users: ported controllers from pylons into pyramid views.

rhodecode/apps/_base/__init__.py

@@ -30,6 +30,7 b' from rhodecode.lib.vcs.exceptions import'
 from rhodecode.model import repo
 from rhodecode.model import repo_group
 from rhodecode.model import user_group
+from rhodecode.model import user
 from rhodecode.model.db import User
 from rhodecode.model.scm import ScmModel
 
@@ -267,6 +268,20 b' class UserGroupAppView(BaseAppView):'
         self.db_user_group_name = self.db_user_group.users_group_name
 
 
+class UserAppView(BaseAppView):
+    def __init__(self, context, request):
+        super(UserAppView, self).__init__(context, request)
+        self.db_user = request.db_user
+        self.db_user_id = self.db_user.user_id
+
+        _ = self.request.translate
+        if not request.db_user_supports_default:
+            if self.db_user.username == User.DEFAULT_USER:
+                h.flash(_("Editing user `{}` is disabled.".format(
+                    User.DEFAULT_USER)), category='warning')
+                raise HTTPFound(h.route_path('users'))
+
+
 class DataGridAppView(object):
     """
     Common class to have re-usable grid rendering components
@@ -483,17 +498,63 b' class UserGroupRoutePredicate(object):'
 
         user_group_id = info['match']['user_group_id']
         user_group_model = user_group.UserGroup()
-        by_name_match = user_group_model.get(
+        by_id_match = user_group_model.get(
             user_group_id, cache=True)
 
-        if by_name_match:
+        if by_id_match:
             # register this as request object we can re-use later
-            request.db_user_group = by_name_match
+            request.db_user_group = by_id_match
             return True
 
         return False
 
 
+class UserRoutePredicateBase(object):
+    supports_default = None
+
+    def __init__(self, val, config):
+        self.val = val
+
+    def text(self):
+        raise NotImplementedError()
+
+    def __call__(self, info, request):
+        if hasattr(request, 'vcs_call'):
+            # skip vcs calls
+            return
+
+        user_id = info['match']['user_id']
+        user_model = user.User()
+        by_id_match = user_model.get(
+            user_id, cache=True)
+
+        if by_id_match:
+            # register this as request object we can re-use later
+            request.db_user = by_id_match
+            request.db_user_supports_default = self.supports_default
+            return True
+
+        return False
+
+
+class UserRoutePredicate(UserRoutePredicateBase):
+    supports_default = False
+
+    def text(self):
+        return 'user_route = %s' % self.val
+
+    phash = text
+
+
+class UserRouteWithDefaultPredicate(UserRoutePredicateBase):
+    supports_default = True
+
+    def text(self):
+        return 'user_with_default_route = %s' % self.val
+
+    phash = text
+
+
 def includeme(config):
     config.add_route_predicate(
         'repo_route', RepoRoutePredicate)
@@ -503,3 +564,7 b' def includeme(config):'
         'repo_group_route', RepoGroupRoutePredicate)
     config.add_route_predicate(
         'user_group_route', UserGroupRoutePredicate)
+    config.add_route_predicate(
+        'user_route_with_default', UserRouteWithDefaultPredicate)
+    config.add_route_predicate(
+        'user_route', UserRoutePredicate)
  No newline at end of file

rhodecode/apps/admin/__init__.py

@@ -137,74 +137,133 b' def admin_routes(config):'
         name='users_data',
         pattern='/users_data')
 
+    config.add_route(
+        name='users_create',
+        pattern='/users/create')
+
+    config.add_route(
+        name='users_new',
+        pattern='/users/new')
+
+    # user management
+    config.add_route(
+        name='user_edit',
+        pattern='/users/{user_id:\d+}/edit',
+        user_route=True)
+    config.add_route(
+        name='user_edit_advanced',
+        pattern='/users/{user_id:\d+}/edit/advanced',
+        user_route=True)
+    config.add_route(
+        name='user_edit_global_perms',
+        pattern='/users/{user_id:\d+}/edit/global_permissions',
+        user_route=True)
+    config.add_route(
+        name='user_edit_global_perms_update',
+        pattern='/users/{user_id:\d+}/edit/global_permissions/update',
+        user_route=True)
+    config.add_route(
+        name='user_update',
+        pattern='/users/{user_id:\d+}/update',
+        user_route=True)
+    config.add_route(
+        name='user_delete',
+        pattern='/users/{user_id:\d+}/delete',
+        user_route=True)
+    config.add_route(
+        name='user_force_password_reset',
+        pattern='/users/{user_id:\d+}/password_reset',
+        user_route=True)
+    config.add_route(
+        name='user_create_personal_repo_group',
+        pattern='/users/{user_id:\d+}/create_repo_group',
+        user_route=True)
+
     # user auth tokens
     config.add_route(
         name='edit_user_auth_tokens',
-        pattern='/users/{user_id:\d+}/edit/auth_tokens')
+        pattern='/users/{user_id:\d+}/edit/auth_tokens',
+        user_route=True)
     config.add_route(
         name='edit_user_auth_tokens_add',
-        pattern='/users/{user_id:\d+}/edit/auth_tokens/new')
+        pattern='/users/{user_id:\d+}/edit/auth_tokens/new',
+        user_route=True)
     config.add_route(
         name='edit_user_auth_tokens_delete',
-        pattern='/users/{user_id:\d+}/edit/auth_tokens/delete')
+        pattern='/users/{user_id:\d+}/edit/auth_tokens/delete',
+        user_route=True)
 
     # user ssh keys
     config.add_route(
         name='edit_user_ssh_keys',
-        pattern='/users/{user_id:\d+}/edit/ssh_keys')
+        pattern='/users/{user_id:\d+}/edit/ssh_keys',
+        user_route=True)
     config.add_route(
         name='edit_user_ssh_keys_generate_keypair',
-        pattern='/users/{user_id:\d+}/edit/ssh_keys/generate')
+        pattern='/users/{user_id:\d+}/edit/ssh_keys/generate',
+        user_route=True)
     config.add_route(
         name='edit_user_ssh_keys_add',
-        pattern='/users/{user_id:\d+}/edit/ssh_keys/new')
+        pattern='/users/{user_id:\d+}/edit/ssh_keys/new',
+        user_route=True)
     config.add_route(
         name='edit_user_ssh_keys_delete',
-        pattern='/users/{user_id:\d+}/edit/ssh_keys/delete')
+        pattern='/users/{user_id:\d+}/edit/ssh_keys/delete',
+        user_route=True)
 
     # user emails
     config.add_route(
         name='edit_user_emails',
-        pattern='/users/{user_id:\d+}/edit/emails')
+        pattern='/users/{user_id:\d+}/edit/emails',
+        user_route=True)
     config.add_route(
         name='edit_user_emails_add',
-        pattern='/users/{user_id:\d+}/edit/emails/new')
+        pattern='/users/{user_id:\d+}/edit/emails/new',
+        user_route=True)
     config.add_route(
         name='edit_user_emails_delete',
-        pattern='/users/{user_id:\d+}/edit/emails/delete')
+        pattern='/users/{user_id:\d+}/edit/emails/delete',
+        user_route=True)
 
     # user IPs
     config.add_route(
         name='edit_user_ips',
-        pattern='/users/{user_id:\d+}/edit/ips')
+        pattern='/users/{user_id:\d+}/edit/ips',
+        user_route=True)
     config.add_route(
         name='edit_user_ips_add',
-        pattern='/users/{user_id:\d+}/edit/ips/new')
+        pattern='/users/{user_id:\d+}/edit/ips/new',
+        user_route_with_default=True)  # enabled for default user too
     config.add_route(
         name='edit_user_ips_delete',
-        pattern='/users/{user_id:\d+}/edit/ips/delete')
+        pattern='/users/{user_id:\d+}/edit/ips/delete',
+        user_route_with_default=True) # enabled for default user too
 
     # user perms
     config.add_route(
         name='edit_user_perms_summary',
-        pattern='/users/{user_id:\d+}/edit/permissions_summary')
+        pattern='/users/{user_id:\d+}/edit/permissions_summary',
+        user_route=True)
     config.add_route(
         name='edit_user_perms_summary_json',
-        pattern='/users/{user_id:\d+}/edit/permissions_summary/json')
+        pattern='/users/{user_id:\d+}/edit/permissions_summary/json',
+        user_route=True)
 
     # user user groups management
     config.add_route(
         name='edit_user_groups_management',
-        pattern='/users/{user_id:\d+}/edit/groups_management')
+        pattern='/users/{user_id:\d+}/edit/groups_management',
+        user_route=True)
 
     config.add_route(
         name='edit_user_groups_management_updates',
-        pattern='/users/{user_id:\d+}/edit/edit_user_groups_management/updates')
+        pattern='/users/{user_id:\d+}/edit/edit_user_groups_management/updates',
+        user_route=True)
 
     # user audit logs
     config.add_route(
         name='edit_user_audit_logs',
-        pattern='/users/{user_id:\d+}/edit/audit')
+        pattern='/users/{user_id:\d+}/edit/audit', user_route=True)
 
     # user-groups admin
     config.add_route(

rhodecode/apps/admin/tests/test_admin_users.py

@@ -19,8 +19,12 b''
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import pytest
+from sqlalchemy.orm.exc import NoResultFound
 
-from rhodecode.model.db import User, UserApiKeys, UserEmailMap
+from rhodecode.lib import auth
+from rhodecode.lib import helpers as h
+from rhodecode.model import validators
+from rhodecode.model.db import User, UserApiKeys, UserEmailMap, Repository
 from rhodecode.model.meta import Session
 from rhodecode.model.user import UserModel
 
@@ -40,6 +44,27 b' def route_path(name, params=None, **kwar'
             ADMIN_PREFIX + '/users',
         'users_data':
             ADMIN_PREFIX + '/users_data',
+        'users_create':
+            ADMIN_PREFIX + '/users/create',
+        'users_new':
+            ADMIN_PREFIX + '/users/new',
+        'user_edit':
+            ADMIN_PREFIX + '/users/{user_id}/edit',
+        'user_edit_advanced':
+            ADMIN_PREFIX + '/users/{user_id}/edit/advanced',
+        'user_edit_global_perms':
+            ADMIN_PREFIX + '/users/{user_id}/edit/global_permissions',
+        'user_edit_global_perms_update':
+            ADMIN_PREFIX + '/users/{user_id}/edit/global_permissions/update',
+        'user_update':
+            ADMIN_PREFIX + '/users/{user_id}/update',
+        'user_delete':
+            ADMIN_PREFIX + '/users/{user_id}/delete',
+        'user_force_password_reset':
+            ADMIN_PREFIX + '/users/{user_id}/password_reset',
+        'user_create_personal_repo_group':
+            ADMIN_PREFIX + '/users/{user_id}/create_repo_group',
+
         'edit_user_auth_tokens':
             ADMIN_PREFIX + '/users/{user_id}/edit/auth_tokens',
         'edit_user_auth_tokens_add':
@@ -60,6 +85,15 b' def route_path(name, params=None, **kwar'
             ADMIN_PREFIX + '/users/{user_id}/edit/ips/new',
         'edit_user_ips_delete':
             ADMIN_PREFIX + '/users/{user_id}/edit/ips/delete',
+
+        'edit_user_perms_summary':
+            ADMIN_PREFIX + '/users/{user_id}/edit/permissions_summary',
+        'edit_user_perms_summary_json':
+            ADMIN_PREFIX + '/users/{user_id}/edit/permissions_summary/json',
+
+        'edit_user_audit_logs':
+            ADMIN_PREFIX + '/users/{user_id}/edit/audit',
+
     }[name].format(**kwargs)
 
     if params:
@@ -220,7 +254,8 b' class TestAdminUsersView(TestController)'
     def test_emails(self):
         self.log_user()
         user = User.get_by_username(TEST_USER_REGULAR_LOGIN)
-        response = self.app.get(route_path('edit_user_emails', user_id=user.user_id))
+        response = self.app.get(
+            route_path('edit_user_emails', user_id=user.user_id))
         response.mustcontain('No additional emails specified')
 
     def test_emails_add(self, user_util):
@@ -233,7 +268,8 b' class TestAdminUsersView(TestController)'
             params={'new_email': '[e-mail]',
                     'csrf_token': self.csrf_token})
 
