API changes

 - added removed_user_from_users_group function
 - fixed errors on wrong username
 - normalized add/remove members from groups functions
 - docs updates

docs/api/api.rst

@@ -1,541 +1,571 b''
 .. _api:
 
 
 API
 ===
 
 
 Starting from RhodeCode version 1.2 a simple API was implemented.
 There's a single schema for calling all api methods. API is implemented
 with JSON protocol both ways. An url to send API request in RhodeCode is
 <your_server>/_admin/api
 
 API ACCESS FOR WEB VIEWS
 ++++++++++++++++++++++++
 
 API access can also be turned on for each web view in RhodeCode that is 
 decorated with `@LoginRequired` decorator. To enable API access simple change 
 the standard login decorator to `@LoginRequired(api_access=True)`. 
 After this change, a rhodecode view can be accessed without login by adding a 
 GET parameter `?api_key=<api_key>` to url. By default this is only
 enabled on RSS/ATOM feed views.
 
 
 API ACCESS
 ++++++++++
 
 All clients are required to send JSON-RPC spec JSON data::
 
     {   
         "id:<id>,
         "api_key":"<api_key>",
         "method":"<method_name>",
         "args":{"<arg_key>":"<arg_val>"}
     }
 
 Example call for autopulling remotes repos using curl::
     curl https://server.com/_admin/api -X POST -H 'content-type:text/plain' --data-binary '{"id":1,"api_key":"xe7cdb2v278e4evbdf5vs04v832v0efvcbcve4a3","method":"pull","args":{"repo":"CPython"}}'
 
 Simply provide
  - *id* A value of any type, which is used to match the response with the request that it is replying to.
  - *api_key* for access and permission validation.
  - *method* is name of method to call
  - *args* is an key:value list of arguments to pass to method
 
 .. note::
 
     api_key can be found in your user account page
 
 
 RhodeCode API will return always a JSON-RPC response::
 
     {   
         "id":<id>,
         "result": "<result>",
         "error": null
     }
 
 All responses from API will be `HTTP/1.0 200 OK`, if there's an error while
 calling api *error* key from response will contain failure description
 and result will be null.
 
 API METHODS
 +++++++++++
 
 
 pull
 ----
 
 Pulls given repo from remote location. Can be used to automatically keep
 remote repos up to date. This command can be executed only using api_key
 belonging to user with admin rights
 
 INPUT::
 
     api_key : "<api_key>"
     method :  "pull"
     args :    {
                 "repo_name" : "<reponame>"
               }
 
 OUTPUT::
 
     result : "Pulled from <reponame>"
     error :  null
 
 
 get_user
 --------
 
 Get's an user by username, Returns empty result if user is not found.
 This command can be executed only using api_key belonging to user with admin 
 rights.
 
 
 INPUT::
 
     api_key : "<api_key>"
     method :  "get_user"
     args :    { 
                 "username" : "<username>"
               }
 
 OUTPUT::
 
     result: None if user does not exist or 
             {
                 "id" :       "<id>",
                 "username" : "<username>",
                 "firstname": "<firstname>",
                 "lastname" : "<lastname>",
                 "email" :    "<email>",
                 "active" :   "<bool>",
                 "admin" :    "<bool>",
                 "ldap" :     "<ldap_dn>"
             }
 
     error:  null
 
 
 get_users
 ---------
 
 Lists all existing users. This command can be executed only using api_key
 belonging to user with admin rights.
 
 
 INPUT::
 
     api_key : "<api_key>"
     method :  "get_users"
     args :    { }
 
 OUTPUT::
 
     result: [
               {
                 "id" :       "<id>",
                 "username" : "<username>",
                 "firstname": "<firstname>",
                 "lastname" : "<lastname>",
                 "email" :    "<email>",
                 "active" :   "<bool>",
                 "admin" :    "<bool>",
                 "ldap" :     "<ldap_dn>"
               },
     	      …
             ]
     error:  null
 
 
 create_user
 -----------
 
 Creates new user or updates current one if such user exists. This command can 
 be executed only using api_key belonging to user with admin rights.
 
 
 INPUT::
 
     api_key : "<api_key>"
     method :  "create_user"
     args :    {
                 "username" :  "<username>",
                 "password" :  "<password>",
                 "email" :     "<useremail>",
                 "firstname" : "<firstname> = None",
                 "lastname" :  "<lastname> = None",
                 "active" :    "<bool> = True",
                 "admin" :     "<bool> = False",
                 "ldap_dn" :   "<ldap_dn> = None"
               }
 
 OUTPUT::
 
     result: {
               "id" : "<new_user_id>",
               "msg" : "created new user <username>"
             }
     error:  null
 
 
 get_users_group
 ---------------
 
 Gets an existing users group. This command can be executed only using api_key
 belonging to user with admin rights.
 
