Show More
@@ -1,577 +1,597 b'' | |||||
1 | # -*- coding: utf-8 -*- |
|
1 | # -*- coding: utf-8 -*- | |
2 |
|
2 | |||
3 | # Copyright (C) 2010-2019 RhodeCode GmbH |
|
3 | # Copyright (C) 2010-2019 RhodeCode GmbH | |
4 | # |
|
4 | # | |
5 | # This program is free software: you can redistribute it and/or modify |
|
5 | # This program is free software: you can redistribute it and/or modify | |
6 | # it under the terms of the GNU Affero General Public License, version 3 |
|
6 | # it under the terms of the GNU Affero General Public License, version 3 | |
7 | # (only), as published by the Free Software Foundation. |
|
7 | # (only), as published by the Free Software Foundation. | |
8 | # |
|
8 | # | |
9 | # This program is distributed in the hope that it will be useful, |
|
9 | # This program is distributed in the hope that it will be useful, | |
10 | # but WITHOUT ANY WARRANTY; without even the implied warranty of |
|
10 | # but WITHOUT ANY WARRANTY; without even the implied warranty of | |
11 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
|
11 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
12 | # GNU General Public License for more details. |
|
12 | # GNU General Public License for more details. | |
13 | # |
|
13 | # | |
14 | # You should have received a copy of the GNU Affero General Public License |
|
14 | # You should have received a copy of the GNU Affero General Public License | |
15 | # along with this program. If not, see <http://www.gnu.org/licenses/>. |
|
15 | # along with this program. If not, see <http://www.gnu.org/licenses/>. | |
16 | # |
|
16 | # | |
17 | # This program is dual-licensed. If you wish to learn more about the |
|
17 | # This program is dual-licensed. If you wish to learn more about the | |
18 | # RhodeCode Enterprise Edition, including its added features, Support services, |
|
18 | # RhodeCode Enterprise Edition, including its added features, Support services, | |
19 | # and proprietary license terms, please see https://rhodecode.com/licenses/ |
|
19 | # and proprietary license terms, please see https://rhodecode.com/licenses/ | |
20 |
|
20 | |||
21 | """ |
|
21 | """ | |
22 | permissions model for RhodeCode |
|
22 | permissions model for RhodeCode | |
23 | """ |
|
23 | """ | |
24 |
|
24 | import collections | ||
25 |
|
||||
26 | import logging |
|
25 | import logging | |
27 | import traceback |
|
26 | import traceback | |
28 |
|
27 | |||
29 | from sqlalchemy.exc import DatabaseError |
|
28 | from sqlalchemy.exc import DatabaseError | |
30 |
|
29 | |||
31 | from rhodecode import events |
|
30 | from rhodecode import events | |
32 | from rhodecode.model import BaseModel |
|
31 | from rhodecode.model import BaseModel | |
33 | from rhodecode.model.db import ( |
|
32 | from rhodecode.model.db import ( | |
34 | User, Permission, UserToPerm, UserRepoToPerm, UserRepoGroupToPerm, |
|
33 | User, Permission, UserToPerm, UserRepoToPerm, UserRepoGroupToPerm, | |
35 | UserUserGroupToPerm, UserGroup, UserGroupToPerm, UserToRepoBranchPermission) |
|
34 | UserUserGroupToPerm, UserGroup, UserGroupToPerm, UserToRepoBranchPermission) | |
36 | from rhodecode.lib.utils2 import str2bool, safe_int |
|
35 | from rhodecode.lib.utils2 import str2bool, safe_int | |
37 |
|
36 | |||
38 | log = logging.getLogger(__name__) |
|
37 | log = logging.getLogger(__name__) | |
39 |
|
38 | |||
40 |
|
39 | |||
41 | class PermissionModel(BaseModel): |
|
40 | class PermissionModel(BaseModel): | |
42 | """ |
|
41 | """ | |
43 | Permissions model for RhodeCode |
|
42 | Permissions model for RhodeCode | |
44 | """ |
|
43 | """ | |
45 |
|
44 | |||
46 | cls = Permission |
|
45 | cls = Permission | |
47 | global_perms = { |
|
46 | global_perms = { | |
48 | 'default_repo_create': None, |
|
47 | 'default_repo_create': None, | |
49 | # special case for create repos on write access to group |
|
48 | # special case for create repos on write access to group | |
50 | 'default_repo_create_on_write': None, |
|
49 | 'default_repo_create_on_write': None, | |
51 | 'default_repo_group_create': None, |
|
50 | 'default_repo_group_create': None, | |
52 | 'default_user_group_create': None, |
|
51 | 'default_user_group_create': None, | |
53 | 'default_fork_create': None, |
|
52 | 'default_fork_create': None, | |
54 | 'default_inherit_default_permissions': None, |
|
53 | 'default_inherit_default_permissions': None, | |
55 | 'default_register': None, |
|
54 | 'default_register': None, | |
56 | 'default_password_reset': None, |
|
55 | 'default_password_reset': None, | |
57 | 'default_extern_activate': None, |
|
56 | 'default_extern_activate': None, | |
58 |
|
57 | |||
59 | # object permissions below |
|
58 | # object permissions below | |
60 | 'default_repo_perm': None, |
|
59 | 'default_repo_perm': None, | |
61 | 'default_group_perm': None, |
|
60 | 'default_group_perm': None, | |
62 | 'default_user_group_perm': None, |
|
61 | 'default_user_group_perm': None, | |
63 |
|
62 | |||
64 | # branch |
|
63 | # branch | |
65 | 'default_branch_perm': None, |
|
64 | 'default_branch_perm': None, | |
66 | } |
|
65 | } | |
67 |
|
66 | |||
68 | def set_global_permission_choices(self, c_obj, gettext_translator): |
|
67 | def set_global_permission_choices(self, c_obj, gettext_translator): | |
69 | _ = gettext_translator |
|
68 | _ = gettext_translator | |
70 |
|
69 | |||
71 | c_obj.repo_perms_choices = [ |
|
70 | c_obj.repo_perms_choices = [ | |
72 | ('repository.none', _('None'),), |
|
71 | ('repository.none', _('None'),), | |
73 | ('repository.read', _('Read'),), |
|
72 | ('repository.read', _('Read'),), | |
74 | ('repository.write', _('Write'),), |
|
73 | ('repository.write', _('Write'),), | |
75 | ('repository.admin', _('Admin'),)] |
|
74 | ('repository.admin', _('Admin'),)] | |
76 |
|
75 | |||
77 | c_obj.group_perms_choices = [ |
|
76 | c_obj.group_perms_choices = [ | |
78 | ('group.none', _('None'),), |
|
77 | ('group.none', _('None'),), | |
79 | ('group.read', _('Read'),), |
|
78 | ('group.read', _('Read'),), | |
80 | ('group.write', _('Write'),), |
|
79 | ('group.write', _('Write'),), | |
81 | ('group.admin', _('Admin'),)] |
|
80 | ('group.admin', _('Admin'),)] | |
82 |
|
81 | |||
83 | c_obj.user_group_perms_choices = [ |
