2836 RhodeCodeCrypto = _RhodeCodeCryptoTest()
project: added all source files and assets
r1 else:
RhodeCodeCrypto = _RhodeCodeCryptoBCrypt()
return RhodeCodeCrypto
def get_crypt_password(password):
"""
Create the hash of `password` with the active crypto backend.
:param password: The cleartext password.
"""
auth: auth code changes for python3
r5080 return crypto_backend().hash_create(safe_bytes(password))
project: added all source files and assets
r1
def check_password(password, hashed):
"""
Check if the value in `password` matches the hash in `hashed`.
:param password: The cleartext password.
:type password: unicode
:param hashed: The expected hashed version of the password.
:type hashed: The hash has to be passed in in text representation.
"""
auth: auth code changes for python3
r5080 password = safe_bytes(password)
project: added all source files and assets
r1 return crypto_backend().hash_check(password, hashed)
def generate_auth_token(data, salt=None):
"""
Generates API KEY from given string
"""
if salt is None:
salt = os.urandom(16)
auth: auth code changes for python3
r5080 token = safe_bytes(data) + safe_bytes(salt)
return sha1(token)
project: added all source files and assets
r1
auth: use consistent way of extracting came_from, and also sanitise it to remove...
r2074 def get_came_from(request):
"""
get query_string+path from request sanitized after removing auth_token
"""
_req = request
path = _req.path
if 'auth_token' in _req.GET:
# sanitize the request and remove auth_token for redirection
_req.GET.pop('auth_token')
qs = _req.query_string
if qs:
path += '?' + qs
return path
project: added all source files and assets
r1 class CookieStoreWrapper(object):
def __init__(self, cookie_store):
self.cookie_store = cookie_store
def __repr__(self):
auth: auth code changes for python3
r5080 return f'CookieStore<{self.cookie_store}>'
project: added all source files and assets
r1
def get(self, key, other=None):
if isinstance(self.cookie_store, dict):
return self.cookie_store.get(key, other)
elif isinstance(self.cookie_store, AuthUser):
return self.cookie_store.__dict__.get(key, other)
def _cached_perms_data(user_id, scope, user_is_admin,
auth: expose a option to calculate how we end up having super-admin permission....
r2065 user_inherit_default_permissions, explicit, algo,
calculate_super_admin):
project: added all source files and assets
r1
permissions = PermissionCalculator(
user_id, scope, user_is_admin, user_inherit_default_permissions,
auth: expose a option to calculate how we end up having super-admin permission....
r2065 explicit, algo, calculate_super_admin)
project: added all source files and assets
r1 return permissions.calculate()
auth: prepare code for removal of pylons request in pyramid migration.
r1791
class PermOrigin(object):
auth: expose a option to calculate how we end up having super-admin permission....
r2065 SUPER_ADMIN = 'superadmin'
repositories: added option to archive repositories instead of deleting them....
r3090 ARCHIVED = 'archived'
dan
permissions: show overridden permissions in permission summary page
r100
REPO_USER = 'user:%s'
REPO_USERGROUP = 'usergroup:%s'
REPO_OWNER = 'repo.owner'
REPO_DEFAULT = 'repo.default'
permissions: explicitly register all permissions set for user. Fixes #4217...
r2063 REPO_DEFAULT_NO_INHERIT = 'repo.default.no.inherit'
dan
permissions: show overridden permissions in permission summary page
r100 REPO_PRIVATE = 'repo.private'
REPOGROUP_USER = 'user:%s'
REPOGROUP_USERGROUP = 'usergroup:%s'
REPOGROUP_OWNER = 'group.owner'
REPOGROUP_DEFAULT = 'group.default'
permissions: explicitly register all permissions set for user. Fixes #4217...
r2063 REPOGROUP_DEFAULT_NO_INHERIT = 'group.default.no.inherit'
dan
permissions: show overridden permissions in permission summary page
r100
USERGROUP_USER = 'user:%s'
USERGROUP_USERGROUP = 'usergroup:%s'
USERGROUP_OWNER = 'usergroup.owner'
USERGROUP_DEFAULT = 'usergroup.default'
permissions: explicitly register all permissions set for user. Fixes #4217...
r2063 USERGROUP_DEFAULT_NO_INHERIT = 'usergroup.default.no.inherit'
dan
permissions: show overridden permissions in permission summary page
r100
class PermOriginDict(dict):
"""
A special dict used for tracking permissions along with their origins.
`__setitem__` has been overridden to expect a tuple(perm, origin)
`__getitem__` will return only the perm
`.perm_origin_stack` will return the stack of (perm, origin) set per key
>>> perms = PermOriginDict()
admin: made all grids use same partial loading logic...
r4146 >>> perms['resource'] = 'read', 'default', 1
dan
permissions: show overridden permissions in permission summary page
r100 >>> perms['resource']
'read'
admin: made all grids use same partial loading logic...
r4146 >>> perms['resource'] = 'write', 'admin', 2
dan
permissions: show overridden permissions in permission summary page
r100 >>> perms['resource']
'write'
>>> perms.perm_origin_stack
admin: made all grids use same partial loading logic...
r4146 {'resource': [('read', 'default', 1), ('write', 'admin', 2)]}
dan
permissions: show overridden permissions in permission summary page
r100 """
def __init__(self, *args, **kw):
dict.__init__(self, *args, **kw)
permissions: explicitly register all permissions set for user. Fixes #4217...
r2063 self.perm_origin_stack = collections.OrderedDict()
dan
permissions: show overridden permissions in permission summary page
r100
auth: python3 compatability code for migration
r4788 def __setitem__(self, key, perm_origin_obj_id):
auth-lib: fixed and tested perms origin dicts....
r4943 # set (most likely via pickle) key:val pair without tuple
if not isinstance(perm_origin_obj_id, tuple):
perm = perm_origin_obj_id
dict.__setitem__(self, key, perm)
else:
# unpack if we create a key from tuple
(perm, origin, obj_id) = perm_origin_obj_id
self.perm_origin_stack.setdefault(key, []).append((perm, origin, obj_id))
dict.__setitem__(self, key, perm)
class BranchPermOriginDict(dict):
branch permissions: added logic to define in UI branch permissions....
r2975 """
Dedicated branch permissions dict, with tracking of patterns and origins.
>>> perms = BranchPermOriginDict()
>>> perms['resource'] = '*pattern', 'read', 'default'
>>> perms['resource']
{'*pattern': 'read'}
>>> perms['resource'] = '*pattern', 'write', 'admin'
>>> perms['resource']
{'*pattern': 'write'}
>>> perms.perm_origin_stack
{'resource': {'*pattern': [('read', 'default'), ('write', 'admin')]}}
"""
auth-lib: fixed and tested perms origin dicts....
r4943 def __init__(self, *args, **kw):
dict.__init__(self, *args, **kw)
self.perm_origin_stack = collections.OrderedDict()
auth: python3 compatability code for migration
r4788 def __setitem__(self, key, pattern_perm_origin):
auth-lib: fixed and tested perms origin dicts....
r4943 # set (most likely via pickle) key:val pair without tuple
if not isinstance(pattern_perm_origin, tuple):
pattern_perm = pattern_perm_origin
dict.__setitem__(self, key, pattern_perm)
branch permissions: added logic to define in UI branch permissions....
r2975 else:
auth-lib: fixed and tested perms origin dicts....
r4943 (pattern_perm, origin) = pattern_perm_origin
# we're passing in the dict, so we save the the stack
auth: auth code changes for python3
r5080 for pattern, perm in list(pattern_perm.items()):
auth-lib: fixed and tested perms origin dicts....
r4943 self.perm_origin_stack.setdefault(key, {})\
.setdefault(pattern, []).append((perm, origin))
dict.__setitem__(self, key, pattern_perm)
branch permissions: added logic to define in UI branch permissions....
r2975
project: added all source files and assets
r1 class PermissionCalculator(object):
def __init__(
self, user_id, scope, user_is_admin,
auth: expose a option to calculate how we end up having super-admin permission....
r2065 user_inherit_default_permissions, explicit, algo,
branch-permissions: handle vcs operations and branch permissions....
r2979 calculate_super_admin_as_user=False):
auth: expose a option to calculate how we end up having super-admin permission....
r2065
project: added all source files and assets
r1 self.user_id = user_id
self.user_is_admin = user_is_admin
self.inherit_default_permissions = user_inherit_default_permissions
self.explicit = explicit
self.algo = algo
branch-permissions: handle vcs operations and branch permissions....
r2979 self.calculate_super_admin_as_user = calculate_super_admin_as_user
project: added all source files and assets
r1
scope = scope or {}
self.scope_repo_id = scope.get('repo_id')
self.scope_repo_group_id = scope.get('repo_group_id')
self.scope_user_group_id = scope.get('user_group_id')
self.default_user_id = User.get_default_user(cache=True).user_id
dan
permissions: show overridden permissions in permission summary page
r100 self.permissions_repositories = PermOriginDict()
self.permissions_repository_groups = PermOriginDict()
self.permissions_user_groups = PermOriginDict()
branch permissions: added logic to define in UI branch permissions....
r2975 self.permissions_repository_branches = BranchPermOriginDict()
project: added all source files and assets
r1 self.permissions_global = set()
self.default_repo_perms = Permission.get_default_repo_perms(
self.default_user_id, self.scope_repo_id)
self.default_repo_groups_perms = Permission.get_default_group_perms(
self.default_user_id, self.scope_repo_group_id)
self.default_user_group_perms = \
Permission.get_default_user_group_perms(
self.default_user_id, self.scope_user_group_id)
branch permissions: added logic to define in UI branch permissions....
r2975 # default branch perms
self.default_branch_repo_perms = \
Permission.get_default_repo_branch_perms(
self.default_user_id, self.scope_repo_id)
project: added all source files and assets
r1 def calculate(self):
branch-permissions: handle vcs operations and branch permissions....
r2979 if self.user_is_admin and not self.calculate_super_admin_as_user:
permissions: fixed a case when a duplicate permission was making archive operation still display settings.
r4414 return self._calculate_super_admin_permissions()
project: added all source files and assets
r1
self._calculate_global_default_permissions()
self._calculate_global_permissions()
self._calculate_default_permissions()
self._calculate_repository_permissions()
branch permissions: added logic to define in UI branch permissions....
r2975 self._calculate_repository_branch_permissions()
project: added all source files and assets
r1 self._calculate_repository_group_permissions()
self._calculate_user_group_permissions()
return self._permission_structure()
permissions: fixed a case when a duplicate permission was making archive operation still display settings.
r4414 def _calculate_super_admin_permissions(self):
project: added all source files and assets
r1 """
permissions: fixed a case when a duplicate permission was making archive operation still display settings.
r4414 super-admin user have all default rights for repositories
project: added all source files and assets
r1 and groups set to admin
"""
self.permissions_global.add('hg.admin')
self.permissions_global.add('hg.create.write_on_repogroup.true')
# repositories
for perm in self.default_repo_perms:
r_k = perm.UserRepoToPerm.repository.repo_name
admin: made all grids use same partial loading logic...
r4146 obj_id = perm.UserRepoToPerm.repository.repo_id
repositories: added option to archive repositories instead of deleting them....
r3090 archived = perm.UserRepoToPerm.repository.archived
project: added all source files and assets
r1 p = 'repository.admin'
admin: made all grids use same partial loading logic...
r4146 self.permissions_repositories[r_k] = p, PermOrigin.SUPER_ADMIN, obj_id
repositories: added option to archive repositories instead of deleting them....
r3090 # special case for archived repositories, which we block still even for
# super admins
if archived:
p = 'repository.read'
admin: made all grids use same partial loading logic...
r4146 self.permissions_repositories[r_k] = p, PermOrigin.ARCHIVED, obj_id
project: added all source files and assets
r1
# repository groups
for perm in self.default_repo_groups_perms:
rg_k = perm.UserRepoGroupToPerm.group.group_name
admin: made all grids use same partial loading logic...
r4146 obj_id = perm.UserRepoGroupToPerm.group.group_id
project: added all source files and assets
r1 p = 'group.admin'
admin: made all grids use same partial loading logic...
r4146 self.permissions_repository_groups[rg_k] = p, PermOrigin.SUPER_ADMIN, obj_id
project: added all source files and assets
r1
# user groups
for perm in self.default_user_group_perms:
u_k = perm.UserUserGroupToPerm.user_group.users_group_name
admin: made all grids use same partial loading logic...
r4146 obj_id = perm.UserUserGroupToPerm.user_group.users_group_id
project: added all source files and assets
r1 p = 'usergroup.admin'
admin: made all grids use same partial loading logic...
r4146 self.permissions_user_groups[u_k] = p, PermOrigin.SUPER_ADMIN, obj_id
project: added all source files and assets
r1
branch permissions: added logic to define in UI branch permissions....
r2975 # branch permissions
branch-permissions: handle vcs operations and branch permissions....
r2979 # since super-admin also can have custom rule permissions
# we *always* need to calculate those inherited from default, and also explicit
self._calculate_default_permissions_repository_branches(
user_inherit_object_permissions=False)
self._calculate_repository_branch_permissions()
branch permissions: added logic to define in UI branch permissions....
r2975
project: added all source files and assets
r1 return self._permission_structure()
def _calculate_global_default_permissions(self):
"""
global permissions taken from the default user
"""
default_global_perms = UserToPerm.query()\
.filter(UserToPerm.user_id == self.default_user_id)\
.options(joinedload(UserToPerm.permission))
for perm in default_global_perms:
self.permissions_global.add(perm.permission.permission_name)
auth: expose a option to calculate how we end up having super-admin permission....
r2065 if self.user_is_admin:
self.permissions_global.add('hg.admin')
self.permissions_global.add('hg.create.write_on_repogroup.true')
project: added all source files and assets
r1 def _calculate_global_permissions(self):
"""
Set global system permissions with user permissions or permissions
taken from the user groups of the current user.
