##// END OF EJS Templates
caches: switch other permission cache to use same cache region.
marcink -
r2815:506cc0a8 default
parent child Browse files
Show More
@@ -1,2198 +1,2198 b''
1 # -*- coding: utf-8 -*-
1 # -*- coding: utf-8 -*-
2
2
3 # Copyright (C) 2010-2018 RhodeCode GmbH
3 # Copyright (C) 2010-2018 RhodeCode GmbH
4 #
4 #
5 # This program is free software: you can redistribute it and/or modify
5 # This program is free software: you can redistribute it and/or modify
6 # it under the terms of the GNU Affero General Public License, version 3
6 # it under the terms of the GNU Affero General Public License, version 3
7 # (only), as published by the Free Software Foundation.
7 # (only), as published by the Free Software Foundation.
8 #
8 #
9 # This program is distributed in the hope that it will be useful,
9 # This program is distributed in the hope that it will be useful,
10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 # GNU General Public License for more details.
12 # GNU General Public License for more details.
13 #
13 #
14 # You should have received a copy of the GNU Affero General Public License
14 # You should have received a copy of the GNU Affero General Public License
15 # along with this program. If not, see <http://www.gnu.org/licenses/>.
15 # along with this program. If not, see <http://www.gnu.org/licenses/>.
16 #
16 #
17 # This program is dual-licensed. If you wish to learn more about the
17 # This program is dual-licensed. If you wish to learn more about the
18 # RhodeCode Enterprise Edition, including its added features, Support services,
18 # RhodeCode Enterprise Edition, including its added features, Support services,
19 # and proprietary license terms, please see https://rhodecode.com/licenses/
19 # and proprietary license terms, please see https://rhodecode.com/licenses/
20
20
21 """
21 """
22 authentication and permission libraries
22 authentication and permission libraries
23 """
23 """
24
24
25 import os
25 import os
26 import time
26 import time
27 import inspect
27 import inspect
28 import collections
28 import collections
29 import fnmatch
29 import fnmatch
30 import hashlib
30 import hashlib
31 import itertools
31 import itertools
32 import logging
32 import logging
33 import random
33 import random
34 import traceback
34 import traceback
35 from functools import wraps
35 from functools import wraps
36
36
37 import ipaddress
37 import ipaddress
38
38
39 from pyramid.httpexceptions import HTTPForbidden, HTTPFound, HTTPNotFound
39 from pyramid.httpexceptions import HTTPForbidden, HTTPFound, HTTPNotFound
40 from sqlalchemy.orm.exc import ObjectDeletedError
40 from sqlalchemy.orm.exc import ObjectDeletedError
41 from sqlalchemy.orm import joinedload
41 from sqlalchemy.orm import joinedload
42 from zope.cachedescriptors.property import Lazy as LazyProperty
42 from zope.cachedescriptors.property import Lazy as LazyProperty
43
43
44 import rhodecode
44 import rhodecode
45 from rhodecode.model import meta
45 from rhodecode.model import meta
46 from rhodecode.model.meta import Session
46 from rhodecode.model.meta import Session
47 from rhodecode.model.user import UserModel
47 from rhodecode.model.user import UserModel
48 from rhodecode.model.db import (
48 from rhodecode.model.db import (
49 User, Repository, Permission, UserToPerm, UserGroupToPerm, UserGroupMember,
49 User, Repository, Permission, UserToPerm, UserGroupToPerm, UserGroupMember,
50 UserIpMap, UserApiKeys, RepoGroup, UserGroup)
50 UserIpMap, UserApiKeys, RepoGroup, UserGroup)
51 from rhodecode.lib import caches
51 from rhodecode.lib import caches
52 from rhodecode.lib.utils2 import safe_unicode, aslist, safe_str, md5, safe_int
52 from rhodecode.lib.utils2 import safe_unicode, aslist, safe_str, md5, safe_int
53 from rhodecode.lib.utils import (
53 from rhodecode.lib.utils import (
54 get_repo_slug, get_repo_group_slug, get_user_group_slug)
54 get_repo_slug, get_repo_group_slug, get_user_group_slug)
55 from rhodecode.lib.caching_query import FromCache
55 from rhodecode.lib.caching_query import FromCache
56
56
57
57
58 if rhodecode.is_unix:
58 if rhodecode.is_unix:
59 import bcrypt
59 import bcrypt
60
60
61 log = logging.getLogger(__name__)
61 log = logging.getLogger(__name__)
62
62
63 csrf_token_key = "csrf_token"
63 csrf_token_key = "csrf_token"
64
64
65
65
66 class PasswordGenerator(object):
66 class PasswordGenerator(object):
67 """
67 """
68 This is a simple class for generating password from different sets of
68 This is a simple class for generating password from different sets of
69 characters
69 characters
70 usage::
70 usage::
71
71
72 passwd_gen = PasswordGenerator()
72 passwd_gen = PasswordGenerator()
73 #print 8-letter password containing only big and small letters
73 #print 8-letter password containing only big and small letters
74 of alphabet
74 of alphabet
75 passwd_gen.gen_password(8, passwd_gen.ALPHABETS_BIG_SMALL)
75 passwd_gen.gen_password(8, passwd_gen.ALPHABETS_BIG_SMALL)
76 """
76 """
77 ALPHABETS_NUM = r'''1234567890'''
77 ALPHABETS_NUM = r'''1234567890'''
78 ALPHABETS_SMALL = r'''qwertyuiopasdfghjklzxcvbnm'''
78 ALPHABETS_SMALL = r'''qwertyuiopasdfghjklzxcvbnm'''
79 ALPHABETS_BIG = r'''QWERTYUIOPASDFGHJKLZXCVBNM'''
79 ALPHABETS_BIG = r'''QWERTYUIOPASDFGHJKLZXCVBNM'''
80 ALPHABETS_SPECIAL = r'''`-=[]\;',./~!@#$%^&*()_+{}|:"<>?'''
80 ALPHABETS_SPECIAL = r'''`-=[]\;',./~!@#$%^&*()_+{}|:"<>?'''
81 ALPHABETS_FULL = ALPHABETS_BIG + ALPHABETS_SMALL \
81 ALPHABETS_FULL = ALPHABETS_BIG + ALPHABETS_SMALL \
82 + ALPHABETS_NUM + ALPHABETS_SPECIAL
82 + ALPHABETS_NUM + ALPHABETS_SPECIAL
83 ALPHABETS_ALPHANUM = ALPHABETS_BIG + ALPHABETS_SMALL + ALPHABETS_NUM
83 ALPHABETS_ALPHANUM = ALPHABETS_BIG + ALPHABETS_SMALL + ALPHABETS_NUM
84 ALPHABETS_BIG_SMALL = ALPHABETS_BIG + ALPHABETS_SMALL
84 ALPHABETS_BIG_SMALL = ALPHABETS_BIG + ALPHABETS_SMALL
85 ALPHABETS_ALPHANUM_BIG = ALPHABETS_BIG + ALPHABETS_NUM
85 ALPHABETS_ALPHANUM_BIG = ALPHABETS_BIG + ALPHABETS_NUM
86 ALPHABETS_ALPHANUM_SMALL = ALPHABETS_SMALL + ALPHABETS_NUM
86 ALPHABETS_ALPHANUM_SMALL = ALPHABETS_SMALL + ALPHABETS_NUM
87
87
88 def __init__(self, passwd=''):
88 def __init__(self, passwd=''):
89 self.passwd = passwd
89 self.passwd = passwd
90
90
91 def gen_password(self, length, type_=None):
91 def gen_password(self, length, type_=None):
92 if type_ is None:
92 if type_ is None:
93 type_ = self.ALPHABETS_FULL
93 type_ = self.ALPHABETS_FULL
94 self.passwd = ''.join([random.choice(type_) for _ in xrange(length)])
94 self.passwd = ''.join([random.choice(type_) for _ in xrange(length)])
95 return self.passwd
95 return self.passwd
96
96
97
97
98 class _RhodeCodeCryptoBase(object):
98 class _RhodeCodeCryptoBase(object):
99 ENC_PREF = None
99 ENC_PREF = None
100
100
101 def hash_create(self, str_):
101 def hash_create(self, str_):
102 """
102 """
103 hash the string using
103 hash the string using
104
104
105 :param str_: password to hash
105 :param str_: password to hash
106 """
106 """
107 raise NotImplementedError
107 raise NotImplementedError
108
108
109 def hash_check_with_upgrade(self, password, hashed):
109 def hash_check_with_upgrade(self, password, hashed):
110 """
110 """
111 Returns tuple in which first element is boolean that states that
111 Returns tuple in which first element is boolean that states that
112 given password matches it's hashed version, and the second is new hash
112 given password matches it's hashed version, and the second is new hash
113 of the password, in case this password should be migrated to new
113 of the password, in case this password should be migrated to new
114 cipher.
114 cipher.
115 """
115 """
116 checked_hash = self.hash_check(password, hashed)
116 checked_hash = self.hash_check(password, hashed)
117 return checked_hash, None
117 return checked_hash, None
118
118
119 def hash_check(self, password, hashed):
119 def hash_check(self, password, hashed):
120 """
120 """
121 Checks matching password with it's hashed value.
121 Checks matching password with it's hashed value.
122
122
123 :param password: password
123 :param password: password
124 :param hashed: password in hashed form
124 :param hashed: password in hashed form
125 """
125 """
126 raise NotImplementedError
126 raise NotImplementedError
127
127
128 def _assert_bytes(self, value):
128 def _assert_bytes(self, value):
129 """
129 """
130 Passing in an `unicode` object can lead to hard to detect issues
130 Passing in an `unicode` object can lead to hard to detect issues
131 if passwords contain non-ascii characters. Doing a type check
131 if passwords contain non-ascii characters. Doing a type check
132 during runtime, so that such mistakes are detected early on.
132 during runtime, so that such mistakes are detected early on.
133 """
133 """
134 if not isinstance(value, str):
134 if not isinstance(value, str):
135 raise TypeError(
135 raise TypeError(
136 "Bytestring required as input, got %r." % (value, ))
136 "Bytestring required as input, got %r." % (value, ))
137
137
138
138
139 class _RhodeCodeCryptoBCrypt(_RhodeCodeCryptoBase):
139 class _RhodeCodeCryptoBCrypt(_RhodeCodeCryptoBase):
140 ENC_PREF = ('$2a$10', '$2b$10')
140 ENC_PREF = ('$2a$10', '$2b$10')
141
141
142 def hash_create(self, str_):
142 def hash_create(self, str_):
143 self._assert_bytes(str_)
143 self._assert_bytes(str_)
144 return bcrypt.hashpw(str_, bcrypt.gensalt(10))
144 return bcrypt.hashpw(str_, bcrypt.gensalt(10))
145
145
146 def hash_check_with_upgrade(self, password, hashed):
146 def hash_check_with_upgrade(self, password, hashed):
147 """
147 """
148 Returns tuple in which first element is boolean that states that
148 Returns tuple in which first element is boolean that states that
149 given password matches it's hashed version, and the second is new hash
149 given password matches it's hashed version, and the second is new hash
150 of the password, in case this password should be migrated to new
150 of the password, in case this password should be migrated to new
151 cipher.
151 cipher.
152
152
153 This implements special upgrade logic which works like that:
153 This implements special upgrade logic which works like that:
154 - check if the given password == bcrypted hash, if yes then we
154 - check if the given password == bcrypted hash, if yes then we
155 properly used password and it was already in bcrypt. Proceed
155 properly used password and it was already in bcrypt. Proceed
156 without any changes
156 without any changes
157 - if bcrypt hash check is not working try with sha256. If hash compare
157 - if bcrypt hash check is not working try with sha256. If hash compare
158 is ok, it means we using correct but old hashed password. indicate
158 is ok, it means we using correct but old hashed password. indicate
159 hash change and proceed
159 hash change and proceed
160 """
160 """
161
161
162 new_hash = None
162 new_hash = None
163
163
164 # regular pw check
164 # regular pw check
165 password_match_bcrypt = self.hash_check(password, hashed)
165 password_match_bcrypt = self.hash_check(password, hashed)
166
166
167 # now we want to know if the password was maybe from sha256
167 # now we want to know if the password was maybe from sha256
168 # basically calling _RhodeCodeCryptoSha256().hash_check()
168 # basically calling _RhodeCodeCryptoSha256().hash_check()
169 if not password_match_bcrypt:
169 if not password_match_bcrypt:
170 if _RhodeCodeCryptoSha256().hash_check(password, hashed):
170 if _RhodeCodeCryptoSha256().hash_check(password, hashed):
171 new_hash = self.hash_create(password) # make new bcrypt hash
171 new_hash = self.hash_create(password) # make new bcrypt hash
172 password_match_bcrypt = True
172 password_match_bcrypt = True
173
173
174 return password_match_bcrypt, new_hash
174 return password_match_bcrypt, new_hash
175
175
176 def hash_check(self, password, hashed):
176 def hash_check(self, password, hashed):
177 """
177 """
178 Checks matching password with it's hashed value.
178 Checks matching password with it's hashed value.
179
179
180 :param password: password
180 :param password: password
181 :param hashed: password in hashed form
181 :param hashed: password in hashed form
182 """
182 """
183 self._assert_bytes(password)
183 self._assert_bytes(password)
184 try:
184 try:
185 return bcrypt.hashpw(password, hashed) == hashed
185 return bcrypt.hashpw(password, hashed) == hashed
186 except ValueError as e:
186 except ValueError as e:
187 # we're having a invalid salt here probably, we should not crash
187 # we're having a invalid salt here probably, we should not crash
188 # just return with False as it would be a wrong password.
188 # just return with False as it would be a wrong password.
189 log.debug('Failed to check password hash using bcrypt %s',
189 log.debug('Failed to check password hash using bcrypt %s',
190 safe_str(e))
190 safe_str(e))
191
191
192 return False
192 return False
193
193
194
194
195 class _RhodeCodeCryptoSha256(_RhodeCodeCryptoBase):
195 class _RhodeCodeCryptoSha256(_RhodeCodeCryptoBase):
196 ENC_PREF = '_'
196 ENC_PREF = '_'
197
197
198 def hash_create(self, str_):
198 def hash_create(self, str_):
199 self._assert_bytes(str_)
199 self._assert_bytes(str_)
200 return hashlib.sha256(str_).hexdigest()
200 return hashlib.sha256(str_).hexdigest()
201
201
202 def hash_check(self, password, hashed):
202 def hash_check(self, password, hashed):
203 """
203 """
204 Checks matching password with it's hashed value.
204 Checks matching password with it's hashed value.
205
205
206 :param password: password
206 :param password: password
207 :param hashed: password in hashed form
207 :param hashed: password in hashed form
208 """
208 """
209 self._assert_bytes(password)
209 self._assert_bytes(password)
210 return hashlib.sha256(password).hexdigest() == hashed
210 return hashlib.sha256(password).hexdigest() == hashed
211
211
212
212
213 class _RhodeCodeCryptoMd5(_RhodeCodeCryptoBase):
213 class _RhodeCodeCryptoMd5(_RhodeCodeCryptoBase):
214 ENC_PREF = '_'
214 ENC_PREF = '_'
215
215
216 def hash_create(self, str_):
216 def hash_create(self, str_):
217 self._assert_bytes(str_)
217 self._assert_bytes(str_)
218 return hashlib.md5(str_).hexdigest()
218 return hashlib.md5(str_).hexdigest()
219
219
220 def hash_check(self, password, hashed):
220 def hash_check(self, password, hashed):
221 """
221 """
222 Checks matching password with it's hashed value.
222 Checks matching password with it's hashed value.
223
223
224 :param password: password
224 :param password: password
225 :param hashed: password in hashed form
225 :param hashed: password in hashed form
226 """
226 """
227 self._assert_bytes(password)
227 self._assert_bytes(password)
228 return hashlib.md5(password).hexdigest() == hashed
228 return hashlib.md5(password).hexdigest() == hashed
229
229
230
230
231 def crypto_backend():
231 def crypto_backend():
232 """
232 """
233 Return the matching crypto backend.
233 Return the matching crypto backend.
234
234
235 Selection is based on if we run tests or not, we pick md5 backend to run
235 Selection is based on if we run tests or not, we pick md5 backend to run
236 tests faster since BCRYPT is expensive to calculate
236 tests faster since BCRYPT is expensive to calculate
237 """
237 """
238 if rhodecode.is_test:
238 if rhodecode.is_test:
239 RhodeCodeCrypto = _RhodeCodeCryptoMd5()
239 RhodeCodeCrypto = _RhodeCodeCryptoMd5()
240 else:
240 else:
241 RhodeCodeCrypto = _RhodeCodeCryptoBCrypt()
241 RhodeCodeCrypto = _RhodeCodeCryptoBCrypt()
242
242
243 return RhodeCodeCrypto
243 return RhodeCodeCrypto
244
244
245
245
246 def get_crypt_password(password):
246 def get_crypt_password(password):
247 """
247 """
248 Create the hash of `password` with the active crypto backend.
248 Create the hash of `password` with the active crypto backend.
249
249
250 :param password: The cleartext password.
250 :param password: The cleartext password.
251 :type password: unicode
251 :type password: unicode
252 """
252 """
253 password = safe_str(password)
253 password = safe_str(password)
254 return crypto_backend().hash_create(password)
254 return crypto_backend().hash_create(password)
255
255
256
256
257 def check_password(password, hashed):
257 def check_password(password, hashed):
258 """
258 """
259 Check if the value in `password` matches the hash in `hashed`.
259 Check if the value in `password` matches the hash in `hashed`.
260
260
261 :param password: The cleartext password.
261 :param password: The cleartext password.
262 :type password: unicode
262 :type password: unicode
263
263
264 :param hashed: The expected hashed version of the password.
264 :param hashed: The expected hashed version of the password.
265 :type hashed: The hash has to be passed in in text representation.
265 :type hashed: The hash has to be passed in in text representation.
266 """
266 """
267 password = safe_str(password)
267 password = safe_str(password)
268 return crypto_backend().hash_check(password, hashed)
268 return crypto_backend().hash_check(password, hashed)
269
269
270
270
271 def generate_auth_token(data, salt=None):
271 def generate_auth_token(data, salt=None):
272 """
272 """
273 Generates API KEY from given string
273 Generates API KEY from given string
274 """
274 """
275
275
276 if salt is None:
276 if salt is None:
277 salt = os.urandom(16)
277 salt = os.urandom(16)
278 return hashlib.sha1(safe_str(data) + salt).hexdigest()
278 return hashlib.sha1(safe_str(data) + salt).hexdigest()
279
279
280
280
281 def get_came_from(request):
281 def get_came_from(request):
282 """
282 """
283 get query_string+path from request sanitized after removing auth_token
283 get query_string+path from request sanitized after removing auth_token
284 """
284 """
285 _req = request
285 _req = request
286
286
287 path = _req.path
287 path = _req.path
288 if 'auth_token' in _req.GET:
288 if 'auth_token' in _req.GET:
289 # sanitize the request and remove auth_token for redirection
289 # sanitize the request and remove auth_token for redirection
290 _req.GET.pop('auth_token')
290 _req.GET.pop('auth_token')
291 qs = _req.query_string
291 qs = _req.query_string
292 if qs:
292 if qs:
293 path += '?' + qs
293 path += '?' + qs
294
294
295 return path
295 return path
296
296
297
297
298 class CookieStoreWrapper(object):
298 class CookieStoreWrapper(object):
299
299
300 def __init__(self, cookie_store):
300 def __init__(self, cookie_store):
301 self.cookie_store = cookie_store
301 self.cookie_store = cookie_store
302
302
303 def __repr__(self):
303 def __repr__(self):
304 return 'CookieStore<%s>' % (self.cookie_store)
304 return 'CookieStore<%s>' % (self.cookie_store)
305
305
306 def get(self, key, other=None):
306 def get(self, key, other=None):
307 if isinstance(self.cookie_store, dict):
307 if isinstance(self.cookie_store, dict):
308 return self.cookie_store.get(key, other)
308 return self.cookie_store.get(key, other)
309 elif isinstance(self.cookie_store, AuthUser):
309 elif isinstance(self.cookie_store, AuthUser):
310 return self.cookie_store.__dict__.get(key, other)
310 return self.cookie_store.__dict__.get(key, other)
311
311
312
312
313 def _cached_perms_data(user_id, scope, user_is_admin,
313 def _cached_perms_data(user_id, scope, user_is_admin,
314 user_inherit_default_permissions, explicit, algo,
314 user_inherit_default_permissions, explicit, algo,
315 calculate_super_admin):
315 calculate_super_admin):
316
316
317 permissions = PermissionCalculator(
317 permissions = PermissionCalculator(
318 user_id, scope, user_is_admin, user_inherit_default_permissions,
318 user_id, scope, user_is_admin, user_inherit_default_permissions,
319 explicit, algo, calculate_super_admin)
319 explicit, algo, calculate_super_admin)
320 return permissions.calculate()
320 return permissions.calculate()
321
321
322
322
323 class PermOrigin(object):
323 class PermOrigin(object):
324 SUPER_ADMIN = 'superadmin'
324 SUPER_ADMIN = 'superadmin'
325
325
326 REPO_USER = 'user:%s'
326 REPO_USER = 'user:%s'
327 REPO_USERGROUP = 'usergroup:%s'
327 REPO_USERGROUP = 'usergroup:%s'
328 REPO_OWNER = 'repo.owner'
328 REPO_OWNER = 'repo.owner'
329 REPO_DEFAULT = 'repo.default'
329 REPO_DEFAULT = 'repo.default'
330 REPO_DEFAULT_NO_INHERIT = 'repo.default.no.inherit'
330 REPO_DEFAULT_NO_INHERIT = 'repo.default.no.inherit'
331 REPO_PRIVATE = 'repo.private'
331 REPO_PRIVATE = 'repo.private'
332
332
333 REPOGROUP_USER = 'user:%s'
333 REPOGROUP_USER = 'user:%s'
334 REPOGROUP_USERGROUP = 'usergroup:%s'
334 REPOGROUP_USERGROUP = 'usergroup:%s'
335 REPOGROUP_OWNER = 'group.owner'
335 REPOGROUP_OWNER = 'group.owner'
336 REPOGROUP_DEFAULT = 'group.default'
336 REPOGROUP_DEFAULT = 'group.default'
337 REPOGROUP_DEFAULT_NO_INHERIT = 'group.default.no.inherit'
337 REPOGROUP_DEFAULT_NO_INHERIT = 'group.default.no.inherit'
338
338
339 USERGROUP_USER = 'user:%s'
339 USERGROUP_USER = 'user:%s'
340 USERGROUP_USERGROUP = 'usergroup:%s'
340 USERGROUP_USERGROUP = 'usergroup:%s'
341 USERGROUP_OWNER = 'usergroup.owner'
341 USERGROUP_OWNER = 'usergroup.owner'
342 USERGROUP_DEFAULT = 'usergroup.default'
342 USERGROUP_DEFAULT = 'usergroup.default'
343 USERGROUP_DEFAULT_NO_INHERIT = 'usergroup.default.no.inherit'
343 USERGROUP_DEFAULT_NO_INHERIT = 'usergroup.default.no.inherit'
344
344
345
345
346 class PermOriginDict(dict):
346 class PermOriginDict(dict):
347 """
347 """
