user-api: use simple schema validator to be consistent how we validate between API and web views.

rhodecode/api/tests/test_create_user.py

@@ -1,192 +1,206 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import mock
 import pytest
 
 from rhodecode.lib.auth import check_password
 from rhodecode.model.user import UserModel
 from rhodecode.tests import (
     TEST_USER_ADMIN_LOGIN, TEST_USER_REGULAR_EMAIL)
 from rhodecode.api.tests.utils import (
     build_data, api_call, assert_ok, assert_error, jsonify, crash)
 from rhodecode.tests.fixture import Fixture
 from rhodecode.model.db import RepoGroup
 
 
 # TODO: mikhail: remove fixture from here
 fixture = Fixture()
 
 
 @pytest.mark.usefixtures("testuser_api", "app")
 class TestCreateUser(object):
     def test_api_create_existing_user(self):
         id_, params = build_data(
             self.apikey, 'create_user',
             username=TEST_USER_ADMIN_LOGIN,
             email='[e-mail]',
             password='trololo')
         response = api_call(self.app, params)
 
         expected = "user `%s` already exist" % (TEST_USER_ADMIN_LOGIN,)
         assert_error(id_, expected, given=response.body)
 
     def test_api_create_user_with_existing_email(self):
         id_, params = build_data(
             self.apikey, 'create_user',
             username=TEST_USER_ADMIN_LOGIN + 'new',
             email=TEST_USER_REGULAR_EMAIL,
             password='trololo')
         response = api_call(self.app, params)
 
         expected = "email `%s` already exist" % (TEST_USER_REGULAR_EMAIL,)
         assert_error(id_, expected, given=response.body)
 
+    def test_api_create_user_with_wrong_username(self):
+        bad_username = '<> HELLO WORLD <>'
+        id_, params = build_data(
+            self.apikey, 'create_user',
+            username=bad_username,
+            email='[e-mail]',
+            password='trololo')
+        response = api_call(self.app, params)
+
+        expected = {'username':
+                        "Username may only contain alphanumeric characters "
+                        "underscores, periods or dashes and must begin with "
+                        "alphanumeric character or underscore"}
+        assert_error(id_, expected, given=response.body)
+
     def test_api_create_user(self):
         username = 'test_new_api_user'
         email = username + "@foo.com"
 
         id_, params = build_data(
             self.apikey, 'create_user',
             username=username,
             email=email,
             password='example')
         response = api_call(self.app, params)
 
         usr = UserModel().get_by_username(username)
         ret = {
             'msg': 'created new user `%s`' % (username,),
             'user': jsonify(usr.get_api_data(include_secrets=True)),
         }
         try:
             expected = ret
             assert check_password('example', usr.password)
             assert_ok(id_, expected, given=response.body)
         finally:
             fixture.destroy_user(usr.user_id)
 
     def test_api_create_user_without_password(self):
         username = 'test_new_api_user_passwordless'
         email = username + "@foo.com"
 
         id_, params = build_data(
             self.apikey, 'create_user',
             username=username,
             email=email)
         response = api_call(self.app, params)
 
         usr = UserModel().get_by_username(username)
         ret = {
             'msg': 'created new user `%s`' % (username,),
             'user': jsonify(usr.get_api_data(include_secrets=True)),
         }
         try:
             expected = ret
             assert_ok(id_, expected, given=response.body)
         finally:
             fixture.destroy_user(usr.user_id)
 
     def test_api_create_user_with_extern_name(self):
         username = 'test_new_api_user_passwordless'
         email = username + "@foo.com"
 
         id_, params = build_data(
             self.apikey, 'create_user',
             username=username,
             email=email, extern_name='rhodecode')
         response = api_call(self.app, params)
 
         usr = UserModel().get_by_username(username)
         ret = {
             'msg': 'created new user `%s`' % (username,),
             'user': jsonify(usr.get_api_data(include_secrets=True)),
         }
         try:
             expected = ret
             assert_ok(id_, expected, given=response.body)
         finally:
             fixture.destroy_user(usr.user_id)
 
     def test_api_create_user_with_password_change(self):
         username = 'test_new_api_user_password_change'
         email = username + "@foo.com"
 
         id_, params = build_data(
             self.apikey, 'create_user',
             username=username,
             email=email, extern_name='rhodecode',
             force_password_change=True)
         response = api_call(self.app, params)
 
         usr = UserModel().get_by_username(username)
         ret = {
             'msg': 'created new user `%s`' % (username,),
             'user': jsonify(usr.get_api_data(include_secrets=True)),
         }
         try:
             expected = ret
             assert_ok(id_, expected, given=response.body)
         finally:
             fixture.destroy_user(usr.user_id)
 
     def test_api_create_user_with_personal_repo_group(self):
         username = 'test_new_api_user_personal_group'
         email = username + "@foo.com"
 
         id_, params = build_data(
             self.apikey, 'create_user',
             username=username,
             email=email, extern_name='rhodecode',
             create_personal_repo_group=True)
         response = api_call(self.app, params)
 
         usr = UserModel().get_by_username(username)
         ret = {
             'msg': 'created new user `%s`' % (username,),
             'user': jsonify(usr.get_api_data(include_secrets=True)),
         }
 
         personal_group = RepoGroup.get_by_group_name(username)
         assert personal_group
         assert personal_group.personal == True
         assert personal_group.user.username == username
 
         try:
             expected = ret
             assert_ok(id_, expected, given=response.body)
         finally:
             fixture.destroy_repo_group(username)
             fixture.destroy_user(usr.user_id)
 
-
     @mock.patch.object(UserModel, 'create_or_update', crash)
     def test_api_create_user_when_exception_happened(self):
 
         username = 'test_new_api_user'
         email = username + "@foo.com"
 
         id_, params = build_data(
             self.apikey, 'create_user',
             username=username,
             email=email,
             password='trololo')
         response = api_call(self.app, params)
         expected = 'failed to create user `%s`' % (username,)
         assert_error(id_, expected, given=response.body)

rhodecode/api/views/user_api.py

@@ -1,529 +1,560 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2011-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import logging
 
