audit-logs: implemented pull request and comment events.

rhodecode/api/tests/test_close_pull_request.py

@@ -1,113 +1,112 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017  RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import pytest
 
 from rhodecode.model.db import UserLog
 from rhodecode.model.pull_request import PullRequestModel
 from rhodecode.tests import TEST_USER_ADMIN_LOGIN
 from rhodecode.api.tests.utils import (
     build_data, api_call, assert_error, assert_ok)
 
 
 @pytest.mark.usefixtures("testuser_api", "app")
 class TestClosePullRequest(object):
 
     @pytest.mark.backends("git", "hg")
     def test_api_close_pull_request(self, pr_util):
         pull_request = pr_util.create_pull_request()
         pull_request_id = pull_request.pull_request_id
         author = pull_request.user_id
         repo = pull_request.target_repo.repo_id
         id_, params = build_data(
             self.apikey, 'close_pull_request',
             repoid=pull_request.target_repo.repo_name,
             pullrequestid=pull_request.pull_request_id)
         response = api_call(self.app, params)
         expected = {
             'pull_request_id': pull_request_id,
             'close_status': 'Rejected',
             'closed': True,
         }
         assert_ok(id_, expected, response.body)
-        action = 'user_closed_pull_request:%d' % pull_request_id
         journal = UserLog.query()\
-            .filter(UserLog.user_id == author)\
+            .filter(UserLog.user_id == author) \
+            .order_by('user_log_id') \
             .filter(UserLog.repository_id == repo)\
-            .filter(UserLog.action == action)\
             .all()
-        assert len(journal) == 1
+        assert journal[-1].action == 'repo.pull_request.close'
 
     @pytest.mark.backends("git", "hg")
     def test_api_close_pull_request_already_closed_error(self, pr_util):
         pull_request = pr_util.create_pull_request()
         pull_request_id = pull_request.pull_request_id
         pull_request_repo = pull_request.target_repo.repo_name
         PullRequestModel().close_pull_request(
             pull_request, pull_request.author)
         id_, params = build_data(
             self.apikey, 'close_pull_request',
             repoid=pull_request_repo, pullrequestid=pull_request_id)
         response = api_call(self.app, params)
 
         expected = 'pull request `%s` is already closed' % pull_request_id
         assert_error(id_, expected, given=response.body)
 
     @pytest.mark.backends("git", "hg")
     def test_api_close_pull_request_repo_error(self):
         id_, params = build_data(
             self.apikey, 'close_pull_request',
             repoid=666, pullrequestid=1)
         response = api_call(self.app, params)
 
         expected = 'repository `666` does not exist'
         assert_error(id_, expected, given=response.body)
 
     @pytest.mark.backends("git", "hg")
     def test_api_close_pull_request_non_admin_with_userid_error(self,
                                                                 pr_util):
         pull_request = pr_util.create_pull_request()
         id_, params = build_data(
             self.apikey_regular, 'close_pull_request',
             repoid=pull_request.target_repo.repo_name,
             pullrequestid=pull_request.pull_request_id,
             userid=TEST_USER_ADMIN_LOGIN)
         response = api_call(self.app, params)
 
         expected = 'userid is not the same as your user'
         assert_error(id_, expected, given=response.body)
 
     @pytest.mark.backends("git", "hg")
     def test_api_close_pull_request_no_perms_to_close(
             self, user_util, pr_util):
         user = user_util.create_user()
         pull_request = pr_util.create_pull_request()
 
         id_, params = build_data(
             user.api_key, 'close_pull_request',
             repoid=pull_request.target_repo.repo_name,
             pullrequestid=pull_request.pull_request_id,)
         response = api_call(self.app, params)
 
         expected = ('pull request `%s` close failed, '
                     'no permission to close.') % pull_request.pull_request_id
 
         response_json = response.json['error']
         assert response_json == expected

rhodecode/api/tests/test_comment_pull_request.py

@@ -1,209 +1,208 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017  RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import pytest
 
 from rhodecode.model.comment import CommentsModel
 from rhodecode.model.db import UserLog
 from rhodecode.model.pull_request import PullRequestModel
 from rhodecode.tests import TEST_USER_ADMIN_LOGIN
 from rhodecode.api.tests.utils import (
     build_data, api_call, assert_error, assert_ok)
 
 
 @pytest.mark.usefixtures("testuser_api", "app")
 class TestCommentPullRequest(object):
     finalizers = []
 
     def teardown_method(self, method):
         if self.finalizers:
             for finalizer in self.finalizers:
                 finalizer()
             self.finalizers = []
 
     @pytest.mark.backends("git", "hg")
     def test_api_comment_pull_request(self, pr_util, no_notifications):
         pull_request = pr_util.create_pull_request()
         pull_request_id = pull_request.pull_request_id
         author = pull_request.user_id
         repo = pull_request.target_repo.repo_id
         id_, params = build_data(
             self.apikey, 'comment_pull_request',
             repoid=pull_request.target_repo.repo_name,
             pullrequestid=pull_request.pull_request_id,
             message='test message')
         response = api_call(self.app, params)
         pull_request = PullRequestModel().get(pull_request.pull_request_id)
 
         comments = CommentsModel().get_comments(
             pull_request.target_repo.repo_id, pull_request=pull_request)
 
         expected = {
             'pull_request_id': pull_request.pull_request_id,
             'comment_id': comments[-1].comment_id,
             'status': {'given': None, 'was_changed': None}
         }
         assert_ok(id_, expected, response.body)
 
-        action = 'user_commented_pull_request:%d' % pull_request_id
         journal = UserLog.query()\
             .filter(UserLog.user_id == author)\
-            .filter(UserLog.repository_id == repo)\
-            .filter(UserLog.action == action)\
+            .filter(UserLog.repository_id == repo) \
+            .order_by('user_log_id') \
             .all()
-        assert len(journal) == 2
+        assert journal[-1].action == 'repo.pull_request.comment.create'
 
     @pytest.mark.backends("git", "hg")
     def test_api_comment_pull_request_change_status(
             self, pr_util, no_notifications):
         pull_request = pr_util.create_pull_request()
         pull_request_id = pull_request.pull_request_id
         id_, params = build_data(
             self.apikey, 'comment_pull_request',
             repoid=pull_request.target_repo.repo_name,
             pullrequestid=pull_request.pull_request_id,
             status='rejected')
         response = api_call(self.app, params)
         pull_request = PullRequestModel().get(pull_request_id)
 
         comments = CommentsModel().get_comments(
             pull_request.target_repo.repo_id, pull_request=pull_request)
         expected = {
             'pull_request_id': pull_request.pull_request_id,
             'comment_id': comments[-1].comment_id,
             'status':  {'given': 'rejected', 'was_changed': True}
         }
         assert_ok(id_, expected, response.body)
 
     @pytest.mark.backends("git", "hg")
     def test_api_comment_pull_request_change_status_with_specific_commit_id(
             self, pr_util, no_notifications):
         pull_request = pr_util.create_pull_request()
         pull_request_id = pull_request.pull_request_id
         latest_commit_id = 'test_commit'
         # inject additional revision, to fail test the status change on
         # non-latest commit
         pull_request.revisions = pull_request.revisions + ['test_commit']
 
         id_, params = build_data(
             self.apikey, 'comment_pull_request',
             repoid=pull_request.target_repo.repo_name,
             pullrequestid=pull_request.pull_request_id,
             status='approved', commit_id=latest_commit_id)
         response = api_call(self.app, params)
         pull_request = PullRequestModel().get(pull_request_id)
 
         expected = {
             'pull_request_id': pull_request.pull_request_id,
             'comment_id': None,
             'status':  {'given': 'approved', 'was_changed': False}
         }
         assert_ok(id_, expected, response.body)
 
     @pytest.mark.backends("git", "hg")
     def test_api_comment_pull_request_change_status_with_specific_commit_id(
             self, pr_util, no_notifications):
         pull_request = pr_util.create_pull_request()
         pull_request_id = pull_request.pull_request_id
         latest_commit_id = pull_request.revisions[0]
 
         id_, params = build_data(
             self.apikey, 'comment_pull_request',
             repoid=pull_request.target_repo.repo_name,
             pullrequestid=pull_request.pull_request_id,
             status='approved', commit_id=latest_commit_id)
         response = api_call(self.app, params)
         pull_request = PullRequestModel().get(pull_request_id)
 
         comments = CommentsModel().get_comments(
             pull_request.target_repo.repo_id, pull_request=pull_request)
         expected = {
             'pull_request_id': pull_request.pull_request_id,
             'comment_id': comments[-1].comment_id,
             'status':  {'given': 'approved', 'was_changed': True}
         }
         assert_ok(id_, expected, response.body)
 
     @pytest.mark.backends("git", "hg")
     def test_api_comment_pull_request_missing_params_error(self, pr_util):
         pull_request = pr_util.create_pull_request()
         pull_request_id = pull_request.pull_request_id
         pull_request_repo = pull_request.target_repo.repo_name
         id_, params = build_data(
             self.apikey, 'comment_pull_request',
             repoid=pull_request_repo,
             pullrequestid=pull_request_id)
         response = api_call(self.app, params)
 
         expected = 'Both message and status parameters are missing. At least one is required.'
         assert_error(id_, expected, given=response.body)
 
     @pytest.mark.backends("git", "hg")
     def test_api_comment_pull_request_unknown_status_error(self, pr_util):
         pull_request = pr_util.create_pull_request()
         pull_request_id = pull_request.pull_request_id
         pull_request_repo = pull_request.target_repo.repo_name
         id_, params = build_data(
             self.apikey, 'comment_pull_request',
             repoid=pull_request_repo,
             pullrequestid=pull_request_id,
             status='42')
         response = api_call(self.app, params)
 
         expected = 'Unknown comment status: `42`'
         assert_error(id_, expected, given=response.body)
 
     @pytest.mark.backends("git", "hg")
     def test_api_comment_pull_request_repo_error(self):
         id_, params = build_data(
             self.apikey, 'comment_pull_request',
             repoid=666, pullrequestid=1)
         response = api_call(self.app, params)
 
         expected = 'repository `666` does not exist'
         assert_error(id_, expected, given=response.body)
 
     @pytest.mark.backends("git", "hg")
     def test_api_comment_pull_request_non_admin_with_userid_error(
             self, pr_util):
         pull_request = pr_util.create_pull_request()
         id_, params = build_data(
             self.apikey_regular, 'comment_pull_request',
             repoid=pull_request.target_repo.repo_name,
             pullrequestid=pull_request.pull_request_id,
             userid=TEST_USER_ADMIN_LOGIN)
         response = api_call(self.app, params)
 
         expected = 'userid is not the same as your user'
         assert_error(id_, expected, given=response.body)
 
     @pytest.mark.backends("git", "hg")
     def test_api_comment_pull_request_wrong_commit_id_error(self, pr_util):
         pull_request = pr_util.create_pull_request()
         id_, params = build_data(
             self.apikey_regular, 'comment_pull_request',
             repoid=pull_request.target_repo.repo_name,
             status='approved',
             pullrequestid=pull_request.pull_request_id,
             commit_id='XXX')
         response = api_call(self.app, params)
 
         expected = 'Invalid commit_id `XXX` for this pull request.'
         assert_error(id_, expected, given=response.body)

rhodecode/api/tests/test_get_pull_request.py

@@ -1,134 +1,134 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 
 import pytest
 import urlobject
 from pylons import url
 
 from rhodecode.api.tests.utils import (
     build_data, api_call, assert_error, assert_ok)
 from rhodecode.lib.utils2 import safe_unicode
 
 pytestmark = pytest.mark.backends("git", "hg")
 
 
 @pytest.mark.usefixtures("testuser_api", "app")
 class TestGetPullRequest(object):
 
-    def test_api_get_pull_request(self, pr_util, http_host_stub, http_host_only_stub):
+    def test_api_get_pull_request(self, pr_util, http_host_only_stub):
         from rhodecode.model.pull_request import PullRequestModel
         pull_request = pr_util.create_pull_request(mergeable=True)
         id_, params = build_data(
             self.apikey, 'get_pull_request',
             repoid=pull_request.target_repo.repo_name,
             pullrequestid=pull_request.pull_request_id)
 
         response = api_call(self.app, params)
 
         assert response.status == '200 OK'
 
         url_obj = urlobject.URLObject(
             url(
                 'pullrequest_show',
                 repo_name=pull_request.target_repo.repo_name,
                 pull_request_id=pull_request.pull_request_id, qualified=True))
 
         pr_url = safe_unicode(
-            url_obj.with_netloc(http_host_stub))
+            url_obj.with_netloc(http_host_only_stub))
         source_url = safe_unicode(
             pull_request.source_repo.clone_url().with_netloc(http_host_only_stub))
         target_url = safe_unicode(
             pull_request.target_repo.clone_url().with_netloc(http_host_only_stub))
         shadow_url = safe_unicode(
             PullRequestModel().get_shadow_clone_url(pull_request))
 
         expected = {
             'pull_request_id': pull_request.pull_request_id,
             'url': pr_url,
             'title': pull_request.title,
             'description': pull_request.description,
             'status': pull_request.status,
             'created_on': pull_request.created_on,
             'updated_on': pull_request.updated_on,
             'commit_ids': pull_request.revisions,
             'review_status': pull_request.calculated_review_status(),
             'mergeable': {
                 'status': True,
                 'message': 'This pull request can be automatically merged.',
             },
             'source': {
                 'clone_url': source_url,
                 'repository': pull_request.source_repo.repo_name,
                 'reference': {
                     'name': pull_request.source_ref_parts.name,
                     'type': pull_request.source_ref_parts.type,
                     'commit_id': pull_request.source_ref_parts.commit_id,
                 },
             },
             'target': {
                 'clone_url': target_url,
                 'repository': pull_request.target_repo.repo_name,
                 'reference': {
                     'name': pull_request.target_ref_parts.name,
                     'type': pull_request.target_ref_parts.type,
                     'commit_id': pull_request.target_ref_parts.commit_id,
                 },
             },
             'merge': {
                 'clone_url': shadow_url,
                 'reference': {
                     'name': pull_request.shadow_merge_ref.name,
                     'type': pull_request.shadow_merge_ref.type,
                     'commit_id': pull_request.shadow_merge_ref.commit_id,
                 },
             },
             'author': pull_request.author.get_api_data(include_secrets=False,
                                                        details='basic'),
             'reviewers': [
                 {
                     'user': reviewer.get_api_data(include_secrets=False,
                                                   details='basic'),
                     'reasons': reasons,
                     'review_status': st[0][1].status if st else 'not_reviewed',
                 }
                 for reviewer, reasons, mandatory, st in
                 pull_request.reviewers_statuses()
             ]
         }
         assert_ok(id_, expected, response.body)
 
     def test_api_get_pull_request_repo_error(self):
         id_, params = build_data(
             self.apikey, 'get_pull_request',
             repoid=666, pullrequestid=1)
         response = api_call(self.app, params)
 
         expected = 'repository `666` does not exist'
         assert_error(id_, expected, given=response.body)
 
     def test_api_get_pull_request_pull_request_error(self):
         id_, params = build_data(
             self.apikey, 'get_pull_request',
             repoid=1, pullrequestid=666)
         response = api_call(self.app, params)
 
         expected = 'pull request `666` does not exist'
         assert_error(id_, expected, given=response.body)

rhodecode/api/tests/test_merge_pull_request.py

@@ -1,136 +1,136 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import pytest
 
 from rhodecode.model.db import UserLog, PullRequest
 from rhodecode.model.meta import Session
 from rhodecode.tests import TEST_USER_ADMIN_LOGIN
 from rhodecode.api.tests.utils import (
     build_data, api_call, assert_error, assert_ok)
 
 
 @pytest.mark.usefixtures("testuser_api", "app")
 class TestMergePullRequest(object):
     @pytest.mark.backends("git", "hg")
     def test_api_merge_pull_request_merge_failed(self, pr_util, no_notifications):
         pull_request = pr_util.create_pull_request(mergeable=True)
         author = pull_request.user_id
         repo = pull_request.target_repo.repo_id
         pull_request_id = pull_request.pull_request_id
         pull_request_repo = pull_request.target_repo.repo_name
 
         id_, params = build_data(
             self.apikey, 'merge_pull_request',
             repoid=pull_request_repo,
             pullrequestid=pull_request_id)
 
         response = api_call(self.app, params)
 
         # The above api call detaches the pull request DB object from the
         # session because of an unconditional transaction rollback in our
         # middleware. Therefore we need to add it back here if we want to use
         # it.
         Session().add(pull_request)
 
         expected = 'merge not possible for following reasons: ' \
                    'Pull request reviewer approval is pending.'
         assert_error(id_, expected, given=response.body)
 
     @pytest.mark.backends("git", "hg")
     def test_api_merge_pull_request(self, pr_util, no_notifications):
         pull_request = pr_util.create_pull_request(mergeable=True, approved=True)
         author = pull_request.user_id
         repo = pull_request.target_repo.repo_id
         pull_request_id = pull_request.pull_request_id
         pull_request_repo = pull_request.target_repo.repo_name
 
         id_, params = build_data(
             self.apikey, 'comment_pull_request',
             repoid=pull_request_repo,
             pullrequestid=pull_request_id,
             status='approved')
 
         response = api_call(self.app, params)
         expected = {
             'comment_id': response.json.get('result', {}).get('comment_id'),
             'pull_request_id': pull_request_id,
             'status': {'given': 'approved', 'was_changed': True}
         }
         assert_ok(id_, expected, given=response.body)
 
         id_, params = build_data(
             self.apikey, 'merge_pull_request',
             repoid=pull_request_repo,
             pullrequestid=pull_request_id)
 
         response = api_call(self.app, params)
 
         pull_request = PullRequest.get(pull_request_id)
 
         expected = {
             'executed': True,
             'failure_reason': 0,
             'possible': True,
             'merge_commit_id': pull_request.shadow_merge_ref.commit_id,
             'merge_ref': pull_request.shadow_merge_ref._asdict()
         }
 
         assert_ok(id_, expected, response.body)
 
-        action = 'user_merged_pull_request:%d' % (pull_request_id, )
         journal = UserLog.query()\
             .filter(UserLog.user_id == author)\
-            .filter(UserLog.repository_id == repo)\
-            .filter(UserLog.action == action)\
+            .filter(UserLog.repository_id == repo) \
+            .order_by('user_log_id') \
             .all()
-        assert len(journal) == 1
+        assert journal[-2].action == 'repo.pull_request.merge'
+        assert journal[-1].action == 'repo.pull_request.close'
 
         id_, params = build_data(
             self.apikey, 'merge_pull_request',
             repoid=pull_request_repo, pullrequestid=pull_request_id)
         response = api_call(self.app, params)
 
         expected = 'merge not possible for following reasons: This pull request is closed.'
         assert_error(id_, expected, given=response.body)
 
     @pytest.mark.backends("git", "hg")
     def test_api_merge_pull_request_repo_error(self):
         id_, params = build_data(
             self.apikey, 'merge_pull_request',
             repoid=666, pullrequestid=1)
         response = api_call(self.app, params)
 
         expected = 'repository `666` does not exist'
         assert_error(id_, expected, given=response.body)
 
     @pytest.mark.backends("git", "hg")
     def test_api_merge_pull_request_non_admin_with_userid_error(self,
                                                                 pr_util):
         pull_request = pr_util.create_pull_request(mergeable=True)
         id_, params = build_data(
             self.apikey_regular, 'merge_pull_request',
             repoid=pull_request.target_repo.repo_name,
             pullrequestid=pull_request.pull_request_id,
             userid=TEST_USER_ADMIN_LOGIN)
         response = api_call(self.app, params)
 
         expected = 'userid is not the same as your user'
         assert_error(id_, expected, given=response.body)

rhodecode/api/tests/test_update_pull_request.py

@@ -1,213 +1,212 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import pytest
 
 from rhodecode.lib.vcs.nodes import FileNode
 from rhodecode.model.db import User
 from rhodecode.model.pull_request import PullRequestModel
 from rhodecode.tests import TEST_USER_ADMIN_LOGIN
 from rhodecode.api.tests.utils import (
     build_data, api_call, assert_ok, assert_error)
 
 
 @pytest.mark.usefixtures("testuser_api", "app")
 class TestUpdatePullRequest(object):
 
     @pytest.mark.backends("git", "hg")
     def test_api_update_pull_request_title_or_description(
-            self, pr_util, silence_action_logger, no_notifications):
+            self, pr_util, no_notifications):
         pull_request = pr_util.create_pull_request()
 
         id_, params = build_data(
             self.apikey, 'update_pull_request',
             repoid=pull_request.target_repo.repo_name,
             pullrequestid=pull_request.pull_request_id,
             title='New TITLE OF A PR',
             description='New DESC OF A PR',
         )
         response = api_call(self.app, params)
 
         expected = {
             "msg": "Updated pull request `{}`".format(
                 pull_request.pull_request_id),
             "pull_request": response.json['result']['pull_request'],
             "updated_commits": {"added": [], "common": [], "removed": []},
             "updated_reviewers": {"added": [], "removed": []},
         }
 
         response_json = response.json['result']
         assert response_json == expected
         pr = response_json['pull_request']
         assert pr['title'] == 'New TITLE OF A PR'
         assert pr['description'] == 'New DESC OF A PR'
 
     @pytest.mark.backends("git", "hg")
     def test_api_try_update_closed_pull_request(
-            self, pr_util, silence_action_logger, no_notifications):
+            self, pr_util, no_notifications):
         pull_request = pr_util.create_pull_request()
         PullRequestModel().close_pull_request(
             pull_request, TEST_USER_ADMIN_LOGIN)
 
         id_, params = build_data(
             self.apikey, 'update_pull_request',
             repoid=pull_request.target_repo.repo_name,
             pullrequestid=pull_request.pull_request_id)
         response = api_call(self.app, params)
 
         expected = 'pull request `{}` update failed, pull request ' \
                    'is closed'.format(pull_request.pull_request_id)
 
         assert_error(id_, expected, response.body)
 
     @pytest.mark.backends("git", "hg")
-    def test_api_update_update_commits(
-            self, pr_util, silence_action_logger, no_notifications):
+    def test_api_update_update_commits(self, pr_util, no_notifications):
         commits = [
             {'message': 'a'},
             {'message': 'b', 'added': [FileNode('file_b', 'test_content\n')]},
             {'message': 'c', 'added': [FileNode('file_c', 'test_content\n')]},
         ]
         pull_request = pr_util.create_pull_request(
             commits=commits, target_head='a', source_head='b', revisions=['b'])
         pr_util.update_source_repository(head='c')
         repo = pull_request.source_repo.scm_instance()
         commits = [x for x in repo.get_commits()]
         print commits
 
         added_commit_id = commits[-1].raw_id  # c commit
         common_commit_id = commits[1].raw_id  # b commit is common ancestor
         total_commits = [added_commit_id, common_commit_id]
 
         id_, params = build_data(
             self.apikey, 'update_pull_request',
             repoid=pull_request.target_repo.repo_name,
             pullrequestid=pull_request.pull_request_id,
             update_commits=True
         )
         response = api_call(self.app, params)
 
         expected = {
             "msg": "Updated pull request `{}`".format(
                 pull_request.pull_request_id),
             "pull_request": response.json['result']['pull_request'],
             "updated_commits": {"added": [added_commit_id],
                                 "common": [common_commit_id],
                                 "total": total_commits,
                                 "removed": []},
             "updated_reviewers": {"added": [], "removed": []},
         }
 
         assert_ok(id_, expected, response.body)
 
     @pytest.mark.backends("git", "hg")
     def test_api_update_change_reviewers(
-            self, user_util, pr_util, silence_action_logger, no_notifications):
+            self, user_util, pr_util, no_notifications):
         a = user_util.create_user()
         b = user_util.create_user()
         c = user_util.create_user()
         new_reviewers = [
             {'username': b.username,'reasons': ['updated via API'],
              'mandatory':False},
             {'username': c.username, 'reasons': ['updated via API'],
              'mandatory':False},
         ]
 
         added = [b.username, c.username]
         removed = [a.username]
 
         pull_request = pr_util.create_pull_request(
             reviewers=[(a.username, ['added via API'], False)])
 
         id_, params = build_data(
             self.apikey, 'update_pull_request',
             repoid=pull_request.target_repo.repo_name,
             pullrequestid=pull_request.pull_request_id,
             reviewers=new_reviewers)
         response = api_call(self.app, params)
         expected = {
             "msg": "Updated pull request `{}`".format(
                 pull_request.pull_request_id),
             "pull_request": response.json['result']['pull_request'],
             "updated_commits": {"added": [], "common": [], "removed": []},
             "updated_reviewers": {"added": added, "removed": removed},
         }
 
         assert_ok(id_, expected, response.body)
 
     @pytest.mark.backends("git", "hg")
     def test_api_update_bad_user_in_reviewers(self, pr_util):
         pull_request = pr_util.create_pull_request()
 
         id_, params = build_data(
             self.apikey, 'update_pull_request',
             repoid=pull_request.target_repo.repo_name,
             pullrequestid=pull_request.pull_request_id,
             reviewers=[{'username': 'bad_name'}])
         response = api_call(self.app, params)
 
         expected = 'user `bad_name` does not exist'
 
         assert_error(id_, expected, response.body)
 
     @pytest.mark.backends("git", "hg")
     def test_api_update_repo_error(self, pr_util):
         id_, params = build_data(
             self.apikey, 'update_pull_request',
             repoid='fake',
             pullrequestid='fake',
             reviewers=[{'username': 'bad_name'}])
         response = api_call(self.app, params)
 
         expected = 'repository `fake` does not exist'
 
         response_json = response.json['error']
         assert response_json == expected
 
     @pytest.mark.backends("git", "hg")
     def test_api_update_pull_request_error(self, pr_util):
         pull_request = pr_util.create_pull_request()
 
         id_, params = build_data(
             self.apikey, 'update_pull_request',
             repoid=pull_request.target_repo.repo_name,
             pullrequestid=999999,
             reviewers=[{'username': 'bad_name'}])
         response = api_call(self.app, params)
 
         expected = 'pull request `999999` does not exist'
         assert_error(id_, expected, response.body)
 
     @pytest.mark.backends("git", "hg")
     def test_api_update_pull_request_no_perms_to_update(
             self, user_util, pr_util):
         user = user_util.create_user()
         pull_request = pr_util.create_pull_request()
 
         id_, params = build_data(
             user.api_key, 'update_pull_request',
             repoid=pull_request.target_repo.repo_name,
             pullrequestid=pull_request.pull_request_id,)
         response = api_call(self.app, params)
 
         expected = ('pull request `%s` update failed, '
                     'no permission to update.') % pull_request.pull_request_id
 
         assert_error(id_, expected, response.body)

rhodecode/api/views/pull_request_api.py

@@ -1,779 +1,779 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2011-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 
 import logging
 
 from rhodecode import events
 from rhodecode.api import jsonrpc_method, JSONRPCError, JSONRPCValidationError
 from rhodecode.api.utils import (
     has_superadmin_permission, Optional, OAttr, get_repo_or_error,
     get_pull_request_or_error, get_commit_or_error, get_user_or_error,
     validate_repo_permissions, resolve_ref_or_error)
 from rhodecode.lib.auth import (HasRepoPermissionAnyApi)
 from rhodecode.lib.base import vcs_operation_context
 from rhodecode.lib.utils2 import str2bool
 from rhodecode.model.changeset_status import ChangesetStatusModel
 from rhodecode.model.comment import CommentsModel
 from rhodecode.model.db import Session, ChangesetStatus, ChangesetComment
 from rhodecode.model.pull_request import PullRequestModel, MergeCheck
 from rhodecode.model.settings import SettingsModel
 from rhodecode.model.validation_schema import Invalid
 from rhodecode.model.validation_schema.schemas.reviewer_schema import(
     ReviewerListSchema)
 
 log = logging.getLogger(__name__)
 
 
 @jsonrpc_method()
 def get_pull_request(request, apiuser, repoid, pullrequestid):
     """
     Get a pull request based on the given ID.
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
     :param repoid: Repository name or repository ID from where the pull
         request was opened.
     :type repoid: str or int
     :param pullrequestid: ID of the requested pull request.
     :type pullrequestid: int
 
     Example output:
 
     .. code-block:: bash
 
       "id": <id_given_in_input>,
       "result":
         {
             "pull_request_id":   "<pull_request_id>",
             "url":               "<url>",
             "title":             "<title>",
             "description":       "<description>",
             "status" :           "<status>",
             "created_on":        "<date_time_created>",
             "updated_on":        "<date_time_updated>",
             "commit_ids":        [
                                      ...
                                      "<commit_id>",
                                      "<commit_id>",
                                      ...
                                  ],
             "review_status":    "<review_status>",
             "mergeable":         {
                                      "status":  "<bool>",
                                      "message": "<message>",
                                  },
             "source":            {
                                      "clone_url":     "<clone_url>",
                                      "repository":    "<repository_name>",
                                      "reference":
                                      {
                                          "name":      "<name>",
                                          "type":      "<type>",
                                          "commit_id": "<commit_id>",
                                      }
                                  },
             "target":            {
                                      "clone_url":   "<clone_url>",
                                      "repository":    "<repository_name>",
                                      "reference":
                                      {
                                          "name":      "<name>",
                                          "type":      "<type>",
                                          "commit_id": "<commit_id>",
                                      }
                                  },
             "merge":             {
                                      "clone_url":   "<clone_url>",
                                      "reference":
                                      {
                                          "name":      "<name>",
                                          "type":      "<type>",
                                          "commit_id": "<commit_id>",
                                      }
                                  },
            "author":             <user_obj>,
            "reviewers":          [
                                      ...
                                      {
                                         "user":          "<user_obj>",
                                         "review_status": "<review_status>",
                                      }
                                      ...
                                  ]
         },
        "error": null
     """
     get_repo_or_error(repoid)
     pull_request = get_pull_request_or_error(pullrequestid)
     if not PullRequestModel().check_user_read(
             pull_request, apiuser, api=True):
         raise JSONRPCError('repository `%s` does not exist' % (repoid,))
     data = pull_request.get_api_data()
     return data
 
 
 @jsonrpc_method()
 def get_pull_requests(request, apiuser, repoid, status=Optional('new')):
     """
     Get all pull requests from the repository specified in `repoid`.
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
     :param repoid: Repository name or repository ID.
     :type repoid: str or int
     :param status: Only return pull requests with the specified status.
         Valid options are.
         * ``new`` (default)
         * ``open``
         * ``closed``
     :type status: str
 
     Example output:
 
     .. code-block:: bash
 
       "id": <id_given_in_input>,
       "result":
         [
             ...
             {
                 "pull_request_id":   "<pull_request_id>",
                 "url":               "<url>",
                 "title" :            "<title>",
                 "description":       "<description>",
                 "status":            "<status>",
                 "created_on":        "<date_time_created>",
                 "updated_on":        "<date_time_updated>",
                 "commit_ids":        [
                                          ...
                                          "<commit_id>",
                                          "<commit_id>",
                                          ...
                                      ],
                 "review_status":    "<review_status>",
                 "mergeable":         {
                                         "status":      "<bool>",
                                         "message:      "<message>",
                                      },
                 "source":            {
                                          "clone_url":     "<clone_url>",
                                          "reference":
                                          {
                                              "name":      "<name>",
                                              "type":      "<type>",
                                              "commit_id": "<commit_id>",
                                          }
                                      },
                 "target":            {
                                          "clone_url":   "<clone_url>",
                                          "reference":
                                          {
                                              "name":      "<name>",
                                              "type":      "<type>",
                                              "commit_id": "<commit_id>",
                                          }
                                      },
                 "merge":             {
                                          "clone_url":   "<clone_url>",
                                          "reference":
                                          {
                                              "name":      "<name>",
                                              "type":      "<type>",
                                              "commit_id": "<commit_id>",
                                          }
                                      },
                "author":             <user_obj>,
                "reviewers":          [
                                          ...
                                          {
                                             "user":          "<user_obj>",
                                             "review_status": "<review_status>",
                                          }
                                          ...
                                      ]
             }
             ...
         ],
       "error": null
 
     """
     repo = get_repo_or_error(repoid)
     if not has_superadmin_permission(apiuser):
         _perms = (
             'repository.admin', 'repository.write', 'repository.read',)
         validate_repo_permissions(apiuser, repoid, repo, _perms)
 
     status = Optional.extract(status)
     pull_requests = PullRequestModel().get_all(repo, statuses=[status])
     data = [pr.get_api_data() for pr in pull_requests]
     return data
 
 
 @jsonrpc_method()
 def merge_pull_request(
         request, apiuser, repoid, pullrequestid,
         userid=Optional(OAttr('apiuser'))):
     """
     Merge the pull request specified by `pullrequestid` into its target
     repository.
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
     :param repoid: The Repository name or repository ID of the
         target repository to which the |pr| is to be merged.
     :type repoid: str or int
     :param pullrequestid: ID of the pull request which shall be merged.
     :type pullrequestid: int
     :param userid: Merge the pull request as this user.
     :type userid: Optional(str or int)
 
     Example output:
 
     .. code-block:: bash
 
         "id": <id_given_in_input>,
         "result": {
             "executed":         "<bool>",
             "failure_reason":   "<int>",
             "merge_commit_id":  "<merge_commit_id>",
             "possible":         "<bool>",
             "merge_ref":        {
                                     "commit_id": "<commit_id>",
                                     "type":      "<type>",
                                     "name":      "<name>"
                                 }
         },
         "error": null
     """
     repo = get_repo_or_error(repoid)
     if not isinstance(userid, Optional):
         if (has_superadmin_permission(apiuser) or
                 HasRepoPermissionAnyApi('repository.admin')(
                     user=apiuser, repo_name=repo.repo_name)):
             apiuser = get_user_or_error(userid)
         else:
             raise JSONRPCError('userid is not the same as your user')
 
     pull_request = get_pull_request_or_error(pullrequestid)
 
     check = MergeCheck.validate(pull_request, user=apiuser)
     merge_possible = not check.failed
 
     if not merge_possible:
         error_messages = []
         for err_type, error_msg in check.errors:
             error_msg = request.translate(error_msg)
             error_messages.append(error_msg)
 
         reasons = ','.join(error_messages)
         raise JSONRPCError(
             'merge not possible for following reasons: {}'.format(reasons))
 
     target_repo = pull_request.target_repo
     extras = vcs_operation_context(
         request.environ, repo_name=target_repo.repo_name,
         username=apiuser.username, action='push',
         scm=target_repo.repo_type)
     merge_response = PullRequestModel().merge(
         pull_request, apiuser, extras=extras)
     if merge_response.executed:
         PullRequestModel().close_pull_request(
             pull_request.pull_request_id, apiuser)
 
         Session().commit()
 
     # In previous versions the merge response directly contained the merge
     # commit id. It is now contained in the merge reference object. To be
     # backwards compatible we have to extract it again.
     merge_response = merge_response._asdict()
     merge_response['merge_commit_id'] = merge_response['merge_ref'].commit_id
 
     return merge_response
 
 
 @jsonrpc_method()
 def comment_pull_request(
         request, apiuser, repoid, pullrequestid, message=Optional(None),
         commit_id=Optional(None), status=Optional(None),
         comment_type=Optional(ChangesetComment.COMMENT_TYPE_NOTE),
         resolves_comment_id=Optional(None),
         userid=Optional(OAttr('apiuser'))):
     """
     Comment on the pull request specified with the `pullrequestid`,
     in the |repo| specified by the `repoid`, and optionally change the
     review status.
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
     :param repoid: The repository name or repository ID.
     :type repoid: str or int
     :param pullrequestid: The pull request ID.
     :type pullrequestid: int
     :param commit_id: Specify the commit_id for which to set a comment. If
         given commit_id is different than latest in the PR status
         change won't be performed.
     :type commit_id: str
     :param message: The text content of the comment.
     :type message: str
     :param status: (**Optional**) Set the approval status of the pull
         request. One of: 'not_reviewed', 'approved', 'rejected',
         'under_review'
     :type status: str
     :param comment_type: Comment type, one of: 'note', 'todo'
     :type comment_type: Optional(str), default: 'note'
     :param userid: Comment on the pull request as this user
     :type userid: Optional(str or int)
 
     Example output:
 
     .. code-block:: bash
 
         id : <id_given_in_input>
         result : {
             "pull_request_id":  "<Integer>",
             "comment_id":       "<Integer>",
             "status": {"given": <given_status>,
                        "was_changed": <bool status_was_actually_changed> },
         },
         error :  null
     """
     repo = get_repo_or_error(repoid)
     if not isinstance(userid, Optional):
         if (has_superadmin_permission(apiuser) or
                 HasRepoPermissionAnyApi('repository.admin')(
                     user=apiuser, repo_name=repo.repo_name)):
             apiuser = get_user_or_error(userid)
         else:
             raise JSONRPCError('userid is not the same as your user')
 
     pull_request = get_pull_request_or_error(pullrequestid)
     if not PullRequestModel().check_user_read(
             pull_request, apiuser, api=True):
         raise JSONRPCError('repository `%s` does not exist' % (repoid,))
     message = Optional.extract(message)
     status = Optional.extract(status)
     commit_id = Optional.extract(commit_id)
     comment_type = Optional.extract(comment_type)
     resolves_comment_id = Optional.extract(resolves_comment_id)
 
     if not message and not status:
         raise JSONRPCError(
             'Both message and status parameters are missing. '
             'At least one is required.')
 
     if (status not in (st[0] for st in ChangesetStatus.STATUSES) and
             status is not None):
         raise JSONRPCError('Unknown comment status: `%s`' % status)
 
     if commit_id and commit_id not in pull_request.revisions:
         raise JSONRPCError(
             'Invalid commit_id `%s` for this pull request.' % commit_id)
 
     allowed_to_change_status = PullRequestModel().check_user_change_status(
         pull_request, apiuser)
 
     # if commit_id is passed re-validated if user is allowed to change status
     # based on latest commit_id from the PR
     if commit_id:
         commit_idx = pull_request.revisions.index(commit_id)
         if commit_idx != 0:
             allowed_to_change_status = False
 
     if resolves_comment_id:
         comment = ChangesetComment.get(resolves_comment_id)
         if not comment:
             raise JSONRPCError(
                 'Invalid resolves_comment_id `%s` for this pull request.'
                 % resolves_comment_id)
         if comment.comment_type != ChangesetComment.COMMENT_TYPE_TODO:
             raise JSONRPCError(
                 'Comment `%s` is wrong type for setting status to resolved.'
                 % resolves_comment_id)
 
     text = message
     status_label = ChangesetStatus.get_status_lbl(status)
     if status and allowed_to_change_status:
         st_message = ('Status change %(transition_icon)s %(status)s'
                       % {'transition_icon': '>', 'status': status_label})
         text = message or st_message
 
     rc_config = SettingsModel().get_all_settings()
     renderer = rc_config.get('rhodecode_markup_renderer', 'rst')
 
     status_change = status and allowed_to_change_status
     comment = CommentsModel().create(
         text=text,
         repo=pull_request.target_repo.repo_id,
         user=apiuser.user_id,
         pull_request=pull_request.pull_request_id,
         f_path=None,
         line_no=None,
         status_change=(status_label if status_change else None),
         status_change_type=(status if status_change else None),
         closing_pr=False,
         renderer=renderer,
         comment_type=comment_type,
         resolves_comment_id=resolves_comment_id
     )
 
     if allowed_to_change_status and status:
         ChangesetStatusModel().set_status(
             pull_request.target_repo.repo_id,
             status,
             apiuser.user_id,
             comment,
             pull_request=pull_request.pull_request_id
         )
         Session().flush()
 
     Session().commit()
     data = {
         'pull_request_id': pull_request.pull_request_id,
         'comment_id': comment.comment_id if comment else None,
         'status': {'given': status, 'was_changed': status_change},
     }
     return data
 
 
 @jsonrpc_method()
 def create_pull_request(
         request, apiuser, source_repo, target_repo, source_ref, target_ref,
         title, description=Optional(''), reviewers=Optional(None)):
     """
     Creates a new pull request.
 
     Accepts refs in the following formats:
 
         * branch:<branch_name>:<sha>
         * branch:<branch_name>
         * bookmark:<bookmark_name>:<sha> (Mercurial only)
         * bookmark:<bookmark_name> (Mercurial only)
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
     :param source_repo: Set the source repository name.
     :type source_repo: str
     :param target_repo: Set the target repository name.
     :type target_repo: str
     :param source_ref: Set the source ref name.
     :type source_ref: str
     :param target_ref: Set the target ref name.
     :type target_ref: str
     :param title: Set the pull request title.
     :type title: str
     :param description: Set the pull request description.
     :type description: Optional(str)
     :param reviewers: Set the new pull request reviewers list.
         Reviewer defined by review rules will be added automatically to the
         defined list.
     :type reviewers: Optional(list)
         Accepts username strings or objects of the format:
 
             [{'username': 'nick', 'reasons': ['original author'], 'mandatory': <bool>}]
     """
 
     source_db_repo =  get_repo_or_error(source_repo)
     target_db_repo = get_repo_or_error(target_repo)
     if not has_superadmin_permission(apiuser):
         _perms = ('repository.admin', 'repository.write', 'repository.read',)
         validate_repo_permissions(apiuser, source_repo, source_db_repo, _perms)
 
     full_source_ref = resolve_ref_or_error(source_ref, source_db_repo)
     full_target_ref = resolve_ref_or_error(target_ref, target_db_repo)
     source_commit = get_commit_or_error(full_source_ref, source_db_repo)
     target_commit = get_commit_or_error(full_target_ref, target_db_repo)
     source_scm = source_db_repo.scm_instance()
     target_scm = target_db_repo.scm_instance()
 
     commit_ranges = target_scm.compare(
         target_commit.raw_id, source_commit.raw_id, source_scm,
         merge=True, pre_load=[])
 
     ancestor = target_scm.get_common_ancestor(
         target_commit.raw_id, source_commit.raw_id, source_scm)
 
     if not commit_ranges:
         raise JSONRPCError('no commits found')
 
     if not ancestor:
         raise JSONRPCError('no common ancestor found')
 
     reviewer_objects = Optional.extract(reviewers) or []
 
     if reviewer_objects:
         schema = ReviewerListSchema()
         try:
             reviewer_objects = schema.deserialize(reviewer_objects)
         except Invalid as err:
             raise JSONRPCValidationError(colander_exc=err)
 
         # validate users
         for reviewer_object in reviewer_objects:
             user = get_user_or_error(reviewer_object['username'])
             reviewer_object['user_id'] = user.user_id
 
     get_default_reviewers_data, get_validated_reviewers = \
         PullRequestModel().get_reviewer_functions()
 
     reviewer_rules = get_default_reviewers_data(
         apiuser.get_instance(), source_db_repo,
         source_commit, target_db_repo, target_commit)
 
     # specified rules are later re-validated, thus we can assume users will
     # eventually provide those that meet the reviewer criteria.
     if not reviewer_objects:
         reviewer_objects = reviewer_rules['reviewers']
 
     try:
         reviewers = get_validated_reviewers(
             reviewer_objects, reviewer_rules)
     except ValueError as e:
         raise JSONRPCError('Reviewers Validation: {}'.format(e))
 
     pull_request_model = PullRequestModel()
     pull_request = pull_request_model.create(
         created_by=apiuser.user_id,
         source_repo=source_repo,
         source_ref=full_source_ref,
         target_repo=target_repo,
         target_ref=full_target_ref,
         revisions=reversed(
             [commit.raw_id for commit in reversed(commit_ranges)]),
         reviewers=reviewers,
         title=title,
         description=Optional.extract(description)
     )
 
     Session().commit()
     data = {
         'msg': 'Created new pull request `{}`'.format(title),
         'pull_request_id': pull_request.pull_request_id,
     }
     return data
 
 
 @jsonrpc_method()
 def update_pull_request(
         request, apiuser, repoid, pullrequestid, title=Optional(''),
         description=Optional(''), reviewers=Optional(None),
         update_commits=Optional(None)):
     """
     Updates a pull request.
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
     :param repoid: The repository name or repository ID.
     :type repoid: str or int
     :param pullrequestid: The pull request ID.
     :type pullrequestid: int
     :param title: Set the pull request title.
     :type title: str
     :param description: Update pull request description.
     :type description: Optional(str)
     :param reviewers: Update pull request reviewers list with new value.
     :type reviewers: Optional(list)
         Accepts username strings or objects of the format:
 
             [{'username': 'nick', 'reasons': ['original author'], 'mandatory': <bool>}]
 
     :param update_commits: Trigger update of commits for this pull request
     :type: update_commits: Optional(bool)
 
     Example output:
 
     .. code-block:: bash
 
         id : <id_given_in_input>
         result : {
             "msg": "Updated pull request `63`",
             "pull_request": <pull_request_object>,
             "updated_reviewers": {
               "added": [
                 "username"
               ],
               "removed": []
             },
             "updated_commits": {
               "added": [
                 "<sha1_hash>"
               ],
               "common": [
                 "<sha1_hash>",
                 "<sha1_hash>",
               ],
               "removed": []
             }
         }
         error :  null
     """
 
     repo = get_repo_or_error(repoid)
     pull_request = get_pull_request_or_error(pullrequestid)
     if not PullRequestModel().check_user_update(
             pull_request, apiuser, api=True):
         raise JSONRPCError(
             'pull request `%s` update failed, no permission to update.' % (
                 pullrequestid,))
     if pull_request.is_closed():
         raise JSONRPCError(
             'pull request `%s` update failed, pull request is closed' % (
                 pullrequestid,))
 
     reviewer_objects = Optional.extract(reviewers) or []
 
     if reviewer_objects:
         schema = ReviewerListSchema()
         try:
             reviewer_objects = schema.deserialize(reviewer_objects)
         except Invalid as err:
             raise JSONRPCValidationError(colander_exc=err)
 
         # validate users
         for reviewer_object in reviewer_objects:
             user = get_user_or_error(reviewer_object['username'])
             reviewer_object['user_id'] = user.user_id
 
         get_default_reviewers_data, get_validated_reviewers = \
             PullRequestModel().get_reviewer_functions()
 
         # re-use stored rules
         reviewer_rules = pull_request.reviewer_data
         try:
             reviewers = get_validated_reviewers(
                 reviewer_objects, reviewer_rules)
         except ValueError as e:
             raise JSONRPCError('Reviewers Validation: {}'.format(e))
     else:
         reviewers = []
 
     title = Optional.extract(title)
     description = Optional.extract(description)
     if title or description:
         PullRequestModel().edit(
             pull_request, title or pull_request.title,
-            description or pull_request.description)
+            description or pull_request.description, apiuser)
         Session().commit()
 
     commit_changes = {"added": [], "common": [], "removed": []}
     if str2bool(Optional.extract(update_commits)):
         if PullRequestModel().has_valid_update_type(pull_request):
             update_response = PullRequestModel().update_commits(
                 pull_request)
             commit_changes = update_response.changes or commit_changes
         Session().commit()
 
     reviewers_changes = {"added": [], "removed": []}
     if reviewers:
         added_reviewers, removed_reviewers = \
-            PullRequestModel().update_reviewers(pull_request, reviewers)
+            PullRequestModel().update_reviewers(pull_request, reviewers, apiuser)
 
         reviewers_changes['added'] = sorted(
             [get_user_or_error(n).username for n in added_reviewers])
         reviewers_changes['removed'] = sorted(
             [get_user_or_error(n).username for n in removed_reviewers])
         Session().commit()
 
     data = {
         'msg': 'Updated pull request `{}`'.format(
             pull_request.pull_request_id),
         'pull_request': pull_request.get_api_data(),
         'updated_commits': commit_changes,
         'updated_reviewers': reviewers_changes
     }
 
     return data
 
 
 @jsonrpc_method()
 def close_pull_request(
         request, apiuser, repoid, pullrequestid,
         userid=Optional(OAttr('apiuser')), message=Optional('')):
     """
     Close the pull request specified by `pullrequestid`.
 
