api: fixed recursive permissions changes to repo group.

- fixes  #5489

rhodecode/api/tests/test_grant_user_group_permission_to_repo_group.py

@@ -1,172 +1,174 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2018 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import mock
 import pytest
 
 from rhodecode.model.user import UserModel
 from rhodecode.model.repo_group import RepoGroupModel
 from rhodecode.api.tests.utils import (
     build_data, api_call, assert_error, assert_ok, crash)
 
 
 @pytest.mark.usefixtures("testuser_api", "app")
 class TestGrantUserGroupPermissionFromRepoGroup(object):
     @pytest.mark.parametrize("name, perm, apply_to_children", [
         ('none', 'group.none', 'none'),
         ('read', 'group.read', 'none'),
         ('write', 'group.write', 'none'),
         ('admin', 'group.admin', 'none'),
 
         ('none', 'group.none', 'all'),
         ('read', 'group.read', 'all'),
         ('write', 'group.write', 'all'),
         ('admin', 'group.admin', 'all'),
 
         ('none', 'group.none', 'repos'),
         ('read', 'group.read', 'repos'),
         ('write', 'group.write', 'repos'),
         ('admin', 'group.admin', 'repos'),
 
         ('none', 'group.none', 'groups'),
         ('read', 'group.read', 'groups'),
         ('write', 'group.write', 'groups'),
         ('admin', 'group.admin', 'groups'),
     ])
     def test_api_grant_user_group_permission_to_repo_group(
             self, name, perm, apply_to_children, user_util):
         user_group = user_util.create_user_group()
         repo_group = user_util.create_repo_group()
+        user_util.create_repo(parent=repo_group)
+
         id_, params = build_data(
             self.apikey,
             'grant_user_group_permission_to_repo_group',
             repogroupid=repo_group.name,
             usergroupid=user_group.users_group_name,
             perm=perm,
             apply_to_children=apply_to_children,)
         response = api_call(self.app, params)
 
         ret = {
             'msg': (
                 'Granted perm: `%s` (recursive:%s) for user group: `%s`'
                 ' in repo group: `%s`' % (
                     perm, apply_to_children, user_group.users_group_name,
                     repo_group.name
                 )
             ),
             'success': True
         }
         expected = ret
         try:
             assert_ok(id_, expected, given=response.body)
         finally:
             RepoGroupModel().revoke_user_group_permission(
                 repo_group.group_id, user_group.users_group_id)
 
     @pytest.mark.parametrize(
         "name, perm, apply_to_children, grant_admin, access_ok", [
             ('none_fails', 'group.none', 'none', False, False),
             ('read_fails', 'group.read', 'none', False, False),
             ('write_fails', 'group.write', 'none', False, False),
             ('admin_fails', 'group.admin', 'none', False, False),
 
             # with granted perms
             ('none_ok', 'group.none', 'none', True, True),
             ('read_ok', 'group.read', 'none', True, True),
             ('write_ok', 'group.write', 'none', True, True),
             ('admin_ok', 'group.admin', 'none', True, True),
         ]
     )
     def test_api_grant_user_group_permission_to_repo_group_by_regular_user(
             self, name, perm, apply_to_children, grant_admin, access_ok,
             user_util):
         user = UserModel().get_by_username(self.TEST_USER_LOGIN)
         user_group = user_util.create_user_group()
         repo_group = user_util.create_repo_group()
         if grant_admin:
             user_util.grant_user_permission_to_repo_group(
                 repo_group, user, 'group.admin')
 
         id_, params = build_data(
             self.apikey_regular,
             'grant_user_group_permission_to_repo_group',
             repogroupid=repo_group.name,
             usergroupid=user_group.users_group_name,
             perm=perm,
             apply_to_children=apply_to_children,)
         response = api_call(self.app, params)
         if access_ok:
             ret = {
                 'msg': (
                     'Granted perm: `%s` (recursive:%s) for user group: `%s`'
                     ' in repo group: `%s`' % (
                         perm, apply_to_children, user_group.users_group_name,
                         repo_group.name
                     )
                 ),
                 'success': True
             }
             expected = ret
             try:
                 assert_ok(id_, expected, given=response.body)
             finally:
                 RepoGroupModel().revoke_user_group_permission(
                     repo_group.group_id, user_group.users_group_id)
         else:
             expected = 'repository group `%s` does not exist' % (
                 repo_group.name,)
             assert_error(id_, expected, given=response.body)
 
     def test_api_grant_user_group_permission_to_repo_group_wrong_permission(
             self, user_util):
         user_group = user_util.create_user_group()
         repo_group = user_util.create_repo_group()
         perm = 'haha.no.permission'
         id_, params = build_data(
             self.apikey,
             'grant_user_group_permission_to_repo_group',
             repogroupid=repo_group.name,
             usergroupid=user_group.users_group_name,
             perm=perm)
         response = api_call(self.app, params)
 
         expected = 'permission `%s` does not exist' % (perm,)
         assert_error(id_, expected, given=response.body)
 
