permissions: properly flush user cache permissions in more cases of permission changes.

- fixed  #5560

rhodecode/api/views/repo_api.py

@@ -43,6 +43,7 b' from rhodecode.model.comment import Comm'
 from rhodecode.model.db import (
     Session, ChangesetStatus, RepositoryField, Repository, RepoGroup,
     ChangesetComment)
+from rhodecode.model.permission import PermissionModel
 from rhodecode.model.repo import RepoModel
 from rhodecode.model.scm import ScmModel, RepoList
 from rhodecode.model.settings import SettingsModel, VcsSettingsModel
@@ -1771,8 +1772,9 b' def grant_user_permission(request, apius'
         }
         audit_logger.store_api(
             'repo.edit.permissions', action_data=action_data, user=apiuser, repo=repo)
+        Session().commit()
+        PermissionModel().flush_user_permission_caches(changes)
 
-        Session().commit()
         return {
             'msg': 'Granted perm: `%s` for user: `%s` in repo: `%s`' % (
                 perm.permission_name, user.username, repo.repo_name
@@ -1833,8 +1835,9 b' def revoke_user_permission(request, apiu'
         }
         audit_logger.store_api(
             'repo.edit.permissions', action_data=action_data, user=apiuser, repo=repo)
+        Session().commit()
+        PermissionModel().flush_user_permission_caches(changes)
 
-        Session().commit()
         return {
             'msg': 'Revoked perm for user: `%s` in repo: `%s`' % (
                 user.username, repo.repo_name
@@ -1919,8 +1922,9 b' def grant_user_group_permission(request,'
         }
         audit_logger.store_api(
             'repo.edit.permissions', action_data=action_data, user=apiuser, repo=repo)
+        Session().commit()
+        PermissionModel().flush_user_permission_caches(changes)
 
-        Session().commit()
         return {
             'msg': 'Granted perm: `%s` for user group: `%s` in '
                    'repo: `%s`' % (
@@ -1992,8 +1996,9 b' def revoke_user_group_permission(request'
         }
         audit_logger.store_api(
             'repo.edit.permissions', action_data=action_data, user=apiuser, repo=repo)
+        Session().commit()
+        PermissionModel().flush_user_permission_caches(changes)
 
-        Session().commit()
         return {
             'msg': 'Revoked perm for user group: `%s` in repo: `%s`' % (
                 user_group.users_group_name, repo.repo_name

rhodecode/api/views/repo_group_api.py

@@ -31,6 +31,7 b' from rhodecode.lib import audit_logger'
 from rhodecode.lib.auth import (
     HasRepoGroupPermissionAnyApi, HasUserGroupPermissionAnyApi)
 from rhodecode.model.db import Session
+from rhodecode.model.permission import PermissionModel
 from rhodecode.model.repo_group import RepoGroupModel
 from rhodecode.model.scm import RepoGroupList
 from rhodecode.model import validation_schema
@@ -465,8 +466,9 b' def grant_user_permission_to_repo_group('
         audit_logger.store_api(
             'repo_group.edit.permissions', action_data=action_data,
             user=apiuser)
+        Session().commit()
+        PermissionModel().flush_user_permission_caches(changes)
 
-        Session().commit()
         return {
             'msg': 'Granted perm: `%s` (recursive:%s) for user: '
                    '`%s` in repo group: `%s`' % (
@@ -548,8 +550,9 b' def revoke_user_permission_from_repo_gro'
         audit_logger.store_api(
             'repo_group.edit.permissions', action_data=action_data,
             user=apiuser)
+        Session().commit()
+        PermissionModel().flush_user_permission_caches(changes)
 
-        Session().commit()
         return {
             'msg': 'Revoked perm (recursive:%s) for user: '
                    '`%s` in repo group: `%s`' % (
@@ -641,8 +644,9 b' def grant_user_group_permission_to_repo_'
         audit_logger.store_api(
             'repo_group.edit.permissions', action_data=action_data,
             user=apiuser)
+        Session().commit()
+        PermissionModel().flush_user_permission_caches(changes)
 
-        Session().commit()
         return {
             'msg': 'Granted perm: `%s` (recursive:%s) '
                    'for user group: `%s` in repo group: `%s`' % (
@@ -733,8 +737,9 b' def revoke_user_group_permission_from_re'
         audit_logger.store_api(
             'repo_group.edit.permissions', action_data=action_data,
             user=apiuser)
+        Session().commit()
+        PermissionModel().flush_user_permission_caches(changes)
 
