Changeset - c101cafe9a0f
Parent rev.
Child rev.
[Not reviewed]
default
0 1 0
Mads Kiilerich (mads) - 6 years ago 2020-08-23 14:41:40
mads@kiilerich.com
auth: compute AuthUser.repository_permissions lazily
1 file changed with 53 insertions and 55 deletions:
kallithea/lib/auth.py
53
55
0 comments (0 inline, 0 general)
kallithea/lib/auth.py
➞
Show inline comments
 
@@ -128,64 +128,45 @@ def bump_permission(permissions, key, ne
 
    new_perm_val = PERM_WEIGHTS[new_perm]
 
    cur_perm_val = PERM_WEIGHTS[cur_perm]
 
    if new_perm_val > cur_perm_val:
 
        permissions[key] = new_perm
 

			




	
	
	
		
 
def get_user_permissions(user_id, user_is_admin):

			




	
	
	
		
 
    repository_permissions = {}

			




	
	
	
		
 
    repository_group_permissions = {}

			




	
	
	
		
 
    user_group_permissions = {}

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
    #======================================================================

			




	
	
	
		
 
    # fetch default permissions

			




	
	
	
		
 
    #======================================================================

			




	
	
	
		
 
    default_repo_perms = Permission.get_default_perms(kallithea.DEFAULT_USER_ID)

			




	
	
	
		
 
    default_repo_groups_perms = Permission.get_default_group_perms(kallithea.DEFAULT_USER_ID)

			




	
	
	
		
 
    default_user_group_perms = Permission.get_default_user_group_perms(kallithea.DEFAULT_USER_ID)

			




	
	
	
		
 

			




	
	
	
		
 
    if user_is_admin:

			




	
	
	
		
 
        #==================================================================

			




	
	
	
		
 
        # admin users have all rights;

			




	
	
	
		
 
        # based on default permissions, just set everything to admin

			




	
	
	
		
 
        #==================================================================

			




	
	
	
		
 

			




	
	
	
		
 
        # repositories

			




	
	
	
		
 
        for perm in default_repo_perms:

			




	
	
	
		
 
            r_k = perm.repository.repo_name

			




	
	
	
		
 
            p = 'repository.admin'

			




	
	
	
		
 
            repository_permissions[r_k] = p

			




	
	
	
		
 

			




	
	
	
		
 
        # repository groups

			




	
	
	
		
 
        for perm in default_repo_groups_perms:

			




	
	
	
		
 
            rg_k = perm.group.group_name

			




	
	
	
		
 
            p = 'group.admin'

			




	
	
	
		
 
            repository_group_permissions[rg_k] = p

			




	
	
	
		
 

			




	
	
	
		
 
        # user groups

			




	
	
	
		
 
        for perm in default_user_group_perms:

			




	
	
	
		
 
            u_k = perm.user_group.users_group_name

			




	
	
	
		
 
            p = 'usergroup.admin'

			




	
	
	
		
 
            user_group_permissions[u_k] = p

			




	
	
	
		
 
        return (repository_permissions, repository_group_permissions, user_group_permissions)

			




	
	
	
		
 
        return (repository_group_permissions, user_group_permissions)

			




	
	
	
		
 

			




	
	
	
		
 
    #==================================================================

			




	
	
	
		
 
    # SET DEFAULTS GLOBAL, REPOS, REPOSITORY GROUPS

			




	
	
	
		
 
    #==================================================================

			




	
	
	
		
 

			




	
	
	
		
 
    # defaults for repositories, taken from default user

			




	
	
	
		
 
    for perm in default_repo_perms:

			




	
	
	
		
 
        r_k = perm.repository.repo_name

			




	
	
	
		
 
        if perm.repository.owner_id == user_id:

			




	
	
	
		
 
            p = 'repository.admin'

			




	
	
	
		
 
        elif perm.repository.private:

			




	
	
	
		
 
            p = 'repository.none'

			




	
	
	
		
 
        else:

			




	
	
	
		
 
            p = perm.permission.permission_name

			




	
	
	
		
 
        repository_permissions[r_k] = p

			




	
	
	
		
 

			




	
	
	
		
 
    # defaults for repository groups taken from default user permission

			




	
	
	
		
 
    # on given group

			




	
	
	
		
 
    for perm in default_repo_groups_perms:

			




	
	
	
		
 
        rg_k = perm.group.group_name

			




	
	
	
		
 
        p = perm.permission.permission_name

			




	
	
	
		
 
        repository_group_permissions[rg_k] = p

			




	
	
		
 
@@ -195,45 +176,12 @@ def get_user_permissions(user_id, user_i

			




	
	
	
		
 
    for perm in default_user_group_perms:

			




	
	
