def denySidebar(fun):

  """Decorator that denies access if the sidebar is calling.

  from functools import wraps

  @wraps(fun)

  def wrapper(self, django_args, *args, **kwargs):

    if django_args.get('SIDEBAR_CALLING'):

      raise out_of_band.Error("Sidebar Calling")

    return fun(self, django_args, *args, **kwargs)

  return wrapper

class Checker(object):

  The __setitem__() and __getitem__() methods are overloaded to DTRT

  when adding new access rights, and retrieving them, so use these

  rather then modifying rights directly if so desired.

  def __init__(self, params):

    """Adopts base.rights as rights if base is set.

    """

    base = params.get('rights') if params else None

    self.rights = base.rights if base else {}

  def __setitem__(self, key, value):

    """Sets a value only if no old value exists.

    """

    oldvalue = self.rights.get(key)

    self.rights[key] = oldvalue if oldvalue else value

  def __getitem__(self, key):

    """Retrieves the right checkers and massages then into a default format.

    The result is guaranteed to be a list of 2-tuples, the first element is a

    checker (iff there is an checker with the specified name), the second

    element is a list of arguments that should be passed to the checker when

    calling it in addition to the standard django_args.

    """

    result = []

    for i in self.rights.get(key, []):

      # Be nice an repack so that it is always a list with tuples

      if isinstance(i, tuple):

        name, arg = i

        tmp = (getattr(self, name), (arg if isinstance(arg, list) else [arg]))

        result.append(tmp)

      else:

        tmp = (getattr(self, i), [])

        result.append(tmp)

    return result

  def checkAccess(self, access_type, django_args):

    """Runs all the defined checks for the specified type.

    Args:

      access_type: the type of request (such as 'list' or 'edit')

      rights: a dictionary containing access check functions

      django_args: a dictionary with django's arguments

    Rights usage:

      The rights dictionary is used to check if the current user is allowed

      to view the page specified. The functions defined in this dictionary

      are always called with the provided django_args dictionary as argument. On any

      request, regardless of what type, the functions in the 'any_access' value

      are called. If the specified type is not in the rights dictionary, all

      the functions in the 'unspecified' value are called. When the specified

      type _is_ in the rights dictionary, all the functions in that access_type's

      value are called.

    """

    self.id = users.get_current_user()

    # Call each access checker

    for check, args in self['any_access']:

      check(django_args, *args)

    if access_type not in self.rights:

      for check, args in self['unspecified']:

        # No checks defined, so do the 'generic' checks and bail out

        check(django_args, *args)

      return

    for check, args in self[access_type]:

      check(django_args, *args)

  def allow(self, django_args):

    """Never raises an alternate HTTP response.  (an access no-op, basically).

    Args:

      django_args: a dictionary with django's arguments

    """

  def deny(self, django_args):

    """Always raises an alternate HTTP response.

    Args:

      django_args: a dictionary with django's arguments

    Raises:

      always raises AccessViolationResponse if called

    """

    context = django_args.get('context', {})

    context['title'] = 'Access denied'

    raise out_of_band.AccessViolation(DEF_PAGE_DENIED_MSG, context=context)

  def checkIsLoggedIn(self, django_args):

    """Raises an alternate HTTP response if Google Account is not logged in.

    Args:

      django_args: a dictionary with django's arguments

    Raises:

      AccessViolationResponse:

      * if no Google Account is even logged in

    """

    if self.id:

      return

    raise out_of_band.LoginRequest()

  def checkNotLoggedIn(self, django_args):

    """Raises an alternate HTTP response if Google Account is logged in.

    Args:

      django_args: a dictionary with django's arguments

    Raises:

      AccessViolationResponse:

      * if a Google Account is currently logged in

    """

    if not self.id:

      return

    raise out_of_band.LoginRequest(message_fmt=DEF_LOGOUT_MSG_FMT)

  def checkIsUser(self, django_args):

    """Raises an alternate HTTP response if Google Account has no User entity.

    Args:

      django_args: a dictionary with django's arguments

    Raises:

      AccessViolationResponse:

      * if no User exists for the logged-in Google Account, or

      * if no Google Account is logged in at all

    """

    self.checkIsLoggedIn(django_args)

    user = user_logic.getForCurrentAccount()

    if user:

      return

    raise out_of_band.LoginRequest(message_fmt=DEF_NO_USER_LOGIN_MSG_FMT)

  def checkAgreesToSiteToS(self, django_args):

    """Raises an alternate HTTP response if User has not agreed to site-wide ToS.

    Args:

      django_args: a dictionary with django's arguments

    Raises:

      AccessViolationResponse:

      * if User has not agreed to the site-wide ToS, or

      * if no User exists for the logged-in Google Account, or

      * if no Google Account is logged in at all

    """

    self.checkIsUser(django_args)

    user = user_logic.getForCurrentAccount()

    if user_logic.agreesToSiteToS(user):

      return

    # Would not reach this point of site-wide ToS did not exist, since

    # agreesToSiteToS() call above always returns True if no ToS is in effect.

    login_msg_fmt = DEF_AGREE_TO_TOS_MSG_FMT % {

        'tos_link': redirects.getToSRedirect(site_logic.getSingleton())}

    raise out_of_band.LoginRequest(message_fmt=login_msg_fmt)

  def checkIsDeveloper(self, django_args):

    """Raises an alternate HTTP response if Google Account is not a Developer.

