|
|
Mads Kiilerich
|
3edb29cfca8e
|
5 years ago
|
|
tests: always pass username as cur_user
Passing a whole User wouldn't work if actually using celery and thus serializing the parameters. The test scenario was thus different from actual runtime.
|
|
|
Mads Kiilerich
|
5e46f73f0d1c
|
5 years ago
|
|
|
|
|
Mads Kiilerich
|
b095e2fbba44
|
5 years ago
|
|
|
|
|
Mads Kiilerich
|
6fbbbd9a627a
|
5 years ago
|
|
db: move URL_SEP constant from db to top level kallithea module
URL_SEP is used in several places - having it in the db module is too high level.
__init__ might not be the best place for this, but it does no harm to the dependencies graph to place constants there.
|
|
|
Mads Kiilerich
|
1ecd6c0e2787
|
5 years ago
|
|
auth: refactor permissions
Avoid using complex vague typing in dict-of-dicts.
|
|
|
Mads Kiilerich
|
2ce710e81e61
|
6 years ago
|
|
permissions: drop hg.create.write_on_repogroup "Repository creation with group write access" setting
Simplify permissions system and get rid of some confusing tech debt.
Before, the global 'write_on_repogroup' setting controlled what write permission on a repo group meant.
With this change, users can create repositories in a repo group if and only if they have write access. Write access to a repo group will now mean the permission to create repositories in it.
Write access to repo groups must be granted explicitly. There should not be any other reason to grant write access than to allow users to create repos. There is thus no upgrade concerns for this change.
An admin that doesn't want users to create repos in a repogroup should just not give them write access.
These global settings might still exist in the database, but is ignored and no longer used and do no harm.
|
|
|
Mads Kiilerich
|
86bf2cd71a65
|
6 years ago
|
|
tests: fix TestPermissions.test_inactive_user_group_does_not_affect_repo_group_permissions_inverse
Handle L1_new leak from test_rename_top_level_group_in_nested_setup .
|
|
|
Mads Kiilerich
|
797767469152
|
6 years ago
|
|
|
|
|
Mads Kiilerich
|
2045d30919e6
|
6 years ago
|
|
|
|
|
Mads Kiilerich
|
6484a0fc0e0b
|
6 years ago
|
|
|
|
|
Mads Kiilerich
|
e63bcce18fef
|
6 years ago
|
|
|
|
|
Mads Kiilerich
|
e527cc2ce8dc
|
6 years ago
|
|
cleanup: get rid of most "import *"
Apply script generated with the following hack: ( hg loc '*.py'|xargs pyflakes-2 | sed -rn "s/([^:]*):.*'(.*)' may be undefined, or defined from star imports.*/sed -ri 's,\\\\<\2\\\\>([^=]|$),XXXX.\2\\\\1,g' \1/gp" | sort -u hg loc '*.py'|xargs pyflakes-2 | sed -rn "s/([^:]*):.* undefined name '(.*)'$/sed -ri 's,\\\\<\2\\\\>([^=]|$),XXXX.\2\\\\1,g' \1/gp" | sort -u hg loc '*.py'|xargs pyflakes-2 | sed -rn "s/([^:]*):.*'(from .*)\.([^.]*) import \*' used.*/sed -ri 's,\\\\<XXXX\\\\.,\3.,g' \1/gp" | sort -u hg loc '*.py'|xargs pyflakes-2 | sed -rn "s/([^:]*):.*'(from .*)\.([^.]*) import \*' used.*/sed -ri 's,\2\\\\.\3 .*,\2 import \3,g' \1/gp" | sort -u ) | grep -v kallithea/bin/kallithea_cli_ishell.py > fix2.sh
|
|
|
Mads Kiilerich
|
0a277465fddf
|
6 years ago
|
|
|
|
|
Mads Kiilerich
|
6d0573ba0721
|
7 years ago
|
|
auth: drop "multiple_counter" from computing permissions
This seems to have been something about having some permissions override existing permissions. It is not clear to me why anybody should want that.
test_user_group_permissions_on_repo_groups.py seems to have been testing for something we don't want. The new behaviour seems more reasonable. The test user is inhering access from the default user, and thus in this case getting read access (except when private).
|
|
|
Mads Kiilerich
|
8eed16b2a99b
|
7 years ago
|
|
auth: minor refactoring of computation of admin access for repo owners
Make the flow slightly simpler ... and now when permissions are merged, we only have to set repo owner access once.
BUT: because multiple_counter, we actually don't merge permissions in all cases. This will thus introduce a regression that will be fixed in next changeset.
|
|
|
Mads Kiilerich
|
b2634df81a11
|
7 years ago
|
|
auth: explicit user permission should not blindly overrule permissions through user groups
Before, explicit permissions of a user could shadow higher permissions that would otherwise be obtained through a group the user is member of. That was confusing and fragile: *removing* a permission could then suddenly give a user *more* permissions.
Instead, change the flag for controlling internal permission computation to *not* use "explicit". Permissions will then add up, no matter if they are explicit or through groups.
The change in auth.py is small, but read the body of __get_perms to see the actual impact ... and also the clean-up changeset that will come next.
This might in some cases be a behaviour change and give users more access ... but it will probably only give the user that was intended. This change can thus be seen as a bugfix.
Some tests assumed the old behaviour. Not for good reasons, but just because that is how they were written. These tests are updated to expect the new behaviour, and it has been reviewed that it makes sense.
