rhodecode/api/views/user_group_api.py

# Copyright (C) 2011-2023 RhodeCode GmbH
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License, version 3
# (only), as published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
#
# This program is dual-licensed. If you wish to learn more about the
# RhodeCode Enterprise Edition, including its added features, Support services,
# and proprietary license terms, please see https://rhodecode.com/licenses/

import logging

from rhodecode.api import (
    jsonrpc_method, JSONRPCError, JSONRPCForbidden, JSONRPCValidationError)
from rhodecode.api.utils import (
    Optional, OAttr, store_update, has_superadmin_permission, get_origin,
    get_user_or_error, get_user_group_or_error, get_perm_or_error)
from rhodecode.lib import audit_logger
from rhodecode.lib.auth import HasUserGroupPermissionAnyApi, HasPermissionAnyApi
from rhodecode.lib.exceptions import UserGroupAssignedException
from rhodecode.model.db import Session
from rhodecode.model.permission import PermissionModel
from rhodecode.model.scm import UserGroupList
from rhodecode.model.user_group import UserGroupModel
from rhodecode.model import validation_schema
from rhodecode.model.validation_schema.schemas import user_group_schema

log = logging.getLogger(__name__)


@jsonrpc_method()
def get_user_group(request, apiuser, usergroupid):
    """
    Returns the data of an existing user group.

    This command can only be run using an |authtoken| with admin rights to
    the specified repository.

    :param apiuser: This is filled automatically from the |authtoken|.
    :type apiuser: AuthUser
    :param usergroupid: Set the user group from which to return data.
    :type usergroupid: str or int

    Example error output:

    .. code-block:: bash

        {
          "error": null,
          "id": <id>,
          "result": {
            "active": true,
            "group_description": "group description",
            "group_name": "group name",
            "permissions": [
              {
                "name": "owner-name",
                "origin": "owner",
                "permission": "usergroup.admin",
                "type": "user"
              },
              {
              {
                "name": "user name",
                "origin": "permission",
                "permission": "usergroup.admin",
                "type": "user"
              },
              {
                "name": "user group name",
                "origin": "permission",
                "permission": "usergroup.write",
                "type": "user_group"
              }
            ],
            "permissions_summary": {
              "repositories": {
                "aa-root-level-repo-1": "repository.admin"
              },
              "repositories_groups": {}
            },
            "owner": "owner name",
            "users": [],
            "users_group_id": 2
          }
        }

    """

    user_group = get_user_group_or_error(usergroupid)
    if not has_superadmin_permission(apiuser):
        # check if we have at least read permission for this user group !
        _perms = ('usergroup.read', 'usergroup.write', 'usergroup.admin',)
        if not HasUserGroupPermissionAnyApi(*_perms)(
                user=apiuser, user_group_name=user_group.users_group_name):
            raise JSONRPCError('user group `{}` does not exist'.format(
                usergroupid))

    permissions = []
    for _user in user_group.permissions():
        user_data = {
            'name': _user.username,
            'permission': _user.permission,
            'origin': get_origin(_user),
            'type': "user",
        }
        permissions.append(user_data)

    for _user_group in user_group.permission_user_groups():
        user_group_data = {
            'name': _user_group.users_group_name,
            'permission': _user_group.permission,
            'origin': get_origin(_user_group),
            'type': "user_group",
        }
        permissions.append(user_group_data)

    data = user_group.get_api_data()
    data["permissions"] = permissions
    data["permissions_summary"] = UserGroupModel().get_perms_summary(
        user_group.users_group_id)
    return data


@jsonrpc_method()
def get_user_groups(request, apiuser):
    """
    Lists all the existing user groups within RhodeCode.

    This command can only be run using an |authtoken| with admin rights to
    the specified repository.

    This command takes the following options:

    :param apiuser: This is filled automatically from the |authtoken|.
    :type apiuser: AuthUser

    Example error output:

    .. code-block:: bash

        id : <id_given_in_input>
        result : [<user_group_obj>,...]
        error : null
    """

    include_secrets = has_superadmin_permission(apiuser)

    result = []
    _perms = ('usergroup.read', 'usergroup.write', 'usergroup.admin',)
    extras = {'user': apiuser}
    for user_group in UserGroupList(UserGroupModel().get_all(),
                                    perm_set=_perms, extra_kwargs=extras):
        result.append(
            user_group.get_api_data(include_secrets=include_secrets))
    return result


@jsonrpc_method()
def create_user_group(
        request, apiuser, group_name, description=Optional(''),
        owner=Optional(OAttr('apiuser')), active=Optional(True),
        sync=Optional(None)):
    """
    Creates a new user group.

