##// END OF EJS Templates
repo-group-schemas: refactor repository group schemas....
marcink -
r1154:e3bdce95 default
parent child Browse files
Show More
@@ -0,0 +1,116 b''
1 # -*- coding: utf-8 -*-
2
3 # Copyright (C) 2016-2016 RhodeCode GmbH
4 #
5 # This program is free software: you can redistribute it and/or modify
6 # it under the terms of the GNU Affero General Public License, version 3
7 # (only), as published by the Free Software Foundation.
8 #
9 # This program is distributed in the hope that it will be useful,
10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 # GNU General Public License for more details.
13 #
14 # You should have received a copy of the GNU Affero General Public License
15 # along with this program. If not, see <http://www.gnu.org/licenses/>.
16 #
17 # This program is dual-licensed. If you wish to learn more about the
18 # RhodeCode Enterprise Edition, including its added features, Support services,
19 # and proprietary license terms, please see https://rhodecode.com/licenses/
20
21 import colander
22 import pytest
23
24 from rhodecode.model.validation_schema import types
25 from rhodecode.model.validation_schema.schemas import repo_group_schema
26
27
28 class TestRepoGroupSchema(object):
29
30 @pytest.mark.parametrize('given, expected', [
31 ('my repo', 'my-repo'),
32 (' hello world mike ', 'hello-world-mike'),
33
34 ('//group1/group2//', 'group1/group2'),
35 ('//group1///group2//', 'group1/group2'),
36 ('///group1/group2///group3', 'group1/group2/group3'),
37 ('word g1/group2///group3', 'word-g1/group2/group3'),
38
39 ('grou p1/gro;,,##up2//.../group3', 'grou-p1/group2/group3'),
40
41 ('group,,,/,,,/1/2/3', 'group/1/2/3'),
42 ('grou[]p1/gro;up2///gro up3', 'group1/group2/gro-up3'),
43 (u'grou[]p1/gro;up2///gro up3/Δ…Δ‡', u'group1/group2/gro-up3/Δ…Δ‡'),
44 ])
45 def test_deserialize_repo_name(self, app, user_admin, given, expected):
46 schema = repo_group_schema.RepoGroupSchema().bind()
47 assert schema.get('repo_group_name').deserialize(given) == expected
48
49 def test_deserialize(self, app, user_admin):
50 schema = repo_group_schema.RepoGroupSchema().bind(
51 user=user_admin
52 )
53
54 schema_data = schema.deserialize(dict(
55 repo_group_name='dupa',
56 repo_group_owner=user_admin.username
57 ))
58
59 assert schema_data['repo_group_name'] == 'dupa'
60 assert schema_data['repo_group'] == {
61 'repo_group_id': None,
62 'repo_group_name': types.RootLocation,
63 'repo_group_name_without_group': 'dupa'}
64
65 @pytest.mark.parametrize('given, err_key, expected_exc', [
66 ('xxx/dupa', 'repo_group', 'Parent repository group `xxx` does not exist'),
67 ('', 'repo_group_name', 'Name must start with a letter or number. Got ``'),
68 ])
69 def test_deserialize_with_bad_group_name(
70 self, app, user_admin, given, err_key, expected_exc):
71 schema = repo_group_schema.RepoGroupSchema().bind(
72 repo_type_options=['hg'],
73 user=user_admin
74 )
75
76 with pytest.raises(colander.Invalid) as excinfo:
77 schema.deserialize(dict(
78 repo_group_name=given,
79 repo_group_owner=user_admin.username
80 ))
81
82 assert excinfo.value.asdict()[err_key] == expected_exc
83
84 def test_deserialize_with_group_name(self, app, user_admin, test_repo_group):
85 schema = repo_group_schema.RepoGroupSchema().bind(
86 user=user_admin
87 )
88
89 full_name = test_repo_group.group_name + '/dupa'
90 schema_data = schema.deserialize(dict(
91 repo_group_name=full_name,
92 repo_group_owner=user_admin.username
93 ))
94
95 assert schema_data['repo_group_name'] == full_name
96 assert schema_data['repo_group'] == {
97 'repo_group_id': test_repo_group.group_id,
98 'repo_group_name': test_repo_group.group_name,
99 'repo_group_name_without_group': 'dupa'}
100
101 def test_deserialize_with_group_name_regular_user_no_perms(
102 self, app, user_regular, test_repo_group):
103 schema = repo_group_schema.RepoGroupSchema().bind(
104 user=user_regular
105 )
106
107 full_name = test_repo_group.group_name + '/dupa'
108 with pytest.raises(colander.Invalid) as excinfo:
109 schema.deserialize(dict(
110 repo_group_name=full_name,
111 repo_group_owner=user_regular.username
112 ))
113
114 expected = 'Parent repository group `{}` does not exist'.format(
115 test_repo_group.group_name)
116 assert excinfo.value.asdict()['repo_group'] == expected
@@ -1,199 +1,289 b''
1 1 # -*- coding: utf-8 -*-
2 2
3 3 # Copyright (C) 2010-2016 RhodeCode GmbH
4 4 #
5 5 # This program is free software: you can redistribute it and/or modify
6 6 # it under the terms of the GNU Affero General Public License, version 3
7 7 # (only), as published by the Free Software Foundation.
8 8 #
9 9 # This program is distributed in the hope that it will be useful,
10 10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 12 # GNU General Public License for more details.
13 13 #
14 14 # You should have received a copy of the GNU Affero General Public License
15 15 # along with this program. If not, see <http://www.gnu.org/licenses/>.
16 16 #
17 17 # This program is dual-licensed. If you wish to learn more about the
18 18 # RhodeCode Enterprise Edition, including its added features, Support services,
19 19 # and proprietary license terms, please see https://rhodecode.com/licenses/
20 20
21 21 import mock
22 22 import pytest
23 23
24 24 from rhodecode.model.meta import Session
25 25 from rhodecode.model.repo_group import RepoGroupModel
26 26 from rhodecode.model.user import UserModel
27 27 from rhodecode.tests import TEST_USER_ADMIN_LOGIN
28 28 from rhodecode.api.tests.utils import (
29 29 build_data, api_call, assert_ok, assert_error, crash)
30 30 from rhodecode.tests.fixture import Fixture
31 31
32 32
33 33 fixture = Fixture()
34 34
35 35
36 36 @pytest.mark.usefixtures("testuser_api", "app")
37 37 class TestCreateRepoGroup(object):
38 38 def test_api_create_repo_group(self):
39 39 repo_group_name = 'api-repo-group'
40 40
41 41 repo_group = RepoGroupModel.cls.get_by_group_name(repo_group_name)
42 42 assert repo_group is None
43 43
44 44 id_, params = build_data(
45 45 self.apikey, 'create_repo_group',
46 46 group_name=repo_group_name,
47 47 owner=TEST_USER_ADMIN_LOGIN,)
48 48 response = api_call(self.app, params)
49 49
50 50 repo_group = RepoGroupModel.cls.get_by_group_name(repo_group_name)
51 51 assert repo_group is not None
52 52 ret = {
53 53 'msg': 'Created new repo group `%s`' % (repo_group_name,),
54 54 'repo_group': repo_group.get_api_data()
55 55 }
56 56 expected = ret
57 try:
57 58 assert_ok(id_, expected, given=response.body)
59 finally:
58 60 fixture.destroy_repo_group(repo_group_name)
59 61
60 def test_api_create_repo_group_regular_user(self):
61 repo_group_name = 'api-repo-group'
62
63 usr = UserModel().get_by_username(self.TEST_USER_LOGIN)
64 usr.inherit_default_permissions = False
65 Session().add(usr)
66 UserModel().grant_perm(
67 self.TEST_USER_LOGIN, 'hg.repogroup.create.true')
68 Session().commit()
69
70 repo_group = RepoGroupModel.cls.get_by_group_name(repo_group_name)
71 assert repo_group is None
72
73 id_, params = build_data(
74 self.apikey_regular, 'create_repo_group',
75 group_name=repo_group_name,
76 owner=TEST_USER_ADMIN_LOGIN,)
77 response = api_call(self.app, params)
78
79 repo_group = RepoGroupModel.cls.get_by_group_name(repo_group_name)
80 assert repo_group is not None
81 ret = {
82 'msg': 'Created new repo group `%s`' % (repo_group_name,),
83 'repo_group': repo_group.get_api_data()
84 }
85 expected = ret
86 assert_ok(id_, expected, given=response.body)
87 fixture.destroy_repo_group(repo_group_name)
88 UserModel().revoke_perm(
89 self.TEST_USER_LOGIN, 'hg.repogroup.create.true')
90 usr = UserModel().get_by_username(self.TEST_USER_LOGIN)
91 usr.inherit_default_permissions = True
92 Session().add(usr)
93 Session().commit()
94
95 def test_api_create_repo_group_regular_user_no_permission(self):
96 repo_group_name = 'api-repo-group'
97
98 id_, params = build_data(
99 self.apikey_regular, 'create_repo_group',
100 group_name=repo_group_name,
101 owner=TEST_USER_ADMIN_LOGIN,)
102 response = api_call(self.app, params)
103
104 expected = "Access was denied to this resource."
