integrations: refactor/cleanup + features, fixes #4181

* added scopes on integrations, scopes are:
    - repo only
    - repogroup children only
    - root repos only
    - global (any repo)
* integrations schemas now have separate section for the
  settings (eg. slack) and options (eg. scope/enabled)
* added descriptions to integration types
* added icons to integration types
* added 'create new' integration page
* added scope of integration to integrations list
* added breadcrumbs for each repo/repogroup/global integrations pages
* added sorting to integrations list
* added pagination to integrations list
* added icons to integrations list
* added type filter to integrations list
* added message to integrations list if none we found
* added extra permissions check on integrations views
* db migration from 56 => 57 - adds child_repos_only field
* added tests for integrations triggered on events
* added tests for integrations schemas
* added tests for integrations views for repo/repogroup/admin

rhodecode/lib/dbmigrate/schema/db_4_4_0_1.py

@@ -0,0 +1,3529 b''
+# -*- coding: utf-8 -*-
+
+# Copyright (C) 2010-2016  RhodeCode GmbH
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License, version 3
+# (only), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+# This program is dual-licensed. If you wish to learn more about the
+# RhodeCode Enterprise Edition, including its added features, Support services,
+# and proprietary license terms, please see https://rhodecode.com/licenses/
+
+"""
+Database Models for RhodeCode Enterprise
+"""
+
+import os
+import sys
+import time
+import hashlib
+import logging
+import datetime
+import warnings
+import ipaddress
+import functools
+import traceback
+import collections
+
+
+from sqlalchemy import *
+from sqlalchemy.exc import IntegrityError
+from sqlalchemy.ext.declarative import declared_attr
+from sqlalchemy.ext.hybrid import hybrid_property
+from sqlalchemy.orm import (
+    relationship, joinedload, class_mapper, validates, aliased)
+from sqlalchemy.sql.expression import true
+from beaker.cache import cache_region, region_invalidate
+from webob.exc import HTTPNotFound
+from zope.cachedescriptors.property import Lazy as LazyProperty
+
+from pylons import url
+from pylons.i18n.translation import lazy_ugettext as _
+
+from rhodecode.lib.vcs import get_backend, get_vcs_instance
+from rhodecode.lib.vcs.utils.helpers import get_scm
+from rhodecode.lib.vcs.exceptions import VCSError
+from rhodecode.lib.vcs.backends.base import (
+    EmptyCommit, Reference, MergeFailureReason)
+from rhodecode.lib.utils2 import (
+    str2bool, safe_str, get_commit_safe, safe_unicode, remove_prefix, md5_safe,
+    time_to_datetime, aslist, Optional, safe_int, get_clone_url, AttributeDict)
+from rhodecode.lib.jsonalchemy import MutationObj, JsonType, JSONDict
+from rhodecode.lib.ext_json import json
+from rhodecode.lib.caching_query import FromCache
+from rhodecode.lib.encrypt import AESCipher
+
+from rhodecode.model.meta import Base, Session
+
+URL_SEP = '/'
+log = logging.getLogger(__name__)
+
+# =============================================================================
+# BASE CLASSES
+# =============================================================================
+
+# this is propagated from .ini file rhodecode.encrypted_values.secret or
+# beaker.session.secret if first is not set.
+# and initialized at environment.py
+ENCRYPTION_KEY = None
+
+# used to sort permissions by types, '#' used here is not allowed to be in
+# usernames, and it's very early in sorted string.printable table.
+PERMISSION_TYPE_SORT = {
+    'admin': '####',
+    'write': '###',
+    'read':  '##',
+    'none':  '#',
+}
+
+
+def display_sort(obj):
+    """
+    Sort function used to sort permissions in .permissions() function of
+    Repository, RepoGroup, UserGroup. Also it put the default user in front
+    of all other resources
+    """
+
+    if obj.username == User.DEFAULT_USER:
+        return '#####'
+    prefix = PERMISSION_TYPE_SORT.get(obj.permission.split('.')[-1], '')
+    return prefix + obj.username
+
+
+def _hash_key(k):
+    return md5_safe(k)
+
+
+class EncryptedTextValue(TypeDecorator):
+    """
+    Special column for encrypted long text data, use like::
+
+        value = Column("encrypted_value", EncryptedValue(), nullable=False)
+
+    This column is intelligent so if value is in unencrypted form it return
+    unencrypted form, but on save it always encrypts
+    """
+    impl = Text
+
+    def process_bind_param(self, value, dialect):
+        if not value:
+            return value
+        if value.startswith('enc$aes$') or value.startswith('enc$aes_hmac$'):
+            # protect against double encrypting if someone manually starts
+            # doing
+            raise ValueError('value needs to be in unencrypted format, ie. '
+                             'not starting with enc$aes')
+        return 'enc$aes_hmac$%s' % AESCipher(
+            ENCRYPTION_KEY, hmac=True).encrypt(value)
+
+    def process_result_value(self, value, dialect):
+        import rhodecode
+
+        if not value:
+            return value
+
+        parts = value.split('$', 3)
+        if not len(parts) == 3:
+            # probably not encrypted values
+            return value
+        else:
+            if parts[0] != 'enc':
+                # parts ok but without our header ?
+                return value
+            enc_strict_mode = str2bool(rhodecode.CONFIG.get(
+                'rhodecode.encrypted_values.strict') or True)
+            # at that stage we know it's our encryption
+            if parts[1] == 'aes':
+                decrypted_data = AESCipher(ENCRYPTION_KEY).decrypt(parts[2])
+            elif parts[1] == 'aes_hmac':
+                decrypted_data = AESCipher(
+                    ENCRYPTION_KEY, hmac=True,
+                    strict_verification=enc_strict_mode).decrypt(parts[2])
+            else:
+                raise ValueError(
+                    'Encryption type part is wrong, must be `aes` '
+                    'or `aes_hmac`, got `%s` instead' % (parts[1]))
+            return decrypted_data
+
+
+class BaseModel(object):
+    """
+    Base Model for all classes
+    """
+
+    @classmethod
+    def _get_keys(cls):
+        """return column names for this model """
+        return class_mapper(cls).c.keys()
+
+    def get_dict(self):
+        """
+        return dict with keys and values corresponding
+        to this model data """
+
+        d = {}
+        for k in self._get_keys():
+            d[k] = getattr(self, k)
+
+        # also use __json__() if present to get additional fields
+        _json_attr = getattr(self, '__json__', None)
+        if _json_attr:
+            # update with attributes from __json__
+            if callable(_json_attr):
+                _json_attr = _json_attr()
+            for k, val in _json_attr.iteritems():
+                d[k] = val
+        return d
+
+    def get_appstruct(self):
+        """return list with keys and values tuples corresponding
+        to this model data """
+
+        l = []
+        for k in self._get_keys():
+            l.append((k, getattr(self, k),))
+        return l
+
+    def populate_obj(self, populate_dict):
+        """populate model with data from given populate_dict"""
+
+        for k in self._get_keys():
+            if k in populate_dict:
+                setattr(self, k, populate_dict[k])
+
+    @classmethod
+    def query(cls):
+        return Session().query(cls)
+
+    @classmethod
+    def get(cls, id_):
+        if id_:
+            return cls.query().get(id_)
+
+    @classmethod
+    def get_or_404(cls, id_):
+        try:
+            id_ = int(id_)
+        except (TypeError, ValueError):
+            raise HTTPNotFound
+
+        res = cls.query().get(id_)
+        if not res:
+            raise HTTPNotFound
+        return res
+
+    @classmethod
+    def getAll(cls):
+        # deprecated and left for backward compatibility
+        return cls.get_all()
+
+    @classmethod
+    def get_all(cls):
+        return cls.query().all()
+
+    @classmethod
+    def delete(cls, id_):
+        obj = cls.query().get(id_)
+        Session().delete(obj)
+
+    @classmethod
+    def identity_cache(cls, session, attr_name, value):
+        exist_in_session = []
+        for (item_cls, pkey), instance in session.identity_map.items():
+            if cls == item_cls and getattr(instance, attr_name) == value:
+                exist_in_session.append(instance)
+        if exist_in_session:
+            if len(exist_in_session) == 1:
+                return exist_in_session[0]
+            log.exception(
+                'multiple objects with attr %s and '
+                'value %s found with same name: %r',
+                attr_name, value, exist_in_session)
+
+    def __repr__(self):
+        if hasattr(self, '__unicode__'):
+            # python repr needs to return str
+            try:
+                return safe_str(self.__unicode__())
+            except UnicodeDecodeError:
+                pass
+        return '<DB:%s>' % (self.__class__.__name__)
+
+
+class RhodeCodeSetting(Base, BaseModel):
+    __tablename__ = 'rhodecode_settings'
+    __table_args__ = (
+        UniqueConstraint('app_settings_name'),
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
+    )
+
+    SETTINGS_TYPES = {
+        'str': safe_str,
+        'int': safe_int,
+        'unicode': safe_unicode,
+        'bool': str2bool,
+        'list': functools.partial(aslist, sep=',')
+    }
+    DEFAULT_UPDATE_URL = 'https://rhodecode.com/api/v1/info/versions'
+    GLOBAL_CONF_KEY = 'app_settings'
+
+    app_settings_id = Column("app_settings_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
+    app_settings_name = Column("app_settings_name", String(255), nullable=True, unique=None, default=None)
+    _app_settings_value = Column("app_settings_value", String(4096), nullable=True, unique=None, default=None)
+    _app_settings_type = Column("app_settings_type", String(255), nullable=True, unique=None, default=None)
+
+    def __init__(self, key='', val='', type='unicode'):
+        self.app_settings_name = key
+        self.app_settings_type = type
+        self.app_settings_value = val
+
+    @validates('_app_settings_value')
+    def validate_settings_value(self, key, val):
+        assert type(val) == unicode
+        return val
+
+    @hybrid_property
+    def app_settings_value(self):
+        v = self._app_settings_value
+        _type = self.app_settings_type
+        if _type:
+            _type = self.app_settings_type.split('.')[0]
+            # decode the encrypted value
+            if 'encrypted' in self.app_settings_type:
+                cipher = EncryptedTextValue()
+                v = safe_unicode(cipher.process_result_value(v, None))
+
+        converter = self.SETTINGS_TYPES.get(_type) or \
+            self.SETTINGS_TYPES['unicode']
+        return converter(v)
+
+    @app_settings_value.setter
+    def app_settings_value(self, val):
+        """
+        Setter that will always make sure we use unicode in app_settings_value
+
+        :param val:
+        """
+        val = safe_unicode(val)
+        # encode the encrypted value
+        if 'encrypted' in self.app_settings_type:
+            cipher = EncryptedTextValue()
+            val = safe_unicode(cipher.process_bind_param(val, None))
+        self._app_settings_value = val
+
+    @hybrid_property
+    def app_settings_type(self):
+        return self._app_settings_type
+
+    @app_settings_type.setter
+    def app_settings_type(self, val):
+        if val.split('.')[0] not in self.SETTINGS_TYPES:
+            raise Exception('type must be one of %s got %s'
+                            % (self.SETTINGS_TYPES.keys(), val))
+        self._app_settings_type = val
+
+    def __unicode__(self):
+        return u"<%s('%s:%s[%s]')>" % (
+            self.__class__.__name__,
+            self.app_settings_name, self.app_settings_value,
+            self.app_settings_type
+        )
+
+
+class RhodeCodeUi(Base, BaseModel):
+    __tablename__ = 'rhodecode_ui'
+    __table_args__ = (
+        UniqueConstraint('ui_key'),
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
+    )
+
+    HOOK_REPO_SIZE = 'changegroup.repo_size'
+    # HG
+    HOOK_PRE_PULL = 'preoutgoing.pre_pull'
+    HOOK_PULL = 'outgoing.pull_logger'
+    HOOK_PRE_PUSH = 'prechangegroup.pre_push'
+    HOOK_PUSH = 'changegroup.push_logger'
+
+    # TODO: johbo: Unify way how hooks are configured for git and hg,
+    # git part is currently hardcoded.
+
+    # SVN PATTERNS
+    SVN_BRANCH_ID = 'vcs_svn_branch'
+    SVN_TAG_ID = 'vcs_svn_tag'
+
+    ui_id = Column(
+        "ui_id", Integer(), nullable=False, unique=True, default=None,
+        primary_key=True)
+    ui_section = Column(
+        "ui_section", String(255), nullable=True, unique=None, default=None)
+    ui_key = Column(
+        "ui_key", String(255), nullable=True, unique=None, default=None)
+    ui_value = Column(
+        "ui_value", String(255), nullable=True, unique=None, default=None)
+    ui_active = Column(
+        "ui_active", Boolean(), nullable=True, unique=None, default=True)
+
+    def __repr__(self):
+        return '<%s[%s]%s=>%s]>' % (self.__class__.__name__, self.ui_section,
+                                    self.ui_key, self.ui_value)
+
+
+class RepoRhodeCodeSetting(Base, BaseModel):
+    __tablename__ = 'repo_rhodecode_settings'
+    __table_args__ = (
+        UniqueConstraint(
+            'app_settings_name', 'repository_id',
+            name='uq_repo_rhodecode_setting_name_repo_id'),
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
+    )
+
+    repository_id = Column(
+        "repository_id", Integer(), ForeignKey('repositories.repo_id'),
+        nullable=False)
+    app_settings_id = Column(
+        "app_settings_id", Integer(), nullable=False, unique=True,
+        default=None, primary_key=True)
+    app_settings_name = Column(
+        "app_settings_name", String(255), nullable=True, unique=None,
+        default=None)
+    _app_settings_value = Column(
+        "app_settings_value", String(4096), nullable=True, unique=None,
+        default=None)
+    _app_settings_type = Column(
+        "app_settings_type", String(255), nullable=True, unique=None,
+        default=None)
+
+    repository = relationship('Repository')
+
+    def __init__(self, repository_id, key='', val='', type='unicode'):
+        self.repository_id = repository_id
+        self.app_settings_name = key
+        self.app_settings_type = type
+        self.app_settings_value = val
+
+    @validates('_app_settings_value')
+    def validate_settings_value(self, key, val):
+        assert type(val) == unicode
+        return val
+
+    @hybrid_property
+    def app_settings_value(self):
+        v = self._app_settings_value
+        type_ = self.app_settings_type
+        SETTINGS_TYPES = RhodeCodeSetting.SETTINGS_TYPES
+        converter = SETTINGS_TYPES.get(type_) or SETTINGS_TYPES['unicode']
+        return converter(v)
+
+    @app_settings_value.setter
+    def app_settings_value(self, val):
+        """
+        Setter that will always make sure we use unicode in app_settings_value
+
+        :param val:
+        """
+        self._app_settings_value = safe_unicode(val)
+
+    @hybrid_property
+    def app_settings_type(self):
+        return self._app_settings_type
+
+    @app_settings_type.setter
+    def app_settings_type(self, val):
+        SETTINGS_TYPES = RhodeCodeSetting.SETTINGS_TYPES
+        if val not in SETTINGS_TYPES:
+            raise Exception('type must be one of %s got %s'
+                            % (SETTINGS_TYPES.keys(), val))
+        self._app_settings_type = val
+
+    def __unicode__(self):
+        return u"<%s('%s:%s:%s[%s]')>" % (
+            self.__class__.__name__, self.repository.repo_name,
+            self.app_settings_name, self.app_settings_value,
+            self.app_settings_type
+        )
+
+
+class RepoRhodeCodeUi(Base, BaseModel):
+    __tablename__ = 'repo_rhodecode_ui'
+    __table_args__ = (
+        UniqueConstraint(
+            'repository_id', 'ui_section', 'ui_key',
+            name='uq_repo_rhodecode_ui_repository_id_section_key'),
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
+    )
+
+    repository_id = Column(
+        "repository_id", Integer(), ForeignKey('repositories.repo_id'),
+        nullable=False)
+    ui_id = Column(
+        "ui_id", Integer(), nullable=False, unique=True, default=None,
+        primary_key=True)
+    ui_section = Column(
+        "ui_section", String(255), nullable=True, unique=None, default=None)
+    ui_key = Column(
+        "ui_key", String(255), nullable=True, unique=None, default=None)
+    ui_value = Column(
+        "ui_value", String(255), nullable=True, unique=None, default=None)
+    ui_active = Column(
+        "ui_active", Boolean(), nullable=True, unique=None, default=True)
+
+    repository = relationship('Repository')
+
+    def __repr__(self):
+        return '<%s[%s:%s]%s=>%s]>' % (
+            self.__class__.__name__, self.repository.repo_name,
+            self.ui_section, self.ui_key, self.ui_value)
+
+
+class User(Base, BaseModel):
+    __tablename__ = 'users'
+    __table_args__ = (
+        UniqueConstraint('username'), UniqueConstraint('email'),
+        Index('u_username_idx', 'username'),
+        Index('u_email_idx', 'email'),
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
+    )
+    DEFAULT_USER = 'default'
+    DEFAULT_USER_EMAIL = '[e-mail]'
+    DEFAULT_GRAVATAR_URL = 'https://secure.gravatar.com/avatar/{md5email}?d=identicon&s={size}'
+
+    user_id = Column("user_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
+    username = Column("username", String(255), nullable=True, unique=None, default=None)
+    password = Column("password", String(255), nullable=True, unique=None, default=None)
+    active = Column("active", Boolean(), nullable=True, unique=None, default=True)
+    admin = Column("admin", Boolean(), nullable=True, unique=None, default=False)
+    name = Column("firstname", String(255), nullable=True, unique=None, default=None)
+    lastname = Column("lastname", String(255), nullable=True, unique=None, default=None)
+    _email = Column("email", String(255), nullable=True, unique=None, default=None)
+    last_login = Column("last_login", DateTime(timezone=False), nullable=True, unique=None, default=None)
+    extern_type = Column("extern_type", String(255), nullable=True, unique=None, default=None)
+    extern_name = Column("extern_name", String(255), nullable=True, unique=None, default=None)
+    api_key = Column("api_key", String(255), nullable=True, unique=None, default=None)
+    inherit_default_permissions = Column("inherit_default_permissions", Boolean(), nullable=False, unique=None, default=True)
+    created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
+    _user_data = Column("user_data", LargeBinary(), nullable=True)  # JSON data
+
+    user_log = relationship('UserLog')
+    user_perms = relationship('UserToPerm', primaryjoin="User.user_id==UserToPerm.user_id", cascade='all')
+
+    repositories = relationship('Repository')
+    repository_groups = relationship('RepoGroup')
+    user_groups = relationship('UserGroup')
+
+    user_followers = relationship('UserFollowing', primaryjoin='UserFollowing.follows_user_id==User.user_id', cascade='all')
+    followings = relationship('UserFollowing', primaryjoin='UserFollowing.user_id==User.user_id', cascade='all')
+
+    repo_to_perm = relationship('UserRepoToPerm', primaryjoin='UserRepoToPerm.user_id==User.user_id', cascade='all')
+    repo_group_to_perm = relationship('UserRepoGroupToPerm', primaryjoin='UserRepoGroupToPerm.user_id==User.user_id', cascade='all')
+    user_group_to_perm = relationship('UserUserGroupToPerm', primaryjoin='UserUserGroupToPerm.user_id==User.user_id', cascade='all')
+
+    group_member = relationship('UserGroupMember', cascade='all')
+
+    notifications = relationship('UserNotification', cascade='all')
+    # notifications assigned to this user
+    user_created_notifications = relationship('Notification', cascade='all')
+    # comments created by this user
+    user_comments = relationship('ChangesetComment', cascade='all')
+    # user profile extra info
+    user_emails = relationship('UserEmailMap', cascade='all')
+    user_ip_map = relationship('UserIpMap', cascade='all')
+    user_auth_tokens = relationship('UserApiKeys', cascade='all')
+    # gists
+    user_gists = relationship('Gist', cascade='all')
+    # user pull requests
+    user_pull_requests = relationship('PullRequest', cascade='all')
+    # external identities
+    extenal_identities = relationship(
+        'ExternalIdentity',
+        primaryjoin="User.user_id==ExternalIdentity.local_user_id",
+        cascade='all')
+
+    def __unicode__(self):
+        return u"<%s('id:%s:%s')>" % (self.__class__.__name__,
+                                      self.user_id, self.username)
+
+    @hybrid_property
+    def email(self):
+        return self._email
+
+    @email.setter
+    def email(self, val):
+        self._email = val.lower() if val else None
+
+    @property
+    def firstname(self):
+        # alias for future
+        return self.name
+
+    @property
+    def emails(self):
+        other = UserEmailMap.query().filter(UserEmailMap.user==self).all()
+        return [self.email] + [x.email for x in other]
+
+    @property
+    def auth_tokens(self):
+        return [self.api_key] + [x.api_key for x in self.extra_auth_tokens]
+
+    @property
+    def extra_auth_tokens(self):
+        return UserApiKeys.query().filter(UserApiKeys.user == self).all()
+
+    @property
+    def feed_token(self):
+        feed_tokens = UserApiKeys.query()\
+            .filter(UserApiKeys.user == self)\
+            .filter(UserApiKeys.role == UserApiKeys.ROLE_FEED)\
+            .all()
+        if feed_tokens:
+            return feed_tokens[0].api_key
+        else:
+            # use the main token so we don't end up with nothing...
+            return self.api_key
+
+    @classmethod
+    def extra_valid_auth_tokens(cls, user, role=None):
+        tokens = UserApiKeys.query().filter(UserApiKeys.user == user)\
+                .filter(or_(UserApiKeys.expires == -1,
+                            UserApiKeys.expires >= time.time()))
+        if role:
+            tokens = tokens.filter(or_(UserApiKeys.role == role,
+                                       UserApiKeys.role == UserApiKeys.ROLE_ALL))
+        return tokens.all()
+
+    @property
+    def ip_addresses(self):
+        ret = UserIpMap.query().filter(UserIpMap.user == self).all()
+        return [x.ip_addr for x in ret]
+
+    @property
+    def username_and_name(self):
+        return '%s (%s %s)' % (self.username, self.firstname, self.lastname)
+
+    @property
+    def username_or_name_or_email(self):
+        full_name = self.full_name if self.full_name is not ' ' else None
+        return self.username or full_name or self.email
+
+    @property
+    def full_name(self):
+        return '%s %s' % (self.firstname, self.lastname)
+
+    @property
+    def full_name_or_username(self):
+        return ('%s %s' % (self.firstname, self.lastname)
+                if (self.firstname and self.lastname) else self.username)
+
+    @property
+    def full_contact(self):
+        return '%s %s <%s>' % (self.firstname, self.lastname, self.email)
+
+    @property
+    def short_contact(self):
+        return '%s %s' % (self.firstname, self.lastname)
+
+    @property
+    def is_admin(self):
+        return self.admin
+
+    @property
+    def AuthUser(self):
+        """
+        Returns instance of AuthUser for this user
+        """
+        from rhodecode.lib.auth import AuthUser
+        return AuthUser(user_id=self.user_id, api_key=self.api_key,
+                        username=self.username)
+
+    @hybrid_property
+    def user_data(self):
+        if not self._user_data:
+            return {}
+
+        try:
+            return json.loads(self._user_data)
+        except TypeError:
+            return {}
+
+    @user_data.setter
+    def user_data(self, val):
+        if not isinstance(val, dict):
+            raise Exception('user_data must be dict, got %s' % type(val))
+        try:
+            self._user_data = json.dumps(val)
+        except Exception:
+            log.error(traceback.format_exc())
+
+    @classmethod
+    def get_by_username(cls, username, case_insensitive=False,
+                        cache=False, identity_cache=False):
+        session = Session()
+
+        if case_insensitive:
+            q = cls.query().filter(
+                func.lower(cls.username) == func.lower(username))
+        else:
+            q = cls.query().filter(cls.username == username)
+
+        if cache:
+            if identity_cache:
+                val = cls.identity_cache(session, 'username', username)
+                if val:
+                    return val
+            else:
+                q = q.options(
+                    FromCache("sql_cache_short",
+                              "get_user_by_name_%s" % _hash_key(username)))
+
+        return q.scalar()
+
+    @classmethod
+    def get_by_auth_token(cls, auth_token, cache=False, fallback=True):
+        q = cls.query().filter(cls.api_key == auth_token)
+
+        if cache:
+            q = q.options(FromCache("sql_cache_short",
+                                    "get_auth_token_%s" % auth_token))
+        res = q.scalar()
+
+        if fallback and not res:
+            #fallback to additional keys
+            _res = UserApiKeys.query()\
+                .filter(UserApiKeys.api_key == auth_token)\
+                .filter(or_(UserApiKeys.expires == -1,
+                            UserApiKeys.expires >= time.time()))\
+                .first()
+            if _res:
+                res = _res.user
+        return res
+
+    @classmethod
+    def get_by_email(cls, email, case_insensitive=False, cache=False):
+
+        if case_insensitive:
+            q = cls.query().filter(func.lower(cls.email) == func.lower(email))
+
+        else:
+            q = cls.query().filter(cls.email == email)
+
+        if cache:
+            q = q.options(FromCache("sql_cache_short",
+                                    "get_email_key_%s" % _hash_key(email)))
+
+        ret = q.scalar()
+        if ret is None:
+            q = UserEmailMap.query()
+            # try fetching in alternate email map
+            if case_insensitive:
+                q = q.filter(func.lower(UserEmailMap.email) == func.lower(email))
+            else:
+                q = q.filter(UserEmailMap.email == email)
+            q = q.options(joinedload(UserEmailMap.user))
+            if cache:
+                q = q.options(FromCache("sql_cache_short",
+                                        "get_email_map_key_%s" % email))
+            ret = getattr(q.scalar(), 'user', None)
+
+        return ret
+
+    @classmethod
+    def get_from_cs_author(cls, author):
+        """
+        Tries to get User objects out of commit author string
+
+        :param author:
+        """
+        from rhodecode.lib.helpers import email, author_name
+        # Valid email in the attribute passed, see if they're in the system
+        _email = email(author)
+        if _email:
+            user = cls.get_by_email(_email, case_insensitive=True)
+            if user:
+                return user
+        # Maybe we can match by username?
+        _author = author_name(author)
+        user = cls.get_by_username(_author, case_insensitive=True)
+        if user:
+            return user
+
+    def update_userdata(self, **kwargs):
+        usr = self
+        old = usr.user_data
+        old.update(**kwargs)
+        usr.user_data = old
+        Session().add(usr)
+        log.debug('updated userdata with ', kwargs)
+
+    def update_lastlogin(self):
+        """Update user lastlogin"""
+        self.last_login = datetime.datetime.now()
+        Session().add(self)
+        log.debug('updated user %s lastlogin', self.username)
+
+    def update_lastactivity(self):
+        """Update user lastactivity"""
+        usr = self
+        old = usr.user_data
+        old.update({'last_activity': time.time()})
+        usr.user_data = old
+        Session().add(usr)
+        log.debug('updated user %s lastactivity', usr.username)
+
+    def update_password(self, new_password, change_api_key=False):
+        from rhodecode.lib.auth import get_crypt_password,generate_auth_token
+
+        self.password = get_crypt_password(new_password)
+        if change_api_key:
+            self.api_key = generate_auth_token(self.username)
+        Session().add(self)
+
+    @classmethod
+    def get_first_super_admin(cls):
+        user = User.query().filter(User.admin == true()).first()
+        if user is None:
+            raise Exception('FATAL: Missing administrative account!')
+        return user
+
+    @classmethod
+    def get_all_super_admins(cls):
+        """
+        Returns all admin accounts sorted by username
+        """
+        return User.query().filter(User.admin == true())\
+            .order_by(User.username.asc()).all()
+
+    @classmethod
+    def get_default_user(cls, cache=False):
+        user = User.get_by_username(User.DEFAULT_USER, cache=cache)
+        if user is None:
+            raise Exception('FATAL: Missing default account!')
+        return user
+
+    def _get_default_perms(self, user, suffix=''):
+        from rhodecode.model.permission import PermissionModel
+        return PermissionModel().get_default_perms(user.user_perms, suffix)
+
+    def get_default_perms(self, suffix=''):
+        return self._get_default_perms(self, suffix)
+
+    def get_api_data(self, include_secrets=False, details='full'):
+        """
+        Common function for generating user related data for API
+
+        :param include_secrets: By default secrets in the API data will be replaced
+           by a placeholder value to prevent exposing this data by accident. In case
+           this data shall be exposed, set this flag to ``True``.
+
+        :param details: details can be 'basic|full' basic gives only a subset of
+           the available user information that includes user_id, name and emails.
+        """
+        user = self
+        user_data = self.user_data
+        data = {
+            'user_id': user.user_id,
+            'username': user.username,
+            'firstname': user.name,
+            'lastname': user.lastname,
+            'email': user.email,
+            'emails': user.emails,
+        }
+        if details == 'basic':
+            return data
+
+        api_key_length = 40
+        api_key_replacement = '*' * api_key_length
+
+        extras = {
+            'api_key': api_key_replacement,
+            'api_keys': [api_key_replacement],
+            'active': user.active,
+            'admin': user.admin,
+            'extern_type': user.extern_type,
+            'extern_name': user.extern_name,
+            'last_login': user.last_login,
+            'ip_addresses': user.ip_addresses,
+            'language': user_data.get('language')
+        }
+        data.update(extras)
+
+        if include_secrets:
+            data['api_key'] = user.api_key
+            data['api_keys'] = user.auth_tokens
+        return data
+
+    def __json__(self):
+        data = {
+            'full_name': self.full_name,
+            'full_name_or_username': self.full_name_or_username,
+            'short_contact': self.short_contact,
+            'full_contact': self.full_contact,
+        }
+        data.update(self.get_api_data())
+        return data
+
+
+class UserApiKeys(Base, BaseModel):
+    __tablename__ = 'user_api_keys'
+    __table_args__ = (
+        Index('uak_api_key_idx', 'api_key'),
+        Index('uak_api_key_expires_idx', 'api_key', 'expires'),
+        UniqueConstraint('api_key'),
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
+    )
+    __mapper_args__ = {}
+
+    # ApiKey role
+    ROLE_ALL = 'token_role_all'
+    ROLE_HTTP = 'token_role_http'
+    ROLE_VCS = 'token_role_vcs'
+    ROLE_API = 'token_role_api'
+    ROLE_FEED = 'token_role_feed'
+    ROLES = [ROLE_ALL, ROLE_HTTP, ROLE_VCS, ROLE_API, ROLE_FEED]
+
+    user_api_key_id = Column("user_api_key_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
+    user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=True, unique=None, default=None)
+    api_key = Column("api_key", String(255), nullable=False, unique=True)
+    description = Column('description', UnicodeText().with_variant(UnicodeText(1024), 'mysql'))
+    expires = Column('expires', Float(53), nullable=False)
+    role = Column('role', String(255), nullable=True)
+    created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
+
+    user = relationship('User', lazy='joined')
+
+    @classmethod
+    def _get_role_name(cls, role):
+        return {
+            cls.ROLE_ALL: _('all'),
+            cls.ROLE_HTTP: _('http/web interface'),
+            cls.ROLE_VCS: _('vcs (git/hg/svn protocol)'),
+            cls.ROLE_API: _('api calls'),
+            cls.ROLE_FEED: _('feed access'),
+        }.get(role, role)
+
+    @property
+    def expired(self):
+        if self.expires == -1:
+            return False
+        return time.time() > self.expires
+
+    @property
+    def role_humanized(self):
+        return self._get_role_name(self.role)
+
+
+class UserEmailMap(Base, BaseModel):
+    __tablename__ = 'user_email_map'
+    __table_args__ = (
+        Index('uem_email_idx', 'email'),
+        UniqueConstraint('email'),
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
+    )
+    __mapper_args__ = {}
+
+    email_id = Column("email_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
+    user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=True, unique=None, default=None)
+    _email = Column("email", String(255), nullable=True, unique=False, default=None)
+    user = relationship('User', lazy='joined')
+
+    @validates('_email')
+    def validate_email(self, key, email):
+        # check if this email is not main one
+        main_email = Session().query(User).filter(User.email == email).scalar()
+        if main_email is not None:
+            raise AttributeError('email %s is present is user table' % email)
+        return email
+
+    @hybrid_property
+    def email(self):
+        return self._email
+
+    @email.setter
+    def email(self, val):
+        self._email = val.lower() if val else None
+
+
+class UserIpMap(Base, BaseModel):
+    __tablename__ = 'user_ip_map'
+    __table_args__ = (
+        UniqueConstraint('user_id', 'ip_addr'),
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
+    )
+    __mapper_args__ = {}
+
+    ip_id = Column("ip_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
+    user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=True, unique=None, default=None)
+    ip_addr = Column("ip_addr", String(255), nullable=True, unique=False, default=None)
+    active = Column("active", Boolean(), nullable=True, unique=None, default=True)
+    description = Column("description", String(10000), nullable=True, unique=None, default=None)
+    user = relationship('User', lazy='joined')
+
+    @classmethod
+    def _get_ip_range(cls, ip_addr):
+        net = ipaddress.ip_network(ip_addr, strict=False)
+        return [str(net.network_address), str(net.broadcast_address)]
+
+    def __json__(self):
+        return {
+          'ip_addr': self.ip_addr,
+          'ip_range': self._get_ip_range(self.ip_addr),
+        }
+
+    def __unicode__(self):
+        return u"<%s('user_id:%s=>%s')>" % (self.__class__.__name__,
+                                            self.user_id, self.ip_addr)
+
+class UserLog(Base, BaseModel):
+    __tablename__ = 'user_logs'
+    __table_args__ = (
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
+    )
+    user_log_id = Column("user_log_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
+    user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=True, unique=None, default=None)
+    username = Column("username", String(255), nullable=True, unique=None, default=None)
+    repository_id = Column("repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=True)
+    repository_name = Column("repository_name", String(255), nullable=True, unique=None, default=None)
+    user_ip = Column("user_ip", String(255), nullable=True, unique=None, default=None)
+    action = Column("action", Text().with_variant(Text(1200000), 'mysql'), nullable=True, unique=None, default=None)
+    action_date = Column("action_date", DateTime(timezone=False), nullable=True, unique=None, default=None)
+
+    def __unicode__(self):
+        return u"<%s('id:%s:%s')>" % (self.__class__.__name__,
+                                      self.repository_name,
+                                      self.action)
+
+    @property
+    def action_as_day(self):
+        return datetime.date(*self.action_date.timetuple()[:3])
+
+    user = relationship('User')
+    repository = relationship('Repository', cascade='')
+
+
+class UserGroup(Base, BaseModel):
+    __tablename__ = 'users_groups'
+    __table_args__ = (
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
+    )
+
+    users_group_id = Column("users_group_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
+    users_group_name = Column("users_group_name", String(255), nullable=False, unique=True, default=None)
+    user_group_description = Column("user_group_description", String(10000), nullable=True, unique=None, default=None)
+    users_group_active = Column("users_group_active", Boolean(), nullable=True, unique=None, default=None)
+    inherit_default_permissions = Column("users_group_inherit_default_permissions", Boolean(), nullable=False, unique=None, default=True)
+    user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=False, default=None)
+    created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
+    _group_data = Column("group_data", LargeBinary(), nullable=True)  # JSON data
+
+    members = relationship('UserGroupMember', cascade="all, delete, delete-orphan", lazy="joined")
+    users_group_to_perm = relationship('UserGroupToPerm', cascade='all')
+    users_group_repo_to_perm = relationship('UserGroupRepoToPerm', cascade='all')
+    users_group_repo_group_to_perm = relationship('UserGroupRepoGroupToPerm', cascade='all')
+    user_user_group_to_perm = relationship('UserUserGroupToPerm', cascade='all')
+    user_group_user_group_to_perm = relationship('UserGroupUserGroupToPerm ', primaryjoin="UserGroupUserGroupToPerm.target_user_group_id==UserGroup.users_group_id", cascade='all')
+
+    user = relationship('User')
+
+    @hybrid_property
+    def group_data(self):
+        if not self._group_data:
+            return {}
+
+        try:
+            return json.loads(self._group_data)
+        except TypeError:
+            return {}
+
+    @group_data.setter
+    def group_data(self, val):
+        try:
+            self._group_data = json.dumps(val)
+        except Exception:
+            log.error(traceback.format_exc())
+
+    def __unicode__(self):
+        return u"<%s('id:%s:%s')>" % (self.__class__.__name__,
+                                      self.users_group_id,
+                                      self.users_group_name)
+
+    @classmethod
+    def get_by_group_name(cls, group_name, cache=False,
+                          case_insensitive=False):
+        if case_insensitive:
+            q = cls.query().filter(func.lower(cls.users_group_name) ==
+                                   func.lower(group_name))
+
+        else:
+            q = cls.query().filter(cls.users_group_name == group_name)
+        if cache:
+            q = q.options(FromCache(
+                            "sql_cache_short",
+                            "get_group_%s" % _hash_key(group_name)))
+        return q.scalar()
+
+    @classmethod
+    def get(cls, user_group_id, cache=False):
+        user_group = cls.query()
+        if cache:
+            user_group = user_group.options(FromCache("sql_cache_short",
+                                    "get_users_group_%s" % user_group_id))
+        return user_group.get(user_group_id)
+
+    def permissions(self, with_admins=True, with_owner=True):
+        q = UserUserGroupToPerm.query().filter(UserUserGroupToPerm.user_group == self)
+        q = q.options(joinedload(UserUserGroupToPerm.user_group),
+                      joinedload(UserUserGroupToPerm.user),
+                      joinedload(UserUserGroupToPerm.permission),)
+
+        # get owners and admins and permissions. We do a trick of re-writing
+        # objects from sqlalchemy to named-tuples due to sqlalchemy session
+        # has a global reference and changing one object propagates to all
+        # others. This means if admin is also an owner admin_row that change
+        # would propagate to both objects
+        perm_rows = []
+        for _usr in q.all():
+            usr = AttributeDict(_usr.user.get_dict())
+            usr.permission = _usr.permission.permission_name
+            perm_rows.append(usr)
+
+        # filter the perm rows by 'default' first and then sort them by
+        # admin,write,read,none permissions sorted again alphabetically in
+        # each group
+        perm_rows = sorted(perm_rows, key=display_sort)
+
+        _admin_perm = 'usergroup.admin'
+        owner_row = []
+        if with_owner:
+            usr = AttributeDict(self.user.get_dict())
+            usr.owner_row = True
+            usr.permission = _admin_perm
+            owner_row.append(usr)
+
+        super_admin_rows = []
+        if with_admins:
+            for usr in User.get_all_super_admins():
+                # if this admin is also owner, don't double the record
+                if usr.user_id == owner_row[0].user_id:
+                    owner_row[0].admin_row = True
+                else:
+                    usr = AttributeDict(usr.get_dict())
+                    usr.admin_row = True
+                    usr.permission = _admin_perm
+                    super_admin_rows.append(usr)
+
+        return super_admin_rows + owner_row + perm_rows
+
+    def permission_user_groups(self):
+        q = UserGroupUserGroupToPerm.query().filter(UserGroupUserGroupToPerm.target_user_group == self)
+        q = q.options(joinedload(UserGroupUserGroupToPerm.user_group),
+                      joinedload(UserGroupUserGroupToPerm.target_user_group),
+                      joinedload(UserGroupUserGroupToPerm.permission),)
+
+        perm_rows = []
+        for _user_group in q.all():
+            usr = AttributeDict(_user_group.user_group.get_dict())
+            usr.permission = _user_group.permission.permission_name
+            perm_rows.append(usr)
+
+        return perm_rows
+
+    def _get_default_perms(self, user_group, suffix=''):
+        from rhodecode.model.permission import PermissionModel
+        return PermissionModel().get_default_perms(user_group.users_group_to_perm, suffix)
+
+    def get_default_perms(self, suffix=''):
+        return self._get_default_perms(self, suffix)
+
+    def get_api_data(self, with_group_members=True, include_secrets=False):
+        """
+        :param include_secrets: See :meth:`User.get_api_data`, this parameter is
+           basically forwarded.
+
+        """
+        user_group = self
+
+        data = {
+            'users_group_id': user_group.users_group_id,
+            'group_name': user_group.users_group_name,
+            'group_description': user_group.user_group_description,
+            'active': user_group.users_group_active,
+            'owner': user_group.user.username,
+        }
+        if with_group_members:
+            users = []
+            for user in user_group.members:
+                user = user.user
+                users.append(user.get_api_data(include_secrets=include_secrets))
+            data['users'] = users
+
+        return data
+
+
+class UserGroupMember(Base, BaseModel):
+    __tablename__ = 'users_groups_members'
+    __table_args__ = (
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
+    )
+
+    users_group_member_id = Column("users_group_member_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
+    users_group_id = Column("users_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)
+    user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)
+
+    user = relationship('User', lazy='joined')
+    users_group = relationship('UserGroup')
+
+    def __init__(self, gr_id='', u_id=''):
+        self.users_group_id = gr_id
+        self.user_id = u_id
+
+
+class RepositoryField(Base, BaseModel):
+    __tablename__ = 'repositories_fields'
+    __table_args__ = (
+        UniqueConstraint('repository_id', 'field_key'),  # no-multi field
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
+    )
+    PREFIX = 'ex_'  # prefix used in form to not conflict with already existing fields
+
+    repo_field_id = Column("repo_field_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
+    repository_id = Column("repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=False, unique=None, default=None)
+    field_key = Column("field_key", String(250))
+    field_label = Column("field_label", String(1024), nullable=False)
+    field_value = Column("field_value", String(10000), nullable=False)
+    field_desc = Column("field_desc", String(1024), nullable=False)
+    field_type = Column("field_type", String(255), nullable=False, unique=None)
+    created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
+
+    repository = relationship('Repository')
+
+    @property
+    def field_key_prefixed(self):
+        return 'ex_%s' % self.field_key
+
+    @classmethod
+    def un_prefix_key(cls, key):
+        if key.startswith(cls.PREFIX):
+            return key[len(cls.PREFIX):]
+        return key
+
+    @classmethod
+    def get_by_key_name(cls, key, repo):
+        row = cls.query()\
+                .filter(cls.repository == repo)\
+                .filter(cls.field_key == key).scalar()
+        return row
+
+
+class Repository(Base, BaseModel):
+    __tablename__ = 'repositories'
+    __table_args__ = (
+        Index('r_repo_name_idx', 'repo_name', mysql_length=255),
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
+    )
+    DEFAULT_CLONE_URI = '{scheme}://{user}@{netloc}/{repo}'
+    DEFAULT_CLONE_URI_ID = '{scheme}://{user}@{netloc}/_{repoid}'
+
+    STATE_CREATED = 'repo_state_created'
+    STATE_PENDING = 'repo_state_pending'
+    STATE_ERROR = 'repo_state_error'
+
+    LOCK_AUTOMATIC = 'lock_auto'
+    LOCK_API = 'lock_api'
+    LOCK_WEB = 'lock_web'
+    LOCK_PULL = 'lock_pull'
+
+    NAME_SEP = URL_SEP
+
+    repo_id = Column(
+        "repo_id", Integer(), nullable=False, unique=True, default=None,
+        primary_key=True)
+    _repo_name = Column(
+        "repo_name", Text(), nullable=False, default=None)
+    _repo_name_hash = Column(
+        "repo_name_hash", String(255), nullable=False, unique=True)
+    repo_state = Column("repo_state", String(255), nullable=True)
+
+    clone_uri = Column(
+        "clone_uri", EncryptedTextValue(), nullable=True, unique=False,
+        default=None)
+    repo_type = Column(
+        "repo_type", String(255), nullable=False, unique=False, default=None)
+    user_id = Column(
+        "user_id", Integer(), ForeignKey('users.user_id'), nullable=False,
+        unique=False, default=None)
+    private = Column(
+        "private", Boolean(), nullable=True, unique=None, default=None)
+    enable_statistics = Column(
+        "statistics", Boolean(), nullable=True, unique=None, default=True)
+    enable_downloads = Column(
+        "downloads", Boolean(), nullable=True, unique=None, default=True)
+    description = Column(
+        "description", String(10000), nullable=True, unique=None, default=None)
+    created_on = Column(
+        'created_on', DateTime(timezone=False), nullable=True, unique=None,
+        default=datetime.datetime.now)
+    updated_on = Column(
+        'updated_on', DateTime(timezone=False), nullable=True, unique=None,
+        default=datetime.datetime.now)
+    _landing_revision = Column(
+        "landing_revision", String(255), nullable=False, unique=False,
+        default=None)
+    enable_locking = Column(
+        "enable_locking", Boolean(), nullable=False, unique=None,
+        default=False)
+    _locked = Column(
+        "locked", String(255), nullable=True, unique=False, default=None)
+    _changeset_cache = Column(
+        "changeset_cache", LargeBinary(), nullable=True)  # JSON data
+
+    fork_id = Column(
+        "fork_id", Integer(), ForeignKey('repositories.repo_id'),
+        nullable=True, unique=False, default=None)
+    group_id = Column(
+        "group_id", Integer(), ForeignKey('groups.group_id'), nullable=True,
+        unique=False, default=None)
+
+    user = relationship('User', lazy='joined')
+    fork = relationship('Repository', remote_side=repo_id, lazy='joined')
+    group = relationship('RepoGroup', lazy='joined')
+    repo_to_perm = relationship(
+        'UserRepoToPerm', cascade='all',
+        order_by='UserRepoToPerm.repo_to_perm_id')
+    users_group_to_perm = relationship('UserGroupRepoToPerm', cascade='all')
+    stats = relationship('Statistics', cascade='all', uselist=False)
+
+    followers = relationship(
+        'UserFollowing',
+        primaryjoin='UserFollowing.follows_repo_id==Repository.repo_id',
+        cascade='all')
+    extra_fields = relationship(
+        'RepositoryField', cascade="all, delete, delete-orphan")
+    logs = relationship('UserLog')
+    comments = relationship(
+        'ChangesetComment', cascade="all, delete, delete-orphan")
+    pull_requests_source = relationship(
+        'PullRequest',
+        primaryjoin='PullRequest.source_repo_id==Repository.repo_id',
+        cascade="all, delete, delete-orphan")
+    pull_requests_target = relationship(
+        'PullRequest',
+        primaryjoin='PullRequest.target_repo_id==Repository.repo_id',
+        cascade="all, delete, delete-orphan")
+    ui = relationship('RepoRhodeCodeUi', cascade="all")
+    settings = relationship('RepoRhodeCodeSetting', cascade="all")
+    integrations = relationship('Integration',
+                                cascade="all, delete, delete-orphan")
+
+    def __unicode__(self):
+        return u"<%s('%s:%s')>" % (self.__class__.__name__, self.repo_id,
+                                   safe_unicode(self.repo_name))
+
+    @hybrid_property
+    def landing_rev(self):
+        # always should return [rev_type, rev]
+        if self._landing_revision:
+            _rev_info = self._landing_revision.split(':')
+            if len(_rev_info) < 2:
+                _rev_info.insert(0, 'rev')
+            return [_rev_info[0], _rev_info[1]]
+        return [None, None]
+
+    @landing_rev.setter
+    def landing_rev(self, val):
+        if ':' not in val:
+            raise ValueError('value must be delimited with `:` and consist '
+                             'of <rev_type>:<rev>, got %s instead' % val)
+        self._landing_revision = val
+
+    @hybrid_property
+    def locked(self):
+        if self._locked:
+            user_id, timelocked, reason = self._locked.split(':')
+            lock_values = int(user_id), timelocked, reason
+        else:
+            lock_values = [None, None, None]
+        return lock_values
+
+    @locked.setter
+    def locked(self, val):
+        if val and isinstance(val, (list, tuple)):
+            self._locked = ':'.join(map(str, val))
+        else:
+            self._locked = None
+
+    @hybrid_property
+    def changeset_cache(self):
+        from rhodecode.lib.vcs.backends.base import EmptyCommit
+        dummy = EmptyCommit().__json__()
+        if not self._changeset_cache:
+            return dummy
+        try:
+            return json.loads(self._changeset_cache)
+        except TypeError:
+            return dummy
+        except Exception:
+            log.error(traceback.format_exc())
+            return dummy
+
+    @changeset_cache.setter
+    def changeset_cache(self, val):
+        try:
+            self._changeset_cache = json.dumps(val)
+        except Exception:
+            log.error(traceback.format_exc())
+
+    @hybrid_property
+    def repo_name(self):
+        return self._repo_name
+
+    @repo_name.setter
+    def repo_name(self, value):
+        self._repo_name = value
+        self._repo_name_hash = hashlib.sha1(safe_str(value)).hexdigest()
+
+    @classmethod
+    def normalize_repo_name(cls, repo_name):
+        """
+        Normalizes os specific repo_name to the format internally stored inside
+        database using URL_SEP
+
+        :param cls:
+        :param repo_name:
+        """
+        return cls.NAME_SEP.join(repo_name.split(os.sep))
+
+    @classmethod
+    def get_by_repo_name(cls, repo_name, cache=False, identity_cache=False):
+        session = Session()
+        q = session.query(cls).filter(cls.repo_name == repo_name)
+
+        if cache:
+            if identity_cache:
+                val = cls.identity_cache(session, 'repo_name', repo_name)
+                if val:
+                    return val
+            else:
+                q = q.options(
+                    FromCache("sql_cache_short",
+                              "get_repo_by_name_%s" % _hash_key(repo_name)))
+
+        return q.scalar()
+
+    @classmethod
+    def get_by_full_path(cls, repo_full_path):
+        repo_name = repo_full_path.split(cls.base_path(), 1)[-1]
+        repo_name = cls.normalize_repo_name(repo_name)
+        return cls.get_by_repo_name(repo_name.strip(URL_SEP))
+
+    @classmethod
+    def get_repo_forks(cls, repo_id):
+        return cls.query().filter(Repository.fork_id == repo_id)
+
+    @classmethod
+    def base_path(cls):
+        """
+        Returns base path when all repos are stored
+
+        :param cls:
+        """
+        q = Session().query(RhodeCodeUi)\
+            .filter(RhodeCodeUi.ui_key == cls.NAME_SEP)
+        q = q.options(FromCache("sql_cache_short", "repository_repo_path"))
+        return q.one().ui_value
+
+    @classmethod
+    def is_valid(cls, repo_name):
+        """
+        returns True if given repo name is a valid filesystem repository
+
+        :param cls:
+        :param repo_name:
+        """
+        from rhodecode.lib.utils import is_valid_repo
+
+        return is_valid_repo(repo_name, cls.base_path())
+
+    @classmethod
+    def get_all_repos(cls, user_id=Optional(None), group_id=Optional(None),
+                      case_insensitive=True):
+        q = Repository.query()
+
+        if not isinstance(user_id, Optional):
+            q = q.filter(Repository.user_id == user_id)
+
+        if not isinstance(group_id, Optional):
+            q = q.filter(Repository.group_id == group_id)
+
+        if case_insensitive:
+            q = q.order_by(func.lower(Repository.repo_name))
+        else:
+            q = q.order_by(Repository.repo_name)
+        return q.all()
+
+    @property
+    def forks(self):
+        """
+        Return forks of this repo
+        """
+        return Repository.get_repo_forks(self.repo_id)
+
+    @property
+    def parent(self):
+        """
+        Returns fork parent
+        """
+        return self.fork
+
+    @property
+    def just_name(self):
+        return self.repo_name.split(self.NAME_SEP)[-1]
+
+    @property
+    def groups_with_parents(self):
+        groups = []
+        if self.group is None:
+            return groups
+
+        cur_gr = self.group
+        groups.insert(0, cur_gr)
+        while 1:
+            gr = getattr(cur_gr, 'parent_group', None)
+            cur_gr = cur_gr.parent_group
+            if gr is None:
+                break
+            groups.insert(0, gr)
+
+        return groups
+
+    @property
+    def groups_and_repo(self):
+        return self.groups_with_parents, self
+
+    @LazyProperty
+    def repo_path(self):
+        """
+        Returns base full path for that repository means where it actually
+        exists on a filesystem
+        """
+        q = Session().query(RhodeCodeUi).filter(
+            RhodeCodeUi.ui_key == self.NAME_SEP)
+        q = q.options(FromCache("sql_cache_short", "repository_repo_path"))
+        return q.one().ui_value
+
+    @property
+    def repo_full_path(self):
+        p = [self.repo_path]
+        # we need to split the name by / since this is how we store the
+        # names in the database, but that eventually needs to be converted
+        # into a valid system path
+        p += self.repo_name.split(self.NAME_SEP)
+        return os.path.join(*map(safe_unicode, p))
+
+    @property
+    def cache_keys(self):
+        """
+        Returns associated cache keys for that repo
+        """
+        return CacheKey.query()\
+            .filter(CacheKey.cache_args == self.repo_name)\
+            .order_by(CacheKey.cache_key)\
+            .all()
+
+    def get_new_name(self, repo_name):
+        """
+        returns new full repository name based on assigned group and new new
+
+        :param group_name:
+        """
+        path_prefix = self.group.full_path_splitted if self.group else []
+        return self.NAME_SEP.join(path_prefix + [repo_name])
+
+    @property
+    def _config(self):
+        """
+        Returns db based config object.
+        """
+        from rhodecode.lib.utils import make_db_config
+        return make_db_config(clear_session=False, repo=self)
+
+    def permissions(self, with_admins=True, with_owner=True):
+        q = UserRepoToPerm.query().filter(UserRepoToPerm.repository == self)
+        q = q.options(joinedload(UserRepoToPerm.repository),
+                      joinedload(UserRepoToPerm.user),
+                      joinedload(UserRepoToPerm.permission),)
+
+        # get owners and admins and permissions. We do a trick of re-writing
+        # objects from sqlalchemy to named-tuples due to sqlalchemy session
+        # has a global reference and changing one object propagates to all
+        # others. This means if admin is also an owner admin_row that change
+        # would propagate to both objects
+        perm_rows = []
+        for _usr in q.all():
+            usr = AttributeDict(_usr.user.get_dict())
+            usr.permission = _usr.permission.permission_name
+            perm_rows.append(usr)
+
+        # filter the perm rows by 'default' first and then sort them by
+        # admin,write,read,none permissions sorted again alphabetically in
+        # each group
+        perm_rows = sorted(perm_rows, key=display_sort)
+
+        _admin_perm = 'repository.admin'
+        owner_row = []
+        if with_owner:
+            usr = AttributeDict(self.user.get_dict())
+            usr.owner_row = True
+            usr.permission = _admin_perm
+            owner_row.append(usr)
+
+        super_admin_rows = []
+        if with_admins:
+            for usr in User.get_all_super_admins():
+                # if this admin is also owner, don't double the record
+                if usr.user_id == owner_row[0].user_id:
+                    owner_row[0].admin_row = True
+                else:
+                    usr = AttributeDict(usr.get_dict())
+                    usr.admin_row = True
+                    usr.permission = _admin_perm
+                    super_admin_rows.append(usr)
+
+        return super_admin_rows + owner_row + perm_rows
+
+    def permission_user_groups(self):
+        q = UserGroupRepoToPerm.query().filter(
+            UserGroupRepoToPerm.repository == self)
+        q = q.options(joinedload(UserGroupRepoToPerm.repository),
+                      joinedload(UserGroupRepoToPerm.users_group),
+                      joinedload(UserGroupRepoToPerm.permission),)
+
+        perm_rows = []
+        for _user_group in q.all():
+            usr = AttributeDict(_user_group.users_group.get_dict())
+            usr.permission = _user_group.permission.permission_name
+            perm_rows.append(usr)
+
+        return perm_rows
+
+    def get_api_data(self, include_secrets=False):
+        """
+        Common function for generating repo api data
+
+        :param include_secrets: See :meth:`User.get_api_data`.
+
+        """
+        # TODO: mikhail: Here there is an anti-pattern, we probably need to
+        # move this methods on models level.
+        from rhodecode.model.settings import SettingsModel
+
+        repo = self
+        _user_id, _time, _reason = self.locked
+
+        data = {
+            'repo_id': repo.repo_id,
+            'repo_name': repo.repo_name,
+            'repo_type': repo.repo_type,
+            'clone_uri': repo.clone_uri or '',
+            'url': url('summary_home', repo_name=self.repo_name, qualified=True),
+            'private': repo.private,
+            'created_on': repo.created_on,
+            'description': repo.description,
+            'landing_rev': repo.landing_rev,
+            'owner': repo.user.username,
+            'fork_of': repo.fork.repo_name if repo.fork else None,
+            'enable_statistics': repo.enable_statistics,
+            'enable_locking': repo.enable_locking,
+            'enable_downloads': repo.enable_downloads,
+            'last_changeset': repo.changeset_cache,
+            'locked_by': User.get(_user_id).get_api_data(
+                include_secrets=include_secrets) if _user_id else None,
+            'locked_date': time_to_datetime(_time) if _time else None,
+            'lock_reason': _reason if _reason else None,
+        }
+
+        # TODO: mikhail: should be per-repo settings here
+        rc_config = SettingsModel().get_all_settings()
+        repository_fields = str2bool(
+            rc_config.get('rhodecode_repository_fields'))
+        if repository_fields:
+            for f in self.extra_fields:
+                data[f.field_key_prefixed] = f.field_value
+
+        return data
+
+    @classmethod
+    def lock(cls, repo, user_id, lock_time=None, lock_reason=None):
+        if not lock_time:
+            lock_time = time.time()
+        if not lock_reason:
+            lock_reason = cls.LOCK_AUTOMATIC
+        repo.locked = [user_id, lock_time, lock_reason]
+        Session().add(repo)
+        Session().commit()
+
+    @classmethod
+    def unlock(cls, repo):
+        repo.locked = None
+        Session().add(repo)
+        Session().commit()
+
+    @classmethod
+    def getlock(cls, repo):
+        return repo.locked
+
+    def is_user_lock(self, user_id):
+        if self.lock[0]:
+            lock_user_id = safe_int(self.lock[0])
+            user_id = safe_int(user_id)
+            # both are ints, and they are equal
+            return all([lock_user_id, user_id]) and lock_user_id == user_id
+
+        return False
+
+    def get_locking_state(self, action, user_id, only_when_enabled=True):
+        """
+        Checks locking on this repository, if locking is enabled and lock is
+        present returns a tuple of make_lock, locked, locked_by.
+        make_lock can have 3 states None (do nothing) True, make lock
+        False release lock, This value is later propagated to hooks, which
+        do the locking. Think about this as signals passed to hooks what to do.
+
+        """
+        # TODO: johbo: This is part of the business logic and should be moved
+        # into the RepositoryModel.
+
+        if action not in ('push', 'pull'):
+            raise ValueError("Invalid action value: %s" % repr(action))
+
+        # defines if locked error should be thrown to user
+        currently_locked = False
+        # defines if new lock should be made, tri-state
+        make_lock = None
+        repo = self
+        user = User.get(user_id)
+
+        lock_info = repo.locked
+
+        if repo and (repo.enable_locking or not only_when_enabled):
+            if action == 'push':
+                # check if it's already locked !, if it is compare users
+                locked_by_user_id = lock_info[0]
+                if user.user_id == locked_by_user_id:
+                    log.debug(
+                        'Got `push` action from user %s, now unlocking', user)
+                    # unlock if we have push from user who locked
+                    make_lock = False
+                else:
+                    # we're not the same user who locked, ban with
+                    # code defined in settings (default is 423 HTTP Locked) !
+                    log.debug('Repo %s is currently locked by %s', repo, user)
+                    currently_locked = True
+            elif action == 'pull':
+                # [0] user [1] date
+                if lock_info[0] and lock_info[1]:
+                    log.debug('Repo %s is currently locked by %s', repo, user)
+                    currently_locked = True
+                else:
+                    log.debug('Setting lock on repo %s by %s', repo, user)
+                    make_lock = True
+
+        else:
+            log.debug('Repository %s do not have locking enabled', repo)
+
+        log.debug('FINAL locking values make_lock:%s,locked:%s,locked_by:%s',
+                  make_lock, currently_locked, lock_info)
+
+        from rhodecode.lib.auth import HasRepoPermissionAny
+        perm_check = HasRepoPermissionAny('repository.write', 'repository.admin')
+        if make_lock and not perm_check(repo_name=repo.repo_name, user=user):
+            # if we don't have at least write permission we cannot make a lock
+            log.debug('lock state reset back to FALSE due to lack '
+                      'of at least read permission')
+            make_lock = False
+
+        return make_lock, currently_locked, lock_info
+
+    @property
+    def last_db_change(self):
+        return self.updated_on
+
+    @property
+    def clone_uri_hidden(self):
+        clone_uri = self.clone_uri
+        if clone_uri:
+            import urlobject
+            url_obj = urlobject.URLObject(clone_uri)
+            if url_obj.password:
+                clone_uri = url_obj.with_password('*****')
+        return clone_uri
+
+    def clone_url(self, **override):
+        qualified_home_url = url('home', qualified=True)
+
+        uri_tmpl = None
+        if 'with_id' in override:
+            uri_tmpl = self.DEFAULT_CLONE_URI_ID
+            del override['with_id']
+
+        if 'uri_tmpl' in override:
