app/soc/views/helper/access.py
author Sverre Rabbelier <srabbelier@gmail.com>
Fri, 13 Feb 2009 21:54:10 +0000
changeset 1305 9567bb475d6d
parent 1300 a89d673771eb
child 1307 091a21cf3627
permissions -rw-r--r--
Do access checks on the pick url for documents Patch by: Sverre Rabbelier
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
293
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
     1
#!/usr/bin/python2.5
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
     2
#
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
     3
# Copyright 2008 the Melange authors.
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
     4
#
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
     5
# Licensed under the Apache License, Version 2.0 (the "License");
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
     6
# you may not use this file except in compliance with the License.
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
     7
# You may obtain a copy of the License at
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
     8
#
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
     9
#   http://www.apache.org/licenses/LICENSE-2.0
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
    10
#
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
    11
# Unless required by applicable law or agreed to in writing, software
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
    12
# distributed under the License is distributed on an "AS IS" BASIS,
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
    13
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
    14
# See the License for the specific language governing permissions and
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
    15
# limitations under the License.
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
    16
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
    17
"""Access control helper.
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
    18
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
    19
The functions in this module can be used to check access control
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
    20
related requirements. When the specified required conditions are not
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
    21
met, an exception is raised. This exception contains a views that
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
    22
either prompts for authentication, or informs the user that they
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
    23
do not meet the required criteria.
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
    24
"""
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
    25
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
    26
__authors__ = [
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
    27
  '"Todd Larsen" <tlarsen@google.com>',
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
    28
  '"Sverre Rabbelier" <sverre@rabbelier.nl>',
726
ba3d399ec9be Added Notifications.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 720
diff changeset
    29
  '"Lennard de Rijk" <ljvderijk@gmail.com>',
293
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
    30
  '"Pawel Solyga" <pawel.solyga@gmail.com>',
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
    31
  ]
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
    32
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
    33
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
    34
from google.appengine.api import users
1017
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
    35
from google.appengine.api import memcache
315
c4f1a07ee340 Add missing blank lines between imports in access.py module.
Pawel Solyga <Pawel.Solyga@gmail.com>
parents: 309
diff changeset
    36
746
018efb9863dc Fix import sorting in soc.views.helper.access module and rename 'host' to 'Program Administrator'.
Pawel Solyga <Pawel.Solyga@gmail.com>
parents: 729
diff changeset
    37
from django.core import urlresolvers
970
8b5611d5b053 Use ugettext instead of ugettext_lazy
Sverre Rabbelier <srabbelier@gmail.com>
parents: 965
diff changeset
    38
from django.utils.translation import ugettext
293
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
    39
481
94834a1e6c01 Attempt to rename User.id to User.account, in preparation for making User be
Todd Larsen <tlarsen@google.com>
parents: 448
diff changeset
    40
from soc.logic import accounts
720
9eb2522dfa83 Make it possible to invite another Host as Host
Sverre Rabbelier <srabbelier@gmail.com>
parents: 714
diff changeset
    41
from soc.logic import dicts
1135
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
    42
from soc.logic import rights as rights_logic
1223
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
    43
from soc.logic.helper import timeline as timeline_helper
914
6ec8dd2a73b3 Added various access methods in preperation for the new request system.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 895
diff changeset
    44
from soc.logic.models.club_admin import logic as club_admin_logic
1135
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
    45
from soc.logic.models.club_member import logic as club_member_logic
1115
0a723ff3d27c Cleanups in base.Logic
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1107
diff changeset
    46
from soc.logic.models.document import logic as document_logic
887
b8c1a6bc913e Take advantage of new "from ... import ... as ..." rules in the style guide.
Todd Larsen <tlarsen@google.com>
parents: 884
diff changeset
    47
from soc.logic.models.host import logic as host_logic
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
    48
from soc.logic.models.mentor import logic as mentor_logic
887
b8c1a6bc913e Take advantage of new "from ... import ... as ..." rules in the style guide.
Todd Larsen <tlarsen@google.com>
parents: 884
diff changeset
    49
from soc.logic.models.notification import logic as notification_logic
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
    50
from soc.logic.models.org_admin import logic as org_admin_logic
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
    51
from soc.logic.models.program import logic as program_logic
887
b8c1a6bc913e Take advantage of new "from ... import ... as ..." rules in the style guide.
Todd Larsen <tlarsen@google.com>
parents: 884
diff changeset
    52
from soc.logic.models.request import logic as request_logic
979
789e70941055 Added checkCanMakeRequestToGroup to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 974
diff changeset
    53
from soc.logic.models.role import logic as role_logic
891
3d40190f35b6 Move getToSLink() to soc.views.helper.redirects.getToSRedirect().
Todd Larsen <tlarsen@google.com>
parents: 890
diff changeset
    54
from soc.logic.models.site import logic as site_logic
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
    55
#from soc.logic.models.student import logic as student_logic
1142
da2487767ef4 Fix missing dot and wrong import sorting in soc.views.helper.access module.
Pawel Solyga <Pawel.Solyga@gmail.com>
parents: 1135
diff changeset
    56
from soc.logic.models.timeline import logic as timeline_logic
887
b8c1a6bc913e Take advantage of new "from ... import ... as ..." rules in the style guide.
Todd Larsen <tlarsen@google.com>
parents: 884
diff changeset
    57
from soc.logic.models.user import logic as user_logic
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
    58
from soc.views.helper import redirects
508
2b90baceac88 Add a access.deny and access.allow method
Sverre Rabbelier <srabbelier@gmail.com>
parents: 481
diff changeset
    59
from soc.views import helper
543
280a1ac6bcc1 Merge soc/logic/out_of_band.py into soc/views/out_of_band.py. Merge
Todd Larsen <tlarsen@google.com>
parents: 525
diff changeset
    60
from soc.views import out_of_band
293
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
    61
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
    62
1043
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
    63
DEF_NO_USER_LOGIN_MSG= ugettext(
1239
065e5bcf90f0 Stylefixes in access.py and removal of self.deny calls
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1237
diff changeset
    64
    'Please create <a href="/user/create_profile">User Profile</a>'
065e5bcf90f0 Stylefixes in access.py and removal of self.deny calls
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1237
diff changeset
    65
    ' in order to view this page.')
293
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
    66
970
8b5611d5b053 Use ugettext instead of ugettext_lazy
Sverre Rabbelier <srabbelier@gmail.com>
parents: 965
diff changeset
    67
DEF_AGREE_TO_TOS_MSG_FMT = ugettext(
1239
065e5bcf90f0 Stylefixes in access.py and removal of self.deny calls
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1237
diff changeset
    68
    'You must agree to the <a href="%(tos_link)s">site-wide Terms of'
065e5bcf90f0 Stylefixes in access.py and removal of self.deny calls
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1237
diff changeset
    69
    ' Service</a> in your <a href="/user/edit_profile">User Profile</a>'
065e5bcf90f0 Stylefixes in access.py and removal of self.deny calls
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1237
diff changeset
    70
    ' in order to view this page.')
888
a75ae24f04cb Add checkAgreesToSiteToS() (partially implemented until circular import fixed).
Todd Larsen <tlarsen@google.com>
parents: 887
diff changeset
    71
970
8b5611d5b053 Use ugettext instead of ugettext_lazy
Sverre Rabbelier <srabbelier@gmail.com>
parents: 965
diff changeset
    72
DEF_DEV_LOGOUT_LOGIN_MSG_FMT = ugettext(
1239
065e5bcf90f0 Stylefixes in access.py and removal of self.deny calls
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1237
diff changeset
    73
    'Please <a href="%%(sign_out)s">sign out</a>'
065e5bcf90f0 Stylefixes in access.py and removal of self.deny calls
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1237
diff changeset
    74
    ' and <a href="%%(sign_in)s">sign in</a>'
065e5bcf90f0 Stylefixes in access.py and removal of self.deny calls
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1237
diff changeset
    75
    ' again as %(role)s to view this page.')
293
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
    76
1135
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
    77
DEF_NEED_MEMBERSHIP_MSG_FMT = ugettext(
1239
065e5bcf90f0 Stylefixes in access.py and removal of self.deny calls
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1237
diff changeset
    78
    'You need to be in the %(status)s group to %(action)s'
065e5bcf90f0 Stylefixes in access.py and removal of self.deny calls
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1237
diff changeset
    79
    ' documents in the %(prefix)s prefix.')
1135
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
    80
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
    81
DEF_NEED_ROLE_MSG = ugettext(
1239
065e5bcf90f0 Stylefixes in access.py and removal of self.deny calls
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1237
diff changeset
    82
    'You do not have the required role.')
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
    83
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
    84
DEF_NOT_YOUR_ENTITY_MSG = ugettext(
1239
065e5bcf90f0 Stylefixes in access.py and removal of self.deny calls
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1237
diff changeset
    85
    'This entity does not belong to you.')
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
    86
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
    87
DEF_NO_ACTIVE_GROUP_MSG = ugettext(
1239
065e5bcf90f0 Stylefixes in access.py and removal of self.deny calls
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1237
diff changeset
    88
    'There is no such active group.')
065e5bcf90f0 Stylefixes in access.py and removal of self.deny calls
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1237
diff changeset
    89
065e5bcf90f0 Stylefixes in access.py and removal of self.deny calls
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1237
diff changeset
    90
DEF_NO_ACTIVE_ROLE_MSG = ugettext(
065e5bcf90f0 Stylefixes in access.py and removal of self.deny calls
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1237
diff changeset
    91
    'There is no such active role.')
065e5bcf90f0 Stylefixes in access.py and removal of self.deny calls
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1237
diff changeset
    92
065e5bcf90f0 Stylefixes in access.py and removal of self.deny calls
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1237
diff changeset
    93
DEF_NO_ACTIVE_PROGRAM_MSG = ugettext(
065e5bcf90f0 Stylefixes in access.py and removal of self.deny calls
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1237
diff changeset
    94
    'There is no such active program.')
