##// END OF EJS Templates
auth-user: enabled cache flags for fetching ACL ids....
marcink -
r4328:eca0587d default
parent child Browse files
Show More
@@ -1,2446 +1,2498 b''
1 # -*- coding: utf-8 -*-
1 # -*- coding: utf-8 -*-
2
2
3 # Copyright (C) 2010-2020 RhodeCode GmbH
3 # Copyright (C) 2010-2020 RhodeCode GmbH
4 #
4 #
5 # This program is free software: you can redistribute it and/or modify
5 # This program is free software: you can redistribute it and/or modify
6 # it under the terms of the GNU Affero General Public License, version 3
6 # it under the terms of the GNU Affero General Public License, version 3
7 # (only), as published by the Free Software Foundation.
7 # (only), as published by the Free Software Foundation.
8 #
8 #
9 # This program is distributed in the hope that it will be useful,
9 # This program is distributed in the hope that it will be useful,
10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 # GNU General Public License for more details.
12 # GNU General Public License for more details.
13 #
13 #
14 # You should have received a copy of the GNU Affero General Public License
14 # You should have received a copy of the GNU Affero General Public License
15 # along with this program. If not, see <http://www.gnu.org/licenses/>.
15 # along with this program. If not, see <http://www.gnu.org/licenses/>.
16 #
16 #
17 # This program is dual-licensed. If you wish to learn more about the
17 # This program is dual-licensed. If you wish to learn more about the
18 # RhodeCode Enterprise Edition, including its added features, Support services,
18 # RhodeCode Enterprise Edition, including its added features, Support services,
19 # and proprietary license terms, please see https://rhodecode.com/licenses/
19 # and proprietary license terms, please see https://rhodecode.com/licenses/
20
20
21 """
21 """
22 authentication and permission libraries
22 authentication and permission libraries
23 """
23 """
24
24
25 import os
25 import os
26
26
27 import colander
27 import colander
28 import time
28 import time
29 import collections
29 import collections
30 import fnmatch
30 import fnmatch
31 import hashlib
31 import hashlib
32 import itertools
32 import itertools
33 import logging
33 import logging
34 import random
34 import random
35 import traceback
35 import traceback
36 from functools import wraps
36 from functools import wraps
37
37
38 import ipaddress
38 import ipaddress
39
39
40 from pyramid.httpexceptions import HTTPForbidden, HTTPFound, HTTPNotFound
40 from pyramid.httpexceptions import HTTPForbidden, HTTPFound, HTTPNotFound
41 from sqlalchemy.orm.exc import ObjectDeletedError
41 from sqlalchemy.orm.exc import ObjectDeletedError
42 from sqlalchemy.orm import joinedload
42 from sqlalchemy.orm import joinedload
43 from zope.cachedescriptors.property import Lazy as LazyProperty
43 from zope.cachedescriptors.property import Lazy as LazyProperty
44
44
45 import rhodecode
45 import rhodecode
46 from rhodecode.model import meta
46 from rhodecode.model import meta
47 from rhodecode.model.meta import Session
47 from rhodecode.model.meta import Session
48 from rhodecode.model.user import UserModel
48 from rhodecode.model.user import UserModel
49 from rhodecode.model.db import (
49 from rhodecode.model.db import (
50 false, User, Repository, Permission, UserToPerm, UserGroupToPerm, UserGroupMember,
50 false, User, Repository, Permission, UserToPerm, UserGroupToPerm, UserGroupMember,
51 UserIpMap, UserApiKeys, RepoGroup, UserGroup, UserNotice)
51 UserIpMap, UserApiKeys, RepoGroup, UserGroup, UserNotice)
52 from rhodecode.lib import rc_cache
52 from rhodecode.lib import rc_cache
53 from rhodecode.lib.utils2 import safe_unicode, aslist, safe_str, md5, safe_int, sha1
53 from rhodecode.lib.utils2 import safe_unicode, aslist, safe_str, md5, safe_int, sha1
54 from rhodecode.lib.utils import (
54 from rhodecode.lib.utils import (
55 get_repo_slug, get_repo_group_slug, get_user_group_slug)
55 get_repo_slug, get_repo_group_slug, get_user_group_slug)
56 from rhodecode.lib.caching_query import FromCache
56 from rhodecode.lib.caching_query import FromCache
57
57
58 if rhodecode.is_unix:
58 if rhodecode.is_unix:
59 import bcrypt
59 import bcrypt
60
60
61 log = logging.getLogger(__name__)
61 log = logging.getLogger(__name__)
62
62
63 csrf_token_key = "csrf_token"
63 csrf_token_key = "csrf_token"
64
64
65
65
66 class PasswordGenerator(object):
66 class PasswordGenerator(object):
67 """
67 """
68 This is a simple class for generating password from different sets of
68 This is a simple class for generating password from different sets of
69 characters
69 characters
70 usage::
70 usage::
71 passwd_gen = PasswordGenerator()
71 passwd_gen = PasswordGenerator()
72 #print 8-letter password containing only big and small letters
72 #print 8-letter password containing only big and small letters
73 of alphabet
73 of alphabet
74 passwd_gen.gen_password(8, passwd_gen.ALPHABETS_BIG_SMALL)
74 passwd_gen.gen_password(8, passwd_gen.ALPHABETS_BIG_SMALL)
75 """
75 """
76 ALPHABETS_NUM = r'''1234567890'''
76 ALPHABETS_NUM = r'''1234567890'''
77 ALPHABETS_SMALL = r'''qwertyuiopasdfghjklzxcvbnm'''
77 ALPHABETS_SMALL = r'''qwertyuiopasdfghjklzxcvbnm'''
78 ALPHABETS_BIG = r'''QWERTYUIOPASDFGHJKLZXCVBNM'''
78 ALPHABETS_BIG = r'''QWERTYUIOPASDFGHJKLZXCVBNM'''
79 ALPHABETS_SPECIAL = r'''`-=[]\;',./~!@#$%^&*()_+{}|:"<>?'''
79 ALPHABETS_SPECIAL = r'''`-=[]\;',./~!@#$%^&*()_+{}|:"<>?'''
80 ALPHABETS_FULL = ALPHABETS_BIG + ALPHABETS_SMALL \
80 ALPHABETS_FULL = ALPHABETS_BIG + ALPHABETS_SMALL \
81 + ALPHABETS_NUM + ALPHABETS_SPECIAL
81 + ALPHABETS_NUM + ALPHABETS_SPECIAL
82 ALPHABETS_ALPHANUM = ALPHABETS_BIG + ALPHABETS_SMALL + ALPHABETS_NUM
82 ALPHABETS_ALPHANUM = ALPHABETS_BIG + ALPHABETS_SMALL + ALPHABETS_NUM
83 ALPHABETS_BIG_SMALL = ALPHABETS_BIG + ALPHABETS_SMALL
83 ALPHABETS_BIG_SMALL = ALPHABETS_BIG + ALPHABETS_SMALL
84 ALPHABETS_ALPHANUM_BIG = ALPHABETS_BIG + ALPHABETS_NUM
84 ALPHABETS_ALPHANUM_BIG = ALPHABETS_BIG + ALPHABETS_NUM
85 ALPHABETS_ALPHANUM_SMALL = ALPHABETS_SMALL + ALPHABETS_NUM
85 ALPHABETS_ALPHANUM_SMALL = ALPHABETS_SMALL + ALPHABETS_NUM
86
86
87 def __init__(self, passwd=''):
87 def __init__(self, passwd=''):
88 self.passwd = passwd
88 self.passwd = passwd
89
89
90 def gen_password(self, length, type_=None):
90 def gen_password(self, length, type_=None):
91 if type_ is None:
91 if type_ is None:
92 type_ = self.ALPHABETS_FULL
92 type_ = self.ALPHABETS_FULL
93 self.passwd = ''.join([random.choice(type_) for _ in range(length)])
93 self.passwd = ''.join([random.choice(type_) for _ in range(length)])
94 return self.passwd
94 return self.passwd
95
95
96
96
97 class _RhodeCodeCryptoBase(object):
97 class _RhodeCodeCryptoBase(object):
98 ENC_PREF = None
98 ENC_PREF = None
99
99
100 def hash_create(self, str_):
100 def hash_create(self, str_):
101 """
101 """
102 hash the string using
102 hash the string using
103
103
104 :param str_: password to hash
104 :param str_: password to hash
105 """
105 """
106 raise NotImplementedError
106 raise NotImplementedError
107
107
108 def hash_check_with_upgrade(self, password, hashed):
108 def hash_check_with_upgrade(self, password, hashed):
109 """
109 """
110 Returns tuple in which first element is boolean that states that
110 Returns tuple in which first element is boolean that states that
111 given password matches it's hashed version, and the second is new hash
111 given password matches it's hashed version, and the second is new hash
112 of the password, in case this password should be migrated to new
112 of the password, in case this password should be migrated to new
113 cipher.
113 cipher.
114 """
114 """
115 checked_hash = self.hash_check(password, hashed)
115 checked_hash = self.hash_check(password, hashed)
116 return checked_hash, None
116 return checked_hash, None
117
117
118 def hash_check(self, password, hashed):
118 def hash_check(self, password, hashed):
119 """
119 """
120 Checks matching password with it's hashed value.
120 Checks matching password with it's hashed value.
121
121
122 :param password: password
122 :param password: password
123 :param hashed: password in hashed form
123 :param hashed: password in hashed form
124 """
124 """
125 raise NotImplementedError
125 raise NotImplementedError
126
126
127 def _assert_bytes(self, value):
127 def _assert_bytes(self, value):
128 """
128 """
129 Passing in an `unicode` object can lead to hard to detect issues
129 Passing in an `unicode` object can lead to hard to detect issues
130 if passwords contain non-ascii characters. Doing a type check
130 if passwords contain non-ascii characters. Doing a type check
131 during runtime, so that such mistakes are detected early on.
131 during runtime, so that such mistakes are detected early on.
132 """
132 """
133 if not isinstance(value, str):
133 if not isinstance(value, str):
134 raise TypeError(
134 raise TypeError(
135 "Bytestring required as input, got %r." % (value, ))
135 "Bytestring required as input, got %r." % (value, ))
136
136
137
137
138 class _RhodeCodeCryptoBCrypt(_RhodeCodeCryptoBase):
138 class _RhodeCodeCryptoBCrypt(_RhodeCodeCryptoBase):
139 ENC_PREF = ('$2a$10', '$2b$10')
139 ENC_PREF = ('$2a$10', '$2b$10')
140
140
141 def hash_create(self, str_):
141 def hash_create(self, str_):
142 self._assert_bytes(str_)
142 self._assert_bytes(str_)
143 return bcrypt.hashpw(str_, bcrypt.gensalt(10))
143 return bcrypt.hashpw(str_, bcrypt.gensalt(10))
144
144
145 def hash_check_with_upgrade(self, password, hashed):
145 def hash_check_with_upgrade(self, password, hashed):
146 """
146 """
147 Returns tuple in which first element is boolean that states that
147 Returns tuple in which first element is boolean that states that
148 given password matches it's hashed version, and the second is new hash
148 given password matches it's hashed version, and the second is new hash
149 of the password, in case this password should be migrated to new
149 of the password, in case this password should be migrated to new
150 cipher.
150 cipher.
151
151
152 This implements special upgrade logic which works like that:
152 This implements special upgrade logic which works like that:
153 - check if the given password == bcrypted hash, if yes then we
153 - check if the given password == bcrypted hash, if yes then we
154 properly used password and it was already in bcrypt. Proceed
154 properly used password and it was already in bcrypt. Proceed
155 without any changes
155 without any changes
156 - if bcrypt hash check is not working try with sha256. If hash compare
156 - if bcrypt hash check is not working try with sha256. If hash compare
157 is ok, it means we using correct but old hashed password. indicate
157 is ok, it means we using correct but old hashed password. indicate
158 hash change and proceed
158 hash change and proceed
159 """
159 """
160
160
161 new_hash = None
161 new_hash = None
162
162
163 # regular pw check
163 # regular pw check
164 password_match_bcrypt = self.hash_check(password, hashed)
164 password_match_bcrypt = self.hash_check(password, hashed)
165
165
166 # now we want to know if the password was maybe from sha256
166 # now we want to know if the password was maybe from sha256
167 # basically calling _RhodeCodeCryptoSha256().hash_check()
167 # basically calling _RhodeCodeCryptoSha256().hash_check()
168 if not password_match_bcrypt:
168 if not password_match_bcrypt:
169 if _RhodeCodeCryptoSha256().hash_check(password, hashed):
169 if _RhodeCodeCryptoSha256().hash_check(password, hashed):
170 new_hash = self.hash_create(password) # make new bcrypt hash
170 new_hash = self.hash_create(password) # make new bcrypt hash
171 password_match_bcrypt = True
171 password_match_bcrypt = True
172
172
173 return password_match_bcrypt, new_hash
173 return password_match_bcrypt, new_hash
174
174
175 def hash_check(self, password, hashed):
175 def hash_check(self, password, hashed):
176 """
176 """
177 Checks matching password with it's hashed value.
177 Checks matching password with it's hashed value.
178
178
179 :param password: password
179 :param password: password
180 :param hashed: password in hashed form
180 :param hashed: password in hashed form
181 """
181 """
182 self._assert_bytes(password)
182 self._assert_bytes(password)
183 try:
183 try:
184 return bcrypt.hashpw(password, hashed) == hashed
184 return bcrypt.hashpw(password, hashed) == hashed
185 except ValueError as e:
185 except ValueError as e:
186 # we're having a invalid salt here probably, we should not crash
186 # we're having a invalid salt here probably, we should not crash
187 # just return with False as it would be a wrong password.
187 # just return with False as it would be a wrong password.
188 log.debug('Failed to check password hash using bcrypt %s',
188 log.debug('Failed to check password hash using bcrypt %s',
189 safe_str(e))
189 safe_str(e))
190
190
191 return False
191 return False
192
192
193
193
194 class _RhodeCodeCryptoSha256(_RhodeCodeCryptoBase):
194 class _RhodeCodeCryptoSha256(_RhodeCodeCryptoBase):
195 ENC_PREF = '_'
195 ENC_PREF = '_'
196
196
197 def hash_create(self, str_):
197 def hash_create(self, str_):
198 self._assert_bytes(str_)
198 self._assert_bytes(str_)
199 return hashlib.sha256(str_).hexdigest()
199 return hashlib.sha256(str_).hexdigest()
200
200
201 def hash_check(self, password, hashed):
201 def hash_check(self, password, hashed):
202 """
202 """
203 Checks matching password with it's hashed value.
203 Checks matching password with it's hashed value.
204
204
205 :param password: password
205 :param password: password
206 :param hashed: password in hashed form
206 :param hashed: password in hashed form
207 """
207 """
208 self._assert_bytes(password)
208 self._assert_bytes(password)
209 return hashlib.sha256(password).hexdigest() == hashed
209 return hashlib.sha256(password).hexdigest() == hashed
210
210
211
211
212 class _RhodeCodeCryptoTest(_RhodeCodeCryptoBase):
212 class _RhodeCodeCryptoTest(_RhodeCodeCryptoBase):
213 ENC_PREF = '_'
213 ENC_PREF = '_'
214
214
215 def hash_create(self, str_):
215 def hash_create(self, str_):
216 self._assert_bytes(str_)
216 self._assert_bytes(str_)
217 return sha1(str_)
217 return sha1(str_)
218
218
219 def hash_check(self, password, hashed):
219 def hash_check(self, password, hashed):
220 """
220 """
221 Checks matching password with it's hashed value.
221 Checks matching password with it's hashed value.
222
222
223 :param password: password
223 :param password: password
224 :param hashed: password in hashed form
224 :param hashed: password in hashed form
225 """
225 """
226 self._assert_bytes(password)
226 self._assert_bytes(password)
227 return sha1(password) == hashed
227 return sha1(password) == hashed
228
228
229
229
230 def crypto_backend():
230 def crypto_backend():
231 """
231 """
232 Return the matching crypto backend.
232 Return the matching crypto backend.
233
233
234 Selection is based on if we run tests or not, we pick sha1-test backend to run
234 Selection is based on if we run tests or not, we pick sha1-test backend to run
235 tests faster since BCRYPT is expensive to calculate
235 tests faster since BCRYPT is expensive to calculate
236 """
236 """
237 if rhodecode.is_test:
237 if rhodecode.is_test:
238 RhodeCodeCrypto = _RhodeCodeCryptoTest()
238 RhodeCodeCrypto = _RhodeCodeCryptoTest()
239 else:
239 else:
240 RhodeCodeCrypto = _RhodeCodeCryptoBCrypt()
240 RhodeCodeCrypto = _RhodeCodeCryptoBCrypt()
241
241
242 return RhodeCodeCrypto
242 return RhodeCodeCrypto
243
243
244
244
245 def get_crypt_password(password):
245 def get_crypt_password(password):
246 """
246 """
247 Create the hash of `password` with the active crypto backend.
247 Create the hash of `password` with the active crypto backend.
248
248
249 :param password: The cleartext password.
249 :param password: The cleartext password.
250 :type password: unicode
250 :type password: unicode
251 """
251 """
252 password = safe_str(password)
252 password = safe_str(password)
253 return crypto_backend().hash_create(password)
253 return crypto_backend().hash_create(password)
254
254
255
255
256 def check_password(password, hashed):
256 def check_password(password, hashed):
257 """
257 """
258 Check if the value in `password` matches the hash in `hashed`.
258 Check if the value in `password` matches the hash in `hashed`.
259
259
260 :param password: The cleartext password.
260 :param password: The cleartext password.
261 :type password: unicode
261 :type password: unicode
262
262
263 :param hashed: The expected hashed version of the password.
263 :param hashed: The expected hashed version of the password.
264 :type hashed: The hash has to be passed in in text representation.
264 :type hashed: The hash has to be passed in in text representation.
265 """
265 """
266 password = safe_str(password)
266 password = safe_str(password)
267 return crypto_backend().hash_check(password, hashed)
267 return crypto_backend().hash_check(password, hashed)
268
268
269
269
270 def generate_auth_token(data, salt=None):
270 def generate_auth_token(data, salt=None):
271 """
271 """
272 Generates API KEY from given string
272 Generates API KEY from given string
273 """
273 """
274
274
275 if salt is None:
275 if salt is None:
276 salt = os.urandom(16)
276 salt = os.urandom(16)
277 return hashlib.sha1(safe_str(data) + salt).hexdigest()
277 return hashlib.sha1(safe_str(data) + salt).hexdigest()
278
278
279
279
280 def get_came_from(request):
280 def get_came_from(request):
281 """
281 """
282 get query_string+path from request sanitized after removing auth_token
282 get query_string+path from request sanitized after removing auth_token
283 """
283 """
284 _req = request
284 _req = request
285
285
286 path = _req.path
286 path = _req.path
287 if 'auth_token' in _req.GET:
287 if 'auth_token' in _req.GET:
288 # sanitize the request and remove auth_token for redirection
288 # sanitize the request and remove auth_token for redirection
289 _req.GET.pop('auth_token')
289 _req.GET.pop('auth_token')
290 qs = _req.query_string
290 qs = _req.query_string
291 if qs:
291 if qs:
292 path += '?' + qs
292 path += '?' + qs
293
293
294 return path
294 return path
295
295
296
296
297 class CookieStoreWrapper(object):
297 class CookieStoreWrapper(object):
298
298
299 def __init__(self, cookie_store):
299 def __init__(self, cookie_store):
300 self.cookie_store = cookie_store
300 self.cookie_store = cookie_store
301
301
302 def __repr__(self):
302 def __repr__(self):
303 return 'CookieStore<%s>' % (self.cookie_store)
303 return 'CookieStore<%s>' % (self.cookie_store)
304
304
305 def get(self, key, other=None):
305 def get(self, key, other=None):
306 if isinstance(self.cookie_store, dict):
306 if isinstance(self.cookie_store, dict):
307 return self.cookie_store.get(key, other)
307 return self.cookie_store.get(key, other)
308 elif isinstance(self.cookie_store, AuthUser):
308 elif isinstance(self.cookie_store, AuthUser):
309 return self.cookie_store.__dict__.get(key, other)
309 return self.cookie_store.__dict__.get(key, other)
310
310
311
311
312 def _cached_perms_data(user_id, scope, user_is_admin,
312 def _cached_perms_data(user_id, scope, user_is_admin,
313 user_inherit_default_permissions, explicit, algo,
313 user_inherit_default_permissions, explicit, algo,
314 calculate_super_admin):
314 calculate_super_admin):
315
315
316 permissions = PermissionCalculator(
316 permissions = PermissionCalculator(
317 user_id, scope, user_is_admin, user_inherit_default_permissions,
317 user_id, scope, user_is_admin, user_inherit_default_permissions,
318 explicit, algo, calculate_super_admin)
318 explicit, algo, calculate_super_admin)
319 return permissions.calculate()
319 return permissions.calculate()
320
320
321
321
322 class PermOrigin(object):
322 class PermOrigin(object):
323 SUPER_ADMIN = 'superadmin'
323 SUPER_ADMIN = 'superadmin'
324 ARCHIVED = 'archived'
324 ARCHIVED = 'archived'
325
325
326 REPO_USER = 'user:%s'
326 REPO_USER = 'user:%s'
327 REPO_USERGROUP = 'usergroup:%s'
327 REPO_USERGROUP = 'usergroup:%s'
328 REPO_OWNER = 'repo.owner'
328 REPO_OWNER = 'repo.owner'
329 REPO_DEFAULT = 'repo.default'
329 REPO_DEFAULT = 'repo.default'
330 REPO_DEFAULT_NO_INHERIT = 'repo.default.no.inherit'
330 REPO_DEFAULT_NO_INHERIT = 'repo.default.no.inherit'
331 REPO_PRIVATE = 'repo.private'
331 REPO_PRIVATE = 'repo.private'
332
332
333 REPOGROUP_USER = 'user:%s'
333 REPOGROUP_USER = 'user:%s'
334 REPOGROUP_USERGROUP = 'usergroup:%s'
334 REPOGROUP_USERGROUP = 'usergroup:%s'
335 REPOGROUP_OWNER = 'group.owner'
335 REPOGROUP_OWNER = 'group.owner'
336 REPOGROUP_DEFAULT = 'group.default'
336 REPOGROUP_DEFAULT = 'group.default'
337 REPOGROUP_DEFAULT_NO_INHERIT = 'group.default.no.inherit'
337 REPOGROUP_DEFAULT_NO_INHERIT = 'group.default.no.inherit'
338
338
339 USERGROUP_USER = 'user:%s'
339 USERGROUP_USER = 'user:%s'
340 USERGROUP_USERGROUP = 'usergroup:%s'
340 USERGROUP_USERGROUP = 'usergroup:%s'
341 USERGROUP_OWNER = 'usergroup.owner'
341 USERGROUP_OWNER = 'usergroup.owner'
342 USERGROUP_DEFAULT = 'usergroup.default'
342 USERGROUP_DEFAULT = 'usergroup.default'
343 USERGROUP_DEFAULT_NO_INHERIT = 'usergroup.default.no.inherit'
343 USERGROUP_DEFAULT_NO_INHERIT = 'usergroup.default.no.inherit'
344
344
345
345
346 class PermOriginDict(dict):
346 class PermOriginDict(dict):
347 """
347 """
