tests: stabilize tests for mysql/postgres.

rhodecode/apps/admin/tests/test_admin_auth_settings.py

@@ -1,202 +1,202 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2019 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import pytest
 
 from rhodecode.tests import assert_session_flash
 from rhodecode.tests.utils import AssertResponse
 from rhodecode.model.db import Session
 from rhodecode.model.settings import SettingsModel
 
 
 def assert_auth_settings_updated(response):
     assert response.status_int == 302, 'Expected response HTTP Found 302'
     assert_session_flash(response, 'Auth settings updated successfully')
 
 
 @pytest.mark.usefixtures("autologin_user", "app")
 class TestAuthSettingsView(object):
 
     def _enable_plugins(self, plugins_list, csrf_token, override=None,
                         verify_response=False):
         test_url = '/_admin/auth'
         params = {
             'auth_plugins': plugins_list,
             'csrf_token': csrf_token,
         }
         if override:
             params.update(override)
         _enabled_plugins = []
         for plugin in plugins_list.split(','):
             plugin_name = plugin.partition('#')[-1]
             enabled_plugin = '%s_enabled' % plugin_name
             cache_ttl = '%s_cache_ttl' % plugin_name
 
             # default params that are needed for each plugin,
             # `enabled` and `cache_ttl`
             params.update({
                 enabled_plugin: True,
                 cache_ttl: 0
             })
             _enabled_plugins.append(enabled_plugin)
 
         # we need to clean any enabled plugin before, since they require
         # form params to be present
         db_plugin = SettingsModel().get_setting_by_name('auth_plugins')
         db_plugin.app_settings_value = \
             'egg:rhodecode-enterprise-ce#rhodecode'
         Session().add(db_plugin)
         Session().commit()
         for _plugin in _enabled_plugins:
             db_plugin = SettingsModel().get_setting_by_name(_plugin)
             if db_plugin:
                 Session().delete(db_plugin)
         Session().commit()
 
         response = self.app.post(url=test_url, params=params)
 
         if verify_response:
             assert_auth_settings_updated(response)
         return params
 
     def _post_ldap_settings(self, params, override=None, force=False):
 
         params.update({
             'filter': 'user',
             'user_member_of': '',
             'user_search_base': '',
             'user_search_filter': 'test_filter',
 
             'host': 'dc.example.com',
             'port': '999',
             'timeout': 3600,
             'tls_kind': 'PLAIN',
             'tls_reqcert': 'NEVER',
             'tls_cert_dir':'/etc/openldap/cacerts',
             'dn_user': 'test_user',
             'dn_pass': 'test_pass',
             'base_dn': 'test_base_dn',
             'search_scope': 'BASE',
             'attr_login': 'test_attr_login',
             'attr_firstname': 'ima',
             'attr_lastname': 'tester',
             'attr_email': '[e-mail]',
             'cache_ttl': '0',
         })
         if force:
             params = {}
         params.update(override or {})
 
         test_url = '/_admin/auth/ldap/'
 
         response = self.app.post(url=test_url, params=params)
         return response
 
     def test_index(self):
         response = self.app.get('/_admin/auth')
         response.mustcontain('Authentication Plugins')
 
     @pytest.mark.parametrize("disable_plugin, needs_import", [
         ('egg:rhodecode-enterprise-ce#headers', None),
         ('egg:rhodecode-enterprise-ce#crowd', None),
         ('egg:rhodecode-enterprise-ce#jasig_cas', None),
         ('egg:rhodecode-enterprise-ce#ldap', None),
         ('egg:rhodecode-enterprise-ce#pam',  "pam"),
     ])
     def test_disable_plugin(self, csrf_token, disable_plugin, needs_import):
         # TODO: johbo: "pam" is currently not available on darwin,
         # although the docs state that it should work on darwin.
         if needs_import:
             pytest.importorskip(needs_import)
 
         self._enable_plugins(
             'egg:rhodecode-enterprise-ce#rhodecode,' + disable_plugin,
             csrf_token, verify_response=True)
 
         self._enable_plugins(
             'egg:rhodecode-enterprise-ce#rhodecode', csrf_token,
             verify_response=True)
 
     def test_ldap_save_settings(self, csrf_token):
         params = self._enable_plugins(
             'egg:rhodecode-enterprise-ce#rhodecode,'
             'egg:rhodecode-enterprise-ce#ldap',
             csrf_token)
         response = self._post_ldap_settings(params)
         assert_auth_settings_updated(response)
 
         new_settings = SettingsModel().get_auth_settings()
         assert new_settings['auth_ldap_host'] == u'dc.example.com', \
             'fail db write compare'
 
     def test_ldap_error_form_wrong_port_number(self, csrf_token):
         params = self._enable_plugins(
             'egg:rhodecode-enterprise-ce#rhodecode,'
             'egg:rhodecode-enterprise-ce#ldap',
             csrf_token)
         invalid_port_value = 'invalid-port-number'
         response = self._post_ldap_settings(params, override={
             'port': invalid_port_value,
         })
-        assertr = AssertResponse(response)
+        assertr = response.assert_response()
         assertr.element_contains(
             '.form .field #port ~ .error-message',
             invalid_port_value)
 
     def test_ldap_error_form(self, csrf_token):
         params = self._enable_plugins(
             'egg:rhodecode-enterprise-ce#rhodecode,'
             'egg:rhodecode-enterprise-ce#ldap',
             csrf_token)
         response = self._post_ldap_settings(params, override={
             'attr_login': '',
         })
         response.mustcontain("""<span class="error-message">The LDAP Login"""
                              """ attribute of the CN must be specified""")
 
     def test_post_ldap_group_settings(self, csrf_token):
         params = self._enable_plugins(
             'egg:rhodecode-enterprise-ce#rhodecode,'
             'egg:rhodecode-enterprise-ce#ldap',
             csrf_token)
 
         response = self._post_ldap_settings(params, override={
             'host': 'dc-legacy.example.com',
             'port': '999',
             'tls_kind': 'PLAIN',
             'tls_reqcert': 'NEVER',
             'dn_user': 'test_user',
             'dn_pass': 'test_pass',
             'base_dn': 'test_base_dn',
             'filter': 'test_filter',
             'search_scope': 'BASE',
             'attr_login': 'test_attr_login',
             'attr_firstname': 'ima',
             'attr_lastname': 'tester',
             'attr_email': '[e-mail]',
             'cache_ttl': '60',
             'csrf_token': csrf_token,
             }
         )
         assert_auth_settings_updated(response)
 
         new_settings = SettingsModel().get_auth_settings()
         assert new_settings['auth_ldap_host'] == u'dc-legacy.example.com', \
             'fail db write compare'

rhodecode/apps/admin/tests/test_admin_repos.py

@@ -1,512 +1,512 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2019 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import urllib
 
 import mock
 import pytest
 
 from rhodecode.apps._base import ADMIN_PREFIX
 from rhodecode.lib import auth
 from rhodecode.lib.utils2 import safe_str
 from rhodecode.lib import helpers as h
 from rhodecode.model.db import (
     Repository, RepoGroup, UserRepoToPerm, User, Permission)
 from rhodecode.model.meta import Session
 from rhodecode.model.repo import RepoModel
 from rhodecode.model.repo_group import RepoGroupModel
 from rhodecode.model.user import UserModel
 from rhodecode.tests import (
     login_user_session, assert_session_flash, TEST_USER_ADMIN_LOGIN,
     TEST_USER_REGULAR_LOGIN, TEST_USER_REGULAR_PASS)
 from rhodecode.tests.fixture import Fixture, error_function
 from rhodecode.tests.utils import AssertResponse, repo_on_filesystem
 
 fixture = Fixture()
 
 
 def route_path(name, params=None, **kwargs):
     import urllib
 
     base_url = {
         'repos': ADMIN_PREFIX + '/repos',
         'repo_new': ADMIN_PREFIX + '/repos/new',
         'repo_create': ADMIN_PREFIX + '/repos/create',
 
         'repo_creating_check': '/{repo_name}/repo_creating_check',
     }[name].format(**kwargs)
 
     if params:
         base_url = '{}?{}'.format(base_url, urllib.urlencode(params))
     return base_url
 
 
 def _get_permission_for_user(user, repo):
     perm = UserRepoToPerm.query()\
         .filter(UserRepoToPerm.repository ==
                 Repository.get_by_repo_name(repo))\
         .filter(UserRepoToPerm.user == User.get_by_username(user))\
         .all()
     return perm
 
 
 @pytest.mark.usefixtures("app")
 class TestAdminRepos(object):
 
     def test_repo_list(self, autologin_user, user_util):
         repo = user_util.create_repo()
         repo_name = repo.repo_name
         response = self.app.get(
             route_path('repos'), status=200)
 
         response.mustcontain(repo_name)
 
     def test_create_page_restricted_to_single_backend(self, autologin_user, backend):
         with mock.patch('rhodecode.BACKENDS', {'git': 'git'}):
             response = self.app.get(route_path('repo_new'), status=200)
-        assert_response = AssertResponse(response)
+        assert_response = response.assert_response()
         element = assert_response.get_element('#repo_type')
         assert element.text_content() == '\ngit\n'
 
     def test_create_page_non_restricted_backends(self, autologin_user, backend):
         response = self.app.get(route_path('repo_new'), status=200)
-        assert_response = AssertResponse(response)
+        assert_response = response.assert_response()
         assert_response.element_contains('#repo_type', 'git')
         assert_response.element_contains('#repo_type', 'svn')
         assert_response.element_contains('#repo_type', 'hg')
 
     @pytest.mark.parametrize(
         "suffix", [u'', u'xxa'], ids=['', 'non-ascii'])
     def test_create(self, autologin_user, backend, suffix, csrf_token):
         repo_name_unicode = backend.new_repo_name(suffix=suffix)
         repo_name = repo_name_unicode.encode('utf8')
         description_unicode = u'description for newly created repo' + suffix
         description = description_unicode.encode('utf8')
         response = self.app.post(
             route_path('repo_create'),
             fixture._get_repo_create_params(
                 repo_private=False,
                 repo_name=repo_name,
                 repo_type=backend.alias,
                 repo_description=description,
                 csrf_token=csrf_token),
             status=302)
 
         self.assert_repository_is_created_correctly(
             repo_name, description, backend)
 
     def test_create_numeric_name(self, autologin_user, backend, csrf_token):
         numeric_repo = '1234'
         repo_name = numeric_repo
         description = 'description for newly created repo' + numeric_repo
         self.app.post(
             route_path('repo_create'),
             fixture._get_repo_create_params(
                 repo_private=False,
                 repo_name=repo_name,
                 repo_type=backend.alias,
                 repo_description=description,
                 csrf_token=csrf_token))
 
         self.assert_repository_is_created_correctly(
             repo_name, description, backend)
 
     @pytest.mark.parametrize("suffix", [u'', u'ąćę'], ids=['', 'non-ascii'])
     def test_create_in_group(
             self, autologin_user, backend, suffix, csrf_token):
         # create GROUP
         group_name = 'sometest_%s' % backend.alias
         gr = RepoGroupModel().create(group_name=group_name,
                                      group_description='test',
                                      owner=TEST_USER_ADMIN_LOGIN)
         Session().commit()
 
         repo_name = u'ingroup' + suffix
         repo_name_full = RepoGroup.url_sep().join(
             [group_name, repo_name])
         description = u'description for newly created repo'
         self.app.post(
             route_path('repo_create'),
             fixture._get_repo_create_params(
                 repo_private=False,
                 repo_name=safe_str(repo_name),
                 repo_type=backend.alias,
                 repo_description=description,
                 repo_group=gr.group_id,
                 csrf_token=csrf_token))
 
         # TODO: johbo: Cleanup work to fixture
         try:
             self.assert_repository_is_created_correctly(
                 repo_name_full, description, backend)
 
             new_repo = RepoModel().get_by_repo_name(repo_name_full)
             inherited_perms = UserRepoToPerm.query().filter(
                 UserRepoToPerm.repository_id == new_repo.repo_id).all()
             assert len(inherited_perms) == 1
         finally:
             RepoModel().delete(repo_name_full)
             RepoGroupModel().delete(group_name)
             Session().commit()
 
     def test_create_in_group_numeric_name(
             self, autologin_user, backend, csrf_token):
         # create GROUP
         group_name = 'sometest_%s' % backend.alias
         gr = RepoGroupModel().create(group_name=group_name,
                                      group_description='test',
                                      owner=TEST_USER_ADMIN_LOGIN)
         Session().commit()
 
         repo_name = '12345'
         repo_name_full = RepoGroup.url_sep().join([group_name, repo_name])
         description = 'description for newly created repo'
         self.app.post(
             route_path('repo_create'),
             fixture._get_repo_create_params(
                 repo_private=False,
                 repo_name=repo_name,
                 repo_type=backend.alias,
                 repo_description=description,
                 repo_group=gr.group_id,
                 csrf_token=csrf_token))
 
         # TODO: johbo: Cleanup work to fixture
         try:
             self.assert_repository_is_created_correctly(
                 repo_name_full, description, backend)
 
             new_repo = RepoModel().get_by_repo_name(repo_name_full)
             inherited_perms = UserRepoToPerm.query()\
                 .filter(UserRepoToPerm.repository_id == new_repo.repo_id).all()
             assert len(inherited_perms) == 1
         finally:
             RepoModel().delete(repo_name_full)
             RepoGroupModel().delete(group_name)
             Session().commit()
 
     def test_create_in_group_without_needed_permissions(self, backend):
         session = login_user_session(
             self.app, TEST_USER_REGULAR_LOGIN, TEST_USER_REGULAR_PASS)
         csrf_token = auth.get_csrf_token(session)
         # revoke
         user_model = UserModel()
         # disable fork and create on default user
         user_model.revoke_perm(User.DEFAULT_USER, 'hg.create.repository')
         user_model.grant_perm(User.DEFAULT_USER, 'hg.create.none')
         user_model.revoke_perm(User.DEFAULT_USER, 'hg.fork.repository')
         user_model.grant_perm(User.DEFAULT_USER, 'hg.fork.none')
 
         # disable on regular user
         user_model.revoke_perm(TEST_USER_REGULAR_LOGIN, 'hg.create.repository')
         user_model.grant_perm(TEST_USER_REGULAR_LOGIN, 'hg.create.none')
         user_model.revoke_perm(TEST_USER_REGULAR_LOGIN, 'hg.fork.repository')
         user_model.grant_perm(TEST_USER_REGULAR_LOGIN, 'hg.fork.none')
         Session().commit()
 
         # create GROUP
         group_name = 'reg_sometest_%s' % backend.alias
         gr = RepoGroupModel().create(group_name=group_name,
                                      group_description='test',
                                      owner=TEST_USER_ADMIN_LOGIN)
         Session().commit()
         repo_group_id = gr.group_id
 
         group_name_allowed = 'reg_sometest_allowed_%s' % backend.alias
         gr_allowed = RepoGroupModel().create(
             group_name=group_name_allowed,
             group_description='test',
             owner=TEST_USER_REGULAR_LOGIN)
         allowed_repo_group_id = gr_allowed.group_id
         Session().commit()
 
         repo_name = 'ingroup'
         description = 'description for newly created repo'
         response = self.app.post(
             route_path('repo_create'),
             fixture._get_repo_create_params(
                 repo_private=False,
                 repo_name=repo_name,
                 repo_type=backend.alias,
                 repo_description=description,
                 repo_group=repo_group_id,
                 csrf_token=csrf_token))
 
         response.mustcontain('Invalid value')
 
         # user is allowed to create in this group
         repo_name = 'ingroup'
         repo_name_full = RepoGroup.url_sep().join(
             [group_name_allowed, repo_name])
         description = 'description for newly created repo'
         response = self.app.post(
             route_path('repo_create'),
             fixture._get_repo_create_params(
                 repo_private=False,
                 repo_name=repo_name,
                 repo_type=backend.alias,
                 repo_description=description,
                 repo_group=allowed_repo_group_id,
                 csrf_token=csrf_token))
 
         # TODO: johbo: Cleanup in pytest fixture
         try:
             self.assert_repository_is_created_correctly(
                 repo_name_full, description, backend)
 
             new_repo = RepoModel().get_by_repo_name(repo_name_full)
             inherited_perms = UserRepoToPerm.query().filter(
                 UserRepoToPerm.repository_id == new_repo.repo_id).all()
             assert len(inherited_perms) == 1
 
             assert repo_on_filesystem(repo_name_full)
         finally:
             RepoModel().delete(repo_name_full)
             RepoGroupModel().delete(group_name)
             RepoGroupModel().delete(group_name_allowed)
             Session().commit()
 
     def test_create_in_group_inherit_permissions(self, autologin_user, backend,
                                                  csrf_token):
         # create GROUP
         group_name = 'sometest_%s' % backend.alias
         gr = RepoGroupModel().create(group_name=group_name,
                                      group_description='test',
                                      owner=TEST_USER_ADMIN_LOGIN)
         perm = Permission.get_by_key('repository.write')
         RepoGroupModel().grant_user_permission(
             gr, TEST_USER_REGULAR_LOGIN, perm)
 
         # add repo permissions
         Session().commit()
         repo_group_id = gr.group_id
         repo_name = 'ingroup_inherited_%s' % backend.alias
         repo_name_full = RepoGroup.url_sep().join([group_name, repo_name])
         description = 'description for newly created repo'
         self.app.post(
             route_path('repo_create'),
             fixture._get_repo_create_params(
                 repo_private=False,
                 repo_name=repo_name,
                 repo_type=backend.alias,
                 repo_description=description,
                 repo_group=repo_group_id,
                 repo_copy_permissions=True,
                 csrf_token=csrf_token))
 
         # TODO: johbo: Cleanup to pytest fixture
         try:
             self.assert_repository_is_created_correctly(
                 repo_name_full, description, backend)
         except Exception:
             RepoGroupModel().delete(group_name)
             Session().commit()
             raise
 
         # check if inherited permissions are applied
         new_repo = RepoModel().get_by_repo_name(repo_name_full)
         inherited_perms = UserRepoToPerm.query().filter(
             UserRepoToPerm.repository_id == new_repo.repo_id).all()
         assert len(inherited_perms) == 2
 
         assert TEST_USER_REGULAR_LOGIN in [
             x.user.username for x in inherited_perms]
         assert 'repository.write' in [
             x.permission.permission_name for x in inherited_perms]
 
         RepoModel().delete(repo_name_full)
         RepoGroupModel().delete(group_name)
         Session().commit()
 
     @pytest.mark.xfail_backends(
         "git", "hg", reason="Missing reposerver support")
     def test_create_with_clone_uri(self, autologin_user, backend, reposerver,
                                    csrf_token):
         source_repo = backend.create_repo(number_of_commits=2)
         source_repo_name = source_repo.repo_name
         reposerver.serve(source_repo.scm_instance())
 
         repo_name = backend.new_repo_name()
         response = self.app.post(
             route_path('repo_create'),
             fixture._get_repo_create_params(
                 repo_private=False,
                 repo_name=repo_name,
                 repo_type=backend.alias,
                 repo_description='',
                 clone_uri=reposerver.url,
                 csrf_token=csrf_token),
             status=302)
 
         # Should be redirected to the creating page
         response.mustcontain('repo_creating')
 
         # Expecting that both repositories have same history
         source_repo = RepoModel().get_by_repo_name(source_repo_name)
         source_vcs = source_repo.scm_instance()
         repo = RepoModel().get_by_repo_name(repo_name)
         repo_vcs = repo.scm_instance()
         assert source_vcs[0].message == repo_vcs[0].message
         assert source_vcs.count() == repo_vcs.count()
         assert source_vcs.commit_ids == repo_vcs.commit_ids
 
     @pytest.mark.xfail_backends("svn", reason="Depends on import support")
     def test_create_remote_repo_wrong_clone_uri(self, autologin_user, backend,
                                                 csrf_token):
         repo_name = backend.new_repo_name()
         description = 'description for newly created repo'
         response = self.app.post(
             route_path('repo_create'),
             fixture._get_repo_create_params(
                 repo_private=False,
                 repo_name=repo_name,
                 repo_type=backend.alias,
                 repo_description=description,
                 clone_uri='http://repo.invalid/repo',
                 csrf_token=csrf_token))
         response.mustcontain('invalid clone url')
 
     @pytest.mark.xfail_backends("svn", reason="Depends on import support")
     def test_create_remote_repo_wrong_clone_uri_hg_svn(
             self, autologin_user, backend, csrf_token):
         repo_name = backend.new_repo_name()
         description = 'description for newly created repo'
         response = self.app.post(
             route_path('repo_create'),
             fixture._get_repo_create_params(
                 repo_private=False,
                 repo_name=repo_name,
                 repo_type=backend.alias,
                 repo_description=description,
                 clone_uri='svn+http://svn.invalid/repo',
                 csrf_token=csrf_token))
         response.mustcontain('invalid clone url')
 
     def test_create_with_git_suffix(
             self, autologin_user, backend, csrf_token):
         repo_name = backend.new_repo_name() + ".git"
         description = 'description for newly created repo'
         response = self.app.post(
             route_path('repo_create'),
             fixture._get_repo_create_params(
                 repo_private=False,
                 repo_name=repo_name,
                 repo_type=backend.alias,
                 repo_description=description,
                 csrf_token=csrf_token))
         response.mustcontain('Repository name cannot end with .git')
 
     def test_default_user_cannot_access_private_repo_in_a_group(
             self, autologin_user, user_util, backend):
 
         group = user_util.create_repo_group()
 
         repo = backend.create_repo(
             repo_private=True, repo_group=group, repo_copy_permissions=True)
 
         permissions = _get_permission_for_user(
             user='default', repo=repo.repo_name)
         assert len(permissions) == 1
         assert permissions[0].permission.permission_name == 'repository.none'
         assert permissions[0].repository.private is True
 
     def test_create_on_top_level_without_permissions(self, backend):
         session = login_user_session(
             self.app, TEST_USER_REGULAR_LOGIN, TEST_USER_REGULAR_PASS)
         csrf_token = auth.get_csrf_token(session)
 
         # revoke
         user_model = UserModel()
         # disable fork and create on default user
         user_model.revoke_perm(User.DEFAULT_USER, 'hg.create.repository')
         user_model.grant_perm(User.DEFAULT_USER, 'hg.create.none')
         user_model.revoke_perm(User.DEFAULT_USER, 'hg.fork.repository')
         user_model.grant_perm(User.DEFAULT_USER, 'hg.fork.none')
 
         # disable on regular user
         user_model.revoke_perm(TEST_USER_REGULAR_LOGIN, 'hg.create.repository')
         user_model.grant_perm(TEST_USER_REGULAR_LOGIN, 'hg.create.none')
         user_model.revoke_perm(TEST_USER_REGULAR_LOGIN, 'hg.fork.repository')
         user_model.grant_perm(TEST_USER_REGULAR_LOGIN, 'hg.fork.none')
         Session().commit()
 
         repo_name = backend.new_repo_name()
         description = 'description for newly created repo'
         response = self.app.post(
             route_path('repo_create'),
             fixture._get_repo_create_params(
                 repo_private=False,
                 repo_name=repo_name,
                 repo_type=backend.alias,
                 repo_description=description,
                 csrf_token=csrf_token))
 
         response.mustcontain(
             u"You do not have the permission to store repositories in "
             u"the root location.")
 
     @mock.patch.object(RepoModel, '_create_filesystem_repo', error_function)
     def test_create_repo_when_filesystem_op_fails(
             self, autologin_user, backend, csrf_token):
         repo_name = backend.new_repo_name()
         description = 'description for newly created repo'
 
         response = self.app.post(
             route_path('repo_create'),
             fixture._get_repo_create_params(
                 repo_private=False,
                 repo_name=repo_name,
                 repo_type=backend.alias,
                 repo_description=description,
                 csrf_token=csrf_token))
 
         assert_session_flash(
             response, 'Error creating repository %s' % repo_name)
         # repo must not be in db
         assert backend.repo is None
         # repo must not be in filesystem !
         assert not repo_on_filesystem(repo_name)
 
     def assert_repository_is_created_correctly(
             self, repo_name, description, backend):
         repo_name_utf8 = safe_str(repo_name)
 
         # run the check page that triggers the flash message
         response = self.app.get(
             route_path('repo_creating_check', repo_name=safe_str(repo_name)))
         assert response.json == {u'result': True}
 
         flash_msg = u'Created repository <a href="/{}">{}</a>'.format(
             urllib.quote(repo_name_utf8), repo_name)
         assert_session_flash(response, flash_msg)
 
         # test if the repo was created in the database
         new_repo = RepoModel().get_by_repo_name(repo_name)
 
         assert new_repo.repo_name == repo_name
         assert new_repo.description == description
 
         # test if the repository is visible in the list ?
         response = self.app.get(
             h.route_path('repo_summary', repo_name=safe_str(repo_name)))
         response.mustcontain(repo_name)
         response.mustcontain(backend.alias)
 
         assert repo_on_filesystem(repo_name)

rhodecode/apps/admin/tests/test_admin_settings.py

@@ -1,743 +1,743 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2019 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import mock
 import pytest
 
 import rhodecode
 from rhodecode.apps._base import ADMIN_PREFIX
 from rhodecode.lib.utils2 import md5
 from rhodecode.model.db import RhodeCodeUi
 from rhodecode.model.meta import Session
 from rhodecode.model.settings import SettingsModel, IssueTrackerSettingsModel
 from rhodecode.tests import assert_session_flash
 from rhodecode.tests.utils import AssertResponse
 
 
 UPDATE_DATA_QUALNAME = 'rhodecode.model.update.UpdateModel.get_update_data'
 
 
 def route_path(name, params=None, **kwargs):
     import urllib
     from rhodecode.apps._base import ADMIN_PREFIX
 
     base_url = {
 
         'admin_settings':
             ADMIN_PREFIX +'/settings',
         'admin_settings_update':
             ADMIN_PREFIX + '/settings/update',
         'admin_settings_global':
             ADMIN_PREFIX + '/settings/global',
         'admin_settings_global_update':
             ADMIN_PREFIX + '/settings/global/update',
         'admin_settings_vcs':
             ADMIN_PREFIX + '/settings/vcs',
         'admin_settings_vcs_update':
             ADMIN_PREFIX + '/settings/vcs/update',
         'admin_settings_vcs_svn_pattern_delete':
             ADMIN_PREFIX + '/settings/vcs/svn_pattern_delete',
         'admin_settings_mapping':
             ADMIN_PREFIX + '/settings/mapping',
         'admin_settings_mapping_update':
             ADMIN_PREFIX + '/settings/mapping/update',
         'admin_settings_visual':
             ADMIN_PREFIX + '/settings/visual',
         'admin_settings_visual_update':
             ADMIN_PREFIX + '/settings/visual/update',
         'admin_settings_issuetracker':
             ADMIN_PREFIX + '/settings/issue-tracker',
         'admin_settings_issuetracker_update':
             ADMIN_PREFIX + '/settings/issue-tracker/update',
         'admin_settings_issuetracker_test':
             ADMIN_PREFIX + '/settings/issue-tracker/test',
         'admin_settings_issuetracker_delete':
             ADMIN_PREFIX + '/settings/issue-tracker/delete',
         'admin_settings_email':
             ADMIN_PREFIX + '/settings/email',
         'admin_settings_email_update':
             ADMIN_PREFIX + '/settings/email/update',
         'admin_settings_hooks':
             ADMIN_PREFIX + '/settings/hooks',
         'admin_settings_hooks_update':
             ADMIN_PREFIX + '/settings/hooks/update',
         'admin_settings_hooks_delete':
             ADMIN_PREFIX + '/settings/hooks/delete',
         'admin_settings_search':
             ADMIN_PREFIX + '/settings/search',
         'admin_settings_labs':
             ADMIN_PREFIX + '/settings/labs',
         'admin_settings_labs_update':
             ADMIN_PREFIX + '/settings/labs/update',
 
         'admin_settings_sessions':
             ADMIN_PREFIX + '/settings/sessions',
         'admin_settings_sessions_cleanup':
             ADMIN_PREFIX + '/settings/sessions/cleanup',
         'admin_settings_system':
             ADMIN_PREFIX + '/settings/system',
         'admin_settings_system_update':
             ADMIN_PREFIX + '/settings/system/updates',
         'admin_settings_open_source':
             ADMIN_PREFIX + '/settings/open_source',
 
 
     }[name].format(**kwargs)
 
     if params:
         base_url = '{}?{}'.format(base_url, urllib.urlencode(params))
     return base_url
 
 
 @pytest.mark.usefixtures('autologin_user', 'app')
 class TestAdminSettingsController(object):
 
     @pytest.mark.parametrize('urlname', [
         'admin_settings_vcs',
         'admin_settings_mapping',
         'admin_settings_global',
         'admin_settings_visual',
         'admin_settings_email',
         'admin_settings_hooks',
         'admin_settings_search',
     ])
     def test_simple_get(self, urlname):
         self.app.get(route_path(urlname))
 
     def test_create_custom_hook(self, csrf_token):
         response = self.app.post(
             route_path('admin_settings_hooks_update'),
             params={
                 'new_hook_ui_key': 'test_hooks_1',
                 'new_hook_ui_value': 'cd /tmp',
                 'csrf_token': csrf_token})
 
         response = response.follow()
         response.mustcontain('test_hooks_1')
         response.mustcontain('cd /tmp')
 
     def test_create_custom_hook_delete(self, csrf_token):
         response = self.app.post(
             route_path('admin_settings_hooks_update'),
             params={
                 'new_hook_ui_key': 'test_hooks_2',
                 'new_hook_ui_value': 'cd /tmp2',
                 'csrf_token': csrf_token})
 
         response = response.follow()
         response.mustcontain('test_hooks_2')
         response.mustcontain('cd /tmp2')
 
         hook_id = SettingsModel().get_ui_by_key('test_hooks_2').ui_id
 
         # delete
         self.app.post(
             route_path('admin_settings_hooks_delete'),
             params={'hook_id': hook_id, 'csrf_token': csrf_token})
         response = self.app.get(route_path('admin_settings_hooks'))
         response.mustcontain(no=['test_hooks_2'])
         response.mustcontain(no=['cd /tmp2'])
 
 
 @pytest.mark.usefixtures('autologin_user', 'app')
 class TestAdminSettingsGlobal(object):
 
     def test_pre_post_code_code_active(self, csrf_token):
         pre_code = 'rc-pre-code-187652122'
         post_code = 'rc-postcode-98165231'
 
         response = self.post_and_verify_settings({
             'rhodecode_pre_code': pre_code,
             'rhodecode_post_code': post_code,
             'csrf_token': csrf_token,
         })
 
         response = response.follow()
         response.mustcontain(pre_code, post_code)
 
     def test_pre_post_code_code_inactive(self, csrf_token):
         pre_code = 'rc-pre-code-187652122'
         post_code = 'rc-postcode-98165231'
         response = self.post_and_verify_settings({
             'rhodecode_pre_code': '',
             'rhodecode_post_code': '',
             'csrf_token': csrf_token,
         })
 
         response = response.follow()
         response.mustcontain(no=[pre_code, post_code])
 
     def test_captcha_activate(self, csrf_token):
         self.post_and_verify_settings({
             'rhodecode_captcha_private_key': '1234567890',
             'rhodecode_captcha_public_key': '1234567890',
             'csrf_token': csrf_token,
         })
 
         response = self.app.get(ADMIN_PREFIX + '/register')
         response.mustcontain('captcha')
 
     def test_captcha_deactivate(self, csrf_token):
         self.post_and_verify_settings({
             'rhodecode_captcha_private_key': '',
             'rhodecode_captcha_public_key': '1234567890',
             'csrf_token': csrf_token,
         })
 
         response = self.app.get(ADMIN_PREFIX + '/register')
         response.mustcontain(no=['captcha'])
 
     def test_title_change(self, csrf_token):
         old_title = 'RhodeCode'
 
         for new_title in ['Changed', 'Żółwik', old_title]:
             response = self.post_and_verify_settings({
                 'rhodecode_title': new_title,
                 'csrf_token': csrf_token,
             })
 
             response = response.follow()
             response.mustcontain(new_title)
 
     def post_and_verify_settings(self, settings):
         old_title = 'RhodeCode'
         old_realm = 'RhodeCode authentication'
         params = {
             'rhodecode_title': old_title,
             'rhodecode_realm': old_realm,
             'rhodecode_pre_code': '',
             'rhodecode_post_code': '',
             'rhodecode_captcha_private_key': '',
             'rhodecode_captcha_public_key': '',
             'rhodecode_create_personal_repo_group': False,
             'rhodecode_personal_repo_group_pattern': '${username}',
         }
         params.update(settings)
         response = self.app.post(
             route_path('admin_settings_global_update'), params=params)
 
         assert_session_flash(response, 'Updated application settings')
         app_settings = SettingsModel().get_all_settings()
         del settings['csrf_token']
         for key, value in settings.iteritems():
             assert app_settings[key] == value.decode('utf-8')
 
         return response
 
 
 @pytest.mark.usefixtures('autologin_user', 'app')
 class TestAdminSettingsVcs(object):
 
     def test_contains_svn_default_patterns(self):
         response = self.app.get(route_path('admin_settings_vcs'))
         expected_patterns = [
             '/trunk',
             '/branches/*',
             '/tags/*',
         ]
         for pattern in expected_patterns:
             response.mustcontain(pattern)
 
     def test_add_new_svn_branch_and_tag_pattern(
             self, backend_svn, form_defaults, disable_sql_cache,
             csrf_token):
         form_defaults.update({
             'new_svn_branch': '/exp/branches/*',
             'new_svn_tag': '/important_tags/*',
             'csrf_token': csrf_token,
         })
 
         response = self.app.post(
             route_path('admin_settings_vcs_update'),
             params=form_defaults, status=302)
         response = response.follow()
 
         # Expect to find the new values on the page
         response.mustcontain('/exp/branches/*')
         response.mustcontain('/important_tags/*')
 
         # Expect that those patterns are used to match branches and tags now
         repo = backend_svn['svn-simple-layout'].scm_instance()
         assert 'exp/branches/exp-sphinx-docs' in repo.branches
         assert 'important_tags/v0.5' in repo.tags
 
     def test_add_same_svn_value_twice_shows_an_error_message(
             self, form_defaults, csrf_token, settings_util):
         settings_util.create_rhodecode_ui('vcs_svn_branch', '/test')
         settings_util.create_rhodecode_ui('vcs_svn_tag', '/test')
 
         response = self.app.post(
             route_path('admin_settings_vcs_update'),
             params={
                 'paths_root_path': form_defaults['paths_root_path'],
                 'new_svn_branch': '/test',
                 'new_svn_tag': '/test',
                 'csrf_token': csrf_token,
             },
             status=200)
 
         response.mustcontain("Pattern already exists")
         response.mustcontain("Some form inputs contain invalid data.")
 
     @pytest.mark.parametrize('section', [
         'vcs_svn_branch',
         'vcs_svn_tag',
     ])
     def test_delete_svn_patterns(
             self, section, csrf_token, settings_util):
         setting = settings_util.create_rhodecode_ui(
             section, '/test_delete', cleanup=False)
 
         self.app.post(
             route_path('admin_settings_vcs_svn_pattern_delete'),
             params={
                 'delete_svn_pattern': setting.ui_id,
                 'csrf_token': csrf_token},
             headers={'X-REQUESTED-WITH': 'XMLHttpRequest'})
 
     @pytest.mark.parametrize('section', [
         'vcs_svn_branch',
         'vcs_svn_tag',
     ])
     def test_delete_svn_patterns_raises_404_when_no_xhr(
             self, section, csrf_token, settings_util):
         setting = settings_util.create_rhodecode_ui(section, '/test_delete')
 
         self.app.post(
             route_path('admin_settings_vcs_svn_pattern_delete'),
             params={
                 'delete_svn_pattern': setting.ui_id,
                 'csrf_token': csrf_token},
             status=404)
 
     def test_extensions_hgsubversion(self, form_defaults, csrf_token):
         form_defaults.update({
             'csrf_token': csrf_token,
             'extensions_hgsubversion': 'True',
         })
         response = self.app.post(
             route_path('admin_settings_vcs_update'),
             params=form_defaults,
             status=302)
 
         response = response.follow()
         extensions_input = (
             '<input id="extensions_hgsubversion" '
             'name="extensions_hgsubversion" type="checkbox" '
             'value="True" checked="checked" />')
         response.mustcontain(extensions_input)
 
     def test_extensions_hgevolve(self, form_defaults, csrf_token):
         form_defaults.update({
             'csrf_token': csrf_token,
             'extensions_evolve': 'True',
         })
         response = self.app.post(
             route_path('admin_settings_vcs_update'),
             params=form_defaults,
             status=302)
 
         response = response.follow()
         extensions_input = (
             '<input id="extensions_evolve" '
             'name="extensions_evolve" type="checkbox" '
             'value="True" checked="checked" />')
         response.mustcontain(extensions_input)
 
     def test_has_a_section_for_pull_request_settings(self):
         response = self.app.get(route_path('admin_settings_vcs'))
         response.mustcontain('Pull Request Settings')
 
     def test_has_an_input_for_invalidation_of_inline_comments(self):
         response = self.app.get(route_path('admin_settings_vcs'))
-        assert_response = AssertResponse(response)
+        assert_response = response.assert_response()
         assert_response.one_element_exists(
             '[name=rhodecode_use_outdated_comments]')
 
     @pytest.mark.parametrize('new_value', [True, False])
     def test_allows_to_change_invalidation_of_inline_comments(
             self, form_defaults, csrf_token, new_value):
         setting_key = 'use_outdated_comments'
         setting = SettingsModel().create_or_update_setting(
             setting_key, not new_value, 'bool')
         Session().add(setting)
         Session().commit()
 
         form_defaults.update({
             'csrf_token': csrf_token,
             'rhodecode_use_outdated_comments': str(new_value),
         })
         response = self.app.post(
             route_path('admin_settings_vcs_update'),
             params=form_defaults,
             status=302)
         response = response.follow()
         setting = SettingsModel().get_setting_by_name(setting_key)
         assert setting.app_settings_value is new_value
 
     @pytest.mark.parametrize('new_value', [True, False])
     def test_allows_to_change_hg_rebase_merge_strategy(
             self, form_defaults, csrf_token, new_value):
         setting_key = 'hg_use_rebase_for_merging'
 
         form_defaults.update({
             'csrf_token': csrf_token,
             'rhodecode_' + setting_key: str(new_value),
         })
 
         with mock.patch.dict(
                 rhodecode.CONFIG, {'labs_settings_active': 'true'}):
             self.app.post(
                 route_path('admin_settings_vcs_update'),
                 params=form_defaults,
                 status=302)
 
         setting = SettingsModel().get_setting_by_name(setting_key)
         assert setting.app_settings_value is new_value
 
     @pytest.fixture()
     def disable_sql_cache(self, request):
         patcher = mock.patch(
             'rhodecode.lib.caching_query.FromCache.process_query')
         request.addfinalizer(patcher.stop)
         patcher.start()
 
     @pytest.fixture()
     def form_defaults(self):
         from rhodecode.apps.admin.views.settings import AdminSettingsView
         return AdminSettingsView._form_defaults()
 
     # TODO: johbo: What we really want is to checkpoint before a test run and
     # reset the session afterwards.
     @pytest.fixture(scope='class', autouse=True)
     def cleanup_settings(self, request, baseapp):
         ui_id = RhodeCodeUi.ui_id
         original_ids = list(
             r.ui_id for r in RhodeCodeUi.query().values(ui_id))
 
         @request.addfinalizer
         def cleanup():
             RhodeCodeUi.query().filter(
                 ui_id.notin_(original_ids)).delete(False)
 
 
 @pytest.mark.usefixtures('autologin_user', 'app')
 class TestLabsSettings(object):
     def test_get_settings_page_disabled(self):
         with mock.patch.dict(
                 rhodecode.CONFIG, {'labs_settings_active': 'false'}):
 
             response = self.app.get(
                 route_path('admin_settings_labs'), status=302)
 
         assert response.location.endswith(route_path('admin_settings'))
 
     def test_get_settings_page_enabled(self):
         from rhodecode.apps.admin.views import settings
         lab_settings = [
             settings.LabSetting(
                 key='rhodecode_bool',
                 type='bool',
                 group='bool group',
                 label='bool label',
                 help='bool help'
             ),
             settings.LabSetting(
                 key='rhodecode_text',
                 type='unicode',
                 group='text group',
                 label='text label',
                 help='text help'
             ),
         ]
         with mock.patch.dict(rhodecode.CONFIG,
                              {'labs_settings_active': 'true'}):
             with mock.patch.object(settings, '_LAB_SETTINGS', lab_settings):
                 response = self.app.get(route_path('admin_settings_labs'))
 
         assert '<label>bool group:</label>' in response
         assert '<label for="rhodecode_bool">bool label</label>' in response
         assert '<p class="help-block">bool help</p>' in response
         assert 'name="rhodecode_bool" type="checkbox"' in response
 
         assert '<label>text group:</label>' in response
         assert '<label for="rhodecode_text">text label</label>' in response
         assert '<p class="help-block">text help</p>' in response
         assert 'name="rhodecode_text" size="60" type="text"' in response
 
 
 @pytest.mark.usefixtures('app')
 class TestOpenSourceLicenses(object):
 
     def test_records_are_displayed(self, autologin_user):
         sample_licenses = [
             {
                 "license": [
                     {
                         "fullName": "BSD 4-clause \"Original\" or \"Old\" License",
                         "shortName": "bsdOriginal",
                         "spdxId": "BSD-4-Clause",
                         "url": "http://spdx.org/licenses/BSD-4-Clause.html"
                     }
                 ],
                 "name": "python2.7-coverage-3.7.1"
             },
             {
                 "license": [
                     {
                         "fullName": "MIT License",
                         "shortName": "mit",
                         "spdxId": "MIT",
                         "url": "http://spdx.org/licenses/MIT.html"
                     }
                 ],
                 "name": "python2.7-bootstrapped-pip-9.0.1"
             },
         ]
         read_licenses_patch = mock.patch(
             'rhodecode.apps.admin.views.open_source_licenses.read_opensource_licenses',
             return_value=sample_licenses)
         with read_licenses_patch:
             response = self.app.get(
                 route_path('admin_settings_open_source'), status=200)
 
-        assert_response = AssertResponse(response)
+        assert_response = response.assert_response()
         assert_response.element_contains(
             '.panel-heading', 'Licenses of Third Party Packages')
         for license_data in sample_licenses:
             response.mustcontain(license_data["license"][0]["spdxId"])
             assert_response.element_contains('.panel-body', license_data["name"])
 
     def test_records_can_be_read(self, autologin_user):
         response = self.app.get(
             route_path('admin_settings_open_source'), status=200)
-        assert_response = AssertResponse(response)
+        assert_response = response.assert_response()
         assert_response.element_contains(
             '.panel-heading', 'Licenses of Third Party Packages')
 
     def test_forbidden_when_normal_user(self, autologin_regular_user):
         self.app.get(
             route_path('admin_settings_open_source'), status=404)
 
 
 @pytest.mark.usefixtures('app')
 class TestUserSessions(object):
 
     def test_forbidden_when_normal_user(self, autologin_regular_user):
         self.app.get(route_path('admin_settings_sessions'), status=404)
 
     def test_show_sessions_page(self, autologin_user):
         response = self.app.get(route_path('admin_settings_sessions'), status=200)
         response.mustcontain('file')
 
     def test_cleanup_old_sessions(self, autologin_user, csrf_token):
 
         post_data = {
             'csrf_token': csrf_token,
             'expire_days': '60'
         }
         response = self.app.post(
             route_path('admin_settings_sessions_cleanup'), params=post_data,
             status=302)
         assert_session_flash(response, 'Cleaned up old sessions')
 
 
 @pytest.mark.usefixtures('app')
 class TestAdminSystemInfo(object):
 
     def test_forbidden_when_normal_user(self, autologin_regular_user):
         self.app.get(route_path('admin_settings_system'), status=404)
 
     def test_system_info_page(self, autologin_user):
         response = self.app.get(route_path('admin_settings_system'))
         response.mustcontain('RhodeCode Community Edition, version {}'.format(
             rhodecode.__version__))
 
     def test_system_update_new_version(self, autologin_user):
         update_data = {
             'versions': [
                 {
                     'version': '100.3.1415926535',
                     'general': 'The latest version we are ever going to ship'
                 },
                 {
                     'version': '0.0.0',
                     'general': 'The first version we ever shipped'
                 }
             ]
         }
         with mock.patch(UPDATE_DATA_QUALNAME, return_value=update_data):
             response = self.app.get(route_path('admin_settings_system_update'))
             response.mustcontain('A <b>new version</b> is available')
 
     def test_system_update_nothing_new(self, autologin_user):
         update_data = {
             'versions': [
                 {
                     'version': '0.0.0',
                     'general': 'The first version we ever shipped'
                 }
             ]
         }
         with mock.patch(UPDATE_DATA_QUALNAME, return_value=update_data):
             response = self.app.get(route_path('admin_settings_system_update'))
             response.mustcontain(
                 'This instance is already running the <b>latest</b> stable version')
 
     def test_system_update_bad_response(self, autologin_user):
         with mock.patch(UPDATE_DATA_QUALNAME, side_effect=ValueError('foo')):
             response = self.app.get(route_path('admin_settings_system_update'))
             response.mustcontain(
                 'Bad data sent from update server')
 
 
 @pytest.mark.usefixtures("app")
 class TestAdminSettingsIssueTracker(object):
     RC_PREFIX = 'rhodecode_'
     SHORT_PATTERN_KEY = 'issuetracker_pat_'
     PATTERN_KEY = RC_PREFIX + SHORT_PATTERN_KEY
 
     def test_issuetracker_index(self, autologin_user):
         response = self.app.get(route_path('admin_settings_issuetracker'))
         assert response.status_code == 200
 
     def test_add_empty_issuetracker_pattern(
             self, request, autologin_user, csrf_token):
         post_url = route_path('admin_settings_issuetracker_update')
         post_data = {
             'csrf_token': csrf_token
         }
         self.app.post(post_url, post_data, status=302)
 
     def test_add_issuetracker_pattern(
             self, request, autologin_user, csrf_token):
         pattern = 'issuetracker_pat'
         another_pattern = pattern+'1'
         post_url = route_path('admin_settings_issuetracker_update')
         post_data = {
             'new_pattern_pattern_0': pattern,
             'new_pattern_url_0': 'http://url',
             'new_pattern_prefix_0': 'prefix',
             'new_pattern_description_0': 'description',
             'new_pattern_pattern_1': another_pattern,
             'new_pattern_url_1': 'https://url1',
             'new_pattern_prefix_1': 'prefix1',
             'new_pattern_description_1': 'description1',
             'csrf_token': csrf_token
         }
         self.app.post(post_url, post_data, status=302)
         settings = SettingsModel().get_all_settings()
         self.uid = md5(pattern)
         assert settings[self.PATTERN_KEY+self.uid] == pattern
         self.another_uid = md5(another_pattern)
         assert settings[self.PATTERN_KEY+self.another_uid] == another_pattern
 
         @request.addfinalizer
         def cleanup():
             defaults = SettingsModel().get_all_settings()
 
             entries = [name for name in defaults if (
                 (self.uid in name) or (self.another_uid) in name)]
             start = len(self.RC_PREFIX)
             for del_key in entries:
                 # TODO: anderson: get_by_name needs name without prefix
                 entry = SettingsModel().get_setting_by_name(del_key[start:])
                 Session().delete(entry)
 
             Session().commit()
 
     def test_edit_issuetracker_pattern(
             self, autologin_user, backend, csrf_token, request):
         old_pattern = 'issuetracker_pat'
         old_uid = md5(old_pattern)
         pattern = 'issuetracker_pat_new'
         self.new_uid = md5(pattern)
 
         SettingsModel().create_or_update_setting(
             self.SHORT_PATTERN_KEY+old_uid, old_pattern, 'unicode')
 
         post_url = route_path('admin_settings_issuetracker_update')
         post_data = {
             'new_pattern_pattern_0': pattern,
             'new_pattern_url_0': 'https://url',
             'new_pattern_prefix_0': 'prefix',
             'new_pattern_description_0': 'description',
             'uid': old_uid,
             'csrf_token': csrf_token
         }
         self.app.post(post_url, post_data, status=302)
         settings = SettingsModel().get_all_settings()
         assert settings[self.PATTERN_KEY+self.new_uid] == pattern
         assert self.PATTERN_KEY+old_uid not in settings
 
         @request.addfinalizer
         def cleanup():
             IssueTrackerSettingsModel().delete_entries(self.new_uid)
 
     def test_replace_issuetracker_pattern_description(
             self, autologin_user, csrf_token, request, settings_util):
         prefix = 'issuetracker'
         pattern = 'issuetracker_pat'
         self.uid = md5(pattern)
         pattern_key = '_'.join([prefix, 'pat', self.uid])
         rc_pattern_key = '_'.join(['rhodecode', pattern_key])
         desc_key = '_'.join([prefix, 'desc', self.uid])
         rc_desc_key = '_'.join(['rhodecode', desc_key])
         new_description = 'new_description'
 
         settings_util.create_rhodecode_setting(
             pattern_key, pattern, 'unicode', cleanup=False)
         settings_util.create_rhodecode_setting(
             desc_key, 'old description', 'unicode', cleanup=False)
 
         post_url = route_path('admin_settings_issuetracker_update')
         post_data = {
             'new_pattern_pattern_0': pattern,
             'new_pattern_url_0': 'https://url',
             'new_pattern_prefix_0': 'prefix',
             'new_pattern_description_0': new_description,
             'uid': self.uid,
             'csrf_token': csrf_token
         }
         self.app.post(post_url, post_data, status=302)
         settings = SettingsModel().get_all_settings()
         assert settings[rc_pattern_key] == pattern
         assert settings[rc_desc_key] == new_description
 
         @request.addfinalizer
         def cleanup():
             IssueTrackerSettingsModel().delete_entries(self.uid)
 
     def test_delete_issuetracker_pattern(
             self, autologin_user, backend, csrf_token, settings_util):
         pattern = 'issuetracker_pat'
         uid = md5(pattern)
         settings_util.create_rhodecode_setting(
             self.SHORT_PATTERN_KEY+uid, pattern, 'unicode', cleanup=False)
 
         post_url = route_path('admin_settings_issuetracker_delete')
         post_data = {
             '_method': 'delete',
             'uid': uid,
             'csrf_token': csrf_token
         }
         self.app.post(post_url, post_data, status=302)
         settings = SettingsModel().get_all_settings()
         assert 'rhodecode_%s%s' % (self.SHORT_PATTERN_KEY, uid) not in settings

rhodecode/apps/login/tests/test_password_reset.py

@@ -1,118 +1,118 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2019 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import pytest
 
 from rhodecode.lib import helpers as h
 from rhodecode.tests import (
     TestController, clear_cache_regions,
     TEST_USER_ADMIN_LOGIN, TEST_USER_ADMIN_PASS)
 from rhodecode.tests.fixture import Fixture
 from rhodecode.tests.utils import AssertResponse
 
 fixture = Fixture()
 
 
 def route_path(name, params=None, **kwargs):
     import urllib
     from rhodecode.apps._base import ADMIN_PREFIX
 
     base_url = {
         'login': ADMIN_PREFIX + '/login',
         'logout': ADMIN_PREFIX + '/logout',
         'register': ADMIN_PREFIX + '/register',
         'reset_password':
             ADMIN_PREFIX + '/password_reset',
         'reset_password_confirmation':
             ADMIN_PREFIX + '/password_reset_confirmation',
 
         'admin_permissions_application':
             ADMIN_PREFIX + '/permissions/application',
         'admin_permissions_application_update':
             ADMIN_PREFIX + '/permissions/application/update',
     }[name].format(**kwargs)
 
     if params:
         base_url = '{}?{}'.format(base_url, urllib.urlencode(params))
     return base_url
 
 
 class TestPasswordReset(TestController):
 
