app/soc/views/helper/access.py
changeset 1239 065e5bcf90f0
parent 1237 b5bf2aa0f3f9
child 1248 f318538394d9
equal deleted inserted replaced
1238:af56ae7397ab 1239:065e5bcf90f0
    59 from soc.views import helper
    59 from soc.views import helper
    60 from soc.views import out_of_band
    60 from soc.views import out_of_band
    61 
    61 
    62 
    62 
    63 DEF_NO_USER_LOGIN_MSG= ugettext(
    63 DEF_NO_USER_LOGIN_MSG= ugettext(
    64   'Please create <a href="/user/create_profile">User Profile</a>'
    64     'Please create <a href="/user/create_profile">User Profile</a>'
    65   ' in order to view this page.')
    65     ' in order to view this page.')
    66 
    66 
    67 DEF_AGREE_TO_TOS_MSG_FMT = ugettext(
    67 DEF_AGREE_TO_TOS_MSG_FMT = ugettext(
    68   'You must agree to the <a href="%(tos_link)s">site-wide Terms of'
    68     'You must agree to the <a href="%(tos_link)s">site-wide Terms of'
    69   ' Service</a> in your <a href="/user/edit_profile">User Profile</a>'
    69     ' Service</a> in your <a href="/user/edit_profile">User Profile</a>'
    70   ' in order to view this page.')
    70     ' in order to view this page.')
    71 
    71 
    72 DEF_DEV_LOGOUT_LOGIN_MSG_FMT = ugettext(
    72 DEF_DEV_LOGOUT_LOGIN_MSG_FMT = ugettext(
    73   'Please <a href="%%(sign_out)s">sign out</a>'
    73     'Please <a href="%%(sign_out)s">sign out</a>'
    74   ' and <a href="%%(sign_in)s">sign in</a>'
    74     ' and <a href="%%(sign_in)s">sign in</a>'
    75   ' again as %(role)s to view this page.')
    75     ' again as %(role)s to view this page.')
    76 
    76 
    77 DEF_NEED_MEMBERSHIP_MSG_FMT = ugettext(
    77 DEF_NEED_MEMBERSHIP_MSG_FMT = ugettext(
    78   'You need to be in the %(status)s group to %(action)s'
    78     'You need to be in the %(status)s group to %(action)s'
    79   ' documents in the %(prefix)s prefix.')
    79     ' documents in the %(prefix)s prefix.')
    80 
    80 
    81 DEF_NEED_ROLE_MSG = ugettext(
    81 DEF_NEED_ROLE_MSG = ugettext(
    82   'You do not have the required role.')
    82     'You do not have the required role.')
    83 
    83 
    84 DEF_NOT_YOUR_ENTITY_MSG = ugettext(
    84 DEF_NOT_YOUR_ENTITY_MSG = ugettext(
    85   'This entity does not belong to you.')
    85     'This entity does not belong to you.')
    86 
    86 
    87 DEF_NO_ACTIVE_GROUP_MSG = ugettext(
    87 DEF_NO_ACTIVE_GROUP_MSG = ugettext(
    88   'There is no such active group.')
    88     'There is no such active group.')
       
    89 
       
    90 DEF_NO_ACTIVE_ROLE_MSG = ugettext(
       
    91     'There is no such active role.')
       
    92 
       
    93 DEF_NO_ACTIVE_PROGRAM_MSG = ugettext(
       
    94     'There is no such active program.')
    89 
    95 
    90 DEF_NO_REQUEST_MSG = ugettext(
    96 DEF_NO_REQUEST_MSG = ugettext(
    91   'There is no accepted request that would allow you to visit this page.')
    97     'There is no accepted request that would allow you to visit this page.')
       
    98 
       
    99 DEF_NO_APPLICATION_MSG = ugettext(
       
   100     'There is no application that would allow you to visit this page.')
    92 
   101 
    93 DEF_NEED_PICK_ARGS_MSG = ugettext(
   102 DEF_NEED_PICK_ARGS_MSG = ugettext(
    94   'The "continue" and "field" args are not both present.')
   103     'The "continue" and "field" args are not both present.')
    95 
   104 
    96 DEF_REVIEW_COMPLETED_MSG = ugettext(
   105 DEF_REVIEW_COMPLETED_MSG = ugettext(
    97     'This Application can not be reviewed anymore (it has been completed or rejected)')
   106     'This Application can not be reviewed anymore (it has been completed or rejected)')
    98 
   107 
    99 DEF_REQUEST_COMPLETED_MSG = ugettext(
   108 DEF_REQUEST_COMPLETED_MSG = ugettext(
   100   'This request cannot be accepted (it is either completed or denied).')
   109     'This request cannot be accepted (it is either completed or denied).')
   101 
   110 
   102 DEF_SCOPE_INACTIVE_MSG = ugettext(
   111 DEF_SCOPE_INACTIVE_MSG = ugettext(
   103   'The scope for this request is not active.')
   112     'The scope for this request is not active.')
   104 
   113 
   105 DEF_PAGE_DENIED_MSG = ugettext(
   114 DEF_PAGE_DENIED_MSG = ugettext(
   106   'Access to this page has been restricted')
   115     'Access to this page has been restricted')
   107 
   116 
   108 DEF_PAGE_INACTIVE_MSG = ugettext(
   117 DEF_PAGE_INACTIVE_MSG = ugettext(
   109     'This page is inactive at this time')
   118     'This page is inactive at this time')
   110 
   119 
   111 DEF_LOGOUT_MSG_FMT = ugettext(
   120 DEF_LOGOUT_MSG_FMT = ugettext(
   670     """
   679     """
   671 
   680 
   672     program = program_logic.getFromKeyFields(django_args)
   681     program = program_logic.getFromKeyFields(django_args)
   673 
   682 
   674     if not program or program.status == 'invalid':
   683     if not program or program.status == 'invalid':
   675       self.deny(django_args)
   684       raise out_of_band.AccessViolation(message_fmt=DEF_NO_ACTIVE_PROGRAM_MSG)
   676 
   685 
   677     new_args = {'scope_path': program.scope_path }
   686     new_args = {'scope_path': program.scope_path }
   678     self.checkHasActiveRole(new_args, host_logic)
   687     self.checkHasActiveRole(new_args, host_logic)
   679 
   688 
   680   @allowDeveloper
   689   @allowDeveloper
   745     if entity:
   754     if entity:
   746       return
   755       return
   747 
   756 
   748     raise out_of_band.AccessViolation(message_fmt=DEF_NOT_YOUR_ENTITY_MSG)
   757     raise out_of_band.AccessViolation(message_fmt=DEF_NOT_YOUR_ENTITY_MSG)
   749 
   758 
   750 
       