348 A special dict used for tracking permissions along with their origins.
348 A special dict used for tracking permissions along with their origins.
349
349
350 `__setitem__` has been overridden to expect a tuple(perm, origin)
350 `__setitem__` has been overridden to expect a tuple(perm, origin)
351 `__getitem__` will return only the perm
351 `__getitem__` will return only the perm
352 `.perm_origin_stack` will return the stack of (perm, origin) set per key
352 `.perm_origin_stack` will return the stack of (perm, origin) set per key
353
353
354 >>> perms = PermOriginDict()
354 >>> perms = PermOriginDict()
355 >>> perms['resource'] = 'read', 'default', 1
355 >>> perms['resource'] = 'read', 'default', 1
356 >>> perms['resource']
356 >>> perms['resource']
357 'read'
357 'read'
358 >>> perms['resource'] = 'write', 'admin', 2
358 >>> perms['resource'] = 'write', 'admin', 2
359 >>> perms['resource']
359 >>> perms['resource']
360 'write'
360 'write'
361 >>> perms.perm_origin_stack
361 >>> perms.perm_origin_stack
362 {'resource': [('read', 'default', 1), ('write', 'admin', 2)]}
362 {'resource': [('read', 'default', 1), ('write', 'admin', 2)]}
363 """
363 """
364
364
365 def __init__(self, *args, **kw):
365 def __init__(self, *args, **kw):
366 dict.__init__(self, *args, **kw)
366 dict.__init__(self, *args, **kw)
367 self.perm_origin_stack = collections.OrderedDict()
367 self.perm_origin_stack = collections.OrderedDict()
368
368
369 def __setitem__(self, key, (perm, origin, obj_id)):
369 def __setitem__(self, key, (perm, origin, obj_id)):
370 self.perm_origin_stack.setdefault(key, []).append(
370 self.perm_origin_stack.setdefault(key, []).append(
371 (perm, origin, obj_id))
371 (perm, origin, obj_id))
372 dict.__setitem__(self, key, perm)
372 dict.__setitem__(self, key, perm)
373
373
374
374
375 class BranchPermOriginDict(PermOriginDict):
375 class BranchPermOriginDict(PermOriginDict):
376 """
376 """
377 Dedicated branch permissions dict, with tracking of patterns and origins.
377 Dedicated branch permissions dict, with tracking of patterns and origins.
378
378
379 >>> perms = BranchPermOriginDict()
379 >>> perms = BranchPermOriginDict()
380 >>> perms['resource'] = '*pattern', 'read', 'default'
380 >>> perms['resource'] = '*pattern', 'read', 'default'
381 >>> perms['resource']
381 >>> perms['resource']
382 {'*pattern': 'read'}
382 {'*pattern': 'read'}
383 >>> perms['resource'] = '*pattern', 'write', 'admin'
383 >>> perms['resource'] = '*pattern', 'write', 'admin'
384 >>> perms['resource']
384 >>> perms['resource']
385 {'*pattern': 'write'}
385 {'*pattern': 'write'}
386 >>> perms.perm_origin_stack
386 >>> perms.perm_origin_stack
387 {'resource': {'*pattern': [('read', 'default'), ('write', 'admin')]}}
387 {'resource': {'*pattern': [('read', 'default'), ('write', 'admin')]}}
388 """
388 """
389 def __setitem__(self, key, (pattern, perm, origin)):
389 def __setitem__(self, key, (pattern, perm, origin)):
390
390
391 self.perm_origin_stack.setdefault(key, {}) \
391 self.perm_origin_stack.setdefault(key, {}) \
392 .setdefault(pattern, []).append((perm, origin))
392 .setdefault(pattern, []).append((perm, origin))
393
393
394 if key in self:
394 if key in self:
395 self[key].__setitem__(pattern, perm)
395 self[key].__setitem__(pattern, perm)
396 else:
396 else:
397 patterns = collections.OrderedDict()
397 patterns = collections.OrderedDict()
398 patterns[pattern] = perm
398 patterns[pattern] = perm
399 dict.__setitem__(self, key, patterns)
399 dict.__setitem__(self, key, patterns)
400
400
401
401
402 class PermissionCalculator(object):
402 class PermissionCalculator(object):
403
403
404 def __init__(
404 def __init__(
405 self, user_id, scope, user_is_admin,
405 self, user_id, scope, user_is_admin,
406 user_inherit_default_permissions, explicit, algo,
406 user_inherit_default_permissions, explicit, algo,
407 calculate_super_admin_as_user=False):
407 calculate_super_admin_as_user=False):
408
408
409 self.user_id = user_id
409 self.user_id = user_id
410 self.user_is_admin = user_is_admin
410 self.user_is_admin = user_is_admin
411 self.inherit_default_permissions = user_inherit_default_permissions
411 self.inherit_default_permissions = user_inherit_default_permissions
412 self.explicit = explicit
412 self.explicit = explicit
413 self.algo = algo
413 self.algo = algo
414 self.calculate_super_admin_as_user = calculate_super_admin_as_user
414 self.calculate_super_admin_as_user = calculate_super_admin_as_user
415
415
416 scope = scope or {}
416 scope = scope or {}
417 self.scope_repo_id = scope.get('repo_id')
417 self.scope_repo_id = scope.get('repo_id')
418 self.scope_repo_group_id = scope.get('repo_group_id')
418 self.scope_repo_group_id = scope.get('repo_group_id')
419 self.scope_user_group_id = scope.get('user_group_id')
419 self.scope_user_group_id = scope.get('user_group_id')
420
420
421 self.default_user_id = User.get_default_user(cache=True).user_id
421 self.default_user_id = User.get_default_user(cache=True).user_id
422
422
423 self.permissions_repositories = PermOriginDict()
423 self.permissions_repositories = PermOriginDict()
424 self.permissions_repository_groups = PermOriginDict()
424 self.permissions_repository_groups = PermOriginDict()
425 self.permissions_user_groups = PermOriginDict()
425 self.permissions_user_groups = PermOriginDict()
426 self.permissions_repository_branches = BranchPermOriginDict()
426 self.permissions_repository_branches = BranchPermOriginDict()
427 self.permissions_global = set()
427 self.permissions_global = set()
428
428
429 self.default_repo_perms = Permission.get_default_repo_perms(
429 self.default_repo_perms = Permission.get_default_repo_perms(
430 self.default_user_id, self.scope_repo_id)
430 self.default_user_id, self.scope_repo_id)
431 self.default_repo_groups_perms = Permission.get_default_group_perms(
431 self.default_repo_groups_perms = Permission.get_default_group_perms(
432 self.default_user_id, self.scope_repo_group_id)
432 self.default_user_id, self.scope_repo_group_id)
433 self.default_user_group_perms = \
433 self.default_user_group_perms = \
434 Permission.get_default_user_group_perms(
434 Permission.get_default_user_group_perms(
435 self.default_user_id, self.scope_user_group_id)
435 self.default_user_id, self.scope_user_group_id)
436
436
437 # default branch perms
437 # default branch perms
438 self.default_branch_repo_perms = \
438 self.default_branch_repo_perms = \
439 Permission.get_default_repo_branch_perms(
439 Permission.get_default_repo_branch_perms(
440 self.default_user_id, self.scope_repo_id)
440 self.default_user_id, self.scope_repo_id)
441
441
442 def calculate(self):
442 def calculate(self):
443 if self.user_is_admin and not self.calculate_super_admin_as_user:
443 if self.user_is_admin and not self.calculate_super_admin_as_user:
444 return self._calculate_admin_permissions()
444 return self._calculate_admin_permissions()
445
445
446 self._calculate_global_default_permissions()
446 self._calculate_global_default_permissions()
447 self._calculate_global_permissions()
447 self._calculate_global_permissions()
448 self._calculate_default_permissions()
448 self._calculate_default_permissions()
449 self._calculate_repository_permissions()
449 self._calculate_repository_permissions()
450 self._calculate_repository_branch_permissions()
450 self._calculate_repository_branch_permissions()
451 self._calculate_repository_group_permissions()
451 self._calculate_repository_group_permissions()
452 self._calculate_user_group_permissions()
452 self._calculate_user_group_permissions()
453 return self._permission_structure()
453 return self._permission_structure()
454
454
455 def _calculate_admin_permissions(self):
455 def _calculate_admin_permissions(self):
456 """
456 """
457 admin user have all default rights for repositories
457 admin user have all default rights for repositories
458 and groups set to admin
458 and groups set to admin
459 """
459 """
460 self.permissions_global.add('hg.admin')
460 self.permissions_global.add('hg.admin')
461 self.permissions_global.add('hg.create.write_on_repogroup.true')
461 self.permissions_global.add('hg.create.write_on_repogroup.true')
462
462
463 # repositories
463 # repositories
464 for perm in self.default_repo_perms:
464 for perm in self.default_repo_perms:
465 r_k = perm.UserRepoToPerm.repository.repo_name
465 r_k = perm.UserRepoToPerm.repository.repo_name
466 obj_id = perm.UserRepoToPerm.repository.repo_id
466 obj_id = perm.UserRepoToPerm.repository.repo_id
467 archived = perm.UserRepoToPerm.repository.archived
467 archived = perm.UserRepoToPerm.repository.archived
468 p = 'repository.admin'
468 p = 'repository.admin'
469 self.permissions_repositories[r_k] = p, PermOrigin.SUPER_ADMIN, obj_id
469 self.permissions_repositories[r_k] = p, PermOrigin.SUPER_ADMIN, obj_id
470 # special case for archived repositories, which we block still even for
470 # special case for archived repositories, which we block still even for
471 # super admins
471 # super admins
472 if archived:
472 if archived:
473 p = 'repository.read'
473 p = 'repository.read'
474 self.permissions_repositories[r_k] = p, PermOrigin.ARCHIVED, obj_id
474 self.permissions_repositories[r_k] = p, PermOrigin.ARCHIVED, obj_id
475
475
476 # repository groups
476 # repository groups
477 for perm in self.default_repo_groups_perms:
477 for perm in self.default_repo_groups_perms:
478 rg_k = perm.UserRepoGroupToPerm.group.group_name
478 rg_k = perm.UserRepoGroupToPerm.group.group_name
479 obj_id = perm.UserRepoGroupToPerm.group.group_id
479 obj_id = perm.UserRepoGroupToPerm.group.group_id
480 p = 'group.admin'
480 p = 'group.admin'
481 self.permissions_repository_groups[rg_k] = p, PermOrigin.SUPER_ADMIN, obj_id
481 self.permissions_repository_groups[rg_k] = p, PermOrigin.SUPER_ADMIN, obj_id
482
482
483 # user groups
483 # user groups
484 for perm in self.default_user_group_perms:
484 for perm in self.default_user_group_perms:
485 u_k = perm.UserUserGroupToPerm.user_group.users_group_name
485 u_k = perm.UserUserGroupToPerm.user_group.users_group_name
486 obj_id = perm.UserUserGroupToPerm.user_group.users_group_id
486 obj_id = perm.UserUserGroupToPerm.user_group.users_group_id
487 p = 'usergroup.admin'
487 p = 'usergroup.admin'
488 self.permissions_user_groups[u_k] = p, PermOrigin.SUPER_ADMIN, obj_id
488 self.permissions_user_groups[u_k] = p, PermOrigin.SUPER_ADMIN, obj_id
489
489
490 # branch permissions
490 # branch permissions
491 # since super-admin also can have custom rule permissions
491 # since super-admin also can have custom rule permissions
492 # we *always* need to calculate those inherited from default, and also explicit
492 # we *always* need to calculate those inherited from default, and also explicit
493 self._calculate_default_permissions_repository_branches(
493 self._calculate_default_permissions_repository_branches(
494 user_inherit_object_permissions=False)
494 user_inherit_object_permissions=False)
495 self._calculate_repository_branch_permissions()
495 self._calculate_repository_branch_permissions()
496
496
497 return self._permission_structure()
497 return self._permission_structure()
498
498
499 def _calculate_global_default_permissions(self):
499 def _calculate_global_default_permissions(self):
500 """
500 """
501 global permissions taken from the default user
501 global permissions taken from the default user
502 """
502 """
503 default_global_perms = UserToPerm.query()\
503 default_global_perms = UserToPerm.query()\
504 .filter(UserToPerm.user_id == self.default_user_id)\
504 .filter(UserToPerm.user_id == self.default_user_id)\
505 .options(joinedload(UserToPerm.permission))
505 .options(joinedload(UserToPerm.permission))
506
506
507 for perm in default_global_perms:
507 for perm in default_global_perms:
508 self.permissions_global.add(perm.permission.permission_name)
508 self.permissions_global.add(perm.permission.permission_name)
509
509
510 if self.user_is_admin:
510 if self.user_is_admin:
511 self.permissions_global.add('hg.admin')
511 self.permissions_global.add('hg.admin')
512 self.permissions_global.add('hg.create.write_on_repogroup.true')
512 self.permissions_global.add('hg.create.write_on_repogroup.true')
513
513
514 def _calculate_global_permissions(self):
514 def _calculate_global_permissions(self):
515 """
515 """
516 Set global system permissions with user permissions or permissions
516 Set global system permissions with user permissions or permissions
517 taken from the user groups of the current user.
517 taken from the user groups of the current user.
518
518
519 The permissions include repo creating, repo group creating, forking
519 The permissions include repo creating, repo group creating, forking
520 etc.
520 etc.
521 """
521 """
522
522
523 # now we read the defined permissions and overwrite what we have set
523 # now we read the defined permissions and overwrite what we have set
524 # before those can be configured from groups or users explicitly.
524 # before those can be configured from groups or users explicitly.
525
525
526 # In case we want to extend this list we should make sure
526 # In case we want to extend this list we should make sure
527 # this is in sync with User.DEFAULT_USER_PERMISSIONS definitions
527 # this is in sync with User.DEFAULT_USER_PERMISSIONS definitions
528 _configurable = frozenset([
528 _configurable = frozenset([
529 'hg.fork.none', 'hg.fork.repository',
529 'hg.fork.none', 'hg.fork.repository',
530 'hg.create.none', 'hg.create.repository',
530 'hg.create.none', 'hg.create.repository',
531 'hg.usergroup.create.false', 'hg.usergroup.create.true',
531 'hg.usergroup.create.false', 'hg.usergroup.create.true',
532 'hg.repogroup.create.false', 'hg.repogroup.create.true',
532 'hg.repogroup.create.false', 'hg.repogroup.create.true',
533 'hg.create.write_on_repogroup.false', 'hg.create.write_on_repogroup.true',
533 'hg.create.write_on_repogroup.false', 'hg.create.write_on_repogroup.true',
534 'hg.inherit_default_perms.false', 'hg.inherit_default_perms.true'
534 'hg.inherit_default_perms.false', 'hg.inherit_default_perms.true'
535 ])
535 ])
536
536
537 # USER GROUPS comes first user group global permissions
537 # USER GROUPS comes first user group global permissions
538 user_perms_from_users_groups = Session().query(UserGroupToPerm)\
538 user_perms_from_users_groups = Session().query(UserGroupToPerm)\
539 .options(joinedload(UserGroupToPerm.permission))\
539 .options(joinedload(UserGroupToPerm.permission))\
540 .join((UserGroupMember, UserGroupToPerm.users_group_id ==
540 .join((UserGroupMember, UserGroupToPerm.users_group_id ==
541 UserGroupMember.users_group_id))\
541 UserGroupMember.users_group_id))\
542 .filter(UserGroupMember.user_id == self.user_id)\
542 .filter(UserGroupMember.user_id == self.user_id)\
543 .order_by(UserGroupToPerm.users_group_id)\
543 .order_by(UserGroupToPerm.users_group_id)\
544 .all()
544 .all()
545
545
546 # need to group here by groups since user can be in more than
546 # need to group here by groups since user can be in more than
547 # one group, so we get all groups
547 # one group, so we get all groups
548 _explicit_grouped_perms = [
548 _explicit_grouped_perms = [
549 [x, list(y)] for x, y in
549 [x, list(y)] for x, y in
550 itertools.groupby(user_perms_from_users_groups,
550 itertools.groupby(user_perms_from_users_groups,
551 lambda _x: _x.users_group)]
551 lambda _x: _x.users_group)]
552
552
553 for gr, perms in _explicit_grouped_perms:
553 for gr, perms in _explicit_grouped_perms:
554 # since user can be in multiple groups iterate over them and
554 # since user can be in multiple groups iterate over them and
555 # select the lowest permissions first (more explicit)
555 # select the lowest permissions first (more explicit)
556 # TODO(marcink): do this^^
556 # TODO(marcink): do this^^
557
557
558 # group doesn't inherit default permissions so we actually set them
558 # group doesn't inherit default permissions so we actually set them
559 if not gr.inherit_default_permissions:
559 if not gr.inherit_default_permissions:
560 # NEED TO IGNORE all previously set configurable permissions
560 # NEED TO IGNORE all previously set configurable permissions
561 # and replace them with explicitly set from this user
561 # and replace them with explicitly set from this user
562 # group permissions
562 # group permissions
563 self.permissions_global = self.permissions_global.difference(
563 self.permissions_global = self.permissions_global.difference(
564 _configurable)
564 _configurable)
565 for perm in perms:
565 for perm in perms:
566 self.permissions_global.add(perm.permission.permission_name)
566 self.permissions_global.add(perm.permission.permission_name)
567
567
568 # user explicit global permissions
568 # user explicit global permissions
569 user_perms = Session().query(UserToPerm)\
569 user_perms = Session().query(UserToPerm)\
570 .options(joinedload(UserToPerm.permission))\
570 .options(joinedload(UserToPerm.permission))\
571 .filter(UserToPerm.user_id == self.user_id).all()
571 .filter(UserToPerm.user_id == self.user_id).all()
572
572
573 if not self.inherit_default_permissions:
573 if not self.inherit_default_permissions:
574 # NEED TO IGNORE all configurable permissions and
574 # NEED TO IGNORE all configurable permissions and
575 # replace them with explicitly set from this user permissions
575 # replace them with explicitly set from this user permissions
576 self.permissions_global = self.permissions_global.difference(
576 self.permissions_global = self.permissions_global.difference(
577 _configurable)
577 _configurable)
578 for perm in user_perms:
578 for perm in user_perms:
579 self.permissions_global.add(perm.permission.permission_name)
579 self.permissions_global.add(perm.permission.permission_name)
580
580
581 def _calculate_default_permissions_repositories(self, user_inherit_object_permissions):
581 def _calculate_default_permissions_repositories(self, user_inherit_object_permissions):
582 for perm in self.default_repo_perms:
582 for perm in self.default_repo_perms:
583 r_k = perm.UserRepoToPerm.repository.repo_name
583 r_k = perm.UserRepoToPerm.repository.repo_name
584 obj_id = perm.UserRepoToPerm.repository.repo_id
584 obj_id = perm.UserRepoToPerm.repository.repo_id
585 archived = perm.UserRepoToPerm.repository.archived
585 archived = perm.UserRepoToPerm.repository.archived
586 p = perm.Permission.permission_name
586 p = perm.Permission.permission_name
587 o = PermOrigin.REPO_DEFAULT
587 o = PermOrigin.REPO_DEFAULT
588 self.permissions_repositories[r_k] = p, o, obj_id
588 self.permissions_repositories[r_k] = p, o, obj_id
589
589
590 # if we decide this user isn't inheriting permissions from
590 # if we decide this user isn't inheriting permissions from
591 # default user we set him to .none so only explicit
591 # default user we set him to .none so only explicit
592 # permissions work
592 # permissions work
593 if not user_inherit_object_permissions:
593 if not user_inherit_object_permissions:
594 p = 'repository.none'
594 p = 'repository.none'
595 o = PermOrigin.REPO_DEFAULT_NO_INHERIT
595 o = PermOrigin.REPO_DEFAULT_NO_INHERIT
596 self.permissions_repositories[r_k] = p, o, obj_id
596 self.permissions_repositories[r_k] = p, o, obj_id
597
597
598 if perm.Repository.private and not (
598 if perm.Repository.private and not (
599 perm.Repository.user_id == self.user_id):
599 perm.Repository.user_id == self.user_id):
600 # disable defaults for private repos,
600 # disable defaults for private repos,
601 p = 'repository.none'
601 p = 'repository.none'
602 o = PermOrigin.REPO_PRIVATE
602 o = PermOrigin.REPO_PRIVATE
603 self.permissions_repositories[r_k] = p, o, obj_id
603 self.permissions_repositories[r_k] = p, o, obj_id
604
604
605 elif perm.Repository.user_id == self.user_id:
605 elif perm.Repository.user_id == self.user_id:
606 # set admin if owner
606 # set admin if owner
607 p = 'repository.admin'
607 p = 'repository.admin'
608 o = PermOrigin.REPO_OWNER
608 o = PermOrigin.REPO_OWNER
609 self.permissions_repositories[r_k] = p, o, obj_id
609 self.permissions_repositories[r_k] = p, o, obj_id
610
610
611 if self.user_is_admin:
611 if self.user_is_admin:
612 p = 'repository.admin'
612 p = 'repository.admin'
613 o = PermOrigin.SUPER_ADMIN
613 o = PermOrigin.SUPER_ADMIN
614 self.permissions_repositories[r_k] = p, o, obj_id
614 self.permissions_repositories[r_k] = p, o, obj_id
615
615
616 # finally in case of archived repositories, we downgrade higher
616 # finally in case of archived repositories, we downgrade higher
617 # permissions to read
617 # permissions to read
618 if archived:
618 if archived:
619 current_perm = self.permissions_repositories[r_k]
619 current_perm = self.permissions_repositories[r_k]
620 if current_perm in ['repository.write', 'repository.admin']:
620 if current_perm in ['repository.write', 'repository.admin']:
621 p = 'repository.read'
621 p = 'repository.read'
622 o = PermOrigin.ARCHIVED
622 o = PermOrigin.ARCHIVED
623 self.permissions_repositories[r_k] = p, o, obj_id
623 self.permissions_repositories[r_k] = p, o, obj_id
624
624
625 def _calculate_default_permissions_repository_branches(self, user_inherit_object_permissions):
625 def _calculate_default_permissions_repository_branches(self, user_inherit_object_permissions):
626 for perm in self.default_branch_repo_perms:
626 for perm in self.default_branch_repo_perms:
627
627
628 r_k = perm.UserRepoToPerm.repository.repo_name
628 r_k = perm.UserRepoToPerm.repository.repo_name
629 p = perm.Permission.permission_name
629 p = perm.Permission.permission_name
630 pattern = perm.UserToRepoBranchPermission.branch_pattern
630 pattern = perm.UserToRepoBranchPermission.branch_pattern
631 o = PermOrigin.REPO_USER % perm.UserRepoToPerm.user.username
631 o = PermOrigin.REPO_USER % perm.UserRepoToPerm.user.username
632
632
633 if not self.explicit:
633 if not self.explicit:
634 cur_perm = self.permissions_repository_branches.get(r_k)
634 cur_perm = self.permissions_repository_branches.get(r_k)
635 if cur_perm:
635 if cur_perm:
636 cur_perm = cur_perm[pattern]
636 cur_perm = cur_perm[pattern]
637 cur_perm = cur_perm or 'branch.none'
637 cur_perm = cur_perm or 'branch.none'
638
638
639 p = self._choose_permission(p, cur_perm)
639 p = self._choose_permission(p, cur_perm)
640
640
641 # NOTE(marcink): register all pattern/perm instances in this
641 # NOTE(marcink): register all pattern/perm instances in this
642 # special dict that aggregates entries
642 # special dict that aggregates entries
643 self.permissions_repository_branches[r_k] = pattern, p, o
643 self.permissions_repository_branches[r_k] = pattern, p, o
644
644
645 def _calculate_default_permissions_repository_groups(self, user_inherit_object_permissions):
645 def _calculate_default_permissions_repository_groups(self, user_inherit_object_permissions):
646 for perm in self.default_repo_groups_perms:
646 for perm in self.default_repo_groups_perms:
647 rg_k = perm.UserRepoGroupToPerm.group.group_name
647 rg_k = perm.UserRepoGroupToPerm.group.group_name
648 obj_id = perm.UserRepoGroupToPerm.group.group_id
648 obj_id = perm.UserRepoGroupToPerm.group.group_id
649 p = perm.Permission.permission_name
649 p = perm.Permission.permission_name
650 o = PermOrigin.REPOGROUP_DEFAULT
650 o = PermOrigin.REPOGROUP_DEFAULT
651 self.permissions_repository_groups[rg_k] = p, o, obj_id
651 self.permissions_repository_groups[rg_k] = p, o, obj_id
652
652
653 # if we decide this user isn't inheriting permissions from default
653 # if we decide this user isn't inheriting permissions from default
654 # user we set him to .none so only explicit permissions work
654 # user we set him to .none so only explicit permissions work
655 if not user_inherit_object_permissions:
655 if not user_inherit_object_permissions:
656 p = 'group.none'
656 p = 'group.none'
657 o = PermOrigin.REPOGROUP_DEFAULT_NO_INHERIT
657 o = PermOrigin.REPOGROUP_DEFAULT_NO_INHERIT
658 self.permissions_repository_groups[rg_k] = p, o, obj_id
658 self.permissions_repository_groups[rg_k] = p, o, obj_id
659
659
660 if perm.RepoGroup.user_id == self.user_id:
660 if perm.RepoGroup.user_id == self.user_id:
661 # set admin if owner
661 # set admin if owner
662 p = 'group.admin'
662 p = 'group.admin'
663 o = PermOrigin.REPOGROUP_OWNER
663 o = PermOrigin.REPOGROUP_OWNER
664 self.permissions_repository_groups[rg_k] = p, o, obj_id
664 self.permissions_repository_groups[rg_k] = p, o, obj_id
665
665
666 if self.user_is_admin:
666 if self.user_is_admin:
667 p = 'group.admin'
667 p = 'group.admin'
668 o = PermOrigin.SUPER_ADMIN
668 o = PermOrigin.SUPER_ADMIN
669 self.permissions_repository_groups[rg_k] = p, o, obj_id
669 self.permissions_repository_groups[rg_k] = p, o, obj_id
670
670
671 def _calculate_default_permissions_user_groups(self, user_inherit_object_permissions):
671 def _calculate_default_permissions_user_groups(self, user_inherit_object_permissions):
672 for perm in self.default_user_group_perms:
672 for perm in self.default_user_group_perms:
673 u_k = perm.UserUserGroupToPerm.user_group.users_group_name
673 u_k = perm.UserUserGroupToPerm.user_group.users_group_name
674 obj_id = perm.UserUserGroupToPerm.user_group.users_group_id
674 obj_id = perm.UserUserGroupToPerm.user_group.users_group_id
675 p = perm.Permission.permission_name
675 p = perm.Permission.permission_name
676 o = PermOrigin.USERGROUP_DEFAULT
676 o = PermOrigin.USERGROUP_DEFAULT
677 self.permissions_user_groups[u_k] = p, o, obj_id
677 self.permissions_user_groups[u_k] = p, o, obj_id
678
678
679 # if we decide this user isn't inheriting permissions from default
679 # if we decide this user isn't inheriting permissions from default
680 # user we set him to .none so only explicit permissions work
680 # user we set him to .none so only explicit permissions work
681 if not user_inherit_object_permissions:
681 if not user_inherit_object_permissions:
682 p = 'usergroup.none'
682 p = 'usergroup.none'
683 o = PermOrigin.USERGROUP_DEFAULT_NO_INHERIT
683 o = PermOrigin.USERGROUP_DEFAULT_NO_INHERIT
684 self.permissions_user_groups[u_k] = p, o, obj_id
684 self.permissions_user_groups[u_k] = p, o, obj_id
685
685
686 if perm.UserGroup.user_id == self.user_id:
686 if perm.UserGroup.user_id == self.user_id:
687 # set admin if owner
687 # set admin if owner
688 p = 'usergroup.admin'
688 p = 'usergroup.admin'
689 o = PermOrigin.USERGROUP_OWNER
689 o = PermOrigin.USERGROUP_OWNER
690 self.permissions_user_groups[u_k] = p, o, obj_id
690 self.permissions_user_groups[u_k] = p, o, obj_id
691
691
692 if self.user_is_admin:
692 if self.user_is_admin:
693 p = 'usergroup.admin'
693 p = 'usergroup.admin'
694 o = PermOrigin.SUPER_ADMIN
694 o = PermOrigin.SUPER_ADMIN
695 self.permissions_user_groups[u_k] = p, o, obj_id
695 self.permissions_user_groups[u_k] = p, o, obj_id
696
696
697 def _calculate_default_permissions(self):
697 def _calculate_default_permissions(self):
698 """
698 """
699 Set default user permissions for repositories, repository branches,
699 Set default user permissions for repositories, repository branches,
700 repository groups, user groups taken from the default user.