The permissions include repo creating, repo group creating, forking
etc.
"""
# now we read the defined permissions and overwrite what we have set
# before those can be configured from groups or users explicitly.
branch permissions: added logic to define in UI branch permissions....
r2975 # In case we want to extend this list we should make sure
# this is in sync with User.DEFAULT_USER_PERMISSIONS definitions
permissions: use constant for fork enable/disable
r4663 from rhodecode.model.permission import PermissionModel
project: added all source files and assets
r1 _configurable = frozenset([
permissions: use constant for fork enable/disable
r4663 PermissionModel.FORKING_DISABLED, PermissionModel.FORKING_ENABLED,
project: added all source files and assets
r1 'hg.create.none', 'hg.create.repository',
'hg.usergroup.create.false', 'hg.usergroup.create.true',
'hg.repogroup.create.false', 'hg.repogroup.create.true',
branch permissions: added logic to define in UI branch permissions....
r2975 'hg.create.write_on_repogroup.false', 'hg.create.write_on_repogroup.true',
project: added all source files and assets
r1 'hg.inherit_default_perms.false', 'hg.inherit_default_perms.true'
])
# USER GROUPS comes first user group global permissions
user_perms_from_users_groups = Session().query(UserGroupToPerm)\
.options(joinedload(UserGroupToPerm.permission))\
.join((UserGroupMember, UserGroupToPerm.users_group_id ==
UserGroupMember.users_group_id))\
.filter(UserGroupMember.user_id == self.user_id)\
.order_by(UserGroupToPerm.users_group_id)\
.all()
# need to group here by groups since user can be in more than
# one group, so we get all groups
_explicit_grouped_perms = [
[x, list(y)] for x, y in
itertools.groupby(user_perms_from_users_groups,
lambda _x: _x.users_group)]
for gr, perms in _explicit_grouped_perms:
# since user can be in multiple groups iterate over them and
# select the lowest permissions first (more explicit)
branch permissions: added logic to define in UI branch permissions....
r2975 # TODO(marcink): do this^^
project: added all source files and assets
r1
# group doesn't inherit default permissions so we actually set them
if not gr.inherit_default_permissions:
# NEED TO IGNORE all previously set configurable permissions
# and replace them with explicitly set from this user
# group permissions
self.permissions_global = self.permissions_global.difference(
_configurable)
for perm in perms:
dan
permissions: show overridden permissions in permission summary page
r100 self.permissions_global.add(perm.permission.permission_name)
project: added all source files and assets
r1
# user explicit global permissions
user_perms = Session().query(UserToPerm)\
.options(joinedload(UserToPerm.permission))\
.filter(UserToPerm.user_id == self.user_id).all()
if not self.inherit_default_permissions:
# NEED TO IGNORE all configurable permissions and
# replace them with explicitly set from this user permissions
self.permissions_global = self.permissions_global.difference(
_configurable)
for perm in user_perms:
self.permissions_global.add(perm.permission.permission_name)
branch-permissions: handle vcs operations and branch permissions....
r2979 def _calculate_default_permissions_repositories(self, user_inherit_object_permissions):
project: added all source files and assets
r1 for perm in self.default_repo_perms:
r_k = perm.UserRepoToPerm.repository.repo_name
admin: made all grids use same partial loading logic...
r4146 obj_id = perm.UserRepoToPerm.repository.repo_id
repositories: added option to archive repositories instead of deleting them....
r3090 archived = perm.UserRepoToPerm.repository.archived
permissions: explicitly register all permissions set for user. Fixes #4217...
r2063 p = perm.Permission.permission_name
dan
permissions: show overridden permissions in permission summary page
r100 o = PermOrigin.REPO_DEFAULT
admin: made all grids use same partial loading logic...
r4146 self.permissions_repositories[r_k] = p, o, obj_id
permissions: explicitly register all permissions set for user. Fixes #4217...
r2063
# if we decide this user isn't inheriting permissions from
# default user we set him to .none so only explicit
# permissions work
if not user_inherit_object_permissions:
p = 'repository.none'
o = PermOrigin.REPO_DEFAULT_NO_INHERIT
admin: made all grids use same partial loading logic...
r4146 self.permissions_repositories[r_k] = p, o, obj_id
permissions: explicitly register all permissions set for user. Fixes #4217...
r2063
project: added all source files and assets
r1 if perm.Repository.private and not (
perm.Repository.user_id == self.user_id):
# disable defaults for private repos,
p = 'repository.none'
dan
permissions: show overridden permissions in permission summary page
r100 o = PermOrigin.REPO_PRIVATE
admin: made all grids use same partial loading logic...
r4146 self.permissions_repositories[r_k] = p, o, obj_id
permissions: explicitly register all permissions set for user. Fixes #4217...
r2063
project: added all source files and assets
r1 elif perm.Repository.user_id == self.user_id:
# set admin if owner
p = 'repository.admin'
dan
permissions: show overridden permissions in permission summary page
r100 o = PermOrigin.REPO_OWNER
admin: made all grids use same partial loading logic...
r4146 self.permissions_repositories[r_k] = p, o, obj_id
project: added all source files and assets
r1
auth: expose a option to calculate how we end up having super-admin permission....
r2065 if self.user_is_admin:
p = 'repository.admin'
o = PermOrigin.SUPER_ADMIN
admin: made all grids use same partial loading logic...
r4146 self.permissions_repositories[r_k] = p, o, obj_id
project: added all source files and assets
r1
repositories: added option to archive repositories instead of deleting them....
r3090 # finally in case of archived repositories, we downgrade higher
# permissions to read
if archived:
current_perm = self.permissions_repositories[r_k]
if current_perm in ['repository.write', 'repository.admin']:
p = 'repository.read'
o = PermOrigin.ARCHIVED
admin: made all grids use same partial loading logic...
r4146 self.permissions_repositories[r_k] = p, o, obj_id
repositories: added option to archive repositories instead of deleting them....
r3090
branch-permissions: handle vcs operations and branch permissions....
r2979 def _calculate_default_permissions_repository_branches(self, user_inherit_object_permissions):
branch permissions: added logic to define in UI branch permissions....
r2975 for perm in self.default_branch_repo_perms:
r_k = perm.UserRepoToPerm.repository.repo_name
p = perm.Permission.permission_name
pattern = perm.UserToRepoBranchPermission.branch_pattern
o = PermOrigin.REPO_USER % perm.UserRepoToPerm.user.username
if not self.explicit:
dan
branch permissions: fixed a case of showing branch permissions entries when inheritation model is used....
r3154 cur_perm = self.permissions_repository_branches.get(r_k)
if cur_perm:
cur_perm = cur_perm[pattern]
cur_perm = cur_perm or 'branch.none'
branch permissions: added logic to define in UI branch permissions....
r2975 p = self._choose_permission(p, cur_perm)
# NOTE(marcink): register all pattern/perm instances in this
# special dict that aggregates entries
auth-lib: fixed and tested perms origin dicts....
r4943 self.permissions_repository_branches[r_k] = {pattern: p}, o
branch permissions: added logic to define in UI branch permissions....
r2975
branch-permissions: handle vcs operations and branch permissions....
r2979 def _calculate_default_permissions_repository_groups(self, user_inherit_object_permissions):
project: added all source files and assets
r1 for perm in self.default_repo_groups_perms:
rg_k = perm.UserRepoGroupToPerm.group.group_name
admin: made all grids use same partial loading logic...
r4146 obj_id = perm.UserRepoGroupToPerm.group.group_id
permissions: explicitly register all permissions set for user. Fixes #4217...
r2063 p = perm.Permission.permission_name
dan
permissions: show overridden permissions in permission summary page
r100 o = PermOrigin.REPOGROUP_DEFAULT
admin: made all grids use same partial loading logic...
r4146 self.permissions_repository_groups[rg_k] = p, o, obj_id
project: added all source files and assets
r1
# if we decide this user isn't inheriting permissions from default
# user we set him to .none so only explicit permissions work
if not user_inherit_object_permissions:
p = 'group.none'
permissions: explicitly register all permissions set for user. Fixes #4217...
r2063 o = PermOrigin.REPOGROUP_DEFAULT_NO_INHERIT
admin: made all grids use same partial loading logic...
r4146 self.permissions_repository_groups[rg_k] = p, o, obj_id
permissions: explicitly register all permissions set for user. Fixes #4217...
r2063
if perm.RepoGroup.user_id == self.user_id:
# set admin if owner
p = 'group.admin'
o = PermOrigin.REPOGROUP_OWNER
admin: made all grids use same partial loading logic...
r4146 self.permissions_repository_groups[rg_k] = p, o, obj_id
project: added all source files and assets
r1
auth: expose a option to calculate how we end up having super-admin permission....
r2065 if self.user_is_admin:
p = 'group.admin'
o = PermOrigin.SUPER_ADMIN
admin: made all grids use same partial loading logic...
r4146 self.permissions_repository_groups[rg_k] = p, o, obj_id
project: added all source files and assets
r1
branch-permissions: handle vcs operations and branch permissions....
r2979 def _calculate_default_permissions_user_groups(self, user_inherit_object_permissions):
project: added all source files and assets
r1 for perm in self.default_user_group_perms:
u_k = perm.UserUserGroupToPerm.user_group.users_group_name
admin: made all grids use same partial loading logic...
r4146 obj_id = perm.UserUserGroupToPerm.user_group.users_group_id
permissions: explicitly register all permissions set for user. Fixes #4217...
r2063 p = perm.Permission.permission_name
dan
permissions: show overridden permissions in permission summary page
r100 o = PermOrigin.USERGROUP_DEFAULT
admin: made all grids use same partial loading logic...
r4146 self.permissions_user_groups[u_k] = p, o, obj_id
auth: make owner of user group give proper admin permissions to the user group....
r1443
project: added all source files and assets
r1 # if we decide this user isn't inheriting permissions from default
# user we set him to .none so only explicit permissions work
if not user_inherit_object_permissions:
p = 'usergroup.none'
permissions: explicitly register all permissions set for user. Fixes #4217...
r2063 o = PermOrigin.USERGROUP_DEFAULT_NO_INHERIT
admin: made all grids use same partial loading logic...
r4146 self.permissions_user_groups[u_k] = p, o, obj_id
permissions: explicitly register all permissions set for user. Fixes #4217...
r2063
if perm.UserGroup.user_id == self.user_id:
# set admin if owner
p = 'usergroup.admin'
o = PermOrigin.USERGROUP_OWNER
admin: made all grids use same partial loading logic...
r4146 self.permissions_user_groups[u_k] = p, o, obj_id
project: added all source files and assets
r1
auth: expose a option to calculate how we end up having super-admin permission....
r2065 if self.user_is_admin:
p = 'usergroup.admin'
o = PermOrigin.SUPER_ADMIN
admin: made all grids use same partial loading logic...
r4146 self.permissions_user_groups[u_k] = p, o, obj_id
project: added all source files and assets
r1
branch-permissions: handle vcs operations and branch permissions....
r2979 def _calculate_default_permissions(self):
"""
Set default user permissions for repositories, repository branches,
repository groups, user groups taken from the default user.
Calculate inheritance of object permissions based on what we have now
in GLOBAL permissions. We check if .false is in GLOBAL since this is
explicitly set. Inherit is the opposite of .false being there.
.. note::
the syntax is little bit odd but what we need to check here is
the opposite of .false permission being in the list so even for
inconsistent state when both .true/.false is there
.false is more important
"""
auth: auth code changes for python3
r5080 user_inherit_object_permissions = (
'hg.inherit_default_perms.false' not in self.permissions_global)
branch-permissions: handle vcs operations and branch permissions....
r2979
# default permissions inherited from `default` user permissions
self._calculate_default_permissions_repositories(
user_inherit_object_permissions)
self._calculate_default_permissions_repository_branches(
user_inherit_object_permissions)
self._calculate_default_permissions_repository_groups(
user_inherit_object_permissions)
self._calculate_default_permissions_user_groups(
user_inherit_object_permissions)
project: added all source files and assets
r1 def _calculate_repository_permissions(self):
"""
permissions: rename repository permissions to mention those are access permissions....
r3985 Repository access permissions for the current user.
project: added all source files and assets
r1
Check if the user is part of user groups for this repository and
fill in the permission from it. `_choose_permission` decides of which
permission should be selected based on selected method.
