auth-tokens: extended views to allowed override of adding scope in EE edition.

rhodecode/apps/my_account/views.py

@@ -1,111 +1,120 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2016-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import logging
 
 from pyramid.httpexceptions import HTTPFound
 from pyramid.view import view_config
 
 from rhodecode.apps._base import BaseAppView
 from rhodecode.lib.auth import LoginRequired, NotAnonymous, CSRFRequired
 from rhodecode.lib.utils2 import safe_int
 from rhodecode.lib import helpers as h
 from rhodecode.model.auth_token import AuthTokenModel
 from rhodecode.model.meta import Session
 
 log = logging.getLogger(__name__)
 
 
 class MyAccountView(BaseAppView):
+    ALLOW_SCOPED_TOKENS = False
+    """
+    This view has alternative version inside EE, if modified please take a look
+    in there as well.
+    """
 
     def load_default_context(self):
         c = self._get_local_tmpl_context()
 
         c.auth_user = self.request.user
         c.user = c.auth_user.get_instance()
-
+        c.allow_scoped_tokens = self.ALLOW_SCOPED_TOKENS
         self._register_global_c(c)
         return c
 
     @LoginRequired()
     @NotAnonymous()
     @view_config(
         route_name='my_account_auth_tokens', request_method='GET',
         renderer='rhodecode:templates/admin/my_account/my_account.mako')
     def my_account_auth_tokens(self):
         _ = self.request.translate
 
         c = self.load_default_context()
         c.active = 'auth_tokens'
 
-        show_expired = True
-
         c.lifetime_values = [
             (str(-1), _('forever')),
             (str(5), _('5 minutes')),
             (str(60), _('1 hour')),
             (str(60 * 24), _('1 day')),
             (str(60 * 24 * 30), _('1 month')),
         ]
         c.lifetime_options = [(c.lifetime_values, _("Lifetime"))]
         c.role_values = [
             (x, AuthTokenModel.cls._get_role_name(x))
             for x in AuthTokenModel.cls.ROLES]
         c.role_options = [(c.role_values, _("Role"))]
         c.user_auth_tokens = AuthTokenModel().get_auth_tokens(
-            c.user.user_id, show_expired=show_expired)
+            c.user.user_id, show_expired=True)
         return self._get_template_context(c)
 
+    def maybe_attach_token_scope(self, token):
+        # implemented in EE edition
+        pass
+
     @LoginRequired()
     @NotAnonymous()
     @CSRFRequired()
     @view_config(
         route_name='my_account_auth_tokens_add', request_method='POST')
     def my_account_auth_tokens_add(self):
         _ = self.request.translate
         c = self.load_default_context()
 
         lifetime = safe_int(self.request.POST.get('lifetime'), -1)
         description = self.request.POST.get('description')
         role = self.request.POST.get('role')
 
-        AuthTokenModel().create(c.user.user_id, description, lifetime, role)
+        token = AuthTokenModel().create(
+            c.user.user_id, description, lifetime, role)
+        self.maybe_attach_token_scope(token)
         Session().commit()
+
         h.flash(_("Auth token successfully created"), category='success')
-
         return HTTPFound(h.route_path('my_account_auth_tokens'))
 
     @LoginRequired()
     @NotAnonymous()
     @CSRFRequired()
     @view_config(
         route_name='my_account_auth_tokens_delete', request_method='POST')
     def my_account_auth_tokens_delete(self):
         _ = self.request.translate
         c = self.load_default_context()
 
         del_auth_token = self.request.POST.get('del_auth_token')
 
         if del_auth_token:
             AuthTokenModel().delete(del_auth_token, c.user.user_id)
             Session().commit()
             h.flash(_("Auth token successfully deleted"), category='success')
 
         return HTTPFound(h.route_path('my_account_auth_tokens'))