700 repository groups, user groups taken from the default user.
701
701
702 Calculate inheritance of object permissions based on what we have now
702 Calculate inheritance of object permissions based on what we have now
703 in GLOBAL permissions. We check if .false is in GLOBAL since this is
703 in GLOBAL permissions. We check if .false is in GLOBAL since this is
704 explicitly set. Inherit is the opposite of .false being there.
704 explicitly set. Inherit is the opposite of .false being there.
705
705
706 .. note::
706 .. note::
707
707
708 the syntax is little bit odd but what we need to check here is
708 the syntax is little bit odd but what we need to check here is
709 the opposite of .false permission being in the list so even for
709 the opposite of .false permission being in the list so even for
710 inconsistent state when both .true/.false is there
710 inconsistent state when both .true/.false is there
711 .false is more important
711 .false is more important
712
712
713 """
713 """
714 user_inherit_object_permissions = not ('hg.inherit_default_perms.false'
714 user_inherit_object_permissions = not ('hg.inherit_default_perms.false'
715 in self.permissions_global)
715 in self.permissions_global)
716
716
717 # default permissions inherited from `default` user permissions
717 # default permissions inherited from `default` user permissions
718 self._calculate_default_permissions_repositories(
718 self._calculate_default_permissions_repositories(
719 user_inherit_object_permissions)
719 user_inherit_object_permissions)
720
720
721 self._calculate_default_permissions_repository_branches(
721 self._calculate_default_permissions_repository_branches(
722 user_inherit_object_permissions)
722 user_inherit_object_permissions)
723
723
724 self._calculate_default_permissions_repository_groups(
724 self._calculate_default_permissions_repository_groups(
725 user_inherit_object_permissions)
725 user_inherit_object_permissions)
726
726
727 self._calculate_default_permissions_user_groups(
727 self._calculate_default_permissions_user_groups(
728 user_inherit_object_permissions)
728 user_inherit_object_permissions)
729
729
730 def _calculate_repository_permissions(self):
730 def _calculate_repository_permissions(self):
731 """
731 """
732 Repository access permissions for the current user.
732 Repository access permissions for the current user.
733
733
734 Check if the user is part of user groups for this repository and
734 Check if the user is part of user groups for this repository and
735 fill in the permission from it. `_choose_permission` decides of which
735 fill in the permission from it. `_choose_permission` decides of which
736 permission should be selected based on selected method.
736 permission should be selected based on selected method.
737 """
737 """
738
738
739 # user group for repositories permissions
739 # user group for repositories permissions
740 user_repo_perms_from_user_group = Permission\
740 user_repo_perms_from_user_group = Permission\
741 .get_default_repo_perms_from_user_group(
741 .get_default_repo_perms_from_user_group(
742 self.user_id, self.scope_repo_id)
742 self.user_id, self.scope_repo_id)
743
743
744 multiple_counter = collections.defaultdict(int)
744 multiple_counter = collections.defaultdict(int)
745 for perm in user_repo_perms_from_user_group:
745 for perm in user_repo_perms_from_user_group:
746 r_k = perm.UserGroupRepoToPerm.repository.repo_name
746 r_k = perm.UserGroupRepoToPerm.repository.repo_name
747 obj_id = perm.UserGroupRepoToPerm.repository.repo_id
747 obj_id = perm.UserGroupRepoToPerm.repository.repo_id
748 multiple_counter[r_k] += 1
748 multiple_counter[r_k] += 1
749 p = perm.Permission.permission_name
749 p = perm.Permission.permission_name
750 o = PermOrigin.REPO_USERGROUP % perm.UserGroupRepoToPerm\
750 o = PermOrigin.REPO_USERGROUP % perm.UserGroupRepoToPerm\
751 .users_group.users_group_name
751 .users_group.users_group_name
752
752
753 if multiple_counter[r_k] > 1:
753 if multiple_counter[r_k] > 1:
754 cur_perm = self.permissions_repositories[r_k]
754 cur_perm = self.permissions_repositories[r_k]
755 p = self._choose_permission(p, cur_perm)
755 p = self._choose_permission(p, cur_perm)
756
756
757 self.permissions_repositories[r_k] = p, o, obj_id
757 self.permissions_repositories[r_k] = p, o, obj_id
758
758
759 if perm.Repository.user_id == self.user_id:
759 if perm.Repository.user_id == self.user_id:
760 # set admin if owner
760 # set admin if owner
761 p = 'repository.admin'
761 p = 'repository.admin'
762 o = PermOrigin.REPO_OWNER
762 o = PermOrigin.REPO_OWNER
763 self.permissions_repositories[r_k] = p, o, obj_id
763 self.permissions_repositories[r_k] = p, o, obj_id
764
764
765 if self.user_is_admin:
765 if self.user_is_admin:
766 p = 'repository.admin'
766 p = 'repository.admin'
767 o = PermOrigin.SUPER_ADMIN
767 o = PermOrigin.SUPER_ADMIN
768 self.permissions_repositories[r_k] = p, o, obj_id
768 self.permissions_repositories[r_k] = p, o, obj_id
769
769
770 # user explicit permissions for repositories, overrides any specified
770 # user explicit permissions for repositories, overrides any specified
771 # by the group permission
771 # by the group permission
772 user_repo_perms = Permission.get_default_repo_perms(
772 user_repo_perms = Permission.get_default_repo_perms(
773 self.user_id, self.scope_repo_id)
773 self.user_id, self.scope_repo_id)
774 for perm in user_repo_perms:
774 for perm in user_repo_perms:
775 r_k = perm.UserRepoToPerm.repository.repo_name
775 r_k = perm.UserRepoToPerm.repository.repo_name
776 obj_id = perm.UserRepoToPerm.repository.repo_id
776 obj_id = perm.UserRepoToPerm.repository.repo_id
777 p = perm.Permission.permission_name
777 p = perm.Permission.permission_name
778 o = PermOrigin.REPO_USER % perm.UserRepoToPerm.user.username
778 o = PermOrigin.REPO_USER % perm.UserRepoToPerm.user.username
779
779
780 if not self.explicit:
780 if not self.explicit:
781 cur_perm = self.permissions_repositories.get(
781 cur_perm = self.permissions_repositories.get(
782 r_k, 'repository.none')
782 r_k, 'repository.none')
783 p = self._choose_permission(p, cur_perm)
783 p = self._choose_permission(p, cur_perm)
784
784
785 self.permissions_repositories[r_k] = p, o, obj_id
785 self.permissions_repositories[r_k] = p, o, obj_id
786
786
787 if perm.Repository.user_id == self.user_id:
787 if perm.Repository.user_id == self.user_id:
788 # set admin if owner
788 # set admin if owner
789 p = 'repository.admin'
789 p = 'repository.admin'
790 o = PermOrigin.REPO_OWNER
790 o = PermOrigin.REPO_OWNER
791 self.permissions_repositories[r_k] = p, o, obj_id
791 self.permissions_repositories[r_k] = p, o, obj_id
792
792
793 if self.user_is_admin:
793 if self.user_is_admin:
794 p = 'repository.admin'
794 p = 'repository.admin'
795 o = PermOrigin.SUPER_ADMIN
795 o = PermOrigin.SUPER_ADMIN
796 self.permissions_repositories[r_k] = p, o, obj_id
796 self.permissions_repositories[r_k] = p, o, obj_id
797
797
798 def _calculate_repository_branch_permissions(self):
798 def _calculate_repository_branch_permissions(self):
799 # user group for repositories permissions
799 # user group for repositories permissions
800 user_repo_branch_perms_from_user_group = Permission\
800 user_repo_branch_perms_from_user_group = Permission\
801 .get_default_repo_branch_perms_from_user_group(
801 .get_default_repo_branch_perms_from_user_group(
802 self.user_id, self.scope_repo_id)
802 self.user_id, self.scope_repo_id)
803
803
804 multiple_counter = collections.defaultdict(int)
804 multiple_counter = collections.defaultdict(int)
805 for perm in user_repo_branch_perms_from_user_group:
805 for perm in user_repo_branch_perms_from_user_group:
806 r_k = perm.UserGroupRepoToPerm.repository.repo_name
806 r_k = perm.UserGroupRepoToPerm.repository.repo_name
807 p = perm.Permission.permission_name
807 p = perm.Permission.permission_name
808 pattern = perm.UserGroupToRepoBranchPermission.branch_pattern
808 pattern = perm.UserGroupToRepoBranchPermission.branch_pattern
809 o = PermOrigin.REPO_USERGROUP % perm.UserGroupRepoToPerm\
809 o = PermOrigin.REPO_USERGROUP % perm.UserGroupRepoToPerm\
810 .users_group.users_group_name
810 .users_group.users_group_name
811
811
812 multiple_counter[r_k] += 1
812 multiple_counter[r_k] += 1
813 if multiple_counter[r_k] > 1:
813 if multiple_counter[r_k] > 1:
814 cur_perm = self.permissions_repository_branches[r_k][pattern]
814 cur_perm = self.permissions_repository_branches[r_k][pattern]
815 p = self._choose_permission(p, cur_perm)
815 p = self._choose_permission(p, cur_perm)
816
816
817 self.permissions_repository_branches[r_k] = pattern, p, o
817 self.permissions_repository_branches[r_k] = pattern, p, o
818
818
819 # user explicit branch permissions for repositories, overrides
819 # user explicit branch permissions for repositories, overrides
820 # any specified by the group permission
820 # any specified by the group permission
821 user_repo_branch_perms = Permission.get_default_repo_branch_perms(
821 user_repo_branch_perms = Permission.get_default_repo_branch_perms(
822 self.user_id, self.scope_repo_id)
822 self.user_id, self.scope_repo_id)
823
823
824 for perm in user_repo_branch_perms:
824 for perm in user_repo_branch_perms:
825
825
826 r_k = perm.UserRepoToPerm.repository.repo_name
826 r_k = perm.UserRepoToPerm.repository.repo_name
827 p = perm.Permission.permission_name
827 p = perm.Permission.permission_name
828 pattern = perm.UserToRepoBranchPermission.branch_pattern
828 pattern = perm.UserToRepoBranchPermission.branch_pattern
829 o = PermOrigin.REPO_USER % perm.UserRepoToPerm.user.username
829 o = PermOrigin.REPO_USER % perm.UserRepoToPerm.user.username
830
830
831 if not self.explicit:
831 if not self.explicit:
832 cur_perm = self.permissions_repository_branches.get(r_k)
832 cur_perm = self.permissions_repository_branches.get(r_k)
833 if cur_perm:
833 if cur_perm:
834 cur_perm = cur_perm[pattern]
834 cur_perm = cur_perm[pattern]
835 cur_perm = cur_perm or 'branch.none'
835 cur_perm = cur_perm or 'branch.none'
836 p = self._choose_permission(p, cur_perm)
836 p = self._choose_permission(p, cur_perm)
837
837
838 # NOTE(marcink): register all pattern/perm instances in this
838 # NOTE(marcink): register all pattern/perm instances in this
839 # special dict that aggregates entries
839 # special dict that aggregates entries
840 self.permissions_repository_branches[r_k] = pattern, p, o
840 self.permissions_repository_branches[r_k] = pattern, p, o
841
841
842 def _calculate_repository_group_permissions(self):
842 def _calculate_repository_group_permissions(self):
843 """
843 """
844 Repository group permissions for the current user.
844 Repository group permissions for the current user.
845
845
846 Check if the user is part of user groups for repository groups and
846 Check if the user is part of user groups for repository groups and
847 fill in the permissions from it. `_choose_permission` decides of which
847 fill in the permissions from it. `_choose_permission` decides of which
848 permission should be selected based on selected method.
848 permission should be selected based on selected method.
849 """
849 """
850 # user group for repo groups permissions
850 # user group for repo groups permissions
851 user_repo_group_perms_from_user_group = Permission\
851 user_repo_group_perms_from_user_group = Permission\
852 .get_default_group_perms_from_user_group(
852 .get_default_group_perms_from_user_group(
853 self.user_id, self.scope_repo_group_id)
853 self.user_id, self.scope_repo_group_id)
854
854
855 multiple_counter = collections.defaultdict(int)
855 multiple_counter = collections.defaultdict(int)
856 for perm in user_repo_group_perms_from_user_group:
856 for perm in user_repo_group_perms_from_user_group:
857 rg_k = perm.UserGroupRepoGroupToPerm.group.group_name
857 rg_k = perm.UserGroupRepoGroupToPerm.group.group_name
858 obj_id = perm.UserGroupRepoGroupToPerm.group.group_id
858 obj_id = perm.UserGroupRepoGroupToPerm.group.group_id
859 multiple_counter[rg_k] += 1
859 multiple_counter[rg_k] += 1
860 o = PermOrigin.REPOGROUP_USERGROUP % perm.UserGroupRepoGroupToPerm\
860 o = PermOrigin.REPOGROUP_USERGROUP % perm.UserGroupRepoGroupToPerm\
861 .users_group.users_group_name
861 .users_group.users_group_name
862 p = perm.Permission.permission_name
862 p = perm.Permission.permission_name
863
863
864 if multiple_counter[rg_k] > 1:
864 if multiple_counter[rg_k] > 1:
865 cur_perm = self.permissions_repository_groups[rg_k]
865 cur_perm = self.permissions_repository_groups[rg_k]
866 p = self._choose_permission(p, cur_perm)
866 p = self._choose_permission(p, cur_perm)
867 self.permissions_repository_groups[rg_k] = p, o, obj_id
867 self.permissions_repository_groups[rg_k] = p, o, obj_id
868
868
869 if perm.RepoGroup.user_id == self.user_id:
869 if perm.RepoGroup.user_id == self.user_id:
870 # set admin if owner, even for member of other user group
870 # set admin if owner, even for member of other user group
871 p = 'group.admin'
871 p = 'group.admin'
872 o = PermOrigin.REPOGROUP_OWNER
872 o = PermOrigin.REPOGROUP_OWNER
873 self.permissions_repository_groups[rg_k] = p, o, obj_id
873 self.permissions_repository_groups[rg_k] = p, o, obj_id
874
874
875 if self.user_is_admin:
875 if self.user_is_admin:
876 p = 'group.admin'
876 p = 'group.admin'
877 o = PermOrigin.SUPER_ADMIN
877 o = PermOrigin.SUPER_ADMIN
878 self.permissions_repository_groups[rg_k] = p, o, obj_id
878 self.permissions_repository_groups[rg_k] = p, o, obj_id
879
879
880 # user explicit permissions for repository groups
880 # user explicit permissions for repository groups
881 user_repo_groups_perms = Permission.get_default_group_perms(
881 user_repo_groups_perms = Permission.get_default_group_perms(
882 self.user_id, self.scope_repo_group_id)
882 self.user_id, self.scope_repo_group_id)
883 for perm in user_repo_groups_perms:
883 for perm in user_repo_groups_perms:
884 rg_k = perm.UserRepoGroupToPerm.group.group_name
884 rg_k = perm.UserRepoGroupToPerm.group.group_name
885 obj_id = perm.UserRepoGroupToPerm.group.group_id
885 obj_id = perm.UserRepoGroupToPerm.group.group_id
886 o = PermOrigin.REPOGROUP_USER % perm.UserRepoGroupToPerm\
886 o = PermOrigin.REPOGROUP_USER % perm.UserRepoGroupToPerm\
887 .user.username
887 .user.username
888 p = perm.Permission.permission_name
888 p = perm.Permission.permission_name
889
889
890 if not self.explicit:
890 if not self.explicit:
891 cur_perm = self.permissions_repository_groups.get(rg_k, 'group.none')
891 cur_perm = self.permissions_repository_groups.get(rg_k, 'group.none')
892 p = self._choose_permission(p, cur_perm)
892 p = self._choose_permission(p, cur_perm)
893
893
894 self.permissions_repository_groups[rg_k] = p, o, obj_id
894 self.permissions_repository_groups[rg_k] = p, o, obj_id
895
895
896 if perm.RepoGroup.user_id == self.user_id:
896 if perm.RepoGroup.user_id == self.user_id:
897 # set admin if owner
897 # set admin if owner
898 p = 'group.admin'
898 p = 'group.admin'
899 o = PermOrigin.REPOGROUP_OWNER
899 o = PermOrigin.REPOGROUP_OWNER
900 self.permissions_repository_groups[rg_k] = p, o, obj_id
900 self.permissions_repository_groups[rg_k] = p, o, obj_id
901
901
902 if self.user_is_admin:
902 if self.user_is_admin:
903 p = 'group.admin'
903 p = 'group.admin'
904 o = PermOrigin.SUPER_ADMIN
904 o = PermOrigin.SUPER_ADMIN
905 self.permissions_repository_groups[rg_k] = p, o, obj_id
905 self.permissions_repository_groups[rg_k] = p, o, obj_id
906
906
907 def _calculate_user_group_permissions(self):
907 def _calculate_user_group_permissions(self):
908 """
908 """