"""
# user group for repositories permissions
user_repo_perms_from_user_group = Permission\
.get_default_repo_perms_from_user_group(
self.user_id, self.scope_repo_id)
multiple_counter = collections.defaultdict(int)
for perm in user_repo_perms_from_user_group:
r_k = perm.UserGroupRepoToPerm.repository.repo_name
admin: made all grids use same partial loading logic...
r4146 obj_id = perm.UserGroupRepoToPerm.repository.repo_id
project: added all source files and assets
r1 multiple_counter[r_k] += 1
p = perm.Permission.permission_name
auth: use pesistent naming of keys in auth. Refactoring only.
r2064 o = PermOrigin.REPO_USERGROUP % perm.UserGroupRepoToPerm\
.users_group.users_group_name
permissions: explicitly register all permissions set for user. Fixes #4217...
r2063
if multiple_counter[r_k] > 1:
cur_perm = self.permissions_repositories[r_k]
p = self._choose_permission(p, cur_perm)
admin: made all grids use same partial loading logic...
r4146 self.permissions_repositories[r_k] = p, o, obj_id
project: added all source files and assets
r1
if perm.Repository.user_id == self.user_id:
# set admin if owner
p = 'repository.admin'
dan
permissions: show overridden permissions in permission summary page
r100 o = PermOrigin.REPO_OWNER
admin: made all grids use same partial loading logic...
r4146 self.permissions_repositories[r_k] = p, o, obj_id
project: added all source files and assets
r1
auth: expose a option to calculate how we end up having super-admin permission....
r2065 if self.user_is_admin:
p = 'repository.admin'
o = PermOrigin.SUPER_ADMIN
admin: made all grids use same partial loading logic...
r4146 self.permissions_repositories[r_k] = p, o, obj_id
project: added all source files and assets
r1
# user explicit permissions for repositories, overrides any specified
# by the group permission
user_repo_perms = Permission.get_default_repo_perms(
self.user_id, self.scope_repo_id)
for perm in user_repo_perms:
r_k = perm.UserRepoToPerm.repository.repo_name
admin: made all grids use same partial loading logic...
r4146 obj_id = perm.UserRepoToPerm.repository.repo_id
permissions: fixed a case when a duplicate permission was making archive operation still display settings.
r4414 archived = perm.UserRepoToPerm.repository.archived
permissions: explicitly register all permissions set for user. Fixes #4217...
r2063 p = perm.Permission.permission_name
dan
permissions: show overridden permissions in permission summary page
r100 o = PermOrigin.REPO_USER % perm.UserRepoToPerm.user.username
permissions: explicitly register all permissions set for user. Fixes #4217...
r2063
if not self.explicit:
cur_perm = self.permissions_repositories.get(
r_k, 'repository.none')
p = self._choose_permission(p, cur_perm)
admin: made all grids use same partial loading logic...
r4146 self.permissions_repositories[r_k] = p, o, obj_id
permissions: explicitly register all permissions set for user. Fixes #4217...
r2063
project: added all source files and assets
r1 if perm.Repository.user_id == self.user_id:
permissions: explicitly register all permissions set for user. Fixes #4217...
r2063 # set admin if owner
project: added all source files and assets
r1 p = 'repository.admin'
dan
permissions: show overridden permissions in permission summary page
r100 o = PermOrigin.REPO_OWNER
admin: made all grids use same partial loading logic...
r4146 self.permissions_repositories[r_k] = p, o, obj_id
project: added all source files and assets
r1
auth: expose a option to calculate how we end up having super-admin permission....
r2065 if self.user_is_admin:
p = 'repository.admin'
o = PermOrigin.SUPER_ADMIN
admin: made all grids use same partial loading logic...
r4146 self.permissions_repositories[r_k] = p, o, obj_id
project: added all source files and assets
r1
permissions: fixed a case when a duplicate permission was making archive operation still display settings.
r4414 # finally in case of archived repositories, we downgrade higher
# permissions to read
if archived:
current_perm = self.permissions_repositories[r_k]
if current_perm in ['repository.write', 'repository.admin']:
p = 'repository.read'
o = PermOrigin.ARCHIVED
self.permissions_repositories[r_k] = p, o, obj_id
branch permissions: added logic to define in UI branch permissions....
r2975 def _calculate_repository_branch_permissions(self):
# user group for repositories permissions
user_repo_branch_perms_from_user_group = Permission\
.get_default_repo_branch_perms_from_user_group(
self.user_id, self.scope_repo_id)
multiple_counter = collections.defaultdict(int)
for perm in user_repo_branch_perms_from_user_group:
r_k = perm.UserGroupRepoToPerm.repository.repo_name
p = perm.Permission.permission_name
pattern = perm.UserGroupToRepoBranchPermission.branch_pattern
o = PermOrigin.REPO_USERGROUP % perm.UserGroupRepoToPerm\
.users_group.users_group_name
multiple_counter[r_k] += 1
if multiple_counter[r_k] > 1:
dan
branch permissions: fixed a case of showing branch permissions entries when inheritation model is used....
r3154 cur_perm = self.permissions_repository_branches[r_k][pattern]
branch permissions: added logic to define in UI branch permissions....
r2975 p = self._choose_permission(p, cur_perm)
auth-lib: fixed and tested perms origin dicts....
r4943 self.permissions_repository_branches[r_k] = {pattern: p}, o
branch permissions: added logic to define in UI branch permissions....
r2975
# user explicit branch permissions for repositories, overrides
# any specified by the group permission
user_repo_branch_perms = Permission.get_default_repo_branch_perms(
self.user_id, self.scope_repo_id)
branch-permissions: handle vcs operations and branch permissions....
r2979
branch permissions: added logic to define in UI branch permissions....
r2975 for perm in user_repo_branch_perms:
r_k = perm.UserRepoToPerm.repository.repo_name
p = perm.Permission.permission_name
pattern = perm.UserToRepoBranchPermission.branch_pattern
o = PermOrigin.REPO_USER % perm.UserRepoToPerm.user.username
if not self.explicit:
dan
branch permissions: fixed a case of showing branch permissions entries when inheritation model is used....
r3154 cur_perm = self.permissions_repository_branches.get(r_k)
if cur_perm:
cur_perm = cur_perm[pattern]
cur_perm = cur_perm or 'branch.none'
branch permissions: added logic to define in UI branch permissions....
r2975 p = self._choose_permission(p, cur_perm)
# NOTE(marcink): register all pattern/perm instances in this
# special dict that aggregates entries
auth-lib: fixed and tested perms origin dicts....
r4943 self.permissions_repository_branches[r_k] = {pattern: p}, o
branch permissions: added logic to define in UI branch permissions....
r2975
project: added all source files and assets
r1 def _calculate_repository_group_permissions(self):
"""
Repository group permissions for the current user.
Check if the user is part of user groups for repository groups and
permissions: explicitly register all permissions set for user. Fixes #4217...
r2063 fill in the permissions from it. `_choose_permission` decides of which
project: added all source files and assets
r1 permission should be selected based on selected method.
"""
# user group for repo groups permissions
user_repo_group_perms_from_user_group = Permission\
.get_default_group_perms_from_user_group(
self.user_id, self.scope_repo_group_id)
multiple_counter = collections.defaultdict(int)
for perm in user_repo_group_perms_from_user_group:
auth: use pesistent naming of keys in auth. Refactoring only.
r2064 rg_k = perm.UserGroupRepoGroupToPerm.group.group_name
admin: made all grids use same partial loading logic...
r4146 obj_id = perm.UserGroupRepoGroupToPerm.group.group_id
auth: use pesistent naming of keys in auth. Refactoring only.
r2064 multiple_counter[rg_k] += 1
o = PermOrigin.REPOGROUP_USERGROUP % perm.UserGroupRepoGroupToPerm\
.users_group.users_group_name
project: added all source files and assets
r1 p = perm.Permission.permission_name
permissions: explicitly register all permissions set for user. Fixes #4217...
r2063
auth: use pesistent naming of keys in auth. Refactoring only.
r2064 if multiple_counter[rg_k] > 1:
cur_perm = self.permissions_repository_groups[rg_k]
permissions: explicitly register all permissions set for user. Fixes #4217...
r2063 p = self._choose_permission(p, cur_perm)
admin: made all grids use same partial loading logic...
r4146 self.permissions_repository_groups[rg_k] = p, o, obj_id
permissions: explicitly register all permissions set for user. Fixes #4217...
r2063
project: added all source files and assets
r1 if perm.RepoGroup.user_id == self.user_id:
auth: make owner of user group give proper admin permissions to the user group....
r1443 # set admin if owner, even for member of other user group
project: added all source files and assets
r1 p = 'group.admin'
dan
permissions: show overridden permissions in permission summary page
r100 o = PermOrigin.REPOGROUP_OWNER
admin: made all grids use same partial loading logic...
r4146 self.permissions_repository_groups[rg_k] = p, o, obj_id
project: added all source files and assets
r1
auth: expose a option to calculate how we end up having super-admin permission....
r2065 if self.user_is_admin:
p = 'group.admin'
o = PermOrigin.SUPER_ADMIN
admin: made all grids use same partial loading logic...
r4146 self.permissions_repository_groups[rg_k] = p, o, obj_id
project: added all source files and assets
r1
# user explicit permissions for repository groups
user_repo_groups_perms = Permission.get_default_group_perms(
self.user_id, self.scope_repo_group_id)
for perm in user_repo_groups_perms:
rg_k = perm.UserRepoGroupToPerm.group.group_name
admin: made all grids use same partial loading logic...
r4146 obj_id = perm.UserRepoGroupToPerm.group.group_id
auth: use pesistent naming of keys in auth. Refactoring only.
r2064 o = PermOrigin.REPOGROUP_USER % perm.UserRepoGroupToPerm\
.user.username
permissions: explicitly register all permissions set for user. Fixes #4217...
r2063 p = perm.Permission.permission_name
if not self.explicit:
dan
branch permissions: fixed a case of showing branch permissions entries when inheritation model is used....
r3154 cur_perm = self.permissions_repository_groups.get(rg_k, 'group.none')
permissions: explicitly register all permissions set for user. Fixes #4217...
r2063 p = self._choose_permission(p, cur_perm)
admin: made all grids use same partial loading logic...
r4146 self.permissions_repository_groups[rg_k] = p, o, obj_id
dan
permissions: show overridden permissions in permission summary page
r100
project: added all source files and assets
r1 if perm.RepoGroup.user_id == self.user_id:
# set admin if owner
p = 'group.admin'
dan
permissions: show overridden permissions in permission summary page
r100 o = PermOrigin.REPOGROUP_OWNER
admin: made all grids use same partial loading logic...
r4146 self.permissions_repository_groups[rg_k] = p, o, obj_id
project: added all source files and assets
r1
auth: expose a option to calculate how we end up having super-admin permission....
r2065 if self.user_is_admin:
p = 'group.admin'
o = PermOrigin.SUPER_ADMIN
admin: made all grids use same partial loading logic...
r4146 self.permissions_repository_groups[rg_k] = p, o, obj_id
project: added all source files and assets
r1
def _calculate_user_group_permissions(self):
"""
User group permissions for the current user.
"""
# user group for user group permissions
user_group_from_user_group = Permission\
.get_default_user_group_perms_from_user_group(
auth: make owner of user group give proper admin permissions to the user group....
r1443 self.user_id, self.scope_user_group_id)
project: added all source files and assets
r1
multiple_counter = collections.defaultdict(int)
for perm in user_group_from_user_group:
admin: made all grids use same partial loading logic...
r4146 ug_k = perm.UserGroupUserGroupToPerm.target_user_group.users_group_name
obj_id = perm.UserGroupUserGroupToPerm.target_user_group.users_group_id
auth: use pesistent naming of keys in auth. Refactoring only.
r2064 multiple_counter[ug_k] += 1
o = PermOrigin.USERGROUP_USERGROUP % perm.UserGroupUserGroupToPerm\
dan
permissions: show overridden permissions in permission summary page
r100 .user_group.users_group_name
project: added all source files and assets
r1 p = perm.Permission.permission_name
auth: make owner of user group give proper admin permissions to the user group....
r1443
auth: use pesistent naming of keys in auth. Refactoring only.
r2064 if multiple_counter[ug_k] > 1:
cur_perm = self.permissions_user_groups[ug_k]
permissions: explicitly register all permissions set for user. Fixes #4217...
r2063 p = self._choose_permission(p, cur_perm)
admin: made all grids use same partial loading logic...
r4146 self.permissions_user_groups[ug_k] = p, o, obj_id
permissions: explicitly register all permissions set for user. Fixes #4217...
r2063
auth: make owner of user group give proper admin permissions to the user group....
r1443 if perm.UserGroup.user_id == self.user_id:
# set admin if owner, even for member of other user group
p = 'usergroup.admin'
o = PermOrigin.USERGROUP_OWNER
admin: made all grids use same partial loading logic...
r4146 self.permissions_user_groups[ug_k] = p, o, obj_id
project: added all source files and assets
r1
auth: expose a option to calculate how we end up having super-admin permission....
r2065 if self.user_is_admin:
p = 'usergroup.admin'
o = PermOrigin.SUPER_ADMIN
admin: made all grids use same partial loading logic...
r4146 self.permissions_user_groups[ug_k] = p, o, obj_id
project: added all source files and assets
r1
# user explicit permission for user groups
user_user_groups_perms = Permission.get_default_user_group_perms(
self.user_id, self.scope_user_group_id)
for perm in user_user_groups_perms:
dan
permissions: show overridden permissions in permission summary page
r100 ug_k = perm.UserUserGroupToPerm.user_group.users_group_name
admin: made all grids use same partial loading logic...
r4146 obj_id = perm.UserUserGroupToPerm.user_group.users_group_id
auth: use pesistent naming of keys in auth. Refactoring only.
r2064 o = PermOrigin.USERGROUP_USER % perm.UserUserGroupToPerm\
.user.username
permissions: explicitly register all permissions set for user. Fixes #4217...
r2063 p = perm.Permission.permission_name
if not self.explicit:
dan
branch permissions: fixed a case of showing branch permissions entries when inheritation model is used....
r3154 cur_perm = self.permissions_user_groups.get(ug_k, 'usergroup.none')
permissions: explicitly register all permissions set for user. Fixes #4217...
r2063 p = self._choose_permission(p, cur_perm)
admin: made all grids use same partial loading logic...
r4146 self.permissions_user_groups[ug_k] = p, o, obj_id
auth: make owner of user group give proper admin permissions to the user group....
r1443
if perm.UserGroup.user_id == self.user_id:
# set admin if owner
p = 'usergroup.admin'
o = PermOrigin.USERGROUP_OWNER
admin: made all grids use same partial loading logic...
r4146 self.permissions_user_groups[ug_k] = p, o, obj_id
project: added all source files and assets
r1
auth: expose a option to calculate how we end up having super-admin permission....
r2065 if self.user_is_admin:
p = 'usergroup.admin'
o = PermOrigin.SUPER_ADMIN
admin: made all grids use same partial loading logic...
r4146 self.permissions_user_groups[ug_k] = p, o, obj_id
project: added all source files and assets
r1
def _choose_permission(self, new_perm, cur_perm):
new_perm_val = Permission.PERM_WEIGHTS[new_perm]
cur_perm_val = Permission.PERM_WEIGHTS[cur_perm]
if self.algo == 'higherwin':
if new_perm_val > cur_perm_val:
return new_perm
return cur_perm
elif self.algo == 'lowerwin':
if new_perm_val < cur_perm_val:
return new_perm
return cur_perm
def _permission_structure(self):
return {
'global': self.permissions_global,
'repositories': self.permissions_repositories,
branch permissions: added logic to define in UI branch permissions....