348 A special dict used for tracking permissions along with their origins.
348 A special dict used for tracking permissions along with their origins.
349
349
350 `__setitem__` has been overridden to expect a tuple(perm, origin)
350 `__setitem__` has been overridden to expect a tuple(perm, origin)
351 `__getitem__` will return only the perm
351 `__getitem__` will return only the perm
352 `.perm_origin_stack` will return the stack of (perm, origin) set per key
352 `.perm_origin_stack` will return the stack of (perm, origin) set per key
353
353
354 >>> perms = PermOriginDict()
354 >>> perms = PermOriginDict()
355 >>> perms['resource'] = 'read', 'default'
355 >>> perms['resource'] = 'read', 'default'
356 >>> perms['resource']
356 >>> perms['resource']
357 'read'
357 'read'
358 >>> perms['resource'] = 'write', 'admin'
358 >>> perms['resource'] = 'write', 'admin'
359 >>> perms['resource']
359 >>> perms['resource']
360 'write'
360 'write'
361 >>> perms.perm_origin_stack
361 >>> perms.perm_origin_stack
362 {'resource': [('read', 'default'), ('write', 'admin')]}
362 {'resource': [('read', 'default'), ('write', 'admin')]}
363 """
363 """
364
364
365 def __init__(self, *args, **kw):
365 def __init__(self, *args, **kw):
366 dict.__init__(self, *args, **kw)
366 dict.__init__(self, *args, **kw)
367 self.perm_origin_stack = collections.OrderedDict()
367 self.perm_origin_stack = collections.OrderedDict()
368
368
369 def __setitem__(self, key, (perm, origin)):
369 def __setitem__(self, key, (perm, origin)):
370 self.perm_origin_stack.setdefault(key, []).append((perm, origin))
370 self.perm_origin_stack.setdefault(key, []).append((perm, origin))
371 dict.__setitem__(self, key, perm)
371 dict.__setitem__(self, key, perm)
372
372
373
373
374 class PermissionCalculator(object):
374 class PermissionCalculator(object):
375
375
376 def __init__(
376 def __init__(
377 self, user_id, scope, user_is_admin,
377 self, user_id, scope, user_is_admin,
378 user_inherit_default_permissions, explicit, algo,
378 user_inherit_default_permissions, explicit, algo,
379 calculate_super_admin=False):
379 calculate_super_admin=False):
380
380
381 self.user_id = user_id
381 self.user_id = user_id
382 self.user_is_admin = user_is_admin
382 self.user_is_admin = user_is_admin
383 self.inherit_default_permissions = user_inherit_default_permissions
383 self.inherit_default_permissions = user_inherit_default_permissions
384 self.explicit = explicit
384 self.explicit = explicit
385 self.algo = algo
385 self.algo = algo
386 self.calculate_super_admin = calculate_super_admin
386 self.calculate_super_admin = calculate_super_admin
387
387
388 scope = scope or {}
388 scope = scope or {}
389 self.scope_repo_id = scope.get('repo_id')
389 self.scope_repo_id = scope.get('repo_id')
390 self.scope_repo_group_id = scope.get('repo_group_id')
390 self.scope_repo_group_id = scope.get('repo_group_id')
391 self.scope_user_group_id = scope.get('user_group_id')
391 self.scope_user_group_id = scope.get('user_group_id')
392
392
393 self.default_user_id = User.get_default_user(cache=True).user_id
393 self.default_user_id = User.get_default_user(cache=True).user_id
394
394
395 self.permissions_repositories = PermOriginDict()
395 self.permissions_repositories = PermOriginDict()
396 self.permissions_repository_groups = PermOriginDict()
396 self.permissions_repository_groups = PermOriginDict()
397 self.permissions_user_groups = PermOriginDict()
397 self.permissions_user_groups = PermOriginDict()
398 self.permissions_global = set()
398 self.permissions_global = set()
399
399
400 self.default_repo_perms = Permission.get_default_repo_perms(
400 self.default_repo_perms = Permission.get_default_repo_perms(
401 self.default_user_id, self.scope_repo_id)
401 self.default_user_id, self.scope_repo_id)
402 self.default_repo_groups_perms = Permission.get_default_group_perms(
402 self.default_repo_groups_perms = Permission.get_default_group_perms(
403 self.default_user_id, self.scope_repo_group_id)
403 self.default_user_id, self.scope_repo_group_id)
404 self.default_user_group_perms = \
404 self.default_user_group_perms = \
405 Permission.get_default_user_group_perms(
405 Permission.get_default_user_group_perms(
406 self.default_user_id, self.scope_user_group_id)
406 self.default_user_id, self.scope_user_group_id)
407
407
408 def calculate(self):
408 def calculate(self):
409 if self.user_is_admin and not self.calculate_super_admin:
409 if self.user_is_admin and not self.calculate_super_admin:
410 return self._admin_permissions()
410 return self._admin_permissions()
411
411
412 self._calculate_global_default_permissions()
412 self._calculate_global_default_permissions()
413 self._calculate_global_permissions()
413 self._calculate_global_permissions()
414 self._calculate_default_permissions()
414 self._calculate_default_permissions()
415 self._calculate_repository_permissions()
415 self._calculate_repository_permissions()
416 self._calculate_repository_group_permissions()
416 self._calculate_repository_group_permissions()
417 self._calculate_user_group_permissions()
417 self._calculate_user_group_permissions()
418 return self._permission_structure()
418 return self._permission_structure()
419
419
420 def _admin_permissions(self):
420 def _admin_permissions(self):
421 """
421 """
422 admin user have all default rights for repositories
422 admin user have all default rights for repositories
423 and groups set to admin
423 and groups set to admin
424 """
424 """
425 self.permissions_global.add('hg.admin')
425 self.permissions_global.add('hg.admin')
426 self.permissions_global.add('hg.create.write_on_repogroup.true')
426 self.permissions_global.add('hg.create.write_on_repogroup.true')
427
427
428 # repositories
428 # repositories
429 for perm in self.default_repo_perms:
429 for perm in self.default_repo_perms:
430 r_k = perm.UserRepoToPerm.repository.repo_name
430 r_k = perm.UserRepoToPerm.repository.repo_name
431 p = 'repository.admin'
431 p = 'repository.admin'
432 self.permissions_repositories[r_k] = p, PermOrigin.SUPER_ADMIN
432 self.permissions_repositories[r_k] = p, PermOrigin.SUPER_ADMIN
433
433
434 # repository groups
434 # repository groups
435 for perm in self.default_repo_groups_perms:
435 for perm in self.default_repo_groups_perms:
436 rg_k = perm.UserRepoGroupToPerm.group.group_name
436 rg_k = perm.UserRepoGroupToPerm.group.group_name
437 p = 'group.admin'
437 p = 'group.admin'
438 self.permissions_repository_groups[rg_k] = p, PermOrigin.SUPER_ADMIN
438 self.permissions_repository_groups[rg_k] = p, PermOrigin.SUPER_ADMIN
439
439
440 # user groups
440 # user groups
441 for perm in self.default_user_group_perms:
441 for perm in self.default_user_group_perms:
442 u_k = perm.UserUserGroupToPerm.user_group.users_group_name
442 u_k = perm.UserUserGroupToPerm.user_group.users_group_name
443 p = 'usergroup.admin'
443 p = 'usergroup.admin'
444 self.permissions_user_groups[u_k] = p, PermOrigin.SUPER_ADMIN
444 self.permissions_user_groups[u_k] = p, PermOrigin.SUPER_ADMIN
445
445
446 return self._permission_structure()
446 return self._permission_structure()
447
447
448 def _calculate_global_default_permissions(self):
448 def _calculate_global_default_permissions(self):
449 """
449 """
450 global permissions taken from the default user
450 global permissions taken from the default user
451 """
451 """
452 default_global_perms = UserToPerm.query()\
452 default_global_perms = UserToPerm.query()\
453 .filter(UserToPerm.user_id == self.default_user_id)\
453 .filter(UserToPerm.user_id == self.default_user_id)\
454 .options(joinedload(UserToPerm.permission))
454 .options(joinedload(UserToPerm.permission))
455
455
456 for perm in default_global_perms:
456 for perm in default_global_perms:
457 self.permissions_global.add(perm.permission.permission_name)
457 self.permissions_global.add(perm.permission.permission_name)
458
458
459 if self.user_is_admin:
459 if self.user_is_admin:
460 self.permissions_global.add('hg.admin')
460 self.permissions_global.add('hg.admin')
461 self.permissions_global.add('hg.create.write_on_repogroup.true')
461 self.permissions_global.add('hg.create.write_on_repogroup.true')
462
462
463 def _calculate_global_permissions(self):
463 def _calculate_global_permissions(self):
464 """
464 """
465 Set global system permissions with user permissions or permissions
465 Set global system permissions with user permissions or permissions
466 taken from the user groups of the current user.
466 taken from the user groups of the current user.
467
467
468 The permissions include repo creating, repo group creating, forking
468 The permissions include repo creating, repo group creating, forking
469 etc.
469 etc.
470 """
470 """
471
471
472 # now we read the defined permissions and overwrite what we have set
472 # now we read the defined permissions and overwrite what we have set
473 # before those can be configured from groups or users explicitly.
473 # before those can be configured from groups or users explicitly.
474
474
475 # TODO: johbo: This seems to be out of sync, find out the reason
475 # TODO: johbo: This seems to be out of sync, find out the reason
476 # for the comment below and update it.
476 # for the comment below and update it.
477
477
478 # In case we want to extend this list we should be always in sync with
478 # In case we want to extend this list we should be always in sync with
479 # User.DEFAULT_USER_PERMISSIONS definitions
479 # User.DEFAULT_USER_PERMISSIONS definitions
480 _configurable = frozenset([
480 _configurable = frozenset([
481 'hg.fork.none', 'hg.fork.repository',
481 'hg.fork.none', 'hg.fork.repository',
482 'hg.create.none', 'hg.create.repository',
482 'hg.create.none', 'hg.create.repository',
483 'hg.usergroup.create.false', 'hg.usergroup.create.true',
483 'hg.usergroup.create.false', 'hg.usergroup.create.true',
484 'hg.repogroup.create.false', 'hg.repogroup.create.true',
484 'hg.repogroup.create.false', 'hg.repogroup.create.true',
485 'hg.create.write_on_repogroup.false',
485 'hg.create.write_on_repogroup.false',
486 'hg.create.write_on_repogroup.true',
486 'hg.create.write_on_repogroup.true',
487 'hg.inherit_default_perms.false', 'hg.inherit_default_perms.true'
487 'hg.inherit_default_perms.false', 'hg.inherit_default_perms.true'
488 ])
488 ])
489
489
490 # USER GROUPS comes first user group global permissions
490 # USER GROUPS comes first user group global permissions
491 user_perms_from_users_groups = Session().query(UserGroupToPerm)\
491 user_perms_from_users_groups = Session().query(UserGroupToPerm)\
492 .options(joinedload(UserGroupToPerm.permission))\
492 .options(joinedload(UserGroupToPerm.permission))\
493 .join((UserGroupMember, UserGroupToPerm.users_group_id ==
493 .join((UserGroupMember, UserGroupToPerm.users_group_id ==
494 UserGroupMember.users_group_id))\
494 UserGroupMember.users_group_id))\
495 .filter(UserGroupMember.user_id == self.user_id)\
495 .filter(UserGroupMember.user_id == self.user_id)\
496 .order_by(UserGroupToPerm.users_group_id)\
496 .order_by(UserGroupToPerm.users_group_id)\
497 .all()
497 .all()
498
498
499 # need to group here by groups since user can be in more than
499 # need to group here by groups since user can be in more than
500 # one group, so we get all groups
500 # one group, so we get all groups
501 _explicit_grouped_perms = [
501 _explicit_grouped_perms = [
502 [x, list(y)] for x, y in
502 [x, list(y)] for x, y in
503 itertools.groupby(user_perms_from_users_groups,
503 itertools.groupby(user_perms_from_users_groups,
504 lambda _x: _x.users_group)]
504 lambda _x: _x.users_group)]
505
505
506 for gr, perms in _explicit_grouped_perms:
506 for gr, perms in _explicit_grouped_perms:
507 # since user can be in multiple groups iterate over them and
507 # since user can be in multiple groups iterate over them and
508 # select the lowest permissions first (more explicit)
508 # select the lowest permissions first (more explicit)
509 # TODO: marcink: do this^^
509 # TODO: marcink: do this^^
510
510
511 # group doesn't inherit default permissions so we actually set them
511 # group doesn't inherit default permissions so we actually set them
512 if not gr.inherit_default_permissions:
512 if not gr.inherit_default_permissions:
513 # NEED TO IGNORE all previously set configurable permissions
513 # NEED TO IGNORE all previously set configurable permissions
514 # and replace them with explicitly set from this user
514 # and replace them with explicitly set from this user
515 # group permissions
515 # group permissions
516 self.permissions_global = self.permissions_global.difference(
516 self.permissions_global = self.permissions_global.difference(
517 _configurable)
517 _configurable)
518 for perm in perms:
518 for perm in perms:
519 self.permissions_global.add(perm.permission.permission_name)
519 self.permissions_global.add(perm.permission.permission_name)
520
520
521 # user explicit global permissions
521 # user explicit global permissions
522 user_perms = Session().query(UserToPerm)\
522 user_perms = Session().query(UserToPerm)\
523 .options(joinedload(UserToPerm.permission))\
523 .options(joinedload(UserToPerm.permission))\
524 .filter(UserToPerm.user_id == self.user_id).all()
524 .filter(UserToPerm.user_id == self.user_id).all()
525
525
526 if not self.inherit_default_permissions:
526 if not self.inherit_default_permissions:
527 # NEED TO IGNORE all configurable permissions and
527 # NEED TO IGNORE all configurable permissions and
528 # replace them with explicitly set from this user permissions
528 # replace them with explicitly set from this user permissions
529 self.permissions_global = self.permissions_global.difference(
529 self.permissions_global = self.permissions_global.difference(
530 _configurable)
530 _configurable)
531 for perm in user_perms:
531 for perm in user_perms:
532 self.permissions_global.add(perm.permission.permission_name)
532 self.permissions_global.add(perm.permission.permission_name)
533
533
534 def _calculate_default_permissions(self):
534 def _calculate_default_permissions(self):
535 """
535 """
536 Set default user permissions for repositories, repository groups
536 Set default user permissions for repositories, repository groups
537 taken from the default user.
537 taken from the default user.
538
538
539 Calculate inheritance of object permissions based on what we have now
539 Calculate inheritance of object permissions based on what we have now
540 in GLOBAL permissions. We check if .false is in GLOBAL since this is
540 in GLOBAL permissions. We check if .false is in GLOBAL since this is
541 explicitly set. Inherit is the opposite of .false being there.
541 explicitly set. Inherit is the opposite of .false being there.
542
542
543 .. note::
543 .. note::
544
544
545 the syntax is little bit odd but what we need to check here is
545 the syntax is little bit odd but what we need to check here is
546 the opposite of .false permission being in the list so even for
546 the opposite of .false permission being in the list so even for
547 inconsistent state when both .true/.false is there
547 inconsistent state when both .true/.false is there
548 .false is more important
548 .false is more important
549
549
550 """
550 """
551 user_inherit_object_permissions = not ('hg.inherit_default_perms.false'
551 user_inherit_object_permissions = not ('hg.inherit_default_perms.false'
552 in self.permissions_global)
552 in self.permissions_global)
553
553
554 # defaults for repositories, taken from `default` user permissions
554 # defaults for repositories, taken from `default` user permissions
555 # on given repo
555 # on given repo
556 for perm in self.default_repo_perms:
556 for perm in self.default_repo_perms:
557 r_k = perm.UserRepoToPerm.repository.repo_name
557 r_k = perm.UserRepoToPerm.repository.repo_name
558 p = perm.Permission.permission_name
558 p = perm.Permission.permission_name
559 o = PermOrigin.REPO_DEFAULT
559 o = PermOrigin.REPO_DEFAULT
560 self.permissions_repositories[r_k] = p, o
560 self.permissions_repositories[r_k] = p, o
561
561
562 # if we decide this user isn't inheriting permissions from
562 # if we decide this user isn't inheriting permissions from
563 # default user we set him to .none so only explicit
563 # default user we set him to .none so only explicit
564 # permissions work
564 # permissions work
565 if not user_inherit_object_permissions:
565 if not user_inherit_object_permissions:
566 p = 'repository.none'
566 p = 'repository.none'
567 o = PermOrigin.REPO_DEFAULT_NO_INHERIT
567 o = PermOrigin.REPO_DEFAULT_NO_INHERIT
568 self.permissions_repositories[r_k] = p, o
568 self.permissions_repositories[r_k] = p, o
569
569
570 if perm.Repository.private and not (
570 if perm.Repository.private and not (
571 perm.Repository.user_id == self.user_id):
571 perm.Repository.user_id == self.user_id):
572 # disable defaults for private repos,
572 # disable defaults for private repos,
573 p = 'repository.none'
573 p = 'repository.none'
574 o = PermOrigin.REPO_PRIVATE
574 o = PermOrigin.REPO_PRIVATE
575 self.permissions_repositories[r_k] = p, o
575 self.permissions_repositories[r_k] = p, o
576
576
577 elif perm.Repository.user_id == self.user_id:
577 elif perm.Repository.user_id == self.user_id:
578 # set admin if owner
578 # set admin if owner
579 p = 'repository.admin'
579 p = 'repository.admin'
580 o = PermOrigin.REPO_OWNER
580 o = PermOrigin.REPO_OWNER
581 self.permissions_repositories[r_k] = p, o
581 self.permissions_repositories[r_k] = p, o
582
582
583 if self.user_is_admin:
583 if self.user_is_admin:
584 p = 'repository.admin'
584 p = 'repository.admin'
585 o = PermOrigin.SUPER_ADMIN
585 o = PermOrigin.SUPER_ADMIN
586 self.permissions_repositories[r_k] = p, o
586 self.permissions_repositories[r_k] = p, o
587
587
588 # defaults for repository groups taken from `default` user permission
588 # defaults for repository groups taken from `default` user permission
589 # on given group
589 # on given group
590 for perm in self.default_repo_groups_perms:
590 for perm in self.default_repo_groups_perms:
591 rg_k = perm.UserRepoGroupToPerm.group.group_name
591 rg_k = perm.UserRepoGroupToPerm.group.group_name
592 p = perm.Permission.permission_name
592 p = perm.Permission.permission_name
593 o = PermOrigin.REPOGROUP_DEFAULT
593 o = PermOrigin.REPOGROUP_DEFAULT
594 self.permissions_repository_groups[rg_k] = p, o
594 self.permissions_repository_groups[rg_k] = p, o
595
595
596 # if we decide this user isn't inheriting permissions from default
596 # if we decide this user isn't inheriting permissions from default
597 # user we set him to .none so only explicit permissions work
597 # user we set him to .none so only explicit permissions work
598 if not user_inherit_object_permissions:
598 if not user_inherit_object_permissions:
599 p = 'group.none'
599 p = 'group.none'
600 o = PermOrigin.REPOGROUP_DEFAULT_NO_INHERIT
600 o = PermOrigin.REPOGROUP_DEFAULT_NO_INHERIT
601 self.permissions_repository_groups[rg_k] = p, o
601 self.permissions_repository_groups[rg_k] = p, o
602
602
603 if perm.RepoGroup.user_id == self.user_id:
603 if perm.RepoGroup.user_id == self.user_id:
604 # set admin if owner
604 # set admin if owner
605 p = 'group.admin'
605 p = 'group.admin'
606 o = PermOrigin.REPOGROUP_OWNER
606 o = PermOrigin.REPOGROUP_OWNER
607 self.permissions_repository_groups[rg_k] = p, o
607 self.permissions_repository_groups[rg_k] = p, o
608
608
609 if self.user_is_admin:
609 if self.user_is_admin:
610 p = 'group.admin'
610 p = 'group.admin'
611 o = PermOrigin.SUPER_ADMIN
611 o = PermOrigin.SUPER_ADMIN
612 self.permissions_repository_groups[rg_k] = p, o
612 self.permissions_repository_groups[rg_k] = p, o
613
613
614 # defaults for user groups taken from `default` user permission
614 # defaults for user groups taken from `default` user permission
615 # on given user group
615 # on given user group
616 for perm in self.default_user_group_perms:
616 for perm in self.default_user_group_perms:
617 u_k = perm.UserUserGroupToPerm.user_group.users_group_name
617 u_k = perm.UserUserGroupToPerm.user_group.users_group_name
618 p = perm.Permission.permission_name
618 p = perm.Permission.permission_name
619 o = PermOrigin.USERGROUP_DEFAULT
619 o = PermOrigin.USERGROUP_DEFAULT
620 self.permissions_user_groups[u_k] = p, o
620 self.permissions_user_groups[u_k] = p, o
621
621
622 # if we decide this user isn't inheriting permissions from default
622 # if we decide this user isn't inheriting permissions from default
623 # user we set him to .none so only explicit permissions work
623 # user we set him to .none so only explicit permissions work
624 if not user_inherit_object_permissions:
624 if not user_inherit_object_permissions:
625 p = 'usergroup.none'
625 p = 'usergroup.none'
626 o = PermOrigin.USERGROUP_DEFAULT_NO_INHERIT
626 o = PermOrigin.USERGROUP_DEFAULT_NO_INHERIT
627 self.permissions_user_groups[u_k] = p, o
627 self.permissions_user_groups[u_k] = p, o
628
628
629 if perm.UserGroup.user_id == self.user_id:
629 if perm.UserGroup.user_id == self.user_id:
630 # set admin if owner
630 # set admin if owner
631 p = 'usergroup.admin'
631 p = 'usergroup.admin'
632 o = PermOrigin.USERGROUP_OWNER
632 o = PermOrigin.USERGROUP_OWNER
633 self.permissions_user_groups[u_k] = p, o
633 self.permissions_user_groups[u_k] = p, o
634
634
635 if self.user_is_admin:
635 if self.user_is_admin:
636 p = 'usergroup.admin'
636 p = 'usergroup.admin'
637 o = PermOrigin.SUPER_ADMIN
637 o = PermOrigin.SUPER_ADMIN
638 self.permissions_user_groups[u_k] = p, o
638 self.permissions_user_groups[u_k] = p, o
639
639
640 def _calculate_repository_permissions(self):
640 def _calculate_repository_permissions(self):
641 """
641 """
642 Repository permissions for the current user.
642 Repository permissions for the current user.
643
643
644 Check if the user is part of user groups for this repository and
644 Check if the user is part of user groups for this repository and
645 fill in the permission from it. `_choose_permission` decides of which
645 fill in the permission from it. `_choose_permission` decides of which
646 permission should be selected based on selected method.
