permission refactoring,

Implemented views for default permissions,
fixes  #23 user registration is controlled by permission system.
Implemented manual registration option
websetup fills default permissions

pylons_app/model/permission_model.py

@@ -0,0 +1,51 b''
+#!/usr/bin/env python
+# encoding: utf-8
+# Model for permissions
+# Copyright (C) 2009-2010 Marcin Kuzminski <[e-mail]>
+ 
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; version 2
+# of the License or (at your opinion) any later version of the license.
+# 
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
+# MA  02110-1301, USA.
+"""
+Created on Aug 20, 2010
+Model for permissions
+@author: marcink
+"""
+
+from pylons.i18n.translation import _
+from pylons_app.model.db import User, Permission
+from pylons_app.model.meta import Session
+import logging
+log = logging.getLogger(__name__)
+
+
+class PermissionModel(object):
+
+    def __init__(self):
+        self.sa = Session() 
+    
+    def get_default(self):
+        return self.sa.query(User).filter(User.username == 'default').scalar()
+    
+    def get_permission(self, id):
+        return self.sa.query(Permission).get(id)
+    
+    def get_permission_by_name(self, name):
+        return self.sa.query(Permission)\
+        .filter(Permission.permission_name == name).scalar()
+    
+    
+    def update(self, form_result):
+        print form_result
+        pass

pylons_app/controllers/admin/permissions.py

@@ -1,90 +1,162 b''
 #!/usr/bin/env python
 # encoding: utf-8
 # permissions controller for pylons
 # Copyright (C) 2009-2010 Marcin Kuzminski <[e-mail]>
- 
+#
 # This program is free software; you can redistribute it and/or
 # modify it under the terms of the GNU General Public License
 # as published by the Free Software Foundation; version 2
 # of the License or (at your opinion) any later version of the license.
 # 
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 # 
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
 # MA  02110-1301, USA.
 """
 Created on April 27, 2010
 permissions controller for pylons
 @author: marcink
 """
+
 from formencode import htmlfill
 from pylons import request, session, tmpl_context as c, url
 from pylons.controllers.util import abort, redirect
 from pylons.i18n.translation import _
 from pylons_app.lib import helpers as h
 from pylons_app.lib.auth import LoginRequired, HasPermissionAllDecorator
 from pylons_app.lib.base import BaseController, render
 from pylons_app.model.db import User, UserLog
-from pylons_app.model.forms import UserForm
+from pylons_app.model.forms import UserForm, DefaultPermissionsForm
+from pylons_app.model.permission_model import PermissionModel
 from pylons_app.model.user_model import UserModel
 import formencode
 import logging
+import traceback
 
 log = logging.getLogger(__name__)
 
 class PermissionsController(BaseController):
     """REST Controller styled on the Atom Publishing Protocol"""
     # To properly map this controller, ensure your config/routing.py
     # file has a resource setup:
     #     map.resource('permission', 'permissions')
     
     @LoginRequired()
-    #@HasPermissionAllDecorator('hg.admin')
+    @HasPermissionAllDecorator('hg.admin')
     def __before__(self):
         c.admin_user = session.get('admin_user')
         c.admin_username = session.get('admin_username')
         super(PermissionsController, self).__before__()
         
+        self.perms_choices = [('repository.none', _('None'),),
+                              ('repository.read', _('Read'),),
+                              ('repository.write', _('Write'),),
+                              ('repository.admin', _('Admin'),)]
+        self.register_choices = [
+            ('hg.register.none', 'disabled'),
+            ('hg.register.manual_activate',
+                            _('allowed with manual account activation')),
+            ('hg.register.auto_activate',
+                            _('allowed with automatic account activation')), ]
+        
+        self.create_choices = [('hg.create.none', _('Disabled')),
+                               ('hg.create.repository', _('Enabled'))]     
+
+        
     def index(self, format='html'):
         """GET /permissions: All items in the collection"""
         # url('permissions')
-        return render('admin/permissions/permissions.html')
 
     def create(self):
         """POST /permissions: Create a new item"""
         # url('permissions')
 
     def new(self, format='html'):
         """GET /permissions/new: Form to create a new item"""
         # url('new_permission')
 
     def update(self, id):
         """PUT /permissions/id: Update an existing item"""
         # Forms posted to this method should contain a hidden field:
         #    <input type="hidden" name="_method" value="PUT" />
         # Or using helpers:
         #    h.form(url('permission', id=ID),
         #           method='put')
         # url('permission', id=ID)
+                
+        permission_model = PermissionModel()
+        
+        _form = DefaultPermissionsForm([x[0] for x in self.perms_choices],
+                                       [x[0] for x in self.register_choices],
+                                       [x[0] for x in self.create_choices])()
+        
+        try:
+            form_result = _form.to_python(dict(request.POST))
+            permission_model.update(form_result)
+            h.flash(_('Default permissions updated succesfully'),
+                    category='success')
+                           
+        except formencode.Invalid as errors:
+            c.perms_choices = self.perms_choices
+            c.register_choices = self.register_choices
+            c.create_choices = self.create_choices
+                    
+            return htmlfill.render(
+                render('admin/permissions/permissions.html'),
+                defaults=errors.value,
+                errors=errors.error_dict or {},
+                prefix_error=False,
+                encoding="UTF-8") 
+        except Exception:
+            log.error(traceback.format_exc())
+            h.flash(_('error occured during update of permissions'),
+                    category='error')
+            
+        return redirect(url('edit_permission', id=id))
+            
+
 
     def delete(self, id):
         """DELETE /permissions/id: Delete an existing item"""
         # Forms posted to this method should contain a hidden field:
         #    <input type="hidden" name="_method" value="DELETE" />
         # Or using helpers:
         #    h.form(url('permission', id=ID),
         #           method='delete')
         # url('permission', id=ID)
 
     def show(self, id, format='html'):
         """GET /permissions/id: Show a specific item"""
         # url('permission', id=ID)
 
     def edit(self, id, format='html'):
         """GET /permissions/id/edit: Form to edit an existing item"""
-        # url('edit_permission', id=ID)
+        #url('edit_permission', id=ID)
+        c.perms_choices = self.perms_choices
+        c.register_choices = self.register_choices
+        c.create_choices = self.create_choices
+        
+        if id == 'default':
+            defaults = {'_method':'put'}
+            for p in UserModel().get_default().user_perms:
+                if p.permission.permission_name.startswith('repository.'):
+                    defaults['default_perm'] = p.permission.permission_name 
+                
+                if p.permission.permission_name.startswith('hg.register.'):
+                    defaults['default_register'] = p.permission.permission_name
+                    
+                if p.permission.permission_name.startswith('hg.create.'):
+                    defaults['default_create'] = p.permission.permission_name
+                             
+            return htmlfill.render(
+                        render('admin/permissions/permissions.html'),
+                        defaults=defaults,
+                        encoding="UTF-8",
+                        force_defaults=True,)        
+        else:
+            return redirect(url('admin_home'))

pylons_app/controllers/admin/repos.py

@@ -1,234 +1,234 b''
 #!/usr/bin/env python
 # encoding: utf-8
 # repos controller for pylons
 # Copyright (C) 2009-2010 Marcin Kuzminski <[e-mail]>
 #
 # This program is free software; you can redistribute it and/or
 # modify it under the terms of the GNU General Public License
 # as published by the Free Software Foundation; version 2
 # of the License or (at your opinion) any later version of the license.
 # 
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 # 
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
 # MA  02110-1301, USA.
 """
 Created on April 7, 2010
 admin controller for pylons
 @author: marcink
 """
 from formencode import htmlfill
 from operator import itemgetter
 from paste.httpexceptions import HTTPInternalServerError
 from pylons import request, response, session, tmpl_context as c, url
 from pylons.controllers.util import abort, redirect
 from pylons.i18n.translation import _
 from pylons_app.lib import helpers as h
 from pylons_app.lib.auth import LoginRequired, HasPermissionAllDecorator, \
     HasPermissionAnyDecorator
 from pylons_app.lib.base import BaseController, render
 from pylons_app.lib.utils import invalidate_cache
 from pylons_app.model.db import User
 from pylons_app.model.forms import RepoForm
 from pylons_app.model.hg_model import HgModel
 from pylons_app.model.repo_model import RepoModel
 import formencode
 import logging
 import traceback
 
 log = logging.getLogger(__name__)
 
 class ReposController(BaseController):
     """REST Controller styled on the Atom Publishing Protocol"""
     # To properly map this controller, ensure your config/routing.py
     # file has a resource setup:
     #     map.resource('repo', 'repos')
     
     @LoginRequired()
-    @HasPermissionAnyDecorator('hg.admin', 'repository.create')
+    @HasPermissionAnyDecorator('hg.admin', 'hg.create.repository')
     def __before__(self):
         c.admin_user = session.get('admin_user')
         c.admin_username = session.get('admin_username')
         super(ReposController, self).__before__()
     
     @HasPermissionAllDecorator('hg.admin')            
     def index(self, format='html'):
         """GET /repos: All items in the collection"""
         # url('repos')
         cached_repo_list = HgModel().get_repos()
         c.repos_list = sorted(cached_repo_list, key=itemgetter('name_sort'))
         return render('admin/repos/repos.html')
     
-    @HasPermissionAnyDecorator('hg.admin', 'repository.create')
+    @HasPermissionAnyDecorator('hg.admin', 'hg.create.repository')
     def create(self):
         """POST /repos: Create a new item"""
         # url('repos')
         repo_model = RepoModel()
         _form = RepoForm()()
         form_result = {}
         try:
             form_result = _form.to_python(dict(request.POST))
             repo_model.create(form_result, c.hg_app_user)
             invalidate_cache('cached_repo_list')
             h.flash(_('created repository %s') % form_result['repo_name'],
                     category='success')
                                                              
         except formencode.Invalid as errors:
             c.new_repo = errors.value['repo_name']
             
             if request.POST.get('user_created'):
                 r = render('admin/repos/repo_add_create_repository.html')
             else:
                 r = render('admin/repos/repo_add.html')
             
             return htmlfill.render(
                 r,
                 defaults=errors.value,
                 errors=errors.error_dict or {},
                 prefix_error=False,
                 encoding="UTF-8")      
 
         except Exception:
             log.error(traceback.format_exc())
             msg = _('error occured during creation of repository %s') \
                     % form_result.get('repo_name')
             h.flash(msg, category='error')
         if request.POST.get('user_created'):
             return redirect(url('hg_home'))    
         return redirect(url('repos'))
     
     @HasPermissionAllDecorator('hg.admin')
     def new(self, format='html'):
         """GET /repos/new: Form to create a new item"""
         new_repo = request.GET.get('repo', '')
         c.new_repo = h.repo_name_slug(new_repo)
 
         return render('admin/repos/repo_add.html')
     
     @HasPermissionAllDecorator('hg.admin')
     def update(self, repo_name):
         """PUT /repos/repo_name: Update an existing item"""
         # Forms posted to this method should contain a hidden field:
         #    <input type="hidden" name="_method" value="PUT" />
         # Or using helpers:
         #    h.form(url('repo', repo_name=ID),
         #           method='put')
         # url('repo', repo_name=ID)
         repo_model = RepoModel()
         changed_name = repo_name
         _form = RepoForm(edit=True, old_data={'repo_name':repo_name})()
         
         try:
             form_result = _form.to_python(dict(request.POST))
             repo_model.update(repo_name, form_result)
             invalidate_cache('cached_repo_list')
             h.flash(_('Repository %s updated succesfully' % repo_name),
                     category='success')
             changed_name = form_result['repo_name']
         except formencode.Invalid as errors:
             c.repo_info = repo_model.get(repo_name)
             c.users_array = repo_model.get_users_js()
             errors.value.update({'user':c.repo_info.user.username})
             return htmlfill.render(
                 render('admin/repos/repo_edit.html'),
                 defaults=errors.value,
                 errors=errors.error_dict or {},
                 prefix_error=False,
                 encoding="UTF-8")
  
         except Exception:
             log.error(traceback.format_exc())
             h.flash(_('error occured during update of repository %s') \
                     % repo_name, category='error')
             
         return redirect(url('edit_repo', repo_name=changed_name))
     
     @HasPermissionAllDecorator('hg.admin')
     def delete(self, repo_name):
         """DELETE /repos/repo_name: Delete an existing item"""
         # Forms posted to this method should contain a hidden field:
         #    <input type="hidden" name="_method" value="DELETE" />
         # Or using helpers:
         #    h.form(url('repo', repo_name=ID),
         #           method='delete')
         # url('repo', repo_name=ID)
         
         repo_model = RepoModel()
         repo = repo_model.get(repo_name)
         if not repo:
             h.flash(_('%s repository is not mapped to db perhaps' 
                       ' it was moved or renamed  from the filesystem'
                       ' please run the application again'
                       ' in order to rescan repositories') % repo_name,
                       category='error')
         
             return redirect(url('repos'))
         try:
             repo_model.delete(repo)            
             invalidate_cache('cached_repo_list')
             h.flash(_('deleted repository %s') % repo_name, category='success')
         except Exception:
             h.flash(_('An error occured during deletion of %s') % repo_name,
                     category='error')
         
         return redirect(url('repos'))
     