r2975 'repository_branches': self.permissions_repository_branches,
project: added all source files and assets
r1 'repositories_groups': self.permissions_repository_groups,
'user_groups': self.permissions_user_groups,
}
auth: allow binding the whitelist views to specific tokens
r1995 def allowed_auth_token_access(view_name, auth_token, whitelist=None):
project: added all source files and assets
r1 """
Check if given controller_name is in whitelist of auth token access
"""
if not whitelist:
from rhodecode import CONFIG
whitelist = aslist(
CONFIG.get('api_access_controllers_whitelist'), sep=',')
auth_white_list: translate from old style controllers to the new views.
r1996 # backward compat translation
compat = {
# old controller, new VIEW
'ChangesetController:*': 'RepoCommitsView:*',
'ChangesetController:changeset_patch': 'RepoCommitsView:repo_commit_patch',
'ChangesetController:changeset_raw': 'RepoCommitsView:repo_commit_raw',
'FilesController:raw': 'RepoCommitsView:repo_commit_raw',
'FilesController:archivefile': 'RepoFilesView:repo_archivefile',
'GistsController:*': 'GistView:*',
}
project: added all source files and assets
r1
auth: allow binding the whitelist views to specific tokens
r1995 log.debug(
logging: use lazy parameter evaluation in log calls.
r3061 'Allowed views for AUTH TOKEN access: %s', whitelist)
project: added all source files and assets
r1 auth_token_access_valid = False
for entry in whitelist:
auth: allow binding the whitelist views to specific tokens
r1995 token_match = True
auth_white_list: translate from old style controllers to the new views.
r1996 if entry in compat:
# translate from old Controllers to Pyramid Views
entry = compat[entry]
auth: allow binding the whitelist views to specific tokens
r1995 if '@' in entry:
# specific AuthToken
entry, allowed_token = entry.split('@', 1)
token_match = auth_token == allowed_token
if fnmatch.fnmatch(view_name, entry) and token_match:
project: added all source files and assets
r1 auth_token_access_valid = True
break
if auth_token_access_valid:
logging: use lazy parameter evaluation in log calls.
r3061 log.debug('view: `%s` matches entry in whitelist: %s',
view_name, whitelist)
project: added all source files and assets
r1 else:
repo-commits: ported changeset code into pyramid views....
r1951 msg = ('view: `%s` does *NOT* match any entry in whitelist: %s'
% (view_name, whitelist))
project: added all source files and assets
r1 if auth_token:
# if we use auth token key and don't have access it's a warning
log.warning(msg)
else:
log.debug(msg)
return auth_token_access_valid
class AuthUser(object):
"""
A simple object that handles all attributes of user in RhodeCode
It does lookup based on API key,given user, or user present in session
Then it fills all required information for such user. It also checks if
anonymous access is enabled and if so, it returns default user as logged in
"""
GLOBAL_PERMS = [x[0] for x in Permission.PERMS]
my-account: owner/watched repos are now loaded only using DB queries....
r4153 repo_read_perms = ['repository.read', 'repository.admin', 'repository.write']
repo_group_read_perms = ['group.read', 'group.write', 'group.admin']
auth-user: use new permissions helpers instead of defining the read list over and over.
r4154 user_group_read_perms = ['usergroup.read', 'usergroup.write', 'usergroup.admin']
project: added all source files and assets
r1
def __init__(self, user_id=None, api_key=None, username=None, ip_addr=None):
self.user_id = user_id
self._api_key = api_key
self.api_key = None
self.username = username
self.ip_addr = ip_addr
self.name = ''
self.lastname = ''
security: use new safe escaped user attributes across the application....
r1815 self.first_name = ''
self.last_name = ''
project: added all source files and assets
r1 self.email = ''
self.is_authenticated = False
self.admin = False
self.inherit_default_permissions = False
self.password = ''
self.anonymous_user = None # propagated on propagate_data
self.propagate_data()
self._instance = None
self._permissions_scoped_cache = {} # used to bind scoped calculation
@LazyProperty
def permissions(self):
branch-permissions: handle vcs operations and branch permissions....
r2979 return self.get_perms(user=self, cache=None)
project: added all source files and assets
r1
auth: don't expose full set of permissions into channelstream payload....
r2194 @LazyProperty
def permissions_safe(self):
"""
Filtered permissions excluding not allowed repositories
"""
branch-permissions: handle vcs operations and branch permissions....
r2979 perms = self.get_perms(user=self, cache=None)
auth: don't expose full set of permissions into channelstream payload....
r2194
perms['repositories'] = {
auth: auth code changes for python3
r5080 k: v for k, v in list(perms['repositories'].items())
if v != 'repository.none'
}
auth: don't expose full set of permissions into channelstream payload....
r2194 perms['repositories_groups'] = {
auth: auth code changes for python3
r5080 k: v for k, v in list(perms['repositories_groups'].items())
if v != 'group.none'
}
auth: don't expose full set of permissions into channelstream payload....
r2194 perms['user_groups'] = {
auth: auth code changes for python3
r5080 k: v for k, v in list(perms['user_groups'].items())
if v != 'usergroup.none'
}
branch permissions: added logic to define in UI branch permissions....
r2975 perms['repository_branches'] = {
auth: auth code changes for python3
r5080 k: v for k, v in list(perms['repository_branches'].items())
if v != 'branch.none'
}
auth: don't expose full set of permissions into channelstream payload....
r2194 return perms
auth: don't expose full set of permissions into channelstream payload....
r2157 @LazyProperty
auth: expose a option to calculate how we end up having super-admin permission....
r2065 def permissions_full_details(self):
return self.get_perms(
branch-permissions: handle vcs operations and branch permissions....
r2979 user=self, cache=None, calculate_super_admin=True)
auth: expose a option to calculate how we end up having super-admin permission....
r2065
project: added all source files and assets
r1 def permissions_with_scope(self, scope):
"""
Call the get_perms function with scoped data. The scope in that function
narrows the SQL calls to the given ID of objects resulting in fetching
Just particular permission we want to obtain. If scope is an empty dict
then it basically narrows the scope to GLOBAL permissions only.
:param scope: dict
"""
if 'repo_name' in scope:
obj = Repository.get_by_repo_name(scope['repo_name'])
if obj:
scope['repo_id'] = obj.repo_id
caches: rewrite of auth/permission caches to dogpile.
r2845 _scope = collections.OrderedDict()
_scope['repo_id'] = -1
_scope['user_group_id'] = -1
_scope['repo_group_id'] = -1
for k in sorted(scope.keys()):
_scope[k] = scope[k]
# store in cache to mimic how the @LazyProperty works,
# the difference here is that we use the unique key calculated
# from params and values
branch-permissions: handle vcs operations and branch permissions....
r2979 return self.get_perms(user=self, cache=None, scope=_scope)
project: added all source files and assets
r1
def get_instance(self):
return User.get(self.user_id)
def propagate_data(self):
"""
Fills in user data and propagates values to this instance. Maps fetched
user attributes to this class instance attributes
"""
user: deprecated usage of api_keys....
r1953 log.debug('AuthUser: starting data propagation for new potential user')
project: added all source files and assets
r1 user_model = UserModel()
anon_user = self.anonymous_user = User.get_default_user(cache=True)
is_user_loaded = False
# lookup by userid
if self.user_id is not None and self.user_id != anon_user.user_id:
auth: improve logging
r1955 log.debug('Trying Auth User lookup by USER ID: `%s`', self.user_id)
project: added all source files and assets
r1 is_user_loaded = user_model.fill_data(self, user_id=self.user_id)
# try go get user by api key
elif self._api_key and self._api_key != anon_user.api_key:
artifacts: expose a special auth-token based artifacts download urls....
r4003 log.debug('Trying Auth User lookup by API KEY: `...%s`', self._api_key[-4:])
project: added all source files and assets
r1 is_user_loaded = user_model.fill_data(self, api_key=self._api_key)
# lookup by username
elif self.username:
auth: improve logging
r1955 log.debug('Trying Auth User lookup by USER NAME: `%s`', self.username)
project: added all source files and assets
r1 is_user_loaded = user_model.fill_data(self, username=self.username)
else:
auth: improve logging
r1955 log.debug('No data in %s that could been used to log in', self)
project: added all source files and assets
r1
if not is_user_loaded:
users: ported controllers from pylons into pyramid views.
r2114 log.debug(
'Failed to load user. Fallback to default user %s', anon_user)
project: added all source files and assets
r1 # if we cannot authenticate user try anonymous
if anon_user.active:
users: ported controllers from pylons into pyramid views.
r2114 log.debug('default user is active, using it as a session user')
project: added all source files and assets
r1 user_model.fill_data(self, user_id=anon_user.user_id)
# then we set this user is logged in
self.is_authenticated = True
else:
users: ported controllers from pylons into pyramid views.
r2114 log.debug('default user is NOT active')
project: added all source files and assets
r1 # in case of disabled anonymous user we reset some of the
# parameters so such user is "corrupted", skipping the fill_data
for attr in ['user_id', 'username', 'admin', 'active']:
setattr(self, attr, None)
self.is_authenticated = False
if not self.username:
self.username = 'None'
auth: improve logging
r1955 log.debug('AuthUser: propagated user is now %s', self)
project: added all source files and assets
r1
def get_perms(self, user, scope=None, explicit=True, algo='higherwin',
branch-permissions: handle vcs operations and branch permissions....
r2979 calculate_super_admin=False, cache=None):
project: added all source files and assets
r1 """
Fills user permission attribute with permissions taken from database
works for permissions given for repositories, and for permissions that
are granted to groups
:param user: instance of User object from database
auth: auth code changes for python3
r5080 :param scope:
project: added all source files and assets
r1 :param explicit: In case there are permissions both for user and a group
that user is part of, explicit flag will defiine if user will
explicitly override permissions from group, if it's False it will
make decision based on the algo
:param algo: algorithm to decide what permission should be choose if
it's multiple defined, eg user in two different groups. It also
decides if explicit flag is turned off how to specify the permission
for case when user is in a group + have defined separate permission
branch-permissions: handle vcs operations and branch permissions....
r2979 :param calculate_super_admin: calculate permissions for super-admin in the
same way as for regular user without speedups
:param cache: Use caching for calculation, None = let the cache backend decide
project: added all source files and assets
r1 """
user_id = user.user_id
user_is_admin = user.is_admin
# inheritance of global permissions like create repo/fork repo etc
user_inherit_default_permissions = user.inherit_default_permissions
permissions: enable caching by controlling short_term cache settings.
r2796 cache_seconds = safe_int(
caches: rewrite of auth/permission caches to dogpile.
r2845 rhodecode.CONFIG.get('rc_cache.cache_perms.expiration_time'))
branch-permissions: handle vcs operations and branch permissions....
r2979 if cache is None:
# let the backend cache decide
cache_on = cache_seconds > 0
else:
cache_on = cache
permissions: enable caching by controlling short_term cache settings.
r2796 log.debug(
auth: update logging for permission calculation function
r2813 'Computing PERMISSION tree for user %s scope `%s` '
logging: use lazy parameter evaluation in log calls.
r3061 'with caching: %s[TTL: %ss]', user, scope, cache_on, cache_seconds or 0)
caches: rewrite of auth/permission caches to dogpile.
r2845
caches: make sure the global cache namespace prefixes are used....
r5106 cache_namespace_uid = f'cache_user_auth.{rc_cache.PERMISSIONS_CACHE_VER}.{user_id}'
caches: rewrite of auth/permission caches to dogpile.
r2845 region = rc_cache.get_or_create_region('cache_perms', cache_namespace_uid)
caches: use new decorator that uses conditional caches skipping dogpile if cache is disabled.
r2892 @region.conditional_cache_on_arguments(namespace=cache_namespace_uid,
condition=cache_on)
caches: introduce cache_ver for permissions in order to be able to invalidate caches if cached code changes
r4155 def compute_perm_tree(cache_name, cache_ver,
caches: rewrite of auth/permission caches to dogpile.
r2845 user_id, scope, user_is_admin,user_inherit_default_permissions,
explicit, algo, calculate_super_admin):
return _cached_perms_data(
user_id, scope, user_is_admin, user_inherit_default_permissions,
explicit, algo, calculate_super_admin)
auth: update logging for permission calculation function
r2813 start = time.time()
branch-permissions: handle vcs operations and branch permissions....
r2979 result = compute_perm_tree(
caches: introduce cache_ver for permissions in order to be able to invalidate caches if cached code changes
r4155 'permissions', 'v1', user_id, scope, user_is_admin,
branch-permissions: handle vcs operations and branch permissions....
r2979 user_inherit_default_permissions, explicit, algo,
calculate_super_admin)
project: added all source files and assets
r1
result_repr = []
for k in result:
result_repr.append((k, len(result[k])))
auth: update logging for permission calculation function
r2813 total = time.time() - start
core: added more accurate time measurement for called functions
r3853 log.debug('PERMISSION tree for user %s computed in %.4fs: %s',
logging: use lazy parameter evaluation in log calls.
r3061 user, total, result_repr)
caches: rewrite of auth/permission caches to dogpile.
r2845
project: added all source files and assets
r1 return result
@property
auth: Add a method to check if an AuthUser is the default user.
r29 def is_default(self):
return self.username == User.DEFAULT_USER
@property
project: added all source files and assets
r1 def is_admin(self):
return self.admin
@property
def is_user_object(self):
return self.user_id is not None
@property
def repositories_admin(self):
"""
Returns list of repositories you're an admin of
"""
auth: make owner of user group give proper admin permissions to the user group....