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
    95
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
    96
DEF_NO_REQUEST_MSG = ugettext(
1239
065e5bcf90f0 Stylefixes in access.py and removal of self.deny calls
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1237
diff changeset
    97
    'There is no accepted request that would allow you to visit this page.')
065e5bcf90f0 Stylefixes in access.py and removal of self.deny calls
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1237
diff changeset
    98
065e5bcf90f0 Stylefixes in access.py and removal of self.deny calls
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1237
diff changeset
    99
DEF_NO_APPLICATION_MSG = ugettext(
065e5bcf90f0 Stylefixes in access.py and removal of self.deny calls
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1237
diff changeset
   100
    'There is no application that would allow you to visit this page.')
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   101
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   102
DEF_NEED_PICK_ARGS_MSG = ugettext(
1239
065e5bcf90f0 Stylefixes in access.py and removal of self.deny calls
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1237
diff changeset
   103
    'The "continue" and "field" args are not both present.')
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   104
1201
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   105
DEF_REVIEW_COMPLETED_MSG = ugettext(
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   106
    'This Application can not be reviewed anymore (it has been completed or rejected)')
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   107
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   108
DEF_REQUEST_COMPLETED_MSG = ugettext(
1239
065e5bcf90f0 Stylefixes in access.py and removal of self.deny calls
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1237
diff changeset
   109
    'This request cannot be accepted (it is either completed or denied).')
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   110
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   111
DEF_SCOPE_INACTIVE_MSG = ugettext(
1239
065e5bcf90f0 Stylefixes in access.py and removal of self.deny calls
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1237
diff changeset
   112
    'The scope for this request is not active.')
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   113
970
8b5611d5b053 Use ugettext instead of ugettext_lazy
Sverre Rabbelier <srabbelier@gmail.com>
parents: 965
diff changeset
   114
DEF_PAGE_DENIED_MSG = ugettext(
1239
065e5bcf90f0 Stylefixes in access.py and removal of self.deny calls
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1237
diff changeset
   115
    'Access to this page has been restricted')
508
2b90baceac88 Add a access.deny and access.allow method
Sverre Rabbelier <srabbelier@gmail.com>
parents: 481
diff changeset
   116
1305
9567bb475d6d Do access checks on the pick url for documents
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1300
diff changeset
   117
DEF_PREFIX_NOT_IN_ARGS_MSG = ugettext(
9567bb475d6d Do access checks on the pick url for documents
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1300
diff changeset
   118
    'A required GET url argument ("prefix") was not specified')
9567bb475d6d Do access checks on the pick url for documents
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1300
diff changeset
   119
1223
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   120
DEF_PAGE_INACTIVE_MSG = ugettext(
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   121
    'This page is inactive at this time')
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   122
970
8b5611d5b053 Use ugettext instead of ugettext_lazy
Sverre Rabbelier <srabbelier@gmail.com>
parents: 965
diff changeset
   123
DEF_LOGOUT_MSG_FMT = ugettext(
590
37735d97b541 Created a seperate module for editSelf things
Sverre Rabbelier <srabbelier@gmail.com>
parents: 543
diff changeset
   124
    'Please <a href="%(sign_out)s">sign out</a> in order to view this page')
37735d97b541 Created a seperate module for editSelf things
Sverre Rabbelier <srabbelier@gmail.com>
parents: 543
diff changeset
   125
979
789e70941055 Added checkCanMakeRequestToGroup to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 974
diff changeset
   126
DEF_GROUP_NOT_FOUND_MSG = ugettext(
789e70941055 Added checkCanMakeRequestToGroup to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 974
diff changeset
   127
    'The requested Group can not be found')
789e70941055 Added checkCanMakeRequestToGroup to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 974
diff changeset
   128
1043
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   129
DEF_USER_ACCOUNT_INVALID_MSG_FMT = ugettext(
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   130
    'The <b><i>%(email)s</i></b> account cannot be used with this site, for'
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   131
    ' one or more of the following reasons:'
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   132
    '<ul>'
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   133
    ' <li>the account is invalid</li>'
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   134
    ' <li>the account is already attached to a User profile and cannot be'
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   135
    ' used to create another one</li>'
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   136
    ' <li>the account is a former account that cannot be used again</li>'
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   137
    '</ul>')
508
2b90baceac88 Add a access.deny and access.allow method
Sverre Rabbelier <srabbelier@gmail.com>
parents: 481
diff changeset
   138
1201
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   139
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   140
def allowSidebar(fun):
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   141
  """Decorator that allows access if the sidebar is calling.
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   142
  """
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   143
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   144
  from functools import wraps
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   145
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   146
  @wraps(fun)
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   147
  def wrapper(self, django_args, *args, **kwargs):
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   148
    if django_args.get('SIDEBAR_CALLING'):
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   149
      return
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   150
    return fun(self, django_args, *args, **kwargs)
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   151
  return wrapper
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   152
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   153
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   154
def denySidebar(fun):
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   155
  """Decorator that denies access if the sidebar is calling.
612
3cca81b1e5a1 Moved checkAccess and getCleanedFields into access and forms
Sverre Rabbelier <srabbelier@gmail.com>
parents: 590
diff changeset
   156
  """
3cca81b1e5a1 Moved checkAccess and getCleanedFields into access and forms
Sverre Rabbelier <srabbelier@gmail.com>
parents: 590
diff changeset
   157
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   158
  from functools import wraps
508
2b90baceac88 Add a access.deny and access.allow method
Sverre Rabbelier <srabbelier@gmail.com>
parents: 481
diff changeset
   159
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   160
  @wraps(fun)
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   161
  def wrapper(self, django_args, *args, **kwargs):
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   162
    if django_args.get('SIDEBAR_CALLING'):
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   163
      raise out_of_band.Error("Sidebar Calling")
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   164
    return fun(self, django_args, *args, **kwargs)
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   165
  return wrapper
293
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
   166
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
   167
1073
feea88d0e1d8 Factor out the allowIfCheckPasses logic
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1068
diff changeset
   168
def allowIfCheckPasses(checker_name):
feea88d0e1d8 Factor out the allowIfCheckPasses logic
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1068
diff changeset
   169
  """Returns a decorator that allows access if the specified checker passes.
1016
15a2f644725f Create a decorator for allowDeveloper
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1012
diff changeset
   170
  """
15a2f644725f Create a decorator for allowDeveloper
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1012
diff changeset
   171
15a2f644725f Create a decorator for allowDeveloper
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1012
diff changeset
   172
  from functools import wraps
15a2f644725f Create a decorator for allowDeveloper
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1012
diff changeset
   173
1073
feea88d0e1d8 Factor out the allowIfCheckPasses logic
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1068
diff changeset
   174
  def decorator(fun):
feea88d0e1d8 Factor out the allowIfCheckPasses logic
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1068
diff changeset
   175
    """Decorator that allows access if the current user is a Developer.
feea88d0e1d8 Factor out the allowIfCheckPasses logic
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1068
diff changeset
   176
    """
feea88d0e1d8 Factor out the allowIfCheckPasses logic
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1068
diff changeset
   177
feea88d0e1d8 Factor out the allowIfCheckPasses logic
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1068
diff changeset
   178
    @wraps(fun)
feea88d0e1d8 Factor out the allowIfCheckPasses logic
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1068
diff changeset
   179
    def wrapper(self, django_args, *args, **kwargs):
feea88d0e1d8 Factor out the allowIfCheckPasses logic
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1068
diff changeset
   180
      try:
feea88d0e1d8 Factor out the allowIfCheckPasses logic
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1068
diff changeset
   181
        # if the check passes we allow access regardless
feea88d0e1d8 Factor out the allowIfCheckPasses logic
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1068
diff changeset
   182
        return self.doCheck(checker_name, django_args, [])
feea88d0e1d8 Factor out the allowIfCheckPasses logic
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1068
diff changeset
   183
      except out_of_band.Error:
feea88d0e1d8 Factor out the allowIfCheckPasses logic
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1068
diff changeset
   184
        # otherwise we run the original check
feea88d0e1d8 Factor out the allowIfCheckPasses logic
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1068
diff changeset
   185
        return fun(self, django_args, *args, **kwargs)
feea88d0e1d8 Factor out the allowIfCheckPasses logic
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1068
diff changeset
   186
    return wrapper
feea88d0e1d8 Factor out the allowIfCheckPasses logic
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1068
diff changeset
   187
feea88d0e1d8 Factor out the allowIfCheckPasses logic
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1068
diff changeset
   188
  return decorator
feea88d0e1d8 Factor out the allowIfCheckPasses logic
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1068
diff changeset
   189
feea88d0e1d8 Factor out the allowIfCheckPasses logic
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1068
diff changeset
   190
feea88d0e1d8 Factor out the allowIfCheckPasses logic
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1068
diff changeset
   191
allowDeveloper = allowIfCheckPasses('checkIsDeveloper')
1016
15a2f644725f Create a decorator for allowDeveloper
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1012
diff changeset
   192
15a2f644725f Create a decorator for allowDeveloper
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1012
diff changeset
   193
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   194
class Checker(object):
590
37735d97b541 Created a seperate module for editSelf things
Sverre Rabbelier <srabbelier@gmail.com>
parents: 543
diff changeset
   195
  """
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   196
  The __setitem__() and __getitem__() methods are overloaded to DTRT
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   197
  when adding new access rights, and retrieving them, so use these
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   198
  rather then modifying rights directly if so desired.
888
a75ae24f04cb Add checkAgreesToSiteToS() (partially implemented until circular import fixed).