909 User group permissions for the current user.
909 User group permissions for the current user.
910 """
910 """
911 # user group for user group permissions
911 # user group for user group permissions
912 user_group_from_user_group = Permission\
912 user_group_from_user_group = Permission\
913 .get_default_user_group_perms_from_user_group(
913 .get_default_user_group_perms_from_user_group(
914 self.user_id, self.scope_user_group_id)
914 self.user_id, self.scope_user_group_id)
915
915
916 multiple_counter = collections.defaultdict(int)
916 multiple_counter = collections.defaultdict(int)
917 for perm in user_group_from_user_group:
917 for perm in user_group_from_user_group:
918 ug_k = perm.UserGroupUserGroupToPerm.target_user_group.users_group_name
918 ug_k = perm.UserGroupUserGroupToPerm.target_user_group.users_group_name
919 obj_id = perm.UserGroupUserGroupToPerm.target_user_group.users_group_id
919 obj_id = perm.UserGroupUserGroupToPerm.target_user_group.users_group_id
920 multiple_counter[ug_k] += 1
920 multiple_counter[ug_k] += 1
921 o = PermOrigin.USERGROUP_USERGROUP % perm.UserGroupUserGroupToPerm\
921 o = PermOrigin.USERGROUP_USERGROUP % perm.UserGroupUserGroupToPerm\
922 .user_group.users_group_name
922 .user_group.users_group_name
923 p = perm.Permission.permission_name
923 p = perm.Permission.permission_name
924
924
925 if multiple_counter[ug_k] > 1:
925 if multiple_counter[ug_k] > 1:
926 cur_perm = self.permissions_user_groups[ug_k]
926 cur_perm = self.permissions_user_groups[ug_k]
927 p = self._choose_permission(p, cur_perm)
927 p = self._choose_permission(p, cur_perm)
928
928
929 self.permissions_user_groups[ug_k] = p, o, obj_id
929 self.permissions_user_groups[ug_k] = p, o, obj_id
930
930
931 if perm.UserGroup.user_id == self.user_id:
931 if perm.UserGroup.user_id == self.user_id:
932 # set admin if owner, even for member of other user group
932 # set admin if owner, even for member of other user group
933 p = 'usergroup.admin'
933 p = 'usergroup.admin'
934 o = PermOrigin.USERGROUP_OWNER
934 o = PermOrigin.USERGROUP_OWNER
935 self.permissions_user_groups[ug_k] = p, o, obj_id
935 self.permissions_user_groups[ug_k] = p, o, obj_id
936
936
937 if self.user_is_admin:
937 if self.user_is_admin:
938 p = 'usergroup.admin'
938 p = 'usergroup.admin'
939 o = PermOrigin.SUPER_ADMIN
939 o = PermOrigin.SUPER_ADMIN
940 self.permissions_user_groups[ug_k] = p, o, obj_id
940 self.permissions_user_groups[ug_k] = p, o, obj_id
941
941
942 # user explicit permission for user groups
942 # user explicit permission for user groups
943 user_user_groups_perms = Permission.get_default_user_group_perms(
943 user_user_groups_perms = Permission.get_default_user_group_perms(
944 self.user_id, self.scope_user_group_id)
944 self.user_id, self.scope_user_group_id)
945 for perm in user_user_groups_perms:
945 for perm in user_user_groups_perms:
946 ug_k = perm.UserUserGroupToPerm.user_group.users_group_name
946 ug_k = perm.UserUserGroupToPerm.user_group.users_group_name
947 obj_id = perm.UserUserGroupToPerm.user_group.users_group_id
947 obj_id = perm.UserUserGroupToPerm.user_group.users_group_id
948 o = PermOrigin.USERGROUP_USER % perm.UserUserGroupToPerm\
948 o = PermOrigin.USERGROUP_USER % perm.UserUserGroupToPerm\
949 .user.username
949 .user.username
950 p = perm.Permission.permission_name
950 p = perm.Permission.permission_name
951
951
952 if not self.explicit:
952 if not self.explicit:
953 cur_perm = self.permissions_user_groups.get(ug_k, 'usergroup.none')
953 cur_perm = self.permissions_user_groups.get(ug_k, 'usergroup.none')
954 p = self._choose_permission(p, cur_perm)
954 p = self._choose_permission(p, cur_perm)
955
955
956 self.permissions_user_groups[ug_k] = p, o, obj_id
956 self.permissions_user_groups[ug_k] = p, o, obj_id
957
957
958 if perm.UserGroup.user_id == self.user_id:
958 if perm.UserGroup.user_id == self.user_id:
959 # set admin if owner
959 # set admin if owner
960 p = 'usergroup.admin'
960 p = 'usergroup.admin'
961 o = PermOrigin.USERGROUP_OWNER
961 o = PermOrigin.USERGROUP_OWNER
962 self.permissions_user_groups[ug_k] = p, o, obj_id
962 self.permissions_user_groups[ug_k] = p, o, obj_id
963
963
964 if self.user_is_admin:
964 if self.user_is_admin:
965 p = 'usergroup.admin'
965 p = 'usergroup.admin'
966 o = PermOrigin.SUPER_ADMIN
966 o = PermOrigin.SUPER_ADMIN
967 self.permissions_user_groups[ug_k] = p, o, obj_id
967 self.permissions_user_groups[ug_k] = p, o, obj_id
968
968
969 def _choose_permission(self, new_perm, cur_perm):
969 def _choose_permission(self, new_perm, cur_perm):
970 new_perm_val = Permission.PERM_WEIGHTS[new_perm]
970 new_perm_val = Permission.PERM_WEIGHTS[new_perm]
971 cur_perm_val = Permission.PERM_WEIGHTS[cur_perm]
971 cur_perm_val = Permission.PERM_WEIGHTS[cur_perm]
972 if self.algo == 'higherwin':
972 if self.algo == 'higherwin':
973 if new_perm_val > cur_perm_val:
973 if new_perm_val > cur_perm_val:
974 return new_perm
974 return new_perm
975 return cur_perm
975 return cur_perm
976 elif self.algo == 'lowerwin':
976 elif self.algo == 'lowerwin':
977 if new_perm_val < cur_perm_val:
977 if new_perm_val < cur_perm_val:
978 return new_perm
978 return new_perm
979 return cur_perm
979 return cur_perm
980
980
981 def _permission_structure(self):
981 def _permission_structure(self):
982 return {
982 return {
983 'global': self.permissions_global,
983 'global': self.permissions_global,
984 'repositories': self.permissions_repositories,
984 'repositories': self.permissions_repositories,
985 'repository_branches': self.permissions_repository_branches,
985 'repository_branches': self.permissions_repository_branches,
986 'repositories_groups': self.permissions_repository_groups,
986 'repositories_groups': self.permissions_repository_groups,
987 'user_groups': self.permissions_user_groups,
987 'user_groups': self.permissions_user_groups,
988 }
988 }
989
989
990
990
991 def allowed_auth_token_access(view_name, auth_token, whitelist=None):
991 def allowed_auth_token_access(view_name, auth_token, whitelist=None):
992 """
992 """
993 Check if given controller_name is in whitelist of auth token access
993 Check if given controller_name is in whitelist of auth token access
994 """
994 """
995 if not whitelist:
995 if not whitelist:
996 from rhodecode import CONFIG
996 from rhodecode import CONFIG
997 whitelist = aslist(
997 whitelist = aslist(
998 CONFIG.get('api_access_controllers_whitelist'), sep=',')
998 CONFIG.get('api_access_controllers_whitelist'), sep=',')
999 # backward compat translation
999 # backward compat translation
1000 compat = {
1000 compat = {
1001 # old controller, new VIEW
1001 # old controller, new VIEW
1002 'ChangesetController:*': 'RepoCommitsView:*',
1002 'ChangesetController:*': 'RepoCommitsView:*',
1003 'ChangesetController:changeset_patch': 'RepoCommitsView:repo_commit_patch',
1003 'ChangesetController:changeset_patch': 'RepoCommitsView:repo_commit_patch',
1004 'ChangesetController:changeset_raw': 'RepoCommitsView:repo_commit_raw',
1004 'ChangesetController:changeset_raw': 'RepoCommitsView:repo_commit_raw',
1005 'FilesController:raw': 'RepoCommitsView:repo_commit_raw',
1005 'FilesController:raw': 'RepoCommitsView:repo_commit_raw',
1006 'FilesController:archivefile': 'RepoFilesView:repo_archivefile',
1006 'FilesController:archivefile': 'RepoFilesView:repo_archivefile',
1007 'GistsController:*': 'GistView:*',
1007 'GistsController:*': 'GistView:*',
1008 }
1008 }
1009
1009
1010 log.debug(
1010 log.debug(
1011 'Allowed views for AUTH TOKEN access: %s', whitelist)
1011 'Allowed views for AUTH TOKEN access: %s', whitelist)
1012 auth_token_access_valid = False
1012 auth_token_access_valid = False
1013
1013
1014 for entry in whitelist:
1014 for entry in whitelist:
1015 token_match = True
1015 token_match = True
1016 if entry in compat:
1016 if entry in compat:
1017 # translate from old Controllers to Pyramid Views
1017 # translate from old Controllers to Pyramid Views
1018 entry = compat[entry]
1018 entry = compat[entry]
1019
1019
1020 if '@' in entry:
1020 if '@' in entry:
1021 # specific AuthToken
1021 # specific AuthToken
1022 entry, allowed_token = entry.split('@', 1)
1022 entry, allowed_token = entry.split('@', 1)
1023 token_match = auth_token == allowed_token
1023 token_match = auth_token == allowed_token
1024
1024
1025 if fnmatch.fnmatch(view_name, entry) and token_match:
1025 if fnmatch.fnmatch(view_name, entry) and token_match:
1026 auth_token_access_valid = True
1026 auth_token_access_valid = True
1027 break
1027 break
1028
1028
1029 if auth_token_access_valid:
1029 if auth_token_access_valid:
1030 log.debug('view: `%s` matches entry in whitelist: %s',
1030 log.debug('view: `%s` matches entry in whitelist: %s',
1031 view_name, whitelist)
1031 view_name, whitelist)
1032
1032
1033 else:
1033 else:
1034 msg = ('view: `%s` does *NOT* match any entry in whitelist: %s'
1034 msg = ('view: `%s` does *NOT* match any entry in whitelist: %s'
1035 % (view_name, whitelist))
1035 % (view_name, whitelist))
1036 if auth_token:
1036 if auth_token:
1037 # if we use auth token key and don't have access it's a warning
1037 # if we use auth token key and don't have access it's a warning
1038 log.warning(msg)
1038 log.warning(msg)
1039 else:
1039 else:
1040 log.debug(msg)
1040 log.debug(msg)
1041
1041
1042 return auth_token_access_valid
1042 return auth_token_access_valid
1043
1043
1044
1044
1045 class AuthUser(object):
1045 class AuthUser(object):
1046 """
1046 """
1047 A simple object that handles all attributes of user in RhodeCode
1047 A simple object that handles all attributes of user in RhodeCode
1048
1048
1049 It does lookup based on API key,given user, or user present in session
1049 It does lookup based on API key,given user, or user present in session
1050 Then it fills all required information for such user. It also checks if
1050 Then it fills all required information for such user. It also checks if
1051 anonymous access is enabled and if so, it returns default user as logged in
1051 anonymous access is enabled and if so, it returns default user as logged in
1052 """
1052 """
1053 GLOBAL_PERMS = [x[0] for x in Permission.PERMS]
1053 GLOBAL_PERMS = [x[0] for x in Permission.PERMS]
1054 repo_read_perms = ['repository.read', 'repository.admin', 'repository.write']
1054 repo_read_perms = ['repository.read', 'repository.admin', 'repository.write']
1055 repo_group_read_perms = ['group.read', 'group.write', 'group.admin']
1055 repo_group_read_perms = ['group.read', 'group.write', 'group.admin']
1056 user_group_read_perms = ['usergroup.read', 'usergroup.write', 'usergroup.admin']
1056 user_group_read_perms = ['usergroup.read', 'usergroup.write', 'usergroup.admin']
1057
1057
1058 def __init__(self, user_id=None, api_key=None, username=None, ip_addr=None):
1058 def __init__(self, user_id=None, api_key=None, username=None, ip_addr=None):
1059
1059
1060 self.user_id = user_id
1060 self.user_id = user_id
1061 self._api_key = api_key
1061 self._api_key = api_key
1062
1062
1063 self.api_key = None
1063 self.api_key = None
1064 self.username = username
1064 self.username = username
1065 self.ip_addr = ip_addr
1065 self.ip_addr = ip_addr
1066 self.name = ''
1066 self.name = ''
1067 self.lastname = ''
1067 self.lastname = ''
1068 self.first_name = ''
1068 self.first_name = ''
1069 self.last_name = ''
1069 self.last_name = ''
1070 self.email = ''
1070 self.email = ''
1071 self.is_authenticated = False
1071 self.is_authenticated = False
1072 self.admin = False
1072 self.admin = False
1073 self.inherit_default_permissions = False
1073 self.inherit_default_permissions = False
1074 self.password = ''
1074 self.password = ''
1075
1075
1076 self.anonymous_user = None # propagated on propagate_data
1076 self.anonymous_user = None # propagated on propagate_data
1077 self.propagate_data()
1077 self.propagate_data()
1078 self._instance = None
1078 self._instance = None
1079 self._permissions_scoped_cache = {} # used to bind scoped calculation
1079 self._permissions_scoped_cache = {} # used to bind scoped calculation
1080
1080
1081 @LazyProperty
1081 @LazyProperty
1082 def permissions(self):
1082 def permissions(self):
1083 return self.get_perms(user=self, cache=None)
1083 return self.get_perms(user=self, cache=None)
1084
1084
1085 @LazyProperty
1085 @LazyProperty
1086 def permissions_safe(self):
1086 def permissions_safe(self):
1087 """
1087 """
1088 Filtered permissions excluding not allowed repositories
1088 Filtered permissions excluding not allowed repositories
1089 """
1089 """
1090 perms = self.get_perms(user=self, cache=None)
1090 perms = self.get_perms(user=self, cache=None)
1091
1091
1092 perms['repositories'] = {
1092 perms['repositories'] = {
1093 k: v for k, v in perms['repositories'].items()
1093 k: v for k, v in perms['repositories'].items()
1094 if v != 'repository.none'}
1094 if v != 'repository.none'}
1095 perms['repositories_groups'] = {
1095 perms['repositories_groups'] = {
1096 k: v for k, v in perms['repositories_groups'].items()
1096 k: v for k, v in perms['repositories_groups'].items()
1097 if v != 'group.none'}
1097 if v != 'group.none'}
1098 perms['user_groups'] = {
1098 perms['user_groups'] = {
1099 k: v for k, v in perms['user_groups'].items()
1099 k: v for k, v in perms['user_groups'].items()
1100 if v != 'usergroup.none'}
1100 if v != 'usergroup.none'}
1101 perms['repository_branches'] = {
1101 perms['repository_branches'] = {
1102 k: v for k, v in perms['repository_branches'].iteritems()
1102 k: v for k, v in perms['repository_branches'].iteritems()
1103 if v != 'branch.none'}
1103 if v != 'branch.none'}
1104 return perms
1104 return perms
1105
1105
1106 @LazyProperty
1106 @LazyProperty
1107 def permissions_full_details(self):
1107 def permissions_full_details(self):
1108 return self.get_perms(
1108 return self.get_perms(
1109 user=self, cache=None, calculate_super_admin=True)
1109 user=self, cache=None, calculate_super_admin=True)
1110
1110
1111 def permissions_with_scope(self, scope):
1111 def permissions_with_scope(self, scope):
1112 """
1112 """
1113 Call the get_perms function with scoped data. The scope in that function
1113 Call the get_perms function with scoped data. The scope in that function
1114 narrows the SQL calls to the given ID of objects resulting in fetching
1114 narrows the SQL calls to the given ID of objects resulting in fetching
1115 Just particular permission we want to obtain. If scope is an empty dict
1115 Just particular permission we want to obtain. If scope is an empty dict
1116 then it basically narrows the scope to GLOBAL permissions only.
1116 then it basically narrows the scope to GLOBAL permissions only.
