user-groups: rewrote the app to pyramid

- added new event data with added/removed/changed permissions
- cleanup code and spelling

rhodecode/apps/user_group/__init__.py

@@ -0,0 +1,101 b''
+# -*- coding: utf-8 -*-
+
+# Copyright (C) 2016-2017  RhodeCode GmbH
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License, version 3
+# (only), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+# This program is dual-licensed. If you wish to learn more about the
+# RhodeCode Enterprise Edition, including its added features, Support services,
+# and proprietary license terms, please see https://rhodecode.com/licenses/
+
+
+from rhodecode.apps.admin.navigation import NavigationRegistry
+from rhodecode.config.routing import ADMIN_PREFIX
+from rhodecode.lib.utils2 import str2bool
+
+
+def admin_routes(config):
+    """
+    User groups /_admin prefixed routes
+    """
+
+    config.add_route(
+        name='user_group_members_data',
+        pattern='/user_groups/{user_group_id:\d+}/members',
+        user_group_route=True)
+
+    # user groups perms
+    config.add_route(
+        name='edit_user_group_perms_summary',
+        pattern='/user_groups/{user_group_id:\d+}/edit/permissions_summary',
+        user_group_route=True)
+    config.add_route(
+        name='edit_user_group_perms_summary_json',
+        pattern='/user_groups/{user_group_id:\d+}/edit/permissions_summary/json',
+        user_group_route=True)
+
+    # user groups edit
+    config.add_route(
+        name='edit_user_group',
+        pattern='/user_groups/{user_group_id:\d+}/edit',
+        user_group_route=True)
+
+    # user groups update
+    config.add_route(
+        name='user_groups_update',
+        pattern='/user_groups/{user_group_id:\d+}/update',
+        user_group_route=True)
+
+    config.add_route(
+        name='edit_user_group_global_perms',
+        pattern='/user_groups/{user_group_id:\d+}/edit/global_permissions',
+        user_group_route=True)
+
+    config.add_route(
+        name='edit_user_group_global_perms_update',
+        pattern='/user_groups/{user_group_id:\d+}/edit/global_permissions/update',
+        user_group_route=True)
+
+    config.add_route(
+        name='edit_user_group_perms',
+        pattern='/user_groups/{user_group_id:\d+}/edit/permissions',
+        user_group_route=True)
+
+    config.add_route(
+        name='edit_user_group_perms_update',
+        pattern='/user_groups/{user_group_id:\d+}/edit/permissions/update',
+        user_group_route=True)
+
+    config.add_route(
+        name='edit_user_group_advanced',
+        pattern='/user_groups/{user_group_id:\d+}/edit/advanced',
+        user_group_route=True)
+
+    config.add_route(
+        name='edit_user_group_advanced_sync',
+        pattern='/user_groups/{user_group_id:\d+}/edit/advanced/sync',
+        user_group_route=True)
+
+    # user groups delete
+    config.add_route(
+        name='user_groups_delete',
+        pattern='/user_groups/{user_group_id:\d+}/delete',
+        user_group_route=True)
+
+
+def includeme(config):
+    # main admin routes
+    config.include(admin_routes, route_prefix=ADMIN_PREFIX)
+
+    # Scan module for configuration decorators.
+    config.scan('.views', ignore='.tests')

rhodecode/apps/user_group/tests/__init__.py

@@ -0,0 +1,19 b''
+# -*- coding: utf-8 -*-
+
+# Copyright (C) 2016-2017 RhodeCode GmbH
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License, version 3
+# (only), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+# This program is dual-licensed. If you wish to learn more about the
+# RhodeCode Enterprise Edition, including its added features, Support services,
+# and proprietary license terms, please see https://rhodecode.com/licenses/\

rhodecode/apps/user_group/views/__init__.py

@@ -0,0 +1,529 b''
+# -*- coding: utf-8 -*-
+
+# Copyright (C) 2016-2017 RhodeCode GmbH
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License, version 3
+# (only), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+# This program is dual-licensed. If you wish to learn more about the
+# RhodeCode Enterprise Edition, including its added features, Support services,
+# and proprietary license terms, please see https://rhodecode.com/licenses/
+
+import logging
+
+import peppercorn
+import formencode
+import formencode.htmlfill
+from pyramid.httpexceptions import HTTPFound
+from pyramid.view import view_config
+from pyramid.response import Response
+from pyramid.renderers import render
+
+from rhodecode.lib.exceptions import (
+    RepoGroupAssignmentError, UserGroupAssignedException)
+from rhodecode.model.forms import (
+    UserGroupPermsForm, UserGroupForm, UserIndividualPermissionsForm,
+    UserPermissionsForm)
+from rhodecode.model.permission import PermissionModel
+
+from rhodecode.apps._base import UserGroupAppView
+from rhodecode.lib.auth import (
+    LoginRequired, HasUserGroupPermissionAnyDecorator, CSRFRequired)
+from rhodecode.lib import helpers as h, audit_logger
+from rhodecode.lib.utils2 import str2bool
+from rhodecode.model.db import (
+    joinedload, User, UserGroupRepoToPerm, UserGroupRepoGroupToPerm)
+from rhodecode.model.meta import Session
+from rhodecode.model.user_group import UserGroupModel
+
+log = logging.getLogger(__name__)
+
+
+class UserGroupsView(UserGroupAppView):
+
+    def load_default_context(self):
+        c = self._get_local_tmpl_context()
+
+        PermissionModel().set_global_permission_choices(
+            c, gettext_translator=self.request.translate)
+
+        self._register_global_c(c)
+        return c
+
+    def _get_perms_summary(self, user_group_id):
+        permissions = {
+            'repositories': {},
+            'repositories_groups': {},
+        }
+        ugroup_repo_perms = UserGroupRepoToPerm.query()\
+            .options(joinedload(UserGroupRepoToPerm.permission))\
+            .options(joinedload(UserGroupRepoToPerm.repository))\
+            .filter(UserGroupRepoToPerm.users_group_id == user_group_id)\
+            .all()
+
+        for gr in ugroup_repo_perms:
+            permissions['repositories'][gr.repository.repo_name]  \
+                = gr.permission.permission_name
+
+        ugroup_group_perms = UserGroupRepoGroupToPerm.query()\
+            .options(joinedload(UserGroupRepoGroupToPerm.permission))\
+            .options(joinedload(UserGroupRepoGroupToPerm.group))\
+            .filter(UserGroupRepoGroupToPerm.users_group_id == user_group_id)\
+            .all()
+
+        for gr in ugroup_group_perms:
+            permissions['repositories_groups'][gr.group.group_name] \
+                = gr.permission.permission_name
+        return permissions
+
+    @LoginRequired()
+    @HasUserGroupPermissionAnyDecorator('usergroup.admin')
+    @view_config(
+        route_name='user_group_members_data', request_method='GET',
+        renderer='json_ext', xhr=True)
+    def user_group_members(self):
+        """
+        Return members of given user group
+        """
+        user_group = self.db_user_group
+        group_members_obj = sorted((x.user for x in user_group.members),
+                                   key=lambda u: u.username.lower())
+
+        group_members = [
+            {
+                'id': user.user_id,
+                'first_name': user.first_name,
+                'last_name': user.last_name,
+                'username': user.username,
+                'icon_link': h.gravatar_url(user.email, 30),
+                'value_display': h.person(user.email),
+                'value': user.username,
+                'value_type': 'user',
+                'active': user.active,
+            }
+            for user in group_members_obj
+        ]
+
+        return {
+            'members': group_members
+        }
+
+    @LoginRequired()
+    @HasUserGroupPermissionAnyDecorator('usergroup.admin')
+    @view_config(
+        route_name='edit_user_group_perms_summary', request_method='GET',
+        renderer='rhodecode:templates/admin/user_groups/user_group_edit.mako')
+    def user_group_perms_summary(self):
+        c = self.load_default_context()
+        c.user_group = self.db_user_group
+        c.active = 'perms_summary'
+        c.permissions = self._get_perms_summary(c.user_group.users_group_id)
+        return self._get_template_context(c)
+
+    @LoginRequired()
+    @HasUserGroupPermissionAnyDecorator('usergroup.admin')
+    @view_config(
+        route_name='edit_user_group_perms_summary_json', request_method='GET',
+        renderer='json_ext')
+    def user_group_perms_summary_json(self):
+        self.load_default_context()
+        user_group = self.db_user_group
+        return self._get_perms_summary(user_group.users_group_id)
+
+    def _revoke_perms_on_yourself(self, form_result):
+        _updates = filter(lambda u: self._rhodecode_user.user_id == int(u[0]),
+                          form_result['perm_updates'])
+        _additions = filter(lambda u: self._rhodecode_user.user_id == int(u[0]),
+                            form_result['perm_additions'])
+        _deletions = filter(lambda u: self._rhodecode_user.user_id == int(u[0]),
+                            form_result['perm_deletions'])
+        admin_perm = 'usergroup.admin'
+        if _updates   and _updates[0][1]   != admin_perm or \
+           _additions and _additions[0][1] != admin_perm or \
+           _deletions and _deletions[0][1] != admin_perm:
+            return True
+        return False
+
+    @LoginRequired()
+    @HasUserGroupPermissionAnyDecorator('usergroup.admin')
+    @CSRFRequired()
+    @view_config(
+        route_name='user_groups_update', request_method='POST',
+        renderer='rhodecode:templates/admin/user_groups/user_group_edit.mako')
+    def user_group_update(self):
+        _ = self.request.translate
+
+        user_group = self.db_user_group
+        user_group_id = user_group.users_group_id
+
+        c = self.load_default_context()
+        c.user_group = user_group
+        c.group_members_obj = [x.user for x in c.user_group.members]
+        c.group_members_obj.sort(key=lambda u: u.username.lower())
+        c.group_members = [(x.user_id, x.username) for x in c.group_members_obj]
+        c.active = 'settings'
+
+        users_group_form = UserGroupForm(
+            edit=True, old_data=c.user_group.get_dict(), allow_disabled=True)()
+
+        old_values = c.user_group.get_api_data()
+        user_group_name = self.request.POST.get('users_group_name')
+        try:
+            form_result = users_group_form.to_python(self.request.POST)
+            pstruct = peppercorn.parse(self.request.POST.items())
+            form_result['users_group_members'] = pstruct['user_group_members']
+
+            user_group, added_members, removed_members = \
+                UserGroupModel().update(c.user_group, form_result)
+            updated_user_group = form_result['users_group_name']
+
+            audit_logger.store_web(
+                'user_group.edit', action_data={'old_data': old_values},
+                user=self._rhodecode_user)
+
+            # TODO(marcink): use added/removed to set user_group.edit.member.add
+
+            h.flash(_('Updated user group %s') % updated_user_group,
+                    category='success')
+            Session().commit()
+        except formencode.Invalid as errors:
+            defaults = errors.value
+            e = errors.error_dict or {}
+
+            data = render(
+                'rhodecode:templates/admin/user_groups/user_group_edit.mako',
+                self._get_template_context(c), self.request)
+            html = formencode.htmlfill.render(
+                data,
+                defaults=defaults,
+                errors=e,
+                prefix_error=False,
+                encoding="UTF-8",
+                force_defaults=False
+            )
+            return Response(html)
+
+        except Exception:
+            log.exception("Exception during update of user group")
+            h.flash(_('Error occurred during update of user group %s')
+                    % user_group_name, category='error')
+
+        raise HTTPFound(
+            h.route_path('edit_user_group', user_group_id=user_group_id))
+
+    @LoginRequired()
+    @HasUserGroupPermissionAnyDecorator('usergroup.admin')
+    @CSRFRequired()
+    @view_config(
+        route_name='user_groups_delete', request_method='POST',
+        renderer='rhodecode:templates/admin/user_groups/user_group_edit.mako')
+    def user_group_delete(self):
+        _ = self.request.translate
+        user_group = self.db_user_group
+
+        self.load_default_context()
+        force = str2bool(self.request.POST.get('force'))
+
+        old_values = user_group.get_api_data()
+        try:
+            UserGroupModel().delete(user_group, force=force)
+            audit_logger.store_web(
+                'user.delete', action_data={'old_data': old_values},
+                user=self._rhodecode_user)
+            Session().commit()
+            h.flash(_('Successfully deleted user group'), category='success')
+        except UserGroupAssignedException as e:
+            h.flash(str(e), category='error')
+        except Exception:
+            log.exception("Exception during deletion of user group")
+            h.flash(_('An error occurred during deletion of user group'),
+                    category='error')
+        raise HTTPFound(h.route_path('user_groups'))
+
+    @LoginRequired()
+    @HasUserGroupPermissionAnyDecorator('usergroup.admin')
+    @view_config(
+        route_name='edit_user_group', request_method='GET',
+        renderer='rhodecode:templates/admin/user_groups/user_group_edit.mako')
+    def user_group_edit(self):
+        user_group = self.db_user_group
+
+        c = self.load_default_context()
+        c.user_group = user_group
+        c.group_members_obj = [x.user for x in c.user_group.members]
+        c.group_members_obj.sort(key=lambda u: u.username.lower())
+        c.group_members = [(x.user_id, x.username) for x in c.group_members_obj]
+
+        c.active = 'settings'
+
+        defaults = user_group.get_dict()
+        # fill owner
+        if user_group.user:
+            defaults.update({'user': user_group.user.username})
+        else:
+            replacement_user = User.get_first_super_admin().username
+            defaults.update({'user': replacement_user})
+
+        data = render(
+            'rhodecode:templates/admin/user_groups/user_group_edit.mako',
+            self._get_template_context(c), self.request)
+        html = formencode.htmlfill.render(
+            data,
+            defaults=defaults,
+            encoding="UTF-8",
+            force_defaults=False
+        )
+        return Response(html)
+
+    @LoginRequired()
+    @HasUserGroupPermissionAnyDecorator('usergroup.admin')
+    @view_config(
+        route_name='edit_user_group_perms', request_method='GET',
+        renderer='rhodecode:templates/admin/user_groups/user_group_edit.mako')
+    def user_group_edit_perms(self):
+        user_group = self.db_user_group
+        c = self.load_default_context()
+        c.user_group = user_group
+        c.active = 'perms'
+
+        defaults = {}
+        # fill user group users
+        for p in c.user_group.user_user_group_to_perm:
+            defaults.update({'u_perm_%s' % p.user.user_id:
+                             p.permission.permission_name})
+
+        for p in c.user_group.user_group_user_group_to_perm:
+            defaults.update({'g_perm_%s' % p.user_group.users_group_id:
+                             p.permission.permission_name})
+
+        data = render(
+            'rhodecode:templates/admin/user_groups/user_group_edit.mako',
+            self._get_template_context(c), self.request)
+        html = formencode.htmlfill.render(
+            data,
+            defaults=defaults,
+            encoding="UTF-8",
+            force_defaults=False
+        )
+        return Response(html)
+
+    @LoginRequired()
+    @HasUserGroupPermissionAnyDecorator('usergroup.admin')
+    @CSRFRequired()
+    @view_config(
+        route_name='edit_user_group_perms_update', request_method='POST',
+        renderer='rhodecode:templates/admin/user_groups/user_group_edit.mako')
+    def user_group_update_perms(self):
+        """
+        grant permission for given user group
+        """
+        _ = self.request.translate
+
+        user_group = self.db_user_group
+        user_group_id = user_group.users_group_id
+        c = self.load_default_context()
+        c.user_group = user_group
+        form = UserGroupPermsForm()().to_python(self.request.POST)
+
+        if not self._rhodecode_user.is_admin:
+            if self._revoke_perms_on_yourself(form):
+                msg = _('Cannot change permission for yourself as admin')
+                h.flash(msg, category='warning')
+                raise HTTPFound(
+                    h.route_path('edit_user_group_perms',
+                                 user_group_id=user_group_id))
+
+        try:
+            changes = UserGroupModel().update_permissions(
+                user_group_id,
+                form['perm_additions'], form['perm_updates'],
+                form['perm_deletions'])
+
+        except RepoGroupAssignmentError:
+            h.flash(_('Target group cannot be the same'), category='error')
+            raise HTTPFound(
+                h.route_path('edit_user_group_perms',
+                             user_group_id=user_group_id))
+
+        action_data = {
+            'added': changes['added'],
+            'updated': changes['updated'],
+            'deleted': changes['deleted'],
+        }
+        audit_logger.store_web(
+            'user_group.edit.permissions', action_data=action_data,
+            user=self._rhodecode_user)
+
+        Session().commit()
+        h.flash(_('User Group permissions updated'), category='success')
+        raise HTTPFound(
+            h.route_path('edit_user_group_perms', user_group_id=user_group_id))
+
+    @LoginRequired()
+    @HasUserGroupPermissionAnyDecorator('usergroup.admin')
+    @view_config(
+        route_name='edit_user_group_global_perms', request_method='GET',
+        renderer='rhodecode:templates/admin/user_groups/user_group_edit.mako')
+    def user_group_global_perms_edit(self):
+        user_group = self.db_user_group
+        c = self.load_default_context()
+        c.user_group = user_group
+        c.active = 'global_perms'
+
+        c.default_user = User.get_default_user()
+        defaults = c.user_group.get_dict()
+        defaults.update(c.default_user.get_default_perms(suffix='_inherited'))
+        defaults.update(c.user_group.get_default_perms())
+
+        data = render(
+            'rhodecode:templates/admin/user_groups/user_group_edit.mako',
+            self._get_template_context(c), self.request)
+        html = formencode.htmlfill.render(
+            data,
+            defaults=defaults,
+            encoding="UTF-8",
+            force_defaults=False
+        )
+        return Response(html)
+
+    @LoginRequired()
+    @HasUserGroupPermissionAnyDecorator('usergroup.admin')
+    @CSRFRequired()
+    @view_config(
+        route_name='edit_user_group_global_perms_update', request_method='POST',
+        renderer='rhodecode:templates/admin/user_groups/user_group_edit.mako')
+    def user_group_global_perms_update(self):
+        _ = self.request.translate
+        user_group = self.db_user_group
+        user_group_id = self.db_user_group.users_group_id
+
+        c = self.load_default_context()
+        c.user_group = user_group
+        c.active = 'global_perms'
+
+        try:
+            # first stage that verifies the checkbox
+            _form = UserIndividualPermissionsForm()
+            form_result = _form.to_python(dict(self.request.POST))
+            inherit_perms = form_result['inherit_default_permissions']
+            user_group.inherit_default_permissions = inherit_perms
+            Session().add(user_group)
+
+            if not inherit_perms:
+                # only update the individual ones if we un check the flag
+                _form = UserPermissionsForm(
+                    [x[0] for x in c.repo_create_choices],
+                    [x[0] for x in c.repo_create_on_write_choices],
+                    [x[0] for x in c.repo_group_create_choices],
+                    [x[0] for x in c.user_group_create_choices],
+                    [x[0] for x in c.fork_choices],
+                    [x[0] for x in c.inherit_default_permission_choices])()
+
+                form_result = _form.to_python(dict(self.request.POST))
+                form_result.update(
+                    {'perm_user_group_id': user_group.users_group_id})
+
+                PermissionModel().update_user_group_permissions(form_result)
+
+            Session().commit()
+            h.flash(_('User Group global permissions updated successfully'),
+                    category='success')
+
+        except formencode.Invalid as errors:
+            defaults = errors.value
+
+            data = render(
+                'rhodecode:templates/admin/user_groups/user_group_edit.mako',
+                self._get_template_context(c), self.request)
+            html = formencode.htmlfill.render(
+                data,
+                defaults=defaults,
+                errors=errors.error_dict or {},
+                prefix_error=False,
+                encoding="UTF-8",
+                force_defaults=False
+            )
+            return Response(html)
+        except Exception:
+            log.exception("Exception during permissions saving")
+            h.flash(_('An error occurred during permissions saving'),
+                    category='error')
+
+        raise HTTPFound(
+            h.route_path('edit_user_group_global_perms',
+                         user_group_id=user_group_id))
+
+    @LoginRequired()
+    @HasUserGroupPermissionAnyDecorator('usergroup.admin')
+    @view_config(
+        route_name='edit_user_group_advanced', request_method='GET',
+        renderer='rhodecode:templates/admin/user_groups/user_group_edit.mako')
+    def user_group_edit_advanced(self):
+        user_group = self.db_user_group
+
+        c = self.load_default_context()
+        c.user_group = user_group
+        c.active = 'advanced'
+        c.group_members_obj = sorted(
+            (x.user for x in c.user_group.members),
+            key=lambda u: u.username.lower())
+
+        c.group_to_repos = sorted(
+            (x.repository for x in c.user_group.users_group_repo_to_perm),
+            key=lambda u: u.repo_name.lower())
+
+        c.group_to_repo_groups = sorted(
+            (x.group for x in c.user_group.users_group_repo_group_to_perm),
+            key=lambda u: u.group_name.lower())
+
+        c.group_to_review_rules = sorted(
+            (x.users_group for x in c.user_group.user_group_review_rules),
+            key=lambda u: u.users_group_name.lower())
+
+        return self._get_template_context(c)
+
+    @LoginRequired()
+    @HasUserGroupPermissionAnyDecorator('usergroup.admin')
+    @CSRFRequired()
+    @view_config(
+        route_name='edit_user_group_advanced_sync', request_method='POST',
+        renderer='rhodecode:templates/admin/user_groups/user_group_edit.mako')
+    def user_group_edit_advanced_set_synchronization(self):
+        _ = self.request.translate
+        user_group = self.db_user_group
+        user_group_id = user_group.users_group_id
+
+        existing = user_group.group_data.get('extern_type')
+
+        if existing:
+            new_state = user_group.group_data
+            new_state['extern_type'] = None
+        else:
+            new_state = user_group.group_data
+            new_state['extern_type'] = 'manual'
+            new_state['extern_type_set_by'] = self._rhodecode_user.username
+
+        try:
+            user_group.group_data = new_state
+            Session().add(user_group)
+            Session().commit()
+
+            h.flash(_('User Group synchronization updated successfully'),
+                    category='success')
+        except Exception:
+            log.exception("Exception during sync settings saving")
+            h.flash(_('An error occurred during synchronization update'),
+                    category='error')
+
+        raise HTTPFound(
+            h.route_path('edit_user_group_advanced',
+                         user_group_id=user_group_id))

rhodecode/apps/_base/__init__.py

@@ -1,471 +1,508 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2016-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import time
 import logging
 import operator
 
 from pyramid.httpexceptions import HTTPFound
 
 from rhodecode.lib import helpers as h
 from rhodecode.lib.utils2 import StrictAttributeDict, safe_int, datetime_to_time
 from rhodecode.lib.vcs.exceptions import RepositoryRequirementError
 from rhodecode.model import repo
 from rhodecode.model import repo_group
+from rhodecode.model import user_group
 from rhodecode.model.db import User
 from rhodecode.model.scm import ScmModel
 
 log = logging.getLogger(__name__)
 
 
 ADMIN_PREFIX = '/_admin'
 STATIC_FILE_PREFIX = '/_static'
 
 URL_NAME_REQUIREMENTS = {
     # group name can have a slash in them, but they must not end with a slash
     'group_name': r'.*?[^/]',
     'repo_group_name': r'.*?[^/]',
     # repo names can have a slash in them, but they must not end with a slash
     'repo_name': r'.*?[^/]',
     # file path eats up everything at the end
     'f_path': r'.*',
     # reference types
     'source_ref_type': '(branch|book|tag|rev|\%\(source_ref_type\)s)',
     'target_ref_type': '(branch|book|tag|rev|\%\(target_ref_type\)s)',
 }
 
 
 def add_route_with_slash(config,name, pattern, **kw):
     config.add_route(name, pattern, **kw)
     if not pattern.endswith('/'):
         config.add_route(name + '_slash', pattern + '/', **kw)
 
 
 def add_route_requirements(route_path, requirements=URL_NAME_REQUIREMENTS):
     """
     Adds regex requirements to pyramid routes using a mapping dict
     e.g::
         add_route_requirements('{repo_name}/settings')
     """
     for key, regex in requirements.items():
         route_path = route_path.replace('{%s}' % key, '{%s:%s}' % (key, regex))
     return route_path
 
 
 def get_format_ref_id(repo):
     """Returns a `repo` specific reference formatter function"""
     if h.is_svn(repo):
         return _format_ref_id_svn
     else:
         return _format_ref_id
 
 
 def _format_ref_id(name, raw_id):
     """Default formatting of a given reference `name`"""
     return name
 
 
 def _format_ref_id_svn(name, raw_id):
     """Special way of formatting a reference for Subversion including path"""
     return '%s@%s' % (name, raw_id)
 
 
 class TemplateArgs(StrictAttributeDict):
     pass
 
 
 class BaseAppView(object):
 
     def __init__(self, context, request):
         self.request = request
         self.context = context
         self.session = request.session
         self._rhodecode_user = request.user  # auth user
         self._rhodecode_db_user = self._rhodecode_user.get_instance()
         self._maybe_needs_password_change(
             request.matched_route.name, self._rhodecode_db_user)
 
     def _maybe_needs_password_change(self, view_name, user_obj):
         log.debug('Checking if user %s needs password change on view %s',
                   user_obj, view_name)
         skip_user_views = [
             'logout', 'login',
             'my_account_password', 'my_account_password_update'
         ]
 
         if not user_obj:
             return
 
         if user_obj.username == User.DEFAULT_USER:
             return
 
         now = time.time()
         should_change = user_obj.user_data.get('force_password_change')
         change_after = safe_int(should_change) or 0
         if should_change and now > change_after:
             log.debug('User %s requires password change', user_obj)
             h.flash('You are required to change your password', 'warning',
                     ignore_duplicate=True)
 
             if view_name not in skip_user_views:
                 raise HTTPFound(
                     self.request.route_path('my_account_password'))
 
     def _log_creation_exception(self, e, repo_name):
         _ = self.request.translate
         reason = None
         if len(e.args) == 2:
             reason = e.args[1]
 
         if reason == 'INVALID_CERTIFICATE':
             log.exception(
                 'Exception creating a repository: invalid certificate')
             msg = (_('Error creating repository %s: invalid certificate')
                    % repo_name)
         else:
             log.exception("Exception creating a repository")
             msg = (_('Error creating repository %s')
                    % repo_name)
         return msg
 
     def _get_local_tmpl_context(self, include_app_defaults=False):
         c = TemplateArgs()
         c.auth_user = self.request.user
         # TODO(marcink): migrate the usage of c.rhodecode_user to c.auth_user
         c.rhodecode_user = self.request.user
 
         if include_app_defaults:
             # NOTE(marcink): after full pyramid migration include_app_defaults
             # should be turned on by default
             from rhodecode.lib.base import attach_context_attributes
             attach_context_attributes(c, self.request, self.request.user.user_id)
 
         return c
 
     def _register_global_c(self, tmpl_args):
         """
         Registers attributes to pylons global `c`
         """
 
         # TODO(marcink): remove once pyramid migration is finished
         from pylons import tmpl_context as c
         try:
             for k, v in tmpl_args.items():
                 setattr(c, k, v)
         except TypeError:
             log.exception('Failed to register pylons C')
             pass
 
     def _get_template_context(self, tmpl_args):
         self._register_global_c(tmpl_args)
 
         local_tmpl_args = {
             'defaults': {},
             'errors': {},
             # register a fake 'c' to be used in templates instead of global
             # pylons c, after migration to pyramid we should rename it to 'c'
             # make sure we replace usage of _c in templates too
             '_c': tmpl_args
         }
         local_tmpl_args.update(tmpl_args)
         return local_tmpl_args
 
     def load_default_context(self):
         """
         example:
 
         def load_default_context(self):
             c = self._get_local_tmpl_context()
             c.custom_var = 'foobar'
             self._register_global_c(c)
             return c
         """
         raise NotImplementedError('Needs implementation in view class')
 
 
 class RepoAppView(BaseAppView):
 
     def __init__(self, context, request):
         super(RepoAppView, self).__init__(context, request)
         self.db_repo = request.db_repo
         self.db_repo_name = self.db_repo.repo_name
         self.db_repo_pull_requests = ScmModel().get_pull_requests(self.db_repo)
 
     def _handle_missing_requirements(self, error):
         log.error(
             'Requirements are missing for repository %s: %s',
             self.db_repo_name, error.message)
 
     def _get_local_tmpl_context(self, include_app_defaults=False):
         _ = self.request.translate
         c = super(RepoAppView, self)._get_local_tmpl_context(
             include_app_defaults=include_app_defaults)
 
         # register common vars for this type of view
         c.rhodecode_db_repo = self.db_repo
         c.repo_name = self.db_repo_name
         c.repository_pull_requests = self.db_repo_pull_requests
 
         c.repository_requirements_missing = False
         try:
             self.rhodecode_vcs_repo = self.db_repo.scm_instance()
         except RepositoryRequirementError as e:
             c.repository_requirements_missing = True
             self._handle_missing_requirements(e)
             self.rhodecode_vcs_repo = None
 
         if (not c.repository_requirements_missing
             and self.rhodecode_vcs_repo is None):
             # unable to fetch this repo as vcs instance, report back to user
             h.flash(_(
                 "The repository `%(repo_name)s` cannot be loaded in filesystem. "
                 "Please check if it exist, or is not damaged.") %
                     {'repo_name': c.repo_name},
                     category='error', ignore_duplicate=True)
             raise HTTPFound(h.route_path('home'))
 
         return c
 
     def _get_f_path(self, matchdict, default=None):
         f_path = matchdict.get('f_path')
         if f_path:
             # fix for multiple initial slashes that causes errors for GIT
             return f_path.lstrip('/')
 
         return default
 
 
 class RepoGroupAppView(BaseAppView):
     def __init__(self, context, request):
         super(RepoGroupAppView, self).__init__(context, request)
         self.db_repo_group = request.db_repo_group
         self.db_repo_group_name = self.db_repo_group.group_name
 
 
+class UserGroupAppView(BaseAppView):
+    def __init__(self, context, request):
+        super(UserGroupAppView, self).__init__(context, request)
+        self.db_user_group = request.db_user_group
+        self.db_user_group_name = self.db_user_group.users_group_name
+
+
 class DataGridAppView(object):
     """
     Common class to have re-usable grid rendering components
     """
 
     def _extract_ordering(self, request, column_map=None):
         column_map = column_map or {}
         column_index = safe_int(request.GET.get('order[0][column]'))
         order_dir = request.GET.get(
             'order[0][dir]', 'desc')
         order_by = request.GET.get(
             'columns[%s][data][sort]' % column_index, 'name_raw')
 
         # translate datatable to DB columns
         order_by = column_map.get(order_by) or order_by
 
         search_q = request.GET.get('search[value]')
         return search_q, order_by, order_dir
 
     def _extract_chunk(self, request):
         start = safe_int(request.GET.get('start'), 0)
         length = safe_int(request.GET.get('length'), 25)
         draw = safe_int(request.GET.get('draw'))
         return draw, start, length
 
     def _get_order_col(self, order_by, model):
         if isinstance(order_by, basestring):
             try:
                 return operator.attrgetter(order_by)(model)
             except AttributeError:
                 return None
         else:
             return order_by
 
 
 class BaseReferencesView(RepoAppView):
     """
     Base for reference view for branches, tags and bookmarks.
     """
     def load_default_context(self):
         c = self._get_local_tmpl_context()
 
         # TODO(marcink): remove repo_info and use c.rhodecode_db_repo instead
         c.repo_info = self.db_repo
 
         self._register_global_c(c)
         return c
 
     def load_refs_context(self, ref_items, partials_template):
         _render = self.request.get_partial_renderer(partials_template)
         pre_load = ["author", "date", "message"]
 
         is_svn = h.is_svn(self.rhodecode_vcs_repo)
         is_hg = h.is_hg(self.rhodecode_vcs_repo)
 
         format_ref_id = get_format_ref_id(self.rhodecode_vcs_repo)
 
         closed_refs = {}
         if is_hg:
             closed_refs = self.rhodecode_vcs_repo.branches_closed
 
         data = []
         for ref_name, commit_id in ref_items:
             commit = self.rhodecode_vcs_repo.get_commit(
                 commit_id=commit_id, pre_load=pre_load)
             closed = ref_name in closed_refs
 
             # TODO: johbo: Unify generation of reference links
             use_commit_id = '/' in ref_name or is_svn
 
             if use_commit_id:
                 files_url = h.route_path(
                     'repo_files',
                     repo_name=self.db_repo_name,
                     f_path=ref_name if is_svn else '',
                     commit_id=commit_id)
 
             else:
                 files_url = h.route_path(
                     'repo_files',
                     repo_name=self.db_repo_name,
                     f_path=ref_name if is_svn else '',
                     commit_id=ref_name,
                     _query=dict(at=ref_name))
 
             data.append({
                 "name": _render('name', ref_name, files_url, closed),
                 "name_raw": ref_name,
                 "date": _render('date', commit.date),
                 "date_raw": datetime_to_time(commit.date),
                 "author": _render('author', commit.author),
                 "commit": _render(
                     'commit', commit.message, commit.raw_id, commit.idx),
                 "commit_raw": commit.idx,
                 "compare": _render(
                     'compare', format_ref_id(ref_name, commit.raw_id)),
             })
 
         return data
 
 
 class RepoRoutePredicate(object):
     def __init__(self, val, config):
         self.val = val
 
     def text(self):
         return 'repo_route = %s' % self.val
 
     phash = text
 
     def __call__(self, info, request):
 
         if hasattr(request, 'vcs_call'):
             # skip vcs calls
             return
 
         repo_name = info['match']['repo_name']
         repo_model = repo.RepoModel()
         by_name_match = repo_model.get_by_repo_name(repo_name, cache=True)
 
         def redirect_if_creating(db_repo):
             if db_repo.repo_state in [repo.Repository.STATE_PENDING]:
                 raise HTTPFound(
                     request.route_path('repo_creating',
                                        repo_name=db_repo.repo_name))
 
         if by_name_match:
             # register this as request object we can re-use later
             request.db_repo = by_name_match
             redirect_if_creating(by_name_match)
             return True
 
         by_id_match = repo_model.get_repo_by_id(repo_name)
         if by_id_match:
             request.db_repo = by_id_match
             redirect_if_creating(by_id_match)
             return True
 
         return False
 
 
 class RepoTypeRoutePredicate(object):
     def __init__(self, val, config):
         self.val = val or ['hg', 'git', 'svn']
 
     def text(self):
         return 'repo_accepted_type = %s' % self.val
 
     phash = text
 
     def __call__(self, info, request):
         if hasattr(request, 'vcs_call'):
             # skip vcs calls
             return
 
         rhodecode_db_repo = request.db_repo
 
         log.debug(
             '%s checking repo type for %s in %s',
             self.__class__.__name__, rhodecode_db_repo.repo_type, self.val)
 
         if rhodecode_db_repo.repo_type in self.val:
             return True
         else:
             log.warning('Current view is not supported for repo type:%s',
                         rhodecode_db_repo.repo_type)
             #
             # h.flash(h.literal(
             #     _('Action not supported for %s.' % rhodecode_repo.alias)),
             #     category='warning')
             # return redirect(
             #     route_path('repo_summary', repo_name=cls.rhodecode_db_repo.repo_name))
 
             return False
 
 
 class RepoGroupRoutePredicate(object):
     def __init__(self, val, config):
         self.val = val
 
     def text(self):
         return 'repo_group_route = %s' % self.val
 
     phash = text
 
     def __call__(self, info, request):
         if hasattr(request, 'vcs_call'):
             # skip vcs calls
             return
 
         repo_group_name = info['match']['repo_group_name']
         repo_group_model = repo_group.RepoGroupModel()
         by_name_match = repo_group_model.get_by_group_name(
             repo_group_name, cache=True)
 
         if by_name_match:
             # register this as request object we can re-use later
             request.db_repo_group = by_name_match
             return True
 
         return False
 
 
+class UserGroupRoutePredicate(object):
+    def __init__(self, val, config):
+        self.val = val
+
+    def text(self):
+        return 'user_group_route = %s' % self.val
+
+    phash = text
+
+    def __call__(self, info, request):
+        if hasattr(request, 'vcs_call'):
+            # skip vcs calls
+            return
+
+        user_group_id = info['match']['user_group_id']
+        user_group_model = user_group.UserGroup()
+        by_name_match = user_group_model.get(
+            user_group_id, cache=True)
+
+        if by_name_match:
+            # register this as request object we can re-use later
+            request.db_user_group = by_name_match
+            return True
+
+        return False
+
+
 def includeme(config):
     config.add_route_predicate(
         'repo_route', RepoRoutePredicate)
     config.add_route_predicate(
         'repo_accepted_types', RepoTypeRoutePredicate)
     config.add_route_predicate(
         'repo_group_route', RepoGroupRoutePredicate)
+    config.add_route_predicate(
+        'user_group_route', UserGroupRoutePredicate)

rhodecode/apps/admin/__init__.py

@@ -1,245 +1,241 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2016-2017  RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 
 from rhodecode.apps.admin.navigation import NavigationRegistry
 from rhodecode.config.routing import ADMIN_PREFIX
 from rhodecode.lib.utils2 import str2bool
 
 
 def admin_routes(config):
     """
     Admin prefixed routes
     """
 
     config.add_route(
         name='admin_audit_logs',
         pattern='/audit_logs')
 
     config.add_route(
         name='pull_requests_global_0',  # backward compat
         pattern='/pull_requests/{pull_request_id:\d+}')
     config.add_route(
         name='pull_requests_global_1',  # backward compat
         pattern='/pull-requests/{pull_request_id:\d+}')
     config.add_route(
         name='pull_requests_global',
         pattern='/pull-request/{pull_request_id:\d+}')
 
     config.add_route(
         name='admin_settings_open_source',
         pattern='/settings/open_source')
     config.add_route(
         name='admin_settings_vcs_svn_generate_cfg',
         pattern='/settings/vcs/svn_generate_cfg')
 
     config.add_route(
         name='admin_settings_system',
         pattern='/settings/system')
     config.add_route(
         name='admin_settings_system_update',
         pattern='/settings/system/updates')
 
     config.add_route(
         name='admin_settings_sessions',
         pattern='/settings/sessions')
     config.add_route(
         name='admin_settings_sessions_cleanup',
         pattern='/settings/sessions/cleanup')
 
     config.add_route(
         name='admin_settings_process_management',
         pattern='/settings/process_management')
     config.add_route(
         name='admin_settings_process_management_signal',
         pattern='/settings/process_management/signal')
 
     # global permissions
 
     config.add_route(
         name='admin_permissions_application',
         pattern='/permissions/application')
     config.add_route(
         name='admin_permissions_application_update',
         pattern='/permissions/application/update')
 
     config.add_route(
         name='admin_permissions_global',
         pattern='/permissions/global')
     config.add_route(
         name='admin_permissions_global_update',
         pattern='/permissions/global/update')
 
     config.add_route(
         name='admin_permissions_object',
         pattern='/permissions/object')
     config.add_route(
         name='admin_permissions_object_update',
         pattern='/permissions/object/update')
 
     config.add_route(
         name='admin_permissions_ips',
         pattern='/permissions/ips')
 
     config.add_route(
         name='admin_permissions_overview',
         pattern='/permissions/overview')
 
     config.add_route(
         name='admin_permissions_auth_token_access',
         pattern='/permissions/auth_token_access')
 
     config.add_route(
         name='admin_permissions_ssh_keys',
         pattern='/permissions/ssh_keys')
     config.add_route(
         name='admin_permissions_ssh_keys_data',
         pattern='/permissions/ssh_keys/data')
     config.add_route(
         name='admin_permissions_ssh_keys_update',
         pattern='/permissions/ssh_keys/update')
 
     # users admin
     config.add_route(
         name='users',
         pattern='/users')
 
     config.add_route(
         name='users_data',
         pattern='/users_data')
 
     # user auth tokens
     config.add_route(
         name='edit_user_auth_tokens',
         pattern='/users/{user_id:\d+}/edit/auth_tokens')
     config.add_route(
         name='edit_user_auth_tokens_add',
         pattern='/users/{user_id:\d+}/edit/auth_tokens/new')
     config.add_route(
         name='edit_user_auth_tokens_delete',
         pattern='/users/{user_id:\d+}/edit/auth_tokens/delete')
 
     # user ssh keys
     config.add_route(
         name='edit_user_ssh_keys',
         pattern='/users/{user_id:\d+}/edit/ssh_keys')
     config.add_route(
         name='edit_user_ssh_keys_generate_keypair',
         pattern='/users/{user_id:\d+}/edit/ssh_keys/generate')
     config.add_route(
         name='edit_user_ssh_keys_add',
         pattern='/users/{user_id:\d+}/edit/ssh_keys/new')
     config.add_route(
         name='edit_user_ssh_keys_delete',
         pattern='/users/{user_id:\d+}/edit/ssh_keys/delete')
 
     # user emails
     config.add_route(
         name='edit_user_emails',
         pattern='/users/{user_id:\d+}/edit/emails')
     config.add_route(
         name='edit_user_emails_add',
         pattern='/users/{user_id:\d+}/edit/emails/new')
     config.add_route(
         name='edit_user_emails_delete',
         pattern='/users/{user_id:\d+}/edit/emails/delete')
 
     # user IPs
     config.add_route(
         name='edit_user_ips',
         pattern='/users/{user_id:\d+}/edit/ips')
     config.add_route(
         name='edit_user_ips_add',
         pattern='/users/{user_id:\d+}/edit/ips/new')
     config.add_route(
         name='edit_user_ips_delete',
         pattern='/users/{user_id:\d+}/edit/ips/delete')
 
     # user perms
     config.add_route(
         name='edit_user_perms_summary',
         pattern='/users/{user_id:\d+}/edit/permissions_summary')
     config.add_route(
         name='edit_user_perms_summary_json',
         pattern='/users/{user_id:\d+}/edit/permissions_summary/json')
 
-    # user groups management
+    # user user groups management
     config.add_route(
         name='edit_user_groups_management',
         pattern='/users/{user_id:\d+}/edit/groups_management')
 
     config.add_route(
         name='edit_user_groups_management_updates',
         pattern='/users/{user_id:\d+}/edit/edit_user_groups_management/updates')
 
     # user audit logs
     config.add_route(
         name='edit_user_audit_logs',
         pattern='/users/{user_id:\d+}/edit/audit')
 
-    # user groups admin
+    # user-groups admin
     config.add_route(
         name='user_groups',
         pattern='/user_groups')
 
     config.add_route(
         name='user_groups_data',
         pattern='/user_groups_data')
 
     config.add_route(
-        name='user_group_members_data',
-        pattern='/user_groups/{user_group_id:\d+}/members')
+        name='user_groups_new',
+        pattern='/user_groups/new')
 
-    # user groups perms
     config.add_route(
-        name='edit_user_group_perms_summary',
-        pattern='/user_groups/{user_group_id:\d+}/edit/permissions_summary')
-    config.add_route(
-        name='edit_user_group_perms_summary_json',
-        pattern='/user_groups/{user_group_id:\d+}/edit/permissions_summary/json')
+        name='user_groups_create',
+        pattern='/user_groups/create')
 
     # repos admin
     config.add_route(
         name='repos',
         pattern='/repos')
 
     config.add_route(
         name='repo_new',
         pattern='/repos/new')
 
     config.add_route(
         name='repo_create',
         pattern='/repos/create')
 
 
 def includeme(config):
     settings = config.get_settings()
 
     # Create admin navigation registry and add it to the pyramid registry.
     labs_active = str2bool(settings.get('labs_settings_active', False))
     navigation_registry = NavigationRegistry(labs_active=labs_active)
     config.registry.registerUtility(navigation_registry)
 
     # main admin routes
     config.add_route(name='admin_home', pattern=ADMIN_PREFIX)
     config.include(admin_routes, route_prefix=ADMIN_PREFIX)
 
     # Scan module for configuration decorators.
     config.scan('.views', ignore='.tests')

rhodecode/apps/admin/tests/test_admin_user_groups.py

@@ -1,113 +1,170 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import pytest
 
 from rhodecode.model.db import UserGroup, User
 from rhodecode.model.meta import Session
 
 from rhodecode.tests import (
     TestController, TEST_USER_REGULAR_LOGIN, assert_session_flash)
 from rhodecode.tests.fixture import Fixture
 
 fixture = Fixture()
 
 
 def route_path(name, params=None, **kwargs):
     import urllib
     from rhodecode.apps._base import ADMIN_PREFIX
 
     base_url = {
         'user_groups': ADMIN_PREFIX + '/user_groups',
         'user_groups_data': ADMIN_PREFIX + '/user_groups_data',
         'user_group_members_data': ADMIN_PREFIX + '/user_groups/{user_group_id}/members',
+        'user_groups_new': ADMIN_PREFIX + '/user_groups/new',
+        'user_groups_create': ADMIN_PREFIX + '/user_groups/create',
+        'edit_user_group': ADMIN_PREFIX + '/user_groups/{user_group_id}/edit',
     }[name].format(**kwargs)
 
     if params:
         base_url = '{}?{}'.format(base_url, urllib.urlencode(params))
     return base_url
 
 
 class TestAdminUserGroupsView(TestController):
 
     def test_show_users(self):
         self.log_user()
         self.app.get(route_path('user_groups'))
 
     def test_show_user_groups_data(self, xhr_header):
         self.log_user()
         response = self.app.get(route_path(
             'user_groups_data'), extra_environ=xhr_header)
 
         all_user_groups = UserGroup.query().count()
         assert response.json['recordsTotal'] == all_user_groups
 
     def test_show_user_groups_data_filtered(self, xhr_header):
         self.log_user()
         response = self.app.get(route_path(
             'user_groups_data', params={'search[value]': 'empty_search'}),
             extra_environ=xhr_header)
 
         all_user_groups = UserGroup.query().count()
         assert response.json['recordsTotal'] == all_user_groups
         assert response.json['recordsFiltered'] == 0
 
     def test_usergroup_escape(self, user_util, xhr_header):
         self.log_user()
 
         xss_img = '<img src="/image1" onload="alert(\'Hello, World!\');">'
         user = user_util.create_user()
         user.name = xss_img
         user.lastname = xss_img
         Session().add(user)
         Session().commit()
 
         user_group = user_util.create_user_group()
 
         user_group.users_group_name = xss_img
         user_group.user_group_description = '<strong onload="alert();">DESC</strong>'
 
         response = self.app.get(
             route_path('user_groups_data'), extra_environ=xhr_header)
 
         response.mustcontain(
             '&lt;strong onload=&#34;alert();&#34;&gt;DESC&lt;/strong&gt;')
         response.mustcontain(
             '&lt;img src=&#34;/image1&#34; onload=&#34;'
             'alert(&#39;Hello, World!&#39;);&#34;&gt;')
 
     def test_edit_user_group_autocomplete_empty_members(self, xhr_header, user_util):
         self.log_user()
         ug = user_util.create_user_group()
         response = self.app.get(
             route_path('user_group_members_data', user_group_id=ug.users_group_id),
             extra_environ=xhr_header)
 
         assert response.json == {'members': []}
 
     def test_edit_user_group_autocomplete_members(self, xhr_header, user_util):
         self.log_user()
         members = [u.user_id for u in User.get_all()]
         ug = user_util.create_user_group(members=members)
         response = self.app.get(
-            route_path('user_group_members_data', user_group_id=ug.users_group_id),
+            route_path('user_group_members_data',
+                       user_group_id=ug.users_group_id),
             extra_environ=xhr_header)
 
         assert len(response.json['members']) == len(members)
+
+    def test_creation_page(self):
+        self.log_user()
+        self.app.get(route_path('user_groups_new'), status=200)
+
+    def test_create(self):
+        from rhodecode.lib import helpers as h
+
+        self.log_user()
+        users_group_name = 'test_user_group'
+        response = self.app.post(route_path('user_groups_create'), {
+            'users_group_name': users_group_name,
+            'user_group_description': 'DESC',
+            'active': True,
+            'csrf_token': self.csrf_token})
+
+        user_group_id = UserGroup.get_by_group_name(
+            users_group_name).users_group_id
+
+        user_group_link = h.link_to(
+            users_group_name,
+            route_path('edit_user_group', user_group_id=user_group_id))
+
+        assert_session_flash(
+            response,
+            'Created user group %s' % user_group_link)
+
+        fixture.destroy_user_group(users_group_name)
+
+    def test_create_with_empty_name(self):
+        self.log_user()
+
+        response = self.app.post(route_path('user_groups_create'), {
+            'users_group_name': '',
+            'user_group_description': 'DESC',
+            'active': True,
+            'csrf_token': self.csrf_token}, status=200)
+
+        response.mustcontain('Please enter a value')
+
+    def test_create_duplicate(self, user_util):
+        self.log_user()
+
+        user_group = user_util.create_user_group()
+        duplicate_name = user_group.users_group_name
+        response = self.app.post(route_path('user_groups_create'), {
+            'users_group_name': duplicate_name,
+            'user_group_description': 'DESC',
+            'active': True,
+            'csrf_token': self.csrf_token}, status=200)
+
+        response.mustcontain(
+            'User group `{}` already exists'.format(user_group.users_group_name))

rhodecode/apps/admin/views/user_groups.py

@@ -1,256 +1,247 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2016-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import logging
 