|
82 | c_obj.user_group_perms_choices = [ | |
84 | ('usergroup.none', _('None'),), |
|
83 | ('usergroup.none', _('None'),), | |
85 | ('usergroup.read', _('Read'),), |
|
84 | ('usergroup.read', _('Read'),), | |
86 | ('usergroup.write', _('Write'),), |
|
85 | ('usergroup.write', _('Write'),), | |
87 | ('usergroup.admin', _('Admin'),)] |
|
86 | ('usergroup.admin', _('Admin'),)] | |
88 |
|
87 | |||
89 | c_obj.branch_perms_choices = [ |
|
88 | c_obj.branch_perms_choices = [ | |
90 | ('branch.none', _('Protected/No Access'),), |
|
89 | ('branch.none', _('Protected/No Access'),), | |
91 | ('branch.merge', _('Web merge'),), |
|
90 | ('branch.merge', _('Web merge'),), | |
92 | ('branch.push', _('Push'),), |
|
91 | ('branch.push', _('Push'),), | |
93 | ('branch.push_force', _('Force Push'),)] |
|
92 | ('branch.push_force', _('Force Push'),)] | |
94 |
|
93 | |||
95 | c_obj.register_choices = [ |
|
94 | c_obj.register_choices = [ | |
96 | ('hg.register.none', _('Disabled')), |
|
95 | ('hg.register.none', _('Disabled')), | |
97 | ('hg.register.manual_activate', _('Allowed with manual account activation')), |
|
96 | ('hg.register.manual_activate', _('Allowed with manual account activation')), | |
98 | ('hg.register.auto_activate', _('Allowed with automatic account activation')),] |
|
97 | ('hg.register.auto_activate', _('Allowed with automatic account activation')),] | |
99 |
|
98 | |||
100 | c_obj.password_reset_choices = [ |
|
99 | c_obj.password_reset_choices = [ | |
101 | ('hg.password_reset.enabled', _('Allow password recovery')), |
|
100 | ('hg.password_reset.enabled', _('Allow password recovery')), | |
102 | ('hg.password_reset.hidden', _('Hide password recovery link')), |
|
101 | ('hg.password_reset.hidden', _('Hide password recovery link')), | |
103 | ('hg.password_reset.disabled', _('Disable password recovery')),] |
|
102 | ('hg.password_reset.disabled', _('Disable password recovery')),] | |
104 |
|
103 | |||
105 | c_obj.extern_activate_choices = [ |
|
104 | c_obj.extern_activate_choices = [ | |
106 | ('hg.extern_activate.manual', _('Manual activation of external account')), |
|
105 | ('hg.extern_activate.manual', _('Manual activation of external account')), | |
107 | ('hg.extern_activate.auto', _('Automatic activation of external account')),] |
|
106 | ('hg.extern_activate.auto', _('Automatic activation of external account')),] | |
108 |
|
107 | |||
109 | c_obj.repo_create_choices = [ |
|
108 | c_obj.repo_create_choices = [ | |
110 | ('hg.create.none', _('Disabled')), |
|
109 | ('hg.create.none', _('Disabled')), | |
111 | ('hg.create.repository', _('Enabled'))] |
|
110 | ('hg.create.repository', _('Enabled'))] | |
112 |
|
111 | |||
113 | c_obj.repo_create_on_write_choices = [ |
|
112 | c_obj.repo_create_on_write_choices = [ | |
114 | ('hg.create.write_on_repogroup.false', _('Disabled')), |
|
113 | ('hg.create.write_on_repogroup.false', _('Disabled')), | |
115 | ('hg.create.write_on_repogroup.true', _('Enabled'))] |
|
114 | ('hg.create.write_on_repogroup.true', _('Enabled'))] | |
116 |
|
115 | |||
117 | c_obj.user_group_create_choices = [ |
|
116 | c_obj.user_group_create_choices = [ | |
118 | ('hg.usergroup.create.false', _('Disabled')), |
|
117 | ('hg.usergroup.create.false', _('Disabled')), | |
119 | ('hg.usergroup.create.true', _('Enabled'))] |
|
118 | ('hg.usergroup.create.true', _('Enabled'))] | |
120 |
|
119 | |||
121 | c_obj.repo_group_create_choices = [ |
|
120 | c_obj.repo_group_create_choices = [ | |
122 | ('hg.repogroup.create.false', _('Disabled')), |
|
121 | ('hg.repogroup.create.false', _('Disabled')), | |
123 | ('hg.repogroup.create.true', _('Enabled'))] |
|
122 | ('hg.repogroup.create.true', _('Enabled'))] | |
124 |
|
123 | |||
125 | c_obj.fork_choices = [ |
|
124 | c_obj.fork_choices = [ | |
126 | ('hg.fork.none', _('Disabled')), |
|
125 | ('hg.fork.none', _('Disabled')), | |
127 | ('hg.fork.repository', _('Enabled'))] |
|
126 | ('hg.fork.repository', _('Enabled'))] | |
128 |
|
127 | |||
129 | c_obj.inherit_default_permission_choices = [ |
|
128 | c_obj.inherit_default_permission_choices = [ | |
130 | ('hg.inherit_default_perms.false', _('Disabled')), |
|
129 | ('hg.inherit_default_perms.false', _('Disabled')), | |
131 | ('hg.inherit_default_perms.true', _('Enabled'))] |
|
130 | ('hg.inherit_default_perms.true', _('Enabled'))] | |
132 |
|
131 | |||
133 | def get_default_perms(self, object_perms, suffix): |
|
132 | def get_default_perms(self, object_perms, suffix): | |
134 | defaults = {} |
|
133 | defaults = {} | |
135 | for perm in object_perms: |
|
134 | for perm in object_perms: | |
136 | # perms |
|
135 | # perms | |
137 | if perm.permission.permission_name.startswith('repository.'): |
|
136 | if perm.permission.permission_name.startswith('repository.'): | |
138 | defaults['default_repo_perm' + suffix] = perm.permission.permission_name |
|
137 | defaults['default_repo_perm' + suffix] = perm.permission.permission_name | |
139 |
|
138 | |||
140 | if perm.permission.permission_name.startswith('group.'): |
|
139 | if perm.permission.permission_name.startswith('group.'): | |
141 | defaults['default_group_perm' + suffix] = perm.permission.permission_name |
|
140 | defaults['default_group_perm' + suffix] = perm.permission.permission_name | |
142 |
|
141 | |||
143 | if perm.permission.permission_name.startswith('usergroup.'): |
|
142 | if perm.permission.permission_name.startswith('usergroup.'): | |
144 | defaults['default_user_group_perm' + suffix] = perm.permission.permission_name |
|
143 | defaults['default_user_group_perm' + suffix] = perm.permission.permission_name | |
145 |
|
144 | |||
146 | # branch |
|
145 | # branch | |
147 | if perm.permission.permission_name.startswith('branch.'): |
|
146 | if perm.permission.permission_name.startswith('branch.'): | |
148 | defaults['default_branch_perm' + suffix] = perm.permission.permission_name |
|
147 | defaults['default_branch_perm' + suffix] = perm.permission.permission_name | |
149 |
|
148 | |||
150 | # creation of objects |
|
149 | # creation of objects | |
151 | if perm.permission.permission_name.startswith('hg.create.write_on_repogroup'): |
|