-        response = self.app.get(route_path('edit_user_emails', user_id=user_id))
+        response = self.app.get(
+            route_path('edit_user_emails', user_id=user_id))
         response.mustcontain('[e-mail]')
 
     def test_emails_add_existing_email(self, user_util, user_regular):
@@ -250,7 +286,8 b' class TestAdminUsersView(TestController)'
         assert_session_flash(
             response, 'This e-mail address is already taken')
 
-        response = self.app.get(route_path('edit_user_emails', user_id=user_id))
+        response = self.app.get(
+            route_path('edit_user_emails', user_id=user_id))
         response.mustcontain(no=[existing_email])
 
     def test_emails_delete(self, user_util):
@@ -263,7 +300,8 b' class TestAdminUsersView(TestController)'
             params={'new_email': '[e-mail]',
                     'csrf_token': self.csrf_token})
 
-        response = self.app.get(route_path('edit_user_emails', user_id=user_id))
+        response = self.app.get(
+            route_path('edit_user_emails', user_id=user_id))
         response.mustcontain('[e-mail]')
 
         user_email = UserEmailMap.query()\
@@ -277,5 +315,469 b' class TestAdminUsersView(TestController)'
             params={'del_email_id': del_email_id,
                     'csrf_token': self.csrf_token})
 
-        response = self.app.get(route_path('edit_user_emails', user_id=user_id))
-        response.mustcontain(no=['[e-mail]'])
  No newline at end of file
+        response = self.app.get(
+            route_path('edit_user_emails', user_id=user_id))
+        response.mustcontain(no=['[e-mail]'])
+
+
+    def test_create(self, request, xhr_header):
+        self.log_user()
+        username = 'newtestuser'
+        password = 'test12'
+        password_confirmation = password
+        name = 'name'
+        lastname = 'lastname'
+        email = '[e-mail]'
+
+        self.app.get(route_path('users_new'))
+
+        response = self.app.post(route_path('users_create'), params={
+            'username': username,
+            'password': password,
+            'password_confirmation': password_confirmation,
+            'firstname': name,
+            'active': True,
+            'lastname': lastname,
+            'extern_name': 'rhodecode',
+            'extern_type': 'rhodecode',
+            'email': email,
+            'csrf_token': self.csrf_token,
+        })
+        user_link = h.link_to(
+            username,
+            route_path(
+                'user_edit', user_id=User.get_by_username(username).user_id))
+        assert_session_flash(response, 'Created user %s' % (user_link,))
+
+        @request.addfinalizer
+        def cleanup():
+            fixture.destroy_user(username)
+            Session().commit()
+
+        new_user = User.query().filter(User.username == username).one()
+
+        assert new_user.username == username
+        assert auth.check_password(password, new_user.password)
+        assert new_user.name == name
+        assert new_user.lastname == lastname
+        assert new_user.email == email
+
+        response = self.app.get(route_path('users_data'),
+                                extra_environ=xhr_header)
+        response.mustcontain(username)
+
+    def test_create_err(self):
+        self.log_user()
+        username = 'new_user'
+        password = ''
+        name = 'name'
+        lastname = 'lastname'
+        email = 'errmail.com'
+
+        self.app.get(route_path('users_new'))
+
+        response = self.app.post(route_path('users_create'), params={
+            'username': username,
+            'password': password,
+            'name': name,
+            'active': False,
+            'lastname': lastname,
+            'email': email,
+            'csrf_token': self.csrf_token,
+        })
+
+        msg = validators.ValidUsername(
+            False, {})._messages['system_invalid_username']
+        msg = h.html_escape(msg % {'username': 'new_user'})
+        response.mustcontain('<span class="error-message">%s</span>' % msg)
+        response.mustcontain(
+            '<span class="error-message">Please enter a value</span>')
+        response.mustcontain(
+            '<span class="error-message">An email address must contain a'
+            ' single @</span>')
+
+        def get_user():
+            Session().query(User).filter(User.username == username).one()
+
+        with pytest.raises(NoResultFound):
+            get_user()
+
+    def test_new(self):
+        self.log_user()
+        self.app.get(route_path('users_new'))
+
+    @pytest.mark.parametrize("name, attrs", [
+        ('firstname', {'firstname': 'new_username'}),
+        ('lastname', {'lastname': 'new_username'}),
+        ('admin', {'admin': True}),
+        ('admin', {'admin': False}),
+        ('extern_type', {'extern_type': 'ldap'}),
+        ('extern_type', {'extern_type': None}),
+        ('extern_name', {'extern_name': 'test'}),
+        ('extern_name', {'extern_name': None}),
+        ('active', {'active': False}),
+        ('active', {'active': True}),
+        ('email', {'email': '[e-mail]'}),
+        ('language', {'language': 'de'}),
+        ('language', {'language': 'en'}),
+        # ('new_password', {'new_password': 'foobar123',
+        #                   'password_confirmation': 'foobar123'})
+        ])
+    def test_update(self, name, attrs, user_util):
+        self.log_user()
+        usr = user_util.create_user(
+            password='qweqwe',
+            email='[e-mail]',
+            extern_type='rhodecode',
+            extern_name='xxx',
+        )
+        user_id = usr.user_id
+        Session().commit()
+
+        params = usr.get_api_data()
+        cur_lang = params['language'] or 'en'
+        params.update({
+            'password_confirmation': '',
+            'new_password': '',
+            'language': cur_lang,
+            'csrf_token': self.csrf_token,
+        })
+        params.update({'new_password': ''})
+        params.update(attrs)
+        if name == 'email':
+            params['emails'] = [attrs['email']]
+        elif name == 'extern_type':
+            # cannot update this via form, expected value is original one
+            params['extern_type'] = "rhodecode"
+        elif name == 'extern_name':
+            # cannot update this via form, expected value is original one
+            params['extern_name'] = 'xxx'
+            # special case since this user is not
+            # logged in yet his data is not filled
+            # so we use creation data
+
+        response = self.app.post(
+            route_path('user_update', user_id=usr.user_id), params)
+        assert response.status_int == 302
+        assert_session_flash(response, 'User updated successfully')
+
+        updated_user = User.get(user_id)
+        updated_params = updated_user.get_api_data()
+        updated_params.update({'password_confirmation': ''})
+        updated_params.update({'new_password': ''})
+
+        del params['csrf_token']
+        assert params == updated_params
+
+    def test_update_and_migrate_password(
+            self, autologin_user, real_crypto_backend, user_util):
+
+        user = user_util.create_user()
+        temp_user = user.username
+        user.password = auth._RhodeCodeCryptoSha256().hash_create(
+            b'test123')
+        Session().add(user)
+        Session().commit()
+
+        params = user.get_api_data()
+
+        params.update({
+            'password_confirmation': 'qweqwe123',
+            'new_password': 'qweqwe123',
+            'language': 'en',
+            'csrf_token': autologin_user.csrf_token,
+        })
+
+        response = self.app.post(
+            route_path('user_update', user_id=user.user_id), params)
+        assert response.status_int == 302
+        assert_session_flash(response, 'User updated successfully')
+
+        # new password should be bcrypted, after log-in and transfer
+        user = User.get_by_username(temp_user)
+        assert user.password.startswith('$')
+
+        updated_user = User.get_by_username(temp_user)
+        updated_params = updated_user.get_api_data()
+        updated_params.update({'password_confirmation': 'qweqwe123'})
+        updated_params.update({'new_password': 'qweqwe123'})
+
+        del params['csrf_token']
+        assert params == updated_params
+
+    def test_delete(self):
+        self.log_user()
+        username = 'newtestuserdeleteme'
+
+        fixture.create_user(name=username)
+
+        new_user = Session().query(User)\
+            .filter(User.username == username).one()
+        response = self.app.post(
+            route_path('user_delete', user_id=new_user.user_id),
+            params={'csrf_token': self.csrf_token})
+
+        assert_session_flash(response, 'Successfully deleted user')
+
+    def test_delete_owner_of_repository(self, request, user_util):
+        self.log_user()
+        obj_name = 'test_repo'
+        usr = user_util.create_user()
+        username = usr.username
+        fixture.create_repo(obj_name, cur_user=usr.username)
+
+        new_user = Session().query(User)\
+            .filter(User.username == username).one()
+        response = self.app.post(
+            route_path('user_delete', user_id=new_user.user_id),
+            params={'csrf_token': self.csrf_token})
+
+        msg = 'user "%s" still owns 1 repositories and cannot be removed. ' \
+              'Switch owners or remove those repositories:%s' % (username,
+                                                                 obj_name)
+        assert_session_flash(response, msg)
+        fixture.destroy_repo(obj_name)
+
+    def test_delete_owner_of_repository_detaching(self, request, user_util):
+        self.log_user()
+        obj_name = 'test_repo'
+        usr = user_util.create_user(auto_cleanup=False)
+        username = usr.username
+        fixture.create_repo(obj_name, cur_user=usr.username)
+
+        new_user = Session().query(User)\
+            .filter(User.username == username).one()
+        response = self.app.post(
+            route_path('user_delete', user_id=new_user.user_id),
+            params={'user_repos': 'detach', 'csrf_token': self.csrf_token})
+
+        msg = 'Detached 1 repositories'
+        assert_session_flash(response, msg)
+        fixture.destroy_repo(obj_name)
+
+    def test_delete_owner_of_repository_deleting(self, request, user_util):
+        self.log_user()
+        obj_name = 'test_repo'
+        usr = user_util.create_user(auto_cleanup=False)
+        username = usr.username
+        fixture.create_repo(obj_name, cur_user=usr.username)
+
+        new_user = Session().query(User)\
+            .filter(User.username == username).one()
+        response = self.app.post(
+            route_path('user_delete', user_id=new_user.user_id),
+            params={'user_repos': 'delete', 'csrf_token': self.csrf_token})
+
+        msg = 'Deleted 1 repositories'
+        assert_session_flash(response, msg)
+
+    def test_delete_owner_of_repository_group(self, request, user_util):
+        self.log_user()
+        obj_name = 'test_group'
+        usr = user_util.create_user()
+        username = usr.username
+        fixture.create_repo_group(obj_name, cur_user=usr.username)
+
+        new_user = Session().query(User)\
+            .filter(User.username == username).one()
+        response = self.app.post(
+            route_path('user_delete', user_id=new_user.user_id),
+            params={'csrf_token': self.csrf_token})
+
+        msg = 'user "%s" still owns 1 repository groups and cannot be removed. ' \
+              'Switch owners or remove those repository groups:%s' % (username,
+                                                                      obj_name)
+        assert_session_flash(response, msg)
+        fixture.destroy_repo_group(obj_name)
+
+    def test_delete_owner_of_repository_group_detaching(self, request, user_util):
+        self.log_user()
+        obj_name = 'test_group'
+        usr = user_util.create_user(auto_cleanup=False)
+        username = usr.username
+        fixture.create_repo_group(obj_name, cur_user=usr.username)
+
+        new_user = Session().query(User)\
+            .filter(User.username == username).one()
+        response = self.app.post(
+            route_path('user_delete', user_id=new_user.user_id),
+            params={'user_repo_groups': 'delete', 'csrf_token': self.csrf_token})
+
+        msg = 'Deleted 1 repository groups'
+        assert_session_flash(response, msg)
+
+    def test_delete_owner_of_repository_group_deleting(self, request, user_util):
+        self.log_user()
+        obj_name = 'test_group'
+        usr = user_util.create_user(auto_cleanup=False)
+        username = usr.username
+        fixture.create_repo_group(obj_name, cur_user=usr.username)
+
+        new_user = Session().query(User)\
+            .filter(User.username == username).one()
+        response = self.app.post(
+            route_path('user_delete', user_id=new_user.user_id),
+            params={'user_repo_groups': 'detach', 'csrf_token': self.csrf_token})
+
+        msg = 'Detached 1 repository groups'
+        assert_session_flash(response, msg)
+        fixture.destroy_repo_group(obj_name)
+
+    def test_delete_owner_of_user_group(self, request, user_util):
+        self.log_user()
+        obj_name = 'test_user_group'
+        usr = user_util.create_user()
+        username = usr.username
+        fixture.create_user_group(obj_name, cur_user=usr.username)
+
+        new_user = Session().query(User)\
+            .filter(User.username == username).one()
+        response = self.app.post(
+            route_path('user_delete', user_id=new_user.user_id),
+            params={'csrf_token': self.csrf_token})
+
+        msg = 'user "%s" still owns 1 user groups and cannot be removed. ' \
+              'Switch owners or remove those user groups:%s' % (username,
+                                                                obj_name)
+        assert_session_flash(response, msg)
+        fixture.destroy_user_group(obj_name)
+
+    def test_delete_owner_of_user_group_detaching(self, request, user_util):
+        self.log_user()
+        obj_name = 'test_user_group'
+        usr = user_util.create_user(auto_cleanup=False)
+        username = usr.username
+        fixture.create_user_group(obj_name, cur_user=usr.username)
+
+        new_user = Session().query(User)\
+            .filter(User.username == username).one()
+        try:
+            response = self.app.post(
+                route_path('user_delete', user_id=new_user.user_id),
+                params={'user_user_groups': 'detach',
+                        'csrf_token': self.csrf_token})
+
+            msg = 'Detached 1 user groups'
+            assert_session_flash(response, msg)
+        finally:
+            fixture.destroy_user_group(obj_name)
+
+    def test_delete_owner_of_user_group_deleting(self, request, user_util):
+        self.log_user()
+        obj_name = 'test_user_group'
+        usr = user_util.create_user(auto_cleanup=False)
+        username = usr.username
+        fixture.create_user_group(obj_name, cur_user=usr.username)
+
+        new_user = Session().query(User)\
+            .filter(User.username == username).one()
+        response = self.app.post(
+            route_path('user_delete', user_id=new_user.user_id),
+            params={'user_user_groups': 'delete', 'csrf_token': self.csrf_token})
+
+        msg = 'Deleted 1 user groups'
+        assert_session_flash(response, msg)
+
+    def test_edit(self, user_util):
+        self.log_user()
+        user = user_util.create_user()
+        self.app.get(route_path('user_edit', user_id=user.user_id))
+
+    def test_edit_default_user_redirect(self):
+        self.log_user()
+        user = User.get_default_user()
+        self.app.get(route_path('user_edit', user_id=user.user_id), status=302)
+
+    @pytest.mark.parametrize(
+        'repo_create, repo_create_write, user_group_create, repo_group_create,'
+        'fork_create, inherit_default_permissions, expect_error,'
+        'expect_form_error', [
+            ('hg.create.none', 'hg.create.write_on_repogroup.false',
+             'hg.usergroup.create.false', 'hg.repogroup.create.false',
+             'hg.fork.none', 'hg.inherit_default_perms.false', False, False),
+            ('hg.create.repository', 'hg.create.write_on_repogroup.false',
+             'hg.usergroup.create.false', 'hg.repogroup.create.false',
+             'hg.fork.none', 'hg.inherit_default_perms.false', False, False),
+            ('hg.create.repository', 'hg.create.write_on_repogroup.true',
+             'hg.usergroup.create.true', 'hg.repogroup.create.true',
+             'hg.fork.repository', 'hg.inherit_default_perms.false', False,
+             False),
+            ('hg.create.XXX', 'hg.create.write_on_repogroup.true',
+             'hg.usergroup.create.true', 'hg.repogroup.create.true',
+             'hg.fork.repository', 'hg.inherit_default_perms.false', False,
+             True),
+            ('', '', '', '', '', '', True, False),
+        ])
+    def test_global_perms_on_user(
+            self, repo_create, repo_create_write, user_group_create,
+            repo_group_create, fork_create, expect_error, expect_form_error,
+            inherit_default_permissions, user_util):
+        self.log_user()
+        user = user_util.create_user()
+        uid = user.user_id
+
+        # ENABLE REPO CREATE ON A GROUP
+        perm_params = {
+            'inherit_default_permissions': False,
+            'default_repo_create': repo_create,
+            'default_repo_create_on_write': repo_create_write,
+            'default_user_group_create': user_group_create,
+            'default_repo_group_create': repo_group_create,
+            'default_fork_create': fork_create,
+            'default_inherit_default_permissions': inherit_default_permissions,
+            'csrf_token': self.csrf_token,
+        }
+        response = self.app.post(
+            route_path('user_edit_global_perms_update', user_id=uid),
+            params=perm_params)
+
+        if expect_form_error:
+            assert response.status_int == 200
+            response.mustcontain('Value must be one of')
+        else:
+            if expect_error:
+                msg = 'An error occurred during permissions saving'
+            else:
+                msg = 'User global permissions updated successfully'
+                ug = User.get(uid)
+                del perm_params['inherit_default_permissions']
+                del perm_params['csrf_token']
+                assert perm_params == ug.get_default_perms()
+            assert_session_flash(response, msg)
+
+    def test_global_permissions_initial_values(self, user_util):
+        self.log_user()
+        user = user_util.create_user()
+        uid = user.user_id
+        response = self.app.get(
+            route_path('user_edit_global_perms', user_id=uid))
+        default_user = User.get_default_user()
+        default_permissions = default_user.get_default_perms()
+        assert_response = response.assert_response()
+        expected_permissions = (
+            'default_repo_create', 'default_repo_create_on_write',
+            'default_fork_create', 'default_repo_group_create',
+            'default_user_group_create', 'default_inherit_default_permissions')
+        for permission in expected_permissions:
+            css_selector = '[name={}][checked=checked]'.format(permission)
+            element = assert_response.get_element(css_selector)
+            assert element.value == default_permissions[permission]
+
+    def test_perms_summary_page(self):
+        user = self.log_user()
+        response = self.app.get(
+            route_path('edit_user_perms_summary', user_id=user['user_id']))
+        for repo in Repository.query().all():
+            response.mustcontain(repo.repo_name)
+
+    def test_perms_summary_page_json(self):
+        user = self.log_user()
+        response = self.app.get(
+            route_path('edit_user_perms_summary_json', user_id=user['user_id']))
+        for repo in Repository.query().all():
+            response.mustcontain(repo.repo_name)
+
+    def test_audit_log_page(self):
+        user = self.log_user()
+        self.app.get(
+            route_path('edit_user_audit_logs', user_id=user['user_id']))