-from rhodecode.api import jsonrpc_method, JSONRPCError, JSONRPCForbidden
+from rhodecode.api import (
+    jsonrpc_method, JSONRPCError, JSONRPCForbidden, JSONRPCValidationError)
 from rhodecode.api.utils import (
     Optional, OAttr, has_superadmin_permission, get_user_or_error, store_update)
 from rhodecode.lib import audit_logger
 from rhodecode.lib.auth import AuthUser, PasswordGenerator
 from rhodecode.lib.exceptions import DefaultUserException
 from rhodecode.lib.utils2 import safe_int, str2bool
 from rhodecode.model.db import Session, User, Repository
 from rhodecode.model.user import UserModel
+from rhodecode.model import validation_schema
+from rhodecode.model.validation_schema.schemas import user_schema
 
 log = logging.getLogger(__name__)
 
 
 @jsonrpc_method()
 def get_user(request, apiuser, userid=Optional(OAttr('apiuser'))):
     """
     Returns the information associated with a username or userid.
 
     * If the ``userid`` is not set, this command returns the information
       for the ``userid`` calling the method.
 
     .. note::
 
        Normal users may only run this command against their ``userid``. For
        full privileges you must run this command using an |authtoken| with
        admin rights.
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
     :param userid: Sets the userid for which data will be returned.
     :type userid: Optional(str or int)
 
     Example output:
 
     .. code-block:: bash
 
         {
           "error": null,
           "id": <id>,
           "result": {
             "active": true,
             "admin": false,
             "api_keys": [ list of keys ],
             "auth_tokens": [ list of tokens with details ],
             "email": "[e-mail]",
             "emails": [
               "[e-mail]"
             ],
             "extern_name": "rhodecode",
             "extern_type": "rhodecode",
             "firstname": "username",
             "ip_addresses": [],
             "language": null,
             "last_login": "Timestamp",
             "last_activity": "Timestamp",
             "lastname": "surnae",
             "permissions": {
               "global": [
                 "hg.inherit_default_perms.true",
                 "usergroup.read",
                 "hg.repogroup.create.false",
                 "hg.create.none",
                 "hg.password_reset.enabled",
                 "hg.extern_activate.manual",
                 "hg.create.write_on_repogroup.false",
                 "hg.usergroup.create.false",
                 "group.none",
                 "repository.none",
                 "hg.register.none",
                 "hg.fork.repository"
               ],
               "repositories": { "username/example": "repository.write"},
               "repositories_groups": { "user-group/repo": "group.none" },
               "user_groups": { "user_group_name": "usergroup.read" }
             },
             "user_id": 32,
             "username": "username"
           }
         }
     """
 
     if not has_superadmin_permission(apiuser):
         # make sure normal user does not pass someone else userid,
         # he is not allowed to do that
         if not isinstance(userid, Optional) and userid != apiuser.user_id:
             raise JSONRPCError('userid is not the same as your user')
 
     userid = Optional.extract(userid, evaluate_locals=locals())
     userid = getattr(userid, 'user_id', userid)
 
     user = get_user_or_error(userid)
     data = user.get_api_data(include_secrets=True)
     data['permissions'] = AuthUser(user_id=user.user_id).permissions
     return data
 
 
 @jsonrpc_method()
 def get_users(request, apiuser):
     """
     Lists all users in the |RCE| user database.
 
     This command can only be run using an |authtoken| with admin rights to
     the specified repository.
 
     This command takes the following options:
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
 
     Example output:
 
     .. code-block:: bash
 
         id : <id_given_in_input>
         result: [<user_object>, ...]
         error:  null
     """
 
     if not has_superadmin_permission(apiuser):
         raise JSONRPCForbidden()
 
     result = []
     users_list = User.query().order_by(User.username) \
         .filter(User.username != User.DEFAULT_USER) \
         .all()
     for user in users_list:
         result.append(user.get_api_data(include_secrets=True))
     return result
 
 
 @jsonrpc_method()
 def create_user(request, apiuser, username, email, password=Optional(''),
                 firstname=Optional(''), lastname=Optional(''),
                 active=Optional(True), admin=Optional(False),
                 extern_name=Optional('rhodecode'),
                 extern_type=Optional('rhodecode'),
                 force_password_change=Optional(False),
                 create_personal_repo_group=Optional(None)):
     """
     Creates a new user and returns the new user object.
 
     This command can only be run using an |authtoken| with admin rights to
     the specified repository.
 
     This command takes the following options:
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
     :param username: Set the new username.
     :type username: str or int
     :param email: Set the user email address.
     :type email: str
     :param password: Set the new user password.
     :type password: Optional(str)
     :param firstname: Set the new user firstname.
     :type firstname: Optional(str)
     :param lastname: Set the new user surname.
     :type lastname: Optional(str)
     :param active: Set the user as active.
     :type active: Optional(``True`` | ``False``)
     :param admin: Give the new user admin rights.
     :type admin: Optional(``True`` | ``False``)
     :param extern_name: Set the authentication plugin name.
         Using LDAP this is filled with LDAP UID.
     :type extern_name: Optional(str)
     :param extern_type: Set the new user authentication plugin.
     :type extern_type: Optional(str)
     :param force_password_change: Force the new user to change password
         on next login.
     :type force_password_change: Optional(``True`` | ``False``)
     :param create_personal_repo_group: Create personal repo group for this user
     :type create_personal_repo_group: Optional(``True`` | ``False``)
 
     Example output:
 
     .. code-block:: bash
 
         id : <id_given_in_input>
         result: {
             "msg" : "created new user `<username>`",
             "user": <user_obj>
         }
         error:  null
 
     Example error output:
 
     .. code-block:: bash
 
       id : <id_given_in_input>
       result : null
       error :  {
         "user `<username>` already exist"
         or
         "email `<email>` already exist"
         or
         "failed to create user `<username>`"
       }
 