Todd Larsen <tlarsen@google.com>
parents: 887
diff changeset
   199
  """
972
43018f61b481 Remove the request and arg parameter from the checkAccess call
Sverre Rabbelier <srabbelier@gmail.com>
parents: 970
diff changeset
   200
1135
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   201
  MEMBERSHIP = {
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   202
    'anyone': 'allow',
1248
f318538394d9 Rename checkHasActiveRole to checkHasActiveRoleForScope
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1239
diff changeset
   203
    'club_admin': ('checkHasActiveRoleForScope', club_admin_logic),
f318538394d9 Rename checkHasActiveRole to checkHasActiveRoleForScope
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1239
diff changeset
   204
    'club_member': ('checkHasActiveRoleForScope', club_member_logic),
f318538394d9 Rename checkHasActiveRole to checkHasActiveRoleForScope
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1239
diff changeset
   205
    'host': ('checkHasActiveRoleForScope', host_logic),
f318538394d9 Rename checkHasActiveRole to checkHasActiveRoleForScope
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1239
diff changeset
   206
    'org_admin': ('checkHasActiveRoleForScope', org_admin_logic),
f318538394d9 Rename checkHasActiveRole to checkHasActiveRoleForScope
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1239
diff changeset
   207
    'org_mentor': ('checkHasActiveRoleForScope', mentor_logic),
f318538394d9 Rename checkHasActiveRole to checkHasActiveRoleForScope
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1239
diff changeset
   208
    'org_student': 'deny', #('checkHasActiveRoleForScope', student_logic),
1135
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   209
    'user': 'checkIsUser',
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   210
    'user_self': ('checkIsUserSelf', 'scope_path'),
1135
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   211
    }
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   212
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   213
  def __init__(self, params):
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   214
    """Adopts base.rights as rights if base is set.
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   215
    """
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   216
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   217
    base = params.get('rights') if params else None
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   218
    self.rights = base.rights if base else {}
1017
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   219
    self.id = None
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   220
    self.user = None
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   221
1226
a671f0d63562 Fix broken document access checks
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1223
diff changeset
   222
  def normalizeChecker(self, checker):
a671f0d63562 Fix broken document access checks
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1223
diff changeset
   223
    """Normalizes the checker to a pre-defined format.
a671f0d63562 Fix broken document access checks
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1223
diff changeset
   224
a671f0d63562 Fix broken document access checks
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1223
diff changeset
   225
    The result is guaranteed to be a list of 2-tuples, the first element is a
a671f0d63562 Fix broken document access checks
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1223
diff changeset
   226
    checker (iff there is an checker with the specified name), the second
a671f0d63562 Fix broken document access checks
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1223
diff changeset
   227
    element is a list of arguments that should be passed to the checker when
a671f0d63562 Fix broken document access checks
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1223
diff changeset
   228
    calling it in addition to the standard django_args.
a671f0d63562 Fix broken document access checks
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1223
diff changeset
   229
    """
a671f0d63562 Fix broken document access checks
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1223
diff changeset
   230
a671f0d63562 Fix broken document access checks
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1223
diff changeset
   231
    # Be nice an repack so that it is always a list with tuples
a671f0d63562 Fix broken document access checks
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1223
diff changeset
   232
    if isinstance(checker, tuple):
a671f0d63562 Fix broken document access checks
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1223
diff changeset
   233
      name, arg = checker
a671f0d63562 Fix broken document access checks
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1223
diff changeset
   234
      return (name, (arg if isinstance(arg, list) else [arg]))
a671f0d63562 Fix broken document access checks
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1223
diff changeset
   235
    else:
a671f0d63562 Fix broken document access checks
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1223
diff changeset
   236
      return (checker, [])
a671f0d63562 Fix broken document access checks
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1223
diff changeset
   237
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   238
  def __setitem__(self, key, value):
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   239
    """Sets a value only if no old value exists.
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   240
    """
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   241
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   242
    oldvalue = self.rights.get(key)
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   243
    self.rights[key] = oldvalue if oldvalue else value
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   244
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   245
  def __getitem__(self, key):
1226
a671f0d63562 Fix broken document access checks
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1223
diff changeset
   246
    """Retrieves and normalizes the right checkers.
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   247
    """
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   248
1226
a671f0d63562 Fix broken document access checks
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1223
diff changeset
   249
    return [self.normalizeChecker(i) for i in self.rights.get(key, [])]
888
a75ae24f04cb Add checkAgreesToSiteToS() (partially implemented until circular import fixed).
Todd Larsen <tlarsen@google.com>
parents: 887
diff changeset
   250
1017
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   251
  def key(self, checker_name):
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   252
    """Returns the key for the specified checker for the current user.
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   253
    """
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   254
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   255
    return "%s.%s" % (self.id, checker_name)
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   256
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   257
  def put(self, checker_name, value):
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   258
    """Puts the result for the specified checker in the cache.
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   259
    """
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   260
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   261
    retention = 30
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   262
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   263
    memcache_key = self.key(checker_name)
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   264
    memcache.add(memcache_key, value, retention)
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   265
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   266
  def get(self, checker_name):
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   267
    """Retrieves the result for the specified checker from cache.
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   268
    """
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   269
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   270
    memcache_key = self.key(checker_name)
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   271
    return memcache.get(memcache_key)
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   272
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   273
  def doCheck(self, checker_name, django_args, args):
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   274
    """Runs the specified checker with the specified arguments.
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   275
    """
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   276
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   277
    checker = getattr(self, checker_name)
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   278
    checker(django_args, *args)
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   279
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   280
  def doCachedCheck(self, checker_name, django_args, args):
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   281
    """Retrieves from cache or runs the specified checker.
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   282
    """
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   283
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   284
    cached = self.get(checker_name)
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   285
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   286
    if cached is None:
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   287
      try:
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   288
        self.doCheck(checker_name, django_args, args)
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   289
        self.put(checker_name, True)
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   290
        return
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   291
      except out_of_band.Error, e:
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   292
        self.put(checker_name, e)
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   293
        raise
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   294
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   295
    if cached is True:
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   296
      return
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   297
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   298
    # re-raise the cached exception
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   299
    raise cached
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   300
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   301
  def check(self, use_cache, checker_name, django_args, args):
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   302
    """Runs the checker, optionally using the cache.
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   303
    """
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   304
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   305
    if use_cache:
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   306
      self.doCachedCheck(checker_name, django_args, args)
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   307
    else:
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   308
      self.doCheck(checker_name, django_args, args)
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   309
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   310
  def setCurrentUser(self, id, user):
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   311
    """Sets up everything for the current user.
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   312
    """
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   313
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   314
    self.id = id
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   315
    self.user = user
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   316
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   317
  def checkAccess(self, access_type, django_args):
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   318
    """Runs all the defined checks for the specified type.
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   319
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   320
    Args:
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   321
      access_type: the type of request (such as 'list' or 'edit')
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   322
      rights: a dictionary containing access check functions
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   323
      django_args: a dictionary with django's arguments
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   324
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   325
    Rights usage:
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   326
      The rights dictionary is used to check if the current user is allowed
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   327
      to view the page specified. The functions defined in this dictionary
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   328
      are always called with the provided django_args dictionary as argument. On any
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   329
      request, regardless of what type, the functions in the 'any_access' value
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   330
      are called. If the specified type is not in the rights dictionary, all
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   331
      the functions in the 'unspecified' value are called. When the specified
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   332
      type _is_ in the rights dictionary, all the functions in that access_type's
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   333
      value are called.
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   334
    """
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   335
1017
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   336
    use_cache = django_args.get('SIDEBAR_CALLING')
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   337
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   338
    # Call each access checker
1017
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   339
    for checker_name, args in self['any_access']:
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   340
      self.check(use_cache, checker_name, django_args, args)
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   341
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   342
    if access_type not in self.rights:
1017
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   343
      # No checks defined, so do the 'generic' checks and bail out
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   344
      for checker_name, args in self['unspecified']:
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   345
        self.check(use_cache, checker_name, django_args, args)
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   346
      return
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   347
1017
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   348
    for checker_name, args in self[access_type]:
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   349
      self.check(use_cache, checker_name, django_args, args)
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   350
1300
a89d673771eb Factor out the hasMembership method from checkMembership
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1265
diff changeset
   351
  def hasMembership(self, roles, django_args):
a89d673771eb Factor out the hasMembership method from checkMembership
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1265
diff changeset
   352
    """Checks whether the user has access to any of the specified roles.
a89d673771eb Factor out the hasMembership method from checkMembership
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1265
diff changeset
   353
a89d673771eb Factor out the hasMembership method from checkMembership
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1265
diff changeset
   354
    Args:
a89d673771eb Factor out the hasMembership method from checkMembership
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1265
diff changeset
   355
      roles: a list of roles to check
a89d673771eb Factor out the hasMembership method from checkMembership
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1265
diff changeset
   356
    """
a89d673771eb Factor out the hasMembership method from checkMembership
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1265
diff changeset
   357
a89d673771eb Factor out the hasMembership method from checkMembership
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1265
diff changeset
   358
    for role in roles:
a89d673771eb Factor out the hasMembership method from checkMembership
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1265
diff changeset
   359
      try:
a89d673771eb Factor out the hasMembership method from checkMembership
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1265
diff changeset
   360
        checker_name, args = self.normalizeChecker(self.MEMBERSHIP[role])
a89d673771eb Factor out the hasMembership method from checkMembership
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1265
diff changeset
   361
        self.doCheck(checker_name, django_args, args)
a89d673771eb Factor out the hasMembership method from checkMembership
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1265
diff changeset
   362
        # the check passed, we can stop now
a89d673771eb Factor out the hasMembership method from checkMembership
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1265
diff changeset
   363
        return True
a89d673771eb Factor out the hasMembership method from checkMembership
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1265
diff changeset
   364
      except out_of_band.Error:
a89d673771eb Factor out the hasMembership method from checkMembership
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1265
diff changeset
   365
        continue
a89d673771eb Factor out the hasMembership method from checkMembership
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1265
diff changeset
   366
a89d673771eb Factor out the hasMembership method from checkMembership
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1265
diff changeset
   367
    return False
a89d673771eb Factor out the hasMembership method from checkMembership
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1265
diff changeset
   368
a89d673771eb Factor out the hasMembership method from checkMembership
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1265
diff changeset
   369
  @allowDeveloper
1135
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   370
  def checkMembership(self, action, prefix, status, django_args):
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   371
    """Checks whether the user has access to the specified status.
