Mercurial > kallithea

annotate rhodecode/lib/auth.py @ 3125:9b92cf5a0cca beta

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Added UserIpMap interface for allowed IP addresses and IP restriction access ref #264 IP restriction for users and user groups
author Marcin Kuzminski <marcin@python-works.com>
date Sun, 30 Dec 2012 23:06:03 +0100
parents aa17c7a1b8a5
children 6c705abed11a
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
895
62c04c5cc971 Added some more details into user edit permissions view
Marcin Kuzminski <marcin@python-works.com>
parents: 779
diff changeset
1 # -*- coding: utf-8 -*-
62c04c5cc971 Added some more details into user edit permissions view
Marcin Kuzminski <marcin@python-works.com>
parents: 779
diff changeset
2 """
62c04c5cc971 Added some more details into user edit permissions view
Marcin Kuzminski <marcin@python-works.com>
parents: 779
diff changeset
3 rhodecode.lib.auth
62c04c5cc971 Added some more details into user edit permissions view
Marcin Kuzminski <marcin@python-works.com>
parents: 779
diff changeset
4 ~~~~~~~~~~~~~~~~~~
1203
6832ef664673 source code cleanup: remove trailing white space, normalize file endings
Marcin Kuzminski <marcin@python-works.com>
parents: 1195
diff changeset
5
895
62c04c5cc971 Added some more details into user edit permissions view
Marcin Kuzminski <marcin@python-works.com>
parents: 779
diff changeset
6 authentication and permission libraries
1203
6832ef664673 source code cleanup: remove trailing white space, normalize file endings
Marcin Kuzminski <marcin@python-works.com>
parents: 1195
diff changeset
7
895
62c04c5cc971 Added some more details into user edit permissions view
Marcin Kuzminski <marcin@python-works.com>
parents: 779
diff changeset
8 :created_on: Apr 4, 2010
1824
89efedac4e6c 2012 copyrights
Marcin Kuzminski <marcin@python-works.com>
parents: 1818
diff changeset
9 :author: marcink
89efedac4e6c 2012 copyrights
Marcin Kuzminski <marcin@python-works.com>
parents: 1818
diff changeset
10 :copyright: (C) 2010-2012 Marcin Kuzminski <marcin@python-works.com>
1532
2afe9320d5e6 updated docstrings
Marcin Kuzminski <marcin@python-works.com>
parents: 1530
diff changeset
11 :license: GPLv3, see COPYING for more details.
895
62c04c5cc971 Added some more details into user edit permissions view
Marcin Kuzminski <marcin@python-works.com>
parents: 779
diff changeset
12 """
1206
a671db5bdd58 fixed license issue #149
Marcin Kuzminski <marcin@python-works.com>
parents: 1203
diff changeset
13 # This program is free software: you can redistribute it and/or modify
a671db5bdd58 fixed license issue #149
Marcin Kuzminski <marcin@python-works.com>
parents: 1203
diff changeset
14 # it under the terms of the GNU General Public License as published by
a671db5bdd58 fixed license issue #149
Marcin Kuzminski <marcin@python-works.com>
parents: 1203
diff changeset
15 # the Free Software Foundation, either version 3 of the License, or
a671db5bdd58 fixed license issue #149
Marcin Kuzminski <marcin@python-works.com>
parents: 1203
diff changeset
16 # (at your option) any later version.
1203
6832ef664673 source code cleanup: remove trailing white space, normalize file endings
Marcin Kuzminski <marcin@python-works.com>
parents: 1195
diff changeset
17 #
252
3782a6d698af licensing updates, code cleanups
Marcin Kuzminski <marcin@python-works.com>
parents: 239
diff changeset
18 # This program is distributed in the hope that it will be useful,
3782a6d698af licensing updates, code cleanups
Marcin Kuzminski <marcin@python-works.com>
parents: 239
diff changeset
19 # but WITHOUT ANY WARRANTY; without even the implied warranty of
3782a6d698af licensing updates, code cleanups
Marcin Kuzminski <marcin@python-works.com>
parents: 239
diff changeset
20 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
3782a6d698af licensing updates, code cleanups
Marcin Kuzminski <marcin@python-works.com>
parents: 239
diff changeset
21 # GNU General Public License for more details.
1203
6832ef664673 source code cleanup: remove trailing white space, normalize file endings
Marcin Kuzminski <marcin@python-works.com>
parents: 1195
diff changeset
22 #
252
3782a6d698af licensing updates, code cleanups
Marcin Kuzminski <marcin@python-works.com>
parents: 239
diff changeset
23 # You should have received a copy of the GNU General Public License
1206
a671db5bdd58 fixed license issue #149
Marcin Kuzminski <marcin@python-works.com>
parents: 1203
diff changeset
24 # along with this program. If not, see <http://www.gnu.org/licenses/>.
381
55377fdc1fc6 cleared global application settings.
Marcin Kuzminski <marcin@python-works.com>
parents: 380
diff changeset
25
895
62c04c5cc971 Added some more details into user edit permissions view
Marcin Kuzminski <marcin@python-works.com>
parents: 779
diff changeset
26 import random
62c04c5cc971 Added some more details into user edit permissions view
Marcin Kuzminski <marcin@python-works.com>
parents: 779
diff changeset
27 import logging
62c04c5cc971 Added some more details into user edit permissions view
Marcin Kuzminski <marcin@python-works.com>
parents: 779
diff changeset
28 import traceback
1116
716911af91e1 Added api_key into user, api key get's generated again after password change
Marcin Kuzminski <marcin@python-works.com>
parents: 1056
diff changeset
29 import hashlib
1118
b0e2c949c34b Fixed Windows installation based on work of Mantis406 fork: "Replace py-bcrypt to make Windows installation easier"
Marcin Kuzminski <marcin@python-works.com>
parents: 1117
diff changeset
30
1116
716911af91e1 Added api_key into user, api key get's generated again after password change
Marcin Kuzminski <marcin@python-works.com>
parents: 1056
diff changeset
31 from tempfile import _RandomNameSequence
895
62c04c5cc971 Added some more details into user edit permissions view
Marcin Kuzminski <marcin@python-works.com>
parents: 779
diff changeset
32 from decorator import decorator
62c04c5cc971 Added some more details into user edit permissions view
Marcin Kuzminski <marcin@python-works.com>
parents: 779
diff changeset
33
1982
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
34 from pylons import config, url, request
52
25e516447a33 implemented autentication
marcink
parents: 48
diff changeset
35 from pylons.controllers.util import abort, redirect
1056
520d27f40b51 #113 removed anonymous access from forking, added system messages in login box.
Marcin Kuzminski <marcin@python-works.com>
parents: 1040
diff changeset
36 from pylons.i18n.translation import _
895
62c04c5cc971 Added some more details into user edit permissions view
Marcin Kuzminski <marcin@python-works.com>
parents: 779
diff changeset
37
2634
4b17216f2110 Deprecated validation of operating system, we just care if it's windows, let approve all other
Marcin Kuzminski <marcin@python-works.com>
parents: 2479
diff changeset
38 from rhodecode import __platform__, is_windows, is_unix
1749
8ecc6b8229a5 commit less models
Marcin Kuzminski <marcin@python-works.com>
parents: 1728
diff changeset
39 from rhodecode.model.meta import Session
1118
b0e2c949c34b Fixed Windows installation based on work of Mantis406 fork: "Replace py-bcrypt to make Windows installation easier"
Marcin Kuzminski <marcin@python-works.com>
parents: 1117
diff changeset
40
2109
8ecfed1d8f8b utils/conf
Marcin Kuzminski <marcin@python-works.com>
parents: 2105
diff changeset
41 from rhodecode.lib.utils2 import str2bool, safe_unicode
895
62c04c5cc971 Added some more details into user edit permissions view
Marcin Kuzminski <marcin@python-works.com>
parents: 779
diff changeset
42 from rhodecode.lib.exceptions import LdapPasswordError, LdapUsernameError
1982
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
43 from rhodecode.lib.utils import get_repo_slug, get_repos_group_slug
713
1bb0fcdec895 fixed #72 show warning on removal when user still is owner of existing repositories
Marcin Kuzminski <marcin@python-works.com>
parents: 705
diff changeset
44 from rhodecode.lib.auth_ldap import AuthLdap
895
62c04c5cc971 Added some more details into user edit permissions view
Marcin Kuzminski <marcin@python-works.com>
parents: 779
diff changeset
45
547
1e757ac98988 renamed project to rhodecode
Marcin Kuzminski <marcin@python-works.com>
parents: 508
diff changeset
46 from rhodecode.model import meta
673
dd532af216d9 #49 Enabled anonymous access for web interface controllable from permissions pannel
Marcin Kuzminski <marcin@python-works.com>
parents: 629
diff changeset
47 from rhodecode.model.user import UserModel
3125
9b92cf5a0cca Added UserIpMap interface for allowed IP addresses and IP restriction access
Marcin Kuzminski <marcin@python-works.com>
parents: 2726
diff changeset
48 from rhodecode.model.db import Permission, RhodeCodeSetting, User, UserIpMap
895
62c04c5cc971 Added some more details into user edit permissions view
Marcin Kuzminski <marcin@python-works.com>
parents: 779
diff changeset
49
1246
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
50 log = logging.getLogger(__name__)
343
6484963056cd implemented cache for repeated queries in simplehg mercurial requests
Marcin Kuzminski <marcin@python-works.com>
parents: 339
diff changeset
51
41
71ffa932799d Added app basic auth.
Marcin Kuzminski <marcin@python-blog.com>
parents:
diff changeset
52
474
a3d9d24acbec Implemented password reset(forms/models/ tasks) and mailing tasks.
Marcin Kuzminski <marcin@python-works.com>
parents: 442
diff changeset
53 class PasswordGenerator(object):
1716
7d1fc253549e notification to commit author + gardening
Marcin Kuzminski <marcin@python-works.com>
parents: 1644
diff changeset
54 """
1818
cf51bbfb120e auto white-space removal
Marcin Kuzminski <marcin@python-works.com>
parents: 1808
diff changeset
55 This is a simple class for generating password from different sets of
1716
7d1fc253549e notification to commit author + gardening
Marcin Kuzminski <marcin@python-works.com>
parents: 1644
diff changeset
56 characters
7d1fc253549e notification to commit author + gardening
Marcin Kuzminski <marcin@python-works.com>
parents: 1644
diff changeset
57 usage::
7d1fc253549e notification to commit author + gardening
Marcin Kuzminski <marcin@python-works.com>
parents: 1644
diff changeset
58
474
a3d9d24acbec Implemented password reset(forms/models/ tasks) and mailing tasks.
Marcin Kuzminski <marcin@python-works.com>
parents: 442
diff changeset
59 passwd_gen = PasswordGenerator()
1246
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
60 #print 8-letter password containing only big and small letters
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
61 of alphabet
2278
24095abde696 print statement cleanup
Marcin Kuzminski <marcin@python-works.com>
parents: 2125
diff changeset
62 passwd_gen.gen_password(8, passwd_gen.ALPHABETS_BIG_SMALL)
474
a3d9d24acbec Implemented password reset(forms/models/ tasks) and mailing tasks.
Marcin Kuzminski <marcin@python-works.com>
parents: 442
diff changeset
63 """
1246
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
64 ALPHABETS_NUM = r'''1234567890'''
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
65 ALPHABETS_SMALL = r'''qwertyuiopasdfghjklzxcvbnm'''
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
66 ALPHABETS_BIG = r'''QWERTYUIOPASDFGHJKLZXCVBNM'''
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
67 ALPHABETS_SPECIAL = r'''`-=[]\;',./~!@#$%^&*()_+{}|:"<>?'''
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
68 ALPHABETS_FULL = ALPHABETS_BIG + ALPHABETS_SMALL \
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
69 + ALPHABETS_NUM + ALPHABETS_SPECIAL
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
70 ALPHABETS_ALPHANUM = ALPHABETS_BIG + ALPHABETS_SMALL + ALPHABETS_NUM
474
a3d9d24acbec Implemented password reset(forms/models/ tasks) and mailing tasks.
Marcin Kuzminski <marcin@python-works.com>
parents: 442
diff changeset
71 ALPHABETS_BIG_SMALL = ALPHABETS_BIG + ALPHABETS_SMALL
1246
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
72 ALPHABETS_ALPHANUM_BIG = ALPHABETS_BIG + ALPHABETS_NUM
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
73 ALPHABETS_ALPHANUM_SMALL = ALPHABETS_SMALL + ALPHABETS_NUM
673
dd532af216d9 #49 Enabled anonymous access for web interface controllable from permissions pannel
Marcin Kuzminski <marcin@python-works.com>
parents: 629
diff changeset
74
474
a3d9d24acbec Implemented password reset(forms/models/ tasks) and mailing tasks.
Marcin Kuzminski <marcin@python-works.com>
parents: 442
diff changeset
75 def __init__(self, passwd=''):
a3d9d24acbec Implemented password reset(forms/models/ tasks) and mailing tasks.
Marcin Kuzminski <marcin@python-works.com>
parents: 442
diff changeset
76 self.passwd = passwd
a3d9d24acbec Implemented password reset(forms/models/ tasks) and mailing tasks.
Marcin Kuzminski <marcin@python-works.com>
parents: 442
diff changeset
77
1993
4d3179d2adfe added optional password type in password generator
Marcin Kuzminski <marcin@python-works.com>
parents: 1992
diff changeset
78 def gen_password(self, length, type_=None):
4d3179d2adfe added optional password type in password generator
Marcin Kuzminski <marcin@python-works.com>
parents: 1992
diff changeset
79 if type_ is None:
4d3179d2adfe added optional password type in password generator
Marcin Kuzminski <marcin@python-works.com>
parents: 1992
diff changeset
80 type_ = self.ALPHABETS_FULL
1982
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
81 self.passwd = ''.join([random.choice(type_) for _ in xrange(length)])
474
a3d9d24acbec Implemented password reset(forms/models/ tasks) and mailing tasks.
Marcin Kuzminski <marcin@python-works.com>
parents: 442
diff changeset
82 return self.passwd
a3d9d24acbec Implemented password reset(forms/models/ tasks) and mailing tasks.