 
 INPUT::
 
     api_key : "<api_key>"
     method :  "get_users_group"
     args :    {
                 "group_name" : "<name>"
               }
 
 OUTPUT::
 
     result : None if group not exist
              {
                "id" :         "<id>",
                "group_name" : "<groupname>",
                "active":      "<bool>",
                "members" :  [
                               { "id" :       "<userid>",
                                 "username" : "<username>",
                                 "firstname": "<firstname>",
                                 "lastname" : "<lastname>",
                                 "email" :    "<email>",
                                 "active" :   "<bool>",
                                 "admin" :    "<bool>",
                                 "ldap" :     "<ldap_dn>"
                               },
                               …
                             ]
              }
     error : null
 
 
 get_users_groups
 ----------------
 
 Lists all existing users groups. This command can be executed only using 
 api_key belonging to user with admin rights.
 
 
 INPUT::
 
     api_key : "<api_key>"
     method :  "get_users_groups"
     args :    { }
 
 OUTPUT::
 
     result : [
                {
                  "id" :         "<id>",
                  "group_name" : "<groupname>",
                  "active":      "<bool>",
                  "members" :  [
 	    	                    {
 	    	                      "id" :       "<userid>",
 	                              "username" : "<username>",
 	                              "firstname": "<firstname>",
 	                              "lastname" : "<lastname>",
 	                              "email" :    "<email>",
 	                              "active" :   "<bool>",
 	                              "admin" :    "<bool>",
 	                              "ldap" :     "<ldap_dn>"
 	                            },
 	    	                    …
 	                          ]
 	            }
               ]
     error : null
 
 
 create_users_group
 ------------------
 
 Creates new users group. This command can be executed only using api_key
 belonging to user with admin rights
 
 
 INPUT::
 
     api_key : "<api_key>"
     method :  "create_users_group"
     args:     {
                 "group_name":  "<groupname>",
                 "active":"<bool> = True"
               }
 
 OUTPUT::
 
     result: {
               "id":  "<newusersgroupid>",
               "msg": "created new users group <groupname>"
             }
     error:  null
 
 
 add_user_to_users_group
 -----------------------
 
-Adds a user to a users group. This command can be executed only using api_key
+Adds a user to a users group. If user exists in that group success will be 
+`false`. This command can be executed only using api_key
 belonging to user with admin rights
 
 
 INPUT::
 
     api_key : "<api_key>"
     method :  "add_user_users_group"
     args:     {
                 "group_name" :  "<groupname>",
                 "username" :   "<username>"
               }
 
 OUTPUT::
 
     result: {
               "id":  "<newusersgroupmemberid>",
-              "msg": "created new users group member"
+              "success": True|False # depends on if member is in group
+              "msg": "added member <username> to users group <groupname> | 
+                      User is already in that group"
+            }
+    error:  null
+
+
+remove_user_from_users_group
+----------------------------
+
+Removes a user from a users group. If user is not in given group success will
+be `false`. This command can be executed only 
+using api_key belonging to user with admin rights
+
+
+INPUT::
+
+    api_key : "<api_key>"
+    method :  "remove_user_from_users_group"
+    args:     {
+                "group_name" :  "<groupname>",
+                "username" :   "<username>"
+              }
+
+OUTPUT::
+
+    result: {
+              "success":  True|False,  # depends on if member is in group
+              "msg": "removed member <username> from users group <groupname> | 
+                      User wasn't in group"
             }
     error:  null
 
 
 get_repo
 --------
 
 Gets an existing repository. This command can be executed only using api_key
 belonging to user with admin rights
 
 
 INPUT::
 
     api_key : "<api_key>"
     method :  "get_repo"
     args:     {
                 "repo_name" : "<reponame>"
               }
 