     :param apiuser: This is filled automatically from the |authtoken|.
     :type apiuser: AuthUser
     :param repoid: Repository name or repository ID to which the pull
         request belongs.
     :type repoid: str or int
     :param pullrequestid: ID of the pull request to be closed.
     :type pullrequestid: int
     :param userid: Close the pull request as this user.
     :type userid: Optional(str or int)
     :param message: Optional message to close the Pull Request with. If not
         specified it will be generated automatically.
     :type message: Optional(str)
 
     Example output:
 
     .. code-block:: bash
 
         "id": <id_given_in_input>,
         "result": {
             "pull_request_id":  "<int>",
             "close_status":     "<str:status_lbl>,
             "closed":           "<bool>"
         },
         "error": null
 
     """
     _ = request.translate
 
     repo = get_repo_or_error(repoid)
     if not isinstance(userid, Optional):
         if (has_superadmin_permission(apiuser) or
                 HasRepoPermissionAnyApi('repository.admin')(
                     user=apiuser, repo_name=repo.repo_name)):
             apiuser = get_user_or_error(userid)
         else:
             raise JSONRPCError('userid is not the same as your user')
 
     pull_request = get_pull_request_or_error(pullrequestid)
 
     if pull_request.is_closed():
         raise JSONRPCError(
             'pull request `%s` is already closed' % (pullrequestid,))
 
     # only owner or admin or person with write permissions
     allowed_to_close = PullRequestModel().check_user_update(
             pull_request, apiuser, api=True)
 
     if not allowed_to_close:
         raise JSONRPCError(
             'pull request `%s` close failed, no permission to close.' % (
                 pullrequestid,))
 
     # message we're using to close the PR, else it's automatically generated
     message = Optional.extract(message)
 
     # finally close the PR, with proper message comment
     comment, status = PullRequestModel().close_pull_request_with_comment(
         pull_request, apiuser, repo, message=message)
     status_lbl = ChangesetStatus.get_status_lbl(status)
 
     Session().commit()
 
     data = {
         'pull_request_id': pull_request.pull_request_id,
         'close_status': status_lbl,
         'closed': True,
     }
     return data

rhodecode/controllers/admin/users.py

@@ -1,643 +1,643 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 Users crud controller for pylons
 """
 
 import logging
 import formencode
 
 from formencode import htmlfill
 from pylons import request, tmpl_context as c, url, config
 from pylons.controllers.util import redirect
 from pylons.i18n.translation import _
 
 from rhodecode.authentication.plugins import auth_rhodecode
 
 from rhodecode.lib import helpers as h
 from rhodecode.lib import auth
 from rhodecode.lib import audit_logger
 from rhodecode.lib.auth import (
     LoginRequired, HasPermissionAllDecorator, AuthUser)
 from rhodecode.lib.base import BaseController, render
 from rhodecode.lib.exceptions import (
     DefaultUserException, UserOwnsReposException, UserOwnsRepoGroupsException,
     UserOwnsUserGroupsException, UserCreationError)
 from rhodecode.lib.utils2 import safe_int, AttributeDict
 
 from rhodecode.model.db import (
     PullRequestReviewers, User, UserEmailMap, UserIpMap, RepoGroup)
 from rhodecode.model.forms import (
     UserForm, UserPermissionsForm, UserIndividualPermissionsForm)
 from rhodecode.model.repo_group import RepoGroupModel
 from rhodecode.model.user import UserModel
 from rhodecode.model.meta import Session
 from rhodecode.model.permission import PermissionModel
 
 log = logging.getLogger(__name__)
 
 
 class UsersController(BaseController):
     """REST Controller styled on the Atom Publishing Protocol"""
 
     @LoginRequired()
     def __before__(self):
         super(UsersController, self).__before__()
         c.available_permissions = config['available_permissions']
         c.allowed_languages = [
             ('en', 'English (en)'),
             ('de', 'German (de)'),
             ('fr', 'French (fr)'),
             ('it', 'Italian (it)'),
             ('ja', 'Japanese (ja)'),
             ('pl', 'Polish (pl)'),
             ('pt', 'Portuguese (pt)'),
             ('ru', 'Russian (ru)'),
             ('zh', 'Chinese (zh)'),
         ]
         PermissionModel().set_global_permission_choices(c, gettext_translator=_)
 
     def _get_personal_repo_group_template_vars(self):
         DummyUser = AttributeDict({
             'username': '${username}',
             'user_id': '${user_id}',
         })
         c.default_create_repo_group = RepoGroupModel() \
             .get_default_create_personal_repo_group()
         c.personal_repo_group_name = RepoGroupModel() \
             .get_personal_group_name(DummyUser)
 
     @HasPermissionAllDecorator('hg.admin')
     @auth.CSRFRequired()
     def create(self):
         c.default_extern_type = auth_rhodecode.RhodeCodeAuthPlugin.name
         user_model = UserModel()
         user_form = UserForm()()
         try:
             form_result = user_form.to_python(dict(request.POST))
             user = user_model.create(form_result)
             Session().flush()
             creation_data = user.get_api_data()
             username = form_result['username']
 
             audit_logger.store_web(
                 'user.create', action_data={'data': creation_data},
                 user=c.rhodecode_user)
 
             user_link = h.link_to(h.escape(username),
                                   url('edit_user',
                                       user_id=user.user_id))
             h.flash(h.literal(_('Created user %(user_link)s')
                               % {'user_link': user_link}), category='success')
             Session().commit()
         except formencode.Invalid as errors:
             self._get_personal_repo_group_template_vars()
             return htmlfill.render(
                 render('admin/users/user_add.mako'),
                 defaults=errors.value,
                 errors=errors.error_dict or {},
                 prefix_error=False,
                 encoding="UTF-8",
                 force_defaults=False)
         except UserCreationError as e:
             h.flash(e, 'error')
         except Exception:
             log.exception("Exception creation of user")
             h.flash(_('Error occurred during creation of user %s')
                     % request.POST.get('username'), category='error')
         return redirect(h.route_path('users'))
 
     @HasPermissionAllDecorator('hg.admin')
     def new(self):
         c.default_extern_type = auth_rhodecode.RhodeCodeAuthPlugin.name
         self._get_personal_repo_group_template_vars()
         return render('admin/users/user_add.mako')
 
     @HasPermissionAllDecorator('hg.admin')
     @auth.CSRFRequired()
     def update(self, user_id):
 
         user_id = safe_int(user_id)
         c.user = User.get_or_404(user_id)
         c.active = 'profile'
         c.extern_type = c.user.extern_type
         c.extern_name = c.user.extern_name
         c.perm_user = AuthUser(user_id=user_id, ip_addr=self.ip_addr)
         available_languages = [x[0] for x in c.allowed_languages]
         _form = UserForm(edit=True, available_languages=available_languages,
                          old_data={'user_id': user_id,
                                    'email': c.user.email})()
         form_result = {}
         old_values = c.user.get_api_data()
         try:
             form_result = _form.to_python(dict(request.POST))
             skip_attrs = ['extern_type', 'extern_name']
             # TODO: plugin should define if username can be updated
             if c.extern_type != "rhodecode":
                 # forbid updating username for external accounts
                 skip_attrs.append('username')
 
             UserModel().update_user(
                 user_id, skip_attrs=skip_attrs, **form_result)
 
             audit_logger.store_web(
                 'user.edit', action_data={'old_data': old_values},
                 user=c.rhodecode_user)
 
             Session().commit()
             h.flash(_('User updated successfully'), category='success')
         except formencode.Invalid as errors:
             defaults = errors.value
             e = errors.error_dict or {}
 
             return htmlfill.render(
                 render('admin/users/user_edit.mako'),
                 defaults=defaults,
                 errors=e,
                 prefix_error=False,
                 encoding="UTF-8",
                 force_defaults=False)
         except UserCreationError as e:
             h.flash(e, 'error')
         except Exception:
             log.exception("Exception updating user")
             h.flash(_('Error occurred during update of user %s')
                     % form_result.get('username'), category='error')
         return redirect(url('edit_user', user_id=user_id))
 
     @HasPermissionAllDecorator('hg.admin')
     @auth.CSRFRequired()
     def delete(self, user_id):
         user_id = safe_int(user_id)
         c.user = User.get_or_404(user_id)
 
         _repos = c.user.repositories
         _repo_groups = c.user.repository_groups
         _user_groups = c.user.user_groups
 
         handle_repos = None
         handle_repo_groups = None
         handle_user_groups = None
         # dummy call for flash of handle
         set_handle_flash_repos = lambda: None
         set_handle_flash_repo_groups = lambda: None
         set_handle_flash_user_groups = lambda: None
 
         if _repos and request.POST.get('user_repos'):
             do = request.POST['user_repos']
             if do == 'detach':
                 handle_repos = 'detach'
                 set_handle_flash_repos = lambda: h.flash(
                     _('Detached %s repositories') % len(_repos),
                     category='success')
             elif do == 'delete':
                 handle_repos = 'delete'
                 set_handle_flash_repos = lambda: h.flash(
                     _('Deleted %s repositories') % len(_repos),
                     category='success')
 
         if _repo_groups and request.POST.get('user_repo_groups'):
             do = request.POST['user_repo_groups']
             if do == 'detach':
                 handle_repo_groups = 'detach'
                 set_handle_flash_repo_groups = lambda: h.flash(
                     _('Detached %s repository groups') % len(_repo_groups),
                     category='success')
             elif do == 'delete':
                 handle_repo_groups = 'delete'
                 set_handle_flash_repo_groups = lambda: h.flash(
                     _('Deleted %s repository groups') % len(_repo_groups),
                     category='success')
 
         if _user_groups and request.POST.get('user_user_groups'):
             do = request.POST['user_user_groups']
             if do == 'detach':
                 handle_user_groups = 'detach'
                 set_handle_flash_user_groups = lambda: h.flash(
                     _('Detached %s user groups') % len(_user_groups),
                     category='success')
             elif do == 'delete':
                 handle_user_groups = 'delete'
                 set_handle_flash_user_groups = lambda: h.flash(
                     _('Deleted %s user groups') % len(_user_groups),
                     category='success')
 
         old_values = c.user.get_api_data()
         try:
             UserModel().delete(c.user, handle_repos=handle_repos,
                                handle_repo_groups=handle_repo_groups,
                                handle_user_groups=handle_user_groups)
 
             audit_logger.store_web(
                 'user.delete', action_data={'old_data': old_values},
                 user=c.rhodecode_user)
 
             Session().commit()
             set_handle_flash_repos()
             set_handle_flash_repo_groups()
             set_handle_flash_user_groups()
             h.flash(_('Successfully deleted user'), category='success')
         except (UserOwnsReposException, UserOwnsRepoGroupsException,
                 UserOwnsUserGroupsException, DefaultUserException) as e:
             h.flash(e, category='warning')
         except Exception:
             log.exception("Exception during deletion of user")
             h.flash(_('An error occurred during deletion of user'),
                     category='error')
         return redirect(h.route_path('users'))
 
     @HasPermissionAllDecorator('hg.admin')
     @auth.CSRFRequired()
     def reset_password(self, user_id):
         """
         toggle reset password flag for this user
         """
         user_id = safe_int(user_id)
         c.user = User.get_or_404(user_id)
         try:
             old_value = c.user.user_data.get('force_password_change')
             c.user.update_userdata(force_password_change=not old_value)
 
             if old_value:
                 msg = _('Force password change disabled for user')
                 audit_logger.store_web(
                     'user.edit.password_reset.disabled',
                     user=c.rhodecode_user)
             else:
                 msg = _('Force password change enabled for user')
                 audit_logger.store_web(
                     'user.edit.password_reset.enabled',
                     user=c.rhodecode_user)
 
             Session().commit()
             h.flash(msg, category='success')
         except Exception:
             log.exception("Exception during password reset for user")
             h.flash(_('An error occurred during password reset for user'),
                     category='error')
 
         return redirect(url('edit_user_advanced', user_id=user_id))
 
     @HasPermissionAllDecorator('hg.admin')
     @auth.CSRFRequired()
     def create_personal_repo_group(self, user_id):
         """
         Create personal repository group for this user
         """
         from rhodecode.model.repo_group import RepoGroupModel
 
         user_id = safe_int(user_id)
         c.user = User.get_or_404(user_id)
         personal_repo_group = RepoGroup.get_user_personal_repo_group(
             c.user.user_id)
         if personal_repo_group:
             return redirect(url('edit_user_advanced', user_id=user_id))
 
         personal_repo_group_name = RepoGroupModel().get_personal_group_name(
             c.user)
         named_personal_group = RepoGroup.get_by_group_name(
             personal_repo_group_name)
         try:
 
             if named_personal_group and named_personal_group.user_id == c.user.user_id:
                 # migrate the same named group, and mark it as personal
                 named_personal_group.personal = True
                 Session().add(named_personal_group)
                 Session().commit()
                 msg = _('Linked repository group `%s` as personal' % (
                     personal_repo_group_name,))
                 h.flash(msg, category='success')
             elif not named_personal_group:
                 RepoGroupModel().create_personal_repo_group(c.user)
 
                 msg = _('Created repository group `%s`' % (
                     personal_repo_group_name,))
                 h.flash(msg, category='success')
             else:
                 msg = _('Repository group `%s` is already taken' % (
                     personal_repo_group_name,))
                 h.flash(msg, category='warning')
         except Exception:
             log.exception("Exception during repository group creation")
             msg = _(
                 'An error occurred during repository group creation for user')
             h.flash(msg, category='error')
             Session().rollback()
 
         return redirect(url('edit_user_advanced', user_id=user_id))
 
     @HasPermissionAllDecorator('hg.admin')
     def show(self, user_id):
         """GET /users/user_id: Show a specific item"""
         # url('user', user_id=ID)
         User.get_or_404(-1)
 
     @HasPermissionAllDecorator('hg.admin')
     def edit(self, user_id):
         """GET /users/user_id/edit: Form to edit an existing item"""
         # url('edit_user', user_id=ID)
         user_id = safe_int(user_id)
         c.user = User.get_or_404(user_id)
         if c.user.username == User.DEFAULT_USER:
             h.flash(_("You can't edit this user"), category='warning')
             return redirect(h.route_path('users'))
 
         c.active = 'profile'
         c.extern_type = c.user.extern_type
         c.extern_name = c.user.extern_name
         c.perm_user = AuthUser(user_id=user_id, ip_addr=self.ip_addr)
 
         defaults = c.user.get_dict()
         defaults.update({'language': c.user.user_data.get('language')})
         return htmlfill.render(
             render('admin/users/user_edit.mako'),
             defaults=defaults,
             encoding="UTF-8",
             force_defaults=False)
 
     @HasPermissionAllDecorator('hg.admin')
     def edit_advanced(self, user_id):
         user_id = safe_int(user_id)
         user = c.user = User.get_or_404(user_id)
         if user.username == User.DEFAULT_USER:
             h.flash(_("You can't edit this user"), category='warning')
             return redirect(h.route_path('users'))
 
         c.active = 'advanced'
         c.personal_repo_group = RepoGroup.get_user_personal_repo_group(user_id)
         c.personal_repo_group_name = RepoGroupModel()\
             .get_personal_group_name(user)
         c.first_admin = User.get_first_super_admin()
         defaults = user.get_dict()
 
         # Interim workaround if the user participated on any pull requests as a
         # reviewer.
         has_review = bool(PullRequestReviewers.query().filter(
             PullRequestReviewers.user_id == user_id).first())
         c.can_delete_user = not has_review
         c.can_delete_user_message = _(
             'The user participates as reviewer in pull requests and '
             'cannot be deleted. You can set the user to '
             '"inactive" instead of deleting it.') if has_review else ''
 
         return htmlfill.render(
             render('admin/users/user_edit.mako'),
             defaults=defaults,
             encoding="UTF-8",
             force_defaults=False)
 
     @HasPermissionAllDecorator('hg.admin')
     def edit_global_perms(self, user_id):
         user_id = safe_int(user_id)
         c.user = User.get_or_404(user_id)
         if c.user.username == User.DEFAULT_USER:
             h.flash(_("You can't edit this user"), category='warning')
             return redirect(h.route_path('users'))
 
         c.active = 'global_perms'
 
         c.default_user = User.get_default_user()
         defaults = c.user.get_dict()
         defaults.update(c.default_user.get_default_perms(suffix='_inherited'))
         defaults.update(c.default_user.get_default_perms())
         defaults.update(c.user.get_default_perms())
 
         return htmlfill.render(
             render('admin/users/user_edit.mako'),
             defaults=defaults,
             encoding="UTF-8",
             force_defaults=False)
 
     @HasPermissionAllDecorator('hg.admin')
     @auth.CSRFRequired()
     def update_global_perms(self, user_id):
         user_id = safe_int(user_id)
         user = User.get_or_404(user_id)
         c.active = 'global_perms'
         try:
             # first stage that verifies the checkbox
             _form = UserIndividualPermissionsForm()
             form_result = _form.to_python(dict(request.POST))
             inherit_perms = form_result['inherit_default_permissions']
             user.inherit_default_permissions = inherit_perms
             Session().add(user)
 
             if not inherit_perms:
                 # only update the individual ones if we un check the flag
                 _form = UserPermissionsForm(
                     [x[0] for x in c.repo_create_choices],
                     [x[0] for x in c.repo_create_on_write_choices],
                     [x[0] for x in c.repo_group_create_choices],
                     [x[0] for x in c.user_group_create_choices],
                     [x[0] for x in c.fork_choices],
                     [x[0] for x in c.inherit_default_permission_choices])()
 
                 form_result = _form.to_python(dict(request.POST))
                 form_result.update({'perm_user_id': user.user_id})
 
                 PermissionModel().update_user_permissions(form_result)
 
             # TODO(marcink): implement global permissions
             # audit_log.store_web('user.edit.permissions')
 
             Session().commit()
             h.flash(_('User global permissions updated successfully'),
                     category='success')
 
         except formencode.Invalid as errors:
             defaults = errors.value
             c.user = user
             return htmlfill.render(
                 render('admin/users/user_edit.mako'),
                 defaults=defaults,
                 errors=errors.error_dict or {},
                 prefix_error=False,
                 encoding="UTF-8",
                 force_defaults=False)
         except Exception:
             log.exception("Exception during permissions saving")
             h.flash(_('An error occurred during permissions saving'),
                     category='error')
         return redirect(url('edit_user_global_perms', user_id=user_id))
 
     @HasPermissionAllDecorator('hg.admin')
     def edit_perms_summary(self, user_id):
         user_id = safe_int(user_id)
         c.user = User.get_or_404(user_id)
         if c.user.username == User.DEFAULT_USER:
             h.flash(_("You can't edit this user"), category='warning')
             return redirect(h.route_path('users'))
 
         c.active = 'perms_summary'
         c.perm_user = AuthUser(user_id=user_id, ip_addr=self.ip_addr)
 
         return render('admin/users/user_edit.mako')
 
     @HasPermissionAllDecorator('hg.admin')
     def edit_emails(self, user_id):
         user_id = safe_int(user_id)
         c.user = User.get_or_404(user_id)
         if c.user.username == User.DEFAULT_USER:
             h.flash(_("You can't edit this user"), category='warning')
             return redirect(h.route_path('users'))
 
         c.active = 'emails'
         c.user_email_map = UserEmailMap.query() \
             .filter(UserEmailMap.user == c.user).all()
 
         defaults = c.user.get_dict()
         return htmlfill.render(
             render('admin/users/user_edit.mako'),
             defaults=defaults,
             encoding="UTF-8",
             force_defaults=False)
 
     @HasPermissionAllDecorator('hg.admin')
     @auth.CSRFRequired()
     def add_email(self, user_id):
         user_id = safe_int(user_id)
         c.user = User.get_or_404(user_id)
 
         email = request.POST.get('new_email')
         user_model = UserModel()
         user_data = c.user.get_api_data()
         try:
             user_model.add_extra_email(user_id, email)
             audit_logger.store_web(
                 'user.edit.email.add',
                 action_data={'email': email, 'user': user_data},
                 user=c.rhodecode_user)
             Session().commit()
             h.flash(_("Added new email address `%s` for user account") % email,
                     category='success')
         except formencode.Invalid as error:
             msg = error.error_dict['email']
             h.flash(msg, category='error')
         except Exception:
             log.exception("Exception during email saving")
             h.flash(_('An error occurred during email saving'),
                     category='error')
         return redirect(url('edit_user_emails', user_id=user_id))
 
     @HasPermissionAllDecorator('hg.admin')
     @auth.CSRFRequired()
     def delete_email(self, user_id):
         user_id = safe_int(user_id)
         c.user = User.get_or_404(user_id)
         email_id = request.POST.get('del_email_id')
         user_model = UserModel()
 
         email = UserEmailMap.query().get(email_id).email
         user_data = c.user.get_api_data()
         user_model.delete_extra_email(user_id, email_id)
         audit_logger.store_web(
             'user.edit.email.delete',
             action_data={'email': email, 'user': user_data},
             user=c.rhodecode_user)
         Session().commit()
         h.flash(_("Removed email address from user account"), category='success')
         return redirect(url('edit_user_emails', user_id=user_id))
 
     @HasPermissionAllDecorator('hg.admin')
     def edit_ips(self, user_id):
         user_id = safe_int(user_id)
         c.user = User.get_or_404(user_id)
         if c.user.username == User.DEFAULT_USER:
             h.flash(_("You can't edit this user"), category='warning')
             return redirect(h.route_path('users'))
 
         c.active = 'ips'
         c.user_ip_map = UserIpMap.query() \
             .filter(UserIpMap.user == c.user).all()
 
         c.inherit_default_ips = c.user.inherit_default_permissions
         c.default_user_ip_map = UserIpMap.query() \
             .filter(UserIpMap.user == User.get_default_user()).all()
 
         defaults = c.user.get_dict()
         return htmlfill.render(
             render('admin/users/user_edit.mako'),
             defaults=defaults,
             encoding="UTF-8",
             force_defaults=False)
 
     @HasPermissionAllDecorator('hg.admin')
     @auth.CSRFRequired()
     def add_ip(self, user_id):
         user_id = safe_int(user_id)
         c.user = User.get_or_404(user_id)
         user_model = UserModel()
         try:
             ip_list = user_model.parse_ip_range(request.POST.get('new_ip'))
         except Exception as e:
             ip_list = []
             log.exception("Exception during ip saving")
             h.flash(_('An error occurred during ip saving:%s' % (e,)),
                     category='error')
 
         desc = request.POST.get('description')
         added = []
         user_data = c.user.get_api_data()
         for ip in ip_list:
             try:
                 user_model.add_extra_ip(user_id, ip, desc)
                 audit_logger.store_web(
                     'user.edit.ip.add',
                     action_data={'ip': ip, 'user': user_data},
                     user=c.rhodecode_user)
                 Session().commit()
                 added.append(ip)
             except formencode.Invalid as error:
                 msg = error.error_dict['ip']
                 h.flash(msg, category='error')
             except Exception:
                 log.exception("Exception during ip saving")
                 h.flash(_('An error occurred during ip saving'),
                         category='error')
         if added:
             h.flash(
                 _("Added ips %s to user whitelist") % (', '.join(ip_list), ),
                 category='success')
         if 'default_user' in request.POST:
             return redirect(url('admin_permissions_ips'))
         return redirect(url('edit_user_ips', user_id=user_id))
 
     @HasPermissionAllDecorator('hg.admin')
     @auth.CSRFRequired()
     def delete_ip(self, user_id):
         user_id = safe_int(user_id)
         c.user = User.get_or_404(user_id)
 
         ip_id = request.POST.get('del_ip_id')
         user_model = UserModel()
+        user_data = c.user.get_api_data()
         ip = UserIpMap.query().get(ip_id).ip_addr
-        user_data = c.user.get_api_data()
         user_model.delete_extra_ip(user_id, ip_id)
         audit_logger.store_web(
             'user.edit.ip.delete',
             action_data={'ip': ip, 'user': user_data},
             user=c.rhodecode_user)
         Session().commit()
         h.flash(_("Removed ip address from user whitelist"), category='success')
 
         if 'default_user' in request.POST:
             return redirect(url('admin_permissions_ips'))
         return redirect(url('edit_user_ips', user_id=user_id))

rhodecode/controllers/changeset.py

@@ -1,484 +1,484 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 commit controller for RhodeCode showing changes between commits
 """
 
 import logging
 
 from collections import defaultdict
 from webob.exc import HTTPForbidden, HTTPBadRequest, HTTPNotFound
 
 from pylons import tmpl_context as c, request, response
 from pylons.i18n.translation import _
 from pylons.controllers.util import redirect
 
 from rhodecode.lib import auth
 from rhodecode.lib import diffs, codeblocks
 from rhodecode.lib.auth import (
     LoginRequired, HasRepoPermissionAnyDecorator, NotAnonymous)
 from rhodecode.lib.base import BaseRepoController, render
 from rhodecode.lib.compat import OrderedDict
 from rhodecode.lib.exceptions import StatusChangeOnClosedPullRequestError
 import rhodecode.lib.helpers as h
 from rhodecode.lib.utils import jsonify
 from rhodecode.lib.utils2 import safe_unicode
 from rhodecode.lib.vcs.backends.base import EmptyCommit
 from rhodecode.lib.vcs.exceptions import (
     RepositoryError, CommitDoesNotExistError, NodeDoesNotExistError)
 from rhodecode.model.db import ChangesetComment, ChangesetStatus
 from rhodecode.model.changeset_status import ChangesetStatusModel
 from rhodecode.model.comment import CommentsModel
 from rhodecode.model.meta import Session
 
 
 log = logging.getLogger(__name__)
 
 
 def _update_with_GET(params, GET):
     for k in ['diff1', 'diff2', 'diff']:
         params[k] += GET.getall(k)
 
 
 def get_ignore_ws(fid, GET):
     ig_ws_global = GET.get('ignorews')
     ig_ws = filter(lambda k: k.startswith('WS'), GET.getall(fid))
     if ig_ws:
         try:
             return int(ig_ws[0].split(':')[-1])
         except Exception:
             pass
     return ig_ws_global
 
 
 def _ignorews_url(GET, fileid=None):
     fileid = str(fileid) if fileid else None
     params = defaultdict(list)
     _update_with_GET(params, GET)
     label = _('Show whitespace')
     tooltiplbl = _('Show whitespace for all diffs')
     ig_ws = get_ignore_ws(fileid, GET)
     ln_ctx = get_line_ctx(fileid, GET)
 
     if ig_ws is None:
         params['ignorews'] += [1]
         label = _('Ignore whitespace')
         tooltiplbl = _('Ignore whitespace for all diffs')
     ctx_key = 'context'
     ctx_val = ln_ctx
 
     # if we have passed in ln_ctx pass it along to our params
     if ln_ctx:
         params[ctx_key] += [ctx_val]
 
     if fileid:
         params['anchor'] = 'a_' + fileid
     return h.link_to(label, h.url.current(**params), title=tooltiplbl, class_='tooltip')
 
 
 def get_line_ctx(fid, GET):
     ln_ctx_global = GET.get('context')
     if fid:
         ln_ctx = filter(lambda k: k.startswith('C'), GET.getall(fid))
     else:
         _ln_ctx = filter(lambda k: k.startswith('C'), GET)
         ln_ctx = GET.get(_ln_ctx[0]) if _ln_ctx  else ln_ctx_global
         if ln_ctx:
             ln_ctx = [ln_ctx]
 
     if ln_ctx:
         retval = ln_ctx[0].split(':')[-1]
     else:
         retval = ln_ctx_global
 
     try:
         return int(retval)
     except Exception:
         return 3
 
 
 def _context_url(GET, fileid=None):
     """
     Generates a url for context lines.
 
     :param fileid:
     """
 
     fileid = str(fileid) if fileid else None
     ig_ws = get_ignore_ws(fileid, GET)
     ln_ctx = (get_line_ctx(fileid, GET) or 3) * 2
 
     params = defaultdict(list)
     _update_with_GET(params, GET)
 
     if ln_ctx > 0:
         params['context'] += [ln_ctx]
 
     if ig_ws:
         ig_ws_key = 'ignorews'
         ig_ws_val = 1
         params[ig_ws_key] += [ig_ws_val]
 
     lbl = _('Increase context')
     tooltiplbl = _('Increase context for all diffs')
 
     if fileid:
         params['anchor'] = 'a_' + fileid
     return h.link_to(lbl, h.url.current(**params), title=tooltiplbl, class_='tooltip')
 
 
 class ChangesetController(BaseRepoController):
 
     def __before__(self):
         super(ChangesetController, self).__before__()
         c.affected_files_cut_off = 60
 
     def _index(self, commit_id_range, method):
         c.ignorews_url = _ignorews_url
         c.context_url = _context_url
         c.fulldiff = fulldiff = request.GET.get('fulldiff')
 
         # fetch global flags of ignore ws or context lines
         context_lcl = get_line_ctx('', request.GET)
         ign_whitespace_lcl = get_ignore_ws('', request.GET)
 
         # diff_limit will cut off the whole diff if the limit is applied
         # otherwise it will just hide the big files from the front-end
         diff_limit = self.cut_off_limit_diff
         file_limit = self.cut_off_limit_file
 
         # get ranges of commit ids if preset
         commit_range = commit_id_range.split('...')[:2]
 
         try:
             pre_load = ['affected_files', 'author', 'branch', 'date',
                         'message', 'parents']
 
             if len(commit_range) == 2:
                 commits = c.rhodecode_repo.get_commits(
                     start_id=commit_range[0], end_id=commit_range[1],
                     pre_load=pre_load)
                 commits = list(commits)
             else:
                 commits = [c.rhodecode_repo.get_commit(
                     commit_id=commit_id_range, pre_load=pre_load)]
 
             c.commit_ranges = commits
             if not c.commit_ranges:
                 raise RepositoryError(
                     'The commit range returned an empty result')
         except CommitDoesNotExistError:
             msg = _('No such commit exists for this repository')
             h.flash(msg, category='error')
             raise HTTPNotFound()
         except Exception:
             log.exception("General failure")
             raise HTTPNotFound()
 
         c.changes = OrderedDict()
         c.lines_added = 0
         c.lines_deleted = 0
 
         # auto collapse if we have more than limit
         collapse_limit = diffs.DiffProcessor._collapse_commits_over
         c.collapse_all_commits = len(c.commit_ranges) > collapse_limit
 
         c.commit_statuses = ChangesetStatus.STATUSES
         c.inline_comments = []
         c.files = []
 
         c.statuses = []
         c.comments = []
         c.unresolved_comments = []
         if len(c.commit_ranges) == 1:
             commit = c.commit_ranges[0]
             c.comments = CommentsModel().get_comments(
                 c.rhodecode_db_repo.repo_id,
                 revision=commit.raw_id)
             c.statuses.append(ChangesetStatusModel().get_status(
                 c.rhodecode_db_repo.repo_id, commit.raw_id))
             # comments from PR
             statuses = ChangesetStatusModel().get_statuses(
                 c.rhodecode_db_repo.repo_id, commit.raw_id,
                 with_revisions=True)
             prs = set(st.pull_request for st in statuses
                       if st.pull_request is not None)
             # from associated statuses, check the pull requests, and
             # show comments from them
             for pr in prs:
                 c.comments.extend(pr.comments)
 
             c.unresolved_comments = CommentsModel()\
                 .get_commit_unresolved_todos(commit.raw_id)
 
         # Iterate over ranges (default commit view is always one commit)
         for commit in c.commit_ranges:
             c.changes[commit.raw_id] = []
 
             commit2 = commit
             commit1 = commit.parents[0] if commit.parents else EmptyCommit()
 
             _diff = c.rhodecode_repo.get_diff(
                 commit1, commit2,
                 ignore_whitespace=ign_whitespace_lcl, context=context_lcl)
             diff_processor = diffs.DiffProcessor(
                 _diff, format='newdiff', diff_limit=diff_limit,
                 file_limit=file_limit, show_full_diff=fulldiff)
 
             commit_changes = OrderedDict()
             if method == 'show':
                 _parsed = diff_processor.prepare()
                 c.limited_diff = isinstance(_parsed, diffs.LimitedDiffContainer)
 
                 _parsed = diff_processor.prepare()
 
                 def _node_getter(commit):
                     def get_node(fname):
                         try:
                             return commit.get_node(fname)
                         except NodeDoesNotExistError:
                             return None
                     return get_node
 
                 inline_comments = CommentsModel().get_inline_comments(
                     c.rhodecode_db_repo.repo_id, revision=commit.raw_id)
                 c.inline_cnt = CommentsModel().get_inline_comments_count(
                     inline_comments)
 
                 diffset = codeblocks.DiffSet(
                     repo_name=c.repo_name,
                     source_node_getter=_node_getter(commit1),
                     target_node_getter=_node_getter(commit2),
                     comments=inline_comments
                 ).render_patchset(_parsed, commit1.raw_id, commit2.raw_id)
                 c.changes[commit.raw_id] = diffset
             else:
                 # downloads/raw we only need RAW diff nothing else
                 diff = diff_processor.as_raw()
                 c.changes[commit.raw_id] = [None, None, None, None, diff, None, None]
 
         # sort comments by how they were generated
         c.comments = sorted(c.comments, key=lambda x: x.comment_id)
 
         if len(c.commit_ranges) == 1:
             c.commit = c.commit_ranges[0]
             c.parent_tmpl = ''.join(
                 '# Parent  %s\n' % x.raw_id for x in c.commit.parents)
         if method == 'download':
             response.content_type = 'text/plain'
             response.content_disposition = (
                 'attachment; filename=%s.diff' % commit_id_range[:12])
             return diff
         elif method == 'patch':
             response.content_type = 'text/plain'
             c.diff = safe_unicode(diff)
             return render('changeset/patch_changeset.mako')
         elif method == 'raw':
             response.content_type = 'text/plain'
             return diff
         elif method == 'show':
             if len(c.commit_ranges) == 1:
                 return render('changeset/changeset.mako')
             else:
                 c.ancestor = None
                 c.target_repo = c.rhodecode_db_repo
                 return render('changeset/changeset_range.mako')
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     def index(self, revision, method='show'):
         return self._index(revision, method=method)
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     def changeset_raw(self, revision):
         return self._index(revision, method='raw')
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     def changeset_patch(self, revision):
         return self._index(revision, method='patch')
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     def changeset_download(self, revision):
         return self._index(revision, method='download')
 
     @LoginRequired()
     @NotAnonymous()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     @auth.CSRFRequired()
     @jsonify
     def comment(self, repo_name, revision):
         commit_id = revision
         status = request.POST.get('changeset_status', None)
         text = request.POST.get('text')
         comment_type = request.POST.get('comment_type')
         resolves_comment_id = request.POST.get('resolves_comment_id', None)
 
         if status:
             text = text or (_('Status change %(transition_icon)s %(status)s')
                             % {'transition_icon': '>',
                                'status': ChangesetStatus.get_status_lbl(status)})
 
         multi_commit_ids = []
         for _commit_id in request.POST.get('commit_ids', '').split(','):
             if _commit_id not in ['', None, EmptyCommit.raw_id]:
                 if _commit_id not in multi_commit_ids:
                     multi_commit_ids.append(_commit_id)
 
         commit_ids = multi_commit_ids or [commit_id]
 
         comment = None
         for current_id in filter(None, commit_ids):
             c.co = comment = CommentsModel().create(
                 text=text,
                 repo=c.rhodecode_db_repo.repo_id,
                 user=c.rhodecode_user.user_id,
                 commit_id=current_id,
                 f_path=request.POST.get('f_path'),
                 line_no=request.POST.get('line'),
                 status_change=(ChangesetStatus.get_status_lbl(status)
                                if status else None),
                 status_change_type=status,
                 comment_type=comment_type,
                 resolves_comment_id=resolves_comment_id
             )
 
             # get status if set !
             if status:
                 # if latest status was from pull request and it's closed
                 # disallow changing status !
                 # dont_allow_on_closed_pull_request = True !
 
                 try:
                     ChangesetStatusModel().set_status(
                         c.rhodecode_db_repo.repo_id,
                         status,
                         c.rhodecode_user.user_id,
                         comment,
                         revision=current_id,
                         dont_allow_on_closed_pull_request=True
                     )
                 except StatusChangeOnClosedPullRequestError:
                     msg = _('Changing the status of a commit associated with '
                             'a closed pull request is not allowed')
                     log.exception(msg)
                     h.flash(msg, category='warning')
                     return redirect(h.url(
                         'changeset_home', repo_name=repo_name,
                         revision=current_id))
 
         # finalize, commit and redirect
         Session().commit()
 
         data = {
             'target_id': h.safeid(h.safe_unicode(request.POST.get('f_path'))),
         }
         if comment:
             data.update(comment.get_dict())
             data.update({'rendered_text':
                          render('changeset/changeset_comment_block.mako')})
 
         return data
 
     @LoginRequired()
     @NotAnonymous()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     @auth.CSRFRequired()
     def preview_comment(self):
         # Technically a CSRF token is not needed as no state changes with this
         # call. However, as this is a POST is better to have it, so automated
         # tools don't flag it as potential CSRF.
         # Post is required because the payload could be bigger than the maximum
         # allowed by GET.
         if not request.environ.get('HTTP_X_PARTIAL_XHR'):
             raise HTTPBadRequest()
         text = request.POST.get('text')
         renderer = request.POST.get('renderer') or 'rst'
         if text:
             return h.render(text, renderer=renderer, mentions=True)
         return ''
 
     @LoginRequired()
     @NotAnonymous()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     @auth.CSRFRequired()
     @jsonify
     def delete_comment(self, repo_name, comment_id):
         comment = ChangesetComment.get(comment_id)
         if not comment:
             log.debug('Comment with id:%s not found, skipping', comment_id)
             # comment already deleted in another call probably
             return True
 
         owner = (comment.author.user_id == c.rhodecode_user.user_id)
         is_repo_admin = h.HasRepoPermissionAny('repository.admin')(c.repo_name)
         if h.HasPermissionAny('hg.admin')() or is_repo_admin or owner:
-            CommentsModel().delete(comment=comment)
+            CommentsModel().delete(comment=comment, user=c.rhodecode_user)
             Session().commit()
             return True
         else:
             raise HTTPForbidden()
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     @jsonify
     def changeset_info(self, repo_name, revision):
         if request.is_xhr:
             try:
                 return c.rhodecode_repo.get_commit(commit_id=revision)
             except CommitDoesNotExistError as e:
                 return EmptyCommit(message=str(e))
         else:
             raise HTTPBadRequest()
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     @jsonify
     def changeset_children(self, repo_name, revision):
         if request.is_xhr:
             commit = c.rhodecode_repo.get_commit(commit_id=revision)
             result = {"results": commit.children}
             return result
         else:
             raise HTTPBadRequest()
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     @jsonify
     def changeset_parents(self, repo_name, revision):
         if request.is_xhr:
             commit = c.rhodecode_repo.get_commit(commit_id=revision)
             result = {"results": commit.parents}
             return result
         else:
             raise HTTPBadRequest()

rhodecode/controllers/files.py

@@ -1,1110 +1,1110 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 Files controller for RhodeCode Enterprise
 """
 
 import itertools
 import logging
 import os
 import shutil
 import tempfile
 
 from pylons import request, response, tmpl_context as c, url
 from pylons.i18n.translation import _
 from pylons.controllers.util import redirect
 from webob.exc import HTTPNotFound, HTTPBadRequest
 
 from rhodecode.controllers.utils import parse_path_ref
 from rhodecode.lib import diffs, helpers as h, caches
 from rhodecode.lib import audit_logger
 from rhodecode.lib.codeblocks import (
     filenode_as_lines_tokens, filenode_as_annotated_lines_tokens)
-from rhodecode.lib.utils import jsonify, action_logger
+from rhodecode.lib.utils import jsonify
 from rhodecode.lib.utils2 import (
     convert_line_endings, detect_mode, safe_str, str2bool)
 from rhodecode.lib.auth import (
     LoginRequired, HasRepoPermissionAnyDecorator, CSRFRequired, XHRRequired)
 from rhodecode.lib.base import BaseRepoController, render
 from rhodecode.lib.vcs import path as vcspath
 from rhodecode.lib.vcs.backends.base import EmptyCommit
 from rhodecode.lib.vcs.conf import settings
 from rhodecode.lib.vcs.exceptions import (
     RepositoryError, CommitDoesNotExistError, EmptyRepositoryError,
     ImproperArchiveTypeError, VCSError, NodeAlreadyExistsError,
     NodeDoesNotExistError, CommitError, NodeError)
 from rhodecode.lib.vcs.nodes import FileNode
 
 from rhodecode.model.repo import RepoModel
 from rhodecode.model.scm import ScmModel
 from rhodecode.model.db import Repository
 
 from rhodecode.controllers.changeset import (
     _ignorews_url, _context_url, get_line_ctx, get_ignore_ws)
 from rhodecode.lib.exceptions import NonRelativePathError
 
 log = logging.getLogger(__name__)
 
 
 class FilesController(BaseRepoController):
 
     def __before__(self):
         super(FilesController, self).__before__()
         c.cut_off_limit = self.cut_off_limit_file
 
     def _get_default_encoding(self):
         enc_list = getattr(c, 'default_encodings', [])
         return enc_list[0] if enc_list else 'UTF-8'
 
     def __get_commit_or_redirect(self, commit_id, repo_name,
                                  redirect_after=True):
         """
         This is a safe way to get commit. If an error occurs it redirects to
         tip with proper message
 
         :param commit_id: id of commit to fetch
         :param repo_name: repo name to redirect after
         :param redirect_after: toggle redirection
         """
         try:
             return c.rhodecode_repo.get_commit(commit_id)
         except EmptyRepositoryError:
             if not redirect_after:
                 return None
             url_ = url('files_add_home',
                        repo_name=c.repo_name,
                        revision=0, f_path='', anchor='edit')
             if h.HasRepoPermissionAny(
                     'repository.write', 'repository.admin')(c.repo_name):
                 add_new = h.link_to(
                     _('Click here to add a new file.'),
                     url_, class_="alert-link")
             else:
                 add_new = ""
             h.flash(h.literal(
                 _('There are no files yet. %s') % add_new), category='warning')
             redirect(h.route_path('repo_summary', repo_name=repo_name))
         except (CommitDoesNotExistError, LookupError):
             msg = _('No such commit exists for this repository')
             h.flash(msg, category='error')
             raise HTTPNotFound()
         except RepositoryError as e:
             h.flash(safe_str(e), category='error')
             raise HTTPNotFound()
 
     def __get_filenode_or_redirect(self, repo_name, commit, path):
         """
         Returns file_node, if error occurs or given path is directory,
         it'll redirect to top level path
 
         :param repo_name: repo_name
         :param commit: given commit
         :param path: path to lookup
         """
         try:
             file_node = commit.get_node(path)
             if file_node.is_dir():
                 raise RepositoryError('The given path is a directory')
         except CommitDoesNotExistError:
             msg = _('No such commit exists for this repository')
             log.exception(msg)
             h.flash(msg, category='error')
             raise HTTPNotFound()
         except RepositoryError as e:
             h.flash(safe_str(e), category='error')
             raise HTTPNotFound()
 
         return file_node
 
     def __get_tree_cache_manager(self, repo_name, namespace_type):
         _namespace = caches.get_repo_namespace_key(namespace_type, repo_name)
         return caches.get_cache_manager('repo_cache_long', _namespace)
 
     def _get_tree_at_commit(self, repo_name, commit_id, f_path,
                             full_load=False, force=False):
         def _cached_tree():
             log.debug('Generating cached file tree for %s, %s, %s',
                       repo_name, commit_id, f_path)
             c.full_load = full_load
             return render('files/files_browser_tree.mako')
 
         cache_manager = self.__get_tree_cache_manager(
             repo_name, caches.FILE_TREE)
 
         cache_key = caches.compute_key_from_params(
             repo_name, commit_id, f_path)
 
         if force:
             # we want to force recompute of caches
             cache_manager.remove_value(cache_key)
 
         return cache_manager.get(cache_key, createfunc=_cached_tree)
 
     def _get_nodelist_at_commit(self, repo_name, commit_id, f_path):
         def _cached_nodes():
             log.debug('Generating cached nodelist for %s, %s, %s',
                       repo_name, commit_id, f_path)
             _d, _f = ScmModel().get_nodes(
                 repo_name, commit_id, f_path, flat=False)
             return _d + _f
 
         cache_manager = self.__get_tree_cache_manager(
             repo_name, caches.FILE_SEARCH_TREE_META)
 
         cache_key = caches.compute_key_from_params(
             repo_name, commit_id, f_path)
         return cache_manager.get(cache_key, createfunc=_cached_nodes)
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator(
         'repository.read', 'repository.write', 'repository.admin')
     def index(
             self, repo_name, revision, f_path, annotate=False, rendered=False):
         commit_id = revision
 
         # redirect to given commit_id from form if given
         get_commit_id = request.GET.get('at_rev', None)
         if get_commit_id:
             self.__get_commit_or_redirect(get_commit_id, repo_name)
 
         c.commit = self.__get_commit_or_redirect(commit_id, repo_name)
         c.branch = request.GET.get('branch', None)
         c.f_path = f_path
         c.annotate = annotate
         # default is false, but .rst/.md files later are autorendered, we can
         # overwrite autorendering by setting this GET flag
         c.renderer = rendered or not request.GET.get('no-render', False)
 
         # prev link
         try:
             prev_commit = c.commit.prev(c.branch)
             c.prev_commit = prev_commit
             c.url_prev = url('files_home', repo_name=c.repo_name,
                              revision=prev_commit.raw_id, f_path=f_path)
             if c.branch:
                 c.url_prev += '?branch=%s' % c.branch
         except (CommitDoesNotExistError, VCSError):
             c.url_prev = '#'
             c.prev_commit = EmptyCommit()
 
         # next link
         try:
             next_commit = c.commit.next(c.branch)
             c.next_commit = next_commit
             c.url_next = url('files_home', repo_name=c.repo_name,
                              revision=next_commit.raw_id, f_path=f_path)
             if c.branch:
                 c.url_next += '?branch=%s' % c.branch
         except (CommitDoesNotExistError, VCSError):
             c.url_next = '#'
             c.next_commit = EmptyCommit()
 
         # files or dirs
         try:
             c.file = c.commit.get_node(f_path)
             c.file_author = True
             c.file_tree = ''
             if c.file.is_file():
                 c.lf_node = c.file.get_largefile_node()
 
                 c.file_source_page = 'true'
                 c.file_last_commit = c.file.last_commit
                 if c.file.size < self.cut_off_limit_file:
                     if c.annotate:  # annotation has precedence over renderer
                         c.annotated_lines = filenode_as_annotated_lines_tokens(
                             c.file
                         )
                     else:
                         c.renderer = (
                             c.renderer and h.renderer_from_filename(c.file.path)
                         )
                         if not c.renderer:
                             c.lines = filenode_as_lines_tokens(c.file)
 
                 c.on_branch_head = self._is_valid_head(
                     commit_id, c.rhodecode_repo)
 
                 branch = c.commit.branch if (
                     c.commit.branch and '/' not in c.commit.branch) else None
                 c.branch_or_raw_id = branch or c.commit.raw_id
                 c.branch_name = c.commit.branch or h.short_id(c.commit.raw_id)
 
                 author = c.file_last_commit.author
                 c.authors = [(h.email(author),
                               h.person(author, 'username_or_name_or_email'))]
             else:
                 c.file_source_page = 'false'
                 c.authors = []
                 c.file_tree = self._get_tree_at_commit(
                     repo_name, c.commit.raw_id, f_path)
 
         except RepositoryError as e:
             h.flash(safe_str(e), category='error')
             raise HTTPNotFound()
 
         if request.environ.get('HTTP_X_PJAX'):
             return render('files/files_pjax.mako')
 
         return render('files/files.mako')
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator(
         'repository.read', 'repository.write', 'repository.admin')
     def annotate_previous(self, repo_name, revision, f_path):
 
         commit_id = revision
         commit = self.__get_commit_or_redirect(commit_id, repo_name)
         prev_commit_id = commit.raw_id
 
         f_path = f_path
         is_file = False
         try:
             _file = commit.get_node(f_path)
             is_file = _file.is_file()
         except (NodeDoesNotExistError, CommitDoesNotExistError, VCSError):
             pass
 
         if is_file:
             history = commit.get_file_history(f_path)
             prev_commit_id = history[1].raw_id \
                 if len(history) > 1 else prev_commit_id
 
         return redirect(h.url(
             'files_annotate_home', repo_name=repo_name,
             revision=prev_commit_id, f_path=f_path))
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     @jsonify
     def history(self, repo_name, revision, f_path):
         commit = self.__get_commit_or_redirect(revision, repo_name)
         f_path = f_path
         _file = commit.get_node(f_path)
         if _file.is_file():
             file_history, _hist = self._get_node_history(commit, f_path)
 
             res = []
             for obj in file_history:
                 res.append({
                     'text': obj[1],
                     'children': [{'id': o[0], 'text': o[1]} for o in obj[0]]
                 })
 
             data = {
                 'more': False,
                 'results': res
             }
             return data
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     def authors(self, repo_name, revision, f_path):
         commit = self.__get_commit_or_redirect(revision, repo_name)
         file_node = commit.get_node(f_path)
         if file_node.is_file():
             c.file_last_commit = file_node.last_commit
             if request.GET.get('annotate') == '1':
                 # use _hist from annotation if annotation mode is on
                 commit_ids = set(x[1] for x in file_node.annotate)
                 _hist = (
                     c.rhodecode_repo.get_commit(commit_id)
                     for commit_id in commit_ids)
             else:
                 _f_history, _hist = self._get_node_history(commit, f_path)
             c.file_author = False
             c.authors = []
             for author in set(commit.author for commit in _hist):
                 c.authors.append((
                     h.email(author),
                     h.person(author, 'username_or_name_or_email')))
             return render('files/file_authors_box.mako')
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     def rawfile(self, repo_name, revision, f_path):
         """
         Action for download as raw
         """
         commit = self.__get_commit_or_redirect(revision, repo_name)
         file_node = self.__get_filenode_or_redirect(repo_name, commit, f_path)
 
         if request.GET.get('lf'):
             # only if lf get flag is passed, we download this file
             # as LFS/Largefile
             lf_node = file_node.get_largefile_node()
             if lf_node:
                 # overwrite our pointer with the REAL large-file
                 file_node = lf_node
 
         response.content_disposition = 'attachment; filename=%s' % \
             safe_str(f_path.split(Repository.NAME_SEP)[-1])
 
         response.content_type = file_node.mimetype
         charset = self._get_default_encoding()
         if charset:
             response.charset = charset
 
         return file_node.content
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     def raw(self, repo_name, revision, f_path):
         """
         Action for show as raw, some mimetypes are "rendered",
         those include images, icons.
         """
         commit = self.__get_commit_or_redirect(revision, repo_name)
         file_node = self.__get_filenode_or_redirect(repo_name, commit, f_path)
 
         raw_mimetype_mapping = {
             # map original mimetype to a mimetype used for "show as raw"
             # you can also provide a content-disposition to override the
             # default "attachment" disposition.
             # orig_type: (new_type, new_dispo)
 
             # show images inline:
             # Do not re-add SVG: it is unsafe and permits XSS attacks. One can
             # for example render an SVG with javascript inside or even render
             # HTML.
             'image/x-icon': ('image/x-icon', 'inline'),
             'image/png': ('image/png', 'inline'),
             'image/gif': ('image/gif', 'inline'),
             'image/jpeg': ('image/jpeg', 'inline'),
             'application/pdf': ('application/pdf', 'inline'),
         }
 
         mimetype = file_node.mimetype
         try:
             mimetype, dispo = raw_mimetype_mapping[mimetype]
         except KeyError:
             # we don't know anything special about this, handle it safely
             if file_node.is_binary:
                 # do same as download raw for binary files
                 mimetype, dispo = 'application/octet-stream', 'attachment'
             else:
                 # do not just use the original mimetype, but force text/plain,
                 # otherwise it would serve text/html and that might be unsafe.
                 # Note: underlying vcs library fakes text/plain mimetype if the
                 # mimetype can not be determined and it thinks it is not
                 # binary.This might lead to erroneous text display in some
                 # cases, but helps in other cases, like with text files
                 # without extension.
                 mimetype, dispo = 'text/plain', 'inline'
 
         if dispo == 'attachment':
             dispo = 'attachment; filename=%s' % safe_str(
                 f_path.split(os.sep)[-1])
 
         response.content_disposition = dispo
         response.content_type = mimetype
         charset = self._get_default_encoding()
         if charset:
             response.charset = charset
         return file_node.content
 
     @CSRFRequired()
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.write', 'repository.admin')
     def delete(self, repo_name, revision, f_path):
         commit_id = revision
 
         repo = c.rhodecode_db_repo
         if repo.enable_locking and repo.locked[0]:
             h.flash(_('This repository has been locked by %s on %s')
                     % (h.person_by_id(repo.locked[0]),
                     h.format_date(h.time_to_datetime(repo.locked[1]))),
                     'warning')
             return redirect(h.url('files_home',
                                   repo_name=repo_name, revision='tip'))
 
         if not self._is_valid_head(commit_id, repo.scm_instance()):
             h.flash(_('You can only delete files with revision '
                       'being a valid branch '), category='warning')
             return redirect(h.url('files_home',
                                   repo_name=repo_name, revision='tip',
                                   f_path=f_path))
 
         c.commit = self.__get_commit_or_redirect(commit_id, repo_name)
         c.file = self.__get_filenode_or_redirect(repo_name, c.commit, f_path)
 
         c.default_message = _(
             'Deleted file %s via RhodeCode Enterprise') % (f_path)
         c.f_path = f_path
         node_path = f_path
         author = c.rhodecode_user.full_contact
         message = request.POST.get('message') or c.default_message
         try:
             nodes = {
                 node_path: {
                     'content': ''
                 }
             }
             self.scm_model.delete_nodes(
                 user=c.rhodecode_user.user_id, repo=c.rhodecode_db_repo,
                 message=message,
                 nodes=nodes,
                 parent_commit=c.commit,
                 author=author,
             )
 
             h.flash(_('Successfully deleted file %s') % f_path,
                     category='success')
         except Exception:
             msg = _('Error occurred during commit')
             log.exception(msg)
             h.flash(msg, category='error')
         return redirect(url('changeset_home',
                             repo_name=c.repo_name, revision='tip'))
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.write', 'repository.admin')
     def delete_home(self, repo_name, revision, f_path):
         commit_id = revision
 
         repo = c.rhodecode_db_repo
         if repo.enable_locking and repo.locked[0]:
             h.flash(_('This repository has been locked by %s on %s')
                     % (h.person_by_id(repo.locked[0]),
                     h.format_date(h.time_to_datetime(repo.locked[1]))),
                     'warning')
             return redirect(h.url('files_home',
                                   repo_name=repo_name, revision='tip'))
 
         if not self._is_valid_head(commit_id, repo.scm_instance()):
             h.flash(_('You can only delete files with revision '
                       'being a valid branch '), category='warning')
             return redirect(h.url('files_home',
                                   repo_name=repo_name, revision='tip',
                                   f_path=f_path))
 
         c.commit = self.__get_commit_or_redirect(commit_id, repo_name)
         c.file = self.__get_filenode_or_redirect(repo_name, c.commit, f_path)
 
         c.default_message = _(
             'Deleted file %s via RhodeCode Enterprise') % (f_path)
         c.f_path = f_path
 
         return render('files/files_delete.mako')
 