Marcin Kuzminski <marcin@python-works.com>
parents: 442
diff changeset
83
1246
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
84
1118
b0e2c949c34b Fixed Windows installation based on work of Mantis406 fork: "Replace py-bcrypt to make Windows installation easier"
Marcin Kuzminski <marcin@python-works.com>
parents: 1117
diff changeset
85 class RhodeCodeCrypto(object):
b0e2c949c34b Fixed Windows installation based on work of Mantis406 fork: "Replace py-bcrypt to make Windows installation easier"
Marcin Kuzminski <marcin@python-works.com>
parents: 1117
diff changeset
86
b0e2c949c34b Fixed Windows installation based on work of Mantis406 fork: "Replace py-bcrypt to make Windows installation easier"
Marcin Kuzminski <marcin@python-works.com>
parents: 1117
diff changeset
87 @classmethod
b0e2c949c34b Fixed Windows installation based on work of Mantis406 fork: "Replace py-bcrypt to make Windows installation easier"
Marcin Kuzminski <marcin@python-works.com>
parents: 1117
diff changeset
88 def hash_string(cls, str_):
b0e2c949c34b Fixed Windows installation based on work of Mantis406 fork: "Replace py-bcrypt to make Windows installation easier"
Marcin Kuzminski <marcin@python-works.com>
parents: 1117
diff changeset
89 """
b0e2c949c34b Fixed Windows installation based on work of Mantis406 fork: "Replace py-bcrypt to make Windows installation easier"
Marcin Kuzminski <marcin@python-works.com>
parents: 1117
diff changeset
90 Cryptographic function used for password hashing based on pybcrypt
b0e2c949c34b Fixed Windows installation based on work of Mantis406 fork: "Replace py-bcrypt to make Windows installation easier"
Marcin Kuzminski <marcin@python-works.com>
parents: 1117
diff changeset
91 or pycrypto in windows
1203
6832ef664673 source code cleanup: remove trailing white space, normalize file endings
Marcin Kuzminski <marcin@python-works.com>
parents: 1195
diff changeset
92
1118
b0e2c949c34b Fixed Windows installation based on work of Mantis406 fork: "Replace py-bcrypt to make Windows installation easier"
Marcin Kuzminski <marcin@python-works.com>
parents: 1117
diff changeset
93 :param password: password to hash
b0e2c949c34b Fixed Windows installation based on work of Mantis406 fork: "Replace py-bcrypt to make Windows installation easier"
Marcin Kuzminski <marcin@python-works.com>
parents: 1117
diff changeset
94 """
2634
4b17216f2110 Deprecated validation of operating system, we just care if it's windows, let approve all other
Marcin Kuzminski <marcin@python-works.com>
parents: 2479
diff changeset
95 if is_windows:
2479
9225597688f4 Added validation into user email map
Marcin Kuzminski <marcin@python-works.com>
parents: 2458
diff changeset
96 from hashlib import sha256
1118
b0e2c949c34b Fixed Windows installation based on work of Mantis406 fork: "Replace py-bcrypt to make Windows installation easier"
Marcin Kuzminski <marcin@python-works.com>
parents: 1117
diff changeset
97 return sha256(str_).hexdigest()
2634
4b17216f2110 Deprecated validation of operating system, we just care if it's windows, let approve all other
Marcin Kuzminski <marcin@python-works.com>
parents: 2479
diff changeset
98 elif is_unix:
2479
9225597688f4 Added validation into user email map
Marcin Kuzminski <marcin@python-works.com>
parents: 2458
diff changeset
99 import bcrypt
1118
b0e2c949c34b Fixed Windows installation based on work of Mantis406 fork: "Replace py-bcrypt to make Windows installation easier"
Marcin Kuzminski <marcin@python-works.com>
parents: 1117
diff changeset
100 return bcrypt.hashpw(str_, bcrypt.gensalt(10))
b0e2c949c34b Fixed Windows installation based on work of Mantis406 fork: "Replace py-bcrypt to make Windows installation easier"
Marcin Kuzminski <marcin@python-works.com>
parents: 1117
diff changeset
101 else:
1246
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
102 raise Exception('Unknown or unsupported platform %s' \
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
103 % __platform__)
1118
b0e2c949c34b Fixed Windows installation based on work of Mantis406 fork: "Replace py-bcrypt to make Windows installation easier"
Marcin Kuzminski <marcin@python-works.com>
parents: 1117
diff changeset
104
b0e2c949c34b Fixed Windows installation based on work of Mantis406 fork: "Replace py-bcrypt to make Windows installation easier"
Marcin Kuzminski <marcin@python-works.com>
parents: 1117
diff changeset
105 @classmethod
b0e2c949c34b Fixed Windows installation based on work of Mantis406 fork: "Replace py-bcrypt to make Windows installation easier"
Marcin Kuzminski <marcin@python-works.com>
parents: 1117
diff changeset
106 def hash_check(cls, password, hashed):
b0e2c949c34b Fixed Windows installation based on work of Mantis406 fork: "Replace py-bcrypt to make Windows installation easier"
Marcin Kuzminski <marcin@python-works.com>
parents: 1117
diff changeset
107 """
b0e2c949c34b Fixed Windows installation based on work of Mantis406 fork: "Replace py-bcrypt to make Windows installation easier"
Marcin Kuzminski <marcin@python-works.com>
parents: 1117
diff changeset
108 Checks matching password with it's hashed value, runs different
b0e2c949c34b Fixed Windows installation based on work of Mantis406 fork: "Replace py-bcrypt to make Windows installation easier"
Marcin Kuzminski <marcin@python-works.com>
parents: 1117
diff changeset
109 implementation based on platform it runs on
1203
6832ef664673 source code cleanup: remove trailing white space, normalize file endings
Marcin Kuzminski <marcin@python-works.com>
parents: 1195
diff changeset
110
1118
b0e2c949c34b Fixed Windows installation based on work of Mantis406 fork: "Replace py-bcrypt to make Windows installation easier"
Marcin Kuzminski <marcin@python-works.com>
parents: 1117
diff changeset
111 :param password: password
b0e2c949c34b Fixed Windows installation based on work of Mantis406 fork: "Replace py-bcrypt to make Windows installation easier"
Marcin Kuzminski <marcin@python-works.com>
parents: 1117
diff changeset
112 :param hashed: password in hashed form
b0e2c949c34b Fixed Windows installation based on work of Mantis406 fork: "Replace py-bcrypt to make Windows installation easier"
Marcin Kuzminski <marcin@python-works.com>
parents: 1117
diff changeset
113 """
b0e2c949c34b Fixed Windows installation based on work of Mantis406 fork: "Replace py-bcrypt to make Windows installation easier"
Marcin Kuzminski <marcin@python-works.com>
parents: 1117
diff changeset
114
2634
4b17216f2110 Deprecated validation of operating system, we just care if it's windows, let approve all other
Marcin Kuzminski <marcin@python-works.com>
parents: 2479
diff changeset
115 if is_windows:
2479
9225597688f4 Added validation into user email map
Marcin Kuzminski <marcin@python-works.com>
parents: 2458
diff changeset
116 from hashlib import sha256
1118
b0e2c949c34b Fixed Windows installation based on work of Mantis406 fork: "Replace py-bcrypt to make Windows installation easier"
Marcin Kuzminski <marcin@python-works.com>
parents: 1117
diff changeset
117 return sha256(password).hexdigest() == hashed
2634
4b17216f2110 Deprecated validation of operating system, we just care if it's windows, let approve all other
Marcin Kuzminski <marcin@python-works.com>
parents: 2479
diff changeset
118 elif is_unix:
2479
9225597688f4 Added validation into user email map
Marcin Kuzminski <marcin@python-works.com>
parents: 2458
diff changeset
119 import bcrypt
1118
b0e2c949c34b Fixed Windows installation based on work of Mantis406 fork: "Replace py-bcrypt to make Windows installation easier"
Marcin Kuzminski <marcin@python-works.com>
parents: 1117
diff changeset
120 return bcrypt.hashpw(password, hashed) == hashed
b0e2c949c34b Fixed Windows installation based on work of Mantis406 fork: "Replace py-bcrypt to make Windows installation easier"
Marcin Kuzminski <marcin@python-works.com>
parents: 1117
diff changeset
121 else:
1246
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
122 raise Exception('Unknown or unsupported platform %s' \
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
123 % __platform__)
1118
b0e2c949c34b Fixed Windows installation based on work of Mantis406 fork: "Replace py-bcrypt to make Windows installation easier"
Marcin Kuzminski <marcin@python-works.com>
parents: 1117
diff changeset
124
673
dd532af216d9 #49 Enabled anonymous access for web interface controllable from permissions pannel
Marcin Kuzminski <marcin@python-works.com>
parents: 629
diff changeset
125
64
08707974eae4 Changed auth lib for sqlalchemy
Marcin Kuzminski <marcin@python-blog.com>
parents: 52
diff changeset
126 def get_crypt_password(password):
1118
b0e2c949c34b Fixed Windows installation based on work of Mantis406 fork: "Replace py-bcrypt to make Windows installation easier"
Marcin Kuzminski <marcin@python-works.com>
parents: 1117
diff changeset
127 return RhodeCodeCrypto.hash_string(password)
b0e2c949c34b Fixed Windows installation based on work of Mantis406 fork: "Replace py-bcrypt to make Windows installation easier"
Marcin Kuzminski <marcin@python-works.com>
parents: 1117
diff changeset
128
1246
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
129
1118
b0e2c949c34b Fixed Windows installation based on work of Mantis406 fork: "Replace py-bcrypt to make Windows installation easier"
Marcin Kuzminski <marcin@python-works.com>
parents: 1117
diff changeset
130 def check_password(password, hashed):
b0e2c949c34b Fixed Windows installation based on work of Mantis406 fork: "Replace py-bcrypt to make Windows installation easier"
Marcin Kuzminski <marcin@python-works.com>
parents: 1117
diff changeset
131 return RhodeCodeCrypto.hash_check(password, hashed)
415
04e8b31fb245 Changed password crypting scheme to bcrypt, added dependency for setup
Marcin Kuzminski <marcin@python-works.com>
parents: 412
diff changeset
132
1950
4ae17f819ee8 #344 optional firstname lastname on user creation
Marcin Kuzminski <marcin@python-works.com>
parents: 1824
diff changeset
133
1628
de71a4bde097 Some code cleanups and fixes
Marcin Kuzminski <marcin@python-works.com>
parents: 1621
diff changeset
134 def generate_api_key(str_, salt=None):
de71a4bde097 Some code cleanups and fixes
Marcin Kuzminski <marcin@python-works.com>
parents: 1621
diff changeset
135 """
de71a4bde097 Some code cleanups and fixes
Marcin Kuzminski <marcin@python-works.com>
parents: 1621
diff changeset
136 Generates API KEY from given string
1818
cf51bbfb120e auto white-space removal
Marcin Kuzminski <marcin@python-works.com>
parents: 1808
diff changeset
137
1628
de71a4bde097 Some code cleanups and fixes
Marcin Kuzminski <marcin@python-works.com>
parents: 1621
diff changeset
138 :param str_:
de71a4bde097 Some code cleanups and fixes
Marcin Kuzminski <marcin@python-works.com>
parents: 1621
diff changeset
139 :param salt:
de71a4bde097 Some code cleanups and fixes
Marcin Kuzminski <marcin@python-works.com>
parents: 1621
diff changeset
140 """
1718
f78bee8eec78 reduce cookie size for better support of client side sessions
Marcin Kuzminski <marcin@python-works.com>
parents: 1716
diff changeset
141
1116
716911af91e1 Added api_key into user, api key get's generated again after password change
Marcin Kuzminski <marcin@python-works.com>
parents: 1056
diff changeset
142 if salt is None:
716911af91e1 Added api_key into user, api key get's generated again after password change
Marcin Kuzminski <marcin@python-works.com>
parents: 1056
diff changeset
143 salt = _RandomNameSequence().next()
716911af91e1 Added api_key into user, api key get's generated again after password change
Marcin Kuzminski <marcin@python-works.com>
parents: 1056
diff changeset
144
1628
de71a4bde097 Some code cleanups and fixes
Marcin Kuzminski <marcin@python-works.com>
parents: 1621
diff changeset
145 return hashlib.sha1(str_ + salt).hexdigest()
1116
716911af91e1 Added api_key into user, api key get's generated again after password change
Marcin Kuzminski <marcin@python-works.com>
parents: 1056
diff changeset
146
1246
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
147
41
71ffa932799d Added app basic auth.
Marcin Kuzminski <marcin@python-blog.com>
parents:
diff changeset
148 def authfunc(environ, username, password):
1628
de71a4bde097 Some code cleanups and fixes
Marcin Kuzminski <marcin@python-works.com>
parents: 1621
diff changeset
149 """
1818
cf51bbfb120e auto white-space removal
Marcin Kuzminski <marcin@python-works.com>
parents: 1808
diff changeset
150 Dummy authentication wrapper function used in Mercurial and Git for
1644
59c26a9aba63 typo fixes
Marcin Kuzminski <marcin@python-works.com>
parents: 1633
diff changeset
151 access control.
1203
6832ef664673 source code cleanup: remove trailing white space, normalize file endings
Marcin Kuzminski <marcin@python-works.com>
parents: 1195
diff changeset
152
761
56c2850a5b5f ldap auth rewrite, moved split authfunc into two functions,
Marcin Kuzminski <marcin@python-works.com>
parents: 749
diff changeset
153 :param environ: needed only for using in Basic auth
56c2850a5b5f ldap auth rewrite, moved split authfunc into two functions,
Marcin Kuzminski <marcin@python-works.com>
parents: 749
diff changeset
154 """
56c2850a5b5f ldap auth rewrite, moved split authfunc into two functions,
Marcin Kuzminski <marcin@python-works.com>
parents: 749
diff changeset
155 return authenticate(username, password)
56c2850a5b5f ldap auth rewrite, moved split authfunc into two functions,
Marcin Kuzminski <marcin@python-works.com>
parents: 749
diff changeset
156
56c2850a5b5f ldap auth rewrite, moved split authfunc into two functions,
Marcin Kuzminski <marcin@python-works.com>
parents: 749
diff changeset
157
56c2850a5b5f ldap auth rewrite, moved split authfunc into two functions,
Marcin Kuzminski <marcin@python-works.com>
parents: 749
diff changeset
158 def authenticate(username, password):
1628
de71a4bde097 Some code cleanups and fixes
Marcin Kuzminski <marcin@python-works.com>
parents: 1621
diff changeset
159 """
de71a4bde097 Some code cleanups and fixes
Marcin Kuzminski <marcin@python-works.com>
parents: 1621
diff changeset
160 Authentication function used for access control,
699
52da7cba88a6 Code refactor for auth func, preparing for ldap support
Marcin Kuzminski <marcin@python-works.com>
parents: 692
diff changeset
161 firstly checks for db authentication then if ldap is enabled for ldap
705
9e9f1b919c0c implements #60, ldap configuration and authentication.
Marcin Kuzminski <marcin@python-works.com>
parents: 699
diff changeset
162 authentication, also creates ldap user if not in database
1203
6832ef664673 source code cleanup: remove trailing white space, normalize file endings
Marcin Kuzminski <marcin@python-works.com>
parents: 1195
diff changeset
163
699
52da7cba88a6 Code refactor for auth func, preparing for ldap support
Marcin Kuzminski <marcin@python-works.com>
parents: 692
diff changeset
164 :param username: username
52da7cba88a6 Code refactor for auth func, preparing for ldap support
Marcin Kuzminski <marcin@python-works.com>
parents: 692
diff changeset
165 :param password: password
52da7cba88a6 Code refactor for auth func, preparing for ldap support
Marcin Kuzminski <marcin@python-works.com>
parents: 692
diff changeset
166 """
1292
c0335c1dee36 added some fixes to LDAP form re-submition, new simples ldap-settings getter.
Marcin Kuzminski <marcin@python-works.com>
parents: 1290
diff changeset
167
705
9e9f1b919c0c implements #60, ldap configuration and authentication.
