diff --git a/rhodecode/api/views/repo_api.py b/rhodecode/api/views/repo_api.py --- a/rhodecode/api/views/repo_api.py +++ b/rhodecode/api/views/repo_api.py @@ -43,6 +43,7 @@ from rhodecode.model.comment import Comm from rhodecode.model.db import ( Session, ChangesetStatus, RepositoryField, Repository, RepoGroup, ChangesetComment) +from rhodecode.model.permission import PermissionModel from rhodecode.model.repo import RepoModel from rhodecode.model.scm import ScmModel, RepoList from rhodecode.model.settings import SettingsModel, VcsSettingsModel @@ -1771,8 +1772,9 @@ def grant_user_permission(request, apius } audit_logger.store_api( 'repo.edit.permissions', action_data=action_data, user=apiuser, repo=repo) + Session().commit() + PermissionModel().flush_user_permission_caches(changes) - Session().commit() return { 'msg': 'Granted perm: `%s` for user: `%s` in repo: `%s`' % ( perm.permission_name, user.username, repo.repo_name @@ -1833,8 +1835,9 @@ def revoke_user_permission(request, apiu } audit_logger.store_api( 'repo.edit.permissions', action_data=action_data, user=apiuser, repo=repo) + Session().commit() + PermissionModel().flush_user_permission_caches(changes) - Session().commit() return { 'msg': 'Revoked perm for user: `%s` in repo: `%s`' % ( user.username, repo.repo_name @@ -1919,8 +1922,9 @@ def grant_user_group_permission(request, } audit_logger.store_api( 'repo.edit.permissions', action_data=action_data, user=apiuser, repo=repo) + Session().commit() + PermissionModel().flush_user_permission_caches(changes) - Session().commit() return { 'msg': 'Granted perm: `%s` for user group: `%s` in ' 'repo: `%s`' % ( @@ -1992,8 +1996,9 @@ def revoke_user_group_permission(request } audit_logger.store_api( 'repo.edit.permissions', action_data=action_data, user=apiuser, repo=repo) + Session().commit() + PermissionModel().flush_user_permission_caches(changes) - Session().commit() return { 'msg': 'Revoked perm for user group: `%s` in repo: `%s`' % ( user_group.users_group_name, repo.repo_name diff --git a/rhodecode/api/views/repo_group_api.py b/rhodecode/api/views/repo_group_api.py --- a/rhodecode/api/views/repo_group_api.py +++ b/rhodecode/api/views/repo_group_api.py @@ -31,6 +31,7 @@ from rhodecode.lib import audit_logger from rhodecode.lib.auth import ( HasRepoGroupPermissionAnyApi, HasUserGroupPermissionAnyApi) from rhodecode.model.db import Session +from rhodecode.model.permission import PermissionModel from rhodecode.model.repo_group import RepoGroupModel from rhodecode.model.scm import RepoGroupList from rhodecode.model import validation_schema @@ -465,8 +466,9 @@ def grant_user_permission_to_repo_group( audit_logger.store_api( 'repo_group.edit.permissions', action_data=action_data, user=apiuser) + Session().commit() + PermissionModel().flush_user_permission_caches(changes) - Session().commit() return { 'msg': 'Granted perm: `%s` (recursive:%s) for user: ' '`%s` in repo group: `%s`' % ( @@ -548,8 +550,9 @@ def revoke_user_permission_from_repo_gro audit_logger.store_api( 'repo_group.edit.permissions', action_data=action_data, user=apiuser) + Session().commit() + PermissionModel().flush_user_permission_caches(changes) - Session().commit() return { 'msg': 'Revoked perm (recursive:%s) for user: ' '`%s` in repo group: `%s`' % ( @@ -641,8 +644,9 @@ def grant_user_group_permission_to_repo_ audit_logger.store_api( 'repo_group.edit.permissions', action_data=action_data, user=apiuser) + Session().commit() + PermissionModel().flush_user_permission_caches(changes) - Session().commit() return { 'msg': 'Granted perm: `%s` (recursive:%s) ' 'for user group: `%s` in repo group: `%s`' % ( @@ -733,8 +737,9 @@ def revoke_user_group_permission_from_re audit_logger.store_api( 'repo_group.edit.permissions', action_data=action_data, user=apiuser) + Session().commit() + PermissionModel().flush_user_permission_caches(changes) - Session().commit() return { 'msg': 'Revoked perm (recursive:%s) for user group: ' '`%s` in repo group: `%s`' % ( diff --git a/rhodecode/api/views/user_group_api.py b/rhodecode/api/views/user_group_api.py --- a/rhodecode/api/views/user_group_api.py +++ b/rhodecode/api/views/user_group_api.py @@ -29,6 +29,7 @@ from rhodecode.lib