105 assert_error(id_, expected, given=response.body)
106
107 62 def test_api_create_repo_group_in_another_group(self):
108 63 repo_group_name = 'api-repo-group'
109 64
110 65 repo_group = RepoGroupModel.cls.get_by_group_name(repo_group_name)
111 66 assert repo_group is None
112 67 # create the parent
113 68 fixture.create_repo_group(repo_group_name)
114 69
115 70 full_repo_group_name = repo_group_name+'/'+repo_group_name
116 71 id_, params = build_data(
117 72 self.apikey, 'create_repo_group',
118 73 group_name=full_repo_group_name,
119 74 owner=TEST_USER_ADMIN_LOGIN,
120 75 copy_permissions=True)
121 76 response = api_call(self.app, params)
122 77
123 78 repo_group = RepoGroupModel.cls.get_by_group_name(full_repo_group_name)
124 79 assert repo_group is not None
125 80 ret = {
126 81 'msg': 'Created new repo group `%s`' % (full_repo_group_name,),
127 82 'repo_group': repo_group.get_api_data()
128 83 }
129 84 expected = ret
85 try:
130 86 assert_ok(id_, expected, given=response.body)
87 finally:
131 88 fixture.destroy_repo_group(full_repo_group_name)
132 89 fixture.destroy_repo_group(repo_group_name)
133 90
134 91 def test_api_create_repo_group_in_another_group_not_existing(self):
135 92 repo_group_name = 'api-repo-group-no'
136 93
137 94 repo_group = RepoGroupModel.cls.get_by_group_name(repo_group_name)
138 95 assert repo_group is None
139 96
140 97 full_repo_group_name = repo_group_name+'/'+repo_group_name
141 98 id_, params = build_data(
142 99 self.apikey, 'create_repo_group',
143 100 group_name=full_repo_group_name,
144 101 owner=TEST_USER_ADMIN_LOGIN,
145 102 copy_permissions=True)
146 103 response = api_call(self.app, params)
147 expected = 'repository group `%s` does not exist' % (repo_group_name,)
104 expected = {
105 'repo_group':
106 'Parent repository group `{}` does not exist'.format(
107 repo_group_name)}
148 108 assert_error(id_, expected, given=response.body)
149 109
150 110 def test_api_create_repo_group_that_exists(self):
151 111 repo_group_name = 'api-repo-group'
152 112
153 113 repo_group = RepoGroupModel.cls.get_by_group_name(repo_group_name)
154 114 assert repo_group is None
155 115
156 116 fixture.create_repo_group(repo_group_name)
157 117 id_, params = build_data(
158 118 self.apikey, 'create_repo_group',
159 119 group_name=repo_group_name,
160 120 owner=TEST_USER_ADMIN_LOGIN,)
161 121 response = api_call(self.app, params)
162 expected = 'repo group `%s` already exist' % (repo_group_name,)
122 expected = {
123 'unique_repo_group_name':
124 'Repository group with name `{}` already exists'.format(
125 repo_group_name)}
126 try:
163 127 assert_error(id_, expected, given=response.body)
128 finally:
164 129 fixture.destroy_repo_group(repo_group_name)
165 130
131 def test_api_create_repo_group_regular_user_wit_root_location_perms(
132 self, user_util):
133 regular_user = user_util.create_user()
134 regular_user_api_key = regular_user.api_key
135
136 repo_group_name = 'api-repo-group-by-regular-user'
137
138 usr = UserModel().get_by_username(regular_user.username)
139 usr.inherit_default_permissions = False
140 Session().add(usr)
141
142 UserModel().grant_perm(
143 regular_user.username, 'hg.repogroup.create.true')
144 Session().commit()
145
146 repo_group = RepoGroupModel.cls.get_by_group_name(repo_group_name)
147 assert repo_group is None
148
149 id_, params = build_data(
150 regular_user_api_key, 'create_repo_group',
151 group_name=repo_group_name)
152 response = api_call(self.app, params)
153
154 repo_group = RepoGroupModel.cls.get_by_group_name(repo_group_name)
155 assert repo_group is not None
156 expected = {
157 'msg': 'Created new repo group `%s`' % (repo_group_name,),
158 'repo_group': repo_group.get_api_data()
159 }
160 try:
161 assert_ok(id_, expected, given=response.body)
162 finally:
163 fixture.destroy_repo_group(repo_group_name)
164
165 def test_api_create_repo_group_regular_user_with_admin_perms_to_parent(
166 self, user_util):
167
168 repo_group_name = 'api-repo-group-parent'
169
170 repo_group = RepoGroupModel.cls.get_by_group_name(repo_group_name)
171 assert repo_group is None
172 # create the parent
173 fixture.create_repo_group(repo_group_name)
174
175 # user perms
176 regular_user = user_util.create_user()
177 regular_user_api_key = regular_user.api_key
178
179 usr = UserModel().get_by_username(regular_user.username)
180 usr.inherit_default_permissions = False
181 Session().add(usr)
182
183 RepoGroupModel().grant_user_permission(
184 repo_group_name, regular_user.username, 'group.admin')
185 Session().commit()
186
187 full_repo_group_name = repo_group_name + '/' + repo_group_name
188 id_, params = build_data(
189 regular_user_api_key, 'create_repo_group',
190 group_name=full_repo_group_name)
191 response = api_call(self.app, params)
192
193 repo_group = RepoGroupModel.cls.get_by_group_name(full_repo_group_name)
194 assert repo_group is not None
195 expected = {
196 'msg': 'Created new repo group `{}`'.format(full_repo_group_name),
197 'repo_group': repo_group.get_api_data()
198 }
199 try:
200 assert_ok(id_, expected, given=response.body)
201 finally:
202 fixture.destroy_repo_group(full_repo_group_name)
203 fixture.destroy_repo_group(repo_group_name)
204
205 def test_api_create_repo_group_regular_user_no_permission_to_create_to_root_level(self):
206 repo_group_name = 'api-repo-group'
207
208 id_, params = build_data(
209 self.apikey_regular, 'create_repo_group',
210 group_name=repo_group_name)
211 response = api_call(self.app, params)
212
213 expected = {
214 'repo_group':
215 u'You do not have the permission to store '
216 u'repository groups in the root location.'}
217 assert_error(id_, expected, given=response.body)
218
219 def test_api_create_repo_group_regular_user_no_parent_group_perms(self):
220 repo_group_name = 'api-repo-group-regular-user'
221
222 repo_group = RepoGroupModel.cls.get_by_group_name(repo_group_name)
223 assert repo_group is None
224 # create the parent
225 fixture.create_repo_group(repo_group_name)
226
227 full_repo_group_name = repo_group_name+'/'+repo_group_name
228
229 id_, params = build_data(
230 self.apikey_regular, 'create_repo_group',
231 group_name=full_repo_group_name)
232 response = api_call(self.app, params)
233
234 expected = {
235 'repo_group':
236 'Parent repository group `{}` does not exist'.format(
237 repo_group_name)}
238 try:
239 assert_error(id_, expected, given=response.body)
240 finally:
241 fixture.destroy_repo_group(repo_group_name)
242
243 def test_api_create_repo_group_regular_user_no_permission_to_specify_owner(
244 self):
245 repo_group_name = 'api-repo-group'
246
247 id_, params = build_data(
248 self.apikey_regular, 'create_repo_group',
249 group_name=repo_group_name,
250 owner=TEST_USER_ADMIN_LOGIN,)
251 response = api_call(self.app, params)
252
253 expected = "Only RhodeCode super-admin can specify `owner` param"
254 assert_error(id_, expected, given=response.body)
255
166 256 @mock.patch.object(RepoGroupModel, 'create', crash)
167 257 def test_api_create_repo_group_exception_occurred(self):
168 258 repo_group_name = 'api-repo-group'
169 259
170 260 repo_group = RepoGroupModel.cls.get_by_group_name(repo_group_name)
171 261 assert repo_group is None
172 262
173 263 id_, params = build_data(
174 264 self.apikey, 'create_repo_group',
175 265 group_name=repo_group_name,
176 266 owner=TEST_USER_ADMIN_LOGIN,)
177 267 response = api_call(self.app, params)
178 268 expected = 'failed to create repo group `%s`' % (repo_group_name,)
179 269 assert_error(id_, expected, given=response.body)
180 270
181 271 def test_create_group_with_extra_slashes_in_name(self, user_util):
182 272 existing_repo_group = user_util.create_repo_group()
183 273 dirty_group_name = '//{}//group2//'.format(