+import formencode
+import formencode.htmlfill
+
 from pyramid.httpexceptions import HTTPFound
 from pyramid.view import view_config
-
-from rhodecode.model.scm import UserGroupList
+from pyramid.response import Response
+from pyramid.renderers import render
 
 from rhodecode.apps._base import BaseAppView, DataGridAppView
 from rhodecode.lib.auth import (
-    LoginRequired, NotAnonymous,
-    HasUserGroupPermissionAnyDecorator)
-from rhodecode.lib import helpers as h
+    LoginRequired, NotAnonymous, CSRFRequired, HasPermissionAnyDecorator)
+from rhodecode.lib import helpers as h, audit_logger
 from rhodecode.lib.utils import PartialRenderer
 from rhodecode.lib.utils2 import safe_unicode
+
+from rhodecode.model.forms import UserGroupForm
+from rhodecode.model.permission import PermissionModel
+from rhodecode.model.scm import UserGroupList
 from rhodecode.model.db import (
-    joinedload, or_, count, User, UserGroup, UserGroupMember,
-    UserGroupRepoToPerm, UserGroupRepoGroupToPerm)
+    or_, count, User, UserGroup, UserGroupMember)
 from rhodecode.model.meta import Session
+from rhodecode.model.user_group import UserGroupModel
 
 log = logging.getLogger(__name__)
 
 
 class AdminUserGroupsView(BaseAppView, DataGridAppView):
 
     def load_default_context(self):
         c = self._get_local_tmpl_context()
+
+        PermissionModel().set_global_permission_choices(
+            c, gettext_translator=self.request.translate)
+
         self._register_global_c(c)
         return c
 
     # permission check in data loading of
     # `user_groups_list_data` via UserGroupList
     @LoginRequired()
     @NotAnonymous()
     @view_config(
         route_name='user_groups', request_method='GET',
         renderer='rhodecode:templates/admin/user_groups/user_groups.mako')
     def user_groups_list(self):
         c = self.load_default_context()
         return self._get_template_context(c)
 
     # permission check inside
     @LoginRequired()
     @NotAnonymous()
     @view_config(
         route_name='user_groups_data', request_method='GET',
         renderer='json_ext', xhr=True)
     def user_groups_list_data(self):
         column_map = {
             'active': 'users_group_active',
             'description': 'user_group_description',
             'members': 'members_total',
             'owner': 'user_username',
             'sync': 'group_data'
         }
         draw, start, limit = self._extract_chunk(self.request)
         search_q, order_by, order_dir = self._extract_ordering(
             self.request, column_map=column_map)
 
         _render = PartialRenderer('data_table/_dt_elements.mako')
 
         def user_group_name(user_group_id, user_group_name):
             return _render("user_group_name", user_group_id, user_group_name)
 
         def user_group_actions(user_group_id, user_group_name):
             return _render("user_group_actions", user_group_id, user_group_name)
 
         def user_profile(username):
             return _render('user_profile', username)
 
         auth_user_group_list = UserGroupList(
             UserGroup.query().all(), perm_set=['usergroup.admin'])
 
         allowed_ids = []
         for user_group in auth_user_group_list:
                 allowed_ids.append(user_group.users_group_id)
 
         user_groups_data_total_count = UserGroup.query()\
             .filter(UserGroup.users_group_id.in_(allowed_ids))\
             .count()
 
         member_count = count(UserGroupMember.user_id)
         base_q = Session.query(
             UserGroup.users_group_name,
             UserGroup.user_group_description,
             UserGroup.users_group_active,
             UserGroup.users_group_id,
             UserGroup.group_data,
             User,
             member_count.label('member_count')
         ) \
         .filter(UserGroup.users_group_id.in_(allowed_ids)) \
         .outerjoin(UserGroupMember) \
         .join(User, User.user_id == UserGroup.user_id) \
         .group_by(UserGroup, User)
 
         if search_q:
             like_expression = u'%{}%'.format(safe_unicode(search_q))
             base_q = base_q.filter(or_(
                 UserGroup.users_group_name.ilike(like_expression),
             ))
 
         user_groups_data_total_filtered_count = base_q.count()
 
         if order_by == 'members_total':
             sort_col = member_count
         elif order_by == 'user_username':
             sort_col = User.username
         else:
             sort_col = getattr(UserGroup, order_by, None)
 
         if isinstance(sort_col, count) or sort_col:
             if order_dir == 'asc':
                 sort_col = sort_col.asc()
             else:
                 sort_col = sort_col.desc()
 
         base_q = base_q.order_by(sort_col)
         base_q = base_q.offset(start).limit(limit)
 
         # authenticated access to user groups
         auth_user_group_list = base_q.all()
 
         user_groups_data = []
         for user_gr in auth_user_group_list:
             user_groups_data.append({
                 "users_group_name": user_group_name(
                     user_gr.users_group_id, h.escape(user_gr.users_group_name)),
                 "name_raw": h.escape(user_gr.users_group_name),
                 "description": h.escape(user_gr.user_group_description),
                 "members": user_gr.member_count,
                 # NOTE(marcink): because of advanced query we
                 # need to load it like that
                 "sync": UserGroup._load_group_data(
                     user_gr.group_data).get('extern_type'),
                 "active": h.bool2icon(user_gr.users_group_active),
                 "owner": user_profile(user_gr.User.username),
                 "action": user_group_actions(
                     user_gr.users_group_id, user_gr.users_group_name)
             })
 
         data = ({
             'draw': draw,
             'data': user_groups_data,
             'recordsTotal': user_groups_data_total_count,
             'recordsFiltered': user_groups_data_total_filtered_count,
         })
 
         return data
 
     @LoginRequired()
-    @HasUserGroupPermissionAnyDecorator('usergroup.admin')
+    @HasPermissionAnyDecorator('hg.admin', 'hg.usergroup.create.true')
     @view_config(
-        route_name='user_group_members_data', request_method='GET',
-        renderer='json_ext', xhr=True)
-    def user_group_members(self):
-        """
-        Return members of given user group
-        """
-        user_group_id = self.request.matchdict['user_group_id']
-        user_group = UserGroup.get_or_404(user_group_id)
-        group_members_obj = sorted((x.user for x in user_group.members),
-                                   key=lambda u: u.username.lower())
-
-        group_members = [
-            {
-                'id': user.user_id,
-                'first_name': user.first_name,
-                'last_name': user.last_name,
-                'username': user.username,
-                'icon_link': h.gravatar_url(user.email, 30),
-                'value_display': h.person(user.email),
-                'value': user.username,
-                'value_type': 'user',
-                'active': user.active,
-            }
-            for user in group_members_obj
-        ]
-
-        return {
-            'members': group_members
-        }
-
-    def _get_perms_summary(self, user_group_id):
-        permissions = {
-            'repositories': {},
-            'repositories_groups': {},
-        }
-        ugroup_repo_perms = UserGroupRepoToPerm.query()\
-            .options(joinedload(UserGroupRepoToPerm.permission))\
-            .options(joinedload(UserGroupRepoToPerm.repository))\
-            .filter(UserGroupRepoToPerm.users_group_id == user_group_id)\
-            .all()
-
-        for gr in ugroup_repo_perms:
-            permissions['repositories'][gr.repository.repo_name]  \
-                = gr.permission.permission_name
-
-        ugroup_group_perms = UserGroupRepoGroupToPerm.query()\
-            .options(joinedload(UserGroupRepoGroupToPerm.permission))\
-            .options(joinedload(UserGroupRepoGroupToPerm.group))\
-            .filter(UserGroupRepoGroupToPerm.users_group_id == user_group_id)\
-            .all()
-
-        for gr in ugroup_group_perms:
-            permissions['repositories_groups'][gr.group.group_name] \
-                = gr.permission.permission_name
-        return permissions
-
-    @LoginRequired()
-    @HasUserGroupPermissionAnyDecorator('usergroup.admin')
-    @view_config(
-        route_name='edit_user_group_perms_summary', request_method='GET',
-        renderer='rhodecode:templates/admin/user_groups/user_group_edit.mako')
-    def user_group_perms_summary(self):
+        route_name='user_groups_new', request_method='GET',
+        renderer='rhodecode:templates/admin/user_groups/user_group_add.mako')
+    def user_groups_new(self):
         c = self.load_default_context()
-
-        user_group_id = self.request.matchdict.get('user_group_id')
-        c.user_group = UserGroup.get_or_404(user_group_id)
-
-        c.active = 'perms_summary'
-
-        c.permissions = self._get_perms_summary(c.user_group.users_group_id)
         return self._get_template_context(c)
 
     @LoginRequired()
-    @HasUserGroupPermissionAnyDecorator('usergroup.admin')
+    @HasPermissionAnyDecorator('hg.admin', 'hg.usergroup.create.true')
+    @CSRFRequired()
     @view_config(
-        route_name='edit_user_group_perms_summary_json', request_method='GET',
-        renderer='json_ext')
-    def user_group_perms_summary_json(self):
-        self.load_default_context()
+        route_name='user_groups_create', request_method='POST',
+        renderer='rhodecode:templates/admin/user_groups/user_group_add.mako')
+    def user_groups_create(self):
+        _ = self.request.translate
+        c = self.load_default_context()
+        users_group_form = UserGroupForm()()
+
+        user_group_name = self.request.POST.get('users_group_name')
+        try:
+            form_result = users_group_form.to_python(dict(self.request.POST))
+            user_group = UserGroupModel().create(
+                name=form_result['users_group_name'],
+                description=form_result['user_group_description'],
+                owner=self._rhodecode_user.user_id,
+                active=form_result['users_group_active'])
+            Session().flush()
+            creation_data = user_group.get_api_data()
+            user_group_name = form_result['users_group_name']
+
+            audit_logger.store_web(
+                'user_group.create', action_data={'data': creation_data},
+                user=self._rhodecode_user)
 
-        user_group_id = self.request.matchdict.get('user_group_id')
-        user_group = UserGroup.get_or_404(user_group_id)
+            user_group_link = h.link_to(
+                h.escape(user_group_name),
+                h.route_path(
+                    'edit_user_group', user_group_id=user_group.users_group_id))
+            h.flash(h.literal(_('Created user group %(user_group_link)s')
+                              % {'user_group_link': user_group_link}),
+                    category='success')
+            Session().commit()
+            user_group_id = user_group.users_group_id
+        except formencode.Invalid as errors:
 
-        return self._get_perms_summary(user_group.users_group_id)
+            data = render(
+                'rhodecode:templates/admin/user_groups/user_group_add.mako',
+                self._get_template_context(c), self.request)
+            html = formencode.htmlfill.render(
+                data,
+                defaults=errors.value,
+                errors=errors.error_dict or {},
+                prefix_error=False,
+                encoding="UTF-8",
+                force_defaults=False
+            )
+            return Response(html)
+
+        except Exception:
+            log.exception("Exception creating user group")
+            h.flash(_('Error occurred during creation of user group %s') \
+                    % user_group_name, category='error')
+            raise HTTPFound(h.route_path('user_groups_new'))
+
+        raise HTTPFound(
+            h.route_path('edit_user_group', user_group_id=user_group_id))

rhodecode/apps/user_group/tests/test_user_groups.py

@@ -1,225 +1,254 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import pytest
 
 from rhodecode.tests import (
-    TestController, url, assert_session_flash, link_to, TEST_USER_ADMIN_LOGIN)
-from rhodecode.model.db import User, UserGroup
+    TestController, assert_session_flash, TEST_USER_ADMIN_LOGIN)
+from rhodecode.model.db import UserGroup
 from rhodecode.model.meta import Session
 from rhodecode.tests.fixture import Fixture
 
-TEST_USER_GROUP = 'admins_test'
-
 fixture = Fixture()
 
 
-class TestAdminUsersGroupsController(TestController):
-
-    def test_create(self):
-        self.log_user()
-        users_group_name = TEST_USER_GROUP
-        response = self.app.post(url('users_groups'), {
-            'users_group_name': users_group_name,
-            'user_group_description': 'DESC',
-            'active': True,
-            'csrf_token': self.csrf_token})
+def route_path(name, params=None, **kwargs):
+    import urllib
+    from rhodecode.apps._base import ADMIN_PREFIX
 
-        user_group_link = link_to(
-            users_group_name,
-            url('edit_users_group',
-                user_group_id=UserGroup.get_by_group_name(
-                    users_group_name).users_group_id))
-        assert_session_flash(
-            response,
-            'Created user group %s' % user_group_link)
+    base_url = {
+        'user_groups': ADMIN_PREFIX + '/user_groups',
+        'user_groups_data': ADMIN_PREFIX + '/user_groups_data',
+        'user_group_members_data': ADMIN_PREFIX + '/user_groups/{user_group_id}/members',
+        'user_groups_new': ADMIN_PREFIX + '/user_groups/new',
+        'user_groups_create': ADMIN_PREFIX + '/user_groups/create',
+        'edit_user_group': ADMIN_PREFIX + '/user_groups/{user_group_id}/edit',
+        'edit_user_group_advanced_sync': ADMIN_PREFIX + '/user_groups/{user_group_id}/edit/advanced/sync',
+        'edit_user_group_global_perms_update': ADMIN_PREFIX + '/user_groups/{user_group_id}/edit/global_permissions/update',
+        'user_groups_update': ADMIN_PREFIX + '/user_groups/{user_group_id}/update',
+        'user_groups_delete': ADMIN_PREFIX + '/user_groups/{user_group_id}/delete',
 
-    def test_set_synchronization(self):
+    }[name].format(**kwargs)
+
+    if params:
+        base_url = '{}?{}'.format(base_url, urllib.urlencode(params))
+    return base_url
+
+
+class TestUserGroupsView(TestController):
+
+    def test_set_synchronization(self, user_util):
         self.log_user()
-        users_group_name = TEST_USER_GROUP + 'sync'
-        response = self.app.post(url('users_groups'), {
-            'users_group_name': users_group_name,
-            'user_group_description': 'DESC',
-            'active': True,
-            'csrf_token': self.csrf_token})
+        user_group_name = user_util.create_user_group().users_group_name
 
         group = Session().query(UserGroup).filter(
-            UserGroup.users_group_name == users_group_name).one()
+            UserGroup.users_group_name == user_group_name).one()
 
         assert group.group_data.get('extern_type') is None
 
         # enable
         self.app.post(
-            url('edit_user_group_advanced_sync', user_group_id=group.users_group_id),
+            route_path('edit_user_group_advanced_sync',
+                       user_group_id=group.users_group_id),
             params={'csrf_token': self.csrf_token}, status=302)
 
         group = Session().query(UserGroup).filter(
-            UserGroup.users_group_name == users_group_name).one()
+            UserGroup.users_group_name == user_group_name).one()
         assert group.group_data.get('extern_type') == 'manual'
         assert group.group_data.get('extern_type_set_by') == TEST_USER_ADMIN_LOGIN
 
         # disable
         self.app.post(
-            url('edit_user_group_advanced_sync',
+            route_path('edit_user_group_advanced_sync',
                 user_group_id=group.users_group_id),
             params={'csrf_token': self.csrf_token}, status=302)
 
         group = Session().query(UserGroup).filter(
-            UserGroup.users_group_name == users_group_name).one()
+            UserGroup.users_group_name == user_group_name).one()
         assert group.group_data.get('extern_type') is None
         assert group.group_data.get('extern_type_set_by') == TEST_USER_ADMIN_LOGIN
 
-    def test_delete(self):
+    def test_delete_user_group(self, user_util):
         self.log_user()
-        users_group_name = TEST_USER_GROUP + 'another'
-        response = self.app.post(url('users_groups'), {
-            'users_group_name': users_group_name,
-            'user_group_description': 'DESC',
-            'active': True,
-            'csrf_token': self.csrf_token})
-
-        user_group_link = link_to(
-            users_group_name,
-            url('edit_users_group',
-                user_group_id=UserGroup.get_by_group_name(
-                    users_group_name).users_group_id))
-        assert_session_flash(
-            response,
-            'Created user group %s' % user_group_link)
+        user_group_id = user_util.create_user_group().users_group_id
 
         group = Session().query(UserGroup).filter(
-            UserGroup.users_group_name == users_group_name).one()
+            UserGroup.users_group_id == user_group_id).one()
 
         self.app.post(
-            url('delete_users_group', user_group_id=group.users_group_id),
-            params={'_method': 'delete', 'csrf_token': self.csrf_token})
+            route_path('user_groups_delete', user_group_id=group.users_group_id),
+            params={'csrf_token': self.csrf_token})
 
         group = Session().query(UserGroup).filter(
-            UserGroup.users_group_name == users_group_name).scalar()
+            UserGroup.users_group_id == user_group_id).scalar()
 
         assert group is None
 
     @pytest.mark.parametrize('repo_create, repo_create_write, user_group_create, repo_group_create, fork_create, inherit_default_permissions, expect_error, expect_form_error', [
         ('hg.create.none', 'hg.create.write_on_repogroup.false', 'hg.usergroup.create.false', 'hg.repogroup.create.false', 'hg.fork.none', 'hg.inherit_default_perms.false', False, False),
         ('hg.create.repository', 'hg.create.write_on_repogroup.true', 'hg.usergroup.create.true', 'hg.repogroup.create.true', 'hg.fork.repository', 'hg.inherit_default_perms.false', False, False),
         ('hg.create.XXX', 'hg.create.write_on_repogroup.true', 'hg.usergroup.create.true', 'hg.repogroup.create.true', 'hg.fork.repository', 'hg.inherit_default_perms.false', False, True),
         ('', '', '', '', '', '', True, False),
     ])
-    def test_global_perms_on_group(
+    def test_global_permissions_on_user_group(
             self, repo_create, repo_create_write, user_group_create,
             repo_group_create, fork_create, expect_error, expect_form_error,
-            inherit_default_permissions):
-        self.log_user()
-        users_group_name = TEST_USER_GROUP + 'another2'
-        response = self.app.post(url('users_groups'),
-                                 {'users_group_name': users_group_name,
-                                  'user_group_description': 'DESC',
-                                  'active': True,
-                                  'csrf_token': self.csrf_token})
+            inherit_default_permissions, user_util):
 
-        ug = UserGroup.get_by_group_name(users_group_name)
-        user_group_link = link_to(
-            users_group_name,
-            url('edit_users_group', user_group_id=ug.users_group_id))
-        assert_session_flash(
-            response,
-            'Created user group %s' % user_group_link)
-        response.follow()
+        self.log_user()
+        user_group = user_util.create_user_group()
+
+        user_group_name = user_group.users_group_name
+        user_group_id = user_group.users_group_id
 
         # ENABLE REPO CREATE ON A GROUP
         perm_params = {
             'inherit_default_permissions': False,
             'default_repo_create': repo_create,
             'default_repo_create_on_write': repo_create_write,
             'default_user_group_create': user_group_create,
             'default_repo_group_create': repo_group_create,
             'default_fork_create': fork_create,
             'default_inherit_default_permissions': inherit_default_permissions,
 
-            '_method': 'put',
             'csrf_token': self.csrf_token,
         }
         response = self.app.post(
-            url('edit_user_group_global_perms',
-                user_group_id=ug.users_group_id),
+            route_path('edit_user_group_global_perms_update',
+                       user_group_id=user_group_id),
             params=perm_params)
 
         if expect_form_error:
             assert response.status_int == 200
             response.mustcontain('Value must be one of')
         else:
             if expect_error:
                 msg = 'An error occurred during permissions saving'
             else:
                 msg = 'User Group global permissions updated successfully'
-                ug = UserGroup.get_by_group_name(users_group_name)
-                del perm_params['_method']
+                ug = UserGroup.get_by_group_name(user_group_name)
                 del perm_params['csrf_token']
                 del perm_params['inherit_default_permissions']
                 assert perm_params == ug.get_default_perms()
             assert_session_flash(response, msg)
 
-        fixture.destroy_user_group(users_group_name)
-
-    def test_edit_autocomplete(self):
+    def test_edit_view(self, user_util):
         self.log_user()
-        ug = fixture.create_user_group(TEST_USER_GROUP, skip_if_exists=True)
-        response = self.app.get(
-            url('edit_users_group', user_group_id=ug.users_group_id))
-        fixture.destroy_user_group(TEST_USER_GROUP)
+
+        user_group = user_util.create_user_group()
+        self.app.get(
+            route_path('edit_user_group',
+                       user_group_id=user_group.users_group_id),
+            status=200)
+
+    def test_update_user_group(self, user_util):
+        user = self.log_user()
+
+        user_group = user_util.create_user_group()
+        users_group_id = user_group.users_group_id
+        new_name = user_group.users_group_name + '_CHANGE'
+
+        params = [
+            ('users_group_active', False),
+            ('user_group_description', 'DESC'),
+            ('users_group_name', new_name),
+            ('user', user['username']),
+            ('csrf_token', self.csrf_token),
+            ('__start__', 'user_group_members:sequence'),
+            ('__start__', 'member:mapping'),
+            ('member_user_id', user['user_id']),
+            ('type', 'existing'),
+            ('__end__', 'member:mapping'),
+            ('__end__', 'user_group_members:sequence'),
+        ]
+
+        self.app.post(
+            route_path('user_groups_update',
+                       user_group_id=users_group_id),
+            params=params,
+            status=302)
+
+        user_group = UserGroup.get(users_group_id)
+        assert user_group
+
+        assert user_group.users_group_name == new_name
+        assert user_group.user_group_description == 'DESC'
+        assert user_group.users_group_active == False
+
+    def test_update_user_group_name_conflicts(self, user_util):
+        self.log_user()
+        user_group_old = user_util.create_user_group()
+        new_name = user_group_old.users_group_name
+
+        user_group = user_util.create_user_group()
+
+        params = dict(
+            users_group_active=False,
+            user_group_description='DESC',
+            users_group_name=new_name,
+            csrf_token=self.csrf_token)
+
+        response = self.app.post(
+            route_path('user_groups_update',
+                       user_group_id=user_group.users_group_id),
+            params=params,
+            status=200)
+
+        response.mustcontain('User group `{}` already exists'.format(
+            new_name))
 
     def test_update_members_from_user_ids(self, user_regular):
         uid = user_regular.user_id
         username = user_regular.username
         self.log_user()
 
         user_group = fixture.create_user_group('test_gr_ids')
         assert user_group.members == []
         assert user_group.user != user_regular
         expected_active_state = not user_group.users_group_active
 
         form_data = [
             ('csrf_token', self.csrf_token),
-            ('_method', 'put'),
             ('user', username),
             ('users_group_name', 'changed_name'),
             ('users_group_active', expected_active_state),
             ('user_group_description', 'changed_description'),
 
             ('__start__', 'user_group_members:sequence'),
             ('__start__', 'member:mapping'),
             ('member_user_id', uid),
             ('type', 'existing'),
             ('__end__', 'member:mapping'),
             ('__end__', 'user_group_members:sequence'),
         ]
         ugid = user_group.users_group_id
-        self.app.post(url('update_users_group', user_group_id=ugid), form_data)
+        self.app.post(
+            route_path('user_groups_update', user_group_id=ugid), form_data)
 
         user_group = UserGroup.get(ugid)
         assert user_group
 
         assert user_group.members[0].user_id == uid
         assert user_group.user_id == uid
         assert 'changed_name' in user_group.users_group_name
         assert 'changed_description' in user_group.user_group_description
         assert user_group.users_group_active == expected_active_state
 
         fixture.destroy_user_group(user_group)

rhodecode/config/middleware.py

@@ -1,535 +1,536 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 Pylons middleware initialization
 """
 import logging
 import traceback
 from collections import OrderedDict
 
 from paste.registry import RegistryManager
 from paste.gzipper import make_gzip_middleware
 from pylons.wsgiapp import PylonsApp
 from pyramid.authorization import ACLAuthorizationPolicy
 from pyramid.config import Configurator
 from pyramid.settings import asbool, aslist
 from pyramid.wsgi import wsgiapp
 from pyramid.httpexceptions import (
     HTTPException, HTTPError, HTTPInternalServerError, HTTPFound)
 from pyramid.events import ApplicationCreated
 from pyramid.renderers import render_to_response
 from routes.middleware import RoutesMiddleware
 import rhodecode
 
 from rhodecode.model import meta
 from rhodecode.config import patches
 from rhodecode.config.routing import STATIC_FILE_PREFIX
 from rhodecode.config.environment import (
     load_environment, load_pyramid_environment)
 
 from rhodecode.lib.vcs import VCSCommunicationError
 from rhodecode.lib.exceptions import VCSServerUnavailable
 from rhodecode.lib.middleware.appenlight import wrap_in_appenlight_if_enabled
 from rhodecode.lib.middleware.error_handling import (
     PylonsErrorHandlingMiddleware)
 from rhodecode.lib.middleware.https_fixup import HttpsFixup
 from rhodecode.lib.middleware.vcs import VCSMiddleware
 from rhodecode.lib.plugins.utils import register_rhodecode_plugin
 from rhodecode.lib.utils2 import aslist as rhodecode_aslist, AttributeDict
 from rhodecode.subscribers import (
     scan_repositories_if_enabled, write_js_routes_if_enabled,
     write_metadata_if_needed)
 
 
 log = logging.getLogger(__name__)
 
 
 # this is used to avoid avoid the route lookup overhead in routesmiddleware
 # for certain routes which won't go to pylons to - eg. static files, debugger
 # it is only needed for the pylons migration and can be removed once complete
 class SkippableRoutesMiddleware(RoutesMiddleware):
     """ Routes middleware that allows you to skip prefixes """
 
     def __init__(self, *args, **kw):
         self.skip_prefixes = kw.pop('skip_prefixes', [])
         super(SkippableRoutesMiddleware, self).__init__(*args, **kw)
 
     def __call__(self, environ, start_response):
         for prefix in self.skip_prefixes:
             if environ['PATH_INFO'].startswith(prefix):
                 # added to avoid the case when a missing /_static route falls
                 # through to pylons and causes an exception as pylons is
                 # expecting wsgiorg.routingargs to be set in the environ
                 # by RoutesMiddleware.
                 if 'wsgiorg.routing_args' not in environ:
                     environ['wsgiorg.routing_args'] = (None, {})
                 return self.app(environ, start_response)
 
         return super(SkippableRoutesMiddleware, self).__call__(
             environ, start_response)
 
 
 def make_app(global_conf, static_files=True, **app_conf):
     """Create a Pylons WSGI application and return it
 
     ``global_conf``
         The inherited configuration for this application. Normally from
         the [DEFAULT] section of the Paste ini file.
 
     ``app_conf``
         The application's local configuration. Normally specified in
         the [app:<name>] section of the Paste ini file (where <name>
         defaults to main).
 
     """
     # Apply compatibility patches
     patches.kombu_1_5_1_python_2_7_11()
     patches.inspect_getargspec()
 
     # Configure the Pylons environment
     config = load_environment(global_conf, app_conf)
 
     # The Pylons WSGI app
     app = PylonsApp(config=config)
 
     # Establish the Registry for this application
     app = RegistryManager(app)
 
     app.config = config
 
     return app
 
 
 def make_pyramid_app(global_config, **settings):
     """
     Constructs the WSGI application based on Pyramid and wraps the Pylons based
     application.
 
     Specials:
 
     * We migrate from Pylons to Pyramid. While doing this, we keep both
       frameworks functional. This involves moving some WSGI middlewares around
       and providing access to some data internals, so that the old code is
       still functional.
 
     * The application can also be integrated like a plugin via the call to
       `includeme`. This is accompanied with the other utility functions which
       are called. Changing this should be done with great care to not break
       cases when these fragments are assembled from another place.
 
     """
     # The edition string should be available in pylons too, so we add it here
     # before copying the settings.
     settings.setdefault('rhodecode.edition', 'Community Edition')
 
     # As long as our Pylons application does expect "unprepared" settings, make
     # sure that we keep an unmodified copy. This avoids unintentional change of
     # behavior in the old application.
     settings_pylons = settings.copy()
 
     sanitize_settings_and_apply_defaults(settings)
     config = Configurator(settings=settings)
     add_pylons_compat_data(config.registry, global_config, settings_pylons)
 
     load_pyramid_environment(global_config, settings)
 
     includeme_first(config)
     includeme(config)
 
     pyramid_app = config.make_wsgi_app()
     pyramid_app = wrap_app_in_wsgi_middlewares(pyramid_app, config)
     pyramid_app.config = config
 
     # creating the app uses a connection - return it after we are done
     meta.Session.remove()
 
     return pyramid_app
 
 
 def make_not_found_view(config):
     """
     This creates the view which should be registered as not-found-view to
     pyramid. Basically it contains of the old pylons app, converted to a view.
     Additionally it is wrapped by some other middlewares.
     """
     settings = config.registry.settings
     vcs_server_enabled = settings['vcs.server.enable']
 
     # Make pylons app from unprepared settings.
     pylons_app = make_app(
         config.registry._pylons_compat_global_config,
         **config.registry._pylons_compat_settings)
     config.registry._pylons_compat_config = pylons_app.config
 
     # Appenlight monitoring.
     pylons_app, appenlight_client = wrap_in_appenlight_if_enabled(
         pylons_app, settings)
 
     # The pylons app is executed inside of the pyramid 404 exception handler.
     # Exceptions which are raised inside of it are not handled by pyramid
     # again. Therefore we add a middleware that invokes the error handler in
     # case of an exception or error response. This way we return proper error
     # HTML pages in case of an error.
     reraise = (settings.get('debugtoolbar.enabled', False) or
                rhodecode.disable_error_handler)
     pylons_app = PylonsErrorHandlingMiddleware(
         pylons_app, error_handler, reraise)
 
     # The VCSMiddleware shall operate like a fallback if pyramid doesn't find a
     # view to handle the request. Therefore it is wrapped around the pylons
     # app. It has to be outside of the error handling otherwise error responses
     # from the vcsserver are converted to HTML error pages. This confuses the
     # command line tools and the user won't get a meaningful error message.
     if vcs_server_enabled:
         pylons_app = VCSMiddleware(
             pylons_app, settings, appenlight_client, registry=config.registry)
 
     # Convert WSGI app to pyramid view and return it.
     return wsgiapp(pylons_app)
 
 
 def add_pylons_compat_data(registry, global_config, settings):
     """
     Attach data to the registry to support the Pylons integration.
     """
     registry._pylons_compat_global_config = global_config
     registry._pylons_compat_settings = settings
 
 
 def error_handler(exception, request):
     import rhodecode
     from rhodecode.lib import helpers
 
     rhodecode_title = rhodecode.CONFIG.get('rhodecode_title') or 'RhodeCode'
 
     base_response = HTTPInternalServerError()
     # prefer original exception for the response since it may have headers set
     if isinstance(exception, HTTPException):
         base_response = exception
     elif isinstance(exception, VCSCommunicationError):
         base_response = VCSServerUnavailable()
 
     def is_http_error(response):
         # error which should have traceback
         return response.status_code > 499
 
     if is_http_error(base_response):
         log.exception(
             'error occurred handling this request for path: %s', request.path)
 
     c = AttributeDict()
     c.error_message = base_response.status
     c.error_explanation = base_response.explanation or str(base_response)
     c.visual = AttributeDict()
 
     c.visual.rhodecode_support_url = (
         request.registry.settings.get('rhodecode_support_url') or
         request.route_url('rhodecode_support')
     )
     c.redirect_time = 0
     c.rhodecode_name = rhodecode_title
     if not c.rhodecode_name:
         c.rhodecode_name = 'Rhodecode'
 
     c.causes = []
     if hasattr(base_response, 'causes'):
         c.causes = base_response.causes
     c.messages = helpers.flash.pop_messages(request=request)
     c.traceback = traceback.format_exc()
     response = render_to_response(
         '/errors/error_document.mako', {'c': c, 'h': helpers}, request=request,
         response=base_response)
 
     return response
 
 
 def includeme(config):
     settings = config.registry.settings
 
     # plugin information
     config.registry.rhodecode_plugins = OrderedDict()
 
     config.add_directive(
         'register_rhodecode_plugin', register_rhodecode_plugin)
 
     if asbool(settings.get('appenlight', 'false')):
         config.include('appenlight_client.ext.pyramid_tween')
 
     if 'mako.default_filters' not in settings:
         # set custom default filters if we don't have it defined
         settings['mako.imports'] = 'from rhodecode.lib.base import h_filter'
         settings['mako.default_filters'] = 'h_filter'
 
     # Includes which are required. The application would fail without them.
     config.include('pyramid_mako')
     config.include('pyramid_beaker')
 
     config.include('rhodecode.authentication')
     config.include('rhodecode.integrations')
 
     # apps
     config.include('rhodecode.apps._base')
     config.include('rhodecode.apps.ops')
 
     config.include('rhodecode.apps.admin')
     config.include('rhodecode.apps.channelstream')
     config.include('rhodecode.apps.login')
     config.include('rhodecode.apps.home')
     config.include('rhodecode.apps.journal')
     config.include('rhodecode.apps.repository')
     config.include('rhodecode.apps.repo_group')
+    config.include('rhodecode.apps.user_group')
     config.include('rhodecode.apps.search')
     config.include('rhodecode.apps.user_profile')
     config.include('rhodecode.apps.my_account')
     config.include('rhodecode.apps.svn_support')
     config.include('rhodecode.apps.ssh_support')
     config.include('rhodecode.apps.gist')
 
     config.include('rhodecode.apps.debug_style')
     config.include('rhodecode.tweens')
     config.include('rhodecode.api')
 
     config.add_route(
         'rhodecode_support', 'https://rhodecode.com/help/', static=True)
 
     config.add_translation_dirs('rhodecode:i18n/')
     settings['default_locale_name'] = settings.get('lang', 'en')
 
     # Add subscribers.
     config.add_subscriber(scan_repositories_if_enabled, ApplicationCreated)
     config.add_subscriber(write_metadata_if_needed, ApplicationCreated)
     config.add_subscriber(write_js_routes_if_enabled, ApplicationCreated)
 
     config.add_request_method(
         'rhodecode.lib.partial_renderer.get_partial_renderer',
         'get_partial_renderer')
 
     # events
     # TODO(marcink): this should be done when pyramid migration is finished
     # config.add_subscriber(
     #     'rhodecode.integrations.integrations_event_handler',
     #     'rhodecode.events.RhodecodeEvent')
 
     # Set the authorization policy.
     authz_policy = ACLAuthorizationPolicy()
     config.set_authorization_policy(authz_policy)
 
     # Set the default renderer for HTML templates to mako.
     config.add_mako_renderer('.html')
 
     config.add_renderer(
         name='json_ext',
         factory='rhodecode.lib.ext_json_renderer.pyramid_ext_json')
 
     # include RhodeCode plugins
     includes = aslist(settings.get('rhodecode.includes', []))
     for inc in includes:
         config.include(inc)
 
     # This is the glue which allows us to migrate in chunks. By registering the
     # pylons based application as the "Not Found" view in Pyramid, we will
     # fallback to the old application each time the new one does not yet know
     # how to handle a request.
     config.add_notfound_view(make_not_found_view(config))
 
     if not settings.get('debugtoolbar.enabled', False):
         # disabled debugtoolbar handle all exceptions via the error_handlers
         config.add_view(error_handler, context=Exception)
 
     config.add_view(error_handler, context=HTTPError)
 
 
 def includeme_first(config):
     # redirect automatic browser favicon.ico requests to correct place
     def favicon_redirect(context, request):
         return HTTPFound(
             request.static_path('rhodecode:public/images/favicon.ico'))
 
     config.add_view(favicon_redirect, route_name='favicon')
     config.add_route('favicon', '/favicon.ico')
 
     def robots_redirect(context, request):
         return HTTPFound(
             request.static_path('rhodecode:public/robots.txt'))
 
     config.add_view(robots_redirect, route_name='robots')
     config.add_route('robots', '/robots.txt')
 
     config.add_static_view(
         '_static/deform', 'deform:static')
     config.add_static_view(
         '_static/rhodecode', path='rhodecode:public', cache_max_age=3600 * 24)
 
 
 def wrap_app_in_wsgi_middlewares(pyramid_app, config):
     """
     Apply outer WSGI middlewares around the application.
 
     Part of this has been moved up from the Pylons layer, so that the
     data is also available if old Pylons code is hit through an already ported
     view.
     """
     settings = config.registry.settings
 
     # enable https redirects based on HTTP_X_URL_SCHEME set by proxy
     pyramid_app = HttpsFixup(pyramid_app, settings)
 
     # Add RoutesMiddleware to support the pylons compatibility tween during
     # migration to pyramid.
 
     # TODO(marcink): remove after migration to pyramid
     if hasattr(config.registry, '_pylons_compat_config'):
         routes_map = config.registry._pylons_compat_config['routes.map']
         pyramid_app = SkippableRoutesMiddleware(
             pyramid_app, routes_map,
             skip_prefixes=(STATIC_FILE_PREFIX, '/_debug_toolbar'))
 
     pyramid_app, _ = wrap_in_appenlight_if_enabled(pyramid_app, settings)
 
     if settings['gzip_responses']:
         pyramid_app = make_gzip_middleware(
             pyramid_app, settings, compress_level=1)
 
     # this should be the outer most middleware in the wsgi stack since
     # middleware like Routes make database calls
     def pyramid_app_with_cleanup(environ, start_response):
         try:
             return pyramid_app(environ, start_response)
         finally:
             # Dispose current database session and rollback uncommitted
             # transactions.
             meta.Session.remove()
 
             # In a single threaded mode server, on non sqlite db we should have
             # '0 Current Checked out connections' at the end of a request,
             # if not, then something, somewhere is leaving a connection open
             pool = meta.Base.metadata.bind.engine.pool
             log.debug('sa pool status: %s', pool.status())
 
     return pyramid_app_with_cleanup
 
 
 def sanitize_settings_and_apply_defaults(settings):
     """
     Applies settings defaults and does all type conversion.
 
     We would move all settings parsing and preparation into this place, so that
     we have only one place left which deals with this part. The remaining parts
     of the application would start to rely fully on well prepared settings.
 
     This piece would later be split up per topic to avoid a big fat monster
     function.
     """
 
     # Pyramid's mako renderer has to search in the templates folder so that the
     # old templates still work. Ported and new templates are expected to use
     # real asset specifications for the includes.
     mako_directories = settings.setdefault('mako.directories', [
         # Base templates of the original Pylons application
         'rhodecode:templates',
     ])
     log.debug(
         "Using the following Mako template directories: %s",
         mako_directories)
 
     # Default includes, possible to change as a user
     pyramid_includes = settings.setdefault('pyramid.includes', [
         'rhodecode.lib.middleware.request_wrapper',
     ])
     log.debug(
         "Using the following pyramid.includes: %s",
         pyramid_includes)
 
     # TODO: johbo: Re-think this, usually the call to config.include
     # should allow to pass in a prefix.
     settings.setdefault('rhodecode.api.url', '/_admin/api')
 
     # Sanitize generic settings.
     _list_setting(settings, 'default_encoding', 'UTF-8')
     _bool_setting(settings, 'is_test', 'false')
     _bool_setting(settings, 'gzip_responses', 'false')
 
     # Call split out functions that sanitize settings for each topic.
     _sanitize_appenlight_settings(settings)
     _sanitize_vcs_settings(settings)
 
     return settings
 
 
 def _sanitize_appenlight_settings(settings):
     _bool_setting(settings, 'appenlight', 'false')
 
 
 def _sanitize_vcs_settings(settings):
     """
     Applies settings defaults and does type conversion for all VCS related
     settings.
     """
     _string_setting(settings, 'vcs.svn.compatible_version', '')
     _string_setting(settings, 'git_rev_filter', '--all')
     _string_setting(settings, 'vcs.hooks.protocol', 'http')
     _string_setting(settings, 'vcs.scm_app_implementation', 'http')
     _string_setting(settings, 'vcs.server', '')
     _string_setting(settings, 'vcs.server.log_level', 'debug')
     _string_setting(settings, 'vcs.server.protocol', 'http')
     _bool_setting(settings, 'startup.import_repos', 'false')
     _bool_setting(settings, 'vcs.hooks.direct_calls', 'false')
     _bool_setting(settings, 'vcs.server.enable', 'true')
     _bool_setting(settings, 'vcs.start_server', 'false')
     _list_setting(settings, 'vcs.backends', 'hg, git, svn')
     _int_setting(settings, 'vcs.connection_timeout', 3600)
 
     # Support legacy values of vcs.scm_app_implementation. Legacy
     # configurations may use 'rhodecode.lib.middleware.utils.scm_app_http'
     # which is now mapped to 'http'.
     scm_app_impl = settings['vcs.scm_app_implementation']
     if scm_app_impl == 'rhodecode.lib.middleware.utils.scm_app_http':
         settings['vcs.scm_app_implementation'] = 'http'
 
 
 def _int_setting(settings, name, default):
     settings[name] = int(settings.get(name, default))
 
 
 def _bool_setting(settings, name, default):
     input = settings.get(name, default)
     if isinstance(input, unicode):
         input = input.encode('utf8')
     settings[name] = asbool(input)
 
 
 def _list_setting(settings, name, default):
     raw_value = settings.get(name, default)
 
     old_separator = ','
     if old_separator in raw_value:
         # If we get a comma separated list, pass it to our own function.
         settings[name] = rhodecode_aslist(raw_value, sep=old_separator)
     else:
         # Otherwise we assume it uses pyramids space/newline separation.
         settings[name] = aslist(raw_value)
 
 
 def _string_setting(settings, name, default, lower=True):
     value = settings.get(name, default)
     if lower:
         value = value.lower()
     settings[name] = value

rhodecode/config/routing.py

@@ -1,393 +1,355 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 Routes configuration
 
 The more specific and detailed routes should be defined first so they
 may take precedent over the more generic routes. For more information
 refer to the routes manual at http://routes.groovie.org/docs/
 
 IMPORTANT: if you change any routing here, make sure to take a look at lib/base.py
 and _route_name variable which uses some of stored naming here to do redirects.
 """
 import os
 import re
 from routes import Mapper
 
 # prefix for non repository related links needs to be prefixed with `/`
 ADMIN_PREFIX = '/_admin'
 STATIC_FILE_PREFIX = '/_static'
 
 # Default requirements for URL parts
 URL_NAME_REQUIREMENTS = {
     # group name can have a slash in them, but they must not end with a slash
     'group_name': r'.*?[^/]',
     'repo_group_name': r'.*?[^/]',
     # repo names can have a slash in them, but they must not end with a slash
     'repo_name': r'.*?[^/]',
     # file path eats up everything at the end
     'f_path': r'.*',
     # reference types
     'source_ref_type': '(branch|book|tag|rev|\%\(source_ref_type\)s)',
     'target_ref_type': '(branch|book|tag|rev|\%\(target_ref_type\)s)',
 }
 
 
 class JSRoutesMapper(Mapper):
     """
     Wrapper for routes.Mapper to make pyroutes compatible url definitions
     """
     _named_route_regex = re.compile(r'^[a-z-_0-9A-Z]+$')
     _argument_prog = re.compile('\{(.*?)\}|:\((.*)\)')
     def __init__(self, *args, **kw):
         super(JSRoutesMapper, self).__init__(*args, **kw)
         self._jsroutes = []
 
     def connect(self, *args, **kw):
         """
         Wrapper for connect to take an extra argument jsroute=True
 
         :param jsroute: boolean, if True will add the route to the pyroutes list
         """
         if kw.pop('jsroute', False):
             if not self._named_route_regex.match(args[0]):
                 raise Exception('only named routes can be added to pyroutes')
             self._jsroutes.append(args[0])
 
         super(JSRoutesMapper, self).connect(*args, **kw)
 
     def _extract_route_information(self, route):
         """
         Convert a route into tuple(name, path, args), eg:
             ('show_user', '/profile/%(username)s', ['username'])
         """
         routepath = route.routepath
         def replace(matchobj):
             if matchobj.group(1):
                 return "%%(%s)s" % matchobj.group(1).split(':')[0]
             else:
                 return "%%(%s)s" % matchobj.group(2)
 
         routepath = self._argument_prog.sub(replace, routepath)
         return (
             route.name,
             routepath,
             [(arg[0].split(':')[0] if arg[0] != '' else arg[1])
               for arg in self._argument_prog.findall(route.routepath)]
         )
 
     def jsroutes(self):
         """
         Return a list of pyroutes.js compatible routes
         """
         for route_name in self._jsroutes:
             yield self._extract_route_information(self._routenames[route_name])
 
 
 def make_map(config):
     """Create, configure and return the routes Mapper"""
     rmap = JSRoutesMapper(
         directory=config['pylons.paths']['controllers'],
         always_scan=config['debug'])
     rmap.minimization = False
     rmap.explicit = False
 
     from rhodecode.lib.utils2 import str2bool
     from rhodecode.model import repo, repo_group
 
     def check_repo(environ, match_dict):
         """
         check for valid repository for proper 404 handling
 
         :param environ:
         :param match_dict:
         """
         repo_name = match_dict.get('repo_name')
 
         if match_dict.get('f_path'):
             # fix for multiple initial slashes that causes errors
             match_dict['f_path'] = match_dict['f_path'].lstrip('/')
         repo_model = repo.RepoModel()
         by_name_match = repo_model.get_by_repo_name(repo_name)
         # if we match quickly from database, short circuit the operation,
         # and validate repo based on the type.
         if by_name_match:
             return True
 
         by_id_match = repo_model.get_repo_by_id(repo_name)
         if by_id_match:
             repo_name = by_id_match.repo_name
             match_dict['repo_name'] = repo_name
             return True
 
         return False
 
     def check_group(environ, match_dict):
         """
         check for valid repository group path for proper 404 handling
 
         :param environ:
         :param match_dict:
         """
         repo_group_name = match_dict.get('group_name')
         repo_group_model = repo_group.RepoGroupModel()
         by_name_match = repo_group_model.get_by_group_name(repo_group_name)
         if by_name_match:
             return True
 
         return False
 
     def check_user_group(environ, match_dict):
         """
         check for valid user group for proper 404 handling
 
         :param environ:
         :param match_dict:
         """
         return True
 
     def check_int(environ, match_dict):
         return match_dict.get('id').isdigit()
 
 
     #==========================================================================
     # CUSTOM ROUTES HERE
     #==========================================================================
 
     # ping and pylons error test
     rmap.connect('ping', '%s/ping' % (ADMIN_PREFIX,), controller='home', action='ping')
     rmap.connect('error_test', '%s/error_test' % (ADMIN_PREFIX,), controller='home', action='error_test')
 
     # ADMIN REPOSITORY GROUPS ROUTES
     with rmap.submapper(path_prefix=ADMIN_PREFIX,
                         controller='admin/repo_groups') as m:
         m.connect('repo_groups', '/repo_groups',
                   action='create', conditions={'method': ['POST']})
         m.connect('repo_groups', '/repo_groups',
                   action='index', conditions={'method': ['GET']})
         m.connect('new_repo_group', '/repo_groups/new',
                   action='new', conditions={'method': ['GET']})
         m.connect('update_repo_group', '/repo_groups/{group_name}',
                   action='update', conditions={'method': ['PUT'],
                                                'function': check_group},
                   requirements=URL_NAME_REQUIREMENTS)
 
         # EXTRAS REPO GROUP ROUTES
         m.connect('edit_repo_group', '/repo_groups/{group_name}/edit',
                   action='edit',
                   conditions={'method': ['GET'], 'function': check_group},
                   requirements=URL_NAME_REQUIREMENTS)
         m.connect('edit_repo_group', '/repo_groups/{group_name}/edit',
                   action='edit',
                   conditions={'method': ['PUT'], 'function': check_group},
                   requirements=URL_NAME_REQUIREMENTS)
 
         m.connect('edit_repo_group_advanced', '/repo_groups/{group_name}/edit/advanced',
                   action='edit_repo_group_advanced',
                   conditions={'method': ['GET'], 'function': check_group},
                   requirements=URL_NAME_REQUIREMENTS)
         m.connect('edit_repo_group_advanced', '/repo_groups/{group_name}/edit/advanced',
                   action='edit_repo_group_advanced',
                   conditions={'method': ['PUT'], 'function': check_group},
                   requirements=URL_NAME_REQUIREMENTS)
 
         m.connect('edit_repo_group_perms', '/repo_groups/{group_name}/edit/permissions',
                   action='edit_repo_group_perms',
                   conditions={'method': ['GET'], 'function': check_group},
                   requirements=URL_NAME_REQUIREMENTS)
         m.connect('edit_repo_group_perms', '/repo_groups/{group_name}/edit/permissions',
                   action='update_perms',
                   conditions={'method': ['PUT'], 'function': check_group},
                   requirements=URL_NAME_REQUIREMENTS)
 
         m.connect('delete_repo_group', '/repo_groups/{group_name}',
                   action='delete', conditions={'method': ['DELETE'],
                                                'function': check_group},
                   requirements=URL_NAME_REQUIREMENTS)
 
     # ADMIN USER ROUTES
     with rmap.submapper(path_prefix=ADMIN_PREFIX,
                         controller='admin/users') as m:
         m.connect('users', '/users',
                   action='create', conditions={'method': ['POST']})
         m.connect('new_user', '/users/new',
                   action='new', conditions={'method': ['GET']})
         m.connect('update_user', '/users/{user_id}',
                   action='update', conditions={'method': ['PUT']})
         m.connect('delete_user', '/users/{user_id}',
                   action='delete', conditions={'method': ['DELETE']})
         m.connect('edit_user', '/users/{user_id}/edit',
                   action='edit', conditions={'method': ['GET']}, jsroute=True)
         m.connect('user', '/users/{user_id}',
                   action='show', conditions={'method': ['GET']})
         m.connect('force_password_reset_user', '/users/{user_id}/password_reset',
                   action='reset_password', conditions={'method': ['POST']})
         m.connect('create_personal_repo_group', '/users/{user_id}/create_repo_group',
                   action='create_personal_repo_group', conditions={'method': ['POST']})
 
         # EXTRAS USER ROUTES
         m.connect('edit_user_advanced', '/users/{user_id}/edit/advanced',
                   action='edit_advanced', conditions={'method': ['GET']})
         m.connect('edit_user_advanced', '/users/{user_id}/edit/advanced',
                   action='update_advanced', conditions={'method': ['PUT']})
 
         m.connect('edit_user_global_perms', '/users/{user_id}/edit/global_permissions',
                   action='edit_global_perms', conditions={'method': ['GET']})
         m.connect('edit_user_global_perms', '/users/{user_id}/edit/global_permissions',
                   action='update_global_perms', conditions={'method': ['PUT']})
 
