global-permissions: ported controller to pyramid view.

- fixed some other tests cases to rely on test routing

rhodecode/apps/admin/views/permissions.py

@@ -0,0 +1,310 b''
+# -*- coding: utf-8 -*-
+
+# Copyright (C) 2016-2017  RhodeCode GmbH
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License, version 3
+# (only), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+# This program is dual-licensed. If you wish to learn more about the
+# RhodeCode Enterprise Edition, including its added features, Support services,
+# and proprietary license terms, please see https://rhodecode.com/licenses/
+
+import logging
+import formencode
+
+from pyramid.view import view_config
+from pyramid.httpexceptions import HTTPFound
+from pyramid.renderers import render
+from pyramid.response import Response
+
+from rhodecode.apps._base import BaseAppView
+
+from rhodecode.lib import helpers as h
+from rhodecode.lib.auth import (
+    LoginRequired, HasPermissionAllDecorator, CSRFRequired)
+from rhodecode.model.db import User, UserIpMap
+from rhodecode.model.forms import (
+    ApplicationPermissionsForm, ObjectPermissionsForm, UserPermissionsForm)
+from rhodecode.model.meta import Session
+from rhodecode.model.permission import PermissionModel
+from rhodecode.model.settings import SettingsModel
+
+
+log = logging.getLogger(__name__)
+
+
+class AdminPermissionsView(BaseAppView):
+    def load_default_context(self):
+        c = self._get_local_tmpl_context()
+
+        self._register_global_c(c)
+        PermissionModel().set_global_permission_choices(
+            c, gettext_translator=self.request.translate)
+        return c
+
+    @LoginRequired()
+    @HasPermissionAllDecorator('hg.admin')
+    @view_config(
+        route_name='admin_permissions_application', request_method='GET',
+        renderer='rhodecode:templates/admin/permissions/permissions.mako')
+    def permissions_application(self):
+        c = self.load_default_context()
+        c.active = 'application'
+
+        c.user = User.get_default_user(refresh=True)
+
+        app_settings = SettingsModel().get_all_settings()
+        defaults = {
+            'anonymous': c.user.active,
+            'default_register_message': app_settings.get(
+                'rhodecode_register_message')
+        }
+        defaults.update(c.user.get_default_perms())
+
+        data = render('rhodecode:templates/admin/permissions/permissions.mako',
+                      self._get_template_context(c), self.request)
+        html = formencode.htmlfill.render(
+            data,
+            defaults=defaults,
+            encoding="UTF-8",
+            force_defaults=False
+        )
+        return Response(html)
+
+    @LoginRequired()
+    @HasPermissionAllDecorator('hg.admin')
+    @CSRFRequired()
+    @view_config(
+        route_name='admin_permissions_application_update', request_method='POST',
+        renderer='rhodecode:templates/admin/permissions/permissions.mako')
+    def permissions_application_update(self):
+        _ = self.request.translate
+        c = self.load_default_context()
+        c.active = 'application'
+
+        _form = ApplicationPermissionsForm(
+            [x[0] for x in c.register_choices],
+            [x[0] for x in c.password_reset_choices],
+            [x[0] for x in c.extern_activate_choices])()
+
+        try:
+            form_result = _form.to_python(dict(self.request.POST))
+            form_result.update({'perm_user_name': User.DEFAULT_USER})
+            PermissionModel().update_application_permissions(form_result)
+
+            settings = [
+                ('register_message', 'default_register_message'),
+            ]
+            for setting, form_key in settings:
+                sett = SettingsModel().create_or_update_setting(
+                    setting, form_result[form_key])
+                Session().add(sett)
+
+            Session().commit()
+            h.flash(_('Application permissions updated successfully'),
+                    category='success')
+
+        except formencode.Invalid as errors:
+            defaults = errors.value
+
+            data = render(
+                'rhodecode:templates/admin/permissions/permissions.mako',
+                self._get_template_context(c), self.request)
+            html = formencode.htmlfill.render(
+                data,
+                defaults=defaults,
+                errors=errors.error_dict or {},
+                prefix_error=False,
+                encoding="UTF-8",
+                force_defaults=False
+            )
+            return Response(html)
+
+        except Exception:
+            log.exception("Exception during update of permissions")
+            h.flash(_('Error occurred during update of permissions'),
+                    category='error')
+
+        raise HTTPFound(h.route_path('admin_permissions_application'))
+
+    @LoginRequired()
+    @HasPermissionAllDecorator('hg.admin')
+    @view_config(
+        route_name='admin_permissions_object', request_method='GET',
+        renderer='rhodecode:templates/admin/permissions/permissions.mako')
+    def permissions_objects(self):
+        c = self.load_default_context()
+        c.active = 'objects'
+
+        c.user = User.get_default_user(refresh=True)
+        defaults = {}
+        defaults.update(c.user.get_default_perms())
+
+        data = render(
+            'rhodecode:templates/admin/permissions/permissions.mako',
+            self._get_template_context(c), self.request)
+        html = formencode.htmlfill.render(
+            data,
+            defaults=defaults,
+            encoding="UTF-8",
+            force_defaults=False
+        )
+        return Response(html)
+
+    @LoginRequired()
+    @HasPermissionAllDecorator('hg.admin')
+    @CSRFRequired()
+    @view_config(
+        route_name='admin_permissions_object_update', request_method='POST',
+        renderer='rhodecode:templates/admin/permissions/permissions.mako')
+    def permissions_objects_update(self):
+        _ = self.request.translate
+        c = self.load_default_context()
+        c.active = 'objects'
+
+        _form = ObjectPermissionsForm(
+            [x[0] for x in c.repo_perms_choices],
+            [x[0] for x in c.group_perms_choices],
+            [x[0] for x in c.user_group_perms_choices])()
+
+        try:
+            form_result = _form.to_python(dict(self.request.POST))
+            form_result.update({'perm_user_name': User.DEFAULT_USER})
+            PermissionModel().update_object_permissions(form_result)
+
+            Session().commit()
+            h.flash(_('Object permissions updated successfully'),
+                    category='success')
+
+        except formencode.Invalid as errors:
+            defaults = errors.value
+
+            data = render(
+                'rhodecode:templates/admin/permissions/permissions.mako',
+                self._get_template_context(c), self.request)
+            html = formencode.htmlfill.render(
+                data,
+                defaults=defaults,
+                errors=errors.error_dict or {},
+                prefix_error=False,
+                encoding="UTF-8",
+                force_defaults=False
+            )
+            return Response(html)
+        except Exception:
+            log.exception("Exception during update of permissions")
+            h.flash(_('Error occurred during update of permissions'),
+                    category='error')
+
+        raise HTTPFound(h.route_path('admin_permissions_object'))
+
+    @LoginRequired()
+    @HasPermissionAllDecorator('hg.admin')
+    @view_config(
+        route_name='admin_permissions_global', request_method='GET',
+        renderer='rhodecode:templates/admin/permissions/permissions.mako')
+    def permissions_global(self):
+        c = self.load_default_context()
+        c.active = 'global'
+
+        c.user = User.get_default_user(refresh=True)
+        defaults = {}
+        defaults.update(c.user.get_default_perms())
+
+        data = render(
+            'rhodecode:templates/admin/permissions/permissions.mako',
+            self._get_template_context(c), self.request)
+        html = formencode.htmlfill.render(
+            data,
+            defaults=defaults,
+            encoding="UTF-8",
+            force_defaults=False
+        )
+        return Response(html)
+
+    @LoginRequired()
+    @HasPermissionAllDecorator('hg.admin')
+    @CSRFRequired()
+    @view_config(
+        route_name='admin_permissions_global_update', request_method='POST',
+        renderer='rhodecode:templates/admin/permissions/permissions.mako')
+    def permissions_global_update(self):
+        _ = self.request.translate
+        c = self.load_default_context()
+        c.active = 'global'
+
+        _form = UserPermissionsForm(
+            [x[0] for x in c.repo_create_choices],
+            [x[0] for x in c.repo_create_on_write_choices],
+            [x[0] for x in c.repo_group_create_choices],
+            [x[0] for x in c.user_group_create_choices],
+            [x[0] for x in c.fork_choices],
+            [x[0] for x in c.inherit_default_permission_choices])()
+
+        try:
+            form_result = _form.to_python(dict(self.request.POST))
+            form_result.update({'perm_user_name': User.DEFAULT_USER})
+            PermissionModel().update_user_permissions(form_result)
+
+            Session().commit()
+            h.flash(_('Global permissions updated successfully'),
+                    category='success')
+
+        except formencode.Invalid as errors:
+            defaults = errors.value
+
+            data = render(
+                'rhodecode:templates/admin/permissions/permissions.mako',
+                self._get_template_context(c), self.request)
+            html = formencode.htmlfill.render(
+                data,
+                defaults=defaults,
+                errors=errors.error_dict or {},
+                prefix_error=False,
+                encoding="UTF-8",
+                force_defaults=False
+            )
+            return Response(html)
+        except Exception:
+            log.exception("Exception during update of permissions")
+            h.flash(_('Error occurred during update of permissions'),
+                    category='error')
+
+        raise HTTPFound(h.route_path('admin_permissions_global'))
+
+    @LoginRequired()
+    @HasPermissionAllDecorator('hg.admin')
+    @view_config(
+        route_name='admin_permissions_ips', request_method='GET',
+        renderer='rhodecode:templates/admin/permissions/permissions.mako')
+    def permissions_ips(self):
+        c = self.load_default_context()
+        c.active = 'ips'
+
+        c.user = User.get_default_user(refresh=True)
+        c.user_ip_map = (
+            UserIpMap.query().filter(UserIpMap.user == c.user).all())
+
+        return self._get_template_context(c)
+
+    @LoginRequired()
+    @HasPermissionAllDecorator('hg.admin')
+    @view_config(
+        route_name='admin_permissions_overview', request_method='GET',
+        renderer='rhodecode:templates/admin/permissions/permissions.mako')
+    def permissions_overview(self):
+        c = self.load_default_context()
+        c.active = 'perms'
+
+        c.user = User.get_default_user(refresh=True)
+        c.perm_user = c.user.AuthUser
+        return self._get_template_context(c)

rhodecode/apps/admin/__init__.py

@@ -1,149 +1,175 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2016-2017  RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 
 from rhodecode.apps.admin.navigation import NavigationRegistry
 from rhodecode.config.routing import ADMIN_PREFIX
 from rhodecode.lib.utils2 import str2bool
 
 
 def admin_routes(config):
     """
     Admin prefixed routes
     """
 
     config.add_route(
         name='admin_audit_logs',
         pattern='/audit_logs')
 
     config.add_route(
         name='pull_requests_global_0',  # backward compat
         pattern='/pull_requests/{pull_request_id:[0-9]+}')
     config.add_route(
         name='pull_requests_global_1',  # backward compat
         pattern='/pull-requests/{pull_request_id:[0-9]+}')
     config.add_route(
         name='pull_requests_global',
         pattern='/pull-request/{pull_request_id:[0-9]+}')
 
     config.add_route(
         name='admin_settings_open_source',
         pattern='/settings/open_source')
     config.add_route(
         name='admin_settings_vcs_svn_generate_cfg',
         pattern='/settings/vcs/svn_generate_cfg')
 
     config.add_route(
         name='admin_settings_system',
         pattern='/settings/system')
     config.add_route(
         name='admin_settings_system_update',
         pattern='/settings/system/updates')
 
     config.add_route(
         name='admin_settings_sessions',
         pattern='/settings/sessions')
     config.add_route(
         name='admin_settings_sessions_cleanup',
         pattern='/settings/sessions/cleanup')
 
     config.add_route(
         name='admin_settings_process_management',
         pattern='/settings/process_management')
     config.add_route(
         name='admin_settings_process_management_signal',
         pattern='/settings/process_management/signal')
 
     # global permissions
+
+    config.add_route(
+        name='admin_permissions_application',
+        pattern='/permissions/application')
+    config.add_route(
+        name='admin_permissions_application_update',
+        pattern='/permissions/application/update')
+
+    config.add_route(
+        name='admin_permissions_global',
+        pattern='/permissions/global')
+    config.add_route(
+        name='admin_permissions_global_update',
+        pattern='/permissions/global/update')
+
+    config.add_route(
+        name='admin_permissions_object',
+        pattern='/permissions/object')
+    config.add_route(
+        name='admin_permissions_object_update',
+        pattern='/permissions/object/update')
+
     config.add_route(
         name='admin_permissions_ips',
         pattern='/permissions/ips')
 
+    config.add_route(
+        name='admin_permissions_overview',
+        pattern='/permissions/overview')
+
     # users admin
     config.add_route(
         name='users',
         pattern='/users')
 
     config.add_route(
         name='users_data',
         pattern='/users_data')
 
     # user auth tokens
     config.add_route(
         name='edit_user_auth_tokens',
         pattern='/users/{user_id:\d+}/edit/auth_tokens')
     config.add_route(
         name='edit_user_auth_tokens_add',
         pattern='/users/{user_id:\d+}/edit/auth_tokens/new')
     config.add_route(
         name='edit_user_auth_tokens_delete',
         pattern='/users/{user_id:\d+}/edit/auth_tokens/delete')
 
     # user emails
     config.add_route(
         name='edit_user_emails',
         pattern='/users/{user_id:\d+}/edit/emails')
     config.add_route(
         name='edit_user_emails_add',
         pattern='/users/{user_id:\d+}/edit/emails/new')
     config.add_route(
         name='edit_user_emails_delete',
         pattern='/users/{user_id:\d+}/edit/emails/delete')
 
     # user IPs
     config.add_route(
         name='edit_user_ips',
         pattern='/users/{user_id:\d+}/edit/ips')
     config.add_route(
         name='edit_user_ips_add',
         pattern='/users/{user_id:\d+}/edit/ips/new')
     config.add_route(
         name='edit_user_ips_delete',
         pattern='/users/{user_id:\d+}/edit/ips/delete')
 
     # user groups management
     config.add_route(
         name='edit_user_groups_management',
         pattern='/users/{user_id:\d+}/edit/groups_management')
 
     config.add_route(
         name='edit_user_groups_management_updates',
         pattern='/users/{user_id:\d+}/edit/edit_user_groups_management/updates')
 
     # user audit logs
     config.add_route(
         name='edit_user_audit_logs',
         pattern='/users/{user_id:\d+}/edit/audit')
 
 
 def includeme(config):
     settings = config.get_settings()
 
     # Create admin navigation registry and add it to the pyramid registry.
     labs_active = str2bool(settings.get('labs_settings_active', False))
     navigation_registry = NavigationRegistry(labs_active=labs_active)
     config.registry.registerUtility(navigation_registry)
 
     # main admin routes
     config.add_route(name='admin_home', pattern=ADMIN_PREFIX)
     config.include(admin_routes, route_prefix=ADMIN_PREFIX)
 
     # Scan module for configuration decorators.
     config.scan()

rhodecode/apps/admin/tests/test_admin_permissions.py

@@ -1,229 +1,250 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import pytest
 from rhodecode.model.db import User, UserIpMap
 from rhodecode.model.permission import PermissionModel
 from rhodecode.tests import (
-    TestController, url, clear_all_caches, assert_session_flash)
+    TestController, clear_all_caches, assert_session_flash)
 
 
 def route_path(name, params=None, **kwargs):
     import urllib
     from rhodecode.apps._base import ADMIN_PREFIX
 
     base_url = {
         'edit_user_ips':
             ADMIN_PREFIX + '/users/{user_id}/edit/ips',
         'edit_user_ips_add':
             ADMIN_PREFIX + '/users/{user_id}/edit/ips/new',
         'edit_user_ips_delete':
             ADMIN_PREFIX + '/users/{user_id}/edit/ips/delete',
+
+        'admin_permissions_application':
+            ADMIN_PREFIX + '/permissions/application',
+        'admin_permissions_application_update':
+            ADMIN_PREFIX + '/permissions/application/update',
+
+        'admin_permissions_global':
+            ADMIN_PREFIX + '/permissions/global',
+        'admin_permissions_global_update':
+            ADMIN_PREFIX + '/permissions/global/update',
+
+        'admin_permissions_object':
+            ADMIN_PREFIX + '/permissions/object',
+        'admin_permissions_object_update':
+            ADMIN_PREFIX + '/permissions/object/update',
+
+        'admin_permissions_ips':
+            ADMIN_PREFIX + '/permissions/ips',
+        'admin_permissions_overview':
+            ADMIN_PREFIX + '/permissions/overview'
+
     }[name].format(**kwargs)
 
     if params:
         base_url = '{}?{}'.format(base_url, urllib.urlencode(params))
     return base_url
 
 
 class TestAdminPermissionsController(TestController):
 
     @pytest.fixture(scope='class', autouse=True)
     def prepare(self, request):
         # cleanup and reset to default permissions after
         @request.addfinalizer
         def cleanup():
             PermissionModel().create_default_user_permissions(
                 User.get_default_user(), force=True)
 
     def test_index_application(self):
         self.log_user()
-        self.app.get(url('admin_permissions_application'))
+        self.app.get(route_path('admin_permissions_application'))
 
     @pytest.mark.parametrize(
         'anonymous, default_register, default_register_message, default_password_reset,' 
         'default_extern_activate, expect_error, expect_form_error', [
             (True, 'hg.register.none', '', 'hg.password_reset.enabled', 'hg.extern_activate.manual',
              False, False),
             (True, 'hg.register.manual_activate', '', 'hg.password_reset.enabled', 'hg.extern_activate.auto',
              False, False),
             (True, 'hg.register.auto_activate', '', 'hg.password_reset.enabled', 'hg.extern_activate.manual',
              False, False),
             (True, 'hg.register.auto_activate', '', 'hg.password_reset.enabled', 'hg.extern_activate.manual',
              False, False),
             (True, 'hg.register.XXX', '', 'hg.password_reset.enabled', 'hg.extern_activate.manual',
              False, True),
             (True, '', '', 'hg.password_reset.enabled', '', True, False),
         ])
     def test_update_application_permissions(
             self, anonymous, default_register, default_register_message, default_password_reset,
             default_extern_activate, expect_error, expect_form_error):
 
         self.log_user()
 
         # TODO: anonymous access set here to False, breaks some other tests
         params = {
             'csrf_token': self.csrf_token,
             'anonymous': anonymous,
             'default_register': default_register,
             'default_register_message': default_register_message,
             'default_password_reset': default_password_reset,
             'default_extern_activate': default_extern_activate,
         }
-        response = self.app.post(url('admin_permissions_application'),
+        response = self.app.post(route_path('admin_permissions_application_update'),
                                  params=params)
         if expect_form_error:
             assert response.status_int == 200
             response.mustcontain('Value must be one of')
         else:
             if expect_error:
                 msg = 'Error occurred during update of permissions'
             else:
                 msg = 'Application permissions updated successfully'
             assert_session_flash(response, msg)
 
     def test_index_object(self):
         self.log_user()
-        self.app.get(url('admin_permissions_object'))
+        self.app.get(route_path('admin_permissions_object'))
 
     @pytest.mark.parametrize(
         'repo, repo_group, user_group, expect_error, expect_form_error', [
             ('repository.none', 'group.none', 'usergroup.none', False, False),
             ('repository.read', 'group.read', 'usergroup.read', False, False),
             ('repository.write', 'group.write', 'usergroup.write',
              False, False),
             ('repository.admin', 'group.admin', 'usergroup.admin',
              False, False),
             ('repository.XXX', 'group.admin', 'usergroup.admin', False, True),
             ('', '', '', True, False),
         ])
     def test_update_object_permissions(self, repo, repo_group, user_group,
                                        expect_error, expect_form_error):
         self.log_user()
 
         params = {
             'csrf_token': self.csrf_token,
             'default_repo_perm': repo,
             'overwrite_default_repo': False,
             'default_group_perm': repo_group,
             'overwrite_default_group': False,
             'default_user_group_perm': user_group,
             'overwrite_default_user_group': False,
         }
-        response = self.app.post(url('admin_permissions_object'),
+        response = self.app.post(route_path('admin_permissions_object_update'),
                                  params=params)
         if expect_form_error:
             assert response.status_int == 200
             response.mustcontain('Value must be one of')
         else:
             if expect_error:
                 msg = 'Error occurred during update of permissions'
             else:
                 msg = 'Object permissions updated successfully'
             assert_session_flash(response, msg)
 
     def test_index_global(self):
         self.log_user()
-        self.app.get(url('admin_permissions_global'))
+        self.app.get(route_path('admin_permissions_global'))
 
     @pytest.mark.parametrize(
         'repo_create, repo_create_write, user_group_create, repo_group_create,'
         'fork_create, inherit_default_permissions, expect_error,'
         'expect_form_error', [
             ('hg.create.none', 'hg.create.write_on_repogroup.false',
              'hg.usergroup.create.false', 'hg.repogroup.create.false',
              'hg.fork.none', 'hg.inherit_default_perms.false', False, False),
             ('hg.create.repository', 'hg.create.write_on_repogroup.true',
              'hg.usergroup.create.true', 'hg.repogroup.create.true',
              'hg.fork.repository', 'hg.inherit_default_perms.false',
              False, False),
             ('hg.create.XXX', 'hg.create.write_on_repogroup.true',
              'hg.usergroup.create.true', 'hg.repogroup.create.true',
              'hg.fork.repository', 'hg.inherit_default_perms.false',
              False, True),
             ('', '', '', '', '', '', True, False),
         ])
     def test_update_global_permissions(
             self, repo_create, repo_create_write, user_group_create,
             repo_group_create, fork_create, inherit_default_permissions,
             expect_error, expect_form_error):
         self.log_user()
 
         params = {
             'csrf_token': self.csrf_token,
             'default_repo_create': repo_create,
             'default_repo_create_on_write': repo_create_write,
             'default_user_group_create': user_group_create,
             'default_repo_group_create': repo_group_create,
             'default_fork_create': fork_create,
             'default_inherit_default_permissions': inherit_default_permissions
         }
-        response = self.app.post(url('admin_permissions_global'),
+        response = self.app.post(route_path('admin_permissions_global_update'),
                                  params=params)
         if expect_form_error:
             assert response.status_int == 200
             response.mustcontain('Value must be one of')
         else:
             if expect_error:
                 msg = 'Error occurred during update of permissions'
             else:
                 msg = 'Global permissions updated successfully'
             assert_session_flash(response, msg)
 
     def test_index_ips(self):
         self.log_user()
-        response = self.app.get(url('admin_permissions_ips'))
+        response = self.app.get(route_path('admin_permissions_ips'))
         # TODO: Test response...
         response.mustcontain('All IP addresses are allowed')
 
     def test_add_delete_ips(self):
         self.log_user()
         clear_all_caches()
 
         # ADD
         default_user_id = User.get_default_user().user_id
         self.app.post(
             route_path('edit_user_ips_add', user_id=default_user_id),
             params={'new_ip': '127.0.0.0/24', 'csrf_token': self.csrf_token})
 
-        response = self.app.get(url('admin_permissions_ips'))
+        response = self.app.get(route_path('admin_permissions_ips'))
         response.mustcontain('127.0.0.0/24')
         response.mustcontain('127.0.0.0 - 127.0.0.255')
 
         # DELETE
         default_user_id = User.get_default_user().user_id
         del_ip_id = UserIpMap.query().filter(UserIpMap.user_id ==
                                              default_user_id).first().ip_id
 
         response = self.app.post(
             route_path('edit_user_ips_delete', user_id=default_user_id),
             params={'del_ip_id': del_ip_id, 'csrf_token': self.csrf_token})
 
         assert_session_flash(response, 'Removed ip address from user whitelist')
 
         clear_all_caches()
-        response = self.app.get(url('admin_permissions_ips'))
+        response = self.app.get(route_path('admin_permissions_ips'))
         response.mustcontain('All IP addresses are allowed')
         response.mustcontain(no=['127.0.0.0/24'])
         response.mustcontain(no=['127.0.0.0 - 127.0.0.255'])
 
     def test_index_overview(self):
         self.log_user()
-        self.app.get(url('admin_permissions_overview'))
+        self.app.get(route_path('admin_permissions_overview'))

rhodecode/apps/login/tests/test_login.py

@@ -1,513 +1,530 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import urlparse
 
 import mock
 import pytest
 
-from rhodecode.config.routing import ADMIN_PREFIX
 from rhodecode.tests import (
-    assert_session_flash, url, HG_REPO, TEST_USER_ADMIN_LOGIN,
+    assert_session_flash, HG_REPO, TEST_USER_ADMIN_LOGIN,
     no_newline_id_generator)
 from rhodecode.tests.fixture import Fixture
 from rhodecode.lib.auth import check_password
 from rhodecode.lib import helpers as h
 from rhodecode.model.auth_token import AuthTokenModel
 from rhodecode.model import validators
 from rhodecode.model.db import User, Notification, UserApiKeys
 from rhodecode.model.meta import Session
 
 fixture = Fixture()
 
-# Hardcode URLs because we don't have a request object to use
-# pyramids URL generation methods.
-index_url = '/'
-login_url = ADMIN_PREFIX + '/login'
-logut_url = ADMIN_PREFIX + '/logout'
-register_url = ADMIN_PREFIX + '/register'
-pwd_reset_url = ADMIN_PREFIX + '/password_reset'
-pwd_reset_confirm_url = ADMIN_PREFIX + '/password_reset_confirmation'
+
+def route_path(name, params=None, **kwargs):
+    import urllib
+    from rhodecode.apps._base import ADMIN_PREFIX
+
+    base_url = {
+        'login': ADMIN_PREFIX + '/login',
+        'logout': ADMIN_PREFIX + '/logout',
+        'register': ADMIN_PREFIX + '/register',
+        'reset_password':
+            ADMIN_PREFIX + '/password_reset',
+        'reset_password_confirmation':
+            ADMIN_PREFIX + '/password_reset_confirmation',
+
+        'admin_permissions_application':
+            ADMIN_PREFIX + '/permissions/application',
+        'admin_permissions_application_update':
+            ADMIN_PREFIX + '/permissions/application/update',
+
+        'repo_commit_raw': '/{repo_name}/raw-changeset/{commit_id}'
+
+    }[name].format(**kwargs)
+
+    if params:
+        base_url = '{}?{}'.format(base_url, urllib.urlencode(params))
+    return base_url
 
 
 @pytest.mark.usefixtures('app')
 class TestLoginController(object):
     destroy_users = set()
 
     @classmethod
     def teardown_class(cls):
         fixture.destroy_users(cls.destroy_users)
 
     def teardown_method(self, method):
         for n in Notification.query().all():
             Session().delete(n)
 
         Session().commit()
         assert Notification.query().all() == []
 
     def test_index(self):
-        response = self.app.get(login_url)
+        response = self.app.get(route_path('login'))
         assert response.status == '200 OK'
         # Test response...
 
     def test_login_admin_ok(self):
-        response = self.app.post(login_url,
+        response = self.app.post(route_path('login'),
                                  {'username': 'test_admin',
                                   'password': 'test12'})
         assert response.status == '302 Found'
         session = response.get_session_from_response()
         username = session['rhodecode_user'].get('username')
         assert username == 'test_admin'
         response = response.follow()
         response.mustcontain('/%s' % HG_REPO)
 
     def test_login_regular_ok(self):
-        response = self.app.post(login_url,
+        response = self.app.post(route_path('login'),
                                  {'username': 'test_regular',
                                   'password': 'test12'})
 
         assert response.status == '302 Found'
         session = response.get_session_from_response()
         username = session['rhodecode_user'].get('username')
         assert username == 'test_regular'
         response = response.follow()
         response.mustcontain('/%s' % HG_REPO)
 
     def test_login_ok_came_from(self):
         test_came_from = '/_admin/users?branch=stable'
-        _url = '{}?came_from={}'.format(login_url, test_came_from)
+        _url = '{}?came_from={}'.format(route_path('login'), test_came_from)
         response = self.app.post(
             _url, {'username': 'test_admin', 'password': 'test12'})
         assert response.status == '302 Found'
         assert 'branch=stable' in response.location
         response = response.follow()
 
         assert response.status == '200 OK'
         response.mustcontain('Users administration')
 
     def test_redirect_to_login_with_get_args(self):
         with fixture.anon_access(False):
             kwargs = {'branch': 'stable'}
             response = self.app.get(
                 h.route_path('repo_summary', repo_name=HG_REPO, _query=kwargs))
             assert response.status == '302 Found'
 
             response_query = urlparse.parse_qsl(response.location)
             assert 'branch=stable' in response_query[0][1]
 
     def test_login_form_with_get_args(self):
-        _url = '{}?came_from=/_admin/users,branch=stable'.format(login_url)
+        _url = '{}?came_from=/_admin/users,branch=stable'.format(route_path('login'))
         response = self.app.get(_url)
         assert 'branch%3Dstable' in response.form.action
 