     @CSRFRequired()
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.write', 'repository.admin')
     def edit(self, repo_name, revision, f_path):
         commit_id = revision
 
         repo = c.rhodecode_db_repo
         if repo.enable_locking and repo.locked[0]:
             h.flash(_('This repository has been locked by %s on %s')
                     % (h.person_by_id(repo.locked[0]),
                     h.format_date(h.time_to_datetime(repo.locked[1]))),
                     'warning')
             return redirect(h.url('files_home',
                                   repo_name=repo_name, revision='tip'))
 
         if not self._is_valid_head(commit_id, repo.scm_instance()):
             h.flash(_('You can only edit files with revision '
                       'being a valid branch '), category='warning')
             return redirect(h.url('files_home',
                                   repo_name=repo_name, revision='tip',
                                   f_path=f_path))
 
         c.commit = self.__get_commit_or_redirect(commit_id, repo_name)
         c.file = self.__get_filenode_or_redirect(repo_name, c.commit, f_path)
 
         if c.file.is_binary:
             return redirect(url('files_home', repo_name=c.repo_name,
                             revision=c.commit.raw_id, f_path=f_path))
         c.default_message = _(
             'Edited file %s via RhodeCode Enterprise') % (f_path)
         c.f_path = f_path
         old_content = c.file.content
         sl = old_content.splitlines(1)
         first_line = sl[0] if sl else ''
 
         # modes:  0 - Unix, 1 - Mac, 2 - DOS
         mode = detect_mode(first_line, 0)
         content = convert_line_endings(request.POST.get('content', ''), mode)
 
         message = request.POST.get('message') or c.default_message
         org_f_path = c.file.unicode_path
         filename = request.POST['filename']
         org_filename = c.file.name
 
         if content == old_content and filename == org_filename:
             h.flash(_('No changes'), category='warning')
             return redirect(url('changeset_home', repo_name=c.repo_name,
                                 revision='tip'))
         try:
             mapping = {
                 org_f_path: {
                     'org_filename': org_f_path,
                     'filename': os.path.join(c.file.dir_path, filename),
                     'content': content,
                     'lexer': '',
                     'op': 'mod',
                 }
             }
 
             ScmModel().update_nodes(
                 user=c.rhodecode_user.user_id,
                 repo=c.rhodecode_db_repo,
                 message=message,
                 nodes=mapping,
                 parent_commit=c.commit,
             )
 
             h.flash(_('Successfully committed to %s') % f_path,
                     category='success')
         except Exception:
             msg = _('Error occurred during commit')
             log.exception(msg)
             h.flash(msg, category='error')
         return redirect(url('changeset_home',
                             repo_name=c.repo_name, revision='tip'))
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.write', 'repository.admin')
     def edit_home(self, repo_name, revision, f_path):
         commit_id = revision
 
         repo = c.rhodecode_db_repo
         if repo.enable_locking and repo.locked[0]:
             h.flash(_('This repository has been locked by %s on %s')
                     % (h.person_by_id(repo.locked[0]),
                     h.format_date(h.time_to_datetime(repo.locked[1]))),
                     'warning')
             return redirect(h.url('files_home',
                                   repo_name=repo_name, revision='tip'))
 
         if not self._is_valid_head(commit_id, repo.scm_instance()):
             h.flash(_('You can only edit files with revision '
                       'being a valid branch '), category='warning')
             return redirect(h.url('files_home',
                                   repo_name=repo_name, revision='tip',
                                   f_path=f_path))
 
         c.commit = self.__get_commit_or_redirect(commit_id, repo_name)
         c.file = self.__get_filenode_or_redirect(repo_name, c.commit, f_path)
 
         if c.file.is_binary:
             return redirect(url('files_home', repo_name=c.repo_name,
                             revision=c.commit.raw_id, f_path=f_path))
         c.default_message = _(
             'Edited file %s via RhodeCode Enterprise') % (f_path)
         c.f_path = f_path
 
         return render('files/files_edit.mako')
 
     def _is_valid_head(self, commit_id, repo):
         # check if commit is a branch identifier- basically we cannot
         # create multiple heads via file editing
         valid_heads = repo.branches.keys() + repo.branches.values()
 
         if h.is_svn(repo) and not repo.is_empty():
             # Note: Subversion only has one head, we add it here in case there
             # is no branch matched.
             valid_heads.append(repo.get_commit(commit_idx=-1).raw_id)
 
         # check if commit is a branch name or branch hash
         return commit_id in valid_heads
 
     @CSRFRequired()
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.write', 'repository.admin')
     def add(self, repo_name, revision, f_path):
         repo = Repository.get_by_repo_name(repo_name)
         if repo.enable_locking and repo.locked[0]:
             h.flash(_('This repository has been locked by %s on %s')
                     % (h.person_by_id(repo.locked[0]),
                     h.format_date(h.time_to_datetime(repo.locked[1]))),
                     'warning')
             return redirect(h.url('files_home',
                                   repo_name=repo_name, revision='tip'))
 
         r_post = request.POST
 
         c.commit = self.__get_commit_or_redirect(
             revision, repo_name, redirect_after=False)
         if c.commit is None:
             c.commit = EmptyCommit(alias=c.rhodecode_repo.alias)
         c.default_message = (_('Added file via RhodeCode Enterprise'))
         c.f_path = f_path
         unix_mode = 0
         content = convert_line_endings(r_post.get('content', ''), unix_mode)
 
         message = r_post.get('message') or c.default_message
         filename = r_post.get('filename')
         location = r_post.get('location', '')  # dir location
         file_obj = r_post.get('upload_file', None)
 
         if file_obj is not None and hasattr(file_obj, 'filename'):
             filename = r_post.get('filename_upload')
             content = file_obj.file
 
             if hasattr(content, 'file'):
                 # non posix systems store real file under file attr
                 content = content.file
 
         # If there's no commit, redirect to repo summary
         if type(c.commit) is EmptyCommit:
             redirect_url = h.route_path('repo_summary', repo_name=c.repo_name)
         else:
             redirect_url = url("changeset_home", repo_name=c.repo_name,
                                revision='tip')
 
         if not filename:
             h.flash(_('No filename'), category='warning')
             return redirect(redirect_url)
 
         # extract the location from filename,
         # allows using foo/bar.txt syntax to create subdirectories
         subdir_loc = filename.rsplit('/', 1)
         if len(subdir_loc) == 2:
             location = os.path.join(location, subdir_loc[0])
 
         # strip all crap out of file, just leave the basename
         filename = os.path.basename(filename)
         node_path = os.path.join(location, filename)
         author = c.rhodecode_user.full_contact
 
         try:
             nodes = {
                 node_path: {
                     'content': content
                 }
             }
             self.scm_model.create_nodes(
                 user=c.rhodecode_user.user_id,
                 repo=c.rhodecode_db_repo,
                 message=message,
                 nodes=nodes,
                 parent_commit=c.commit,
                 author=author,
             )
 
             h.flash(_('Successfully committed to %s') % node_path,
                     category='success')
         except NonRelativePathError as e:
             h.flash(_(
                 'The location specified must be a relative path and must not '
                 'contain .. in the path'), category='warning')
             return redirect(url('changeset_home', repo_name=c.repo_name,
                                 revision='tip'))
         except (NodeError, NodeAlreadyExistsError) as e:
             h.flash(_(e), category='error')
         except Exception:
             msg = _('Error occurred during commit')
             log.exception(msg)
             h.flash(msg, category='error')
         return redirect(url('changeset_home',
                             repo_name=c.repo_name, revision='tip'))
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.write', 'repository.admin')
     def add_home(self, repo_name, revision, f_path):
 
         repo = Repository.get_by_repo_name(repo_name)
         if repo.enable_locking and repo.locked[0]:
             h.flash(_('This repository has been locked by %s on %s')
                     % (h.person_by_id(repo.locked[0]),
                     h.format_date(h.time_to_datetime(repo.locked[1]))),
                     'warning')
             return redirect(h.url('files_home',
                                   repo_name=repo_name, revision='tip'))
 
         c.commit = self.__get_commit_or_redirect(
             revision, repo_name, redirect_after=False)
         if c.commit is None:
             c.commit = EmptyCommit(alias=c.rhodecode_repo.alias)
         c.default_message = (_('Added file via RhodeCode Enterprise'))
         c.f_path = f_path
 
         return render('files/files_add.mako')
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     def archivefile(self, repo_name, fname):
         fileformat = None
         commit_id = None
         ext = None
         subrepos = request.GET.get('subrepos') == 'true'
 
         for a_type, ext_data in settings.ARCHIVE_SPECS.items():
             archive_spec = fname.split(ext_data[1])
             if len(archive_spec) == 2 and archive_spec[1] == '':
                 fileformat = a_type or ext_data[1]
                 commit_id = archive_spec[0]
                 ext = ext_data[1]
 
         dbrepo = RepoModel().get_by_repo_name(repo_name)
         if not dbrepo.enable_downloads:
             return _('Downloads disabled')
 
         try:
             commit = c.rhodecode_repo.get_commit(commit_id)
             content_type = settings.ARCHIVE_SPECS[fileformat][0]
         except CommitDoesNotExistError:
             return _('Unknown revision %s') % commit_id
         except EmptyRepositoryError:
             return _('Empty repository')
         except KeyError:
             return _('Unknown archive type')
 
         # archive cache
         from rhodecode import CONFIG
 
         archive_name = '%s-%s%s%s' % (
             safe_str(repo_name.replace('/', '_')),
             '-sub' if subrepos else '',
             safe_str(commit.short_id), ext)
 
         use_cached_archive = False
         archive_cache_enabled = CONFIG.get(
             'archive_cache_dir') and not request.GET.get('no_cache')
 
         if archive_cache_enabled:
             # check if we it's ok to write
             if not os.path.isdir(CONFIG['archive_cache_dir']):
                 os.makedirs(CONFIG['archive_cache_dir'])
             cached_archive_path = os.path.join(
                 CONFIG['archive_cache_dir'], archive_name)
             if os.path.isfile(cached_archive_path):
                 log.debug('Found cached archive in %s', cached_archive_path)
                 fd, archive = None, cached_archive_path
                 use_cached_archive = True
             else:
                 log.debug('Archive %s is not yet cached', archive_name)
 
         if not use_cached_archive:
             # generate new archive
             fd, archive = tempfile.mkstemp()
             log.debug('Creating new temp archive in %s' % (archive,))
             try:
                 commit.archive_repo(archive, kind=fileformat, subrepos=subrepos)
             except ImproperArchiveTypeError:
                 return _('Unknown archive type')
             if archive_cache_enabled:
                 # if we generated the archive and we have cache enabled
                 # let's use this for future
                 log.debug('Storing new archive in %s' % (cached_archive_path,))
                 shutil.move(archive, cached_archive_path)
                 archive = cached_archive_path
 
         # store download action
         audit_logger.store_web(
             action='repo.archive.download',
             action_data={'user_agent': request.user_agent,
                          'archive_name': archive_name,
                          'archive_spec': fname,
                          'archive_cached': use_cached_archive},
             user=c.rhodecode_user,
             repo=dbrepo,
             commit=True
         )
 
         response.content_disposition = str(
             'attachment; filename=%s' % archive_name)
         response.content_type = str(content_type)
 
         def get_chunked_archive(archive):
             with open(archive, 'rb') as stream:
                 while True:
                     data = stream.read(16 * 1024)
                     if not data:
                         if fd:  # fd means we used temporary file
                             os.close(fd)
                         if not archive_cache_enabled:
                             log.debug('Destroying temp archive %s', archive)
                             os.remove(archive)
                         break
                     yield data
 
         return get_chunked_archive(archive)
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     def diff(self, repo_name, f_path):
 
         c.action = request.GET.get('diff')
         diff1 = request.GET.get('diff1', '')
         diff2 = request.GET.get('diff2', '')
 
         path1, diff1 = parse_path_ref(diff1, default_path=f_path)
 
         ignore_whitespace = str2bool(request.GET.get('ignorews'))
         line_context = request.GET.get('context', 3)
 
         if not any((diff1, diff2)):
             h.flash(
                 'Need query parameter "diff1" or "diff2" to generate a diff.',
                 category='error')
             raise HTTPBadRequest()
 
         if c.action not in ['download', 'raw']:
             # redirect to new view if we render diff
             return redirect(
                 url('compare_url', repo_name=repo_name,
                     source_ref_type='rev',
                     source_ref=diff1,
                     target_repo=c.repo_name,
                     target_ref_type='rev',
                     target_ref=diff2,
                     f_path=f_path))
 
         try:
             node1 = self._get_file_node(diff1, path1)
             node2 = self._get_file_node(diff2, f_path)
         except (RepositoryError, NodeError):
             log.exception("Exception while trying to get node from repository")
             return redirect(url(
                 'files_home', repo_name=c.repo_name, f_path=f_path))
 
         if all(isinstance(node.commit, EmptyCommit)
                for node in (node1, node2)):
             raise HTTPNotFound
 
         c.commit_1 = node1.commit
         c.commit_2 = node2.commit
 
         if c.action == 'download':
             _diff = diffs.get_gitdiff(node1, node2,
                                       ignore_whitespace=ignore_whitespace,
                                       context=line_context)
             diff = diffs.DiffProcessor(_diff, format='gitdiff')
 
             diff_name = '%s_vs_%s.diff' % (diff1, diff2)
             response.content_type = 'text/plain'
             response.content_disposition = (
                 'attachment; filename=%s' % (diff_name,)
             )
             charset = self._get_default_encoding()
             if charset:
                 response.charset = charset
             return diff.as_raw()
 
         elif c.action == 'raw':
             _diff = diffs.get_gitdiff(node1, node2,
                                       ignore_whitespace=ignore_whitespace,
                                       context=line_context)
             diff = diffs.DiffProcessor(_diff, format='gitdiff')
             response.content_type = 'text/plain'
             charset = self._get_default_encoding()
             if charset:
                 response.charset = charset
             return diff.as_raw()
 
         else:
             return redirect(
                 url('compare_url', repo_name=repo_name,
                     source_ref_type='rev',
                     source_ref=diff1,
                     target_repo=c.repo_name,
                     target_ref_type='rev',
                     target_ref=diff2,
                     f_path=f_path))
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     def diff_2way(self, repo_name, f_path):
         """
         Kept only to make OLD links work
         """
         diff1 = request.GET.get('diff1', '')
         diff2 = request.GET.get('diff2', '')
 
         if not any((diff1, diff2)):
             h.flash(
                 'Need query parameter "diff1" or "diff2" to generate a diff.',
                 category='error')
             raise HTTPBadRequest()
 
         return redirect(
             url('compare_url', repo_name=repo_name,
                 source_ref_type='rev',
                 source_ref=diff1,
                 target_repo=c.repo_name,
                 target_ref_type='rev',
                 target_ref=diff2,
                 f_path=f_path,
                 diffmode='sideside'))
 
     def _get_file_node(self, commit_id, f_path):
         if commit_id not in ['', None, 'None', '0' * 12, '0' * 40]:
             commit = c.rhodecode_repo.get_commit(commit_id=commit_id)
             try:
                 node = commit.get_node(f_path)
                 if node.is_dir():
                     raise NodeError('%s path is a %s not a file'
                                     % (node, type(node)))
             except NodeDoesNotExistError:
                 commit = EmptyCommit(
                     commit_id=commit_id,
                     idx=commit.idx,
                     repo=commit.repository,
                     alias=commit.repository.alias,
                     message=commit.message,
                     author=commit.author,
                     date=commit.date)
                 node = FileNode(f_path, '', commit=commit)
         else:
             commit = EmptyCommit(
                 repo=c.rhodecode_repo,
                 alias=c.rhodecode_repo.alias)
             node = FileNode(f_path, '', commit=commit)
         return node
 
     def _get_node_history(self, commit, f_path, commits=None):
         """
         get commit history for given node
 
         :param commit: commit to calculate history
         :param f_path: path for node to calculate history for
         :param commits: if passed don't calculate history and take
             commits defined in this list
         """
         # calculate history based on tip
         tip = c.rhodecode_repo.get_commit()
         if commits is None:
             pre_load = ["author", "branch"]
             try:
                 commits = tip.get_file_history(f_path, pre_load=pre_load)
             except (NodeDoesNotExistError, CommitError):
                 # this node is not present at tip!
                 commits = commit.get_file_history(f_path, pre_load=pre_load)
 
         history = []
         commits_group = ([], _("Changesets"))
         for commit in commits:
             branch = ' (%s)' % commit.branch if commit.branch else ''
             n_desc = 'r%s:%s%s' % (commit.idx, commit.short_id, branch)
             commits_group[0].append((commit.raw_id, n_desc,))
         history.append(commits_group)
 
         symbolic_reference = self._symbolic_reference
 
         if c.rhodecode_repo.alias == 'svn':
             adjusted_f_path = self._adjust_file_path_for_svn(
                 f_path, c.rhodecode_repo)
             if adjusted_f_path != f_path:
                 log.debug(
                     'Recognized svn tag or branch in file "%s", using svn '
                     'specific symbolic references', f_path)
                 f_path = adjusted_f_path
                 symbolic_reference = self._symbolic_reference_svn
 
         branches = self._create_references(
             c.rhodecode_repo.branches, symbolic_reference, f_path)
         branches_group = (branches, _("Branches"))
 
         tags = self._create_references(
             c.rhodecode_repo.tags, symbolic_reference, f_path)
         tags_group = (tags, _("Tags"))
 
         history.append(branches_group)
         history.append(tags_group)
 
         return history, commits
 
     def _adjust_file_path_for_svn(self, f_path, repo):
         """
         Computes the relative path of `f_path`.
 
         This is mainly based on prefix matching of the recognized tags and
         branches in the underlying repository.
         """
         tags_and_branches = itertools.chain(
             repo.branches.iterkeys(),
             repo.tags.iterkeys())
         tags_and_branches = sorted(tags_and_branches, key=len, reverse=True)
 
         for name in tags_and_branches:
             if f_path.startswith(name + '/'):
                 f_path = vcspath.relpath(f_path, name)
                 break
         return f_path
 
     def _create_references(
             self, branches_or_tags, symbolic_reference, f_path):
         items = []
         for name, commit_id in branches_or_tags.items():
             sym_ref = symbolic_reference(commit_id, name, f_path)
             items.append((sym_ref, name))
         return items
 
     def _symbolic_reference(self, commit_id, name, f_path):
         return commit_id
 
     def _symbolic_reference_svn(self, commit_id, name, f_path):
         new_f_path = vcspath.join(name, f_path)
         return u'%s@%s' % (new_f_path, commit_id)
 
     @LoginRequired()
     @XHRRequired()
     @HasRepoPermissionAnyDecorator(
         'repository.read', 'repository.write', 'repository.admin')
     @jsonify
     def nodelist(self, repo_name, revision, f_path):
         commit = self.__get_commit_or_redirect(revision, repo_name)
 
         metadata = self._get_nodelist_at_commit(
             repo_name, commit.raw_id, f_path)
         return {'nodes': metadata}
 
     @LoginRequired()
     @XHRRequired()
     @HasRepoPermissionAnyDecorator(
         'repository.read', 'repository.write', 'repository.admin')
     def nodetree_full(self, repo_name, commit_id, f_path):
         """
         Returns rendered html of file tree that contains commit date,
         author, revision for the specified combination of
         repo, commit_id and file path
 
         :param repo_name: name of the repository
         :param commit_id: commit_id of file tree
         :param f_path: file path of the requested directory
         """
 
         commit = self.__get_commit_or_redirect(commit_id, repo_name)
         try:
             dir_node = commit.get_node(f_path)
         except RepositoryError as e:
             return 'error {}'.format(safe_str(e))
 
         if dir_node.is_file():
             return ''
 
         c.file = dir_node
         c.commit = commit
 
         # using force=True here, make a little trick. We flush the cache and
         # compute it using the same key as without full_load, so the fully
         # loaded cached tree is now returned instead of partial
         return self._get_tree_at_commit(
             repo_name, commit.raw_id, dir_node.path, full_load=True,
             force=True)

rhodecode/controllers/pullrequests.py

@@ -1,1008 +1,1009 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2012-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 pull requests controller for rhodecode for initializing pull requests
 """
 import types
 
 import peppercorn
 import formencode
 import logging
 import collections
 
 from webob.exc import HTTPNotFound, HTTPForbidden, HTTPBadRequest
 from pylons import request, tmpl_context as c, url
 from pylons.controllers.util import redirect
 from pylons.i18n.translation import _
 from pyramid.threadlocal import get_current_registry
 from sqlalchemy.sql import func
 from sqlalchemy.sql.expression import or_
 
 from rhodecode import events
 from rhodecode.lib import auth, diffs, helpers as h, codeblocks
 from rhodecode.lib.ext_json import json
 from rhodecode.lib.base import (
     BaseRepoController, render, vcs_operation_context)
 from rhodecode.lib.auth import (
     LoginRequired, HasRepoPermissionAnyDecorator, NotAnonymous,
     HasAcceptedRepoType, XHRRequired)
 from rhodecode.lib.channelstream import channelstream_request
 from rhodecode.lib.utils import jsonify
 from rhodecode.lib.utils2 import (
     safe_int, safe_str, str2bool, safe_unicode)
 from rhodecode.lib.vcs.backends.base import (
     EmptyCommit, UpdateFailureReason, EmptyRepository)
 from rhodecode.lib.vcs.exceptions import (
     EmptyRepositoryError, CommitDoesNotExistError, RepositoryRequirementError,
     NodeDoesNotExistError)
 
 from rhodecode.model.changeset_status import ChangesetStatusModel
 from rhodecode.model.comment import CommentsModel
 from rhodecode.model.db import (PullRequest, ChangesetStatus, ChangesetComment,
     Repository, PullRequestVersion)
 from rhodecode.model.forms import PullRequestForm
 from rhodecode.model.meta import Session
 from rhodecode.model.pull_request import PullRequestModel, MergeCheck
 
 log = logging.getLogger(__name__)
 
 
 class PullrequestsController(BaseRepoController):
 
     def __before__(self):
         super(PullrequestsController, self).__before__()
         c.REVIEW_STATUS_APPROVED = ChangesetStatus.STATUS_APPROVED
         c.REVIEW_STATUS_REJECTED = ChangesetStatus.STATUS_REJECTED
 
     @LoginRequired()
     @NotAnonymous()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     @HasAcceptedRepoType('git', 'hg')
     def index(self):
         source_repo = c.rhodecode_db_repo
 
         try:
             source_repo.scm_instance().get_commit()
         except EmptyRepositoryError:
             h.flash(h.literal(_('There are no commits yet')),
                     category='warning')
             redirect(h.route_path('repo_summary', repo_name=source_repo.repo_name))
 
         commit_id = request.GET.get('commit')
         branch_ref = request.GET.get('branch')
         bookmark_ref = request.GET.get('bookmark')
 
         try:
             source_repo_data = PullRequestModel().generate_repo_data(
                 source_repo, commit_id=commit_id,
                 branch=branch_ref, bookmark=bookmark_ref)
         except CommitDoesNotExistError as e:
             log.exception(e)
             h.flash(_('Commit does not exist'), 'error')
             redirect(url('pullrequest_home', repo_name=source_repo.repo_name))
 
         default_target_repo = source_repo
 
         if source_repo.parent:
             parent_vcs_obj = source_repo.parent.scm_instance()
             if parent_vcs_obj and not parent_vcs_obj.is_empty():
                 # change default if we have a parent repo
                 default_target_repo = source_repo.parent
 
         target_repo_data = PullRequestModel().generate_repo_data(
             default_target_repo)
 
         selected_source_ref = source_repo_data['refs']['selected_ref']
 
         title_source_ref = selected_source_ref.split(':', 2)[1]
         c.default_title = PullRequestModel().generate_pullrequest_title(
             source=source_repo.repo_name,
             source_ref=title_source_ref,
             target=default_target_repo.repo_name
         )
 
         c.default_repo_data = {
             'source_repo_name': source_repo.repo_name,
             'source_refs_json': json.dumps(source_repo_data),
             'target_repo_name': default_target_repo.repo_name,
             'target_refs_json': json.dumps(target_repo_data),
         }
         c.default_source_ref = selected_source_ref
 
         return render('/pullrequests/pullrequest.mako')
 
     @LoginRequired()
     @NotAnonymous()
     @XHRRequired()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     @jsonify
     def get_repo_refs(self, repo_name, target_repo_name):
         repo = Repository.get_by_repo_name(target_repo_name)
         if not repo:
             raise HTTPNotFound
         return PullRequestModel().generate_repo_data(repo)
 
     @LoginRequired()
     @NotAnonymous()
     @XHRRequired()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     @jsonify
     def get_repo_destinations(self, repo_name):
         repo = Repository.get_by_repo_name(repo_name)
         if not repo:
             raise HTTPNotFound
         filter_query = request.GET.get('query')
 
         query = Repository.query() \
             .order_by(func.length(Repository.repo_name)) \
             .filter(or_(
             Repository.repo_name == repo.repo_name,
             Repository.fork_id == repo.repo_id))
 
         if filter_query:
             ilike_expression = u'%{}%'.format(safe_unicode(filter_query))
             query = query.filter(
                 Repository.repo_name.ilike(ilike_expression))
 
         add_parent = False
         if repo.parent:
             if filter_query in repo.parent.repo_name:
                 parent_vcs_obj = repo.parent.scm_instance()
                 if parent_vcs_obj and not parent_vcs_obj.is_empty():
                     add_parent = True
 
         limit = 20 - 1 if add_parent else 20
         all_repos = query.limit(limit).all()
         if add_parent:
             all_repos += [repo.parent]
 
         repos = []
         for obj in self.scm_model.get_repos(all_repos):
             repos.append({
                 'id': obj['name'],
                 'text': obj['name'],
                 'type': 'repo',
                 'obj': obj['dbrepo']
             })
 
         data = {
             'more': False,
             'results': [{
                 'text': _('Repositories'),
                 'children': repos
             }] if repos else []
         }
         return data
 
     @LoginRequired()
     @NotAnonymous()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     @HasAcceptedRepoType('git', 'hg')
     @auth.CSRFRequired()
     def create(self, repo_name):
         repo = Repository.get_by_repo_name(repo_name)
         if not repo:
             raise HTTPNotFound
 
         controls = peppercorn.parse(request.POST.items())
 
         try:
             _form = PullRequestForm(repo.repo_id)().to_python(controls)
         except formencode.Invalid as errors:
             if errors.error_dict.get('revisions'):
                 msg = 'Revisions: %s' % errors.error_dict['revisions']
             elif errors.error_dict.get('pullrequest_title'):
                 msg = _('Pull request requires a title with min. 3 chars')
             else:
                 msg = _('Error creating pull request: {}').format(errors)
             log.exception(msg)
             h.flash(msg, 'error')
 
             # would rather just go back to form ...
             return redirect(url('pullrequest_home', repo_name=repo_name))
 
         source_repo = _form['source_repo']
         source_ref = _form['source_ref']
         target_repo = _form['target_repo']
         target_ref = _form['target_ref']
         commit_ids = _form['revisions'][::-1]
 
         # find the ancestor for this pr
         source_db_repo = Repository.get_by_repo_name(_form['source_repo'])
         target_db_repo = Repository.get_by_repo_name(_form['target_repo'])
 
         source_scm = source_db_repo.scm_instance()
         target_scm = target_db_repo.scm_instance()
 
         source_commit = source_scm.get_commit(source_ref.split(':')[-1])
         target_commit = target_scm.get_commit(target_ref.split(':')[-1])
 
         ancestor = source_scm.get_common_ancestor(
             source_commit.raw_id, target_commit.raw_id, target_scm)
 
         target_ref_type, target_ref_name, __ = _form['target_ref'].split(':')
         target_ref = ':'.join((target_ref_type, target_ref_name, ancestor))
 
         pullrequest_title = _form['pullrequest_title']
         title_source_ref = source_ref.split(':', 2)[1]
         if not pullrequest_title:
             pullrequest_title = PullRequestModel().generate_pullrequest_title(
                 source=source_repo,
                 source_ref=title_source_ref,
                 target=target_repo
             )
 
         description = _form['pullrequest_desc']
 
         get_default_reviewers_data, validate_default_reviewers = \
             PullRequestModel().get_reviewer_functions()
 
         # recalculate reviewers logic, to make sure we can validate this
         reviewer_rules = get_default_reviewers_data(
             c.rhodecode_user.get_instance(), source_db_repo,
             source_commit, target_db_repo, target_commit)
 
         given_reviewers = _form['review_members']
         reviewers = validate_default_reviewers(given_reviewers, reviewer_rules)
 
         try:
             pull_request = PullRequestModel().create(
                 c.rhodecode_user.user_id, source_repo, source_ref, target_repo,
                 target_ref, commit_ids, reviewers, pullrequest_title,
                 description, reviewer_rules
             )
             Session().commit()
             h.flash(_('Successfully opened new pull request'),
                     category='success')
         except Exception as e:
             msg = _('Error occurred during creation of this pull request.')
             log.exception(msg)
             h.flash(msg, category='error')
             return redirect(url('pullrequest_home', repo_name=repo_name))
 
         return redirect(url('pullrequest_show', repo_name=target_repo,
                             pull_request_id=pull_request.pull_request_id))
 
     @LoginRequired()
     @NotAnonymous()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     @auth.CSRFRequired()
     @jsonify
     def update(self, repo_name, pull_request_id):
         pull_request_id = safe_int(pull_request_id)
         pull_request = PullRequest.get_or_404(pull_request_id)
         # only owner or admin can update it
         allowed_to_update = PullRequestModel().check_user_update(
             pull_request, c.rhodecode_user)
         if allowed_to_update:
             controls = peppercorn.parse(request.POST.items())
 
             if 'review_members' in controls:
                 self._update_reviewers(
                     pull_request_id, controls['review_members'],
                     pull_request.reviewer_data)
             elif str2bool(request.POST.get('update_commits', 'false')):
                 self._update_commits(pull_request)
             elif str2bool(request.POST.get('edit_pull_request', 'false')):
                 self._edit_pull_request(pull_request)
             else:
                 raise HTTPBadRequest()
             return True
         raise HTTPForbidden()
 
     def _edit_pull_request(self, pull_request):
         try:
             PullRequestModel().edit(
                 pull_request, request.POST.get('title'),
-                request.POST.get('description'))
+                request.POST.get('description'), c.rhodecode_user)
         except ValueError:
             msg = _(u'Cannot update closed pull requests.')
             h.flash(msg, category='error')
             return
         else:
             Session().commit()
 
         msg = _(u'Pull request title & description updated.')
         h.flash(msg, category='success')
         return
 
     def _update_commits(self, pull_request):
         resp = PullRequestModel().update_commits(pull_request)
 
         if resp.executed:
 
             if resp.target_changed and resp.source_changed:
                 changed = 'target and source repositories'
             elif resp.target_changed and not resp.source_changed:
                 changed = 'target repository'
             elif not resp.target_changed and resp.source_changed:
                 changed = 'source repository'
             else:
                 changed = 'nothing'
 
             msg = _(
                 u'Pull request updated to "{source_commit_id}" with '
                 u'{count_added} added, {count_removed} removed commits. '
                 u'Source of changes: {change_source}')
             msg = msg.format(
                 source_commit_id=pull_request.source_ref_parts.commit_id,
                 count_added=len(resp.changes.added),
                 count_removed=len(resp.changes.removed),
                 change_source=changed)
             h.flash(msg, category='success')
 
             registry = get_current_registry()
             rhodecode_plugins = getattr(registry, 'rhodecode_plugins', {})
             channelstream_config = rhodecode_plugins.get('channelstream', {})
             if channelstream_config.get('enabled'):
                 message = msg + (
                     ' - <a onclick="window.location.reload()">'
                     '<strong>{}</strong></a>'.format(_('Reload page')))
                 channel = '/repo${}$/pr/{}'.format(
                     pull_request.target_repo.repo_name,
                     pull_request.pull_request_id
                 )
                 payload = {
                     'type': 'message',
                     'user': 'system',
                     'exclude_users': [request.user.username],
                     'channel': channel,
                     'message': {
                         'message': message,
                         'level': 'success',
                         'topic': '/notifications'
                     }
                 }
                 channelstream_request(
                     channelstream_config, [payload], '/message',
                     raise_exc=False)
         else:
             msg = PullRequestModel.UPDATE_STATUS_MESSAGES[resp.reason]
             warning_reasons = [
                 UpdateFailureReason.NO_CHANGE,
                 UpdateFailureReason.WRONG_REF_TYPE,
             ]
             category = 'warning' if resp.reason in warning_reasons else 'error'
             h.flash(msg, category=category)
 
     @auth.CSRFRequired()
     @LoginRequired()
     @NotAnonymous()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     def merge(self, repo_name, pull_request_id):
         """
         POST /{repo_name}/pull-request/{pull_request_id}
 
         Merge will perform a server-side merge of the specified
         pull request, if the pull request is approved and mergeable.
         After successful merging, the pull request is automatically
         closed, with a relevant comment.
         """
         pull_request_id = safe_int(pull_request_id)
         pull_request = PullRequest.get_or_404(pull_request_id)
         user = c.rhodecode_user
 
         check = MergeCheck.validate(pull_request, user)
         merge_possible = not check.failed
 
         for err_type, error_msg in check.errors:
             h.flash(error_msg, category=err_type)
 
         if merge_possible:
             log.debug("Pre-conditions checked, trying to merge.")
             extras = vcs_operation_context(
                 request.environ, repo_name=pull_request.target_repo.repo_name,
                 username=user.username, action='push',
                 scm=pull_request.target_repo.repo_type)
             self._merge_pull_request(pull_request, user, extras)
 
         return redirect(url(
             'pullrequest_show',
             repo_name=pull_request.target_repo.repo_name,
             pull_request_id=pull_request.pull_request_id))
 
     def _merge_pull_request(self, pull_request, user, extras):
         merge_resp = PullRequestModel().merge(
             pull_request, user, extras=extras)
 
         if merge_resp.executed:
             log.debug("The merge was successful, closing the pull request.")
             PullRequestModel().close_pull_request(
                 pull_request.pull_request_id, user)
             Session().commit()
             msg = _('Pull request was successfully merged and closed.')
             h.flash(msg, category='success')
         else:
             log.debug(
                 "The merge was not successful. Merge response: %s",
                 merge_resp)
             msg = PullRequestModel().merge_status_message(
                 merge_resp.failure_reason)
             h.flash(msg, category='error')
 
     def _update_reviewers(self, pull_request_id, review_members, reviewer_rules):
 
         get_default_reviewers_data, validate_default_reviewers = \
             PullRequestModel().get_reviewer_functions()
 
         try:
             reviewers = validate_default_reviewers(review_members, reviewer_rules)
         except ValueError as e:
             log.error('Reviewers Validation: {}'.format(e))
             h.flash(e, category='error')
             return
 
-        PullRequestModel().update_reviewers(pull_request_id, reviewers)
+        PullRequestModel().update_reviewers(
+            pull_request_id, reviewers, c.rhodecode_user)
         h.flash(_('Pull request reviewers updated.'), category='success')
         Session().commit()
 
     @LoginRequired()
     @NotAnonymous()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     @auth.CSRFRequired()
     @jsonify
     def delete(self, repo_name, pull_request_id):
         pull_request_id = safe_int(pull_request_id)
         pull_request = PullRequest.get_or_404(pull_request_id)
 
         pr_closed = pull_request.is_closed()
         allowed_to_delete = PullRequestModel().check_user_delete(
             pull_request, c.rhodecode_user) and not pr_closed
 
         # only owner can delete it !
         if allowed_to_delete:
-            PullRequestModel().delete(pull_request)
+            PullRequestModel().delete(pull_request, c.rhodecode_user)
             Session().commit()
             h.flash(_('Successfully deleted pull request'),
                     category='success')
             return redirect(url('my_account_pullrequests'))
 
         h.flash(_('Your are not allowed to delete this pull request'),
                 category='error')
         raise HTTPForbidden()
 
     def _get_pr_version(self, pull_request_id, version=None):
         pull_request_id = safe_int(pull_request_id)
         at_version = None
 
         if version and version == 'latest':
             pull_request_ver = PullRequest.get(pull_request_id)
             pull_request_obj = pull_request_ver
             _org_pull_request_obj = pull_request_obj
             at_version = 'latest'
         elif version:
             pull_request_ver = PullRequestVersion.get_or_404(version)
             pull_request_obj = pull_request_ver
             _org_pull_request_obj = pull_request_ver.pull_request
             at_version = pull_request_ver.pull_request_version_id
         else:
             _org_pull_request_obj = pull_request_obj = PullRequest.get_or_404(
                 pull_request_id)
 
         pull_request_display_obj = PullRequest.get_pr_display_object(
             pull_request_obj, _org_pull_request_obj)
 
         return _org_pull_request_obj, pull_request_obj, \
                pull_request_display_obj, at_version
 
     def _get_diffset(
             self, source_repo, source_ref_id, target_ref_id, target_commit,
             source_commit, diff_limit, file_limit, display_inline_comments):
         vcs_diff = PullRequestModel().get_diff(
             source_repo, source_ref_id, target_ref_id)
 
         diff_processor = diffs.DiffProcessor(
             vcs_diff, format='newdiff', diff_limit=diff_limit,
             file_limit=file_limit, show_full_diff=c.fulldiff)
 
         _parsed = diff_processor.prepare()
 
         def _node_getter(commit):
             def get_node(fname):
                 try:
                     return commit.get_node(fname)
                 except NodeDoesNotExistError:
                     return None
 
             return get_node
 
         diffset = codeblocks.DiffSet(
             repo_name=c.repo_name,
             source_repo_name=c.source_repo.repo_name,
             source_node_getter=_node_getter(target_commit),
             target_node_getter=_node_getter(source_commit),
             comments=display_inline_comments
         )
         diffset = diffset.render_patchset(
             _parsed, target_commit.raw_id, source_commit.raw_id)
 
         return diffset
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     def show(self, repo_name, pull_request_id):
         pull_request_id = safe_int(pull_request_id)
         version = request.GET.get('version')
         from_version = request.GET.get('from_version') or version
         merge_checks = request.GET.get('merge_checks')
         c.fulldiff = str2bool(request.GET.get('fulldiff'))
 
         (pull_request_latest,
          pull_request_at_ver,
          pull_request_display_obj,
          at_version) = self._get_pr_version(
             pull_request_id, version=version)
         pr_closed = pull_request_latest.is_closed()
 
         if pr_closed and (version or from_version):
             # not allow to browse versions
             return redirect(h.url('pullrequest_show', repo_name=repo_name,
                                   pull_request_id=pull_request_id))
 
         versions = pull_request_display_obj.versions()
 
         c.at_version = at_version
         c.at_version_num = (at_version
                             if at_version and at_version != 'latest'
                             else None)
         c.at_version_pos = ChangesetComment.get_index_from_version(
             c.at_version_num, versions)
 
         (prev_pull_request_latest,
          prev_pull_request_at_ver,
          prev_pull_request_display_obj,
          prev_at_version) = self._get_pr_version(
             pull_request_id, version=from_version)
 
         c.from_version = prev_at_version
         c.from_version_num = (prev_at_version
                               if prev_at_version and prev_at_version != 'latest'
                               else None)
         c.from_version_pos = ChangesetComment.get_index_from_version(
             c.from_version_num, versions)
 
         # define if we're in COMPARE mode or VIEW at version mode
         compare = at_version != prev_at_version
 
         # pull_requests repo_name we opened it against
         # ie. target_repo must match
         if repo_name != pull_request_at_ver.target_repo.repo_name:
             raise HTTPNotFound
 
         c.shadow_clone_url = PullRequestModel().get_shadow_clone_url(
             pull_request_at_ver)
 
         c.pull_request = pull_request_display_obj
         c.pull_request_latest = pull_request_latest
 
         if compare or (at_version and not at_version == 'latest'):
             c.allowed_to_change_status = False
             c.allowed_to_update = False
             c.allowed_to_merge = False
             c.allowed_to_delete = False
             c.allowed_to_comment = False
             c.allowed_to_close = False
         else:
             can_change_status = PullRequestModel().check_user_change_status(
                 pull_request_at_ver, c.rhodecode_user)
             c.allowed_to_change_status = can_change_status and not pr_closed
 
             c.allowed_to_update = PullRequestModel().check_user_update(
                 pull_request_latest, c.rhodecode_user) and not pr_closed
             c.allowed_to_merge = PullRequestModel().check_user_merge(
                 pull_request_latest, c.rhodecode_user) and not pr_closed
             c.allowed_to_delete = PullRequestModel().check_user_delete(
                 pull_request_latest, c.rhodecode_user) and not pr_closed
             c.allowed_to_comment = not pr_closed
             c.allowed_to_close = c.allowed_to_merge and not pr_closed
 
         c.forbid_adding_reviewers = False
         c.forbid_author_to_review = False
         c.forbid_commit_author_to_review = False
 
         if pull_request_latest.reviewer_data and \
                         'rules' in pull_request_latest.reviewer_data:
             rules = pull_request_latest.reviewer_data['rules'] or {}
             try:
                 c.forbid_adding_reviewers = rules.get(
                     'forbid_adding_reviewers')
                 c.forbid_author_to_review = rules.get(
                     'forbid_author_to_review')
                 c.forbid_commit_author_to_review = rules.get(
                     'forbid_commit_author_to_review')
             except Exception:
                 pass
 
         # check merge capabilities
         _merge_check = MergeCheck.validate(
             pull_request_latest, user=c.rhodecode_user)
         c.pr_merge_errors = _merge_check.error_details
         c.pr_merge_possible = not _merge_check.failed
         c.pr_merge_message = _merge_check.merge_msg
 
         c.pull_request_review_status = _merge_check.review_status
         if merge_checks:
             return render('/pullrequests/pullrequest_merge_checks.mako')
 
         comments_model = CommentsModel()
 
         # reviewers and statuses
         c.pull_request_reviewers = pull_request_at_ver.reviewers_statuses()
         allowed_reviewers = [x[0].user_id for x in c.pull_request_reviewers]
 
         # GENERAL COMMENTS with versions #
         q = comments_model._all_general_comments_of_pull_request(pull_request_latest)
         q = q.order_by(ChangesetComment.comment_id.asc())
         general_comments = q
 
         # pick comments we want to render at current version
         c.comment_versions = comments_model.aggregate_comments(
             general_comments, versions, c.at_version_num)
         c.comments = c.comment_versions[c.at_version_num]['until']
 
         # INLINE COMMENTS with versions  #
         q = comments_model._all_inline_comments_of_pull_request(pull_request_latest)
         q = q.order_by(ChangesetComment.comment_id.asc())
         inline_comments = q
 
         c.inline_versions = comments_model.aggregate_comments(
             inline_comments, versions, c.at_version_num, inline=True)
 
         # inject latest version
         latest_ver = PullRequest.get_pr_display_object(
             pull_request_latest, pull_request_latest)
 
         c.versions = versions + [latest_ver]
 
         # if we use version, then do not show later comments
         # than current version
         display_inline_comments = collections.defaultdict(
             lambda: collections.defaultdict(list))
         for co in inline_comments:
             if c.at_version_num:
                 # pick comments that are at least UPTO given version, so we
                 # don't render comments for higher version
                 should_render = co.pull_request_version_id and \
                                 co.pull_request_version_id <= c.at_version_num
             else:
                 # showing all, for 'latest'
                 should_render = True
 
             if should_render:
                 display_inline_comments[co.f_path][co.line_no].append(co)
 
         # load diff data into template context, if we use compare mode then
         # diff is calculated based on changes between versions of PR
 
         source_repo = pull_request_at_ver.source_repo
         source_ref_id = pull_request_at_ver.source_ref_parts.commit_id
 
         target_repo = pull_request_at_ver.target_repo
         target_ref_id = pull_request_at_ver.target_ref_parts.commit_id
 
         if compare:
             # in compare switch the diff base to latest commit from prev version
             target_ref_id = prev_pull_request_display_obj.revisions[0]
 
         # despite opening commits for bookmarks/branches/tags, we always
         # convert this to rev to prevent changes after bookmark or branch change
         c.source_ref_type = 'rev'
         c.source_ref = source_ref_id
 
         c.target_ref_type = 'rev'
         c.target_ref = target_ref_id
 
         c.source_repo = source_repo
         c.target_repo = target_repo
 
         # diff_limit is the old behavior, will cut off the whole diff
         # if the limit is applied  otherwise will just hide the
         # big files from the front-end
         diff_limit = self.cut_off_limit_diff
         file_limit = self.cut_off_limit_file
 
         c.commit_ranges = []
         source_commit = EmptyCommit()
         target_commit = EmptyCommit()
         c.missing_requirements = False
 
         source_scm = source_repo.scm_instance()
         target_scm = target_repo.scm_instance()
 
         # try first shadow repo, fallback to regular repo
         try:
             commits_source_repo = pull_request_latest.get_shadow_repo()
         except Exception:
             log.debug('Failed to get shadow repo', exc_info=True)
             commits_source_repo = source_scm
 
         c.commits_source_repo = commits_source_repo
         commit_cache = {}
         try:
             pre_load = ["author", "branch", "date", "message"]
             show_revs = pull_request_at_ver.revisions
             for rev in show_revs:
                 comm = commits_source_repo.get_commit(
                     commit_id=rev, pre_load=pre_load)
                 c.commit_ranges.append(comm)
                 commit_cache[comm.raw_id] = comm
 
             # Order here matters, we first need to get target, and then
             # the source
             target_commit = commits_source_repo.get_commit(
                 commit_id=safe_str(target_ref_id))
 
             source_commit = commits_source_repo.get_commit(
                 commit_id=safe_str(source_ref_id))
 
         except CommitDoesNotExistError:
             log.warning(
                 'Failed to get commit from `{}` repo'.format(
                     commits_source_repo), exc_info=True)
         except RepositoryRequirementError:
             log.warning(
                 'Failed to get all required data from repo', exc_info=True)
             c.missing_requirements = True
 
         c.ancestor = None  # set it to None, to hide it from PR view
 
         try:
             ancestor_id = source_scm.get_common_ancestor(
                 source_commit.raw_id, target_commit.raw_id, target_scm)
             c.ancestor_commit = source_scm.get_commit(ancestor_id)
         except Exception:
             c.ancestor_commit = None
 
         c.statuses = source_repo.statuses(
             [x.raw_id for x in c.commit_ranges])
 
         # auto collapse if we have more than limit
         collapse_limit = diffs.DiffProcessor._collapse_commits_over
         c.collapse_all_commits = len(c.commit_ranges) > collapse_limit
         c.compare_mode = compare
 
         c.missing_commits = False
         if (c.missing_requirements or isinstance(source_commit, EmptyCommit)
             or source_commit == target_commit):
 
             c.missing_commits = True
         else:
 
             c.diffset = self._get_diffset(
                 commits_source_repo, source_ref_id, target_ref_id,
                 target_commit, source_commit,
                 diff_limit, file_limit, display_inline_comments)
 
             c.limited_diff = c.diffset.limited_diff
 
             # calculate removed files that are bound to comments
             comment_deleted_files = [
                 fname for fname in display_inline_comments
                 if fname not in c.diffset.file_stats]
 
             c.deleted_files_comments = collections.defaultdict(dict)
             for fname, per_line_comments in display_inline_comments.items():
                 if fname in comment_deleted_files:
                     c.deleted_files_comments[fname]['stats'] = 0
                     c.deleted_files_comments[fname]['comments'] = list()
                     for lno, comments in per_line_comments.items():
                         c.deleted_files_comments[fname]['comments'].extend(
                             comments)
 
         # this is a hack to properly display links, when creating PR, the
         # compare view and others uses different notation, and
         # compare_commits.mako renders links based on the target_repo.
         # We need to swap that here to generate it properly on the html side
         c.target_repo = c.source_repo
 
         c.commit_statuses = ChangesetStatus.STATUSES
 
         c.show_version_changes = not pr_closed
         if c.show_version_changes:
             cur_obj = pull_request_at_ver
             prev_obj = prev_pull_request_at_ver
 
             old_commit_ids = prev_obj.revisions
             new_commit_ids = cur_obj.revisions
             commit_changes = PullRequestModel()._calculate_commit_id_changes(
                 old_commit_ids, new_commit_ids)
             c.commit_changes_summary = commit_changes
 
             # calculate the diff for commits between versions
             c.commit_changes = []
             mark = lambda cs, fw: list(
                 h.itertools.izip_longest([], cs, fillvalue=fw))
             for c_type, raw_id in mark(commit_changes.added, 'a') \
                                 + mark(commit_changes.removed, 'r') \
                                 + mark(commit_changes.common, 'c'):
 
                 if raw_id in commit_cache:
                     commit = commit_cache[raw_id]
                 else:
                     try:
                         commit = commits_source_repo.get_commit(raw_id)
                     except CommitDoesNotExistError:
                         # in case we fail extracting still use "dummy" commit
                         # for display in commit diff
                         commit = h.AttributeDict(
                             {'raw_id': raw_id,
                              'message': 'EMPTY or MISSING COMMIT'})
                 c.commit_changes.append([c_type, commit])
 
             # current user review statuses for each version
             c.review_versions = {}
             if c.rhodecode_user.user_id in allowed_reviewers:
                 for co in general_comments:
                     if co.author.user_id == c.rhodecode_user.user_id:
                         # each comment has a status change
                         status = co.status_change
                         if status:
                             _ver_pr = status[0].comment.pull_request_version_id
                             c.review_versions[_ver_pr] = status[0]
 
         return render('/pullrequests/pullrequest_show.mako')
 
     @LoginRequired()
     @NotAnonymous()
     @HasRepoPermissionAnyDecorator(
         'repository.read', 'repository.write', 'repository.admin')
     @auth.CSRFRequired()
     @jsonify
     def comment(self, repo_name, pull_request_id):
         pull_request_id = safe_int(pull_request_id)
         pull_request = PullRequest.get_or_404(pull_request_id)
         if pull_request.is_closed():
             log.debug('comment: forbidden because pull request is closed')
             raise HTTPForbidden()
 
         status = request.POST.get('changeset_status', None)
         text = request.POST.get('text')
         comment_type = request.POST.get('comment_type')
         resolves_comment_id = request.POST.get('resolves_comment_id', None)
         close_pull_request = request.POST.get('close_pull_request')
 