r1443 return [
auth: auth code changes for python3
r5080 x[0] for x in list(self.permissions['repositories'].items())
auth: make owner of user group give proper admin permissions to the user group....
r1443 if x[1] == 'repository.admin']
project: added all source files and assets
r1
@property
def repository_groups_admin(self):
"""
Returns list of repository groups you're an admin of
"""
auth: make owner of user group give proper admin permissions to the user group....
r1443 return [
auth: auth code changes for python3
r5080 x[0] for x in list(self.permissions['repositories_groups'].items())
auth: make owner of user group give proper admin permissions to the user group....
r1443 if x[1] == 'group.admin']
project: added all source files and assets
r1
@property
def user_groups_admin(self):
"""
Returns list of user groups you're an admin of
"""
auth: make owner of user group give proper admin permissions to the user group....
r1443 return [
auth: auth code changes for python3
r5080 x[0] for x in list(self.permissions['user_groups'].items())
auth: make owner of user group give proper admin permissions to the user group....
r1443 if x[1] == 'usergroup.admin']
project: added all source files and assets
r1
admin: made all grids use same partial loading logic...
r4146 def repo_acl_ids_from_stack(self, perms=None, prefix_filter=None, cache=False):
if not perms:
auth-user: use new permissions helpers instead of defining the read list over and over.
r4154 perms = AuthUser.repo_read_perms
admin: made all grids use same partial loading logic...
r4146 allowed_ids = []
auth: auth code changes for python3
r5080 for k, stack_data in list(self.permissions['repositories'].perm_origin_stack.items()):
admin: made all grids use same partial loading logic...
r4146 perm, origin, obj_id = stack_data[-1] # last item is the current permission
if prefix_filter and not k.startswith(prefix_filter):
continue
if perm in perms:
allowed_ids.append(obj_id)
return allowed_ids
auth: added additional name filters to the acl helpers....
r2037 def repo_acl_ids(self, perms=None, name_filter=None, cache=False):
auth: added helpers to fetch IDs of repos/repo groups/user groups that...
r2036 """
Returns list of repository ids that user have access to based on given
perms. The cache flag should be only used in cases that are used for
display purposes, NOT IN ANY CASE for permission checks.
"""
from rhodecode.model.scm import RepoList
if not perms:
auth-user: use new permissions helpers instead of defining the read list over and over.
r4154 perms = AuthUser.repo_read_perms
auth: added helpers to fetch IDs of repos/repo groups/user groups that...
r2036
auth-user: enabled cache flags for fetching ACL ids....
r4328 if not isinstance(perms, list):
raise ValueError('perms parameter must be a list got {} instead'.format(perms))
def _cached_repo_acl(perm_def, _name_filter):
auth: added additional name filters to the acl helpers....
r2037 qry = Repository.query()
auth: code style, more python3 compat changes.
r2822 if _name_filter:
FOLD: into unicode changes
r4959 ilike_expression = '%{}%'.format(_name_filter)
auth: added additional name filters to the acl helpers....
r2037 qry = qry.filter(
Repository.repo_name.ilike(ilike_expression))
return [x.repo_id for x in
admin: made all grids use same partial loading logic...
r4146 RepoList(qry, perm_set=perm_def, extra_kwargs={'user': self})]
auth: added helpers to fetch IDs of repos/repo groups/user groups that...
r2036
auth-user: enabled cache flags for fetching ACL ids....
r4328 log.debug('Computing REPO ACL IDS user %s', self)
caches: make sure the global cache namespace prefixes are used....
r5106 cache_namespace_uid = f'cache_user_repo_acl_ids.{rc_cache.PERMISSIONS_CACHE_VER}.{self.user_id}'
auth-user: enabled cache flags for fetching ACL ids....
r4328 region = rc_cache.get_or_create_region('cache_perms', cache_namespace_uid)
@region.conditional_cache_on_arguments(namespace=cache_namespace_uid, condition=cache)
def compute_repo_acl_ids(cache_ver, user_id, perm_def, _name_filter):
return _cached_repo_acl(perm_def, _name_filter)
start = time.time()
result = compute_repo_acl_ids('v1', self.user_id, perms, name_filter)
total = time.time() - start
log.debug('REPO ACL IDS for user %s computed in %.4fs', self, total)
return result
auth: added helpers to fetch IDs of repos/repo groups/user groups that...
r2036
admin: made all grids use same partial loading logic...
r4146 def repo_group_acl_ids_from_stack(self, perms=None, prefix_filter=None, cache=False):
if not perms:
auth-user: use new permissions helpers instead of defining the read list over and over.
r4154 perms = AuthUser.repo_group_read_perms
admin: made all grids use same partial loading logic...
r4146 allowed_ids = []
auth: auth code changes for python3
r5080 for k, stack_data in list(self.permissions['repositories_groups'].perm_origin_stack.items()):
admin: made all grids use same partial loading logic...
r4146 perm, origin, obj_id = stack_data[-1] # last item is the current permission
if prefix_filter and not k.startswith(prefix_filter):
continue
if perm in perms:
allowed_ids.append(obj_id)
return allowed_ids
auth: added additional name filters to the acl helpers....
r2037 def repo_group_acl_ids(self, perms=None, name_filter=None, cache=False):
auth: added helpers to fetch IDs of repos/repo groups/user groups that...
r2036 """
Returns list of repository group ids that user have access to based on given
perms. The cache flag should be only used in cases that are used for
display purposes, NOT IN ANY CASE for permission checks.
"""
from rhodecode.model.scm import RepoGroupList
if not perms:
auth-user: use new permissions helpers instead of defining the read list over and over.
r4154 perms = AuthUser.repo_group_read_perms
auth: added helpers to fetch IDs of repos/repo groups/user groups that...
r2036
auth-user: enabled cache flags for fetching ACL ids....
r4328 if not isinstance(perms, list):
auth: auth code changes for python3
r5080 raise ValueError(f'perms parameter must be a list got {perms} instead')
auth-user: enabled cache flags for fetching ACL ids....
r4328
def _cached_repo_group_acl(perm_def, _name_filter):
auth: added additional name filters to the acl helpers....
r2037 qry = RepoGroup.query()
auth: code style, more python3 compat changes.
r2822 if _name_filter:
FOLD: into unicode changes
r4959 ilike_expression = '%{}%'.format(_name_filter)
auth: added additional name filters to the acl helpers....
r2037 qry = qry.filter(
RepoGroup.group_name.ilike(ilike_expression))
return [x.group_id for x in
admin: made all grids use same partial loading logic...
r4146 RepoGroupList(qry, perm_set=perm_def, extra_kwargs={'user': self})]
auth: added helpers to fetch IDs of repos/repo groups/user groups that...
r2036
auth-user: enabled cache flags for fetching ACL ids....
r4328 log.debug('Computing REPO GROUP ACL IDS user %s', self)
caches: make sure the global cache namespace prefixes are used....
r5106 cache_namespace_uid = f'cache_user_repo_group_acl_ids.{rc_cache.PERMISSIONS_CACHE_VER}.{self.user_id}'
auth-user: enabled cache flags for fetching ACL ids....
r4328 region = rc_cache.get_or_create_region('cache_perms', cache_namespace_uid)
@region.conditional_cache_on_arguments(namespace=cache_namespace_uid, condition=cache)
def compute_repo_group_acl_ids(cache_ver, user_id, perm_def, _name_filter):
return _cached_repo_group_acl(perm_def, _name_filter)
start = time.time()
result = compute_repo_group_acl_ids('v1', self.user_id, perms, name_filter)
total = time.time() - start
log.debug('REPO GROUP ACL IDS for user %s computed in %.4fs', self, total)
return result
auth: added helpers to fetch IDs of repos/repo groups/user groups that...
r2036
admin: made all grids use same partial loading logic...
r4146 def user_group_acl_ids_from_stack(self, perms=None, cache=False):
if not perms:
auth-user: use new permissions helpers instead of defining the read list over and over.
r4154 perms = AuthUser.user_group_read_perms
admin: made all grids use same partial loading logic...
r4146 allowed_ids = []
auth: auth code changes for python3
r5080 for k, stack_data in list(self.permissions['user_groups'].perm_origin_stack.items()):
admin: made all grids use same partial loading logic...
r4146 perm, origin, obj_id = stack_data[-1] # last item is the current permission
if perm in perms:
allowed_ids.append(obj_id)
return allowed_ids
auth: added additional name filters to the acl helpers....
r2037 def user_group_acl_ids(self, perms=None, name_filter=None, cache=False):
auth: added helpers to fetch IDs of repos/repo groups/user groups that...
r2036 """
Returns list of user group ids that user have access to based on given
perms. The cache flag should be only used in cases that are used for
display purposes, NOT IN ANY CASE for permission checks.
"""
from rhodecode.model.scm import UserGroupList
if not perms:
auth-user: use new permissions helpers instead of defining the read list over and over.
r4154 perms = AuthUser.user_group_read_perms
auth: added helpers to fetch IDs of repos/repo groups/user groups that...
r2036
auth-user: enabled cache flags for fetching ACL ids....
r4328 if not isinstance(perms, list):
raise ValueError('perms parameter must be a list got {} instead'.format(perms))
def _cached_user_group_acl(perm_def, _name_filter):
auth: added additional name filters to the acl helpers....
r2037 qry = UserGroup.query()
auth-user: enabled cache flags for fetching ACL ids....
r4328 if _name_filter:
FOLD: into unicode changes
r4959 ilike_expression = '%{}%'.format(_name_filter)
auth: added additional name filters to the acl helpers....
r2037 qry = qry.filter(
UserGroup.users_group_name.ilike(ilike_expression))
return [x.users_group_id for x in
admin: made all grids use same partial loading logic...
r4146 UserGroupList(qry, perm_set=perm_def, extra_kwargs={'user': self})]
auth: added helpers to fetch IDs of repos/repo groups/user groups that...
r2036
auth-user: enabled cache flags for fetching ACL ids....
r4328 log.debug('Computing USER GROUP ACL IDS user %s', self)
caches: make sure the global cache namespace prefixes are used....
r5106 cache_namespace_uid = f'cache_user_user_group_acl_ids.{rc_cache.PERMISSIONS_CACHE_VER}.{self.user_id}'
auth-user: enabled cache flags for fetching ACL ids....
r4328 region = rc_cache.get_or_create_region('cache_perms', cache_namespace_uid)
@region.conditional_cache_on_arguments(namespace=cache_namespace_uid, condition=cache)
def compute_user_group_acl_ids(cache_ver, user_id, perm_def, _name_filter):
return _cached_user_group_acl(perm_def, _name_filter)
start = time.time()
result = compute_user_group_acl_ids('v1', self.user_id, perms, name_filter)
total = time.time() - start
log.debug('USER GROUP ACL IDS for user %s computed in %.4fs', self, total)
return result
auth: added helpers to fetch IDs of repos/repo groups/user groups that...
r2036
project: added all source files and assets
r1 @property
def ip_allowed(self):
"""
Checks if ip_addr used in constructor is allowed from defined list of
allowed ip_addresses for user
:returns: boolean, True if ip is in allowed ip range
"""
# check IP
inherit = self.inherit_default_permissions
return AuthUser.check_ip_allowed(self.user_id, self.ip_addr,
inherit_from_default=inherit)
auth-user: enabled cache flags for fetching ACL ids....
r4328
repo-groups: implemented default personal repo groups logic....
r1094 @property
def personal_repo_group(self):
return RepoGroup.get_user_personal_repo_group(self.user_id)
project: added all source files and assets
r1
feed-token, user, performance: lazy load the feed_token. We only need it for...
r2424 @LazyProperty
def feed_token(self):
return self.get_instance().feed_token
artifacts: expose a special auth-token based artifacts download urls....
r4003 @LazyProperty
def artifact_token(self):
return self.get_instance().artifact_token
project: added all source files and assets
r1 @classmethod
def check_ip_allowed(cls, user_id, ip_addr, inherit_from_default):
allowed_ips = AuthUser.get_allowed_ips(
user_id, cache=True, inherit_from_default=inherit_from_default)
if check_ip_access(source_ip=ip_addr, allowed_ips=allowed_ips):
logging: use lazy parameter evaluation in log calls.
r3061 log.debug('IP:%s for user %s is in range of %s',
ip_addr, user_id, allowed_ips)
project: added all source files and assets
r1 return True
else:
logging: updated logging information on IP checks.
r2820 log.info('Access for IP:%s forbidden for user %s, '
logging: expose extra metadata to various important logs for loki
r4816 'not in %s', ip_addr, user_id, allowed_ips,
extra={"ip": ip_addr, "user_id": user_id})
project: added all source files and assets
r1 return False
branch-permissions: handle vcs operations and branch permissions....
r2979 def get_branch_permissions(self, repo_name, perms=None):
perms = perms or self.permissions_with_scope({'repo_name': repo_name})
branch-permissions: enabled branch permissions checks for SSH backend.
r2982 branch_perms = perms.get('repository_branches', {})
if not branch_perms:
return {}
repo_branch_perms = branch_perms.get(repo_name)
return repo_branch_perms or {}
branch-permissions: handle vcs operations and branch permissions....
r2979
def get_rule_and_branch_permission(self, repo_name, branch_name):
"""
Check if this AuthUser has defined any permissions for branches. If any of
the rules match in order, we return the matching permissions
"""
rule = default_perm = ''
branch-permissions: enabled branch permissions checks for SSH backend.
r2982 repo_branch_perms = self.get_branch_permissions(repo_name=repo_name)
branch-permissions: handle vcs operations and branch permissions....
r2979 if not repo_branch_perms:
return rule, default_perm
# now calculate the permissions
auth: auth code changes for python3
r5080 for pattern, branch_perm in list(repo_branch_perms.items()):
branch-permissions: handle vcs operations and branch permissions....
r2979 if fnmatch.fnmatch(branch_name, pattern):
rule = '`{}`=>{}'.format(pattern, branch_perm)
return rule, branch_perm
return rule, default_perm
core: added user-notice logic to push notice messages....