     @pytest.mark.parametrize(
         'pwd_reset_setting, show_link, show_reset', [
             ('hg.password_reset.enabled', True, True),
             ('hg.password_reset.hidden', False, True),
             ('hg.password_reset.disabled', False, False),
         ])
     def test_password_reset_settings(
             self, pwd_reset_setting, show_link, show_reset):
         clear_cache_regions()
         self.log_user(TEST_USER_ADMIN_LOGIN, TEST_USER_ADMIN_PASS)
         params = {
             'csrf_token': self.csrf_token,
             'anonymous': 'True',
             'default_register': 'hg.register.auto_activate',
             'default_register_message': '',
             'default_password_reset': pwd_reset_setting,
             'default_extern_activate': 'hg.extern_activate.auto',
         }
         resp = self.app.post(
             route_path('admin_permissions_application_update'), params=params)
         self.logout_user()
 
         login_page = self.app.get(route_path('login'))
         asr_login = AssertResponse(login_page)
 
         if show_link:
             asr_login.one_element_exists('a.pwd_reset')
         else:
             asr_login.no_element_exists('a.pwd_reset')
 
         response = self.app.get(route_path('reset_password'))
         
-        assert_response = AssertResponse(response)
+        assert_response = response.assert_response()
         if show_reset:
             response.mustcontain('Send password reset email')
             assert_response.one_element_exists('#email')
             assert_response.one_element_exists('#send')
         else:
             response.mustcontain('Password reset is disabled.')
             assert_response.no_element_exists('#email')
             assert_response.no_element_exists('#send')
 
     def test_password_form_disabled(self):
         self.log_user(TEST_USER_ADMIN_LOGIN, TEST_USER_ADMIN_PASS)
         params = {
             'csrf_token': self.csrf_token,
             'anonymous': 'True',
             'default_register': 'hg.register.auto_activate',
             'default_register_message': '',
             'default_password_reset': 'hg.password_reset.disabled',
             'default_extern_activate': 'hg.extern_activate.auto',
         }
         self.app.post(route_path('admin_permissions_application_update'), params=params)
         self.logout_user()
 
         response = self.app.post(
             route_path('reset_password'), {'email': '[e-mail]',}
         )
         response = response.follow()
         response.mustcontain('Password reset is disabled.')

rhodecode/apps/login/tests/test_register_captcha.py

@@ -1,133 +1,133 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2016-2019 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 
 import mock
 import pytest
 
 from rhodecode.apps._base import ADMIN_PREFIX
 from rhodecode.apps.login.views import LoginView, CaptchaData
 from rhodecode.model.settings import SettingsModel
 from rhodecode.lib.utils2 import AttributeDict
 from rhodecode.tests.utils import AssertResponse
 
 
 class RhodeCodeSetting(object):
     def __init__(self, name, value):
         self.name = name
         self.value = value
 
     def __enter__(self):
         from rhodecode.model.settings import SettingsModel
         model = SettingsModel()
         self.old_setting = model.get_setting_by_name(self.name)
         model.create_or_update_setting(name=self.name, val=self.value)
         return self
 
     def __exit__(self, exc_type, exc_val, exc_tb):
         model = SettingsModel()
         if self.old_setting:
             model.create_or_update_setting(
                 name=self.name, val=self.old_setting.app_settings_value)
         else:
             model.create_or_update_setting(name=self.name)
 
 
 class TestRegisterCaptcha(object):
 
     @pytest.mark.parametrize('private_key, public_key, expected', [
         ('',        '',       CaptchaData(False, '',        '')),
         ('',        'pubkey', CaptchaData(False, '',        'pubkey')),
         ('privkey', '',       CaptchaData(True,  'privkey', '')),
         ('privkey', 'pubkey', CaptchaData(True,  'privkey', 'pubkey')),
     ])
     def test_get_captcha_data(self, private_key, public_key, expected,
                               request_stub, user_util):
         request_stub.user = user_util.create_user().AuthUser()
         request_stub.matched_route = AttributeDict({'name': 'login'})
         login_view = LoginView(mock.Mock(), request_stub)
 
         with RhodeCodeSetting('captcha_private_key', private_key):
             with RhodeCodeSetting('captcha_public_key', public_key):
                 captcha = login_view._get_captcha_data()
                 assert captcha == expected
 
     @pytest.mark.parametrize('active', [False, True])
     @mock.patch.object(LoginView, '_get_captcha_data')
     def test_private_key_does_not_leak_to_html(
             self, m_get_captcha_data, active, app):
         captcha = CaptchaData(
             active=active, private_key='PRIVATE_KEY', public_key='PUBLIC_KEY')
         m_get_captcha_data.return_value = captcha
 
         response = app.get(ADMIN_PREFIX + '/register')
         assert 'PRIVATE_KEY' not in response
 
     @pytest.mark.parametrize('active', [False, True])
     @mock.patch.object(LoginView, '_get_captcha_data')
     def test_register_view_renders_captcha(
             self, m_get_captcha_data, active, app):
         captcha = CaptchaData(
             active=active, private_key='PRIVATE_KEY', public_key='PUBLIC_KEY')
         m_get_captcha_data.return_value = captcha
 
         response = app.get(ADMIN_PREFIX + '/register')
 
-        assertr = AssertResponse(response)
+        assertr = response.assert_response()
         if active:
             assertr.one_element_exists('#recaptcha_field')
         else:
             assertr.no_element_exists('#recaptcha_field')
 
     @pytest.mark.parametrize('valid', [False, True])
     @mock.patch.object(LoginView, 'validate_captcha')
     @mock.patch.object(LoginView, '_get_captcha_data')
     def test_register_with_active_captcha(
             self, m_get_captcha_data, m_validate_captcha, valid, app, csrf_token):
         captcha = CaptchaData(
             active=True, private_key='PRIVATE_KEY', public_key='PUBLIC_KEY')
         m_get_captcha_data.return_value = captcha
         m_response = mock.Mock()
         m_response.is_valid = valid
         m_validate_captcha.return_value = valid, 'ok'
 
         params = {
             'csrf_token': csrf_token,
             'email': '[e-mail]',
             'firstname': 'pytest-firstname',
             'lastname': 'pytest-lastname',
             'password': 'secret',
             'password_confirmation': 'secret',
             'username': 'pytest',
         }
         response = app.post(ADMIN_PREFIX + '/register', params=params)
 
         if valid:
             # If we provided a valid captcha input we expect a successful
             # registration and redirect to the login page.
             assert response.status_int == 302
             assert 'location' in response.headers
             assert ADMIN_PREFIX + '/login' in response.headers['location']
         else:
             # If captche input is invalid we expect to stay on the registration
             # page with an error message displayed.
-            assertr = AssertResponse(response)
+            assertr = response.assert_response()
             assert response.status_int == 200
             assertr.one_element_exists('#recaptcha_field ~ span.error-message')

rhodecode/apps/repository/tests/test_repo_feed.py

@@ -1,137 +1,137 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2019 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import pytest
 from rhodecode.model.auth_token import AuthTokenModel
 from rhodecode.tests import TestController
 
 
 def route_path(name, params=None, **kwargs):
     import urllib
 
     base_url = {
         'rss_feed_home': '/{repo_name}/feed-rss',
         'atom_feed_home': '/{repo_name}/feed-atom',
         'rss_feed_home_old': '/{repo_name}/feed/rss',
         'atom_feed_home_old': '/{repo_name}/feed/atom',
     }[name].format(**kwargs)
 
     if params:
         base_url = '{}?{}'.format(base_url, urllib.urlencode(params))
     return base_url
 
 
 class TestFeedView(TestController):
 
     @pytest.mark.parametrize("feed_type,response_types,content_type",[
         ('rss', ['<rss version="2.0">'],
          "application/rss+xml"),
         ('atom', ['xmlns="http://www.w3.org/2005/Atom"', 'xml:lang="en-us"'],
          "application/atom+xml"),
     ])
     def test_feed(self, backend, feed_type, response_types, content_type):
         self.log_user()
         response = self.app.get(
             route_path('{}_feed_home'.format(feed_type),
                        repo_name=backend.repo_name))
 
         for content in response_types:
             response.mustcontain(content)
 
         assert response.content_type == content_type
 
     @pytest.mark.parametrize("feed_type, content_type", [
         ('rss', "application/rss+xml"),
         ('atom', "application/atom+xml")
     ])
     def test_feed_with_auth_token(
             self, backend, user_admin, feed_type, content_type):
         auth_token = user_admin.feed_token
         assert auth_token != ''
 
         response = self.app.get(
             route_path(
                 '{}_feed_home'.format(feed_type),
                 repo_name=backend.repo_name,
                 params=dict(auth_token=auth_token)),
             status=200)
 
         assert response.content_type == content_type
 
     @pytest.mark.parametrize("feed_type, content_type", [
         ('rss', "application/rss+xml"),
         ('atom', "application/atom+xml")
     ])
     def test_feed_with_auth_token_by_uid(
             self, backend, user_admin, feed_type, content_type):
         auth_token = user_admin.feed_token
         assert auth_token != ''
 
         response = self.app.get(
             route_path(
                 '{}_feed_home'.format(feed_type),
                 repo_name='_{}'.format(backend.repo.repo_id),
                 params=dict(auth_token=auth_token)),
             status=200)
 
         assert response.content_type == content_type
 
     @pytest.mark.parametrize("feed_type, content_type", [
         ('rss', "application/rss+xml"),
         ('atom', "application/atom+xml")
     ])
     def test_feed_old_urls_with_auth_token(
             self, backend, user_admin, feed_type, content_type):
         auth_token = user_admin.feed_token
         assert auth_token != ''
 
         response = self.app.get(
             route_path(
                 '{}_feed_home_old'.format(feed_type),
                 repo_name=backend.repo_name,
                 params=dict(auth_token=auth_token)),
             status=200)
 
         assert response.content_type == content_type
 
     @pytest.mark.parametrize("feed_type", ['rss', 'atom'])
     def test_feed_with_auth_token_of_wrong_type(
             self, backend, user_util, feed_type):
         user = user_util.create_user()
         auth_token = AuthTokenModel().create(
-            user.user_id, 'test-token', -1, AuthTokenModel.cls.ROLE_API)
+            user.user_id, u'test-token', -1, AuthTokenModel.cls.ROLE_API)
         auth_token = auth_token.api_key
 
         self.app.get(
             route_path(
                 '{}_feed_home'.format(feed_type),
                 repo_name=backend.repo_name,
                 params=dict(auth_token=auth_token)),
             status=302)
 
         auth_token = AuthTokenModel().create(
-            user.user_id, 'test-token', -1, AuthTokenModel.cls.ROLE_FEED)
+            user.user_id, u'test-token', -1, AuthTokenModel.cls.ROLE_FEED)
         auth_token = auth_token.api_key
         self.app.get(
             route_path(
                 '{}_feed_home'.format(feed_type),
                 repo_name=backend.repo_name,
                 params=dict(auth_token=auth_token)),
             status=200)

rhodecode/apps/repository/tests/test_repo_summary.py

@@ -1,524 +1,524 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2019 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import re
 
 import mock
 import pytest
 
 from rhodecode.apps.repository.views.repo_summary import RepoSummaryView
 from rhodecode.lib import helpers as h
 from rhodecode.lib.compat import OrderedDict
 from rhodecode.lib.utils2 import AttributeDict, safe_str
 from rhodecode.lib.vcs.exceptions import RepositoryRequirementError
 from rhodecode.model.db import Repository
 from rhodecode.model.meta import Session
 from rhodecode.model.repo import RepoModel
 from rhodecode.model.scm import ScmModel
 from rhodecode.tests import assert_session_flash
 from rhodecode.tests.fixture import Fixture
 from rhodecode.tests.utils import AssertResponse, repo_on_filesystem
 
 
 fixture = Fixture()
 
 
 def route_path(name, params=None, **kwargs):
     import urllib
 
     base_url = {
         'repo_summary': '/{repo_name}',
         'repo_stats': '/{repo_name}/repo_stats/{commit_id}',
         'repo_refs_data': '/{repo_name}/refs-data',
         'repo_refs_changelog_data': '/{repo_name}/refs-data-changelog',
         'repo_creating_check': '/{repo_name}/repo_creating_check',
     }[name].format(**kwargs)
 
     if params:
         base_url = '{}?{}'.format(base_url, urllib.urlencode(params))
     return base_url
 
 
 def assert_clone_url(response, server, repo, disabled=False):
 
     response.mustcontain(
         '<input type="text" class="input-monospace clone_url_input" '
         '{disabled}readonly="readonly" '
         'value="http://test_admin@{server}/{repo}"/>'.format(
             server=server, repo=repo, disabled='disabled ' if disabled else ' ')
     )
 
 
 @pytest.mark.usefixtures('app')
 class TestSummaryView(object):
     def test_index(self, autologin_user, backend, http_host_only_stub):
         repo_id = backend.repo.repo_id
         repo_name = backend.repo_name
         with mock.patch('rhodecode.lib.helpers.is_svn_without_proxy',
                         return_value=False):
             response = self.app.get(
                 route_path('repo_summary', repo_name=repo_name))
 
         # repo type
         response.mustcontain(
             '<i class="icon-%s">' % (backend.alias, )
         )
         # public/private
         response.mustcontain(
             """<i class="icon-unlock-alt">"""
         )
 
         # clone url...
         assert_clone_url(response, http_host_only_stub, repo_name)
         assert_clone_url(response, http_host_only_stub, '_{}'.format(repo_id))
 
     def test_index_svn_without_proxy(
             self, autologin_user, backend_svn, http_host_only_stub):
         repo_id = backend_svn.repo.repo_id
         repo_name = backend_svn.repo_name
         response = self.app.get(route_path('repo_summary', repo_name=repo_name))
         # clone url...
 
         assert_clone_url(response, http_host_only_stub, repo_name, disabled=True)
         assert_clone_url(response, http_host_only_stub, '_{}'.format(repo_id), disabled=True)
 
     def test_index_with_trailing_slash(
             self, autologin_user, backend, http_host_only_stub):
 
         repo_id = backend.repo.repo_id
         repo_name = backend.repo_name
         with mock.patch('rhodecode.lib.helpers.is_svn_without_proxy',
                         return_value=False):
             response = self.app.get(
                 route_path('repo_summary', repo_name=repo_name) + '/',
                 status=200)
 
         # clone url...
         assert_clone_url(response, http_host_only_stub, repo_name)
         assert_clone_url(response, http_host_only_stub, '_{}'.format(repo_id))
 
     def test_index_by_id(self, autologin_user, backend):
         repo_id = backend.repo.repo_id
         response = self.app.get(
             route_path('repo_summary', repo_name='_%s' % (repo_id,)))
 
         # repo type
         response.mustcontain(
             '<i class="icon-%s">' % (backend.alias, )
         )
         # public/private
         response.mustcontain(
             """<i class="icon-unlock-alt">"""
         )
 
     def test_index_by_repo_having_id_path_in_name_hg(self, autologin_user):
         fixture.create_repo(name='repo_1')
         response = self.app.get(route_path('repo_summary', repo_name='repo_1'))
 
         try:
             response.mustcontain("repo_1")
         finally:
             RepoModel().delete(Repository.get_by_repo_name('repo_1'))
             Session().commit()
 
     def test_index_with_anonymous_access_disabled(
             self, backend, disable_anonymous_user):
         response = self.app.get(
             route_path('repo_summary', repo_name=backend.repo_name), status=302)
         assert 'login' in response.location
 
     def _enable_stats(self, repo):
         r = Repository.get_by_repo_name(repo)
         r.enable_statistics = True
         Session().add(r)
         Session().commit()
 
     expected_trending = {
         'hg': {
             "py": {"count": 68, "desc": ["Python"]},
             "rst": {"count": 16, "desc": ["Rst"]},
             "css": {"count": 2, "desc": ["Css"]},
             "sh": {"count": 2, "desc": ["Bash"]},
             "bat": {"count": 1, "desc": ["Batch"]},
             "cfg": {"count": 1, "desc": ["Ini"]},
             "html": {"count": 1, "desc": ["EvoqueHtml", "Html"]},
             "ini": {"count": 1, "desc": ["Ini"]},
             "js": {"count": 1, "desc": ["Javascript"]},
             "makefile": {"count": 1, "desc": ["Makefile", "Makefile"]}
         },
         'git': {
             "py": {"count": 68, "desc": ["Python"]},
             "rst": {"count": 16, "desc": ["Rst"]},
             "css": {"count": 2, "desc": ["Css"]},
             "sh": {"count": 2, "desc": ["Bash"]},
             "bat": {"count": 1, "desc": ["Batch"]},
             "cfg": {"count": 1, "desc": ["Ini"]},
             "html": {"count": 1, "desc": ["EvoqueHtml", "Html"]},
             "ini": {"count": 1, "desc": ["Ini"]},
             "js": {"count": 1, "desc": ["Javascript"]},
             "makefile": {"count": 1, "desc": ["Makefile", "Makefile"]}
         },
         'svn': {
             "py": {"count": 75, "desc": ["Python"]},
             "rst": {"count": 16, "desc": ["Rst"]},
             "html": {"count": 11, "desc": ["EvoqueHtml", "Html"]},
             "css": {"count": 2, "desc": ["Css"]},
             "bat": {"count": 1, "desc": ["Batch"]},
             "cfg": {"count": 1, "desc": ["Ini"]},
             "ini": {"count": 1, "desc": ["Ini"]},
             "js": {"count": 1, "desc": ["Javascript"]},
             "makefile": {"count": 1, "desc": ["Makefile", "Makefile"]},
             "sh": {"count": 1, "desc": ["Bash"]}
         },
     }
 
     def test_repo_stats(self, autologin_user, backend, xhr_header):
         response = self.app.get(
             route_path(
                 'repo_stats', repo_name=backend.repo_name, commit_id='tip'),
             extra_environ=xhr_header,
             status=200)
         assert re.match(r'6[\d\.]+ KiB', response.json['size'])
 
     def test_repo_stats_code_stats_enabled(self, autologin_user, backend, xhr_header):
         repo_name = backend.repo_name
 
         # codes stats
         self._enable_stats(repo_name)
         ScmModel().mark_for_invalidation(repo_name)
 
         response = self.app.get(
             route_path(
                 'repo_stats', repo_name=backend.repo_name, commit_id='tip'),
             extra_environ=xhr_header,
             status=200)
 
         expected_data = self.expected_trending[backend.alias]
         returned_stats = response.json['code_stats']
         for k, v in expected_data.items():
             assert v == returned_stats[k]
 
     def test_repo_refs_data(self, backend):
         response = self.app.get(
             route_path('repo_refs_data', repo_name=backend.repo_name),
             status=200)
 
         # Ensure that there is the correct amount of items in the result
         repo = backend.repo.scm_instance()
         data = response.json['results']
         items = sum(len(section['children']) for section in data)
         repo_refs = len(repo.branches) + len(repo.tags) + len(repo.bookmarks)
         assert items == repo_refs
 
     def test_index_shows_missing_requirements_message(
             self, backend, autologin_user):
         repo_name = backend.repo_name
         scm_patcher = mock.patch.object(
             Repository, 'scm_instance', side_effect=RepositoryRequirementError)
 
         with scm_patcher:
             response = self.app.get(
                 route_path('repo_summary', repo_name=repo_name))
-        assert_response = AssertResponse(response)
+        assert_response = response.assert_response()
         assert_response.element_contains(
             '.main .alert-warning strong', 'Missing requirements')
         assert_response.element_contains(
             '.main .alert-warning',
             'Commits cannot be displayed, because this repository '
             'uses one or more extensions, which was not enabled.')
 
     def test_missing_requirements_page_does_not_contains_switch_to(
             self, autologin_user, backend):
         repo_name = backend.repo_name
         scm_patcher = mock.patch.object(
             Repository, 'scm_instance', side_effect=RepositoryRequirementError)
 
         with scm_patcher:
             response = self.app.get(route_path('repo_summary', repo_name=repo_name))
         response.mustcontain(no='Switch To')
 
 
 @pytest.mark.usefixtures('app')
 class TestRepoLocation(object):
 
     @pytest.mark.parametrize("suffix", [u'', u'ąęł'], ids=['', 'non-ascii'])
     def test_missing_filesystem_repo(
             self, autologin_user, backend, suffix, csrf_token):
         repo = backend.create_repo(name_suffix=suffix)
         repo_name = repo.repo_name
 
         # delete from file system
         RepoModel()._delete_filesystem_repo(repo)
 
         # test if the repo is still in the database
         new_repo = RepoModel().get_by_repo_name(repo_name)
         assert new_repo.repo_name == repo_name
 
         # check if repo is not in the filesystem
         assert not repo_on_filesystem(repo_name)
 
         response = self.app.get(
             route_path('repo_summary', repo_name=safe_str(repo_name)), status=302)
 
         msg = 'The repository `%s` cannot be loaded in filesystem. ' \
               'Please check if it exist, or is not damaged.' % repo_name
         assert_session_flash(response, msg)
 
     @pytest.mark.parametrize("suffix", [u'', u'ąęł'], ids=['', 'non-ascii'])
     def test_missing_filesystem_repo_on_repo_check(
             self, autologin_user, backend, suffix, csrf_token):
         repo = backend.create_repo(name_suffix=suffix)
         repo_name = repo.repo_name
 
         # delete from file system
         RepoModel()._delete_filesystem_repo(repo)
 
         # test if the repo is still in the database
         new_repo = RepoModel().get_by_repo_name(repo_name)
         assert new_repo.repo_name == repo_name
 
         # check if repo is not in the filesystem
         assert not repo_on_filesystem(repo_name)
 
         # flush the session
         self.app.get(
             route_path('repo_summary', repo_name=safe_str(repo_name)),
             status=302)
 
         response = self.app.get(
             route_path('repo_creating_check', repo_name=safe_str(repo_name)),
             status=200)
         msg = 'The repository `%s` cannot be loaded in filesystem. ' \
               'Please check if it exist, or is not damaged.' % repo_name
         assert_session_flash(response, msg )
 
 
 @pytest.fixture()
 def summary_view(context_stub, request_stub, user_util):
     """
     Bootstrap view to test the view functions
     """
     request_stub.matched_route = AttributeDict(name='test_view')
 
     request_stub.user = user_util.create_user().AuthUser()
     request_stub.db_repo = user_util.create_repo()
 
     view = RepoSummaryView(context=context_stub, request=request_stub)
     return view
 
 
 @pytest.mark.usefixtures('app')
 class TestCreateReferenceData(object):
 
     @pytest.fixture()
     def example_refs(self):
         section_1_refs = OrderedDict((('a', 'a_id'), ('b', 'b_id')))
         example_refs = [
             ('section_1', section_1_refs, 't1'),
             ('section_2', {'c': 'c_id'}, 't2'),
         ]
         return example_refs
 
     def test_generates_refs_based_on_commit_ids(self, example_refs, summary_view):
         repo = mock.Mock()
         repo.name = 'test-repo'
         repo.alias = 'git'
         full_repo_name = 'pytest-repo-group/' + repo.name
 
         result = summary_view._create_reference_data(
             repo, full_repo_name, example_refs)
 
         expected_files_url = '/{}/files/'.format(full_repo_name)
         expected_result = [
             {
                 'children': [
                     {
                         'id': 'a', 'idx': 0, 'raw_id': 'a_id', 'text': 'a', 'type': 't1',
                         'files_url': expected_files_url + 'a/?at=a',
                     },
                     {
                         'id': 'b', 'idx': 0, 'raw_id': 'b_id', 'text': 'b', 'type': 't1',
                         'files_url': expected_files_url + 'b/?at=b',
                     }
                 ],
                 'text': 'section_1'
             },
             {
                 'children': [
                     {
                         'id': 'c', 'idx': 0, 'raw_id': 'c_id', 'text': 'c', 'type': 't2',
                         'files_url': expected_files_url + 'c/?at=c',
                     }
                 ],
                 'text': 'section_2'
             }]
         assert result == expected_result
 
     def test_generates_refs_with_path_for_svn(self, example_refs, summary_view):
         repo = mock.Mock()
         repo.name = 'test-repo'
         repo.alias = 'svn'
         full_repo_name = 'pytest-repo-group/' + repo.name
 
         result = summary_view._create_reference_data(
             repo, full_repo_name, example_refs)
 
         expected_files_url = '/{}/files/'.format(full_repo_name)
         expected_result = [
             {
                 'children': [
                     {
                         'id': 'a@a_id', 'idx': 0, 'raw_id': 'a_id',
                         'text': 'a', 'type': 't1',
                         'files_url': expected_files_url + 'a_id/a?at=a',
                     },
                     {
                         'id': 'b@b_id', 'idx': 0, 'raw_id': 'b_id',
                         'text': 'b', 'type': 't1',
                         'files_url': expected_files_url + 'b_id/b?at=b',
                     }
                 ],
                 'text': 'section_1'
             },
             {
                 'children': [
                     {
                         'id': 'c@c_id', 'idx': 0, 'raw_id': 'c_id',
                         'text': 'c', 'type': 't2',
                         'files_url': expected_files_url + 'c_id/c?at=c',
                     }
                 ],
                 'text': 'section_2'
             }
         ]
         assert result == expected_result
 
 
 class TestCreateFilesUrl(object):
 
     def test_creates_non_svn_url(self, app, summary_view):
         repo = mock.Mock()
         repo.name = 'abcde'
         full_repo_name = 'test-repo-group/' + repo.name
         ref_name = 'branch1'
         raw_id = 'deadbeef0123456789'
         is_svn = False
 
         with mock.patch('rhodecode.lib.helpers.route_path') as url_mock:
             result = summary_view._create_files_url(
                 repo, full_repo_name, ref_name, raw_id, is_svn)
         url_mock.assert_called_once_with(
             'repo_files', repo_name=full_repo_name, commit_id=ref_name,
             f_path='', _query=dict(at=ref_name))
         assert result == url_mock.return_value
 
     def test_creates_svn_url(self, app, summary_view):
         repo = mock.Mock()
         repo.name = 'abcde'
         full_repo_name = 'test-repo-group/' + repo.name
         ref_name = 'branch1'
         raw_id = 'deadbeef0123456789'
         is_svn = True
 
         with mock.patch('rhodecode.lib.helpers.route_path') as url_mock:
             result = summary_view._create_files_url(
                 repo, full_repo_name, ref_name, raw_id, is_svn)
         url_mock.assert_called_once_with(
             'repo_files', repo_name=full_repo_name, f_path=ref_name,
             commit_id=raw_id, _query=dict(at=ref_name))
         assert result == url_mock.return_value
 
     def test_name_has_slashes(self, app, summary_view):
         repo = mock.Mock()
         repo.name = 'abcde'
         full_repo_name = 'test-repo-group/' + repo.name
         ref_name = 'branch1/branch2'
         raw_id = 'deadbeef0123456789'
         is_svn = False
 
         with mock.patch('rhodecode.lib.helpers.route_path') as url_mock:
             result = summary_view._create_files_url(
                 repo, full_repo_name, ref_name, raw_id, is_svn)
         url_mock.assert_called_once_with(
             'repo_files', repo_name=full_repo_name, commit_id=raw_id,
             f_path='', _query=dict(at=ref_name))
         assert result == url_mock.return_value
 
 
 class TestReferenceItems(object):
     repo = mock.Mock()
     repo.name = 'pytest-repo'
     repo_full_name = 'pytest-repo-group/' + repo.name
     ref_type = 'branch'
     fake_url = '/abcde/'
 
     @staticmethod
     def _format_function(name, id_):
         return 'format_function_{}_{}'.format(name, id_)
 
     def test_creates_required_amount_of_items(self, summary_view):
         amount = 100
         refs = {
             'ref{}'.format(i): '{0:040d}'.format(i)
             for i in range(amount)
         }
 
         url_patcher = mock.patch.object(summary_view, '_create_files_url')
         svn_patcher = mock.patch('rhodecode.lib.helpers.is_svn',
                                  return_value=False)
 
         with url_patcher as url_mock, svn_patcher:
             result = summary_view._create_reference_items(
                 self.repo, self.repo_full_name, refs, self.ref_type,
                 self._format_function)
         assert len(result) == amount
         assert url_mock.call_count == amount
 
     def test_single_item_details(self, summary_view):
         ref_name = 'ref1'
         ref_id = 'deadbeef'
         refs = {
             ref_name: ref_id
         }
 
         svn_patcher = mock.patch('rhodecode.lib.helpers.is_svn',
                                  return_value=False)
 
         url_patcher = mock.patch.object(
             summary_view, '_create_files_url', return_value=self.fake_url)
 
         with url_patcher as url_mock, svn_patcher:
             result = summary_view._create_reference_items(
                 self.repo, self.repo_full_name, refs, self.ref_type,
                 self._format_function)
 
         url_mock.assert_called_once_with(
             self.repo, self.repo_full_name, ref_name, ref_id, False)
         expected_result = [
             {
                 'text': ref_name,
                 'id': self._format_function(ref_name, ref_id),
                 'raw_id': ref_id,
                 'idx': 0,
                 'type': self.ref_type,
                 'files_url': self.fake_url
             }
         ]
         assert result == expected_result

rhodecode/apps/repository/tests/test_repo_vcs_settings.py

@@ -1,685 +1,685 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2019 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import mock
 import pytest
 
 from rhodecode.lib import auth
 from rhodecode.lib.utils2 import str2bool
 from rhodecode.model.db import (
     Repository, UserRepoToPerm, User)
 from rhodecode.model.meta import Session
 from rhodecode.model.settings import SettingsModel, VcsSettingsModel
 from rhodecode.model.user import UserModel
 from rhodecode.tests import (
     login_user_session, logout_user_session,
     TEST_USER_REGULAR_LOGIN, TEST_USER_REGULAR_PASS)
 from rhodecode.tests.fixture import Fixture
 from rhodecode.tests.utils import AssertResponse
 
 fixture = Fixture()
 
 
 def route_path(name, params=None, **kwargs):
     import urllib
 
     base_url = {
         'repo_summary': '/{repo_name}',
         'repo_creating_check': '/{repo_name}/repo_creating_check',
         'edit_repo': '/{repo_name}/settings',
         'edit_repo_vcs': '/{repo_name}/settings/vcs',
         'edit_repo_vcs_update': '/{repo_name}/settings/vcs/update',
         'edit_repo_vcs_svn_pattern_delete': '/{repo_name}/settings/vcs/svn_pattern/delete'
     }[name].format(**kwargs)
 
     if params:
         base_url = '{}?{}'.format(base_url, urllib.urlencode(params))
     return base_url
 
 
 @pytest.mark.usefixtures("app")
 class TestVcsSettings(object):
     FORM_DATA = {
         'inherit_global_settings': False,
         'hooks_changegroup_repo_size': False,
         'hooks_changegroup_push_logger': False,
         'hooks_outgoing_pull_logger': False,
         'extensions_largefiles': False,
         'extensions_evolve': False,
         'phases_publish': 'False',
         'rhodecode_pr_merge_enabled': False,
         'rhodecode_use_outdated_comments': False,
         'new_svn_branch': '',
         'new_svn_tag': ''
     }
 
     @pytest.mark.skip_backends('svn')
     def test_global_settings_initial_values(self, autologin_user, backend):
         repo_name = backend.repo_name
         response = self.app.get(route_path('edit_repo_vcs', repo_name=repo_name))
 
         expected_settings = (
             'rhodecode_use_outdated_comments', 'rhodecode_pr_merge_enabled',
             'hooks_changegroup_repo_size', 'hooks_changegroup_push_logger',
             'hooks_outgoing_pull_logger'
         )
         for setting in expected_settings:
             self.assert_repo_value_equals_global_value(response, setting)
 
     def test_show_settings_requires_repo_admin_permission(
             self, backend, user_util, settings_util):
         repo = backend.create_repo()
         repo_name = repo.repo_name
         user = UserModel().get_by_username(TEST_USER_REGULAR_LOGIN)
         user_util.grant_user_permission_to_repo(repo, user, 'repository.admin')
         login_user_session(
             self.app, TEST_USER_REGULAR_LOGIN, TEST_USER_REGULAR_PASS)
         self.app.get(route_path('edit_repo_vcs', repo_name=repo_name), status=200)
 
     def test_inherit_global_settings_flag_is_true_by_default(
             self, autologin_user, backend):
         repo_name = backend.repo_name
         response = self.app.get(route_path('edit_repo_vcs', repo_name=repo_name))
 
-        assert_response = AssertResponse(response)
+        assert_response = response.assert_response()
         element = assert_response.get_element('#inherit_global_settings')
         assert element.checked
 
     @pytest.mark.parametrize('checked_value', [True, False])
     def test_inherit_global_settings_value(
             self, autologin_user, backend, checked_value, settings_util):
         repo = backend.create_repo()
         repo_name = repo.repo_name
         settings_util.create_repo_rhodecode_setting(
             repo, 'inherit_vcs_settings', checked_value, 'bool')
         response = self.app.get(route_path('edit_repo_vcs', repo_name=repo_name))
 
-        assert_response = AssertResponse(response)
+        assert_response = response.assert_response()
         element = assert_response.get_element('#inherit_global_settings')
         assert element.checked == checked_value
 
     @pytest.mark.skip_backends('svn')
     def test_hooks_settings_are_created(
             self, autologin_user, backend, csrf_token):
         repo_name = backend.repo_name
         data = self.FORM_DATA.copy()
         data['csrf_token'] = csrf_token
         self.app.post(
             route_path('edit_repo_vcs_update', repo_name=repo_name), data, status=302)
         settings = SettingsModel(repo=repo_name)
         try:
             for section, key in VcsSettingsModel.HOOKS_SETTINGS:
                 ui = settings.get_ui_by_section_and_key(section, key)
                 assert ui.ui_active is False
         finally:
             self._cleanup_repo_settings(settings)
 
     def test_hooks_settings_are_not_created_for_svn(
             self, autologin_user, backend_svn, csrf_token):
         repo_name = backend_svn.repo_name
         data = self.FORM_DATA.copy()
         data['csrf_token'] = csrf_token
         self.app.post(
             route_path('edit_repo_vcs_update', repo_name=repo_name), data, status=302)
         settings = SettingsModel(repo=repo_name)
         try:
             for section, key in VcsSettingsModel.HOOKS_SETTINGS:
                 ui = settings.get_ui_by_section_and_key(section, key)
                 assert ui is None
         finally:
             self._cleanup_repo_settings(settings)
 
     @pytest.mark.skip_backends('svn')
     def test_hooks_settings_are_updated(
             self, autologin_user, backend, csrf_token):
         repo_name = backend.repo_name
         settings = SettingsModel(repo=repo_name)
         for section, key in VcsSettingsModel.HOOKS_SETTINGS:
             settings.create_ui_section_value(section, '', key=key, active=True)
 
         data = self.FORM_DATA.copy()
         data['csrf_token'] = csrf_token
         self.app.post(
             route_path('edit_repo_vcs_update', repo_name=repo_name), data, status=302)
         try:
             for section, key in VcsSettingsModel.HOOKS_SETTINGS:
                 ui = settings.get_ui_by_section_and_key(section, key)
                 assert ui.ui_active is False
         finally:
             self._cleanup_repo_settings(settings)
 
     def test_hooks_settings_are_not_updated_for_svn(
             self, autologin_user, backend_svn, csrf_token):
         repo_name = backend_svn.repo_name
         settings = SettingsModel(repo=repo_name)
         for section, key in VcsSettingsModel.HOOKS_SETTINGS:
             settings.create_ui_section_value(section, '', key=key, active=True)
 
         data = self.FORM_DATA.copy()
         data['csrf_token'] = csrf_token
         self.app.post(
             route_path('edit_repo_vcs_update', repo_name=repo_name), data, status=302)
         try:
             for section, key in VcsSettingsModel.HOOKS_SETTINGS:
                 ui = settings.get_ui_by_section_and_key(section, key)
                 assert ui.ui_active is True
         finally:
             self._cleanup_repo_settings(settings)
 
     @pytest.mark.skip_backends('svn')
     def test_pr_settings_are_created(
             self, autologin_user, backend, csrf_token):
         repo_name = backend.repo_name
         data = self.FORM_DATA.copy()
         data['csrf_token'] = csrf_token
         self.app.post(
             route_path('edit_repo_vcs_update', repo_name=repo_name), data, status=302)
         settings = SettingsModel(repo=repo_name)
         try:
             for name in VcsSettingsModel.GENERAL_SETTINGS:
                 setting = settings.get_setting_by_name(name)
                 assert setting.app_settings_value is False
         finally:
             self._cleanup_repo_settings(settings)
 
     def test_pr_settings_are_not_created_for_svn(
             self, autologin_user, backend_svn, csrf_token):
         repo_name = backend_svn.repo_name
         data = self.FORM_DATA.copy()
         data['csrf_token'] = csrf_token
         self.app.post(
             route_path('edit_repo_vcs_update', repo_name=repo_name), data, status=302)
         settings = SettingsModel(repo=repo_name)
         try:
             for name in VcsSettingsModel.GENERAL_SETTINGS:
                 setting = settings.get_setting_by_name(name)
                 assert setting is None
         finally:
             self._cleanup_repo_settings(settings)
 
     def test_pr_settings_creation_requires_repo_admin_permission(
             self, backend, user_util, settings_util, csrf_token):
         repo = backend.create_repo()
         repo_name = repo.repo_name
 
         logout_user_session(self.app, csrf_token)
         session = login_user_session(
             self.app, TEST_USER_REGULAR_LOGIN, TEST_USER_REGULAR_PASS)
         new_csrf_token = auth.get_csrf_token(session)
 
         user = UserModel().get_by_username(TEST_USER_REGULAR_LOGIN)
         repo = Repository.get_by_repo_name(repo_name)
         user_util.grant_user_permission_to_repo(repo, user, 'repository.admin')
         data = self.FORM_DATA.copy()
         data['csrf_token'] = new_csrf_token
         settings = SettingsModel(repo=repo_name)
 
         try:
             self.app.post(
                 route_path('edit_repo_vcs_update', repo_name=repo_name), data,
                 status=302)
         finally:
             self._cleanup_repo_settings(settings)
 
     @pytest.mark.skip_backends('svn')
     def test_pr_settings_are_updated(
             self, autologin_user, backend, csrf_token):
         repo_name = backend.repo_name
         settings = SettingsModel(repo=repo_name)
         for name in VcsSettingsModel.GENERAL_SETTINGS:
             settings.create_or_update_setting(name, True, 'bool')
 
         data = self.FORM_DATA.copy()
         data['csrf_token'] = csrf_token
         self.app.post(
             route_path('edit_repo_vcs_update', repo_name=repo_name), data, status=302)
         try:
             for name in VcsSettingsModel.GENERAL_SETTINGS:
                 setting = settings.get_setting_by_name(name)
                 assert setting.app_settings_value is False
         finally:
             self._cleanup_repo_settings(settings)
 
     def test_pr_settings_are_not_updated_for_svn(
             self, autologin_user, backend_svn, csrf_token):
         repo_name = backend_svn.repo_name
         settings = SettingsModel(repo=repo_name)
         for name in VcsSettingsModel.GENERAL_SETTINGS:
             settings.create_or_update_setting(name, True, 'bool')
 
         data = self.FORM_DATA.copy()
         data['csrf_token'] = csrf_token
         self.app.post(
             route_path('edit_repo_vcs_update', repo_name=repo_name), data, status=302)
         try:
             for name in VcsSettingsModel.GENERAL_SETTINGS:
                 setting = settings.get_setting_by_name(name)
                 assert setting.app_settings_value is True
         finally:
             self._cleanup_repo_settings(settings)
 
     def test_svn_settings_are_created(
             self, autologin_user, backend_svn, csrf_token, settings_util):
         repo_name = backend_svn.repo_name
         data = self.FORM_DATA.copy()
         data['new_svn_tag'] = 'svn-tag'
         data['new_svn_branch'] = 'svn-branch'
         data['csrf_token'] = csrf_token
 
         # Create few global settings to make sure that uniqueness validators
         # are not triggered
         settings_util.create_rhodecode_ui(
             VcsSettingsModel.SVN_BRANCH_SECTION, 'svn-branch')
         settings_util.create_rhodecode_ui(
             VcsSettingsModel.SVN_TAG_SECTION, 'svn-tag')
 
         self.app.post(
             route_path('edit_repo_vcs_update', repo_name=repo_name), data, status=302)
         settings = SettingsModel(repo=repo_name)
         try:
             svn_branches = settings.get_ui_by_section(
                 VcsSettingsModel.SVN_BRANCH_SECTION)
             svn_branch_names = [b.ui_value for b in svn_branches]
             svn_tags = settings.get_ui_by_section(
                 VcsSettingsModel.SVN_TAG_SECTION)
             svn_tag_names = [b.ui_value for b in svn_tags]
             assert 'svn-branch' in svn_branch_names
             assert 'svn-tag' in svn_tag_names
         finally:
             self._cleanup_repo_settings(settings)
 
     def test_svn_settings_are_unique(
             self, autologin_user, backend_svn, csrf_token, settings_util):
         repo = backend_svn.repo
         repo_name = repo.repo_name
         data = self.FORM_DATA.copy()
         data['new_svn_tag'] = 'test_tag'
         data['new_svn_branch'] = 'test_branch'
         data['csrf_token'] = csrf_token
         settings_util.create_repo_rhodecode_ui(
             repo, VcsSettingsModel.SVN_BRANCH_SECTION, 'test_branch')
         settings_util.create_repo_rhodecode_ui(
             repo, VcsSettingsModel.SVN_TAG_SECTION, 'test_tag')
 
         response = self.app.post(
             route_path('edit_repo_vcs_update', repo_name=repo_name), data, status=200)
         response.mustcontain('Pattern already exists')
 
     def test_svn_settings_with_empty_values_are_not_created(
             self, autologin_user, backend_svn, csrf_token):
         repo_name = backend_svn.repo_name
         data = self.FORM_DATA.copy()
         data['csrf_token'] = csrf_token
         self.app.post(
             route_path('edit_repo_vcs_update', repo_name=repo_name), data, status=302)
         settings = SettingsModel(repo=repo_name)
         try:
             svn_branches = settings.get_ui_by_section(
                 VcsSettingsModel.SVN_BRANCH_SECTION)
             svn_tags = settings.get_ui_by_section(
                 VcsSettingsModel.SVN_TAG_SECTION)
             assert len(svn_branches) == 0
             assert len(svn_tags) == 0
         finally:
             self._cleanup_repo_settings(settings)
 
     def test_svn_settings_are_shown_for_svn_repository(
             self, autologin_user, backend_svn, csrf_token):
         repo_name = backend_svn.repo_name
         response = self.app.get(
             route_path('edit_repo_vcs', repo_name=repo_name), status=200)
         response.mustcontain('Subversion Settings')
 
     @pytest.mark.skip_backends('svn')
     def test_svn_settings_are_not_created_for_not_svn_repository(
             self, autologin_user, backend, csrf_token):
         repo_name = backend.repo_name
         data = self.FORM_DATA.copy()
         data['csrf_token'] = csrf_token
         self.app.post(
             route_path('edit_repo_vcs_update', repo_name=repo_name), data, status=302)
         settings = SettingsModel(repo=repo_name)
         try:
             svn_branches = settings.get_ui_by_section(
                 VcsSettingsModel.SVN_BRANCH_SECTION)
             svn_tags = settings.get_ui_by_section(
                 VcsSettingsModel.SVN_TAG_SECTION)
             assert len(svn_branches) == 0
             assert len(svn_tags) == 0
         finally:
             self._cleanup_repo_settings(settings)
 
     @pytest.mark.skip_backends('svn')
     def test_svn_settings_are_shown_only_for_svn_repository(
             self, autologin_user, backend, csrf_token):
         repo_name = backend.repo_name
         response = self.app.get(
             route_path('edit_repo_vcs', repo_name=repo_name), status=200)
         response.mustcontain(no='Subversion Settings')
 
     def test_hg_settings_are_created(
             self, autologin_user, backend_hg, csrf_token):
         repo_name = backend_hg.repo_name
         data = self.FORM_DATA.copy()
         data['new_svn_tag'] = 'svn-tag'
         data['new_svn_branch'] = 'svn-branch'
         data['csrf_token'] = csrf_token
         self.app.post(
             route_path('edit_repo_vcs_update', repo_name=repo_name), data, status=302)
         settings = SettingsModel(repo=repo_name)
         try:
             largefiles_ui = settings.get_ui_by_section_and_key(
                 'extensions', 'largefiles')
             assert largefiles_ui.ui_active is False
             phases_ui = settings.get_ui_by_section_and_key(
                 'phases', 'publish')
             assert str2bool(phases_ui.ui_value) is False
         finally:
             self._cleanup_repo_settings(settings)
 
     def test_hg_settings_are_updated(
             self, autologin_user, backend_hg, csrf_token):
         repo_name = backend_hg.repo_name
         settings = SettingsModel(repo=repo_name)
         settings.create_ui_section_value(
             'extensions', '', key='largefiles', active=True)
         settings.create_ui_section_value(
             'phases', '1', key='publish', active=True)
 
         data = self.FORM_DATA.copy()
         data['csrf_token'] = csrf_token
         self.app.post(
             route_path('edit_repo_vcs_update', repo_name=repo_name), data, status=302)
         try:
             largefiles_ui = settings.get_ui_by_section_and_key(
                 'extensions', 'largefiles')
             assert largefiles_ui.ui_active is False
             phases_ui = settings.get_ui_by_section_and_key(
                 'phases', 'publish')
             assert str2bool(phases_ui.ui_value) is False
         finally:
             self._cleanup_repo_settings(settings)
 
     def test_hg_settings_are_shown_for_hg_repository(
             self, autologin_user, backend_hg, csrf_token):
         repo_name = backend_hg.repo_name
         response = self.app.get(
             route_path('edit_repo_vcs', repo_name=repo_name), status=200)
         response.mustcontain('Mercurial Settings')
 
     @pytest.mark.skip_backends('hg')
     def test_hg_settings_are_created_only_for_hg_repository(
             self, autologin_user, backend, csrf_token):
         repo_name = backend.repo_name
         data = self.FORM_DATA.copy()
         data['csrf_token'] = csrf_token
         self.app.post(
             route_path('edit_repo_vcs_update', repo_name=repo_name), data, status=302)
         settings = SettingsModel(repo=repo_name)
         try:
             largefiles_ui = settings.get_ui_by_section_and_key(
                 'extensions', 'largefiles')
             assert largefiles_ui is None
             phases_ui = settings.get_ui_by_section_and_key(
                 'phases', 'publish')
             assert phases_ui is None
         finally:
             self._cleanup_repo_settings(settings)
 
     @pytest.mark.skip_backends('hg')
     def test_hg_settings_are_shown_only_for_hg_repository(
             self, autologin_user, backend, csrf_token):
         repo_name = backend.repo_name
         response = self.app.get(
             route_path('edit_repo_vcs', repo_name=repo_name), status=200)
         response.mustcontain(no='Mercurial Settings')
 