     @mock.patch.object(RepoGroupModel, 'grant_user_group_permission', crash)
     def test_api_grant_user_group_permission_exception_when_adding_2(
             self, user_util):
         user_group = user_util.create_user_group()
         repo_group = user_util.create_repo_group()
         perm = 'group.read'
         id_, params = build_data(
             self.apikey,
             'grant_user_group_permission_to_repo_group',
             repogroupid=repo_group.name,
             usergroupid=user_group.users_group_name,
             perm=perm)
         response = api_call(self.app, params)
 
         expected = (
             'failed to edit permission for user group: `%s`'
             ' in repo group: `%s`' % (
                 user_group.users_group_name, repo_group.name)
         )
         assert_error(id_, expected, given=response.body)

rhodecode/api/views/repo_group_api.py

@@ -1,719 +1,719 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2011-2018 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 
 import logging
 
 from rhodecode.api import JSONRPCValidationError
 from rhodecode.api import jsonrpc_method, JSONRPCError
 from rhodecode.api.utils import (
     has_superadmin_permission, Optional, OAttr, get_user_or_error,
     get_repo_group_or_error, get_perm_or_error, get_user_group_or_error,
     get_origin, validate_repo_group_permissions, validate_set_owner_permissions)
 from rhodecode.lib import audit_logger
 from rhodecode.lib.auth import (
     HasRepoGroupPermissionAnyApi, HasUserGroupPermissionAnyApi)
 from rhodecode.model.db import Session
 from rhodecode.model.repo_group import RepoGroupModel
 from rhodecode.model.scm import RepoGroupList
 from rhodecode.model import validation_schema
 from rhodecode.model.validation_schema.schemas import repo_group_schema
 
 
 log = logging.getLogger(__name__)
 
 
 @jsonrpc_method()
 def get_repo_group(request, apiuser, repogroupid):
     """
     Return the specified |repo| group, along with permissions,
     and repositories inside the group
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
     :param repogroupid: Specify the name of ID of the repository group.
     :type repogroupid: str or int
 
 
     Example output:
 
     .. code-block:: bash
 
         {
           "error": null,
           "id": repo-group-id,
           "result": {
             "group_description": "repo group description",
             "group_id": 14,
             "group_name": "group name",
             "permissions": [
               {
                 "name": "super-admin-username",
                 "origin": "super-admin",
                 "permission": "group.admin",
                 "type": "user"
               },
               {
                 "name": "owner-name",
                 "origin": "owner",
                 "permission": "group.admin",
                 "type": "user"
               },
               {
                 "name": "user-group-name",
                 "origin": "permission",
                 "permission": "group.write",
                 "type": "user_group"
               }
             ],
             "owner": "owner-name",
             "parent_group": null,
             "repositories": [ repo-list ]
           }
         }
     """
 
     repo_group = get_repo_group_or_error(repogroupid)
     if not has_superadmin_permission(apiuser):
         # check if we have at least read permission for this repo group !
         _perms = ('group.admin', 'group.write', 'group.read',)
         if not HasRepoGroupPermissionAnyApi(*_perms)(
                 user=apiuser, group_name=repo_group.group_name):
             raise JSONRPCError(
                 'repository group `%s` does not exist' % (repogroupid,))
 
     permissions = []
     for _user in repo_group.permissions():
         user_data = {
             'name': _user.username,
             'permission': _user.permission,
             'origin': get_origin(_user),
             'type': "user",
         }
         permissions.append(user_data)
 
     for _user_group in repo_group.permission_user_groups():
         user_group_data = {
             'name': _user_group.users_group_name,
             'permission': _user_group.permission,
             'origin': get_origin(_user_group),
             'type': "user_group",
         }
         permissions.append(user_group_data)
 
     data = repo_group.get_api_data()
     data["permissions"] = permissions
     return data
 
 
 @jsonrpc_method()
 def get_repo_groups(request, apiuser):
     """
     Returns all repository groups.
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
     """
 
     result = []
     _perms = ('group.read', 'group.write', 'group.admin',)
     extras = {'user': apiuser}
     for repo_group in RepoGroupList(RepoGroupModel().get_all(),
                                     perm_set=_perms, extra_kwargs=extras):
         result.append(repo_group.get_api_data())
     return result
 
 
 @jsonrpc_method()
 def create_repo_group(
         request, apiuser, group_name,
         owner=Optional(OAttr('apiuser')),
         description=Optional(''),
         copy_permissions=Optional(False)):
     """
     Creates a repository group.
 