r4300 def get_notice_messages(self):
notice_level = 'notice-error'
notice_messages = []
if self.is_default:
return [], notice_level
notices = UserNotice.query()\
.filter(UserNotice.user_id == self.user_id)\
.filter(UserNotice.notice_read == false())\
.all()
try:
for entry in notices:
msg = {
'msg_id': entry.user_notice_id,
'level': entry.notification_level,
'subject': entry.notice_subject,
'body': entry.notice_body,
}
notice_messages.append(msg)
log.debug('Got user %s %s messages', self, len(notice_messages))
levels = [x['level'] for x in notice_messages]
notice_level = 'notice-error' if 'error' in levels else 'notice-warning'
except Exception:
pass
return notice_messages, notice_level
project: added all source files and assets
r1 def __repr__(self):
request-wrapper: expose usernames for better auditing capabilities.
r4347 return self.repr_user(self.user_id, self.username, self.ip_addr, self.is_authenticated)
project: added all source files and assets
r1
def set_authenticated(self, authenticated=True):
if self.user_id != self.anonymous_user.user_id:
self.is_authenticated = authenticated
def get_cookie_store(self):
return {
'username': self.username,
auth: re-orginize imports use hashlib helpers
r4958 'password': md5(safe_bytes(self.password or '')),
project: added all source files and assets
r1 'user_id': self.user_id,
'is_authenticated': self.is_authenticated
}
@classmethod
request-wrapper: expose usernames for better auditing capabilities.
r4347 def repr_user(cls, user_id=0, username='ANONYMOUS', ip='0.0.0.0', is_authenticated=False):
tmpl = "<AuthUser('id:{}[{}] ip:{} auth:{}')>"
return tmpl.format(user_id, username, ip, is_authenticated)
@classmethod
project: added all source files and assets
r1 def from_cookie_store(cls, cookie_store):
"""
Creates AuthUser from a cookie store
:param cls:
:param cookie_store:
"""
user_id = cookie_store.get('user_id')
username = cookie_store.get('username')
api_key = cookie_store.get('api_key')
return AuthUser(user_id, api_key, username)
@classmethod
def get_allowed_ips(cls, user_id, cache=False, inherit_from_default=False):
_set = set()
if inherit_from_default:
caches: use new decorator that uses conditional caches skipping dogpile if cache is disabled.
r2892 def_user_id = User.get_default_user(cache=True).user_id
default_ips = UserIpMap.query().filter(UserIpMap.user_id == def_user_id)
project: added all source files and assets
r1 if cache:
caches: ensure we don't use non-ascii characters in cache keys....
r1749 default_ips = default_ips.options(
FromCache("sql_cache_short", "get_user_ips_default"))
project: added all source files and assets
r1
# populate from default user
for ip in default_ips:
try:
_set.add(ip.ip_addr)
except ObjectDeletedError:
# since we use heavy caching sometimes it happens that
# we get deleted objects here, we just skip them
pass
ip-restritions: fix issue with loading empty IP rules for non-logged not-anonymous users....
r2838 # NOTE:(marcink) we don't want to load any rules for empty
# user_id which is the case of access of non logged users when anonymous
# access is disabled
user_ips = []
if user_id:
user_ips = UserIpMap.query().filter(UserIpMap.user_id == user_id)
if cache:
user_ips = user_ips.options(
auth: auth code changes for python3
r5080 FromCache("sql_cache_short", f"get_user_ips_{user_id}"))
project: added all source files and assets
r1
for ip in user_ips:
try:
_set.add(ip.ip_addr)
except ObjectDeletedError:
# since we use heavy caching sometimes it happens that we get
# deleted objects here, we just skip them
pass
auth: code cleanup, use set literals for py3 compat
r2821 return _set or {ip for ip in ['0.0.0.0/0', '::/0']}
project: added all source files and assets
r1
users: ported controllers from pylons into pyramid views.
r2114 def set_available_permissions(settings):
project: added all source files and assets
r1 """
users: ported controllers from pylons into pyramid views.
r2114 This function will propagate pyramid settings with all available defined
project: added all source files and assets
r1 permission given in db. We don't want to check each time from db for new
permissions since adding a new permission also requires application restart
ie. to decorate new views with the newly created permission
users: ported controllers from pylons into pyramid views.
r2114 :param settings: current pyramid registry.settings
project: added all source files and assets
r1
"""
users: ported controllers from pylons into pyramid views.
r2114 log.debug('auth: getting information about all available permissions')
project: added all source files and assets
r1 try:
sa = meta.Session
all_perms = sa.query(Permission).all()
users: ported controllers from pylons into pyramid views.
r2114 settings.setdefault('available_permissions',
[x.permission_name for x in all_perms])
log.debug('auth: set available permissions')
project: added all source files and assets
r1 except Exception:
users: ported controllers from pylons into pyramid views.
r2114 log.exception('Failed to fetch permissions from the database.')
raise
project: added all source files and assets
r1
sessions: don't use pylons sessions for csrf tokens
r2101 def get_csrf_token(session, force_new=False, save_if_missing=True):
project: added all source files and assets
r1 """
Return the current authentication token, creating one if one doesn't
already exist and the save_if_missing flag is present.
auth: remove pylons i18n and replaced it with pyramid translation
r2345 :param session: pass in the pyramid session, else we use the global ones
project: added all source files and assets
r1 :param force_new: force to re-generate the token and store it in session
:param save_if_missing: save the newly generated token if it's missing in
session
"""
dependencies: bumped pyramid to 1.9 webob to 1.7.3 and webtest to 2.0.27...
r1906 # NOTE(marcink): probably should be replaced with below one from pyramid 1.9
# from pyramid.csrf import get_csrf_token
project: added all source files and assets
r1
if (csrf_token_key not in session and save_if_missing) or force_new:
auth: re-orginize imports use hashlib helpers
r4958 token = sha1(ascii_bytes(str(random.getrandbits(128))))
project: added all source files and assets
r1 session[csrf_token_key] = token
if hasattr(session, 'save'):
session.save()
return session.get(csrf_token_key)
user-groups: rewrote the app to pyramid...
r2068 def get_request(perm_class_instance):
fix(events): fixed celery based events where it was missing request object
r5340 from rhodecode.lib.pyramid_utils import get_current_request
auth: prepare code for removal of pylons request in pyramid migration.
r1791 pyramid_request = get_current_request()
return pyramid_request
project: added all source files and assets
r1 # CHECK DECORATORS
class CSRFRequired(object):
"""
Decorator for authenticating a form
This decorator uses an authorization token stored in the client's
session for prevention of certain Cross-site request forgery (CSRF)
attacks (See
http://en.wikipedia.org/wiki/Cross-site_request_forgery for more
information).
dan
webhelpers: port most of the items from webhelpers to webhelpers2...
r4090 For use with the ``secure_form`` helper functions.
project: added all source files and assets
r1
"""
dan
webhelpers: port most of the items from webhelpers to webhelpers2...
r4090 def __init__(self, token=csrf_token_key, header='X-CSRF-Token', except_methods=None):
project: added all source files and assets
r1 self.token = token
self.header = header
dan
account: convert change password form to colander schema and fix bug...
r665 self.except_methods = except_methods or []
project: added all source files and assets
r1
def __call__(self, func):
return get_cython_compat_decorator(self.__wrapper, func)
def _get_csrf(self, _request):
return _request.POST.get(self.token, _request.headers.get(self.header))
def check_csrf(self, _request, cur_token):
supplied_token = self._get_csrf(_request)
return supplied_token and supplied_token == cur_token
auth: prepare code for removal of pylons request in pyramid migration.
r1791 def _get_request(self):
return get_request(self)
project: added all source files and assets
r1 def __wrapper(self, func, *fargs, **fkwargs):
auth: auth code changes for python3
r5080 cls = fargs[0]
request = cls.request or self._get_request()
auth: prepare code for removal of pylons request in pyramid migration.
r1791
dan
account: convert change password form to colander schema and fix bug...
r665 if request.method in self.except_methods:
return func(*fargs, **fkwargs)
sessions: don't use pylons sessions for csrf tokens
r2101 cur_token = get_csrf_token(request.session, save_if_missing=False)
project: added all source files and assets
r1 if self.check_csrf(request, cur_token):
if request.POST.get(self.token):
del request.POST[self.token]
return func(*fargs, **fkwargs)
else:
reason = 'token-missing'
supplied_token = self._get_csrf(request)
if supplied_token and cur_token != supplied_token:
auth: prepare code for removal of pylons request in pyramid migration.
r1791 reason = 'token-mismatch [%s:%s]' % (
cur_token or ''[:6], supplied_token or ''[:6])
project: added all source files and assets
r1
csrf_message = \
("Cross-site request forgery detected, request denied. See "
"http://en.wikipedia.org/wiki/Cross-site_request_forgery for "
"more information.")
auth: auth code changes for python3
r5080 log.warning('Cross-site request forgery detected, request %r DENIED: %s '
'REMOTE_ADDR:%s, HEADERS:%s' % (
project: added all source files and assets
r1 request, reason, request.remote_addr, request.headers))
auth: use pyramid HTTP excetion when detecting CSRF error. It helps catching this...
r1310 raise HTTPForbidden(explanation=csrf_message)
project: added all source files and assets
r1
class LoginRequired(object):
"""
Must be logged in to execute this function else
redirect to login page
auth: auth code changes for python3
r5080 :param auth_token_access: if enabled this checks only for valid auth token
project: added all source files and assets
r1 and grants access based on valid token
"""
auth-tokens: updated logic of authentication to a common shared user method.
r1421 def __init__(self, auth_token_access=None):
project: added all source files and assets
r1 self.auth_token_access = auth_token_access
artifacts: expose a special auth-token based artifacts download urls....
r4003 if self.auth_token_access:
valid_type = set(auth_token_access).intersection(set(UserApiKeys.ROLES))
if not valid_type:
raise ValueError('auth_token_access must be on of {}, got {}'.format(
UserApiKeys.ROLES, auth_token_access))
project: added all source files and assets
r1
def __call__(self, func):
return get_cython_compat_decorator(self.__wrapper, func)
auth: re-use the get_current_request in fetching request in decorators....
r1775 def _get_request(self):
auth: prepare code for removal of pylons request in pyramid migration.
r1791 return get_request(self)
auth: re-use the get_current_request in fetching request in decorators....
r1775
project: added all source files and assets
r1 def __wrapper(self, func, *fargs, **fkwargs):
auth: Change login url generation in auth decorators....
r35 from rhodecode.lib import helpers as h
project: added all source files and assets
r1 cls = fargs[0]
user = cls._rhodecode_user
auth: auth code changes for python3
r5080 request = cls.request or self._get_request()
auth: remove pylons i18n and replaced it with pyramid translation
r2345 _ = request.translate
auth: re-use the get_current_request in fetching request in decorators....
r1775
project: added all source files and assets
r1 loc = "%s:%s" % (cls.__class__.__name__, func.__name__)
logging: use lazy parameter evaluation in log calls.
r3061 log.debug('Starting login restriction checks for user: %s', user)
project: added all source files and assets
r1 # check if our IP is allowed
ip_access_valid = True
if not user.ip_allowed:
artifacts: expose a special auth-token based artifacts download urls....
r4003 h.flash(h.literal(_('IP {} not allowed'.format(user.ip_addr))),
project: added all source files and assets
r1 category='warning')
ip_access_valid = False
artifacts: expose a special auth-token based artifacts download urls....
r4003 # we used stored token that is extract from GET or URL param (if any)
_auth_token = request.user_auth_token
# check if we used an AUTH_TOKEN and it's a valid one
auth-tokens: updated logic of authentication to a common shared user method.
r1421 # defined white-list of controllers which API access will be enabled
artifacts: expose a special auth-token based artifacts download urls....
r4003 whitelist = None
if self.auth_token_access:
# since this location is allowed by @LoginRequired decorator it's our
# only whitelist
whitelist = [loc]
project: added all source files and assets
r1 auth_token_access_valid = allowed_auth_token_access(
artifacts: expose a special auth-token based artifacts download urls....
r4003 loc, whitelist=whitelist, auth_token=_auth_token)
project: added all source files and assets
r1
# explicit controller is enabled or API is in our whitelist
artifacts: expose a special auth-token based artifacts download urls....
r4003 if auth_token_access_valid:
logging: use lazy parameter evaluation in log calls.
r3061 log.debug('Checking AUTH TOKEN access for %s', cls)
auth-tokens: updated logic of authentication to a common shared user method.
r1421 db_user = user.get_instance()
project: added all source files and assets
r1
auth-tokens: updated logic of authentication to a common shared user method.
r1421 if db_user:
if self.auth_token_access:
roles = self.auth_token_access
else:
roles = [UserApiKeys.ROLE_HTTP]
artifacts: expose a special auth-token based artifacts download urls....
r4003 log.debug('AUTH TOKEN: checking auth for user %s and roles %s',
db_user, roles)
auth-tokens: updated logic of authentication to a common shared user method.
r1421 token_match = db_user.authenticate_by_token(
auth-tokens: disable authenticating by builtin token.
r1477 _auth_token, roles=roles)
auth-tokens: updated logic of authentication to a common shared user method.
r1421 else:
log.debug('Unable to fetch db instance for auth user: %s', user)
token_match = False
if _auth_token and token_match:
project: added all source files and assets
r1 auth_token_access_valid = True
logging: use lazy parameter evaluation in log calls.
r3061 log.debug('AUTH TOKEN ****%s is VALID', _auth_token[-4:])
project: added all source files and assets
r1 else:
auth_token_access_valid = False
if not _auth_token:
log.debug("AUTH TOKEN *NOT* present in request")
else:
logging: use lazy parameter evaluation in log calls.