rhodecode/templates/admin/my_account/my_account_auth_tokens.mako

@@ -1,95 +1,158 b''
 <div class="panel panel-default">
   <div class="panel-heading">
     <h3 class="panel-title">${_('Authentication Tokens')}</h3>
   </div>
   <div class="panel-body">
       <p>
          ${_('Each token can have a role. Token with a role can be used only in given context, '
          'e.g. VCS tokens can be used together with the authtoken auth plugin for git/hg/svn operations only.')}
-          ${_('Additionally scope for VCS type token can narrow the use to chosen repository.')}
       </p>
       <table class="rctable auth_tokens">
         %if c.user_auth_tokens:
             <tr>
                 <th>${_('Token')}</th>
                 <th>${_('Scope')}</th>
                 <th>${_('Description')}</th>
                 <th>${_('Role')}</th>
                 <th>${_('Expiration')}</th>
                 <th>${_('Action')}</th>
             </tr>
             %for auth_token in c.user_auth_tokens:
               <tr class="${'expired' if auth_token.expired else ''}">
                 <td class="truncate-wrap td-authtoken">
                     <div class="user_auth_tokens truncate autoexpand">
                     <code>${auth_token.api_key}</code>
                     </div>
                 </td>
                 <td class="td">${auth_token.scope_humanized}</td>
                 <td class="td-wrap">${auth_token.description}</td>
                 <td class="td-tags">
                     <span class="tag disabled">${auth_token.role_humanized}</span>
                 </td>
                 <td class="td-exp">
                      %if auth_token.expires == -1:
                       ${_('never')}
                      %else:
                         %if auth_token.expired:
                             <span style="text-decoration: line-through">${h.age_component(h.time_to_utcdatetime(auth_token.expires))}</span>
                         %else:
                             ${h.age_component(h.time_to_utcdatetime(auth_token.expires))}
                         %endif
                      %endif
                 </td>
                 <td class="td-action">
                     ${h.secure_form(h.route_path('my_account_auth_tokens_delete'), method='post')}
                         ${h.hidden('del_auth_token',auth_token.api_key)}
                         <button class="btn btn-link btn-danger" type="submit"
                                 onclick="return confirm('${_('Confirm to remove this auth token: %s') % auth_token.api_key}');">
                             ${_('Delete')}
                         </button>
                     ${h.end_form()}
                 </td>
               </tr>
             %endfor
         %else:
         <tr><td><div class="ip">${_('No additional auth token specified')}</div></td></tr>
         %endif
       </table>
 
         <div class="user_auth_tokens">
             ${h.secure_form(h.route_path('my_account_auth_tokens_add'), method='post')}
             <div class="form form-vertical">
                 <!-- fields -->
                 <div class="fields">
                      <div class="field">
                         <div class="label">
                             <label for="new_email">${_('New authentication token')}:</label>
                         </div>
                         <div class="input">
                             ${h.text('description', placeholder=_('Description'))}
                             ${h.select('lifetime', '', c.lifetime_options)}
                             ${h.select('role', '', c.role_options)}
+
+                            % if c.allow_scoped_tokens:
+                                ${h.hidden('scope_repo_id')}
+                            % else:
+                                ${h.select('scope_repo_id_disabled', '', ['Scopes available in EE edition'], disabled='disabled')}
+                            % endif
                         </div>
+                         <p class="help-block">
+                             ${_('Repository scope works only with tokens with VCS type.')}
+                         </p>
                      </div>
                     <div class="buttons">
                       ${h.submit('save',_('Add'),class_="btn")}
                       ${h.reset('reset',_('Reset'),class_="btn")}
                     </div>
                 </div>
             </div>
             ${h.end_form()}
         </div>
     </div>
 </div>
     <script>
         $(document).ready(function(){
+
             var select2Options = {
                 'containerCssClass': "drop-menu",
                 'dropdownCssClass': "drop-menu-dropdown",
                 'dropdownAutoWidth': true
             };
             $("#lifetime").select2(select2Options);
             $("#role").select2(select2Options);
+
+var repoFilter = function(data) {
+    var results = [];
+
+    if (!data.results[0]) {
+        return data
+    }
+
+    $.each(data.results[0].children, function() {
+        // replace name to ID for submision
+        this.id = this.obj.repo_id;
+        results.push(this);
+    });
+
+    data.results[0].children = results;
+    return data;
+};
+
+$("#scope_repo_id_disabled").select2(select2Options);
+
+$("#scope_repo_id").select2({
+    cachedDataSource: {},
+    minimumInputLength: 2,
+    placeholder: "${_('repository scope')}",
+    dropdownAutoWidth: true,
+    containerCssClass: "drop-menu",
+    dropdownCssClass: "drop-menu-dropdown",
+    formatResult: formatResult,
+    query: $.debounce(250, function(query){
+        self = this;
+        var cacheKey = query.term;
+        var cachedData = self.cachedDataSource[cacheKey];
+
+        if (cachedData) {
+            query.callback({results: cachedData.results});
+        } else {
+            $.ajax({
+                url: "${h.url('repo_list_data')}",
+                data: {'query': query.term},
+                dataType: 'json',
+                type: 'GET',
+                success: function(data) {
+                    data = repoFilter(data);
+                    self.cachedDataSource[cacheKey] = data;
+                    query.callback({results: data.results});
+                },
+                error: function(data, textStatus, errorThrown) {
+                    alert("Error while fetching entries.\nError code {0} ({1}).".format(data.status, data.statusText));
+                }
+            })
+        }
+    })
+});
+
         });
     </script>