+            uri_tmpl = override['uri_tmpl']
+            del override['uri_tmpl']
+
+        # we didn't override our tmpl from **overrides
+        if not uri_tmpl:
+            uri_tmpl = self.DEFAULT_CLONE_URI
+            try:
+                from pylons import tmpl_context as c
+                uri_tmpl = c.clone_uri_tmpl
+            except Exception:
+                # in any case if we call this outside of request context,
+                # ie, not having tmpl_context set up
+                pass
+
+        return get_clone_url(uri_tmpl=uri_tmpl,
+                             qualifed_home_url=qualified_home_url,
+                             repo_name=self.repo_name,
+                             repo_id=self.repo_id, **override)
+
+    def set_state(self, state):
+        self.repo_state = state
+        Session().add(self)
+    #==========================================================================
+    # SCM PROPERTIES
+    #==========================================================================
+
+    def get_commit(self, commit_id=None, commit_idx=None, pre_load=None):
+        return get_commit_safe(
+            self.scm_instance(), commit_id, commit_idx, pre_load=pre_load)
+
+    def get_changeset(self, rev=None, pre_load=None):
+        warnings.warn("Use get_commit", DeprecationWarning)
+        commit_id = None
+        commit_idx = None
+        if isinstance(rev, basestring):
+            commit_id = rev
+        else:
+            commit_idx = rev
+        return self.get_commit(commit_id=commit_id, commit_idx=commit_idx,
+                               pre_load=pre_load)
+
+    def get_landing_commit(self):
+        """
+        Returns landing commit, or if that doesn't exist returns the tip
+        """
+        _rev_type, _rev = self.landing_rev
+        commit = self.get_commit(_rev)
+        if isinstance(commit, EmptyCommit):
+            return self.get_commit()
+        return commit
+
+    def update_commit_cache(self, cs_cache=None, config=None):
+        """
+        Update cache of last changeset for repository, keys should be::
+
+            short_id
+            raw_id
+            revision
+            parents
+            message
+            date
+            author
+
+        :param cs_cache:
+        """
+        from rhodecode.lib.vcs.backends.base import BaseChangeset
+        if cs_cache is None:
+            # use no-cache version here
+            scm_repo = self.scm_instance(cache=False, config=config)
+            if scm_repo:
+                cs_cache = scm_repo.get_commit(
+                    pre_load=["author", "date", "message", "parents"])
+            else:
+                cs_cache = EmptyCommit()
+
+        if isinstance(cs_cache, BaseChangeset):
+            cs_cache = cs_cache.__json__()
+
+        def is_outdated(new_cs_cache):
+            if (new_cs_cache['raw_id'] != self.changeset_cache['raw_id'] or
+                new_cs_cache['revision'] != self.changeset_cache['revision']):
+                return True
+            return False
+
+        # check if we have maybe already latest cached revision
+        if is_outdated(cs_cache) or not self.changeset_cache:
+            _default = datetime.datetime.fromtimestamp(0)
+            last_change = cs_cache.get('date') or _default
+            log.debug('updated repo %s with new cs cache %s',
+                      self.repo_name, cs_cache)
+            self.updated_on = last_change
+            self.changeset_cache = cs_cache
+            Session().add(self)
+            Session().commit()
+        else:
+            log.debug('Skipping update_commit_cache for repo:`%s` '
+                      'commit already with latest changes', self.repo_name)
+
+    @property
+    def tip(self):
+        return self.get_commit('tip')
+
+    @property
+    def author(self):
+        return self.tip.author
+
+    @property
+    def last_change(self):
+        return self.scm_instance().last_change
+
+    def get_comments(self, revisions=None):
+        """
+        Returns comments for this repository grouped by revisions
+
+        :param revisions: filter query by revisions only
+        """
+        cmts = ChangesetComment.query()\
+            .filter(ChangesetComment.repo == self)
+        if revisions:
+            cmts = cmts.filter(ChangesetComment.revision.in_(revisions))
+        grouped = collections.defaultdict(list)
+        for cmt in cmts.all():
+            grouped[cmt.revision].append(cmt)
+        return grouped
+
+    def statuses(self, revisions=None):
+        """
+        Returns statuses for this repository
+
+        :param revisions: list of revisions to get statuses for
+        """
+        statuses = ChangesetStatus.query()\
+            .filter(ChangesetStatus.repo == self)\
+            .filter(ChangesetStatus.version == 0)
+
+        if revisions:
+            # Try doing the filtering in chunks to avoid hitting limits
+            size = 500
+            status_results = []
+            for chunk in xrange(0, len(revisions), size):
+                status_results += statuses.filter(
+                    ChangesetStatus.revision.in_(
+                        revisions[chunk: chunk+size])
+                ).all()
+        else:
+            status_results = statuses.all()
+
+        grouped = {}
+
+        # maybe we have open new pullrequest without a status?
+        stat = ChangesetStatus.STATUS_UNDER_REVIEW
+        status_lbl = ChangesetStatus.get_status_lbl(stat)
+        for pr in PullRequest.query().filter(PullRequest.source_repo == self).all():
+            for rev in pr.revisions:
+                pr_id = pr.pull_request_id
+                pr_repo = pr.target_repo.repo_name
+                grouped[rev] = [stat, status_lbl, pr_id, pr_repo]
+
+        for stat in status_results:
+            pr_id = pr_repo = None
+            if stat.pull_request:
+                pr_id = stat.pull_request.pull_request_id
+                pr_repo = stat.pull_request.target_repo.repo_name
+            grouped[stat.revision] = [str(stat.status), stat.status_lbl,
+                                      pr_id, pr_repo]
+        return grouped
+
+    # ==========================================================================
+    # SCM CACHE INSTANCE
+    # ==========================================================================
+
+    def scm_instance(self, **kwargs):
+        import rhodecode
+
+        # Passing a config will not hit the cache currently only used
+        # for repo2dbmapper
+        config = kwargs.pop('config', None)
+        cache = kwargs.pop('cache', None)
+        full_cache = str2bool(rhodecode.CONFIG.get('vcs_full_cache'))
+        # if cache is NOT defined use default global, else we have a full
+        # control over cache behaviour
+        if cache is None and full_cache and not config:
+            return self._get_instance_cached()
+        return self._get_instance(cache=bool(cache), config=config)
+
+    def _get_instance_cached(self):
+        @cache_region('long_term')
+        def _get_repo(cache_key):
+            return self._get_instance()
+
+        invalidator_context = CacheKey.repo_context_cache(
+            _get_repo, self.repo_name, None, thread_scoped=True)
+
+        with invalidator_context as context:
+            context.invalidate()
+            repo = context.compute()
+
+        return repo
+
+    def _get_instance(self, cache=True, config=None):
+        config = config or self._config
+        custom_wire = {
+            'cache': cache  # controls the vcs.remote cache
+        }
+
+        repo = get_vcs_instance(
+            repo_path=safe_str(self.repo_full_path),
+            config=config,
+            with_wire=custom_wire,
+            create=False)
+
+        return repo
+
+    def __json__(self):
+        return {'landing_rev': self.landing_rev}
+
+    def get_dict(self):
+
+        # Since we transformed `repo_name` to a hybrid property, we need to
+        # keep compatibility with the code which uses `repo_name` field.
+
+        result = super(Repository, self).get_dict()
+        result['repo_name'] = result.pop('_repo_name', None)
+        return result
+
+
+class RepoGroup(Base, BaseModel):
+    __tablename__ = 'groups'
+    __table_args__ = (
+        UniqueConstraint('group_name', 'group_parent_id'),
+        CheckConstraint('group_id != group_parent_id'),
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
+    )
+    __mapper_args__ = {'order_by': 'group_name'}
+
+    CHOICES_SEPARATOR = '/'  # used to generate select2 choices for nested groups
+
+    group_id = Column("group_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
+    group_name = Column("group_name", String(255), nullable=False, unique=True, default=None)
+    group_parent_id = Column("group_parent_id", Integer(), ForeignKey('groups.group_id'), nullable=True, unique=None, default=None)
+    group_description = Column("group_description", String(10000), nullable=True, unique=None, default=None)
+    enable_locking = Column("enable_locking", Boolean(), nullable=False, unique=None, default=False)
+    user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=False, default=None)
+    created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
+
+    repo_group_to_perm = relationship('UserRepoGroupToPerm', cascade='all', order_by='UserRepoGroupToPerm.group_to_perm_id')
+    users_group_to_perm = relationship('UserGroupRepoGroupToPerm', cascade='all')
+    parent_group = relationship('RepoGroup', remote_side=group_id)
+    user = relationship('User')
+
+    def __init__(self, group_name='', parent_group=None):
+        self.group_name = group_name
+        self.parent_group = parent_group
+
+    def __unicode__(self):
+        return u"<%s('id:%s:%s')>" % (self.__class__.__name__, self.group_id,
+                                      self.group_name)
+
+    @classmethod
+    def _generate_choice(cls, repo_group):
+        from webhelpers.html import literal as _literal
+        _name = lambda k: _literal(cls.CHOICES_SEPARATOR.join(k))
+        return repo_group.group_id, _name(repo_group.full_path_splitted)
+
+    @classmethod
+    def groups_choices(cls, groups=None, show_empty_group=True):
+        if not groups:
+            groups = cls.query().all()
+
+        repo_groups = []
+        if show_empty_group:
+            repo_groups = [('-1', u'-- %s --' % _('No parent'))]
+
+        repo_groups.extend([cls._generate_choice(x) for x in groups])
+
+        repo_groups = sorted(
+            repo_groups, key=lambda t: t[1].split(cls.CHOICES_SEPARATOR)[0])
+        return repo_groups
+
+    @classmethod
+    def url_sep(cls):
+        return URL_SEP
+
+    @classmethod
+    def get_by_group_name(cls, group_name, cache=False, case_insensitive=False):
+        if case_insensitive:
+            gr = cls.query().filter(func.lower(cls.group_name)
+                                    == func.lower(group_name))
+        else:
+            gr = cls.query().filter(cls.group_name == group_name)
+        if cache:
+            gr = gr.options(FromCache(
+                            "sql_cache_short",
+                            "get_group_%s" % _hash_key(group_name)))
+        return gr.scalar()
+
+    @classmethod
+    def get_all_repo_groups(cls, user_id=Optional(None), group_id=Optional(None),
+                            case_insensitive=True):
+        q = RepoGroup.query()
+
+        if not isinstance(user_id, Optional):
+            q = q.filter(RepoGroup.user_id == user_id)
+
+        if not isinstance(group_id, Optional):
+            q = q.filter(RepoGroup.group_parent_id == group_id)
+
+        if case_insensitive:
+            q = q.order_by(func.lower(RepoGroup.group_name))
+        else:
+            q = q.order_by(RepoGroup.group_name)
+        return q.all()
+
+    @property
+    def parents(self):
+        parents_recursion_limit = 10
+        groups = []
+        if self.parent_group is None:
+            return groups
+        cur_gr = self.parent_group
+        groups.insert(0, cur_gr)
+        cnt = 0
+        while 1:
+            cnt += 1
+            gr = getattr(cur_gr, 'parent_group', None)
+            cur_gr = cur_gr.parent_group
+            if gr is None:
+                break
+            if cnt == parents_recursion_limit:
+                # this will prevent accidental infinit loops
+                log.error(('more than %s parents found for group %s, stopping '
+                           'recursive parent fetching' % (parents_recursion_limit, self)))
+                break
+
+            groups.insert(0, gr)
+        return groups
+
+    @property
+    def children(self):
+        return RepoGroup.query().filter(RepoGroup.parent_group == self)
+
+    @property
+    def name(self):
+        return self.group_name.split(RepoGroup.url_sep())[-1]
+
+    @property
+    def full_path(self):
+        return self.group_name
+
+    @property
+    def full_path_splitted(self):
+        return self.group_name.split(RepoGroup.url_sep())
+
+    @property
+    def repositories(self):
+        return Repository.query()\
+                .filter(Repository.group == self)\
+                .order_by(Repository.repo_name)
+
+    @property
+    def repositories_recursive_count(self):
+        cnt = self.repositories.count()
+
+        def children_count(group):
+            cnt = 0
+            for child in group.children:
+                cnt += child.repositories.count()
+                cnt += children_count(child)
+            return cnt
+
+        return cnt + children_count(self)
+
+    def _recursive_objects(self, include_repos=True):
+        all_ = []
+
+        def _get_members(root_gr):
+            if include_repos:
+                for r in root_gr.repositories:
+                    all_.append(r)
+            childs = root_gr.children.all()
+            if childs:
+                for gr in childs:
+                    all_.append(gr)
+                    _get_members(gr)
+
+        _get_members(self)
+        return [self] + all_
+
+    def recursive_groups_and_repos(self):
+        """
+        Recursive return all groups, with repositories in those groups
+        """
+        return self._recursive_objects()
+
+    def recursive_groups(self):
+        """
+        Returns all children groups for this group including children of children
+        """
+        return self._recursive_objects(include_repos=False)
+
+    def get_new_name(self, group_name):
+        """
+        returns new full group name based on parent and new name
+
+        :param group_name:
+        """
+        path_prefix = (self.parent_group.full_path_splitted if
+                       self.parent_group else [])
+        return RepoGroup.url_sep().join(path_prefix + [group_name])
+
+    def permissions(self, with_admins=True, with_owner=True):
+        q = UserRepoGroupToPerm.query().filter(UserRepoGroupToPerm.group == self)
+        q = q.options(joinedload(UserRepoGroupToPerm.group),
+                      joinedload(UserRepoGroupToPerm.user),
+                      joinedload(UserRepoGroupToPerm.permission),)
+
+        # get owners and admins and permissions. We do a trick of re-writing
+        # objects from sqlalchemy to named-tuples due to sqlalchemy session
+        # has a global reference and changing one object propagates to all
+        # others. This means if admin is also an owner admin_row that change
+        # would propagate to both objects
+        perm_rows = []
+        for _usr in q.all():
+            usr = AttributeDict(_usr.user.get_dict())
+            usr.permission = _usr.permission.permission_name
+            perm_rows.append(usr)
+
+        # filter the perm rows by 'default' first and then sort them by
+        # admin,write,read,none permissions sorted again alphabetically in
+        # each group
+        perm_rows = sorted(perm_rows, key=display_sort)
+
+        _admin_perm = 'group.admin'
+        owner_row = []
+        if with_owner:
+            usr = AttributeDict(self.user.get_dict())
+            usr.owner_row = True
+            usr.permission = _admin_perm
+            owner_row.append(usr)
+
+        super_admin_rows = []
+        if with_admins:
+            for usr in User.get_all_super_admins():
+                # if this admin is also owner, don't double the record
+                if usr.user_id == owner_row[0].user_id:
+                    owner_row[0].admin_row = True
+                else:
+                    usr = AttributeDict(usr.get_dict())
+                    usr.admin_row = True
+                    usr.permission = _admin_perm
+                    super_admin_rows.append(usr)
+
+        return super_admin_rows + owner_row + perm_rows
+
+    def permission_user_groups(self):
+        q = UserGroupRepoGroupToPerm.query().filter(UserGroupRepoGroupToPerm.group == self)
+        q = q.options(joinedload(UserGroupRepoGroupToPerm.group),
+                      joinedload(UserGroupRepoGroupToPerm.users_group),
+                      joinedload(UserGroupRepoGroupToPerm.permission),)
+
+        perm_rows = []
+        for _user_group in q.all():
+            usr = AttributeDict(_user_group.users_group.get_dict())
+            usr.permission = _user_group.permission.permission_name
+            perm_rows.append(usr)
+
+        return perm_rows
+
+    def get_api_data(self):
+        """
+        Common function for generating api data
+
+        """
+        group = self
+        data = {
+            'group_id': group.group_id,
+            'group_name': group.group_name,
+            'group_description': group.group_description,
+            'parent_group': group.parent_group.group_name if group.parent_group else None,
+            'repositories': [x.repo_name for x in group.repositories],
+            'owner': group.user.username,
+        }
+        return data
+
+
+class Permission(Base, BaseModel):
+    __tablename__ = 'permissions'
+    __table_args__ = (
+        Index('p_perm_name_idx', 'permission_name'),
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
+    )
+    PERMS = [
+        ('hg.admin', _('RhodeCode Super Administrator')),
+
+        ('repository.none', _('Repository no access')),
+        ('repository.read', _('Repository read access')),
+        ('repository.write', _('Repository write access')),
+        ('repository.admin', _('Repository admin access')),
+
+        ('group.none', _('Repository group no access')),
+        ('group.read', _('Repository group read access')),
+        ('group.write', _('Repository group write access')),
+        ('group.admin', _('Repository group admin access')),
+
+        ('usergroup.none', _('User group no access')),
+        ('usergroup.read', _('User group read access')),
+        ('usergroup.write', _('User group write access')),
+        ('usergroup.admin', _('User group admin access')),
+
+        ('hg.repogroup.create.false', _('Repository Group creation disabled')),
+        ('hg.repogroup.create.true', _('Repository Group creation enabled')),
+
+        ('hg.usergroup.create.false', _('User Group creation disabled')),
+        ('hg.usergroup.create.true', _('User Group creation enabled')),
+
+        ('hg.create.none', _('Repository creation disabled')),
+        ('hg.create.repository', _('Repository creation enabled')),
+        ('hg.create.write_on_repogroup.true', _('Repository creation enabled with write permission to a repository group')),
+        ('hg.create.write_on_repogroup.false', _('Repository creation disabled with write permission to a repository group')),
+
+        ('hg.fork.none', _('Repository forking disabled')),
+        ('hg.fork.repository', _('Repository forking enabled')),
+
+        ('hg.register.none', _('Registration disabled')),
+        ('hg.register.manual_activate', _('User Registration with manual account activation')),
+        ('hg.register.auto_activate', _('User Registration with automatic account activation')),
+
+        ('hg.extern_activate.manual', _('Manual activation of external account')),
+        ('hg.extern_activate.auto', _('Automatic activation of external account')),
+
+        ('hg.inherit_default_perms.false', _('Inherit object permissions from default user disabled')),
+        ('hg.inherit_default_perms.true', _('Inherit object permissions from default user enabled')),
+    ]
+
+    # definition of system default permissions for DEFAULT user
+    DEFAULT_USER_PERMISSIONS = [
+        'repository.read',
+        'group.read',
+        'usergroup.read',
+        'hg.create.repository',
+        'hg.repogroup.create.false',
+        'hg.usergroup.create.false',
+        'hg.create.write_on_repogroup.true',
+        'hg.fork.repository',
+        'hg.register.manual_activate',
+        'hg.extern_activate.auto',
+        'hg.inherit_default_perms.true',
+    ]
+
+    # defines which permissions are more important higher the more important
+    # Weight defines which permissions are more important.
+    # The higher number the more important.
+    PERM_WEIGHTS = {
+        'repository.none': 0,
+        'repository.read': 1,
+        'repository.write': 3,
+        'repository.admin': 4,
+
+        'group.none': 0,
+        'group.read': 1,
+        'group.write': 3,
+        'group.admin': 4,
+
+        'usergroup.none': 0,
+        'usergroup.read': 1,
+        'usergroup.write': 3,
+        'usergroup.admin': 4,
+
+        'hg.repogroup.create.false': 0,
+        'hg.repogroup.create.true': 1,
+
+        'hg.usergroup.create.false': 0,
+        'hg.usergroup.create.true': 1,
+
+        'hg.fork.none': 0,
+        'hg.fork.repository': 1,
+        'hg.create.none': 0,
+        'hg.create.repository': 1
+    }
+
+    permission_id = Column("permission_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
+    permission_name = Column("permission_name", String(255), nullable=True, unique=None, default=None)
+    permission_longname = Column("permission_longname", String(255), nullable=True, unique=None, default=None)
+
+    def __unicode__(self):
+        return u"<%s('%s:%s')>" % (
+            self.__class__.__name__, self.permission_id, self.permission_name
+        )
+
+    @classmethod
+    def get_by_key(cls, key):
+        return cls.query().filter(cls.permission_name == key).scalar()
+
+    @classmethod
+    def get_default_repo_perms(cls, user_id, repo_id=None):
+        q = Session().query(UserRepoToPerm, Repository, Permission)\
+            .join((Permission, UserRepoToPerm.permission_id == Permission.permission_id))\
+            .join((Repository, UserRepoToPerm.repository_id == Repository.repo_id))\
+            .filter(UserRepoToPerm.user_id == user_id)
+        if repo_id:
+            q = q.filter(UserRepoToPerm.repository_id == repo_id)
+        return q.all()
+
+    @classmethod
+    def get_default_repo_perms_from_user_group(cls, user_id, repo_id=None):
+        q = Session().query(UserGroupRepoToPerm, Repository, Permission)\
+            .join(
+                Permission,
+                UserGroupRepoToPerm.permission_id == Permission.permission_id)\
+            .join(
+                Repository,
+                UserGroupRepoToPerm.repository_id == Repository.repo_id)\
+            .join(
+                UserGroup,
+                UserGroupRepoToPerm.users_group_id ==
+                UserGroup.users_group_id)\
+            .join(
+                UserGroupMember,
+                UserGroupRepoToPerm.users_group_id ==
+                UserGroupMember.users_group_id)\
+            .filter(
+                UserGroupMember.user_id == user_id,
+                UserGroup.users_group_active == true())
+        if repo_id:
+            q = q.filter(UserGroupRepoToPerm.repository_id == repo_id)
+        return q.all()
+
+    @classmethod
+    def get_default_group_perms(cls, user_id, repo_group_id=None):
+        q = Session().query(UserRepoGroupToPerm, RepoGroup, Permission)\
+            .join((Permission, UserRepoGroupToPerm.permission_id == Permission.permission_id))\
+            .join((RepoGroup, UserRepoGroupToPerm.group_id == RepoGroup.group_id))\
+            .filter(UserRepoGroupToPerm.user_id == user_id)
+        if repo_group_id:
+            q = q.filter(UserRepoGroupToPerm.group_id == repo_group_id)
+        return q.all()
+
+    @classmethod
+    def get_default_group_perms_from_user_group(
+            cls, user_id, repo_group_id=None):
+        q = Session().query(UserGroupRepoGroupToPerm, RepoGroup, Permission)\
+            .join(
+                Permission,
+                UserGroupRepoGroupToPerm.permission_id ==
+                Permission.permission_id)\
+            .join(
+                RepoGroup,
+                UserGroupRepoGroupToPerm.group_id == RepoGroup.group_id)\
+            .join(
+                UserGroup,
+                UserGroupRepoGroupToPerm.users_group_id ==
+                UserGroup.users_group_id)\
+            .join(
+                UserGroupMember,
+                UserGroupRepoGroupToPerm.users_group_id ==
+                UserGroupMember.users_group_id)\
+            .filter(
+                UserGroupMember.user_id == user_id,
+                UserGroup.users_group_active == true())
+        if repo_group_id:
+            q = q.filter(UserGroupRepoGroupToPerm.group_id == repo_group_id)
+        return q.all()
+
+    @classmethod
+    def get_default_user_group_perms(cls, user_id, user_group_id=None):
+        q = Session().query(UserUserGroupToPerm, UserGroup, Permission)\
+            .join((Permission, UserUserGroupToPerm.permission_id == Permission.permission_id))\
+            .join((UserGroup, UserUserGroupToPerm.user_group_id == UserGroup.users_group_id))\
+            .filter(UserUserGroupToPerm.user_id == user_id)
+        if user_group_id:
+            q = q.filter(UserUserGroupToPerm.user_group_id == user_group_id)
+        return q.all()
+
+    @classmethod
+    def get_default_user_group_perms_from_user_group(
+            cls, user_id, user_group_id=None):
+        TargetUserGroup = aliased(UserGroup, name='target_user_group')
+        q = Session().query(UserGroupUserGroupToPerm, UserGroup, Permission)\
+            .join(
+                Permission,
+                UserGroupUserGroupToPerm.permission_id ==
+                Permission.permission_id)\
+            .join(
+                TargetUserGroup,
+                UserGroupUserGroupToPerm.target_user_group_id ==
+                TargetUserGroup.users_group_id)\
+            .join(
+                UserGroup,
+                UserGroupUserGroupToPerm.user_group_id ==
+                UserGroup.users_group_id)\
+            .join(
+                UserGroupMember,
+                UserGroupUserGroupToPerm.user_group_id ==
+                UserGroupMember.users_group_id)\
+            .filter(
+                UserGroupMember.user_id == user_id,
+                UserGroup.users_group_active == true())
+        if user_group_id:
+            q = q.filter(
+                UserGroupUserGroupToPerm.user_group_id == user_group_id)
+
+        return q.all()
+
+
+class UserRepoToPerm(Base, BaseModel):
+    __tablename__ = 'repo_to_perm'
+    __table_args__ = (
+        UniqueConstraint('user_id', 'repository_id', 'permission_id'),
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
+    )
+    repo_to_perm_id = Column("repo_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
+    user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)
+    permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
+    repository_id = Column("repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=False, unique=None, default=None)
+
+    user = relationship('User')
+    repository = relationship('Repository')
+    permission = relationship('Permission')
+
+    @classmethod
+    def create(cls, user, repository, permission):
+        n = cls()
+        n.user = user
+        n.repository = repository
+        n.permission = permission
+        Session().add(n)
+        return n
+
+    def __unicode__(self):
+        return u'<%s => %s >' % (self.user, self.repository)
+
+
+class UserUserGroupToPerm(Base, BaseModel):
+    __tablename__ = 'user_user_group_to_perm'
+    __table_args__ = (
+        UniqueConstraint('user_id', 'user_group_id', 'permission_id'),
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
+    )
+    user_user_group_to_perm_id = Column("user_user_group_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
+    user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)
+    permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
+    user_group_id = Column("user_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)
+
+    user = relationship('User')
+    user_group = relationship('UserGroup')
+    permission = relationship('Permission')
+
+    @classmethod
+    def create(cls, user, user_group, permission):
+        n = cls()
+        n.user = user
+        n.user_group = user_group
+        n.permission = permission
+        Session().add(n)
+        return n
+
+    def __unicode__(self):
+        return u'<%s => %s >' % (self.user, self.user_group)
+
+
+class UserToPerm(Base, BaseModel):
+    __tablename__ = 'user_to_perm'
+    __table_args__ = (
+        UniqueConstraint('user_id', 'permission_id'),
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
+    )
+    user_to_perm_id = Column("user_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
+    user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)
+    permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
+
+    user = relationship('User')
+    permission = relationship('Permission', lazy='joined')
+
+    def __unicode__(self):
+        return u'<%s => %s >' % (self.user, self.permission)
+
+
+class UserGroupRepoToPerm(Base, BaseModel):
+    __tablename__ = 'users_group_repo_to_perm'
+    __table_args__ = (
+        UniqueConstraint('repository_id', 'users_group_id', 'permission_id'),
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
+    )
+    users_group_to_perm_id = Column("users_group_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
+    users_group_id = Column("users_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)
+    permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
+    repository_id = Column("repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=False, unique=None, default=None)
+
+    users_group = relationship('UserGroup')
+    permission = relationship('Permission')
+    repository = relationship('Repository')
+
+    @classmethod
+    def create(cls, users_group, repository, permission):
+        n = cls()
+        n.users_group = users_group
+        n.repository = repository
+        n.permission = permission
+        Session().add(n)
+        return n
+
+    def __unicode__(self):
+        return u'<UserGroupRepoToPerm:%s => %s >' % (self.users_group, self.repository)
+
+
+class UserGroupUserGroupToPerm(Base, BaseModel):
+    __tablename__ = 'user_group_user_group_to_perm'
+    __table_args__ = (
+        UniqueConstraint('target_user_group_id', 'user_group_id', 'permission_id'),
+        CheckConstraint('target_user_group_id != user_group_id'),
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
+    )
+    user_group_user_group_to_perm_id = Column("user_group_user_group_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
+    target_user_group_id = Column("target_user_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)
+    permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
+    user_group_id = Column("user_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)
+
+    target_user_group = relationship('UserGroup', primaryjoin='UserGroupUserGroupToPerm.target_user_group_id==UserGroup.users_group_id')
+    user_group = relationship('UserGroup', primaryjoin='UserGroupUserGroupToPerm.user_group_id==UserGroup.users_group_id')
+    permission = relationship('Permission')
+
+    @classmethod
+    def create(cls, target_user_group, user_group, permission):
+        n = cls()
+        n.target_user_group = target_user_group
+        n.user_group = user_group
+        n.permission = permission
+        Session().add(n)
+        return n
+
+    def __unicode__(self):
+        return u'<UserGroupUserGroup:%s => %s >' % (self.target_user_group, self.user_group)
+
+
+class UserGroupToPerm(Base, BaseModel):
+    __tablename__ = 'users_group_to_perm'
+    __table_args__ = (
+        UniqueConstraint('users_group_id', 'permission_id',),
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
+    )
+    users_group_to_perm_id = Column("users_group_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
+    users_group_id = Column("users_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)
+    permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
+
+    users_group = relationship('UserGroup')
+    permission = relationship('Permission')
+
+
+class UserRepoGroupToPerm(Base, BaseModel):
+    __tablename__ = 'user_repo_group_to_perm'
+    __table_args__ = (
+        UniqueConstraint('user_id', 'group_id', 'permission_id'),
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
+    )
+
+    group_to_perm_id = Column("group_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
+    user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)
+    group_id = Column("group_id", Integer(), ForeignKey('groups.group_id'), nullable=False, unique=None, default=None)
+    permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
+
+    user = relationship('User')
+    group = relationship('RepoGroup')
+    permission = relationship('Permission')
+
+    @classmethod
+    def create(cls, user, repository_group, permission):
+        n = cls()
+        n.user = user
+        n.group = repository_group
+        n.permission = permission
+        Session().add(n)
+        return n
+
+
+class UserGroupRepoGroupToPerm(Base, BaseModel):
+    __tablename__ = 'users_group_repo_group_to_perm'
+    __table_args__ = (
+        UniqueConstraint('users_group_id', 'group_id'),
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
+    )
+
+    users_group_repo_group_to_perm_id = Column("users_group_repo_group_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
+    users_group_id = Column("users_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)
+    group_id = Column("group_id", Integer(), ForeignKey('groups.group_id'), nullable=False, unique=None, default=None)
+    permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
+
+    users_group = relationship('UserGroup')
+    permission = relationship('Permission')
+    group = relationship('RepoGroup')
+
+    @classmethod
+    def create(cls, user_group, repository_group, permission):
+        n = cls()
+        n.users_group = user_group
+        n.group = repository_group
+        n.permission = permission
+        Session().add(n)
+        return n
+
+    def __unicode__(self):
+        return u'<UserGroupRepoGroupToPerm:%s => %s >' % (self.users_group, self.group)
+
+
+class Statistics(Base, BaseModel):
+    __tablename__ = 'statistics'
+    __table_args__ = (
+         UniqueConstraint('repository_id'),
+         {'extend_existing': True, 'mysql_engine': 'InnoDB',
+          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
+    )
+    stat_id = Column("stat_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
+    repository_id = Column("repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=False, unique=True, default=None)
+    stat_on_revision = Column("stat_on_revision", Integer(), nullable=False)
+    commit_activity = Column("commit_activity", LargeBinary(1000000), nullable=False)#JSON data
+    commit_activity_combined = Column("commit_activity_combined", LargeBinary(), nullable=False)#JSON data
+    languages = Column("languages", LargeBinary(1000000), nullable=False)#JSON data
+
+    repository = relationship('Repository', single_parent=True)
+
+
+class UserFollowing(Base, BaseModel):
+    __tablename__ = 'user_followings'
+    __table_args__ = (
+        UniqueConstraint('user_id', 'follows_repository_id'),
+        UniqueConstraint('user_id', 'follows_user_id'),
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
+    )
+
+    user_following_id = Column("user_following_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
+    user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)
+    follows_repo_id = Column("follows_repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=True, unique=None, default=None)
+    follows_user_id = Column("follows_user_id", Integer(), ForeignKey('users.user_id'), nullable=True, unique=None, default=None)
+    follows_from = Column('follows_from', DateTime(timezone=False), nullable=True, unique=None, default=datetime.datetime.now)
+
+    user = relationship('User', primaryjoin='User.user_id==UserFollowing.user_id')
+
+    follows_user = relationship('User', primaryjoin='User.user_id==UserFollowing.follows_user_id')
+    follows_repository = relationship('Repository', order_by='Repository.repo_name')
+
+    @classmethod
+    def get_repo_followers(cls, repo_id):
+        return cls.query().filter(cls.follows_repo_id == repo_id)
+
+
+class CacheKey(Base, BaseModel):
+    __tablename__ = 'cache_invalidation'
+    __table_args__ = (
+        UniqueConstraint('cache_key'),
+        Index('key_idx', 'cache_key'),
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
+    )
+    CACHE_TYPE_ATOM = 'ATOM'
+    CACHE_TYPE_RSS = 'RSS'
+    CACHE_TYPE_README = 'README'
+
+    cache_id = Column("cache_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
+    cache_key = Column("cache_key", String(255), nullable=True, unique=None, default=None)
+    cache_args = Column("cache_args", String(255), nullable=True, unique=None, default=None)
+    cache_active = Column("cache_active", Boolean(), nullable=True, unique=None, default=False)
+
+    def __init__(self, cache_key, cache_args=''):
+        self.cache_key = cache_key
+        self.cache_args = cache_args
+        self.cache_active = False
+
+    def __unicode__(self):
+        return u"<%s('%s:%s[%s]')>" % (
+            self.__class__.__name__,
+            self.cache_id, self.cache_key, self.cache_active)
+
+    def _cache_key_partition(self):
+        prefix, repo_name, suffix = self.cache_key.partition(self.cache_args)
+        return prefix, repo_name, suffix
+
+    def get_prefix(self):
+        """
+        Try to extract prefix from existing cache key. The key could consist
+        of prefix, repo_name, suffix
+        """
+        # this returns prefix, repo_name, suffix
+        return self._cache_key_partition()[0]
+
+    def get_suffix(self):
+        """
+        get suffix that might have been used in _get_cache_key to
+        generate self.cache_key. Only used for informational purposes
+        in repo_edit.html.
+        """
+        # prefix, repo_name, suffix
+        return self._cache_key_partition()[2]
+
+    @classmethod
+    def delete_all_cache(cls):
+        """
+        Delete all cache keys from database.
+        Should only be run when all instances are down and all entries
+        thus stale.
+        """
+        cls.query().delete()
+        Session().commit()
+
+    @classmethod
+    def get_cache_key(cls, repo_name, cache_type):
+        """
+
+        Generate a cache key for this process of RhodeCode instance.
+        Prefix most likely will be process id or maybe explicitly set
+        instance_id from .ini file.
+        """
+        import rhodecode
+        prefix = safe_unicode(rhodecode.CONFIG.get('instance_id') or '')
+
+        repo_as_unicode = safe_unicode(repo_name)
+        key = u'{}_{}'.format(repo_as_unicode, cache_type) \
+            if cache_type else repo_as_unicode
+
+        return u'{}{}'.format(prefix, key)
+
+    @classmethod
+    def set_invalidate(cls, repo_name, delete=False):
+        """
+        Mark all caches of a repo as invalid in the database.
+        """
+
+        try:
+            qry = Session().query(cls).filter(cls.cache_args == repo_name)
+            if delete:
+                log.debug('cache objects deleted for repo %s',
+                          safe_str(repo_name))
+                qry.delete()
+            else:
+                log.debug('cache objects marked as invalid for repo %s',
+                          safe_str(repo_name))
+                qry.update({"cache_active": False})
+
+            Session().commit()
+        except Exception:
+            log.exception(
+                'Cache key invalidation failed for repository %s',
+                safe_str(repo_name))
+            Session().rollback()
+
+    @classmethod
+    def get_active_cache(cls, cache_key):
+        inv_obj = cls.query().filter(cls.cache_key == cache_key).scalar()
+        if inv_obj:
+            return inv_obj
+        return None
+
+    @classmethod
+    def repo_context_cache(cls, compute_func, repo_name, cache_type,
+                           thread_scoped=False):
+        """
+        @cache_region('long_term')
+        def _heavy_calculation(cache_key):
+            return 'result'
+
+        cache_context = CacheKey.repo_context_cache(
+            _heavy_calculation, repo_name, cache_type)
+
+        with cache_context as context:
+            context.invalidate()
+            computed = context.compute()
+
+        assert computed == 'result'
+        """
+        from rhodecode.lib import caches
+        return caches.InvalidationContext(
+            compute_func, repo_name, cache_type, thread_scoped=thread_scoped)
+
+
+class ChangesetComment(Base, BaseModel):
+    __tablename__ = 'changeset_comments'
+    __table_args__ = (
+        Index('cc_revision_idx', 'revision'),
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
+    )
+
+    COMMENT_OUTDATED = u'comment_outdated'
+
+    comment_id = Column('comment_id', Integer(), nullable=False, primary_key=True)
+    repo_id = Column('repo_id', Integer(), ForeignKey('repositories.repo_id'), nullable=False)
+    revision = Column('revision', String(40), nullable=True)
+    pull_request_id = Column("pull_request_id", Integer(), ForeignKey('pull_requests.pull_request_id'), nullable=True)
+    pull_request_version_id = Column("pull_request_version_id", Integer(), ForeignKey('pull_request_versions.pull_request_version_id'), nullable=True)
+    line_no = Column('line_no', Unicode(10), nullable=True)
+    hl_lines = Column('hl_lines', Unicode(512), nullable=True)
+    f_path = Column('f_path', Unicode(1000), nullable=True)
+    user_id = Column('user_id', Integer(), ForeignKey('users.user_id'), nullable=False)
+    text = Column('text', UnicodeText().with_variant(UnicodeText(25000), 'mysql'), nullable=False)
+    created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
+    modified_at = Column('modified_at', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
+    renderer = Column('renderer', Unicode(64), nullable=True)
+    display_state = Column('display_state',  Unicode(128), nullable=True)
+
+    author = relationship('User', lazy='joined')
+    repo = relationship('Repository')
+    status_change = relationship('ChangesetStatus', cascade="all, delete, delete-orphan")
+    pull_request = relationship('PullRequest', lazy='joined')
+    pull_request_version = relationship('PullRequestVersion')
+
+    @classmethod
+    def get_users(cls, revision=None, pull_request_id=None):
+        """
+        Returns user associated with this ChangesetComment. ie those
+        who actually commented
+
+        :param cls:
+        :param revision:
+        """
+        q = Session().query(User)\
+                .join(ChangesetComment.author)
+        if revision:
+            q = q.filter(cls.revision == revision)
+        elif pull_request_id:
+            q = q.filter(cls.pull_request_id == pull_request_id)
+        return q.all()
+
+    def render(self, mentions=False):
+        from rhodecode.lib import helpers as h
+        return h.render(self.text, renderer=self.renderer, mentions=mentions)
+
+    def __repr__(self):
+        if self.comment_id:
+            return '<DB:ChangesetComment #%s>' % self.comment_id
+        else:
+            return '<DB:ChangesetComment at %#x>' % id(self)
+
+
+class ChangesetStatus(Base, BaseModel):
+    __tablename__ = 'changeset_statuses'
+    __table_args__ = (
+        Index('cs_revision_idx', 'revision'),
+        Index('cs_version_idx', 'version'),
+        UniqueConstraint('repo_id', 'revision', 'version'),
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
+    )
+    STATUS_NOT_REVIEWED = DEFAULT = 'not_reviewed'
+    STATUS_APPROVED = 'approved'
+    STATUS_REJECTED = 'rejected'
+    STATUS_UNDER_REVIEW = 'under_review'
+
+    STATUSES = [
+        (STATUS_NOT_REVIEWED, _("Not Reviewed")),  # (no icon) and default
+        (STATUS_APPROVED, _("Approved")),
+        (STATUS_REJECTED, _("Rejected")),
+        (STATUS_UNDER_REVIEW, _("Under Review")),
+    ]
+
+    changeset_status_id = Column('changeset_status_id', Integer(), nullable=False, primary_key=True)
+    repo_id = Column('repo_id', Integer(), ForeignKey('repositories.repo_id'), nullable=False)
+    user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None)
+    revision = Column('revision', String(40), nullable=False)
+    status = Column('status', String(128), nullable=False, default=DEFAULT)
+    changeset_comment_id = Column('changeset_comment_id', Integer(), ForeignKey('changeset_comments.comment_id'))
+    modified_at = Column('modified_at', DateTime(), nullable=False, default=datetime.datetime.now)
+    version = Column('version', Integer(), nullable=False, default=0)
+    pull_request_id = Column("pull_request_id", Integer(), ForeignKey('pull_requests.pull_request_id'), nullable=True)
+
+    author = relationship('User', lazy='joined')
+    repo = relationship('Repository')
+    comment = relationship('ChangesetComment', lazy='joined')
+    pull_request = relationship('PullRequest', lazy='joined')
+
+    def __unicode__(self):
+        return u"<%s('%s[%s]:%s')>" % (
+            self.__class__.__name__,
+            self.status, self.version, self.author
+        )
+
+    @classmethod
+    def get_status_lbl(cls, value):
+        return dict(cls.STATUSES).get(value)
+
+    @property
+    def status_lbl(self):
+        return ChangesetStatus.get_status_lbl(self.status)
+
+
+class _PullRequestBase(BaseModel):
+    """
+    Common attributes of pull request and version entries.
+    """
+
+    # .status values
+    STATUS_NEW = u'new'
+    STATUS_OPEN = u'open'
+    STATUS_CLOSED = u'closed'
+
+    title = Column('title', Unicode(255), nullable=True)
+    description = Column(
+        'description', UnicodeText().with_variant(UnicodeText(10240), 'mysql'),
+        nullable=True)
+    # new/open/closed status of pull request (not approve/reject/etc)
+    status = Column('status', Unicode(255), nullable=False, default=STATUS_NEW)
+    created_on = Column(
+        'created_on', DateTime(timezone=False), nullable=False,
+        default=datetime.datetime.now)
+    updated_on = Column(
+        'updated_on', DateTime(timezone=False), nullable=False,
+        default=datetime.datetime.now)
+
+    @declared_attr
+    def user_id(cls):
+        return Column(
+            "user_id", Integer(), ForeignKey('users.user_id'), nullable=False,
+            unique=None)
+
+    # 500 revisions max
+    _revisions = Column(
+        'revisions', UnicodeText().with_variant(UnicodeText(20500), 'mysql'))
+
+    @declared_attr
+    def source_repo_id(cls):
+        # TODO: dan: rename column to source_repo_id
+        return Column(
+            'org_repo_id', Integer(), ForeignKey('repositories.repo_id'),
+            nullable=False)
+
+    source_ref = Column('org_ref', Unicode(255), nullable=False)
+
+    @declared_attr
+    def target_repo_id(cls):
+        # TODO: dan: rename column to target_repo_id
+        return Column(
+            'other_repo_id', Integer(), ForeignKey('repositories.repo_id'),
+            nullable=False)
+
+    target_ref = Column('other_ref', Unicode(255), nullable=False)
+
+    # TODO: dan: rename column to last_merge_source_rev
+    _last_merge_source_rev = Column(
+        'last_merge_org_rev', String(40), nullable=True)
+    # TODO: dan: rename column to last_merge_target_rev
+    _last_merge_target_rev = Column(
+        'last_merge_other_rev', String(40), nullable=True)
+    _last_merge_status = Column('merge_status', Integer(), nullable=True)
+    merge_rev = Column('merge_rev', String(40), nullable=True)
+
+    @hybrid_property
+    def revisions(self):
+        return self._revisions.split(':') if self._revisions else []
+
+    @revisions.setter
+    def revisions(self, val):
+        self._revisions = ':'.join(val)
+
+    @declared_attr
+    def author(cls):
+        return relationship('User', lazy='joined')
+
+    @declared_attr
+    def source_repo(cls):
+        return relationship(
+            'Repository',
+            primaryjoin='%s.source_repo_id==Repository.repo_id' % cls.__name__)
+
+    @property
+    def source_ref_parts(self):
+        refs = self.source_ref.split(':')
+        return Reference(refs[0], refs[1], refs[2])
+
+    @declared_attr
+    def target_repo(cls):
+        return relationship(
+            'Repository',
+            primaryjoin='%s.target_repo_id==Repository.repo_id' % cls.__name__)
+
+    @property
+    def target_ref_parts(self):
+        refs = self.target_ref.split(':')
+        return Reference(refs[0], refs[1], refs[2])
+
+
+class PullRequest(Base, _PullRequestBase):
+    __tablename__ = 'pull_requests'
+    __table_args__ = (
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
+    )
+
+    pull_request_id = Column(
+        'pull_request_id', Integer(), nullable=False, primary_key=True)
+
+    def __repr__(self):
+        if self.pull_request_id:
+            return '<DB:PullRequest #%s>' % self.pull_request_id
+        else:
+            return '<DB:PullRequest at %#x>' % id(self)
+
+    reviewers = relationship('PullRequestReviewers',
+                             cascade="all, delete, delete-orphan")
+    statuses = relationship('ChangesetStatus')
+    comments = relationship('ChangesetComment',
+                            cascade="all, delete, delete-orphan")
+    versions = relationship('PullRequestVersion',
+                            cascade="all, delete, delete-orphan")
+
+    def is_closed(self):
+        return self.status == self.STATUS_CLOSED
+
+    def get_api_data(self):
+        from rhodecode.model.pull_request import PullRequestModel
+        pull_request = self
+        merge_status = PullRequestModel().merge_status(pull_request)
+        data = {
+            'pull_request_id': pull_request.pull_request_id,
+            'url': url('pullrequest_show', repo_name=self.target_repo.repo_name,
+                                       pull_request_id=self.pull_request_id,
+                                       qualified=True),
+            'title': pull_request.title,
+            'description': pull_request.description,
+            'status': pull_request.status,
+            'created_on': pull_request.created_on,
+            'updated_on': pull_request.updated_on,
+            'commit_ids': pull_request.revisions,
+            'review_status': pull_request.calculated_review_status(),
+            'mergeable': {
+                'status': merge_status[0],
+                'message': unicode(merge_status[1]),
+            },
+            'source': {
+                'clone_url': pull_request.source_repo.clone_url(),
+                'repository': pull_request.source_repo.repo_name,
+                'reference': {
+                    'name': pull_request.source_ref_parts.name,
+                    'type': pull_request.source_ref_parts.type,
+                    'commit_id': pull_request.source_ref_parts.commit_id,
+                },
+            },
+            'target': {
+                'clone_url': pull_request.target_repo.clone_url(),
+                'repository': pull_request.target_repo.repo_name,
+                'reference': {
+                    'name': pull_request.target_ref_parts.name,
+                    'type': pull_request.target_ref_parts.type,
+                    'commit_id': pull_request.target_ref_parts.commit_id,
+                },
+            },
+            'author': pull_request.author.get_api_data(include_secrets=False,
+                                                       details='basic'),
+            'reviewers': [
+                {
+                    'user': reviewer.get_api_data(include_secrets=False,
+                                                  details='basic'),
+                    'review_status': st[0][1].status if st else 'not_reviewed',
+                }
+                for reviewer, st in pull_request.reviewers_statuses()
+            ]
+        }
+
+        return data
+
+    def __json__(self):
+        return {
+            'revisions': self.revisions,
+        }
+
+    def calculated_review_status(self):
+        # TODO: anderson: 13.05.15 Used only on templates/my_account_pullrequests.html
+        # because it's tricky on how to use ChangesetStatusModel from there
+        warnings.warn("Use calculated_review_status from ChangesetStatusModel", DeprecationWarning)
+        from rhodecode.model.changeset_status import ChangesetStatusModel
+        return ChangesetStatusModel().calculated_review_status(self)
+
+    def reviewers_statuses(self):
+        warnings.warn("Use reviewers_statuses from ChangesetStatusModel", DeprecationWarning)
+        from rhodecode.model.changeset_status import ChangesetStatusModel
+        return ChangesetStatusModel().reviewers_statuses(self)
+
+
+class PullRequestVersion(Base, _PullRequestBase):
+    __tablename__ = 'pull_request_versions'
+    __table_args__ = (
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
+    )
+
+    pull_request_version_id = Column(
+        'pull_request_version_id', Integer(), nullable=False, primary_key=True)
+    pull_request_id = Column(
+        'pull_request_id', Integer(),
+        ForeignKey('pull_requests.pull_request_id'), nullable=False)
+    pull_request = relationship('PullRequest')
+
+    def __repr__(self):
+        if self.pull_request_version_id:
+            return '<DB:PullRequestVersion #%s>' % self.pull_request_version_id
+        else:
+            return '<DB:PullRequestVersion at %#x>' % id(self)
+
+
+class PullRequestReviewers(Base, BaseModel):
+    __tablename__ = 'pull_request_reviewers'
+    __table_args__ = (
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
+    )
+
+    def __init__(self, user=None, pull_request=None):
+        self.user = user
+        self.pull_request = pull_request
+
+    pull_requests_reviewers_id = Column(
+        'pull_requests_reviewers_id', Integer(), nullable=False,
+        primary_key=True)
+    pull_request_id = Column(
+        "pull_request_id", Integer(),
+        ForeignKey('pull_requests.pull_request_id'), nullable=False)
+    user_id = Column(
+        "user_id", Integer(), ForeignKey('users.user_id'), nullable=True)
+
+    user = relationship('User')
+    pull_request = relationship('PullRequest')
+
+
+class Notification(Base, BaseModel):
+    __tablename__ = 'notifications'
+    __table_args__ = (
+        Index('notification_type_idx', 'type'),
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
+    )
+
+    TYPE_CHANGESET_COMMENT = u'cs_comment'
+    TYPE_MESSAGE = u'message'
+    TYPE_MENTION = u'mention'
+    TYPE_REGISTRATION = u'registration'
+    TYPE_PULL_REQUEST = u'pull_request'
+    TYPE_PULL_REQUEST_COMMENT = u'pull_request_comment'
+
+    notification_id = Column('notification_id', Integer(), nullable=False, primary_key=True)
+    subject = Column('subject', Unicode(512), nullable=True)
+    body = Column('body', UnicodeText().with_variant(UnicodeText(50000), 'mysql'), nullable=True)
+    created_by = Column("created_by", Integer(), ForeignKey('users.user_id'), nullable=True)
+    created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
+    type_ = Column('type', Unicode(255))
+
+    created_by_user = relationship('User')
+    notifications_to_users = relationship('UserNotification', lazy='joined',
+                                          cascade="all, delete, delete-orphan")
+
+    @property
+    def recipients(self):
+        return [x.user for x in UserNotification.query()\
+                .filter(UserNotification.notification == self)\
+                .order_by(UserNotification.user_id.asc()).all()]
+
+    @classmethod
+    def create(cls, created_by, subject, body, recipients, type_=None):
+        if type_ is None:
+            type_ = Notification.TYPE_MESSAGE
+
+        notification = cls()
+        notification.created_by_user = created_by
+        notification.subject = subject
+        notification.body = body
+        notification.type_ = type_
+        notification.created_on = datetime.datetime.now()
+
+        for u in recipients:
+            assoc = UserNotification()
+            assoc.notification = notification
+
+            # if created_by is inside recipients mark his notification
+            # as read
+            if u.user_id == created_by.user_id:
+                assoc.read = True
+
+            u.notifications.append(assoc)
+        Session().add(notification)
+
+        return notification
+
+    @property
+    def description(self):
+        from rhodecode.model.notification import NotificationModel
+        return NotificationModel().make_description(self)
+
+
+class UserNotification(Base, BaseModel):
+    __tablename__ = 'user_to_notification'
+    __table_args__ = (
+        UniqueConstraint('user_id', 'notification_id'),
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
+    )
+    user_id = Column('user_id', Integer(), ForeignKey('users.user_id'), primary_key=True)
+    notification_id = Column("notification_id", Integer(), ForeignKey('notifications.notification_id'), primary_key=True)
+    read = Column('read', Boolean, default=False)
+    sent_on = Column('sent_on', DateTime(timezone=False), nullable=True, unique=None)
+
+    user = relationship('User', lazy="joined")
+    notification = relationship('Notification', lazy="joined",
+                                order_by=lambda: Notification.created_on.desc(),)
+
+    def mark_as_read(self):
+        self.read = True
+        Session().add(self)
+
+
+class Gist(Base, BaseModel):
+    __tablename__ = 'gists'
+    __table_args__ = (
+        Index('g_gist_access_id_idx', 'gist_access_id'),
+        Index('g_created_on_idx', 'created_on'),
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
+    )
+    GIST_PUBLIC = u'public'
+    GIST_PRIVATE = u'private'
+    DEFAULT_FILENAME = u'gistfile1.txt'
+
+    ACL_LEVEL_PUBLIC = u'acl_public'
+    ACL_LEVEL_PRIVATE = u'acl_private'
+
+    gist_id = Column('gist_id', Integer(), primary_key=True)
+    gist_access_id = Column('gist_access_id', Unicode(250))
+    gist_description = Column('gist_description', UnicodeText().with_variant(UnicodeText(1024), 'mysql'))
+    gist_owner = Column('user_id', Integer(), ForeignKey('users.user_id'), nullable=True)
+    gist_expires = Column('gist_expires', Float(53), nullable=False)
+    gist_type = Column('gist_type', Unicode(128), nullable=False)
+    created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
+    modified_at = Column('modified_at', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
+    acl_level = Column('acl_level', Unicode(128), nullable=True)
+
+    owner = relationship('User')
+
+    def __repr__(self):
+        return '<Gist:[%s]%s>' % (self.gist_type, self.gist_access_id)
+
+    @classmethod
+    def get_or_404(cls, id_):
+        res = cls.query().filter(cls.gist_access_id == id_).scalar()
+        if not res:
+            raise HTTPNotFound
+        return res
+
+    @classmethod
+    def get_by_access_id(cls, gist_access_id):
+        return cls.query().filter(cls.gist_access_id == gist_access_id).scalar()
+
+    def gist_url(self):
+        import rhodecode
+        alias_url = rhodecode.CONFIG.get('gist_alias_url')
+        if alias_url:
+            return alias_url.replace('{gistid}', self.gist_access_id)
+
+        return url('gist', gist_id=self.gist_access_id, qualified=True)
+
+    @classmethod
+    def base_path(cls):
+        """
+        Returns base path when all gists are stored
+
+        :param cls:
+        """
+        from rhodecode.model.gist import GIST_STORE_LOC
+        q = Session().query(RhodeCodeUi)\
+            .filter(RhodeCodeUi.ui_key == URL_SEP)
+        q = q.options(FromCache("sql_cache_short", "repository_repo_path"))
+        return os.path.join(q.one().ui_value, GIST_STORE_LOC)
+
+    def get_api_data(self):
+        """
+        Common function for generating gist related data for API
+        """
+        gist = self
+        data = {
+            'gist_id': gist.gist_id,
+            'type': gist.gist_type,
+            'access_id': gist.gist_access_id,
+            'description': gist.gist_description,
+            'url': gist.gist_url(),
+            'expires': gist.gist_expires,
+            'created_on': gist.created_on,
+            'modified_at': gist.modified_at,
+            'content': None,
+            'acl_level': gist.acl_level,
+        }
+        return data
+
+    def __json__(self):
+        data = dict(
+        )
+        data.update(self.get_api_data())
+        return data
+    # SCM functions
+
+    def scm_instance(self, **kwargs):
+        full_repo_path = os.path.join(self.base_path(), self.gist_access_id)
+        return get_vcs_instance(
+            repo_path=safe_str(full_repo_path), create=False)
+
+
+class DbMigrateVersion(Base, BaseModel):
+    __tablename__ = 'db_migrate_version'
+    __table_args__ = (
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
+    )
+    repository_id = Column('repository_id', String(250), primary_key=True)
+    repository_path = Column('repository_path', Text)
+    version = Column('version', Integer)
+
+
+class ExternalIdentity(Base, BaseModel):
+    __tablename__ = 'external_identities'
+    __table_args__ = (
+        Index('local_user_id_idx', 'local_user_id'),
+        Index('external_id_idx', 'external_id'),
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8'})
+
+    external_id = Column('external_id', Unicode(255), default=u'',
+                         primary_key=True)
+    external_username = Column('external_username', Unicode(1024), default=u'')
+    local_user_id = Column('local_user_id', Integer(),
+                           ForeignKey('users.user_id'), primary_key=True)
+    provider_name = Column('provider_name', Unicode(255), default=u'',
+                           primary_key=True)
+    access_token = Column('access_token', String(1024), default=u'')
+    alt_token = Column('alt_token', String(1024), default=u'')
+    token_secret = Column('token_secret', String(1024), default=u'')
+
+    @classmethod
+    def by_external_id_and_provider(cls, external_id, provider_name,
+                                    local_user_id=None):
+        """
+        Returns ExternalIdentity instance based on search params
+
+        :param external_id:
+        :param provider_name:
+        :return: ExternalIdentity
+        """
+        query = cls.query()
+        query = query.filter(cls.external_id == external_id)
+        query = query.filter(cls.provider_name == provider_name)
+        if local_user_id:
+            query = query.filter(cls.local_user_id == local_user_id)
+        return query.first()
+
+    @classmethod
+    def user_by_external_id_and_provider(cls, external_id, provider_name):
+        """
+        Returns User instance based on search params
+
+        :param external_id:
+        :param provider_name:
+        :return: User
+        """
+        query = User.query()
+        query = query.filter(cls.external_id == external_id)
+        query = query.filter(cls.provider_name == provider_name)
+        query = query.filter(User.user_id == cls.local_user_id)
+        return query.first()
+
+    @classmethod
+    def by_local_user_id(cls, local_user_id):
+        """
+        Returns all tokens for user
+
+        :param local_user_id:
+        :return: ExternalIdentity
+        """
+        query = cls.query()
+        query = query.filter(cls.local_user_id == local_user_id)
+        return query
+
+
+class Integration(Base, BaseModel):
+    __tablename__ = 'integrations'
+    __table_args__ = (
+        {'extend_existing': True, 'mysql_engine': 'InnoDB',
+         'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
+    )
+
+    integration_id = Column('integration_id', Integer(), primary_key=True)
+    integration_type = Column('integration_type', String(255))
+    enabled = Column('enabled', Boolean(), nullable=False)
+    name = Column('name', String(255), nullable=False)
+    child_repos_only = Column('child_repos_only', Boolean(), nullable=True)
+
+    settings = Column(
+        'settings_json', MutationObj.as_mutable(
+            JsonType(dialect_map=dict(mysql=UnicodeText(16384)))))
+    repo_id = Column(
+        'repo_id', Integer(), ForeignKey('repositories.repo_id'),
+        nullable=True, unique=None, default=None)
+    repo = relationship('Repository', lazy='joined')
+
+    repo_group_id = Column(
+        'repo_group_id', Integer(), ForeignKey('groups.group_id'),
+        nullable=True, unique=None, default=None)
+    repo_group = relationship('RepoGroup', lazy='joined')
+
+    @hybrid_property
+    def scope(self):
+        if self.repo:
+            return self.repo
+        if self.repo_group:
+            return self.repo_group
+        if self.child_repos_only:
+            return 'root_repos'
+        return 'global'
+
+    @scope.setter
+    def scope(self, value):
+        self.repo = None
+        self.repo_id = None
+        self.repo_group_id = None
+        self.repo_group = None
+        self.child_repos_only = None
+        if isinstance(value, Repository):
+            self.repo = value
+        elif isinstance(value, RepoGroup):
+            self.repo_group = value
+        elif value == 'root_repos':
+            self.child_repos_only = True
+        elif value == 'global':
+            pass
+        else:
+            raise Exception("invalid scope: %s, must be one of "
+                "['global', 'root_repos', <RepoGroup>. <Repository>]" % value)
+
+    def __repr__(self):
+        return '<Integration(%r, %r)>' % (self.integration_type, self.scope)