646 permission should be selected based on selected method.
647 """
647 """
648
648
649 # user group for repositories permissions
649 # user group for repositories permissions
650 user_repo_perms_from_user_group = Permission\
650 user_repo_perms_from_user_group = Permission\
651 .get_default_repo_perms_from_user_group(
651 .get_default_repo_perms_from_user_group(
652 self.user_id, self.scope_repo_id)
652 self.user_id, self.scope_repo_id)
653
653
654 multiple_counter = collections.defaultdict(int)
654 multiple_counter = collections.defaultdict(int)
655 for perm in user_repo_perms_from_user_group:
655 for perm in user_repo_perms_from_user_group:
656 r_k = perm.UserGroupRepoToPerm.repository.repo_name
656 r_k = perm.UserGroupRepoToPerm.repository.repo_name
657 multiple_counter[r_k] += 1
657 multiple_counter[r_k] += 1
658 p = perm.Permission.permission_name
658 p = perm.Permission.permission_name
659 o = PermOrigin.REPO_USERGROUP % perm.UserGroupRepoToPerm\
659 o = PermOrigin.REPO_USERGROUP % perm.UserGroupRepoToPerm\
660 .users_group.users_group_name
660 .users_group.users_group_name
661
661
662 if multiple_counter[r_k] > 1:
662 if multiple_counter[r_k] > 1:
663 cur_perm = self.permissions_repositories[r_k]
663 cur_perm = self.permissions_repositories[r_k]
664 p = self._choose_permission(p, cur_perm)
664 p = self._choose_permission(p, cur_perm)
665
665
666 self.permissions_repositories[r_k] = p, o
666 self.permissions_repositories[r_k] = p, o
667
667
668 if perm.Repository.user_id == self.user_id:
668 if perm.Repository.user_id == self.user_id:
669 # set admin if owner
669 # set admin if owner
670 p = 'repository.admin'
670 p = 'repository.admin'
671 o = PermOrigin.REPO_OWNER
671 o = PermOrigin.REPO_OWNER
672 self.permissions_repositories[r_k] = p, o
672 self.permissions_repositories[r_k] = p, o
673
673
674 if self.user_is_admin:
674 if self.user_is_admin:
675 p = 'repository.admin'
675 p = 'repository.admin'
676 o = PermOrigin.SUPER_ADMIN
676 o = PermOrigin.SUPER_ADMIN
677 self.permissions_repositories[r_k] = p, o
677 self.permissions_repositories[r_k] = p, o
678
678
679 # user explicit permissions for repositories, overrides any specified
679 # user explicit permissions for repositories, overrides any specified
680 # by the group permission
680 # by the group permission
681 user_repo_perms = Permission.get_default_repo_perms(
681 user_repo_perms = Permission.get_default_repo_perms(
682 self.user_id, self.scope_repo_id)
682 self.user_id, self.scope_repo_id)
683 for perm in user_repo_perms:
683 for perm in user_repo_perms:
684 r_k = perm.UserRepoToPerm.repository.repo_name
684 r_k = perm.UserRepoToPerm.repository.repo_name
685 p = perm.Permission.permission_name
685 p = perm.Permission.permission_name
686 o = PermOrigin.REPO_USER % perm.UserRepoToPerm.user.username
686 o = PermOrigin.REPO_USER % perm.UserRepoToPerm.user.username
687
687
688 if not self.explicit:
688 if not self.explicit:
689 cur_perm = self.permissions_repositories.get(
689 cur_perm = self.permissions_repositories.get(
690 r_k, 'repository.none')
690 r_k, 'repository.none')
691 p = self._choose_permission(p, cur_perm)
691 p = self._choose_permission(p, cur_perm)
692
692
693 self.permissions_repositories[r_k] = p, o
693 self.permissions_repositories[r_k] = p, o
694
694
695 if perm.Repository.user_id == self.user_id:
695 if perm.Repository.user_id == self.user_id:
696 # set admin if owner
696 # set admin if owner
697 p = 'repository.admin'
697 p = 'repository.admin'
698 o = PermOrigin.REPO_OWNER
698 o = PermOrigin.REPO_OWNER
699 self.permissions_repositories[r_k] = p, o
699 self.permissions_repositories[r_k] = p, o
700
700
701 if self.user_is_admin:
701 if self.user_is_admin:
702 p = 'repository.admin'
702 p = 'repository.admin'
703 o = PermOrigin.SUPER_ADMIN
703 o = PermOrigin.SUPER_ADMIN
704 self.permissions_repositories[r_k] = p, o
704 self.permissions_repositories[r_k] = p, o
705
705
706 def _calculate_repository_group_permissions(self):
706 def _calculate_repository_group_permissions(self):
707 """
707 """
708 Repository group permissions for the current user.
708 Repository group permissions for the current user.
709
709
710 Check if the user is part of user groups for repository groups and
710 Check if the user is part of user groups for repository groups and
711 fill in the permissions from it. `_choose_permission` decides of which
711 fill in the permissions from it. `_choose_permission` decides of which
712 permission should be selected based on selected method.
712 permission should be selected based on selected method.
713 """
713 """
714 # user group for repo groups permissions
714 # user group for repo groups permissions
715 user_repo_group_perms_from_user_group = Permission\
715 user_repo_group_perms_from_user_group = Permission\
716 .get_default_group_perms_from_user_group(
716 .get_default_group_perms_from_user_group(
717 self.user_id, self.scope_repo_group_id)
717 self.user_id, self.scope_repo_group_id)
718
718
719 multiple_counter = collections.defaultdict(int)
719 multiple_counter = collections.defaultdict(int)
720 for perm in user_repo_group_perms_from_user_group:
720 for perm in user_repo_group_perms_from_user_group:
721 rg_k = perm.UserGroupRepoGroupToPerm.group.group_name
721 rg_k = perm.UserGroupRepoGroupToPerm.group.group_name
722 multiple_counter[rg_k] += 1
722 multiple_counter[rg_k] += 1
723 o = PermOrigin.REPOGROUP_USERGROUP % perm.UserGroupRepoGroupToPerm\
723 o = PermOrigin.REPOGROUP_USERGROUP % perm.UserGroupRepoGroupToPerm\
724 .users_group.users_group_name
724 .users_group.users_group_name
725 p = perm.Permission.permission_name
725 p = perm.Permission.permission_name
726
726
727 if multiple_counter[rg_k] > 1:
727 if multiple_counter[rg_k] > 1:
728 cur_perm = self.permissions_repository_groups[rg_k]
728 cur_perm = self.permissions_repository_groups[rg_k]
729 p = self._choose_permission(p, cur_perm)
729 p = self._choose_permission(p, cur_perm)
730 self.permissions_repository_groups[rg_k] = p, o
730 self.permissions_repository_groups[rg_k] = p, o
731
731
732 if perm.RepoGroup.user_id == self.user_id:
732 if perm.RepoGroup.user_id == self.user_id:
733 # set admin if owner, even for member of other user group
733 # set admin if owner, even for member of other user group
734 p = 'group.admin'
734 p = 'group.admin'
735 o = PermOrigin.REPOGROUP_OWNER
735 o = PermOrigin.REPOGROUP_OWNER
736 self.permissions_repository_groups[rg_k] = p, o
736 self.permissions_repository_groups[rg_k] = p, o
737
737
738 if self.user_is_admin:
738 if self.user_is_admin:
739 p = 'group.admin'
739 p = 'group.admin'
740 o = PermOrigin.SUPER_ADMIN
740 o = PermOrigin.SUPER_ADMIN
741 self.permissions_repository_groups[rg_k] = p, o
741 self.permissions_repository_groups[rg_k] = p, o
742
742
743 # user explicit permissions for repository groups
743 # user explicit permissions for repository groups
744 user_repo_groups_perms = Permission.get_default_group_perms(
744 user_repo_groups_perms = Permission.get_default_group_perms(
745 self.user_id, self.scope_repo_group_id)
745 self.user_id, self.scope_repo_group_id)
746 for perm in user_repo_groups_perms:
746 for perm in user_repo_groups_perms:
747 rg_k = perm.UserRepoGroupToPerm.group.group_name
747 rg_k = perm.UserRepoGroupToPerm.group.group_name
748 o = PermOrigin.REPOGROUP_USER % perm.UserRepoGroupToPerm\
748 o = PermOrigin.REPOGROUP_USER % perm.UserRepoGroupToPerm\
749 .user.username
749 .user.username
750 p = perm.Permission.permission_name
750 p = perm.Permission.permission_name
751
751
752 if not self.explicit:
752 if not self.explicit:
753 cur_perm = self.permissions_repository_groups.get(
753 cur_perm = self.permissions_repository_groups.get(
754 rg_k, 'group.none')
754 rg_k, 'group.none')
755 p = self._choose_permission(p, cur_perm)
755 p = self._choose_permission(p, cur_perm)
756
756
757 self.permissions_repository_groups[rg_k] = p, o
757 self.permissions_repository_groups[rg_k] = p, o
758
758
759 if perm.RepoGroup.user_id == self.user_id:
759 if perm.RepoGroup.user_id == self.user_id:
760 # set admin if owner
760 # set admin if owner
761 p = 'group.admin'
761 p = 'group.admin'
762 o = PermOrigin.REPOGROUP_OWNER
762 o = PermOrigin.REPOGROUP_OWNER
763 self.permissions_repository_groups[rg_k] = p, o
763 self.permissions_repository_groups[rg_k] = p, o
764
764
765 if self.user_is_admin:
765 if self.user_is_admin:
766 p = 'group.admin'
766 p = 'group.admin'
767 o = PermOrigin.SUPER_ADMIN
767 o = PermOrigin.SUPER_ADMIN
768 self.permissions_repository_groups[rg_k] = p, o
768 self.permissions_repository_groups[rg_k] = p, o
769
769
770 def _calculate_user_group_permissions(self):
770 def _calculate_user_group_permissions(self):
771 """
771 """
772 User group permissions for the current user.
772 User group permissions for the current user.
773 """
773 """
774 # user group for user group permissions
774 # user group for user group permissions
775 user_group_from_user_group = Permission\
775 user_group_from_user_group = Permission\
776 .get_default_user_group_perms_from_user_group(
776 .get_default_user_group_perms_from_user_group(
777 self.user_id, self.scope_user_group_id)
777 self.user_id, self.scope_user_group_id)
778
778
779 multiple_counter = collections.defaultdict(int)
779 multiple_counter = collections.defaultdict(int)
780 for perm in user_group_from_user_group:
780 for perm in user_group_from_user_group:
781 ug_k = perm.UserGroupUserGroupToPerm\
781 ug_k = perm.UserGroupUserGroupToPerm\
782 .target_user_group.users_group_name
782 .target_user_group.users_group_name
783 multiple_counter[ug_k] += 1
783 multiple_counter[ug_k] += 1
784 o = PermOrigin.USERGROUP_USERGROUP % perm.UserGroupUserGroupToPerm\
784 o = PermOrigin.USERGROUP_USERGROUP % perm.UserGroupUserGroupToPerm\
785 .user_group.users_group_name
785 .user_group.users_group_name
786 p = perm.Permission.permission_name
786 p = perm.Permission.permission_name
787
787
788 if multiple_counter[ug_k] > 1:
788 if multiple_counter[ug_k] > 1:
789 cur_perm = self.permissions_user_groups[ug_k]
789 cur_perm = self.permissions_user_groups[ug_k]
790 p = self._choose_permission(p, cur_perm)
790 p = self._choose_permission(p, cur_perm)
791
791
792 self.permissions_user_groups[ug_k] = p, o
792 self.permissions_user_groups[ug_k] = p, o
793
793
794 if perm.UserGroup.user_id == self.user_id:
794 if perm.UserGroup.user_id == self.user_id:
795 # set admin if owner, even for member of other user group
795 # set admin if owner, even for member of other user group
796 p = 'usergroup.admin'
796 p = 'usergroup.admin'
797 o = PermOrigin.USERGROUP_OWNER
797 o = PermOrigin.USERGROUP_OWNER
798 self.permissions_user_groups[ug_k] = p, o
798 self.permissions_user_groups[ug_k] = p, o
799
799
800 if self.user_is_admin:
800 if self.user_is_admin:
801 p = 'usergroup.admin'
801 p = 'usergroup.admin'
802 o = PermOrigin.SUPER_ADMIN
802 o = PermOrigin.SUPER_ADMIN
803 self.permissions_user_groups[ug_k] = p, o
803 self.permissions_user_groups[ug_k] = p, o
804
804
805 # user explicit permission for user groups
805 # user explicit permission for user groups
806 user_user_groups_perms = Permission.get_default_user_group_perms(
806 user_user_groups_perms = Permission.get_default_user_group_perms(
807 self.user_id, self.scope_user_group_id)
807 self.user_id, self.scope_user_group_id)
808 for perm in user_user_groups_perms:
808 for perm in user_user_groups_perms:
809 ug_k = perm.UserUserGroupToPerm.user_group.users_group_name
809 ug_k = perm.UserUserGroupToPerm.user_group.users_group_name
810 o = PermOrigin.USERGROUP_USER % perm.UserUserGroupToPerm\
810 o = PermOrigin.USERGROUP_USER % perm.UserUserGroupToPerm\
811 .user.username
811 .user.username
812 p = perm.Permission.permission_name
812 p = perm.Permission.permission_name
813
813
814 if not self.explicit:
814 if not self.explicit:
815 cur_perm = self.permissions_user_groups.get(
815 cur_perm = self.permissions_user_groups.get(
816 ug_k, 'usergroup.none')
816 ug_k, 'usergroup.none')
817 p = self._choose_permission(p, cur_perm)
817 p = self._choose_permission(p, cur_perm)
818
818
819 self.permissions_user_groups[ug_k] = p, o
819 self.permissions_user_groups[ug_k] = p, o
820
820
821 if perm.UserGroup.user_id == self.user_id:
821 if perm.UserGroup.user_id == self.user_id:
822 # set admin if owner
822 # set admin if owner
823 p = 'usergroup.admin'
823 p = 'usergroup.admin'
824 o = PermOrigin.USERGROUP_OWNER
824 o = PermOrigin.USERGROUP_OWNER
825 self.permissions_user_groups[ug_k] = p, o
825 self.permissions_user_groups[ug_k] = p, o
826
826
827 if self.user_is_admin:
827 if self.user_is_admin:
828 p = 'usergroup.admin'
828 p = 'usergroup.admin'
829 o = PermOrigin.SUPER_ADMIN
829 o = PermOrigin.SUPER_ADMIN
830 self.permissions_user_groups[ug_k] = p, o
830 self.permissions_user_groups[ug_k] = p, o
831
831
832 def _choose_permission(self, new_perm, cur_perm):
832 def _choose_permission(self, new_perm, cur_perm):
833 new_perm_val = Permission.PERM_WEIGHTS[new_perm]
833 new_perm_val = Permission.PERM_WEIGHTS[new_perm]
834 cur_perm_val = Permission.PERM_WEIGHTS[cur_perm]
834 cur_perm_val = Permission.PERM_WEIGHTS[cur_perm]
835 if self.algo == 'higherwin':
835 if self.algo == 'higherwin':
836 if new_perm_val > cur_perm_val:
836 if new_perm_val > cur_perm_val:
837 return new_perm
837 return new_perm
838 return cur_perm
838 return cur_perm
839 elif self.algo == 'lowerwin':
839 elif self.algo == 'lowerwin':
840 if new_perm_val < cur_perm_val:
840 if new_perm_val < cur_perm_val:
841 return new_perm
841 return new_perm
842 return cur_perm
842 return cur_perm
843
843
844 def _permission_structure(self):
844 def _permission_structure(self):
845 return {
845 return {
846 'global': self.permissions_global,
846 'global': self.permissions_global,
847 'repositories': self.permissions_repositories,
847 'repositories': self.permissions_repositories,
848 'repositories_groups': self.permissions_repository_groups,
848 'repositories_groups': self.permissions_repository_groups,
849 'user_groups': self.permissions_user_groups,
849 'user_groups': self.permissions_user_groups,
850 }
850 }
851
851
852
852
853 def allowed_auth_token_access(view_name, auth_token, whitelist=None):
853 def allowed_auth_token_access(view_name, auth_token, whitelist=None):
854 """
854 """
855 Check if given controller_name is in whitelist of auth token access
855 Check if given controller_name is in whitelist of auth token access
856 """
856 """
857 if not whitelist:
857 if not whitelist:
858 from rhodecode import CONFIG
858 from rhodecode import CONFIG
859 whitelist = aslist(
859 whitelist = aslist(
860 CONFIG.get('api_access_controllers_whitelist'), sep=',')
860 CONFIG.get('api_access_controllers_whitelist'), sep=',')
861 # backward compat translation
861 # backward compat translation
862 compat = {
862 compat = {
863 # old controller, new VIEW
863 # old controller, new VIEW
864 'ChangesetController:*': 'RepoCommitsView:*',
864 'ChangesetController:*': 'RepoCommitsView:*',
865 'ChangesetController:changeset_patch': 'RepoCommitsView:repo_commit_patch',
865 'ChangesetController:changeset_patch': 'RepoCommitsView:repo_commit_patch',
866 'ChangesetController:changeset_raw': 'RepoCommitsView:repo_commit_raw',
866 'ChangesetController:changeset_raw': 'RepoCommitsView:repo_commit_raw',
867 'FilesController:raw': 'RepoCommitsView:repo_commit_raw',
867 'FilesController:raw': 'RepoCommitsView:repo_commit_raw',
868 'FilesController:archivefile': 'RepoFilesView:repo_archivefile',
868 'FilesController:archivefile': 'RepoFilesView:repo_archivefile',
869 'GistsController:*': 'GistView:*',
869 'GistsController:*': 'GistView:*',
870 }
870 }
871
871
872 log.debug(
872 log.debug(
873 'Allowed views for AUTH TOKEN access: %s' % (whitelist,))
873 'Allowed views for AUTH TOKEN access: %s' % (whitelist,))
874 auth_token_access_valid = False
874 auth_token_access_valid = False
875
875
876 for entry in whitelist:
876 for entry in whitelist:
877 token_match = True
877 token_match = True
878 if entry in compat:
878 if entry in compat:
879 # translate from old Controllers to Pyramid Views
879 # translate from old Controllers to Pyramid Views
880 entry = compat[entry]
880 entry = compat[entry]
881
881
882 if '@' in entry:
882 if '@' in entry:
883 # specific AuthToken
883 # specific AuthToken
884 entry, allowed_token = entry.split('@', 1)
884 entry, allowed_token = entry.split('@', 1)
885 token_match = auth_token == allowed_token
885 token_match = auth_token == allowed_token
886
886
887 if fnmatch.fnmatch(view_name, entry) and token_match:
887 if fnmatch.fnmatch(view_name, entry) and token_match:
888 auth_token_access_valid = True
888 auth_token_access_valid = True
889 break
889 break
890
890
891 if auth_token_access_valid:
891 if auth_token_access_valid:
892 log.debug('view: `%s` matches entry in whitelist: %s'
892 log.debug('view: `%s` matches entry in whitelist: %s'
893 % (view_name, whitelist))
893 % (view_name, whitelist))
894 else:
894 else:
895 msg = ('view: `%s` does *NOT* match any entry in whitelist: %s'
895 msg = ('view: `%s` does *NOT* match any entry in whitelist: %s'
896 % (view_name, whitelist))
896 % (view_name, whitelist))
897 if auth_token:
897 if auth_token:
898 # if we use auth token key and don't have access it's a warning
898 # if we use auth token key and don't have access it's a warning
899 log.warning(msg)
899 log.warning(msg)
900 else:
900 else:
901 log.debug(msg)
901 log.debug(msg)
902
902
903 return auth_token_access_valid
903 return auth_token_access_valid
904
904
905
905
906 class AuthUser(object):
906 class AuthUser(object):
907 """
907 """
908 A simple object that handles all attributes of user in RhodeCode
908 A simple object that handles all attributes of user in RhodeCode
909
909
910 It does lookup based on API key,given user, or user present in session
910 It does lookup based on API key,given user, or user present in session
911 Then it fills all required information for such user. It also checks if
911 Then it fills all required information for such user. It also checks if
912 anonymous access is enabled and if so, it returns default user as logged in
912 anonymous access is enabled and if so, it returns default user as logged in
913 """
913 """
914 GLOBAL_PERMS = [x[0] for x in Permission.PERMS]
914 GLOBAL_PERMS = [x[0] for x in Permission.PERMS]
915
915
916 def __init__(self, user_id=None, api_key=None, username=None, ip_addr=None):
916 def __init__(self, user_id=None, api_key=None, username=None, ip_addr=None):
917
917
918 self.user_id = user_id
918 self.user_id = user_id
919 self._api_key = api_key
919 self._api_key = api_key
920
920
921 self.api_key = None
921 self.api_key = None
922 self.username = username
922 self.username = username
923 self.ip_addr = ip_addr
923 self.ip_addr = ip_addr
924 self.name = ''
924 self.name = ''
925 self.lastname = ''
925 self.lastname = ''
926 self.first_name = ''
926 self.first_name = ''
927 self.last_name = ''
927 self.last_name = ''
928 self.email = ''
928 self.email = ''
929 self.is_authenticated = False
929 self.is_authenticated = False
930 self.admin = False
930 self.admin = False
931 self.inherit_default_permissions = False
931 self.inherit_default_permissions = False
932 self.password = ''
932 self.password = ''
933
933
934 self.anonymous_user = None # propagated on propagate_data
934 self.anonymous_user = None # propagated on propagate_data
935 self.propagate_data()
935 self.propagate_data()
936 self._instance = None
936 self._instance = None
937 self._permissions_scoped_cache = {} # used to bind scoped calculation
937 self._permissions_scoped_cache = {} # used to bind scoped calculation
938
938
939 @LazyProperty
939 @LazyProperty
940 def permissions(self):
940 def permissions(self):
941 return self.get_perms(user=self, cache=False)
941 return self.get_perms(user=self, cache=False)
942
942
943 @LazyProperty
943 @LazyProperty
944 def permissions_safe(self):
944 def permissions_safe(self):
945 """
945 """
946 Filtered permissions excluding not allowed repositories
946 Filtered permissions excluding not allowed repositories
947 """
947 """
948 perms = self.get_perms(user=self, cache=False)
948 perms = self.get_perms(user=self, cache=False)
949
949
950 perms['repositories'] = {
950 perms['repositories'] = {
951 k: v for k, v in perms['repositories'].iteritems()
951 k: v for k, v in perms['repositories'].iteritems()
952 if v != 'repository.none'}
952 if v != 'repository.none'}
953 perms['repositories_groups'] = {
953 perms['repositories_groups'] = {
954 k: v for k, v in perms['repositories_groups'].iteritems()
954 k: v for k, v in perms['repositories_groups'].iteritems()
955 if v != 'group.none'}
955 if v != 'group.none'}
956 perms['user_groups'] = {
956 perms['user_groups'] = {
957 k: v for k, v in perms['user_groups'].iteritems()
957 k: v for k, v in perms['user_groups'].iteritems()
958 if v != 'usergroup.none'}
958 if v != 'usergroup.none'}
959 return perms
959 return perms
960
960
961 @LazyProperty
961 @LazyProperty
962 def permissions_full_details(self):
962 def permissions_full_details(self):
963 return self.get_perms(
963 return self.get_perms(
964 user=self, cache=False, calculate_super_admin=True)
964 user=self, cache=False, calculate_super_admin=True)
965
965
966 def permissions_with_scope(self, scope):
966 def permissions_with_scope(self, scope):
967 """
967 """
968 Call the get_perms function with scoped data. The scope in that function
968 Call the get_perms function with scoped data. The scope in that function
969 narrows the SQL calls to the given ID of objects resulting in fetching
969 narrows the SQL calls to the given ID of objects resulting in fetching
970 Just particular permission we want to obtain. If scope is an empty dict
970 Just particular permission we want to obtain. If scope is an empty dict
971 then it basically narrows the scope to GLOBAL permissions only.