184 274 existing_repo_group.group_name)
185 275 cleaned_group_name = '{}/group2'.format(
186 276 existing_repo_group.group_name)
187 277
188 278 id_, params = build_data(
189 279 self.apikey, 'create_repo_group',
190 280 group_name=dirty_group_name,
191 281 owner=TEST_USER_ADMIN_LOGIN,)
192 282 response = api_call(self.app, params)
193 283 repo_group = RepoGroupModel.cls.get_by_group_name(cleaned_group_name)
194 284 expected = {
195 285 'msg': 'Created new repo group `%s`' % (cleaned_group_name,),
196 286 'repo_group': repo_group.get_api_data()
197 287 }
198 288 assert_ok(id_, expected, given=response.body)
199 289 fixture.destroy_repo_group(cleaned_group_name)
@@ -1,107 +1,150 b''
1 1 # -*- coding: utf-8 -*-
2 2
3 3 # Copyright (C) 2010-2016 RhodeCode GmbH
4 4 #
5 5 # This program is free software: you can redistribute it and/or modify
6 6 # it under the terms of the GNU Affero General Public License, version 3
7 7 # (only), as published by the Free Software Foundation.
8 8 #
9 9 # This program is distributed in the hope that it will be useful,
10 10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 12 # GNU General Public License for more details.
13 13 #
14 14 # You should have received a copy of the GNU Affero General Public License
15 15 # along with this program. If not, see <http://www.gnu.org/licenses/>.
16 16 #
17 17 # This program is dual-licensed. If you wish to learn more about the
18 18 # RhodeCode Enterprise Edition, including its added features, Support services,
19 19 # and proprietary license terms, please see https://rhodecode.com/licenses/
20 20
21 21 import os
22 22
23 23 import pytest
24 24
25 25 from rhodecode.model.repo_group import RepoGroupModel
26 26 from rhodecode.model.user import UserModel
27 27 from rhodecode.api.tests.utils import (
28 28 build_data, api_call, assert_error, assert_ok)
29 29
30 30
31 31 @pytest.mark.usefixtures("testuser_api", "app")
32 32 class TestApiUpdateRepoGroup(object):
33
33 34 def test_update_group_name(self, user_util):
34 35 new_group_name = 'new-group'
35 36 initial_name = self._update(user_util, group_name=new_group_name)
36 37 assert RepoGroupModel()._get_repo_group(initial_name) is None
37 assert RepoGroupModel()._get_repo_group(new_group_name) is not None
38 new_group = RepoGroupModel()._get_repo_group(new_group_name)
39 assert new_group is not None
40 assert new_group.full_path == new_group_name
38 41
39 def test_update_parent(self, user_util):
42 def test_update_group_name_change_parent(self, user_util):
43
40 44 parent_group = user_util.create_repo_group()
41 initial_name = self._update(user_util, parent=parent_group.name)
45 parent_group_name = parent_group.name
42 46
43 expected_group_name = '{}/{}'.format(parent_group.name, initial_name)
47 expected_group_name = '{}/{}'.format(parent_group_name, 'new-group')
48 initial_name = self._update(user_util, group_name=expected_group_name)
49
44 50 repo_group = RepoGroupModel()._get_repo_group(expected_group_name)
51
45 52 assert repo_group is not None
46 53 assert repo_group.group_name == expected_group_name
47 assert repo_group.name == initial_name
54 assert repo_group.full_path == expected_group_name
48 55 assert RepoGroupModel()._get_repo_group(initial_name) is None
56
49 57 new_path = os.path.join(
50 58 RepoGroupModel().repos_path, *repo_group.full_path_splitted)
51 59 assert os.path.exists(new_path)
52 60
53 61 def test_update_enable_locking(self, user_util):
54 62 initial_name = self._update(user_util, enable_locking=True)
55 63 repo_group = RepoGroupModel()._get_repo_group(initial_name)
56 64 assert repo_group.enable_locking is True
57 65
58 66 def test_update_description(self, user_util):
59 67 description = 'New description'
60 68 initial_name = self._update(user_util, description=description)
61 69 repo_group = RepoGroupModel()._get_repo_group(initial_name)
62 70 assert repo_group.group_description == description
63 71
64 72 def test_update_owner(self, user_util):
65 73 owner = self.TEST_USER_LOGIN
66 74 initial_name = self._update(user_util, owner=owner)
67 75 repo_group = RepoGroupModel()._get_repo_group(initial_name)
68 76 assert repo_group.user.username == owner
69 77
70 def test_api_update_repo_group_by_regular_user_no_permission(
71 self, backend):
72 repo = backend.create_repo()
73 repo_name = repo.repo_name
78 def test_update_group_name_conflict_with_existing(self, user_util):
79 group_1 = user_util.create_repo_group()
80 group_2 = user_util.create_repo_group()
81 repo_group_name_1 = group_1.group_name
82 repo_group_name_2 = group_2.group_name
74 83
75 84 id_, params = build_data(
76 self.apikey_regular, 'update_repo_group', repogroupid=repo_name)
85 self.apikey, 'update_repo_group', repogroupid=repo_group_name_1,
86 group_name=repo_group_name_2)
87 response = api_call(self.app, params)
88 expected = {
89 'unique_repo_group_name':
90 'Repository group with name `{}` already exists'.format(
91 repo_group_name_2)}
92 assert_error(id_, expected, given=response.body)
93
94 def test_api_update_repo_group_by_regular_user_no_permission(self, user_util):
95 temp_user = user_util.create_user()
96 temp_user_api_key = temp_user.api_key
97 parent_group = user_util.create_repo_group()
98 repo_group_name = parent_group.group_name
99 id_, params = build_data(
100 temp_user_api_key, 'update_repo_group', repogroupid=repo_group_name)
77 101 response = api_call(self.app, params)
78 expected = 'repository group `%s` does not exist' % (repo_name,)
102 expected = 'repository group `%s` does not exist' % (repo_group_name,)
103 assert_error(id_, expected, given=response.body)
104
105 def test_api_update_repo_group_regular_user_no_root_write_permissions(
106 self, user_util):
107 temp_user = user_util.create_user()
108 temp_user_api_key = temp_user.api_key
109 parent_group = user_util.create_repo_group(owner=temp_user.username)
110 repo_group_name = parent_group.group_name
111
112 id_, params = build_data(
113 temp_user_api_key, 'update_repo_group', repogroupid=repo_group_name,
114 group_name='at-root-level')
115 response = api_call(self.app, params)
116 expected = {
117 'repo_group': 'You do not have the permission to store '
118 'repository groups in the root location.'}
79 119 assert_error(id_, expected, given=response.body)
80 120
81 121 def _update(self, user_util, **kwargs):
82 122 repo_group = user_util.create_repo_group()
83 123 initial_name = repo_group.name
84 124 user = UserModel().get_by_username(self.TEST_USER_LOGIN)
85 125 user_util.grant_user_permission_to_repo_group(
86 126 repo_group, user, 'group.admin')
87 127
88 128 id_, params = build_data(
89 129 self.apikey, 'update_repo_group', repogroupid=initial_name,
90 130 **kwargs)
91 131 response = api_call(self.app, params)
92 ret = {
132
133 repo_group = RepoGroupModel.cls.get(repo_group.group_id)
134
135 expected = {
93 136 'msg': 'updated repository group ID:{} {}'.format(
94 137 repo_group.group_id, repo_group.group_name),
95 138 'repo_group': {
96 139 'repositories': [],
97 140 'group_name': repo_group.group_name,
98 141 'group_description': repo_group.group_description,
99 142 'owner': repo_group.user.username,
100 143 'group_id': repo_group.group_id,
101 144 'parent_group': (
102 145 repo_group.parent_group.name
103 146 if repo_group.parent_group else None)
104 147 }
105 148 }
106 assert_ok(id_, ret, given=response.body)
149 assert_ok(id_, expected, given=response.body)
107 150 return initial_name
@@ -1,699 +1,702 b''
1 1 # -*- coding: utf-8 -*-
2 2
3 3 # Copyright (C) 2011-2016 RhodeCode GmbH
4 4 #
5 5 # This program is free software: you can redistribute it and/or modify
6 6 # it under the terms of the GNU Affero General Public License, version 3
7 7 # (only), as published by the Free Software Foundation.