rhodecode/lib/dbmigrate/versions/057_version_4_4_0.py

@@ -0,0 +1,35 b''
+import logging
+import datetime
+
+from sqlalchemy import *
+from sqlalchemy.exc import DatabaseError
+from sqlalchemy.orm import relation, backref, class_mapper, joinedload
+from sqlalchemy.orm.session import Session
+from sqlalchemy.ext.declarative import declarative_base
+
+from rhodecode.lib.dbmigrate.migrate import *
+from rhodecode.lib.dbmigrate.migrate.changeset import *
+from rhodecode.lib.utils2 import str2bool
+
+from rhodecode.model.meta import Base
+from rhodecode.model import meta
+from rhodecode.lib.dbmigrate.versions import _reset_base, notify
+
+log = logging.getLogger(__name__)
+
+
+def upgrade(migrate_engine):
+    """
+    Upgrade operations go here.
+    Don't create your own engine; bind migrate_engine to your metadata
+    """
+    _reset_base(migrate_engine)
+    from rhodecode.lib.dbmigrate.schema import db_4_4_0_1
+
+    tbl = db_4_4_0_1.Integration.__table__
+    child_repos_only = db_4_4_0_1.Integration.child_repos_only
+    child_repos_only.create(table=tbl)
+
+def downgrade(migrate_engine):
+    meta = MetaData()
+    meta.bind = migrate_engine

rhodecode/__init__.py

@@ -1,62 +1,62 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2016  RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 
 RhodeCode, a web based repository management software
 versioning implementation: http://www.python.org/dev/peps/pep-0386/
 """
 
 import os
 import sys
 import platform
 
 VERSION = tuple(open(os.path.join(
     os.path.dirname(__file__), 'VERSION')).read().split('.'))
 
 BACKENDS = {
     'hg': 'Mercurial repository',
     'git': 'Git repository',
     'svn': 'Subversion repository',
 }
 
 CELERY_ENABLED = False
 CELERY_EAGER = False
 
 # link to config for pylons
 CONFIG = {}
 
 # Populated with the settings dictionary from application init in
 # rhodecode.conf.environment.load_pyramid_environment
 PYRAMID_SETTINGS = {}
 
 # Linked module for extensions
 EXTENSIONS = {}
 
 __version__ = ('.'.join((str(each) for each in VERSION[:3])))
-__dbversion__ = 56  # defines current db version for migrations
+__dbversion__ = 57  # defines current db version for migrations
 __platform__ = platform.system()
 __license__ = 'AGPLv3, and Commercial License'
 __author__ = 'RhodeCode GmbH'
 __url__ = 'http://rhodecode.com'
 
 is_windows = __platform__ in ['Windows']
 is_unix = not is_windows
 is_test = False

rhodecode/config/routing.py

@@ -1,1159 +1,1160 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2016  RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 Routes configuration
 
 The more specific and detailed routes should be defined first so they
 may take precedent over the more generic routes. For more information
 refer to the routes manual at http://routes.groovie.org/docs/
 
 IMPORTANT: if you change any routing here, make sure to take a look at lib/base.py
 and _route_name variable which uses some of stored naming here to do redirects.
 """
 import os
 import re
 from routes import Mapper
 
 from rhodecode.config import routing_links
 
 # prefix for non repository related links needs to be prefixed with `/`
 ADMIN_PREFIX = '/_admin'
 STATIC_FILE_PREFIX = '/_static'
 
 # Default requirements for URL parts
 URL_NAME_REQUIREMENTS = {
     # group name can have a slash in them, but they must not end with a slash
     'group_name': r'.*?[^/]',
+    'repo_group_name': r'.*?[^/]',
     # repo names can have a slash in them, but they must not end with a slash
     'repo_name': r'.*?[^/]',
     # file path eats up everything at the end
     'f_path': r'.*',
     # reference types
     'source_ref_type': '(branch|book|tag|rev|\%\(source_ref_type\)s)',
     'target_ref_type': '(branch|book|tag|rev|\%\(target_ref_type\)s)',
 }
 
 
 def add_route_requirements(route_path, requirements):
     """
     Adds regex requirements to pyramid routes using a mapping dict
 
     >>> add_route_requirements('/{action}/{id}', {'id': r'\d+'})
     '/{action}/{id:\d+}'
 
      """
     for key, regex in requirements.items():
         route_path = route_path.replace('{%s}' % key, '{%s:%s}' % (key, regex))
     return route_path
 
 
 class JSRoutesMapper(Mapper):
     """
     Wrapper for routes.Mapper to make pyroutes compatible url definitions
     """
     _named_route_regex = re.compile(r'^[a-z-_0-9A-Z]+$')
     _argument_prog = re.compile('\{(.*?)\}|:\((.*)\)')
     def __init__(self, *args, **kw):
         super(JSRoutesMapper, self).__init__(*args, **kw)
         self._jsroutes = []
 
     def connect(self, *args, **kw):
         """
         Wrapper for connect to take an extra argument jsroute=True
 
         :param jsroute: boolean, if True will add the route to the pyroutes list
         """
         if kw.pop('jsroute', False):
             if not self._named_route_regex.match(args[0]):
                 raise Exception('only named routes can be added to pyroutes')
             self._jsroutes.append(args[0])
 
         super(JSRoutesMapper, self).connect(*args, **kw)
 
     def _extract_route_information(self, route):
         """
         Convert a route into tuple(name, path, args), eg:
             ('user_profile', '/profile/%(username)s', ['username'])
         """
         routepath = route.routepath
         def replace(matchobj):
             if matchobj.group(1):
                 return "%%(%s)s" % matchobj.group(1).split(':')[0]
             else:
                 return "%%(%s)s" % matchobj.group(2)
 
         routepath = self._argument_prog.sub(replace, routepath)
         return (
             route.name,
             routepath,
             [(arg[0].split(':')[0] if arg[0] != '' else arg[1])
               for arg in self._argument_prog.findall(route.routepath)]
         )
 
     def jsroutes(self):
         """
         Return a list of pyroutes.js compatible routes
         """
         for route_name in self._jsroutes:
             yield self._extract_route_information(self._routenames[route_name])
 
 
 def make_map(config):
     """Create, configure and return the routes Mapper"""
     rmap = JSRoutesMapper(directory=config['pylons.paths']['controllers'],
                   always_scan=config['debug'])
     rmap.minimization = False
     rmap.explicit = False
 
     from rhodecode.lib.utils2 import str2bool
     from rhodecode.model import repo, repo_group
 
     def check_repo(environ, match_dict):
         """
         check for valid repository for proper 404 handling
 
         :param environ:
         :param match_dict:
         """
         repo_name = match_dict.get('repo_name')
 
         if match_dict.get('f_path'):
             # fix for multiple initial slashes that causes errors
             match_dict['f_path'] = match_dict['f_path'].lstrip('/')
         repo_model = repo.RepoModel()
         by_name_match = repo_model.get_by_repo_name(repo_name)
         # if we match quickly from database, short circuit the operation,
         # and validate repo based on the type.
         if by_name_match:
             return True
 
         by_id_match = repo_model.get_repo_by_id(repo_name)
         if by_id_match:
             repo_name = by_id_match.repo_name
             match_dict['repo_name'] = repo_name
             return True
 
         return False
 
     def check_group(environ, match_dict):
         """
         check for valid repository group path for proper 404 handling
 
         :param environ:
         :param match_dict:
         """
         repo_group_name = match_dict.get('group_name')
         repo_group_model = repo_group.RepoGroupModel()
         by_name_match = repo_group_model.get_by_group_name(repo_group_name)
         if by_name_match:
             return True
 
         return False
 
     def check_user_group(environ, match_dict):
         """
         check for valid user group for proper 404 handling
 
         :param environ:
         :param match_dict:
         """
         return True
 
     def check_int(environ, match_dict):
         return match_dict.get('id').isdigit()
 
 
     #==========================================================================
     # CUSTOM ROUTES HERE
     #==========================================================================
 
     # MAIN PAGE
     rmap.connect('home', '/', controller='home', action='index', jsroute=True)
     rmap.connect('goto_switcher_data', '/_goto_data', controller='home',
                  action='goto_switcher_data')
     rmap.connect('repo_list_data', '/_repos', controller='home',
                  action='repo_list_data')
 
     rmap.connect('user_autocomplete_data', '/_users', controller='home',
                  action='user_autocomplete_data', jsroute=True)
     rmap.connect('user_group_autocomplete_data', '/_user_groups', controller='home',
                  action='user_group_autocomplete_data')
 
     rmap.connect(
         'user_profile', '/_profiles/{username}', controller='users',
         action='user_profile')
 
     # TODO: johbo: Static links, to be replaced by our redirection mechanism
     rmap.connect('rst_help',
                  'http://docutils.sourceforge.net/docs/user/rst/quickref.html',
                  _static=True)
     rmap.connect('markdown_help',
                  'http://daringfireball.net/projects/markdown/syntax',
                  _static=True)
     rmap.connect('rhodecode_official', 'https://rhodecode.com', _static=True)
     rmap.connect('rhodecode_support', 'https://rhodecode.com/help/', _static=True)
     rmap.connect('rhodecode_translations', 'https://rhodecode.com/translate/enterprise', _static=True)
     # TODO: anderson - making this a static link since redirect won't play
     # nice with POST requests
     rmap.connect('enterprise_license_convert_from_old',
                  'https://rhodecode.com/u/license-upgrade',
                  _static=True)
 
     routing_links.connect_redirection_links(rmap)
 
     rmap.connect('ping', '%s/ping' % (ADMIN_PREFIX,), controller='home', action='ping')
     rmap.connect('error_test', '%s/error_test' % (ADMIN_PREFIX,), controller='home', action='error_test')
 
     # ADMIN REPOSITORY ROUTES
     with rmap.submapper(path_prefix=ADMIN_PREFIX,
                         controller='admin/repos') as m:
         m.connect('repos', '/repos',
                   action='create', conditions={'method': ['POST']})
         m.connect('repos', '/repos',
                   action='index', conditions={'method': ['GET']})
         m.connect('new_repo', '/create_repository', jsroute=True,
                   action='create_repository', conditions={'method': ['GET']})
         m.connect('/repos/{repo_name}',
                   action='update', conditions={'method': ['PUT'],
                                                'function': check_repo},
                   requirements=URL_NAME_REQUIREMENTS)
         m.connect('delete_repo', '/repos/{repo_name}',
                   action='delete', conditions={'method': ['DELETE']},
                   requirements=URL_NAME_REQUIREMENTS)
         m.connect('repo', '/repos/{repo_name}',
                   action='show', conditions={'method': ['GET'],
                                              'function': check_repo},
                   requirements=URL_NAME_REQUIREMENTS)
 