971 then it basically narrows the scope to GLOBAL permissions only.
972
972
973 :param scope: dict
973 :param scope: dict
974 """
974 """
975 if 'repo_name' in scope:
975 if 'repo_name' in scope:
976 obj = Repository.get_by_repo_name(scope['repo_name'])
976 obj = Repository.get_by_repo_name(scope['repo_name'])
977 if obj:
977 if obj:
978 scope['repo_id'] = obj.repo_id
978 scope['repo_id'] = obj.repo_id
979 _scope = {
979 _scope = {
980 'repo_id': -1,
980 'repo_id': -1,
981 'user_group_id': -1,
981 'user_group_id': -1,
982 'repo_group_id': -1,
982 'repo_group_id': -1,
983 }
983 }
984 _scope.update(scope)
984 _scope.update(scope)
985 cache_key = "_".join(map(safe_str, reduce(lambda a, b: a+b,
985 cache_key = "_".join(map(safe_str, reduce(lambda a, b: a+b,
986 _scope.items())))
986 _scope.items())))
987 if cache_key not in self._permissions_scoped_cache:
987 if cache_key not in self._permissions_scoped_cache:
988 # store in cache to mimic how the @LazyProperty works,
988 # store in cache to mimic how the @LazyProperty works,
989 # the difference here is that we use the unique key calculated
989 # the difference here is that we use the unique key calculated
990 # from params and values
990 # from params and values
991 res = self.get_perms(user=self, cache=False, scope=_scope)
991 res = self.get_perms(user=self, cache=False, scope=_scope)
992 self._permissions_scoped_cache[cache_key] = res
992 self._permissions_scoped_cache[cache_key] = res
993 return self._permissions_scoped_cache[cache_key]
993 return self._permissions_scoped_cache[cache_key]
994
994
995 def get_instance(self):
995 def get_instance(self):
996 return User.get(self.user_id)
996 return User.get(self.user_id)
997
997
998 def update_lastactivity(self):
998 def update_lastactivity(self):
999 if self.user_id:
999 if self.user_id:
1000 User.get(self.user_id).update_lastactivity()
1000 User.get(self.user_id).update_lastactivity()
1001
1001
1002 def propagate_data(self):
1002 def propagate_data(self):
1003 """
1003 """
1004 Fills in user data and propagates values to this instance. Maps fetched
1004 Fills in user data and propagates values to this instance. Maps fetched
1005 user attributes to this class instance attributes
1005 user attributes to this class instance attributes
1006 """
1006 """
1007 log.debug('AuthUser: starting data propagation for new potential user')
1007 log.debug('AuthUser: starting data propagation for new potential user')
1008 user_model = UserModel()
1008 user_model = UserModel()
1009 anon_user = self.anonymous_user = User.get_default_user(cache=True)
1009 anon_user = self.anonymous_user = User.get_default_user(cache=True)
1010 is_user_loaded = False
1010 is_user_loaded = False
1011
1011
1012 # lookup by userid
1012 # lookup by userid
1013 if self.user_id is not None and self.user_id != anon_user.user_id:
1013 if self.user_id is not None and self.user_id != anon_user.user_id:
1014 log.debug('Trying Auth User lookup by USER ID: `%s`', self.user_id)
1014 log.debug('Trying Auth User lookup by USER ID: `%s`', self.user_id)
1015 is_user_loaded = user_model.fill_data(self, user_id=self.user_id)
1015 is_user_loaded = user_model.fill_data(self, user_id=self.user_id)
1016
1016
1017 # try go get user by api key
1017 # try go get user by api key
1018 elif self._api_key and self._api_key != anon_user.api_key:
1018 elif self._api_key and self._api_key != anon_user.api_key:
1019 log.debug('Trying Auth User lookup by API KEY: `%s`', self._api_key)
1019 log.debug('Trying Auth User lookup by API KEY: `%s`', self._api_key)
1020 is_user_loaded = user_model.fill_data(self, api_key=self._api_key)
1020 is_user_loaded = user_model.fill_data(self, api_key=self._api_key)
1021
1021
1022 # lookup by username
1022 # lookup by username
1023 elif self.username:
1023 elif self.username:
1024 log.debug('Trying Auth User lookup by USER NAME: `%s`', self.username)
1024 log.debug('Trying Auth User lookup by USER NAME: `%s`', self.username)
1025 is_user_loaded = user_model.fill_data(self, username=self.username)
1025 is_user_loaded = user_model.fill_data(self, username=self.username)
1026 else:
1026 else:
1027 log.debug('No data in %s that could been used to log in', self)
1027 log.debug('No data in %s that could been used to log in', self)
1028
1028
1029 if not is_user_loaded:
1029 if not is_user_loaded:
1030 log.debug(
1030 log.debug(
1031 'Failed to load user. Fallback to default user %s', anon_user)
1031 'Failed to load user. Fallback to default user %s', anon_user)
1032 # if we cannot authenticate user try anonymous
1032 # if we cannot authenticate user try anonymous
1033 if anon_user.active:
1033 if anon_user.active:
1034 log.debug('default user is active, using it as a session user')
1034 log.debug('default user is active, using it as a session user')
1035 user_model.fill_data(self, user_id=anon_user.user_id)
1035 user_model.fill_data(self, user_id=anon_user.user_id)
1036 # then we set this user is logged in
1036 # then we set this user is logged in
1037 self.is_authenticated = True
1037 self.is_authenticated = True
1038 else:
1038 else:
1039 log.debug('default user is NOT active')
1039 log.debug('default user is NOT active')
1040 # in case of disabled anonymous user we reset some of the
1040 # in case of disabled anonymous user we reset some of the
1041 # parameters so such user is "corrupted", skipping the fill_data
1041 # parameters so such user is "corrupted", skipping the fill_data
1042 for attr in ['user_id', 'username', 'admin', 'active']:
1042 for attr in ['user_id', 'username', 'admin', 'active']:
1043 setattr(self, attr, None)
1043 setattr(self, attr, None)
1044 self.is_authenticated = False
1044 self.is_authenticated = False
1045
1045
1046 if not self.username:
1046 if not self.username:
1047 self.username = 'None'
1047 self.username = 'None'
1048
1048
1049 log.debug('AuthUser: propagated user is now %s', self)
1049 log.debug('AuthUser: propagated user is now %s', self)
1050
1050
1051 def get_perms(self, user, scope=None, explicit=True, algo='higherwin',
1051 def get_perms(self, user, scope=None, explicit=True, algo='higherwin',
1052 calculate_super_admin=False, cache=False):
1052 calculate_super_admin=False, cache=False):
1053 """
1053 """
1054 Fills user permission attribute with permissions taken from database
1054 Fills user permission attribute with permissions taken from database
1055 works for permissions given for repositories, and for permissions that
1055 works for permissions given for repositories, and for permissions that
1056 are granted to groups
1056 are granted to groups
1057
1057
1058 :param user: instance of User object from database
1058 :param user: instance of User object from database
1059 :param explicit: In case there are permissions both for user and a group
1059 :param explicit: In case there are permissions both for user and a group
1060 that user is part of, explicit flag will defiine if user will
1060 that user is part of, explicit flag will defiine if user will
1061 explicitly override permissions from group, if it's False it will
1061 explicitly override permissions from group, if it's False it will
1062 make decision based on the algo
1062 make decision based on the algo
1063 :param algo: algorithm to decide what permission should be choose if
1063 :param algo: algorithm to decide what permission should be choose if
1064 it's multiple defined, eg user in two different groups. It also
1064 it's multiple defined, eg user in two different groups. It also
1065 decides if explicit flag is turned off how to specify the permission
1065 decides if explicit flag is turned off how to specify the permission
1066 for case when user is in a group + have defined separate permission
1066 for case when user is in a group + have defined separate permission
1067 """
1067 """
1068 user_id = user.user_id
1068 user_id = user.user_id
1069 user_is_admin = user.is_admin
1069 user_is_admin = user.is_admin
1070
1070
1071 # inheritance of global permissions like create repo/fork repo etc
1071 # inheritance of global permissions like create repo/fork repo etc
1072 user_inherit_default_permissions = user.inherit_default_permissions
1072 user_inherit_default_permissions = user.inherit_default_permissions
1073
1073
1074 cache_seconds = safe_int(
1074 cache_seconds = safe_int(
1075 rhodecode.CONFIG.get('beaker.cache.short_term.expire'))
1075 rhodecode.CONFIG.get('beaker.cache.short_term.expire'))
1076 cache_on = cache or cache_seconds > 0
1076 cache_on = cache or cache_seconds > 0
1077 log.debug(
1077 log.debug(
1078 'Computing PERMISSION tree for user %s scope `%s` '
1078 'Computing PERMISSION tree for user %s scope `%s` '
1079 'with caching: %s[%ss]' % (user, scope, cache_on, cache_seconds))
1079 'with caching: %s[%ss]' % (user, scope, cache_on, cache_seconds))
1080 start = time.time()
1080 start = time.time()
1081 compute = caches.conditional_cache(
1081 compute = caches.conditional_cache(
1082 'short_term', 'cache_desc.{}'.format(user_id),
1082 'short_term', 'cache_desc.{}'.format(user_id),
1083 condition=cache_on, func=_cached_perms_data)
1083 condition=cache_on, func=_cached_perms_data)
1084 result = compute(user_id, scope, user_is_admin,
1084 result = compute(user_id, scope, user_is_admin,
1085 user_inherit_default_permissions, explicit, algo,
1085 user_inherit_default_permissions, explicit, algo,
1086 calculate_super_admin)
1086 calculate_super_admin)
1087
1087
1088 result_repr = []
1088 result_repr = []
1089 for k in result:
1089 for k in result:
1090 result_repr.append((k, len(result[k])))
1090 result_repr.append((k, len(result[k])))
1091 total = time.time() - start
1091 total = time.time() - start
1092 log.debug('PERMISSION tree for user %s computed in %.3fs: %s' % (
1092 log.debug('PERMISSION tree for user %s computed in %.3fs: %s' % (
1093 user, total, result_repr))
1093 user, total, result_repr))
1094 return result
1094 return result
1095
1095
1096 @property
1096 @property
1097 def is_default(self):
1097 def is_default(self):
1098 return self.username == User.DEFAULT_USER
1098 return self.username == User.DEFAULT_USER
1099
1099
1100 @property
1100 @property
1101 def is_admin(self):
1101 def is_admin(self):
1102 return self.admin
1102 return self.admin
1103
1103
1104 @property
1104 @property
1105 def is_user_object(self):
1105 def is_user_object(self):
1106 return self.user_id is not None
1106 return self.user_id is not None
1107
1107
1108 @property
1108 @property
1109 def repositories_admin(self):
1109 def repositories_admin(self):
1110 """
1110 """
1111 Returns list of repositories you're an admin of
1111 Returns list of repositories you're an admin of
1112 """
1112 """
1113 return [
1113 return [
1114 x[0] for x in self.permissions['repositories'].iteritems()
1114 x[0] for x in self.permissions['repositories'].iteritems()
1115 if x[1] == 'repository.admin']
1115 if x[1] == 'repository.admin']
1116
1116
1117 @property
1117 @property
1118 def repository_groups_admin(self):
1118 def repository_groups_admin(self):
1119 """
1119 """
1120 Returns list of repository groups you're an admin of
1120 Returns list of repository groups you're an admin of
1121 """
1121 """
1122 return [
1122 return [
1123 x[0] for x in self.permissions['repositories_groups'].iteritems()
1123 x[0] for x in self.permissions['repositories_groups'].iteritems()
1124 if x[1] == 'group.admin']
1124 if x[1] == 'group.admin']
1125
1125
1126 @property
1126 @property
1127 def user_groups_admin(self):
1127 def user_groups_admin(self):
1128 """
1128 """
1129 Returns list of user groups you're an admin of
1129 Returns list of user groups you're an admin of
1130 """
1130 """
1131 return [
1131 return [
1132 x[0] for x in self.permissions['user_groups'].iteritems()
1132 x[0] for x in self.permissions['user_groups'].iteritems()
1133 if x[1] == 'usergroup.admin']
1133 if x[1] == 'usergroup.admin']
1134
1134
1135 def repo_acl_ids(self, perms=None, name_filter=None, cache=False):
1135 def repo_acl_ids(self, perms=None, name_filter=None, cache=False):
1136 """
1136 """
1137 Returns list of repository ids that user have access to based on given
1137 Returns list of repository ids that user have access to based on given
1138 perms. The cache flag should be only used in cases that are used for
1138 perms. The cache flag should be only used in cases that are used for
1139 display purposes, NOT IN ANY CASE for permission checks.
1139 display purposes, NOT IN ANY CASE for permission checks.
1140 """
1140 """
1141 from rhodecode.model.scm import RepoList
1141 from rhodecode.model.scm import RepoList
1142 if not perms:
1142 if not perms:
1143 perms = [
1143 perms = [
1144 'repository.read', 'repository.write', 'repository.admin']
1144 'repository.read', 'repository.write', 'repository.admin']
1145
1145
1146 def _cached_repo_acl(user_id, perm_def, name_filter):
1146 def _cached_repo_acl(user_id, perm_def, name_filter):
1147 qry = Repository.query()
1147 qry = Repository.query()
1148 if name_filter:
1148 if name_filter:
1149 ilike_expression = u'%{}%'.format(safe_unicode(name_filter))
1149 ilike_expression = u'%{}%'.format(safe_unicode(name_filter))
1150 qry = qry.filter(
1150 qry = qry.filter(
1151 Repository.repo_name.ilike(ilike_expression))
1151 Repository.repo_name.ilike(ilike_expression))
1152
1152
1153 return [x.repo_id for x in
1153 return [x.repo_id for x in
1154 RepoList(qry, perm_set=perm_def)]
1154 RepoList(qry, perm_set=perm_def)]
1155
1155
1156 compute = caches.conditional_cache(
1156 compute = caches.conditional_cache(
1157 'long_term', 'repo_acl_ids.{}'.format(self.user_id),
1157 'short_term', 'repo_acl_ids.{}'.format(self.user_id),
1158 condition=cache, func=_cached_repo_acl)
1158 condition=cache, func=_cached_repo_acl)
1159 return compute(self.user_id, perms, name_filter)
1159 return compute(self.user_id, perms, name_filter)
1160
1160
1161 def repo_group_acl_ids(self, perms=None, name_filter=None, cache=False):
1161 def repo_group_acl_ids(self, perms=None, name_filter=None, cache=False):
1162 """
1162 """
1163 Returns list of repository group ids that user have access to based on given
1163 Returns list of repository group ids that user have access to based on given
1164 perms. The cache flag should be only used in cases that are used for
1164 perms. The cache flag should be only used in cases that are used for
1165 display purposes, NOT IN ANY CASE for permission checks.
1165 display purposes, NOT IN ANY CASE for permission checks.
1166 """
1166 """
1167 from rhodecode.model.scm import RepoGroupList
1167 from rhodecode.model.scm import RepoGroupList
1168 if not perms:
1168 if not perms:
1169 perms = [
1169 perms = [
1170 'group.read', 'group.write', 'group.admin']
1170 'group.read', 'group.write', 'group.admin']
1171
1171
1172 def _cached_repo_group_acl(user_id, perm_def, name_filter):
1172 def _cached_repo_group_acl(user_id, perm_def, name_filter):
1173 qry = RepoGroup.query()
1173 qry = RepoGroup.query()
1174 if name_filter:
1174 if name_filter:
1175 ilike_expression = u'%{}%'.format(safe_unicode(name_filter))
1175 ilike_expression = u'%{}%'.format(safe_unicode(name_filter))
1176 qry = qry.filter(
1176 qry = qry.filter(
1177 RepoGroup.group_name.ilike(ilike_expression))
1177 RepoGroup.group_name.ilike(ilike_expression))
1178
1178
1179 return [x.group_id for x in
1179 return [x.group_id for x in
1180 RepoGroupList(qry, perm_set=perm_def)]
1180 RepoGroupList(qry, perm_set=perm_def)]
1181
1181
1182 compute = caches.conditional_cache(
1182 compute = caches.conditional_cache(
1183 'long_term', 'repo_group_acl_ids.{}'.format(self.user_id),
1183 'short_term', 'repo_group_acl_ids.{}'.format(self.user_id),
1184 condition=cache, func=_cached_repo_group_acl)
1184 condition=cache, func=_cached_repo_group_acl)
1185 return compute(self.user_id, perms, name_filter)
1185 return compute(self.user_id, perms, name_filter)
1186
1186
1187 def user_group_acl_ids(self, perms=None, name_filter=None, cache=False):
1187 def user_group_acl_ids(self, perms=None, name_filter=None, cache=False):
1188 """
1188 """
1189 Returns list of user group ids that user have access to based on given
1189 Returns list of user group ids that user have access to based on given
1190 perms. The cache flag should be only used in cases that are used for
1190 perms. The cache flag should be only used in cases that are used for
1191 display purposes, NOT IN ANY CASE for permission checks.
1191 display purposes, NOT IN ANY CASE for permission checks.