	
		
 
        u_k = perm.user_group.users_group_name

			




	
	
	
		
 
        p = perm.permission.permission_name

			




	
	
	
		
 
        user_group_permissions[u_k] = p

			




	
	
	
		
 

			




	
	
	
		
 
    #======================================================================

			




	
	
	
		
 
    # !! PERMISSIONS FOR REPOSITORIES !!

			




	
	
	
		
 
    #======================================================================

			




	
	
	
		
 
    #======================================================================

			




	
	
	
		
 
    # check if user is part of user groups for this repository and

			




	
	
	
		
 
    # fill in his permission from it.

			




	
	
	
		
 
    #======================================================================

			




	
	
	
		
 

			




	
	
	
		
 
    # user group for repositories permissions

			




	
	
	
		
 
    user_repo_perms_from_users_groups = \

			




	
	
	
		
 
     Session().query(UserGroupRepoToPerm) \

			




	
	
	
		
 
        .join((UserGroup, UserGroupRepoToPerm.users_group_id ==

			




	
	
	
		
 
               UserGroup.users_group_id)) \

			




	
	
	
		
 
        .filter(UserGroup.users_group_active == True) \

			




	
	
	
		
 
        .join((UserGroupMember, UserGroupRepoToPerm.users_group_id ==

			




	
	
	
		
 
               UserGroupMember.users_group_id)) \

			




	
	
	
		
 
        .filter(UserGroupMember.user_id == user_id) \

			




	
	
	
		
 
        .options(joinedload(UserGroupRepoToPerm.repository)) \

			




	
	
	
		
 
        .options(joinedload(UserGroupRepoToPerm.permission)) \

			




	
	
	
		
 
        .all()

			




	
	
	
		
 

			




	
	
	
		
 
    for perm in user_repo_perms_from_users_groups:

			




	
	
	
		
 
        bump_permission(repository_permissions,

			




	
	
	
		
 
            perm.repository.repo_name,

			




	
	
	
		
 
            perm.permission.permission_name)

			




	
	
	
		
 

			




	
	
	
		
 
    # user permissions for repositories

			




	
	
	
		
 
    user_repo_perms = Permission.get_default_perms(user_id)

			




	
	
	
		
 
    for perm in user_repo_perms:

			




	
	
	
		
 
        bump_permission(repository_permissions,

			




	
	
	
		
 
            perm.repository.repo_name,

			




	
	
	
		
 
            perm.permission.permission_name)

			




	
	
	
		
 

			




	
	
	
		
 
    #======================================================================

			




	
	
	
		
 
    # !! PERMISSIONS FOR REPOSITORY GROUPS !!

			




	
	
	
		
 
    #======================================================================

			




	
	
	
		
 
    #======================================================================

			




	
	
	
		
 
    # check if user is part of user groups for this repository groups and

			




	
	
	
		
 
    # fill in his permission from it.

			




	
	
	
		
 
    #======================================================================

			




	
	
		
 
@@ -287,13 +235,13 @@ def get_user_permissions(user_id, user_i

			




	
	
	
		
 
    user_user_groups_perms = Permission.get_default_user_group_perms(user_id)

			




	
	
	
		
 
    for perm in user_user_groups_perms:

			




	
	
	
		
 
        bump_permission(user_group_permissions,

			




	
	
	
		
 
            perm.user_group.users_group_name,

			




	
	
	
		
 
            perm.permission.permission_name)

			




	
	
	
		
 

			




	
	
	
		
 
    return (repository_permissions, repository_group_permissions, user_group_permissions)

			




	
	
	
		
 
    return (repository_group_permissions, user_group_permissions)

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
class AuthUser(object):

			




	
	
	
		
 
    """

			




	
	
	
		
 
    Represents a Kallithea user, including various authentication and

			




	
	
	
		
 
    authorization information. Typically used to store the current user,

			




	
	
		
 
@@ -376,13 +324,13 @@ class AuthUser(object):

			




	
	
	
		
 
                assert k not in ['api_keys', 'permissions']

			




	
	
	
		
 
                setattr(self, k, v)

			




	
	
	
		
 
            self.is_default_user = dbuser.is_default_user

			




	
	
	
		
 
        log.debug('Auth User is now %s', self)

			




	
	
	
		
 

			




	
	
	
		
 
        log.debug('Getting PERMISSION tree for %s', self)

			




	
	
	
		
 
        (self.repository_permissions, self.repository_group_permissions, self.user_group_permissions,

			




	
	
	
		
 
        (self.repository_group_permissions, self.user_group_permissions,

			




	
	
	
		
 
        )= get_user_permissions(self.user_id, self.is_admin)

			




	
	
	
		
 

			




	
	
	
		
 
    @LazyProperty

			




	
	