r3061 log.warning("AUTH TOKEN ****%s *NOT* valid", _auth_token[-4:])
log.debug('Checking if %s is authenticated @ %s', user.username, loc)
project: added all source files and assets
r1 reason = 'RHODECODE_AUTH' if user.is_authenticated \
else 'AUTH_TOKEN_AUTH'
if ip_access_valid and (
user.is_authenticated or auth_token_access_valid):
logging: use lazy parameter evaluation in log calls.
r3061 log.info('user %s authenticating with:%s IS authenticated on func %s',
user, reason, loc)
project: added all source files and assets
r1
return func(*fargs, **fkwargs)
else:
log.warning(
'user %s authenticating with:%s NOT authenticated on '
logging: use lazy parameter evaluation in log calls.
r3061 'func: %s: IP_ACCESS:%s AUTH_TOKEN_ACCESS:%s',
user, reason, loc, ip_access_valid, auth_token_access_valid)
project: added all source files and assets
r1 # we preserve the get PARAM
auth: use consistent way of extracting came_from, and also sanitise it to remove...
r2074 came_from = get_came_from(request)
logging: use lazy parameter evaluation in log calls.
r3061 log.debug('redirecting to login page with %s', came_from)
auth: use pyramid only redirections.
r1790 raise HTTPFound(
auth: Change login url generation in auth decorators....
r35 h.route_path('login', _query={'came_from': came_from}))
project: added all source files and assets
r1
class NotAnonymous(object):
"""
Must be logged in to execute this function else
auth: re-use the get_current_request in fetching request in decorators....
r1775 redirect to login page
"""
project: added all source files and assets
r1
def __call__(self, func):
return get_cython_compat_decorator(self.__wrapper, func)
auth: prepare code for removal of pylons request in pyramid migration.
r1791 def _get_request(self):
return get_request(self)
project: added all source files and assets
r1 def __wrapper(self, func, *fargs, **fkwargs):
core: properly handle new redirections set in decorators....
r1499 import rhodecode.lib.helpers as h
project: added all source files and assets
r1 cls = fargs[0]
self.user = cls._rhodecode_user
auth: auth code changes for python3
r5080 request = cls.request or self._get_request()
auth: remove pylons i18n and replaced it with pyramid translation
r2345 _ = request.translate
logging: use lazy parameter evaluation in log calls.
r3061 log.debug('Checking if user is not anonymous @%s', cls)
project: added all source files and assets
r1
anonymous = self.user.username == User.DEFAULT_USER
if anonymous:
auth: use consistent way of extracting came_from, and also sanitise it to remove...
r2074 came_from = get_came_from(request)
project: added all source files and assets
r1 h.flash(_('You need to be a registered user to '
'perform this action'),
category='warning')
auth: use pyramid only redirections.
r1790 raise HTTPFound(
auth: Change login url generation in auth decorators....
r35 h.route_path('login', _query={'came_from': came_from}))
project: added all source files and assets
r1 else:
return func(*fargs, **fkwargs)
class PermsDecorator(object):
"""
Base class for controller decorators, we extract the current user from
the class itself, which has it stored in base controllers
"""
def __init__(self, *required_perms):
self.required_perms = set(required_perms)
def __call__(self, func):
return get_cython_compat_decorator(self.__wrapper, func)
auth: make the perms decorators and function pyramid compatible.
r1494 def _get_request(self):
auth: prepare code for removal of pylons request in pyramid migration.
r1791 return get_request(self)
auth: make the perms decorators and function pyramid compatible.
r1494
project: added all source files and assets
r1 def __wrapper(self, func, *fargs, **fkwargs):
cls = fargs[0]
_user = cls._rhodecode_user
auth: auth code changes for python3
r5080 request = cls.request or self._get_request()
self.request = request
auth: remove pylons i18n and replaced it with pyramid translation
r2345 _ = request.translate
project: added all source files and assets
r1
log.debug('checking %s permissions %s for %s %s',
self.__class__.__name__, self.required_perms, cls, _user)
if self.check_permissions(_user):
log.debug('Permission granted for %s %s', cls, _user)
return func(*fargs, **fkwargs)
else:
log.debug('Permission denied for %s %s', cls, _user)
anonymous = _user.username == User.DEFAULT_USER
if anonymous:
auth: auth code changes for python3
r5080 import rhodecode.lib.helpers as h
auth: use consistent way of extracting came_from, and also sanitise it to remove...
r2074 came_from = get_came_from(self._get_request())
project: added all source files and assets
r1 h.flash(_('You need to be signed in to view this page'),
home: moved home and repo group views into pyramid....
r1774 category='warning')
auth: make the perms decorators and function pyramid compatible.
r1494 raise HTTPFound(
auth: Change login url generation in auth decorators....
r35 h.route_path('login', _query={'came_from': came_from}))
project: added all source files and assets
r1
else:
security: use 404 instead of 403 code on permission decorator to prevent resource discovery attacks.
r1817 # redirect with 404 to prevent resource discovery
raise HTTPNotFound()
project: added all source files and assets
r1
def check_permissions(self, user):
"""Dummy function for overriding"""
raise NotImplementedError(
'You have to write this function in child class')
class HasPermissionAllDecorator(PermsDecorator):
"""
Checks for access permission for all given predicates. All of them
have to be meet in order to fulfill the request
"""
def check_permissions(self, user):
perms = user.permissions_with_scope({})
if self.required_perms.issubset(perms['global']):
return True
return False
class HasPermissionAnyDecorator(PermsDecorator):
"""
Checks for access permission for any of given predicates. In order to
fulfill the request any of predicates must be meet
"""
def check_permissions(self, user):
perms = user.permissions_with_scope({})
if self.required_perms.intersection(perms['global']):
return True
return False
class HasRepoPermissionAllDecorator(PermsDecorator):
"""
Checks for access permission for all given predicates for specific
repository. All of them have to be meet in order to fulfill the request
"""
auth: make the perms decorators and function pyramid compatible.
r1494 def _get_repo_name(self):
auth: auth code changes for python3
r5080 _request = self.request or self._get_request()
auth: make the perms decorators and function pyramid compatible.
r1494 return get_repo_slug(_request)
project: added all source files and assets
r1
def check_permissions(self, user):
perms = user.permissions
auth: make the perms decorators and function pyramid compatible.
r1494 repo_name = self._get_repo_name()
home: moved home and repo group views into pyramid....
r1774
project: added all source files and assets
r1 try:
auth: code cleanup, use set literals for py3 compat
r2821 user_perms = {perms['repositories'][repo_name]}
project: added all source files and assets
r1 except KeyError:
home: moved home and repo group views into pyramid....
r1774 log.debug('cannot locate repo with name: `%s` in permissions defs',
repo_name)
project: added all source files and assets
r1 return False
home: moved home and repo group views into pyramid....
r1774 log.debug('checking `%s` permissions for repo `%s`',
user_perms, repo_name)
project: added all source files and assets
r1 if self.required_perms.issubset(user_perms):
return True
return False
class HasRepoPermissionAnyDecorator(PermsDecorator):
"""
Checks for access permission for any of given predicates for specific
repository. In order to fulfill the request any of predicates must be meet
"""
auth: make the perms decorators and function pyramid compatible.
r1494 def _get_repo_name(self):
auth: auth code changes for python3
r5080 _request = self.request or self._get_request()
auth: make the perms decorators and function pyramid compatible.
r1494 return get_repo_slug(_request)
project: added all source files and assets
r1
def check_permissions(self, user):
perms = user.permissions
auth: make the perms decorators and function pyramid compatible.
r1494 repo_name = self._get_repo_name()
home: moved home and repo group views into pyramid....
r1774
project: added all source files and assets
r1 try:
auth: code cleanup, use set literals for py3 compat
r2821 user_perms = {perms['repositories'][repo_name]}
project: added all source files and assets
r1 except KeyError:
routing: optionally use explicit db object on route....
r1989 log.debug(
'cannot locate repo with name: `%s` in permissions defs',
repo_name)
project: added all source files and assets
r1 return False
home: moved home and repo group views into pyramid....
r1774 log.debug('checking `%s` permissions for repo `%s`',
user_perms, repo_name)
project: added all source files and assets
r1 if self.required_perms.intersection(user_perms):
return True
return False
class HasRepoGroupPermissionAllDecorator(PermsDecorator):
"""
Checks for access permission for all given predicates for specific
repository group. All of them have to be meet in order to
fulfill the request
"""
auth: make the perms decorators and function pyramid compatible.
r1494 def _get_repo_group_name(self):
auth: auth code changes for python3
r5080 _request = self.request or self._get_request()
auth: make the perms decorators and function pyramid compatible.
r1494 return get_repo_group_slug(_request)
project: added all source files and assets
r1
def check_permissions(self, user):
perms = user.permissions
auth: make the perms decorators and function pyramid compatible.
r1494 group_name = self._get_repo_group_name()
project: added all source files and assets
r1 try:
auth: code cleanup, use set literals for py3 compat
r2821 user_perms = {perms['repositories_groups'][group_name]}
project: added all source files and assets
r1 except KeyError:
routing: optionally use explicit db object on route....
r1989 log.debug(
'cannot locate repo group with name: `%s` in permissions defs',
group_name)
project: added all source files and assets
r1 return False
home: moved home and repo group views into pyramid....
r1774 log.debug('checking `%s` permissions for repo group `%s`',
user_perms, group_name)
project: added all source files and assets
r1 if self.required_perms.issubset(user_perms):
return True
return False
class HasRepoGroupPermissionAnyDecorator(PermsDecorator):
"""
Checks for access permission for any of given predicates for specific
repository group. In order to fulfill the request any
of predicates must be met
"""
auth: make the perms decorators and function pyramid compatible.
r1494 def _get_repo_group_name(self):
auth: auth code changes for python3
r5080 _request = self.request or self._get_request()
auth: make the perms decorators and function pyramid compatible.
r1494 return get_repo_group_slug(_request)
project: added all source files and assets
r1
def check_permissions(self, user):
perms = user.permissions
auth: make the perms decorators and function pyramid compatible.
r1494 group_name = self._get_repo_group_name()
home: moved home and repo group views into pyramid....
r1774
project: added all source files and assets
r1 try:
auth: code cleanup, use set literals for py3 compat
r2821 user_perms = {perms['repositories_groups'][group_name]}
project: added all source files and assets
r1 except KeyError:
routing: optionally use explicit db object on route....
r1989 log.debug(
'cannot locate repo group with name: `%s` in permissions defs',
group_name)
project: added all source files and assets
r1 return False
home: moved home and repo group views into pyramid....
r1774 log.debug('checking `%s` permissions for repo group `%s`',
user_perms, group_name)
project: added all source files and assets
r1 if self.required_perms.intersection(user_perms):
return True
return False
class HasUserGroupPermissionAllDecorator(PermsDecorator):
"""
Checks for access permission for all given predicates for specific
user group. All of them have to be meet in order to fulfill the request
"""
auth: make the perms decorators and function pyramid compatible.
r1494 def _get_user_group_name(self):
auth: auth code changes for python3
r5080 _request = self.request or self._get_request()
auth: make the perms decorators and function pyramid compatible.
r1494 return get_user_group_slug(_request)
project: added all source files and assets
r1
def check_permissions(self, user):
perms = user.permissions
auth: make the perms decorators and function pyramid compatible.
r1494 group_name = self._get_user_group_name()
project: added all source files and assets
r1 try:
auth: code cleanup, use set literals for py3 compat
r2821 user_perms = {perms['user_groups'][group_name]}
project: added all source files and assets
r1 except KeyError:
return False
if self.required_perms.issubset(user_perms):
return True
return False
class HasUserGroupPermissionAnyDecorator(PermsDecorator):
"""
Checks for access permission for any of given predicates for specific
user group. In order to fulfill the request any of predicates must be meet
"""
auth: make the perms decorators and function pyramid compatible.
r1494 def _get_user_group_name(self):
auth: auth code changes for python3
r5080 _request = self.request or self._get_request()
auth: make the perms decorators and function pyramid compatible.
r1494 return get_user_group_slug(_request)
project: added all source files and assets
r1
def check_permissions(self, user):
perms = user.permissions
auth: make the perms decorators and function pyramid compatible.
r1494 group_name = self._get_user_group_name()
project: added all source files and assets
r1 try:
auth: code cleanup, use set literals for py3 compat
r2821 user_perms = {perms['user_groups'][group_name]}
project: added all source files and assets
r1 except KeyError:
return False
if self.required_perms.intersection(user_perms):
return True
return False
# CHECK FUNCTIONS
class PermsFunction(object):
"""Base function for other check functions"""
def __init__(self, *perms):
self.required_perms = set(perms)
self.repo_name = None
self.repo_group_name = None
self.user_group_name = None
def __bool__(self):
core: fixed cython compat inspect that caused some API calls to not work correctly.
r4184 import inspect
project: added all source files and assets
r1 frame = inspect.currentframe()
stack_trace = traceback.format_stack(frame)
log.error('Checking bool value on a class instance of perm '
logging: use lazy parameter evaluation in log calls.
r3061 'function is not allowed: %s', ''.join(stack_trace))
project: added all source files and assets
r1 # rather than throwing errors, here we always return False so if by
# accident someone checks truth for just an instance it will always end
# up in returning False
return False
__nonzero__ = __bool__
def __call__(self, check_location='', user=None):
if not user:
log.debug('Using user attribute from global request')
auth: re-use the get_current_request in fetching request in decorators....
r1775 request = self._get_request()
project: added all source files and assets
r1 user = request.user
# init auth user if not already given
if not isinstance(user, AuthUser):
log.debug('Wrapping user %s into AuthUser', user)
user = AuthUser(user.user_id)
cls_name = self.__class__.__name__
check_scope = self._get_check_scope(cls_name)
check_location = check_location or 'unspecified location'
log.debug('checking cls:%s %s usr:%s %s @ %s', cls_name,
self.required_perms, user, check_scope, check_location)
if not user:
log.warning('Empty user given for permission check')
return False
if self.check_permissions(user):
log.debug('Permission to repo:`%s` GRANTED for user:`%s` @ %s',
check_scope, user, check_location)
return True
else:
log.debug('Permission to repo:`%s` DENIED for user:`%s` @ %s',
check_scope, user, check_location)
return False
auth: make the perms decorators and function pyramid compatible.
