auth-lib: fixed and tested perms origin dicts.

- since python3 the pickle serialization changed
- perm origin dicts needed change to be serializable

rhodecode/lib/auth.py

@@ -367,12 +367,18 b' class PermOriginDict(dict):'
         self.perm_origin_stack = collections.OrderedDict()
 
     def __setitem__(self, key, perm_origin_obj_id):
+        # set (most likely via pickle) key:val pair without tuple
+        if not isinstance(perm_origin_obj_id, tuple):
+            perm = perm_origin_obj_id
+            dict.__setitem__(self, key, perm)
+        else:
+            # unpack if we create a key from tuple
         (perm, origin, obj_id) = perm_origin_obj_id
         self.perm_origin_stack.setdefault(key, []).append((perm, origin, obj_id))
         dict.__setitem__(self, key, perm)
 
 
-class BranchPermOriginDict(PermOriginDict):
+class BranchPermOriginDict(dict):
     """
     Dedicated branch permissions dict, with tracking of patterns and origins.
 
@@ -386,18 +392,24 b' class BranchPermOriginDict(PermOriginDic'
     >>> perms.perm_origin_stack
     {'resource': {'*pattern': [('read', 'default'), ('write', 'admin')]}}
     """
+    def __init__(self, *args, **kw):
+        dict.__init__(self, *args, **kw)
+        self.perm_origin_stack = collections.OrderedDict()
+
     def __setitem__(self, key, pattern_perm_origin):
-        (pattern, perm, origin) = pattern_perm_origin
-
+        # set (most likely via pickle) key:val pair without tuple
+        if not isinstance(pattern_perm_origin, tuple):
+            pattern_perm = pattern_perm_origin
+            dict.__setitem__(self, key, pattern_perm)
+
+        else:
+            (pattern_perm, origin) = pattern_perm_origin
+            # we're passing in the dict, so we save the the stack
+            for pattern, perm in pattern_perm.items():
         self.perm_origin_stack.setdefault(key, {}) \
             .setdefault(pattern, []).append((perm, origin))
 
-        if key in self:
-            self[key].__setitem__(pattern, perm)
-        else:
-            patterns = collections.OrderedDict()
-            patterns[pattern] = perm
-            dict.__setitem__(self, key, patterns)
+            dict.__setitem__(self, key, pattern_perm)
 
 
 class PermissionCalculator(object):
@@ -643,7 +655,7 b' class PermissionCalculator(object):'
 
             # NOTE(marcink): register all pattern/perm instances in this
             # special dict that aggregates entries
-            self.permissions_repository_branches[r_k] = pattern, p, o
+            self.permissions_repository_branches[r_k] = {pattern: p}, o
 
     def _calculate_default_permissions_repository_groups(self, user_inherit_object_permissions):
         for perm in self.default_repo_groups_perms:
@@ -827,7 +839,7 b' class PermissionCalculator(object):'
                 cur_perm = self.permissions_repository_branches[r_k][pattern]
                 p = self._choose_permission(p, cur_perm)
 
-            self.permissions_repository_branches[r_k] = pattern, p, o
+            self.permissions_repository_branches[r_k] = {pattern: p}, o
 
         # user explicit branch permissions for repositories, overrides
         # any specified by the group permission
@@ -850,7 +862,7 b' class PermissionCalculator(object):'
 
             # NOTE(marcink): register all pattern/perm instances in this
             # special dict that aggregates entries
-            self.permissions_repository_branches[r_k] = pattern, p, o
+            self.permissions_repository_branches[r_k] = {pattern: p}, o
 
     def _calculate_repository_group_permissions(self):
         """

rhodecode/tests/lib/test_auth.py

@@ -33,6 +33,11 b' from rhodecode.model.user import UserMod'
 from rhodecode.model.user_group import UserGroupModel
 
 
+def repickle(obj):
+    import pickle
+    return pickle.loads(pickle.dumps(obj, protocol=pickle.HIGHEST_PROTOCOL))
+
+
 def test_perm_origin_dict():
     pod = auth.PermOriginDict()
     pod['thing'] = 'read', 'default', 1
@@ -59,8 +64,90 b' def test_perm_origin_dict():'
         'other': [('write', 'default', 8), ('none', 'override', 8)],
         'thing': [('read', 'default', 1), ('write', 'admin', 1)]}
 