1117
1117
1118 :param scope: dict
1118 :param scope: dict
1119 """
1119 """
1120 if 'repo_name' in scope:
1120 if 'repo_name' in scope:
1121 obj = Repository.get_by_repo_name(scope['repo_name'])
1121 obj = Repository.get_by_repo_name(scope['repo_name'])
1122 if obj:
1122 if obj:
1123 scope['repo_id'] = obj.repo_id
1123 scope['repo_id'] = obj.repo_id
1124 _scope = collections.OrderedDict()
1124 _scope = collections.OrderedDict()
1125 _scope['repo_id'] = -1
1125 _scope['repo_id'] = -1
1126 _scope['user_group_id'] = -1
1126 _scope['user_group_id'] = -1
1127 _scope['repo_group_id'] = -1
1127 _scope['repo_group_id'] = -1
1128
1128
1129 for k in sorted(scope.keys()):
1129 for k in sorted(scope.keys()):
1130 _scope[k] = scope[k]
1130 _scope[k] = scope[k]
1131
1131
1132 # store in cache to mimic how the @LazyProperty works,
1132 # store in cache to mimic how the @LazyProperty works,
1133 # the difference here is that we use the unique key calculated
1133 # the difference here is that we use the unique key calculated
1134 # from params and values
1134 # from params and values
1135 return self.get_perms(user=self, cache=None, scope=_scope)
1135 return self.get_perms(user=self, cache=None, scope=_scope)
1136
1136
1137 def get_instance(self):
1137 def get_instance(self):
1138 return User.get(self.user_id)
1138 return User.get(self.user_id)
1139
1139
1140 def propagate_data(self):
1140 def propagate_data(self):
1141 """
1141 """
1142 Fills in user data and propagates values to this instance. Maps fetched
1142 Fills in user data and propagates values to this instance. Maps fetched
1143 user attributes to this class instance attributes
1143 user attributes to this class instance attributes
1144 """
1144 """
1145 log.debug('AuthUser: starting data propagation for new potential user')
1145 log.debug('AuthUser: starting data propagation for new potential user')
1146 user_model = UserModel()
1146 user_model = UserModel()
1147 anon_user = self.anonymous_user = User.get_default_user(cache=True)
1147 anon_user = self.anonymous_user = User.get_default_user(cache=True)
1148 is_user_loaded = False
1148 is_user_loaded = False
1149
1149
1150 # lookup by userid
1150 # lookup by userid
1151 if self.user_id is not None and self.user_id != anon_user.user_id:
1151 if self.user_id is not None and self.user_id != anon_user.user_id:
1152 log.debug('Trying Auth User lookup by USER ID: `%s`', self.user_id)
1152 log.debug('Trying Auth User lookup by USER ID: `%s`', self.user_id)
1153 is_user_loaded = user_model.fill_data(self, user_id=self.user_id)
1153 is_user_loaded = user_model.fill_data(self, user_id=self.user_id)
1154
1154
1155 # try go get user by api key
1155 # try go get user by api key
1156 elif self._api_key and self._api_key != anon_user.api_key:
1156 elif self._api_key and self._api_key != anon_user.api_key:
1157 log.debug('Trying Auth User lookup by API KEY: `...%s`', self._api_key[-4:])
1157 log.debug('Trying Auth User lookup by API KEY: `...%s`', self._api_key[-4:])
1158 is_user_loaded = user_model.fill_data(self, api_key=self._api_key)
1158 is_user_loaded = user_model.fill_data(self, api_key=self._api_key)
1159
1159
1160 # lookup by username
1160 # lookup by username
1161 elif self.username:
1161 elif self.username:
1162 log.debug('Trying Auth User lookup by USER NAME: `%s`', self.username)
1162 log.debug('Trying Auth User lookup by USER NAME: `%s`', self.username)
1163 is_user_loaded = user_model.fill_data(self, username=self.username)
1163 is_user_loaded = user_model.fill_data(self, username=self.username)
1164 else:
1164 else:
1165 log.debug('No data in %s that could been used to log in', self)
1165 log.debug('No data in %s that could been used to log in', self)
1166
1166
1167 if not is_user_loaded:
1167 if not is_user_loaded:
1168 log.debug(
1168 log.debug(
1169 'Failed to load user. Fallback to default user %s', anon_user)
1169 'Failed to load user. Fallback to default user %s', anon_user)
1170 # if we cannot authenticate user try anonymous
1170 # if we cannot authenticate user try anonymous
1171 if anon_user.active:
1171 if anon_user.active:
1172 log.debug('default user is active, using it as a session user')
1172 log.debug('default user is active, using it as a session user')
1173 user_model.fill_data(self, user_id=anon_user.user_id)
1173 user_model.fill_data(self, user_id=anon_user.user_id)
1174 # then we set this user is logged in
1174 # then we set this user is logged in
1175 self.is_authenticated = True
1175 self.is_authenticated = True
1176 else:
1176 else:
1177 log.debug('default user is NOT active')
1177 log.debug('default user is NOT active')
1178 # in case of disabled anonymous user we reset some of the
1178 # in case of disabled anonymous user we reset some of the
1179 # parameters so such user is "corrupted", skipping the fill_data
1179 # parameters so such user is "corrupted", skipping the fill_data
1180 for attr in ['user_id', 'username', 'admin', 'active']:
1180 for attr in ['user_id', 'username', 'admin', 'active']:
1181 setattr(self, attr, None)
1181 setattr(self, attr, None)
1182 self.is_authenticated = False
1182 self.is_authenticated = False
1183
1183
1184 if not self.username:
1184 if not self.username:
1185 self.username = 'None'
1185 self.username = 'None'
1186
1186
1187 log.debug('AuthUser: propagated user is now %s', self)
1187 log.debug('AuthUser: propagated user is now %s', self)
1188
1188
1189 def get_perms(self, user, scope=None, explicit=True, algo='higherwin',
1189 def get_perms(self, user, scope=None, explicit=True, algo='higherwin',
1190 calculate_super_admin=False, cache=None):
1190 calculate_super_admin=False, cache=None):
1191 """
1191 """
1192 Fills user permission attribute with permissions taken from database
1192 Fills user permission attribute with permissions taken from database
1193 works for permissions given for repositories, and for permissions that
1193 works for permissions given for repositories, and for permissions that
1194 are granted to groups
1194 are granted to groups
1195
1195
1196 :param user: instance of User object from database
1196 :param user: instance of User object from database
1197 :param explicit: In case there are permissions both for user and a group
1197 :param explicit: In case there are permissions both for user and a group
1198 that user is part of, explicit flag will defiine if user will
1198 that user is part of, explicit flag will defiine if user will
1199 explicitly override permissions from group, if it's False it will
1199 explicitly override permissions from group, if it's False it will
1200 make decision based on the algo
1200 make decision based on the algo
1201 :param algo: algorithm to decide what permission should be choose if
1201 :param algo: algorithm to decide what permission should be choose if
1202 it's multiple defined, eg user in two different groups. It also
1202 it's multiple defined, eg user in two different groups. It also
1203 decides if explicit flag is turned off how to specify the permission
1203 decides if explicit flag is turned off how to specify the permission
1204 for case when user is in a group + have defined separate permission
1204 for case when user is in a group + have defined separate permission
1205 :param calculate_super_admin: calculate permissions for super-admin in the
1205 :param calculate_super_admin: calculate permissions for super-admin in the
1206 same way as for regular user without speedups
1206 same way as for regular user without speedups
1207 :param cache: Use caching for calculation, None = let the cache backend decide
1207 :param cache: Use caching for calculation, None = let the cache backend decide
1208 """
1208 """
1209 user_id = user.user_id
1209 user_id = user.user_id
1210 user_is_admin = user.is_admin
1210 user_is_admin = user.is_admin
1211
1211
1212 # inheritance of global permissions like create repo/fork repo etc
1212 # inheritance of global permissions like create repo/fork repo etc
1213 user_inherit_default_permissions = user.inherit_default_permissions
1213 user_inherit_default_permissions = user.inherit_default_permissions
1214
1214
1215 cache_seconds = safe_int(
1215 cache_seconds = safe_int(
1216 rhodecode.CONFIG.get('rc_cache.cache_perms.expiration_time'))
1216 rhodecode.CONFIG.get('rc_cache.cache_perms.expiration_time'))
1217
1217
1218 if cache is None:
1218 if cache is None:
1219 # let the backend cache decide
1219 # let the backend cache decide
1220 cache_on = cache_seconds > 0
1220 cache_on = cache_seconds > 0
1221 else:
1221 else:
1222 cache_on = cache
1222 cache_on = cache
1223
1223
1224 log.debug(
1224 log.debug(
1225 'Computing PERMISSION tree for user %s scope `%s` '
1225 'Computing PERMISSION tree for user %s scope `%s` '
1226 'with caching: %s[TTL: %ss]', user, scope, cache_on, cache_seconds or 0)
1226 'with caching: %s[TTL: %ss]', user, scope, cache_on, cache_seconds or 0)
1227
1227
1228 cache_namespace_uid = 'cache_user_auth.{}'.format(user_id)
1228 cache_namespace_uid = 'cache_user_auth.{}'.format(user_id)
1229 region = rc_cache.get_or_create_region('cache_perms', cache_namespace_uid)
1229 region = rc_cache.get_or_create_region('cache_perms', cache_namespace_uid)
1230
1230
1231 @region.conditional_cache_on_arguments(namespace=cache_namespace_uid,
1231 @region.conditional_cache_on_arguments(namespace=cache_namespace_uid,
1232 condition=cache_on)
1232 condition=cache_on)
1233 def compute_perm_tree(cache_name, cache_ver,
1233 def compute_perm_tree(cache_name, cache_ver,
1234 user_id, scope, user_is_admin,user_inherit_default_permissions,
1234 user_id, scope, user_is_admin,user_inherit_default_permissions,
1235 explicit, algo, calculate_super_admin):
1235 explicit, algo, calculate_super_admin):
1236 return _cached_perms_data(
1236 return _cached_perms_data(
1237 user_id, scope, user_is_admin, user_inherit_default_permissions,
1237 user_id, scope, user_is_admin, user_inherit_default_permissions,
1238 explicit, algo, calculate_super_admin)
1238 explicit, algo, calculate_super_admin)
1239
1239
1240 start = time.time()
1240 start = time.time()
1241 result = compute_perm_tree(
1241 result = compute_perm_tree(
1242 'permissions', 'v1', user_id, scope, user_is_admin,
1242 'permissions', 'v1', user_id, scope, user_is_admin,
1243 user_inherit_default_permissions, explicit, algo,
1243 user_inherit_default_permissions, explicit, algo,
1244 calculate_super_admin)
1244 calculate_super_admin)
1245
1245
1246 result_repr = []
1246 result_repr = []
1247 for k in result:
1247 for k in result:
1248 result_repr.append((k, len(result[k])))
1248 result_repr.append((k, len(result[k])))
1249 total = time.time() - start
1249 total = time.time() - start
1250 log.debug('PERMISSION tree for user %s computed in %.4fs: %s',
1250 log.debug('PERMISSION tree for user %s computed in %.4fs: %s',
1251 user, total, result_repr)
1251 user, total, result_repr)
1252
1252
1253 return result
1253 return result
1254
1254
1255 @property
1255 @property
1256 def is_default(self):
1256 def is_default(self):
1257 return self.username == User.DEFAULT_USER
1257 return self.username == User.DEFAULT_USER
1258
1258
1259 @property
1259 @property
1260 def is_admin(self):
1260 def is_admin(self):
1261 return self.admin
1261 return self.admin
1262
1262
1263 @property
1263 @property
1264 def is_user_object(self):
1264 def is_user_object(self):
1265 return self.user_id is not None
1265 return self.user_id is not None
1266
1266
1267 @property
1267 @property
1268 def repositories_admin(self):
1268 def repositories_admin(self):
1269 """
1269 """
1270 Returns list of repositories you're an admin of
1270 Returns list of repositories you're an admin of
1271 """
1271 """
1272 return [
1272 return [
1273 x[0] for x in self.permissions['repositories'].items()
1273 x[0] for x in self.permissions['repositories'].items()
1274 if x[1] == 'repository.admin']
1274 if x[1] == 'repository.admin']
1275
1275
1276 @property
1276 @property
1277 def repository_groups_admin(self):
1277 def repository_groups_admin(self):
1278 """
1278 """
1279 Returns list of repository groups you're an admin of
1279 Returns list of repository groups you're an admin of
1280 """
1280 """
1281 return [
1281 return [
1282 x[0] for x in self.permissions['repositories_groups'].items()
1282 x[0] for x in self.permissions['repositories_groups'].items()
1283 if x[1] == 'group.admin']
1283 if x[1] == 'group.admin']
1284
1284
1285 @property
1285 @property
1286 def user_groups_admin(self):
1286 def user_groups_admin(self):
1287 """
1287 """
1288 Returns list of user groups you're an admin of
1288 Returns list of user groups you're an admin of
1289 """
1289 """
1290 return [
1290 return [
1291 x[0] for x in self.permissions['user_groups'].items()
1291 x[0] for x in self.permissions['user_groups'].items()
1292 if x[1] == 'usergroup.admin']
1292 if x[1] == 'usergroup.admin']
1293
1293
1294 def repo_acl_ids_from_stack(self, perms=None, prefix_filter=None, cache=False):
1294 def repo_acl_ids_from_stack(self, perms=None, prefix_filter=None, cache=False):
1295 if not perms:
1295 if not perms:
1296 perms = AuthUser.repo_read_perms
1296 perms = AuthUser.repo_read_perms
1297 allowed_ids = []
1297 allowed_ids = []
1298 for k, stack_data in self.permissions['repositories'].perm_origin_stack.items():
1298 for k, stack_data in self.permissions['repositories'].perm_origin_stack.items():
1299 perm, origin, obj_id = stack_data[-1] # last item is the current permission
1299 perm, origin, obj_id = stack_data[-1] # last item is the current permission
1300 if prefix_filter and not k.startswith(prefix_filter):
1300 if prefix_filter and not k.startswith(prefix_filter):
1301 continue
1301 continue
1302 if perm in perms:
1302 if perm in perms:
1303 allowed_ids.append(obj_id)
1303 allowed_ids.append(obj_id)
1304 return allowed_ids
1304 return allowed_ids
1305
1305
1306 def repo_acl_ids(self, perms=None, name_filter=None, cache=False):
1306 def repo_acl_ids(self, perms=None, name_filter=None, cache=False):
1307 """
1307 """
1308 Returns list of repository ids that user have access to based on given
1308 Returns list of repository ids that user have access to based on given
1309 perms. The cache flag should be only used in cases that are used for
1309 perms. The cache flag should be only used in cases that are used for
1310 display purposes, NOT IN ANY CASE for permission checks.
1310 display purposes, NOT IN ANY CASE for permission checks.
1311 """
1311 """
1312 from rhodecode.model.scm import RepoList
1312 from rhodecode.model.scm import RepoList
1313 if not perms:
1313 if not perms:
1314 perms = AuthUser.repo_read_perms
1314 perms = AuthUser.repo_read_perms
1315
1315
1316 def _cached_repo_acl(user_id, perm_def, _name_filter):
1316 if not isinstance(perms, list):
1317 raise ValueError('perms parameter must be a list got {} instead'.format(perms))
1318
1319 def _cached_repo_acl(perm_def, _name_filter):
1317 qry = Repository.query()
1320 qry = Repository.query()
1318 if _name_filter:
1321 if _name_filter:
1319 ilike_expression = u'%{}%'.format(safe_unicode(_name_filter))
1322 ilike_expression = u'%{}%'.format(safe_unicode(_name_filter))
1320 qry = qry.filter(
1323 qry = qry.filter(
1321 Repository.repo_name.ilike(ilike_expression))
1324 Repository.repo_name.ilike(ilike_expression))
1322
1325
1323 return [x.repo_id for x in
1326 return [x.repo_id for x in
1324 RepoList(qry, perm_set=perm_def, extra_kwargs={'user': self})]
1327 RepoList(qry, perm_set=perm_def, extra_kwargs={'user': self})]
1325
1328
1326 return _cached_repo_acl(self.user_id, perms, name_filter)
1329 log.debug('Computing REPO ACL IDS user %s', self)
1330
1331 cache_namespace_uid = 'cache_user_repo_acl_ids.{}'.format(self.user_id)
1332 region = rc_cache.get_or_create_region('cache_perms', cache_namespace_uid)
1333
1334 @region.conditional_cache_on_arguments(namespace=cache_namespace_uid, condition=cache)
1335 def compute_repo_acl_ids(cache_ver, user_id, perm_def, _name_filter):
1336 return _cached_repo_acl(perm_def, _name_filter)
1337
1338 start = time.time()
1339 result = compute_repo_acl_ids('v1', self.user_id, perms, name_filter)
1340 total = time.time() - start
1341 log.debug('REPO ACL IDS for user %s computed in %.4fs', self, total)
1342
1343 return result
1327
1344
1328 def repo_group_acl_ids_from_stack(self, perms=None, prefix_filter=None, cache=False):
1345 def repo_group_acl_ids_from_stack(self, perms=None, prefix_filter=None, cache=False):
1329 if not perms:
1346 if not perms:
1330 perms = AuthUser.repo_group_read_perms
1347 perms = AuthUser.repo_group_read_perms
1331 allowed_ids = []
1348 allowed_ids = []
1332 for k, stack_data in self.permissions['repositories_groups'].perm_origin_stack.items():
1349 for k, stack_data in self.permissions['repositories_groups'].perm_origin_stack.items():
1333 perm, origin, obj_id = stack_data[-1] # last item is the current permission
1350 perm, origin, obj_id = stack_data[-1] # last item is the current permission
1334 if prefix_filter and not k.startswith(prefix_filter):
1351 if prefix_filter and not k.startswith(prefix_filter):
1335 continue
1352 continue
1336 if perm in perms:
1353 if perm in perms:
1337 allowed_ids.append(obj_id)
1354 allowed_ids.append(obj_id)
1338 return allowed_ids
1355 return allowed_ids
1339
1356
1340 def repo_group_acl_ids(self, perms=None, name_filter=None, cache=False):
1357 def repo_group_acl_ids(self, perms=None, name_filter=None, cache=False):
1341 """
1358 """
1342 Returns list of repository group ids that user have access to based on given
1359 Returns list of repository group ids that user have access to based on given
1343 perms. The cache flag should be only used in cases that are used for
1360 perms. The cache flag should be only used in cases that are used for
1344 display purposes, NOT IN ANY CASE for permission checks.
1361 display purposes, NOT IN ANY CASE for permission checks.
1345 """
1362 """
1346 from rhodecode.model.scm import RepoGroupList
1363 from rhodecode.model.scm import RepoGroupList
1347 if not perms:
1364 if not perms:
1348 perms = AuthUser.repo_group_read_perms
1365 perms = AuthUser.repo_group_read_perms
1349
1366
1350 def _cached_repo_group_acl(user_id, perm_def, _name_filter):
1367 if not isinstance(perms, list):
1368 raise ValueError('perms parameter must be a list got {} instead'.format(perms))
1369
1370 def _cached_repo_group_acl(perm_def, _name_filter):
1351 qry = RepoGroup.query()
1371 qry = RepoGroup.query()
1352 if _name_filter:
1372 if _name_filter:
1353 ilike_expression = u'%{}%'.format(safe_unicode(_name_filter))
1373 ilike_expression = u'%{}%'.format(safe_unicode(_name_filter))
1354 qry = qry.filter(
1374 qry = qry.filter(
1355 RepoGroup.group_name.ilike(ilike_expression))
1375 RepoGroup.group_name.ilike(ilike_expression))
1356
1376
1357 return [x.group_id for x in
1377 return [x.group_id for x in
1358 RepoGroupList(qry, perm_set=perm_def, extra_kwargs={'user': self})]
1378 RepoGroupList(qry, perm_set=perm_def, extra_kwargs={'user': self})]
1359
1379
1360 return _cached_repo_group_acl(self.user_id, perms, name_filter)
1380 log.debug('Computing REPO GROUP ACL IDS user %s', self)
1381
1382 cache_namespace_uid = 'cache_user_repo_group_acl_ids.{}'.format(self.user_id)
1383 region = rc_cache.get_or_create_region('cache_perms', cache_namespace_uid)
1384
1385 @region.conditional_cache_on_arguments(namespace=cache_namespace_uid, condition=cache)
1386 def compute_repo_group_acl_ids(cache_ver, user_id, perm_def, _name_filter):
1387 return _cached_repo_group_acl(perm_def, _name_filter)
1388
1389 start = time.time()
1390 result = compute_repo_group_acl_ids('v1', self.user_id, perms, name_filter)
1391 total = time.time() - start
1392 log.debug('REPO GROUP ACL IDS for user %s computed in %.4fs', self, total)
1393
1394 return result
1361
1395
1362 def user_group_acl_ids_from_stack(self, perms=None, cache=False):
1396 def user_group_acl_ids_from_stack(self, perms=None, cache=False):
1363 if not perms:
1397 if not perms:
1364 perms = AuthUser.user_group_read_perms
1398 perms = AuthUser.user_group_read_perms
1365 allowed_ids = []
1399 allowed_ids = []
1366 for k, stack_data in self.permissions['user_groups'].perm_origin_stack.items():
1400 for k, stack_data in self.permissions['user_groups'].perm_origin_stack.items():
1367 perm, origin, obj_id = stack_data[-1] # last item is the current permission
1401 perm, origin, obj_id = stack_data[-1] # last item is the current permission
1368 if perm in perms:
1402 if perm in perms:
1369 allowed_ids.append(obj_id)
1403 allowed_ids.append(obj_id)
1370 return allowed_ids
1404 return allowed_ids
1371
1405
1372 def user_group_acl_ids(self, perms=None, name_filter=None, cache=False):
1406 def user_group_acl_ids(self, perms=None, name_filter=None, cache=False):
1373 """
1407 """
1374 Returns list of user group ids that user have access to based on given
1408 Returns list of user group ids that user have access to based on given
1375 perms. The cache flag should be only used in cases that are used for
1409 perms. The cache flag should be only used in cases that are used for
1376 display purposes, NOT IN ANY CASE for permission checks.
1410 display purposes, NOT IN ANY CASE for permission checks.
1377 """
1411 """
1378 from rhodecode.model.scm import UserGroupList
1412 from rhodecode.model.scm import UserGroupList
1379 if not perms:
1413 if not perms:
1380 perms = AuthUser.user_group_read_perms
1414 perms = AuthUser.user_group_read_perms
1381
1415
1382 def _cached_user_group_acl(user_id, perm_def, name_filter):
1416 if not isinstance(perms, list):
1417 raise ValueError('perms parameter must be a list got {} instead'.format(perms))
1418
1419 def _cached_user_group_acl(perm_def, _name_filter):
1383 qry = UserGroup.query()
1420 qry = UserGroup.query()
1384 if name_filter:
1421 if _name_filter:
1385 ilike_expression = u'%{}%'.format(safe_unicode(name_filter))
1422 ilike_expression = u'%{}%'.format(safe_unicode(_name_filter))
1386 qry = qry.filter(
1423 qry = qry.filter(
1387 UserGroup.users_group_name.ilike(ilike_expression))
1424 UserGroup.users_group_name.ilike(ilike_expression))
1388
1425
1389 return [x.users_group_id for x in
1426 return [x.users_group_id for x in
1390 UserGroupList(qry, perm_set=perm_def, extra_kwargs={'user': self})]
1427 UserGroupList(qry, perm_set=perm_def, extra_kwargs={'user': self})]
1391
1428
1392 return _cached_user_group_acl(self.user_id, perms, name_filter)
1429 log.debug('Computing USER GROUP ACL IDS user %s', self)
1430
1431 cache_namespace_uid = 'cache_user_user_group_acl_ids.{}'.format(self.user_id)
1432 region = rc_cache.get_or_create_region('cache_perms', cache_namespace_uid)
1433
1434 @region.conditional_cache_on_arguments(namespace=cache_namespace_uid, condition=cache)
1435 def compute_user_group_acl_ids(cache_ver, user_id, perm_def, _name_filter):
1436 return _cached_user_group_acl(perm_def, _name_filter)
1437
1438 start = time.time()
1439 result = compute_user_group_acl_ids('v1', self.user_id, perms, name_filter)
1440 total = time.time() - start
1441 log.debug('USER GROUP ACL IDS for user %s computed in %.4fs', self, total)
1442
1443 return result
1393
1444
1394 @property
1445 @property
1395 def ip_allowed(self):
1446 def ip_allowed(self):