     @pytest.mark.parametrize("url_came_from", [
         'data:text/html,<script>window.alert("xss")</script>',
         'mailto:[e-mail]',
         'file:///etc/passwd',
         'ftp://some.ftp.server',
         'http://other.domain',
         '/\r\nX-Forwarded-Host: http://example.org',
     ], ids=no_newline_id_generator)
     def test_login_bad_came_froms(self, url_came_from):
-        _url = '{}?came_from={}'.format(login_url, url_came_from)
+        _url = '{}?came_from={}'.format(route_path('login'), url_came_from)
         response = self.app.post(
             _url,
             {'username': 'test_admin', 'password': 'test12'})
         assert response.status == '302 Found'
         response = response.follow()
         assert response.status == '200 OK'
         assert response.request.path == '/'
 
     def test_login_short_password(self):
-        response = self.app.post(login_url,
+        response = self.app.post(route_path('login'),
                                  {'username': 'test_admin',
                                   'password': 'as'})
         assert response.status == '200 OK'
 
         response.mustcontain('Enter 3 characters or more')
 
     def test_login_wrong_non_ascii_password(self, user_regular):
         response = self.app.post(
-            login_url,
+            route_path('login'),
             {'username': user_regular.username,
              'password': u'invalid-non-asci\xe4'.encode('utf8')})
 
         response.mustcontain('invalid user name')
         response.mustcontain('invalid password')
 
     def test_login_with_non_ascii_password(self, user_util):
         password = u'valid-non-ascii\xe4'
         user = user_util.create_user(password=password)
         response = self.app.post(
-            login_url,
+            route_path('login'),
             {'username': user.username,
              'password': password.encode('utf-8')})
         assert response.status_code == 302
 
     def test_login_wrong_username_password(self):
-        response = self.app.post(login_url,
+        response = self.app.post(route_path('login'),
                                  {'username': 'error',
                                   'password': 'test12'})
 
         response.mustcontain('invalid user name')
         response.mustcontain('invalid password')
 
     def test_login_admin_ok_password_migration(self, real_crypto_backend):
         from rhodecode.lib import auth
 
         # create new user, with sha256 password
         temp_user = 'test_admin_sha256'
         user = fixture.create_user(temp_user)
         user.password = auth._RhodeCodeCryptoSha256().hash_create(
             b'test123')
         Session().add(user)
         Session().commit()
         self.destroy_users.add(temp_user)
-        response = self.app.post(login_url,
+        response = self.app.post(route_path('login'),
                                  {'username': temp_user,
                                   'password': 'test123'})
 
         assert response.status == '302 Found'
         session = response.get_session_from_response()
         username = session['rhodecode_user'].get('username')
         assert username == temp_user
         response = response.follow()
         response.mustcontain('/%s' % HG_REPO)
 
         # new password should be bcrypted, after log-in and transfer
         user = User.get_by_username(temp_user)
         assert user.password.startswith('$')
 
     # REGISTRATIONS
     def test_register(self):
-        response = self.app.get(register_url)
+        response = self.app.get(route_path('register'))
         response.mustcontain('Create an Account')
 
     def test_register_err_same_username(self):
         uname = 'test_admin'
         response = self.app.post(
-            register_url,
+            route_path('register'),
             {
                 'username': uname,
                 'password': 'test12',
                 'password_confirmation': 'test12',
                 'email': '[e-mail]',
                 'firstname': 'test',
                 'lastname': 'test'
             }
         )
 
         assertr = response.assert_response()
         msg = validators.ValidUsername()._messages['username_exists']
         msg = msg % {'username': uname}
         assertr.element_contains('#username+.error-message', msg)
 
     def test_register_err_same_email(self):
         response = self.app.post(
-            register_url,
+            route_path('register'),
             {
                 'username': 'test_admin_0',
                 'password': 'test12',
                 'password_confirmation': 'test12',
                 'email': '[e-mail]',
                 'firstname': 'test',
                 'lastname': 'test'
             }
         )
 
         assertr = response.assert_response()
         msg = validators.UniqSystemEmail()()._messages['email_taken']
         assertr.element_contains('#email+.error-message', msg)
 
     def test_register_err_same_email_case_sensitive(self):
         response = self.app.post(
-            register_url,
+            route_path('register'),
             {
                 'username': 'test_admin_1',
                 'password': 'test12',
                 'password_confirmation': 'test12',
                 'email': '[e-mail]',
                 'firstname': 'test',
                 'lastname': 'test'
             }
         )
         assertr = response.assert_response()
         msg = validators.UniqSystemEmail()()._messages['email_taken']
         assertr.element_contains('#email+.error-message', msg)
 
     def test_register_err_wrong_data(self):
         response = self.app.post(
-            register_url,
+            route_path('register'),
             {
                 'username': 'xs',
                 'password': 'test',
                 'password_confirmation': 'test',
                 'email': 'goodmailm',
                 'firstname': 'test',
                 'lastname': 'test'
             }
         )
         assert response.status == '200 OK'
         response.mustcontain('An email address must contain a single @')
         response.mustcontain('Enter a value 6 characters long or more')
 
     def test_register_err_username(self):
         response = self.app.post(
-            register_url,
+            route_path('register'),
             {
                 'username': 'error user',
                 'password': 'test12',
                 'password_confirmation': 'test12',
                 'email': 'goodmailm',
                 'firstname': 'test',
                 'lastname': 'test'
             }
         )
 
         response.mustcontain('An email address must contain a single @')
         response.mustcontain(
             'Username may only contain '
             'alphanumeric characters underscores, '
             'periods or dashes and must begin with '
             'alphanumeric character')
 
     def test_register_err_case_sensitive(self):
         usr = 'Test_Admin'
         response = self.app.post(
-            register_url,
+            route_path('register'),
             {
                 'username': usr,
                 'password': 'test12',
                 'password_confirmation': 'test12',
                 'email': 'goodmailm',
                 'firstname': 'test',
                 'lastname': 'test'
             }
         )
 
         assertr = response.assert_response()
         msg = validators.ValidUsername()._messages['username_exists']
         msg = msg % {'username': usr}
         assertr.element_contains('#username+.error-message', msg)
 
     def test_register_special_chars(self):
         response = self.app.post(
-            register_url,
+            route_path('register'),
             {
                 'username': 'xxxaxn',
                 'password': 'ąćźżąśśśś',
                 'password_confirmation': 'ąćźżąśśśś',
                 'email': '[e-mail]',
                 'firstname': 'test',
                 'lastname': 'test'
             }
         )
 
         msg = validators.ValidPassword()._messages['invalid_password']
         response.mustcontain(msg)
 
     def test_register_password_mismatch(self):
         response = self.app.post(
-            register_url,
+            route_path('register'),
             {
                 'username': 'xs',
                 'password': '123qwe',
                 'password_confirmation': 'qwe123',
                 'email': '[e-mail]',
                 'firstname': 'test',
                 'lastname': 'test'
             }
         )
         msg = validators.ValidPasswordsMatch()._messages['password_mismatch']
         response.mustcontain(msg)
 
     def test_register_ok(self):
         username = 'test_regular4'
         password = 'qweqwe'
         email = '[e-mail]'
         name = 'testname'
         lastname = 'testlastname'
 
         response = self.app.post(
-            register_url,
+            route_path('register'),
             {
                 'username': username,
                 'password': password,
                 'password_confirmation': password,
                 'email': email,
                 'firstname': name,
                 'lastname': lastname,
                 'admin': True
             }
         )  # This should be overriden
         assert response.status == '302 Found'
         assert_session_flash(
             response, 'You have successfully registered with RhodeCode')
 
         ret = Session().query(User).filter(
             User.username == 'test_regular4').one()
         assert ret.username == username
         assert check_password(password, ret.password)
         assert ret.email == email
         assert ret.name == name
         assert ret.lastname == lastname
         assert ret.auth_tokens is not None
         assert not ret.admin
 
     def test_forgot_password_wrong_mail(self):
         bad_email = '[e-mail]'
         response = self.app.post(
-            pwd_reset_url, {'email': bad_email, }
+            route_path('reset_password'), {'email': bad_email, }
         )
         assert_session_flash(response,
             'If such email exists, a password reset link was sent to it.')
 
     def test_forgot_password(self, user_util):
-        response = self.app.get(pwd_reset_url)
+        response = self.app.get(route_path('reset_password'))
         assert response.status == '200 OK'
 
         user = user_util.create_user()
         user_id = user.user_id
         email = user.email
 
-        response = self.app.post(pwd_reset_url, {'email': email, })
+        response = self.app.post(route_path('reset_password'), {'email': email, })
 
         assert_session_flash(response,
             'If such email exists, a password reset link was sent to it.')
 
         # BAD KEY
-        confirm_url = '{}?key={}'.format(pwd_reset_confirm_url, 'badkey')
+        confirm_url = '{}?key={}'.format(route_path('reset_password_confirmation'), 'badkey')
         response = self.app.get(confirm_url)
         assert response.status == '302 Found'
-        assert response.location.endswith(pwd_reset_url)
+        assert response.location.endswith(route_path('reset_password'))
         assert_session_flash(response, 'Given reset token is invalid')
 
         response.follow()  # cleanup flash
 
         # GOOD KEY
         key = UserApiKeys.query()\
             .filter(UserApiKeys.user_id == user_id)\
             .filter(UserApiKeys.role == UserApiKeys.ROLE_PASSWORD_RESET)\
             .first()
 
         assert key
 
-        confirm_url = '{}?key={}'.format(pwd_reset_confirm_url, key.api_key)
+        confirm_url = '{}?key={}'.format(route_path('reset_password_confirmation'), key.api_key)
         response = self.app.get(confirm_url)
         assert response.status == '302 Found'
-        assert response.location.endswith(login_url)
+        assert response.location.endswith(route_path('login'))
 
         assert_session_flash(
             response,
             'Your password reset was successful, '
             'a new password has been sent to your email')
 
         response.follow()
 
     def _get_api_whitelist(self, values=None):
         config = {'api_access_controllers_whitelist': values or []}
         return config
 
     @pytest.mark.parametrize("test_name, auth_token", [
         ('none', None),
         ('empty_string', ''),
         ('fake_number', '123456'),
         ('proper_auth_token', None)
     ])
     def test_access_not_whitelisted_page_via_auth_token(
             self, test_name, auth_token, user_admin):
 
         whitelist = self._get_api_whitelist([])
         with mock.patch.dict('rhodecode.CONFIG', whitelist):
             assert [] == whitelist['api_access_controllers_whitelist']
             if test_name == 'proper_auth_token':
                 # use builtin if api_key is None
                 auth_token = user_admin.api_key
 
             with fixture.anon_access(False):
-                self.app.get(url(controller='changeset',
-                                 action='changeset_raw',
-                                 repo_name=HG_REPO, revision='tip',
-                                 api_key=auth_token),
+                self.app.get(
+                    route_path('repo_commit_raw',
+                               repo_name=HG_REPO, commit_id='tip',
+                               params=dict(api_key=auth_token)),
                              status=302)
 
     @pytest.mark.parametrize("test_name, auth_token, code", [
         ('none', None, 302),
         ('empty_string', '', 302),
         ('fake_number', '123456', 302),
         ('proper_auth_token', None, 200)
     ])
     def test_access_whitelisted_page_via_auth_token(
             self, test_name, auth_token, code, user_admin):
 
         whitelist_entry = ['ChangesetController:changeset_raw']
         whitelist = self._get_api_whitelist(whitelist_entry)
 
         with mock.patch.dict('rhodecode.CONFIG', whitelist):
             assert whitelist_entry == whitelist['api_access_controllers_whitelist']
 
             if test_name == 'proper_auth_token':
                 auth_token = user_admin.api_key
                 assert auth_token
 
             with fixture.anon_access(False):
-                self.app.get(url(controller='changeset',
-                                 action='changeset_raw',
-                                 repo_name=HG_REPO, revision='tip',
-                                 api_key=auth_token),
+                self.app.get(
+                    route_path('repo_commit_raw',
+                               repo_name=HG_REPO, commit_id='tip',
+                               params=dict(api_key=auth_token)),
                              status=code)
 
     def test_access_page_via_extra_auth_token(self):
         whitelist = self._get_api_whitelist(
             ['ChangesetController:changeset_raw'])
         with mock.patch.dict('rhodecode.CONFIG', whitelist):
             assert ['ChangesetController:changeset_raw'] == \
                 whitelist['api_access_controllers_whitelist']
 
             new_auth_token = AuthTokenModel().create(
                 TEST_USER_ADMIN_LOGIN, 'test')
             Session().commit()
             with fixture.anon_access(False):
-                self.app.get(url(controller='changeset',
-                                 action='changeset_raw',
-                                 repo_name=HG_REPO, revision='tip',
-                                 api_key=new_auth_token.api_key),
+                self.app.get(
+                    route_path('repo_commit_raw',
+                               repo_name=HG_REPO, commit_id='tip',
+                               params=dict(api_key=new_auth_token.api_key)),
                              status=200)
 
     def test_access_page_via_expired_auth_token(self):
         whitelist = self._get_api_whitelist(
             ['ChangesetController:changeset_raw'])
         with mock.patch.dict('rhodecode.CONFIG', whitelist):
             assert ['ChangesetController:changeset_raw'] == \
                 whitelist['api_access_controllers_whitelist']
 
             new_auth_token = AuthTokenModel().create(
                 TEST_USER_ADMIN_LOGIN, 'test')
             Session().commit()
             # patch the api key and make it expired
             new_auth_token.expires = 0
             Session().add(new_auth_token)
             Session().commit()
             with fixture.anon_access(False):
-                self.app.get(url(controller='changeset',
-                                 action='changeset_raw',
-                                 repo_name=HG_REPO, revision='tip',
-                                 api_key=new_auth_token.api_key),
+                self.app.get(
+                    route_path('repo_commit_raw',
+                               repo_name=HG_REPO, commit_id='tip',
+                               params=dict(api_key=new_auth_token.api_key)),
                              status=302)

rhodecode/apps/login/tests/test_password_reset.py

@@ -1,106 +1,121 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import pytest
 
-from rhodecode.config.routing import ADMIN_PREFIX
+from rhodecode.lib import helpers as h
 from rhodecode.tests import (
-    TestController, clear_all_caches, url,
+    TestController, clear_all_caches,
     TEST_USER_ADMIN_LOGIN, TEST_USER_ADMIN_PASS)
 from rhodecode.tests.fixture import Fixture
 from rhodecode.tests.utils import AssertResponse
 
 fixture = Fixture()
 
-# Hardcode URLs because we don't have a request object to use
-# pyramids URL generation methods.
-index_url = '/'
-login_url = ADMIN_PREFIX + '/login'
-logut_url = ADMIN_PREFIX + '/logout'
-register_url = ADMIN_PREFIX + '/register'
-pwd_reset_url = ADMIN_PREFIX + '/password_reset'
-pwd_reset_confirm_url = ADMIN_PREFIX + '/password_reset_confirmation'
+
+def route_path(name, params=None, **kwargs):
+    import urllib
+    from rhodecode.apps._base import ADMIN_PREFIX
+
+    base_url = {
+        'login': ADMIN_PREFIX + '/login',
+        'logout': ADMIN_PREFIX + '/logout',
+        'register': ADMIN_PREFIX + '/register',
+        'reset_password':
+            ADMIN_PREFIX + '/password_reset',
+        'reset_password_confirmation':
+            ADMIN_PREFIX + '/password_reset_confirmation',
+
+        'admin_permissions_application':
+            ADMIN_PREFIX + '/permissions/application',
+        'admin_permissions_application_update':
+            ADMIN_PREFIX + '/permissions/application/update',
+    }[name].format(**kwargs)
+
+    if params:
+        base_url = '{}?{}'.format(base_url, urllib.urlencode(params))
+    return base_url
 
 
 class TestPasswordReset(TestController):
 
     @pytest.mark.parametrize(
         'pwd_reset_setting, show_link, show_reset', [
             ('hg.password_reset.enabled', True, True),
             ('hg.password_reset.hidden', False, True),
             ('hg.password_reset.disabled', False, False),
         ])
     def test_password_reset_settings(
             self, pwd_reset_setting, show_link, show_reset):
         clear_all_caches()
         self.log_user(TEST_USER_ADMIN_LOGIN, TEST_USER_ADMIN_PASS)
         params = {
             'csrf_token': self.csrf_token,
             'anonymous': 'True',
             'default_register': 'hg.register.auto_activate',
             'default_register_message': '',
             'default_password_reset': pwd_reset_setting,
             'default_extern_activate': 'hg.extern_activate.auto',
         }
-        resp = self.app.post(url('admin_permissions_application'), params=params)
+        resp = self.app.post(route_path('admin_permissions_application_update'), params=params)
         self.logout_user()
 
-        login_page = self.app.get(login_url)
+        login_page = self.app.get(route_path('login'))
         asr_login = AssertResponse(login_page)
-        index_page = self.app.get(index_url)
+        index_page = self.app.get(h.route_path('home'))
         asr_index = AssertResponse(index_page)
 
         if show_link:
             asr_login.one_element_exists('a.pwd_reset')
             asr_index.one_element_exists('a.pwd_reset')
         else:
             asr_login.no_element_exists('a.pwd_reset')
             asr_index.no_element_exists('a.pwd_reset')
 
-        response = self.app.get(pwd_reset_url)
+        response = self.app.get(route_path('reset_password'))
         
         assert_response = AssertResponse(response)
         if show_reset:
             response.mustcontain('Send password reset email')
             assert_response.one_element_exists('#email')
             assert_response.one_element_exists('#send')
         else:
             response.mustcontain('Password reset is disabled.')
             assert_response.no_element_exists('#email')
             assert_response.no_element_exists('#send')
 
     def test_password_form_disabled(self):
         self.log_user(TEST_USER_ADMIN_LOGIN, TEST_USER_ADMIN_PASS)
         params = {
             'csrf_token': self.csrf_token,
             'anonymous': 'True',
             'default_register': 'hg.register.auto_activate',
             'default_register_message': '',
             'default_password_reset': 'hg.password_reset.disabled',
             'default_extern_activate': 'hg.extern_activate.auto',
         }
-        self.app.post(url('admin_permissions_application'), params=params)
+        self.app.post(route_path('admin_permissions_application_update'), params=params)
         self.logout_user()
 
         response = self.app.post(
-            pwd_reset_url, {'email': '[e-mail]',}
+            route_path('reset_password'), {'email': '[e-mail]',}
         )
         response = response.follow()
         response.mustcontain('Password reset is disabled.')

rhodecode/config/routing.py

@@ -1,686 +1,660 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 Routes configuration
 
 The more specific and detailed routes should be defined first so they
 may take precedent over the more generic routes. For more information
 refer to the routes manual at http://routes.groovie.org/docs/
 
 IMPORTANT: if you change any routing here, make sure to take a look at lib/base.py
 and _route_name variable which uses some of stored naming here to do redirects.
 """
 import os
 import re
 from routes import Mapper
 
 # prefix for non repository related links needs to be prefixed with `/`
 ADMIN_PREFIX = '/_admin'
 STATIC_FILE_PREFIX = '/_static'
 
 # Default requirements for URL parts
 URL_NAME_REQUIREMENTS = {
     # group name can have a slash in them, but they must not end with a slash
     'group_name': r'.*?[^/]',
     'repo_group_name': r'.*?[^/]',
     # repo names can have a slash in them, but they must not end with a slash
     'repo_name': r'.*?[^/]',
     # file path eats up everything at the end
     'f_path': r'.*',
     # reference types
     'source_ref_type': '(branch|book|tag|rev|\%\(source_ref_type\)s)',
     'target_ref_type': '(branch|book|tag|rev|\%\(target_ref_type\)s)',
 }
 
 
 class JSRoutesMapper(Mapper):
     """
     Wrapper for routes.Mapper to make pyroutes compatible url definitions
     """
     _named_route_regex = re.compile(r'^[a-z-_0-9A-Z]+$')
     _argument_prog = re.compile('\{(.*?)\}|:\((.*)\)')
     def __init__(self, *args, **kw):
         super(JSRoutesMapper, self).__init__(*args, **kw)
         self._jsroutes = []
 
     def connect(self, *args, **kw):
         """
         Wrapper for connect to take an extra argument jsroute=True
 
         :param jsroute: boolean, if True will add the route to the pyroutes list
         """
         if kw.pop('jsroute', False):
             if not self._named_route_regex.match(args[0]):
                 raise Exception('only named routes can be added to pyroutes')
             self._jsroutes.append(args[0])
 
         super(JSRoutesMapper, self).connect(*args, **kw)
 
     def _extract_route_information(self, route):
         """
         Convert a route into tuple(name, path, args), eg:
             ('show_user', '/profile/%(username)s', ['username'])
         """
         routepath = route.routepath
         def replace(matchobj):
             if matchobj.group(1):
                 return "%%(%s)s" % matchobj.group(1).split(':')[0]
             else:
                 return "%%(%s)s" % matchobj.group(2)
 
         routepath = self._argument_prog.sub(replace, routepath)
         return (
             route.name,
             routepath,
             [(arg[0].split(':')[0] if arg[0] != '' else arg[1])
               for arg in self._argument_prog.findall(route.routepath)]
         )
 
     def jsroutes(self):
         """
         Return a list of pyroutes.js compatible routes
         """
         for route_name in self._jsroutes:
             yield self._extract_route_information(self._routenames[route_name])
 
 
 def make_map(config):
     """Create, configure and return the routes Mapper"""
     rmap = JSRoutesMapper(
         directory=config['pylons.paths']['controllers'],
         always_scan=config['debug'])
     rmap.minimization = False
     rmap.explicit = False
 
     from rhodecode.lib.utils2 import str2bool
     from rhodecode.model import repo, repo_group
 
     def check_repo(environ, match_dict):
         """
         check for valid repository for proper 404 handling
 
         :param environ:
         :param match_dict:
         """
         repo_name = match_dict.get('repo_name')
 
         if match_dict.get('f_path'):
             # fix for multiple initial slashes that causes errors
             match_dict['f_path'] = match_dict['f_path'].lstrip('/')
         repo_model = repo.RepoModel()
         by_name_match = repo_model.get_by_repo_name(repo_name)
         # if we match quickly from database, short circuit the operation,
         # and validate repo based on the type.
         if by_name_match:
             return True
 
         by_id_match = repo_model.get_repo_by_id(repo_name)
         if by_id_match:
             repo_name = by_id_match.repo_name
             match_dict['repo_name'] = repo_name
             return True
 
         return False
 
     def check_group(environ, match_dict):
         """
         check for valid repository group path for proper 404 handling
 
         :param environ:
         :param match_dict:
         """
         repo_group_name = match_dict.get('group_name')
         repo_group_model = repo_group.RepoGroupModel()
         by_name_match = repo_group_model.get_by_group_name(repo_group_name)
         if by_name_match:
             return True
 
         return False
 
     def check_user_group(environ, match_dict):
         """
         check for valid user group for proper 404 handling
 
         :param environ:
         :param match_dict:
         """
         return True
 
     def check_int(environ, match_dict):
         return match_dict.get('id').isdigit()
 
 
     #==========================================================================
     # CUSTOM ROUTES HERE
     #==========================================================================
 
     # ping and pylons error test
     rmap.connect('ping', '%s/ping' % (ADMIN_PREFIX,), controller='home', action='ping')
     rmap.connect('error_test', '%s/error_test' % (ADMIN_PREFIX,), controller='home', action='error_test')
 
     # ADMIN REPOSITORY ROUTES
     with rmap.submapper(path_prefix=ADMIN_PREFIX,
                         controller='admin/repos') as m:
         m.connect('repos', '/repos',
                   action='create', conditions={'method': ['POST']})
         m.connect('repos', '/repos',
                   action='index', conditions={'method': ['GET']})
         m.connect('new_repo', '/create_repository', jsroute=True,
                   action='create_repository', conditions={'method': ['GET']})
         m.connect('delete_repo', '/repos/{repo_name}',
                   action='delete', conditions={'method': ['DELETE']},
                   requirements=URL_NAME_REQUIREMENTS)
         m.connect('repo', '/repos/{repo_name}',
                   action='show', conditions={'method': ['GET'],
                                              'function': check_repo},
                   requirements=URL_NAME_REQUIREMENTS)
 
     # ADMIN REPOSITORY GROUPS ROUTES
     with rmap.submapper(path_prefix=ADMIN_PREFIX,
                         controller='admin/repo_groups') as m:
         m.connect('repo_groups', '/repo_groups',
                   action='create', conditions={'method': ['POST']})
         m.connect('repo_groups', '/repo_groups',
                   action='index', conditions={'method': ['GET']})
         m.connect('new_repo_group', '/repo_groups/new',
                   action='new', conditions={'method': ['GET']})
         m.connect('update_repo_group', '/repo_groups/{group_name}',
                   action='update', conditions={'method': ['PUT'],
                                                'function': check_group},
                   requirements=URL_NAME_REQUIREMENTS)
 
         # EXTRAS REPO GROUP ROUTES
         m.connect('edit_repo_group', '/repo_groups/{group_name}/edit',
                   action='edit',
                   conditions={'method': ['GET'], 'function': check_group},
                   requirements=URL_NAME_REQUIREMENTS)
         m.connect('edit_repo_group', '/repo_groups/{group_name}/edit',
                   action='edit',
                   conditions={'method': ['PUT'], 'function': check_group},
                   requirements=URL_NAME_REQUIREMENTS)
 
         m.connect('edit_repo_group_advanced', '/repo_groups/{group_name}/edit/advanced',
                   action='edit_repo_group_advanced',
                   conditions={'method': ['GET'], 'function': check_group},
                   requirements=URL_NAME_REQUIREMENTS)
         m.connect('edit_repo_group_advanced', '/repo_groups/{group_name}/edit/advanced',
                   action='edit_repo_group_advanced',
                   conditions={'method': ['PUT'], 'function': check_group},
                   requirements=URL_NAME_REQUIREMENTS)
 
         m.connect('edit_repo_group_perms', '/repo_groups/{group_name}/edit/permissions',
                   action='edit_repo_group_perms',
                   conditions={'method': ['GET'], 'function': check_group},
                   requirements=URL_NAME_REQUIREMENTS)
         m.connect('edit_repo_group_perms', '/repo_groups/{group_name}/edit/permissions',
                   action='update_perms',
                   conditions={'method': ['PUT'], 'function': check_group},
                   requirements=URL_NAME_REQUIREMENTS)
 
         m.connect('delete_repo_group', '/repo_groups/{group_name}',
                   action='delete', conditions={'method': ['DELETE'],
                                                'function': check_group},
                   requirements=URL_NAME_REQUIREMENTS)
 
     # ADMIN USER ROUTES
     with rmap.submapper(path_prefix=ADMIN_PREFIX,
                         controller='admin/users') as m:
         m.connect('users', '/users',
                   action='create', conditions={'method': ['POST']})
         m.connect('new_user', '/users/new',
                   action='new', conditions={'method': ['GET']})
         m.connect('update_user', '/users/{user_id}',
                   action='update', conditions={'method': ['PUT']})
         m.connect('delete_user', '/users/{user_id}',
                   action='delete', conditions={'method': ['DELETE']})
         m.connect('edit_user', '/users/{user_id}/edit',
                   action='edit', conditions={'method': ['GET']}, jsroute=True)
         m.connect('user', '/users/{user_id}',
                   action='show', conditions={'method': ['GET']})
         m.connect('force_password_reset_user', '/users/{user_id}/password_reset',
                   action='reset_password', conditions={'method': ['POST']})
         m.connect('create_personal_repo_group', '/users/{user_id}/create_repo_group',
                   action='create_personal_repo_group', conditions={'method': ['POST']})
 
         # EXTRAS USER ROUTES
         m.connect('edit_user_advanced', '/users/{user_id}/edit/advanced',
                   action='edit_advanced', conditions={'method': ['GET']})
         m.connect('edit_user_advanced', '/users/{user_id}/edit/advanced',
                   action='update_advanced', conditions={'method': ['PUT']})
 
         m.connect('edit_user_global_perms', '/users/{user_id}/edit/global_permissions',
                   action='edit_global_perms', conditions={'method': ['GET']})
         m.connect('edit_user_global_perms', '/users/{user_id}/edit/global_permissions',
                   action='update_global_perms', conditions={'method': ['PUT']})
 
         m.connect('edit_user_perms_summary', '/users/{user_id}/edit/permissions_summary',
                   action='edit_perms_summary', conditions={'method': ['GET']})
 