Marcin Kuzminski <marcin@python-works.com>
parents: 699
diff changeset
168 user_model = UserModel()
1530
04027bdb876c Refactoring of model get functions
Marcin Kuzminski <marcin@python-works.com>
parents: 1425
diff changeset
169 user = User.get_by_username(username)
699
52da7cba88a6 Code refactor for auth func, preparing for ldap support
Marcin Kuzminski <marcin@python-works.com>
parents: 692
diff changeset
170
761
56c2850a5b5f ldap auth rewrite, moved split authfunc into two functions,
Marcin Kuzminski <marcin@python-works.com>
parents: 749
diff changeset
171 log.debug('Authenticating user using RhodeCode account')
991
b232a36cc51f Improve LDAP authentication
Thayne Harbaugh <thayne@fusionio.com>
parents: 895
diff changeset
172 if user is not None and not user.ldap_dn:
64
08707974eae4 Changed auth lib for sqlalchemy
Marcin Kuzminski <marcin@python-blog.com>
parents: 52
diff changeset
173 if user.active:
674
99875a8f2ad1 #49 Enabled anonymous access push and pull commands
Marcin Kuzminski <marcin@python-works.com>
parents: 673
diff changeset
174 if user.username == 'default' and user.active:
2025
7e979933ffec more work on improving info logging
Marcin Kuzminski <marcin@python-works.com>
parents: 2000
diff changeset
175 log.info('user %s authenticated correctly as anonymous user' %
761
56c2850a5b5f ldap auth rewrite, moved split authfunc into two functions,
Marcin Kuzminski <marcin@python-works.com>
parents: 749
diff changeset
176 username)
674
99875a8f2ad1 #49 Enabled anonymous access push and pull commands
Marcin Kuzminski <marcin@python-works.com>
parents: 673
diff changeset
177 return True
99875a8f2ad1 #49 Enabled anonymous access push and pull commands
Marcin Kuzminski <marcin@python-works.com>
parents: 673
diff changeset
178
1246
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
179 elif user.username == username and check_password(password,
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
180 user.password):
1976
Marcin Kuzminski <marcin@python-works.com>
parents: 1950
diff changeset
181 log.info('user %s authenticated correctly' % username)
41
71ffa932799d Added app basic auth.
Marcin Kuzminski <marcin@python-blog.com>
parents:
diff changeset
182 return True
71ffa932799d Added app basic auth.
Marcin Kuzminski <marcin@python-blog.com>
parents:
diff changeset
183 else:
2025
7e979933ffec more work on improving info logging
Marcin Kuzminski <marcin@python-works.com>
parents: 2000
diff changeset
184 log.warning('user %s tried auth but is disabled' % username)
705
9e9f1b919c0c implements #60, ldap configuration and authentication.
Marcin Kuzminski <marcin@python-works.com>
parents: 699
diff changeset
185
9e9f1b919c0c implements #60, ldap configuration and authentication.
Marcin Kuzminski <marcin@python-works.com>
parents: 699
diff changeset
186 else:
761
56c2850a5b5f ldap auth rewrite, moved split authfunc into two functions,
Marcin Kuzminski <marcin@python-works.com>
parents: 749
diff changeset
187 log.debug('Regular authentication failed')
1530
04027bdb876c Refactoring of model get functions
Marcin Kuzminski <marcin@python-works.com>
parents: 1425
diff changeset
188 user_obj = User.get_by_username(username, case_insensitive=True)
761
56c2850a5b5f ldap auth rewrite, moved split authfunc into two functions,
Marcin Kuzminski <marcin@python-works.com>
parents: 749
diff changeset
189
991
b232a36cc51f Improve LDAP authentication
Thayne Harbaugh <thayne@fusionio.com>
parents: 895
diff changeset
190 if user_obj is not None and not user_obj.ldap_dn:
749
fcd4fb51526e added debug message for ldap auth
Marcin Kuzminski <marcin@python-works.com>
parents: 748
diff changeset
191 log.debug('this user already exists as non ldap')
748
88338675a0f7 fixed ldap issue and small template fix
Marcin Kuzminski <marcin@python-works.com>
parents: 742
diff changeset
192 return False
88338675a0f7 fixed ldap issue and small template fix
Marcin Kuzminski <marcin@python-works.com>
parents: 742
diff changeset
193
1633
2c0d35e336b5 refactoring of models names for repoGroup permissions
Marcin Kuzminski <marcin@python-works.com>
parents: 1630
diff changeset
194 ldap_settings = RhodeCodeSetting.get_ldap_settings()
705
9e9f1b919c0c implements #60, ldap configuration and authentication.
Marcin Kuzminski <marcin@python-works.com>
parents: 699
diff changeset
195 #======================================================================
1203
6832ef664673 source code cleanup: remove trailing white space, normalize file endings
Marcin Kuzminski <marcin@python-works.com>
parents: 1195
diff changeset
196 # FALLBACK TO LDAP AUTH IF ENABLE
705
9e9f1b919c0c implements #60, ldap configuration and authentication.
Marcin Kuzminski <marcin@python-works.com>
parents: 699
diff changeset
197 #======================================================================
1135
1aa1655bf019 fixed some config bool converter problems with ldap
Marcin Kuzminski <marcin@python-works.com>
parents: 1122
diff changeset
198 if str2bool(ldap_settings.get('ldap_active')):
761
56c2850a5b5f ldap auth rewrite, moved split authfunc into two functions,
Marcin Kuzminski <marcin@python-works.com>
parents: 749
diff changeset
199 log.debug("Authenticating user using ldap")
705
9e9f1b919c0c implements #60, ldap configuration and authentication.
Marcin Kuzminski <marcin@python-works.com>
parents: 699
diff changeset
200 kwargs = {
1246
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
201 'server': ldap_settings.get('ldap_host', ''),
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
202 'base_dn': ldap_settings.get('ldap_base_dn', ''),
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
203 'port': ldap_settings.get('ldap_port'),
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
204 'bind_dn': ldap_settings.get('ldap_dn_user'),
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
205 'bind_pass': ldap_settings.get('ldap_dn_pass'),
1290
74685a31cc43 Enable start_tls connection encryption.
"Lorenzo M. Catucci" <lorenzo@sancho.ccd.uniroma2.it>
parents: 1288
diff changeset
206 'tls_kind': ldap_settings.get('ldap_tls_kind'),
1246
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
207 'tls_reqcert': ldap_settings.get('ldap_tls_reqcert'),
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
208 'ldap_filter': ldap_settings.get('ldap_filter'),
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
209 'search_scope': ldap_settings.get('ldap_search_scope'),
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
210 'attr_login': ldap_settings.get('ldap_attr_login'),
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
211 'ldap_version': 3,
705
9e9f1b919c0c implements #60, ldap configuration and authentication.
Marcin Kuzminski <marcin@python-works.com>
parents: 699
diff changeset
212 }
9e9f1b919c0c implements #60, ldap configuration and authentication.
Marcin Kuzminski <marcin@python-works.com>
parents: 699
diff changeset
213 log.debug('Checking for ldap authentication')
9e9f1b919c0c implements #60, ldap configuration and authentication.
Marcin Kuzminski <marcin@python-works.com>
parents: 699
diff changeset
214 try:
9e9f1b919c0c implements #60, ldap configuration and authentication.
Marcin Kuzminski <marcin@python-works.com>
parents: 699
diff changeset
215 aldap = AuthLdap(**kwargs)
1246
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
216 (user_dn, ldap_attrs) = aldap.authenticate_ldap(username,
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
217 password)
1976
Marcin Kuzminski <marcin@python-works.com>
parents: 1950
diff changeset
218 log.debug('Got ldap DN response %s' % user_dn)
705
9e9f1b919c0c implements #60, ldap configuration and authentication.
Marcin Kuzminski <marcin@python-works.com>
parents: 699
diff changeset
219
1307
c1516b35f91d pep8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1305
diff changeset
220 get_ldap_attr = lambda k: ldap_attrs.get(ldap_settings\
1292
c0335c1dee36 added some fixes to LDAP form re-submition, new simples ldap-settings getter.
Marcin Kuzminski <marcin@python-works.com>
parents: 1290
diff changeset
221 .get(k), [''])[0]
c0335c1dee36 added some fixes to LDAP form re-submition, new simples ldap-settings getter.
Marcin Kuzminski <marcin@python-works.com>
parents: 1290
diff changeset
222
991
b232a36cc51f Improve LDAP authentication
Thayne Harbaugh <thayne@fusionio.com>
parents: 895
diff changeset
223 user_attrs = {
1425
3dedf3991d40 fixes #173, many thanks for slestak for contributing into this one.
Marcin Kuzminski <marcin@python-works.com>
parents: 1336
diff changeset
224 'name': safe_unicode(get_ldap_attr('ldap_attr_firstname')),
3dedf3991d40 fixes #173, many thanks for slestak for contributing into this one.
Marcin Kuzminski <marcin@python-works.com>
parents: 1336
diff changeset
225 'lastname': safe_unicode(get_ldap_attr('ldap_attr_lastname')),
3dedf3991d40 fixes #173, many thanks for slestak for contributing into this one.
Marcin Kuzminski <marcin@python-works.com>
parents: 1336
diff changeset
226 'email': get_ldap_attr('ldap_attr_email'),
3dedf3991d40 fixes #173, many thanks for slestak for contributing into this one.
Marcin Kuzminski <marcin@python-works.com>
parents: 1336
diff changeset
227 }
2000
72c525a7e7ad added migrations from 1.2.X to 1.3
Marcin Kuzminski <marcin@python-works.com>
parents: 1993
diff changeset
228
72c525a7e7ad added migrations from 1.2.X to 1.3
Marcin Kuzminski <marcin@python-works.com>
parents: 1993
diff changeset
229 # don't store LDAP password since we don't need it. Override
1992
335b55caa81d #355 replaced stored LDAP password with some random generated one
Marcin Kuzminski <marcin@python-works.com>
parents: 1982
diff changeset
230 # with some random generated password
335b55caa81d #355 replaced stored LDAP password with some random generated one
Marcin Kuzminski <marcin@python-works.com>
parents: 1982
diff changeset
231 _password = PasswordGenerator().gen_password(length=8)
335b55caa81d #355 replaced stored LDAP password with some random generated one
Marcin Kuzminski <marcin@python-works.com>
parents: 1982
diff changeset
232 # create this user on the fly if it doesn't exist in rhodecode
335b55caa81d #355 replaced stored LDAP password with some random generated one
Marcin Kuzminski <marcin@python-works.com>
parents: 1982
diff changeset
233 # database
335b55caa81d #355 replaced stored LDAP password with some random generated one
Marcin Kuzminski <marcin@python-works.com>
parents: 1982
diff changeset
234 if user_model.create_ldap(username, _password, user_dn,
1246
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
235 user_attrs):
1976
Marcin Kuzminski <marcin@python-works.com>
parents: 1950
diff changeset
236 log.info('created new ldap user %s' % username)
1818
cf51bbfb120e auto white-space removal
Marcin Kuzminski <marcin@python-works.com>
parents: 1808
diff changeset
237
2634
4b17216f2110 Deprecated validation of operating system, we just care if it's windows, let approve all other
Marcin Kuzminski <marcin@python-works.com>
parents: 2479
diff changeset
238 Session().commit()
761
56c2850a5b5f ldap auth rewrite, moved split authfunc into two functions,
Marcin Kuzminski <marcin@python-works.com>
parents: 749
diff changeset
239 return True
56c2850a5b5f ldap auth rewrite, moved split authfunc into two functions,
Marcin Kuzminski <marcin@python-works.com>
parents: 749
diff changeset
240 except (LdapUsernameError, LdapPasswordError,):
56c2850a5b5f ldap auth rewrite, moved split authfunc into two functions,
Marcin Kuzminski <marcin@python-works.com>
parents: 749
diff changeset
241 pass
56c2850a5b5f ldap auth rewrite, moved split authfunc into two functions,
Marcin Kuzminski <marcin@python-works.com>
parents: 749
diff changeset
242 except (Exception,):
705
9e9f1b919c0c implements #60, ldap configuration and authentication.
Marcin Kuzminski <marcin@python-works.com>
parents: 699
diff changeset
243 log.error(traceback.format_exc())
761
56c2850a5b5f ldap auth rewrite, moved split authfunc into two functions,
Marcin Kuzminski <marcin@python-works.com>
parents: 749
diff changeset
244 pass
41
71ffa932799d Added app basic auth.
Marcin Kuzminski <marcin@python-blog.com>
parents:
diff changeset
245 return False
71ffa932799d Added app basic auth.