1192 """
1192 """
1193 from rhodecode.model.scm import UserGroupList
1193 from rhodecode.model.scm import UserGroupList
1194 if not perms:
1194 if not perms:
1195 perms = [
1195 perms = [
1196 'usergroup.read', 'usergroup.write', 'usergroup.admin']
1196 'usergroup.read', 'usergroup.write', 'usergroup.admin']
1197
1197
1198 def _cached_user_group_acl(user_id, perm_def, name_filter):
1198 def _cached_user_group_acl(user_id, perm_def, name_filter):
1199 qry = UserGroup.query()
1199 qry = UserGroup.query()
1200 if name_filter:
1200 if name_filter:
1201 ilike_expression = u'%{}%'.format(safe_unicode(name_filter))
1201 ilike_expression = u'%{}%'.format(safe_unicode(name_filter))
1202 qry = qry.filter(
1202 qry = qry.filter(
1203 UserGroup.users_group_name.ilike(ilike_expression))
1203 UserGroup.users_group_name.ilike(ilike_expression))
1204
1204
1205 return [x.users_group_id for x in
1205 return [x.users_group_id for x in
1206 UserGroupList(qry, perm_set=perm_def)]
1206 UserGroupList(qry, perm_set=perm_def)]
1207
1207
1208 compute = caches.conditional_cache(
1208 compute = caches.conditional_cache(
1209 'long_term', 'user_group_acl_ids.{}'.format(self.user_id),
1209 'short_term', 'user_group_acl_ids.{}'.format(self.user_id),
1210 condition=cache, func=_cached_user_group_acl)
1210 condition=cache, func=_cached_user_group_acl)
1211 return compute(self.user_id, perms, name_filter)
1211 return compute(self.user_id, perms, name_filter)
1212
1212
1213 @property
1213 @property
1214 def ip_allowed(self):
1214 def ip_allowed(self):
1215 """
1215 """
1216 Checks if ip_addr used in constructor is allowed from defined list of
1216 Checks if ip_addr used in constructor is allowed from defined list of
1217 allowed ip_addresses for user
1217 allowed ip_addresses for user
1218
1218
1219 :returns: boolean, True if ip is in allowed ip range
1219 :returns: boolean, True if ip is in allowed ip range
1220 """
1220 """
1221 # check IP
1221 # check IP
1222 inherit = self.inherit_default_permissions
1222 inherit = self.inherit_default_permissions
1223 return AuthUser.check_ip_allowed(self.user_id, self.ip_addr,
1223 return AuthUser.check_ip_allowed(self.user_id, self.ip_addr,
1224 inherit_from_default=inherit)
1224 inherit_from_default=inherit)
1225 @property
1225 @property
1226 def personal_repo_group(self):
1226 def personal_repo_group(self):
1227 return RepoGroup.get_user_personal_repo_group(self.user_id)
1227 return RepoGroup.get_user_personal_repo_group(self.user_id)
1228
1228
1229 @LazyProperty
1229 @LazyProperty
1230 def feed_token(self):
1230 def feed_token(self):
1231 return self.get_instance().feed_token
1231 return self.get_instance().feed_token
1232
1232
1233 @classmethod
1233 @classmethod
1234 def check_ip_allowed(cls, user_id, ip_addr, inherit_from_default):
1234 def check_ip_allowed(cls, user_id, ip_addr, inherit_from_default):
1235 allowed_ips = AuthUser.get_allowed_ips(
1235 allowed_ips = AuthUser.get_allowed_ips(
1236 user_id, cache=True, inherit_from_default=inherit_from_default)
1236 user_id, cache=True, inherit_from_default=inherit_from_default)
1237 if check_ip_access(source_ip=ip_addr, allowed_ips=allowed_ips):
1237 if check_ip_access(source_ip=ip_addr, allowed_ips=allowed_ips):
1238 log.debug('IP:%s is in range of %s' % (ip_addr, allowed_ips))
1238 log.debug('IP:%s is in range of %s' % (ip_addr, allowed_ips))
1239 return True
1239 return True
1240 else:
1240 else:
1241 log.info('Access for IP:%s forbidden, '
1241 log.info('Access for IP:%s forbidden, '
1242 'not in %s' % (ip_addr, allowed_ips))
1242 'not in %s' % (ip_addr, allowed_ips))
1243 return False
1243 return False
1244
1244
1245 def __repr__(self):
1245 def __repr__(self):
1246 return "<AuthUser('id:%s[%s] ip:%s auth:%s')>"\
1246 return "<AuthUser('id:%s[%s] ip:%s auth:%s')>"\
1247 % (self.user_id, self.username, self.ip_addr, self.is_authenticated)
1247 % (self.user_id, self.username, self.ip_addr, self.is_authenticated)
1248
1248
1249 def set_authenticated(self, authenticated=True):
1249 def set_authenticated(self, authenticated=True):
1250 if self.user_id != self.anonymous_user.user_id:
1250 if self.user_id != self.anonymous_user.user_id:
1251 self.is_authenticated = authenticated
1251 self.is_authenticated = authenticated
1252
1252
1253 def get_cookie_store(self):
1253 def get_cookie_store(self):
1254 return {
1254 return {
1255 'username': self.username,
1255 'username': self.username,
1256 'password': md5(self.password or ''),
1256 'password': md5(self.password or ''),
1257 'user_id': self.user_id,
1257 'user_id': self.user_id,
1258 'is_authenticated': self.is_authenticated
1258 'is_authenticated': self.is_authenticated
1259 }
1259 }
1260
1260
1261 @classmethod
1261 @classmethod
1262 def from_cookie_store(cls, cookie_store):
1262 def from_cookie_store(cls, cookie_store):
1263 """
1263 """
1264 Creates AuthUser from a cookie store
1264 Creates AuthUser from a cookie store
1265
1265
1266 :param cls:
1266 :param cls:
1267 :param cookie_store:
1267 :param cookie_store:
1268 """
1268 """
1269 user_id = cookie_store.get('user_id')
1269 user_id = cookie_store.get('user_id')
1270 username = cookie_store.get('username')
1270 username = cookie_store.get('username')
1271 api_key = cookie_store.get('api_key')
1271 api_key = cookie_store.get('api_key')
1272 return AuthUser(user_id, api_key, username)
1272 return AuthUser(user_id, api_key, username)
1273
1273
1274 @classmethod
1274 @classmethod
1275 def get_allowed_ips(cls, user_id, cache=False, inherit_from_default=False):
1275 def get_allowed_ips(cls, user_id, cache=False, inherit_from_default=False):
1276 _set = set()
1276 _set = set()
1277
1277
1278 if inherit_from_default:
1278 if inherit_from_default:
1279 default_ips = UserIpMap.query().filter(
1279 default_ips = UserIpMap.query().filter(
1280 UserIpMap.user == User.get_default_user(cache=True))
1280 UserIpMap.user == User.get_default_user(cache=True))
1281 if cache:
1281 if cache:
1282 default_ips = default_ips.options(
1282 default_ips = default_ips.options(
1283 FromCache("sql_cache_short", "get_user_ips_default"))
1283 FromCache("sql_cache_short", "get_user_ips_default"))
1284
1284
1285 # populate from default user
1285 # populate from default user
1286 for ip in default_ips:
1286 for ip in default_ips:
1287 try:
1287 try:
1288 _set.add(ip.ip_addr)
1288 _set.add(ip.ip_addr)
1289 except ObjectDeletedError:
1289 except ObjectDeletedError:
1290 # since we use heavy caching sometimes it happens that
1290 # since we use heavy caching sometimes it happens that
1291 # we get deleted objects here, we just skip them
1291 # we get deleted objects here, we just skip them
1292 pass
1292 pass
1293
1293
1294 user_ips = UserIpMap.query().filter(UserIpMap.user_id == user_id)
1294 user_ips = UserIpMap.query().filter(UserIpMap.user_id == user_id)
1295 if cache:
1295 if cache:
1296 user_ips = user_ips.options(
1296 user_ips = user_ips.options(
1297 FromCache("sql_cache_short", "get_user_ips_%s" % user_id))
1297 FromCache("sql_cache_short", "get_user_ips_%s" % user_id))
1298
1298
1299 for ip in user_ips:
1299 for ip in user_ips:
1300 try:
1300 try:
1301 _set.add(ip.ip_addr)
1301 _set.add(ip.ip_addr)
1302 except ObjectDeletedError:
1302 except ObjectDeletedError:
1303 # since we use heavy caching sometimes it happens that we get
1303 # since we use heavy caching sometimes it happens that we get
1304 # deleted objects here, we just skip them
1304 # deleted objects here, we just skip them
1305 pass
1305 pass
1306 return _set or set(['0.0.0.0/0', '::/0'])
1306 return _set or set(['0.0.0.0/0', '::/0'])
1307
1307
1308
1308
1309 def set_available_permissions(settings):
1309 def set_available_permissions(settings):
1310 """
1310 """
1311 This function will propagate pyramid settings with all available defined
1311 This function will propagate pyramid settings with all available defined
1312 permission given in db. We don't want to check each time from db for new
1312 permission given in db. We don't want to check each time from db for new
1313 permissions since adding a new permission also requires application restart
1313 permissions since adding a new permission also requires application restart
1314 ie. to decorate new views with the newly created permission
1314 ie. to decorate new views with the newly created permission
1315
1315
1316 :param settings: current pyramid registry.settings
1316 :param settings: current pyramid registry.settings
1317
1317
1318 """
1318 """
1319 log.debug('auth: getting information about all available permissions')
1319 log.debug('auth: getting information about all available permissions')
1320 try:
1320 try:
1321 sa = meta.Session
1321 sa = meta.Session
1322 all_perms = sa.query(Permission).all()
1322 all_perms = sa.query(Permission).all()
1323 settings.setdefault('available_permissions',
1323 settings.setdefault('available_permissions',
1324 [x.permission_name for x in all_perms])
1324 [x.permission_name for x in all_perms])
1325 log.debug('auth: set available permissions')
1325 log.debug('auth: set available permissions')
1326 except Exception:
1326 except Exception:
1327 log.exception('Failed to fetch permissions from the database.')
1327 log.exception('Failed to fetch permissions from the database.')
1328 raise
1328 raise
1329
1329
1330
1330
1331 def get_csrf_token(session, force_new=False, save_if_missing=True):
1331 def get_csrf_token(session, force_new=False, save_if_missing=True):
1332 """
1332 """
1333 Return the current authentication token, creating one if one doesn't
1333 Return the current authentication token, creating one if one doesn't
1334 already exist and the save_if_missing flag is present.
1334 already exist and the save_if_missing flag is present.
1335
1335
1336 :param session: pass in the pyramid session, else we use the global ones
1336 :param session: pass in the pyramid session, else we use the global ones
1337 :param force_new: force to re-generate the token and store it in session
1337 :param force_new: force to re-generate the token and store it in session
1338 :param save_if_missing: save the newly generated token if it's missing in
1338 :param save_if_missing: save the newly generated token if it's missing in
1339 session
1339 session
1340 """
1340 """
1341 # NOTE(marcink): probably should be replaced with below one from pyramid 1.9
1341 # NOTE(marcink): probably should be replaced with below one from pyramid 1.9
1342 # from pyramid.csrf import get_csrf_token
1342 # from pyramid.csrf import get_csrf_token
1343
1343
1344 if (csrf_token_key not in session and save_if_missing) or force_new:
1344 if (csrf_token_key not in session and save_if_missing) or force_new:
1345 token = hashlib.sha1(str(random.getrandbits(128))).hexdigest()
1345 token = hashlib.sha1(str(random.getrandbits(128))).hexdigest()
1346 session[csrf_token_key] = token
1346 session[csrf_token_key] = token
1347 if hasattr(session, 'save'):
1347 if hasattr(session, 'save'):
1348 session.save()
1348 session.save()
1349 return session.get(csrf_token_key)
1349 return session.get(csrf_token_key)
1350
1350
1351
1351
1352 def get_request(perm_class_instance):
1352 def get_request(perm_class_instance):
1353 from pyramid.threadlocal import get_current_request
1353 from pyramid.threadlocal import get_current_request
1354 pyramid_request = get_current_request()
1354 pyramid_request = get_current_request()
1355 return pyramid_request
1355 return pyramid_request
1356
1356
1357
1357
1358 # CHECK DECORATORS
1358 # CHECK DECORATORS
1359 class CSRFRequired(object):
1359 class CSRFRequired(object):
1360 """
1360 """
1361 Decorator for authenticating a form
1361 Decorator for authenticating a form
1362
1362
1363 This decorator uses an authorization token stored in the client's
1363 This decorator uses an authorization token stored in the client's
1364 session for prevention of certain Cross-site request forgery (CSRF)
1364 session for prevention of certain Cross-site request forgery (CSRF)
1365 attacks (See
1365 attacks (See
1366 http://en.wikipedia.org/wiki/Cross-site_request_forgery for more
1366 http://en.wikipedia.org/wiki/Cross-site_request_forgery for more
1367 information).
1367 information).
1368
1368
1369 For use with the ``webhelpers.secure_form`` helper functions.
1369 For use with the ``webhelpers.secure_form`` helper functions.
1370
1370
1371 """
1371 """
1372 def __init__(self, token=csrf_token_key, header='X-CSRF-Token',
1372 def __init__(self, token=csrf_token_key, header='X-CSRF-Token',
1373 except_methods=None):
1373 except_methods=None):
1374 self.token = token
1374 self.token = token
1375 self.header = header
1375 self.header = header
1376 self.except_methods = except_methods or []
1376 self.except_methods = except_methods or []
1377
1377
1378 def __call__(self, func):
1378 def __call__(self, func):
1379 return get_cython_compat_decorator(self.__wrapper, func)
1379 return get_cython_compat_decorator(self.__wrapper, func)
1380
1380
1381 def _get_csrf(self, _request):
1381 def _get_csrf(self, _request):
1382 return _request.POST.get(self.token, _request.headers.get(self.header))
1382 return _request.POST.get(self.token, _request.headers.get(self.header))
1383
1383
1384 def check_csrf(self, _request, cur_token):
1384 def check_csrf(self, _request, cur_token):
1385 supplied_token = self._get_csrf(_request)
1385 supplied_token = self._get_csrf(_request)
1386 return supplied_token and supplied_token == cur_token
1386 return supplied_token and supplied_token == cur_token
1387
1387
1388 def _get_request(self):
1388 def _get_request(self):
1389 return get_request(self)
1389 return get_request(self)
1390
1390
1391 def __wrapper(self, func, *fargs, **fkwargs):
1391 def __wrapper(self, func, *fargs, **fkwargs):
1392 request = self._get_request()
1392 request = self._get_request()
1393
1393
1394 if request.method in self.except_methods:
1394 if request.method in self.except_methods:
1395 return func(*fargs, **fkwargs)
1395 return func(*fargs, **fkwargs)
1396
1396
1397 cur_token = get_csrf_token(request.session, save_if_missing=False)
1397 cur_token = get_csrf_token(request.session, save_if_missing=False)
1398 if self.check_csrf(request, cur_token):
1398 if self.check_csrf(request, cur_token):
1399 if request.POST.get(self.token):
1399 if request.POST.get(self.token):
1400 del request.POST[self.token]
1400 del request.POST[self.token]
1401 return func(*fargs, **fkwargs)
1401 return func(*fargs, **fkwargs)
1402 else:
1402 else:
1403 reason = 'token-missing'
1403 reason = 'token-missing'
1404 supplied_token = self._get_csrf(request)
1404 supplied_token = self._get_csrf(request)
1405 if supplied_token and cur_token != supplied_token:
1405 if supplied_token and cur_token != supplied_token:
1406 reason = 'token-mismatch [%s:%s]' % (
1406 reason = 'token-mismatch [%s:%s]' % (
1407 cur_token or ''[:6], supplied_token or ''[:6])
1407 cur_token or ''[:6], supplied_token or ''[:6])
1408
1408
1409 csrf_message = \
1409 csrf_message = \
1410 ("Cross-site request forgery detected, request denied. See "
1410 ("Cross-site request forgery detected, request denied. See "
1411 "http://en.wikipedia.org/wiki/Cross-site_request_forgery for "
1411 "http://en.wikipedia.org/wiki/Cross-site_request_forgery for "
1412 "more information.")
1412 "more information.")
1413 log.warn('Cross-site request forgery detected, request %r DENIED: %s '
1413 log.warn('Cross-site request forgery detected, request %r DENIED: %s '
1414 'REMOTE_ADDR:%s, HEADERS:%s' % (
1414 'REMOTE_ADDR:%s, HEADERS:%s' % (
1415 request, reason, request.remote_addr, request.headers))
1415 request, reason, request.remote_addr, request.headers))
1416
1416
1417 raise HTTPForbidden(explanation=csrf_message)
1417 raise HTTPForbidden(explanation=csrf_message)
1418
1418
1419
1419
1420 class LoginRequired(object):
1420 class LoginRequired(object):
1421 """
1421 """
1422 Must be logged in to execute this function else
1422 Must be logged in to execute this function else
1423 redirect to login page
1423 redirect to login page
1424
1424
1425 :param api_access: if enabled this checks only for valid auth token
1425 :param api_access: if enabled this checks only for valid auth token
1426 and grants access based on valid token
1426 and grants access based on valid token
1427 """
1427 """
1428 def __init__(self, auth_token_access=None):
1428 def __init__(self, auth_token_access=None):
1429 self.auth_token_access = auth_token_access
1429 self.auth_token_access = auth_token_access
1430
1430
1431 def __call__(self, func):
1431 def __call__(self, func):
1432 return get_cython_compat_decorator(self.__wrapper, func)
1432 return get_cython_compat_decorator(self.__wrapper, func)
1433
1433
1434 def _get_request(self):
1434 def _get_request(self):
1435 return get_request(self)
1435 return get_request(self)
1436
1436
1437 def __wrapper(self, func, *fargs, **fkwargs):
1437 def __wrapper(self, func, *fargs, **fkwargs):
1438 from rhodecode.lib import helpers as h
1438 from rhodecode.lib import helpers as h
1439 cls = fargs[0]
1439 cls = fargs[0]
1440 user = cls._rhodecode_user
1440 user = cls._rhodecode_user
1441 request = self._get_request()
1441 request = self._get_request()
1442 _ = request.translate
1442 _ = request.translate
1443
1443
1444 loc = "%s:%s" % (cls.__class__.__name__, func.__name__)
1444 loc = "%s:%s" % (cls.__class__.__name__, func.__name__)
1445 log.debug('Starting login restriction checks for user: %s' % (user,))
1445 log.debug('Starting login restriction checks for user: %s' % (user,))
1446 # check if our IP is allowed
1446 # check if our IP is allowed
1447 ip_access_valid = True
1447 ip_access_valid = True
1448 if not user.ip_allowed:
1448 if not user.ip_allowed:
1449 h.flash(h.literal(_('IP %s not allowed' % (user.ip_addr,))),
1449 h.flash(h.literal(_('IP %s not allowed' % (user.ip_addr,))),
1450 category='warning')
1450 category='warning')
1451 ip_access_valid = False
1451 ip_access_valid = False
1452
1452
1453 # check if we used an APIKEY and it's a valid one
1453 # check if we used an APIKEY and it's a valid one
1454 # defined white-list of controllers which API access will be enabled
1454 # defined white-list of controllers which API access will be enabled
1455 _auth_token = request.GET.get(
1455 _auth_token = request.GET.get(
1456 'auth_token', '') or request.GET.get('api_key', '')
1456 'auth_token', '') or request.GET.get('api_key', '')
1457 auth_token_access_valid = allowed_auth_token_access(
1457 auth_token_access_valid = allowed_auth_token_access(
1458 loc, auth_token=_auth_token)
1458 loc, auth_token=_auth_token)
1459
1459
1460 # explicit controller is enabled or API is in our whitelist
1460 # explicit controller is enabled or API is in our whitelist
1461 if self.auth_token_access or auth_token_access_valid:
1461 if self.auth_token_access or auth_token_access_valid:
1462 log.debug('Checking AUTH TOKEN access for %s' % (cls,))
1462 log.debug('Checking AUTH TOKEN access for %s' % (cls,))
1463 db_user = user.get_instance()
1463 db_user = user.get_instance()
1464
1464
1465 if db_user:
1465 if db_user:
1466 if self.auth_token_access:
1466 if self.auth_token_access:
1467 roles = self.auth_token_access
1467 roles = self.auth_token_access
1468 else:
1468 else:
1469 roles = [UserApiKeys.ROLE_HTTP]
1469 roles = [UserApiKeys.ROLE_HTTP]
1470 token_match = db_user.authenticate_by_token(
1470 token_match = db_user.authenticate_by_token(
1471 _auth_token, roles=roles)
1471 _auth_token, roles=roles)
1472 else:
1472 else:
1473 log.debug('Unable to fetch db instance for auth user: %s', user)
1473 log.debug('Unable to fetch db instance for auth user: %s', user)
1474 token_match = False
1474 token_match = False
1475
1475
1476 if _auth_token and token_match:
1476 if _auth_token and token_match:
1477 auth_token_access_valid = True
1477 auth_token_access_valid = True
1478 log.debug('AUTH TOKEN ****%s is VALID' % (_auth_token[-4:],))
1478 log.debug('AUTH TOKEN ****%s is VALID' % (_auth_token[-4:],))
1479 else:
1479 else:
1480 auth_token_access_valid = False
1480 auth_token_access_valid = False
1481 if not _auth_token:
1481 if not _auth_token:
1482 log.debug("AUTH TOKEN *NOT* present in request")
1482 log.debug("AUTH TOKEN *NOT* present in request")
1483 else:
1483 else:
1484 log.warning(
1484 log.warning(
1485 "AUTH TOKEN ****%s *NOT* valid" % _auth_token[-4:])
1485 "AUTH TOKEN ****%s *NOT* valid" % _auth_token[-4:])
1486
1486
1487 log.debug('Checking if %s is authenticated @ %s' % (user.username, loc))
1487 log.debug('Checking if %s is authenticated @ %s' % (user.username, loc))
1488 reason = 'RHODECODE_AUTH' if user.is_authenticated \
1488 reason = 'RHODECODE_AUTH' if user.is_authenticated \
1489 else 'AUTH_TOKEN_AUTH'
1489 else 'AUTH_TOKEN_AUTH'
1490
1490
1491 if ip_access_valid and (
1491 if ip_access_valid and (
1492 user.is_authenticated or auth_token_access_valid):
1492 user.is_authenticated or auth_token_access_valid):
1493 log.info(
1493 log.info(
1494 'user %s authenticating with:%s IS authenticated on func %s'
1494 'user %s authenticating with:%s IS authenticated on func %s'
1495 % (user, reason, loc))
1495 % (user, reason, loc))
1496
1496
1497 # update user data to check last activity
1497 # update user data to check last activity
1498 user.update_lastactivity()
1498 user.update_lastactivity()
1499 Session().commit()
1499 Session().commit()
1500 return func(*fargs, **fkwargs)
1500 return func(*fargs, **fkwargs)
1501 else:
1501 else:
1502 log.warning(
1502 log.warning(
1503 'user %s authenticating with:%s NOT authenticated on '
1503 'user %s authenticating with:%s NOT authenticated on '
1504 'func: %s: IP_ACCESS:%s AUTH_TOKEN_ACCESS:%s'
1504 'func: %s: IP_ACCESS:%s AUTH_TOKEN_ACCESS:%s'
1505 % (user, reason, loc, ip_access_valid,
1505 % (user, reason, loc, ip_access_valid,
1506 auth_token_access_valid))
1506 auth_token_access_valid))
1507 # we preserve the get PARAM