8 8 #
9 9 # This program is distributed in the hope that it will be useful,
10 10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 12 # GNU General Public License for more details.
13 13 #
14 14 # You should have received a copy of the GNU Affero General Public License
15 15 # along with this program. If not, see <http://www.gnu.org/licenses/>.
16 16 #
17 17 # This program is dual-licensed. If you wish to learn more about the
18 18 # RhodeCode Enterprise Edition, including its added features, Support services,
19 19 # and proprietary license terms, please see https://rhodecode.com/licenses/
20 20
21 21
22 22 import logging
23 23
24 import colander
25
26 from rhodecode.api import jsonrpc_method, JSONRPCError, JSONRPCForbidden
24 from rhodecode.api import JSONRPCValidationError
25 from rhodecode.api import jsonrpc_method, JSONRPCError
27 26 from rhodecode.api.utils import (
28 27 has_superadmin_permission, Optional, OAttr, get_user_or_error,
29 store_update, get_repo_group_or_error,
30 get_perm_or_error, get_user_group_or_error, get_origin)
28 get_repo_group_or_error, get_perm_or_error, get_user_group_or_error,
29 get_origin, validate_repo_group_permissions, validate_set_owner_permissions)
31 30 from rhodecode.lib.auth import (
32 HasPermissionAnyApi, HasRepoGroupPermissionAnyApi,
33 HasUserGroupPermissionAnyApi)
34 from rhodecode.model.db import Session, RepoGroup
31 HasRepoGroupPermissionAnyApi, HasUserGroupPermissionAnyApi)
32 from rhodecode.model.db import Session
35 33 from rhodecode.model.repo_group import RepoGroupModel
36 34 from rhodecode.model.scm import RepoGroupList
35 from rhodecode.model import validation_schema
37 36 from rhodecode.model.validation_schema.schemas import repo_group_schema
38 37
39 38
40 39 log = logging.getLogger(__name__)
41 40
42 41
43 42 @jsonrpc_method()
44 43 def get_repo_group(request, apiuser, repogroupid):
45 44 """
46 45 Return the specified |repo| group, along with permissions,
47 46 and repositories inside the group
48 47
49 48 :param apiuser: This is filled automatically from the |authtoken|.
50 49 :type apiuser: AuthUser
51 50 :param repogroupid: Specify the name of ID of the repository group.
52 51 :type repogroupid: str or int
53 52
54 53
55 54 Example output:
56 55
57 56 .. code-block:: bash
58 57
59 58 {
60 59 "error": null,
61 60 "id": repo-group-id,
62 61 "result": {
63 62 "group_description": "repo group description",
64 63 "group_id": 14,
65 64 "group_name": "group name",
66 65 "members": [
67 66 {
68 67 "name": "super-admin-username",
69 68 "origin": "super-admin",
70 69 "permission": "group.admin",
71 70 "type": "user"
72 71 },
73 72 {
74 73 "name": "owner-name",
75 74 "origin": "owner",
76 75 "permission": "group.admin",
77 76 "type": "user"
78 77 },
79 78 {
80 79 "name": "user-group-name",
81 80 "origin": "permission",
82 81 "permission": "group.write",
83 82 "type": "user_group"
84 83 }
85 84 ],
86 85 "owner": "owner-name",
87 86 "parent_group": null,
88 87 "repositories": [ repo-list ]
89 88 }
90 89 }
91 90 """
92 91
93 92 repo_group = get_repo_group_or_error(repogroupid)
94 93 if not has_superadmin_permission(apiuser):
95 94 # check if we have at least read permission for this repo group !
96 95 _perms = ('group.admin', 'group.write', 'group.read',)
97 96 if not HasRepoGroupPermissionAnyApi(*_perms)(
98 97 user=apiuser, group_name=repo_group.group_name):
99 98 raise JSONRPCError(
100 99 'repository group `%s` does not exist' % (repogroupid,))
101 100
102 101 permissions = []
103 102 for _user in repo_group.permissions():
104 103 user_data = {
105 104 'name': _user.username,
106 105 'permission': _user.permission,
107 106 'origin': get_origin(_user),
108 107 'type': "user",
109 108 }
110 109 permissions.append(user_data)
111 110
112 111 for _user_group in repo_group.permission_user_groups():
113 112 user_group_data = {
114 113 'name': _user_group.users_group_name,
115 114 'permission': _user_group.permission,
116 115 'origin': get_origin(_user_group),
117 116 'type': "user_group",
118 117 }
119 118 permissions.append(user_group_data)
120 119
121 120 data = repo_group.get_api_data()
122 121 data["members"] = permissions # TODO: this should be named permissions
123 122 return data
124 123
125 124
126 125 @jsonrpc_method()
127 126 def get_repo_groups(request, apiuser):
128 127 """
129 128 Returns all repository groups.
130 129
131 130 :param apiuser: This is filled automatically from the |authtoken|.
132 131 :type apiuser: AuthUser
133 132 """
134 133
135 134 result = []
136 135 _perms = ('group.read', 'group.write', 'group.admin',)
137 136 extras = {'user': apiuser}
138 137 for repo_group in RepoGroupList(RepoGroupModel().get_all(),
139 138 perm_set=_perms, extra_kwargs=extras):
140 139 result.append(repo_group.get_api_data())
141 140 return result
142 141
143 142
144 143 @jsonrpc_method()
145 def create_repo_group(request, apiuser, group_name, description=Optional(''),
144 def create_repo_group(
145 request, apiuser, group_name,
146 146 owner=Optional(OAttr('apiuser')),
147 description=Optional(''),
147 148 copy_permissions=Optional(False)):
148 149 """
149 150 Creates a repository group.
150 151
151 * If the repository group name contains "/", all the required repository
152 groups will be created.
152 * If the repository group name contains "/", repository group will be
153 created inside a repository group or nested repository groups
153 154
154 For example "foo/bar/baz" will create |repo| groups "foo" and "bar"
155 (with "foo" as parent). It will also create the "baz" repository
156 with "bar" as |repo| group.
155 For example "foo/bar/group1" will create repository group called "group1"
156 inside group "foo/bar". You have to have permissions to access and
157 write to the last repository group ("bar" in this example)
157 158
158 This command can only be run using an |authtoken| with admin
159 permissions.