     """
     if not has_superadmin_permission(apiuser):
         raise JSONRPCForbidden()
 
     if UserModel().get_by_username(username):
         raise JSONRPCError("user `%s` already exist" % (username,))
 
     if UserModel().get_by_email(email, case_insensitive=True):
         raise JSONRPCError("email `%s` already exist" % (email,))
 
     # generate random password if we actually given the
     # extern_name and it's not rhodecode
     if (not isinstance(extern_name, Optional) and
                 Optional.extract(extern_name) != 'rhodecode'):
         # generate temporary password if user is external
         password = PasswordGenerator().gen_password(length=16)
     create_repo_group = Optional.extract(create_personal_repo_group)
     if isinstance(create_repo_group, basestring):
         create_repo_group = str2bool(create_repo_group)
 
+    username = Optional.extract(username)
+    password = Optional.extract(password)
+    email = Optional.extract(email)
+    first_name = Optional.extract(firstname)
+    last_name = Optional.extract(lastname)
+    active = Optional.extract(active)
+    admin = Optional.extract(admin)
+    extern_type = Optional.extract(extern_type)
+    extern_name = Optional.extract(extern_name)
+
+    schema = user_schema.UserSchema().bind(
+        # user caller
+        user=apiuser)
+    try:
+        schema_data = schema.deserialize(dict(
+            username=username,
+            email=email,
+            password=password,
+            first_name=first_name,
+            last_name=last_name,
+            active=active,
+            admin=admin,
+            extern_type=extern_type,
+            extern_name=extern_name,
+            ))
+    except validation_schema.Invalid as err:
+        raise JSONRPCValidationError(colander_exc=err)
+
     try:
         user = UserModel().create_or_update(
-            username=Optional.extract(username),
-            password=Optional.extract(password),
-            email=Optional.extract(email),
-            firstname=Optional.extract(firstname),
-            lastname=Optional.extract(lastname),
-            active=Optional.extract(active),
-            admin=Optional.extract(admin),
-            extern_type=Optional.extract(extern_type),
-            extern_name=Optional.extract(extern_name),
+            username=schema_data['username'],
+            password=schema_data['password'],
+            email=schema_data['email'],
+            firstname=schema_data['first_name'],
+            lastname=schema_data['last_name'],
+            active=schema_data['active'],
+            admin=schema_data['admin'],
+            extern_type=schema_data['extern_type'],
+            extern_name=schema_data['extern_name'],
             force_password_change=Optional.extract(force_password_change),
             create_repo_group=create_repo_group
         )
         Session().flush()
         creation_data = user.get_api_data()
         audit_logger.store_api(
             'user.create', action_data={'data': creation_data},
             user=apiuser)
 
         Session().commit()
         return {
             'msg': 'created new user `%s`' % username,
             'user': user.get_api_data(include_secrets=True)
         }
     except Exception:
         log.exception('Error occurred during creation of user')
         raise JSONRPCError('failed to create user `%s`' % (username,))
 
 
 @jsonrpc_method()
 def update_user(request, apiuser, userid, username=Optional(None),
                 email=Optional(None), password=Optional(None),
                 firstname=Optional(None), lastname=Optional(None),
                 active=Optional(None), admin=Optional(None),
                 extern_type=Optional(None), extern_name=Optional(None), ):
     """
     Updates the details for the specified user, if that user exists.
 
     This command can only be run using an |authtoken| with admin rights to
     the specified repository.
 
     This command takes the following options:
 
     :param apiuser: This is filled automatically from |authtoken|.
     :type apiuser: AuthUser
     :param userid: Set the ``userid`` to update.
     :type userid: str or int
     :param username: Set the new username.
     :type username: str or int
     :param email: Set the new email.
     :type email: str
     :param password: Set the new password.
     :type password: Optional(str)
     :param firstname: Set the new first name.
     :type firstname: Optional(str)
     :param lastname: Set the new surname.
     :type lastname: Optional(str)
     :param active: Set the new user as active.
     :type active: Optional(``True`` | ``False``)
     :param admin: Give the user admin rights.
     :type admin: Optional(``True`` | ``False``)
     :param extern_name: Set the authentication plugin user name.
         Using LDAP this is filled with LDAP UID.
     :type extern_name: Optional(str)
     :param extern_type: Set the authentication plugin type.
     :type extern_type: Optional(str)
 
 
     Example output:
 
     .. code-block:: bash
 
         id : <id_given_in_input>
         result: {
             "msg" : "updated user ID:<userid> <username>",
             "user": <user_object>,
         }
         error:  null
 
     Example error output:
 
     .. code-block:: bash
 
       id : <id_given_in_input>
       result : null
       error :  {
         "failed to update user `<username>`"
       }
 
     """
     if not has_superadmin_permission(apiuser):
         raise JSONRPCForbidden()
 
     user = get_user_or_error(userid)
     old_data = user.get_api_data()
     # only non optional arguments will be stored in updates
     updates = {}
 
     try:
 
         store_update(updates, username, 'username')
         store_update(updates, password, 'password')
         store_update(updates, email, 'email')
         store_update(updates, firstname, 'name')
         store_update(updates, lastname, 'lastname')
         store_update(updates, active, 'active')
         store_update(updates, admin, 'admin')
         store_update(updates, extern_name, 'extern_name')
         store_update(updates, extern_type, 'extern_type')
 
         user = UserModel().update_user(user, **updates)
         audit_logger.store_api(
             'user.edit', action_data={'old_data': old_data},
             user=apiuser)
         Session().commit()
         return {
             'msg': 'updated user ID:%s %s' % (user.user_id, user.username),
             'user': user.get_api_data(include_secrets=True)
         }
     except DefaultUserException:
         log.exception("Default user edit exception")
         raise JSONRPCError('editing default user is forbidden')
     except Exception:
         log.exception("Error occurred during update of user")
         raise JSONRPCError('failed to update user `%s`' % (userid,))
 
 
 @jsonrpc_method()
 def delete_user(request, apiuser, userid):
     """
     Deletes the specified user from the |RCE| user database.
 