rhodecode/apps/admin/views/users.py

@@ -18,7 +18,6 b''
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
-import time
 import logging
 import datetime
 import formencode
@@ -26,51 +25,46 b' import formencode.htmlfill'
 
 from pyramid.httpexceptions import HTTPFound
 from pyramid.view import view_config
-from sqlalchemy.sql.functions import coalesce
-from sqlalchemy.exc import IntegrityError
+from pyramid.renderers import render
+from pyramid.response import Response
 
-from rhodecode.apps._base import BaseAppView, DataGridAppView
+from rhodecode.apps._base import BaseAppView, DataGridAppView, UserAppView
 from rhodecode.apps.ssh_support import SshKeyFileChangeEvent
+from rhodecode.authentication.plugins import auth_rhodecode
 from rhodecode.events import trigger
 
 from rhodecode.lib import audit_logger
+from rhodecode.lib.exceptions import (
+    UserCreationError, UserOwnsReposException, UserOwnsRepoGroupsException,
+    UserOwnsUserGroupsException, DefaultUserException)
 from rhodecode.lib.ext_json import json
 from rhodecode.lib.auth import (
     LoginRequired, HasPermissionAllDecorator, CSRFRequired)
 from rhodecode.lib import helpers as h
-from rhodecode.lib.utils2 import safe_int, safe_unicode
+from rhodecode.lib.utils2 import safe_int, safe_unicode, AttributeDict
 from rhodecode.model.auth_token import AuthTokenModel
+from rhodecode.model.forms import (
+    UserForm, UserIndividualPermissionsForm, UserPermissionsForm)
+from rhodecode.model.permission import PermissionModel
+from rhodecode.model.repo_group import RepoGroupModel
 from rhodecode.model.ssh_key import SshKeyModel
 from rhodecode.model.user import UserModel
 from rhodecode.model.user_group import UserGroupModel
 from rhodecode.model.db import (
-    or_, User, UserIpMap, UserEmailMap, UserApiKeys, UserSshKeys)
+    or_, coalesce,IntegrityError, User, UserGroup, UserIpMap, UserEmailMap,
+    UserApiKeys, UserSshKeys, RepoGroup)
 from rhodecode.model.meta import Session
 
 log = logging.getLogger(__name__)
 
 
 class AdminUsersView(BaseAppView, DataGridAppView):
-    ALLOW_SCOPED_TOKENS = False
-    """
-    This view has alternative version inside EE, if modified please take a look
-    in there as well.
-    """
 
     def load_default_context(self):
         c = self._get_local_tmpl_context()
-        c.allow_scoped_tokens = self.ALLOW_SCOPED_TOKENS
         self._register_global_c(c)
         return c
 