Note that this 'explicit' flag mostly is for repo permissions and independent of the 'user_inherit_default_permissions' that just was removed and is about global permissions.
|
|
|
Mads Kiilerich
|
93834966ae01
|
7 years ago
|
|
auth: global permissions given to the default user are the bare minimum and should apply to *all* other users too
Drop the "subtractive permission" config option "inherit_from_default" that when set to false would give users less global permissions than the default unauthenticated user.
Instead, think positive and merge all positive permissions.
At the end, filter the global permissions to make sure we for each kind of permissions only keep the one with most weight.
|
|
|
Lars Kruse
|
48a00daba2f2
|
8 years ago
|
|
codingstyle: replace comparison for equality against None with "is" expression
Both style and correctness.
Reported by flake8.
|
|
|
Lars Kruse
|
7691290837d2
|
8 years ago
|
|
codingstyle: trivial whitespace fixes
Reported by flake8.
|
|
|
Mads Kiilerich
|
95e149edc46c
|
8 years ago
|
|
sqlalchemy: fix warnings from running the test suite
Mainly warnings about strings being passed where unicode was expected.
|
|
|
Søren Løvborg
|
4136526cce20
|
9 years ago
|
|
db: remove superfluous Session.add calls
Don't re-add objects to the SQLAlchemy Session just because they were modified. Session.add is only for freshly constructed objects that SQLAlchemy doesn't know about yet.
The rules are quite simple:
When creating a database object by calling the constructor directly, it must explicitly be added to the session.
When creating an object using a factory function (like "create_repo"), the returned object has already (by convention) been added to the session, and should not be added again.
When getting an object from the session (via Session.query or any of the utility functions that look up objects in the database), it's already added, and should not be added again. SQLAlchemy notices attribute modifications automatically for all objects it knows about.
|
|
|
Thomas De Schampheleire
|
8d98924c58b1
|
9 years ago
|
|
tests: add as little code as possible in __init__.py
kallithea/tests/__init__.py contained quite a lot of code, including the test base class TestController. This in itself may be considered bad practice.
Specifically, this poses a problem when using pytest 3.0+, in which asserts in some files are not automatically rewritten to give improved assert output. That problem can be fixed by explicitly registering such files for assertion rewriting, but that register call should be executed _before_ said files are imported. I.e. if the register call is in kallithea/tests/__init__.py, assert calls in __init__.py itself can not be rewritten.
Since the TestController base class does effectively contain asserts, and we do not want to execute the register call from somewhere outside the kallithea/tests directory, we need to move the TestController class to another file (kallithea/tests/base.py) so we can have a register call in __init__.py before loading base.py.
While not strictly necessary to fix the mentioned pytest problem, we take the opportunity to fully clean __init__.py and move everything to the new kallithea/tests/base.py. While doing so, unnecessary imports are removed, and imports are ordered alphabetically. Explicit imports of symbols from modules that were already imported as a whole, are removed in favor of fully qualifying the references (e.g. tempfile._RandomNameSequence).
|
|
|
domruf
|
05c67c3ef222
|
9 years ago
|
|
|
|
|
Thomas De Schampheleire
|
7f2aa3ec2931
|
10 years ago
|
|
pytest migration: rename TestControllerPytest back to TestController
The name TestControllerPytest was introduced to allow a temporary situation where nose/unittest and pytest-based tests could coexist. This situation is now over, so the base test class can be renamed again.
|
|
|
Thomas De Schampheleire
|
7483b3f3bea5
|
10 years ago
|
|
pytest migration: models: switch to standard assert statements Use unittest2pytest to replace unittest-style assert statements (e.g. assertEqual) with standard Python assert statements to benefit from pytest's improved reporting on assert failures. The conversion by unittest2pytest was correct except for: - 'import pytest' is not automatically added when needed - line wrapping in string formatting caused a syntax error in the transformed code. Reported upstream at https://github.com/pytest-dev/unittest2pytest/issues/3 . - in assertRaises with a lambda, the lambda needs to be removed
|
|
|
timeless@gmail.com
|
f8a3a2c8687b
|
10 years ago
|
|
|
|
|
Thomas De Schampheleire
|
be1d20bfd2dd
|
10 years ago
|
|
pytest migration: model: convert all tests to TestControllerPytest
The model tests were based on BaseTestCase which does not exist currently for pytest-style tests. Nevertheless, there seems to be no advantage of directly subclassing BaseTestCase over subclassing TestControllerPytest. Thus, keep things simple and use TestControllerPytest.
|
|
|
Mads Kiilerich
|
bd4840ad72d3
|
10 years ago
|
|
tests: more consistently use unicode where unicode is expected
Nothing but extra u annotation to turn str constants into unicode.
This has been verified by hacking sqlalchemy to fail if wrong string types are passed.
|
|
|
Mads Kiilerich
|
6077644fca45
|
10 years ago
|
|
|
|
|
Mads Kiilerich
|
edb24bc0f71a
|
10 years ago
|
|
|
|
|
Mads Kiilerich
|
148360f533a4
|
10 years ago
|
|
|
|
|
Mads Kiilerich
|
9d87b8d5ba00
|
10 years ago
|
|
auth: ignore permissions from in-active user groups (Issue #138)
Tests by Thomas De Schampheleire.
Additionally, rename the unused and seemingly search-replace-massacred function revokehas_permrevoke_permgrant_perm_perm into revoke_perm.
|
|
|
Thomas De Schampheleire
|
b8c657874b7a
|
10 years ago
|
|
|
|
|
Bradley M. Kuhn
|
d1addaf7a91e
|
11 years ago
|
|
Second step in two-part process to rename directories. This is the actual directory rename.
|