1396 """
1447 """
1397 Checks if ip_addr used in constructor is allowed from defined list of
1448 Checks if ip_addr used in constructor is allowed from defined list of
1398 allowed ip_addresses for user
1449 allowed ip_addresses for user
1399
1450
1400 :returns: boolean, True if ip is in allowed ip range
1451 :returns: boolean, True if ip is in allowed ip range
1401 """
1452 """
1402 # check IP
1453 # check IP
1403 inherit = self.inherit_default_permissions
1454 inherit = self.inherit_default_permissions
1404 return AuthUser.check_ip_allowed(self.user_id, self.ip_addr,
1455 return AuthUser.check_ip_allowed(self.user_id, self.ip_addr,
1405 inherit_from_default=inherit)
1456 inherit_from_default=inherit)
1457
1406 @property
1458 @property
1407 def personal_repo_group(self):
1459 def personal_repo_group(self):
1408 return RepoGroup.get_user_personal_repo_group(self.user_id)
1460 return RepoGroup.get_user_personal_repo_group(self.user_id)
1409
1461
1410 @LazyProperty
1462 @LazyProperty
1411 def feed_token(self):
1463 def feed_token(self):
1412 return self.get_instance().feed_token
1464 return self.get_instance().feed_token
1413
1465
1414 @LazyProperty
1466 @LazyProperty
1415 def artifact_token(self):
1467 def artifact_token(self):
1416 return self.get_instance().artifact_token
1468 return self.get_instance().artifact_token
1417
1469
1418 @classmethod
1470 @classmethod
1419 def check_ip_allowed(cls, user_id, ip_addr, inherit_from_default):
1471 def check_ip_allowed(cls, user_id, ip_addr, inherit_from_default):
1420 allowed_ips = AuthUser.get_allowed_ips(
1472 allowed_ips = AuthUser.get_allowed_ips(
1421 user_id, cache=True, inherit_from_default=inherit_from_default)
1473 user_id, cache=True, inherit_from_default=inherit_from_default)
1422 if check_ip_access(source_ip=ip_addr, allowed_ips=allowed_ips):
1474 if check_ip_access(source_ip=ip_addr, allowed_ips=allowed_ips):
1423 log.debug('IP:%s for user %s is in range of %s',
1475 log.debug('IP:%s for user %s is in range of %s',
1424 ip_addr, user_id, allowed_ips)
1476 ip_addr, user_id, allowed_ips)
1425 return True
1477 return True
1426 else:
1478 else:
1427 log.info('Access for IP:%s forbidden for user %s, '
1479 log.info('Access for IP:%s forbidden for user %s, '
1428 'not in %s', ip_addr, user_id, allowed_ips)
1480 'not in %s', ip_addr, user_id, allowed_ips)
1429 return False
1481 return False
1430
1482
1431 def get_branch_permissions(self, repo_name, perms=None):
1483 def get_branch_permissions(self, repo_name, perms=None):
1432 perms = perms or self.permissions_with_scope({'repo_name': repo_name})
1484 perms = perms or self.permissions_with_scope({'repo_name': repo_name})
1433 branch_perms = perms.get('repository_branches', {})
1485 branch_perms = perms.get('repository_branches', {})
1434 if not branch_perms:
1486 if not branch_perms:
1435 return {}
1487 return {}
1436 repo_branch_perms = branch_perms.get(repo_name)
1488 repo_branch_perms = branch_perms.get(repo_name)
1437 return repo_branch_perms or {}
1489 return repo_branch_perms or {}
1438
1490
1439 def get_rule_and_branch_permission(self, repo_name, branch_name):
1491 def get_rule_and_branch_permission(self, repo_name, branch_name):
1440 """
1492 """
1441 Check if this AuthUser has defined any permissions for branches. If any of
1493 Check if this AuthUser has defined any permissions for branches. If any of
1442 the rules match in order, we return the matching permissions
1494 the rules match in order, we return the matching permissions
1443 """
1495 """
1444
1496
1445 rule = default_perm = ''
1497 rule = default_perm = ''
1446
1498
1447 repo_branch_perms = self.get_branch_permissions(repo_name=repo_name)
1499 repo_branch_perms = self.get_branch_permissions(repo_name=repo_name)
1448 if not repo_branch_perms:
1500 if not repo_branch_perms:
1449 return rule, default_perm
1501 return rule, default_perm
1450
1502
1451 # now calculate the permissions
1503 # now calculate the permissions
1452 for pattern, branch_perm in repo_branch_perms.items():
1504 for pattern, branch_perm in repo_branch_perms.items():
1453 if fnmatch.fnmatch(branch_name, pattern):
1505 if fnmatch.fnmatch(branch_name, pattern):
1454 rule = '`{}`=>{}'.format(pattern, branch_perm)
1506 rule = '`{}`=>{}'.format(pattern, branch_perm)
1455 return rule, branch_perm
1507 return rule, branch_perm
1456
1508
1457 return rule, default_perm
1509 return rule, default_perm
1458
1510
1459 def get_notice_messages(self):
1511 def get_notice_messages(self):
1460
1512
1461 notice_level = 'notice-error'
1513 notice_level = 'notice-error'
1462 notice_messages = []
1514 notice_messages = []
1463 if self.is_default:
1515 if self.is_default:
1464 return [], notice_level
1516 return [], notice_level
1465
1517
1466 notices = UserNotice.query()\
1518 notices = UserNotice.query()\
1467 .filter(UserNotice.user_id == self.user_id)\
1519 .filter(UserNotice.user_id == self.user_id)\
1468 .filter(UserNotice.notice_read == false())\
1520 .filter(UserNotice.notice_read == false())\
1469 .all()
1521 .all()
1470
1522
1471 try:
1523 try:
1472 for entry in notices:
1524 for entry in notices:
1473
1525
1474 msg = {
1526 msg = {
1475 'msg_id': entry.user_notice_id,
1527 'msg_id': entry.user_notice_id,
1476 'level': entry.notification_level,
1528 'level': entry.notification_level,
1477 'subject': entry.notice_subject,
1529 'subject': entry.notice_subject,
1478 'body': entry.notice_body,
1530 'body': entry.notice_body,
1479 }
1531 }
1480 notice_messages.append(msg)
1532 notice_messages.append(msg)
1481
1533
1482 log.debug('Got user %s %s messages', self, len(notice_messages))
1534 log.debug('Got user %s %s messages', self, len(notice_messages))
1483
1535
1484 levels = [x['level'] for x in notice_messages]
1536 levels = [x['level'] for x in notice_messages]
1485 notice_level = 'notice-error' if 'error' in levels else 'notice-warning'
1537 notice_level = 'notice-error' if 'error' in levels else 'notice-warning'
1486 except Exception:
1538 except Exception:
1487 pass
1539 pass
1488
1540
1489 return notice_messages, notice_level
1541 return notice_messages, notice_level
1490
1542
1491 def __repr__(self):
1543 def __repr__(self):
1492 return "<AuthUser('id:%s[%s] ip:%s auth:%s')>"\
1544 return "<AuthUser('id:%s[%s] ip:%s auth:%s')>"\
1493 % (self.user_id, self.username, self.ip_addr, self.is_authenticated)
1545 % (self.user_id, self.username, self.ip_addr, self.is_authenticated)
1494
1546
1495 def set_authenticated(self, authenticated=True):
1547 def set_authenticated(self, authenticated=True):
1496 if self.user_id != self.anonymous_user.user_id:
1548 if self.user_id != self.anonymous_user.user_id:
1497 self.is_authenticated = authenticated
1549 self.is_authenticated = authenticated
1498
1550
1499 def get_cookie_store(self):
1551 def get_cookie_store(self):
1500 return {
1552 return {
1501 'username': self.username,
1553 'username': self.username,
1502 'password': md5(self.password or ''),
1554 'password': md5(self.password or ''),
1503 'user_id': self.user_id,
1555 'user_id': self.user_id,
1504 'is_authenticated': self.is_authenticated
1556 'is_authenticated': self.is_authenticated
1505 }
1557 }
1506
1558
1507 @classmethod
1559 @classmethod
1508 def from_cookie_store(cls, cookie_store):
1560 def from_cookie_store(cls, cookie_store):
1509 """
1561 """
1510 Creates AuthUser from a cookie store
1562 Creates AuthUser from a cookie store
1511
1563
1512 :param cls:
1564 :param cls:
1513 :param cookie_store:
1565 :param cookie_store:
1514 """
1566 """
1515 user_id = cookie_store.get('user_id')
1567 user_id = cookie_store.get('user_id')
1516 username = cookie_store.get('username')
1568 username = cookie_store.get('username')
1517 api_key = cookie_store.get('api_key')
1569 api_key = cookie_store.get('api_key')
1518 return AuthUser(user_id, api_key, username)
1570 return AuthUser(user_id, api_key, username)
1519
1571
1520 @classmethod
1572 @classmethod
1521 def get_allowed_ips(cls, user_id, cache=False, inherit_from_default=False):
1573 def get_allowed_ips(cls, user_id, cache=False, inherit_from_default=False):
1522 _set = set()
1574 _set = set()
1523
1575
1524 if inherit_from_default:
1576 if inherit_from_default:
1525 def_user_id = User.get_default_user(cache=True).user_id
1577 def_user_id = User.get_default_user(cache=True).user_id
1526 default_ips = UserIpMap.query().filter(UserIpMap.user_id == def_user_id)
1578 default_ips = UserIpMap.query().filter(UserIpMap.user_id == def_user_id)
1527 if cache:
1579 if cache:
1528 default_ips = default_ips.options(
1580 default_ips = default_ips.options(
1529 FromCache("sql_cache_short", "get_user_ips_default"))
1581 FromCache("sql_cache_short", "get_user_ips_default"))
1530
1582
1531 # populate from default user
1583 # populate from default user
1532 for ip in default_ips:
1584 for ip in default_ips:
1533 try:
1585 try:
1534 _set.add(ip.ip_addr)
1586 _set.add(ip.ip_addr)
1535 except ObjectDeletedError:
1587 except ObjectDeletedError:
1536 # since we use heavy caching sometimes it happens that
1588 # since we use heavy caching sometimes it happens that
1537 # we get deleted objects here, we just skip them
1589 # we get deleted objects here, we just skip them
1538 pass
1590 pass
1539
1591
1540 # NOTE:(marcink) we don't want to load any rules for empty
1592 # NOTE:(marcink) we don't want to load any rules for empty
1541 # user_id which is the case of access of non logged users when anonymous
1593 # user_id which is the case of access of non logged users when anonymous
1542 # access is disabled
1594 # access is disabled
1543 user_ips = []
1595 user_ips = []
1544 if user_id:
1596 if user_id:
1545 user_ips = UserIpMap.query().filter(UserIpMap.user_id == user_id)
1597 user_ips = UserIpMap.query().filter(UserIpMap.user_id == user_id)
1546 if cache:
1598 if cache:
1547 user_ips = user_ips.options(
1599 user_ips = user_ips.options(
1548 FromCache("sql_cache_short", "get_user_ips_%s" % user_id))
1600 FromCache("sql_cache_short", "get_user_ips_%s" % user_id))
1549
1601
1550 for ip in user_ips:
1602 for ip in user_ips:
1551 try:
1603 try:
1552 _set.add(ip.ip_addr)
1604 _set.add(ip.ip_addr)
1553 except ObjectDeletedError:
1605 except ObjectDeletedError:
1554 # since we use heavy caching sometimes it happens that we get
1606 # since we use heavy caching sometimes it happens that we get
1555 # deleted objects here, we just skip them
1607 # deleted objects here, we just skip them
1556 pass
1608 pass
1557 return _set or {ip for ip in ['0.0.0.0/0', '::/0']}
1609 return _set or {ip for ip in ['0.0.0.0/0', '::/0']}
1558
1610
1559
1611
1560 def set_available_permissions(settings):
1612 def set_available_permissions(settings):
1561 """
1613 """
1562 This function will propagate pyramid settings with all available defined
1614 This function will propagate pyramid settings with all available defined
1563 permission given in db. We don't want to check each time from db for new
1615 permission given in db. We don't want to check each time from db for new
1564 permissions since adding a new permission also requires application restart
1616 permissions since adding a new permission also requires application restart
1565 ie. to decorate new views with the newly created permission
1617 ie. to decorate new views with the newly created permission
1566
1618
1567 :param settings: current pyramid registry.settings
1619 :param settings: current pyramid registry.settings
1568
1620
1569 """
1621 """
1570 log.debug('auth: getting information about all available permissions')
1622 log.debug('auth: getting information about all available permissions')
1571 try:
1623 try:
1572 sa = meta.Session
1624 sa = meta.Session
1573 all_perms = sa.query(Permission).all()
1625 all_perms = sa.query(Permission).all()
1574 settings.setdefault('available_permissions',
1626 settings.setdefault('available_permissions',
1575 [x.permission_name for x in all_perms])
1627 [x.permission_name for x in all_perms])
1576 log.debug('auth: set available permissions')
1628 log.debug('auth: set available permissions')
1577 except Exception:
1629 except Exception:
1578 log.exception('Failed to fetch permissions from the database.')
1630 log.exception('Failed to fetch permissions from the database.')
1579 raise
1631 raise
1580
1632
1581
1633
1582 def get_csrf_token(session, force_new=False, save_if_missing=True):
1634 def get_csrf_token(session, force_new=False, save_if_missing=True):
1583 """
1635 """
1584 Return the current authentication token, creating one if one doesn't
1636 Return the current authentication token, creating one if one doesn't
1585 already exist and the save_if_missing flag is present.
1637 already exist and the save_if_missing flag is present.
1586
1638
1587 :param session: pass in the pyramid session, else we use the global ones
1639 :param session: pass in the pyramid session, else we use the global ones
1588 :param force_new: force to re-generate the token and store it in session
1640 :param force_new: force to re-generate the token and store it in session
1589 :param save_if_missing: save the newly generated token if it's missing in
1641 :param save_if_missing: save the newly generated token if it's missing in
1590 session
1642 session
1591 """
1643 """
1592 # NOTE(marcink): probably should be replaced with below one from pyramid 1.9
1644 # NOTE(marcink): probably should be replaced with below one from pyramid 1.9
1593 # from pyramid.csrf import get_csrf_token
1645 # from pyramid.csrf import get_csrf_token
1594
1646
1595 if (csrf_token_key not in session and save_if_missing) or force_new:
1647 if (csrf_token_key not in session and save_if_missing) or force_new:
1596 token = hashlib.sha1(str(random.getrandbits(128))).hexdigest()
1648 token = hashlib.sha1(str(random.getrandbits(128))).hexdigest()
1597 session[csrf_token_key] = token
1649 session[csrf_token_key] = token
1598 if hasattr(session, 'save'):
1650 if hasattr(session, 'save'):
1599 session.save()
1651 session.save()
1600 return session.get(csrf_token_key)
1652 return session.get(csrf_token_key)
1601
1653
1602
1654
1603 def get_request(perm_class_instance):
1655 def get_request(perm_class_instance):
1604 from pyramid.threadlocal import get_current_request
1656 from pyramid.threadlocal import get_current_request
1605 pyramid_request = get_current_request()
1657 pyramid_request = get_current_request()
1606 return pyramid_request
1658 return pyramid_request
1607
1659
1608
1660
1609 # CHECK DECORATORS
1661 # CHECK DECORATORS
1610 class CSRFRequired(object):
1662 class CSRFRequired(object):
1611 """
1663 """
1612 Decorator for authenticating a form
1664 Decorator for authenticating a form
1613
1665
1614 This decorator uses an authorization token stored in the client's
1666 This decorator uses an authorization token stored in the client's
1615 session for prevention of certain Cross-site request forgery (CSRF)
1667 session for prevention of certain Cross-site request forgery (CSRF)
1616 attacks (See
1668 attacks (See
1617 http://en.wikipedia.org/wiki/Cross-site_request_forgery for more
1669 http://en.wikipedia.org/wiki/Cross-site_request_forgery for more
1618 information).
1670 information).
1619
1671
1620 For use with the ``secure_form`` helper functions.
1672 For use with the ``secure_form`` helper functions.
1621
1673
1622 """
1674 """
1623 def __init__(self, token=csrf_token_key, header='X-CSRF-Token', except_methods=None):
1675 def __init__(self, token=csrf_token_key, header='X-CSRF-Token', except_methods=None):
1624 self.token = token
1676 self.token = token
1625 self.header = header
1677 self.header = header
1626 self.except_methods = except_methods or []
1678 self.except_methods = except_methods or []
1627
1679
1628 def __call__(self, func):
1680 def __call__(self, func):
1629 return get_cython_compat_decorator(self.__wrapper, func)
1681 return get_cython_compat_decorator(self.__wrapper, func)
1630
1682
1631 def _get_csrf(self, _request):
1683 def _get_csrf(self, _request):
1632 return _request.POST.get(self.token, _request.headers.get(self.header))
1684 return _request.POST.get(self.token, _request.headers.get(self.header))
1633
1685
1634 def check_csrf(self, _request, cur_token):
1686 def check_csrf(self, _request, cur_token):
1635 supplied_token = self._get_csrf(_request)
1687 supplied_token = self._get_csrf(_request)
1636 return supplied_token and supplied_token == cur_token
1688 return supplied_token and supplied_token == cur_token
1637
1689
1638 def _get_request(self):
1690 def _get_request(self):
1639 return get_request(self)
1691 return get_request(self)
1640
1692
1641 def __wrapper(self, func, *fargs, **fkwargs):
1693 def __wrapper(self, func, *fargs, **fkwargs):
1642 request = self._get_request()
1694 request = self._get_request()
1643
1695
1644 if request.method in self.except_methods:
1696 if request.method in self.except_methods:
1645 return func(*fargs, **fkwargs)
1697 return func(*fargs, **fkwargs)
1646
1698
1647 cur_token = get_csrf_token(request.session, save_if_missing=False)
1699 cur_token = get_csrf_token(request.session, save_if_missing=False)
1648 if self.check_csrf(request, cur_token):
1700 if self.check_csrf(request, cur_token):
1649 if request.POST.get(self.token):
1701 if request.POST.get(self.token):
1650 del request.POST[self.token]
1702 del request.POST[self.token]
1651 return func(*fargs, **fkwargs)
1703 return func(*fargs, **fkwargs)
1652 else:
1704 else:
1653 reason = 'token-missing'
1705 reason = 'token-missing'
1654 supplied_token = self._get_csrf(request)
1706 supplied_token = self._get_csrf(request)
1655 if supplied_token and cur_token != supplied_token:
1707 if supplied_token and cur_token != supplied_token:
1656 reason = 'token-mismatch [%s:%s]' % (
1708 reason = 'token-mismatch [%s:%s]' % (
1657 cur_token or ''[:6], supplied_token or ''[:6])
1709 cur_token or ''[:6], supplied_token or ''[:6])
1658
1710
1659 csrf_message = \
1711 csrf_message = \
1660 ("Cross-site request forgery detected, request denied. See "
1712 ("Cross-site request forgery detected, request denied. See "
1661 "http://en.wikipedia.org/wiki/Cross-site_request_forgery for "
1713 "http://en.wikipedia.org/wiki/Cross-site_request_forgery for "
1662 "more information.")
1714 "more information.")
1663 log.warn('Cross-site request forgery detected, request %r DENIED: %s '
1715 log.warn('Cross-site request forgery detected, request %r DENIED: %s '
1664 'REMOTE_ADDR:%s, HEADERS:%s' % (
1716 'REMOTE_ADDR:%s, HEADERS:%s' % (
1665 request, reason, request.remote_addr, request.headers))
1717 request, reason, request.remote_addr, request.headers))
1666
1718
1667 raise HTTPForbidden(explanation=csrf_message)
1719 raise HTTPForbidden(explanation=csrf_message)
1668
1720
1669
1721
1670 class LoginRequired(object):
1722 class LoginRequired(object):
1671 """
1723 """
1672 Must be logged in to execute this function else
1724 Must be logged in to execute this function else
1673 redirect to login page
1725 redirect to login page
1674
1726
1675 :param api_access: if enabled this checks only for valid auth token
1727 :param api_access: if enabled this checks only for valid auth token
1676 and grants access based on valid token
1728 and grants access based on valid token
1677 """
1729 """
1678 def __init__(self, auth_token_access=None):
1730 def __init__(self, auth_token_access=None):
1679 self.auth_token_access = auth_token_access
1731 self.auth_token_access = auth_token_access
1680 if self.auth_token_access:
1732 if self.auth_token_access:
1681 valid_type = set(auth_token_access).intersection(set(UserApiKeys.ROLES))
1733 valid_type = set(auth_token_access).intersection(set(UserApiKeys.ROLES))
1682 if not valid_type:
1734 if not valid_type:
1683 raise ValueError('auth_token_access must be on of {}, got {}'.format(
1735 raise ValueError('auth_token_access must be on of {}, got {}'.format(
1684 UserApiKeys.ROLES, auth_token_access))
1736 UserApiKeys.ROLES, auth_token_access))
1685
1737
1686 def __call__(self, func):
1738 def __call__(self, func):
1687 return get_cython_compat_decorator(self.__wrapper, func)
1739 return get_cython_compat_decorator(self.__wrapper, func)
1688
1740
1689 def _get_request(self):
1741 def _get_request(self):
1690 return get_request(self)
1742 return get_request(self)
1691
1743
1692 def __wrapper(self, func, *fargs, **fkwargs):
1744 def __wrapper(self, func, *fargs, **fkwargs):
1693 from rhodecode.lib import helpers as h
1745 from rhodecode.lib import helpers as h
1694 cls = fargs[0]
1746 cls = fargs[0]
1695 user = cls._rhodecode_user
1747 user = cls._rhodecode_user
1696 request = self._get_request()
1748 request = self._get_request()
1697 _ = request.translate
1749 _ = request.translate
1698
1750
1699 loc = "%s:%s" % (cls.__class__.__name__, func.__name__)
1751 loc = "%s:%s" % (cls.__class__.__name__, func.__name__)
1700 log.debug('Starting login restriction checks for user: %s', user)
1752 log.debug('Starting login restriction checks for user: %s', user)
1701 # check if our IP is allowed
1753 # check if our IP is allowed
1702 ip_access_valid = True
1754 ip_access_valid = True
1703 if not user.ip_allowed:
1755 if not user.ip_allowed:
1704 h.flash(h.literal(_('IP {} not allowed'.format(user.ip_addr))),
1756 h.flash(h.literal(_('IP {} not allowed'.format(user.ip_addr))),
1705 category='warning')
1757 category='warning')
1706 ip_access_valid = False
1758 ip_access_valid = False
1707
1759
1708 # we used stored token that is extract from GET or URL param (if any)
1760 # we used stored token that is extract from GET or URL param (if any)
1709 _auth_token = request.user_auth_token
1761 _auth_token = request.user_auth_token
1710
1762
1711 # check if we used an AUTH_TOKEN and it's a valid one
1763 # check if we used an AUTH_TOKEN and it's a valid one
1712 # defined white-list of controllers which API access will be enabled
1764 # defined white-list of controllers which API access will be enabled
1713 whitelist = None
1765 whitelist = None
1714 if self.auth_token_access:
1766 if self.auth_token_access:
1715 # since this location is allowed by @LoginRequired decorator it's our
1767 # since this location is allowed by @LoginRequired decorator it's our
1716 # only whitelist
1768 # only whitelist
1717 whitelist = [loc]
1769 whitelist = [loc]
1718 auth_token_access_valid = allowed_auth_token_access(
1770 auth_token_access_valid = allowed_auth_token_access(
1719 loc, whitelist=whitelist, auth_token=_auth_token)
1771 loc, whitelist=whitelist, auth_token=_auth_token)
1720
1772
1721 # explicit controller is enabled or API is in our whitelist
1773 # explicit controller is enabled or API is in our whitelist
1722 if auth_token_access_valid:
1774 if auth_token_access_valid:
1723 log.debug('Checking AUTH TOKEN access for %s', cls)
1775 log.debug('Checking AUTH TOKEN access for %s', cls)
1724 db_user = user.get_instance()
1776 db_user = user.get_instance()
1725
1777
1726 if db_user:
1778 if db_user:
1727 if self.auth_token_access:
1779 if self.auth_token_access:
1728 roles = self.auth_token_access
1780 roles = self.auth_token_access
1729 else:
1781 else:
1730 roles = [UserApiKeys.ROLE_HTTP]
1782 roles = [UserApiKeys.ROLE_HTTP]
1731 log.debug('AUTH TOKEN: checking auth for user %s and roles %s',