-    # ADMIN USER GROUPS REST ROUTES
-    with rmap.submapper(path_prefix=ADMIN_PREFIX,
-                        controller='admin/user_groups') as m:
-        m.connect('users_groups', '/user_groups',
-                  action='create', conditions={'method': ['POST']})
-        m.connect('new_users_group', '/user_groups/new',
-                  action='new', conditions={'method': ['GET']})
-        m.connect('update_users_group', '/user_groups/{user_group_id}',
-                  action='update', conditions={'method': ['PUT']})
-        m.connect('delete_users_group', '/user_groups/{user_group_id}',
-                  action='delete', conditions={'method': ['DELETE']})
-        m.connect('edit_users_group', '/user_groups/{user_group_id}/edit',
-                  action='edit', conditions={'method': ['GET']},
-                  function=check_user_group)
-
-        # EXTRAS USER GROUP ROUTES
-        m.connect('edit_user_group_global_perms',
-                  '/user_groups/{user_group_id}/edit/global_permissions',
-                  action='edit_global_perms', conditions={'method': ['GET']})
-        m.connect('edit_user_group_global_perms',
-                  '/user_groups/{user_group_id}/edit/global_permissions',
-                  action='update_global_perms', conditions={'method': ['PUT']})
-
-        m.connect('edit_user_group_perms',
-                  '/user_groups/{user_group_id}/edit/permissions',
-                  action='edit_perms', conditions={'method': ['GET']})
-        m.connect('edit_user_group_perms',
-                  '/user_groups/{user_group_id}/edit/permissions',
-                  action='update_perms', conditions={'method': ['PUT']})
-
-        m.connect('edit_user_group_advanced',
-                  '/user_groups/{user_group_id}/edit/advanced',
-                  action='edit_advanced', conditions={'method': ['GET']})
-
-        m.connect('edit_user_group_advanced_sync',
-                  '/user_groups/{user_group_id}/edit/advanced/sync',
-                  action='edit_advanced_set_synchronization', conditions={'method': ['POST']})
-
     # ADMIN DEFAULTS REST ROUTES
     with rmap.submapper(path_prefix=ADMIN_PREFIX,
                         controller='admin/defaults') as m:
         m.connect('admin_defaults_repositories', '/defaults/repositories',
                   action='update_repository_defaults', conditions={'method': ['POST']})
         m.connect('admin_defaults_repositories', '/defaults/repositories',
                   action='index', conditions={'method': ['GET']})
 
     # ADMIN SETTINGS ROUTES
     with rmap.submapper(path_prefix=ADMIN_PREFIX,
                         controller='admin/settings') as m:
 
         # default
         m.connect('admin_settings', '/settings',
                   action='settings_global_update',
                   conditions={'method': ['POST']})
         m.connect('admin_settings', '/settings',
                   action='settings_global', conditions={'method': ['GET']})
 
         m.connect('admin_settings_vcs', '/settings/vcs',
                   action='settings_vcs_update',
                   conditions={'method': ['POST']})
         m.connect('admin_settings_vcs', '/settings/vcs',
                   action='settings_vcs',
                   conditions={'method': ['GET']})
         m.connect('admin_settings_vcs', '/settings/vcs',
                   action='delete_svn_pattern',
                   conditions={'method': ['DELETE']})
 
         m.connect('admin_settings_mapping', '/settings/mapping',
                   action='settings_mapping_update',
                   conditions={'method': ['POST']})
         m.connect('admin_settings_mapping', '/settings/mapping',
                   action='settings_mapping', conditions={'method': ['GET']})
 
         m.connect('admin_settings_global', '/settings/global',
                   action='settings_global_update',
                   conditions={'method': ['POST']})
         m.connect('admin_settings_global', '/settings/global',
                   action='settings_global', conditions={'method': ['GET']})
 
         m.connect('admin_settings_visual', '/settings/visual',
                   action='settings_visual_update',
                   conditions={'method': ['POST']})
         m.connect('admin_settings_visual', '/settings/visual',
                   action='settings_visual', conditions={'method': ['GET']})
 
         m.connect('admin_settings_issuetracker',
                   '/settings/issue-tracker', action='settings_issuetracker',
                   conditions={'method': ['GET']})
         m.connect('admin_settings_issuetracker_save',
                   '/settings/issue-tracker/save',
                   action='settings_issuetracker_save',
                   conditions={'method': ['POST']})
         m.connect('admin_issuetracker_test', '/settings/issue-tracker/test',
                   action='settings_issuetracker_test',
                   conditions={'method': ['POST']})
         m.connect('admin_issuetracker_delete',
                   '/settings/issue-tracker/delete',
                   action='settings_issuetracker_delete',
                   conditions={'method': ['DELETE']})
 
         m.connect('admin_settings_email', '/settings/email',
                   action='settings_email_update',
                   conditions={'method': ['POST']})
         m.connect('admin_settings_email', '/settings/email',
                   action='settings_email', conditions={'method': ['GET']})
 
         m.connect('admin_settings_hooks', '/settings/hooks',
                   action='settings_hooks_update',
                   conditions={'method': ['POST', 'DELETE']})
         m.connect('admin_settings_hooks', '/settings/hooks',
                   action='settings_hooks', conditions={'method': ['GET']})
 
         m.connect('admin_settings_search', '/settings/search',
                   action='settings_search', conditions={'method': ['GET']})
 
         m.connect('admin_settings_supervisor', '/settings/supervisor',
                   action='settings_supervisor', conditions={'method': ['GET']})
         m.connect('admin_settings_supervisor_log', '/settings/supervisor/{procid}/log',
                   action='settings_supervisor_log', conditions={'method': ['GET']})
 
         m.connect('admin_settings_labs', '/settings/labs',
                   action='settings_labs_update',
                   conditions={'method': ['POST']})
         m.connect('admin_settings_labs', '/settings/labs',
                   action='settings_labs', conditions={'method': ['GET']})
 
     # ADMIN MY ACCOUNT
     with rmap.submapper(path_prefix=ADMIN_PREFIX,
                         controller='admin/my_account') as m:
 
         # NOTE(marcink): this needs to be kept for password force flag to be
         # handled in pylons controllers, remove after full migration to pyramid
         m.connect('my_account_password', '/my_account/password',
                   action='my_account_password', conditions={'method': ['GET']})
 
 
     return rmap

rhodecode/lib/auth.py

@@ -1,2161 +1,2161 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 authentication and permission libraries
 """
 
 import os
 import inspect
 import collections
 import fnmatch
 import hashlib
 import itertools
 import logging
 import random
 import traceback
 from functools import wraps
 
 import ipaddress
 from beaker.cache import cache_region
 from pyramid.httpexceptions import HTTPForbidden, HTTPFound, HTTPNotFound
 from pylons.i18n.translation import _
 # NOTE(marcink): this has to be removed only after pyramid migration,
 # replace with _ = request.translate
 from sqlalchemy.orm.exc import ObjectDeletedError
 from sqlalchemy.orm import joinedload
 from zope.cachedescriptors.property import Lazy as LazyProperty
 
 import rhodecode
 from rhodecode.model import meta
 from rhodecode.model.meta import Session
 from rhodecode.model.user import UserModel
 from rhodecode.model.db import (
     User, Repository, Permission, UserToPerm, UserGroupToPerm, UserGroupMember,
     UserIpMap, UserApiKeys, RepoGroup, UserGroup)
 from rhodecode.lib import caches
 from rhodecode.lib.utils2 import safe_unicode, aslist, safe_str, md5
 from rhodecode.lib.utils import (
     get_repo_slug, get_repo_group_slug, get_user_group_slug)
 from rhodecode.lib.caching_query import FromCache
 
 
 if rhodecode.is_unix:
     import bcrypt
 
 log = logging.getLogger(__name__)
 
 csrf_token_key = "csrf_token"
 
 
 class PasswordGenerator(object):
     """
     This is a simple class for generating password from different sets of
     characters
     usage::
 
         passwd_gen = PasswordGenerator()
         #print 8-letter password containing only big and small letters
             of alphabet
         passwd_gen.gen_password(8, passwd_gen.ALPHABETS_BIG_SMALL)
     """
     ALPHABETS_NUM = r'''1234567890'''
     ALPHABETS_SMALL = r'''qwertyuiopasdfghjklzxcvbnm'''
     ALPHABETS_BIG = r'''QWERTYUIOPASDFGHJKLZXCVBNM'''
     ALPHABETS_SPECIAL = r'''`-=[]\;',./~!@#$%^&*()_+{}|:"<>?'''
     ALPHABETS_FULL = ALPHABETS_BIG + ALPHABETS_SMALL \
         + ALPHABETS_NUM + ALPHABETS_SPECIAL
     ALPHABETS_ALPHANUM = ALPHABETS_BIG + ALPHABETS_SMALL + ALPHABETS_NUM
     ALPHABETS_BIG_SMALL = ALPHABETS_BIG + ALPHABETS_SMALL
     ALPHABETS_ALPHANUM_BIG = ALPHABETS_BIG + ALPHABETS_NUM
     ALPHABETS_ALPHANUM_SMALL = ALPHABETS_SMALL + ALPHABETS_NUM
 
     def __init__(self, passwd=''):
         self.passwd = passwd
 
     def gen_password(self, length, type_=None):
         if type_ is None:
             type_ = self.ALPHABETS_FULL
         self.passwd = ''.join([random.choice(type_) for _ in xrange(length)])
         return self.passwd
 
 
 class _RhodeCodeCryptoBase(object):
     ENC_PREF = None
 
     def hash_create(self, str_):
         """
         hash the string using
 
         :param str_: password to hash
         """
         raise NotImplementedError
 
     def hash_check_with_upgrade(self, password, hashed):
         """
         Returns tuple in which first element is boolean that states that
         given password matches it's hashed version, and the second is new hash
         of the password, in case this password should be migrated to new
         cipher.
         """
         checked_hash = self.hash_check(password, hashed)
         return checked_hash, None
 
     def hash_check(self, password, hashed):
         """
         Checks matching password with it's hashed value.
 
         :param password: password
         :param hashed: password in hashed form
         """
         raise NotImplementedError
 
     def _assert_bytes(self, value):
         """
         Passing in an `unicode` object can lead to hard to detect issues
         if passwords contain non-ascii characters.  Doing a type check
         during runtime, so that such mistakes are detected early on.
         """
         if not isinstance(value, str):
             raise TypeError(
                 "Bytestring required as input, got %r." % (value, ))
 
 
 class _RhodeCodeCryptoBCrypt(_RhodeCodeCryptoBase):
     ENC_PREF = ('$2a$10', '$2b$10')
 
     def hash_create(self, str_):
         self._assert_bytes(str_)
         return bcrypt.hashpw(str_, bcrypt.gensalt(10))
 
     def hash_check_with_upgrade(self, password, hashed):
         """
         Returns tuple in which first element is boolean that states that
         given password matches it's hashed version, and the second is new hash
         of the password, in case this password should be migrated to new
         cipher.
 
         This implements special upgrade logic which works like that:
          - check if the given password == bcrypted hash, if yes then we
            properly used password and it was already in bcrypt. Proceed
            without any changes
          - if bcrypt hash check is not working try with sha256. If hash compare
            is ok, it means we using correct but old hashed password. indicate
            hash change and proceed
         """
 
         new_hash = None
 
         # regular pw check
         password_match_bcrypt = self.hash_check(password, hashed)
 
         # now we want to know if the password was maybe from sha256
         # basically calling _RhodeCodeCryptoSha256().hash_check()
         if not password_match_bcrypt:
             if _RhodeCodeCryptoSha256().hash_check(password, hashed):
                 new_hash = self.hash_create(password)  # make new bcrypt hash
                 password_match_bcrypt = True
 
         return password_match_bcrypt, new_hash
 
     def hash_check(self, password, hashed):
         """
         Checks matching password with it's hashed value.
 
         :param password: password
         :param hashed: password in hashed form
         """
         self._assert_bytes(password)
         try:
             return bcrypt.hashpw(password, hashed) == hashed
         except ValueError as e:
             # we're having a invalid salt here probably, we should not crash
             # just return with False as it would be a wrong password.
             log.debug('Failed to check password hash using bcrypt %s',
                       safe_str(e))
 
         return False
 
 
 class _RhodeCodeCryptoSha256(_RhodeCodeCryptoBase):
     ENC_PREF = '_'
 
     def hash_create(self, str_):
         self._assert_bytes(str_)
         return hashlib.sha256(str_).hexdigest()
 
     def hash_check(self, password, hashed):
         """
         Checks matching password with it's hashed value.
 
         :param password: password
         :param hashed: password in hashed form
         """
         self._assert_bytes(password)
         return hashlib.sha256(password).hexdigest() == hashed
 
 
 class _RhodeCodeCryptoMd5(_RhodeCodeCryptoBase):
     ENC_PREF = '_'
 
     def hash_create(self, str_):
         self._assert_bytes(str_)
         return hashlib.md5(str_).hexdigest()
 
     def hash_check(self, password, hashed):
         """
         Checks matching password with it's hashed value.
 
         :param password: password
         :param hashed: password in hashed form
         """
         self._assert_bytes(password)
         return hashlib.md5(password).hexdigest() == hashed
 
 
 def crypto_backend():
     """
     Return the matching crypto backend.
 
     Selection is based on if we run tests or not, we pick md5 backend to run
     tests faster since BCRYPT is expensive to calculate
     """
     if rhodecode.is_test:
         RhodeCodeCrypto = _RhodeCodeCryptoMd5()
     else:
         RhodeCodeCrypto = _RhodeCodeCryptoBCrypt()
 
     return RhodeCodeCrypto
 
 
 def get_crypt_password(password):
     """
     Create the hash of `password` with the active crypto backend.
 
     :param password: The cleartext password.
     :type password: unicode
     """
     password = safe_str(password)
     return crypto_backend().hash_create(password)
 
 
 def check_password(password, hashed):
     """
     Check if the value in `password` matches the hash in `hashed`.
 
     :param password: The cleartext password.
     :type password: unicode
 
     :param hashed: The expected hashed version of the password.
     :type hashed: The hash has to be passed in in text representation.
     """
     password = safe_str(password)
     return crypto_backend().hash_check(password, hashed)
 
 
 def generate_auth_token(data, salt=None):
     """
     Generates API KEY from given string
     """
 
     if salt is None:
         salt = os.urandom(16)
     return hashlib.sha1(safe_str(data) + salt).hexdigest()
 
 
 class CookieStoreWrapper(object):
 
     def __init__(self, cookie_store):
         self.cookie_store = cookie_store
 
     def __repr__(self):
         return 'CookieStore<%s>' % (self.cookie_store)
 
     def get(self, key, other=None):
         if isinstance(self.cookie_store, dict):
             return self.cookie_store.get(key, other)
         elif isinstance(self.cookie_store, AuthUser):
             return self.cookie_store.__dict__.get(key, other)
 
 
 def _cached_perms_data(user_id, scope, user_is_admin,
                        user_inherit_default_permissions, explicit, algo,
                        calculate_super_admin):
 
     permissions = PermissionCalculator(
         user_id, scope, user_is_admin, user_inherit_default_permissions,
         explicit, algo, calculate_super_admin)
     return permissions.calculate()
 
 
 class PermOrigin(object):
     SUPER_ADMIN = 'superadmin'
 
     REPO_USER = 'user:%s'
     REPO_USERGROUP = 'usergroup:%s'
     REPO_OWNER = 'repo.owner'
     REPO_DEFAULT = 'repo.default'
     REPO_DEFAULT_NO_INHERIT = 'repo.default.no.inherit'
     REPO_PRIVATE = 'repo.private'
 
     REPOGROUP_USER = 'user:%s'
     REPOGROUP_USERGROUP = 'usergroup:%s'
     REPOGROUP_OWNER = 'group.owner'
     REPOGROUP_DEFAULT = 'group.default'
     REPOGROUP_DEFAULT_NO_INHERIT = 'group.default.no.inherit'
 
     USERGROUP_USER = 'user:%s'
     USERGROUP_USERGROUP = 'usergroup:%s'
     USERGROUP_OWNER = 'usergroup.owner'
     USERGROUP_DEFAULT = 'usergroup.default'
     USERGROUP_DEFAULT_NO_INHERIT = 'usergroup.default.no.inherit'
 
 
 class PermOriginDict(dict):
     """
     A special dict used for tracking permissions along with their origins.
 
     `__setitem__` has been overridden to expect a tuple(perm, origin)
     `__getitem__` will return only the perm
     `.perm_origin_stack` will return the stack of (perm, origin) set per key
 
     >>> perms = PermOriginDict()
     >>> perms['resource'] = 'read', 'default'
     >>> perms['resource']
     'read'
     >>> perms['resource'] = 'write', 'admin'
     >>> perms['resource']
     'write'
     >>> perms.perm_origin_stack
     {'resource': [('read', 'default'), ('write', 'admin')]}
     """
 
     def __init__(self, *args, **kw):
         dict.__init__(self, *args, **kw)
         self.perm_origin_stack = collections.OrderedDict()
 
     def __setitem__(self, key, (perm, origin)):
         self.perm_origin_stack.setdefault(key, []).append((perm, origin))
         dict.__setitem__(self, key, perm)
 
 
 class PermissionCalculator(object):
 
     def __init__(
             self, user_id, scope, user_is_admin,
             user_inherit_default_permissions, explicit, algo,
             calculate_super_admin=False):
 
         self.user_id = user_id
         self.user_is_admin = user_is_admin
         self.inherit_default_permissions = user_inherit_default_permissions
         self.explicit = explicit
         self.algo = algo
         self.calculate_super_admin = calculate_super_admin
 
         scope = scope or {}
         self.scope_repo_id = scope.get('repo_id')
         self.scope_repo_group_id = scope.get('repo_group_id')
         self.scope_user_group_id = scope.get('user_group_id')
 
         self.default_user_id = User.get_default_user(cache=True).user_id
 
         self.permissions_repositories = PermOriginDict()
         self.permissions_repository_groups = PermOriginDict()
         self.permissions_user_groups = PermOriginDict()
         self.permissions_global = set()
 
         self.default_repo_perms = Permission.get_default_repo_perms(
             self.default_user_id, self.scope_repo_id)
         self.default_repo_groups_perms = Permission.get_default_group_perms(
             self.default_user_id, self.scope_repo_group_id)
         self.default_user_group_perms = \
             Permission.get_default_user_group_perms(
                 self.default_user_id, self.scope_user_group_id)
 
     def calculate(self):
         if self.user_is_admin and not self.calculate_super_admin:
             return self._admin_permissions()
 
         self._calculate_global_default_permissions()
         self._calculate_global_permissions()
         self._calculate_default_permissions()
         self._calculate_repository_permissions()
         self._calculate_repository_group_permissions()
         self._calculate_user_group_permissions()
         return self._permission_structure()
 
     def _admin_permissions(self):
         """
         admin user have all default rights for repositories
         and groups set to admin
         """
         self.permissions_global.add('hg.admin')
         self.permissions_global.add('hg.create.write_on_repogroup.true')
 
         # repositories
         for perm in self.default_repo_perms:
             r_k = perm.UserRepoToPerm.repository.repo_name
             p = 'repository.admin'
             self.permissions_repositories[r_k] = p, PermOrigin.SUPER_ADMIN
 
         # repository groups
         for perm in self.default_repo_groups_perms:
             rg_k = perm.UserRepoGroupToPerm.group.group_name
             p = 'group.admin'
             self.permissions_repository_groups[rg_k] = p, PermOrigin.SUPER_ADMIN
 
         # user groups
         for perm in self.default_user_group_perms:
             u_k = perm.UserUserGroupToPerm.user_group.users_group_name
             p = 'usergroup.admin'
             self.permissions_user_groups[u_k] = p, PermOrigin.SUPER_ADMIN
 
         return self._permission_structure()
 
     def _calculate_global_default_permissions(self):
         """
         global permissions taken from the default user
         """
         default_global_perms = UserToPerm.query()\
             .filter(UserToPerm.user_id == self.default_user_id)\
             .options(joinedload(UserToPerm.permission))
 
         for perm in default_global_perms:
             self.permissions_global.add(perm.permission.permission_name)
 
         if self.user_is_admin:
             self.permissions_global.add('hg.admin')
             self.permissions_global.add('hg.create.write_on_repogroup.true')
 
     def _calculate_global_permissions(self):
         """
         Set global system permissions with user permissions or permissions
         taken from the user groups of the current user.
 
         The permissions include repo creating, repo group creating, forking
         etc.
         """
 
         # now we read the defined permissions and overwrite what we have set
         # before those can be configured from groups or users explicitly.
 
         # TODO: johbo: This seems to be out of sync, find out the reason
         # for the comment below and update it.
 
         # In case we want to extend this list we should be always in sync with
         # User.DEFAULT_USER_PERMISSIONS definitions
         _configurable = frozenset([
             'hg.fork.none', 'hg.fork.repository',
             'hg.create.none', 'hg.create.repository',
             'hg.usergroup.create.false', 'hg.usergroup.create.true',
             'hg.repogroup.create.false', 'hg.repogroup.create.true',
             'hg.create.write_on_repogroup.false',
             'hg.create.write_on_repogroup.true',
             'hg.inherit_default_perms.false', 'hg.inherit_default_perms.true'
         ])
 
         # USER GROUPS comes first user group global permissions
         user_perms_from_users_groups = Session().query(UserGroupToPerm)\
             .options(joinedload(UserGroupToPerm.permission))\
             .join((UserGroupMember, UserGroupToPerm.users_group_id ==
                    UserGroupMember.users_group_id))\
             .filter(UserGroupMember.user_id == self.user_id)\
             .order_by(UserGroupToPerm.users_group_id)\
             .all()
 
         # need to group here by groups since user can be in more than
         # one group, so we get all groups
         _explicit_grouped_perms = [
             [x, list(y)] for x, y in
             itertools.groupby(user_perms_from_users_groups,
                               lambda _x: _x.users_group)]
 
         for gr, perms in _explicit_grouped_perms:
             # since user can be in multiple groups iterate over them and
             # select the lowest permissions first (more explicit)
             # TODO: marcink: do this^^
 
             # group doesn't inherit default permissions so we actually set them
             if not gr.inherit_default_permissions:
                 # NEED TO IGNORE all previously set configurable permissions
                 # and replace them with explicitly set from this user
                 # group permissions
                 self.permissions_global = self.permissions_global.difference(
                     _configurable)
                 for perm in perms:
                     self.permissions_global.add(perm.permission.permission_name)
 
         # user explicit global permissions
         user_perms = Session().query(UserToPerm)\
             .options(joinedload(UserToPerm.permission))\
             .filter(UserToPerm.user_id == self.user_id).all()
 
         if not self.inherit_default_permissions:
             # NEED TO IGNORE all configurable permissions and
             # replace them with explicitly set from this user permissions
             self.permissions_global = self.permissions_global.difference(
                 _configurable)
             for perm in user_perms:
                 self.permissions_global.add(perm.permission.permission_name)
 
     def _calculate_default_permissions(self):
         """
         Set default user permissions for repositories, repository groups
         taken from the default user.
 
         Calculate inheritance of object permissions based on what we have now
         in GLOBAL permissions. We check if .false is in GLOBAL since this is
         explicitly set. Inherit is the opposite of .false being there.
 
         .. note::
 
            the syntax is little bit odd but what we need to check here is
            the opposite of .false permission being in the list so even for
            inconsistent state when both .true/.false is there
            .false is more important
 
         """
         user_inherit_object_permissions = not ('hg.inherit_default_perms.false'
                                                in self.permissions_global)
 
         # defaults for repositories, taken from `default` user permissions
         # on given repo
         for perm in self.default_repo_perms:
             r_k = perm.UserRepoToPerm.repository.repo_name
             p = perm.Permission.permission_name
             o = PermOrigin.REPO_DEFAULT
             self.permissions_repositories[r_k] = p, o
 
             # if we decide this user isn't inheriting permissions from
             # default user we set him to .none so only explicit
             # permissions work
             if not user_inherit_object_permissions:
                 p = 'repository.none'
                 o = PermOrigin.REPO_DEFAULT_NO_INHERIT
                 self.permissions_repositories[r_k] = p, o
 
             if perm.Repository.private and not (
                     perm.Repository.user_id == self.user_id):
                 # disable defaults for private repos,
                 p = 'repository.none'
                 o = PermOrigin.REPO_PRIVATE
                 self.permissions_repositories[r_k] = p, o
 
             elif perm.Repository.user_id == self.user_id:
                 # set admin if owner
                 p = 'repository.admin'
                 o = PermOrigin.REPO_OWNER
                 self.permissions_repositories[r_k] = p, o
 
             if self.user_is_admin:
                 p = 'repository.admin'
                 o = PermOrigin.SUPER_ADMIN
                 self.permissions_repositories[r_k] = p, o
 
         # defaults for repository groups taken from `default` user permission
         # on given group
         for perm in self.default_repo_groups_perms:
             rg_k = perm.UserRepoGroupToPerm.group.group_name
             p = perm.Permission.permission_name
             o = PermOrigin.REPOGROUP_DEFAULT
             self.permissions_repository_groups[rg_k] = p, o
 
             # if we decide this user isn't inheriting permissions from default
             # user we set him to .none so only explicit permissions work
             if not user_inherit_object_permissions:
                 p = 'group.none'
                 o = PermOrigin.REPOGROUP_DEFAULT_NO_INHERIT
                 self.permissions_repository_groups[rg_k] = p, o
 
             if perm.RepoGroup.user_id == self.user_id:
                 # set admin if owner
                 p = 'group.admin'
                 o = PermOrigin.REPOGROUP_OWNER
                 self.permissions_repository_groups[rg_k] = p, o
 
             if self.user_is_admin:
                 p = 'group.admin'
                 o = PermOrigin.SUPER_ADMIN
                 self.permissions_repository_groups[rg_k] = p, o
 
         # defaults for user groups taken from `default` user permission
         # on given user group
         for perm in self.default_user_group_perms:
             u_k = perm.UserUserGroupToPerm.user_group.users_group_name
             p = perm.Permission.permission_name
             o = PermOrigin.USERGROUP_DEFAULT
             self.permissions_user_groups[u_k] = p, o
 
             # if we decide this user isn't inheriting permissions from default
             # user we set him to .none so only explicit permissions work
             if not user_inherit_object_permissions:
                 p = 'usergroup.none'
                 o = PermOrigin.USERGROUP_DEFAULT_NO_INHERIT
                 self.permissions_user_groups[u_k] = p, o
 
             if perm.UserGroup.user_id == self.user_id:
                 # set admin if owner
                 p = 'usergroup.admin'
                 o = PermOrigin.USERGROUP_OWNER
                 self.permissions_user_groups[u_k] = p, o
 
             if self.user_is_admin:
                 p = 'usergroup.admin'
                 o = PermOrigin.SUPER_ADMIN
                 self.permissions_user_groups[u_k] = p, o
 
     def _calculate_repository_permissions(self):
         """
         Repository permissions for the current user.
 
         Check if the user is part of user groups for this repository and
         fill in the permission from it. `_choose_permission` decides of which
         permission should be selected based on selected method.
         """
 
         # user group for repositories permissions
         user_repo_perms_from_user_group = Permission\
             .get_default_repo_perms_from_user_group(
                 self.user_id, self.scope_repo_id)
 
         multiple_counter = collections.defaultdict(int)
         for perm in user_repo_perms_from_user_group:
             r_k = perm.UserGroupRepoToPerm.repository.repo_name
             multiple_counter[r_k] += 1
             p = perm.Permission.permission_name
             o = PermOrigin.REPO_USERGROUP % perm.UserGroupRepoToPerm\
                 .users_group.users_group_name
 
             if multiple_counter[r_k] > 1:
                 cur_perm = self.permissions_repositories[r_k]
                 p = self._choose_permission(p, cur_perm)
 
             self.permissions_repositories[r_k] = p, o
 
             if perm.Repository.user_id == self.user_id:
                 # set admin if owner
                 p = 'repository.admin'
                 o = PermOrigin.REPO_OWNER
                 self.permissions_repositories[r_k] = p, o
 
             if self.user_is_admin:
                 p = 'repository.admin'
                 o = PermOrigin.SUPER_ADMIN
                 self.permissions_repositories[r_k] = p, o
 
         # user explicit permissions for repositories, overrides any specified
         # by the group permission
         user_repo_perms = Permission.get_default_repo_perms(
             self.user_id, self.scope_repo_id)
         for perm in user_repo_perms:
             r_k = perm.UserRepoToPerm.repository.repo_name
             p = perm.Permission.permission_name
             o = PermOrigin.REPO_USER % perm.UserRepoToPerm.user.username
 
             if not self.explicit:
                 cur_perm = self.permissions_repositories.get(
                     r_k, 'repository.none')
                 p = self._choose_permission(p, cur_perm)
 
             self.permissions_repositories[r_k] = p, o
 
             if perm.Repository.user_id == self.user_id:
                 # set admin if owner
                 p = 'repository.admin'
                 o = PermOrigin.REPO_OWNER
                 self.permissions_repositories[r_k] = p, o
 
             if self.user_is_admin:
                 p = 'repository.admin'
                 o = PermOrigin.SUPER_ADMIN
                 self.permissions_repositories[r_k] = p, o
 
     def _calculate_repository_group_permissions(self):
         """
         Repository group permissions for the current user.
 
         Check if the user is part of user groups for repository groups and
         fill in the permissions from it. `_choose_permission` decides of which
         permission should be selected based on selected method.
         """
         # user group for repo groups permissions
         user_repo_group_perms_from_user_group = Permission\
             .get_default_group_perms_from_user_group(
                 self.user_id, self.scope_repo_group_id)
 
         multiple_counter = collections.defaultdict(int)
         for perm in user_repo_group_perms_from_user_group:
             rg_k = perm.UserGroupRepoGroupToPerm.group.group_name
             multiple_counter[rg_k] += 1
             o = PermOrigin.REPOGROUP_USERGROUP % perm.UserGroupRepoGroupToPerm\
                 .users_group.users_group_name
             p = perm.Permission.permission_name
 
             if multiple_counter[rg_k] > 1:
                 cur_perm = self.permissions_repository_groups[rg_k]
                 p = self._choose_permission(p, cur_perm)
             self.permissions_repository_groups[rg_k] = p, o
 
             if perm.RepoGroup.user_id == self.user_id:
                 # set admin if owner, even for member of other user group
                 p = 'group.admin'
                 o = PermOrigin.REPOGROUP_OWNER
                 self.permissions_repository_groups[rg_k] = p, o
 
             if self.user_is_admin:
                 p = 'group.admin'
                 o = PermOrigin.SUPER_ADMIN
                 self.permissions_repository_groups[rg_k] = p, o
 
         # user explicit permissions for repository groups
         user_repo_groups_perms = Permission.get_default_group_perms(
             self.user_id, self.scope_repo_group_id)
         for perm in user_repo_groups_perms:
             rg_k = perm.UserRepoGroupToPerm.group.group_name
             o = PermOrigin.REPOGROUP_USER % perm.UserRepoGroupToPerm\
                 .user.username
             p = perm.Permission.permission_name
 
             if not self.explicit:
                 cur_perm = self.permissions_repository_groups.get(
                     rg_k, 'group.none')
                 p = self._choose_permission(p, cur_perm)
 
             self.permissions_repository_groups[rg_k] = p, o
 
             if perm.RepoGroup.user_id == self.user_id:
                 # set admin if owner
                 p = 'group.admin'
                 o = PermOrigin.REPOGROUP_OWNER
                 self.permissions_repository_groups[rg_k] = p, o
 
             if self.user_is_admin:
                 p = 'group.admin'
                 o = PermOrigin.SUPER_ADMIN
                 self.permissions_repository_groups[rg_k] = p, o
 
     def _calculate_user_group_permissions(self):
         """
         User group permissions for the current user.
         """
         # user group for user group permissions
         user_group_from_user_group = Permission\
             .get_default_user_group_perms_from_user_group(
                 self.user_id, self.scope_user_group_id)
 
         multiple_counter = collections.defaultdict(int)
         for perm in user_group_from_user_group:
             ug_k = perm.UserGroupUserGroupToPerm\
                 .target_user_group.users_group_name
             multiple_counter[ug_k] += 1
             o = PermOrigin.USERGROUP_USERGROUP % perm.UserGroupUserGroupToPerm\
                 .user_group.users_group_name
             p = perm.Permission.permission_name
 
             if multiple_counter[ug_k] > 1:
                 cur_perm = self.permissions_user_groups[ug_k]
                 p = self._choose_permission(p, cur_perm)
 
             self.permissions_user_groups[ug_k] = p, o
 
             if perm.UserGroup.user_id == self.user_id:
                 # set admin if owner, even for member of other user group
                 p = 'usergroup.admin'
                 o = PermOrigin.USERGROUP_OWNER
                 self.permissions_user_groups[ug_k] = p, o
 
             if self.user_is_admin:
                 p = 'usergroup.admin'
                 o = PermOrigin.SUPER_ADMIN
                 self.permissions_user_groups[ug_k] = p, o
 
         # user explicit permission for user groups
         user_user_groups_perms = Permission.get_default_user_group_perms(
             self.user_id, self.scope_user_group_id)
         for perm in user_user_groups_perms:
             ug_k = perm.UserUserGroupToPerm.user_group.users_group_name
             o = PermOrigin.USERGROUP_USER % perm.UserUserGroupToPerm\
                 .user.username
             p = perm.Permission.permission_name
 
             if not self.explicit:
                 cur_perm = self.permissions_user_groups.get(
                     ug_k, 'usergroup.none')
                 p = self._choose_permission(p, cur_perm)
 
             self.permissions_user_groups[ug_k] = p, o
 
             if perm.UserGroup.user_id == self.user_id:
                 # set admin if owner
                 p = 'usergroup.admin'
                 o = PermOrigin.USERGROUP_OWNER
                 self.permissions_user_groups[ug_k] = p, o
 
             if self.user_is_admin:
                 p = 'usergroup.admin'
                 o = PermOrigin.SUPER_ADMIN
                 self.permissions_user_groups[ug_k] = p, o
 
     def _choose_permission(self, new_perm, cur_perm):
         new_perm_val = Permission.PERM_WEIGHTS[new_perm]
         cur_perm_val = Permission.PERM_WEIGHTS[cur_perm]
         if self.algo == 'higherwin':
             if new_perm_val > cur_perm_val:
                 return new_perm
             return cur_perm
         elif self.algo == 'lowerwin':
             if new_perm_val < cur_perm_val:
                 return new_perm
             return cur_perm
 
     def _permission_structure(self):
         return {
             'global': self.permissions_global,
             'repositories': self.permissions_repositories,
             'repositories_groups': self.permissions_repository_groups,
             'user_groups': self.permissions_user_groups,
         }
 
 
 def allowed_auth_token_access(view_name, auth_token, whitelist=None):
     """
     Check if given controller_name is in whitelist of auth token access
     """
     if not whitelist:
         from rhodecode import CONFIG
         whitelist = aslist(
             CONFIG.get('api_access_controllers_whitelist'), sep=',')
     # backward compat translation
     compat = {
         # old controller, new VIEW
         'ChangesetController:*': 'RepoCommitsView:*',
         'ChangesetController:changeset_patch': 'RepoCommitsView:repo_commit_patch',
         'ChangesetController:changeset_raw': 'RepoCommitsView:repo_commit_raw',
         'FilesController:raw': 'RepoCommitsView:repo_commit_raw',
         'FilesController:archivefile': 'RepoFilesView:repo_archivefile',
         'GistsController:*': 'GistView:*',
     }
 
     log.debug(
         'Allowed views for AUTH TOKEN access: %s' % (whitelist,))
     auth_token_access_valid = False
 
     for entry in whitelist:
         token_match = True
         if entry in compat:
             # translate from old Controllers to Pyramid Views
             entry = compat[entry]
 
         if '@' in entry:
             # specific AuthToken
             entry, allowed_token = entry.split('@', 1)
             token_match = auth_token == allowed_token
 
         if fnmatch.fnmatch(view_name, entry) and token_match:
             auth_token_access_valid = True
             break
 
     if auth_token_access_valid:
         log.debug('view: `%s` matches entry in whitelist: %s'
                   % (view_name, whitelist))
     else:
         msg = ('view: `%s` does *NOT* match any entry in whitelist: %s'
                % (view_name, whitelist))
         if auth_token:
             # if we use auth token key and don't have access it's a warning
             log.warning(msg)
         else:
             log.debug(msg)
 
     return auth_token_access_valid
 
 
 class AuthUser(object):
     """
     A simple object that handles all attributes of user in RhodeCode
 
     It does lookup based on API key,given user, or user present in session
     Then it fills all required information for such user. It also checks if
     anonymous access is enabled and if so, it returns default user as logged in
     """
     GLOBAL_PERMS = [x[0] for x in Permission.PERMS]
 
     def __init__(self, user_id=None, api_key=None, username=None, ip_addr=None):
 
         self.user_id = user_id
         self._api_key = api_key
 
         self.api_key = None
         self.feed_token = ''
         self.username = username
         self.ip_addr = ip_addr
         self.name = ''
         self.lastname = ''
         self.first_name = ''
         self.last_name = ''
         self.email = ''
         self.is_authenticated = False
         self.admin = False
         self.inherit_default_permissions = False
         self.password = ''
 
         self.anonymous_user = None  # propagated on propagate_data
         self.propagate_data()
         self._instance = None
         self._permissions_scoped_cache = {}  # used to bind scoped calculation
 
     @LazyProperty
     def permissions(self):
         return self.get_perms(user=self, cache=False)
 
     @LazyProperty
     def permissions_full_details(self):
         return self.get_perms(
             user=self, cache=False, calculate_super_admin=True)
 
     def permissions_with_scope(self, scope):
         """
         Call the get_perms function with scoped data. The scope in that function
         narrows the SQL calls to the given ID of objects resulting in fetching
         Just particular permission we want to obtain. If scope is an empty dict
         then it basically narrows the scope to GLOBAL permissions only.
 
         :param scope: dict
         """
         if 'repo_name' in scope:
             obj = Repository.get_by_repo_name(scope['repo_name'])
             if obj:
                 scope['repo_id'] = obj.repo_id
         _scope = {
             'repo_id': -1,
             'user_group_id': -1,
             'repo_group_id': -1,
         }
         _scope.update(scope)
         cache_key = "_".join(map(safe_str, reduce(lambda a, b: a+b,
                                                   _scope.items())))
         if cache_key not in self._permissions_scoped_cache:
             # store in cache to mimic how the @LazyProperty works,
             # the difference here is that we use the unique key calculated
             # from params and values
             res = self.get_perms(user=self, cache=False, scope=_scope)
             self._permissions_scoped_cache[cache_key] = res
         return self._permissions_scoped_cache[cache_key]
 
     def get_instance(self):
         return User.get(self.user_id)
 
     def update_lastactivity(self):
         if self.user_id:
             User.get(self.user_id).update_lastactivity()
 
     def propagate_data(self):
         """
         Fills in user data and propagates values to this instance. Maps fetched
         user attributes to this class instance attributes
         """
         log.debug('AuthUser: starting data propagation for new potential user')
         user_model = UserModel()
         anon_user = self.anonymous_user = User.get_default_user(cache=True)
         is_user_loaded = False
 
         # lookup by userid
         if self.user_id is not None and self.user_id != anon_user.user_id:
             log.debug('Trying Auth User lookup by USER ID: `%s`', self.user_id)
             is_user_loaded = user_model.fill_data(self, user_id=self.user_id)
 
         # try go get user by api key
         elif self._api_key and self._api_key != anon_user.api_key:
             log.debug('Trying Auth User lookup by API KEY: `%s`', self._api_key)
             is_user_loaded = user_model.fill_data(self, api_key=self._api_key)
 
         # lookup by username
         elif self.username:
             log.debug('Trying Auth User lookup by USER NAME: `%s`', self.username)
             is_user_loaded = user_model.fill_data(self, username=self.username)
         else:
             log.debug('No data in %s that could been used to log in', self)
 
         if not is_user_loaded:
             log.debug('Failed to load user. Fallback to default user')
             # if we cannot authenticate user try anonymous
             if anon_user.active:
                 user_model.fill_data(self, user_id=anon_user.user_id)
                 # then we set this user is logged in
                 self.is_authenticated = True
             else:
                 # in case of disabled anonymous user we reset some of the
                 # parameters so such user is "corrupted", skipping the fill_data
                 for attr in ['user_id', 'username', 'admin', 'active']:
                     setattr(self, attr, None)
                 self.is_authenticated = False
 
         if not self.username:
             self.username = 'None'
 
         log.debug('AuthUser: propagated user is now %s', self)
 
     def get_perms(self, user, scope=None, explicit=True, algo='higherwin',
                   calculate_super_admin=False, cache=False):
         """
         Fills user permission attribute with permissions taken from database
         works for permissions given for repositories, and for permissions that
         are granted to groups
 
         :param user: instance of User object from database
         :param explicit: In case there are permissions both for user and a group
             that user is part of, explicit flag will defiine if user will
             explicitly override permissions from group, if it's False it will
             make decision based on the algo
         :param algo: algorithm to decide what permission should be choose if
             it's multiple defined, eg user in two different groups. It also
             decides if explicit flag is turned off how to specify the permission
             for case when user is in a group + have defined separate permission
         """
         user_id = user.user_id
         user_is_admin = user.is_admin
 
         # inheritance of global permissions like create repo/fork repo etc
         user_inherit_default_permissions = user.inherit_default_permissions
 
         log.debug('Computing PERMISSION tree for scope %s' % (scope, ))
         compute = caches.conditional_cache(
             'short_term', 'cache_desc',
             condition=cache, func=_cached_perms_data)
         result = compute(user_id, scope, user_is_admin,
                          user_inherit_default_permissions, explicit, algo,
                          calculate_super_admin)
 
         result_repr = []
         for k in result:
             result_repr.append((k, len(result[k])))
 
         log.debug('PERMISSION tree computed %s' % (result_repr,))
         return result
 
     @property
     def is_default(self):
         return self.username == User.DEFAULT_USER
 
     @property
     def is_admin(self):
         return self.admin
 
     @property
     def is_user_object(self):
         return self.user_id is not None
 
     @property
     def repositories_admin(self):
         """
         Returns list of repositories you're an admin of
         """
         return [
             x[0] for x in self.permissions['repositories'].iteritems()
             if x[1] == 'repository.admin']
 
     @property
     def repository_groups_admin(self):
         """
         Returns list of repository groups you're an admin of
         """
         return [
             x[0] for x in self.permissions['repositories_groups'].iteritems()
             if x[1] == 'group.admin']
 
     @property
     def user_groups_admin(self):
         """
         Returns list of user groups you're an admin of
         """
         return [
             x[0] for x in self.permissions['user_groups'].iteritems()
             if x[1] == 'usergroup.admin']
 
     def repo_acl_ids(self, perms=None, name_filter=None, cache=False):
         """
         Returns list of repository ids that user have access to based on given
         perms. The cache flag should be only used in cases that are used for
         display purposes, NOT IN ANY CASE for permission checks.
         """
         from rhodecode.model.scm import RepoList
         if not perms:
             perms = [
                 'repository.read', 'repository.write', 'repository.admin']
 
         def _cached_repo_acl(user_id, perm_def, name_filter):
             qry = Repository.query()
             if name_filter:
                 ilike_expression = u'%{}%'.format(safe_unicode(name_filter))
                 qry = qry.filter(
                     Repository.repo_name.ilike(ilike_expression))
 
             return [x.repo_id for x in
                     RepoList(qry, perm_set=perm_def)]
 
         compute = caches.conditional_cache(
             'long_term', 'repo_acl_ids',
             condition=cache, func=_cached_repo_acl)
         return compute(self.user_id, perms, name_filter)
 
     def repo_group_acl_ids(self, perms=None, name_filter=None, cache=False):
         """
         Returns list of repository group ids that user have access to based on given
         perms. The cache flag should be only used in cases that are used for
         display purposes, NOT IN ANY CASE for permission checks.
         """
         from rhodecode.model.scm import RepoGroupList
         if not perms:
             perms = [
                 'group.read', 'group.write', 'group.admin']
 
         def _cached_repo_group_acl(user_id, perm_def, name_filter):
             qry = RepoGroup.query()
             if name_filter:
                 ilike_expression = u'%{}%'.format(safe_unicode(name_filter))
                 qry = qry.filter(
                     RepoGroup.group_name.ilike(ilike_expression))
 
             return [x.group_id for x in
                     RepoGroupList(qry, perm_set=perm_def)]
 
         compute = caches.conditional_cache(
             'long_term', 'repo_group_acl_ids',
             condition=cache, func=_cached_repo_group_acl)
         return compute(self.user_id, perms, name_filter)
 
     def user_group_acl_ids(self, perms=None, name_filter=None, cache=False):
         """
         Returns list of user group ids that user have access to based on given
         perms. The cache flag should be only used in cases that are used for
         display purposes, NOT IN ANY CASE for permission checks.
         """
         from rhodecode.model.scm import UserGroupList
         if not perms:
             perms = [
                 'usergroup.read', 'usergroup.write', 'usergroup.admin']
 
         def _cached_user_group_acl(user_id, perm_def, name_filter):
             qry = UserGroup.query()
             if name_filter:
                 ilike_expression = u'%{}%'.format(safe_unicode(name_filter))
                 qry = qry.filter(
                     UserGroup.users_group_name.ilike(ilike_expression))
 
             return [x.users_group_id for x in
                     UserGroupList(qry, perm_set=perm_def)]
 
         compute = caches.conditional_cache(
             'long_term', 'user_group_acl_ids',
             condition=cache, func=_cached_user_group_acl)
         return compute(self.user_id, perms, name_filter)
 
     @property
     def ip_allowed(self):
         """
         Checks if ip_addr used in constructor is allowed from defined list of
         allowed ip_addresses for user
 
         :returns: boolean, True if ip is in allowed ip range
         """
         # check IP
         inherit = self.inherit_default_permissions
         return AuthUser.check_ip_allowed(self.user_id, self.ip_addr,
                                          inherit_from_default=inherit)
     @property
     def personal_repo_group(self):
         return RepoGroup.get_user_personal_repo_group(self.user_id)
 
     @classmethod
     def check_ip_allowed(cls, user_id, ip_addr, inherit_from_default):
         allowed_ips = AuthUser.get_allowed_ips(
             user_id, cache=True, inherit_from_default=inherit_from_default)
         if check_ip_access(source_ip=ip_addr, allowed_ips=allowed_ips):
             log.debug('IP:%s is in range of %s' % (ip_addr, allowed_ips))
             return True
         else:
             log.info('Access for IP:%s forbidden, '
                      'not in %s' % (ip_addr, allowed_ips))
             return False
 
     def __repr__(self):
         return "<AuthUser('id:%s[%s] ip:%s auth:%s')>"\
             % (self.user_id, self.username, self.ip_addr, self.is_authenticated)
 
     def set_authenticated(self, authenticated=True):
         if self.user_id != self.anonymous_user.user_id:
             self.is_authenticated = authenticated
 
     def get_cookie_store(self):
         return {
             'username': self.username,
             'password': md5(self.password),
             'user_id': self.user_id,
             'is_authenticated': self.is_authenticated
         }
 
     @classmethod
     def from_cookie_store(cls, cookie_store):
         """
         Creates AuthUser from a cookie store
 
         :param cls:
         :param cookie_store:
         """
         user_id = cookie_store.get('user_id')
         username = cookie_store.get('username')
         api_key = cookie_store.get('api_key')
         return AuthUser(user_id, api_key, username)
 
     @classmethod
     def get_allowed_ips(cls, user_id, cache=False, inherit_from_default=False):
         _set = set()
 
         if inherit_from_default:
             default_ips = UserIpMap.query().filter(
                 UserIpMap.user == User.get_default_user(cache=True))
             if cache:
                 default_ips = default_ips.options(
                     FromCache("sql_cache_short", "get_user_ips_default"))
 
             # populate from default user
             for ip in default_ips:
                 try:
                     _set.add(ip.ip_addr)
                 except ObjectDeletedError:
                     # since we use heavy caching sometimes it happens that
                     # we get deleted objects here, we just skip them
                     pass
 
         user_ips = UserIpMap.query().filter(UserIpMap.user_id == user_id)
         if cache:
             user_ips = user_ips.options(
                 FromCache("sql_cache_short", "get_user_ips_%s" % user_id))
 
         for ip in user_ips:
             try:
                 _set.add(ip.ip_addr)
             except ObjectDeletedError:
                 # since we use heavy caching sometimes it happens that we get
                 # deleted objects here, we just skip them
                 pass
         return _set or set(['0.0.0.0/0', '::/0'])
 
 
 def set_available_permissions(config):
     """
     This function will propagate pylons globals with all available defined
     permission given in db. We don't want to check each time from db for new
     permissions since adding a new permission also requires application restart
     ie. to decorate new views with the newly created permission
 
     :param config: current pylons config instance
 
     """
     log.info('getting information about all available permissions')
     try:
         sa = meta.Session
         all_perms = sa.query(Permission).all()
         config['available_permissions'] = [x.permission_name for x in all_perms]
     except Exception:
         log.error(traceback.format_exc())
     finally:
         meta.Session.remove()
 
 
 def get_csrf_token(session=None, force_new=False, save_if_missing=True):
     """
     Return the current authentication token, creating one if one doesn't
     already exist and the save_if_missing flag is present.
 