 OUTPUT::
 
     result: None if repository does not exist or
             {
                 "id" :          "<id>",
                 "repo_name" :   "<reponame>"
                 "type" :        "<type>",
                 "description" : "<description>",
                 "members" :     [
                                   { "id" :         "<userid>",
                                     "username" :   "<username>",
                                     "firstname":   "<firstname>",
                                     "lastname" :   "<lastname>",
                                     "email" :      "<email>",
                                     "active" :     "<bool>",
                                     "admin" :      "<bool>",
                                     "ldap" :       "<ldap_dn>",
                                     "permission" : "repository.(read|write|admin)"
                                   },
                                   …
                                   {
                                     "id" :       "<usersgroupid>",
                                     "name" :     "<usersgroupname>",
                                     "active":    "<bool>",
                                     "permission" : "repository.(read|write|admin)"
                                   },
                                   …
                                 ]
             }
     error:  null
 
 
 get_repos
 ---------
 
 Lists all existing repositories. This command can be executed only using api_key
 belonging to user with admin rights
 
 
 INPUT::
 
     api_key : "<api_key>"
     method :  "get_repos"
     args:     { }
 
 OUTPUT::
 
     result: [
               {
                 "id" :          "<id>",
                 "repo_name" :   "<reponame>"
                 "type" :        "<type>",
                 "description" : "<description>"
               },
               …
             ]
     error:  null
 
 
 get_repo_nodes
 --------------
 
 returns a list of nodes and it's children in a flat list for a given path 
 at given revision. It's possible to specify ret_type to show only `files` or 
 `dirs`. This command can be executed only using api_key belonging to user 
 with admin rights
 
 
 INPUT::
 
     api_key : "<api_key>"
     method :  "get_repo_nodes"
     args:     {
                 "repo_name" : "<reponame>",
                 "revision"  : "<revision>",
                 "root_path" : "<root_path>",
                 "ret_type"  : "<ret_type>" = 'all'
               }
 
 OUTPUT::
 
     result: [
               {
                 "name" :        "<name>"
                 "type" :        "<type>",
               },
               …
             ]
     error:  null
 
 
 create_repo
 -----------
 
 Creates a repository. This command can be executed only using api_key
 belonging to user with admin rights.
 If repository name contains "/", all needed repository groups will be created.
 For example "foo/bar/baz" will create groups "foo", "bar" (with "foo" as parent),
 and create "baz" repository with "bar" as group.
 
 
 INPUT::
 
     api_key : "<api_key>"
     method :  "create_repo"
     args:     {
                 "repo_name" :   "<reponame>",
                 "owner_name" :  "<ownername>",
                 "description" : "<description> = ''",
                 "repo_type" :   "<type> = 'hg'",
                 "private" :     "<bool> = False"
               }
 
 OUTPUT::
 
     result: {
               "id": "<newrepoid>",
               "msg": "Created new repository <reponame>",
             }
     error:  null
 
 
 grant_user_permission
 ---------------------
 
 Grant permission for user on given repository, or update existing one
 if found. This command can be executed only using api_key belonging to user 
 with admin rights.
 
 
 INPUT::
 
     api_key : "<api_key>"
     method :  "grant_user_permission"
     args:     {
                 "repo_name" :  "<reponame>",
                 "username" :   "<username>",
                 "perm" :       "(repository.(none|read|write|admin))",
               }
 
 OUTPUT::
 
     result: {
               "msg" : "Granted perm: <perm> for user: <username> in repo: <reponame>"
             }
     error:  null
 
 
 revoke_user_permission
 ----------------------
 
 Revoke permission for user on given repository. This command can be executed 
 only using api_key belonging to user with admin rights.
 
 
 INPUT::
 
     api_key : "<api_key>"
     method  : "revoke_user_permission"
     args:     {
                 "repo_name" :  "<reponame>",
                 "username" :   "<username>",
               }
 
 OUTPUT::
 
     result: {
               "msg" : "Revoked perm for user: <suername> in repo: <reponame>"
             }
     error:  null
 
 
 grant_users_group_permission
 ----------------------------
 
 Grant permission for users group on given repository, or update
 existing one if found. This command can be executed only using 
 api_key belonging to user with admin rights.
 
 
 INPUT::
 
     api_key : "<api_key>"
     method :  "grant_users_group_permission"
     args:     {
                 "repo_name" : "<reponame>",
                 "group_name" : "<usersgroupname>",
                 "perm" : "(repository.(none|read|write|admin))",
               }
 
 OUTPUT::
 
     result: {
               "msg" : "Granted perm: <perm> for group: <usersgroupname> in repo: <reponame>"
             }
     error:  null
     
     
 revoke_users_group_permission
 -----------------------------
 
 Revoke permission for users group on given repository.This command can be 
 executed only using api_key belonging to user with admin rights.
 