-        Session().commit()
         return {
             'msg': 'Revoked perm (recursive:%s) for user group: '
                    '`%s` in repo group: `%s`' % (

rhodecode/api/views/user_group_api.py

@@ -29,6 +29,7 b' from rhodecode.lib import audit_logger'
 from rhodecode.lib.auth import HasUserGroupPermissionAnyApi, HasPermissionAnyApi
 from rhodecode.lib.exceptions import UserGroupAssignedException
 from rhodecode.model.db import Session
+from rhodecode.model.permission import PermissionModel
 from rhodecode.model.scm import UserGroupList
 from rhodecode.model.user_group import UserGroupModel
 from rhodecode.model import validation_schema
@@ -266,6 +267,10 b' def create_user_group('
             'user_group.create', action_data={'data': creation_data},
             user=apiuser)
         Session().commit()
+
+        affected_user_ids = [apiuser.user_id, owner.user_id]
+        PermissionModel().trigger_permission_flush(affected_user_ids)
+
         return {
             'msg': 'created new user group `%s`' % group_name,
             'user_group': creation_data
@@ -649,8 +654,9 b' def grant_user_permission_to_user_group('
         audit_logger.store_api(
             'user_group.edit.permissions', action_data=action_data,
             user=apiuser)
+        Session().commit()
+        PermissionModel().flush_user_permission_caches(changes)
 
-        Session().commit()
         return {
             'msg':
                 'Granted perm: `%s` for user: `%s` in user group: `%s`' % (
@@ -718,8 +724,9 b' def revoke_user_permission_from_user_gro'
         audit_logger.store_api(
             'user_group.edit.permissions', action_data=action_data,
             user=apiuser)
+        Session().commit()
+        PermissionModel().flush_user_permission_caches(changes)
 
-        Session().commit()
         return {
             'msg': 'Revoked perm for user: `%s` in user group: `%s`' % (
                 user.username, user_group.users_group_name
@@ -795,8 +802,9 b' def grant_user_group_permission_to_user_'
         audit_logger.store_api(
             'user_group.edit.permissions', action_data=action_data,
             user=apiuser)
+        Session().commit()
+        PermissionModel().flush_user_permission_caches(changes)
 
-        Session().commit()
         return {
             'msg': 'Granted perm: `%s` for user group: `%s` '
                    'in user group: `%s`' % (
@@ -873,8 +881,8 b' def revoke_user_group_permission_from_us'
         audit_logger.store_api(
             'user_group.edit.permissions', action_data=action_data,
             user=apiuser)
-
         Session().commit()
+        PermissionModel().flush_user_permission_caches(changes)
 
         return {
             'msg': 'Revoked perm for user group: '

rhodecode/apps/admin/views/permissions.py

@@ -142,7 +142,7 b' class AdminPermissionsView(BaseAppView, '
                     category='error')
 
         affected_user_ids = [User.get_default_user().user_id]
-        events.trigger(events.UserPermissionsChange(affected_user_ids))
+        PermissionModel().trigger_permission_flush(affected_user_ids)
 
         raise HTTPFound(h.route_path('admin_permissions_application'))
 
@@ -218,7 +218,7 b' class AdminPermissionsView(BaseAppView, '
                     category='error')
 
         affected_user_ids = [User.get_default_user().user_id]
-        events.trigger(events.UserPermissionsChange(affected_user_ids))
+        PermissionModel().trigger_permission_flush(affected_user_ids)
 
         raise HTTPFound(h.route_path('admin_permissions_object'))
 
@@ -320,7 +320,7 b' class AdminPermissionsView(BaseAppView, '
                     category='error')
 
         affected_user_ids = [User.get_default_user().user_id]
-        events.trigger(events.UserPermissionsChange(affected_user_ids))
+        PermissionModel().trigger_permission_flush(affected_user_ids)
 
         raise HTTPFound(h.route_path('admin_permissions_global'))
 