     # ADMIN USER GROUPS REST ROUTES
     with rmap.submapper(path_prefix=ADMIN_PREFIX,
                         controller='admin/user_groups') as m:
         m.connect('users_groups', '/user_groups',
                   action='create', conditions={'method': ['POST']})
         m.connect('users_groups', '/user_groups',
                   action='index', conditions={'method': ['GET']})
         m.connect('new_users_group', '/user_groups/new',
                   action='new', conditions={'method': ['GET']})
         m.connect('update_users_group', '/user_groups/{user_group_id}',
                   action='update', conditions={'method': ['PUT']})
         m.connect('delete_users_group', '/user_groups/{user_group_id}',
                   action='delete', conditions={'method': ['DELETE']})
         m.connect('edit_users_group', '/user_groups/{user_group_id}/edit',
                   action='edit', conditions={'method': ['GET']},
                   function=check_user_group)
 
         # EXTRAS USER GROUP ROUTES
         m.connect('edit_user_group_global_perms',
                   '/user_groups/{user_group_id}/edit/global_permissions',
                   action='edit_global_perms', conditions={'method': ['GET']})
         m.connect('edit_user_group_global_perms',
                   '/user_groups/{user_group_id}/edit/global_permissions',
                   action='update_global_perms', conditions={'method': ['PUT']})
         m.connect('edit_user_group_perms_summary',
                   '/user_groups/{user_group_id}/edit/permissions_summary',
                   action='edit_perms_summary', conditions={'method': ['GET']})
 
         m.connect('edit_user_group_perms',
                   '/user_groups/{user_group_id}/edit/permissions',
                   action='edit_perms', conditions={'method': ['GET']})
         m.connect('edit_user_group_perms',
                   '/user_groups/{user_group_id}/edit/permissions',
                   action='update_perms', conditions={'method': ['PUT']})
 
         m.connect('edit_user_group_advanced',
                   '/user_groups/{user_group_id}/edit/advanced',
                   action='edit_advanced', conditions={'method': ['GET']})
 
         m.connect('edit_user_group_advanced_sync',
                   '/user_groups/{user_group_id}/edit/advanced/sync',
                   action='edit_advanced_set_synchronization', conditions={'method': ['POST']})
 
         m.connect('edit_user_group_members',
                   '/user_groups/{user_group_id}/edit/members', jsroute=True,
                   action='user_group_members', conditions={'method': ['GET']})
 
-    # ADMIN PERMISSIONS ROUTES
-    with rmap.submapper(path_prefix=ADMIN_PREFIX,
-                        controller='admin/permissions') as m:
-        m.connect('admin_permissions_application', '/permissions/application',
-                  action='permission_application_update', conditions={'method': ['POST']})
-        m.connect('admin_permissions_application', '/permissions/application',
-                  action='permission_application', conditions={'method': ['GET']})
-
-        m.connect('admin_permissions_global', '/permissions/global',
-                  action='permission_global_update', conditions={'method': ['POST']})
-        m.connect('admin_permissions_global', '/permissions/global',
-                  action='permission_global', conditions={'method': ['GET']})
-
-        m.connect('admin_permissions_object', '/permissions/object',
-                  action='permission_objects_update', conditions={'method': ['POST']})
-        m.connect('admin_permissions_object', '/permissions/object',
-                  action='permission_objects', conditions={'method': ['GET']})
-
-        m.connect('admin_permissions_ips', '/permissions/ips',
-                  action='permission_ips', conditions={'method': ['POST']})
-        m.connect('admin_permissions_ips', '/permissions/ips',
-                  action='permission_ips', conditions={'method': ['GET']})
-
-        m.connect('admin_permissions_overview', '/permissions/overview',
-                  action='permission_perms', conditions={'method': ['GET']})
-
     # ADMIN DEFAULTS REST ROUTES
     with rmap.submapper(path_prefix=ADMIN_PREFIX,
                         controller='admin/defaults') as m:
         m.connect('admin_defaults_repositories', '/defaults/repositories',
                   action='update_repository_defaults', conditions={'method': ['POST']})
         m.connect('admin_defaults_repositories', '/defaults/repositories',
                   action='index', conditions={'method': ['GET']})
 
     # ADMIN SETTINGS ROUTES
     with rmap.submapper(path_prefix=ADMIN_PREFIX,
                         controller='admin/settings') as m:
 
         # default
         m.connect('admin_settings', '/settings',
                   action='settings_global_update',
                   conditions={'method': ['POST']})
         m.connect('admin_settings', '/settings',
                   action='settings_global', conditions={'method': ['GET']})
 
         m.connect('admin_settings_vcs', '/settings/vcs',
                   action='settings_vcs_update',
                   conditions={'method': ['POST']})
         m.connect('admin_settings_vcs', '/settings/vcs',
                   action='settings_vcs',
                   conditions={'method': ['GET']})
         m.connect('admin_settings_vcs', '/settings/vcs',
                   action='delete_svn_pattern',
                   conditions={'method': ['DELETE']})
 
         m.connect('admin_settings_mapping', '/settings/mapping',
                   action='settings_mapping_update',
                   conditions={'method': ['POST']})
         m.connect('admin_settings_mapping', '/settings/mapping',
                   action='settings_mapping', conditions={'method': ['GET']})
 
         m.connect('admin_settings_global', '/settings/global',
                   action='settings_global_update',
                   conditions={'method': ['POST']})
         m.connect('admin_settings_global', '/settings/global',
                   action='settings_global', conditions={'method': ['GET']})
 
         m.connect('admin_settings_visual', '/settings/visual',
                   action='settings_visual_update',
                   conditions={'method': ['POST']})
         m.connect('admin_settings_visual', '/settings/visual',
                   action='settings_visual', conditions={'method': ['GET']})
 
         m.connect('admin_settings_issuetracker',
                   '/settings/issue-tracker', action='settings_issuetracker',
                   conditions={'method': ['GET']})
         m.connect('admin_settings_issuetracker_save',
                   '/settings/issue-tracker/save',
                   action='settings_issuetracker_save',
                   conditions={'method': ['POST']})
         m.connect('admin_issuetracker_test', '/settings/issue-tracker/test',
                   action='settings_issuetracker_test',
                   conditions={'method': ['POST']})
         m.connect('admin_issuetracker_delete',
                   '/settings/issue-tracker/delete',
                   action='settings_issuetracker_delete',
                   conditions={'method': ['DELETE']})
 
         m.connect('admin_settings_email', '/settings/email',
                   action='settings_email_update',
                   conditions={'method': ['POST']})
         m.connect('admin_settings_email', '/settings/email',
                   action='settings_email', conditions={'method': ['GET']})
 
         m.connect('admin_settings_hooks', '/settings/hooks',
                   action='settings_hooks_update',
                   conditions={'method': ['POST', 'DELETE']})
         m.connect('admin_settings_hooks', '/settings/hooks',
                   action='settings_hooks', conditions={'method': ['GET']})
 
         m.connect('admin_settings_search', '/settings/search',
                   action='settings_search', conditions={'method': ['GET']})
 
         m.connect('admin_settings_supervisor', '/settings/supervisor',
                   action='settings_supervisor', conditions={'method': ['GET']})
         m.connect('admin_settings_supervisor_log', '/settings/supervisor/{procid}/log',
                   action='settings_supervisor_log', conditions={'method': ['GET']})
 
         m.connect('admin_settings_labs', '/settings/labs',
                   action='settings_labs_update',
                   conditions={'method': ['POST']})
         m.connect('admin_settings_labs', '/settings/labs',
                   action='settings_labs', conditions={'method': ['GET']})
 
     # ADMIN MY ACCOUNT
     with rmap.submapper(path_prefix=ADMIN_PREFIX,
                         controller='admin/my_account') as m:
 
         # NOTE(marcink): this needs to be kept for password force flag to be
         # handled in pylons controllers, remove after full migration to pyramid
         m.connect('my_account_password', '/my_account/password',
                   action='my_account_password', conditions={'method': ['GET']})
 
     #==========================================================================
     # REPOSITORY ROUTES
     #==========================================================================
 
     rmap.connect('repo_creating_home', '/{repo_name}/repo_creating',
                  controller='admin/repos', action='repo_creating',
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('repo_check_home', '/{repo_name}/crepo_check',
                  controller='admin/repos', action='repo_check',
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('changeset_home', '/{repo_name}/changeset/{revision}',
                  controller='changeset', revision='tip',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
     rmap.connect('changeset_children', '/{repo_name}/changeset_children/{revision}',
                  controller='changeset', revision='tip', action='changeset_children',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('changeset_parents', '/{repo_name}/changeset_parents/{revision}',
                  controller='changeset', revision='tip', action='changeset_parents',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     # repo edit options
     rmap.connect('edit_repo_fields', '/{repo_name}/settings/fields',
                  controller='admin/repos', action='edit_fields',
                  conditions={'method': ['GET'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('create_repo_fields', '/{repo_name}/settings/fields/new',
                  controller='admin/repos', action='create_repo_field',
                  conditions={'method': ['PUT'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('delete_repo_fields', '/{repo_name}/settings/fields/{field_id}',
                  controller='admin/repos', action='delete_repo_field',
                  conditions={'method': ['DELETE'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('toggle_locking', '/{repo_name}/settings/advanced/locking_toggle',
                  controller='admin/repos', action='toggle_locking',
                  conditions={'method': ['GET'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('edit_repo_remote', '/{repo_name}/settings/remote',
                  controller='admin/repos', action='edit_remote_form',
                  conditions={'method': ['GET'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('edit_repo_remote', '/{repo_name}/settings/remote',
                  controller='admin/repos', action='edit_remote',
                  conditions={'method': ['PUT'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('edit_repo_statistics', '/{repo_name}/settings/statistics',
                  controller='admin/repos', action='edit_statistics_form',
                  conditions={'method': ['GET'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('edit_repo_statistics', '/{repo_name}/settings/statistics',
                  controller='admin/repos', action='edit_statistics',
                  conditions={'method': ['PUT'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('repo_settings_issuetracker',
                  '/{repo_name}/settings/issue-tracker',
                  controller='admin/repos', action='repo_issuetracker',
                  conditions={'method': ['GET'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('repo_issuetracker_test',
                  '/{repo_name}/settings/issue-tracker/test',
                  controller='admin/repos', action='repo_issuetracker_test',
                  conditions={'method': ['POST'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('repo_issuetracker_delete',
                  '/{repo_name}/settings/issue-tracker/delete',
                  controller='admin/repos', action='repo_issuetracker_delete',
                  conditions={'method': ['DELETE'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('repo_issuetracker_save',
                  '/{repo_name}/settings/issue-tracker/save',
                  controller='admin/repos', action='repo_issuetracker_save',
                  conditions={'method': ['POST'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('repo_vcs_settings', '/{repo_name}/settings/vcs',
                  controller='admin/repos', action='repo_settings_vcs_update',
                  conditions={'method': ['POST'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('repo_vcs_settings', '/{repo_name}/settings/vcs',
                  controller='admin/repos', action='repo_settings_vcs',
                  conditions={'method': ['GET'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('repo_vcs_settings', '/{repo_name}/settings/vcs',
                  controller='admin/repos', action='repo_delete_svn_pattern',
                  conditions={'method': ['DELETE'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
     rmap.connect('repo_pullrequest_settings', '/{repo_name}/settings/pullrequest',
                  controller='admin/repos', action='repo_settings_pullrequest',
                  conditions={'method': ['GET', 'POST'], 'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     # still working url for backward compat.
     rmap.connect('raw_changeset_home_depraced',
                  '/{repo_name}/raw-changeset/{revision}',
                  controller='changeset', action='changeset_raw',
                  revision='tip', conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     # new URLs
     rmap.connect('changeset_raw_home',
                  '/{repo_name}/changeset-diff/{revision}',
                  controller='changeset', action='changeset_raw',
                  revision='tip', conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('changeset_patch_home',
                  '/{repo_name}/changeset-patch/{revision}',
                  controller='changeset', action='changeset_patch',
                  revision='tip', conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('changeset_download_home',
                  '/{repo_name}/changeset-download/{revision}',
                  controller='changeset', action='changeset_download',
                  revision='tip', conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('changeset_comment',
                  '/{repo_name}/changeset/{revision}/comment', jsroute=True,
                  controller='changeset', revision='tip', action='comment',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('changeset_comment_preview',
                  '/{repo_name}/changeset/comment/preview', jsroute=True,
                  controller='changeset', action='preview_comment',
                  conditions={'function': check_repo, 'method': ['POST']},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('changeset_comment_delete',
                  '/{repo_name}/changeset/comment/{comment_id}/delete',
                  controller='changeset', action='delete_comment',
                  conditions={'function': check_repo, 'method': ['DELETE']},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('changeset_info', '/{repo_name}/changeset_info/{revision}',
                  controller='changeset', action='changeset_info',
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('compare_home',
                  '/{repo_name}/compare',
                  controller='compare', action='index',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('compare_url',
                  '/{repo_name}/compare/{source_ref_type}@{source_ref:.*?}...{target_ref_type}@{target_ref:.*?}',
                  controller='compare', action='compare',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('pullrequest_home',
                  '/{repo_name}/pull-request/new', controller='pullrequests',
                  action='index', conditions={'function': check_repo,
                                              'method': ['GET']},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('pullrequest',
                  '/{repo_name}/pull-request/new', controller='pullrequests',
                  action='create', conditions={'function': check_repo,
                                               'method': ['POST']},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('pullrequest_repo_refs',
                  '/{repo_name}/pull-request/refs/{target_repo_name:.*?[^/]}',
                  controller='pullrequests',
                  action='get_repo_refs',
                  conditions={'function': check_repo, 'method': ['GET']},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('pullrequest_repo_destinations',
                  '/{repo_name}/pull-request/repo-destinations',
                  controller='pullrequests',
                  action='get_repo_destinations',
                  conditions={'function': check_repo, 'method': ['GET']},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('pullrequest_show',
                  '/{repo_name}/pull-request/{pull_request_id}',
                  controller='pullrequests',
                  action='show', conditions={'function': check_repo,
                                             'method': ['GET']},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('pullrequest_update',
                  '/{repo_name}/pull-request/{pull_request_id}',
                  controller='pullrequests',
                  action='update', conditions={'function': check_repo,
                                               'method': ['PUT']},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('pullrequest_merge',
                  '/{repo_name}/pull-request/{pull_request_id}',
                  controller='pullrequests',
                  action='merge', conditions={'function': check_repo,
                                              'method': ['POST']},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('pullrequest_delete',
                  '/{repo_name}/pull-request/{pull_request_id}',
                  controller='pullrequests',
                  action='delete', conditions={'function': check_repo,
                                               'method': ['DELETE']},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('pullrequest_comment',
                  '/{repo_name}/pull-request-comment/{pull_request_id}',
                  controller='pullrequests',
                  action='comment', conditions={'function': check_repo,
                                                'method': ['POST']},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('pullrequest_comment_delete',
                  '/{repo_name}/pull-request-comment/{comment_id}/delete',
                  controller='pullrequests', action='delete_comment',
                  conditions={'function': check_repo, 'method': ['DELETE']},
                  requirements=URL_NAME_REQUIREMENTS, jsroute=True)
 
     rmap.connect('repo_fork_create_home', '/{repo_name}/fork',
                  controller='forks', action='fork_create',
                  conditions={'function': check_repo, 'method': ['POST']},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('repo_fork_home', '/{repo_name}/fork',
                  controller='forks', action='fork',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     rmap.connect('repo_forks_home', '/{repo_name}/forks',
                  controller='forks', action='forks',
                  conditions={'function': check_repo},
                  requirements=URL_NAME_REQUIREMENTS)
 
     return rmap

rhodecode/model/permission.py

@@ -1,483 +1,484 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 permissions model for RhodeCode
 """
 
 
 import logging
 import traceback
 
 from sqlalchemy.exc import DatabaseError
 
 from rhodecode.model import BaseModel
 from rhodecode.model.db import (
     User, Permission, UserToPerm, UserRepoToPerm, UserRepoGroupToPerm,
     UserUserGroupToPerm, UserGroup, UserGroupToPerm)
 from rhodecode.lib.utils2 import str2bool, safe_int
 
 log = logging.getLogger(__name__)
 
 
 class PermissionModel(BaseModel):
     """
     Permissions model for RhodeCode
     """
 
     cls = Permission
     global_perms = {
         'default_repo_create': None,
         # special case for create repos on write access to group
         'default_repo_create_on_write': None,
         'default_repo_group_create': None,
         'default_user_group_create': None,
         'default_fork_create': None,
         'default_inherit_default_permissions': None,
         'default_register': None,
         'default_password_reset': None,
         'default_extern_activate': None,
 
         # object permissions below
         'default_repo_perm': None,
         'default_group_perm': None,
         'default_user_group_perm': None,
     }
 
     def set_global_permission_choices(self, c_obj, gettext_translator):
+        _ = gettext_translator
 
         c_obj.repo_perms_choices = [
-            ('repository.none', gettext_translator('None'),),
-            ('repository.read', gettext_translator('Read'),),
-            ('repository.write', gettext_translator('Write'),),
-            ('repository.admin', gettext_translator('Admin'),)]
+            ('repository.none', _('None'),),
+            ('repository.read', _('Read'),),
+            ('repository.write', _('Write'),),
+            ('repository.admin', _('Admin'),)]
 
         c_obj.group_perms_choices = [
-            ('group.none', gettext_translator('None'),),
-            ('group.read', gettext_translator('Read'),),
-            ('group.write', gettext_translator('Write'),),
-            ('group.admin', gettext_translator('Admin'),)]
+            ('group.none', _('None'),),
+            ('group.read', _('Read'),),
+            ('group.write', _('Write'),),
+            ('group.admin', _('Admin'),)]
 
         c_obj.user_group_perms_choices = [
-            ('usergroup.none', gettext_translator('None'),),
-            ('usergroup.read', gettext_translator('Read'),),
-            ('usergroup.write', gettext_translator('Write'),),
-            ('usergroup.admin', gettext_translator('Admin'),)]
+            ('usergroup.none', _('None'),),
+            ('usergroup.read', _('Read'),),
+            ('usergroup.write', _('Write'),),
+            ('usergroup.admin', _('Admin'),)]
 
         c_obj.register_choices = [
-            ('hg.register.none', gettext_translator('Disabled')),
-            ('hg.register.manual_activate', gettext_translator('Allowed with manual account activation')),
-            ('hg.register.auto_activate', gettext_translator('Allowed with automatic account activation')),]
+            ('hg.register.none', _('Disabled')),
+            ('hg.register.manual_activate', _('Allowed with manual account activation')),
+            ('hg.register.auto_activate', _('Allowed with automatic account activation')),]
 
         c_obj.password_reset_choices = [
-            ('hg.password_reset.enabled', gettext_translator('Allow password recovery')),
-            ('hg.password_reset.hidden', gettext_translator('Hide password recovery link')),
-            ('hg.password_reset.disabled', gettext_translator('Disable password recovery')),]
+            ('hg.password_reset.enabled', _('Allow password recovery')),
+            ('hg.password_reset.hidden', _('Hide password recovery link')),
+            ('hg.password_reset.disabled', _('Disable password recovery')),]
 
         c_obj.extern_activate_choices = [
-            ('hg.extern_activate.manual', gettext_translator('Manual activation of external account')),
-            ('hg.extern_activate.auto', gettext_translator('Automatic activation of external account')),]
+            ('hg.extern_activate.manual', _('Manual activation of external account')),
+            ('hg.extern_activate.auto', _('Automatic activation of external account')),]
 
         c_obj.repo_create_choices = [
-            ('hg.create.none', gettext_translator('Disabled')),
-            ('hg.create.repository', gettext_translator('Enabled'))]
+            ('hg.create.none', _('Disabled')),
+            ('hg.create.repository', _('Enabled'))]
 
         c_obj.repo_create_on_write_choices = [
-            ('hg.create.write_on_repogroup.false', gettext_translator('Disabled')),
-            ('hg.create.write_on_repogroup.true', gettext_translator('Enabled'))]
+            ('hg.create.write_on_repogroup.false', _('Disabled')),
+            ('hg.create.write_on_repogroup.true', _('Enabled'))]
 
         c_obj.user_group_create_choices = [
-            ('hg.usergroup.create.false', gettext_translator('Disabled')),
-            ('hg.usergroup.create.true', gettext_translator('Enabled'))]
+            ('hg.usergroup.create.false', _('Disabled')),
+            ('hg.usergroup.create.true', _('Enabled'))]
 
         c_obj.repo_group_create_choices = [
-            ('hg.repogroup.create.false', gettext_translator('Disabled')),
-            ('hg.repogroup.create.true', gettext_translator('Enabled'))]
+            ('hg.repogroup.create.false', _('Disabled')),
+            ('hg.repogroup.create.true', _('Enabled'))]
 
         c_obj.fork_choices = [
-            ('hg.fork.none', gettext_translator('Disabled')),
-            ('hg.fork.repository', gettext_translator('Enabled'))]
+            ('hg.fork.none', _('Disabled')),
+            ('hg.fork.repository', _('Enabled'))]
 
         c_obj.inherit_default_permission_choices = [
-            ('hg.inherit_default_perms.false', gettext_translator('Disabled')),
-            ('hg.inherit_default_perms.true', gettext_translator('Enabled'))]
+            ('hg.inherit_default_perms.false', _('Disabled')),
+            ('hg.inherit_default_perms.true', _('Enabled'))]
 
     def get_default_perms(self, object_perms, suffix):
         defaults = {}
         for perm in object_perms:
             # perms
             if perm.permission.permission_name.startswith('repository.'):
                 defaults['default_repo_perm' + suffix] = perm.permission.permission_name
 
             if perm.permission.permission_name.startswith('group.'):
                 defaults['default_group_perm' + suffix] = perm.permission.permission_name
 
             if perm.permission.permission_name.startswith('usergroup.'):
                 defaults['default_user_group_perm' + suffix] = perm.permission.permission_name
 
             # creation of objects
             if perm.permission.permission_name.startswith('hg.create.write_on_repogroup'):
                 defaults['default_repo_create_on_write' + suffix] = perm.permission.permission_name
 
             elif perm.permission.permission_name.startswith('hg.create.'):
                 defaults['default_repo_create' + suffix] = perm.permission.permission_name
 
             if perm.permission.permission_name.startswith('hg.fork.'):
                 defaults['default_fork_create' + suffix] = perm.permission.permission_name
 
             if perm.permission.permission_name.startswith('hg.inherit_default_perms.'):
                 defaults['default_inherit_default_permissions' + suffix] = perm.permission.permission_name
 
             if perm.permission.permission_name.startswith('hg.repogroup.'):
                 defaults['default_repo_group_create' + suffix] = perm.permission.permission_name
 
             if perm.permission.permission_name.startswith('hg.usergroup.'):
                 defaults['default_user_group_create' + suffix] = perm.permission.permission_name
 
             # registration and external account activation
             if perm.permission.permission_name.startswith('hg.register.'):
                 defaults['default_register' + suffix] = perm.permission.permission_name
 
             if perm.permission.permission_name.startswith('hg.password_reset.'):
                 defaults['default_password_reset' + suffix] = perm.permission.permission_name
 
             if perm.permission.permission_name.startswith('hg.extern_activate.'):
                 defaults['default_extern_activate' + suffix] = perm.permission.permission_name
 
         return defaults
 
     def _make_new_user_perm(self, user, perm_name):
         log.debug('Creating new user permission:%s', perm_name)
         new = UserToPerm()
         new.user = user
         new.permission = Permission.get_by_key(perm_name)
         return new
 
     def _make_new_user_group_perm(self, user_group, perm_name):
         log.debug('Creating new user group permission:%s', perm_name)
         new = UserGroupToPerm()
         new.users_group = user_group
         new.permission = Permission.get_by_key(perm_name)
         return new
 
     def _keep_perm(self, perm_name, keep_fields):
         def get_pat(field_name):
             return {
                 # global perms
                 'default_repo_create': 'hg.create.',
                 # special case for create repos on write access to group
                 'default_repo_create_on_write': 'hg.create.write_on_repogroup.',
                 'default_repo_group_create': 'hg.repogroup.create.',
                 'default_user_group_create': 'hg.usergroup.create.',
                 'default_fork_create': 'hg.fork.',
                 'default_inherit_default_permissions': 'hg.inherit_default_perms.',
 
                 # application perms
                 'default_register': 'hg.register.',
                 'default_password_reset': 'hg.password_reset.',
                 'default_extern_activate': 'hg.extern_activate.',
 
                 # object permissions below
                 'default_repo_perm': 'repository.',
                 'default_group_perm': 'group.',
                 'default_user_group_perm': 'usergroup.',
             }[field_name]
         for field in keep_fields:
             pat = get_pat(field)
             if perm_name.startswith(pat):
                 return True
         return False
 
     def _clear_object_perm(self, object_perms, preserve=None):
         preserve = preserve or []
         _deleted = []
         for perm in object_perms:
             perm_name = perm.permission.permission_name
             if not self._keep_perm(perm_name, keep_fields=preserve):
                 _deleted.append(perm_name)
                 self.sa.delete(perm)
         return _deleted
 
     def _clear_user_perms(self, user_id, preserve=None):
         perms = self.sa.query(UserToPerm)\
             .filter(UserToPerm.user_id == user_id)\
             .all()
         return self._clear_object_perm(perms, preserve=preserve)
 
     def _clear_user_group_perms(self, user_group_id, preserve=None):
         perms = self.sa.query(UserGroupToPerm)\
             .filter(UserGroupToPerm.users_group_id == user_group_id)\
             .all()
         return self._clear_object_perm(perms, preserve=preserve)
 
     def _set_new_object_perms(self, obj_type, object, form_result, preserve=None):
         # clear current entries, to make this function idempotent
         # it will fix even if we define more permissions or permissions
         # are somehow missing
         preserve = preserve or []
         _global_perms = self.global_perms.copy()
         if obj_type not in ['user', 'user_group']:
             raise ValueError("obj_type must be on of 'user' or 'user_group'")
         if len(_global_perms) != len(Permission.DEFAULT_USER_PERMISSIONS):
             raise Exception('Inconsistent permissions definition')
 
         if obj_type == 'user':
             self._clear_user_perms(object.user_id, preserve)
         if obj_type == 'user_group':
             self._clear_user_group_perms(object.users_group_id, preserve)
 
         # now kill the keys that we want to preserve from the form.
         for key in preserve:
             del _global_perms[key]
 
         for k in _global_perms.copy():
             _global_perms[k] = form_result[k]
 
         # at that stage we validate all are passed inside form_result
         for _perm_key, perm_value in _global_perms.items():
             if perm_value is None:
                 raise ValueError('Missing permission for %s' % (_perm_key,))
 
             if obj_type == 'user':
                 p = self._make_new_user_perm(object, perm_value)
                 self.sa.add(p)
             if obj_type == 'user_group':
                 p = self._make_new_user_group_perm(object, perm_value)
                 self.sa.add(p)
 
     def _set_new_user_perms(self, user, form_result, preserve=None):
         return self._set_new_object_perms(
             'user', user, form_result, preserve)
 
     def _set_new_user_group_perms(self, user_group, form_result, preserve=None):
         return self._set_new_object_perms(
             'user_group', user_group, form_result, preserve)
 
     def set_new_user_perms(self, user, form_result):
         # calculate what to preserve from what is given in form_result
         preserve = set(self.global_perms.keys()).difference(set(form_result.keys()))
         return self._set_new_user_perms(user, form_result, preserve)
 
     def set_new_user_group_perms(self, user_group, form_result):
         # calculate what to preserve from what is given in form_result
         preserve = set(self.global_perms.keys()).difference(set(form_result.keys()))
         return self._set_new_user_group_perms(user_group, form_result, preserve)
 
     def create_permissions(self):
         """
         Create permissions for whole system
         """
         for p in Permission.PERMS:
             if not Permission.get_by_key(p[0]):
                 new_perm = Permission()
                 new_perm.permission_name = p[0]
                 new_perm.permission_longname = p[0]  # translation err with p[1]
                 self.sa.add(new_perm)
 
     def _create_default_object_permission(self, obj_type, obj, obj_perms,
                                           force=False):
         if obj_type not in ['user', 'user_group']:
             raise ValueError("obj_type must be on of 'user' or 'user_group'")
 
         def _get_group(perm_name):
             return '.'.join(perm_name.split('.')[:1])
 
         defined_perms_groups = map(
             _get_group, (x.permission.permission_name for x in obj_perms))
         log.debug('GOT ALREADY DEFINED:%s', obj_perms)
 
         if force:
             self._clear_object_perm(obj_perms)
             self.sa.commit()
             defined_perms_groups = []
         # for every default permission that needs to be created, we check if
         # it's group is already defined, if it's not we create default perm
         for perm_name in Permission.DEFAULT_USER_PERMISSIONS:
             gr = _get_group(perm_name)
             if gr not in defined_perms_groups:
                 log.debug('GR:%s not found, creating permission %s',
                           gr, perm_name)
                 if obj_type == 'user':
                     new_perm = self._make_new_user_perm(obj, perm_name)
                     self.sa.add(new_perm)
                 if obj_type == 'user_group':
                     new_perm = self._make_new_user_group_perm(obj, perm_name)
                     self.sa.add(new_perm)
 
     def create_default_user_permissions(self, user, force=False):
         """
         Creates only missing default permissions for user, if force is set it
         resets the default permissions for that user
 