         # the logic here should work like following, if we submit close
         # pr comment, use `close_pull_request_with_comment` function
         # else handle regular comment logic
         user = c.rhodecode_user
         repo = c.rhodecode_db_repo
 
         if close_pull_request:
             # only owner or admin or person with write permissions
             allowed_to_close = PullRequestModel().check_user_update(
                 pull_request, c.rhodecode_user)
             if not allowed_to_close:
                 log.debug('comment: forbidden because not allowed to close '
                           'pull request %s', pull_request_id)
                 raise HTTPForbidden()
             comment, status = PullRequestModel().close_pull_request_with_comment(
                 pull_request, user, repo, message=text)
             Session().flush()
             events.trigger(
                 events.PullRequestCommentEvent(pull_request, comment))
 
         else:
             # regular comment case, could be inline, or one with status.
             # for that one we check also permissions
 
             allowed_to_change_status = PullRequestModel().check_user_change_status(
                 pull_request, c.rhodecode_user)
 
             if status and allowed_to_change_status:
                 message = (_('Status change %(transition_icon)s %(status)s')
                            % {'transition_icon': '>',
                               'status': ChangesetStatus.get_status_lbl(status)})
                 text = text or message
 
             comment = CommentsModel().create(
                 text=text,
                 repo=c.rhodecode_db_repo.repo_id,
                 user=c.rhodecode_user.user_id,
                 pull_request=pull_request_id,
                 f_path=request.POST.get('f_path'),
                 line_no=request.POST.get('line'),
                 status_change=(ChangesetStatus.get_status_lbl(status)
                                if status and allowed_to_change_status else None),
                 status_change_type=(status
                                     if status and allowed_to_change_status else None),
                 comment_type=comment_type,
                 resolves_comment_id=resolves_comment_id
             )
 
             if allowed_to_change_status:
                 # calculate old status before we change it
                 old_calculated_status = pull_request.calculated_review_status()
 
                 # get status if set !
                 if status:
                     ChangesetStatusModel().set_status(
                         c.rhodecode_db_repo.repo_id,
                         status,
                         c.rhodecode_user.user_id,
                         comment,
                         pull_request=pull_request_id
                     )
 
                 Session().flush()
                 events.trigger(
                     events.PullRequestCommentEvent(pull_request, comment))
 
                 # we now calculate the status of pull request, and based on that
                 # calculation we set the commits status
                 calculated_status = pull_request.calculated_review_status()
                 if old_calculated_status != calculated_status:
                     PullRequestModel()._trigger_pull_request_hook(
                         pull_request, c.rhodecode_user, 'review_status_change')
 
         Session().commit()
 
         if not request.is_xhr:
             return redirect(h.url('pullrequest_show', repo_name=repo_name,
                                   pull_request_id=pull_request_id))
 
         data = {
             'target_id': h.safeid(h.safe_unicode(request.POST.get('f_path'))),
         }
         if comment:
             c.co = comment
             rendered_comment = render('changeset/changeset_comment_block.mako')
             data.update(comment.get_dict())
             data.update({'rendered_text': rendered_comment})
 
         return data
 
     @LoginRequired()
     @NotAnonymous()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',
                                    'repository.admin')
     @auth.CSRFRequired()
     @jsonify
     def delete_comment(self, repo_name, comment_id):
         return self._delete_comment(comment_id)
 
     def _delete_comment(self, comment_id):
         comment_id = safe_int(comment_id)
         co = ChangesetComment.get_or_404(comment_id)
         if co.pull_request.is_closed():
             # don't allow deleting comments on closed pull request
             raise HTTPForbidden()
 
         is_owner = co.author.user_id == c.rhodecode_user.user_id
         is_repo_admin = h.HasRepoPermissionAny('repository.admin')(c.repo_name)
         if h.HasPermissionAny('hg.admin')() or is_repo_admin or is_owner:
             old_calculated_status = co.pull_request.calculated_review_status()
-            CommentsModel().delete(comment=co)
+            CommentsModel().delete(comment=co, user=c.rhodecode_user)
             Session().commit()
             calculated_status = co.pull_request.calculated_review_status()
             if old_calculated_status != calculated_status:
                 PullRequestModel()._trigger_pull_request_hook(
                     co.pull_request, c.rhodecode_user, 'review_status_change')
             return True
         else:
             raise HTTPForbidden()

rhodecode/lib/audit_logger.py

@@ -1,240 +1,257 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2017-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import logging
 import datetime
 
 from rhodecode.model import meta
 from rhodecode.model.db import User, UserLog, Repository
 
 
 log = logging.getLogger(__name__)
 
 # action as key, and expected action_data as value
-ACTIONS = {
+ACTIONS_V1 = {
     'user.login.success': {'user_agent': ''},
     'user.login.failure': {'user_agent': ''},
     'user.logout': {'user_agent': ''},
     'user.password.reset_request': {},
     'user.push': {'user_agent': '', 'commit_ids': []},
     'user.pull': {'user_agent': ''},
 
     'user.create': {'data': {}},
     'user.delete': {'old_data': {}},
     'user.edit': {'old_data': {}},
     'user.edit.permissions': {},
     'user.edit.ip.add': {},
     'user.edit.ip.delete': {},
     'user.edit.token.add': {},
     'user.edit.token.delete': {},
     'user.edit.email.add': {},
     'user.edit.email.delete': {},
     'user.edit.password_reset.enabled': {},
     'user.edit.password_reset.disabled': {},
 
     'user_group.create': {'data': {}},
     'user_group.delete': {'old_data': {}},
     'user_group.edit': {'old_data': {}},
     'user_group.edit.permissions': {},
     'user_group.edit.member.add': {},
     'user_group.edit.member.delete': {},
 
     'repo.create': {'data': {}},
     'repo.fork': {'data': {}},
     'repo.edit': {'old_data': {}},
     'repo.edit.permissions': {},
     'repo.delete': {'old_data': {}},
     'repo.commit.strip': {},
     'repo.archive.download': {},
 
+    'repo.pull_request.create': '',
+    'repo.pull_request.edit': '',
+    'repo.pull_request.delete': '',
+    'repo.pull_request.close': '',
+    'repo.pull_request.merge': '',
+    'repo.pull_request.vote': '',
+    'repo.pull_request.comment.create': '',
+    'repo.pull_request.comment.delete': '',
+
+    'repo.pull_request.reviewer.add': '',
+    'repo.pull_request.reviewer.delete': '',
+
+    'repo.commit.comment.create': '',
+    'repo.commit.comment.delete': '',
+    'repo.commit.vote': '',
+
     'repo_group.create': {'data': {}},
     'repo_group.edit': {'old_data': {}},
     'repo_group.edit.permissions': {},
     'repo_group.delete': {'old_data': {}},
 }
+ACTIONS = ACTIONS_V1
 
 SOURCE_WEB = 'source_web'
 SOURCE_API = 'source_api'
 
 
 class UserWrap(object):
     """
     Fake object used to imitate AuthUser
     """
 
     def __init__(self, user_id=None, username=None, ip_addr=None):
         self.user_id = user_id
         self.username = username
         self.ip_addr = ip_addr
 
 
 class RepoWrap(object):
     """
     Fake object used to imitate RepoObject that audit logger requires
     """
 
     def __init__(self, repo_id=None, repo_name=None):
         self.repo_id = repo_id
         self.repo_name = repo_name
 
 
 def _store_log(action_name, action_data, user_id, username, user_data,
                ip_address, repository_id, repository_name):
     user_log = UserLog()
     user_log.version = UserLog.VERSION_2
 
     user_log.action = action_name
     user_log.action_data = action_data
 
     user_log.user_ip = ip_address
 
     user_log.user_id = user_id
     user_log.username = username
     user_log.user_data = user_data
 
     user_log.repository_id = repository_id
     user_log.repository_name = repository_name
 
     user_log.action_date = datetime.datetime.now()
 
     log.info('AUDIT: Logging action: `%s` by user:id:%s[%s] ip:%s',
              action_name, user_id, username, ip_address)
 
     return user_log
 
 
 def store_web(*args, **kwargs):
     if 'action_data' not in kwargs:
         kwargs['action_data'] = {}
     kwargs['action_data'].update({
         'source': SOURCE_WEB
     })
     return store(*args, **kwargs)
 
 
 def store_api(*args, **kwargs):
     if 'action_data' not in kwargs:
         kwargs['action_data'] = {}
     kwargs['action_data'].update({
         'source': SOURCE_API
     })
     return store(*args, **kwargs)
 
 
 def store(action, user, action_data=None, user_data=None, ip_addr=None,
           repo=None, sa_session=None, commit=False):
     """
     Audit logger for various actions made by users, typically this
     results in a call such::
 
         from rhodecode.lib import audit_logger
 
         audit_logger.store(
             action='repo.edit', user=self._rhodecode_user)
         audit_logger.store(
             action='repo.delete', action_data={'data': repo_data},
             user=audit_logger.UserWrap(username='itried-login', ip_addr='8.8.8.8'))
 
         # repo action
         audit_logger.store(
             action='repo.delete',
             user=audit_logger.UserWrap(username='itried-login', ip_addr='8.8.8.8'),
             repo=audit_logger.RepoWrap(repo_name='some-repo'))
 
         # repo action, when we know and have the repository object already
         audit_logger.store(
             action='repo.delete',
             action_data={'source': audit_logger.SOURCE_WEB, },
             user=self._rhodecode_user,
             repo=repo_object)
 
         # alternative wrapper to the above
         audit_logger.store_web(
             action='repo.delete',
             action_data={},
             user=self._rhodecode_user,
             repo=repo_object)
 
         # without an user ?
         audit_logger.store(
             action='user.login.failure',
             user=audit_logger.UserWrap(
                     username=self.request.params.get('username'),
                     ip_addr=self.request.remote_addr))
 
     """
     from rhodecode.lib.utils2 import safe_unicode
     from rhodecode.lib.auth import AuthUser
 
     action_spec = ACTIONS.get(action, None)
     if action_spec is None:
         raise ValueError('Action `{}` is not supported'.format(action))
 
     if not sa_session:
         sa_session = meta.Session()
 
     try:
         username = getattr(user, 'username', None)
         if not username:
             pass
 
         user_id = getattr(user, 'user_id', None)
         if not user_id:
             # maybe we have username ? Try to figure user_id from username
             if username:
                 user_id = getattr(
                     User.get_by_username(username), 'user_id', None)
 
         ip_addr = ip_addr or getattr(user, 'ip_addr', None)
         if not ip_addr:
             pass
 
         if not user_data:
             # try to get this from the auth user
             if isinstance(user, AuthUser):
                 user_data = {
                     'username': user.username,
                     'email': user.email,
                 }
 
         repository_name = getattr(repo, 'repo_name', None)
         repository_id = getattr(repo, 'repo_id', None)
         if not repository_id:
             # maybe we have repo_name ? Try to figure repo_id from repo_name
             if repository_name:
                 repository_id = getattr(
                     Repository.get_by_repo_name(repository_name), 'repo_id', None)
 
         user_log = _store_log(
             action_name=safe_unicode(action),
             action_data=action_data or {},
             user_id=user_id,
             username=username,
             user_data=user_data or {},
             ip_address=safe_unicode(ip_addr),
             repository_id=repository_id,
             repository_name=repository_name
         )
         sa_session.add(user_log)
         if commit:
             sa_session.commit()
 
     except Exception:
         log.exception('AUDIT: failed to store audit log')

rhodecode/lib/utils.py

@@ -1,1044 +1,982 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 Utilities library for RhodeCode
 """
 
 import datetime
 import decorator
 import json
 import logging
 import os
 import re
 import shutil
 import tempfile
 import traceback
 import tarfile
 import warnings
 import hashlib
 from os.path import join as jn
 
 import paste
 import pkg_resources
 from paste.script.command import Command, BadCommand
 from webhelpers.text import collapse, remove_formatting, strip_tags
 from mako import exceptions
 from pyramid.threadlocal import get_current_registry
 from pyramid.request import Request
 
 from rhodecode.lib.fakemod import create_module
 from rhodecode.lib.vcs.backends.base import Config
 from rhodecode.lib.vcs.exceptions import VCSError
 from rhodecode.lib.vcs.utils.helpers import get_scm, get_scm_backend
 from rhodecode.lib.utils2 import (
     safe_str, safe_unicode, get_current_rhodecode_user, md5)
 from rhodecode.model import meta
 from rhodecode.model.db import (
     Repository, User, RhodeCodeUi, UserLog, RepoGroup, UserGroup)
 from rhodecode.model.meta import Session
 
 
 log = logging.getLogger(__name__)
 
 REMOVED_REPO_PAT = re.compile(r'rm__\d{8}_\d{6}_\d{6}__.*')
 
 # String which contains characters that are not allowed in slug names for
 # repositories or repository groups. It is properly escaped to use it in
 # regular expressions.
 SLUG_BAD_CHARS = re.escape('`?=[]\;\'"<>,/~!@#$%^&*()+{}|:')
 
 # Regex that matches forbidden characters in repo/group slugs.
 SLUG_BAD_CHAR_RE = re.compile('[{}]'.format(SLUG_BAD_CHARS))
 
 # Regex that matches allowed characters in repo/group slugs.
 SLUG_GOOD_CHAR_RE = re.compile('[^{}]'.format(SLUG_BAD_CHARS))
 
 # Regex that matches whole repo/group slugs.
 SLUG_RE = re.compile('[^{}]+'.format(SLUG_BAD_CHARS))
 
 _license_cache = None
 
 
 def repo_name_slug(value):
     """
     Return slug of name of repository
     This function is called on each creation/modification
     of repository to prevent bad names in repo
     """
     replacement_char = '-'
 
     slug = remove_formatting(value)
     slug = SLUG_BAD_CHAR_RE.sub('', slug)
     slug = re.sub('[\s]+', '-', slug)
     slug = collapse(slug, replacement_char)
     return slug
 
 
 #==============================================================================
 # PERM DECORATOR HELPERS FOR EXTRACTING NAMES FOR PERM CHECKS
 #==============================================================================
 def get_repo_slug(request):
     if isinstance(request, Request) and getattr(request, 'db_repo', None):
         # pyramid
         _repo = request.db_repo.repo_name
     else:
         # TODO(marcink): remove after pylons migration...
         _repo = request.environ['pylons.routes_dict'].get('repo_name')
 
     if _repo:
         _repo = _repo.rstrip('/')
     return _repo
 
 
 def get_repo_group_slug(request):
     if isinstance(request, Request) and getattr(request, 'matchdict', None):
         # pyramid
         _group = request.matchdict.get('repo_group_name')
     else:
         _group = request.environ['pylons.routes_dict'].get('group_name')
 
     if _group:
         _group = _group.rstrip('/')
     return _group
 
 
 def get_user_group_slug(request):
     if isinstance(request, Request) and getattr(request, 'matchdict', None):
         # pyramid
         _group = request.matchdict.get('user_group_id')
     else:
         _group = request.environ['pylons.routes_dict'].get('user_group_id')
 
     try:
         _group = UserGroup.get(_group)
         if _group:
             _group = _group.users_group_name
     except Exception:
         log.debug(traceback.format_exc())
         # catch all failures here
         pass
 
     return _group
 
 
-def action_logger(user, action, repo, ipaddr='', sa=None, commit=False):
-    """
-    Action logger for various actions made by users
-
-    :param user: user that made this action, can be a unique username string or
-        object containing user_id attribute
-    :param action: action to log, should be on of predefined unique actions for
-        easy translations
-    :param repo: string name of repository or object containing repo_id,
-        that action was made on
-    :param ipaddr: optional ip address from what the action was made
-    :param sa: optional sqlalchemy session
-
-    """
-
-    if not sa:
-        sa = meta.Session()
-    # if we don't get explicit IP address try to get one from registered user
-    # in tmpl context var
-    if not ipaddr:
-        ipaddr = getattr(get_current_rhodecode_user(), 'ip_addr', '')
-
-    try:
-        if getattr(user, 'user_id', None):
-            user_obj = User.get(user.user_id)
-        elif isinstance(user, basestring):
-            user_obj = User.get_by_username(user)
-        else:
-            raise Exception('You have to provide a user object or a username')
-
-        if getattr(repo, 'repo_id', None):
-            repo_obj = Repository.get(repo.repo_id)
-            repo_name = repo_obj.repo_name
-        elif isinstance(repo, basestring):
-            repo_name = repo.lstrip('/')
-            repo_obj = Repository.get_by_repo_name(repo_name)
-        else:
-            repo_obj = None
-            repo_name = ''
-
-        user_log = UserLog()
-        user_log.user_id = user_obj.user_id
-        user_log.username = user_obj.username
-        action = safe_unicode(action)
-        user_log.action = action[:1200000]
-
-        user_log.repository = repo_obj
-        user_log.repository_name = repo_name
-
-        user_log.action_date = datetime.datetime.now()
-        user_log.user_ip = ipaddr
-        sa.add(user_log)
-
-        log.info('Logging action:`%s` on repo:`%s` by user:%s ip:%s',
-                 action, safe_unicode(repo), user_obj, ipaddr)
-        if commit:
-            sa.commit()
-    except Exception:
-        log.error(traceback.format_exc())
-        raise
-
-
 def get_filesystem_repos(path, recursive=False, skip_removed_repos=True):
     """
     Scans given path for repos and return (name,(type,path)) tuple
 
     :param path: path to scan for repositories
     :param recursive: recursive search and return names with subdirs in front
     """
 
     # remove ending slash for better results
     path = path.rstrip(os.sep)
     log.debug('now scanning in %s location recursive:%s...', path, recursive)
 
     def _get_repos(p):
         dirpaths = _get_dirpaths(p)
         if not _is_dir_writable(p):
             log.warning('repo path without write access: %s', p)
 
         for dirpath in dirpaths:
             if os.path.isfile(os.path.join(p, dirpath)):
                 continue
             cur_path = os.path.join(p, dirpath)
 
             # skip removed repos
             if skip_removed_repos and REMOVED_REPO_PAT.match(dirpath):
                 continue
 
             #skip .<somethin> dirs
             if dirpath.startswith('.'):
                 continue
 
             try:
                 scm_info = get_scm(cur_path)
                 yield scm_info[1].split(path, 1)[-1].lstrip(os.sep), scm_info
             except VCSError:
                 if not recursive:
                     continue
                 #check if this dir containts other repos for recursive scan
                 rec_path = os.path.join(p, dirpath)
                 if os.path.isdir(rec_path):
                     for inner_scm in _get_repos(rec_path):
                         yield inner_scm
 
     return _get_repos(path)
 
 
 def _get_dirpaths(p):
     try:
         # OS-independable way of checking if we have at least read-only
         # access or not.
         dirpaths = os.listdir(p)
     except OSError:
         log.warning('ignoring repo path without read access: %s', p)
         return []
 
     # os.listpath has a tweak: If a unicode is passed into it, then it tries to
     # decode paths and suddenly returns unicode objects itself. The items it
     # cannot decode are returned as strings and cause issues.
     #
     # Those paths are ignored here until a solid solution for path handling has
     # been built.
     expected_type = type(p)
 
     def _has_correct_type(item):
         if type(item) is not expected_type:
             log.error(
                 u"Ignoring path %s since it cannot be decoded into unicode.",
                 # Using "repr" to make sure that we see the byte value in case
                 # of support.
                 repr(item))
             return False
         return True
 
     dirpaths = [item for item in dirpaths if _has_correct_type(item)]
 
     return dirpaths
 
 
 def _is_dir_writable(path):
     """
     Probe if `path` is writable.
 
     Due to trouble on Cygwin / Windows, this is actually probing if it is
     possible to create a file inside of `path`, stat does not produce reliable
     results in this case.
     """
     try:
         with tempfile.TemporaryFile(dir=path):
             pass
     except OSError:
         return False
     return True
 
 
 def is_valid_repo(repo_name, base_path, expect_scm=None, explicit_scm=None):
     """
     Returns True if given path is a valid repository False otherwise.
     If expect_scm param is given also, compare if given scm is the same
     as expected from scm parameter. If explicit_scm is given don't try to
     detect the scm, just use the given one to check if repo is valid
 
     :param repo_name:
     :param base_path:
     :param expect_scm:
     :param explicit_scm:
 
     :return True: if given path is a valid repository
     """
     full_path = os.path.join(safe_str(base_path), safe_str(repo_name))
     log.debug('Checking if `%s` is a valid path for repository. '
               'Explicit type: %s', repo_name, explicit_scm)
 
     try:
         if explicit_scm:
             detected_scms = [get_scm_backend(explicit_scm)]
         else:
             detected_scms = get_scm(full_path)
 
         if expect_scm:
             return detected_scms[0] == expect_scm
         log.debug('path: %s is an vcs object:%s', full_path, detected_scms)
         return True
     except VCSError:
         log.debug('path: %s is not a valid repo !', full_path)
         return False
 
 
 def is_valid_repo_group(repo_group_name, base_path, skip_path_check=False):
     """
     Returns True if given path is a repository group, False otherwise
 
     :param repo_name:
     :param base_path:
     """
     full_path = os.path.join(safe_str(base_path), safe_str(repo_group_name))
     log.debug('Checking if `%s` is a valid path for repository group',
               repo_group_name)
 
     # check if it's not a repo
     if is_valid_repo(repo_group_name, base_path):
         log.debug('Repo called %s exist, it is not a valid '
                   'repo group' % repo_group_name)
         return False
 
     try:
         # we need to check bare git repos at higher level
         # since we might match branches/hooks/info/objects or possible
         # other things inside bare git repo
         scm_ = get_scm(os.path.dirname(full_path))
         log.debug('path: %s is a vcs object:%s, not valid '
                   'repo group' % (full_path, scm_))
         return False
     except VCSError:
         pass
 
     # check if it's a valid path
     if skip_path_check or os.path.isdir(full_path):
         log.debug('path: %s is a valid repo group !', full_path)
         return True
 
     log.debug('path: %s is not a valid repo group !', full_path)
     return False
 
 
 def ask_ok(prompt, retries=4, complaint='[y]es or [n]o please!'):
     while True:
         ok = raw_input(prompt)
         if ok.lower() in ('y', 'ye', 'yes'):
             return True
         if ok.lower() in ('n', 'no', 'nop', 'nope'):
             return False
         retries = retries - 1
         if retries < 0:
             raise IOError
         print(complaint)
 
 # propagated from mercurial documentation
 ui_sections = [
     'alias', 'auth',
     'decode/encode', 'defaults',
     'diff', 'email',
     'extensions', 'format',
     'merge-patterns', 'merge-tools',
     'hooks', 'http_proxy',
     'smtp', 'patch',
     'paths', 'profiling',
     'server', 'trusted',
     'ui', 'web', ]
 
 
 def config_data_from_db(clear_session=True, repo=None):
     """
     Read the configuration data from the database and return configuration
     tuples.
     """
     from rhodecode.model.settings import VcsSettingsModel
 
     config = []
 
     sa = meta.Session()
     settings_model = VcsSettingsModel(repo=repo, sa=sa)
 
     ui_settings = settings_model.get_ui_settings()
 
     for setting in ui_settings:
         if setting.active:
             log.debug(
                 'settings ui from db: [%s] %s=%s',
                 setting.section, setting.key, setting.value)
             config.append((
                 safe_str(setting.section), safe_str(setting.key),
                 safe_str(setting.value)))
         if setting.key == 'push_ssl':
             # force set push_ssl requirement to False, rhodecode
             # handles that
             config.append((
                 safe_str(setting.section), safe_str(setting.key), False))
     if clear_session:
         meta.Session.remove()
 
     # TODO: mikhail: probably it makes no sense to re-read hooks information.
     # It's already there and activated/deactivated
     skip_entries = []
     enabled_hook_classes = get_enabled_hook_classes(ui_settings)
     if 'pull' not in enabled_hook_classes:
         skip_entries.append(('hooks', RhodeCodeUi.HOOK_PRE_PULL))
     if 'push' not in enabled_hook_classes:
         skip_entries.append(('hooks', RhodeCodeUi.HOOK_PRE_PUSH))
         skip_entries.append(('hooks', RhodeCodeUi.HOOK_PRETX_PUSH))
         skip_entries.append(('hooks', RhodeCodeUi.HOOK_PUSH_KEY))
 
     config = [entry for entry in config if entry[:2] not in skip_entries]
 
     return config
 
 
 def make_db_config(clear_session=True, repo=None):
     """
     Create a :class:`Config` instance based on the values in the database.
     """
     config = Config()
     config_data = config_data_from_db(clear_session=clear_session, repo=repo)
     for section, option, value in config_data:
         config.set(section, option, value)
     return config
 
 
 def get_enabled_hook_classes(ui_settings):
     """
     Return the enabled hook classes.
 
     :param ui_settings: List of ui_settings as returned
         by :meth:`VcsSettingsModel.get_ui_settings`
 
     :return: a list with the enabled hook classes. The order is not guaranteed.
     :rtype: list
     """
     enabled_hooks = []
     active_hook_keys = [
         key for section, key, value, active in ui_settings
         if section == 'hooks' and active]
 
     hook_names = {
         RhodeCodeUi.HOOK_PUSH: 'push',
         RhodeCodeUi.HOOK_PULL: 'pull',
         RhodeCodeUi.HOOK_REPO_SIZE: 'repo_size'
     }
 
     for key in active_hook_keys:
         hook = hook_names.get(key)
         if hook:
             enabled_hooks.append(hook)
 
     return enabled_hooks
 
 
 def set_rhodecode_config(config):
     """
     Updates pylons config with new settings from database
 
     :param config:
     """
     from rhodecode.model.settings import SettingsModel
     app_settings = SettingsModel().get_all_settings()
 
     for k, v in app_settings.items():
         config[k] = v
 
 
 def get_rhodecode_realm():
     """
     Return the rhodecode realm from database.
     """
     from rhodecode.model.settings import SettingsModel
     realm = SettingsModel().get_setting_by_name('realm')
     return safe_str(realm.app_settings_value)
 
 
 def get_rhodecode_base_path():
     """
     Returns the base path. The base path is the filesystem path which points
     to the repository store.
     """
     from rhodecode.model.settings import SettingsModel
     paths_ui = SettingsModel().get_ui_by_section_and_key('paths', '/')
     return safe_str(paths_ui.ui_value)
 
 
 def map_groups(path):
     """
     Given a full path to a repository, create all nested groups that this
     repo is inside. This function creates parent-child relationships between
     groups and creates default perms for all new groups.
 
     :param paths: full path to repository
     """
     from rhodecode.model.repo_group import RepoGroupModel
     sa = meta.Session()
     groups = path.split(Repository.NAME_SEP)
     parent = None
     group = None
 
     # last element is repo in nested groups structure
     groups = groups[:-1]
     rgm = RepoGroupModel(sa)
     owner = User.get_first_super_admin()
     for lvl, group_name in enumerate(groups):
         group_name = '/'.join(groups[:lvl] + [group_name])
         group = RepoGroup.get_by_group_name(group_name)
         desc = '%s group' % group_name
 
         # skip folders that are now removed repos
         if REMOVED_REPO_PAT.match(group_name):
             break
 
         if group is None:
             log.debug('creating group level: %s group_name: %s',
                        lvl, group_name)
             group = RepoGroup(group_name, parent)
             group.group_description = desc
             group.user = owner
             sa.add(group)
             perm_obj = rgm._create_default_perms(group)
             sa.add(perm_obj)
             sa.flush()
 
         parent = group
     return group
 
 
 def repo2db_mapper(initial_repo_list, remove_obsolete=False):
     """
     maps all repos given in initial_repo_list, non existing repositories
     are created, if remove_obsolete is True it also checks for db entries
     that are not in initial_repo_list and removes them.
 
     :param initial_repo_list: list of repositories found by scanning methods
     :param remove_obsolete: check for obsolete entries in database
     """
     from rhodecode.model.repo import RepoModel
     from rhodecode.model.scm import ScmModel
     from rhodecode.model.repo_group import RepoGroupModel
     from rhodecode.model.settings import SettingsModel
 
     sa = meta.Session()
     repo_model = RepoModel()
     user = User.get_first_super_admin()
     added = []
 
     # creation defaults
     defs = SettingsModel().get_default_repo_settings(strip_prefix=True)
     enable_statistics = defs.get('repo_enable_statistics')
     enable_locking = defs.get('repo_enable_locking')
     enable_downloads = defs.get('repo_enable_downloads')
     private = defs.get('repo_private')
 
     for name, repo in initial_repo_list.items():
         group = map_groups(name)
         unicode_name = safe_unicode(name)
         db_repo = repo_model.get_by_repo_name(unicode_name)
         # found repo that is on filesystem not in RhodeCode database
         if not db_repo:
             log.info('repository %s not found, creating now', name)
             added.append(name)
             desc = (repo.description
                     if repo.description != 'unknown'
                     else '%s repository' % name)
 
             db_repo = repo_model._create_repo(
                 repo_name=name,
                 repo_type=repo.alias,
                 description=desc,
                 repo_group=getattr(group, 'group_id', None),
                 owner=user,
                 enable_locking=enable_locking,
                 enable_downloads=enable_downloads,
                 enable_statistics=enable_statistics,
                 private=private,
                 state=Repository.STATE_CREATED
             )
             sa.commit()
             # we added that repo just now, and make sure we updated server info
             if db_repo.repo_type == 'git':
                 git_repo = db_repo.scm_instance()
                 # update repository server-info
                 log.debug('Running update server info')
                 git_repo._update_server_info()
 
             db_repo.update_commit_cache()
 
         config = db_repo._config
         config.set('extensions', 'largefiles', '')
         ScmModel().install_hooks(
             db_repo.scm_instance(config=config),
             repo_type=db_repo.repo_type)
 
     removed = []
     if remove_obsolete:
         # remove from database those repositories that are not in the filesystem
         for repo in sa.query(Repository).all():
             if repo.repo_name not in initial_repo_list.keys():
                 log.debug("Removing non-existing repository found in db `%s`",
                           repo.repo_name)
                 try:
                     RepoModel(sa).delete(repo, forks='detach', fs_remove=False)
                     sa.commit()
                     removed.append(repo.repo_name)
                 except Exception:
                     # don't hold further removals on error
                     log.error(traceback.format_exc())
                     sa.rollback()
 
         def splitter(full_repo_name):
             _parts = full_repo_name.rsplit(RepoGroup.url_sep(), 1)
             gr_name = None
             if len(_parts) == 2:
                 gr_name = _parts[0]
             return gr_name
 
         initial_repo_group_list = [splitter(x) for x in
                                    initial_repo_list.keys() if splitter(x)]
 
         # remove from database those repository groups that are not in the
         # filesystem due to parent child relationships we need to delete them
         # in a specific order of most nested first
         all_groups = [x.group_name for x in sa.query(RepoGroup).all()]
         nested_sort = lambda gr: len(gr.split('/'))
         for group_name in sorted(all_groups, key=nested_sort, reverse=True):
             if group_name not in initial_repo_group_list:
                 repo_group = RepoGroup.get_by_group_name(group_name)
                 if (repo_group.children.all() or
                     not RepoGroupModel().check_exist_filesystem(
                         group_name=group_name, exc_on_failure=False)):
                     continue
 
                 log.info(
                     'Removing non-existing repository group found in db `%s`',
                     group_name)
                 try:
                     RepoGroupModel(sa).delete(group_name, fs_remove=False)
                     sa.commit()
                     removed.append(group_name)
                 except Exception:
                     # don't hold further removals on error
                     log.exception(
                         'Unable to remove repository group `%s`',
                         group_name)
                     sa.rollback()
                     raise
 
     return added, removed
 
 
 def get_default_cache_settings(settings):
     cache_settings = {}
     for key in settings.keys():
         for prefix in ['beaker.cache.', 'cache.']:
             if key.startswith(prefix):
                 name = key.split(prefix)[1].strip()
                 cache_settings[name] = settings[key].strip()
     return cache_settings
 
 
 # set cache regions for beaker so celery can utilise it
 def add_cache(settings):
     from rhodecode.lib import caches
     cache_settings = {'regions': None}
     # main cache settings used as default ...
     cache_settings.update(get_default_cache_settings(settings))
 
     if cache_settings['regions']:
         for region in cache_settings['regions'].split(','):
             region = region.strip()
             region_settings = {}
             for key, value in cache_settings.items():
                 if key.startswith(region):
                     region_settings[key.split('.')[1]] = value
 
             caches.configure_cache_region(
                 region, region_settings, cache_settings)
 
 
 def load_rcextensions(root_path):
     import rhodecode
     from rhodecode.config import conf
 
     path = os.path.join(root_path, 'rcextensions', '__init__.py')
     if os.path.isfile(path):
         rcext = create_module('rc', path)
         EXT = rhodecode.EXTENSIONS = rcext
         log.debug('Found rcextensions now loading %s...', rcext)
 
         # Additional mappings that are not present in the pygments lexers
         conf.LANGUAGES_EXTENSIONS_MAP.update(getattr(EXT, 'EXTRA_MAPPINGS', {}))
 
         # auto check if the module is not missing any data, set to default if is
         # this will help autoupdate new feature of rcext module
         #from rhodecode.config import rcextensions
         #for k in dir(rcextensions):
         #    if not k.startswith('_') and not hasattr(EXT, k):
         #        setattr(EXT, k, getattr(rcextensions, k))
 
 
 def get_custom_lexer(extension):
     """
     returns a custom lexer if it is defined in rcextensions module, or None
     if there's no custom lexer defined
     """
     import rhodecode
     from pygments import lexers
 
     # custom override made by RhodeCode
     if extension in ['mako']:
         return lexers.get_lexer_by_name('html+mako')
 
     # check if we didn't define this extension as other lexer
     extensions = rhodecode.EXTENSIONS and getattr(rhodecode.EXTENSIONS, 'EXTRA_LEXERS', None)
     if extensions and extension in rhodecode.EXTENSIONS.EXTRA_LEXERS:
         _lexer_name = rhodecode.EXTENSIONS.EXTRA_LEXERS[extension]
         return lexers.get_lexer_by_name(_lexer_name)
 
 
 #==============================================================================
 # TEST FUNCTIONS AND CREATORS
 #==============================================================================
 def create_test_index(repo_location, config):
     """
     Makes default test index.
     """
     import rc_testdata
 
     rc_testdata.extract_search_index(
         'vcs_search_index', os.path.dirname(config['search.location']))
 
 
 def create_test_directory(test_path):
     """
     Create test directory if it doesn't exist.
     """
     if not os.path.isdir(test_path):
         log.debug('Creating testdir %s', test_path)
         os.makedirs(test_path)
 
 
 def create_test_database(test_path, config):
     """
     Makes a fresh database.
     """
     from rhodecode.lib.db_manage import DbManage
 
     # PART ONE create db
     dbconf = config['sqlalchemy.db1.url']
     log.debug('making test db %s', dbconf)
 
     dbmanage = DbManage(log_sql=False, dbconf=dbconf, root=config['here'],
                         tests=True, cli_args={'force_ask': True})
     dbmanage.create_tables(override=True)
     dbmanage.set_db_version()
     # for tests dynamically set new root paths based on generated content
     dbmanage.create_settings(dbmanage.config_prompt(test_path))
     dbmanage.create_default_user()
     dbmanage.create_test_admin_and_users()
     dbmanage.create_permissions()
     dbmanage.populate_default_permissions()
     Session().commit()
 
 
 def create_test_repositories(test_path, config):
     """
     Creates test repositories in the temporary directory. Repositories are
     extracted from archives within the rc_testdata package.
     """
     import rc_testdata
     from rhodecode.tests import HG_REPO, GIT_REPO, SVN_REPO
 
     log.debug('making test vcs repositories')
 
     idx_path = config['search.location']
     data_path = config['cache_dir']
 
     # clean index and data
     if idx_path and os.path.exists(idx_path):
         log.debug('remove %s', idx_path)
         shutil.rmtree(idx_path)
 
     if data_path and os.path.exists(data_path):
         log.debug('remove %s', data_path)
         shutil.rmtree(data_path)
 
     rc_testdata.extract_hg_dump('vcs_test_hg', jn(test_path, HG_REPO))
     rc_testdata.extract_git_dump('vcs_test_git', jn(test_path, GIT_REPO))
 
     # Note: Subversion is in the process of being integrated with the system,
     # until we have a properly packed version of the test svn repository, this
     # tries to copy over the repo from a package "rc_testdata"
     svn_repo_path = rc_testdata.get_svn_repo_archive()
     with tarfile.open(svn_repo_path) as tar:
         tar.extractall(jn(test_path, SVN_REPO))
 
 
 #==============================================================================
 # PASTER COMMANDS
 #==============================================================================
 class BasePasterCommand(Command):
     """
     Abstract Base Class for paster commands.
 
     The celery commands are somewhat aggressive about loading
     celery.conf, and since our module sets the `CELERY_LOADER`
     environment variable to our loader, we have to bootstrap a bit and
     make sure we've had a chance to load the pylons config off of the
     command line, otherwise everything fails.
     """
     min_args = 1
     min_args_error = "Please provide a paster config file as an argument."
     takes_config_file = 1
     requires_config_file = True
 
     def notify_msg(self, msg, log=False):
         """Make a notification to user, additionally if logger is passed
         it logs this action using given logger
 
         :param msg: message that will be printed to user
         :param log: logging instance, to use to additionally log this message
 
         """
         if log and isinstance(log, logging):
             log(msg)
 
     def run(self, args):
         """
         Overrides Command.run
 
         Checks for a config file argument and loads it.
         """
         if len(args) < self.min_args:
             raise BadCommand(
                 self.min_args_error % {'min_args': self.min_args,
                                        'actual_args': len(args)})
 
         # Decrement because we're going to lob off the first argument.
         # @@ This is hacky
         self.min_args -= 1
         self.bootstrap_config(args[0])
         self.update_parser()
         return super(BasePasterCommand, self).run(args[1:])
 
     def update_parser(self):
         """
         Abstract method.  Allows for the class' parser to be updated
         before the superclass' `run` method is called.  Necessary to
         allow options/arguments to be passed through to the underlying
         celery command.
         """
         raise NotImplementedError("Abstract Method.")
 
     def bootstrap_config(self, conf):
         """
         Loads the pylons configuration.
         """
         from pylons import config as pylonsconfig
 
         self.path_to_ini_file = os.path.realpath(conf)
         conf = paste.deploy.appconfig('config:' + self.path_to_ini_file)
         pylonsconfig.init_app(conf.global_conf, conf.local_conf)
 
     def _init_session(self):
         """
         Inits SqlAlchemy Session
         """
         logging.config.fileConfig(self.path_to_ini_file)
         from pylons import config
         from rhodecode.config.utils import initialize_database
 
         # get to remove repos !!
         add_cache(config)
         initialize_database(config)
 
 
 @decorator.decorator
 def jsonify(func, *args, **kwargs):
     """Action decorator that formats output for JSON
 
     Given a function that will return content, this decorator will turn
     the result into JSON, with a content-type of 'application/json' and
     output it.
 
     """
     from pylons.decorators.util import get_pylons
     from rhodecode.lib.ext_json import json
     pylons = get_pylons(args)
     pylons.response.headers['Content-Type'] = 'application/json; charset=utf-8'
     data = func(*args, **kwargs)
     if isinstance(data, (list, tuple)):
         msg = "JSON responses with Array envelopes are susceptible to " \
               "cross-site data leak attacks, see " \
               "http://wiki.pylonshq.com/display/pylonsfaq/Warnings"
         warnings.warn(msg, Warning, 2)
         log.warning(msg)
     log.debug("Returning JSON wrapped action output")
     return json.dumps(data, encoding='utf-8')
 
 
 class PartialRenderer(object):
     """
     Partial renderer used to render chunks of html used in datagrids
     use like::
 
         _render = PartialRenderer('data_table/_dt_elements.mako')
         _render('quick_menu', args, kwargs)
         PartialRenderer.h,
                         c,
                         _,
                         ungettext
         are the template stuff initialized inside and can be re-used later
 
     :param tmpl_name: template path relate to /templates/ dir
     """
 
     def __init__(self, tmpl_name):
         import rhodecode
         from pylons import request, tmpl_context as c
         from pylons.i18n.translation import _, ungettext
         from rhodecode.lib import helpers as h
 
         self.tmpl_name = tmpl_name
         self.rhodecode = rhodecode
         self.c = c
         self._ = _
         self.ungettext = ungettext
         self.h = h
         self.request = request
 
     def _mako_lookup(self):
         _tmpl_lookup = self.rhodecode.CONFIG['pylons.app_globals'].mako_lookup
         return _tmpl_lookup.get_template(self.tmpl_name)
 
     def _update_kwargs_for_render(self, kwargs):
         """
         Inject params required for Mako rendering
         """
         _kwargs = {
             '_': self._,
             'h': self.h,
             'c': self.c,
             'request': self.request,
             'ungettext': self.ungettext,
         }
         _kwargs.update(kwargs)
         return _kwargs
 
     def _render_with_exc(self, render_func, args, kwargs):
         try:
             return render_func.render(*args, **kwargs)
         except:
             log.error(exceptions.text_error_template().render())
             raise
 
     def _get_template(self, template_obj, def_name):
         if def_name:
             tmpl = template_obj.get_def(def_name)
         else:
             tmpl = template_obj
         return tmpl
 
     def render(self, def_name, *args, **kwargs):
         lookup_obj = self._mako_lookup()
         tmpl = self._get_template(lookup_obj, def_name=def_name)
         kwargs = self._update_kwargs_for_render(kwargs)
         return self._render_with_exc(tmpl, args, kwargs)
 
     def __call__(self, tmpl, *args, **kwargs):
         return self.render(tmpl, *args, **kwargs)
 
 
 def password_changed(auth_user, session):
     # Never report password change in case of default user or anonymous user.
     if auth_user.username == User.DEFAULT_USER or auth_user.user_id is None:
         return False
 
     password_hash = md5(auth_user.password) if auth_user.password else None
     rhodecode_user = session.get('rhodecode_user', {})
     session_password_hash = rhodecode_user.get('password', '')
     return password_hash != session_password_hash
 
 
 def read_opensource_licenses():
     global _license_cache
 
     if not _license_cache:
         licenses = pkg_resources.resource_string(
             'rhodecode', 'config/licenses.json')
         _license_cache = json.loads(licenses)
 
     return _license_cache
 
 
 def get_registry(request):
     """
     Utility to get the pyramid registry from a request. During migration to
     pyramid we sometimes want to use the pyramid registry from pylons context.
     Therefore this utility returns `request.registry` for pyramid requests and
     uses `get_current_registry()` for pylons requests.
     """
     try:
         return request.registry
     except AttributeError:
         return get_current_registry()
 
 
 def generate_platform_uuid():
     """
     Generates platform UUID based on it's name
     """
     import platform
 
     try:
         uuid_list = [platform.platform()]
         return hashlib.sha256(':'.join(uuid_list)).hexdigest()
     except Exception as e:
         log.error('Failed to generate host uuid: %s' % e)
         return 'UNDEFINED'

rhodecode/model/comment.py

@@ -1,650 +1,666 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2011-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 comments model for RhodeCode
 """
 
 import logging
 import traceback
 import collections
 
 from datetime import datetime
 
 from pylons.i18n.translation import _
 from pyramid.threadlocal import get_current_registry, get_current_request
 from sqlalchemy.sql.expression import null
 from sqlalchemy.sql.functions import coalesce
 
 from rhodecode.lib import helpers as h, diffs
+from rhodecode.lib import audit_logger
 from rhodecode.lib.channelstream import channelstream_request
-from rhodecode.lib.utils import action_logger
 from rhodecode.lib.utils2 import extract_mentioned_users, safe_str
 from rhodecode.model import BaseModel
 from rhodecode.model.db import (
     ChangesetComment, User, Notification, PullRequest, AttributeDict)
 from rhodecode.model.notification import NotificationModel
 from rhodecode.model.meta import Session
 from rhodecode.model.settings import VcsSettingsModel
 from rhodecode.model.notification import EmailNotificationModel
 from rhodecode.model.validation_schema.schemas import comment_schema
 
 
 log = logging.getLogger(__name__)
 
 
 class CommentsModel(BaseModel):
 
     cls = ChangesetComment
 
     DIFF_CONTEXT_BEFORE = 3
     DIFF_CONTEXT_AFTER = 3
 
     def __get_commit_comment(self, changeset_comment):
         return self._get_instance(ChangesetComment, changeset_comment)
 
     def __get_pull_request(self, pull_request):
         return self._get_instance(PullRequest, pull_request)
 
     def _extract_mentions(self, s):
         user_objects = []
         for username in extract_mentioned_users(s):
             user_obj = User.get_by_username(username, case_insensitive=True)
             if user_obj:
                 user_objects.append(user_obj)
         return user_objects
 
     def _get_renderer(self, global_renderer='rst'):
         try:
             # try reading from visual context
             from pylons import tmpl_context
             global_renderer = tmpl_context.visual.default_renderer
         except AttributeError:
             log.debug("Renderer not set, falling back "
                       "to default renderer '%s'", global_renderer)
         except Exception:
             log.error(traceback.format_exc())
         return global_renderer
 
     def aggregate_comments(self, comments, versions, show_version, inline=False):
         # group by versions, and count until, and display objects
 
         comment_groups = collections.defaultdict(list)
         [comment_groups[
              _co.pull_request_version_id].append(_co) for _co in comments]
 
         def yield_comments(pos):
             for co in comment_groups[pos]:
                 yield co
 
         comment_versions = collections.defaultdict(
             lambda: collections.defaultdict(list))
         prev_prvid = -1
         # fake last entry with None, to aggregate on "latest" version which
         # doesn't have an pull_request_version_id
         for ver in versions + [AttributeDict({'pull_request_version_id': None})]:
             prvid = ver.pull_request_version_id
             if prev_prvid == -1:
                 prev_prvid = prvid
 
             for co in yield_comments(prvid):
                 comment_versions[prvid]['at'].append(co)
 
             # save until
             current = comment_versions[prvid]['at']
             prev_until = comment_versions[prev_prvid]['until']
             cur_until = prev_until + current
             comment_versions[prvid]['until'].extend(cur_until)
 
             # save outdated
             if inline:
                 outdated = [x for x in cur_until
                             if x.outdated_at_version(show_version)]
             else:
                 outdated = [x for x in cur_until
                             if x.older_than_version(show_version)]
             display = [x for x in cur_until if x not in outdated]
 
             comment_versions[prvid]['outdated'] = outdated
             comment_versions[prvid]['display'] = display
 
             prev_prvid = prvid
 
         return comment_versions
 
     def get_unresolved_todos(self, pull_request, show_outdated=True):
 
         todos = Session().query(ChangesetComment) \
             .filter(ChangesetComment.pull_request == pull_request) \
             .filter(ChangesetComment.resolved_by == None) \
             .filter(ChangesetComment.comment_type
                     == ChangesetComment.COMMENT_TYPE_TODO)
 
         if not show_outdated:
             todos = todos.filter(
                 coalesce(ChangesetComment.display_state, '') !=
                 ChangesetComment.COMMENT_OUTDATED)
 
         todos = todos.all()
 
         return todos
 
     def get_commit_unresolved_todos(self, commit_id, show_outdated=True):
 
         todos = Session().query(ChangesetComment) \
             .filter(ChangesetComment.revision == commit_id) \
             .filter(ChangesetComment.resolved_by == None) \
             .filter(ChangesetComment.comment_type
                     == ChangesetComment.COMMENT_TYPE_TODO)
 
         if not show_outdated:
             todos = todos.filter(
                 coalesce(ChangesetComment.display_state, '') !=
                 ChangesetComment.COMMENT_OUTDATED)
 
         todos = todos.all()
 
         return todos
 
+    def _log_audit_action(self, action, action_data, user, comment):
+        audit_logger.store(
+            action=action,
+            action_data=action_data,
+            user=user,
+            repo=comment.repo)
+
     def create(self, text, repo, user, commit_id=None, pull_request=None,
                f_path=None, line_no=None, status_change=None,
                status_change_type=None, comment_type=None,
                resolves_comment_id=None, closing_pr=False, send_email=True,
                renderer=None):
         """
         Creates new comment for commit or pull request.
         IF status_change is not none this comment is associated with a
         status change of commit or commit associated with pull request
 
         :param text:
         :param repo:
         :param user:
         :param commit_id:
         :param pull_request:
         :param f_path:
         :param line_no:
         :param status_change: Label for status change
         :param comment_type: Type of comment
         :param status_change_type: type of status change
         :param closing_pr:
         :param send_email:
         :param renderer: pick renderer for this comment
         """
         if not text:
             log.warning('Missing text for comment, skipping...')
             return
 
         if not renderer:
             renderer = self._get_renderer()
 
         repo = self._get_repo(repo)
         user = self._get_user(user)
 
         schema = comment_schema.CommentSchema()
         validated_kwargs = schema.deserialize(dict(
             comment_body=text,
             comment_type=comment_type,
             comment_file=f_path,
             comment_line=line_no,
             renderer_type=renderer,
             status_change=status_change_type,
             resolves_comment_id=resolves_comment_id,
             repo=repo.repo_id,
             user=user.user_id,
         ))
 
         comment = ChangesetComment()
         comment.renderer = validated_kwargs['renderer_type']
         comment.text = validated_kwargs['comment_body']
         comment.f_path = validated_kwargs['comment_file']
         comment.line_no = validated_kwargs['comment_line']
         comment.comment_type = validated_kwargs['comment_type']
 
         comment.repo = repo
         comment.author = user
         comment.resolved_comment = self.__get_commit_comment(
             validated_kwargs['resolves_comment_id'])
 
         pull_request_id = pull_request
 
         commit_obj = None
         pull_request_obj = None
 
         if commit_id:
             notification_type = EmailNotificationModel.TYPE_COMMIT_COMMENT
             # do a lookup, so we don't pass something bad here
             commit_obj = repo.scm_instance().get_commit(commit_id=commit_id)
             comment.revision = commit_obj.raw_id
 
         elif pull_request_id:
             notification_type = EmailNotificationModel.TYPE_PULL_REQUEST_COMMENT
             pull_request_obj = self.__get_pull_request(pull_request_id)
             comment.pull_request = pull_request_obj
         else:
             raise Exception('Please specify commit or pull_request_id')
 
         Session().add(comment)
         Session().flush()
         kwargs = {
             'user': user,
             'renderer_type': renderer,
             'repo_name': repo.repo_name,
             'status_change': status_change,
             'status_change_type': status_change_type,
             'comment_body': text,
             'comment_file': f_path,
             'comment_line': line_no,
             'comment_type': comment_type or 'note'
         }
 
         if commit_obj:
             recipients = ChangesetComment.get_users(
                 revision=commit_obj.raw_id)
             # add commit author if it's in RhodeCode system
             cs_author = User.get_from_cs_author(commit_obj.author)
             if not cs_author:
                 # use repo owner if we cannot extract the author correctly
                 cs_author = repo.user
             recipients += [cs_author]
 
             commit_comment_url = self.get_url(comment)
 
             target_repo_url = h.link_to(
                 repo.repo_name,
                 h.route_url('repo_summary', repo_name=repo.repo_name))
 