     :param session: pass in the pylons session, else we use the global ones
     :param force_new: force to re-generate the token and store it in session
     :param save_if_missing: save the newly generated token if it's missing in
         session
     """
     # NOTE(marcink): probably should be replaced with below one from pyramid 1.9
     # from pyramid.csrf import get_csrf_token
 
     if not session:
         from pylons import session
 
     if (csrf_token_key not in session and save_if_missing) or force_new:
         token = hashlib.sha1(str(random.getrandbits(128))).hexdigest()
         session[csrf_token_key] = token
         if hasattr(session, 'save'):
             session.save()
     return session.get(csrf_token_key)
 
 
-def get_request(perm_class):
+def get_request(perm_class_instance):
     from pyramid.threadlocal import get_current_request
     pyramid_request = get_current_request()
     if not pyramid_request:
         # return global request of pylons in case pyramid isn't available
         # NOTE(marcink): this should be removed after migration to pyramid
         from pylons import request
         return request
     return pyramid_request
 
 
 # CHECK DECORATORS
 class CSRFRequired(object):
     """
     Decorator for authenticating a form
 
     This decorator uses an authorization token stored in the client's
     session for prevention of certain Cross-site request forgery (CSRF)
     attacks (See
     http://en.wikipedia.org/wiki/Cross-site_request_forgery for more
     information).
 
     For use with the ``webhelpers.secure_form`` helper functions.
 
     """
     def __init__(self, token=csrf_token_key, header='X-CSRF-Token',
         except_methods=None):
         self.token = token
         self.header = header
         self.except_methods = except_methods or []
 
     def __call__(self, func):
         return get_cython_compat_decorator(self.__wrapper, func)
 
     def _get_csrf(self, _request):
         return _request.POST.get(self.token, _request.headers.get(self.header))
 
     def check_csrf(self, _request, cur_token):
         supplied_token = self._get_csrf(_request)
         return supplied_token and supplied_token == cur_token
 
     def _get_request(self):
         return get_request(self)
 
     def __wrapper(self, func, *fargs, **fkwargs):
         request = self._get_request()
 
         if request.method in self.except_methods:
             return func(*fargs, **fkwargs)
 
         cur_token = get_csrf_token(save_if_missing=False)
         if self.check_csrf(request, cur_token):
             if request.POST.get(self.token):
                 del request.POST[self.token]
             return func(*fargs, **fkwargs)
         else:
             reason = 'token-missing'
             supplied_token = self._get_csrf(request)
             if supplied_token and cur_token != supplied_token:
                 reason = 'token-mismatch [%s:%s]' % (
                     cur_token or ''[:6], supplied_token or ''[:6])
 
             csrf_message = \
                 ("Cross-site request forgery detected, request denied. See "
                  "http://en.wikipedia.org/wiki/Cross-site_request_forgery for "
                  "more information.")
         log.warn('Cross-site request forgery detected, request %r DENIED: %s '
                  'REMOTE_ADDR:%s, HEADERS:%s' % (
                      request, reason, request.remote_addr, request.headers))
 
         raise HTTPForbidden(explanation=csrf_message)
 
 
 class LoginRequired(object):
     """
     Must be logged in to execute this function else
     redirect to login page
 
     :param api_access: if enabled this checks only for valid auth token
         and grants access based on valid token
     """
     def __init__(self, auth_token_access=None):
         self.auth_token_access = auth_token_access
 
     def __call__(self, func):
         return get_cython_compat_decorator(self.__wrapper, func)
 
     def _get_request(self):
         return get_request(self)
 
     def __wrapper(self, func, *fargs, **fkwargs):
         from rhodecode.lib import helpers as h
         cls = fargs[0]
         user = cls._rhodecode_user
         request = self._get_request()
 
         loc = "%s:%s" % (cls.__class__.__name__, func.__name__)
         log.debug('Starting login restriction checks for user: %s' % (user,))
         # check if our IP is allowed
         ip_access_valid = True
         if not user.ip_allowed:
             h.flash(h.literal(_('IP %s not allowed' % (user.ip_addr,))),
                     category='warning')
             ip_access_valid = False
 
         # check if we used an APIKEY and it's a valid one
         # defined white-list of controllers which API access will be enabled
         _auth_token = request.GET.get(
             'auth_token', '') or request.GET.get('api_key', '')
         auth_token_access_valid = allowed_auth_token_access(
             loc, auth_token=_auth_token)
 
         # explicit controller is enabled or API is in our whitelist
         if self.auth_token_access or auth_token_access_valid:
             log.debug('Checking AUTH TOKEN access for %s' % (cls,))
             db_user = user.get_instance()
 
             if db_user:
                 if self.auth_token_access:
                     roles = self.auth_token_access
                 else:
                     roles = [UserApiKeys.ROLE_HTTP]
                 token_match = db_user.authenticate_by_token(
                     _auth_token, roles=roles)
             else:
                 log.debug('Unable to fetch db instance for auth user: %s', user)
                 token_match = False
 
             if _auth_token and token_match:
                 auth_token_access_valid = True
                 log.debug('AUTH TOKEN ****%s is VALID' % (_auth_token[-4:],))
             else:
                 auth_token_access_valid = False
                 if not _auth_token:
                     log.debug("AUTH TOKEN *NOT* present in request")
                 else:
                     log.warning(
                         "AUTH TOKEN ****%s *NOT* valid" % _auth_token[-4:])
 
         log.debug('Checking if %s is authenticated @ %s' % (user.username, loc))
         reason = 'RHODECODE_AUTH' if user.is_authenticated \
             else 'AUTH_TOKEN_AUTH'
 
         if ip_access_valid and (
                 user.is_authenticated or auth_token_access_valid):
             log.info(
                 'user %s authenticating with:%s IS authenticated on func %s'
                 % (user, reason, loc))
 
             # update user data to check last activity
             user.update_lastactivity()
             Session().commit()
             return func(*fargs, **fkwargs)
         else:
             log.warning(
                 'user %s authenticating with:%s NOT authenticated on '
                 'func: %s: IP_ACCESS:%s AUTH_TOKEN_ACCESS:%s'
                 % (user, reason, loc, ip_access_valid,
                    auth_token_access_valid))
             # we preserve the get PARAM
             came_from = request.path_qs
             log.debug('redirecting to login page with %s' % (came_from,))
             raise HTTPFound(
                 h.route_path('login', _query={'came_from': came_from}))
 
 
 class NotAnonymous(object):
     """
     Must be logged in to execute this function else
     redirect to login page
     """
 
     def __call__(self, func):
         return get_cython_compat_decorator(self.__wrapper, func)
 
     def _get_request(self):
         return get_request(self)
 
     def __wrapper(self, func, *fargs, **fkwargs):
         import rhodecode.lib.helpers as h
         cls = fargs[0]
         self.user = cls._rhodecode_user
         request = self._get_request()
 
         log.debug('Checking if user is not anonymous @%s' % cls)
 
         anonymous = self.user.username == User.DEFAULT_USER
 
         if anonymous:
             came_from = request.path_qs
             h.flash(_('You need to be a registered user to '
                       'perform this action'),
                     category='warning')
             raise HTTPFound(
                 h.route_path('login', _query={'came_from': came_from}))
         else:
             return func(*fargs, **fkwargs)
 
 
 class PermsDecorator(object):
     """
     Base class for controller decorators, we extract the current user from
     the class itself, which has it stored in base controllers
     """
 
     def __init__(self, *required_perms):
         self.required_perms = set(required_perms)
 
     def __call__(self, func):
         return get_cython_compat_decorator(self.__wrapper, func)
 
     def _get_request(self):
         return get_request(self)
 
     def _get_came_from(self):
         _request = self._get_request()
 
         # both pylons/pyramid has this attribute
         return _request.path_qs
 
     def __wrapper(self, func, *fargs, **fkwargs):
         import rhodecode.lib.helpers as h
         cls = fargs[0]
         _user = cls._rhodecode_user
 
         log.debug('checking %s permissions %s for %s %s',
                   self.__class__.__name__, self.required_perms, cls, _user)
 
         if self.check_permissions(_user):
             log.debug('Permission granted for %s %s', cls, _user)
             return func(*fargs, **fkwargs)
 
         else:
             log.debug('Permission denied for %s %s', cls, _user)
             anonymous = _user.username == User.DEFAULT_USER
 
             if anonymous:
                 came_from = self._get_came_from()
                 h.flash(_('You need to be signed in to view this page'),
                         category='warning')
                 raise HTTPFound(
                     h.route_path('login', _query={'came_from': came_from}))
 
             else:
                 # redirect with 404 to prevent resource discovery
                 raise HTTPNotFound()
 
     def check_permissions(self, user):
         """Dummy function for overriding"""
         raise NotImplementedError(
             'You have to write this function in child class')
 
 
 class HasPermissionAllDecorator(PermsDecorator):
     """
     Checks for access permission for all given predicates. All of them
     have to be meet in order to fulfill the request
     """
 
     def check_permissions(self, user):
         perms = user.permissions_with_scope({})
         if self.required_perms.issubset(perms['global']):
             return True
         return False
 
 
 class HasPermissionAnyDecorator(PermsDecorator):
     """
     Checks for access permission for any of given predicates. In order to
     fulfill the request any of predicates must be meet
     """
 
     def check_permissions(self, user):
         perms = user.permissions_with_scope({})
         if self.required_perms.intersection(perms['global']):
             return True
         return False
 
 
 class HasRepoPermissionAllDecorator(PermsDecorator):
     """
     Checks for access permission for all given predicates for specific
     repository. All of them have to be meet in order to fulfill the request
     """
     def _get_repo_name(self):
         _request = self._get_request()
         return get_repo_slug(_request)
 
     def check_permissions(self, user):
         perms = user.permissions
         repo_name = self._get_repo_name()
 
         try:
             user_perms = set([perms['repositories'][repo_name]])
         except KeyError:
             log.debug('cannot locate repo with name: `%s` in permissions defs',
                       repo_name)
             return False
 
         log.debug('checking `%s` permissions for repo `%s`',
                   user_perms, repo_name)
         if self.required_perms.issubset(user_perms):
             return True
         return False
 
 
 class HasRepoPermissionAnyDecorator(PermsDecorator):
     """
     Checks for access permission for any of given predicates for specific
     repository. In order to fulfill the request any of predicates must be meet
     """
     def _get_repo_name(self):
         _request = self._get_request()
         return get_repo_slug(_request)
 
     def check_permissions(self, user):
         perms = user.permissions
         repo_name = self._get_repo_name()
 
         try:
             user_perms = set([perms['repositories'][repo_name]])
         except KeyError:
             log.debug(
                 'cannot locate repo with name: `%s` in permissions defs',
                 repo_name)
             return False
 
         log.debug('checking `%s` permissions for repo `%s`',
                   user_perms, repo_name)
         if self.required_perms.intersection(user_perms):
             return True
         return False
 
 
 class HasRepoGroupPermissionAllDecorator(PermsDecorator):
     """
     Checks for access permission for all given predicates for specific
     repository group. All of them have to be meet in order to
     fulfill the request
     """
     def _get_repo_group_name(self):
         _request = self._get_request()
         return get_repo_group_slug(_request)
 
     def check_permissions(self, user):
         perms = user.permissions
         group_name = self._get_repo_group_name()
         try:
             user_perms = set([perms['repositories_groups'][group_name]])
         except KeyError:
             log.debug(
                 'cannot locate repo group with name: `%s` in permissions defs',
                 group_name)
             return False
 
         log.debug('checking `%s` permissions for repo group `%s`',
                   user_perms, group_name)
         if self.required_perms.issubset(user_perms):
             return True
         return False
 
 
 class HasRepoGroupPermissionAnyDecorator(PermsDecorator):
     """
     Checks for access permission for any of given predicates for specific
     repository group. In order to fulfill the request any
     of predicates must be met
     """
     def _get_repo_group_name(self):
         _request = self._get_request()
         return get_repo_group_slug(_request)
 
     def check_permissions(self, user):
         perms = user.permissions
         group_name = self._get_repo_group_name()
 
         try:
             user_perms = set([perms['repositories_groups'][group_name]])
         except KeyError:
             log.debug(
                 'cannot locate repo group with name: `%s` in permissions defs',
                 group_name)
             return False
 
         log.debug('checking `%s` permissions for repo group `%s`',
                   user_perms, group_name)
         if self.required_perms.intersection(user_perms):
             return True
         return False
 
 
 class HasUserGroupPermissionAllDecorator(PermsDecorator):
     """
     Checks for access permission for all given predicates for specific
     user group. All of them have to be meet in order to fulfill the request
     """
     def _get_user_group_name(self):
         _request = self._get_request()
         return get_user_group_slug(_request)
 
     def check_permissions(self, user):
         perms = user.permissions
         group_name = self._get_user_group_name()
         try:
             user_perms = set([perms['user_groups'][group_name]])
         except KeyError:
             return False
 
         if self.required_perms.issubset(user_perms):
             return True
         return False
 
 
 class HasUserGroupPermissionAnyDecorator(PermsDecorator):
     """
     Checks for access permission for any of given predicates for specific
     user group. In order to fulfill the request any of predicates must be meet
     """
     def _get_user_group_name(self):
         _request = self._get_request()
         return get_user_group_slug(_request)
 
     def check_permissions(self, user):
         perms = user.permissions
         group_name = self._get_user_group_name()
         try:
             user_perms = set([perms['user_groups'][group_name]])
         except KeyError:
             return False
 
         if self.required_perms.intersection(user_perms):
             return True
         return False
 
 
 # CHECK FUNCTIONS
 class PermsFunction(object):
     """Base function for other check functions"""
 
     def __init__(self, *perms):
         self.required_perms = set(perms)
         self.repo_name = None
         self.repo_group_name = None
         self.user_group_name = None
 
     def __bool__(self):
         frame = inspect.currentframe()
         stack_trace = traceback.format_stack(frame)
         log.error('Checking bool value on a class instance of perm '
                   'function is not allowed: %s' % ''.join(stack_trace))
         # rather than throwing errors, here we always return False so if by
         # accident someone checks truth for just an instance it will always end
         # up in returning False
         return False
     __nonzero__ = __bool__
 
     def __call__(self, check_location='', user=None):
         if not user:
             log.debug('Using user attribute from global request')
             # TODO: remove this someday,put as user as attribute here
             request = self._get_request()
             user = request.user
 
         # init auth user if not already given
         if not isinstance(user, AuthUser):
             log.debug('Wrapping user %s into AuthUser', user)
             user = AuthUser(user.user_id)
 
         cls_name = self.__class__.__name__
         check_scope = self._get_check_scope(cls_name)
         check_location = check_location or 'unspecified location'
 
         log.debug('checking cls:%s %s usr:%s %s @ %s', cls_name,
                   self.required_perms, user, check_scope, check_location)
         if not user:
             log.warning('Empty user given for permission check')
             return False
 
         if self.check_permissions(user):
             log.debug('Permission to repo:`%s` GRANTED for user:`%s` @ %s',
                       check_scope, user, check_location)
             return True
 
         else:
             log.debug('Permission to repo:`%s` DENIED for user:`%s` @ %s',
                       check_scope, user, check_location)
             return False
 
     def _get_request(self):
         return get_request(self)
 
     def _get_check_scope(self, cls_name):
         return {
             'HasPermissionAll':          'GLOBAL',
             'HasPermissionAny':          'GLOBAL',
             'HasRepoPermissionAll':      'repo:%s' % self.repo_name,
             'HasRepoPermissionAny':      'repo:%s' % self.repo_name,
             'HasRepoGroupPermissionAll': 'repo_group:%s' % self.repo_group_name,
             'HasRepoGroupPermissionAny': 'repo_group:%s' % self.repo_group_name,
             'HasUserGroupPermissionAll': 'user_group:%s' % self.user_group_name,
             'HasUserGroupPermissionAny': 'user_group:%s' % self.user_group_name,
         }.get(cls_name, '?:%s' % cls_name)
 
     def check_permissions(self, user):
         """Dummy function for overriding"""
         raise Exception('You have to write this function in child class')
 
 
 class HasPermissionAll(PermsFunction):
     def check_permissions(self, user):
         perms = user.permissions_with_scope({})
         if self.required_perms.issubset(perms.get('global')):
             return True
         return False
 
 
 class HasPermissionAny(PermsFunction):
     def check_permissions(self, user):
         perms = user.permissions_with_scope({})
         if self.required_perms.intersection(perms.get('global')):
             return True
         return False
 
 
 class HasRepoPermissionAll(PermsFunction):
     def __call__(self, repo_name=None, check_location='', user=None):
         self.repo_name = repo_name
         return super(HasRepoPermissionAll, self).__call__(check_location, user)
 
     def _get_repo_name(self):
         if not self.repo_name:
             _request = self._get_request()
             self.repo_name = get_repo_slug(_request)
         return self.repo_name
 
     def check_permissions(self, user):
         self.repo_name = self._get_repo_name()
         perms = user.permissions
         try:
             user_perms = set([perms['repositories'][self.repo_name]])
         except KeyError:
             return False
         if self.required_perms.issubset(user_perms):
             return True
         return False
 
 
 class HasRepoPermissionAny(PermsFunction):
     def __call__(self, repo_name=None, check_location='', user=None):
         self.repo_name = repo_name
         return super(HasRepoPermissionAny, self).__call__(check_location, user)
 
     def _get_repo_name(self):
         if not self.repo_name:
             _request = self._get_request()
             self.repo_name = get_repo_slug(_request)
         return self.repo_name
 
     def check_permissions(self, user):
         self.repo_name = self._get_repo_name()
         perms = user.permissions
         try:
             user_perms = set([perms['repositories'][self.repo_name]])
         except KeyError:
             return False
         if self.required_perms.intersection(user_perms):
             return True
         return False
 
 
 class HasRepoGroupPermissionAny(PermsFunction):
     def __call__(self, group_name=None, check_location='', user=None):
         self.repo_group_name = group_name
         return super(HasRepoGroupPermissionAny, self).__call__(
             check_location, user)
 
     def check_permissions(self, user):
         perms = user.permissions
         try:
             user_perms = set(
                 [perms['repositories_groups'][self.repo_group_name]])
         except KeyError:
             return False
         if self.required_perms.intersection(user_perms):
             return True
         return False
 
 
 class HasRepoGroupPermissionAll(PermsFunction):
     def __call__(self, group_name=None, check_location='', user=None):
         self.repo_group_name = group_name
         return super(HasRepoGroupPermissionAll, self).__call__(
             check_location, user)
 
     def check_permissions(self, user):
         perms = user.permissions
         try:
             user_perms = set(
                 [perms['repositories_groups'][self.repo_group_name]])
         except KeyError:
             return False
         if self.required_perms.issubset(user_perms):
             return True
         return False
 
 
 class HasUserGroupPermissionAny(PermsFunction):
     def __call__(self, user_group_name=None, check_location='', user=None):
         self.user_group_name = user_group_name
         return super(HasUserGroupPermissionAny, self).__call__(
             check_location, user)
 
     def check_permissions(self, user):
         perms = user.permissions
         try:
             user_perms = set([perms['user_groups'][self.user_group_name]])
         except KeyError:
             return False
         if self.required_perms.intersection(user_perms):
             return True
         return False
 
 
 class HasUserGroupPermissionAll(PermsFunction):
     def __call__(self, user_group_name=None, check_location='', user=None):
         self.user_group_name = user_group_name
         return super(HasUserGroupPermissionAll, self).__call__(
             check_location, user)
 
     def check_permissions(self, user):
         perms = user.permissions
         try:
             user_perms = set([perms['user_groups'][self.user_group_name]])
         except KeyError:
             return False
         if self.required_perms.issubset(user_perms):
             return True
         return False
 
 
 # SPECIAL VERSION TO HANDLE MIDDLEWARE AUTH
 class HasPermissionAnyMiddleware(object):
     def __init__(self, *perms):
         self.required_perms = set(perms)
 
     def __call__(self, user, repo_name):
         # repo_name MUST be unicode, since we handle keys in permission
         # dict by unicode
         repo_name = safe_unicode(repo_name)
         user = AuthUser(user.user_id)
         log.debug(
             'Checking VCS protocol permissions %s for user:%s repo:`%s`',
             self.required_perms, user, repo_name)
 
         if self.check_permissions(user, repo_name):
             log.debug('Permission to repo:`%s` GRANTED for user:%s @ %s',
                       repo_name, user, 'PermissionMiddleware')
             return True
 
         else:
             log.debug('Permission to repo:`%s` DENIED for user:%s @ %s',
                       repo_name, user, 'PermissionMiddleware')
             return False
 
     def check_permissions(self, user, repo_name):
         perms = user.permissions_with_scope({'repo_name': repo_name})
 
         try:
             user_perms = set([perms['repositories'][repo_name]])
         except Exception:
             log.exception('Error while accessing user permissions')
             return False
 
         if self.required_perms.intersection(user_perms):
             return True
         return False
 
 
 # SPECIAL VERSION TO HANDLE API AUTH
 class _BaseApiPerm(object):
     def __init__(self, *perms):
         self.required_perms = set(perms)
 
     def __call__(self, check_location=None, user=None, repo_name=None,
                  group_name=None, user_group_name=None):
         cls_name = self.__class__.__name__
         check_scope = 'global:%s' % (self.required_perms,)
         if repo_name:
             check_scope += ', repo_name:%s' % (repo_name,)
 
         if group_name:
             check_scope += ', repo_group_name:%s' % (group_name,)
 
         if user_group_name:
             check_scope += ', user_group_name:%s' % (user_group_name,)
 
         log.debug(
             'checking cls:%s %s %s @ %s'
             % (cls_name, self.required_perms, check_scope, check_location))
         if not user:
             log.debug('Empty User passed into arguments')
             return False
 
         # process user
         if not isinstance(user, AuthUser):
             user = AuthUser(user.user_id)
         if not check_location:
             check_location = 'unspecified'
         if self.check_permissions(user.permissions, repo_name, group_name,
                                   user_group_name):
             log.debug('Permission to repo:`%s` GRANTED for user:`%s` @ %s',
                       check_scope, user, check_location)
             return True
 
         else:
             log.debug('Permission to repo:`%s` DENIED for user:`%s` @ %s',
                       check_scope, user, check_location)
             return False
 
     def check_permissions(self, perm_defs, repo_name=None, group_name=None,
                           user_group_name=None):
         """
         implement in child class should return True if permissions are ok,
         False otherwise
 
         :param perm_defs: dict with permission definitions
         :param repo_name: repo name
         """
         raise NotImplementedError()
 
 
 class HasPermissionAllApi(_BaseApiPerm):
     def check_permissions(self, perm_defs, repo_name=None, group_name=None,
                           user_group_name=None):
         if self.required_perms.issubset(perm_defs.get('global')):
             return True
         return False
 
 
 class HasPermissionAnyApi(_BaseApiPerm):
     def check_permissions(self, perm_defs, repo_name=None, group_name=None,
                           user_group_name=None):
         if self.required_perms.intersection(perm_defs.get('global')):
             return True
         return False
 
 
 class HasRepoPermissionAllApi(_BaseApiPerm):
     def check_permissions(self, perm_defs, repo_name=None, group_name=None,
                           user_group_name=None):
         try:
             _user_perms = set([perm_defs['repositories'][repo_name]])
         except KeyError:
             log.warning(traceback.format_exc())
             return False
         if self.required_perms.issubset(_user_perms):
             return True
         return False
 
 
 class HasRepoPermissionAnyApi(_BaseApiPerm):
     def check_permissions(self, perm_defs, repo_name=None, group_name=None,
                           user_group_name=None):
         try:
             _user_perms = set([perm_defs['repositories'][repo_name]])
         except KeyError:
             log.warning(traceback.format_exc())
             return False
         if self.required_perms.intersection(_user_perms):
             return True
         return False
 
 
 class HasRepoGroupPermissionAnyApi(_BaseApiPerm):
     def check_permissions(self, perm_defs, repo_name=None, group_name=None,
                           user_group_name=None):
         try:
             _user_perms = set([perm_defs['repositories_groups'][group_name]])
         except KeyError:
             log.warning(traceback.format_exc())
             return False
         if self.required_perms.intersection(_user_perms):
             return True
         return False
 
 
 class HasRepoGroupPermissionAllApi(_BaseApiPerm):
     def check_permissions(self, perm_defs, repo_name=None, group_name=None,
                           user_group_name=None):
         try:
             _user_perms = set([perm_defs['repositories_groups'][group_name]])
         except KeyError:
             log.warning(traceback.format_exc())
             return False
         if self.required_perms.issubset(_user_perms):
             return True
         return False
 
 
 class HasUserGroupPermissionAnyApi(_BaseApiPerm):
     def check_permissions(self, perm_defs, repo_name=None, group_name=None,
                           user_group_name=None):
         try:
             _user_perms = set([perm_defs['user_groups'][user_group_name]])
         except KeyError:
             log.warning(traceback.format_exc())
             return False
         if self.required_perms.intersection(_user_perms):
             return True
         return False
 
 
 def check_ip_access(source_ip, allowed_ips=None):
     """
     Checks if source_ip is a subnet of any of allowed_ips.
 
     :param source_ip:
     :param allowed_ips: list of allowed ips together with mask
     """
     log.debug('checking if ip:%s is subnet of %s' % (source_ip, allowed_ips))
     source_ip_address = ipaddress.ip_address(safe_unicode(source_ip))
     if isinstance(allowed_ips, (tuple, list, set)):
         for ip in allowed_ips:
             ip = safe_unicode(ip)
             try:
                 network_address = ipaddress.ip_network(ip, strict=False)
                 if source_ip_address in network_address:
                     log.debug('IP %s is network %s' %
                               (source_ip_address, network_address))
                     return True
                 # for any case we cannot determine the IP, don't crash just
                 # skip it and log as error, we want to say forbidden still when
                 # sending bad IP
             except Exception:
                 log.error(traceback.format_exc())
                 continue
     return False
 
 
 def get_cython_compat_decorator(wrapper, func):
     """
     Creates a cython compatible decorator. The previously used
     decorator.decorator() function seems to be incompatible with cython.
 
     :param wrapper: __wrapper method of the decorator class
     :param func: decorated function
     """
     @wraps(func)
     def local_wrapper(*args, **kwds):
         return wrapper(func, *args, **kwds)
     local_wrapper.__wrapped__ = func
     return local_wrapper
 
 

rhodecode/lib/dbmigrate/schema/db_1_2_0.py

@@ -1,1054 +1,1053 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import os
 import logging
 import datetime
 import traceback
 from datetime import date
 
 from sqlalchemy import *
 from sqlalchemy.ext.hybrid import hybrid_property
 from sqlalchemy.orm import relationship, joinedload, class_mapper, validates
 from beaker.cache import cache_region, region_invalidate
 
 from rhodecode.lib.vcs import get_backend
 from rhodecode.lib.vcs.utils.helpers import get_scm
 from rhodecode.lib.vcs.exceptions import VCSError
 from zope.cachedescriptors.property import Lazy as LazyProperty
 from rhodecode.lib.auth import generate_auth_token
 from rhodecode.lib.utils2 import str2bool, safe_str, get_commit_safe, safe_unicode
 from rhodecode.lib.exceptions import UserGroupAssignedException
 from rhodecode.lib.ext_json import json
 
 from rhodecode.model.meta import Base, Session
 from rhodecode.lib.caching_query import FromCache
 
 
 log = logging.getLogger(__name__)
 
 #==============================================================================
 # BASE CLASSES
 #==============================================================================
 
 class ModelSerializer(json.JSONEncoder):
     """
     Simple Serializer for JSON,
 
     usage::
 
         to make object customized for serialization implement a __json__
         method that will return a dict for serialization into json
 
     example::
 
         class Task(object):
 
             def __init__(self, name, value):
                 self.name = name
                 self.value = value
 
             def __json__(self):
                 return dict(name=self.name,
                             value=self.value)
 
     """
 
     def default(self, obj):
 
         if hasattr(obj, '__json__'):
             return obj.__json__()
         else:
             return json.JSONEncoder.default(self, obj)
 
 class BaseModel(object):
     """Base Model for all classess
 
     """
 
     @classmethod
     def _get_keys(cls):
         """return column names for this model """
         return class_mapper(cls).c.keys()
 
     def get_dict(self):
         """return dict with keys and values corresponding
         to this model data """
 
         d = {}
         for k in self._get_keys():
             d[k] = getattr(self, k)
         return d
 
     def get_appstruct(self):
         """return list with keys and values tupples corresponding
         to this model data """
 
         l = []
         for k in self._get_keys():
             l.append((k, getattr(self, k),))
         return l
 
     def populate_obj(self, populate_dict):
         """populate model with data from given populate_dict"""
 
         for k in self._get_keys():
             if k in populate_dict:
                 setattr(self, k, populate_dict[k])
 
     @classmethod
     def query(cls):
         return Session.query(cls)
 
     @classmethod
     def get(cls, id_):
         if id_:
             return cls.query().get(id_)
 
     @classmethod
     def getAll(cls):
         return cls.query().all()
 
     @classmethod
     def delete(cls, id_):
         obj = cls.query().get(id_)
         Session.delete(obj)
         Session.commit()
 
 
 class RhodeCodeSetting(Base, BaseModel):
     __tablename__ = 'rhodecode_settings'
     __table_args__ = (UniqueConstraint('app_settings_name'), {'extend_existing':True})
     app_settings_id = Column("app_settings_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     app_settings_name = Column("app_settings_name", String(255), nullable=True, unique=None, default=None)
     _app_settings_value = Column("app_settings_value", String(255), nullable=True, unique=None, default=None)
 
     def __init__(self, k='', v=''):
         self.app_settings_name = k
         self.app_settings_value = v
 
 
     @validates('_app_settings_value')
     def validate_settings_value(self, key, val):
         assert type(val) == unicode
         return val
 
     @hybrid_property
     def app_settings_value(self):
         v = self._app_settings_value
         if v == 'ldap_active':
             v = str2bool(v)
         return v
 
     @app_settings_value.setter
     def app_settings_value(self, val):
         """
         Setter that will always make sure we use unicode in app_settings_value
 
         :param val:
         """
         self._app_settings_value = safe_unicode(val)
 
     def __repr__(self):
         return "<%s('%s:%s')>" % (self.__class__.__name__,
                                   self.app_settings_name, self.app_settings_value)
 
 
     @classmethod
     def get_by_name(cls, ldap_key):
         return cls.query()\
             .filter(cls.app_settings_name == ldap_key).scalar()
 
     @classmethod
     def get_app_settings(cls, cache=False):
 
         ret = cls.query()
 
         if cache:
             ret = ret.options(FromCache("sql_cache_short", "get_hg_settings"))
 
         if not ret:
             raise Exception('Could not get application settings !')
         settings = {}
         for each in ret:
             settings['rhodecode_' + each.app_settings_name] = \
                 each.app_settings_value
 
         return settings
 
     @classmethod
     def get_ldap_settings(cls, cache=False):
         ret = cls.query()\
                 .filter(cls.app_settings_name.startswith('ldap_')).all()
         fd = {}
         for row in ret:
             fd.update({row.app_settings_name:row.app_settings_value})
 
         return fd
 
 
 class RhodeCodeUi(Base, BaseModel):
     __tablename__ = 'rhodecode_ui'
     __table_args__ = (UniqueConstraint('ui_key'), {'extend_existing':True})
 
     HOOK_REPO_SIZE = 'changegroup.repo_size'
     HOOK_PUSH = 'pretxnchangegroup.push_logger'
     HOOK_PULL = 'preoutgoing.pull_logger'
 
     ui_id = Column("ui_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     ui_section = Column("ui_section", String(255), nullable=True, unique=None, default=None)
     ui_key = Column("ui_key", String(255), nullable=True, unique=None, default=None)
     ui_value = Column("ui_value", String(255), nullable=True, unique=None, default=None)
     ui_active = Column("ui_active", Boolean(), nullable=True, unique=None, default=True)
 
 
     @classmethod
     def get_by_key(cls, key):
         return cls.query().filter(cls.ui_key == key)
 
 
     @classmethod
     def get_builtin_hooks(cls):
         q = cls.query()
         q = q.filter(cls.ui_key.in_([cls.HOOK_REPO_SIZE,
                                      cls.HOOK_PUSH, cls.HOOK_PULL]))
         return q.all()
 
     @classmethod
     def get_custom_hooks(cls):
         q = cls.query()
         q = q.filter(~cls.ui_key.in_([cls.HOOK_REPO_SIZE,
                                       cls.HOOK_PUSH, cls.HOOK_PULL]))
         q = q.filter(cls.ui_section == 'hooks')
         return q.all()
 
     @classmethod
     def create_or_update_hook(cls, key, val):
         new_ui = cls.get_by_key(key).scalar() or cls()
         new_ui.ui_section = 'hooks'
         new_ui.ui_active = True
         new_ui.ui_key = key
         new_ui.ui_value = val
 
         Session.add(new_ui)
         Session.commit()
 
 
 class User(Base, BaseModel):
     __tablename__ = 'users'
     __table_args__ = (UniqueConstraint('username'), UniqueConstraint('email'), {'extend_existing':True})
     user_id = Column("user_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     username = Column("username", String(255), nullable=True, unique=None, default=None)
     password = Column("password", String(255), nullable=True, unique=None, default=None)
     active = Column("active", Boolean(), nullable=True, unique=None, default=None)
     admin = Column("admin", Boolean(), nullable=True, unique=None, default=False)
     name = Column("name", String(255), nullable=True, unique=None, default=None)
     lastname = Column("lastname", String(255), nullable=True, unique=None, default=None)
     email = Column("email", String(255), nullable=True, unique=None, default=None)
     last_login = Column("last_login", DateTime(timezone=False), nullable=True, unique=None, default=None)
     ldap_dn = Column("ldap_dn", String(255), nullable=True, unique=None, default=None)
     api_key = Column("api_key", String(255), nullable=True, unique=None, default=None)
 
     user_log = relationship('UserLog', cascade='all')
     user_perms = relationship('UserToPerm', primaryjoin="User.user_id==UserToPerm.user_id", cascade='all')
 
     repositories = relationship('Repository')
     user_followers = relationship('UserFollowing', primaryjoin='UserFollowing.follows_user_id==User.user_id', cascade='all')
     repo_to_perm = relationship('UserRepoToPerm', primaryjoin='UserRepoToPerm.user_id==User.user_id', cascade='all')
 
     group_member = relationship('UserGroupMember', cascade='all')
 
     @property
     def full_contact(self):
         return '%s %s <%s>' % (self.name, self.lastname, self.email)
 
     @property
     def short_contact(self):
         return '%s %s' % (self.name, self.lastname)
 
     @property
     def is_admin(self):
         return self.admin
 
     def __repr__(self):
         try:
             return "<%s('id:%s:%s')>" % (self.__class__.__name__,
                                              self.user_id, self.username)
         except:
             return self.__class__.__name__
 
     @classmethod
     def get_by_username(cls, username, case_insensitive=False):
         if case_insensitive:
             return Session.query(cls).filter(cls.username.ilike(username)).scalar()
         else:
             return Session.query(cls).filter(cls.username == username).scalar()
 
     @classmethod
     def get_by_auth_token(cls, auth_token):
         return cls.query().filter(cls.api_key == auth_token).one()
 
     def update_lastlogin(self):
         """Update user lastlogin"""
 
         self.last_login = datetime.datetime.now()
         Session.add(self)
         Session.commit()
         log.debug('updated user %s lastlogin' % self.username)
 
     @classmethod
     def create(cls, form_data):
         from rhodecode.lib.auth import get_crypt_password
 
         try:
             new_user = cls()
             for k, v in form_data.items():
                 if k == 'password':
                     v = get_crypt_password(v)
                 setattr(new_user, k, v)
 
             new_user.api_key = generate_auth_token(form_data['username'])
             Session.add(new_user)
             Session.commit()
             return new_user
         except:
             log.error(traceback.format_exc())
             Session.rollback()
             raise
 
 class UserLog(Base, BaseModel):
     __tablename__ = 'user_logs'
     __table_args__ = {'extend_existing':True}
     user_log_id = Column("user_log_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)
     repository_id = Column("repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=False, unique=None, default=None)
     repository_name = Column("repository_name", String(255), nullable=True, unique=None, default=None)
     user_ip = Column("user_ip", String(255), nullable=True, unique=None, default=None)
     action = Column("action", String(1200000), nullable=True, unique=None, default=None)
     action_date = Column("action_date", DateTime(timezone=False), nullable=True, unique=None, default=None)
 
     @property
     def action_as_day(self):
         return date(*self.action_date.timetuple()[:3])
 
     user = relationship('User')
     repository = relationship('Repository')
 
 
 class UserGroup(Base, BaseModel):
     __tablename__ = 'users_groups'
     __table_args__ = {'extend_existing':True}
 
     users_group_id = Column("users_group_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     users_group_name = Column("users_group_name", String(255), nullable=False, unique=True, default=None)
     users_group_active = Column("users_group_active", Boolean(), nullable=True, unique=None, default=None)
 
     members = relationship('UserGroupMember', cascade="all, delete, delete-orphan", lazy="joined")
 
     def __repr__(self):
         return '<userGroup(%s)>' % (self.users_group_name)
 
     @classmethod
     def get_by_group_name(cls, group_name, cache=False, case_insensitive=False):
         if case_insensitive:
             gr = cls.query()\
                 .filter(cls.users_group_name.ilike(group_name))
         else:
             gr = cls.query()\
                 .filter(cls.users_group_name == group_name)
         if cache:
             gr = gr.options(FromCache("sql_cache_short",
                                           "get_user_%s" % group_name))
         return gr.scalar()
 
-
     @classmethod
     def get(cls, users_group_id, cache=False):
         users_group = cls.query()
         if cache:
             users_group = users_group.options(FromCache("sql_cache_short",
                                     "get_users_group_%s" % users_group_id))
         return users_group.get(users_group_id)
 
     @classmethod
     def create(cls, form_data):
         try:
-            new_users_group = cls()
+            new_user_group = cls()
             for k, v in form_data.items():
-                setattr(new_users_group, k, v)
+                setattr(new_user_group, k, v)
 
-            Session.add(new_users_group)
+            Session.add(new_user_group)
             Session.commit()
-            return new_users_group
+            return new_user_group
         except:
             log.error(traceback.format_exc())
             Session.rollback()
             raise
 
     @classmethod
     def update(cls, users_group_id, form_data):
 
         try:
             users_group = cls.get(users_group_id, cache=False)
 
             for k, v in form_data.items():
                 if k == 'users_group_members':
                     users_group.members = []
                     Session.flush()
                     members_list = []
                     if v:
                         v = [v] if isinstance(v, basestring) else v
                         for u_id in set(v):
                             member = UserGroupMember(users_group_id, u_id)
                             members_list.append(member)
                     setattr(users_group, 'members', members_list)
                 setattr(users_group, k, v)
 
             Session.add(users_group)
             Session.commit()
         except:
             log.error(traceback.format_exc())
             Session.rollback()
             raise
 
     @classmethod
     def delete(cls, user_group_id):
         try:
 
             # check if this group is not assigned to repo
             assigned_groups = UserGroupRepoToPerm.query()\
                 .filter(UserGroupRepoToPerm.users_group_id ==
                         user_group_id).all()
 
             if assigned_groups:
                 raise UserGroupAssignedException(
                     'UserGroup assigned to %s' % assigned_groups)
 
             users_group = cls.get(user_group_id, cache=False)
             Session.delete(users_group)
             Session.commit()
         except:
             log.error(traceback.format_exc())
             Session.rollback()
             raise
 
 class UserGroupMember(Base, BaseModel):
     __tablename__ = 'users_groups_members'
     __table_args__ = {'extend_existing':True}
 
     users_group_member_id = Column("users_group_member_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     users_group_id = Column("users_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)
 
     user = relationship('User', lazy='joined')
     users_group = relationship('UserGroup')
 
     def __init__(self, gr_id='', u_id=''):
         self.users_group_id = gr_id
         self.user_id = u_id
 
     @staticmethod
     def add_user_to_group(group, user):
         ugm = UserGroupMember()
         ugm.users_group = group
         ugm.user = user
         Session.add(ugm)
         Session.commit()
         return ugm
 
 class Repository(Base, BaseModel):
     __tablename__ = 'repositories'
     __table_args__ = (UniqueConstraint('repo_name'), {'extend_existing':True},)
 
     repo_id = Column("repo_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     repo_name = Column("repo_name", String(255), nullable=False, unique=True, default=None)
     clone_uri = Column("clone_uri", String(255), nullable=True, unique=False, default=None)
     repo_type = Column("repo_type", String(255), nullable=False, unique=False, default='hg')
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=False, default=None)
     private = Column("private", Boolean(), nullable=True, unique=None, default=None)
     enable_statistics = Column("statistics", Boolean(), nullable=True, unique=None, default=True)
     enable_downloads = Column("downloads", Boolean(), nullable=True, unique=None, default=True)
     description = Column("description", String(10000), nullable=True, unique=None, default=None)
     created_on = Column('created_on', DateTime(timezone=False), nullable=True, unique=None, default=datetime.datetime.now)
 
     fork_id = Column("fork_id", Integer(), ForeignKey('repositories.repo_id'), nullable=True, unique=False, default=None)
     group_id = Column("group_id", Integer(), ForeignKey('groups.group_id'), nullable=True, unique=False, default=None)
 
 
     user = relationship('User')
     fork = relationship('Repository', remote_side=repo_id)
     group = relationship('RepoGroup')
     repo_to_perm = relationship('UserRepoToPerm', cascade='all', order_by='UserRepoToPerm.repo_to_perm_id')
     users_group_to_perm = relationship('UserGroupRepoToPerm', cascade='all')
     stats = relationship('Statistics', cascade='all', uselist=False)
 
     followers = relationship('UserFollowing', primaryjoin='UserFollowing.follows_repo_id==Repository.repo_id', cascade='all')
 
     logs = relationship('UserLog', cascade='all')
 
     def __repr__(self):
         return "<%s('%s:%s')>" % (self.__class__.__name__,
                                   self.repo_id, self.repo_name)
 
     @classmethod
     def url_sep(cls):
         return '/'
 
     @classmethod
     def get_by_repo_name(cls, repo_name):
         q = Session.query(cls).filter(cls.repo_name == repo_name)
         q = q.options(joinedload(Repository.fork))\
                 .options(joinedload(Repository.user))\
                 .options(joinedload(Repository.group))
         return q.one()
 
     @classmethod
     def get_repo_forks(cls, repo_id):
         return cls.query().filter(Repository.fork_id == repo_id)
 
     @classmethod
     def base_path(cls):
         """
         Returns base path when all repos are stored
 
         :param cls:
         """
         q = Session.query(RhodeCodeUi).filter(RhodeCodeUi.ui_key ==
                                               cls.url_sep())
         q.options(FromCache("sql_cache_short", "repository_repo_path"))
         return q.one().ui_value
 
     @property
     def just_name(self):
         return self.repo_name.split(Repository.url_sep())[-1]
 
     @property
     def groups_with_parents(self):
         groups = []
         if self.group is None:
             return groups
 
         cur_gr = self.group
         groups.insert(0, cur_gr)
         while 1:
             gr = getattr(cur_gr, 'parent_group', None)
             cur_gr = cur_gr.parent_group
             if gr is None:
                 break
             groups.insert(0, gr)
 
         return groups
 
     @property
     def groups_and_repo(self):
         return self.groups_with_parents, self.just_name
 
     @LazyProperty
     def repo_path(self):
         """
         Returns base full path for that repository means where it actually
         exists on a filesystem
         """
         q = Session.query(RhodeCodeUi).filter(RhodeCodeUi.ui_key ==
                                               Repository.url_sep())
         q.options(FromCache("sql_cache_short", "repository_repo_path"))
         return q.one().ui_value
 
     @property
     def repo_full_path(self):
         p = [self.repo_path]
         # we need to split the name by / since this is how we store the
         # names in the database, but that eventually needs to be converted
         # into a valid system path
         p += self.repo_name.split(Repository.url_sep())
         return os.path.join(*p)
 
     def get_new_name(self, repo_name):
         """
         returns new full repository name based on assigned group and new new
 
         :param group_name:
         """
         path_prefix = self.group.full_path_splitted if self.group else []
         return Repository.url_sep().join(path_prefix + [repo_name])
 
     @property
     def _config(self):
         """
         Returns db based config object.
         """
         from rhodecode.lib.utils import make_db_config
         return make_db_config(clear_session=False)
 
     @classmethod
     def is_valid(cls, repo_name):
         """
         returns True if given repo name is a valid filesystem repository
 
         :param cls:
         :param repo_name:
         """
         from rhodecode.lib.utils import is_valid_repo
 
         return is_valid_repo(repo_name, cls.base_path())
 
 
     #==========================================================================
     # SCM PROPERTIES
     #==========================================================================
 
     def get_commit(self, rev):
         return get_commit_safe(self.scm_instance, rev)
 
     @property
     def tip(self):
         return self.get_commit('tip')
 
     @property
     def author(self):
         return self.tip.author
 
     @property
     def last_change(self):
         return self.scm_instance.last_change
 
     #==========================================================================
     # SCM CACHE INSTANCE
     #==========================================================================
 
     @property
     def invalidate(self):
         return CacheInvalidation.invalidate(self.repo_name)
 
     def set_invalidate(self):
         """
         set a cache for invalidation for this instance
         """
         CacheInvalidation.set_invalidate(self.repo_name)
 
     @LazyProperty
     def scm_instance(self):
         return self.__get_instance()
 
     @property
     def scm_instance_cached(self):
         @cache_region('long_term')
         def _c(repo_name):
             return self.__get_instance()
         rn = self.repo_name
 
         inv = self.invalidate
         if inv is not None:
             region_invalidate(_c, None, rn)
             # update our cache
             CacheInvalidation.set_valid(inv.cache_key)
         return _c(rn)
 
     def __get_instance(self):
 
         repo_full_path = self.repo_full_path
 
         try:
             alias = get_scm(repo_full_path)[0]
             log.debug('Creating instance of %s repository' % alias)
             backend = get_backend(alias)
         except VCSError:
             log.error(traceback.format_exc())
             log.error('Perhaps this repository is in db and not in '
                       'filesystem run rescan repositories with '
                       '"destroy old data " option from admin panel')
             return
 
         if alias == 'hg':
 
             repo = backend(safe_str(repo_full_path), create=False,
                            config=self._config)
 
         else:
             repo = backend(repo_full_path, create=False)
 
         return repo
 
 
 class Group(Base, BaseModel):
     __tablename__ = 'groups'
     __table_args__ = (UniqueConstraint('group_name', 'group_parent_id'),
                       CheckConstraint('group_id != group_parent_id'), {'extend_existing':True},)
     __mapper_args__ = {'order_by':'group_name'}
 
     group_id = Column("group_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     group_name = Column("group_name", String(255), nullable=False, unique=True, default=None)
     group_parent_id = Column("group_parent_id", Integer(), ForeignKey('groups.group_id'), nullable=True, unique=None, default=None)
     group_description = Column("group_description", String(10000), nullable=True, unique=None, default=None)
 
     parent_group = relationship('Group', remote_side=group_id)
 
     def __init__(self, group_name='', parent_group=None):
         self.group_name = group_name
         self.parent_group = parent_group
 
     def __repr__(self):
         return "<%s('%s:%s')>" % (self.__class__.__name__, self.group_id,
                                   self.group_name)
 
     @classmethod
     def url_sep(cls):
         return '/'
 
     @classmethod
     def get_by_group_name(cls, group_name, cache=False, case_insensitive=False):
         if case_insensitive:
             gr = cls.query()\
                 .filter(cls.group_name.ilike(group_name))
         else:
             gr = cls.query()\
                 .filter(cls.group_name == group_name)
         if cache:
             gr = gr.options(FromCache("sql_cache_short",
                                           "get_group_%s" % group_name))
         return gr.scalar()
 
     @property
     def parents(self):
         parents_recursion_limit = 5
         groups = []
         if self.parent_group is None:
             return groups
         cur_gr = self.parent_group
         groups.insert(0, cur_gr)
         cnt = 0
         while 1:
             cnt += 1
             gr = getattr(cur_gr, 'parent_group', None)
             cur_gr = cur_gr.parent_group
             if gr is None:
                 break
             if cnt == parents_recursion_limit:
                 # this will prevent accidental infinit loops
                 log.error('group nested more than %s' %
                           parents_recursion_limit)
                 break
 
             groups.insert(0, gr)
         return groups
 
     @property
     def children(self):
         return Group.query().filter(Group.parent_group == self)
 
     @property
     def name(self):
         return self.group_name.split(Group.url_sep())[-1]
 
     @property
     def full_path(self):
         return self.group_name
 
     @property
     def full_path_splitted(self):
         return self.group_name.split(Group.url_sep())
 
     @property
     def repositories(self):
         return Repository.query().filter(Repository.group == self)
 
     @property
     def repositories_recursive_count(self):
         cnt = self.repositories.count()
 
         def children_count(group):
             cnt = 0
             for child in group.children:
                 cnt += child.repositories.count()
                 cnt += children_count(child)
             return cnt
 
         return cnt + children_count(self)
 
 
     def get_new_name(self, group_name):
         """
         returns new full group name based on parent and new name
 
         :param group_name:
         """
         path_prefix = (self.parent_group.full_path_splitted if
                        self.parent_group else [])
         return Group.url_sep().join(path_prefix + [group_name])
 
 
 class Permission(Base, BaseModel):
     __tablename__ = 'permissions'
     __table_args__ = {'extend_existing':True}
     permission_id = Column("permission_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     permission_name = Column("permission_name", String(255), nullable=True, unique=None, default=None)
     permission_longname = Column("permission_longname", String(255), nullable=True, unique=None, default=None)
 
     def __repr__(self):
         return "<%s('%s:%s')>" % (self.__class__.__name__,
                                   self.permission_id, self.permission_name)
 