         :param user:
         :param force:
         """
         user = self._get_user(user)
         obj_perms = UserToPerm.query().filter(UserToPerm.user == user).all()
         return self._create_default_object_permission(
             'user', user, obj_perms, force)
 
     def create_default_user_group_permissions(self, user_group, force=False):
         """
         Creates only missing default permissions for user group, if force is set it
         resets the default permissions for that user group
 
         :param user_group:
         :param force:
         """
         user_group = self._get_user_group(user_group)
         obj_perms = UserToPerm.query().filter(UserGroupToPerm.users_group == user_group).all()
         return self._create_default_object_permission(
             'user_group', user_group, obj_perms, force)
 
     def update_application_permissions(self, form_result):
         if 'perm_user_id' in form_result:
             perm_user = User.get(safe_int(form_result['perm_user_id']))
         else:
             # used mostly to do lookup for default user
             perm_user = User.get_by_username(form_result['perm_user_name'])
 
         try:
             # stage 1 set anonymous access
             if perm_user.username == User.DEFAULT_USER:
                 perm_user.active = str2bool(form_result['anonymous'])
                 self.sa.add(perm_user)
 
             # stage 2 reset defaults and set them from form data
             self._set_new_user_perms(perm_user, form_result, preserve=[
                 'default_repo_perm',
                 'default_group_perm',
                 'default_user_group_perm',
 
                 'default_repo_group_create',
                 'default_user_group_create',
                 'default_repo_create_on_write',
                 'default_repo_create',
                 'default_fork_create',
                 'default_inherit_default_permissions',])
 
             self.sa.commit()
         except (DatabaseError,):
             log.error(traceback.format_exc())
             self.sa.rollback()
             raise
 
     def update_user_permissions(self, form_result):
         if 'perm_user_id' in form_result:
             perm_user = User.get(safe_int(form_result['perm_user_id']))
         else:
             # used mostly to do lookup for default user
             perm_user = User.get_by_username(form_result['perm_user_name'])
         try:
             # stage 2 reset defaults and set them from form data
             self._set_new_user_perms(perm_user, form_result, preserve=[
                 'default_repo_perm',
                 'default_group_perm',
                 'default_user_group_perm',
 
                 'default_register',
                 'default_password_reset',
                 'default_extern_activate'])
             self.sa.commit()
         except (DatabaseError,):
             log.error(traceback.format_exc())
             self.sa.rollback()
             raise
 
     def update_user_group_permissions(self, form_result):
         if 'perm_user_group_id' in form_result:
             perm_user_group = UserGroup.get(safe_int(form_result['perm_user_group_id']))
         else:
             # used mostly to do lookup for default user
             perm_user_group = UserGroup.get_by_group_name(form_result['perm_user_group_name'])
         try:
             # stage 2 reset defaults and set them from form data
             self._set_new_user_group_perms(perm_user_group, form_result, preserve=[
                 'default_repo_perm',
                 'default_group_perm',
                 'default_user_group_perm',
 
                 'default_register',
                 'default_password_reset',
                 'default_extern_activate'])
             self.sa.commit()
         except (DatabaseError,):
             log.error(traceback.format_exc())
             self.sa.rollback()
             raise
 
     def update_object_permissions(self, form_result):
         if 'perm_user_id' in form_result:
             perm_user = User.get(safe_int(form_result['perm_user_id']))
         else:
             # used mostly to do lookup for default user
             perm_user = User.get_by_username(form_result['perm_user_name'])
         try:
 
             # stage 2 reset defaults and set them from form data
             self._set_new_user_perms(perm_user, form_result, preserve=[
                 'default_repo_group_create',
                 'default_user_group_create',
                 'default_repo_create_on_write',
                 'default_repo_create',
                 'default_fork_create',
                 'default_inherit_default_permissions',
 
                 'default_register',
                 'default_password_reset',
                 'default_extern_activate'])
 
             # overwrite default repo permissions
             if form_result['overwrite_default_repo']:
                 _def_name = form_result['default_repo_perm'].split('repository.')[-1]
                 _def = Permission.get_by_key('repository.' + _def_name)
                 for r2p in self.sa.query(UserRepoToPerm)\
                                .filter(UserRepoToPerm.user == perm_user)\
                                .all():
                     # don't reset PRIVATE repositories
                     if not r2p.repository.private:
                         r2p.permission = _def
                         self.sa.add(r2p)
 
             # overwrite default repo group permissions
             if form_result['overwrite_default_group']:
                 _def_name = form_result['default_group_perm'].split('group.')[-1]
                 _def = Permission.get_by_key('group.' + _def_name)
                 for g2p in self.sa.query(UserRepoGroupToPerm)\
                                .filter(UserRepoGroupToPerm.user == perm_user)\
                                .all():
                     g2p.permission = _def
                     self.sa.add(g2p)
 
             # overwrite default user group permissions
             if form_result['overwrite_default_user_group']:
                 _def_name = form_result['default_user_group_perm'].split('usergroup.')[-1]
                 # user groups
                 _def = Permission.get_by_key('usergroup.' + _def_name)
                 for g2p in self.sa.query(UserUserGroupToPerm)\
                                .filter(UserUserGroupToPerm.user == perm_user)\
                                .all():
                     g2p.permission = _def
                     self.sa.add(g2p)
             self.sa.commit()
         except (DatabaseError,):
             log.exception('Failed to set default object permissions')
             self.sa.rollback()
             raise

rhodecode/public/js/rhodecode/routes.js

@@ -1,206 +1,213 b''
 
 /******************************************************************************
  *                                                                            *
  *                      DO NOT CHANGE THIS FILE MANUALLY                      *
  *                                                                            *
  *                                                                            *
  *        This file is automatically generated when the app starts up with    *
  *                         generate_js_files = true                           *
  *                                                                            *
  *  To add a route here pass jsroute=True to the route definition in the app  *
  *                                                                            *
  ******************************************************************************/
 function registerRCRoutes() {
     // routes registration
     pyroutes.register('new_repo', '/_admin/create_repository', []);
     pyroutes.register('edit_user', '/_admin/users/%(user_id)s/edit', ['user_id']);
     pyroutes.register('edit_user_group_members', '/_admin/user_groups/%(user_group_id)s/edit/members', ['user_group_id']);
     pyroutes.register('changeset_home', '/%(repo_name)s/changeset/%(revision)s', ['repo_name', 'revision']);
     pyroutes.register('changeset_comment', '/%(repo_name)s/changeset/%(revision)s/comment', ['repo_name', 'revision']);
     pyroutes.register('changeset_comment_preview', '/%(repo_name)s/changeset/comment/preview', ['repo_name']);
     pyroutes.register('changeset_comment_delete', '/%(repo_name)s/changeset/comment/%(comment_id)s/delete', ['repo_name', 'comment_id']);
     pyroutes.register('changeset_info', '/%(repo_name)s/changeset_info/%(revision)s', ['repo_name', 'revision']);
     pyroutes.register('compare_url', '/%(repo_name)s/compare/%(source_ref_type)s@%(source_ref)s...%(target_ref_type)s@%(target_ref)s', ['repo_name', 'source_ref_type', 'source_ref', 'target_ref_type', 'target_ref']);
     pyroutes.register('pullrequest_home', '/%(repo_name)s/pull-request/new', ['repo_name']);
     pyroutes.register('pullrequest', '/%(repo_name)s/pull-request/new', ['repo_name']);
     pyroutes.register('pullrequest_repo_refs', '/%(repo_name)s/pull-request/refs/%(target_repo_name)s', ['repo_name', 'target_repo_name']);
     pyroutes.register('pullrequest_repo_destinations', '/%(repo_name)s/pull-request/repo-destinations', ['repo_name']);
     pyroutes.register('pullrequest_show', '/%(repo_name)s/pull-request/%(pull_request_id)s', ['repo_name', 'pull_request_id']);
     pyroutes.register('pullrequest_update', '/%(repo_name)s/pull-request/%(pull_request_id)s', ['repo_name', 'pull_request_id']);
     pyroutes.register('pullrequest_comment', '/%(repo_name)s/pull-request-comment/%(pull_request_id)s', ['repo_name', 'pull_request_id']);
     pyroutes.register('pullrequest_comment_delete', '/%(repo_name)s/pull-request-comment/%(comment_id)s/delete', ['repo_name', 'comment_id']);
     pyroutes.register('favicon', '/favicon.ico', []);
     pyroutes.register('robots', '/robots.txt', []);
     pyroutes.register('auth_home', '/_admin/auth*traverse', []);
     pyroutes.register('global_integrations_new', '/_admin/integrations/new', []);
     pyroutes.register('global_integrations_home', '/_admin/integrations', []);
     pyroutes.register('global_integrations_list', '/_admin/integrations/%(integration)s', ['integration']);
     pyroutes.register('global_integrations_create', '/_admin/integrations/%(integration)s/new', ['integration']);
     pyroutes.register('global_integrations_edit', '/_admin/integrations/%(integration)s/%(integration_id)s', ['integration', 'integration_id']);
     pyroutes.register('repo_group_integrations_home', '/%(repo_group_name)s/settings/integrations', ['repo_group_name']);
     pyroutes.register('repo_group_integrations_list', '/%(repo_group_name)s/settings/integrations/%(integration)s', ['repo_group_name', 'integration']);
     pyroutes.register('repo_group_integrations_new', '/%(repo_group_name)s/settings/integrations/new', ['repo_group_name']);
     pyroutes.register('repo_group_integrations_create', '/%(repo_group_name)s/settings/integrations/%(integration)s/new', ['repo_group_name', 'integration']);
     pyroutes.register('repo_group_integrations_edit', '/%(repo_group_name)s/settings/integrations/%(integration)s/%(integration_id)s', ['repo_group_name', 'integration', 'integration_id']);
     pyroutes.register('repo_integrations_home', '/%(repo_name)s/settings/integrations', ['repo_name']);
     pyroutes.register('repo_integrations_list', '/%(repo_name)s/settings/integrations/%(integration)s', ['repo_name', 'integration']);
     pyroutes.register('repo_integrations_new', '/%(repo_name)s/settings/integrations/new', ['repo_name']);
     pyroutes.register('repo_integrations_create', '/%(repo_name)s/settings/integrations/%(integration)s/new', ['repo_name', 'integration']);
     pyroutes.register('repo_integrations_edit', '/%(repo_name)s/settings/integrations/%(integration)s/%(integration_id)s', ['repo_name', 'integration', 'integration_id']);
     pyroutes.register('ops_ping', '/_admin/ops/ping', []);
     pyroutes.register('ops_error_test', '/_admin/ops/error', []);
     pyroutes.register('ops_redirect_test', '/_admin/ops/redirect', []);
     pyroutes.register('admin_home', '/_admin', []);
     pyroutes.register('admin_audit_logs', '/_admin/audit_logs', []);
     pyroutes.register('pull_requests_global_0', '/_admin/pull_requests/%(pull_request_id)s', ['pull_request_id']);
     pyroutes.register('pull_requests_global_1', '/_admin/pull-requests/%(pull_request_id)s', ['pull_request_id']);
     pyroutes.register('pull_requests_global', '/_admin/pull-request/%(pull_request_id)s', ['pull_request_id']);
     pyroutes.register('admin_settings_open_source', '/_admin/settings/open_source', []);
     pyroutes.register('admin_settings_vcs_svn_generate_cfg', '/_admin/settings/vcs/svn_generate_cfg', []);
     pyroutes.register('admin_settings_system', '/_admin/settings/system', []);
     pyroutes.register('admin_settings_system_update', '/_admin/settings/system/updates', []);
     pyroutes.register('admin_settings_sessions', '/_admin/settings/sessions', []);
     pyroutes.register('admin_settings_sessions_cleanup', '/_admin/settings/sessions/cleanup', []);
     pyroutes.register('admin_settings_process_management', '/_admin/settings/process_management', []);
     pyroutes.register('admin_settings_process_management_signal', '/_admin/settings/process_management/signal', []);
+    pyroutes.register('admin_permissions_application', '/_admin/permissions/application', []);
+    pyroutes.register('admin_permissions_application_update', '/_admin/permissions/application/update', []);
+    pyroutes.register('admin_permissions_global', '/_admin/permissions/global', []);
+    pyroutes.register('admin_permissions_global_update', '/_admin/permissions/global/update', []);
+    pyroutes.register('admin_permissions_object', '/_admin/permissions/object', []);
+    pyroutes.register('admin_permissions_object_update', '/_admin/permissions/object/update', []);
     pyroutes.register('admin_permissions_ips', '/_admin/permissions/ips', []);
+    pyroutes.register('admin_permissions_overview', '/_admin/permissions/overview', []);
     pyroutes.register('users', '/_admin/users', []);
     pyroutes.register('users_data', '/_admin/users_data', []);
     pyroutes.register('edit_user_auth_tokens', '/_admin/users/%(user_id)s/edit/auth_tokens', ['user_id']);
     pyroutes.register('edit_user_auth_tokens_add', '/_admin/users/%(user_id)s/edit/auth_tokens/new', ['user_id']);
     pyroutes.register('edit_user_auth_tokens_delete', '/_admin/users/%(user_id)s/edit/auth_tokens/delete', ['user_id']);
     pyroutes.register('edit_user_emails', '/_admin/users/%(user_id)s/edit/emails', ['user_id']);
     pyroutes.register('edit_user_emails_add', '/_admin/users/%(user_id)s/edit/emails/new', ['user_id']);
     pyroutes.register('edit_user_emails_delete', '/_admin/users/%(user_id)s/edit/emails/delete', ['user_id']);
     pyroutes.register('edit_user_ips', '/_admin/users/%(user_id)s/edit/ips', ['user_id']);
     pyroutes.register('edit_user_ips_add', '/_admin/users/%(user_id)s/edit/ips/new', ['user_id']);
     pyroutes.register('edit_user_ips_delete', '/_admin/users/%(user_id)s/edit/ips/delete', ['user_id']);
     pyroutes.register('edit_user_groups_management', '/_admin/users/%(user_id)s/edit/groups_management', ['user_id']);
     pyroutes.register('edit_user_groups_management_updates', '/_admin/users/%(user_id)s/edit/edit_user_groups_management/updates', ['user_id']);
     pyroutes.register('edit_user_audit_logs', '/_admin/users/%(user_id)s/edit/audit', ['user_id']);
     pyroutes.register('channelstream_connect', '/_admin/channelstream/connect', []);
     pyroutes.register('channelstream_subscribe', '/_admin/channelstream/subscribe', []);
     pyroutes.register('channelstream_proxy', '/_channelstream', []);
     pyroutes.register('login', '/_admin/login', []);
     pyroutes.register('logout', '/_admin/logout', []);
     pyroutes.register('register', '/_admin/register', []);
     pyroutes.register('reset_password', '/_admin/password_reset', []);
     pyroutes.register('reset_password_confirmation', '/_admin/password_reset_confirmation', []);
     pyroutes.register('home', '/', []);
     pyroutes.register('user_autocomplete_data', '/_users', []);
     pyroutes.register('user_group_autocomplete_data', '/_user_groups', []);
     pyroutes.register('repo_list_data', '/_repos', []);
     pyroutes.register('goto_switcher_data', '/_goto_data', []);
     pyroutes.register('journal', '/_admin/journal', []);
     pyroutes.register('journal_rss', '/_admin/journal/rss', []);
     pyroutes.register('journal_atom', '/_admin/journal/atom', []);
     pyroutes.register('journal_public', '/_admin/public_journal', []);
     pyroutes.register('journal_public_atom', '/_admin/public_journal/atom', []);
     pyroutes.register('journal_public_atom_old', '/_admin/public_journal_atom', []);
     pyroutes.register('journal_public_rss', '/_admin/public_journal/rss', []);
     pyroutes.register('journal_public_rss_old', '/_admin/public_journal_rss', []);
     pyroutes.register('toggle_following', '/_admin/toggle_following', []);
     pyroutes.register('repo_summary_explicit', '/%(repo_name)s/summary', ['repo_name']);
     pyroutes.register('repo_summary_commits', '/%(repo_name)s/summary-commits', ['repo_name']);
     pyroutes.register('repo_commit', '/%(repo_name)s/changeset/%(commit_id)s', ['repo_name', 'commit_id']);
     pyroutes.register('repo_archivefile', '/%(repo_name)s/archive/%(fname)s', ['repo_name', 'fname']);
     pyroutes.register('repo_files_diff', '/%(repo_name)s/diff/%(f_path)s', ['repo_name', 'f_path']);
     pyroutes.register('repo_files_diff_2way_redirect', '/%(repo_name)s/diff-2way/%(f_path)s', ['repo_name', 'f_path']);
     pyroutes.register('repo_files', '/%(repo_name)s/files/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_files:default_path', '/%(repo_name)s/files/%(commit_id)s/', ['repo_name', 'commit_id']);
     pyroutes.register('repo_files:default_commit', '/%(repo_name)s/files', ['repo_name']);
     pyroutes.register('repo_files:rendered', '/%(repo_name)s/render/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_files:annotated', '/%(repo_name)s/annotate/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_files:annotated_previous', '/%(repo_name)s/annotate-previous/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_nodetree_full', '/%(repo_name)s/nodetree_full/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_nodetree_full:default_path', '/%(repo_name)s/nodetree_full/%(commit_id)s/', ['repo_name', 'commit_id']);
     pyroutes.register('repo_files_nodelist', '/%(repo_name)s/nodelist/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_file_raw', '/%(repo_name)s/raw/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_file_download', '/%(repo_name)s/download/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_file_download:legacy', '/%(repo_name)s/rawfile/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_file_history', '/%(repo_name)s/history/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_file_authors', '/%(repo_name)s/authors/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_files_remove_file', '/%(repo_name)s/remove_file/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_files_delete_file', '/%(repo_name)s/delete_file/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_files_edit_file', '/%(repo_name)s/edit_file/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_files_update_file', '/%(repo_name)s/update_file/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_files_add_file', '/%(repo_name)s/add_file/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_files_create_file', '/%(repo_name)s/create_file/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_refs_data', '/%(repo_name)s/refs-data', ['repo_name']);
     pyroutes.register('repo_refs_changelog_data', '/%(repo_name)s/refs-data-changelog', ['repo_name']);
     pyroutes.register('repo_stats', '/%(repo_name)s/repo_stats/%(commit_id)s', ['repo_name', 'commit_id']);
     pyroutes.register('repo_changelog', '/%(repo_name)s/changelog', ['repo_name']);
     pyroutes.register('repo_changelog_file', '/%(repo_name)s/changelog/%(commit_id)s/%(f_path)s', ['repo_name', 'commit_id', 'f_path']);
     pyroutes.register('repo_changelog_elements', '/%(repo_name)s/changelog_elements', ['repo_name']);
     pyroutes.register('tags_home', '/%(repo_name)s/tags', ['repo_name']);
     pyroutes.register('branches_home', '/%(repo_name)s/branches', ['repo_name']);
     pyroutes.register('bookmarks_home', '/%(repo_name)s/bookmarks', ['repo_name']);
     pyroutes.register('pullrequest_show', '/%(repo_name)s/pull-request/%(pull_request_id)s', ['repo_name', 'pull_request_id']);
     pyroutes.register('pullrequest_show_all', '/%(repo_name)s/pull-request', ['repo_name']);
     pyroutes.register('pullrequest_show_all_data', '/%(repo_name)s/pull-request-data', ['repo_name']);
     pyroutes.register('changeset_home', '/%(repo_name)s/changeset/%(revision)s', ['repo_name', 'revision']);
     pyroutes.register('changeset_children', '/%(repo_name)s/changeset_children/%(revision)s', ['repo_name', 'revision']);
     pyroutes.register('changeset_parents', '/%(repo_name)s/changeset_parents/%(revision)s', ['repo_name', 'revision']);
     pyroutes.register('edit_repo', '/%(repo_name)s/settings', ['repo_name']);
     pyroutes.register('edit_repo_advanced', '/%(repo_name)s/settings/advanced', ['repo_name']);
     pyroutes.register('edit_repo_advanced_delete', '/%(repo_name)s/settings/advanced/delete', ['repo_name']);
     pyroutes.register('edit_repo_advanced_locking', '/%(repo_name)s/settings/advanced/locking', ['repo_name']);
     pyroutes.register('edit_repo_advanced_journal', '/%(repo_name)s/settings/advanced/journal', ['repo_name']);
     pyroutes.register('edit_repo_advanced_fork', '/%(repo_name)s/settings/advanced/fork', ['repo_name']);
     pyroutes.register('edit_repo_caches', '/%(repo_name)s/settings/caches', ['repo_name']);
     pyroutes.register('edit_repo_perms', '/%(repo_name)s/settings/permissions', ['repo_name']);
     pyroutes.register('repo_reviewers', '/%(repo_name)s/settings/review/rules', ['repo_name']);
     pyroutes.register('repo_default_reviewers_data', '/%(repo_name)s/settings/review/default-reviewers', ['repo_name']);
     pyroutes.register('repo_maintenance', '/%(repo_name)s/settings/maintenance', ['repo_name']);
     pyroutes.register('repo_maintenance_execute', '/%(repo_name)s/settings/maintenance/execute', ['repo_name']);
     pyroutes.register('strip', '/%(repo_name)s/settings/strip', ['repo_name']);
     pyroutes.register('strip_check', '/%(repo_name)s/settings/strip_check', ['repo_name']);
     pyroutes.register('strip_execute', '/%(repo_name)s/settings/strip_execute', ['repo_name']);
     pyroutes.register('rss_feed_home', '/%(repo_name)s/feed/rss', ['repo_name']);
     pyroutes.register('atom_feed_home', '/%(repo_name)s/feed/atom', ['repo_name']);
     pyroutes.register('repo_summary', '/%(repo_name)s', ['repo_name']);
     pyroutes.register('repo_summary_slash', '/%(repo_name)s/', ['repo_name']);
     pyroutes.register('repo_group_home', '/%(repo_group_name)s', ['repo_group_name']);
     pyroutes.register('repo_group_home_slash', '/%(repo_group_name)s/', ['repo_group_name']);
     pyroutes.register('search', '/_admin/search', []);
     pyroutes.register('search_repo', '/%(repo_name)s/search', ['repo_name']);
     pyroutes.register('user_profile', '/_profiles/%(username)s', ['username']);
     pyroutes.register('my_account_profile', '/_admin/my_account/profile', []);
     pyroutes.register('my_account_edit', '/_admin/my_account/edit', []);
     pyroutes.register('my_account_update', '/_admin/my_account/update', []);
     pyroutes.register('my_account_password', '/_admin/my_account/password', []);
     pyroutes.register('my_account_password_update', '/_admin/my_account/password', []);
     pyroutes.register('my_account_auth_tokens', '/_admin/my_account/auth_tokens', []);
     pyroutes.register('my_account_auth_tokens_add', '/_admin/my_account/auth_tokens/new', []);
     pyroutes.register('my_account_auth_tokens_delete', '/_admin/my_account/auth_tokens/delete', []);
     pyroutes.register('my_account_emails', '/_admin/my_account/emails', []);
     pyroutes.register('my_account_emails_add', '/_admin/my_account/emails/new', []);
     pyroutes.register('my_account_emails_delete', '/_admin/my_account/emails/delete', []);
     pyroutes.register('my_account_repos', '/_admin/my_account/repos', []);
     pyroutes.register('my_account_watched', '/_admin/my_account/watched', []);
     pyroutes.register('my_account_perms', '/_admin/my_account/perms', []);
     pyroutes.register('my_account_notifications', '/_admin/my_account/notifications', []);
     pyroutes.register('my_account_notifications_toggle_visibility', '/_admin/my_account/toggle_visibility', []);
     pyroutes.register('my_account_pullrequests', '/_admin/my_account/pull_requests', []);
     pyroutes.register('my_account_pullrequests_data', '/_admin/my_account/pull_requests/data', []);
     pyroutes.register('notifications_show_all', '/_admin/notifications', []);
     pyroutes.register('notifications_mark_all_read', '/_admin/notifications/mark_all_read', []);
     pyroutes.register('notifications_show', '/_admin/notifications/%(notification_id)s', ['notification_id']);
     pyroutes.register('notifications_update', '/_admin/notifications/%(notification_id)s/update', ['notification_id']);
     pyroutes.register('notifications_delete', '/_admin/notifications/%(notification_id)s/delete', ['notification_id']);
     pyroutes.register('my_account_notifications_test_channelstream', '/_admin/my_account/test_channelstream', []);
     pyroutes.register('gists_show', '/_admin/gists', []);
     pyroutes.register('gists_new', '/_admin/gists/new', []);
     pyroutes.register('gists_create', '/_admin/gists/create', []);
     pyroutes.register('gist_show', '/_admin/gists/%(gist_id)s', ['gist_id']);
     pyroutes.register('gist_delete', '/_admin/gists/%(gist_id)s/delete', ['gist_id']);
     pyroutes.register('gist_edit', '/_admin/gists/%(gist_id)s/edit', ['gist_id']);
     pyroutes.register('gist_edit_check_revision', '/_admin/gists/%(gist_id)s/edit/check_revision', ['gist_id']);
     pyroutes.register('gist_update', '/_admin/gists/%(gist_id)s/update', ['gist_id']);
     pyroutes.register('gist_show_rev', '/_admin/gists/%(gist_id)s/%(revision)s', ['gist_id', 'revision']);
     pyroutes.register('gist_show_formatted', '/_admin/gists/%(gist_id)s/%(revision)s/%(format)s', ['gist_id', 'revision', 'format']);
     pyroutes.register('gist_show_formatted_path', '/_admin/gists/%(gist_id)s/%(revision)s/%(format)s/%(f_path)s', ['gist_id', 'revision', 'format', 'f_path']);
     pyroutes.register('debug_style_home', '/_admin/debug_style', []);
     pyroutes.register('debug_style_template', '/_admin/debug_style/t/%(t_path)s', ['t_path']);
     pyroutes.register('apiv2', '/_admin/api', []);
 }

rhodecode/templates/admin/permissions/permissions.mako

@@ -1,56 +1,56 b''
 ## -*- coding: utf-8 -*-
 <%inherit file="/base/base.mako"/>
 
 <%def name="title()">
     ${_('Permissions Administration')}
     %if c.rhodecode_name:
         &middot; ${h.branding(c.rhodecode_name)}
     %endif
 </%def>
 
 <%def name="breadcrumbs_links()">
     ${h.link_to(_('Admin'),h.route_path('admin_home'))}
     &raquo;
     ${_('Permissions')}
 </%def>
 
 <%def name="menu_bar_nav()">
     ${self.menu_items(active='admin')}
 </%def>
 
 
 <%def name="main()">
 <div class="box">
   <div class="title">
       ${self.breadcrumbs()}
   </div>
 
   <div class="sidebar-col-wrapper scw-small">
     ##main
     <div class="sidebar">
         <ul class="nav nav-pills nav-stacked">
           <li class="${'active' if c.active=='application' else ''}">
-            <a href="${h.url('admin_permissions_application')}">${_('Application')}</a>
+            <a href="${h.route_path('admin_permissions_application')}">${_('Application')}</a>
           </li>
           <li class="${'active' if c.active=='global' else ''}">
-            <a href="${h.url('admin_permissions_global')}">${_('Global')}</a>
+            <a href="${h.route_path('admin_permissions_global')}">${_('Global')}</a>
           </li>
           <li class="${'active' if c.active=='objects' else ''}">
-            <a href="${h.url('admin_permissions_object')}">${_('Object')}</a>
+            <a href="${h.route_path('admin_permissions_object')}">${_('Object')}</a>
           </li>
           <li class="${'active' if c.active=='ips' else ''}">
-            <a href="${h.url('admin_permissions_ips')}">${_('IP Whitelist')}</a>
+            <a href="${h.route_path('admin_permissions_ips')}">${_('IP Whitelist')}</a>
           </li>
           <li class="${'active' if c.active=='perms' else ''}">
-            <a href="${h.url('admin_permissions_overview')}">${_('Overview')}</a>
+            <a href="${h.route_path('admin_permissions_overview')}">${_('Overview')}</a>
           </li>
         </ul>
     </div>
 