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   372
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   373
    Args:
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   374
      action: the action that was performed (e.g., 'read')
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   375
      prefix: the prefix, determines what access set is used
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   376
      status: the access status (e.g., 'public')
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   377
      django_args: the django args to pass on to the checkers
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   378
    """
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   379
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   380
    checker = rights_logic.Checker(prefix)
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   381
    roles = checker.getMembership(status)
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   382
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   383
    message_fmt = DEF_NEED_MEMBERSHIP_MSG_FMT % {
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   384
        'action': action,
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   385
        'prefix': prefix,
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   386
        'status': status,
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   387
        }
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   388
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   389
    # try to see if they belong to any of the roles, if not, raise an
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   390
    # access violation for the specified action, prefix and status.
1300
a89d673771eb Factor out the hasMembership method from checkMembership
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1265
diff changeset
   391
    if not self.hasMembership(roles, django_args):
1135
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   392
      raise out_of_band.AccessViolation(message_fmt)
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   393
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   394
  def allow(self, django_args):
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   395
    """Never raises an alternate HTTP response.  (an access no-op, basically).
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   396
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   397
    Args:
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   398
      django_args: a dictionary with django's arguments
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   399
    """
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   400
888
a75ae24f04cb Add checkAgreesToSiteToS() (partially implemented until circular import fixed).
Todd Larsen <tlarsen@google.com>
parents: 887
diff changeset
   401
    return
293
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
   402
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   403
  def deny(self, django_args):
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   404
    """Always raises an alternate HTTP response.
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   405
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   406
    Args:
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   407
      django_args: a dictionary with django's arguments
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   408
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   409
    Raises:
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   410
      always raises AccessViolationResponse if called
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   411
    """
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   412
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   413
    context = django_args.get('context', {})
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   414
    context['title'] = 'Access denied'
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   415
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   416
    raise out_of_band.AccessViolation(DEF_PAGE_DENIED_MSG, context=context)
888
a75ae24f04cb Add checkAgreesToSiteToS() (partially implemented until circular import fixed).
Todd Larsen <tlarsen@google.com>
parents: 887
diff changeset
   417
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   418
  def checkIsLoggedIn(self, django_args):
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   419
    """Raises an alternate HTTP response if Google Account is not logged in.
888
a75ae24f04cb Add checkAgreesToSiteToS() (partially implemented until circular import fixed).
Todd Larsen <tlarsen@google.com>
parents: 887
diff changeset
   420
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   421
    Args:
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   422
      django_args: a dictionary with django's arguments
888
a75ae24f04cb Add checkAgreesToSiteToS() (partially implemented until circular import fixed).
Todd Larsen <tlarsen@google.com>
parents: 887
diff changeset
   423
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   424
    Raises:
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   425
      AccessViolationResponse:
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   426
      * if no Google Account is even logged in
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   427
    """
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   428
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   429
    if self.id:
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   430
      return
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   431
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   432
    raise out_of_band.LoginRequest()
888
a75ae24f04cb Add checkAgreesToSiteToS() (partially implemented until circular import fixed).
Todd Larsen <tlarsen@google.com>
parents: 887
diff changeset
   433
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   434
  def checkNotLoggedIn(self, django_args):
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   435
    """Raises an alternate HTTP response if Google Account is logged in.
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   436
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   437
    Args:
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   438
      django_args: a dictionary with django's arguments
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   439
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   440
    Raises:
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   441
      AccessViolationResponse:
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   442
      * if a Google Account is currently logged in
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   443
    """
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   444
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   445
    if not self.id:
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   446
      return
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   447
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   448
    raise out_of_band.LoginRequest(message_fmt=DEF_LOGOUT_MSG_FMT)
888
a75ae24f04cb Add checkAgreesToSiteToS() (partially implemented until circular import fixed).
Todd Larsen <tlarsen@google.com>
parents: 887
diff changeset
   449
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   450
  def checkIsUser(self, django_args):
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   451
    """Raises an alternate HTTP response if Google Account has no User entity.
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   452
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   453
    Args:
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   454
      django_args: a dictionary with django's arguments
895
e70ffd079438 Even developers need to agree to the terms of service for Melange
Sverre Rabbelier <srabbelier@gmail.com>
parents: 892
diff changeset
   455
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   456
    Raises:
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   457
      AccessViolationResponse:
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   458
      * if no User exists for the logged-in Google Account, or
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   459
      * if no Google Account is logged in at all
1012
73f0b61f2d9d Fold checkAgreesToSiteToS into checkIsUser
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1007
diff changeset
   460
      * if User has not agreed to the site-wide ToS, if one exists
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   461
    """
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   462
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   463
    self.checkIsLoggedIn(django_args)
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   464
1017
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   465
    if not self.user:
1043
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   466
      raise out_of_band.LoginRequest(message_fmt=DEF_NO_USER_LOGIN_MSG)
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   467
1017
6ad4fdb48840 Cache access checks and disable sidebar caching
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1016
diff changeset
   468
    if user_logic.agreesToSiteToS(self.user):
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   469
      return
293
1edd01373e71 Add an access control module
Sverre Rabbelier <srabbelier@gmail.com>
parents:
diff changeset
   470
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   471
    # Would not reach this point of site-wide ToS did not exist, since
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   472
    # agreesToSiteToS() call above always returns True if no ToS is in effect.
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   473
    login_msg_fmt = DEF_AGREE_TO_TOS_MSG_FMT % {
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   474
        'tos_link': redirects.getToSRedirect(site_logic.getSingleton())}
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   475
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   476
    raise out_of_band.LoginRequest(message_fmt=login_msg_fmt)
1135
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   477
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   478
  @allowDeveloper
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   479
  def checkIsUserSelf(self, django_args, field_name):
1142
da2487767ef4 Fix missing dot and wrong import sorting in soc.views.helper.access module.
Pawel Solyga <Pawel.Solyga@gmail.com>
parents: 1135
diff changeset
   480
    """Checks whether the specified user is the logged in user.
1135
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   481
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   482
    Args:
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   483
      django_args: the keyword args from django, only scope_path is used
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   484
    """
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   485
1198
3318f8d00691 Added some extra isUser checks to make sure that you have to accept the ToS before you can do anything concerning requests.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1192
diff changeset
   486
    self.checkIsUser(django_args)
3318f8d00691 Added some extra isUser checks to make sure that you have to accept the ToS before you can do anything concerning requests.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1192
diff changeset
   487
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   488
    if not field_name in django_args:
1135
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   489
      self.deny(django_args)
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   490
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   491
    if self.user.link_id == django_args[field_name]:
1135
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   492
      return
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   493
1177
53c802c2a2e2 More access related fixes
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1176
diff changeset
   494
    raise out_of_band.AccessViolation(DEF_NOT_YOUR_ENTITY_MSG)
1135
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   495
1043
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   496
  def checkIsUnusedAccount(self, django_args):
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   497
    """Raises an alternate HTTP response if Google Account has a User entity.
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   498
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   499
    Args:
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   500
      django_args: a dictionary with django's arguments
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   501
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   502
    Raises:
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   503
      AccessViolationResponse:
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   504
      * if a User exists for the logged-in Google Account, or
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   505
      * if a User has this Gooogle Account in their formerAccounts list
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   506
    """
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   507
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   508
    self.checkIsLoggedIn(django_args)
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   509
1192
b53fa1e05dbd Adds the possibility to exclude the user from the website.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1189
diff changeset
   510
    user_entity = user_logic.getForFields({'account':self.id}, unique=True)
b53fa1e05dbd Adds the possibility to exclude the user from the website.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1189
diff changeset
   511
b53fa1e05dbd Adds the possibility to exclude the user from the website.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1189
diff changeset
   512
    if not user_entity and not user_logic.isFormerAccount(self.id):
1048
0fe0cb8f7253 Changed access.py to comply more with the style of the module.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1043
diff changeset
   513
      # this account has not been used yet
0fe0cb8f7253 Changed access.py to comply more with the style of the module.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1043
diff changeset
   514
      return
1043
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   515
1048
0fe0cb8f7253 Changed access.py to comply more with the style of the module.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1043
diff changeset
   516
    message_fmt = DEF_USER_ACCOUNT_INVALID_MSG_FMT % {
0fe0cb8f7253 Changed access.py to comply more with the style of the module.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1043
diff changeset
   517
        'email' : self.id.email()}
0fe0cb8f7253 Changed access.py to comply more with the style of the module.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1043
diff changeset
   518
    raise out_of_band.LoginRequest(message_fmt=message_fmt)
0fe0cb8f7253 Changed access.py to comply more with the style of the module.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1043
diff changeset
   519
1043
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   520
  def checkHasUserEntity(self, django_args):
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   521
    """Raises an alternate HTTP response if Google Account has no User entity.
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   522
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   523
    Args:
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   524
      django_args: a dictionary with django's arguments
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   525
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   526
    Raises:
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   527
      AccessViolationResponse:
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   528
      * if no User exists for the logged-in Google Account, or
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   529
      * if no Google Account is logged in at all
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   530
    """
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   531
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   532
    self.checkIsLoggedIn(django_args)
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   533
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   534
    if not self.user:
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   535
      raise out_of_band.LoginRequest(message_fmt=DEF_NO_USER_LOGIN_MSG)
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   536
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   537
    return
5e15994b2033 Redone the user's profile page.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1037
diff changeset
   538
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   539
  def checkIsDeveloper(self, django_args):
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   540
    """Raises an alternate HTTP response if Google Account is not a Developer.