     This command can only be run using an |authtoken| with admin rights to
     the specified repository.
 
     .. important::
 
        Ensure all open pull requests and open code review
        requests to this user are close.
 
        Also ensure all repositories, or repository groups owned by this
        user are reassigned before deletion.
 
     This command takes the following options:
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
     :param userid: Set the user to delete.
     :type userid: str or int
 
     Example output:
 
     .. code-block:: bash
 
         id : <id_given_in_input>
         result: {
             "msg" : "deleted user ID:<userid> <username>",
             "user": null
         }
         error:  null
 
     Example error output:
 
     .. code-block:: bash
 
       id : <id_given_in_input>
       result : null
       error :  {
         "failed to delete user ID:<userid> <username>"
       }
 
     """
     if not has_superadmin_permission(apiuser):
         raise JSONRPCForbidden()
 
     user = get_user_or_error(userid)
     old_data = user.get_api_data()
     try:
         UserModel().delete(userid)
         audit_logger.store_api(
             'user.delete', action_data={'old_data': old_data},
             user=apiuser)
 
         Session().commit()
         return {
             'msg': 'deleted user ID:%s %s' % (user.user_id, user.username),
             'user': None
         }
     except Exception:
         log.exception("Error occurred during deleting of user")
         raise JSONRPCError(
             'failed to delete user ID:%s %s' % (user.user_id, user.username))
 
 
 @jsonrpc_method()
 def get_user_locks(request, apiuser, userid=Optional(OAttr('apiuser'))):
     """
     Displays all repositories locked by the specified user.
 
     * If this command is run by a non-admin user, it returns
       a list of |repos| locked by that user.
 
     This command takes the following options:
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
     :param userid: Sets the userid whose list of locked |repos| will be
         displayed.
     :type userid: Optional(str or int)
 
     Example output:
 
     .. code-block:: bash
 
         id : <id_given_in_input>
         result : {
             [repo_object, repo_object,...]
         }
         error :  null
     """
 
     include_secrets = False
     if not has_superadmin_permission(apiuser):
         # make sure normal user does not pass someone else userid,
         # he is not allowed to do that
         if not isinstance(userid, Optional) and userid != apiuser.user_id:
             raise JSONRPCError('userid is not the same as your user')
     else:
         include_secrets = True
 
     userid = Optional.extract(userid, evaluate_locals=locals())
     userid = getattr(userid, 'user_id', userid)
     user = get_user_or_error(userid)
 
     ret = []
 
     # show all locks
     for r in Repository.getAll():
         _user_id, _time, _reason = r.locked
         if _user_id and _time:
             _api_data = r.get_api_data(include_secrets=include_secrets)
             # if we use user filter just show the locks for this user
             if safe_int(_user_id) == user.user_id:
                 ret.append(_api_data)
 
     return ret
 
 
 @jsonrpc_method()
 def get_user_audit_logs(request, apiuser, userid=Optional(OAttr('apiuser'))):
     """
     Fetches all action logs made by the specified user.
 
     This command takes the following options:
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
     :param userid: Sets the userid whose list of locked |repos| will be
         displayed.
     :type userid: Optional(str or int)
 
     Example output:
 
     .. code-block:: bash
 
         id : <id_given_in_input>
         result : {
             [action, action,...]
         }
         error :  null
     """
 
     if not has_superadmin_permission(apiuser):
         # make sure normal user does not pass someone else userid,
         # he is not allowed to do that
         if not isinstance(userid, Optional) and userid != apiuser.user_id:
             raise JSONRPCError('userid is not the same as your user')
 
     userid = Optional.extract(userid, evaluate_locals=locals())
     userid = getattr(userid, 'user_id', userid)
     user = get_user_or_error(userid)
 
     ret = []
 
     # show all user actions
     for entry in UserModel().get_user_log(user, filter_term=None):
         ret.append(entry)
     return ret

rhodecode/api/views/user_group_api.py

@@ -1,818 +1,818 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2011-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import logging
 
-from rhodecode.api import jsonrpc_method, JSONRPCError, JSONRPCForbidden, \
-    JSONRPCValidationError
+from rhodecode.api import (
+    jsonrpc_method, JSONRPCError, JSONRPCForbidden, JSONRPCValidationError)
 from rhodecode.api.utils import (
     Optional, OAttr, store_update, has_superadmin_permission, get_origin,
     get_user_or_error, get_user_group_or_error, get_perm_or_error)
 from rhodecode.lib import audit_logger
 from rhodecode.lib.auth import HasUserGroupPermissionAnyApi, HasPermissionAnyApi
 from rhodecode.lib.exceptions import UserGroupAssignedException
 from rhodecode.model.db import Session
 from rhodecode.model.scm import UserGroupList
 from rhodecode.model.user_group import UserGroupModel
 from rhodecode.model import validation_schema
 from rhodecode.model.validation_schema.schemas import user_group_schema
 
 log = logging.getLogger(__name__)
 
 
 @jsonrpc_method()
 def get_user_group(request, apiuser, usergroupid):
     """
     Returns the data of an existing user group.
 