    This command can only be run using an |authtoken| with admin rights to
    the specified repository.

    This command takes the following options:

    :param apiuser: This is filled automatically from the |authtoken|.
    :type apiuser: AuthUser
    :param group_name: Set the name of the new user group.
    :type group_name: str
    :param description: Give a description of the new user group.
    :type description: str
    :param owner: Set the owner of the new user group.
        If not set, the owner is the |authtoken| user.
    :type owner: Optional(str or int)
    :param active: Set this group as active.
    :type active: Optional(``True`` | ``False``)
    :param sync: Set enabled or disabled the automatically sync from
        external authentication types like ldap. If User Group will be named like
        one from e.g ldap and sync flag is enabled members will be synced automatically.
        Sync type when enabled via API is set to `manual_api`
    :type sync: Optional(``True`` | ``False``)

    Example output:

    .. code-block:: bash

        id : <id_given_in_input>
        result: {
                  "msg": "created new user group `<groupname>`",
                  "user_group": <user_group_object>
                }
        error:  null

    Example error output:

    .. code-block:: bash

      id : <id_given_in_input>
      result : null
      error :  {
        "user group `<group name>` already exist"
        or
        "failed to create group `<group name>`"
      }

    """

    if not has_superadmin_permission(apiuser):
        if not HasPermissionAnyApi('hg.usergroup.create.true')(user=apiuser):
            raise JSONRPCForbidden()

    if UserGroupModel().get_by_name(group_name):
        raise JSONRPCError(f"user group `{group_name}` already exist")

    if isinstance(owner, Optional):
        owner = apiuser.user_id

    owner = get_user_or_error(owner)
    active = Optional.extract(active)
    description = Optional.extract(description)
    sync = Optional.extract(sync)

    # set the sync option based on group_data
    group_data = None
    if sync:
        group_data = {
            'extern_type': 'manual_api',
            'extern_type_set_by': apiuser.username
        }

    schema = user_group_schema.UserGroupSchema().bind(
        # user caller
        user=apiuser)
    try:
        schema_data = schema.deserialize(dict(
            user_group_name=group_name,
            user_group_description=description,
            user_group_owner=owner.username,
            user_group_active=active,
            ))
    except validation_schema.Invalid as err:
        raise JSONRPCValidationError(colander_exc=err)

    try:
        user_group = UserGroupModel().create(
            name=schema_data['user_group_name'],
            description=schema_data['user_group_description'],
            owner=owner,
            active=schema_data['user_group_active'], group_data=group_data)
        Session().flush()
        creation_data = user_group.get_api_data()
        audit_logger.store_api(
            'user_group.create', action_data={'data': creation_data},
            user=apiuser)
        Session().commit()

        affected_user_ids = [apiuser.user_id, owner.user_id]
        PermissionModel().trigger_permission_flush(affected_user_ids)

        return {
            'msg': 'created new user group `%s`' % group_name,
            'user_group': creation_data
        }
    except Exception:
        log.exception("Error occurred during creation of user group")
        raise JSONRPCError(f'failed to create group `{group_name}`')


@jsonrpc_method()
def update_user_group(request, apiuser, usergroupid, group_name=Optional(''),
                      description=Optional(''), owner=Optional(None),
                      active=Optional(True), sync=Optional(None)):
    """
    Updates the specified `user group` with the details provided.

    This command can only be run using an |authtoken| with admin rights to
    the specified repository.

    :param apiuser: This is filled automatically from the |authtoken|.
    :type apiuser: AuthUser
    :param usergroupid: Set the id of the `user group` to update.
    :type usergroupid: str or int
    :param group_name: Set the new name the `user group`
    :type group_name: str
    :param description: Give a description for the `user group`
    :type description: str
    :param owner: Set the owner of the `user group`.
    :type owner: Optional(str or int)
    :param active: Set the group as active.
    :type active: Optional(``True`` | ``False``)
    :param sync: Set enabled or disabled the automatically sync from
        external authentication types like ldap. If User Group will be named like
        one from e.g ldap and sync flag is enabled members will be synced automatically.
        Sync type when enabled via API is set to `manual_api`
    :type sync: Optional(``True`` | ``False``)