	
		
 
    def global_permissions(self):

			




	
	
	
		
 
        log.debug('Getting global permissions for %s', self)

			




	
	
	
		
 

			




	
	
		
 
@@ -430,12 +378,62 @@ class AuthUser(object):

			




	
	
	
		
 
        for perm in sorted(global_permissions, key=lambda n: PERM_WEIGHTS.get(n, -1)):

			




	
	
	
		
 
            kind = perm.rsplit('.', 1)[0]

			




	
	
	
		
 
            kind_max_perm[kind] = perm

			




	
	
	
		
 
        return set(kind_max_perm.values())

			




	
	
	
		
 

			




	
	
	
		
 
    @LazyProperty

			




	
	
	
		
 
    def repository_permissions(self):

			




	
	
	
		
 
        log.debug('Getting repository permissions for %s', self)

			




	
	
	
		
 
        repository_permissions = {}

			




	
	
	
		
 
        default_repo_perms = Permission.get_default_perms(kallithea.DEFAULT_USER_ID)

			




	
	
	
		
 

			




	
	
	
		
 
        if self.is_admin:

			




	
	
	
		
 
            for perm in default_repo_perms:

			




	
	
	
		
 
                r_k = perm.repository.repo_name

			




	
	
	
		
 
                p = 'repository.admin'

			




	
	
	
		
 
                repository_permissions[r_k] = p

			




	
	
	
		
 

			




	
	
	
		
 
        else:

			




	
	
	
		
 
            # defaults for repositories from default user

			




	
	
	
		
 
            for perm in default_repo_perms:

			




	
	
	
		
 
                r_k = perm.repository.repo_name

			




	
	
	
		
 
                if perm.repository.owner_id == self.user_id:

			




	
	
	
		
 
                    p = 'repository.admin'

			




	
	
	
		
 
                elif perm.repository.private:

			




	
	
	
		
 
                    p = 'repository.none'

			




	
	
	
		
 
                else:

			




	
	
	
		
 
                    p = perm.permission.permission_name

			




	
	
	
		
 
                repository_permissions[r_k] = p

			




	
	
	
		
 

			




	
	
	
		
 
            # user group repository permissions

			




	
	
	
		
 
            user_repo_perms_from_users_groups = \

			




	
	
	
		
 
             Session().query(UserGroupRepoToPerm) \

			




	
	
	
		
 
                .join((UserGroup, UserGroupRepoToPerm.users_group_id ==

			




	
	
	
		
 
                       UserGroup.users_group_id)) \

			




	
	
	
		
 
                .filter(UserGroup.users_group_active == True) \

			




	
	
	
		
 
                .join((UserGroupMember, UserGroupRepoToPerm.users_group_id ==

			




	
	
	
		
 
                       UserGroupMember.users_group_id)) \

			




	
	
	
		
 
                .filter(UserGroupMember.user_id == self.user_id) \

			




	
	
	
		
 
                .options(joinedload(UserGroupRepoToPerm.repository)) \

			




	
	
	
		
 
                .options(joinedload(UserGroupRepoToPerm.permission)) \

			




	
	
	
		
 
                .all()

			




	
	
	
		
 
            for perm in user_repo_perms_from_users_groups:

			




	
	
	
		
 
                bump_permission(repository_permissions,

			




	
	
	
		
 
                    perm.repository.repo_name,

			




	
	
	
		
 
                    perm.permission.permission_name)

			




	
	
	
		
 

			




	
	
	
		
 
            # user permissions for repositories

			




	
	
	
		
 
            user_repo_perms = Permission.get_default_perms(self.user_id)

			




	
	
	
		
 
            for perm in user_repo_perms:

			




	
	
	
		
 
                bump_permission(repository_permissions,

			




	
	
	
		
 
                    perm.repository.repo_name,

			




	
	
	
		
 
                    perm.permission.permission_name)

			




	
	
	
		
 

			




	
	
	
		
 
        return repository_permissions

			




	
	
	
		
 

			




	
	
	
		
 
    @LazyProperty

			




	
	
	
		
 
    def permissions(self):

			




	
	
	
		
 
        """dict with all 4 kind of permissions - mainly for backwards compatibility"""

			




	
	
	
		
 
        return {

			




	
	
	
		
 
            'global': self.global_permissions,

			




	
	
	
		
 
            'repositories': self.repository_permissions,

			




	
	
	
		
 
            'repositories_groups': self.repository_group_permissions,

			




        

    



    


    



    



      

      





    
    0 comments (0 inline, 0 general)
    





    


  

  







  


    




    








    
        Server instance: clio-29004
    
    
        This site is powered by
            Kallithea 0.7.0,
        which is
        © 2010–2025 by various authors & licensed under GPLv3.
            – Support