     This command can only be run using an |authtoken| with admin rights to
     the specified repository.
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
     :param usergroupid: Set the user group from which to return data.
     :type usergroupid: str or int
 
     Example error output:
 
     .. code-block:: bash
 
         {
           "error": null,
           "id": <id>,
           "result": {
             "active": true,
             "group_description": "group description",
             "group_name": "group name",
             "members": [
               {
                 "name": "owner-name",
                 "origin": "owner",
                 "permission": "usergroup.admin",
                 "type": "user"
               },
               {
               {
                 "name": "user name",
                 "origin": "permission",
                 "permission": "usergroup.admin",
                 "type": "user"
               },
               {
                 "name": "user group name",
                 "origin": "permission",
                 "permission": "usergroup.write",
                 "type": "user_group"
               }
             ],
             "owner": "owner name",
             "users": [],
             "users_group_id": 2
           }
         }
 
     """
 
     user_group = get_user_group_or_error(usergroupid)
     if not has_superadmin_permission(apiuser):
         # check if we have at least read permission for this user group !
         _perms = ('usergroup.read', 'usergroup.write', 'usergroup.admin',)
         if not HasUserGroupPermissionAnyApi(*_perms)(
                 user=apiuser, user_group_name=user_group.users_group_name):
             raise JSONRPCError('user group `%s` does not exist' % (
                 usergroupid,))
 
     permissions = []
     for _user in user_group.permissions():
         user_data = {
             'name': _user.username,
             'permission': _user.permission,
             'origin': get_origin(_user),
             'type': "user",
         }
         permissions.append(user_data)
 
     for _user_group in user_group.permission_user_groups():
         user_group_data = {
             'name': _user_group.users_group_name,
             'permission': _user_group.permission,
             'origin': get_origin(_user_group),
             'type': "user_group",
         }
         permissions.append(user_group_data)
 
     data = user_group.get_api_data()
     data['members'] = permissions
 
     return data
 
 
 @jsonrpc_method()
 def get_user_groups(request, apiuser):
     """
     Lists all the existing user groups within RhodeCode.
 
     This command can only be run using an |authtoken| with admin rights to
     the specified repository.
 
     This command takes the following options:
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
 
     Example error output:
 
     .. code-block:: bash
 
         id : <id_given_in_input>
         result : [<user_group_obj>,...]
         error : null
     """
 
     include_secrets = has_superadmin_permission(apiuser)
 
     result = []
     _perms = ('usergroup.read', 'usergroup.write', 'usergroup.admin',)
     extras = {'user': apiuser}
     for user_group in UserGroupList(UserGroupModel().get_all(),
                                     perm_set=_perms, extra_kwargs=extras):
         result.append(
             user_group.get_api_data(include_secrets=include_secrets))
     return result
 
 
 @jsonrpc_method()
 def create_user_group(
         request, apiuser, group_name, description=Optional(''),
         owner=Optional(OAttr('apiuser')), active=Optional(True)):
     """
     Creates a new user group.
 
     This command can only be run using an |authtoken| with admin rights to
     the specified repository.
 
     This command takes the following options:
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
     :param group_name: Set the name of the new user group.
     :type group_name: str
     :param description: Give a description of the new user group.
     :type description: str
     :param owner: Set the owner of the new user group.
         If not set, the owner is the |authtoken| user.
     :type owner: Optional(str or int)
     :param active: Set this group as active.
     :type active: Optional(``True`` | ``False``)
 
     Example output:
 
     .. code-block:: bash
 
         id : <id_given_in_input>
         result: {
                   "msg": "created new user group `<groupname>`",
                   "user_group": <user_group_object>
                 }
         error:  null
 
     Example error output:
 
     .. code-block:: bash
 
       id : <id_given_in_input>
       result : null
       error :  {
         "user group `<group name>` already exist"
         or
         "failed to create group `<group name>`"
       }
 
     """
 
     if not has_superadmin_permission(apiuser):
         if not HasPermissionAnyApi('hg.usergroup.create.true')(user=apiuser):
             raise JSONRPCForbidden()
 
     if UserGroupModel().get_by_name(group_name):
         raise JSONRPCError("user group `%s` already exist" % (group_name,))
 
     if isinstance(owner, Optional):
         owner = apiuser.user_id
 
     owner = get_user_or_error(owner)
     active = Optional.extract(active)
     description = Optional.extract(description)
 
     schema = user_group_schema.UserGroupSchema().bind(
         # user caller
         user=apiuser)
     try:
         schema_data = schema.deserialize(dict(
             user_group_name=group_name,
             user_group_description=description,
             user_group_owner=owner.username,
             user_group_active=active,
             ))
     except validation_schema.Invalid as err:
         raise JSONRPCValidationError(colander_exc=err)
 
     try:
         user_group = UserGroupModel().create(
             name=schema_data['user_group_name'],
             description=schema_data['user_group_description'],
             owner=owner,
             active=schema_data['user_group_active'])
         Session().flush()
         creation_data = user_group.get_api_data()
         audit_logger.store_api(
             'user_group.create', action_data={'data': creation_data},
             user=apiuser)
         Session().commit()
         return {
             'msg': 'created new user group `%s`' % group_name,
             'user_group': creation_data
         }
     except Exception:
         log.exception("Error occurred during creation of user group")
         raise JSONRPCError('failed to create group `%s`' % (group_name,))
 
 
 @jsonrpc_method()
 def update_user_group(request, apiuser, usergroupid, group_name=Optional(''),
                       description=Optional(''), owner=Optional(None),
                       active=Optional(True)):
     """
     Updates the specified `user group` with the details provided.
 
     This command can only be run using an |authtoken| with admin rights to
     the specified repository.
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
     :param usergroupid: Set the id of the `user group` to update.
     :type usergroupid: str or int
     :param group_name: Set the new name the `user group`
     :type group_name: str
     :param description: Give a description for the `user group`
     :type description: str
     :param owner: Set the owner of the `user group`.
     :type owner: Optional(str or int)
     :param active: Set the group as active.
     :type active: Optional(``True`` | ``False``)
 
     Example output:
 
     .. code-block:: bash
 
       id : <id_given_in_input>
       result : {
         "msg": 'updated user group ID:<user group id> <user group name>',
         "user_group": <user_group_object>
       }
       error :  null
 
     Example error output:
 
     .. code-block:: bash
 
       id : <id_given_in_input>
       result : null
       error :  {
         "failed to update user group `<user group name>`"
       }
 