159 This command can only be run using an |authtoken| with at least
160 permissions to create repository groups, or admin permissions to
161 parent repository groups.
160 162
161 163 :param apiuser: This is filled automatically from the |authtoken|.
162 164 :type apiuser: AuthUser
163 165 :param group_name: Set the repository group name.
164 166 :type group_name: str
165 167 :param description: Set the |repo| group description.
166 168 :type description: str
167 169 :param owner: Set the |repo| group owner.
168 170 :type owner: str
169 171 :param copy_permissions:
170 172 :type copy_permissions:
171 173
172 174 Example output:
173 175
174 176 .. code-block:: bash
175 177
176 178 id : <id_given_in_input>
177 179 result : {
178 180 "msg": "Created new repo group `<repo_group_name>`"
179 181 "repo_group": <repogroup_object>
180 182 }
181 183 error : null
182 184
183 185
184 186 Example error output:
185 187
186 188 .. code-block:: bash
187 189
188 190 id : <id_given_in_input>
189 191 result : null
190 192 error : {
191 193 failed to create repo group `<repogroupid>`
192 194 }
193 195
194 196 """
195 197
196 schema = repo_group_schema.RepoGroupSchema()
197 try:
198 data = schema.deserialize({
199 'group_name': group_name
200 })
201 except colander.Invalid as e:
202 raise JSONRPCError("Validation failed: %s" % (e.asdict(),))
203 group_name = data['group_name']
198 owner = validate_set_owner_permissions(apiuser, owner)
204 199
205 if isinstance(owner, Optional):
206 owner = apiuser.user_id
207
208 group_description = Optional.extract(description)
200 description = Optional.extract(description)
209 201 copy_permissions = Optional.extract(copy_permissions)
210 202
211 # get by full name with parents, check if it already exist
212 if RepoGroup.get_by_group_name(group_name):
213 raise JSONRPCError("repo group `%s` already exist" % (group_name,))
214
215 (group_name_cleaned,
216 parent_group_name) = RepoGroupModel()._get_group_name_and_parent(
217 group_name)
203 schema = repo_group_schema.RepoGroupSchema().bind(
204 # user caller
205 user=apiuser)
218 206
219 parent_group = None
220 if parent_group_name:
221 parent_group = get_repo_group_or_error(parent_group_name)
207 try:
208 schema_data = schema.deserialize(dict(
209 repo_group_name=group_name,
210 repo_group_owner=owner.username,
211 repo_group_description=description,
212 repo_group_copy_permissions=copy_permissions,
213 ))
214 except validation_schema.Invalid as err:
215 raise JSONRPCValidationError(colander_exc=err)
222 216
223 if not HasPermissionAnyApi(
224 'hg.admin', 'hg.repogroup.create.true')(user=apiuser):
225 # check if we have admin permission for this parent repo group !
226 # users without admin or hg.repogroup.create can only create other
227 # groups in groups they own so this is a required, but can be empty
228 parent_group = getattr(parent_group, 'group_name', '')
229 _perms = ('group.admin',)
230 if not HasRepoGroupPermissionAnyApi(*_perms)(
231 user=apiuser, group_name=parent_group):
232 raise JSONRPCForbidden()
217 validated_group_name = schema_data['repo_group_name']
233 218
234 219 try:
235 220 repo_group = RepoGroupModel().create(
236 group_name=group_name,
237 group_description=group_description,
238 221 owner=owner,
239 copy_permissions=copy_permissions)
222 group_name=validated_group_name,
223 group_description=schema_data['repo_group_name'],
224 copy_permissions=schema_data['repo_group_copy_permissions'])
240 225 Session().commit()
241 226 return {
242 'msg': 'Created new repo group `%s`' % group_name,
227 'msg': 'Created new repo group `%s`' % validated_group_name,
243 228 'repo_group': repo_group.get_api_data()
244 229 }
245 230 except Exception:
246 231 log.exception("Exception occurred while trying create repo group")
247 232 raise JSONRPCError(
248 'failed to create repo group `%s`' % (group_name,))
233 'failed to create repo group `%s`' % (validated_group_name,))
249 234
250 235
251 236 @jsonrpc_method()
252 237 def update_repo_group(
253 238 request, apiuser, repogroupid, group_name=Optional(''),
254 239 description=Optional(''), owner=Optional(OAttr('apiuser')),
255 parent=Optional(None), enable_locking=Optional(False)):
240 enable_locking=Optional(False)):
256 241 """
257 242 Updates repository group with the details given.
258 243
259 244 This command can only be run using an |authtoken| with admin
260 245 permissions.
261 246
247 * If the group_name name contains "/", repository group will be updated
248 accordingly with a repository group or nested repository groups
249
250 For example repogroupid=group-test group_name="foo/bar/group-test"
251 will update repository group called "group-test" and place it
252 inside group "foo/bar".
253 You have to have permissions to access and write to the last repository
254 group ("bar" in this example)
255
262 256 :param apiuser: This is filled automatically from the |authtoken|.
263 257 :type apiuser: AuthUser
264 258 :param repogroupid: Set the ID of repository group.
265 259 :type repogroupid: str or int
266 260 :param group_name: Set the name of the |repo| group.
267 261 :type group_name: str
268 262 :param description: Set a description for the group.
269 263 :type description: str
270 264 :param owner: Set the |repo| group owner.
271 265 :type owner: str
272 :param parent: Set the |repo| group parent.
273 :type parent: str or int
274 266 :param enable_locking: Enable |repo| locking. The default is false.
275 267 :type enable_locking: bool
276 268 """
277 269
278 270 repo_group = get_repo_group_or_error(repogroupid)
271
279 272 if not has_superadmin_permission(apiuser):
280 # check if we have admin permission for this repo group !
281 _perms = ('group.admin',)
282 if not HasRepoGroupPermissionAnyApi(*_perms)(
283 user=apiuser, group_name=repo_group.group_name):
284 raise JSONRPCError(
285 'repository group `%s` does not exist' % (repogroupid,))
273 validate_repo_group_permissions(
274 apiuser, repogroupid, repo_group, ('group.admin',))
275
276 updates = dict(
277 group_name=group_name
278 if not isinstance(group_name, Optional) else repo_group.group_name,
279
280 group_description=description
281 if not isinstance(description, Optional) else repo_group.group_description,
282
283 user=owner
284 if not isinstance(owner, Optional) else repo_group.user.username,
285
286 enable_locking=enable_locking
287 if not isinstance(enable_locking, Optional) else repo_group.enable_locking
288 )
286 289
287 updates = {}
290 schema = repo_group_schema.RepoGroupSchema().bind(
291 # user caller
292 user=apiuser,
293 old_values=repo_group.get_api_data())
294
288 295 try:
289 store_update(updates, group_name, 'group_name')
290 store_update(updates, description, 'group_description')
291 store_update(updates, owner, 'user')
292 store_update(updates, parent, 'group_parent_id')
293 store_update(updates, enable_locking, 'enable_locking')
294 repo_group = RepoGroupModel().update(repo_group, updates)
296 schema_data = schema.deserialize(dict(
297 repo_group_name=updates['group_name'],
298 repo_group_owner=updates['user'],
299 repo_group_description=updates['group_description'],
300 repo_group_enable_locking=updates['enable_locking'],
301 ))
302 except validation_schema.Invalid as err:
303 raise JSONRPCValidationError(colander_exc=err)
304
305 validated_updates = dict(
306 group_name=schema_data['repo_group']['repo_group_name_without_group'],
307 group_parent_id=schema_data['repo_group']['repo_group_id'],
308 user=schema_data['repo_group_owner'],
309 group_description=schema_data['repo_group_description'],
310 enable_locking=schema_data['repo_group_enable_locking'],
311 )
312
313 try:
314 RepoGroupModel().update(repo_group, validated_updates)
295 315 Session().commit()
296 316 return {
297 317 'msg': 'updated repository group ID:%s %s' % (
298 318 repo_group.group_id, repo_group.group_name),
299 319 'repo_group': repo_group.get_api_data()
300 320 }
301 321 except Exception:
302 log.exception("Exception occurred while trying update repo group")
322 log.exception(
323 u"Exception occurred while trying update repo group %s",
324 repogroupid)
303 325 raise JSONRPCError('failed to update repository group `%s`'
304 326 % (repogroupid,))
305 327
306 328
307 329 @jsonrpc_method()
308 330 def delete_repo_group(request, apiuser, repogroupid):
309 331 """
310 332 Deletes a |repo| group.