             # commit specifics
             kwargs.update({
                 'commit': commit_obj,
                 'commit_message': commit_obj.message,
                 'commit_target_repo': target_repo_url,
                 'commit_comment_url': commit_comment_url,
             })
 
         elif pull_request_obj:
             # get the current participants of this pull request
             recipients = ChangesetComment.get_users(
                 pull_request_id=pull_request_obj.pull_request_id)
             # add pull request author
             recipients += [pull_request_obj.author]
 
             # add the reviewers to notification
             recipients += [x.user for x in pull_request_obj.reviewers]
 
             pr_target_repo = pull_request_obj.target_repo
             pr_source_repo = pull_request_obj.source_repo
 
             pr_comment_url = h.url(
                 'pullrequest_show',
                 repo_name=pr_target_repo.repo_name,
                 pull_request_id=pull_request_obj.pull_request_id,
                 anchor='comment-%s' % comment.comment_id,
                 qualified=True,)
 
             # set some variables for email notification
             pr_target_repo_url = h.route_url(
                 'repo_summary', repo_name=pr_target_repo.repo_name)
 
             pr_source_repo_url = h.route_url(
                 'repo_summary', repo_name=pr_source_repo.repo_name)
 
             # pull request specifics
             kwargs.update({
                 'pull_request': pull_request_obj,
                 'pr_id': pull_request_obj.pull_request_id,
                 'pr_target_repo': pr_target_repo,
                 'pr_target_repo_url': pr_target_repo_url,
                 'pr_source_repo': pr_source_repo,
                 'pr_source_repo_url': pr_source_repo_url,
                 'pr_comment_url': pr_comment_url,
                 'pr_closing': closing_pr,
             })
         if send_email:
             # pre-generate the subject for notification itself
             (subject,
              _h, _e,  # we don't care about those
              body_plaintext) = EmailNotificationModel().render_email(
                 notification_type, **kwargs)
 
             mention_recipients = set(
                 self._extract_mentions(text)).difference(recipients)
 
             # create notification objects, and emails
             NotificationModel().create(
                 created_by=user,
                 notification_subject=subject,
                 notification_body=body_plaintext,
                 notification_type=notification_type,
                 recipients=recipients,
                 mention_recipients=mention_recipients,
                 email_kwargs=kwargs,
             )
 
-        action = (
-            'user_commented_pull_request:{}'.format(
-                comment.pull_request.pull_request_id)
-            if comment.pull_request
-            else 'user_commented_revision:{}'.format(comment.revision)
-        )
-        action_logger(user, action, comment.repo)
+        Session().flush()
+        if comment.pull_request:
+            action = 'repo.pull_request.comment.create'
+        else:
+            action = 'repo.commit.comment.create'
+
+        comment_data = comment.get_api_data()
+        self._log_audit_action(
+            action, {'data': comment_data}, user, comment)
 
         registry = get_current_registry()
         rhodecode_plugins = getattr(registry, 'rhodecode_plugins', {})
         channelstream_config = rhodecode_plugins.get('channelstream', {})
         msg_url = ''
         if commit_obj:
             msg_url = commit_comment_url
             repo_name = repo.repo_name
         elif pull_request_obj:
             msg_url = pr_comment_url
             repo_name = pr_target_repo.repo_name
 
         if channelstream_config.get('enabled'):
             message = '<strong>{}</strong> {} - ' \
                       '<a onclick="window.location=\'{}\';' \
                       'window.location.reload()">' \
                       '<strong>{}</strong></a>'
             message = message.format(
                 user.username, _('made a comment'), msg_url,
                 _('Show it now'))
             channel = '/repo${}$/pr/{}'.format(
                 repo_name,
                 pull_request_id
             )
             payload = {
                 'type': 'message',
                 'timestamp': datetime.utcnow(),
                 'user': 'system',
                 'exclude_users': [user.username],
                 'channel': channel,
                 'message': {
                     'message': message,
                     'level': 'info',
                     'topic': '/notifications'
                 }
             }
             channelstream_request(channelstream_config, [payload],
                                   '/message', raise_exc=False)
 
         return comment
 
-    def delete(self, comment):
+    def delete(self, comment, user):
         """
         Deletes given comment
-
-        :param comment_id:
         """
         comment = self.__get_commit_comment(comment)
+        old_data = comment.get_api_data()
         Session().delete(comment)
 
+        if comment.pull_request:
+            action = 'repo.pull_request.comment.delete'
+        else:
+            action = 'repo.commit.comment.delete'
+
+        self._log_audit_action(
+            action, {'old_data': old_data}, user, comment)
+
         return comment
 
     def get_all_comments(self, repo_id, revision=None, pull_request=None):
         q = ChangesetComment.query()\
                 .filter(ChangesetComment.repo_id == repo_id)
         if revision:
             q = q.filter(ChangesetComment.revision == revision)
         elif pull_request:
             pull_request = self.__get_pull_request(pull_request)
             q = q.filter(ChangesetComment.pull_request == pull_request)
         else:
             raise Exception('Please specify commit or pull_request')
         q = q.order_by(ChangesetComment.created_on)
         return q.all()
 
     def get_url(self, comment, request=None, permalink=False):
         if not request:
             request = get_current_request()
 
         comment = self.__get_commit_comment(comment)
         if comment.pull_request:
             pull_request = comment.pull_request
             if permalink:
                 return request.route_url(
                     'pull_requests_global',
                     pull_request_id=pull_request.pull_request_id,
                     _anchor='comment-%s' % comment.comment_id)
             else:
                 return request.route_url(
                     'pullrequest_show',
                     repo_name=safe_str(pull_request.target_repo.repo_name),
                     pull_request_id=pull_request.pull_request_id,
                     _anchor='comment-%s' % comment.comment_id)
 
         else:
             repo = comment.repo
             commit_id = comment.revision
 
             if permalink:
                 return request.route_url(
                     'repo_commit', repo_name=safe_str(repo.repo_id),
                     commit_id=commit_id,
                     _anchor='comment-%s' % comment.comment_id)
 
             else:
                 return request.route_url(
                     'repo_commit', repo_name=safe_str(repo.repo_name),
                     commit_id=commit_id,
                     _anchor='comment-%s' % comment.comment_id)
 
     def get_comments(self, repo_id, revision=None, pull_request=None):
         """
         Gets main comments based on revision or pull_request_id
 
         :param repo_id:
         :param revision:
         :param pull_request:
         """
 
         q = ChangesetComment.query()\
                 .filter(ChangesetComment.repo_id == repo_id)\
                 .filter(ChangesetComment.line_no == None)\
                 .filter(ChangesetComment.f_path == None)
         if revision:
             q = q.filter(ChangesetComment.revision == revision)
         elif pull_request:
             pull_request = self.__get_pull_request(pull_request)
             q = q.filter(ChangesetComment.pull_request == pull_request)
         else:
             raise Exception('Please specify commit or pull_request')
         q = q.order_by(ChangesetComment.created_on)
         return q.all()
 
     def get_inline_comments(self, repo_id, revision=None, pull_request=None):
         q = self._get_inline_comments_query(repo_id, revision, pull_request)
         return self._group_comments_by_path_and_line_number(q)
 
     def get_inline_comments_count(self, inline_comments, skip_outdated=True,
                                   version=None):
         inline_cnt = 0
         for fname, per_line_comments in inline_comments.iteritems():
             for lno, comments in per_line_comments.iteritems():
                 for comm in comments:
                     if not comm.outdated_at_version(version) and skip_outdated:
                         inline_cnt += 1
 
         return inline_cnt
 
     def get_outdated_comments(self, repo_id, pull_request):
         # TODO: johbo: Remove `repo_id`, it is not needed to find the comments
         # of a pull request.
         q = self._all_inline_comments_of_pull_request(pull_request)
         q = q.filter(
             ChangesetComment.display_state ==
             ChangesetComment.COMMENT_OUTDATED
         ).order_by(ChangesetComment.comment_id.asc())
 
         return self._group_comments_by_path_and_line_number(q)
 
     def _get_inline_comments_query(self, repo_id, revision, pull_request):
         # TODO: johbo: Split this into two methods: One for PR and one for
         # commit.
         if revision:
             q = Session().query(ChangesetComment).filter(
                 ChangesetComment.repo_id == repo_id,
                 ChangesetComment.line_no != null(),
                 ChangesetComment.f_path != null(),
                 ChangesetComment.revision == revision)
 
         elif pull_request:
             pull_request = self.__get_pull_request(pull_request)
             if not CommentsModel.use_outdated_comments(pull_request):
                 q = self._visible_inline_comments_of_pull_request(pull_request)
             else:
                 q = self._all_inline_comments_of_pull_request(pull_request)
 
         else:
             raise Exception('Please specify commit or pull_request_id')
         q = q.order_by(ChangesetComment.comment_id.asc())
         return q
 
     def _group_comments_by_path_and_line_number(self, q):
         comments = q.all()
         paths = collections.defaultdict(lambda: collections.defaultdict(list))
         for co in comments:
             paths[co.f_path][co.line_no].append(co)
         return paths
 
     @classmethod
     def needed_extra_diff_context(cls):
         return max(cls.DIFF_CONTEXT_BEFORE, cls.DIFF_CONTEXT_AFTER)
 
     def outdate_comments(self, pull_request, old_diff_data, new_diff_data):
         if not CommentsModel.use_outdated_comments(pull_request):
             return
 
         comments = self._visible_inline_comments_of_pull_request(pull_request)
         comments_to_outdate = comments.all()
 
         for comment in comments_to_outdate:
             self._outdate_one_comment(comment, old_diff_data, new_diff_data)
 
     def _outdate_one_comment(self, comment, old_diff_proc, new_diff_proc):
         diff_line = _parse_comment_line_number(comment.line_no)
 
         try:
             old_context = old_diff_proc.get_context_of_line(
                 path=comment.f_path, diff_line=diff_line)
             new_context = new_diff_proc.get_context_of_line(
                 path=comment.f_path, diff_line=diff_line)
         except (diffs.LineNotInDiffException,
                 diffs.FileNotInDiffException):
             comment.display_state = ChangesetComment.COMMENT_OUTDATED
             return
 
         if old_context == new_context:
             return
 
         if self._should_relocate_diff_line(diff_line):
             new_diff_lines = new_diff_proc.find_context(
                 path=comment.f_path, context=old_context,
                 offset=self.DIFF_CONTEXT_BEFORE)
             if not new_diff_lines:
                 comment.display_state = ChangesetComment.COMMENT_OUTDATED
             else:
                 new_diff_line = self._choose_closest_diff_line(
                     diff_line, new_diff_lines)
                 comment.line_no = _diff_to_comment_line_number(new_diff_line)
         else:
             comment.display_state = ChangesetComment.COMMENT_OUTDATED
 
     def _should_relocate_diff_line(self, diff_line):
         """
         Checks if relocation shall be tried for the given `diff_line`.
 
         If a comment points into the first lines, then we can have a situation
         that after an update another line has been added on top. In this case
         we would find the context still and move the comment around. This
         would be wrong.
         """
         should_relocate = (
             (diff_line.new and diff_line.new > self.DIFF_CONTEXT_BEFORE) or
             (diff_line.old and diff_line.old > self.DIFF_CONTEXT_BEFORE))
         return should_relocate
 
     def _choose_closest_diff_line(self, diff_line, new_diff_lines):
         candidate = new_diff_lines[0]
         best_delta = _diff_line_delta(diff_line, candidate)
         for new_diff_line in new_diff_lines[1:]:
             delta = _diff_line_delta(diff_line, new_diff_line)
             if delta < best_delta:
                 candidate = new_diff_line
                 best_delta = delta
         return candidate
 
     def _visible_inline_comments_of_pull_request(self, pull_request):
         comments = self._all_inline_comments_of_pull_request(pull_request)
         comments = comments.filter(
             coalesce(ChangesetComment.display_state, '') !=
             ChangesetComment.COMMENT_OUTDATED)
         return comments
 
     def _all_inline_comments_of_pull_request(self, pull_request):
         comments = Session().query(ChangesetComment)\
             .filter(ChangesetComment.line_no != None)\
             .filter(ChangesetComment.f_path != None)\
             .filter(ChangesetComment.pull_request == pull_request)
         return comments
 
     def _all_general_comments_of_pull_request(self, pull_request):
         comments = Session().query(ChangesetComment)\
             .filter(ChangesetComment.line_no == None)\
             .filter(ChangesetComment.f_path == None)\
             .filter(ChangesetComment.pull_request == pull_request)
         return comments
 
     @staticmethod
     def use_outdated_comments(pull_request):
         settings_model = VcsSettingsModel(repo=pull_request.target_repo)
         settings = settings_model.get_general_settings()
         return settings.get('rhodecode_use_outdated_comments', False)
 
 
 def _parse_comment_line_number(line_no):
     """
     Parses line numbers of the form "(o|n)\d+" and returns them in a tuple.
     """
     old_line = None
     new_line = None
     if line_no.startswith('o'):
         old_line = int(line_no[1:])
     elif line_no.startswith('n'):
         new_line = int(line_no[1:])
     else:
         raise ValueError("Comment lines have to start with either 'o' or 'n'.")
     return diffs.DiffLineNumber(old_line, new_line)
 
 
 def _diff_to_comment_line_number(diff_line):
     if diff_line.new is not None:
         return u'n{}'.format(diff_line.new)
     elif diff_line.old is not None:
         return u'o{}'.format(diff_line.old)
     return u''
 
 
 def _diff_line_delta(a, b):
     if None not in (a.new, b.new):
         return abs(a.new - b.new)
     elif None not in (a.old, b.old):
         return abs(a.old - b.old)
     else:
         raise ValueError(
             "Cannot compute delta between {} and {}".format(a, b))

rhodecode/model/db.py

@@ -1,4031 +1,4065 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 Database Models for RhodeCode Enterprise
 """
 
 import re
 import os
 import time
 import hashlib
 import logging
 import datetime
 import warnings
 import ipaddress
 import functools
 import traceback
 import collections
 
 
 from sqlalchemy import *
 from sqlalchemy.ext.declarative import declared_attr
 from sqlalchemy.ext.hybrid import hybrid_property
 from sqlalchemy.orm import (
     relationship, joinedload, class_mapper, validates, aliased)
 from sqlalchemy.sql.expression import true
 from beaker.cache import cache_region
 from zope.cachedescriptors.property import Lazy as LazyProperty
 
 from pylons.i18n.translation import lazy_ugettext as _
 from pyramid.threadlocal import get_current_request
 
 from rhodecode.lib.vcs import get_vcs_instance
 from rhodecode.lib.vcs.backends.base import EmptyCommit, Reference
 from rhodecode.lib.utils2 import (
     str2bool, safe_str, get_commit_safe, safe_unicode, md5_safe,
     time_to_datetime, aslist, Optional, safe_int, get_clone_url, AttributeDict,
     glob2re, StrictAttributeDict, cleaned_uri)
 from rhodecode.lib.jsonalchemy import MutationObj, MutationList, JsonType
 from rhodecode.lib.ext_json import json
 from rhodecode.lib.caching_query import FromCache
 from rhodecode.lib.encrypt import AESCipher
 
 from rhodecode.model.meta import Base, Session
 
 URL_SEP = '/'
 log = logging.getLogger(__name__)
 
 # =============================================================================
 # BASE CLASSES
 # =============================================================================
 
 # this is propagated from .ini file rhodecode.encrypted_values.secret or
 # beaker.session.secret if first is not set.
 # and initialized at environment.py
 ENCRYPTION_KEY = None
 
 # used to sort permissions by types, '#' used here is not allowed to be in
 # usernames, and it's very early in sorted string.printable table.
 PERMISSION_TYPE_SORT = {
     'admin': '####',
     'write': '###',
     'read':  '##',
     'none':  '#',
 }
 
 
 def display_sort(obj):
     """
     Sort function used to sort permissions in .permissions() function of
     Repository, RepoGroup, UserGroup. Also it put the default user in front
     of all other resources
     """
 
     if obj.username == User.DEFAULT_USER:
         return '#####'
     prefix = PERMISSION_TYPE_SORT.get(obj.permission.split('.')[-1], '')
     return prefix + obj.username
 
 
 def _hash_key(k):
     return md5_safe(k)
 
 
 class EncryptedTextValue(TypeDecorator):
     """
     Special column for encrypted long text data, use like::
 
         value = Column("encrypted_value", EncryptedValue(), nullable=False)
 
     This column is intelligent so if value is in unencrypted form it return
     unencrypted form, but on save it always encrypts
     """
     impl = Text
 
     def process_bind_param(self, value, dialect):
         if not value:
             return value
         if value.startswith('enc$aes$') or value.startswith('enc$aes_hmac$'):
             # protect against double encrypting if someone manually starts
             # doing
             raise ValueError('value needs to be in unencrypted format, ie. '
                              'not starting with enc$aes')
         return 'enc$aes_hmac$%s' % AESCipher(
             ENCRYPTION_KEY, hmac=True).encrypt(value)
 
     def process_result_value(self, value, dialect):
         import rhodecode
 
         if not value:
             return value
 
         parts = value.split('$', 3)
         if not len(parts) == 3:
             # probably not encrypted values
             return value
         else:
             if parts[0] != 'enc':
                 # parts ok but without our header ?
                 return value
             enc_strict_mode = str2bool(rhodecode.CONFIG.get(
                 'rhodecode.encrypted_values.strict') or True)
             # at that stage we know it's our encryption
             if parts[1] == 'aes':
                 decrypted_data = AESCipher(ENCRYPTION_KEY).decrypt(parts[2])
             elif parts[1] == 'aes_hmac':
                 decrypted_data = AESCipher(
                     ENCRYPTION_KEY, hmac=True,
                     strict_verification=enc_strict_mode).decrypt(parts[2])
             else:
                 raise ValueError(
                     'Encryption type part is wrong, must be `aes` '
                     'or `aes_hmac`, got `%s` instead' % (parts[1]))
             return decrypted_data
 
 
 class BaseModel(object):
     """
     Base Model for all classes
     """
 
     @classmethod
     def _get_keys(cls):
         """return column names for this model """
         return class_mapper(cls).c.keys()
 
     def get_dict(self):
         """
         return dict with keys and values corresponding
         to this model data """
 
         d = {}
         for k in self._get_keys():
             d[k] = getattr(self, k)
 
         # also use __json__() if present to get additional fields
         _json_attr = getattr(self, '__json__', None)
         if _json_attr:
             # update with attributes from __json__
             if callable(_json_attr):
                 _json_attr = _json_attr()
             for k, val in _json_attr.iteritems():
                 d[k] = val
         return d
 
     def get_appstruct(self):
         """return list with keys and values tuples corresponding
         to this model data """
 
         l = []
         for k in self._get_keys():
             l.append((k, getattr(self, k),))
         return l
 
     def populate_obj(self, populate_dict):
         """populate model with data from given populate_dict"""
 
         for k in self._get_keys():
             if k in populate_dict:
                 setattr(self, k, populate_dict[k])
 
     @classmethod
     def query(cls):
         return Session().query(cls)
 
     @classmethod
     def get(cls, id_):
         if id_:
             return cls.query().get(id_)
 
     @classmethod
     def get_or_404(cls, id_, pyramid_exc=False):
         if pyramid_exc:
             # NOTE(marcink): backward compat, once migration to pyramid
             # this should only use pyramid exceptions
             from pyramid.httpexceptions import HTTPNotFound
         else:
             from webob.exc import HTTPNotFound
 
         try:
             id_ = int(id_)
         except (TypeError, ValueError):
             raise HTTPNotFound
 
         res = cls.query().get(id_)
         if not res:
             raise HTTPNotFound
         return res
 
     @classmethod
     def getAll(cls):
         # deprecated and left for backward compatibility
         return cls.get_all()
 
     @classmethod
     def get_all(cls):
         return cls.query().all()
 
     @classmethod
     def delete(cls, id_):
         obj = cls.query().get(id_)
         Session().delete(obj)
 
     @classmethod
     def identity_cache(cls, session, attr_name, value):
         exist_in_session = []
         for (item_cls, pkey), instance in session.identity_map.items():
             if cls == item_cls and getattr(instance, attr_name) == value:
                 exist_in_session.append(instance)
         if exist_in_session:
             if len(exist_in_session) == 1:
                 return exist_in_session[0]
             log.exception(
                 'multiple objects with attr %s and '
                 'value %s found with same name: %r',
                 attr_name, value, exist_in_session)
 
     def __repr__(self):
         if hasattr(self, '__unicode__'):
             # python repr needs to return str
             try:
                 return safe_str(self.__unicode__())
             except UnicodeDecodeError:
                 pass
         return '<DB:%s>' % (self.__class__.__name__)
 
 
 class RhodeCodeSetting(Base, BaseModel):
     __tablename__ = 'rhodecode_settings'
     __table_args__ = (
         UniqueConstraint('app_settings_name'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
 
     SETTINGS_TYPES = {
         'str': safe_str,
         'int': safe_int,
         'unicode': safe_unicode,
         'bool': str2bool,
         'list': functools.partial(aslist, sep=',')
     }
     DEFAULT_UPDATE_URL = 'https://rhodecode.com/api/v1/info/versions'
     GLOBAL_CONF_KEY = 'app_settings'
 
     app_settings_id = Column("app_settings_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     app_settings_name = Column("app_settings_name", String(255), nullable=True, unique=None, default=None)
     _app_settings_value = Column("app_settings_value", String(4096), nullable=True, unique=None, default=None)
     _app_settings_type = Column("app_settings_type", String(255), nullable=True, unique=None, default=None)
 
     def __init__(self, key='', val='', type='unicode'):
         self.app_settings_name = key
         self.app_settings_type = type
         self.app_settings_value = val
 
     @validates('_app_settings_value')
     def validate_settings_value(self, key, val):
         assert type(val) == unicode
         return val
 
     @hybrid_property
     def app_settings_value(self):
         v = self._app_settings_value
         _type = self.app_settings_type
         if _type:
             _type = self.app_settings_type.split('.')[0]
             # decode the encrypted value
             if 'encrypted' in self.app_settings_type:
                 cipher = EncryptedTextValue()
                 v = safe_unicode(cipher.process_result_value(v, None))
 
         converter = self.SETTINGS_TYPES.get(_type) or \
             self.SETTINGS_TYPES['unicode']
         return converter(v)
 
     @app_settings_value.setter
     def app_settings_value(self, val):
         """
         Setter that will always make sure we use unicode in app_settings_value
 
         :param val:
         """
         val = safe_unicode(val)
         # encode the encrypted value
         if 'encrypted' in self.app_settings_type:
             cipher = EncryptedTextValue()
             val = safe_unicode(cipher.process_bind_param(val, None))
         self._app_settings_value = val
 
     @hybrid_property
     def app_settings_type(self):
         return self._app_settings_type
 
     @app_settings_type.setter
     def app_settings_type(self, val):
         if val.split('.')[0] not in self.SETTINGS_TYPES:
             raise Exception('type must be one of %s got %s'
                             % (self.SETTINGS_TYPES.keys(), val))
         self._app_settings_type = val
 
     def __unicode__(self):
         return u"<%s('%s:%s[%s]')>" % (
             self.__class__.__name__,
             self.app_settings_name, self.app_settings_value,
             self.app_settings_type
         )
 
 
 class RhodeCodeUi(Base, BaseModel):
     __tablename__ = 'rhodecode_ui'
     __table_args__ = (
         UniqueConstraint('ui_key'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
 
     HOOK_REPO_SIZE = 'changegroup.repo_size'
     # HG
     HOOK_PRE_PULL = 'preoutgoing.pre_pull'
     HOOK_PULL = 'outgoing.pull_logger'
     HOOK_PRE_PUSH = 'prechangegroup.pre_push'
     HOOK_PRETX_PUSH = 'pretxnchangegroup.pre_push'
     HOOK_PUSH = 'changegroup.push_logger'
     HOOK_PUSH_KEY = 'pushkey.key_push'
 
     # TODO: johbo: Unify way how hooks are configured for git and hg,
     # git part is currently hardcoded.
 
     # SVN PATTERNS
     SVN_BRANCH_ID = 'vcs_svn_branch'
     SVN_TAG_ID = 'vcs_svn_tag'
 
     ui_id = Column(
         "ui_id", Integer(), nullable=False, unique=True, default=None,
         primary_key=True)
     ui_section = Column(
         "ui_section", String(255), nullable=True, unique=None, default=None)
     ui_key = Column(
         "ui_key", String(255), nullable=True, unique=None, default=None)
     ui_value = Column(
         "ui_value", String(255), nullable=True, unique=None, default=None)
     ui_active = Column(
         "ui_active", Boolean(), nullable=True, unique=None, default=True)
 
     def __repr__(self):
         return '<%s[%s]%s=>%s]>' % (self.__class__.__name__, self.ui_section,
                                     self.ui_key, self.ui_value)
 
 
 class RepoRhodeCodeSetting(Base, BaseModel):
     __tablename__ = 'repo_rhodecode_settings'
     __table_args__ = (
         UniqueConstraint(
             'app_settings_name', 'repository_id',
             name='uq_repo_rhodecode_setting_name_repo_id'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
 
     repository_id = Column(
         "repository_id", Integer(), ForeignKey('repositories.repo_id'),
         nullable=False)
     app_settings_id = Column(
         "app_settings_id", Integer(), nullable=False, unique=True,
         default=None, primary_key=True)
     app_settings_name = Column(
         "app_settings_name", String(255), nullable=True, unique=None,
         default=None)
     _app_settings_value = Column(
         "app_settings_value", String(4096), nullable=True, unique=None,
         default=None)
     _app_settings_type = Column(
         "app_settings_type", String(255), nullable=True, unique=None,
         default=None)
 
     repository = relationship('Repository')
 
     def __init__(self, repository_id, key='', val='', type='unicode'):
         self.repository_id = repository_id
         self.app_settings_name = key
         self.app_settings_type = type
         self.app_settings_value = val
 
     @validates('_app_settings_value')
     def validate_settings_value(self, key, val):
         assert type(val) == unicode
         return val
 
     @hybrid_property
     def app_settings_value(self):
         v = self._app_settings_value
         type_ = self.app_settings_type
         SETTINGS_TYPES = RhodeCodeSetting.SETTINGS_TYPES
         converter = SETTINGS_TYPES.get(type_) or SETTINGS_TYPES['unicode']
         return converter(v)
 
     @app_settings_value.setter
     def app_settings_value(self, val):
         """
         Setter that will always make sure we use unicode in app_settings_value
 
         :param val:
         """
         self._app_settings_value = safe_unicode(val)
 
     @hybrid_property
     def app_settings_type(self):
         return self._app_settings_type
 
     @app_settings_type.setter
     def app_settings_type(self, val):
         SETTINGS_TYPES = RhodeCodeSetting.SETTINGS_TYPES
         if val not in SETTINGS_TYPES:
             raise Exception('type must be one of %s got %s'
                             % (SETTINGS_TYPES.keys(), val))
         self._app_settings_type = val
 
     def __unicode__(self):
         return u"<%s('%s:%s:%s[%s]')>" % (
             self.__class__.__name__, self.repository.repo_name,
             self.app_settings_name, self.app_settings_value,
             self.app_settings_type
         )
 
 
 class RepoRhodeCodeUi(Base, BaseModel):
     __tablename__ = 'repo_rhodecode_ui'
     __table_args__ = (
         UniqueConstraint(
             'repository_id', 'ui_section', 'ui_key',
             name='uq_repo_rhodecode_ui_repository_id_section_key'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
 
     repository_id = Column(
         "repository_id", Integer(), ForeignKey('repositories.repo_id'),
         nullable=False)
     ui_id = Column(
         "ui_id", Integer(), nullable=False, unique=True, default=None,
         primary_key=True)
     ui_section = Column(
         "ui_section", String(255), nullable=True, unique=None, default=None)
     ui_key = Column(
         "ui_key", String(255), nullable=True, unique=None, default=None)
     ui_value = Column(
         "ui_value", String(255), nullable=True, unique=None, default=None)
     ui_active = Column(
         "ui_active", Boolean(), nullable=True, unique=None, default=True)
 
     repository = relationship('Repository')
 
     def __repr__(self):
         return '<%s[%s:%s]%s=>%s]>' % (
             self.__class__.__name__, self.repository.repo_name,
             self.ui_section, self.ui_key, self.ui_value)
 
 
 class User(Base, BaseModel):
     __tablename__ = 'users'
     __table_args__ = (
         UniqueConstraint('username'), UniqueConstraint('email'),
         Index('u_username_idx', 'username'),
         Index('u_email_idx', 'email'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
     DEFAULT_USER = 'default'
     DEFAULT_USER_EMAIL = '[e-mail]'
     DEFAULT_GRAVATAR_URL = 'https://secure.gravatar.com/avatar/{md5email}?d=identicon&s={size}'
 
     user_id = Column("user_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     username = Column("username", String(255), nullable=True, unique=None, default=None)
     password = Column("password", String(255), nullable=True, unique=None, default=None)
     active = Column("active", Boolean(), nullable=True, unique=None, default=True)
     admin = Column("admin", Boolean(), nullable=True, unique=None, default=False)
     name = Column("firstname", String(255), nullable=True, unique=None, default=None)
     lastname = Column("lastname", String(255), nullable=True, unique=None, default=None)
     _email = Column("email", String(255), nullable=True, unique=None, default=None)
     last_login = Column("last_login", DateTime(timezone=False), nullable=True, unique=None, default=None)
     last_activity = Column('last_activity', DateTime(timezone=False), nullable=True, unique=None, default=None)
 
     extern_type = Column("extern_type", String(255), nullable=True, unique=None, default=None)
     extern_name = Column("extern_name", String(255), nullable=True, unique=None, default=None)
     _api_key = Column("api_key", String(255), nullable=True, unique=None, default=None)
     inherit_default_permissions = Column("inherit_default_permissions", Boolean(), nullable=False, unique=None, default=True)
     created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
     _user_data = Column("user_data", LargeBinary(), nullable=True)  # JSON data
 
     user_log = relationship('UserLog')
     user_perms = relationship('UserToPerm', primaryjoin="User.user_id==UserToPerm.user_id", cascade='all')
 
     repositories = relationship('Repository')
     repository_groups = relationship('RepoGroup')
     user_groups = relationship('UserGroup')
 
     user_followers = relationship('UserFollowing', primaryjoin='UserFollowing.follows_user_id==User.user_id', cascade='all')
     followings = relationship('UserFollowing', primaryjoin='UserFollowing.user_id==User.user_id', cascade='all')
 
     repo_to_perm = relationship('UserRepoToPerm', primaryjoin='UserRepoToPerm.user_id==User.user_id', cascade='all')
     repo_group_to_perm = relationship('UserRepoGroupToPerm', primaryjoin='UserRepoGroupToPerm.user_id==User.user_id', cascade='all')
     user_group_to_perm = relationship('UserUserGroupToPerm', primaryjoin='UserUserGroupToPerm.user_id==User.user_id', cascade='all')
 
     group_member = relationship('UserGroupMember', cascade='all')
 
     notifications = relationship('UserNotification', cascade='all')
     # notifications assigned to this user
     user_created_notifications = relationship('Notification', cascade='all')
     # comments created by this user
     user_comments = relationship('ChangesetComment', cascade='all')
     # user profile extra info
     user_emails = relationship('UserEmailMap', cascade='all')
     user_ip_map = relationship('UserIpMap', cascade='all')
     user_auth_tokens = relationship('UserApiKeys', cascade='all')
     # gists
     user_gists = relationship('Gist', cascade='all')
     # user pull requests
     user_pull_requests = relationship('PullRequest', cascade='all')
     # external identities
     extenal_identities = relationship(
         'ExternalIdentity',
         primaryjoin="User.user_id==ExternalIdentity.local_user_id",
         cascade='all')
 
     def __unicode__(self):
         return u"<%s('id:%s:%s')>" % (self.__class__.__name__,
                                       self.user_id, self.username)
 
     @hybrid_property
     def email(self):
         return self._email
 
     @email.setter
     def email(self, val):
         self._email = val.lower() if val else None
 
     @hybrid_property
     def api_key(self):
         """
         Fetch if exist an auth-token with role ALL connected to this user
         """
         user_auth_token = UserApiKeys.query()\
             .filter(UserApiKeys.user_id == self.user_id)\
             .filter(or_(UserApiKeys.expires == -1,
                             UserApiKeys.expires >= time.time()))\
             .filter(UserApiKeys.role == UserApiKeys.ROLE_ALL).first()
         if user_auth_token:
             user_auth_token = user_auth_token.api_key
 
         return user_auth_token
 
     @api_key.setter
     def api_key(self, val):
         # don't allow to set API key this is deprecated for now
         self._api_key = None
 
     @property
     def firstname(self):
         # alias for future
         return self.name
 
     @property
     def emails(self):
         other = UserEmailMap.query().filter(UserEmailMap.user==self).all()
         return [self.email] + [x.email for x in other]
 
     @property
     def auth_tokens(self):
         return [x.api_key for x in self.extra_auth_tokens]
 
     @property
     def extra_auth_tokens(self):
         return UserApiKeys.query().filter(UserApiKeys.user == self).all()
 
     @property
     def feed_token(self):
         return self.get_feed_token()
 
     def get_feed_token(self):
         feed_tokens = UserApiKeys.query()\
             .filter(UserApiKeys.user == self)\
             .filter(UserApiKeys.role == UserApiKeys.ROLE_FEED)\
             .all()
         if feed_tokens:
             return feed_tokens[0].api_key
         return 'NO_FEED_TOKEN_AVAILABLE'
 
     @classmethod
     def extra_valid_auth_tokens(cls, user, role=None):
         tokens = UserApiKeys.query().filter(UserApiKeys.user == user)\
                 .filter(or_(UserApiKeys.expires == -1,
                             UserApiKeys.expires >= time.time()))
         if role:
             tokens = tokens.filter(or_(UserApiKeys.role == role,
                                        UserApiKeys.role == UserApiKeys.ROLE_ALL))
         return tokens.all()
 
     def authenticate_by_token(self, auth_token, roles=None, scope_repo_id=None):
         from rhodecode.lib import auth
 
         log.debug('Trying to authenticate user: %s via auth-token, '
                   'and roles: %s', self, roles)
 
         if not auth_token:
             return False
 
         crypto_backend = auth.crypto_backend()
 
         roles = (roles or []) + [UserApiKeys.ROLE_ALL]
         tokens_q = UserApiKeys.query()\
             .filter(UserApiKeys.user_id == self.user_id)\
             .filter(or_(UserApiKeys.expires == -1,
                         UserApiKeys.expires >= time.time()))
 
         tokens_q = tokens_q.filter(UserApiKeys.role.in_(roles))
 
         plain_tokens = []
         hash_tokens = []
 
         for token in tokens_q.all():
             # verify scope first
             if token.repo_id:
                 # token has a scope, we need to verify it
                 if scope_repo_id != token.repo_id:
                     log.debug(
                         'Scope mismatch: token has a set repo scope: %s, '
                         'and calling scope is:%s, skipping further checks',
                          token.repo, scope_repo_id)
                     # token has a scope, and it doesn't match, skip token
                     continue
 
             if token.api_key.startswith(crypto_backend.ENC_PREF):
                 hash_tokens.append(token.api_key)
             else:
                 plain_tokens.append(token.api_key)
 
         is_plain_match = auth_token in plain_tokens
         if is_plain_match:
             return True
 
         for hashed in hash_tokens:
             # TODO(marcink): this is expensive to calculate, but most secure
             match = crypto_backend.hash_check(auth_token, hashed)
             if match:
                 return True
 
         return False
 
     @property
     def ip_addresses(self):
         ret = UserIpMap.query().filter(UserIpMap.user == self).all()
         return [x.ip_addr for x in ret]
 
     @property
     def username_and_name(self):
         return '%s (%s %s)' % (self.username, self.firstname, self.lastname)
 
     @property
     def username_or_name_or_email(self):
         full_name = self.full_name if self.full_name is not ' ' else None
         return self.username or full_name or self.email
 
     @property
     def full_name(self):
         return '%s %s' % (self.firstname, self.lastname)
 
     @property
     def full_name_or_username(self):
         return ('%s %s' % (self.firstname, self.lastname)
                 if (self.firstname and self.lastname) else self.username)
 
     @property
     def full_contact(self):
         return '%s %s <%s>' % (self.firstname, self.lastname, self.email)
 
     @property
     def short_contact(self):
         return '%s %s' % (self.firstname, self.lastname)
 
     @property
     def is_admin(self):
         return self.admin
 
     @property
     def AuthUser(self):
         """
         Returns instance of AuthUser for this user
         """
         from rhodecode.lib.auth import AuthUser
         return AuthUser(user_id=self.user_id, username=self.username)
 
     @hybrid_property
     def user_data(self):
         if not self._user_data:
             return {}
 
         try:
             return json.loads(self._user_data)
         except TypeError:
             return {}
 
     @user_data.setter
     def user_data(self, val):
         if not isinstance(val, dict):
             raise Exception('user_data must be dict, got %s' % type(val))
         try:
             self._user_data = json.dumps(val)
         except Exception:
             log.error(traceback.format_exc())
 
     @classmethod
     def get_by_username(cls, username, case_insensitive=False,
                         cache=False, identity_cache=False):
         session = Session()
 
         if case_insensitive:
             q = cls.query().filter(
                 func.lower(cls.username) == func.lower(username))
         else:
             q = cls.query().filter(cls.username == username)
 
         if cache:
             if identity_cache:
                 val = cls.identity_cache(session, 'username', username)
                 if val:
                     return val
             else:
                 cache_key = "get_user_by_name_%s" % _hash_key(username)
                 q = q.options(
                     FromCache("sql_cache_short", cache_key))
 
         return q.scalar()
 
     @classmethod
     def get_by_auth_token(cls, auth_token, cache=False):
         q = UserApiKeys.query()\
             .filter(UserApiKeys.api_key == auth_token)\
             .filter(or_(UserApiKeys.expires == -1,
                         UserApiKeys.expires >= time.time()))
         if cache:
             q = q.options(
                 FromCache("sql_cache_short", "get_auth_token_%s" % auth_token))
 
         match = q.first()
         if match:
             return match.user
 
     @classmethod
     def get_by_email(cls, email, case_insensitive=False, cache=False):
 
         if case_insensitive:
             q = cls.query().filter(func.lower(cls.email) == func.lower(email))
 
         else:
             q = cls.query().filter(cls.email == email)
 
         email_key = _hash_key(email)
         if cache:
             q = q.options(
                 FromCache("sql_cache_short", "get_email_key_%s" % email_key))
 
         ret = q.scalar()
         if ret is None:
             q = UserEmailMap.query()
             # try fetching in alternate email map
             if case_insensitive:
                 q = q.filter(func.lower(UserEmailMap.email) == func.lower(email))
             else:
                 q = q.filter(UserEmailMap.email == email)
             q = q.options(joinedload(UserEmailMap.user))
             if cache:
                 q = q.options(
                     FromCache("sql_cache_short", "get_email_map_key_%s" % email_key))
             ret = getattr(q.scalar(), 'user', None)
 
         return ret
 
     @classmethod
     def get_from_cs_author(cls, author):
         """
         Tries to get User objects out of commit author string
 
         :param author:
         """
         from rhodecode.lib.helpers import email, author_name
         # Valid email in the attribute passed, see if they're in the system
         _email = email(author)
         if _email:
             user = cls.get_by_email(_email, case_insensitive=True)
             if user:
                 return user
         # Maybe we can match by username?
         _author = author_name(author)
         user = cls.get_by_username(_author, case_insensitive=True)
         if user:
             return user
 
     def update_userdata(self, **kwargs):
         usr = self
         old = usr.user_data
         old.update(**kwargs)
         usr.user_data = old
         Session().add(usr)
         log.debug('updated userdata with ', kwargs)
 
     def update_lastlogin(self):
         """Update user lastlogin"""
         self.last_login = datetime.datetime.now()
         Session().add(self)
         log.debug('updated user %s lastlogin', self.username)
 
     def update_lastactivity(self):
         """Update user lastactivity"""
         self.last_activity = datetime.datetime.now()
         Session().add(self)
         log.debug('updated user %s lastactivity', self.username)
 
     def update_password(self, new_password):
         from rhodecode.lib.auth import get_crypt_password
 
         self.password = get_crypt_password(new_password)
         Session().add(self)
 
     @classmethod
     def get_first_super_admin(cls):
         user = User.query().filter(User.admin == true()).first()
         if user is None:
             raise Exception('FATAL: Missing administrative account!')
         return user
 
     @classmethod
     def get_all_super_admins(cls):
         """
         Returns all admin accounts sorted by username
         """
         return User.query().filter(User.admin == true())\
             .order_by(User.username.asc()).all()
 
     @classmethod
     def get_default_user(cls, cache=False, refresh=False):
         user = User.get_by_username(User.DEFAULT_USER, cache=cache)
         if user is None:
             raise Exception('FATAL: Missing default account!')
         if refresh:
             # The default user might be based on outdated state which
             # has been loaded from the cache.
             # A call to refresh() ensures that the
             # latest state from the database is used.
             Session().refresh(user)
         return user
 
     def _get_default_perms(self, user, suffix=''):
         from rhodecode.model.permission import PermissionModel
         return PermissionModel().get_default_perms(user.user_perms, suffix)
 
     def get_default_perms(self, suffix=''):
         return self._get_default_perms(self, suffix)
 
     def get_api_data(self, include_secrets=False, details='full'):
         """
         Common function for generating user related data for API
 
         :param include_secrets: By default secrets in the API data will be replaced
            by a placeholder value to prevent exposing this data by accident. In case
            this data shall be exposed, set this flag to ``True``.
 
         :param details: details can be 'basic|full' basic gives only a subset of
            the available user information that includes user_id, name and emails.
         """
         user = self
         user_data = self.user_data
         data = {
             'user_id': user.user_id,
             'username': user.username,
             'firstname': user.name,
             'lastname': user.lastname,
             'email': user.email,
             'emails': user.emails,
         }
         if details == 'basic':
             return data
 
         api_key_length = 40
         api_key_replacement = '*' * api_key_length
 
         extras = {
             'api_keys': [api_key_replacement],
             'auth_tokens': [api_key_replacement],
             'active': user.active,
             'admin': user.admin,
             'extern_type': user.extern_type,
             'extern_name': user.extern_name,
             'last_login': user.last_login,
             'last_activity': user.last_activity,
             'ip_addresses': user.ip_addresses,
             'language': user_data.get('language')
         }
         data.update(extras)
 
         if include_secrets:
             data['api_keys'] = user.auth_tokens
             data['auth_tokens'] = user.extra_auth_tokens
         return data
 
     def __json__(self):
         data = {
             'full_name': self.full_name,
             'full_name_or_username': self.full_name_or_username,
             'short_contact': self.short_contact,
             'full_contact': self.full_contact,
         }
         data.update(self.get_api_data())
         return data
 
 
 class UserApiKeys(Base, BaseModel):
     __tablename__ = 'user_api_keys'
     __table_args__ = (
         Index('uak_api_key_idx', 'api_key'),
         Index('uak_api_key_expires_idx', 'api_key', 'expires'),
         UniqueConstraint('api_key'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
     __mapper_args__ = {}
 
     # ApiKey role
     ROLE_ALL = 'token_role_all'
     ROLE_HTTP = 'token_role_http'
     ROLE_VCS = 'token_role_vcs'
     ROLE_API = 'token_role_api'
     ROLE_FEED = 'token_role_feed'
     ROLE_PASSWORD_RESET = 'token_password_reset'
 
     ROLES = [ROLE_ALL, ROLE_HTTP, ROLE_VCS, ROLE_API, ROLE_FEED]
 
     user_api_key_id = Column("user_api_key_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=True, unique=None, default=None)
     api_key = Column("api_key", String(255), nullable=False, unique=True)
     description = Column('description', UnicodeText().with_variant(UnicodeText(1024), 'mysql'))
     expires = Column('expires', Float(53), nullable=False)
     role = Column('role', String(255), nullable=True)
     created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
 
     # scope columns
     repo_id = Column(
         'repo_id', Integer(), ForeignKey('repositories.repo_id'),
         nullable=True, unique=None, default=None)
     repo = relationship('Repository', lazy='joined')
 
     repo_group_id = Column(
         'repo_group_id', Integer(), ForeignKey('groups.group_id'),
         nullable=True, unique=None, default=None)
     repo_group = relationship('RepoGroup', lazy='joined')
 
     user = relationship('User', lazy='joined')
 
     def __unicode__(self):
         return u"<%s('%s')>" % (self.__class__.__name__, self.role)
 
     def __json__(self):
         data = {
             'auth_token': self.api_key,
             'role': self.role,
             'scope': self.scope_humanized,
             'expired': self.expired
         }
         return data
 
     @property
     def expired(self):
         if self.expires == -1:
             return False
         return time.time() > self.expires
 
     @classmethod
     def _get_role_name(cls, role):
         return {
             cls.ROLE_ALL: _('all'),
             cls.ROLE_HTTP: _('http/web interface'),
             cls.ROLE_VCS: _('vcs (git/hg/svn protocol)'),
             cls.ROLE_API: _('api calls'),
             cls.ROLE_FEED: _('feed access'),
         }.get(role, role)
 
     @property
     def role_humanized(self):
         return self._get_role_name(self.role)
 
     def _get_scope(self):
         if self.repo:
             return repr(self.repo)
         if self.repo_group:
             return repr(self.repo_group) + ' (recursive)'
         return 'global'
 
     @property
     def scope_humanized(self):
         return self._get_scope()
 
 
 class UserEmailMap(Base, BaseModel):
     __tablename__ = 'user_email_map'
     __table_args__ = (
         Index('uem_email_idx', 'email'),
         UniqueConstraint('email'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
     __mapper_args__ = {}
 
     email_id = Column("email_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=True, unique=None, default=None)
     _email = Column("email", String(255), nullable=True, unique=False, default=None)
     user = relationship('User', lazy='joined')
 
     @validates('_email')
     def validate_email(self, key, email):
         # check if this email is not main one
         main_email = Session().query(User).filter(User.email == email).scalar()
         if main_email is not None:
             raise AttributeError('email %s is present is user table' % email)
         return email
 
     @hybrid_property
     def email(self):
         return self._email
 
     @email.setter
     def email(self, val):
         self._email = val.lower() if val else None
 
 
 class UserIpMap(Base, BaseModel):
     __tablename__ = 'user_ip_map'
     __table_args__ = (
         UniqueConstraint('user_id', 'ip_addr'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
     __mapper_args__ = {}
 
     ip_id = Column("ip_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=True, unique=None, default=None)
     ip_addr = Column("ip_addr", String(255), nullable=True, unique=False, default=None)
     active = Column("active", Boolean(), nullable=True, unique=None, default=True)
     description = Column("description", String(10000), nullable=True, unique=None, default=None)
     user = relationship('User', lazy='joined')
 
     @classmethod
     def _get_ip_range(cls, ip_addr):
         net = ipaddress.ip_network(ip_addr, strict=False)
         return [str(net.network_address), str(net.broadcast_address)]
 
     def __json__(self):
         return {
           'ip_addr': self.ip_addr,
           'ip_range': self._get_ip_range(self.ip_addr),
         }
 
     def __unicode__(self):
         return u"<%s('user_id:%s=>%s')>" % (self.__class__.__name__,
                                             self.user_id, self.ip_addr)
 
 
 class UserLog(Base, BaseModel):
     __tablename__ = 'user_logs'
     __table_args__ = (
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
     )
     VERSION_1 = 'v1'
     VERSION_2 = 'v2'
     VERSIONS = [VERSION_1, VERSION_2]
 
     user_log_id = Column("user_log_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=True, unique=None, default=None)
     username = Column("username", String(255), nullable=True, unique=None, default=None)
     repository_id = Column("repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=True)
     repository_name = Column("repository_name", String(255), nullable=True, unique=None, default=None)
     user_ip = Column("user_ip", String(255), nullable=True, unique=None, default=None)
     action = Column("action", Text().with_variant(Text(1200000), 'mysql'), nullable=True, unique=None, default=None)
     action_date = Column("action_date", DateTime(timezone=False), nullable=True, unique=None, default=None)
 
     version = Column("version", String(255), nullable=True, default=VERSION_1)
     user_data = Column('user_data_json', MutationObj.as_mutable(JsonType(dialect_map=dict(mysql=UnicodeText(16384)))))
     action_data = Column('action_data_json', MutationObj.as_mutable(JsonType(dialect_map=dict(mysql=UnicodeText(16384)))))
 
     def __unicode__(self):
         return u"<%s('id:%s:%s')>" % (
             self.__class__.__name__, self.repository_name, self.action)
 
     def __json__(self):
         return {
             'user_id': self.user_id,
             'username': self.username,
             'repository_id': self.repository_id,
             'repository_name': self.repository_name,
             'user_ip': self.user_ip,
             'action_date': self.action_date,
             'action': self.action,
         }
 
     @property
     def action_as_day(self):
         return datetime.date(*self.action_date.timetuple()[:3])
 
     user = relationship('User')
     repository = relationship('Repository', cascade='')
 
 
 class UserGroup(Base, BaseModel):
     __tablename__ = 'users_groups'
     __table_args__ = (
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
     )
 
     users_group_id = Column("users_group_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     users_group_name = Column("users_group_name", String(255), nullable=False, unique=True, default=None)
     user_group_description = Column("user_group_description", String(10000), nullable=True, unique=None, default=None)
     users_group_active = Column("users_group_active", Boolean(), nullable=True, unique=None, default=None)
     inherit_default_permissions = Column("users_group_inherit_default_permissions", Boolean(), nullable=False, unique=None, default=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=False, default=None)
     created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
     _group_data = Column("group_data", LargeBinary(), nullable=True)  # JSON data
 
     members = relationship('UserGroupMember', cascade="all, delete, delete-orphan", lazy="joined")
     users_group_to_perm = relationship('UserGroupToPerm', cascade='all')
     users_group_repo_to_perm = relationship('UserGroupRepoToPerm', cascade='all')
     users_group_repo_group_to_perm = relationship('UserGroupRepoGroupToPerm', cascade='all')
     user_user_group_to_perm = relationship('UserUserGroupToPerm', cascade='all')
     user_group_user_group_to_perm = relationship('UserGroupUserGroupToPerm ', primaryjoin="UserGroupUserGroupToPerm.target_user_group_id==UserGroup.users_group_id", cascade='all')
 
     user = relationship('User')
 
     @hybrid_property
     def group_data(self):
         if not self._group_data:
             return {}
 
         try:
             return json.loads(self._group_data)
         except TypeError:
             return {}
 
     @group_data.setter
     def group_data(self, val):
         try:
             self._group_data = json.dumps(val)
         except Exception:
             log.error(traceback.format_exc())
 
     def __unicode__(self):
         return u"<%s('id:%s:%s')>" % (self.__class__.__name__,
                                       self.users_group_id,
                                       self.users_group_name)
 
     @classmethod
     def get_by_group_name(cls, group_name, cache=False,
                           case_insensitive=False):
         if case_insensitive:
             q = cls.query().filter(func.lower(cls.users_group_name) ==
                                    func.lower(group_name))
 
         else:
             q = cls.query().filter(cls.users_group_name == group_name)
         if cache:
             q = q.options(
                 FromCache("sql_cache_short", "get_group_%s" % _hash_key(group_name)))
         return q.scalar()
 
     @classmethod
     def get(cls, user_group_id, cache=False):
         user_group = cls.query()
         if cache:
             user_group = user_group.options(
                 FromCache("sql_cache_short", "get_users_group_%s" % user_group_id))
         return user_group.get(user_group_id)
 
     def permissions(self, with_admins=True, with_owner=True):
         q = UserUserGroupToPerm.query().filter(UserUserGroupToPerm.user_group == self)
         q = q.options(joinedload(UserUserGroupToPerm.user_group),
                       joinedload(UserUserGroupToPerm.user),
                       joinedload(UserUserGroupToPerm.permission),)
 
         # get owners and admins and permissions. We do a trick of re-writing
         # objects from sqlalchemy to named-tuples due to sqlalchemy session
         # has a global reference and changing one object propagates to all
         # others. This means if admin is also an owner admin_row that change
         # would propagate to both objects
         perm_rows = []
         for _usr in q.all():
             usr = AttributeDict(_usr.user.get_dict())
             usr.permission = _usr.permission.permission_name
             perm_rows.append(usr)
 
         # filter the perm rows by 'default' first and then sort them by
         # admin,write,read,none permissions sorted again alphabetically in
         # each group
         perm_rows = sorted(perm_rows, key=display_sort)
 
         _admin_perm = 'usergroup.admin'
         owner_row = []
         if with_owner:
             usr = AttributeDict(self.user.get_dict())
             usr.owner_row = True
             usr.permission = _admin_perm
             owner_row.append(usr)
 
         super_admin_rows = []
         if with_admins:
             for usr in User.get_all_super_admins():
                 # if this admin is also owner, don't double the record
                 if usr.user_id == owner_row[0].user_id:
                     owner_row[0].admin_row = True
                 else:
                     usr = AttributeDict(usr.get_dict())
                     usr.admin_row = True
                     usr.permission = _admin_perm
                     super_admin_rows.append(usr)
 
         return super_admin_rows + owner_row + perm_rows
 
     def permission_user_groups(self):
         q = UserGroupUserGroupToPerm.query().filter(UserGroupUserGroupToPerm.target_user_group == self)
         q = q.options(joinedload(UserGroupUserGroupToPerm.user_group),
                       joinedload(UserGroupUserGroupToPerm.target_user_group),
                       joinedload(UserGroupUserGroupToPerm.permission),)
 
         perm_rows = []
         for _user_group in q.all():
             usr = AttributeDict(_user_group.user_group.get_dict())
             usr.permission = _user_group.permission.permission_name
             perm_rows.append(usr)
 
         return perm_rows
 
     def _get_default_perms(self, user_group, suffix=''):
         from rhodecode.model.permission import PermissionModel
         return PermissionModel().get_default_perms(user_group.users_group_to_perm, suffix)
 
     def get_default_perms(self, suffix=''):
         return self._get_default_perms(self, suffix)
 
     def get_api_data(self, with_group_members=True, include_secrets=False):
         """
         :param include_secrets: See :meth:`User.get_api_data`, this parameter is
            basically forwarded.
 