rhodecode/apps/admin/views/repo_groups.py

@@ -36,6 +36,7 b' from rhodecode.lib.auth import ('
 from rhodecode.lib import helpers as h, audit_logger
 from rhodecode.lib.utils2 import safe_int, safe_unicode, datetime_to_time
 from rhodecode.model.forms import RepoGroupForm
+from rhodecode.model.permission import PermissionModel
 from rhodecode.model.repo_group import RepoGroupModel
 from rhodecode.model.scm import RepoGroupList
 from rhodecode.model.db import (
@@ -354,7 +355,7 b' class AdminRepoGroupsView(BaseAppView, D'
             copy_perms = [perm['user_id'] for perm in user_group_perms]
             # also include those newly created by copy
             affected_user_ids.extend(copy_perms)
-        events.trigger(events.UserPermissionsChange(affected_user_ids))
+        PermissionModel().trigger_permission_flush(affected_user_ids)
 
         raise HTTPFound(
             h.route_path('repo_group_home',

rhodecode/apps/admin/views/repositories.py

@@ -39,6 +39,7 b' from rhodecode.lib import helpers as h'
 from rhodecode.lib.utils import repo_name_slug
 from rhodecode.lib.utils2 import safe_int, safe_unicode
 from rhodecode.model.forms import RepoForm
+from rhodecode.model.permission import PermissionModel
 from rhodecode.model.repo import RepoModel
 from rhodecode.model.scm import RepoList, RepoGroupList, ScmModel
 from rhodecode.model.settings import SettingsModel
@@ -182,7 +183,7 b' class AdminReposView(BaseAppView, DataGr'
         if copy_permissions:
             # permission flush is done in repo creating
             pass
-        events.trigger(events.UserPermissionsChange(affected_user_ids))
+        PermissionModel().trigger_permission_flush(affected_user_ids)
 
         raise HTTPFound(
             h.route_path('repo_creating', repo_name=repo_name,

rhodecode/apps/admin/views/user_groups.py

@@ -266,6 +266,8 b' class AdminUserGroupsView(BaseAppView, D'
                     % user_group_name, category='error')
             raise HTTPFound(h.route_path('user_groups_new'))
 
-        events.trigger(events.UserPermissionsChange([self._rhodecode_user.user_id]))
+        affected_user_ids = [self._rhodecode_user.user_id]
+        PermissionModel().trigger_permission_flush(affected_user_ids)
+
         raise HTTPFound(
             h.route_path('edit_user_group', user_group_id=user_group_id))

rhodecode/apps/admin/views/users.py

@@ -597,7 +597,7 b' class UsersView(UserAppView):'
                     category='error')
 
         affected_user_ids = [user_id]
-        events.trigger(events.UserPermissionsChange(affected_user_ids))
+        PermissionModel().trigger_permission_flush(affected_user_ids)
         raise HTTPFound(h.route_path('user_edit_global_perms', user_id=user_id))
 
     @LoginRequired()

rhodecode/apps/repo_group/views/repo_group_permissions.py

@@ -23,14 +23,12 b' import logging'
 from pyramid.view import view_config
 from pyramid.httpexceptions import HTTPFound
 
-from rhodecode import events
 from rhodecode.apps._base import RepoGroupAppView
 from rhodecode.lib import helpers as h
 from rhodecode.lib import audit_logger
 from rhodecode.lib.auth import (
     LoginRequired, HasRepoGroupPermissionAnyDecorator, CSRFRequired)
-from rhodecode.lib.utils2 import safe_int
-from rhodecode.model.db import UserGroup
+from rhodecode.model.permission import PermissionModel
 from rhodecode.model.repo_group import RepoGroupModel
 from rhodecode.model.forms import RepoGroupPermsForm
 from rhodecode.model.meta import Session
@@ -98,18 +96,7 b' class RepoGroupPermissionsView(RepoGroup'
 
         Session().commit()
         h.flash(_('Repository Group permissions updated'), category='success')
-
-        affected_user_ids = []
-        for change in changes['added'] + changes['updated'] + changes['deleted']:
-            if change['type'] == 'user':
-                affected_user_ids.append(change['id'])
-            if change['type'] == 'user_group':
-                user_group = UserGroup.get(safe_int(change['id']))
-                if user_group:
-                    group_members_ids = [x.user_id for x in user_group.members]
-                    affected_user_ids.extend(group_members_ids)
-
-        events.trigger(events.UserPermissionsChange(affected_user_ids))
+        PermissionModel().flush_user_permission_caches(changes)
 