    Example output:

    .. code-block:: bash

      id : <id_given_in_input>
      result : {
        "msg": 'updated user group ID:<user group id> <user group name>',
        "user_group": <user_group_object>
      }
      error :  null

    Example error output:

    .. code-block:: bash

      id : <id_given_in_input>
      result : null
      error :  {
        "failed to update user group `<user group name>`"
      }

    """

    user_group = get_user_group_or_error(usergroupid)
    include_secrets = False
    if not has_superadmin_permission(apiuser):
        # check if we have admin permission for this user group !
        _perms = ('usergroup.admin',)
        if not HasUserGroupPermissionAnyApi(*_perms)(
                user=apiuser, user_group_name=user_group.users_group_name):
            raise JSONRPCError(
                f'user group `{usergroupid}` does not exist')
    else:
        include_secrets = True

    if not isinstance(owner, Optional):
        owner = get_user_or_error(owner)

    old_data = user_group.get_api_data()
    updates = {}
    store_update(updates, group_name, 'users_group_name')
    store_update(updates, description, 'user_group_description')
    store_update(updates, owner, 'user')
    store_update(updates, active, 'users_group_active')

    sync = Optional.extract(sync)
    group_data = None
    if sync is True:
        group_data = {
            'extern_type': 'manual_api',
            'extern_type_set_by': apiuser.username
        }
    if sync is False:
        group_data = user_group.group_data
        if group_data and "extern_type" in group_data:
            del group_data["extern_type"]

    try:
        UserGroupModel().update(user_group, updates, group_data=group_data)
        audit_logger.store_api(
            'user_group.edit', action_data={'old_data': old_data},
            user=apiuser)
        Session().commit()
        return {
            'msg': 'updated user group ID:{} {}'.format(
                user_group.users_group_id, user_group.users_group_name),
            'user_group': user_group.get_api_data(
                include_secrets=include_secrets)
        }
    except Exception:
        log.exception("Error occurred during update of user group")
        raise JSONRPCError(
            f'failed to update user group `{usergroupid}`')


@jsonrpc_method()
def delete_user_group(request, apiuser, usergroupid):
    """
    Deletes the specified `user group`.

    This command can only be run using an |authtoken| with admin rights to
    the specified repository.

    This command takes the following options:

    :param apiuser: filled automatically from apikey
    :type apiuser: AuthUser
    :param usergroupid:
    :type usergroupid: int

    Example output:

    .. code-block:: bash

      id : <id_given_in_input>
      result : {
        "msg": "deleted user group ID:<user_group_id> <user_group_name>"
      }
      error :  null

    Example error output:

    .. code-block:: bash

      id : <id_given_in_input>
      result : null
      error :  {
        "failed to delete user group ID:<user_group_id> <user_group_name>"
        or
        "RepoGroup assigned to <repo_groups_list>"
      }

    """

    user_group = get_user_group_or_error(usergroupid)
    if not has_superadmin_permission(apiuser):
        # check if we have admin permission for this user group !
        _perms = ('usergroup.admin',)
        if not HasUserGroupPermissionAnyApi(*_perms)(
                user=apiuser, user_group_name=user_group.users_group_name):
            raise JSONRPCError(
                f'user group `{usergroupid}` does not exist')

    old_data = user_group.get_api_data()
    try:
        UserGroupModel().delete(user_group)
        audit_logger.store_api(
            'user_group.delete', action_data={'old_data': old_data},
            user=apiuser)
        Session().commit()
        return {
            'msg': 'deleted user group ID:{} {}'.format(
                user_group.users_group_id, user_group.users_group_name),
            'user_group': None
        }
    except UserGroupAssignedException as e:
        log.exception("UserGroupAssigned error")
        raise JSONRPCError(str(e))
    except Exception:
        log.exception("Error occurred during deletion of user group")
        raise JSONRPCError(
            'failed to delete user group ID:%s %s' %(
                user_group.users_group_id, user_group.users_group_name))


@jsonrpc_method()
def add_user_to_user_group(request, apiuser, usergroupid, userid):
    """
    Adds a user to a `user group`. If the user already exists in the group
    this command will return false.

    This command can only be run using an |authtoken| with admin rights to
    the specified user group.