     @pytest.mark.skip_backends('hg')
     def test_hg_settings_are_updated_only_for_hg_repository(
             self, autologin_user, backend, csrf_token):
         repo_name = backend.repo_name
         settings = SettingsModel(repo=repo_name)
         settings.create_ui_section_value(
             'extensions', '', key='largefiles', active=True)
         settings.create_ui_section_value(
             'phases', '1', key='publish', active=True)
 
         data = self.FORM_DATA.copy()
         data['csrf_token'] = csrf_token
         self.app.post(
             route_path('edit_repo_vcs_update', repo_name=repo_name), data, status=302)
         try:
             largefiles_ui = settings.get_ui_by_section_and_key(
                 'extensions', 'largefiles')
             assert largefiles_ui.ui_active is True
             phases_ui = settings.get_ui_by_section_and_key(
                 'phases', 'publish')
             assert phases_ui.ui_value == '1'
         finally:
             self._cleanup_repo_settings(settings)
 
     def test_per_repo_svn_settings_are_displayed(
             self, autologin_user, backend_svn, settings_util):
         repo = backend_svn.create_repo()
         repo_name = repo.repo_name
         branches = [
             settings_util.create_repo_rhodecode_ui(
                 repo, VcsSettingsModel.SVN_BRANCH_SECTION,
                 'branch_{}'.format(i))
             for i in range(10)]
         tags = [
             settings_util.create_repo_rhodecode_ui(
                 repo, VcsSettingsModel.SVN_TAG_SECTION, 'tag_{}'.format(i))
             for i in range(10)]
 
         response = self.app.get(
             route_path('edit_repo_vcs', repo_name=repo_name), status=200)
-        assert_response = AssertResponse(response)
+        assert_response = response.assert_response()
         for branch in branches:
             css_selector = '[name=branch_value_{}]'.format(branch.ui_id)
             element = assert_response.get_element(css_selector)
             assert element.value == branch.ui_value
         for tag in tags:
             css_selector = '[name=tag_ui_value_new_{}]'.format(tag.ui_id)
             element = assert_response.get_element(css_selector)
             assert element.value == tag.ui_value
 
     def test_per_repo_hg_and_pr_settings_are_not_displayed_for_svn(
             self, autologin_user, backend_svn, settings_util):
         repo = backend_svn.create_repo()
         repo_name = repo.repo_name
         response = self.app.get(
             route_path('edit_repo_vcs', repo_name=repo_name), status=200)
         response.mustcontain(no='<label>Hooks:</label>')
         response.mustcontain(no='<label>Pull Request Settings:</label>')
 
     def test_inherit_global_settings_value_is_saved(
             self, autologin_user, backend, csrf_token):
         repo_name = backend.repo_name
         data = self.FORM_DATA.copy()
         data['csrf_token'] = csrf_token
         data['inherit_global_settings'] = True
         self.app.post(
             route_path('edit_repo_vcs_update', repo_name=repo_name), data, status=302)
 
         settings = SettingsModel(repo=repo_name)
         vcs_settings = VcsSettingsModel(repo=repo_name)
         try:
             assert vcs_settings.inherit_global_settings is True
         finally:
             self._cleanup_repo_settings(settings)
 
     def test_repo_cache_is_invalidated_when_settings_are_updated(
             self, autologin_user, backend, csrf_token):
         repo_name = backend.repo_name
         data = self.FORM_DATA.copy()
         data['csrf_token'] = csrf_token
         data['inherit_global_settings'] = True
         settings = SettingsModel(repo=repo_name)
 
         invalidation_patcher = mock.patch(
             'rhodecode.model.scm.ScmModel.mark_for_invalidation')
         with invalidation_patcher as invalidation_mock:
             self.app.post(
                 route_path('edit_repo_vcs_update', repo_name=repo_name), data,
                 status=302)
         try:
             invalidation_mock.assert_called_once_with(repo_name, delete=True)
         finally:
             self._cleanup_repo_settings(settings)
 
     def test_other_settings_not_saved_inherit_global_settings_is_true(
             self, autologin_user, backend, csrf_token):
         repo_name = backend.repo_name
         data = self.FORM_DATA.copy()
         data['csrf_token'] = csrf_token
         data['inherit_global_settings'] = True
         self.app.post(
             route_path('edit_repo_vcs_update', repo_name=repo_name), data, status=302)
 
         settings = SettingsModel(repo=repo_name)
         ui_settings = (
             VcsSettingsModel.HOOKS_SETTINGS + VcsSettingsModel.HG_SETTINGS)
 
         vcs_settings = []
         try:
             for section, key in ui_settings:
                 ui = settings.get_ui_by_section_and_key(section, key)
                 if ui:
                     vcs_settings.append(ui)
             vcs_settings.extend(settings.get_ui_by_section(
                 VcsSettingsModel.SVN_BRANCH_SECTION))
             vcs_settings.extend(settings.get_ui_by_section(
                 VcsSettingsModel.SVN_TAG_SECTION))
             for name in VcsSettingsModel.GENERAL_SETTINGS:
                 setting = settings.get_setting_by_name(name)
                 if setting:
                     vcs_settings.append(setting)
             assert vcs_settings == []
         finally:
             self._cleanup_repo_settings(settings)
 
     def test_delete_svn_branch_and_tag_patterns(
             self, autologin_user, backend_svn, settings_util, csrf_token, xhr_header):
         repo = backend_svn.create_repo()
         repo_name = repo.repo_name
         branch = settings_util.create_repo_rhodecode_ui(
             repo, VcsSettingsModel.SVN_BRANCH_SECTION, 'test_branch',
             cleanup=False)
         tag = settings_util.create_repo_rhodecode_ui(
             repo, VcsSettingsModel.SVN_TAG_SECTION, 'test_tag', cleanup=False)
         data = {
             'csrf_token': csrf_token
         }
         for id_ in (branch.ui_id, tag.ui_id):
             data['delete_svn_pattern'] = id_,
             self.app.post(
                 route_path('edit_repo_vcs_svn_pattern_delete', repo_name=repo_name),
                 data, extra_environ=xhr_header, status=200)
         settings = VcsSettingsModel(repo=repo_name)
         assert settings.get_repo_svn_branch_patterns() == []
 
     def test_delete_svn_branch_requires_repo_admin_permission(
             self, backend_svn, user_util, settings_util, csrf_token, xhr_header):
         repo = backend_svn.create_repo()
         repo_name = repo.repo_name
 
         logout_user_session(self.app, csrf_token)
         session = login_user_session(
             self.app, TEST_USER_REGULAR_LOGIN, TEST_USER_REGULAR_PASS)
         csrf_token = auth.get_csrf_token(session)
 
         repo = Repository.get_by_repo_name(repo_name)
         user = UserModel().get_by_username(TEST_USER_REGULAR_LOGIN)
         user_util.grant_user_permission_to_repo(repo, user, 'repository.admin')
         branch = settings_util.create_repo_rhodecode_ui(
             repo, VcsSettingsModel.SVN_BRANCH_SECTION, 'test_branch',
             cleanup=False)
         data = {
             'csrf_token': csrf_token,
             'delete_svn_pattern': branch.ui_id
         }
         self.app.post(
             route_path('edit_repo_vcs_svn_pattern_delete', repo_name=repo_name),
             data, extra_environ=xhr_header, status=200)
 
     def test_delete_svn_branch_raises_400_when_not_found(
             self, autologin_user, backend_svn, settings_util, csrf_token, xhr_header):
         repo_name = backend_svn.repo_name
         data = {
             'delete_svn_pattern': 123,
             'csrf_token': csrf_token
         }
         self.app.post(
             route_path('edit_repo_vcs_svn_pattern_delete', repo_name=repo_name),
             data, extra_environ=xhr_header, status=400)
 
     def test_delete_svn_branch_raises_400_when_no_id_specified(
             self, autologin_user, backend_svn, settings_util, csrf_token, xhr_header):
         repo_name = backend_svn.repo_name
         data = {
             'csrf_token': csrf_token
         }
         self.app.post(
             route_path('edit_repo_vcs_svn_pattern_delete', repo_name=repo_name),
             data, extra_environ=xhr_header, status=400)
 
     def _cleanup_repo_settings(self, settings_model):
         cleanup = []
         ui_settings = (
             VcsSettingsModel.HOOKS_SETTINGS + VcsSettingsModel.HG_SETTINGS)
 
         for section, key in ui_settings:
             ui = settings_model.get_ui_by_section_and_key(section, key)
             if ui:
                 cleanup.append(ui)
 
         cleanup.extend(settings_model.get_ui_by_section(
             VcsSettingsModel.INHERIT_SETTINGS))
         cleanup.extend(settings_model.get_ui_by_section(
             VcsSettingsModel.SVN_BRANCH_SECTION))
         cleanup.extend(settings_model.get_ui_by_section(
             VcsSettingsModel.SVN_TAG_SECTION))
 
         for name in VcsSettingsModel.GENERAL_SETTINGS:
             setting = settings_model.get_setting_by_name(name)
             if setting:
                 cleanup.append(setting)
 
         for object_ in cleanup:
             Session().delete(object_)
         Session().commit()
 
     def assert_repo_value_equals_global_value(self, response, setting):
-        assert_response = AssertResponse(response)
+        assert_response = response.assert_response()
         global_css_selector = '[name={}_inherited]'.format(setting)
         repo_css_selector = '[name={}]'.format(setting)
         repo_element = assert_response.get_element(repo_css_selector)
         global_element = assert_response.get_element(global_css_selector)
         assert repo_element.value == global_element.value
 
 
 def _get_permission_for_user(user, repo):
     perm = UserRepoToPerm.query()\
         .filter(UserRepoToPerm.repository ==
                 Repository.get_by_repo_name(repo))\
         .filter(UserRepoToPerm.user == User.get_by_username(user))\
         .all()
     return perm

rhodecode/apps/repository/tests/test_vcs_settings.py

@@ -1,104 +1,104 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2019 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import mock
 import pytest
 
 import rhodecode
 from rhodecode.model.db import Repository
 from rhodecode.model.settings import SettingsModel
 from rhodecode.tests.utils import AssertResponse
 
 
 def route_path(name, params=None, **kwargs):
     import urllib
 
     base_url = {
         'edit_repo': '/{repo_name}/settings',
         'edit_repo_vcs': '/{repo_name}/settings/vcs',
         'edit_repo_vcs_update': '/{repo_name}/settings/vcs/update',
     }[name].format(**kwargs)
 
     if params:
         base_url = '{}?{}'.format(base_url, urllib.urlencode(params))
     return base_url
 
 
 @pytest.mark.usefixtures('autologin_user', 'app')
 class TestAdminRepoVcsSettings(object):
 
     @pytest.mark.parametrize('setting_name, setting_backends', [
         ('hg_use_rebase_for_merging', ['hg']),
     ])
     def test_labs_settings_visible_if_enabled(
             self, setting_name, setting_backends, backend):
         if backend.alias not in setting_backends:
             pytest.skip('Setting not available for backend {}'.format(backend))
 
         vcs_settings_url = route_path(
             'edit_repo_vcs', repo_name=backend.repo.repo_name)
 
         with mock.patch.dict(
                 rhodecode.CONFIG, {'labs_settings_active': 'true'}):
             response = self.app.get(vcs_settings_url)
 
-        assertr = AssertResponse(response)
+        assertr = response.assert_response()
         assertr.one_element_exists('#rhodecode_{}'.format(setting_name))
 
     @pytest.mark.parametrize('setting_name, setting_backends', [
         ('hg_use_rebase_for_merging', ['hg']),
     ])
     def test_update_boolean_settings(
             self, csrf_token, setting_name, setting_backends, backend):
         if backend.alias not in setting_backends:
             pytest.skip('Setting not available for backend {}'.format(backend))
 
         repo = backend.create_repo()
         repo_name = repo.repo_name
 
         settings_model = SettingsModel(repo=repo)
         vcs_settings_url = route_path(
             'edit_repo_vcs_update', repo_name=repo_name)
 
         self.app.post(
             vcs_settings_url,
             params={
                 'inherit_global_settings': False,
                 'new_svn_branch': 'dummy-value-for-testing',
                 'new_svn_tag': 'dummy-value-for-testing',
                 'rhodecode_{}'.format(setting_name): 'true',
                 'csrf_token': csrf_token,
             })
         settings_model = SettingsModel(repo=Repository.get_by_repo_name(repo_name))
         setting = settings_model.get_setting_by_name(setting_name)
         assert setting.app_settings_value
 
         self.app.post(
             vcs_settings_url,
             params={
                 'inherit_global_settings': False,
                 'new_svn_branch': 'dummy-value-for-testing',
                 'new_svn_tag': 'dummy-value-for-testing',
                 'rhodecode_{}'.format(setting_name): 'false',
                 'csrf_token': csrf_token,
             })
         settings_model = SettingsModel(repo=Repository.get_by_repo_name(repo_name))
         setting = settings_model.get_setting_by_name(setting_name)
         assert not setting.app_settings_value

rhodecode/apps/search/tests/test_search.py

@@ -1,202 +1,202 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2019 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import os
 
 import mock
 import pytest
 from whoosh import query
 
 from rhodecode.tests import (
     TestController, HG_REPO,
     TEST_USER_REGULAR_LOGIN, TEST_USER_REGULAR_PASS)
 from rhodecode.tests.utils import AssertResponse
 
 
 def route_path(name, **kwargs):
     from rhodecode.apps._base import ADMIN_PREFIX
     return {
         'search':
             ADMIN_PREFIX + '/search',
         'search_repo':
             '/{repo_name}/search',
 
     }[name].format(**kwargs)
 
 
 class TestSearchController(TestController):
 
     def test_index(self):
         self.log_user()
         response = self.app.get(route_path('search'))
-        assert_response = AssertResponse(response)
+        assert_response = response.assert_response()
         assert_response.one_element_exists('input#q')
 
     def test_search_files_empty_search(self):
         if os.path.isdir(self.index_location):
             pytest.skip('skipped due to existing index')
         else:
             self.log_user()
             response = self.app.get(route_path('search'),
                                     {'q': HG_REPO})
             response.mustcontain('There is no index to search in. '
                                  'Please run whoosh indexer')
 
     def test_search_validation(self):
         self.log_user()
         response = self.app.get(route_path('search'),
             {'q': query, 'type': 'content', 'page_limit': 1000})
 
         response.mustcontain(
             'page_limit - 1000 is greater than maximum value 500')
 
     @pytest.mark.parametrize("query, expected_hits, expected_paths", [
         ('todo', 23, [
             'vcs/backends/hg/inmemory.py',
             'vcs/tests/test_git.py']),
         ('extension:rst installation', 6, [
             'docs/index.rst',
             'docs/installation.rst']),
         ('def repo', 87, [
             'vcs/tests/test_git.py',
             'vcs/tests/test_changesets.py']),
         ('repository:%s def test' % HG_REPO, 18, [
             'vcs/tests/test_git.py',
             'vcs/tests/test_changesets.py']),
         ('"def main"', 9, [
             'vcs/__init__.py',
             'vcs/tests/__init__.py',
             'vcs/utils/progressbar.py']),
         ('owner:test_admin', 358, [
             'vcs/tests/base.py',
             'MANIFEST.in',
             'vcs/utils/termcolors.py',
             'docs/theme/ADC/static/documentation.png']),
         ('owner:test_admin def main', 72, [
             'vcs/__init__.py',
             'vcs/tests/test_utils_filesize.py',
             'vcs/tests/test_cli.py']),
         ('owner:michał test', 0, []),
     ])
     def test_search_files(self, query, expected_hits, expected_paths):
         self.log_user()
         response = self.app.get(route_path('search'),
             {'q': query, 'type': 'content', 'page_limit': 500})
 
         response.mustcontain('%s results' % expected_hits)
         for path in expected_paths:
             response.mustcontain(path)
 
     @pytest.mark.parametrize("query, expected_hits, expected_commits", [
         ('bother to ask where to fetch repo during tests', 3, [
             ('hg', 'a00c1b6f5d7a6ae678fd553a8b81d92367f7ecf1'),
             ('git', 'c6eb379775c578a95dad8ddab53f963b80894850'),
             ('svn', '98')]),
         ('michał', 0, []),
         ('changed:tests/utils.py', 36, [
             ('hg', 'a00c1b6f5d7a6ae678fd553a8b81d92367f7ecf1')]),
         ('changed:vcs/utils/archivers.py', 11, [
             ('hg', '25213a5fbb048dff8ba65d21e466a835536e5b70'),
             ('hg', '47aedd538bf616eedcb0e7d630ea476df0e159c7'),
             ('hg', 'f5d23247fad4856a1dabd5838afade1e0eed24fb'),
             ('hg', '04ad456aefd6461aea24f90b63954b6b1ce07b3e'),
             ('git', 'c994f0de03b2a0aa848a04fc2c0d7e737dba31fc'),
             ('git', 'd1f898326327e20524fe22417c22d71064fe54a1'),
             ('git', 'fe568b4081755c12abf6ba673ba777fc02a415f3'),
             ('git', 'bafe786f0d8c2ff7da5c1dcfcfa577de0b5e92f1')]),
         ('added:README.rst', 3, [
             ('hg', '3803844fdbd3b711175fc3da9bdacfcd6d29a6fb'),
             ('git', 'ff7ca51e58c505fec0dd2491de52c622bb7a806b'),
             ('svn', '8')]),
         ('changed:lazy.py', 15, [
             ('hg', 'eaa291c5e6ae6126a203059de9854ccf7b5baa12'),
             ('git', '17438a11f72b93f56d0e08e7d1fa79a378578a82'),
             ('svn', '82'),
             ('svn', '262'),
             ('hg', 'f5d23247fad4856a1dabd5838afade1e0eed24fb'),
             ('git', '33fa3223355104431402a888fa77a4e9956feb3e')
             ]),
         ('author:[e-mail] '
          'commit_id:b986218ba1c9b0d6a259fac9b050b1724ed8e545', 1, [
              ('hg', 'b986218ba1c9b0d6a259fac9b050b1724ed8e545')]),
         ('b986218ba1c9b0d6a259fac9b050b1724ed8e545', 1, [
              ('hg', 'b986218ba1c9b0d6a259fac9b050b1724ed8e545')]),
         ('b986218b', 1, [
              ('hg', 'b986218ba1c9b0d6a259fac9b050b1724ed8e545')]),
     ])
     def test_search_commit_messages(
             self, query, expected_hits, expected_commits, enabled_backends):
         self.log_user()
         response = self.app.get(route_path('search'),
             {'q': query, 'type': 'commit', 'page_limit': 500})
 
         response.mustcontain('%s results' % expected_hits)
         for backend, commit_id in expected_commits:
             if backend in enabled_backends:
                 response.mustcontain(commit_id)
 
     @pytest.mark.parametrize("query, expected_hits, expected_paths", [
         ('readme.rst', 3, []),
         ('test*', 75, []),
         ('*model*', 1, []),
         ('extension:rst', 48, []),
         ('extension:rst api', 24, []),
     ])
     def test_search_file_paths(self, query, expected_hits, expected_paths):
         self.log_user()
         response = self.app.get(route_path('search'),
             {'q': query, 'type': 'path', 'page_limit': 500})
 
         response.mustcontain('%s results' % expected_hits)
         for path in expected_paths:
             response.mustcontain(path)
 
     def test_search_commit_message_specific_repo(self, backend):
         self.log_user()
         response = self.app.get(
             route_path('search_repo',repo_name=backend.repo_name),
             {'q': 'bother to ask where to fetch repo during tests',
              'type': 'commit'})
 
         response.mustcontain('1 results')
 
     def test_filters_are_not_applied_for_admin_user(self):
         self.log_user()
         with mock.patch('whoosh.searching.Searcher.search') as search_mock:
             self.app.get(route_path('search'),
                 {'q': 'test query', 'type': 'commit'})
         assert search_mock.call_count == 1
         _, kwargs = search_mock.call_args
         assert kwargs['filter'] is None
 
     def test_filters_are_applied_for_normal_user(self, enabled_backends):
         self.log_user(TEST_USER_REGULAR_LOGIN, TEST_USER_REGULAR_PASS)
         with mock.patch('whoosh.searching.Searcher.search') as search_mock:
             self.app.get(route_path('search'),
                 {'q': 'test query', 'type': 'commit'})
         assert search_mock.call_count == 1
         _, kwargs = search_mock.call_args
         assert isinstance(kwargs['filter'], query.Or)
         expected_repositories = [
             'vcs_test_{}'.format(b) for b in enabled_backends]
         queried_repositories = [
             name for type_, name in kwargs['filter'].all_terms()]
         for repository in expected_repositories:
             assert repository in queried_repositories

rhodecode/apps/user_profile/tests/test_users.py

@@ -1,75 +1,75 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2019 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import pytest
 
 from rhodecode.model.db import User
 from rhodecode.tests import (
     TestController, TEST_USER_ADMIN_LOGIN, TEST_USER_ADMIN_PASS,
     TEST_USER_REGULAR_LOGIN, TEST_USER_REGULAR_PASS)
 from rhodecode.tests.fixture import Fixture
 from rhodecode.tests.utils import AssertResponse
 
 fixture = Fixture()
 
 
 def route_path(name, **kwargs):
     return '/_profiles/{username}'.format(**kwargs)
 
 
 class TestUsersController(TestController):
 
     def test_user_profile(self, user_util):
         edit_link_css = '.user-profile .panel-edit'
         self.log_user(TEST_USER_REGULAR_LOGIN, TEST_USER_REGULAR_PASS)
         user = user_util.create_user(
             'test-my-user', password='qweqwe', email='[e-mail]')
         username = user.username
 
         response = self.app.get(route_path('user_profile', username=username))
         response.mustcontain('testme')
         response.mustcontain('[e-mail]')
-        assert_response = AssertResponse(response)
+        assert_response = response.assert_response()
         assert_response.no_element_exists(edit_link_css)
 
         # edit should be available to superadmin users
         self.logout_user()
         self.log_user(TEST_USER_ADMIN_LOGIN, TEST_USER_ADMIN_PASS)
         response = self.app.get(route_path('user_profile', username=username))
-        assert_response = AssertResponse(response)
+        assert_response = response.assert_response()
         assert_response.element_contains(edit_link_css, 'Edit')
 
     def test_user_profile_not_available(self, user_util):
         user = user_util.create_user()
         username = user.username
 
         # not logged in, redirect
         self.app.get(route_path('user_profile', username=username), status=302)
 
         self.log_user()
         # after log-in show
         self.app.get(route_path('user_profile', username=username), status=200)
 
         # default user, not allowed to show it
         self.app.get(
             route_path('user_profile', username=User.DEFAULT_USER), status=404)
 
         # actual 404
         self.app.get(route_path('user_profile', username='unknown'), status=404)

rhodecode/model/db.py

@@ -1,5218 +1,5218 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2019 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 Database Models for RhodeCode Enterprise
 """
 
 import re
 import os
 import time
 import string
 import hashlib
 import logging
 import datetime
 import uuid
 import warnings
 import ipaddress
 import functools
 import traceback
 import collections
 
 from sqlalchemy import (
     or_, and_, not_, func, TypeDecorator, event,
     Index, Sequence, UniqueConstraint, ForeignKey, CheckConstraint, Column,
     Boolean, String, Unicode, UnicodeText, DateTime, Integer, LargeBinary,
     Text, Float, PickleType)
 from sqlalchemy.sql.expression import true, false, case
 from sqlalchemy.sql.functions import coalesce, count  # pragma: no cover
 from sqlalchemy.orm import (
     relationship, joinedload, class_mapper, validates, aliased)
 from sqlalchemy.ext.declarative import declared_attr
 from sqlalchemy.ext.hybrid import hybrid_property
 from sqlalchemy.exc import IntegrityError  # pragma: no cover
 from sqlalchemy.dialects.mysql import LONGTEXT
 from zope.cachedescriptors.property import Lazy as LazyProperty
 from pyramid import compat
 from pyramid.threadlocal import get_current_request
 from webhelpers.text import collapse, remove_formatting
 
 from rhodecode.translation import _
 from rhodecode.lib.vcs import get_vcs_instance
 from rhodecode.lib.vcs.backends.base import EmptyCommit, Reference
 from rhodecode.lib.utils2 import (
     str2bool, safe_str, get_commit_safe, safe_unicode, sha1_safe,
     time_to_datetime, aslist, Optional, safe_int, get_clone_url, AttributeDict,
     glob2re, StrictAttributeDict, cleaned_uri, datetime_to_time, OrderedDefaultDict)
 from rhodecode.lib.jsonalchemy import MutationObj, MutationList, JsonType, \
     JsonRaw
 from rhodecode.lib.ext_json import json
 from rhodecode.lib.caching_query import FromCache
 from rhodecode.lib.encrypt import AESCipher, validate_and_get_enc_data
 from rhodecode.lib.encrypt2 import Encryptor
 from rhodecode.model.meta import Base, Session
 
 URL_SEP = '/'
 log = logging.getLogger(__name__)
 
 # =============================================================================
 # BASE CLASSES
 # =============================================================================
 
 # this is propagated from .ini file rhodecode.encrypted_values.secret or
 # beaker.session.secret if first is not set.
 # and initialized at environment.py
 ENCRYPTION_KEY = None
 
 # used to sort permissions by types, '#' used here is not allowed to be in
 # usernames, and it's very early in sorted string.printable table.
 PERMISSION_TYPE_SORT = {
     'admin': '####',
     'write': '###',
     'read':  '##',
     'none':  '#',
 }
 
 
 def display_user_sort(obj):
     """
     Sort function used to sort permissions in .permissions() function of
     Repository, RepoGroup, UserGroup. Also it put the default user in front
     of all other resources
     """
 
     if obj.username == User.DEFAULT_USER:
         return '#####'
     prefix = PERMISSION_TYPE_SORT.get(obj.permission.split('.')[-1], '')
     return prefix + obj.username
 
 
 def display_user_group_sort(obj):
     """
     Sort function used to sort permissions in .permissions() function of
     Repository, RepoGroup, UserGroup. Also it put the default user in front
     of all other resources
     """
 
     prefix = PERMISSION_TYPE_SORT.get(obj.permission.split('.')[-1], '')
     return prefix + obj.users_group_name
 
 
 def _hash_key(k):
     return sha1_safe(k)
 
 
 def in_filter_generator(qry, items, limit=500):
     """
     Splits IN() into multiple with OR
     e.g.::
     cnt = Repository.query().filter(
         or_(
             *in_filter_generator(Repository.repo_id, range(100000))
         )).count()
     """
     if not items:
         # empty list will cause empty query which might cause security issues
         # this can lead to hidden unpleasant results
         items = [-1]
 
     parts = []
     for chunk in xrange(0, len(items), limit):
         parts.append(
             qry.in_(items[chunk: chunk + limit])
         )
 
     return parts
 
 
 base_table_args = {
     'extend_existing': True,
     'mysql_engine': 'InnoDB',
     'mysql_charset': 'utf8',
     'sqlite_autoincrement': True
 }
 
 
 class EncryptedTextValue(TypeDecorator):
     """
     Special column for encrypted long text data, use like::
 
         value = Column("encrypted_value", EncryptedValue(), nullable=False)
 
     This column is intelligent so if value is in unencrypted form it return
     unencrypted form, but on save it always encrypts
     """
     impl = Text
 
     def process_bind_param(self, value, dialect):
         """
         Setter for storing value
         """
         import rhodecode
         if not value:
             return value
 
         # protect against double encrypting if values is already encrypted
         if value.startswith('enc$aes$') \
                 or value.startswith('enc$aes_hmac$') \
                 or value.startswith('enc2$'):
             raise ValueError('value needs to be in unencrypted format, '
                              'ie. not starting with enc$ or enc2$')
 
         algo = rhodecode.CONFIG.get('rhodecode.encrypted_values.algorithm') or 'aes'
         if algo == 'aes':
             return 'enc$aes_hmac$%s' % AESCipher(ENCRYPTION_KEY, hmac=True).encrypt(value)
         elif algo == 'fernet':
             return Encryptor(ENCRYPTION_KEY).encrypt(value)
         else:
             ValueError('Bad encryption algorithm, should be fernet or aes, got: {}'.format(algo))
 
     def process_result_value(self, value, dialect):
         """
         Getter for retrieving value
         """
 
         import rhodecode
         if not value:
             return value
 
         algo = rhodecode.CONFIG.get('rhodecode.encrypted_values.algorithm') or 'aes'
         enc_strict_mode = str2bool(rhodecode.CONFIG.get('rhodecode.encrypted_values.strict') or True)
         if algo == 'aes':
             decrypted_data = validate_and_get_enc_data(value, ENCRYPTION_KEY, enc_strict_mode)
         elif algo == 'fernet':
             return Encryptor(ENCRYPTION_KEY).decrypt(value)
         else:
             ValueError('Bad encryption algorithm, should be fernet or aes, got: {}'.format(algo))
         return decrypted_data
 
 
 class BaseModel(object):
     """
     Base Model for all classes
     """
 
     @classmethod
     def _get_keys(cls):
         """return column names for this model """
         return class_mapper(cls).c.keys()
 
     def get_dict(self):
         """
         return dict with keys and values corresponding
         to this model data """
 
         d = {}
         for k in self._get_keys():
             d[k] = getattr(self, k)
 
         # also use __json__() if present to get additional fields
         _json_attr = getattr(self, '__json__', None)
         if _json_attr:
             # update with attributes from __json__
             if callable(_json_attr):
                 _json_attr = _json_attr()
             for k, val in _json_attr.iteritems():
                 d[k] = val
         return d
 
     def get_appstruct(self):
         """return list with keys and values tuples corresponding
         to this model data """
 
         lst = []
         for k in self._get_keys():
             lst.append((k, getattr(self, k),))
         return lst
 
     def populate_obj(self, populate_dict):
         """populate model with data from given populate_dict"""
 
         for k in self._get_keys():
             if k in populate_dict:
                 setattr(self, k, populate_dict[k])
 
     @classmethod
     def query(cls):
         return Session().query(cls)
 
     @classmethod
     def get(cls, id_):
         if id_:
             return cls.query().get(id_)
 
     @classmethod
     def get_or_404(cls, id_):
         from pyramid.httpexceptions import HTTPNotFound
 
         try:
             id_ = int(id_)
         except (TypeError, ValueError):
             raise HTTPNotFound()
 
         res = cls.query().get(id_)
         if not res:
             raise HTTPNotFound()
         return res
 
     @classmethod
     def getAll(cls):
         # deprecated and left for backward compatibility
         return cls.get_all()
 
     @classmethod
     def get_all(cls):
         return cls.query().all()
 
     @classmethod
     def delete(cls, id_):
         obj = cls.query().get(id_)
         Session().delete(obj)
 
     @classmethod
     def identity_cache(cls, session, attr_name, value):
         exist_in_session = []
         for (item_cls, pkey), instance in session.identity_map.items():
             if cls == item_cls and getattr(instance, attr_name) == value:
                 exist_in_session.append(instance)
         if exist_in_session:
             if len(exist_in_session) == 1:
                 return exist_in_session[0]
             log.exception(
                 'multiple objects with attr %s and '
                 'value %s found with same name: %r',
                 attr_name, value, exist_in_session)
 
     def __repr__(self):
         if hasattr(self, '__unicode__'):
             # python repr needs to return str
             try:
                 return safe_str(self.__unicode__())
             except UnicodeDecodeError:
                 pass
         return '<DB:%s>' % (self.__class__.__name__)
 
 
 class RhodeCodeSetting(Base, BaseModel):
     __tablename__ = 'rhodecode_settings'
     __table_args__ = (
         UniqueConstraint('app_settings_name'),
         base_table_args
     )
 
     SETTINGS_TYPES = {
         'str': safe_str,
         'int': safe_int,
         'unicode': safe_unicode,
         'bool': str2bool,
         'list': functools.partial(aslist, sep=',')
     }
     DEFAULT_UPDATE_URL = 'https://rhodecode.com/api/v1/info/versions'
     GLOBAL_CONF_KEY = 'app_settings'
 
     app_settings_id = Column("app_settings_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     app_settings_name = Column("app_settings_name", String(255), nullable=True, unique=None, default=None)
     _app_settings_value = Column("app_settings_value", String(4096), nullable=True, unique=None, default=None)
     _app_settings_type = Column("app_settings_type", String(255), nullable=True, unique=None, default=None)
 
     def __init__(self, key='', val='', type='unicode'):
         self.app_settings_name = key
         self.app_settings_type = type
         self.app_settings_value = val
 
     @validates('_app_settings_value')
     def validate_settings_value(self, key, val):
         assert type(val) == unicode
         return val
 
     @hybrid_property
     def app_settings_value(self):
         v = self._app_settings_value
         _type = self.app_settings_type
         if _type:
             _type = self.app_settings_type.split('.')[0]
             # decode the encrypted value
             if 'encrypted' in self.app_settings_type:
                 cipher = EncryptedTextValue()
                 v = safe_unicode(cipher.process_result_value(v, None))
 
         converter = self.SETTINGS_TYPES.get(_type) or \
             self.SETTINGS_TYPES['unicode']
         return converter(v)
 
     @app_settings_value.setter
     def app_settings_value(self, val):
         """
         Setter that will always make sure we use unicode in app_settings_value
 
         :param val:
         """
         val = safe_unicode(val)
         # encode the encrypted value
         if 'encrypted' in self.app_settings_type:
             cipher = EncryptedTextValue()
             val = safe_unicode(cipher.process_bind_param(val, None))
         self._app_settings_value = val
 
     @hybrid_property
     def app_settings_type(self):
         return self._app_settings_type
 
     @app_settings_type.setter
     def app_settings_type(self, val):
         if val.split('.')[0] not in self.SETTINGS_TYPES:
             raise Exception('type must be one of %s got %s'
                             % (self.SETTINGS_TYPES.keys(), val))
         self._app_settings_type = val
 
     @classmethod
     def get_by_prefix(cls, prefix):
         return RhodeCodeSetting.query()\
             .filter(RhodeCodeSetting.app_settings_name.startswith(prefix))\
             .all()
 
     def __unicode__(self):
         return u"<%s('%s:%s[%s]')>" % (
             self.__class__.__name__,
             self.app_settings_name, self.app_settings_value,
             self.app_settings_type
         )
 
 
 class RhodeCodeUi(Base, BaseModel):
     __tablename__ = 'rhodecode_ui'
     __table_args__ = (
         UniqueConstraint('ui_key'),
         base_table_args
     )
 
     HOOK_REPO_SIZE = 'changegroup.repo_size'
     # HG
     HOOK_PRE_PULL = 'preoutgoing.pre_pull'
     HOOK_PULL = 'outgoing.pull_logger'
     HOOK_PRE_PUSH = 'prechangegroup.pre_push'
     HOOK_PRETX_PUSH = 'pretxnchangegroup.pre_push'
     HOOK_PUSH = 'changegroup.push_logger'
     HOOK_PUSH_KEY = 'pushkey.key_push'
 
     HOOKS_BUILTIN = [
         HOOK_PRE_PULL,
         HOOK_PULL,
         HOOK_PRE_PUSH,
         HOOK_PRETX_PUSH,
         HOOK_PUSH,
         HOOK_PUSH_KEY,
     ]
 
     # TODO: johbo: Unify way how hooks are configured for git and hg,
     # git part is currently hardcoded.
 
     # SVN PATTERNS
     SVN_BRANCH_ID = 'vcs_svn_branch'
     SVN_TAG_ID = 'vcs_svn_tag'
 
     ui_id = Column(
         "ui_id", Integer(), nullable=False, unique=True, default=None,
         primary_key=True)
     ui_section = Column(
         "ui_section", String(255), nullable=True, unique=None, default=None)
     ui_key = Column(
         "ui_key", String(255), nullable=True, unique=None, default=None)
     ui_value = Column(
         "ui_value", String(255), nullable=True, unique=None, default=None)
     ui_active = Column(
         "ui_active", Boolean(), nullable=True, unique=None, default=True)
 
     def __repr__(self):
         return '<%s[%s]%s=>%s]>' % (self.__class__.__name__, self.ui_section,
                                     self.ui_key, self.ui_value)
 
 
 class RepoRhodeCodeSetting(Base, BaseModel):
     __tablename__ = 'repo_rhodecode_settings'
     __table_args__ = (
         UniqueConstraint(
             'app_settings_name', 'repository_id',
             name='uq_repo_rhodecode_setting_name_repo_id'),
         base_table_args
     )
 
     repository_id = Column(
         "repository_id", Integer(), ForeignKey('repositories.repo_id'),
         nullable=False)
     app_settings_id = Column(
         "app_settings_id", Integer(), nullable=False, unique=True,
         default=None, primary_key=True)
     app_settings_name = Column(
         "app_settings_name", String(255), nullable=True, unique=None,
         default=None)
     _app_settings_value = Column(
         "app_settings_value", String(4096), nullable=True, unique=None,
         default=None)
     _app_settings_type = Column(
         "app_settings_type", String(255), nullable=True, unique=None,
         default=None)
 
     repository = relationship('Repository')
 
     def __init__(self, repository_id, key='', val='', type='unicode'):
         self.repository_id = repository_id
         self.app_settings_name = key
         self.app_settings_type = type
         self.app_settings_value = val
 
     @validates('_app_settings_value')
     def validate_settings_value(self, key, val):
         assert type(val) == unicode
         return val
 
     @hybrid_property
     def app_settings_value(self):
         v = self._app_settings_value
         type_ = self.app_settings_type
         SETTINGS_TYPES = RhodeCodeSetting.SETTINGS_TYPES
         converter = SETTINGS_TYPES.get(type_) or SETTINGS_TYPES['unicode']
         return converter(v)
 
     @app_settings_value.setter
     def app_settings_value(self, val):
         """
         Setter that will always make sure we use unicode in app_settings_value
 
         :param val:
         """
         self._app_settings_value = safe_unicode(val)
 
     @hybrid_property
     def app_settings_type(self):
         return self._app_settings_type
 
     @app_settings_type.setter
     def app_settings_type(self, val):
         SETTINGS_TYPES = RhodeCodeSetting.SETTINGS_TYPES
         if val not in SETTINGS_TYPES:
             raise Exception('type must be one of %s got %s'
                             % (SETTINGS_TYPES.keys(), val))
         self._app_settings_type = val
 
     def __unicode__(self):
         return u"<%s('%s:%s:%s[%s]')>" % (
             self.__class__.__name__, self.repository.repo_name,
             self.app_settings_name, self.app_settings_value,
             self.app_settings_type
         )
 
 
 class RepoRhodeCodeUi(Base, BaseModel):
     __tablename__ = 'repo_rhodecode_ui'
     __table_args__ = (
         UniqueConstraint(
             'repository_id', 'ui_section', 'ui_key',
             name='uq_repo_rhodecode_ui_repository_id_section_key'),
         base_table_args
     )
 
     repository_id = Column(
         "repository_id", Integer(), ForeignKey('repositories.repo_id'),
         nullable=False)
     ui_id = Column(
         "ui_id", Integer(), nullable=False, unique=True, default=None,
         primary_key=True)
     ui_section = Column(
         "ui_section", String(255), nullable=True, unique=None, default=None)
     ui_key = Column(
         "ui_key", String(255), nullable=True, unique=None, default=None)
     ui_value = Column(
         "ui_value", String(255), nullable=True, unique=None, default=None)
     ui_active = Column(
         "ui_active", Boolean(), nullable=True, unique=None, default=True)
 
     repository = relationship('Repository')
 
     def __repr__(self):
         return '<%s[%s:%s]%s=>%s]>' % (
             self.__class__.__name__, self.repository.repo_name,
             self.ui_section, self.ui_key, self.ui_value)
 
 
 class User(Base, BaseModel):
     __tablename__ = 'users'
     __table_args__ = (
         UniqueConstraint('username'), UniqueConstraint('email'),
         Index('u_username_idx', 'username'),
         Index('u_email_idx', 'email'),
         base_table_args
     )
 
     DEFAULT_USER = 'default'
     DEFAULT_USER_EMAIL = '[e-mail]'
     DEFAULT_GRAVATAR_URL = 'https://secure.gravatar.com/avatar/{md5email}?d=identicon&s={size}'
 
     user_id = Column("user_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     username = Column("username", String(255), nullable=True, unique=None, default=None)
     password = Column("password", String(255), nullable=True, unique=None, default=None)
     active = Column("active", Boolean(), nullable=True, unique=None, default=True)
     admin = Column("admin", Boolean(), nullable=True, unique=None, default=False)
     name = Column("firstname", String(255), nullable=True, unique=None, default=None)
     lastname = Column("lastname", String(255), nullable=True, unique=None, default=None)
     _email = Column("email", String(255), nullable=True, unique=None, default=None)
     last_login = Column("last_login", DateTime(timezone=False), nullable=True, unique=None, default=None)
     last_activity = Column('last_activity', DateTime(timezone=False), nullable=True, unique=None, default=None)
 
     extern_type = Column("extern_type", String(255), nullable=True, unique=None, default=None)
     extern_name = Column("extern_name", String(255), nullable=True, unique=None, default=None)
     _api_key = Column("api_key", String(255), nullable=True, unique=None, default=None)
     inherit_default_permissions = Column("inherit_default_permissions", Boolean(), nullable=False, unique=None, default=True)
     created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
     _user_data = Column("user_data", LargeBinary(), nullable=True)  # JSON data
 
     user_log = relationship('UserLog')
-    user_perms = relationship('UserToPerm', primaryjoin="User.user_id==UserToPerm.user_id", cascade='all')
+    user_perms = relationship('UserToPerm', primaryjoin="User.user_id==UserToPerm.user_id", cascade='all, delete-orphan')
 
     repositories = relationship('Repository')
     repository_groups = relationship('RepoGroup')
     user_groups = relationship('UserGroup')
 
     user_followers = relationship('UserFollowing', primaryjoin='UserFollowing.follows_user_id==User.user_id', cascade='all')
     followings = relationship('UserFollowing', primaryjoin='UserFollowing.user_id==User.user_id', cascade='all')
 
-    repo_to_perm = relationship('UserRepoToPerm', primaryjoin='UserRepoToPerm.user_id==User.user_id', cascade='all')
-    repo_group_to_perm = relationship('UserRepoGroupToPerm', primaryjoin='UserRepoGroupToPerm.user_id==User.user_id', cascade='all')
-    user_group_to_perm = relationship('UserUserGroupToPerm', primaryjoin='UserUserGroupToPerm.user_id==User.user_id', cascade='all')
+    repo_to_perm = relationship('UserRepoToPerm', primaryjoin='UserRepoToPerm.user_id==User.user_id', cascade='all, delete-orphan')
+    repo_group_to_perm = relationship('UserRepoGroupToPerm', primaryjoin='UserRepoGroupToPerm.user_id==User.user_id', cascade='all, delete-orphan')
+    user_group_to_perm = relationship('UserUserGroupToPerm', primaryjoin='UserUserGroupToPerm.user_id==User.user_id', cascade='all, delete-orphan')
 
     group_member = relationship('UserGroupMember', cascade='all')
 
     notifications = relationship('UserNotification', cascade='all')
     # notifications assigned to this user
     user_created_notifications = relationship('Notification', cascade='all')
     # comments created by this user
     user_comments = relationship('ChangesetComment', cascade='all')
     # user profile extra info
     user_emails = relationship('UserEmailMap', cascade='all')
     user_ip_map = relationship('UserIpMap', cascade='all')
     user_auth_tokens = relationship('UserApiKeys', cascade='all')
     user_ssh_keys = relationship('UserSshKeys', cascade='all')
 
     # gists
     user_gists = relationship('Gist', cascade='all')
     # user pull requests
     user_pull_requests = relationship('PullRequest', cascade='all')
     # external identities
     extenal_identities = relationship(
         'ExternalIdentity',
         primaryjoin="User.user_id==ExternalIdentity.local_user_id",
         cascade='all')
     # review rules
     user_review_rules = relationship('RepoReviewRuleUser', cascade='all')
 
     def __unicode__(self):
         return u"<%s('id:%s:%s')>" % (self.__class__.__name__,
                                       self.user_id, self.username)
 
     @hybrid_property
     def email(self):
         return self._email
 
     @email.setter
     def email(self, val):
         self._email = val.lower() if val else None
 
     @hybrid_property
     def first_name(self):
         from rhodecode.lib import helpers as h
         if self.name:
             return h.escape(self.name)
         return self.name
 
     @hybrid_property
     def last_name(self):
         from rhodecode.lib import helpers as h
         if self.lastname:
             return h.escape(self.lastname)
         return self.lastname
 
     @hybrid_property
     def api_key(self):
         """
         Fetch if exist an auth-token with role ALL connected to this user
         """
         user_auth_token = UserApiKeys.query()\
             .filter(UserApiKeys.user_id == self.user_id)\
             .filter(or_(UserApiKeys.expires == -1,
                             UserApiKeys.expires >= time.time()))\
             .filter(UserApiKeys.role == UserApiKeys.ROLE_ALL).first()
         if user_auth_token:
             user_auth_token = user_auth_token.api_key
 
         return user_auth_token
 
     @api_key.setter
     def api_key(self, val):
         # don't allow to set API key this is deprecated for now
         self._api_key = None
 
     @property
     def reviewer_pull_requests(self):
         return PullRequestReviewers.query() \
             .options(joinedload(PullRequestReviewers.pull_request)) \
             .filter(PullRequestReviewers.user_id == self.user_id) \
             .all()
 
     @property
     def firstname(self):
         # alias for future
         return self.name
 
     @property
     def emails(self):
         other = UserEmailMap.query()\
             .filter(UserEmailMap.user == self) \
             .order_by(UserEmailMap.email_id.asc()) \
             .all()
         return [self.email] + [x.email for x in other]
 
     @property
     def auth_tokens(self):
         auth_tokens = self.get_auth_tokens()
         return [x.api_key for x in auth_tokens]
 
     def get_auth_tokens(self):
         return UserApiKeys.query()\
             .filter(UserApiKeys.user == self)\
             .order_by(UserApiKeys.user_api_key_id.asc())\
             .all()
 
     @LazyProperty
     def feed_token(self):
         return self.get_feed_token()
 
     def get_feed_token(self, cache=True):
         feed_tokens = UserApiKeys.query()\
             .filter(UserApiKeys.user == self)\
             .filter(UserApiKeys.role == UserApiKeys.ROLE_FEED)
         if cache:
             feed_tokens = feed_tokens.options(
                 FromCache("sql_cache_short", "get_user_feed_token_%s" % self.user_id))
 
         feed_tokens = feed_tokens.all()
         if feed_tokens:
             return feed_tokens[0].api_key
         return 'NO_FEED_TOKEN_AVAILABLE'
 
     @classmethod
     def get(cls, user_id, cache=False):
         if not user_id:
             return
 
         user = cls.query()
         if cache:
             user = user.options(
                 FromCache("sql_cache_short", "get_users_%s" % user_id))
         return user.get(user_id)
 
     @classmethod
     def extra_valid_auth_tokens(cls, user, role=None):
         tokens = UserApiKeys.query().filter(UserApiKeys.user == user)\
                 .filter(or_(UserApiKeys.expires == -1,
                             UserApiKeys.expires >= time.time()))
         if role:
             tokens = tokens.filter(or_(UserApiKeys.role == role,
                                        UserApiKeys.role == UserApiKeys.ROLE_ALL))
         return tokens.all()
 
     def authenticate_by_token(self, auth_token, roles=None, scope_repo_id=None):
         from rhodecode.lib import auth
 
         log.debug('Trying to authenticate user: %s via auth-token, '
                   'and roles: %s', self, roles)
 
         if not auth_token:
             return False
 
         roles = (roles or []) + [UserApiKeys.ROLE_ALL]
         tokens_q = UserApiKeys.query()\
             .filter(UserApiKeys.user_id == self.user_id)\
             .filter(or_(UserApiKeys.expires == -1,
                         UserApiKeys.expires >= time.time()))
 
         tokens_q = tokens_q.filter(UserApiKeys.role.in_(roles))
 
         crypto_backend = auth.crypto_backend()
         enc_token_map = {}
         plain_token_map = {}
         for token in tokens_q:
             if token.api_key.startswith(crypto_backend.ENC_PREF):
                 enc_token_map[token.api_key] = token
             else:
                 plain_token_map[token.api_key] = token
         log.debug(
             'Found %s plain and %s encrypted user tokens to check for authentication',
             len(plain_token_map), len(enc_token_map))
 
         # plain token match comes first
         match = plain_token_map.get(auth_token)
 
         # check encrypted tokens now
         if not match:
             for token_hash, token in enc_token_map.items():
                 # NOTE(marcink): this is expensive to calculate, but most secure
                 if crypto_backend.hash_check(auth_token, token_hash):
                     match = token
                     break
 
         if match:
             log.debug('Found matching token %s', match)
             if match.repo_id:
                 log.debug('Found scope, checking for scope match of token %s', match)
                 if match.repo_id == scope_repo_id:
                     return True
                 else:
                     log.debug(
                         'AUTH_TOKEN: scope mismatch, token has a set repo scope: %s, '
                         'and calling scope is:%s, skipping further checks',
                          match.repo, scope_repo_id)
                     return False
             else:
                 return True
 
         return False
 
     @property
     def ip_addresses(self):
         ret = UserIpMap.query().filter(UserIpMap.user == self).all()
         return [x.ip_addr for x in ret]
 
     @property
     def username_and_name(self):
         return '%s (%s %s)' % (self.username, self.first_name, self.last_name)
 
     @property
     def username_or_name_or_email(self):
         full_name = self.full_name if self.full_name is not ' ' else None
         return self.username or full_name or self.email
 
     @property
     def full_name(self):
         return '%s %s' % (self.first_name, self.last_name)
 
     @property
     def full_name_or_username(self):
         return ('%s %s' % (self.first_name, self.last_name)
                 if (self.first_name and self.last_name) else self.username)
 
     @property
     def full_contact(self):
         return '%s %s <%s>' % (self.first_name, self.last_name, self.email)
 
     @property
     def short_contact(self):
         return '%s %s' % (self.first_name, self.last_name)
 
     @property
     def is_admin(self):
         return self.admin
 
     def AuthUser(self, **kwargs):
         """
         Returns instance of AuthUser for this user
         """
         from rhodecode.lib.auth import AuthUser
         return AuthUser(user_id=self.user_id, username=self.username, **kwargs)
 
     @hybrid_property
     def user_data(self):
         if not self._user_data:
             return {}
 
         try:
             return json.loads(self._user_data)
         except TypeError:
             return {}
 
     @user_data.setter
     def user_data(self, val):
         if not isinstance(val, dict):
             raise Exception('user_data must be dict, got %s' % type(val))
         try:
             self._user_data = json.dumps(val)
         except Exception:
             log.error(traceback.format_exc())
 
     @classmethod
     def get_by_username(cls, username, case_insensitive=False,
                         cache=False, identity_cache=False):
         session = Session()
 
         if case_insensitive:
             q = cls.query().filter(
                 func.lower(cls.username) == func.lower(username))
         else:
             q = cls.query().filter(cls.username == username)
 
         if cache:
             if identity_cache:
                 val = cls.identity_cache(session, 'username', username)
                 if val:
                     return val
             else:
                 cache_key = "get_user_by_name_%s" % _hash_key(username)
                 q = q.options(
                     FromCache("sql_cache_short", cache_key))
 
         return q.scalar()
 
     @classmethod
     def get_by_auth_token(cls, auth_token, cache=False):
         q = UserApiKeys.query()\
             .filter(UserApiKeys.api_key == auth_token)\
             .filter(or_(UserApiKeys.expires == -1,
                         UserApiKeys.expires >= time.time()))
         if cache:
             q = q.options(
                 FromCache("sql_cache_short", "get_auth_token_%s" % auth_token))
 
         match = q.first()
         if match:
             return match.user
 
     @classmethod
     def get_by_email(cls, email, case_insensitive=False, cache=False):
 
         if case_insensitive:
             q = cls.query().filter(func.lower(cls.email) == func.lower(email))
 
         else:
             q = cls.query().filter(cls.email == email)
 
         email_key = _hash_key(email)
         if cache:
             q = q.options(
                 FromCache("sql_cache_short", "get_email_key_%s" % email_key))
 
         ret = q.scalar()
         if ret is None:
             q = UserEmailMap.query()
             # try fetching in alternate email map
             if case_insensitive:
                 q = q.filter(func.lower(UserEmailMap.email) == func.lower(email))
             else:
                 q = q.filter(UserEmailMap.email == email)
             q = q.options(joinedload(UserEmailMap.user))
             if cache:
                 q = q.options(
                     FromCache("sql_cache_short", "get_email_map_key_%s" % email_key))
             ret = getattr(q.scalar(), 'user', None)
 
         return ret
 
     @classmethod
     def get_from_cs_author(cls, author):
         """
         Tries to get User objects out of commit author string
 
         :param author:
         """
         from rhodecode.lib.helpers import email, author_name
         # Valid email in the attribute passed, see if they're in the system
         _email = email(author)
         if _email:
             user = cls.get_by_email(_email, case_insensitive=True)
             if user:
                 return user
         # Maybe we can match by username?
         _author = author_name(author)
         user = cls.get_by_username(_author, case_insensitive=True)
         if user:
             return user
 
     def update_userdata(self, **kwargs):
         usr = self
         old = usr.user_data
         old.update(**kwargs)
         usr.user_data = old
         Session().add(usr)
         log.debug('updated userdata with %s', kwargs)
 
     def update_lastlogin(self):
         """Update user lastlogin"""
         self.last_login = datetime.datetime.now()
         Session().add(self)
         log.debug('updated user %s lastlogin', self.username)
 
     def update_password(self, new_password):
         from rhodecode.lib.auth import get_crypt_password
 
         self.password = get_crypt_password(new_password)
         Session().add(self)
 
     @classmethod
     def get_first_super_admin(cls):
         user = User.query()\
             .filter(User.admin == true()) \
             .order_by(User.user_id.asc()) \
             .first()
 
         if user is None:
             raise Exception('FATAL: Missing administrative account!')
         return user
 
     @classmethod
     def get_all_super_admins(cls, only_active=False):
         """
         Returns all admin accounts sorted by username
         """
         qry = User.query().filter(User.admin == true()).order_by(User.username.asc())
         if only_active:
             qry = qry.filter(User.active == true())
         return qry.all()
 
     @classmethod
     def get_default_user(cls, cache=False, refresh=False):
         user = User.get_by_username(User.DEFAULT_USER, cache=cache)
         if user is None:
             raise Exception('FATAL: Missing default account!')
         if refresh:
             # The default user might be based on outdated state which
             # has been loaded from the cache.
             # A call to refresh() ensures that the
             # latest state from the database is used.
             Session().refresh(user)
         return user
 
     def _get_default_perms(self, user, suffix=''):
         from rhodecode.model.permission import PermissionModel
         return PermissionModel().get_default_perms(user.user_perms, suffix)
 
     def get_default_perms(self, suffix=''):
         return self._get_default_perms(self, suffix)
 
     def get_api_data(self, include_secrets=False, details='full'):
         """
         Common function for generating user related data for API
 
         :param include_secrets: By default secrets in the API data will be replaced
            by a placeholder value to prevent exposing this data by accident. In case
            this data shall be exposed, set this flag to ``True``.
 