         """
         user_group = self
         data = {
             'users_group_id': user_group.users_group_id,
             'group_name': user_group.users_group_name,
             'group_description': user_group.user_group_description,
             'active': user_group.users_group_active,
             'owner': user_group.user.username,
             'owner_email': user_group.user.email,
         }
 
         if with_group_members:
             users = []
             for user in user_group.members:
                 user = user.user
                 users.append(user.get_api_data(include_secrets=include_secrets))
             data['users'] = users
 
         return data
 
 
 class UserGroupMember(Base, BaseModel):
     __tablename__ = 'users_groups_members'
     __table_args__ = (
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
     )
 
     users_group_member_id = Column("users_group_member_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     users_group_id = Column("users_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)
 
     user = relationship('User', lazy='joined')
     users_group = relationship('UserGroup')
 
     def __init__(self, gr_id='', u_id=''):
         self.users_group_id = gr_id
         self.user_id = u_id
 
 
 class RepositoryField(Base, BaseModel):
     __tablename__ = 'repositories_fields'
     __table_args__ = (
         UniqueConstraint('repository_id', 'field_key'),  # no-multi field
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
     )
     PREFIX = 'ex_'  # prefix used in form to not conflict with already existing fields
 
     repo_field_id = Column("repo_field_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     repository_id = Column("repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=False, unique=None, default=None)
     field_key = Column("field_key", String(250))
     field_label = Column("field_label", String(1024), nullable=False)
     field_value = Column("field_value", String(10000), nullable=False)
     field_desc = Column("field_desc", String(1024), nullable=False)
     field_type = Column("field_type", String(255), nullable=False, unique=None)
     created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
 
     repository = relationship('Repository')
 
     @property
     def field_key_prefixed(self):
         return 'ex_%s' % self.field_key
 
     @classmethod
     def un_prefix_key(cls, key):
         if key.startswith(cls.PREFIX):
             return key[len(cls.PREFIX):]
         return key
 
     @classmethod
     def get_by_key_name(cls, key, repo):
         row = cls.query()\
                 .filter(cls.repository == repo)\
                 .filter(cls.field_key == key).scalar()
         return row
 
 
 class Repository(Base, BaseModel):
     __tablename__ = 'repositories'
     __table_args__ = (
         Index('r_repo_name_idx', 'repo_name', mysql_length=255),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
     )
     DEFAULT_CLONE_URI = '{scheme}://{user}@{netloc}/{repo}'
     DEFAULT_CLONE_URI_ID = '{scheme}://{user}@{netloc}/_{repoid}'
 
     STATE_CREATED = 'repo_state_created'
     STATE_PENDING = 'repo_state_pending'
     STATE_ERROR = 'repo_state_error'
 
     LOCK_AUTOMATIC = 'lock_auto'
     LOCK_API = 'lock_api'
     LOCK_WEB = 'lock_web'
     LOCK_PULL = 'lock_pull'
 
     NAME_SEP = URL_SEP
 
     repo_id = Column(
         "repo_id", Integer(), nullable=False, unique=True, default=None,
         primary_key=True)
     _repo_name = Column(
         "repo_name", Text(), nullable=False, default=None)
     _repo_name_hash = Column(
         "repo_name_hash", String(255), nullable=False, unique=True)
     repo_state = Column("repo_state", String(255), nullable=True)
 
     clone_uri = Column(
         "clone_uri", EncryptedTextValue(), nullable=True, unique=False,
         default=None)
     repo_type = Column(
         "repo_type", String(255), nullable=False, unique=False, default=None)
     user_id = Column(
         "user_id", Integer(), ForeignKey('users.user_id'), nullable=False,
         unique=False, default=None)
     private = Column(
         "private", Boolean(), nullable=True, unique=None, default=None)
     enable_statistics = Column(
         "statistics", Boolean(), nullable=True, unique=None, default=True)
     enable_downloads = Column(
         "downloads", Boolean(), nullable=True, unique=None, default=True)
     description = Column(
         "description", String(10000), nullable=True, unique=None, default=None)
     created_on = Column(
         'created_on', DateTime(timezone=False), nullable=True, unique=None,
         default=datetime.datetime.now)
     updated_on = Column(
         'updated_on', DateTime(timezone=False), nullable=True, unique=None,
         default=datetime.datetime.now)
     _landing_revision = Column(
         "landing_revision", String(255), nullable=False, unique=False,
         default=None)
     enable_locking = Column(
         "enable_locking", Boolean(), nullable=False, unique=None,
         default=False)
     _locked = Column(
         "locked", String(255), nullable=True, unique=False, default=None)
     _changeset_cache = Column(
         "changeset_cache", LargeBinary(), nullable=True)  # JSON data
 
     fork_id = Column(
         "fork_id", Integer(), ForeignKey('repositories.repo_id'),
         nullable=True, unique=False, default=None)
     group_id = Column(
         "group_id", Integer(), ForeignKey('groups.group_id'), nullable=True,
         unique=False, default=None)
 
     user = relationship('User', lazy='joined')
     fork = relationship('Repository', remote_side=repo_id, lazy='joined')
     group = relationship('RepoGroup', lazy='joined')
     repo_to_perm = relationship(
         'UserRepoToPerm', cascade='all',
         order_by='UserRepoToPerm.repo_to_perm_id')
     users_group_to_perm = relationship('UserGroupRepoToPerm', cascade='all')
     stats = relationship('Statistics', cascade='all', uselist=False)
 
     followers = relationship(
         'UserFollowing',
         primaryjoin='UserFollowing.follows_repo_id==Repository.repo_id',
         cascade='all')
     extra_fields = relationship(
         'RepositoryField', cascade="all, delete, delete-orphan")
     logs = relationship('UserLog')
     comments = relationship(
         'ChangesetComment', cascade="all, delete, delete-orphan")
     pull_requests_source = relationship(
         'PullRequest',
         primaryjoin='PullRequest.source_repo_id==Repository.repo_id',
         cascade="all, delete, delete-orphan")
     pull_requests_target = relationship(
         'PullRequest',
         primaryjoin='PullRequest.target_repo_id==Repository.repo_id',
         cascade="all, delete, delete-orphan")
     ui = relationship('RepoRhodeCodeUi', cascade="all")
     settings = relationship('RepoRhodeCodeSetting', cascade="all")
     integrations = relationship('Integration',
                                 cascade="all, delete, delete-orphan")
 
     def __unicode__(self):
         return u"<%s('%s:%s')>" % (self.__class__.__name__, self.repo_id,
                                    safe_unicode(self.repo_name))
 
     @hybrid_property
     def landing_rev(self):
         # always should return [rev_type, rev]
         if self._landing_revision:
             _rev_info = self._landing_revision.split(':')
             if len(_rev_info) < 2:
                 _rev_info.insert(0, 'rev')
             return [_rev_info[0], _rev_info[1]]
         return [None, None]
 
     @landing_rev.setter
     def landing_rev(self, val):
         if ':' not in val:
             raise ValueError('value must be delimited with `:` and consist '
                              'of <rev_type>:<rev>, got %s instead' % val)
         self._landing_revision = val
 
     @hybrid_property
     def locked(self):
         if self._locked:
             user_id, timelocked, reason = self._locked.split(':')
             lock_values = int(user_id), timelocked, reason
         else:
             lock_values = [None, None, None]
         return lock_values
 
     @locked.setter
     def locked(self, val):
         if val and isinstance(val, (list, tuple)):
             self._locked = ':'.join(map(str, val))
         else:
             self._locked = None
 
     @hybrid_property
     def changeset_cache(self):
         from rhodecode.lib.vcs.backends.base import EmptyCommit
         dummy = EmptyCommit().__json__()
         if not self._changeset_cache:
             return dummy
         try:
             return json.loads(self._changeset_cache)
         except TypeError:
             return dummy
         except Exception:
             log.error(traceback.format_exc())
             return dummy
 
     @changeset_cache.setter
     def changeset_cache(self, val):
         try:
             self._changeset_cache = json.dumps(val)
         except Exception:
             log.error(traceback.format_exc())
 
     @hybrid_property
     def repo_name(self):
         return self._repo_name
 
     @repo_name.setter
     def repo_name(self, value):
         self._repo_name = value
         self._repo_name_hash = hashlib.sha1(safe_str(value)).hexdigest()
 
     @classmethod
     def normalize_repo_name(cls, repo_name):
         """
         Normalizes os specific repo_name to the format internally stored inside
         database using URL_SEP
 
         :param cls:
         :param repo_name:
         """
         return cls.NAME_SEP.join(repo_name.split(os.sep))
 
     @classmethod
     def get_by_repo_name(cls, repo_name, cache=False, identity_cache=False):
         session = Session()
         q = session.query(cls).filter(cls.repo_name == repo_name)
 
         if cache:
             if identity_cache:
                 val = cls.identity_cache(session, 'repo_name', repo_name)
                 if val:
                     return val
             else:
                 cache_key = "get_repo_by_name_%s" % _hash_key(repo_name)
                 q = q.options(
                     FromCache("sql_cache_short", cache_key))
 
         return q.scalar()
 
     @classmethod
     def get_by_full_path(cls, repo_full_path):
         repo_name = repo_full_path.split(cls.base_path(), 1)[-1]
         repo_name = cls.normalize_repo_name(repo_name)
         return cls.get_by_repo_name(repo_name.strip(URL_SEP))
 
     @classmethod
     def get_repo_forks(cls, repo_id):
         return cls.query().filter(Repository.fork_id == repo_id)
 
     @classmethod
     def base_path(cls):
         """
         Returns base path when all repos are stored
 
         :param cls:
         """
         q = Session().query(RhodeCodeUi)\
             .filter(RhodeCodeUi.ui_key == cls.NAME_SEP)
         q = q.options(FromCache("sql_cache_short", "repository_repo_path"))
         return q.one().ui_value
 
     @classmethod
     def is_valid(cls, repo_name):
         """
         returns True if given repo name is a valid filesystem repository
 
         :param cls:
         :param repo_name:
         """
         from rhodecode.lib.utils import is_valid_repo
 
         return is_valid_repo(repo_name, cls.base_path())
 
     @classmethod
     def get_all_repos(cls, user_id=Optional(None), group_id=Optional(None),
                       case_insensitive=True):
         q = Repository.query()
 
         if not isinstance(user_id, Optional):
             q = q.filter(Repository.user_id == user_id)
 
         if not isinstance(group_id, Optional):
             q = q.filter(Repository.group_id == group_id)
 
         if case_insensitive:
             q = q.order_by(func.lower(Repository.repo_name))
         else:
             q = q.order_by(Repository.repo_name)
         return q.all()
 
     @property
     def forks(self):
         """
         Return forks of this repo
         """
         return Repository.get_repo_forks(self.repo_id)
 
     @property
     def parent(self):
         """
         Returns fork parent
         """
         return self.fork
 
     @property
     def just_name(self):
         return self.repo_name.split(self.NAME_SEP)[-1]
 
     @property
     def groups_with_parents(self):
         groups = []
         if self.group is None:
             return groups
 
         cur_gr = self.group
         groups.insert(0, cur_gr)
         while 1:
             gr = getattr(cur_gr, 'parent_group', None)
             cur_gr = cur_gr.parent_group
             if gr is None:
                 break
             groups.insert(0, gr)
 
         return groups
 
     @property
     def groups_and_repo(self):
         return self.groups_with_parents, self
 
     @LazyProperty
     def repo_path(self):
         """
         Returns base full path for that repository means where it actually
         exists on a filesystem
         """
         q = Session().query(RhodeCodeUi).filter(
             RhodeCodeUi.ui_key == self.NAME_SEP)
         q = q.options(FromCache("sql_cache_short", "repository_repo_path"))
         return q.one().ui_value
 
     @property
     def repo_full_path(self):
         p = [self.repo_path]
         # we need to split the name by / since this is how we store the
         # names in the database, but that eventually needs to be converted
         # into a valid system path
         p += self.repo_name.split(self.NAME_SEP)
         return os.path.join(*map(safe_unicode, p))
 
     @property
     def cache_keys(self):
         """
         Returns associated cache keys for that repo
         """
         return CacheKey.query()\
             .filter(CacheKey.cache_args == self.repo_name)\
             .order_by(CacheKey.cache_key)\
             .all()
 
     def get_new_name(self, repo_name):
         """
         returns new full repository name based on assigned group and new new
 
         :param group_name:
         """
         path_prefix = self.group.full_path_splitted if self.group else []
         return self.NAME_SEP.join(path_prefix + [repo_name])
 
     @property
     def _config(self):
         """
         Returns db based config object.
         """
         from rhodecode.lib.utils import make_db_config
         return make_db_config(clear_session=False, repo=self)
 
     def permissions(self, with_admins=True, with_owner=True):
         q = UserRepoToPerm.query().filter(UserRepoToPerm.repository == self)
         q = q.options(joinedload(UserRepoToPerm.repository),
                       joinedload(UserRepoToPerm.user),
                       joinedload(UserRepoToPerm.permission),)
 
         # get owners and admins and permissions. We do a trick of re-writing
         # objects from sqlalchemy to named-tuples due to sqlalchemy session
         # has a global reference and changing one object propagates to all
         # others. This means if admin is also an owner admin_row that change
         # would propagate to both objects
         perm_rows = []
         for _usr in q.all():
             usr = AttributeDict(_usr.user.get_dict())
             usr.permission = _usr.permission.permission_name
             perm_rows.append(usr)
 
         # filter the perm rows by 'default' first and then sort them by
         # admin,write,read,none permissions sorted again alphabetically in
         # each group
         perm_rows = sorted(perm_rows, key=display_sort)
 
         _admin_perm = 'repository.admin'
         owner_row = []
         if with_owner:
             usr = AttributeDict(self.user.get_dict())
             usr.owner_row = True
             usr.permission = _admin_perm
             owner_row.append(usr)
 
         super_admin_rows = []
         if with_admins:
             for usr in User.get_all_super_admins():
                 # if this admin is also owner, don't double the record
                 if usr.user_id == owner_row[0].user_id:
                     owner_row[0].admin_row = True
                 else:
                     usr = AttributeDict(usr.get_dict())
                     usr.admin_row = True
                     usr.permission = _admin_perm
                     super_admin_rows.append(usr)
 
         return super_admin_rows + owner_row + perm_rows
 
     def permission_user_groups(self):
         q = UserGroupRepoToPerm.query().filter(
             UserGroupRepoToPerm.repository == self)
         q = q.options(joinedload(UserGroupRepoToPerm.repository),
                       joinedload(UserGroupRepoToPerm.users_group),
                       joinedload(UserGroupRepoToPerm.permission),)
 
         perm_rows = []
         for _user_group in q.all():
             usr = AttributeDict(_user_group.users_group.get_dict())
             usr.permission = _user_group.permission.permission_name
             perm_rows.append(usr)
 
         return perm_rows
 
     def get_api_data(self, include_secrets=False):
         """
         Common function for generating repo api data
 
         :param include_secrets: See :meth:`User.get_api_data`.
 
         """
         # TODO: mikhail: Here there is an anti-pattern, we probably need to
         # move this methods on models level.
         from rhodecode.model.settings import SettingsModel
         from rhodecode.model.repo import RepoModel
 
         repo = self
         _user_id, _time, _reason = self.locked
 
         data = {
             'repo_id': repo.repo_id,
             'repo_name': repo.repo_name,
             'repo_type': repo.repo_type,
             'clone_uri': repo.clone_uri or '',
             'url': RepoModel().get_url(self),
             'private': repo.private,
             'created_on': repo.created_on,
             'description': repo.description,
             'landing_rev': repo.landing_rev,
             'owner': repo.user.username,
             'fork_of': repo.fork.repo_name if repo.fork else None,
             'fork_of_id': repo.fork.repo_id if repo.fork else None,
             'enable_statistics': repo.enable_statistics,
             'enable_locking': repo.enable_locking,
             'enable_downloads': repo.enable_downloads,
             'last_changeset': repo.changeset_cache,
             'locked_by': User.get(_user_id).get_api_data(
                 include_secrets=include_secrets) if _user_id else None,
             'locked_date': time_to_datetime(_time) if _time else None,
             'lock_reason': _reason if _reason else None,
         }
 
         # TODO: mikhail: should be per-repo settings here
         rc_config = SettingsModel().get_all_settings()
         repository_fields = str2bool(
             rc_config.get('rhodecode_repository_fields'))
         if repository_fields:
             for f in self.extra_fields:
                 data[f.field_key_prefixed] = f.field_value
 
         return data
 
     @classmethod
     def lock(cls, repo, user_id, lock_time=None, lock_reason=None):
         if not lock_time:
             lock_time = time.time()
         if not lock_reason:
             lock_reason = cls.LOCK_AUTOMATIC
         repo.locked = [user_id, lock_time, lock_reason]
         Session().add(repo)
         Session().commit()
 
     @classmethod
     def unlock(cls, repo):
         repo.locked = None
         Session().add(repo)
         Session().commit()
 
     @classmethod
     def getlock(cls, repo):
         return repo.locked
 
     def is_user_lock(self, user_id):
         if self.lock[0]:
             lock_user_id = safe_int(self.lock[0])
             user_id = safe_int(user_id)
             # both are ints, and they are equal
             return all([lock_user_id, user_id]) and lock_user_id == user_id
 
         return False
 
     def get_locking_state(self, action, user_id, only_when_enabled=True):
         """
         Checks locking on this repository, if locking is enabled and lock is
         present returns a tuple of make_lock, locked, locked_by.
         make_lock can have 3 states None (do nothing) True, make lock
         False release lock, This value is later propagated to hooks, which
         do the locking. Think about this as signals passed to hooks what to do.
 
         """
         # TODO: johbo: This is part of the business logic and should be moved
         # into the RepositoryModel.
 
         if action not in ('push', 'pull'):
             raise ValueError("Invalid action value: %s" % repr(action))
 
         # defines if locked error should be thrown to user
         currently_locked = False
         # defines if new lock should be made, tri-state
         make_lock = None
         repo = self
         user = User.get(user_id)
 
         lock_info = repo.locked
 
         if repo and (repo.enable_locking or not only_when_enabled):
             if action == 'push':
                 # check if it's already locked !, if it is compare users
                 locked_by_user_id = lock_info[0]
                 if user.user_id == locked_by_user_id:
                     log.debug(
                         'Got `push` action from user %s, now unlocking', user)
                     # unlock if we have push from user who locked
                     make_lock = False
                 else:
                     # we're not the same user who locked, ban with
                     # code defined in settings (default is 423 HTTP Locked) !
                     log.debug('Repo %s is currently locked by %s', repo, user)
                     currently_locked = True
             elif action == 'pull':
                 # [0] user [1] date
                 if lock_info[0] and lock_info[1]:
                     log.debug('Repo %s is currently locked by %s', repo, user)
                     currently_locked = True
                 else:
                     log.debug('Setting lock on repo %s by %s', repo, user)
                     make_lock = True
 
         else:
             log.debug('Repository %s do not have locking enabled', repo)
 
         log.debug('FINAL locking values make_lock:%s,locked:%s,locked_by:%s',
                   make_lock, currently_locked, lock_info)
 
         from rhodecode.lib.auth import HasRepoPermissionAny
         perm_check = HasRepoPermissionAny('repository.write', 'repository.admin')
         if make_lock and not perm_check(repo_name=repo.repo_name, user=user):
             # if we don't have at least write permission we cannot make a lock
             log.debug('lock state reset back to FALSE due to lack '
                       'of at least read permission')
             make_lock = False
 
         return make_lock, currently_locked, lock_info
 
     @property
     def last_db_change(self):
         return self.updated_on
 
     @property
     def clone_uri_hidden(self):
         clone_uri = self.clone_uri
         if clone_uri:
             import urlobject
             url_obj = urlobject.URLObject(cleaned_uri(clone_uri))
             if url_obj.password:
                 clone_uri = url_obj.with_password('*****')
         return clone_uri
 
     def clone_url(self, **override):
 
         uri_tmpl = None
         if 'with_id' in override:
             uri_tmpl = self.DEFAULT_CLONE_URI_ID
             del override['with_id']
 
         if 'uri_tmpl' in override:
             uri_tmpl = override['uri_tmpl']
             del override['uri_tmpl']
 
         # we didn't override our tmpl from **overrides
         if not uri_tmpl:
             uri_tmpl = self.DEFAULT_CLONE_URI
             try:
                 from pylons import tmpl_context as c
                 uri_tmpl = c.clone_uri_tmpl
             except Exception:
                 # in any case if we call this outside of request context,
                 # ie, not having tmpl_context set up
                 pass
 
         request = get_current_request()
         return get_clone_url(request=request,
                              uri_tmpl=uri_tmpl,
                              repo_name=self.repo_name,
                              repo_id=self.repo_id, **override)
 
     def set_state(self, state):
         self.repo_state = state
         Session().add(self)
     #==========================================================================
     # SCM PROPERTIES
     #==========================================================================
 
     def get_commit(self, commit_id=None, commit_idx=None, pre_load=None):
         return get_commit_safe(
             self.scm_instance(), commit_id, commit_idx, pre_load=pre_load)
 
     def get_changeset(self, rev=None, pre_load=None):
         warnings.warn("Use get_commit", DeprecationWarning)
         commit_id = None
         commit_idx = None
         if isinstance(rev, basestring):
             commit_id = rev
         else:
             commit_idx = rev
         return self.get_commit(commit_id=commit_id, commit_idx=commit_idx,
                                pre_load=pre_load)
 
     def get_landing_commit(self):
         """
         Returns landing commit, or if that doesn't exist returns the tip
         """
         _rev_type, _rev = self.landing_rev
         commit = self.get_commit(_rev)
         if isinstance(commit, EmptyCommit):
             return self.get_commit()
         return commit
 
     def update_commit_cache(self, cs_cache=None, config=None):
         """
         Update cache of last changeset for repository, keys should be::
 
             short_id
             raw_id
             revision
             parents
             message
             date
             author
 
         :param cs_cache:
         """
         from rhodecode.lib.vcs.backends.base import BaseChangeset
         if cs_cache is None:
             # use no-cache version here
             scm_repo = self.scm_instance(cache=False, config=config)
             if scm_repo:
                 cs_cache = scm_repo.get_commit(
                     pre_load=["author", "date", "message", "parents"])
             else:
                 cs_cache = EmptyCommit()
 
         if isinstance(cs_cache, BaseChangeset):
             cs_cache = cs_cache.__json__()
 
         def is_outdated(new_cs_cache):
             if (new_cs_cache['raw_id'] != self.changeset_cache['raw_id'] or
                 new_cs_cache['revision'] != self.changeset_cache['revision']):
                 return True
             return False
 
         # check if we have maybe already latest cached revision
         if is_outdated(cs_cache) or not self.changeset_cache:
             _default = datetime.datetime.fromtimestamp(0)
             last_change = cs_cache.get('date') or _default
             log.debug('updated repo %s with new cs cache %s',
                       self.repo_name, cs_cache)
             self.updated_on = last_change
             self.changeset_cache = cs_cache
             Session().add(self)
             Session().commit()
         else:
             log.debug('Skipping update_commit_cache for repo:`%s` '
                       'commit already with latest changes', self.repo_name)
 
     @property
     def tip(self):
         return self.get_commit('tip')
 
     @property
     def author(self):
         return self.tip.author
 
     @property
     def last_change(self):
         return self.scm_instance().last_change
 
     def get_comments(self, revisions=None):
         """
         Returns comments for this repository grouped by revisions
 
         :param revisions: filter query by revisions only
         """
         cmts = ChangesetComment.query()\
             .filter(ChangesetComment.repo == self)
         if revisions:
             cmts = cmts.filter(ChangesetComment.revision.in_(revisions))
         grouped = collections.defaultdict(list)
         for cmt in cmts.all():
             grouped[cmt.revision].append(cmt)
         return grouped
 
     def statuses(self, revisions=None):
         """
         Returns statuses for this repository
 
         :param revisions: list of revisions to get statuses for
         """
         statuses = ChangesetStatus.query()\
             .filter(ChangesetStatus.repo == self)\
             .filter(ChangesetStatus.version == 0)
 
         if revisions:
             # Try doing the filtering in chunks to avoid hitting limits
             size = 500
             status_results = []
             for chunk in xrange(0, len(revisions), size):
                 status_results += statuses.filter(
                     ChangesetStatus.revision.in_(
                         revisions[chunk: chunk+size])
                 ).all()
         else:
             status_results = statuses.all()
 
         grouped = {}
 
         # maybe we have open new pullrequest without a status?
         stat = ChangesetStatus.STATUS_UNDER_REVIEW
         status_lbl = ChangesetStatus.get_status_lbl(stat)
         for pr in PullRequest.query().filter(PullRequest.source_repo == self).all():
             for rev in pr.revisions:
                 pr_id = pr.pull_request_id
                 pr_repo = pr.target_repo.repo_name
                 grouped[rev] = [stat, status_lbl, pr_id, pr_repo]
 
         for stat in status_results:
             pr_id = pr_repo = None
             if stat.pull_request:
                 pr_id = stat.pull_request.pull_request_id
                 pr_repo = stat.pull_request.target_repo.repo_name
             grouped[stat.revision] = [str(stat.status), stat.status_lbl,
                                       pr_id, pr_repo]
         return grouped
 
     # ==========================================================================
     # SCM CACHE INSTANCE
     # ==========================================================================
 
     def scm_instance(self, **kwargs):
         import rhodecode
 
         # Passing a config will not hit the cache currently only used
         # for repo2dbmapper
         config = kwargs.pop('config', None)
         cache = kwargs.pop('cache', None)
         full_cache = str2bool(rhodecode.CONFIG.get('vcs_full_cache'))
         # if cache is NOT defined use default global, else we have a full
         # control over cache behaviour
         if cache is None and full_cache and not config:
             return self._get_instance_cached()
         return self._get_instance(cache=bool(cache), config=config)
 
     def _get_instance_cached(self):
         @cache_region('long_term')
         def _get_repo(cache_key):
             return self._get_instance()
 
         invalidator_context = CacheKey.repo_context_cache(
             _get_repo, self.repo_name, None, thread_scoped=True)
 
         with invalidator_context as context:
             context.invalidate()
             repo = context.compute()
 
         return repo
 
     def _get_instance(self, cache=True, config=None):
         config = config or self._config
         custom_wire = {
             'cache': cache  # controls the vcs.remote cache
         }
         repo = get_vcs_instance(
             repo_path=safe_str(self.repo_full_path),
             config=config,
             with_wire=custom_wire,
             create=False,
             _vcs_alias=self.repo_type)
 
         return repo
 
     def __json__(self):
         return {'landing_rev': self.landing_rev}
 
     def get_dict(self):
 
         # Since we transformed `repo_name` to a hybrid property, we need to
         # keep compatibility with the code which uses `repo_name` field.
 
         result = super(Repository, self).get_dict()
         result['repo_name'] = result.pop('_repo_name', None)
         return result
 
 
 class RepoGroup(Base, BaseModel):
     __tablename__ = 'groups'
     __table_args__ = (
         UniqueConstraint('group_name', 'group_parent_id'),
         CheckConstraint('group_id != group_parent_id'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
     )
     __mapper_args__ = {'order_by': 'group_name'}
 
     CHOICES_SEPARATOR = '/'  # used to generate select2 choices for nested groups
 
     group_id = Column("group_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     group_name = Column("group_name", String(255), nullable=False, unique=True, default=None)
     group_parent_id = Column("group_parent_id", Integer(), ForeignKey('groups.group_id'), nullable=True, unique=None, default=None)
     group_description = Column("group_description", String(10000), nullable=True, unique=None, default=None)
     enable_locking = Column("enable_locking", Boolean(), nullable=False, unique=None, default=False)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=False, default=None)
     created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
     personal = Column('personal', Boolean(), nullable=True, unique=None, default=None)
 
     repo_group_to_perm = relationship('UserRepoGroupToPerm', cascade='all', order_by='UserRepoGroupToPerm.group_to_perm_id')
     users_group_to_perm = relationship('UserGroupRepoGroupToPerm', cascade='all')
     parent_group = relationship('RepoGroup', remote_side=group_id)
     user = relationship('User')
     integrations = relationship('Integration',
                                 cascade="all, delete, delete-orphan")
 
     def __init__(self, group_name='', parent_group=None):
         self.group_name = group_name
         self.parent_group = parent_group
 
     def __unicode__(self):
         return u"<%s('id:%s:%s')>" % (self.__class__.__name__, self.group_id,
                                       self.group_name)
 
     @classmethod
     def _generate_choice(cls, repo_group):
         from webhelpers.html import literal as _literal
         _name = lambda k: _literal(cls.CHOICES_SEPARATOR.join(k))
         return repo_group.group_id, _name(repo_group.full_path_splitted)
 
     @classmethod
     def groups_choices(cls, groups=None, show_empty_group=True):
         if not groups:
             groups = cls.query().all()
 
         repo_groups = []
         if show_empty_group:
             repo_groups = [(-1, u'-- %s --' % _('No parent'))]
 
         repo_groups.extend([cls._generate_choice(x) for x in groups])
 
         repo_groups = sorted(
             repo_groups, key=lambda t: t[1].split(cls.CHOICES_SEPARATOR)[0])
         return repo_groups
 
     @classmethod
     def url_sep(cls):
         return URL_SEP
 
     @classmethod
     def get_by_group_name(cls, group_name, cache=False, case_insensitive=False):
         if case_insensitive:
             gr = cls.query().filter(func.lower(cls.group_name)
                                     == func.lower(group_name))
         else:
             gr = cls.query().filter(cls.group_name == group_name)
         if cache:
             name_key = _hash_key(group_name)
             gr = gr.options(
                 FromCache("sql_cache_short", "get_group_%s" % name_key))
         return gr.scalar()
 
     @classmethod
     def get_user_personal_repo_group(cls, user_id):
         user = User.get(user_id)
         if user.username == User.DEFAULT_USER:
             return None
 
         return cls.query()\
             .filter(cls.personal == true()) \
             .filter(cls.user == user).scalar()
 
     @classmethod
     def get_all_repo_groups(cls, user_id=Optional(None), group_id=Optional(None),
                             case_insensitive=True):
         q = RepoGroup.query()
 
         if not isinstance(user_id, Optional):
             q = q.filter(RepoGroup.user_id == user_id)
 
         if not isinstance(group_id, Optional):
             q = q.filter(RepoGroup.group_parent_id == group_id)
 
         if case_insensitive:
             q = q.order_by(func.lower(RepoGroup.group_name))
         else:
             q = q.order_by(RepoGroup.group_name)
         return q.all()
 
     @property
     def parents(self):
         parents_recursion_limit = 10
         groups = []
         if self.parent_group is None:
             return groups
         cur_gr = self.parent_group
         groups.insert(0, cur_gr)
         cnt = 0
         while 1:
             cnt += 1
             gr = getattr(cur_gr, 'parent_group', None)
             cur_gr = cur_gr.parent_group
             if gr is None:
                 break
             if cnt == parents_recursion_limit:
                 # this will prevent accidental infinit loops
                 log.error(('more than %s parents found for group %s, stopping '
                            'recursive parent fetching' % (parents_recursion_limit, self)))
                 break
 
             groups.insert(0, gr)
         return groups
 
     @property
     def children(self):
         return RepoGroup.query().filter(RepoGroup.parent_group == self)
 
     @property
     def name(self):
         return self.group_name.split(RepoGroup.url_sep())[-1]
 
     @property
     def full_path(self):
         return self.group_name
 
     @property
     def full_path_splitted(self):
         return self.group_name.split(RepoGroup.url_sep())
 
     @property
     def repositories(self):
         return Repository.query()\
                 .filter(Repository.group == self)\
                 .order_by(Repository.repo_name)
 
     @property
     def repositories_recursive_count(self):
         cnt = self.repositories.count()
 
         def children_count(group):
             cnt = 0
             for child in group.children:
                 cnt += child.repositories.count()
                 cnt += children_count(child)
             return cnt
 
         return cnt + children_count(self)
 
     def _recursive_objects(self, include_repos=True):
         all_ = []
 
         def _get_members(root_gr):
             if include_repos:
                 for r in root_gr.repositories:
                     all_.append(r)
             childs = root_gr.children.all()
             if childs:
                 for gr in childs:
                     all_.append(gr)
                     _get_members(gr)
 
         _get_members(self)
         return [self] + all_
 
     def recursive_groups_and_repos(self):
         """
         Recursive return all groups, with repositories in those groups
         """
         return self._recursive_objects()
 
     def recursive_groups(self):
         """
         Returns all children groups for this group including children of children
         """
         return self._recursive_objects(include_repos=False)
 
     def get_new_name(self, group_name):
         """
         returns new full group name based on parent and new name
 
         :param group_name:
         """
         path_prefix = (self.parent_group.full_path_splitted if
                        self.parent_group else [])
         return RepoGroup.url_sep().join(path_prefix + [group_name])
 
     def permissions(self, with_admins=True, with_owner=True):
         q = UserRepoGroupToPerm.query().filter(UserRepoGroupToPerm.group == self)
         q = q.options(joinedload(UserRepoGroupToPerm.group),
                       joinedload(UserRepoGroupToPerm.user),
                       joinedload(UserRepoGroupToPerm.permission),)
 
         # get owners and admins and permissions. We do a trick of re-writing
         # objects from sqlalchemy to named-tuples due to sqlalchemy session
         # has a global reference and changing one object propagates to all
         # others. This means if admin is also an owner admin_row that change
         # would propagate to both objects
         perm_rows = []
         for _usr in q.all():
             usr = AttributeDict(_usr.user.get_dict())
             usr.permission = _usr.permission.permission_name
             perm_rows.append(usr)
 
         # filter the perm rows by 'default' first and then sort them by
         # admin,write,read,none permissions sorted again alphabetically in
         # each group
         perm_rows = sorted(perm_rows, key=display_sort)
 
         _admin_perm = 'group.admin'
         owner_row = []
         if with_owner:
             usr = AttributeDict(self.user.get_dict())
             usr.owner_row = True
             usr.permission = _admin_perm
             owner_row.append(usr)
 
         super_admin_rows = []
         if with_admins:
             for usr in User.get_all_super_admins():
                 # if this admin is also owner, don't double the record
                 if usr.user_id == owner_row[0].user_id:
                     owner_row[0].admin_row = True
                 else:
                     usr = AttributeDict(usr.get_dict())
                     usr.admin_row = True
                     usr.permission = _admin_perm
                     super_admin_rows.append(usr)
 
         return super_admin_rows + owner_row + perm_rows
 
     def permission_user_groups(self):
         q = UserGroupRepoGroupToPerm.query().filter(UserGroupRepoGroupToPerm.group == self)
         q = q.options(joinedload(UserGroupRepoGroupToPerm.group),
                       joinedload(UserGroupRepoGroupToPerm.users_group),
                       joinedload(UserGroupRepoGroupToPerm.permission),)
 
         perm_rows = []
         for _user_group in q.all():
             usr = AttributeDict(_user_group.users_group.get_dict())
             usr.permission = _user_group.permission.permission_name
             perm_rows.append(usr)
 
         return perm_rows
 
     def get_api_data(self):
         """
         Common function for generating api data
 
         """
         group = self
         data = {
             'group_id': group.group_id,
             'group_name': group.group_name,
             'group_description': group.group_description,
             'parent_group': group.parent_group.group_name if group.parent_group else None,
             'repositories': [x.repo_name for x in group.repositories],
             'owner': group.user.username,
         }
         return data
 
 
 class Permission(Base, BaseModel):
     __tablename__ = 'permissions'
     __table_args__ = (
         Index('p_perm_name_idx', 'permission_name'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
     )
     PERMS = [
         ('hg.admin', _('RhodeCode Super Administrator')),
 
         ('repository.none', _('Repository no access')),
         ('repository.read', _('Repository read access')),
         ('repository.write', _('Repository write access')),
         ('repository.admin', _('Repository admin access')),
 
         ('group.none', _('Repository group no access')),
         ('group.read', _('Repository group read access')),
         ('group.write', _('Repository group write access')),
         ('group.admin', _('Repository group admin access')),
 
         ('usergroup.none', _('User group no access')),
         ('usergroup.read', _('User group read access')),
         ('usergroup.write', _('User group write access')),
         ('usergroup.admin', _('User group admin access')),
 
         ('hg.repogroup.create.false', _('Repository Group creation disabled')),
         ('hg.repogroup.create.true', _('Repository Group creation enabled')),
 
         ('hg.usergroup.create.false', _('User Group creation disabled')),
         ('hg.usergroup.create.true', _('User Group creation enabled')),
 
         ('hg.create.none', _('Repository creation disabled')),
         ('hg.create.repository', _('Repository creation enabled')),
         ('hg.create.write_on_repogroup.true', _('Repository creation enabled with write permission to a repository group')),
         ('hg.create.write_on_repogroup.false', _('Repository creation disabled with write permission to a repository group')),
 
         ('hg.fork.none', _('Repository forking disabled')),
         ('hg.fork.repository', _('Repository forking enabled')),
 
         ('hg.register.none', _('Registration disabled')),
         ('hg.register.manual_activate', _('User Registration with manual account activation')),
         ('hg.register.auto_activate', _('User Registration with automatic account activation')),
 
         ('hg.password_reset.enabled', _('Password reset enabled')),
         ('hg.password_reset.hidden', _('Password reset hidden')),
         ('hg.password_reset.disabled', _('Password reset disabled')),
 
         ('hg.extern_activate.manual', _('Manual activation of external account')),
         ('hg.extern_activate.auto', _('Automatic activation of external account')),
 
         ('hg.inherit_default_perms.false', _('Inherit object permissions from default user disabled')),
         ('hg.inherit_default_perms.true', _('Inherit object permissions from default user enabled')),
     ]
 
     # definition of system default permissions for DEFAULT user
     DEFAULT_USER_PERMISSIONS = [
         'repository.read',
         'group.read',
         'usergroup.read',
         'hg.create.repository',
         'hg.repogroup.create.false',
         'hg.usergroup.create.false',
         'hg.create.write_on_repogroup.true',
         'hg.fork.repository',
         'hg.register.manual_activate',
         'hg.password_reset.enabled',
         'hg.extern_activate.auto',
         'hg.inherit_default_perms.true',
     ]
 
     # defines which permissions are more important higher the more important
     # Weight defines which permissions are more important.
     # The higher number the more important.
     PERM_WEIGHTS = {
         'repository.none': 0,
         'repository.read': 1,
         'repository.write': 3,
         'repository.admin': 4,
 
         'group.none': 0,
         'group.read': 1,
         'group.write': 3,
         'group.admin': 4,
 
         'usergroup.none': 0,
         'usergroup.read': 1,
         'usergroup.write': 3,
         'usergroup.admin': 4,
 
         'hg.repogroup.create.false': 0,
         'hg.repogroup.create.true': 1,
 
         'hg.usergroup.create.false': 0,
         'hg.usergroup.create.true': 1,
 
         'hg.fork.none': 0,
         'hg.fork.repository': 1,
         'hg.create.none': 0,
         'hg.create.repository': 1
     }
 
     permission_id = Column("permission_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     permission_name = Column("permission_name", String(255), nullable=True, unique=None, default=None)
     permission_longname = Column("permission_longname", String(255), nullable=True, unique=None, default=None)
 
     def __unicode__(self):
         return u"<%s('%s:%s')>" % (
             self.__class__.__name__, self.permission_id, self.permission_name
         )
 
     @classmethod
     def get_by_key(cls, key):
         return cls.query().filter(cls.permission_name == key).scalar()
 
     @classmethod
     def get_default_repo_perms(cls, user_id, repo_id=None):
         q = Session().query(UserRepoToPerm, Repository, Permission)\
             .join((Permission, UserRepoToPerm.permission_id == Permission.permission_id))\
             .join((Repository, UserRepoToPerm.repository_id == Repository.repo_id))\
             .filter(UserRepoToPerm.user_id == user_id)
         if repo_id:
             q = q.filter(UserRepoToPerm.repository_id == repo_id)
         return q.all()
 
     @classmethod
     def get_default_repo_perms_from_user_group(cls, user_id, repo_id=None):
         q = Session().query(UserGroupRepoToPerm, Repository, Permission)\
             .join(
                 Permission,
                 UserGroupRepoToPerm.permission_id == Permission.permission_id)\
             .join(
                 Repository,
                 UserGroupRepoToPerm.repository_id == Repository.repo_id)\
             .join(
                 UserGroup,
                 UserGroupRepoToPerm.users_group_id ==
                 UserGroup.users_group_id)\
             .join(
                 UserGroupMember,
                 UserGroupRepoToPerm.users_group_id ==
                 UserGroupMember.users_group_id)\
             .filter(
                 UserGroupMember.user_id == user_id,
                 UserGroup.users_group_active == true())
         if repo_id:
             q = q.filter(UserGroupRepoToPerm.repository_id == repo_id)
         return q.all()
 
     @classmethod
     def get_default_group_perms(cls, user_id, repo_group_id=None):
         q = Session().query(UserRepoGroupToPerm, RepoGroup, Permission)\
             .join((Permission, UserRepoGroupToPerm.permission_id == Permission.permission_id))\
             .join((RepoGroup, UserRepoGroupToPerm.group_id == RepoGroup.group_id))\
             .filter(UserRepoGroupToPerm.user_id == user_id)
         if repo_group_id:
             q = q.filter(UserRepoGroupToPerm.group_id == repo_group_id)
         return q.all()
 
     @classmethod
     def get_default_group_perms_from_user_group(
             cls, user_id, repo_group_id=None):
         q = Session().query(UserGroupRepoGroupToPerm, RepoGroup, Permission)\
             .join(
                 Permission,
                 UserGroupRepoGroupToPerm.permission_id ==
                 Permission.permission_id)\
             .join(
                 RepoGroup,
                 UserGroupRepoGroupToPerm.group_id == RepoGroup.group_id)\
             .join(
                 UserGroup,
                 UserGroupRepoGroupToPerm.users_group_id ==
                 UserGroup.users_group_id)\
             .join(
                 UserGroupMember,
                 UserGroupRepoGroupToPerm.users_group_id ==
                 UserGroupMember.users_group_id)\
             .filter(
                 UserGroupMember.user_id == user_id,
                 UserGroup.users_group_active == true())
         if repo_group_id:
             q = q.filter(UserGroupRepoGroupToPerm.group_id == repo_group_id)
         return q.all()
 
     @classmethod
     def get_default_user_group_perms(cls, user_id, user_group_id=None):
         q = Session().query(UserUserGroupToPerm, UserGroup, Permission)\
             .join((Permission, UserUserGroupToPerm.permission_id == Permission.permission_id))\
             .join((UserGroup, UserUserGroupToPerm.user_group_id == UserGroup.users_group_id))\
             .filter(UserUserGroupToPerm.user_id == user_id)
         if user_group_id:
             q = q.filter(UserUserGroupToPerm.user_group_id == user_group_id)
         return q.all()
 
     @classmethod
     def get_default_user_group_perms_from_user_group(
             cls, user_id, user_group_id=None):
         TargetUserGroup = aliased(UserGroup, name='target_user_group')
         q = Session().query(UserGroupUserGroupToPerm, UserGroup, Permission)\
             .join(
                 Permission,
                 UserGroupUserGroupToPerm.permission_id ==
                 Permission.permission_id)\
             .join(
                 TargetUserGroup,
                 UserGroupUserGroupToPerm.target_user_group_id ==
                 TargetUserGroup.users_group_id)\
             .join(
                 UserGroup,
                 UserGroupUserGroupToPerm.user_group_id ==
                 UserGroup.users_group_id)\
             .join(
                 UserGroupMember,
                 UserGroupUserGroupToPerm.user_group_id ==
                 UserGroupMember.users_group_id)\
             .filter(
                 UserGroupMember.user_id == user_id,
                 UserGroup.users_group_active == true())
         if user_group_id:
             q = q.filter(
                 UserGroupUserGroupToPerm.user_group_id == user_group_id)
 
         return q.all()
 
 
 class UserRepoToPerm(Base, BaseModel):
     __tablename__ = 'repo_to_perm'
     __table_args__ = (
         UniqueConstraint('user_id', 'repository_id', 'permission_id'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
     repo_to_perm_id = Column("repo_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)
     permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
     repository_id = Column("repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=False, unique=None, default=None)
 
     user = relationship('User')
     repository = relationship('Repository')
     permission = relationship('Permission')
 
     @classmethod
     def create(cls, user, repository, permission):
         n = cls()
         n.user = user
         n.repository = repository
         n.permission = permission
         Session().add(n)
         return n
 
     def __unicode__(self):
         return u'<%s => %s >' % (self.user, self.repository)
 
 
 class UserUserGroupToPerm(Base, BaseModel):
     __tablename__ = 'user_user_group_to_perm'
     __table_args__ = (
         UniqueConstraint('user_id', 'user_group_id', 'permission_id'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
     user_user_group_to_perm_id = Column("user_user_group_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)
     permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
     user_group_id = Column("user_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)
 
     user = relationship('User')
     user_group = relationship('UserGroup')
     permission = relationship('Permission')
 
     @classmethod
     def create(cls, user, user_group, permission):
         n = cls()
         n.user = user
         n.user_group = user_group
         n.permission = permission
         Session().add(n)
         return n
 
     def __unicode__(self):
         return u'<%s => %s >' % (self.user, self.user_group)
 
 
 class UserToPerm(Base, BaseModel):
     __tablename__ = 'user_to_perm'
     __table_args__ = (
         UniqueConstraint('user_id', 'permission_id'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
     user_to_perm_id = Column("user_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)
     permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
 
     user = relationship('User')
     permission = relationship('Permission', lazy='joined')
 
     def __unicode__(self):
         return u'<%s => %s >' % (self.user, self.permission)
 
 
 class UserGroupRepoToPerm(Base, BaseModel):
     __tablename__ = 'users_group_repo_to_perm'
     __table_args__ = (
         UniqueConstraint('repository_id', 'users_group_id', 'permission_id'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
     users_group_to_perm_id = Column("users_group_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     users_group_id = Column("users_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)
     permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
     repository_id = Column("repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=False, unique=None, default=None)
 
     users_group = relationship('UserGroup')
     permission = relationship('Permission')
     repository = relationship('Repository')
 
     @classmethod
     def create(cls, users_group, repository, permission):
         n = cls()
         n.users_group = users_group
         n.repository = repository
         n.permission = permission
         Session().add(n)
         return n
 
     def __unicode__(self):
         return u'<UserGroupRepoToPerm:%s => %s >' % (self.users_group, self.repository)
 
 
 class UserGroupUserGroupToPerm(Base, BaseModel):
     __tablename__ = 'user_group_user_group_to_perm'
     __table_args__ = (
         UniqueConstraint('target_user_group_id', 'user_group_id', 'permission_id'),
         CheckConstraint('target_user_group_id != user_group_id'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
     user_group_user_group_to_perm_id = Column("user_group_user_group_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     target_user_group_id = Column("target_user_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)
     permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
     user_group_id = Column("user_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)
 
     target_user_group = relationship('UserGroup', primaryjoin='UserGroupUserGroupToPerm.target_user_group_id==UserGroup.users_group_id')
     user_group = relationship('UserGroup', primaryjoin='UserGroupUserGroupToPerm.user_group_id==UserGroup.users_group_id')
     permission = relationship('Permission')
 
     @classmethod
     def create(cls, target_user_group, user_group, permission):
         n = cls()
         n.target_user_group = target_user_group
         n.user_group = user_group
         n.permission = permission
         Session().add(n)
         return n
 
     def __unicode__(self):
         return u'<UserGroupUserGroup:%s => %s >' % (self.target_user_group, self.user_group)
 
 
 class UserGroupToPerm(Base, BaseModel):
     __tablename__ = 'users_group_to_perm'
     __table_args__ = (
         UniqueConstraint('users_group_id', 'permission_id',),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
     users_group_to_perm_id = Column("users_group_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     users_group_id = Column("users_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)
     permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
 
     users_group = relationship('UserGroup')
     permission = relationship('Permission')
 
 
 class UserRepoGroupToPerm(Base, BaseModel):
     __tablename__ = 'user_repo_group_to_perm'
     __table_args__ = (
         UniqueConstraint('user_id', 'group_id', 'permission_id'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
 
     group_to_perm_id = Column("group_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)
     group_id = Column("group_id", Integer(), ForeignKey('groups.group_id'), nullable=False, unique=None, default=None)
     permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
 
     user = relationship('User')
     group = relationship('RepoGroup')
     permission = relationship('Permission')
 