     """
 
     user_group = get_user_group_or_error(usergroupid)
     include_secrets = False
     if not has_superadmin_permission(apiuser):
         # check if we have admin permission for this user group !
         _perms = ('usergroup.admin',)
         if not HasUserGroupPermissionAnyApi(*_perms)(
                 user=apiuser, user_group_name=user_group.users_group_name):
             raise JSONRPCError(
                 'user group `%s` does not exist' % (usergroupid,))
     else:
         include_secrets = True
 
     if not isinstance(owner, Optional):
         owner = get_user_or_error(owner)
 
     old_data = user_group.get_api_data()
     updates = {}
     store_update(updates, group_name, 'users_group_name')
     store_update(updates, description, 'user_group_description')
     store_update(updates, owner, 'user')
     store_update(updates, active, 'users_group_active')
     try:
         UserGroupModel().update(user_group, updates)
         audit_logger.store_api(
             'user_group.edit', action_data={'old_data': old_data},
             user=apiuser)
         Session().commit()
         return {
             'msg': 'updated user group ID:%s %s' % (
                 user_group.users_group_id, user_group.users_group_name),
             'user_group': user_group.get_api_data(
                 include_secrets=include_secrets)
         }
     except Exception:
         log.exception("Error occurred during update of user group")
         raise JSONRPCError(
             'failed to update user group `%s`' % (usergroupid,))
 
 
 @jsonrpc_method()
 def delete_user_group(request, apiuser, usergroupid):
     """
     Deletes the specified `user group`.
 
     This command can only be run using an |authtoken| with admin rights to
     the specified repository.
 
     This command takes the following options:
 
     :param apiuser: filled automatically from apikey
     :type apiuser: AuthUser
     :param usergroupid:
     :type usergroupid: int
 
     Example output:
 
     .. code-block:: bash
 
       id : <id_given_in_input>
       result : {
         "msg": "deleted user group ID:<user_group_id> <user_group_name>"
       }
       error :  null
 
     Example error output:
 
     .. code-block:: bash
 
       id : <id_given_in_input>
       result : null
       error :  {
         "failed to delete user group ID:<user_group_id> <user_group_name>"
         or
         "RepoGroup assigned to <repo_groups_list>"
       }
 
     """
 
     user_group = get_user_group_or_error(usergroupid)
     if not has_superadmin_permission(apiuser):
         # check if we have admin permission for this user group !
         _perms = ('usergroup.admin',)
         if not HasUserGroupPermissionAnyApi(*_perms)(
                 user=apiuser, user_group_name=user_group.users_group_name):
             raise JSONRPCError(
                 'user group `%s` does not exist' % (usergroupid,))
 
     old_data = user_group.get_api_data()
     try:
         UserGroupModel().delete(user_group)
         audit_logger.store_api(
             'user_group.delete', action_data={'old_data': old_data},
             user=apiuser)
         Session().commit()
         return {
             'msg': 'deleted user group ID:%s %s' % (
                 user_group.users_group_id, user_group.users_group_name),
             'user_group': None
         }
     except UserGroupAssignedException as e:
         log.exception("UserGroupAssigned error")
         raise JSONRPCError(str(e))
     except Exception:
         log.exception("Error occurred during deletion of user group")
         raise JSONRPCError(
             'failed to delete user group ID:%s %s' %(
                 user_group.users_group_id, user_group.users_group_name))
 
 
 @jsonrpc_method()
 def add_user_to_user_group(request, apiuser, usergroupid, userid):
     """
     Adds a user to a `user group`. If the user already exists in the group
     this command will return false.
 
     This command can only be run using an |authtoken| with admin rights to
     the specified user group.
 
     This command takes the following options:
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
     :param usergroupid: Set the name of the `user group` to which a
         user will be added.
     :type usergroupid: int
     :param userid: Set the `user_id` of the user to add to the group.
     :type userid: int
 
     Example output:
 
     .. code-block:: bash
 
       id : <id_given_in_input>
       result : {
           "success": True|False # depends on if member is in group
           "msg": "added member `<username>` to user group `<groupname>` |
                   User is already in that group"
 
       }
       error :  null
 
     Example error output:
 
     .. code-block:: bash
 
       id : <id_given_in_input>
       result : null
       error :  {
         "failed to add member to user group `<user_group_name>`"
       }
 
     """
 
     user = get_user_or_error(userid)
     user_group = get_user_group_or_error(usergroupid)
     if not has_superadmin_permission(apiuser):
         # check if we have admin permission for this user group !
         _perms = ('usergroup.admin',)
         if not HasUserGroupPermissionAnyApi(*_perms)(
                 user=apiuser, user_group_name=user_group.users_group_name):
             raise JSONRPCError('user group `%s` does not exist' % (
                 usergroupid,))
 
     try:
         ugm = UserGroupModel().add_user_to_group(user_group, user)
         success = True if ugm is not True else False
         msg = 'added member `%s` to user group `%s`' % (
             user.username, user_group.users_group_name
         )
         msg = msg if success else 'User is already in that group'
         if success:
             user_data = user.get_api_data()
             audit_logger.store_api(
                 'user_group.edit.member.add', action_data={'user': user_data},
                 user=apiuser)
 
         Session().commit()
 
         return {
             'success': success,
             'msg': msg
         }
     except Exception:
         log.exception("Error occurred during adding a member to user group")
         raise JSONRPCError(
             'failed to add member to user group `%s`' % (
                 user_group.users_group_name,
             )
         )
 
 
 @jsonrpc_method()
 def remove_user_from_user_group(request, apiuser, usergroupid, userid):
     """
     Removes a user from a user group.
 
     * If the specified user is not in the group, this command will return
       `false`.
 