     # ADMIN REPOSITORY GROUPS ROUTES
     with rmap.submapper(path_prefix=ADMIN_PREFIX,
                         controller='admin/repo_groups') as m:
         m.connect('repo_groups', '/repo_groups',
                   action='create', conditions={'method': ['POST']})
         m.connect('repo_groups', '/repo_groups',
                   action='index', conditions={'method': ['GET']})
         m.connect('new_repo_group', '/repo_groups/new',
                   action='new', conditions={'method': ['GET']})
         m.connect('update_repo_group', '/repo_groups/{group_name}',
                   action='update', conditions={'method': ['PUT'],
                                                'function': check_group},
                   requirements=URL_NAME_REQUIREMENTS)
 
         # EXTRAS REPO GROUP ROUTES
         m.connect('edit_repo_group', '/repo_groups/{group_name}/edit',
                   action='edit',
                   conditions={'method': ['GET'], 'function': check_group},
                   requirements=URL_NAME_REQUIREMENTS)
         m.connect('edit_repo_group', '/repo_groups/{group_name}/edit',
                   action='edit',
                   conditions={'method': ['PUT'], 'function': check_group},
                   requirements=URL_NAME_REQUIREMENTS)
 
         m.connect('edit_repo_group_advanced', '/repo_groups/{group_name}/edit/advanced',
                   action='edit_repo_group_advanced',
                   conditions={'method': ['GET'], 'function': check_group},
                   requirements=URL_NAME_REQUIREMENTS)
         m.connect('edit_repo_group_advanced', '/repo_groups/{group_name}/edit/advanced',
                   action='edit_repo_group_advanced',
                   conditions={'method': ['PUT'], 'function': check_group},
                   requirements=URL_NAME_REQUIREMENTS)
 
         m.connect('edit_repo_group_perms', '/repo_groups/{group_name}/edit/permissions',
                   action='edit_repo_group_perms',
                   conditions={'method': ['GET'], 'function': check_group},
                   requirements=URL_NAME_REQUIREMENTS)
         m.connect('edit_repo_group_perms', '/repo_groups/{group_name}/edit/permissions',
                   action='update_perms',
                   conditions={'method': ['PUT'], 'function': check_group},
                   requirements=URL_NAME_REQUIREMENTS)
 
         m.connect('delete_repo_group', '/repo_groups/{group_name}',
                   action='delete', conditions={'method': ['DELETE'],
                                                'function': check_group},
                   requirements=URL_NAME_REQUIREMENTS)
 
     # ADMIN USER ROUTES
     with rmap.submapper(path_prefix=ADMIN_PREFIX,
                         controller='admin/users') as m:
         m.connect('users', '/users',
                   action='create', conditions={'method': ['POST']})
         m.connect('users', '/users',
                   action='index', conditions={'method': ['GET']})
         m.connect('new_user', '/users/new',
                   action='new', conditions={'method': ['GET']})
         m.connect('update_user', '/users/{user_id}',
                   action='update', conditions={'method': ['PUT']})
         m.connect('delete_user', '/users/{user_id}',
                   action='delete', conditions={'method': ['DELETE']})
         m.connect('edit_user', '/users/{user_id}/edit',
                   action='edit', conditions={'method': ['GET']})
         m.connect('user', '/users/{user_id}',
                   action='show', conditions={'method': ['GET']})
         m.connect('force_password_reset_user', '/users/{user_id}/password_reset',
                   action='reset_password', conditions={'method': ['POST']})
         m.connect('create_personal_repo_group', '/users/{user_id}/create_repo_group',
                   action='create_personal_repo_group', conditions={'method': ['POST']})
 
         # EXTRAS USER ROUTES
         m.connect('edit_user_advanced', '/users/{user_id}/edit/advanced',
                   action='edit_advanced', conditions={'method': ['GET']})
         m.connect('edit_user_advanced', '/users/{user_id}/edit/advanced',
                   action='update_advanced', conditions={'method': ['PUT']})
 
         m.connect('edit_user_auth_tokens', '/users/{user_id}/edit/auth_tokens',
                   action='edit_auth_tokens', conditions={'method': ['GET']})
         m.connect('edit_user_auth_tokens', '/users/{user_id}/edit/auth_tokens',
                   action='add_auth_token', conditions={'method': ['PUT']})
         m.connect('edit_user_auth_tokens', '/users/{user_id}/edit/auth_tokens',
                   action='delete_auth_token', conditions={'method': ['DELETE']})
 
         m.connect('edit_user_global_perms', '/users/{user_id}/edit/global_permissions',
                   action='edit_global_perms', conditions={'method': ['GET']})
         m.connect('edit_user_global_perms', '/users/{user_id}/edit/global_permissions',
                   action='update_global_perms', conditions={'method': ['PUT']})
 
         m.connect('edit_user_perms_summary', '/users/{user_id}/edit/permissions_summary',
                   action='edit_perms_summary', conditions={'method': ['GET']})
 
         m.connect('edit_user_emails', '/users/{user_id}/edit/emails',
                   action='edit_emails', conditions={'method': ['GET']})
         m.connect('edit_user_emails', '/users/{user_id}/edit/emails',
                   action='add_email', conditions={'method': ['PUT']})
         m.connect('edit_user_emails', '/users/{user_id}/edit/emails',
                   action='delete_email', conditions={'method': ['DELETE']})
 
         m.connect('edit_user_ips', '/users/{user_id}/edit/ips',
                   action='edit_ips', conditions={'method': ['GET']})
         m.connect('edit_user_ips', '/users/{user_id}/edit/ips',
                   action='add_ip', conditions={'method': ['PUT']})
         m.connect('edit_user_ips', '/users/{user_id}/edit/ips',
                   action='delete_ip', conditions={'method': ['DELETE']})
 
     # ADMIN USER GROUPS REST ROUTES
     with rmap.submapper(path_prefix=ADMIN_PREFIX,
                         controller='admin/user_groups') as m:
         m.connect('users_groups', '/user_groups',
                   action='create', conditions={'method': ['POST']})
         m.connect('users_groups', '/user_groups',
                   action='index', conditions={'method': ['GET']})
         m.connect('new_users_group', '/user_groups/new',
                   action='new', conditions={'method': ['GET']})
         m.connect('update_users_group', '/user_groups/{user_group_id}',
                   action='update', conditions={'method': ['PUT']})
         m.connect('delete_users_group', '/user_groups/{user_group_id}',
                   action='delete', conditions={'method': ['DELETE']})
         m.connect('edit_users_group', '/user_groups/{user_group_id}/edit',
                   action='edit', conditions={'method': ['GET']},
                   function=check_user_group)
 
         # EXTRAS USER GROUP ROUTES
         m.connect('edit_user_group_global_perms',
                   '/user_groups/{user_group_id}/edit/global_permissions',
                   action='edit_global_perms', conditions={'method': ['GET']})
         m.connect('edit_user_group_global_perms',
                   '/user_groups/{user_group_id}/edit/global_permissions',
                   action='update_global_perms', conditions={'method': ['PUT']})
         m.connect('edit_user_group_perms_summary',
                   '/user_groups/{user_group_id}/edit/permissions_summary',
                   action='edit_perms_summary', conditions={'method': ['GET']})
 
         m.connect('edit_user_group_perms',
                   '/user_groups/{user_group_id}/edit/permissions',
                   action='edit_perms', conditions={'method': ['GET']})
         m.connect('edit_user_group_perms',
                   '/user_groups/{user_group_id}/edit/permissions',
                   action='update_perms', conditions={'method': ['PUT']})
 
         m.connect('edit_user_group_advanced',
                   '/user_groups/{user_group_id}/edit/advanced',
                   action='edit_advanced', conditions={'method': ['GET']})
 
         m.connect('edit_user_group_members',
                   '/user_groups/{user_group_id}/edit/members', jsroute=True,
                   action='edit_members', conditions={'method': ['GET']})
 
     # ADMIN PERMISSIONS ROUTES
     with rmap.submapper(path_prefix=ADMIN_PREFIX,
                         controller='admin/permissions') as m:
         m.connect('admin_permissions_application', '/permissions/application',
                   action='permission_application_update', conditions={'method': ['POST']})
         m.connect('admin_permissions_application', '/permissions/application',
                   action='permission_application', conditions={'method': ['GET']})
 
         m.connect('admin_permissions_global', '/permissions/global',
                   action='permission_global_update', conditions={'method': ['POST']})
         m.connect('admin_permissions_global', '/permissions/global',
                   action='permission_global', conditions={'method': ['GET']})
 
         m.connect('admin_permissions_object', '/permissions/object',
                   action='permission_objects_update', conditions={'method': ['POST']})
         m.connect('admin_permissions_object', '/permissions/object',
                   action='permission_objects', conditions={'method': ['GET']})
 
         m.connect('admin_permissions_ips', '/permissions/ips',
                   action='permission_ips', conditions={'method': ['POST']})
         m.connect('admin_permissions_ips', '/permissions/ips',
                   action='permission_ips', conditions={'method': ['GET']})
 
         m.connect('admin_permissions_overview', '/permissions/overview',
                   action='permission_perms', conditions={'method': ['GET']})
 
     # ADMIN DEFAULTS REST ROUTES
     with rmap.submapper(path_prefix=ADMIN_PREFIX,
                         controller='admin/defaults') as m:
         m.connect('admin_defaults_repositories', '/defaults/repositories',
                   action='update_repository_defaults', conditions={'method': ['POST']})
         m.connect('admin_defaults_repositories', '/defaults/repositories',
                   action='index', conditions={'method': ['GET']})
 
     # ADMIN DEBUG STYLE ROUTES
     if str2bool(config.get('debug_style')):
         with rmap.submapper(path_prefix=ADMIN_PREFIX + '/debug_style',
                             controller='debug_style') as m:
             m.connect('debug_style_home', '',
                       action='index', conditions={'method': ['GET']})
             m.connect('debug_style_template', '/t/{t_path}',
                       action='template', conditions={'method': ['GET']})
 
     # ADMIN SETTINGS ROUTES
     with rmap.submapper(path_prefix=ADMIN_PREFIX,
                         controller='admin/settings') as m:
 
         # default
         m.connect('admin_settings', '/settings',
                   action='settings_global_update',
                   conditions={'method': ['POST']})
         m.connect('admin_settings', '/settings',
                   action='settings_global', conditions={'method': ['GET']})
 
         m.connect('admin_settings_vcs', '/settings/vcs',
                   action='settings_vcs_update',
                   conditions={'method': ['POST']})
         m.connect('admin_settings_vcs', '/settings/vcs',
                   action='settings_vcs',
                   conditions={'method': ['GET']})
         m.connect('admin_settings_vcs', '/settings/vcs',
                   action='delete_svn_pattern',
                   conditions={'method': ['DELETE']})
 
         m.connect('admin_settings_mapping', '/settings/mapping',
                   action='settings_mapping_update',
                   conditions={'method': ['POST']})
         m.connect('admin_settings_mapping', '/settings/mapping',
                   action='settings_mapping', conditions={'method': ['GET']})
 
         m.connect('admin_settings_global', '/settings/global',
                   action='settings_global_update',
                   conditions={'method': ['POST']})
         m.connect('admin_settings_global', '/settings/global',
                   action='settings_global', conditions={'method': ['GET']})
 
         m.connect('admin_settings_visual', '/settings/visual',
                   action='settings_visual_update',
                   conditions={'method': ['POST']})
         m.connect('admin_settings_visual', '/settings/visual',
                   action='settings_visual', conditions={'method': ['GET']})
 
         m.connect('admin_settings_issuetracker',
                   '/settings/issue-tracker', action='settings_issuetracker',
                   conditions={'method': ['GET']})
         m.connect('admin_settings_issuetracker_save',
                   '/settings/issue-tracker/save',
                   action='settings_issuetracker_save',
                   conditions={'method': ['POST']})
         m.connect('admin_issuetracker_test', '/settings/issue-tracker/test',
                   action='settings_issuetracker_test',
                   conditions={'method': ['POST']})
         m.connect('admin_issuetracker_delete',
                   '/settings/issue-tracker/delete',
                   action='settings_issuetracker_delete',
                   conditions={'method': ['DELETE']})
 
         m.connect('admin_settings_email', '/settings/email',
                   action='settings_email_update',
                   conditions={'method': ['POST']})
         m.connect('admin_settings_email', '/settings/email',
                   action='settings_email', conditions={'method': ['GET']})
 
         m.connect('admin_settings_hooks', '/settings/hooks',
                   action='settings_hooks_update',
                   conditions={'method': ['POST', 'DELETE']})
         m.connect('admin_settings_hooks', '/settings/hooks',
                   action='settings_hooks', conditions={'method': ['GET']})
 
         m.connect('admin_settings_search', '/settings/search',
                   action='settings_search', conditions={'method': ['GET']})
 
         m.connect('admin_settings_system', '/settings/system',
                   action='settings_system', conditions={'method': ['GET']})
 
         m.connect('admin_settings_system_update', '/settings/system/updates',
                   action='settings_system_update', conditions={'method': ['GET']})
 
         m.connect('admin_settings_supervisor', '/settings/supervisor',
                   action='settings_supervisor', conditions={'method': ['GET']})
         m.connect('admin_settings_supervisor_log', '/settings/supervisor/{procid}/log',
                   action='settings_supervisor_log', conditions={'method': ['GET']})
 
         m.connect('admin_settings_labs', '/settings/labs',
                   action='settings_labs_update',
                   conditions={'method': ['POST']})
         m.connect('admin_settings_labs', '/settings/labs',
                   action='settings_labs', conditions={'method': ['GET']})
 
     # ADMIN MY ACCOUNT
     with rmap.submapper(path_prefix=ADMIN_PREFIX,
                         controller='admin/my_account') as m:
 
         m.connect('my_account', '/my_account',
                   action='my_account', conditions={'method': ['GET']})
         m.connect('my_account_edit', '/my_account/edit',
                   action='my_account_edit', conditions={'method': ['GET']})
         m.connect('my_account', '/my_account',
                   action='my_account_update', conditions={'method': ['POST']})
 
         m.connect('my_account_password', '/my_account/password',
                   action='my_account_password', conditions={'method': ['GET', 'POST']})
 
         m.connect('my_account_repos', '/my_account/repos',
                   action='my_account_repos', conditions={'method': ['GET']})
 
         m.connect('my_account_watched', '/my_account/watched',
                   action='my_account_watched', conditions={'method': ['GET']})
 
         m.connect('my_account_pullrequests', '/my_account/pull_requests',
                   action='my_account_pullrequests', conditions={'method': ['GET']})
 
         m.connect('my_account_perms', '/my_account/perms',
                   action='my_account_perms', conditions={'method': ['GET']})
 
         m.connect('my_account_emails', '/my_account/emails',
                   action='my_account_emails', conditions={'method': ['GET']})
         m.connect('my_account_emails', '/my_account/emails',
                   action='my_account_emails_add', conditions={'method': ['POST']})
         m.connect('my_account_emails', '/my_account/emails',
                   action='my_account_emails_delete', conditions={'method': ['DELETE']})
 
         m.connect('my_account_auth_tokens', '/my_account/auth_tokens',
                   action='my_account_auth_tokens', conditions={'method': ['GET']})
         m.connect('my_account_auth_tokens', '/my_account/auth_tokens',
                   action='my_account_auth_tokens_add', conditions={'method': ['POST']})
         m.connect('my_account_auth_tokens', '/my_account/auth_tokens',
                   action='my_account_auth_tokens_delete', conditions={'method': ['DELETE']})
         m.connect('my_account_notifications', '/my_account/notifications',
                   action='my_notifications',
                   conditions={'method': ['GET']})
         m.connect('my_account_notifications_toggle_visibility',
                   '/my_account/toggle_visibility',
                   action='my_notifications_toggle_visibility',
                   conditions={'method': ['POST']})
 
     # NOTIFICATION REST ROUTES
     with rmap.submapper(path_prefix=ADMIN_PREFIX,
                         controller='admin/notifications') as m:
         m.connect('notifications', '/notifications',
                   action='index', conditions={'method': ['GET']})
         m.connect('notifications_mark_all_read', '/notifications/mark_all_read',
                   action='mark_all_read', conditions={'method': ['POST']})
         m.connect('/notifications/{notification_id}',
                   action='update', conditions={'method': ['PUT']})
         m.connect('/notifications/{notification_id}',
                   action='delete', conditions={'method': ['DELETE']})
         m.connect('notification', '/notifications/{notification_id}',
                   action='show', conditions={'method': ['GET']})
 
     # ADMIN GIST
     with rmap.submapper(path_prefix=ADMIN_PREFIX,
                         controller='admin/gists') as m:
         m.connect('gists', '/gists',
                   action='create', conditions={'method': ['POST']})
         m.connect('gists', '/gists', jsroute=True,
                   action='index', conditions={'method': ['GET']})
         m.connect('new_gist', '/gists/new', jsroute=True,
                   action='new', conditions={'method': ['GET']})
 
         m.connect('/gists/{gist_id}',
                   action='delete', conditions={'method': ['DELETE']})
         m.connect('edit_gist', '/gists/{gist_id}/edit',
                   action='edit_form', conditions={'method': ['GET']})
         m.connect('edit_gist', '/gists/{gist_id}/edit',
                   action='edit', conditions={'method': ['POST']})
         m.connect(
             'edit_gist_check_revision', '/gists/{gist_id}/edit/check_revision',
             action='check_revision', conditions={'method': ['GET']})
 
         m.connect('gist', '/gists/{gist_id}',
                   action='show', conditions={'method': ['GET']})
         m.connect('gist_rev', '/gists/{gist_id}/{revision}',
                   revision='tip',
                   action='show', conditions={'method': ['GET']})
         m.connect('formatted_gist', '/gists/{gist_id}/{revision}/{format}',
                   revision='tip',
                   action='show', conditions={'method': ['GET']})
         m.connect('formatted_gist_file', '/gists/{gist_id}/{revision}/{format}/{f_path}',
                   revision='tip',
                   action='show', conditions={'method': ['GET']},
                   requirements=URL_NAME_REQUIREMENTS)
 
     # ADMIN MAIN PAGES
     with rmap.submapper(path_prefix=ADMIN_PREFIX,
                         controller='admin/admin') as m:
         m.connect('admin_home', '', action='index')
         m.connect('admin_add_repo', '/add_repo/{new_repo:[a-z0-9\. _-]*}',
                   action='add_repo')
         m.connect(
             'pull_requests_global_0', '/pull_requests/{pull_request_id:[0-9]+}',
             action='pull_requests')
         m.connect(
             'pull_requests_global', '/pull-requests/{pull_request_id:[0-9]+}',
             action='pull_requests')
 
 
     # USER JOURNAL
     rmap.connect('journal', '%s/journal' % (ADMIN_PREFIX,),
                  controller='journal', action='index')
     rmap.connect('journal_rss', '%s/journal/rss' % (ADMIN_PREFIX,),
                  controller='journal', action='journal_rss')
     rmap.connect('journal_atom', '%s/journal/atom' % (ADMIN_PREFIX,),
                  controller='journal', action='journal_atom')
 
     rmap.connect('public_journal', '%s/public_journal' % (ADMIN_PREFIX,),
                  controller='journal', action='public_journal')
 
     rmap.connect('public_journal_rss', '%s/public_journal/rss' % (ADMIN_PREFIX,),
                  controller='journal', action='public_journal_rss')
 
     rmap.connect('public_journal_rss_old', '%s/public_journal_rss' % (ADMIN_PREFIX,),
                  controller='journal', action='public_journal_rss')
 
     rmap.connect('public_journal_atom',
                  '%s/public_journal/atom' % (ADMIN_PREFIX,), controller='journal',
                  action='public_journal_atom')
 
     rmap.connect('public_journal_atom_old',
                  '%s/public_journal_atom' % (ADMIN_PREFIX,), controller='journal',
                  action='public_journal_atom')
 
     rmap.connect('toggle_following', '%s/toggle_following' % (ADMIN_PREFIX,),
                  controller='journal', action='toggle_following', jsroute=True,
                  conditions={'method': ['POST']})
 
     # FULL TEXT SEARCH
     rmap.connect('search', '%s/search' % (ADMIN_PREFIX,),
                  controller='search')
     rmap.connect('search_repo_home', '/{repo_name}/search',
                  controller='search',
                  action='index',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     # FEEDS
     rmap.connect('rss_feed_home', '/{repo_name}/feed/rss',
                  controller='feed', action='rss',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('atom_feed_home', '/{repo_name}/feed/atom',
                  controller='feed', action='atom',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     #==========================================================================
     # REPOSITORY ROUTES
     #==========================================================================
 
     rmap.connect('repo_creating_home', '/{repo_name}/repo_creating',
                  controller='admin/repos', action='repo_creating',
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('repo_check_home', '/{repo_name}/crepo_check',
                  controller='admin/repos', action='repo_check',
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('repo_stats', '/{repo_name}/repo_stats/{commit_id}',
                  controller='summary', action='repo_stats',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('repo_refs_data', '/{repo_name}/refs-data',
                  controller='summary', action='repo_refs_data', jsroute=True,
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('repo_refs_changelog_data', '/{repo_name}/refs-data-changelog',
                  controller='summary', action='repo_refs_changelog_data',
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('changeset_home', '/{repo_name}/changeset/{revision}',
                  controller='changeset', revision='tip', jsroute=True,
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('changeset_children', '/{repo_name}/changeset_children/{revision}',
                  controller='changeset', revision='tip', action='changeset_children',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('changeset_parents', '/{repo_name}/changeset_parents/{revision}',
                  controller='changeset', revision='tip', action='changeset_parents',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     # repo edit options
     rmap.connect('edit_repo', '/{repo_name}/settings', jsroute=True,
                  controller='admin/repos', action='edit',
                  conditions={'method': ['GET'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('edit_repo_perms', '/{repo_name}/settings/permissions',
                  jsroute=True,
                  controller='admin/repos', action='edit_permissions',
                  conditions={'method': ['GET'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('edit_repo_perms_update', '/{repo_name}/settings/permissions',
                  controller='admin/repos', action='edit_permissions_update',
                  conditions={'method': ['PUT'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('edit_repo_fields', '/{repo_name}/settings/fields',
                  controller='admin/repos', action='edit_fields',
                  conditions={'method': ['GET'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('create_repo_fields', '/{repo_name}/settings/fields/new',
                  controller='admin/repos', action='create_repo_field',
                  conditions={'method': ['PUT'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('delete_repo_fields', '/{repo_name}/settings/fields/{field_id}',
                  controller='admin/repos', action='delete_repo_field',
                  conditions={'method': ['DELETE'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('edit_repo_advanced', '/{repo_name}/settings/advanced',
                  controller='admin/repos', action='edit_advanced',
                  conditions={'method': ['GET'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('edit_repo_advanced_locking', '/{repo_name}/settings/advanced/locking',
                  controller='admin/repos', action='edit_advanced_locking',
                  conditions={'method': ['PUT'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('toggle_locking', '/{repo_name}/settings/advanced/locking_toggle',
                  controller='admin/repos', action='toggle_locking',
                  conditions={'method': ['GET'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('edit_repo_advanced_journal', '/{repo_name}/settings/advanced/journal',
                  controller='admin/repos', action='edit_advanced_journal',
                  conditions={'method': ['PUT'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('edit_repo_advanced_fork', '/{repo_name}/settings/advanced/fork',
                  controller='admin/repos', action='edit_advanced_fork',
                  conditions={'method': ['PUT'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('edit_repo_caches', '/{repo_name}/settings/caches',
                  controller='admin/repos', action='edit_caches_form',
                  conditions={'method': ['GET'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('edit_repo_caches', '/{repo_name}/settings/caches',
                  controller='admin/repos', action='edit_caches',
                  conditions={'method': ['PUT'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('edit_repo_remote', '/{repo_name}/settings/remote',
                  controller='admin/repos', action='edit_remote_form',
                  conditions={'method': ['GET'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('edit_repo_remote', '/{repo_name}/settings/remote',
                  controller='admin/repos', action='edit_remote',
                  conditions={'method': ['PUT'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('edit_repo_statistics', '/{repo_name}/settings/statistics',
                  controller='admin/repos', action='edit_statistics_form',
                  conditions={'method': ['GET'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('edit_repo_statistics', '/{repo_name}/settings/statistics',
                  controller='admin/repos', action='edit_statistics',
                  conditions={'method': ['PUT'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('repo_settings_issuetracker',
                  '/{repo_name}/settings/issue-tracker',
                  controller='admin/repos', action='repo_issuetracker',
                  conditions={'method': ['GET'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('repo_issuetracker_test',
                  '/{repo_name}/settings/issue-tracker/test',
                  controller='admin/repos', action='repo_issuetracker_test',
                  conditions={'method': ['POST'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('repo_issuetracker_delete',
                  '/{repo_name}/settings/issue-tracker/delete',
                  controller='admin/repos', action='repo_issuetracker_delete',
                  conditions={'method': ['DELETE'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('repo_issuetracker_save',
                  '/{repo_name}/settings/issue-tracker/save',
                  controller='admin/repos', action='repo_issuetracker_save',
                  conditions={'method': ['POST'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('repo_vcs_settings', '/{repo_name}/settings/vcs',
                  controller='admin/repos', action='repo_settings_vcs_update',
                  conditions={'method': ['POST'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('repo_vcs_settings', '/{repo_name}/settings/vcs',
                  controller='admin/repos', action='repo_settings_vcs',
                  conditions={'method': ['GET'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('repo_vcs_settings', '/{repo_name}/settings/vcs',
                  controller='admin/repos', action='repo_delete_svn_pattern',
                  conditions={'method': ['DELETE'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     # still working url for backward compat.
     rmap.connect('raw_changeset_home_depraced',
                  '/{repo_name}/raw-changeset/{revision}',
                  controller='changeset', action='changeset_raw',
                  revision='tip', conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     # new URLs
     rmap.connect('changeset_raw_home',
                  '/{repo_name}/changeset-diff/{revision}',
                  controller='changeset', action='changeset_raw',
                  revision='tip', conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('changeset_patch_home',
                  '/{repo_name}/changeset-patch/{revision}',
                  controller='changeset', action='changeset_patch',
                  revision='tip', conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('changeset_download_home',
                  '/{repo_name}/changeset-download/{revision}',
                  controller='changeset', action='changeset_download',
                  revision='tip', conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('changeset_comment',
                  '/{repo_name}/changeset/{revision}/comment', jsroute=True,
                  controller='changeset', revision='tip', action='comment',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('changeset_comment_preview',
                  '/{repo_name}/changeset/comment/preview', jsroute=True,
                  controller='changeset', action='preview_comment',
                  conditions={'function': check_repo, 'method': ['POST']},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('changeset_comment_delete',
                  '/{repo_name}/changeset/comment/{comment_id}/delete',
                  controller='changeset', action='delete_comment',
                  conditions={'function': check_repo, 'method': ['DELETE']},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('changeset_info', '/{repo_name}/changeset_info/{revision}',
                  controller='changeset', action='changeset_info',
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('compare_home',
                  '/{repo_name}/compare',
                  controller='compare', action='index',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('compare_url',
                  '/{repo_name}/compare/{source_ref_type}@{source_ref:.*?}...{target_ref_type}@{target_ref:.*?}',
                  controller='compare', action='compare',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('pullrequest_home',
                  '/{repo_name}/pull-request/new', controller='pullrequests',
                  action='index', conditions={'function': check_repo,
                                              'method': ['GET']},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('pullrequest',
                  '/{repo_name}/pull-request/new', controller='pullrequests',
                  action='create', conditions={'function': check_repo,
                                               'method': ['POST']},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('pullrequest_repo_refs',
                  '/{repo_name}/pull-request/refs/{target_repo_name:.*?[^/]}',
                  controller='pullrequests',
                  action='get_repo_refs',
                  conditions={'function': check_repo, 'method': ['GET']},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('pullrequest_repo_destinations',
                  '/{repo_name}/pull-request/repo-destinations',
                  controller='pullrequests',
                  action='get_repo_destinations',
                  conditions={'function': check_repo, 'method': ['GET']},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('pullrequest_show',
                  '/{repo_name}/pull-request/{pull_request_id}',
                  controller='pullrequests',
                  action='show', conditions={'function': check_repo,
                                             'method': ['GET']},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('pullrequest_update',
                  '/{repo_name}/pull-request/{pull_request_id}',
                  controller='pullrequests',
                  action='update', conditions={'function': check_repo,
                                               'method': ['PUT']},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('pullrequest_merge',
                  '/{repo_name}/pull-request/{pull_request_id}',
                  controller='pullrequests',
                  action='merge', conditions={'function': check_repo,
                                              'method': ['POST']},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('pullrequest_delete',
                  '/{repo_name}/pull-request/{pull_request_id}',
                  controller='pullrequests',
                  action='delete', conditions={'function': check_repo,
                                               'method': ['DELETE']},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('pullrequest_show_all',
                  '/{repo_name}/pull-request',
                  controller='pullrequests',
                  action='show_all', conditions={'function': check_repo,
                                                 'method': ['GET']},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('pullrequest_comment',
                  '/{repo_name}/pull-request-comment/{pull_request_id}',
                  controller='pullrequests',
                  action='comment', conditions={'function': check_repo,
                                                'method': ['POST']},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('pullrequest_comment_delete',
                  '/{repo_name}/pull-request-comment/{comment_id}/delete',
                  controller='pullrequests', action='delete_comment',
                  conditions={'function': check_repo, 'method': ['DELETE']},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('summary_home_explicit', '/{repo_name}/summary',
                  controller='summary', conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('branches_home', '/{repo_name}/branches',
                  controller='branches', conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('tags_home', '/{repo_name}/tags',
                  controller='tags', conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('bookmarks_home', '/{repo_name}/bookmarks',
                  controller='bookmarks', conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('changelog_home', '/{repo_name}/changelog', jsroute=True,
                  controller='changelog', conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('changelog_summary_home', '/{repo_name}/changelog_summary',
                  controller='changelog', action='changelog_summary',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('changelog_file_home',
                  '/{repo_name}/changelog/{revision}/{f_path}',
                  controller='changelog', f_path=None,
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('changelog_details', '/{repo_name}/changelog_details/{cs}',
                  controller='changelog', action='changelog_details',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('files_home',  '/{repo_name}/files/{revision}/{f_path}',
                  controller='files', revision='tip', f_path='',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('files_home_simple_catchrev',
                  '/{repo_name}/files/{revision}',
                  controller='files', revision='tip', f_path='',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('files_home_simple_catchall',
                  '/{repo_name}/files',
                  controller='files', revision='tip', f_path='',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('files_history_home',
                  '/{repo_name}/history/{revision}/{f_path}',
                  controller='files', action='history', revision='tip', f_path='',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('files_authors_home',
                  '/{repo_name}/authors/{revision}/{f_path}',
                  controller='files', action='authors', revision='tip', f_path='',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('files_diff_home', '/{repo_name}/diff/{f_path}',
                  controller='files', action='diff', f_path='',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('files_diff_2way_home',
                  '/{repo_name}/diff-2way/{f_path}',
                  controller='files', action='diff_2way', f_path='',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('files_rawfile_home',
                  '/{repo_name}/rawfile/{revision}/{f_path}',
                  controller='files', action='rawfile', revision='tip',
                  f_path='', conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('files_raw_home',
                  '/{repo_name}/raw/{revision}/{f_path}',
                  controller='files', action='raw', revision='tip', f_path='',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('files_render_home',
                  '/{repo_name}/render/{revision}/{f_path}',
                  controller='files', action='index', revision='tip', f_path='',
                  rendered=True, conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('files_annotate_home',
                  '/{repo_name}/annotate/{revision}/{f_path}',
                  controller='files', action='index', revision='tip',
                  f_path='', annotate=True, conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('files_edit',
                  '/{repo_name}/edit/{revision}/{f_path}',
                  controller='files', action='edit', revision='tip',
                  f_path='',
                  conditions={'function': check_repo, 'method': ['POST']},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('files_edit_home',
                  '/{repo_name}/edit/{revision}/{f_path}',
                  controller='files', action='edit_home', revision='tip',
                  f_path='', conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('files_add',
                  '/{repo_name}/add/{revision}/{f_path}',
                  controller='files', action='add', revision='tip',
                  f_path='',
                  conditions={'function': check_repo, 'method': ['POST']},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('files_add_home',
                  '/{repo_name}/add/{revision}/{f_path}',
                  controller='files', action='add_home', revision='tip',
                  f_path='', conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('files_delete',
                  '/{repo_name}/delete/{revision}/{f_path}',
                  controller='files', action='delete', revision='tip',
                  f_path='',
                  conditions={'function': check_repo, 'method': ['POST']},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('files_delete_home',
                  '/{repo_name}/delete/{revision}/{f_path}',
                  controller='files', action='delete_home', revision='tip',
                  f_path='', conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('files_archive_home', '/{repo_name}/archive/{fname}',
                  controller='files', action='archivefile',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('files_nodelist_home',
                  '/{repo_name}/nodelist/{revision}/{f_path}',
                  controller='files', action='nodelist',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('files_nodetree_full',
                  '/{repo_name}/nodetree_full/{commit_id}/{f_path}',
                  controller='files', action='nodetree_full',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('repo_fork_create_home', '/{repo_name}/fork',
                  controller='forks', action='fork_create',
                  conditions={'function': check_repo, 'method': ['POST']},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('repo_fork_home', '/{repo_name}/fork',
                  controller='forks', action='fork',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('repo_forks_home', '/{repo_name}/forks',
                  controller='forks', action='forks',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('repo_followers_home', '/{repo_name}/followers',
                  controller='followers', action='followers',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     # must be here for proper group/repo catching pattern
     _connect_with_slash(
         rmap, 'repo_group_home', '/{group_name}',
         controller='home', action='index_repo_group',
         conditions={'function': check_group},
         requirements=URL_NAME_REQUIREMENTS)
 
     # catch all, at the end
     _connect_with_slash(
         rmap, 'summary_home', '/{repo_name}', jsroute=True,
         controller='summary', action='index',
         conditions={'function': check_repo},
         requirements=URL_NAME_REQUIREMENTS)
 
     return rmap
 
 
 def _connect_with_slash(mapper, name, path, *args, **kwargs):
     """
     Connect a route with an optional trailing slash in `path`.
     """
     mapper.connect(name + '_slash', path + '/', *args, **kwargs)
     mapper.connect(name, path, *args, **kwargs)

rhodecode/integrations/routes.py

@@ -1,200 +1,238 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2012-2016  RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import logging
 
 from rhodecode.model.db import Repository, Integration, RepoGroup
 from rhodecode.config.routing import (
     ADMIN_PREFIX, add_route_requirements, URL_NAME_REQUIREMENTS)
 from rhodecode.integrations import integration_type_registry
 
 log = logging.getLogger(__name__)
 
 
 def includeme(config):
 
     # global integrations
+
+    config.add_route('global_integrations_new',
+                     ADMIN_PREFIX + '/integrations/new')
+    config.add_view('rhodecode.integrations.views.GlobalIntegrationsView',
+                    attr='new_integration',
+                    renderer='rhodecode:templates/admin/integrations/new.html',
+                    request_method='GET',
+                    route_name='global_integrations_new')
+
     config.add_route('global_integrations_home',
                      ADMIN_PREFIX + '/integrations')
     config.add_route('global_integrations_list',
                      ADMIN_PREFIX + '/integrations/{integration}')
     for route_name in ['global_integrations_home', 'global_integrations_list']:
         config.add_view('rhodecode.integrations.views.GlobalIntegrationsView',
                         attr='index',
                         renderer='rhodecode:templates/admin/integrations/list.html',
                         request_method='GET',
                         route_name=route_name)
 
     config.add_route('global_integrations_create',
                      ADMIN_PREFIX + '/integrations/{integration}/new',
                      custom_predicates=(valid_integration,))
     config.add_route('global_integrations_edit',
                      ADMIN_PREFIX + '/integrations/{integration}/{integration_id}',
                      custom_predicates=(valid_integration,))
+
+
     for route_name in ['global_integrations_create', 'global_integrations_edit']:
         config.add_view('rhodecode.integrations.views.GlobalIntegrationsView',
                         attr='settings_get',
-                        renderer='rhodecode:templates/admin/integrations/edit.html',
+                        renderer='rhodecode:templates/admin/integrations/form.html',
                         request_method='GET',
                         route_name=route_name)
         config.add_view('rhodecode.integrations.views.GlobalIntegrationsView',
                         attr='settings_post',
-                        renderer='rhodecode:templates/admin/integrations/edit.html',
+                        renderer='rhodecode:templates/admin/integrations/form.html',
+                        request_method='POST',
+                        route_name=route_name)
+
+
+    # repo group integrations
+    config.add_route('repo_group_integrations_home',
+                     add_route_requirements(
+                        '{repo_group_name}/settings/integrations',
+                        URL_NAME_REQUIREMENTS
+                     ),
+                     custom_predicates=(valid_repo_group,)
+                     )
+    config.add_route('repo_group_integrations_list',
+                     add_route_requirements(
+                        '{repo_group_name}/settings/integrations/{integration}',
+                        URL_NAME_REQUIREMENTS
+                     ),
+                     custom_predicates=(valid_repo_group, valid_integration))
+    for route_name in ['repo_group_integrations_home', 'repo_group_integrations_list']:
+        config.add_view('rhodecode.integrations.views.RepoGroupIntegrationsView',
+                        attr='index',
+                        renderer='rhodecode:templates/admin/integrations/list.html',
+                        request_method='GET',
+                        route_name=route_name)
+
+    config.add_route('repo_group_integrations_new',
+                     add_route_requirements(
+                        '{repo_group_name}/settings/integrations/new',
+                        URL_NAME_REQUIREMENTS
+                     ),
+                     custom_predicates=(valid_repo_group,))
+    config.add_view('rhodecode.integrations.views.RepoGroupIntegrationsView',
+                    attr='new_integration',
+                    renderer='rhodecode:templates/admin/integrations/new.html',
+                    request_method='GET',
+                    route_name='repo_group_integrations_new')
+
+    config.add_route('repo_group_integrations_create',
+                     add_route_requirements(
+                        '{repo_group_name}/settings/integrations/{integration}/new',
+                        URL_NAME_REQUIREMENTS
+                     ),
+                     custom_predicates=(valid_repo_group, valid_integration))
+    config.add_route('repo_group_integrations_edit',
+                     add_route_requirements(
+                        '{repo_group_name}/settings/integrations/{integration}/{integration_id}',
+                        URL_NAME_REQUIREMENTS
+                     ),
+                     custom_predicates=(valid_repo_group, valid_integration))
+    for route_name in ['repo_group_integrations_edit', 'repo_group_integrations_create']:
+        config.add_view('rhodecode.integrations.views.RepoGroupIntegrationsView',
+                        attr='settings_get',
+                        renderer='rhodecode:templates/admin/integrations/form.html',
+                        request_method='GET',
+                        route_name=route_name)
+        config.add_view('rhodecode.integrations.views.RepoGroupIntegrationsView',
+                        attr='settings_post',
+                        renderer='rhodecode:templates/admin/integrations/form.html',
                         request_method='POST',
                         route_name=route_name)
 
 
     # repo integrations
     config.add_route('repo_integrations_home',
                      add_route_requirements(
                         '{repo_name}/settings/integrations',
                         URL_NAME_REQUIREMENTS
                      ),
                      custom_predicates=(valid_repo,))
     config.add_route('repo_integrations_list',
                      add_route_requirements(
                         '{repo_name}/settings/integrations/{integration}',
                         URL_NAME_REQUIREMENTS
                      ),
                      custom_predicates=(valid_repo, valid_integration))
     for route_name in ['repo_integrations_home', 'repo_integrations_list']:
         config.add_view('rhodecode.integrations.views.RepoIntegrationsView',
                         attr='index',
                         request_method='GET',
+                        renderer='rhodecode:templates/admin/integrations/list.html',
                         route_name=route_name)
 
+    config.add_route('repo_integrations_new',
+                     add_route_requirements(
+                        '{repo_name}/settings/integrations/new',
+                        URL_NAME_REQUIREMENTS
+                     ),
+                     custom_predicates=(valid_repo,))
+    config.add_view('rhodecode.integrations.views.RepoIntegrationsView',
+                    attr='new_integration',
+                    renderer='rhodecode:templates/admin/integrations/new.html',
+                    request_method='GET',
+                    route_name='repo_integrations_new')
+
     config.add_route('repo_integrations_create',
                      add_route_requirements(
                         '{repo_name}/settings/integrations/{integration}/new',
                         URL_NAME_REQUIREMENTS
                      ),
                      custom_predicates=(valid_repo, valid_integration))
     config.add_route('repo_integrations_edit',
                      add_route_requirements(
                         '{repo_name}/settings/integrations/{integration}/{integration_id}',
                         URL_NAME_REQUIREMENTS
                      ),
                      custom_predicates=(valid_repo, valid_integration))
     for route_name in ['repo_integrations_edit', 'repo_integrations_create']:
         config.add_view('rhodecode.integrations.views.RepoIntegrationsView',
                         attr='settings_get',
-                        renderer='rhodecode:templates/admin/integrations/edit.html',
+                        renderer='rhodecode:templates/admin/integrations/form.html',
                         request_method='GET',
                         route_name=route_name)
         config.add_view('rhodecode.integrations.views.RepoIntegrationsView',
                         attr='settings_post',
-                        renderer='rhodecode:templates/admin/integrations/edit.html',
-                        request_method='POST',
-                        route_name=route_name)
-
-
-    # repo group integrations
-    config.add_route('repo_group_integrations_home',
-                     add_route_requirements(
-                        '{repo_group_name}/settings/integrations',
-                        URL_NAME_REQUIREMENTS
-                     ),
-                     custom_predicates=(valid_repo_group,))
-    config.add_route('repo_group_integrations_list',
-                     add_route_requirements(
-                        '{repo_group_name}/settings/integrations/{integration}',
-                        URL_NAME_REQUIREMENTS
-                     ),
-                     custom_predicates=(valid_repo_group, valid_integration))
-    for route_name in ['repo_group_integrations_home', 'repo_group_integrations_list']:
-        config.add_view('rhodecode.integrations.views.RepoGroupIntegrationsView',
-                        attr='index',
-                        request_method='GET',
-                        route_name=route_name)
-
-    config.add_route('repo_group_integrations_create',
-                     add_route_requirements(
-                        '{repo_group_name}/settings/integrations/{integration}/new',
-                        URL_NAME_REQUIREMENTS
-                     ),
-                     custom_predicates=(valid_repo_group, valid_integration))
-    config.add_route('repo_group_integrations_edit',
-                     add_route_requirements(
-                        '{repo_group_name}/settings/integrations/{integration}/{integration_id}',
-                        URL_NAME_REQUIREMENTS
-                     ),
-                     custom_predicates=(valid_repo_group, valid_integration))
-    for route_name in ['repo_group_integrations_edit', 'repo_group_integrations_create']:
-        config.add_view('rhodecode.integrations.views.RepoGroupIntegrationsView',
-                        attr='settings_get',
-                        renderer='rhodecode:templates/admin/integrations/edit.html',
-                        request_method='GET',
-                        route_name=route_name)
-        config.add_view('rhodecode.integrations.views.RepoGroupIntegrationsView',
-                        attr='settings_post',
-                        renderer='rhodecode:templates/admin/integrations/edit.html',
+                        renderer='rhodecode:templates/admin/integrations/form.html',
                         request_method='POST',
                         route_name=route_name)
 
 
 def valid_repo(info, request):
     repo = Repository.get_by_repo_name(info['match']['repo_name'])
     if repo:
         return True
 
 
 def valid_repo_group(info, request):
     repo_group = RepoGroup.get_by_group_name(info['match']['repo_group_name'])
     if repo_group:
         return True
     return False
 
 
 def valid_integration(info, request):
     integration_type = info['match']['integration']
     integration_id = info['match'].get('integration_id')
     repo_name = info['match'].get('repo_name')
     repo_group_name = info['match'].get('repo_group_name')
 
     if integration_type not in integration_type_registry:
         return False
 
     repo, repo_group = None, None
     if repo_name:
         repo = Repository.get_by_repo_name(repo_name)
         if not repo:
             return False
 
     if repo_group_name:
         repo_group = RepoGroup.get_by_group_name(repo_group_name)
         if not repo_group:
             return False
 
     if repo_name and repo_group:
         raise Exception('Either repo or repo_group can be set, not both')
 
 
     if integration_id:
         integration = Integration.get(integration_id)
         if not integration:
             return False
         if integration.integration_type != integration_type:
             return False
         if repo and repo.repo_id != integration.repo_id:
             return False
-        if repo_group and repo_group.repo_group_id != integration.repo_group_id:
+        if repo_group and repo_group.group_id != integration.repo_group_id:
             return False
 
     return True

rhodecode/integrations/schema.py

@@ -1,45 +1,71 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2012-2016  RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import colander
 