     @classmethod
     def get_by_key(cls, key):
         return cls.query().filter(cls.permission_name == key).scalar()
 
 class UserRepoToPerm(Base, BaseModel):
     __tablename__ = 'repo_to_perm'
     __table_args__ = (UniqueConstraint('user_id', 'repository_id'), {'extend_existing':True})
     repo_to_perm_id = Column("repo_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)
     permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
     repository_id = Column("repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=False, unique=None, default=None)
 
     user = relationship('User')
     permission = relationship('Permission')
     repository = relationship('Repository')
 
 class UserToPerm(Base, BaseModel):
     __tablename__ = 'user_to_perm'
     __table_args__ = (UniqueConstraint('user_id', 'permission_id'), {'extend_existing':True})
     user_to_perm_id = Column("user_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)
     permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
 
     user = relationship('User')
     permission = relationship('Permission')
 
     @classmethod
     def has_perm(cls, user_id, perm):
         if not isinstance(perm, Permission):
             raise Exception('perm needs to be an instance of Permission class')
 
         return cls.query().filter(cls.user_id == user_id)\
             .filter(cls.permission == perm).scalar() is not None
 
     @classmethod
     def grant_perm(cls, user_id, perm):
         if not isinstance(perm, Permission):
             raise Exception('perm needs to be an instance of Permission class')
 
         new = cls()
         new.user_id = user_id
         new.permission = perm
         try:
             Session.add(new)
             Session.commit()
         except:
             Session.rollback()
 
 
     @classmethod
     def revoke_perm(cls, user_id, perm):
         if not isinstance(perm, Permission):
             raise Exception('perm needs to be an instance of Permission class')
 
         try:
             cls.query().filter(cls.user_id == user_id) \
                 .filter(cls.permission == perm).delete()
             Session.commit()
         except:
             Session.rollback()
 
 class UserGroupRepoToPerm(Base, BaseModel):
     __tablename__ = 'users_group_repo_to_perm'
     __table_args__ = (UniqueConstraint('repository_id', 'users_group_id', 'permission_id'), {'extend_existing':True})
     users_group_to_perm_id = Column("users_group_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     users_group_id = Column("users_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)
     permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
     repository_id = Column("repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=False, unique=None, default=None)
 
     users_group = relationship('UserGroup')
     permission = relationship('Permission')
     repository = relationship('Repository')
 
     def __repr__(self):
         return '<userGroup:%s => %s >' % (self.users_group, self.repository)
 
 class UserGroupToPerm(Base, BaseModel):
     __tablename__ = 'users_group_to_perm'
     __table_args__ = {'extend_existing':True}
     users_group_to_perm_id = Column("users_group_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     users_group_id = Column("users_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)
     permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
 
     users_group = relationship('UserGroup')
     permission = relationship('Permission')
 
 
     @classmethod
     def has_perm(cls, users_group_id, perm):
         if not isinstance(perm, Permission):
             raise Exception('perm needs to be an instance of Permission class')
 
         return cls.query().filter(cls.users_group_id ==
                                          users_group_id)\
                                          .filter(cls.permission == perm)\
                                          .scalar() is not None
 
     @classmethod
     def grant_perm(cls, users_group_id, perm):
         if not isinstance(perm, Permission):
             raise Exception('perm needs to be an instance of Permission class')
 
         new = cls()
         new.users_group_id = users_group_id
         new.permission = perm
         try:
             Session.add(new)
             Session.commit()
         except:
             Session.rollback()
 
 
     @classmethod
     def revoke_perm(cls, users_group_id, perm):
         if not isinstance(perm, Permission):
             raise Exception('perm needs to be an instance of Permission class')
 
         try:
             cls.query().filter(cls.users_group_id == users_group_id) \
                 .filter(cls.permission == perm).delete()
             Session.commit()
         except:
             Session.rollback()
 
 
 class UserRepoGroupToPerm(Base, BaseModel):
     __tablename__ = 'group_to_perm'
     __table_args__ = (UniqueConstraint('group_id', 'permission_id'), {'extend_existing':True})
 
     group_to_perm_id = Column("group_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)
     permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
     group_id = Column("group_id", Integer(), ForeignKey('groups.group_id'), nullable=False, unique=None, default=None)
 
     user = relationship('User')
     permission = relationship('Permission')
     group = relationship('RepoGroup')
 
 class Statistics(Base, BaseModel):
     __tablename__ = 'statistics'
     __table_args__ = (UniqueConstraint('repository_id'), {'extend_existing':True})
     stat_id = Column("stat_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     repository_id = Column("repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=False, unique=True, default=None)
     stat_on_revision = Column("stat_on_revision", Integer(), nullable=False)
     commit_activity = Column("commit_activity", LargeBinary(1000000), nullable=False)#JSON data
     commit_activity_combined = Column("commit_activity_combined", LargeBinary(), nullable=False)#JSON data
     languages = Column("languages", LargeBinary(1000000), nullable=False)#JSON data
 
     repository = relationship('Repository', single_parent=True)
 
 class UserFollowing(Base, BaseModel):
     __tablename__ = 'user_followings'
     __table_args__ = (UniqueConstraint('user_id', 'follows_repository_id'),
                       UniqueConstraint('user_id', 'follows_user_id')
                       , {'extend_existing':True})
 
     user_following_id = Column("user_following_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)
     follows_repo_id = Column("follows_repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=True, unique=None, default=None)
     follows_user_id = Column("follows_user_id", Integer(), ForeignKey('users.user_id'), nullable=True, unique=None, default=None)
     follows_from = Column('follows_from', DateTime(timezone=False), nullable=True, unique=None, default=datetime.datetime.now)
 
     user = relationship('User', primaryjoin='User.user_id==UserFollowing.user_id')
 
     follows_user = relationship('User', primaryjoin='User.user_id==UserFollowing.follows_user_id')
     follows_repository = relationship('Repository', order_by='Repository.repo_name')
 
 
     @classmethod
     def get_repo_followers(cls, repo_id):
         return cls.query().filter(cls.follows_repo_id == repo_id)
 
 class CacheInvalidation(Base, BaseModel):
     __tablename__ = 'cache_invalidation'
     __table_args__ = (UniqueConstraint('cache_key'), {'extend_existing':True})
     cache_id = Column("cache_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     cache_key = Column("cache_key", String(255), nullable=True, unique=None, default=None)
     cache_args = Column("cache_args", String(255), nullable=True, unique=None, default=None)
     cache_active = Column("cache_active", Boolean(), nullable=True, unique=None, default=False)
 
 
     def __init__(self, cache_key, cache_args=''):
         self.cache_key = cache_key
         self.cache_args = cache_args
         self.cache_active = False
 
     def __repr__(self):
         return "<%s('%s:%s')>" % (self.__class__.__name__,
                                   self.cache_id, self.cache_key)
 
     @classmethod
     def invalidate(cls, key):
         """
         Returns Invalidation object if this given key should be invalidated
         None otherwise. `cache_active = False` means that this cache
         state is not valid and needs to be invalidated
 
         :param key:
         """
         return cls.query()\
                 .filter(CacheInvalidation.cache_key == key)\
                 .filter(CacheInvalidation.cache_active == False)\
                 .scalar()
 
     @classmethod
     def set_invalidate(cls, key):
         """
         Mark this Cache key for invalidation
 
         :param key:
         """
 
         log.debug('marking %s for invalidation' % key)
         inv_obj = Session.query(cls)\
             .filter(cls.cache_key == key).scalar()
         if inv_obj:
             inv_obj.cache_active = False
         else:
             log.debug('cache key not found in invalidation db -> creating one')
             inv_obj = CacheInvalidation(key)
 
         try:
             Session.add(inv_obj)
             Session.commit()
         except Exception:
             log.error(traceback.format_exc())
             Session.rollback()
 
     @classmethod
     def set_valid(cls, key):
         """
         Mark this cache key as active and currently cached
 
         :param key:
         """
         inv_obj = Session.query(CacheInvalidation)\
             .filter(CacheInvalidation.cache_key == key).scalar()
         inv_obj.cache_active = True
         Session.add(inv_obj)
         Session.commit()
 
 class DbMigrateVersion(Base, BaseModel):
     __tablename__ = 'db_migrate_version'
     __table_args__ = {'extend_existing':True}
     repository_id = Column('repository_id', String(250), primary_key=True)
     repository_path = Column('repository_path', Text)
     version = Column('version', Integer)

rhodecode/lib/utils.py

@@ -1,973 +1,980 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 Utilities library for RhodeCode
 """
 
 import datetime
 import decorator
 import json
 import logging
 import os
 import re
 import shutil
 import tempfile
 import traceback
 import tarfile
 import warnings
 import hashlib
 from os.path import join as jn
 
 import paste
 import pkg_resources
 from paste.script.command import Command, BadCommand
 from webhelpers.text import collapse, remove_formatting, strip_tags
 from mako import exceptions
 from pyramid.threadlocal import get_current_registry
 from pyramid.request import Request
 
 from rhodecode.lib.fakemod import create_module
 from rhodecode.lib.vcs.backends.base import Config
 from rhodecode.lib.vcs.exceptions import VCSError
 from rhodecode.lib.vcs.utils.helpers import get_scm, get_scm_backend
 from rhodecode.lib.utils2 import (
     safe_str, safe_unicode, get_current_rhodecode_user, md5)
 from rhodecode.model import meta
 from rhodecode.model.db import (
     Repository, User, RhodeCodeUi, UserLog, RepoGroup, UserGroup)
 from rhodecode.model.meta import Session
 
 
 log = logging.getLogger(__name__)
 
 REMOVED_REPO_PAT = re.compile(r'rm__\d{8}_\d{6}_\d{6}__.*')
 
 # String which contains characters that are not allowed in slug names for
 # repositories or repository groups. It is properly escaped to use it in
 # regular expressions.
 SLUG_BAD_CHARS = re.escape('`?=[]\;\'"<>,/~!@#$%^&*()+{}|:')
 
 # Regex that matches forbidden characters in repo/group slugs.
 SLUG_BAD_CHAR_RE = re.compile('[{}]'.format(SLUG_BAD_CHARS))
 
 # Regex that matches allowed characters in repo/group slugs.
 SLUG_GOOD_CHAR_RE = re.compile('[^{}]'.format(SLUG_BAD_CHARS))
 
 # Regex that matches whole repo/group slugs.
 SLUG_RE = re.compile('[^{}]+'.format(SLUG_BAD_CHARS))
 
 _license_cache = None
 
 
 def repo_name_slug(value):
     """
     Return slug of name of repository
     This function is called on each creation/modification
     of repository to prevent bad names in repo
     """
     replacement_char = '-'
 
     slug = remove_formatting(value)
     slug = SLUG_BAD_CHAR_RE.sub('', slug)
     slug = re.sub('[\s]+', '-', slug)
     slug = collapse(slug, replacement_char)
     return slug
 
 
 #==============================================================================
 # PERM DECORATOR HELPERS FOR EXTRACTING NAMES FOR PERM CHECKS
 #==============================================================================
 def get_repo_slug(request):
     _repo = ''
     if isinstance(request, Request):
         if hasattr(request, 'db_repo'):
             # if our requests has set db reference use it for name, this
             # translates the example.com/_<id> into proper repo names
             _repo = request.db_repo.repo_name
         elif getattr(request, 'matchdict', None):
             # pyramid
             _repo = request.matchdict.get('repo_name')
 
     # TODO(marcink): remove after pylons migration...
     if not _repo:
         _repo = request.environ['pylons.routes_dict'].get('repo_name')
 
     if _repo:
         _repo = _repo.rstrip('/')
     return _repo
 
 
 def get_repo_group_slug(request):
     _group = ''
     if isinstance(request, Request):
         if hasattr(request, 'db_repo_group'):
             # if our requests has set db reference use it for name, this
             # translates the example.com/_<id> into proper repo group names
             _group = request.db_repo_group.group_name
         elif getattr(request, 'matchdict', None):
             # pyramid
             _group = request.matchdict.get('repo_group_name')
 
     # TODO(marcink): remove after pylons migration...
     if not _group:
         _group = request.environ['pylons.routes_dict'].get('group_name')
 
     if _group:
         _group = _group.rstrip('/')
     return _group
 
 
 def get_user_group_slug(request):
-    if isinstance(request, Request) and getattr(request, 'matchdict', None):
-        # pyramid
-        _group = request.matchdict.get('user_group_id')
-    else:
-        _group = request.environ['pylons.routes_dict'].get('user_group_id')
+    _user_group = ''
+    if isinstance(request, Request):
+
+        if hasattr(request, 'db_user_group'):
+            _user_group = request.db_user_group.users_group_name
+        elif getattr(request, 'matchdict', None):
+            # pyramid
+            _user_group = request.matchdict.get('user_group_id')
 
-    try:
-        _group = UserGroup.get(_group)
-        if _group:
-            _group = _group.users_group_name
-    except Exception:
-        log.exception('Failed to get user group by id')
-        # catch all failures here
-        return None
+            try:
+                _user_group = UserGroup.get(_user_group)
+                if _user_group:
+                    _user_group = _user_group.users_group_name
+            except Exception:
+                log.exception('Failed to get user group by id')
+                # catch all failures here
+                return None
 
-    return _group
+    # TODO(marcink): remove after pylons migration...
+    if not _user_group:
+        _user_group = request.environ['pylons.routes_dict'].get('user_group_id')
+
+    return _user_group
 
 
 def get_filesystem_repos(path, recursive=False, skip_removed_repos=True):
     """
     Scans given path for repos and return (name,(type,path)) tuple
 
     :param path: path to scan for repositories
     :param recursive: recursive search and return names with subdirs in front
     """
 
     # remove ending slash for better results
     path = path.rstrip(os.sep)
     log.debug('now scanning in %s location recursive:%s...', path, recursive)
 
     def _get_repos(p):
         dirpaths = _get_dirpaths(p)
         if not _is_dir_writable(p):
             log.warning('repo path without write access: %s', p)
 
         for dirpath in dirpaths:
             if os.path.isfile(os.path.join(p, dirpath)):
                 continue
             cur_path = os.path.join(p, dirpath)
 
             # skip removed repos
             if skip_removed_repos and REMOVED_REPO_PAT.match(dirpath):
                 continue
 
             #skip .<somethin> dirs
             if dirpath.startswith('.'):
                 continue
 
             try:
                 scm_info = get_scm(cur_path)
                 yield scm_info[1].split(path, 1)[-1].lstrip(os.sep), scm_info
             except VCSError:
                 if not recursive:
                     continue
                 #check if this dir containts other repos for recursive scan
                 rec_path = os.path.join(p, dirpath)
                 if os.path.isdir(rec_path):
                     for inner_scm in _get_repos(rec_path):
                         yield inner_scm
 
     return _get_repos(path)
 
 
 def _get_dirpaths(p):
     try:
         # OS-independable way of checking if we have at least read-only
         # access or not.
         dirpaths = os.listdir(p)
     except OSError:
         log.warning('ignoring repo path without read access: %s', p)
         return []
 
     # os.listpath has a tweak: If a unicode is passed into it, then it tries to
     # decode paths and suddenly returns unicode objects itself. The items it
     # cannot decode are returned as strings and cause issues.
     #
     # Those paths are ignored here until a solid solution for path handling has
     # been built.
     expected_type = type(p)
 
     def _has_correct_type(item):
         if type(item) is not expected_type:
             log.error(
                 u"Ignoring path %s since it cannot be decoded into unicode.",
                 # Using "repr" to make sure that we see the byte value in case
                 # of support.
                 repr(item))
             return False
         return True
 
     dirpaths = [item for item in dirpaths if _has_correct_type(item)]
 
     return dirpaths
 
 
 def _is_dir_writable(path):
     """
     Probe if `path` is writable.
 
     Due to trouble on Cygwin / Windows, this is actually probing if it is
     possible to create a file inside of `path`, stat does not produce reliable
     results in this case.
     """
     try:
         with tempfile.TemporaryFile(dir=path):
             pass
     except OSError:
         return False
     return True
 
 
 def is_valid_repo(repo_name, base_path, expect_scm=None, explicit_scm=None):
     """
     Returns True if given path is a valid repository False otherwise.
     If expect_scm param is given also, compare if given scm is the same
     as expected from scm parameter. If explicit_scm is given don't try to
     detect the scm, just use the given one to check if repo is valid
 
     :param repo_name:
     :param base_path:
     :param expect_scm:
     :param explicit_scm:
 
     :return True: if given path is a valid repository
     """
     full_path = os.path.join(safe_str(base_path), safe_str(repo_name))
     log.debug('Checking if `%s` is a valid path for repository. '
               'Explicit type: %s', repo_name, explicit_scm)
 
     try:
         if explicit_scm:
             detected_scms = [get_scm_backend(explicit_scm)]
         else:
             detected_scms = get_scm(full_path)
 
         if expect_scm:
             return detected_scms[0] == expect_scm
         log.debug('path: %s is an vcs object:%s', full_path, detected_scms)
         return True
     except VCSError:
         log.debug('path: %s is not a valid repo !', full_path)
         return False
 
 
 def is_valid_repo_group(repo_group_name, base_path, skip_path_check=False):
     """
     Returns True if given path is a repository group, False otherwise
 
     :param repo_name:
     :param base_path:
     """
     full_path = os.path.join(safe_str(base_path), safe_str(repo_group_name))
     log.debug('Checking if `%s` is a valid path for repository group',
               repo_group_name)
 
     # check if it's not a repo
     if is_valid_repo(repo_group_name, base_path):
         log.debug('Repo called %s exist, it is not a valid '
                   'repo group' % repo_group_name)
         return False
 
     try:
         # we need to check bare git repos at higher level
         # since we might match branches/hooks/info/objects or possible
         # other things inside bare git repo
         scm_ = get_scm(os.path.dirname(full_path))
         log.debug('path: %s is a vcs object:%s, not valid '
                   'repo group' % (full_path, scm_))
         return False
     except VCSError:
         pass
 
     # check if it's a valid path
     if skip_path_check or os.path.isdir(full_path):
         log.debug('path: %s is a valid repo group !', full_path)
         return True
 
     log.debug('path: %s is not a valid repo group !', full_path)
     return False
 
 
 def ask_ok(prompt, retries=4, complaint='[y]es or [n]o please!'):
     while True:
         ok = raw_input(prompt)
         if ok.lower() in ('y', 'ye', 'yes'):
             return True
         if ok.lower() in ('n', 'no', 'nop', 'nope'):
             return False
         retries = retries - 1
         if retries < 0:
             raise IOError
         print(complaint)
 
 # propagated from mercurial documentation
 ui_sections = [
     'alias', 'auth',
     'decode/encode', 'defaults',
     'diff', 'email',
     'extensions', 'format',
     'merge-patterns', 'merge-tools',
     'hooks', 'http_proxy',
     'smtp', 'patch',
     'paths', 'profiling',
     'server', 'trusted',
     'ui', 'web', ]
 
 
 def config_data_from_db(clear_session=True, repo=None):
     """
     Read the configuration data from the database and return configuration
     tuples.
     """
     from rhodecode.model.settings import VcsSettingsModel
 
     config = []
 
     sa = meta.Session()
     settings_model = VcsSettingsModel(repo=repo, sa=sa)
 
     ui_settings = settings_model.get_ui_settings()
 
     for setting in ui_settings:
         if setting.active:
             log.debug(
                 'settings ui from db: [%s] %s=%s',
                 setting.section, setting.key, setting.value)
             config.append((
                 safe_str(setting.section), safe_str(setting.key),
                 safe_str(setting.value)))
         if setting.key == 'push_ssl':
             # force set push_ssl requirement to False, rhodecode
             # handles that
             config.append((
                 safe_str(setting.section), safe_str(setting.key), False))
     if clear_session:
         meta.Session.remove()
 
     # TODO: mikhail: probably it makes no sense to re-read hooks information.
     # It's already there and activated/deactivated
     skip_entries = []
     enabled_hook_classes = get_enabled_hook_classes(ui_settings)
     if 'pull' not in enabled_hook_classes:
         skip_entries.append(('hooks', RhodeCodeUi.HOOK_PRE_PULL))
     if 'push' not in enabled_hook_classes:
         skip_entries.append(('hooks', RhodeCodeUi.HOOK_PRE_PUSH))
         skip_entries.append(('hooks', RhodeCodeUi.HOOK_PRETX_PUSH))
         skip_entries.append(('hooks', RhodeCodeUi.HOOK_PUSH_KEY))
 
     config = [entry for entry in config if entry[:2] not in skip_entries]
 
     return config
 
 
 def make_db_config(clear_session=True, repo=None):
     """
     Create a :class:`Config` instance based on the values in the database.
     """
     config = Config()
     config_data = config_data_from_db(clear_session=clear_session, repo=repo)
     for section, option, value in config_data:
         config.set(section, option, value)
     return config
 
 
 def get_enabled_hook_classes(ui_settings):
     """
     Return the enabled hook classes.
 
     :param ui_settings: List of ui_settings as returned
         by :meth:`VcsSettingsModel.get_ui_settings`
 
     :return: a list with the enabled hook classes. The order is not guaranteed.
     :rtype: list
     """
     enabled_hooks = []
     active_hook_keys = [
         key for section, key, value, active in ui_settings
         if section == 'hooks' and active]
 
     hook_names = {
         RhodeCodeUi.HOOK_PUSH: 'push',
         RhodeCodeUi.HOOK_PULL: 'pull',
         RhodeCodeUi.HOOK_REPO_SIZE: 'repo_size'
     }
 
     for key in active_hook_keys:
         hook = hook_names.get(key)
         if hook:
             enabled_hooks.append(hook)
 
     return enabled_hooks
 
 
 def set_rhodecode_config(config):
     """
     Updates pylons config with new settings from database
 
     :param config:
     """
     from rhodecode.model.settings import SettingsModel
     app_settings = SettingsModel().get_all_settings()
 
     for k, v in app_settings.items():
         config[k] = v
 
 
 def get_rhodecode_realm():
     """
     Return the rhodecode realm from database.
     """
     from rhodecode.model.settings import SettingsModel
     realm = SettingsModel().get_setting_by_name('realm')
     return safe_str(realm.app_settings_value)
 
 
 def get_rhodecode_base_path():
     """
     Returns the base path. The base path is the filesystem path which points
     to the repository store.
     """
     from rhodecode.model.settings import SettingsModel
     paths_ui = SettingsModel().get_ui_by_section_and_key('paths', '/')
     return safe_str(paths_ui.ui_value)
 
 
 def map_groups(path):
     """
     Given a full path to a repository, create all nested groups that this
     repo is inside. This function creates parent-child relationships between
     groups and creates default perms for all new groups.
 
     :param paths: full path to repository
     """
     from rhodecode.model.repo_group import RepoGroupModel
     sa = meta.Session()
     groups = path.split(Repository.NAME_SEP)
     parent = None
     group = None
 
     # last element is repo in nested groups structure
     groups = groups[:-1]
     rgm = RepoGroupModel(sa)
     owner = User.get_first_super_admin()
     for lvl, group_name in enumerate(groups):
         group_name = '/'.join(groups[:lvl] + [group_name])
         group = RepoGroup.get_by_group_name(group_name)
         desc = '%s group' % group_name
 
         # skip folders that are now removed repos
         if REMOVED_REPO_PAT.match(group_name):
             break
 
         if group is None:
             log.debug('creating group level: %s group_name: %s',
                        lvl, group_name)
             group = RepoGroup(group_name, parent)
             group.group_description = desc
             group.user = owner
             sa.add(group)
             perm_obj = rgm._create_default_perms(group)
             sa.add(perm_obj)
             sa.flush()
 
         parent = group
     return group
 
 
 def repo2db_mapper(initial_repo_list, remove_obsolete=False):
     """
     maps all repos given in initial_repo_list, non existing repositories
     are created, if remove_obsolete is True it also checks for db entries
     that are not in initial_repo_list and removes them.
 
     :param initial_repo_list: list of repositories found by scanning methods
     :param remove_obsolete: check for obsolete entries in database
     """
     from rhodecode.model.repo import RepoModel
     from rhodecode.model.scm import ScmModel
     from rhodecode.model.repo_group import RepoGroupModel
     from rhodecode.model.settings import SettingsModel
 
     sa = meta.Session()
     repo_model = RepoModel()
     user = User.get_first_super_admin()
     added = []
 
     # creation defaults
     defs = SettingsModel().get_default_repo_settings(strip_prefix=True)
     enable_statistics = defs.get('repo_enable_statistics')
     enable_locking = defs.get('repo_enable_locking')
     enable_downloads = defs.get('repo_enable_downloads')
     private = defs.get('repo_private')
 
     for name, repo in initial_repo_list.items():
         group = map_groups(name)
         unicode_name = safe_unicode(name)
         db_repo = repo_model.get_by_repo_name(unicode_name)
         # found repo that is on filesystem not in RhodeCode database
         if not db_repo:
             log.info('repository %s not found, creating now', name)
             added.append(name)
             desc = (repo.description
                     if repo.description != 'unknown'
                     else '%s repository' % name)
 
             db_repo = repo_model._create_repo(
                 repo_name=name,
                 repo_type=repo.alias,
                 description=desc,
                 repo_group=getattr(group, 'group_id', None),
                 owner=user,
                 enable_locking=enable_locking,
                 enable_downloads=enable_downloads,
                 enable_statistics=enable_statistics,
                 private=private,
                 state=Repository.STATE_CREATED
             )
             sa.commit()
             # we added that repo just now, and make sure we updated server info
             if db_repo.repo_type == 'git':
                 git_repo = db_repo.scm_instance()
                 # update repository server-info
                 log.debug('Running update server info')
                 git_repo._update_server_info()
 
             db_repo.update_commit_cache()
 
         config = db_repo._config
         config.set('extensions', 'largefiles', '')
         ScmModel().install_hooks(
             db_repo.scm_instance(config=config),
             repo_type=db_repo.repo_type)
 
     removed = []
     if remove_obsolete:
         # remove from database those repositories that are not in the filesystem
         for repo in sa.query(Repository).all():
             if repo.repo_name not in initial_repo_list.keys():
                 log.debug("Removing non-existing repository found in db `%s`",
                           repo.repo_name)
                 try:
                     RepoModel(sa).delete(repo, forks='detach', fs_remove=False)
                     sa.commit()
                     removed.append(repo.repo_name)
                 except Exception:
                     # don't hold further removals on error
                     log.error(traceback.format_exc())
                     sa.rollback()
 
         def splitter(full_repo_name):
             _parts = full_repo_name.rsplit(RepoGroup.url_sep(), 1)
             gr_name = None
             if len(_parts) == 2:
                 gr_name = _parts[0]
             return gr_name
 
         initial_repo_group_list = [splitter(x) for x in
                                    initial_repo_list.keys() if splitter(x)]
 
         # remove from database those repository groups that are not in the
         # filesystem due to parent child relationships we need to delete them
         # in a specific order of most nested first
         all_groups = [x.group_name for x in sa.query(RepoGroup).all()]
         nested_sort = lambda gr: len(gr.split('/'))
         for group_name in sorted(all_groups, key=nested_sort, reverse=True):
             if group_name not in initial_repo_group_list:
                 repo_group = RepoGroup.get_by_group_name(group_name)
                 if (repo_group.children.all() or
                     not RepoGroupModel().check_exist_filesystem(
                         group_name=group_name, exc_on_failure=False)):
                     continue
 
                 log.info(
                     'Removing non-existing repository group found in db `%s`',
                     group_name)
                 try:
                     RepoGroupModel(sa).delete(group_name, fs_remove=False)
                     sa.commit()
                     removed.append(group_name)
                 except Exception:
                     # don't hold further removals on error
                     log.exception(
                         'Unable to remove repository group `%s`',
                         group_name)
                     sa.rollback()
                     raise
 
     return added, removed
 
 
 def get_default_cache_settings(settings):
     cache_settings = {}
     for key in settings.keys():
         for prefix in ['beaker.cache.', 'cache.']:
             if key.startswith(prefix):
                 name = key.split(prefix)[1].strip()
                 cache_settings[name] = settings[key].strip()
     return cache_settings
 
 
 # set cache regions for beaker so celery can utilise it
 def add_cache(settings):
     from rhodecode.lib import caches
     cache_settings = {'regions': None}
     # main cache settings used as default ...
     cache_settings.update(get_default_cache_settings(settings))
 
     if cache_settings['regions']:
         for region in cache_settings['regions'].split(','):
             region = region.strip()
             region_settings = {}
             for key, value in cache_settings.items():
                 if key.startswith(region):
                     region_settings[key.split('.')[1]] = value
 
             caches.configure_cache_region(
                 region, region_settings, cache_settings)
 
 
 def load_rcextensions(root_path):
     import rhodecode
     from rhodecode.config import conf
 
     path = os.path.join(root_path, 'rcextensions', '__init__.py')
     if os.path.isfile(path):
         rcext = create_module('rc', path)
         EXT = rhodecode.EXTENSIONS = rcext
         log.debug('Found rcextensions now loading %s...', rcext)
 
         # Additional mappings that are not present in the pygments lexers
         conf.LANGUAGES_EXTENSIONS_MAP.update(getattr(EXT, 'EXTRA_MAPPINGS', {}))
 
         # auto check if the module is not missing any data, set to default if is
         # this will help autoupdate new feature of rcext module
         #from rhodecode.config import rcextensions
         #for k in dir(rcextensions):
         #    if not k.startswith('_') and not hasattr(EXT, k):
         #        setattr(EXT, k, getattr(rcextensions, k))
 
 
 def get_custom_lexer(extension):
     """
     returns a custom lexer if it is defined in rcextensions module, or None
     if there's no custom lexer defined
     """
     import rhodecode
     from pygments import lexers
 
     # custom override made by RhodeCode
     if extension in ['mako']:
         return lexers.get_lexer_by_name('html+mako')
 
     # check if we didn't define this extension as other lexer
     extensions = rhodecode.EXTENSIONS and getattr(rhodecode.EXTENSIONS, 'EXTRA_LEXERS', None)
     if extensions and extension in rhodecode.EXTENSIONS.EXTRA_LEXERS:
         _lexer_name = rhodecode.EXTENSIONS.EXTRA_LEXERS[extension]
         return lexers.get_lexer_by_name(_lexer_name)
 
 
 #==============================================================================
 # TEST FUNCTIONS AND CREATORS
 #==============================================================================
 def create_test_index(repo_location, config):
     """
     Makes default test index.
     """
     import rc_testdata
 
     rc_testdata.extract_search_index(
         'vcs_search_index', os.path.dirname(config['search.location']))
 
 
 def create_test_directory(test_path):
     """
     Create test directory if it doesn't exist.
     """
     if not os.path.isdir(test_path):
         log.debug('Creating testdir %s', test_path)
         os.makedirs(test_path)
 
 
 def create_test_database(test_path, config):
     """
     Makes a fresh database.
     """
     from rhodecode.lib.db_manage import DbManage
 
     # PART ONE create db
     dbconf = config['sqlalchemy.db1.url']
     log.debug('making test db %s', dbconf)
 
     dbmanage = DbManage(log_sql=False, dbconf=dbconf, root=config['here'],
                         tests=True, cli_args={'force_ask': True})
     dbmanage.create_tables(override=True)
     dbmanage.set_db_version()
     # for tests dynamically set new root paths based on generated content
     dbmanage.create_settings(dbmanage.config_prompt(test_path))
     dbmanage.create_default_user()
     dbmanage.create_test_admin_and_users()
     dbmanage.create_permissions()
     dbmanage.populate_default_permissions()
     Session().commit()
 
 
 def create_test_repositories(test_path, config):
     """
     Creates test repositories in the temporary directory. Repositories are
     extracted from archives within the rc_testdata package.
     """
     import rc_testdata
     from rhodecode.tests import HG_REPO, GIT_REPO, SVN_REPO
 
     log.debug('making test vcs repositories')
 
     idx_path = config['search.location']
     data_path = config['cache_dir']
 
     # clean index and data
     if idx_path and os.path.exists(idx_path):
         log.debug('remove %s', idx_path)
         shutil.rmtree(idx_path)
 
     if data_path and os.path.exists(data_path):
         log.debug('remove %s', data_path)
         shutil.rmtree(data_path)
 
     rc_testdata.extract_hg_dump('vcs_test_hg', jn(test_path, HG_REPO))
     rc_testdata.extract_git_dump('vcs_test_git', jn(test_path, GIT_REPO))
 
     # Note: Subversion is in the process of being integrated with the system,
     # until we have a properly packed version of the test svn repository, this
     # tries to copy over the repo from a package "rc_testdata"
     svn_repo_path = rc_testdata.get_svn_repo_archive()
     with tarfile.open(svn_repo_path) as tar:
         tar.extractall(jn(test_path, SVN_REPO))
 
 
 #==============================================================================
 # PASTER COMMANDS
 #==============================================================================
 class BasePasterCommand(Command):
     """
     Abstract Base Class for paster commands.
 
     The celery commands are somewhat aggressive about loading
     celery.conf, and since our module sets the `CELERY_LOADER`
     environment variable to our loader, we have to bootstrap a bit and
     make sure we've had a chance to load the pylons config off of the
     command line, otherwise everything fails.
     """
     min_args = 1
     min_args_error = "Please provide a paster config file as an argument."
     takes_config_file = 1
     requires_config_file = True
 
     def notify_msg(self, msg, log=False):
         """Make a notification to user, additionally if logger is passed
         it logs this action using given logger
 
         :param msg: message that will be printed to user
         :param log: logging instance, to use to additionally log this message
 
         """
         if log and isinstance(log, logging):
             log(msg)
 
     def run(self, args):
         """
         Overrides Command.run
 
         Checks for a config file argument and loads it.
         """
         if len(args) < self.min_args:
             raise BadCommand(
                 self.min_args_error % {'min_args': self.min_args,
                                        'actual_args': len(args)})
 
         # Decrement because we're going to lob off the first argument.
         # @@ This is hacky
         self.min_args -= 1
         self.bootstrap_config(args[0])
         self.update_parser()
         return super(BasePasterCommand, self).run(args[1:])
 
     def update_parser(self):
         """
         Abstract method.  Allows for the class' parser to be updated
         before the superclass' `run` method is called.  Necessary to
         allow options/arguments to be passed through to the underlying
         celery command.
         """
         raise NotImplementedError("Abstract Method.")
 
     def bootstrap_config(self, conf):
         """
         Loads the pylons configuration.
         """
         from pylons import config as pylonsconfig
 
         self.path_to_ini_file = os.path.realpath(conf)
         conf = paste.deploy.appconfig('config:' + self.path_to_ini_file)
         pylonsconfig.init_app(conf.global_conf, conf.local_conf)
 
     def _init_session(self):
         """
         Inits SqlAlchemy Session
         """
         logging.config.fileConfig(self.path_to_ini_file)
         from pylons import config
         from rhodecode.config.utils import initialize_database
 
         # get to remove repos !!
         add_cache(config)
         initialize_database(config)
 
 
 class PartialRenderer(object):
     """
     Partial renderer used to render chunks of html used in datagrids
     use like::
 
         _render = PartialRenderer('data_table/_dt_elements.mako')
         _render('quick_menu', args, kwargs)
         PartialRenderer.h,
                         c,
                         _,
                         ungettext
         are the template stuff initialized inside and can be re-used later
 
     :param tmpl_name: template path relate to /templates/ dir
     """
 
     def __init__(self, tmpl_name):
         import rhodecode
         from pylons import request, tmpl_context as c
         from pylons.i18n.translation import _, ungettext
         from rhodecode.lib import helpers as h
 
         self.tmpl_name = tmpl_name
         self.rhodecode = rhodecode
         self.c = c
         self._ = _
         self.ungettext = ungettext
         self.h = h
         self.request = request
 
     def _mako_lookup(self):
         _tmpl_lookup = self.rhodecode.CONFIG['pylons.app_globals'].mako_lookup
         return _tmpl_lookup.get_template(self.tmpl_name)
 
     def _update_kwargs_for_render(self, kwargs):
         """
         Inject params required for Mako rendering
         """
         _kwargs = {
             '_': self._,
             'h': self.h,
             'c': self.c,
             'request': self.request,
             '_ungettext': self.ungettext,
         }
         _kwargs.update(kwargs)
         return _kwargs
 
     def _render_with_exc(self, render_func, args, kwargs):
         try:
             return render_func.render(*args, **kwargs)
         except:
             log.error(exceptions.text_error_template().render())
             raise
 
     def _get_template(self, template_obj, def_name):
         if def_name:
             tmpl = template_obj.get_def(def_name)
         else:
             tmpl = template_obj
         return tmpl
 
     def render(self, def_name, *args, **kwargs):
         lookup_obj = self._mako_lookup()
         tmpl = self._get_template(lookup_obj, def_name=def_name)
         kwargs = self._update_kwargs_for_render(kwargs)
         return self._render_with_exc(tmpl, args, kwargs)
 
     def __call__(self, tmpl, *args, **kwargs):
         return self.render(tmpl, *args, **kwargs)
 
 
 def password_changed(auth_user, session):
     # Never report password change in case of default user or anonymous user.
     if auth_user.username == User.DEFAULT_USER or auth_user.user_id is None:
         return False
 
     password_hash = md5(auth_user.password) if auth_user.password else None
     rhodecode_user = session.get('rhodecode_user', {})
     session_password_hash = rhodecode_user.get('password', '')
     return password_hash != session_password_hash
 
 
 def read_opensource_licenses():
     global _license_cache
 
     if not _license_cache:
         licenses = pkg_resources.resource_string(
             'rhodecode', 'config/licenses.json')
         _license_cache = json.loads(licenses)
 
     return _license_cache
 
 
 def get_registry(request):
     """
     Utility to get the pyramid registry from a request. During migration to
     pyramid we sometimes want to use the pyramid registry from pylons context.
     Therefore this utility returns `request.registry` for pyramid requests and
     uses `get_current_registry()` for pylons requests.
     """
     try:
         return request.registry
     except AttributeError:
         return get_current_registry()
 
 
 def generate_platform_uuid():
     """
     Generates platform UUID based on it's name
     """
     import platform
 
     try:
         uuid_list = [platform.platform()]
         return hashlib.sha256(':'.join(uuid_list)).hexdigest()
     except Exception as e:
         log.error('Failed to generate host uuid: %s' % e)
         return 'UNDEFINED'

rhodecode/model/repo_permission.py

@@ -1,102 +1,102 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2011-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 
 """
 repository permission model for RhodeCode
 """
 
 import logging
 from rhodecode.model import BaseModel
 from rhodecode.model.db import UserRepoToPerm, UserGroupRepoToPerm, \
     Permission
 
 log = logging.getLogger(__name__)
 
 
 class RepositoryPermissionModel(BaseModel):
 
     cls = UserRepoToPerm
 
     def get_user_permission(self, repository, user):
         repository = self._get_repo(repository)
         user = self._get_user(user)
 
         return UserRepoToPerm.query() \
                 .filter(UserRepoToPerm.user == user) \
                 .filter(UserRepoToPerm.repository == repository) \
                 .scalar()
 
     def update_user_permission(self, repository, user, permission):
         permission = Permission.get_by_key(permission)
         current = self.get_user_permission(repository, user)
         if current:
             if not current.permission is permission:
                 current.permission = permission
         else:
             p = UserRepoToPerm()
             p.user = user
             p.repository = repository
             p.permission = permission
             self.sa.add(p)
 
     def delete_user_permission(self, repository, user):
         current = self.get_user_permission(repository, user)
         if current:
             self.sa.delete(current)
 
     def get_users_group_permission(self, repository, users_group):
         return UserGroupRepoToPerm.query() \
                 .filter(UserGroupRepoToPerm.users_group == users_group) \
                 .filter(UserGroupRepoToPerm.repository == repository) \
                 .scalar()
 
-    def update_users_group_permission(self, repository, users_group,
-                                      permission):
+    def update_user_group_permission(self, repository, users_group,
+                                     permission):
         permission = Permission.get_by_key(permission)
         current = self.get_users_group_permission(repository, users_group)
         if current:
             if not current.permission is permission:
                 current.permission = permission
         else:
             p = UserGroupRepoToPerm()
             p.users_group = users_group
             p.repository = repository
             p.permission = permission
             self.sa.add(p)
 
     def delete_users_group_permission(self, repository, users_group):
         current = self.get_users_group_permission(repository, users_group)
         if current:
             self.sa.delete(current)
 
     def update_or_delete_user_permission(self, repository, user, permission):
         if permission:
             self.update_user_permission(repository, user, permission)
         else:
             self.delete_user_permission(repository, user)
 
     def update_or_delete_users_group_permission(self, repository, user_group,
                                               permission):
         if permission:
-            self.update_users_group_permission(repository, user_group,
+            self.update_user_group_permission(repository, user_group,
                                                permission)
         else:
             self.delete_users_group_permission(repository, user_group)

rhodecode/model/user_group.py

@@ -1,623 +1,637 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2011-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
-
-"""
-user group model for RhodeCode
-"""
-
-
 import logging
 import traceback
 
 from rhodecode.lib.utils2 import safe_str, safe_unicode
 from rhodecode.lib.exceptions import (
     UserGroupAssignedException, RepoGroupAssignmentError)
 from rhodecode.lib.utils2 import (
     get_current_rhodecode_user, action_logger_generic)
 from rhodecode.model import BaseModel
 from rhodecode.model.scm import UserGroupList
 from rhodecode.model.db import (
     true, func, User, UserGroupMember, UserGroup,
     UserGroupRepoToPerm, Permission, UserGroupToPerm, UserUserGroupToPerm,
     UserGroupUserGroupToPerm, UserGroupRepoGroupToPerm)
 
 
 log = logging.getLogger(__name__)
 
 
 class UserGroupModel(BaseModel):
 
     cls = UserGroup
 
     def _get_user_group(self, user_group):
         return self._get_instance(UserGroup, user_group,
                                   callback=UserGroup.get_by_group_name)
 
     def _create_default_perms(self, user_group):
         # create default permission
         default_perm = 'usergroup.read'
         def_user = User.get_default_user()
         for p in def_user.user_perms:
             if p.permission.permission_name.startswith('usergroup.'):
                 default_perm = p.permission.permission_name
                 break
 
         user_group_to_perm = UserUserGroupToPerm()
         user_group_to_perm.permission = Permission.get_by_key(default_perm)
 
         user_group_to_perm.user_group = user_group
         user_group_to_perm.user_id = def_user.user_id
         return user_group_to_perm
 
-    def update_permissions(self, user_group, perm_additions=None, perm_updates=None,
-                           perm_deletions=None, check_perms=True, cur_user=None):
+    def update_permissions(
+            self, user_group, perm_additions=None, perm_updates=None,
+            perm_deletions=None, check_perms=True, cur_user=None):
+
         from rhodecode.lib.auth import HasUserGroupPermissionAny
         if not perm_additions:
             perm_additions = []
         if not perm_updates:
             perm_updates = []
         if not perm_deletions:
             perm_deletions = []
 
         req_perms = ('usergroup.read', 'usergroup.write', 'usergroup.admin')
 
+        changes = {
+            'added': [],
+            'updated': [],
+            'deleted': []
+        }
         # update permissions
         for member_id, perm, member_type in perm_updates:
             member_id = int(member_id)
             if member_type == 'user':
+                member_name = User.get(member_id).username
                 # this updates existing one
                 self.grant_user_permission(
                     user_group=user_group, user=member_id, perm=perm
                 )
             else:
                 # check if we have permissions to alter this usergroup
                 member_name = UserGroup.get(member_id).users_group_name
-                if not check_perms or HasUserGroupPermissionAny(*req_perms)(member_name, user=cur_user):
+                if not check_perms or HasUserGroupPermissionAny(
+                        *req_perms)(member_name, user=cur_user):
                     self.grant_user_group_permission(
-                        target_user_group=user_group, user_group=member_id, perm=perm
-                    )
+                        target_user_group=user_group, user_group=member_id, perm=perm)
+
+            changes['updated'].append({'type': member_type, 'id': member_id,
+                                       'name': member_name, 'new_perm': perm})
 
         # set new permissions
         for member_id, perm, member_type in perm_additions:
             member_id = int(member_id)
             if member_type == 'user':
+                member_name = User.get(member_id).username
                 self.grant_user_permission(
-                    user_group=user_group, user=member_id, perm=perm
-                )
+                    user_group=user_group, user=member_id, perm=perm)
             else:
                 # check if we have permissions to alter this usergroup
                 member_name = UserGroup.get(member_id).users_group_name
-                if not check_perms or HasUserGroupPermissionAny(*req_perms)(member_name, user=cur_user):
+                if not check_perms or HasUserGroupPermissionAny(
+                        *req_perms)(member_name, user=cur_user):
                     self.grant_user_group_permission(
-                        target_user_group=user_group, user_group=member_id, perm=perm
-                    )
+                        target_user_group=user_group, user_group=member_id, perm=perm)
+
+            changes['added'].append({'type': member_type, 'id': member_id,
+                                     'name': member_name, 'new_perm': perm})
 
         # delete permissions
         for member_id, perm, member_type in perm_deletions:
             member_id = int(member_id)
             if member_type == 'user':
+                member_name = User.get(member_id).username
                 self.revoke_user_permission(user_group=user_group, user=member_id)
             else:
                 # check if we have permissions to alter this usergroup
                 member_name = UserGroup.get(member_id).users_group_name
-                if not check_perms or HasUserGroupPermissionAny(*req_perms)(member_name, user=cur_user):
+                if not check_perms or HasUserGroupPermissionAny(
+                        *req_perms)(member_name, user=cur_user):
                     self.revoke_user_group_permission(
-                        target_user_group=user_group, user_group=member_id
-                    )
+                        target_user_group=user_group, user_group=member_id)
+
+            changes['deleted'].append({'type': member_type, 'id': member_id,
+                                       'name': member_name, 'new_perm': perm})
+        return changes
 
     def get(self, user_group_id, cache=False):
         return UserGroup.get(user_group_id)
 
     def get_group(self, user_group):
         return self._get_user_group(user_group)
 
     def get_by_name(self, name, cache=False, case_insensitive=False):
         return UserGroup.get_by_group_name(name, cache, case_insensitive)
 
     def create(self, name, description, owner, active=True, group_data=None):
         try:
             new_user_group = UserGroup()
             new_user_group.user = self._get_user(owner)
             new_user_group.users_group_name = name
             new_user_group.user_group_description = description
             new_user_group.users_group_active = active
             if group_data:
                 new_user_group.group_data = group_data
             self.sa.add(new_user_group)
             perm_obj = self._create_default_perms(new_user_group)
             self.sa.add(perm_obj)
 
             self.grant_user_permission(user_group=new_user_group,
                                        user=owner, perm='usergroup.admin')
 
             return new_user_group
         except Exception:
             log.error(traceback.format_exc())
             raise
 
     def _get_memberships_for_user_ids(self, user_group, user_id_list):
         members = []
         for user_id in user_id_list:
             member = self._get_membership(user_group.users_group_id, user_id)
             members.append(member)
         return members
 
     def _get_added_and_removed_user_ids(self, user_group, user_id_list):
         current_members = user_group.members or []
         current_members_ids = [m.user.user_id for m in current_members]
 
         added_members = [
             user_id for user_id in user_id_list
             if user_id not in current_members_ids]
         if user_id_list == []:
             # all members were deleted
             deleted_members = current_members_ids
         else:
             deleted_members = [
                 user_id for user_id in current_members_ids
                 if user_id not in user_id_list]
 
         return added_members, deleted_members
 
     def _set_users_as_members(self, user_group, user_ids):
         user_group.members = []
         self.sa.flush()
         members = self._get_memberships_for_user_ids(
             user_group, user_ids)
         user_group.members = members
         self.sa.add(user_group)
 
     def _update_members_from_user_ids(self, user_group, user_ids):
         added, removed = self._get_added_and_removed_user_ids(
             user_group, user_ids)
         self._set_users_as_members(user_group, user_ids)
         self._log_user_changes('added to', user_group, added)
         self._log_user_changes('removed from', user_group, removed)
         return added, removed
 
     def _clean_members_data(self, members_data):
         if not members_data:
             members_data = []
 
         members = []
         for user in members_data:
             uid = int(user['member_user_id'])
             if uid not in members and user['type'] in ['new', 'existing']:
                 members.append(uid)
         return members
 
     def update(self, user_group, form_data):
         user_group = self._get_user_group(user_group)
         if 'users_group_name' in form_data:
             user_group.users_group_name = form_data['users_group_name']
         if 'users_group_active' in form_data:
             user_group.users_group_active = form_data['users_group_active']
         if 'user_group_description' in form_data:
             user_group.user_group_description = form_data[
                 'user_group_description']
 
         # handle owner change
         if 'user' in form_data:
             owner = form_data['user']
             if isinstance(owner, basestring):
                 owner = User.get_by_username(form_data['user'])
 
             if not isinstance(owner, User):
                 raise ValueError(
                     'invalid owner for user group: %s' % form_data['user'])
 
             user_group.user = owner
 
         added_user_ids = []
         removed_user_ids = []
         if 'users_group_members' in form_data:
             members_id_list = self._clean_members_data(
                 form_data['users_group_members'])
             added_user_ids, removed_user_ids = \
                 self._update_members_from_user_ids(user_group, members_id_list)
 
         self.sa.add(user_group)
         return user_group, added_user_ids, removed_user_ids
 
     def delete(self, user_group, force=False):
         """
         Deletes repository group, unless force flag is used
         raises exception if there are members in that group, else deletes
         group and users
 