     This command can only be run using an |authtoken| with admin rights to
     the specified user group.
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
     :param usergroupid: Sets the user group name.
     :type usergroupid: str or int
     :param userid: The user you wish to remove from |RCE|.
     :type userid: str or int
 
     Example output:
 
     .. code-block:: bash
 
         id : <id_given_in_input>
         result: {
                   "success":  True|False,  # depends on if member is in group
                   "msg": "removed member <username> from user group <groupname> |
                           User wasn't in group"
                 }
         error:  null
 
     """
 
     user = get_user_or_error(userid)
     user_group = get_user_group_or_error(usergroupid)
     if not has_superadmin_permission(apiuser):
         # check if we have admin permission for this user group !
         _perms = ('usergroup.admin',)
         if not HasUserGroupPermissionAnyApi(*_perms)(
                 user=apiuser, user_group_name=user_group.users_group_name):
             raise JSONRPCError(
                 'user group `%s` does not exist' % (usergroupid,))
 
     try:
         success = UserGroupModel().remove_user_from_group(user_group, user)
         msg = 'removed member `%s` from user group `%s`' % (
             user.username, user_group.users_group_name
         )
         msg = msg if success else "User wasn't in group"
         if success:
             user_data = user.get_api_data()
             audit_logger.store_api(
                 'user_group.edit.member.delete', action_data={'user': user_data},
                 user=apiuser)
 
         Session().commit()
         return {'success': success, 'msg': msg}
     except Exception:
         log.exception("Error occurred during removing an member from user group")
         raise JSONRPCError(
             'failed to remove member from user group `%s`' % (
                 user_group.users_group_name,
             )
         )
 
 
 @jsonrpc_method()
 def grant_user_permission_to_user_group(
         request, apiuser, usergroupid, userid, perm):
     """
     Set permissions for a user in a user group.
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
     :param usergroupid: Set the user group to edit permissions on.
     :type usergroupid: str or int
     :param userid: Set the user from whom you wish to set permissions.
     :type userid: str
     :param perm: (usergroup.(none|read|write|admin))
     :type perm: str
 
     Example output:
 
     .. code-block:: bash
 
       id : <id_given_in_input>
       result : {
         "msg": "Granted perm: `<perm_name>` for user: `<username>` in user group: `<user_group_name>`",
         "success": true
       }
       error :  null
     """
 
     user_group = get_user_group_or_error(usergroupid)
 
     if not has_superadmin_permission(apiuser):
         # check if we have admin permission for this user group !
         _perms = ('usergroup.admin',)
         if not HasUserGroupPermissionAnyApi(*_perms)(
                 user=apiuser, user_group_name=user_group.users_group_name):
             raise JSONRPCError(
                 'user group `%s` does not exist' % (usergroupid,))
 
     user = get_user_or_error(userid)
     perm = get_perm_or_error(perm, prefix='usergroup.')
 
     try:
         UserGroupModel().grant_user_permission(
             user_group=user_group, user=user, perm=perm)
         Session().commit()
         return {
             'msg':
                 'Granted perm: `%s` for user: `%s` in user group: `%s`' % (
                     perm.permission_name, user.username,
                     user_group.users_group_name
                 ),
             'success': True
         }
     except Exception:
         log.exception("Error occurred during editing permissions "
                       "for user in user group")
         raise JSONRPCError(
             'failed to edit permission for user: '
             '`%s` in user group: `%s`' % (
                 userid, user_group.users_group_name))
 
 
 @jsonrpc_method()
 def revoke_user_permission_from_user_group(
         request, apiuser, usergroupid, userid):
     """
     Revoke a users permissions in a user group.
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
     :param usergroupid: Set the user group from which to revoke the user
         permissions.
     :type: usergroupid: str or int
     :param userid: Set the userid of the user whose permissions will be
         revoked.
     :type userid: str
 
     Example output:
 
     .. code-block:: bash
 
       id : <id_given_in_input>
       result : {
         "msg": "Revoked perm for user: `<username>` in user group: `<user_group_name>`",
         "success": true
       }
       error :  null
     """
 
     user_group = get_user_group_or_error(usergroupid)
 
     if not has_superadmin_permission(apiuser):
         # check if we have admin permission for this user group !
         _perms = ('usergroup.admin',)
         if not HasUserGroupPermissionAnyApi(*_perms)(
                 user=apiuser, user_group_name=user_group.users_group_name):
             raise JSONRPCError(
                 'user group `%s` does not exist' % (usergroupid,))
 
     user = get_user_or_error(userid)
 
     try:
         UserGroupModel().revoke_user_permission(
             user_group=user_group, user=user)
         Session().commit()
         return {
             'msg': 'Revoked perm for user: `%s` in user group: `%s`' % (
                 user.username, user_group.users_group_name
             ),
             'success': True
         }
     except Exception:
         log.exception("Error occurred during editing permissions "
                       "for user in user group")
         raise JSONRPCError(
             'failed to edit permission for user: `%s` in user group: `%s`'
             % (userid, user_group.users_group_name))
 
 
 @jsonrpc_method()
 def grant_user_group_permission_to_user_group(
         request, apiuser, usergroupid, sourceusergroupid, perm):
     """
     Give one user group permissions to another user group.
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
     :param usergroupid: Set the user group on which to edit permissions.
     :type usergroupid: str or int
     :param sourceusergroupid: Set the source user group to which
         access/permissions will be granted.
     :type sourceusergroupid: str or int
     :param perm: (usergroup.(none|read|write|admin))
     :type perm: str
 
     Example output:
 
     .. code-block:: bash
 
       id : <id_given_in_input>
       result : {
         "msg": "Granted perm: `<perm_name>` for user group: `<source_user_group_name>` in user group: `<user_group_name>`",
         "success": true
       }
       error :  null
     """
 
     user_group = get_user_group_or_error(sourceusergroupid)
     target_user_group = get_user_group_or_error(usergroupid)
     perm = get_perm_or_error(perm, prefix='usergroup.')
 
     if not has_superadmin_permission(apiuser):
         # check if we have admin permission for this user group !
         _perms = ('usergroup.admin',)
         if not HasUserGroupPermissionAnyApi(*_perms)(
                 user=apiuser,
                 user_group_name=target_user_group.users_group_name):
             raise JSONRPCError(
                 'to user group `%s` does not exist' % (usergroupid,))
 