1783 log.debug('AUTH TOKEN: checking auth for user %s and roles %s',
1732 db_user, roles)
1784 db_user, roles)
1733 token_match = db_user.authenticate_by_token(
1785 token_match = db_user.authenticate_by_token(
1734 _auth_token, roles=roles)
1786 _auth_token, roles=roles)
1735 else:
1787 else:
1736 log.debug('Unable to fetch db instance for auth user: %s', user)
1788 log.debug('Unable to fetch db instance for auth user: %s', user)
1737 token_match = False
1789 token_match = False
1738
1790
1739 if _auth_token and token_match:
1791 if _auth_token and token_match:
1740 auth_token_access_valid = True
1792 auth_token_access_valid = True
1741 log.debug('AUTH TOKEN ****%s is VALID', _auth_token[-4:])
1793 log.debug('AUTH TOKEN ****%s is VALID', _auth_token[-4:])
1742 else:
1794 else:
1743 auth_token_access_valid = False
1795 auth_token_access_valid = False
1744 if not _auth_token:
1796 if not _auth_token:
1745 log.debug("AUTH TOKEN *NOT* present in request")
1797 log.debug("AUTH TOKEN *NOT* present in request")
1746 else:
1798 else:
1747 log.warning("AUTH TOKEN ****%s *NOT* valid", _auth_token[-4:])
1799 log.warning("AUTH TOKEN ****%s *NOT* valid", _auth_token[-4:])
1748
1800
1749 log.debug('Checking if %s is authenticated @ %s', user.username, loc)
1801 log.debug('Checking if %s is authenticated @ %s', user.username, loc)
1750 reason = 'RHODECODE_AUTH' if user.is_authenticated \
1802 reason = 'RHODECODE_AUTH' if user.is_authenticated \
1751 else 'AUTH_TOKEN_AUTH'
1803 else 'AUTH_TOKEN_AUTH'
1752
1804
1753 if ip_access_valid and (
1805 if ip_access_valid and (
1754 user.is_authenticated or auth_token_access_valid):
1806 user.is_authenticated or auth_token_access_valid):
1755 log.info('user %s authenticating with:%s IS authenticated on func %s',
1807 log.info('user %s authenticating with:%s IS authenticated on func %s',
1756 user, reason, loc)
1808 user, reason, loc)
1757
1809
1758 return func(*fargs, **fkwargs)
1810 return func(*fargs, **fkwargs)
1759 else:
1811 else:
1760 log.warning(
1812 log.warning(
1761 'user %s authenticating with:%s NOT authenticated on '
1813 'user %s authenticating with:%s NOT authenticated on '
1762 'func: %s: IP_ACCESS:%s AUTH_TOKEN_ACCESS:%s',
1814 'func: %s: IP_ACCESS:%s AUTH_TOKEN_ACCESS:%s',
1763 user, reason, loc, ip_access_valid, auth_token_access_valid)
1815 user, reason, loc, ip_access_valid, auth_token_access_valid)
1764 # we preserve the get PARAM
1816 # we preserve the get PARAM
1765 came_from = get_came_from(request)
1817 came_from = get_came_from(request)
1766
1818
1767 log.debug('redirecting to login page with %s', came_from)
1819 log.debug('redirecting to login page with %s', came_from)
1768 raise HTTPFound(
1820 raise HTTPFound(
1769 h.route_path('login', _query={'came_from': came_from}))
1821 h.route_path('login', _query={'came_from': came_from}))
1770
1822
1771
1823
1772 class NotAnonymous(object):
1824 class NotAnonymous(object):
1773 """
1825 """
1774 Must be logged in to execute this function else
1826 Must be logged in to execute this function else
1775 redirect to login page
1827 redirect to login page
1776 """
1828 """
1777
1829
1778 def __call__(self, func):
1830 def __call__(self, func):
1779 return get_cython_compat_decorator(self.__wrapper, func)
1831 return get_cython_compat_decorator(self.__wrapper, func)
1780
1832
1781 def _get_request(self):
1833 def _get_request(self):
1782 return get_request(self)
1834 return get_request(self)
1783
1835
1784 def __wrapper(self, func, *fargs, **fkwargs):
1836 def __wrapper(self, func, *fargs, **fkwargs):
1785 import rhodecode.lib.helpers as h
1837 import rhodecode.lib.helpers as h
1786 cls = fargs[0]
1838 cls = fargs[0]
1787 self.user = cls._rhodecode_user
1839 self.user = cls._rhodecode_user
1788 request = self._get_request()
1840 request = self._get_request()
1789 _ = request.translate
1841 _ = request.translate
1790 log.debug('Checking if user is not anonymous @%s', cls)
1842 log.debug('Checking if user is not anonymous @%s', cls)
1791
1843
1792 anonymous = self.user.username == User.DEFAULT_USER
1844 anonymous = self.user.username == User.DEFAULT_USER
1793
1845
1794 if anonymous:
1846 if anonymous:
1795 came_from = get_came_from(request)
1847 came_from = get_came_from(request)
1796 h.flash(_('You need to be a registered user to '
1848 h.flash(_('You need to be a registered user to '
1797 'perform this action'),
1849 'perform this action'),
1798 category='warning')
1850 category='warning')
1799 raise HTTPFound(
1851 raise HTTPFound(
1800 h.route_path('login', _query={'came_from': came_from}))
1852 h.route_path('login', _query={'came_from': came_from}))
1801 else:
1853 else:
1802 return func(*fargs, **fkwargs)
1854 return func(*fargs, **fkwargs)
1803
1855
1804
1856
1805 class PermsDecorator(object):
1857 class PermsDecorator(object):
1806 """
1858 """
1807 Base class for controller decorators, we extract the current user from
1859 Base class for controller decorators, we extract the current user from
1808 the class itself, which has it stored in base controllers
1860 the class itself, which has it stored in base controllers
1809 """
1861 """
1810
1862
1811 def __init__(self, *required_perms):
1863 def __init__(self, *required_perms):
1812 self.required_perms = set(required_perms)
1864 self.required_perms = set(required_perms)
1813
1865
1814 def __call__(self, func):
1866 def __call__(self, func):
1815 return get_cython_compat_decorator(self.__wrapper, func)
1867 return get_cython_compat_decorator(self.__wrapper, func)
1816
1868
1817 def _get_request(self):
1869 def _get_request(self):
1818 return get_request(self)
1870 return get_request(self)
1819
1871
1820 def __wrapper(self, func, *fargs, **fkwargs):
1872 def __wrapper(self, func, *fargs, **fkwargs):
1821 import rhodecode.lib.helpers as h
1873 import rhodecode.lib.helpers as h
1822 cls = fargs[0]
1874 cls = fargs[0]
1823 _user = cls._rhodecode_user
1875 _user = cls._rhodecode_user
1824 request = self._get_request()
1876 request = self._get_request()
1825 _ = request.translate
1877 _ = request.translate
1826
1878
1827 log.debug('checking %s permissions %s for %s %s',
1879 log.debug('checking %s permissions %s for %s %s',
1828 self.__class__.__name__, self.required_perms, cls, _user)
1880 self.__class__.__name__, self.required_perms, cls, _user)
1829
1881
1830 if self.check_permissions(_user):
1882 if self.check_permissions(_user):
1831 log.debug('Permission granted for %s %s', cls, _user)
1883 log.debug('Permission granted for %s %s', cls, _user)
1832 return func(*fargs, **fkwargs)
1884 return func(*fargs, **fkwargs)
1833
1885
1834 else:
1886 else:
1835 log.debug('Permission denied for %s %s', cls, _user)
1887 log.debug('Permission denied for %s %s', cls, _user)
1836 anonymous = _user.username == User.DEFAULT_USER
1888 anonymous = _user.username == User.DEFAULT_USER
1837
1889
1838 if anonymous:
1890 if anonymous:
1839 came_from = get_came_from(self._get_request())
1891 came_from = get_came_from(self._get_request())
1840 h.flash(_('You need to be signed in to view this page'),
1892 h.flash(_('You need to be signed in to view this page'),
1841 category='warning')
1893 category='warning')
1842 raise HTTPFound(
1894 raise HTTPFound(
1843 h.route_path('login', _query={'came_from': came_from}))
1895 h.route_path('login', _query={'came_from': came_from}))
1844
1896
1845 else:
1897 else:
1846 # redirect with 404 to prevent resource discovery
1898 # redirect with 404 to prevent resource discovery
1847 raise HTTPNotFound()
1899 raise HTTPNotFound()
1848
1900
1849 def check_permissions(self, user):
1901 def check_permissions(self, user):
1850 """Dummy function for overriding"""
1902 """Dummy function for overriding"""
1851 raise NotImplementedError(
1903 raise NotImplementedError(
1852 'You have to write this function in child class')
1904 'You have to write this function in child class')
1853
1905
1854
1906
1855 class HasPermissionAllDecorator(PermsDecorator):
1907 class HasPermissionAllDecorator(PermsDecorator):
1856 """
1908 """
1857 Checks for access permission for all given predicates. All of them
1909 Checks for access permission for all given predicates. All of them
1858 have to be meet in order to fulfill the request
1910 have to be meet in order to fulfill the request
1859 """
1911 """
1860
1912
1861 def check_permissions(self, user):
1913 def check_permissions(self, user):
1862 perms = user.permissions_with_scope({})
1914 perms = user.permissions_with_scope({})
1863 if self.required_perms.issubset(perms['global']):
1915 if self.required_perms.issubset(perms['global']):
1864 return True
1916 return True
1865 return False
1917 return False
1866
1918
1867
1919
1868 class HasPermissionAnyDecorator(PermsDecorator):
1920 class HasPermissionAnyDecorator(PermsDecorator):
1869 """
1921 """
1870 Checks for access permission for any of given predicates. In order to
1922 Checks for access permission for any of given predicates. In order to
1871 fulfill the request any of predicates must be meet
1923 fulfill the request any of predicates must be meet
1872 """
1924 """
1873
1925
1874 def check_permissions(self, user):
1926 def check_permissions(self, user):
1875 perms = user.permissions_with_scope({})
1927 perms = user.permissions_with_scope({})
1876 if self.required_perms.intersection(perms['global']):
1928 if self.required_perms.intersection(perms['global']):
1877 return True
1929 return True
1878 return False
1930 return False
1879
1931
1880
1932
1881 class HasRepoPermissionAllDecorator(PermsDecorator):
1933 class HasRepoPermissionAllDecorator(PermsDecorator):
1882 """
1934 """
1883 Checks for access permission for all given predicates for specific
1935 Checks for access permission for all given predicates for specific
1884 repository. All of them have to be meet in order to fulfill the request
1936 repository. All of them have to be meet in order to fulfill the request
1885 """
1937 """
1886 def _get_repo_name(self):
1938 def _get_repo_name(self):
1887 _request = self._get_request()
1939 _request = self._get_request()
1888 return get_repo_slug(_request)
1940 return get_repo_slug(_request)
1889
1941
1890 def check_permissions(self, user):
1942 def check_permissions(self, user):
1891 perms = user.permissions
1943 perms = user.permissions
1892 repo_name = self._get_repo_name()
1944 repo_name = self._get_repo_name()
1893
1945
1894 try:
1946 try:
1895 user_perms = {perms['repositories'][repo_name]}
1947 user_perms = {perms['repositories'][repo_name]}
1896 except KeyError:
1948 except KeyError:
1897 log.debug('cannot locate repo with name: `%s` in permissions defs',
1949 log.debug('cannot locate repo with name: `%s` in permissions defs',
1898 repo_name)
1950 repo_name)
1899 return False
1951 return False
1900
1952
1901 log.debug('checking `%s` permissions for repo `%s`',
1953 log.debug('checking `%s` permissions for repo `%s`',
1902 user_perms, repo_name)
1954 user_perms, repo_name)
1903 if self.required_perms.issubset(user_perms):
1955 if self.required_perms.issubset(user_perms):
1904 return True
1956 return True
1905 return False
1957 return False
1906
1958
1907
1959
1908 class HasRepoPermissionAnyDecorator(PermsDecorator):
1960 class HasRepoPermissionAnyDecorator(PermsDecorator):
1909 """
1961 """
1910 Checks for access permission for any of given predicates for specific
1962 Checks for access permission for any of given predicates for specific
1911 repository. In order to fulfill the request any of predicates must be meet
1963 repository. In order to fulfill the request any of predicates must be meet
1912 """
1964 """
1913 def _get_repo_name(self):
1965 def _get_repo_name(self):
1914 _request = self._get_request()
1966 _request = self._get_request()
1915 return get_repo_slug(_request)
1967 return get_repo_slug(_request)
1916
1968
1917 def check_permissions(self, user):
1969 def check_permissions(self, user):
1918 perms = user.permissions
1970 perms = user.permissions
1919 repo_name = self._get_repo_name()
1971 repo_name = self._get_repo_name()
1920
1972
1921 try:
1973 try:
1922 user_perms = {perms['repositories'][repo_name]}
1974 user_perms = {perms['repositories'][repo_name]}
1923 except KeyError:
1975 except KeyError:
1924 log.debug(
1976 log.debug(
1925 'cannot locate repo with name: `%s` in permissions defs',
1977 'cannot locate repo with name: `%s` in permissions defs',
1926 repo_name)
1978 repo_name)
1927 return False
1979 return False
1928
1980
1929 log.debug('checking `%s` permissions for repo `%s`',
1981 log.debug('checking `%s` permissions for repo `%s`',
1930 user_perms, repo_name)
1982 user_perms, repo_name)
1931 if self.required_perms.intersection(user_perms):
1983 if self.required_perms.intersection(user_perms):
1932 return True
1984 return True
1933 return False
1985 return False
1934
1986
1935
1987
1936 class HasRepoGroupPermissionAllDecorator(PermsDecorator):
1988 class HasRepoGroupPermissionAllDecorator(PermsDecorator):
1937 """
1989 """
1938 Checks for access permission for all given predicates for specific
1990 Checks for access permission for all given predicates for specific
1939 repository group. All of them have to be meet in order to
1991 repository group. All of them have to be meet in order to
1940 fulfill the request
1992 fulfill the request
1941 """
1993 """
1942 def _get_repo_group_name(self):
1994 def _get_repo_group_name(self):
1943 _request = self._get_request()
1995 _request = self._get_request()
1944 return get_repo_group_slug(_request)
1996 return get_repo_group_slug(_request)
1945
1997
1946 def check_permissions(self, user):
1998 def check_permissions(self, user):
1947 perms = user.permissions
1999 perms = user.permissions
1948 group_name = self._get_repo_group_name()
2000 group_name = self._get_repo_group_name()
1949 try:
2001 try:
1950 user_perms = {perms['repositories_groups'][group_name]}
2002 user_perms = {perms['repositories_groups'][group_name]}
1951 except KeyError:
2003 except KeyError:
1952 log.debug(
2004 log.debug(
1953 'cannot locate repo group with name: `%s` in permissions defs',
2005 'cannot locate repo group with name: `%s` in permissions defs',
1954 group_name)
2006 group_name)
1955 return False
2007 return False
1956
2008
1957 log.debug('checking `%s` permissions for repo group `%s`',
2009 log.debug('checking `%s` permissions for repo group `%s`',
1958 user_perms, group_name)
2010 user_perms, group_name)
1959 if self.required_perms.issubset(user_perms):
2011 if self.required_perms.issubset(user_perms):
1960 return True
2012 return True
1961 return False
2013 return False
1962
2014
1963
2015
1964 class HasRepoGroupPermissionAnyDecorator(PermsDecorator):
2016 class HasRepoGroupPermissionAnyDecorator(PermsDecorator):
1965 """
2017 """
1966 Checks for access permission for any of given predicates for specific
2018 Checks for access permission for any of given predicates for specific
1967 repository group. In order to fulfill the request any
2019 repository group. In order to fulfill the request any
1968 of predicates must be met
2020 of predicates must be met
1969 """
2021 """
1970 def _get_repo_group_name(self):
2022 def _get_repo_group_name(self):
1971 _request = self._get_request()
2023 _request = self._get_request()
1972 return get_repo_group_slug(_request)
2024 return get_repo_group_slug(_request)
1973
2025
1974 def check_permissions(self, user):
2026 def check_permissions(self, user):
1975 perms = user.permissions
2027 perms = user.permissions
1976 group_name = self._get_repo_group_name()
2028 group_name = self._get_repo_group_name()
1977
2029
1978 try:
2030 try:
1979 user_perms = {perms['repositories_groups'][group_name]}
2031 user_perms = {perms['repositories_groups'][group_name]}
1980 except KeyError:
2032 except KeyError:
1981 log.debug(
2033 log.debug(
1982 'cannot locate repo group with name: `%s` in permissions defs',
2034 'cannot locate repo group with name: `%s` in permissions defs',
1983 group_name)
2035 group_name)
1984 return False
2036 return False
1985
2037
1986 log.debug('checking `%s` permissions for repo group `%s`',
2038 log.debug('checking `%s` permissions for repo group `%s`',
1987 user_perms, group_name)
2039 user_perms, group_name)
1988 if self.required_perms.intersection(user_perms):
2040 if self.required_perms.intersection(user_perms):
1989 return True
2041 return True
1990 return False
2042 return False
1991
2043
1992
2044
1993 class HasUserGroupPermissionAllDecorator(PermsDecorator):
2045 class HasUserGroupPermissionAllDecorator(PermsDecorator):
1994 """
2046 """
1995 Checks for access permission for all given predicates for specific
2047 Checks for access permission for all given predicates for specific
1996 user group. All of them have to be meet in order to fulfill the request
2048 user group. All of them have to be meet in order to fulfill the request
1997 """
2049 """
1998 def _get_user_group_name(self):
2050 def _get_user_group_name(self):
1999 _request = self._get_request()
2051 _request = self._get_request()
2000 return get_user_group_slug(_request)
2052 return get_user_group_slug(_request)
2001
2053
2002 def check_permissions(self, user):
2054 def check_permissions(self, user):
2003 perms = user.permissions
2055 perms = user.permissions
2004 group_name = self._get_user_group_name()
2056 group_name = self._get_user_group_name()
2005 try:
2057 try:
2006 user_perms = {perms['user_groups'][group_name]}
2058 user_perms = {perms['user_groups'][group_name]}
2007 except KeyError:
2059 except KeyError:
2008 return False
2060 return False
2009
2061
2010 if self.required_perms.issubset(user_perms):
2062 if self.required_perms.issubset(user_perms):
2011 return True
2063 return True
2012 return False
2064 return False
2013
2065
2014
2066
2015 class HasUserGroupPermissionAnyDecorator(PermsDecorator):
2067 class HasUserGroupPermissionAnyDecorator(PermsDecorator):
2016 """
2068 """
2017 Checks for access permission for any of given predicates for specific
2069 Checks for access permission for any of given predicates for specific
2018 user group. In order to fulfill the request any of predicates must be meet
2070 user group. In order to fulfill the request any of predicates must be meet
2019 """
2071 """
2020 def _get_user_group_name(self):
2072 def _get_user_group_name(self):
2021 _request = self._get_request()
2073 _request = self._get_request()
2022 return get_user_group_slug(_request)
2074 return get_user_group_slug(_request)
2023
2075
2024 def check_permissions(self, user):
2076 def check_permissions(self, user):
2025 perms = user.permissions
2077 perms = user.permissions
2026 group_name = self._get_user_group_name()
2078 group_name = self._get_user_group_name()
2027 try:
2079 try:
2028 user_perms = {perms['user_groups'][group_name]}
2080 user_perms = {perms['user_groups'][group_name]}
2029 except KeyError:
2081 except KeyError:
2030 return False
2082 return False
2031
2083
2032 if self.required_perms.intersection(user_perms):
2084 if self.required_perms.intersection(user_perms):
2033 return True
2085 return True
2034 return False
2086 return False
2035
2087
2036
2088
2037 # CHECK FUNCTIONS
2089 # CHECK FUNCTIONS
2038 class PermsFunction(object):
2090 class PermsFunction(object):
2039 """Base function for other check functions"""
2091 """Base function for other check functions"""
2040
2092
2041 def __init__(self, *perms):
2093 def __init__(self, *perms):
2042 self.required_perms = set(perms)
2094 self.required_perms = set(perms)
2043 self.repo_name = None
2095 self.repo_name = None
2044 self.repo_group_name = None
2096 self.repo_group_name = None
2045 self.user_group_name = None
2097 self.user_group_name = None
2046
2098
2047 def __bool__(self):
2099 def __bool__(self):
2048 import inspect
2100 import inspect
2049 frame = inspect.currentframe()
2101 frame = inspect.currentframe()
2050 stack_trace = traceback.format_stack(frame)
2102 stack_trace = traceback.format_stack(frame)
2051 log.error('Checking bool value on a class instance of perm '
2103 log.error('Checking bool value on a class instance of perm '
2052 'function is not allowed: %s', ''.join(stack_trace))
2104 'function is not allowed: %s', ''.join(stack_trace))
2053 # rather than throwing errors, here we always return False so if by
2105 # rather than throwing errors, here we always return False so if by
2054 # accident someone checks truth for just an instance it will always end
2106 # accident someone checks truth for just an instance it will always end
2055 # up in returning False
2107 # up in returning False
2056 return False
2108 return False
2057 __nonzero__ = __bool__
2109 __nonzero__ = __bool__
2058
2110
2059 def __call__(self, check_location='', user=None):
2111 def __call__(self, check_location='', user=None):
2060 if not user:
2112 if not user:
2061 log.debug('Using user attribute from global request')
2113 log.debug('Using user attribute from global request')
2062 request = self._get_request()
2114 request = self._get_request()
2063 user = request.user
2115 user = request.user
2064
2116
2065 # init auth user if not already given
2117 # init auth user if not already given
2066 if not isinstance(user, AuthUser):
2118 if not isinstance(user, AuthUser):
2067 log.debug('Wrapping user %s into AuthUser', user)
2119 log.debug('Wrapping user %s into AuthUser', user)
2068 user = AuthUser(user.user_id)
2120 user = AuthUser(user.user_id)
2069
2121
2070 cls_name = self.__class__.__name__
2122 cls_name = self.__class__.__name__
2071 check_scope = self._get_check_scope(cls_name)
2123 check_scope = self._get_check_scope(cls_name)
2072 check_location = check_location or 'unspecified location'
2124 check_location = check_location or 'unspecified location'
2073
2125
2074 log.debug('checking cls:%s %s usr:%s %s @ %s', cls_name,
2126 log.debug('checking cls:%s %s usr:%s %s @ %s', cls_name,
2075 self.required_perms, user, check_scope, check_location)
2127 self.required_perms, user, check_scope, check_location)
2076 if not user:
2128 if not user:
2077 log.warning('Empty user given for permission check')
2129 log.warning('Empty user given for permission check')
2078 return False
2130 return False
2079
2131
2080 if self.check_permissions(user):
2132 if self.check_permissions(user):
2081 log.debug('Permission to repo:`%s` GRANTED for user:`%s` @ %s',
2133 log.debug('Permission to repo:`%s` GRANTED for user:`%s` @ %s',
2082 check_scope, user, check_location)
2134 check_scope, user, check_location)
2083 return True
2135 return True
2084
2136
2085 else:
2137 else:
2086 log.debug('Permission to repo:`%s` DENIED for user:`%s` @ %s',
2138 log.debug('Permission to repo:`%s` DENIED for user:`%s` @ %s',
2087 check_scope, user, check_location)
2139 check_scope, user, check_location)
2088 return False
2140 return False
2089
2141
2090 def _get_request(self):
2142 def _get_request(self):
2091 return get_request(self)
2143 return get_request(self)
2092
2144
2093 def _get_check_scope(self, cls_name):
2145 def _get_check_scope(self, cls_name):
2094 return {
2146 return {
2095 'HasPermissionAll': 'GLOBAL',
2147 'HasPermissionAll': 'GLOBAL',
2096 'HasPermissionAny': 'GLOBAL',
2148 'HasPermissionAny': 'GLOBAL',
2097 'HasRepoPermissionAll': 'repo:%s' % self.repo_name,
2149 'HasRepoPermissionAll': 'repo:%s' % self.repo_name,