-from rhodecode.translation import lazy_ugettext
+from rhodecode.translation import _
 
 
-class IntegrationSettingsSchemaBase(colander.MappingSchema):
-    """
-    This base schema is intended for use in integrations.
-    It adds a few default settings (e.g., "enabled"), so that integration
-    authors don't have to maintain a bunch of boilerplate.
-    """
+class IntegrationOptionsSchemaBase(colander.MappingSchema):
     enabled = colander.SchemaNode(
         colander.Bool(),
         default=True,
-        description=lazy_ugettext('Enable or disable this integration.'),
+        description=_('Enable or disable this integration.'),
         missing=False,
-        title=lazy_ugettext('Enabled'),
+        title=_('Enabled'),
     )
 
     name = colander.SchemaNode(
         colander.String(),
-        description=lazy_ugettext('Short name for this integration.'),
+        description=_('Short name for this integration.'),
         missing=colander.required,
-        title=lazy_ugettext('Integration name'),
+        title=_('Integration name'),
     )
+
+
+class RepoIntegrationOptionsSchema(IntegrationOptionsSchemaBase):
+    pass
+
+
+class RepoGroupIntegrationOptionsSchema(IntegrationOptionsSchemaBase):
+    child_repos_only = colander.SchemaNode(
+        colander.Bool(),
+        default=True,
+        description=_(
+            'Limit integrations to to work only on the direct children '
+            'repositories of this repository group (no subgroups)'),
+        missing=False,
+        title=_('Limit to childen repos only'),
+    )
+
+
+class GlobalIntegrationOptionsSchema(IntegrationOptionsSchemaBase):
+    child_repos_only = colander.SchemaNode(
+        colander.Bool(),
+        default=False,
+        description=_(
+            'Limit integrations to to work only on root level repositories'),
+        missing=False,
+        title=_('Root repositories only'),
+    )
+
+
+class IntegrationSettingsSchemaBase(colander.MappingSchema):
+    pass

rhodecode/integrations/types/base.py

@@ -1,42 +1,101 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2012-2016  RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
-from rhodecode.integrations.schema import IntegrationSettingsSchemaBase
+import colander
+from rhodecode.translation import _
 
 
 class IntegrationTypeBase(object):
     """ Base class for IntegrationType plugins """
 
+    description = ''
+    icon = '''
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<svg
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   viewBox="0 -256 1792 1792"
+   id="svg3025"
+   version="1.1"
+   inkscape:version="0.48.3.1 r9886"
+   width="100%"
+   height="100%"
+   sodipodi:docname="cog_font_awesome.svg">
+  <metadata
+     id="metadata3035">
+    <rdf:RDF>
+      <cc:Work
+         rdf:about="">
+        <dc:format>image/svg+xml</dc:format>
+        <dc:type
+           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+      </cc:Work>
+    </rdf:RDF>
+  </metadata>
+  <defs
+     id="defs3033" />
+  <sodipodi:namedview
+     pagecolor="#ffffff"
+     bordercolor="#666666"
+     borderopacity="1"
+     objecttolerance="10"
+     gridtolerance="10"
+     guidetolerance="10"
+     inkscape:pageopacity="0"
+     inkscape:pageshadow="2"
+     inkscape:window-width="640"
+     inkscape:window-height="480"
+     id="namedview3031"
+     showgrid="false"
+     inkscape:zoom="0.13169643"
+     inkscape:cx="896"
+     inkscape:cy="896"
+     inkscape:window-x="0"
+     inkscape:window-y="25"
+     inkscape:window-maximized="0"
+     inkscape:current-layer="svg3025" />
+  <g
+     transform="matrix(1,0,0,-1,121.49153,1285.4237)"
+     id="g3027">
+    <path
+       d="m 1024,640 q 0,106 -75,181 -75,75 -181,75 -106,0 -181,-75 -75,-75 -75,-181 0,-106 75,-181 75,-75 181,-75 106,0 181,75 75,75 75,181 z m 512,109 V 527 q 0,-12 -8,-23 -8,-11 -20,-13 l -185,-28 q -19,-54 -39,-91 35,-50 107,-138 10,-12 10,-25 0,-13 -9,-23 -27,-37 -99,-108 -72,-71 -94,-71 -12,0 -26,9 l -138,108 q -44,-23 -91,-38 -16,-136 -29,-186 -7,-28 -36,-28 H 657 q -14,0 -24.5,8.5 Q 622,-111 621,-98 L 593,86 q -49,16 -90,37 L 362,16 Q 352,7 337,7 323,7 312,18 186,132 147,186 q -7,10 -7,23 0,12 8,23 15,21 51,66.5 36,45.5 54,70.5 -27,50 -41,99 L 29,495 Q 16,497 8,507.5 0,518 0,531 v 222 q 0,12 8,23 8,11 19,13 l 186,28 q 14,46 39,92 -40,57 -107,138 -10,12 -10,24 0,10 9,23 26,36 98.5,107.5 72.5,71.5 94.5,71.5 13,0 26,-10 l 138,-107 q 44,23 91,38 16,136 29,186 7,28 36,28 h 222 q 14,0 24.5,-8.5 Q 914,1391 915,1378 l 28,-184 q 49,-16 90,-37 l 142,107 q 9,9 24,9 13,0 25,-10 129,-119 165,-170 7,-8 7,-22 0,-12 -8,-23 -15,-21 -51,-66.5 -36,-45.5 -54,-70.5 26,-50 41,-98 l 183,-28 q 13,-2 21,-12.5 8,-10.5 8,-23.5 z"
+       id="path3029"
+       inkscape:connector-curvature="0"
+       style="fill:currentColor" />
+  </g>
+</svg>
+'''
+
     def __init__(self, settings):
         """
         :param settings: dict of settings to be used for the integration
         """
         self.settings = settings
 
-
     def settings_schema(self):
         """
         A colander schema of settings for the integration type
-
-        Subclasses can return their own schema but should always
-        inherit from IntegrationSettingsSchemaBase
         """
-        return IntegrationSettingsSchemaBase()
-
+        return colander.Schema()

rhodecode/integrations/types/email.py

@@ -1,222 +1,283 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2012-2016  RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 from __future__ import unicode_literals
 import deform
 import logging
 import colander
 
 from mako.template import Template
 
 from rhodecode import events
-from rhodecode.translation import _, lazy_ugettext
+from rhodecode.translation import _
 from rhodecode.lib.celerylib import run_task
 from rhodecode.lib.celerylib import tasks
 from rhodecode.integrations.types.base import IntegrationTypeBase
-from rhodecode.integrations.schema import IntegrationSettingsSchemaBase
 
 
 log = logging.getLogger(__name__)
 
 repo_push_template_plaintext = Template('''
 Commits:
 
 % for commit in data['push']['commits']:
 ${commit['url']} by ${commit['author']} at ${commit['date']}
 ${commit['message']}
 ----
 
 % endfor
 ''')
 
 ## TODO (marcink): think about putting this into a file, or use base.mako email template
 
 repo_push_template_html = Template('''
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
 <html xmlns="http://www.w3.org/1999/xhtml">
 <head>
     <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0"/>
     <title>${subject}</title>
     <style type="text/css">
         /* Based on The MailChimp Reset INLINE: Yes. */
         #outlook a {padding:0;} /* Force Outlook to provide a "view in browser" menu link. */
         body{width:100% !important; -webkit-text-size-adjust:100%; -ms-text-size-adjust:100%; margin:0; padding:0;}
         /* Prevent Webkit and Windows Mobile platforms from changing default font sizes.*/
         .ExternalClass {width:100%;} /* Force Hotmail to display emails at full width */
         .ExternalClass, .ExternalClass p, .ExternalClass span, .ExternalClass font, .ExternalClass td, .ExternalClass div {line-height: 100%;}
         /* Forces Hotmail to display normal line spacing.  More on that: http://www.emailonacid.com/forum/viewthread/43/ */
         #backgroundTable {margin:0; padding:0; line-height: 100% !important;}
         /* End reset */
 
         /* defaults for images*/
         img {outline:none; text-decoration:none; -ms-interpolation-mode: bicubic;}
         a img {border:none;}
         .image_fix {display:block;}
 
         body {line-height:1.2em;}
         p {margin: 0 0 20px;}
         h1, h2, h3, h4, h5, h6 {color:#323232!important;}
         a {color:#427cc9;text-decoration:none;outline:none;cursor:pointer;}
         a:focus {outline:none;}
         a:hover {color: #305b91;}
         h1 a, h2 a, h3 a, h4 a, h5 a, h6 a {color:#427cc9!important;text-decoration:none!important;}
         h1 a:active, h2 a:active,  h3 a:active, h4 a:active, h5 a:active, h6 a:active {color: #305b91!important;}
         h1 a:visited, h2 a:visited,  h3 a:visited, h4 a:visited, h5 a:visited, h6 a:visited {color: #305b91!important;}
         table {font-size:13px;border-collapse:collapse;mso-table-lspace:0pt;mso-table-rspace:0pt;}
         table td {padding:.65em 1em .65em 0;border-collapse:collapse;vertical-align:top;text-align:left;}
         input {display:inline;border-radius:2px;border-style:solid;border: 1px solid #dbd9da;padding:.5em;}
         input:focus {outline: 1px solid #979797}
         @media only screen and (-webkit-min-device-pixel-ratio: 2) {
         /* Put your iPhone 4g styles in here */
         }
 
         /* Android targeting */
         @media only screen and (-webkit-device-pixel-ratio:.75){
         /* Put CSS for low density (ldpi) Android layouts in here */
         }
         @media only screen and (-webkit-device-pixel-ratio:1){
         /* Put CSS for medium density (mdpi) Android layouts in here */
         }
         @media only screen and (-webkit-device-pixel-ratio:1.5){
         /* Put CSS for high density (hdpi) Android layouts in here */
         }
         /* end Android targeting */
 
     </style>
 
     <!-- Targeting Windows Mobile -->
     <!--[if IEMobile 7]>
     <style type="text/css">
 
     </style>
     <![endif]-->
 
     <!--[if gte mso 9]>
         <style>
         /* Target Outlook 2007 and 2010 */
         </style>
     <![endif]-->
 </head>
 <body>
 <!-- Wrapper/Container Table: Use a wrapper table to control the width and the background color consistently of your email. Use this approach instead of setting attributes on the body tag. -->
 <table cellpadding="0" cellspacing="0" border="0" id="backgroundTable" align="left" style="margin:1%;width:97%;padding:0;font-family:sans-serif;font-weight:100;border:1px solid #dbd9da">
     <tr>
         <td valign="top" style="padding:0;">
             <table cellpadding="0" cellspacing="0" border="0" align="left" width="100%">
                 <tr><td style="width:100%;padding:7px;background-color:#202020" valign="top">
                     <a style="color:#eeeeee;text-decoration:none;" href="${instance_url}">
                         ${'RhodeCode'}
                     </a>
                 </td></tr>
                 <tr>
                     <td style="padding:15px;" valign="top">
                         % for commit in data['push']['commits']:
                         <a href="${commit['url']}">${commit['short_id']}</a> by ${commit['author']} at ${commit['date']} <br/>
                         ${commit['message_html']} <br/>
                         <br/>
                         % endfor
                     </td>
                 </tr>
             </table>
         </td>
     </tr>
 </table>
 <!-- End of wrapper table -->
 <p><a style="margin-top:15px;margin-left:1%;font-family:sans-serif;font-weight:100;font-size:11px;color:#666666;text-decoration:none;" href="${instance_url}">
     ${'This is a notification from RhodeCode. %(instance_url)s' % {'instance_url': instance_url}}
 </a></p>
 </body>
 </html>
 ''')
 
+email_icon = '''
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<svg
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   viewBox="0 -256 1850 1850"
+   id="svg2989"
+   version="1.1"
+   inkscape:version="0.48.3.1 r9886"
+   width="100%"
+   height="100%"
+   sodipodi:docname="envelope_font_awesome.svg">
+  <metadata
+     id="metadata2999">
+    <rdf:RDF>
+      <cc:Work
+         rdf:about="">
+        <dc:format>image/svg+xml</dc:format>
+        <dc:type
+           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+      </cc:Work>
+    </rdf:RDF>
+  </metadata>
+  <defs
+     id="defs2997" />
+  <sodipodi:namedview
+     pagecolor="#ffffff"
+     bordercolor="#666666"
+     borderopacity="1"
+     objecttolerance="10"
+     gridtolerance="10"
+     guidetolerance="10"
+     inkscape:pageopacity="0"
+     inkscape:pageshadow="2"
+     inkscape:window-width="640"
+     inkscape:window-height="480"
+     id="namedview2995"
+     showgrid="false"
+     inkscape:zoom="0.13169643"
+     inkscape:cx="896"
+     inkscape:cy="896"
+     inkscape:window-x="0"
+     inkscape:window-y="25"
+     inkscape:window-maximized="0"
+     inkscape:current-layer="svg2989" />
+  <g
+     transform="matrix(1,0,0,-1,37.966102,1282.678)"
+     id="g2991">
+    <path
+       d="m 1664,32 v 768 q -32,-36 -69,-66 -268,-206 -426,-338 -51,-43 -83,-67 -32,-24 -86.5,-48.5 Q 945,256 897,256 h -1 -1 Q 847,256 792.5,280.5 738,305 706,329 674,353 623,396 465,528 197,734 160,764 128,800 V 32 Q 128,19 137.5,9.5 147,0 160,0 h 1472 q 13,0 22.5,9.5 9.5,9.5 9.5,22.5 z m 0,1051 v 11 13.5 q 0,0 -0.5,13 -0.5,13 -3,12.5 -2.5,-0.5 -5.5,9 -3,9.5 -9,7.5 -6,-2 -14,2.5 H 160 q -13,0 -22.5,-9.5 Q 128,1133 128,1120 128,952 275,836 468,684 676,519 682,514 711,489.5 740,465 757,452 774,439 801.5,420.5 829,402 852,393 q 23,-9 43,-9 h 1 1 q 20,0 43,9 23,9 50.5,27.5 27.5,18.5 44.5,31.5 17,13 46,37.5 29,24.5 35,29.5 208,165 401,317 54,43 100.5,115.5 46.5,72.5 46.5,131.5 z m 128,37 V 32 q 0,-66 -47,-113 -47,-47 -113,-47 H 160 Q 94,-128 47,-81 0,-34 0,32 v 1088 q 0,66 47,113 47,47 113,47 h 1472 q 66,0 113,-47 47,-47 47,-113 z"
+       id="path2993"
+       inkscape:connector-curvature="0"
+       style="fill:currentColor" />
+  </g>
+</svg>
+'''
 
-class EmailSettingsSchema(IntegrationSettingsSchemaBase):
+class EmailSettingsSchema(colander.Schema):
     @colander.instantiate(validator=colander.Length(min=1))
     class recipients(colander.SequenceSchema):
-        title = lazy_ugettext('Recipients')
-        description = lazy_ugettext('Email addresses to send push events to')
+        title = _('Recipients')
+        description = _('Email addresses to send push events to')
         widget = deform.widget.SequenceWidget(min_len=1)
 
         recipient = colander.SchemaNode(
             colander.String(),
-            title=lazy_ugettext('Email address'),
-            description=lazy_ugettext('Email address'),
+            title=_('Email address'),
+            description=_('Email address'),
             default='',
             validator=colander.Email(),
             widget=deform.widget.TextInputWidget(
                 placeholder='[e-mail]',
             ),
         )
 
 
 class EmailIntegrationType(IntegrationTypeBase):
     key = 'email'
-    display_name = lazy_ugettext('Email')
-    SettingsSchema = EmailSettingsSchema
+    display_name = _('Email')
+    description = _('Send repo push summaries to a list of recipients via email')
+    icon = email_icon
 
     def settings_schema(self):
         schema = EmailSettingsSchema()
         return schema
 
     def send_event(self, event):
         data = event.as_dict()
         log.debug('got event: %r', event)
 
         if isinstance(event, events.RepoPushEvent):
             repo_push_handler(data, self.settings)
         else:
             log.debug('ignoring event: %r', event)
 
 
 def repo_push_handler(data, settings):
     commit_num = len(data['push']['commits'])
     server_url = data['server_url']
 
     if commit_num == 0:
         subject = '[{repo_name}] {author} pushed {commit_num} commit on branches: {branches}'.format(
             author=data['actor']['username'],
             repo_name=data['repo']['repo_name'],
             commit_num=commit_num,
             branches=', '.join(
                 branch['name'] for branch in data['push']['branches'])
         )
     else:
         subject = '[{repo_name}] {author} pushed {commit_num} commits on branches: {branches}'.format(
             author=data['actor']['username'],
             repo_name=data['repo']['repo_name'],
             commit_num=commit_num,
             branches=', '.join(
                 branch['name'] for branch in data['push']['branches']))
 
     email_body_plaintext = repo_push_template_plaintext.render(
         data=data,
         subject=subject,
         instance_url=server_url)
 
     email_body_html = repo_push_template_html.render(
         data=data,
         subject=subject,
         instance_url=server_url)
 
     for email_address in settings['recipients']:
         run_task(
             tasks.send_email, email_address, subject,
             email_body_plaintext, email_body_html)

rhodecode/integrations/types/hipchat.py

@@ -1,242 +1,243 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2012-2016  RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 from __future__ import unicode_literals
 import deform
 import re
 import logging
 import requests
 import colander
 import textwrap
 from celery.task import task
 from mako.template import Template
 
 from rhodecode import events
-from rhodecode.translation import lazy_ugettext
+from rhodecode.translation import _
 from rhodecode.lib import helpers as h
 from rhodecode.lib.celerylib import run_task
 from rhodecode.lib.colander_utils import strip_whitespace
 from rhodecode.integrations.types.base import IntegrationTypeBase
-from rhodecode.integrations.schema import IntegrationSettingsSchemaBase
 
 log = logging.getLogger(__name__)
 
 
-class HipchatSettingsSchema(IntegrationSettingsSchemaBase):
+class HipchatSettingsSchema(colander.Schema):
     color_choices = [
-        ('yellow', lazy_ugettext('Yellow')),
-        ('red', lazy_ugettext('Red')),
-        ('green', lazy_ugettext('Green')),
-        ('purple', lazy_ugettext('Purple')),
-        ('gray', lazy_ugettext('Gray')),
+        ('yellow', _('Yellow')),
+        ('red', _('Red')),
+        ('green', _('Green')),
+        ('purple', _('Purple')),
+        ('gray', _('Gray')),
     ]
 
     server_url = colander.SchemaNode(
         colander.String(),
-        title=lazy_ugettext('Hipchat server URL'),
-        description=lazy_ugettext('Hipchat integration url.'),
+        title=_('Hipchat server URL'),
+        description=_('Hipchat integration url.'),
         default='',
         preparer=strip_whitespace,
         validator=colander.url,
         widget=deform.widget.TextInputWidget(
             placeholder='https://?.hipchat.com/v2/room/?/notification?auth_token=?',
         ),
     )
     notify = colander.SchemaNode(
         colander.Bool(),
-        title=lazy_ugettext('Notify'),
-        description=lazy_ugettext('Make a notification to the users in room.'),
+        title=_('Notify'),
+        description=_('Make a notification to the users in room.'),
         missing=False,
         default=False,
     )
     color = colander.SchemaNode(
         colander.String(),
-        title=lazy_ugettext('Color'),
-        description=lazy_ugettext('Background color of message.'),
+        title=_('Color'),
+        description=_('Background color of message.'),
         missing='',
         validator=colander.OneOf([x[0] for x in color_choices]),
         widget=deform.widget.Select2Widget(
             values=color_choices,
         ),
     )
 
 
 repo_push_template = Template('''
 <b>${data['actor']['username']}</b> pushed to
 %if data['push']['branches']:
 ${len(data['push']['branches']) > 1 and 'branches' or 'branch'}
 ${', '.join('<a href="%s">%s</a>' % (branch['url'], branch['name']) for branch in data['push']['branches'])}
 %else:
 unknown branch
 %endif
 in <a href="${data['repo']['url']}">${data['repo']['repo_name']}</a>
 <br>
 <ul>
 %for commit in data['push']['commits']:
     <li>
         <a href="${commit['url']}">${commit['short_id']}</a> - ${commit['message_html']}
     </li>
 %endfor
 </ul>
 ''')
 
 
-
 class HipchatIntegrationType(IntegrationTypeBase):
     key = 'hipchat'
-    display_name = lazy_ugettext('Hipchat')
+    display_name = _('Hipchat')
+    description = _('Send events such as repo pushes and pull requests to '
+                    'your hipchat channel.')
+    icon = '''<?xml version="1.0" encoding="utf-8"?><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"><svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 1000 1000" enable-background="new 0 0 1000 1000" xml:space="preserve"><g><g transform="translate(0.000000,511.000000) scale(0.100000,-0.100000)"><path fill="#205281" d="M4197.1,4662.4c-1661.5-260.4-3018-1171.6-3682.6-2473.3C219.9,1613.6,100,1120.3,100,462.6c0-1014,376.8-1918.4,1127-2699.4C2326.7-3377.6,3878.5-3898.3,5701-3730.5l486.5,44.5l208.9-123.3c637.2-373.4,1551.8-640.6,2240.4-650.9c304.9-6.9,335.7,0,417.9,75.4c185,174.7,147.3,411.1-89.1,548.1c-315.2,181.6-620,544.7-733.1,870.1l-51.4,157.6l472.7,472.7c349.4,349.4,520.7,551.5,657.7,774.2c784.5,1281.2,784.5,2788.5,0,4052.6c-236.4,376.8-794.8,966-1178.4,1236.7c-572.1,407.7-1264.1,709.1-1993.7,870.1c-267.2,58.2-479.6,75.4-1038,82.2C4714.4,4686.4,4310.2,4679.6,4197.1,4662.4z M5947.6,3740.9c1856.7-380.3,3127.6-1709.4,3127.6-3275c0-1000.3-534.4-1949.2-1466.2-2600.1c-188.4-133.6-287.8-226.1-301.5-284.4c-41.1-157.6,263.8-938.6,397.4-1020.8c20.5-10.3,34.3-44.5,34.3-75.4c0-167.8-811.9,195.3-1363.4,609.8l-181.6,137l-332.3-58.2c-445.3-78.8-1281.2-78.8-1702.6,0C2796-2569.2,1734.1-1832.6,1220.2-801.5C983.8-318.5,905,51.5,929,613.3c27.4,640.6,243.2,1192.1,685.1,1740.3c620,770.8,1661.5,1305.2,2822.8,1452.5C4806.9,3854,5553.7,3819.7,5947.6,3740.9z"/><path fill="#205281" d="M2381.5-345.9c-75.4-106.2-68.5-167.8,34.3-322c332.3-500.2,1010.6-928.4,1760.8-1120.2c417.9-106.2,1226.4-106.2,1644.3,0c712.5,181.6,1270.9,517.3,1685.4,1014C7681-561.7,7715.3-424.7,7616-325.4c-89.1,89.1-167.9,65.1-431.7-133.6c-835.8-630.3-2028-856.4-3086.5-585.8C3683.3-938.6,3142-685,2830.3-448.7C2576.8-253.4,2463.7-229.4,2381.5-345.9z"/></g></g><!-- Svg Vector Icons : http://www.onlinewebfonts.com/icon --></svg>'''
     valid_events = [
         events.PullRequestCloseEvent,
         events.PullRequestMergeEvent,
         events.PullRequestUpdateEvent,
         events.PullRequestCommentEvent,
         events.PullRequestReviewEvent,
         events.PullRequestCreateEvent,
         events.RepoPushEvent,
         events.RepoCreateEvent,
     ]
 
     def send_event(self, event):
         if event.__class__ not in self.valid_events:
             log.debug('event not valid: %r' % event)
             return
 
         if event.name not in self.settings['events']:
             log.debug('event ignored: %r' % event)
             return
 
         data = event.as_dict()
 
         text = '<b>%s<b> caused a <b>%s</b> event' % (
             data['actor']['username'], event.name)
 
         log.debug('handling hipchat event for %s' % event.name)
 
         if isinstance(event, events.PullRequestCommentEvent):
             text = self.format_pull_request_comment_event(event, data)
         elif isinstance(event, events.PullRequestReviewEvent):
             text = self.format_pull_request_review_event(event, data)
         elif isinstance(event, events.PullRequestEvent):
             text = self.format_pull_request_event(event, data)
         elif isinstance(event, events.RepoPushEvent):
             text = self.format_repo_push_event(data)
         elif isinstance(event, events.RepoCreateEvent):
             text = self.format_repo_create_event(data)
         else:
             log.error('unhandled event type: %r' % event)
 
         run_task(post_text_to_hipchat, self.settings, text)
 
     def settings_schema(self):
         schema = HipchatSettingsSchema()
         schema.add(colander.SchemaNode(
             colander.Set(),
             widget=deform.widget.CheckboxChoiceWidget(
                 values=sorted(
                     [(e.name, e.display_name) for e in self.valid_events]
                 )
             ),
             description="Events activated for this integration",
             name='events'
         ))
 
         return schema
 
     def format_pull_request_comment_event(self, event, data):
         comment_text = data['comment']['text']
         if len(comment_text) > 200:
             comment_text = '{comment_text}<a href="{comment_url}">...<a/>'.format(
                 comment_text=comment_text[:200],
                 comment_url=data['comment']['url'],
             )
 
         comment_status = ''
         if data['comment']['status']:
             comment_status = '[{}]: '.format(data['comment']['status'])
 
         return (textwrap.dedent(
             '''
             {user} commented on pull request <a href="{pr_url}">{number}</a> - {pr_title}:
             >>> {comment_status}{comment_text}
             ''').format(
                 comment_status=comment_status,
                 user=data['actor']['username'],
                 number=data['pullrequest']['pull_request_id'],
                 pr_url=data['pullrequest']['url'],
                 pr_status=data['pullrequest']['status'],
                 pr_title=data['pullrequest']['title'],
                 comment_text=comment_text
             )
         )
 
     def format_pull_request_review_event(self, event, data):
         return (textwrap.dedent(
             '''
             Status changed to {pr_status} for pull request <a href="{pr_url}">#{number}</a> - {pr_title}
             ''').format(
                 user=data['actor']['username'],
                 number=data['pullrequest']['pull_request_id'],
                 pr_url=data['pullrequest']['url'],
                 pr_status=data['pullrequest']['status'],
                 pr_title=data['pullrequest']['title'],
             )
         )
 
     def format_pull_request_event(self, event, data):
         action = {
             events.PullRequestCloseEvent: 'closed',
             events.PullRequestMergeEvent: 'merged',
             events.PullRequestUpdateEvent: 'updated',
             events.PullRequestCreateEvent: 'created',
         }.get(event.__class__, str(event.__class__))
 
         return ('Pull request <a href="{url}">#{number}</a> - {title} '
                 '{action} by {user}').format(
             user=data['actor']['username'],
             number=data['pullrequest']['pull_request_id'],
             url=data['pullrequest']['url'],
             title=data['pullrequest']['title'],
             action=action
         )
 
     def format_repo_push_event(self, data):
         result = repo_push_template.render(
             data=data,
         )
         return result
 
     def format_repo_create_event(self, data):
         return '<a href="{}">{}</a> ({}) repository created by <b>{}</b>'.format(
             data['repo']['url'],
             data['repo']['repo_name'],
             data['repo']['repo_type'],
             data['actor']['username'],
         )
 
 
 @task(ignore_result=True)
 def post_text_to_hipchat(settings, text):
     log.debug('sending %s to hipchat %s' % (text, settings['server_url']))
     resp = requests.post(settings['server_url'], json={
         "message": text,
         "color": settings.get('color', 'yellow'),
         "notify": settings.get('notify', False),
     })
     resp.raise_for_status()  # raise exception on a failed request

rhodecode/integrations/types/slack.py

@@ -1,253 +1,256 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2012-2016  RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 from __future__ import unicode_literals
 import deform
 import re
 import logging
 import requests
 import colander
 import textwrap
 from celery.task import task
 from mako.template import Template
 
 from rhodecode import events
-from rhodecode.translation import lazy_ugettext
+from rhodecode.translation import _
 from rhodecode.lib import helpers as h
 from rhodecode.lib.celerylib import run_task
 from rhodecode.lib.colander_utils import strip_whitespace
 from rhodecode.integrations.types.base import IntegrationTypeBase
-from rhodecode.integrations.schema import IntegrationSettingsSchemaBase
 
 log = logging.getLogger(__name__)
 
 
-class SlackSettingsSchema(IntegrationSettingsSchemaBase):
+class SlackSettingsSchema(colander.Schema):
     service = colander.SchemaNode(
         colander.String(),
-        title=lazy_ugettext('Slack service URL'),
-        description=h.literal(lazy_ugettext(
+        title=_('Slack service URL'),
+        description=h.literal(_(
             'This can be setup at the '
             '<a href="https://my.slack.com/services/new/incoming-webhook/">'
             'slack app manager</a>')),
         default='',
         preparer=strip_whitespace,
         validator=colander.url,
         widget=deform.widget.TextInputWidget(
             placeholder='https://hooks.slack.com/services/...',
         ),
     )
     username = colander.SchemaNode(
         colander.String(),
-        title=lazy_ugettext('Username'),
-        description=lazy_ugettext('Username to show notifications coming from.'),
+        title=_('Username'),
+        description=_('Username to show notifications coming from.'),
         missing='Rhodecode',
         preparer=strip_whitespace,
         widget=deform.widget.TextInputWidget(
             placeholder='Rhodecode'
         ),
     )
     channel = colander.SchemaNode(
         colander.String(),
-        title=lazy_ugettext('Channel'),
-        description=lazy_ugettext('Channel to send notifications to.'),
+        title=_('Channel'),
+        description=_('Channel to send notifications to.'),
         missing='',
         preparer=strip_whitespace,
         widget=deform.widget.TextInputWidget(
             placeholder='#general'
         ),
     )
     icon_emoji = colander.SchemaNode(
         colander.String(),
-        title=lazy_ugettext('Emoji'),
-        description=lazy_ugettext('Emoji to use eg. :studio_microphone:'),
+        title=_('Emoji'),
+        description=_('Emoji to use eg. :studio_microphone:'),
         missing='',
         preparer=strip_whitespace,
         widget=deform.widget.TextInputWidget(
             placeholder=':studio_microphone:'
         ),
     )
 
 
 repo_push_template = Template(r'''
 *${data['actor']['username']}* pushed to \
 %if data['push']['branches']:
 ${len(data['push']['branches']) > 1 and 'branches' or 'branch'} \
 ${', '.join('<%s|%s>' % (branch['url'], branch['name']) for branch in data['push']['branches'])} \
 %else:
 unknown branch \
 %endif
 in <${data['repo']['url']}|${data['repo']['repo_name']}>
 >>>
 %for commit in data['push']['commits']:
 <${commit['url']}|${commit['short_id']}> - ${commit['message_html']|html_to_slack_links}
 %endfor
 ''')
 
 
+
+
 class SlackIntegrationType(IntegrationTypeBase):
     key = 'slack'
-    display_name = lazy_ugettext('Slack')
-    SettingsSchema = SlackSettingsSchema
+    display_name = _('Slack')
+    description = _('Send events such as repo pushes and pull requests to '
+                    'your slack channel.')
+    icon = '''<?xml version="1.0" encoding="UTF-8" standalone="no"?><svg viewBox="0 0 256 256" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" preserveAspectRatio="xMidYMid"><g><path d="M165.963541,15.8384262 C162.07318,3.86308197 149.212328,-2.69009836 137.239082,1.20236066 C125.263738,5.09272131 118.710557,17.9535738 122.603016,29.9268197 L181.550164,211.292328 C185.597902,222.478689 197.682361,228.765377 209.282098,225.426885 C221.381246,221.943607 228.756984,209.093246 224.896,197.21023 C224.749115,196.756984 165.963541,15.8384262 165.963541,15.8384262" fill="#DFA22F"></path><path d="M74.6260984,45.515541 C70.7336393,33.5422951 57.8727869,26.9891148 45.899541,30.8794754 C33.9241967,34.7698361 27.3710164,47.6306885 31.2634754,59.6060328 L90.210623,240.971541 C94.2583607,252.157902 106.34282,258.44459 117.942557,255.104 C130.041705,251.62282 137.417443,238.772459 133.556459,226.887344 C133.409574,226.436197 74.6260984,45.515541 74.6260984,45.515541" fill="#3CB187"></path><path d="M240.161574,166.045377 C252.136918,162.155016 258.688,149.294164 254.797639,137.31882 C250.907279,125.345574 238.046426,118.792393 226.07318,122.682754 L44.7076721,181.632 C33.5213115,185.677639 27.234623,197.762098 30.5731148,209.361836 C34.0563934,221.460984 46.9067541,228.836721 58.7897705,224.975738 C59.2430164,224.828852 240.161574,166.045377 240.161574,166.045377" fill="#CE1E5B"></path><path d="M82.507541,217.270557 C94.312918,213.434754 109.528131,208.491016 125.855475,203.186361 C122.019672,191.380984 117.075934,176.163672 111.76918,159.83423 L68.4191475,173.924721 L82.507541,217.270557" fill="#392538"></path><path d="M173.847082,187.591344 C190.235279,182.267803 205.467279,177.31777 217.195016,173.507148 C213.359213,161.70177 208.413377,146.480262 203.106623,130.146623 L159.75659,144.237115 L173.847082,187.591344" fill="#BB242A"></path><path d="M210.484459,74.7058361 C222.457705,70.8154754 229.010885,57.954623 225.120525,45.9792787 C221.230164,34.0060328 208.369311,27.4528525 196.393967,31.3432131 L15.028459,90.292459 C3.84209836,94.3380984 -2.44459016,106.422557 0.896,118.022295 C4.37718033,130.121443 17.227541,137.49718 29.1126557,133.636197 C29.5638033,133.489311 210.484459,74.7058361 210.484459,74.7058361" fill="#72C5CD"></path><path d="M52.8220328,125.933115 C64.6274098,122.097311 79.8468197,117.151475 96.1762623,111.84682 C90.8527213,95.4565246 85.9026885,80.2245246 82.0920656,68.4946885 L38.731541,82.5872787 L52.8220328,125.933115" fill="#248C73"></path><path d="M144.159475,96.256 C160.551869,90.9303607 175.785967,85.9803279 187.515803,82.1676066 C182.190164,65.7752131 177.240131,50.5390164 173.42741,38.807082 L130.068984,52.8996721 L144.159475,96.256" fill="#62803A"></path></g></svg>'''
     valid_events = [
         events.PullRequestCloseEvent,
         events.PullRequestMergeEvent,
         events.PullRequestUpdateEvent,
         events.PullRequestCommentEvent,
         events.PullRequestReviewEvent,
         events.PullRequestCreateEvent,
         events.RepoPushEvent,
         events.RepoCreateEvent,
     ]
 
     def send_event(self, event):
         if event.__class__ not in self.valid_events:
             log.debug('event not valid: %r' % event)
             return
 
         if event.name not in self.settings['events']:
             log.debug('event ignored: %r' % event)
             return
 
         data = event.as_dict()
 
         text = '*%s* caused a *%s* event' % (
             data['actor']['username'], event.name)
 
         log.debug('handling slack event for %s' % event.name)
 
         if isinstance(event, events.PullRequestCommentEvent):
             text = self.format_pull_request_comment_event(event, data)
         elif isinstance(event, events.PullRequestReviewEvent):
             text = self.format_pull_request_review_event(event, data)
         elif isinstance(event, events.PullRequestEvent):
             text = self.format_pull_request_event(event, data)
         elif isinstance(event, events.RepoPushEvent):
             text = self.format_repo_push_event(data)
         elif isinstance(event, events.RepoCreateEvent):
             text = self.format_repo_create_event(data)
         else:
             log.error('unhandled event type: %r' % event)
 
         run_task(post_text_to_slack, self.settings, text)
 
     def settings_schema(self):
         schema = SlackSettingsSchema()
         schema.add(colander.SchemaNode(
             colander.Set(),
             widget=deform.widget.CheckboxChoiceWidget(
                 values=sorted(
                     [(e.name, e.display_name) for e in self.valid_events]
                 )
             ),
             description="Events activated for this integration",
             name='events'
         ))
 
         return schema
 
     def format_pull_request_comment_event(self, event, data):
         comment_text = data['comment']['text']
         if len(comment_text) > 200:
             comment_text = '<{comment_url}|{comment_text}...>'.format(
                 comment_text=comment_text[:200],
                 comment_url=data['comment']['url'],
             )
 
         comment_status = ''
         if data['comment']['status']:
             comment_status = '[{}]: '.format(data['comment']['status'])
 
         return (textwrap.dedent(
             '''
             {user} commented on pull request <{pr_url}|#{number}> - {pr_title}:
             >>> {comment_status}{comment_text}
             ''').format(
                 comment_status=comment_status,
                 user=data['actor']['username'],
                 number=data['pullrequest']['pull_request_id'],
                 pr_url=data['pullrequest']['url'],
                 pr_status=data['pullrequest']['status'],
                 pr_title=data['pullrequest']['title'],
                 comment_text=comment_text
             )
         )
 
     def format_pull_request_review_event(self, event, data):
         return (textwrap.dedent(
             '''
             Status changed to {pr_status} for pull request <{pr_url}|#{number}> - {pr_title}
             ''').format(
                 user=data['actor']['username'],
                 number=data['pullrequest']['pull_request_id'],
                 pr_url=data['pullrequest']['url'],
                 pr_status=data['pullrequest']['status'],
                 pr_title=data['pullrequest']['title'],
             )
         )
 
     def format_pull_request_event(self, event, data):
         action = {
             events.PullRequestCloseEvent: 'closed',
             events.PullRequestMergeEvent: 'merged',
             events.PullRequestUpdateEvent: 'updated',
             events.PullRequestCreateEvent: 'created',
         }.get(event.__class__, str(event.__class__))
 
         return ('Pull request <{url}|#{number}> - {title} '
                 '{action} by {user}').format(
             user=data['actor']['username'],
             number=data['pullrequest']['pull_request_id'],
             url=data['pullrequest']['url'],
             title=data['pullrequest']['title'],
             action=action
         )
 
     def format_repo_push_event(self, data):
         result = repo_push_template.render(
             data=data,
             html_to_slack_links=html_to_slack_links,
         )
         return result
 
     def format_repo_create_event(self, data):
         return '<{}|{}> ({}) repository created by *{}*'.format(
             data['repo']['url'],
             data['repo']['repo_name'],
             data['repo']['repo_type'],
             data['actor']['username'],
         )
 
 
 def html_to_slack_links(message):
     return re.compile(r'<a .*?href=["\'](.+?)".*?>(.+?)</a>').sub(
         r'<\1|\2>', message)
 
 
 @task(ignore_result=True)
 def post_text_to_slack(settings, text):
     log.debug('sending %s to slack %s' % (text, settings['service']))
     resp = requests.post(settings['service'], json={
         "channel": settings.get('channel', ''),
         "username": settings.get('username', 'Rhodecode'),
         "text": text,
         "icon_emoji": settings.get('icon_emoji', ':studio_microphone:')
     })
     resp.raise_for_status()  # raise exception on a failed request

rhodecode/integrations/types/webhook.py

@@ -1,111 +1,117 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2012-2016  RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 from __future__ import unicode_literals
 
 import deform
 import logging
 import requests
 import colander
 from celery.task import task
 from mako.template import Template
 
 from rhodecode import events
-from rhodecode.translation import lazy_ugettext
+from rhodecode.translation import _
 from rhodecode.integrations.types.base import IntegrationTypeBase
-from rhodecode.integrations.schema import IntegrationSettingsSchemaBase
 
 log = logging.getLogger(__name__)
 
 
-class WebhookSettingsSchema(IntegrationSettingsSchemaBase):
+class WebhookSettingsSchema(colander.Schema):
     url = colander.SchemaNode(
         colander.String(),
-        title=lazy_ugettext('Webhook URL'),
-        description=lazy_ugettext('URL of the webhook to receive POST event.'),
-        default='',
+        title=_('Webhook URL'),
+        description=_('URL of the webhook to receive POST event.'),
+        missing=colander.required,
+        required=True,
         validator=colander.url,
         widget=deform.widget.TextInputWidget(
             placeholder='https://www.example.com/webhook'
         ),
     )
     secret_token = colander.SchemaNode(
         colander.String(),
-        title=lazy_ugettext('Secret Token'),
-        description=lazy_ugettext('String used to validate received payloads.'),
+        title=_('Secret Token'),
+        description=_('String used to validate received payloads.'),
         default='',
+        missing='',
         widget=deform.widget.TextInputWidget(
             placeholder='secret_token'
         ),
     )
 