    This command takes the following options:

    :param apiuser: This is filled automatically from the |authtoken|.
    :type apiuser: AuthUser
    :param usergroupid: Set the name of the `user group` to which a
        user will be added.
    :type usergroupid: int
    :param userid: Set the `user_id` of the user to add to the group.
    :type userid: int

    Example output:

    .. code-block:: bash

      id : <id_given_in_input>
      result : {
          "success": True|False # depends on if member is in group
          "msg": "added member `<username>` to user group `<groupname>` |
                  User is already in that group"

      }
      error :  null

    Example error output:

    .. code-block:: bash

      id : <id_given_in_input>
      result : null
      error :  {
        "failed to add member to user group `<user_group_name>`"
      }

    """

    user = get_user_or_error(userid)
    user_group = get_user_group_or_error(usergroupid)
    if not has_superadmin_permission(apiuser):
        # check if we have admin permission for this user group !
        _perms = ('usergroup.admin',)
        if not HasUserGroupPermissionAnyApi(*_perms)(
                user=apiuser, user_group_name=user_group.users_group_name):
            raise JSONRPCError('user group `{}` does not exist'.format(
                usergroupid))

    old_values = user_group.get_api_data()
    try:
        ugm = UserGroupModel().add_user_to_group(user_group, user)
        success = True if ugm is not True else False
        msg = 'added member `{}` to user group `{}`'.format(
            user.username, user_group.users_group_name
        )
        msg = msg if success else 'User is already in that group'
        if success:
            user_data = user.get_api_data()
            audit_logger.store_api(
                'user_group.edit.member.add',
                action_data={'user': user_data, 'old_data': old_values},
                user=apiuser)

        Session().commit()

        return {
            'success': success,
            'msg': msg
        }
    except Exception:
        log.exception("Error occurred during adding a member to user group")
        raise JSONRPCError(
            'failed to add member to user group `{}`'.format(
                user_group.users_group_name,
            )
        )


@jsonrpc_method()
def remove_user_from_user_group(request, apiuser, usergroupid, userid):
    """
    Removes a user from a user group.

    * If the specified user is not in the group, this command will return
      `false`.

    This command can only be run using an |authtoken| with admin rights to
    the specified user group.

    :param apiuser: This is filled automatically from the |authtoken|.
    :type apiuser: AuthUser
    :param usergroupid: Sets the user group name.
    :type usergroupid: str or int
    :param userid: The user you wish to remove from |RCE|.
    :type userid: str or int

    Example output:

    .. code-block:: bash

        id : <id_given_in_input>
        result: {
                  "success":  True|False,  # depends on if member is in group
                  "msg": "removed member <username> from user group <groupname> |
                          User wasn't in group"
                }
        error:  null

    """

    user = get_user_or_error(userid)
    user_group = get_user_group_or_error(usergroupid)
    if not has_superadmin_permission(apiuser):
        # check if we have admin permission for this user group !
        _perms = ('usergroup.admin',)
        if not HasUserGroupPermissionAnyApi(*_perms)(
                user=apiuser, user_group_name=user_group.users_group_name):
            raise JSONRPCError(
                f'user group `{usergroupid}` does not exist')

    old_values = user_group.get_api_data()
    try:
        success = UserGroupModel().remove_user_from_group(user_group, user)
        msg = 'removed member `{}` from user group `{}`'.format(
            user.username, user_group.users_group_name
        )
        msg = msg if success else "User wasn't in group"
        if success:
            user_data = user.get_api_data()
            audit_logger.store_api(
                'user_group.edit.member.delete',
                action_data={'user': user_data, 'old_data': old_values},
                user=apiuser)

        Session().commit()
        return {'success': success, 'msg': msg}
    except Exception:
        log.exception("Error occurred during removing an member from user group")
        raise JSONRPCError(
            'failed to remove member from user group `{}`'.format(
                user_group.users_group_name,
            )
        )


@jsonrpc_method()
def grant_user_permission_to_user_group(
        request, apiuser, usergroupid, userid, perm):
    """
    Set permissions for a user in a user group.