2098 'HasRepoPermissionAny': 'repo:%s' % self.repo_name,
2150 'HasRepoPermissionAny': 'repo:%s' % self.repo_name,
2099 'HasRepoGroupPermissionAll': 'repo_group:%s' % self.repo_group_name,
2151 'HasRepoGroupPermissionAll': 'repo_group:%s' % self.repo_group_name,
2100 'HasRepoGroupPermissionAny': 'repo_group:%s' % self.repo_group_name,
2152 'HasRepoGroupPermissionAny': 'repo_group:%s' % self.repo_group_name,
2101 'HasUserGroupPermissionAll': 'user_group:%s' % self.user_group_name,
2153 'HasUserGroupPermissionAll': 'user_group:%s' % self.user_group_name,
2102 'HasUserGroupPermissionAny': 'user_group:%s' % self.user_group_name,
2154 'HasUserGroupPermissionAny': 'user_group:%s' % self.user_group_name,
2103 }.get(cls_name, '?:%s' % cls_name)
2155 }.get(cls_name, '?:%s' % cls_name)
2104
2156
2105 def check_permissions(self, user):
2157 def check_permissions(self, user):
2106 """Dummy function for overriding"""
2158 """Dummy function for overriding"""
2107 raise Exception('You have to write this function in child class')
2159 raise Exception('You have to write this function in child class')
2108
2160
2109
2161
2110 class HasPermissionAll(PermsFunction):
2162 class HasPermissionAll(PermsFunction):
2111 def check_permissions(self, user):
2163 def check_permissions(self, user):
2112 perms = user.permissions_with_scope({})
2164 perms = user.permissions_with_scope({})
2113 if self.required_perms.issubset(perms.get('global')):
2165 if self.required_perms.issubset(perms.get('global')):
2114 return True
2166 return True
2115 return False
2167 return False
2116
2168
2117
2169
2118 class HasPermissionAny(PermsFunction):
2170 class HasPermissionAny(PermsFunction):
2119 def check_permissions(self, user):
2171 def check_permissions(self, user):
2120 perms = user.permissions_with_scope({})
2172 perms = user.permissions_with_scope({})
2121 if self.required_perms.intersection(perms.get('global')):
2173 if self.required_perms.intersection(perms.get('global')):
2122 return True
2174 return True
2123 return False
2175 return False
2124
2176
2125
2177
2126 class HasRepoPermissionAll(PermsFunction):
2178 class HasRepoPermissionAll(PermsFunction):
2127 def __call__(self, repo_name=None, check_location='', user=None):
2179 def __call__(self, repo_name=None, check_location='', user=None):
2128 self.repo_name = repo_name
2180 self.repo_name = repo_name
2129 return super(HasRepoPermissionAll, self).__call__(check_location, user)
2181 return super(HasRepoPermissionAll, self).__call__(check_location, user)
2130
2182
2131 def _get_repo_name(self):
2183 def _get_repo_name(self):
2132 if not self.repo_name:
2184 if not self.repo_name:
2133 _request = self._get_request()
2185 _request = self._get_request()
2134 self.repo_name = get_repo_slug(_request)
2186 self.repo_name = get_repo_slug(_request)
2135 return self.repo_name
2187 return self.repo_name
2136
2188
2137 def check_permissions(self, user):
2189 def check_permissions(self, user):
2138 self.repo_name = self._get_repo_name()
2190 self.repo_name = self._get_repo_name()
2139 perms = user.permissions
2191 perms = user.permissions
2140 try:
2192 try:
2141 user_perms = {perms['repositories'][self.repo_name]}
2193 user_perms = {perms['repositories'][self.repo_name]}
2142 except KeyError:
2194 except KeyError:
2143 return False
2195 return False
2144 if self.required_perms.issubset(user_perms):
2196 if self.required_perms.issubset(user_perms):
2145 return True
2197 return True
2146 return False
2198 return False
2147
2199
2148
2200
2149 class HasRepoPermissionAny(PermsFunction):
2201 class HasRepoPermissionAny(PermsFunction):
2150 def __call__(self, repo_name=None, check_location='', user=None):
2202 def __call__(self, repo_name=None, check_location='', user=None):
2151 self.repo_name = repo_name
2203 self.repo_name = repo_name
2152 return super(HasRepoPermissionAny, self).__call__(check_location, user)
2204 return super(HasRepoPermissionAny, self).__call__(check_location, user)
2153
2205
2154 def _get_repo_name(self):
2206 def _get_repo_name(self):
2155 if not self.repo_name:
2207 if not self.repo_name:
2156 _request = self._get_request()
2208 _request = self._get_request()
2157 self.repo_name = get_repo_slug(_request)
2209 self.repo_name = get_repo_slug(_request)
2158 return self.repo_name
2210 return self.repo_name
2159
2211
2160 def check_permissions(self, user):
2212 def check_permissions(self, user):
2161 self.repo_name = self._get_repo_name()
2213 self.repo_name = self._get_repo_name()
2162 perms = user.permissions
2214 perms = user.permissions
2163 try:
2215 try:
2164 user_perms = {perms['repositories'][self.repo_name]}
2216 user_perms = {perms['repositories'][self.repo_name]}
2165 except KeyError:
2217 except KeyError:
2166 return False
2218 return False
2167 if self.required_perms.intersection(user_perms):
2219 if self.required_perms.intersection(user_perms):
2168 return True
2220 return True
2169 return False
2221 return False
2170
2222
2171
2223
2172 class HasRepoGroupPermissionAny(PermsFunction):
2224 class HasRepoGroupPermissionAny(PermsFunction):
2173 def __call__(self, group_name=None, check_location='', user=None):
2225 def __call__(self, group_name=None, check_location='', user=None):
2174 self.repo_group_name = group_name
2226 self.repo_group_name = group_name
2175 return super(HasRepoGroupPermissionAny, self).__call__(check_location, user)
2227 return super(HasRepoGroupPermissionAny, self).__call__(check_location, user)
2176
2228
2177 def check_permissions(self, user):
2229 def check_permissions(self, user):
2178 perms = user.permissions
2230 perms = user.permissions
2179 try:
2231 try:
2180 user_perms = {perms['repositories_groups'][self.repo_group_name]}
2232 user_perms = {perms['repositories_groups'][self.repo_group_name]}
2181 except KeyError:
2233 except KeyError:
2182 return False
2234 return False
2183 if self.required_perms.intersection(user_perms):
2235 if self.required_perms.intersection(user_perms):
2184 return True
2236 return True
2185 return False
2237 return False
2186
2238
2187
2239
2188 class HasRepoGroupPermissionAll(PermsFunction):
2240 class HasRepoGroupPermissionAll(PermsFunction):
2189 def __call__(self, group_name=None, check_location='', user=None):
2241 def __call__(self, group_name=None, check_location='', user=None):
2190 self.repo_group_name = group_name
2242 self.repo_group_name = group_name
2191 return super(HasRepoGroupPermissionAll, self).__call__(check_location, user)
2243 return super(HasRepoGroupPermissionAll, self).__call__(check_location, user)
2192
2244
2193 def check_permissions(self, user):
2245 def check_permissions(self, user):
2194 perms = user.permissions
2246 perms = user.permissions
2195 try:
2247 try:
2196 user_perms = {perms['repositories_groups'][self.repo_group_name]}
2248 user_perms = {perms['repositories_groups'][self.repo_group_name]}
2197 except KeyError:
2249 except KeyError:
2198 return False
2250 return False
2199 if self.required_perms.issubset(user_perms):
2251 if self.required_perms.issubset(user_perms):
2200 return True
2252 return True
2201 return False
2253 return False
2202
2254
2203
2255
2204 class HasUserGroupPermissionAny(PermsFunction):
2256 class HasUserGroupPermissionAny(PermsFunction):
2205 def __call__(self, user_group_name=None, check_location='', user=None):
2257 def __call__(self, user_group_name=None, check_location='', user=None):
2206 self.user_group_name = user_group_name
2258 self.user_group_name = user_group_name
2207 return super(HasUserGroupPermissionAny, self).__call__(check_location, user)
2259 return super(HasUserGroupPermissionAny, self).__call__(check_location, user)
2208
2260
2209 def check_permissions(self, user):
2261 def check_permissions(self, user):
2210 perms = user.permissions
2262 perms = user.permissions
2211 try:
2263 try:
2212 user_perms = {perms['user_groups'][self.user_group_name]}
2264 user_perms = {perms['user_groups'][self.user_group_name]}
2213 except KeyError:
2265 except KeyError:
2214 return False
2266 return False
2215 if self.required_perms.intersection(user_perms):
2267 if self.required_perms.intersection(user_perms):
2216 return True
2268 return True
2217 return False
2269 return False
2218
2270
2219
2271
2220 class HasUserGroupPermissionAll(PermsFunction):
2272 class HasUserGroupPermissionAll(PermsFunction):
2221 def __call__(self, user_group_name=None, check_location='', user=None):
2273 def __call__(self, user_group_name=None, check_location='', user=None):
2222 self.user_group_name = user_group_name
2274 self.user_group_name = user_group_name
2223 return super(HasUserGroupPermissionAll, self).__call__(check_location, user)
2275 return super(HasUserGroupPermissionAll, self).__call__(check_location, user)
2224
2276
2225 def check_permissions(self, user):
2277 def check_permissions(self, user):
2226 perms = user.permissions
2278 perms = user.permissions
2227 try:
2279 try:
2228 user_perms = {perms['user_groups'][self.user_group_name]}
2280 user_perms = {perms['user_groups'][self.user_group_name]}
2229 except KeyError:
2281 except KeyError:
2230 return False
2282 return False
2231 if self.required_perms.issubset(user_perms):
2283 if self.required_perms.issubset(user_perms):
2232 return True
2284 return True
2233 return False
2285 return False
2234
2286
2235
2287
2236 # SPECIAL VERSION TO HANDLE MIDDLEWARE AUTH
2288 # SPECIAL VERSION TO HANDLE MIDDLEWARE AUTH
2237 class HasPermissionAnyMiddleware(object):
2289 class HasPermissionAnyMiddleware(object):
2238 def __init__(self, *perms):
2290 def __init__(self, *perms):
2239 self.required_perms = set(perms)
2291 self.required_perms = set(perms)
2240
2292
2241 def __call__(self, auth_user, repo_name):
2293 def __call__(self, auth_user, repo_name):
2242 # repo_name MUST be unicode, since we handle keys in permission
2294 # repo_name MUST be unicode, since we handle keys in permission
2243 # dict by unicode
2295 # dict by unicode
2244 repo_name = safe_unicode(repo_name)
2296 repo_name = safe_unicode(repo_name)
2245 log.debug(
2297 log.debug(
2246 'Checking VCS protocol permissions %s for user:%s repo:`%s`',
2298 'Checking VCS protocol permissions %s for user:%s repo:`%s`',
2247 self.required_perms, auth_user, repo_name)
2299 self.required_perms, auth_user, repo_name)
2248
2300
2249 if self.check_permissions(auth_user, repo_name):
2301 if self.check_permissions(auth_user, repo_name):
2250 log.debug('Permission to repo:`%s` GRANTED for user:%s @ %s',
2302 log.debug('Permission to repo:`%s` GRANTED for user:%s @ %s',
2251 repo_name, auth_user, 'PermissionMiddleware')
2303 repo_name, auth_user, 'PermissionMiddleware')
2252 return True
2304 return True
2253
2305
2254 else:
2306 else:
2255 log.debug('Permission to repo:`%s` DENIED for user:%s @ %s',
2307 log.debug('Permission to repo:`%s` DENIED for user:%s @ %s',
2256 repo_name, auth_user, 'PermissionMiddleware')
2308 repo_name, auth_user, 'PermissionMiddleware')
2257 return False
2309 return False
2258
2310
2259 def check_permissions(self, user, repo_name):
2311 def check_permissions(self, user, repo_name):
2260 perms = user.permissions_with_scope({'repo_name': repo_name})
2312 perms = user.permissions_with_scope({'repo_name': repo_name})
2261
2313
2262 try:
2314 try:
2263 user_perms = {perms['repositories'][repo_name]}
2315 user_perms = {perms['repositories'][repo_name]}
2264 except Exception:
2316 except Exception:
2265 log.exception('Error while accessing user permissions')
2317 log.exception('Error while accessing user permissions')
2266 return False
2318 return False
2267
2319
2268 if self.required_perms.intersection(user_perms):
2320 if self.required_perms.intersection(user_perms):
2269 return True
2321 return True
2270 return False
2322 return False
2271
2323
2272
2324
2273 # SPECIAL VERSION TO HANDLE API AUTH
2325 # SPECIAL VERSION TO HANDLE API AUTH
2274 class _BaseApiPerm(object):
2326 class _BaseApiPerm(object):
2275 def __init__(self, *perms):
2327 def __init__(self, *perms):
2276 self.required_perms = set(perms)
2328 self.required_perms = set(perms)
2277
2329
2278 def __call__(self, check_location=None, user=None, repo_name=None,
2330 def __call__(self, check_location=None, user=None, repo_name=None,
2279 group_name=None, user_group_name=None):
2331 group_name=None, user_group_name=None):
2280 cls_name = self.__class__.__name__
2332 cls_name = self.__class__.__name__
2281 check_scope = 'global:%s' % (self.required_perms,)
2333 check_scope = 'global:%s' % (self.required_perms,)
2282 if repo_name:
2334 if repo_name:
2283 check_scope += ', repo_name:%s' % (repo_name,)
2335 check_scope += ', repo_name:%s' % (repo_name,)
2284
2336
2285 if group_name:
2337 if group_name:
2286 check_scope += ', repo_group_name:%s' % (group_name,)
2338 check_scope += ', repo_group_name:%s' % (group_name,)
2287
2339
2288 if user_group_name:
2340 if user_group_name:
2289 check_scope += ', user_group_name:%s' % (user_group_name,)
2341 check_scope += ', user_group_name:%s' % (user_group_name,)
2290
2342
2291 log.debug('checking cls:%s %s %s @ %s',
2343 log.debug('checking cls:%s %s %s @ %s',
2292 cls_name, self.required_perms, check_scope, check_location)
2344 cls_name, self.required_perms, check_scope, check_location)
2293 if not user:
2345 if not user:
2294 log.debug('Empty User passed into arguments')
2346 log.debug('Empty User passed into arguments')
2295 return False
2347 return False
2296
2348
2297 # process user
2349 # process user
2298 if not isinstance(user, AuthUser):
2350 if not isinstance(user, AuthUser):
2299 user = AuthUser(user.user_id)
2351 user = AuthUser(user.user_id)
2300 if not check_location:
2352 if not check_location:
2301 check_location = 'unspecified'
2353 check_location = 'unspecified'
2302 if self.check_permissions(user.permissions, repo_name, group_name,
2354 if self.check_permissions(user.permissions, repo_name, group_name,
2303 user_group_name):
2355 user_group_name):
2304 log.debug('Permission to repo:`%s` GRANTED for user:`%s` @ %s',
2356 log.debug('Permission to repo:`%s` GRANTED for user:`%s` @ %s',
2305 check_scope, user, check_location)
2357 check_scope, user, check_location)
2306 return True
2358 return True
2307
2359
2308 else:
2360 else:
2309 log.debug('Permission to repo:`%s` DENIED for user:`%s` @ %s',
2361 log.debug('Permission to repo:`%s` DENIED for user:`%s` @ %s',
2310 check_scope, user, check_location)
2362 check_scope, user, check_location)
2311 return False
2363 return False
2312
2364
2313 def check_permissions(self, perm_defs, repo_name=None, group_name=None,
2365 def check_permissions(self, perm_defs, repo_name=None, group_name=None,
2314 user_group_name=None):
2366 user_group_name=None):
2315 """
2367 """
2316 implement in child class should return True if permissions are ok,
2368 implement in child class should return True if permissions are ok,
2317 False otherwise
2369 False otherwise
2318
2370
2319 :param perm_defs: dict with permission definitions
2371 :param perm_defs: dict with permission definitions
2320 :param repo_name: repo name
2372 :param repo_name: repo name
2321 """
2373 """
2322 raise NotImplementedError()
2374 raise NotImplementedError()
2323
2375
2324
2376
2325 class HasPermissionAllApi(_BaseApiPerm):
2377 class HasPermissionAllApi(_BaseApiPerm):
2326 def check_permissions(self, perm_defs, repo_name=None, group_name=None,
2378 def check_permissions(self, perm_defs, repo_name=None, group_name=None,
2327 user_group_name=None):
2379 user_group_name=None):
2328 if self.required_perms.issubset(perm_defs.get('global')):
2380 if self.required_perms.issubset(perm_defs.get('global')):
2329 return True
2381 return True
2330 return False
2382 return False
2331
2383
2332
2384
2333 class HasPermissionAnyApi(_BaseApiPerm):
2385 class HasPermissionAnyApi(_BaseApiPerm):
2334 def check_permissions(self, perm_defs, repo_name=None, group_name=None,
2386 def check_permissions(self, perm_defs, repo_name=None, group_name=None,
2335 user_group_name=None):
2387 user_group_name=None):
2336 if self.required_perms.intersection(perm_defs.get('global')):
2388 if self.required_perms.intersection(perm_defs.get('global')):
2337 return True
2389 return True
2338 return False
2390 return False
2339
2391
2340
2392
2341 class HasRepoPermissionAllApi(_BaseApiPerm):
2393 class HasRepoPermissionAllApi(_BaseApiPerm):
2342 def check_permissions(self, perm_defs, repo_name=None, group_name=None,
2394 def check_permissions(self, perm_defs, repo_name=None, group_name=None,
2343 user_group_name=None):
2395 user_group_name=None):
2344 try:
2396 try:
2345 _user_perms = {perm_defs['repositories'][repo_name]}
2397 _user_perms = {perm_defs['repositories'][repo_name]}
2346 except KeyError:
2398 except KeyError:
2347 log.warning(traceback.format_exc())
2399 log.warning(traceback.format_exc())
2348 return False
2400 return False
2349 if self.required_perms.issubset(_user_perms):
2401 if self.required_perms.issubset(_user_perms):
2350 return True
2402 return True
2351 return False
2403 return False
2352
2404
2353
2405
2354 class HasRepoPermissionAnyApi(_BaseApiPerm):
2406 class HasRepoPermissionAnyApi(_BaseApiPerm):
2355 def check_permissions(self, perm_defs, repo_name=None, group_name=None,
2407 def check_permissions(self, perm_defs, repo_name=None, group_name=None,
2356 user_group_name=None):
2408 user_group_name=None):
2357 try:
2409 try:
2358 _user_perms = {perm_defs['repositories'][repo_name]}
2410 _user_perms = {perm_defs['repositories'][repo_name]}
2359 except KeyError:
2411 except KeyError:
2360 log.warning(traceback.format_exc())
2412 log.warning(traceback.format_exc())
2361 return False
2413 return False
2362 if self.required_perms.intersection(_user_perms):
2414 if self.required_perms.intersection(_user_perms):
2363 return True
2415 return True
2364 return False
2416 return False
2365
2417
2366
2418
2367 class HasRepoGroupPermissionAnyApi(_BaseApiPerm):
2419 class HasRepoGroupPermissionAnyApi(_BaseApiPerm):
2368 def check_permissions(self, perm_defs, repo_name=None, group_name=None,
2420 def check_permissions(self, perm_defs, repo_name=None, group_name=None,
2369 user_group_name=None):
2421 user_group_name=None):
2370 try:
2422 try:
2371 _user_perms = {perm_defs['repositories_groups'][group_name]}
2423 _user_perms = {perm_defs['repositories_groups'][group_name]}
2372 except KeyError:
2424 except KeyError:
2373 log.warning(traceback.format_exc())
2425 log.warning(traceback.format_exc())
2374 return False
2426 return False
2375 if self.required_perms.intersection(_user_perms):
2427 if self.required_perms.intersection(_user_perms):
2376 return True
2428 return True
2377 return False
2429 return False
2378
2430
2379
2431
2380 class HasRepoGroupPermissionAllApi(_BaseApiPerm):
2432 class HasRepoGroupPermissionAllApi(_BaseApiPerm):
2381 def check_permissions(self, perm_defs, repo_name=None, group_name=None,
2433 def check_permissions(self, perm_defs, repo_name=None, group_name=None,
2382 user_group_name=None):
2434 user_group_name=None):
2383 try:
2435 try:
2384 _user_perms = {perm_defs['repositories_groups'][group_name]}
2436 _user_perms = {perm_defs['repositories_groups'][group_name]}
2385 except KeyError:
2437 except KeyError:
2386 log.warning(traceback.format_exc())
2438 log.warning(traceback.format_exc())
2387 return False
2439 return False
2388 if self.required_perms.issubset(_user_perms):
2440 if self.required_perms.issubset(_user_perms):
2389 return True
2441 return True
2390 return False
2442 return False
2391
2443
2392
2444
2393 class HasUserGroupPermissionAnyApi(_BaseApiPerm):
2445 class HasUserGroupPermissionAnyApi(_BaseApiPerm):
2394 def check_permissions(self, perm_defs, repo_name=None, group_name=None,
2446 def check_permissions(self, perm_defs, repo_name=None, group_name=None,
2395 user_group_name=None):
2447 user_group_name=None):
2396 try:
2448 try:
2397 _user_perms = {perm_defs['user_groups'][user_group_name]}
2449 _user_perms = {perm_defs['user_groups'][user_group_name]}
2398 except KeyError:
2450 except KeyError:
2399 log.warning(traceback.format_exc())
2451 log.warning(traceback.format_exc())
2400 return False
2452 return False
2401 if self.required_perms.intersection(_user_perms):
2453 if self.required_perms.intersection(_user_perms):
2402 return True
2454 return True
2403 return False
2455 return False
2404
2456
2405
2457
2406 def check_ip_access(source_ip, allowed_ips=None):
2458 def check_ip_access(source_ip, allowed_ips=None):
2407 """
2459 """
2408 Checks if source_ip is a subnet of any of allowed_ips.
2460 Checks if source_ip is a subnet of any of allowed_ips.
2409
2461
2410 :param source_ip:
2462 :param source_ip:
2411 :param allowed_ips: list of allowed ips together with mask
2463 :param allowed_ips: list of allowed ips together with mask
2412 """
2464 """
2413 log.debug('checking if ip:%s is subnet of %s', source_ip, allowed_ips)
2465 log.debug('checking if ip:%s is subnet of %s', source_ip, allowed_ips)
2414 source_ip_address = ipaddress.ip_address(safe_unicode(source_ip))
2466 source_ip_address = ipaddress.ip_address(safe_unicode(source_ip))
2415 if isinstance(allowed_ips, (tuple, list, set)):
2467 if isinstance(allowed_ips, (tuple, list, set)):
2416 for ip in allowed_ips:
2468 for ip in allowed_ips:
2417 ip = safe_unicode(ip)
2469 ip = safe_unicode(ip)
2418 try:
2470 try:
2419 network_address = ipaddress.ip_network(ip, strict=False)
2471 network_address = ipaddress.ip_network(ip, strict=False)
2420 if source_ip_address in network_address:
2472 if source_ip_address in network_address:
2421 log.debug('IP %s is network %s', source_ip_address, network_address)
2473 log.debug('IP %s is network %s', source_ip_address, network_address)
2422 return True
2474 return True
2423 # for any case we cannot determine the IP, don't crash just
2475 # for any case we cannot determine the IP, don't crash just
2424 # skip it and log as error, we want to say forbidden still when
2476 # skip it and log as error, we want to say forbidden still when
2425 # sending bad IP
2477 # sending bad IP
2426 except Exception:
2478 except Exception:
2427 log.error(traceback.format_exc())
2479 log.error(traceback.format_exc())
2428 continue
2480 continue
2429 return False
2481 return False
2430
2482
2431
2483
2432 def get_cython_compat_decorator(wrapper, func):
2484 def get_cython_compat_decorator(wrapper, func):
2433 """
2485 """
2434 Creates a cython compatible decorator. The previously used
2486 Creates a cython compatible decorator. The previously used
2435 decorator.decorator() function seems to be incompatible with cython.
2487 decorator.decorator() function seems to be incompatible with cython.
2436
2488
2437 :param wrapper: __wrapper method of the decorator class
2489 :param wrapper: __wrapper method of the decorator class
2438 :param func: decorated function
2490 :param func: decorated function
2439 """
2491 """
2440 @wraps(func)
2492 @wraps(func)
2441 def local_wrapper(*args, **kwds):
2493 def local_wrapper(*args, **kwds):
2442 return wrapper(func, *args, **kwds)
2494 return wrapper(func, *args, **kwds)
2443 local_wrapper.__wrapped__ = func
2495 local_wrapper.__wrapped__ = func
2444 return local_wrapper
2496 return local_wrapper
2445
2497
2446
2498
General Comments 0
You need to be logged in to leave comments. Login now