         :param user_group:
         :param force:
         """
         user_group = self._get_user_group(user_group)
+        if not user_group:
+            return
+
         try:
             # check if this group is not assigned to repo
             assigned_to_repo = [x.repository for x in UserGroupRepoToPerm.query()\
                 .filter(UserGroupRepoToPerm.users_group == user_group).all()]
             # check if this group is not assigned to repo
             assigned_to_repo_group = [x.group for x in UserGroupRepoGroupToPerm.query()\
                 .filter(UserGroupRepoGroupToPerm.users_group == user_group).all()]
 
             if (assigned_to_repo or assigned_to_repo_group) and not force:
                 assigned = ','.join(map(safe_str,
                                     assigned_to_repo+assigned_to_repo_group))
 
                 raise UserGroupAssignedException(
                     'UserGroup assigned to %s' % (assigned,))
             self.sa.delete(user_group)
         except Exception:
             log.error(traceback.format_exc())
             raise
 
     def _log_user_changes(self, action, user_group, user_or_users):
         users = user_or_users
         if not isinstance(users, (list, tuple)):
             users = [users]
         rhodecode_user = get_current_rhodecode_user()
         ipaddr = getattr(rhodecode_user, 'ip_addr', '')
         group_name = user_group.users_group_name
 
         for user_or_user_id in users:
             user = self._get_user(user_or_user_id)
             log_text = 'User {user} {action} {group}'.format(
                 action=action, user=user.username, group=group_name)
             log.info('Logging action: {0} by {1} ip:{2}'.format(
                      log_text, rhodecode_user, ipaddr))
 
     def _find_user_in_group(self, user, user_group):
         user_group_member = None
         for m in user_group.members:
             if m.user_id == user.user_id:
                 # Found this user's membership row
                 user_group_member = m
                 break
 
         return user_group_member
 
     def _get_membership(self, user_group_id, user_id):
         user_group_member = UserGroupMember(user_group_id, user_id)
         return user_group_member
 
     def add_user_to_group(self, user_group, user):
         user_group = self._get_user_group(user_group)
         user = self._get_user(user)
         user_member = self._find_user_in_group(user, user_group)
         if user_member:
             # user already in the group, skip
             return True
 
         member = self._get_membership(
             user_group.users_group_id, user.user_id)
         user_group.members.append(member)
 
         try:
             self.sa.add(member)
         except Exception:
             # what could go wrong here?
             log.error(traceback.format_exc())
             raise
 
         self._log_user_changes('added to', user_group, user)
         return member
 
     def remove_user_from_group(self, user_group, user):
         user_group = self._get_user_group(user_group)
         user = self._get_user(user)
         user_group_member = self._find_user_in_group(user, user_group)
 
         if not user_group_member:
             # User isn't in that group
             return False
 
         try:
             self.sa.delete(user_group_member)
         except Exception:
             log.error(traceback.format_exc())
             raise
 
         self._log_user_changes('removed from', user_group, user)
         return True
 
     def has_perm(self, user_group, perm):
         user_group = self._get_user_group(user_group)
         perm = self._get_perm(perm)
 
         return UserGroupToPerm.query()\
             .filter(UserGroupToPerm.users_group == user_group)\
             .filter(UserGroupToPerm.permission == perm).scalar() is not None
 
     def grant_perm(self, user_group, perm):
         user_group = self._get_user_group(user_group)
         perm = self._get_perm(perm)
 
         # if this permission is already granted skip it
         _perm = UserGroupToPerm.query()\
             .filter(UserGroupToPerm.users_group == user_group)\
             .filter(UserGroupToPerm.permission == perm)\
             .scalar()
         if _perm:
             return
 
         new = UserGroupToPerm()
         new.users_group = user_group
         new.permission = perm
         self.sa.add(new)
         return new
 
     def revoke_perm(self, user_group, perm):
         user_group = self._get_user_group(user_group)
         perm = self._get_perm(perm)
 
         obj = UserGroupToPerm.query()\
             .filter(UserGroupToPerm.users_group == user_group)\
             .filter(UserGroupToPerm.permission == perm).scalar()
         if obj:
             self.sa.delete(obj)
 
     def grant_user_permission(self, user_group, user, perm):
         """
         Grant permission for user on given user group, or update
         existing one if found
 
         :param user_group: Instance of UserGroup, users_group_id,
             or users_group_name
         :param user: Instance of User, user_id or username
         :param perm: Instance of Permission, or permission_name
         """
 
         user_group = self._get_user_group(user_group)
         user = self._get_user(user)
         permission = self._get_perm(perm)
 
         # check if we have that permission already
         obj = self.sa.query(UserUserGroupToPerm)\
             .filter(UserUserGroupToPerm.user == user)\
             .filter(UserUserGroupToPerm.user_group == user_group)\
             .scalar()
         if obj is None:
             # create new !
             obj = UserUserGroupToPerm()
         obj.user_group = user_group
         obj.user = user
         obj.permission = permission
         self.sa.add(obj)
         log.debug('Granted perm %s to %s on %s', perm, user, user_group)
         action_logger_generic(
             'granted permission: {} to user: {} on usergroup: {}'.format(
                 perm, user, user_group), namespace='security.usergroup')
 
         return obj
 
     def revoke_user_permission(self, user_group, user):
         """
         Revoke permission for user on given user group
 
         :param user_group: Instance of UserGroup, users_group_id,
             or users_group name
         :param user: Instance of User, user_id or username
         """
 
         user_group = self._get_user_group(user_group)
         user = self._get_user(user)
 
         obj = self.sa.query(UserUserGroupToPerm)\
             .filter(UserUserGroupToPerm.user == user)\
             .filter(UserUserGroupToPerm.user_group == user_group)\
             .scalar()
         if obj:
             self.sa.delete(obj)
             log.debug('Revoked perm on %s on %s', user_group, user)
             action_logger_generic(
                 'revoked permission from user: {} on usergroup: {}'.format(
                     user, user_group), namespace='security.usergroup')
 
     def grant_user_group_permission(self, target_user_group, user_group, perm):
         """
         Grant user group permission for given target_user_group
 
         :param target_user_group:
         :param user_group:
         :param perm:
         """
         target_user_group = self._get_user_group(target_user_group)
         user_group = self._get_user_group(user_group)
         permission = self._get_perm(perm)
         # forbid assigning same user group to itself
         if target_user_group == user_group:
             raise RepoGroupAssignmentError('target repo:%s cannot be '
                                            'assigned to itself' % target_user_group)
 
         # check if we have that permission already
         obj = self.sa.query(UserGroupUserGroupToPerm)\
             .filter(UserGroupUserGroupToPerm.target_user_group == target_user_group)\
             .filter(UserGroupUserGroupToPerm.user_group == user_group)\
             .scalar()
         if obj is None:
             # create new !
             obj = UserGroupUserGroupToPerm()
         obj.user_group = user_group
         obj.target_user_group = target_user_group
         obj.permission = permission
         self.sa.add(obj)
         log.debug(
             'Granted perm %s to %s on %s', perm, target_user_group, user_group)
         action_logger_generic(
             'granted permission: {} to usergroup: {} on usergroup: {}'.format(
                 perm, user_group, target_user_group),
             namespace='security.usergroup')
 
         return obj
 
     def revoke_user_group_permission(self, target_user_group, user_group):
         """
         Revoke user group permission for given target_user_group
 
         :param target_user_group:
         :param user_group:
         """
         target_user_group = self._get_user_group(target_user_group)
         user_group = self._get_user_group(user_group)
 
         obj = self.sa.query(UserGroupUserGroupToPerm)\
             .filter(UserGroupUserGroupToPerm.target_user_group == target_user_group)\
             .filter(UserGroupUserGroupToPerm.user_group == user_group)\
             .scalar()
         if obj:
             self.sa.delete(obj)
             log.debug(
                 'Revoked perm on %s on %s', target_user_group, user_group)
             action_logger_generic(
                 'revoked permission from usergroup: {} on usergroup: {}'.format(
                     user_group, target_user_group),
                 namespace='security.repogroup')
 
     def enforce_groups(self, user, groups, extern_type=None):
         user = self._get_user(user)
         log.debug('Enforcing groups %s on user %s', groups, user)
         current_groups = user.group_member
         # find the external created groups
         externals = [x.users_group for x in current_groups
                      if 'extern_type' in x.users_group.group_data]
 
         # calculate from what groups user should be removed
         # externals that are not in groups
         for gr in externals:
             if gr.users_group_name not in groups:
                 log.debug('Removing user %s from user group %s', user, gr)
                 self.remove_user_from_group(gr, user)
 
         # now we calculate in which groups user should be == groups params
         owner = User.get_first_super_admin().username
         for gr in set(groups):
             existing_group = UserGroup.get_by_group_name(gr)
             if not existing_group:
                 desc = 'Automatically created from plugin:%s' % extern_type
                 # we use first admin account to set the owner of the group
                 existing_group = UserGroupModel().create(
                     gr, desc, owner, group_data={'extern_type': extern_type})
 
             # we can only add users to special groups created via plugins
             managed = 'extern_type' in existing_group.group_data
             if managed:
                 log.debug('Adding user %s to user group %s', user, gr)
                 UserGroupModel().add_user_to_group(existing_group, user)
             else:
                 log.debug('Skipping addition to group %s since it is '
                           'not set to be automatically synchronized' % gr)
 
     def change_groups(self, user, groups):
         """
         This method changes user group assignment
         :param user:  User
         :param groups: array of UserGroupModel
-        :return:
         """
         user = self._get_user(user)
         log.debug('Changing user(%s) assignment to groups(%s)', user, groups)
         current_groups = user.group_member
         current_groups = [x.users_group for x in current_groups]
 
         # calculate from what groups user should be removed/add
         groups = set(groups)
         current_groups = set(current_groups)
 
         groups_to_remove = current_groups - groups
         groups_to_add = groups - current_groups
 
         for gr in groups_to_remove:
-            log.debug('Removing user %s from user group %s', user.username, gr.users_group_name)
+            log.debug('Removing user %s from user group %s',
+                      user.username, gr.users_group_name)
             self.remove_user_from_group(gr.users_group_name, user.username)
         for gr in groups_to_add:
-            log.debug('Adding user %s to user group %s', user.username, gr.users_group_name)
-            UserGroupModel().add_user_to_group(gr.users_group_name, user.username)
+            log.debug('Adding user %s to user group %s',
+                      user.username, gr.users_group_name)
+            UserGroupModel().add_user_to_group(
+                gr.users_group_name, user.username)
 
     def _serialize_user_group(self, user_group):
         import rhodecode.lib.helpers as h
         return {
                 'id': user_group.users_group_id,
                 # TODO: marcink figure out a way to generate the url for the
                 # icon
                 'icon_link': '',
                 'value_display': 'Group: %s (%d members)' % (
                     user_group.users_group_name, len(user_group.members),),
                 'value': user_group.users_group_name,
                 'description': user_group.user_group_description,
                 'owner': user_group.user.username,
 
                 'owner_icon': h.gravatar_url(user_group.user.email, 30),
                 'value_display_owner': h.person(user_group.user.email),
 
                 'value_type': 'user_group',
                 'active': user_group.users_group_active,
             }
 
     def get_user_groups(self, name_contains=None, limit=20, only_active=True,
                         expand_groups=False):
         query = self.sa.query(UserGroup)
         if only_active:
             query = query.filter(UserGroup.users_group_active == true())
 
         if name_contains:
             ilike_expression = u'%{}%'.format(safe_unicode(name_contains))
             query = query.filter(
                 UserGroup.users_group_name.ilike(ilike_expression))\
                 .order_by(func.length(UserGroup.users_group_name))\
                 .order_by(UserGroup.users_group_name)
 
             query = query.limit(limit)
         user_groups = query.all()
         perm_set = ['usergroup.read', 'usergroup.write', 'usergroup.admin']
         user_groups = UserGroupList(user_groups, perm_set=perm_set)
 
         # store same serialize method to extract data from User
         from rhodecode.model.user import UserModel
         serialize_user = UserModel()._serialize_user
 
         _groups = []
         for group in user_groups:
             entry = self._serialize_user_group(group)
             if expand_groups:
                 expanded_members = []
                 for member in group.members:
                     expanded_members.append(serialize_user(member.user))
                 entry['members'] = expanded_members
             _groups.append(entry)
         return _groups
 
     @staticmethod
     def get_user_groups_as_dict(user_group):
         import rhodecode.lib.helpers as h
 
         data = {
             'users_group_id': user_group.users_group_id,
             'group_name': user_group.users_group_name,
             'group_description': user_group.user_group_description,
             'active': user_group.users_group_active,
             "owner": user_group.user.username,
             'owner_icon': h.gravatar_url(user_group.user.email, 30),
             "owner_data": {
                 'owner': user_group.user.username,
                 'owner_icon': h.gravatar_url(user_group.user.email, 30)}
             }
         return data
-
-
-
-

rhodecode/model/validators.py

@@ -1,1122 +1,1122 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 Set of generic validators
 """
 
 import logging
 import os
 import re
 from collections import defaultdict
 
 import formencode
 import ipaddress
 from formencode.validators import (
     UnicodeString, OneOf, Int, Number, Regex, Email, Bool, StringBoolean, Set,
     NotEmpty, IPAddress, CIDR, String, FancyValidator
 )
 from pylons.i18n.translation import _
 from sqlalchemy.sql.expression import true
 from sqlalchemy.util import OrderedSet
 from webhelpers.pylonslib.secure_form import authentication_token
 
 from rhodecode.authentication import (
     legacy_plugin_prefix, _import_legacy_plugin)
 from rhodecode.authentication.base import loadplugin
 from rhodecode.config.routing import ADMIN_PREFIX
 from rhodecode.lib.auth import HasRepoGroupPermissionAny, HasPermissionAny
 from rhodecode.lib.utils import repo_name_slug, make_db_config
 from rhodecode.lib.utils2 import safe_int, str2bool, aslist, md5, safe_unicode
 from rhodecode.lib.vcs.backends.git.repository import GitRepository
 from rhodecode.lib.vcs.backends.hg.repository import MercurialRepository
 from rhodecode.lib.vcs.backends.svn.repository import SubversionRepository
 from rhodecode.model.db import (
     RepoGroup, Repository, UserGroup, User, ChangesetStatus, Gist)
 from rhodecode.model.settings import VcsSettingsModel
 
 # silence warnings and pylint
 UnicodeString, OneOf, Int, Number, Regex, Email, Bool, StringBoolean, Set, \
     NotEmpty, IPAddress, CIDR, String, FancyValidator
 
 log = logging.getLogger(__name__)
 
 
 class _Missing(object):
     pass
 
 Missing = _Missing()
 
 
 class StateObj(object):
     """
     this is needed to translate the messages using _() in validators
     """
     _ = staticmethod(_)
 
 
 def M(self, key, state=None, **kwargs):
     """
     returns string from self.message based on given key,
     passed kw params are used to substitute %(named)s params inside
     translated strings
 
     :param msg:
     :param state:
     """
     if state is None:
         state = StateObj()
     else:
         state._ = staticmethod(_)
     # inject validator into state object
     return self.message(key, state, **kwargs)
 
 
 def UniqueList(convert=None):
     class _UniqueList(formencode.FancyValidator):
         """
         Unique List !
         """
         messages = {
             'empty': _(u'Value cannot be an empty list'),
             'missing_value': _(u'Value cannot be an empty list'),
         }
 
         def _to_python(self, value, state):
             ret_val = []
 
             def make_unique(value):
                 seen = []
                 return [c for c in value if not (c in seen or seen.append(c))]
 
             if isinstance(value, list):
                 ret_val = make_unique(value)
             elif isinstance(value, set):
                 ret_val = make_unique(list(value))
             elif isinstance(value, tuple):
                 ret_val = make_unique(list(value))
             elif value is None:
                 ret_val = []
             else:
                 ret_val = [value]
 
             if convert:
                 ret_val = map(convert, ret_val)
             return ret_val
 
         def empty_value(self, value):
             return []
 
     return _UniqueList
 
 
 def UniqueListFromString():
     class _UniqueListFromString(UniqueList()):
         def _to_python(self, value, state):
             if isinstance(value, basestring):
                 value = aslist(value, ',')
             return super(_UniqueListFromString, self)._to_python(value, state)
     return _UniqueListFromString
 
 
 def ValidSvnPattern(section, repo_name=None):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'pattern_exists': _(u'Pattern already exists'),
         }
 
         def validate_python(self, value, state):
             if not value:
                 return
             model = VcsSettingsModel(repo=repo_name)
             ui_settings = model.get_svn_patterns(section=section)
             for entry in ui_settings:
                 if value == entry.value:
                     msg = M(self, 'pattern_exists', state)
                     raise formencode.Invalid(msg, value, state)
     return _validator
 
 
 def ValidUsername(edit=False, old_data={}):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'username_exists': _(u'Username "%(username)s" already exists'),
             'system_invalid_username':
                 _(u'Username "%(username)s" is forbidden'),
             'invalid_username':
                 _(u'Username may only contain alphanumeric characters '
                     u'underscores, periods or dashes and must begin with '
                     u'alphanumeric character or underscore')
         }
 
         def validate_python(self, value, state):
             if value in ['default', 'new_user']:
                 msg = M(self, 'system_invalid_username', state, username=value)
                 raise formencode.Invalid(msg, value, state)
             # check if user is unique
             old_un = None
             if edit:
                 old_un = User.get(old_data.get('user_id')).username
 
             if old_un != value or not edit:
                 if User.get_by_username(value, case_insensitive=True):
                     msg = M(self, 'username_exists', state, username=value)
                     raise formencode.Invalid(msg, value, state)
 
             if (re.match(r'^[\w]{1}[\w\-\.]{0,254}$', value)
                     is None):
                 msg = M(self, 'invalid_username', state)
                 raise formencode.Invalid(msg, value, state)
     return _validator
 
 
 def ValidRegex(msg=None):
     class _validator(formencode.validators.Regex):
         messages = {'invalid': msg or _(u'The input is not valid')}
     return _validator
 
 
 def ValidRepoUser(allow_disabled=False):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'invalid_username': _(u'Username %(username)s is not valid'),
             'disabled_username': _(u'Username %(username)s is disabled')
         }
 
         def validate_python(self, value, state):
             try:
                 user = User.query().filter(User.username == value).one()
             except Exception:
                 msg = M(self, 'invalid_username', state, username=value)
                 raise formencode.Invalid(
                     msg, value, state, error_dict={'username': msg}
                 )
             if user and (not allow_disabled and not user.active):
                 msg = M(self, 'disabled_username', state, username=value)
                 raise formencode.Invalid(
                     msg, value, state, error_dict={'username': msg}
                 )
 
     return _validator
 
 
 def ValidUserGroup(edit=False, old_data={}):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'invalid_group': _(u'Invalid user group name'),
-            'group_exist': _(u'User group "%(usergroup)s" already exists'),
+            'group_exist': _(u'User group `%(usergroup)s` already exists'),
             'invalid_usergroup_name':
                 _(u'user group name may only contain alphanumeric '
                   u'characters underscores, periods or dashes and must begin '
                   u'with alphanumeric character')
         }
 
         def validate_python(self, value, state):
             if value in ['default']:
                 msg = M(self, 'invalid_group', state)
                 raise formencode.Invalid(
                     msg, value, state, error_dict={'users_group_name': msg}
                 )
             # check if group is unique
             old_ugname = None
             if edit:
                 old_id = old_data.get('users_group_id')
                 old_ugname = UserGroup.get(old_id).users_group_name
 
             if old_ugname != value or not edit:
                 is_existing_group = UserGroup.get_by_group_name(
                     value, case_insensitive=True)
                 if is_existing_group:
                     msg = M(self, 'group_exist', state, usergroup=value)
                     raise formencode.Invalid(
                         msg, value, state, error_dict={'users_group_name': msg}
                     )
 
             if re.match(r'^[a-zA-Z0-9]{1}[a-zA-Z0-9\-\_\.]+$', value) is None:
                 msg = M(self, 'invalid_usergroup_name', state)
                 raise formencode.Invalid(
                     msg, value, state, error_dict={'users_group_name': msg}
                 )
 
     return _validator
 
 
 def ValidRepoGroup(edit=False, old_data={}, can_create_in_root=False):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'group_parent_id': _(u'Cannot assign this group as parent'),
             'group_exists': _(u'Group "%(group_name)s" already exists'),
             'repo_exists': _(u'Repository with name "%(group_name)s" '
                              u'already exists'),
             'permission_denied': _(u"no permission to store repository group"
                                    u"in this location"),
             'permission_denied_root': _(
                 u"no permission to store repository group "
                 u"in root location")
         }
 
         def _to_python(self, value, state):
             group_name = repo_name_slug(value.get('group_name', ''))
             group_parent_id = safe_int(value.get('group_parent_id'))
             gr = RepoGroup.get(group_parent_id)
             if gr:
                 parent_group_path = gr.full_path
                 # value needs to be aware of group name in order to check
                 # db key This is an actual just the name to store in the
                 # database
                 group_name_full = (
                     parent_group_path + RepoGroup.url_sep() + group_name)
             else:
                 group_name_full = group_name
 
             value['group_name'] = group_name
             value['group_name_full'] = group_name_full
             value['group_parent_id'] = group_parent_id
             return value
 
         def validate_python(self, value, state):
 
             old_group_name = None
             group_name = value.get('group_name')
             group_name_full = value.get('group_name_full')
             group_parent_id = safe_int(value.get('group_parent_id'))
             if group_parent_id == -1:
                 group_parent_id = None
 
             group_obj = RepoGroup.get(old_data.get('group_id'))
             parent_group_changed = False
             if edit:
                 old_group_name = group_obj.group_name
                 old_group_parent_id = group_obj.group_parent_id
 
                 if group_parent_id != old_group_parent_id:
                     parent_group_changed = True
 
                 # TODO: mikhail: the following if statement is not reached
                 # since group_parent_id's OneOf validation fails before.
                 # Can be removed.
 
                 # check against setting a parent of self
                 parent_of_self = (
                     old_data['group_id'] == group_parent_id
                     if group_parent_id else False
                 )
                 if parent_of_self:
                     msg = M(self, 'group_parent_id', state)
                     raise formencode.Invalid(
                         msg, value, state, error_dict={'group_parent_id': msg}
                     )
 
             # group we're moving current group inside
             child_group = None
             if group_parent_id:
                 child_group = RepoGroup.query().filter(
                     RepoGroup.group_id == group_parent_id).scalar()
 
             # do a special check that we cannot move a group to one of
             # it's children
             if edit and child_group:
                 parents = [x.group_id for x in child_group.parents]
                 move_to_children = old_data['group_id'] in parents
                 if move_to_children:
                     msg = M(self, 'group_parent_id', state)
                     raise formencode.Invalid(
                         msg, value, state, error_dict={'group_parent_id': msg})
 
             # Check if we have permission to store in the parent.
             # Only check if the parent group changed.
             if parent_group_changed:
                 if child_group is None:
                     if not can_create_in_root:
                         msg = M(self, 'permission_denied_root', state)
                         raise formencode.Invalid(
                             msg, value, state,
                             error_dict={'group_parent_id': msg})
                 else:
                     valid = HasRepoGroupPermissionAny('group.admin')
                     forbidden = not valid(
                         child_group.group_name, 'can create group validator')
                     if forbidden:
                         msg = M(self, 'permission_denied', state)
                         raise formencode.Invalid(
                             msg, value, state,
                             error_dict={'group_parent_id': msg})
 
             # if we change the name or it's new group, check for existing names
             # or repositories with the same name
             if old_group_name != group_name_full or not edit:
                 # check group
                 gr = RepoGroup.get_by_group_name(group_name_full)
                 if gr:
                     msg = M(self, 'group_exists', state, group_name=group_name)
                     raise formencode.Invalid(
                         msg, value, state, error_dict={'group_name': msg})
 
                 # check for same repo
                 repo = Repository.get_by_repo_name(group_name_full)
                 if repo:
                     msg = M(self, 'repo_exists', state, group_name=group_name)
                     raise formencode.Invalid(
                         msg, value, state, error_dict={'group_name': msg})
 
     return _validator
 
 
 def ValidPassword():
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'invalid_password':
                 _(u'Invalid characters (non-ascii) in password')
         }
 
         def validate_python(self, value, state):
             try:
                 (value or '').decode('ascii')
             except UnicodeError:
                 msg = M(self, 'invalid_password', state)
                 raise formencode.Invalid(msg, value, state,)
     return _validator
 
 
 def ValidOldPassword(username):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'invalid_password': _(u'Invalid old password')
         }
 
         def validate_python(self, value, state):
             from rhodecode.authentication.base import authenticate, HTTP_TYPE
             if not authenticate(username, value, '', HTTP_TYPE):
                 msg = M(self, 'invalid_password', state)
                 raise formencode.Invalid(
                     msg, value, state, error_dict={'current_password': msg}
                 )
     return _validator
 
 
 def ValidPasswordsMatch(
         passwd='new_password', passwd_confirmation='password_confirmation'):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'password_mismatch': _(u'Passwords do not match'),
         }
 
         def validate_python(self, value, state):
 
             pass_val = value.get('password') or value.get(passwd)
             if pass_val != value[passwd_confirmation]:
                 msg = M(self, 'password_mismatch', state)
                 raise formencode.Invalid(
                     msg, value, state,
                     error_dict={passwd: msg, passwd_confirmation: msg}
                 )
     return _validator
 
 
 def ValidAuth():
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'invalid_password': _(u'invalid password'),
             'invalid_username': _(u'invalid user name'),
             'disabled_account': _(u'Your account is disabled')
         }
 
         def validate_python(self, value, state):
             from rhodecode.authentication.base import authenticate, HTTP_TYPE
 
             password = value['password']
             username = value['username']
 
             if not authenticate(username, password, '', HTTP_TYPE,
                                 skip_missing=True):
                 user = User.get_by_username(username)
                 if user and not user.active:
                     log.warning('user %s is disabled', username)
                     msg = M(self, 'disabled_account', state)
                     raise formencode.Invalid(
                         msg, value, state, error_dict={'username': msg}
                     )
                 else:
                     log.warning('user `%s` failed to authenticate', username)
                     msg = M(self, 'invalid_username', state)
                     msg2 = M(self, 'invalid_password', state)
                     raise formencode.Invalid(
                         msg, value, state,
                         error_dict={'username': msg, 'password': msg2}
                     )
     return _validator
 
 
 def ValidAuthToken():
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'invalid_token': _(u'Token mismatch')
         }
 
         def validate_python(self, value, state):
             if value != authentication_token():
                 msg = M(self, 'invalid_token', state)
                 raise formencode.Invalid(msg, value, state)
     return _validator
 
 
 def ValidRepoName(edit=False, old_data={}):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'invalid_repo_name':
                 _(u'Repository name %(repo)s is disallowed'),
             # top level
             'repository_exists': _(u'Repository with name %(repo)s '
                                    u'already exists'),
             'group_exists': _(u'Repository group with name "%(repo)s" '
                               u'already exists'),
             # inside a group
             'repository_in_group_exists': _(u'Repository with name %(repo)s '
                                             u'exists in group "%(group)s"'),
             'group_in_group_exists': _(
                 u'Repository group with name "%(repo)s" '
                 u'exists in group "%(group)s"'),
         }
 
         def _to_python(self, value, state):
             repo_name = repo_name_slug(value.get('repo_name', ''))
             repo_group = value.get('repo_group')
             if repo_group:
                 gr = RepoGroup.get(repo_group)
                 group_path = gr.full_path
                 group_name = gr.group_name
                 # value needs to be aware of group name in order to check
                 # db key This is an actual just the name to store in the
                 # database
                 repo_name_full = group_path + RepoGroup.url_sep() + repo_name
             else:
                 group_name = group_path = ''
                 repo_name_full = repo_name
 
             value['repo_name'] = repo_name
             value['repo_name_full'] = repo_name_full
             value['group_path'] = group_path
             value['group_name'] = group_name
             return value
 
         def validate_python(self, value, state):
 
             repo_name = value.get('repo_name')
             repo_name_full = value.get('repo_name_full')
             group_path = value.get('group_path')
             group_name = value.get('group_name')
 
             if repo_name in [ADMIN_PREFIX, '']:
                 msg = M(self, 'invalid_repo_name', state, repo=repo_name)
                 raise formencode.Invalid(
                     msg, value, state, error_dict={'repo_name': msg})
 
             rename = old_data.get('repo_name') != repo_name_full
             create = not edit
             if rename or create:
 
                 if group_path:
                     if Repository.get_by_repo_name(repo_name_full):
                         msg = M(self, 'repository_in_group_exists', state,
                                 repo=repo_name, group=group_name)
                         raise formencode.Invalid(
                             msg, value, state, error_dict={'repo_name': msg})
                     if RepoGroup.get_by_group_name(repo_name_full):
                         msg = M(self, 'group_in_group_exists', state,
                                 repo=repo_name, group=group_name)
                         raise formencode.Invalid(
                             msg, value, state, error_dict={'repo_name': msg})
                 else:
                     if RepoGroup.get_by_group_name(repo_name_full):
                         msg = M(self, 'group_exists', state, repo=repo_name)
                         raise formencode.Invalid(
                             msg, value, state, error_dict={'repo_name': msg})
 
                     if Repository.get_by_repo_name(repo_name_full):
                         msg = M(
                             self, 'repository_exists', state, repo=repo_name)
                         raise formencode.Invalid(
                             msg, value, state, error_dict={'repo_name': msg})
             return value
     return _validator
 
 
 def ValidForkName(*args, **kwargs):
     return ValidRepoName(*args, **kwargs)
 
 
 def SlugifyName():
     class _validator(formencode.validators.FancyValidator):
 
         def _to_python(self, value, state):
             return repo_name_slug(value)
 
         def validate_python(self, value, state):
             pass
 
     return _validator
 
 
 def CannotHaveGitSuffix():
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'has_git_suffix':
                 _(u'Repository name cannot end with .git'),
         }
 
         def _to_python(self, value, state):
             return value
 
         def validate_python(self, value, state):
             if value and value.endswith('.git'):
                 msg = M(
                     self, 'has_git_suffix', state)
                 raise formencode.Invalid(
                     msg, value, state, error_dict={'repo_name': msg})
 
     return _validator
 
 
 def ValidCloneUri():
     class InvalidCloneUrl(Exception):
         allowed_prefixes = ()
 
     def url_handler(repo_type, url):
         config = make_db_config(clear_session=False)
         if repo_type == 'hg':
             allowed_prefixes = ('http', 'svn+http', 'git+http')
 
             if 'http' in url[:4]:
                 # initially check if it's at least the proper URL
                 # or does it pass basic auth
                 MercurialRepository.check_url(url, config)
             elif 'svn+http' in url[:8]:  # svn->hg import
                 SubversionRepository.check_url(url, config)
             elif 'git+http' in url[:8]:  # git->hg import
                 raise NotImplementedError()
             else:
                 exc = InvalidCloneUrl('Clone from URI %s not allowed. '
                                       'Allowed url must start with one of %s'
                                       % (url, ','.join(allowed_prefixes)))
                 exc.allowed_prefixes = allowed_prefixes
                 raise exc
 
         elif repo_type == 'git':
             allowed_prefixes = ('http', 'svn+http', 'hg+http')
             if 'http' in url[:4]:
                 # initially check if it's at least the proper URL
                 # or does it pass basic auth
                 GitRepository.check_url(url, config)
             elif 'svn+http' in url[:8]:  # svn->git import
                 raise NotImplementedError()
             elif 'hg+http' in url[:8]:  # hg->git import
                 raise NotImplementedError()
             else:
                 exc = InvalidCloneUrl('Clone from URI %s not allowed. '
                                       'Allowed url must start with one of %s'
                                       % (url, ','.join(allowed_prefixes)))
                 exc.allowed_prefixes = allowed_prefixes
                 raise exc
 
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'clone_uri': _(u'invalid clone url for %(rtype)s repository'),
             'invalid_clone_uri': _(
                 u'Invalid clone url, provide a valid clone '
                 u'url starting with one of %(allowed_prefixes)s')
         }
 
         def validate_python(self, value, state):
             repo_type = value.get('repo_type')
             url = value.get('clone_uri')
 
             if url:
                 try:
                     url_handler(repo_type, url)
                 except InvalidCloneUrl as e:
                     log.warning(e)
                     msg = M(self, 'invalid_clone_uri', rtype=repo_type,
                             allowed_prefixes=','.join(e.allowed_prefixes))
                     raise formencode.Invalid(msg, value, state,
                                              error_dict={'clone_uri': msg})
                 except Exception:
                     log.exception('Url validation failed')
                     msg = M(self, 'clone_uri', rtype=repo_type)
                     raise formencode.Invalid(msg, value, state,
                                              error_dict={'clone_uri': msg})
     return _validator
 
 
 def ValidForkType(old_data={}):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'invalid_fork_type': _(u'Fork have to be the same type as parent')
         }
 
         def validate_python(self, value, state):
             if old_data['repo_type'] != value:
                 msg = M(self, 'invalid_fork_type', state)
                 raise formencode.Invalid(
                     msg, value, state, error_dict={'repo_type': msg}
                 )
     return _validator
 
 
 def CanWriteGroup(old_data=None):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'permission_denied': _(
                 u"You do not have the permission "
                 u"to create repositories in this group."),
             'permission_denied_root': _(
                 u"You do not have the permission to store repositories in "
                 u"the root location.")
         }
 
         def _to_python(self, value, state):
             # root location
             if value in [-1, "-1"]:
                 return None
             return value
 
         def validate_python(self, value, state):
             gr = RepoGroup.get(value)
             gr_name = gr.group_name if gr else None  # None means ROOT location
             # create repositories with write permission on group is set to true
             create_on_write = HasPermissionAny(
                 'hg.create.write_on_repogroup.true')()
             group_admin = HasRepoGroupPermissionAny('group.admin')(
                 gr_name, 'can write into group validator')
             group_write = HasRepoGroupPermissionAny('group.write')(
                 gr_name, 'can write into group validator')
             forbidden = not (group_admin or (group_write and create_on_write))
             can_create_repos = HasPermissionAny(
                 'hg.admin', 'hg.create.repository')
             gid = (old_data['repo_group'].get('group_id')
                    if (old_data and 'repo_group' in old_data) else None)
             value_changed = gid != safe_int(value)
             new = not old_data
             # do check if we changed the value, there's a case that someone got
             # revoked write permissions to a repository, he still created, we
             # don't need to check permission if he didn't change the value of
             # groups in form box
             if value_changed or new:
                 # parent group need to be existing
                 if gr and forbidden:
                     msg = M(self, 'permission_denied', state)
                     raise formencode.Invalid(
                         msg, value, state, error_dict={'repo_type': msg}
                     )
                 # check if we can write to root location !
                 elif gr is None and not can_create_repos():
                     msg = M(self, 'permission_denied_root', state)
                     raise formencode.Invalid(
                         msg, value, state, error_dict={'repo_type': msg}
                     )
 
     return _validator
 
 
 def ValidPerms(type_='repo'):
     if type_ == 'repo_group':
         EMPTY_PERM = 'group.none'
     elif type_ == 'repo':
         EMPTY_PERM = 'repository.none'
     elif type_ == 'user_group':
         EMPTY_PERM = 'usergroup.none'
 
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'perm_new_member_name':
                 _(u'This username or user group name is not valid')
         }
 
         def _to_python(self, value, state):
             perm_updates = OrderedSet()
             perm_additions = OrderedSet()
             perm_deletions = OrderedSet()
             # build a list of permission to update/delete and new permission
 
             # Read the perm_new_member/perm_del_member attributes and group
             # them by they IDs
             new_perms_group = defaultdict(dict)
             del_perms_group = defaultdict(dict)
             for k, v in value.copy().iteritems():
                 if k.startswith('perm_del_member'):
                     # delete from org storage so we don't process that later
                     del value[k]
                     # part is `id`, `type`
                     _type, part = k.split('perm_del_member_')
                     args = part.split('_')
                     if len(args) == 2:
                         _key, pos = args
                         del_perms_group[pos][_key] = v
                 if k.startswith('perm_new_member'):
                     # delete from org storage so we don't process that later
                     del value[k]
                     # part is `id`, `type`, `perm`
                     _type, part = k.split('perm_new_member_')
                     args = part.split('_')
                     if len(args) == 2:
                         _key, pos = args
                         new_perms_group[pos][_key] = v
 
             # store the deletes
             for k in sorted(del_perms_group.keys()):
                 perm_dict = del_perms_group[k]
                 del_member = perm_dict.get('id')
                 del_type = perm_dict.get('type')
                 if del_member and del_type:
                     perm_deletions.add(
                         (del_member, None, del_type))
 
             # store additions in order of how they were added in web form
             for k in sorted(new_perms_group.keys()):
                 perm_dict = new_perms_group[k]
                 new_member = perm_dict.get('id')
                 new_type = perm_dict.get('type')
                 new_perm = perm_dict.get('perm')
                 if new_member and new_perm and new_type:
                     perm_additions.add(
                         (new_member, new_perm, new_type))
 
             # get updates of permissions
             # (read the existing radio button states)
             default_user_id = User.get_default_user().user_id
             for k, update_value in value.iteritems():
                 if k.startswith('u_perm_') or k.startswith('g_perm_'):
                     member = k[7:]
                     update_type = {'u': 'user',
                                    'g': 'users_group'}[k[0]]
 
                     if safe_int(member) == default_user_id:
                         if str2bool(value.get('repo_private')):
                             # prevent from updating default user permissions
                             # when this repository is marked as private
                             update_value = EMPTY_PERM
 
                     perm_updates.add(
                         (member, update_value, update_type))
 
             value['perm_additions'] = []  # propagated later
             value['perm_updates'] = list(perm_updates)
             value['perm_deletions'] = list(perm_deletions)
 
             updates_map = dict(
                 (x[0], (x[1], x[2])) for x in value['perm_updates'])
             # make sure Additions don't override updates.
             for member_id, perm, member_type in list(perm_additions):
                 if member_id in updates_map:
                     perm = updates_map[member_id][0]
                 value['perm_additions'].append((member_id, perm, member_type))
 
                 # on new entries validate users they exist and they are active !
                 # this leaves feedback to the form
                 try:
                     if member_type == 'user':
                         User.query()\
                             .filter(User.active == true())\
                             .filter(User.user_id == member_id).one()
                     if member_type == 'users_group':
                         UserGroup.query()\
                             .filter(UserGroup.users_group_active == true())\
                             .filter(UserGroup.users_group_id == member_id)\
                             .one()
 
                 except Exception:
                     log.exception('Updated permission failed: org_exc:')
                     msg = M(self, 'perm_new_member_type', state)
                     raise formencode.Invalid(
                         msg, value, state, error_dict={
                             'perm_new_member_name': msg}
                     )
             return value
     return _validator
 
 
 def ValidSettings():
     class _validator(formencode.validators.FancyValidator):
         def _to_python(self, value, state):
             # settings  form for users that are not admin
             # can't edit certain parameters, it's extra backup if they mangle
             # with forms
 
             forbidden_params = [
                 'user', 'repo_type', 'repo_enable_locking',
                 'repo_enable_downloads', 'repo_enable_statistics'
             ]
 
             for param in forbidden_params:
                 if param in value:
                     del value[param]
             return value
 
         def validate_python(self, value, state):
             pass
     return _validator
 
 
 def ValidPath():
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'invalid_path': _(u'This is not a valid path')
         }
 
         def validate_python(self, value, state):
             if not os.path.isdir(value):
                 msg = M(self, 'invalid_path', state)
                 raise formencode.Invalid(
                     msg, value, state, error_dict={'paths_root_path': msg}
                 )
     return _validator
 
 
 def UniqSystemEmail(old_data={}):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'email_taken': _(u'This e-mail address is already taken')
         }
 
         def _to_python(self, value, state):
             return value.lower()
 
         def validate_python(self, value, state):
             if (old_data.get('email') or '').lower() != value:
                 user = User.get_by_email(value, case_insensitive=True)
                 if user:
                     msg = M(self, 'email_taken', state)
                     raise formencode.Invalid(
                         msg, value, state, error_dict={'email': msg}
                     )
     return _validator
 
 
 def ValidSystemEmail():
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'non_existing_email': _(u'e-mail "%(email)s" does not exist.')
         }
 
         def _to_python(self, value, state):
             return value.lower()
 
         def validate_python(self, value, state):
             user = User.get_by_email(value, case_insensitive=True)
             if user is None:
                 msg = M(self, 'non_existing_email', state, email=value)
                 raise formencode.Invalid(
                     msg, value, state, error_dict={'email': msg}
                 )
 
     return _validator
 
 
 def NotReviewedRevisions(repo_id):
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'rev_already_reviewed':
                 _(u'Revisions %(revs)s are already part of pull request '
                   u'or have set status'),
         }
 
         def validate_python(self, value, state):
             # check revisions if they are not reviewed, or a part of another
             # pull request
             statuses = ChangesetStatus.query()\
                 .filter(ChangesetStatus.revision.in_(value))\
                 .filter(ChangesetStatus.repo_id == repo_id)\
                 .all()
 
             errors = []
             for status in statuses:
                 if status.pull_request_id:
                     errors.append(['pull_req', status.revision[:12]])
                 elif status.status:
                     errors.append(['status', status.revision[:12]])
 
             if errors:
                 revs = ','.join([x[1] for x in errors])
                 msg = M(self, 'rev_already_reviewed', state, revs=revs)
                 raise formencode.Invalid(
                     msg, value, state, error_dict={'revisions': revs})
 
     return _validator
 
 
 def ValidIp():
     class _validator(CIDR):
         messages = {
             'badFormat': _(u'Please enter a valid IPv4 or IpV6 address'),
             'illegalBits': _(
                 u'The network size (bits) must be within the range '
                 u'of 0-32 (not %(bits)r)'),
         }
 
         # we ovveride the default to_python() call
         def to_python(self, value, state):
             v = super(_validator, self).to_python(value, state)
             v = safe_unicode(v.strip())
             net = ipaddress.ip_network(address=v, strict=False)
             return str(net)
 
         def validate_python(self, value, state):
             try:
                 addr = safe_unicode(value.strip())
                 # this raises an ValueError if address is not IpV4 or IpV6
                 ipaddress.ip_network(addr, strict=False)
             except ValueError:
                 raise formencode.Invalid(self.message('badFormat', state),
                                          value, state)
 
     return _validator
 
 
 def FieldKey():
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'badFormat': _(
                 u'Key name can only consist of letters, '
                 u'underscore, dash or numbers'),
         }
 
         def validate_python(self, value, state):
             if not re.match('[a-zA-Z0-9_-]+$', value):
                 raise formencode.Invalid(self.message('badFormat', state),
                                          value, state)
     return _validator
 
 
 def ValidAuthPlugins():
     class _validator(formencode.validators.FancyValidator):
         messages = {
             'import_duplicate': _(
                 u'Plugins %(loaded)s and %(next_to_load)s '
                 u'both export the same name'),
             'missing_includeme': _(
                 u'The plugin "%(plugin_id)s" is missing an includeme '
                 u'function.'),
             'import_error': _(
                 u'Can not load plugin "%(plugin_id)s"'),
             'no_plugin': _(
                 u'No plugin available with ID "%(plugin_id)s"'),
         }
 
         def _to_python(self, value, state):
             # filter empty values
             return filter(lambda s: s not in [None, ''], value)
 
         def _validate_legacy_plugin_id(self, plugin_id, value, state):
             """
             Validates that the plugin import works. It also checks that the
             plugin has an includeme attribute.
             """
             try:
                 plugin = _import_legacy_plugin(plugin_id)
             except Exception as e:
                 log.exception(
                     'Exception during import of auth legacy plugin "{}"'
                     .format(plugin_id))
                 msg = M(self, 'import_error', plugin_id=plugin_id)
                 raise formencode.Invalid(msg, value, state)
 
             if not hasattr(plugin, 'includeme'):
                 msg = M(self, 'missing_includeme', plugin_id=plugin_id)
                 raise formencode.Invalid(msg, value, state)
 
             return plugin
 
         def _validate_plugin_id(self, plugin_id, value, state):
             """
             Plugins are already imported during app start up. Therefore this
             validation only retrieves the plugin from the plugin registry and
             if it returns something not None everything is OK.
             """
             plugin = loadplugin(plugin_id)
 
             if plugin is None:
                 msg = M(self, 'no_plugin', plugin_id=plugin_id)
                 raise formencode.Invalid(msg, value, state)
 
             return plugin
 
         def validate_python(self, value, state):
             unique_names = {}
             for plugin_id in value:
 
                 # Validate legacy or normal plugin.
                 if plugin_id.startswith(legacy_plugin_prefix):
                     plugin = self._validate_legacy_plugin_id(
                         plugin_id, value, state)
                 else:
                     plugin = self._validate_plugin_id(plugin_id, value, state)
 
                 # Only allow unique plugin names.
                 if plugin.name in unique_names:
                     msg = M(self, 'import_duplicate', state,
                             loaded=unique_names[plugin.name],
                             next_to_load=plugin)
                     raise formencode.Invalid(msg, value, state)
                 unique_names[plugin.name] = plugin
 
     return _validator
 
 
 def ValidPattern():
 
     class _Validator(formencode.validators.FancyValidator):
 
         def _to_python(self, value, state):
             patterns = []
 
             prefix = 'new_pattern'
             for name, v in value.iteritems():
                 pattern_name = '_'.join((prefix, 'pattern'))
                 if name.startswith(pattern_name):
                     new_item_id = name[len(pattern_name)+1:]
 
                     def _field(name):
                         return '%s_%s_%s' % (prefix, name, new_item_id)
 
                     values = {
                         'issuetracker_pat': value.get(_field('pattern')),
                         'issuetracker_pat': value.get(_field('pattern')),
                         'issuetracker_url': value.get(_field('url')),
                         'issuetracker_pref': value.get(_field('prefix')),
                         'issuetracker_desc': value.get(_field('description'))
                     }
                     new_uid = md5(values['issuetracker_pat'])
 
                     has_required_fields = (
                         values['issuetracker_pat']
                         and values['issuetracker_url'])
 
                     if has_required_fields:
                         settings = [
                             ('_'.join((key, new_uid)), values[key], 'unicode')
                             for key in values]
                         patterns.append(settings)
 
             value['patterns'] = patterns
             delete_patterns = value.get('uid') or []
             if not isinstance(delete_patterns, (list, tuple)):
                 delete_patterns = [delete_patterns]
             value['delete_patterns'] = delete_patterns
             return value
     return _Validator

rhodecode/public/js/rhodecode/routes.js

@@ -1,258 +1,269 b''
 