150 | if perm.permission.permission_name.startswith('hg.create.write_on_repogroup'): | |
152 | defaults['default_repo_create_on_write' + suffix] = perm.permission.permission_name |
|
151 | defaults['default_repo_create_on_write' + suffix] = perm.permission.permission_name | |
153 |
|
152 | |||
154 | elif perm.permission.permission_name.startswith('hg.create.'): |
|
153 | elif perm.permission.permission_name.startswith('hg.create.'): | |
155 | defaults['default_repo_create' + suffix] = perm.permission.permission_name |
|
154 | defaults['default_repo_create' + suffix] = perm.permission.permission_name | |
156 |
|
155 | |||
157 | if perm.permission.permission_name.startswith('hg.fork.'): |
|
156 | if perm.permission.permission_name.startswith('hg.fork.'): | |
158 | defaults['default_fork_create' + suffix] = perm.permission.permission_name |
|
157 | defaults['default_fork_create' + suffix] = perm.permission.permission_name | |
159 |
|
158 | |||
160 | if perm.permission.permission_name.startswith('hg.inherit_default_perms.'): |
|
159 | if perm.permission.permission_name.startswith('hg.inherit_default_perms.'): | |
161 | defaults['default_inherit_default_permissions' + suffix] = perm.permission.permission_name |
|
160 | defaults['default_inherit_default_permissions' + suffix] = perm.permission.permission_name | |
162 |
|
161 | |||
163 | if perm.permission.permission_name.startswith('hg.repogroup.'): |
|
162 | if perm.permission.permission_name.startswith('hg.repogroup.'): | |
164 | defaults['default_repo_group_create' + suffix] = perm.permission.permission_name |
|
163 | defaults['default_repo_group_create' + suffix] = perm.permission.permission_name | |
165 |
|
164 | |||
166 | if perm.permission.permission_name.startswith('hg.usergroup.'): |
|
165 | if perm.permission.permission_name.startswith('hg.usergroup.'): | |
167 | defaults['default_user_group_create' + suffix] = perm.permission.permission_name |
|
166 | defaults['default_user_group_create' + suffix] = perm.permission.permission_name | |
168 |
|
167 | |||
169 | # registration and external account activation |
|
168 | # registration and external account activation | |
170 | if perm.permission.permission_name.startswith('hg.register.'): |
|
169 | if perm.permission.permission_name.startswith('hg.register.'): | |
171 | defaults['default_register' + suffix] = perm.permission.permission_name |
|
170 | defaults['default_register' + suffix] = perm.permission.permission_name | |
172 |
|
171 | |||
173 | if perm.permission.permission_name.startswith('hg.password_reset.'): |
|
172 | if perm.permission.permission_name.startswith('hg.password_reset.'): | |
174 | defaults['default_password_reset' + suffix] = perm.permission.permission_name |
|
173 | defaults['default_password_reset' + suffix] = perm.permission.permission_name | |
175 |
|
174 | |||
176 | if perm.permission.permission_name.startswith('hg.extern_activate.'): |
|
175 | if perm.permission.permission_name.startswith('hg.extern_activate.'): | |
177 | defaults['default_extern_activate' + suffix] = perm.permission.permission_name |
|
176 | defaults['default_extern_activate' + suffix] = perm.permission.permission_name | |
178 |
|
177 | |||
179 | return defaults |
|
178 | return defaults | |
180 |
|
179 | |||
181 | def _make_new_user_perm(self, user, perm_name): |
|
180 | def _make_new_user_perm(self, user, perm_name): | |
182 | log.debug('Creating new user permission:%s', perm_name) |
|
181 | log.debug('Creating new user permission:%s', perm_name) | |
183 | new = UserToPerm() |
|
182 | new = UserToPerm() | |
184 | new.user = user |
|
183 | new.user = user | |
185 | new.permission = Permission.get_by_key(perm_name) |
|
184 | new.permission = Permission.get_by_key(perm_name) | |
186 | return new |
|
185 | return new | |
187 |
|
186 | |||
188 | def _make_new_user_group_perm(self, user_group, perm_name): |
|
187 | def _make_new_user_group_perm(self, user_group, perm_name): | |
189 | log.debug('Creating new user group permission:%s', perm_name) |
|
188 | log.debug('Creating new user group permission:%s', perm_name) | |
190 | new = UserGroupToPerm() |
|
189 | new = UserGroupToPerm() | |
191 | new.users_group = user_group |
|
190 | new.users_group = user_group | |
192 | new.permission = Permission.get_by_key(perm_name) |
|
191 | new.permission = Permission.get_by_key(perm_name) | |
193 | return new |
|
192 | return new | |
194 |
|
193 | |||
195 | def _keep_perm(self, perm_name, keep_fields): |
|
194 | def _keep_perm(self, perm_name, keep_fields): | |
196 | def get_pat(field_name): |
|
195 | def get_pat(field_name): | |
197 | return { |
|
196 | return { | |
198 | # global perms |
|
197 | # global perms | |
199 | 'default_repo_create': 'hg.create.', |
|
198 | 'default_repo_create': 'hg.create.', | |
200 | # special case for create repos on write access to group |
|
199 | # special case for create repos on write access to group | |
201 | 'default_repo_create_on_write': 'hg.create.write_on_repogroup.', |
|
200 | 'default_repo_create_on_write': 'hg.create.write_on_repogroup.', | |
202 | 'default_repo_group_create': 'hg.repogroup.create.', |
|
201 | 'default_repo_group_create': 'hg.repogroup.create.', | |
203 | 'default_user_group_create': 'hg.usergroup.create.', |
|
202 | 'default_user_group_create': 'hg.usergroup.create.', | |
204 | 'default_fork_create': 'hg.fork.', |
|
203 | 'default_fork_create': 'hg.fork.', | |
205 | 'default_inherit_default_permissions': 'hg.inherit_default_perms.', |
|
204 | 'default_inherit_default_permissions': 'hg.inherit_default_perms.', | |
206 |
|
205 | |||
207 | # application perms |
|
206 | # application perms | |
208 | 'default_register': 'hg.register.', |
|
207 | 'default_register': 'hg.register.', | |
209 | 'default_password_reset': 'hg.password_reset.', |
|
208 | 'default_password_reset': 'hg.password_reset.', | |
210 | 'default_extern_activate': 'hg.extern_activate.', |
|
209 | 'default_extern_activate': 'hg.extern_activate.', | |
211 |
|
210 | |||
212 | # object permissions below |
|
211 | # object permissions below | |
213 | 'default_repo_perm': 'repository.', |
|
212 | 'default_repo_perm': 'repository.', | |
214 | 'default_group_perm': 'group.', |
|
213 | 'default_group_perm': 'group.', | |