 
+
+
 class WebhookIntegrationType(IntegrationTypeBase):
     key = 'webhook'
-    display_name = lazy_ugettext('Webhook')
+    display_name = _('Webhook')
+    description = _('Post json events to a webhook endpoint')
+    icon = '''<?xml version="1.0" encoding="UTF-8" standalone="no"?><svg viewBox="0 0 256 239" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" preserveAspectRatio="xMidYMid"><g><path d="M119.540432,100.502743 C108.930124,118.338815 98.7646301,135.611455 88.3876025,152.753617 C85.7226696,157.154315 84.4040417,160.738531 86.5332204,166.333309 C92.4107024,181.787152 84.1193605,196.825836 68.5350381,200.908244 C53.8383677,204.759349 39.5192953,195.099955 36.6032893,179.365384 C34.0194114,165.437749 44.8274148,151.78491 60.1824106,149.608284 C61.4694072,149.424428 62.7821041,149.402681 64.944891,149.240571 C72.469175,136.623655 80.1773157,123.700312 88.3025935,110.073173 C73.611854,95.4654658 64.8677898,78.3885437 66.803227,57.2292132 C68.1712787,42.2715849 74.0527146,29.3462646 84.8033863,18.7517722 C105.393354,-1.53572199 136.805164,-4.82141828 161.048542,10.7510424 C184.333097,25.7086706 194.996783,54.8450075 185.906752,79.7822957 C179.052655,77.9239597 172.151111,76.049808 164.563565,73.9917997 C167.418285,60.1274266 165.306899,47.6765751 155.95591,37.0109123 C149.777932,29.9690049 141.850349,26.2780332 132.835442,24.9178894 C114.764113,22.1877169 97.0209573,33.7983633 91.7563309,51.5355878 C85.7800012,71.6669027 94.8245623,88.1111998 119.540432,100.502743 L119.540432,100.502743 Z" fill="#C73A63"></path><path d="M149.841194,79.4106285 C157.316054,92.5969067 164.905578,105.982857 172.427885,119.246236 C210.44865,107.483365 239.114472,128.530009 249.398582,151.063322 C261.81978,178.282014 253.328765,210.520191 228.933162,227.312431 C203.893073,244.551464 172.226236,241.605803 150.040866,219.46195 C155.694953,214.729124 161.376716,209.974552 167.44794,204.895759 C189.360489,219.088306 208.525074,218.420096 222.753207,201.614016 C234.885769,187.277151 234.622834,165.900356 222.138374,151.863988 C207.730339,135.66681 188.431321,135.172572 165.103273,150.721309 C155.426087,133.553447 145.58086,116.521995 136.210101,99.2295848 C133.05093,93.4015266 129.561608,90.0209366 122.440622,88.7873178 C110.547271,86.7253555 102.868785,76.5124151 102.408155,65.0698097 C101.955433,53.7537294 108.621719,43.5249733 119.04224,39.5394355 C129.363912,35.5914599 141.476705,38.7783085 148.419765,47.554004 C154.093621,54.7244134 155.896602,62.7943365 152.911402,71.6372484 C152.081082,74.1025091 151.00562,76.4886916 149.841194,79.4106285 L149.841194,79.4106285 Z" fill="#4B4B4B"></path><path d="M167.706921,187.209935 L121.936499,187.209935 C117.54964,205.253587 108.074103,219.821756 91.7464461,229.085759 C79.0544063,236.285822 65.3738898,238.72736 50.8136292,236.376762 C24.0061432,232.053165 2.08568567,207.920497 0.156179306,180.745298 C-2.02835403,149.962159 19.1309765,122.599149 47.3341915,116.452801 C49.2814904,123.524363 51.2485589,130.663141 53.1958579,137.716911 C27.3195169,150.919004 18.3639187,167.553089 25.6054984,188.352614 C31.9811726,206.657224 50.0900643,216.690262 69.7528413,212.809503 C89.8327554,208.847688 99.9567329,192.160226 98.7211371,165.37844 C117.75722,165.37844 136.809118,165.180745 155.847178,165.475311 C163.280522,165.591951 169.019617,164.820939 174.620326,158.267339 C183.840836,147.48306 200.811003,148.455721 210.741239,158.640984 C220.88894,169.049642 220.402609,185.79839 209.663799,195.768166 C199.302587,205.38802 182.933414,204.874012 173.240413,194.508846 C171.247644,192.37176 169.677943,189.835329 167.706921,187.209935 L167.706921,187.209935 Z" fill="#4A4A4A"></path></g></svg>'''
+
     valid_events = [
         events.PullRequestCloseEvent,
         events.PullRequestMergeEvent,
         events.PullRequestUpdateEvent,
         events.PullRequestCommentEvent,
         events.PullRequestReviewEvent,
         events.PullRequestCreateEvent,
         events.RepoPushEvent,
         events.RepoCreateEvent,
     ]
 
     def settings_schema(self):
         schema = WebhookSettingsSchema()
         schema.add(colander.SchemaNode(
             colander.Set(),
             widget=deform.widget.CheckboxChoiceWidget(
                 values=sorted(
                     [(e.name, e.display_name) for e in self.valid_events]
                 )
             ),
             description="Events activated for this integration",
             name='events'
         ))
         return schema
 
     def send_event(self, event):
         log.debug('handling event %s with webhook integration %s',
             event.name, self)
 
         if event.__class__ not in self.valid_events:
             log.debug('event not valid: %r' % event)
             return
 
         if event.name not in self.settings['events']:
             log.debug('event ignored: %r' % event)
             return
 
         data = event.as_dict()
         post_to_webhook(data, self.settings)
 
 
 @task(ignore_result=True)
 def post_to_webhook(data, settings):
     log.debug('sending event:%s to webhook %s', data['name'], settings['url'])
     resp = requests.post(settings['url'], json={
         'token': settings['secret_token'],
         'event': data
     })
     resp.raise_for_status()  # raise exception on a failed request

rhodecode/integrations/views.py

@@ -1,299 +1,385 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2012-2016  RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
-import colander
-import logging
 import pylons
 import deform
+import logging
+import colander
+import peppercorn
+import webhelpers.paginate
 
-from pyramid.httpexceptions import HTTPFound, HTTPForbidden
+from pyramid.httpexceptions import HTTPFound, HTTPForbidden, HTTPBadRequest
 from pyramid.renderers import render
 from pyramid.response import Response
 
 from rhodecode.lib import auth
 from rhodecode.lib.auth import LoginRequired, HasPermissionAllDecorator
+from rhodecode.lib.utils2 import safe_int
+from rhodecode.lib.helpers import Page
 from rhodecode.model.db import Repository, RepoGroup, Session, Integration
 from rhodecode.model.scm import ScmModel
 from rhodecode.model.integration import IntegrationModel
 from rhodecode.admin.navigation import navigation_list
 from rhodecode.translation import _
 from rhodecode.integrations import integration_type_registry
+from rhodecode.model.validation_schema.schemas.integration_schema import (
+    make_integration_schema)
 
 log = logging.getLogger(__name__)
 
 
 class IntegrationSettingsViewBase(object):
     """ Base Integration settings view used by both repo / global settings """
 
     def __init__(self, context, request):
         self.context = context
         self.request = request
         self._load_general_context()
 
         if not self.perm_check(request.user):
             raise HTTPForbidden()
 
     def _load_general_context(self):
         """
         This avoids boilerplate for repo/global+list/edit+views/templates
         by doing all possible contexts at the same time however it should
         be split up into separate functions once more "contexts" exist
         """
 
         self.IntegrationType = None
         self.repo = None
         self.repo_group = None
         self.integration = None
         self.integrations = {}
 
         request = self.request
 
-        if 'repo_name' in request.matchdict:  # we're in a repo context
+        if 'repo_name' in request.matchdict:  # in repo settings context
             repo_name = request.matchdict['repo_name']
             self.repo = Repository.get_by_repo_name(repo_name)
 
-        if 'repo_group_name' in request.matchdict: # we're in repo_group context
+        if 'repo_group_name' in request.matchdict: # in group settings context
             repo_group_name = request.matchdict['repo_group_name']
             self.repo_group = RepoGroup.get_by_group_name(repo_group_name)
 
-        if 'integration' in request.matchdict:  # we're in integration context
+
+        if 'integration' in request.matchdict:  # integration type context
             integration_type = request.matchdict['integration']
             self.IntegrationType = integration_type_registry[integration_type]
 
         if 'integration_id' in request.matchdict:  # single integration context
             integration_id = request.matchdict['integration_id']
             self.integration = Integration.get(integration_id)
-        else:                                      # list integrations context
-            integrations = IntegrationModel().get_integrations(
-                repo=self.repo, repo_group=self.repo_group)
 
-            for integration in integrations:
-                self.integrations.setdefault(integration.integration_type, []
-                    ).append(integration)
+            # extra perms check just in case
+            if not self._has_perms_for_integration(self.integration):
+                raise HTTPForbidden()
 
         self.settings = self.integration and self.integration.settings or {}
+        self.admin_view = not (self.repo or self.repo_group)
+
+    def _has_perms_for_integration(self, integration):
+        perms = self.request.user.permissions
+
+        if 'hg.admin' in perms['global']:
+            return True
+
+        if integration.repo:
+            return perms['repositories'].get(
+                integration.repo.repo_name) == 'repository.admin'
+
+        if integration.repo_group:
+            return perms['repositories_groups'].get(
+                integration.repo_group.group_name) == 'group.admin'
+
+        return False
 
     def _template_c_context(self):
         # TODO: dan: this is a stopgap in order to inherit from current pylons
         # based admin/repo settings templates - this should be removed entirely
         # after port to pyramid
 
         c = pylons.tmpl_context
         c.active = 'integrations'
         c.rhodecode_user = self.request.user
         c.repo = self.repo
         c.repo_group = self.repo_group
         c.repo_name = self.repo and self.repo.repo_name or None
         c.repo_group_name = self.repo_group and self.repo_group.group_name or None
+
         if self.repo:
             c.repo_info = self.repo
             c.rhodecode_db_repo = self.repo
             c.repository_pull_requests = ScmModel().get_pull_requests(self.repo)
         else:
             c.navlist = navigation_list(self.request)
 
         return c
 
     def _form_schema(self):
-        if self.integration:
-            settings = self.integration.settings
-        else:
-            settings = {}
-        return self.IntegrationType(settings=settings).settings_schema()
+        schema = make_integration_schema(IntegrationType=self.IntegrationType,
+                                         settings=self.settings)
 
-    def settings_get(self, defaults=None, errors=None, form=None):
-        """
-        View that displays the plugin settings as a form.
-        """
-        defaults = defaults or {}
-        errors = errors or {}
+        # returns a clone, important if mutating the schema later
+        return schema.bind(
+            permissions=self.request.user.permissions,
+            no_scope=not self.admin_view)
+
+
+    def _form_defaults(self):
+        defaults = {}
 
         if self.integration:
-            defaults = self.integration.settings or {}
-            defaults['name'] = self.integration.name
-            defaults['enabled'] = self.integration.enabled
+            defaults['settings'] = self.integration.settings or {}
+            defaults['options'] = {
+                'name': self.integration.name,
+                'enabled': self.integration.enabled,
+                'scope': self.integration.scope,
+            }
         else:
             if self.repo:
                 scope = _('{repo_name} repository').format(
                     repo_name=self.repo.repo_name)
             elif self.repo_group:
                 scope = _('{repo_group_name} repo group').format(
                     repo_group_name=self.repo_group.group_name)
             else:
                 scope = _('Global')
 
-            defaults['name'] = '{} {} integration'.format(scope,
-                self.IntegrationType.display_name)
-            defaults['enabled'] = True
+            defaults['options'] = {
+                'enabled': True,
+                'name': _('{name} integration').format(
+                    name=self.IntegrationType.display_name),
+            }
+            if self.repo:
+                defaults['options']['scope'] = self.repo
+            elif self.repo_group:
+                defaults['options']['scope'] = self.repo_group
+
+        return defaults
 
-        schema = self._form_schema().bind(request=self.request)
+    def _delete_integration(self, integration):
+        Session().delete(self.integration)
+        Session().commit()
+        self.request.session.flash(
+            _('Integration {integration_name} deleted successfully.').format(
+                integration_name=self.integration.name),
+            queue='success')
+
+        if self.repo:
+            redirect_to = self.request.route_url(
+                'repo_integrations_home', repo_name=self.repo.repo_name)
+        elif self.repo_group:
+            redirect_to = self.request.route_url(
+                'repo_group_integrations_home',
+                repo_group_name=self.repo_group.group_name)
+        else:
+            redirect_to = self.request.route_url('global_integrations_home')
+        raise HTTPFound(redirect_to)
+
+    def settings_get(self, defaults=None, form=None):
+        """
+        View that displays the integration settings as a form.
+        """
+
+        defaults = defaults or self._form_defaults()
+        schema = self._form_schema()
 
         if self.integration:
             buttons = ('submit', 'delete')
         else:
             buttons = ('submit',)
 
         form = form or deform.Form(schema, appstruct=defaults, buttons=buttons)
 
-        for node in schema:
-            setting = self.settings.get(node.name)
-            if setting is not None:
-                defaults.setdefault(node.name, setting)
-            else:
-                if node.default:
-                    defaults.setdefault(node.name, node.default)
-
         template_context = {
             'form': form,
-            'defaults': defaults,
-            'errors': errors,
-            'schema': schema,
             'current_IntegrationType': self.IntegrationType,
             'integration': self.integration,
-            'settings': self.settings,
-            'resource': self.context,
             'c': self._template_c_context(),
         }
 
         return template_context
 
     @auth.CSRFRequired()
     def settings_post(self):
         """
-        View that validates and stores the plugin settings.
+        View that validates and stores the integration settings.
         """
-        if self.request.params.get('delete'):
-            Session().delete(self.integration)
-            Session().commit()
-            self.request.session.flash(
-                _('Integration {integration_name} deleted successfully.').format(
-                    integration_name=self.integration.name),
-                queue='success')
-            if self.repo:
-                redirect_to = self.request.route_url(
-                    'repo_integrations_home', repo_name=self.repo.repo_name)
-            else:
-                redirect_to = self.request.route_url('global_integrations_home')
-            raise HTTPFound(redirect_to)
+        controls = self.request.POST.items()
+        pstruct = peppercorn.parse(controls)
+
+        if self.integration and pstruct.get('delete'):
+            return self._delete_integration(self.integration)
+
+        schema = self._form_schema()
+
+        skip_settings_validation = False
+        if self.integration and 'enabled' not in pstruct.get('options', {}):
+            skip_settings_validation = True
+            schema['settings'].validator = None
+            for field in schema['settings'].children:
+                field.validator = None
+                field.missing = ''
 
-        schema = self._form_schema().bind(request=self.request)
+        if self.integration:
+            buttons = ('submit', 'delete')
+        else:
+            buttons = ('submit',)
 
-        form = deform.Form(schema, buttons=('submit', 'delete'))
+        form = deform.Form(schema, buttons=buttons)
 
-        params = {}
-        for node in schema.children:
-            if type(node.typ) in (colander.Set, colander.List):
-                val = self.request.params.getall(node.name)
-            else:
-                val = self.request.params.get(node.name)
-            if val:
-                params[node.name] = val
+        if not self.admin_view:
+            # scope is read only field in these cases, and has to be added
+            options = pstruct.setdefault('options', {})
+            if 'scope' not in options:
+                if self.repo:
+                    options['scope'] = 'repo:{}'.format(self.repo.repo_name)
+                elif self.repo_group:
+                    options['scope'] = 'repogroup:{}'.format(
+                        self.repo_group.group_name)
 
-        controls = self.request.POST.items()
         try:
-            valid_data = form.validate(controls)
+            valid_data = form.validate_pstruct(pstruct)
         except deform.ValidationFailure as e:
             self.request.session.flash(
                 _('Errors exist when saving integration settings. '
                   'Please check the form inputs.'),
                 queue='error')
-            return self.settings_get(errors={}, defaults=params, form=e)
+            return self.settings_get(form=e)
 
         if not self.integration:
             self.integration = Integration()
             self.integration.integration_type = self.IntegrationType.key
-            if self.repo:
-                self.integration.repo = self.repo
-            elif self.repo_group:
-                self.integration.repo_group = self.repo_group
             Session().add(self.integration)
 
-        self.integration.enabled = valid_data.pop('enabled', False)
-        self.integration.name = valid_data.pop('name')
-        self.integration.settings = valid_data
+        scope = valid_data['options']['scope']
 
+        IntegrationModel().update_integration(self.integration,
+            name=valid_data['options']['name'],
+            enabled=valid_data['options']['enabled'],
+            settings=valid_data['settings'],
+            scope=scope)
+
+        self.integration.settings = valid_data['settings']
         Session().commit()
-
         # Display success message and redirect.
         self.request.session.flash(
             _('Integration {integration_name} updated successfully.').format(
                 integration_name=self.IntegrationType.display_name),
             queue='success')
 
-        if self.repo:
-            redirect_to = self.request.route_url(
-                'repo_integrations_edit', repo_name=self.repo.repo_name,
+
+        # if integration scope changes, we must redirect to the right place
+        # keeping in mind if the original view was for /repo/ or /_admin/
+        admin_view = not (self.repo or self.repo_group)
+
+        if isinstance(self.integration.scope, Repository) and not admin_view:
+            redirect_to = self.request.route_path(
+                'repo_integrations_edit',
+                repo_name=self.integration.scope.repo_name,
                 integration=self.integration.integration_type,
                 integration_id=self.integration.integration_id)
-        elif self.repo:
-            redirect_to = self.request.route_url(
+        elif isinstance(self.integration.scope, RepoGroup) and not admin_view:
+            redirect_to = self.request.route_path(
                 'repo_group_integrations_edit',
-                repo_group_name=self.repo_group.group_name,
+                repo_group_name=self.integration.scope.group_name,
                 integration=self.integration.integration_type,
                 integration_id=self.integration.integration_id)
         else:
-            redirect_to = self.request.route_url(
+            redirect_to = self.request.route_path(
                 'global_integrations_edit',
                 integration=self.integration.integration_type,
                 integration_id=self.integration.integration_id)
 
         return HTTPFound(redirect_to)
 
     def index(self):
-        current_integrations = self.integrations
-        if self.IntegrationType:
-            current_integrations = {
-                self.IntegrationType.key: self.integrations.get(
-                    self.IntegrationType.key, [])
-            }
+        """ List integrations """
+        if self.repo:
+            scope = self.repo
+        elif self.repo_group:
+            scope = self.repo_group
+        else:
+            scope = 'all'
+
+        integrations = []
+
+        for integration in IntegrationModel().get_integrations(
+                        scope=scope, IntegrationType=self.IntegrationType):
+
+            # extra permissions check *just in case*
+            if not self._has_perms_for_integration(integration):
+                continue
+            integrations.append(integration)
+
+        sort_arg = self.request.GET.get('sort', 'name:asc')
+        if ':' in sort_arg:
+            sort_field, sort_dir = sort_arg.split(':')
+        else:
+            sort_field = sort_arg, 'asc'
+
+        assert sort_field in ('name', 'integration_type', 'enabled', 'scope')
+
+        integrations.sort(
+            key=lambda x: getattr(x[1], sort_field), reverse=(sort_dir=='desc'))
+
+
+        page_url = webhelpers.paginate.PageURL(
+            self.request.path, self.request.GET)
+        page = safe_int(self.request.GET.get('page', 1), 1)
+
+        integrations = Page(integrations, page=page, items_per_page=10,
+                               url=page_url)
 
         template_context = {
+            'sort_field': sort_field,
+            'rev_sort_dir': sort_dir != 'desc' and 'desc' or 'asc',
             'current_IntegrationType': self.IntegrationType,
-            'current_integrations': current_integrations,
+            'integrations_list': integrations,
             'available_integrations': integration_type_registry,
-            'c': self._template_c_context()
+            'c': self._template_c_context(),
+            'request': self.request,
         }
+        return template_context
 
-        if self.repo:
-            html = render('rhodecode:templates/admin/integrations/list.html',
-                          template_context,
-                          request=self.request)
-        else:
-            html = render('rhodecode:templates/admin/integrations/list.html',
-                          template_context,
-                          request=self.request)
-
-        return Response(html)
-
+    def new_integration(self):
+        template_context = {
+            'available_integrations': integration_type_registry,
+            'c': self._template_c_context(),
+        }
+        return template_context
 
 class GlobalIntegrationsView(IntegrationSettingsViewBase):
     def perm_check(self, user):
         return auth.HasPermissionAll('hg.admin').check_permissions(user=user)
 
 
 class RepoIntegrationsView(IntegrationSettingsViewBase):
     def perm_check(self, user):
         return auth.HasRepoPermissionAll('repository.admin'
             )(repo_name=self.repo.repo_name, user=user)
 
+
 class RepoGroupIntegrationsView(IntegrationSettingsViewBase):
     def perm_check(self, user):
         return auth.HasRepoGroupPermissionAll('group.admin'
             )(group_name=self.repo_group.group_name, user=user)
+

rhodecode/lib/dbmigrate/schema/db_4_4_0_0.py

@@ -1,3506 +1,3505 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2016  RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 Database Models for RhodeCode Enterprise
 """
 
 import os
 import sys
 import time
 import hashlib
 import logging
 import datetime
 import warnings
 import ipaddress
 import functools
 import traceback
 import collections
 
 
 from sqlalchemy import *
 from sqlalchemy.exc import IntegrityError
 from sqlalchemy.ext.declarative import declared_attr
 from sqlalchemy.ext.hybrid import hybrid_property
 from sqlalchemy.orm import (
     relationship, joinedload, class_mapper, validates, aliased)
 from sqlalchemy.sql.expression import true
 from beaker.cache import cache_region, region_invalidate
 from webob.exc import HTTPNotFound
 from zope.cachedescriptors.property import Lazy as LazyProperty
 
 from pylons import url
 from pylons.i18n.translation import lazy_ugettext as _
 
 from rhodecode.lib.vcs import get_backend, get_vcs_instance
 from rhodecode.lib.vcs.utils.helpers import get_scm
 from rhodecode.lib.vcs.exceptions import VCSError
 from rhodecode.lib.vcs.backends.base import (
     EmptyCommit, Reference, MergeFailureReason)
 from rhodecode.lib.utils2 import (
     str2bool, safe_str, get_commit_safe, safe_unicode, remove_prefix, md5_safe,
     time_to_datetime, aslist, Optional, safe_int, get_clone_url, AttributeDict)
 from rhodecode.lib.jsonalchemy import MutationObj, JsonType, JSONDict
 from rhodecode.lib.ext_json import json
 from rhodecode.lib.caching_query import FromCache
 from rhodecode.lib.encrypt import AESCipher
 
 from rhodecode.model.meta import Base, Session
 
 URL_SEP = '/'
 log = logging.getLogger(__name__)
 
 # =============================================================================
 # BASE CLASSES
 # =============================================================================
 
 # this is propagated from .ini file rhodecode.encrypted_values.secret or
 # beaker.session.secret if first is not set.
 # and initialized at environment.py
 ENCRYPTION_KEY = None
 
 # used to sort permissions by types, '#' used here is not allowed to be in
 # usernames, and it's very early in sorted string.printable table.
 PERMISSION_TYPE_SORT = {
     'admin': '####',
     'write': '###',
     'read':  '##',
     'none':  '#',
 }
 
 
 def display_sort(obj):
     """
     Sort function used to sort permissions in .permissions() function of
     Repository, RepoGroup, UserGroup. Also it put the default user in front
     of all other resources
     """
 
     if obj.username == User.DEFAULT_USER:
         return '#####'
     prefix = PERMISSION_TYPE_SORT.get(obj.permission.split('.')[-1], '')
     return prefix + obj.username
 
 
 def _hash_key(k):
     return md5_safe(k)
 
 
 class EncryptedTextValue(TypeDecorator):
     """
     Special column for encrypted long text data, use like::
 
         value = Column("encrypted_value", EncryptedValue(), nullable=False)
 
     This column is intelligent so if value is in unencrypted form it return
     unencrypted form, but on save it always encrypts
     """
     impl = Text
 
     def process_bind_param(self, value, dialect):
         if not value:
             return value
         if value.startswith('enc$aes$') or value.startswith('enc$aes_hmac$'):
             # protect against double encrypting if someone manually starts
             # doing
             raise ValueError('value needs to be in unencrypted format, ie. '
                              'not starting with enc$aes')
         return 'enc$aes_hmac$%s' % AESCipher(
             ENCRYPTION_KEY, hmac=True).encrypt(value)
 
     def process_result_value(self, value, dialect):
         import rhodecode
 
         if not value:
             return value
 
         parts = value.split('$', 3)
         if not len(parts) == 3:
             # probably not encrypted values
             return value
         else:
             if parts[0] != 'enc':
                 # parts ok but without our header ?
                 return value
             enc_strict_mode = str2bool(rhodecode.CONFIG.get(
                 'rhodecode.encrypted_values.strict') or True)
             # at that stage we know it's our encryption
             if parts[1] == 'aes':
                 decrypted_data = AESCipher(ENCRYPTION_KEY).decrypt(parts[2])
             elif parts[1] == 'aes_hmac':
                 decrypted_data = AESCipher(
                     ENCRYPTION_KEY, hmac=True,
                     strict_verification=enc_strict_mode).decrypt(parts[2])
             else:
                 raise ValueError(
                     'Encryption type part is wrong, must be `aes` '
                     'or `aes_hmac`, got `%s` instead' % (parts[1]))
             return decrypted_data
 
 
 class BaseModel(object):
     """
     Base Model for all classes
     """
 
     @classmethod
     def _get_keys(cls):
         """return column names for this model """
         return class_mapper(cls).c.keys()
 
     def get_dict(self):
         """
         return dict with keys and values corresponding
         to this model data """
 
         d = {}
         for k in self._get_keys():
             d[k] = getattr(self, k)
 
         # also use __json__() if present to get additional fields
         _json_attr = getattr(self, '__json__', None)
         if _json_attr:
             # update with attributes from __json__
             if callable(_json_attr):
                 _json_attr = _json_attr()
             for k, val in _json_attr.iteritems():
                 d[k] = val
         return d
 
     def get_appstruct(self):
         """return list with keys and values tuples corresponding
         to this model data """
 
         l = []
         for k in self._get_keys():
             l.append((k, getattr(self, k),))
         return l
 
     def populate_obj(self, populate_dict):
         """populate model with data from given populate_dict"""
 
         for k in self._get_keys():
             if k in populate_dict:
                 setattr(self, k, populate_dict[k])
 
     @classmethod
     def query(cls):
         return Session().query(cls)
 
     @classmethod
     def get(cls, id_):
         if id_:
             return cls.query().get(id_)
 
     @classmethod
     def get_or_404(cls, id_):
         try:
             id_ = int(id_)
         except (TypeError, ValueError):
             raise HTTPNotFound
 
         res = cls.query().get(id_)
         if not res:
             raise HTTPNotFound
         return res
 
     @classmethod
     def getAll(cls):
         # deprecated and left for backward compatibility
         return cls.get_all()
 
     @classmethod
     def get_all(cls):
         return cls.query().all()
 
     @classmethod
     def delete(cls, id_):
         obj = cls.query().get(id_)
         Session().delete(obj)
 
     @classmethod
     def identity_cache(cls, session, attr_name, value):
         exist_in_session = []
         for (item_cls, pkey), instance in session.identity_map.items():
             if cls == item_cls and getattr(instance, attr_name) == value:
                 exist_in_session.append(instance)
         if exist_in_session:
             if len(exist_in_session) == 1:
                 return exist_in_session[0]
             log.exception(
                 'multiple objects with attr %s and '
                 'value %s found with same name: %r',
                 attr_name, value, exist_in_session)
 
     def __repr__(self):
         if hasattr(self, '__unicode__'):
             # python repr needs to return str
             try:
                 return safe_str(self.__unicode__())
             except UnicodeDecodeError:
                 pass
         return '<DB:%s>' % (self.__class__.__name__)
 
 
 class RhodeCodeSetting(Base, BaseModel):
     __tablename__ = 'rhodecode_settings'
     __table_args__ = (
         UniqueConstraint('app_settings_name'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
 
     SETTINGS_TYPES = {
         'str': safe_str,
         'int': safe_int,
         'unicode': safe_unicode,
         'bool': str2bool,
         'list': functools.partial(aslist, sep=',')
     }
     DEFAULT_UPDATE_URL = 'https://rhodecode.com/api/v1/info/versions'
     GLOBAL_CONF_KEY = 'app_settings'
 
     app_settings_id = Column("app_settings_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     app_settings_name = Column("app_settings_name", String(255), nullable=True, unique=None, default=None)
     _app_settings_value = Column("app_settings_value", String(4096), nullable=True, unique=None, default=None)
     _app_settings_type = Column("app_settings_type", String(255), nullable=True, unique=None, default=None)
 
     def __init__(self, key='', val='', type='unicode'):
         self.app_settings_name = key
         self.app_settings_type = type
         self.app_settings_value = val
 
     @validates('_app_settings_value')
     def validate_settings_value(self, key, val):
         assert type(val) == unicode
         return val
 
     @hybrid_property
     def app_settings_value(self):
         v = self._app_settings_value
         _type = self.app_settings_type
         if _type:
             _type = self.app_settings_type.split('.')[0]
             # decode the encrypted value
             if 'encrypted' in self.app_settings_type:
                 cipher = EncryptedTextValue()
                 v = safe_unicode(cipher.process_result_value(v, None))
 
         converter = self.SETTINGS_TYPES.get(_type) or \
             self.SETTINGS_TYPES['unicode']
         return converter(v)
 
     @app_settings_value.setter
     def app_settings_value(self, val):
         """
         Setter that will always make sure we use unicode in app_settings_value
 
         :param val:
         """
         val = safe_unicode(val)
         # encode the encrypted value
         if 'encrypted' in self.app_settings_type:
             cipher = EncryptedTextValue()
             val = safe_unicode(cipher.process_bind_param(val, None))
         self._app_settings_value = val
 
     @hybrid_property
     def app_settings_type(self):
         return self._app_settings_type
 
     @app_settings_type.setter
     def app_settings_type(self, val):
         if val.split('.')[0] not in self.SETTINGS_TYPES:
             raise Exception('type must be one of %s got %s'
                             % (self.SETTINGS_TYPES.keys(), val))
         self._app_settings_type = val
 
     def __unicode__(self):
         return u"<%s('%s:%s[%s]')>" % (
             self.__class__.__name__,
             self.app_settings_name, self.app_settings_value,
             self.app_settings_type
         )
 
 
 class RhodeCodeUi(Base, BaseModel):
     __tablename__ = 'rhodecode_ui'
     __table_args__ = (
         UniqueConstraint('ui_key'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
 
     HOOK_REPO_SIZE = 'changegroup.repo_size'
     # HG
     HOOK_PRE_PULL = 'preoutgoing.pre_pull'
     HOOK_PULL = 'outgoing.pull_logger'
     HOOK_PRE_PUSH = 'prechangegroup.pre_push'
     HOOK_PUSH = 'changegroup.push_logger'
 
     # TODO: johbo: Unify way how hooks are configured for git and hg,
     # git part is currently hardcoded.
 
     # SVN PATTERNS
     SVN_BRANCH_ID = 'vcs_svn_branch'
     SVN_TAG_ID = 'vcs_svn_tag'
 
     ui_id = Column(
         "ui_id", Integer(), nullable=False, unique=True, default=None,
         primary_key=True)
     ui_section = Column(
         "ui_section", String(255), nullable=True, unique=None, default=None)
     ui_key = Column(
         "ui_key", String(255), nullable=True, unique=None, default=None)
     ui_value = Column(
         "ui_value", String(255), nullable=True, unique=None, default=None)
     ui_active = Column(
         "ui_active", Boolean(), nullable=True, unique=None, default=True)
 
     def __repr__(self):
         return '<%s[%s]%s=>%s]>' % (self.__class__.__name__, self.ui_section,
                                     self.ui_key, self.ui_value)
 
 
 class RepoRhodeCodeSetting(Base, BaseModel):
     __tablename__ = 'repo_rhodecode_settings'
     __table_args__ = (
         UniqueConstraint(
             'app_settings_name', 'repository_id',
             name='uq_repo_rhodecode_setting_name_repo_id'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
 
     repository_id = Column(
         "repository_id", Integer(), ForeignKey('repositories.repo_id'),
         nullable=False)
     app_settings_id = Column(
         "app_settings_id", Integer(), nullable=False, unique=True,
         default=None, primary_key=True)
     app_settings_name = Column(
         "app_settings_name", String(255), nullable=True, unique=None,
         default=None)
     _app_settings_value = Column(
         "app_settings_value", String(4096), nullable=True, unique=None,
         default=None)
     _app_settings_type = Column(
         "app_settings_type", String(255), nullable=True, unique=None,
         default=None)
 
     repository = relationship('Repository')
 
     def __init__(self, repository_id, key='', val='', type='unicode'):
         self.repository_id = repository_id
         self.app_settings_name = key
         self.app_settings_type = type
         self.app_settings_value = val
 
     @validates('_app_settings_value')
     def validate_settings_value(self, key, val):
         assert type(val) == unicode
         return val
 
     @hybrid_property
     def app_settings_value(self):
         v = self._app_settings_value
         type_ = self.app_settings_type
         SETTINGS_TYPES = RhodeCodeSetting.SETTINGS_TYPES
         converter = SETTINGS_TYPES.get(type_) or SETTINGS_TYPES['unicode']
         return converter(v)
 
     @app_settings_value.setter
     def app_settings_value(self, val):
         """
         Setter that will always make sure we use unicode in app_settings_value
 
         :param val:
         """
         self._app_settings_value = safe_unicode(val)
 
     @hybrid_property
     def app_settings_type(self):
         return self._app_settings_type
 
     @app_settings_type.setter
     def app_settings_type(self, val):
         SETTINGS_TYPES = RhodeCodeSetting.SETTINGS_TYPES
         if val not in SETTINGS_TYPES:
             raise Exception('type must be one of %s got %s'
                             % (SETTINGS_TYPES.keys(), val))
         self._app_settings_type = val
 
     def __unicode__(self):
         return u"<%s('%s:%s:%s[%s]')>" % (
             self.__class__.__name__, self.repository.repo_name,
             self.app_settings_name, self.app_settings_value,
             self.app_settings_type
         )
 
 
 class RepoRhodeCodeUi(Base, BaseModel):
     __tablename__ = 'repo_rhodecode_ui'
     __table_args__ = (
         UniqueConstraint(
             'repository_id', 'ui_section', 'ui_key',
             name='uq_repo_rhodecode_ui_repository_id_section_key'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
 
     repository_id = Column(
         "repository_id", Integer(), ForeignKey('repositories.repo_id'),
         nullable=False)
     ui_id = Column(
         "ui_id", Integer(), nullable=False, unique=True, default=None,
         primary_key=True)
     ui_section = Column(
         "ui_section", String(255), nullable=True, unique=None, default=None)
     ui_key = Column(
         "ui_key", String(255), nullable=True, unique=None, default=None)
     ui_value = Column(
         "ui_value", String(255), nullable=True, unique=None, default=None)
     ui_active = Column(
         "ui_active", Boolean(), nullable=True, unique=None, default=True)
 
     repository = relationship('Repository')
 
     def __repr__(self):
         return '<%s[%s:%s]%s=>%s]>' % (
             self.__class__.__name__, self.repository.repo_name,
             self.ui_section, self.ui_key, self.ui_value)
 
 
 class User(Base, BaseModel):
     __tablename__ = 'users'
     __table_args__ = (
         UniqueConstraint('username'), UniqueConstraint('email'),
         Index('u_username_idx', 'username'),
         Index('u_email_idx', 'email'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
     DEFAULT_USER = 'default'
     DEFAULT_USER_EMAIL = '[e-mail]'
     DEFAULT_GRAVATAR_URL = 'https://secure.gravatar.com/avatar/{md5email}?d=identicon&s={size}'
 
     user_id = Column("user_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     username = Column("username", String(255), nullable=True, unique=None, default=None)
     password = Column("password", String(255), nullable=True, unique=None, default=None)
     active = Column("active", Boolean(), nullable=True, unique=None, default=True)
     admin = Column("admin", Boolean(), nullable=True, unique=None, default=False)
     name = Column("firstname", String(255), nullable=True, unique=None, default=None)
     lastname = Column("lastname", String(255), nullable=True, unique=None, default=None)
     _email = Column("email", String(255), nullable=True, unique=None, default=None)
     last_login = Column("last_login", DateTime(timezone=False), nullable=True, unique=None, default=None)
     extern_type = Column("extern_type", String(255), nullable=True, unique=None, default=None)
     extern_name = Column("extern_name", String(255), nullable=True, unique=None, default=None)
     api_key = Column("api_key", String(255), nullable=True, unique=None, default=None)
     inherit_default_permissions = Column("inherit_default_permissions", Boolean(), nullable=False, unique=None, default=True)
     created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
     _user_data = Column("user_data", LargeBinary(), nullable=True)  # JSON data
 
     user_log = relationship('UserLog')
     user_perms = relationship('UserToPerm', primaryjoin="User.user_id==UserToPerm.user_id", cascade='all')
 
     repositories = relationship('Repository')
     repository_groups = relationship('RepoGroup')
     user_groups = relationship('UserGroup')
 
     user_followers = relationship('UserFollowing', primaryjoin='UserFollowing.follows_user_id==User.user_id', cascade='all')
     followings = relationship('UserFollowing', primaryjoin='UserFollowing.user_id==User.user_id', cascade='all')
 
     repo_to_perm = relationship('UserRepoToPerm', primaryjoin='UserRepoToPerm.user_id==User.user_id', cascade='all')
     repo_group_to_perm = relationship('UserRepoGroupToPerm', primaryjoin='UserRepoGroupToPerm.user_id==User.user_id', cascade='all')
     user_group_to_perm = relationship('UserUserGroupToPerm', primaryjoin='UserUserGroupToPerm.user_id==User.user_id', cascade='all')
 
     group_member = relationship('UserGroupMember', cascade='all')
 
     notifications = relationship('UserNotification', cascade='all')
     # notifications assigned to this user
     user_created_notifications = relationship('Notification', cascade='all')
     # comments created by this user
     user_comments = relationship('ChangesetComment', cascade='all')
     # user profile extra info
     user_emails = relationship('UserEmailMap', cascade='all')
     user_ip_map = relationship('UserIpMap', cascade='all')
     user_auth_tokens = relationship('UserApiKeys', cascade='all')
     # gists
     user_gists = relationship('Gist', cascade='all')
     # user pull requests
     user_pull_requests = relationship('PullRequest', cascade='all')
     # external identities
     extenal_identities = relationship(
         'ExternalIdentity',
         primaryjoin="User.user_id==ExternalIdentity.local_user_id",
         cascade='all')
 
     def __unicode__(self):
         return u"<%s('id:%s:%s')>" % (self.__class__.__name__,
                                       self.user_id, self.username)
 
     @hybrid_property
     def email(self):
         return self._email
 
     @email.setter
     def email(self, val):
         self._email = val.lower() if val else None
 
     @property
     def firstname(self):
         # alias for future
         return self.name
 
     @property
     def emails(self):
         other = UserEmailMap.query().filter(UserEmailMap.user==self).all()
         return [self.email] + [x.email for x in other]
 
     @property
     def auth_tokens(self):
         return [self.api_key] + [x.api_key for x in self.extra_auth_tokens]
 
     @property
     def extra_auth_tokens(self):
         return UserApiKeys.query().filter(UserApiKeys.user == self).all()
 
     @property
     def feed_token(self):
         feed_tokens = UserApiKeys.query()\
             .filter(UserApiKeys.user == self)\
             .filter(UserApiKeys.role == UserApiKeys.ROLE_FEED)\
             .all()
         if feed_tokens:
             return feed_tokens[0].api_key
         else:
             # use the main token so we don't end up with nothing...
             return self.api_key
 
     @classmethod
     def extra_valid_auth_tokens(cls, user, role=None):
         tokens = UserApiKeys.query().filter(UserApiKeys.user == user)\
                 .filter(or_(UserApiKeys.expires == -1,
                             UserApiKeys.expires >= time.time()))
         if role:
             tokens = tokens.filter(or_(UserApiKeys.role == role,
                                        UserApiKeys.role == UserApiKeys.ROLE_ALL))
         return tokens.all()
 
     @property
     def ip_addresses(self):
         ret = UserIpMap.query().filter(UserIpMap.user == self).all()
         return [x.ip_addr for x in ret]
 
     @property
     def username_and_name(self):
         return '%s (%s %s)' % (self.username, self.firstname, self.lastname)
 
     @property
     def username_or_name_or_email(self):
         full_name = self.full_name if self.full_name is not ' ' else None
         return self.username or full_name or self.email
 
     @property
     def full_name(self):
         return '%s %s' % (self.firstname, self.lastname)
 
     @property
     def full_name_or_username(self):
         return ('%s %s' % (self.firstname, self.lastname)
                 if (self.firstname and self.lastname) else self.username)
 
     @property
     def full_contact(self):
         return '%s %s <%s>' % (self.firstname, self.lastname, self.email)
 
     @property
     def short_contact(self):
         return '%s %s' % (self.firstname, self.lastname)
 
     @property
     def is_admin(self):
         return self.admin
 
     @property
     def AuthUser(self):
         """
         Returns instance of AuthUser for this user
         """
         from rhodecode.lib.auth import AuthUser
         return AuthUser(user_id=self.user_id, api_key=self.api_key,
                         username=self.username)
 
     @hybrid_property
     def user_data(self):
         if not self._user_data:
             return {}
 
         try:
             return json.loads(self._user_data)
         except TypeError:
             return {}
 
     @user_data.setter
     def user_data(self, val):
         if not isinstance(val, dict):
             raise Exception('user_data must be dict, got %s' % type(val))
         try:
             self._user_data = json.dumps(val)
         except Exception:
             log.error(traceback.format_exc())
 
     @classmethod
     def get_by_username(cls, username, case_insensitive=False,
                         cache=False, identity_cache=False):
         session = Session()
 
         if case_insensitive:
             q = cls.query().filter(
                 func.lower(cls.username) == func.lower(username))
         else:
             q = cls.query().filter(cls.username == username)
 
         if cache:
             if identity_cache:
                 val = cls.identity_cache(session, 'username', username)
                 if val:
                     return val
             else:
                 q = q.options(
                     FromCache("sql_cache_short",
                               "get_user_by_name_%s" % _hash_key(username)))
 
         return q.scalar()
 
     @classmethod
     def get_by_auth_token(cls, auth_token, cache=False, fallback=True):
         q = cls.query().filter(cls.api_key == auth_token)
 
         if cache:
             q = q.options(FromCache("sql_cache_short",
                                     "get_auth_token_%s" % auth_token))
         res = q.scalar()
 
         if fallback and not res:
             #fallback to additional keys
             _res = UserApiKeys.query()\
                 .filter(UserApiKeys.api_key == auth_token)\
                 .filter(or_(UserApiKeys.expires == -1,
                             UserApiKeys.expires >= time.time()))\
                 .first()
             if _res:
                 res = _res.user
         return res
 
     @classmethod
     def get_by_email(cls, email, case_insensitive=False, cache=False):
 
         if case_insensitive:
             q = cls.query().filter(func.lower(cls.email) == func.lower(email))
 
         else:
             q = cls.query().filter(cls.email == email)
 
         if cache:
             q = q.options(FromCache("sql_cache_short",
                                     "get_email_key_%s" % _hash_key(email)))
 
         ret = q.scalar()
         if ret is None:
             q = UserEmailMap.query()
             # try fetching in alternate email map
             if case_insensitive:
                 q = q.filter(func.lower(UserEmailMap.email) == func.lower(email))
             else:
                 q = q.filter(UserEmailMap.email == email)
             q = q.options(joinedload(UserEmailMap.user))
             if cache:
                 q = q.options(FromCache("sql_cache_short",
                                         "get_email_map_key_%s" % email))
             ret = getattr(q.scalar(), 'user', None)
 
         return ret
 
     @classmethod
     def get_from_cs_author(cls, author):
         """
         Tries to get User objects out of commit author string
 
         :param author:
         """
         from rhodecode.lib.helpers import email, author_name
         # Valid email in the attribute passed, see if they're in the system
         _email = email(author)
         if _email:
             user = cls.get_by_email(_email, case_insensitive=True)
             if user:
                 return user
         # Maybe we can match by username?
         _author = author_name(author)
         user = cls.get_by_username(_author, case_insensitive=True)
         if user:
             return user
 
     def update_userdata(self, **kwargs):
         usr = self
         old = usr.user_data
         old.update(**kwargs)
         usr.user_data = old
         Session().add(usr)
         log.debug('updated userdata with ', kwargs)
 
     def update_lastlogin(self):
         """Update user lastlogin"""
         self.last_login = datetime.datetime.now()
         Session().add(self)
         log.debug('updated user %s lastlogin', self.username)
 
     def update_lastactivity(self):
         """Update user lastactivity"""
         usr = self
         old = usr.user_data
         old.update({'last_activity': time.time()})
         usr.user_data = old
         Session().add(usr)
         log.debug('updated user %s lastactivity', usr.username)
 
     def update_password(self, new_password, change_api_key=False):
         from rhodecode.lib.auth import get_crypt_password,generate_auth_token
 
         self.password = get_crypt_password(new_password)
         if change_api_key:
             self.api_key = generate_auth_token(self.username)
         Session().add(self)
 
     @classmethod
     def get_first_super_admin(cls):
         user = User.query().filter(User.admin == true()).first()
         if user is None:
             raise Exception('FATAL: Missing administrative account!')
         return user
 
     @classmethod
     def get_all_super_admins(cls):
         """
         Returns all admin accounts sorted by username
         """
         return User.query().filter(User.admin == true())\
             .order_by(User.username.asc()).all()
 
     @classmethod
     def get_default_user(cls, cache=False):
         user = User.get_by_username(User.DEFAULT_USER, cache=cache)
         if user is None:
             raise Exception('FATAL: Missing default account!')
         return user
 
     def _get_default_perms(self, user, suffix=''):
         from rhodecode.model.permission import PermissionModel
         return PermissionModel().get_default_perms(user.user_perms, suffix)
 
     def get_default_perms(self, suffix=''):
         return self._get_default_perms(self, suffix)
 
     def get_api_data(self, include_secrets=False, details='full'):
         """
         Common function for generating user related data for API
 
         :param include_secrets: By default secrets in the API data will be replaced
            by a placeholder value to prevent exposing this data by accident. In case
            this data shall be exposed, set this flag to ``True``.
 