     * If the repository group name contains "/", repository group will be
       created inside a repository group or nested repository groups
 
       For example "foo/bar/group1" will create repository group called "group1"
       inside group "foo/bar". You have to have permissions to access and
       write to the last repository group ("bar" in this example)
 
     This command can only be run using an |authtoken| with at least
     permissions to create repository groups, or admin permissions to
     parent repository groups.
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
     :param group_name: Set the repository group name.
     :type group_name: str
     :param description: Set the |repo| group description.
     :type description: str
     :param owner: Set the |repo| group owner.
     :type owner: str
     :param copy_permissions:
     :type copy_permissions:
 
     Example output:
 
     .. code-block:: bash
 
       id : <id_given_in_input>
       result : {
           "msg": "Created new repo group `<repo_group_name>`"
           "repo_group": <repogroup_object>
       }
       error :  null
 
 
     Example error output:
 
     .. code-block:: bash
 
       id : <id_given_in_input>
       result : null
       error :  {
         failed to create repo group `<repogroupid>`
       }
 
     """
 
     owner = validate_set_owner_permissions(apiuser, owner)
 
     description = Optional.extract(description)
     copy_permissions = Optional.extract(copy_permissions)
 
     schema = repo_group_schema.RepoGroupSchema().bind(
         # user caller
         user=apiuser)
 
     try:
         schema_data = schema.deserialize(dict(
             repo_group_name=group_name,
             repo_group_owner=owner.username,
             repo_group_description=description,
             repo_group_copy_permissions=copy_permissions,
         ))
     except validation_schema.Invalid as err:
         raise JSONRPCValidationError(colander_exc=err)
 
     validated_group_name = schema_data['repo_group_name']
 
     try:
         repo_group = RepoGroupModel().create(
             owner=owner,
             group_name=validated_group_name,
             group_description=schema_data['repo_group_description'],
             copy_permissions=schema_data['repo_group_copy_permissions'])
         Session().flush()
 
         repo_group_data = repo_group.get_api_data()
         audit_logger.store_api(
             'repo_group.create', action_data={'data': repo_group_data},
             user=apiuser)
 
         Session().commit()
         return {
             'msg': 'Created new repo group `%s`' % validated_group_name,
             'repo_group': repo_group.get_api_data()
         }
     except Exception:
         log.exception("Exception occurred while trying create repo group")
         raise JSONRPCError(
             'failed to create repo group `%s`' % (validated_group_name,))
 
 
 @jsonrpc_method()
 def update_repo_group(
         request, apiuser, repogroupid, group_name=Optional(''),
         description=Optional(''), owner=Optional(OAttr('apiuser')),
         enable_locking=Optional(False)):
     """
     Updates repository group with the details given.
 
     This command can only be run using an |authtoken| with admin
     permissions.
 
     * If the group_name name contains "/", repository group will be updated
       accordingly with a repository group or nested repository groups
 
       For example repogroupid=group-test group_name="foo/bar/group-test"
       will update repository group called "group-test" and place it
       inside group "foo/bar".
       You have to have permissions to access and write to the last repository
       group ("bar" in this example)
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
     :param repogroupid: Set the ID of repository group.
     :type repogroupid: str or int
     :param group_name: Set the name of the |repo| group.
     :type group_name: str
     :param description: Set a description for the group.
     :type description: str
     :param owner: Set the |repo| group owner.
     :type owner: str
     :param enable_locking: Enable |repo| locking. The default is false.
     :type enable_locking: bool
     """
 
     repo_group = get_repo_group_or_error(repogroupid)
 
     if not has_superadmin_permission(apiuser):
         validate_repo_group_permissions(
             apiuser, repogroupid, repo_group, ('group.admin',))
 
     updates = dict(
         group_name=group_name
         if not isinstance(group_name, Optional) else repo_group.group_name,
 