    :param apiuser: This is filled automatically from the |authtoken|.
    :type apiuser: AuthUser
    :param usergroupid: Set the user group to edit permissions on.
    :type usergroupid: str or int
    :param userid: Set the user from whom you wish to set permissions.
    :type userid: str
    :param perm: (usergroup.(none|read|write|admin))
    :type perm: str

    Example output:

    .. code-block:: bash

      id : <id_given_in_input>
      result : {
        "msg": "Granted perm: `<perm_name>` for user: `<username>` in user group: `<user_group_name>`",
        "success": true
      }
      error :  null
    """

    user_group = get_user_group_or_error(usergroupid)

    if not has_superadmin_permission(apiuser):
        # check if we have admin permission for this user group !
        _perms = ('usergroup.admin',)
        if not HasUserGroupPermissionAnyApi(*_perms)(
                user=apiuser, user_group_name=user_group.users_group_name):
            raise JSONRPCError(
                f'user group `{usergroupid}` does not exist')

    user = get_user_or_error(userid)
    perm = get_perm_or_error(perm, prefix='usergroup.')

    try:
        changes = UserGroupModel().grant_user_permission(
            user_group=user_group, user=user, perm=perm)

        action_data = {
            'added': changes['added'],
            'updated': changes['updated'],
            'deleted': changes['deleted'],
        }
        audit_logger.store_api(
            'user_group.edit.permissions', action_data=action_data,
            user=apiuser)
        Session().commit()
        PermissionModel().flush_user_permission_caches(changes)

        return {
            'msg':
                'Granted perm: `{}` for user: `{}` in user group: `{}`'.format(
                    perm.permission_name, user.username,
                    user_group.users_group_name
                ),
            'success': True
        }
    except Exception:
        log.exception("Error occurred during editing permissions "
                      "for user in user group")
        raise JSONRPCError(
            'failed to edit permission for user: '
            '`%s` in user group: `%s`' % (
                userid, user_group.users_group_name))


@jsonrpc_method()
def revoke_user_permission_from_user_group(
        request, apiuser, usergroupid, userid):
    """
    Revoke a users permissions in a user group.

    :param apiuser: This is filled automatically from the |authtoken|.
    :type apiuser: AuthUser
    :param usergroupid: Set the user group from which to revoke the user
        permissions.
    :type: usergroupid: str or int
    :param userid: Set the userid of the user whose permissions will be
        revoked.
    :type userid: str

    Example output:

    .. code-block:: bash

      id : <id_given_in_input>
      result : {
        "msg": "Revoked perm for user: `<username>` in user group: `<user_group_name>`",
        "success": true
      }
      error :  null
    """

    user_group = get_user_group_or_error(usergroupid)

    if not has_superadmin_permission(apiuser):
        # check if we have admin permission for this user group !
        _perms = ('usergroup.admin',)
        if not HasUserGroupPermissionAnyApi(*_perms)(
                user=apiuser, user_group_name=user_group.users_group_name):
            raise JSONRPCError(
                f'user group `{usergroupid}` does not exist')

    user = get_user_or_error(userid)

    try:
        changes = UserGroupModel().revoke_user_permission(
            user_group=user_group, user=user)
        action_data = {
            'added': changes['added'],
            'updated': changes['updated'],
            'deleted': changes['deleted'],
        }
        audit_logger.store_api(
            'user_group.edit.permissions', action_data=action_data,
            user=apiuser)
        Session().commit()
        PermissionModel().flush_user_permission_caches(changes)

        return {
            'msg': 'Revoked perm for user: `{}` in user group: `{}`'.format(
                user.username, user_group.users_group_name
            ),
            'success': True
        }
    except Exception:
        log.exception("Error occurred during editing permissions "
                      "for user in user group")
        raise JSONRPCError(
            'failed to edit permission for user: `%s` in user group: `%s`'
            % (userid, user_group.users_group_name))


@jsonrpc_method()
def grant_user_group_permission_to_user_group(
        request, apiuser, usergroupid, sourceusergroupid, perm):
    """
    Give one user group permissions to another user group.

    :param apiuser: This is filled automatically from the |authtoken|.
    :type apiuser: AuthUser
    :param usergroupid: Set the user group on which to edit permissions.
    :type usergroupid: str or int
    :param sourceusergroupid: Set the source user group to which
        access/permissions will be granted.
    :type sourceusergroupid: str or int
    :param perm: (usergroup.(none|read|write|admin))
    :type perm: str

    Example output:

    .. code-block:: bash

      id : <id_given_in_input>
      result : {
        "msg": "Granted perm: `<perm_name>` for user group: `<source_user_group_name>` in user group: `<user_group_name>`",
        "success": true
      }
      error :  null
    """

    user_group = get_user_group_or_error(sourceusergroupid)
    target_user_group = get_user_group_or_error(usergroupid)
    perm = get_perm_or_error(perm, prefix='usergroup.')