-    def _redirect_for_default_user(self, username):
-        _ = self.request.translate
-        if username == User.DEFAULT_USER:
-            h.flash(_("You can't edit this user"), category='warning')
-            # TODO(marcink): redirect to 'users' admin panel once this
-            # is a pyramid view
-            raise HTTPFound('/')
-
     @LoginRequired()
     @HasPermissionAllDecorator('hg.admin')
     @view_config(
@@ -163,6 +157,529 b' class AdminUsersView(BaseAppView, DataGr'
 
         return data
 
+    def _set_personal_repo_group_template_vars(self, c_obj):
+        DummyUser = AttributeDict({
+            'username': '${username}',
+            'user_id': '${user_id}',
+        })
+        c_obj.default_create_repo_group = RepoGroupModel() \
+            .get_default_create_personal_repo_group()
+        c_obj.personal_repo_group_name = RepoGroupModel() \
+            .get_personal_group_name(DummyUser)
+
+    @LoginRequired()
+    @HasPermissionAllDecorator('hg.admin')
+    @view_config(
+        route_name='users_new', request_method='GET',
+        renderer='rhodecode:templates/admin/users/user_add.mako')
+    def users_new(self):
+        _ = self.request.translate
+        c = self.load_default_context()
+        c.default_extern_type = auth_rhodecode.RhodeCodeAuthPlugin.name
+        self._set_personal_repo_group_template_vars(c)
+        return self._get_template_context(c)
+
+    @LoginRequired()
+    @HasPermissionAllDecorator('hg.admin')
+    @CSRFRequired()
+    @view_config(
+        route_name='users_create', request_method='POST',
+        renderer='rhodecode:templates/admin/users/user_add.mako')
+    def users_create(self):
+        _ = self.request.translate
+        c = self.load_default_context()
+        c.default_extern_type = auth_rhodecode.RhodeCodeAuthPlugin.name
+        user_model = UserModel()
+        user_form = UserForm()()
+        try:
+            form_result = user_form.to_python(dict(self.request.POST))
+            user = user_model.create(form_result)
+            Session().flush()
+            creation_data = user.get_api_data()
+            username = form_result['username']
+
+            audit_logger.store_web(
+                'user.create', action_data={'data': creation_data},
+                user=c.rhodecode_user)
+
+            user_link = h.link_to(
+                h.escape(username),
+                h.route_path('user_edit', user_id=user.user_id))
+            h.flash(h.literal(_('Created user %(user_link)s')
+                              % {'user_link': user_link}), category='success')
+            Session().commit()
+        except formencode.Invalid as errors:
+            self._set_personal_repo_group_template_vars(c)
+            data = render(
+                'rhodecode:templates/admin/users/user_add.mako',
+                self._get_template_context(c), self.request)
+            html = formencode.htmlfill.render(
+                data,
+                defaults=errors.value,
+                errors=errors.error_dict or {},
+                prefix_error=False,
+                encoding="UTF-8",
+                force_defaults=False
+            )
+            return Response(html)
+        except UserCreationError as e:
+            h.flash(e, 'error')
+        except Exception:
+            log.exception("Exception creation of user")
+            h.flash(_('Error occurred during creation of user %s')
+                    % self.request.POST.get('username'), category='error')
+        raise HTTPFound(h.route_path('users'))
+
+
+class UsersView(UserAppView):
+    ALLOW_SCOPED_TOKENS = False
+    """
+    This view has alternative version inside EE, if modified please take a look
+    in there as well.
+    """
+
+    def load_default_context(self):
+        c = self._get_local_tmpl_context()
+        c.allow_scoped_tokens = self.ALLOW_SCOPED_TOKENS
+        c.allowed_languages = [
+            ('en', 'English (en)'),
+            ('de', 'German (de)'),
+            ('fr', 'French (fr)'),
+            ('it', 'Italian (it)'),
+            ('ja', 'Japanese (ja)'),
+            ('pl', 'Polish (pl)'),
+            ('pt', 'Portuguese (pt)'),
+            ('ru', 'Russian (ru)'),
+            ('zh', 'Chinese (zh)'),
+        ]
+        req = self.request
+
+        c.available_permissions = req.registry.settings['available_permissions']
+        PermissionModel().set_global_permission_choices(
+            c, gettext_translator=req.translate)
+
+        self._register_global_c(c)
+        return c
+
+    @LoginRequired()
+    @HasPermissionAllDecorator('hg.admin')
+    @CSRFRequired()
+    @view_config(
+        route_name='user_update', request_method='POST',
+        renderer='rhodecode:templates/admin/users/user_edit.mako')
+    def user_update(self):
+        _ = self.request.translate
+        c = self.load_default_context()
+
+        user_id = self.db_user_id
+        c.user = self.db_user
+
+        c.active = 'profile'
+        c.extern_type = c.user.extern_type
+        c.extern_name = c.user.extern_name
+        c.perm_user = c.user.AuthUser(ip_addr=self.request.remote_addr)
+        available_languages = [x[0] for x in c.allowed_languages]
+        _form = UserForm(edit=True, available_languages=available_languages,
+                         old_data={'user_id': user_id,
+                                   'email': c.user.email})()
+        form_result = {}
+        old_values = c.user.get_api_data()
+        try:
+            form_result = _form.to_python(dict(self.request.POST))
+            skip_attrs = ['extern_type', 'extern_name']
+            # TODO: plugin should define if username can be updated
+            if c.extern_type != "rhodecode":
+                # forbid updating username for external accounts
+                skip_attrs.append('username')
+
+            UserModel().update_user(
+                user_id, skip_attrs=skip_attrs, **form_result)
+
+            audit_logger.store_web(
+                'user.edit', action_data={'old_data': old_values},
+                user=c.rhodecode_user)
+
+            Session().commit()
+            h.flash(_('User updated successfully'), category='success')
+        except formencode.Invalid as errors:
+            data = render(
+                'rhodecode:templates/admin/users/user_edit.mako',
+                self._get_template_context(c), self.request)
+            html = formencode.htmlfill.render(
+                data,
+                defaults=errors.value,
+                errors=errors.error_dict or {},
+                prefix_error=False,
+                encoding="UTF-8",
+                force_defaults=False
+            )
+            return Response(html)
+        except UserCreationError as e:
+            h.flash(e, 'error')
+        except Exception:
+            log.exception("Exception updating user")
+            h.flash(_('Error occurred during update of user %s')
+                    % form_result.get('username'), category='error')
+        raise HTTPFound(h.route_path('user_edit', user_id=user_id))
+
+    @LoginRequired()
+    @HasPermissionAllDecorator('hg.admin')
+    @CSRFRequired()
+    @view_config(
+        route_name='user_delete', request_method='POST',
+        renderer='rhodecode:templates/admin/users/user_edit.mako')
+    def user_delete(self):
+        _ = self.request.translate
+        c = self.load_default_context()
+        c.user = self.db_user
+
+        _repos = c.user.repositories
+        _repo_groups = c.user.repository_groups
+        _user_groups = c.user.user_groups
+
+        handle_repos = None
+        handle_repo_groups = None
+        handle_user_groups = None
+        # dummy call for flash of handle
+        set_handle_flash_repos = lambda: None
+        set_handle_flash_repo_groups = lambda: None
+        set_handle_flash_user_groups = lambda: None
+
+        if _repos and self.request.POST.get('user_repos'):
+            do = self.request.POST['user_repos']
+            if do == 'detach':
+                handle_repos = 'detach'
+                set_handle_flash_repos = lambda: h.flash(
+                    _('Detached %s repositories') % len(_repos),
+                    category='success')
+            elif do == 'delete':
+                handle_repos = 'delete'
+                set_handle_flash_repos = lambda: h.flash(
+                    _('Deleted %s repositories') % len(_repos),
+                    category='success')
+
+        if _repo_groups and self.request.POST.get('user_repo_groups'):
+            do = self.request.POST['user_repo_groups']
+            if do == 'detach':
+                handle_repo_groups = 'detach'
+                set_handle_flash_repo_groups = lambda: h.flash(
+                    _('Detached %s repository groups') % len(_repo_groups),
+                    category='success')
+            elif do == 'delete':
+                handle_repo_groups = 'delete'
+                set_handle_flash_repo_groups = lambda: h.flash(
+                    _('Deleted %s repository groups') % len(_repo_groups),
+                    category='success')
+
+        if _user_groups and self.request.POST.get('user_user_groups'):
+            do = self.request.POST['user_user_groups']
+            if do == 'detach':
+                handle_user_groups = 'detach'
+                set_handle_flash_user_groups = lambda: h.flash(
+                    _('Detached %s user groups') % len(_user_groups),
+                    category='success')
+            elif do == 'delete':
+                handle_user_groups = 'delete'
+                set_handle_flash_user_groups = lambda: h.flash(
+                    _('Deleted %s user groups') % len(_user_groups),
+                    category='success')
+
+        old_values = c.user.get_api_data()
+        try:
+            UserModel().delete(c.user, handle_repos=handle_repos,
+                               handle_repo_groups=handle_repo_groups,
+                               handle_user_groups=handle_user_groups)
+
+            audit_logger.store_web(
+                'user.delete', action_data={'old_data': old_values},
+                user=c.rhodecode_user)
+
+            Session().commit()
+            set_handle_flash_repos()
+            set_handle_flash_repo_groups()
+            set_handle_flash_user_groups()
+            h.flash(_('Successfully deleted user'), category='success')
+        except (UserOwnsReposException, UserOwnsRepoGroupsException,
+                UserOwnsUserGroupsException, DefaultUserException) as e:
+            h.flash(e, category='warning')
+        except Exception:
+            log.exception("Exception during deletion of user")
+            h.flash(_('An error occurred during deletion of user'),
+                    category='error')
+        raise HTTPFound(h.route_path('users'))
+
+    @LoginRequired()
+    @HasPermissionAllDecorator('hg.admin')
+    @view_config(
+        route_name='user_edit', request_method='GET',
+        renderer='rhodecode:templates/admin/users/user_edit.mako')
+    def user_edit(self):
+        _ = self.request.translate
+        c = self.load_default_context()
+        c.user = self.db_user
+
+        c.active = 'profile'
+        c.extern_type = c.user.extern_type
+        c.extern_name = c.user.extern_name
+        c.perm_user = c.user.AuthUser(ip_addr=self.request.remote_addr)
+
+        defaults = c.user.get_dict()
+        defaults.update({'language': c.user.user_data.get('language')})
+
+        data = render(
+            'rhodecode:templates/admin/users/user_edit.mako',
+            self._get_template_context(c), self.request)
+        html = formencode.htmlfill.render(
+            data,
+            defaults=defaults,
+            encoding="UTF-8",
+            force_defaults=False
+        )
+        return Response(html)
+
+    @LoginRequired()
+    @HasPermissionAllDecorator('hg.admin')
+    @view_config(
+        route_name='user_edit_advanced', request_method='GET',
+        renderer='rhodecode:templates/admin/users/user_edit.mako')
+    def user_edit_advanced(self):
+        _ = self.request.translate
+        c = self.load_default_context()
+
+        user_id = self.db_user_id
+        c.user = self.db_user
+
+        c.active = 'advanced'
+        c.personal_repo_group = RepoGroup.get_user_personal_repo_group(user_id)
+        c.personal_repo_group_name = RepoGroupModel()\
+            .get_personal_group_name(c.user)
+
+        c.user_to_review_rules = sorted(
+            (x.user for x in c.user.user_review_rules),
+            key=lambda u: u.username.lower())
+
+        c.first_admin = User.get_first_super_admin()
+        defaults = c.user.get_dict()
+
+        # Interim workaround if the user participated on any pull requests as a
+        # reviewer.
+        has_review = len(c.user.reviewer_pull_requests)
+        c.can_delete_user = not has_review
+        c.can_delete_user_message = ''
+        inactive_link = h.link_to(
+            'inactive', h.route_path('user_edit', user_id=user_id, _anchor='active'))
+        if has_review == 1:
+            c.can_delete_user_message = h.literal(_(
+                'The user participates as reviewer in {} pull request and '
+                'cannot be deleted. \nYou can set the user to '
+                '"{}" instead of deleting it.').format(
+                has_review, inactive_link))
+        elif has_review:
+            c.can_delete_user_message = h.literal(_(
+                'The user participates as reviewer in {} pull requests and '
+                'cannot be deleted. \nYou can set the user to '
+                '"{}" instead of deleting it.').format(
+                has_review, inactive_link))
+
+        data = render(
+            'rhodecode:templates/admin/users/user_edit.mako',
+            self._get_template_context(c), self.request)
+        html = formencode.htmlfill.render(
+            data,
+            defaults=defaults,
+            encoding="UTF-8",
+            force_defaults=False
+        )
+        return Response(html)
+
+    @LoginRequired()
+    @HasPermissionAllDecorator('hg.admin')
+    @view_config(
+        route_name='user_edit_global_perms', request_method='GET',
+        renderer='rhodecode:templates/admin/users/user_edit.mako')
+    def user_edit_global_perms(self):
+        _ = self.request.translate
+        c = self.load_default_context()
+        c.user = self.db_user
+
+        c.active = 'global_perms'
+
+        c.default_user = User.get_default_user()
+        defaults = c.user.get_dict()
+        defaults.update(c.default_user.get_default_perms(suffix='_inherited'))
+        defaults.update(c.default_user.get_default_perms())
+        defaults.update(c.user.get_default_perms())
+
+        data = render(
+            'rhodecode:templates/admin/users/user_edit.mako',
+            self._get_template_context(c), self.request)
+        html = formencode.htmlfill.render(
+            data,
+            defaults=defaults,
+            encoding="UTF-8",
+            force_defaults=False
+        )
+        return Response(html)
+
+    @LoginRequired()
+    @HasPermissionAllDecorator('hg.admin')
+    @CSRFRequired()
+    @view_config(
+        route_name='user_edit_global_perms_update', request_method='POST',
+        renderer='rhodecode:templates/admin/users/user_edit.mako')
+    def user_edit_global_perms_update(self):
+        _ = self.request.translate
+        c = self.load_default_context()
+
+        user_id = self.db_user_id
+        c.user = self.db_user
+
+        c.active = 'global_perms'
+        try:
+            # first stage that verifies the checkbox
+            _form = UserIndividualPermissionsForm()
+            form_result = _form.to_python(dict(self.request.POST))
+            inherit_perms = form_result['inherit_default_permissions']
+            c.user.inherit_default_permissions = inherit_perms
+            Session().add(c.user)
+
+            if not inherit_perms:
+                # only update the individual ones if we un check the flag
+                _form = UserPermissionsForm(
+                    [x[0] for x in c.repo_create_choices],
+                    [x[0] for x in c.repo_create_on_write_choices],
+                    [x[0] for x in c.repo_group_create_choices],
+                    [x[0] for x in c.user_group_create_choices],
+                    [x[0] for x in c.fork_choices],
+                    [x[0] for x in c.inherit_default_permission_choices])()
+
+                form_result = _form.to_python(dict(self.request.POST))
+                form_result.update({'perm_user_id': c.user.user_id})
+
+                PermissionModel().update_user_permissions(form_result)
+
+            # TODO(marcink): implement global permissions
+            # audit_log.store_web('user.edit.permissions')
+
+            Session().commit()
+            h.flash(_('User global permissions updated successfully'),
+                    category='success')
+
+        except formencode.Invalid as errors:
+            data = render(
+                'rhodecode:templates/admin/users/user_edit.mako',
+                self._get_template_context(c), self.request)
+            html = formencode.htmlfill.render(
+                data,
+                defaults=errors.value,
+                errors=errors.error_dict or {},
+                prefix_error=False,
+                encoding="UTF-8",
+                force_defaults=False
+            )
+            return Response(html)
+        except Exception:
+            log.exception("Exception during permissions saving")
+            h.flash(_('An error occurred during permissions saving'),
+                    category='error')
+        raise HTTPFound(h.route_path('user_edit_global_perms', user_id=user_id))
+
+    @LoginRequired()
+    @HasPermissionAllDecorator('hg.admin')
+    @CSRFRequired()
+    @view_config(
+        route_name='user_force_password_reset', request_method='POST',
+        renderer='rhodecode:templates/admin/users/user_edit.mako')
+    def user_force_password_reset(self):
+        """
+        toggle reset password flag for this user
+        """
+        _ = self.request.translate
+        c = self.load_default_context()
+
+        user_id = self.db_user_id
+        c.user = self.db_user
+
+        try:
+            old_value = c.user.user_data.get('force_password_change')
+            c.user.update_userdata(force_password_change=not old_value)
+
+            if old_value:
+                msg = _('Force password change disabled for user')
+                audit_logger.store_web(
+                    'user.edit.password_reset.disabled',
+                    user=c.rhodecode_user)
+            else:
+                msg = _('Force password change enabled for user')
+                audit_logger.store_web(
+                    'user.edit.password_reset.enabled',
+                    user=c.rhodecode_user)
+
+            Session().commit()
+            h.flash(msg, category='success')
+        except Exception:
+            log.exception("Exception during password reset for user")
+            h.flash(_('An error occurred during password reset for user'),
+                    category='error')
+
+        raise HTTPFound(h.route_path('user_edit_advanced', user_id=user_id))
+
+    @LoginRequired()
+    @HasPermissionAllDecorator('hg.admin')
+    @CSRFRequired()
+    @view_config(
+        route_name='user_create_personal_repo_group', request_method='POST',
+        renderer='rhodecode:templates/admin/users/user_edit.mako')
+    def user_create_personal_repo_group(self):
+        """
+        Create personal repository group for this user
+        """
+        from rhodecode.model.repo_group import RepoGroupModel
+
+        _ = self.request.translate
+        c = self.load_default_context()
+
+        user_id = self.db_user_id
+        c.user = self.db_user
+
+        personal_repo_group = RepoGroup.get_user_personal_repo_group(
+            c.user.user_id)
+        if personal_repo_group:
+            raise HTTPFound(h.route_path('user_edit_advanced', user_id=user_id))
+
+        personal_repo_group_name = RepoGroupModel().get_personal_group_name(
+            c.user)
+        named_personal_group = RepoGroup.get_by_group_name(
+            personal_repo_group_name)
+        try:
+
+            if named_personal_group and named_personal_group.user_id == c.user.user_id:
+                # migrate the same named group, and mark it as personal
+                named_personal_group.personal = True
+                Session().add(named_personal_group)
+                Session().commit()
+                msg = _('Linked repository group `%s` as personal' % (
+                    personal_repo_group_name,))
+                h.flash(msg, category='success')
+            elif not named_personal_group:
+                RepoGroupModel().create_personal_repo_group(c.user)
+
+                msg = _('Created repository group `%s`' % (
+                    personal_repo_group_name,))
+                h.flash(msg, category='success')
+            else:
+                msg = _('Repository group `%s` is already taken' % (
+                    personal_repo_group_name,))
+                h.flash(msg, category='warning')
+        except Exception:
+            log.exception("Exception during repository group creation")
+            msg = _(
+                'An error occurred during repository group creation for user')
+            h.flash(msg, category='error')
+            Session().rollback()
+
+        raise HTTPFound(h.route_path('user_edit_advanced', user_id=user_id))
+
     @LoginRequired()
     @HasPermissionAllDecorator('hg.admin')
     @view_config(
@@ -171,10 +688,7 b' class AdminUsersView(BaseAppView, DataGr'
     def auth_tokens(self):
         _ = self.request.translate
         c = self.load_default_context()
-
-        user_id = self.request.matchdict.get('user_id')
-        c.user = User.get_or_404(user_id)
-        self._redirect_for_default_user(c.user.username)
+        c.user = self.db_user
 