         group_description=description
         if not isinstance(description, Optional) else repo_group.group_description,
 
         user=owner
         if not isinstance(owner, Optional) else repo_group.user.username,
 
         enable_locking=enable_locking
         if not isinstance(enable_locking, Optional) else repo_group.enable_locking
     )
 
     schema = repo_group_schema.RepoGroupSchema().bind(
         # user caller
         user=apiuser,
         old_values=repo_group.get_api_data())
 
     try:
         schema_data = schema.deserialize(dict(
             repo_group_name=updates['group_name'],
             repo_group_owner=updates['user'],
             repo_group_description=updates['group_description'],
             repo_group_enable_locking=updates['enable_locking'],
         ))
     except validation_schema.Invalid as err:
         raise JSONRPCValidationError(colander_exc=err)
 
     validated_updates = dict(
         group_name=schema_data['repo_group']['repo_group_name_without_group'],
         group_parent_id=schema_data['repo_group']['repo_group_id'],
         user=schema_data['repo_group_owner'],
         group_description=schema_data['repo_group_description'],
         enable_locking=schema_data['repo_group_enable_locking'],
     )
 
     old_data = repo_group.get_api_data()
     try:
         RepoGroupModel().update(repo_group, validated_updates)
         audit_logger.store_api(
             'repo_group.edit', action_data={'old_data': old_data},
             user=apiuser)
 
         Session().commit()
         return {
             'msg': 'updated repository group ID:%s %s' % (
                 repo_group.group_id, repo_group.group_name),
             'repo_group': repo_group.get_api_data()
         }
     except Exception:
         log.exception(
             u"Exception occurred while trying update repo group %s",
             repogroupid)
         raise JSONRPCError('failed to update repository group `%s`'
                            % (repogroupid,))
 
 
 @jsonrpc_method()
 def delete_repo_group(request, apiuser, repogroupid):
     """
     Deletes a |repo| group.
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
     :param repogroupid: Set the name or ID of repository group to be
         deleted.
     :type repogroupid: str or int
 
     Example output:
 
     .. code-block:: bash
 
       id : <id_given_in_input>
       result : {
         'msg': 'deleted repo group ID:<repogroupid> <repogroupname>'
         'repo_group': null
       }
       error :  null
 
     Example error output:
 
     .. code-block:: bash
 
       id : <id_given_in_input>
       result : null
       error :  {
         "failed to delete repo group ID:<repogroupid> <repogroupname>"
       }
 
     """
 
     repo_group = get_repo_group_or_error(repogroupid)
     if not has_superadmin_permission(apiuser):
         validate_repo_group_permissions(
             apiuser, repogroupid, repo_group, ('group.admin',))
 
     old_data = repo_group.get_api_data()
     try:
         RepoGroupModel().delete(repo_group)
         audit_logger.store_api(
             'repo_group.delete', action_data={'old_data': old_data},
             user=apiuser)
         Session().commit()
         return {
             'msg': 'deleted repo group ID:%s %s' %
                    (repo_group.group_id, repo_group.group_name),
             'repo_group': None
         }
     except Exception:
         log.exception("Exception occurred while trying to delete repo group")
         raise JSONRPCError('failed to delete repo group ID:%s %s' %
                            (repo_group.group_id, repo_group.group_name))
 
 
 @jsonrpc_method()
 def grant_user_permission_to_repo_group(
         request, apiuser, repogroupid, userid, perm,
         apply_to_children=Optional('none')):
     """
     Grant permission for a user on the given repository group, or update
     existing permissions if found.
 
     This command can only be run using an |authtoken| with admin
     permissions.
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
     :param repogroupid: Set the name or ID of repository group.
     :type repogroupid: str or int
     :param userid: Set the user name.
     :type userid: str
     :param perm: (group.(none|read|write|admin))
     :type perm: str
     :param apply_to_children: 'none', 'repos', 'groups', 'all'
     :type apply_to_children: str
 
     Example output:
 
     .. code-block:: bash
 
         id : <id_given_in_input>
         result: {
                   "msg" : "Granted perm: `<perm>` (recursive:<apply_to_children>) for user: `<username>` in repo group: `<repo_group_name>`",
                   "success": true
                 }
         error:  null
 
     Example error output:
 
     .. code-block:: bash
 
       id : <id_given_in_input>
       result : null
       error :  {
         "failed to edit permission for user: `<userid>` in repo group: `<repo_group_name>`"
       }
 