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   541
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   542
    Args:
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   543
      django_args: a dictionary with django's arguments
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   544
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   545
    Raises:
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   546
      AccessViolationResponse:
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   547
      * if User is not a Developer, or
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   548
      * if no User exists for the logged-in Google Account, or
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   549
      * if no Google Account is logged in at all
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   550
    """
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   551
1012
73f0b61f2d9d Fold checkAgreesToSiteToS into checkIsUser
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1007
diff changeset
   552
    self.checkIsUser(django_args)
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   553
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   554
    if accounts.isDeveloper(account=self.id, user=self.user):
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   555
      return
979
789e70941055 Added checkCanMakeRequestToGroup to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 974
diff changeset
   556
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   557
    login_message_fmt = DEF_DEV_LOGOUT_LOGIN_MSG_FMT % {
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   558
        'role': 'a Site Developer '}
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   559
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   560
    raise out_of_band.LoginRequest(message_fmt=login_message_fmt)
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   561
1061
09c243461de8 Redone access checks concerning groups to deal with the state property.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1048
diff changeset
   562
  @allowDeveloper
09c243461de8 Redone access checks concerning groups to deal with the state property.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1048
diff changeset
   563
  @denySidebar
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   564
  def checkIsActive(self, django_args, logic,
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   565
                    field_name='scope_path', filter_field='link_id'):
1085
0afbdd0905ef Renamed state to status where appropriate.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1080
diff changeset
   566
    """Raises an alternate HTTP response if Group status is not active.
1061
09c243461de8 Redone access checks concerning groups to deal with the state property.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1048
diff changeset
   567
09c243461de8 Redone access checks concerning groups to deal with the state property.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1048
diff changeset
   568
    Args:
09c243461de8 Redone access checks concerning groups to deal with the state property.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1048
diff changeset
   569
      django_args: a dictionary with django's arguments
09c243461de8 Redone access checks concerning groups to deal with the state property.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1048
diff changeset
   570
09c243461de8 Redone access checks concerning groups to deal with the state property.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1048
diff changeset
   571
    Raises:
09c243461de8 Redone access checks concerning groups to deal with the state property.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1048
diff changeset
   572
      AccessViolationResponse:
09c243461de8 Redone access checks concerning groups to deal with the state property.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1048
diff changeset
   573
      * if no Group is found
1085
0afbdd0905ef Renamed state to status where appropriate.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1080
diff changeset
   574
      * if the Group status is not active
1061
09c243461de8 Redone access checks concerning groups to deal with the state property.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1048
diff changeset
   575
    """
09c243461de8 Redone access checks concerning groups to deal with the state property.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1048
diff changeset
   576
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   577
    self.checkIsUser(django_args)
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   578
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   579
    if field_name and (field_name not in django_args):
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   580
      self.deny(django_args)
1061
09c243461de8 Redone access checks concerning groups to deal with the state property.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1048
diff changeset
   581
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   582
    fields = {
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   583
        filter_field: django_args[filter_field],
1179
427d2ec42823 Rewrite getForFields to use GQL instead of the Query API
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1177
diff changeset
   584
        'status': 'active',
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   585
        }
1061
09c243461de8 Redone access checks concerning groups to deal with the state property.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1048
diff changeset
   586
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   587
    if field_name:
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   588
      fields['scope_path'] = django_args[field_name]
1061
09c243461de8 Redone access checks concerning groups to deal with the state property.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1048
diff changeset
   589
1179
427d2ec42823 Rewrite getForFields to use GQL instead of the Query API
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1177
diff changeset
   590
    entity = logic.getForFields(fields, unique=True)
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   591
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   592
    if entity:
1061
09c243461de8 Redone access checks concerning groups to deal with the state property.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1048
diff changeset
   593
      return
09c243461de8 Redone access checks concerning groups to deal with the state property.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1048
diff changeset
   594
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   595
    raise out_of_band.AccessViolation(message_fmt=DEF_NO_ACTIVE_GROUP_MSG)
1061
09c243461de8 Redone access checks concerning groups to deal with the state property.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1048
diff changeset
   596
1248
f318538394d9 Rename checkHasActiveRole to checkHasActiveRoleForScope
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1239
diff changeset
   597
  def checkHasActiveRoleForScope(self, django_args, logic, field_name=None):
1203
38225f2ad3a6 Renamed checkHasRole to checkHasActiveRole.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1201
diff changeset
   598
    """Checks that the user has the specified active role.
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   599
    """
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   600
1184
bd9c6101d41d Use .logic in checkIsAllowedToManageRole at the caller
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1180
diff changeset
   601
    if not field_name:
bd9c6101d41d Use .logic in checkIsAllowedToManageRole at the caller
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1180
diff changeset
   602
      field_name = 'scope_path'
bd9c6101d41d Use .logic in checkIsAllowedToManageRole at the caller
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1180
diff changeset
   603
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   604
    django_args['user'] = self.user
1184
bd9c6101d41d Use .logic in checkIsAllowedToManageRole at the caller
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1180
diff changeset
   605
    self.checkIsActive(django_args, logic, field_name, 'user')
1061
09c243461de8 Redone access checks concerning groups to deal with the state property.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1048
diff changeset
   606
1189
14357ec13647 More access related fixes
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1184
diff changeset
   607
  def checkSeeded(self, django_args, checker_name, *args):
14357ec13647 More access related fixes
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1184
diff changeset
   608
    """Wrapper to update the django_args with the contens of seed first.
14357ec13647 More access related fixes
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1184
diff changeset
   609
    """
14357ec13647 More access related fixes
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1184
diff changeset
   610
14357ec13647 More access related fixes
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1184
diff changeset
   611
    django_args.update(django_args.get('seed', {}))
14357ec13647 More access related fixes
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1184
diff changeset
   612
    self.doCheck(checker_name, django_args, args)
14357ec13647 More access related fixes
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1184
diff changeset
   613
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   614
  def checkCanMakeRequestToGroup(self, django_args, group_logic):
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   615
    """Raises an alternate HTTP response if the specified group is not in an
1085
0afbdd0905ef Renamed state to status where appropriate.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1080
diff changeset
   616
    active status.
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   617
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   618
    Args:
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   619
      group_logic: Logic module for the type of group which the request is for
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   620
    """
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   621
1198
3318f8d00691 Added some extra isUser checks to make sure that you have to accept the ToS before you can do anything concerning requests.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1192
diff changeset
   622
    self.checkIsUser(django_args)
3318f8d00691 Added some extra isUser checks to make sure that you have to accept the ToS before you can do anything concerning requests.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1192
diff changeset
   623
979
789e70941055 Added checkCanMakeRequestToGroup to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 974
diff changeset
   624
    group_entity = role_logic.getGroupEntityFromScopePath(
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   625
        group_logic.logic, django_args['scope_path'])
979
789e70941055 Added checkCanMakeRequestToGroup to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 974
diff changeset
   626
789e70941055 Added checkCanMakeRequestToGroup to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 974
diff changeset
   627
    if not group_entity:
789e70941055 Added checkCanMakeRequestToGroup to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 974
diff changeset
   628
      raise out_of_band.Error(DEF_GROUP_NOT_FOUND_MSG, status=404)
789e70941055 Added checkCanMakeRequestToGroup to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 974
diff changeset
   629
1085
0afbdd0905ef Renamed state to status where appropriate.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1080
diff changeset
   630
    if group_entity.status != 'active':
1198
3318f8d00691 Added some extra isUser checks to make sure that you have to accept the ToS before you can do anything concerning requests.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1192
diff changeset
   631
      # tell the user that this group is not active
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   632
      raise out_of_band.AccessViolation(message_fmt=DEF_NO_ACTIVE_GROUP_MSG)
1061
09c243461de8 Redone access checks concerning groups to deal with the state property.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1048
diff changeset
   633
979
789e70941055 Added checkCanMakeRequestToGroup to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 974
diff changeset
   634
    return
789e70941055 Added checkCanMakeRequestToGroup to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 974
diff changeset
   635
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   636
  def checkCanCreateFromRequest(self, django_args, role_name):
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   637
    """Raises an alternate HTTP response if the specified request does not exist
1085
0afbdd0905ef Renamed state to status where appropriate.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1080
diff changeset
   638
       or if it's status is not group_accepted. Also when the group this request
0afbdd0905ef Renamed state to status where appropriate.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1080
diff changeset
   639
       is from is in an inactive or invalid status access will be denied.
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   640
    """
972
43018f61b481 Remove the request and arg parameter from the checkAccess call
Sverre Rabbelier <srabbelier@gmail.com>
parents: 970
diff changeset
   641
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   642
    self.checkIsUserSelf(django_args, 'link_id')
914
6ec8dd2a73b3 Added various access methods in preperation for the new request system.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 895
diff changeset
   643
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   644
    fields = {
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   645
        'link_id': django_args['link_id'],
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   646
        'scope_path': django_args['scope_path'],
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   647
        'role': role_name,
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   648
        'status': 'group_accepted',
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   649
        }
914
6ec8dd2a73b3 Added various access methods in preperation for the new request system.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 895
diff changeset
   650
1176
c211191e7d81 Fixed access related bugs
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1163
diff changeset
   651
    entity = request_logic.getForFields(fields, unique=True)
914
6ec8dd2a73b3 Added various access methods in preperation for the new request system.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 895
diff changeset
   652
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   653
    if entity and (entity.scope.status not in ['invalid', 'inactive']):
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   654
      return
914
6ec8dd2a73b3 Added various access methods in preperation for the new request system.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 895
diff changeset
   655
1177
53c802c2a2e2 More access related fixes
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1176
diff changeset
   656
    raise out_of_band.AccessViolation(message_fmt=DEF_NO_REQUEST_MSG)
914
6ec8dd2a73b3 Added various access methods in preperation for the new request system.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 895
diff changeset
   657
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   658
  def checkIsMyGroupAcceptedRequest(self, django_args):
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   659
    """Checks whether the user can accept the specified request.