 INPUT::
 
     api_key : "<api_key>"
     method  : "revoke_users_group_permission"
     args:     {
                 "repo_name" :  "<reponame>",
                 "users_group" :   "<usersgroupname>",
               }
 
 OUTPUT::
 
     result: {
               "msg" : "Revoked perm for group: <usersgroupname> in repo: <reponame>"
             }
     error:  null
  No newline at end of file

rhodecode/controllers/api/api.py

@@ -1,571 +1,604 b''
 # -*- coding: utf-8 -*-
 """
     rhodecode.controllers.api
     ~~~~~~~~~~~~~~~~~~~~~~~~~
 
     API controller for RhodeCode
 
     :created_on: Aug 20, 2011
     :author: marcink
     :copyright: (C) 2011-2012 Marcin Kuzminski <[e-mail]>
     :license: GPLv3, see COPYING for more details.
 """
 # This program is free software; you can redistribute it and/or
 # modify it under the terms of the GNU General Public License
 # as published by the Free Software Foundation; version 2
 # of the License or (at your opinion) any later version of the license.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
 # MA  02110-1301, USA.
 
 import traceback
 import logging
 
 from sqlalchemy.orm.exc import NoResultFound
 
 from rhodecode.controllers.api import JSONRPCController, JSONRPCError
 from rhodecode.lib.auth import HasPermissionAllDecorator, \
     HasPermissionAnyDecorator
 
 from rhodecode.model.meta import Session
 from rhodecode.model.scm import ScmModel
 from rhodecode.model.db import User, UsersGroup, RepoGroup, Repository
 from rhodecode.model.repo import RepoModel
 from rhodecode.model.user import UserModel
 from rhodecode.model.repo_permission import RepositoryPermissionModel
 from rhodecode.model.users_group import UsersGroupModel
 from rhodecode.model.repos_group import ReposGroupModel
 
 
 log = logging.getLogger(__name__)
 
 
 class ApiController(JSONRPCController):
     """
     API Controller
 
 
     Each method needs to have USER as argument this is then based on given
     API_KEY propagated as instance of user object
 
     Preferably this should be first argument also
 
 
     Each function should also **raise** JSONRPCError for any
     errors that happens
 
     """
 
     @HasPermissionAllDecorator('hg.admin')
     def pull(self, apiuser, repo_name):
         """
         Dispatch pull action on given repo
 
 
         :param user:
         :param repo_name:
         """
 
         if Repository.is_valid(repo_name) is False:
             raise JSONRPCError('Unknown repo "%s"' % repo_name)
 
         try:
             ScmModel().pull_changes(repo_name, self.rhodecode_user.username)
             return 'Pulled from %s' % repo_name
         except Exception:
             raise JSONRPCError('Unable to pull changes from "%s"' % repo_name)
 
     @HasPermissionAllDecorator('hg.admin')
     def get_user(self, apiuser, username):
         """"
         Get a user by username
 
         :param apiuser:
         :param username:
         """
 
         user = User.get_by_username(username)
-        if not user:
-            return None
+        if user is None:
+            return user
 
         return dict(
             id=user.user_id,
             username=user.username,
             firstname=user.name,
             lastname=user.lastname,
             email=user.email,
             active=user.active,
             admin=user.admin,
             ldap=user.ldap_dn
         )
 
     @HasPermissionAllDecorator('hg.admin')
     def get_users(self, apiuser):
         """"
         Get all users
 
         :param apiuser:
         """
 
         result = []
         for user in User.getAll():
             result.append(
                 dict(
                     id=user.user_id,
                     username=user.username,
                     firstname=user.name,
                     lastname=user.lastname,
                     email=user.email,
                     active=user.active,
                     admin=user.admin,
                     ldap=user.ldap_dn
                 )
             )
         return result
 
     @HasPermissionAllDecorator('hg.admin')
     def create_user(self, apiuser, username, password, email, firstname=None,
                     lastname=None, active=True, admin=False, ldap_dn=None):
         """
         Create new user or updates current one
 
         :param apiuser:
         :param username:
         :param password:
         :param email:
         :param name:
         :param lastname:
         :param active:
         :param admin:
         :param ldap_dn:
         """
 
         if User.get_by_username(username):
             raise JSONRPCError("user %s already exist" % username)
 
         try:
             usr = UserModel().create_or_update(
                 username, password, email, firstname,
                 lastname, active, admin, ldap_dn
             )
             Session.commit()
             return dict(
                 id=usr.user_id,
                 msg='created new user %s' % username
             )
         except Exception:
             log.error(traceback.format_exc())
             raise JSONRPCError('failed to create user %s' % username)
 
