import kallithea.lib.locale

import kallithea.model.base

import kallithea.model.meta

from kallithea.lib import celerypylons

from kallithea.lib.middleware.https_fixup import HttpsFixup

from kallithea.lib.middleware.permanent_repo_url import PermanentRepoUrl

from kallithea.lib.middleware.simplegit import SimpleGit

from kallithea.lib.middleware.simplehg import SimpleHg

from kallithea.lib.middleware.wrapper import RequestWrapper

from kallithea.lib.utils import check_git_version, load_rcextensions, set_app_settings, set_indexer_config, set_vcs_config

from kallithea.lib.utils2 import str2bool

log = logging.getLogger(__name__)

class KallitheaAppConfig(AppConfig):

    # Note: AppConfig has a misleading name, as it's not the application

    # configuration, but the application configurator. The AppConfig values are

    # used as a template to create the actual configuration, which might

    # overwrite or extend the one provided by the configurator template.

    # To make it clear, AppConfig creates the config and sets into it the same

            current_heads = sorted(str(s) for s in context.get_current_heads())

        if current_heads != available_heads:

            log.error('Failed to run Kallithea:\n\n'

                      'The database version does not match the Kallithea version.\n'

                      'Please read the documentation on how to upgrade or downgrade the database.\n'

                      'Current database version id(s): %s\n'

                      'Expected database version id(s): %s\n'

                      'If you are a developer and you know what you are doing, you can add `ignore_alembic_revision = True` '

                      'to your .ini file to skip the check.\n' % (' '.join(current_heads), ' '.join(available_heads)))

            sys.exit(1)

    # store some globals into kallithea

    if str2bool(config.get('use_celery')):

        kallithea.CELERY_APP = celerypylons.make_app()

    kallithea.CONFIG = config

    load_rcextensions(root_path=config['here'])

    set_app_settings(config)

    instance_id = kallithea.CONFIG.get('instance_id', '*')

    if instance_id == '*':

        instance_id = '%s-%s' % (platform.uname()[1], os.getpid())

        kallithea.CONFIG['instance_id'] = instance_id

from tg.i18n import ugettext as _

from webob.exc import HTTPForbidden, HTTPFound, HTTPInternalServerError, HTTPNotFound

import kallithea

from kallithea.config.routing import url

from kallithea.lib import helpers as h

from kallithea.lib.auth import HasPermissionAny, HasRepoPermissionLevelDecorator, LoginRequired, NotAnonymous

from kallithea.lib.base import BaseRepoController, jsonify, render

from kallithea.lib.exceptions import AttachedForksError

from kallithea.lib.utils import action_logger

from kallithea.lib.utils2 import safe_int

from kallithea.lib.vcs import RepositoryError

from kallithea.model.forms import RepoFieldForm, RepoForm, RepoPermsForm

from kallithea.model.meta import Session

from kallithea.model.repo import RepoModel

from kallithea.model.scm import AvailableRepoGroupChoices, RepoList, ScmModel

log = logging.getLogger(__name__)

class ReposController(BaseRepoController):

    """

    REST Controller styled on the Atom Publishing Protocol"""

        try:

            Session().delete(field)

            Session().commit()

        except Exception as e:

            log.error(traceback.format_exc())

            msg = _('An error occurred during removal of field')

            h.flash(msg, category='error')

        raise HTTPFound(location=url('edit_repo_fields', repo_name=repo_name))

    @HasRepoPermissionLevelDecorator('admin')

    def edit_advanced(self, repo_name):

        c.repo_info = self._load_repo()

        c.in_public_journal = UserFollowing.query() \

            .filter(UserFollowing.user_id == c.default_user_id) \

            .filter(UserFollowing.follows_repository == c.repo_info).scalar()

        _repos = Repository.query(sorted=True).all()

        read_access_repos = RepoList(_repos, perm_level='read')

        c.repos_list = [(None, _('-- Not a fork --'))]

        c.repos_list += [(x.repo_id, x.repo_name)