     """
 
     repo_group = get_repo_group_or_error(repogroupid)
 
     if not has_superadmin_permission(apiuser):
         validate_repo_group_permissions(
             apiuser, repogroupid, repo_group, ('group.admin',))
 
     user = get_user_or_error(userid)
     perm = get_perm_or_error(perm, prefix='group.')
     apply_to_children = Optional.extract(apply_to_children)
 
-    perm_additions = [[user.user_id, perm, "user"]]
+    perm_additions = [[user.user_id, perm.permission_name, "user"]]
     try:
         RepoGroupModel().update_permissions(repo_group=repo_group,
                                             perm_additions=perm_additions,
                                             recursive=apply_to_children,
                                             cur_user=apiuser)
         Session().commit()
         return {
             'msg': 'Granted perm: `%s` (recursive:%s) for user: '
                    '`%s` in repo group: `%s`' % (
                        perm.permission_name, apply_to_children, user.username,
                        repo_group.name
                    ),
             'success': True
         }
     except Exception:
         log.exception("Exception occurred while trying to grant "
                       "user permissions to repo group")
         raise JSONRPCError(
             'failed to edit permission for user: '
             '`%s` in repo group: `%s`' % (userid, repo_group.name))
 
 
 @jsonrpc_method()
 def revoke_user_permission_from_repo_group(
         request, apiuser, repogroupid, userid,
         apply_to_children=Optional('none')):
     """
     Revoke permission for a user in a given repository group.
 
     This command can only be run using an |authtoken| with admin
     permissions on the |repo| group.
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
     :param repogroupid: Set the name or ID of the repository group.
     :type repogroupid: str or int
     :param userid: Set the user name to revoke.
     :type userid: str
     :param apply_to_children: 'none', 'repos', 'groups', 'all'
     :type apply_to_children: str
 
     Example output:
 
     .. code-block:: bash
 
         id : <id_given_in_input>
         result: {
                   "msg" : "Revoked perm (recursive:<apply_to_children>) for user: `<username>` in repo group: `<repo_group_name>`",
                   "success": true
                 }
         error:  null
 
     Example error output:
 
     .. code-block:: bash
 
       id : <id_given_in_input>
       result : null
       error :  {
         "failed to edit permission for user: `<userid>` in repo group: `<repo_group_name>`"
       }
 
     """
 
     repo_group = get_repo_group_or_error(repogroupid)
 
     if not has_superadmin_permission(apiuser):
         validate_repo_group_permissions(
             apiuser, repogroupid, repo_group, ('group.admin',))
 
     user = get_user_or_error(userid)
     apply_to_children = Optional.extract(apply_to_children)
 
     perm_deletions = [[user.user_id, None, "user"]]
     try:
         RepoGroupModel().update_permissions(repo_group=repo_group,
                                             perm_deletions=perm_deletions,
                                             recursive=apply_to_children,
                                             cur_user=apiuser)
         Session().commit()
         return {
             'msg': 'Revoked perm (recursive:%s) for user: '
                    '`%s` in repo group: `%s`' % (
                        apply_to_children, user.username, repo_group.name
                    ),
             'success': True
         }
     except Exception:
         log.exception("Exception occurred while trying revoke user "
                       "permission from repo group")
         raise JSONRPCError(
             'failed to edit permission for user: '
             '`%s` in repo group: `%s`' % (userid, repo_group.name))
 
 
 @jsonrpc_method()
 def grant_user_group_permission_to_repo_group(
         request, apiuser, repogroupid, usergroupid, perm,
         apply_to_children=Optional('none'), ):
     """
     Grant permission for a user group on given repository group, or update
     existing permissions if found.
 
     This command can only be run using an |authtoken| with admin
     permissions on the |repo| group.
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
     :param repogroupid: Set the name or id of repository group
     :type repogroupid: str or int
     :param usergroupid: id of usergroup
     :type usergroupid: str or int
     :param perm: (group.(none|read|write|admin))
     :type perm: str
     :param apply_to_children: 'none', 'repos', 'groups', 'all'
     :type apply_to_children: str
 
     Example output:
 
     .. code-block:: bash
 
       id : <id_given_in_input>
       result : {
         "msg" : "Granted perm: `<perm>` (recursive:<apply_to_children>) for user group: `<usersgroupname>` in repo group: `<repo_group_name>`",
         "success": true
 
       }
       error :  null
 
     Example error output:
 