    Args:

      django_args: a dictionary with django's arguments

    Raises:

      AccessViolationResponse:

      * if User is not a Developer, or

      * if no User exists for the logged-in Google Account, or

      * if no Google Account is logged in at all

    """

    self.checkAgreesToSiteToS(django_args)

    if accounts.isDeveloper(account=self.id):

      return

    login_message_fmt = DEF_DEV_LOGOUT_LOGIN_MSG_FMT % {

        'role': 'a Site Developer '}

    raise out_of_band.LoginRequest(message_fmt=login_message_fmt)

  def checkCanMakeRequestToGroup(self, django_args, group_logic):

    """Raises an alternate HTTP response if the specified group is not in an

    active state.

    Note that state hasn't been implemented yet

    Args:

      group_logic: Logic module for the type of group which the request is for

    """

        group_logic.logic, django_args['scope_path'])

  def checkCanCreateFromRequest(self, django_args, role_name):

    """Raises an alternate HTTP response if the specified request does not exist

       or if it's state is not group_accepted.

    """

    self.checkAgreesToSiteToS(django_args)

    if user_entity.link_id != django_args['link_id']:

      deny(django_args)

    fields = {'link_id': django_args['link_id'],

        'scope_path': django_args['scope_path'],

      deny(django_args)

  def checkCanProcessRequest(self, django_args, role_name):

    """Raises an alternate HTTP response if the specified request does not exist

       or if it's state is completed or denied.

    """

    fields = {'link_id': django_args['link_id'],

        'scope_path': django_args['scope_path'],

      deny(django_args)

  def checkIsMyGroupAcceptedRequest(self, django_args):

    """Raises an alternate HTTP response if the specified request does not exist

       or if it's state is not group_accepted.

    """

    self.checkAgreesToSiteToS(django_args)

    user_entity = user_logic.getForCurrentAccount()

    if user_entity.link_id != django_args['link_id']:

      # not the current user's request

      return deny(django_args)

    fields = {'link_id': django_args['link_id'],

              'scope_path': django_args['scope_path'],

              'role': django_args['role']}

    request_entity = request_logic.getForFields(fields, unique=True)

    if not request_entity:

      # TODO return 404

      return deny(django_args)

    if request_entity.state != 'group_accepted':

      return deny(django_args)

  @denySidebar

  def checkIsHost(self, django_args):

    """Raises an alternate HTTP response if Google Account has no Host entity.

    Args:

      request: a Django HTTP request

    Raises:

      AccessViolationResponse:

      * if User is not already a Host, or

      * if User has not agreed to the site-wide ToS, or

      * if no User exists for the logged-in Google Account, or

      * if the user is not even logged in

    """

      self.checkIsDeveloper(django_args)

    self.checkAgreesToSiteToS(django_args)

    user = user_logic.getForCurrentAccount()

    if django_args.get('scope_path'):

      scope_path = django_args['scope_path']

    else:

      scope_path = django_args['link_id']

    fields = {'user': user,

              'scope_path': scope_path,

              'state': 'active'}

    host = host_logic.getForFields(fields, unique=True)

    self.checkAgreesToSiteToS(django_args)

    user = user_logic.getForCurrentAccount()

    fields = {'user': user,

              'state': 'active'}

    host = host_logic.getForFields(fields, unique=True)

    if host:

      return

    login_message_fmt = DEF_DEV_LOGOUT_LOGIN_MSG_FMT % {

        'role': 'a Program Administrator '}

    raise out_of_band.LoginRequest(message_fmt=login_message_fmt)

  def checkIsHostForSponsor(self, django_args):

    """Raises an alternate HTTP response if Google Account has no Host entity

       for the specified Sponsor.

    Args:

      request: a Django HTTP request

    Raises:

      AccessViolationResponse:

      * if User is not already a Host for the specified program, or

      * if User has not agreed to the site-wide ToS, or

      * if no User exists for the logged-in Google Account, or

      * if the user is not even logged in

    """

    self.checkAgreesToSiteToS(django_args)

    user = user_logic.getForCurrentAccount()

    if django_args.get('scope_path'):

      scope_path = django_args['scope_path']

    else:

      scope_path = django_args['link_id']

    fields = {'user': user,

              'scope_path': scope_path,

              'state': 'active'}

    host = host_logic.getForFields(fields, unique=True)

    if host:

      return

    login_message_fmt = DEF_DEV_LOGOUT_LOGIN_MSG_FMT % {

        'role': 'a Program Administrator '}

    raise out_of_band.LoginRequest(message_fmt=login_message_fmt)

  def checkIsClubAdminForClub(self, django_args):

    """Returns an alternate HTTP response if Google Account has no Club Admin

       entity for the specified club.

    Args:

      django_args: a dictionary with django's arguments

     Raises:

       AccessViolationResponse: if the required authorization is not met

    Returns:

      None if Club Admin exists for the specified club, or a subclass of

      django.http.HttpResponse which contains the alternate response

      should be returned by the calling view.

    """