Marcin Kuzminski <marcin@python-blog.com>
parents:
diff changeset
246
1950
4ae17f819ee8 #344 optional firstname lastname on user creation
Marcin Kuzminski <marcin@python-works.com>
parents: 1824
diff changeset
247
1621
cbc2b1913cdf Added basic automatic user creation for container auth
Liad Shani <liadff@gmail.com>
parents: 1618
diff changeset
248 def login_container_auth(username):
cbc2b1913cdf Added basic automatic user creation for container auth
Liad Shani <liadff@gmail.com>
parents: 1618
diff changeset
249 user = User.get_by_username(username)
cbc2b1913cdf Added basic automatic user creation for container auth
Liad Shani <liadff@gmail.com>
parents: 1618
diff changeset
250 if user is None:
cbc2b1913cdf Added basic automatic user creation for container auth
Liad Shani <liadff@gmail.com>
parents: 1618
diff changeset
251 user_attrs = {
1628
de71a4bde097 Some code cleanups and fixes
Marcin Kuzminski <marcin@python-works.com>
parents: 1621
diff changeset
252 'name': username,
de71a4bde097 Some code cleanups and fixes
Marcin Kuzminski <marcin@python-works.com>
parents: 1621
diff changeset
253 'lastname': None,
de71a4bde097 Some code cleanups and fixes
Marcin Kuzminski <marcin@python-works.com>
parents: 1621
diff changeset
254 'email': None,
de71a4bde097 Some code cleanups and fixes
Marcin Kuzminski <marcin@python-works.com>
parents: 1621
diff changeset
255 }
1749
8ecc6b8229a5 commit less models
Marcin Kuzminski <marcin@python-works.com>
parents: 1728
diff changeset
256 user = UserModel().create_for_container_auth(username, user_attrs)
1628
de71a4bde097 Some code cleanups and fixes
Marcin Kuzminski <marcin@python-works.com>
parents: 1621
diff changeset
257 if not user:
1621
cbc2b1913cdf Added basic automatic user creation for container auth
Liad Shani <liadff@gmail.com>
parents: 1618
diff changeset
258 return None
1976
Marcin Kuzminski <marcin@python-works.com>
parents: 1950
diff changeset
259 log.info('User %s was created by container authentication' % username)
1621
cbc2b1913cdf Added basic automatic user creation for container auth
Liad Shani <liadff@gmail.com>
parents: 1618
diff changeset
260
cbc2b1913cdf Added basic automatic user creation for container auth
Liad Shani <liadff@gmail.com>
parents: 1618
diff changeset
261 if not user.active:
cbc2b1913cdf Added basic automatic user creation for container auth
Liad Shani <liadff@gmail.com>
parents: 1618
diff changeset
262 return None
cbc2b1913cdf Added basic automatic user creation for container auth
Liad Shani <liadff@gmail.com>
parents: 1618
diff changeset
263
cbc2b1913cdf Added basic automatic user creation for container auth
Liad Shani <liadff@gmail.com>
parents: 1618
diff changeset
264 user.update_lastlogin()
2634
4b17216f2110 Deprecated validation of operating system, we just care if it's windows, let approve all other
Marcin Kuzminski <marcin@python-works.com>
parents: 2479
diff changeset
265 Session().commit()
1818
cf51bbfb120e auto white-space removal
Marcin Kuzminski <marcin@python-works.com>
parents: 1808
diff changeset
266
1718
f78bee8eec78 reduce cookie size for better support of client side sessions
Marcin Kuzminski <marcin@python-works.com>
parents: 1716
diff changeset
267 log.debug('User %s is now logged in by container authentication',
1628
de71a4bde097 Some code cleanups and fixes
Marcin Kuzminski <marcin@python-works.com>
parents: 1621
diff changeset
268 user.username)
1621
cbc2b1913cdf Added basic automatic user creation for container auth
Liad Shani <liadff@gmail.com>
parents: 1618
diff changeset
269 return user
cbc2b1913cdf Added basic automatic user creation for container auth
Liad Shani <liadff@gmail.com>
parents: 1618
diff changeset
270
1950
4ae17f819ee8 #344 optional firstname lastname on user creation
Marcin Kuzminski <marcin@python-works.com>
parents: 1824
diff changeset
271
1630
25d8e4836bc2 Improved container-based auth support for middleware
Liad Shani <liadff@gmail.com>
parents: 1628
diff changeset
272 def get_container_username(environ, config):
25d8e4836bc2 Improved container-based auth support for middleware
Liad Shani <liadff@gmail.com>
parents: 1628
diff changeset
273 username = None
1621
cbc2b1913cdf Added basic automatic user creation for container auth
Liad Shani <liadff@gmail.com>
parents: 1618
diff changeset
274
1630
25d8e4836bc2 Improved container-based auth support for middleware
Liad Shani <liadff@gmail.com>
parents: 1628
diff changeset
275 if str2bool(config.get('container_auth_enabled', False)):
25d8e4836bc2 Improved container-based auth support for middleware
Liad Shani <liadff@gmail.com>
parents: 1628
diff changeset
276 from paste.httpheaders import REMOTE_USER
25d8e4836bc2 Improved container-based auth support for middleware
Liad Shani <liadff@gmail.com>
parents: 1628
diff changeset
277 username = REMOTE_USER(environ)
25d8e4836bc2 Improved container-based auth support for middleware
Liad Shani <liadff@gmail.com>
parents: 1628
diff changeset
278
25d8e4836bc2 Improved container-based auth support for middleware
Liad Shani <liadff@gmail.com>
parents: 1628
diff changeset
279 if not username and str2bool(config.get('proxypass_auth_enabled', False)):
1617
cf128ced8c85 Improved container-based auth implementation and added support for a reverse-proxy setup (using the X-Forwarded-User header)
Liad Shani <liadff@gmail.com>
parents: 1614
diff changeset
280 username = environ.get('HTTP_X_FORWARDED_USER')
cf128ced8c85 Improved container-based auth implementation and added support for a reverse-proxy setup (using the X-Forwarded-User header)
Liad Shani <liadff@gmail.com>
parents: 1614
diff changeset
281
1630
25d8e4836bc2 Improved container-based auth support for middleware
Liad Shani <liadff@gmail.com>
parents: 1628
diff changeset
282 if username:
1628
de71a4bde097 Some code cleanups and fixes
Marcin Kuzminski <marcin@python-works.com>
parents: 1621
diff changeset
283 # Removing realm and domain from username
1617
cf128ced8c85 Improved container-based auth implementation and added support for a reverse-proxy setup (using the X-Forwarded-User header)
Liad Shani <liadff@gmail.com>
parents: 1614
diff changeset
284 username = username.partition('@')[0]
cf128ced8c85 Improved container-based auth implementation and added support for a reverse-proxy setup (using the X-Forwarded-User header)
Liad Shani <liadff@gmail.com>
parents: 1614
diff changeset
285 username = username.rpartition('\\')[2]
1976
Marcin Kuzminski <marcin@python-works.com>
parents: 1950
diff changeset
286 log.debug('Received username %s from container' % username)
1617
cf128ced8c85 Improved container-based auth implementation and added support for a reverse-proxy setup (using the X-Forwarded-User header)
Liad Shani <liadff@gmail.com>
parents: 1614
diff changeset
287
cf128ced8c85 Improved container-based auth implementation and added support for a reverse-proxy setup (using the X-Forwarded-User header)
Liad Shani <liadff@gmail.com>
parents: 1614
diff changeset
288 return username
1246
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
289
1950
4ae17f819ee8 #344 optional firstname lastname on user creation
Marcin Kuzminski <marcin@python-works.com>
parents: 1824
diff changeset
290
2030
61f9aeb2129e Added session wrapper, for rc 1.2.X compatibility. Adds backwards compatability
Marcin Kuzminski <marcin@python-works.com>
parents: 2025
diff changeset
291 class CookieStoreWrapper(object):
61f9aeb2129e Added session wrapper, for rc 1.2.X compatibility. Adds backwards compatability
Marcin Kuzminski <marcin@python-works.com>
parents: 2025
diff changeset
292
61f9aeb2129e Added session wrapper, for rc 1.2.X compatibility. Adds backwards compatability
Marcin Kuzminski <marcin@python-works.com>
parents: 2025
diff changeset
293 def __init__(self, cookie_store):
61f9aeb2129e Added session wrapper, for rc 1.2.X compatibility. Adds backwards compatability
Marcin Kuzminski <marcin@python-works.com>
parents: 2025
diff changeset
294 self.cookie_store = cookie_store
61f9aeb2129e Added session wrapper, for rc 1.2.X compatibility. Adds backwards compatability
Marcin Kuzminski <marcin@python-works.com>
parents: 2025
diff changeset
295
61f9aeb2129e Added session wrapper, for rc 1.2.X compatibility. Adds backwards compatability
Marcin Kuzminski <marcin@python-works.com>
parents: 2025
diff changeset
296 def __repr__(self):
61f9aeb2129e Added session wrapper, for rc 1.2.X compatibility. Adds backwards compatability
Marcin Kuzminski <marcin@python-works.com>
parents: 2025
diff changeset
297 return 'CookieStore<%s>' % (self.cookie_store)
61f9aeb2129e Added session wrapper, for rc 1.2.X compatibility. Adds backwards compatability
Marcin Kuzminski <marcin@python-works.com>
parents: 2025
diff changeset
298
61f9aeb2129e Added session wrapper, for rc 1.2.X compatibility. Adds backwards compatability
Marcin Kuzminski <marcin@python-works.com>
parents: 2025
diff changeset
299 def get(self, key, other=None):
61f9aeb2129e Added session wrapper, for rc 1.2.X compatibility. Adds backwards compatability
Marcin Kuzminski <marcin@python-works.com>
parents: 2025
diff changeset
300 if isinstance(self.cookie_store, dict):
61f9aeb2129e Added session wrapper, for rc 1.2.X compatibility. Adds backwards compatability
Marcin Kuzminski <marcin@python-works.com>
parents: 2025
diff changeset
301 return self.cookie_store.get(key, other)
61f9aeb2129e Added session wrapper, for rc 1.2.X compatibility. Adds backwards compatability
Marcin Kuzminski <marcin@python-works.com>
parents: 2025
diff changeset
302 elif isinstance(self.cookie_store, AuthUser):
61f9aeb2129e Added session wrapper, for rc 1.2.X compatibility. Adds backwards compatability
Marcin Kuzminski <marcin@python-works.com>
parents: 2025
diff changeset
303 return self.cookie_store.__dict__.get(key, other)
61f9aeb2129e Added session wrapper, for rc 1.2.X compatibility. Adds backwards compatability
Marcin Kuzminski <marcin@python-works.com>
parents: 2025
diff changeset
304
61f9aeb2129e Added session wrapper, for rc 1.2.X compatibility. Adds backwards compatability
Marcin Kuzminski <marcin@python-works.com>
parents: 2025
diff changeset
305
190
d8eb7ee27b4c Added LoginRequired decorator, empty User data container, hash functions
Marcin Kuzminski <marcin@python-works.com>
parents: 96
diff changeset
306 class AuthUser(object):
1117
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
307 """
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
308 A simple object that handles all attributes of user in RhodeCode
1203
6832ef664673 source code cleanup: remove trailing white space, normalize file endings
Marcin Kuzminski <marcin@python-works.com>
parents: 1195
diff changeset
309
1117
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
310 It does lookup based on API key,given user, or user present in session
1203
6832ef664673 source code cleanup: remove trailing white space, normalize file endings
Marcin Kuzminski <marcin@python-works.com>
parents: 1195
diff changeset
311 Then it fills all required information for such user. It also checks if
1117
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
312 anonymous access is enabled and if so, it returns default user as logged
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
313 in
190
d8eb7ee27b4c Added LoginRequired decorator, empty User data container, hash functions
Marcin Kuzminski <marcin@python-works.com>
parents: 96
diff changeset
314 """
1016
3790279d2538 #56 added propagation of permission from group
Marcin Kuzminski <marcin@python-works.com>
parents: 991
diff changeset
315
3125
9b92cf5a0cca Added UserIpMap interface for allowed IP addresses and IP restriction access
Marcin Kuzminski <marcin@python-works.com>
parents: 2726
diff changeset
316 def __init__(self, user_id=None, api_key=None, username=None, ip_addr=None):
1117
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
317
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
318 self.user_id = user_id
1120
a8d759613d8f fixed some bugs in api key auth, added access by api key into rss/atom feeds in global journal
Marcin Kuzminski <marcin@python-works.com>
parents: 1118
diff changeset
319 self.api_key = None
1617
cf128ced8c85 Improved container-based auth implementation and added support for a reverse-proxy setup (using the X-Forwarded-User header)
Liad Shani <liadff@gmail.com>
parents: 1614
diff changeset
320 self.username = username
3125
9b92cf5a0cca Added UserIpMap interface for allowed IP addresses and IP restriction access
Marcin Kuzminski <marcin@python-works.com>
parents: 2726
diff changeset
321 self.ip_addr = ip_addr
1628
de71a4bde097 Some code cleanups and fixes
Marcin Kuzminski <marcin@python-works.com>
parents: 1621
diff changeset
322
355
5bbcc0cac389 added session remove in forms, and added name and lastname to auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 350
diff changeset
323 self.name = ''
5bbcc0cac389 added session remove in forms, and added name and lastname to auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 350
diff changeset
324 self.lastname = ''
404
a10bdd0b05a7 fixed user email for gravatars
Marcin Kuzminski <marcin@python-works.com>
parents: 399
diff changeset
325 self.email = ''
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
326 self.is_authenticated = False
1117
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
327 self.admin = False
2714
a2eaa0054430 fixed error when disabled anonymous access lead to error on server
Marcin Kuzminski <marcin@python-works.com>
parents: 2709
diff changeset
328 self.inherit_default_permissions = False
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
329 self.permissions = {}
3125
9b92cf5a0cca Added UserIpMap interface for allowed IP addresses and IP restriction access
Marcin Kuzminski <marcin@python-works.com>
parents: 2726
diff changeset
330 self.allowed_ips = set()
1120
a8d759613d8f fixed some bugs in api key auth, added access by api key into rss/atom feeds in global journal
Marcin Kuzminski <marcin@python-works.com>
parents: 1118
diff changeset
331 self._api_key = api_key
1117
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
332 self.propagate_data()
1950
4ae17f819ee8 #344 optional firstname lastname on user creation
Marcin Kuzminski <marcin@python-works.com>
parents: 1824
diff changeset
333 self._instance = None
1117
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
334
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
335 def propagate_data(self):
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
336 user_model = UserModel()
1728
07e56179633e - fixes celery sqlalchemy session issues for async forking
Marcin Kuzminski <marcin@python-works.com>
parents: 1718
diff changeset
337 self.anonymous_user = User.get_by_username('default', cache=True)
1613
6cab36e31f09 Added container-based authentication support
Liad Shani <liadff@gmail.com>
parents: 1425
diff changeset
338 is_user_loaded = False
1718
f78bee8eec78 reduce cookie size for better support of client side sessions
Marcin Kuzminski <marcin@python-works.com>
parents: 1716
diff changeset
339
1628
de71a4bde097 Some code cleanups and fixes
Marcin Kuzminski <marcin@python-works.com>
parents: 1621
diff changeset