         :param details: details can be 'basic|full' basic gives only a subset of
            the available user information that includes user_id, name and emails.
         """
         user = self
         user_data = self.user_data
         data = {
             'user_id': user.user_id,
             'username': user.username,
             'firstname': user.name,
             'lastname': user.lastname,
             'email': user.email,
             'emails': user.emails,
         }
         if details == 'basic':
             return data
 
         api_key_length = 40
         api_key_replacement = '*' * api_key_length
 
         extras = {
             'api_key': api_key_replacement,
             'api_keys': [api_key_replacement],
             'active': user.active,
             'admin': user.admin,
             'extern_type': user.extern_type,
             'extern_name': user.extern_name,
             'last_login': user.last_login,
             'ip_addresses': user.ip_addresses,
             'language': user_data.get('language')
         }
         data.update(extras)
 
         if include_secrets:
             data['api_key'] = user.api_key
             data['api_keys'] = user.auth_tokens
         return data
 
     def __json__(self):
         data = {
             'full_name': self.full_name,
             'full_name_or_username': self.full_name_or_username,
             'short_contact': self.short_contact,
             'full_contact': self.full_contact,
         }
         data.update(self.get_api_data())
         return data
 
 
 class UserApiKeys(Base, BaseModel):
     __tablename__ = 'user_api_keys'
     __table_args__ = (
         Index('uak_api_key_idx', 'api_key'),
         Index('uak_api_key_expires_idx', 'api_key', 'expires'),
         UniqueConstraint('api_key'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
     __mapper_args__ = {}
 
     # ApiKey role
     ROLE_ALL = 'token_role_all'
     ROLE_HTTP = 'token_role_http'
     ROLE_VCS = 'token_role_vcs'
     ROLE_API = 'token_role_api'
     ROLE_FEED = 'token_role_feed'
     ROLES = [ROLE_ALL, ROLE_HTTP, ROLE_VCS, ROLE_API, ROLE_FEED]
 
     user_api_key_id = Column("user_api_key_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=True, unique=None, default=None)
     api_key = Column("api_key", String(255), nullable=False, unique=True)
     description = Column('description', UnicodeText().with_variant(UnicodeText(1024), 'mysql'))
     expires = Column('expires', Float(53), nullable=False)
     role = Column('role', String(255), nullable=True)
     created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
 
     user = relationship('User', lazy='joined')
 
     @classmethod
     def _get_role_name(cls, role):
         return {
             cls.ROLE_ALL: _('all'),
             cls.ROLE_HTTP: _('http/web interface'),
             cls.ROLE_VCS: _('vcs (git/hg/svn protocol)'),
             cls.ROLE_API: _('api calls'),
             cls.ROLE_FEED: _('feed access'),
         }.get(role, role)
 
     @property
     def expired(self):
         if self.expires == -1:
             return False
         return time.time() > self.expires
 
     @property
     def role_humanized(self):
         return self._get_role_name(self.role)
 
 
 class UserEmailMap(Base, BaseModel):
     __tablename__ = 'user_email_map'
     __table_args__ = (
         Index('uem_email_idx', 'email'),
         UniqueConstraint('email'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
     __mapper_args__ = {}
 
     email_id = Column("email_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=True, unique=None, default=None)
     _email = Column("email", String(255), nullable=True, unique=False, default=None)
     user = relationship('User', lazy='joined')
 
     @validates('_email')
     def validate_email(self, key, email):
         # check if this email is not main one
         main_email = Session().query(User).filter(User.email == email).scalar()
         if main_email is not None:
             raise AttributeError('email %s is present is user table' % email)
         return email
 
     @hybrid_property
     def email(self):
         return self._email
 
     @email.setter
     def email(self, val):
         self._email = val.lower() if val else None
 
 
 class UserIpMap(Base, BaseModel):
     __tablename__ = 'user_ip_map'
     __table_args__ = (
         UniqueConstraint('user_id', 'ip_addr'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
     __mapper_args__ = {}
 
     ip_id = Column("ip_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=True, unique=None, default=None)
     ip_addr = Column("ip_addr", String(255), nullable=True, unique=False, default=None)
     active = Column("active", Boolean(), nullable=True, unique=None, default=True)
     description = Column("description", String(10000), nullable=True, unique=None, default=None)
     user = relationship('User', lazy='joined')
 
     @classmethod
     def _get_ip_range(cls, ip_addr):
         net = ipaddress.ip_network(ip_addr, strict=False)
         return [str(net.network_address), str(net.broadcast_address)]
 
     def __json__(self):
         return {
           'ip_addr': self.ip_addr,
           'ip_range': self._get_ip_range(self.ip_addr),
         }
 
     def __unicode__(self):
         return u"<%s('user_id:%s=>%s')>" % (self.__class__.__name__,
                                             self.user_id, self.ip_addr)
 
 class UserLog(Base, BaseModel):
     __tablename__ = 'user_logs'
     __table_args__ = (
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
     )
     user_log_id = Column("user_log_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=True, unique=None, default=None)
     username = Column("username", String(255), nullable=True, unique=None, default=None)
     repository_id = Column("repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=True)
     repository_name = Column("repository_name", String(255), nullable=True, unique=None, default=None)
     user_ip = Column("user_ip", String(255), nullable=True, unique=None, default=None)
     action = Column("action", Text().with_variant(Text(1200000), 'mysql'), nullable=True, unique=None, default=None)
     action_date = Column("action_date", DateTime(timezone=False), nullable=True, unique=None, default=None)
 
     def __unicode__(self):
         return u"<%s('id:%s:%s')>" % (self.__class__.__name__,
                                       self.repository_name,
                                       self.action)
 
     @property
     def action_as_day(self):
         return datetime.date(*self.action_date.timetuple()[:3])
 
     user = relationship('User')
     repository = relationship('Repository', cascade='')
 
 
 class UserGroup(Base, BaseModel):
     __tablename__ = 'users_groups'
     __table_args__ = (
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
     )
 
     users_group_id = Column("users_group_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     users_group_name = Column("users_group_name", String(255), nullable=False, unique=True, default=None)
     user_group_description = Column("user_group_description", String(10000), nullable=True, unique=None, default=None)
     users_group_active = Column("users_group_active", Boolean(), nullable=True, unique=None, default=None)
     inherit_default_permissions = Column("users_group_inherit_default_permissions", Boolean(), nullable=False, unique=None, default=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=False, default=None)
     created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
     _group_data = Column("group_data", LargeBinary(), nullable=True)  # JSON data
 
     members = relationship('UserGroupMember', cascade="all, delete, delete-orphan", lazy="joined")
     users_group_to_perm = relationship('UserGroupToPerm', cascade='all')
     users_group_repo_to_perm = relationship('UserGroupRepoToPerm', cascade='all')
     users_group_repo_group_to_perm = relationship('UserGroupRepoGroupToPerm', cascade='all')
     user_user_group_to_perm = relationship('UserUserGroupToPerm', cascade='all')
     user_group_user_group_to_perm = relationship('UserGroupUserGroupToPerm ', primaryjoin="UserGroupUserGroupToPerm.target_user_group_id==UserGroup.users_group_id", cascade='all')
 
     user = relationship('User')
 
     @hybrid_property
     def group_data(self):
         if not self._group_data:
             return {}
 
         try:
             return json.loads(self._group_data)
         except TypeError:
             return {}
 
     @group_data.setter
     def group_data(self, val):
         try:
             self._group_data = json.dumps(val)
         except Exception:
             log.error(traceback.format_exc())
 
     def __unicode__(self):
         return u"<%s('id:%s:%s')>" % (self.__class__.__name__,
                                       self.users_group_id,
                                       self.users_group_name)
 
     @classmethod
     def get_by_group_name(cls, group_name, cache=False,
                           case_insensitive=False):
         if case_insensitive:
             q = cls.query().filter(func.lower(cls.users_group_name) ==
                                    func.lower(group_name))
 
         else:
             q = cls.query().filter(cls.users_group_name == group_name)
         if cache:
             q = q.options(FromCache(
                             "sql_cache_short",
                             "get_group_%s" % _hash_key(group_name)))
         return q.scalar()
 
     @classmethod
     def get(cls, user_group_id, cache=False):
         user_group = cls.query()
         if cache:
             user_group = user_group.options(FromCache("sql_cache_short",
                                     "get_users_group_%s" % user_group_id))
         return user_group.get(user_group_id)
 
     def permissions(self, with_admins=True, with_owner=True):
         q = UserUserGroupToPerm.query().filter(UserUserGroupToPerm.user_group == self)
         q = q.options(joinedload(UserUserGroupToPerm.user_group),
                       joinedload(UserUserGroupToPerm.user),
                       joinedload(UserUserGroupToPerm.permission),)
 
         # get owners and admins and permissions. We do a trick of re-writing
         # objects from sqlalchemy to named-tuples due to sqlalchemy session
         # has a global reference and changing one object propagates to all
         # others. This means if admin is also an owner admin_row that change
         # would propagate to both objects
         perm_rows = []
         for _usr in q.all():
             usr = AttributeDict(_usr.user.get_dict())
             usr.permission = _usr.permission.permission_name
             perm_rows.append(usr)
 
         # filter the perm rows by 'default' first and then sort them by
         # admin,write,read,none permissions sorted again alphabetically in
         # each group
         perm_rows = sorted(perm_rows, key=display_sort)
 
         _admin_perm = 'usergroup.admin'
         owner_row = []
         if with_owner:
             usr = AttributeDict(self.user.get_dict())
             usr.owner_row = True
             usr.permission = _admin_perm
             owner_row.append(usr)
 
         super_admin_rows = []
         if with_admins:
             for usr in User.get_all_super_admins():
                 # if this admin is also owner, don't double the record
                 if usr.user_id == owner_row[0].user_id:
                     owner_row[0].admin_row = True
                 else:
                     usr = AttributeDict(usr.get_dict())
                     usr.admin_row = True
                     usr.permission = _admin_perm
                     super_admin_rows.append(usr)
 
         return super_admin_rows + owner_row + perm_rows
 
     def permission_user_groups(self):
         q = UserGroupUserGroupToPerm.query().filter(UserGroupUserGroupToPerm.target_user_group == self)
         q = q.options(joinedload(UserGroupUserGroupToPerm.user_group),
                       joinedload(UserGroupUserGroupToPerm.target_user_group),
                       joinedload(UserGroupUserGroupToPerm.permission),)
 
         perm_rows = []
         for _user_group in q.all():
             usr = AttributeDict(_user_group.user_group.get_dict())
             usr.permission = _user_group.permission.permission_name
             perm_rows.append(usr)
 
         return perm_rows
 
     def _get_default_perms(self, user_group, suffix=''):
         from rhodecode.model.permission import PermissionModel
         return PermissionModel().get_default_perms(user_group.users_group_to_perm, suffix)
 
     def get_default_perms(self, suffix=''):
         return self._get_default_perms(self, suffix)
 
     def get_api_data(self, with_group_members=True, include_secrets=False):
         """
         :param include_secrets: See :meth:`User.get_api_data`, this parameter is
            basically forwarded.
 
         """
         user_group = self
 
         data = {
             'users_group_id': user_group.users_group_id,
             'group_name': user_group.users_group_name,
             'group_description': user_group.user_group_description,
             'active': user_group.users_group_active,
             'owner': user_group.user.username,
         }
         if with_group_members:
             users = []
             for user in user_group.members:
                 user = user.user
                 users.append(user.get_api_data(include_secrets=include_secrets))
             data['users'] = users
 
         return data
 
 
 class UserGroupMember(Base, BaseModel):
     __tablename__ = 'users_groups_members'
     __table_args__ = (
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
     )
 
     users_group_member_id = Column("users_group_member_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     users_group_id = Column("users_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)
 
     user = relationship('User', lazy='joined')
     users_group = relationship('UserGroup')
 
     def __init__(self, gr_id='', u_id=''):
         self.users_group_id = gr_id
         self.user_id = u_id
 
 
 class RepositoryField(Base, BaseModel):
     __tablename__ = 'repositories_fields'
     __table_args__ = (
         UniqueConstraint('repository_id', 'field_key'),  # no-multi field
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
     )
     PREFIX = 'ex_'  # prefix used in form to not conflict with already existing fields
 
     repo_field_id = Column("repo_field_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     repository_id = Column("repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=False, unique=None, default=None)
     field_key = Column("field_key", String(250))
     field_label = Column("field_label", String(1024), nullable=False)
     field_value = Column("field_value", String(10000), nullable=False)
     field_desc = Column("field_desc", String(1024), nullable=False)
     field_type = Column("field_type", String(255), nullable=False, unique=None)
     created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
 
     repository = relationship('Repository')
 
     @property
     def field_key_prefixed(self):
         return 'ex_%s' % self.field_key
 
     @classmethod
     def un_prefix_key(cls, key):
         if key.startswith(cls.PREFIX):
             return key[len(cls.PREFIX):]
         return key
 
     @classmethod
     def get_by_key_name(cls, key, repo):
         row = cls.query()\
                 .filter(cls.repository == repo)\
                 .filter(cls.field_key == key).scalar()
         return row
 
 
 class Repository(Base, BaseModel):
     __tablename__ = 'repositories'
     __table_args__ = (
         Index('r_repo_name_idx', 'repo_name', mysql_length=255),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
     )
     DEFAULT_CLONE_URI = '{scheme}://{user}@{netloc}/{repo}'
     DEFAULT_CLONE_URI_ID = '{scheme}://{user}@{netloc}/_{repoid}'
 
     STATE_CREATED = 'repo_state_created'
     STATE_PENDING = 'repo_state_pending'
     STATE_ERROR = 'repo_state_error'
 
     LOCK_AUTOMATIC = 'lock_auto'
     LOCK_API = 'lock_api'
     LOCK_WEB = 'lock_web'
     LOCK_PULL = 'lock_pull'
 
     NAME_SEP = URL_SEP
 
     repo_id = Column(
         "repo_id", Integer(), nullable=False, unique=True, default=None,
         primary_key=True)
     _repo_name = Column(
         "repo_name", Text(), nullable=False, default=None)
     _repo_name_hash = Column(
         "repo_name_hash", String(255), nullable=False, unique=True)
     repo_state = Column("repo_state", String(255), nullable=True)
 
     clone_uri = Column(
         "clone_uri", EncryptedTextValue(), nullable=True, unique=False,
         default=None)
     repo_type = Column(
         "repo_type", String(255), nullable=False, unique=False, default=None)
     user_id = Column(
         "user_id", Integer(), ForeignKey('users.user_id'), nullable=False,
         unique=False, default=None)
     private = Column(
         "private", Boolean(), nullable=True, unique=None, default=None)
     enable_statistics = Column(
         "statistics", Boolean(), nullable=True, unique=None, default=True)
     enable_downloads = Column(
         "downloads", Boolean(), nullable=True, unique=None, default=True)
     description = Column(
         "description", String(10000), nullable=True, unique=None, default=None)
     created_on = Column(
         'created_on', DateTime(timezone=False), nullable=True, unique=None,
         default=datetime.datetime.now)
     updated_on = Column(
         'updated_on', DateTime(timezone=False), nullable=True, unique=None,
         default=datetime.datetime.now)
     _landing_revision = Column(
         "landing_revision", String(255), nullable=False, unique=False,
         default=None)
     enable_locking = Column(
         "enable_locking", Boolean(), nullable=False, unique=None,
         default=False)
     _locked = Column(
         "locked", String(255), nullable=True, unique=False, default=None)
     _changeset_cache = Column(
         "changeset_cache", LargeBinary(), nullable=True)  # JSON data
 
     fork_id = Column(
         "fork_id", Integer(), ForeignKey('repositories.repo_id'),
         nullable=True, unique=False, default=None)
     group_id = Column(
         "group_id", Integer(), ForeignKey('groups.group_id'), nullable=True,
         unique=False, default=None)
 
     user = relationship('User', lazy='joined')
     fork = relationship('Repository', remote_side=repo_id, lazy='joined')
     group = relationship('RepoGroup', lazy='joined')
     repo_to_perm = relationship(
         'UserRepoToPerm', cascade='all',
         order_by='UserRepoToPerm.repo_to_perm_id')
     users_group_to_perm = relationship('UserGroupRepoToPerm', cascade='all')
     stats = relationship('Statistics', cascade='all', uselist=False)
 
     followers = relationship(
         'UserFollowing',
         primaryjoin='UserFollowing.follows_repo_id==Repository.repo_id',
         cascade='all')
     extra_fields = relationship(
         'RepositoryField', cascade="all, delete, delete-orphan")
     logs = relationship('UserLog')
     comments = relationship(
         'ChangesetComment', cascade="all, delete, delete-orphan")
     pull_requests_source = relationship(
         'PullRequest',
         primaryjoin='PullRequest.source_repo_id==Repository.repo_id',
         cascade="all, delete, delete-orphan")
     pull_requests_target = relationship(
         'PullRequest',
         primaryjoin='PullRequest.target_repo_id==Repository.repo_id',
         cascade="all, delete, delete-orphan")
     ui = relationship('RepoRhodeCodeUi', cascade="all")
     settings = relationship('RepoRhodeCodeSetting', cascade="all")
     integrations = relationship('Integration',
                                 cascade="all, delete, delete-orphan")
 
     def __unicode__(self):
         return u"<%s('%s:%s')>" % (self.__class__.__name__, self.repo_id,
                                    safe_unicode(self.repo_name))
 
     @hybrid_property
     def landing_rev(self):
         # always should return [rev_type, rev]
         if self._landing_revision:
             _rev_info = self._landing_revision.split(':')
             if len(_rev_info) < 2:
                 _rev_info.insert(0, 'rev')
             return [_rev_info[0], _rev_info[1]]
         return [None, None]
 
     @landing_rev.setter
     def landing_rev(self, val):
         if ':' not in val:
             raise ValueError('value must be delimited with `:` and consist '
                              'of <rev_type>:<rev>, got %s instead' % val)
         self._landing_revision = val
 
     @hybrid_property
     def locked(self):
         if self._locked:
             user_id, timelocked, reason = self._locked.split(':')
             lock_values = int(user_id), timelocked, reason
         else:
             lock_values = [None, None, None]
         return lock_values
 
     @locked.setter
     def locked(self, val):
         if val and isinstance(val, (list, tuple)):
             self._locked = ':'.join(map(str, val))
         else:
             self._locked = None
 
     @hybrid_property
     def changeset_cache(self):
         from rhodecode.lib.vcs.backends.base import EmptyCommit
         dummy = EmptyCommit().__json__()
         if not self._changeset_cache:
             return dummy
         try:
             return json.loads(self._changeset_cache)
         except TypeError:
             return dummy
         except Exception:
             log.error(traceback.format_exc())
             return dummy
 
     @changeset_cache.setter
     def changeset_cache(self, val):
         try:
             self._changeset_cache = json.dumps(val)
         except Exception:
             log.error(traceback.format_exc())
 
     @hybrid_property
     def repo_name(self):
         return self._repo_name
 
     @repo_name.setter
     def repo_name(self, value):
         self._repo_name = value
         self._repo_name_hash = hashlib.sha1(safe_str(value)).hexdigest()
 
     @classmethod
     def normalize_repo_name(cls, repo_name):
         """
         Normalizes os specific repo_name to the format internally stored inside
         database using URL_SEP
 
         :param cls:
         :param repo_name:
         """
         return cls.NAME_SEP.join(repo_name.split(os.sep))
 
     @classmethod
     def get_by_repo_name(cls, repo_name, cache=False, identity_cache=False):
         session = Session()
         q = session.query(cls).filter(cls.repo_name == repo_name)
 
         if cache:
             if identity_cache:
                 val = cls.identity_cache(session, 'repo_name', repo_name)
                 if val:
                     return val
             else:
                 q = q.options(
                     FromCache("sql_cache_short",
                               "get_repo_by_name_%s" % _hash_key(repo_name)))
 
         return q.scalar()
 
     @classmethod
     def get_by_full_path(cls, repo_full_path):
         repo_name = repo_full_path.split(cls.base_path(), 1)[-1]
         repo_name = cls.normalize_repo_name(repo_name)
         return cls.get_by_repo_name(repo_name.strip(URL_SEP))
 
     @classmethod
     def get_repo_forks(cls, repo_id):
         return cls.query().filter(Repository.fork_id == repo_id)
 
     @classmethod
     def base_path(cls):
         """
         Returns base path when all repos are stored
 
         :param cls:
         """
         q = Session().query(RhodeCodeUi)\
             .filter(RhodeCodeUi.ui_key == cls.NAME_SEP)
         q = q.options(FromCache("sql_cache_short", "repository_repo_path"))
         return q.one().ui_value
 
     @classmethod
     def is_valid(cls, repo_name):
         """
         returns True if given repo name is a valid filesystem repository
 
         :param cls:
         :param repo_name:
         """
         from rhodecode.lib.utils import is_valid_repo
 
         return is_valid_repo(repo_name, cls.base_path())
 
     @classmethod
     def get_all_repos(cls, user_id=Optional(None), group_id=Optional(None),
                       case_insensitive=True):
         q = Repository.query()
 
         if not isinstance(user_id, Optional):
             q = q.filter(Repository.user_id == user_id)
 
         if not isinstance(group_id, Optional):
             q = q.filter(Repository.group_id == group_id)
 
         if case_insensitive:
             q = q.order_by(func.lower(Repository.repo_name))
         else:
             q = q.order_by(Repository.repo_name)
         return q.all()
 
     @property
     def forks(self):
         """
         Return forks of this repo
         """
         return Repository.get_repo_forks(self.repo_id)
 
     @property
     def parent(self):
         """
         Returns fork parent
         """
         return self.fork
 
     @property
     def just_name(self):
         return self.repo_name.split(self.NAME_SEP)[-1]
 
     @property
     def groups_with_parents(self):
         groups = []
         if self.group is None:
             return groups
 
         cur_gr = self.group
         groups.insert(0, cur_gr)
         while 1:
             gr = getattr(cur_gr, 'parent_group', None)
             cur_gr = cur_gr.parent_group
             if gr is None:
                 break
             groups.insert(0, gr)
 
         return groups
 
     @property
     def groups_and_repo(self):
         return self.groups_with_parents, self
 
     @LazyProperty
     def repo_path(self):
         """
         Returns base full path for that repository means where it actually
         exists on a filesystem
         """
         q = Session().query(RhodeCodeUi).filter(
             RhodeCodeUi.ui_key == self.NAME_SEP)
         q = q.options(FromCache("sql_cache_short", "repository_repo_path"))
         return q.one().ui_value
 
     @property
     def repo_full_path(self):
         p = [self.repo_path]
         # we need to split the name by / since this is how we store the
         # names in the database, but that eventually needs to be converted
         # into a valid system path
         p += self.repo_name.split(self.NAME_SEP)
         return os.path.join(*map(safe_unicode, p))
 
     @property
     def cache_keys(self):
         """
         Returns associated cache keys for that repo
         """
         return CacheKey.query()\
             .filter(CacheKey.cache_args == self.repo_name)\
             .order_by(CacheKey.cache_key)\
             .all()
 
     def get_new_name(self, repo_name):
         """
         returns new full repository name based on assigned group and new new
 
         :param group_name:
         """
         path_prefix = self.group.full_path_splitted if self.group else []
         return self.NAME_SEP.join(path_prefix + [repo_name])
 
     @property
     def _config(self):
         """
         Returns db based config object.
         """
         from rhodecode.lib.utils import make_db_config
         return make_db_config(clear_session=False, repo=self)
 
     def permissions(self, with_admins=True, with_owner=True):
         q = UserRepoToPerm.query().filter(UserRepoToPerm.repository == self)
         q = q.options(joinedload(UserRepoToPerm.repository),
                       joinedload(UserRepoToPerm.user),
                       joinedload(UserRepoToPerm.permission),)
 
         # get owners and admins and permissions. We do a trick of re-writing
         # objects from sqlalchemy to named-tuples due to sqlalchemy session
         # has a global reference and changing one object propagates to all
         # others. This means if admin is also an owner admin_row that change
         # would propagate to both objects
         perm_rows = []
         for _usr in q.all():
             usr = AttributeDict(_usr.user.get_dict())
             usr.permission = _usr.permission.permission_name
             perm_rows.append(usr)
 
         # filter the perm rows by 'default' first and then sort them by
         # admin,write,read,none permissions sorted again alphabetically in
         # each group
         perm_rows = sorted(perm_rows, key=display_sort)
 
         _admin_perm = 'repository.admin'
         owner_row = []
         if with_owner:
             usr = AttributeDict(self.user.get_dict())
             usr.owner_row = True
             usr.permission = _admin_perm
             owner_row.append(usr)
 
         super_admin_rows = []
         if with_admins:
             for usr in User.get_all_super_admins():
                 # if this admin is also owner, don't double the record
                 if usr.user_id == owner_row[0].user_id:
                     owner_row[0].admin_row = True
                 else:
                     usr = AttributeDict(usr.get_dict())
                     usr.admin_row = True
                     usr.permission = _admin_perm
                     super_admin_rows.append(usr)
 
         return super_admin_rows + owner_row + perm_rows
 
     def permission_user_groups(self):
         q = UserGroupRepoToPerm.query().filter(
             UserGroupRepoToPerm.repository == self)
         q = q.options(joinedload(UserGroupRepoToPerm.repository),
                       joinedload(UserGroupRepoToPerm.users_group),
                       joinedload(UserGroupRepoToPerm.permission),)
 
         perm_rows = []
         for _user_group in q.all():
             usr = AttributeDict(_user_group.users_group.get_dict())
             usr.permission = _user_group.permission.permission_name
             perm_rows.append(usr)
 
         return perm_rows
 
     def get_api_data(self, include_secrets=False):
         """
         Common function for generating repo api data
 
         :param include_secrets: See :meth:`User.get_api_data`.
 
         """
         # TODO: mikhail: Here there is an anti-pattern, we probably need to
         # move this methods on models level.
         from rhodecode.model.settings import SettingsModel
 
         repo = self
         _user_id, _time, _reason = self.locked
 
         data = {
             'repo_id': repo.repo_id,
             'repo_name': repo.repo_name,
             'repo_type': repo.repo_type,
             'clone_uri': repo.clone_uri or '',
             'url': url('summary_home', repo_name=self.repo_name, qualified=True),
             'private': repo.private,
             'created_on': repo.created_on,
             'description': repo.description,
             'landing_rev': repo.landing_rev,
             'owner': repo.user.username,
             'fork_of': repo.fork.repo_name if repo.fork else None,
             'enable_statistics': repo.enable_statistics,
             'enable_locking': repo.enable_locking,
             'enable_downloads': repo.enable_downloads,
             'last_changeset': repo.changeset_cache,
             'locked_by': User.get(_user_id).get_api_data(
                 include_secrets=include_secrets) if _user_id else None,
             'locked_date': time_to_datetime(_time) if _time else None,
             'lock_reason': _reason if _reason else None,
         }
 
         # TODO: mikhail: should be per-repo settings here
         rc_config = SettingsModel().get_all_settings()
         repository_fields = str2bool(
             rc_config.get('rhodecode_repository_fields'))
         if repository_fields:
             for f in self.extra_fields:
                 data[f.field_key_prefixed] = f.field_value
 
         return data
 
     @classmethod
     def lock(cls, repo, user_id, lock_time=None, lock_reason=None):
         if not lock_time:
             lock_time = time.time()
         if not lock_reason:
             lock_reason = cls.LOCK_AUTOMATIC
         repo.locked = [user_id, lock_time, lock_reason]
         Session().add(repo)
         Session().commit()
 
     @classmethod
     def unlock(cls, repo):
         repo.locked = None
         Session().add(repo)
         Session().commit()
 
     @classmethod
     def getlock(cls, repo):
         return repo.locked
 
     def is_user_lock(self, user_id):
         if self.lock[0]:
             lock_user_id = safe_int(self.lock[0])
             user_id = safe_int(user_id)
             # both are ints, and they are equal
             return all([lock_user_id, user_id]) and lock_user_id == user_id
 
         return False
 
     def get_locking_state(self, action, user_id, only_when_enabled=True):
         """
         Checks locking on this repository, if locking is enabled and lock is
         present returns a tuple of make_lock, locked, locked_by.
         make_lock can have 3 states None (do nothing) True, make lock
         False release lock, This value is later propagated to hooks, which
         do the locking. Think about this as signals passed to hooks what to do.
 
         """
         # TODO: johbo: This is part of the business logic and should be moved
         # into the RepositoryModel.
 
         if action not in ('push', 'pull'):
             raise ValueError("Invalid action value: %s" % repr(action))
 
         # defines if locked error should be thrown to user
         currently_locked = False
         # defines if new lock should be made, tri-state
         make_lock = None
         repo = self
         user = User.get(user_id)
 
         lock_info = repo.locked
 
         if repo and (repo.enable_locking or not only_when_enabled):
             if action == 'push':
                 # check if it's already locked !, if it is compare users
                 locked_by_user_id = lock_info[0]
                 if user.user_id == locked_by_user_id:
                     log.debug(
                         'Got `push` action from user %s, now unlocking', user)
                     # unlock if we have push from user who locked
                     make_lock = False
                 else:
                     # we're not the same user who locked, ban with
                     # code defined in settings (default is 423 HTTP Locked) !
                     log.debug('Repo %s is currently locked by %s', repo, user)
                     currently_locked = True
             elif action == 'pull':
                 # [0] user [1] date
                 if lock_info[0] and lock_info[1]:
                     log.debug('Repo %s is currently locked by %s', repo, user)
                     currently_locked = True
                 else:
                     log.debug('Setting lock on repo %s by %s', repo, user)
                     make_lock = True
 
         else:
             log.debug('Repository %s do not have locking enabled', repo)
 
         log.debug('FINAL locking values make_lock:%s,locked:%s,locked_by:%s',
                   make_lock, currently_locked, lock_info)
 
         from rhodecode.lib.auth import HasRepoPermissionAny
         perm_check = HasRepoPermissionAny('repository.write', 'repository.admin')
         if make_lock and not perm_check(repo_name=repo.repo_name, user=user):
             # if we don't have at least write permission we cannot make a lock
             log.debug('lock state reset back to FALSE due to lack '
                       'of at least read permission')
             make_lock = False
 
         return make_lock, currently_locked, lock_info
 
     @property
     def last_db_change(self):
         return self.updated_on
 
     @property
     def clone_uri_hidden(self):
         clone_uri = self.clone_uri
         if clone_uri:
             import urlobject
             url_obj = urlobject.URLObject(clone_uri)
             if url_obj.password:
                 clone_uri = url_obj.with_password('*****')
         return clone_uri
 
     def clone_url(self, **override):
         qualified_home_url = url('home', qualified=True)
 
         uri_tmpl = None
         if 'with_id' in override:
             uri_tmpl = self.DEFAULT_CLONE_URI_ID
             del override['with_id']
 
         if 'uri_tmpl' in override:
             uri_tmpl = override['uri_tmpl']
             del override['uri_tmpl']
 
         # we didn't override our tmpl from **overrides
         if not uri_tmpl:
             uri_tmpl = self.DEFAULT_CLONE_URI
             try:
                 from pylons import tmpl_context as c
                 uri_tmpl = c.clone_uri_tmpl
             except Exception:
                 # in any case if we call this outside of request context,
                 # ie, not having tmpl_context set up
                 pass
 
         return get_clone_url(uri_tmpl=uri_tmpl,
                              qualifed_home_url=qualified_home_url,
                              repo_name=self.repo_name,
                              repo_id=self.repo_id, **override)
 
     def set_state(self, state):
         self.repo_state = state
         Session().add(self)
     #==========================================================================
     # SCM PROPERTIES
     #==========================================================================
 
     def get_commit(self, commit_id=None, commit_idx=None, pre_load=None):
         return get_commit_safe(
             self.scm_instance(), commit_id, commit_idx, pre_load=pre_load)
 
     def get_changeset(self, rev=None, pre_load=None):
         warnings.warn("Use get_commit", DeprecationWarning)
         commit_id = None
         commit_idx = None
         if isinstance(rev, basestring):
             commit_id = rev
         else:
             commit_idx = rev
         return self.get_commit(commit_id=commit_id, commit_idx=commit_idx,
                                pre_load=pre_load)
 
     def get_landing_commit(self):
         """
         Returns landing commit, or if that doesn't exist returns the tip
         """
         _rev_type, _rev = self.landing_rev
         commit = self.get_commit(_rev)
         if isinstance(commit, EmptyCommit):
             return self.get_commit()
         return commit
 
     def update_commit_cache(self, cs_cache=None, config=None):
         """
         Update cache of last changeset for repository, keys should be::
 
             short_id
             raw_id
             revision
             parents
             message
             date
             author
 
         :param cs_cache:
         """
         from rhodecode.lib.vcs.backends.base import BaseChangeset
         if cs_cache is None:
             # use no-cache version here
             scm_repo = self.scm_instance(cache=False, config=config)
             if scm_repo:
                 cs_cache = scm_repo.get_commit(
                     pre_load=["author", "date", "message", "parents"])
             else:
                 cs_cache = EmptyCommit()
 
         if isinstance(cs_cache, BaseChangeset):
             cs_cache = cs_cache.__json__()
 
         def is_outdated(new_cs_cache):
             if (new_cs_cache['raw_id'] != self.changeset_cache['raw_id'] or
                 new_cs_cache['revision'] != self.changeset_cache['revision']):
                 return True
             return False
 
         # check if we have maybe already latest cached revision
         if is_outdated(cs_cache) or not self.changeset_cache:
             _default = datetime.datetime.fromtimestamp(0)
             last_change = cs_cache.get('date') or _default
             log.debug('updated repo %s with new cs cache %s',
                       self.repo_name, cs_cache)
             self.updated_on = last_change
             self.changeset_cache = cs_cache
             Session().add(self)
             Session().commit()
         else:
             log.debug('Skipping update_commit_cache for repo:`%s` '
                       'commit already with latest changes', self.repo_name)
 
     @property
     def tip(self):
         return self.get_commit('tip')
 
     @property
     def author(self):
         return self.tip.author
 
     @property
     def last_change(self):
         return self.scm_instance().last_change
 
     def get_comments(self, revisions=None):
         """
         Returns comments for this repository grouped by revisions
 
         :param revisions: filter query by revisions only
         """
         cmts = ChangesetComment.query()\
             .filter(ChangesetComment.repo == self)
         if revisions:
             cmts = cmts.filter(ChangesetComment.revision.in_(revisions))
         grouped = collections.defaultdict(list)
         for cmt in cmts.all():
             grouped[cmt.revision].append(cmt)
         return grouped
 
     def statuses(self, revisions=None):
         """
         Returns statuses for this repository
 
         :param revisions: list of revisions to get statuses for
         """
         statuses = ChangesetStatus.query()\
             .filter(ChangesetStatus.repo == self)\
             .filter(ChangesetStatus.version == 0)
 
         if revisions:
             # Try doing the filtering in chunks to avoid hitting limits
             size = 500
             status_results = []
             for chunk in xrange(0, len(revisions), size):
                 status_results += statuses.filter(
                     ChangesetStatus.revision.in_(
                         revisions[chunk: chunk+size])
                 ).all()
         else:
             status_results = statuses.all()
 
         grouped = {}
 
         # maybe we have open new pullrequest without a status?
         stat = ChangesetStatus.STATUS_UNDER_REVIEW
         status_lbl = ChangesetStatus.get_status_lbl(stat)
         for pr in PullRequest.query().filter(PullRequest.source_repo == self).all():
             for rev in pr.revisions:
                 pr_id = pr.pull_request_id
                 pr_repo = pr.target_repo.repo_name
                 grouped[rev] = [stat, status_lbl, pr_id, pr_repo]
 
         for stat in status_results:
             pr_id = pr_repo = None
             if stat.pull_request:
                 pr_id = stat.pull_request.pull_request_id
                 pr_repo = stat.pull_request.target_repo.repo_name
             grouped[stat.revision] = [str(stat.status), stat.status_lbl,
                                       pr_id, pr_repo]
         return grouped
 
     # ==========================================================================
     # SCM CACHE INSTANCE
     # ==========================================================================
 
     def scm_instance(self, **kwargs):
         import rhodecode
 
         # Passing a config will not hit the cache currently only used
         # for repo2dbmapper
         config = kwargs.pop('config', None)
         cache = kwargs.pop('cache', None)
         full_cache = str2bool(rhodecode.CONFIG.get('vcs_full_cache'))
         # if cache is NOT defined use default global, else we have a full
         # control over cache behaviour
         if cache is None and full_cache and not config:
             return self._get_instance_cached()
         return self._get_instance(cache=bool(cache), config=config)
 
     def _get_instance_cached(self):
         @cache_region('long_term')
         def _get_repo(cache_key):
             return self._get_instance()
 
         invalidator_context = CacheKey.repo_context_cache(
             _get_repo, self.repo_name, None, thread_scoped=True)
 
         with invalidator_context as context:
             context.invalidate()
             repo = context.compute()
 
         return repo
 
     def _get_instance(self, cache=True, config=None):
         config = config or self._config
         custom_wire = {
             'cache': cache  # controls the vcs.remote cache
         }
 
         repo = get_vcs_instance(
             repo_path=safe_str(self.repo_full_path),
             config=config,
             with_wire=custom_wire,
             create=False)
 
         return repo
 
     def __json__(self):
         return {'landing_rev': self.landing_rev}
 
     def get_dict(self):
 
         # Since we transformed `repo_name` to a hybrid property, we need to
         # keep compatibility with the code which uses `repo_name` field.
 
         result = super(Repository, self).get_dict()
         result['repo_name'] = result.pop('_repo_name', None)
         return result
 
 
 class RepoGroup(Base, BaseModel):
     __tablename__ = 'groups'
     __table_args__ = (
         UniqueConstraint('group_name', 'group_parent_id'),
         CheckConstraint('group_id != group_parent_id'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
     )
     __mapper_args__ = {'order_by': 'group_name'}
 
     CHOICES_SEPARATOR = '/'  # used to generate select2 choices for nested groups
 
     group_id = Column("group_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     group_name = Column("group_name", String(255), nullable=False, unique=True, default=None)
     group_parent_id = Column("group_parent_id", Integer(), ForeignKey('groups.group_id'), nullable=True, unique=None, default=None)
     group_description = Column("group_description", String(10000), nullable=True, unique=None, default=None)
     enable_locking = Column("enable_locking", Boolean(), nullable=False, unique=None, default=False)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=False, default=None)
     created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
 
     repo_group_to_perm = relationship('UserRepoGroupToPerm', cascade='all', order_by='UserRepoGroupToPerm.group_to_perm_id')
     users_group_to_perm = relationship('UserGroupRepoGroupToPerm', cascade='all')
     parent_group = relationship('RepoGroup', remote_side=group_id)
     user = relationship('User')
 
     def __init__(self, group_name='', parent_group=None):
         self.group_name = group_name
         self.parent_group = parent_group
 
     def __unicode__(self):
         return u"<%s('id:%s:%s')>" % (self.__class__.__name__, self.group_id,
                                       self.group_name)
 
     @classmethod
     def _generate_choice(cls, repo_group):
         from webhelpers.html import literal as _literal
         _name = lambda k: _literal(cls.CHOICES_SEPARATOR.join(k))
         return repo_group.group_id, _name(repo_group.full_path_splitted)
 
     @classmethod
     def groups_choices(cls, groups=None, show_empty_group=True):
         if not groups:
             groups = cls.query().all()
 
         repo_groups = []
         if show_empty_group:
             repo_groups = [('-1', u'-- %s --' % _('No parent'))]
 
         repo_groups.extend([cls._generate_choice(x) for x in groups])
 
         repo_groups = sorted(
             repo_groups, key=lambda t: t[1].split(cls.CHOICES_SEPARATOR)[0])
         return repo_groups
 
     @classmethod
     def url_sep(cls):
         return URL_SEP
 
     @classmethod
     def get_by_group_name(cls, group_name, cache=False, case_insensitive=False):
         if case_insensitive:
             gr = cls.query().filter(func.lower(cls.group_name)
                                     == func.lower(group_name))
         else:
             gr = cls.query().filter(cls.group_name == group_name)
         if cache:
             gr = gr.options(FromCache(
                             "sql_cache_short",
                             "get_group_%s" % _hash_key(group_name)))
         return gr.scalar()
 
     @classmethod
     def get_all_repo_groups(cls, user_id=Optional(None), group_id=Optional(None),
                             case_insensitive=True):
         q = RepoGroup.query()
 
         if not isinstance(user_id, Optional):
             q = q.filter(RepoGroup.user_id == user_id)
 
         if not isinstance(group_id, Optional):
             q = q.filter(RepoGroup.group_parent_id == group_id)
 
         if case_insensitive:
             q = q.order_by(func.lower(RepoGroup.group_name))
         else:
             q = q.order_by(RepoGroup.group_name)
         return q.all()
 
     @property
     def parents(self):
         parents_recursion_limit = 10
         groups = []
         if self.parent_group is None:
             return groups
         cur_gr = self.parent_group
         groups.insert(0, cur_gr)
         cnt = 0
         while 1:
             cnt += 1
             gr = getattr(cur_gr, 'parent_group', None)
             cur_gr = cur_gr.parent_group
             if gr is None:
                 break
             if cnt == parents_recursion_limit:
                 # this will prevent accidental infinit loops
                 log.error(('more than %s parents found for group %s, stopping '
                            'recursive parent fetching' % (parents_recursion_limit, self)))
                 break
 
             groups.insert(0, gr)
         return groups
 
     @property
     def children(self):
         return RepoGroup.query().filter(RepoGroup.parent_group == self)
 
     @property
     def name(self):
         return self.group_name.split(RepoGroup.url_sep())[-1]
 
     @property
     def full_path(self):
         return self.group_name
 
     @property
     def full_path_splitted(self):
         return self.group_name.split(RepoGroup.url_sep())
 
     @property
     def repositories(self):
         return Repository.query()\
                 .filter(Repository.group == self)\
                 .order_by(Repository.repo_name)
 
     @property
     def repositories_recursive_count(self):
         cnt = self.repositories.count()
 
         def children_count(group):
             cnt = 0
             for child in group.children:
                 cnt += child.repositories.count()
                 cnt += children_count(child)
             return cnt
 
         return cnt + children_count(self)
 
     def _recursive_objects(self, include_repos=True):
         all_ = []
 
         def _get_members(root_gr):
             if include_repos:
                 for r in root_gr.repositories:
                     all_.append(r)
             childs = root_gr.children.all()
             if childs:
                 for gr in childs:
                     all_.append(gr)
                     _get_members(gr)
 
         _get_members(self)
         return [self] + all_
 
     def recursive_groups_and_repos(self):
         """
         Recursive return all groups, with repositories in those groups
         """
         return self._recursive_objects()
 
     def recursive_groups(self):
         """
         Returns all children groups for this group including children of children
         """
         return self._recursive_objects(include_repos=False)
 
     def get_new_name(self, group_name):
         """
         returns new full group name based on parent and new name
 