1507 # we preserve the get PARAM
1508 came_from = get_came_from(request)
1508 came_from = get_came_from(request)
1509
1509
1510 log.debug('redirecting to login page with %s' % (came_from,))
1510 log.debug('redirecting to login page with %s' % (came_from,))
1511 raise HTTPFound(
1511 raise HTTPFound(
1512 h.route_path('login', _query={'came_from': came_from}))
1512 h.route_path('login', _query={'came_from': came_from}))
1513
1513
1514
1514
1515 class NotAnonymous(object):
1515 class NotAnonymous(object):
1516 """
1516 """
1517 Must be logged in to execute this function else
1517 Must be logged in to execute this function else
1518 redirect to login page
1518 redirect to login page
1519 """
1519 """
1520
1520
1521 def __call__(self, func):
1521 def __call__(self, func):
1522 return get_cython_compat_decorator(self.__wrapper, func)
1522 return get_cython_compat_decorator(self.__wrapper, func)
1523
1523
1524 def _get_request(self):
1524 def _get_request(self):
1525 return get_request(self)
1525 return get_request(self)
1526
1526
1527 def __wrapper(self, func, *fargs, **fkwargs):
1527 def __wrapper(self, func, *fargs, **fkwargs):
1528 import rhodecode.lib.helpers as h
1528 import rhodecode.lib.helpers as h
1529 cls = fargs[0]
1529 cls = fargs[0]
1530 self.user = cls._rhodecode_user
1530 self.user = cls._rhodecode_user
1531 request = self._get_request()
1531 request = self._get_request()
1532 _ = request.translate
1532 _ = request.translate
1533 log.debug('Checking if user is not anonymous @%s' % cls)
1533 log.debug('Checking if user is not anonymous @%s' % cls)
1534
1534
1535 anonymous = self.user.username == User.DEFAULT_USER
1535 anonymous = self.user.username == User.DEFAULT_USER
1536
1536
1537 if anonymous:
1537 if anonymous:
1538 came_from = get_came_from(request)
1538 came_from = get_came_from(request)
1539 h.flash(_('You need to be a registered user to '
1539 h.flash(_('You need to be a registered user to '
1540 'perform this action'),
1540 'perform this action'),
1541 category='warning')
1541 category='warning')
1542 raise HTTPFound(
1542 raise HTTPFound(
1543 h.route_path('login', _query={'came_from': came_from}))
1543 h.route_path('login', _query={'came_from': came_from}))
1544 else:
1544 else:
1545 return func(*fargs, **fkwargs)
1545 return func(*fargs, **fkwargs)
1546
1546
1547
1547
1548 class PermsDecorator(object):
1548 class PermsDecorator(object):
1549 """
1549 """
1550 Base class for controller decorators, we extract the current user from
1550 Base class for controller decorators, we extract the current user from
1551 the class itself, which has it stored in base controllers
1551 the class itself, which has it stored in base controllers
1552 """
1552 """
1553
1553
1554 def __init__(self, *required_perms):
1554 def __init__(self, *required_perms):
1555 self.required_perms = set(required_perms)
1555 self.required_perms = set(required_perms)
1556
1556
1557 def __call__(self, func):
1557 def __call__(self, func):
1558 return get_cython_compat_decorator(self.__wrapper, func)
1558 return get_cython_compat_decorator(self.__wrapper, func)
1559
1559
1560 def _get_request(self):
1560 def _get_request(self):
1561 return get_request(self)
1561 return get_request(self)
1562
1562
1563 def __wrapper(self, func, *fargs, **fkwargs):
1563 def __wrapper(self, func, *fargs, **fkwargs):
1564 import rhodecode.lib.helpers as h
1564 import rhodecode.lib.helpers as h
1565 cls = fargs[0]
1565 cls = fargs[0]
1566 _user = cls._rhodecode_user
1566 _user = cls._rhodecode_user
1567 request = self._get_request()
1567 request = self._get_request()
1568 _ = request.translate
1568 _ = request.translate
1569
1569
1570 log.debug('checking %s permissions %s for %s %s',
1570 log.debug('checking %s permissions %s for %s %s',
1571 self.__class__.__name__, self.required_perms, cls, _user)
1571 self.__class__.__name__, self.required_perms, cls, _user)
1572
1572
1573 if self.check_permissions(_user):
1573 if self.check_permissions(_user):
1574 log.debug('Permission granted for %s %s', cls, _user)
1574 log.debug('Permission granted for %s %s', cls, _user)
1575 return func(*fargs, **fkwargs)
1575 return func(*fargs, **fkwargs)
1576
1576
1577 else:
1577 else:
1578 log.debug('Permission denied for %s %s', cls, _user)
1578 log.debug('Permission denied for %s %s', cls, _user)
1579 anonymous = _user.username == User.DEFAULT_USER
1579 anonymous = _user.username == User.DEFAULT_USER
1580
1580
1581 if anonymous:
1581 if anonymous:
1582 came_from = get_came_from(self._get_request())
1582 came_from = get_came_from(self._get_request())
1583 h.flash(_('You need to be signed in to view this page'),
1583 h.flash(_('You need to be signed in to view this page'),
1584 category='warning')
1584 category='warning')
1585 raise HTTPFound(
1585 raise HTTPFound(
1586 h.route_path('login', _query={'came_from': came_from}))
1586 h.route_path('login', _query={'came_from': came_from}))
1587
1587
1588 else:
1588 else:
1589 # redirect with 404 to prevent resource discovery
1589 # redirect with 404 to prevent resource discovery
1590 raise HTTPNotFound()
1590 raise HTTPNotFound()
1591
1591
1592 def check_permissions(self, user):
1592 def check_permissions(self, user):
1593 """Dummy function for overriding"""
1593 """Dummy function for overriding"""
1594 raise NotImplementedError(
1594 raise NotImplementedError(
1595 'You have to write this function in child class')
1595 'You have to write this function in child class')
1596
1596
1597
1597
1598 class HasPermissionAllDecorator(PermsDecorator):
1598 class HasPermissionAllDecorator(PermsDecorator):
1599 """
1599 """
1600 Checks for access permission for all given predicates. All of them
1600 Checks for access permission for all given predicates. All of them
1601 have to be meet in order to fulfill the request
1601 have to be meet in order to fulfill the request
1602 """
1602 """
1603
1603
1604 def check_permissions(self, user):
1604 def check_permissions(self, user):
1605 perms = user.permissions_with_scope({})
1605 perms = user.permissions_with_scope({})
1606 if self.required_perms.issubset(perms['global']):
1606 if self.required_perms.issubset(perms['global']):
1607 return True
1607 return True
1608 return False
1608 return False
1609
1609
1610
1610
1611 class HasPermissionAnyDecorator(PermsDecorator):
1611 class HasPermissionAnyDecorator(PermsDecorator):
1612 """
1612 """
1613 Checks for access permission for any of given predicates. In order to
1613 Checks for access permission for any of given predicates. In order to
1614 fulfill the request any of predicates must be meet
1614 fulfill the request any of predicates must be meet
1615 """
1615 """
1616
1616
1617 def check_permissions(self, user):
1617 def check_permissions(self, user):
1618 perms = user.permissions_with_scope({})
1618 perms = user.permissions_with_scope({})
1619 if self.required_perms.intersection(perms['global']):
1619 if self.required_perms.intersection(perms['global']):
1620 return True
1620 return True
1621 return False
1621 return False
1622
1622
1623
1623
1624 class HasRepoPermissionAllDecorator(PermsDecorator):
1624 class HasRepoPermissionAllDecorator(PermsDecorator):
1625 """
1625 """
1626 Checks for access permission for all given predicates for specific
1626 Checks for access permission for all given predicates for specific
1627 repository. All of them have to be meet in order to fulfill the request
1627 repository. All of them have to be meet in order to fulfill the request
1628 """
1628 """
1629 def _get_repo_name(self):
1629 def _get_repo_name(self):
1630 _request = self._get_request()
1630 _request = self._get_request()
1631 return get_repo_slug(_request)
1631 return get_repo_slug(_request)
1632
1632
1633 def check_permissions(self, user):
1633 def check_permissions(self, user):
1634 perms = user.permissions
1634 perms = user.permissions
1635 repo_name = self._get_repo_name()
1635 repo_name = self._get_repo_name()
1636
1636
1637 try:
1637 try:
1638 user_perms = set([perms['repositories'][repo_name]])
1638 user_perms = set([perms['repositories'][repo_name]])
1639 except KeyError:
1639 except KeyError:
1640 log.debug('cannot locate repo with name: `%s` in permissions defs',
1640 log.debug('cannot locate repo with name: `%s` in permissions defs',
1641 repo_name)
1641 repo_name)
1642 return False
1642 return False
1643
1643
1644 log.debug('checking `%s` permissions for repo `%s`',
1644 log.debug('checking `%s` permissions for repo `%s`',
1645 user_perms, repo_name)
1645 user_perms, repo_name)
1646 if self.required_perms.issubset(user_perms):
1646 if self.required_perms.issubset(user_perms):
1647 return True
1647 return True
1648 return False
1648 return False
1649
1649
1650
1650
1651 class HasRepoPermissionAnyDecorator(PermsDecorator):
1651 class HasRepoPermissionAnyDecorator(PermsDecorator):
1652 """
1652 """
1653 Checks for access permission for any of given predicates for specific
1653 Checks for access permission for any of given predicates for specific
1654 repository. In order to fulfill the request any of predicates must be meet
1654 repository. In order to fulfill the request any of predicates must be meet
1655 """
1655 """
1656 def _get_repo_name(self):
1656 def _get_repo_name(self):
1657 _request = self._get_request()
1657 _request = self._get_request()
1658 return get_repo_slug(_request)
1658 return get_repo_slug(_request)
1659
1659
1660 def check_permissions(self, user):
1660 def check_permissions(self, user):
1661 perms = user.permissions
1661 perms = user.permissions
1662 repo_name = self._get_repo_name()
1662 repo_name = self._get_repo_name()
1663
1663
1664 try:
1664 try:
1665 user_perms = set([perms['repositories'][repo_name]])
1665 user_perms = set([perms['repositories'][repo_name]])
1666 except KeyError:
1666 except KeyError:
1667 log.debug(
1667 log.debug(
1668 'cannot locate repo with name: `%s` in permissions defs',
1668 'cannot locate repo with name: `%s` in permissions defs',
1669 repo_name)
1669 repo_name)
1670 return False
1670 return False
1671
1671
1672 log.debug('checking `%s` permissions for repo `%s`',
1672 log.debug('checking `%s` permissions for repo `%s`',
1673 user_perms, repo_name)
1673 user_perms, repo_name)
1674 if self.required_perms.intersection(user_perms):
1674 if self.required_perms.intersection(user_perms):
1675 return True
1675 return True
1676 return False
1676 return False
1677
1677
1678
1678
1679 class HasRepoGroupPermissionAllDecorator(PermsDecorator):
1679 class HasRepoGroupPermissionAllDecorator(PermsDecorator):
1680 """
1680 """
1681 Checks for access permission for all given predicates for specific
1681 Checks for access permission for all given predicates for specific
1682 repository group. All of them have to be meet in order to
1682 repository group. All of them have to be meet in order to
1683 fulfill the request
1683 fulfill the request
1684 """
1684 """
1685 def _get_repo_group_name(self):
1685 def _get_repo_group_name(self):
1686 _request = self._get_request()
1686 _request = self._get_request()
1687 return get_repo_group_slug(_request)
1687 return get_repo_group_slug(_request)
1688
1688
1689 def check_permissions(self, user):
1689 def check_permissions(self, user):
1690 perms = user.permissions
1690 perms = user.permissions
1691 group_name = self._get_repo_group_name()
1691 group_name = self._get_repo_group_name()
1692 try:
1692 try:
1693 user_perms = set([perms['repositories_groups'][group_name]])
1693 user_perms = set([perms['repositories_groups'][group_name]])
1694 except KeyError:
1694 except KeyError:
1695 log.debug(
1695 log.debug(
1696 'cannot locate repo group with name: `%s` in permissions defs',
1696 'cannot locate repo group with name: `%s` in permissions defs',
1697 group_name)
1697 group_name)
1698 return False
1698 return False
1699
1699
1700 log.debug('checking `%s` permissions for repo group `%s`',
1700 log.debug('checking `%s` permissions for repo group `%s`',
1701 user_perms, group_name)
1701 user_perms, group_name)
1702 if self.required_perms.issubset(user_perms):
1702 if self.required_perms.issubset(user_perms):
1703 return True
1703 return True
1704 return False
1704 return False
1705
1705
1706
1706
1707 class HasRepoGroupPermissionAnyDecorator(PermsDecorator):
1707 class HasRepoGroupPermissionAnyDecorator(PermsDecorator):
1708 """
1708 """
1709 Checks for access permission for any of given predicates for specific
1709 Checks for access permission for any of given predicates for specific
1710 repository group. In order to fulfill the request any
1710 repository group. In order to fulfill the request any
1711 of predicates must be met
1711 of predicates must be met
1712 """
1712 """
1713 def _get_repo_group_name(self):
1713 def _get_repo_group_name(self):
1714 _request = self._get_request()
1714 _request = self._get_request()
1715 return get_repo_group_slug(_request)
1715 return get_repo_group_slug(_request)
1716
1716
1717 def check_permissions(self, user):
1717 def check_permissions(self, user):
1718 perms = user.permissions
1718 perms = user.permissions
1719 group_name = self._get_repo_group_name()
1719 group_name = self._get_repo_group_name()
1720
1720
1721 try:
1721 try:
1722 user_perms = set([perms['repositories_groups'][group_name]])
1722 user_perms = set([perms['repositories_groups'][group_name]])
1723 except KeyError:
1723 except KeyError:
1724 log.debug(
1724 log.debug(
1725 'cannot locate repo group with name: `%s` in permissions defs',
1725 'cannot locate repo group with name: `%s` in permissions defs',
1726 group_name)
1726 group_name)
1727 return False
1727 return False
1728
1728
1729 log.debug('checking `%s` permissions for repo group `%s`',
1729 log.debug('checking `%s` permissions for repo group `%s`',
1730 user_perms, group_name)
1730 user_perms, group_name)
1731 if self.required_perms.intersection(user_perms):
1731 if self.required_perms.intersection(user_perms):
1732 return True
1732 return True
1733 return False
1733 return False
1734
1734
1735
1735
1736 class HasUserGroupPermissionAllDecorator(PermsDecorator):
1736 class HasUserGroupPermissionAllDecorator(PermsDecorator):
1737 """
1737 """
1738 Checks for access permission for all given predicates for specific
1738 Checks for access permission for all given predicates for specific
1739 user group. All of them have to be meet in order to fulfill the request
1739 user group. All of them have to be meet in order to fulfill the request
1740 """
1740 """
1741 def _get_user_group_name(self):
1741 def _get_user_group_name(self):
1742 _request = self._get_request()
1742 _request = self._get_request()
1743 return get_user_group_slug(_request)
1743 return get_user_group_slug(_request)
1744
1744
1745 def check_permissions(self, user):
1745 def check_permissions(self, user):
1746 perms = user.permissions
1746 perms = user.permissions
1747 group_name = self._get_user_group_name()
1747 group_name = self._get_user_group_name()
1748 try:
1748 try:
1749 user_perms = set([perms['user_groups'][group_name]])
1749 user_perms = set([perms['user_groups'][group_name]])
1750 except KeyError:
1750 except KeyError:
1751 return False
1751 return False
1752
1752
1753 if self.required_perms.issubset(user_perms):
1753 if self.required_perms.issubset(user_perms):
1754 return True
1754 return True
1755 return False
1755 return False
1756
1756
1757
1757
1758 class HasUserGroupPermissionAnyDecorator(PermsDecorator):
1758 class HasUserGroupPermissionAnyDecorator(PermsDecorator):
1759 """
1759 """
1760 Checks for access permission for any of given predicates for specific
1760 Checks for access permission for any of given predicates for specific
1761 user group. In order to fulfill the request any of predicates must be meet
1761 user group. In order to fulfill the request any of predicates must be meet
1762 """
1762 """
1763 def _get_user_group_name(self):
1763 def _get_user_group_name(self):
1764 _request = self._get_request()
1764 _request = self._get_request()
1765 return get_user_group_slug(_request)
1765 return get_user_group_slug(_request)
1766
1766
1767 def check_permissions(self, user):
1767 def check_permissions(self, user):
1768 perms = user.permissions
1768 perms = user.permissions
1769 group_name = self._get_user_group_name()
1769 group_name = self._get_user_group_name()
1770 try:
1770 try:
1771 user_perms = set([perms['user_groups'][group_name]])
1771 user_perms = set([perms['user_groups'][group_name]])
1772 except KeyError:
1772 except KeyError:
1773 return False
1773 return False
1774
1774
1775 if self.required_perms.intersection(user_perms):
1775 if self.required_perms.intersection(user_perms):
1776 return True
1776 return True
1777 return False
1777 return False
1778
1778
1779
1779
1780 # CHECK FUNCTIONS
1780 # CHECK FUNCTIONS
1781 class PermsFunction(object):
1781 class PermsFunction(object):
1782 """Base function for other check functions"""
1782 """Base function for other check functions"""
1783
1783
1784 def __init__(self, *perms):
1784 def __init__(self, *perms):
1785 self.required_perms = set(perms)
1785 self.required_perms = set(perms)
1786 self.repo_name = None
1786 self.repo_name = None
1787 self.repo_group_name = None
1787 self.repo_group_name = None
1788 self.user_group_name = None
1788 self.user_group_name = None
1789
1789
1790 def __bool__(self):
1790 def __bool__(self):
1791 frame = inspect.currentframe()
1791 frame = inspect.currentframe()
1792 stack_trace = traceback.format_stack(frame)
1792 stack_trace = traceback.format_stack(frame)
1793 log.error('Checking bool value on a class instance of perm '
1793 log.error('Checking bool value on a class instance of perm '
1794 'function is not allowed: %s' % ''.join(stack_trace))
1794 'function is not allowed: %s' % ''.join(stack_trace))
1795 # rather than throwing errors, here we always return False so if by
1795 # rather than throwing errors, here we always return False so if by
1796 # accident someone checks truth for just an instance it will always end
1796 # accident someone checks truth for just an instance it will always end
1797 # up in returning False
1797 # up in returning False
1798 return False
1798 return False
1799 __nonzero__ = __bool__
1799 __nonzero__ = __bool__
1800
1800
1801 def __call__(self, check_location='', user=None):
1801 def __call__(self, check_location='', user=None):
1802 if not user:
1802 if not user:
1803 log.debug('Using user attribute from global request')
1803 log.debug('Using user attribute from global request')
1804 # TODO: remove this someday,put as user as attribute here
1804 # TODO: remove this someday,put as user as attribute here
1805 request = self._get_request()
1805 request = self._get_request()
1806 user = request.user
1806 user = request.user
1807
1807
1808 # init auth user if not already given
1808 # init auth user if not already given
1809 if not isinstance(user, AuthUser):
1809 if not isinstance(user, AuthUser):
1810 log.debug('Wrapping user %s into AuthUser', user)
1810 log.debug('Wrapping user %s into AuthUser', user)
1811 user = AuthUser(user.user_id)
1811 user = AuthUser(user.user_id)
1812
1812
1813 cls_name = self.__class__.__name__
1813 cls_name = self.__class__.__name__
1814 check_scope = self._get_check_scope(cls_name)
1814 check_scope = self._get_check_scope(cls_name)
1815 check_location = check_location or 'unspecified location'
1815 check_location = check_location or 'unspecified location'
1816
1816
1817 log.debug('checking cls:%s %s usr:%s %s @ %s', cls_name,
1817 log.debug('checking cls:%s %s usr:%s %s @ %s', cls_name,
1818 self.required_perms, user, check_scope, check_location)
1818 self.required_perms, user, check_scope, check_location)
1819 if not user:
1819 if not user:
1820 log.warning('Empty user given for permission check')
1820 log.warning('Empty user given for permission check')
1821 return False
1821 return False
1822
1822
1823 if self.check_permissions(user):
1823 if self.check_permissions(user):
1824 log.debug('Permission to repo:`%s` GRANTED for user:`%s` @ %s',
1824 log.debug('Permission to repo:`%s` GRANTED for user:`%s` @ %s',
1825 check_scope, user, check_location)
1825 check_scope, user, check_location)
1826 return True
1826 return True
1827
1827
1828 else:
1828 else:
1829 log.debug('Permission to repo:`%s` DENIED for user:`%s` @ %s',
1829 log.debug('Permission to repo:`%s` DENIED for user:`%s` @ %s',
1830 check_scope, user, check_location)
1830 check_scope, user, check_location)
1831 return False
1831 return False
1832
1832
1833 def _get_request(self):
1833 def _get_request(self):
1834 return get_request(self)
1834 return get_request(self)
1835
1835
1836 def _get_check_scope(self, cls_name):
1836 def _get_check_scope(self, cls_name):
1837 return {
1837 return {
1838 'HasPermissionAll': 'GLOBAL',
1838 'HasPermissionAll': 'GLOBAL',
1839 'HasPermissionAny': 'GLOBAL',
1839 'HasPermissionAny': 'GLOBAL',
1840 'HasRepoPermissionAll': 'repo:%s' % self.repo_name,
1840 'HasRepoPermissionAll': 'repo:%s' % self.repo_name,
1841 'HasRepoPermissionAny': 'repo:%s' % self.repo_name,
1841 'HasRepoPermissionAny': 'repo:%s' % self.repo_name,
1842 'HasRepoGroupPermissionAll': 'repo_group:%s' % self.repo_group_name,
1842 'HasRepoGroupPermissionAll': 'repo_group:%s' % self.repo_group_name,
1843 'HasRepoGroupPermissionAny': 'repo_group:%s' % self.repo_group_name,
1843 'HasRepoGroupPermissionAny': 'repo_group:%s' % self.repo_group_name,
1844 'HasUserGroupPermissionAll': 'user_group:%s' % self.user_group_name,
1844 'HasUserGroupPermissionAll': 'user_group:%s' % self.user_group_name,
1845 'HasUserGroupPermissionAny': 'user_group:%s' % self.user_group_name,
1845 'HasUserGroupPermissionAny': 'user_group:%s' % self.user_group_name,
1846 }.get(cls_name, '?:%s' % cls_name)
1846 }.get(cls_name, '?:%s' % cls_name)
1847
1847
1848 def check_permissions(self, user):
1848 def check_permissions(self, user):
1849 """Dummy function for overriding"""