311 333
312 334 :param apiuser: This is filled automatically from the |authtoken|.
313 335 :type apiuser: AuthUser
314 336 :param repogroupid: Set the name or ID of repository group to be
315 337 deleted.
316 338 :type repogroupid: str or int
317 339
318 340 Example output:
319 341
320 342 .. code-block:: bash
321 343
322 344 id : <id_given_in_input>
323 345 result : {
324 346 'msg': 'deleted repo group ID:<repogroupid> <repogroupname>'
325 347 'repo_group': null
326 348 }
327 349 error : null
328 350
329 351 Example error output:
330 352
331 353 .. code-block:: bash
332 354
333 355 id : <id_given_in_input>
334 356 result : null
335 357 error : {
336 358 "failed to delete repo group ID:<repogroupid> <repogroupname>"
337 359 }
338 360
339 361 """
340 362
341 363 repo_group = get_repo_group_or_error(repogroupid)
342 364 if not has_superadmin_permission(apiuser):
343 # check if we have admin permission for this repo group !
344 _perms = ('group.admin',)
345 if not HasRepoGroupPermissionAnyApi(*_perms)(
346 user=apiuser, group_name=repo_group.group_name):
347 raise JSONRPCError(
348 'repository group `%s` does not exist' % (repogroupid,))
365 validate_repo_group_permissions(
366 apiuser, repogroupid, repo_group, ('group.admin',))
367
349 368 try:
350 369 RepoGroupModel().delete(repo_group)
351 370 Session().commit()
352 371 return {
353 372 'msg': 'deleted repo group ID:%s %s' %
354 373 (repo_group.group_id, repo_group.group_name),
355 374 'repo_group': None
356 375 }
357 376 except Exception:
358 377 log.exception("Exception occurred while trying to delete repo group")
359 378 raise JSONRPCError('failed to delete repo group ID:%s %s' %
360 379 (repo_group.group_id, repo_group.group_name))
361 380
362 381
363 382 @jsonrpc_method()
364 383 def grant_user_permission_to_repo_group(
365 384 request, apiuser, repogroupid, userid, perm,
366 385 apply_to_children=Optional('none')):
367 386 """
368 387 Grant permission for a user on the given repository group, or update
369 388 existing permissions if found.
370 389
371 390 This command can only be run using an |authtoken| with admin
372 391 permissions.
373 392
374 393 :param apiuser: This is filled automatically from the |authtoken|.
375 394 :type apiuser: AuthUser
376 395 :param repogroupid: Set the name or ID of repository group.
377 396 :type repogroupid: str or int
378 397 :param userid: Set the user name.
379 398 :type userid: str
380 399 :param perm: (group.(none|read|write|admin))
381 400 :type perm: str
382 401 :param apply_to_children: 'none', 'repos', 'groups', 'all'
383 402 :type apply_to_children: str
384 403
385 404 Example output:
386 405
387 406 .. code-block:: bash
388 407
389 408 id : <id_given_in_input>
390 409 result: {
391 410 "msg" : "Granted perm: `<perm>` (recursive:<apply_to_children>) for user: `<username>` in repo group: `<repo_group_name>`",
392 411 "success": true
393 412 }
394 413 error: null
395 414
396 415 Example error output:
397 416
398 417 .. code-block:: bash
399 418
400 419 id : <id_given_in_input>
401 420 result : null
402 421 error : {
403 422 "failed to edit permission for user: `<userid>` in repo group: `<repo_group_name>`"
404 423 }
405 424
406 425 """
407 426
408 427 repo_group = get_repo_group_or_error(repogroupid)
409 428
410 429 if not has_superadmin_permission(apiuser):
411 # check if we have admin permission for this repo group !
412 _perms = ('group.admin',)
413 if not HasRepoGroupPermissionAnyApi(*_perms)(
414 user=apiuser, group_name=repo_group.group_name):
415 raise JSONRPCError(
416 'repository group `%s` does not exist' % (repogroupid,))
430 validate_repo_group_permissions(
431 apiuser, repogroupid, repo_group, ('group.admin',))
417 432
418 433 user = get_user_or_error(userid)
419 434 perm = get_perm_or_error(perm, prefix='group.')
420 435 apply_to_children = Optional.extract(apply_to_children)
421 436
422 437 perm_additions = [[user.user_id, perm, "user"]]
423 438 try:
424 439 RepoGroupModel().update_permissions(repo_group=repo_group,
425 440 perm_additions=perm_additions,
426 441 recursive=apply_to_children,
427 442 cur_user=apiuser)
428 443 Session().commit()
429 444 return {
430 445 'msg': 'Granted perm: `%s` (recursive:%s) for user: '
431 446 '`%s` in repo group: `%s`' % (
432 447 perm.permission_name, apply_to_children, user.username,
433 448 repo_group.name
434 449 ),
435 450 'success': True
436 451 }
437 452 except Exception:
438 453 log.exception("Exception occurred while trying to grant "
439 454 "user permissions to repo group")
440 455 raise JSONRPCError(
441 456 'failed to edit permission for user: '
442 457 '`%s` in repo group: `%s`' % (userid, repo_group.name))
443 458
444 459
445 460 @jsonrpc_method()
446 461 def revoke_user_permission_from_repo_group(
447 462 request, apiuser, repogroupid, userid,
448 463 apply_to_children=Optional('none')):
449 464 """
450 465 Revoke permission for a user in a given repository group.
451 466
452 467 This command can only be run using an |authtoken| with admin
453 468 permissions on the |repo| group.
454 469
455 470 :param apiuser: This is filled automatically from the |authtoken|.
456 471 :type apiuser: AuthUser
457 472 :param repogroupid: Set the name or ID of the repository group.
458 473 :type repogroupid: str or int
459 474 :param userid: Set the user name to revoke.
460 475 :type userid: str
461 476 :param apply_to_children: 'none', 'repos', 'groups', 'all'
462 477 :type apply_to_children: str
463 478
464 479 Example output:
465 480
466 481 .. code-block:: bash
467 482
468 483 id : <id_given_in_input>
469 484 result: {
470 485 "msg" : "Revoked perm (recursive:<apply_to_children>) for user: `<username>` in repo group: `<repo_group_name>`",
471 486 "success": true
472 487 }
473 488 error: null
474 489
475 490 Example error output:
476 491
477 492 .. code-block:: bash
478 493
479 494 id : <id_given_in_input>
480 495 result : null
481 496 error : {
482 497 "failed to edit permission for user: `<userid>` in repo group: `<repo_group_name>`"
483 498 }
484 499
485 500 """
486 501
487 502 repo_group = get_repo_group_or_error(repogroupid)
488 503
489 504 if not has_superadmin_permission(apiuser):
490 # check if we have admin permission for this repo group !
491 _perms = ('group.admin',)
492 if not HasRepoGroupPermissionAnyApi(*_perms)(
493 user=apiuser, group_name=repo_group.group_name):
494 raise JSONRPCError(
495 'repository group `%s` does not exist' % (repogroupid,))
505 validate_repo_group_permissions(
506 apiuser, repogroupid, repo_group, ('group.admin',))
496 507
497 508 user = get_user_or_error(userid)
498 509 apply_to_children = Optional.extract(apply_to_children)
499 510
500 511 perm_deletions = [[user.user_id, None, "user"]]
501 512 try:
502 513 RepoGroupModel().update_permissions(repo_group=repo_group,
503 514 perm_deletions=perm_deletions,
504 515 recursive=apply_to_children,
505 516 cur_user=apiuser)
506 517 Session().commit()
507 518 return {
508 519 'msg': 'Revoked perm (recursive:%s) for user: '
509 520 '`%s` in repo group: `%s`' % (
510 521 apply_to_children, user.username, repo_group.name
511 522 ),
512 523 'success': True
513 524 }
514 525 except Exception:
515 526 log.exception("Exception occurred while trying revoke user "
516 527 "permission from repo group")
517 528 raise JSONRPCError(
518 529 'failed to edit permission for user: '
519 530 '`%s` in repo group: `%s`' % (userid, repo_group.name))
520 531
521 532
522 533 @jsonrpc_method()
523 534 def grant_user_group_permission_to_repo_group(
524 535 request, apiuser, repogroupid, usergroupid, perm,
525 536 apply_to_children=Optional('none'), ):
526 537 """
527 538 Grant permission for a user group on given repository group, or update
528 539 existing permissions if found.