215 | 'default_user_group_perm': 'usergroup.', |
|
214 | 'default_user_group_perm': 'usergroup.', | |
216 | # branch |
|
215 | # branch | |
217 | 'default_branch_perm': 'branch.', |
|
216 | 'default_branch_perm': 'branch.', | |
218 |
|
217 | |||
219 | }[field_name] |
|
218 | }[field_name] | |
220 | for field in keep_fields: |
|
219 | for field in keep_fields: | |
221 | pat = get_pat(field) |
|
220 | pat = get_pat(field) | |
222 | if perm_name.startswith(pat): |
|
221 | if perm_name.startswith(pat): | |
223 | return True |
|
222 | return True | |
224 | return False |
|
223 | return False | |
225 |
|
224 | |||
226 | def _clear_object_perm(self, object_perms, preserve=None): |
|
225 | def _clear_object_perm(self, object_perms, preserve=None): | |
227 | preserve = preserve or [] |
|
226 | preserve = preserve or [] | |
228 | _deleted = [] |
|
227 | _deleted = [] | |
229 | for perm in object_perms: |
|
228 | for perm in object_perms: | |
230 | perm_name = perm.permission.permission_name |
|
229 | perm_name = perm.permission.permission_name | |
231 | if not self._keep_perm(perm_name, keep_fields=preserve): |
|
230 | if not self._keep_perm(perm_name, keep_fields=preserve): | |
232 | _deleted.append(perm_name) |
|
231 | _deleted.append(perm_name) | |
233 | self.sa.delete(perm) |
|
232 | self.sa.delete(perm) | |
234 | return _deleted |
|
233 | return _deleted | |
235 |
|
234 | |||
236 | def _clear_user_perms(self, user_id, preserve=None): |
|
235 | def _clear_user_perms(self, user_id, preserve=None): | |
237 | perms = self.sa.query(UserToPerm)\ |
|
236 | perms = self.sa.query(UserToPerm)\ | |
238 | .filter(UserToPerm.user_id == user_id)\ |
|
237 | .filter(UserToPerm.user_id == user_id)\ | |
239 | .all() |
|
238 | .all() | |
240 | return self._clear_object_perm(perms, preserve=preserve) |
|
239 | return self._clear_object_perm(perms, preserve=preserve) | |
241 |
|
240 | |||
242 | def _clear_user_group_perms(self, user_group_id, preserve=None): |
|
241 | def _clear_user_group_perms(self, user_group_id, preserve=None): | |
243 | perms = self.sa.query(UserGroupToPerm)\ |
|
242 | perms = self.sa.query(UserGroupToPerm)\ | |
244 | .filter(UserGroupToPerm.users_group_id == user_group_id)\ |
|
243 | .filter(UserGroupToPerm.users_group_id == user_group_id)\ | |
245 | .all() |
|
244 | .all() | |
246 | return self._clear_object_perm(perms, preserve=preserve) |
|
245 | return self._clear_object_perm(perms, preserve=preserve) | |
247 |
|
246 | |||
248 | def _set_new_object_perms(self, obj_type, object, form_result, preserve=None): |
|
247 | def _set_new_object_perms(self, obj_type, object, form_result, preserve=None): | |
249 | # clear current entries, to make this function idempotent |
|
248 | # clear current entries, to make this function idempotent | |
250 | # it will fix even if we define more permissions or permissions |
|
249 | # it will fix even if we define more permissions or permissions | |
251 | # are somehow missing |
|
250 | # are somehow missing | |
252 | preserve = preserve or [] |
|
251 | preserve = preserve or [] | |
253 | _global_perms = self.global_perms.copy() |
|
252 | _global_perms = self.global_perms.copy() | |
254 | if obj_type not in ['user', 'user_group']: |
|
253 | if obj_type not in ['user', 'user_group']: | |
255 | raise ValueError("obj_type must be on of 'user' or 'user_group'") |
|
254 | raise ValueError("obj_type must be on of 'user' or 'user_group'") | |
256 | global_perms = len(_global_perms) |
|
255 | global_perms = len(_global_perms) | |
257 | default_user_perms = len(Permission.DEFAULT_USER_PERMISSIONS) |
|
256 | default_user_perms = len(Permission.DEFAULT_USER_PERMISSIONS) | |
258 | if global_perms != default_user_perms: |
|
257 | if global_perms != default_user_perms: | |
259 | raise Exception( |
|
258 | raise Exception( | |
260 | 'Inconsistent permissions definition. Got {} vs {}'.format( |
|
259 | 'Inconsistent permissions definition. Got {} vs {}'.format( | |
261 | global_perms, default_user_perms)) |
|
260 | global_perms, default_user_perms)) | |
262 |
|
261 | |||
263 | if obj_type == 'user': |
|
262 | if obj_type == 'user': | |
264 | self._clear_user_perms(object.user_id, preserve) |
|
263 | self._clear_user_perms(object.user_id, preserve) | |
265 | if obj_type == 'user_group': |
|
264 | if obj_type == 'user_group': | |
266 | self._clear_user_group_perms(object.users_group_id, preserve) |
|
265 | self._clear_user_group_perms(object.users_group_id, preserve) | |
267 |
|
266 | |||
268 | # now kill the keys that we want to preserve from the form. |
|
267 | # now kill the keys that we want to preserve from the form. | |
269 | for key in preserve: |
|
268 | for key in preserve: | |
270 | del _global_perms[key] |
|
269 | del _global_perms[key] | |
271 |
|
270 | |||
272 | for k in _global_perms.copy(): |
|
271 | for k in _global_perms.copy(): | |
273 | _global_perms[k] = form_result[k] |
|
272 | _global_perms[k] = form_result[k] | |
274 |
|
273 | |||
275 | # at that stage we validate all are passed inside form_result |
|
274 | # at that stage we validate all are passed inside form_result | |
276 | for _perm_key, perm_value in _global_perms.items(): |
|
275 | for _perm_key, perm_value in _global_perms.items(): | |
277 | if perm_value is None: |
|
276 | if perm_value is None: | |
278 | raise ValueError('Missing permission for %s' % (_perm_key,)) |
|
277 | raise ValueError('Missing permission for %s' % (_perm_key,)) | |
279 |
|
278 | |||
280 | if obj_type == 'user': |
|
279 | if obj_type == 'user': | |
281 | p = self._make_new_user_perm(object, perm_value) |
|
280 | p = self._make_new_user_perm(object, perm_value) | |
282 | self.sa.add(p) |
|
281 | self.sa.add(p) | |
283 | if obj_type == 'user_group': |
|
282 | if obj_type == 'user_group': | |
284 | p = self._make_new_user_group_perm(object, perm_value) |
|
283 | p = self._make_new_user_group_perm(object, perm_value) | |
285 | self.sa.add(p) |
|
284 | self.sa.add(p) | |
286 |
|
285 | |||
287 | def _set_new_user_perms(self, user, form_result, preserve=None): |
|
286 | def _set_new_user_perms(self, user, form_result, preserve=None): | |
288 | return self._set_new_object_perms( |
|