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   660
    """
1061
09c243461de8 Redone access checks concerning groups to deal with the state property.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1048
diff changeset
   661
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   662
    self.checkCanCreateFromRequest(django_args, django_args['role'])
972
43018f61b481 Remove the request and arg parameter from the checkAccess call
Sverre Rabbelier <srabbelier@gmail.com>
parents: 970
diff changeset
   663
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   664
  def checkCanProcessRequest(self, django_args, role_name):
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   665
    """Raises an alternate HTTP response if the specified request does not exist
1085
0afbdd0905ef Renamed state to status where appropriate.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1080
diff changeset
   666
       or if it's status is completed or denied. Also Raises an alternate HTTP response
1061
09c243461de8 Redone access checks concerning groups to deal with the state property.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1048
diff changeset
   667
       whenever the group in the request is not active.
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   668
    """
948
bd956f419ad9 Add missing blank lines and remove unused checkIsInvited function from soc.views.helper.access module.
Pawel Solyga <Pawel.Solyga@gmail.com>
parents: 943
diff changeset
   669
1198
3318f8d00691 Added some extra isUser checks to make sure that you have to accept the ToS before you can do anything concerning requests.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1192
diff changeset
   670
    self.checkIsUser(django_args)
3318f8d00691 Added some extra isUser checks to make sure that you have to accept the ToS before you can do anything concerning requests.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1192
diff changeset
   671
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   672
    fields = {
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   673
        'link_id': django_args['link_id'],
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   674
        'scope_path': django_args['scope_path'],
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   675
        'role': role_name,
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   676
        }
960
129efa976d6d Added checkCanProcessRequest in access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 958
diff changeset
   677
1115
0a723ff3d27c Cleanups in base.Logic
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1107
diff changeset
   678
    request_entity = request_logic.getFromKeyFieldsOr404(fields)
960
129efa976d6d Added checkCanProcessRequest in access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 958
diff changeset
   679
1085
0afbdd0905ef Renamed state to status where appropriate.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1080
diff changeset
   680
    if request_entity.status in ['completed', 'denied']:
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   681
      raise out_of_band.AccessViolation(message_fmt=DEF_REQUEST_COMPLETED_MSG)
914
6ec8dd2a73b3 Added various access methods in preperation for the new request system.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 895
diff changeset
   682
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   683
    if request_entity.scope.status == 'active':
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   684
      return
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   685
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   686
    raise out_of_band.AccessViolation(message_fmt=DEF_SCOPE_INACTIVE_MSG)
1135
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   687
1218
569a3fe9cb88 Cleaned up getKeyNameFromFields in Logic base.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1203
diff changeset
   688
  @allowDeveloper
1074
94bc2a9ae103 Properly check if a program is active
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1073
diff changeset
   689
  @denySidebar
94bc2a9ae103 Properly check if a program is active
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1073
diff changeset
   690
  def checkIsHostForProgram(self, django_args):
94bc2a9ae103 Properly check if a program is active
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1073
diff changeset
   691
    """Checks if the user is a host for the specified program.
94bc2a9ae103 Properly check if a program is active
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1073
diff changeset
   692
    """
94bc2a9ae103 Properly check if a program is active
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1073
diff changeset
   693
1218
569a3fe9cb88 Cleaned up getKeyNameFromFields in Logic base.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1203
diff changeset
   694
    program = program_logic.getFromKeyFields(django_args)
1074
94bc2a9ae103 Properly check if a program is active
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1073
diff changeset
   695
1107
a878188e225c Added status to program.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1085
diff changeset
   696
    if not program or program.status == 'invalid':
1239
065e5bcf90f0 Stylefixes in access.py and removal of self.deny calls
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1237
diff changeset
   697
      raise out_of_band.AccessViolation(message_fmt=DEF_NO_ACTIVE_PROGRAM_MSG)
1074
94bc2a9ae103 Properly check if a program is active
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1073
diff changeset
   698
1107
a878188e225c Added status to program.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1085
diff changeset
   699
    new_args = {'scope_path': program.scope_path }
1248
f318538394d9 Rename checkHasActiveRole to checkHasActiveRoleForScope
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1239
diff changeset
   700
    self.checkHasActiveRoleForScope(new_args, host_logic)
1135
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   701
1200
e68fd70ba076 Added checkCanEditGroupApp to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1198
diff changeset
   702
  @allowDeveloper
1223
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   703
  @denySidebar
1250
b06e6e014658 Fixed access checkers for orgs
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1248
diff changeset
   704
  def checkIsHostForProgramInScope(self, django_args):
b06e6e014658 Fixed access checkers for orgs
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1248
diff changeset
   705
    """Checks if the user is a host for the specified program.
b06e6e014658 Fixed access checkers for orgs
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1248
diff changeset
   706
    """
b06e6e014658 Fixed access checkers for orgs
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1248
diff changeset
   707
b06e6e014658 Fixed access checkers for orgs
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1248
diff changeset
   708
    program = program_logic.getFromKeyName(django_args['scope_path'])
b06e6e014658 Fixed access checkers for orgs
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1248
diff changeset
   709
b06e6e014658 Fixed access checkers for orgs
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1248
diff changeset
   710
    if not program or program.status == 'invalid':
b06e6e014658 Fixed access checkers for orgs
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1248
diff changeset
   711
      raise out_of_band.AccessViolation(message_fmt=DEF_NO_ACTIVE_PROGRAM_MSG)
b06e6e014658 Fixed access checkers for orgs
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1248
diff changeset
   712
b06e6e014658 Fixed access checkers for orgs
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1248
diff changeset
   713
    django_args = {'scope_path': program.scope_path}
b06e6e014658 Fixed access checkers for orgs
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1248
diff changeset
   714
    self.checkHasActiveRoleForScope(django_args, host_logic)
b06e6e014658 Fixed access checkers for orgs
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1248
diff changeset
   715
b06e6e014658 Fixed access checkers for orgs
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1248
diff changeset
   716
  @allowDeveloper
b06e6e014658 Fixed access checkers for orgs
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1248
diff changeset
   717
  @denySidebar
1223
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   718
  def checkIsActivePeriod(self, django_args, period_name, key_name_arg):
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   719
    """Checks if the given period is active for the given program.
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   720
    
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   721
    Args:
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   722
      django_args: a dictionary with django's arguments.
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   723
      period_name: the name of the period which is checked.
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   724
      key_name_arg: the entry in django_args that specifies the given program
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   725
        keyname. If none is given the key_name is constructed from django_args
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   726
        itself.
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   727
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   728
    Raises:
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   729
      AccessViolationResponse:
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   730
      * if no active Program is found
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   731
      * if the period is not active
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   732
    """
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   733
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   734
    if key_name_arg and key_name_arg in django_args:
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   735
      key_name = django_args[key_name_arg]
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   736
    else:
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   737
      key_name = program_logic.getKeyNameFromFields(fields)
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   738
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   739
    program_entity = program_logic.getFromKeyName(key_name)
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   740
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   741
    if not program_entity or (
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   742
        program_entity.status in ['inactive', 'invalid']):
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   743
      raise out_of_band.AccessViolation(message_fmt=DEF_SCOPE_INACTIVE_MSG)
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   744
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   745
    if timeline_helper.isActivePeriod(program_entity.timeline, period_name):
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   746
      return
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   747
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   748
    raise out_of_band.AccessViolation(message_fmt=DEF_PAGE_INACTIVE_MSG)
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   749
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   750
  def checkCanCreateOrgApp(self, django_args, period_name):
1237
b5bf2aa0f3f9 Added missing comment in access.py and removed excessive whitespace.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1232
diff changeset
   751
    """Checks to see if the program in the scope_path is accepting org apps
b5bf2aa0f3f9 Added missing comment in access.py and removed excessive whitespace.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1232
diff changeset
   752
    """
b5bf2aa0f3f9 Added missing comment in access.py and removed excessive whitespace.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1232
diff changeset
   753
1223
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   754
    if 'seed' in django_args:
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   755
      return self.checkIsActivePeriod(django_args['seed'], 
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   756
          period_name, 'scope_path')
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   757
    else:
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   758
      return
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   759
aca77e2cc8f7 Added new access checks to deal with timeline for programs.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1218
diff changeset
   760
  @allowDeveloper
1200
e68fd70ba076 Added checkCanEditGroupApp to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1198
diff changeset
   761
  def checkCanEditGroupApp(self, django_args, group_app_logic):
1201
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   762
    """Checks if the group_app in args is valid to be edited by the current user.