         :param details: details can be 'basic|full' basic gives only a subset of
            the available user information that includes user_id, name and emails.
         """
         user = self
         user_data = self.user_data
         data = {
             'user_id': user.user_id,
             'username': user.username,
             'firstname': user.name,
             'lastname': user.lastname,
             'email': user.email,
             'emails': user.emails,
         }
         if details == 'basic':
             return data
 
         auth_token_length = 40
         auth_token_replacement = '*' * auth_token_length
 
         extras = {
             'auth_tokens': [auth_token_replacement],
             'active': user.active,
             'admin': user.admin,
             'extern_type': user.extern_type,
             'extern_name': user.extern_name,
             'last_login': user.last_login,
             'last_activity': user.last_activity,
             'ip_addresses': user.ip_addresses,
             'language': user_data.get('language')
         }
         data.update(extras)
 
         if include_secrets:
             data['auth_tokens'] = user.auth_tokens
         return data
 
     def __json__(self):
         data = {
             'full_name': self.full_name,
             'full_name_or_username': self.full_name_or_username,
             'short_contact': self.short_contact,
             'full_contact': self.full_contact,
         }
         data.update(self.get_api_data())
         return data
 
 
 class UserApiKeys(Base, BaseModel):
     __tablename__ = 'user_api_keys'
     __table_args__ = (
         Index('uak_api_key_idx', 'api_key'),
         Index('uak_api_key_expires_idx', 'api_key', 'expires'),
         base_table_args
     )
     __mapper_args__ = {}
 
     # ApiKey role
     ROLE_ALL = 'token_role_all'
     ROLE_HTTP = 'token_role_http'
     ROLE_VCS = 'token_role_vcs'
     ROLE_API = 'token_role_api'
     ROLE_FEED = 'token_role_feed'
     ROLE_PASSWORD_RESET = 'token_password_reset'
 
     ROLES = [ROLE_ALL, ROLE_HTTP, ROLE_VCS, ROLE_API, ROLE_FEED]
 
     user_api_key_id = Column("user_api_key_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=True, unique=None, default=None)
     api_key = Column("api_key", String(255), nullable=False, unique=True)
     description = Column('description', UnicodeText().with_variant(UnicodeText(1024), 'mysql'))
     expires = Column('expires', Float(53), nullable=False)
     role = Column('role', String(255), nullable=True)
     created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
 
     # scope columns
     repo_id = Column(
         'repo_id', Integer(), ForeignKey('repositories.repo_id'),
         nullable=True, unique=None, default=None)
     repo = relationship('Repository', lazy='joined')
 
     repo_group_id = Column(
         'repo_group_id', Integer(), ForeignKey('groups.group_id'),
         nullable=True, unique=None, default=None)
     repo_group = relationship('RepoGroup', lazy='joined')
 
     user = relationship('User', lazy='joined')
 
     def __unicode__(self):
         return u"<%s('%s')>" % (self.__class__.__name__, self.role)
 
     def __json__(self):
         data = {
             'auth_token': self.api_key,
             'role': self.role,
             'scope': self.scope_humanized,
             'expired': self.expired
         }
         return data
 
     def get_api_data(self, include_secrets=False):
         data = self.__json__()
         if include_secrets:
             return data
         else:
             data['auth_token'] = self.token_obfuscated
             return data
 
     @hybrid_property
     def description_safe(self):
         from rhodecode.lib import helpers as h
         return h.escape(self.description)
 
     @property
     def expired(self):
         if self.expires == -1:
             return False
         return time.time() > self.expires
 
     @classmethod
     def _get_role_name(cls, role):
         return {
             cls.ROLE_ALL: _('all'),
             cls.ROLE_HTTP: _('http/web interface'),
             cls.ROLE_VCS: _('vcs (git/hg/svn protocol)'),
             cls.ROLE_API: _('api calls'),
             cls.ROLE_FEED: _('feed access'),
         }.get(role, role)
 
     @property
     def role_humanized(self):
         return self._get_role_name(self.role)
 
     def _get_scope(self):
         if self.repo:
             return 'Repository: {}'.format(self.repo.repo_name)
         if self.repo_group:
             return 'RepositoryGroup: {} (recursive)'.format(self.repo_group.group_name)
         return 'Global'
 
     @property
     def scope_humanized(self):
         return self._get_scope()
 
     @property
     def token_obfuscated(self):
         if self.api_key:
             return self.api_key[:4] + "****"
 
 
 class UserEmailMap(Base, BaseModel):
     __tablename__ = 'user_email_map'
     __table_args__ = (
         Index('uem_email_idx', 'email'),
         UniqueConstraint('email'),
         base_table_args
     )
     __mapper_args__ = {}
 
     email_id = Column("email_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=True, unique=None, default=None)
     _email = Column("email", String(255), nullable=True, unique=False, default=None)
     user = relationship('User', lazy='joined')
 
     @validates('_email')
     def validate_email(self, key, email):
         # check if this email is not main one
         main_email = Session().query(User).filter(User.email == email).scalar()
         if main_email is not None:
             raise AttributeError('email %s is present is user table' % email)
         return email
 
     @hybrid_property
     def email(self):
         return self._email
 
     @email.setter
     def email(self, val):
         self._email = val.lower() if val else None
 
 
 class UserIpMap(Base, BaseModel):
     __tablename__ = 'user_ip_map'
     __table_args__ = (
         UniqueConstraint('user_id', 'ip_addr'),
         base_table_args
     )
     __mapper_args__ = {}
 
     ip_id = Column("ip_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=True, unique=None, default=None)
     ip_addr = Column("ip_addr", String(255), nullable=True, unique=False, default=None)
     active = Column("active", Boolean(), nullable=True, unique=None, default=True)
     description = Column("description", String(10000), nullable=True, unique=None, default=None)
     user = relationship('User', lazy='joined')
 
     @hybrid_property
     def description_safe(self):
         from rhodecode.lib import helpers as h
         return h.escape(self.description)
 
     @classmethod
     def _get_ip_range(cls, ip_addr):
         net = ipaddress.ip_network(safe_unicode(ip_addr), strict=False)
         return [str(net.network_address), str(net.broadcast_address)]
 
     def __json__(self):
         return {
           'ip_addr': self.ip_addr,
           'ip_range': self._get_ip_range(self.ip_addr),
         }
 
     def __unicode__(self):
         return u"<%s('user_id:%s=>%s')>" % (self.__class__.__name__,
                                             self.user_id, self.ip_addr)
 
 
 class UserSshKeys(Base, BaseModel):
     __tablename__ = 'user_ssh_keys'
     __table_args__ = (
         Index('usk_ssh_key_fingerprint_idx', 'ssh_key_fingerprint'),
 
         UniqueConstraint('ssh_key_fingerprint'),
 
         base_table_args
     )
     __mapper_args__ = {}
 
     ssh_key_id = Column('ssh_key_id', Integer(), nullable=False, unique=True, default=None, primary_key=True)
     ssh_key_data = Column('ssh_key_data', String(10240), nullable=False, unique=None, default=None)
     ssh_key_fingerprint = Column('ssh_key_fingerprint', String(255), nullable=False, unique=None, default=None)
 
     description = Column('description', UnicodeText().with_variant(UnicodeText(1024), 'mysql'))
 
     created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
     accessed_on = Column('accessed_on', DateTime(timezone=False), nullable=True, default=None)
     user_id = Column('user_id', Integer(), ForeignKey('users.user_id'), nullable=True, unique=None, default=None)
 
     user = relationship('User', lazy='joined')
 
     def __json__(self):
         data = {
             'ssh_fingerprint': self.ssh_key_fingerprint,
             'description': self.description,
             'created_on': self.created_on
         }
         return data
 
     def get_api_data(self):
         data = self.__json__()
         return data
 
 
 class UserLog(Base, BaseModel):
     __tablename__ = 'user_logs'
     __table_args__ = (
         base_table_args,
     )
 
     VERSION_1 = 'v1'
     VERSION_2 = 'v2'
     VERSIONS = [VERSION_1, VERSION_2]
 
     user_log_id = Column("user_log_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id',ondelete='SET NULL'), nullable=True, unique=None, default=None)
     username = Column("username", String(255), nullable=True, unique=None, default=None)
     repository_id = Column("repository_id", Integer(), ForeignKey('repositories.repo_id', ondelete='SET NULL'), nullable=True, unique=None, default=None)
     repository_name = Column("repository_name", String(255), nullable=True, unique=None, default=None)
     user_ip = Column("user_ip", String(255), nullable=True, unique=None, default=None)
     action = Column("action", Text().with_variant(Text(1200000), 'mysql'), nullable=True, unique=None, default=None)
     action_date = Column("action_date", DateTime(timezone=False), nullable=True, unique=None, default=None)
 
     version = Column("version", String(255), nullable=True, default=VERSION_1)
     user_data = Column('user_data_json', MutationObj.as_mutable(JsonType(dialect_map=dict(mysql=LONGTEXT()))))
     action_data = Column('action_data_json', MutationObj.as_mutable(JsonType(dialect_map=dict(mysql=LONGTEXT()))))
 
     def __unicode__(self):
         return u"<%s('id:%s:%s')>" % (
             self.__class__.__name__, self.repository_name, self.action)
 
     def __json__(self):
         return {
             'user_id': self.user_id,
             'username': self.username,
             'repository_id': self.repository_id,
             'repository_name': self.repository_name,
             'user_ip': self.user_ip,
             'action_date': self.action_date,
             'action': self.action,
         }
 
     @hybrid_property
     def entry_id(self):
         return self.user_log_id
 
     @property
     def action_as_day(self):
         return datetime.date(*self.action_date.timetuple()[:3])
 
     user = relationship('User')
     repository = relationship('Repository', cascade='')
 
 
 class UserGroup(Base, BaseModel):
     __tablename__ = 'users_groups'
     __table_args__ = (
         base_table_args,
     )
 
     users_group_id = Column("users_group_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     users_group_name = Column("users_group_name", String(255), nullable=False, unique=True, default=None)
     user_group_description = Column("user_group_description", String(10000), nullable=True, unique=None, default=None)
     users_group_active = Column("users_group_active", Boolean(), nullable=True, unique=None, default=None)
     inherit_default_permissions = Column("users_group_inherit_default_permissions", Boolean(), nullable=False, unique=None, default=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=False, default=None)
     created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
     _group_data = Column("group_data", LargeBinary(), nullable=True)  # JSON data
 
-    members = relationship('UserGroupMember', cascade="all, delete, delete-orphan", lazy="joined")
+    members = relationship('UserGroupMember', cascade="all, delete-orphan", lazy="joined")
     users_group_to_perm = relationship('UserGroupToPerm', cascade='all')
     users_group_repo_to_perm = relationship('UserGroupRepoToPerm', cascade='all')
     users_group_repo_group_to_perm = relationship('UserGroupRepoGroupToPerm', cascade='all')
     user_user_group_to_perm = relationship('UserUserGroupToPerm', cascade='all')
     user_group_user_group_to_perm = relationship('UserGroupUserGroupToPerm ', primaryjoin="UserGroupUserGroupToPerm.target_user_group_id==UserGroup.users_group_id", cascade='all')
 
     user_group_review_rules = relationship('RepoReviewRuleUserGroup', cascade='all')
     user = relationship('User', primaryjoin="User.user_id==UserGroup.user_id")
 
     @classmethod
     def _load_group_data(cls, column):
         if not column:
             return {}
 
         try:
             return json.loads(column) or {}
         except TypeError:
             return {}
 
     @hybrid_property
     def description_safe(self):
         from rhodecode.lib import helpers as h
         return h.escape(self.user_group_description)
 
     @hybrid_property
     def group_data(self):
         return self._load_group_data(self._group_data)
 
     @group_data.expression
     def group_data(self, **kwargs):
         return self._group_data
 
     @group_data.setter
     def group_data(self, val):
         try:
             self._group_data = json.dumps(val)
         except Exception:
             log.error(traceback.format_exc())
 
     @classmethod
     def _load_sync(cls, group_data):
         if group_data:
             return group_data.get('extern_type')
 
     @property
     def sync(self):
         return self._load_sync(self.group_data)
 
     def __unicode__(self):
         return u"<%s('id:%s:%s')>" % (self.__class__.__name__,
                                       self.users_group_id,
                                       self.users_group_name)
 
     @classmethod
     def get_by_group_name(cls, group_name, cache=False,
                           case_insensitive=False):
         if case_insensitive:
             q = cls.query().filter(func.lower(cls.users_group_name) ==
                                    func.lower(group_name))
 
         else:
             q = cls.query().filter(cls.users_group_name == group_name)
         if cache:
             q = q.options(
                 FromCache("sql_cache_short", "get_group_%s" % _hash_key(group_name)))
         return q.scalar()
 
     @classmethod
     def get(cls, user_group_id, cache=False):
         if not user_group_id:
             return
 
         user_group = cls.query()
         if cache:
             user_group = user_group.options(
                 FromCache("sql_cache_short", "get_users_group_%s" % user_group_id))
         return user_group.get(user_group_id)
 
     def permissions(self, with_admins=True, with_owner=True,
                     expand_from_user_groups=False):
         """
         Permissions for user groups
         """
         _admin_perm = 'usergroup.admin'
 
         owner_row = []
         if with_owner:
             usr = AttributeDict(self.user.get_dict())
             usr.owner_row = True
             usr.permission = _admin_perm
             owner_row.append(usr)
 
         super_admin_ids = []
         super_admin_rows = []
         if with_admins:
             for usr in User.get_all_super_admins():
                 super_admin_ids.append(usr.user_id)
                 # if this admin is also owner, don't double the record
                 if usr.user_id == owner_row[0].user_id:
                     owner_row[0].admin_row = True
                 else:
                     usr = AttributeDict(usr.get_dict())
                     usr.admin_row = True
                     usr.permission = _admin_perm
                     super_admin_rows.append(usr)
 
         q = UserUserGroupToPerm.query().filter(UserUserGroupToPerm.user_group == self)
         q = q.options(joinedload(UserUserGroupToPerm.user_group),
                       joinedload(UserUserGroupToPerm.user),
                       joinedload(UserUserGroupToPerm.permission),)
 
         # get owners and admins and permissions. We do a trick of re-writing
         # objects from sqlalchemy to named-tuples due to sqlalchemy session
         # has a global reference and changing one object propagates to all
         # others. This means if admin is also an owner admin_row that change
         # would propagate to both objects
         perm_rows = []
         for _usr in q.all():
             usr = AttributeDict(_usr.user.get_dict())
             # if this user is also owner/admin, mark as duplicate record
             if usr.user_id == owner_row[0].user_id or usr.user_id in super_admin_ids:
                 usr.duplicate_perm = True
             usr.permission = _usr.permission.permission_name
             perm_rows.append(usr)
 
         # filter the perm rows by 'default' first and then sort them by
         # admin,write,read,none permissions sorted again alphabetically in
         # each group
         perm_rows = sorted(perm_rows, key=display_user_sort)
 
         user_groups_rows = []
         if expand_from_user_groups:
             for ug in self.permission_user_groups(with_members=True):
                 for user_data in ug.members:
                     user_groups_rows.append(user_data)
 
         return super_admin_rows + owner_row + perm_rows + user_groups_rows
 
     def permission_user_groups(self, with_members=False):
         q = UserGroupUserGroupToPerm.query()\
             .filter(UserGroupUserGroupToPerm.target_user_group == self)
         q = q.options(joinedload(UserGroupUserGroupToPerm.user_group),
                       joinedload(UserGroupUserGroupToPerm.target_user_group),
                       joinedload(UserGroupUserGroupToPerm.permission),)
 
         perm_rows = []
         for _user_group in q.all():
             entry = AttributeDict(_user_group.user_group.get_dict())
             entry.permission = _user_group.permission.permission_name
             if with_members:
                 entry.members = [x.user.get_dict()
                                  for x in _user_group.user_group.members]
             perm_rows.append(entry)
 
         perm_rows = sorted(perm_rows, key=display_user_group_sort)
         return perm_rows
 
     def _get_default_perms(self, user_group, suffix=''):
         from rhodecode.model.permission import PermissionModel
         return PermissionModel().get_default_perms(user_group.users_group_to_perm, suffix)
 
     def get_default_perms(self, suffix=''):
         return self._get_default_perms(self, suffix)
 
     def get_api_data(self, with_group_members=True, include_secrets=False):
         """
         :param include_secrets: See :meth:`User.get_api_data`, this parameter is
            basically forwarded.
 
         """
         user_group = self
         data = {
             'users_group_id': user_group.users_group_id,
             'group_name': user_group.users_group_name,
             'group_description': user_group.user_group_description,
             'active': user_group.users_group_active,
             'owner': user_group.user.username,
             'sync': user_group.sync,
             'owner_email': user_group.user.email,
         }
 
         if with_group_members:
             users = []
             for user in user_group.members:
                 user = user.user
                 users.append(user.get_api_data(include_secrets=include_secrets))
             data['users'] = users
 
         return data
 
 
 class UserGroupMember(Base, BaseModel):
     __tablename__ = 'users_groups_members'
     __table_args__ = (
         base_table_args,
     )
 
     users_group_member_id = Column("users_group_member_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     users_group_id = Column("users_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)
 
     user = relationship('User', lazy='joined')
     users_group = relationship('UserGroup')
 
     def __init__(self, gr_id='', u_id=''):
         self.users_group_id = gr_id
         self.user_id = u_id
 
 
 class RepositoryField(Base, BaseModel):
     __tablename__ = 'repositories_fields'
     __table_args__ = (
         UniqueConstraint('repository_id', 'field_key'),  # no-multi field
         base_table_args,
     )
 
     PREFIX = 'ex_'  # prefix used in form to not conflict with already existing fields
 
     repo_field_id = Column("repo_field_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     repository_id = Column("repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=False, unique=None, default=None)
     field_key = Column("field_key", String(250))
     field_label = Column("field_label", String(1024), nullable=False)
     field_value = Column("field_value", String(10000), nullable=False)
     field_desc = Column("field_desc", String(1024), nullable=False)
     field_type = Column("field_type", String(255), nullable=False, unique=None)
     created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
 
     repository = relationship('Repository')
 
     @property
     def field_key_prefixed(self):
         return 'ex_%s' % self.field_key
 
     @classmethod
     def un_prefix_key(cls, key):
         if key.startswith(cls.PREFIX):
             return key[len(cls.PREFIX):]
         return key
 
     @classmethod
     def get_by_key_name(cls, key, repo):
         row = cls.query()\
                 .filter(cls.repository == repo)\
                 .filter(cls.field_key == key).scalar()
         return row
 
 
 class Repository(Base, BaseModel):
     __tablename__ = 'repositories'
     __table_args__ = (
         Index('r_repo_name_idx', 'repo_name', mysql_length=255),
         base_table_args,
     )
     DEFAULT_CLONE_URI = '{scheme}://{user}@{netloc}/{repo}'
     DEFAULT_CLONE_URI_ID = '{scheme}://{user}@{netloc}/_{repoid}'
     DEFAULT_CLONE_URI_SSH = 'ssh://{sys_user}@{hostname}/{repo}'
 
     STATE_CREATED = 'repo_state_created'
     STATE_PENDING = 'repo_state_pending'
     STATE_ERROR = 'repo_state_error'
 
     LOCK_AUTOMATIC = 'lock_auto'
     LOCK_API = 'lock_api'
     LOCK_WEB = 'lock_web'
     LOCK_PULL = 'lock_pull'
 
     NAME_SEP = URL_SEP
 
     repo_id = Column(
         "repo_id", Integer(), nullable=False, unique=True, default=None,
         primary_key=True)
     _repo_name = Column(
         "repo_name", Text(), nullable=False, default=None)
     _repo_name_hash = Column(
         "repo_name_hash", String(255), nullable=False, unique=True)
     repo_state = Column("repo_state", String(255), nullable=True)
 
     clone_uri = Column(
         "clone_uri", EncryptedTextValue(), nullable=True, unique=False,
         default=None)
     push_uri = Column(
         "push_uri", EncryptedTextValue(), nullable=True, unique=False,
         default=None)
     repo_type = Column(
         "repo_type", String(255), nullable=False, unique=False, default=None)
     user_id = Column(
         "user_id", Integer(), ForeignKey('users.user_id'), nullable=False,
         unique=False, default=None)
     private = Column(
         "private", Boolean(), nullable=True, unique=None, default=None)
     archived = Column(
         "archived", Boolean(), nullable=True, unique=None, default=None)
     enable_statistics = Column(
         "statistics", Boolean(), nullable=True, unique=None, default=True)
     enable_downloads = Column(
         "downloads", Boolean(), nullable=True, unique=None, default=True)
     description = Column(
         "description", String(10000), nullable=True, unique=None, default=None)
     created_on = Column(
         'created_on', DateTime(timezone=False), nullable=True, unique=None,
         default=datetime.datetime.now)
     updated_on = Column(
         'updated_on', DateTime(timezone=False), nullable=True, unique=None,
         default=datetime.datetime.now)
     _landing_revision = Column(
         "landing_revision", String(255), nullable=False, unique=False,
         default=None)
     enable_locking = Column(
         "enable_locking", Boolean(), nullable=False, unique=None,
         default=False)
     _locked = Column(
         "locked", String(255), nullable=True, unique=False, default=None)
     _changeset_cache = Column(
         "changeset_cache", LargeBinary(), nullable=True)  # JSON data
 
     fork_id = Column(
         "fork_id", Integer(), ForeignKey('repositories.repo_id'),
         nullable=True, unique=False, default=None)
     group_id = Column(
         "group_id", Integer(), ForeignKey('groups.group_id'), nullable=True,
         unique=False, default=None)
 
     user = relationship('User', lazy='joined')
     fork = relationship('Repository', remote_side=repo_id, lazy='joined')
     group = relationship('RepoGroup', lazy='joined')
     repo_to_perm = relationship(
         'UserRepoToPerm', cascade='all',
         order_by='UserRepoToPerm.repo_to_perm_id')
     users_group_to_perm = relationship('UserGroupRepoToPerm', cascade='all')
     stats = relationship('Statistics', cascade='all', uselist=False)
 
     followers = relationship(
         'UserFollowing',
         primaryjoin='UserFollowing.follows_repo_id==Repository.repo_id',
         cascade='all')
     extra_fields = relationship(
-        'RepositoryField', cascade="all, delete, delete-orphan")
+        'RepositoryField', cascade="all, delete-orphan")
     logs = relationship('UserLog')
     comments = relationship(
-        'ChangesetComment', cascade="all, delete, delete-orphan")
+        'ChangesetComment', cascade="all, delete-orphan")
     pull_requests_source = relationship(
         'PullRequest',
         primaryjoin='PullRequest.source_repo_id==Repository.repo_id',
-        cascade="all, delete, delete-orphan")
+        cascade="all, delete-orphan")
     pull_requests_target = relationship(
         'PullRequest',
         primaryjoin='PullRequest.target_repo_id==Repository.repo_id',
-        cascade="all, delete, delete-orphan")
+        cascade="all, delete-orphan")
     ui = relationship('RepoRhodeCodeUi', cascade="all")
     settings = relationship('RepoRhodeCodeSetting', cascade="all")
-    integrations = relationship('Integration', cascade="all, delete, delete-orphan")
+    integrations = relationship('Integration', cascade="all, delete-orphan")
 
     scoped_tokens = relationship('UserApiKeys', cascade="all")
 
     artifacts = relationship('FileStore', cascade="all")
 
     def __unicode__(self):
         return u"<%s('%s:%s')>" % (self.__class__.__name__, self.repo_id,
                                    safe_unicode(self.repo_name))
 
     @hybrid_property
     def description_safe(self):
         from rhodecode.lib import helpers as h
         return h.escape(self.description)
 
     @hybrid_property
     def landing_rev(self):
         # always should return [rev_type, rev]
         if self._landing_revision:
             _rev_info = self._landing_revision.split(':')
             if len(_rev_info) < 2:
                 _rev_info.insert(0, 'rev')
             return [_rev_info[0], _rev_info[1]]
         return [None, None]
 
     @landing_rev.setter
     def landing_rev(self, val):
         if ':' not in val:
             raise ValueError('value must be delimited with `:` and consist '
                              'of <rev_type>:<rev>, got %s instead' % val)
         self._landing_revision = val
 
     @hybrid_property
     def locked(self):
         if self._locked:
             user_id, timelocked, reason = self._locked.split(':')
             lock_values = int(user_id), timelocked, reason
         else:
             lock_values = [None, None, None]
         return lock_values
 
     @locked.setter
     def locked(self, val):
         if val and isinstance(val, (list, tuple)):
             self._locked = ':'.join(map(str, val))
         else:
             self._locked = None
 
     @hybrid_property
     def changeset_cache(self):
         from rhodecode.lib.vcs.backends.base import EmptyCommit
         dummy = EmptyCommit().__json__()
         if not self._changeset_cache:
             dummy['source_repo_id'] = self.repo_id
             return json.loads(json.dumps(dummy))
 
         try:
             return json.loads(self._changeset_cache)
         except TypeError:
             return dummy
         except Exception:
             log.error(traceback.format_exc())
             return dummy
 
     @changeset_cache.setter
     def changeset_cache(self, val):
         try:
             self._changeset_cache = json.dumps(val)
         except Exception:
             log.error(traceback.format_exc())
 
     @hybrid_property
     def repo_name(self):
         return self._repo_name
 
     @repo_name.setter
     def repo_name(self, value):
         self._repo_name = value
         self._repo_name_hash = hashlib.sha1(safe_str(value)).hexdigest()
 
     @classmethod
     def normalize_repo_name(cls, repo_name):
         """
         Normalizes os specific repo_name to the format internally stored inside
         database using URL_SEP
 
         :param cls:
         :param repo_name:
         """
         return cls.NAME_SEP.join(repo_name.split(os.sep))
 
     @classmethod
     def get_by_repo_name(cls, repo_name, cache=False, identity_cache=False):
         session = Session()
         q = session.query(cls).filter(cls.repo_name == repo_name)
 
         if cache:
             if identity_cache:
                 val = cls.identity_cache(session, 'repo_name', repo_name)
                 if val:
                     return val
             else:
                 cache_key = "get_repo_by_name_%s" % _hash_key(repo_name)
                 q = q.options(
                     FromCache("sql_cache_short", cache_key))
 
         return q.scalar()
 
     @classmethod
     def get_by_id_or_repo_name(cls, repoid):
         if isinstance(repoid, (int, long)):
             try:
                 repo = cls.get(repoid)
             except ValueError:
                 repo = None
         else:
             repo = cls.get_by_repo_name(repoid)
         return repo
 
     @classmethod
     def get_by_full_path(cls, repo_full_path):
         repo_name = repo_full_path.split(cls.base_path(), 1)[-1]
         repo_name = cls.normalize_repo_name(repo_name)
         return cls.get_by_repo_name(repo_name.strip(URL_SEP))
 
     @classmethod
     def get_repo_forks(cls, repo_id):
         return cls.query().filter(Repository.fork_id == repo_id)
 
     @classmethod
     def base_path(cls):
         """
         Returns base path when all repos are stored
 
         :param cls:
         """
         q = Session().query(RhodeCodeUi)\
             .filter(RhodeCodeUi.ui_key == cls.NAME_SEP)
         q = q.options(FromCache("sql_cache_short", "repository_repo_path"))
         return q.one().ui_value
 
     @classmethod
     def get_all_repos(cls, user_id=Optional(None), group_id=Optional(None),
                       case_insensitive=True, archived=False):
         q = Repository.query()
 
         if not archived:
             q = q.filter(Repository.archived.isnot(true()))
 
         if not isinstance(user_id, Optional):
             q = q.filter(Repository.user_id == user_id)
 
         if not isinstance(group_id, Optional):
             q = q.filter(Repository.group_id == group_id)
 
         if case_insensitive:
             q = q.order_by(func.lower(Repository.repo_name))
         else:
             q = q.order_by(Repository.repo_name)
 
         return q.all()
 
     @property
     def repo_uid(self):
         return '_{}'.format(self.repo_id)
 
     @property
     def forks(self):
         """
         Return forks of this repo
         """
         return Repository.get_repo_forks(self.repo_id)
 
     @property
     def parent(self):
         """
         Returns fork parent
         """
         return self.fork
 
     @property
     def just_name(self):
         return self.repo_name.split(self.NAME_SEP)[-1]
 
     @property
     def groups_with_parents(self):
         groups = []
         if self.group is None:
             return groups
 
         cur_gr = self.group
         groups.insert(0, cur_gr)
         while 1:
             gr = getattr(cur_gr, 'parent_group', None)
             cur_gr = cur_gr.parent_group
             if gr is None:
                 break
             groups.insert(0, gr)
 
         return groups
 
     @property
     def groups_and_repo(self):
         return self.groups_with_parents, self
 
     @LazyProperty
     def repo_path(self):
         """
         Returns base full path for that repository means where it actually
         exists on a filesystem
         """
         q = Session().query(RhodeCodeUi).filter(
             RhodeCodeUi.ui_key == self.NAME_SEP)
         q = q.options(FromCache("sql_cache_short", "repository_repo_path"))
         return q.one().ui_value
 
     @property
     def repo_full_path(self):
         p = [self.repo_path]
         # we need to split the name by / since this is how we store the
         # names in the database, but that eventually needs to be converted
         # into a valid system path
         p += self.repo_name.split(self.NAME_SEP)
         return os.path.join(*map(safe_unicode, p))
 
     @property
     def cache_keys(self):
         """
         Returns associated cache keys for that repo
         """
         invalidation_namespace = CacheKey.REPO_INVALIDATION_NAMESPACE.format(
             repo_id=self.repo_id)
         return CacheKey.query()\
             .filter(CacheKey.cache_args == invalidation_namespace)\
             .order_by(CacheKey.cache_key)\
             .all()
 
     @property
     def cached_diffs_relative_dir(self):
         """
         Return a relative to the repository store path of cached diffs
         used for safe display for users, who shouldn't know the absolute store
         path
         """
         return os.path.join(
             os.path.dirname(self.repo_name),
             self.cached_diffs_dir.split(os.path.sep)[-1])
 
     @property
     def cached_diffs_dir(self):
         path = self.repo_full_path
         return os.path.join(
             os.path.dirname(path),
             '.__shadow_diff_cache_repo_{}'.format(self.repo_id))
 
     def cached_diffs(self):
         diff_cache_dir = self.cached_diffs_dir
         if os.path.isdir(diff_cache_dir):
             return os.listdir(diff_cache_dir)
         return []
 
     def shadow_repos(self):
         shadow_repos_pattern = '.__shadow_repo_{}'.format(self.repo_id)
         return [
             x for x in os.listdir(os.path.dirname(self.repo_full_path))
             if x.startswith(shadow_repos_pattern)]
 
     def get_new_name(self, repo_name):
         """
         returns new full repository name based on assigned group and new new
 
         :param group_name:
         """
         path_prefix = self.group.full_path_splitted if self.group else []
         return self.NAME_SEP.join(path_prefix + [repo_name])
 
     @property
     def _config(self):
         """
         Returns db based config object.
         """
         from rhodecode.lib.utils import make_db_config
         return make_db_config(clear_session=False, repo=self)
 
     def permissions(self, with_admins=True, with_owner=True,
                     expand_from_user_groups=False):
         """
         Permissions for repositories
         """
         _admin_perm = 'repository.admin'
 
         owner_row = []
         if with_owner:
             usr = AttributeDict(self.user.get_dict())
             usr.owner_row = True
             usr.permission = _admin_perm
             usr.permission_id = None
             owner_row.append(usr)
 
         super_admin_ids = []
         super_admin_rows = []
         if with_admins:
             for usr in User.get_all_super_admins():
                 super_admin_ids.append(usr.user_id)
                 # if this admin is also owner, don't double the record
                 if usr.user_id == owner_row[0].user_id:
                     owner_row[0].admin_row = True
                 else:
                     usr = AttributeDict(usr.get_dict())
                     usr.admin_row = True
                     usr.permission = _admin_perm
                     usr.permission_id = None
                     super_admin_rows.append(usr)
 
         q = UserRepoToPerm.query().filter(UserRepoToPerm.repository == self)
         q = q.options(joinedload(UserRepoToPerm.repository),
                       joinedload(UserRepoToPerm.user),
                       joinedload(UserRepoToPerm.permission),)
 
         # get owners and admins and permissions. We do a trick of re-writing
         # objects from sqlalchemy to named-tuples due to sqlalchemy session
         # has a global reference and changing one object propagates to all
         # others. This means if admin is also an owner admin_row that change
         # would propagate to both objects
         perm_rows = []
         for _usr in q.all():
             usr = AttributeDict(_usr.user.get_dict())
             # if this user is also owner/admin, mark as duplicate record
             if usr.user_id == owner_row[0].user_id or usr.user_id in super_admin_ids:
                 usr.duplicate_perm = True
             # also check if this permission is maybe used by branch_permissions
             if _usr.branch_perm_entry:
                 usr.branch_rules = [x.branch_rule_id for x in _usr.branch_perm_entry]
 
             usr.permission = _usr.permission.permission_name
             usr.permission_id = _usr.repo_to_perm_id
             perm_rows.append(usr)
 
         # filter the perm rows by 'default' first and then sort them by
         # admin,write,read,none permissions sorted again alphabetically in
         # each group
         perm_rows = sorted(perm_rows, key=display_user_sort)
 
         user_groups_rows = []
         if expand_from_user_groups:
             for ug in self.permission_user_groups(with_members=True):
                 for user_data in ug.members:
                     user_groups_rows.append(user_data)
 
         return super_admin_rows + owner_row + perm_rows + user_groups_rows
 
     def permission_user_groups(self, with_members=True):
         q = UserGroupRepoToPerm.query()\
             .filter(UserGroupRepoToPerm.repository == self)
         q = q.options(joinedload(UserGroupRepoToPerm.repository),
                       joinedload(UserGroupRepoToPerm.users_group),
                       joinedload(UserGroupRepoToPerm.permission),)
 
         perm_rows = []
         for _user_group in q.all():
             entry = AttributeDict(_user_group.users_group.get_dict())
             entry.permission = _user_group.permission.permission_name
             if with_members:
                 entry.members = [x.user.get_dict()
                                  for x in _user_group.users_group.members]
             perm_rows.append(entry)
 
         perm_rows = sorted(perm_rows, key=display_user_group_sort)
         return perm_rows
 
     def get_api_data(self, include_secrets=False):
         """
         Common function for generating repo api data
 
         :param include_secrets: See :meth:`User.get_api_data`.
 
         """
         # TODO: mikhail: Here there is an anti-pattern, we probably need to
         # move this methods on models level.
         from rhodecode.model.settings import SettingsModel
         from rhodecode.model.repo import RepoModel
 
         repo = self
         _user_id, _time, _reason = self.locked
 
         data = {
             'repo_id': repo.repo_id,
             'repo_name': repo.repo_name,
             'repo_type': repo.repo_type,
             'clone_uri': repo.clone_uri or '',
             'push_uri': repo.push_uri or '',
             'url': RepoModel().get_url(self),
             'private': repo.private,
             'created_on': repo.created_on,
             'description': repo.description_safe,
             'landing_rev': repo.landing_rev,
             'owner': repo.user.username,
             'fork_of': repo.fork.repo_name if repo.fork else None,
             'fork_of_id': repo.fork.repo_id if repo.fork else None,
             'enable_statistics': repo.enable_statistics,
             'enable_locking': repo.enable_locking,
             'enable_downloads': repo.enable_downloads,
             'last_changeset': repo.changeset_cache,
             'locked_by': User.get(_user_id).get_api_data(
                 include_secrets=include_secrets) if _user_id else None,
             'locked_date': time_to_datetime(_time) if _time else None,
             'lock_reason': _reason if _reason else None,
         }
 
         # TODO: mikhail: should be per-repo settings here
         rc_config = SettingsModel().get_all_settings()
         repository_fields = str2bool(
             rc_config.get('rhodecode_repository_fields'))
         if repository_fields:
             for f in self.extra_fields:
                 data[f.field_key_prefixed] = f.field_value
 
         return data
 
     @classmethod
     def lock(cls, repo, user_id, lock_time=None, lock_reason=None):
         if not lock_time:
             lock_time = time.time()
         if not lock_reason:
             lock_reason = cls.LOCK_AUTOMATIC
         repo.locked = [user_id, lock_time, lock_reason]
         Session().add(repo)
         Session().commit()
 
     @classmethod
     def unlock(cls, repo):
         repo.locked = None
         Session().add(repo)
         Session().commit()
 
     @classmethod
     def getlock(cls, repo):
         return repo.locked
 
     def is_user_lock(self, user_id):
         if self.lock[0]:
             lock_user_id = safe_int(self.lock[0])
             user_id = safe_int(user_id)
             # both are ints, and they are equal
             return all([lock_user_id, user_id]) and lock_user_id == user_id
 
         return False
 
     def get_locking_state(self, action, user_id, only_when_enabled=True):
         """
         Checks locking on this repository, if locking is enabled and lock is
         present returns a tuple of make_lock, locked, locked_by.
         make_lock can have 3 states None (do nothing) True, make lock
         False release lock, This value is later propagated to hooks, which
         do the locking. Think about this as signals passed to hooks what to do.
 
         """
         # TODO: johbo: This is part of the business logic and should be moved
         # into the RepositoryModel.
 
         if action not in ('push', 'pull'):
             raise ValueError("Invalid action value: %s" % repr(action))
 
         # defines if locked error should be thrown to user
         currently_locked = False
         # defines if new lock should be made, tri-state
         make_lock = None
         repo = self
         user = User.get(user_id)
 
         lock_info = repo.locked
 
         if repo and (repo.enable_locking or not only_when_enabled):
             if action == 'push':
                 # check if it's already locked !, if it is compare users
                 locked_by_user_id = lock_info[0]
                 if user.user_id == locked_by_user_id:
                     log.debug(
                         'Got `push` action from user %s, now unlocking', user)
                     # unlock if we have push from user who locked
                     make_lock = False
                 else:
                     # we're not the same user who locked, ban with
                     # code defined in settings (default is 423 HTTP Locked) !
                     log.debug('Repo %s is currently locked by %s', repo, user)
                     currently_locked = True
             elif action == 'pull':
                 # [0] user [1] date
                 if lock_info[0] and lock_info[1]:
                     log.debug('Repo %s is currently locked by %s', repo, user)
                     currently_locked = True
                 else:
                     log.debug('Setting lock on repo %s by %s', repo, user)
                     make_lock = True
 
         else:
             log.debug('Repository %s do not have locking enabled', repo)
 
         log.debug('FINAL locking values make_lock:%s,locked:%s,locked_by:%s',
                   make_lock, currently_locked, lock_info)
 
         from rhodecode.lib.auth import HasRepoPermissionAny
         perm_check = HasRepoPermissionAny('repository.write', 'repository.admin')
         if make_lock and not perm_check(repo_name=repo.repo_name, user=user):
             # if we don't have at least write permission we cannot make a lock
             log.debug('lock state reset back to FALSE due to lack '
                       'of at least read permission')
             make_lock = False
 
         return make_lock, currently_locked, lock_info
 
     @property
     def last_commit_cache_update_diff(self):
         return time.time() - (safe_int(self.changeset_cache.get('updated_on')) or 0)
 
     @property
     def last_commit_change(self):
         from rhodecode.lib.vcs.utils.helpers import parse_datetime
         empty_date = datetime.datetime.fromtimestamp(0)
         date_latest = self.changeset_cache.get('date', empty_date)
         try:
             return parse_datetime(date_latest)
         except Exception:
             return empty_date
 
     @property
     def last_db_change(self):
         return self.updated_on
 
     @property
     def clone_uri_hidden(self):
         clone_uri = self.clone_uri
         if clone_uri:
             import urlobject
             url_obj = urlobject.URLObject(cleaned_uri(clone_uri))
             if url_obj.password:
                 clone_uri = url_obj.with_password('*****')
         return clone_uri
 
     @property
     def push_uri_hidden(self):
         push_uri = self.push_uri
         if push_uri:
             import urlobject
             url_obj = urlobject.URLObject(cleaned_uri(push_uri))
             if url_obj.password:
                 push_uri = url_obj.with_password('*****')
         return push_uri
 
     def clone_url(self, **override):
         from rhodecode.model.settings import SettingsModel
 
         uri_tmpl = None
         if 'with_id' in override:
             uri_tmpl = self.DEFAULT_CLONE_URI_ID
             del override['with_id']
 
         if 'uri_tmpl' in override:
             uri_tmpl = override['uri_tmpl']
             del override['uri_tmpl']
 
         ssh = False
         if 'ssh' in override:
             ssh = True
             del override['ssh']
 
         # we didn't override our tmpl from **overrides
         request = get_current_request()
         if not uri_tmpl:
             if hasattr(request, 'call_context') and hasattr(request.call_context, 'rc_config'):
                 rc_config = request.call_context.rc_config
             else:
                 rc_config = SettingsModel().get_all_settings(cache=True)
             if ssh:
                 uri_tmpl = rc_config.get(
                     'rhodecode_clone_uri_ssh_tmpl') or self.DEFAULT_CLONE_URI_SSH
             else:
                 uri_tmpl = rc_config.get(
                     'rhodecode_clone_uri_tmpl') or self.DEFAULT_CLONE_URI
 
         return get_clone_url(request=request,
                              uri_tmpl=uri_tmpl,
                              repo_name=self.repo_name,
                              repo_id=self.repo_id, **override)
 
     def set_state(self, state):
         self.repo_state = state
         Session().add(self)
     #==========================================================================
     # SCM PROPERTIES
     #==========================================================================
 
     def get_commit(self, commit_id=None, commit_idx=None, pre_load=None):
         return get_commit_safe(
             self.scm_instance(), commit_id, commit_idx, pre_load=pre_load)
 
     def get_changeset(self, rev=None, pre_load=None):
         warnings.warn("Use get_commit", DeprecationWarning)
         commit_id = None
         commit_idx = None
         if isinstance(rev, compat.string_types):
             commit_id = rev
         else:
             commit_idx = rev
         return self.get_commit(commit_id=commit_id, commit_idx=commit_idx,
                                pre_load=pre_load)
 
     def get_landing_commit(self):
         """
         Returns landing commit, or if that doesn't exist returns the tip
         """
         _rev_type, _rev = self.landing_rev
         commit = self.get_commit(_rev)
         if isinstance(commit, EmptyCommit):
             return self.get_commit()
         return commit
 
     def update_commit_cache(self, cs_cache=None, config=None):
         """
         Update cache of last commit for repository, keys should be::
 
             source_repo_id
             short_id
             raw_id
             revision
             parents
             message
             date
             author
             updated_on
 
         """
         from rhodecode.lib.vcs.backends.base import BaseChangeset
         if cs_cache is None:
             # use no-cache version here
             scm_repo = self.scm_instance(cache=False, config=config)
 
             empty = scm_repo is None or scm_repo.is_empty()
             if not empty:
                 cs_cache = scm_repo.get_commit(
                     pre_load=["author", "date", "message", "parents", "branch"])
             else:
                 cs_cache = EmptyCommit()
 
         if isinstance(cs_cache, BaseChangeset):
             cs_cache = cs_cache.__json__()
 
         def is_outdated(new_cs_cache):
             if (new_cs_cache['raw_id'] != self.changeset_cache['raw_id'] or
                 new_cs_cache['revision'] != self.changeset_cache['revision']):
                 return True
             return False
 
         # check if we have maybe already latest cached revision
         if is_outdated(cs_cache) or not self.changeset_cache:
             _default = datetime.datetime.utcnow()
             last_change = cs_cache.get('date') or _default
             # we check if last update is newer than the new value
             # if yes, we use the current timestamp instead. Imagine you get
             # old commit pushed 1y ago, we'd set last update 1y to ago.
             last_change_timestamp = datetime_to_time(last_change)
             current_timestamp = datetime_to_time(last_change)
             if last_change_timestamp > current_timestamp:
                 cs_cache['date'] = _default
 
             cs_cache['updated_on'] = time.time()
             self.changeset_cache = cs_cache
             Session().add(self)
             Session().commit()
 
             log.debug('updated repo %s with new commit cache %s',
                       self.repo_name, cs_cache)
         else:
             cs_cache = self.changeset_cache
             cs_cache['updated_on'] = time.time()
             self.changeset_cache = cs_cache
             Session().add(self)
             Session().commit()
 
             log.debug('Skipping update_commit_cache for repo:`%s` '
                       'commit already with latest changes', self.repo_name)
 
     @property
     def tip(self):
         return self.get_commit('tip')
 
     @property
     def author(self):
         return self.tip.author
 
     @property
     def last_change(self):
         return self.scm_instance().last_change
 
     def get_comments(self, revisions=None):
         """
         Returns comments for this repository grouped by revisions
 
         :param revisions: filter query by revisions only
         """
         cmts = ChangesetComment.query()\
             .filter(ChangesetComment.repo == self)
         if revisions:
             cmts = cmts.filter(ChangesetComment.revision.in_(revisions))
         grouped = collections.defaultdict(list)
         for cmt in cmts.all():
             grouped[cmt.revision].append(cmt)
         return grouped
 
     def statuses(self, revisions=None):
         """
         Returns statuses for this repository
 
         :param revisions: list of revisions to get statuses for
         """
         statuses = ChangesetStatus.query()\
             .filter(ChangesetStatus.repo == self)\
             .filter(ChangesetStatus.version == 0)
 
         if revisions:
             # Try doing the filtering in chunks to avoid hitting limits
             size = 500
             status_results = []
             for chunk in xrange(0, len(revisions), size):
                 status_results += statuses.filter(
                     ChangesetStatus.revision.in_(
                         revisions[chunk: chunk+size])
                 ).all()
         else:
             status_results = statuses.all()
 
         grouped = {}
 
         # maybe we have open new pullrequest without a status?
         stat = ChangesetStatus.STATUS_UNDER_REVIEW
         status_lbl = ChangesetStatus.get_status_lbl(stat)
         for pr in PullRequest.query().filter(PullRequest.source_repo == self).all():
             for rev in pr.revisions:
                 pr_id = pr.pull_request_id
                 pr_repo = pr.target_repo.repo_name
                 grouped[rev] = [stat, status_lbl, pr_id, pr_repo]
 
         for stat in status_results:
             pr_id = pr_repo = None
             if stat.pull_request:
                 pr_id = stat.pull_request.pull_request_id
                 pr_repo = stat.pull_request.target_repo.repo_name
             grouped[stat.revision] = [str(stat.status), stat.status_lbl,
                                       pr_id, pr_repo]
         return grouped
 
     # ==========================================================================
     # SCM CACHE INSTANCE
     # ==========================================================================
 
     def scm_instance(self, **kwargs):
         import rhodecode
 
         # Passing a config will not hit the cache currently only used
         # for repo2dbmapper
         config = kwargs.pop('config', None)
         cache = kwargs.pop('cache', None)
         vcs_full_cache = kwargs.pop('vcs_full_cache', None)
         if vcs_full_cache is not None:
             # allows override global config
             full_cache = vcs_full_cache
         else:
             full_cache = str2bool(rhodecode.CONFIG.get('vcs_full_cache'))
         # if cache is NOT defined use default global, else we have a full
         # control over cache behaviour
         if cache is None and full_cache and not config:
             log.debug('Initializing pure cached instance for %s', self.repo_path)
             return self._get_instance_cached()
 
         # cache here is sent to the "vcs server"
         return self._get_instance(cache=bool(cache), config=config)
 
     def _get_instance_cached(self):
         from rhodecode.lib import rc_cache
 
         cache_namespace_uid = 'cache_repo_instance.{}'.format(self.repo_id)
         invalidation_namespace = CacheKey.REPO_INVALIDATION_NAMESPACE.format(
             repo_id=self.repo_id)
         region = rc_cache.get_or_create_region('cache_repo_longterm', cache_namespace_uid)
 
         @region.conditional_cache_on_arguments(namespace=cache_namespace_uid)
         def get_instance_cached(repo_id, context_id, _cache_state_uid):
             return self._get_instance(repo_state_uid=_cache_state_uid)
 
         # we must use thread scoped cache here,
         # because each thread of gevent needs it's own not shared connection and cache
         # we also alter `args` so the cache key is individual for every green thread.
         inv_context_manager = rc_cache.InvalidationContext(
             uid=cache_namespace_uid, invalidation_namespace=invalidation_namespace,
             thread_scoped=True)
         with inv_context_manager as invalidation_context:
             cache_state_uid = invalidation_context.cache_data['cache_state_uid']
             args = (self.repo_id, inv_context_manager.cache_key, cache_state_uid)
 
             # re-compute and store cache if we get invalidate signal
             if invalidation_context.should_invalidate():
                 instance = get_instance_cached.refresh(*args)
             else:
                 instance = get_instance_cached(*args)
 
             log.debug('Repo instance fetched in %.4fs', inv_context_manager.compute_time)
             return instance
 
     def _get_instance(self, cache=True, config=None, repo_state_uid=None):
         log.debug('Initializing %s instance `%s` with cache flag set to: %s',
                   self.repo_type, self.repo_path, cache)
         config = config or self._config
         custom_wire = {
             'cache': cache,  # controls the vcs.remote cache
             'repo_state_uid': repo_state_uid
         }
         repo = get_vcs_instance(
             repo_path=safe_str(self.repo_full_path),
             config=config,
             with_wire=custom_wire,
             create=False,
             _vcs_alias=self.repo_type)
         if repo is not None:
             repo.count()  # cache rebuild
         return repo
 
     def get_shadow_repository_path(self, workspace_id):
         from rhodecode.lib.vcs.backends.base import BaseRepository
         shadow_repo_path = BaseRepository._get_shadow_repository_path(
             self.repo_full_path, self.repo_id, workspace_id)
         return shadow_repo_path
 
     def __json__(self):
         return {'landing_rev': self.landing_rev}
 
     def get_dict(self):
 
         # Since we transformed `repo_name` to a hybrid property, we need to
         # keep compatibility with the code which uses `repo_name` field.
 
         result = super(Repository, self).get_dict()
         result['repo_name'] = result.pop('_repo_name', None)
         return result
 
 
 class RepoGroup(Base, BaseModel):
     __tablename__ = 'groups'
     __table_args__ = (
         UniqueConstraint('group_name', 'group_parent_id'),
         base_table_args,
     )
     __mapper_args__ = {'order_by': 'group_name'}
 
     CHOICES_SEPARATOR = '/'  # used to generate select2 choices for nested groups
 
     group_id = Column("group_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     _group_name = Column("group_name", String(255), nullable=False, unique=True, default=None)
     group_name_hash = Column("repo_group_name_hash", String(1024), nullable=False, unique=False)
     group_parent_id = Column("group_parent_id", Integer(), ForeignKey('groups.group_id'), nullable=True, unique=None, default=None)
     group_description = Column("group_description", String(10000), nullable=True, unique=None, default=None)
     enable_locking = Column("enable_locking", Boolean(), nullable=False, unique=None, default=False)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=False, default=None)
     created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
     updated_on = Column('updated_on', DateTime(timezone=False), nullable=True, unique=None, default=datetime.datetime.now)
     personal = Column('personal', Boolean(), nullable=True, unique=None, default=None)
     _changeset_cache = Column(
         "changeset_cache", LargeBinary(), nullable=True)  # JSON data
 
     repo_group_to_perm = relationship('UserRepoGroupToPerm', cascade='all', order_by='UserRepoGroupToPerm.group_to_perm_id')
     users_group_to_perm = relationship('UserGroupRepoGroupToPerm', cascade='all')
     parent_group = relationship('RepoGroup', remote_side=group_id)
     user = relationship('User')
-    integrations = relationship('Integration', cascade="all, delete, delete-orphan")
+    integrations = relationship('Integration', cascade="all, delete-orphan")
 
     def __init__(self, group_name='', parent_group=None):
         self.group_name = group_name
         self.parent_group = parent_group
 
     def __unicode__(self):
         return u"<%s('id:%s:%s')>" % (
             self.__class__.__name__, self.group_id, self.group_name)
 
     @hybrid_property
     def group_name(self):
         return self._group_name
 
     @group_name.setter
     def group_name(self, value):
         self._group_name = value
         self.group_name_hash = self.hash_repo_group_name(value)
 
     @hybrid_property
     def changeset_cache(self):
         from rhodecode.lib.vcs.backends.base import EmptyCommit
         dummy = EmptyCommit().__json__()
         if not self._changeset_cache:
             dummy['source_repo_id'] = ''
             return json.loads(json.dumps(dummy))
 
         try:
             return json.loads(self._changeset_cache)
         except TypeError:
             return dummy
         except Exception:
             log.error(traceback.format_exc())
             return dummy
 
     @changeset_cache.setter
     def changeset_cache(self, val):
         try:
             self._changeset_cache = json.dumps(val)
         except Exception:
             log.error(traceback.format_exc())
 
     @validates('group_parent_id')
     def validate_group_parent_id(self, key, val):
         """
         Check cycle references for a parent group to self
         """
         if self.group_id and val:
             assert val != self.group_id
 
         return val
 
     @hybrid_property
     def description_safe(self):
         from rhodecode.lib import helpers as h
         return h.escape(self.group_description)
 
     @classmethod
     def hash_repo_group_name(cls, repo_group_name):
         val = remove_formatting(repo_group_name)
         val = safe_str(val).lower()
         chars = []
         for c in val:
             if c not in string.ascii_letters:
                 c = str(ord(c))
             chars.append(c)
 
         return ''.join(chars)
 