340 # try go get user by api key
1122
31e82d872631 disabled api key for anonymous users, and added api_key to rss/atom links for other users
Marcin Kuzminski <marcin@python-works.com>
parents: 1120
diff changeset
341 if self._api_key and self._api_key != self.anonymous_user.api_key:
1976
Marcin Kuzminski <marcin@python-works.com>
parents: 1950
diff changeset
342 log.debug('Auth User lookup by API KEY %s' % self._api_key)
1618
9353189b7675 Added automatic logout of deactivated/deleted users
Liad Shani <liadff@gmail.com>
parents: 1617
diff changeset
343 is_user_loaded = user_model.fill_data(self, api_key=self._api_key)
1818
cf51bbfb120e auto white-space removal
Marcin Kuzminski <marcin@python-works.com>
parents: 1808
diff changeset
344 # lookup by userid
1718
f78bee8eec78 reduce cookie size for better support of client side sessions
Marcin Kuzminski <marcin@python-works.com>
parents: 1716
diff changeset
345 elif (self.user_id is not None and
1628
de71a4bde097 Some code cleanups and fixes
Marcin Kuzminski <marcin@python-works.com>
parents: 1621
diff changeset
346 self.user_id != self.anonymous_user.user_id):
1976
Marcin Kuzminski <marcin@python-works.com>
parents: 1950
diff changeset
347 log.debug('Auth User lookup by USER ID %s' % self.user_id)
1618
9353189b7675 Added automatic logout of deactivated/deleted users
Liad Shani <liadff@gmail.com>
parents: 1617
diff changeset
348 is_user_loaded = user_model.fill_data(self, user_id=self.user_id)
1808
ff788e390497 fix issue #323 auth by suername only if container auth is enabled
Marcin Kuzminski <marcin@python-works.com>
parents: 1749
diff changeset
349 # lookup by username
ff788e390497 fix issue #323 auth by suername only if container auth is enabled
Marcin Kuzminski <marcin@python-works.com>
parents: 1749
diff changeset
350 elif self.username and \
ff788e390497 fix issue #323 auth by suername only if container auth is enabled
Marcin Kuzminski <marcin@python-works.com>
parents: 1749
diff changeset
351 str2bool(config.get('container_auth_enabled', False)):
1818
cf51bbfb120e auto white-space removal
Marcin Kuzminski <marcin@python-works.com>
parents: 1808
diff changeset
352
1976
Marcin Kuzminski <marcin@python-works.com>
parents: 1950
diff changeset
353 log.debug('Auth User lookup by USER NAME %s' % self.username)
1621
cbc2b1913cdf Added basic automatic user creation for container auth
Liad Shani <liadff@gmail.com>
parents: 1618
diff changeset
354 dbuser = login_container_auth(self.username)
cbc2b1913cdf Added basic automatic user creation for container auth
Liad Shani <liadff@gmail.com>
parents: 1618
diff changeset
355 if dbuser is not None:
2709
d2d35cf2b351 RhodeCode now has a option to explicitly set forking permissions. ref #508
Marcin Kuzminski <marcin@python-works.com>
parents: 2634
diff changeset
356 log.debug('filling all attributes to object')
1613
6cab36e31f09 Added container-based authentication support
Liad Shani <liadff@gmail.com>
parents: 1425
diff changeset
357 for k, v in dbuser.get_dict().items():
6cab36e31f09 Added container-based authentication support
Liad Shani <liadff@gmail.com>
parents: 1425
diff changeset
358 setattr(self, k, v)
6cab36e31f09 Added container-based authentication support
Liad Shani <liadff@gmail.com>
parents: 1425
diff changeset
359 self.set_authenticated()
6cab36e31f09 Added container-based authentication support
Liad Shani <liadff@gmail.com>
parents: 1425
diff changeset
360 is_user_loaded = True
2045
5b12cbae0b50 fixed issue with sessions that lead to redirection loops
Marcin Kuzminski <marcin@python-works.com>
parents: 2030
diff changeset
361 else:
5b12cbae0b50 fixed issue with sessions that lead to redirection loops
Marcin Kuzminski <marcin@python-works.com>
parents: 2030
diff changeset
362 log.debug('No data in %s that could been used to log in' % self)
1613
6cab36e31f09 Added container-based authentication support
Liad Shani <liadff@gmail.com>
parents: 1425
diff changeset
363
6cab36e31f09 Added container-based authentication support
Liad Shani <liadff@gmail.com>
parents: 1425
diff changeset
364 if not is_user_loaded:
1628
de71a4bde097 Some code cleanups and fixes
Marcin Kuzminski <marcin@python-works.com>
parents: 1621
diff changeset
365 # if we cannot authenticate user try anonymous
1613
6cab36e31f09 Added container-based authentication support
Liad Shani <liadff@gmail.com>
parents: 1425
diff changeset
366 if self.anonymous_user.active is True:
1718
f78bee8eec78 reduce cookie size for better support of client side sessions
Marcin Kuzminski <marcin@python-works.com>
parents: 1716
diff changeset
367 user_model.fill_data(self, user_id=self.anonymous_user.user_id)
1628
de71a4bde097 Some code cleanups and fixes
Marcin Kuzminski <marcin@python-works.com>
parents: 1621
diff changeset
368 # then we set this user is logged in
1613
6cab36e31f09 Added container-based authentication support
Liad Shani <liadff@gmail.com>
parents: 1425
diff changeset
369 self.is_authenticated = True
1117
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
370 else:
1618
9353189b7675 Added automatic logout of deactivated/deleted users
Liad Shani <liadff@gmail.com>
parents: 1617
diff changeset
371 self.user_id = None
9353189b7675 Added automatic logout of deactivated/deleted users
Liad Shani <liadff@gmail.com>
parents: 1617
diff changeset
372 self.username = None
1613
6cab36e31f09 Added container-based authentication support
Liad Shani <liadff@gmail.com>
parents: 1425
diff changeset
373 self.is_authenticated = False
1117
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
374
1617
cf128ced8c85 Improved container-based auth implementation and added support for a reverse-proxy setup (using the X-Forwarded-User header)
Liad Shani <liadff@gmail.com>
parents: 1614
diff changeset
375 if not self.username:
cf128ced8c85 Improved container-based auth implementation and added support for a reverse-proxy setup (using the X-Forwarded-User header)
Liad Shani <liadff@gmail.com>
parents: 1614
diff changeset
376 self.username = 'None'
cf128ced8c85 Improved container-based auth implementation and added support for a reverse-proxy setup (using the X-Forwarded-User header)
Liad Shani <liadff@gmail.com>
parents: 1614
diff changeset
377
1976
Marcin Kuzminski <marcin@python-works.com>
parents: 1950
diff changeset
378 log.debug('Auth User is now %s' % self)
1117
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
379 user_model.fill_perms(self)
3125
9b92cf5a0cca Added UserIpMap interface for allowed IP addresses and IP restriction access
Marcin Kuzminski <marcin@python-works.com>
parents: 2726
diff changeset
380 log.debug('Filling Allowed IPs')
9b92cf5a0cca Added UserIpMap interface for allowed IP addresses and IP restriction access
Marcin Kuzminski <marcin@python-works.com>
parents: 2726
diff changeset
381 self.allowed_ips = AuthUser.get_allowed_ips(self.user_id)
1117
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
382
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
383 @property
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
384 def is_admin(self):
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
385 return self.admin
239
b18f89d6d17f Adde draft for permissions systems, made all needed decorators, and checks. For future usage in the system.
Marcin Kuzminski <marcin@python-works.com>
parents: 234
diff changeset
386
673
dd532af216d9 #49 Enabled anonymous access for web interface controllable from permissions pannel
Marcin Kuzminski <marcin@python-works.com>
parents: 629
diff changeset
387 def __repr__(self):
1117
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
388 return "<AuthUser('id:%s:%s|%s')>" % (self.user_id, self.username,
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
389 self.is_authenticated)
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
390
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
391 def set_authenticated(self, authenticated=True):
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
392 if self.user_id != self.anonymous_user.user_id:
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
393 self.is_authenticated = authenticated
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
394
1718
f78bee8eec78 reduce cookie size for better support of client side sessions
Marcin Kuzminski <marcin@python-works.com>
parents: 1716
diff changeset
395 def get_cookie_store(self):
1950
4ae17f819ee8 #344 optional firstname lastname on user creation
Marcin Kuzminski <marcin@python-works.com>
parents: 1824
diff changeset
396 return {'username': self.username,
1718
f78bee8eec78 reduce cookie size for better support of client side sessions
Marcin Kuzminski <marcin@python-works.com>
parents: 1716
diff changeset
397 'user_id': self.user_id,
1950
4ae17f819ee8 #344 optional firstname lastname on user creation
Marcin Kuzminski <marcin@python-works.com>
parents: 1824
diff changeset
398 'is_authenticated': self.is_authenticated}
1718
f78bee8eec78 reduce cookie size for better support of client side sessions
Marcin Kuzminski <marcin@python-works.com>
parents: 1716
diff changeset
399
f78bee8eec78 reduce cookie size for better support of client side sessions
Marcin Kuzminski <marcin@python-works.com>
parents: 1716
diff changeset
400 @classmethod
f78bee8eec78 reduce cookie size for better support of client side sessions
Marcin Kuzminski <marcin@python-works.com>
parents: 1716
diff changeset
401 def from_cookie_store(cls, cookie_store):
2030
61f9aeb2129e Added session wrapper, for rc 1.2.X compatibility. Adds backwards compatability
Marcin Kuzminski <marcin@python-works.com>
parents: 2025
diff changeset
402 """
61f9aeb2129e Added session wrapper, for rc 1.2.X compatibility. Adds backwards compatability
Marcin Kuzminski <marcin@python-works.com>
parents: 2025
diff changeset
403 Creates AuthUser from a cookie store
61f9aeb2129e Added session wrapper, for rc 1.2.X compatibility. Adds backwards compatability
Marcin Kuzminski <marcin@python-works.com>
parents: 2025
diff changeset
404
61f9aeb2129e Added session wrapper, for rc 1.2.X compatibility. Adds backwards compatability
Marcin Kuzminski <marcin@python-works.com>
parents: 2025
diff changeset
405 :param cls:
61f9aeb2129e Added session wrapper, for rc 1.2.X compatibility. Adds backwards compatability
Marcin Kuzminski <marcin@python-works.com>
parents: 2025
diff changeset
406 :param cookie_store:
61f9aeb2129e Added session wrapper, for rc 1.2.X compatibility. Adds backwards compatability
Marcin Kuzminski <marcin@python-works.com>
parents: 2025
diff changeset
407 """
1718
f78bee8eec78 reduce cookie size for better support of client side sessions
Marcin Kuzminski <marcin@python-works.com>
parents: 1716
diff changeset
408 user_id = cookie_store.get('user_id')
f78bee8eec78 reduce cookie size for better support of client side sessions
Marcin Kuzminski <marcin@python-works.com>
parents: 1716
diff changeset
409 username = cookie_store.get('username')
f78bee8eec78 reduce cookie size for better support of client side sessions
Marcin Kuzminski <marcin@python-works.com>
parents: 1716
diff changeset
410 api_key = cookie_store.get('api_key')
f78bee8eec78 reduce cookie size for better support of client side sessions
Marcin Kuzminski <marcin@python-works.com>
parents: 1716
diff changeset
411 return AuthUser(user_id, api_key, username)
239
b18f89d6d17f Adde draft for permissions systems, made all needed decorators, and checks. For future usage in the system.
Marcin Kuzminski <marcin@python-works.com>
parents: 234
diff changeset
412
3125
9b92cf5a0cca Added UserIpMap interface for allowed IP addresses and IP restriction access
Marcin Kuzminski <marcin@python-works.com>
parents: 2726
diff changeset
413 @classmethod
9b92cf5a0cca Added UserIpMap interface for allowed IP addresses and IP restriction access
Marcin Kuzminski <marcin@python-works.com>
parents: 2726
diff changeset
414 def get_allowed_ips(cls, user_id):
9b92cf5a0cca Added UserIpMap interface for allowed IP addresses and IP restriction access
Marcin Kuzminski <marcin@python-works.com>
parents: 2726
diff changeset
415 _set = set()
9b92cf5a0cca Added UserIpMap interface for allowed IP addresses and IP restriction access
Marcin Kuzminski <marcin@python-works.com>
parents: 2726
diff changeset
416 user_ips = UserIpMap.query().filter(UserIpMap.user_id == user_id).all()
9b92cf5a0cca Added UserIpMap interface for allowed IP addresses and IP restriction access
Marcin Kuzminski <marcin@python-works.com>
parents: 2726
diff changeset
417 for ip in user_ips:
9b92cf5a0cca Added UserIpMap interface for allowed IP addresses and IP restriction access
Marcin Kuzminski <marcin@python-works.com>
parents: 2726
diff changeset
418 _set.add(ip.ip_addr)
9b92cf5a0cca Added UserIpMap interface for allowed IP addresses and IP restriction access
Marcin Kuzminski <marcin@python-works.com>
parents: 2726
diff changeset
419 return _set or set(['0.0.0.0/0'])
9b92cf5a0cca Added UserIpMap interface for allowed IP addresses and IP restriction access
Marcin Kuzminski <marcin@python-works.com>
parents: 2726
diff changeset
420
1950
4ae17f819ee8 #344 optional firstname lastname on user creation
Marcin Kuzminski <marcin@python-works.com>
parents: 1824
diff changeset
421
239
b18f89d6d17f Adde draft for permissions systems, made all needed decorators, and checks. For future usage in the system.
Marcin Kuzminski <marcin@python-works.com>
parents: 234
diff changeset
422 def set_available_permissions(config):
1628
de71a4bde097 Some code cleanups and fixes
Marcin Kuzminski <marcin@python-works.com>
parents: 1621
diff changeset
423 """
de71a4bde097 Some code cleanups and fixes
Marcin Kuzminski <marcin@python-works.com>
parents: 1621
diff changeset
424 This function will propagate pylons globals with all available defined
1203
6832ef664673 source code cleanup: remove trailing white space, normalize file endings
Marcin Kuzminski <marcin@python-works.com>
parents: 1195
diff changeset
425 permission given in db. We don't want to check each time from db for new
239
b18f89d6d17f Adde draft for permissions systems, made all needed decorators, and checks. For future usage in the system.
Marcin Kuzminski <marcin@python-works.com>
parents: 234
diff changeset
426 permissions since adding a new permission also requires application restart
b18f89d6d17f Adde draft for permissions systems, made all needed decorators, and checks. For future usage in the system.
Marcin Kuzminski <marcin@python-works.com>
parents: 234
diff changeset
427 ie. to decorate new views with the newly created permission
1203
6832ef664673 source code cleanup: remove trailing white space, normalize file endings
Marcin Kuzminski <marcin@python-works.com>
parents: 1195
diff changeset
428
895
62c04c5cc971 Added some more details into user edit permissions view
Marcin Kuzminski <marcin@python-works.com>
parents: 779
diff changeset
429 :param config: current pylons config instance
1203
6832ef664673 source code cleanup: remove trailing white space, normalize file endings
Marcin Kuzminski <marcin@python-works.com>
parents: 1195
diff changeset
430
239
b18f89d6d17f Adde draft for permissions systems, made all needed decorators, and checks. For future usage in the system.