287 | return self._set_new_object_perms( | |
289 | 'user', user, form_result, preserve) |
|
288 | 'user', user, form_result, preserve) | |
290 |
|
289 | |||
291 | def _set_new_user_group_perms(self, user_group, form_result, preserve=None): |
|
290 | def _set_new_user_group_perms(self, user_group, form_result, preserve=None): | |
292 | return self._set_new_object_perms( |
|
291 | return self._set_new_object_perms( | |
293 | 'user_group', user_group, form_result, preserve) |
|
292 | 'user_group', user_group, form_result, preserve) | |
294 |
|
293 | |||
295 | def set_new_user_perms(self, user, form_result): |
|
294 | def set_new_user_perms(self, user, form_result): | |
296 | # calculate what to preserve from what is given in form_result |
|
295 | # calculate what to preserve from what is given in form_result | |
297 | preserve = set(self.global_perms.keys()).difference(set(form_result.keys())) |
|
296 | preserve = set(self.global_perms.keys()).difference(set(form_result.keys())) | |
298 | return self._set_new_user_perms(user, form_result, preserve) |
|
297 | return self._set_new_user_perms(user, form_result, preserve) | |
299 |
|
298 | |||
300 | def set_new_user_group_perms(self, user_group, form_result): |
|
299 | def set_new_user_group_perms(self, user_group, form_result): | |
301 | # calculate what to preserve from what is given in form_result |
|
300 | # calculate what to preserve from what is given in form_result | |
302 | preserve = set(self.global_perms.keys()).difference(set(form_result.keys())) |
|
301 | preserve = set(self.global_perms.keys()).difference(set(form_result.keys())) | |
303 | return self._set_new_user_group_perms(user_group, form_result, preserve) |
|
302 | return self._set_new_user_group_perms(user_group, form_result, preserve) | |
304 |
|
303 | |||
305 | def create_permissions(self): |
|
304 | def create_permissions(self): | |
306 | """ |
|
305 | """ | |
307 | Create permissions for whole system |
|
306 | Create permissions for whole system | |
308 | """ |
|
307 | """ | |
309 | for p in Permission.PERMS: |
|
308 | for p in Permission.PERMS: | |
310 | if not Permission.get_by_key(p[0]): |
|
309 | if not Permission.get_by_key(p[0]): | |
311 | new_perm = Permission() |
|
310 | new_perm = Permission() | |
312 | new_perm.permission_name = p[0] |
|
311 | new_perm.permission_name = p[0] | |
313 | new_perm.permission_longname = p[0] # translation err with p[1] |
|
312 | new_perm.permission_longname = p[0] # translation err with p[1] | |
314 | self.sa.add(new_perm) |
|
313 | self.sa.add(new_perm) | |
315 |
|
314 | |||
316 | def _create_default_object_permission(self, obj_type, obj, obj_perms, |
|
315 | def _create_default_object_permission(self, obj_type, obj, obj_perms, | |
317 | force=False): |
|
316 | force=False): | |
318 | if obj_type not in ['user', 'user_group']: |
|
317 | if obj_type not in ['user', 'user_group']: | |
319 | raise ValueError("obj_type must be on of 'user' or 'user_group'") |
|
318 | raise ValueError("obj_type must be on of 'user' or 'user_group'") | |
320 |
|
319 | |||
321 | def _get_group(perm_name): |
|
320 | def _get_group(perm_name): | |
322 | return '.'.join(perm_name.split('.')[:1]) |
|
321 | return '.'.join(perm_name.split('.')[:1]) | |
323 |
|
322 | |||
324 | defined_perms_groups = map( |
|
323 | defined_perms_groups = map( | |
325 | _get_group, (x.permission.permission_name for x in obj_perms)) |
|
324 | _get_group, (x.permission.permission_name for x in obj_perms)) | |
326 | log.debug('GOT ALREADY DEFINED:%s', obj_perms) |
|
325 | log.debug('GOT ALREADY DEFINED:%s', obj_perms) | |
327 |
|
326 | |||
328 | if force: |
|
327 | if force: | |
329 | self._clear_object_perm(obj_perms) |
|
328 | self._clear_object_perm(obj_perms) | |
330 | self.sa.commit() |
|
329 | self.sa.commit() | |
331 | defined_perms_groups = [] |
|
330 | defined_perms_groups = [] | |
332 | # for every default permission that needs to be created, we check if |
|
331 | # for every default permission that needs to be created, we check if | |
333 | # it's group is already defined, if it's not we create default perm |
|
332 | # it's group is already defined, if it's not we create default perm | |
334 | for perm_name in Permission.DEFAULT_USER_PERMISSIONS: |
|
333 | for perm_name in Permission.DEFAULT_USER_PERMISSIONS: | |
335 | gr = _get_group(perm_name) |
|
334 | gr = _get_group(perm_name) | |
336 | if gr not in defined_perms_groups: |
|
335 | if gr not in defined_perms_groups: | |
337 | log.debug('GR:%s not found, creating permission %s', |
|
336 | log.debug('GR:%s not found, creating permission %s', | |
338 | gr, perm_name) |
|
337 | gr, perm_name) | |
339 | if obj_type == 'user': |
|
338 | if obj_type == 'user': | |
340 | new_perm = self._make_new_user_perm(obj, perm_name) |
|
339 | new_perm = self._make_new_user_perm(obj, perm_name) | |
341 | self.sa.add(new_perm) |
|
340 | self.sa.add(new_perm) | |
342 | if obj_type == 'user_group': |
|
341 | if obj_type == 'user_group': | |
343 | new_perm = self._make_new_user_group_perm(obj, perm_name) |
|
342 | new_perm = self._make_new_user_group_perm(obj, perm_name) | |
344 | self.sa.add(new_perm) |
|
343 | self.sa.add(new_perm) | |
345 |
|
344 | |||
346 | def create_default_user_permissions(self, user, force=False): |
|
345 | def create_default_user_permissions(self, user, force=False): | |
347 | """ |
|
346 | """ | |
348 | Creates only missing default permissions for user, if force is set it |
|
347 | Creates only missing default permissions for user, if force is set it | |
349 | resets the default permissions for that user |
|
348 | resets the default permissions for that user | |
350 |
|
349 | |||
351 | :param user: |
|
350 | :param user: | |
352 | :param force: |
|
351 | :param force: | |
353 | """ |
|
352 | """ | |
354 | user = self._get_user(user) |
|
353 | user = self._get_user(user) | |
355 | obj_perms = UserToPerm.query().filter(UserToPerm.user == user).all() |
|
354 | obj_perms = UserToPerm.query().filter(UserToPerm.user == user).all() | |
356 | return self._create_default_object_permission( |
|
355 | return self._create_default_object_permission( | |
357 | 'user', user, obj_perms, force) |
|
356 | 'user', user, obj_perms, force) | |