     @HasPermissionAllDecorator('hg.admin')        
     def delete_perm_user(self, repo_name):
         """
         DELETE an existing repository permission user
         @param repo_name:
         """
         
         try:
             repo_model = RepoModel()
             repo_model.delete_perm_user(request.POST, repo_name)            
         except Exception as e:
             h.flash(_('An error occured during deletion of repository user'),
                     category='error')
             raise HTTPInternalServerError()
     
     @HasPermissionAllDecorator('hg.admin')    
     def show(self, repo_name, format='html'):
         """GET /repos/repo_name: Show a specific item"""
         # url('repo', repo_name=ID)
     
     @HasPermissionAllDecorator('hg.admin')    
     def edit(self, repo_name, format='html'):
         """GET /repos/repo_name/edit: Form to edit an existing item"""
         # url('edit_repo', repo_name=ID)
         repo_model = RepoModel()
         c.repo_info = repo = repo_model.get(repo_name)
         if not repo:
             h.flash(_('%s repository is not mapped to db perhaps' 
                       ' it was created or renamed from the filesystem'
                       ' please run the application again'
                       ' in order to rescan repositories') % repo_name,
                       category='error')
         
             return redirect(url('repos'))        
         defaults = c.repo_info.__dict__
         if c.repo_info.user:
             defaults.update({'user':c.repo_info.user.username})
         else:
             replacement_user = self.sa.query(User)\
             .filter(User.admin == True).first().username
             defaults.update({'user':replacement_user})
             
         c.users_array = repo_model.get_users_js()
         
         for p in c.repo_info.repo_to_perm:
             defaults.update({'perm_%s' % p.user.username: 
                              p.permission.permission_name})
             
         return htmlfill.render(
             render('admin/repos/repo_edit.html'),
             defaults=defaults,
             encoding="UTF-8",
             force_defaults=False
         )          

pylons_app/controllers/admin/settings.py

@@ -1,281 +1,281 b''
 #!/usr/bin/env python
 # encoding: utf-8
 # settings controller for pylons
 # Copyright (C) 2009-2010 Marcin Kuzminski <[e-mail]>
 #
 # This program is free software; you can redistribute it and/or
 # modify it under the terms of the GNU General Public License
 # as published by the Free Software Foundation; version 2
 # of the License or (at your opinion) any later version of the license.
 # 
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 # 
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
 # MA  02110-1301, USA.
 """
 Created on July 14, 2010
 settings controller for pylons
 @author: marcink
 """
 from formencode import htmlfill
 from pylons import request, session, tmpl_context as c, url, app_globals as g, \
     config
 from pylons.controllers.util import abort, redirect
 from pylons.i18n.translation import _
 from pylons_app.lib import helpers as h
 from pylons_app.lib.auth import LoginRequired, HasPermissionAllDecorator, \
     HasPermissionAnyDecorator
 from pylons_app.lib.base import BaseController, render
 from pylons_app.lib.utils import repo2db_mapper, invalidate_cache, \
     set_hg_app_config, get_hg_settings, get_hg_ui_settings, make_ui
 from pylons_app.model.db import User, UserLog, HgAppSettings, HgAppUi
 from pylons_app.model.forms import UserForm, ApplicationSettingsForm, \
     ApplicationUiSettingsForm
 from pylons_app.model.hg_model import HgModel
 from pylons_app.model.user_model import UserModel
 import formencode
 import logging
 import traceback
  
 log = logging.getLogger(__name__)
 
 
 class SettingsController(BaseController):
     """REST Controller styled on the Atom Publishing Protocol"""
     # To properly map this controller, ensure your config/routing.py
     # file has a resource setup:
     #     map.resource('setting', 'settings', controller='admin/settings', 
     #         path_prefix='/admin', name_prefix='admin_')
 
 
     @LoginRequired()
     def __before__(self):
         c.admin_user = session.get('admin_user')
         c.admin_username = session.get('admin_username')
         super(SettingsController, self).__before__()
     
     
     @HasPermissionAllDecorator('hg.admin')    
     def index(self, format='html'):
         """GET /admin/settings: All items in the collection"""
         # url('admin_settings')
 
         defaults = get_hg_settings()
         defaults.update(get_hg_ui_settings())
         return htmlfill.render(
             render('admin/settings/settings.html'),
             defaults=defaults,
             encoding="UTF-8",
             force_defaults=False
         )  
     
     @HasPermissionAllDecorator('hg.admin')
     def create(self):
         """POST /admin/settings: Create a new item"""
         # url('admin_settings')
     
     @HasPermissionAllDecorator('hg.admin')
     def new(self, format='html'):
         """GET /admin/settings/new: Form to create a new item"""
         # url('admin_new_setting')
         
     @HasPermissionAllDecorator('hg.admin')
     def update(self, setting_id):
         """PUT /admin/settings/setting_id: Update an existing item"""
         # Forms posted to this method should contain a hidden field:
         #    <input type="hidden" name="_method" value="PUT" />
         # Or using helpers:
         #    h.form(url('admin_setting', setting_id=ID),
         #           method='put')
         # url('admin_setting', setting_id=ID)
         if setting_id == 'mapping':
             rm_obsolete = request.POST.get('destroy', False)
             log.debug('Rescanning directories with destroy=%s', rm_obsolete)
 
             initial = HgModel.repo_scan(g.paths[0][0], g.paths[0][1], g.baseui)
             repo2db_mapper(initial, rm_obsolete)
             invalidate_cache('cached_repo_list')
             h.flash(_('Repositories sucessfully rescanned'), category='success')            
         
         if setting_id == 'global':
             
             application_form = ApplicationSettingsForm()()
             try:
                 form_result = application_form.to_python(dict(request.POST))
             
                 try:
                     hgsettings1 = self.sa.query(HgAppSettings)\
                     .filter(HgAppSettings.app_settings_name == 'title').one()
                     hgsettings1.app_settings_value = form_result['hg_app_title'] 
                     
                     hgsettings2 = self.sa.query(HgAppSettings)\
                     .filter(HgAppSettings.app_settings_name == 'realm').one()
                     hgsettings2.app_settings_value = form_result['hg_app_realm'] 
                     
                     
                     self.sa.add(hgsettings1)
                     self.sa.add(hgsettings2)
                     self.sa.commit()
                     set_hg_app_config(config)
                     h.flash(_('Updated application settings'),
                             category='success')
                                     
                 except:
                     log.error(traceback.format_exc())
                     h.flash(_('error occured during updating application settings'),
                             category='error')
                                 
                     self.sa.rollback()
                     
 
             except formencode.Invalid as errors:
                 return htmlfill.render(
                      render('admin/settings/settings.html'),
                      defaults=errors.value,
                      errors=errors.error_dict or {},
                      prefix_error=False,
                      encoding="UTF-8") 
         
         if setting_id == 'mercurial':
             application_form = ApplicationUiSettingsForm()()
             try:
                 form_result = application_form.to_python(dict(request.POST))
             
                 try:
                     
                     hgsettings1 = self.sa.query(HgAppUi)\
                     .filter(HgAppUi.ui_key == 'push_ssl').one()
                     hgsettings1.ui_value = form_result['web_push_ssl']
                     
                     hgsettings2 = self.sa.query(HgAppUi)\
                     .filter(HgAppUi.ui_key == '/').one()
                     hgsettings2.ui_value = form_result['paths_root_path']                    
                     
                     
                     #HOOKS
                     hgsettings3 = self.sa.query(HgAppUi)\
                     .filter(HgAppUi.ui_key == 'changegroup.update').one()
                     hgsettings3.ui_active = bool(form_result['hooks_changegroup_update'])  
                     
                     hgsettings4 = self.sa.query(HgAppUi)\
                     .filter(HgAppUi.ui_key == 'changegroup.repo_size').one()
                     hgsettings4.ui_active = bool(form_result['hooks_changegroup_repo_size'])                                          
                     
                     
                     
                     
                     self.sa.add(hgsettings1)
                     self.sa.add(hgsettings2)
                     self.sa.add(hgsettings3)
                     self.sa.add(hgsettings4)
                     self.sa.commit()
                     
                     h.flash(_('Updated mercurial settings'),
                             category='success')
                                     
                 except:
                     log.error(traceback.format_exc())
                     h.flash(_('error occured during updating application settings'),
                             category='error')
                                 
                     self.sa.rollback()
                     
 
             except formencode.Invalid as errors:
                 return htmlfill.render(
                      render('admin/settings/settings.html'),
                      defaults=errors.value,
                      errors=errors.error_dict or {},
                      prefix_error=False,
                      encoding="UTF-8") 
                 
                 
                         
         return redirect(url('admin_settings'))
     
     @HasPermissionAllDecorator('hg.admin')
     def delete(self, setting_id):
         """DELETE /admin/settings/setting_id: Delete an existing item"""
         # Forms posted to this method should contain a hidden field:
         #    <input type="hidden" name="_method" value="DELETE" />
         # Or using helpers:
         #    h.form(url('admin_setting', setting_id=ID),
         #           method='delete')
         # url('admin_setting', setting_id=ID)
     
     @HasPermissionAllDecorator('hg.admin')
     def show(self, setting_id, format='html'):
         """GET /admin/settings/setting_id: Show a specific item"""
         # url('admin_setting', setting_id=ID)
     
     @HasPermissionAllDecorator('hg.admin')         
     def edit(self, setting_id, format='html'):
         """GET /admin/settings/setting_id/edit: Form to edit an existing item"""
         # url('admin_edit_setting', setting_id=ID)
 
 
     def my_account(self):
         """
         GET /_admin/my_account Displays info about my account 
         """
         # url('admin_settings_my_account')
         c.user = self.sa.query(User).get(c.hg_app_user.user_id)
         if c.user.username == 'default':
             h.flash(_("You can't edit this user since it's" 
               " crucial for entire application"), category='warning')
             return redirect(url('users'))
         
         defaults = c.user.__dict__
         return htmlfill.render(
             render('admin/users/user_edit_my_account.html'),
             defaults=defaults,
             encoding="UTF-8",
             force_defaults=False
         ) 
 
     def my_account_update(self):
         """PUT /_admin/my_account_update: Update an existing item"""
         # Forms posted to this method should contain a hidden field:
         #    <input type="hidden" name="_method" value="PUT" />
         # Or using helpers:
         #    h.form(url('admin_settings_my_account_update'),
         #           method='put')
         # url('admin_settings_my_account_update', id=ID)
         user_model = UserModel()
         uid = c.hg_app_user.user_id
         _form = UserForm(edit=True, old_data={'user_id':uid})()
         form_result = {}
         try:
             form_result = _form.to_python(dict(request.POST))
             user_model.update_my_account(uid, form_result)
             h.flash(_('Your account was updated succesfully'),
                     category='success')
                            
         except formencode.Invalid as errors:
             #c.user = self.sa.query(User).get(c.hg_app_user.user_id)
             return htmlfill.render(
                 render('admin/users/user_edit_my_account.html'),
                 defaults=errors.value,
                 errors=errors.error_dict or {},
                 prefix_error=False,
                 encoding="UTF-8")
         except Exception:
             log.error(traceback.format_exc())
             h.flash(_('error occured during update of user %s') \
                     % form_result.get('username'), category='error')
                     
         return redirect(url('my_account'))
     
-    @HasPermissionAnyDecorator('repository.create', 'hg.admin')
+    @HasPermissionAnyDecorator('hg.admin', 'hg.create.repository')
     def create_repository(self):
         """GET /_admin/create_repository: Form to create a new item"""
         new_repo = request.GET.get('repo', '')
         c.new_repo = h.repo_name_slug(new_repo)
 
         return render('admin/repos/repo_add_create_repository.html')
         

pylons_app/controllers/admin/users.py

@@ -1,163 +1,162 b''
 #!/usr/bin/env python
 # encoding: utf-8
 # users controller for pylons
 # Copyright (C) 2009-2010 Marcin Kuzminski <[e-mail]>
 # 
 # This program is free software; you can redistribute it and/or
 # modify it under the terms of the GNU General Public License
 # as published by the Free Software Foundation; version 2
 # of the License or (at your opinion) any later version of the license.
 # 
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 # 
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
 # MA  02110-1301, USA.
 """
 Created on April 4, 2010
 users controller for pylons
 @author: marcink
 """
 
 from formencode import htmlfill
 from pylons import request, session, tmpl_context as c, url
 from pylons.controllers.util import abort, redirect
 from pylons.i18n.translation import _
 from pylons_app.lib import helpers as h
 from pylons_app.lib.auth import LoginRequired, HasPermissionAllDecorator
 from pylons_app.lib.base import BaseController, render
 from pylons_app.model.db import User, UserLog
 from pylons_app.model.forms import UserForm
 from pylons_app.model.user_model import UserModel, DefaultUserException
 import formencode
 import logging
 import traceback
 