     <div class="main-content-full-width">
         <%include file="/admin/permissions/permissions_${c.active}.mako"/>
     </div>
   </div>
 </div>
 
 </%def>

rhodecode/templates/admin/permissions/permissions_application.mako

@@ -1,81 +1,81 b''
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('System Wide Application Permissions')}</h3>
     </div>
     <div class="panel-body">
-        ${h.secure_form(h.url('admin_permissions_application'), method='post')}
+        ${h.secure_form(h.route_path('admin_permissions_application_update'), method='POST', request=request)}
             <div class="form">
                 <!-- fields -->
                 <div class="fields">
                     <div class="field">
                         <div class="label label-checkbox">
                             <label for="anonymous">${_('Anonymous Access')}:</label>
                         </div>
                         <div class="checkboxes">
                             <div class="checkbox">
                                 ${h.checkbox('anonymous',True)} Allow Anonymous Access
                             </div>
-                             <span class="help-block">${h.literal(_('Allow access to RhodeCode Enterprise without requiring users to login. Anonymous users get the %s permission settings.' % (h.link_to('"default user"',h.url('admin_permissions_object')))))}</span>
+                             <span class="help-block">${h.literal(_('Allow access to RhodeCode Enterprise without requiring users to login. Anonymous users get the %s permission settings.' % (h.link_to('"default user"',h.route_path('admin_permissions_object')))))}</span>
                         </div>
                     </div>
 
                     <div class="field">
                         <div class="label label-select">
                             <label for="default_register">${_('Registration')}:</label>
                         </div>
                         <div class="select">
                             ${h.select('default_register','',c.register_choices)}
                         </div>
                     </div>
 
                     <div class="field">
                         <div class="label label-select">
                             <label for="default_password_reset">${_('Password Reset')}:</label>
                         </div>
                         <div class="select">
                             ${h.select('default_password_reset','',c.password_reset_choices)}
                         </div>
                     </div>
 
                     <div class="field">
                         <div class="label label-textarea">
                             <label for="default_register_message">${_('Registration Page Message')}:</label>
                         </div>
                         <div class="textarea text-area editor" >
                             ${h.textarea('default_register_message', class_="medium", )}
                             <span class="help-block">${_('Custom message to be displayed on the registration page. HTML syntax is supported.')}</span>
                         </div>
                      </div>
 
                      <div class="field">
                         <div class="label">
                             <label for="default_extern_activate">${_('External Authentication Account Activation')}:</label>
                         </div>
                         <div class="select">
                             ${h.select('default_extern_activate','',c.extern_activate_choices)}
                         </div>
                      </div>
                     <div class="buttons">
                       ${h.submit('save',_('Save'),class_="btn")}
                       ${h.reset('reset',_('Reset'),class_="btn")}
                     </div>
                 </div>
             </div>
         ${h.end_form()}
     </div>
 </div>
 
 <script>
     $(document).ready(function(){
         var select2Options = {
             containerCssClass: 'drop-menu',
             dropdownCssClass: 'drop-menu-dropdown',
             dropdownAutoWidth: true,
             minimumResultsForSearch: -1
         };
 
         $("#default_register").select2(select2Options);
         $("#default_password_reset").select2(select2Options);
         $("#default_extern_activate").select2(select2Options);
     });
 </script>

rhodecode/templates/admin/permissions/permissions_global.mako

@@ -1,10 +1,10 b''
 
-${h.secure_form(h.url('admin_permissions_global'), method='post')}
+${h.secure_form(h.route_path('admin_permissions_global_update'), method='POST', request=request)}
     <div class="form permissions-global">
         <!-- fields -->
         <div class="fields">
             <%namespace name="dpb" file="/base/default_perms_box.mako"/>
             ${dpb.default_perms_radios(global_permissions_template = True)}
         </div>
     </div>
 ${h.end_form()}

rhodecode/templates/admin/permissions/permissions_ips.mako

@@ -1,67 +1,70 b''
 
 
 <div class="panel panel-default">
   <div class="panel-heading">
       <h3 class="panel-title">${_('Default IP Whitelist For All Users')}</h3>
   </div>
   <div class="panel-body">
     <div class="ips_wrap">
+    <h5>${_('Current IP address')}: <code>${c.rhodecode_user.ip_addr}</code></h5>
+
+
       <table class="rctable ip-whitelist">
         <tr>
           <th>IP Address</th>
           <th>IP Range</th>
           <th>Description</th>
           <th></th>
         </tr>
       %if c.user_ip_map:
         %for ip in c.user_ip_map:
           <tr>
               <td class="td-ip"><div class="ip">${ip.ip_addr}</div></td>
               <td class="td-iprange"><div class="ip">${h.ip_range(ip.ip_addr)}</div></td>
               <td class="td-description"><div class="ip">${ip.description}</div></td>
               <td class="td-action">
                 ${h.secure_form(h.route_path('edit_user_ips_delete', user_id=c.user.user_id), method='POST', request=request)}
                     ${h.hidden('del_ip_id',ip.ip_id)}
                     ${h.hidden('default_user', 'True')}
                     ${h.submit('remove_',_('Delete'),id="remove_ip_%s" % ip.ip_id,
                     class_="btn btn-link btn-danger", onclick="return confirm('"+_('Confirm to delete this ip: %s') % ip.ip_addr+"');")}
                 ${h.end_form()}
               </td>
           </tr>
         %endfor
        %else:
           <tr>
             <td class="ip">${_('All IP addresses are allowed')}</td>
             <td></td>
             <td></td>
             <td></td>
           </tr>
        %endif
       </table>
     </div>
 
     ${h.secure_form(h.route_path('edit_user_ips_add', user_id=c.user.user_id), method='POST', request=request)}
       <div class="form">
         <!-- fields -->
         <div class="fields">
           <div class="field">
             <div class="label">
               <label for="new_ip">${_('New IP Address')}:</label>
             </div>
             <div class="input">
               ${h.hidden('default_user', 'True')}
               ${h.text('new_ip')} ${h.text('description', placeholder=_('Description...'))}
               <span class="help-block">${_('Enter a comma separated list of IP Addresses like 127.0.0.1,\n'
                'or use an IP Address with a mask 127.0.0.1/24, to create a network range.\n'
                'To specify multiple addresses in a range, use the 127.0.0.1-127.0.0.10 syntax')}</span>
             </div>
            </div>
           <div class="buttons">
             ${h.submit('save',_('Add'),class_="btn")}
             ${h.reset('reset',_('Reset'),class_="btn")}
           </div>
         </div>
       </div>
     ${h.end_form()}
   </div>
 </div>

rhodecode/templates/admin/permissions/permissions_objects.mako

@@ -1,77 +1,77 b''
    <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Default Permissions for Repositories, User Groups and Repository Groups.')}</h3>
     </div>
     <div class="panel-body">
         <p>${_('Default system permissions. Each permissions management entity will be created with the following default settings. Check the overwrite checkbox to force any permission changes on already existing settings.')}
         </p>
-        ${h.secure_form(h.url('admin_permissions_object'), method='post')}
+        ${h.secure_form(h.route_path('admin_permissions_object_update'), method='POST', request=request)}
             <div class="form">
                 <div class="fields">
                     <div class="field">
                         <div class="label">
                             <label for="default_repo_perm">${_('Repository')}:</label>
                         </div>
                         <div class="select">
                             ${h.select('default_repo_perm','',c.repo_perms_choices)}
 
                             ${h.checkbox('overwrite_default_repo','true')}
                             <label for="overwrite_default_repo">
                                 <span class="tooltip" title="${h.tooltip(_('All default permissions on each repository will be reset to chosen permission, note that all custom default permission on repositories will be lost'))}">
                                     ${_('Overwrite Existing Settings')}
                                 </span>
                             </label>
                         </div>
                     </div>
                     <div class="field">
                         <div class="label">
                             <label for="default_group_perm">${_('Repository Groups')}:</label>
                         </div>
                         <div class="select">
                             ${h.select('default_group_perm','',c.group_perms_choices)}
                             ${h.checkbox('overwrite_default_group','true')}
                             <label for="overwrite_default_group">
                                 <span class="tooltip" title="${h.tooltip(_('All default permissions on each repository group will be reset to chosen permission, note that all custom default permission on repository groups will be lost'))}">
                                     ${_('Overwrite Existing Settings')}
                                 </span>
                             </label>
                         </div>
                     </div>
                     <div class="field">
                         <div class="label">
                             <label for="default_group_perm">${_('User Groups')}:</label>
                         </div>
                         <div class="select">
                             ${h.select('default_user_group_perm','',c.user_group_perms_choices)}
                             ${h.checkbox('overwrite_default_user_group','true')}
                             <label for="overwrite_default_user_group">
                                 <span class="tooltip" title="${h.tooltip(_('All default permissions on each user group will be reset to chosen permission, note that all custom default permission on repository groups will be lost'))}">
                                     ${_('Overwrite Existing Settings')}
                                 </span>
                             </label>
                         </div>
                     </div>
 
                     <div class="buttons">
                       ${h.submit('save',_('Save'),class_="btn")}
                       ${h.reset('reset',_('Reset'),class_="btn")}
                     </div>
                 </div>
             </div>
         ${h.end_form()}
     </div>
 </div>
 
 <script>
     $(document).ready(function(){
         var select2Options = {
             containerCssClass: 'drop-menu',
             dropdownCssClass: 'drop-menu-dropdown',
             dropdownAutoWidth: true,
             minimumResultsForSearch: -1
         };
         $("#default_repo_perm").select2(select2Options);
         $("#default_group_perm").select2(select2Options);
         $("#default_user_group_perm").select2(select2Options);
     });
 </script>

rhodecode/templates/admin/users/user_edit_ips.mako

@@ -1,78 +1,78 b''
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Custom IP Whitelist')}</h3>
     </div>
     <div class="panel-body">
         <div class="ips_wrap">
         <h5>${_('Current IP address')}: <code>${c.rhodecode_user.ip_addr}</code></h5>
   <table class="rctable ip-whitelist">
     <tr>
       <th>${_('IP Address')}</th>
       <th>${_('IP Range')}</th>
       <th>${_('Description')}</th>
       <th></th>
     </tr>
     %if c.default_user_ip_map and c.inherit_default_ips:
         %for ip in c.default_user_ip_map:
           <tr>
             <td class="td-ip"><div class="ip">${ip.ip_addr}</div></td>
             <td class="td-iprange"><div class="ip">${h.ip_range(ip.ip_addr)}</div></td>
-            <td class="td-description">${h.literal(_('Inherited from %s') % h.link_to('*default*',h.url('admin_permissions_ips')))}</td>
+            <td class="td-description">${h.literal(_('Inherited from %s') % h.link_to('*default*',h.route_path('admin_permissions_ips')))}</td>
             <td></td>
           </tr>
         %endfor
     %endif
 
     %if c.user_ip_map:
         %for ip in c.user_ip_map:
           <tr>
             <td class="td-ip"><div class="ip">${ip.ip_addr}</div></td>
             <td class="td-iprange"><div class="ip">${h.ip_range(ip.ip_addr)}</div></td>
             <td class="td-description"><div class="ip">${ip.description}</div></td>
             <td class="td-action">
                 ${h.secure_form(h.route_path('edit_user_ips_delete', user_id=c.user.user_id), method='POST', request=request)}
                     ${h.hidden('del_ip_id', ip.ip_id)}
                     ${h.submit('remove_', _('Delete'),id="remove_ip_%s" % ip.ip_id,
                     class_="btn btn-link btn-danger", onclick="return confirm('"+_('Confirm to delete this ip: %s') % ip.ip_addr+"');")}
                 ${h.end_form()}
             </td>
           </tr>
         %endfor
     %endif
     %if not c.default_user_ip_map and not c.user_ip_map:
         <tr>
           <td><h2 class="ip">${_('All IP addresses are allowed')}</h2></td>
           <td></td>
           <td></td>
           <td></td>
         </tr>
     %endif
   </table>
 </div>
 
         <div>
     ${h.secure_form(h.route_path('edit_user_ips_add', user_id=c.user.user_id), method='POST', request=request)}
     <div class="form">
         <!-- fields -->
         <div class="fields">
              <div class="field">
                 <div class="label">
                     <label for="new_ip">${_('New IP Address')}:</label>
                 </div>
                 <div class="input">
                     ${h.text('new_ip')} ${h.text('description', placeholder=_('Description...'))}
                     <span class="help-block">${_('Enter comma separated list of ip addresses like 127.0.0.1,\n'
                      'or use a ip address with a mask 127.0.0.1/24, to create a network range.\n'
                      'To specify multiple address range use 127.0.0.1-127.0.0.10 syntax')}</span>
                 </div>
              </div>
             <div class="buttons">
               ${h.submit('save',_('Add'),class_="btn btn-small")}
               ${h.reset('reset',_('Reset'),class_="btn btn-small")}
             </div>
         </div>
     </div>
     ${h.end_form()}
 </div>
     </div>
 </div>

rhodecode/templates/base/base.mako

@@ -1,600 +1,600 b''
 ## -*- coding: utf-8 -*-
 <%inherit file="root.mako"/>
 
 <div class="outerwrapper">
   <!-- HEADER -->
   <div class="header">
       <div id="header-inner" class="wrapper">
           <div id="logo">
               <div class="logo-wrapper">
                   <a href="${h.route_path('home')}"><img src="${h.asset('images/rhodecode-logo-white-216x60.png')}" alt="RhodeCode"/></a>
               </div>
               %if c.rhodecode_name:
                <div class="branding">- ${h.branding(c.rhodecode_name)}</div>
               %endif
           </div>
           <!-- MENU BAR NAV -->
           ${self.menu_bar_nav()}
           <!-- END MENU BAR NAV -->
       </div>
   </div>
   ${self.menu_bar_subnav()}
   <!-- END HEADER -->
 
   <!-- CONTENT -->
   <div id="content" class="wrapper">
 
       <rhodecode-toast id="notifications"></rhodecode-toast>
 
       <div class="main">
           ${next.main()}
       </div>
   </div>
   <!-- END CONTENT -->
 
 </div>
 <!-- FOOTER -->
 <div id="footer">
    <div id="footer-inner" class="title wrapper">
        <div>
            <p class="footer-link-right">
                % if c.visual.show_version:
                    RhodeCode Enterprise ${c.rhodecode_version} ${c.rhodecode_edition}
                % endif
                &copy; 2010-${h.datetime.today().year}, <a href="${h.route_url('rhodecode_official')}" target="_blank">RhodeCode GmbH</a>. All rights reserved.
                % if c.visual.rhodecode_support_url:
                   <a href="${c.visual.rhodecode_support_url}" target="_blank">${_('Support')}</a>
                % endif
            </p>
            <% sid = 'block' if request.GET.get('showrcid') else 'none' %>
            <p class="server-instance" style="display:${sid}">
                ## display hidden instance ID if specially defined
                % if c.rhodecode_instanceid:
                    ${_('RhodeCode instance id: %s') % c.rhodecode_instanceid}
                % endif
            </p>
        </div>
    </div>
 </div>
 
 <!-- END FOOTER -->
 
 ### MAKO DEFS ###
 
 <%def name="menu_bar_subnav()">
 </%def>
 
 <%def name="breadcrumbs(class_='breadcrumbs')">
     <div class="${class_}">
     ${self.breadcrumbs_links()}
     </div>
 </%def>
 
 <%def name="admin_menu()">
   <ul class="admin_menu submenu">
       <li><a href="${h.route_path('admin_audit_logs')}">${_('Admin audit logs')}</a></li>
       <li><a href="${h.url('repos')}">${_('Repositories')}</a></li>
       <li><a href="${h.url('repo_groups')}">${_('Repository groups')}</a></li>
       <li><a href="${h.route_path('users')}">${_('Users')}</a></li>
       <li><a href="${h.url('users_groups')}">${_('User groups')}</a></li>
-      <li><a href="${h.url('admin_permissions_application')}">${_('Permissions')}</a></li>
+      <li><a href="${h.route_path('admin_permissions_application')}">${_('Permissions')}</a></li>
       <li><a href="${h.route_path('auth_home', traverse='')}">${_('Authentication')}</a></li>
       <li><a href="${h.route_path('global_integrations_home')}">${_('Integrations')}</a></li>
       <li><a href="${h.url('admin_defaults_repositories')}">${_('Defaults')}</a></li>
       <li class="last"><a href="${h.url('admin_settings')}">${_('Settings')}</a></li>
   </ul>
 </%def>
 
 
 <%def name="dt_info_panel(elements)">
     <dl class="dl-horizontal">
     %for dt, dd, title, show_items in elements:
       <dt>${dt}:</dt>
       <dd title="${h.tooltip(title)}">
       %if callable(dd):
           ## allow lazy evaluation of elements
           ${dd()}
       %else:
           ${dd}
       %endif
       %if show_items:
           <span class="btn-collapse" data-toggle="item-${h.md5_safe(dt)[:6]}-details">${_('Show More')} </span>
       %endif
       </dd>
 
       %if show_items:
           <div class="collapsable-content" data-toggle="item-${h.md5_safe(dt)[:6]}-details" style="display: none">
           %for item in show_items:
               <dt></dt>
               <dd>${item}</dd>
           %endfor
           </div>
       %endif
 
     %endfor
     </dl>
 </%def>
 
 
 <%def name="gravatar(email, size=16)">
   <%
     if (size > 16):
         gravatar_class = 'gravatar gravatar-large'
     else:
         gravatar_class = 'gravatar'
   %>
   <%doc>
     TODO: johbo: For now we serve double size images to make it smooth
     for retina. This is how it worked until now. Should be replaced
     with a better solution at some point.
   </%doc>
   <img class="${gravatar_class}" src="${h.gravatar_url(email, size * 2)}" height="${size}" width="${size}">
 </%def>
 
 
 <%def name="gravatar_with_user(contact, size=16, show_disabled=False)">
   <% email = h.email_or_none(contact) %>
   <div class="rc-user tooltip" title="${h.tooltip(h.author_string(email))}">
     ${self.gravatar(email, size)}
     <span class="${'user user-disabled' if show_disabled else 'user'}"> ${h.link_to_user(contact)}</span>
   </div>
 </%def>
 
 
 ## admin menu used for people that have some admin resources
 <%def name="admin_menu_simple(repositories=None, repository_groups=None, user_groups=None)">
   <ul class="submenu">
    %if repositories:
       <li class="local-admin-repos"><a href="${h.url('repos')}">${_('Repositories')}</a></li>
    %endif
    %if repository_groups:
       <li class="local-admin-repo-groups"><a href="${h.url('repo_groups')}">${_('Repository groups')}</a></li>
    %endif
    %if user_groups:
       <li class="local-admin-user-groups"><a href="${h.url('users_groups')}">${_('User groups')}</a></li>
    %endif
   </ul>
 </%def>
 
 <%def name="repo_page_title(repo_instance)">
 <div class="title-content">
     <div class="title-main">
         ## SVN/HG/GIT icons
         %if h.is_hg(repo_instance):
             <i class="icon-hg"></i>
         %endif
         %if h.is_git(repo_instance):
             <i class="icon-git"></i>
         %endif
         %if h.is_svn(repo_instance):
             <i class="icon-svn"></i>
         %endif
 
         ## public/private
         %if repo_instance.private:
             <i class="icon-repo-private"></i>
         %else:
             <i class="icon-repo-public"></i>
         %endif
 
         ## repo name with group name
         ${h.breadcrumb_repo_link(c.rhodecode_db_repo)}
 
     </div>
 
     ## FORKED
     %if repo_instance.fork:
     <p>
         <i class="icon-code-fork"></i> ${_('Fork of')}
         <a href="${h.route_path('repo_summary',repo_name=repo_instance.fork.repo_name)}">${repo_instance.fork.repo_name}</a>
     </p>
     %endif
 
     ## IMPORTED FROM REMOTE
     %if repo_instance.clone_uri:
     <p>
        <i class="icon-code-fork"></i> ${_('Clone from')}
        <a href="${h.url(h.safe_str(h.hide_credentials(repo_instance.clone_uri)))}">${h.hide_credentials(repo_instance.clone_uri)}</a>
     </p>
     %endif
 
     ## LOCKING STATUS
      %if repo_instance.locked[0]:
        <p class="locking_locked">
            <i class="icon-repo-lock"></i>
            ${_('Repository locked by %(user)s') % {'user': h.person_by_id(repo_instance.locked[0])}}
        </p>
      %elif repo_instance.enable_locking:
          <p class="locking_unlocked">
              <i class="icon-repo-unlock"></i>
              ${_('Repository not locked. Pull repository to lock it.')}
          </p>
      %endif
 
 </div>
 </%def>
 
 <%def name="repo_menu(active=None)">
     <%
     def is_active(selected):
         if selected == active:
             return "active"
     %>
 
   <!--- CONTEXT BAR -->
   <div id="context-bar">
     <div class="wrapper">
       <ul id="context-pages" class="horizontal-list navigation">
         <li class="${is_active('summary')}"><a class="menulink" href="${h.route_path('repo_summary', repo_name=c.repo_name)}"><div class="menulabel">${_('Summary')}</div></a></li>
         <li class="${is_active('changelog')}"><a class="menulink" href="${h.route_path('repo_changelog', repo_name=c.repo_name)}"><div class="menulabel">${_('Changelog')}</div></a></li>
         <li class="${is_active('files')}"><a class="menulink" href="${h.route_path('repo_files', repo_name=c.repo_name, commit_id=c.rhodecode_db_repo.landing_rev[1], f_path='')}"><div class="menulabel">${_('Files')}</div></a></li>
         <li class="${is_active('compare')}">
             <a class="menulink" href="${h.url('compare_home',repo_name=c.repo_name)}"><div class="menulabel">${_('Compare')}</div></a>
         </li>
         ## TODO: anderson: ideally it would have a function on the scm_instance "enable_pullrequest() and enable_fork()"
         %if c.rhodecode_db_repo.repo_type in ['git','hg']:
           <li class="${is_active('showpullrequest')}">
             <a class="menulink" href="${h.route_path('pullrequest_show_all', repo_name=c.repo_name)}" title="${h.tooltip(_('Show Pull Requests for %s') % c.repo_name)}">
               %if c.repository_pull_requests:
                 <span class="pr_notifications">${c.repository_pull_requests}</span>
               %endif
               <div class="menulabel">${_('Pull Requests')}</div>
             </a>
           </li>
         %endif
         <li class="${is_active('options')}">
           <a class="menulink dropdown">
               <div class="menulabel">${_('Options')} <div class="show_more"></div></div>
           </a>
           <ul class="submenu">
              %if h.HasRepoPermissionAll('repository.admin')(c.repo_name):
                    <li><a href="${h.route_path('edit_repo',repo_name=c.repo_name)}">${_('Settings')}</a></li>
              %endif
               %if c.rhodecode_db_repo.fork:
                <li><a href="${h.url('compare_url',repo_name=c.rhodecode_db_repo.fork.repo_name,source_ref_type=c.rhodecode_db_repo.landing_rev[0],source_ref=c.rhodecode_db_repo.landing_rev[1], target_repo=c.repo_name,target_ref_type='branch' if request.GET.get('branch') else c.rhodecode_db_repo.landing_rev[0],target_ref=request.GET.get('branch') or c.rhodecode_db_repo.landing_rev[1], merge=1)}">
                    ${_('Compare fork')}</a></li>
               %endif
 
               <li><a href="${h.route_path('search_repo',repo_name=c.repo_name)}">${_('Search')}</a></li>
 
               %if h.HasRepoPermissionAny('repository.write','repository.admin')(c.repo_name) and c.rhodecode_db_repo.enable_locking:
                 %if c.rhodecode_db_repo.locked[0]:
                   <li><a class="locking_del" href="${h.url('toggle_locking',repo_name=c.repo_name)}">${_('Unlock')}</a></li>
                 %else:
                   <li><a class="locking_add" href="${h.url('toggle_locking',repo_name=c.repo_name)}">${_('Lock')}</a></li>
                 %endif
               %endif
               %if c.rhodecode_user.username != h.DEFAULT_USER:
                 %if c.rhodecode_db_repo.repo_type in ['git','hg']:
                   <li><a href="${h.url('repo_fork_home',repo_name=c.repo_name)}">${_('Fork')}</a></li>
                   <li><a href="${h.url('pullrequest_home',repo_name=c.repo_name)}">${_('Create Pull Request')}</a></li>
                 %endif
               %endif
              </ul>
         </li>
       </ul>
     </div>
     <div class="clear"></div>
   </div>
   <!--- END CONTEXT BAR -->
 
 </%def>
 
 <%def name="usermenu(active=False)">
     ## USER MENU
     <li id="quick_login_li" class="${'active' if active else ''}">
       <a id="quick_login_link" class="menulink childs">
         ${gravatar(c.rhodecode_user.email, 20)}
         <span class="user">
           %if c.rhodecode_user.username != h.DEFAULT_USER:
             <span class="menu_link_user">${c.rhodecode_user.username}</span><div class="show_more"></div>
           %else:
             <span>${_('Sign in')}</span>
           %endif
         </span>
       </a>
 
   <div class="user-menu submenu">
       <div id="quick_login">
         %if c.rhodecode_user.username == h.DEFAULT_USER:
             <h4>${_('Sign in to your account')}</h4>
             ${h.form(h.route_path('login', _query={'came_from': h.url.current()}), needs_csrf_token=False)}
             <div class="form form-vertical">
                 <div class="fields">
                     <div class="field">
                         <div class="label">
                             <label for="username">${_('Username')}:</label>
                         </div>
                         <div class="input">
                             ${h.text('username',class_='focus',tabindex=1)}
                         </div>
 
                     </div>
                     <div class="field">
                         <div class="label">
                             <label for="password">${_('Password')}:</label>
                             %if h.HasPermissionAny('hg.password_reset.enabled')():
                               <span class="forgot_password">${h.link_to(_('(Forgot password?)'),h.route_path('reset_password'), class_='pwd_reset')}</span>
                             %endif
                         </div>
                         <div class="input">
                             ${h.password('password',class_='focus',tabindex=2)}
                         </div>
                     </div>
                     <div class="buttons">
                         <div class="register">
                         %if h.HasPermissionAny('hg.admin', 'hg.register.auto_activate', 'hg.register.manual_activate')():
                          ${h.link_to(_("Don't have an account?"),h.route_path('register'))} <br/>
                         %endif
                         ${h.link_to(_("Using external auth? Sign In here."),h.route_path('login'))}
                         </div>
                         <div class="submit">
                             ${h.submit('sign_in',_('Sign In'),class_="btn btn-small",tabindex=3)}
                         </div>
                     </div>
                 </div>
             </div>
             ${h.end_form()}
         %else:
             <div class="">
                 <div class="big_gravatar">${gravatar(c.rhodecode_user.email, 48)}</div>
                 <div class="full_name">${c.rhodecode_user.full_name_or_username}</div>
                 <div class="email">${c.rhodecode_user.email}</div>
             </div>
             <div class="">
             <ol class="links">
               <li>${h.link_to(_(u'My account'),h.route_path('my_account_profile'))}</li>
               % if c.rhodecode_user.personal_repo_group:
                 <li>${h.link_to(_(u'My personal group'), h.route_path('repo_group_home', repo_group_name=c.rhodecode_user.personal_repo_group.group_name))}</li>
               % endif
               <li class="logout">
               ${h.secure_form(h.route_path('logout'), request=request)}
                   ${h.submit('log_out', _(u'Sign Out'),class_="btn btn-primary")}
               ${h.end_form()}
               </li>
             </ol>
             </div>
         %endif
       </div>
   </div>
       %if c.rhodecode_user.username != h.DEFAULT_USER:
         <div class="pill_container">
           <a class="menu_link_notifications ${'empty' if c.unread_notifications == 0 else ''}" href="${h.route_path('notifications_show_all')}">${c.unread_notifications}</a>
         </div>
       % endif
     </li>
 </%def>
 
 <%def name="menu_items(active=None)">
     <%
     def is_active(selected):
         if selected == active:
             return "active"
         return ""
     %>
     <ul id="quick" class="main_nav navigation horizontal-list">
       <!-- repo switcher -->
       <li class="${is_active('repositories')} repo_switcher_li has_select2">
         <input id="repo_switcher" name="repo_switcher" type="hidden">
       </li>
 