         c.active = 'auth_tokens'
 
@@ -200,10 +714,8 b' class AdminUsersView(BaseAppView, DataGr'
         _ = self.request.translate
         c = self.load_default_context()
 
-        user_id = self.request.matchdict.get('user_id')
-        c.user = User.get_or_404(user_id)
-
-        self._redirect_for_default_user(c.user.username)
+        user_id = self.db_user_id
+        c.user = self.db_user
 
         user_data = c.user.get_api_data()
         lifetime = safe_int(self.request.POST.get('lifetime'), -1)
@@ -233,9 +745,9 b' class AdminUsersView(BaseAppView, DataGr'
         _ = self.request.translate
         c = self.load_default_context()
 
-        user_id = self.request.matchdict.get('user_id')
-        c.user = User.get_or_404(user_id)
-        self._redirect_for_default_user(c.user.username)
+        user_id = self.db_user_id
+        c.user = self.db_user
+
         user_data = c.user.get_api_data()
 
         del_auth_token = self.request.POST.get('del_auth_token')
@@ -262,10 +774,7 b' class AdminUsersView(BaseAppView, DataGr'
     def ssh_keys(self):
         _ = self.request.translate
         c = self.load_default_context()
-
-        user_id = self.request.matchdict.get('user_id')
-        c.user = User.get_or_404(user_id)
-        self._redirect_for_default_user(c.user.username)
+        c.user = self.db_user
 
         c.active = 'ssh_keys'
         c.default_key = self.request.GET.get('default_key')
@@ -281,9 +790,7 b' class AdminUsersView(BaseAppView, DataGr'
         _ = self.request.translate
         c = self.load_default_context()
 
-        user_id = self.request.matchdict.get('user_id')
-        c.user = User.get_or_404(user_id)
-        self._redirect_for_default_user(c.user.username)
+        c.user = self.db_user
 
         c.active = 'ssh_keys_generate'
         comment = 'RhodeCode-SSH {}'.format(c.user.email or '')
@@ -300,10 +807,8 b' class AdminUsersView(BaseAppView, DataGr'
         _ = self.request.translate
         c = self.load_default_context()
 