1849 """Dummy function for overriding"""
1850 raise Exception('You have to write this function in child class')
1850 raise Exception('You have to write this function in child class')
1851
1851
1852
1852
1853 class HasPermissionAll(PermsFunction):
1853 class HasPermissionAll(PermsFunction):
1854 def check_permissions(self, user):
1854 def check_permissions(self, user):
1855 perms = user.permissions_with_scope({})
1855 perms = user.permissions_with_scope({})
1856 if self.required_perms.issubset(perms.get('global')):
1856 if self.required_perms.issubset(perms.get('global')):
1857 return True
1857 return True
1858 return False
1858 return False
1859
1859
1860
1860
1861 class HasPermissionAny(PermsFunction):
1861 class HasPermissionAny(PermsFunction):
1862 def check_permissions(self, user):
1862 def check_permissions(self, user):
1863 perms = user.permissions_with_scope({})
1863 perms = user.permissions_with_scope({})
1864 if self.required_perms.intersection(perms.get('global')):
1864 if self.required_perms.intersection(perms.get('global')):
1865 return True
1865 return True
1866 return False
1866 return False
1867
1867
1868
1868
1869 class HasRepoPermissionAll(PermsFunction):
1869 class HasRepoPermissionAll(PermsFunction):
1870 def __call__(self, repo_name=None, check_location='', user=None):
1870 def __call__(self, repo_name=None, check_location='', user=None):
1871 self.repo_name = repo_name
1871 self.repo_name = repo_name
1872 return super(HasRepoPermissionAll, self).__call__(check_location, user)
1872 return super(HasRepoPermissionAll, self).__call__(check_location, user)
1873
1873
1874 def _get_repo_name(self):
1874 def _get_repo_name(self):
1875 if not self.repo_name:
1875 if not self.repo_name:
1876 _request = self._get_request()
1876 _request = self._get_request()
1877 self.repo_name = get_repo_slug(_request)
1877 self.repo_name = get_repo_slug(_request)
1878 return self.repo_name
1878 return self.repo_name
1879
1879
1880 def check_permissions(self, user):
1880 def check_permissions(self, user):
1881 self.repo_name = self._get_repo_name()
1881 self.repo_name = self._get_repo_name()
1882 perms = user.permissions
1882 perms = user.permissions
1883 try:
1883 try:
1884 user_perms = set([perms['repositories'][self.repo_name]])
1884 user_perms = set([perms['repositories'][self.repo_name]])
1885 except KeyError:
1885 except KeyError:
1886 return False
1886 return False
1887 if self.required_perms.issubset(user_perms):
1887 if self.required_perms.issubset(user_perms):
1888 return True
1888 return True
1889 return False
1889 return False
1890
1890
1891
1891
1892 class HasRepoPermissionAny(PermsFunction):
1892 class HasRepoPermissionAny(PermsFunction):
1893 def __call__(self, repo_name=None, check_location='', user=None):
1893 def __call__(self, repo_name=None, check_location='', user=None):
1894 self.repo_name = repo_name
1894 self.repo_name = repo_name
1895 return super(HasRepoPermissionAny, self).__call__(check_location, user)
1895 return super(HasRepoPermissionAny, self).__call__(check_location, user)
1896
1896
1897 def _get_repo_name(self):
1897 def _get_repo_name(self):
1898 if not self.repo_name:
1898 if not self.repo_name:
1899 _request = self._get_request()
1899 _request = self._get_request()
1900 self.repo_name = get_repo_slug(_request)
1900 self.repo_name = get_repo_slug(_request)
1901 return self.repo_name
1901 return self.repo_name
1902
1902
1903 def check_permissions(self, user):
1903 def check_permissions(self, user):
1904 self.repo_name = self._get_repo_name()
1904 self.repo_name = self._get_repo_name()
1905 perms = user.permissions
1905 perms = user.permissions
1906 try:
1906 try:
1907 user_perms = set([perms['repositories'][self.repo_name]])
1907 user_perms = set([perms['repositories'][self.repo_name]])
1908 except KeyError:
1908 except KeyError:
1909 return False
1909 return False
1910 if self.required_perms.intersection(user_perms):
1910 if self.required_perms.intersection(user_perms):
1911 return True
1911 return True
1912 return False
1912 return False
1913
1913
1914
1914
1915 class HasRepoGroupPermissionAny(PermsFunction):
1915 class HasRepoGroupPermissionAny(PermsFunction):
1916 def __call__(self, group_name=None, check_location='', user=None):
1916 def __call__(self, group_name=None, check_location='', user=None):
1917 self.repo_group_name = group_name
1917 self.repo_group_name = group_name
1918 return super(HasRepoGroupPermissionAny, self).__call__(
1918 return super(HasRepoGroupPermissionAny, self).__call__(
1919 check_location, user)
1919 check_location, user)
1920
1920
1921 def check_permissions(self, user):
1921 def check_permissions(self, user):
1922 perms = user.permissions
1922 perms = user.permissions
1923 try:
1923 try:
1924 user_perms = set(
1924 user_perms = set(
1925 [perms['repositories_groups'][self.repo_group_name]])
1925 [perms['repositories_groups'][self.repo_group_name]])
1926 except KeyError:
1926 except KeyError:
1927 return False
1927 return False
1928 if self.required_perms.intersection(user_perms):
1928 if self.required_perms.intersection(user_perms):
1929 return True
1929 return True
1930 return False
1930 return False
1931
1931
1932
1932
1933 class HasRepoGroupPermissionAll(PermsFunction):
1933 class HasRepoGroupPermissionAll(PermsFunction):
1934 def __call__(self, group_name=None, check_location='', user=None):
1934 def __call__(self, group_name=None, check_location='', user=None):
1935 self.repo_group_name = group_name
1935 self.repo_group_name = group_name
1936 return super(HasRepoGroupPermissionAll, self).__call__(
1936 return super(HasRepoGroupPermissionAll, self).__call__(
1937 check_location, user)
1937 check_location, user)
1938
1938
1939 def check_permissions(self, user):
1939 def check_permissions(self, user):
1940 perms = user.permissions
1940 perms = user.permissions
1941 try:
1941 try:
1942 user_perms = set(
1942 user_perms = set(
1943 [perms['repositories_groups'][self.repo_group_name]])
1943 [perms['repositories_groups'][self.repo_group_name]])
1944 except KeyError:
1944 except KeyError:
1945 return False
1945 return False
1946 if self.required_perms.issubset(user_perms):
1946 if self.required_perms.issubset(user_perms):
1947 return True
1947 return True
1948 return False
1948 return False
1949
1949
1950
1950
1951 class HasUserGroupPermissionAny(PermsFunction):
1951 class HasUserGroupPermissionAny(PermsFunction):
1952 def __call__(self, user_group_name=None, check_location='', user=None):
1952 def __call__(self, user_group_name=None, check_location='', user=None):
1953 self.user_group_name = user_group_name
1953 self.user_group_name = user_group_name
1954 return super(HasUserGroupPermissionAny, self).__call__(
1954 return super(HasUserGroupPermissionAny, self).__call__(
1955 check_location, user)
1955 check_location, user)
1956
1956
1957 def check_permissions(self, user):
1957 def check_permissions(self, user):
1958 perms = user.permissions
1958 perms = user.permissions
1959 try:
1959 try:
1960 user_perms = set([perms['user_groups'][self.user_group_name]])
1960 user_perms = set([perms['user_groups'][self.user_group_name]])
1961 except KeyError:
1961 except KeyError:
1962 return False
1962 return False
1963 if self.required_perms.intersection(user_perms):
1963 if self.required_perms.intersection(user_perms):
1964 return True
1964 return True
1965 return False
1965 return False
1966
1966
1967
1967
1968 class HasUserGroupPermissionAll(PermsFunction):
1968 class HasUserGroupPermissionAll(PermsFunction):
1969 def __call__(self, user_group_name=None, check_location='', user=None):
1969 def __call__(self, user_group_name=None, check_location='', user=None):
1970 self.user_group_name = user_group_name
1970 self.user_group_name = user_group_name
1971 return super(HasUserGroupPermissionAll, self).__call__(
1971 return super(HasUserGroupPermissionAll, self).__call__(
1972 check_location, user)
1972 check_location, user)
1973
1973
1974 def check_permissions(self, user):
1974 def check_permissions(self, user):
1975 perms = user.permissions
1975 perms = user.permissions
1976 try:
1976 try:
1977 user_perms = set([perms['user_groups'][self.user_group_name]])
1977 user_perms = set([perms['user_groups'][self.user_group_name]])
1978 except KeyError:
1978 except KeyError:
1979 return False
1979 return False
1980 if self.required_perms.issubset(user_perms):
1980 if self.required_perms.issubset(user_perms):
1981 return True
1981 return True
1982 return False
1982 return False
1983
1983
1984
1984
1985 # SPECIAL VERSION TO HANDLE MIDDLEWARE AUTH
1985 # SPECIAL VERSION TO HANDLE MIDDLEWARE AUTH
1986 class HasPermissionAnyMiddleware(object):
1986 class HasPermissionAnyMiddleware(object):
1987 def __init__(self, *perms):
1987 def __init__(self, *perms):
1988 self.required_perms = set(perms)
1988 self.required_perms = set(perms)
1989
1989
1990 def __call__(self, user, repo_name):
1990 def __call__(self, user, repo_name):
1991 # repo_name MUST be unicode, since we handle keys in permission
1991 # repo_name MUST be unicode, since we handle keys in permission
1992 # dict by unicode
1992 # dict by unicode
1993 repo_name = safe_unicode(repo_name)
1993 repo_name = safe_unicode(repo_name)
1994 user = AuthUser(user.user_id)
1994 user = AuthUser(user.user_id)
1995 log.debug(
1995 log.debug(
1996 'Checking VCS protocol permissions %s for user:%s repo:`%s`',
1996 'Checking VCS protocol permissions %s for user:%s repo:`%s`',
1997 self.required_perms, user, repo_name)
1997 self.required_perms, user, repo_name)
1998
1998
1999 if self.check_permissions(user, repo_name):
1999 if self.check_permissions(user, repo_name):
2000 log.debug('Permission to repo:`%s` GRANTED for user:%s @ %s',
2000 log.debug('Permission to repo:`%s` GRANTED for user:%s @ %s',
2001 repo_name, user, 'PermissionMiddleware')
2001 repo_name, user, 'PermissionMiddleware')
2002 return True
2002 return True
2003
2003
2004 else:
2004 else:
2005 log.debug('Permission to repo:`%s` DENIED for user:%s @ %s',
2005 log.debug('Permission to repo:`%s` DENIED for user:%s @ %s',
2006 repo_name, user, 'PermissionMiddleware')
2006 repo_name, user, 'PermissionMiddleware')
2007 return False
2007 return False
2008
2008
2009 def check_permissions(self, user, repo_name):
2009 def check_permissions(self, user, repo_name):
2010 perms = user.permissions_with_scope({'repo_name': repo_name})
2010 perms = user.permissions_with_scope({'repo_name': repo_name})
2011
2011
2012 try:
2012 try:
2013 user_perms = set([perms['repositories'][repo_name]])
2013 user_perms = set([perms['repositories'][repo_name]])
2014 except Exception:
2014 except Exception:
2015 log.exception('Error while accessing user permissions')
2015 log.exception('Error while accessing user permissions')
2016 return False
2016 return False
2017
2017
2018 if self.required_perms.intersection(user_perms):
2018 if self.required_perms.intersection(user_perms):
2019 return True
2019 return True
2020 return False
2020 return False
2021
2021
2022
2022
2023 # SPECIAL VERSION TO HANDLE API AUTH
2023 # SPECIAL VERSION TO HANDLE API AUTH
2024 class _BaseApiPerm(object):
2024 class _BaseApiPerm(object):
2025 def __init__(self, *perms):
2025 def __init__(self, *perms):
2026 self.required_perms = set(perms)
2026 self.required_perms = set(perms)
2027
2027
2028 def __call__(self, check_location=None, user=None, repo_name=None,
2028 def __call__(self, check_location=None, user=None, repo_name=None,
2029 group_name=None, user_group_name=None):
2029 group_name=None, user_group_name=None):
2030 cls_name = self.__class__.__name__
2030 cls_name = self.__class__.__name__
2031 check_scope = 'global:%s' % (self.required_perms,)
2031 check_scope = 'global:%s' % (self.required_perms,)
2032 if repo_name:
2032 if repo_name:
2033 check_scope += ', repo_name:%s' % (repo_name,)
2033 check_scope += ', repo_name:%s' % (repo_name,)
2034
2034
2035 if group_name:
2035 if group_name:
2036 check_scope += ', repo_group_name:%s' % (group_name,)
2036 check_scope += ', repo_group_name:%s' % (group_name,)
2037
2037
2038 if user_group_name:
2038 if user_group_name:
2039 check_scope += ', user_group_name:%s' % (user_group_name,)
2039 check_scope += ', user_group_name:%s' % (user_group_name,)
2040
2040
2041 log.debug(
2041 log.debug(
2042 'checking cls:%s %s %s @ %s'
2042 'checking cls:%s %s %s @ %s'
2043 % (cls_name, self.required_perms, check_scope, check_location))
2043 % (cls_name, self.required_perms, check_scope, check_location))
2044 if not user:
2044 if not user:
2045 log.debug('Empty User passed into arguments')
2045 log.debug('Empty User passed into arguments')
2046 return False
2046 return False
2047
2047
2048 # process user
2048 # process user
2049 if not isinstance(user, AuthUser):
2049 if not isinstance(user, AuthUser):
2050 user = AuthUser(user.user_id)
2050 user = AuthUser(user.user_id)
2051 if not check_location:
2051 if not check_location:
2052 check_location = 'unspecified'
2052 check_location = 'unspecified'
2053 if self.check_permissions(user.permissions, repo_name, group_name,
2053 if self.check_permissions(user.permissions, repo_name, group_name,
2054 user_group_name):
2054 user_group_name):
2055 log.debug('Permission to repo:`%s` GRANTED for user:`%s` @ %s',
2055 log.debug('Permission to repo:`%s` GRANTED for user:`%s` @ %s',
2056 check_scope, user, check_location)
2056 check_scope, user, check_location)
2057 return True
2057 return True
2058
2058
2059 else:
2059 else:
2060 log.debug('Permission to repo:`%s` DENIED for user:`%s` @ %s',
2060 log.debug('Permission to repo:`%s` DENIED for user:`%s` @ %s',
2061 check_scope, user, check_location)
2061 check_scope, user, check_location)
2062 return False
2062 return False
2063
2063
2064 def check_permissions(self, perm_defs, repo_name=None, group_name=None,
2064 def check_permissions(self, perm_defs, repo_name=None, group_name=None,
2065 user_group_name=None):
2065 user_group_name=None):
2066 """
2066 """
2067 implement in child class should return True if permissions are ok,
2067 implement in child class should return True if permissions are ok,
2068 False otherwise
2068 False otherwise
2069
2069
2070 :param perm_defs: dict with permission definitions
2070 :param perm_defs: dict with permission definitions
2071 :param repo_name: repo name
2071 :param repo_name: repo name
2072 """
2072 """
2073 raise NotImplementedError()
2073 raise NotImplementedError()
2074
2074
2075
2075
2076 class HasPermissionAllApi(_BaseApiPerm):
2076 class HasPermissionAllApi(_BaseApiPerm):
2077 def check_permissions(self, perm_defs, repo_name=None, group_name=None,
2077 def check_permissions(self, perm_defs, repo_name=None, group_name=None,
2078 user_group_name=None):
2078 user_group_name=None):
2079 if self.required_perms.issubset(perm_defs.get('global')):
2079 if self.required_perms.issubset(perm_defs.get('global')):
2080 return True
2080 return True
2081 return False
2081 return False
2082
2082
2083
2083
2084 class HasPermissionAnyApi(_BaseApiPerm):
2084 class HasPermissionAnyApi(_BaseApiPerm):
2085 def check_permissions(self, perm_defs, repo_name=None, group_name=None,
2085 def check_permissions(self, perm_defs, repo_name=None, group_name=None,
2086 user_group_name=None):
2086 user_group_name=None):
2087 if self.required_perms.intersection(perm_defs.get('global')):
2087 if self.required_perms.intersection(perm_defs.get('global')):
2088 return True
2088 return True
2089 return False
2089 return False
2090
2090
2091
2091
2092 class HasRepoPermissionAllApi(_BaseApiPerm):
2092 class HasRepoPermissionAllApi(_BaseApiPerm):
2093 def check_permissions(self, perm_defs, repo_name=None, group_name=None,
2093 def check_permissions(self, perm_defs, repo_name=None, group_name=None,
2094 user_group_name=None):
2094 user_group_name=None):
2095 try:
2095 try:
2096 _user_perms = set([perm_defs['repositories'][repo_name]])
2096 _user_perms = set([perm_defs['repositories'][repo_name]])
2097 except KeyError:
2097 except KeyError:
2098 log.warning(traceback.format_exc())
2098 log.warning(traceback.format_exc())
2099 return False
2099 return False
2100 if self.required_perms.issubset(_user_perms):
2100 if self.required_perms.issubset(_user_perms):
2101 return True
2101 return True
2102 return False
2102 return False
2103
2103
2104
2104
2105 class HasRepoPermissionAnyApi(_BaseApiPerm):
2105 class HasRepoPermissionAnyApi(_BaseApiPerm):
2106 def check_permissions(self, perm_defs, repo_name=None, group_name=None,
2106 def check_permissions(self, perm_defs, repo_name=None, group_name=None,
2107 user_group_name=None):
2107 user_group_name=None):
2108 try:
2108 try:
2109 _user_perms = set([perm_defs['repositories'][repo_name]])
2109 _user_perms = set([perm_defs['repositories'][repo_name]])
2110 except KeyError:
2110 except KeyError:
2111 log.warning(traceback.format_exc())
2111 log.warning(traceback.format_exc())
2112 return False
2112 return False
2113 if self.required_perms.intersection(_user_perms):
2113 if self.required_perms.intersection(_user_perms):
2114 return True
2114 return True
2115 return False
2115 return False
2116
2116
2117
2117
2118 class HasRepoGroupPermissionAnyApi(_BaseApiPerm):
2118 class HasRepoGroupPermissionAnyApi(_BaseApiPerm):
2119 def check_permissions(self, perm_defs, repo_name=None, group_name=None,
2119 def check_permissions(self, perm_defs, repo_name=None, group_name=None,
2120 user_group_name=None):
2120 user_group_name=None):
2121 try:
2121 try:
2122 _user_perms = set([perm_defs['repositories_groups'][group_name]])
2122 _user_perms = set([perm_defs['repositories_groups'][group_name]])
2123 except KeyError:
2123 except KeyError:
2124 log.warning(traceback.format_exc())
2124 log.warning(traceback.format_exc())
2125 return False
2125 return False
2126 if self.required_perms.intersection(_user_perms):
2126 if self.required_perms.intersection(_user_perms):
2127 return True
2127 return True
2128 return False
2128 return False
2129
2129
2130
2130
2131 class HasRepoGroupPermissionAllApi(_BaseApiPerm):
2131 class HasRepoGroupPermissionAllApi(_BaseApiPerm):
2132 def check_permissions(self, perm_defs, repo_name=None, group_name=None,
2132 def check_permissions(self, perm_defs, repo_name=None, group_name=None,
2133 user_group_name=None):
2133 user_group_name=None):
2134 try:
2134 try:
2135 _user_perms = set([perm_defs['repositories_groups'][group_name]])
2135 _user_perms = set([perm_defs['repositories_groups'][group_name]])
2136 except KeyError:
2136 except KeyError:
2137 log.warning(traceback.format_exc())
2137 log.warning(traceback.format_exc())
2138 return False
2138 return False
2139 if self.required_perms.issubset(_user_perms):
2139 if self.required_perms.issubset(_user_perms):
2140 return True
2140 return True
2141 return False
2141 return False
2142
2142
2143
2143
2144 class HasUserGroupPermissionAnyApi(_BaseApiPerm):
2144 class HasUserGroupPermissionAnyApi(_BaseApiPerm):
2145 def check_permissions(self, perm_defs, repo_name=None, group_name=None,
2145 def check_permissions(self, perm_defs, repo_name=None, group_name=None,
2146 user_group_name=None):
2146 user_group_name=None):
2147 try:
2147 try:
2148 _user_perms = set([perm_defs['user_groups'][user_group_name]])
2148 _user_perms = set([perm_defs['user_groups'][user_group_name]])
2149 except KeyError:
2149 except KeyError:
2150 log.warning(traceback.format_exc())
2150 log.warning(traceback.format_exc())
2151 return False
2151 return False
2152 if self.required_perms.intersection(_user_perms):
2152 if self.required_perms.intersection(_user_perms):
2153 return True
2153 return True
2154 return False
2154 return False
2155
2155
2156
2156
2157 def check_ip_access(source_ip, allowed_ips=None):
2157 def check_ip_access(source_ip, allowed_ips=None):
2158 """
2158 """
2159 Checks if source_ip is a subnet of any of allowed_ips.
2159 Checks if source_ip is a subnet of any of allowed_ips.
2160
2160
2161 :param source_ip:
2161 :param source_ip:
2162 :param allowed_ips: list of allowed ips together with mask
2162 :param allowed_ips: list of allowed ips together with mask
2163 """
2163 """
2164 log.debug('checking if ip:%s is subnet of %s' % (source_ip, allowed_ips))
2164 log.debug('checking if ip:%s is subnet of %s' % (source_ip, allowed_ips))
2165 source_ip_address = ipaddress.ip_address(safe_unicode(source_ip))
2165 source_ip_address = ipaddress.ip_address(safe_unicode(source_ip))
2166 if isinstance(allowed_ips, (tuple, list, set)):
2166 if isinstance(allowed_ips, (tuple, list, set)):
2167 for ip in allowed_ips:
2167 for ip in allowed_ips:
2168 ip = safe_unicode(ip)
2168 ip = safe_unicode(ip)
2169 try:
2169 try:
2170 network_address = ipaddress.ip_network(ip, strict=False)
2170 network_address = ipaddress.ip_network(ip, strict=False)
2171 if source_ip_address in network_address:
2171 if source_ip_address in network_address:
2172 log.debug('IP %s is network %s' %
2172 log.debug('IP %s is network %s' %
2173 (source_ip_address, network_address))
2173 (source_ip_address, network_address))
2174 return True
2174 return True
2175 # for any case we cannot determine the IP, don't crash just
2175 # for any case we cannot determine the IP, don't crash just
2176 # skip it and log as error, we want to say forbidden still when
2176 # skip it and log as error, we want to say forbidden still when
2177 # sending bad IP
2177 # sending bad IP
2178 except Exception:
2178 except Exception:
2179 log.error(traceback.format_exc())
2179 log.error(traceback.format_exc())
2180 continue
2180 continue
2181 return False
2181 return False
2182
2182
2183
2183
2184 def get_cython_compat_decorator(wrapper, func):
2184 def get_cython_compat_decorator(wrapper, func):
2185 """
2185 """
2186 Creates a cython compatible decorator. The previously used
2186 Creates a cython compatible decorator. The previously used
2187 decorator.decorator() function seems to be incompatible with cython.