Marcin Kuzminski <marcin@python-works.com>
parents: 234
diff changeset
431 """
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
432 log.info('getting information about all available permissions')
350
664a5b8c551a Added application settings, are now customizable from database
Marcin Kuzminski <marcin@python-works.com>
parents: 343
diff changeset
433 try:
1749
8ecc6b8229a5 commit less models
Marcin Kuzminski <marcin@python-works.com>
parents: 1728
diff changeset
434 sa = meta.Session
350
664a5b8c551a Added application settings, are now customizable from database
Marcin Kuzminski <marcin@python-works.com>
parents: 343
diff changeset
435 all_perms = sa.query(Permission).all()
1950
4ae17f819ee8 #344 optional firstname lastname on user creation
Marcin Kuzminski <marcin@python-works.com>
parents: 1824
diff changeset
436 except Exception:
629
7e536d1af60d Code refactoring,models renames
Marcin Kuzminski <marcin@python-works.com>
parents: 612
diff changeset
437 pass
350
664a5b8c551a Added application settings, are now customizable from database
Marcin Kuzminski <marcin@python-works.com>
parents: 343
diff changeset
438 finally:
664a5b8c551a Added application settings, are now customizable from database
Marcin Kuzminski <marcin@python-works.com>
parents: 343
diff changeset
439 meta.Session.remove()
673
dd532af216d9 #49 Enabled anonymous access for web interface controllable from permissions pannel
Marcin Kuzminski <marcin@python-works.com>
parents: 629
diff changeset
440
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
441 config['available_permissions'] = [x.permission_name for x in all_perms]
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
442
1246
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
443
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
444 #==============================================================================
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
445 # CHECK DECORATORS
1246
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
446 #==============================================================================
190
d8eb7ee27b4c Added LoginRequired decorator, empty User data container, hash functions
Marcin Kuzminski <marcin@python-works.com>
parents: 96
diff changeset
447 class LoginRequired(object):
1117
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
448 """
1203
6832ef664673 source code cleanup: remove trailing white space, normalize file endings
Marcin Kuzminski <marcin@python-works.com>
parents: 1195
diff changeset
449 Must be logged in to execute this function else
1117
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
450 redirect to login page
1203
6832ef664673 source code cleanup: remove trailing white space, normalize file endings
Marcin Kuzminski <marcin@python-works.com>
parents: 1195
diff changeset
451
1117
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
452 :param api_access: if enabled this checks only for valid auth token
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
453 and grants access based on valid token
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
454 """
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
455
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
456 def __init__(self, api_access=False):
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
457 self.api_access = api_access
673
dd532af216d9 #49 Enabled anonymous access for web interface controllable from permissions pannel
Marcin Kuzminski <marcin@python-works.com>
parents: 629
diff changeset
458
190
d8eb7ee27b4c Added LoginRequired decorator, empty User data container, hash functions
Marcin Kuzminski <marcin@python-works.com>
parents: 96
diff changeset
459 def __call__(self, func):
377
bd8b25ad058d Fixed decorators bug when using them with keyworded arguments,new implementation takes new approach that is more flexible
Marcin Kuzminski <marcin@python-works.com>
parents: 371
diff changeset
460 return decorator(self.__wrapper, func)
673
dd532af216d9 #49 Enabled anonymous access for web interface controllable from permissions pannel
Marcin Kuzminski <marcin@python-works.com>
parents: 629
diff changeset
461
377
bd8b25ad058d Fixed decorators bug when using them with keyworded arguments,new implementation takes new approach that is more flexible
Marcin Kuzminski <marcin@python-works.com>
parents: 371
diff changeset
462 def __wrapper(self, func, *fargs, **fkwargs):
1117
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
463 cls = fargs[0]
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
464 user = cls.rhodecode_user
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
465
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
466 api_access_ok = False
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
467 if self.api_access:
1976
Marcin Kuzminski <marcin@python-works.com>
parents: 1950
diff changeset
468 log.debug('Checking API KEY access for %s' % cls)
1117
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
469 if user.api_key == request.GET.get('api_key'):
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
470 api_access_ok = True
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
471 else:
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
472 log.debug("API KEY token not valid")
2025
7e979933ffec more work on improving info logging
Marcin Kuzminski <marcin@python-works.com>
parents: 2000
diff changeset
473 loc = "%s:%s" % (cls.__class__.__name__, func.__name__)
7e979933ffec more work on improving info logging
Marcin Kuzminski <marcin@python-works.com>
parents: 2000
diff changeset
474 log.debug('Checking if %s is authenticated @ %s' % (user.username, loc))
1117
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
475 if user.is_authenticated or api_access_ok:
2458
ba49541187d9 Little more verbose logging for auth
Marcin Kuzminski <marcin@python-works.com>
parents: 2278
diff changeset
476 reason = 'RegularAuth' if user.is_authenticated else 'APIAuth'
ba49541187d9 Little more verbose logging for auth
Marcin Kuzminski <marcin@python-works.com>
parents: 2278
diff changeset
477 log.info('user %s is authenticated and granted access to %s '
ba49541187d9 Little more verbose logging for auth
Marcin Kuzminski <marcin@python-works.com>
parents: 2278
diff changeset
478 'using %s' % (user.username, loc, reason)
2025
7e979933ffec more work on improving info logging
Marcin Kuzminski <marcin@python-works.com>
parents: 2000
diff changeset
479 )
377
bd8b25ad058d Fixed decorators bug when using them with keyworded arguments,new implementation takes new approach that is more flexible
Marcin Kuzminski <marcin@python-works.com>
parents: 371
diff changeset
480 return func(*fargs, **fkwargs)
bd8b25ad058d Fixed decorators bug when using them with keyworded arguments,new implementation takes new approach that is more flexible
Marcin Kuzminski <marcin@python-works.com>
parents: 371
diff changeset
481 else:
2025
7e979933ffec more work on improving info logging
Marcin Kuzminski <marcin@python-works.com>
parents: 2000
diff changeset
482 log.warn('user %s NOT authenticated on func: %s' % (
7e979933ffec more work on improving info logging
Marcin Kuzminski <marcin@python-works.com>
parents: 2000
diff changeset
483 user, loc)
7e979933ffec more work on improving info logging
Marcin Kuzminski <marcin@python-works.com>
parents: 2000
diff changeset
484 )
1207
e61b7ba293db changed the way of generating url for came_from
Marcin Kuzminski <marcin@python-works.com>
parents: 1206
diff changeset
485 p = url.current()
673
dd532af216d9 #49 Enabled anonymous access for web interface controllable from permissions pannel
Marcin Kuzminski <marcin@python-works.com>
parents: 629
diff changeset
486
1976
Marcin Kuzminski <marcin@python-works.com>
parents: 1950
diff changeset
487 log.debug('redirecting to login page with %s' % p)
474
a3d9d24acbec Implemented password reset(forms/models/ tasks) and mailing tasks.
Marcin Kuzminski <marcin@python-works.com>
parents: 442
diff changeset
488 return redirect(url('login_home', came_from=p))
239
b18f89d6d17f Adde draft for permissions systems, made all needed decorators, and checks. For future usage in the system.
Marcin Kuzminski <marcin@python-works.com>
parents: 234
diff changeset
489
1246
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
490
779
389d02a5df52 Added isanonymous decorator for checking permissions for anonymous access
Marcin Kuzminski <marcin@python-works.com>
parents: 761
diff changeset
491 class NotAnonymous(object):
1716
7d1fc253549e notification to commit author + gardening
Marcin Kuzminski <marcin@python-works.com>
parents: 1644
diff changeset
492 """
7d1fc253549e notification to commit author + gardening
Marcin Kuzminski <marcin@python-works.com>
parents: 1644
diff changeset
493 Must be logged in to execute this function else
779
389d02a5df52 Added isanonymous decorator for checking permissions for anonymous access
Marcin Kuzminski <marcin@python-works.com>
parents: 761
diff changeset
494 redirect to login page"""
389d02a5df52 Added isanonymous decorator for checking permissions for anonymous access
Marcin Kuzminski <marcin@python-works.com>
parents: 761
diff changeset
495
389d02a5df52 Added isanonymous decorator for checking permissions for anonymous access
Marcin Kuzminski <marcin@python-works.com>
parents: 761
diff changeset
496 def __call__(self, func):
389d02a5df52 Added isanonymous decorator for checking permissions for anonymous access
Marcin Kuzminski <marcin@python-works.com>
parents: 761
diff changeset
497 return decorator(self.__wrapper, func)
389d02a5df52 Added isanonymous decorator for checking permissions for anonymous access
Marcin Kuzminski <marcin@python-works.com>
parents: 761
diff changeset
498
389d02a5df52 Added isanonymous decorator for checking permissions for anonymous access
Marcin Kuzminski <marcin@python-works.com>
parents: 761
diff changeset
499 def __wrapper(self, func, *fargs, **fkwargs):
1117
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
500 cls = fargs[0]
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
501 self.user = cls.rhodecode_user
779
389d02a5df52 Added isanonymous decorator for checking permissions for anonymous access
Marcin Kuzminski <marcin@python-works.com>
parents: 761
diff changeset
502
1976
Marcin Kuzminski <marcin@python-works.com>
parents: 1950
diff changeset
503 log.debug('Checking if user is not anonymous @%s' % cls)
1117
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
504
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
505 anonymous = self.user.username == 'default'
779
389d02a5df52 Added isanonymous decorator for checking permissions for anonymous access
Marcin Kuzminski <marcin@python-works.com>
parents: 761
diff changeset
506
389d02a5df52 Added isanonymous decorator for checking permissions for anonymous access
Marcin Kuzminski <marcin@python-works.com>
parents: 761
diff changeset
507 if anonymous:
1335
40c8d18102a9 fixed redirection link in notAnonymous decorator
Marcin Kuzminski <marcin@python-works.com>
parents: 1307
diff changeset
508 p = url.current()
1056
520d27f40b51 #113 removed anonymous access from forking, added system messages in login box.
Marcin Kuzminski <marcin@python-works.com>
parents: 1040
diff changeset
509
520d27f40b51 #113 removed anonymous access from forking, added system messages in login box.
Marcin Kuzminski <marcin@python-works.com>
parents: 1040
diff changeset
510 import rhodecode.lib.helpers as h
1246
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
511 h.flash(_('You need to be a registered user to '
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
512 'perform this action'),
1056
520d27f40b51 #113 removed anonymous access from forking, added system messages in login box.
Marcin Kuzminski <marcin@python-works.com>
parents: 1040
diff changeset
513 category='warning')
779
389d02a5df52 Added isanonymous decorator for checking permissions for anonymous access
Marcin Kuzminski <marcin@python-works.com>
parents: 761
diff changeset
514 return redirect(url('login_home', came_from=p))
389d02a5df52 Added isanonymous decorator for checking permissions for anonymous access
Marcin Kuzminski <marcin@python-works.com>
parents: 761
diff changeset
515 else:
389d02a5df52 Added isanonymous decorator for checking permissions for anonymous access
Marcin Kuzminski <marcin@python-works.com>
parents: 761
diff changeset
516 return func(*fargs, **fkwargs)
389d02a5df52 Added isanonymous decorator for checking permissions for anonymous access
Marcin Kuzminski <marcin@python-works.com>
parents: 761
diff changeset
517
1246
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
518
239
b18f89d6d17f Adde draft for permissions systems, made all needed decorators, and checks. For future usage in the system.
Marcin Kuzminski <marcin@python-works.com>
parents: 234
diff changeset
519 class PermsDecorator(object):
1117
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
520 """Base class for controller decorators"""
673
dd532af216d9 #49 Enabled anonymous access for web interface controllable from permissions pannel
Marcin Kuzminski <marcin@python-works.com>
parents: 629
diff changeset
521
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
522 def __init__(self, *required_perms):
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
523 available_perms = config['available_permissions']
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
524 for perm in required_perms:
239
b18f89d6d17f Adde draft for permissions systems, made all needed decorators, and checks. For future usage in the system.
Marcin Kuzminski <marcin@python-works.com>
parents: 234
diff changeset
525 if perm not in available_perms:
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
526 raise Exception("'%s' permission is not defined" % perm)
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
527 self.required_perms = set(required_perms)
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
528 self.user_perms = None
673
dd532af216d9 #49 Enabled anonymous access for web interface controllable from permissions pannel
Marcin Kuzminski <marcin@python-works.com>
parents: 629
diff changeset
529
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
530 def __call__(self, func):
377
bd8b25ad058d Fixed decorators bug when using them with keyworded arguments,new implementation takes new approach that is more flexible
Marcin Kuzminski <marcin@python-works.com>
parents: 371
diff changeset
531 return decorator(self.__wrapper, func)
673
dd532af216d9 #49 Enabled anonymous access for web interface controllable from permissions pannel
Marcin Kuzminski <marcin@python-works.com>
parents: 629
diff changeset
532
377
bd8b25ad058d Fixed decorators bug when using them with keyworded arguments,new implementation takes new approach that is more flexible
Marcin Kuzminski <marcin@python-works.com>
parents: 371
diff changeset
533 def __wrapper(self, func, *fargs, **fkwargs):
1117
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
534 cls = fargs[0]
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
535 self.user = cls.rhodecode_user
673
dd532af216d9 #49 Enabled anonymous access for web interface controllable from permissions pannel
Marcin Kuzminski <marcin@python-works.com>
parents: 629
diff changeset
536 self.user_perms = self.user.permissions
dd532af216d9 #49 Enabled anonymous access for web interface controllable from permissions pannel
Marcin Kuzminski <marcin@python-works.com>
parents: 629
diff changeset
537 log.debug('checking %s permissions %s for %s %s',
2125
097327aaf2ad more detailed logging on auth system
Marcin Kuzminski <marcin@python-works.com>
parents: 2109
diff changeset
538 self.__class__.__name__, self.required_perms, cls, self.user)
377
bd8b25ad058d Fixed decorators bug when using them with keyworded arguments,new implementation takes new approach that is more flexible
Marcin Kuzminski <marcin@python-works.com>
parents: 371
diff changeset
539
bd8b25ad058d Fixed decorators bug when using them with keyworded arguments,new implementation takes new approach that is more flexible
Marcin Kuzminski <marcin@python-works.com>
parents: 371
diff changeset
540 if self.check_permissions():
1976
Marcin Kuzminski <marcin@python-works.com>
parents: 1950
diff changeset
541 log.debug('Permission granted for %s %s' % (cls, self.user))
377
bd8b25ad058d Fixed decorators bug when using them with keyworded arguments,new implementation takes new approach that is more flexible
Marcin Kuzminski <marcin@python-works.com>
parents: 371
diff changeset
542 return func(*fargs, **fkwargs)
673
dd532af216d9 #49 Enabled anonymous access for web interface controllable from permissions pannel
Marcin Kuzminski <marcin@python-works.com>
parents: 629
diff changeset
543
377
bd8b25ad058d Fixed decorators bug when using them with keyworded arguments,new implementation takes new approach that is more flexible
Marcin Kuzminski <marcin@python-works.com>
parents: 371
diff changeset
544 else:
2025
7e979933ffec more work on improving info logging
Marcin Kuzminski <marcin@python-works.com>
parents: 2000
diff changeset
545 log.debug('Permission denied for %s %s' % (cls, self.user))
1336
e9fe4ff57cbb Do a redirect to login for anonymous users
Marcin Kuzminski <marcin@python-works.com>
parents: 1335
diff changeset
546 anonymous = self.user.username == 'default'
e9fe4ff57cbb Do a redirect to login for anonymous users
Marcin Kuzminski <marcin@python-works.com>
parents: 1335
diff changeset
547
e9fe4ff57cbb Do a redirect to login for anonymous users
Marcin Kuzminski <marcin@python-works.com>
parents: 1335
diff changeset
548 if anonymous:
e9fe4ff57cbb Do a redirect to login for anonymous users
Marcin Kuzminski <marcin@python-works.com>
parents: 1335
diff changeset
549 p = url.current()
e9fe4ff57cbb Do a redirect to login for anonymous users
Marcin Kuzminski <marcin@python-works.com>
parents: 1335
diff changeset
550
e9fe4ff57cbb Do a redirect to login for anonymous users
Marcin Kuzminski <marcin@python-works.com>
parents: 1335
diff changeset
551 import rhodecode.lib.helpers as h
e9fe4ff57cbb Do a redirect to login for anonymous users
Marcin Kuzminski <marcin@python-works.com>
parents: 1335
diff changeset
552 h.flash(_('You need to be a signed in to '
e9fe4ff57cbb Do a redirect to login for anonymous users
Marcin Kuzminski <marcin@python-works.com>
parents: 1335
diff changeset
553 'view this page'),
e9fe4ff57cbb Do a redirect to login for anonymous users
Marcin Kuzminski <marcin@python-works.com>
parents: 1335
diff changeset
554 category='warning')
e9fe4ff57cbb Do a redirect to login for anonymous users
Marcin Kuzminski <marcin@python-works.com>
parents: 1335
diff changeset
555 return redirect(url('login_home', came_from=p))
e9fe4ff57cbb Do a redirect to login for anonymous users
Marcin Kuzminski <marcin@python-works.com>
parents: 1335
diff changeset
556
e9fe4ff57cbb Do a redirect to login for anonymous users
Marcin Kuzminski <marcin@python-works.com>
parents: 1335
diff changeset
557 else:
1628
de71a4bde097 Some code cleanups and fixes
Marcin Kuzminski <marcin@python-works.com>
parents: 1621
diff changeset
558 # redirect with forbidden ret code
1336
e9fe4ff57cbb Do a redirect to login for anonymous users
Marcin Kuzminski <marcin@python-works.com>
parents: 1335
diff changeset
559 return abort(403)
377
bd8b25ad058d Fixed decorators bug when using them with keyworded arguments,new implementation takes new approach that is more flexible
Marcin Kuzminski <marcin@python-works.com>
parents: 371
diff changeset
560
239
b18f89d6d17f Adde draft for permissions systems, made all needed decorators, and checks. For future usage in the system.