-        user_id = self.request.matchdict.get('user_id')
-        c.user = User.get_or_404(user_id)
-
-        self._redirect_for_default_user(c.user.username)
+        user_id = self.db_user_id
+        c.user = self.db_user
 
         user_data = c.user.get_api_data()
         key_data = self.request.POST.get('key_data')
@@ -353,9 +858,9 b' class AdminUsersView(BaseAppView, DataGr'
         _ = self.request.translate
         c = self.load_default_context()
 
-        user_id = self.request.matchdict.get('user_id')
-        c.user = User.get_or_404(user_id)
-        self._redirect_for_default_user(c.user.username)
+        user_id = self.db_user_id
+        c.user = self.db_user
+
         user_data = c.user.get_api_data()
 
         del_ssh_key = self.request.POST.get('del_ssh_key')
@@ -384,10 +889,7 b' class AdminUsersView(BaseAppView, DataGr'
     def emails(self):
         _ = self.request.translate
         c = self.load_default_context()
-
-        user_id = self.request.matchdict.get('user_id')
-        c.user = User.get_or_404(user_id)
-        self._redirect_for_default_user(c.user.username)
+        c.user = self.db_user
 
         c.active = 'emails'
         c.user_email_map = UserEmailMap.query() \
@@ -404,22 +906,26 b' class AdminUsersView(BaseAppView, DataGr'
         _ = self.request.translate
         c = self.load_default_context()
 
-        user_id = self.request.matchdict.get('user_id')
-        c.user = User.get_or_404(user_id)
-        self._redirect_for_default_user(c.user.username)
+        user_id = self.db_user_id
+        c.user = self.db_user
 
         email = self.request.POST.get('new_email')
         user_data = c.user.get_api_data()
         try:
             UserModel().add_extra_email(c.user.user_id, email)
             audit_logger.store_web(
-                'user.edit.email.add', action_data={'email': email, 'user': user_data},
+                'user.edit.email.add',
+                action_data={'email': email, 'user': user_data},
                 user=self._rhodecode_user)
             Session().commit()
             h.flash(_("Added new email address `%s` for user account") % email,
                     category='success')
         except formencode.Invalid as error:
             h.flash(h.escape(error.error_dict['email']), category='error')
+        except IntegrityError:
+            log.warning("Email %s already exists", email)
+            h.flash(_('Email `{}` is already registered for another user.').format(email),
+                    category='error')
         except Exception:
             log.exception("Exception during email saving")
             h.flash(_('An error occurred during email saving'),
@@ -435,9 +941,8 b' class AdminUsersView(BaseAppView, DataGr'
         _ = self.request.translate
         c = self.load_default_context()
 
-        user_id = self.request.matchdict.get('user_id')
-        c.user = User.get_or_404(user_id)
-        self._redirect_for_default_user(c.user.username)
+        user_id = self.db_user_id
+        c.user = self.db_user
 
         email_id = self.request.POST.get('del_email_id')
         user_model = UserModel()
@@ -446,7 +951,8 b' class AdminUsersView(BaseAppView, DataGr'
         user_data = c.user.get_api_data()
         user_model.delete_extra_email(c.user.user_id, email_id)
         audit_logger.store_web(
-            'user.edit.email.delete', action_data={'email': email, 'user': user_data},
+            'user.edit.email.delete',
+            action_data={'email': email, 'user': user_data},
             user=self._rhodecode_user)
         Session().commit()
         h.flash(_("Removed email address from user account"),
@@ -461,10 +967,7 b' class AdminUsersView(BaseAppView, DataGr'
     def ips(self):
         _ = self.request.translate
         c = self.load_default_context()
-
-        user_id = self.request.matchdict.get('user_id')
-        c.user = User.get_or_404(user_id)
-        self._redirect_for_default_user(c.user.username)
+        c.user = self.db_user
 
         c.active = 'ips'
         c.user_ip_map = UserIpMap.query() \
@@ -481,14 +984,14 b' class AdminUsersView(BaseAppView, DataGr'
     @CSRFRequired()
     @view_config(
         route_name='edit_user_ips_add', request_method='POST')
+    # NOTE(marcink): this view is allowed for default users, as we can
+    # edit their IP white list
     def ips_add(self):
         _ = self.request.translate
         c = self.load_default_context()
 
-        user_id = self.request.matchdict.get('user_id')
-        c.user = User.get_or_404(user_id)
-        # NOTE(marcink): this view is allowed for default users, as we can
-        # edit their IP white list
+        user_id = self.db_user_id
+        c.user = self.db_user
 
         user_model = UserModel()
         desc = self.request.POST.get('description')
@@ -506,7 +1009,8 b' class AdminUsersView(BaseAppView, DataGr'
             try:
                 user_model.add_extra_ip(c.user.user_id, ip, desc)
                 audit_logger.store_web(
-                    'user.edit.ip.add', action_data={'ip': ip, 'user': user_data},
+                    'user.edit.ip.add',
+                    action_data={'ip': ip, 'user': user_data},
                     user=self._rhodecode_user)
                 Session().commit()
                 added.append(ip)
@@ -531,14 +1035,14 b' class AdminUsersView(BaseAppView, DataGr'
     @CSRFRequired()
     @view_config(
         route_name='edit_user_ips_delete', request_method='POST')
+    # NOTE(marcink): this view is allowed for default users, as we can
+    # edit their IP white list
     def ips_delete(self):
         _ = self.request.translate
         c = self.load_default_context()
 
-        user_id = self.request.matchdict.get('user_id')
-        c.user = User.get_or_404(user_id)
-        # NOTE(marcink): this view is allowed for default users, as we can
-        # edit their IP white list
+        user_id = self.db_user_id
+        c.user = self.db_user
 
         ip_id = self.request.POST.get('del_ip_id')
         user_model = UserModel()
@@ -563,11 +1067,9 b' class AdminUsersView(BaseAppView, DataGr'
         renderer='rhodecode:templates/admin/users/user_edit.mako')
     def groups_management(self):
         c = self.load_default_context()
+        c.user = self.db_user
+        c.data = c.user.group_member
 
-        user_id = self.request.matchdict.get('user_id')
-        c.user = User.get_or_404(user_id)
-        c.data = c.user.group_member
-        self._redirect_for_default_user(c.user.username)
         groups = [UserGroupModel.get_user_groups_as_dict(group.users_group)
                   for group in c.user.group_member]
         c.groups = json.dumps(groups)
@@ -584,9 +1086,8 b' class AdminUsersView(BaseAppView, DataGr'
         _ = self.request.translate
         c = self.load_default_context()
 
-        user_id = self.request.matchdict.get('user_id')
-        c.user = User.get_or_404(user_id)
-        self._redirect_for_default_user(c.user.username)
+        user_id = self.db_user_id
+        c.user = self.db_user
 
         user_groups = set(self.request.POST.getall('users_group_id'))
         user_groups_objects = []
@@ -595,8 +1096,26 b' class AdminUsersView(BaseAppView, DataGr'
             user_groups_objects.append(
                 UserGroupModel().get_group(safe_int(ugid)))
         user_group_model = UserGroupModel()
+        added_to_groups, removed_from_groups = \
         user_group_model.change_groups(c.user, user_groups_objects)
 
+        user_data = c.user.get_api_data()
+        for user_group_id in added_to_groups:
+            user_group = UserGroup.get(user_group_id)
+            old_values = user_group.get_api_data()
+            audit_logger.store_web(
+                'user_group.edit.member.add',
+                action_data={'user': user_data, 'old_data': old_values},
+                user=self._rhodecode_user)
+
+        for user_group_id in removed_from_groups:
+            user_group = UserGroup.get(user_group_id)
+            old_values = user_group.get_api_data()
+            audit_logger.store_web(
+                'user_group.edit.member.delete',
+                action_data={'user': user_data, 'old_data': old_values},
+                user=self._rhodecode_user)
+
         Session().commit()
         c.active = 'user_groups_management'
         h.flash(_("Groups successfully changed"), category='success')
@@ -612,10 +1131,8 b' class AdminUsersView(BaseAppView, DataGr'
     def user_audit_logs(self):
         _ = self.request.translate
         c = self.load_default_context()
+        c.user = self.db_user
 
-        user_id = self.request.matchdict.get('user_id')
-        c.user = User.get_or_404(user_id)
-        self._redirect_for_default_user(c.user.username)
         c.active = 'audit'
 
         p = safe_int(self.request.GET.get('page', 1), 1)
@@ -641,10 +1158,7 b' class AdminUsersView(BaseAppView, DataGr'
     def user_perms_summary(self):
         _ = self.request.translate
         c = self.load_default_context()
-
-        user_id = self.request.matchdict.get('user_id')
-        c.user = User.get_or_404(user_id)
-        self._redirect_for_default_user(c.user.username)
+        c.user = self.db_user
 
         c.active = 'perms_summary'
         c.perm_user = c.user.AuthUser(ip_addr=self.request.remote_addr)
@@ -658,11 +1172,6 b' class AdminUsersView(BaseAppView, DataGr'
         renderer='json_ext')
     def user_perms_summary_json(self):
         self.load_default_context()
-
-        user_id = self.request.matchdict.get('user_id')
-        user = User.get_or_404(user_id)
-        self._redirect_for_default_user(user.username)
-
-        perm_user = user.AuthUser(ip_addr=self.request.remote_addr)
+        perm_user = self.db_user.AuthUser(ip_addr=self.request.remote_addr)
 
         return perm_user.permissions

rhodecode/config/environment.py

@@ -115,7 +115,6 b' def load_environment(global_conf, app_co'
         'secret': config.get('channelstream.secret')
     }
 
-    set_available_permissions(config)
     db_cfg = make_db_config(clear_session=True)
 
     repos_path = list(db_cfg.items('paths'))[0][1]
@@ -178,5 +177,6 b' def load_pyramid_environment(global_conf'
                          log_level=settings['vcs.server.log_level'])
 
     utils.configure_vcs(settings)
+
     if vcs_server_enabled:
         connect_vcs(vcs_server_uri, utils.get_vcs_server_protocol(settings))

rhodecode/config/middleware.py

@@ -41,6 +41,7 b' import rhodecode'
 
 from rhodecode.model import meta
 from rhodecode.config import patches
+from rhodecode.config import utils as config_utils
 from rhodecode.config.routing import STATIC_FILE_PREFIX
 from rhodecode.config.environment import (
     load_environment, load_pyramid_environment)
@@ -56,7 +57,7 b' from rhodecode.lib.plugins.utils import '
 from rhodecode.lib.utils2 import aslist as rhodecode_aslist, AttributeDict
 from rhodecode.subscribers import (
     scan_repositories_if_enabled, write_js_routes_if_enabled,
-    write_metadata_if_needed)
+    write_metadata_if_needed, inject_app_settings)
 
 
 log = logging.getLogger(__name__)
@@ -146,11 +147,12 b' def make_pyramid_app(global_config, **se'
     settings_pylons = settings.copy()
 
     sanitize_settings_and_apply_defaults(settings)
+
     config = Configurator(settings=settings)
+    load_pyramid_environment(global_config, settings)
+
     add_pylons_compat_data(config.registry, global_config, settings_pylons)
 