     @classmethod
     def _generate_choice(cls, repo_group):
         from webhelpers.html import literal as _literal
         _name = lambda k: _literal(cls.CHOICES_SEPARATOR.join(k))
         return repo_group.group_id, _name(repo_group.full_path_splitted)
 
     @classmethod
     def groups_choices(cls, groups=None, show_empty_group=True):
         if not groups:
             groups = cls.query().all()
 
         repo_groups = []
         if show_empty_group:
             repo_groups = [(-1, u'-- %s --' % _('No parent'))]
 
         repo_groups.extend([cls._generate_choice(x) for x in groups])
 
         repo_groups = sorted(
             repo_groups, key=lambda t: t[1].split(cls.CHOICES_SEPARATOR)[0])
         return repo_groups
 
     @classmethod
     def url_sep(cls):
         return URL_SEP
 
     @classmethod
     def get_by_group_name(cls, group_name, cache=False, case_insensitive=False):
         if case_insensitive:
             gr = cls.query().filter(func.lower(cls.group_name)
                                     == func.lower(group_name))
         else:
             gr = cls.query().filter(cls.group_name == group_name)
         if cache:
             name_key = _hash_key(group_name)
             gr = gr.options(
                 FromCache("sql_cache_short", "get_group_%s" % name_key))
         return gr.scalar()
 
     @classmethod
     def get_user_personal_repo_group(cls, user_id):
         user = User.get(user_id)
         if user.username == User.DEFAULT_USER:
             return None
 
         return cls.query()\
             .filter(cls.personal == true()) \
             .filter(cls.user == user) \
             .order_by(cls.group_id.asc()) \
             .first()
 
     @classmethod
     def get_all_repo_groups(cls, user_id=Optional(None), group_id=Optional(None),
                             case_insensitive=True):
         q = RepoGroup.query()
 
         if not isinstance(user_id, Optional):
             q = q.filter(RepoGroup.user_id == user_id)
 
         if not isinstance(group_id, Optional):
             q = q.filter(RepoGroup.group_parent_id == group_id)
 
         if case_insensitive:
             q = q.order_by(func.lower(RepoGroup.group_name))
         else:
             q = q.order_by(RepoGroup.group_name)
         return q.all()
 
     @property
     def parents(self, parents_recursion_limit = 10):
         groups = []
         if self.parent_group is None:
             return groups
         cur_gr = self.parent_group
         groups.insert(0, cur_gr)
         cnt = 0
         while 1:
             cnt += 1
             gr = getattr(cur_gr, 'parent_group', None)
             cur_gr = cur_gr.parent_group
             if gr is None:
                 break
             if cnt == parents_recursion_limit:
                 # this will prevent accidental infinit loops
                 log.error('more than %s parents found for group %s, stopping '
                           'recursive parent fetching', parents_recursion_limit, self)
                 break
 
             groups.insert(0, gr)
         return groups
 
     @property
     def last_commit_cache_update_diff(self):
         return time.time() - (safe_int(self.changeset_cache.get('updated_on')) or 0)
 
     @property
     def last_commit_change(self):
         from rhodecode.lib.vcs.utils.helpers import parse_datetime
         empty_date = datetime.datetime.fromtimestamp(0)
         date_latest = self.changeset_cache.get('date', empty_date)
         try:
             return parse_datetime(date_latest)
         except Exception:
             return empty_date
 
     @property
     def last_db_change(self):
         return self.updated_on
 
     @property
     def children(self):
         return RepoGroup.query().filter(RepoGroup.parent_group == self)
 
     @property
     def name(self):
         return self.group_name.split(RepoGroup.url_sep())[-1]
 
     @property
     def full_path(self):
         return self.group_name
 
     @property
     def full_path_splitted(self):
         return self.group_name.split(RepoGroup.url_sep())
 
     @property
     def repositories(self):
         return Repository.query()\
                 .filter(Repository.group == self)\
                 .order_by(Repository.repo_name)
 
     @property
     def repositories_recursive_count(self):
         cnt = self.repositories.count()
 
         def children_count(group):
             cnt = 0
             for child in group.children:
                 cnt += child.repositories.count()
                 cnt += children_count(child)
             return cnt
 
         return cnt + children_count(self)
 
     def _recursive_objects(self, include_repos=True, include_groups=True):
         all_ = []
 
         def _get_members(root_gr):
             if include_repos:
                 for r in root_gr.repositories:
                     all_.append(r)
             childs = root_gr.children.all()
             if childs:
                 for gr in childs:
                     if include_groups:
                         all_.append(gr)
                     _get_members(gr)
 
         root_group = []
         if include_groups:
             root_group = [self]
 
         _get_members(self)
         return root_group + all_
 
     def recursive_groups_and_repos(self):
         """
         Recursive return all groups, with repositories in those groups
         """
         return self._recursive_objects()
 
     def recursive_groups(self):
         """
         Returns all children groups for this group including children of children
         """
         return self._recursive_objects(include_repos=False)
 
     def recursive_repos(self):
         """
         Returns all children repositories for this group
         """
         return self._recursive_objects(include_groups=False)
 
     def get_new_name(self, group_name):
         """
         returns new full group name based on parent and new name
 
         :param group_name:
         """
         path_prefix = (self.parent_group.full_path_splitted if
                        self.parent_group else [])
         return RepoGroup.url_sep().join(path_prefix + [group_name])
 
     def update_commit_cache(self, config=None):
         """
         Update cache of last changeset for newest repository inside this group, keys should be::
 
             source_repo_id
             short_id
             raw_id
             revision
             parents
             message
             date
             author
 
         """
         from rhodecode.lib.vcs.utils.helpers import parse_datetime
 
         def repo_groups_and_repos():
             all_entries = OrderedDefaultDict(list)
 
             def _get_members(root_gr, pos=0):
 
                 for repo in root_gr.repositories:
                     all_entries[root_gr].append(repo)
 
                 # fill in all parent positions
                 for parent_group in root_gr.parents:
                     all_entries[parent_group].extend(all_entries[root_gr])
 
                 children_groups = root_gr.children.all()
                 if children_groups:
                     for cnt, gr in enumerate(children_groups, 1):
                         _get_members(gr, pos=pos+cnt)
 
             _get_members(root_gr=self)
             return all_entries
 
         empty_date = datetime.datetime.fromtimestamp(0)
         for repo_group, repos in repo_groups_and_repos().items():
 
             latest_repo_cs_cache = {}
             for repo in repos:
                 repo_cs_cache = repo.changeset_cache
                 date_latest = latest_repo_cs_cache.get('date', empty_date)
                 date_current = repo_cs_cache.get('date', empty_date)
                 current_timestamp = datetime_to_time(parse_datetime(date_latest))
                 if current_timestamp < datetime_to_time(parse_datetime(date_current)):
                     latest_repo_cs_cache = repo_cs_cache
                     latest_repo_cs_cache['source_repo_id'] = repo.repo_id
 
             latest_repo_cs_cache['updated_on'] = time.time()
             repo_group.changeset_cache = latest_repo_cs_cache
             Session().add(repo_group)
             Session().commit()
 
             log.debug('updated repo group %s with new commit cache %s',
                       repo_group.group_name, latest_repo_cs_cache)
 
     def permissions(self, with_admins=True, with_owner=True,
                     expand_from_user_groups=False):
         """
         Permissions for repository groups
         """
         _admin_perm = 'group.admin'
 
         owner_row = []
         if with_owner:
             usr = AttributeDict(self.user.get_dict())
             usr.owner_row = True
             usr.permission = _admin_perm
             owner_row.append(usr)
 
         super_admin_ids = []
         super_admin_rows = []
         if with_admins:
             for usr in User.get_all_super_admins():
                 super_admin_ids.append(usr.user_id)
                 # if this admin is also owner, don't double the record
                 if usr.user_id == owner_row[0].user_id:
                     owner_row[0].admin_row = True
                 else:
                     usr = AttributeDict(usr.get_dict())
                     usr.admin_row = True
                     usr.permission = _admin_perm
                     super_admin_rows.append(usr)
 
         q = UserRepoGroupToPerm.query().filter(UserRepoGroupToPerm.group == self)
         q = q.options(joinedload(UserRepoGroupToPerm.group),
                       joinedload(UserRepoGroupToPerm.user),
                       joinedload(UserRepoGroupToPerm.permission),)
 
         # get owners and admins and permissions. We do a trick of re-writing
         # objects from sqlalchemy to named-tuples due to sqlalchemy session
         # has a global reference and changing one object propagates to all
         # others. This means if admin is also an owner admin_row that change
         # would propagate to both objects
         perm_rows = []
         for _usr in q.all():
             usr = AttributeDict(_usr.user.get_dict())
             # if this user is also owner/admin, mark as duplicate record
             if usr.user_id == owner_row[0].user_id or usr.user_id in super_admin_ids:
                 usr.duplicate_perm = True
             usr.permission = _usr.permission.permission_name
             perm_rows.append(usr)
 
         # filter the perm rows by 'default' first and then sort them by
         # admin,write,read,none permissions sorted again alphabetically in
         # each group
         perm_rows = sorted(perm_rows, key=display_user_sort)
 
         user_groups_rows = []
         if expand_from_user_groups:
             for ug in self.permission_user_groups(with_members=True):
                 for user_data in ug.members:
                     user_groups_rows.append(user_data)
 
         return super_admin_rows + owner_row + perm_rows + user_groups_rows
 
     def permission_user_groups(self, with_members=False):
         q = UserGroupRepoGroupToPerm.query()\
             .filter(UserGroupRepoGroupToPerm.group == self)
         q = q.options(joinedload(UserGroupRepoGroupToPerm.group),
                       joinedload(UserGroupRepoGroupToPerm.users_group),
                       joinedload(UserGroupRepoGroupToPerm.permission),)
 
         perm_rows = []
         for _user_group in q.all():
             entry = AttributeDict(_user_group.users_group.get_dict())
             entry.permission = _user_group.permission.permission_name
             if with_members:
                 entry.members = [x.user.get_dict()
                                  for x in _user_group.users_group.members]
             perm_rows.append(entry)
 
         perm_rows = sorted(perm_rows, key=display_user_group_sort)
         return perm_rows
 
     def get_api_data(self):
         """
         Common function for generating api data
 
         """
         group = self
         data = {
             'group_id': group.group_id,
             'group_name': group.group_name,
             'group_description': group.description_safe,
             'parent_group': group.parent_group.group_name if group.parent_group else None,
             'repositories': [x.repo_name for x in group.repositories],
             'owner': group.user.username,
         }
         return data
 
     def get_dict(self):
         # Since we transformed `group_name` to a hybrid property, we need to
         # keep compatibility with the code which uses `group_name` field.
         result = super(RepoGroup, self).get_dict()
         result['group_name'] = result.pop('_group_name', None)
         return result
 
 
 class Permission(Base, BaseModel):
     __tablename__ = 'permissions'
     __table_args__ = (
         Index('p_perm_name_idx', 'permission_name'),
         base_table_args,
     )
 
     PERMS = [
         ('hg.admin', _('RhodeCode Super Administrator')),
 
         ('repository.none', _('Repository no access')),
         ('repository.read', _('Repository read access')),
         ('repository.write', _('Repository write access')),
         ('repository.admin', _('Repository admin access')),
 
         ('group.none', _('Repository group no access')),
         ('group.read', _('Repository group read access')),
         ('group.write', _('Repository group write access')),
         ('group.admin', _('Repository group admin access')),
 
         ('usergroup.none', _('User group no access')),
         ('usergroup.read', _('User group read access')),
         ('usergroup.write', _('User group write access')),
         ('usergroup.admin', _('User group admin access')),
 
         ('branch.none', _('Branch no permissions')),
         ('branch.merge', _('Branch access by web merge')),
         ('branch.push', _('Branch access by push')),
         ('branch.push_force', _('Branch access by push with force')),
 
         ('hg.repogroup.create.false', _('Repository Group creation disabled')),
         ('hg.repogroup.create.true', _('Repository Group creation enabled')),
 
         ('hg.usergroup.create.false', _('User Group creation disabled')),
         ('hg.usergroup.create.true', _('User Group creation enabled')),
 
         ('hg.create.none', _('Repository creation disabled')),
         ('hg.create.repository', _('Repository creation enabled')),
         ('hg.create.write_on_repogroup.true', _('Repository creation enabled with write permission to a repository group')),
         ('hg.create.write_on_repogroup.false', _('Repository creation disabled with write permission to a repository group')),
 
         ('hg.fork.none', _('Repository forking disabled')),
         ('hg.fork.repository', _('Repository forking enabled')),
 
         ('hg.register.none', _('Registration disabled')),
         ('hg.register.manual_activate', _('User Registration with manual account activation')),
         ('hg.register.auto_activate', _('User Registration with automatic account activation')),
 
         ('hg.password_reset.enabled', _('Password reset enabled')),
         ('hg.password_reset.hidden', _('Password reset hidden')),
         ('hg.password_reset.disabled', _('Password reset disabled')),
 
         ('hg.extern_activate.manual', _('Manual activation of external account')),
         ('hg.extern_activate.auto', _('Automatic activation of external account')),
 
         ('hg.inherit_default_perms.false', _('Inherit object permissions from default user disabled')),
         ('hg.inherit_default_perms.true', _('Inherit object permissions from default user enabled')),
     ]
 
     # definition of system default permissions for DEFAULT user, created on
     # system setup
     DEFAULT_USER_PERMISSIONS = [
         # object perms
         'repository.read',
         'group.read',
         'usergroup.read',
         # branch, for backward compat we need same value as before so forced pushed
         'branch.push_force',
         # global
         'hg.create.repository',
         'hg.repogroup.create.false',
         'hg.usergroup.create.false',
         'hg.create.write_on_repogroup.true',
         'hg.fork.repository',
         'hg.register.manual_activate',
         'hg.password_reset.enabled',
         'hg.extern_activate.auto',
         'hg.inherit_default_perms.true',
     ]
 
     # defines which permissions are more important higher the more important
     # Weight defines which permissions are more important.
     # The higher number the more important.
     PERM_WEIGHTS = {
         'repository.none': 0,
         'repository.read': 1,
         'repository.write': 3,
         'repository.admin': 4,
 
         'group.none': 0,
         'group.read': 1,
         'group.write': 3,
         'group.admin': 4,
 
         'usergroup.none': 0,
         'usergroup.read': 1,
         'usergroup.write': 3,
         'usergroup.admin': 4,
 
         'branch.none': 0,
         'branch.merge': 1,
         'branch.push': 3,
         'branch.push_force': 4,
 
         'hg.repogroup.create.false': 0,
         'hg.repogroup.create.true': 1,
 
         'hg.usergroup.create.false': 0,
         'hg.usergroup.create.true': 1,
 
         'hg.fork.none': 0,
         'hg.fork.repository': 1,
         'hg.create.none': 0,
         'hg.create.repository': 1
     }
 
     permission_id = Column("permission_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     permission_name = Column("permission_name", String(255), nullable=True, unique=None, default=None)
     permission_longname = Column("permission_longname", String(255), nullable=True, unique=None, default=None)
 
     def __unicode__(self):
         return u"<%s('%s:%s')>" % (
             self.__class__.__name__, self.permission_id, self.permission_name
         )
 
     @classmethod
     def get_by_key(cls, key):
         return cls.query().filter(cls.permission_name == key).scalar()
 
     @classmethod
     def get_default_repo_perms(cls, user_id, repo_id=None):
         q = Session().query(UserRepoToPerm, Repository, Permission)\
             .join((Permission, UserRepoToPerm.permission_id == Permission.permission_id))\
             .join((Repository, UserRepoToPerm.repository_id == Repository.repo_id))\
             .filter(UserRepoToPerm.user_id == user_id)
         if repo_id:
             q = q.filter(UserRepoToPerm.repository_id == repo_id)
         return q.all()
 
     @classmethod
     def get_default_repo_branch_perms(cls, user_id, repo_id=None):
         q = Session().query(UserToRepoBranchPermission, UserRepoToPerm, Permission) \
             .join(
                 Permission,
                 UserToRepoBranchPermission.permission_id == Permission.permission_id) \
             .join(
                 UserRepoToPerm,
                 UserToRepoBranchPermission.rule_to_perm_id == UserRepoToPerm.repo_to_perm_id) \
             .filter(UserRepoToPerm.user_id == user_id)
 
         if repo_id:
             q = q.filter(UserToRepoBranchPermission.repository_id == repo_id)
         return q.order_by(UserToRepoBranchPermission.rule_order).all()
 
     @classmethod
     def get_default_repo_perms_from_user_group(cls, user_id, repo_id=None):
         q = Session().query(UserGroupRepoToPerm, Repository, Permission)\
             .join(
                 Permission,
                 UserGroupRepoToPerm.permission_id == Permission.permission_id)\
             .join(
                 Repository,
                 UserGroupRepoToPerm.repository_id == Repository.repo_id)\
             .join(
                 UserGroup,
                 UserGroupRepoToPerm.users_group_id ==
                 UserGroup.users_group_id)\
             .join(
                 UserGroupMember,
                 UserGroupRepoToPerm.users_group_id ==
                 UserGroupMember.users_group_id)\
             .filter(
                 UserGroupMember.user_id == user_id,
                 UserGroup.users_group_active == true())
         if repo_id:
             q = q.filter(UserGroupRepoToPerm.repository_id == repo_id)
         return q.all()
 
     @classmethod
     def get_default_repo_branch_perms_from_user_group(cls, user_id, repo_id=None):
         q = Session().query(UserGroupToRepoBranchPermission, UserGroupRepoToPerm, Permission) \
             .join(
                 Permission,
                 UserGroupToRepoBranchPermission.permission_id == Permission.permission_id) \
             .join(
                 UserGroupRepoToPerm,
                 UserGroupToRepoBranchPermission.rule_to_perm_id == UserGroupRepoToPerm.users_group_to_perm_id) \
             .join(
                 UserGroup,
                 UserGroupRepoToPerm.users_group_id == UserGroup.users_group_id) \
             .join(
                 UserGroupMember,
                 UserGroupRepoToPerm.users_group_id == UserGroupMember.users_group_id) \
             .filter(
                 UserGroupMember.user_id == user_id,
                 UserGroup.users_group_active == true())
 
         if repo_id:
             q = q.filter(UserGroupToRepoBranchPermission.repository_id == repo_id)
         return q.order_by(UserGroupToRepoBranchPermission.rule_order).all()
 
     @classmethod
     def get_default_group_perms(cls, user_id, repo_group_id=None):
         q = Session().query(UserRepoGroupToPerm, RepoGroup, Permission)\
             .join(
                 Permission,
                 UserRepoGroupToPerm.permission_id == Permission.permission_id)\
             .join(
                 RepoGroup,
                 UserRepoGroupToPerm.group_id == RepoGroup.group_id)\
             .filter(UserRepoGroupToPerm.user_id == user_id)
         if repo_group_id:
             q = q.filter(UserRepoGroupToPerm.group_id == repo_group_id)
         return q.all()
 
     @classmethod
     def get_default_group_perms_from_user_group(
             cls, user_id, repo_group_id=None):
         q = Session().query(UserGroupRepoGroupToPerm, RepoGroup, Permission)\
             .join(
                 Permission,
                 UserGroupRepoGroupToPerm.permission_id ==
                 Permission.permission_id)\
             .join(
                 RepoGroup,
                 UserGroupRepoGroupToPerm.group_id == RepoGroup.group_id)\
             .join(
                 UserGroup,
                 UserGroupRepoGroupToPerm.users_group_id ==
                 UserGroup.users_group_id)\
             .join(
                 UserGroupMember,
                 UserGroupRepoGroupToPerm.users_group_id ==
                 UserGroupMember.users_group_id)\
             .filter(
                 UserGroupMember.user_id == user_id,
                 UserGroup.users_group_active == true())
         if repo_group_id:
             q = q.filter(UserGroupRepoGroupToPerm.group_id == repo_group_id)
         return q.all()
 
     @classmethod
     def get_default_user_group_perms(cls, user_id, user_group_id=None):
         q = Session().query(UserUserGroupToPerm, UserGroup, Permission)\
             .join((Permission, UserUserGroupToPerm.permission_id == Permission.permission_id))\
             .join((UserGroup, UserUserGroupToPerm.user_group_id == UserGroup.users_group_id))\
             .filter(UserUserGroupToPerm.user_id == user_id)
         if user_group_id:
             q = q.filter(UserUserGroupToPerm.user_group_id == user_group_id)
         return q.all()
 
     @classmethod
     def get_default_user_group_perms_from_user_group(
             cls, user_id, user_group_id=None):
         TargetUserGroup = aliased(UserGroup, name='target_user_group')
         q = Session().query(UserGroupUserGroupToPerm, UserGroup, Permission)\
             .join(
                 Permission,
                 UserGroupUserGroupToPerm.permission_id ==
                 Permission.permission_id)\
             .join(
                 TargetUserGroup,
                 UserGroupUserGroupToPerm.target_user_group_id ==
                 TargetUserGroup.users_group_id)\
             .join(
                 UserGroup,
                 UserGroupUserGroupToPerm.user_group_id ==
                 UserGroup.users_group_id)\
             .join(
                 UserGroupMember,
                 UserGroupUserGroupToPerm.user_group_id ==
                 UserGroupMember.users_group_id)\
             .filter(
                 UserGroupMember.user_id == user_id,
                 UserGroup.users_group_active == true())
         if user_group_id:
             q = q.filter(
                 UserGroupUserGroupToPerm.user_group_id == user_group_id)
 
         return q.all()
 
 
 class UserRepoToPerm(Base, BaseModel):
     __tablename__ = 'repo_to_perm'
     __table_args__ = (
         UniqueConstraint('user_id', 'repository_id', 'permission_id'),
         base_table_args
     )
 
     repo_to_perm_id = Column("repo_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)
     permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
     repository_id = Column("repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=False, unique=None, default=None)
 
     user = relationship('User')
     repository = relationship('Repository')
     permission = relationship('Permission')
 
-    branch_perm_entry = relationship('UserToRepoBranchPermission', cascade="all, delete, delete-orphan", lazy='joined')
+    branch_perm_entry = relationship('UserToRepoBranchPermission', cascade="all, delete-orphan", lazy='joined')
 
     @classmethod
     def create(cls, user, repository, permission):
         n = cls()
         n.user = user
         n.repository = repository
         n.permission = permission
         Session().add(n)
         return n
 
     def __unicode__(self):
         return u'<%s => %s >' % (self.user, self.repository)
 
 
 class UserUserGroupToPerm(Base, BaseModel):
     __tablename__ = 'user_user_group_to_perm'
     __table_args__ = (
         UniqueConstraint('user_id', 'user_group_id', 'permission_id'),
         base_table_args
     )
 
     user_user_group_to_perm_id = Column("user_user_group_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)
     permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
     user_group_id = Column("user_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)
 
     user = relationship('User')
     user_group = relationship('UserGroup')
     permission = relationship('Permission')
 
     @classmethod
     def create(cls, user, user_group, permission):
         n = cls()
         n.user = user
         n.user_group = user_group
         n.permission = permission
         Session().add(n)
         return n
 
     def __unicode__(self):
         return u'<%s => %s >' % (self.user, self.user_group)
 
 
 class UserToPerm(Base, BaseModel):
     __tablename__ = 'user_to_perm'
     __table_args__ = (
         UniqueConstraint('user_id', 'permission_id'),
         base_table_args
     )
 
     user_to_perm_id = Column("user_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)
     permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
 
     user = relationship('User')
     permission = relationship('Permission', lazy='joined')
 
     def __unicode__(self):
         return u'<%s => %s >' % (self.user, self.permission)
 
 
 class UserGroupRepoToPerm(Base, BaseModel):
     __tablename__ = 'users_group_repo_to_perm'
     __table_args__ = (
         UniqueConstraint('repository_id', 'users_group_id', 'permission_id'),
         base_table_args
     )
 
     users_group_to_perm_id = Column("users_group_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     users_group_id = Column("users_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)
     permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
     repository_id = Column("repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=False, unique=None, default=None)
 
     users_group = relationship('UserGroup')
     permission = relationship('Permission')
     repository = relationship('Repository')
     user_group_branch_perms = relationship('UserGroupToRepoBranchPermission', cascade='all')
 
     @classmethod
     def create(cls, users_group, repository, permission):
         n = cls()
         n.users_group = users_group
         n.repository = repository
         n.permission = permission
         Session().add(n)
         return n
 
     def __unicode__(self):
         return u'<UserGroupRepoToPerm:%s => %s >' % (self.users_group, self.repository)
 
 
 class UserGroupUserGroupToPerm(Base, BaseModel):
     __tablename__ = 'user_group_user_group_to_perm'
     __table_args__ = (
         UniqueConstraint('target_user_group_id', 'user_group_id', 'permission_id'),
         CheckConstraint('target_user_group_id != user_group_id'),
         base_table_args
     )
 
     user_group_user_group_to_perm_id = Column("user_group_user_group_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     target_user_group_id = Column("target_user_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)
     permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
     user_group_id = Column("user_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)
 
     target_user_group = relationship('UserGroup', primaryjoin='UserGroupUserGroupToPerm.target_user_group_id==UserGroup.users_group_id')
     user_group = relationship('UserGroup', primaryjoin='UserGroupUserGroupToPerm.user_group_id==UserGroup.users_group_id')
     permission = relationship('Permission')
 
     @classmethod
     def create(cls, target_user_group, user_group, permission):
         n = cls()
         n.target_user_group = target_user_group
         n.user_group = user_group
         n.permission = permission
         Session().add(n)
         return n
 
     def __unicode__(self):
         return u'<UserGroupUserGroup:%s => %s >' % (self.target_user_group, self.user_group)
 
 
 class UserGroupToPerm(Base, BaseModel):
     __tablename__ = 'users_group_to_perm'
     __table_args__ = (
         UniqueConstraint('users_group_id', 'permission_id',),
         base_table_args
     )
 
     users_group_to_perm_id = Column("users_group_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     users_group_id = Column("users_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)
     permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
 
     users_group = relationship('UserGroup')
     permission = relationship('Permission')
 
 
 class UserRepoGroupToPerm(Base, BaseModel):
     __tablename__ = 'user_repo_group_to_perm'
     __table_args__ = (
         UniqueConstraint('user_id', 'group_id', 'permission_id'),
         base_table_args
     )
 
     group_to_perm_id = Column("group_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)
     group_id = Column("group_id", Integer(), ForeignKey('groups.group_id'), nullable=False, unique=None, default=None)
     permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
 
     user = relationship('User')
     group = relationship('RepoGroup')
     permission = relationship('Permission')
 
     @classmethod
     def create(cls, user, repository_group, permission):
         n = cls()
         n.user = user
         n.group = repository_group
         n.permission = permission
         Session().add(n)
         return n
 
 
 class UserGroupRepoGroupToPerm(Base, BaseModel):
     __tablename__ = 'users_group_repo_group_to_perm'
     __table_args__ = (
         UniqueConstraint('users_group_id', 'group_id'),
         base_table_args
     )
 
     users_group_repo_group_to_perm_id = Column("users_group_repo_group_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     users_group_id = Column("users_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)
     group_id = Column("group_id", Integer(), ForeignKey('groups.group_id'), nullable=False, unique=None, default=None)
     permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
 
     users_group = relationship('UserGroup')
     permission = relationship('Permission')
     group = relationship('RepoGroup')
 
     @classmethod
     def create(cls, user_group, repository_group, permission):
         n = cls()
         n.users_group = user_group
         n.group = repository_group
         n.permission = permission
         Session().add(n)
         return n
 
     def __unicode__(self):
         return u'<UserGroupRepoGroupToPerm:%s => %s >' % (self.users_group, self.group)
 
 
 class Statistics(Base, BaseModel):
     __tablename__ = 'statistics'
     __table_args__ = (
          base_table_args
     )
 
     stat_id = Column("stat_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     repository_id = Column("repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=False, unique=True, default=None)
     stat_on_revision = Column("stat_on_revision", Integer(), nullable=False)
     commit_activity = Column("commit_activity", LargeBinary(1000000), nullable=False)#JSON data
     commit_activity_combined = Column("commit_activity_combined", LargeBinary(), nullable=False)#JSON data
     languages = Column("languages", LargeBinary(1000000), nullable=False)#JSON data
 
     repository = relationship('Repository', single_parent=True)
 
 
 class UserFollowing(Base, BaseModel):
     __tablename__ = 'user_followings'
     __table_args__ = (
         UniqueConstraint('user_id', 'follows_repository_id'),
         UniqueConstraint('user_id', 'follows_user_id'),
         base_table_args
     )
 
     user_following_id = Column("user_following_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)
     follows_repo_id = Column("follows_repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=True, unique=None, default=None)
     follows_user_id = Column("follows_user_id", Integer(), ForeignKey('users.user_id'), nullable=True, unique=None, default=None)
     follows_from = Column('follows_from', DateTime(timezone=False), nullable=True, unique=None, default=datetime.datetime.now)
 
     user = relationship('User', primaryjoin='User.user_id==UserFollowing.user_id')
 
     follows_user = relationship('User', primaryjoin='User.user_id==UserFollowing.follows_user_id')
     follows_repository = relationship('Repository', order_by='Repository.repo_name')
 
     @classmethod
     def get_repo_followers(cls, repo_id):
         return cls.query().filter(cls.follows_repo_id == repo_id)
 
 
 class CacheKey(Base, BaseModel):
     __tablename__ = 'cache_invalidation'
     __table_args__ = (
         UniqueConstraint('cache_key'),
         Index('key_idx', 'cache_key'),
         base_table_args,
     )
 
     CACHE_TYPE_FEED = 'FEED'
 
     # namespaces used to register process/thread aware caches
     REPO_INVALIDATION_NAMESPACE = 'repo_cache:{repo_id}'
     SETTINGS_INVALIDATION_NAMESPACE = 'system_settings'
 
     cache_id = Column("cache_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     cache_key = Column("cache_key", String(255), nullable=True, unique=None, default=None)
     cache_args = Column("cache_args", String(255), nullable=True, unique=None, default=None)
     cache_state_uid = Column("cache_state_uid", String(255), nullable=True, unique=None, default=None)
     cache_active = Column("cache_active", Boolean(), nullable=True, unique=None, default=False)
 
     def __init__(self, cache_key, cache_args='', cache_state_uid=None):
         self.cache_key = cache_key
         self.cache_args = cache_args
         self.cache_active = False
         # first key should be same for all entries, since all workers should share it
         self.cache_state_uid = cache_state_uid or self.generate_new_state_uid()
 
     def __unicode__(self):
         return u"<%s('%s:%s[%s]')>" % (
             self.__class__.__name__,
             self.cache_id, self.cache_key, self.cache_active)
 
     def _cache_key_partition(self):
         prefix, repo_name, suffix = self.cache_key.partition(self.cache_args)
         return prefix, repo_name, suffix
 
     def get_prefix(self):
         """
         Try to extract prefix from existing cache key. The key could consist
         of prefix, repo_name, suffix
         """
         # this returns prefix, repo_name, suffix
         return self._cache_key_partition()[0]
 
     def get_suffix(self):
         """
         get suffix that might have been used in _get_cache_key to
         generate self.cache_key. Only used for informational purposes
         in repo_edit.mako.
         """
         # prefix, repo_name, suffix
         return self._cache_key_partition()[2]
 
     @classmethod
     def generate_new_state_uid(cls, based_on=None):
         if based_on:
             return str(uuid.uuid5(uuid.NAMESPACE_URL, safe_str(based_on)))
         else:
             return str(uuid.uuid4())
 
     @classmethod
     def delete_all_cache(cls):
         """
         Delete all cache keys from database.
         Should only be run when all instances are down and all entries
         thus stale.
         """
         cls.query().delete()
         Session().commit()
 
     @classmethod
     def set_invalidate(cls, cache_uid, delete=False):
         """
         Mark all caches of a repo as invalid in the database.
         """
 
         try:
             qry = Session().query(cls).filter(cls.cache_args == cache_uid)
             if delete:
                 qry.delete()
                 log.debug('cache objects deleted for cache args %s',
                           safe_str(cache_uid))
             else:
                 qry.update({"cache_active": False,
                             "cache_state_uid": cls.generate_new_state_uid()})
                 log.debug('cache objects marked as invalid for cache args %s',
                           safe_str(cache_uid))
 
             Session().commit()
         except Exception:
             log.exception(
                 'Cache key invalidation failed for cache args %s',
                 safe_str(cache_uid))
             Session().rollback()
 
     @classmethod
     def get_active_cache(cls, cache_key):
         inv_obj = cls.query().filter(cls.cache_key == cache_key).scalar()
         if inv_obj:
             return inv_obj
         return None
 
     @classmethod
     def get_namespace_map(cls, namespace):
         return {
             x.cache_key: x
             for x in cls.query().filter(cls.cache_args == namespace)}
 
 
 class ChangesetComment(Base, BaseModel):
     __tablename__ = 'changeset_comments'
     __table_args__ = (
         Index('cc_revision_idx', 'revision'),
         base_table_args,
     )
 
     COMMENT_OUTDATED = u'comment_outdated'
     COMMENT_TYPE_NOTE = u'note'
     COMMENT_TYPE_TODO = u'todo'
     COMMENT_TYPES = [COMMENT_TYPE_NOTE, COMMENT_TYPE_TODO]
 
     comment_id = Column('comment_id', Integer(), nullable=False, primary_key=True)
     repo_id = Column('repo_id', Integer(), ForeignKey('repositories.repo_id'), nullable=False)
     revision = Column('revision', String(40), nullable=True)
     pull_request_id = Column("pull_request_id", Integer(), ForeignKey('pull_requests.pull_request_id'), nullable=True)
     pull_request_version_id = Column("pull_request_version_id", Integer(), ForeignKey('pull_request_versions.pull_request_version_id'), nullable=True)
     line_no = Column('line_no', Unicode(10), nullable=True)
     hl_lines = Column('hl_lines', Unicode(512), nullable=True)
     f_path = Column('f_path', Unicode(1000), nullable=True)
     user_id = Column('user_id', Integer(), ForeignKey('users.user_id'), nullable=False)
     text = Column('text', UnicodeText().with_variant(UnicodeText(25000), 'mysql'), nullable=False)
     created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
     modified_at = Column('modified_at', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
     renderer = Column('renderer', Unicode(64), nullable=True)
     display_state = Column('display_state',  Unicode(128), nullable=True)
 
     comment_type = Column('comment_type',  Unicode(128), nullable=True, default=COMMENT_TYPE_NOTE)
     resolved_comment_id = Column('resolved_comment_id', Integer(), ForeignKey('changeset_comments.comment_id'), nullable=True)
 
     resolved_comment = relationship('ChangesetComment', remote_side=comment_id, back_populates='resolved_by')
     resolved_by = relationship('ChangesetComment', back_populates='resolved_comment')
 
     author = relationship('User', lazy='joined')
     repo = relationship('Repository')
-    status_change = relationship('ChangesetStatus', cascade="all, delete, delete-orphan", lazy='joined')
+    status_change = relationship('ChangesetStatus', cascade="all, delete-orphan", lazy='joined')
     pull_request = relationship('PullRequest', lazy='joined')
     pull_request_version = relationship('PullRequestVersion')
 
     @classmethod
     def get_users(cls, revision=None, pull_request_id=None):
         """
         Returns user associated with this ChangesetComment. ie those
         who actually commented
 
         :param cls:
         :param revision:
         """
         q = Session().query(User)\
                 .join(ChangesetComment.author)
         if revision:
             q = q.filter(cls.revision == revision)
         elif pull_request_id:
             q = q.filter(cls.pull_request_id == pull_request_id)
         return q.all()
 
     @classmethod
     def get_index_from_version(cls, pr_version, versions):
         num_versions = [x.pull_request_version_id for x in versions]
         try:
             return num_versions.index(pr_version) +1
         except (IndexError, ValueError):
             return
 
     @property
     def outdated(self):
         return self.display_state == self.COMMENT_OUTDATED
 
     def outdated_at_version(self, version):
         """
         Checks if comment is outdated for given pull request version
         """
         return self.outdated and self.pull_request_version_id != version
 
     def older_than_version(self, version):
         """
         Checks if comment is made from previous version than given
         """
         if version is None:
             return self.pull_request_version_id is not None
 
         return self.pull_request_version_id < version
 
     @property
     def resolved(self):
         return self.resolved_by[0] if self.resolved_by else None
 
     @property
     def is_todo(self):
         return self.comment_type == self.COMMENT_TYPE_TODO
 
     @property
     def is_inline(self):
         return self.line_no and self.f_path
 
     def get_index_version(self, versions):
         return self.get_index_from_version(
             self.pull_request_version_id, versions)
 
     def __repr__(self):
         if self.comment_id:
             return '<DB:Comment #%s>' % self.comment_id
         else:
             return '<DB:Comment at %#x>' % id(self)
 
     def get_api_data(self):
         comment = self
         data = {
             'comment_id': comment.comment_id,
             'comment_type': comment.comment_type,
             'comment_text': comment.text,
             'comment_status': comment.status_change,
             'comment_f_path': comment.f_path,
             'comment_lineno': comment.line_no,
             'comment_author': comment.author,
             'comment_created_on': comment.created_on,
             'comment_resolved_by': self.resolved
         }
         return data
 
     def __json__(self):
         data = dict()
         data.update(self.get_api_data())
         return data
 
 
 class ChangesetStatus(Base, BaseModel):
     __tablename__ = 'changeset_statuses'
     __table_args__ = (
         Index('cs_revision_idx', 'revision'),
         Index('cs_version_idx', 'version'),
         UniqueConstraint('repo_id', 'revision', 'version'),
         base_table_args
     )
 
     STATUS_NOT_REVIEWED = DEFAULT = 'not_reviewed'
     STATUS_APPROVED = 'approved'
     STATUS_REJECTED = 'rejected'
     STATUS_UNDER_REVIEW = 'under_review'
 
     STATUSES = [
         (STATUS_NOT_REVIEWED, _("Not Reviewed")),  # (no icon) and default
         (STATUS_APPROVED, _("Approved")),
         (STATUS_REJECTED, _("Rejected")),
         (STATUS_UNDER_REVIEW, _("Under Review")),
     ]
 
     changeset_status_id = Column('changeset_status_id', Integer(), nullable=False, primary_key=True)
     repo_id = Column('repo_id', Integer(), ForeignKey('repositories.repo_id'), nullable=False)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None)
     revision = Column('revision', String(40), nullable=False)
     status = Column('status', String(128), nullable=False, default=DEFAULT)
     changeset_comment_id = Column('changeset_comment_id', Integer(), ForeignKey('changeset_comments.comment_id'))
     modified_at = Column('modified_at', DateTime(), nullable=False, default=datetime.datetime.now)
     version = Column('version', Integer(), nullable=False, default=0)
     pull_request_id = Column("pull_request_id", Integer(), ForeignKey('pull_requests.pull_request_id'), nullable=True)
 
     author = relationship('User', lazy='joined')
     repo = relationship('Repository')
     comment = relationship('ChangesetComment', lazy='joined')
     pull_request = relationship('PullRequest', lazy='joined')
 
     def __unicode__(self):
         return u"<%s('%s[v%s]:%s')>" % (
             self.__class__.__name__,
             self.status, self.version, self.author
         )
 
     @classmethod
     def get_status_lbl(cls, value):
         return dict(cls.STATUSES).get(value)
 
     @property
     def status_lbl(self):
         return ChangesetStatus.get_status_lbl(self.status)
 
     def get_api_data(self):
         status = self
         data = {
             'status_id': status.changeset_status_id,
             'status': status.status,
         }
         return data
 
     def __json__(self):
         data = dict()
         data.update(self.get_api_data())
         return data
 
 
 class _SetState(object):
     """
     Context processor allowing changing state for sensitive operation such as
     pull request update or merge
     """
 
     def __init__(self, pull_request, pr_state, back_state=None):
         self._pr = pull_request
         self._org_state = back_state or pull_request.pull_request_state
         self._pr_state = pr_state
         self._current_state = None
 
     def __enter__(self):
         log.debug('StateLock: entering set state context, setting state to: `%s`',
                   self._pr_state)
         self.set_pr_state(self._pr_state)
         return self
 
     def __exit__(self, exc_type, exc_val, exc_tb):
         if exc_val is not None:
             log.error(traceback.format_exc(exc_tb))
             return None
 
         self.set_pr_state(self._org_state)
         log.debug('StateLock: exiting set state context, setting state to: `%s`',
                   self._org_state)
     @property
     def state(self):
         return self._current_state
 
     def set_pr_state(self, pr_state):
         try:
             self._pr.pull_request_state = pr_state
             Session().add(self._pr)
             Session().commit()
             self._current_state = pr_state
         except Exception:
             log.exception('Failed to set PullRequest %s state to %s', self._pr, pr_state)
             raise
 
 class _PullRequestBase(BaseModel):
     """
     Common attributes of pull request and version entries.
     """
 
     # .status values
     STATUS_NEW = u'new'
     STATUS_OPEN = u'open'
     STATUS_CLOSED = u'closed'
 
     # available states
     STATE_CREATING = u'creating'
     STATE_UPDATING = u'updating'
     STATE_MERGING = u'merging'
     STATE_CREATED = u'created'
 
     title = Column('title', Unicode(255), nullable=True)
     description = Column(
         'description', UnicodeText().with_variant(UnicodeText(10240), 'mysql'),
         nullable=True)
     description_renderer = Column('description_renderer', Unicode(64), nullable=True)
 
     # new/open/closed status of pull request (not approve/reject/etc)
     status = Column('status', Unicode(255), nullable=False, default=STATUS_NEW)
     created_on = Column(
         'created_on', DateTime(timezone=False), nullable=False,
         default=datetime.datetime.now)
     updated_on = Column(
         'updated_on', DateTime(timezone=False), nullable=False,
         default=datetime.datetime.now)
 
     pull_request_state = Column("pull_request_state", String(255), nullable=True)
 
     @declared_attr
     def user_id(cls):
         return Column(
             "user_id", Integer(), ForeignKey('users.user_id'), nullable=False,
             unique=None)
 
     # 500 revisions max
     _revisions = Column(
         'revisions', UnicodeText().with_variant(UnicodeText(20500), 'mysql'))
 
     @declared_attr
     def source_repo_id(cls):
         # TODO: dan: rename column to source_repo_id
         return Column(
             'org_repo_id', Integer(), ForeignKey('repositories.repo_id'),
             nullable=False)
 
     _source_ref = Column('org_ref', Unicode(255), nullable=False)
 
     @hybrid_property
     def source_ref(self):
         return self._source_ref
 
     @source_ref.setter
     def source_ref(self, val):
         parts = (val or '').split(':')
         if len(parts) != 3:
             raise ValueError(
                 'Invalid reference format given: {}, expected X:Y:Z'.format(val))
         self._source_ref = safe_unicode(val)
 
     _target_ref = Column('other_ref', Unicode(255), nullable=False)
 
     @hybrid_property
     def target_ref(self):
         return self._target_ref
 
     @target_ref.setter
     def target_ref(self, val):
         parts = (val or '').split(':')
         if len(parts) != 3:
             raise ValueError(
                 'Invalid reference format given: {}, expected X:Y:Z'.format(val))
         self._target_ref = safe_unicode(val)
 
     @declared_attr
     def target_repo_id(cls):
         # TODO: dan: rename column to target_repo_id
         return Column(
             'other_repo_id', Integer(), ForeignKey('repositories.repo_id'),
             nullable=False)
 
     _shadow_merge_ref = Column('shadow_merge_ref', Unicode(255), nullable=True)
 
     # TODO: dan: rename column to last_merge_source_rev
     _last_merge_source_rev = Column(
         'last_merge_org_rev', String(40), nullable=True)
     # TODO: dan: rename column to last_merge_target_rev
     _last_merge_target_rev = Column(
         'last_merge_other_rev', String(40), nullable=True)
     _last_merge_status = Column('merge_status', Integer(), nullable=True)
     merge_rev = Column('merge_rev', String(40), nullable=True)
 
     reviewer_data = Column(
         'reviewer_data_json', MutationObj.as_mutable(
             JsonType(dialect_map=dict(mysql=UnicodeText(16384)))))
 
     @property
     def reviewer_data_json(self):
         return json.dumps(self.reviewer_data)
 
     @hybrid_property
     def description_safe(self):
         from rhodecode.lib import helpers as h
         return h.escape(self.description)
 
     @hybrid_property
     def revisions(self):
         return self._revisions.split(':') if self._revisions else []
 
     @revisions.setter
     def revisions(self, val):
         self._revisions = u':'.join(val)
 
     @hybrid_property
     def last_merge_status(self):
         return safe_int(self._last_merge_status)
 
     @last_merge_status.setter
     def last_merge_status(self, val):
         self._last_merge_status = val
 
     @declared_attr
     def author(cls):
         return relationship('User', lazy='joined')
 
     @declared_attr
     def source_repo(cls):
         return relationship(
             'Repository',
             primaryjoin='%s.source_repo_id==Repository.repo_id' % cls.__name__)
 
     @property
     def source_ref_parts(self):
         return self.unicode_to_reference(self.source_ref)
 
     @declared_attr
     def target_repo(cls):
         return relationship(
             'Repository',
             primaryjoin='%s.target_repo_id==Repository.repo_id' % cls.__name__)
 
     @property
     def target_ref_parts(self):
         return self.unicode_to_reference(self.target_ref)
 
     @property
     def shadow_merge_ref(self):
         return self.unicode_to_reference(self._shadow_merge_ref)
 
     @shadow_merge_ref.setter
     def shadow_merge_ref(self, ref):
         self._shadow_merge_ref = self.reference_to_unicode(ref)
 
     @staticmethod
     def unicode_to_reference(raw):
         """
         Convert a unicode (or string) to a reference object.
         If unicode evaluates to False it returns None.
         """
         if raw:
             refs = raw.split(':')
             return Reference(*refs)
         else:
             return None
 
     @staticmethod
     def reference_to_unicode(ref):
         """
         Convert a reference object to unicode.
         If reference is None it returns None.
         """
         if ref:
             return u':'.join(ref)
         else:
             return None
 
     def get_api_data(self, with_merge_state=True):
         from rhodecode.model.pull_request import PullRequestModel
 
         pull_request = self
         if with_merge_state:
             merge_status = PullRequestModel().merge_status(pull_request)
             merge_state = {
                 'status': merge_status[0],
                 'message': safe_unicode(merge_status[1]),
             }
         else:
             merge_state = {'status': 'not_available',
                            'message': 'not_available'}
 
         merge_data = {
             'clone_url': PullRequestModel().get_shadow_clone_url(pull_request),
             'reference': (
                 pull_request.shadow_merge_ref._asdict()
                 if pull_request.shadow_merge_ref else None),
         }
 
         data = {
             'pull_request_id': pull_request.pull_request_id,
             'url': PullRequestModel().get_url(pull_request),
             'title': pull_request.title,
             'description': pull_request.description,
             'status': pull_request.status,
             'state': pull_request.pull_request_state,
             'created_on': pull_request.created_on,
             'updated_on': pull_request.updated_on,
             'commit_ids': pull_request.revisions,
             'review_status': pull_request.calculated_review_status(),
             'mergeable': merge_state,
             'source': {
                 'clone_url': pull_request.source_repo.clone_url(),
                 'repository': pull_request.source_repo.repo_name,
                 'reference': {
                     'name': pull_request.source_ref_parts.name,
                     'type': pull_request.source_ref_parts.type,
                     'commit_id': pull_request.source_ref_parts.commit_id,
                 },
             },
             'target': {
                 'clone_url': pull_request.target_repo.clone_url(),
                 'repository': pull_request.target_repo.repo_name,
                 'reference': {
                     'name': pull_request.target_ref_parts.name,
                     'type': pull_request.target_ref_parts.type,
                     'commit_id': pull_request.target_ref_parts.commit_id,
                 },
             },
             'merge': merge_data,
             'author': pull_request.author.get_api_data(include_secrets=False,
                                                        details='basic'),
             'reviewers': [
                 {
                     'user': reviewer.get_api_data(include_secrets=False,
                                                   details='basic'),
                     'reasons': reasons,
                     'review_status': st[0][1].status if st else 'not_reviewed',
                 }
                 for obj, reviewer, reasons, mandatory, st in
                 pull_request.reviewers_statuses()
             ]
         }
 
         return data
 
     def set_state(self, pull_request_state, final_state=None):
         """
         # goes from initial state to updating to initial state.
         # initial state can be changed by specifying back_state=
         with pull_request_obj.set_state(PullRequest.STATE_UPDATING):
            pull_request.merge()
 
         :param pull_request_state:
         :param final_state:
 
         """
 
         return _SetState(self, pull_request_state, back_state=final_state)
 
 
 class PullRequest(Base, _PullRequestBase):
     __tablename__ = 'pull_requests'
     __table_args__ = (
         base_table_args,
     )
 
     pull_request_id = Column(
         'pull_request_id', Integer(), nullable=False, primary_key=True)
 
     def __repr__(self):
         if self.pull_request_id:
             return '<DB:PullRequest #%s>' % self.pull_request_id
         else:
             return '<DB:PullRequest at %#x>' % id(self)
 
     reviewers = relationship('PullRequestReviewers',
-                             cascade="all, delete, delete-orphan")
+                             cascade="all, delete-orphan")
     statuses = relationship('ChangesetStatus',
-                            cascade="all, delete, delete-orphan")
+                            cascade="all, delete-orphan")
     comments = relationship('ChangesetComment',
-                            cascade="all, delete, delete-orphan")
+                            cascade="all, delete-orphan")
     versions = relationship('PullRequestVersion',
-                            cascade="all, delete, delete-orphan",
+                            cascade="all, delete-orphan",
                             lazy='dynamic')
 
     @classmethod
     def get_pr_display_object(cls, pull_request_obj, org_pull_request_obj,
                               internal_methods=None):
 
         class PullRequestDisplay(object):
             """
             Special object wrapper for showing PullRequest data via Versions
             It mimics PR object as close as possible. This is read only object
             just for display
             """
 
             def __init__(self, attrs, internal=None):
                 self.attrs = attrs
                 # internal have priority over the given ones via attrs
                 self.internal = internal or ['versions']
 
             def __getattr__(self, item):
                 if item in self.internal:
                     return getattr(self, item)
                 try:
                     return self.attrs[item]
                 except KeyError:
                     raise AttributeError(
                         '%s object has no attribute %s' % (self, item))
 
             def __repr__(self):
                 return '<DB:PullRequestDisplay #%s>' % self.attrs.get('pull_request_id')
 
             def versions(self):
                 return pull_request_obj.versions.order_by(
                     PullRequestVersion.pull_request_version_id).all()
 
             def is_closed(self):
                 return pull_request_obj.is_closed()
 
             @property
             def pull_request_version_id(self):
                 return getattr(pull_request_obj, 'pull_request_version_id', None)
 
         attrs = StrictAttributeDict(pull_request_obj.get_api_data(with_merge_state=False))
 
         attrs.author = StrictAttributeDict(
             pull_request_obj.author.get_api_data())
         if pull_request_obj.target_repo:
             attrs.target_repo = StrictAttributeDict(
                 pull_request_obj.target_repo.get_api_data())
             attrs.target_repo.clone_url = pull_request_obj.target_repo.clone_url
 
         if pull_request_obj.source_repo:
             attrs.source_repo = StrictAttributeDict(
                 pull_request_obj.source_repo.get_api_data())
             attrs.source_repo.clone_url = pull_request_obj.source_repo.clone_url
 
         attrs.source_ref_parts = pull_request_obj.source_ref_parts
         attrs.target_ref_parts = pull_request_obj.target_ref_parts
         attrs.revisions = pull_request_obj.revisions
 
         attrs.shadow_merge_ref = org_pull_request_obj.shadow_merge_ref
         attrs.reviewer_data = org_pull_request_obj.reviewer_data
         attrs.reviewer_data_json = org_pull_request_obj.reviewer_data_json
 
         return PullRequestDisplay(attrs, internal=internal_methods)
 
     def is_closed(self):
         return self.status == self.STATUS_CLOSED
 
     def __json__(self):
         return {
             'revisions': self.revisions,
         }
 
     def calculated_review_status(self):
         from rhodecode.model.changeset_status import ChangesetStatusModel
         return ChangesetStatusModel().calculated_review_status(self)
 
     def reviewers_statuses(self):
         from rhodecode.model.changeset_status import ChangesetStatusModel
         return ChangesetStatusModel().reviewers_statuses(self)
 