     @classmethod
     def create(cls, user, repository_group, permission):
         n = cls()
         n.user = user
         n.group = repository_group
         n.permission = permission
         Session().add(n)
         return n
 
 
 class UserGroupRepoGroupToPerm(Base, BaseModel):
     __tablename__ = 'users_group_repo_group_to_perm'
     __table_args__ = (
         UniqueConstraint('users_group_id', 'group_id'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
 
     users_group_repo_group_to_perm_id = Column("users_group_repo_group_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     users_group_id = Column("users_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)
     group_id = Column("group_id", Integer(), ForeignKey('groups.group_id'), nullable=False, unique=None, default=None)
     permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)
 
     users_group = relationship('UserGroup')
     permission = relationship('Permission')
     group = relationship('RepoGroup')
 
     @classmethod
     def create(cls, user_group, repository_group, permission):
         n = cls()
         n.users_group = user_group
         n.group = repository_group
         n.permission = permission
         Session().add(n)
         return n
 
     def __unicode__(self):
         return u'<UserGroupRepoGroupToPerm:%s => %s >' % (self.users_group, self.group)
 
 
 class Statistics(Base, BaseModel):
     __tablename__ = 'statistics'
     __table_args__ = (
          UniqueConstraint('repository_id'),
          {'extend_existing': True, 'mysql_engine': 'InnoDB',
           'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
     stat_id = Column("stat_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     repository_id = Column("repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=False, unique=True, default=None)
     stat_on_revision = Column("stat_on_revision", Integer(), nullable=False)
     commit_activity = Column("commit_activity", LargeBinary(1000000), nullable=False)#JSON data
     commit_activity_combined = Column("commit_activity_combined", LargeBinary(), nullable=False)#JSON data
     languages = Column("languages", LargeBinary(1000000), nullable=False)#JSON data
 
     repository = relationship('Repository', single_parent=True)
 
 
 class UserFollowing(Base, BaseModel):
     __tablename__ = 'user_followings'
     __table_args__ = (
         UniqueConstraint('user_id', 'follows_repository_id'),
         UniqueConstraint('user_id', 'follows_user_id'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
 
     user_following_id = Column("user_following_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)
     follows_repo_id = Column("follows_repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=True, unique=None, default=None)
     follows_user_id = Column("follows_user_id", Integer(), ForeignKey('users.user_id'), nullable=True, unique=None, default=None)
     follows_from = Column('follows_from', DateTime(timezone=False), nullable=True, unique=None, default=datetime.datetime.now)
 
     user = relationship('User', primaryjoin='User.user_id==UserFollowing.user_id')
 
     follows_user = relationship('User', primaryjoin='User.user_id==UserFollowing.follows_user_id')
     follows_repository = relationship('Repository', order_by='Repository.repo_name')
 
     @classmethod
     def get_repo_followers(cls, repo_id):
         return cls.query().filter(cls.follows_repo_id == repo_id)
 
 
 class CacheKey(Base, BaseModel):
     __tablename__ = 'cache_invalidation'
     __table_args__ = (
         UniqueConstraint('cache_key'),
         Index('key_idx', 'cache_key'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
     )
     CACHE_TYPE_ATOM = 'ATOM'
     CACHE_TYPE_RSS = 'RSS'
     CACHE_TYPE_README = 'README'
 
     cache_id = Column("cache_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     cache_key = Column("cache_key", String(255), nullable=True, unique=None, default=None)
     cache_args = Column("cache_args", String(255), nullable=True, unique=None, default=None)
     cache_active = Column("cache_active", Boolean(), nullable=True, unique=None, default=False)
 
     def __init__(self, cache_key, cache_args=''):
         self.cache_key = cache_key
         self.cache_args = cache_args
         self.cache_active = False
 
     def __unicode__(self):
         return u"<%s('%s:%s[%s]')>" % (
             self.__class__.__name__,
             self.cache_id, self.cache_key, self.cache_active)
 
     def _cache_key_partition(self):
         prefix, repo_name, suffix = self.cache_key.partition(self.cache_args)
         return prefix, repo_name, suffix
 
     def get_prefix(self):
         """
         Try to extract prefix from existing cache key. The key could consist
         of prefix, repo_name, suffix
         """
         # this returns prefix, repo_name, suffix
         return self._cache_key_partition()[0]
 
     def get_suffix(self):
         """
         get suffix that might have been used in _get_cache_key to
         generate self.cache_key. Only used for informational purposes
         in repo_edit.mako.
         """
         # prefix, repo_name, suffix
         return self._cache_key_partition()[2]
 
     @classmethod
     def delete_all_cache(cls):
         """
         Delete all cache keys from database.
         Should only be run when all instances are down and all entries
         thus stale.
         """
         cls.query().delete()
         Session().commit()
 
     @classmethod
     def get_cache_key(cls, repo_name, cache_type):
         """
 
         Generate a cache key for this process of RhodeCode instance.
         Prefix most likely will be process id or maybe explicitly set
         instance_id from .ini file.
         """
         import rhodecode
         prefix = safe_unicode(rhodecode.CONFIG.get('instance_id') or '')
 
         repo_as_unicode = safe_unicode(repo_name)
         key = u'{}_{}'.format(repo_as_unicode, cache_type) \
             if cache_type else repo_as_unicode
 
         return u'{}{}'.format(prefix, key)
 
     @classmethod
     def set_invalidate(cls, repo_name, delete=False):
         """
         Mark all caches of a repo as invalid in the database.
         """
 
         try:
             qry = Session().query(cls).filter(cls.cache_args == repo_name)
             if delete:
                 log.debug('cache objects deleted for repo %s',
                           safe_str(repo_name))
                 qry.delete()
             else:
                 log.debug('cache objects marked as invalid for repo %s',
                           safe_str(repo_name))
                 qry.update({"cache_active": False})
 
             Session().commit()
         except Exception:
             log.exception(
                 'Cache key invalidation failed for repository %s',
                 safe_str(repo_name))
             Session().rollback()
 
     @classmethod
     def get_active_cache(cls, cache_key):
         inv_obj = cls.query().filter(cls.cache_key == cache_key).scalar()
         if inv_obj:
             return inv_obj
         return None
 
     @classmethod
     def repo_context_cache(cls, compute_func, repo_name, cache_type,
                            thread_scoped=False):
         """
         @cache_region('long_term')
         def _heavy_calculation(cache_key):
             return 'result'
 
         cache_context = CacheKey.repo_context_cache(
             _heavy_calculation, repo_name, cache_type)
 
         with cache_context as context:
             context.invalidate()
             computed = context.compute()
 
         assert computed == 'result'
         """
         from rhodecode.lib import caches
         return caches.InvalidationContext(
             compute_func, repo_name, cache_type, thread_scoped=thread_scoped)
 
 
 class ChangesetComment(Base, BaseModel):
     __tablename__ = 'changeset_comments'
     __table_args__ = (
         Index('cc_revision_idx', 'revision'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
     )
 
     COMMENT_OUTDATED = u'comment_outdated'
     COMMENT_TYPE_NOTE = u'note'
     COMMENT_TYPE_TODO = u'todo'
     COMMENT_TYPES = [COMMENT_TYPE_NOTE, COMMENT_TYPE_TODO]
 
     comment_id = Column('comment_id', Integer(), nullable=False, primary_key=True)
     repo_id = Column('repo_id', Integer(), ForeignKey('repositories.repo_id'), nullable=False)
     revision = Column('revision', String(40), nullable=True)
     pull_request_id = Column("pull_request_id", Integer(), ForeignKey('pull_requests.pull_request_id'), nullable=True)
     pull_request_version_id = Column("pull_request_version_id", Integer(), ForeignKey('pull_request_versions.pull_request_version_id'), nullable=True)
     line_no = Column('line_no', Unicode(10), nullable=True)
     hl_lines = Column('hl_lines', Unicode(512), nullable=True)
     f_path = Column('f_path', Unicode(1000), nullable=True)
     user_id = Column('user_id', Integer(), ForeignKey('users.user_id'), nullable=False)
     text = Column('text', UnicodeText().with_variant(UnicodeText(25000), 'mysql'), nullable=False)
     created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
     modified_at = Column('modified_at', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
     renderer = Column('renderer', Unicode(64), nullable=True)
     display_state = Column('display_state',  Unicode(128), nullable=True)
 
     comment_type = Column('comment_type',  Unicode(128), nullable=True, default=COMMENT_TYPE_NOTE)
     resolved_comment_id = Column('resolved_comment_id', Integer(), ForeignKey('changeset_comments.comment_id'), nullable=True)
     resolved_comment = relationship('ChangesetComment', remote_side=comment_id, backref='resolved_by')
     author = relationship('User', lazy='joined')
     repo = relationship('Repository')
     status_change = relationship('ChangesetStatus', cascade="all, delete, delete-orphan", lazy='joined')
     pull_request = relationship('PullRequest', lazy='joined')
     pull_request_version = relationship('PullRequestVersion')
 
     @classmethod
     def get_users(cls, revision=None, pull_request_id=None):
         """
         Returns user associated with this ChangesetComment. ie those
         who actually commented
 
         :param cls:
         :param revision:
         """
         q = Session().query(User)\
                 .join(ChangesetComment.author)
         if revision:
             q = q.filter(cls.revision == revision)
         elif pull_request_id:
             q = q.filter(cls.pull_request_id == pull_request_id)
         return q.all()
 
     @classmethod
     def get_index_from_version(cls, pr_version, versions):
         num_versions = [x.pull_request_version_id for x in versions]
         try:
             return num_versions.index(pr_version) +1
         except (IndexError, ValueError):
             return
 
     @property
     def outdated(self):
         return self.display_state == self.COMMENT_OUTDATED
 
     def outdated_at_version(self, version):
         """
         Checks if comment is outdated for given pull request version
         """
         return self.outdated and self.pull_request_version_id != version
 
     def older_than_version(self, version):
         """
         Checks if comment is made from previous version than given
         """
         if version is None:
             return self.pull_request_version_id is not None
 
         return self.pull_request_version_id < version
 
     @property
     def resolved(self):
         return self.resolved_by[0] if self.resolved_by else None
 
     @property
     def is_todo(self):
         return self.comment_type == self.COMMENT_TYPE_TODO
 
     @property
     def is_inline(self):
         return self.line_no and self.f_path
 
     def get_index_version(self, versions):
         return self.get_index_from_version(
             self.pull_request_version_id, versions)
 
     def __repr__(self):
         if self.comment_id:
             return '<DB:Comment #%s>' % self.comment_id
         else:
             return '<DB:Comment at %#x>' % id(self)
 
+    def get_api_data(self):
+        comment = self
+        data = {
+            'comment_id': comment.comment_id,
+            'comment_type': comment.comment_type,
+            'comment_text': comment.text,
+            'comment_status': comment.status_change,
+            'comment_f_path': comment.f_path,
+            'comment_lineno': comment.line_no,
+            'comment_author': comment.author,
+            'comment_created_on': comment.created_on
+        }
+        return data
+
+    def __json__(self):
+        data = dict()
+        data.update(self.get_api_data())
+        return data
+
 
 class ChangesetStatus(Base, BaseModel):
     __tablename__ = 'changeset_statuses'
     __table_args__ = (
         Index('cs_revision_idx', 'revision'),
         Index('cs_version_idx', 'version'),
         UniqueConstraint('repo_id', 'revision', 'version'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
     STATUS_NOT_REVIEWED = DEFAULT = 'not_reviewed'
     STATUS_APPROVED = 'approved'
     STATUS_REJECTED = 'rejected'
     STATUS_UNDER_REVIEW = 'under_review'
 
     STATUSES = [
         (STATUS_NOT_REVIEWED, _("Not Reviewed")),  # (no icon) and default
         (STATUS_APPROVED, _("Approved")),
         (STATUS_REJECTED, _("Rejected")),
         (STATUS_UNDER_REVIEW, _("Under Review")),
     ]
 
     changeset_status_id = Column('changeset_status_id', Integer(), nullable=False, primary_key=True)
     repo_id = Column('repo_id', Integer(), ForeignKey('repositories.repo_id'), nullable=False)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None)
     revision = Column('revision', String(40), nullable=False)
     status = Column('status', String(128), nullable=False, default=DEFAULT)
     changeset_comment_id = Column('changeset_comment_id', Integer(), ForeignKey('changeset_comments.comment_id'))
     modified_at = Column('modified_at', DateTime(), nullable=False, default=datetime.datetime.now)
     version = Column('version', Integer(), nullable=False, default=0)
     pull_request_id = Column("pull_request_id", Integer(), ForeignKey('pull_requests.pull_request_id'), nullable=True)
 
     author = relationship('User', lazy='joined')
     repo = relationship('Repository')
     comment = relationship('ChangesetComment', lazy='joined')
     pull_request = relationship('PullRequest', lazy='joined')
 
     def __unicode__(self):
         return u"<%s('%s[v%s]:%s')>" % (
             self.__class__.__name__,
             self.status, self.version, self.author
         )
 
     @classmethod
     def get_status_lbl(cls, value):
         return dict(cls.STATUSES).get(value)
 
     @property
     def status_lbl(self):
         return ChangesetStatus.get_status_lbl(self.status)
 
+    def get_api_data(self):
+        status = self
+        data = {
+            'status_id': status.changeset_status_id,
+            'status': status.status,
+        }
+        return data
+
+    def __json__(self):
+        data = dict()
+        data.update(self.get_api_data())
+        return data
+
 
 class _PullRequestBase(BaseModel):
     """
     Common attributes of pull request and version entries.
     """
 
     # .status values
     STATUS_NEW = u'new'
     STATUS_OPEN = u'open'
     STATUS_CLOSED = u'closed'
 
     title = Column('title', Unicode(255), nullable=True)
     description = Column(
         'description', UnicodeText().with_variant(UnicodeText(10240), 'mysql'),
         nullable=True)
     # new/open/closed status of pull request (not approve/reject/etc)
     status = Column('status', Unicode(255), nullable=False, default=STATUS_NEW)
     created_on = Column(
         'created_on', DateTime(timezone=False), nullable=False,
         default=datetime.datetime.now)
     updated_on = Column(
         'updated_on', DateTime(timezone=False), nullable=False,
         default=datetime.datetime.now)
 
     @declared_attr
     def user_id(cls):
         return Column(
             "user_id", Integer(), ForeignKey('users.user_id'), nullable=False,
             unique=None)
 
     # 500 revisions max
     _revisions = Column(
         'revisions', UnicodeText().with_variant(UnicodeText(20500), 'mysql'))
 
     @declared_attr
     def source_repo_id(cls):
         # TODO: dan: rename column to source_repo_id
         return Column(
             'org_repo_id', Integer(), ForeignKey('repositories.repo_id'),
             nullable=False)
 
     source_ref = Column('org_ref', Unicode(255), nullable=False)
 
     @declared_attr
     def target_repo_id(cls):
         # TODO: dan: rename column to target_repo_id
         return Column(
             'other_repo_id', Integer(), ForeignKey('repositories.repo_id'),
             nullable=False)
 
     target_ref = Column('other_ref', Unicode(255), nullable=False)
     _shadow_merge_ref = Column('shadow_merge_ref', Unicode(255), nullable=True)
 
     # TODO: dan: rename column to last_merge_source_rev
     _last_merge_source_rev = Column(
         'last_merge_org_rev', String(40), nullable=True)
     # TODO: dan: rename column to last_merge_target_rev
     _last_merge_target_rev = Column(
         'last_merge_other_rev', String(40), nullable=True)
     _last_merge_status = Column('merge_status', Integer(), nullable=True)
     merge_rev = Column('merge_rev', String(40), nullable=True)
 
     reviewer_data = Column(
         'reviewer_data_json', MutationObj.as_mutable(
             JsonType(dialect_map=dict(mysql=UnicodeText(16384)))))
 
     @property
     def reviewer_data_json(self):
         return json.dumps(self.reviewer_data)
 
     @hybrid_property
     def revisions(self):
         return self._revisions.split(':') if self._revisions else []
 
     @revisions.setter
     def revisions(self, val):
         self._revisions = ':'.join(val)
 
     @declared_attr
     def author(cls):
         return relationship('User', lazy='joined')
 
     @declared_attr
     def source_repo(cls):
         return relationship(
             'Repository',
             primaryjoin='%s.source_repo_id==Repository.repo_id' % cls.__name__)
 
     @property
     def source_ref_parts(self):
         return self.unicode_to_reference(self.source_ref)
 
     @declared_attr
     def target_repo(cls):
         return relationship(
             'Repository',
             primaryjoin='%s.target_repo_id==Repository.repo_id' % cls.__name__)
 
     @property
     def target_ref_parts(self):
         return self.unicode_to_reference(self.target_ref)
 
     @property
     def shadow_merge_ref(self):
         return self.unicode_to_reference(self._shadow_merge_ref)
 
     @shadow_merge_ref.setter
     def shadow_merge_ref(self, ref):
         self._shadow_merge_ref = self.reference_to_unicode(ref)
 
     def unicode_to_reference(self, raw):
         """
         Convert a unicode (or string) to a reference object.
         If unicode evaluates to False it returns None.
         """
         if raw:
             refs = raw.split(':')
             return Reference(*refs)
         else:
             return None
 
     def reference_to_unicode(self, ref):
         """
         Convert a reference object to unicode.
         If reference is None it returns None.
         """
         if ref:
             return u':'.join(ref)
         else:
             return None
 
-    def get_api_data(self):
-        from pylons import url
+    def get_api_data(self, with_merge_state=True):
         from rhodecode.model.pull_request import PullRequestModel
+
         pull_request = self
-        merge_status = PullRequestModel().merge_status(pull_request)
-
-        pull_request_url = url(
-            'pullrequest_show', repo_name=self.target_repo.repo_name,
-            pull_request_id=self.pull_request_id, qualified=True)
+        if with_merge_state:
+            merge_status = PullRequestModel().merge_status(pull_request)
+            merge_state = {
+                'status': merge_status[0],
+                'message': safe_unicode(merge_status[1]),
+            }
+        else:
+            merge_state = {'status': 'not_available',
+                           'message': 'not_available'}
 
         merge_data = {
             'clone_url': PullRequestModel().get_shadow_clone_url(pull_request),
             'reference': (
                 pull_request.shadow_merge_ref._asdict()
                 if pull_request.shadow_merge_ref else None),
         }
 
         data = {
             'pull_request_id': pull_request.pull_request_id,
-            'url': pull_request_url,
+            'url': PullRequestModel().get_url(pull_request),
             'title': pull_request.title,
             'description': pull_request.description,
             'status': pull_request.status,
             'created_on': pull_request.created_on,
             'updated_on': pull_request.updated_on,
             'commit_ids': pull_request.revisions,
             'review_status': pull_request.calculated_review_status(),
-            'mergeable': {
-                'status': merge_status[0],
-                'message': unicode(merge_status[1]),
-            },
+            'mergeable': merge_state,
             'source': {
                 'clone_url': pull_request.source_repo.clone_url(),
                 'repository': pull_request.source_repo.repo_name,
                 'reference': {
                     'name': pull_request.source_ref_parts.name,
                     'type': pull_request.source_ref_parts.type,
                     'commit_id': pull_request.source_ref_parts.commit_id,
                 },
             },
             'target': {
                 'clone_url': pull_request.target_repo.clone_url(),
                 'repository': pull_request.target_repo.repo_name,
                 'reference': {
                     'name': pull_request.target_ref_parts.name,
                     'type': pull_request.target_ref_parts.type,
                     'commit_id': pull_request.target_ref_parts.commit_id,
                 },
             },
             'merge': merge_data,
             'author': pull_request.author.get_api_data(include_secrets=False,
                                                        details='basic'),
             'reviewers': [
                 {
                     'user': reviewer.get_api_data(include_secrets=False,
                                                   details='basic'),
                     'reasons': reasons,
                     'review_status': st[0][1].status if st else 'not_reviewed',
                 }
                 for reviewer, reasons, mandatory, st in
                 pull_request.reviewers_statuses()
             ]
         }
 
         return data
 
 
 class PullRequest(Base, _PullRequestBase):
     __tablename__ = 'pull_requests'
     __table_args__ = (
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
     )
 
     pull_request_id = Column(
         'pull_request_id', Integer(), nullable=False, primary_key=True)
 
     def __repr__(self):
         if self.pull_request_id:
             return '<DB:PullRequest #%s>' % self.pull_request_id
         else:
             return '<DB:PullRequest at %#x>' % id(self)
 
     reviewers = relationship('PullRequestReviewers',
                              cascade="all, delete, delete-orphan")
-    statuses = relationship('ChangesetStatus')
+    statuses = relationship('ChangesetStatus',
+                            cascade="all, delete, delete-orphan")
     comments = relationship('ChangesetComment',
                             cascade="all, delete, delete-orphan")
     versions = relationship('PullRequestVersion',
                             cascade="all, delete, delete-orphan",
                             lazy='dynamic')
 
     @classmethod
     def get_pr_display_object(cls, pull_request_obj, org_pull_request_obj,
                               internal_methods=None):
 
         class PullRequestDisplay(object):
             """
             Special object wrapper for showing PullRequest data via Versions
             It mimics PR object as close as possible. This is read only object
             just for display
             """
 
             def __init__(self, attrs, internal=None):
                 self.attrs = attrs
                 # internal have priority over the given ones via attrs
                 self.internal = internal or ['versions']
 
             def __getattr__(self, item):
                 if item in self.internal:
                     return getattr(self, item)
                 try:
                     return self.attrs[item]
                 except KeyError:
                     raise AttributeError(
                         '%s object has no attribute %s' % (self, item))
 
             def __repr__(self):
                 return '<DB:PullRequestDisplay #%s>' % self.attrs.get('pull_request_id')
 
             def versions(self):
                 return pull_request_obj.versions.order_by(
                     PullRequestVersion.pull_request_version_id).all()
 
             def is_closed(self):
                 return pull_request_obj.is_closed()
 
             @property
             def pull_request_version_id(self):
                 return getattr(pull_request_obj, 'pull_request_version_id', None)
 
         attrs = StrictAttributeDict(pull_request_obj.get_api_data())
 
         attrs.author = StrictAttributeDict(
             pull_request_obj.author.get_api_data())
         if pull_request_obj.target_repo:
             attrs.target_repo = StrictAttributeDict(
                 pull_request_obj.target_repo.get_api_data())
             attrs.target_repo.clone_url = pull_request_obj.target_repo.clone_url
 
         if pull_request_obj.source_repo:
             attrs.source_repo = StrictAttributeDict(
                 pull_request_obj.source_repo.get_api_data())
             attrs.source_repo.clone_url = pull_request_obj.source_repo.clone_url
 
         attrs.source_ref_parts = pull_request_obj.source_ref_parts
         attrs.target_ref_parts = pull_request_obj.target_ref_parts
         attrs.revisions = pull_request_obj.revisions
 
         attrs.shadow_merge_ref = org_pull_request_obj.shadow_merge_ref
         attrs.reviewer_data = org_pull_request_obj.reviewer_data
         attrs.reviewer_data_json = org_pull_request_obj.reviewer_data_json
 
         return PullRequestDisplay(attrs, internal=internal_methods)
 
     def is_closed(self):
         return self.status == self.STATUS_CLOSED
 
     def __json__(self):
         return {
             'revisions': self.revisions,
         }
 
     def calculated_review_status(self):
         from rhodecode.model.changeset_status import ChangesetStatusModel
         return ChangesetStatusModel().calculated_review_status(self)
 
     def reviewers_statuses(self):
         from rhodecode.model.changeset_status import ChangesetStatusModel
         return ChangesetStatusModel().reviewers_statuses(self)
 
     @property
     def workspace_id(self):
         from rhodecode.model.pull_request import PullRequestModel
         return PullRequestModel()._workspace_id(self)
 
     def get_shadow_repo(self):
         workspace_id = self.workspace_id
         vcs_obj = self.target_repo.scm_instance()
         shadow_repository_path = vcs_obj._get_shadow_repository_path(
             workspace_id)
         return vcs_obj._get_shadow_instance(shadow_repository_path)
 
 
 class PullRequestVersion(Base, _PullRequestBase):
     __tablename__ = 'pull_request_versions'
     __table_args__ = (
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
     )
 
     pull_request_version_id = Column(
         'pull_request_version_id', Integer(), nullable=False, primary_key=True)
     pull_request_id = Column(
         'pull_request_id', Integer(),
         ForeignKey('pull_requests.pull_request_id'), nullable=False)
     pull_request = relationship('PullRequest')
 
     def __repr__(self):
         if self.pull_request_version_id:
             return '<DB:PullRequestVersion #%s>' % self.pull_request_version_id
         else:
             return '<DB:PullRequestVersion at %#x>' % id(self)
 
     @property
     def reviewers(self):
         return self.pull_request.reviewers
 
     @property
     def versions(self):
         return self.pull_request.versions
 
     def is_closed(self):
         # calculate from original
         return self.pull_request.status == self.STATUS_CLOSED
 
     def calculated_review_status(self):
         return self.pull_request.calculated_review_status()
 
     def reviewers_statuses(self):
         return self.pull_request.reviewers_statuses()
 
 
 class PullRequestReviewers(Base, BaseModel):
     __tablename__ = 'pull_request_reviewers'
     __table_args__ = (
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
     )
 
     @hybrid_property
     def reasons(self):
         if not self._reasons:
             return []
         return self._reasons
 
     @reasons.setter
     def reasons(self, val):
         val = val or []
         if any(not isinstance(x, basestring) for x in val):
             raise Exception('invalid reasons type, must be list of strings')
         self._reasons = val
 
     pull_requests_reviewers_id = Column(
         'pull_requests_reviewers_id', Integer(), nullable=False,
         primary_key=True)
     pull_request_id = Column(
         "pull_request_id", Integer(),
         ForeignKey('pull_requests.pull_request_id'), nullable=False)
     user_id = Column(
         "user_id", Integer(), ForeignKey('users.user_id'), nullable=True)
     _reasons = Column(
         'reason', MutationList.as_mutable(
             JsonType('list', dialect_map=dict(mysql=UnicodeText(16384)))))
     mandatory = Column("mandatory", Boolean(), nullable=False, default=False)
     user = relationship('User')
     pull_request = relationship('PullRequest')
 
 
 class Notification(Base, BaseModel):
     __tablename__ = 'notifications'
     __table_args__ = (
         Index('notification_type_idx', 'type'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
     )
 
     TYPE_CHANGESET_COMMENT = u'cs_comment'
     TYPE_MESSAGE = u'message'
     TYPE_MENTION = u'mention'
     TYPE_REGISTRATION = u'registration'
     TYPE_PULL_REQUEST = u'pull_request'
     TYPE_PULL_REQUEST_COMMENT = u'pull_request_comment'
 
     notification_id = Column('notification_id', Integer(), nullable=False, primary_key=True)
     subject = Column('subject', Unicode(512), nullable=True)
     body = Column('body', UnicodeText().with_variant(UnicodeText(50000), 'mysql'), nullable=True)
     created_by = Column("created_by", Integer(), ForeignKey('users.user_id'), nullable=True)
     created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
     type_ = Column('type', Unicode(255))
 
     created_by_user = relationship('User')
     notifications_to_users = relationship('UserNotification', lazy='joined',
                                           cascade="all, delete, delete-orphan")
 
     @property
     def recipients(self):
         return [x.user for x in UserNotification.query()\
                 .filter(UserNotification.notification == self)\
                 .order_by(UserNotification.user_id.asc()).all()]
 
     @classmethod
     def create(cls, created_by, subject, body, recipients, type_=None):
         if type_ is None:
             type_ = Notification.TYPE_MESSAGE
 
         notification = cls()
         notification.created_by_user = created_by
         notification.subject = subject
         notification.body = body
         notification.type_ = type_
         notification.created_on = datetime.datetime.now()
 
         for u in recipients:
             assoc = UserNotification()
             assoc.notification = notification
 
             # if created_by is inside recipients mark his notification
             # as read
             if u.user_id == created_by.user_id:
                 assoc.read = True
 
             u.notifications.append(assoc)
         Session().add(notification)
 
         return notification
 
     @property
     def description(self):
         from rhodecode.model.notification import NotificationModel
         return NotificationModel().make_description(self)
 
 
 class UserNotification(Base, BaseModel):
     __tablename__ = 'user_to_notification'
     __table_args__ = (
         UniqueConstraint('user_id', 'notification_id'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
     user_id = Column('user_id', Integer(), ForeignKey('users.user_id'), primary_key=True)
     notification_id = Column("notification_id", Integer(), ForeignKey('notifications.notification_id'), primary_key=True)
     read = Column('read', Boolean, default=False)
     sent_on = Column('sent_on', DateTime(timezone=False), nullable=True, unique=None)
 
     user = relationship('User', lazy="joined")
     notification = relationship('Notification', lazy="joined",
                                 order_by=lambda: Notification.created_on.desc(),)
 
     def mark_as_read(self):
         self.read = True
         Session().add(self)
 
 
 class Gist(Base, BaseModel):
     __tablename__ = 'gists'
     __table_args__ = (
         Index('g_gist_access_id_idx', 'gist_access_id'),
         Index('g_created_on_idx', 'created_on'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
     GIST_PUBLIC = u'public'
     GIST_PRIVATE = u'private'
     DEFAULT_FILENAME = u'gistfile1.txt'
 
     ACL_LEVEL_PUBLIC = u'acl_public'
     ACL_LEVEL_PRIVATE = u'acl_private'
 
     gist_id = Column('gist_id', Integer(), primary_key=True)
     gist_access_id = Column('gist_access_id', Unicode(250))
     gist_description = Column('gist_description', UnicodeText().with_variant(UnicodeText(1024), 'mysql'))
     gist_owner = Column('user_id', Integer(), ForeignKey('users.user_id'), nullable=True)
     gist_expires = Column('gist_expires', Float(53), nullable=False)
     gist_type = Column('gist_type', Unicode(128), nullable=False)
     created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
     modified_at = Column('modified_at', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)
     acl_level = Column('acl_level', Unicode(128), nullable=True)
 
     owner = relationship('User')
 
     def __repr__(self):
         return '<Gist:[%s]%s>' % (self.gist_type, self.gist_access_id)
 
     @classmethod
     def get_or_404(cls, id_, pyramid_exc=False):
 
         if pyramid_exc:
             from pyramid.httpexceptions import HTTPNotFound
         else:
             from webob.exc import HTTPNotFound
 
         res = cls.query().filter(cls.gist_access_id == id_).scalar()
         if not res:
             raise HTTPNotFound
         return res
 
     @classmethod
     def get_by_access_id(cls, gist_access_id):
         return cls.query().filter(cls.gist_access_id == gist_access_id).scalar()
 
     def gist_url(self):
         import rhodecode
         from pylons import url
 
         alias_url = rhodecode.CONFIG.get('gist_alias_url')
         if alias_url:
             return alias_url.replace('{gistid}', self.gist_access_id)
 
         return url('gist', gist_id=self.gist_access_id, qualified=True)
 
     @classmethod
     def base_path(cls):
         """
         Returns base path when all gists are stored
 
         :param cls:
         """
         from rhodecode.model.gist import GIST_STORE_LOC
         q = Session().query(RhodeCodeUi)\
             .filter(RhodeCodeUi.ui_key == URL_SEP)
         q = q.options(FromCache("sql_cache_short", "repository_repo_path"))
         return os.path.join(q.one().ui_value, GIST_STORE_LOC)
 
     def get_api_data(self):
         """
         Common function for generating gist related data for API
         """
         gist = self
         data = {
             'gist_id': gist.gist_id,
             'type': gist.gist_type,
             'access_id': gist.gist_access_id,
             'description': gist.gist_description,
             'url': gist.gist_url(),
             'expires': gist.gist_expires,
             'created_on': gist.created_on,
             'modified_at': gist.modified_at,
             'content': None,
             'acl_level': gist.acl_level,
         }
         return data
 
     def __json__(self):
         data = dict(
         )
         data.update(self.get_api_data())
         return data
     # SCM functions
 
     def scm_instance(self, **kwargs):
         full_repo_path = os.path.join(self.base_path(), self.gist_access_id)
         return get_vcs_instance(
             repo_path=safe_str(full_repo_path), create=False)
 
 
 class ExternalIdentity(Base, BaseModel):
     __tablename__ = 'external_identities'
     __table_args__ = (
         Index('local_user_id_idx', 'local_user_id'),
         Index('external_id_idx', 'external_id'),
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8'})
 
     external_id = Column('external_id', Unicode(255), default=u'',
                          primary_key=True)
     external_username = Column('external_username', Unicode(1024), default=u'')
     local_user_id = Column('local_user_id', Integer(),
                            ForeignKey('users.user_id'), primary_key=True)
     provider_name = Column('provider_name', Unicode(255), default=u'',
                            primary_key=True)
     access_token = Column('access_token', String(1024), default=u'')
     alt_token = Column('alt_token', String(1024), default=u'')
     token_secret = Column('token_secret', String(1024), default=u'')
 
     @classmethod
     def by_external_id_and_provider(cls, external_id, provider_name,
                                     local_user_id=None):
         """
         Returns ExternalIdentity instance based on search params
 
         :param external_id:
         :param provider_name:
         :return: ExternalIdentity
         """
         query = cls.query()
         query = query.filter(cls.external_id == external_id)
         query = query.filter(cls.provider_name == provider_name)
         if local_user_id:
             query = query.filter(cls.local_user_id == local_user_id)
         return query.first()
 
     @classmethod
     def user_by_external_id_and_provider(cls, external_id, provider_name):
         """
         Returns User instance based on search params
 
         :param external_id:
         :param provider_name:
         :return: User
         """
         query = User.query()
         query = query.filter(cls.external_id == external_id)
         query = query.filter(cls.provider_name == provider_name)
         query = query.filter(User.user_id == cls.local_user_id)
         return query.first()
 
     @classmethod
     def by_local_user_id(cls, local_user_id):
         """
         Returns all tokens for user
 
         :param local_user_id:
         :return: ExternalIdentity
         """
         query = cls.query()
         query = query.filter(cls.local_user_id == local_user_id)
         return query
 
 
 class Integration(Base, BaseModel):
     __tablename__ = 'integrations'
     __table_args__ = (
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True}
     )
 
     integration_id = Column('integration_id', Integer(), primary_key=True)
     integration_type = Column('integration_type', String(255))
     enabled = Column('enabled', Boolean(), nullable=False)
     name = Column('name', String(255), nullable=False)
     child_repos_only = Column('child_repos_only', Boolean(), nullable=False,
         default=False)
 
     settings = Column(
         'settings_json', MutationObj.as_mutable(
             JsonType(dialect_map=dict(mysql=UnicodeText(16384)))))
     repo_id = Column(
         'repo_id', Integer(), ForeignKey('repositories.repo_id'),
         nullable=True, unique=None, default=None)
     repo = relationship('Repository', lazy='joined')
 
     repo_group_id = Column(
         'repo_group_id', Integer(), ForeignKey('groups.group_id'),
         nullable=True, unique=None, default=None)
     repo_group = relationship('RepoGroup', lazy='joined')
 
     @property
     def scope(self):
         if self.repo:
             return repr(self.repo)
         if self.repo_group:
             if self.child_repos_only:
                 return repr(self.repo_group) + ' (child repos only)'
             else:
                 return repr(self.repo_group) + ' (recursive)'
         if self.child_repos_only:
             return 'root_repos'
         return 'global'
 
     def __repr__(self):
         return '<Integration(%r, %r)>' % (self.integration_type, self.scope)
 
 
 class RepoReviewRuleUser(Base, BaseModel):
     __tablename__ = 'repo_review_rules_users'
     __table_args__ = (
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True,}
     )
     repo_review_rule_user_id = Column('repo_review_rule_user_id', Integer(), primary_key=True)
     repo_review_rule_id = Column("repo_review_rule_id", Integer(), ForeignKey('repo_review_rules.repo_review_rule_id'))
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False)
     mandatory = Column("mandatory", Boolean(), nullable=False, default=False)
     user = relationship('User')
 
     def rule_data(self):
         return {
             'mandatory': self.mandatory
         }
 
 
 class RepoReviewRuleUserGroup(Base, BaseModel):
     __tablename__ = 'repo_review_rules_users_groups'
     __table_args__ = (
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True,}
     )
     repo_review_rule_users_group_id = Column('repo_review_rule_users_group_id', Integer(), primary_key=True)
     repo_review_rule_id = Column("repo_review_rule_id", Integer(), ForeignKey('repo_review_rules.repo_review_rule_id'))
     users_group_id = Column("users_group_id", Integer(),ForeignKey('users_groups.users_group_id'), nullable=False)
     mandatory = Column("mandatory", Boolean(), nullable=False, default=False)
     users_group = relationship('UserGroup')
 
     def rule_data(self):
         return {
             'mandatory': self.mandatory
         }
 
 
 class RepoReviewRule(Base, BaseModel):
     __tablename__ = 'repo_review_rules'
     __table_args__ = (
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True,}
     )
 
     repo_review_rule_id = Column(
         'repo_review_rule_id', Integer(), primary_key=True)
     repo_id = Column(
         "repo_id", Integer(), ForeignKey('repositories.repo_id'))
     repo = relationship('Repository', backref='review_rules')
 
     _branch_pattern = Column("branch_pattern", UnicodeText().with_variant(UnicodeText(255), 'mysql'), default=u'*')  # glob
     _file_pattern = Column("file_pattern", UnicodeText().with_variant(UnicodeText(255), 'mysql'), default=u'*')  # glob
 
     use_authors_for_review = Column("use_authors_for_review", Boolean(), nullable=False, default=False)
     forbid_author_to_review = Column("forbid_author_to_review", Boolean(), nullable=False, default=False)
     forbid_commit_author_to_review = Column("forbid_commit_author_to_review", Boolean(), nullable=False, default=False)
     forbid_adding_reviewers = Column("forbid_adding_reviewers", Boolean(), nullable=False, default=False)
 
     rule_users = relationship('RepoReviewRuleUser')
     rule_user_groups = relationship('RepoReviewRuleUserGroup')
 
     @hybrid_property
     def branch_pattern(self):
         return self._branch_pattern or '*'
 
     def _validate_glob(self, value):
         re.compile('^' + glob2re(value) + '$')
 
     @branch_pattern.setter
     def branch_pattern(self, value):
         self._validate_glob(value)
         self._branch_pattern = value or '*'
 
     @hybrid_property
     def file_pattern(self):
         return self._file_pattern or '*'
 
     @file_pattern.setter
     def file_pattern(self, value):
         self._validate_glob(value)
         self._file_pattern = value or '*'
 
     def matches(self, branch, files_changed):
         """
         Check if this review rule matches a branch/files in a pull request
 
         :param branch: branch name for the commit
         :param files_changed: list of file paths changed in the pull request
         """
 
         branch = branch or ''
         files_changed = files_changed or []
 
         branch_matches = True
         if branch:
             branch_regex = re.compile('^' + glob2re(self.branch_pattern) + '$')
             branch_matches = bool(branch_regex.search(branch))
 
         files_matches = True
         if self.file_pattern != '*':
             files_matches = False
             file_regex = re.compile(glob2re(self.file_pattern))
             for filename in files_changed:
                 if file_regex.search(filename):
                     files_matches = True
                     break
 
         return branch_matches and files_matches
 
     @property
     def review_users(self):
         """ Returns the users which this rule applies to """
 
         users = collections.OrderedDict()
 
         for rule_user in self.rule_users:
             if rule_user.user.active:
                 if rule_user.user not in users:
                     users[rule_user.user.username] = {
                         'user': rule_user.user,
                         'source': 'user',
                         'source_data': {},
                         'data': rule_user.rule_data()
                     }
 
         for rule_user_group in self.rule_user_groups:
             source_data = {
                 'name': rule_user_group.users_group.users_group_name,
                 'members': len(rule_user_group.users_group.members)
             }
             for member in rule_user_group.users_group.members:
                 if member.user.active:
                     users[member.user.username] = {
                         'user': member.user,
                         'source': 'user_group',
                         'source_data': source_data,
                         'data': rule_user_group.rule_data()
                     }
 
         return users
 
     def __repr__(self):
         return '<RepoReviewerRule(id=%r, repo=%r)>' % (
             self.repo_review_rule_id, self.repo)
 
 
 class DbMigrateVersion(Base, BaseModel):
     __tablename__ = 'db_migrate_version'
     __table_args__ = (
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
     )
     repository_id = Column('repository_id', String(250), primary_key=True)
     repository_path = Column('repository_path', Text)
     version = Column('version', Integer)
 
 
 class DbSession(Base, BaseModel):
     __tablename__ = 'db_session'
     __table_args__ = (
         {'extend_existing': True, 'mysql_engine': 'InnoDB',
          'mysql_charset': 'utf8', 'sqlite_autoincrement': True},
     )
 
     def __repr__(self):
         return '<DB:DbSession({})>'.format(self.id)
 
     id = Column('id', Integer())
     namespace = Column('namespace', String(255), primary_key=True)
     accessed = Column('accessed', DateTime, nullable=False)
     created = Column('created', DateTime, nullable=False)
     data = Column('data', PickleType, nullable=False)

rhodecode/model/pull_request.py

@@ -1,1528 +1,1554 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2012-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 
 """
 pull request model for RhodeCode
 """
 
 from collections import namedtuple
 import json
 import logging
 import datetime
 import urllib
 
 from pylons.i18n.translation import _
 from pylons.i18n.translation import lazy_ugettext
 from pyramid.threadlocal import get_current_request
 from sqlalchemy import or_
 
 from rhodecode import events
 from rhodecode.lib import helpers as h, hooks_utils, diffs
+from rhodecode.lib import audit_logger
 from rhodecode.lib.compat import OrderedDict
 from rhodecode.lib.hooks_daemon import prepare_callback_daemon
 from rhodecode.lib.markup_renderer import (
     DEFAULT_COMMENTS_RENDERER, RstTemplateRenderer)
-from rhodecode.lib.utils import action_logger
 from rhodecode.lib.utils2 import safe_unicode, safe_str, md5_safe
 from rhodecode.lib.vcs.backends.base import (
     Reference, MergeResponse, MergeFailureReason, UpdateFailureReason)
 from rhodecode.lib.vcs.conf import settings as vcs_settings
 from rhodecode.lib.vcs.exceptions import (
     CommitDoesNotExistError, EmptyRepositoryError)
 from rhodecode.model import BaseModel
 from rhodecode.model.changeset_status import ChangesetStatusModel
 from rhodecode.model.comment import CommentsModel
 from rhodecode.model.db import (
     PullRequest, PullRequestReviewers, ChangesetStatus,
     PullRequestVersion, ChangesetComment, Repository)
 from rhodecode.model.meta import Session
 from rhodecode.model.notification import NotificationModel, \
     EmailNotificationModel
 from rhodecode.model.scm import ScmModel
 from rhodecode.model.settings import VcsSettingsModel
 
 
 log = logging.getLogger(__name__)
 
 
 # Data structure to hold the response data when updating commits during a pull
 # request update.
 UpdateResponse = namedtuple('UpdateResponse', [
     'executed', 'reason', 'new', 'old', 'changes',
     'source_changed', 'target_changed'])
 
 
 class PullRequestModel(BaseModel):
 
     cls = PullRequest
 
     DIFF_CONTEXT = 3
 
     MERGE_STATUS_MESSAGES = {
         MergeFailureReason.NONE: lazy_ugettext(
             'This pull request can be automatically merged.'),
         MergeFailureReason.UNKNOWN: lazy_ugettext(
             'This pull request cannot be merged because of an unhandled'
             ' exception.'),
         MergeFailureReason.MERGE_FAILED: lazy_ugettext(
             'This pull request cannot be merged because of merge conflicts.'),
         MergeFailureReason.PUSH_FAILED: lazy_ugettext(
             'This pull request could not be merged because push to target'
             ' failed.'),
         MergeFailureReason.TARGET_IS_NOT_HEAD: lazy_ugettext(
             'This pull request cannot be merged because the target is not a'
             ' head.'),
         MergeFailureReason.HG_SOURCE_HAS_MORE_BRANCHES: lazy_ugettext(
             'This pull request cannot be merged because the source contains'
             ' more branches than the target.'),
         MergeFailureReason.HG_TARGET_HAS_MULTIPLE_HEADS: lazy_ugettext(
             'This pull request cannot be merged because the target has'
             ' multiple heads.'),
         MergeFailureReason.TARGET_IS_LOCKED: lazy_ugettext(
             'This pull request cannot be merged because the target repository'
             ' is locked.'),
         MergeFailureReason._DEPRECATED_MISSING_COMMIT: lazy_ugettext(
             'This pull request cannot be merged because the target or the '
             'source reference is missing.'),
         MergeFailureReason.MISSING_TARGET_REF: lazy_ugettext(
             'This pull request cannot be merged because the target '
             'reference is missing.'),
         MergeFailureReason.MISSING_SOURCE_REF: lazy_ugettext(
             'This pull request cannot be merged because the source '
             'reference is missing.'),
         MergeFailureReason.SUBREPO_MERGE_FAILED: lazy_ugettext(
             'This pull request cannot be merged because of conflicts related '
             'to sub repositories.'),
     }
 
     UPDATE_STATUS_MESSAGES = {
         UpdateFailureReason.NONE: lazy_ugettext(
             'Pull request update successful.'),
         UpdateFailureReason.UNKNOWN: lazy_ugettext(
             'Pull request update failed because of an unknown error.'),
         UpdateFailureReason.NO_CHANGE: lazy_ugettext(
             'No update needed because the source and target have not changed.'),
         UpdateFailureReason.WRONG_REF_TYPE: lazy_ugettext(
             'Pull request cannot be updated because the reference type is '
             'not supported for an update. Only Branch, Tag or Bookmark is allowed.'),
         UpdateFailureReason.MISSING_TARGET_REF: lazy_ugettext(
             'This pull request cannot be updated because the target '
             'reference is missing.'),
         UpdateFailureReason.MISSING_SOURCE_REF: lazy_ugettext(
             'This pull request cannot be updated because the source '
             'reference is missing.'),
     }
 
     def __get_pull_request(self, pull_request):
         return self._get_instance((
             PullRequest, PullRequestVersion), pull_request)
 
     def _check_perms(self, perms, pull_request, user, api=False):
         if not api:
             return h.HasRepoPermissionAny(*perms)(
                 user=user, repo_name=pull_request.target_repo.repo_name)
         else:
             return h.HasRepoPermissionAnyApi(*perms)(
                 user=user, repo_name=pull_request.target_repo.repo_name)
 
     def check_user_read(self, pull_request, user, api=False):
         _perms = ('repository.admin', 'repository.write', 'repository.read',)
         return self._check_perms(_perms, pull_request, user, api)
 
     def check_user_merge(self, pull_request, user, api=False):
         _perms = ('repository.admin', 'repository.write', 'hg.admin',)
         return self._check_perms(_perms, pull_request, user, api)
 
     def check_user_update(self, pull_request, user, api=False):
         owner = user.user_id == pull_request.user_id
         return self.check_user_merge(pull_request, user, api) or owner
 
     def check_user_delete(self, pull_request, user):
         owner = user.user_id == pull_request.user_id
         _perms = ('repository.admin',)
         return self._check_perms(_perms, pull_request, user) or owner
 
     def check_user_change_status(self, pull_request, user, api=False):
         reviewer = user.user_id in [x.user_id for x in
                                     pull_request.reviewers]
         return self.check_user_update(pull_request, user, api) or reviewer
 
     def get(self, pull_request):
         return self.__get_pull_request(pull_request)
 
     def _prepare_get_all_query(self, repo_name, source=False, statuses=None,
                                opened_by=None, order_by=None,
                                order_dir='desc'):
         repo = None
         if repo_name:
             repo = self._get_repo(repo_name)
 
         q = PullRequest.query()
 
         # source or target
         if repo and source:
             q = q.filter(PullRequest.source_repo == repo)
         elif repo:
             q = q.filter(PullRequest.target_repo == repo)
 
         # closed,opened
         if statuses:
             q = q.filter(PullRequest.status.in_(statuses))
 
         # opened by filter
         if opened_by:
             q = q.filter(PullRequest.user_id.in_(opened_by))
 
         if order_by:
             order_map = {
                 'name_raw': PullRequest.pull_request_id,
                 'title': PullRequest.title,
                 'updated_on_raw': PullRequest.updated_on,
                 'target_repo': PullRequest.target_repo_id
             }
             if order_dir == 'asc':
                 q = q.order_by(order_map[order_by].asc())
             else:
                 q = q.order_by(order_map[order_by].desc())
 
         return q
 
     def count_all(self, repo_name, source=False, statuses=None,
                   opened_by=None):
         """
         Count the number of pull requests for a specific repository.
 
         :param repo_name: target or source repo
         :param source: boolean flag to specify if repo_name refers to source
         :param statuses: list of pull request statuses
         :param opened_by: author user of the pull request
         :returns: int number of pull requests
         """
         q = self._prepare_get_all_query(
             repo_name, source=source, statuses=statuses, opened_by=opened_by)
 
         return q.count()
 
     def get_all(self, repo_name, source=False, statuses=None, opened_by=None,
                 offset=0, length=None, order_by=None, order_dir='desc'):
         """
         Get all pull requests for a specific repository.
 
         :param repo_name: target or source repo
         :param source: boolean flag to specify if repo_name refers to source
         :param statuses: list of pull request statuses
         :param opened_by: author user of the pull request
         :param offset: pagination offset
         :param length: length of returned list
         :param order_by: order of the returned list
         :param order_dir: 'asc' or 'desc' ordering direction
         :returns: list of pull requests
         """
         q = self._prepare_get_all_query(
             repo_name, source=source, statuses=statuses, opened_by=opened_by,
             order_by=order_by, order_dir=order_dir)
 
         if length:
             pull_requests = q.limit(length).offset(offset).all()
         else:
             pull_requests = q.all()
 
         return pull_requests
 
     def count_awaiting_review(self, repo_name, source=False, statuses=None,
                               opened_by=None):
         """
         Count the number of pull requests for a specific repository that are
         awaiting review.
 
         :param repo_name: target or source repo
         :param source: boolean flag to specify if repo_name refers to source
         :param statuses: list of pull request statuses
         :param opened_by: author user of the pull request
         :returns: int number of pull requests
         """
         pull_requests = self.get_awaiting_review(
             repo_name, source=source, statuses=statuses, opened_by=opened_by)
 
         return len(pull_requests)
 
     def get_awaiting_review(self, repo_name, source=False, statuses=None,
                             opened_by=None, offset=0, length=None,
                             order_by=None, order_dir='desc'):
         """
         Get all pull requests for a specific repository that are awaiting
         review.
 