-
 log = logging.getLogger(__name__)
 
 class UsersController(BaseController):
     """REST Controller styled on the Atom Publishing Protocol"""
     # To properly map this controller, ensure your config/routing.py
     # file has a resource setup:
     #     map.resource('user', 'users')
     
     @LoginRequired()
     @HasPermissionAllDecorator('hg.admin')
     def __before__(self):
         c.admin_user = session.get('admin_user')
         c.admin_username = session.get('admin_username')
         super(UsersController, self).__before__()
     
 
     def index(self, format='html'):
         """GET /users: All items in the collection"""
         # url('users')
         
         c.users_list = self.sa.query(User).all()     
         return render('admin/users/users.html')
     
     def create(self):
         """POST /users: Create a new item"""
         # url('users')
         
         user_model = UserModel()
         login_form = UserForm()()
         try:
             form_result = login_form.to_python(dict(request.POST))
             user_model.create(form_result)
             h.flash(_('created user %s') % form_result['username'],
                     category='success')
         except formencode.Invalid as errors:
             return htmlfill.render(
                 render('admin/users/user_add.html'),
                 defaults=errors.value,
                 errors=errors.error_dict or {},
                 prefix_error=False,
                 encoding="UTF-8") 
         except Exception:
             log.error(traceback.format_exc())
             h.flash(_('error occured during creation of user %s') \
                     % request.POST.get('username'), category='error')            
         return redirect(url('users'))
     
     def new(self, format='html'):
         """GET /users/new: Form to create a new item"""
         # url('new_user')
         return render('admin/users/user_add.html')
 
     def update(self, id):
         """PUT /users/id: Update an existing item"""
         # Forms posted to this method should contain a hidden field:
         #    <input type="hidden" name="_method" value="PUT" />
         # Or using helpers:
         #    h.form(url('user', id=ID),
         #           method='put')
         # url('user', id=ID)
         user_model = UserModel()
         _form = UserForm(edit=True, old_data={'user_id':id})()
         form_result = {}
         try:
             form_result = _form.to_python(dict(request.POST))
             user_model.update(id, form_result)
             h.flash(_('User updated succesfully'), category='success')
                            
         except formencode.Invalid as errors:
             c.user = user_model.get_user(id)
             return htmlfill.render(
                 render('admin/users/user_edit.html'),
                 defaults=errors.value,
                 errors=errors.error_dict or {},
                 prefix_error=False,
                 encoding="UTF-8") 
         except Exception:
             log.error(traceback.format_exc())
             h.flash(_('error occured during update of user %s') \
                     % form_result.get('username'), category='error')
             
         return redirect(url('users'))
     
     def delete(self, id):
         """DELETE /users/id: Delete an existing item"""
         # Forms posted to this method should contain a hidden field:
         #    <input type="hidden" name="_method" value="DELETE" />
         # Or using helpers:
         #    h.form(url('user', id=ID),
         #           method='delete')
         # url('user', id=ID)
         user_model = UserModel()
         try:
             user_model.delete(id)
             h.flash(_('sucessfully deleted user'), category='success')
         except DefaultUserException as e:
             h.flash(str(e), category='warning')
         except Exception:
             h.flash(_('An error occured during deletion of user'),
                     category='error')            
         return redirect(url('users'))
         
     def show(self, id, format='html'):
         """GET /users/id: Show a specific item"""
         # url('user', id=ID)
     
     
     def edit(self, id, format='html'):
         """GET /users/id/edit: Form to edit an existing item"""
         # url('edit_user', id=ID)
         c.user = self.sa.query(User).get(id)
         if c.user.username == 'default':
             h.flash(_("You can't edit this user since it's" 
               " crucial for entire application"), category='warning')
             return redirect(url('users'))
         
         defaults = c.user.__dict__
         return htmlfill.render(
             render('admin/users/user_edit.html'),
             defaults=defaults,
             encoding="UTF-8",
             force_defaults=False
         )    

pylons_app/controllers/login.py

@@ -1,88 +1,97 b''
 #!/usr/bin/env python
 # encoding: utf-8
 # login controller for pylons
 # Copyright (C) 2009-2010 Marcin Kuzminski <[e-mail]>
 # 
 # This program is free software; you can redistribute it and/or
 # modify it under the terms of the GNU General Public License
 # as published by the Free Software Foundation; version 2
 # of the License or (at your opinion) any later version of the license.
 # 
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 # 
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
 # MA  02110-1301, USA.
+
+"""
+Created on April 22, 2010
+login controller for pylons
+@author: marcink
+"""
 from formencode import htmlfill
 from pylons import request, response, session, tmpl_context as c, url
 from pylons.controllers.util import abort, redirect
-from pylons_app.lib.auth import AuthUser
+from pylons_app.lib.auth import AuthUser, HasPermissionAnyDecorator
 from pylons_app.lib.base import BaseController, render
 from pylons_app.model.forms import LoginForm, RegisterForm
 from pylons_app.model.user_model import UserModel
 import formencode
 import logging
-"""
-Created on April 22, 2010
-login controller for pylons
-@author: marcink
-"""
 
 log = logging.getLogger(__name__)
 
 class LoginController(BaseController):
 
     def __before__(self):
         super(LoginController, self).__before__()
 
     def index(self):
         #redirect if already logged in
         if c.hg_app_user.is_authenticated:
             return redirect(url('hg_home'))
         
         if request.POST:
             #import Login Form validator class
             login_form = LoginForm()
             try:
                 c.form_result = login_form.to_python(dict(request.POST))
                 return redirect(url('hg_home'))
                                
             except formencode.Invalid as errors:
                 return htmlfill.render(
                     render('/login.html'),
                     defaults=errors.value,
                     errors=errors.error_dict or {},
                     prefix_error=False,
                     encoding="UTF-8")
                         
         return render('/login.html')
     
-    
+    @HasPermissionAnyDecorator('hg.admin', 'hg.register.auto_activate', 'hg.register.manual_activate')
     def register(self):
+        user_model = UserModel()
+        c.auto_active = False
+        for perm in user_model.get_default().user_perms:
+            if perm.permission.permission_name == 'hg.register.auto_activate':
+                c.auto_active = False
+                break
+                        
         if request.POST:
-            user_model = UserModel()
+                
             register_form = RegisterForm()()
             try:
                 form_result = register_form.to_python(dict(request.POST))
+                form_result['active'] = c.auto_active
                 user_model.create_registration(form_result)
                 return redirect(url('login_home'))
                                
             except formencode.Invalid as errors:
                 return htmlfill.render(
                     render('/register.html'),
                     defaults=errors.value,
                     errors=errors.error_dict or {},
                     prefix_error=False,
                     encoding="UTF-8")
         
         return render('/register.html')
     
     def logout(self):
         session['hg_app_user'] = AuthUser()
         session.save()
         log.info('Logging out and setting user as Empty')
         redirect(url('hg_home'))

pylons_app/lib/auth.py

@@ -1,433 +1,451 b''
 #!/usr/bin/env python
 # encoding: utf-8
 # authentication and permission libraries
 # Copyright (C) 2009-2010 Marcin Kuzminski <[e-mail]>
 #
 # This program is free software; you can redistribute it and/or
 # modify it under the terms of the GNU General Public License
 # as published by the Free Software Foundation; version 2
 # of the License or (at your opinion) any later version of the license.
 # 
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 # 
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
 # MA  02110-1301, USA.
 """
 Created on April 4, 2010
 
 @author: marcink
 """
 from beaker.cache import cache_region
 from pylons import config, session, url, request
 from pylons.controllers.util import abort, redirect
 from pylons_app.lib.utils import get_repo_slug
 from pylons_app.model import meta
-from pylons_app.model.db import User, RepoToPerm, Repository, Permission
+from pylons_app.model.db import User, RepoToPerm, Repository, Permission, \
+    UserToPerm
 from sqlalchemy.exc import OperationalError
 from sqlalchemy.orm.exc import NoResultFound, MultipleResultsFound
 import bcrypt
 from decorator import decorator
 import logging
 
 log = logging.getLogger(__name__) 
 
 def get_crypt_password(password):
     """Cryptographic function used for password hashing based on sha1
     @param password: password to hash
     """    
     return bcrypt.hashpw(password, bcrypt.gensalt(10))
 
 def check_password(password, hashed):
     return bcrypt.hashpw(password, hashed) == hashed
 
 @cache_region('super_short_term', 'cached_user')
 def get_user_cached(username):
     sa = meta.Session
     try:
         user = sa.query(User).filter(User.username == username).one()
     finally:
         meta.Session.remove()
     return user
 
 def authfunc(environ, username, password):
     try:
         user = get_user_cached(username)
     except (NoResultFound, MultipleResultsFound, OperationalError) as e:
         log.error(e)
         user = None
         
     if user:
         if user.active:
             if user.username == username and check_password(password, user.password):
                 log.info('user %s authenticated correctly', username)
                 return True
         else:
             log.error('user %s is disabled', username)
             
     return False
 
 class  AuthUser(object):
     """
     A simple object that handles a mercurial username for authentication
     """
     def __init__(self):
         self.username = 'None'
         self.name = ''
         self.lastname = ''
         self.email = ''
         self.user_id = None
         self.is_authenticated = False
         self.is_admin = False
         self.permissions = {}
 
 
 def set_available_permissions(config):
     """
     This function will propagate pylons globals with all available defined
     permission given in db. We don't wannt to check each time from db for new 
     permissions since adding a new permission also requires application restart
     ie. to decorate new views with the newly created permission
     @param config:
     """
     log.info('getting information about all available permissions')
     try:
         sa = meta.Session
         all_perms = sa.query(Permission).all()
     finally:
         meta.Session.remove()
     
     config['available_permissions'] = [x.permission_name for x in all_perms]
 
 def set_base_path(config):
     config['base_path'] = config['pylons.app_globals'].base_path
 
 def fill_data(user):
     """
     Fills user data with those from database and log out user if not present
     in database
     @param user:
     """
     sa = meta.Session
     dbuser = sa.query(User).get(user.user_id)
     if dbuser:
         user.username = dbuser.username
         user.is_admin = dbuser.admin
         user.name = dbuser.name
         user.lastname = dbuser.lastname
         user.email = dbuser.email
     else:
         user.is_authenticated = False
     meta.Session.remove()
     return user
             
 def fill_perms(user):
     """
     Fills user permission attribute with permissions taken from database
     @param user:
     """
     
     sa = meta.Session
     user.permissions['repositories'] = {}
     user.permissions['global'] = set()
     
-    #first fetch default permissions
-    default_perms = sa.query(RepoToPerm, Repository, Permission)\
+    #===========================================================================
+    # fetch default permissions
+    #===========================================================================
+    default_perms = sa.query(RepoToPerm, UserToPerm, Repository, Permission)\
+        .outerjoin((UserToPerm, RepoToPerm.user_id == UserToPerm.user_id))\
         .join((Repository, RepoToPerm.repository_id == Repository.repo_id))\
         .join((Permission, RepoToPerm.permission_id == Permission.permission_id))\
         .filter(RepoToPerm.user_id == sa.query(User).filter(User.username == 
                                             'default').one().user_id).all()
-
+                                            
     if user.is_admin:
+        #=======================================================================
+        # #admin have all rights set to admin        
+        #=======================================================================
         user.permissions['global'].add('hg.admin')
-        #admin have all rights set to admin
+        
         for perm in default_perms:
             p = 'repository.admin'
             user.permissions['repositories'][perm.RepoToPerm.repository.repo_name] = p
     
     else:
-        user.permissions['global'].add('repository.create')
-        user.permissions['global'].add('hg.register')
+        #=======================================================================
+        # set default permissions
+        #=======================================================================
         
+        #default global
+        for perm in default_perms:
+            user.permissions['global'].add(perm.UserToPerm.permission.permission_name)
+            
+#        user.permissions['global'].add('hg.create.repository')
+#        user.permissions['global'].add('hg.register')
+        
+        #default repositories
         for perm in default_perms:
             if perm.Repository.private and not perm.Repository.user_id == user.user_id:
                 #disable defaults for private repos,
                 p = 'repository.none'
             elif perm.Repository.user_id == user.user_id:
                 #set admin if owner
                 p = 'repository.admin'
             else:
                 p = perm.Permission.permission_name
                 
             user.permissions['repositories'][perm.RepoToPerm.repository.repo_name] = p
                                                 
-        
-        user_perms = sa.query(RepoToPerm, Permission, Repository)\
+        #=======================================================================
+        # #overwrite default with user permissions if any
+        #=======================================================================
+        user_perms = sa.query(RepoToPerm, UserToPerm, Permission, Repository)\
+            .outerjoin((UserToPerm, RepoToPerm.user_id == UserToPerm.user_id))\
             .join((Repository, RepoToPerm.repository_id == Repository.repo_id))\
             .join((Permission, RepoToPerm.permission_id == Permission.permission_id))\
             .filter(RepoToPerm.user_id == user.user_id).all()
-        #overwrite userpermissions with defaults
+            
         for perm in user_perms:
-            #set write if owner
-            if perm.Repository.user_id == user.user_id:
-                p = 'repository.write'
+            if perm.Repository.user_id == user.user_id:#set admin if owner
+                p = 'repository.admin'
             else:
                 p = perm.Permission.permission_name
             user.permissions['repositories'][perm.RepoToPerm.repository.repo_name] = p
     meta.Session.remove()         
     return user
     
 def get_user(session):
     """
     Gets user from session, and wraps permissions into user
     @param session:
     """
     user = session.get('hg_app_user', AuthUser())
     if user.is_authenticated:
         user = fill_data(user)
     user = fill_perms(user)
     session['hg_app_user'] = user
     session.save()
     return user
         
