permissions: allow users to update settings for repository groups they still own, or have admin perms, when they don't change their name.

- this before gave no-permission errors as the parent group access was checked
- since the group parent permission should be checked at creation, or name change this commit fixes such case

rhodecode/api/tests/test_create_repo_group.py

@@ -233,8 +233,8 b' class TestCreateRepoGroup(object):'
 
         expected = {
             'repo_group':
-                'Parent repository group `{}` does not exist'.format(
-                    repo_group_name)}
+                u"You do not have the permissions to store "
+                u"repository groups inside repository group `{}`".format(repo_group_name)}
         try:
             assert_error(id_, expected, given=response.body)
         finally:

rhodecode/model/validation_schema/schemas/repo_group_schema.py

@@ -53,7 +53,8 b' def deferred_can_write_to_group_validato'
             # permissions denied we expose as not existing, to prevent
             # resource discovery
             'permission_denied_parent_group':
-                _(u"Parent repository group `{}` does not exist"),
+                _(u"You do not have the permissions to store "
+                  u"repository groups inside repository group `{}`"),
             'permission_denied_root':
                 _(u"You do not have the permission to store "
                   u"repository groups in the root location.")
@@ -100,9 +101,15 b' def deferred_can_write_to_group_validato'
         # we want to allow this...
         forbidden = not (group_admin or (group_write and create_on_write and 0))
 
+        old_name = old_values.get('group_name')
+        if old_name and old_name == old_values.get('submitted_repo_group_name'):
+            # we're editing a repository group, we didn't change the name
+            # we skip the check for write into parent group now
+            # this allows changing settings for this repo group
+            return
+
         if parent_group and forbidden:
-            msg = messages['permission_denied_parent_group'].format(
-                parent_group_name)
+            msg = messages['permission_denied_parent_group'].format(parent_group_name)
             raise colander.Invalid(node, msg)
 
     return can_write_group_validator
@@ -248,6 +255,9 b' class RepoGroupSchema(colander.Schema):'
         validated_name = appstruct['repo_group_name']
 
         # second pass to validate permissions to repo_group
+        if 'old_values' in self.bindings:
+            # save current repo name for name change checks
+            self.bindings['old_values']['submitted_repo_group_name'] = validated_name
         second = RepoGroupAccessSchema().bind(**self.bindings)
         appstruct_second = second.deserialize({'repo_group': validated_name})
         # save result
@@ -286,6 +296,9 b' class RepoGroupSettingsSchema(RepoGroupS'
             validated_name = separator.join([group.group_name, validated_name])
 
         # second pass to validate permissions to repo_group
+        if 'old_values' in self.bindings:
+            # save current repo name for name change checks
+            self.bindings['old_values']['submitted_repo_group_name'] = validated_name
         second = RepoGroupAccessSchema().bind(**self.bindings)
         appstruct_second = second.deserialize({'repo_group': validated_name})
         # save result