 /******************************************************************************
  *                                                                            *
  *                      DO NOT CHANGE THIS FILE MANUALLY                      *
  *                                                                            *
  *                                                                            *
  *        This file is automatically generated when the app starts up with    *
  *                         generate_js_files = true                           *
  *                                                                            *
  *  To add a route here pass jsroute=True to the route definition in the app  *
  *                                                                            *
  ******************************************************************************/
 function registerRCRoutes() {
     // routes registration
     pyroutes.register('edit_user', '/_admin/users/%(user_id)s/edit', ['user_id']);
     pyroutes.register('favicon', '/favicon.ico', []);
     pyroutes.register('robots', '/robots.txt', []);
     pyroutes.register('auth_home', '/_admin/auth*traverse', []);
     pyroutes.register('global_integrations_new', '/_admin/integrations/new', []);
     pyroutes.register('global_integrations_home', '/_admin/integrations', []);
     pyroutes.register('global_integrations_list', '/_admin/integrations/%(integration)s', ['integration']);
     pyroutes.register('global_integrations_create', '/_admin/integrations/%(integration)s/new', ['integration']);
     pyroutes.register('global_integrations_edit', '/_admin/integrations/%(integration)s/%(integration_id)s', ['integration', 'integration_id']);
     pyroutes.register('repo_group_integrations_home', '/%(repo_group_name)s/settings/integrations', ['repo_group_name']);
     pyroutes.register('repo_group_integrations_new', '/%(repo_group_name)s/settings/integrations/new', ['repo_group_name']);
     pyroutes.register('repo_group_integrations_list', '/%(repo_group_name)s/settings/integrations/%(integration)s', ['repo_group_name', 'integration']);
     pyroutes.register('repo_group_integrations_create', '/%(repo_group_name)s/settings/integrations/%(integration)s/new', ['repo_group_name', 'integration']);
     pyroutes.register('repo_group_integrations_edit', '/%(repo_group_name)s/settings/integrations/%(integration)s/%(integration_id)s', ['repo_group_name', 'integration', 'integration_id']);
     pyroutes.register('repo_integrations_home', '/%(repo_name)s/settings/integrations', ['repo_name']);
     pyroutes.register('repo_integrations_new', '/%(repo_name)s/settings/integrations/new', ['repo_name']);
     pyroutes.register('repo_integrations_list', '/%(repo_name)s/settings/integrations/%(integration)s', ['repo_name', 'integration']);
     pyroutes.register('repo_integrations_create', '/%(repo_name)s/settings/integrations/%(integration)s/new', ['repo_name', 'integration']);
     pyroutes.register('repo_integrations_edit', '/%(repo_name)s/settings/integrations/%(integration)s/%(integration_id)s', ['repo_name', 'integration', 'integration_id']);
     pyroutes.register('ops_ping', '/_admin/ops/ping', []);
     pyroutes.register('ops_error_test', '/_admin/ops/error', []);
     pyroutes.register('ops_redirect_test', '/_admin/ops/redirect', []);
     pyroutes.register('admin_home', '/_admin', []);
     pyroutes.register('admin_audit_logs', '/_admin/audit_logs', []);
     pyroutes.register('pull_requests_global_0', '/_admin/pull_requests/%(pull_request_id)s', ['pull_request_id']);
     pyroutes.register('pull_requests_global_1', '/_admin/pull-requests/%(pull_request_id)s', ['pull_request_id']);
     pyroutes.register('pull_requests_global', '/_admin/pull-request/%(pull_request_id)s', ['pull_request_id']);
     pyroutes.register('admin_settings_open_source', '/_admin/settings/open_source', []);
     pyroutes.register('admin_settings_vcs_svn_generate_cfg', '/_admin/settings/vcs/svn_generate_cfg', []);
     pyroutes.register('admin_settings_system', '/_admin/settings/system', []);
     pyroutes.register('admin_settings_system_update', '/_admin/settings/system/updates', []);
     pyroutes.register('admin_settings_sessions', '/_admin/settings/sessions', []);
     pyroutes.register('admin_settings_sessions_cleanup', '/_admin/settings/sessions/cleanup', []);
     pyroutes.register('admin_settings_process_management', '/_admin/settings/process_management', []);
     pyroutes.register('admin_settings_process_management_signal', '/_admin/settings/process_management/signal', []);
     pyroutes.register('admin_permissions_application', '/_admin/permissions/application', []);
     pyroutes.register('admin_permissions_application_update', '/_admin/permissions/application/update', []);
     pyroutes.register('admin_permissions_global', '/_admin/permissions/global', []);
     pyroutes.register('admin_permissions_global_update', '/_admin/permissions/global/update', []);
     pyroutes.register('admin_permissions_object', '/_admin/permissions/object', []);
     pyroutes.register('admin_permissions_object_update', '/_admin/permissions/object/update', []);
     pyroutes.register('admin_permissions_ips', '/_admin/permissions/ips', []);
     pyroutes.register('admin_permissions_overview', '/_admin/permissions/overview', []);
     pyroutes.register('admin_permissions_auth_token_access', '/_admin/permissions/auth_token_access', []);
     pyroutes.register('admin_permissions_ssh_keys', '/_admin/permissions/ssh_keys', []);
     pyroutes.register('admin_permissions_ssh_keys_data', '/_admin/permissions/ssh_keys/data', []);
     pyroutes.register('admin_permissions_ssh_keys_update', '/_admin/permissions/ssh_keys/update', []);
     pyroutes.register('users', '/_admin/users', []);
     pyroutes.register('users_data', '/_admin/users_data', []);
     pyroutes.register('edit_user_auth_tokens', '/_admin/users/%(user_id)s/edit/auth_tokens', ['user_id']);
     pyroutes.register('edit_user_auth_tokens_add', '/_admin/users/%(user_id)s/edit/auth_tokens/new', ['user_id']);
     pyroutes.register('edit_user_auth_tokens_delete', '/_admin/users/%(user_id)s/edit/auth_tokens/delete', ['user_id']);
     pyroutes.register('edit_user_ssh_keys', '/_admin/users/%(user_id)s/edit/ssh_keys', ['user_id']);
     pyroutes.register('edit_user_ssh_keys_generate_keypair', '/_admin/users/%(user_id)s/edit/ssh_keys/generate', ['user_id']);
     pyroutes.register('edit_user_ssh_keys_add', '/_admin/users/%(user_id)s/edit/ssh_keys/new', ['user_id']);
     pyroutes.register('edit_user_ssh_keys_delete', '/_admin/users/%(user_id)s/edit/ssh_keys/delete', ['user_id']);
     pyroutes.register('edit_user_emails', '/_admin/users/%(user_id)s/edit/emails', ['user_id']);
     pyroutes.register('edit_user_emails_add', '/_admin/users/%(user_id)s/edit/emails/new', ['user_id']);
     pyroutes.register('edit_user_emails_delete', '/_admin/users/%(user_id)s/edit/emails/delete', ['user_id']);
     pyroutes.register('edit_user_ips', '/_admin/users/%(user_id)s/edit/ips', ['user_id']);
     pyroutes.register('edit_user_ips_add', '/_admin/users/%(user_id)s/edit/ips/new', ['user_id']);
     pyroutes.register('edit_user_ips_delete', '/_admin/users/%(user_id)s/edit/ips/delete', ['user_id']);
     pyroutes.register('edit_user_perms_summary', '/_admin/users/%(user_id)s/edit/permissions_summary', ['user_id']);
     pyroutes.register('edit_user_perms_summary_json', '/_admin/users/%(user_id)s/edit/permissions_summary/json', ['user_id']);
     pyroutes.register('edit_user_groups_management', '/_admin/users/%(user_id)s/edit/groups_management', ['user_id']);
     pyroutes.register('edit_user_groups_management_updates', '/_admin/users/%(user_id)s/edit/edit_user_groups_management/updates', ['user_id']);
     pyroutes.register('edit_user_audit_logs', '/_admin/users/%(user_id)s/edit/audit', ['user_id']);
     pyroutes.register('user_groups', '/_admin/user_groups', []);
     pyroutes.register('user_groups_data', '/_admin/user_groups_data', []);
-    pyroutes.register('user_group_members_data', '/_admin/user_groups/%(user_group_id)s/members', ['user_group_id']);
-    pyroutes.register('edit_user_group_perms_summary', '/_admin/user_groups/%(user_group_id)s/edit/permissions_summary', ['user_group_id']);
-    pyroutes.register('edit_user_group_perms_summary_json', '/_admin/user_groups/%(user_group_id)s/edit/permissions_summary/json', ['user_group_id']);
+    pyroutes.register('user_groups_new', '/_admin/user_groups/new', []);
+    pyroutes.register('user_groups_create', '/_admin/user_groups/create', []);
     pyroutes.register('repos', '/_admin/repos', []);
     pyroutes.register('repo_new', '/_admin/repos/new', []);
     pyroutes.register('repo_create', '/_admin/repos/create', []);
     pyroutes.register('channelstream_connect', '/_admin/channelstream/connect', []);
     pyroutes.register('channelstream_subscribe', '/_admin/channelstream/subscribe', []);
     pyroutes.register('channelstream_proxy', '/_channelstream', []);
     pyroutes.register('login', '/_admin/login', []);
     pyroutes.register('logout', '/_admin/logout', []);
     pyroutes.register('register', '/_admin/register', []);
     pyroutes.register('reset_password', '/_admin/password_reset', []);
     pyroutes.register('reset_password_confirmation', '/_admin/password_reset_confirmation', []);
     pyroutes.register('home', '/', []);
     pyroutes.register('user_autocomplete_data', '/_users', []);
     pyroutes.register('user_group_autocomplete_data', '/_user_groups', []);
     pyroutes.register('repo_list_data', '/_repos', []);
     pyroutes.register('goto_switcher_data', '/_goto_data', []);
     pyroutes.register('journal', '/_admin/journal', []);
     pyroutes.register('journal_rss', '/_admin/journal/rss', []);
     pyroutes.register('journal_atom', '/_admin/journal/atom', []);
     pyroutes.register('journal_public', '/_admin/public_journal', []);
     pyroutes.register('journal_public_atom', '/_admin/public_journal/atom', []);
     pyroutes.register('journal_public_atom_old', '/_admin/public_journal_atom', []);
     pyroutes.register('journal_public_rss', '/_admin/public_journal/rss', []);
     pyroutes.register('journal_public_rss_old', '/_admin/public_journal_rss', []);
     pyroutes.register('toggle_following', '/_admin/toggle_following', []);
     pyroutes.register('repo_creating', '/%(repo_name)s/repo_creating', ['repo_name']);
     pyroutes.register('repo_creating_check', '/%(repo_name)s/repo_creating_check', ['repo_name']);
     pyroutes.register('repo_summary_explicit', '/%(repo_name)s/summary', ['repo_name']);
     pyroutes.register('repo_summary_commits', '/%(repo_name)s/summary-commits', ['repo_name']);
     pyroutes.register('repo_commit', '/%(repo_name)s/changeset/%(commit_id)s', ['repo_name', 'commit_id']);
     pyroutes.register('repo_commit_children', '/%(repo_name)s/changeset_children/%(commit_id)s', ['repo_name', 'commit_id']);
     pyroutes.register('repo_commit_parents', '/%(repo_name)s/changeset_parents/%(commit_id)s', ['repo_name', 'commit_id']);
     pyroutes.register('repo_commit_raw', '/%(repo_name)s/changeset-diff/%(commit_id)s', ['repo_name', 'commit_id']);
     pyroutes.register('repo_commit_patch', '/%(repo_name)s/changeset-patch/%(commit_id)s', ['repo_name', 'commit_id']);
     pyroutes.register('repo_commit_download', '/%(repo_name)s/changeset-download/%(commit_id)s', ['repo_name', 'commit_id']);
     pyroutes.register('repo_commit_data', '/%(repo_name)s/changeset-data/%(commit_id)s', ['repo_name', 'commit_id']);
     pyroutes.register('repo_commit_comment_create', '/%(repo_name)s/changeset/%(commit_id)s/comment/create', ['repo_name', 'commit_id']);
     pyroutes.register('repo_commit_comment_preview', '/%(repo_name)s/changeset/%(commit_id)s/comment/preview', ['repo_name', 'commit_id']);
     pyroutes.register('repo_commit_comment_delete', '/%(repo_name)s/changeset/%(commit_id)s/comment/%(comment_id)s/delete', ['repo_name', 'commit_id', 'comment_id']);
     pyroutes.register('repo_commit_raw_deprecated', '/%(repo_name)s/raw-changeset/%(commit_id)s', ['repo_name', 'commit_id']);
     pyroutes.register('repo_archivefile', '/%(repo_name)s/archive/%(fname)s', ['repo_name', 'fname']);
     pyroutes.register('repo_files_diff', '/%(repo_name)s/diff/%(f_path)s', ['repo_name', 'f_path']);
     pyroutes.register('repo_files_diff_2way_redirect', '/%(repo_name)s/diff-2way/%(f_path)s', ['repo_name', 'f_path']);
     pyroutes.register('repo_files', '/%(repo_name)s/files/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_files:default_path', '/%(repo_name)s/files/%(commit_id)s/', ['repo_name', 'commit_id']);
     pyroutes.register('repo_files:default_commit', '/%(repo_name)s/files', ['repo_name']);
     pyroutes.register('repo_files:rendered', '/%(repo_name)s/render/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_files:annotated', '/%(repo_name)s/annotate/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_files:annotated_previous', '/%(repo_name)s/annotate-previous/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_nodetree_full', '/%(repo_name)s/nodetree_full/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_nodetree_full:default_path', '/%(repo_name)s/nodetree_full/%(commit_id)s/', ['repo_name', 'commit_id']);
     pyroutes.register('repo_files_nodelist', '/%(repo_name)s/nodelist/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_file_raw', '/%(repo_name)s/raw/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_file_download', '/%(repo_name)s/download/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_file_download:legacy', '/%(repo_name)s/rawfile/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_file_history', '/%(repo_name)s/history/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_file_authors', '/%(repo_name)s/authors/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_files_remove_file', '/%(repo_name)s/remove_file/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_files_delete_file', '/%(repo_name)s/delete_file/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_files_edit_file', '/%(repo_name)s/edit_file/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_files_update_file', '/%(repo_name)s/update_file/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_files_add_file', '/%(repo_name)s/add_file/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_files_create_file', '/%(repo_name)s/create_file/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_refs_data', '/%(repo_name)s/refs-data', ['repo_name']);
     pyroutes.register('repo_refs_changelog_data', '/%(repo_name)s/refs-data-changelog', ['repo_name']);
     pyroutes.register('repo_stats', '/%(repo_name)s/repo_stats/%(commit_id)s', ['repo_name', 'commit_id']);
     pyroutes.register('repo_changelog', '/%(repo_name)s/changelog', ['repo_name']);
     pyroutes.register('repo_changelog_file', '/%(repo_name)s/changelog/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_changelog_elements', '/%(repo_name)s/changelog_elements', ['repo_name']);
     pyroutes.register('repo_compare_select', '/%(repo_name)s/compare', ['repo_name']);
     pyroutes.register('repo_compare', '/%(repo_name)s/compare/%(source_ref_type)s@%(source_ref)s...%(target_ref_type)s@%(target_ref)s', ['repo_name', 'source_ref_type', 'source_ref', 'target_ref_type', 'target_ref']);
     pyroutes.register('tags_home', '/%(repo_name)s/tags', ['repo_name']);
     pyroutes.register('branches_home', '/%(repo_name)s/branches', ['repo_name']);
     pyroutes.register('bookmarks_home', '/%(repo_name)s/bookmarks', ['repo_name']);
     pyroutes.register('repo_fork_new', '/%(repo_name)s/fork', ['repo_name']);
     pyroutes.register('repo_fork_create', '/%(repo_name)s/fork/create', ['repo_name']);
     pyroutes.register('repo_forks_show_all', '/%(repo_name)s/forks', ['repo_name']);
     pyroutes.register('repo_forks_data', '/%(repo_name)s/forks/data', ['repo_name']);
     pyroutes.register('pullrequest_show', '/%(repo_name)s/pull-request/%(pull_request_id)s', ['repo_name', 'pull_request_id']);
     pyroutes.register('pullrequest_show_all', '/%(repo_name)s/pull-request', ['repo_name']);
     pyroutes.register('pullrequest_show_all_data', '/%(repo_name)s/pull-request-data', ['repo_name']);
     pyroutes.register('pullrequest_repo_refs', '/%(repo_name)s/pull-request/refs/%(target_repo_name)s', ['repo_name', 'target_repo_name']);
     pyroutes.register('pullrequest_repo_destinations', '/%(repo_name)s/pull-request/repo-destinations', ['repo_name']);
     pyroutes.register('pullrequest_new', '/%(repo_name)s/pull-request/new', ['repo_name']);
     pyroutes.register('pullrequest_create', '/%(repo_name)s/pull-request/create', ['repo_name']);
     pyroutes.register('pullrequest_update', '/%(repo_name)s/pull-request/%(pull_request_id)s/update', ['repo_name', 'pull_request_id']);
     pyroutes.register('pullrequest_merge', '/%(repo_name)s/pull-request/%(pull_request_id)s/merge', ['repo_name', 'pull_request_id']);
     pyroutes.register('pullrequest_delete', '/%(repo_name)s/pull-request/%(pull_request_id)s/delete', ['repo_name', 'pull_request_id']);
     pyroutes.register('pullrequest_comment_create', '/%(repo_name)s/pull-request/%(pull_request_id)s/comment', ['repo_name', 'pull_request_id']);
     pyroutes.register('pullrequest_comment_delete', '/%(repo_name)s/pull-request/%(pull_request_id)s/comment/%(comment_id)s/delete', ['repo_name', 'pull_request_id', 'comment_id']);
     pyroutes.register('edit_repo', '/%(repo_name)s/settings', ['repo_name']);
     pyroutes.register('edit_repo_advanced', '/%(repo_name)s/settings/advanced', ['repo_name']);
     pyroutes.register('edit_repo_advanced_delete', '/%(repo_name)s/settings/advanced/delete', ['repo_name']);
     pyroutes.register('edit_repo_advanced_locking', '/%(repo_name)s/settings/advanced/locking', ['repo_name']);
     pyroutes.register('edit_repo_advanced_journal', '/%(repo_name)s/settings/advanced/journal', ['repo_name']);
     pyroutes.register('edit_repo_advanced_fork', '/%(repo_name)s/settings/advanced/fork', ['repo_name']);
     pyroutes.register('edit_repo_caches', '/%(repo_name)s/settings/caches', ['repo_name']);
     pyroutes.register('edit_repo_perms', '/%(repo_name)s/settings/permissions', ['repo_name']);
     pyroutes.register('edit_repo_maintenance', '/%(repo_name)s/settings/maintenance', ['repo_name']);
     pyroutes.register('edit_repo_maintenance_execute', '/%(repo_name)s/settings/maintenance/execute', ['repo_name']);
     pyroutes.register('edit_repo_fields', '/%(repo_name)s/settings/fields', ['repo_name']);
     pyroutes.register('edit_repo_fields_create', '/%(repo_name)s/settings/fields/create', ['repo_name']);
     pyroutes.register('edit_repo_fields_delete', '/%(repo_name)s/settings/fields/%(field_id)s/delete', ['repo_name', 'field_id']);
     pyroutes.register('repo_edit_toggle_locking', '/%(repo_name)s/settings/toggle_locking', ['repo_name']);
     pyroutes.register('edit_repo_remote', '/%(repo_name)s/settings/remote', ['repo_name']);
     pyroutes.register('edit_repo_remote_pull', '/%(repo_name)s/settings/remote/pull', ['repo_name']);
     pyroutes.register('edit_repo_statistics', '/%(repo_name)s/settings/statistics', ['repo_name']);
     pyroutes.register('edit_repo_statistics_reset', '/%(repo_name)s/settings/statistics/update', ['repo_name']);
     pyroutes.register('edit_repo_issuetracker', '/%(repo_name)s/settings/issue_trackers', ['repo_name']);
     pyroutes.register('edit_repo_issuetracker_test', '/%(repo_name)s/settings/issue_trackers/test', ['repo_name']);
     pyroutes.register('edit_repo_issuetracker_delete', '/%(repo_name)s/settings/issue_trackers/delete', ['repo_name']);
     pyroutes.register('edit_repo_issuetracker_update', '/%(repo_name)s/settings/issue_trackers/update', ['repo_name']);
     pyroutes.register('edit_repo_vcs', '/%(repo_name)s/settings/vcs', ['repo_name']);
     pyroutes.register('edit_repo_vcs_update', '/%(repo_name)s/settings/vcs/update', ['repo_name']);
     pyroutes.register('edit_repo_vcs_svn_pattern_delete', '/%(repo_name)s/settings/vcs/svn_pattern/delete', ['repo_name']);
     pyroutes.register('repo_reviewers', '/%(repo_name)s/settings/review/rules', ['repo_name']);
     pyroutes.register('repo_default_reviewers_data', '/%(repo_name)s/settings/review/default-reviewers', ['repo_name']);
     pyroutes.register('edit_repo_strip', '/%(repo_name)s/settings/strip', ['repo_name']);
     pyroutes.register('strip_check', '/%(repo_name)s/settings/strip_check', ['repo_name']);
     pyroutes.register('strip_execute', '/%(repo_name)s/settings/strip_execute', ['repo_name']);
     pyroutes.register('rss_feed_home', '/%(repo_name)s/feed/rss', ['repo_name']);
     pyroutes.register('atom_feed_home', '/%(repo_name)s/feed/atom', ['repo_name']);
     pyroutes.register('repo_summary', '/%(repo_name)s', ['repo_name']);
     pyroutes.register('repo_summary_slash', '/%(repo_name)s/', ['repo_name']);
     pyroutes.register('repo_group_home', '/%(repo_group_name)s', ['repo_group_name']);
     pyroutes.register('repo_group_home_slash', '/%(repo_group_name)s/', ['repo_group_name']);
+    pyroutes.register('user_group_members_data', '/_admin/user_groups/%(user_group_id)s/members', ['user_group_id']);
+    pyroutes.register('edit_user_group_perms_summary', '/_admin/user_groups/%(user_group_id)s/edit/permissions_summary', ['user_group_id']);
+    pyroutes.register('edit_user_group_perms_summary_json', '/_admin/user_groups/%(user_group_id)s/edit/permissions_summary/json', ['user_group_id']);
+    pyroutes.register('edit_user_group', '/_admin/user_groups/%(user_group_id)s/edit', ['user_group_id']);
+    pyroutes.register('user_groups_update', '/_admin/user_groups/%(user_group_id)s/update', ['user_group_id']);
+    pyroutes.register('edit_user_group_global_perms', '/_admin/user_groups/%(user_group_id)s/edit/global_permissions', ['user_group_id']);
+    pyroutes.register('edit_user_group_global_perms_update', '/_admin/user_groups/%(user_group_id)s/edit/global_permissions/update', ['user_group_id']);
+    pyroutes.register('edit_user_group_perms', '/_admin/user_groups/%(user_group_id)s/edit/permissions', ['user_group_id']);
+    pyroutes.register('edit_user_group_perms_update', '/_admin/user_groups/%(user_group_id)s/edit/permissions/update', ['user_group_id']);
+    pyroutes.register('edit_user_group_advanced', '/_admin/user_groups/%(user_group_id)s/edit/advanced', ['user_group_id']);
+    pyroutes.register('edit_user_group_advanced_sync', '/_admin/user_groups/%(user_group_id)s/edit/advanced/sync', ['user_group_id']);
+    pyroutes.register('user_groups_delete', '/_admin/user_groups/%(user_group_id)s/delete', ['user_group_id']);
     pyroutes.register('search', '/_admin/search', []);
     pyroutes.register('search_repo', '/%(repo_name)s/search', ['repo_name']);
     pyroutes.register('user_profile', '/_profiles/%(username)s', ['username']);
     pyroutes.register('my_account_profile', '/_admin/my_account/profile', []);
     pyroutes.register('my_account_edit', '/_admin/my_account/edit', []);
     pyroutes.register('my_account_update', '/_admin/my_account/update', []);
     pyroutes.register('my_account_password', '/_admin/my_account/password', []);
     pyroutes.register('my_account_password_update', '/_admin/my_account/password/update', []);
     pyroutes.register('my_account_auth_tokens', '/_admin/my_account/auth_tokens', []);
     pyroutes.register('my_account_auth_tokens_add', '/_admin/my_account/auth_tokens/new', []);
     pyroutes.register('my_account_auth_tokens_delete', '/_admin/my_account/auth_tokens/delete', []);
     pyroutes.register('my_account_ssh_keys', '/_admin/my_account/ssh_keys', []);
     pyroutes.register('my_account_ssh_keys_generate', '/_admin/my_account/ssh_keys/generate', []);
     pyroutes.register('my_account_ssh_keys_add', '/_admin/my_account/ssh_keys/new', []);
     pyroutes.register('my_account_ssh_keys_delete', '/_admin/my_account/ssh_keys/delete', []);
     pyroutes.register('my_account_emails', '/_admin/my_account/emails', []);
     pyroutes.register('my_account_emails_add', '/_admin/my_account/emails/new', []);
     pyroutes.register('my_account_emails_delete', '/_admin/my_account/emails/delete', []);
     pyroutes.register('my_account_repos', '/_admin/my_account/repos', []);
     pyroutes.register('my_account_watched', '/_admin/my_account/watched', []);
     pyroutes.register('my_account_perms', '/_admin/my_account/perms', []);
     pyroutes.register('my_account_notifications', '/_admin/my_account/notifications', []);
     pyroutes.register('my_account_notifications_toggle_visibility', '/_admin/my_account/toggle_visibility', []);
     pyroutes.register('my_account_pullrequests', '/_admin/my_account/pull_requests', []);
     pyroutes.register('my_account_pullrequests_data', '/_admin/my_account/pull_requests/data', []);
     pyroutes.register('notifications_show_all', '/_admin/notifications', []);
     pyroutes.register('notifications_mark_all_read', '/_admin/notifications/mark_all_read', []);
     pyroutes.register('notifications_show', '/_admin/notifications/%(notification_id)s', ['notification_id']);
     pyroutes.register('notifications_update', '/_admin/notifications/%(notification_id)s/update', ['notification_id']);
     pyroutes.register('notifications_delete', '/_admin/notifications/%(notification_id)s/delete', ['notification_id']);
     pyroutes.register('my_account_notifications_test_channelstream', '/_admin/my_account/test_channelstream', []);
     pyroutes.register('gists_show', '/_admin/gists', []);
     pyroutes.register('gists_new', '/_admin/gists/new', []);
     pyroutes.register('gists_create', '/_admin/gists/create', []);
     pyroutes.register('gist_show', '/_admin/gists/%(gist_id)s', ['gist_id']);
     pyroutes.register('gist_delete', '/_admin/gists/%(gist_id)s/delete', ['gist_id']);
     pyroutes.register('gist_edit', '/_admin/gists/%(gist_id)s/edit', ['gist_id']);
     pyroutes.register('gist_edit_check_revision', '/_admin/gists/%(gist_id)s/edit/check_revision', ['gist_id']);
     pyroutes.register('gist_update', '/_admin/gists/%(gist_id)s/update', ['gist_id']);
     pyroutes.register('gist_show_rev', '/_admin/gists/%(gist_id)s/%(revision)s', ['gist_id', 'revision']);
     pyroutes.register('gist_show_formatted', '/_admin/gists/%(gist_id)s/%(revision)s/%(format)s', ['gist_id', 'revision', 'format']);
     pyroutes.register('gist_show_formatted_path', '/_admin/gists/%(gist_id)s/%(revision)s/%(format)s/%(f_path)s', ['gist_id', 'revision', 'format', 'f_path']);
     pyroutes.register('debug_style_home', '/_admin/debug_style', []);
     pyroutes.register('debug_style_template', '/_admin/debug_style/t/%(t_path)s', ['t_path']);
     pyroutes.register('apiv2', '/_admin/api', []);
 }

rhodecode/templates/admin/repo_groups/repo_group_edit_perms.mako

@@ -1,148 +1,148 b''
 <%namespace name="base" file="/base/base.mako"/>
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Repository Group Permissions')}</h3>
     </div>
     <div class="panel-body">
         ${h.secure_form(h.url('edit_repo_group_perms', group_name=c.repo_group.group_name),method='put')}
         <table id="permissions_manage" class="rctable permissions">
             <tr>
                 <th class="td-radio">${_('None')}</th>
                 <th class="td-radio">${_('Read')}</th>
                 <th class="td-radio">${_('Write')}</th>
                 <th class="td-radio">${_('Admin')}</th>
                 <th class="td-user">${_('User/User Group')}</th>
                 <th></th>
             </tr>
             ## USERS
             %for _user in c.repo_group.permissions():
                 %if getattr(_user, 'admin_row', None) or getattr(_user, 'owner_row', None):
                     <tr class="perm_admin_row">
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.none', disabled="disabled")}</td>
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.read', disabled="disabled")}</td>
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.write', disabled="disabled")}</td>
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.admin', 'repository.admin', disabled="disabled")}</td>
                         <td class="td-user">
                             ${base.gravatar(_user.email, 16)}
                             <span class="user">
                                 ${h.link_to_user(_user.username)}
                                 %if getattr(_user, 'admin_row', None):
                                     (${_('super admin')})
                                 %endif
                                 %if getattr(_user, 'owner_row', None):
                                     (${_('owner')})
                                 %endif
                             </span>
                         </td>
                         <td></td>
                     </tr>
                 %else:
                     ##forbid revoking permission from yourself, except if you're an super admin
                     <tr>
                         %if c.rhodecode_user.user_id != _user.user_id or c.rhodecode_user.is_admin:
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'group.none')}</td>
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'group.read')}</td>
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'group.write')}</td>
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'group.admin')}</td>
                         <td class="td-user">
                             ${base.gravatar(_user.email, 16)}
                             <span class="user">
                                 % if _user.username == h.DEFAULT_USER:
                                     ${h.DEFAULT_USER} <span class="user-perm-help-text"> - ${_('permission for all other users')}</span>
                                 % else:
                                     ${h.link_to_user(_user.username)}
                                 % endif
                             </span>
                         </td>
                         <td class="td-action">
                             %if _user.username != h.DEFAULT_USER:
                                 <span  class="btn btn-link btn-danger revoke_perm"
                                   member="${_user.user_id}" member_type="user">
                                 <i class="icon-remove"></i> ${_('Revoke')}
                                 </span>
                             %endif
                         </td>
                         %else:
                             ## special case for current user permissions, we make sure he cannot take his own permissions
                             <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'group.none', disabled="disabled")}</td>
                             <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'group.read', disabled="disabled")}</td>
                             <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'group.write', disabled="disabled")}</td>
                             <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'group.admin', disabled="disabled")}</td>
                             <td class="td-user">
                                 ${base.gravatar(_user.email, 16)}
                                 <span class="user">
                                     % if _user.username == h.DEFAULT_USER:
                                         ${h.DEFAULT_USER} <span class="user-perm-help-text"> - ${_('permission for all other users')}</span>
                                     % else:
                                         ${h.link_to_user(_user.username)}
                                     % endif
                                     <span class="user-perm-help-text">(${_('delegated admin')})</span>
                                 </span>
                             </td>
                             <td></td>
                         %endif
                     </tr>
                 %endif
             %endfor
 
             ## USER GROUPS
             %for _user_group in c.repo_group.permission_user_groups():
                 <tr id="id${id(_user_group.users_group_name)}">
                     <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'group.none')}</td>
                     <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'group.read')}</td>
                     <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'group.write')}</td>
                     <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'group.admin')}</td>
                     <td class="td-componentname">
                         <i class="icon-group" ></i>
                         %if h.HasPermissionAny('hg.admin')():
-                         <a href="${h.url('edit_users_group',user_group_id=_user_group.users_group_id)}">
+                         <a href="${h.route_path('edit_user_group',user_group_id=_user_group.users_group_id)}">
                              ${_user_group.users_group_name}
                          </a>
                         %else:
                          ${_user_group.users_group_name}
                         %endif
                     </td>
                     <td class="td-action">
                         <span  class="btn btn-link btn-danger revoke_perm"
                               member="${_user_group.users_group_id}" member_type="user_group">
                         <i class="icon-remove"></i> ${_('Revoke')}
                         </span>
                     </td>
                 </tr>
             %endfor
 
             <tr class="new_members" id="add_perm_input"></tr>
         </table>
         <div id="add_perm" class="link">
             ${_('Add new')}
         </div>
         <div class="fields">
             <div class="field">
                <div class="label label-radio">
                    ${_('Apply to children')}:
                </div>
                <div class="radios">
                    ${h.radio('recursive', 'none', label=_('None'), checked="checked")}
                    ${h.radio('recursive', 'groups', label=_('Repository Groups'))}
                    ${h.radio('recursive', 'repos', label=_('Repositories'))}
                    ${h.radio('recursive', 'all', label=_('Both'))}
                <span class="help-block">${_('Set or revoke permissions to selected types of children of this group, including non-private repositories and other groups if chosen.')}</span>
                </div>
             </div>
         </div>
         <div class="buttons">
           ${h.submit('save',_('Save'),class_="btn btn-primary")}
           ${h.reset('reset',_('Reset'),class_="btn btn-danger")}
         </div>
         ${h.end_form()}
     </div>
 </div>
 <script type="text/javascript">
     $('#add_perm').on('click', function(e){
         addNewPermInput($(this), 'group');
     });
     $('.revoke_perm').on('click', function(e){
         markRevokePermInput($(this), 'group');
     })
 </script>

rhodecode/templates/admin/repos/repo_edit_permissions.mako

@@ -1,123 +1,123 b''
 <%namespace name="base" file="/base/base.mako"/>
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Repository Permissions')}</h3>
     </div>
     <div class="panel-body">
         ${h.secure_form(h.route_path('edit_repo_perms', repo_name=c.repo_name), method='POST', request=request)}
         <table id="permissions_manage" class="rctable permissions">
             <tr>
                 <th class="td-radio">${_('None')}</th>
                 <th class="td-radio">${_('Read')}</th>
                 <th class="td-radio">${_('Write')}</th>
                 <th class="td-radio">${_('Admin')}</th>
                 <th class="td-owner">${_('User/User Group')}</th>
                 <th></th>
             </tr>
             ## USERS
             %for _user in c.repo_info.permissions():
                 %if getattr(_user, 'admin_row', None) or getattr(_user, 'owner_row', None):
                     <tr class="perm_admin_row">
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.none', disabled="disabled")}</td>
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.read', disabled="disabled")}</td>
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.write', disabled="disabled")}</td>
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.admin', 'repository.admin', disabled="disabled")}</td>
                         <td class="td-user">
                             ${base.gravatar(_user.email, 16)}
                             ${h.link_to_user(_user.username)}
                             %if getattr(_user, 'admin_row', None):
                                 (${_('super admin')})
                             %endif
                             %if getattr(_user, 'owner_row', None):
                                 (${_('owner')})
                             %endif
                         </td>
                         <td></td>
                     </tr>
                 %elif _user.username == h.DEFAULT_USER and c.repo_info.private:
                     <tr>
                         <td colspan="4">
                             <span class="private_repo_msg">
                             <strong title="${h.tooltip(_user.permission)}">${_('private repository')}</strong>
                             </span>
                         </td>
                         <td class="private_repo_msg">
                             ${base.gravatar(h.DEFAULT_USER_EMAIL, 16)}
                             ${h.DEFAULT_USER} - ${_('only users/user groups explicitly added here will have access')}</td>
                         <td></td>
                     </tr>
                 %else:
                     <tr>
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'repository.none', checked=_user.permission=='repository.none')}</td>
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'repository.read', checked=_user.permission=='repository.read')}</td>
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'repository.write', checked=_user.permission=='repository.write')}</td>
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'repository.admin', checked=_user.permission=='repository.admin')}</td>
                         <td class="td-user">
                             ${base.gravatar(_user.email, 16)}
                             <span class="user">
                                 % if _user.username == h.DEFAULT_USER:
                                     ${h.DEFAULT_USER} <span class="user-perm-help-text"> - ${_('permission for all other users')}</span>
                                 % else:
                                     ${h.link_to_user(_user.username)}
                                 % endif
                             </span>
                         </td>
                         <td class="td-action">
                           %if _user.username != h.DEFAULT_USER:
                             <span class="btn btn-link btn-danger revoke_perm"
                                   member="${_user.user_id}" member_type="user">
                             <i class="icon-remove"></i> ${_('Revoke')}
                             </span>
                           %endif
                         </td>
                     </tr>
                 %endif
             %endfor
 
             ## USER GROUPS
             %for _user_group in c.repo_info.permission_user_groups():
                 <tr>
                     <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'repository.none', checked=_user_group.permission=='repository.none')}</td>
                     <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'repository.read', checked=_user_group.permission=='repository.read')}</td>
                     <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'repository.write', checked=_user_group.permission=='repository.write')}</td>
                     <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'repository.admin', checked=_user_group.permission=='repository.admin')}</td>
                     <td class="td-componentname">
                         <i class="icon-group" ></i>
                         %if h.HasPermissionAny('hg.admin')():
-                         <a href="${h.url('edit_users_group',user_group_id=_user_group.users_group_id)}">
+                         <a href="${h.route_path('edit_user_group',user_group_id=_user_group.users_group_id)}">
                              ${_user_group.users_group_name}
                          </a>
                         %else:
                          ${_user_group.users_group_name}
                         %endif
                     </td>
                     <td class="td-action">
                         <span class="btn btn-link btn-danger revoke_perm"
                               member="${_user_group.users_group_id}" member_type="user_group">
                         <i class="icon-remove"></i> ${_('Revoke')}
                         </span>
                     </td>
                 </tr>
             %endfor
             <tr class="new_members" id="add_perm_input"></tr>
         </table>
         <div id="add_perm" class="link">
             ${_('Add new')}
         </div>
         <div class="buttons">
           ${h.submit('save',_('Save'),class_="btn btn-primary")}
           ${h.reset('reset',_('Reset'),class_="btn btn-danger")}
         </div>
         ${h.end_form()}
     </div>
 </div>
 
 <script type="text/javascript">
     $('#add_perm').on('click', function(e){
         addNewPermInput($(this), 'repository');
     });
     $('.revoke_perm').on('click', function(e){
         markRevokePermInput($(this), 'repository');
     });
 </script>

rhodecode/templates/admin/user_groups/user_group_add.mako

@@ -1,72 +1,72 b''
 ## -*- coding: utf-8 -*-
 <%inherit file="/base/base.mako"/>
 
 <%def name="title()">
     ${_('Add user group')}
     %if c.rhodecode_name:
         &middot; ${h.branding(c.rhodecode_name)}
     %endif
 </%def>
 <%def name="breadcrumbs_links()">
     ${h.link_to(_('Admin'),h.route_path('admin_home'))}
     &raquo;
-    ${h.link_to(_('User groups'),h.url('users_groups'))}
+    ${h.link_to(_('User groups'),h.route_path('user_groups'))}
     &raquo;
     ${_('Add User Group')}
 </%def>
 
 <%def name="menu_bar_nav()">
     ${self.menu_items(active='admin')}
 </%def>
 
 <%def name="main()">
 <div class="box main-content">
     <!-- box / title -->
     <div class="title">
         ${self.breadcrumbs()}
     </div>
     <!-- end box / title -->
-    ${h.secure_form(h.url('users_groups'))}
+    ${h.secure_form(h.route_path('user_groups_create'), method='POST', request=request)}
     <div class="form">
         <!-- fields -->
         <div class="fields">
              <div class="field">
                 <div class="label">
                     <label for="users_group_name">${_('Group name')}:</label>
                 </div>
                 <div class="input">
                     ${h.text('users_group_name', class_='medium')}
                 </div>
              </div>
             <div class="field">
                 <div class="label">
                     <label for="user_group_description">${_('Description')}:</label>
                 </div>
                 <div class="textarea editor">
                     ${h.textarea('user_group_description')}
                     <span class="help-block">${_('Short, optional description for this user group.')}</span>
                 </div>
              </div>
              <div class="field">
                 <div class="label">
                     <label for="users_group_active">${_('Active')}:</label>
                 </div>
                 <div class="checkboxes">
                     ${h.checkbox('users_group_active',value=True, checked='checked')}
                 </div>
              </div>
 
             <div class="buttons">
               ${h.submit('save',_('Save'),class_="btn")}
             </div>
         </div>
     </div>
     ${h.end_form()}
 </div>
 </%def>
 
 <script>
     $(document).ready(function(){
         $('#users_group_name').focus();
     })
 </script>

rhodecode/templates/admin/user_groups/user_group_edit.mako

@@ -1,46 +1,46 b''
 ## -*- coding: utf-8 -*-
 <%inherit file="/base/base.mako"/>
 
 <%def name="title()">
     ${_('%s user group settings') % c.user_group.users_group_name}
     %if c.rhodecode_name:
         &middot; ${h.branding(c.rhodecode_name)}
     %endif
 </%def>
 
 <%def name="breadcrumbs_links()">
     ${h.link_to(_('Admin'),h.route_path('admin_home'))}
     &raquo;
-    ${h.link_to(_('User Groups'),h.url('users_groups'))}
+    ${h.link_to(_('User Groups'),h.route_path('user_groups'))}
     &raquo;
     ${c.user_group.users_group_name}
 </%def>
 
 <%def name="menu_bar_nav()">
     ${self.menu_items(active='admin')}
 </%def>
 
 <%def name="main()">
 <div class="box">
   <div class="title">
       ${self.breadcrumbs()}
   </div>
 
   ##main
   <div class="sidebar-col-wrapper">
     <div class="sidebar">
         <ul class="nav nav-pills nav-stacked">
-          <li class="${'active' if c.active=='settings' else ''}"><a href="${h.url('edit_users_group', user_group_id=c.user_group.users_group_id)}">${_('Settings')}</a></li>
-          <li class="${'active' if c.active=='perms' else ''}"><a href="${h.url('edit_user_group_perms', user_group_id=c.user_group.users_group_id)}">${_('Permissions')}</a></li>
-          <li class="${'active' if c.active=='advanced' else ''}"><a href="${h.url('edit_user_group_advanced', user_group_id=c.user_group.users_group_id)}">${_('Advanced')}</a></li>
-          <li class="${'active' if c.active=='global_perms' else ''}"><a href="${h.url('edit_user_group_global_perms', user_group_id=c.user_group.users_group_id)}">${_('Global permissions')}</a></li>
+          <li class="${'active' if c.active=='settings' else ''}"><a href="${h.route_path('edit_user_group', user_group_id=c.user_group.users_group_id)}">${_('Settings')}</a></li>
+          <li class="${'active' if c.active=='perms' else ''}"><a href="${h.route_path('edit_user_group_perms', user_group_id=c.user_group.users_group_id)}">${_('Permissions')}</a></li>
+          <li class="${'active' if c.active=='advanced' else ''}"><a href="${h.route_path('edit_user_group_advanced', user_group_id=c.user_group.users_group_id)}">${_('Advanced')}</a></li>
+          <li class="${'active' if c.active=='global_perms' else ''}"><a href="${h.route_path('edit_user_group_global_perms', user_group_id=c.user_group.users_group_id)}">${_('Global permissions')}</a></li>
           <li class="${'active' if c.active=='perms_summary' else ''}"><a href="${h.route_path('edit_user_group_perms_summary', user_group_id=c.user_group.users_group_id)}">${_('Permissions summary')}</a></li>
         </ul>
     </div>
 
     <div class="main-content-full-width">
         <%include file="/admin/user_groups/user_group_edit_${c.active}.mako"/>
     </div>
   </div>
 </div>
 </%def>

rhodecode/templates/admin/user_groups/user_group_edit_advanced.mako

@@ -1,84 +1,84 b''
 <%namespace name="base" file="/base/base.mako"/>
 
 <%
  elems = [
     (_('Owner'), lambda:base.gravatar_with_user(c.user_group.user.email), '', ''),
     (_('Created on'), h.format_date(c.user_group.created_on), '', '',),
 
     (_('Members'), len(c.group_members_obj),'', [x for x in c.group_members_obj]),
     (_('Automatic member sync'), 'Yes' if c.user_group.group_data.get('extern_type') else 'No', '', '',),
 
     (_('Assigned to repositories'), len(c.group_to_repos),'', [x for x in c.group_to_repos]),
     (_('Assigned to repo groups'), len(c.group_to_repo_groups), '', [x for x in c.group_to_repo_groups]),
 
     (_('Assigned to review rules'), len(c.group_to_review_rules), '', [x for x in c.group_to_review_rules]),
  ]
 %>
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('User Group: %s') % c.user_group.users_group_name}</h3>
     </div>
     <div class="panel-body">
         ${base.dt_info_panel(elems)}
     </div>
 
 </div>
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Group members sync')}</h3>
     </div>
     <div class="panel-body">
         <% sync_type = c.user_group.group_data.get('extern_type') %>
 
         % if sync_type:
             <p>
                 ${_('This group is set to be automatically synchronised.')}<br/>
                 ${_('This group synchronization was set by')}: <strong>${sync_type}</strong>
             </p>
         % else:
             <p>
                 ${_('This group is not set to be automatically synchronised')}
             </p>
         % endif
 
         <div>
-        ${h.secure_form(h.url('edit_user_group_advanced_sync', user_group_id=c.user_group.users_group_id), method='post')}
+        ${h.secure_form(h.route_path('edit_user_group_advanced_sync', user_group_id=c.user_group.users_group_id), method='POST', request=request)}
             <div class="field">
                 <button class="btn btn-default" type="submit">
                     %if sync_type:
                         ${_('Disable synchronization')}
                     %else:
                         ${_('Enable synchronization')}
                     %endif
                 </button>
             </div>
             <div class="field">
                 <span class="help-block">
                     ${_('Users will be added or removed from this group when they authenticate with RhodeCode system, based on LDAP group membership. '
                         'This requires `LDAP+User group` authentication plugin to be configured and enabled. (EE only feature)')}
                 </span>
             </div>
         ${h.end_form()}
         </div>
 
     </div>
 </div>
 
 
 <div class="panel panel-danger">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Delete User Group')}</h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.url('delete_users_group', user_group_id=c.user_group.users_group_id),method='delete')}
+        ${h.secure_form(h.route_path('user_groups_delete', user_group_id=c.user_group.users_group_id), method='POST', request=request)}
             ${h.hidden('force', 1)}
             <button class="btn btn-small btn-danger" type="submit"
                     onclick="return confirm('${_('Confirm to delete user group `%(ugroup)s` with all permission assignments') % {'ugroup': c.user_group.users_group_name}}');">
                 <i class="icon-remove-sign"></i>
                 ${_('Delete This User Group')}
             </button>
         ${h.end_form()}
     </div>
 </div>

rhodecode/templates/admin/user_groups/user_group_edit_global_perms.mako

@@ -1,3 +1,3 b''
 <%namespace name="dpb" file="/base/default_perms_box.mako"/>
-${dpb.default_perms_box(h.url('edit_user_group_global_perms', user_group_id=c.user_group.users_group_id))}
+${dpb.default_perms_box(form_url=h.route_path('edit_user_group_global_perms_update', user_group_id=c.user_group.users_group_id))}
 

rhodecode/templates/admin/user_groups/user_group_edit_perms.mako

@@ -1,134 +1,134 b''
 <%namespace name="base" file="/base/base.mako"/>
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('User Group Permissions')}</h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.url('edit_user_group_perms', user_group_id=c.user_group.users_group_id),method='put')}
+        ${h.secure_form(h.route_path('edit_user_group_perms_update', user_group_id=c.user_group.users_group_id), method='POST', request=request)}
         <table id="permissions_manage" class="rctable permissions">
             <tr>
                 <th class="td-radio">${_('None')}</th>
                 <th class="td-radio">${_('Read')}</th>
                 <th class="td-radio">${_('Write')}</th>
                 <th class="td-radio">${_('Admin')}</th>
                 <th>${_('User/User Group')}</th>
                 <th></th>
             </tr>
             ## USERS
             %for _user in c.user_group.permissions():
                 %if getattr(_user, 'admin_row', None) or getattr(_user, 'owner_row', None):
                     <tr class="perm_admin_row">
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.none', disabled="disabled")}</td>
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.read', disabled="disabled")}</td>
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.write', disabled="disabled")}</td>
                         <td class="td-radio">${h.radio('admin_perm_%s' % _user.user_id,'repository.admin', 'repository.admin', disabled="disabled")}</td>
                         <td class="td-user">
                             ${base.gravatar(_user.email, 16)}
                             <span class="user">
                                 ${h.link_to_user(_user.username)}
                                 %if getattr(_user, 'admin_row', None):
                                     (${_('super admin')})
                                 %endif
                                 %if getattr(_user, 'owner_row', None):
                                     (${_('owner')})
                                 %endif
                             </span>
                         </td>
                         <td></td>
                     </tr>
                 %else:
                     ##forbid revoking permission from yourself, except if you're an super admin
                     <tr>
                         %if c.rhodecode_user.user_id != _user.user_id or c.rhodecode_user.is_admin:
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'usergroup.none')}</td>
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'usergroup.read')}</td>
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'usergroup.write')}</td>
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'usergroup.admin')}</td>
                         <td class="td-user">
                             ${base.gravatar(_user.email, 16)}
                             <span class="user">
                                 % if _user.username == h.DEFAULT_USER:
                                     ${h.DEFAULT_USER} <span class="user-perm-help-text"> - ${_('permission for all other users')}</span>
                                 % else:
                                     ${h.link_to_user(_user.username)}
                                 % endif
                             </span>
                         </td>
                         <td class="td-action">
                           %if _user.username != h.DEFAULT_USER:
                             <span class="btn btn-link btn-danger revoke_perm"
                                   member="${_user.user_id}" member_type="user">
                             <i class="icon-remove"></i> ${_('revoke')}
                             </span>
                           %endif
                         </td>
                         %else:
                         ## special case for current user permissions, we make sure he cannot take his own permissions
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'usergroup.none', disabled="disabled")}</td>
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'usergroup.read', disabled="disabled")}</td>
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'usergroup.write', disabled="disabled")}</td>
                         <td class="td-radio">${h.radio('u_perm_%s' % _user.user_id,'usergroup.admin', disabled="disabled")}</td>
                         <td class="td-user">
                             ${base.gravatar(_user.email, 16)}
                             <span class="user">
                                 % if _user.username == h.DEFAULT_USER:
                                     ${h.DEFAULT_USER} <span class="user-perm-help-text"> - ${_('permission for all other users')}</span>
                                 % else:
                                     ${h.link_to_user(_user.username)}
                                 % endif
                                 <span class="user-perm-help-text">(${_('delegated admin')})</span>
                             </span>
                         </td>
                         <td></td>
                         %endif
                     </tr>
                 %endif
             %endfor
 
             ## USER GROUPS
             %for _user_group in c.user_group.permission_user_groups():
                 <tr>
                     <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'usergroup.none')}</td>
                     <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'usergroup.read')}</td>
                     <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'usergroup.write')}</td>
                     <td class="td-radio">${h.radio('g_perm_%s' % _user_group.users_group_id,'usergroup.admin')}</td>
                     <td class="td-user">
                         <i class="icon-group" ></i>
                         %if h.HasPermissionAny('hg.admin')():
-                         <a href="${h.url('edit_users_group',user_group_id=_user_group.users_group_id)}">
+                         <a href="${h.route_path('edit_user_group',user_group_id=_user_group.users_group_id)}">
                              ${_user_group.users_group_name}
                          </a>
                         %else:
                          ${_user_group.users_group_name}
                         %endif
                     </td>
                     <td class="td-action">
                         <span class="btn btn-link btn-danger revoke_perm"
                               member="${_user_group.users_group_id}" member_type="user_group">
                         <i class="icon-remove"></i> ${_('revoke')}
                         </span>
                     </td>
                 </tr>
             %endfor
             <tr class="new_members" id="add_perm_input"></tr>
         </table>
         <div id="add_perm" class="link">
             ${_('Add new')}
         </div>
         <div class="buttons">
           ${h.submit('save',_('Save'),class_="btn btn-primary")}
           ${h.reset('reset',_('Reset'),class_="btn btn-danger")}
         </div>
         ${h.end_form()}
     </div>
 </div>
 
 <script type="text/javascript">
     $('#add_perm').on('click', function(e){
         addNewPermInput($(this), 'usergroup');
     });
     $('.revoke_perm').on('click', function(e){
         markRevokePermInput($(this), 'usergroup');
     });
 </script>

rhodecode/templates/admin/user_groups/user_group_edit_settings.mako

@@ -1,186 +1,186 b''
 ## -*- coding: utf-8 -*-
 <%namespace name="base" file="/base/base.mako"/>
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('User Group: %s') % c.user_group.users_group_name}</h3>
     </div>
     <div class="panel-body">
-    ${h.secure_form(h.url('update_users_group', user_group_id=c.user_group.users_group_id),method='put', id='edit_users_group')}
+    ${h.secure_form(h.route_path('user_groups_update', user_group_id=c.user_group.users_group_id), id='edit_user_group', method='POST', request=request)}
         <div class="form">
             <!-- fields -->
                 <div class="fields">
                      <div class="field">
                         <div class="label">
                             <label for="users_group_name">${_('Group name')}:</label>
                         </div>
                         <div class="input">
                             ${h.text('users_group_name',class_='medium')}
                         </div>
                      </div>
 