     @HasPermissionAllDecorator('hg.admin')
     def get_users_group(self, apiuser, group_name):
         """"
         Get users group by name
 
         :param apiuser:
         :param group_name:
         """
 
         users_group = UsersGroup.get_by_group_name(group_name)
         if not users_group:
             return None
 
         members = []
         for user in users_group.members:
             user = user.user
             members.append(dict(id=user.user_id,
                             username=user.username,
                             firstname=user.name,
                             lastname=user.lastname,
                             email=user.email,
                             active=user.active,
                             admin=user.admin,
                             ldap=user.ldap_dn))
 
         return dict(id=users_group.users_group_id,
                     group_name=users_group.users_group_name,
                     active=users_group.users_group_active,
                     members=members)
 
     @HasPermissionAllDecorator('hg.admin')
     def get_users_groups(self, apiuser):
         """"
         Get all users groups
 
         :param apiuser:
         """
 
         result = []
         for users_group in UsersGroup.getAll():
             members = []
             for user in users_group.members:
                 user = user.user
                 members.append(dict(id=user.user_id,
                                 username=user.username,
                                 firstname=user.name,
                                 lastname=user.lastname,
                                 email=user.email,
                                 active=user.active,
                                 admin=user.admin,
                                 ldap=user.ldap_dn))
 
             result.append(dict(id=users_group.users_group_id,
                                 group_name=users_group.users_group_name,
                                 active=users_group.users_group_active,
                                 members=members))
         return result
 
     @HasPermissionAllDecorator('hg.admin')
     def create_users_group(self, apiuser, group_name, active=True):
         """
         Creates an new usergroup
 
         :param group_name:
         :param active:
         """
 
         if self.get_users_group(apiuser, group_name):
             raise JSONRPCError("users group %s already exist" % group_name)
 
         try:
             ug = UsersGroupModel().create(name=group_name, active=active)
             Session.commit()
             return dict(id=ug.users_group_id,
                         msg='created new users group %s' % group_name)
         except Exception:
             log.error(traceback.format_exc())
             raise JSONRPCError('failed to create group %s' % group_name)
 
     @HasPermissionAllDecorator('hg.admin')
     def add_user_to_users_group(self, apiuser, group_name, username):
         """"
         Add a user to a group
 
         :param apiuser:
         :param group_name:
         :param username:
         """
 
         try:
             users_group = UsersGroup.get_by_group_name(group_name)
             if not users_group:
                 raise JSONRPCError('unknown users group %s' % group_name)
 
-            try:
-                user = User.get_by_username(username)
-            except NoResultFound:
+            user = User.get_by_username(username)
+            if user is None:
                 raise JSONRPCError('unknown user %s' % username)
 
             ugm = UsersGroupModel().add_user_to_group(users_group, user)
+            success = True if ugm != True else False
+            msg = 'added member %s to users group %s' % (username, group_name)
+            msg = msg if success else 'User is already in that group'
             Session.commit()
-            return dict(id=ugm.users_group_member_id,
-                        msg='created new users group member')
+
+            return dict(
+                id=ugm.users_group_member_id if ugm != True else None,
+                success=success,
+                msg=msg
+            )
         except Exception:
             log.error(traceback.format_exc())
-            raise JSONRPCError('failed to create users group member')
+            raise JSONRPCError('failed to add users group member')
+
+    @HasPermissionAllDecorator('hg.admin')
+    def remove_user_from_users_group(self, apiuser, group_name, username):
+        """
+        Remove user from a group
+
+        :param apiuser
+        :param group_name
+        :param username
+        """
+
+        try:
+            users_group = UsersGroup.get_by_group_name(group_name)
+            if not users_group:
+                raise JSONRPCError('unknown users group %s' % group_name)
+
+            user = User.get_by_username(username)
+            if user is None:
+                raise JSONRPCError('unknown user %s' % username)
+
+            success = UsersGroupModel().remove_user_from_group(users_group, user)
+            msg = 'removed member %s from users group %s' % (username, group_name)
+            msg = msg if success else "User wasn't in group"
+            Session.commit()
+            return dict(success=success, msg=msg)
+        except Exception:
+            log.error(traceback.format_exc())
+            raise JSONRPCError('failed to remove user from group')
 
     @HasPermissionAnyDecorator('hg.admin')
     def get_repo(self, apiuser, repo_name):
         """"
         Get repository by name
 