358 |
|
357 | |||
359 | def create_default_user_group_permissions(self, user_group, force=False): |
|
358 | def create_default_user_group_permissions(self, user_group, force=False): | |
360 | """ |
|
359 | """ | |
361 | Creates only missing default permissions for user group, if force is |
|
360 | Creates only missing default permissions for user group, if force is | |
362 | set it resets the default permissions for that user group |
|
361 | set it resets the default permissions for that user group | |
363 |
|
362 | |||
364 | :param user_group: |
|
363 | :param user_group: | |
365 | :param force: |
|
364 | :param force: | |
366 | """ |
|
365 | """ | |
367 | user_group = self._get_user_group(user_group) |
|
366 | user_group = self._get_user_group(user_group) | |
368 | obj_perms = UserToPerm.query().filter(UserGroupToPerm.users_group == user_group).all() |
|
367 | obj_perms = UserToPerm.query().filter(UserGroupToPerm.users_group == user_group).all() | |
369 | return self._create_default_object_permission( |
|
368 | return self._create_default_object_permission( | |
370 | 'user_group', user_group, obj_perms, force) |
|
369 | 'user_group', user_group, obj_perms, force) | |
371 |
|
370 | |||
372 | def update_application_permissions(self, form_result): |
|
371 | def update_application_permissions(self, form_result): | |
373 | if 'perm_user_id' in form_result: |
|
372 | if 'perm_user_id' in form_result: | |
374 | perm_user = User.get(safe_int(form_result['perm_user_id'])) |
|
373 | perm_user = User.get(safe_int(form_result['perm_user_id'])) | |
375 | else: |
|
374 | else: | |
376 | # used mostly to do lookup for default user |
|
375 | # used mostly to do lookup for default user | |
377 | perm_user = User.get_by_username(form_result['perm_user_name']) |
|
376 | perm_user = User.get_by_username(form_result['perm_user_name']) | |
378 |
|
377 | |||
379 | try: |
|
378 | try: | |
380 | # stage 1 set anonymous access |
|
379 | # stage 1 set anonymous access | |
381 | if perm_user.username == User.DEFAULT_USER: |
|
380 | if perm_user.username == User.DEFAULT_USER: | |
382 | perm_user.active = str2bool(form_result['anonymous']) |
|
381 | perm_user.active = str2bool(form_result['anonymous']) | |
383 | self.sa.add(perm_user) |
|
382 | self.sa.add(perm_user) | |
384 |
|
383 | |||
385 | # stage 2 reset defaults and set them from form data |
|
384 | # stage 2 reset defaults and set them from form data | |
386 | self._set_new_user_perms(perm_user, form_result, preserve=[ |
|
385 | self._set_new_user_perms(perm_user, form_result, preserve=[ | |
387 | 'default_repo_perm', |
|
386 | 'default_repo_perm', | |
388 | 'default_group_perm', |
|
387 | 'default_group_perm', | |
389 | 'default_user_group_perm', |
|
388 | 'default_user_group_perm', | |
390 | 'default_branch_perm', |
|
389 | 'default_branch_perm', | |
391 |
|
390 | |||
392 | 'default_repo_group_create', |
|
391 | 'default_repo_group_create', | |
393 | 'default_user_group_create', |
|
392 | 'default_user_group_create', | |
394 | 'default_repo_create_on_write', |
|
393 | 'default_repo_create_on_write', | |
395 | 'default_repo_create', |
|
394 | 'default_repo_create', | |
396 | 'default_fork_create', |
|
395 | 'default_fork_create', | |
397 | 'default_inherit_default_permissions',]) |
|
396 | 'default_inherit_default_permissions',]) | |
398 |
|
397 | |||
399 | self.sa.commit() |
|
398 | self.sa.commit() | |
400 | except (DatabaseError,): |
|
399 | except (DatabaseError,): | |
401 | log.error(traceback.format_exc()) |
|
400 | log.error(traceback.format_exc()) | |
402 | self.sa.rollback() |
|
401 | self.sa.rollback() | |
403 | raise |
|
402 | raise | |
404 |
|
403 | |||
405 | def update_user_permissions(self, form_result): |
|
404 | def update_user_permissions(self, form_result): | |
406 | if 'perm_user_id' in form_result: |
|
405 | if 'perm_user_id' in form_result: | |
407 | perm_user = User.get(safe_int(form_result['perm_user_id'])) |
|
406 | perm_user = User.get(safe_int(form_result['perm_user_id'])) | |
408 | else: |
|
407 | else: | |
409 | # used mostly to do lookup for default user |
|
408 | # used mostly to do lookup for default user | |
410 | perm_user = User.get_by_username(form_result['perm_user_name']) |
|
409 | perm_user = User.get_by_username(form_result['perm_user_name']) | |
411 | try: |
|
410 | try: | |
412 | # stage 2 reset defaults and set them from form data |
|
411 | # stage 2 reset defaults and set them from form data | |
413 | self._set_new_user_perms(perm_user, form_result, preserve=[ |
|
412 | self._set_new_user_perms(perm_user, form_result, preserve=[ | |
414 | 'default_repo_perm', |
|
413 | 'default_repo_perm', | |
415 | 'default_group_perm', |
|
414 | 'default_group_perm', | |
416 | 'default_user_group_perm', |
|
415 | 'default_user_group_perm', | |
417 | 'default_branch_perm', |
|
416 | 'default_branch_perm', | |
418 |
|
417 | |||
419 | 'default_register', |
|
418 | 'default_register', | |
420 | 'default_password_reset', |
|
419 | 'default_password_reset', | |
421 | 'default_extern_activate']) |
|
420 | 'default_extern_activate']) | |
422 | self.sa.commit() |
|
421 | self.sa.commit() | |
423 | except (DatabaseError,): |
|
422 | except (DatabaseError,): | |
424 | log.error(traceback.format_exc()) |
|
423 | log.error(traceback.format_exc()) | |
425 | self.sa.rollback() |
|
424 | self.sa.rollback() | |
426 | raise |
|
425 | raise | |
427 |
|
426 | |||
428 | def update_user_group_permissions(self, form_result): |
|
427 | def update_user_group_permissions(self, form_result): | |
429 | if 'perm_user_group_id' in form_result: |
|
428 | if 'perm_user_group_id' in form_result: | |
430 | perm_user_group = UserGroup.get(safe_int(form_result['perm_user_group_id'])) |
|
429 | perm_user_group = UserGroup.get(safe_int(form_result['perm_user_group_id'])) | |
431 | else: |
|
430 | else: | |
432 | # used mostly to do lookup for default user |
|
431 | # used mostly to do lookup for default user | |
433 | perm_user_group = UserGroup.get_by_group_name(form_result['perm_user_group_name']) |
|
432 | perm_user_group = UserGroup.get_by_group_name(form_result['perm_user_group_name']) | |
434 | try: |
|
433 | try: | |