         raise HTTPFound(
             h.route_path('edit_repo_group_perms',

rhodecode/apps/repo_group/views/repo_group_settings.py

@@ -33,6 +33,7 b' from rhodecode.lib.auth import ('
     LoginRequired, HasPermissionAll,
     HasRepoGroupPermissionAny, HasRepoGroupPermissionAnyDecorator, CSRFRequired)
 from rhodecode.model.db import Session, RepoGroup, User
+from rhodecode.model.permission import PermissionModel
 from rhodecode.model.scm import RepoGroupList
 from rhodecode.model.repo_group import RepoGroupModel
 from rhodecode.model.validation_schema.schemas import repo_group_schema
@@ -187,7 +188,7 b' class RepoGroupSettingsView(RepoGroupApp'
             owner = User.get_by_username(schema_data['repo_group_owner'])
             owner_id = owner.user_id if owner else self._rhodecode_user.user_id
             affected_user_ids.extend([self._rhodecode_user.user_id, owner_id])
-            events.trigger(events.UserPermissionsChange(affected_user_ids))
+            PermissionModel().trigger_permission_flush(affected_user_ids)
 
         raise HTTPFound(
             h.route_path('edit_repo_group', repo_group_name=new_repo_group_name))

rhodecode/apps/repository/views/repo_checks.py

@@ -28,6 +28,7 b' from rhodecode.apps._base import BaseApp'
 from rhodecode.lib import helpers as h
 from rhodecode.lib.auth import (NotAnonymous, HasRepoPermissionAny)
 from rhodecode.model.db import Repository
+from rhodecode.model.permission import PermissionModel
 from rhodecode.model.validation_schema.types import RepoNameType
 
 log = logging.getLogger(__name__)
@@ -122,4 +123,4 b' class RepoChecksView(BaseAppView):'
         # repo is finished and created, we flush the permissions now
         user_group_perms = db_repo.permissions(expand_from_user_groups=True)
         affected_user_ids = [perm['user_id'] for perm in user_group_perms]
-        events.trigger(events.UserPermissionsChange(affected_user_ids))
+        PermissionModel().trigger_permission_flush(affected_user_ids)

rhodecode/apps/repository/views/repo_forks.py

@@ -36,6 +36,7 b' from rhodecode.lib.auth import ('
 import rhodecode.lib.helpers as h
 from rhodecode.lib.celerylib.utils import get_task_id
 from rhodecode.model.db import coalesce, or_, Repository, RepoGroup
+from rhodecode.model.permission import PermissionModel
 from rhodecode.model.repo import RepoModel
 from rhodecode.model.forms import RepoForkForm
 from rhodecode.model.scm import ScmModel, RepoGroupList
@@ -259,7 +260,7 b' class RepoForksView(RepoAppView, DataGri'
             # permission flush is done in repo creating
             pass
 
-        events.trigger(events.UserPermissionsChange(affected_user_ids))
+        PermissionModel().trigger_permission_flush(affected_user_ids)
 
         raise HTTPFound(
             h.route_path('repo_creating', repo_name=repo_name,

rhodecode/apps/repository/views/repo_permissions.py

@@ -23,16 +23,14 b' import logging'
 from pyramid.httpexceptions import HTTPFound
 from pyramid.view import view_config
 
-from rhodecode import events
 from rhodecode.apps._base import RepoAppView
 from rhodecode.lib import helpers as h
 from rhodecode.lib import audit_logger
 from rhodecode.lib.auth import (
     LoginRequired, HasRepoPermissionAnyDecorator, CSRFRequired)
-from rhodecode.lib.utils2 import safe_int
-from rhodecode.model.db import UserGroup
 from rhodecode.model.forms import RepoPermsForm
 from rhodecode.model.meta import Session
+from rhodecode.model.permission import PermissionModel
 from rhodecode.model.repo import RepoModel
 
 log = logging.getLogger(__name__)
@@ -91,17 +89,7 b' class RepoSettingsPermissionsView(RepoAp'
         Session().commit()
         h.flash(_('Repository permissions updated'), category='success')
 