         :param apiuser:
         :param repo_name:
         """
 
         repo = Repository.get_by_repo_name(repo_name)
         if repo is None:
             raise JSONRPCError('unknown repository %s' % repo)
 
         members = []
         for user in repo.repo_to_perm:
             perm = user.permission.permission_name
             user = user.user
             members.append(
                 dict(
                     type_="user",
                     id=user.user_id,
                     username=user.username,
                     firstname=user.name,
                     lastname=user.lastname,
                     email=user.email,
                     active=user.active,
                     admin=user.admin,
                     ldap=user.ldap_dn,
                     permission=perm
                 )
             )
         for users_group in repo.users_group_to_perm:
             perm = users_group.permission.permission_name
             users_group = users_group.users_group
             members.append(
                 dict(
                     type_="users_group",
                     id=users_group.users_group_id,
                     name=users_group.users_group_name,
                     active=users_group.users_group_active,
                     permission=perm
                 )
             )
 
         return dict(
             id=repo.repo_id,
             repo_name=repo.repo_name,
             type=repo.repo_type,
             description=repo.description,
             members=members
         )
 
     @HasPermissionAnyDecorator('hg.admin')
     def get_repos(self, apiuser):
         """"
         Get all repositories
 
         :param apiuser:
         """
 
         result = []
         for repository in Repository.getAll():
             result.append(
                 dict(
                     id=repository.repo_id,
                     repo_name=repository.repo_name,
                     type=repository.repo_type,
                     description=repository.description
                 )
             )
         return result
 
     @HasPermissionAnyDecorator('hg.admin')
     def get_repo_nodes(self, apiuser, repo_name, revision, root_path,
                        ret_type='all'):
         """
         returns a list of nodes and it's children
         for a given path at given revision. It's possible to specify ret_type
         to show only files or dirs
 
         :param apiuser:
         :param repo_name: name of repository
         :param revision: revision for which listing should be done
         :param root_path: path from which start displaying
         :param ret_type: return type 'all|files|dirs' nodes
         """
         try:
             _d, _f = ScmModel().get_nodes(repo_name, revision, root_path,
                                           flat=False)
             _map = {
                 'all': _d + _f,
                 'files': _f,
                 'dirs': _d,
             }
             return _map[ret_type]
         except KeyError:
             raise JSONRPCError('ret_type must be one of %s' % _map.keys())
         except Exception, e:
             raise JSONRPCError(e)
 
     @HasPermissionAnyDecorator('hg.admin', 'hg.create.repository')
     def create_repo(self, apiuser, repo_name, owner_name, description='',
                     repo_type='hg', private=False):
         """
         Create a repository
 
         :param apiuser:
         :param repo_name:
         :param description:
         :param type:
         :param private:
         :param owner_name:
         """
 
         try:
-            try:
-                owner = User.get_by_username(owner_name)
-            except NoResultFound:
-                raise JSONRPCError('unknown user %s' % owner)
+            owner = User.get_by_username(owner_name)
+            if owner is None:
+                raise JSONRPCError('unknown user %s' % owner_name)
 
             if Repository.get_by_repo_name(repo_name):
                 raise JSONRPCError("repo %s already exist" % repo_name)
 
             groups = repo_name.split('/')
             real_name = groups[-1]
             groups = groups[:-1]
             parent_id = None
             for g in groups:
                 group = RepoGroup.get_by_group_name(g)
                 if not group:
                     group = ReposGroupModel().create(g, '', parent_id)
                 parent_id = group.group_id
 
             repo = RepoModel().create(
                 dict(
                     repo_name=real_name,
                     repo_name_full=repo_name,
                     description=description,
                     private=private,
                     repo_type=repo_type,
                     repo_group=parent_id,
                     clone_uri=None
                 ),
                 owner
             )
             Session.commit()
 
             return dict(
                 id=repo.repo_id,
                 msg="Created new repository %s" % repo.repo_name
             )
 
         except Exception:
             log.error(traceback.format_exc())
             raise JSONRPCError('failed to create repository %s' % repo_name)
 
     @HasPermissionAnyDecorator('hg.admin')
     def grant_user_permission(self, repo_name, username, perm):
         """
         Grant permission for user on given repository, or update existing one
         if found
 
         :param repo_name:
         :param username:
         :param perm:
         """
 
         try:
             repo = Repository.get_by_repo_name(repo_name)
             if repo is None:
                 raise JSONRPCError('unknown repository %s' % repo)
 
             user = User.get_by_username(username)
             if user is None:
                 raise JSONRPCError('unknown user %s' % username)
 