435 | # stage 2 reset defaults and set them from form data |
|
434 | # stage 2 reset defaults and set them from form data | |
436 | self._set_new_user_group_perms(perm_user_group, form_result, preserve=[ |
|
435 | self._set_new_user_group_perms(perm_user_group, form_result, preserve=[ | |
437 | 'default_repo_perm', |
|
436 | 'default_repo_perm', | |
438 | 'default_group_perm', |
|
437 | 'default_group_perm', | |
439 | 'default_user_group_perm', |
|
438 | 'default_user_group_perm', | |
440 | 'default_branch_perm', |
|
439 | 'default_branch_perm', | |
441 |
|
440 | |||
442 | 'default_register', |
|
441 | 'default_register', | |
443 | 'default_password_reset', |
|
442 | 'default_password_reset', | |
444 | 'default_extern_activate']) |
|
443 | 'default_extern_activate']) | |
445 | self.sa.commit() |
|
444 | self.sa.commit() | |
446 | except (DatabaseError,): |
|
445 | except (DatabaseError,): | |
447 | log.error(traceback.format_exc()) |
|
446 | log.error(traceback.format_exc()) | |
448 | self.sa.rollback() |
|
447 | self.sa.rollback() | |
449 | raise |
|
448 | raise | |
450 |
|
449 | |||
451 | def update_object_permissions(self, form_result): |
|
450 | def update_object_permissions(self, form_result): | |
452 | if 'perm_user_id' in form_result: |
|
451 | if 'perm_user_id' in form_result: | |
453 | perm_user = User.get(safe_int(form_result['perm_user_id'])) |
|
452 | perm_user = User.get(safe_int(form_result['perm_user_id'])) | |
454 | else: |
|
453 | else: | |
455 | # used mostly to do lookup for default user |
|
454 | # used mostly to do lookup for default user | |
456 | perm_user = User.get_by_username(form_result['perm_user_name']) |
|
455 | perm_user = User.get_by_username(form_result['perm_user_name']) | |
457 | try: |
|
456 | try: | |
458 |
|
457 | |||
459 | # stage 2 reset defaults and set them from form data |
|
458 | # stage 2 reset defaults and set them from form data | |
460 | self._set_new_user_perms(perm_user, form_result, preserve=[ |
|
459 | self._set_new_user_perms(perm_user, form_result, preserve=[ | |
461 | 'default_repo_group_create', |
|
460 | 'default_repo_group_create', | |
462 | 'default_user_group_create', |
|
461 | 'default_user_group_create', | |
463 | 'default_repo_create_on_write', |
|
462 | 'default_repo_create_on_write', | |
464 | 'default_repo_create', |
|
463 | 'default_repo_create', | |
465 | 'default_fork_create', |
|
464 | 'default_fork_create', | |
466 | 'default_inherit_default_permissions', |
|
465 | 'default_inherit_default_permissions', | |
467 | 'default_branch_perm', |
|
466 | 'default_branch_perm', | |
468 |
|
467 | |||
469 | 'default_register', |
|
468 | 'default_register', | |
470 | 'default_password_reset', |
|
469 | 'default_password_reset', | |
471 | 'default_extern_activate']) |
|
470 | 'default_extern_activate']) | |
472 |
|
471 | |||
473 | # overwrite default repo permissions |
|
472 | # overwrite default repo permissions | |
474 | if form_result['overwrite_default_repo']: |
|
473 | if form_result['overwrite_default_repo']: | |
475 | _def_name = form_result['default_repo_perm'].split('repository.')[-1] |
|
474 | _def_name = form_result['default_repo_perm'].split('repository.')[-1] | |
476 | _def = Permission.get_by_key('repository.' + _def_name) |
|
475 | _def = Permission.get_by_key('repository.' + _def_name) | |
477 | for r2p in self.sa.query(UserRepoToPerm)\ |
|
476 | for r2p in self.sa.query(UserRepoToPerm)\ | |
478 | .filter(UserRepoToPerm.user == perm_user)\ |
|
477 | .filter(UserRepoToPerm.user == perm_user)\ | |
479 | .all(): |
|
478 | .all(): | |
480 | # don't reset PRIVATE repositories |
|
479 | # don't reset PRIVATE repositories | |
481 | if not r2p.repository.private: |
|
480 | if not r2p.repository.private: | |
482 | r2p.permission = _def |
|
481 | r2p.permission = _def | |
483 | self.sa.add(r2p) |
|
482 | self.sa.add(r2p) | |
484 |
|
483 | |||
485 | # overwrite default repo group permissions |
|
484 | # overwrite default repo group permissions | |
486 | if form_result['overwrite_default_group']: |
|
485 | if form_result['overwrite_default_group']: | |
487 | _def_name = form_result['default_group_perm'].split('group.')[-1] |
|
486 | _def_name = form_result['default_group_perm'].split('group.')[-1] | |
488 | _def = Permission.get_by_key('group.' + _def_name) |
|
487 | _def = Permission.get_by_key('group.' + _def_name) | |
489 | for g2p in self.sa.query(UserRepoGroupToPerm)\ |
|
488 | for g2p in self.sa.query(UserRepoGroupToPerm)\ | |
490 | .filter(UserRepoGroupToPerm.user == perm_user)\ |
|
489 | .filter(UserRepoGroupToPerm.user == perm_user)\ | |
491 | .all(): |
|
490 | .all(): | |
492 | g2p.permission = _def |
|
491 | g2p.permission = _def | |
493 | self.sa.add(g2p) |
|
492 | self.sa.add(g2p) | |
494 |
|
493 | |||
495 | # overwrite default user group permissions |
|
494 | # overwrite default user group permissions | |
496 | if form_result['overwrite_default_user_group']: |
|
495 | if form_result['overwrite_default_user_group']: | |
497 | _def_name = form_result['default_user_group_perm'].split('usergroup.')[-1] |
|
496 | _def_name = form_result['default_user_group_perm'].split('usergroup.')[-1] | |
498 | # user groups |
|
497 | # user groups | |
499 | _def = Permission.get_by_key('usergroup.' + _def_name) |
|
498 | _def = Permission.get_by_key('usergroup.' + _def_name) | |
500 | for g2p in self.sa.query(UserUserGroupToPerm)\ |
|
499 | for g2p in self.sa.query(UserUserGroupToPerm)\ | |
501 | .filter(UserUserGroupToPerm.user == perm_user)\ |
|
500 | .filter(UserUserGroupToPerm.user == perm_user)\ | |
502 | .all(): |
|
501 | .all(): | |
503 | g2p.permission = _def |
|
502 | g2p.permission = _def | |
504 | self.sa.add(g2p) |
|
503 | self.sa.add(g2p) | |
505 |
|
504 | |||
506 | # COMMIT |
|
505 | # COMMIT | |
507 | self.sa.commit() |
|
506 | self.sa.commit() | |
508 | except (DatabaseError,): |
|
507 | except (DatabaseError,): | |
509 | log.exception('Failed to set default object permissions') |
|
508 | log.exception('Failed to set default object permissions') | |
510 | self.sa.rollback() |
|
509 | self.sa.rollback() | |
511 | raise |
|
510 | raise | |
512 |
|
511 | |||
513 | def update_branch_permissions(self, form_result): |