       ## ROOT MENU
       %if c.rhodecode_user.username != h.DEFAULT_USER:
         <li class="${is_active('journal')}">
           <a class="menulink" title="${_('Show activity journal')}" href="${h.route_path('journal')}">
             <div class="menulabel">${_('Journal')}</div>
           </a>
         </li>
       %else:
         <li class="${is_active('journal')}">
           <a class="menulink" title="${_('Show Public activity journal')}" href="${h.route_path('journal_public')}">
             <div class="menulabel">${_('Public journal')}</div>
           </a>
         </li>
       %endif
         <li class="${is_active('gists')}">
           <a class="menulink childs" title="${_('Show Gists')}" href="${h.route_path('gists_show')}">
             <div class="menulabel">${_('Gists')}</div>
           </a>
         </li>
       <li class="${is_active('search')}">
           <a class="menulink" title="${_('Search in repositories you have access to')}" href="${h.route_path('search')}">
             <div class="menulabel">${_('Search')}</div>
           </a>
       </li>
       % if h.HasPermissionAll('hg.admin')('access admin main page'):
         <li class="${is_active('admin')}">
           <a class="menulink childs" title="${_('Admin settings')}" href="#" onclick="return false;">
             <div class="menulabel">${_('Admin')} <div class="show_more"></div></div>
           </a>
           ${admin_menu()}
         </li>
       % elif c.rhodecode_user.repositories_admin or c.rhodecode_user.repository_groups_admin or c.rhodecode_user.user_groups_admin:
       <li class="${is_active('admin')}">
           <a class="menulink childs" title="${_('Delegated Admin settings')}">
             <div class="menulabel">${_('Admin')} <div class="show_more"></div></div>
           </a>
           ${admin_menu_simple(c.rhodecode_user.repositories_admin,
                               c.rhodecode_user.repository_groups_admin,
                               c.rhodecode_user.user_groups_admin or h.HasPermissionAny('hg.usergroup.create.true')())}
       </li>
       % endif
       % if c.debug_style:
       <li class="${is_active('debug_style')}">
           <a class="menulink" title="${_('Style')}" href="${h.route_path('debug_style_home')}">
             <div class="menulabel">${_('Style')}</div>
           </a>
       </li>
       % endif
       ## render extra user menu
       ${usermenu(active=(active=='my_account'))}
     </ul>
 
     <script type="text/javascript">
         var visual_show_public_icon = "${c.visual.show_public_icon}" == "True";
 
         /*format the look of items in the list*/
         var format = function(state, escapeMarkup){
             if (!state.id){
               return state.text; // optgroup
             }
             var obj_dict = state.obj;
             var tmpl = '';
 
             if(obj_dict && state.type == 'repo'){
                 if(obj_dict['repo_type'] === 'hg'){
                     tmpl += '<i class="icon-hg"></i> ';
                 }
                 else if(obj_dict['repo_type'] === 'git'){
                     tmpl += '<i class="icon-git"></i> ';
                 }
                 else if(obj_dict['repo_type'] === 'svn'){
                     tmpl += '<i class="icon-svn"></i> ';
                 }
                 if(obj_dict['private']){
                     tmpl += '<i class="icon-lock" ></i> ';
                 }
                 else if(visual_show_public_icon){
                     tmpl += '<i class="icon-unlock-alt"></i> ';
                 }
             }
             if(obj_dict && state.type == 'commit') {
                 tmpl += '<i class="icon-tag"></i>';
             }
             if(obj_dict && state.type == 'group'){
                 tmpl += '<i class="icon-folder-close"></i> ';
             }
             tmpl += escapeMarkup(state.text);
             return tmpl;
         };
 
         var formatResult = function(result, container, query, escapeMarkup) {
             return format(result, escapeMarkup);
         };
 
         var formatSelection = function(data, container, escapeMarkup) {
             return format(data, escapeMarkup);
         };
 
         $("#repo_switcher").select2({
             cachedDataSource: {},
             minimumInputLength: 2,
             placeholder: '<div class="menulabel">${_('Go to')} <div class="show_more"></div></div>',
             dropdownAutoWidth: true,
             formatResult: formatResult,
             formatSelection: formatSelection,
             containerCssClass: "repo-switcher",
             dropdownCssClass: "repo-switcher-dropdown",
             escapeMarkup: function(m){
                 // don't escape our custom placeholder
                 if(m.substr(0,23) == '<div class="menulabel">'){
                     return m;
                 }
 
                 return Select2.util.escapeMarkup(m);
             },
             query: $.debounce(250, function(query){
                 self = this;
                 var cacheKey = query.term;
                 var cachedData = self.cachedDataSource[cacheKey];
 
                 if (cachedData) {
                     query.callback({results: cachedData.results});
                 } else {
                     $.ajax({
                         url: pyroutes.url('goto_switcher_data'),
                         data: {'query': query.term},
                         dataType: 'json',
                         type: 'GET',
                         success: function(data) {
                             self.cachedDataSource[cacheKey] = data;
                             query.callback({results: data.results});
                         },
                         error: function(data, textStatus, errorThrown) {
                             alert("Error while fetching entries.\nError code {0} ({1}).".format(data.status, data.statusText));
                         }
                     })
                 }
             })
         });
 
         $("#repo_switcher").on('select2-selecting', function(e){
             e.preventDefault();
             window.location = e.choice.url;
         });
 
     </script>
     <script src="${h.asset('js/rhodecode/base/keyboard-bindings.js', ver=c.rhodecode_version_hash)}"></script>
 </%def>
 
 <div class="modal" id="help_kb" tabindex="-1" role="dialog" aria-labelledby="myModalLabel" aria-hidden="true">
     <div class="modal-dialog">
       <div class="modal-content">
         <div class="modal-header">
           <button type="button" class="close" data-dismiss="modal" aria-hidden="true">&times;</button>
           <h4 class="modal-title" id="myModalLabel">${_('Keyboard shortcuts')}</h4>
         </div>
         <div class="modal-body">
               <div class="block-left">
                 <table class="keyboard-mappings">
                     <tbody>
                   <tr>
                     <th></th>
                     <th>${_('Site-wide shortcuts')}</th>
                   </tr>
                   <%
                      elems = [
                          ('/', 'Open quick search box'),
                          ('g h', 'Goto home page'),
                          ('g g', 'Goto my private gists page'),
                          ('g G', 'Goto my public gists page'),
                          ('n r', 'New repository page'),
                          ('n g', 'New gist page'),
                      ]
                   %>
                   %for key, desc in elems:
                   <tr>
                     <td class="keys">
                       <span class="key tag">${key}</span>
                     </td>
                     <td>${desc}</td>
                   </tr>
                 %endfor
                 </tbody>
                   </table>
               </div>
               <div class="block-left">
                 <table class="keyboard-mappings">
                 <tbody>
                   <tr>
                     <th></th>
                     <th>${_('Repositories')}</th>
                   </tr>
                   <%
                      elems = [
                          ('g s', 'Goto summary page'),
                          ('g c', 'Goto changelog page'),
                          ('g f', 'Goto files page'),
                          ('g F', 'Goto files page with file search activated'),
                          ('g p', 'Goto pull requests page'),
                          ('g o', 'Goto repository settings'),
                          ('g O', 'Goto repository permissions settings'),
                      ]
                   %>
                   %for key, desc in elems:
                   <tr>
                     <td class="keys">
                       <span class="key tag">${key}</span>
                     </td>
                     <td>${desc}</td>
                   </tr>
                 %endfor
                 </tbody>
               </table>
             </div>
         </div>
         <div class="modal-footer">
         </div>
       </div><!-- /.modal-content -->
     </div><!-- /.modal-dialog -->
 </div><!-- /.modal -->

rhodecode/templates/base/default_perms_box.mako

@@ -1,156 +1,156 b''
 ## snippet for displaying default permission box
 ## usage:
 ##    <%namespace name="dpb" file="/base/default_perms_box.mako"/>
 ##    ${dpb.default_perms_box(<url_to_form>)}
 ##    ${dpb.default_perms_radios()}
 
 <%def name="default_perms_radios(global_permissions_template = False, suffix='', **kwargs)">
 <div class="main-content-full-width">
   <div class="panel panel-default">
 
     ## displayed according to checkbox selection
     <div class="panel-heading">
       %if not global_permissions_template:
         <h3 class="inherit_overlay_default panel-title">${_('Inherited Permissions')}</h3>
         <h3 class="inherit_overlay panel-title">${_('Custom Permissions')}</h3>
       %else:
         <h3 class="panel-title">${_('Default Global Permissions')}</h3>
       %endif
     </div>
 
     <div class="panel-body">
       %if global_permissions_template:
         <p>${_('The following options configure the default permissions each user or group will inherit. You can override these permissions for each individual user or user group using individual permissions settings.')}</p>
       %endif
         <div class="field">
            <div class="label">
                <label for="default_repo_create${suffix}">${_('Repository Creation')}:</label>
            </div>
            <div class="radios">
                ${h.radio('default_repo_create' + suffix, c.repo_create_choices[1][0], label=c.repo_create_choices[1][1], **kwargs)}
                ${h.radio('default_repo_create' + suffix, c.repo_create_choices[0][0], label=c.repo_create_choices[0][1], **kwargs)}
                <span class="help-block">${_('Permission to create root level repositories. When disabled, users can still create repositories inside their own repository groups.')}</span>
            </div>
         </div>
         <div class="field">
            <div class="label">
                <label for="default_repo_create_on_write${suffix}">${_('Repository Creation With Group Write Access')}:</label>
            </div>
            <div class="radios">
                ${h.radio('default_repo_create_on_write' + suffix, c.repo_create_on_write_choices[1][0], label=c.repo_create_on_write_choices[1][1], **kwargs)}
                ${h.radio('default_repo_create_on_write' + suffix, c.repo_create_on_write_choices[0][0], label=c.repo_create_on_write_choices[0][1], **kwargs)}
                <span class="help-block">${_('Write permission given on a repository group will allow creating repositories inside that group.')}</span>
            </div>
         </div>
         <div class="field">
            <div class="label">
                <label for="default_fork_create${suffix}">${_('Repository Forking')}:</label>
            </div>
            <div class="radios">
                ${h.radio('default_fork_create' + suffix, c.fork_choices[1][0], label=c.fork_choices[1][1], **kwargs)}
                ${h.radio('default_fork_create' + suffix, c.fork_choices[0][0], label=c.fork_choices[0][1], **kwargs)}
                <span class="help-block">${_('Permission to create root level repository forks. When disabled, users can still fork repositories inside their own repository groups.')}</span>
            </div>
         </div>
         <div class="field">
            <div class="label">
                <label for="default_repo_group_create${suffix}">${_('Repository Group Creation')}:</label>
            </div>
            <div class="radios">
                ${h.radio('default_repo_group_create' + suffix, c.repo_group_create_choices[1][0], label=c.repo_group_create_choices[1][1], **kwargs)}
                ${h.radio('default_repo_group_create' + suffix, c.repo_group_create_choices[0][0], label=c.repo_group_create_choices[0][1], **kwargs)}
                <span class="help-block">${_('Permission to create root level repository groups. When disabled, repository group admins can still create repository subgroups within their repository groups.')}</span>
            </div>
         </div>
         <div class="field">
            <div class="label">
                <label for="default_user_group_create${suffix}">${_('User Group Creation')}:</label>
            </div>
            <div class="radios">
                ${h.radio('default_user_group_create' + suffix, c.user_group_create_choices[1][0], label=c.user_group_create_choices[1][1], **kwargs)}
                ${h.radio('default_user_group_create' + suffix, c.user_group_create_choices[0][0], label=c.user_group_create_choices[0][1], **kwargs)}
                <span class="help-block">${_('Permission to allow user group creation.')}</span>
            </div>
         </div>
 
         <div class="field">
            <div class="label">
                <label for="default_inherit_default_permissions${suffix}">${_('Inherit Permissions From The Default User')}:</label>
            </div>
            <div class="radios">
                ${h.radio('default_inherit_default_permissions' + suffix, c.inherit_default_permission_choices[1][0], label=c.inherit_default_permission_choices[1][1], **kwargs)}
                ${h.radio('default_inherit_default_permissions' + suffix, c.inherit_default_permission_choices[0][0], label=c.inherit_default_permission_choices[0][1], **kwargs)}
                <span class="help-block">${_('Inherit default permissions from the default user. Turn off this option to force explicit permissions for users, even if they are more restrictive than the default user permissions.')}</span>
            </div>
         </div>
 
         <div class="buttons">
          ${h.submit('save',_('Save'),class_="btn")}
          ${h.reset('reset',_('Reset'),class_="btn")}
         </div>
     </div>
   </div>
 </div>
 </%def>
 
 <%def name="default_perms_box(form_url)">
   ${h.secure_form(form_url, method='put')}
     <div class="form">
       <div class="fields">
         <div class="field panel panel-default panel-body">
           <div class="label label-checkbox">
               <label for="inherit_default_permissions">${_('Inherit from default settings')}:</label>
           </div>
           <div class="checkboxes">
               ${h.checkbox('inherit_default_permissions',value=True)}
               <span class="help-block">
               ${h.literal(_('Select to inherit permissions from %s permissions settings, '
                             'including default IP address whitelist and inheritance of \npermission by members of user groups.')
-                          % h.link_to('default user', h.url('admin_permissions_global')))}
+                          % h.link_to('default user', h.route_path('admin_permissions_global')))}
               </span>
           </div>
         </div>
   
         ## INHERITED permissions == the user permissions in admin
         ## if inherit checkbox is set this is displayed in non-edit mode
         <div class="inherit_overlay_default">
             ${default_perms_radios(global_permissions_template = False, suffix='_inherited', disabled="disabled")}
         </div>
   
         ## CUSTOM permissions
         <div class="inherit_overlay">
             ${default_perms_radios(global_permissions_template = False)}
         </div>
       </div>
     </div>
   ${h.end_form()}
 
         
 ## JS
 <script>
 var show_custom_perms = function(inherit_default){
     if(inherit_default) {
         $('.inherit_overlay_default').show();
         $('.inherit_overlay').hide();
     }
     else {
         $('.inherit_overlay').show();
         $('.inherit_overlay_default').hide();
     }
 };
 $(document).ready(function(e){
     var inherit_checkbox = $('#inherit_default_permissions');
     var defaults = inherit_checkbox.prop('checked');
     show_custom_perms(defaults);
     inherit_checkbox.on('change', function(){
         if($(this).prop('checked')){
            show_custom_perms(true);
         }
         else{
            show_custom_perms(false);
         }
     })
 })
 </script>
 
 </%def>

rhodecode/templates/base/perms_summary.mako

@@ -1,207 +1,207 b''
 ## snippet for displaying permissions overview for users
 ## usage:
 ##    <%namespace name="p" file="/base/perms_summary.mako"/>
 ##    ${p.perms_summary(c.perm_user.permissions)}
 
 <%def name="perms_summary(permissions, show_all=False, actions=True)">
 <div id="perms" class="table fields">
   %for section in sorted(permissions.keys()):
   <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${section.replace("_"," ").capitalize()}</h3>
     </div>
     <div class="panel-body">
       <div class="perms_section_head field">
         <div class="radios">
           %if section != 'global':
               <span class="permissions_boxes">
               <span class="desc">${_('show')}: </span>
               ${h.checkbox('perms_filter_none_%s' % section, 'none', 'checked', class_='perm_filter filter_%s' % section, section=section, perm_type='none')}   <label for="${'perms_filter_none_%s' % section}"><span class="perm_tag none">${_('none')}</span></label>
               ${h.checkbox('perms_filter_read_%s' % section, 'read', 'checked', class_='perm_filter filter_%s' % section, section=section, perm_type='read')}   <label for="${'perms_filter_read_%s' % section}"><span class="perm_tag read">${_('read')}</span></label>
               ${h.checkbox('perms_filter_write_%s' % section, 'write', 'checked', class_='perm_filter filter_%s' % section, section=section, perm_type='write')} <label for="${'perms_filter_write_%s' % section}"> <span class="perm_tag write">${_('write')}</span></label>
               ${h.checkbox('perms_filter_admin_%s' % section, 'admin', 'checked', class_='perm_filter filter_%s' % section, section=section, perm_type='admin')} <label for="${'perms_filter_admin_%s' % section}"><span class="perm_tag admin">${_('admin')}</span></label>
               </span>
           %endif
         </div>
       </div>
       <div class="field">
         %if not permissions[section]:
             <p class="empty_data help-block">${_('No permissions defined')}</p>
         %else:
         <div id='tbl_list_wrap_${section}'>
          <table id="tbl_list_${section}" class="rctable">
           ## global permission box
           %if section == 'global':
             <thead>
                 <tr>
                 <th colspan="2" class="left">${_('Permission')}</th>
                 %if actions:
                 <th>${_('Edit Permission')}</th>
                 %endif
             </thead>
             <tbody>
 
             <%
               def get_section_perms(prefix, opts):
                   _selected = []
                   for op in opts:
                       if op.startswith(prefix) and not op.startswith('hg.create.write_on_repogroup'):
                           _selected.append(op)
                   admin = 'hg.admin' in opts
                   _selected_vals = [x.partition(prefix)[-1] for x in _selected]
                   return admin, _selected_vals, _selected
             %>
             <%def name="glob(lbl, val, val_lbl=None, custom_url=None)">
               <tr>
                 <td class="td-tags">
                     ${lbl}
                 </td>
                 <td class="td-tags">
                     %if val[0]:
                       %if not val_lbl:
                           ${h.bool2icon(True)}
                       %else:
                           <span class="perm_tag admin">${val_lbl}.admin</span>
                       %endif
                     %else:
                       %if not val_lbl:
                           ${h.bool2icon({'false': False,
                                          'true': True,
                                          'none': False,
                                          'repository': True}.get(val[1][0] if 0 < len(val[1]) else 'false'))}
                       %else:
                           <span class="perm_tag ${val[1][0]}">${val_lbl}.${val[1][0]}</span>
                       %endif
                     %endif
                 </td>
                 %if actions:
                 <td class="td-action">
-                     <a href="${custom_url or h.url('admin_permissions_global')}">${_('edit')}</a>
+                     <a href="${custom_url or h.route_path('admin_permissions_global')}">${_('edit')}</a>
                 </td>
                 %endif
               </tr>
             </%def>
 
            ${glob(_('Super admin'), get_section_perms('hg.admin', permissions[section]))}
 
-           ${glob(_('Repository default permission'), get_section_perms('repository.', permissions[section]), 'repository', h.url('admin_permissions_object'))}
-           ${glob(_('Repository group default permission'), get_section_perms('group.', permissions[section]), 'group', h.url('admin_permissions_object'))}
-           ${glob(_('User group default permission'), get_section_perms('usergroup.', permissions[section]), 'usergroup', h.url('admin_permissions_object'))}
+           ${glob(_('Repository default permission'), get_section_perms('repository.', permissions[section]), 'repository', h.route_path('admin_permissions_object'))}
+           ${glob(_('Repository group default permission'), get_section_perms('group.', permissions[section]), 'group', h.route_path('admin_permissions_object'))}
+           ${glob(_('User group default permission'), get_section_perms('usergroup.', permissions[section]), 'usergroup', h.route_path('admin_permissions_object'))}
 
-           ${glob(_('Create repositories'), get_section_perms('hg.create.', permissions[section]), custom_url=h.url('admin_permissions_global'))}
-           ${glob(_('Fork repositories'), get_section_perms('hg.fork.', permissions[section]), custom_url=h.url('admin_permissions_global'))}
-           ${glob(_('Create repository groups'), get_section_perms('hg.repogroup.create.', permissions[section]), custom_url=h.url('admin_permissions_global'))}
-           ${glob(_('Create user groups'), get_section_perms('hg.usergroup.create.', permissions[section]), custom_url=h.url('admin_permissions_global'))}
+           ${glob(_('Create repositories'), get_section_perms('hg.create.', permissions[section]), custom_url=h.route_path('admin_permissions_global'))}
+           ${glob(_('Fork repositories'), get_section_perms('hg.fork.', permissions[section]), custom_url=h.route_path('admin_permissions_global'))}
+           ${glob(_('Create repository groups'), get_section_perms('hg.repogroup.create.', permissions[section]), custom_url=h.route_path('admin_permissions_global'))}
+           ${glob(_('Create user groups'), get_section_perms('hg.usergroup.create.', permissions[section]), custom_url=h.route_path('admin_permissions_global'))}
 
 
            </tbody>
           %else:
            ## none/read/write/admin permissions on groups/repos etc
             <thead>
                 <tr>
                 <th>${_('Name')}</th>
                 <th>${_('Permission')}</th>
                 %if actions:
                 <th>${_('Edit Permission')}</th>
                 %endif
             </thead>
             <tbody class="section_${section}">
             <%
                 def sorter(permissions):
                     def custom_sorter(item):
                        ## read/write/admin
                        section = item[1].split('.')[-1]
                        section_importance = {'none': u'0',
                                              'read': u'1',
                                              'write':u'2',
                                              'admin':u'3'}.get(section)
                        ## sort by group importance+name
                        return section_importance+item[0]
                     return sorted(permissions, key=custom_sorter)
             %>
             %for k, section_perm in sorter(permissions[section].items()):
                 %if section_perm.split('.')[-1] != 'none' or show_all:
                 <tr class="perm_row ${'%s_%s' % (section, section_perm.split('.')[-1])}">
                     <td class="td-componentname">
                         %if section == 'repositories':
                             <a href="${h.route_path('repo_summary',repo_name=k)}">${k}</a>
                         %elif section == 'repositories_groups':
                             <a href="${h.route_path('repo_group_home', repo_group_name=k)}">${k}</a>
                         %elif section == 'user_groups':
                             ##<a href="${h.url('edit_users_group',user_group_id=k)}">${k}</a>
                             ${k}
                         %endif
                     </td>
                     <td class="td-tags">
                       %if hasattr(permissions[section], 'perm_origin_stack'):
                          %for i, (perm, origin) in enumerate(reversed(permissions[section].perm_origin_stack[k])):
                          <span class="${i > 0 and 'perm_overriden' or ''} perm_tag ${perm.split('.')[-1]}">
                           ${perm} (${origin})
                         </span>
                          %endfor
                       %else:
                          <span class="perm_tag ${section_perm.split('.')[-1]}">${section_perm}</span>
                       %endif
                     </td>
                     %if actions:
                     <td class="td-action">
                         %if section == 'repositories':
                             <a href="${h.route_path('edit_repo_perms',repo_name=k,anchor='permissions_manage')}">${_('edit')}</a>
                         %elif section == 'repositories_groups':
                             <a href="${h.url('edit_repo_group_perms',group_name=k,anchor='permissions_manage')}">${_('edit')}</a>
                         %elif section == 'user_groups':
                             ##<a href="${h.url('edit_users_group',user_group_id=k)}">${_('edit')}</a>
                         %endif
                     </td>
                     %endif
                 </tr>
                 %endif
             %endfor
 
             <tr id="empty_${section}" class="noborder" style="display:none;">
               <td colspan="6">${_('No permission defined')}</td>
             </tr>
 
             </tbody>
           %endif
          </table>
         </div>
         %endif
       </div>
     </div>
   </div>
   %endfor
 </div>
 
 <script>
     $(document).ready(function(){
         var show_empty = function(section){
             var visible = $('.section_{0} tr.perm_row:visible'.format(section)).length;
             if(visible == 0){
                 $('#empty_{0}'.format(section)).show();
             }
             else{
                 $('#empty_{0}'.format(section)).hide();
             }
         };
         $('.perm_filter').on('change', function(e){
             var self = this;
             var section = $(this).attr('section');
 
             var opts = {};
             var elems = $('.filter_' + section).each(function(el){
                 var perm_type = $(this).attr('perm_type');
                 var checked = this.checked;
                 opts[perm_type] = checked;
                 if(checked){
                     $('.'+section+'_'+perm_type).show();
                 }
                 else{
                     $('.'+section+'_'+perm_type).hide();
                 }
             });
             show_empty(section);
         })
     })
 </script>
 </%def>

rhodecode/tests/__init__.py

@@ -1,265 +1,265 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import os
 import time
 import logging
 import datetime
 import hashlib
 import tempfile
 from os.path import join as jn
 
 from tempfile import _RandomNameSequence
 
 from paste.deploy import loadapp
 from paste.script.appinstall import SetupCommand
 
 import pylons
 import pylons.test
 from pylons import config, url
 from pylons.i18n.translation import _get_translator
 from pylons.util import ContextObj
 
 from routes.util import URLGenerator
 from nose.plugins.skip import SkipTest
 import pytest
 
 from rhodecode import is_windows
 from rhodecode.config.routing import ADMIN_PREFIX
 from rhodecode.model.meta import Session
 from rhodecode.model.db import User
 from rhodecode.lib import auth
+from rhodecode.lib import helpers as h
 from rhodecode.lib.helpers import flash, link_to
 from rhodecode.lib.utils2 import safe_unicode, safe_str
 
 
 log = logging.getLogger(__name__)
 
 __all__ = [
     'get_new_dir', 'TestController', 'SkipTest',
     'url', 'link_to', 'ldap_lib_installed', 'clear_all_caches',
     'assert_session_flash', 'login_user', 'no_newline_id_generator',
     'TESTS_TMP_PATH', 'HG_REPO', 'GIT_REPO', 'SVN_REPO',
     'NEW_HG_REPO', 'NEW_GIT_REPO',
     'HG_FORK', 'GIT_FORK', 'TEST_USER_ADMIN_LOGIN', 'TEST_USER_ADMIN_PASS',
     'TEST_USER_REGULAR_LOGIN', 'TEST_USER_REGULAR_PASS',
     'TEST_USER_REGULAR_EMAIL', 'TEST_USER_REGULAR2_LOGIN',
     'TEST_USER_REGULAR2_PASS', 'TEST_USER_REGULAR2_EMAIL', 'TEST_HG_REPO',
     'TEST_HG_REPO_CLONE', 'TEST_HG_REPO_PULL', 'TEST_GIT_REPO',
     'TEST_GIT_REPO_CLONE', 'TEST_GIT_REPO_PULL', 'SCM_TESTS',
 ]
 
 # Invoke websetup with the current config file
 # SetupCommand('setup-app').run([config_file])
 
 # SOME GLOBALS FOR TESTS
 TEST_DIR = tempfile.gettempdir()
 
 TESTS_TMP_PATH = jn(TEST_DIR, 'rc_test_%s' % _RandomNameSequence().next())
 TEST_USER_ADMIN_LOGIN = 'test_admin'
 TEST_USER_ADMIN_PASS = 'test12'
 TEST_USER_ADMIN_EMAIL = '[e-mail]'
 
 TEST_USER_REGULAR_LOGIN = 'test_regular'
 TEST_USER_REGULAR_PASS = 'test12'
 TEST_USER_REGULAR_EMAIL = '[e-mail]'
 
 TEST_USER_REGULAR2_LOGIN = 'test_regular2'
 TEST_USER_REGULAR2_PASS = 'test12'
 TEST_USER_REGULAR2_EMAIL = '[e-mail]'
 
 HG_REPO = 'vcs_test_hg'
 GIT_REPO = 'vcs_test_git'
 SVN_REPO = 'vcs_test_svn'
 
 NEW_HG_REPO = 'vcs_test_hg_new'
 NEW_GIT_REPO = 'vcs_test_git_new'
 
 HG_FORK = 'vcs_test_hg_fork'
 GIT_FORK = 'vcs_test_git_fork'
 
 ## VCS
 SCM_TESTS = ['hg', 'git']
 uniq_suffix = str(int(time.mktime(datetime.datetime.now().timetuple())))
 
 TEST_GIT_REPO = jn(TESTS_TMP_PATH, GIT_REPO)
 TEST_GIT_REPO_CLONE = jn(TESTS_TMP_PATH, 'vcsgitclone%s' % uniq_suffix)
 TEST_GIT_REPO_PULL = jn(TESTS_TMP_PATH, 'vcsgitpull%s' % uniq_suffix)
 
 TEST_HG_REPO = jn(TESTS_TMP_PATH, HG_REPO)
 TEST_HG_REPO_CLONE = jn(TESTS_TMP_PATH, 'vcshgclone%s' % uniq_suffix)
 TEST_HG_REPO_PULL = jn(TESTS_TMP_PATH, 'vcshgpull%s' % uniq_suffix)
 
 TEST_REPO_PREFIX = 'vcs-test'
 
 
 # skip ldap tests if LDAP lib is not installed
 ldap_lib_installed = False
 try:
     import ldap
     ldap_lib_installed = True
 except ImportError:
     # means that python-ldap is not installed
     pass
 
 
 def clear_all_caches():
     from beaker.cache import cache_managers
     for _cache in cache_managers.values():
         _cache.clear()
 
 
 def get_new_dir(title):
     """
     Returns always new directory path.
     """
     from rhodecode.tests.vcs.utils import get_normalized_path
     name_parts = [TEST_REPO_PREFIX]
     if title:
         name_parts.append(title)
     hex_str = hashlib.sha1('%s %s' % (os.getpid(), time.time())).hexdigest()
     name_parts.append(hex_str)
     name = '-'.join(name_parts)
     path = os.path.join(TEST_DIR, name)
     return get_normalized_path(path)
 
 
 @pytest.mark.usefixtures('app', 'index_location')
 class TestController(object):
 
     maxDiff = None
 
     def log_user(self, username=TEST_USER_ADMIN_LOGIN,
                  password=TEST_USER_ADMIN_PASS):
         self._logged_username = username
         self._session = login_user_session(self.app, username, password)
         self.csrf_token = auth.get_csrf_token(self._session)
 
         return self._session['rhodecode_user']
 
     def logout_user(self):
         logout_user_session(self.app, auth.get_csrf_token(self._session))
         self.csrf_token = None
         self._logged_username = None
         self._session = None
 
     def _get_logged_user(self):
         return User.get_by_username(self._logged_username)
 
 
 def login_user_session(
         app, username=TEST_USER_ADMIN_LOGIN, password=TEST_USER_ADMIN_PASS):
-    from rhodecode.tests.functional.test_login import login_url
+
     response = app.post(
-        login_url,
+        h.route_path('login'),
         {'username': username, 'password': password})
     if 'invalid user name' in response.body:
         pytest.fail('could not login using %s %s' % (username, password))
 
     assert response.status == '302 Found'
     response = response.follow()
     assert response.status == '200 OK'
 
     session = response.get_session_from_response()
     assert 'rhodecode_user' in session
     rc_user = session['rhodecode_user']
     assert rc_user.get('username') == username
     assert rc_user.get('is_authenticated')
 
     return session
 
 
 def logout_user_session(app, csrf_token):
-    from rhodecode.tests.functional.test_login import logut_url
-    app.post(logut_url, {'csrf_token': csrf_token}, status=302)
+    app.post(h.route_path('logout'), {'csrf_token': csrf_token}, status=302)
 
 
 def login_user(app, username=TEST_USER_ADMIN_LOGIN,
                password=TEST_USER_ADMIN_PASS):
     return login_user_session(app, username, password)['rhodecode_user']
 
 
 def assert_session_flash(response=None, msg=None, category=None, no_=None):
     """
     Assert on a flash message in the current session.
 