    if not has_superadmin_permission(apiuser):
        # check if we have admin permission for this user group !
        _perms = ('usergroup.admin',)
        if not HasUserGroupPermissionAnyApi(*_perms)(
                user=apiuser,
                user_group_name=target_user_group.users_group_name):
            raise JSONRPCError(
                f'to user group `{usergroupid}` does not exist')

        # check if we have at least read permission for source user group !
        _perms = ('usergroup.read', 'usergroup.write', 'usergroup.admin',)
        if not HasUserGroupPermissionAnyApi(*_perms)(
                user=apiuser, user_group_name=user_group.users_group_name):
            raise JSONRPCError(
                f'user group `{sourceusergroupid}` does not exist')

    try:
        changes = UserGroupModel().grant_user_group_permission(
            target_user_group=target_user_group,
            user_group=user_group, perm=perm)

        action_data = {
            'added': changes['added'],
            'updated': changes['updated'],
            'deleted': changes['deleted'],
        }
        audit_logger.store_api(
            'user_group.edit.permissions', action_data=action_data,
            user=apiuser)
        Session().commit()
        PermissionModel().flush_user_permission_caches(changes)

        return {
            'msg': 'Granted perm: `%s` for user group: `%s` '
                   'in user group: `%s`' % (
                       perm.permission_name, user_group.users_group_name,
                       target_user_group.users_group_name
                   ),
            'success': True
        }
    except Exception:
        log.exception("Error occurred during editing permissions "
                      "for user group in user group")
        raise JSONRPCError(
            'failed to edit permission for user group: `%s` in '
            'user group: `%s`' % (
                sourceusergroupid, target_user_group.users_group_name
            )
        )


@jsonrpc_method()
def revoke_user_group_permission_from_user_group(
        request, apiuser, usergroupid, sourceusergroupid):
    """
    Revoke the permissions that one user group has to another.

    :param apiuser: This is filled automatically from the |authtoken|.
    :type apiuser: AuthUser
    :param usergroupid: Set the user group on which to edit permissions.
    :type usergroupid: str or int
    :param sourceusergroupid: Set the user group from which permissions
        are revoked.
    :type sourceusergroupid: str or int

    Example output:

    .. code-block:: bash

      id : <id_given_in_input>
      result : {
        "msg": "Revoked perm for user group: `<user_group_name>` in user group: `<target_user_group_name>`",
        "success": true
      }
      error :  null
    """

    user_group = get_user_group_or_error(sourceusergroupid)
    target_user_group = get_user_group_or_error(usergroupid)

    if not has_superadmin_permission(apiuser):
        # check if we have admin permission for this user group !
        _perms = ('usergroup.admin',)
        if not HasUserGroupPermissionAnyApi(*_perms)(
                user=apiuser,
                user_group_name=target_user_group.users_group_name):
            raise JSONRPCError(
                f'to user group `{usergroupid}` does not exist')

        # check if we have at least read permission
        # for the source user group !
        _perms = ('usergroup.read', 'usergroup.write', 'usergroup.admin',)
        if not HasUserGroupPermissionAnyApi(*_perms)(
                user=apiuser, user_group_name=user_group.users_group_name):
            raise JSONRPCError(
                f'user group `{sourceusergroupid}` does not exist')

    try:
        changes = UserGroupModel().revoke_user_group_permission(
            target_user_group=target_user_group, user_group=user_group)
        action_data = {
            'added': changes['added'],
            'updated': changes['updated'],
            'deleted': changes['deleted'],
        }
        audit_logger.store_api(
            'user_group.edit.permissions', action_data=action_data,
            user=apiuser)
        Session().commit()
        PermissionModel().flush_user_permission_caches(changes)

        return {
            'msg': 'Revoked perm for user group: '
                   '`%s` in user group: `%s`' % (
                       user_group.users_group_name,
                       target_user_group.users_group_name
                   ),
            'success': True
        }
    except Exception:
        log.exception("Error occurred during editing permissions "
                      "for user group in user group")
        raise JSONRPCError(
            'failed to edit permission for user group: '
            '`%s` in user group: `%s`' % (
                sourceusergroupid, target_user_group.users_group_name
            )
        )