import audit_logger from rhodecode.lib.auth import HasUserGroupPermissionAnyApi, HasPermissionAnyApi from rhodecode.lib.exceptions import UserGroupAssignedException from rhodecode.model.db import Session +from rhodecode.model.permission import PermissionModel from rhodecode.model.scm import UserGroupList from rhodecode.model.user_group import UserGroupModel from rhodecode.model import validation_schema @@ -266,6 +267,10 @@ def create_user_group( 'user_group.create', action_data={'data': creation_data}, user=apiuser) Session().commit() + + affected_user_ids = [apiuser.user_id, owner.user_id] + PermissionModel().trigger_permission_flush(affected_user_ids) + return { 'msg': 'created new user group `%s`' % group_name, 'user_group': creation_data @@ -649,8 +654,9 @@ def grant_user_permission_to_user_group( audit_logger.store_api( 'user_group.edit.permissions', action_data=action_data, user=apiuser) + Session().commit() + PermissionModel().flush_user_permission_caches(changes) - Session().commit() return { 'msg': 'Granted perm: `%s` for user: `%s` in user group: `%s`' % ( @@ -718,8 +724,9 @@ def revoke_user_permission_from_user_gro audit_logger.store_api( 'user_group.edit.permissions', action_data=action_data, user=apiuser) + Session().commit() + PermissionModel().flush_user_permission_caches(changes) - Session().commit() return { 'msg': 'Revoked perm for user: `%s` in user group: `%s`' % ( user.username, user_group.users_group_name @@ -795,8 +802,9 @@ def grant_user_group_permission_to_user_ audit_logger.store_api( 'user_group.edit.permissions', action_data=action_data, user=apiuser) + Session().commit() + PermissionModel().flush_user_permission_caches(changes) - Session().commit() return { 'msg': 'Granted perm: `%s` for user group: `%s` ' 'in user group: `%s`' % ( @@ -873,8 +881,8 @@ def revoke_user_group_permission_from_us audit_logger.store_api( 'user_group.edit.permissions', action_data=action_data, user=apiuser) - Session().commit() + PermissionModel().flush_user_permission_caches(changes) return { 'msg': 'Revoked perm for user group: ' diff --git a/rhodecode/apps/admin/views/permissions.py b/rhodecode/apps/admin/views/permissions.py --- a/rhodecode/apps/admin/views/permissions.py +++ b/rhodecode/apps/admin/views/permissions.py @@ -142,7 +142,7 @@ class AdminPermissionsView(BaseAppView, category='error') affected_user_ids = [User.get_default_user().user_id] - events.trigger(events.UserPermissionsChange(affected_user_ids)) + PermissionModel().trigger_permission_flush(affected_user_ids) raise HTTPFound(h.route_path('admin_permissions_application')) @@ -218,7 +218,7 @@ class AdminPermissionsView(BaseAppView, category='error') affected_user_ids = [User.get_default_user().user_id] - events.trigger(events.UserPermissionsChange(affected_user_ids)) + PermissionModel().trigger_permission_flush(affected_user_ids) raise HTTPFound(h.route_path('admin_permissions_object')) @@ -320,7 +320,7 @@ class AdminPermissionsView(BaseAppView, category='error') affected_user_ids = [User.get_default_user().user_id] - events.trigger(events.UserPermissionsChange(affected_user_ids)) + PermissionModel().trigger_permission_flush(affected_user_ids) raise HTTPFound(h.route_path('admin_permissions_global')) diff --git a/rhodecode/apps/admin/views/repo_groups.py b/rhodecode/apps/admin/views/repo_groups.py --- a/rhodecode/apps/admin/views/repo_groups.py +++ b/rhodecode/apps/admin/views/repo_groups.py @@ -36,6 +36,7 @@ from rhodecode.lib.auth import ( from rhodecode.lib import helpers as h, audit_logger from rhodecode.lib.utils2 import safe_int, safe_unicode, datetime_to_time from rhodecode.model.forms import RepoGroupForm +from rhodecode.model.permission import PermissionModel from rhodecode.model.repo_group import RepoGroupModel from rhodecode.model.scm import RepoGroupList from rhodecode.model.db import ( @@ -354,7 +355,7 @@ class AdminRepoGroupsView(BaseAppView, D copy_perms = [perm['user_id'] for perm in user_group_perms] # also include those newly created by copy affected_user_ids.extend(copy_perms) - events.trigger(events.UserPermissionsChange(affected_user_ids)) + PermissionModel().trigger_permission_flush(affected_user_ids) raise