 #===============================================================================
 # CHECK DECORATORS
 #===============================================================================
 class LoginRequired(object):
     """Must be logged in to execute this function else redirect to login page"""
    
     def __call__(self, func):
         return decorator(self.__wrapper, func)
     
     def __wrapper(self, func, *fargs, **fkwargs):
         user = session.get('hg_app_user', AuthUser())
         log.debug('Checking login required for user:%s', user.username)
         if user.is_authenticated:
             log.debug('user %s is authenticated', user.username)
             return func(*fargs, **fkwargs)
         else:
             log.warn('user %s not authenticated', user.username)
             log.debug('redirecting to login page')
             return redirect(url('login_home'))
 
 class PermsDecorator(object):
     """Base class for decorators"""
     
     def __init__(self, *required_perms):
         available_perms = config['available_permissions']
         for perm in required_perms:
             if perm not in available_perms:
                 raise Exception("'%s' permission is not defined" % perm)
         self.required_perms = set(required_perms)
         self.user_perms = None
         
     def __call__(self, func):
         return decorator(self.__wrapper, func)
     
     
     def __wrapper(self, func, *fargs, **fkwargs):
 #        _wrapper.__name__ = func.__name__
 #        _wrapper.__dict__.update(func.__dict__)
 #        _wrapper.__doc__ = func.__doc__
 
         self.user_perms = session.get('hg_app_user', AuthUser()).permissions
         log.debug('checking %s permissions %s for %s',
            self.__class__.__name__, self.required_perms, func.__name__)
         
         if self.check_permissions():
             log.debug('Permission granted for %s', func.__name__)
             
             return func(*fargs, **fkwargs)
         
         else:
             log.warning('Permission denied for %s', func.__name__)
             #redirect with forbidden ret code
             return abort(403)
 
         
         
     def check_permissions(self):
         """Dummy function for overriding"""
         raise Exception('You have to write this function in child class')
 
 class HasPermissionAllDecorator(PermsDecorator):
     """Checks for access permission for all given predicates. All of them 
     have to be meet in order to fulfill the request
     """
         
     def check_permissions(self):
         if self.required_perms.issubset(self.user_perms.get('global')):
             return True
         return False
             
 
 class HasPermissionAnyDecorator(PermsDecorator):
     """Checks for access permission for any of given predicates. In order to 
     fulfill the request any of predicates must be meet
     """
     
     def check_permissions(self):
         if self.required_perms.intersection(self.user_perms.get('global')):
             return True
         return False
 
 class HasRepoPermissionAllDecorator(PermsDecorator):
     """Checks for access permission for all given predicates for specific 
     repository. All of them have to be meet in order to fulfill the request
     """
             
     def check_permissions(self):
         repo_name = get_repo_slug(request)
         try:
             user_perms = set([self.user_perms['repositories'][repo_name]])
         except KeyError:
             return False
         if self.required_perms.issubset(user_perms):
             return True
         return False
             
 
 class HasRepoPermissionAnyDecorator(PermsDecorator):
     """Checks for access permission for any of given predicates for specific 
     repository. In order to fulfill the request any of predicates must be meet
     """
             
     def check_permissions(self):
         repo_name = get_repo_slug(request)
         
         try:
             user_perms = set([self.user_perms['repositories'][repo_name]])
         except KeyError:
             return False
         if self.required_perms.intersection(user_perms):
             return True
         return False
 #===============================================================================
 # CHECK FUNCTIONS
 #===============================================================================
 
 class PermsFunction(object):
     """Base function for other check functions"""
     
     def __init__(self, *perms):
         available_perms = config['available_permissions']
         
         for perm in perms:
             if perm not in available_perms:
                 raise Exception("'%s' permission in not defined" % perm)
         self.required_perms = set(perms)
         self.user_perms = None
         self.granted_for = ''
         self.repo_name = None
         
     def __call__(self, check_Location=''):
         user = session.get('hg_app_user', False)
         if not user:
             return False
         self.user_perms = user.permissions
         self.granted_for = user.username        
         log.debug('checking %s %s', self.__class__.__name__, self.required_perms)            
         
         if self.check_permissions():
             log.debug('Permission granted for %s @%s', self.granted_for,
                       check_Location)
             return True
         
         else:
             log.warning('Permission denied for %s @%s', self.granted_for,
                         check_Location)
             return False 
     
     def check_permissions(self):
         """Dummy function for overriding"""
         raise Exception('You have to write this function in child class')
         
 class HasPermissionAll(PermsFunction):
     def check_permissions(self):
         if self.required_perms.issubset(self.user_perms.get('global')):
             return True
         return False
 
 class HasPermissionAny(PermsFunction):
     def check_permissions(self):
         if self.required_perms.intersection(self.user_perms.get('global')):
             return True
         return False
 
 class HasRepoPermissionAll(PermsFunction):
     
     def __call__(self, repo_name=None, check_Location=''):
         self.repo_name = repo_name
         return super(HasRepoPermissionAll, self).__call__(check_Location)
             
     def check_permissions(self):
         if not self.repo_name:
             self.repo_name = get_repo_slug(request)
 
         try:
             self.user_perms = set([self.user_perms['repositories']\
                                    [self.repo_name]])
         except KeyError:
             return False
         self.granted_for = self.repo_name       
         if self.required_perms.issubset(self.user_perms):
             return True
         return False
             
 class HasRepoPermissionAny(PermsFunction):
     
     def __call__(self, repo_name=None, check_Location=''):
         self.repo_name = repo_name
         return super(HasRepoPermissionAny, self).__call__(check_Location)
         
     def check_permissions(self):
         if not self.repo_name:
             self.repo_name = get_repo_slug(request)
 
         try:
             self.user_perms = set([self.user_perms['repositories']\
                                    [self.repo_name]])
         except KeyError:
             return False
         self.granted_for = self.repo_name
         if self.required_perms.intersection(self.user_perms):
             return True
         return False
 
 #===============================================================================
 # SPECIAL VERSION TO HANDLE MIDDLEWARE AUTH
 #===============================================================================
 
 class HasPermissionAnyMiddleware(object):
     def __init__(self, *perms):
         self.required_perms = set(perms)
     
     def __call__(self, user, repo_name):
         usr = AuthUser()
         usr.user_id = user.user_id
         usr.username = user.username
         usr.is_admin = user.admin
         
         try:
             self.user_perms = set([fill_perms(usr)\
                                    .permissions['repositories'][repo_name]])
         except:
             self.user_perms = set()
         self.granted_for = ''
         self.username = user.username
         self.repo_name = repo_name        
         return self.check_permissions()
             
     def check_permissions(self):
         log.debug('checking mercurial protocol '
                   'permissions for user:%s repository:%s',
                                                 self.username, self.repo_name)
         if self.required_perms.intersection(self.user_perms):
             log.debug('permission granted')
             return True
         log.debug('permission denied')
         return False

pylons_app/lib/db_manage.py

@@ -1,205 +1,244 b''
 #!/usr/bin/env python
 # encoding: utf-8
 # database managment for hg app
 # Copyright (C) 2009-2010 Marcin Kuzminski <[e-mail]>
 #
 # This program is free software; you can redistribute it and/or
 # modify it under the terms of the GNU General Public License
 # as published by the Free Software Foundation; version 2
 # of the License or (at your opinion) any later version of the license.
 # 
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 # 
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
 # MA  02110-1301, USA.
 
 """
 Created on April 10, 2010
 database managment and creation for hg app
 @author: marcink
 """
 
 from os.path import dirname as dn, join as jn
 import os
 import sys
 import uuid
 ROOT = dn(dn(dn(os.path.realpath(__file__))))
 sys.path.append(ROOT)
 
 from pylons_app.lib.auth import get_crypt_password
 from pylons_app.lib.utils import ask_ok
 from pylons_app.model import init_model
-from pylons_app.model.db import User, Permission, HgAppUi, HgAppSettings
+from pylons_app.model.db import User, Permission, HgAppUi, HgAppSettings, \
+    UserToPerm
 from pylons_app.model import meta
 from sqlalchemy.engine import create_engine
 import logging
 
 log = logging.getLogger(__name__)
 
 class DbManage(object):
     def __init__(self, log_sql):
         self.dbname = 'hg_app.db'
         dburi = 'sqlite:////%s' % jn(ROOT, self.dbname)
         engine = create_engine(dburi, echo=log_sql) 
         init_model(engine)
         self.sa = meta.Session
         self.db_exists = False
     
     def check_for_db(self, override):
         log.info('checking for exisiting db')
         if os.path.isfile(jn(ROOT, self.dbname)):
             self.db_exists = True
             log.info('database exisist')
             if not override:
                 raise Exception('database already exists')
 
     def create_tables(self, override=False):
         """
         Create a auth database
         """
         self.check_for_db(override)
         if override:
             log.info("database exisist and it's going to be destroyed")
             destroy = ask_ok('Are you sure to destroy old database ? [y/n]')
             if not destroy:
                 sys.exit()
             if self.db_exists and destroy:
                 os.remove(jn(ROOT, self.dbname))
         checkfirst = not override
         meta.Base.metadata.create_all(checkfirst=checkfirst)
         log.info('Created tables for %s', self.dbname)
     
     def admin_prompt(self):
         import getpass
         username = raw_input('Specify admin username:')
         password = getpass.getpass('Specify admin password:')
         self.create_user(username, password, True)
     
     def config_prompt(self):
         log.info('Setting up repositories config')
         
         path = raw_input('Specify valid full path to your repositories'
                         ' you can change this later in application settings:')
         
         if not os.path.isdir(path):
             log.error('You entered wrong path')
             sys.exit()
         
         hooks1 = HgAppUi()
         hooks1.ui_section = 'hooks'
         hooks1.ui_key = 'changegroup.update'
         hooks1.ui_value = 'hg update >&2'
         
         hooks2 = HgAppUi()
         hooks2.ui_section = 'hooks'
         hooks2.ui_key = 'changegroup.repo_size'
         hooks2.ui_value = 'python:pylons_app.lib.hooks.repo_size' 
                 
         web1 = HgAppUi()
         web1.ui_section = 'web'
         web1.ui_key = 'push_ssl'
         web1.ui_value = 'false'
                 
         web2 = HgAppUi()
         web2.ui_section = 'web'
         web2.ui_key = 'allow_archive'
         web2.ui_value = 'gz zip bz2'
                 
         web3 = HgAppUi()
         web3.ui_section = 'web'
         web3.ui_key = 'allow_push'
         web3.ui_value = '*'
         
         web4 = HgAppUi()
         web4.ui_section = 'web'
         web4.ui_key = 'baseurl'
         web4.ui_value = '/'                        
         
         paths = HgAppUi()
         paths.ui_section = 'paths'
         paths.ui_key = '/'
         paths.ui_value = os.path.join(path, '*')
         
         
         hgsettings1 = HgAppSettings()
         
         hgsettings1.app_settings_name = 'realm'
         hgsettings1.app_settings_value = 'hg-app authentication'
         
         hgsettings2 = HgAppSettings()
         hgsettings2.app_settings_name = 'title'
         hgsettings2.app_settings_value = 'hg-app'      
         
         try:
             self.sa.add(hooks1)
             self.sa.add(hooks2)
             self.sa.add(web1)
             self.sa.add(web2)
             self.sa.add(web3)
             self.sa.add(web4)
             self.sa.add(paths)
             self.sa.add(hgsettings1)
             self.sa.add(hgsettings2)
             self.sa.commit()
         except:
             self.sa.rollback()
             raise        
         log.info('created ui config')
                     
     def create_user(self, username, password, admin=False):
         
         log.info('creating default user')
         #create default user for handling default permissions.
         def_user = User()
         def_user.username = 'default'
         def_user.password = get_crypt_password(str(uuid.uuid1())[:8])
         def_user.name = 'default'
         def_user.lastname = 'default'
         def_user.email = '[e-mail]'
         def_user.admin = False
         def_user.active = False
         
         log.info('creating administrator user %s', username)
         new_user = User()
         new_user.username = username
         new_user.password = get_crypt_password(password)
         new_user.name = 'Hg'
         new_user.lastname = 'Admin'
         new_user.email = 'admin@localhost'
         new_user.admin = admin
         new_user.active = True
         