1200
e68fd70ba076 Added checkCanEditGroupApp to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1198
diff changeset
   763
e68fd70ba076 Added checkCanEditGroupApp to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1198
diff changeset
   764
    Args:
e68fd70ba076 Added checkCanEditGroupApp to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1198
diff changeset
   765
      group_app_logic: A logic instance for the Group Application
e68fd70ba076 Added checkCanEditGroupApp to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1198
diff changeset
   766
    """
e68fd70ba076 Added checkCanEditGroupApp to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1198
diff changeset
   767
e68fd70ba076 Added checkCanEditGroupApp to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1198
diff changeset
   768
    self.checkIsUser(django_args)
e68fd70ba076 Added checkCanEditGroupApp to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1198
diff changeset
   769
e68fd70ba076 Added checkCanEditGroupApp to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1198
diff changeset
   770
    fields = {
e68fd70ba076 Added checkCanEditGroupApp to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1198
diff changeset
   771
        'link_id': django_args['link_id'],
e68fd70ba076 Added checkCanEditGroupApp to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1198
diff changeset
   772
        'applicant': self.user,
e68fd70ba076 Added checkCanEditGroupApp to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1198
diff changeset
   773
        'status' : ['needs review', 'rejected']
e68fd70ba076 Added checkCanEditGroupApp to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1198
diff changeset
   774
        }
e68fd70ba076 Added checkCanEditGroupApp to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1198
diff changeset
   775
e68fd70ba076 Added checkCanEditGroupApp to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1198
diff changeset
   776
    if 'scope_path' in django_args:
e68fd70ba076 Added checkCanEditGroupApp to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1198
diff changeset
   777
      fields['scope_path'] = django_args['scope_path']
e68fd70ba076 Added checkCanEditGroupApp to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1198
diff changeset
   778
e68fd70ba076 Added checkCanEditGroupApp to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1198
diff changeset
   779
    entity = group_app_logic.getForFields(fields)
e68fd70ba076 Added checkCanEditGroupApp to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1198
diff changeset
   780
e68fd70ba076 Added checkCanEditGroupApp to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1198
diff changeset
   781
    if entity:
e68fd70ba076 Added checkCanEditGroupApp to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1198
diff changeset
   782
      return
e68fd70ba076 Added checkCanEditGroupApp to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1198
diff changeset
   783
e68fd70ba076 Added checkCanEditGroupApp to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1198
diff changeset
   784
    raise out_of_band.AccessViolation(message_fmt=DEF_NOT_YOUR_ENTITY_MSG)
e68fd70ba076 Added checkCanEditGroupApp to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1198
diff changeset
   785
1201
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   786
  @allowSidebar
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   787
  def checkCanReviewGroupApp(self, django_args, group_app_logic):
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   788
    """Checks if the group_app in args is valid to be reviewed.
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   789
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   790
    Args:
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   791
      group_app_logic: A logic instance for the Group Application
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   792
    """
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   793
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   794
    if 'link_id' not in django_args:
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   795
      # calling review overview, so we can't check a specified entity
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   796
      return
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   797
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   798
    fields = {
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   799
        'link_id': django_args['link_id'],
1232
3bce6205e24e Added pre-accpeted status to group_app.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1227
diff changeset
   800
        'status' : ['needs review', 'accepted', 'rejected', 'ignored',
3bce6205e24e Added pre-accpeted status to group_app.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1227
diff changeset
   801
            'pre-accepted']
1201
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   802
        }
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   803
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   804
    if 'scope_path' in django_args:
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   805
      fields['scope_path'] = django_args['scope_path']
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   806
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   807
    entity = group_app_logic.getForFields(fields)
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   808
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   809
    if entity:
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   810
      return
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   811
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   812
    raise out_of_band.AccessViolation(message_fmt=DEF_REVIEW_COMPLETED_MSG)
0a4c1af700a0 Added checkCanReviewGroupApp to acces.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1200
diff changeset
   813
1135
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   814
  @allowDeveloper
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   815
  def checkIsApplicationAccepted(self, django_args, app_logic):
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   816
    """Returns an alternate HTTP response if Google Account has no Club App
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   817
       entity for the specified Club.
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   818
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   819
    Args:
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   820
      django_args: a dictionary with django's arguments
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   821
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   822
     Raises:
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   823
       AccessViolationResponse: if the required authorization is not met
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   824
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   825
    Returns:
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   826
      None if Club App  exists for the specified program, or a subclass
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   827
      of django.http.HttpResponse which contains the alternate response
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   828
      should be returned by the calling view.
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   829
    """
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   830
1012
73f0b61f2d9d Fold checkAgreesToSiteToS into checkIsUser
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1007
diff changeset
   831
    self.checkIsUser(django_args)
814
25ffebd9fa8f Implement the checkIsClubAppAccepted function
Sverre Rabbelier <srabbelier@gmail.com>
parents: 802
diff changeset
   832
884
ded4850776c8 Changed checkIsClubAppAccepted into a more generic checkIsApplicationAccepted.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 882
diff changeset
   833
    properties = {
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   834
        'applicant': self.user,
1085
0afbdd0905ef Renamed state to status where appropriate.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1080
diff changeset
   835
        'status': 'accepted'
884
ded4850776c8 Changed checkIsClubAppAccepted into a more generic checkIsApplicationAccepted.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 882
diff changeset
   836
        }
814
25ffebd9fa8f Implement the checkIsClubAppAccepted function
Sverre Rabbelier <srabbelier@gmail.com>
parents: 802
diff changeset
   837
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   838
    application = app_logic.getForFields(properties, unique=True)
884
ded4850776c8 Changed checkIsClubAppAccepted into a more generic checkIsApplicationAccepted.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 882
diff changeset
   839
ded4850776c8 Changed checkIsClubAppAccepted into a more generic checkIsApplicationAccepted.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 882
diff changeset
   840
    if application:
ded4850776c8 Changed checkIsClubAppAccepted into a more generic checkIsApplicationAccepted.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 882
diff changeset
   841
      return
814
25ffebd9fa8f Implement the checkIsClubAppAccepted function
Sverre Rabbelier <srabbelier@gmail.com>
parents: 802
diff changeset
   842
1239
065e5bcf90f0 Stylefixes in access.py and removal of self.deny calls
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1237
diff changeset
   843
    raise out_of_band.AccessViolation(message_fmt=DEF_NO_APPLICATION_MSG)
726
ba3d399ec9be Added Notifications.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 720
diff changeset
   844
1180
6290c9e49848 Fixed club_app
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1179
diff changeset
   845
  def checkIsMyEntity(self, django_args, logic,
6290c9e49848 Fixed club_app
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1179
diff changeset
   846
                      field_name='user', user=False):
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   847
    """Checks whether the entity belongs to the user.
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   848
    """
791
30da180c4bca Added the club_app view, logic and model
Sverre Rabbelier <srabbelier@gmail.com>
parents: 746
diff changeset
   849
1012
73f0b61f2d9d Fold checkAgreesToSiteToS into checkIsUser
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1007
diff changeset
   850
    self.checkIsUser(django_args)
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   851
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   852
    fields = {
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   853
        'link_id': django_args['link_id'],
1180
6290c9e49848 Fixed club_app
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1179
diff changeset
   854
        field_name: self.user if user else self.user.key().name()
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   855
        }
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   856
1200
e68fd70ba076 Added checkCanEditGroupApp to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1198
diff changeset
   857
    if 'scope_path' in django_args:
e68fd70ba076 Added checkCanEditGroupApp to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1198
diff changeset
   858
      fields['scope_path'] = django_args['scope_path']
e68fd70ba076 Added checkCanEditGroupApp to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1198
diff changeset
   859
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   860
    entity = logic.getForFields(fields)
914
6ec8dd2a73b3 Added various access methods in preperation for the new request system.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 895
diff changeset
   861
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   862
    if entity:
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   863
      return
914
6ec8dd2a73b3 Added various access methods in preperation for the new request system.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 895
diff changeset
   864
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   865
    raise out_of_band.AccessViolation(message_fmt=DEF_NOT_YOUR_ENTITY_MSG)
1066
b22750a2b04a Added checkIsAllowedToManageRole to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1061
diff changeset
   866
b22750a2b04a Added checkIsAllowedToManageRole to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1061
diff changeset
   867
  @allowDeveloper
b22750a2b04a Added checkIsAllowedToManageRole to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1061
diff changeset
   868
  @denySidebar
b22750a2b04a Added checkIsAllowedToManageRole to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1061
diff changeset
   869
  def checkIsAllowedToManageRole(self, django_args, role_logic, manage_role_logic):
b22750a2b04a Added checkIsAllowedToManageRole to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1061
diff changeset
   870
    """Returns an alternate HTTP response if the user is not allowed to manage
1068
8a06ebff014e Changed docstring for checkIsAllowedToManageRole.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1066
diff changeset
   871
       the role given in args. 
8a06ebff014e Changed docstring for checkIsAllowedToManageRole.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1066
diff changeset
   872
8a06ebff014e Changed docstring for checkIsAllowedToManageRole.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1066
diff changeset
   873
     Args:
8a06ebff014e Changed docstring for checkIsAllowedToManageRole.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1066
diff changeset
   874
       role_logic: determines the logic for the role in args.
8a06ebff014e Changed docstring for checkIsAllowedToManageRole.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1066
diff changeset
   875
       manage_role_logic: determines the logic for the role which is allowed 
8a06ebff014e Changed docstring for checkIsAllowedToManageRole.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1066
diff changeset
   876
           to manage this role.
1066
b22750a2b04a Added checkIsAllowedToManageRole to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1061
diff changeset
   877
b22750a2b04a Added checkIsAllowedToManageRole to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1061
diff changeset
   878
     Raises:
b22750a2b04a Added checkIsAllowedToManageRole to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1061
diff changeset
   879
       AccessViolationResponse: if the required authorization is not met
b22750a2b04a Added checkIsAllowedToManageRole to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1061
diff changeset
   880
b22750a2b04a Added checkIsAllowedToManageRole to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1061
diff changeset
   881
    Returns:
1068
8a06ebff014e Changed docstring for checkIsAllowedToManageRole.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1066
diff changeset
   882
      None if the given role is active and belongs to the current user.