529 540
530 541 This command can only be run using an |authtoken| with admin
531 542 permissions on the |repo| group.
532 543
533 544 :param apiuser: This is filled automatically from the |authtoken|.
534 545 :type apiuser: AuthUser
535 546 :param repogroupid: Set the name or id of repository group
536 547 :type repogroupid: str or int
537 548 :param usergroupid: id of usergroup
538 549 :type usergroupid: str or int
539 550 :param perm: (group.(none|read|write|admin))
540 551 :type perm: str
541 552 :param apply_to_children: 'none', 'repos', 'groups', 'all'
542 553 :type apply_to_children: str
543 554
544 555 Example output:
545 556
546 557 .. code-block:: bash
547 558
548 559 id : <id_given_in_input>
549 560 result : {
550 561 "msg" : "Granted perm: `<perm>` (recursive:<apply_to_children>) for user group: `<usersgroupname>` in repo group: `<repo_group_name>`",
551 562 "success": true
552 563
553 564 }
554 565 error : null
555 566
556 567 Example error output:
557 568
558 569 .. code-block:: bash
559 570
560 571 id : <id_given_in_input>
561 572 result : null
562 573 error : {
563 574 "failed to edit permission for user group: `<usergroup>` in repo group: `<repo_group_name>`"
564 575 }
565 576
566 577 """
567 578
568 579 repo_group = get_repo_group_or_error(repogroupid)
569 580 perm = get_perm_or_error(perm, prefix='group.')
570 581 user_group = get_user_group_or_error(usergroupid)
571 582 if not has_superadmin_permission(apiuser):
572 # check if we have admin permission for this repo group !
573 _perms = ('group.admin',)
574 if not HasRepoGroupPermissionAnyApi(*_perms)(
575 user=apiuser, group_name=repo_group.group_name):
576 raise JSONRPCError(
577 'repository group `%s` does not exist' % (repogroupid,))
583 validate_repo_group_permissions(
584 apiuser, repogroupid, repo_group, ('group.admin',))
578 585
579 586 # check if we have at least read permission for this user group !
580 587 _perms = ('usergroup.read', 'usergroup.write', 'usergroup.admin',)
581 588 if not HasUserGroupPermissionAnyApi(*_perms)(
582 589 user=apiuser, user_group_name=user_group.users_group_name):
583 590 raise JSONRPCError(
584 591 'user group `%s` does not exist' % (usergroupid,))
585 592
586 593 apply_to_children = Optional.extract(apply_to_children)
587 594
588 595 perm_additions = [[user_group.users_group_id, perm, "user_group"]]
589 596 try:
590 597 RepoGroupModel().update_permissions(repo_group=repo_group,
591 598 perm_additions=perm_additions,
592 599 recursive=apply_to_children,
593 600 cur_user=apiuser)
594 601 Session().commit()
595 602 return {
596 603 'msg': 'Granted perm: `%s` (recursive:%s) '
597 604 'for user group: `%s` in repo group: `%s`' % (
598 605 perm.permission_name, apply_to_children,
599 606 user_group.users_group_name, repo_group.name
600 607 ),
601 608 'success': True
602 609 }
603 610 except Exception:
604 611 log.exception("Exception occurred while trying to grant user "
605 612 "group permissions to repo group")
606 613 raise JSONRPCError(
607 614 'failed to edit permission for user group: `%s` in '
608 615 'repo group: `%s`' % (
609 616 usergroupid, repo_group.name
610 617 )
611 618 )
612 619
613 620
614 621 @jsonrpc_method()
615 622 def revoke_user_group_permission_from_repo_group(
616 623 request, apiuser, repogroupid, usergroupid,
617 624 apply_to_children=Optional('none')):
618 625 """
619 626 Revoke permission for user group on given repository.
620 627
621 628 This command can only be run using an |authtoken| with admin
622 629 permissions on the |repo| group.
623 630
624 631 :param apiuser: This is filled automatically from the |authtoken|.
625 632 :type apiuser: AuthUser
626 633 :param repogroupid: name or id of repository group
627 634 :type repogroupid: str or int
628 635 :param usergroupid:
629 636 :param apply_to_children: 'none', 'repos', 'groups', 'all'
630 637 :type apply_to_children: str
631 638
632 639 Example output:
633 640
634 641 .. code-block:: bash
635 642
636 643 id : <id_given_in_input>
637 644 result: {
638 645 "msg" : "Revoked perm (recursive:<apply_to_children>) for user group: `<usersgroupname>` in repo group: `<repo_group_name>`",
639 646 "success": true
640 647 }
641 648 error: null
642 649
643 650 Example error output:
644 651
645 652 .. code-block:: bash
646 653
647 654 id : <id_given_in_input>
648 655 result : null
649 656 error : {
650 657 "failed to edit permission for user group: `<usergroup>` in repo group: `<repo_group_name>`"
651 658 }
652 659
653 660
654 661 """
655 662
656 663 repo_group = get_repo_group_or_error(repogroupid)
657 664 user_group = get_user_group_or_error(usergroupid)
658 665 if not has_superadmin_permission(apiuser):
659 # check if we have admin permission for this repo group !
660 _perms = ('group.admin',)
661 if not HasRepoGroupPermissionAnyApi(*_perms)(
662 user=apiuser, group_name=repo_group.group_name):
663 raise JSONRPCError(
664 'repository group `%s` does not exist' % (repogroupid,))
666 validate_repo_group_permissions(
667 apiuser, repogroupid, repo_group, ('group.admin',))
665 668
666 669 # check if we have at least read permission for this user group !
667 670 _perms = ('usergroup.read', 'usergroup.write', 'usergroup.admin',)
668 671 if not HasUserGroupPermissionAnyApi(*_perms)(
669 672 user=apiuser, user_group_name=user_group.users_group_name):
670 673 raise JSONRPCError(
671 674 'user group `%s` does not exist' % (usergroupid,))
672 675
673 676 apply_to_children = Optional.extract(apply_to_children)
674 677
675 678 perm_deletions = [[user_group.users_group_id, None, "user_group"]]
676 679 try:
677 680 RepoGroupModel().update_permissions(repo_group=repo_group,
678 681 perm_deletions=perm_deletions,
679 682 recursive=apply_to_children,
680 683 cur_user=apiuser)
681 684 Session().commit()
682 685 return {
683 686 'msg': 'Revoked perm (recursive:%s) for user group: '
684 687 '`%s` in repo group: `%s`' % (
685 688 apply_to_children, user_group.users_group_name,
686 689 repo_group.name
687 690 ),
688 691 'success': True
689 692 }
690 693 except Exception:
691 694 log.exception("Exception occurred while trying revoke user group "
692 695 "permissions from repo group")
693 696 raise JSONRPCError(
694 697 'failed to edit permission for user group: '
695 698 '`%s` in repo group: `%s`' % (
696 699 user_group.users_group_name, repo_group.name
697 700 )
698 701 )
699 702
@@ -1,29 +1,240 b''
1 1 # -*- coding: utf-8 -*-
2 2
3 3 # Copyright (C) 2016-2016 RhodeCode GmbH
4 4 #
5 5 # This program is free software: you can redistribute it and/or modify
6 6 # it under the terms of the GNU Affero General Public License, version 3
7 7 # (only), as published by the Free Software Foundation.