         try:
             self.sa.add(def_user)
             self.sa.add(new_user)
             self.sa.commit()
         except:
             self.sa.rollback()
             raise
     
     def create_permissions(self):
         #module.(access|create|change|delete)_[name]
         #module.(read|write|owner)
         perms = [('repository.none', 'Repository no access'),
                  ('repository.read', 'Repository read access'),
                  ('repository.write', 'Repository write access'),
                  ('repository.admin', 'Repository admin access'),
-                 ('repository.create', 'Repository create'),
                  ('hg.admin', 'Hg Administrator'),
+                 ('hg.create.repository', 'Repository create'),
+                 ('hg.create.none', 'Repository creation disabled'),
+                 ('hg.register.none', 'Register disabled'),
+                 ('hg.register.manual_activate', 'Register new user with hg-app without manual activation'),
+                 ('hg.register.auto_activate', 'Register new user with hg-app without auto activation'),
                 ]
         
         for p in perms:
             new_perm = Permission()
             new_perm.permission_name = p[0]
             new_perm.permission_longname = p[1]
             try:
                 self.sa.add(new_perm)
                 self.sa.commit()
             except:
                 self.sa.rollback()
                 raise
+
+    def populate_default_permissions(self):
+        log.info('creating default user permissions')
+        
+        default_user = self.sa.query(User)\
+        .filter(User.username == 'default').scalar()
+        
+        reg_perm = UserToPerm()
+        reg_perm.user = default_user
+        reg_perm.permission = self.sa.query(Permission)\
+        .filter(Permission.permission_name == 'hg.register.manual_activate')\
+        .scalar() 
+        
+        create_repo_perm = UserToPerm()
+        create_repo_perm.user = default_user
+        create_repo_perm.permission = self.sa.query(Permission)\
+        .filter(Permission.permission_name == 'hg.create.repository')\
+        .scalar() 
+        
+        default_repo_perm = UserToPerm()
+        default_repo_perm.user = default_user
+        default_repo_perm.permission = self.sa.query(Permission)\
+        .filter(Permission.permission_name == 'repository.read')\
+        .scalar() 
+                
+        try:
+            self.sa.add(reg_perm)
+            self.sa.add(create_repo_perm)
+            self.sa.add(default_repo_perm)
+            self.sa.commit()
+        except:
+            self.sa.rollback()
+            raise        
+        

pylons_app/model/db.py

@@ -1,103 +1,107 b''
 from pylons_app.model.meta import Base
 from sqlalchemy.orm import relation, backref
 from sqlalchemy import *
 from vcs.utils.lazy import LazyProperty
 
 class HgAppSettings(Base):
     __tablename__ = 'hg_app_settings'
     __table_args__ = (UniqueConstraint('app_settings_name'), {'useexisting':True})
     app_settings_id = Column("app_settings_id", INTEGER(), nullable=False, unique=True, default=None, primary_key=True)
     app_settings_name = Column("app_settings_name", TEXT(length=None, convert_unicode=False, assert_unicode=None), nullable=True, unique=None, default=None)
     app_settings_value = Column("app_settings_value", TEXT(length=None, convert_unicode=False, assert_unicode=None), nullable=True, unique=None, default=None)
 
 class HgAppUi(Base):
     __tablename__ = 'hg_app_ui'
     __table_args__ = {'useexisting':True}
     ui_id = Column("ui_id", INTEGER(), nullable=False, unique=True, default=None, primary_key=True)
     ui_section = Column("ui_section", TEXT(length=None, convert_unicode=False, assert_unicode=None), nullable=True, unique=None, default=None)
     ui_key = Column("ui_key", TEXT(length=None, convert_unicode=False, assert_unicode=None), nullable=True, unique=None, default=None)
     ui_value = Column("ui_value", TEXT(length=None, convert_unicode=False, assert_unicode=None), nullable=True, unique=None, default=None)
     ui_active = Column("ui_active", BOOLEAN(), nullable=True, unique=None, default=True)
     
     
 class User(Base): 
     __tablename__ = 'users'
     __table_args__ = {'useexisting':True}
     user_id = Column("user_id", INTEGER(), nullable=False, unique=True, default=None, primary_key=True)
     username = Column("username", TEXT(length=None, convert_unicode=False, assert_unicode=None), nullable=True, unique=None, default=None)
     password = Column("password", TEXT(length=None, convert_unicode=False, assert_unicode=None), nullable=True, unique=None, default=None)
     active = Column("active", BOOLEAN(), nullable=True, unique=None, default=None)
     admin = Column("admin", BOOLEAN(), nullable=True, unique=None, default=False)
     name = Column("name", TEXT(length=None, convert_unicode=False, assert_unicode=None), nullable=True, unique=None, default=None)
     lastname = Column("lastname", TEXT(length=None, convert_unicode=False, assert_unicode=None), nullable=True, unique=None, default=None)
     email = Column("email", TEXT(length=None, convert_unicode=False, assert_unicode=None), nullable=True, unique=None, default=None)
     last_login = Column("last_login", DATETIME(timezone=False), nullable=True, unique=None, default=None)
     
     user_log = relation('UserLog')
+    user_perms = relation('UserToPerm', primaryjoin="User.user_id==UserToPerm.user_id")
     
     @LazyProperty
     def full_contact(self):
         return '%s %s <%s>' % (self.name, self.lastname, self.email)
         
     def __repr__(self):
-        return "<User('%s:%s')>" % (self.user_id, self.username)
+        return "<User('id:%s:%s')>" % (self.user_id, self.username)
       
 class UserLog(Base): 
     __tablename__ = 'user_logs'
     __table_args__ = {'useexisting':True}
     user_log_id = Column("user_log_id", INTEGER(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", INTEGER(), ForeignKey(u'users.user_id'), nullable=False, unique=None, default=None)
     user_ip = Column("user_ip", TEXT(length=None, convert_unicode=False, assert_unicode=None), nullable=True, unique=None, default=None) 
     repository = Column("repository", TEXT(length=None, convert_unicode=False, assert_unicode=None), ForeignKey(u'repositories.repo_name'), nullable=False, unique=None, default=None)
     action = Column("action", TEXT(length=None, convert_unicode=False, assert_unicode=None), nullable=True, unique=None, default=None)
     action_date = Column("action_date", DATETIME(timezone=False), nullable=True, unique=None, default=None)
     
     user = relation('User')
     
 class Repository(Base):
     __tablename__ = 'repositories'
     __table_args__ = (UniqueConstraint('repo_name'), {'useexisting':True},)
     repo_id = Column("repo_id", INTEGER(), nullable=False, unique=True, default=None, primary_key=True)
     repo_name = Column("repo_name", TEXT(length=None, convert_unicode=False, assert_unicode=None), nullable=False, unique=True, default=None)
     user_id = Column("user_id", INTEGER(), ForeignKey(u'users.user_id'), nullable=False, unique=False, default=None)
     private = Column("private", BOOLEAN(), nullable=True, unique=None, default=None)
     description = Column("description", TEXT(length=None, convert_unicode=False, assert_unicode=None), nullable=True, unique=None, default=None)
     
     user = relation('User')
     repo_to_perm = relation('RepoToPerm', cascade='all')
     
+    def __repr__(self):
+        return "<Repository('id:%s:%s')>" % (self.repo_id, self.repo_name)
+        
 class Permission(Base):
     __tablename__ = 'permissions'
     __table_args__ = {'useexisting':True}
     permission_id = Column("permission_id", INTEGER(), nullable=False, unique=True, default=None, primary_key=True)
     permission_name = Column("permission_name", TEXT(length=None, convert_unicode=False, assert_unicode=None), nullable=True, unique=None, default=None)
     permission_longname = Column("permission_longname", TEXT(length=None, convert_unicode=False, assert_unicode=None), nullable=True, unique=None, default=None)
     
     def __repr__(self):
         return "<Permission('%s:%s')>" % (self.permission_id, self.permission_name)
 
 class RepoToPerm(Base):
     __tablename__ = 'repo_to_perm'
     __table_args__ = (UniqueConstraint('user_id', 'repository_id'), {'useexisting':True})
     repo_to_perm_id = Column("repo_to_perm_id", INTEGER(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", INTEGER(), ForeignKey(u'users.user_id'), nullable=False, unique=None, default=None)
     permission_id = Column("permission_id", INTEGER(), ForeignKey(u'permissions.permission_id'), nullable=False, unique=None, default=None)
     repository_id = Column("repository_id", INTEGER(), ForeignKey(u'repositories.repo_id'), nullable=False, unique=None, default=None) 
     
     user = relation('User')
     permission = relation('Permission')
     repository = relation('Repository')
 
 class UserToPerm(Base):
     __tablename__ = 'user_to_perm'
     __table_args__ = (UniqueConstraint('user_id', 'permission_id'), {'useexisting':True})
     user_to_perm_id = Column("user_to_perm_id", INTEGER(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", INTEGER(), ForeignKey(u'users.user_id'), nullable=False, unique=None, default=None)
     permission_id = Column("permission_id", INTEGER(), ForeignKey(u'permissions.permission_id'), nullable=False, unique=None, default=None)
     
     user = relation('User')
     permission = relation('Permission')
 
 
 
 

pylons_app/model/forms.py

@@ -1,330 +1,339 b''
 """ this is forms validation classes
 http://formencode.org/module-formencode.validators.html
 for list off all availible validators
 
 we can create our own validators
 
 The table below outlines the options which can be used in a schema in addition to the validators themselves
 pre_validators          []     These validators will be applied before the schema
 chained_validators      []     These validators will be applied after the schema
 allow_extra_fields      False     If True, then it is not an error when keys that aren't associated with a validator are present
 filter_extra_fields     False     If True, then keys that aren't associated with a validator are removed
 if_key_missing          NoDefault If this is given, then any keys that aren't available but are expected will be replaced with this value (and then validated). This does not override a present .if_missing attribute on validators. NoDefault is a special FormEncode class to mean that no default values has been specified and therefore missing keys shouldn't take a default value.
 ignore_key_missing      False     If True, then missing keys will be missing in the result, if the validator doesn't have .if_missing on it already    
   
   
 <name> = formencode.validators.<name of validator>
 <name> must equal form name
 list=[1,2,3,4,5]
 for SELECT use formencode.All(OneOf(list), Int())
     
 """
 from formencode import All
 from formencode.validators import UnicodeString, OneOf, Int, Number, Regex, \
     Email, Bool, StringBoolean
 from pylons import session
 from pylons.i18n.translation import _
 from pylons_app.lib.auth import check_password, get_crypt_password
 from pylons_app.model import meta
 from pylons_app.model.db import User, Repository
 from sqlalchemy.exc import OperationalError
 from sqlalchemy.orm.exc import NoResultFound, MultipleResultsFound
 from webhelpers.pylonslib.secure_form import authentication_token
 import datetime
 import formencode
 import logging
 import os
 import pylons_app.lib.helpers as h
 log = logging.getLogger(__name__)
 
 
 #this is needed to translate the messages using _() in validators
 class State_obj(object):
     _ = staticmethod(_)
     
 #===============================================================================
 # VALIDATORS
 #===============================================================================
 class ValidAuthToken(formencode.validators.FancyValidator):
     messages = {'invalid_token':_('Token mismatch')}
 
     def validate_python(self, value, state):
 
         if value != authentication_token():
             raise formencode.Invalid(self.message('invalid_token', state,
                                             search_number=value), value, state)
             
 def ValidUsername(edit, old_data):             
     class _ValidUsername(formencode.validators.FancyValidator):
     
         def validate_python(self, value, state):
             if value in ['default', 'new_user']:
                 raise formencode.Invalid(_('Invalid username'), value, state)
             #check if user is uniq
             sa = meta.Session
             old_un = None
             if edit:
                 old_un = sa.query(User).get(old_data.get('user_id')).username
                 
             if old_un != value or not edit:    
                 if sa.query(User).filter(User.username == value).scalar():
                     raise formencode.Invalid(_('This username already exists') ,
                                              value, state)
             meta.Session.remove()
                             
     return _ValidUsername   
     
 class ValidPassword(formencode.validators.FancyValidator):
     
     def to_python(self, value, state):
         if value:
             return get_crypt_password(value)
         
 class ValidAuth(formencode.validators.FancyValidator):
     messages = {
             'invalid_password':_('invalid password'),
             'invalid_login':_('invalid user name'),
             'disabled_account':_('Your acccount is disabled')
             