                         for x in read_access_repos

                         if x.repo_id != c.repo_info.repo_id

                         and x.repo_type == c.repo_info.repo_type]

    @HasRepoPermissionLevelDecorator('admin')

    def edit_advanced_journal(self, repo_name):

        """

        Sets this repository to be visible in public journal,

        in other words asking default user to follow this repo

        :param repo_name:

        """

        try:

            repo_id = Repository.get_by_repo_name(repo_name).repo_id

            self.scm_model.toggle_following_repo(repo_id, user_id)

            h.flash(_('Updated repository visibility in public journal'),

                    category='success')

            Session().commit()

        except Exception:

            h.flash(_('An error occurred during setting this'

                      ' repository in public journal'),

                    category='error')

        raise HTTPFound(location=url('edit_repo_advanced', repo_name=repo_name))

    @HasRepoPermissionLevelDecorator('admin')

    def edit_advanced_fork(self, repo_name):

import logging

import traceback

import formencode

from formencode import htmlfill

from sqlalchemy.sql.expression import func

from tg import app_globals, request

from tg import tmpl_context as c

from tg.i18n import ugettext as _

from webob.exc import HTTPFound, HTTPNotFound

from kallithea.config.routing import url

from kallithea.lib import auth_modules

from kallithea.lib import helpers as h

from kallithea.lib.auth import AuthUser, HasPermissionAnyDecorator, LoginRequired

from kallithea.lib.base import BaseController, IfSshEnabled, render

from kallithea.lib.exceptions import DefaultUserException, UserCreationError, UserOwnsReposException

from kallithea.lib.utils import action_logger

from kallithea.lib.utils2 import datetime_to_time, generate_api_key, safe_int

from kallithea.model.api_key import ApiKeyModel

from kallithea.model.db import User, UserEmailMap, UserIpMap, UserToPerm

from kallithea.model.forms import CustomDefaultPermissionsForm, UserForm

from kallithea.model.meta import Session

        user_model.delete_extra_email(id, email_id)

        Session().commit()

        h.flash(_("Removed email from user"), category='success')

        raise HTTPFound(location=url('edit_user_emails', id=id))

    def edit_ips(self, id):

        c.user = self._get_user_or_raise_if_default(id)

        c.active = 'ips'

        c.user_ip_map = UserIpMap.query() \

            .filter(UserIpMap.user == c.user).all()

        c.default_user_ip_map = UserIpMap.query() \

        defaults = c.user.get_dict()

        return htmlfill.render(

            render('admin/users/user_edit.html'),

            defaults=defaults,

            encoding="UTF-8",

            force_defaults=False)

    def add_ip(self, id):

        ip = request.POST.get('new_ip')

        user_model = UserModel()

"""

import logging

import traceback

import formencode

from formencode import htmlfill

from tg import request

from tg import tmpl_context as c

from tg.i18n import ugettext as _

from webob.exc import HTTPFound

import kallithea.lib.helpers as h

from kallithea.config.routing import url

from kallithea.lib.auth import HasPermissionAny, HasPermissionAnyDecorator, HasRepoPermissionLevel, HasRepoPermissionLevelDecorator, LoginRequired

from kallithea.lib.base import BaseRepoController, render

from kallithea.lib.page import Page

from kallithea.lib.utils2 import safe_int

from kallithea.model.forms import RepoForkForm

from kallithea.model.repo import RepoModel

from kallithea.model.scm import AvailableRepoGroupChoices, ScmModel

log = logging.getLogger(__name__)

class ForksController(BaseRepoController):

    def __load_defaults(self):

        if HasPermissionAny('hg.create.write_on_repogroup.true')():

        """