                     <div class="field badged-field">
                         <div class="label">
                             <label for="user">${_('Owner')}:</label>
                         </div>
                         <div class="input">
                             <div class="badge-input-container">
                                 <div class="user-badge">
                                     ${base.gravatar_with_user(c.user_group.user.email, show_disabled=not c.user_group.user.active)}
                                 </div>
                                 <div class="badge-input-wrap">
                                     ${h.text('user', class_="medium", autocomplete="off")}
                                 </div>
                             </div>
                             <form:error name="user"/>
                             <p class="help-block">${_('Change owner of this user group.')}</p>
                         </div>
                     </div>
 
                      <div class="field">
                         <div class="label label-textarea">
                             <label for="user_group_description">${_('Description')}:</label>
                         </div>
                         <div class="textarea textarea-small editor">
                             ${h.textarea('user_group_description',cols=23,rows=5,class_="medium")}
                             <span class="help-block">${_('Short, optional description for this user group.')}</span>
                         </div>
                      </div>
                      <div class="field">
                         <div class="label label-checkbox">
                             <label for="users_group_active">${_('Active')}:</label>
                         </div>
                         <div class="checkboxes">
                             ${h.checkbox('users_group_active',value=True)}
                         </div>
                      </div>
 
                      <div class="field">
                         <div class="label label-checkbox">
                             <label for="users_group_active">${_('Add members')}:</label>
                         </div>
                         <div class="input">
                             ${h.text('user_group_add_members', placeholder="user/usergroup", class_="medium")}
                         </div>
                      </div>
 
                     <input type="hidden" name="__start__" value="user_group_members:sequence"/>
                     <table id="group_members_placeholder" class="rctable group_members">
                         <tr>
                           <th>${_('Username')}</th>
                           <th>${_('Action')}</th>
                         </tr>
 
                         % if c.group_members_obj:
                           % for user in c.group_members_obj:
                             <tr>
                               <td id="member_user_${user.user_id}" class="td-author">
                                 <div class="group_member">
                                   ${base.gravatar(user.email, 16)}
                                   <span class="username user">${h.link_to(h.person(user), h.url( 'edit_user',user_id=user.user_id))}</span>
                                   <input type="hidden" name="__start__" value="member:mapping">
                                   <input type="hidden" name="member_user_id" value="${user.user_id}">
                                   <input type="hidden" name="type" value="existing" id="member_${user.user_id}">
                                   <input type="hidden" name="__end__" value="member:mapping">
                                 </div>
                               </td>
                               <td class="">
                                 <div class="usergroup_member_remove action_button" onclick="removeUserGroupMember(${user.user_id}, true)" style="visibility: visible;">
                                     <i class="icon-remove-sign"></i>
                                 </div>
                               </td>
                             </tr>
                           % endfor
 
                         % else:
                           <tr><td colspan="2">${_('No members yet')}</td></tr>
                         % endif
                      </table>
                     <input type="hidden" name="__end__" value="user_group_members:sequence"/>
 
                      <div class="buttons">
                        ${h.submit('Save',_('Save'),class_="btn")}
                      </div>
                 </div>
         </div>
     ${h.end_form()}
     </div>
 </div>
 <script>
     $(document).ready(function(){
         $("#group_parent_id").select2({
             'containerCssClass': "drop-menu",
             'dropdownCssClass': "drop-menu-dropdown",
             'dropdownAutoWidth': true
         });
 
         removeUserGroupMember = function(userId){
             $('#member_'+userId).val('remove');
             $('#member_user_'+userId).addClass('to-delete');
         };
 
         $('#user_group_add_members').autocomplete({
             serviceUrl: pyroutes.url('user_autocomplete_data'),
             minChars:2,
             maxHeight:400,
             width:300,
             deferRequestBy: 300, //miliseconds
             showNoSuggestionNotice: true,
             params: { user_groups:true },
             formatResult: autocompleteFormatResult,
             lookupFilter: autocompleteFilterResult,
             onSelect: function(element, suggestion){
 
                 function addMember(user, fromUserGroup) {
                     var gravatar = user.icon_link;
                     var username = user.value_display;
                     var userLink = pyroutes.url('edit_user', {"user_id": user.id});
                     var uid = user.id;
 
                     if (fromUserGroup) {
                         username = username +" "+ _gettext('(from usergroup {0})'.format(fromUserGroup))
                     }
 
                     var elem = $(
                         ('<tr>'+
                           '<td id="member_user_{6}" class="td-author td-author-new-entry">'+
                             '<div class="group_member">'+
                               '<img class="gravatar" src="{0}" height="16" width="16">'+
                               '<span class="username user"><a href="{1}">{2}</a></span>'+
                               '<input type="hidden" name="__start__" value="member:mapping">'+
                               '<input type="hidden" name="member_user_id" value="{3}">'+
                               '<input type="hidden" name="type" value="new" id="member_{4}">'+
                               '<input type="hidden" name="__end__" value="member:mapping">'+
                             '</div>'+
                           '</td>'+
                           '<td class="td-author-new-entry">'+
                             '<div class="usergroup_member_remove action_button" onclick="removeUserGroupMember({5}, true)" style="visibility: visible;">'+
                                 '<i class="icon-remove-sign"></i>'+
                             '</div>'+
                           '</td>'+
                         '</tr>').format(gravatar, userLink, username,
                                 uid, uid, uid, uid)
                     );
                     $('#group_members_placeholder').append(elem)
                 }
 
                 if (suggestion.value_type == 'user_group') {
                     $.getJSON(
                         pyroutes.url('user_group_members_data',
                                     {'user_group_id': suggestion.id}),
                         function(data) {
                             $.each(data.members, function(idx, user) {
                                 addMember(user, suggestion.value)
                             });
                         }
                     );
                 } else if (suggestion.value_type == 'user') {
                     addMember(suggestion, null);
                 }
             }
         });
 
 
         UsersAutoComplete('user', '${c.rhodecode_user.user_id}');
     })
 </script>

rhodecode/templates/admin/user_groups/user_groups.mako

@@ -1,108 +1,108 b''
 ## -*- coding: utf-8 -*-
 <%inherit file="/base/base.mako"/>
 
 <%def name="title()">
     ${_('User groups administration')}
     %if c.rhodecode_name:
         &middot; ${h.branding(c.rhodecode_name)}
     %endif
 </%def>
 
 <%def name="breadcrumbs_links()">
     <input class="q_filter_box" id="q_filter" size="15" type="text" name="filter" placeholder="${_('quick filter...')}" value=""/>
     ${h.link_to(_('Admin'),h.route_path('admin_home'))} &raquo; <span id="user_group_count">0</span> ${_('user groups')}
 </%def>
 
 <%def name="menu_bar_nav()">
     ${self.menu_items(active='admin')}
 </%def>
 
 <%def name="main()">
 <div class="box">
 
     <div class="title">
         ${self.breadcrumbs()}
         <ul class="links">
         %if h.HasPermissionAny('hg.admin', 'hg.usergroup.create.true')():
           <li>
-            <a href="${h.url('new_users_group')}" class="btn btn-small btn-success">${_(u'Add User Group')}</a>
+            <a href="${h.route_path('user_groups_new')}" class="btn btn-small btn-success">${_(u'Add User Group')}</a>
           </li>
         %endif
         </ul>
     </div>
 
     <div id="repos_list_wrap">
         <table id="user_group_list_table" class="display"></table>
     </div>
 
 </div>
 <script>
 $(document).ready(function() {
     var getDatatableCount = function(){
       var table = $('#user_group_list_table').dataTable();
       var page = table.api().page.info();
       var  active = page.recordsDisplay;
       var  total = page.recordsTotal;
 
       var _text = _gettext("{0} out of {1} users").format(active, total);
       $('#user_group_count').text(_text);
     };
 
     // user list
     $('#user_group_list_table').DataTable({
       processing: true,
       serverSide: true,
       ajax: "${h.route_path('user_groups_data')}",
       dom: 'rtp',
       pageLength: ${c.visual.admin_grid_items},
       order: [[ 0, "asc" ]],
       columns: [
          { data: {"_": "users_group_name",
                   "sort": "users_group_name"}, title: "${_('Name')}", className: "td-componentname"  },
          { data: {"_": "description",
                   "sort": "description"}, title: "${_('Description')}", className: "td-description" },
          { data: {"_": "members",
                   "sort": "members"}, title: "${_('Members')}", className: "td-number" },
          { data: {"_": "sync",
                   "sort": "sync"}, title: "${_('Sync')}", className: "td-sync" },
          { data: {"_": "active",
                   "sort": "active"}, title: "${_('Active')}", className: "td-active" },
          { data: {"_": "owner",
                   "sort": "owner"}, title: "${_('Owner')}", className: "td-user" },
          { data: {"_": "action",
                   "sort": "action"}, title: "${_('Action')}", className: "td-action", orderable: false}
       ],
       language: {
           paginate: DEFAULT_GRID_PAGINATION,
           sProcessing: _gettext('loading...'),
           emptyTable: _gettext("No user groups available yet.")
       }
     });
 
     $('#user_group_list_table').on('xhr.dt', function(e, settings, json, xhr){
         $('#user_group_list_table').css('opacity', 1);
     });
 
     $('#user_group_list_table').on('preXhr.dt', function(e, settings, data){
         $('#user_group_list_table').css('opacity', 0.3);
     });
 
     // refresh counters on draw
     $('#user_group_list_table').on('draw.dt', function(){
         getDatatableCount();
     });
 
     // filter
     $('#q_filter').on('keyup',
         $.debounce(250, function() {
             $('#user_group_list_table').DataTable().search(
                 $('#q_filter').val()
             ).draw();
         })
     );
 
   });
 
 </script>
 
 </%def>

rhodecode/templates/base/base.mako

@@ -1,609 +1,609 b''
 ## -*- coding: utf-8 -*-
 <%inherit file="root.mako"/>
 
 <div class="outerwrapper">
   <!-- HEADER -->
   <div class="header">
       <div id="header-inner" class="wrapper">
           <div id="logo">
               <div class="logo-wrapper">
                   <a href="${h.route_path('home')}"><img src="${h.asset('images/rhodecode-logo-white-216x60.png')}" alt="RhodeCode"/></a>
               </div>
               %if c.rhodecode_name:
                <div class="branding">- ${h.branding(c.rhodecode_name)}</div>
               %endif
           </div>
           <!-- MENU BAR NAV -->
           ${self.menu_bar_nav()}
           <!-- END MENU BAR NAV -->
       </div>
   </div>
   ${self.menu_bar_subnav()}
   <!-- END HEADER -->
 
   <!-- CONTENT -->
   <div id="content" class="wrapper">
 
       <rhodecode-toast id="notifications"></rhodecode-toast>
 
       <div class="main">
           ${next.main()}
       </div>
   </div>
   <!-- END CONTENT -->
 
 </div>
 <!-- FOOTER -->
 <div id="footer">
    <div id="footer-inner" class="title wrapper">
        <div>
            <p class="footer-link-right">
                % if c.visual.show_version:
                    RhodeCode Enterprise ${c.rhodecode_version} ${c.rhodecode_edition}
                % endif
                &copy; 2010-${h.datetime.today().year}, <a href="${h.route_url('rhodecode_official')}" target="_blank">RhodeCode GmbH</a>. All rights reserved.
                % if c.visual.rhodecode_support_url:
                   <a href="${c.visual.rhodecode_support_url}" target="_blank">${_('Support')}</a>
                % endif
            </p>
            <% sid = 'block' if request.GET.get('showrcid') else 'none' %>
            <p class="server-instance" style="display:${sid}">
                ## display hidden instance ID if specially defined
                % if c.rhodecode_instanceid:
                    ${_('RhodeCode instance id: %s') % c.rhodecode_instanceid}
                % endif
            </p>
        </div>
    </div>
 </div>
 
 <!-- END FOOTER -->
 
 ### MAKO DEFS ###
 
 <%def name="menu_bar_subnav()">
 </%def>
 
 <%def name="breadcrumbs(class_='breadcrumbs')">
     <div class="${class_}">
     ${self.breadcrumbs_links()}
     </div>
 </%def>
 
 <%def name="admin_menu()">
   <ul class="admin_menu submenu">
       <li><a href="${h.route_path('admin_audit_logs')}">${_('Admin audit logs')}</a></li>
       <li><a href="${h.route_path('repos')}">${_('Repositories')}</a></li>
       <li><a href="${h.url('repo_groups')}">${_('Repository groups')}</a></li>
       <li><a href="${h.route_path('users')}">${_('Users')}</a></li>
-      <li><a href="${h.url('users_groups')}">${_('User groups')}</a></li>
+      <li><a href="${h.route_path('user_groups')}">${_('User groups')}</a></li>
       <li><a href="${h.route_path('admin_permissions_application')}">${_('Permissions')}</a></li>
       <li><a href="${h.route_path('auth_home', traverse='')}">${_('Authentication')}</a></li>
       <li><a href="${h.route_path('global_integrations_home')}">${_('Integrations')}</a></li>
       <li><a href="${h.url('admin_defaults_repositories')}">${_('Defaults')}</a></li>
       <li class="last"><a href="${h.url('admin_settings')}">${_('Settings')}</a></li>
   </ul>
 </%def>
 
 
 <%def name="dt_info_panel(elements)">
     <dl class="dl-horizontal">
     %for dt, dd, title, show_items in elements:
       <dt>${dt}:</dt>
       <dd title="${h.tooltip(title)}">
       %if callable(dd):
           ## allow lazy evaluation of elements
           ${dd()}
       %else:
           ${dd}
       %endif
       %if show_items:
           <span class="btn-collapse" data-toggle="item-${h.md5_safe(dt)[:6]}-details">${_('Show More')} </span>
       %endif
       </dd>
 
       %if show_items:
           <div class="collapsable-content" data-toggle="item-${h.md5_safe(dt)[:6]}-details" style="display: none">
           %for item in show_items:
               <dt></dt>
               <dd>${item}</dd>
           %endfor
           </div>
       %endif
 
     %endfor
     </dl>
 </%def>
 
 
 <%def name="gravatar(email, size=16)">
   <%
     if (size > 16):
         gravatar_class = 'gravatar gravatar-large'
     else:
         gravatar_class = 'gravatar'
   %>
   <%doc>
     TODO: johbo: For now we serve double size images to make it smooth
     for retina. This is how it worked until now. Should be replaced
     with a better solution at some point.
   </%doc>
   <img class="${gravatar_class}" src="${h.gravatar_url(email, size * 2)}" height="${size}" width="${size}">
 </%def>
 
 
 <%def name="gravatar_with_user(contact, size=16, show_disabled=False)">
   <% email = h.email_or_none(contact) %>
   <div class="rc-user tooltip" title="${h.tooltip(h.author_string(email))}">
     ${self.gravatar(email, size)}
     <span class="${'user user-disabled' if show_disabled else 'user'}"> ${h.link_to_user(contact)}</span>
   </div>
 </%def>
 
 
 ## admin menu used for people that have some admin resources
 <%def name="admin_menu_simple(repositories=None, repository_groups=None, user_groups=None)">
   <ul class="submenu">
    %if repositories:
       <li class="local-admin-repos"><a href="${h.route_path('repos')}">${_('Repositories')}</a></li>
    %endif
    %if repository_groups:
       <li class="local-admin-repo-groups"><a href="${h.url('repo_groups')}">${_('Repository groups')}</a></li>
    %endif
    %if user_groups:
-      <li class="local-admin-user-groups"><a href="${h.url('users_groups')}">${_('User groups')}</a></li>
+      <li class="local-admin-user-groups"><a href="${h.route_path('user_groups')}">${_('User groups')}</a></li>
    %endif
   </ul>
 </%def>
 
 <%def name="repo_page_title(repo_instance)">
 <div class="title-content">
     <div class="title-main">
         ## SVN/HG/GIT icons
         %if h.is_hg(repo_instance):
             <i class="icon-hg"></i>
         %endif
         %if h.is_git(repo_instance):
             <i class="icon-git"></i>
         %endif
         %if h.is_svn(repo_instance):
             <i class="icon-svn"></i>
         %endif
 
         ## public/private
         %if repo_instance.private:
             <i class="icon-repo-private"></i>
         %else:
             <i class="icon-repo-public"></i>
         %endif
 
         ## repo name with group name
         ${h.breadcrumb_repo_link(c.rhodecode_db_repo)}
 
     </div>
 
     ## FORKED
     %if repo_instance.fork:
     <p>
         <i class="icon-code-fork"></i> ${_('Fork of')}
         <a href="${h.route_path('repo_summary',repo_name=repo_instance.fork.repo_name)}">${repo_instance.fork.repo_name}</a>
     </p>
     %endif
 
     ## IMPORTED FROM REMOTE
     %if repo_instance.clone_uri:
     <p>
        <i class="icon-code-fork"></i> ${_('Clone from')}
        <a href="${h.url(h.safe_str(h.hide_credentials(repo_instance.clone_uri)))}">${h.hide_credentials(repo_instance.clone_uri)}</a>
     </p>
     %endif
 
     ## LOCKING STATUS
      %if repo_instance.locked[0]:
        <p class="locking_locked">
            <i class="icon-repo-lock"></i>
            ${_('Repository locked by %(user)s') % {'user': h.person_by_id(repo_instance.locked[0])}}
        </p>
      %elif repo_instance.enable_locking:
          <p class="locking_unlocked">
              <i class="icon-repo-unlock"></i>
              ${_('Repository not locked. Pull repository to lock it.')}
          </p>
      %endif
 
 </div>
 </%def>
 
 <%def name="repo_menu(active=None)">
     <%
     def is_active(selected):
         if selected == active:
             return "active"
     %>
 
   <!--- CONTEXT BAR -->
   <div id="context-bar">
     <div class="wrapper">
       <ul id="context-pages" class="horizontal-list navigation">
         <li class="${is_active('summary')}"><a class="menulink" href="${h.route_path('repo_summary', repo_name=c.repo_name)}"><div class="menulabel">${_('Summary')}</div></a></li>
         <li class="${is_active('changelog')}"><a class="menulink" href="${h.route_path('repo_changelog', repo_name=c.repo_name)}"><div class="menulabel">${_('Changelog')}</div></a></li>
         <li class="${is_active('files')}"><a class="menulink" href="${h.route_path('repo_files', repo_name=c.repo_name, commit_id=c.rhodecode_db_repo.landing_rev[1], f_path='')}"><div class="menulabel">${_('Files')}</div></a></li>
         <li class="${is_active('compare')}"><a class="menulink" href="${h.route_path('repo_compare_select',repo_name=c.repo_name)}"><div class="menulabel">${_('Compare')}</div></a></li>
         ## TODO: anderson: ideally it would have a function on the scm_instance "enable_pullrequest() and enable_fork()"
         %if c.rhodecode_db_repo.repo_type in ['git','hg']:
           <li class="${is_active('showpullrequest')}">
             <a class="menulink" href="${h.route_path('pullrequest_show_all', repo_name=c.repo_name)}" title="${h.tooltip(_('Show Pull Requests for %s') % c.repo_name)}">
               %if c.repository_pull_requests:
                 <span class="pr_notifications">${c.repository_pull_requests}</span>
               %endif
               <div class="menulabel">${_('Pull Requests')}</div>
             </a>
           </li>
         %endif
         <li class="${is_active('options')}">
           <a class="menulink dropdown">
               <div class="menulabel">${_('Options')} <div class="show_more"></div></div>
           </a>
           <ul class="submenu">
              %if h.HasRepoPermissionAll('repository.admin')(c.repo_name):
                    <li><a href="${h.route_path('edit_repo',repo_name=c.repo_name)}">${_('Settings')}</a></li>
              %endif
               %if c.rhodecode_db_repo.fork:
                <li>
                    <a title="${h.tooltip(_('Compare fork with %s' % c.rhodecode_db_repo.fork.repo_name))}"
                       href="${h.route_path('repo_compare',
                             repo_name=c.rhodecode_db_repo.fork.repo_name,
                             source_ref_type=c.rhodecode_db_repo.landing_rev[0],
                             source_ref=c.rhodecode_db_repo.landing_rev[1],
                             target_repo=c.repo_name,target_ref_type='branch' if request.GET.get('branch') else c.rhodecode_db_repo.landing_rev[0],
                             target_ref=request.GET.get('branch') or c.rhodecode_db_repo.landing_rev[1],
                             _query=dict(merge=1))}"
                     >
                    ${_('Compare fork')}
                    </a>
                </li>
               %endif
 
               <li><a href="${h.route_path('search_repo',repo_name=c.repo_name)}">${_('Search')}</a></li>
 
               %if h.HasRepoPermissionAny('repository.write','repository.admin')(c.repo_name) and c.rhodecode_db_repo.enable_locking:
                 %if c.rhodecode_db_repo.locked[0]:
                   <li><a class="locking_del" href="${h.route_path('repo_edit_toggle_locking',repo_name=c.repo_name)}">${_('Unlock')}</a></li>
                 %else:
                   <li><a class="locking_add" href="${h.route_path('repo_edit_toggle_locking',repo_name=c.repo_name)}">${_('Lock')}</a></li>
                 %endif
               %endif
               %if c.rhodecode_user.username != h.DEFAULT_USER:
                 %if c.rhodecode_db_repo.repo_type in ['git','hg']:
                   <li><a href="${h.route_path('repo_fork_new',repo_name=c.repo_name)}">${_('Fork')}</a></li>
                   <li><a href="${h.route_path('pullrequest_new',repo_name=c.repo_name)}">${_('Create Pull Request')}</a></li>
                 %endif
               %endif
              </ul>
         </li>
       </ul>
     </div>
     <div class="clear"></div>
   </div>
   <!--- END CONTEXT BAR -->
 
 </%def>
 
 <%def name="usermenu(active=False)">
     ## USER MENU
     <li id="quick_login_li" class="${'active' if active else ''}">
       <a id="quick_login_link" class="menulink childs">
         ${gravatar(c.rhodecode_user.email, 20)}
         <span class="user">
           %if c.rhodecode_user.username != h.DEFAULT_USER:
             <span class="menu_link_user">${c.rhodecode_user.username}</span><div class="show_more"></div>
           %else:
             <span>${_('Sign in')}</span>
           %endif
         </span>
       </a>
 
   <div class="user-menu submenu">
       <div id="quick_login">
         %if c.rhodecode_user.username == h.DEFAULT_USER:
             <h4>${_('Sign in to your account')}</h4>
             ${h.form(h.route_path('login', _query={'came_from': h.url.current()}), needs_csrf_token=False)}
             <div class="form form-vertical">
                 <div class="fields">
                     <div class="field">
                         <div class="label">
                             <label for="username">${_('Username')}:</label>
                         </div>
                         <div class="input">
                             ${h.text('username',class_='focus',tabindex=1)}
                         </div>
 
                     </div>
                     <div class="field">
                         <div class="label">
                             <label for="password">${_('Password')}:</label>
                             %if h.HasPermissionAny('hg.password_reset.enabled')():
                               <span class="forgot_password">${h.link_to(_('(Forgot password?)'),h.route_path('reset_password'), class_='pwd_reset')}</span>
                             %endif
                         </div>
                         <div class="input">
                             ${h.password('password',class_='focus',tabindex=2)}
                         </div>
                     </div>
                     <div class="buttons">
                         <div class="register">
                         %if h.HasPermissionAny('hg.admin', 'hg.register.auto_activate', 'hg.register.manual_activate')():
                          ${h.link_to(_("Don't have an account?"),h.route_path('register'))} <br/>
                         %endif
                         ${h.link_to(_("Using external auth? Sign In here."),h.route_path('login'))}
                         </div>
                         <div class="submit">
                             ${h.submit('sign_in',_('Sign In'),class_="btn btn-small",tabindex=3)}
                         </div>
                     </div>
                 </div>
             </div>
             ${h.end_form()}
         %else:
             <div class="">
                 <div class="big_gravatar">${gravatar(c.rhodecode_user.email, 48)}</div>
                 <div class="full_name">${c.rhodecode_user.full_name_or_username}</div>
                 <div class="email">${c.rhodecode_user.email}</div>
             </div>
             <div class="">
             <ol class="links">
               <li>${h.link_to(_(u'My account'),h.route_path('my_account_profile'))}</li>
               % if c.rhodecode_user.personal_repo_group:
                 <li>${h.link_to(_(u'My personal group'), h.route_path('repo_group_home', repo_group_name=c.rhodecode_user.personal_repo_group.group_name))}</li>
               % endif
               <li class="logout">
               ${h.secure_form(h.route_path('logout'), request=request)}
                   ${h.submit('log_out', _(u'Sign Out'),class_="btn btn-primary")}
               ${h.end_form()}
               </li>
             </ol>
             </div>
         %endif
       </div>
   </div>
       %if c.rhodecode_user.username != h.DEFAULT_USER:
         <div class="pill_container">
           <a class="menu_link_notifications ${'empty' if c.unread_notifications == 0 else ''}" href="${h.route_path('notifications_show_all')}">${c.unread_notifications}</a>
         </div>
       % endif
     </li>
 </%def>
 
 <%def name="menu_items(active=None)">
     <%
     def is_active(selected):
         if selected == active:
             return "active"
         return ""
     %>
     <ul id="quick" class="main_nav navigation horizontal-list">
       <!-- repo switcher -->
       <li class="${is_active('repositories')} repo_switcher_li has_select2">
         <input id="repo_switcher" name="repo_switcher" type="hidden">
       </li>
 
       ## ROOT MENU
       %if c.rhodecode_user.username != h.DEFAULT_USER:
         <li class="${is_active('journal')}">
           <a class="menulink" title="${_('Show activity journal')}" href="${h.route_path('journal')}">
             <div class="menulabel">${_('Journal')}</div>
           </a>
         </li>
       %else:
         <li class="${is_active('journal')}">
           <a class="menulink" title="${_('Show Public activity journal')}" href="${h.route_path('journal_public')}">
             <div class="menulabel">${_('Public journal')}</div>
           </a>
         </li>
       %endif
         <li class="${is_active('gists')}">
           <a class="menulink childs" title="${_('Show Gists')}" href="${h.route_path('gists_show')}">
             <div class="menulabel">${_('Gists')}</div>
           </a>
         </li>
       <li class="${is_active('search')}">
           <a class="menulink" title="${_('Search in repositories you have access to')}" href="${h.route_path('search')}">
             <div class="menulabel">${_('Search')}</div>
           </a>
       </li>
       % if h.HasPermissionAll('hg.admin')('access admin main page'):
         <li class="${is_active('admin')}">
           <a class="menulink childs" title="${_('Admin settings')}" href="#" onclick="return false;">
             <div class="menulabel">${_('Admin')} <div class="show_more"></div></div>
           </a>
           ${admin_menu()}
         </li>
       % elif c.rhodecode_user.repositories_admin or c.rhodecode_user.repository_groups_admin or c.rhodecode_user.user_groups_admin:
       <li class="${is_active('admin')}">
           <a class="menulink childs" title="${_('Delegated Admin settings')}">
             <div class="menulabel">${_('Admin')} <div class="show_more"></div></div>
           </a>
           ${admin_menu_simple(c.rhodecode_user.repositories_admin,
                               c.rhodecode_user.repository_groups_admin,
                               c.rhodecode_user.user_groups_admin or h.HasPermissionAny('hg.usergroup.create.true')())}
       </li>
       % endif
       % if c.debug_style:
       <li class="${is_active('debug_style')}">
           <a class="menulink" title="${_('Style')}" href="${h.route_path('debug_style_home')}">
             <div class="menulabel">${_('Style')}</div>
           </a>
       </li>
       % endif
       ## render extra user menu
       ${usermenu(active=(active=='my_account'))}
     </ul>
 
     <script type="text/javascript">
         var visual_show_public_icon = "${c.visual.show_public_icon}" == "True";
 
         /*format the look of items in the list*/
         var format = function(state, escapeMarkup){
             if (!state.id){
               return state.text; // optgroup
             }
             var obj_dict = state.obj;
             var tmpl = '';
 
             if(obj_dict && state.type == 'repo'){
                 if(obj_dict['repo_type'] === 'hg'){
                     tmpl += '<i class="icon-hg"></i> ';
                 }
                 else if(obj_dict['repo_type'] === 'git'){
                     tmpl += '<i class="icon-git"></i> ';
                 }
                 else if(obj_dict['repo_type'] === 'svn'){
                     tmpl += '<i class="icon-svn"></i> ';
                 }
                 if(obj_dict['private']){
                     tmpl += '<i class="icon-lock" ></i> ';
                 }
                 else if(visual_show_public_icon){
                     tmpl += '<i class="icon-unlock-alt"></i> ';
                 }
             }
             if(obj_dict && state.type == 'commit') {
                 tmpl += '<i class="icon-tag"></i>';
             }
             if(obj_dict && state.type == 'group'){
                 tmpl += '<i class="icon-folder-close"></i> ';
             }
             tmpl += escapeMarkup(state.text);
             return tmpl;
         };
 
         var formatResult = function(result, container, query, escapeMarkup) {
             return format(result, escapeMarkup);
         };
 
         var formatSelection = function(data, container, escapeMarkup) {
             return format(data, escapeMarkup);
         };
 
         $("#repo_switcher").select2({
             cachedDataSource: {},
             minimumInputLength: 2,
             placeholder: '<div class="menulabel">${_('Go to')} <div class="show_more"></div></div>',
             dropdownAutoWidth: true,
             formatResult: formatResult,
             formatSelection: formatSelection,
             containerCssClass: "repo-switcher",
             dropdownCssClass: "repo-switcher-dropdown",
             escapeMarkup: function(m){
                 // don't escape our custom placeholder
                 if(m.substr(0,23) == '<div class="menulabel">'){
                     return m;
                 }
 
                 return Select2.util.escapeMarkup(m);
             },
             query: $.debounce(250, function(query){
                 self = this;
                 var cacheKey = query.term;
                 var cachedData = self.cachedDataSource[cacheKey];
 
                 if (cachedData) {
                     query.callback({results: cachedData.results});
                 } else {
                     $.ajax({
                         url: pyroutes.url('goto_switcher_data'),
                         data: {'query': query.term},
                         dataType: 'json',
                         type: 'GET',
                         success: function(data) {
                             self.cachedDataSource[cacheKey] = data;
                             query.callback({results: data.results});
                         },
                         error: function(data, textStatus, errorThrown) {
                             alert("Error while fetching entries.\nError code {0} ({1}).".format(data.status, data.statusText));
                         }
                     })
                 }
             })
         });
 
         $("#repo_switcher").on('select2-selecting', function(e){
             e.preventDefault();
             window.location = e.choice.url;
         });
 
     </script>
     <script src="${h.asset('js/rhodecode/base/keyboard-bindings.js', ver=c.rhodecode_version_hash)}"></script>
 </%def>
 
 <div class="modal" id="help_kb" tabindex="-1" role="dialog" aria-labelledby="myModalLabel" aria-hidden="true">
     <div class="modal-dialog">
       <div class="modal-content">
         <div class="modal-header">
           <button type="button" class="close" data-dismiss="modal" aria-hidden="true">&times;</button>
           <h4 class="modal-title" id="myModalLabel">${_('Keyboard shortcuts')}</h4>
         </div>
         <div class="modal-body">
               <div class="block-left">
                 <table class="keyboard-mappings">
                     <tbody>
                   <tr>
                     <th></th>
                     <th>${_('Site-wide shortcuts')}</th>
                   </tr>
                   <%
                      elems = [
                          ('/', 'Open quick search box'),
                          ('g h', 'Goto home page'),
                          ('g g', 'Goto my private gists page'),
                          ('g G', 'Goto my public gists page'),
                          ('n r', 'New repository page'),
                          ('n g', 'New gist page'),
                      ]
                   %>
                   %for key, desc in elems:
                   <tr>
                     <td class="keys">
                       <span class="key tag">${key}</span>
                     </td>
                     <td>${desc}</td>
                   </tr>
                 %endfor
                 </tbody>
                   </table>
               </div>
               <div class="block-left">
                 <table class="keyboard-mappings">
                 <tbody>
                   <tr>
                     <th></th>
                     <th>${_('Repositories')}</th>
                   </tr>
                   <%
                      elems = [
                          ('g s', 'Goto summary page'),
                          ('g c', 'Goto changelog page'),
                          ('g f', 'Goto files page'),
                          ('g F', 'Goto files page with file search activated'),
                          ('g p', 'Goto pull requests page'),
                          ('g o', 'Goto repository settings'),
                          ('g O', 'Goto repository permissions settings'),
                      ]
                   %>
                   %for key, desc in elems:
                   <tr>
                     <td class="keys">
                       <span class="key tag">${key}</span>
                     </td>
                     <td>${desc}</td>
                   </tr>
                 %endfor
                 </tbody>
               </table>
             </div>
         </div>
         <div class="modal-footer">
         </div>
       </div><!-- /.modal-content -->
     </div><!-- /.modal-dialog -->
 </div><!-- /.modal -->

rhodecode/templates/base/default_perms_box.mako

@@ -1,156 +1,156 b''
 ## snippet for displaying default permission box
 ## usage:
 ##    <%namespace name="dpb" file="/base/default_perms_box.mako"/>
 ##    ${dpb.default_perms_box(<url_to_form>)}
 ##    ${dpb.default_perms_radios()}
 
 <%def name="default_perms_radios(global_permissions_template = False, suffix='', **kwargs)">
 <div class="main-content-full-width">
   <div class="panel panel-default">
 
     ## displayed according to checkbox selection
     <div class="panel-heading">
       %if not global_permissions_template:
         <h3 class="inherit_overlay_default panel-title">${_('Inherited Permissions')}</h3>
         <h3 class="inherit_overlay panel-title">${_('Custom Permissions')}</h3>
       %else:
         <h3 class="panel-title">${_('Default Global Permissions')}</h3>
       %endif
     </div>
 
     <div class="panel-body">
       %if global_permissions_template:
         <p>${_('The following options configure the default permissions each user or group will inherit. You can override these permissions for each individual user or user group using individual permissions settings.')}</p>
       %endif
         <div class="field">
            <div class="label">
                <label for="default_repo_create${suffix}">${_('Repository Creation')}:</label>
            </div>
            <div class="radios">
                ${h.radio('default_repo_create' + suffix, c.repo_create_choices[1][0], label=c.repo_create_choices[1][1], **kwargs)}
                ${h.radio('default_repo_create' + suffix, c.repo_create_choices[0][0], label=c.repo_create_choices[0][1], **kwargs)}
                <span class="help-block">${_('Permission to create root level repositories. When disabled, users can still create repositories inside their own repository groups.')}</span>
            </div>
         </div>
         <div class="field">
            <div class="label">
                <label for="default_repo_create_on_write${suffix}">${_('Repository Creation With Group Write Access')}:</label>
            </div>
            <div class="radios">
                ${h.radio('default_repo_create_on_write' + suffix, c.repo_create_on_write_choices[1][0], label=c.repo_create_on_write_choices[1][1], **kwargs)}
                ${h.radio('default_repo_create_on_write' + suffix, c.repo_create_on_write_choices[0][0], label=c.repo_create_on_write_choices[0][1], **kwargs)}
                <span class="help-block">${_('Write permission given on a repository group will allow creating repositories inside that group.')}</span>
            </div>
         </div>
         <div class="field">
            <div class="label">
                <label for="default_fork_create${suffix}">${_('Repository Forking')}:</label>
            </div>
            <div class="radios">
                ${h.radio('default_fork_create' + suffix, c.fork_choices[1][0], label=c.fork_choices[1][1], **kwargs)}
                ${h.radio('default_fork_create' + suffix, c.fork_choices[0][0], label=c.fork_choices[0][1], **kwargs)}
                <span class="help-block">${_('Permission to create root level repository forks. When disabled, users can still fork repositories inside their own repository groups.')}</span>
            </div>
         </div>
         <div class="field">
            <div class="label">
                <label for="default_repo_group_create${suffix}">${_('Repository Group Creation')}:</label>
            </div>
            <div class="radios">
                ${h.radio('default_repo_group_create' + suffix, c.repo_group_create_choices[1][0], label=c.repo_group_create_choices[1][1], **kwargs)}
                ${h.radio('default_repo_group_create' + suffix, c.repo_group_create_choices[0][0], label=c.repo_group_create_choices[0][1], **kwargs)}
                <span class="help-block">${_('Permission to create root level repository groups. When disabled, repository group admins can still create repository subgroups within their repository groups.')}</span>
            </div>
         </div>
         <div class="field">
            <div class="label">
                <label for="default_user_group_create${suffix}">${_('User Group Creation')}:</label>
            </div>
            <div class="radios">
                ${h.radio('default_user_group_create' + suffix, c.user_group_create_choices[1][0], label=c.user_group_create_choices[1][1], **kwargs)}
                ${h.radio('default_user_group_create' + suffix, c.user_group_create_choices[0][0], label=c.user_group_create_choices[0][1], **kwargs)}
                <span class="help-block">${_('Permission to allow user group creation.')}</span>
            </div>
         </div>
 
         <div class="field">
            <div class="label">
                <label for="default_inherit_default_permissions${suffix}">${_('Inherit Permissions From The Default User')}:</label>
            </div>
            <div class="radios">
                ${h.radio('default_inherit_default_permissions' + suffix, c.inherit_default_permission_choices[1][0], label=c.inherit_default_permission_choices[1][1], **kwargs)}
                ${h.radio('default_inherit_default_permissions' + suffix, c.inherit_default_permission_choices[0][0], label=c.inherit_default_permission_choices[0][1], **kwargs)}
                <span class="help-block">${_('Inherit default permissions from the default user. Turn off this option to force explicit permissions for users, even if they are more restrictive than the default user permissions.')}</span>
            </div>
         </div>
 
         <div class="buttons">
          ${h.submit('save',_('Save'),class_="btn")}
          ${h.reset('reset',_('Reset'),class_="btn")}
         </div>
     </div>
   </div>
 </div>
 </%def>
 
 <%def name="default_perms_box(form_url)">
-  ${h.secure_form(form_url, method='put')}
+  ${h.secure_form(form_url, method='POST', request=request)}
     <div class="form">
       <div class="fields">
         <div class="field panel panel-default panel-body">
           <div class="label label-checkbox">
               <label for="inherit_default_permissions">${_('Inherit from default settings')}:</label>
           </div>
           <div class="checkboxes">
               ${h.checkbox('inherit_default_permissions',value=True)}
               <span class="help-block">
               ${h.literal(_('Select to inherit permissions from %s permissions settings, '
                             'including default IP address whitelist and inheritance of \npermission by members of user groups.')
                           % h.link_to('default user', h.route_path('admin_permissions_global')))}
               </span>
           </div>
         </div>
   
         ## INHERITED permissions == the user permissions in admin
         ## if inherit checkbox is set this is displayed in non-edit mode
         <div class="inherit_overlay_default">
             ${default_perms_radios(global_permissions_template = False, suffix='_inherited', disabled="disabled")}
         </div>
   
         ## CUSTOM permissions
         <div class="inherit_overlay">
             ${default_perms_radios(global_permissions_template = False)}
         </div>
       </div>
     </div>
   ${h.end_form()}
 
         
 ## JS
 <script>
 var show_custom_perms = function(inherit_default){
     if(inherit_default) {
         $('.inherit_overlay_default').show();
         $('.inherit_overlay').hide();
     }
     else {
         $('.inherit_overlay').show();
         $('.inherit_overlay_default').hide();
     }
 };
 $(document).ready(function(e){
     var inherit_checkbox = $('#inherit_default_permissions');
     var defaults = inherit_checkbox.prop('checked');
     show_custom_perms(defaults);
     inherit_checkbox.on('change', function(){
         if($(this).prop('checked')){
            show_custom_perms(true);
         }
         else{
            show_custom_perms(false);
         }
     })
 })
 </script>
 
 </%def>

rhodecode/templates/base/perms_summary.mako

@@ -1,268 +1,268 b''
 ## snippet for displaying permissions overview for users
 ## usage:
 ##    <%namespace name="p" file="/base/perms_summary.mako"/>
 ##    ${p.perms_summary(c.perm_user.permissions)}
 
 <%def name="perms_summary(permissions, show_all=False, actions=True, side_link=None)">
 <div id="perms" class="table fields">
   %for section in sorted(permissions.keys()):
   <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${section.replace("_"," ").capitalize()}</h3>
         % if side_link:
             <div class="pull-right">
                 <a href="${side_link}">${_('in JSON format')}</a>
             </div>
         % endif
     </div>
     <div class="panel-body">
       <div class="perms_section_head field">
         <div class="radios">
           %if section != 'global':
               <span class="permissions_boxes">
               <span class="desc">${_('show')}: </span>
               ${h.checkbox('perms_filter_none_%s' % section, 'none', 'checked', class_='perm_filter filter_%s' % section, section=section, perm_type='none')}   <label for="${'perms_filter_none_%s' % section}"><span class="perm_tag none">${_('none')}</span></label>
               ${h.checkbox('perms_filter_read_%s' % section, 'read', 'checked', class_='perm_filter filter_%s' % section, section=section, perm_type='read')}   <label for="${'perms_filter_read_%s' % section}"><span class="perm_tag read">${_('read')}</span></label>
               ${h.checkbox('perms_filter_write_%s' % section, 'write', 'checked', class_='perm_filter filter_%s' % section, section=section, perm_type='write')} <label for="${'perms_filter_write_%s' % section}"> <span class="perm_tag write">${_('write')}</span></label>
               ${h.checkbox('perms_filter_admin_%s' % section, 'admin', 'checked', class_='perm_filter filter_%s' % section, section=section, perm_type='admin')} <label for="${'perms_filter_admin_%s' % section}"><span class="perm_tag admin">${_('admin')}</span></label>
               </span>
           %endif
         </div>
       </div>
       <div class="field">
         %if not permissions[section]:
             <p class="empty_data help-block">${_('No permissions defined')}</p>
         %else:
         <div id='tbl_list_wrap_${section}'>
          <table id="tbl_list_${section}" class="rctable">
           ## global permission box
           %if section == 'global':
             <thead>
                 <tr>
                 <th colspan="2" class="left">${_('Permission')}</th>
                 %if actions:
                 <th colspan="2">${_('Edit Permission')}</th>
                 %endif
             </thead>
             <tbody>
 
             <%
               def get_section_perms(prefix, opts):
                   _selected = []
                   for op in opts:
                       if op.startswith(prefix) and not op.startswith('hg.create.write_on_repogroup'):
                           _selected.append(op)
                   admin = 'hg.admin' in opts
                   _selected_vals = [x.partition(prefix)[-1] for x in _selected]
                   return admin, _selected_vals, _selected
             %>
 
             <%def name="glob(lbl, val, val_lbl=None, edit_url=None, edit_global_url=None)">
               <tr>
                 <td class="td-tags">
                     ${lbl}
                 </td>
                 <td class="td-tags">
                     %if val[0]:
                       %if not val_lbl:
                           ## super admin case
                           True
                       %else:
                           <span class="perm_tag admin">${val_lbl}.admin</span>
                       %endif
                     %else:
                       %if not val_lbl:
                           ${
                              {'false': False,
                              'true': True,
                              'none': False,
                              'repository': True}.get(val[1][0] if 0 < len(val[1]) else 'false')
                           }
                       %else:
                           <span class="perm_tag ${val[1][0]}">${val_lbl}.${val[1][0]}</span>
                       %endif
                     %endif
                 </td>
                 %if actions:
 
                     % if edit_url or edit_global_url:
 
                         <td class="td-action">
                             % if edit_url:
                             <a href="${edit_url}">${_('edit')}</a>
                             % else:
                                 -
                             % endif
                         </td>
 
                         <td class="td-action">
                             % if edit_global_url:
                             <a href="${edit_global_url}">${_('edit global')}</a>
                             % else:
                                 -
                             % endif
                         </td>
 
                     % else:
                         <td class="td-action"></td>
                         <td class="td-action">
                             <a href="${h.route_path('admin_permissions_global')}">${_('edit global')}</a>
                         <td class="td-action">
                     % endif
 
                 %endif
               </tr>
             </%def>
 
            ${glob(_('Repository default permission'), get_section_perms('repository.', permissions[section]), 'repository',
                 edit_url=None, edit_global_url=h.route_path('admin_permissions_object'))}
 
            ${glob(_('Repository group default permission'), get_section_perms('group.', permissions[section]), 'group',
                 edit_url=None, edit_global_url=h.route_path('admin_permissions_object'))}
 
            ${glob(_('User group default permission'), get_section_perms('usergroup.', permissions[section]), 'usergroup',
                 edit_url=None, edit_global_url=h.route_path('admin_permissions_object'))}
 
            ${glob(_('Super admin'), get_section_perms('hg.admin', permissions[section]),
                 edit_url=h.url('edit_user', user_id=c.user.user_id, anchor='admin'), edit_global_url=None)}
 
            ${glob(_('Inherit permissions'), get_section_perms('hg.inherit_default_perms.', permissions[section]),
                 edit_url=h.url('edit_user_global_perms', user_id=c.user.user_id), edit_global_url=None)}
 
            ${glob(_('Create repositories'), get_section_perms('hg.create.', permissions[section]),
                 edit_url=h.url('edit_user_global_perms', user_id=c.user.user_id), edit_global_url=h.route_path('admin_permissions_object'))}
 
            ${glob(_('Fork repositories'), get_section_perms('hg.fork.', permissions[section]),
                 edit_url=h.url('edit_user_global_perms', user_id=c.user.user_id), edit_global_url=h.route_path('admin_permissions_object'))}
 
            ${glob(_('Create repository groups'), get_section_perms('hg.repogroup.create.', permissions[section]),
                 edit_url=h.url('edit_user_global_perms', user_id=c.user.user_id), edit_global_url=h.route_path('admin_permissions_object'))}
 
            ${glob(_('Create user groups'), get_section_perms('hg.usergroup.create.', permissions[section]),
                 edit_url=h.url('edit_user_global_perms', user_id=c.user.user_id), edit_global_url=h.route_path('admin_permissions_object'))}
 
            </tbody>
           %else:
            ## none/read/write/admin permissions on groups/repos etc
             <thead>
                 <tr>
                 <th>${_('Name')}</th>
                 <th>${_('Permission')}</th>
                 %if actions:
                 <th>${_('Edit Permission')}</th>
                 %endif
             </thead>
             <tbody class="section_${section}">
             <%
                 def sorter(permissions):
                     def custom_sorter(item):
                        ## read/write/admin
                        section = item[1].split('.')[-1]
                        section_importance = {'none': u'0',
                                              'read': u'1',
                                              'write':u'2',
                                              'admin':u'3'}.get(section)
                        ## sort by group importance+name
                        return section_importance+item[0]
                     return sorted(permissions, key=custom_sorter)
             %>
             %for k, section_perm in sorter(permissions[section].items()):
                 %if section_perm.split('.')[-1] != 'none' or show_all:
                 <tr class="perm_row ${'%s_%s' % (section, section_perm.split('.')[-1])}">
                     <td class="td-name">
                         %if section == 'repositories':
                             <a href="${h.route_path('repo_summary',repo_name=k)}">${k}</a>
                         %elif section == 'repositories_groups':
                             <a href="${h.route_path('repo_group_home', repo_group_name=k)}">${k}</a>
                         %elif section == 'user_groups':
-                            ##<a href="${h.url('edit_users_group',user_group_id=k)}">${k}</a>
+                            ##<a href="${h.route_path('edit_user_group',user_group_id=k)}">${k}</a>
                             ${k}
                         %endif
                     </td>
                     <td class="td-tags">
                       %if hasattr(permissions[section], 'perm_origin_stack'):
                          <div>
                          %for i, (perm, origin) in enumerate(reversed(permissions[section].perm_origin_stack[k])):
 
                          % if i > 0:
                              <div style="color: #979797">
                              <i class="icon-arrow_up"></i>
                                  ${_('overridden by')}
                              <i class="icon-arrow_up"></i>
                              </div>
                          % endif
 
                          <div>
                              <span class="${i > 0 and 'perm_overriden' or ''} perm_tag ${perm.split('.')[-1]}">
                               ${perm} (${origin})
                              </span>
                          </div>
 
                          %endfor
                          </div>
                       %else:
                          <span class="perm_tag ${section_perm.split('.')[-1]}">${section_perm}</span>
                       %endif
                     </td>
                     %if actions:
                     <td class="td-action">
                         %if section == 'repositories':
                             <a href="${h.route_path('edit_repo_perms',repo_name=k,_anchor='permissions_manage')}">${_('edit')}</a>
                         %elif section == 'repositories_groups':
                             <a href="${h.url('edit_repo_group_perms',group_name=k,anchor='permissions_manage')}">${_('edit')}</a>
                         %elif section == 'user_groups':
-                            ##<a href="${h.url('edit_users_group',user_group_id=k)}">${_('edit')}</a>
+                            ##<a href="${h.route_path('edit_user_group',user_group_id=k)}">${_('edit')}</a>
                         %endif
                     </td>
                     %endif
                 </tr>
                 %endif
             %endfor
 
             <tr id="empty_${section}" class="noborder" style="display:none;">
               <td colspan="6">${_('No permission defined')}</td>
             </tr>
 
             </tbody>
           %endif
          </table>
         </div>
         %endif
       </div>
     </div>
   </div>
   %endfor
 </div>
 
 <script>
     $(document).ready(function(){
         var show_empty = function(section){
             var visible = $('.section_{0} tr.perm_row:visible'.format(section)).length;
             if(visible == 0){
                 $('#empty_{0}'.format(section)).show();
             }
             else{
                 $('#empty_{0}'.format(section)).hide();
             }
         };
         $('.perm_filter').on('change', function(e){
             var self = this;
             var section = $(this).attr('section');
 
             var opts = {};
             var elems = $('.filter_' + section).each(function(el){
                 var perm_type = $(this).attr('perm_type');
                 var checked = this.checked;
                 opts[perm_type] = checked;
                 if(checked){
                     $('.'+section+'_'+perm_type).show();
                 }
                 else{
                     $('.'+section+'_'+perm_type).hide();
                 }
             });
             show_empty(section);
         })
     })
 </script>
 </%def>