             }
     #error mapping
     e_dict = {'username':messages['invalid_login'],
               'password':messages['invalid_password']}
     e_dict_disable = {'username':messages['disabled_account']}
     
     def validate_python(self, value, state):
         sa = meta.Session
         password = value['password']
         username = value['username']
         try:
             user = sa.query(User).filter(User.username == username).one()
         except (NoResultFound, MultipleResultsFound, OperationalError) as e:
             log.error(e)
             user = None
             raise formencode.Invalid(self.message('invalid_password',
                                      state=State_obj), value, state,
                                      error_dict=self.e_dict)            
         if user:
             if user.active:
                 if user.username == username and check_password(password, user.password):
                     from pylons_app.lib.auth import AuthUser
                     auth_user = AuthUser()
                     auth_user.username = username
                     auth_user.is_authenticated = True
                     auth_user.is_admin = user.admin
                     auth_user.user_id = user.user_id
                     auth_user.name = user.name
                     auth_user.lastname = user.lastname
                     session['hg_app_user'] = auth_user
                     session.save()
                     log.info('user %s is now authenticated', username)
                     
                     try:
                         user.last_login = datetime.datetime.now()
                         sa.add(user)
                         sa.commit()                        
                     except (OperationalError) as e:
                         log.error(e)
                         sa.rollback()
                     
                     return value
                 else:
                     log.warning('user %s not authenticated', username)
                     raise formencode.Invalid(self.message('invalid_password',
                                              state=State_obj), value, state,
                                              error_dict=self.e_dict)
             else:
                 log.warning('user %s is disabled', username)
                 raise formencode.Invalid(self.message('disabled_account',
                                          state=State_obj),
                                          value, state,
                                          error_dict=self.e_dict_disable)
             
         meta.Session.remove()
 
                    
 class ValidRepoUser(formencode.validators.FancyValidator):
             
     def to_python(self, value, state):
         sa = meta.Session
         try:
             self.user_db = sa.query(User)\
                 .filter(User.active == True)\
                 .filter(User.username == value).one()
         except Exception:
             raise formencode.Invalid(_('This username is not valid'),
                                      value, state)
         meta.Session.remove()            
         return self.user_db.user_id
 
 def ValidRepoName(edit, old_data):    
     class _ValidRepoName(formencode.validators.FancyValidator):
             
         def to_python(self, value, state):
             slug = h.repo_name_slug(value)
             if slug in ['_admin']:
                 raise formencode.Invalid(_('This repository name is disallowed'),
                                          value, state)
             if old_data.get('repo_name') != value or not edit:    
                 sa = meta.Session
                 if sa.query(Repository).filter(Repository.repo_name == slug).scalar():
                     raise formencode.Invalid(_('This repository already exists') ,
                                              value, state)
                 meta.Session.remove()
             return slug 
         
         
     return _ValidRepoName
 
 class ValidPerms(formencode.validators.FancyValidator):
     messages = {'perm_new_user_name':_('This username is not valid')}
     
     def to_python(self, value, state):
         perms_update = []
         perms_new = []
         #build a list of permission to update and new permission to create
         for k, v in value.items():
             if k.startswith('perm_'):
                 if  k.startswith('perm_new_user'):
                     new_perm = value.get('perm_new_user', False)
                     new_user = value.get('perm_new_user_name', False)
                     if new_user and new_perm:
                         if (new_user, new_perm) not in perms_new:
                             perms_new.append((new_user, new_perm))
                 else:
                     usr = k[5:]                    
                     if usr == 'default':
                         if value['private']:
                             #set none for default when updating to private repo
                             v = 'repository.none'
                     perms_update.append((usr, v))
         value['perms_updates'] = perms_update
         value['perms_new'] = perms_new
         sa = meta.Session
         for k, v in perms_new:
             try:
                 self.user_db = sa.query(User)\
                     .filter(User.active == True)\
                     .filter(User.username == k).one()
             except Exception:
                 msg = self.message('perm_new_user_name',
                                      state=State_obj)
                 raise formencode.Invalid(msg, value, state, error_dict={'perm_new_user_name':msg})            
         return value
     
 class ValidSettings(formencode.validators.FancyValidator):
     
     def to_python(self, value, state):
         #settings  form can't edit user
         if value.has_key('user'):
             del['value']['user']
         
         return value
     
 class ValidPath(formencode.validators.FancyValidator):
     def to_python(self, value, state):
         isdir = os.path.isdir(value.replace('*', ''))
         if (value.endswith('/*') or value.endswith('/**')) and isdir:
             return value
         elif not isdir:
             msg = _('This is not a valid path') 
         else:
             msg = _('You need to specify * or ** at the end of path (ie. /tmp/*)')
         
         raise formencode.Invalid(msg, value, state,
                                      error_dict={'paths_root_path':msg})            
                        
 #===============================================================================
 # FORMS        
 #===============================================================================
 class LoginForm(formencode.Schema):
     allow_extra_fields = True
     filter_extra_fields = True
     username = UnicodeString(
                              strip=True,
                              min=3,
                              not_empty=True,
                              messages={
                                        'empty':_('Please enter a login'),
                                        'tooShort':_('Enter a value %(min)i characters long or more')}
                             )
 
     password = UnicodeString(
                             strip=True,
                             min=3,
                             not_empty=True,
                             messages={
                                       'empty':_('Please enter a password'),
                                       'tooShort':_('Enter a value %(min)i characters long or more')}
                                 )
 
 
     #chained validators have access to all data
     chained_validators = [ValidAuth]
     
 def UserForm(edit=False, old_data={}):
     class _UserForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = True
         username = All(UnicodeString(strip=True, min=3, not_empty=True), ValidUsername(edit, old_data))
         if edit:
             new_password = All(UnicodeString(strip=True, min=3, not_empty=False), ValidPassword)
             admin = StringBoolean(if_missing=False)
         else:
             password = All(UnicodeString(strip=True, min=8, not_empty=True), ValidPassword)
         active = StringBoolean(if_missing=False)
         name = UnicodeString(strip=True, min=3, not_empty=True)
         lastname = UnicodeString(strip=True, min=3, not_empty=True)
         email = Email(not_empty=True)
         
     return _UserForm
 
 RegisterForm = UserForm
     
     
 def RepoForm(edit=False, old_data={}):
     class _RepoForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = False
         repo_name = All(UnicodeString(strip=True, min=1, not_empty=True), ValidRepoName(edit, old_data))
         description = UnicodeString(strip=True, min=3, not_empty=True)
         private = StringBoolean(if_missing=False)
         
         if edit:
             user = All(Int(not_empty=True), ValidRepoUser)
         
         chained_validators = [ValidPerms]
     return _RepoForm
 
 def RepoSettingsForm(edit=False, old_data={}):
     class _RepoForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = False
         repo_name = All(UnicodeString(strip=True, min=1, not_empty=True), ValidRepoName(edit, old_data))
         description = UnicodeString(strip=True, min=3, not_empty=True)
         private = StringBoolean(if_missing=False)
         
         chained_validators = [ValidPerms, ValidSettings]
     return _RepoForm
 
 
 def ApplicationSettingsForm():
     class _ApplicationSettingsForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = False
         hg_app_title = UnicodeString(strip=True, min=3, not_empty=True)
         hg_app_realm = UnicodeString(strip=True, min=3, not_empty=True)
         
     return _ApplicationSettingsForm
  
 def ApplicationUiSettingsForm():
     class _ApplicationUiSettingsForm(formencode.Schema):
         allow_extra_fields = True
         filter_extra_fields = False
         web_push_ssl = OneOf(['true', 'false'], if_missing='false')
         paths_root_path = All(ValidPath(), UnicodeString(strip=True, min=3, not_empty=True))
         hooks_changegroup_update = OneOf(['True', 'False'], if_missing=False)
         hooks_changegroup_repo_size = OneOf(['True', 'False'], if_missing=False)
         
     return _ApplicationUiSettingsForm
 
+def DefaultPermissionsForm(perms_choices, register_choices, create_choices):
+    class _DefaultPermissionsForm(formencode.Schema):
+        allow_extra_fields = True
+        filter_extra_fields = True
+        default_perm = OneOf(perms_choices)
+        default_register = OneOf(register_choices)
+        default_create = OneOf(create_choices)
+        
+    return _DefaultPermissionsForm

pylons_app/model/repo_model.py

@@ -1,178 +1,185 b''
 #!/usr/bin/env python
 # encoding: utf-8
 # model for handling repositories actions
 # Copyright (C) 2009-2010 Marcin Kuzminski <[e-mail]>
 # This program is free software; you can redistribute it and/or
 # modify it under the terms of the GNU General Public License
 # as published by the Free Software Foundation; version 2
 # of the License or (at your opinion) any later version of the license.
 # 
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 # 
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
 # MA  02110-1301, USA.
 """
 Created on Jun 5, 2010
 model for handling repositories actions
 @author: marcink
 """
 from datetime import datetime
 from pylons import app_globals as g
 from pylons_app.lib.utils import check_repo
 from pylons_app.model.db import Repository, RepoToPerm, User, Permission
 from pylons_app.model.meta import Session
+from pylons_app.model.user_model import UserModel
 import logging
 import os
 import shutil
 import traceback
 log = logging.getLogger(__name__)
 
 class RepoModel(object):
     
     def __init__(self):
         self.sa = Session()
     
     def get(self, id):
         return self.sa.query(Repository).filter(Repository.repo_name == id).scalar()
         
     def get_users_js(self):
         
         users = self.sa.query(User).filter(User.active == True).all()
         u_tmpl = '''{id:%s, fname:"%s", lname:"%s", nname:"%s"},'''
         users_array = '[%s];' % '\n'.join([u_tmpl % (u.user_id, u.name,
                                                     u.lastname, u.username) 
                                         for u in users])
         return users_array        
         
     
     def update(self, repo_name, form_data):
         try:
 
             #update permissions
             for username, perm in form_data['perms_updates']:
                 r2p = self.sa.query(RepoToPerm)\
                         .filter(RepoToPerm.user == self.sa.query(User)\
                                 .filter(User.username == username).one())\
                         .filter(RepoToPerm.repository == self.get(repo_name))\
                         .one()
                 
                 r2p.permission_id = self.sa.query(Permission).filter(
                                                 Permission.permission_name == 
                                                 perm).one().permission_id
                 self.sa.add(r2p)
             
             #set new permissions
             for username, perm in form_data['perms_new']:
                 r2p = RepoToPerm()
                 r2p.repository = self.get(repo_name)
                 r2p.user = self.sa.query(User)\
                                 .filter(User.username == username).one()
                 
                 r2p.permission_id = self.sa.query(Permission).filter(
                                         Permission.permission_name == perm)\
                                         .one().permission_id
                 self.sa.add(r2p)
             
             #update current repo
             cur_repo = self.get(repo_name)
              
             for k, v in form_data.items():
                 if k == 'user':
                     cur_repo.user_id = v
                 else:
                     setattr(cur_repo, k, v)
                                                         
             self.sa.add(cur_repo)
             
             if repo_name != form_data['repo_name']:
                 #rename our data
                 self.__rename_repo(repo_name, form_data['repo_name'])            
             
             self.sa.commit()
         except:
             log.error(traceback.format_exc())
             self.sa.rollback()
             raise    
     
     def create(self, form_data, cur_user, just_db=False):
         try:
             repo_name = form_data['repo_name']
             new_repo = Repository()
             for k, v in form_data.items():
                 setattr(new_repo, k, v)
                 
             new_repo.user_id = cur_user.user_id
             self.sa.add(new_repo)
             
             #create default permission
             repo_to_perm = RepoToPerm()
-            default_perm = 'repository.none' if form_data['private'] \
-                                                        else 'repository.read'
+            default = 'repository.read'
+            for p in UserModel().get_default().user_perms:
+                if p.permission.permission_name.startswith('repository.'):
+                    default = p.permission.permission_name
+                    break
+            
+            default_perm = 'repository.none' if form_data['private'] else default
+            
             repo_to_perm.permission_id = self.sa.query(Permission)\
                     .filter(Permission.permission_name == default_perm)\
                     .one().permission_id
                         
             repo_to_perm.repository_id = new_repo.repo_id
             repo_to_perm.user_id = self.sa.query(User)\
                     .filter(User.username == 'default').one().user_id 
             
             self.sa.add(repo_to_perm)
             self.sa.commit()
             if not just_db:
                 self.__create_repo(repo_name)
         except:
             log.error(traceback.format_exc())
             self.sa.rollback()
             raise    
                      
     def delete(self, repo):
         try:
             self.sa.delete(repo)
             self.sa.commit()
             self.__delete_repo(repo.repo_name)
         except:
             log.error(traceback.format_exc())
             self.sa.rollback()
             raise
         
     def delete_perm_user(self, form_data, repo_name):
         try:
             self.sa.query(RepoToPerm)\
                 .filter(RepoToPerm.repository == self.get(repo_name))\
                 .filter(RepoToPerm.user_id == form_data['user_id']).delete()
             self.sa.commit()
         except:
             log.error(traceback.format_exc())
             self.sa.rollback()
             raise
            
     def __create_repo(self, repo_name):        
         repo_path = os.path.join(g.base_path, repo_name)
         if check_repo(repo_name, g.base_path):
             log.info('creating repo %s in %s', repo_name, repo_path)
             from vcs.backends.hg import MercurialRepository
             MercurialRepository(repo_path, create=True)
 
     def __rename_repo(self, old, new):
         log.info('renaming repo from %s to %s', old, new)
         
         old_path = os.path.join(g.base_path, old)
         new_path = os.path.join(g.base_path, new)
         if os.path.isdir(new_path):
             raise Exception('Was trying to rename to already existing dir %s',
                             new_path)        
         shutil.move(old_path, new_path)
     
     def __delete_repo(self, name):
         rm_path = os.path.join(g.base_path, name)
         log.info("Removing %s", rm_path)
         #disable hg 
         shutil.move(os.path.join(rm_path, '.hg'), os.path.join(rm_path, 'rm__.hg'))
         #disable repo
         shutil.move(rm_path, os.path.join(g.base_path, 'rm__%s__%s' \
                                           % (datetime.today(), name)))

pylons_app/model/user_model.py

@@ -1,126 +1,128 b''
 #!/usr/bin/env python
 # encoding: utf-8
 # Model for users
 # Copyright (C) 2009-2010 Marcin Kuzminski <[e-mail]>
  
 # This program is free software; you can redistribute it and/or
 # modify it under the terms of the GNU General Public License
 # as published by the Free Software Foundation; version 2
 # of the License or (at your opinion) any later version of the license.
 # 
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 # 
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
 # MA  02110-1301, USA.
 