             RepoModel().grant_user_permission(repo=repo, user=user, perm=perm)
 
             Session.commit()
             return dict(
                 msg='Granted perm: %s for user: %s in repo: %s' % (
                     perm, username, repo_name
                 )
             )
         except Exception:
             log.error(traceback.format_exc())
             raise JSONRPCError(
                 'failed to edit permission %(repo)s for %(user)s' % dict(
                     user=username, repo=repo_name
                 )
             )
 
     @HasPermissionAnyDecorator('hg.admin')
     def revoke_user_permission(self, repo_name, username):
         """
         Revoke permission for user on given repository
 
         :param repo_name:
         :param username:
         """
 
         try:
             repo = Repository.get_by_repo_name(repo_name)
             if repo is None:
                 raise JSONRPCError('unknown repository %s' % repo)
 
             user = User.get_by_username(username)
             if user is None:
                 raise JSONRPCError('unknown user %s' % username)
 
             RepoModel().revoke_user_permission(repo=repo_name, user=username)
 
             Session.commit()
             return dict(
                 msg='Revoked perm for user: %s in repo: %s' % (
                     username, repo_name
                 )
             )
         except Exception:
             log.error(traceback.format_exc())
             raise JSONRPCError(
                 'failed to edit permission %(repo)s for %(user)s' % dict(
                     user=username, repo=repo_name
                 )
             )
 
     @HasPermissionAnyDecorator('hg.admin')
     def grant_users_group_permission(self, repo_name, group_name, perm):
         """
         Grant permission for users group on given repository, or update
         existing one if found
 
         :param repo_name:
         :param group_name:
         :param perm:
         """
 
         try:
             repo = Repository.get_by_repo_name(repo_name)
             if repo is None:
                 raise JSONRPCError('unknown repository %s' % repo)
 
             user_group = UsersGroup.get_by_group_name(group_name)
             if user_group is None:
                 raise JSONRPCError('unknown users group %s' % user_group)
 
             RepoModel().grant_users_group_permission(repo=repo_name,
                                                      group_name=group_name,
                                                      perm=perm)
 
             Session.commit()
             return dict(
                 msg='Granted perm: %s for group: %s in repo: %s' % (
                     perm, group_name, repo_name
                 )
             )
         except Exception:
             log.error(traceback.format_exc())
             raise JSONRPCError(
                 'failed to edit permission %(repo)s for %(usersgr)s' % dict(
                     usersgr=group_name, repo=repo_name
                 )
             )
 
     @HasPermissionAnyDecorator('hg.admin')
     def revoke_users_group_permission(self, repo_name, group_name):
         """
         Revoke permission for users group on given repository
 
         :param repo_name:
         :param group_name:
         """
 
         try:
             repo = Repository.get_by_repo_name(repo_name)
             if repo is None:
                 raise JSONRPCError('unknown repository %s' % repo)
 
             user_group = UsersGroup.get_by_group_name(group_name)
             if user_group is None:
                 raise JSONRPCError('unknown users group %s' % user_group)
 
             RepoModel().revoke_users_group_permission(repo=repo_name,
                                                       group_name=group_name)
 
             Session.commit()
             return dict(
                 msg='Revoked perm for group: %s in repo: %s' % (
                     group_name, repo_name
                 )
             )
         except Exception:
             log.error(traceback.format_exc())
             raise JSONRPCError(
                 'failed to edit permission %(repo)s for %(usersgr)s' % dict(
                     usersgr=group_name, repo=repo_name
                 )
             )

rhodecode/model/users_group.py

@@ -1,160 +1,188 b''
 # -*- coding: utf-8 -*-
 """
     rhodecode.model.users_group
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
     users group model for RhodeCode
 
     :created_on: Oct 1, 2011
     :author: nvinot
     :copyright: (C) 2011-2011 Nicolas Vinot <[e-mail]>
     :copyright: (C) 2010-2012 Marcin Kuzminski <[e-mail]>
     :license: GPLv3, see COPYING for more details.
 """
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation, either version 3 of the License, or
 # (at your option) any later version.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import logging
 import traceback
 
 from rhodecode.model import BaseModel
 from rhodecode.model.db import UsersGroupMember, UsersGroup,\
-    UsersGroupRepoToPerm, Permission, UsersGroupToPerm
+    UsersGroupRepoToPerm, Permission, UsersGroupToPerm, User
 from rhodecode.lib.exceptions import UsersGroupsAssignedException
 
 log = logging.getLogger(__name__)
 
 
 class UsersGroupModel(BaseModel):
 