-    load_pyramid_environment(global_config, settings)
-
     includeme_first(config)
     includeme(config)
 
@@ -315,6 +317,7 b' def includeme(config):'
     settings['default_locale_name'] = settings.get('lang', 'en')
 
     # Add subscribers.
+    config.add_subscriber(inject_app_settings, ApplicationCreated)
     config.add_subscriber(scan_repositories_if_enabled, ApplicationCreated)
     config.add_subscriber(write_metadata_if_needed, ApplicationCreated)
     config.add_subscriber(write_js_routes_if_enabled, ApplicationCreated)
@@ -472,6 +475,9 b' def sanitize_settings_and_apply_defaults'
     _sanitize_appenlight_settings(settings)
     _sanitize_vcs_settings(settings)
 
+    # configure instance id
+    config_utils.set_instance_id(settings)
+
     return settings
 
 

rhodecode/config/routing.py

@@ -219,37 +219,6 b' def make_map(config):'
                                                'function': check_group},
                   requirements=URL_NAME_REQUIREMENTS)
 
-    # ADMIN USER ROUTES
-    with rmap.submapper(path_prefix=ADMIN_PREFIX,
-                        controller='admin/users') as m:
-        m.connect('users', '/users',
-                  action='create', conditions={'method': ['POST']})
-        m.connect('new_user', '/users/new',
-                  action='new', conditions={'method': ['GET']})
-        m.connect('update_user', '/users/{user_id}',
-                  action='update', conditions={'method': ['PUT']})
-        m.connect('delete_user', '/users/{user_id}',
-                  action='delete', conditions={'method': ['DELETE']})
-        m.connect('edit_user', '/users/{user_id}/edit',
-                  action='edit', conditions={'method': ['GET']}, jsroute=True)
-        m.connect('user', '/users/{user_id}',
-                  action='show', conditions={'method': ['GET']})
-        m.connect('force_password_reset_user', '/users/{user_id}/password_reset',
-                  action='reset_password', conditions={'method': ['POST']})
-        m.connect('create_personal_repo_group', '/users/{user_id}/create_repo_group',
-                  action='create_personal_repo_group', conditions={'method': ['POST']})
-
-        # EXTRAS USER ROUTES
-        m.connect('edit_user_advanced', '/users/{user_id}/edit/advanced',
-                  action='edit_advanced', conditions={'method': ['GET']})
-        m.connect('edit_user_advanced', '/users/{user_id}/edit/advanced',
-                  action='update_advanced', conditions={'method': ['PUT']})
-
-        m.connect('edit_user_global_perms', '/users/{user_id}/edit/global_permissions',
-                  action='edit_global_perms', conditions={'method': ['GET']})
-        m.connect('edit_user_global_perms', '/users/{user_id}/edit/global_permissions',
-                  action='update_global_perms', conditions={'method': ['PUT']})
-
     # ADMIN SETTINGS ROUTES
     with rmap.submapper(path_prefix=ADMIN_PREFIX,
                         controller='admin/settings') as m:
@@ -339,5 +308,4 b' def make_map(config):'
         m.connect('my_account_password', '/my_account/password',
                   action='my_account_password', conditions={'method': ['GET']})
 
-
     return rmap

rhodecode/lib/auth.py

@@ -1012,13 +1012,16 b' class AuthUser(object):'
             log.debug('No data in %s that could been used to log in', self)
 
         if not is_user_loaded:
-            log.debug('Failed to load user. Fallback to default user')
+            log.debug(
+                'Failed to load user. Fallback to default user %s', anon_user)
             # if we cannot authenticate user try anonymous
             if anon_user.active:
+                log.debug('default user is active, using it as a session user')
                 user_model.fill_data(self, user_id=anon_user.user_id)
                 # then we set this user is logged in
                 self.is_authenticated = True
             else:
+                log.debug('default user is NOT active')
                 # in case of disabled anonymous user we reset some of the
                 # parameters so such user is "corrupted", skipping the fill_data
                 for attr in ['user_id', 'username', 'admin', 'active']:
@@ -1277,25 +1280,26 b' class AuthUser(object):'
         return _set or set(['0.0.0.0/0', '::/0'])
 
 
-def set_available_permissions(config):
+def set_available_permissions(settings):
     """
-    This function will propagate pylons globals with all available defined
+    This function will propagate pyramid settings with all available defined
     permission given in db. We don't want to check each time from db for new
     permissions since adding a new permission also requires application restart
     ie. to decorate new views with the newly created permission
 
-    :param config: current pylons config instance
+    :param settings: current pyramid registry.settings
 
     """
-    log.info('getting information about all available permissions')
+    log.debug('auth: getting information about all available permissions')
     try:
         sa = meta.Session
         all_perms = sa.query(Permission).all()
-        config['available_permissions'] = [x.permission_name for x in all_perms]
+        settings.setdefault('available_permissions',
+                            [x.permission_name for x in all_perms])
+        log.debug('auth: set available permissions')
     except Exception:
-        log.error(traceback.format_exc())
-    finally:
-        meta.Session.remove()
+        log.exception('Failed to fetch permissions from the database.')
+        raise
 
 
 def get_csrf_token(session, force_new=False, save_if_missing=True):

rhodecode/model/db.py

@@ -681,6 +681,17 b' class User(Base, BaseModel):'
         return 'NO_FEED_TOKEN_AVAILABLE'
 
     @classmethod
+    def get(cls, user_id, cache=False):
+        if not user_id:
+            return
+
+        user = cls.query()
+        if cache:
+            user = user.options(
+                FromCache("sql_cache_short", "get_users_%s" % user_id))
+        return user.get(user_id)
+
+    @classmethod
     def extra_valid_auth_tokens(cls, user, role=None):
         tokens = UserApiKeys.query().filter(UserApiKeys.user == user)\
                 .filter(or_(UserApiKeys.expires == -1,
@@ -1341,6 +1352,9 b' class UserGroup(Base, BaseModel):'
 
     @classmethod
     def get(cls, user_group_id, cache=False):
+        if not user_group_id:
+            return
+
         user_group = cls.query()
         if cache:
             user_group = user_group.options(

rhodecode/model/user_group.py

@@ -554,16 +554,22 b' class UserGroupModel(BaseModel):'
         groups_to_remove = current_groups - groups
         groups_to_add = groups - current_groups
 
+        removed_from_groups = []
+        added_to_groups = []
         for gr in groups_to_remove:
             log.debug('Removing user %s from user group %s',
                       user.username, gr.users_group_name)
+            removed_from_groups.append(gr.users_group_id)
             self.remove_user_from_group(gr.users_group_name, user.username)
         for gr in groups_to_add:
             log.debug('Adding user %s to user group %s',
                       user.username, gr.users_group_name)
+            added_to_groups.append(gr.users_group_id)
             UserGroupModel().add_user_to_group(
                 gr.users_group_name, user.username)
 
+        return added_to_groups, removed_from_groups
+
     def _serialize_user_group(self, user_group):
         import rhodecode.lib.helpers as h
         return {

rhodecode/public/js/rhodecode/routes.js

@@ -12,7 +12,6 b''
  ******************************************************************************/
 function registerRCRoutes() {
     // routes registration
-    pyroutes.register('edit_user', '/_admin/users/%(user_id)s/edit', ['user_id']);
     pyroutes.register('favicon', '/favicon.ico', []);
     pyroutes.register('robots', '/robots.txt', []);
     pyroutes.register('auth_home', '/_admin/auth*traverse', []);
@@ -66,6 +65,16 b' function registerRCRoutes() {'
     pyroutes.register('admin_permissions_ssh_keys_update', '/_admin/permissions/ssh_keys/update', []);
     pyroutes.register('users', '/_admin/users', []);
     pyroutes.register('users_data', '/_admin/users_data', []);
+    pyroutes.register('users_create', '/_admin/users/create', []);
+    pyroutes.register('users_new', '/_admin/users/new', []);
+    pyroutes.register('user_edit', '/_admin/users/%(user_id)s/edit', ['user_id']);
+    pyroutes.register('user_edit_advanced', '/_admin/users/%(user_id)s/edit/advanced', ['user_id']);
+    pyroutes.register('user_edit_global_perms', '/_admin/users/%(user_id)s/edit/global_permissions', ['user_id']);
+    pyroutes.register('user_edit_global_perms_update', '/_admin/users/%(user_id)s/edit/global_permissions/update', ['user_id']);
+    pyroutes.register('user_update', '/_admin/users/%(user_id)s/update', ['user_id']);
+    pyroutes.register('user_delete', '/_admin/users/%(user_id)s/delete', ['user_id']);
+    pyroutes.register('user_force_password_reset', '/_admin/users/%(user_id)s/password_reset', ['user_id']);
+    pyroutes.register('user_create_personal_repo_group', '/_admin/users/%(user_id)s/create_repo_group', ['user_id']);
     pyroutes.register('edit_user_auth_tokens', '/_admin/users/%(user_id)s/edit/auth_tokens', ['user_id']);
     pyroutes.register('edit_user_auth_tokens_add', '/_admin/users/%(user_id)s/edit/auth_tokens/new', ['user_id']);
     pyroutes.register('edit_user_auth_tokens_delete', '/_admin/users/%(user_id)s/edit/auth_tokens/delete', ['user_id']);

rhodecode/subscribers.py

@@ -35,6 +35,7 b' from threading import Thread'
 
 from rhodecode.translation import _ as tsf
 from rhodecode.config.jsroutes import generate_jsroutes_content
+from rhodecode.lib import auth
 
 import rhodecode
 
@@ -140,6 +141,12 b' def add_pylons_context(event):'
     pylons.tmpl_context._push_object(context)
 
 
+def inject_app_settings(event):
+    settings = event.app.registry.settings
+    # inject info about available permissions
+    auth.set_available_permissions(settings)
+
+
 def scan_repositories_if_enabled(event):
     """
     This is subscribed to the `pyramid.events.ApplicationCreated` event. It

rhodecode/templates/admin/my_account/my_account_auth_tokens.mako

@@ -102,7 +102,6 b' var select2Options = {'
 };
 $("#role").select2(select2Options);
 