 """
 Created on April 9, 2010
 Model for users
 @author: marcink
 """
 
 from pylons_app.model.db import User
 from pylons_app.model.meta import Session
 from pylons.i18n.translation import _
 import logging
 log = logging.getLogger(__name__)
 
 class DefaultUserException(Exception):pass
 
 class UserModel(object):
 
     def __init__(self):
         self.sa = Session() 
     
+    def get_default(self):
+        return self.sa.query(User).filter(User.username == 'default').scalar()
+    
     def get_user(self, id):
         return self.sa.query(User).get(id)
     
     def create(self, form_data):
         try:
             new_user = User()
             for k, v in form_data.items():
                 setattr(new_user, k, v)
                 
             self.sa.add(new_user)
             self.sa.commit()
         except Exception as e:
             log.error(e)
             self.sa.rollback()
             raise      
     
     def create_registration(self, form_data):
         try:
             new_user = User()
             for k, v in form_data.items():
-                if k != 'admin' or k != 'active':
+                if k != 'admin':
                     setattr(new_user, k, v)
-                setattr(new_user, 'active', True)
                 
             self.sa.add(new_user)
             self.sa.commit()
         except Exception as e:
             log.error(e)
             self.sa.rollback()
             raise      
     
     def update(self, uid, form_data):
         try:
             new_user = self.sa.query(User).get(uid)
             if new_user.username == 'default':
                 raise DefaultUserException(
                                 _("You can't Edit this user since it's" 
                                   " crucial for entire application"))
             for k, v in form_data.items():
                 if k == 'new_password' and v != '':
                     new_user.password = v
                 else:
                     setattr(new_user, k, v)
                 
             self.sa.add(new_user)
             self.sa.commit()
         except Exception as e:
             log.error(e)
             self.sa.rollback()
             raise      
         
     def update_my_account(self, uid, form_data):
         try:
             new_user = self.sa.query(User).get(uid)
             if new_user.username == 'default':
                 raise DefaultUserException(
                                 _("You can't Edit this user since it's" 
                                   " crucial for entire application"))
             for k, v in form_data.items():
                 if k == 'new_password' and v != '':
                     new_user.password = v
                 else:
                     if k not in ['admin', 'active']:
                         setattr(new_user, k, v)
                 
             self.sa.add(new_user)
             self.sa.commit()
         except Exception as e:
             log.error(e)
             self.sa.rollback()
             raise 
                 
     def delete(self, id):
         
         try:
             
             user = self.sa.query(User).get(id)
             if user.username == 'default':
                 raise DefaultUserException(
                                 _("You can't remove this user since it's" 
                                   " crucial for entire application"))
             self.sa.delete(user)
             self.sa.commit()            
         except Exception as e:
             log.error(e)
             self.sa.rollback()
             raise        

pylons_app/templates/admin/permissions/permissions.html

@@ -1,45 +1,62 b''
 ## -*- coding: utf-8 -*-
 <%inherit file="/base/base.html"/>
 
 <%def name="title()">
     ${_('Permissions administration')}
 </%def>
 
 <%def name="breadcrumbs_links()">
     ${h.link_to(_('Admin'),h.url('admin_home'))} 
     &raquo;
     ${_('Permissions')}    
 </%def>
 
 <%def name="page_nav()">
 	${self.menu('admin')}
 </%def>
 
 <%def name="main()">
 <div class="box">
     <!-- box / title -->
     <div class="title">
         ${self.breadcrumbs()}       
     </div>
-    <h3>${_('Repositories permissions')}</h3>
-    ${h.form(url('permission', id='default_perm'),method='put')}
+    <h3>${_('Default permissions')}</h3>
+    ${h.form(url('permission', id='default'),method='put')}
     <div class="form">
         <!-- fields -->
         <div class="fields">
         
 			<div class="field">
 				<div class="label">
-					<label for="default_perm">${_('default repository permission')}:</label>
+					<label for="default_perm">${_('Default repository permission')}:</label>
 				</div>
 				<div class="select">
-					${h.select('default_perm','repository.read',['repository.none','repository.read','repository.write','repository.admin'])}
+					${h.select('default_perm','',c.perms_choices)}
+				</div>
+			</div>   
+			<div class="field">
+		        <div class="label">
+		            <label for="default_register">${_('Registration')}:</label>
+		        </div>
+				<div class="select">
+					${h.select('default_register','',c.register_choices)}
 				</div>
-			</div>           
+			</div> 		
+             <div class="field">
+                <div class="label">
+                    <label for="default_create">${_('Allow repository creation')}:</label>
+                </div>
+				<div class="select">
+					${h.select('default_create','',c.create_choices)}
+				</div>
+             </div>	
+				        
 	        <div class="buttons">
 	        ${h.submit('set','set',class_="ui-button ui-widget ui-state-default ui-corner-all")}
-	        </div>                                                          
+	        </div>	                                                               
         </div>
     </div>  
     ${h.end_form()}
 </div>
 </%def>    

pylons_app/templates/base/base.html

@@ -1,255 +1,255 b''
 ## -*- coding: utf-8 -*-
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
 <html xmlns="http://www.w3.org/1999/xhtml" id="mainhtml">
 <head>
     <title>${next.title()}</title>
     <link rel="icon" href="/images/hgicon.png" type="image/png" />
     <meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
     <meta name="robots" content="index, nofollow"/>
     <!-- stylesheets -->
     ${self.css()}
     <!-- scripts -->
     ${self.js()}
 </head>
 <body>
     <!-- header -->
     <div id="header">
         <!-- user -->
         <ul id="logged-user">
             <li class="first">
 	            <div class="gravatar">
 	            	<img alt="gravatar" src="${h.gravatar_url(c.hg_app_user.email,24)}" />
 	            </div>
 	            <div class="account">
 	            	${h.link_to('%s %s'%(c.hg_app_user.name,c.hg_app_user.lastname),h.url('admin_settings_my_account'))}<br/>
 	            	${h.link_to(c.hg_app_user.username,h.url('admin_settings_my_account'))}
 	            </div>	
             </li>
             <li class="last highlight">${h.link_to(u'Logout',h.url('logout_home'))}</li>
         </ul>
         <!-- end user -->
         <div id="header-inner">
             <div id="home">
                 <a href="${h.url('hg_home')}"></a>
             </div>
             <!-- logo -->
             <div id="logo">
                 <h1><a href="${h.url('hg_home')}">${c.hg_app_name}</a></h1>
             </div>
             <!-- end logo -->
             <!-- quick menu -->
             ${self.page_nav()}
             <!-- end quick -->
             <div class="corner tl"></div>
             <div class="corner tr"></div>
         </div>
     </div>     
     <!-- end header -->
     
 	<!-- CONTENT -->
 	<div id="content"> 
         <div class="flash_msg">
             <% messages = h.flash.pop_messages() %>
             % if messages:
             <ul id="flash-messages">
                 % for message in messages:
                 <li class="${message.category}_msg">${message}</li>
                 % endfor
             </ul>
             % endif
         </div>	    
 	    <div id="main"> 
 	        ${next.main()}
 	    </div>
 	</div> 
     <!-- END CONTENT -->
 
 	<!-- footer -->
 	<div id="footer">
 	    <p>Hg App ${c.hg_app_version} &copy; 2010 by Marcin Kuzminski</p>
         <script type="text/javascript">${h.tooltip.activate()}</script>	    
 	</div>
 	<!-- end footer -->
 </body>
 
 </html>
 
 ### MAKO DEFS ### 
 <%def name="page_nav()">
 	${self.menu()}
 </%def>
 
 <%def name="menu(current=None)">
 		<% 
 		def is_current(selected):
 			if selected == current:
 				return h.literal('class="current"')
 		%>
 		%if current not in ['home','admin']:
            <script type="text/javascript">
             YAHOO.util.Event.onDOMReady(function(){
                 YAHOO.util.Event.addListener('repo_switcher','click',function(){
                     if(YAHOO.util.Dom.hasClass('repo_switcher','selected')){
                         YAHOO.util.Dom.setStyle('switch_repos','display','none');
                         YAHOO.util.Dom.setStyle('repo_switcher','background','');
                         YAHOO.util.Dom.removeClass('repo_switcher','selected');
                         YAHOO.util.Dom.get('repo_switcher').removeAttribute('style');
                     }
                     else{
                         YAHOO.util.Dom.setStyle('switch_repos','display','');
                         YAHOO.util.Dom.addClass('repo_switcher','selected');
                     }
                     });
                 YAHOO.util.Event.addListener('repos_list','change',function(e){
                     var wa = YAHOO.util.Dom.get('repos_list').value;
                     
                     var url = "${h.url('summary_home',repo_name='__REPO__')}".replace('__REPO__',wa);
                     window.location = url;
                 })
                });
             </script>
             		
 		   ##REGULAR MENU            
 	        <ul id="quick">
 				<!-- repo switcher -->
 				<li>
 					<a id="repo_switcher" title="${_('Switch repository')}" href="#">
                     <span class="icon">
                         <img src="/images/icons/database.png" alt="${_('Products')}" />
                     </span>
                     <span>&darr;</span>					
 					</a>
 					<div id="switch_repos" style="display:none;">
 						<select id="repos_list" size="10">
 						%for repo in c.repo_switcher_list:
 							<option value="${repo}">${repo}</option>
 						%endfor
 						</select>
 					</div>			
 				</li>
 				
 	            <li ${is_current('summary')}>
 	               <a title="${_('Summary')}" href="${h.url('summary_home',repo_name=c.repo_name)}">
 	               <span class="icon">
 	                   <img src="/images/icons/clipboard_16.png" alt="${_('Summary')}" />
 	               </span>
 	               <span>${_('Summary')}</span>                 
 	               </a>	            
 	            </li>
                 <li ${is_current('shortlog')}>
                    <a title="${_('Shortlog')}" href="${h.url('shortlog_home',repo_name=c.repo_name)}">
                    <span class="icon">
                        <img src="/images/icons/application_double.png" alt="${_('Shortlog')}" />
                    </span>
                    <span>${_('Shortlog')}</span>                 
                    </a>             
                 </li>	            
                 <li ${is_current('changelog')}>
                    <a title="${_('Changelog')}" href="${h.url('changelog_home',repo_name=c.repo_name)}">
                    <span class="icon">
                        <img src="/images/icons/time.png" alt="${_('Changelog')}" />
                    </span>
                    <span>${_('Changelog')}</span>                 
                    </a>             
                 </li>   	            
                 <li ${is_current('branches')}>
                    <a title="${_('Branches')}" href="${h.url('branches_home',repo_name=c.repo_name)}">
                    <span class="icon">
                        <img src="/images/icons/arrow_branch.png" alt="${_('Branches')}" />
                    </span>
                    <span>${_('Branches')}</span>                 
                    </a>             
                 </li> 	            
                 <li ${is_current('tags')}>
                    <a title="${_('Tags')}" href="${h.url('tags_home',repo_name=c.repo_name)}">
                    <span class="icon">
                        <img src="/images/icons/tag_blue.png" alt="${_('Tags')}" />
                    </span>
                    <span>${_('Tags')}</span>                 
                    </a>             
                 </li>
                 <li ${is_current('files')}>
                    <a title="${_('Files')}" href="${h.url('files_home',repo_name=c.repo_name)}">
                    <span class="icon">
                        <img src="/images/icons/file.png" alt="${_('Files')}" />
                    </span>
                    <span>${_('Files')}</span>                 
                    </a>             
                 </li>                            
 				%if h.HasRepoPermissionAll('repository.admin')(c.repo_name):
                 <li ${is_current('settings')}>
                    <a title="${_('Settings')}" href="${h.url('repo_settings_home',repo_name=c.repo_name)}">
                    <span class="icon">
                        <img src="/images/icons/cog_edit.png" alt="${_('Settings')}" />
                    </span>
                    <span>${_('Settings')}</span>                 
                    </a>             
                 </li>				
 				%endif					        
 	        </ul>
 		%else:
 		    ##ROOT MENU
             <ul id="quick">
                 <li>
                     <a title="${_('Home')}"  href="${h.url('hg_home')}">
                     <span class="icon">
                         <img src="/images/icons/home_16.png" alt="${_('Home')}" />
                     </span>
                     <span>${_('Home')}</span>                 
                     </a>        
                 </li>
                 