     :param msg: Required. The expected message. Will be evaluated if a
         :class:`LazyString` is passed in.
     :param response: Optional. For functional testing, pass in the response
         object. Otherwise don't pass in any value.
     :param category: Optional. If passed, the message category will be
         checked as well.
     :param no_: Optional. If passed, the message will be checked to NOT be in the
         flash session
     """
     if msg is None and no_ is None:
         raise ValueError("Parameter msg or no_ is required.")
 
     if msg and no_:
         raise ValueError("Please specify either msg or no_, but not both")
 
     messages = flash.pop_messages()
     msg = _eval_if_lazy(msg)
 
     assert messages, 'unable to find message `%s` in empty flash list' % msg
     message = messages[0]
 
     message_text = _eval_if_lazy(message.message) or ''
 
     if no_:
         if no_ in message_text:
             msg = u'msg `%s` found in session flash.' % (no_,)
             pytest.fail(safe_str(msg))
     else:
         if msg not in message_text:
             fail_msg = u'msg `%s` not found in session ' \
                        u'flash: got `%s` (type:%s) instead' % (
                 msg, message_text, type(message_text))
 
             pytest.fail(safe_str(fail_msg))
         if category:
             assert category == message.category
 
 
 def _eval_if_lazy(value):
     return value.eval() if hasattr(value, 'eval') else value
 
 
 def assert_session_flash_is_empty(response):
     assert 'flash' in response.session, 'Response session has no flash key'
 
     msg = 'flash messages are present in session:%s' % \
           response.session['flash'][0]
     pytest.fail(safe_str(msg))
 
 
 def no_newline_id_generator(test_name):
     """
     Generates a test name without spaces or newlines characters. Used for
     nicer output of progress of test
     """
     org_name = test_name
     test_name = test_name\
         .replace('\n', '_N') \
         .replace('\r', '_N') \
         .replace('\t', '_T') \
         .replace(' ', '_S')
 
     return test_name or 'test-with-empty-name'

rhodecode/tests/functional/test_pullrequests.py

@@ -1,1107 +1,1106 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import mock
 import pytest
 from webob.exc import HTTPNotFound
 
 import rhodecode
 from rhodecode.lib.vcs.nodes import FileNode
 from rhodecode.lib import helpers as h
 from rhodecode.model.changeset_status import ChangesetStatusModel
 from rhodecode.model.db import (
     PullRequest, ChangesetStatus, UserLog, Notification, ChangesetComment)
 from rhodecode.model.meta import Session
 from rhodecode.model.pull_request import PullRequestModel
 from rhodecode.model.user import UserModel
 from rhodecode.tests import (
     assert_session_flash, url, TEST_USER_ADMIN_LOGIN, TEST_USER_REGULAR_LOGIN)
 from rhodecode.tests.utils import AssertResponse
 
 
 def route_path(name, params=None, **kwargs):
     import urllib
 
     base_url = {
         'repo_changelog':'/{repo_name}/changelog',
         'repo_changelog_file':'/{repo_name}/changelog/{commit_id}/{f_path}',
     }[name].format(**kwargs)
 
     if params:
         base_url = '{}?{}'.format(base_url, urllib.urlencode(params))
     return base_url
 
 
 @pytest.mark.usefixtures('app', 'autologin_user')
 @pytest.mark.backends("git", "hg")
 class TestPullrequestsController(object):
 
     def test_index(self, backend):
         self.app.get(url(
             controller='pullrequests', action='index',
             repo_name=backend.repo_name))
 
     def test_option_menu_create_pull_request_exists(self, backend):
         repo_name = backend.repo_name
         response = self.app.get(h.route_path('repo_summary', repo_name=repo_name))
 
         create_pr_link = '<a href="%s">Create Pull Request</a>' % url(
             'pullrequest', repo_name=repo_name)
         response.mustcontain(create_pr_link)
 
     def test_create_pr_form_with_raw_commit_id(self, backend):
         repo = backend.repo
 
         self.app.get(
             url(controller='pullrequests', action='index',
                 repo_name=repo.repo_name,
                 commit=repo.get_commit().raw_id),
             status=200)
 
     @pytest.mark.parametrize('pr_merge_enabled', [True, False])
     def test_show(self, pr_util, pr_merge_enabled):
         pull_request = pr_util.create_pull_request(
             mergeable=pr_merge_enabled, enable_notifications=False)
 
         response = self.app.get(url(
             controller='pullrequests', action='show',
             repo_name=pull_request.target_repo.scm_instance().name,
             pull_request_id=str(pull_request.pull_request_id)))
 
         for commit_id in pull_request.revisions:
             response.mustcontain(commit_id)
 
         assert pull_request.target_ref_parts.type in response
         assert pull_request.target_ref_parts.name in response
         target_clone_url = pull_request.target_repo.clone_url()
         assert target_clone_url in response
 
         assert 'class="pull-request-merge"' in response
         assert (
             'Server-side pull request merging is disabled.'
             in response) != pr_merge_enabled
 
     def test_close_status_visibility(self, pr_util, user_util, csrf_token):
-        from rhodecode.tests.functional.test_login import login_url, logut_url
         # Logout
         response = self.app.post(
-            logut_url,
+            h.route_path('logout'),
             params={'csrf_token': csrf_token})
         # Login as regular user
-        response = self.app.post(login_url,
+        response = self.app.post(h.route_path('login'),
                                  {'username': TEST_USER_REGULAR_LOGIN,
                                   'password': 'test12'})
 
         pull_request = pr_util.create_pull_request(
             author=TEST_USER_REGULAR_LOGIN)
 
         response = self.app.get(url(
             controller='pullrequests', action='show',
             repo_name=pull_request.target_repo.scm_instance().name,
             pull_request_id=str(pull_request.pull_request_id)))
 
         response.mustcontain('Server-side pull request merging is disabled.')
 
         assert_response = response.assert_response()
         # for regular user without a merge permissions, we don't see it
         assert_response.no_element_exists('#close-pull-request-action')
 
         user_util.grant_user_permission_to_repo(
             pull_request.target_repo,
             UserModel().get_by_username(TEST_USER_REGULAR_LOGIN),
             'repository.write')
         response = self.app.get(url(
             controller='pullrequests', action='show',
             repo_name=pull_request.target_repo.scm_instance().name,
             pull_request_id=str(pull_request.pull_request_id)))
 
         response.mustcontain('Server-side pull request merging is disabled.')
 
         assert_response = response.assert_response()
         # now regular user has a merge permissions, we have CLOSE button
         assert_response.one_element_exists('#close-pull-request-action')
 
     def test_show_invalid_commit_id(self, pr_util):
         # Simulating invalid revisions which will cause a lookup error
         pull_request = pr_util.create_pull_request()
         pull_request.revisions = ['invalid']
         Session().add(pull_request)
         Session().commit()
 
         response = self.app.get(url(
             controller='pullrequests', action='show',
             repo_name=pull_request.target_repo.scm_instance().name,
             pull_request_id=str(pull_request.pull_request_id)))
 
         for commit_id in pull_request.revisions:
             response.mustcontain(commit_id)
 
     def test_show_invalid_source_reference(self, pr_util):
         pull_request = pr_util.create_pull_request()
         pull_request.source_ref = 'branch:b:invalid'
         Session().add(pull_request)
         Session().commit()
 
         self.app.get(url(
             controller='pullrequests', action='show',
             repo_name=pull_request.target_repo.scm_instance().name,
             pull_request_id=str(pull_request.pull_request_id)))
 
     def test_edit_title_description(self, pr_util, csrf_token):
         pull_request = pr_util.create_pull_request()
         pull_request_id = pull_request.pull_request_id
 
         response = self.app.post(
             url(controller='pullrequests', action='update',
                 repo_name=pull_request.target_repo.repo_name,
                 pull_request_id=str(pull_request_id)),
             params={
                 'edit_pull_request': 'true',
                 '_method': 'put',
                 'title': 'New title',
                 'description': 'New description',
                 'csrf_token': csrf_token})
 
         assert_session_flash(
             response, u'Pull request title & description updated.',
             category='success')
 
         pull_request = PullRequest.get(pull_request_id)
         assert pull_request.title == 'New title'
         assert pull_request.description == 'New description'
 
     def test_edit_title_description_closed(self, pr_util, csrf_token):
         pull_request = pr_util.create_pull_request()
         pull_request_id = pull_request.pull_request_id
         pr_util.close()
 
         response = self.app.post(
             url(controller='pullrequests', action='update',
                 repo_name=pull_request.target_repo.repo_name,
                 pull_request_id=str(pull_request_id)),
             params={
                 'edit_pull_request': 'true',
                 '_method': 'put',
                 'title': 'New title',
                 'description': 'New description',
                 'csrf_token': csrf_token})
 
         assert_session_flash(
             response, u'Cannot update closed pull requests.',
             category='error')
 
     def test_update_invalid_source_reference(self, pr_util, csrf_token):
         from rhodecode.lib.vcs.backends.base import UpdateFailureReason
 
         pull_request = pr_util.create_pull_request()
         pull_request.source_ref = 'branch:invalid-branch:invalid-commit-id'
         Session().add(pull_request)
         Session().commit()
 
         pull_request_id = pull_request.pull_request_id
 
         response = self.app.post(
             url(controller='pullrequests', action='update',
                 repo_name=pull_request.target_repo.repo_name,
                 pull_request_id=str(pull_request_id)),
             params={'update_commits': 'true', '_method': 'put',
                     'csrf_token': csrf_token})
 
         expected_msg = PullRequestModel.UPDATE_STATUS_MESSAGES[
             UpdateFailureReason.MISSING_SOURCE_REF]
         assert_session_flash(response, expected_msg, category='error')
 
     def test_missing_target_reference(self, pr_util, csrf_token):
         from rhodecode.lib.vcs.backends.base import MergeFailureReason
         pull_request = pr_util.create_pull_request(
             approved=True, mergeable=True)
         pull_request.target_ref = 'branch:invalid-branch:invalid-commit-id'
         Session().add(pull_request)
         Session().commit()
 
         pull_request_id = pull_request.pull_request_id
         pull_request_url = url(
             controller='pullrequests', action='show',
             repo_name=pull_request.target_repo.repo_name,
             pull_request_id=str(pull_request_id))
 
         response = self.app.get(pull_request_url)
 
         assertr = AssertResponse(response)
         expected_msg = PullRequestModel.MERGE_STATUS_MESSAGES[
             MergeFailureReason.MISSING_TARGET_REF]
         assertr.element_contains(
             'span[data-role="merge-message"]', str(expected_msg))
 
     def test_comment_and_close_pull_request_custom_message_approved(
             self, pr_util, csrf_token, xhr_header):
 
         pull_request = pr_util.create_pull_request(approved=True)
         pull_request_id = pull_request.pull_request_id
         author = pull_request.user_id
         repo = pull_request.target_repo.repo_id
 
         self.app.post(
             url(controller='pullrequests',
                 action='comment',
                 repo_name=pull_request.target_repo.scm_instance().name,
                 pull_request_id=str(pull_request_id)),
             params={
                 'close_pull_request': '1',
                 'text': 'Closing a PR',
                 'csrf_token': csrf_token},
             extra_environ=xhr_header,)
 
         journal = UserLog.query()\
             .filter(UserLog.user_id == author)\
             .filter(UserLog.repository_id == repo) \
             .order_by('user_log_id') \
             .all()
         assert journal[-1].action == 'repo.pull_request.close'
 
         pull_request = PullRequest.get(pull_request_id)
         assert pull_request.is_closed()
 
         status = ChangesetStatusModel().get_status(
             pull_request.source_repo, pull_request=pull_request)
         assert status == ChangesetStatus.STATUS_APPROVED
         comments = ChangesetComment().query() \
             .filter(ChangesetComment.pull_request == pull_request) \
             .order_by(ChangesetComment.comment_id.asc())\
             .all()
         assert comments[-1].text == 'Closing a PR'
 
     def test_comment_force_close_pull_request_rejected(
             self, pr_util, csrf_token, xhr_header):
         pull_request = pr_util.create_pull_request()
         pull_request_id = pull_request.pull_request_id
         PullRequestModel().update_reviewers(
             pull_request_id, [(1, ['reason'], False), (2, ['reason2'], False)],
             pull_request.author)
         author = pull_request.user_id
         repo = pull_request.target_repo.repo_id
 
         self.app.post(
             url(controller='pullrequests',
                 action='comment',
                 repo_name=pull_request.target_repo.scm_instance().name,
                 pull_request_id=str(pull_request_id)),
             params={
                 'close_pull_request': '1',
                 'csrf_token': csrf_token},
             extra_environ=xhr_header)
 
         pull_request = PullRequest.get(pull_request_id)
 
         journal = UserLog.query()\
             .filter(UserLog.user_id == author, UserLog.repository_id == repo) \
             .order_by('user_log_id') \
             .all()
         assert journal[-1].action == 'repo.pull_request.close'
 
         # check only the latest status, not the review status
         status = ChangesetStatusModel().get_status(
             pull_request.source_repo, pull_request=pull_request)
         assert status == ChangesetStatus.STATUS_REJECTED
 
     def test_comment_and_close_pull_request(
             self, pr_util, csrf_token, xhr_header):
         pull_request = pr_util.create_pull_request()
         pull_request_id = pull_request.pull_request_id
 
         response = self.app.post(
             url(controller='pullrequests',
                 action='comment',
                 repo_name=pull_request.target_repo.scm_instance().name,
                 pull_request_id=str(pull_request.pull_request_id)),
             params={
                 'close_pull_request': 'true',
                 'csrf_token': csrf_token},
             extra_environ=xhr_header)
 
         assert response.json
 
         pull_request = PullRequest.get(pull_request_id)
         assert pull_request.is_closed()
 
         # check only the latest status, not the review status
         status = ChangesetStatusModel().get_status(
             pull_request.source_repo, pull_request=pull_request)
         assert status == ChangesetStatus.STATUS_REJECTED
 
     def test_create_pull_request(self, backend, csrf_token):
         commits = [
             {'message': 'ancestor'},
             {'message': 'change'},
             {'message': 'change2'},
         ]
         commit_ids = backend.create_master_repo(commits)
         target = backend.create_repo(heads=['ancestor'])
         source = backend.create_repo(heads=['change2'])
 
         response = self.app.post(
             url(
                 controller='pullrequests',
                 action='create',
                 repo_name=source.repo_name
             ),
             [
                 ('source_repo', source.repo_name),
                 ('source_ref', 'branch:default:' + commit_ids['change2']),
                 ('target_repo', target.repo_name),
                 ('target_ref',  'branch:default:' + commit_ids['ancestor']),
                 ('common_ancestor', commit_ids['ancestor']),
                 ('pullrequest_desc', 'Description'),
                 ('pullrequest_title', 'Title'),
                 ('__start__', 'review_members:sequence'),
                     ('__start__', 'reviewer:mapping'),
                         ('user_id', '1'),
                         ('__start__', 'reasons:sequence'),
                             ('reason', 'Some reason'),
                         ('__end__', 'reasons:sequence'),
                         ('mandatory', 'False'),
                     ('__end__', 'reviewer:mapping'),
                 ('__end__', 'review_members:sequence'),
                 ('__start__', 'revisions:sequence'),
                     ('revisions', commit_ids['change']),
                     ('revisions', commit_ids['change2']),
                 ('__end__', 'revisions:sequence'),
                 ('user', ''),
                 ('csrf_token', csrf_token),
             ],
             status=302)
 
         location = response.headers['Location']
         pull_request_id = location.rsplit('/', 1)[1]
         assert pull_request_id != 'new'
         pull_request = PullRequest.get(int(pull_request_id))
 
         # check that we have now both revisions
         assert pull_request.revisions == [commit_ids['change2'], commit_ids['change']]
         assert pull_request.source_ref == 'branch:default:' + commit_ids['change2']
         expected_target_ref = 'branch:default:' + commit_ids['ancestor']
         assert pull_request.target_ref == expected_target_ref
 
     def test_reviewer_notifications(self, backend, csrf_token):
         # We have to use the app.post for this test so it will create the
         # notifications properly with the new PR
         commits = [
             {'message': 'ancestor',
              'added': [FileNode('file_A', content='content_of_ancestor')]},
             {'message': 'change',
              'added': [FileNode('file_a', content='content_of_change')]},
             {'message': 'change-child'},
             {'message': 'ancestor-child', 'parents': ['ancestor'],
              'added': [
                 FileNode('file_B', content='content_of_ancestor_child')]},
             {'message': 'ancestor-child-2'},
         ]
         commit_ids = backend.create_master_repo(commits)
         target = backend.create_repo(heads=['ancestor-child'])
         source = backend.create_repo(heads=['change'])
 
         response = self.app.post(
             url(
                 controller='pullrequests',
                 action='create',
                 repo_name=source.repo_name
             ),
             [
                 ('source_repo', source.repo_name),
                 ('source_ref', 'branch:default:' + commit_ids['change']),
                 ('target_repo', target.repo_name),
                 ('target_ref',  'branch:default:' + commit_ids['ancestor-child']),
                 ('common_ancestor', commit_ids['ancestor']),
                 ('pullrequest_desc', 'Description'),
                 ('pullrequest_title', 'Title'),
                 ('__start__', 'review_members:sequence'),
                     ('__start__', 'reviewer:mapping'),
                         ('user_id', '2'),
                         ('__start__', 'reasons:sequence'),
                             ('reason', 'Some reason'),
                         ('__end__', 'reasons:sequence'),
                         ('mandatory', 'False'),
                     ('__end__', 'reviewer:mapping'),
                 ('__end__', 'review_members:sequence'),
                 ('__start__', 'revisions:sequence'),
                     ('revisions', commit_ids['change']),
                 ('__end__', 'revisions:sequence'),
                 ('user', ''),
                 ('csrf_token', csrf_token),
             ],
             status=302)
 
         location = response.headers['Location']
 
         pull_request_id = location.rsplit('/', 1)[1]
         assert pull_request_id != 'new'
         pull_request = PullRequest.get(int(pull_request_id))
 
         # Check that a notification was made
         notifications = Notification.query()\
             .filter(Notification.created_by == pull_request.author.user_id,
                     Notification.type_ == Notification.TYPE_PULL_REQUEST,
                     Notification.subject.contains(
                         "wants you to review pull request #%s" % pull_request_id))
         assert len(notifications.all()) == 1
 
         # Change reviewers and check that a notification was made
         PullRequestModel().update_reviewers(
             pull_request.pull_request_id, [(1, [], False)],
             pull_request.author)
         assert len(notifications.all()) == 2
 
     def test_create_pull_request_stores_ancestor_commit_id(self, backend,
                                                            csrf_token):
         commits = [
             {'message': 'ancestor',
              'added': [FileNode('file_A', content='content_of_ancestor')]},
             {'message': 'change',
              'added': [FileNode('file_a', content='content_of_change')]},
             {'message': 'change-child'},
             {'message': 'ancestor-child', 'parents': ['ancestor'],
              'added': [
                 FileNode('file_B', content='content_of_ancestor_child')]},
             {'message': 'ancestor-child-2'},
         ]
         commit_ids = backend.create_master_repo(commits)
         target = backend.create_repo(heads=['ancestor-child'])
         source = backend.create_repo(heads=['change'])
 
         response = self.app.post(
             url(
                 controller='pullrequests',
                 action='create',
                 repo_name=source.repo_name
             ),
             [
                 ('source_repo', source.repo_name),
                 ('source_ref', 'branch:default:' + commit_ids['change']),
                 ('target_repo', target.repo_name),
                 ('target_ref',  'branch:default:' + commit_ids['ancestor-child']),
                 ('common_ancestor', commit_ids['ancestor']),
                 ('pullrequest_desc', 'Description'),
                 ('pullrequest_title', 'Title'),
                 ('__start__', 'review_members:sequence'),
                     ('__start__', 'reviewer:mapping'),
                         ('user_id', '1'),
                         ('__start__', 'reasons:sequence'),
                             ('reason', 'Some reason'),
                         ('__end__', 'reasons:sequence'),
                         ('mandatory', 'False'),
                     ('__end__', 'reviewer:mapping'),
                 ('__end__', 'review_members:sequence'),
                 ('__start__', 'revisions:sequence'),
                     ('revisions', commit_ids['change']),
                 ('__end__', 'revisions:sequence'),
                 ('user', ''),
                 ('csrf_token', csrf_token),
             ],
             status=302)
 
         location = response.headers['Location']
 
         pull_request_id = location.rsplit('/', 1)[1]
         assert pull_request_id != 'new'
         pull_request = PullRequest.get(int(pull_request_id))
 
         # target_ref has to point to the ancestor's commit_id in order to
         # show the correct diff
         expected_target_ref = 'branch:default:' + commit_ids['ancestor']
         assert pull_request.target_ref == expected_target_ref
 
         # Check generated diff contents
         response = response.follow()
         assert 'content_of_ancestor' not in response.body
         assert 'content_of_ancestor-child' not in response.body
         assert 'content_of_change' in response.body
 
     def test_merge_pull_request_enabled(self, pr_util, csrf_token):
         # Clear any previous calls to rcextensions
         rhodecode.EXTENSIONS.calls.clear()
 
         pull_request = pr_util.create_pull_request(
             approved=True, mergeable=True)
         pull_request_id = pull_request.pull_request_id
         repo_name = pull_request.target_repo.scm_instance().name,
 
         response = self.app.post(
             url(controller='pullrequests',
                 action='merge',
                 repo_name=str(repo_name[0]),
                 pull_request_id=str(pull_request_id)),
             params={'csrf_token': csrf_token}).follow()
 
         pull_request = PullRequest.get(pull_request_id)
 
         assert response.status_int == 200
         assert pull_request.is_closed()
         assert_pull_request_status(
             pull_request, ChangesetStatus.STATUS_APPROVED)
 
         # Check the relevant log entries were added
         user_logs = UserLog.query().order_by('-user_log_id').limit(3)
         actions = [log.action for log in user_logs]
         pr_commit_ids = PullRequestModel()._get_commit_ids(pull_request)
         expected_actions = [
              u'repo.pull_request.close',
              u'repo.pull_request.merge',
              u'repo.pull_request.comment.create'
         ]
         assert actions == expected_actions
 
         user_logs = UserLog.query().order_by('-user_log_id').limit(4)
         actions = [log for log in user_logs]
         assert actions[-1].action == 'user.push'
         assert actions[-1].action_data['commit_ids'] == pr_commit_ids
 
         # Check post_push rcextension was really executed
         push_calls = rhodecode.EXTENSIONS.calls['post_push']
         assert len(push_calls) == 1
         unused_last_call_args, last_call_kwargs = push_calls[0]
         assert last_call_kwargs['action'] == 'push'
         assert last_call_kwargs['pushed_revs'] == pr_commit_ids
 
     def test_merge_pull_request_disabled(self, pr_util, csrf_token):
         pull_request = pr_util.create_pull_request(mergeable=False)
         pull_request_id = pull_request.pull_request_id
         pull_request = PullRequest.get(pull_request_id)
 
         response = self.app.post(
             url(controller='pullrequests',
                 action='merge',
                 repo_name=pull_request.target_repo.scm_instance().name,
                 pull_request_id=str(pull_request.pull_request_id)),
             params={'csrf_token': csrf_token}).follow()
 
         assert response.status_int == 200
         response.mustcontain(
             'Merge is not currently possible because of below failed checks.')
         response.mustcontain('Server-side pull request merging is disabled.')
 