Marcin Kuzminski <marcin@python-works.com>
parents: 234
diff changeset
561 def check_permissions(self):
377
bd8b25ad058d Fixed decorators bug when using them with keyworded arguments,new implementation takes new approach that is more flexible
Marcin Kuzminski <marcin@python-works.com>
parents: 371
diff changeset
562 """Dummy function for overriding"""
239
b18f89d6d17f Adde draft for permissions systems, made all needed decorators, and checks. For future usage in the system.
Marcin Kuzminski <marcin@python-works.com>
parents: 234
diff changeset
563 raise Exception('You have to write this function in child class')
b18f89d6d17f Adde draft for permissions systems, made all needed decorators, and checks. For future usage in the system.
Marcin Kuzminski <marcin@python-works.com>
parents: 234
diff changeset
564
1246
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
565
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
566 class HasPermissionAllDecorator(PermsDecorator):
1716
7d1fc253549e notification to commit author + gardening
Marcin Kuzminski <marcin@python-works.com>
parents: 1644
diff changeset
567 """
7d1fc253549e notification to commit author + gardening
Marcin Kuzminski <marcin@python-works.com>
parents: 1644
diff changeset
568 Checks for access permission for all given predicates. All of them
377
bd8b25ad058d Fixed decorators bug when using them with keyworded arguments,new implementation takes new approach that is more flexible
Marcin Kuzminski <marcin@python-works.com>
parents: 371
diff changeset
569 have to be meet in order to fulfill the request
239
b18f89d6d17f Adde draft for permissions systems, made all needed decorators, and checks. For future usage in the system.
Marcin Kuzminski <marcin@python-works.com>
parents: 234
diff changeset
570 """
673
dd532af216d9 #49 Enabled anonymous access for web interface controllable from permissions pannel
Marcin Kuzminski <marcin@python-works.com>
parents: 629
diff changeset
571
239
b18f89d6d17f Adde draft for permissions systems, made all needed decorators, and checks. For future usage in the system.
Marcin Kuzminski <marcin@python-works.com>
parents: 234
diff changeset
572 def check_permissions(self):
339
5d517bbf0a0d some extra checks for auth lib
Marcin Kuzminski <marcin@python-works.com>
parents: 333
diff changeset
573 if self.required_perms.issubset(self.user_perms.get('global')):
239
b18f89d6d17f Adde draft for permissions systems, made all needed decorators, and checks. For future usage in the system.
Marcin Kuzminski <marcin@python-works.com>
parents: 234
diff changeset
574 return True
b18f89d6d17f Adde draft for permissions systems, made all needed decorators, and checks. For future usage in the system.
Marcin Kuzminski <marcin@python-works.com>
parents: 234
diff changeset
575 return False
673
dd532af216d9 #49 Enabled anonymous access for web interface controllable from permissions pannel
Marcin Kuzminski <marcin@python-works.com>
parents: 629
diff changeset
576
239
b18f89d6d17f Adde draft for permissions systems, made all needed decorators, and checks. For future usage in the system.
Marcin Kuzminski <marcin@python-works.com>
parents: 234
diff changeset
577
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
578 class HasPermissionAnyDecorator(PermsDecorator):
1716
7d1fc253549e notification to commit author + gardening
Marcin Kuzminski <marcin@python-works.com>
parents: 1644
diff changeset
579 """
7d1fc253549e notification to commit author + gardening
Marcin Kuzminski <marcin@python-works.com>
parents: 1644
diff changeset
580 Checks for access permission for any of given predicates. In order to
239
b18f89d6d17f Adde draft for permissions systems, made all needed decorators, and checks. For future usage in the system.
Marcin Kuzminski <marcin@python-works.com>
parents: 234
diff changeset
581 fulfill the request any of predicates must be meet
b18f89d6d17f Adde draft for permissions systems, made all needed decorators, and checks. For future usage in the system.
Marcin Kuzminski <marcin@python-works.com>
parents: 234
diff changeset
582 """
673
dd532af216d9 #49 Enabled anonymous access for web interface controllable from permissions pannel
Marcin Kuzminski <marcin@python-works.com>
parents: 629
diff changeset
583
239
b18f89d6d17f Adde draft for permissions systems, made all needed decorators, and checks. For future usage in the system.
Marcin Kuzminski <marcin@python-works.com>
parents: 234
diff changeset
584 def check_permissions(self):
339
5d517bbf0a0d some extra checks for auth lib
Marcin Kuzminski <marcin@python-works.com>
parents: 333
diff changeset
585 if self.required_perms.intersection(self.user_perms.get('global')):
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
586 return True
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
587 return False
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
588
1246
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
589
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
590 class HasRepoPermissionAllDecorator(PermsDecorator):
1716
7d1fc253549e notification to commit author + gardening
Marcin Kuzminski <marcin@python-works.com>
parents: 1644
diff changeset
591 """
7d1fc253549e notification to commit author + gardening
Marcin Kuzminski <marcin@python-works.com>
parents: 1644
diff changeset
592 Checks for access permission for all given predicates for specific
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
593 repository. All of them have to be meet in order to fulfill the request
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
594 """
673
dd532af216d9 #49 Enabled anonymous access for web interface controllable from permissions pannel
Marcin Kuzminski <marcin@python-works.com>
parents: 629
diff changeset
595
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
596 def check_permissions(self):
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
597 repo_name = get_repo_slug(request)
339
5d517bbf0a0d some extra checks for auth lib
Marcin Kuzminski <marcin@python-works.com>
parents: 333
diff changeset
598 try:
5d517bbf0a0d some extra checks for auth lib
Marcin Kuzminski <marcin@python-works.com>
parents: 333
diff changeset
599 user_perms = set([self.user_perms['repositories'][repo_name]])
5d517bbf0a0d some extra checks for auth lib
Marcin Kuzminski <marcin@python-works.com>
parents: 333
diff changeset
600 except KeyError:
5d517bbf0a0d some extra checks for auth lib
Marcin Kuzminski <marcin@python-works.com>
parents: 333
diff changeset
601 return False
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
602 if self.required_perms.issubset(user_perms):
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
603 return True
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
604 return False
673
dd532af216d9 #49 Enabled anonymous access for web interface controllable from permissions pannel
Marcin Kuzminski <marcin@python-works.com>
parents: 629
diff changeset
605
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
606
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
607 class HasRepoPermissionAnyDecorator(PermsDecorator):
1716
7d1fc253549e notification to commit author + gardening
Marcin Kuzminski <marcin@python-works.com>
parents: 1644
diff changeset
608 """
7d1fc253549e notification to commit author + gardening
Marcin Kuzminski <marcin@python-works.com>
parents: 1644
diff changeset
609 Checks for access permission for any of given predicates for specific
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
610 repository. In order to fulfill the request any of predicates must be meet
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
611 """
673
dd532af216d9 #49 Enabled anonymous access for web interface controllable from permissions pannel
Marcin Kuzminski <marcin@python-works.com>
parents: 629
diff changeset
612
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
613 def check_permissions(self):
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
614 repo_name = get_repo_slug(request)
673
dd532af216d9 #49 Enabled anonymous access for web interface controllable from permissions pannel
Marcin Kuzminski <marcin@python-works.com>
parents: 629
diff changeset
615
339
5d517bbf0a0d some extra checks for auth lib
Marcin Kuzminski <marcin@python-works.com>
parents: 333
diff changeset
616 try:
5d517bbf0a0d some extra checks for auth lib
Marcin Kuzminski <marcin@python-works.com>
parents: 333
diff changeset
617 user_perms = set([self.user_perms['repositories'][repo_name]])
5d517bbf0a0d some extra checks for auth lib
Marcin Kuzminski <marcin@python-works.com>
parents: 333
diff changeset
618 except KeyError:
5d517bbf0a0d some extra checks for auth lib
Marcin Kuzminski <marcin@python-works.com>
parents: 333
diff changeset
619 return False
2125
097327aaf2ad more detailed logging on auth system
Marcin Kuzminski <marcin@python-works.com>
parents: 2109
diff changeset
620
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
621 if self.required_perms.intersection(user_perms):
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
622 return True
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
623 return False
1246
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
624
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
625
1982
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
626 class HasReposGroupPermissionAllDecorator(PermsDecorator):
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
627 """
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
628 Checks for access permission for all given predicates for specific
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
629 repository. All of them have to be meet in order to fulfill the request
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
630 """
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
631
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
632 def check_permissions(self):
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
633 group_name = get_repos_group_slug(request)
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
634 try:
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
635 user_perms = set([self.user_perms['repositories_groups'][group_name]])
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
636 except KeyError:
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
637 return False
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
638 if self.required_perms.issubset(user_perms):
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
639 return True
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
640 return False
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
641
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
642
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
643 class HasReposGroupPermissionAnyDecorator(PermsDecorator):
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
644 """
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
645 Checks for access permission for any of given predicates for specific
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
646 repository. In order to fulfill the request any of predicates must be meet
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
647 """
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
648
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
649 def check_permissions(self):
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
650 group_name = get_repos_group_slug(request)
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
651
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
652 try:
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
653 user_perms = set([self.user_perms['repositories_groups'][group_name]])
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
654 except KeyError:
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
655 return False
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
656 if self.required_perms.intersection(user_perms):
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
657 return True
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
658 return False
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
659
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
660
1246
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
661 #==============================================================================
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
662 # CHECK FUNCTIONS
1246
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
663 #==============================================================================
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
664 class PermsFunction(object):
377
bd8b25ad058d Fixed decorators bug when using them with keyworded arguments,new implementation takes new approach that is more flexible
Marcin Kuzminski <marcin@python-works.com>
parents: 371
diff changeset
665 """Base function for other check functions"""
673
dd532af216d9 #49 Enabled anonymous access for web interface controllable from permissions pannel
Marcin Kuzminski <marcin@python-works.com>
parents: 629
diff changeset
666
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
667 def __init__(self, *perms):
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
668 available_perms = config['available_permissions']
673
dd532af216d9 #49 Enabled anonymous access for web interface controllable from permissions pannel
Marcin Kuzminski <marcin@python-works.com>
parents: 629
diff changeset
669
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
670 for perm in perms:
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
671 if perm not in available_perms:
2105
926f55b038bc added initial rc-extension module
Marcin Kuzminski <marcin@python-works.com>
parents: 2100
diff changeset
672 raise Exception("'%s' permission is not defined" % perm)
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
673 self.required_perms = set(perms)
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
674 self.user_perms = None
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
675 self.repo_name = None
2125
097327aaf2ad more detailed logging on auth system
Marcin Kuzminski <marcin@python-works.com>
parents: 2109
diff changeset
676 self.group_name = None
673
dd532af216d9 #49 Enabled anonymous access for web interface controllable from permissions pannel
Marcin Kuzminski <marcin@python-works.com>
parents: 629
diff changeset
677
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
678 def __call__(self, check_Location=''):
1728
07e56179633e - fixes celery sqlalchemy session issues for async forking
Marcin Kuzminski <marcin@python-works.com>
parents: 1718
diff changeset
679 user = request.user
2125
097327aaf2ad more detailed logging on auth system
Marcin Kuzminski <marcin@python-works.com>
parents: 2109
diff changeset
680 cls_name = self.__class__.__name__
097327aaf2ad more detailed logging on auth system
Marcin Kuzminski <marcin@python-works.com>
parents: 2109
diff changeset
681 check_scope = {
097327aaf2ad more detailed logging on auth system
Marcin Kuzminski <marcin@python-works.com>
parents: 2109
diff changeset
682 'HasPermissionAll': '',
097327aaf2ad more detailed logging on auth system
Marcin Kuzminski <marcin@python-works.com>
parents: 2109
diff changeset
683 'HasPermissionAny': '',
097327aaf2ad more detailed logging on auth system
Marcin Kuzminski <marcin@python-works.com>
parents: 2109
diff changeset
684 'HasRepoPermissionAll': 'repo:%s' % self.repo_name,
097327aaf2ad more detailed logging on auth system
Marcin Kuzminski <marcin@python-works.com>
parents: 2109
diff changeset
685 'HasRepoPermissionAny': 'repo:%s' % self.repo_name,
097327aaf2ad more detailed logging on auth system
Marcin Kuzminski <marcin@python-works.com>
parents: 2109
diff changeset
686 'HasReposGroupPermissionAll': 'group:%s' % self.group_name,
097327aaf2ad more detailed logging on auth system
Marcin Kuzminski <marcin@python-works.com>
parents: 2109
diff changeset
687 'HasReposGroupPermissionAny': 'group:%s' % self.group_name,
097327aaf2ad more detailed logging on auth system
Marcin Kuzminski <marcin@python-works.com>
parents: 2109
diff changeset
688 }.get(cls_name, '?')