                 <li>
                     <a title="${_('Search')}"  href="${h.url('search')}">
                     <span class="icon">
                         <img src="/images/icons/search_16.png" alt="${_('Search')}" />
                     </span>
                     <span>${_('Search')}</span>                 
                     </a>        
                 </li>
                 
 				%if h.HasPermissionAll('hg.admin')('access admin main page'):
                 <li ${is_current('admin')}>
                    <a title="${_('Admin')}" href="${h.url('admin_home')}">
                    <span class="icon">
                        <img src="/images/icons/cog_edit.png" alt="${_('Admin')}" />
                    </span>
                    <span>${_('Admin')}</span>                 
                    </a>    
 				    <ul>
 				        <li>${h.link_to(_('repositories'),h.url('repos'),class_='repos')}</li>
 				        <li>${h.link_to(_('users'),h.url('users'),class_='users')}</li>
-				        <li>${h.link_to(_('permissions'),h.url('permissions'),class_='permissions')}</li>
+				        <li>${h.link_to(_('permissions'),h.url('edit_permission',id='default'),class_='permissions')}</li>
 				        <li>${h.link_to(_('settings'),h.url('admin_settings'),class_='settings')}</li>        
 				    </ul>
                 </li>
 				%endif
 				
 			</ul>
 		%endif    
 </%def>
 
 
 <%def name="css()">
 <link rel="stylesheet" type="text/css" href="/css/reset.css" />
 <link rel="stylesheet" type="text/css" href="/css/style.css" media="screen" />
 <link rel="stylesheet" type="text/css" href="/css/style_full.css" />
 <link id="color" rel="stylesheet" type="text/css" href="/css/colors/blue.css" />
 <link rel="stylesheet" type="text/css" href="/css/pygments.css"  />
 <link rel="stylesheet" type="text/css" href="/css/diff.css"  />
 </%def>
 
 <%def name="js()">
 <script type="text/javascript" src="/js/yui/utilities/utilities.js"></script>
 <!--[if IE]><script language="javascript" type="text/javascript" src="/js/excanvas.min.js"></script><![endif]-->
 <script type="text/javascript" src="/js/yui/container/container-min.js"></script>
 <script type="text/javascript" src="/js/yui/datasource/datasource-min.js"></script>
 <script type="text/javascript" src="/js/yui/autocomplete/autocomplete-min.js"></script>
 <script type="text/javascript" src="/js/yui.flot.js"></script>
 </%def>
 
 <%def name="breadcrumbs()">
     <div class="breadcrumbs">
     ${self.breadcrumbs_links()}
     </div>
 </%def>
  No newline at end of file

pylons_app/templates/index.html

@@ -1,84 +1,84 b''
 ## -*- coding: utf-8 -*-
 <%inherit file="base/base.html"/>
 <%def name="title()">
     ${c.hg_app_name}
 </%def>
 <%def name="breadcrumbs()">
 	${c.hg_app_name}
 </%def>
 <%def name="page_nav()">
 	${self.menu('home')}
 </%def>
 <%def name="main()">
 	<%def name="get_sort(name)">
 		<%name_slug = name.lower().replace(' ','_') %>
 		%if name_slug == c.cs_slug:
 			<span style="font-weight: bold;text-decoration: underline;">${name}</span>
 		%else:
 			<span style="font-weight: bold">${name}</span>
 		%endif
 		<a href="?sort=${name_slug}">&darr;</a>
 		<a href="?sort=-${name_slug}">&uarr;</a>
 	</%def>
 	
 	
 	
     <div class="box">
 	    <!-- box / title -->
 	    <div class="title">
 	        <h5>${_('Dashboard')}</h5>
-	        %if h.HasPermissionAny('repository.create','hg.admin')():
+	        %if h.HasPermissionAny('hg.admin','hg.create.repository')():
 	        <ul class="links">
 	          <li>
 	            <span>${h.link_to(u'ADD NEW REPOSITORY',h.url('admin_settings_create_repository'),class_="add_icon")}</span>
 	          </li>          
 	        </ul>  	        
 	        %endif
 	    </div>
 	    <!-- end box / title -->
         <div class="table">
                     <table>
             <thead>
 	            <tr>
 			        <th class="left">${get_sort(_('Name'))}</th>
 			        <th class="left">${get_sort(_('Description'))}</th>
 			        <th class="left">${get_sort(_('Last change'))}</th>
 			        <th class="left">${get_sort(_('Tip'))}</th>
 			        <th class="left">${get_sort(_('Contact'))}</th>
 			        <th class="left">${_('RSS')}</th>
 			        <th class="left">${_('Atom')}</th>
 	            </tr>
             </thead>
                         <tbody>
 					    %for cnt,repo in enumerate(c.repos_list):
 					        %if h.HasRepoPermissionAny('repository.write','repository.read','repository.admin')(repo['name'],'main page check'):
 					        <tr class="parity${cnt%2}">
 					            <td>
 					             %if repo['repo'].dbrepo.private:
 					                <img alt="${_('private')}" src="/images/icons/lock.png"/>
 					             %else:
 					                <img alt="${_('public')}" src="/images/icons/lock_open.png"/>
 					             %endif  
 					            ${h.link_to(repo['name'],
 					                h.url('summary_home',repo_name=repo['name']))}</td>
 					            <td title="${repo['description']}">${h.truncate(repo['description'],60)}</td>
 					            <td>${h.age(repo['last_change'])}</td>
 					            <td>${h.link_to_if(repo['rev']>=0,'r%s:%s' % (repo['rev'],repo['tip']),
 					                h.url('changeset_home',repo_name=repo['name'],revision=repo['tip']),
 					                class_="tooltip",
 					                tooltip_title=h.tooltip(repo['last_msg']))}</td>
 					            <td title="${repo['contact']}">${h.person(repo['contact'])}</td>
 					            <td>
 					                <a title="${_('Subscribe to %s rss feed')%repo['name']}" class="rss_icon"  href="${h.url('rss_feed_home',repo_name=repo['name'])}"></a>
 					            </td>        
 					            <td>
 					                <a title="${_('Subscribe to %s atom feed')%repo['name']}"  class="atom_icon" href="${h.url('atom_feed_home',repo_name=repo['name'])}"></a>
 					            </td>
 					        </tr>
 					        %endif
 					    %endfor
                         </tbody>
                     </table>
             </div>
     </div>	
 </%def>    

pylons_app/templates/login.html

@@ -1,76 +1,78 b''
 ## -*- coding: utf-8 -*-
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
 <html xmlns="http://www.w3.org/1999/xhtml" id="mainhtml">
     <head>
         <title>${_('Sign In to hg-app')}</title>
         <meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
         <link rel="icon" href="/images/hgicon.png" type="image/png" />
         <meta name="robots" content="index, nofollow"/>
             
         <!-- stylesheets -->
         <link rel="stylesheet" type="text/css" href="/css/reset.css" />
         <link rel="stylesheet" type="text/css" href="/css/style.css" media="screen" />
         <link id="color" rel="stylesheet" type="text/css" href="/css/colors/blue.css" />
 
         <!-- scripts -->
 
     </head>
     <body>
 <div id="login">
             <!-- login -->
             <div class="title">
                 <h5>${_('Sign In to hg-app')}</h5>
                 <div class="corner tl"></div>
                 <div class="corner tr"></div>
             </div>
             <div class="inner">            
                 ${h.form(h.url.current())}
                 <div class="form">
                     <!-- fields -->
 
                     <div class="fields">
                         <div class="field">
                             <div class="label">
                                 <label for="username">${_('Username')}:</label>
                             </div>
                             <div class="input">
                                 ${h.text('username',class_='focus',size=40)}
                             </div>
                             
                         </div>                     
                         <div class="field">
                             <div class="label">
                                 <label for="password">${_('Password')}:</label>
                             </div>
                             <div class="input">
                                 ${h.password('password',class_='focus',size=40)}
                             </div>
                             
                         </div>
                         ##<div class="field">
                         ##    <div class="checkbox">
                         ##        <input type="checkbox" id="remember" name="remember" />
                         ##        <label for="remember">Remember me</label>
                         ##    </div>
                         ##</div>
                         <div class="buttons">
                             ${h.submit('sign_in','Sign In',class_="ui-button ui-widget ui-state-default ui-corner-all")}
                         </div>
                     </div>
                     <!-- end fields -->
                     <!-- links -->
                     <div class="links">
                         ${h.link_to(_('Forgot your password ?'),h.url('#'))}
-                         / 
-                        ${h.link_to(_("Don't have an account ?"),h.url('register'))}
+                        %if h.HasPermissionAny('hg.admin', 'hg.register.auto_activate', 'hg.register.manual_activate')():
+	                         / 
+	                        ${h.link_to(_("Don't have an account ?"),h.url('register'))}
+                        %endif
                     </div>
 
                     <!-- end links -->
                 </div>
                 ${h.end_form()}
             </div>
             <!-- end login -->
         </div>
     </body>
 </html>
 

pylons_app/templates/register.html

@@ -1,88 +1,93 b''
 ## -*- coding: utf-8 -*-
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
 <html xmlns="http://www.w3.org/1999/xhtml" id="mainhtml">
     <head>
         <title>${_('Sign Up to hg-app')}</title>
         <meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
         <link rel="icon" href="/images/hgicon.png" type="image/png" />
         <meta name="robots" content="index, nofollow"/>
             
         <!-- stylesheets -->
         <link rel="stylesheet" type="text/css" href="/css/reset.css" />
         <link rel="stylesheet" type="text/css" href="/css/style.css" media="screen" />
         <link id="color" rel="stylesheet" type="text/css" href="/css/colors/blue.css" />
 
         <!-- scripts -->
 
     </head>
     <body>
 		<div id="register">
 			
 			<div class="title">
 				<h5>${_('Sign Up to hg-app')}</h5>
                 <div class="corner tl"></div>
                 <div class="corner tr"></div>				
 			</div>
 			<div class="inner">
 			    ${h.form(url('register'))}
 			    <div class="form">
 			        <!-- fields -->
 			        <div class="fields">
 			             <div class="field">
 			                <div class="label">
 			                    <label for="username">${_('Username')}:</label>
 			                </div>
 			                <div class="input">
 			                    ${h.text('username')}
 			                </div>
 			             </div>
 			            
 			             <div class="field">
 			                <div class="label">
 			                    <label for="password">${_('New Password')}:</label>
 			                </div>
 			                <div class="input">
 			                    ${h.password('password')}
 			                </div>
 			             </div>
 			            
 			             <div class="field">
 			                <div class="label">
 			                    <label for="name">${_('First Name')}:</label>
 			                </div>
 			                <div class="input">
 			                    ${h.text('name')}
 			                </div>
 			             </div>
 			            
 			             <div class="field">
 			                <div class="label">
 			                    <label for="lastname">${_('Last Name')}:</label>
 			                </div>
 			                <div class="input">
 			                    ${h.text('lastname')}
 			                </div>
 			             </div>
 			            
 			             <div class="field">
 			                <div class="label">
 			                    <label for="email">${_('Email')}:</label>
 			                </div>
 			                <div class="input">
 			                    ${h.text('email')}
 			                </div>
 			             </div>
 			                        
 			            <div class="buttons">
 				            <div class="nohighlight">
 				              ${h.submit('sign_up','Sign Up',class_="ui-button ui-widget ui-state-default ui-corner-all")}
+				              %if c.auto_active:
+							  	<div class="activation_msg">${_('Your account will be activated right after registration')}</div>
+							  %else:
+							  	<div class="activation_msg">${_('Your account must wait for activation by administrator')}</div>
+							  %endif
 				            </div>
 			            </div>             
 			    	</div>
 			    </div>
 			    ${h.end_form()}
 			</div>    
 	    </div>
     </body>
 </html>
 

pylons_app/websetup.py

@@ -1,23 +1,24 b''
 """Setup the pylons_app application"""
 
 from os.path import dirname as dn, join as jn
 from pylons_app.config.environment import load_environment
 from pylons_app.lib.db_manage import DbManage
 import logging
 import os
 import sys
 
 log = logging.getLogger(__name__)
 
 ROOT = dn(dn(os.path.realpath(__file__)))
 sys.path.append(ROOT)
 
 def setup_app(command, conf, vars):
     """Place any commands to setup pylons_app here"""
     dbmanage = DbManage(log_sql=True)
     dbmanage.create_tables(override=True)
     dbmanage.config_prompt()
     dbmanage.admin_prompt()
     dbmanage.create_permissions()
+    dbmanage.populate_default_permissions()
     load_environment(conf.global_conf, conf.local_conf, initial=True)