     @pytest.mark.skip_backends('svn')
     def test_merge_pull_request_not_approved(self, pr_util, csrf_token):
         pull_request = pr_util.create_pull_request(mergeable=True)
         pull_request_id = pull_request.pull_request_id
         repo_name = pull_request.target_repo.scm_instance().name,
 
         response = self.app.post(
             url(controller='pullrequests',
                 action='merge',
                 repo_name=str(repo_name[0]),
                 pull_request_id=str(pull_request_id)),
             params={'csrf_token': csrf_token}).follow()
 
         assert response.status_int == 200
 
         response.mustcontain(
             'Merge is not currently possible because of below failed checks.')
         response.mustcontain('Pull request reviewer approval is pending.')
 
     def test_update_source_revision(self, backend, csrf_token):
         commits = [
             {'message': 'ancestor'},
             {'message': 'change'},
             {'message': 'change-2'},
         ]
         commit_ids = backend.create_master_repo(commits)
         target = backend.create_repo(heads=['ancestor'])
         source = backend.create_repo(heads=['change'])
 
         # create pr from a in source to A in target
         pull_request = PullRequest()
         pull_request.source_repo = source
         # TODO: johbo: Make sure that we write the source ref this way!
         pull_request.source_ref = 'branch:{branch}:{commit_id}'.format(
             branch=backend.default_branch_name, commit_id=commit_ids['change'])
         pull_request.target_repo = target
 
         pull_request.target_ref = 'branch:{branch}:{commit_id}'.format(
             branch=backend.default_branch_name,
             commit_id=commit_ids['ancestor'])
         pull_request.revisions = [commit_ids['change']]
         pull_request.title = u"Test"
         pull_request.description = u"Description"
         pull_request.author = UserModel().get_by_username(
             TEST_USER_ADMIN_LOGIN)
         Session().add(pull_request)
         Session().commit()
         pull_request_id = pull_request.pull_request_id
 
         # source has ancestor - change - change-2
         backend.pull_heads(source, heads=['change-2'])
 
         # update PR
         self.app.post(
             url(controller='pullrequests', action='update',
                 repo_name=target.repo_name,
                 pull_request_id=str(pull_request_id)),
             params={'update_commits': 'true', '_method': 'put',
                     'csrf_token': csrf_token})
 
         # check that we have now both revisions
         pull_request = PullRequest.get(pull_request_id)
         assert pull_request.revisions == [
             commit_ids['change-2'], commit_ids['change']]
 
         # TODO: johbo: this should be a test on its own
         response = self.app.get(url(
             controller='pullrequests', action='index',
             repo_name=target.repo_name))
         assert response.status_int == 200
         assert 'Pull request updated to' in response.body
         assert 'with 1 added, 0 removed commits.' in response.body
 
     def test_update_target_revision(self, backend, csrf_token):
         commits = [
             {'message': 'ancestor'},
             {'message': 'change'},
             {'message': 'ancestor-new', 'parents': ['ancestor']},
             {'message': 'change-rebased'},
         ]
         commit_ids = backend.create_master_repo(commits)
         target = backend.create_repo(heads=['ancestor'])
         source = backend.create_repo(heads=['change'])
 
         # create pr from a in source to A in target
         pull_request = PullRequest()
         pull_request.source_repo = source
         # TODO: johbo: Make sure that we write the source ref this way!
         pull_request.source_ref = 'branch:{branch}:{commit_id}'.format(
             branch=backend.default_branch_name, commit_id=commit_ids['change'])
         pull_request.target_repo = target
         # TODO: johbo: Target ref should be branch based, since tip can jump
         # from branch to branch
         pull_request.target_ref = 'branch:{branch}:{commit_id}'.format(
             branch=backend.default_branch_name,
             commit_id=commit_ids['ancestor'])
         pull_request.revisions = [commit_ids['change']]
         pull_request.title = u"Test"
         pull_request.description = u"Description"
         pull_request.author = UserModel().get_by_username(
             TEST_USER_ADMIN_LOGIN)
         Session().add(pull_request)
         Session().commit()
         pull_request_id = pull_request.pull_request_id
 
         # target has ancestor - ancestor-new
         # source has ancestor - ancestor-new - change-rebased
         backend.pull_heads(target, heads=['ancestor-new'])
         backend.pull_heads(source, heads=['change-rebased'])
 
         # update PR
         self.app.post(
             url(controller='pullrequests', action='update',
                 repo_name=target.repo_name,
                 pull_request_id=str(pull_request_id)),
             params={'update_commits': 'true', '_method': 'put',
                     'csrf_token': csrf_token},
             status=200)
 
         # check that we have now both revisions
         pull_request = PullRequest.get(pull_request_id)
         assert pull_request.revisions == [commit_ids['change-rebased']]
         assert pull_request.target_ref == 'branch:{branch}:{commit_id}'.format(
             branch=backend.default_branch_name,
             commit_id=commit_ids['ancestor-new'])
 
         # TODO: johbo: This should be a test on its own
         response = self.app.get(url(
             controller='pullrequests', action='index',
             repo_name=target.repo_name))
         assert response.status_int == 200
         assert 'Pull request updated to' in response.body
         assert 'with 1 added, 1 removed commits.' in response.body
 
     def test_update_of_ancestor_reference(self, backend, csrf_token):
         commits = [
             {'message': 'ancestor'},
             {'message': 'change'},
             {'message': 'change-2'},
             {'message': 'ancestor-new', 'parents': ['ancestor']},
             {'message': 'change-rebased'},
         ]
         commit_ids = backend.create_master_repo(commits)
         target = backend.create_repo(heads=['ancestor'])
         source = backend.create_repo(heads=['change'])
 
         # create pr from a in source to A in target
         pull_request = PullRequest()
         pull_request.source_repo = source
         # TODO: johbo: Make sure that we write the source ref this way!
         pull_request.source_ref = 'branch:{branch}:{commit_id}'.format(
             branch=backend.default_branch_name,
             commit_id=commit_ids['change'])
         pull_request.target_repo = target
         # TODO: johbo: Target ref should be branch based, since tip can jump
         # from branch to branch
         pull_request.target_ref = 'branch:{branch}:{commit_id}'.format(
             branch=backend.default_branch_name,
             commit_id=commit_ids['ancestor'])
         pull_request.revisions = [commit_ids['change']]
         pull_request.title = u"Test"
         pull_request.description = u"Description"
         pull_request.author = UserModel().get_by_username(
             TEST_USER_ADMIN_LOGIN)
         Session().add(pull_request)
         Session().commit()
         pull_request_id = pull_request.pull_request_id
 
         # target has ancestor - ancestor-new
         # source has ancestor - ancestor-new - change-rebased
         backend.pull_heads(target, heads=['ancestor-new'])
         backend.pull_heads(source, heads=['change-rebased'])
 
         # update PR
         self.app.post(
             url(controller='pullrequests', action='update',
                 repo_name=target.repo_name,
                 pull_request_id=str(pull_request_id)),
             params={'update_commits': 'true', '_method': 'put',
                     'csrf_token': csrf_token},
             status=200)
 
         # Expect the target reference to be updated correctly
         pull_request = PullRequest.get(pull_request_id)
         assert pull_request.revisions == [commit_ids['change-rebased']]
         expected_target_ref = 'branch:{branch}:{commit_id}'.format(
             branch=backend.default_branch_name,
             commit_id=commit_ids['ancestor-new'])
         assert pull_request.target_ref == expected_target_ref
 
     def test_remove_pull_request_branch(self, backend_git, csrf_token):
         branch_name = 'development'
         commits = [
             {'message': 'initial-commit'},
             {'message': 'old-feature'},
             {'message': 'new-feature', 'branch': branch_name},
         ]
         repo = backend_git.create_repo(commits)
         commit_ids = backend_git.commit_ids
 
         pull_request = PullRequest()
         pull_request.source_repo = repo
         pull_request.target_repo = repo
         pull_request.source_ref = 'branch:{branch}:{commit_id}'.format(
             branch=branch_name, commit_id=commit_ids['new-feature'])
         pull_request.target_ref = 'branch:{branch}:{commit_id}'.format(
             branch=backend_git.default_branch_name,
             commit_id=commit_ids['old-feature'])
         pull_request.revisions = [commit_ids['new-feature']]
         pull_request.title = u"Test"
         pull_request.description = u"Description"
         pull_request.author = UserModel().get_by_username(
             TEST_USER_ADMIN_LOGIN)
         Session().add(pull_request)
         Session().commit()
 
         vcs = repo.scm_instance()
         vcs.remove_ref('refs/heads/{}'.format(branch_name))
 
         response = self.app.get(url(
             controller='pullrequests', action='show',
             repo_name=repo.repo_name,
             pull_request_id=str(pull_request.pull_request_id)))
 
         assert response.status_int == 200
         assert_response = AssertResponse(response)
         assert_response.element_contains(
             '#changeset_compare_view_content .alert strong',
             'Missing commits')
         assert_response.element_contains(
             '#changeset_compare_view_content .alert',
             'This pull request cannot be displayed, because one or more'
             ' commits no longer exist in the source repository.')
 
     def test_strip_commits_from_pull_request(
             self, backend, pr_util, csrf_token):
         commits = [
             {'message': 'initial-commit'},
             {'message': 'old-feature'},
             {'message': 'new-feature', 'parents': ['initial-commit']},
         ]
         pull_request = pr_util.create_pull_request(
             commits, target_head='initial-commit', source_head='new-feature',
             revisions=['new-feature'])
 
         vcs = pr_util.source_repository.scm_instance()
         if backend.alias == 'git':
             vcs.strip(pr_util.commit_ids['new-feature'], branch_name='master')
         else:
             vcs.strip(pr_util.commit_ids['new-feature'])
 
         response = self.app.get(url(
             controller='pullrequests', action='show',
             repo_name=pr_util.target_repository.repo_name,
             pull_request_id=str(pull_request.pull_request_id)))
 
         assert response.status_int == 200
         assert_response = AssertResponse(response)
         assert_response.element_contains(
             '#changeset_compare_view_content .alert strong',
             'Missing commits')
         assert_response.element_contains(
             '#changeset_compare_view_content .alert',
             'This pull request cannot be displayed, because one or more'
             ' commits no longer exist in the source repository.')
         assert_response.element_contains(
             '#update_commits',
             'Update commits')
 
     def test_strip_commits_and_update(
             self, backend, pr_util, csrf_token):
         commits = [
             {'message': 'initial-commit'},
             {'message': 'old-feature'},
             {'message': 'new-feature', 'parents': ['old-feature']},
         ]
         pull_request = pr_util.create_pull_request(
             commits, target_head='old-feature', source_head='new-feature',
             revisions=['new-feature'], mergeable=True)
 
         vcs = pr_util.source_repository.scm_instance()
         if backend.alias == 'git':
             vcs.strip(pr_util.commit_ids['new-feature'], branch_name='master')
         else:
             vcs.strip(pr_util.commit_ids['new-feature'])
 
         response = self.app.post(
             url(controller='pullrequests', action='update',
                 repo_name=pull_request.target_repo.repo_name,
                 pull_request_id=str(pull_request.pull_request_id)),
             params={'update_commits': 'true', '_method': 'put',
                     'csrf_token': csrf_token})
 
         assert response.status_int == 200
         assert response.body == 'true'
 
         # Make sure that after update, it won't raise 500 errors
         response = self.app.get(url(
             controller='pullrequests', action='show',
             repo_name=pr_util.target_repository.repo_name,
             pull_request_id=str(pull_request.pull_request_id)))
 
         assert response.status_int == 200
         assert_response = AssertResponse(response)
         assert_response.element_contains(
             '#changeset_compare_view_content .alert strong',
             'Missing commits')
 
     def test_branch_is_a_link(self, pr_util):
         pull_request = pr_util.create_pull_request()
         pull_request.source_ref = 'branch:origin:1234567890abcdef'
         pull_request.target_ref = 'branch:target:abcdef1234567890'
         Session().add(pull_request)
         Session().commit()
 
         response = self.app.get(url(
             controller='pullrequests', action='show',
             repo_name=pull_request.target_repo.scm_instance().name,
             pull_request_id=str(pull_request.pull_request_id)))
         assert response.status_int == 200
         assert_response = AssertResponse(response)
 
         origin = assert_response.get_element('.pr-origininfo .tag')
         origin_children = origin.getchildren()
         assert len(origin_children) == 1
         target = assert_response.get_element('.pr-targetinfo .tag')
         target_children = target.getchildren()
         assert len(target_children) == 1
 
         expected_origin_link = route_path(
             'repo_changelog',
             repo_name=pull_request.source_repo.scm_instance().name,
             params=dict(branch='origin'))
         expected_target_link = route_path(
             'repo_changelog',
             repo_name=pull_request.target_repo.scm_instance().name,
             params=dict(branch='target'))
         assert origin_children[0].attrib['href'] == expected_origin_link
         assert origin_children[0].text == 'branch: origin'
         assert target_children[0].attrib['href'] == expected_target_link
         assert target_children[0].text == 'branch: target'
 
     def test_bookmark_is_not_a_link(self, pr_util):
         pull_request = pr_util.create_pull_request()
         pull_request.source_ref = 'bookmark:origin:1234567890abcdef'
         pull_request.target_ref = 'bookmark:target:abcdef1234567890'
         Session().add(pull_request)
         Session().commit()
 
         response = self.app.get(url(
             controller='pullrequests', action='show',
             repo_name=pull_request.target_repo.scm_instance().name,
             pull_request_id=str(pull_request.pull_request_id)))
         assert response.status_int == 200
         assert_response = AssertResponse(response)
 
         origin = assert_response.get_element('.pr-origininfo .tag')
         assert origin.text.strip() == 'bookmark: origin'
         assert origin.getchildren() == []
 
         target = assert_response.get_element('.pr-targetinfo .tag')
         assert target.text.strip() == 'bookmark: target'
         assert target.getchildren() == []
 
     def test_tag_is_not_a_link(self, pr_util):
         pull_request = pr_util.create_pull_request()
         pull_request.source_ref = 'tag:origin:1234567890abcdef'
         pull_request.target_ref = 'tag:target:abcdef1234567890'
         Session().add(pull_request)
         Session().commit()
 
         response = self.app.get(url(
             controller='pullrequests', action='show',
             repo_name=pull_request.target_repo.scm_instance().name,
             pull_request_id=str(pull_request.pull_request_id)))
         assert response.status_int == 200
         assert_response = AssertResponse(response)
 
         origin = assert_response.get_element('.pr-origininfo .tag')
         assert origin.text.strip() == 'tag: origin'
         assert origin.getchildren() == []
 
         target = assert_response.get_element('.pr-targetinfo .tag')
         assert target.text.strip() == 'tag: target'
         assert target.getchildren() == []
 
     @pytest.mark.parametrize('mergeable', [True, False])
     def test_shadow_repository_link(
             self, mergeable, pr_util, http_host_only_stub):
         """
         Check that the pull request summary page displays a link to the shadow
         repository if the pull request is mergeable. If it is not mergeable
         the link should not be displayed.
         """
         pull_request = pr_util.create_pull_request(
             mergeable=mergeable, enable_notifications=False)
         target_repo = pull_request.target_repo.scm_instance()
         pr_id = pull_request.pull_request_id
         shadow_url = '{host}/{repo}/pull-request/{pr_id}/repository'.format(
             host=http_host_only_stub, repo=target_repo.name, pr_id=pr_id)
 
         response = self.app.get(url(
             controller='pullrequests', action='show',
             repo_name=target_repo.name,
             pull_request_id=str(pr_id)))
 
         assertr = AssertResponse(response)
         if mergeable:
             assertr.element_value_contains(
                 'div.pr-mergeinfo input', shadow_url)
             assertr.element_value_contains(
                 'div.pr-mergeinfo input', 'pr-merge')
         else:
             assertr.no_element_exists('div.pr-mergeinfo')
 
 
 @pytest.mark.usefixtures('app')
 @pytest.mark.backends("git", "hg")
 class TestPullrequestsControllerDelete(object):
     def test_pull_request_delete_button_permissions_admin(
             self, autologin_user, user_admin, pr_util):
         pull_request = pr_util.create_pull_request(
             author=user_admin.username, enable_notifications=False)
 
         response = self.app.get(url(
             controller='pullrequests', action='show',
             repo_name=pull_request.target_repo.scm_instance().name,
             pull_request_id=str(pull_request.pull_request_id)))
 
         response.mustcontain('id="delete_pullrequest"')
         response.mustcontain('Confirm to delete this pull request')
 
     def test_pull_request_delete_button_permissions_owner(
             self, autologin_regular_user, user_regular, pr_util):
         pull_request = pr_util.create_pull_request(
             author=user_regular.username, enable_notifications=False)
 
         response = self.app.get(url(
             controller='pullrequests', action='show',
             repo_name=pull_request.target_repo.scm_instance().name,
             pull_request_id=str(pull_request.pull_request_id)))
 
         response.mustcontain('id="delete_pullrequest"')
         response.mustcontain('Confirm to delete this pull request')
 
     def test_pull_request_delete_button_permissions_forbidden(
             self, autologin_regular_user, user_regular, user_admin, pr_util):
         pull_request = pr_util.create_pull_request(
             author=user_admin.username, enable_notifications=False)
 
         response = self.app.get(url(
             controller='pullrequests', action='show',
             repo_name=pull_request.target_repo.scm_instance().name,
             pull_request_id=str(pull_request.pull_request_id)))
         response.mustcontain(no=['id="delete_pullrequest"'])
         response.mustcontain(no=['Confirm to delete this pull request'])
 
     def test_pull_request_delete_button_permissions_can_update_cannot_delete(
             self, autologin_regular_user, user_regular, user_admin, pr_util,
             user_util):
 
         pull_request = pr_util.create_pull_request(
             author=user_admin.username, enable_notifications=False)
 
         user_util.grant_user_permission_to_repo(
             pull_request.target_repo, user_regular,
             'repository.write')
 
         response = self.app.get(url(
             controller='pullrequests', action='show',
             repo_name=pull_request.target_repo.scm_instance().name,
             pull_request_id=str(pull_request.pull_request_id)))
 
         response.mustcontain('id="open_edit_pullrequest"')
         response.mustcontain('id="delete_pullrequest"')
         response.mustcontain(no=['Confirm to delete this pull request'])
 
     def test_delete_comment_returns_404_if_comment_does_not_exist(
             self, autologin_user, pr_util, user_admin):
 
         pull_request = pr_util.create_pull_request(
             author=user_admin.username, enable_notifications=False)
 
         self.app.get(url(
             controller='pullrequests', action='delete_comment',
             repo_name=pull_request.target_repo.scm_instance().name,
             comment_id=1024404), status=404)
 
 
 def assert_pull_request_status(pull_request, expected_status):
     status = ChangesetStatusModel().calculated_review_status(
         pull_request=pull_request)
     assert status == expected_status
 
 
 @pytest.mark.parametrize('action', ['index', 'create'])
 @pytest.mark.usefixtures("autologin_user")
 def test_redirects_to_repo_summary_for_svn_repositories(backend_svn, app, action):
     response = app.get(url(
         controller='pullrequests', action=action,
         repo_name=backend_svn.repo_name))
     assert response.status_int == 302
 
     # Not allowed, redirect to the summary
     redirected = response.follow()
     summary_url = h.route_path('repo_summary', repo_name=backend_svn.repo_name)
 
     # URL adds leading slash and path doesn't have it
     assert redirected.request.path == summary_url

rhodecode/tests/utils.py

@@ -1,426 +1,431 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import threading
 import time
 import logging
 import os.path
 import subprocess32
 import tempfile
 import urllib2
 from lxml.html import fromstring, tostring
 from lxml.cssselect import CSSSelector
 from urlparse import urlparse, parse_qsl
 from urllib import unquote_plus
 import webob
 
 from webtest.app import TestResponse, TestApp, string_types
 from webtest.compat import print_stderr
 
 import pytest
 import rc_testdata
 
 from rhodecode.model.db import User, Repository
 from rhodecode.model.meta import Session
 from rhodecode.model.scm import ScmModel
 from rhodecode.lib.vcs.backends.svn.repository import SubversionRepository
 from rhodecode.lib.vcs.backends.base import EmptyCommit
 
 
 log = logging.getLogger(__name__)
 
 
 class CustomTestResponse(TestResponse):
     def _save_output(self, out):
         f = tempfile.NamedTemporaryFile(
             delete=False, prefix='rc-test-', suffix='.html')
         f.write(out)
         return f.name
 
     def mustcontain(self, *strings, **kw):
         """
         Assert that the response contains all of the strings passed
         in as arguments.
 
         Equivalent to::
 
             assert string in res
         """
         if 'no' in kw:
             no = kw['no']
             del kw['no']
             if isinstance(no, string_types):
                 no = [no]
         else:
             no = []
         if kw:
             raise TypeError(
                 "The only keyword argument allowed is 'no'")
 
         f = self._save_output(str(self))
 
         for s in strings:
             if not s in self:
                 print_stderr("Actual response (no %r):" % s)
                 print_stderr(str(self))
                 raise IndexError(
                     "Body does not contain string %r, output saved as %s" % (
                     s, f))
 
         for no_s in no:
             if no_s in self:
                 print_stderr("Actual response (has %r)" % no_s)
                 print_stderr(str(self))
                 raise IndexError(
                     "Body contains bad string %r, output saved as %s" % (
                     no_s, f))
 
     def assert_response(self):
         return AssertResponse(self)
 
     def get_session_from_response(self):
         """
         This returns the session from a response object. Pylons has some magic
         to make the session available as `response.session`. But pyramid
         doesn't expose it.
         """
         return self.request.environ['beaker.session']
 
 
 class TestRequest(webob.BaseRequest):
 
     # for py.test
     disabled = True
     ResponseClass = CustomTestResponse
 
 
 class CustomTestApp(TestApp):
     """
     Custom app to make mustcontain more usefull
     """
     RequestClass = TestRequest
 
 
 def set_anonymous_access(enabled):
     """(Dis)allows anonymous access depending on parameter `enabled`"""
     user = User.get_default_user()
     user.active = enabled
     Session().add(user)
     Session().commit()
     time.sleep(1.5)  # must sleep for cache (1s to expire)
     log.info('anonymous access is now: %s', enabled)
     assert enabled == User.get_default_user().active, (
         'Cannot set anonymous access')
 
 
 def check_xfail_backends(node, backend_alias):
     # Using "xfail_backends" here intentionally, since this marks work
     # which is "to be done" soon.
     skip_marker = node.get_marker('xfail_backends')
     if skip_marker and backend_alias in skip_marker.args:
         msg = "Support for backend %s to be developed." % (backend_alias, )
         msg = skip_marker.kwargs.get('reason', msg)
         pytest.xfail(msg)
 
 
 def check_skip_backends(node, backend_alias):
     # Using "skip_backends" here intentionally, since this marks work which is
     # not supported.
     skip_marker = node.get_marker('skip_backends')
     if skip_marker and backend_alias in skip_marker.args:
         msg = "Feature not supported for backend %s." % (backend_alias, )
         msg = skip_marker.kwargs.get('reason', msg)
         pytest.skip(msg)
 
 
 def extract_git_repo_from_dump(dump_name, repo_name):
     """Create git repo `repo_name` from dump `dump_name`."""
     repos_path = ScmModel().repos_path
     target_path = os.path.join(repos_path, repo_name)
     rc_testdata.extract_git_dump(dump_name, target_path)
     return target_path
 
 
 def extract_hg_repo_from_dump(dump_name, repo_name):
     """Create hg repo `repo_name` from dump `dump_name`."""
     repos_path = ScmModel().repos_path
     target_path = os.path.join(repos_path, repo_name)
     rc_testdata.extract_hg_dump(dump_name, target_path)
     return target_path
 
 
 def extract_svn_repo_from_dump(dump_name, repo_name):
     """Create a svn repo `repo_name` from dump `dump_name`."""
     repos_path = ScmModel().repos_path
     target_path = os.path.join(repos_path, repo_name)
     SubversionRepository(target_path, create=True)
     _load_svn_dump_into_repo(dump_name, target_path)
     return target_path
 
 
 def assert_message_in_log(log_records, message, levelno, module):
     messages = [
         r.message for r in log_records
         if r.module == module and r.levelno == levelno
     ]
     assert message in messages
 
 
 def _load_svn_dump_into_repo(dump_name, repo_path):
     """
     Utility to populate a svn repository with a named dump
 
     Currently the dumps are in rc_testdata. They might later on be
     integrated with the main repository once they stabilize more.
     """
     dump = rc_testdata.load_svn_dump(dump_name)
     load_dump = subprocess32.Popen(
         ['svnadmin', 'load', repo_path],
         stdin=subprocess32.PIPE, stdout=subprocess32.PIPE,
         stderr=subprocess32.PIPE)
     out, err = load_dump.communicate(dump)
     if load_dump.returncode != 0:
         log.error("Output of load_dump command: %s", out)
         log.error("Error output of load_dump command: %s", err)
         raise Exception(
             'Failed to load dump "%s" into repository at path "%s".'
             % (dump_name, repo_path))
 
 
 class AssertResponse(object):
     """
     Utility that helps to assert things about a given HTML response.
     """
 
     def __init__(self, response):
         self.response = response
 
     def get_imports(self):
         return fromstring, tostring, CSSSelector
 
     def one_element_exists(self, css_selector):
         self.get_element(css_selector)
 
     def no_element_exists(self, css_selector):
         assert not self._get_elements(css_selector)
 
     def element_equals_to(self, css_selector, expected_content):
         element = self.get_element(css_selector)
         element_text = self._element_to_string(element)
         assert expected_content in element_text
 
     def element_contains(self, css_selector, expected_content):
         element = self.get_element(css_selector)
         assert expected_content in element.text_content()
 
     def element_value_contains(self, css_selector, expected_content):
         element = self.get_element(css_selector)
         assert expected_content in element.value
 
     def contains_one_link(self, link_text, href):
         fromstring, tostring, CSSSelector = self.get_imports()
         doc = fromstring(self.response.body)
         sel = CSSSelector('a[href]')
         elements = [
             e for e in sel(doc) if e.text_content().strip() == link_text]
         assert len(elements) == 1, "Did not find link or found multiple links"
         self._ensure_url_equal(elements[0].attrib.get('href'), href)
 
     def contains_one_anchor(self, anchor_id):
         fromstring, tostring, CSSSelector = self.get_imports()
         doc = fromstring(self.response.body)
         sel = CSSSelector('#' + anchor_id)
         elements = sel(doc)
         assert len(elements) == 1, 'cannot find 1 element {}'.format(anchor_id)
 
     def _ensure_url_equal(self, found, expected):
         assert _Url(found) == _Url(expected)
 
     def get_element(self, css_selector):
         elements = self._get_elements(css_selector)
         assert len(elements) == 1, 'cannot find 1 element {}'.format(css_selector)
         return elements[0]
 
     def get_elements(self, css_selector):
         return self._get_elements(css_selector)
 
     def _get_elements(self, css_selector):
         fromstring, tostring, CSSSelector = self.get_imports()
         doc = fromstring(self.response.body)
         sel = CSSSelector(css_selector)
         elements = sel(doc)
         return elements
 
     def _element_to_string(self, element):
         fromstring, tostring, CSSSelector = self.get_imports()
         return tostring(element)
 
 
 class _Url(object):
     """
     A url object that can be compared with other url orbjects
     without regard to the vagaries of encoding, escaping, and ordering
     of parameters in query strings.
 
     Inspired by
     http://stackoverflow.com/questions/5371992/comparing-two-urls-in-python
     """
 
     def __init__(self, url):
         parts = urlparse(url)
         _query = frozenset(parse_qsl(parts.query))
         _path = unquote_plus(parts.path)
         parts = parts._replace(query=_query, path=_path)
         self.parts = parts
 
     def __eq__(self, other):
         return self.parts == other.parts
 
     def __hash__(self):
         return hash(self.parts)
 
 
 def run_test_concurrently(times, raise_catched_exc=True):
     """
     Add this decorator to small pieces of code that you want to test
     concurrently
 
     ex:
 
     @test_concurrently(25)
     def my_test_function():
         ...
     """
     def test_concurrently_decorator(test_func):
         def wrapper(*args, **kwargs):
             exceptions = []
 
             def call_test_func():
                 try:
                     test_func(*args, **kwargs)
                 except Exception as e:
                     exceptions.append(e)
                     if raise_catched_exc:
                         raise
             threads = []
             for i in range(times):
                 threads.append(threading.Thread(target=call_test_func))
             for t in threads:
                 t.start()
             for t in threads:
                 t.join()
             if exceptions:
                 raise Exception(
                     'test_concurrently intercepted %s exceptions: %s' % (
                         len(exceptions), exceptions))
         return wrapper
     return test_concurrently_decorator
 
 
 def wait_for_url(url, timeout=10):
     """
     Wait until URL becomes reachable.
 
     It polls the URL until the timeout is reached or it became reachable.
     If will call to `py.test.fail` in case the URL is not reachable.
     """
     timeout = time.time() + timeout
     last = 0
     wait = 0.1
 
     while timeout > last:
         last = time.time()
         if is_url_reachable(url):
             break
         elif (last + wait) > time.time():
             # Go to sleep because not enough time has passed since last check.
             time.sleep(wait)
     else:
         pytest.fail("Timeout while waiting for URL {}".format(url))
 
 
 def is_url_reachable(url):
     try:
         urllib2.urlopen(url)
     except urllib2.URLError:
         return False
     return True
 
 
 def repo_on_filesystem(repo_name):
     from rhodecode.lib import vcs
     from rhodecode.tests import TESTS_TMP_PATH
     repo = vcs.get_vcs_instance(
         os.path.join(TESTS_TMP_PATH, repo_name), create=False)
     return repo is not None
 
 
 def commit_change(
         repo, filename, content, message, vcs_type, parent=None, newfile=False):
     from rhodecode.tests import TEST_USER_ADMIN_LOGIN
 
     repo = Repository.get_by_repo_name(repo)
     _commit = parent
     if not parent:
         _commit = EmptyCommit(alias=vcs_type)
 
     if newfile:
         nodes = {
             filename: {
                 'content': content
             }
         }
         commit = ScmModel().create_nodes(
             user=TEST_USER_ADMIN_LOGIN, repo=repo,
             message=message,
             nodes=nodes,
             parent_commit=_commit,
             author=TEST_USER_ADMIN_LOGIN,
         )
     else:
         commit = ScmModel().commit_change(
             repo=repo.scm_instance(), repo_name=repo.repo_name,
             commit=parent, user=TEST_USER_ADMIN_LOGIN,
             author=TEST_USER_ADMIN_LOGIN,
             message=message,
             content=content,
             f_path=filename
         )
     return commit
 
 
 def add_test_routes(config):
     """
     Adds test routing that can be used in different functional tests
     """
+    from rhodecode.apps._base import ADMIN_PREFIX
+
     config.add_route(name='home', pattern='/')
+
+    config.add_route(name='login', pattern=ADMIN_PREFIX + '/login')
+    config.add_route(name='logout', pattern=ADMIN_PREFIX + '/logout')
     config.add_route(name='repo_summary', pattern='/{repo_name}')
     config.add_route(name='repo_summary_explicit', pattern='/{repo_name}/summary')
     config.add_route(name='repo_group_home', pattern='/{repo_group_name}')
 
     config.add_route(name='pullrequest_show',
                      pattern='/{repo_name}/pull-request/{pull_request_id}')
     config.add_route(name='pull_requests_global',
                      pattern='/pull-request/{pull_request_id}')
     config.add_route(name='repo_commit',
                      pattern='/{repo_name}/changeset/{commit_id}')
 
     config.add_route(name='repo_files',
                      pattern='/{repo_name}/files/{commit_id}/{f_path}')