r1494 def _get_request(self):
auth: prepare code for removal of pylons request in pyramid migration.
r1791 return get_request(self)
auth: make the perms decorators and function pyramid compatible.
r1494
project: added all source files and assets
r1 def _get_check_scope(self, cls_name):
return {
'HasPermissionAll': 'GLOBAL',
'HasPermissionAny': 'GLOBAL',
'HasRepoPermissionAll': 'repo:%s' % self.repo_name,
'HasRepoPermissionAny': 'repo:%s' % self.repo_name,
'HasRepoGroupPermissionAll': 'repo_group:%s' % self.repo_group_name,
'HasRepoGroupPermissionAny': 'repo_group:%s' % self.repo_group_name,
'HasUserGroupPermissionAll': 'user_group:%s' % self.user_group_name,
'HasUserGroupPermissionAny': 'user_group:%s' % self.user_group_name,
}.get(cls_name, '?:%s' % cls_name)
def check_permissions(self, user):
"""Dummy function for overriding"""
raise Exception('You have to write this function in child class')
class HasPermissionAll(PermsFunction):
def check_permissions(self, user):
perms = user.permissions_with_scope({})
if self.required_perms.issubset(perms.get('global')):
return True
return False
class HasPermissionAny(PermsFunction):
def check_permissions(self, user):
perms = user.permissions_with_scope({})
if self.required_perms.intersection(perms.get('global')):
return True
return False
class HasRepoPermissionAll(PermsFunction):
def __call__(self, repo_name=None, check_location='', user=None):
self.repo_name = repo_name
return super(HasRepoPermissionAll, self).__call__(check_location, user)
auth: make the perms decorators and function pyramid compatible.
r1494 def _get_repo_name(self):
project: added all source files and assets
r1 if not self.repo_name:
auth: make the perms decorators and function pyramid compatible.
r1494 _request = self._get_request()
self.repo_name = get_repo_slug(_request)
return self.repo_name
project: added all source files and assets
r1
auth: make the perms decorators and function pyramid compatible.
r1494 def check_permissions(self, user):
self.repo_name = self._get_repo_name()
project: added all source files and assets
r1 perms = user.permissions
try:
auth: code cleanup, use set literals for py3 compat
r2821 user_perms = {perms['repositories'][self.repo_name]}
project: added all source files and assets
r1 except KeyError:
return False
if self.required_perms.issubset(user_perms):
return True
return False
class HasRepoPermissionAny(PermsFunction):
def __call__(self, repo_name=None, check_location='', user=None):
self.repo_name = repo_name
return super(HasRepoPermissionAny, self).__call__(check_location, user)
auth: make the perms decorators and function pyramid compatible.
r1494 def _get_repo_name(self):
project: added all source files and assets
r1 if not self.repo_name:
auth: prepare code for removal of pylons request in pyramid migration.
r1791 _request = self._get_request()
self.repo_name = get_repo_slug(_request)
auth: make the perms decorators and function pyramid compatible.
r1494 return self.repo_name
project: added all source files and assets
r1
auth: make the perms decorators and function pyramid compatible.
r1494 def check_permissions(self, user):
self.repo_name = self._get_repo_name()
project: added all source files and assets
r1 perms = user.permissions
try:
auth: code cleanup, use set literals for py3 compat
r2821 user_perms = {perms['repositories'][self.repo_name]}
project: added all source files and assets
r1 except KeyError:
return False
if self.required_perms.intersection(user_perms):
return True
return False
class HasRepoGroupPermissionAny(PermsFunction):
auth: auth code changes for python3
r5080
project: added all source files and assets
r1 def __call__(self, group_name=None, check_location='', user=None):
self.repo_group_name = group_name
auth: reduced usage of raw auth calls inside templates
r3587 return super(HasRepoGroupPermissionAny, self).__call__(check_location, user)
project: added all source files and assets
r1
def check_permissions(self, user):
perms = user.permissions
try:
auth: code cleanup, use set literals for py3 compat
r2821 user_perms = {perms['repositories_groups'][self.repo_group_name]}
project: added all source files and assets
r1 except KeyError:
return False
if self.required_perms.intersection(user_perms):
return True
return False
class HasRepoGroupPermissionAll(PermsFunction):
def __call__(self, group_name=None, check_location='', user=None):
self.repo_group_name = group_name
auth: reduced usage of raw auth calls inside templates
r3587 return super(HasRepoGroupPermissionAll, self).__call__(check_location, user)
project: added all source files and assets
r1
def check_permissions(self, user):
perms = user.permissions
try:
auth: code cleanup, use set literals for py3 compat
r2821 user_perms = {perms['repositories_groups'][self.repo_group_name]}
project: added all source files and assets
r1 except KeyError:
return False
if self.required_perms.issubset(user_perms):
return True
return False
class HasUserGroupPermissionAny(PermsFunction):
def __call__(self, user_group_name=None, check_location='', user=None):
self.user_group_name = user_group_name
auth: reduced usage of raw auth calls inside templates
r3587 return super(HasUserGroupPermissionAny, self).__call__(check_location, user)
project: added all source files and assets
r1
def check_permissions(self, user):
perms = user.permissions
try:
auth: code cleanup, use set literals for py3 compat
r2821 user_perms = {perms['user_groups'][self.user_group_name]}
project: added all source files and assets
r1 except KeyError:
return False
if self.required_perms.intersection(user_perms):
return True
return False
class HasUserGroupPermissionAll(PermsFunction):
def __call__(self, user_group_name=None, check_location='', user=None):
self.user_group_name = user_group_name
auth: reduced usage of raw auth calls inside templates
r3587 return super(HasUserGroupPermissionAll, self).__call__(check_location, user)
project: added all source files and assets
r1
def check_permissions(self, user):
perms = user.permissions
try:
auth: code cleanup, use set literals for py3 compat
r2821 user_perms = {perms['user_groups'][self.user_group_name]}
project: added all source files and assets
r1 except KeyError:
return False
if self.required_perms.issubset(user_perms):
return True
return False
# SPECIAL VERSION TO HANDLE MIDDLEWARE AUTH
class HasPermissionAnyMiddleware(object):
def __init__(self, *perms):
self.required_perms = set(perms)
branch-permissions: handle vcs operations and branch permissions....
r2979 def __call__(self, auth_user, repo_name):
FOLD: into unicode changes
r4959 # # repo_name MUST be unicode, since we handle keys in permission
# # dict by unicode
#TODO: verify
auth: auth code changes for python3
r5080 # repo_name = safe_str(repo_name)
FOLD: into unicode changes
r4959
project: added all source files and assets
r1 log.debug(
'Checking VCS protocol permissions %s for user:%s repo:`%s`',
branch-permissions: handle vcs operations and branch permissions....
r2979 self.required_perms, auth_user, repo_name)
if self.check_permissions(auth_user, repo_name):
project: added all source files and assets
r1 log.debug('Permission to repo:`%s` GRANTED for user:%s @ %s',
branch-permissions: handle vcs operations and branch permissions....
r2979 repo_name, auth_user, 'PermissionMiddleware')
project: added all source files and assets
r1 return True
else:
log.debug('Permission to repo:`%s` DENIED for user:%s @ %s',
branch-permissions: handle vcs operations and branch permissions....
r2979 repo_name, auth_user, 'PermissionMiddleware')
project: added all source files and assets
r1 return False
def check_permissions(self, user, repo_name):
perms = user.permissions_with_scope({'repo_name': repo_name})
try:
auth: code cleanup, use set literals for py3 compat
r2821 user_perms = {perms['repositories'][repo_name]}
project: added all source files and assets
r1 except Exception:
log.exception('Error while accessing user permissions')
return False
if self.required_perms.intersection(user_perms):
return True
return False
# SPECIAL VERSION TO HANDLE API AUTH
class _BaseApiPerm(object):
def __init__(self, *perms):
self.required_perms = set(perms)
def __call__(self, check_location=None, user=None, repo_name=None,
group_name=None, user_group_name=None):
cls_name = self.__class__.__name__
check_scope = 'global:%s' % (self.required_perms,)
if repo_name:
check_scope += ', repo_name:%s' % (repo_name,)
if group_name:
check_scope += ', repo_group_name:%s' % (group_name,)
if user_group_name:
check_scope += ', user_group_name:%s' % (user_group_name,)
logging: use lazy parameter evaluation in log calls.
r3061 log.debug('checking cls:%s %s %s @ %s',
cls_name, self.required_perms, check_scope, check_location)
project: added all source files and assets
r1 if not user:
log.debug('Empty User passed into arguments')
return False
# process user
if not isinstance(user, AuthUser):
user = AuthUser(user.user_id)
if not check_location:
check_location = 'unspecified'
if self.check_permissions(user.permissions, repo_name, group_name,
user_group_name):
log.debug('Permission to repo:`%s` GRANTED for user:`%s` @ %s',
check_scope, user, check_location)
return True
else:
log.debug('Permission to repo:`%s` DENIED for user:`%s` @ %s',
check_scope, user, check_location)
return False
def check_permissions(self, perm_defs, repo_name=None, group_name=None,
user_group_name=None):
"""
implement in child class should return True if permissions are ok,
False otherwise
:param perm_defs: dict with permission definitions
:param repo_name: repo name
"""
raise NotImplementedError()
class HasPermissionAllApi(_BaseApiPerm):
def check_permissions(self, perm_defs, repo_name=None, group_name=None,
user_group_name=None):
if self.required_perms.issubset(perm_defs.get('global')):
return True
return False
class HasPermissionAnyApi(_BaseApiPerm):
def check_permissions(self, perm_defs, repo_name=None, group_name=None,
user_group_name=None):
if self.required_perms.intersection(perm_defs.get('global')):
return True
return False
class HasRepoPermissionAllApi(_BaseApiPerm):
def check_permissions(self, perm_defs, repo_name=None, group_name=None,
user_group_name=None):
try:
auth: code cleanup, use set literals for py3 compat
r2821 _user_perms = {perm_defs['repositories'][repo_name]}
project: added all source files and assets
r1 except KeyError:
log.warning(traceback.format_exc())
return False
if self.required_perms.issubset(_user_perms):
return True
return False
class HasRepoPermissionAnyApi(_BaseApiPerm):
def check_permissions(self, perm_defs, repo_name=None, group_name=None,
user_group_name=None):
try:
auth: code cleanup, use set literals for py3 compat
r2821 _user_perms = {perm_defs['repositories'][repo_name]}
project: added all source files and assets
r1 except KeyError:
log.warning(traceback.format_exc())
return False
if self.required_perms.intersection(_user_perms):
return True
return False
class HasRepoGroupPermissionAnyApi(_BaseApiPerm):
def check_permissions(self, perm_defs, repo_name=None, group_name=None,
user_group_name=None):
try:
auth: code cleanup, use set literals for py3 compat
r2821 _user_perms = {perm_defs['repositories_groups'][group_name]}
project: added all source files and assets
r1 except KeyError:
log.warning(traceback.format_exc())
return False
if self.required_perms.intersection(_user_perms):
return True
return False
class HasRepoGroupPermissionAllApi(_BaseApiPerm):
def check_permissions(self, perm_defs, repo_name=None, group_name=None,
user_group_name=None):
try:
auth: code cleanup, use set literals for py3 compat
r2821 _user_perms = {perm_defs['repositories_groups'][group_name]}
project: added all source files and assets
r1 except KeyError:
log.warning(traceback.format_exc())
return False
if self.required_perms.issubset(_user_perms):
return True
return False
class HasUserGroupPermissionAnyApi(_BaseApiPerm):
def check_permissions(self, perm_defs, repo_name=None, group_name=None,
user_group_name=None):
try:
auth: code cleanup, use set literals for py3 compat
r2821 _user_perms = {perm_defs['user_groups'][user_group_name]}
project: added all source files and assets
r1 except KeyError:
log.warning(traceback.format_exc())
return False
if self.required_perms.intersection(_user_perms):
return True
return False
def check_ip_access(source_ip, allowed_ips=None):
"""
Checks if source_ip is a subnet of any of allowed_ips.
:param source_ip:
:param allowed_ips: list of allowed ips together with mask
"""
logging: use lazy parameter evaluation in log calls.
r3061 log.debug('checking if ip:%s is subnet of %s', source_ip, allowed_ips)
FOLD: into unicode changes
r4959 source_ip_address = ipaddress.ip_address(source_ip)
project: added all source files and assets
r1 if isinstance(allowed_ips, (tuple, list, set)):
for ip in allowed_ips:
FOLD: into unicode changes
r4959 #TODO: verify
auth: auth code changes for python3
r5080 #ip = safe_str(ip)
project: added all source files and assets
r1 try:
network_address = ipaddress.ip_network(ip, strict=False)
if source_ip_address in network_address:
logging: use lazy parameter evaluation in log calls.
r3061 log.debug('IP %s is network %s', source_ip_address, network_address)
project: added all source files and assets
r1 return True
# for any case we cannot determine the IP, don't crash just
# skip it and log as error, we want to say forbidden still when
# sending bad IP
except Exception:
log.error(traceback.format_exc())
continue
return False
def get_cython_compat_decorator(wrapper, func):
"""
Creates a cython compatible decorator. The previously used
decorator.decorator() function seems to be incompatible with cython.
:param wrapper: __wrapper method of the decorator class
:param func: decorated function
"""
@wraps(func)
def local_wrapper(*args, **kwds):
return wrapper(func, *args, **kwds)
local_wrapper.__wrapped__ = func
return local_wrapper
core: properly handle new redirections set in decorators....
r1499