py_tasks_melange: comparison app/soc/views/helper/access.py

equal deleted inserted replaced

-:0ec74865eb5e
+:70e0b6d8ff73
 DEF_LOGOUT_MSG_FMT = ugettext_lazy(
 'Please <a href="%(sign_out)s">sign out</a> in order to view this page')
-def checkAccess(access_type, request, rights):
+def checkAccess(access_type, request, rights, args=None, kwargs=None):
 """Runs all the defined checks for the specified type.
 Args:
 access_type: the type of request (such as 'list' or 'edit')
 request: the Django request object
 the response provided by the failed access check.
 """
 # Call each access checker
 for check in rights['any_access']:
-check(request)
+check(request, args, kwargs)
 if access_type not in rights:
 for check in rights['unspecified']:
 # No checks defined, so do the 'generic' checks and bail out
-check(request)
+check(request, args, kwargs)
 return
 for check in rights[access_type]:
-check(request)
+check(request, args, kwargs)
-def allow(request):
+def allow(request, args, kwargs):
 """Never returns an alternate HTTP response.
 Args:
 request: a Django HTTP request
 """
 return
-def deny(request):
+def deny(request, args, kwargs):
 """Returns an alternate HTTP response.
 Args:
 request: a Django HTTP request
 context['title'] = 'Access denied'
 raise out_of_band.AccessViolation(DEF_PAGE_DENIED_MSG, context=context)
-def checkIsLoggedIn(request):
+def checkIsLoggedIn(request, args, kwargs):
 """Returns an alternate HTTP response if Google Account is not logged in.
 Args:
 request: a Django HTTP request
 return
 raise out_of_band.LoginRequest()
-def checkNotLoggedIn(request):
+def checkNotLoggedIn(request, args, kwargs):
 """Returns an alternate HTTP response if Google Account is not logged in.
 Args:
 request: a Django HTTP request
 return
 raise out_of_band.LoginRequest(message_fmt=DEF_LOGOUT_MSG_FMT)
-def checkIsUser(request):
+def checkIsUser(request, args, kwargs):
 """Returns an alternate HTTP response if Google Account has no User entity.
 Args:
 request: a Django HTTP request
 None if User exists for a Google Account, or a subclass of
 django.http.HttpResponse which contains the alternate response
 should be returned by the calling view.
 """
-checkIsLoggedIn(request)
+checkIsLoggedIn(request, args, kwargs)
 user = user_logic.logic.getForFields(
 {'account': users.get_current_user()}, unique=True)
 if user:
 return
 raise out_of_band.LoginRequest(message_fmt=DEF_NO_USER_LOGIN_MSG_FMT)
-def checkIsDeveloper(request):
+def checkIsDeveloper(request, args, kwargs):
 """Returns an alternate HTTP response if Google Account is not a Developer.
 Args:
 request: a Django HTTP request
 None if Google Account is logged in and logged-in user is a Developer,
 or a subclass of django.http.HttpResponse which contains the alternate
 response should be returned by the calling view.
 """
-checkIsUser(request)
+checkIsUser(request, args, kwargs)
 if accounts.isDeveloper(account=users.get_current_user()):
 return
 login_message_fmt = DEF_DEV_LOGOUT_LOGIN_MSG_FMT % {
 'role': 'a Site Developer '}
 raise out_of_band.LoginRequest(message_fmt=login_message_fmt)
-def checkIsHost(request):
+def checkIsHost(request, args, kwargs):
 """Returns an alternate HTTP response if Google Account has no Host entity
 for the specified program.
 Args:
 request: a Django HTTP request
 should be returned by the calling view.
 """
 try:
 # if the current user is invited to create a host profile we allow access
-checkIsInvited(request)
+checkIsInvited(request, args, kwargs)
 return
 except out_of_band.Error:
 pass
-checkIsUser(request)
+checkIsUser(request, args, kwargs)
 user = user_logic.logic.getForFields(
 {'account': users.get_current_user()}, unique=True)
 host = host_logic.logic.getForFields(
 'role': 'a Program Administrator '}
 raise out_of_band.LoginRequest(message_fmt=login_message_fmt)
-def checkIsClubAdminForClub(request):
+def checkIsClubAdminForClub(request, args, kwargs):
 """Returns an alternate HTTP response if Google Account has no Club Admin
 entity for the specified club.
 Args:
 request: a Django HTTP request
 should be returned by the calling view.
 """
 try:
 # if the current user is invited to create a host profile we allow access
-checkIsDeveloper(request)
+checkIsDeveloper(request, args, kwargs)
 return
 except out_of_band.Error:
 pass
-checkIsUser(request)
+checkIsUser(request, args, kwargs)
 # TODO(srabbelier) implement this
 login_message_fmt = DEF_DEV_LOGOUT_LOGIN_MSG_FMT % {
 'role': 'a Club Admin for this Club'}
 raise out_of_band.LoginRequest(message_fmt=login_message_fmt)
-def checkIsInvited(request):
+def checkIsInvited(request, args, kwargs):
 """Returns an alternate HTTP response if Google Account has no Host entity
 for the specified program.
 Args:
 request: a Django HTTP request
 should be returned by the calling view.
 """
 try:
 # if the current user is a developer we allow access
-checkIsDeveloper(request)
+checkIsDeveloper(request, args, kwargs)
 return
 except out_of_band.Error:
 pass
-checkIsUser(request)
+checkIsUser(request, args, kwargs)
 login_message_fmt = DEF_DEV_LOGOUT_LOGIN_MSG_FMT % {
 'role': 'a Program Administrator for this Program'}
 splitpath = request.path.split('/')