HTTPFound( h.route_path('repo_group_home', diff --git a/rhodecode/apps/admin/views/repositories.py b/rhodecode/apps/admin/views/repositories.py --- a/rhodecode/apps/admin/views/repositories.py +++ b/rhodecode/apps/admin/views/repositories.py @@ -39,6 +39,7 @@ from rhodecode.lib import helpers as h from rhodecode.lib.utils import repo_name_slug from rhodecode.lib.utils2 import safe_int, safe_unicode from rhodecode.model.forms import RepoForm +from rhodecode.model.permission import PermissionModel from rhodecode.model.repo import RepoModel from rhodecode.model.scm import RepoList, RepoGroupList, ScmModel from rhodecode.model.settings import SettingsModel @@ -182,7 +183,7 @@ class AdminReposView(BaseAppView, DataGr if copy_permissions: # permission flush is done in repo creating pass - events.trigger(events.UserPermissionsChange(affected_user_ids)) + PermissionModel().trigger_permission_flush(affected_user_ids) raise HTTPFound( h.route_path('repo_creating', repo_name=repo_name, diff --git a/rhodecode/apps/admin/views/user_groups.py b/rhodecode/apps/admin/views/user_groups.py --- a/rhodecode/apps/admin/views/user_groups.py +++ b/rhodecode/apps/admin/views/user_groups.py @@ -266,6 +266,8 @@ class AdminUserGroupsView(BaseAppView, D % user_group_name, category='error') raise HTTPFound(h.route_path('user_groups_new')) - events.trigger(events.UserPermissionsChange([self._rhodecode_user.user_id])) + affected_user_ids = [self._rhodecode_user.user_id] + PermissionModel().trigger_permission_flush(affected_user_ids) + raise HTTPFound( h.route_path('edit_user_group', user_group_id=user_group_id)) diff --git a/rhodecode/apps/admin/views/users.py b/rhodecode/apps/admin/views/users.py --- a/rhodecode/apps/admin/views/users.py +++ b/rhodecode/apps/admin/views/users.py @@ -597,7 +597,7 @@ class UsersView(UserAppView): category='error') affected_user_ids = [user_id] - events.trigger(events.UserPermissionsChange(affected_user_ids)) + PermissionModel().trigger_permission_flush(affected_user_ids) raise HTTPFound(h.route_path('user_edit_global_perms', user_id=user_id)) @LoginRequired() diff --git a/rhodecode/apps/repo_group/views/repo_group_permissions.py b/rhodecode/apps/repo_group/views/repo_group_permissions.py --- a/rhodecode/apps/repo_group/views/repo_group_permissions.py +++ b/rhodecode/apps/repo_group/views/repo_group_permissions.py @@ -23,14 +23,12 @@ import logging from pyramid.view import view_config from pyramid.httpexceptions import HTTPFound -from rhodecode import events from rhodecode.apps._base import RepoGroupAppView from rhodecode.lib import helpers as h from rhodecode.lib import audit_logger from rhodecode.lib.auth import ( LoginRequired, HasRepoGroupPermissionAnyDecorator, CSRFRequired) -from rhodecode.lib.utils2 import safe_int -from rhodecode.model.db import UserGroup +from rhodecode.model.permission import PermissionModel from rhodecode.model.repo_group import RepoGroupModel from rhodecode.model.forms import RepoGroupPermsForm from rhodecode.model.meta import Session @@ -98,18 +96,7 @@ class RepoGroupPermissionsView(RepoGroup Session().commit() h.flash(_('Repository Group permissions updated'), category='success') - - affected_user_ids = [] - for change in changes['added'] + changes['updated'] + changes['deleted']: - if change['type'] == 'user': - affected_user_ids.append(change['id']) - if change['type'] == 'user_group': - user_group = UserGroup.get(safe_int(change['id'])) - if user_group: - group_members_ids = [x.user_id for x in user_group.members] - affected_user_ids.extend(group_members_ids) - - events.trigger(events.UserPermissionsChange(affected_user_ids)) + PermissionModel().flush_user_permission_caches(changes) raise HTTPFound( h.route_path('edit_repo_group_perms', diff --git a/rhodecode/apps/repo_group/views/repo_group_settings.py b/rhodecode/apps/repo_group/views/repo_group_settings.py --- a/rhodecode/apps/repo_group/views/repo_group_settings.py +++ b/rhodecode/apps/repo_group/views/repo_group_settings.py @@ -33,6 +33,7 @@ from rhodecode.lib.auth import ( LoginRequired, HasPermissionAll, HasRepoGroupPermissionAny, HasRepoGroupPermissionAnyDecorator, CSRFRequired) from rhodecode.model.db import Session, RepoGroup, User +from