         :param repo_name: target or source repo
         :param source: boolean flag to specify if repo_name refers to source
         :param statuses: list of pull request statuses
         :param opened_by: author user of the pull request
         :param offset: pagination offset
         :param length: length of returned list
         :param order_by: order of the returned list
         :param order_dir: 'asc' or 'desc' ordering direction
         :returns: list of pull requests
         """
         pull_requests = self.get_all(
             repo_name, source=source, statuses=statuses, opened_by=opened_by,
             order_by=order_by, order_dir=order_dir)
 
         _filtered_pull_requests = []
         for pr in pull_requests:
             status = pr.calculated_review_status()
             if status in [ChangesetStatus.STATUS_NOT_REVIEWED,
                           ChangesetStatus.STATUS_UNDER_REVIEW]:
                 _filtered_pull_requests.append(pr)
         if length:
             return _filtered_pull_requests[offset:offset+length]
         else:
             return _filtered_pull_requests
 
     def count_awaiting_my_review(self, repo_name, source=False, statuses=None,
                                  opened_by=None, user_id=None):
         """
         Count the number of pull requests for a specific repository that are
         awaiting review from a specific user.
 
         :param repo_name: target or source repo
         :param source: boolean flag to specify if repo_name refers to source
         :param statuses: list of pull request statuses
         :param opened_by: author user of the pull request
         :param user_id: reviewer user of the pull request
         :returns: int number of pull requests
         """
         pull_requests = self.get_awaiting_my_review(
             repo_name, source=source, statuses=statuses, opened_by=opened_by,
             user_id=user_id)
 
         return len(pull_requests)
 
     def get_awaiting_my_review(self, repo_name, source=False, statuses=None,
                                opened_by=None, user_id=None, offset=0,
                                length=None, order_by=None, order_dir='desc'):
         """
         Get all pull requests for a specific repository that are awaiting
         review from a specific user.
 
         :param repo_name: target or source repo
         :param source: boolean flag to specify if repo_name refers to source
         :param statuses: list of pull request statuses
         :param opened_by: author user of the pull request
         :param user_id: reviewer user of the pull request
         :param offset: pagination offset
         :param length: length of returned list
         :param order_by: order of the returned list
         :param order_dir: 'asc' or 'desc' ordering direction
         :returns: list of pull requests
         """
         pull_requests = self.get_all(
             repo_name, source=source, statuses=statuses, opened_by=opened_by,
             order_by=order_by, order_dir=order_dir)
 
         _my = PullRequestModel().get_not_reviewed(user_id)
         my_participation = []
         for pr in pull_requests:
             if pr in _my:
                 my_participation.append(pr)
         _filtered_pull_requests = my_participation
         if length:
             return _filtered_pull_requests[offset:offset+length]
         else:
             return _filtered_pull_requests
 
     def get_not_reviewed(self, user_id):
         return [
             x.pull_request for x in PullRequestReviewers.query().filter(
                 PullRequestReviewers.user_id == user_id).all()
         ]
 
     def _prepare_participating_query(self, user_id=None, statuses=None,
                                      order_by=None, order_dir='desc'):
         q = PullRequest.query()
         if user_id:
             reviewers_subquery = Session().query(
                 PullRequestReviewers.pull_request_id).filter(
                 PullRequestReviewers.user_id == user_id).subquery()
             user_filter= or_(
                 PullRequest.user_id == user_id,
                 PullRequest.pull_request_id.in_(reviewers_subquery)
             )
             q = PullRequest.query().filter(user_filter)
 
         # closed,opened
         if statuses:
             q = q.filter(PullRequest.status.in_(statuses))
 
         if order_by:
             order_map = {
                 'name_raw': PullRequest.pull_request_id,
                 'title': PullRequest.title,
                 'updated_on_raw': PullRequest.updated_on,
                 'target_repo': PullRequest.target_repo_id
             }
             if order_dir == 'asc':
                 q = q.order_by(order_map[order_by].asc())
             else:
                 q = q.order_by(order_map[order_by].desc())
 
         return q
 
     def count_im_participating_in(self, user_id=None, statuses=None):
         q = self._prepare_participating_query(user_id, statuses=statuses)
         return q.count()
 
     def get_im_participating_in(
             self, user_id=None, statuses=None, offset=0,
             length=None, order_by=None, order_dir='desc'):
         """
         Get all Pull requests that i'm participating in, or i have opened
         """
 
         q = self._prepare_participating_query(
             user_id, statuses=statuses, order_by=order_by,
             order_dir=order_dir)
 
         if length:
             pull_requests = q.limit(length).offset(offset).all()
         else:
             pull_requests = q.all()
 
         return pull_requests
 
     def get_versions(self, pull_request):
         """
         returns version of pull request sorted by ID descending
         """
         return PullRequestVersion.query()\
             .filter(PullRequestVersion.pull_request == pull_request)\
             .order_by(PullRequestVersion.pull_request_version_id.asc())\
             .all()
 
     def create(self, created_by, source_repo, source_ref, target_repo,
                target_ref, revisions, reviewers, title, description=None,
                reviewer_data=None):
 
         created_by_user = self._get_user(created_by)
         source_repo = self._get_repo(source_repo)
         target_repo = self._get_repo(target_repo)
 
         pull_request = PullRequest()
         pull_request.source_repo = source_repo
         pull_request.source_ref = source_ref
         pull_request.target_repo = target_repo
         pull_request.target_ref = target_ref
         pull_request.revisions = revisions
         pull_request.title = title
         pull_request.description = description
         pull_request.author = created_by_user
         pull_request.reviewer_data = reviewer_data
 
         Session().add(pull_request)
         Session().flush()
 
         reviewer_ids = set()
         # members / reviewers
         for reviewer_object in reviewers:
             user_id, reasons, mandatory = reviewer_object
             user = self._get_user(user_id)
 
             # skip duplicates
             if user.user_id in reviewer_ids:
                 continue
 
             reviewer_ids.add(user.user_id)
 
             reviewer = PullRequestReviewers()
             reviewer.user = user
             reviewer.pull_request = pull_request
             reviewer.reasons = reasons
             reviewer.mandatory = mandatory
             Session().add(reviewer)
 
         # Set approval status to "Under Review" for all commits which are
         # part of this pull request.
         ChangesetStatusModel().set_status(
             repo=target_repo,
             status=ChangesetStatus.STATUS_UNDER_REVIEW,
             user=created_by_user,
             pull_request=pull_request
         )
 
         self.notify_reviewers(pull_request, reviewer_ids)
         self._trigger_pull_request_hook(
             pull_request, created_by_user, 'create')
 
+        creation_data = pull_request.get_api_data(with_merge_state=False)
+        self._log_audit_action(
+            'repo.pull_request.create', {'data': creation_data},
+            created_by_user, pull_request)
+
         return pull_request
 
     def _trigger_pull_request_hook(self, pull_request, user, action):
         pull_request = self.__get_pull_request(pull_request)
         target_scm = pull_request.target_repo.scm_instance()
         if action == 'create':
             trigger_hook = hooks_utils.trigger_log_create_pull_request_hook
         elif action == 'merge':
             trigger_hook = hooks_utils.trigger_log_merge_pull_request_hook
         elif action == 'close':
             trigger_hook = hooks_utils.trigger_log_close_pull_request_hook
         elif action == 'review_status_change':
             trigger_hook = hooks_utils.trigger_log_review_pull_request_hook
         elif action == 'update':
             trigger_hook = hooks_utils.trigger_log_update_pull_request_hook
         else:
             return
 
         trigger_hook(
             username=user.username,
             repo_name=pull_request.target_repo.repo_name,
             repo_alias=target_scm.alias,
             pull_request=pull_request)
 
     def _get_commit_ids(self, pull_request):
         """
         Return the commit ids of the merged pull request.
 
         This method is not dealing correctly yet with the lack of autoupdates
         nor with the implicit target updates.
         For example: if a commit in the source repo is already in the target it
         will be reported anyways.
         """
         merge_rev = pull_request.merge_rev
         if merge_rev is None:
             raise ValueError('This pull request was not merged yet')
 
         commit_ids = list(pull_request.revisions)
         if merge_rev not in commit_ids:
             commit_ids.append(merge_rev)
 
         return commit_ids
 
     def merge(self, pull_request, user, extras):
         log.debug("Merging pull request %s", pull_request.pull_request_id)
         merge_state = self._merge_pull_request(pull_request, user, extras)
         if merge_state.executed:
             log.debug(
                 "Merge was successful, updating the pull request comments.")
             self._comment_and_close_pr(pull_request, user, merge_state)
-            self._log_action('user_merged_pull_request', user, pull_request)
+
+            self._log_audit_action(
+                'repo.pull_request.merge',
+                {'merge_state': merge_state.__dict__},
+                user, pull_request)
+
         else:
             log.warn("Merge failed, not updating the pull request.")
         return merge_state
 
     def _merge_pull_request(self, pull_request, user, extras):
         target_vcs = pull_request.target_repo.scm_instance()
         source_vcs = pull_request.source_repo.scm_instance()
         target_ref = self._refresh_reference(
             pull_request.target_ref_parts, target_vcs)
 
         message = _(
             'Merge pull request #%(pr_id)s from '
             '%(source_repo)s %(source_ref_name)s\n\n %(pr_title)s') % {
                 'pr_id': pull_request.pull_request_id,
                 'source_repo': source_vcs.name,
                 'source_ref_name': pull_request.source_ref_parts.name,
                 'pr_title': pull_request.title
             }
 
         workspace_id = self._workspace_id(pull_request)
         use_rebase = self._use_rebase_for_merging(pull_request)
 
         callback_daemon, extras = prepare_callback_daemon(
             extras, protocol=vcs_settings.HOOKS_PROTOCOL,
             use_direct_calls=vcs_settings.HOOKS_DIRECT_CALLS)
 
         with callback_daemon:
             # TODO: johbo: Implement a clean way to run a config_override
             # for a single call.
             target_vcs.config.set(
                 'rhodecode', 'RC_SCM_DATA', json.dumps(extras))
             merge_state = target_vcs.merge(
                 target_ref, source_vcs, pull_request.source_ref_parts,
                 workspace_id, user_name=user.username,
                 user_email=user.email, message=message, use_rebase=use_rebase)
         return merge_state
 
     def _comment_and_close_pr(self, pull_request, user, merge_state):
         pull_request.merge_rev = merge_state.merge_ref.commit_id
         pull_request.updated_on = datetime.datetime.now()
 
         CommentsModel().create(
             text=unicode(_('Pull request merged and closed')),
             repo=pull_request.target_repo.repo_id,
             user=user.user_id,
             pull_request=pull_request.pull_request_id,
             f_path=None,
             line_no=None,
             closing_pr=True
         )
 
         Session().add(pull_request)
         Session().flush()
         # TODO: paris: replace invalidation with less radical solution
         ScmModel().mark_for_invalidation(
             pull_request.target_repo.repo_name)
         self._trigger_pull_request_hook(pull_request, user, 'merge')
 
     def has_valid_update_type(self, pull_request):
         source_ref_type = pull_request.source_ref_parts.type
         return source_ref_type in ['book', 'branch', 'tag']
 
     def update_commits(self, pull_request):
         """
         Get the updated list of commits for the pull request
         and return the new pull request version and the list
         of commits processed by this update action
         """
         pull_request = self.__get_pull_request(pull_request)
         source_ref_type = pull_request.source_ref_parts.type
         source_ref_name = pull_request.source_ref_parts.name
         source_ref_id = pull_request.source_ref_parts.commit_id
 
         target_ref_type = pull_request.target_ref_parts.type
         target_ref_name = pull_request.target_ref_parts.name
         target_ref_id = pull_request.target_ref_parts.commit_id
 
         if not self.has_valid_update_type(pull_request):
             log.debug(
                 "Skipping update of pull request %s due to ref type: %s",
                 pull_request, source_ref_type)
             return UpdateResponse(
                 executed=False,
                 reason=UpdateFailureReason.WRONG_REF_TYPE,
                 old=pull_request, new=None, changes=None,
                 source_changed=False, target_changed=False)
 
         # source repo
         source_repo = pull_request.source_repo.scm_instance()
         try:
             source_commit = source_repo.get_commit(commit_id=source_ref_name)
         except CommitDoesNotExistError:
             return UpdateResponse(
                 executed=False,
                 reason=UpdateFailureReason.MISSING_SOURCE_REF,
                 old=pull_request, new=None, changes=None,
                 source_changed=False, target_changed=False)
 
         source_changed = source_ref_id != source_commit.raw_id
 
         # target repo
         target_repo = pull_request.target_repo.scm_instance()
         try:
             target_commit = target_repo.get_commit(commit_id=target_ref_name)
         except CommitDoesNotExistError:
             return UpdateResponse(
                 executed=False,
                 reason=UpdateFailureReason.MISSING_TARGET_REF,
                 old=pull_request, new=None, changes=None,
                 source_changed=False, target_changed=False)
         target_changed = target_ref_id != target_commit.raw_id
 
         if not (source_changed or target_changed):
             log.debug("Nothing changed in pull request %s", pull_request)
             return UpdateResponse(
                 executed=False,
                 reason=UpdateFailureReason.NO_CHANGE,
                 old=pull_request, new=None, changes=None,
                 source_changed=target_changed, target_changed=source_changed)
 
         change_in_found = 'target repo' if target_changed else 'source repo'
         log.debug('Updating pull request because of change in %s detected',
                   change_in_found)
 
         # Finally there is a need for an update, in case of source change
         # we create a new version, else just an update
         if source_changed:
             pull_request_version = self._create_version_from_snapshot(pull_request)
             self._link_comments_to_version(pull_request_version)
         else:
             try:
                 ver = pull_request.versions[-1]
             except IndexError:
                 ver = None
 
             pull_request.pull_request_version_id = \
                 ver.pull_request_version_id if ver else None
             pull_request_version = pull_request
 
         try:
             if target_ref_type in ('tag', 'branch', 'book'):
                 target_commit = target_repo.get_commit(target_ref_name)
             else:
                 target_commit = target_repo.get_commit(target_ref_id)
         except CommitDoesNotExistError:
             return UpdateResponse(
                 executed=False,
                 reason=UpdateFailureReason.MISSING_TARGET_REF,
                 old=pull_request, new=None, changes=None,
                 source_changed=source_changed, target_changed=target_changed)
 
         # re-compute commit ids
         old_commit_ids = pull_request.revisions
         pre_load = ["author", "branch", "date", "message"]
         commit_ranges = target_repo.compare(
             target_commit.raw_id, source_commit.raw_id, source_repo, merge=True,
             pre_load=pre_load)
 
         ancestor = target_repo.get_common_ancestor(
             target_commit.raw_id, source_commit.raw_id, source_repo)
 
         pull_request.source_ref = '%s:%s:%s' % (
             source_ref_type, source_ref_name, source_commit.raw_id)
         pull_request.target_ref = '%s:%s:%s' % (
             target_ref_type, target_ref_name, ancestor)
 
         pull_request.revisions = [
             commit.raw_id for commit in reversed(commit_ranges)]
         pull_request.updated_on = datetime.datetime.now()
         Session().add(pull_request)
         new_commit_ids = pull_request.revisions
 
         old_diff_data, new_diff_data = self._generate_update_diffs(
             pull_request, pull_request_version)
 
         # calculate commit and file changes
         changes = self._calculate_commit_id_changes(
             old_commit_ids, new_commit_ids)
         file_changes = self._calculate_file_changes(
             old_diff_data, new_diff_data)
 
         # set comments as outdated if DIFFS changed
         CommentsModel().outdate_comments(
             pull_request, old_diff_data=old_diff_data,
             new_diff_data=new_diff_data)
 
         commit_changes = (changes.added or changes.removed)
         file_node_changes = (
             file_changes.added or file_changes.modified or file_changes.removed)
         pr_has_changes = commit_changes or file_node_changes
 
         # Add an automatic comment to the pull request, in case
         # anything has changed
         if pr_has_changes:
             update_comment = CommentsModel().create(
                 text=self._render_update_message(changes, file_changes),
                 repo=pull_request.target_repo,
                 user=pull_request.author,
                 pull_request=pull_request,
                 send_email=False, renderer=DEFAULT_COMMENTS_RENDERER)
 
             # Update status to "Under Review" for added commits
             for commit_id in changes.added:
                 ChangesetStatusModel().set_status(
                     repo=pull_request.source_repo,
                     status=ChangesetStatus.STATUS_UNDER_REVIEW,
                     comment=update_comment,
                     user=pull_request.author,
                     pull_request=pull_request,
                     revision=commit_id)
 
         log.debug(
             'Updated pull request %s, added_ids: %s, common_ids: %s, '
             'removed_ids: %s', pull_request.pull_request_id,
             changes.added, changes.common, changes.removed)
         log.debug(
             'Updated pull request with the following file changes: %s',
             file_changes)
 
         log.info(
             "Updated pull request %s from commit %s to commit %s, "
             "stored new version %s of this pull request.",
             pull_request.pull_request_id, source_ref_id,
             pull_request.source_ref_parts.commit_id,
             pull_request_version.pull_request_version_id)
         Session().commit()
         self._trigger_pull_request_hook(
             pull_request, pull_request.author, 'update')
 
         return UpdateResponse(
             executed=True, reason=UpdateFailureReason.NONE,
             old=pull_request, new=pull_request_version, changes=changes,
             source_changed=source_changed, target_changed=target_changed)
 
     def _create_version_from_snapshot(self, pull_request):
         version = PullRequestVersion()
         version.title = pull_request.title
         version.description = pull_request.description
         version.status = pull_request.status
         version.created_on = datetime.datetime.now()
         version.updated_on = pull_request.updated_on
         version.user_id = pull_request.user_id
         version.source_repo = pull_request.source_repo
         version.source_ref = pull_request.source_ref
         version.target_repo = pull_request.target_repo
         version.target_ref = pull_request.target_ref
 
         version._last_merge_source_rev = pull_request._last_merge_source_rev
         version._last_merge_target_rev = pull_request._last_merge_target_rev
         version._last_merge_status = pull_request._last_merge_status
         version.shadow_merge_ref = pull_request.shadow_merge_ref
         version.merge_rev = pull_request.merge_rev
         version.reviewer_data = pull_request.reviewer_data
 
         version.revisions = pull_request.revisions
         version.pull_request = pull_request
         Session().add(version)
         Session().flush()
 
         return version
 
     def _generate_update_diffs(self, pull_request, pull_request_version):
 
         diff_context = (
             self.DIFF_CONTEXT +
             CommentsModel.needed_extra_diff_context())
 
         source_repo = pull_request_version.source_repo
         source_ref_id = pull_request_version.source_ref_parts.commit_id
         target_ref_id = pull_request_version.target_ref_parts.commit_id
         old_diff = self._get_diff_from_pr_or_version(
             source_repo, source_ref_id, target_ref_id, context=diff_context)
 
         source_repo = pull_request.source_repo
         source_ref_id = pull_request.source_ref_parts.commit_id
         target_ref_id = pull_request.target_ref_parts.commit_id
 
         new_diff = self._get_diff_from_pr_or_version(
             source_repo, source_ref_id, target_ref_id, context=diff_context)
 
         old_diff_data = diffs.DiffProcessor(old_diff)
         old_diff_data.prepare()
         new_diff_data = diffs.DiffProcessor(new_diff)
         new_diff_data.prepare()
 
         return old_diff_data, new_diff_data
 
     def _link_comments_to_version(self, pull_request_version):
         """
         Link all unlinked comments of this pull request to the given version.
 
         :param pull_request_version: The `PullRequestVersion` to which
             the comments shall be linked.
 
         """
         pull_request = pull_request_version.pull_request
         comments = ChangesetComment.query()\
             .filter(
                 # TODO: johbo: Should we query for the repo at all here?
                 # Pending decision on how comments of PRs are to be related
                 # to either the source repo, the target repo or no repo at all.
                 ChangesetComment.repo_id == pull_request.target_repo.repo_id,
                 ChangesetComment.pull_request == pull_request,
                 ChangesetComment.pull_request_version == None)\
             .order_by(ChangesetComment.comment_id.asc())
 
         # TODO: johbo: Find out why this breaks if it is done in a bulk
         # operation.
         for comment in comments:
             comment.pull_request_version_id = (
                 pull_request_version.pull_request_version_id)
             Session().add(comment)
 
     def _calculate_commit_id_changes(self, old_ids, new_ids):
         added = [x for x in new_ids if x not in old_ids]
         common = [x for x in new_ids if x in old_ids]
         removed = [x for x in old_ids if x not in new_ids]
         total = new_ids
         return ChangeTuple(added, common, removed, total)
 
     def _calculate_file_changes(self, old_diff_data, new_diff_data):
 
         old_files = OrderedDict()
         for diff_data in old_diff_data.parsed_diff:
             old_files[diff_data['filename']] = md5_safe(diff_data['raw_diff'])
 
         added_files = []
         modified_files = []
         removed_files = []
         for diff_data in new_diff_data.parsed_diff:
             new_filename = diff_data['filename']
             new_hash = md5_safe(diff_data['raw_diff'])
 
             old_hash = old_files.get(new_filename)
             if not old_hash:
                 # file is not present in old diff, means it's added
                 added_files.append(new_filename)
             else:
                 if new_hash != old_hash:
                     modified_files.append(new_filename)
                 # now remove a file from old, since we have seen it already
                 del old_files[new_filename]
 
         # removed files is when there are present in old, but not in NEW,
         # since we remove old files that are present in new diff, left-overs
         # if any should be the removed files
         removed_files.extend(old_files.keys())
 
         return FileChangeTuple(added_files, modified_files, removed_files)
 
     def _render_update_message(self, changes, file_changes):
         """
         render the message using DEFAULT_COMMENTS_RENDERER (RST renderer),
         so it's always looking the same disregarding on which default
         renderer system is using.
 
         :param changes: changes named tuple
         :param file_changes: file changes named tuple
 
         """
         new_status = ChangesetStatus.get_status_lbl(
             ChangesetStatus.STATUS_UNDER_REVIEW)
 
         changed_files = (
             file_changes.added + file_changes.modified + file_changes.removed)
 
         params = {
             'under_review_label': new_status,
             'added_commits': changes.added,
             'removed_commits': changes.removed,
             'changed_files': changed_files,
             'added_files': file_changes.added,
             'modified_files': file_changes.modified,
             'removed_files': file_changes.removed,
         }
         renderer = RstTemplateRenderer()
         return renderer.render('pull_request_update.mako', **params)
 
-    def edit(self, pull_request, title, description):
+    def edit(self, pull_request, title, description, user):
         pull_request = self.__get_pull_request(pull_request)
+        old_data = pull_request.get_api_data(with_merge_state=False)
         if pull_request.is_closed():
             raise ValueError('This pull request is closed')
         if title:
             pull_request.title = title
         pull_request.description = description
         pull_request.updated_on = datetime.datetime.now()
         Session().add(pull_request)
+        self._log_audit_action(
+            'repo.pull_request.edit', {'old_data': old_data},
+            user, pull_request)
 
-    def update_reviewers(self, pull_request, reviewer_data):
+    def update_reviewers(self, pull_request, reviewer_data, user):
         """
         Update the reviewers in the pull request
 
         :param pull_request: the pr to update
         :param reviewer_data: list of tuples
             [(user, ['reason1', 'reason2'], mandatory_flag)]
         """
 
         reviewers = {}
         for user_id, reasons, mandatory in reviewer_data:
             if isinstance(user_id, (int, basestring)):
                 user_id = self._get_user(user_id).user_id
             reviewers[user_id] = {
                 'reasons': reasons, 'mandatory': mandatory}
 
         reviewers_ids = set(reviewers.keys())
         pull_request = self.__get_pull_request(pull_request)
         current_reviewers = PullRequestReviewers.query()\
             .filter(PullRequestReviewers.pull_request ==
                     pull_request).all()
         current_reviewers_ids = set([x.user.user_id for x in current_reviewers])
 
         ids_to_add = reviewers_ids.difference(current_reviewers_ids)
         ids_to_remove = current_reviewers_ids.difference(reviewers_ids)
 
         log.debug("Adding %s reviewers", ids_to_add)
         log.debug("Removing %s reviewers", ids_to_remove)
         changed = False
         for uid in ids_to_add:
             changed = True
             _usr = self._get_user(uid)
             reviewer = PullRequestReviewers()
             reviewer.user = _usr
             reviewer.pull_request = pull_request
             reviewer.reasons = reviewers[uid]['reasons']
             # NOTE(marcink): mandatory shouldn't be changed now
-            #reviewer.mandatory = reviewers[uid]['reasons']
+            # reviewer.mandatory = reviewers[uid]['reasons']
             Session().add(reviewer)
+            self._log_audit_action(
+                'repo.pull_request.reviewer.add', {'data': reviewer.get_dict()},
+                user, pull_request)
 
         for uid in ids_to_remove:
             changed = True
             reviewers = PullRequestReviewers.query()\
                 .filter(PullRequestReviewers.user_id == uid,
                         PullRequestReviewers.pull_request == pull_request)\
                 .all()
             # use .all() in case we accidentally added the same person twice
             # this CAN happen due to the lack of DB checks
             for obj in reviewers:
+                old_data = obj.get_dict()
                 Session().delete(obj)
+                self._log_audit_action(
+                    'repo.pull_request.reviewer.delete',
+                    {'old_data': old_data}, user, pull_request)
 
         if changed:
             pull_request.updated_on = datetime.datetime.now()
             Session().add(pull_request)
 
         self.notify_reviewers(pull_request, ids_to_add)
         return ids_to_add, ids_to_remove
 
     def get_url(self, pull_request, request=None, permalink=False):
         if not request:
             request = get_current_request()
 
         if permalink:
             return request.route_url(
                 'pull_requests_global',
                 pull_request_id=pull_request.pull_request_id,)
         else:
             return request.route_url(
                 'pullrequest_show',
                 repo_name=safe_str(pull_request.target_repo.repo_name),
                 pull_request_id=pull_request.pull_request_id,)
 
     def get_shadow_clone_url(self, pull_request):
         """
         Returns qualified url pointing to the shadow repository. If this pull
         request is closed there is no shadow repository and ``None`` will be
         returned.
         """
         if pull_request.is_closed():
             return None
         else:
             pr_url = urllib.unquote(self.get_url(pull_request))
             return safe_unicode('{pr_url}/repository'.format(pr_url=pr_url))
 
     def notify_reviewers(self, pull_request, reviewers_ids):
         # notification to reviewers
         if not reviewers_ids:
             return
 
         pull_request_obj = pull_request
         # get the current participants of this pull request
         recipients = reviewers_ids
         notification_type = EmailNotificationModel.TYPE_PULL_REQUEST
 
         pr_source_repo = pull_request_obj.source_repo
         pr_target_repo = pull_request_obj.target_repo
 
         pr_url = h.url(
             'pullrequest_show',
             repo_name=pr_target_repo.repo_name,
             pull_request_id=pull_request_obj.pull_request_id,
             qualified=True,)
 
         # set some variables for email notification
         pr_target_repo_url = h.route_url(
             'repo_summary', repo_name=pr_target_repo.repo_name)
 
         pr_source_repo_url = h.route_url(
             'repo_summary', repo_name=pr_source_repo.repo_name)
 
         # pull request specifics
         pull_request_commits = [
             (x.raw_id, x.message)
             for x in map(pr_source_repo.get_commit, pull_request.revisions)]
 
         kwargs = {
             'user': pull_request.author,
             'pull_request': pull_request_obj,
             'pull_request_commits': pull_request_commits,
 
             'pull_request_target_repo': pr_target_repo,
             'pull_request_target_repo_url': pr_target_repo_url,
 
             'pull_request_source_repo': pr_source_repo,
             'pull_request_source_repo_url': pr_source_repo_url,
 
             'pull_request_url': pr_url,
         }
 
         # pre-generate the subject for notification itself
         (subject,
          _h, _e,  # we don't care about those
          body_plaintext) = EmailNotificationModel().render_email(
             notification_type, **kwargs)
 
         # create notification objects, and emails
         NotificationModel().create(
             created_by=pull_request.author,
             notification_subject=subject,
             notification_body=body_plaintext,
             notification_type=notification_type,
             recipients=recipients,
             email_kwargs=kwargs,
         )
 
-    def delete(self, pull_request):
+    def delete(self, pull_request, user):
         pull_request = self.__get_pull_request(pull_request)
+        old_data = pull_request.get_api_data(with_merge_state=False)
         self._cleanup_merge_workspace(pull_request)
+        self._log_audit_action(
+            'repo.pull_request.delete', {'old_data': old_data},
+            user, pull_request)
         Session().delete(pull_request)
 
     def close_pull_request(self, pull_request, user):
         pull_request = self.__get_pull_request(pull_request)
         self._cleanup_merge_workspace(pull_request)
         pull_request.status = PullRequest.STATUS_CLOSED
         pull_request.updated_on = datetime.datetime.now()
         Session().add(pull_request)
         self._trigger_pull_request_hook(
             pull_request, pull_request.author, 'close')
-        self._log_action('user_closed_pull_request', user, pull_request)
+        self._log_audit_action(
+            'repo.pull_request.close', {}, user, pull_request)
 
     def close_pull_request_with_comment(
             self, pull_request, user, repo, message=None):
 
         pull_request_review_status = pull_request.calculated_review_status()
 
         if pull_request_review_status == ChangesetStatus.STATUS_APPROVED:
             # approved only if we have voting consent
             status = ChangesetStatus.STATUS_APPROVED
         else:
             status = ChangesetStatus.STATUS_REJECTED
         status_lbl = ChangesetStatus.get_status_lbl(status)
 
         default_message = (
             _('Closing with status change {transition_icon} {status}.')
         ).format(transition_icon='>', status=status_lbl)
         text = message or default_message
 
         # create a comment, and link it to new status
         comment = CommentsModel().create(
             text=text,
             repo=repo.repo_id,
             user=user.user_id,
             pull_request=pull_request.pull_request_id,
             status_change=status_lbl,
             status_change_type=status,
             closing_pr=True
         )
 
         # calculate old status before we change it
         old_calculated_status = pull_request.calculated_review_status()
         ChangesetStatusModel().set_status(
             repo.repo_id,
             status,
             user.user_id,
             comment=comment,
             pull_request=pull_request.pull_request_id
         )
 
         Session().flush()
         events.trigger(events.PullRequestCommentEvent(pull_request, comment))
         # we now calculate the status of pull request again, and based on that
         # calculation trigger status change. This might happen in cases
         # that non-reviewer admin closes a pr, which means his vote doesn't
         # change the status, while if he's a reviewer this might change it.
         calculated_status = pull_request.calculated_review_status()
         if old_calculated_status != calculated_status:
             self._trigger_pull_request_hook(
                 pull_request, user, 'review_status_change')
 
         # finally close the PR
         PullRequestModel().close_pull_request(
             pull_request.pull_request_id, user)
 
         return comment, status
 
     def merge_status(self, pull_request):
         if not self._is_merge_enabled(pull_request):
             return False, _('Server-side pull request merging is disabled.')
         if pull_request.is_closed():
             return False, _('This pull request is closed.')
         merge_possible, msg = self._check_repo_requirements(
             target=pull_request.target_repo, source=pull_request.source_repo)
         if not merge_possible:
             return merge_possible, msg
 
         try:
             resp = self._try_merge(pull_request)
             log.debug("Merge response: %s", resp)
             status = resp.possible, self.merge_status_message(
                 resp.failure_reason)
         except NotImplementedError:
             status = False, _('Pull request merging is not supported.')
 
         return status
 
     def _check_repo_requirements(self, target, source):
         """
         Check if `target` and `source` have compatible requirements.
 
         Currently this is just checking for largefiles.
         """
         target_has_largefiles = self._has_largefiles(target)
         source_has_largefiles = self._has_largefiles(source)
         merge_possible = True
         message = u''
 
         if target_has_largefiles != source_has_largefiles:
             merge_possible = False
             if source_has_largefiles:
                 message = _(
                     'Target repository large files support is disabled.')
             else:
                 message = _(
                     'Source repository large files support is disabled.')
 
         return merge_possible, message
 
     def _has_largefiles(self, repo):
         largefiles_ui = VcsSettingsModel(repo=repo).get_ui_settings(
             'extensions', 'largefiles')
         return largefiles_ui and largefiles_ui[0].active
 
     def _try_merge(self, pull_request):
         """
         Try to merge the pull request and return the merge status.
         """
         log.debug(
             "Trying out if the pull request %s can be merged.",
             pull_request.pull_request_id)
         target_vcs = pull_request.target_repo.scm_instance()
 
         # Refresh the target reference.
         try:
             target_ref = self._refresh_reference(
                 pull_request.target_ref_parts, target_vcs)
         except CommitDoesNotExistError:
             merge_state = MergeResponse(
                 False, False, None, MergeFailureReason.MISSING_TARGET_REF)
             return merge_state
 
         target_locked = pull_request.target_repo.locked
         if target_locked and target_locked[0]:
             log.debug("The target repository is locked.")
             merge_state = MergeResponse(
                 False, False, None, MergeFailureReason.TARGET_IS_LOCKED)
         elif self._needs_merge_state_refresh(pull_request, target_ref):
             log.debug("Refreshing the merge status of the repository.")
             merge_state = self._refresh_merge_state(
                 pull_request, target_vcs, target_ref)
         else:
             possible = pull_request.\
                 _last_merge_status == MergeFailureReason.NONE
             merge_state = MergeResponse(
                 possible, False, None, pull_request._last_merge_status)
 
         return merge_state
 
     def _refresh_reference(self, reference, vcs_repository):
         if reference.type in ('branch', 'book'):
             name_or_id = reference.name
         else:
             name_or_id = reference.commit_id
         refreshed_commit = vcs_repository.get_commit(name_or_id)
         refreshed_reference = Reference(
             reference.type, reference.name, refreshed_commit.raw_id)
         return refreshed_reference
 
     def _needs_merge_state_refresh(self, pull_request, target_reference):
         return not(
             pull_request.revisions and
             pull_request.revisions[0] == pull_request._last_merge_source_rev and
             target_reference.commit_id == pull_request._last_merge_target_rev)
 
     def _refresh_merge_state(self, pull_request, target_vcs, target_reference):
         workspace_id = self._workspace_id(pull_request)
         source_vcs = pull_request.source_repo.scm_instance()
         use_rebase = self._use_rebase_for_merging(pull_request)
         merge_state = target_vcs.merge(
             target_reference, source_vcs, pull_request.source_ref_parts,
             workspace_id, dry_run=True, use_rebase=use_rebase)
 
         # Do not store the response if there was an unknown error.
         if merge_state.failure_reason != MergeFailureReason.UNKNOWN:
             pull_request._last_merge_source_rev = \
                 pull_request.source_ref_parts.commit_id
             pull_request._last_merge_target_rev = target_reference.commit_id
             pull_request._last_merge_status = merge_state.failure_reason
             pull_request.shadow_merge_ref = merge_state.merge_ref
             Session().add(pull_request)
             Session().commit()
 
         return merge_state
 
     def _workspace_id(self, pull_request):
         workspace_id = 'pr-%s' % pull_request.pull_request_id
         return workspace_id
 
     def merge_status_message(self, status_code):
         """
         Return a human friendly error message for the given merge status code.
         """
         return self.MERGE_STATUS_MESSAGES[status_code]
 
     def generate_repo_data(self, repo, commit_id=None, branch=None,
                            bookmark=None):
         all_refs, selected_ref = \
             self._get_repo_pullrequest_sources(
                 repo.scm_instance(), commit_id=commit_id,
                 branch=branch, bookmark=bookmark)
 
         refs_select2 = []
         for element in all_refs:
             children = [{'id': x[0], 'text': x[1]} for x in element[0]]
             refs_select2.append({'text': element[1], 'children': children})
 
         return {
             'user': {
                 'user_id': repo.user.user_id,
                 'username': repo.user.username,
                 'firstname': repo.user.firstname,
                 'lastname': repo.user.lastname,
                 'gravatar_link': h.gravatar_url(repo.user.email, 14),
             },
             'description': h.chop_at_smart(repo.description, '\n'),
             'refs': {
                 'all_refs': all_refs,
                 'selected_ref': selected_ref,
                 'select2_refs': refs_select2
             }
         }
 
     def generate_pullrequest_title(self, source, source_ref, target):
         return u'{source}#{at_ref} to {target}'.format(
             source=source,
             at_ref=source_ref,
             target=target,
         )
 
     def _cleanup_merge_workspace(self, pull_request):
         # Merging related cleanup
         target_scm = pull_request.target_repo.scm_instance()
         workspace_id = 'pr-%s' % pull_request.pull_request_id
 
         try:
             target_scm.cleanup_merge_workspace(workspace_id)
         except NotImplementedError:
             pass
 
     def _get_repo_pullrequest_sources(
             self, repo, commit_id=None, branch=None, bookmark=None):
         """
         Return a structure with repo's interesting commits, suitable for
         the selectors in pullrequest controller
 
         :param commit_id: a commit that must be in the list somehow
             and selected by default
         :param branch: a branch that must be in the list and selected
             by default - even if closed
         :param bookmark: a bookmark that must be in the list and selected
         """
 
         commit_id = safe_str(commit_id) if commit_id else None
         branch = safe_str(branch) if branch else None
         bookmark = safe_str(bookmark) if bookmark else None
 
         selected = None
 
         # order matters: first source that has commit_id in it will be selected
         sources = []
         sources.append(('book', repo.bookmarks.items(), _('Bookmarks'), bookmark))
         sources.append(('branch', repo.branches.items(), _('Branches'), branch))
 
         if commit_id:
             ref_commit = (h.short_id(commit_id), commit_id)
             sources.append(('rev', [ref_commit], _('Commit IDs'), commit_id))
 
         sources.append(
             ('branch', repo.branches_closed.items(), _('Closed Branches'), branch),
         )
 
         groups = []
         for group_key, ref_list, group_name, match in sources:
             group_refs = []
             for ref_name, ref_id in ref_list:
                 ref_key = '%s:%s:%s' % (group_key, ref_name, ref_id)
                 group_refs.append((ref_key, ref_name))
 
                 if not selected:
                     if set([commit_id, match]) & set([ref_id, ref_name]):
                         selected = ref_key
 
             if group_refs:
                 groups.append((group_refs, group_name))
 
         if not selected:
             ref = commit_id or branch or bookmark
             if ref:
                 raise CommitDoesNotExistError(
                     'No commit refs could be found matching: %s' % ref)
             elif repo.DEFAULT_BRANCH_NAME in repo.branches:
                 selected = 'branch:%s:%s' % (
                     repo.DEFAULT_BRANCH_NAME,
                     repo.branches[repo.DEFAULT_BRANCH_NAME]
                 )
             elif repo.commit_ids:
                 rev = repo.commit_ids[0]
                 selected = 'rev:%s:%s' % (rev, rev)
             else:
                 raise EmptyRepositoryError()
         return groups, selected
 
     def get_diff(self, source_repo, source_ref_id, target_ref_id, context=DIFF_CONTEXT):
         return self._get_diff_from_pr_or_version(
             source_repo, source_ref_id, target_ref_id, context=context)
 
     def _get_diff_from_pr_or_version(
             self, source_repo, source_ref_id, target_ref_id, context):
         target_commit = source_repo.get_commit(
             commit_id=safe_str(target_ref_id))
         source_commit = source_repo.get_commit(
             commit_id=safe_str(source_ref_id))
         if isinstance(source_repo, Repository):
             vcs_repo = source_repo.scm_instance()
         else:
             vcs_repo = source_repo
 
         # TODO: johbo: In the context of an update, we cannot reach
         # the old commit anymore with our normal mechanisms. It needs
         # some sort of special support in the vcs layer to avoid this
         # workaround.
         if (source_commit.raw_id == vcs_repo.EMPTY_COMMIT_ID and
                 vcs_repo.alias == 'git'):
             source_commit.raw_id = safe_str(source_ref_id)
 
         log.debug('calculating diff between '
                   'source_ref:%s and target_ref:%s for repo `%s`',
                   target_ref_id, source_ref_id,
                   safe_unicode(vcs_repo.path))
 
         vcs_diff = vcs_repo.get_diff(
             commit1=target_commit, commit2=source_commit, context=context)
         return vcs_diff
 
     def _is_merge_enabled(self, pull_request):
         settings_model = VcsSettingsModel(repo=pull_request.target_repo)
         settings = settings_model.get_general_settings()
         return settings.get('rhodecode_pr_merge_enabled', False)
 
     def _use_rebase_for_merging(self, pull_request):
         settings_model = VcsSettingsModel(repo=pull_request.target_repo)
         settings = settings_model.get_general_settings()
         return settings.get('rhodecode_hg_use_rebase_for_merging', False)
 
-    def _log_action(self, action, user, pull_request):
-        action_logger(
-            user,
-            '{action}:{pr_id}'.format(
-                action=action, pr_id=pull_request.pull_request_id),
-            pull_request.target_repo)
+    def _log_audit_action(self, action, action_data, user, pull_request):
+        audit_logger.store(
+            action=action,
+            action_data=action_data,
+            user=user,
+            repo=pull_request.target_repo)
 
     def get_reviewer_functions(self):
         """
         Fetches functions for validation and fetching default reviewers.
         If available we use the EE package, else we fallback to CE
         package functions
         """
         try:
             from rc_reviewers.utils import get_default_reviewers_data
             from rc_reviewers.utils import validate_default_reviewers
         except ImportError:
             from rhodecode.apps.repository.utils import \
                 get_default_reviewers_data
             from rhodecode.apps.repository.utils import \
                 validate_default_reviewers
 
         return get_default_reviewers_data, validate_default_reviewers
 
 
 class MergeCheck(object):
     """
     Perform Merge Checks and returns a check object which stores information
     about merge errors, and merge conditions
     """
     TODO_CHECK = 'todo'
     PERM_CHECK = 'perm'
     REVIEW_CHECK = 'review'
     MERGE_CHECK = 'merge'
 
     def __init__(self):
         self.review_status = None
         self.merge_possible = None
         self.merge_msg = ''
         self.failed = None
         self.errors = []
         self.error_details = OrderedDict()
 
     def push_error(self, error_type, message, error_key, details):
         self.failed = True
         self.errors.append([error_type, message])
         self.error_details[error_key] = dict(
             details=details,
             error_type=error_type,
             message=message
         )
 
     @classmethod
     def validate(cls, pull_request, user, fail_early=False, translator=None):
         # if migrated to pyramid...
         # _ = lambda: translator or _  # use passed in translator if any
 
         merge_check = cls()
 
         # permissions to merge
         user_allowed_to_merge = PullRequestModel().check_user_merge(
             pull_request, user)
         if not user_allowed_to_merge:
             log.debug("MergeCheck: cannot merge, approval is pending.")
 
             msg = _('User `{}` not allowed to perform merge.').format(user.username)
             merge_check.push_error('error', msg, cls.PERM_CHECK, user.username)
             if fail_early:
                 return merge_check
 
         # review status, must be always present
         review_status = pull_request.calculated_review_status()
         merge_check.review_status = review_status
 
         status_approved = review_status == ChangesetStatus.STATUS_APPROVED
         if not status_approved:
             log.debug("MergeCheck: cannot merge, approval is pending.")
 
             msg = _('Pull request reviewer approval is pending.')
 
             merge_check.push_error(
                 'warning', msg, cls.REVIEW_CHECK, review_status)
 
             if fail_early:
                 return merge_check
 
         # left over TODOs
         todos = CommentsModel().get_unresolved_todos(pull_request)
         if todos:
             log.debug("MergeCheck: cannot merge, {} "
                       "unresolved todos left.".format(len(todos)))
 
             if len(todos) == 1:
                 msg = _('Cannot merge, {} TODO still not resolved.').format(
                     len(todos))
             else:
                 msg = _('Cannot merge, {} TODOs still not resolved.').format(
                     len(todos))
 
             merge_check.push_error('warning', msg, cls.TODO_CHECK, todos)
 
             if fail_early:
                 return merge_check
 
         # merge possible
         merge_status, msg = PullRequestModel().merge_status(pull_request)
         merge_check.merge_possible = merge_status
         merge_check.merge_msg = msg
         if not merge_status:
             log.debug(
                 "MergeCheck: cannot merge, pull request merge not possible.")
             merge_check.push_error('warning', msg, cls.MERGE_CHECK, None)
 
             if fail_early:
                 return merge_check
 
         return merge_check
 
 
 ChangeTuple = namedtuple('ChangeTuple',
                          ['added', 'common', 'removed', 'total'])
 
 FileChangeTuple = namedtuple('FileChangeTuple',
                              ['added', 'modified', 'removed'])

rhodecode/tests/functional/test_admin_permissions.py

@@ -1,210 +1,213 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import pytest
 from rhodecode.model.db import User, UserIpMap
 from rhodecode.model.permission import PermissionModel
 from rhodecode.tests import (
     TestController, url, clear_all_caches, assert_session_flash)
 
 
 class TestAdminPermissionsController(TestController):
 
     @pytest.fixture(scope='class', autouse=True)
     def prepare(self, request):
         # cleanup and reset to default permissions after
         @request.addfinalizer
         def cleanup():
             PermissionModel().create_default_user_permissions(
                 User.get_default_user(), force=True)
 
     def test_index_application(self):
         self.log_user()
         self.app.get(url('admin_permissions_application'))
 
     @pytest.mark.parametrize(
         'anonymous, default_register, default_register_message, default_password_reset,' 
         'default_extern_activate, expect_error, expect_form_error', [
             (True, 'hg.register.none', '', 'hg.password_reset.enabled', 'hg.extern_activate.manual',
              False, False),
             (True, 'hg.register.manual_activate', '', 'hg.password_reset.enabled', 'hg.extern_activate.auto',
              False, False),
             (True, 'hg.register.auto_activate', '', 'hg.password_reset.enabled', 'hg.extern_activate.manual',
              False, False),
             (True, 'hg.register.auto_activate', '', 'hg.password_reset.enabled', 'hg.extern_activate.manual',
              False, False),
             (True, 'hg.register.XXX', '', 'hg.password_reset.enabled', 'hg.extern_activate.manual',
              False, True),
             (True, '', '', 'hg.password_reset.enabled', '', True, False),
         ])
     def test_update_application_permissions(
             self, anonymous, default_register, default_register_message, default_password_reset,
             default_extern_activate, expect_error, expect_form_error):
 
         self.log_user()
 
         # TODO: anonymous access set here to False, breaks some other tests
         params = {
             'csrf_token': self.csrf_token,
             'anonymous': anonymous,
             'default_register': default_register,
             'default_register_message': default_register_message,
             'default_password_reset': default_password_reset,
             'default_extern_activate': default_extern_activate,
         }
         response = self.app.post(url('admin_permissions_application'),
                                  params=params)
         if expect_form_error:
             assert response.status_int == 200
             response.mustcontain('Value must be one of')
         else:
             if expect_error:
                 msg = 'Error occurred during update of permissions'
             else:
                 msg = 'Application permissions updated successfully'
             assert_session_flash(response, msg)
 
     def test_index_object(self):
         self.log_user()
         self.app.get(url('admin_permissions_object'))
 
     @pytest.mark.parametrize(
         'repo, repo_group, user_group, expect_error, expect_form_error', [
             ('repository.none', 'group.none', 'usergroup.none', False, False),
             ('repository.read', 'group.read', 'usergroup.read', False, False),
             ('repository.write', 'group.write', 'usergroup.write',
              False, False),
             ('repository.admin', 'group.admin', 'usergroup.admin',
              False, False),
             ('repository.XXX', 'group.admin', 'usergroup.admin', False, True),
             ('', '', '', True, False),
         ])
     def test_update_object_permissions(self, repo, repo_group, user_group,
                                        expect_error, expect_form_error):
         self.log_user()
 
         params = {
             'csrf_token': self.csrf_token,
             'default_repo_perm': repo,
             'overwrite_default_repo': False,
             'default_group_perm': repo_group,
             'overwrite_default_group': False,
             'default_user_group_perm': user_group,
             'overwrite_default_user_group': False,
         }
         response = self.app.post(url('admin_permissions_object'),
                                  params=params)
         if expect_form_error:
             assert response.status_int == 200
             response.mustcontain('Value must be one of')
         else:
             if expect_error:
                 msg = 'Error occurred during update of permissions'
             else:
                 msg = 'Object permissions updated successfully'
             assert_session_flash(response, msg)
 
     def test_index_global(self):
         self.log_user()
         self.app.get(url('admin_permissions_global'))
 
     @pytest.mark.parametrize(
         'repo_create, repo_create_write, user_group_create, repo_group_create,'
         'fork_create, inherit_default_permissions, expect_error,'
         'expect_form_error', [
             ('hg.create.none', 'hg.create.write_on_repogroup.false',
              'hg.usergroup.create.false', 'hg.repogroup.create.false',
              'hg.fork.none', 'hg.inherit_default_perms.false', False, False),
             ('hg.create.repository', 'hg.create.write_on_repogroup.true',
              'hg.usergroup.create.true', 'hg.repogroup.create.true',
              'hg.fork.repository', 'hg.inherit_default_perms.false',
              False, False),
             ('hg.create.XXX', 'hg.create.write_on_repogroup.true',
              'hg.usergroup.create.true', 'hg.repogroup.create.true',
              'hg.fork.repository', 'hg.inherit_default_perms.false',
              False, True),
             ('', '', '', '', '', '', True, False),
         ])
     def test_update_global_permissions(
             self, repo_create, repo_create_write, user_group_create,
             repo_group_create, fork_create, inherit_default_permissions,
             expect_error, expect_form_error):
         self.log_user()
 
         params = {
             'csrf_token': self.csrf_token,
             'default_repo_create': repo_create,
             'default_repo_create_on_write': repo_create_write,
             'default_user_group_create': user_group_create,
             'default_repo_group_create': repo_group_create,
             'default_fork_create': fork_create,
             'default_inherit_default_permissions': inherit_default_permissions
         }
         response = self.app.post(url('admin_permissions_global'),
                                  params=params)
         if expect_form_error:
             assert response.status_int == 200
             response.mustcontain('Value must be one of')
         else:
             if expect_error:
                 msg = 'Error occurred during update of permissions'
             else:
                 msg = 'Global permissions updated successfully'
             assert_session_flash(response, msg)
 
     def test_index_ips(self):
         self.log_user()
         response = self.app.get(url('admin_permissions_ips'))
         # TODO: Test response...
         response.mustcontain('All IP addresses are allowed')
 
     def test_add_delete_ips(self):
         self.log_user()
         clear_all_caches()
 
         # ADD
         default_user_id = User.get_default_user().user_id
         response = self.app.post(
             url('edit_user_ips', user_id=default_user_id),
             params={'new_ip': '127.0.0.0/24', '_method': 'put',
                     'csrf_token': self.csrf_token})
 
         response = self.app.get(url('admin_permissions_ips'))
         response.mustcontain('127.0.0.0/24')
         response.mustcontain('127.0.0.0 - 127.0.0.255')
 
         # DELETE
         default_user_id = User.get_default_user().user_id
         del_ip_id = UserIpMap.query().filter(UserIpMap.user_id ==
                                              default_user_id).first().ip_id
 
         response = self.app.post(
             url('edit_user_ips', user_id=default_user_id),
             params={'_method': 'delete', 'del_ip_id': del_ip_id,
                     'csrf_token': self.csrf_token})
+
+        assert_session_flash(response, 'Removed ip address from user whitelist')
+
         clear_all_caches()
         response = self.app.get(url('admin_permissions_ips'))
         response.mustcontain('All IP addresses are allowed')
         response.mustcontain(no=['127.0.0.0/24'])
         response.mustcontain(no=['127.0.0.0 - 127.0.0.255'])
 
     def test_index_overview(self):
         self.log_user()
         self.app.get(url('admin_permissions_overview'))