097327aaf2ad more detailed logging on auth system
Marcin Kuzminski <marcin@python-works.com>
parents: 2109
diff changeset
689 log.debug('checking cls:%s %s usr:%s %s @ %s', cls_name,
097327aaf2ad more detailed logging on auth system
Marcin Kuzminski <marcin@python-works.com>
parents: 2109
diff changeset
690 self.required_perms, user, check_scope,
097327aaf2ad more detailed logging on auth system
Marcin Kuzminski <marcin@python-works.com>
parents: 2109
diff changeset
691 check_Location or 'unspecified location')
333
f5f290d68646 fixed auth bug
Marcin Kuzminski <marcin@python-works.com>
parents: 316
diff changeset
692 if not user:
2045
5b12cbae0b50 fixed issue with sessions that lead to redirection loops
Marcin Kuzminski <marcin@python-works.com>
parents: 2030
diff changeset
693 log.debug('Empty request user')
333
f5f290d68646 fixed auth bug
Marcin Kuzminski <marcin@python-works.com>
parents: 316
diff changeset
694 return False
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
695 self.user_perms = user.permissions
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
696 if self.check_permissions():
2125
097327aaf2ad more detailed logging on auth system
Marcin Kuzminski <marcin@python-works.com>
parents: 2109
diff changeset
697 log.debug('Permission granted for user: %s @ %s', user,
1117
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
698 check_Location or 'unspecified location')
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
699 return True
673
dd532af216d9 #49 Enabled anonymous access for web interface controllable from permissions pannel
Marcin Kuzminski <marcin@python-works.com>
parents: 629
diff changeset
700
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
701 else:
2125
097327aaf2ad more detailed logging on auth system
Marcin Kuzminski <marcin@python-works.com>
parents: 2109
diff changeset
702 log.debug('Permission denied for user: %s @ %s', user,
1117
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
703 check_Location or 'unspecified location')
673
dd532af216d9 #49 Enabled anonymous access for web interface controllable from permissions pannel
Marcin Kuzminski <marcin@python-works.com>
parents: 629
diff changeset
704 return False
dd532af216d9 #49 Enabled anonymous access for web interface controllable from permissions pannel
Marcin Kuzminski <marcin@python-works.com>
parents: 629
diff changeset
705
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
706 def check_permissions(self):
377
bd8b25ad058d Fixed decorators bug when using them with keyworded arguments,new implementation takes new approach that is more flexible
Marcin Kuzminski <marcin@python-works.com>
parents: 371
diff changeset
707 """Dummy function for overriding"""
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
708 raise Exception('You have to write this function in child class')
673
dd532af216d9 #49 Enabled anonymous access for web interface controllable from permissions pannel
Marcin Kuzminski <marcin@python-works.com>
parents: 629
diff changeset
709
1246
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
710
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
711 class HasPermissionAll(PermsFunction):
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
712 def check_permissions(self):
339
5d517bbf0a0d some extra checks for auth lib
Marcin Kuzminski <marcin@python-works.com>
parents: 333
diff changeset
713 if self.required_perms.issubset(self.user_perms.get('global')):
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
714 return True
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
715 return False
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
716
1246
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
717
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
718 class HasPermissionAny(PermsFunction):
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
719 def check_permissions(self):
339
5d517bbf0a0d some extra checks for auth lib
Marcin Kuzminski <marcin@python-works.com>
parents: 333
diff changeset
720 if self.required_perms.intersection(self.user_perms.get('global')):
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
721 return True
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
722 return False
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
723
1246
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
724
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
725 class HasRepoPermissionAll(PermsFunction):
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
726 def __call__(self, repo_name=None, check_Location=''):
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
727 self.repo_name = repo_name
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
728 return super(HasRepoPermissionAll, self).__call__(check_Location)
673
dd532af216d9 #49 Enabled anonymous access for web interface controllable from permissions pannel
Marcin Kuzminski <marcin@python-works.com>
parents: 629
diff changeset
729
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
730 def check_permissions(self):
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
731 if not self.repo_name:
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
732 self.repo_name = get_repo_slug(request)
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
733
339
5d517bbf0a0d some extra checks for auth lib
Marcin Kuzminski <marcin@python-works.com>
parents: 333
diff changeset
734 try:
2125
097327aaf2ad more detailed logging on auth system
Marcin Kuzminski <marcin@python-works.com>
parents: 2109
diff changeset
735 self._user_perms = set(
1982
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
736 [self.user_perms['repositories'][self.repo_name]]
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
737 )
339
5d517bbf0a0d some extra checks for auth lib
Marcin Kuzminski <marcin@python-works.com>
parents: 333
diff changeset
738 except KeyError:
5d517bbf0a0d some extra checks for auth lib
Marcin Kuzminski <marcin@python-works.com>
parents: 333
diff changeset
739 return False
2125
097327aaf2ad more detailed logging on auth system
Marcin Kuzminski <marcin@python-works.com>
parents: 2109
diff changeset
740 if self.required_perms.issubset(self._user_perms):
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
741 return True
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
742 return False
673
dd532af216d9 #49 Enabled anonymous access for web interface controllable from permissions pannel
Marcin Kuzminski <marcin@python-works.com>
parents: 629
diff changeset
743
1246
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
744
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
745 class HasRepoPermissionAny(PermsFunction):
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
746 def __call__(self, repo_name=None, check_Location=''):
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
747 self.repo_name = repo_name
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
748 return super(HasRepoPermissionAny, self).__call__(check_Location)
673
dd532af216d9 #49 Enabled anonymous access for web interface controllable from permissions pannel
Marcin Kuzminski <marcin@python-works.com>
parents: 629
diff changeset
749
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
750 def check_permissions(self):
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
751 if not self.repo_name:
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
752 self.repo_name = get_repo_slug(request)
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
753
339
5d517bbf0a0d some extra checks for auth lib
Marcin Kuzminski <marcin@python-works.com>
parents: 333
diff changeset
754 try:
2125
097327aaf2ad more detailed logging on auth system
Marcin Kuzminski <marcin@python-works.com>
parents: 2109
diff changeset
755 self._user_perms = set(
1982
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
756 [self.user_perms['repositories'][self.repo_name]]
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
757 )
339
5d517bbf0a0d some extra checks for auth lib
Marcin Kuzminski <marcin@python-works.com>
parents: 333
diff changeset
758 except KeyError:
5d517bbf0a0d some extra checks for auth lib
Marcin Kuzminski <marcin@python-works.com>
parents: 333
diff changeset
759 return False
2125
097327aaf2ad more detailed logging on auth system
Marcin Kuzminski <marcin@python-works.com>
parents: 2109
diff changeset
760 if self.required_perms.intersection(self._user_perms):
239
b18f89d6d17f Adde draft for permissions systems, made all needed decorators, and checks. For future usage in the system.
Marcin Kuzminski <marcin@python-works.com>
parents: 234
diff changeset
761 return True
b18f89d6d17f Adde draft for permissions systems, made all needed decorators, and checks. For future usage in the system.
Marcin Kuzminski <marcin@python-works.com>
parents: 234
diff changeset
762 return False
b18f89d6d17f Adde draft for permissions systems, made all needed decorators, and checks. For future usage in the system.
Marcin Kuzminski <marcin@python-works.com>
parents: 234
diff changeset
763
1246
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
764
1982
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
765 class HasReposGroupPermissionAny(PermsFunction):
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
766 def __call__(self, group_name=None, check_Location=''):
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
767 self.group_name = group_name
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
768 return super(HasReposGroupPermissionAny, self).__call__(check_Location)
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
769
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
770 def check_permissions(self):
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
771 try:
2125
097327aaf2ad more detailed logging on auth system
Marcin Kuzminski <marcin@python-works.com>
parents: 2109
diff changeset
772 self._user_perms = set(
1982
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
773 [self.user_perms['repositories_groups'][self.group_name]]
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
774 )
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
775 except KeyError:
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
776 return False
2125
097327aaf2ad more detailed logging on auth system
Marcin Kuzminski <marcin@python-works.com>
parents: 2109
diff changeset
777 if self.required_perms.intersection(self._user_perms):
1982
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
778 return True
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
779 return False
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
780
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
781
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
782 class HasReposGroupPermissionAll(PermsFunction):
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
783 def __call__(self, group_name=None, check_Location=''):
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
784 self.group_name = group_name
2634
4b17216f2110 Deprecated validation of operating system, we just care if it's windows, let approve all other
Marcin Kuzminski <marcin@python-works.com>
parents: 2479
diff changeset
785 return super(HasReposGroupPermissionAll, self).__call__(check_Location)
1982
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
786
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
787 def check_permissions(self):
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
788 try:
2125
097327aaf2ad more detailed logging on auth system
Marcin Kuzminski <marcin@python-works.com>
parents: 2109
diff changeset
789 self._user_perms = set(
1982
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
790 [self.user_perms['repositories_groups'][self.group_name]]
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
791 )
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
792 except KeyError:
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
793 return False
2125
097327aaf2ad more detailed logging on auth system
Marcin Kuzminski <marcin@python-works.com>
parents: 2109
diff changeset
794 if self.required_perms.issubset(self._user_perms):
1982
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
795 return True
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
796 return False
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
797
87f0800abc7b #227 Initial version of repository groups permissions system
Marcin Kuzminski <marcin@python-works.com>
parents: 1976
diff changeset
798
1246
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
799 #==============================================================================
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
800 # SPECIAL VERSION TO HANDLE MIDDLEWARE AUTH
1246
9365a893ad4e PEP8ify
Marcin Kuzminski <marcin@python-works.com>
parents: 1207
diff changeset
801 #==============================================================================
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
802 class HasPermissionAnyMiddleware(object):
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
803 def __init__(self, *perms):
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
804 self.required_perms = set(perms)
673
dd532af216d9 #49 Enabled anonymous access for web interface controllable from permissions pannel
Marcin Kuzminski <marcin@python-works.com>
parents: 629
diff changeset
805
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
806 def __call__(self, user, repo_name):
2100
f0649c7cf94a fixed some unicode problems with waitress
Marcin Kuzminski <marcin@python-works.com>
parents: 2045
diff changeset
807 # repo_name MUST be unicode, since we handle keys in permission
f0649c7cf94a fixed some unicode problems with waitress
Marcin Kuzminski <marcin@python-works.com>
parents: 2045
diff changeset
808 # dict by unicode
f0649c7cf94a fixed some unicode problems with waitress
Marcin Kuzminski <marcin@python-works.com>
parents: 2045
diff changeset
809 repo_name = safe_unicode(repo_name)
1117
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
810 usr = AuthUser(user.user_id)
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
811 try:
1117
6eb5bb24a948 Major rewrite of auth objects. Moved parts of filling user data into user model.
Marcin Kuzminski <marcin@python-works.com>
parents: 1116
diff changeset
812 self.user_perms = set([usr.permissions['repositories'][repo_name]])
2100
f0649c7cf94a fixed some unicode problems with waitress
Marcin Kuzminski <marcin@python-works.com>
parents: 2045
diff changeset
813 except Exception:
2109
8ecfed1d8f8b utils/conf
Marcin Kuzminski <marcin@python-works.com>
parents: 2105
diff changeset
814 log.error('Exception while accessing permissions %s' %
2100
f0649c7cf94a fixed some unicode problems with waitress
Marcin Kuzminski <marcin@python-works.com>
parents: 2045
diff changeset
815 traceback.format_exc())
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
816 self.user_perms = set()
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
817 self.username = user.username
673
dd532af216d9 #49 Enabled anonymous access for web interface controllable from permissions pannel
Marcin Kuzminski <marcin@python-works.com>
parents: 629
diff changeset
818 self.repo_name = repo_name
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
819 return self.check_permissions()
673
dd532af216d9 #49 Enabled anonymous access for web interface controllable from permissions pannel
Marcin Kuzminski <marcin@python-works.com>
parents: 629
diff changeset
820
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
821 def check_permissions(self):
2726
aa17c7a1b8a5 Implemented basic locking functionality.
Marcin Kuzminski <marcin@python-works.com>
parents: 2714
diff changeset
822 log.debug('checking VCS protocol '
1040
8e49b6ceffe1 fixes fixes fixes ! optimized queries on journal
Marcin Kuzminski <marcin@python-works.com>
parents: 1036
diff changeset
823 'permissions %s for user:%s repository:%s', self.user_perms,
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
824 self.username, self.repo_name)
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
825 if self.required_perms.intersection(self.user_perms):
2125
097327aaf2ad more detailed logging on auth system
Marcin Kuzminski <marcin@python-works.com>
parents: 2109
diff changeset
826 log.debug('permission granted for user:%s on repo:%s' % (
097327aaf2ad more detailed logging on auth system
Marcin Kuzminski <marcin@python-works.com>
parents: 2109
diff changeset
827 self.username, self.repo_name
097327aaf2ad more detailed logging on auth system
Marcin Kuzminski <marcin@python-works.com>
parents: 2109
diff changeset
828 )
097327aaf2ad more detailed logging on auth system
Marcin Kuzminski <marcin@python-works.com>
parents: 2109
diff changeset
829 )
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
830 return True
2125
097327aaf2ad more detailed logging on auth system
Marcin Kuzminski <marcin@python-works.com>
parents: 2109
diff changeset
831 log.debug('permission denied for user:%s on repo:%s' % (
097327aaf2ad more detailed logging on auth system
Marcin Kuzminski <marcin@python-works.com>
parents: 2109
diff changeset
832 self.username, self.repo_name
097327aaf2ad more detailed logging on auth system
Marcin Kuzminski <marcin@python-works.com>
parents: 2109
diff changeset
833 )
097327aaf2ad more detailed logging on auth system
Marcin Kuzminski <marcin@python-works.com>
parents: 2109
diff changeset
834 )
316
d6e2817734d2 Full rewrite of auth module, new functions/decorators. FIxed auth user
Marcin Kuzminski <marcin@python-works.com>
parents: 299
diff changeset
835 return False
3125
9b92cf5a0cca Added UserIpMap interface for allowed IP addresses and IP restriction access
Marcin Kuzminski <marcin@python-works.com>
parents: 2726
diff changeset
836
9b92cf5a0cca Added UserIpMap interface for allowed IP addresses and IP restriction access
Marcin Kuzminski <marcin@python-works.com>
parents: 2726
diff changeset
837
9b92cf5a0cca Added UserIpMap interface for allowed IP addresses and IP restriction access
Marcin Kuzminski <marcin@python-works.com>
parents: 2726
diff changeset
838 def check_ip_access(source_ip, allowed_ips=None):
9b92cf5a0cca Added UserIpMap interface for allowed IP addresses and IP restriction access
Marcin Kuzminski <marcin@python-works.com>
parents: 2726
diff changeset
839 """
9b92cf5a0cca Added UserIpMap interface for allowed IP addresses and IP restriction access
Marcin Kuzminski <marcin@python-works.com>
parents: 2726
diff changeset
840 Checks if source_ip is a subnet of any of allowed_ips.
9b92cf5a0cca Added UserIpMap interface for allowed IP addresses and IP restriction access
Marcin Kuzminski <marcin@python-works.com>
parents: 2726
diff changeset
841
9b92cf5a0cca Added UserIpMap interface for allowed IP addresses and IP restriction access
Marcin Kuzminski <marcin@python-works.com>
parents: 2726
diff changeset
842 :param source_ip:
9b92cf5a0cca Added UserIpMap interface for allowed IP addresses and IP restriction access
Marcin Kuzminski <marcin@python-works.com>
parents: 2726
diff changeset
843 :param allowed_ips: list of allowed ips together with mask
9b92cf5a0cca Added UserIpMap interface for allowed IP addresses and IP restriction access
Marcin Kuzminski <marcin@python-works.com>
parents: 2726
diff changeset
844 """
9b92cf5a0cca Added UserIpMap interface for allowed IP addresses and IP restriction access
Marcin Kuzminski <marcin@python-works.com>
parents: 2726
diff changeset
845 from rhodecode.lib import ipaddr
9b92cf5a0cca Added UserIpMap interface for allowed IP addresses and IP restriction access
Marcin Kuzminski <marcin@python-works.com>
parents: 2726
diff changeset
846 log.debug('checking if ip:%s is subnet of %s' % (source_ip, allowed_ips))
9b92cf5a0cca Added UserIpMap interface for allowed IP addresses and IP restriction access
Marcin Kuzminski <marcin@python-works.com>
parents: 2726
diff changeset
847 if isinstance(allowed_ips, (tuple, list, set)):
9b92cf5a0cca Added UserIpMap interface for allowed IP addresses and IP restriction access
Marcin Kuzminski <marcin@python-works.com>
parents: 2726
diff changeset
848 for ip in allowed_ips:
9b92cf5a0cca Added UserIpMap interface for allowed IP addresses and IP restriction access
Marcin Kuzminski <marcin@python-works.com>
parents: 2726
diff changeset
849 if ipaddr.IPAddress(source_ip) in ipaddr.IPNetwork(ip):
9b92cf5a0cca Added UserIpMap interface for allowed IP addresses and IP restriction access
Marcin Kuzminski <marcin@python-works.com>
parents: 2726
diff changeset
850 return True
9b92cf5a0cca Added UserIpMap interface for allowed IP addresses and IP restriction access
Marcin Kuzminski <marcin@python-works.com>
parents: 2726
diff changeset
851 return False