     @property
     def workspace_id(self):
         from rhodecode.model.pull_request import PullRequestModel
         return PullRequestModel()._workspace_id(self)
 
     def get_shadow_repo(self):
         workspace_id = self.workspace_id
         shadow_repository_path = self.target_repo.get_shadow_repository_path(workspace_id)
         if os.path.isdir(shadow_repository_path):
             vcs_obj = self.target_repo.scm_instance()
             return vcs_obj.get_shadow_instance(shadow_repository_path)
 
 
 class PullRequestVersion(Base, _PullRequestBase):
     __tablename__ = 'pull_request_versions'
     __table_args__ = (
         base_table_args,
     )
 
     pull_request_version_id = Column(
         'pull_request_version_id', Integer(), nullable=False, primary_key=True)
     pull_request_id = Column(
         'pull_request_id', Integer(),
         ForeignKey('pull_requests.pull_request_id'), nullable=False)
     pull_request = relationship('PullRequest')
 
     def __repr__(self):
         if self.pull_request_version_id:
             return '<DB:PullRequestVersion #%s>' % self.pull_request_version_id
         else:
             return '<DB:PullRequestVersion at %#x>' % id(self)
 
     @property
     def reviewers(self):
         return self.pull_request.reviewers
 
     @property
     def versions(self):
         return self.pull_request.versions
 
     def is_closed(self):
         # calculate from original
         return self.pull_request.status == self.STATUS_CLOSED
 
     def calculated_review_status(self):
         return self.pull_request.calculated_review_status()
 
     def reviewers_statuses(self):
         return self.pull_request.reviewers_statuses()
 
 
 class PullRequestReviewers(Base, BaseModel):
     __tablename__ = 'pull_request_reviewers'
     __table_args__ = (
         base_table_args,
     )
 
     @hybrid_property
     def reasons(self):
         if not self._reasons:
             return []
         return self._reasons
 
     @reasons.setter
     def reasons(self, val):
         val = val or []
         if any(not isinstance(x, compat.string_types) for x in val):
             raise Exception('invalid reasons type, must be list of strings')
         self._reasons = val
 
     pull_requests_reviewers_id = Column(
         'pull_requests_reviewers_id', Integer(), nullable=False,
         primary_key=True)
     pull_request_id = Column(
         "pull_request_id", Integer(),
         ForeignKey('pull_requests.pull_request_id'), nullable=False)
     user_id = Column(
         "user_id", Integer(), ForeignKey('users.user_id'), nullable=True)
     _reasons = Column(
         'reason', MutationList.as_mutable(
             JsonType('list', dialect_map=dict(mysql=UnicodeText(16384)))))
 
     mandatory = Column("mandatory", Boolean(), nullable=False, default=False)
     user = relationship('User')
     pull_request = relationship('PullRequest')
 
     rule_data = Column(
         'rule_data_json',
         JsonType(dialect_map=dict(mysql=UnicodeText(16384))))
 
     def rule_user_group_data(self):
         """
         Returns the voting user group rule data for this reviewer
         """
 
         if self.rule_data and 'vote_rule' in self.rule_data:
             user_group_data = {}
             if 'rule_user_group_entry_id' in self.rule_data:
                 # means a group with voting rules !
                 user_group_data['id'] = self.rule_data['rule_user_group_entry_id']
                 user_group_data['name'] = self.rule_data['rule_name']
                 user_group_data['vote_rule'] = self.rule_data['vote_rule']
 
             return user_group_data
 
     def __unicode__(self):
         return u"<%s('id:%s')>" % (self.__class__.__name__,
                                    self.pull_requests_reviewers_id)
 
 
 class Notification(Base, BaseModel):
     __tablename__ = 'notifications'
     __table_args__ = (
         Index('notification_type_idx', 'type'),
         base_table_args,
     )
 
     TYPE_CHANGESET_COMMENT = u'cs_comment'
     TYPE_MESSAGE = u'message'
     TYPE_MENTION = u'mention'
     TYPE_REGISTRATION = u'registration'
     TYPE_PULL_REQUEST = u'pull_request'
     TYPE_PULL_REQUEST_COMMENT = u'pull_request_comment'
 
     notification_id = Column('notification_id', Integer(), nullable=False, primary_key=True)
     subject = Column('subject', Unicode(512), nullable=True)
     body = Column('body', UnicodeText().with_variant(UnicodeText(50000), 'mysql'), nullable=True)
     created_by = Column("created_by", Integer(), ForeignKey('users.user_id'), nullable=True)
     created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
     type_ = Column('type', Unicode(255))
 
     created_by_user = relationship('User')
     notifications_to_users = relationship('UserNotification', lazy='joined',
-                                          cascade="all, delete, delete-orphan")
+                                          cascade="all, delete-orphan")
 
     @property
     def recipients(self):
         return [x.user for x in UserNotification.query()\
                 .filter(UserNotification.notification == self)\
                 .order_by(UserNotification.user_id.asc()).all()]
 
     @classmethod
     def create(cls, created_by, subject, body, recipients, type_=None):
         if type_ is None:
             type_ = Notification.TYPE_MESSAGE
 
         notification = cls()
         notification.created_by_user = created_by
         notification.subject = subject
         notification.body = body
         notification.type_ = type_
         notification.created_on = datetime.datetime.now()
 
         # For each recipient link the created notification to his account
         for u in recipients:
             assoc = UserNotification()
             assoc.user_id = u.user_id
             assoc.notification = notification
 
             # if created_by is inside recipients mark his notification
             # as read
             if u.user_id == created_by.user_id:
                 assoc.read = True
             Session().add(assoc)
 
         Session().add(notification)
 
         return notification
 
 
 class UserNotification(Base, BaseModel):
     __tablename__ = 'user_to_notification'
     __table_args__ = (
         UniqueConstraint('user_id', 'notification_id'),
         base_table_args
     )
 
     user_id = Column('user_id', Integer(), ForeignKey('users.user_id'), primary_key=True)
     notification_id = Column("notification_id", Integer(), ForeignKey('notifications.notification_id'), primary_key=True)
     read = Column('read', Boolean, default=False)
     sent_on = Column('sent_on', DateTime(timezone=False), nullable=True, unique=None)
 
     user = relationship('User', lazy="joined")
     notification = relationship('Notification', lazy="joined",
                                 order_by=lambda: Notification.created_on.desc(),)
 
     def mark_as_read(self):
         self.read = True
         Session().add(self)
 
 
 class Gist(Base, BaseModel):
     __tablename__ = 'gists'
     __table_args__ = (
         Index('g_gist_access_id_idx', 'gist_access_id'),
         Index('g_created_on_idx', 'created_on'),
         base_table_args
     )
 
     GIST_PUBLIC = u'public'
     GIST_PRIVATE = u'private'
     DEFAULT_FILENAME = u'gistfile1.txt'
 
     ACL_LEVEL_PUBLIC = u'acl_public'
     ACL_LEVEL_PRIVATE = u'acl_private'
 
     gist_id = Column('gist_id', Integer(), primary_key=True)
     gist_access_id = Column('gist_access_id', Unicode(250))
     gist_description = Column('gist_description', UnicodeText().with_variant(UnicodeText(1024), 'mysql'))
     gist_owner = Column('user_id', Integer(), ForeignKey('users.user_id'), nullable=True)
     gist_expires = Column('gist_expires', Float(53), nullable=False)
     gist_type = Column('gist_type', Unicode(128), nullable=False)
     created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
     modified_at = Column('modified_at', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
     acl_level = Column('acl_level', Unicode(128), nullable=True)
 
     owner = relationship('User')
 
     def __repr__(self):
         return '<Gist:[%s]%s>' % (self.gist_type, self.gist_access_id)
 
     @hybrid_property
     def description_safe(self):
         from rhodecode.lib import helpers as h
         return h.escape(self.gist_description)
 
     @classmethod
     def get_or_404(cls, id_):
         from pyramid.httpexceptions import HTTPNotFound
 
         res = cls.query().filter(cls.gist_access_id == id_).scalar()
         if not res:
             raise HTTPNotFound()
         return res
 
     @classmethod
     def get_by_access_id(cls, gist_access_id):
         return cls.query().filter(cls.gist_access_id == gist_access_id).scalar()
 
     def gist_url(self):
         from rhodecode.model.gist import GistModel
         return GistModel().get_url(self)
 
     @classmethod
     def base_path(cls):
         """
         Returns base path when all gists are stored
 
         :param cls:
         """
         from rhodecode.model.gist import GIST_STORE_LOC
         q = Session().query(RhodeCodeUi)\
             .filter(RhodeCodeUi.ui_key == URL_SEP)
         q = q.options(FromCache("sql_cache_short", "repository_repo_path"))
         return os.path.join(q.one().ui_value, GIST_STORE_LOC)
 
     def get_api_data(self):
         """
         Common function for generating gist related data for API
         """
         gist = self
         data = {
             'gist_id': gist.gist_id,
             'type': gist.gist_type,
             'access_id': gist.gist_access_id,
             'description': gist.gist_description,
             'url': gist.gist_url(),
             'expires': gist.gist_expires,
             'created_on': gist.created_on,
             'modified_at': gist.modified_at,
             'content': None,
             'acl_level': gist.acl_level,
         }
         return data
 
     def __json__(self):
         data = dict(
         )
         data.update(self.get_api_data())
         return data
     # SCM functions
 
     def scm_instance(self, **kwargs):
         """
         Get an instance of VCS Repository
 
         :param kwargs:
         """
         from rhodecode.model.gist import GistModel
         full_repo_path = os.path.join(self.base_path(), self.gist_access_id)
         return get_vcs_instance(
             repo_path=safe_str(full_repo_path), create=False,
             _vcs_alias=GistModel.vcs_backend)
 
 
 class ExternalIdentity(Base, BaseModel):
     __tablename__ = 'external_identities'
     __table_args__ = (
         Index('local_user_id_idx', 'local_user_id'),
         Index('external_id_idx', 'external_id'),
         base_table_args
     )
 
     external_id = Column('external_id', Unicode(255), default=u'', primary_key=True)
     external_username = Column('external_username', Unicode(1024), default=u'')
     local_user_id = Column('local_user_id', Integer(), ForeignKey('users.user_id'), primary_key=True)
     provider_name = Column('provider_name', Unicode(255), default=u'', primary_key=True)
     access_token = Column('access_token', String(1024), default=u'')
     alt_token = Column('alt_token', String(1024), default=u'')
     token_secret = Column('token_secret', String(1024), default=u'')
 
     @classmethod
     def by_external_id_and_provider(cls, external_id, provider_name, local_user_id=None):
         """
         Returns ExternalIdentity instance based on search params
 
         :param external_id:
         :param provider_name:
         :return: ExternalIdentity
         """
         query = cls.query()
         query = query.filter(cls.external_id == external_id)
         query = query.filter(cls.provider_name == provider_name)
         if local_user_id:
             query = query.filter(cls.local_user_id == local_user_id)
         return query.first()
 
     @classmethod
     def user_by_external_id_and_provider(cls, external_id, provider_name):
         """
         Returns User instance based on search params
 
         :param external_id:
         :param provider_name:
         :return: User
         """
         query = User.query()
         query = query.filter(cls.external_id == external_id)
         query = query.filter(cls.provider_name == provider_name)
         query = query.filter(User.user_id == cls.local_user_id)
         return query.first()
 
     @classmethod
     def by_local_user_id(cls, local_user_id):
         """
         Returns all tokens for user
 
         :param local_user_id:
         :return: ExternalIdentity
         """
         query = cls.query()
         query = query.filter(cls.local_user_id == local_user_id)
         return query
 
     @classmethod
     def load_provider_plugin(cls, plugin_id):
         from rhodecode.authentication.base import loadplugin
         _plugin_id = 'egg:rhodecode-enterprise-ee#{}'.format(plugin_id)
         auth_plugin = loadplugin(_plugin_id)
         return auth_plugin
 
 
 class Integration(Base, BaseModel):
     __tablename__ = 'integrations'
     __table_args__ = (
         base_table_args
     )
 
     integration_id = Column('integration_id', Integer(), primary_key=True)
     integration_type = Column('integration_type', String(255))
     enabled = Column('enabled', Boolean(), nullable=False)
     name = Column('name', String(255), nullable=False)
     child_repos_only = Column('child_repos_only', Boolean(), nullable=False,
         default=False)
 
     settings = Column(
         'settings_json', MutationObj.as_mutable(
             JsonType(dialect_map=dict(mysql=UnicodeText(16384)))))
     repo_id = Column(
         'repo_id', Integer(), ForeignKey('repositories.repo_id'),
         nullable=True, unique=None, default=None)
     repo = relationship('Repository', lazy='joined')
 
     repo_group_id = Column(
         'repo_group_id', Integer(), ForeignKey('groups.group_id'),
         nullable=True, unique=None, default=None)
     repo_group = relationship('RepoGroup', lazy='joined')
 
     @property
     def scope(self):
         if self.repo:
             return repr(self.repo)
         if self.repo_group:
             if self.child_repos_only:
                 return repr(self.repo_group) + ' (child repos only)'
             else:
                 return repr(self.repo_group) + ' (recursive)'
         if self.child_repos_only:
             return 'root_repos'
         return 'global'
 
     def __repr__(self):
         return '<Integration(%r, %r)>' % (self.integration_type, self.scope)
 
 
 class RepoReviewRuleUser(Base, BaseModel):
     __tablename__ = 'repo_review_rules_users'
     __table_args__ = (
         base_table_args
     )
 
     repo_review_rule_user_id = Column('repo_review_rule_user_id', Integer(), primary_key=True)
     repo_review_rule_id = Column("repo_review_rule_id", Integer(), ForeignKey('repo_review_rules.repo_review_rule_id'))
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False)
     mandatory = Column("mandatory", Boolean(), nullable=False, default=False)
     user = relationship('User')
 
     def rule_data(self):
         return {
             'mandatory': self.mandatory
         }
 
 
 class RepoReviewRuleUserGroup(Base, BaseModel):
     __tablename__ = 'repo_review_rules_users_groups'
     __table_args__ = (
         base_table_args
     )
 
     VOTE_RULE_ALL = -1
 
     repo_review_rule_users_group_id = Column('repo_review_rule_users_group_id', Integer(), primary_key=True)
     repo_review_rule_id = Column("repo_review_rule_id", Integer(), ForeignKey('repo_review_rules.repo_review_rule_id'))
     users_group_id = Column("users_group_id", Integer(),ForeignKey('users_groups.users_group_id'), nullable=False)
     mandatory = Column("mandatory", Boolean(), nullable=False, default=False)
     vote_rule = Column("vote_rule", Integer(), nullable=True, default=VOTE_RULE_ALL)
     users_group = relationship('UserGroup')
 
     def rule_data(self):
         return {
             'mandatory': self.mandatory,
             'vote_rule': self.vote_rule
         }
 
     @property
     def vote_rule_label(self):
         if not self.vote_rule or self.vote_rule == self.VOTE_RULE_ALL:
             return 'all must vote'
         else:
             return 'min. vote {}'.format(self.vote_rule)
 
 
 class RepoReviewRule(Base, BaseModel):
     __tablename__ = 'repo_review_rules'
     __table_args__ = (
         base_table_args
     )
 
     repo_review_rule_id = Column(
         'repo_review_rule_id', Integer(), primary_key=True)
     repo_id = Column(
         "repo_id", Integer(), ForeignKey('repositories.repo_id'))
     repo = relationship('Repository', backref='review_rules')
 
     review_rule_name = Column('review_rule_name', String(255))
     _branch_pattern = Column("branch_pattern", UnicodeText().with_variant(UnicodeText(255), 'mysql'), default=u'*')  # glob
     _target_branch_pattern = Column("target_branch_pattern", UnicodeText().with_variant(UnicodeText(255), 'mysql'), default=u'*')  # glob
     _file_pattern = Column("file_pattern", UnicodeText().with_variant(UnicodeText(255), 'mysql'), default=u'*')  # glob
 
     use_authors_for_review = Column("use_authors_for_review", Boolean(), nullable=False, default=False)
     forbid_author_to_review = Column("forbid_author_to_review", Boolean(), nullable=False, default=False)
     forbid_commit_author_to_review = Column("forbid_commit_author_to_review", Boolean(), nullable=False, default=False)
     forbid_adding_reviewers = Column("forbid_adding_reviewers", Boolean(), nullable=False, default=False)
 
     rule_users = relationship('RepoReviewRuleUser')
     rule_user_groups = relationship('RepoReviewRuleUserGroup')
 
     def _validate_pattern(self, value):
         re.compile('^' + glob2re(value) + '$')
 
     @hybrid_property
     def source_branch_pattern(self):
         return self._branch_pattern or '*'
 
     @source_branch_pattern.setter
     def source_branch_pattern(self, value):
         self._validate_pattern(value)
         self._branch_pattern = value or '*'
 
     @hybrid_property
     def target_branch_pattern(self):
         return self._target_branch_pattern or '*'
 
     @target_branch_pattern.setter
     def target_branch_pattern(self, value):
         self._validate_pattern(value)
         self._target_branch_pattern = value or '*'
 
     @hybrid_property
     def file_pattern(self):
         return self._file_pattern or '*'
 
     @file_pattern.setter
     def file_pattern(self, value):
         self._validate_pattern(value)
         self._file_pattern = value or '*'
 
     def matches(self, source_branch, target_branch, files_changed):
         """
         Check if this review rule matches a branch/files in a pull request
 
         :param source_branch: source branch name for the commit
         :param target_branch: target branch name for the commit
         :param files_changed: list of file paths changed in the pull request
         """
 
         source_branch = source_branch or ''
         target_branch = target_branch or ''
         files_changed = files_changed or []
 
         branch_matches = True
         if source_branch or target_branch:
             if self.source_branch_pattern == '*':
                 source_branch_match = True
             else:
                 if self.source_branch_pattern.startswith('re:'):
                     source_pattern = self.source_branch_pattern[3:]
                 else:
                     source_pattern = '^' + glob2re(self.source_branch_pattern) + '$'
                 source_branch_regex = re.compile(source_pattern)
                 source_branch_match = bool(source_branch_regex.search(source_branch))
             if self.target_branch_pattern == '*':
                 target_branch_match = True
             else:
                 if self.target_branch_pattern.startswith('re:'):
                     target_pattern = self.target_branch_pattern[3:]
                 else:
                     target_pattern = '^' + glob2re(self.target_branch_pattern) + '$'
                 target_branch_regex = re.compile(target_pattern)
                 target_branch_match = bool(target_branch_regex.search(target_branch))
 
             branch_matches = source_branch_match and target_branch_match
 
         files_matches = True
         if self.file_pattern != '*':
             files_matches = False
             if self.file_pattern.startswith('re:'):
                 file_pattern = self.file_pattern[3:]
             else:
                 file_pattern = glob2re(self.file_pattern)
             file_regex = re.compile(file_pattern)
             for filename in files_changed:
                 if file_regex.search(filename):
                     files_matches = True
                     break
 
         return branch_matches and files_matches
 
     @property
     def review_users(self):
         """ Returns the users which this rule applies to """
 
         users = collections.OrderedDict()
 
         for rule_user in self.rule_users:
             if rule_user.user.active:
                 if rule_user.user not in users:
                     users[rule_user.user.username] = {
                         'user': rule_user.user,
                         'source': 'user',
                         'source_data': {},
                         'data': rule_user.rule_data()
                     }
 
         for rule_user_group in self.rule_user_groups:
             source_data = {
                 'user_group_id': rule_user_group.users_group.users_group_id,
                 'name': rule_user_group.users_group.users_group_name,
                 'members': len(rule_user_group.users_group.members)
             }
             for member in rule_user_group.users_group.members:
                 if member.user.active:
                     key = member.user.username
                     if key in users:
                         # skip this member as we have him already
                         # this prevents from override the "first" matched
                         # users with duplicates in multiple groups
                         continue
 
                     users[key] = {
                         'user': member.user,
                         'source': 'user_group',
                         'source_data': source_data,
                         'data': rule_user_group.rule_data()
                     }
 
         return users
 
     def user_group_vote_rule(self, user_id):
 
         rules = []
         if not self.rule_user_groups:
             return rules
 
         for user_group in self.rule_user_groups:
             user_group_members = [x.user_id for x in user_group.users_group.members]
             if user_id in user_group_members:
                 rules.append(user_group)
         return rules
 
     def __repr__(self):
         return '<RepoReviewerRule(id=%r, repo=%r)>' % (
             self.repo_review_rule_id, self.repo)
 
 
 class ScheduleEntry(Base, BaseModel):
     __tablename__ = 'schedule_entries'
     __table_args__ = (
         UniqueConstraint('schedule_name', name='s_schedule_name_idx'),
         UniqueConstraint('task_uid', name='s_task_uid_idx'),
         base_table_args,
     )
 
     schedule_types = ['crontab', 'timedelta', 'integer']
     schedule_entry_id = Column('schedule_entry_id', Integer(), primary_key=True)
 
     schedule_name = Column("schedule_name", String(255), nullable=False, unique=None, default=None)
     schedule_description = Column("schedule_description", String(10000), nullable=True, unique=None, default=None)
     schedule_enabled = Column("schedule_enabled", Boolean(), nullable=False, unique=None, default=True)
 
     _schedule_type = Column("schedule_type", String(255), nullable=False, unique=None, default=None)
     schedule_definition = Column('schedule_definition_json', MutationObj.as_mutable(JsonType(default=lambda: "", dialect_map=dict(mysql=LONGTEXT()))))
 
     schedule_last_run = Column('schedule_last_run', DateTime(timezone=False), nullable=True, unique=None, default=None)
     schedule_total_run_count = Column('schedule_total_run_count', Integer(), nullable=True, unique=None, default=0)
 
     # task
     task_uid = Column("task_uid", String(255), nullable=False, unique=None, default=None)
     task_dot_notation = Column("task_dot_notation", String(4096), nullable=False, unique=None, default=None)
     task_args = Column('task_args_json', MutationObj.as_mutable(JsonType(default=list, dialect_map=dict(mysql=LONGTEXT()))))
     task_kwargs = Column('task_kwargs_json', MutationObj.as_mutable(JsonType(default=dict, dialect_map=dict(mysql=LONGTEXT()))))
 
     created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
     updated_on = Column('updated_on', DateTime(timezone=False), nullable=True, unique=None, default=None)
 
     @hybrid_property
     def schedule_type(self):
         return self._schedule_type
 
     @schedule_type.setter
     def schedule_type(self, val):
         if val not in self.schedule_types:
             raise ValueError('Value must be on of `{}` and got `{}`'.format(
                 val, self.schedule_type))
 
         self._schedule_type = val
 
     @classmethod
     def get_uid(cls, obj):
         args = obj.task_args
         kwargs = obj.task_kwargs
         if isinstance(args, JsonRaw):
             try:
                 args = json.loads(args)
             except ValueError:
                 args = tuple()
 
         if isinstance(kwargs, JsonRaw):
             try:
                 kwargs = json.loads(kwargs)
             except ValueError:
                 kwargs = dict()
 
         dot_notation = obj.task_dot_notation
         val = '.'.join(map(safe_str, [
             sorted(dot_notation), args, sorted(kwargs.items())]))
         return hashlib.sha1(val).hexdigest()
 
     @classmethod
     def get_by_schedule_name(cls, schedule_name):
         return cls.query().filter(cls.schedule_name == schedule_name).scalar()
 
     @classmethod
     def get_by_schedule_id(cls, schedule_id):
         return cls.query().filter(cls.schedule_entry_id == schedule_id).scalar()
 
     @property
     def task(self):
         return self.task_dot_notation
 
     @property
     def schedule(self):
         from rhodecode.lib.celerylib.utils import raw_2_schedule
         schedule = raw_2_schedule(self.schedule_definition, self.schedule_type)
         return schedule
 
     @property
     def args(self):
         try:
             return list(self.task_args or [])
         except ValueError:
             return list()
 
     @property
     def kwargs(self):
         try:
             return dict(self.task_kwargs or {})
         except ValueError:
             return dict()
 
     def _as_raw(self, val):
         if hasattr(val, 'de_coerce'):
             val = val.de_coerce()
             if val:
                 val = json.dumps(val)
 
         return val
 
     @property
     def schedule_definition_raw(self):
         return self._as_raw(self.schedule_definition)
 
     @property
     def args_raw(self):
         return self._as_raw(self.task_args)
 
     @property
     def kwargs_raw(self):
         return self._as_raw(self.task_kwargs)
 
     def __repr__(self):
         return '<DB:ScheduleEntry({}:{})>'.format(
             self.schedule_entry_id, self.schedule_name)
 
 
 @event.listens_for(ScheduleEntry, 'before_update')
 def update_task_uid(mapper, connection, target):
     target.task_uid = ScheduleEntry.get_uid(target)
 
 
 @event.listens_for(ScheduleEntry, 'before_insert')
 def set_task_uid(mapper, connection, target):
     target.task_uid = ScheduleEntry.get_uid(target)
 
 
 class _BaseBranchPerms(BaseModel):
     @classmethod
     def compute_hash(cls, value):
         return sha1_safe(value)
 
     @hybrid_property
     def branch_pattern(self):
         return self._branch_pattern or '*'
 
     @hybrid_property
     def branch_hash(self):
         return self._branch_hash
 
     def _validate_glob(self, value):
         re.compile('^' + glob2re(value) + '$')
 
     @branch_pattern.setter
     def branch_pattern(self, value):
         self._validate_glob(value)
         self._branch_pattern = value or '*'
         # set the Hash when setting the branch pattern
         self._branch_hash = self.compute_hash(self._branch_pattern)
 
     def matches(self, branch):
         """
         Check if this the branch matches entry
 
         :param branch: branch name for the commit
         """
 
         branch = branch or ''
 
         branch_matches = True
         if branch:
             branch_regex = re.compile('^' + glob2re(self.branch_pattern) + '$')
             branch_matches = bool(branch_regex.search(branch))
 
         return branch_matches
 
 
 class UserToRepoBranchPermission(Base, _BaseBranchPerms):
     __tablename__ = 'user_to_repo_branch_permissions'
     __table_args__ = (
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True,}
     )
 
     branch_rule_id = Column('branch_rule_id', Integer(), primary_key=True)
 
     repository_id = Column('repository_id', Integer(), ForeignKey('repositories.repo_id'), nullable=False, unique=None, default=None)
     repo = relationship('Repository', backref='user_branch_perms')
 
     permission_id = Column('permission_id', Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
     permission = relationship('Permission')
 
     rule_to_perm_id = Column('rule_to_perm_id', Integer(), ForeignKey('repo_to_perm.repo_to_perm_id'), nullable=False, unique=None, default=None)
     user_repo_to_perm = relationship('UserRepoToPerm')
 
     rule_order = Column('rule_order', Integer(), nullable=False)
     _branch_pattern = Column('branch_pattern', UnicodeText().with_variant(UnicodeText(2048), 'mysql'), default=u'*')  # glob
     _branch_hash = Column('branch_hash', UnicodeText().with_variant(UnicodeText(2048), 'mysql'))
 
     def __unicode__(self):
         return u'<UserBranchPermission(%s => %r)>' % (
             self.user_repo_to_perm, self.branch_pattern)
 
 
 class UserGroupToRepoBranchPermission(Base, _BaseBranchPerms):
     __tablename__ = 'user_group_to_repo_branch_permissions'
     __table_args__ = (
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True,}
     )
 
     branch_rule_id = Column('branch_rule_id', Integer(), primary_key=True)
 
     repository_id = Column('repository_id', Integer(), ForeignKey('repositories.repo_id'), nullable=False, unique=None, default=None)
     repo = relationship('Repository', backref='user_group_branch_perms')
 
     permission_id = Column('permission_id', Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
     permission = relationship('Permission')
 
     rule_to_perm_id = Column('rule_to_perm_id', Integer(), ForeignKey('users_group_repo_to_perm.users_group_to_perm_id'), nullable=False, unique=None, default=None)
     user_group_repo_to_perm = relationship('UserGroupRepoToPerm')
 
     rule_order = Column('rule_order', Integer(), nullable=False)
     _branch_pattern = Column('branch_pattern', UnicodeText().with_variant(UnicodeText(2048), 'mysql'), default=u'*')  # glob
     _branch_hash = Column('branch_hash', UnicodeText().with_variant(UnicodeText(2048), 'mysql'))
 
     def __unicode__(self):
         return u'<UserBranchPermission(%s => %r)>' % (
             self.user_group_repo_to_perm, self.branch_pattern)
 
 
 class UserBookmark(Base, BaseModel):
     __tablename__ = 'user_bookmarks'
     __table_args__ = (
         UniqueConstraint('user_id', 'bookmark_repo_id'),
         UniqueConstraint('user_id', 'bookmark_repo_group_id'),
         UniqueConstraint('user_id', 'bookmark_position'),
         base_table_args
     )
 
     user_bookmark_id = Column("user_bookmark_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)
     position = Column("bookmark_position", Integer(), nullable=False)
     title = Column("bookmark_title", String(255), nullable=True, unique=None, default=None)
     redirect_url = Column("bookmark_redirect_url", String(10240), nullable=True, unique=None, default=None)
     created_on = Column("created_on", DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
 
     bookmark_repo_id = Column("bookmark_repo_id", Integer(), ForeignKey("repositories.repo_id"), nullable=True, unique=None, default=None)
     bookmark_repo_group_id = Column("bookmark_repo_group_id", Integer(), ForeignKey("groups.group_id"), nullable=True, unique=None, default=None)
 
     user = relationship("User")
 
     repository = relationship("Repository")
     repository_group = relationship("RepoGroup")
 
     @classmethod
     def get_by_position_for_user(cls, position, user_id):
         return cls.query() \
             .filter(UserBookmark.user_id == user_id) \
             .filter(UserBookmark.position == position).scalar()
 
     @classmethod
     def get_bookmarks_for_user(cls, user_id):
         return cls.query() \
             .filter(UserBookmark.user_id == user_id) \
             .options(joinedload(UserBookmark.repository)) \
             .options(joinedload(UserBookmark.repository_group)) \
             .order_by(UserBookmark.position.asc()) \
             .all()
 
     def __unicode__(self):
         return u'<UserBookmark(%d @ %r)>' % (self.position, self.redirect_url)
 
 
 class FileStore(Base, BaseModel):
     __tablename__ = 'file_store'
     __table_args__ = (
         base_table_args
     )
 
     file_store_id = Column('file_store_id', Integer(), primary_key=True)
     file_uid = Column('file_uid', String(1024), nullable=False)
     file_display_name = Column('file_display_name', UnicodeText().with_variant(UnicodeText(2048), 'mysql'), nullable=True)
     file_description = Column('file_description', UnicodeText().with_variant(UnicodeText(10240), 'mysql'), nullable=True)
     file_org_name = Column('file_org_name', UnicodeText().with_variant(UnicodeText(10240), 'mysql'), nullable=False)
 
     # sha256 hash
     file_hash = Column('file_hash', String(512), nullable=False)
     file_size = Column('file_size', Integer(), nullable=False)
 
     created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
     accessed_on = Column('accessed_on', DateTime(timezone=False), nullable=True)
     accessed_count = Column('accessed_count', Integer(), default=0)
 
     enabled = Column('enabled', Boolean(), nullable=False, default=True)
 
     # if repo/repo_group reference is set, check for permissions
     check_acl = Column('check_acl', Boolean(), nullable=False, default=True)
 
     # hidden defines an attachment that should be hidden from showing in artifact listing
     hidden = Column('hidden', Boolean(), nullable=False, default=False)
 
     user_id = Column('user_id', Integer(), ForeignKey('users.user_id'), nullable=False)
     upload_user = relationship('User', lazy='joined', primaryjoin='User.user_id==FileStore.user_id')
 
     # scope limited to user, which requester have access to
     scope_user_id = Column(
         'scope_user_id', Integer(), ForeignKey('users.user_id'),
         nullable=True, unique=None, default=None)
     user = relationship('User', lazy='joined', primaryjoin='User.user_id==FileStore.scope_user_id')
 
     # scope limited to user group, which requester have access to
     scope_user_group_id = Column(
         'scope_user_group_id', Integer(), ForeignKey('users_groups.users_group_id'),
         nullable=True, unique=None, default=None)
     user_group = relationship('UserGroup', lazy='joined')
 
     # scope limited to repo, which requester have access to
     scope_repo_id = Column(
         'scope_repo_id', Integer(), ForeignKey('repositories.repo_id'),
         nullable=True, unique=None, default=None)
     repo = relationship('Repository', lazy='joined')
 
     # scope limited to repo group, which requester have access to
     scope_repo_group_id = Column(
         'scope_repo_group_id', Integer(), ForeignKey('groups.group_id'),
         nullable=True, unique=None, default=None)
     repo_group = relationship('RepoGroup', lazy='joined')
 
     @classmethod
     def create(cls, file_uid, filename, file_hash, file_size, file_display_name='',
                file_description='', enabled=True, hidden=False, check_acl=True,
                user_id=None, scope_user_id=None, scope_repo_id=None, scope_repo_group_id=None):
 
         store_entry = FileStore()
         store_entry.file_uid = file_uid
         store_entry.file_display_name = file_display_name
         store_entry.file_org_name = filename
         store_entry.file_size = file_size
         store_entry.file_hash = file_hash
         store_entry.file_description = file_description
 
         store_entry.check_acl = check_acl
         store_entry.enabled = enabled
         store_entry.hidden = hidden
 
         store_entry.user_id = user_id
         store_entry.scope_user_id = scope_user_id
         store_entry.scope_repo_id = scope_repo_id
         store_entry.scope_repo_group_id = scope_repo_group_id
 
         return store_entry
 
     @classmethod
     def bump_access_counter(cls, file_uid, commit=True):
         FileStore().query()\
             .filter(FileStore.file_uid == file_uid)\
             .update({FileStore.accessed_count: (FileStore.accessed_count + 1),
                      FileStore.accessed_on: datetime.datetime.now()})
         if commit:
             Session().commit()
 
     def __repr__(self):
         return '<FileStore({})>'.format(self.file_store_id)
 
 
 class DbMigrateVersion(Base, BaseModel):
     __tablename__ = 'db_migrate_version'
     __table_args__ = (
         base_table_args,
     )
 
     repository_id = Column('repository_id', String(250), primary_key=True)
     repository_path = Column('repository_path', Text)
     version = Column('version', Integer)
 
     @classmethod
     def set_version(cls, version):
         """
         Helper for forcing a different version, usually for debugging purposes via ishell.
         """
         ver = DbMigrateVersion.query().first()
         ver.version = version
         Session().commit()
 
 
 class DbSession(Base, BaseModel):
     __tablename__ = 'db_session'
     __table_args__ = (
         base_table_args,
     )
 
     def __repr__(self):
         return '<DB:DbSession({})>'.format(self.id)
 
     id = Column('id', Integer())
     namespace = Column('namespace', String(255), primary_key=True)
     accessed = Column('accessed', DateTime, nullable=False)
     created = Column('created', DateTime, nullable=False)
     data = Column('data', PickleType, nullable=False)

rhodecode/model/user.py

@@ -1,946 +1,945 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2019 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 users model for RhodeCode
 """
 
 import logging
 import traceback
 import datetime
 import ipaddress
 
 from pyramid.threadlocal import get_current_request
 from sqlalchemy.exc import DatabaseError
 
 from rhodecode import events
 from rhodecode.lib.user_log_filter import user_log_filter
 from rhodecode.lib.utils2 import (
     safe_unicode, get_current_rhodecode_user, action_logger_generic,
     AttributeDict, str2bool)
 from rhodecode.lib.exceptions import (
     DefaultUserException, UserOwnsReposException, UserOwnsRepoGroupsException,
     UserOwnsUserGroupsException, NotAllowedToCreateUserError)
 from rhodecode.lib.caching_query import FromCache
 from rhodecode.model import BaseModel
 from rhodecode.model.auth_token import AuthTokenModel
 from rhodecode.model.db import (
     _hash_key, true, false, or_, joinedload, User, UserToPerm,
     UserEmailMap, UserIpMap, UserLog)
 from rhodecode.model.meta import Session
 from rhodecode.model.repo_group import RepoGroupModel
 
 
 log = logging.getLogger(__name__)
 
 
 class UserModel(BaseModel):
     cls = User
 
     def get(self, user_id, cache=False):
         user = self.sa.query(User)
         if cache:
             user = user.options(
                 FromCache("sql_cache_short", "get_user_%s" % user_id))
         return user.get(user_id)
 
     def get_user(self, user):
         return self._get_user(user)
 
     def _serialize_user(self, user):
         import rhodecode.lib.helpers as h
 
         return {
             'id': user.user_id,
             'first_name': user.first_name,
             'last_name': user.last_name,
             'username': user.username,
             'email': user.email,
             'icon_link': h.gravatar_url(user.email, 30),
             'profile_link':  h.link_to_user(user),
             'value_display': h.escape(h.person(user)),
             'value': user.username,
             'value_type': 'user',
             'active': user.active,
         }
 
     def get_users(self, name_contains=None, limit=20, only_active=True):
 
         query = self.sa.query(User)
         if only_active:
             query = query.filter(User.active == true())
 
         if name_contains:
             ilike_expression = u'%{}%'.format(safe_unicode(name_contains))
             query = query.filter(
                 or_(
                     User.name.ilike(ilike_expression),
                     User.lastname.ilike(ilike_expression),
                     User.username.ilike(ilike_expression)
                 )
             )
             query = query.limit(limit)
         users = query.all()
 
         _users = [
             self._serialize_user(user) for user in users
         ]
         return _users
 
     def get_by_username(self, username, cache=False, case_insensitive=False):
 
         if case_insensitive:
             user = self.sa.query(User).filter(User.username.ilike(username))
         else:
             user = self.sa.query(User)\
                 .filter(User.username == username)
         if cache:
             name_key = _hash_key(username)
             user = user.options(
                 FromCache("sql_cache_short", "get_user_%s" % name_key))
         return user.scalar()
 
     def get_by_email(self, email, cache=False, case_insensitive=False):
         return User.get_by_email(email, case_insensitive, cache)
 
     def get_by_auth_token(self, auth_token, cache=False):
         return User.get_by_auth_token(auth_token, cache)
 
     def get_active_user_count(self, cache=False):
         qry = User.query().filter(
             User.active == true()).filter(
                 User.username != User.DEFAULT_USER)
         if cache:
             qry = qry.options(
                 FromCache("sql_cache_short", "get_active_users"))
         return qry.count()
 
     def create(self, form_data, cur_user=None):
         if not cur_user:
             cur_user = getattr(get_current_rhodecode_user(), 'username', None)
 
         user_data = {
             'username': form_data['username'],
             'password': form_data['password'],
             'email': form_data['email'],
             'firstname': form_data['firstname'],
             'lastname': form_data['lastname'],
             'active': form_data['active'],
             'extern_type': form_data['extern_type'],
             'extern_name': form_data['extern_name'],
             'admin': False,
             'cur_user': cur_user
         }
 
         if 'create_repo_group' in form_data:
             user_data['create_repo_group'] = str2bool(
                 form_data.get('create_repo_group'))
 
         try:
             if form_data.get('password_change'):
                 user_data['force_password_change'] = True
             return UserModel().create_or_update(**user_data)
         except Exception:
             log.error(traceback.format_exc())
             raise
 
     def update_user(self, user, skip_attrs=None, **kwargs):
         from rhodecode.lib.auth import get_crypt_password
 
         user = self._get_user(user)
         if user.username == User.DEFAULT_USER:
             raise DefaultUserException(
                 "You can't edit this user (`%(username)s`) since it's "
                 "crucial for entire application" % {
                 'username': user.username})
 
         # first store only defaults
         user_attrs = {
             'updating_user_id': user.user_id,
             'username': user.username,
             'password': user.password,
             'email': user.email,
             'firstname': user.name,
             'lastname': user.lastname,
             'active': user.active,
             'admin': user.admin,
             'extern_name': user.extern_name,
             'extern_type': user.extern_type,
             'language': user.user_data.get('language')
         }
 
         # in case there's new_password, that comes from form, use it to
         # store password
         if kwargs.get('new_password'):
             kwargs['password'] = kwargs['new_password']
 
         # cleanups, my_account password change form
         kwargs.pop('current_password', None)
         kwargs.pop('new_password', None)
 
         # cleanups, user edit password change form
         kwargs.pop('password_confirmation', None)
         kwargs.pop('password_change', None)
 
         # create repo group on user creation
         kwargs.pop('create_repo_group', None)
 
         # legacy forms send name, which is the firstname
         firstname = kwargs.pop('name', None)
         if firstname:
             kwargs['firstname'] = firstname
 
         for k, v in kwargs.items():
             # skip if we don't want to update this
             if skip_attrs and k in skip_attrs:
                 continue
 
             user_attrs[k] = v
 
         try:
             return self.create_or_update(**user_attrs)
         except Exception:
             log.error(traceback.format_exc())
             raise
 
     def create_or_update(
             self, username, password, email, firstname='', lastname='',
             active=True, admin=False, extern_type=None, extern_name=None,
             cur_user=None, plugin=None, force_password_change=False,
             allow_to_create_user=True, create_repo_group=None,
             updating_user_id=None, language=None, strict_creation_check=True):
         """
         Creates a new instance if not found, or updates current one
 
         :param username:
         :param password:
         :param email:
         :param firstname:
         :param lastname:
         :param active:
         :param admin:
         :param extern_type:
         :param extern_name:
         :param cur_user:
         :param plugin: optional plugin this method was called from
         :param force_password_change: toggles new or existing user flag
             for password change
         :param allow_to_create_user: Defines if the method can actually create
             new users
         :param create_repo_group: Defines if the method should also
             create an repo group with user name, and owner
         :param updating_user_id: if we set it up this is the user we want to
             update this allows to editing username.
         :param language: language of user from interface.
 
         :returns: new User object with injected `is_new_user` attribute.
         """
 
         if not cur_user:
             cur_user = getattr(get_current_rhodecode_user(), 'username', None)
 
         from rhodecode.lib.auth import (
             get_crypt_password, check_password, generate_auth_token)
         from rhodecode.lib.hooks_base import (
             log_create_user, check_allowed_create_user)
 
         def _password_change(new_user, password):
             old_password = new_user.password or ''
             # empty password
             if not old_password:
                 return False
 
             # password check is only needed for RhodeCode internal auth calls
             # in case it's a plugin we don't care
             if not plugin:
 
                 # first check if we gave crypted password back, and if it
                 # matches it's not password change
                 if new_user.password == password:
                     return False
 
                 password_match = check_password(password, old_password)
                 if not password_match:
                     return True
 
             return False
 
         # read settings on default personal repo group creation
         if create_repo_group is None:
             default_create_repo_group = RepoGroupModel()\
                 .get_default_create_personal_repo_group()
             create_repo_group = default_create_repo_group
 
         user_data = {
             'username': username,
             'password': password,
             'email': email,
             'firstname': firstname,
             'lastname': lastname,
             'active': active,
             'admin': admin
         }
 
         if updating_user_id:
             log.debug('Checking for existing account in RhodeCode '
                       'database with user_id `%s` ', updating_user_id)
             user = User.get(updating_user_id)
         else:
             log.debug('Checking for existing account in RhodeCode '
                       'database with username `%s` ', username)
             user = User.get_by_username(username, case_insensitive=True)
 
         if user is None:
             # we check internal flag if this method is actually allowed to
             # create new user
             if not allow_to_create_user:
                 msg = ('Method wants to create new user, but it is not '
                        'allowed to do so')
                 log.warning(msg)
                 raise NotAllowedToCreateUserError(msg)
 
             log.debug('Creating new user %s', username)
 
             # only if we create user that is active
             new_active_user = active
             if new_active_user and strict_creation_check:
                 # raises UserCreationError if it's not allowed for any reason to
                 # create new active user, this also executes pre-create hooks
                 check_allowed_create_user(user_data, cur_user, strict_check=True)
             events.trigger(events.UserPreCreate(user_data))
             new_user = User()
             edit = False
         else:
             log.debug('updating user `%s`', username)
             events.trigger(events.UserPreUpdate(user, user_data))
             new_user = user
             edit = True
 
             # we're not allowed to edit default user
             if user.username == User.DEFAULT_USER:
                 raise DefaultUserException(
                     "You can't edit this user (`%(username)s`) since it's "
                     "crucial for entire application"
                     % {'username': user.username})
 
         # inject special attribute that will tell us if User is new or old
         new_user.is_new_user = not edit
         # for users that didn's specify auth type, we use RhodeCode built in
         from rhodecode.authentication.plugins import auth_rhodecode
         extern_name = extern_name or auth_rhodecode.RhodeCodeAuthPlugin.uid
         extern_type = extern_type or auth_rhodecode.RhodeCodeAuthPlugin.uid
 
         try:
             new_user.username = username
             new_user.admin = admin
             new_user.email = email
             new_user.active = active
             new_user.extern_name = safe_unicode(extern_name)
             new_user.extern_type = safe_unicode(extern_type)
             new_user.name = firstname
             new_user.lastname = lastname
 
             # set password only if creating an user or password is changed
             if not edit or _password_change(new_user, password):
                 reason = 'new password' if edit else 'new user'
                 log.debug('Updating password reason=>%s', reason)
                 new_user.password = get_crypt_password(password) if password else None
 
             if force_password_change:
                 new_user.update_userdata(force_password_change=True)
             if language:
                 new_user.update_userdata(language=language)
             new_user.update_userdata(notification_status=True)
 
             self.sa.add(new_user)
 
             if not edit and create_repo_group:
                 RepoGroupModel().create_personal_repo_group(
                     new_user, commit_early=False)
 
             if not edit:
                 # add the RSS token
                 self.add_auth_token(
                     user=username, lifetime_minutes=-1,
                     role=self.auth_token_role.ROLE_FEED,
                     description=u'Generated feed token')
 
                 kwargs = new_user.get_dict()
                 # backward compat, require api_keys present
                 kwargs['api_keys'] = kwargs['auth_tokens']
                 log_create_user(created_by=cur_user, **kwargs)
                 events.trigger(events.UserPostCreate(user_data))
             return new_user
         except (DatabaseError,):
             log.error(traceback.format_exc())
             raise
 
     def create_registration(self, form_data,
                             extern_name='rhodecode', extern_type='rhodecode'):
         from rhodecode.model.notification import NotificationModel
         from rhodecode.model.notification import EmailNotificationModel
 
         try:
             form_data['admin'] = False
             form_data['extern_name'] = extern_name
             form_data['extern_type'] = extern_type
             new_user = self.create(form_data)
 
             self.sa.add(new_user)
             self.sa.flush()
 
             user_data = new_user.get_dict()
             kwargs = {
                 # use SQLALCHEMY safe dump of user data
                 'user': AttributeDict(user_data),
                 'date': datetime.datetime.now()
             }
             notification_type = EmailNotificationModel.TYPE_REGISTRATION
             # pre-generate the subject for notification itself
             (subject,
              _h, _e,  # we don't care about those
              body_plaintext) = EmailNotificationModel().render_email(
                 notification_type, **kwargs)
 
             # create notification objects, and emails
             NotificationModel().create(
                 created_by=new_user,
                 notification_subject=subject,
                 notification_body=body_plaintext,
                 notification_type=notification_type,
                 recipients=None,  # all admins
                 email_kwargs=kwargs,
             )
 
             return new_user
         except Exception:
             log.error(traceback.format_exc())
             raise
 
     def _handle_user_repos(self, username, repositories, handle_mode=None):
         _superadmin = self.cls.get_first_super_admin()
         left_overs = True
 
         from rhodecode.model.repo import RepoModel
 
         if handle_mode == 'detach':
             for obj in repositories:
                 obj.user = _superadmin
                 # set description we know why we super admin now owns
                 # additional repositories that were orphaned !
                 obj.description += '  \n::detached repository from deleted user: %s' % (username,)
                 self.sa.add(obj)
             left_overs = False
         elif handle_mode == 'delete':
             for obj in repositories:
                 RepoModel().delete(obj, forks='detach')
             left_overs = False
 
         # if nothing is done we have left overs left
         return left_overs
 
     def _handle_user_repo_groups(self, username, repository_groups,
                                  handle_mode=None):
         _superadmin = self.cls.get_first_super_admin()
         left_overs = True
 
         from rhodecode.model.repo_group import RepoGroupModel
 
         if handle_mode == 'detach':
             for r in repository_groups:
                 r.user = _superadmin
                 # set description we know why we super admin now owns
                 # additional repositories that were orphaned !
                 r.group_description += '  \n::detached repository group from deleted user: %s' % (username,)
                 r.personal = False
                 self.sa.add(r)
             left_overs = False
         elif handle_mode == 'delete':
             for r in repository_groups:
                 RepoGroupModel().delete(r)
             left_overs = False
 
         # if nothing is done we have left overs left
         return left_overs
 
     def _handle_user_user_groups(self, username, user_groups, handle_mode=None):
         _superadmin = self.cls.get_first_super_admin()
         left_overs = True
 
         from rhodecode.model.user_group import UserGroupModel
 
         if handle_mode == 'detach':
             for r in user_groups:
                 for user_user_group_to_perm in r.user_user_group_to_perm:
                     if user_user_group_to_perm.user.username == username:
                         user_user_group_to_perm.user = _superadmin
                 r.user = _superadmin
                 # set description we know why we super admin now owns
                 # additional repositories that were orphaned !
                 r.user_group_description += '  \n::detached user group from deleted user: %s' % (username,)
                 self.sa.add(r)
             left_overs = False
         elif handle_mode == 'delete':
             for r in user_groups:
                 UserGroupModel().delete(r)
             left_overs = False
 
         # if nothing is done we have left overs left
         return left_overs
 
     def delete(self, user, cur_user=None, handle_repos=None,
                handle_repo_groups=None, handle_user_groups=None):
         from rhodecode.lib.hooks_base import log_delete_user
 
         if not cur_user:
-            cur_user = getattr(
-                get_current_rhodecode_user(), 'username', None)
+            cur_user = getattr(get_current_rhodecode_user(), 'username', None)
         user = self._get_user(user)
 
         try:
             if user.username == User.DEFAULT_USER:
                 raise DefaultUserException(
                     u"You can't remove this user since it's"
                     u" crucial for entire application")
 
             left_overs = self._handle_user_repos(
                 user.username, user.repositories, handle_repos)
             if left_overs and user.repositories:
                 repos = [x.repo_name for x in user.repositories]
                 raise UserOwnsReposException(
                     u'user "%(username)s" still owns %(len_repos)s repositories and cannot be '
                     u'removed. Switch owners or remove those repositories:%(list_repos)s'
                     % {'username': user.username, 'len_repos': len(repos),
                        'list_repos': ', '.join(repos)})
 
             left_overs = self._handle_user_repo_groups(
                 user.username, user.repository_groups, handle_repo_groups)
             if left_overs and user.repository_groups:
                 repo_groups = [x.group_name for x in user.repository_groups]
                 raise UserOwnsRepoGroupsException(
                     u'user "%(username)s" still owns %(len_repo_groups)s repository groups and cannot be '
                     u'removed. Switch owners or remove those repository groups:%(list_repo_groups)s'
                     % {'username': user.username, 'len_repo_groups': len(repo_groups),
                        'list_repo_groups': ', '.join(repo_groups)})
 
             left_overs = self._handle_user_user_groups(
                 user.username, user.user_groups, handle_user_groups)
             if left_overs and user.user_groups:
                 user_groups = [x.users_group_name for x in user.user_groups]
                 raise UserOwnsUserGroupsException(
                     u'user "%s" still owns %s user groups and cannot be '
                     u'removed. Switch owners or remove those user groups:%s'
                     % (user.username, len(user_groups), ', '.join(user_groups)))
 
             user_data = user.get_dict()  # fetch user data before expire
 
             # we might change the user data with detach/delete, make sure
             # the object is marked as expired before actually deleting !
             self.sa.expire(user)
             self.sa.delete(user)
 
             log_delete_user(deleted_by=cur_user, **user_data)
         except Exception:
             log.error(traceback.format_exc())
             raise
 
     def reset_password_link(self, data, pwd_reset_url):
         from rhodecode.lib.celerylib import tasks, run_task
         from rhodecode.model.notification import EmailNotificationModel
         user_email = data['email']
         try:
             user = User.get_by_email(user_email)
             if user:
                 log.debug('password reset user found %s', user)
 
                 email_kwargs = {
                     'password_reset_url': pwd_reset_url,
                     'user': user,
                     'email': user_email,
                     'date': datetime.datetime.now()
                 }
 