+    def __get_user(self, user):
+        return self._get_instance(User, user, callback=User.get_by_username)
+
     def __get_users_group(self, users_group):
         return self._get_instance(UsersGroup, users_group,
                                   callback=UsersGroup.get_by_group_name)
 
     def __get_perm(self, permission):
         return self._get_instance(Permission, permission,
                                   callback=Permission.get_by_key)
 
     def get(self, users_group_id, cache=False):
         return UsersGroup.get(users_group_id)
 
     def get_by_name(self, name, cache=False, case_insensitive=False):
         return UsersGroup.get_by_group_name(name, cache, case_insensitive)
 
     def create(self, name, active=True):
         try:
             new = UsersGroup()
             new.users_group_name = name
             new.users_group_active = active
             self.sa.add(new)
             return new
         except:
             log.error(traceback.format_exc())
             raise
 
     def update(self, users_group, form_data):
 
         try:
             users_group = self.__get_users_group(users_group)
 
             for k, v in form_data.items():
                 if k == 'users_group_members':
                     users_group.members = []
                     self.sa.flush()
                     members_list = []
                     if v:
                         v = [v] if isinstance(v, basestring) else v
                         for u_id in set(v):
                             member = UsersGroupMember(users_group.users_group_id, u_id)
                             members_list.append(member)
                     setattr(users_group, 'members', members_list)
                 setattr(users_group, k, v)
 
             self.sa.add(users_group)
         except:
             log.error(traceback.format_exc())
             raise
 
     def delete(self, users_group, force=False):
         """
         Deletes repos group, unless force flag is used
         raises exception if there are members in that group, else deletes
         group and users
 
         :param users_group:
         :param force:
         """
         try:
             users_group = self.__get_users_group(users_group)
 
             # check if this group is not assigned to repo
             assigned_groups = UsersGroupRepoToPerm.query()\
                 .filter(UsersGroupRepoToPerm.users_group == users_group).all()
 
             if assigned_groups and force is False:
                 raise UsersGroupsAssignedException('RepoGroup assigned to %s' %
                                                    assigned_groups)
 
             self.sa.delete(users_group)
         except:
             log.error(traceback.format_exc())
             raise
 
     def add_user_to_group(self, users_group, user):
+        users_group = self.__get_users_group(users_group)
+        user = self.__get_user(user)
+
         for m in users_group.members:
             u = m.user
             if u.user_id == user.user_id:
-                return m
+                return True
 
         try:
             users_group_member = UsersGroupMember()
             users_group_member.user = user
             users_group_member.users_group = users_group
 
             users_group.members.append(users_group_member)
             user.group_member.append(users_group_member)
 
             self.sa.add(users_group_member)
             return users_group_member
         except:
             log.error(traceback.format_exc())
             raise
 
+    def remove_user_from_group(self, users_group, user):
+        users_group = self.__get_users_group(users_group)
+        user = self.__get_user(user)
+
+        users_group_member = None
+        for m in users_group.members:
+            if m.user.user_id == user.user_id:
+                # Found this user's membership row
+                users_group_member = m
+                break
+
+        if users_group_member:
+            try:
+                self.sa.delete(users_group_member)
+                return True
+            except:
+                log.error(traceback.format_exc())
+                raise
+        else:
+            # User isn't in that group
+            return False
+
     def has_perm(self, users_group, perm):
         users_group = self.__get_users_group(users_group)
         perm = self.__get_perm(perm)
 
         return UsersGroupToPerm.query()\
             .filter(UsersGroupToPerm.users_group == users_group)\
             .filter(UsersGroupToPerm.permission == perm).scalar() is not None
 
     def grant_perm(self, users_group, perm):
         if not isinstance(perm, Permission):
             raise Exception('perm needs to be an instance of Permission class')
 
         users_group = self.__get_users_group(users_group)
 
         new = UsersGroupToPerm()
         new.users_group = users_group
         new.permission = perm
         self.sa.add(new)
 
     def revoke_perm(self, users_group, perm):
         users_group = self.__get_users_group(users_group)
         perm = self.__get_perm(perm)
 
         obj = UsersGroupToPerm.query()\
             .filter(UsersGroupToPerm.users_group == users_group)\
             .filter(UsersGroupToPerm.permission == perm).scalar()
         if obj:
             self.sa.delete(obj)