8 8 #
9 9 # This program is distributed in the hope that it will be useful,
10 10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 12 # GNU General Public License for more details.
13 13 #
14 14 # You should have received a copy of the GNU Affero General Public License
15 15 # along with this program. If not, see <http://www.gnu.org/licenses/>.
16 16 #
17 17 # This program is dual-licensed. If you wish to learn more about the
18 18 # RhodeCode Enterprise Edition, including its added features, Support services,
19 19 # and proprietary license terms, please see https://rhodecode.com/licenses/
20 20
21 21
22 22 import colander
23 23
24
24 from rhodecode.translation import _
25 25 from rhodecode.model.validation_schema import validators, preparers, types
26 26
27 27
28 def get_group_and_repo(repo_name):
29 from rhodecode.model.repo_group import RepoGroupModel
30 return RepoGroupModel()._get_group_name_and_parent(
31 repo_name, get_object=True)
32
33
34 @colander.deferred
35 def deferred_can_write_to_group_validator(node, kw):
36 old_values = kw.get('old_values') or {}
37 request_user = kw.get('user')
38
39 def can_write_group_validator(node, value):
40 from rhodecode.lib.auth import (
41 HasPermissionAny, HasRepoGroupPermissionAny)
42 from rhodecode.model.repo_group import RepoGroupModel
43
44 messages = {
45 'invalid_parent_repo_group':
46 _(u"Parent repository group `{}` does not exist"),
47 # permissions denied we expose as not existing, to prevent
48 # resource discovery
49 'permission_denied_parent_group':
50 _(u"Parent repository group `{}` does not exist"),
51 'permission_denied_root':
52 _(u"You do not have the permission to store "
53 u"repository groups in the root location.")
54 }
55
56 value = value['repo_group_name']
57 parent_group_name = value
58
59 is_root_location = value is types.RootLocation
60
61 # NOT initialized validators, we must call them
62 can_create_repo_groups_at_root = HasPermissionAny(
63 'hg.admin', 'hg.repogroup.create.true')
64
65 if is_root_location:
66 if can_create_repo_groups_at_root(user=request_user):
67 # we can create repo group inside tool-level. No more checks
68 # are required
69 return
70 else:
71 raise colander.Invalid(node, messages['permission_denied_root'])
72
73 # check if the parent repo group actually exists
74 parent_group = None
75 if parent_group_name:
76 parent_group = RepoGroupModel().get_by_group_name(parent_group_name)
77 if value and not parent_group:
78 raise colander.Invalid(
79 node, messages['invalid_parent_repo_group'].format(
80 parent_group_name))
81
82 # check if we have permissions to create new groups under
83 # parent repo group
84 # create repositories with write permission on group is set to true
85 create_on_write = HasPermissionAny(
86 'hg.create.write_on_repogroup.true')(user=request_user)
87
88 group_admin = HasRepoGroupPermissionAny('group.admin')(
89 parent_group_name, 'can write into group validator', user=request_user)
90 group_write = HasRepoGroupPermissionAny('group.write')(
91 parent_group_name, 'can write into group validator', user=request_user)
92
93 # creation by write access is currently disabled. Needs thinking if
94 # we want to allow this...
95 forbidden = not (group_admin or (group_write and create_on_write and 0))
96
97 if parent_group and forbidden:
98 msg = messages['permission_denied_parent_group'].format(
99 parent_group_name)
100 raise colander.Invalid(node, msg)
101
102 return can_write_group_validator
103
104
105 @colander.deferred
106 def deferred_repo_group_owner_validator(node, kw):
107
108 def repo_owner_validator(node, value):
109 from rhodecode.model.db import User
110 existing = User.get_by_username(value)
111 if not existing:
112 msg = _(u'Repo group owner with id `{}` does not exists').format(
113 value)
114 raise colander.Invalid(node, msg)
115
116 return repo_owner_validator
117
118
119 @colander.deferred
120 def deferred_unique_name_validator(node, kw):
121 request_user = kw.get('user')
122 old_values = kw.get('old_values') or {}
123
124 def unique_name_validator(node, value):
125 from rhodecode.model.db import Repository, RepoGroup
126 name_changed = value != old_values.get('group_name')
127
128 existing = Repository.get_by_repo_name(value)
129 if name_changed and existing:
130 msg = _(u'Repository with name `{}` already exists').format(value)
131 raise colander.Invalid(node, msg)
132
133 existing_group = RepoGroup.get_by_group_name(value)
134 if name_changed and existing_group:
135 msg = _(u'Repository group with name `{}` already exists').format(
136 value)
137 raise colander.Invalid(node, msg)
138 return unique_name_validator
139
140
141 @colander.deferred
142 def deferred_repo_group_name_validator(node, kw):
143 return validators.valid_name_validator
144
145
146 class GroupType(colander.Mapping):
147 def _validate(self, node, value):
148 try:
149 return dict(repo_group_name=value)
150 except Exception as e:
151 raise colander.Invalid(
152 node, '"${val}" is not a mapping type: ${err}'.format(
153 val=value, err=e))
154
155 def deserialize(self, node, cstruct):
156 if cstruct is colander.null:
157 return cstruct
158
159 appstruct = super(GroupType, self).deserialize(node, cstruct)
160 validated_name = appstruct['repo_group_name']
161
162 # inject group based on once deserialized data
163 (repo_group_name_without_group,
164 parent_group_name,
165 parent_group) = get_group_and_repo(validated_name)
166
167 appstruct['repo_group_name_without_group'] = repo_group_name_without_group
168 appstruct['repo_group_name'] = parent_group_name or types.RootLocation
169 if parent_group:
170 appstruct['repo_group_id'] = parent_group.group_id
171
172 return appstruct
173
174
175 class GroupSchema(colander.SchemaNode):
176 schema_type = GroupType
177 validator = deferred_can_write_to_group_validator
178 missing = colander.null
179
180
181 class RepoGroup(GroupSchema):
182 repo_group_name = colander.SchemaNode(
183 types.GroupNameType())
184 repo_group_id = colander.SchemaNode(
185 colander.String(), missing=None)
186 repo_group_name_without_group = colander.SchemaNode(
187 colander.String(), missing=None)
188
189
190 class RepoGroupAccessSchema(colander.MappingSchema):
191 repo_group = RepoGroup()
192
193
194 class RepoGroupNameUniqueSchema(colander.MappingSchema):
195 unique_repo_group_name = colander.SchemaNode(
196 colander.String(),
197 validator=deferred_unique_name_validator)
198
199
28 200 class RepoGroupSchema(colander.Schema):
29 group_name = colander.SchemaNode(types.GroupNameType())
201
202 repo_group_name = colander.SchemaNode(
203 types.GroupNameType(),
204 validator=deferred_repo_group_name_validator)
205
206 repo_group_owner = colander.SchemaNode(
207 colander.String(),
208 validator=deferred_repo_group_owner_validator)
209
210 repo_group_description = colander.SchemaNode(
211 colander.String(), missing='')
212
213 repo_group_copy_permissions = colander.SchemaNode(
214 types.StringBooleanType(),
215 missing=False)
216
217 repo_group_enable_locking = colander.SchemaNode(
218 types.StringBooleanType(),
219 missing=False)
220
221 def deserialize(self, cstruct):
222 """
223 Custom deserialize that allows to chain validation, and verify
224 permissions, and as last step uniqueness
225 """
226
227 appstruct = super(RepoGroupSchema, self).deserialize(cstruct)
228 validated_name = appstruct['repo_group_name']
229
230 # second pass to validate permissions to repo_group
231 second = RepoGroupAccessSchema().bind(**self.bindings)
232 appstruct_second = second.deserialize({'repo_group': validated_name})
233 # save result
234 appstruct['repo_group'] = appstruct_second['repo_group']
235
236 # thirds to validate uniqueness
237 third = RepoGroupNameUniqueSchema().bind(**self.bindings)
238 third.deserialize({'unique_repo_group_name': validated_name})
239
240 return appstruct
General Comments 0
You need to be logged in to leave comments. Login now