                 (subject, headers, email_body,
                  email_body_plaintext) = EmailNotificationModel().render_email(
                     EmailNotificationModel.TYPE_PASSWORD_RESET, **email_kwargs)
 
                 recipients = [user_email]
 
                 action_logger_generic(
                     'sending password reset email to user: {}'.format(
                         user), namespace='security.password_reset')
 
                 run_task(tasks.send_email, recipients, subject,
                          email_body_plaintext, email_body)
 
             else:
                 log.debug("password reset email %s not found", user_email)
         except Exception:
             log.error(traceback.format_exc())
             return False
 
         return True
 
     def reset_password(self, data):
         from rhodecode.lib.celerylib import tasks, run_task
         from rhodecode.model.notification import EmailNotificationModel
         from rhodecode.lib import auth
         user_email = data['email']
         pre_db = True
         try:
             user = User.get_by_email(user_email)
             new_passwd = auth.PasswordGenerator().gen_password(
                 12, auth.PasswordGenerator.ALPHABETS_BIG_SMALL)
             if user:
                 user.password = auth.get_crypt_password(new_passwd)
                 # also force this user to reset his password !
                 user.update_userdata(force_password_change=True)
 
                 Session().add(user)
 
                 # now delete the token in question
                 UserApiKeys = AuthTokenModel.cls
                 UserApiKeys().query().filter(
                     UserApiKeys.api_key == data['token']).delete()
 
                 Session().commit()
                 log.info('successfully reset password for `%s`', user_email)
 
             if new_passwd is None:
                 raise Exception('unable to generate new password')
 
             pre_db = False
 
             email_kwargs = {
                 'new_password': new_passwd,
                 'user': user,
                 'email': user_email,
                 'date': datetime.datetime.now()
             }
 
             (subject, headers, email_body,
              email_body_plaintext) = EmailNotificationModel().render_email(
                 EmailNotificationModel.TYPE_PASSWORD_RESET_CONFIRMATION,
                 **email_kwargs)
 
             recipients = [user_email]
 
             action_logger_generic(
                 'sent new password to user: {} with email: {}'.format(
                     user, user_email), namespace='security.password_reset')
 
             run_task(tasks.send_email, recipients, subject,
                      email_body_plaintext, email_body)
 
         except Exception:
             log.error('Failed to update user password')
             log.error(traceback.format_exc())
             if pre_db:
                 # we rollback only if local db stuff fails. If it goes into
                 # run_task, we're pass rollback state this wouldn't work then
                 Session().rollback()
 
         return True
 
     def fill_data(self, auth_user, user_id=None, api_key=None, username=None):
         """
         Fetches auth_user by user_id,or api_key if present.
         Fills auth_user attributes with those taken from database.
         Additionally set's is_authenitated if lookup fails
         present in database
 
         :param auth_user: instance of user to set attributes
         :param user_id: user id to fetch by
         :param api_key: api key to fetch by
         :param username: username to fetch by
         """
         def token_obfuscate(token):
             if token:
                 return token[:4] + "****"
 
         if user_id is None and api_key is None and username is None:
             raise Exception('You need to pass user_id, api_key or username')
 
         log.debug(
             'AuthUser: fill data execution based on: '
             'user_id:%s api_key:%s username:%s', user_id, api_key, username)
         try:
             dbuser = None
             if user_id:
                 dbuser = self.get(user_id)
             elif api_key:
                 dbuser = self.get_by_auth_token(api_key)
             elif username:
                 dbuser = self.get_by_username(username)
 
             if not dbuser:
                 log.warning(
                     'Unable to lookup user by id:%s api_key:%s username:%s',
                     user_id, token_obfuscate(api_key), username)
                 return False
             if not dbuser.active:
                 log.debug('User `%s:%s` is inactive, skipping fill data',
                           username, user_id)
                 return False
 
             log.debug('AuthUser: filling found user:%s data', dbuser)
             user_data = dbuser.get_dict()
 
             user_data.update({
                 # set explicit the safe escaped values
                 'first_name': dbuser.first_name,
                 'last_name': dbuser.last_name,
             })
 
             for k, v in user_data.items():
                 # properties of auth user we dont update
                 if k not in ['auth_tokens', 'permissions']:
                     setattr(auth_user, k, v)
 
         except Exception:
             log.error(traceback.format_exc())
             auth_user.is_authenticated = False
             return False
 
         return True
 
     def has_perm(self, user, perm):
         perm = self._get_perm(perm)
         user = self._get_user(user)
 
         return UserToPerm.query().filter(UserToPerm.user == user)\
             .filter(UserToPerm.permission == perm).scalar() is not None
 
     def grant_perm(self, user, perm):
         """
         Grant user global permissions
 
         :param user:
         :param perm:
         """
         user = self._get_user(user)
         perm = self._get_perm(perm)
         # if this permission is already granted skip it
         _perm = UserToPerm.query()\
             .filter(UserToPerm.user == user)\
             .filter(UserToPerm.permission == perm)\
             .scalar()
         if _perm:
             return
         new = UserToPerm()
         new.user = user
         new.permission = perm
         self.sa.add(new)
         return new
 
     def revoke_perm(self, user, perm):
         """
         Revoke users global permissions
 
         :param user:
         :param perm:
         """
         user = self._get_user(user)
         perm = self._get_perm(perm)
 
         obj = UserToPerm.query()\
                 .filter(UserToPerm.user == user)\
                 .filter(UserToPerm.permission == perm)\
                 .scalar()
         if obj:
             self.sa.delete(obj)
 
     def add_extra_email(self, user, email):
         """
         Adds email address to UserEmailMap
 
         :param user:
         :param email:
         """
 
         user = self._get_user(user)
 
         obj = UserEmailMap()
         obj.user = user
         obj.email = email
         self.sa.add(obj)
         return obj
 
     def delete_extra_email(self, user, email_id):
         """
         Removes email address from UserEmailMap
 
         :param user:
         :param email_id:
         """
         user = self._get_user(user)
         obj = UserEmailMap.query().get(email_id)
         if obj and obj.user_id == user.user_id:
             self.sa.delete(obj)
 
     def parse_ip_range(self, ip_range):
         ip_list = []
 
         def make_unique(value):
             seen = []
             return [c for c in value if not (c in seen or seen.append(c))]
 
         # firsts split by commas
         for ip_range in ip_range.split(','):
             if not ip_range:
                 continue
             ip_range = ip_range.strip()
             if '-' in ip_range:
                 start_ip, end_ip = ip_range.split('-', 1)
                 start_ip = ipaddress.ip_address(safe_unicode(start_ip.strip()))
                 end_ip = ipaddress.ip_address(safe_unicode(end_ip.strip()))
                 parsed_ip_range = []
 
                 for index in xrange(int(start_ip), int(end_ip) + 1):
                     new_ip = ipaddress.ip_address(index)
                     parsed_ip_range.append(str(new_ip))
                 ip_list.extend(parsed_ip_range)
             else:
                 ip_list.append(ip_range)
 
         return make_unique(ip_list)
 
     def add_extra_ip(self, user, ip, description=None):
         """
         Adds ip address to UserIpMap
 
         :param user:
         :param ip:
         """
 
         user = self._get_user(user)
         obj = UserIpMap()
         obj.user = user
         obj.ip_addr = ip
         obj.description = description
         self.sa.add(obj)
         return obj
 
     auth_token_role = AuthTokenModel.cls
 
     def add_auth_token(self, user, lifetime_minutes, role, description=u'',
                        scope_callback=None):
         """
         Add AuthToken for user.
 
         :param user: username/user_id
         :param lifetime_minutes: in minutes the lifetime for token, -1 equals no limit
         :param role: one of AuthTokenModel.cls.ROLE_*
         :param description: optional string description
         """
 
         token = AuthTokenModel().create(
             user, description, lifetime_minutes, role)
         if scope_callback and callable(scope_callback):
             # call the callback if we provide, used to attach scope for EE edition
             scope_callback(token)
         return token
 
     def delete_extra_ip(self, user, ip_id):
         """
         Removes ip address from UserIpMap
 
         :param user:
         :param ip_id:
         """
         user = self._get_user(user)
         obj = UserIpMap.query().get(ip_id)
         if obj and obj.user_id == user.user_id:
             self.sa.delete(obj)
 
     def get_accounts_in_creation_order(self, current_user=None):
         """
         Get accounts in order of creation for deactivation for license limits
 
         pick currently logged in user, and append to the list in position 0
         pick all super-admins in order of creation date and add it to the list
         pick all other accounts in order of creation and add it to the list.
 
         Based on that list, the last accounts can be disabled as they are
         created at the end and don't include any of the super admins as well
         as the current user.
 
         :param current_user: optionally current user running this operation
         """
 
         if not current_user:
             current_user = get_current_rhodecode_user()
         active_super_admins = [
             x.user_id for x in User.query()
             .filter(User.user_id != current_user.user_id)
             .filter(User.active == true())
             .filter(User.admin == true())
             .order_by(User.created_on.asc())]
 
         active_regular_users = [
             x.user_id for x in User.query()
             .filter(User.user_id != current_user.user_id)
             .filter(User.active == true())
             .filter(User.admin == false())
             .order_by(User.created_on.asc())]
 
         list_of_accounts = [current_user.user_id]
         list_of_accounts += active_super_admins
         list_of_accounts += active_regular_users
 
         return list_of_accounts
 
     def deactivate_last_users(self, expected_users, current_user=None):
         """
         Deactivate accounts that are over the license limits.
         Algorithm of which accounts to disabled is based on the formula:
 
         Get current user, then super admins in creation order, then regular
         active users in creation order.
 
         Using that list we mark all accounts from the end of it as inactive.
         This way we block only latest created accounts.
 
         :param expected_users: list of users in special order, we deactivate
             the end N amount of users from that list
         """
 
         list_of_accounts = self.get_accounts_in_creation_order(
             current_user=current_user)
 
         for acc_id in list_of_accounts[expected_users + 1:]:
             user = User.get(acc_id)
             log.info('Deactivating account %s for license unlock', user)
             user.active = False
             Session().add(user)
             Session().commit()
 
         return
 
     def get_user_log(self, user, filter_term):
         user_log = UserLog.query()\
             .filter(or_(UserLog.user_id == user.user_id,
                         UserLog.username == user.username))\
             .options(joinedload(UserLog.user))\
             .options(joinedload(UserLog.repository))\
             .order_by(UserLog.action_date.desc())
 
         user_log = user_log_filter(user_log, filter_term)
         return user_log

rhodecode/tests/lib/test_auth.py

@@ -1,617 +1,632 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2019 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import os
 from hashlib import sha1
 
 import pytest
 from mock import patch
 
 from rhodecode.lib import auth
 from rhodecode.lib.utils2 import md5
 from rhodecode.model.auth_token import AuthTokenModel
-from rhodecode.model.db import User
+from rhodecode.model.db import Session, User
 from rhodecode.model.repo import RepoModel
 from rhodecode.model.user import UserModel
 from rhodecode.model.user_group import UserGroupModel
 
 
 def test_perm_origin_dict():
     pod = auth.PermOriginDict()
     pod['thing'] = 'read', 'default'
     assert pod['thing'] == 'read'
 
     assert pod.perm_origin_stack == {
         'thing': [('read', 'default')]}
 
     pod['thing'] = 'write', 'admin'
     assert pod['thing'] == 'write'
 
     assert pod.perm_origin_stack == {
         'thing': [('read', 'default'), ('write', 'admin')]}
 
     pod['other'] = 'write', 'default'
 
     assert pod.perm_origin_stack == {
         'other': [('write', 'default')],
         'thing': [('read', 'default'), ('write', 'admin')]}
 
     pod['other'] = 'none', 'override'
 
     assert pod.perm_origin_stack == {
         'other': [('write', 'default'), ('none', 'override')],
         'thing': [('read', 'default'), ('write', 'admin')]}
 
     with pytest.raises(ValueError):
         pod['thing'] = 'read'
 
 
 def test_cached_perms_data(user_regular, backend_random):
     permissions = get_permissions(user_regular)
     repo_name = backend_random.repo.repo_name
     expected_global_permissions = {
         'repository.read', 'group.read', 'usergroup.read'}
     assert expected_global_permissions.issubset(permissions['global'])
     assert permissions['repositories'][repo_name] == 'repository.read'
 
 
 def test_cached_perms_data_with_admin_user(user_regular, backend_random):
     permissions = get_permissions(user_regular, user_is_admin=True)
     repo_name = backend_random.repo.repo_name
     assert 'hg.admin' in permissions['global']
     assert permissions['repositories'][repo_name] == 'repository.admin'
 
 
 def test_cached_perms_data_with_admin_user_extended_calculation(user_regular, backend_random):
     permissions = get_permissions(user_regular, user_is_admin=True,
                                   calculate_super_admin=True)
     repo_name = backend_random.repo.repo_name
     assert 'hg.admin' in permissions['global']
     assert permissions['repositories'][repo_name] == 'repository.admin'
 
 
 def test_cached_perms_data_user_group_global_permissions(user_util):
     user, user_group = user_util.create_user_with_group()
     user_group.inherit_default_permissions = False
 
     granted_permission = 'repository.write'
     UserGroupModel().grant_perm(user_group, granted_permission)
+    Session().commit()
 
     permissions = get_permissions(user)
     assert granted_permission in permissions['global']
 
 
 @pytest.mark.xfail(reason="Not implemented, see TODO note")
 def test_cached_perms_data_user_group_global_permissions_(user_util):
     user, user_group = user_util.create_user_with_group()
 
     granted_permission = 'repository.write'
     UserGroupModel().grant_perm(user_group, granted_permission)
+    Session().commit()
 
     permissions = get_permissions(user)
     assert granted_permission in permissions['global']
 
 
 def test_cached_perms_data_user_global_permissions(user_util):
     user = user_util.create_user()
     UserModel().grant_perm(user, 'repository.none')
+    Session().commit()
 
     permissions = get_permissions(user, user_inherit_default_permissions=True)
     assert 'repository.read' in permissions['global']
 
 
 def test_cached_perms_data_repository_permissions_on_private_repository(
         backend_random, user_util):
     user, user_group = user_util.create_user_with_group()
 
     repo = backend_random.create_repo()
     repo.private = True
 
     granted_permission = 'repository.write'
     RepoModel().grant_user_group_permission(
         repo, user_group.users_group_name, granted_permission)
+    Session().commit()
 
     permissions = get_permissions(user)
     assert permissions['repositories'][repo.repo_name] == granted_permission
 
 
 def test_cached_perms_data_repository_permissions_for_owner(
         backend_random, user_util):
     user = user_util.create_user()
 
     repo = backend_random.create_repo()
     repo.user_id = user.user_id
 
     permissions = get_permissions(user)
     assert permissions['repositories'][repo.repo_name] == 'repository.admin'
 
     # TODO: johbo: Make cleanup in UserUtility smarter, then remove this hack
     repo.user_id = User.get_default_user().user_id
 
 
 def test_cached_perms_data_repository_permissions_not_inheriting_defaults(
         backend_random, user_util):
     user = user_util.create_user()
     repo = backend_random.create_repo()
 
     # Don't inherit default object permissions
     UserModel().grant_perm(user, 'hg.inherit_default_perms.false')
+    Session().commit()
 
     permissions = get_permissions(user)
     assert permissions['repositories'][repo.repo_name] == 'repository.none'
 
 
 def test_cached_perms_data_default_permissions_on_repository_group(user_util):
     # Have a repository group with default permissions set
     repo_group = user_util.create_repo_group()
     default_user = User.get_default_user()
     user_util.grant_user_permission_to_repo_group(
         repo_group, default_user, 'repository.write')
     user = user_util.create_user()
 
     permissions = get_permissions(user)
     assert permissions['repositories_groups'][repo_group.group_name] == \
         'repository.write'
 
 
 def test_cached_perms_data_default_permissions_on_repository_group_owner(
         user_util):
     # Have a repository group
     repo_group = user_util.create_repo_group()
     default_user = User.get_default_user()
 
     # Add a permission for the default user to hit the code path
     user_util.grant_user_permission_to_repo_group(
         repo_group, default_user, 'repository.write')
 
     # Have an owner of the group
     user = user_util.create_user()
     repo_group.user_id = user.user_id
 
     permissions = get_permissions(user)
     assert permissions['repositories_groups'][repo_group.group_name] == \
         'group.admin'
 
 
 def test_cached_perms_data_default_permissions_on_repository_group_no_inherit(
         user_util):
     # Have a repository group
     repo_group = user_util.create_repo_group()
     default_user = User.get_default_user()
 
     # Add a permission for the default user to hit the code path
     user_util.grant_user_permission_to_repo_group(
         repo_group, default_user, 'repository.write')
 
     # Don't inherit default object permissions
     user = user_util.create_user()
     UserModel().grant_perm(user, 'hg.inherit_default_perms.false')
+    Session().commit()
 
     permissions = get_permissions(user)
     assert permissions['repositories_groups'][repo_group.group_name] == \
         'group.none'
 
 
 def test_cached_perms_data_repository_permissions_from_user_group(
         user_util, backend_random):
     user, user_group = user_util.create_user_with_group()
 
     # Needs a second user group to make sure that we select the right
     # permissions.
     user_group2 = user_util.create_user_group()
     UserGroupModel().add_user_to_group(user_group2, user)
 
     repo = backend_random.create_repo()
 
     RepoModel().grant_user_group_permission(
         repo, user_group.users_group_name, 'repository.read')
     RepoModel().grant_user_group_permission(
         repo, user_group2.users_group_name, 'repository.write')
+    Session().commit()
 
     permissions = get_permissions(user)
     assert permissions['repositories'][repo.repo_name] == 'repository.write'
 
 
 def test_cached_perms_data_repository_permissions_from_user_group_owner(
         user_util, backend_random):
     user, user_group = user_util.create_user_with_group()
 
     repo = backend_random.create_repo()
     repo.user_id = user.user_id
 
     RepoModel().grant_user_group_permission(
         repo, user_group.users_group_name, 'repository.write')
+    Session().commit()
 
     permissions = get_permissions(user)
     assert permissions['repositories'][repo.repo_name] == 'repository.admin'
 
 
 def test_cached_perms_data_user_repository_permissions(
         user_util, backend_random):
     user = user_util.create_user()
     repo = backend_random.create_repo()
     granted_permission = 'repository.write'
     RepoModel().grant_user_permission(repo, user, granted_permission)
+    Session().commit()
 
     permissions = get_permissions(user)
     assert permissions['repositories'][repo.repo_name] == granted_permission
 
 
 def test_cached_perms_data_user_repository_permissions_explicit(
         user_util, backend_random):
     user = user_util.create_user()
     repo = backend_random.create_repo()
     granted_permission = 'repository.none'
     RepoModel().grant_user_permission(repo, user, granted_permission)
+    Session().commit()
 
     permissions = get_permissions(user, explicit=True)
     assert permissions['repositories'][repo.repo_name] == granted_permission
 
 
 def test_cached_perms_data_user_repository_permissions_owner(
         user_util, backend_random):
     user = user_util.create_user()
     repo = backend_random.create_repo()
     repo.user_id = user.user_id
     RepoModel().grant_user_permission(repo, user, 'repository.write')
+    Session().commit()
 
     permissions = get_permissions(user)
     assert permissions['repositories'][repo.repo_name] == 'repository.admin'
 
 
 def test_cached_perms_data_repository_groups_permissions_inherited(
         user_util, backend_random):
     user, user_group = user_util.create_user_with_group()
 
     # Needs a second group to hit the last condition
     user_group2 = user_util.create_user_group()
     UserGroupModel().add_user_to_group(user_group2, user)
 
     repo_group = user_util.create_repo_group()
 
     user_util.grant_user_group_permission_to_repo_group(
         repo_group, user_group, 'group.read')
     user_util.grant_user_group_permission_to_repo_group(
         repo_group, user_group2, 'group.write')
 
     permissions = get_permissions(user)
     assert permissions['repositories_groups'][repo_group.group_name] == \
         'group.write'
 
 
 def test_cached_perms_data_repository_groups_permissions_inherited_owner(
         user_util, backend_random):
     user, user_group = user_util.create_user_with_group()
     repo_group = user_util.create_repo_group()
     repo_group.user_id = user.user_id
 
     granted_permission = 'group.write'
     user_util.grant_user_group_permission_to_repo_group(
         repo_group, user_group, granted_permission)
 
     permissions = get_permissions(user)
     assert permissions['repositories_groups'][repo_group.group_name] == \
         'group.admin'
 
 
 def test_cached_perms_data_repository_groups_permissions(
         user_util, backend_random):
     user = user_util.create_user()
 
     repo_group = user_util.create_repo_group()
 
     granted_permission = 'group.write'
     user_util.grant_user_permission_to_repo_group(
         repo_group, user, granted_permission)
 
     permissions = get_permissions(user)
     assert permissions['repositories_groups'][repo_group.group_name] == \
         'group.write'
 
 
 def test_cached_perms_data_repository_groups_permissions_explicit(
         user_util, backend_random):
     user = user_util.create_user()
 
     repo_group = user_util.create_repo_group()
 
     granted_permission = 'group.none'
     user_util.grant_user_permission_to_repo_group(
         repo_group, user, granted_permission)
 
     permissions = get_permissions(user, explicit=True)
     assert permissions['repositories_groups'][repo_group.group_name] == \
         'group.none'
 
 
 def test_cached_perms_data_repository_groups_permissions_owner(
         user_util, backend_random):
     user = user_util.create_user()
 
     repo_group = user_util.create_repo_group()
     repo_group.user_id = user.user_id
 
     granted_permission = 'group.write'
     user_util.grant_user_permission_to_repo_group(
         repo_group, user, granted_permission)
 
     permissions = get_permissions(user)
     assert permissions['repositories_groups'][repo_group.group_name] == \
         'group.admin'
 
 
 def test_cached_perms_data_user_group_permissions_inherited(
         user_util, backend_random):
     user, user_group = user_util.create_user_with_group()
     user_group2 = user_util.create_user_group()
     UserGroupModel().add_user_to_group(user_group2, user)
 
     target_user_group = user_util.create_user_group()
 
     user_util.grant_user_group_permission_to_user_group(
         target_user_group, user_group, 'usergroup.read')
     user_util.grant_user_group_permission_to_user_group(
         target_user_group, user_group2, 'usergroup.write')
 
     permissions = get_permissions(user)
     assert permissions['user_groups'][target_user_group.users_group_name] == \
         'usergroup.write'
 
 
 def test_cached_perms_data_user_group_permissions(
         user_util, backend_random):
     user = user_util.create_user()
     user_group = user_util.create_user_group()
     UserGroupModel().grant_user_permission(user_group, user, 'usergroup.write')
+    Session().commit()
 
     permissions = get_permissions(user)
     assert permissions['user_groups'][user_group.users_group_name] == \
         'usergroup.write'
 
 
 def test_cached_perms_data_user_group_permissions_explicit(
         user_util, backend_random):
     user = user_util.create_user()
     user_group = user_util.create_user_group()
     UserGroupModel().grant_user_permission(user_group, user, 'usergroup.none')
+    Session().commit()
 
     permissions = get_permissions(user, explicit=True)
     assert permissions['user_groups'][user_group.users_group_name] == \
         'usergroup.none'
 
 
 def test_cached_perms_data_user_group_permissions_not_inheriting_defaults(
         user_util, backend_random):
     user = user_util.create_user()
     user_group = user_util.create_user_group()
 
     # Don't inherit default object permissions
     UserModel().grant_perm(user, 'hg.inherit_default_perms.false')
+    Session().commit()
 
     permissions = get_permissions(user)
     assert permissions['user_groups'][user_group.users_group_name] == \
         'usergroup.none'
 
 
 def test_permission_calculator_admin_permissions(
         user_util, backend_random):
     user = user_util.create_user()
     user_group = user_util.create_user_group()
     repo = backend_random.repo
     repo_group = user_util.create_repo_group()
 
     calculator = auth.PermissionCalculator(
         user.user_id, {}, False, False, True, 'higherwin')
     permissions = calculator._calculate_admin_permissions()
 
     assert permissions['repositories_groups'][repo_group.group_name] == \
         'group.admin'
     assert permissions['user_groups'][user_group.users_group_name] == \
         'usergroup.admin'
     assert permissions['repositories'][repo.repo_name] == 'repository.admin'
     assert 'hg.admin' in permissions['global']
 
 
 def test_permission_calculator_repository_permissions_robustness_from_group(
         user_util, backend_random):
     user, user_group = user_util.create_user_with_group()
 
     RepoModel().grant_user_group_permission(
         backend_random.repo, user_group.users_group_name, 'repository.write')
 
     calculator = auth.PermissionCalculator(
         user.user_id, {}, False, False, False, 'higherwin')
     calculator._calculate_repository_permissions()
 
 
 def test_permission_calculator_repository_permissions_robustness_from_user(
         user_util, backend_random):
     user = user_util.create_user()
 
     RepoModel().grant_user_permission(
         backend_random.repo, user, 'repository.write')
+    Session().commit()
 
     calculator = auth.PermissionCalculator(
         user.user_id, {}, False, False, False, 'higherwin')
     calculator._calculate_repository_permissions()
 
 
 def test_permission_calculator_repo_group_permissions_robustness_from_group(
         user_util, backend_random):
     user, user_group = user_util.create_user_with_group()
     repo_group = user_util.create_repo_group()
 
     user_util.grant_user_group_permission_to_repo_group(
         repo_group, user_group, 'group.write')
 
     calculator = auth.PermissionCalculator(
         user.user_id, {}, False, False, False, 'higherwin')
     calculator._calculate_repository_group_permissions()
 
 
 def test_permission_calculator_repo_group_permissions_robustness_from_user(
         user_util, backend_random):
     user = user_util.create_user()
     repo_group = user_util.create_repo_group()
 
     user_util.grant_user_permission_to_repo_group(
         repo_group, user, 'group.write')
 
     calculator = auth.PermissionCalculator(
         user.user_id, {}, False, False, False, 'higherwin')
     calculator._calculate_repository_group_permissions()
 
 
 def test_permission_calculator_user_group_permissions_robustness_from_group(
         user_util, backend_random):
     user, user_group = user_util.create_user_with_group()
     target_user_group = user_util.create_user_group()
 
     user_util.grant_user_group_permission_to_user_group(
         target_user_group, user_group, 'usergroup.write')
 
     calculator = auth.PermissionCalculator(
         user.user_id, {}, False, False, False, 'higherwin')
     calculator._calculate_user_group_permissions()
 
 
 def test_permission_calculator_user_group_permissions_robustness_from_user(
         user_util, backend_random):
     user = user_util.create_user()
     target_user_group = user_util.create_user_group()
 
     user_util.grant_user_permission_to_user_group(
         target_user_group, user, 'usergroup.write')
 
     calculator = auth.PermissionCalculator(
         user.user_id, {}, False, False, False, 'higherwin')
     calculator._calculate_user_group_permissions()
 
 
 @pytest.mark.parametrize("algo, new_permission, old_permission, expected", [
     ('higherwin', 'repository.none', 'repository.none', 'repository.none'),
     ('higherwin', 'repository.read', 'repository.none', 'repository.read'),
     ('lowerwin', 'repository.write', 'repository.write', 'repository.write'),
     ('lowerwin', 'repository.read', 'repository.write', 'repository.read'),
 ])
 def test_permission_calculator_choose_permission(
         user_regular, algo, new_permission, old_permission, expected):
     calculator = auth.PermissionCalculator(
         user_regular.user_id, {}, False, False, False, algo)
     result = calculator._choose_permission(new_permission, old_permission)
     assert result == expected
 
 
 def test_permission_calculator_choose_permission_raises_on_wrong_algo(
         user_regular):
     calculator = auth.PermissionCalculator(
         user_regular.user_id, {}, False, False, False, 'invalid')
     result = calculator._choose_permission(
         'repository.read', 'repository.read')
     # TODO: johbo: This documents the existing behavior. Think of an
     # improvement.
     assert result is None
 
 
 def test_auth_user_get_cookie_store_for_normal_user(user_util):
     user = user_util.create_user()
     auth_user = auth.AuthUser(user_id=user.user_id)
     expected_data = {
         'username': user.username,
         'user_id': user.user_id,
         'password': md5(user.password),
         'is_authenticated': False
     }
     assert auth_user.get_cookie_store() == expected_data
 
 
 def test_auth_user_get_cookie_store_for_default_user():
     default_user = User.get_default_user()
     auth_user = auth.AuthUser()
     expected_data = {
         'username': User.DEFAULT_USER,
         'user_id': default_user.user_id,
         'password': md5(default_user.password),
         'is_authenticated': True
     }
     assert auth_user.get_cookie_store() == expected_data
 
 
 def get_permissions(user, **kwargs):
     """
     Utility filling in useful defaults into the call to `_cached_perms_data`.
 
     Fill in `**kwargs` if specific values are needed for a test.
     """
     call_args = {
         'user_id': user.user_id,
         'scope': {},
         'user_is_admin': False,
         'user_inherit_default_permissions': False,
         'explicit': False,
         'algo': 'higherwin',
         'calculate_super_admin': False,
     }
     call_args.update(kwargs)
     permissions = auth._cached_perms_data(**call_args)
     return permissions
 
 
 class TestGenerateAuthToken(object):
     def test_salt_is_used_when_specified(self):
         salt = 'abcde'
         user_name = 'test_user'
         result = auth.generate_auth_token(user_name, salt)
         expected_result = sha1(user_name + salt).hexdigest()
         assert result == expected_result
 
     def test_salt_is_geneated_when_not_specified(self):
         user_name = 'test_user'
         random_salt = os.urandom(16)
         with patch.object(auth, 'os') as os_mock:
             os_mock.urandom.return_value = random_salt
             result = auth.generate_auth_token(user_name)
         expected_result = sha1(user_name + random_salt).hexdigest()
         assert result == expected_result
 
 
 @pytest.mark.parametrize("test_token, test_roles, auth_result, expected_tokens", [
     ('', None, False,
      []),
     ('wrongtoken', None, False,
      []),
     ('abracadabra_vcs', [AuthTokenModel.cls.ROLE_API], False,
      [('abracadabra_api', AuthTokenModel.cls.ROLE_API, -1)]),
     ('abracadabra_api', [AuthTokenModel.cls.ROLE_API], True,
      [('abracadabra_api', AuthTokenModel.cls.ROLE_API, -1)]),
     ('abracadabra_api', [AuthTokenModel.cls.ROLE_API], True,
      [('abracadabra_api', AuthTokenModel.cls.ROLE_API, -1),
       ('abracadabra_http', AuthTokenModel.cls.ROLE_HTTP, -1)]),
 ])
 def test_auth_by_token(test_token, test_roles, auth_result, expected_tokens,
                        user_util):
     user = user_util.create_user()
     user_id = user.user_id
     for token, role, expires in expected_tokens:
-        new_token = AuthTokenModel().create(user_id, 'test-token', expires, role)
+        new_token = AuthTokenModel().create(user_id, u'test-token', expires, role)
         new_token.api_key = token  # inject known name for testing...
 
     assert auth_result == user.authenticate_by_token(
         test_token, roles=test_roles)

rhodecode/tests/models/settings/test_vcs_settings.py

@@ -1,1080 +1,1143 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2019 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import mock
 import pytest
 
 from rhodecode.lib.utils2 import str2bool
 from rhodecode.model.meta import Session
 from rhodecode.model.settings import VcsSettingsModel, UiSetting
 
 
 HOOKS_FORM_DATA = {
     'hooks_changegroup_repo_size': True,
     'hooks_changegroup_push_logger': True,
     'hooks_outgoing_pull_logger': True
 }
 
 SVN_FORM_DATA = {
     'new_svn_branch': 'test-branch',
     'new_svn_tag': 'test-tag'
 }
 
 GENERAL_FORM_DATA = {
     'rhodecode_pr_merge_enabled': True,
     'rhodecode_use_outdated_comments': True,
     'rhodecode_hg_use_rebase_for_merging': True,
     'rhodecode_hg_close_branch_before_merging': True,
     'rhodecode_git_use_rebase_for_merging': True,
     'rhodecode_git_close_branch_before_merging': True,
     'rhodecode_diff_cache': True,
 }
 
 
 class TestInheritGlobalSettingsProperty(object):
     def test_get_raises_exception_when_repository_not_specified(self):
         model = VcsSettingsModel()
         with pytest.raises(Exception) as exc_info:
             model.inherit_global_settings
         assert str(exc_info.value) == 'Repository is not specified'
 
     def test_true_is_returned_when_value_is_not_found(self, repo_stub):
         model = VcsSettingsModel(repo=repo_stub.repo_name)
         assert model.inherit_global_settings is True
 
     def test_value_is_returned(self, repo_stub, settings_util):
         model = VcsSettingsModel(repo=repo_stub.repo_name)
         settings_util.create_repo_rhodecode_setting(
             repo_stub, VcsSettingsModel.INHERIT_SETTINGS, False, 'bool')
         assert model.inherit_global_settings is False
 
     def test_value_is_set(self, repo_stub):
         model = VcsSettingsModel(repo=repo_stub.repo_name)
         model.inherit_global_settings = False
         setting = model.repo_settings.get_setting_by_name(
             VcsSettingsModel.INHERIT_SETTINGS)
         try:
             assert setting.app_settings_type == 'bool'
             assert setting.app_settings_value is False
         finally:
             Session().delete(setting)
             Session().commit()
 
     def test_set_raises_exception_when_repository_not_specified(self):
         model = VcsSettingsModel()
         with pytest.raises(Exception) as exc_info:
             model.inherit_global_settings = False
         assert str(exc_info.value) == 'Repository is not specified'
 
 
 class TestVcsSettingsModel(object):
     def test_global_svn_branch_patterns(self):
         model = VcsSettingsModel()
         expected_result = {'test': 'test'}
         with mock.patch.object(model, 'global_settings') as settings_mock:
             get_settings = settings_mock.get_ui_by_section
             get_settings.return_value = expected_result
             settings_mock.return_value = expected_result
             result = model.get_global_svn_branch_patterns()
 
         get_settings.assert_called_once_with(model.SVN_BRANCH_SECTION)
         assert expected_result == result
 
     def test_repo_svn_branch_patterns(self):
         model = VcsSettingsModel()
         expected_result = {'test': 'test'}
         with mock.patch.object(model, 'repo_settings') as settings_mock:
             get_settings = settings_mock.get_ui_by_section
             get_settings.return_value = expected_result
             settings_mock.return_value = expected_result
             result = model.get_repo_svn_branch_patterns()
 
         get_settings.assert_called_once_with(model.SVN_BRANCH_SECTION)
         assert expected_result == result
 
     def test_repo_svn_branch_patterns_raises_exception_when_repo_is_not_set(
             self):
         model = VcsSettingsModel()
         with pytest.raises(Exception) as exc_info:
             model.get_repo_svn_branch_patterns()
         assert str(exc_info.value) == 'Repository is not specified'
 
     def test_global_svn_tag_patterns(self):
         model = VcsSettingsModel()
         expected_result = {'test': 'test'}
         with mock.patch.object(model, 'global_settings') as settings_mock:
             get_settings = settings_mock.get_ui_by_section
             get_settings.return_value = expected_result
             settings_mock.return_value = expected_result
             result = model.get_global_svn_tag_patterns()
 
         get_settings.assert_called_once_with(model.SVN_TAG_SECTION)
         assert expected_result == result
 
     def test_repo_svn_tag_patterns(self):
         model = VcsSettingsModel()
         expected_result = {'test': 'test'}
         with mock.patch.object(model, 'repo_settings') as settings_mock:
             get_settings = settings_mock.get_ui_by_section
             get_settings.return_value = expected_result
             settings_mock.return_value = expected_result
             result = model.get_repo_svn_tag_patterns()
 
         get_settings.assert_called_once_with(model.SVN_TAG_SECTION)
         assert expected_result == result
 
     def test_repo_svn_tag_patterns_raises_exception_when_repo_is_not_set(self):
         model = VcsSettingsModel()
         with pytest.raises(Exception) as exc_info:
             model.get_repo_svn_tag_patterns()
         assert str(exc_info.value) == 'Repository is not specified'
 
     def test_get_global_settings(self):
         expected_result = {'test': 'test'}
         model = VcsSettingsModel()
         with mock.patch.object(model, '_collect_all_settings') as collect_mock:
             collect_mock.return_value = expected_result
             result = model.get_global_settings()
 
         collect_mock.assert_called_once_with(global_=True)
         assert result == expected_result
 
     def test_get_repo_settings(self, repo_stub):
         model = VcsSettingsModel(repo=repo_stub.repo_name)
         expected_result = {'test': 'test'}
         with mock.patch.object(model, '_collect_all_settings') as collect_mock:
             collect_mock.return_value = expected_result
             result = model.get_repo_settings()
 
         collect_mock.assert_called_once_with(global_=False)
         assert result == expected_result
 
     @pytest.mark.parametrize('settings, global_', [
         ('global_settings', True),
         ('repo_settings', False)
     ])
     def test_collect_all_settings(self, settings, global_):
         model = VcsSettingsModel()
         result_mock = self._mock_result()
 
         settings_patch = mock.patch.object(model, settings)
         with settings_patch as settings_mock:
             settings_mock.get_ui_by_section_and_key.return_value = result_mock
             settings_mock.get_setting_by_name.return_value = result_mock
             result = model._collect_all_settings(global_=global_)
 
         ui_settings = model.HG_SETTINGS + model.GIT_SETTINGS + model.HOOKS_SETTINGS
         self._assert_get_settings_calls(
             settings_mock, ui_settings, model.GENERAL_SETTINGS)
         self._assert_collect_all_settings_result(
             ui_settings, model.GENERAL_SETTINGS, result)
 
     @pytest.mark.parametrize('settings, global_', [
         ('global_settings', True),
         ('repo_settings', False)
     ])
     def test_collect_all_settings_without_empty_value(self, settings, global_):
         model = VcsSettingsModel()
 
         settings_patch = mock.patch.object(model, settings)
         with settings_patch as settings_mock:
             settings_mock.get_ui_by_section_and_key.return_value = None
             settings_mock.get_setting_by_name.return_value = None
             result = model._collect_all_settings(global_=global_)
 
         assert result == {}
 
     def _mock_result(self):
         result_mock = mock.Mock()
         result_mock.ui_value = 'ui_value'
         result_mock.ui_active = True
         result_mock.app_settings_value = 'setting_value'
         return result_mock
 
     def _assert_get_settings_calls(
             self, settings_mock, ui_settings, general_settings):
         assert (
             settings_mock.get_ui_by_section_and_key.call_count ==
             len(ui_settings))
         assert (
             settings_mock.get_setting_by_name.call_count ==
             len(general_settings))
 
         for section, key in ui_settings:
             expected_call = mock.call(section, key)
             assert (
                 expected_call in
                 settings_mock.get_ui_by_section_and_key.call_args_list)
 
         for name in general_settings:
             expected_call = mock.call(name)
             assert (
                 expected_call in
                 settings_mock.get_setting_by_name.call_args_list)
 
     def _assert_collect_all_settings_result(
             self, ui_settings, general_settings, result):
         expected_result = {}
         for section, key in ui_settings:
             key = '{}_{}'.format(section, key.replace('.', '_'))
 
             if section in ('extensions', 'hooks'):
                 value = True
             elif key in ['vcs_git_lfs_enabled']:
                 value = True
             else:
                 value = 'ui_value'
             expected_result[key] = value
 
         for name in general_settings:
             key = 'rhodecode_' + name
             expected_result[key] = 'setting_value'
 
         assert expected_result == result
 
 
 class TestCreateOrUpdateRepoHookSettings(object):
     def test_create_when_no_repo_object_found(self, repo_stub):
         model = VcsSettingsModel(repo=repo_stub.repo_name)
 
         self._create_settings(model, HOOKS_FORM_DATA)
 
         cleanup = []
         try:
             for section, key in model.HOOKS_SETTINGS:
                 ui = model.repo_settings.get_ui_by_section_and_key(
                     section, key)
                 assert ui.ui_active is True
                 cleanup.append(ui)
         finally:
             for ui in cleanup:
                 Session().delete(ui)
             Session().commit()
 
     def test_create_raises_exception_when_data_incomplete(self, repo_stub):
         model = VcsSettingsModel(repo=repo_stub.repo_name)
 
         deleted_key = 'hooks_changegroup_repo_size'
         data = HOOKS_FORM_DATA.copy()
         data.pop(deleted_key)
 
         with pytest.raises(ValueError) as exc_info:
             model.create_or_update_repo_hook_settings(data)
+            Session().commit()
+
         msg = 'The given data does not contain {} key'.format(deleted_key)
         assert str(exc_info.value) == msg
 
     def test_update_when_repo_object_found(self, repo_stub, settings_util):
         model = VcsSettingsModel(repo=repo_stub.repo_name)
         for section, key in model.HOOKS_SETTINGS:
             settings_util.create_repo_rhodecode_ui(
                 repo_stub, section, None, key=key, active=False)
         model.create_or_update_repo_hook_settings(HOOKS_FORM_DATA)
+        Session().commit()
+
         for section, key in model.HOOKS_SETTINGS:
             ui = model.repo_settings.get_ui_by_section_and_key(section, key)
             assert ui.ui_active is True
 
     def _create_settings(self, model, data):
         global_patch = mock.patch.object(model, 'global_settings')
         global_setting = mock.Mock()
         global_setting.ui_value = 'Test value'
         with global_patch as global_mock:
             global_mock.get_ui_by_section_and_key.return_value = global_setting
             model.create_or_update_repo_hook_settings(HOOKS_FORM_DATA)
+            Session().commit()
 
 
 class TestUpdateGlobalHookSettings(object):
     def test_update_raises_exception_when_data_incomplete(self):
         model = VcsSettingsModel()
 
         deleted_key = 'hooks_changegroup_repo_size'
         data = HOOKS_FORM_DATA.copy()
         data.pop(deleted_key)
 
         with pytest.raises(ValueError) as exc_info:
             model.update_global_hook_settings(data)
+            Session().commit()
+
         msg = 'The given data does not contain {} key'.format(deleted_key)
         assert str(exc_info.value) == msg
 
     def test_update_global_hook_settings(self, settings_util):
         model = VcsSettingsModel()
         setting_mock = mock.MagicMock()
         setting_mock.ui_active = False
         get_settings_patcher = mock.patch.object(
             model.global_settings, 'get_ui_by_section_and_key',
             return_value=setting_mock)
         session_patcher = mock.patch('rhodecode.model.settings.Session')
         with get_settings_patcher as get_settings_mock, session_patcher:
             model.update_global_hook_settings(HOOKS_FORM_DATA)
+            Session().commit()
+
         assert setting_mock.ui_active is True
         assert get_settings_mock.call_count == 3
 
 
 class TestCreateOrUpdateRepoGeneralSettings(object):
     def test_calls_create_or_update_general_settings(self, repo_stub):
         model = VcsSettingsModel(repo=repo_stub.repo_name)
         create_patch = mock.patch.object(
             model, '_create_or_update_general_settings')
         with create_patch as create_mock:
             model.create_or_update_repo_pr_settings(GENERAL_FORM_DATA)
+            Session().commit()
+
         create_mock.assert_called_once_with(
             model.repo_settings, GENERAL_FORM_DATA)
 
     def test_raises_exception_when_repository_is_not_specified(self):
         model = VcsSettingsModel()
         with pytest.raises(Exception) as exc_info:
             model.create_or_update_repo_pr_settings(GENERAL_FORM_DATA)
         assert str(exc_info.value) == 'Repository is not specified'
 
 
 class TestCreateOrUpdatGlobalGeneralSettings(object):
     def test_calls_create_or_update_general_settings(self):
         model = VcsSettingsModel()
         create_patch = mock.patch.object(
             model, '_create_or_update_general_settings')
         with create_patch as create_mock:
             model.create_or_update_global_pr_settings(GENERAL_FORM_DATA)
         create_mock.assert_called_once_with(
             model.global_settings, GENERAL_FORM_DATA)
 
 
 class TestCreateOrUpdateGeneralSettings(object):
     def test_create_when_no_repo_settings_found(self, repo_stub):
         model = VcsSettingsModel(repo=repo_stub.repo_name)
         model._create_or_update_general_settings(
             model.repo_settings, GENERAL_FORM_DATA)
 
         cleanup = []
         try:
             for name in model.GENERAL_SETTINGS:
                 setting = model.repo_settings.get_setting_by_name(name)
                 assert setting.app_settings_value is True
                 cleanup.append(setting)
         finally:
             for setting in cleanup:
                 Session().delete(setting)
             Session().commit()
 
     def test_create_raises_exception_when_data_incomplete(self, repo_stub):
         model = VcsSettingsModel(repo=repo_stub.repo_name)
 
         deleted_key = 'rhodecode_pr_merge_enabled'
         data = GENERAL_FORM_DATA.copy()
         data.pop(deleted_key)
 
         with pytest.raises(ValueError) as exc_info:
             model._create_or_update_general_settings(model.repo_settings, data)
+        Session().commit()
 
         msg = 'The given data does not contain {} key'.format(deleted_key)
         assert str(exc_info.value) == msg
 
     def test_update_when_repo_setting_found(self, repo_stub, settings_util):
         model = VcsSettingsModel(repo=repo_stub.repo_name)
         for name in model.GENERAL_SETTINGS:
             settings_util.create_repo_rhodecode_setting(
                 repo_stub, name, False, 'bool')
 
         model._create_or_update_general_settings(
             model.repo_settings, GENERAL_FORM_DATA)
+        Session().commit()
 
         for name in model.GENERAL_SETTINGS:
             setting = model.repo_settings.get_setting_by_name(name)
             assert setting.app_settings_value is True
 
 
 class TestCreateRepoSvnSettings(object):
     def test_calls_create_svn_settings(self, repo_stub):
         model = VcsSettingsModel(repo=repo_stub.repo_name)
         with mock.patch.object(model, '_create_svn_settings') as create_mock:
             model.create_repo_svn_settings(SVN_FORM_DATA)
+            Session().commit()
+
         create_mock.assert_called_once_with(model.repo_settings, SVN_FORM_DATA)
 
     def test_raises_exception_when_repository_is_not_specified(self):
         model = VcsSettingsModel()
         with pytest.raises(Exception) as exc_info:
             model.create_repo_svn_settings(SVN_FORM_DATA)
+            Session().commit()
+
         assert str(exc_info.value) == 'Repository is not specified'
 
 
 class TestCreateSvnSettings(object):
     def test_create(self, repo_stub):
         model = VcsSettingsModel(repo=repo_stub.repo_name)
         model._create_svn_settings(model.repo_settings, SVN_FORM_DATA)
         Session().commit()
 
         branch_ui = model.repo_settings.get_ui_by_section(
             model.SVN_BRANCH_SECTION)
         tag_ui = model.repo_settings.get_ui_by_section(
             model.SVN_TAG_SECTION)
 
         try:
             assert len(branch_ui) == 1
             assert len(tag_ui) == 1
         finally:
             Session().delete(branch_ui[0])
             Session().delete(tag_ui[0])
             Session().commit()
 
     def test_create_tag(self, repo_stub):
         model = VcsSettingsModel(repo=repo_stub.repo_name)
         data = SVN_FORM_DATA.copy()
         data.pop('new_svn_branch')
         model._create_svn_settings(model.repo_settings, data)
         Session().commit()
 
         branch_ui = model.repo_settings.get_ui_by_section(
             model.SVN_BRANCH_SECTION)
         tag_ui = model.repo_settings.get_ui_by_section(
             model.SVN_TAG_SECTION)
 
         try:
             assert len(branch_ui) == 0
             assert len(tag_ui) == 1
         finally:
             Session().delete(tag_ui[0])
             Session().commit()
 
     def test_create_nothing_when_no_svn_settings_specified(self, repo_stub):
         model = VcsSettingsModel(repo=repo_stub.repo_name)
         model._create_svn_settings(model.repo_settings, {})
         Session().commit()
 
         branch_ui = model.repo_settings.get_ui_by_section(
             model.SVN_BRANCH_SECTION)
         tag_ui = model.repo_settings.get_ui_by_section(
             model.SVN_TAG_SECTION)
 
         assert len(branch_ui) == 0
         assert len(tag_ui) == 0
 
     def test_create_nothing_when_empty_settings_specified(self, repo_stub):
         model = VcsSettingsModel(repo=repo_stub.repo_name)
         data = {
             'new_svn_branch': '',
             'new_svn_tag': ''
         }
         model._create_svn_settings(model.repo_settings, data)
         Session().commit()
 
         branch_ui = model.repo_settings.get_ui_by_section(
             model.SVN_BRANCH_SECTION)
         tag_ui = model.repo_settings.get_ui_by_section(
             model.SVN_TAG_SECTION)
 
         assert len(branch_ui) == 0
         assert len(tag_ui) == 0
 
 
 class TestCreateOrUpdateUi(object):
     def test_create(self, repo_stub):
         model = VcsSettingsModel(repo=repo_stub.repo_name)
         model._create_or_update_ui(
             model.repo_settings, 'test-section', 'test-key', active=False,
             value='False')
         Session().commit()
 
         created_ui = model.repo_settings.get_ui_by_section_and_key(
             'test-section', 'test-key')
 
         try:
             assert created_ui.ui_active is False
             assert str2bool(created_ui.ui_value) is False
         finally:
             Session().delete(created_ui)
             Session().commit()
 
     def test_update(self, repo_stub, settings_util):
         model = VcsSettingsModel(repo=repo_stub.repo_name)
         # care about only 3 first settings
         largefiles, phases, evolve = model.HG_SETTINGS[:3]
 
         section = 'test-section'
         key = 'test-key'
         settings_util.create_repo_rhodecode_ui(
             repo_stub, section, 'True', key=key, active=True)
 
         model._create_or_update_ui(
             model.repo_settings, section, key, active=False, value='False')
         Session().commit()
 
         created_ui = model.repo_settings.get_ui_by_section_and_key(
             section, key)
         assert created_ui.ui_active is False
         assert str2bool(created_ui.ui_value) is False
 
 
 class TestCreateOrUpdateRepoHgSettings(object):
     FORM_DATA = {
         'extensions_largefiles': False,
         'extensions_evolve': False,
         'phases_publish': False
     }
 
     def test_creates_repo_hg_settings_when_data_is_correct(self, repo_stub):
         model = VcsSettingsModel(repo=repo_stub.repo_name)
         with mock.patch.object(model, '_create_or_update_ui') as create_mock:
             model.create_or_update_repo_hg_settings(self.FORM_DATA)
         expected_calls = [
             mock.call(model.repo_settings, 'extensions', 'largefiles', active=False, value=''),
             mock.call(model.repo_settings, 'extensions', 'evolve', active=False, value=''),
             mock.call(model.repo_settings, 'experimental', 'evolution', active=False, value=''),
             mock.call(model.repo_settings, 'experimental', 'evolution.exchange', active=False, value='no'),
             mock.call(model.repo_settings, 'extensions', 'topic', active=False, value=''),
             mock.call(model.repo_settings, 'phases', 'publish', value='False'),
         ]
         assert expected_calls == create_mock.call_args_list
 