     .. code-block:: bash
 
       id : <id_given_in_input>
       result : null
       error :  {
         "failed to edit permission for user group: `<usergroup>` in repo group: `<repo_group_name>`"
       }
 
     """
 
     repo_group = get_repo_group_or_error(repogroupid)
     perm = get_perm_or_error(perm, prefix='group.')
     user_group = get_user_group_or_error(usergroupid)
     if not has_superadmin_permission(apiuser):
         validate_repo_group_permissions(
             apiuser, repogroupid, repo_group, ('group.admin',))
 
         # check if we have at least read permission for this user group !
         _perms = ('usergroup.read', 'usergroup.write', 'usergroup.admin',)
         if not HasUserGroupPermissionAnyApi(*_perms)(
                 user=apiuser, user_group_name=user_group.users_group_name):
             raise JSONRPCError(
                 'user group `%s` does not exist' % (usergroupid,))
 
     apply_to_children = Optional.extract(apply_to_children)
 
-    perm_additions = [[user_group.users_group_id, perm, "user_group"]]
+    perm_additions = [[user_group.users_group_id, perm.permission_name, "user_group"]]
     try:
         RepoGroupModel().update_permissions(repo_group=repo_group,
                                             perm_additions=perm_additions,
                                             recursive=apply_to_children,
                                             cur_user=apiuser)
         Session().commit()
         return {
             'msg': 'Granted perm: `%s` (recursive:%s) '
                    'for user group: `%s` in repo group: `%s`' % (
                        perm.permission_name, apply_to_children,
                        user_group.users_group_name, repo_group.name
                    ),
             'success': True
         }
     except Exception:
         log.exception("Exception occurred while trying to grant user "
                       "group permissions to repo group")
         raise JSONRPCError(
             'failed to edit permission for user group: `%s` in '
             'repo group: `%s`' % (
                 usergroupid, repo_group.name
             )
         )
 
 
 @jsonrpc_method()
 def revoke_user_group_permission_from_repo_group(
         request, apiuser, repogroupid, usergroupid,
         apply_to_children=Optional('none')):
     """
     Revoke permission for user group on given repository.
 
     This command can only be run using an |authtoken| with admin
     permissions on the |repo| group.
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
     :param repogroupid: name or id of repository group
     :type repogroupid: str or int
     :param usergroupid:
     :param apply_to_children: 'none', 'repos', 'groups', 'all'
     :type apply_to_children: str
 
     Example output:
 
     .. code-block:: bash
 
         id : <id_given_in_input>
         result: {
                   "msg" : "Revoked perm (recursive:<apply_to_children>) for user group: `<usersgroupname>` in repo group: `<repo_group_name>`",
                   "success": true
                 }
         error:  null
 
     Example error output:
 
     .. code-block:: bash
 
       id : <id_given_in_input>
       result : null
       error :  {
         "failed to edit permission for user group: `<usergroup>` in repo group: `<repo_group_name>`"
       }
 
 
     """
 
     repo_group = get_repo_group_or_error(repogroupid)
     user_group = get_user_group_or_error(usergroupid)
     if not has_superadmin_permission(apiuser):
         validate_repo_group_permissions(
             apiuser, repogroupid, repo_group, ('group.admin',))
 
         # check if we have at least read permission for this user group !
         _perms = ('usergroup.read', 'usergroup.write', 'usergroup.admin',)
         if not HasUserGroupPermissionAnyApi(*_perms)(
                 user=apiuser, user_group_name=user_group.users_group_name):
             raise JSONRPCError(
                 'user group `%s` does not exist' % (usergroupid,))
 
     apply_to_children = Optional.extract(apply_to_children)
 
     perm_deletions = [[user_group.users_group_id, None, "user_group"]]
     try:
         RepoGroupModel().update_permissions(repo_group=repo_group,
                                             perm_deletions=perm_deletions,
                                             recursive=apply_to_children,
                                             cur_user=apiuser)
         Session().commit()
         return {
             'msg': 'Revoked perm (recursive:%s) for user group: '
                    '`%s` in repo group: `%s`' % (
                        apply_to_children, user_group.users_group_name,
                        repo_group.name
                    ),
             'success': True
         }
     except Exception:
         log.exception("Exception occurred while trying revoke user group "
                       "permissions from repo group")
         raise JSONRPCError(
             'failed to edit permission for user group: '
             '`%s` in repo group: `%s`' % (
                 user_group.users_group_name, repo_group.name
             )
         )