rhodecode.model.permission import PermissionModel from rhodecode.model.scm import RepoGroupList from rhodecode.model.repo_group import RepoGroupModel from rhodecode.model.validation_schema.schemas import repo_group_schema @@ -187,7 +188,7 @@ class RepoGroupSettingsView(RepoGroupApp owner = User.get_by_username(schema_data['repo_group_owner']) owner_id = owner.user_id if owner else self._rhodecode_user.user_id affected_user_ids.extend([self._rhodecode_user.user_id, owner_id]) - events.trigger(events.UserPermissionsChange(affected_user_ids)) + PermissionModel().trigger_permission_flush(affected_user_ids) raise HTTPFound( h.route_path('edit_repo_group', repo_group_name=new_repo_group_name)) diff --git a/rhodecode/apps/repository/views/repo_checks.py b/rhodecode/apps/repository/views/repo_checks.py --- a/rhodecode/apps/repository/views/repo_checks.py +++ b/rhodecode/apps/repository/views/repo_checks.py @@ -28,6 +28,7 @@ from rhodecode.apps._base import BaseApp from rhodecode.lib import helpers as h from rhodecode.lib.auth import (NotAnonymous, HasRepoPermissionAny) from rhodecode.model.db import Repository +from rhodecode.model.permission import PermissionModel from rhodecode.model.validation_schema.types import RepoNameType log = logging.getLogger(__name__) @@ -122,4 +123,4 @@ class RepoChecksView(BaseAppView): # repo is finished and created, we flush the permissions now user_group_perms = db_repo.permissions(expand_from_user_groups=True) affected_user_ids = [perm['user_id'] for perm in user_group_perms] - events.trigger(events.UserPermissionsChange(affected_user_ids)) + PermissionModel().trigger_permission_flush(affected_user_ids) diff --git a/rhodecode/apps/repository/views/repo_forks.py b/rhodecode/apps/repository/views/repo_forks.py --- a/rhodecode/apps/repository/views/repo_forks.py +++ b/rhodecode/apps/repository/views/repo_forks.py @@ -36,6 +36,7 @@ from rhodecode.lib.auth import ( import rhodecode.lib.helpers as h from rhodecode.lib.celerylib.utils import get_task_id from rhodecode.model.db import coalesce, or_, Repository, RepoGroup +from rhodecode.model.permission import PermissionModel from rhodecode.model.repo import RepoModel from rhodecode.model.forms import RepoForkForm from rhodecode.model.scm import ScmModel, RepoGroupList @@ -259,7 +260,7 @@ class RepoForksView(RepoAppView, DataGri # permission flush is done in repo creating pass - events.trigger(events.UserPermissionsChange(affected_user_ids)) + PermissionModel().trigger_permission_flush(affected_user_ids) raise HTTPFound( h.route_path('repo_creating', repo_name=repo_name, diff --git a/rhodecode/apps/repository/views/repo_permissions.py b/rhodecode/apps/repository/views/repo_permissions.py --- a/rhodecode/apps/repository/views/repo_permissions.py +++ b/rhodecode/apps/repository/views/repo_permissions.py @@ -23,16 +23,14 @@ import logging from pyramid.httpexceptions import HTTPFound from pyramid.view import view_config -from rhodecode import events from rhodecode.apps._base import RepoAppView from rhodecode.lib import helpers as h from rhodecode.lib import audit_logger from rhodecode.lib.auth import ( LoginRequired, HasRepoPermissionAnyDecorator, CSRFRequired) -from rhodecode.lib.utils2 import safe_int -from rhodecode.model.db import UserGroup from rhodecode.model.forms import RepoPermsForm from rhodecode.model.meta import Session +from rhodecode.model.permission import PermissionModel from rhodecode.model.repo import RepoModel log = logging.getLogger(__name__) @@ -91,17 +89,7 @@ class RepoSettingsPermissionsView(RepoAp Session().commit() h.flash(_('Repository permissions updated'), category='success') - affected_user_ids = [] - for change in changes['added'] + changes['updated'] + changes['deleted']: - if change['type'] == 'user': - affected_user_ids.append(change['id']) - if change['type'] == 'user_group': - user_group = UserGroup.get(safe_int(change['id'])) - if user_group: - group_members_ids = [x.user_id for x in user_group.members] - affected_user_ids.extend(group_members_ids) - - events.trigger(events.UserPermissionsChange(affected_user_ids)) + PermissionModel().flush_user_permission_caches(changes) raise HTTPFound( h.route_path('edit_repo_perms', repo_name=self.db_repo_name)) diff --git a/rhodecode/apps/repository/views/repo_settings.py b/rhodecode/apps/repository/views/repo_settings.py --- a/rhodecode/apps/repository/views/repo_settings.py +++ b/rhodecode/apps/repository/views/repo_settings.py @@ -33,6 +33,7 @@ from rhodecode.lib.auth import ( LoginRequired, HasRepoPermissionAnyDecorator, CSRFRequired) from rhodecode.model.db import RepositoryField, RepoGroup, Repository, User from rhodecode.model.meta import Session +from rhodecode.model.permission import PermissionModel from rhodecode.model.repo import RepoModel from rhodecode.model.scm import RepoGroupList, ScmModel from rhodecode.model.validation_schema.schemas import repo_schema @@ -184,7 +185,7 @@ class RepoSettingsView(RepoAppView): owner = User.get_by_username(schema_data['repo_owner']) owner_id = owner.user_id if owner else self._rhodecode_user.user_id affected_user_ids.extend([self._rhodecode_user.user_id, owner_id]) - events.trigger(events.UserPermissionsChange(affected_user_ids)) + PermissionModel().trigger_permission_flush(affected_user_ids) raise HTTPFound( h.route_path('edit_repo', repo_name=new_repo_name)) diff --git a/rhodecode/apps/repository/views/repo_settings_advanced.py b/rhodecode/apps/repository/views/repo_settings_advanced.py --- a/rhodecode/apps/repository/views/repo_settings_advanced.py +++ b/rhodecode/apps/repository/views/repo_settings_advanced.py @@ -34,6 +34,7 @@ from rhodecode.lib.exceptions import Att from rhodecode.lib.utils2 import safe_int from rhodecode.lib.vcs import RepositoryError from rhodecode.model.db import Session, UserFollowing, User, Repository +from rhodecode.model.permission import PermissionModel from rhodecode.model.repo import RepoModel from rhodecode.model.scm import ScmModel @@ -110,7 +111,7 @@ class RepoSettingsView(RepoAppView): # flush permissions for all users defined in permissions affected_user_ids = self._get_users_with_permissions().keys() - events.trigger(events.UserPermissionsChange(affected_user_ids)) + PermissionModel().trigger_permission_flush(affected_user_ids) raise HTTPFound(h.route_path('home')) diff --git a/rhodecode/apps/user_group/views/__init__.py b/rhodecode/apps/user_group/views/__init__.py --- a/rhodecode/apps/user_group/views/__init__.py +++ b/rhodecode/apps/user_group/views/__init__.py @@ -199,7 +199,7 @@ class UserGroupsView(UserGroupAppView): affected_user_ids.append(self._rhodecode_user.user_id) affected_user_ids.append(owner_id) - events.trigger(events.UserPermissionsChange(affected_user_ids)) + PermissionModel().trigger_permission_flush(affected_user_ids) Session().commit() except formencode.Invalid as errors: @@ -383,7 +383,7 @@ class UserGroupsView(UserGroupAppView): group_members_ids = [x.user_id for x in user_group.members] affected_user_ids.extend(group_members_ids) - events.trigger(events.UserPermissionsChange(affected_user_ids)) + PermissionModel().trigger_permission_flush(affected_user_ids) raise HTTPFound( h.route_path('edit_user_group_perms', user_group_id=user_group_id)) diff --git a/rhodecode/model/permission.py b/rhodecode/model/permission.py --- a/rhodecode/model/permission.py +++ b/rhodecode/model/permission.py @@ -28,6 +28,7 @@ import traceback from sqlalchemy.exc import DatabaseError +from rhodecode import events from rhodecode.model import BaseModel from rhodecode.model.db import ( User, Permission, UserToPerm, UserRepoToPerm, UserRepoGroupToPerm, @@ -556,3 +557,21 @@ class PermissionModel(BaseModel): self.sa.rollback() raise + def trigger_permission_flush(self, affected_user_ids): + events.trigger(events.UserPermissionsChange(affected_user_ids)) + + def flush_user_permission_caches(self, changes, affected_user_ids=None): + affected_user_ids = affected_user_ids or [] + + for change in changes['added'] + changes['updated'] + changes['deleted']: + if change['type'] == 'user': + affected_user_ids.append(change['id']) + if change['type'] == 'user_group': + user_group = UserGroup.get(safe_int(change['id'])) + if user_group: + group_members_ids = [x.user_id for x in user_group.members] + affected_user_ids.extend(group_members_ids) + + self.trigger_permission_flush(affected_user_ids) + + return affected_user_ids