         # check if we have at least read permission for source user group !
         _perms = ('usergroup.read', 'usergroup.write', 'usergroup.admin',)
         if not HasUserGroupPermissionAnyApi(*_perms)(
                 user=apiuser, user_group_name=user_group.users_group_name):
             raise JSONRPCError(
                 'user group `%s` does not exist' % (sourceusergroupid,))
 
     try:
         UserGroupModel().grant_user_group_permission(
             target_user_group=target_user_group,
             user_group=user_group, perm=perm)
         Session().commit()
 
         return {
             'msg': 'Granted perm: `%s` for user group: `%s` '
                    'in user group: `%s`' % (
                        perm.permission_name, user_group.users_group_name,
                        target_user_group.users_group_name
                    ),
             'success': True
         }
     except Exception:
         log.exception("Error occurred during editing permissions "
                       "for user group in user group")
         raise JSONRPCError(
             'failed to edit permission for user group: `%s` in '
             'user group: `%s`' % (
                 sourceusergroupid, target_user_group.users_group_name
             )
         )
 
 
 @jsonrpc_method()
 def revoke_user_group_permission_from_user_group(
         request, apiuser, usergroupid, sourceusergroupid):
     """
     Revoke the permissions that one user group has to another.
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
     :param usergroupid: Set the user group on which to edit permissions.
     :type usergroupid: str or int
     :param sourceusergroupid: Set the user group from which permissions
         are revoked.
     :type sourceusergroupid: str or int
 
     Example output:
 
     .. code-block:: bash
 
       id : <id_given_in_input>
       result : {
         "msg": "Revoked perm for user group: `<user_group_name>` in user group: `<target_user_group_name>`",
         "success": true
       }
       error :  null
     """
 
     user_group = get_user_group_or_error(sourceusergroupid)
     target_user_group = get_user_group_or_error(usergroupid)
 
     if not has_superadmin_permission(apiuser):
         # check if we have admin permission for this user group !
         _perms = ('usergroup.admin',)
         if not HasUserGroupPermissionAnyApi(*_perms)(
                 user=apiuser,
                 user_group_name=target_user_group.users_group_name):
             raise JSONRPCError(
                 'to user group `%s` does not exist' % (usergroupid,))
 
         # check if we have at least read permission
         # for the source user group !
         _perms = ('usergroup.read', 'usergroup.write', 'usergroup.admin',)
         if not HasUserGroupPermissionAnyApi(*_perms)(
                 user=apiuser, user_group_name=user_group.users_group_name):
             raise JSONRPCError(
                 'user group `%s` does not exist' % (sourceusergroupid,))
 
     try:
         UserGroupModel().revoke_user_group_permission(
             target_user_group=target_user_group, user_group=user_group)
         Session().commit()
 
         return {
             'msg': 'Revoked perm for user group: '
                    '`%s` in user group: `%s`' % (
                        user_group.users_group_name,
                        target_user_group.users_group_name
                    ),
             'success': True
         }
     except Exception:
         log.exception("Error occurred during editing permissions "
                       "for user group in user group")
         raise JSONRPCError(
             'failed to edit permission for user group: '
             '`%s` in user group: `%s`' % (
                 sourceusergroupid, target_user_group.users_group_name
             )
         )

rhodecode/model/validation_schema/schemas/user_schema.py

@@ -1,61 +1,125 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2016-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
+import re
 import colander
 
 from rhodecode import forms
 from rhodecode.model.db import User
+from rhodecode.model.validation_schema import types, validators
 from rhodecode.translation import _
 from rhodecode.lib.auth import check_password
 
 
 @colander.deferred
 def deferred_user_password_validator(node, kw):
     username = kw.get('username')
     user = User.get_by_username(username)
 
     def _user_password_validator(node, value):
         if not check_password(value, user.password):
             msg = _('Password is incorrect')
             raise colander.Invalid(node, msg)
     return _user_password_validator
 
 
 class ChangePasswordSchema(colander.Schema):
 
     current_password = colander.SchemaNode(
         colander.String(),
         missing=colander.required,
         widget=forms.widget.PasswordWidget(redisplay=True),
         validator=deferred_user_password_validator)
 
     new_password = colander.SchemaNode(
         colander.String(),
         missing=colander.required,
         widget=forms.widget.CheckedPasswordWidget(redisplay=True),
         validator=colander.Length(min=6))
 
-
     def validator(self, form, values):
         if values['current_password'] == values['new_password']:
             exc = colander.Invalid(form)
             exc['new_password'] = _('New password must be different '
                                     'to old password')
             raise exc
+
+
[e-mail]
+def deferred_username_validator(node, kw):
+
+    def name_validator(node, value):
+        msg = _(
+            u'Username may only contain alphanumeric characters '
+            u'underscores, periods or dashes and must begin with '
+            u'alphanumeric character or underscore')
+
+        if not re.match(r'^[\w]{1}[\w\-\.]{0,254}$', value):
+            raise colander.Invalid(node, msg)
+
+    return name_validator
+
+
[e-mail]
+def deferred_email_validator(node, kw):
+    # NOTE(marcink): we might provide uniqueness validation later here...
+    return colander.Email()
+
+
+class UserSchema(colander.Schema):
+    username = colander.SchemaNode(
+        colander.String(),
+        validator=deferred_username_validator)
+
+    email = colander.SchemaNode(
+        colander.String(),
+        validator=deferred_email_validator)
+
+    password = colander.SchemaNode(
+        colander.String(), missing='')
+
+    first_name = colander.SchemaNode(
+        colander.String(), missing='')
+
+    last_name = colander.SchemaNode(
+        colander.String(), missing='')
+
+    active = colander.SchemaNode(
+        types.StringBooleanType(),
+        missing=False)
+
+    admin = colander.SchemaNode(
+        types.StringBooleanType(),
+        missing=False)
+
+    extern_name = colander.SchemaNode(
+        colander.String(), missing='')
+
+    extern_type = colander.SchemaNode(
+        colander.String(), missing='')
+
+    def deserialize(self, cstruct):
+        """
+        Custom deserialize that allows to chain validation, and verify
+        permissions, and as last step uniqueness
+        """
+
+        appstruct = super(UserSchema, self).deserialize(cstruct)
+        return appstruct