-
 var preloadData = {
     results: [
         % for entry in c.lifetime_values:

rhodecode/templates/admin/user_groups/user_group_edit_settings.mako

@@ -77,7 +77,7 b''
                               <td id="member_user_${user.user_id}" class="td-author">
                                 <div class="group_member">
                                   ${base.gravatar(user.email, 16)}
-                                  <span class="username user">${h.link_to(h.person(user), h.url( 'edit_user',user_id=user.user_id))}</span>
+                                  <span class="username user">${h.link_to(h.person(user), h.route_path('user_edit',user_id=user.user_id))}</span>
                                   <input type="hidden" name="__start__" value="member:mapping">
                                   <input type="hidden" name="member_user_id" value="${user.user_id}">
                                   <input type="hidden" name="type" value="existing" id="member_${user.user_id}">
@@ -134,7 +134,7 b''
                 function addMember(user, fromUserGroup) {
                     var gravatar = user.icon_link;
                     var username = user.value_display;
-                    var userLink = pyroutes.url('edit_user', {"user_id": user.id});
+                    var userLink = pyroutes.url('user_edit', {"user_id": user.id});
                     var uid = user.id;
 
                     if (fromUserGroup) {

rhodecode/templates/admin/users/user_add.mako

@@ -26,7 +26,7 b''
         ${self.breadcrumbs()}
     </div>
     <!-- end box / title -->
-    ${h.secure_form(h.url('users'))}
+    ${h.secure_form(h.route_path('users_create'), request=request)}
     <div class="form">
         <!-- fields -->
         <div class="fields">

rhodecode/templates/admin/users/user_edit.mako

@@ -35,11 +35,11 b''
   <div class="sidebar-col-wrapper">
     <div class="sidebar">
         <ul class="nav nav-pills nav-stacked">
-          <li class="${'active' if c.active=='profile' else ''}"><a href="${h.url('edit_user', user_id=c.user.user_id)}">${_('User Profile')}</a></li>
+          <li class="${'active' if c.active=='profile' else ''}"><a href="${h.route_path('user_edit', user_id=c.user.user_id)}">${_('User Profile')}</a></li>
           <li class="${'active' if c.active=='auth_tokens' else ''}"><a href="${h.route_path('edit_user_auth_tokens', user_id=c.user.user_id)}">${_('Auth tokens')}</a></li>
           <li class="${'active' if c.active in ['ssh_keys','ssh_keys_generate'] else ''}"><a href="${h.route_path('edit_user_ssh_keys', user_id=c.user.user_id)}">${_('SSH Keys')}</a></li>
-          <li class="${'active' if c.active=='advanced' else ''}"><a href="${h.url('edit_user_advanced', user_id=c.user.user_id)}">${_('Advanced')}</a></li>
-          <li class="${'active' if c.active=='global_perms' else ''}"><a href="${h.url('edit_user_global_perms', user_id=c.user.user_id)}">${_('Global permissions')}</a></li>
+          <li class="${'active' if c.active=='advanced' else ''}"><a href="${h.route_path('user_edit_advanced', user_id=c.user.user_id)}">${_('Advanced')}</a></li>
+          <li class="${'active' if c.active=='global_perms' else ''}"><a href="${h.route_path('user_edit_global_perms', user_id=c.user.user_id)}">${_('Global permissions')}</a></li>
           <li class="${'active' if c.active=='perms_summary' else ''}"><a href="${h.route_path('edit_user_perms_summary', user_id=c.user.user_id)}">${_('Permissions summary')}</a></li>
           <li class="${'active' if c.active=='emails' else ''}"><a href="${h.route_path('edit_user_emails', user_id=c.user.user_id)}">${_('Emails')}</a></li>
           <li class="${'active' if c.active=='ips' else ''}"><a href="${h.route_path('edit_user_ips', user_id=c.user.user_id)}">${_('Ip Whitelist')}</a></li>

rhodecode/templates/admin/users/user_edit_advanced.mako

@@ -34,7 +34,7 b''
         <h3 class="panel-title">${_('Force Password Reset')}</h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.url('force_password_reset_user', user_id=c.user.user_id), method='post')}
+        ${h.secure_form(h.route_path('user_force_password_reset', user_id=c.user.user_id), request=request)}
             <div class="field">
                 <button class="btn btn-default" type="submit">
                     <i class="icon-lock"></i>
@@ -59,7 +59,7 b''
         <h3 class="panel-title">${_('Personal Repository Group')}</h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.url('create_personal_repo_group', user_id=c.user.user_id), method='post')}
+        ${h.secure_form(h.route_path('user_create_personal_repo_group', user_id=c.user.user_id), request=request)}
 
         %if c.personal_repo_group:
             <div class="panel-body-title-text">${_('Users personal repository group')} : ${h.link_to(c.personal_repo_group.group_name, h.route_path('repo_group_home', repo_group_name=c.personal_repo_group.group_name))}</div>
@@ -84,7 +84,7 b''
         <h3 class="panel-title">${_('Delete User')}</h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.url('delete_user', user_id=c.user.user_id), method='delete')}
+        ${h.secure_form(h.route_path('user_delete', user_id=c.user.user_id), request=request)}
 
             <table class="display">
                 <tr>

rhodecode/templates/admin/users/user_edit_auth_tokens.mako

@@ -92,6 +92,7 b''
 <script>
 
 $(document).ready(function(){
+
 var select2Options = {
     'containerCssClass': "drop-menu",
     'dropdownCssClass': "drop-menu-dropdown",

rhodecode/templates/admin/users/user_edit_global_perms.mako

@@ -1,2 +1,2 b''
 <%namespace name="dpb" file="/base/default_perms_box.mako"/>
-${dpb.default_perms_box(h.url('edit_user_global_perms', user_id=c.user.user_id))}
+${dpb.default_perms_box(form_url=h.route_path('user_edit_global_perms_update', user_id=c.user.user_id))}

rhodecode/templates/admin/users/user_edit_groups.mako

@@ -61,7 +61,7 b' var api;'
                  render: function (data,type,full,meta)
                     {return '<input type="hidden" name="users_group_id" value="'+data+'">'}},
          { data: {"_": "active",
-                  "sort": "active"}, title: "${_('Active')}", className: "td-active", className: "td-number"},
+                  "sort": "active"}, title: "${_('Active')}", className: "td-active"},
          { data: {"_": "owner_data"}, title: "${_('Owner')}", className: "td-user",
              render: function (data,type,full,meta)
                     {return '<div class="rc-user tooltip">'+
@@ -72,8 +72,8 b' var api;'
          { data: null,
              title: "${_('Action')}",
              className: "td-action",
-             defaultContent: '<a href="" class="btn btn-link btn-danger">Delete</a>'
-         },
+             defaultContent: '-'
+         }
       ],
       language: {
           paginate: DEFAULT_GRID_PAGINATION,

rhodecode/templates/admin/users/user_edit_profile.mako

@@ -6,7 +6,7 b''
     </div>
     <div class="panel-body">
         <div class="user-profile-content">
-        ${h.secure_form(h.url('update_user', user_id=c.user.user_id),method='put', class_='form')}
+        ${h.secure_form(h.route_path('user_update', user_id=c.user.user_id), class_='form', request=request)}
         <% readonly = None %>
         <% disabled = "" %>
         %if c.extern_type != 'rhodecode':

rhodecode/templates/admin/users/users.mako

@@ -25,7 +25,7 b''
         ${self.breadcrumbs()}
         <ul class="links">
           <li>
-            <a href="${h.url('new_user')}" class="btn btn-small btn-success">${_(u'Add User')}</a>
+            <a href="${h.route_path('users_new')}" class="btn btn-small btn-success">${_(u'Add User')}</a>
           </li>
         </ul>
     </div>

rhodecode/templates/base/perms_summary.mako

@@ -124,22 +124,22 b''
                 edit_url=None, edit_global_url=h.route_path('admin_permissions_object'))}
 
            ${glob(_('Super admin'), get_section_perms('hg.admin', permissions[section]),
-                edit_url=h.url('edit_user', user_id=c.user.user_id, anchor='admin'), edit_global_url=None)}
+                edit_url=h.route_path('user_edit', user_id=c.user.user_id, _anchor='admin'), edit_global_url=None)}
 
            ${glob(_('Inherit permissions'), get_section_perms('hg.inherit_default_perms.', permissions[section]),
-                edit_url=h.url('edit_user_global_perms', user_id=c.user.user_id), edit_global_url=None)}
+                edit_url=h.route_path('user_edit_global_perms', user_id=c.user.user_id), edit_global_url=None)}
 
            ${glob(_('Create repositories'), get_section_perms('hg.create.', permissions[section]),
-                edit_url=h.url('edit_user_global_perms', user_id=c.user.user_id), edit_global_url=h.route_path('admin_permissions_object'))}
+                edit_url=h.route_path('user_edit_global_perms', user_id=c.user.user_id), edit_global_url=h.route_path('admin_permissions_object'))}
 
            ${glob(_('Fork repositories'), get_section_perms('hg.fork.', permissions[section]),
-                edit_url=h.url('edit_user_global_perms', user_id=c.user.user_id), edit_global_url=h.route_path('admin_permissions_object'))}
+                edit_url=h.route_path('user_edit_global_perms', user_id=c.user.user_id), edit_global_url=h.route_path('admin_permissions_object'))}
 
            ${glob(_('Create repository groups'), get_section_perms('hg.repogroup.create.', permissions[section]),
-                edit_url=h.url('edit_user_global_perms', user_id=c.user.user_id), edit_global_url=h.route_path('admin_permissions_object'))}
+                edit_url=h.route_path('user_edit_global_perms', user_id=c.user.user_id), edit_global_url=h.route_path('admin_permissions_object'))}
 
            ${glob(_('Create user groups'), get_section_perms('hg.usergroup.create.', permissions[section]),
-                edit_url=h.url('edit_user_global_perms', user_id=c.user.user_id), edit_global_url=h.route_path('admin_permissions_object'))}
+                edit_url=h.route_path('user_edit_global_perms', user_id=c.user.user_id), edit_global_url=h.route_path('admin_permissions_object'))}
 
            </tbody>
           %else:

rhodecode/templates/data_table/_dt_elements.mako

@@ -250,11 +250,11 b''
 
 <%def name="user_actions(user_id, username)">
  <div class="grid_edit">
-   <a href="${h.url('edit_user',user_id=user_id)}" title="${_('Edit')}">
-     <i class="icon-pencil"></i>Edit</a>
+   <a href="${h.route_path('user_edit',user_id=user_id)}" title="${_('Edit')}">
+     <i class="icon-pencil"></i>${_('Edit')}</a>
  </div>
  <div class="grid_delete">
-  ${h.secure_form(h.url('delete_user', user_id=user_id),method='delete')}
+  ${h.secure_form(h.route_path('user_delete', user_id=user_id), request=request)}
     ${h.submit('remove_',_('Delete'),id="remove_user_%s" % user_id, class_="btn btn-link btn-danger",
     onclick="return confirm('"+_('Confirm to delete this user: %s') % username+"');")}
   ${h.end_form()}
@@ -275,7 +275,7 b''
 
 
 <%def name="user_name(user_id, username)">
-    ${h.link_to(h.person(username, 'username_or_name_or_email'), h.url('edit_user', user_id=user_id))}
+    ${h.link_to(h.person(username, 'username_or_name_or_email'), h.route_path('user_edit', user_id=user_id))}
 </%def>
 
 <%def name="user_profile(username)">

rhodecode/templates/users/user_profile.mako

@@ -4,7 +4,7 b''
     <div class="panel-heading">
         <h3 class="panel-title">${_('Profile')}</h3>
         %if h.HasPermissionAny('hg.admin')():
-            ${h.link_to(_('Edit'), h.url('edit_user', user_id=c.user.user_id), class_='panel-edit')}
+            ${h.link_to(_('Edit'), h.route_path('user_edit', user_id=c.user.user_id), class_='panel-edit')}
         %endif
     </div>