-        affected_user_ids = []
-        for change in changes['added'] + changes['updated'] + changes['deleted']:
-            if change['type'] == 'user':
-                affected_user_ids.append(change['id'])
-            if change['type'] == 'user_group':
-                user_group = UserGroup.get(safe_int(change['id']))
-                if user_group:
-                    group_members_ids = [x.user_id for x in user_group.members]
-                    affected_user_ids.extend(group_members_ids)
-
-        events.trigger(events.UserPermissionsChange(affected_user_ids))
+        PermissionModel().flush_user_permission_caches(changes)
 
         raise HTTPFound(
             h.route_path('edit_repo_perms', repo_name=self.db_repo_name))

rhodecode/apps/repository/views/repo_settings.py

@@ -33,6 +33,7 b' from rhodecode.lib.auth import ('
     LoginRequired, HasRepoPermissionAnyDecorator, CSRFRequired)
 from rhodecode.model.db import RepositoryField, RepoGroup, Repository, User
 from rhodecode.model.meta import Session
+from rhodecode.model.permission import PermissionModel
 from rhodecode.model.repo import RepoModel
 from rhodecode.model.scm import RepoGroupList, ScmModel
 from rhodecode.model.validation_schema.schemas import repo_schema
@@ -184,7 +185,7 b' class RepoSettingsView(RepoAppView):'
             owner = User.get_by_username(schema_data['repo_owner'])
             owner_id = owner.user_id if owner else self._rhodecode_user.user_id
             affected_user_ids.extend([self._rhodecode_user.user_id, owner_id])
-            events.trigger(events.UserPermissionsChange(affected_user_ids))
+            PermissionModel().trigger_permission_flush(affected_user_ids)
 
         raise HTTPFound(
             h.route_path('edit_repo', repo_name=new_repo_name))

rhodecode/apps/repository/views/repo_settings_advanced.py

@@ -34,6 +34,7 b' from rhodecode.lib.exceptions import Att'
 from rhodecode.lib.utils2 import safe_int
 from rhodecode.lib.vcs import RepositoryError
 from rhodecode.model.db import Session, UserFollowing, User, Repository
+from rhodecode.model.permission import PermissionModel
 from rhodecode.model.repo import RepoModel
 from rhodecode.model.scm import ScmModel
 
@@ -110,7 +111,7 b' class RepoSettingsView(RepoAppView):'
 
         # flush permissions for all users defined in permissions
         affected_user_ids = self._get_users_with_permissions().keys()
-        events.trigger(events.UserPermissionsChange(affected_user_ids))
+        PermissionModel().trigger_permission_flush(affected_user_ids)
 
         raise HTTPFound(h.route_path('home'))
 

rhodecode/apps/user_group/views/__init__.py

@@ -199,7 +199,7 b' class UserGroupsView(UserGroupAppView):'
                 affected_user_ids.append(self._rhodecode_user.user_id)
                 affected_user_ids.append(owner_id)
 
-            events.trigger(events.UserPermissionsChange(affected_user_ids))
+            PermissionModel().trigger_permission_flush(affected_user_ids)
 
             Session().commit()
         except formencode.Invalid as errors:
@@ -383,7 +383,7 b' class UserGroupsView(UserGroupAppView):'
                     group_members_ids = [x.user_id for x in user_group.members]
                     affected_user_ids.extend(group_members_ids)
 
-        events.trigger(events.UserPermissionsChange(affected_user_ids))
+        PermissionModel().trigger_permission_flush(affected_user_ids)
 
         raise HTTPFound(
             h.route_path('edit_user_group_perms', user_group_id=user_group_id))

rhodecode/model/permission.py

@@ -28,6 +28,7 b' import traceback'
 
 from sqlalchemy.exc import DatabaseError
 
+from rhodecode import events
 from rhodecode.model import BaseModel
 from rhodecode.model.db import (
     User, Permission, UserToPerm, UserRepoToPerm, UserRepoGroupToPerm,
@@ -556,3 +557,21 b' class PermissionModel(BaseModel):'
             self.sa.rollback()
             raise
 
+    def trigger_permission_flush(self, affected_user_ids):
+        events.trigger(events.UserPermissionsChange(affected_user_ids))
+
+    def flush_user_permission_caches(self, changes, affected_user_ids=None):
+        affected_user_ids = affected_user_ids or []
+
+        for change in changes['added'] + changes['updated'] + changes['deleted']:
+            if change['type'] == 'user':
+                affected_user_ids.append(change['id'])
+            if change['type'] == 'user_group':
+                user_group = UserGroup.get(safe_int(change['id']))
+                if user_group:
+                    group_members_ids = [x.user_id for x in user_group.members]
+                    affected_user_ids.extend(group_members_ids)
+
+        self.trigger_permission_flush(affected_user_ids)
+
+        return affected_user_ids