|
512 | def update_branch_permissions(self, form_result): | |
514 | if 'perm_user_id' in form_result: |
|
513 | if 'perm_user_id' in form_result: | |
515 | perm_user = User.get(safe_int(form_result['perm_user_id'])) |
|
514 | perm_user = User.get(safe_int(form_result['perm_user_id'])) | |
516 | else: |
|
515 | else: | |
517 | # used mostly to do lookup for default user |
|
516 | # used mostly to do lookup for default user | |
518 | perm_user = User.get_by_username(form_result['perm_user_name']) |
|
517 | perm_user = User.get_by_username(form_result['perm_user_name']) | |
519 | try: |
|
518 | try: | |
520 |
|
519 | |||
521 | # stage 2 reset defaults and set them from form data |
|
520 | # stage 2 reset defaults and set them from form data | |
522 | self._set_new_user_perms(perm_user, form_result, preserve=[ |
|
521 | self._set_new_user_perms(perm_user, form_result, preserve=[ | |
523 | 'default_repo_perm', |
|
522 | 'default_repo_perm', | |
524 | 'default_group_perm', |
|
523 | 'default_group_perm', | |
525 | 'default_user_group_perm', |
|
524 | 'default_user_group_perm', | |
526 |
|
525 | |||
527 | 'default_repo_group_create', |
|
526 | 'default_repo_group_create', | |
528 | 'default_user_group_create', |
|
527 | 'default_user_group_create', | |
529 | 'default_repo_create_on_write', |
|
528 | 'default_repo_create_on_write', | |
530 | 'default_repo_create', |
|
529 | 'default_repo_create', | |
531 | 'default_fork_create', |
|
530 | 'default_fork_create', | |
532 | 'default_inherit_default_permissions', |
|
531 | 'default_inherit_default_permissions', | |
533 |
|
532 | |||
534 | 'default_register', |
|
533 | 'default_register', | |
535 | 'default_password_reset', |
|
534 | 'default_password_reset', | |
536 | 'default_extern_activate']) |
|
535 | 'default_extern_activate']) | |
537 |
|
536 | |||
538 | # overwrite default branch permissions |
|
537 | # overwrite default branch permissions | |
539 | if form_result['overwrite_default_branch']: |
|
538 | if form_result['overwrite_default_branch']: | |
540 | _def_name = \ |
|
539 | _def_name = \ | |
541 | form_result['default_branch_perm'].split('branch.')[-1] |
|
540 | form_result['default_branch_perm'].split('branch.')[-1] | |
542 |
|
541 | |||
543 | _def = Permission.get_by_key('branch.' + _def_name) |
|
542 | _def = Permission.get_by_key('branch.' + _def_name) | |
544 |
|
543 | |||
545 | user_perms = UserToRepoBranchPermission.query()\ |
|
544 | user_perms = UserToRepoBranchPermission.query()\ | |
546 | .join(UserToRepoBranchPermission.user_repo_to_perm)\ |
|
545 | .join(UserToRepoBranchPermission.user_repo_to_perm)\ | |
547 | .filter(UserRepoToPerm.user == perm_user).all() |
|
546 | .filter(UserRepoToPerm.user == perm_user).all() | |
548 |
|
547 | |||
549 | for g2p in user_perms: |
|
548 | for g2p in user_perms: | |
550 | g2p.permission = _def |
|
549 | g2p.permission = _def | |
551 | self.sa.add(g2p) |
|
550 | self.sa.add(g2p) | |
552 |
|
551 | |||
553 | # COMMIT |
|
552 | # COMMIT | |
554 | self.sa.commit() |
|
553 | self.sa.commit() | |
555 | except (DatabaseError,): |
|
554 | except (DatabaseError,): | |
556 | log.exception('Failed to set default branch permissions') |
|
555 | log.exception('Failed to set default branch permissions') | |
557 | self.sa.rollback() |
|
556 | self.sa.rollback() | |
558 | raise |
|
557 | raise | |
559 |
|
558 | |||
|
559 | def get_users_with_repo_write(self, db_repo): | |||
|
560 | write_plus = ['repository.write', 'repository.admin'] | |||
|
561 | default_user_id = User.get_default_user().user_id | |||
|
562 | user_write_permissions = collections.OrderedDict() | |||
|
563 | ||||
|
564 | # write+ and DEFAULT user for inheritance | |||
|
565 | for perm in db_repo.permissions(): | |||
|
566 | if perm.permission in write_plus or perm.user_id == default_user_id: | |||
|
567 | user_write_permissions[perm.user_id] = perm | |||
|
568 | return user_write_permissions | |||
|
569 | ||||
|
570 | def get_user_groups_with_repo_write(self, db_repo): | |||
|
571 | write_plus = ['repository.write', 'repository.admin'] | |||
|
572 | user_group_write_permissions = collections.OrderedDict() | |||
|
573 | ||||
|
574 | # write+ and DEFAULT user for inheritance | |||
|
575 | for p in db_repo.permission_user_groups(): | |||
|
576 | if p.permission in write_plus: | |||
|
577 | user_group_write_permissions[p.users_group_id] = p | |||
|
578 | return user_group_write_permissions | |||
|
579 | ||||
560 | def trigger_permission_flush(self, affected_user_ids): |
|
580 | def trigger_permission_flush(self, affected_user_ids): | |
561 | events.trigger(events.UserPermissionsChange(affected_user_ids)) |
|
581 | events.trigger(events.UserPermissionsChange(affected_user_ids)) | |
562 |
|
582 | |||
563 | def flush_user_permission_caches(self, changes, affected_user_ids=None): |
|
583 | def flush_user_permission_caches(self, changes, affected_user_ids=None): | |
564 | affected_user_ids = affected_user_ids or [] |
|
584 | affected_user_ids = affected_user_ids or [] | |
565 |
|
585 | |||
566 | for change in changes['added'] + changes['updated'] + changes['deleted']: |
|
586 | for change in changes['added'] + changes['updated'] + changes['deleted']: | |
567 | if change['type'] == 'user': |
|
587 | if change['type'] == 'user': | |
568 | affected_user_ids.append(change['id']) |
|
588 | affected_user_ids.append(change['id']) | |
569 | if change['type'] == 'user_group': |
|
589 | if change['type'] == 'user_group': | |
570 | user_group = UserGroup.get(safe_int(change['id'])) |
|
590 | user_group = UserGroup.get(safe_int(change['id'])) | |
571 | if user_group: |
|
591 | if user_group: | |
572 | group_members_ids = [x.user_id for x in user_group.members] |
|
592 | group_members_ids = [x.user_id for x in user_group.members] | |
573 | affected_user_ids.extend(group_members_ids) |
|
593 | affected_user_ids.extend(group_members_ids) | |
574 |
|
594 | |||
575 | self.trigger_permission_flush(affected_user_ids) |
|
595 | self.trigger_permission_flush(affected_user_ids) | |
576 |
|
596 | |||
577 | return affected_user_ids |
|
597 | return affected_user_ids |
General Comments 0
You need to be logged in to leave comments.
Login now