 splitpath = splitpath[1:] # cut off leading ''
 if len(splitpath) < 4:
 # TODO: perhaps this needs a better explanation?
-deny(request)
+deny(request, args, kwargs)
 role = splitpath[0]
 group_id = splitpath[2]
 user_id = splitpath[3]
 user = user_logic.logic.getForFields(
 {'account': users.get_current_user()}, unique=True)
 if user_id != user.link_id:
 # TODO: perhaps this needs a better explanation?
-deny(request)
+deny(request, args, kwargs)
 properties = {
 'link_id': user_id,
 'role': role,
 'scope_path': group_id,
 return
 raise out_of_band.LoginRequest(message_fmt=login_message_fmt)
-def checkIsClubAppAccepted(request):
+def checkIsClubAppAccepted(request, args, kwargs):
 """Returns an alternate HTTP response if Google Account has no Club App
 entity for the specified Club.
 Args:
 request: a Django HTTP request
 should be returned by the calling view.
 """
 try:
 # if the current user is a developer we allow access
-checkIsDeveloper(request)
+checkIsDeveloper(request, args, kwargs)
 return
 except out_of_band.Error:
 pass
-checkIsUser(request)
+checkIsUser(request, args, kwargs)
 user = user_logic.logic.getForCurrentAccount()
 properties = {
 'applicant': user,
 if group_app:
 return
 # TODO(srabbelier) Make this give a proper error message
-deny(request)
+deny(request, args, kwargs)
-def checkIsMyNotification(request):
+def checkIsMyNotification(request, args, kwargs):
 """Returns an alternate HTTP response if this request is for a Notification belonging
 to the current user.
 Args:
 request: a Django HTTP request
 None if the current User is allowed to access this Notification.
 """
 try:
 # if the current user is a developer we allow access
-checkIsDeveloper(request)
+checkIsDeveloper(request, args, kwargs)
 return
 except out_of_band.Error:
 pass
-checkIsUser(request)
+checkIsUser(request, args, kwargs)
 # Mine the url for params
 try:
 callback, args, kwargs = urlresolvers.resolve(request.path)
 except Exception:
-deny(request)
+deny(request, args, kwargs)
 properties = dicts.filter(kwargs, ['link_id', 'scope_path'])
 notification = notification_logic.logic.getForFields(properties, unique=True)
 user = user_logic.logic.getForCurrentAccount()
 # if the keys are equal (which is what we want).
 if user.key() == notification.scope.key():
 return None
 # TODO(ljvderijk) Make this give a proper error message
-deny(request)
+deny(request, args, kwargs)
-def checkIsMyApplication(request):
+def checkIsMyApplication(request, args, kwargs):
 """Returns an alternate HTTP response if this request is for a Application belonging
 to the current user.
 Args:
 request: a Django HTTP request
 None if the current User is allowed to access this Application.
 """
 try:
 # if the current user is a developer we allow access
-checkIsDeveloper(request)
+checkIsDeveloper(request, args, kwargs)
 return
 except out_of_band.Error:
 pass
-checkIsUser(request)
+checkIsUser(request, args, kwargs)
 # Mine the url for params
 try:
 callback, args, kwargs = urlresolvers.resolve(request.path)
 except Exception:
-deny(request)
+deny(request, args, kwargs)
 properties = dicts.filter(kwargs, ['link_id'])
 application = group_app_logic.logic.getForFields(properties, unique=True)
 user = user_logic.logic.getForCurrentAccount()
 # if the keys are equal (which is what we want).
 if user.key() == application.applicant.key():
 return None
 # TODO(srabbelier) Make this give a proper error message
-deny(request)
+deny(request, args, kwargs)
-def checkCanInvite(request):
+def checkCanInvite(request, args, kwargs):
 """Checks to see if the current user can create an invite.
 Note that if the current url is not in the default 'request' form
 this method either deny()s or performs the wrong access check.
 request: a Django HTTP request
 """
 try:
 # if the current user is a developer we allow access
-checkIsDeveloper(request)
+checkIsDeveloper(request, args, kwargs)
 return
 except out_of_band.Error:
 pass
 # Mine the url for params
 try:
 callback, args, kwargs = urlresolvers.resolve(request.path)
 except Exception:
-deny(request)
+deny(request, args, kwargs)
 # Construct a new url by reshufling the kwargs
 order = ['role', 'access_type', 'scope_path', 'link_id']
 url_params = dicts.unzip(kwargs, order)
 url = '/'.join([''] + list(url_params))
 # Mine the reshufled url
 try:
 callback, args, kwargs = urlresolvers.resolve(url)
 except Exception:
-deny(request)
+deny(request, args, kwargs)
 # Get the everything we need for the access check
 params = callback.im_self.getParams()
 access_type = kwargs['access_type']
 # Perform the access check
-helper.access.checkAccess(access_type, request, rights=params['rights'])
+checkAccess(access_type, request, rights=params['rights'])
-def checkIsDocumentPublic(request):
+def checkIsDocumentPublic(request, args, kwargs):
 """Checks whether a document is public.
 Args:
 request: a Django HTTP request
 """
 # TODO(srabbelier): A proper check needs to be done to see if the document
 # is public or not, probably involving analysing it's scope or such.
-allow(request)
+allow(request, args, kwargs)

changeset 872	70e0b6d8ff73
parent 814	25ffebd9fa8f
child 882	267e31f1a0b6