2187 decorator.decorator() function seems to be incompatible with cython.
2188
2188
2189 :param wrapper: __wrapper method of the decorator class
2189 :param wrapper: __wrapper method of the decorator class
2190 :param func: decorated function
2190 :param func: decorated function
2191 """
2191 """
2192 @wraps(func)
2192 @wraps(func)
2193 def local_wrapper(*args, **kwds):
2193 def local_wrapper(*args, **kwds):
2194 return wrapper(func, *args, **kwds)
2194 return wrapper(func, *args, **kwds)
2195 local_wrapper.__wrapped__ = func
2195 local_wrapper.__wrapped__ = func
2196 return local_wrapper
2196 return local_wrapper
2197
2197
2198
2198
@@ -1,295 +1,295 b''
1 # -*- coding: utf-8 -*-
1 # -*- coding: utf-8 -*-
2
2
3 # Copyright (C) 2015-2018 RhodeCode GmbH
3 # Copyright (C) 2015-2018 RhodeCode GmbH
4 #
4 #
5 # This program is free software: you can redistribute it and/or modify
5 # This program is free software: you can redistribute it and/or modify
6 # it under the terms of the GNU Affero General Public License, version 3
6 # it under the terms of the GNU Affero General Public License, version 3
7 # (only), as published by the Free Software Foundation.
7 # (only), as published by the Free Software Foundation.
8 #
8 #
9 # This program is distributed in the hope that it will be useful,
9 # This program is distributed in the hope that it will be useful,
10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 # GNU General Public License for more details.
12 # GNU General Public License for more details.
13 #
13 #
14 # You should have received a copy of the GNU Affero General Public License
14 # You should have received a copy of the GNU Affero General Public License
15 # along with this program. If not, see <http://www.gnu.org/licenses/>.
15 # along with this program. If not, see <http://www.gnu.org/licenses/>.
16 #
16 #
17 # This program is dual-licensed. If you wish to learn more about the
17 # This program is dual-licensed. If you wish to learn more about the
18 # RhodeCode Enterprise Edition, including its added features, Support services,
18 # RhodeCode Enterprise Edition, including its added features, Support services,
19 # and proprietary license terms, please see https://rhodecode.com/licenses/
19 # and proprietary license terms, please see https://rhodecode.com/licenses/
20 import functools
20 import functools
21
21
22 import beaker
22 import beaker
23 import logging
23 import logging
24 import threading
24 import threading
25
25
26 from beaker.cache import _cache_decorate, cache_regions, region_invalidate
26 from beaker.cache import _cache_decorate, cache_regions, region_invalidate
27 from sqlalchemy.exc import IntegrityError
27 from sqlalchemy.exc import IntegrityError
28
28
29 from rhodecode.lib.utils import safe_str, md5
29 from rhodecode.lib.utils import safe_str, md5
30 from rhodecode.model.db import Session, CacheKey
30 from rhodecode.model.db import Session, CacheKey
31
31
32 log = logging.getLogger(__name__)
32 log = logging.getLogger(__name__)
33
33
34 FILE_TREE = 'cache_file_tree'
34 FILE_TREE = 'cache_file_tree'
35 FILE_TREE_META = 'cache_file_tree_metadata'
35 FILE_TREE_META = 'cache_file_tree_metadata'
36 FILE_SEARCH_TREE_META = 'cache_file_search_metadata'
36 FILE_SEARCH_TREE_META = 'cache_file_search_metadata'
37 SUMMARY_STATS = 'cache_summary_stats'
37 SUMMARY_STATS = 'cache_summary_stats'
38
38
39 # This list of caches gets purged when invalidation happens
39 # This list of caches gets purged when invalidation happens
40 USED_REPO_CACHES = (FILE_TREE, FILE_SEARCH_TREE_META)
40 USED_REPO_CACHES = (FILE_TREE, FILE_SEARCH_TREE_META)
41
41
42 DEFAULT_CACHE_MANAGER_CONFIG = {
42 DEFAULT_CACHE_MANAGER_CONFIG = {
43 'type': 'memorylru_base',
43 'type': 'memorylru_base',
44 'max_items': 10240,
44 'max_items': 10240,
45 'key_length': 256,
45 'key_length': 256,
46 'enabled': True
46 'enabled': True
47 }
47 }
48
48
49
49
50 def get_default_cache_settings(settings):
50 def get_default_cache_settings(settings):
51 cache_settings = {}
51 cache_settings = {}
52 for key in settings.keys():
52 for key in settings.keys():
53 for prefix in ['beaker.cache.', 'cache.']:
53 for prefix in ['beaker.cache.', 'cache.']:
54 if key.startswith(prefix):
54 if key.startswith(prefix):
55 name = key.split(prefix)[1].strip()
55 name = key.split(prefix)[1].strip()
56 cache_settings[name] = settings[key].strip()
56 cache_settings[name] = settings[key].strip()
57 return cache_settings
57 return cache_settings
58
58
59
59
60 # set cache regions for beaker so celery can utilise it
60 # set cache regions for beaker so celery can utilise it
61 def configure_caches(settings, default_region_settings=None):
61 def configure_caches(settings, default_region_settings=None):
62 cache_settings = {'regions': None}
62 cache_settings = {'regions': None}
63 # main cache settings used as default ...
63 # main cache settings used as default ...
64 cache_settings.update(get_default_cache_settings(settings))
64 cache_settings.update(get_default_cache_settings(settings))
65 default_region_settings = default_region_settings or \
65 default_region_settings = default_region_settings or \
66 {'type': DEFAULT_CACHE_MANAGER_CONFIG['type']}
66 {'type': DEFAULT_CACHE_MANAGER_CONFIG['type']}
67 if cache_settings['regions']:
67 if cache_settings['regions']:
68 for region in cache_settings['regions'].split(','):
68 for region in cache_settings['regions'].split(','):
69 region = region.strip()
69 region = region.strip()
70 region_settings = default_region_settings.copy()
70 region_settings = default_region_settings.copy()
71 for key, value in cache_settings.items():
71 for key, value in cache_settings.items():
72 if key.startswith(region):
72 if key.startswith(region):
73 region_settings[key.split(region + '.')[-1]] = value
73 region_settings[key.split(region + '.')[-1]] = value
74 log.debug('Configuring cache region `%s` with settings %s',
74 log.debug('Configuring cache region `%s` with settings %s',
75 region, region_settings)
75 region, region_settings)
76 configure_cache_region(
76 configure_cache_region(
77 region, region_settings, cache_settings)
77 region, region_settings, cache_settings)
78
78
79
79
80 def configure_cache_region(
80 def configure_cache_region(
81 region_name, region_settings, default_cache_kw, default_expire=60):
81 region_name, region_settings, default_cache_kw, default_expire=60):
82 default_type = default_cache_kw.get('type', 'memory')
82 default_type = default_cache_kw.get('type', 'memory')
83 default_lock_dir = default_cache_kw.get('lock_dir')
83 default_lock_dir = default_cache_kw.get('lock_dir')
84 default_data_dir = default_cache_kw.get('data_dir')
84 default_data_dir = default_cache_kw.get('data_dir')
85
85
86 region_settings['lock_dir'] = region_settings.get('lock_dir', default_lock_dir)
86 region_settings['lock_dir'] = region_settings.get('lock_dir', default_lock_dir)
87 region_settings['data_dir'] = region_settings.get('data_dir', default_data_dir)
87 region_settings['data_dir'] = region_settings.get('data_dir', default_data_dir)
88 region_settings['type'] = region_settings.get('type', default_type)
88 region_settings['type'] = region_settings.get('type', default_type)
89 region_settings['expire'] = int(region_settings.get('expire', default_expire))
89 region_settings['expire'] = int(region_settings.get('expire', default_expire))
90
90
91 beaker.cache.cache_regions[region_name] = region_settings
91 beaker.cache.cache_regions[region_name] = region_settings
92
92
93
93
94 def get_cache_manager(region_name, cache_name, custom_ttl=None):
94 def get_cache_manager(region_name, cache_name, custom_ttl=None):
95 """
95 """
96 Creates a Beaker cache manager. Such instance can be used like that::
96 Creates a Beaker cache manager. Such instance can be used like that::
97
97
98 _namespace = caches.get_repo_namespace_key(caches.XXX, repo_name)
98 _namespace = caches.get_repo_namespace_key(caches.XXX, repo_name)
99 cache_manager = caches.get_cache_manager('repo_cache_long', _namespace)
99 cache_manager = caches.get_cache_manager('repo_cache_long', _namespace)
100 _cache_key = caches.compute_key_from_params(repo_name, commit.raw_id)
100 _cache_key = caches.compute_key_from_params(repo_name, commit.raw_id)
101 def heavy_compute():
101 def heavy_compute():
102 ...
102 ...
103 result = cache_manager.get(_cache_key, createfunc=heavy_compute)
103 result = cache_manager.get(_cache_key, createfunc=heavy_compute)
104
104
105 :param region_name: region from ini file
105 :param region_name: region from ini file
106 :param cache_name: custom cache name, usually prefix+repo_name. eg
106 :param cache_name: custom cache name, usually prefix+repo_name. eg
107 file_switcher_repo1
107 file_switcher_repo1
108 :param custom_ttl: override .ini file timeout on this cache
108 :param custom_ttl: override .ini file timeout on this cache
109 :return: instance of cache manager
109 :return: instance of cache manager
110 """
110 """
111
111
112 cache_config = cache_regions.get(region_name, DEFAULT_CACHE_MANAGER_CONFIG)
112 cache_config = cache_regions.get(region_name, DEFAULT_CACHE_MANAGER_CONFIG)
113 if custom_ttl:
113 if custom_ttl:
114 log.debug('Updating region %s with custom ttl: %s',
114 log.debug('Updating region %s with custom ttl: %s',
115 region_name, custom_ttl)
115 region_name, custom_ttl)
116 cache_config.update({'expire': custom_ttl})
116 cache_config.update({'expire': custom_ttl})
117
117
118 return beaker.cache.Cache._get_cache(cache_name, cache_config)
118 return beaker.cache.Cache._get_cache(cache_name, cache_config)
119
119
120
120
121 def clear_cache_manager(cache_manager):
121 def clear_cache_manager(cache_manager):
122 """
122 """
123 namespace = 'foobar'
123 namespace = 'foobar'
124 cache_manager = get_cache_manager('repo_cache_long', namespace)
124 cache_manager = get_cache_manager('repo_cache_long', namespace)
125 clear_cache_manager(cache_manager)
125 clear_cache_manager(cache_manager)
126 """
126 """
127
127
128 log.debug('Clearing all values for cache manager %s', cache_manager)
128 log.debug('Clearing all values for cache manager %s', cache_manager)
129 cache_manager.clear()
129 cache_manager.clear()
130
130
131
131
132 def clear_repo_caches(repo_name):
132 def clear_repo_caches(repo_name):
133 # invalidate cache manager for this repo
133 # invalidate cache manager for this repo
134 for prefix in USED_REPO_CACHES:
134 for prefix in USED_REPO_CACHES:
135 namespace = get_repo_namespace_key(prefix, repo_name)
135 namespace = get_repo_namespace_key(prefix, repo_name)
136 cache_manager = get_cache_manager('repo_cache_long', namespace)
136 cache_manager = get_cache_manager('repo_cache_long', namespace)
137 clear_cache_manager(cache_manager)
137 clear_cache_manager(cache_manager)
138
138
139
139
140 def compute_key_from_params(*args):
140 def compute_key_from_params(*args):
141 """
141 """
142 Helper to compute key from given params to be used in cache manager
142 Helper to compute key from given params to be used in cache manager
143 """
143 """
144 return md5("_".join(map(safe_str, args)))
144 return md5("_".join(map(safe_str, args)))
145
145
146
146
147 def get_repo_namespace_key(prefix, repo_name):
147 def get_repo_namespace_key(prefix, repo_name):
148 return '{0}_{1}'.format(prefix, compute_key_from_params(repo_name))
148 return '{0}_{1}'.format(prefix, compute_key_from_params(repo_name))
149
149
150
150
151 def conditional_cache(region, cache_namespace, condition, func):
151 def conditional_cache(region, cache_namespace, condition, func):
152 """
152 """
153 Conditional caching function use like::
153 Conditional caching function use like::
154 def _c(arg):
154 def _c(arg):
155 # heavy computation function
155 # heavy computation function
156 return data
156 return data
157
157
158 # depending on the condition the compute is wrapped in cache or not
158 # depending on the condition the compute is wrapped in cache or not
159 compute = conditional_cache('short_term', 'cache_desc',
159 compute = conditional_cache('short_term', 'cache_namespace_id',
160 condition=True, func=func)
160 condition=True, func=func)
161 return compute(arg)
161 return compute(arg)
162
162
163 :param region: name of cache region
163 :param region: name of cache region
164 :param cache_namespace: cache namespace
164 :param cache_namespace: cache namespace
165 :param condition: condition for cache to be triggered, and
165 :param condition: condition for cache to be triggered, and
166 return data cached
166 return data cached
167 :param func: wrapped heavy function to compute
167 :param func: wrapped heavy function to compute
168
168
169 """
169 """
170 wrapped = func
170 wrapped = func
171 if condition:
171 if condition:
172 log.debug('conditional_cache: True, wrapping call of '
172 log.debug('conditional_cache: True, wrapping call of '
173 'func: %s into %s region cache', region, func)
173 'func: %s into %s region cache', region, func)
174
174
175 def _cache_wrap(region_name, cache_namespace):
175 def _cache_wrap(region_name, cache_namespace):
176 """Return a caching wrapper"""
176 """Return a caching wrapper"""
177
177
178 def decorate(func):
178 def decorate(func):
179 @functools.wraps(func)
179 @functools.wraps(func)
180 def cached(*args, **kwargs):
180 def cached(*args, **kwargs):
181 if kwargs:
181 if kwargs:
182 raise AttributeError(
182 raise AttributeError(
183 'Usage of kwargs is not allowed. '
183 'Usage of kwargs is not allowed. '
184 'Use only positional arguments in wrapped function')
184 'Use only positional arguments in wrapped function')
185 manager = get_cache_manager(region_name, cache_namespace)
185 manager = get_cache_manager(region_name, cache_namespace)
186 cache_key = compute_key_from_params(*args)
186 cache_key = compute_key_from_params(*args)
187
187
188 def go():
188 def go():
189 return func(*args, **kwargs)
189 return func(*args, **kwargs)
190
190
191 # save org function name
191 # save org function name
192 go.__name__ = '_cached_%s' % (func.__name__,)
192 go.__name__ = '_cached_%s' % (func.__name__,)
193
193
194 return manager.get(cache_key, createfunc=go)
194 return manager.get(cache_key, createfunc=go)
195 return cached
195 return cached
196
196
197 return decorate
197 return decorate
198
198
199 cached_region = _cache_wrap(region, cache_namespace)
199 cached_region = _cache_wrap(region, cache_namespace)
200 wrapped = cached_region(func)
200 wrapped = cached_region(func)
201
201
202 return wrapped
202 return wrapped
203
203
204
204
205 class ActiveRegionCache(object):
205 class ActiveRegionCache(object):
206 def __init__(self, context):
206 def __init__(self, context):
207 self.context = context
207 self.context = context
208
208
209 def invalidate(self, *args, **kwargs):
209 def invalidate(self, *args, **kwargs):
210 return False
210 return False
211
211
212 def compute(self):
212 def compute(self):
213 log.debug('Context cache: getting obj %s from cache', self.context)
213 log.debug('Context cache: getting obj %s from cache', self.context)
214 return self.context.compute_func(self.context.cache_key)
214 return self.context.compute_func(self.context.cache_key)
215
215
216
216
217 class FreshRegionCache(ActiveRegionCache):
217 class FreshRegionCache(ActiveRegionCache):
218 def invalidate(self):
218 def invalidate(self):
219 log.debug('Context cache: invalidating cache for %s', self.context)
219 log.debug('Context cache: invalidating cache for %s', self.context)
220 region_invalidate(
220 region_invalidate(
221 self.context.compute_func, None, self.context.cache_key)
221 self.context.compute_func, None, self.context.cache_key)
222 return True
222 return True
223
223
224
224
225 class InvalidationContext(object):
225 class InvalidationContext(object):
226 def __repr__(self):
226 def __repr__(self):
227 return '<InvalidationContext:{}[{}]>'.format(
227 return '<InvalidationContext:{}[{}]>'.format(
228 safe_str(self.repo_name), safe_str(self.cache_type))
228 safe_str(self.repo_name), safe_str(self.cache_type))
229
229
230 def __init__(self, compute_func, repo_name, cache_type,
230 def __init__(self, compute_func, repo_name, cache_type,
231 raise_exception=False, thread_scoped=False):
231 raise_exception=False, thread_scoped=False):
232 self.compute_func = compute_func
232 self.compute_func = compute_func
233 self.repo_name = repo_name
233 self.repo_name = repo_name
234 self.cache_type = cache_type
234 self.cache_type = cache_type
235 self.cache_key = compute_key_from_params(
235 self.cache_key = compute_key_from_params(
236 repo_name, cache_type)
236 repo_name, cache_type)
237 self.raise_exception = raise_exception
237 self.raise_exception = raise_exception
238
238
239 # Append the thread id to the cache key if this invalidation context
239 # Append the thread id to the cache key if this invalidation context
240 # should be scoped to the current thread.
240 # should be scoped to the current thread.
241 if thread_scoped:
241 if thread_scoped:
242 thread_id = threading.current_thread().ident
242 thread_id = threading.current_thread().ident
243 self.cache_key = '{cache_key}_{thread_id}'.format(
243 self.cache_key = '{cache_key}_{thread_id}'.format(
244 cache_key=self.cache_key, thread_id=thread_id)
244 cache_key=self.cache_key, thread_id=thread_id)
245
245
246 def get_cache_obj(self):
246 def get_cache_obj(self):
247 cache_key = CacheKey.get_cache_key(
247 cache_key = CacheKey.get_cache_key(
248 self.repo_name, self.cache_type)
248 self.repo_name, self.cache_type)
249 cache_obj = CacheKey.get_active_cache(cache_key)
249 cache_obj = CacheKey.get_active_cache(cache_key)
250 if not cache_obj:
250 if not cache_obj:
251 cache_obj = CacheKey(cache_key, self.repo_name)
251 cache_obj = CacheKey(cache_key, self.repo_name)
252 return cache_obj
252 return cache_obj
253
253
254 def __enter__(self):
254 def __enter__(self):
255 """
255 """
256 Test if current object is valid, and return CacheRegion function
256 Test if current object is valid, and return CacheRegion function
257 that does invalidation and calculation
257 that does invalidation and calculation
258 """
258 """
259
259
260 self.cache_obj = self.get_cache_obj()
260 self.cache_obj = self.get_cache_obj()
261 if self.cache_obj.cache_active:
261 if self.cache_obj.cache_active:
262 # means our cache obj is existing and marked as it's
262 # means our cache obj is existing and marked as it's
263 # cache is not outdated, we return BaseInvalidator
263 # cache is not outdated, we return BaseInvalidator
264 self.skip_cache_active_change = True
264 self.skip_cache_active_change = True
265 return ActiveRegionCache(self)
265 return ActiveRegionCache(self)
266
266
267 # the key is either not existing or set to False, we return
267 # the key is either not existing or set to False, we return
268 # the real invalidator which re-computes value. We additionally set
268 # the real invalidator which re-computes value. We additionally set
269 # the flag to actually update the Database objects
269 # the flag to actually update the Database objects
270 self.skip_cache_active_change = False
270 self.skip_cache_active_change = False
271 return FreshRegionCache(self)
271 return FreshRegionCache(self)
272
272
273 def __exit__(self, exc_type, exc_val, exc_tb):
273 def __exit__(self, exc_type, exc_val, exc_tb):
274
274
275 if self.skip_cache_active_change:
275 if self.skip_cache_active_change:
276 return
276 return
277
277
278 try:
278 try:
279 self.cache_obj.cache_active = True
279 self.cache_obj.cache_active = True
280 Session().add(self.cache_obj)
280 Session().add(self.cache_obj)
281 Session().commit()
281 Session().commit()
282 except IntegrityError:
282 except IntegrityError:
283 # if we catch integrity error, it means we inserted this object
283 # if we catch integrity error, it means we inserted this object
284 # assumption is that's really an edge race-condition case and
284 # assumption is that's really an edge race-condition case and
285 # it's safe is to skip it
285 # it's safe is to skip it
286 Session().rollback()
286 Session().rollback()
287 except Exception:
287 except Exception:
288 log.exception('Failed to commit on cache key update')
288 log.exception('Failed to commit on cache key update')
289 Session().rollback()
289 Session().rollback()
290 if self.raise_exception:
290 if self.raise_exception:
291 raise
291 raise
292
292
293
293
294 def includeme(config):
294 def includeme(config):
295 configure_caches(config.registry.settings)
295 configure_caches(config.registry.settings)
General Comments 0
You need to be logged in to leave comments. Login now