+    # we can still save regular key
+    pod['thing'] = 'read'
     with pytest.raises(ValueError):
+        pod['thing'] = 'read', 'missing-3td-key'
+
+
+def test_perm_origin_dict_serialization():
+    pod = auth.PermOriginDict()
+    pod['thing'] = 'read', 'default', 1
+
+    assert pod['thing'] == 'read'
+    pod = repickle(pod)
+    assert pod['thing'] == 'read'
+
+    assert pod.perm_origin_stack == {
+        'thing': [('read', 'default', 1)]}
+
+    pod['thing'] = 'write', 'admin', 1
+    assert pod['thing'] == 'write'
+    assert pod['thing'] == 'write'
+    assert pod.perm_origin_stack == {
+        'thing': [('read', 'default', 1), ('write', 'admin', 1)]}
+
+    pod = repickle(pod)
+    assert pod['thing'] == 'write'
+    assert pod['thing'] == 'write'
+    assert pod.perm_origin_stack == {
+        'thing': [('read', 'default', 1), ('write', 'admin', 1)]}
+
+    pod['other'] = 'write', 'default', 8
+
+    assert pod.perm_origin_stack == {
+        'other': [('write', 'default', 8)],
+        'thing': [('read', 'default', 1), ('write', 'admin', 1)]}
+    pod = repickle(pod)
+    assert pod.perm_origin_stack == {
+        'other': [('write', 'default', 8)],
+        'thing': [('read', 'default', 1), ('write', 'admin', 1)]}
+
+    pod['other'] = 'none', 'override', 8
+
+    assert pod.perm_origin_stack == {
+        'other': [('write', 'default', 8), ('none', 'override', 8)],
+        'thing': [('read', 'default', 1), ('write', 'admin', 1)]}
+    pod = repickle(pod)
+    assert pod.perm_origin_stack == {
+        'other': [('write', 'default', 8), ('none', 'override', 8)],
+        'thing': [('read', 'default', 1), ('write', 'admin', 1)]}
+
         pod['thing'] = 'read'
+    with pytest.raises(ValueError):
+        pod['thing'] = 'read', 'missing-3td-key'
+
+
+def test_branch_perm_origin_dict():
+    pod = auth.BranchPermOriginDict()
+    pod['resource'] = {'*pattern': 'read'}, 'default'
+    assert pod['resource'] == {'*pattern': 'read'}
+    assert pod.perm_origin_stack == {'resource': {'*pattern': [('read', 'default')]}}
+
+    # 2nd call
+    pod['resource'] = {'*pattern': 'write'}, 'admin'
+    assert pod['resource'] == {'*pattern': 'write'}
+    assert pod.perm_origin_stack == {'resource': {'*pattern': [('read', 'default'), ('write', 'admin')]}}
+
+
+def test_branch_perm_origin_dict_serialization():
+    pod = auth.BranchPermOriginDict()
+    pod['resource'] = {'*pattern': 'read'}, 'default'
+    assert pod['resource'] == {'*pattern': 'read'}
+    assert pod.perm_origin_stack == {'resource': {'*pattern': [('read', 'default')]}}
+
+    pod = repickle(pod)
+    assert pod['resource'] == {'*pattern': 'read'}
+    assert pod.perm_origin_stack == {'resource': {'*pattern': [('read', 'default')]}}
+
+    # 2nd call
+    pod['resource'] = {'*pattern': 'write'}, 'admin'
+    assert pod['resource'] == {'*pattern': 'write'}
+    assert pod.perm_origin_stack == {'resource': {'*pattern': [('read', 'default'), ('write', 'admin')]}}
+
+    pod = repickle(pod)
+    assert pod['resource'] == {'*pattern': 'write'}
+    assert pod.perm_origin_stack == {'resource': {'*pattern': [('read', 'default'), ('write', 'admin')]}}
 
 
 def test_cached_perms_data(user_regular, backend_random):