         :param group_name:
         """
         path_prefix = (self.parent_group.full_path_splitted if
                        self.parent_group else [])
         return RepoGroup.url_sep().join(path_prefix + [group_name])
 
     def permissions(self, with_admins=True, with_owner=True):
         q = UserRepoGroupToPerm.query().filter(UserRepoGroupToPerm.group == self)
         q = q.options(joinedload(UserRepoGroupToPerm.group),
                       joinedload(UserRepoGroupToPerm.user),
                       joinedload(UserRepoGroupToPerm.permission),)
 
         # get owners and admins and permissions. We do a trick of re-writing
         # objects from sqlalchemy to named-tuples due to sqlalchemy session
         # has a global reference and changing one object propagates to all
         # others. This means if admin is also an owner admin_row that change
         # would propagate to both objects
         perm_rows = []
         for _usr in q.all():
             usr = AttributeDict(_usr.user.get_dict())
             usr.permission = _usr.permission.permission_name
             perm_rows.append(usr)
 
         # filter the perm rows by 'default' first and then sort them by
         # admin,write,read,none permissions sorted again alphabetically in
         # each group
         perm_rows = sorted(perm_rows, key=display_sort)
 
         _admin_perm = 'group.admin'
         owner_row = []
         if with_owner:
             usr = AttributeDict(self.user.get_dict())
             usr.owner_row = True
             usr.permission = _admin_perm
             owner_row.append(usr)
 
         super_admin_rows = []
         if with_admins:
             for usr in User.get_all_super_admins():
                 # if this admin is also owner, don't double the record
                 if usr.user_id == owner_row[0].user_id:
                     owner_row[0].admin_row = True
                 else:
                     usr = AttributeDict(usr.get_dict())
                     usr.admin_row = True
                     usr.permission = _admin_perm
                     super_admin_rows.append(usr)
 
         return super_admin_rows + owner_row + perm_rows
 
     def permission_user_groups(self):
         q = UserGroupRepoGroupToPerm.query().filter(UserGroupRepoGroupToPerm.group == self)
         q = q.options(joinedload(UserGroupRepoGroupToPerm.group),
                       joinedload(UserGroupRepoGroupToPerm.users_group),
                       joinedload(UserGroupRepoGroupToPerm.permission),)
 
         perm_rows = []
         for _user_group in q.all():
             usr = AttributeDict(_user_group.users_group.get_dict())
             usr.permission = _user_group.permission.permission_name
             perm_rows.append(usr)
 
         return perm_rows
 
     def get_api_data(self):
         """
         Common function for generating api data
 
         """
         group = self
         data = {
             'group_id': group.group_id,
             'group_name': group.group_name,
             'group_description': group.group_description,
             'parent_group': group.parent_group.group_name if group.parent_group else None,
             'repositories': [x.repo_name for x in group.repositories],
             'owner': group.user.username,
         }
         return data
 
 
 class Permission(Base, BaseModel):
     __tablename__ = 'permissions'
     __table_args__ = (
         Index('p_perm_name_idx', 'permission_name'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
     )
     PERMS = [
         ('hg.admin', _('RhodeCode Super Administrator')),
 
         ('repository.none', _('Repository no access')),
         ('repository.read', _('Repository read access')),
         ('repository.write', _('Repository write access')),
         ('repository.admin', _('Repository admin access')),
 
         ('group.none', _('Repository group no access')),
         ('group.read', _('Repository group read access')),
         ('group.write', _('Repository group write access')),
         ('group.admin', _('Repository group admin access')),
 
         ('usergroup.none', _('User group no access')),
         ('usergroup.read', _('User group read access')),
         ('usergroup.write', _('User group write access')),
         ('usergroup.admin', _('User group admin access')),
 
         ('hg.repogroup.create.false', _('Repository Group creation disabled')),
         ('hg.repogroup.create.true', _('Repository Group creation enabled')),
 
         ('hg.usergroup.create.false', _('User Group creation disabled')),
         ('hg.usergroup.create.true', _('User Group creation enabled')),
 
         ('hg.create.none', _('Repository creation disabled')),
         ('hg.create.repository', _('Repository creation enabled')),
         ('hg.create.write_on_repogroup.true', _('Repository creation enabled with write permission to a repository group')),
         ('hg.create.write_on_repogroup.false', _('Repository creation disabled with write permission to a repository group')),
 
         ('hg.fork.none', _('Repository forking disabled')),
         ('hg.fork.repository', _('Repository forking enabled')),
 
         ('hg.register.none', _('Registration disabled')),
         ('hg.register.manual_activate', _('User Registration with manual account activation')),
         ('hg.register.auto_activate', _('User Registration with automatic account activation')),
 
         ('hg.extern_activate.manual', _('Manual activation of external account')),
         ('hg.extern_activate.auto', _('Automatic activation of external account')),
 
         ('hg.inherit_default_perms.false', _('Inherit object permissions from default user disabled')),
         ('hg.inherit_default_perms.true', _('Inherit object permissions from default user enabled')),
     ]
 
     # definition of system default permissions for DEFAULT user
     DEFAULT_USER_PERMISSIONS = [
         'repository.read',
         'group.read',
         'usergroup.read',
         'hg.create.repository',
         'hg.repogroup.create.false',
         'hg.usergroup.create.false',
         'hg.create.write_on_repogroup.true',
         'hg.fork.repository',
         'hg.register.manual_activate',
         'hg.extern_activate.auto',
         'hg.inherit_default_perms.true',
     ]
 
     # defines which permissions are more important higher the more important
     # Weight defines which permissions are more important.
     # The higher number the more important.
     PERM_WEIGHTS = {
         'repository.none': 0,
         'repository.read': 1,
         'repository.write': 3,
         'repository.admin': 4,
 
         'group.none': 0,
         'group.read': 1,
         'group.write': 3,
         'group.admin': 4,
 
         'usergroup.none': 0,
         'usergroup.read': 1,
         'usergroup.write': 3,
         'usergroup.admin': 4,
 
         'hg.repogroup.create.false': 0,
         'hg.repogroup.create.true': 1,
 
         'hg.usergroup.create.false': 0,
         'hg.usergroup.create.true': 1,
 
         'hg.fork.none': 0,
         'hg.fork.repository': 1,
         'hg.create.none': 0,
         'hg.create.repository': 1
     }
 
     permission_id = Column("permission_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     permission_name = Column("permission_name", String(255), nullable=True, unique=None, default=None)
     permission_longname = Column("permission_longname", String(255), nullable=True, unique=None, default=None)
 
     def __unicode__(self):
         return u"<%s('%s:%s')>" % (
             self.__class__.__name__, self.permission_id, self.permission_name
         )
 
     @classmethod
     def get_by_key(cls, key):
         return cls.query().filter(cls.permission_name == key).scalar()
 
     @classmethod
     def get_default_repo_perms(cls, user_id, repo_id=None):
         q = Session().query(UserRepoToPerm, Repository, Permission)\
             .join((Permission, UserRepoToPerm.permission_id == Permission.permission_id))\
             .join((Repository, UserRepoToPerm.repository_id == Repository.repo_id))\
             .filter(UserRepoToPerm.user_id == user_id)
         if repo_id:
             q = q.filter(UserRepoToPerm.repository_id == repo_id)
         return q.all()
 
     @classmethod
     def get_default_repo_perms_from_user_group(cls, user_id, repo_id=None):
         q = Session().query(UserGroupRepoToPerm, Repository, Permission)\
             .join(
                 Permission,
                 UserGroupRepoToPerm.permission_id == Permission.permission_id)\
             .join(
                 Repository,
                 UserGroupRepoToPerm.repository_id == Repository.repo_id)\
             .join(
                 UserGroup,
                 UserGroupRepoToPerm.users_group_id ==
                 UserGroup.users_group_id)\
             .join(
                 UserGroupMember,
                 UserGroupRepoToPerm.users_group_id ==
                 UserGroupMember.users_group_id)\
             .filter(
                 UserGroupMember.user_id == user_id,
                 UserGroup.users_group_active == true())
         if repo_id:
             q = q.filter(UserGroupRepoToPerm.repository_id == repo_id)
         return q.all()
 
     @classmethod
     def get_default_group_perms(cls, user_id, repo_group_id=None):
         q = Session().query(UserRepoGroupToPerm, RepoGroup, Permission)\
             .join((Permission, UserRepoGroupToPerm.permission_id == Permission.permission_id))\
             .join((RepoGroup, UserRepoGroupToPerm.group_id == RepoGroup.group_id))\
             .filter(UserRepoGroupToPerm.user_id == user_id)
         if repo_group_id:
             q = q.filter(UserRepoGroupToPerm.group_id == repo_group_id)
         return q.all()
 
     @classmethod
     def get_default_group_perms_from_user_group(
             cls, user_id, repo_group_id=None):
         q = Session().query(UserGroupRepoGroupToPerm, RepoGroup, Permission)\
             .join(
                 Permission,
                 UserGroupRepoGroupToPerm.permission_id ==
                 Permission.permission_id)\
             .join(
                 RepoGroup,
                 UserGroupRepoGroupToPerm.group_id == RepoGroup.group_id)\
             .join(
                 UserGroup,
                 UserGroupRepoGroupToPerm.users_group_id ==
                 UserGroup.users_group_id)\
             .join(
                 UserGroupMember,
                 UserGroupRepoGroupToPerm.users_group_id ==
                 UserGroupMember.users_group_id)\
             .filter(
                 UserGroupMember.user_id == user_id,
                 UserGroup.users_group_active == true())
         if repo_group_id:
             q = q.filter(UserGroupRepoGroupToPerm.group_id == repo_group_id)
         return q.all()
 
     @classmethod
     def get_default_user_group_perms(cls, user_id, user_group_id=None):
         q = Session().query(UserUserGroupToPerm, UserGroup, Permission)\
             .join((Permission, UserUserGroupToPerm.permission_id == Permission.permission_id))\
             .join((UserGroup, UserUserGroupToPerm.user_group_id == UserGroup.users_group_id))\
             .filter(UserUserGroupToPerm.user_id == user_id)
         if user_group_id:
             q = q.filter(UserUserGroupToPerm.user_group_id == user_group_id)
         return q.all()
 
     @classmethod
     def get_default_user_group_perms_from_user_group(
             cls, user_id, user_group_id=None):
         TargetUserGroup = aliased(UserGroup, name='target_user_group')
         q = Session().query(UserGroupUserGroupToPerm, UserGroup, Permission)\
             .join(
                 Permission,
                 UserGroupUserGroupToPerm.permission_id ==
                 Permission.permission_id)\
             .join(
                 TargetUserGroup,
                 UserGroupUserGroupToPerm.target_user_group_id ==
                 TargetUserGroup.users_group_id)\
             .join(
                 UserGroup,
                 UserGroupUserGroupToPerm.user_group_id ==
                 UserGroup.users_group_id)\
             .join(
                 UserGroupMember,
                 UserGroupUserGroupToPerm.user_group_id ==
                 UserGroupMember.users_group_id)\
             .filter(
                 UserGroupMember.user_id == user_id,
                 UserGroup.users_group_active == true())
         if user_group_id:
             q = q.filter(
                 UserGroupUserGroupToPerm.user_group_id == user_group_id)
 
         return q.all()
 
 
 class UserRepoToPerm(Base, BaseModel):
     __tablename__ = 'repo_to_perm'
     __table_args__ = (
         UniqueConstraint('user_id', 'repository_id', 'permission_id'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
     repo_to_perm_id = Column("repo_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)
     permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
     repository_id = Column("repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=False, unique=None, default=None)
 
     user = relationship('User')
     repository = relationship('Repository')
     permission = relationship('Permission')
 
     @classmethod
     def create(cls, user, repository, permission):
         n = cls()
         n.user = user
         n.repository = repository
         n.permission = permission
         Session().add(n)
         return n
 
     def __unicode__(self):
         return u'<%s => %s >' % (self.user, self.repository)
 
 
 class UserUserGroupToPerm(Base, BaseModel):
     __tablename__ = 'user_user_group_to_perm'
     __table_args__ = (
         UniqueConstraint('user_id', 'user_group_id', 'permission_id'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
     user_user_group_to_perm_id = Column("user_user_group_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)
     permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
     user_group_id = Column("user_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)
 
     user = relationship('User')
     user_group = relationship('UserGroup')
     permission = relationship('Permission')
 
     @classmethod
     def create(cls, user, user_group, permission):
         n = cls()
         n.user = user
         n.user_group = user_group
         n.permission = permission
         Session().add(n)
         return n
 
     def __unicode__(self):
         return u'<%s => %s >' % (self.user, self.user_group)
 
 
 class UserToPerm(Base, BaseModel):
     __tablename__ = 'user_to_perm'
     __table_args__ = (
         UniqueConstraint('user_id', 'permission_id'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
     user_to_perm_id = Column("user_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)
     permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
 
     user = relationship('User')
     permission = relationship('Permission', lazy='joined')
 
     def __unicode__(self):
         return u'<%s => %s >' % (self.user, self.permission)
 
 
 class UserGroupRepoToPerm(Base, BaseModel):
     __tablename__ = 'users_group_repo_to_perm'
     __table_args__ = (
         UniqueConstraint('repository_id', 'users_group_id', 'permission_id'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
     users_group_to_perm_id = Column("users_group_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     users_group_id = Column("users_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)
     permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
     repository_id = Column("repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=False, unique=None, default=None)
 
     users_group = relationship('UserGroup')
     permission = relationship('Permission')
     repository = relationship('Repository')
 
     @classmethod
     def create(cls, users_group, repository, permission):
         n = cls()
         n.users_group = users_group
         n.repository = repository
         n.permission = permission
         Session().add(n)
         return n
 
     def __unicode__(self):
         return u'<UserGroupRepoToPerm:%s => %s >' % (self.users_group, self.repository)
 
 
 class UserGroupUserGroupToPerm(Base, BaseModel):
     __tablename__ = 'user_group_user_group_to_perm'
     __table_args__ = (
         UniqueConstraint('target_user_group_id', 'user_group_id', 'permission_id'),
         CheckConstraint('target_user_group_id != user_group_id'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
     user_group_user_group_to_perm_id = Column("user_group_user_group_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     target_user_group_id = Column("target_user_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)
     permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
     user_group_id = Column("user_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)
 
     target_user_group = relationship('UserGroup', primaryjoin='UserGroupUserGroupToPerm.target_user_group_id==UserGroup.users_group_id')
     user_group = relationship('UserGroup', primaryjoin='UserGroupUserGroupToPerm.user_group_id==UserGroup.users_group_id')
     permission = relationship('Permission')
 
     @classmethod
     def create(cls, target_user_group, user_group, permission):
         n = cls()
         n.target_user_group = target_user_group
         n.user_group = user_group
         n.permission = permission
         Session().add(n)
         return n
 
     def __unicode__(self):
         return u'<UserGroupUserGroup:%s => %s >' % (self.target_user_group, self.user_group)
 
 
 class UserGroupToPerm(Base, BaseModel):
     __tablename__ = 'users_group_to_perm'
     __table_args__ = (
         UniqueConstraint('users_group_id', 'permission_id',),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
     users_group_to_perm_id = Column("users_group_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     users_group_id = Column("users_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)
     permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
 
     users_group = relationship('UserGroup')
     permission = relationship('Permission')
 
 
 class UserRepoGroupToPerm(Base, BaseModel):
     __tablename__ = 'user_repo_group_to_perm'
     __table_args__ = (
         UniqueConstraint('user_id', 'group_id', 'permission_id'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
 
     group_to_perm_id = Column("group_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)
     group_id = Column("group_id", Integer(), ForeignKey('groups.group_id'), nullable=False, unique=None, default=None)
     permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
 
     user = relationship('User')
     group = relationship('RepoGroup')
     permission = relationship('Permission')
 
     @classmethod
     def create(cls, user, repository_group, permission):
         n = cls()
         n.user = user
         n.group = repository_group
         n.permission = permission
         Session().add(n)
         return n
 
 
 class UserGroupRepoGroupToPerm(Base, BaseModel):
     __tablename__ = 'users_group_repo_group_to_perm'
     __table_args__ = (
         UniqueConstraint('users_group_id', 'group_id'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
 
     users_group_repo_group_to_perm_id = Column("users_group_repo_group_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     users_group_id = Column("users_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)
     group_id = Column("group_id", Integer(), ForeignKey('groups.group_id'), nullable=False, unique=None, default=None)
     permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
 
     users_group = relationship('UserGroup')
     permission = relationship('Permission')
     group = relationship('RepoGroup')
 
     @classmethod
     def create(cls, user_group, repository_group, permission):
         n = cls()
         n.users_group = user_group
         n.group = repository_group
         n.permission = permission
         Session().add(n)
         return n
 
     def __unicode__(self):
         return u'<UserGroupRepoGroupToPerm:%s => %s >' % (self.users_group, self.group)
 
 
 class Statistics(Base, BaseModel):
     __tablename__ = 'statistics'
     __table_args__ = (
          UniqueConstraint('repository_id'),
          {'extend_existing': True, 'mysql_engine': 'InnoDB',
           'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
     stat_id = Column("stat_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     repository_id = Column("repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=False, unique=True, default=None)
     stat_on_revision = Column("stat_on_revision", Integer(), nullable=False)
     commit_activity = Column("commit_activity", LargeBinary(1000000), nullable=False)#JSON data
     commit_activity_combined = Column("commit_activity_combined", LargeBinary(), nullable=False)#JSON data
     languages = Column("languages", LargeBinary(1000000), nullable=False)#JSON data
 
     repository = relationship('Repository', single_parent=True)
 
 
 class UserFollowing(Base, BaseModel):
     __tablename__ = 'user_followings'
     __table_args__ = (
         UniqueConstraint('user_id', 'follows_repository_id'),
         UniqueConstraint('user_id', 'follows_user_id'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
 
     user_following_id = Column("user_following_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)
     follows_repo_id = Column("follows_repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=True, unique=None, default=None)
     follows_user_id = Column("follows_user_id", Integer(), ForeignKey('users.user_id'), nullable=True, unique=None, default=None)
     follows_from = Column('follows_from', DateTime(timezone=False), nullable=True, unique=None, default=datetime.datetime.now)
 
     user = relationship('User', primaryjoin='User.user_id==UserFollowing.user_id')
 
     follows_user = relationship('User', primaryjoin='User.user_id==UserFollowing.follows_user_id')
     follows_repository = relationship('Repository', order_by='Repository.repo_name')
 
     @classmethod
     def get_repo_followers(cls, repo_id):
         return cls.query().filter(cls.follows_repo_id == repo_id)
 
 
 class CacheKey(Base, BaseModel):
     __tablename__ = 'cache_invalidation'
     __table_args__ = (
         UniqueConstraint('cache_key'),
         Index('key_idx', 'cache_key'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
     )
     CACHE_TYPE_ATOM = 'ATOM'
     CACHE_TYPE_RSS = 'RSS'
     CACHE_TYPE_README = 'README'
 
     cache_id = Column("cache_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     cache_key = Column("cache_key", String(255), nullable=True, unique=None, default=None)
     cache_args = Column("cache_args", String(255), nullable=True, unique=None, default=None)
     cache_active = Column("cache_active", Boolean(), nullable=True, unique=None, default=False)
 
     def __init__(self, cache_key, cache_args=''):
         self.cache_key = cache_key
         self.cache_args = cache_args
         self.cache_active = False
 
     def __unicode__(self):
         return u"<%s('%s:%s[%s]')>" % (
             self.__class__.__name__,
             self.cache_id, self.cache_key, self.cache_active)
 
     def _cache_key_partition(self):
         prefix, repo_name, suffix = self.cache_key.partition(self.cache_args)
         return prefix, repo_name, suffix
 
     def get_prefix(self):
         """
         Try to extract prefix from existing cache key. The key could consist
         of prefix, repo_name, suffix
         """
         # this returns prefix, repo_name, suffix
         return self._cache_key_partition()[0]
 
     def get_suffix(self):
         """
         get suffix that might have been used in _get_cache_key to
         generate self.cache_key. Only used for informational purposes
         in repo_edit.html.
         """
         # prefix, repo_name, suffix
         return self._cache_key_partition()[2]
 
     @classmethod
     def delete_all_cache(cls):
         """
         Delete all cache keys from database.
         Should only be run when all instances are down and all entries
         thus stale.
         """
         cls.query().delete()
         Session().commit()
 
     @classmethod
     def get_cache_key(cls, repo_name, cache_type):
         """
 
         Generate a cache key for this process of RhodeCode instance.
         Prefix most likely will be process id or maybe explicitly set
         instance_id from .ini file.
         """
         import rhodecode
         prefix = safe_unicode(rhodecode.CONFIG.get('instance_id') or '')
 
         repo_as_unicode = safe_unicode(repo_name)
         key = u'{}_{}'.format(repo_as_unicode, cache_type) \
             if cache_type else repo_as_unicode
 
         return u'{}{}'.format(prefix, key)
 
     @classmethod
     def set_invalidate(cls, repo_name, delete=False):
         """
         Mark all caches of a repo as invalid in the database.
         """
 
         try:
             qry = Session().query(cls).filter(cls.cache_args == repo_name)
             if delete:
                 log.debug('cache objects deleted for repo %s',
                           safe_str(repo_name))
                 qry.delete()
             else:
                 log.debug('cache objects marked as invalid for repo %s',
                           safe_str(repo_name))
                 qry.update({"cache_active": False})
 
             Session().commit()
         except Exception:
             log.exception(
                 'Cache key invalidation failed for repository %s',
                 safe_str(repo_name))
             Session().rollback()
 
     @classmethod
     def get_active_cache(cls, cache_key):
         inv_obj = cls.query().filter(cls.cache_key == cache_key).scalar()
         if inv_obj:
             return inv_obj
         return None
 
     @classmethod
     def repo_context_cache(cls, compute_func, repo_name, cache_type,
                            thread_scoped=False):
         """
         @cache_region('long_term')
         def _heavy_calculation(cache_key):
             return 'result'
 
         cache_context = CacheKey.repo_context_cache(
             _heavy_calculation, repo_name, cache_type)
 
         with cache_context as context:
             context.invalidate()
             computed = context.compute()
 
         assert computed == 'result'
         """
         from rhodecode.lib import caches
         return caches.InvalidationContext(
             compute_func, repo_name, cache_type, thread_scoped=thread_scoped)
 
 
 class ChangesetComment(Base, BaseModel):
     __tablename__ = 'changeset_comments'
     __table_args__ = (
         Index('cc_revision_idx', 'revision'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
     )
 
     COMMENT_OUTDATED = u'comment_outdated'
 
     comment_id = Column('comment_id', Integer(), nullable=False, primary_key=True)
     repo_id = Column('repo_id', Integer(), ForeignKey('repositories.repo_id'), nullable=False)
     revision = Column('revision', String(40), nullable=True)
     pull_request_id = Column("pull_request_id", Integer(), ForeignKey('pull_requests.pull_request_id'), nullable=True)
     pull_request_version_id = Column("pull_request_version_id", Integer(), ForeignKey('pull_request_versions.pull_request_version_id'), nullable=True)
     line_no = Column('line_no', Unicode(10), nullable=True)
     hl_lines = Column('hl_lines', Unicode(512), nullable=True)
     f_path = Column('f_path', Unicode(1000), nullable=True)
     user_id = Column('user_id', Integer(), ForeignKey('users.user_id'), nullable=False)
     text = Column('text', UnicodeText().with_variant(UnicodeText(25000), 'mysql'), nullable=False)
     created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
     modified_at = Column('modified_at', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
     renderer = Column('renderer', Unicode(64), nullable=True)
     display_state = Column('display_state',  Unicode(128), nullable=True)
 
     author = relationship('User', lazy='joined')
     repo = relationship('Repository')
     status_change = relationship('ChangesetStatus', cascade="all, delete, delete-orphan")
     pull_request = relationship('PullRequest', lazy='joined')
     pull_request_version = relationship('PullRequestVersion')
 
     @classmethod
     def get_users(cls, revision=None, pull_request_id=None):
         """
         Returns user associated with this ChangesetComment. ie those
         who actually commented
 
         :param cls:
         :param revision:
         """
         q = Session().query(User)\
                 .join(ChangesetComment.author)
         if revision:
             q = q.filter(cls.revision == revision)
         elif pull_request_id:
             q = q.filter(cls.pull_request_id == pull_request_id)
         return q.all()
 
     def render(self, mentions=False):
         from rhodecode.lib import helpers as h
         return h.render(self.text, renderer=self.renderer, mentions=mentions)
 
     def __repr__(self):
         if self.comment_id:
             return '<DB:ChangesetComment #%s>' % self.comment_id
         else:
             return '<DB:ChangesetComment at %#x>' % id(self)
 
 
 class ChangesetStatus(Base, BaseModel):
     __tablename__ = 'changeset_statuses'
     __table_args__ = (
         Index('cs_revision_idx', 'revision'),
         Index('cs_version_idx', 'version'),
         UniqueConstraint('repo_id', 'revision', 'version'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
     STATUS_NOT_REVIEWED = DEFAULT = 'not_reviewed'
     STATUS_APPROVED = 'approved'
     STATUS_REJECTED = 'rejected'
     STATUS_UNDER_REVIEW = 'under_review'
 
     STATUSES = [
         (STATUS_NOT_REVIEWED, _("Not Reviewed")),  # (no icon) and default
         (STATUS_APPROVED, _("Approved")),
         (STATUS_REJECTED, _("Rejected")),
         (STATUS_UNDER_REVIEW, _("Under Review")),
     ]
 
     changeset_status_id = Column('changeset_status_id', Integer(), nullable=False, primary_key=True)
     repo_id = Column('repo_id', Integer(), ForeignKey('repositories.repo_id'), nullable=False)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None)
     revision = Column('revision', String(40), nullable=False)
     status = Column('status', String(128), nullable=False, default=DEFAULT)
     changeset_comment_id = Column('changeset_comment_id', Integer(), ForeignKey('changeset_comments.comment_id'))
     modified_at = Column('modified_at', DateTime(), nullable=False, default=datetime.datetime.now)
     version = Column('version', Integer(), nullable=False, default=0)
     pull_request_id = Column("pull_request_id", Integer(), ForeignKey('pull_requests.pull_request_id'), nullable=True)
 
     author = relationship('User', lazy='joined')
     repo = relationship('Repository')
     comment = relationship('ChangesetComment', lazy='joined')
     pull_request = relationship('PullRequest', lazy='joined')
 
     def __unicode__(self):
         return u"<%s('%s[%s]:%s')>" % (
             self.__class__.__name__,
             self.status, self.version, self.author
         )
 
     @classmethod
     def get_status_lbl(cls, value):
         return dict(cls.STATUSES).get(value)
 
     @property
     def status_lbl(self):
         return ChangesetStatus.get_status_lbl(self.status)
 
 
 class _PullRequestBase(BaseModel):
     """
     Common attributes of pull request and version entries.
     """
 
     # .status values
     STATUS_NEW = u'new'
     STATUS_OPEN = u'open'
     STATUS_CLOSED = u'closed'
 
     title = Column('title', Unicode(255), nullable=True)
     description = Column(
         'description', UnicodeText().with_variant(UnicodeText(10240), 'mysql'),
         nullable=True)
     # new/open/closed status of pull request (not approve/reject/etc)
     status = Column('status', Unicode(255), nullable=False, default=STATUS_NEW)
     created_on = Column(
         'created_on', DateTime(timezone=False), nullable=False,
         default=datetime.datetime.now)
     updated_on = Column(
         'updated_on', DateTime(timezone=False), nullable=False,
         default=datetime.datetime.now)
 
     @declared_attr
     def user_id(cls):
         return Column(
             "user_id", Integer(), ForeignKey('users.user_id'), nullable=False,
             unique=None)
 
     # 500 revisions max
     _revisions = Column(
         'revisions', UnicodeText().with_variant(UnicodeText(20500), 'mysql'))
 
     @declared_attr
     def source_repo_id(cls):
         # TODO: dan: rename column to source_repo_id
         return Column(
             'org_repo_id', Integer(), ForeignKey('repositories.repo_id'),
             nullable=False)
 
     source_ref = Column('org_ref', Unicode(255), nullable=False)
 
     @declared_attr
     def target_repo_id(cls):
         # TODO: dan: rename column to target_repo_id
         return Column(
             'other_repo_id', Integer(), ForeignKey('repositories.repo_id'),
             nullable=False)
 
     target_ref = Column('other_ref', Unicode(255), nullable=False)
 
     # TODO: dan: rename column to last_merge_source_rev
     _last_merge_source_rev = Column(
         'last_merge_org_rev', String(40), nullable=True)
     # TODO: dan: rename column to last_merge_target_rev
     _last_merge_target_rev = Column(
         'last_merge_other_rev', String(40), nullable=True)
     _last_merge_status = Column('merge_status', Integer(), nullable=True)
     merge_rev = Column('merge_rev', String(40), nullable=True)
 
     @hybrid_property
     def revisions(self):
         return self._revisions.split(':') if self._revisions else []
 
     @revisions.setter
     def revisions(self, val):
         self._revisions = ':'.join(val)
 
     @declared_attr
     def author(cls):
         return relationship('User', lazy='joined')
 
     @declared_attr
     def source_repo(cls):
         return relationship(
             'Repository',
             primaryjoin='%s.source_repo_id==Repository.repo_id' % cls.__name__)
 
     @property
     def source_ref_parts(self):
         refs = self.source_ref.split(':')
         return Reference(refs[0], refs[1], refs[2])
 
     @declared_attr
     def target_repo(cls):
         return relationship(
             'Repository',
             primaryjoin='%s.target_repo_id==Repository.repo_id' % cls.__name__)
 
     @property
     def target_ref_parts(self):
         refs = self.target_ref.split(':')
         return Reference(refs[0], refs[1], refs[2])
 
 
 class PullRequest(Base, _PullRequestBase):
     __tablename__ = 'pull_requests'
     __table_args__ = (
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
     )
 
     pull_request_id = Column(
         'pull_request_id', Integer(), nullable=False, primary_key=True)
 
     def __repr__(self):
         if self.pull_request_id:
             return '<DB:PullRequest #%s>' % self.pull_request_id
         else:
             return '<DB:PullRequest at %#x>' % id(self)
 
     reviewers = relationship('PullRequestReviewers',
                              cascade="all, delete, delete-orphan")
     statuses = relationship('ChangesetStatus')
     comments = relationship('ChangesetComment',
                             cascade="all, delete, delete-orphan")
     versions = relationship('PullRequestVersion',
                             cascade="all, delete, delete-orphan")
 
     def is_closed(self):
         return self.status == self.STATUS_CLOSED
 
     def get_api_data(self):
         from rhodecode.model.pull_request import PullRequestModel
         pull_request = self
         merge_status = PullRequestModel().merge_status(pull_request)
         data = {
             'pull_request_id': pull_request.pull_request_id,
             'url': url('pullrequest_show', repo_name=self.target_repo.repo_name,
                                        pull_request_id=self.pull_request_id,
                                        qualified=True),
             'title': pull_request.title,
             'description': pull_request.description,
             'status': pull_request.status,
             'created_on': pull_request.created_on,
             'updated_on': pull_request.updated_on,
             'commit_ids': pull_request.revisions,
             'review_status': pull_request.calculated_review_status(),
             'mergeable': {
                 'status': merge_status[0],
                 'message': unicode(merge_status[1]),
             },
             'source': {
                 'clone_url': pull_request.source_repo.clone_url(),
                 'repository': pull_request.source_repo.repo_name,
                 'reference': {
                     'name': pull_request.source_ref_parts.name,
                     'type': pull_request.source_ref_parts.type,
                     'commit_id': pull_request.source_ref_parts.commit_id,
                 },
             },
             'target': {
                 'clone_url': pull_request.target_repo.clone_url(),
                 'repository': pull_request.target_repo.repo_name,
                 'reference': {
                     'name': pull_request.target_ref_parts.name,
                     'type': pull_request.target_ref_parts.type,
                     'commit_id': pull_request.target_ref_parts.commit_id,
                 },
             },
             'author': pull_request.author.get_api_data(include_secrets=False,
                                                        details='basic'),
             'reviewers': [
                 {
                     'user': reviewer.get_api_data(include_secrets=False,
                                                   details='basic'),
                     'review_status': st[0][1].status if st else 'not_reviewed',
                 }
                 for reviewer, st in pull_request.reviewers_statuses()
             ]
         }
 
         return data
 
     def __json__(self):
         return {
             'revisions': self.revisions,
         }
 
     def calculated_review_status(self):
         # TODO: anderson: 13.05.15 Used only on templates/my_account_pullrequests.html
         # because it's tricky on how to use ChangesetStatusModel from there
         warnings.warn("Use calculated_review_status from ChangesetStatusModel", DeprecationWarning)
         from rhodecode.model.changeset_status import ChangesetStatusModel
         return ChangesetStatusModel().calculated_review_status(self)
 
     def reviewers_statuses(self):
         warnings.warn("Use reviewers_statuses from ChangesetStatusModel", DeprecationWarning)
         from rhodecode.model.changeset_status import ChangesetStatusModel
         return ChangesetStatusModel().reviewers_statuses(self)
 
 
 class PullRequestVersion(Base, _PullRequestBase):
     __tablename__ = 'pull_request_versions'
     __table_args__ = (
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
     )
 
     pull_request_version_id = Column(
         'pull_request_version_id', Integer(), nullable=False, primary_key=True)
     pull_request_id = Column(
         'pull_request_id', Integer(),
         ForeignKey('pull_requests.pull_request_id'), nullable=False)
     pull_request = relationship('PullRequest')
 
     def __repr__(self):
         if self.pull_request_version_id:
             return '<DB:PullRequestVersion #%s>' % self.pull_request_version_id
         else:
             return '<DB:PullRequestVersion at %#x>' % id(self)
 
 
 class PullRequestReviewers(Base, BaseModel):
     __tablename__ = 'pull_request_reviewers'
     __table_args__ = (
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
     )
 
     def __init__(self, user=None, pull_request=None):
         self.user = user
         self.pull_request = pull_request
 
     pull_requests_reviewers_id = Column(
         'pull_requests_reviewers_id', Integer(), nullable=False,
         primary_key=True)
     pull_request_id = Column(
         "pull_request_id", Integer(),
         ForeignKey('pull_requests.pull_request_id'), nullable=False)
     user_id = Column(
         "user_id", Integer(), ForeignKey('users.user_id'), nullable=True)
 
     user = relationship('User')
     pull_request = relationship('PullRequest')
 
 
 class Notification(Base, BaseModel):
     __tablename__ = 'notifications'
     __table_args__ = (
         Index('notification_type_idx', 'type'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
     )
 
     TYPE_CHANGESET_COMMENT = u'cs_comment'
     TYPE_MESSAGE = u'message'
     TYPE_MENTION = u'mention'
     TYPE_REGISTRATION = u'registration'
     TYPE_PULL_REQUEST = u'pull_request'
     TYPE_PULL_REQUEST_COMMENT = u'pull_request_comment'
 
     notification_id = Column('notification_id', Integer(), nullable=False, primary_key=True)
     subject = Column('subject', Unicode(512), nullable=True)
     body = Column('body', UnicodeText().with_variant(UnicodeText(50000), 'mysql'), nullable=True)
     created_by = Column("created_by", Integer(), ForeignKey('users.user_id'), nullable=True)
     created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
     type_ = Column('type', Unicode(255))
 
     created_by_user = relationship('User')
     notifications_to_users = relationship('UserNotification', lazy='joined',
                                           cascade="all, delete, delete-orphan")
 
     @property
     def recipients(self):
         return [x.user for x in UserNotification.query()\
                 .filter(UserNotification.notification == self)\
                 .order_by(UserNotification.user_id.asc()).all()]
 
     @classmethod
     def create(cls, created_by, subject, body, recipients, type_=None):
         if type_ is None:
             type_ = Notification.TYPE_MESSAGE
 
         notification = cls()
         notification.created_by_user = created_by
         notification.subject = subject
         notification.body = body
         notification.type_ = type_
         notification.created_on = datetime.datetime.now()
 
         for u in recipients:
             assoc = UserNotification()
             assoc.notification = notification
 
             # if created_by is inside recipients mark his notification
             # as read
             if u.user_id == created_by.user_id:
                 assoc.read = True
 
             u.notifications.append(assoc)
         Session().add(notification)
 
         return notification
 
     @property
     def description(self):
         from rhodecode.model.notification import NotificationModel
         return NotificationModel().make_description(self)
 
 
 class UserNotification(Base, BaseModel):
     __tablename__ = 'user_to_notification'
     __table_args__ = (
         UniqueConstraint('user_id', 'notification_id'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
     user_id = Column('user_id', Integer(), ForeignKey('users.user_id'), primary_key=True)
     notification_id = Column("notification_id", Integer(), ForeignKey('notifications.notification_id'), primary_key=True)
     read = Column('read', Boolean, default=False)
     sent_on = Column('sent_on', DateTime(timezone=False), nullable=True, unique=None)
 
     user = relationship('User', lazy="joined")
     notification = relationship('Notification', lazy="joined",
                                 order_by=lambda: Notification.created_on.desc(),)
 
     def mark_as_read(self):
         self.read = True
         Session().add(self)
 
 
 class Gist(Base, BaseModel):
     __tablename__ = 'gists'
     __table_args__ = (
         Index('g_gist_access_id_idx', 'gist_access_id'),
         Index('g_created_on_idx', 'created_on'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
     GIST_PUBLIC = u'public'
     GIST_PRIVATE = u'private'
     DEFAULT_FILENAME = u'gistfile1.txt'
 
     ACL_LEVEL_PUBLIC = u'acl_public'
     ACL_LEVEL_PRIVATE = u'acl_private'
 
     gist_id = Column('gist_id', Integer(), primary_key=True)
     gist_access_id = Column('gist_access_id', Unicode(250))
     gist_description = Column('gist_description', UnicodeText().with_variant(UnicodeText(1024), 'mysql'))
     gist_owner = Column('user_id', Integer(), ForeignKey('users.user_id'), nullable=True)
     gist_expires = Column('gist_expires', Float(53), nullable=False)
     gist_type = Column('gist_type', Unicode(128), nullable=False)
     created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
     modified_at = Column('modified_at', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
     acl_level = Column('acl_level', Unicode(128), nullable=True)
 
     owner = relationship('User')
 
     def __repr__(self):
         return '<Gist:[%s]%s>' % (self.gist_type, self.gist_access_id)
 
     @classmethod
     def get_or_404(cls, id_):
         res = cls.query().filter(cls.gist_access_id == id_).scalar()
         if not res:
             raise HTTPNotFound
         return res
 
     @classmethod
     def get_by_access_id(cls, gist_access_id):
         return cls.query().filter(cls.gist_access_id == gist_access_id).scalar()
 
     def gist_url(self):
         import rhodecode
         alias_url = rhodecode.CONFIG.get('gist_alias_url')
         if alias_url:
             return alias_url.replace('{gistid}', self.gist_access_id)
 
         return url('gist', gist_id=self.gist_access_id, qualified=True)
 
     @classmethod
     def base_path(cls):
         """
         Returns base path when all gists are stored
 
         :param cls:
         """
         from rhodecode.model.gist import GIST_STORE_LOC
         q = Session().query(RhodeCodeUi)\
             .filter(RhodeCodeUi.ui_key == URL_SEP)
         q = q.options(FromCache("sql_cache_short", "repository_repo_path"))
         return os.path.join(q.one().ui_value, GIST_STORE_LOC)
 
     def get_api_data(self):
         """
         Common function for generating gist related data for API
         """
         gist = self
         data = {
             'gist_id': gist.gist_id,
             'type': gist.gist_type,
             'access_id': gist.gist_access_id,
             'description': gist.gist_description,
             'url': gist.gist_url(),
             'expires': gist.gist_expires,
             'created_on': gist.created_on,
             'modified_at': gist.modified_at,
             'content': None,
             'acl_level': gist.acl_level,
         }
         return data
 
     def __json__(self):
         data = dict(
         )
         data.update(self.get_api_data())
         return data
     # SCM functions
 
     def scm_instance(self, **kwargs):
         full_repo_path = os.path.join(self.base_path(), self.gist_access_id)
         return get_vcs_instance(
             repo_path=safe_str(full_repo_path), create=False)
 
 
 class DbMigrateVersion(Base, BaseModel):
     __tablename__ = 'db_migrate_version'
     __table_args__ = (
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
     )
     repository_id = Column('repository_id', String(250), primary_key=True)
     repository_path = Column('repository_path', Text)
     version = Column('version', Integer)
 
 
 class ExternalIdentity(Base, BaseModel):
     __tablename__ = 'external_identities'
     __table_args__ = (
         Index('local_user_id_idx', 'local_user_id'),
         Index('external_id_idx', 'external_id'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8'})
 
     external_id = Column('external_id', Unicode(255), default=u'',
                          primary_key=True)
     external_username = Column('external_username', Unicode(1024), default=u'')
     local_user_id = Column('local_user_id', Integer(),
                            ForeignKey('users.user_id'), primary_key=True)
     provider_name = Column('provider_name', Unicode(255), default=u'',
                            primary_key=True)
     access_token = Column('access_token', String(1024), default=u'')
     alt_token = Column('alt_token', String(1024), default=u'')
     token_secret = Column('token_secret', String(1024), default=u'')
 
     @classmethod
     def by_external_id_and_provider(cls, external_id, provider_name,
                                     local_user_id=None):
         """
         Returns ExternalIdentity instance based on search params
 
         :param external_id:
         :param provider_name:
         :return: ExternalIdentity
         """
         query = cls.query()
         query = query.filter(cls.external_id == external_id)
         query = query.filter(cls.provider_name == provider_name)
         if local_user_id:
             query = query.filter(cls.local_user_id == local_user_id)
         return query.first()
 
     @classmethod
     def user_by_external_id_and_provider(cls, external_id, provider_name):
         """
         Returns User instance based on search params
 
         :param external_id:
         :param provider_name:
         :return: User
         """
         query = User.query()
         query = query.filter(cls.external_id == external_id)
         query = query.filter(cls.provider_name == provider_name)
         query = query.filter(User.user_id == cls.local_user_id)
         return query.first()
 
     @classmethod
     def by_local_user_id(cls, local_user_id):
         """
         Returns all tokens for user
 
         :param local_user_id:
         :return: ExternalIdentity
         """
         query = cls.query()
         query = query.filter(cls.local_user_id == local_user_id)
         return query
 
 
 class Integration(Base, BaseModel):
     __tablename__ = 'integrations'
     __table_args__ = (
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
 
     integration_id = Column('integration_id', Integer(), primary_key=True)
     integration_type = Column('integration_type', String(255))
     enabled = Column('enabled', Boolean(), nullable=False)
     name = Column('name', String(255), nullable=False)
-
     settings = Column(
         'settings_json', MutationObj.as_mutable(
             JsonType(dialect_map=dict(mysql=UnicodeText(16384)))))
     repo_id = Column(
         'repo_id', Integer(), ForeignKey('repositories.repo_id'),
         nullable=True, unique=None, default=None)
     repo = relationship('Repository', lazy='joined')
 
     repo_group_id = Column(
         'repo_group_id', Integer(), ForeignKey('groups.group_id'),
         nullable=True, unique=None, default=None)
     repo_group = relationship('RepoGroup', lazy='joined')
 
     def __repr__(self):
         if self.repo:
             scope = 'repo=%r' % self.repo
         elif self.repo_group:
             scope = 'repo_group=%r' % self.repo_group
         else:
             scope = 'global'
 
         return '<Integration(%r, %r)>' % (self.integration_type, scope)