   751   @allowSidebar
   759   @allowSidebar
   752   def checkCanReviewGroupApp(self, django_args, group_app_logic):
   760   def checkCanReviewGroupApp(self, django_args, group_app_logic):
   753     """Checks if the group_app in args is valid to be reviewed.
   761     """Checks if the group_app in args is valid to be reviewed.
   754 
   762 
   755     Args:
   763     Args:
   803     application = app_logic.getForFields(properties, unique=True)
   811     application = app_logic.getForFields(properties, unique=True)
   804 
   812 
   805     if application:
   813     if application:
   806       return
   814       return
   807 
   815 
   808     # TODO(srabbelier) Make this give a proper error message
   816     raise out_of_band.AccessViolation(message_fmt=DEF_NO_APPLICATION_MSG)
   809     self.deny(django_args)
       
   810 
   817 
   811   def checkIsMyEntity(self, django_args, logic,
   818   def checkIsMyEntity(self, django_args, logic,
   812                       field_name='user', user=False):
   819                       field_name='user', user=False):
   813     """Checks whether the entity belongs to the user.
   820     """Checks whether the entity belongs to the user.
   814     """
   821     """
   858 
   865 
   859     # apparently it's not the user's role so check if managing this role is allowed
   866     # apparently it's not the user's role so check if managing this role is allowed
   860     fields = {
   867     fields = {
   861         'link_id': django_args['link_id'],
   868         'link_id': django_args['link_id'],
   862         'scope_path': django_args['scope_path'],
   869         'scope_path': django_args['scope_path'],
   863         'status': 'active',
   870         }
   864         }
   871 
   865 
   872     role_entity = role_logic.getFromKeyFieldsOr404(fields)
   866     role_entity = role_logic.getForFields(fields)
   873     if role_entity.status != 'active':
       
   874       raise out_of_band.AccessViolation(message_fmt=DEF_NO_ACTIVE_ROLE_MSG)
   867 
   875 
   868     fields = {
   876     fields = {
   869         'link_id': self.user.link_id,
   877         'link_id': self.user.link_id,
   870         'scope_path': django_args['scope_path'],
   878         'scope_path': django_args['scope_path'],
   871         'status': 'active'
   879         'status': 'active'
   872         }
   880         }
   873 
   881 
   874     manage_entity = manage_role_logic.getForFields(fields, unique=True)
   882     manage_entity = manage_role_logic.getForFields(fields, unique=True)
   875 
   883 
   876     if not manage_entity:
   884     if not manage_entity:
   877       self.deny(django_args)
   885       raise out_of_band.AccessViolation(message_fmt=DEF_NOT_YOUR_ENTITY_MSG)
   878 
   886 
   879     return
   887     return
   880 
   888 
   881   @denySidebar
   889   @denySidebar
   882   @allowDeveloper
   890   @allowDeveloper
   885 
   893 
   886     Args:
   894     Args:
   887       django_args: a dictionary with django's arguments
   895       django_args: a dictionary with django's arguments
   888     """
   896     """
   889 
   897 
   890     key_fields = document_logic.getKeyFieldsFromFields(django_args)
   898     document = document_logic.getFromKeyFieldsOr404(django_args)
   891     document = document_logic.getFromKeyFields(key_fields)
       
   892 
   899 
   893     self.checkMembership('read', document.prefix,
   900     self.checkMembership('read', document.prefix,
   894                          document.read_access, django_args)
   901                          document.read_access, django_args)
   895 
   902 
   896   @denySidebar
   903   @denySidebar
   900 
   907 
   901     Args:
   908     Args:
   902       django_args: a dictionary with django's arguments
   909       django_args: a dictionary with django's arguments
   903     """
   910     """
   904 
   911 
   905     document = document_logic.getFromKeyFields(django_args)
   912     document = document_logic.getFromKeyFieldsOr404(django_args)
   906 
   913 
   907     self.checkMembership('write', document.prefix,
   914     self.checkMembership('write', document.prefix,
   908                          document.write_access, django_args)
   915                          document.write_access, django_args)
   909 
   916 
   910   def checkCanEditTimeline(self, django_args):
   917   def checkCanEditTimeline(self, django_args):