8a06ebff014e Changed docstring for checkIsAllowedToManageRole.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1066
diff changeset
   883
      None if the current User has an active role (from manage_role_logic) 
8a06ebff014e Changed docstring for checkIsAllowedToManageRole.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1066
diff changeset
   884
           that belongs to the same scope as the role that needs to be managed
1066
b22750a2b04a Added checkIsAllowedToManageRole to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1061
diff changeset
   885
    """
b22750a2b04a Added checkIsAllowedToManageRole to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1061
diff changeset
   886
b22750a2b04a Added checkIsAllowedToManageRole to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1061
diff changeset
   887
    try:
b22750a2b04a Added checkIsAllowedToManageRole to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1061
diff changeset
   888
      # check if it is my role the user's own role
1248
f318538394d9 Rename checkHasActiveRole to checkHasActiveRoleForScope
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1239
diff changeset
   889
      self.checkHasActiveRoleForScope(django_args, role_logic)
1066
b22750a2b04a Added checkIsAllowedToManageRole to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1061
diff changeset
   890
    except out_of_band.Error:
b22750a2b04a Added checkIsAllowedToManageRole to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1061
diff changeset
   891
      pass
b22750a2b04a Added checkIsAllowedToManageRole to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1061
diff changeset
   892
b22750a2b04a Added checkIsAllowedToManageRole to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1061
diff changeset
   893
    # apparently it's not the user's role so check if managing this role is allowed
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   894
    fields = {
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   895
        'link_id': django_args['link_id'],
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   896
        'scope_path': django_args['scope_path'],
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   897
        }
1066
b22750a2b04a Added checkIsAllowedToManageRole to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1061
diff changeset
   898
1239
065e5bcf90f0 Stylefixes in access.py and removal of self.deny calls
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1237
diff changeset
   899
    role_entity = role_logic.getFromKeyFieldsOr404(fields)
065e5bcf90f0 Stylefixes in access.py and removal of self.deny calls
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1237
diff changeset
   900
    if role_entity.status != 'active':
065e5bcf90f0 Stylefixes in access.py and removal of self.deny calls
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1237
diff changeset
   901
      raise out_of_band.AccessViolation(message_fmt=DEF_NO_ACTIVE_ROLE_MSG)
914
6ec8dd2a73b3 Added various access methods in preperation for the new request system.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 895
diff changeset
   902
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   903
    fields = {
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   904
        'link_id': self.user.link_id,
1066
b22750a2b04a Added checkIsAllowedToManageRole to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1061
diff changeset
   905
        'scope_path': django_args['scope_path'],
1142
da2487767ef4 Fix missing dot and wrong import sorting in soc.views.helper.access module.
Pawel Solyga <Pawel.Solyga@gmail.com>
parents: 1135
diff changeset
   906
        'status': 'active'
1066
b22750a2b04a Added checkIsAllowedToManageRole to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1061
diff changeset
   907
        }
b22750a2b04a Added checkIsAllowedToManageRole to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1061
diff changeset
   908
1184
bd9c6101d41d Use .logic in checkIsAllowedToManageRole at the caller
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1180
diff changeset
   909
    manage_entity = manage_role_logic.getForFields(fields, unique=True)
1066
b22750a2b04a Added checkIsAllowedToManageRole to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1061
diff changeset
   910
b22750a2b04a Added checkIsAllowedToManageRole to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1061
diff changeset
   911
    if not manage_entity:
1239
065e5bcf90f0 Stylefixes in access.py and removal of self.deny calls
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1237
diff changeset
   912
      raise out_of_band.AccessViolation(message_fmt=DEF_NOT_YOUR_ENTITY_MSG)
1066
b22750a2b04a Added checkIsAllowedToManageRole to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1061
diff changeset
   913
b22750a2b04a Added checkIsAllowedToManageRole to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1061
diff changeset
   914
    return
b22750a2b04a Added checkIsAllowedToManageRole to access.py.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1061
diff changeset
   915
1265
cecb2b35f805 Added allowsidebar to checkIsDocumentReadable.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1263
diff changeset
   916
  @allowSidebar
1115
0a723ff3d27c Cleanups in base.Logic
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1107
diff changeset
   917
  @allowDeveloper
1135
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   918
  def checkIsDocumentReadable(self, django_args):
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   919
    """Checks whether a document is readable.
699
4e8eefe95748 Add and use a placeholder for checkIsDocumentPublic
Sverre Rabbelier <srabbelier@gmail.com>
parents: 639
diff changeset
   920
1007
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   921
    Args:
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   922
      django_args: a dictionary with django's arguments
3b66772d21a5 Major refactor of the access module
Sverre Rabbelier <srabbelier@gmail.com>
parents: 999
diff changeset
   923
    """
699
4e8eefe95748 Add and use a placeholder for checkIsDocumentPublic
Sverre Rabbelier <srabbelier@gmail.com>
parents: 639
diff changeset
   924
1239
065e5bcf90f0 Stylefixes in access.py and removal of self.deny calls
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1237
diff changeset
   925
    document = document_logic.getFromKeyFieldsOr404(django_args)
1135
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   926
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   927
    self.checkMembership('read', document.prefix,
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   928
                         document.read_access, django_args)
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   929
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   930
  @denySidebar
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   931
  @allowDeveloper
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   932
  def checkIsDocumentWritable(self, django_args):
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   933
    """Checks whether a document is writable.
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   934
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   935
    Args:
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   936
      django_args: a dictionary with django's arguments
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   937
    """
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   938
1239
065e5bcf90f0 Stylefixes in access.py and removal of self.deny calls
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1237
diff changeset
   939
    document = document_logic.getFromKeyFieldsOr404(django_args)
1135
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   940
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   941
    self.checkMembership('write', document.prefix,
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   942
                         document.write_access, django_args)
1074
94bc2a9ae103 Properly check if a program is active
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1073
diff changeset
   943
1305
9567bb475d6d Do access checks on the pick url for documents
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1300
diff changeset
   944
  @allowDeveloper
9567bb475d6d Do access checks on the pick url for documents
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1300
diff changeset
   945
  def checkDocumentPick(self, django_args):
9567bb475d6d Do access checks on the pick url for documents
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1300
diff changeset
   946
    """Checks whether the user has access to the specified pick url.
9567bb475d6d Do access checks on the pick url for documents
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1300
diff changeset
   947
9567bb475d6d Do access checks on the pick url for documents
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1300
diff changeset
   948
    Will update the 'read_access' field of django_args['GET'].
9567bb475d6d Do access checks on the pick url for documents
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1300
diff changeset
   949
    """
9567bb475d6d Do access checks on the pick url for documents
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1300
diff changeset
   950
9567bb475d6d Do access checks on the pick url for documents
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1300
diff changeset
   951
    get_args = django_args['GET']
9567bb475d6d Do access checks on the pick url for documents
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1300
diff changeset
   952
9567bb475d6d Do access checks on the pick url for documents
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1300
diff changeset
   953
    # make mutable in order to inject the proper read_access filter
9567bb475d6d Do access checks on the pick url for documents
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1300
diff changeset
   954
    mutable = get_args._mutable
9567bb475d6d Do access checks on the pick url for documents
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1300
diff changeset
   955
    get_args._mutable = True
9567bb475d6d Do access checks on the pick url for documents
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1300
diff changeset
   956
9567bb475d6d Do access checks on the pick url for documents
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1300
diff changeset
   957
    if 'prefix' not in get_args:
9567bb475d6d Do access checks on the pick url for documents
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1300
diff changeset
   958
      raise out_of_band.AccessViolation(message_fmt=DEF_PREFIX_NOT_IN_ARGS_MSG)
9567bb475d6d Do access checks on the pick url for documents
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1300
diff changeset
   959
9567bb475d6d Do access checks on the pick url for documents
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1300
diff changeset
   960
    prefix = get_args['prefix']
9567bb475d6d Do access checks on the pick url for documents
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1300
diff changeset
   961
9567bb475d6d Do access checks on the pick url for documents
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1300
diff changeset
   962
    checker = rights_logic.Checker(prefix)
9567bb475d6d Do access checks on the pick url for documents
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1300
diff changeset
   963
    memberships = checker.getMemberships()
9567bb475d6d Do access checks on the pick url for documents
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1300
diff changeset
   964
9567bb475d6d Do access checks on the pick url for documents
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1300
diff changeset
   965
    roles = []
9567bb475d6d Do access checks on the pick url for documents
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1300
diff changeset
   966
    for key, value in memberships.iteritems():
9567bb475d6d Do access checks on the pick url for documents
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1300
diff changeset
   967
      if self.hasMembership(value, django_args):
9567bb475d6d Do access checks on the pick url for documents
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1300
diff changeset
   968
        roles.append(key)
9567bb475d6d Do access checks on the pick url for documents
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1300
diff changeset
   969
9567bb475d6d Do access checks on the pick url for documents
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1300
diff changeset
   970
    get_args.setlist('read_access', roles)
9567bb475d6d Do access checks on the pick url for documents
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1300
diff changeset
   971
    get_args._mutable = mutable
9567bb475d6d Do access checks on the pick url for documents
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1300
diff changeset
   972
1135
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   973
  def checkCanEditTimeline(self, django_args):
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   974
    """Checks whether this program's timeline may be edited.
24d695060863 Hook up the ACL system for documents.
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1122
diff changeset
   975
    """
1107
a878188e225c Added status to program.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1085
diff changeset
   976
a878188e225c Added status to program.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1085
diff changeset
   977
    time_line_keyname = django_args['scope_path']
a878188e225c Added status to program.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1085
diff changeset
   978
    timeline_entity = timeline_logic.getFromKeyName(time_line_keyname)
a878188e225c Added status to program.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1085
diff changeset
   979
a878188e225c Added status to program.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1085
diff changeset
   980
    if not timeline_entity:
a878188e225c Added status to program.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1085
diff changeset
   981
      # timeline does not exists so deny
a878188e225c Added status to program.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1085
diff changeset
   982
      self.deny(django_args)
a878188e225c Added status to program.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1085
diff changeset
   983
1122
659984867a9a Removed workflow type as keyfield from program.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1115
diff changeset
   984
    split_keyname = time_line_keyname.rsplit('/')
1107
a878188e225c Added status to program.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1085
diff changeset
   985
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   986
    fields = {
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   987
        'scope_path' : split_keyname[0],
1122
659984867a9a Removed workflow type as keyfield from program.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1115
diff changeset
   988
        'link_id' : split_keyname[1],
1107
a878188e225c Added status to program.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1085
diff changeset
   989
        }
a878188e225c Added status to program.
Lennard de Rijk <ljvderijk@gmail.com>
parents: 1085
diff changeset
   990
1163
d8c50be19232 Cleaned up access.py
Sverre Rabbelier <srabbelier@gmail.com>
parents: 1142
diff changeset
   991
    self.checkIsHostForProgram(fields)