     @pytest.mark.parametrize('field_to_remove', FORM_DATA.keys())
     def test_key_is_not_found(self, repo_stub, field_to_remove):
         model = VcsSettingsModel(repo=repo_stub.repo_name)
         data = self.FORM_DATA.copy()
         data.pop(field_to_remove)
         with pytest.raises(ValueError) as exc_info:
             model.create_or_update_repo_hg_settings(data)
+            Session().commit()
+
         expected_message = 'The given data does not contain {} key'.format(
             field_to_remove)
         assert str(exc_info.value) == expected_message
 
     def test_create_raises_exception_when_repository_not_specified(self):
         model = VcsSettingsModel()
         with pytest.raises(Exception) as exc_info:
             model.create_or_update_repo_hg_settings(self.FORM_DATA)
+            Session().commit()
+
         assert str(exc_info.value) == 'Repository is not specified'
 
 
 class TestUpdateGlobalSslSetting(object):
     def test_updates_global_hg_settings(self):
         model = VcsSettingsModel()
         with mock.patch.object(model, '_create_or_update_ui') as create_mock:
             model.update_global_ssl_setting('False')
+            Session().commit()
+
         create_mock.assert_called_once_with(
             model.global_settings, 'web', 'push_ssl', value='False')
 
 
 class TestUpdateGlobalPathSetting(object):
     def test_updates_global_path_settings(self):
         model = VcsSettingsModel()
         with mock.patch.object(model, '_create_or_update_ui') as create_mock:
             model.update_global_path_setting('False')
+            Session().commit()
+
         create_mock.assert_called_once_with(
             model.global_settings, 'paths', '/', value='False')
 
 
 class TestCreateOrUpdateGlobalHgSettings(object):
     FORM_DATA = {
         'extensions_largefiles': False,
         'largefiles_usercache': '/example/largefiles-store',
         'phases_publish': False,
         'extensions_hgsubversion': False,
         'extensions_evolve': False
     }
 
     def test_creates_repo_hg_settings_when_data_is_correct(self):
         model = VcsSettingsModel()
         with mock.patch.object(model, '_create_or_update_ui') as create_mock:
             model.create_or_update_global_hg_settings(self.FORM_DATA)
+            Session().commit()
+
         expected_calls = [
             mock.call(model.global_settings, 'extensions', 'largefiles', active=False, value=''),
             mock.call(model.global_settings, 'largefiles', 'usercache', value='/example/largefiles-store'),
             mock.call(model.global_settings, 'phases', 'publish', value='False'),
             mock.call(model.global_settings, 'extensions', 'hgsubversion', active=False),
             mock.call(model.global_settings, 'extensions', 'evolve', active=False, value=''),
             mock.call(model.global_settings, 'experimental', 'evolution', active=False, value=''),
             mock.call(model.global_settings, 'experimental', 'evolution.exchange', active=False, value='no'),
             mock.call(model.global_settings, 'extensions', 'topic', active=False, value=''),
         ]
 
         assert expected_calls == create_mock.call_args_list
 
     @pytest.mark.parametrize('field_to_remove', FORM_DATA.keys())
     def test_key_is_not_found(self, repo_stub, field_to_remove):
         model = VcsSettingsModel(repo=repo_stub.repo_name)
         data = self.FORM_DATA.copy()
         data.pop(field_to_remove)
         with pytest.raises(Exception) as exc_info:
             model.create_or_update_global_hg_settings(data)
+            Session().commit()
+
         expected_message = 'The given data does not contain {} key'.format(
             field_to_remove)
         assert str(exc_info.value) == expected_message
 
 
 class TestCreateOrUpdateGlobalGitSettings(object):
     FORM_DATA = {
         'vcs_git_lfs_enabled': False,
         'vcs_git_lfs_store_location': '/example/lfs-store',
     }
 
     def test_creates_repo_hg_settings_when_data_is_correct(self):
         model = VcsSettingsModel()
         with mock.patch.object(model, '_create_or_update_ui') as create_mock:
             model.create_or_update_global_git_settings(self.FORM_DATA)
+            Session().commit()
+
         expected_calls = [
             mock.call(model.global_settings, 'vcs_git_lfs', 'enabled', active=False, value=False),
             mock.call(model.global_settings, 'vcs_git_lfs', 'store_location', value='/example/lfs-store'),
         ]
         assert expected_calls == create_mock.call_args_list
 
 
 class TestDeleteRepoSvnPattern(object):
     def test_success_when_repo_is_set(self, backend_svn, settings_util):
         repo = backend_svn.create_repo()
         repo_name = repo.repo_name
 
         model = VcsSettingsModel(repo=repo_name)
         entry = settings_util.create_repo_rhodecode_ui(
             repo, VcsSettingsModel.SVN_BRANCH_SECTION, 'svn-branch')
         Session().commit()
 
         model.delete_repo_svn_pattern(entry.ui_id)
 
     def test_fail_when_delete_id_from_other_repo(self, backend_svn):
         repo_name = backend_svn.repo_name
         model = VcsSettingsModel(repo=repo_name)
         delete_ui_patch = mock.patch.object(model.repo_settings, 'delete_ui')
         with delete_ui_patch as delete_ui_mock:
             model.delete_repo_svn_pattern(123)
+            Session().commit()
+
         delete_ui_mock.assert_called_once_with(-1)
 
     def test_raises_exception_when_repository_is_not_specified(self):
         model = VcsSettingsModel()
         with pytest.raises(Exception) as exc_info:
             model.delete_repo_svn_pattern(123)
         assert str(exc_info.value) == 'Repository is not specified'
 
 
 class TestDeleteGlobalSvnPattern(object):
     def test_delete_global_svn_pattern_calls_delete_ui(self):
         model = VcsSettingsModel()
         delete_ui_patch = mock.patch.object(model.global_settings, 'delete_ui')
         with delete_ui_patch as delete_ui_mock:
             model.delete_global_svn_pattern(123)
         delete_ui_mock.assert_called_once_with(123)
 
 
 class TestFilterUiSettings(object):
     def test_settings_are_filtered(self):
         model = VcsSettingsModel()
         repo_settings = [
             UiSetting('extensions', 'largefiles', '', True),
             UiSetting('phases', 'publish', 'True', True),
             UiSetting('hooks', 'changegroup.repo_size', 'hook', True),
             UiSetting('hooks', 'changegroup.push_logger', 'hook', True),
             UiSetting('hooks', 'outgoing.pull_logger', 'hook', True),
             UiSetting(
                 'vcs_svn_branch', '84223c972204fa545ca1b22dac7bef5b68d7442d',
                 'test_branch', True),
             UiSetting(
                 'vcs_svn_tag', '84229c972204fa545ca1b22dac7bef5b68d7442d',
                 'test_tag', True),
         ]
         non_repo_settings = [
             UiSetting('largefiles', 'usercache', '/example/largefiles-store', True),
             UiSetting('test', 'outgoing.pull_logger', 'hook', True),
             UiSetting('hooks', 'test2', 'hook', True),
             UiSetting(
                 'vcs_svn_repo', '84229c972204fa545ca1b22dac7bef5b68d7442d',
                 'test_tag', True),
         ]
         settings = repo_settings + non_repo_settings
         filtered_settings = model._filter_ui_settings(settings)
         assert sorted(filtered_settings) == sorted(repo_settings)
 
 
 class TestFilterGeneralSettings(object):
     def test_settings_are_filtered(self):
         model = VcsSettingsModel()
         settings = {
             'rhodecode_abcde': 'value1',
             'rhodecode_vwxyz': 'value2',
         }
         general_settings = {
             'rhodecode_{}'.format(key): 'value'
             for key in VcsSettingsModel.GENERAL_SETTINGS
         }
         settings.update(general_settings)
 
         filtered_settings = model._filter_general_settings(general_settings)
         assert sorted(filtered_settings) == sorted(general_settings)
 
 
 class TestGetRepoUiSettings(object):
     def test_global_uis_are_returned_when_no_repo_uis_found(
             self, repo_stub):
         model = VcsSettingsModel(repo=repo_stub.repo_name)
         result = model.get_repo_ui_settings()
         svn_sections = (
             VcsSettingsModel.SVN_TAG_SECTION,
             VcsSettingsModel.SVN_BRANCH_SECTION)
         expected_result = [
             s for s in model.global_settings.get_ui()
             if s.section not in svn_sections]
         assert sorted(result) == sorted(expected_result)
 
     def test_repo_uis_are_overriding_global_uis(
             self, repo_stub, settings_util):
         for section, key in VcsSettingsModel.HOOKS_SETTINGS:
             settings_util.create_repo_rhodecode_ui(
                 repo_stub, section, 'repo', key=key, active=False)
         model = VcsSettingsModel(repo=repo_stub.repo_name)
         result = model.get_repo_ui_settings()
         for setting in result:
             locator = (setting.section, setting.key)
             if locator in VcsSettingsModel.HOOKS_SETTINGS:
                 assert setting.value == 'repo'
 
                 assert setting.active is False
 
     def test_global_svn_patterns_are_not_in_list(
             self, repo_stub, settings_util):
         svn_sections = (
             VcsSettingsModel.SVN_TAG_SECTION,
             VcsSettingsModel.SVN_BRANCH_SECTION)
         for section in svn_sections:
             settings_util.create_rhodecode_ui(
                 section, 'repo', key='deadbeef' + section, active=False)
+            Session().commit()
+
         model = VcsSettingsModel(repo=repo_stub.repo_name)
         result = model.get_repo_ui_settings()
         for setting in result:
             assert setting.section not in svn_sections
 
     def test_repo_uis_filtered_by_section_are_returned(
             self, repo_stub, settings_util):
         for section, key in VcsSettingsModel.HOOKS_SETTINGS:
             settings_util.create_repo_rhodecode_ui(
                 repo_stub, section, 'repo', key=key, active=False)
         model = VcsSettingsModel(repo=repo_stub.repo_name)
         section, key = VcsSettingsModel.HOOKS_SETTINGS[0]
         result = model.get_repo_ui_settings(section=section)
         for setting in result:
             assert setting.section == section
 
     def test_repo_uis_filtered_by_key_are_returned(
             self, repo_stub, settings_util):
         for section, key in VcsSettingsModel.HOOKS_SETTINGS:
             settings_util.create_repo_rhodecode_ui(
                 repo_stub, section, 'repo', key=key, active=False)
         model = VcsSettingsModel(repo=repo_stub.repo_name)
         section, key = VcsSettingsModel.HOOKS_SETTINGS[0]
         result = model.get_repo_ui_settings(key=key)
         for setting in result:
             assert setting.key == key
 
     def test_raises_exception_when_repository_is_not_specified(self):
         model = VcsSettingsModel()
         with pytest.raises(Exception) as exc_info:
             model.get_repo_ui_settings()
         assert str(exc_info.value) == 'Repository is not specified'
 
 
 class TestGetRepoGeneralSettings(object):
     def test_global_settings_are_returned_when_no_repo_settings_found(
             self, repo_stub):
         model = VcsSettingsModel(repo=repo_stub.repo_name)
         result = model.get_repo_general_settings()
         expected_result = model.global_settings.get_all_settings()
         assert sorted(result) == sorted(expected_result)
 
     def test_repo_uis_are_overriding_global_uis(
             self, repo_stub, settings_util):
         for key in VcsSettingsModel.GENERAL_SETTINGS:
             settings_util.create_repo_rhodecode_setting(
                 repo_stub, key, 'abcde', type_='unicode')
+            Session().commit()
+
         model = VcsSettingsModel(repo=repo_stub.repo_name)
         result = model.get_repo_ui_settings()
         for key in result:
             if key in VcsSettingsModel.GENERAL_SETTINGS:
                 assert result[key] == 'abcde'
 
     def test_raises_exception_when_repository_is_not_specified(self):
         model = VcsSettingsModel()
         with pytest.raises(Exception) as exc_info:
             model.get_repo_general_settings()
         assert str(exc_info.value) == 'Repository is not specified'
 
 
 class TestGetGlobalGeneralSettings(object):
     def test_global_settings_are_returned(self, repo_stub):
         model = VcsSettingsModel()
         result = model.get_global_general_settings()
         expected_result = model.global_settings.get_all_settings()
         assert sorted(result) == sorted(expected_result)
 
     def test_repo_uis_are_not_overriding_global_uis(
             self, repo_stub, settings_util):
         for key in VcsSettingsModel.GENERAL_SETTINGS:
             settings_util.create_repo_rhodecode_setting(
                 repo_stub, key, 'abcde', type_='unicode')
+            Session().commit()
+
         model = VcsSettingsModel(repo=repo_stub.repo_name)
         result = model.get_global_general_settings()
         expected_result = model.global_settings.get_all_settings()
         assert sorted(result) == sorted(expected_result)
 
 
 class TestGetGlobalUiSettings(object):
     def test_global_uis_are_returned(self, repo_stub):
         model = VcsSettingsModel()
         result = model.get_global_ui_settings()
         expected_result = model.global_settings.get_ui()
         assert sorted(result) == sorted(expected_result)
 
     def test_repo_uis_are_not_overriding_global_uis(
             self, repo_stub, settings_util):
         for section, key in VcsSettingsModel.HOOKS_SETTINGS:
             settings_util.create_repo_rhodecode_ui(
                 repo_stub, section, 'repo', key=key, active=False)
+            Session().commit()
+
         model = VcsSettingsModel(repo=repo_stub.repo_name)
         result = model.get_global_ui_settings()
         expected_result = model.global_settings.get_ui()
         assert sorted(result) == sorted(expected_result)
 
     def test_ui_settings_filtered_by_section(
             self, repo_stub, settings_util):
         model = VcsSettingsModel(repo=repo_stub.repo_name)
         section, key = VcsSettingsModel.HOOKS_SETTINGS[0]
         result = model.get_global_ui_settings(section=section)
         expected_result = model.global_settings.get_ui(section=section)
         assert sorted(result) == sorted(expected_result)
 
     def test_ui_settings_filtered_by_key(
             self, repo_stub, settings_util):
         model = VcsSettingsModel(repo=repo_stub.repo_name)
         section, key = VcsSettingsModel.HOOKS_SETTINGS[0]
         result = model.get_global_ui_settings(key=key)
         expected_result = model.global_settings.get_ui(key=key)
         assert sorted(result) == sorted(expected_result)
 
 
 class TestGetGeneralSettings(object):
     def test_global_settings_are_returned_when_inherited_is_true(
             self, repo_stub, settings_util):
         model = VcsSettingsModel(repo=repo_stub.repo_name)
         model.inherit_global_settings = True
         for key in VcsSettingsModel.GENERAL_SETTINGS:
             settings_util.create_repo_rhodecode_setting(
                 repo_stub, key, 'abcde', type_='unicode')
+            Session().commit()
+
         result = model.get_general_settings()
         expected_result = model.get_global_general_settings()
         assert sorted(result) == sorted(expected_result)
 
     def test_repo_settings_are_returned_when_inherited_is_false(
             self, repo_stub, settings_util):
         model = VcsSettingsModel(repo=repo_stub.repo_name)
         model.inherit_global_settings = False
         for key in VcsSettingsModel.GENERAL_SETTINGS:
             settings_util.create_repo_rhodecode_setting(
                 repo_stub, key, 'abcde', type_='unicode')
+            Session().commit()
+
         result = model.get_general_settings()
         expected_result = model.get_repo_general_settings()
         assert sorted(result) == sorted(expected_result)
 
     def test_global_settings_are_returned_when_no_repository_specified(self):
         model = VcsSettingsModel()
         result = model.get_general_settings()
         expected_result = model.get_global_general_settings()
         assert sorted(result) == sorted(expected_result)
 
 
 class TestGetUiSettings(object):
     def test_global_settings_are_returned_when_inherited_is_true(
             self, repo_stub, settings_util):
         model = VcsSettingsModel(repo=repo_stub.repo_name)
         model.inherit_global_settings = True
         for section, key in VcsSettingsModel.HOOKS_SETTINGS:
             settings_util.create_repo_rhodecode_ui(
                 repo_stub, section, 'repo', key=key, active=True)
+            Session().commit()
+
         result = model.get_ui_settings()
         expected_result = model.get_global_ui_settings()
         assert sorted(result) == sorted(expected_result)
 
     def test_repo_settings_are_returned_when_inherited_is_false(
             self, repo_stub, settings_util):
         model = VcsSettingsModel(repo=repo_stub.repo_name)
         model.inherit_global_settings = False
         for section, key in VcsSettingsModel.HOOKS_SETTINGS:
             settings_util.create_repo_rhodecode_ui(
                 repo_stub, section, 'repo', key=key, active=True)
+            Session().commit()
+
         result = model.get_ui_settings()
         expected_result = model.get_repo_ui_settings()
         assert sorted(result) == sorted(expected_result)
 
     def test_repo_settings_filtered_by_section_and_key(self, repo_stub):
         model = VcsSettingsModel(repo=repo_stub.repo_name)
         model.inherit_global_settings = False
+
         args = ('section', 'key')
         with mock.patch.object(model, 'get_repo_ui_settings') as settings_mock:
             model.get_ui_settings(*args)
+        Session().commit()
+
         settings_mock.assert_called_once_with(*args)
 
     def test_global_settings_filtered_by_section_and_key(self):
         model = VcsSettingsModel()
         args = ('section', 'key')
         with mock.patch.object(model, 'get_global_ui_settings') as (
                 settings_mock):
             model.get_ui_settings(*args)
         settings_mock.assert_called_once_with(*args)
 
     def test_global_settings_are_returned_when_no_repository_specified(self):
         model = VcsSettingsModel()
         result = model.get_ui_settings()
         expected_result = model.get_global_ui_settings()
         assert sorted(result) == sorted(expected_result)
 
 
 class TestGetSvnPatterns(object):
     def test_repo_settings_filtered_by_section_and_key(self, repo_stub):
         model = VcsSettingsModel(repo=repo_stub.repo_name)
         args = ('section', )
         with mock.patch.object(model, 'get_repo_ui_settings') as settings_mock:
             model.get_svn_patterns(*args)
+
+        Session().commit()
         settings_mock.assert_called_once_with(*args)
 
     def test_global_settings_filtered_by_section_and_key(self):
         model = VcsSettingsModel()
         args = ('section', )
         with mock.patch.object(model, 'get_global_ui_settings') as (
                 settings_mock):
             model.get_svn_patterns(*args)
         settings_mock.assert_called_once_with(*args)
 
 
 class TestGetReposLocation(object):
     def test_returns_repos_location(self, repo_stub):
         model = VcsSettingsModel()
 
         result_mock = mock.Mock()
         result_mock.ui_value = '/tmp'
 
         with mock.patch.object(model, 'global_settings') as settings_mock:
             settings_mock.get_ui_by_key.return_value = result_mock
             result = model.get_repos_location()
 
         settings_mock.get_ui_by_key.assert_called_once_with('/')
         assert result == '/tmp'
 
 
 class TestCreateOrUpdateRepoSettings(object):
     FORM_DATA = {
         'inherit_global_settings': False,
         'hooks_changegroup_repo_size': False,
         'hooks_changegroup_push_logger': False,
         'hooks_outgoing_pull_logger': False,
         'extensions_largefiles': False,
         'extensions_evolve': False,
         'largefiles_usercache': '/example/largefiles-store',
         'vcs_git_lfs_enabled': False,
         'vcs_git_lfs_store_location': '/',
         'phases_publish': 'False',
         'rhodecode_pr_merge_enabled': False,
         'rhodecode_use_outdated_comments': False,
         'new_svn_branch': '',
         'new_svn_tag': ''
     }
 
     def test_get_raises_exception_when_repository_not_specified(self):
         model = VcsSettingsModel()
         with pytest.raises(Exception) as exc_info:
             model.create_or_update_repo_settings(data=self.FORM_DATA)
+            Session().commit()
+
         assert str(exc_info.value) == 'Repository is not specified'
 
     def test_only_svn_settings_are_updated_when_type_is_svn(self, backend_svn):
         repo = backend_svn.create_repo()
         model = VcsSettingsModel(repo=repo)
         with self._patch_model(model) as mocks:
             model.create_or_update_repo_settings(
                 data=self.FORM_DATA, inherit_global_settings=False)
+            Session().commit()
+
         mocks['create_repo_svn_settings'].assert_called_once_with(
             self.FORM_DATA)
         non_called_methods = (
             'create_or_update_repo_hook_settings',
             'create_or_update_repo_pr_settings',
             'create_or_update_repo_hg_settings')
         for method in non_called_methods:
             assert mocks[method].call_count == 0
 
     def test_non_svn_settings_are_updated_when_type_is_hg(self, backend_hg):
         repo = backend_hg.create_repo()
         model = VcsSettingsModel(repo=repo)
         with self._patch_model(model) as mocks:
             model.create_or_update_repo_settings(
                 data=self.FORM_DATA, inherit_global_settings=False)
+            Session().commit()
 
         assert mocks['create_repo_svn_settings'].call_count == 0
         called_methods = (
             'create_or_update_repo_hook_settings',
             'create_or_update_repo_pr_settings',
             'create_or_update_repo_hg_settings')
         for method in called_methods:
             mocks[method].assert_called_once_with(self.FORM_DATA)
 
     def test_non_svn_and_hg_settings_are_updated_when_type_is_git(
             self, backend_git):
         repo = backend_git.create_repo()
         model = VcsSettingsModel(repo=repo)
         with self._patch_model(model) as mocks:
             model.create_or_update_repo_settings(
                 data=self.FORM_DATA, inherit_global_settings=False)
 
         assert mocks['create_repo_svn_settings'].call_count == 0
         called_methods = (
             'create_or_update_repo_hook_settings',
             'create_or_update_repo_pr_settings')
         non_called_methods = (
             'create_repo_svn_settings',
             'create_or_update_repo_hg_settings'
         )
         for method in called_methods:
             mocks[method].assert_called_once_with(self.FORM_DATA)
         for method in non_called_methods:
             assert mocks[method].call_count == 0
 
     def test_no_methods_are_called_when_settings_are_inherited(
             self, backend):
         repo = backend.create_repo()
         model = VcsSettingsModel(repo=repo)
         with self._patch_model(model) as mocks:
             model.create_or_update_repo_settings(
                 data=self.FORM_DATA, inherit_global_settings=True)
         for method_name in mocks:
             assert mocks[method_name].call_count == 0
 
     def test_cache_is_marked_for_invalidation(self, repo_stub):
         model = VcsSettingsModel(repo=repo_stub)
         invalidation_patcher = mock.patch(
             'rhodecode.model.scm.ScmModel.mark_for_invalidation')
         with invalidation_patcher as invalidation_mock:
             model.create_or_update_repo_settings(
                 data=self.FORM_DATA, inherit_global_settings=True)
+        Session().commit()
+
         invalidation_mock.assert_called_once_with(
             repo_stub.repo_name, delete=True)
 
     def test_inherit_flag_is_saved(self, repo_stub):
         model = VcsSettingsModel(repo=repo_stub)
         model.inherit_global_settings = True
         with self._patch_model(model):
             model.create_or_update_repo_settings(
                 data=self.FORM_DATA, inherit_global_settings=False)
+            Session().commit()
+
         assert model.inherit_global_settings is False
 
     def _patch_model(self, model):
         return mock.patch.multiple(
             model,
             create_repo_svn_settings=mock.DEFAULT,
             create_or_update_repo_hook_settings=mock.DEFAULT,
             create_or_update_repo_pr_settings=mock.DEFAULT,
             create_or_update_repo_hg_settings=mock.DEFAULT)

rhodecode/tests/models/test_permissions.py

@@ -1,735 +1,744 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2019 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import pytest
 
 from rhodecode.lib.auth import AuthUser
 from rhodecode.model.db import (
     RepoGroup, User, UserGroupRepoGroupToPerm, Permission, UserToPerm,
     UserGroupToPerm)
 from rhodecode.model.meta import Session
 from rhodecode.model.permission import PermissionModel
 from rhodecode.model.repo import RepoModel
 from rhodecode.model.repo_group import RepoGroupModel
 from rhodecode.model.user import UserModel
 from rhodecode.model.user_group import UserGroupModel
 from rhodecode.tests.fixture import Fixture
 
 
 fixture = Fixture()
 
 
 @pytest.fixture()
 def repo_name(backend_hg):
     return backend_hg.repo_name
 
 
 class TestPermissions(object):
 
     @pytest.fixture(scope='class', autouse=True)
     def default_permissions(self, request, baseapp):
         # recreate default user to get a clean start
         PermissionModel().create_default_user_permissions(
             user=User.DEFAULT_USER, force=True)
         Session().commit()
 
     @pytest.fixture(autouse=True)
     def prepare_users(self, request):
         # TODO: User creation is a duplicate of test_nofitications, check
         # if that can be unified
         self.u1 = UserModel().create_or_update(
             username=u'u1', password=u'qweqwe',
             email=u'[e-mail]', firstname=u'u1', lastname=u'u1'
         )
         self.u2 = UserModel().create_or_update(
             username=u'u2', password=u'qweqwe',
             email=u'[e-mail]', firstname=u'u2', lastname=u'u2'
         )
         self.u3 = UserModel().create_or_update(
             username=u'u3', password=u'qweqwe',
             email=u'[e-mail]', firstname=u'u3', lastname=u'u3'
         )
         self.anon = User.get_default_user()
         self.a1 = UserModel().create_or_update(
             username=u'a1', password=u'qweqwe',
             email=u'[e-mail]', firstname=u'a1', lastname=u'a1',
             admin=True
         )
         Session().commit()
 
         request.addfinalizer(self.cleanup)
 
     def cleanup(self):
         if hasattr(self, 'test_repo'):
             RepoModel().delete(repo=self.test_repo)
+            Session().commit()
 
         if hasattr(self, 'g1'):
             RepoGroupModel().delete(self.g1.group_id)
         if hasattr(self, 'g2'):
             RepoGroupModel().delete(self.g2.group_id)
+        Session().commit()
 
-        UserModel().delete(self.u1)
-        UserModel().delete(self.u2)
-        UserModel().delete(self.u3)
-        UserModel().delete(self.a1)
+        UserModel().delete(self.u1, handle_repos='delete', handle_repo_groups='delete')
+        UserModel().delete(self.u2, handle_repos='delete', handle_repo_groups='delete')
+        UserModel().delete(self.u3, handle_repos='delete', handle_repo_groups='delete')
+        UserModel().delete(self.a1, handle_repos='delete', handle_repo_groups='delete')
+        Session().commit()
 
         if hasattr(self, 'ug1'):
             UserGroupModel().delete(self.ug1, force=True)
-
         Session().commit()
 
     def test_default_perms_set(self, repo_name):
         assert repo_perms(self.u1)[repo_name] == 'repository.read'
         new_perm = 'repository.write'
         RepoModel().grant_user_permission(repo=repo_name, user=self.u1,
                                           perm=new_perm)
         Session().commit()
         assert repo_perms(self.u1)[repo_name] == new_perm
 
     def test_default_admin_perms_set(self, repo_name):
         assert repo_perms(self.a1)[repo_name] == 'repository.admin'
         RepoModel().grant_user_permission(repo=repo_name, user=self.a1,
                                           perm='repository.write')
         Session().commit()
         # cannot really downgrade admins permissions !? they still gets set as
         # admin !
         assert repo_perms(self.a1)[repo_name] == 'repository.admin'
 
     def test_default_group_perms(self, repo_name):
         self.g1 = fixture.create_repo_group('test1', skip_if_exists=True)
         self.g2 = fixture.create_repo_group('test2', skip_if_exists=True)
 
         assert repo_perms(self.u1)[repo_name] == 'repository.read'
         assert group_perms(self.u1) == {
             'test1': 'group.read', 'test2': 'group.read'}
         assert global_perms(self.u1) == set(
             Permission.DEFAULT_USER_PERMISSIONS)
 
     def test_default_admin_group_perms(self, repo_name):
         self.g1 = fixture.create_repo_group('test1', skip_if_exists=True)
         self.g2 = fixture.create_repo_group('test2', skip_if_exists=True)
 
         assert repo_perms(self.a1)[repo_name] == 'repository.admin'
         assert group_perms(self.a1) == {
             'test1': 'group.admin', 'test2': 'group.admin'}
 
     def test_default_owner_repo_perms(self, backend, user_util, test_repo):
         user = user_util.create_user()
         repo = test_repo('minimal', backend.alias)
         org_owner = repo.user
         assert repo_perms(user)[repo.repo_name] == 'repository.read'
 
         repo.user = user
         assert repo_perms(user)[repo.repo_name] == 'repository.admin'
         repo.user = org_owner
 
     def test_default_owner_branch_perms(self, user_util, test_user_group):
         user = user_util.create_user()
         assert branch_perms(user) == {}
 
     def test_default_owner_repo_group_perms(self, user_util, test_repo_group):
         user = user_util.create_user()
         org_owner = test_repo_group.user
 
         assert group_perms(user)[test_repo_group.group_name] == 'group.read'
 
         test_repo_group.user = user
         assert group_perms(user)[test_repo_group.group_name] == 'group.admin'
         test_repo_group.user = org_owner
 
     def test_default_owner_user_group_perms(self, user_util, test_user_group):
         user = user_util.create_user()
         org_owner = test_user_group.user
 
         assert user_group_perms(user)[test_user_group.users_group_name] == 'usergroup.read'
 
         test_user_group.user = user
         assert user_group_perms(user)[test_user_group.users_group_name] == 'usergroup.admin'
 
         test_user_group.user = org_owner
 
     def test_propagated_permission_from_users_group_by_explicit_perms_exist(
             self, repo_name):
         # make group
         self.ug1 = fixture.create_user_group('G1')
         UserGroupModel().add_user_to_group(self.ug1, self.u1)
 
         # set permission to lower
         new_perm = 'repository.none'
         RepoModel().grant_user_permission(
             repo=repo_name, user=self.u1, perm=new_perm)
         Session().commit()
         assert repo_perms(self.u1)[repo_name] == new_perm
 
         # grant perm for group this should not override permission from user
         # since it has explicitly set
         new_perm_gr = 'repository.write'
         RepoModel().grant_user_group_permission(
             repo=repo_name, group_name=self.ug1, perm=new_perm_gr)
+        Session().commit()
 
         assert repo_perms(self.u1)[repo_name] == new_perm
         assert group_perms(self.u1) == {}
 
     def test_propagated_permission_from_users_group(self, repo_name):
         # make group
         self.ug1 = fixture.create_user_group('G1')
         UserGroupModel().add_user_to_group(self.ug1, self.u3)
 
         # grant perm for group
         # this should override default permission from user
         new_perm_gr = 'repository.write'
         RepoModel().grant_user_group_permission(
             repo=repo_name, group_name=self.ug1, perm=new_perm_gr)
+        Session().commit()
 
         assert repo_perms(self.u3)[repo_name] == new_perm_gr
         assert group_perms(self.u3) == {}
 
     def test_propagated_permission_from_users_group_lower_weight(
             self, repo_name):
         # make group with user
         self.ug1 = fixture.create_user_group('G1')
         UserGroupModel().add_user_to_group(self.ug1, self.u1)
 
         # set permission to lower
         new_perm_h = 'repository.write'
         RepoModel().grant_user_permission(
             repo=repo_name, user=self.u1, perm=new_perm_h)
         Session().commit()
 
         assert repo_perms(self.u1)[repo_name] == new_perm_h
 
         # grant perm for group this should NOT override permission from user
         # since it's lower than granted
         new_perm_l = 'repository.read'
         RepoModel().grant_user_group_permission(
             repo=repo_name, group_name=self.ug1, perm=new_perm_l)
+        Session().commit()
 
         assert repo_perms(self.u1)[repo_name] == new_perm_h
         assert group_perms(self.u1) == {}
 
     def test_repo_in_group_permissions(self):
         self.g1 = fixture.create_repo_group('group1', skip_if_exists=True)
         self.g2 = fixture.create_repo_group('group2', skip_if_exists=True)
         # both perms should be read !
         assert group_perms(self.u1) == \
             {u'group1': u'group.read', u'group2': u'group.read'}
 
         assert group_perms(self.anon) == \
             {u'group1': u'group.read', u'group2': u'group.read'}
 
         # Change perms to none for both groups
         RepoGroupModel().grant_user_permission(
             repo_group=self.g1, user=self.anon, perm='group.none')
         RepoGroupModel().grant_user_permission(
             repo_group=self.g2, user=self.anon, perm='group.none')
 
         assert group_perms(self.u1) == \
             {u'group1': u'group.none', u'group2': u'group.none'}
         assert group_perms(self.anon) == \
             {u'group1': u'group.none', u'group2': u'group.none'}
 
         # add repo to group
         name = RepoGroup.url_sep().join([self.g1.group_name, 'test_perm'])
         self.test_repo = fixture.create_repo(name=name,
                                              repo_type='hg',
                                              repo_group=self.g1,
                                              cur_user=self.u1,)
 
         assert group_perms(self.u1) == \
             {u'group1': u'group.none', u'group2': u'group.none'}
         assert group_perms(self.anon) == \
             {u'group1': u'group.none', u'group2': u'group.none'}
 
         # grant permission for u2 !
         RepoGroupModel().grant_user_permission(
             repo_group=self.g1, user=self.u2, perm='group.read')
         RepoGroupModel().grant_user_permission(
             repo_group=self.g2, user=self.u2, perm='group.read')
         Session().commit()
         assert self.u1 != self.u2
 
         # u1 and anon should have not change perms while u2 should !
         assert group_perms(self.u1) == \
             {u'group1': u'group.none', u'group2': u'group.none'}
         assert group_perms(self.u2) == \
             {u'group1': u'group.read', u'group2': u'group.read'}
         assert group_perms(self.anon) == \
             {u'group1': u'group.none', u'group2': u'group.none'}
 
     def test_repo_group_user_as_user_group_member(self):
         # create Group1
         self.g1 = fixture.create_repo_group('group1', skip_if_exists=True)
         assert group_perms(self.anon) == {u'group1': u'group.read'}
 
         # set default permission to none
         RepoGroupModel().grant_user_permission(
             repo_group=self.g1, user=self.anon, perm='group.none')
+        Session().commit()
+
         # make group
         self.ug1 = fixture.create_user_group('G1')
         # add user to group
         UserGroupModel().add_user_to_group(self.ug1, self.u1)
         Session().commit()
 
         # check if user is in the group
         ug1 = UserGroupModel().get(self.ug1.users_group_id)
         members = [x.user_id for x in ug1.members]
         assert members == [self.u1.user_id]
         # add some user to that group
 
         # check his permissions
         assert group_perms(self.anon) == {u'group1': u'group.none'}
         assert group_perms(self.u1) == {u'group1': u'group.none'}
 
         # grant ug1 read permissions for
         RepoGroupModel().grant_user_group_permission(
             repo_group=self.g1, group_name=self.ug1, perm='group.read')
         Session().commit()
 
         # check if the
         obj = Session().query(UserGroupRepoGroupToPerm)\
             .filter(UserGroupRepoGroupToPerm.group == self.g1)\
             .filter(UserGroupRepoGroupToPerm.users_group == self.ug1)\
             .scalar()
         assert obj.permission.permission_name == 'group.read'
 
         assert group_perms(self.anon) == {u'group1': u'group.none'}
         assert group_perms(self.u1) == {u'group1': u'group.read'}
 
     def test_inherited_permissions_from_default_on_user_enabled(self):
         # enable fork and create on default user
         _form_result = {
             'default_repo_create': 'hg.create.repository',
             'default_fork_create': 'hg.fork.repository'
         }
         PermissionModel().set_new_user_perms(
             User.get_default_user(), _form_result)
         Session().commit()
 
         # make sure inherit flag is turned on
         self.u1.inherit_default_permissions = True
         Session().commit()
 
         # this user will have inherited permissions from default user
         assert global_perms(self.u1) == default_perms()
 
     def test_inherited_permissions_from_default_on_user_disabled(self):
         # disable fork and create on default user
         _form_result = {
             'default_repo_create': 'hg.create.none',
             'default_fork_create': 'hg.fork.none'
         }
         PermissionModel().set_new_user_perms(
             User.get_default_user(), _form_result)
         Session().commit()
 
         # make sure inherit flag is turned on
         self.u1.inherit_default_permissions = True
         Session().commit()
 
         # this user will have inherited permissions from default user
         expected_perms = default_perms(
             added=['hg.create.none', 'hg.fork.none'],
             removed=['hg.create.repository', 'hg.fork.repository'])
         assert global_perms(self.u1) == expected_perms
 
     def test_non_inherited_permissions_from_default_on_user_enabled(self):
         user_model = UserModel()
         # enable fork and create on default user
         usr = User.DEFAULT_USER
         user_model.revoke_perm(usr, 'hg.create.none')
         user_model.grant_perm(usr, 'hg.create.repository')
         user_model.revoke_perm(usr, 'hg.fork.none')
         user_model.grant_perm(usr, 'hg.fork.repository')
 
         # disable global perms on specific user
         user_model.revoke_perm(self.u1, 'hg.create.repository')
         user_model.grant_perm(self.u1, 'hg.create.none')
         user_model.revoke_perm(self.u1, 'hg.fork.repository')
         user_model.grant_perm(self.u1, 'hg.fork.none')
 
         # TODO(marcink): check branch permissions now ?
 
         # make sure inherit flag is turned off
         self.u1.inherit_default_permissions = False
         Session().commit()
 
         # this user will have non inherited permissions from he's
         # explicitly set permissions
         assert global_perms(self.u1) == {
             'hg.create.none',
             'hg.fork.none',
             'hg.register.manual_activate',
             'hg.password_reset.enabled',
             'hg.extern_activate.auto',
             'repository.read',
             'group.read',
             'usergroup.read',
             'branch.push_force',
         }
 
     def test_non_inherited_permissions_from_default_on_user_disabled(self):
         user_model = UserModel()
         # disable fork and create on default user
         usr = User.DEFAULT_USER
         user_model.revoke_perm(usr, 'hg.create.repository')
         user_model.grant_perm(usr, 'hg.create.none')
         user_model.revoke_perm(usr, 'hg.fork.repository')
         user_model.grant_perm(usr, 'hg.fork.none')
 
         # enable global perms on specific user
         user_model.revoke_perm(self.u1, 'hg.create.none')
         user_model.grant_perm(self.u1, 'hg.create.repository')
         user_model.revoke_perm(self.u1, 'hg.fork.none')
         user_model.grant_perm(self.u1, 'hg.fork.repository')
 
         # make sure inherit flag is turned off
         self.u1.inherit_default_permissions = False
         Session().commit()
 
         # TODO(marcink): check branch perms
 
         # this user will have non inherited permissions from he's
         # explicitly set permissions
         assert global_perms(self.u1) == {
             'hg.create.repository',
             'hg.fork.repository',
             'hg.register.manual_activate',
             'hg.password_reset.enabled',
             'hg.extern_activate.auto',
             'repository.read',
             'group.read',
             'usergroup.read',
             'branch.push_force',
         }
 
     @pytest.mark.parametrize('perm, expected_perm', [
         ('hg.inherit_default_perms.false', 'repository.none', ),
         ('hg.inherit_default_perms.true', 'repository.read', ),
     ])
     def test_inherited_permissions_on_objects(self, perm, expected_perm):
         _form_result = {
             'default_inherit_default_permissions': perm,
         }
         PermissionModel().set_new_user_perms(
             User.get_default_user(), _form_result)
         Session().commit()
 
         # make sure inherit flag is turned on
         self.u1.inherit_default_permissions = True
         Session().commit()
 
         # TODO(marcink): check branch perms
 
         # this user will have inherited permissions from default user
         assert global_perms(self.u1) == {
             'hg.create.none',
             'hg.fork.none',
             'hg.register.manual_activate',
             'hg.password_reset.enabled',
             'hg.extern_activate.auto',
             'repository.read',
             'group.read',
             'usergroup.read',
             'branch.push_force',
             'hg.create.write_on_repogroup.true',
             'hg.usergroup.create.false',
             'hg.repogroup.create.false',
             perm
         }
 
         assert set(repo_perms(self.u1).values()) == set([expected_perm])
 
     def test_repo_owner_permissions_not_overwritten_by_group(self):
         # create repo as USER,
         self.test_repo = fixture.create_repo(name='myownrepo',
                                              repo_type='hg',
                                              cur_user=self.u1)
 
         # he has permissions of admin as owner
         assert repo_perms(self.u1)['myownrepo'] == 'repository.admin'
 
         # set his permission as user group, he should still be admin
         self.ug1 = fixture.create_user_group('G1')
         UserGroupModel().add_user_to_group(self.ug1, self.u1)
         RepoModel().grant_user_group_permission(
             self.test_repo,
             group_name=self.ug1,
             perm='repository.none')
         Session().commit()
 
         assert repo_perms(self.u1)['myownrepo'] == 'repository.admin'
 
     def test_repo_owner_permissions_not_overwritten_by_others(self):
         # create repo as USER,
         self.test_repo = fixture.create_repo(name='myownrepo',
                                              repo_type='hg',
                                              cur_user=self.u1)
 
         # he has permissions of admin as owner
         assert repo_perms(self.u1)['myownrepo'] == 'repository.admin'
 
         # set his permission as user, he should still be admin
         RepoModel().grant_user_permission(
             self.test_repo, user=self.u1, perm='repository.none')
         Session().commit()
 
         assert repo_perms(self.u1)['myownrepo'] == 'repository.admin'
 
     def test_repo_group_owner_permissions_not_overwritten_by_group(self):
         # "u1" shall be owner without any special permission assigned
         self.g1 = fixture.create_repo_group('test1')
 
         # Make user group and grant a permission to user group
         self.ug1 = fixture.create_user_group('G1')
         UserGroupModel().add_user_to_group(self.ug1, self.u1)
         RepoGroupModel().grant_user_group_permission(
             repo_group=self.g1, group_name=self.ug1, perm='group.write')
+        Session().commit()
 
         # Verify that user does not get any special permission if he is not
         # owner
         assert group_perms(self.u1) == {'test1': 'group.write'}
 
         # Make him owner of the repo group
         self.g1.user = self.u1
         assert group_perms(self.u1) == {'test1': 'group.admin'}
 
     def test_repo_group_owner_permissions_not_overwritten_by_others(self):
         # "u1" shall be owner without any special permission assigned
         self.g1 = fixture.create_repo_group('test1')
         RepoGroupModel().grant_user_permission(
             repo_group=self.g1, user=self.u1, perm='group.write')
+        Session().commit()
 
         # Verify that user does not get any special permission if he is not
         # owner
         assert group_perms(self.u1) == {'test1': 'group.write'}
 
         # Make him owner of the repo group
         self.g1.user = self.u1
         assert group_perms(self.u1) == {u'test1': 'group.admin'}
 
-    def _test_def_user_perm_equal(
+    def assert_user_perm_equal(
             self, user, change_factor=0, compare_keys=None):
         perms = UserToPerm.query().filter(UserToPerm.user == user).all()
         assert len(perms) == \
             len(Permission.DEFAULT_USER_PERMISSIONS) + change_factor
         if compare_keys:
             assert set(
                 x.permissions.permission_name for x in perms) == compare_keys
 
-    def _test_def_user_group_perm_equal(
+    def assert_def_user_group_perm_equal(
             self, user_group, change_factor=0, compare_keys=None):
         perms = UserGroupToPerm.query().filter(
             UserGroupToPerm.users_group == user_group).all()
         assert len(perms) == \
             len(Permission.DEFAULT_USER_PERMISSIONS) + change_factor
         if compare_keys:
             assert set(
                 x.permissions.permission_name for x in perms) == compare_keys
 
     def test_set_default_permissions(self):
         PermissionModel().create_default_user_permissions(user=self.u1)
-        self._test_def_user_perm_equal(user=self.u1)
+        self.assert_user_perm_equal(user=self.u1)
 
     def test_set_default_permissions_after_one_is_missing(self):
         PermissionModel().create_default_user_permissions(user=self.u1)
-        self._test_def_user_perm_equal(user=self.u1)
+        self.assert_user_perm_equal(user=self.u1)
         # now we delete one, it should be re-created after another call
         perms = UserToPerm.query().filter(UserToPerm.user == self.u1).all()
         Session().delete(perms[0])
         Session().commit()
 
-        self._test_def_user_perm_equal(user=self.u1, change_factor=-1)
+        self.assert_user_perm_equal(user=self.u1, change_factor=-1)
 
         # create missing one !
         PermissionModel().create_default_user_permissions(user=self.u1)
-        self._test_def_user_perm_equal(user=self.u1)
+        self.assert_user_perm_equal(user=self.u1)
 
     @pytest.mark.parametrize("perm, modify_to", [
         ('repository.read', 'repository.none'),
         ('group.read', 'group.none'),
         ('usergroup.read', 'usergroup.none'),
         ('hg.create.repository', 'hg.create.none'),
         ('hg.fork.repository', 'hg.fork.none'),
         ('hg.register.manual_activate', 'hg.register.auto_activate',)
     ])
     def test_set_default_permissions_after_modification(self, perm, modify_to):
         PermissionModel().create_default_user_permissions(user=self.u1)
-        self._test_def_user_perm_equal(user=self.u1)
+        self.assert_user_perm_equal(user=self.u1)
 
         old = Permission.get_by_key(perm)
         new = Permission.get_by_key(modify_to)
         assert old is not None
         assert new is not None
 
         # now modify permissions
         p = UserToPerm.query().filter(
             UserToPerm.user == self.u1).filter(
             UserToPerm.permission == old).one()
         p.permission = new
         Session().add(p)
         Session().commit()
 
         PermissionModel().create_default_user_permissions(user=self.u1)
-        self._test_def_user_perm_equal(user=self.u1)
+        self.assert_user_perm_equal(user=self.u1)
 
     def test_clear_user_perms(self):
         PermissionModel().create_default_user_permissions(user=self.u1)
-        self._test_def_user_perm_equal(user=self.u1)
+        self.assert_user_perm_equal(user=self.u1)
 
         # now clear permissions
         cleared = PermissionModel()._clear_user_perms(self.u1.user_id)
-        self._test_def_user_perm_equal(user=self.u1,
+        self.assert_user_perm_equal(user=self.u1,
                                        change_factor=len(cleared)*-1)
 
     def test_clear_user_group_perms(self):
         self.ug1 = fixture.create_user_group('G1')
         PermissionModel().create_default_user_group_permissions(
             user_group=self.ug1)
-        self._test_def_user_group_perm_equal(user_group=self.ug1)
+        self.assert_def_user_group_perm_equal(user_group=self.ug1)
 
         # now clear permissions
         cleared = PermissionModel()._clear_user_group_perms(
             self.ug1.users_group_id)
-        self._test_def_user_group_perm_equal(user_group=self.ug1,
+        self.assert_def_user_group_perm_equal(user_group=self.ug1,
                                              change_factor=len(cleared)*-1)
 
     @pytest.mark.parametrize("form_result", [
         {},
         {'default_repo_create': 'hg.create.repository'},
         {'default_repo_create': 'hg.create.repository',
          'default_repo_perm': 'repository.read'},
         {'default_repo_create': 'hg.create.none',
          'default_repo_perm': 'repository.write',
          'default_fork_create': 'hg.fork.none'},
     ])
     def test_set_new_user_permissions(self, form_result):
         _form_result = {}
         _form_result.update(form_result)
         PermissionModel().set_new_user_perms(self.u1, _form_result)
         Session().commit()
         change_factor = -1 * (len(Permission.DEFAULT_USER_PERMISSIONS)
                               - len(form_result.keys()))
-        self._test_def_user_perm_equal(
+        self.assert_user_perm_equal(
             self.u1, change_factor=change_factor)
 
     @pytest.mark.parametrize("form_result", [
         {},
         {'default_repo_create': 'hg.create.repository'},
         {'default_repo_create': 'hg.create.repository',
          'default_repo_perm': 'repository.read'},
         {'default_repo_create': 'hg.create.none',
          'default_repo_perm': 'repository.write',
          'default_fork_create': 'hg.fork.none'},
     ])
     def test_set_new_user_group_permissions(self, form_result):
         _form_result = {}
         _form_result.update(form_result)
         self.ug1 = fixture.create_user_group('G1')
         PermissionModel().set_new_user_group_perms(self.ug1, _form_result)
         Session().commit()
         change_factor = -1 * (len(Permission.DEFAULT_USER_PERMISSIONS)
                               - len(form_result.keys()))
-        self._test_def_user_group_perm_equal(
+        self.assert_def_user_group_perm_equal(
             self.ug1, change_factor=change_factor)
 
     @pytest.mark.parametrize("group_active, expected_perm", [
         (True, 'repository.admin'),
         (False, 'repository.read'),
     ])
     def test_get_default_repo_perms_from_user_group_with_active_group(
             self, backend, user_util, group_active, expected_perm):
         repo = backend.create_repo()
         user = user_util.create_user()
         user_group = user_util.create_user_group(
             members=[user], users_group_active=group_active)
 
         user_util.grant_user_group_permission_to_repo(
             repo, user_group, 'repository.admin')
         permissions = repo_perms(user)
         repo_permission = permissions.get(repo.repo_name)
         assert repo_permission == expected_perm
 
     @pytest.mark.parametrize("group_active, expected_perm", [
         (True, 'group.admin'),
         (False, 'group.read')
     ])
     def test_get_default_group_perms_from_user_group_with_active_group(
             self, user_util, group_active, expected_perm):
         user = user_util.create_user()
         repo_group = user_util.create_repo_group()
         user_group = user_util.create_user_group(
             members=[user], users_group_active=group_active)
 
         user_util.grant_user_group_permission_to_repo_group(
             repo_group, user_group, 'group.admin')
         permissions = group_perms(user)
         group_permission = permissions.get(repo_group.name)
         assert group_permission == expected_perm
 
     @pytest.mark.parametrize("group_active, expected_perm", [
         (True, 'usergroup.admin'),
         (False, 'usergroup.read')
     ])
     def test_get_default_user_group_perms_from_user_group_with_active_group(
             self, user_util, group_active, expected_perm):
         user = user_util.create_user()
         user_group = user_util.create_user_group(
             members=[user], users_group_active=group_active)
         target_user_group = user_util.create_user_group()
 
         user_util.grant_user_group_permission_to_user_group(
             target_user_group, user_group, 'usergroup.admin')
         permissions = user_group_perms(user)
         group_permission = permissions.get(target_user_group.users_group_name)
         assert group_permission == expected_perm
 
 
 def repo_perms(user):
     auth_user = AuthUser(user_id=user.user_id)
     return auth_user.permissions['repositories']
 
 
 def branch_perms(user):
     auth_user = AuthUser(user_id=user.user_id)
     return auth_user.permissions['repository_branches']
 
 
 def group_perms(user):
     auth_user = AuthUser(user_id=user.user_id)
     return auth_user.permissions['repositories_groups']
 
 
 def user_group_perms(user):
     auth_user = AuthUser(user_id=user.user_id)
     return auth_user.permissions['user_groups']
 
 
 def global_perms(user):
     auth_user = AuthUser(user_id=user.user_id)
     return auth_user.permissions['global']
 
 
 def default_perms(added=None, removed=None):
     expected_perms = set(Permission.DEFAULT_USER_PERMISSIONS)
     if removed:
         expected_perms.difference_update(removed)
     if added:
         expected_perms.update(added)
     return expected_perms