        Load defaults settings for edit, and update

        """

        self.__load_defaults()

        c.repo_info = c.db_repo

        repo = c.db_repo.scm_instance

        if c.repo_info is None:

            h.not_mapped_error(c.repo_name)

            raise HTTPFound(location=url('repos'))

        c.in_public_journal = UserFollowing.query() \

            .filter(UserFollowing.user_id == c.default_user_id) \

            .filter(UserFollowing.follows_repository == c.repo_info).scalar()

        if c.repo_info.stats:

            last_rev = c.repo_info.stats.stat_on_revision + 1

        else:

            last_rev = 0

        c.stats_revision = last_rev

        c.repo_last_rev = repo.count() if repo.revisions else 0

import os

import string

import bcrypt

import ipaddr

from decorator import decorator

from sqlalchemy.orm import joinedload

from sqlalchemy.orm.exc import ObjectDeletedError

from tg import request

from tg.i18n import ugettext as _

from webob.exc import HTTPForbidden, HTTPFound

from kallithea.config.routing import url

from kallithea.lib.utils import get_repo_group_slug, get_repo_slug, get_user_group_slug

from kallithea.lib.utils2 import ascii_bytes, ascii_str, safe_bytes

from kallithea.lib.vcs.utils.lazy import LazyProperty

                                UserGroupUserGroupToPerm, UserIpMap, UserToPerm)

from kallithea.model.meta import Session

from kallithea.model.user import UserModel

log = logging.getLogger(__name__)

class PasswordGenerator(object):

    """

    This is a simple class for generating password from different sets of

    characters

        Assuming the permissions are comparable, set the new permission if it

        has higher weight, else drop it and keep the old permission.

        """

        cur_perm = permissions[kind][key]

        new_perm_val = PERM_WEIGHTS[new_perm]

        cur_perm_val = PERM_WEIGHTS[cur_perm]

        if new_perm_val > cur_perm_val:

            permissions[kind][key] = new_perm

    #======================================================================

    # fetch default permissions

    #======================================================================

    if user_is_admin:

        #==================================================================

        # admin users have all rights;

        # based on default permissions, just set everything to admin

        #==================================================================

        permissions[GLOBAL].add('hg.admin')

        permissions[GLOBAL].add('hg.create.write_on_repogroup.true')

        # repositories

        for perm in default_repo_perms:

            r_k = perm.repository.repo_name

        for perm in default_user_group_perms:

            u_k = perm.user_group.users_group_name

            p = 'usergroup.admin'

            permissions[UK][u_k] = p

        return permissions

    #==================================================================

    # SET DEFAULTS GLOBAL, REPOS, REPOSITORY GROUPS

    #==================================================================

    # default global permissions taken from the default user

    default_global_perms = UserToPerm.query() \

        .options(joinedload(UserToPerm.permission))

    for perm in default_global_perms:

        permissions[GLOBAL].add(perm.permission.permission_name)

    # defaults for repositories, taken from default user

    for perm in default_repo_perms:

        r_k = perm.repository.repo_name

        if perm.repository.owner_id == user_id:

            p = 'repository.admin'

        elif perm.repository.private:

            p = 'repository.none'

        Deserializes an `AuthUser` from a cookie `dict` ... or return None.

        """

        return AuthUser.make(

            dbuser=UserModel().get(cookie.get('user_id')),

            is_external_auth=cookie.get('is_external_auth', False),

            ip_addr=ip_addr,

        )

    @classmethod

    def get_allowed_ips(cls, user_id):

        _set = set()

        for ip in default_ips:

            try:

                _set.add(ip.ip_addr)

            except ObjectDeletedError:

                # since we use heavy caching sometimes it happens that we get

                # deleted objects here, we just skip them

                pass

        user_ips = UserIpMap.query().filter(UserIpMap.user_id == user_id)

        for ip in user_ips:

            try:

                _set.add(ip.ip_addr)

@pytest.fixture

def auto_clear_ip_permissions():

    """Fixture that provides nothing but clearing IP permissions upon test

    exit. This clearing is needed to avoid other test failing to make fake http

    accesses."""

    yield

    # cleanup

    user_model = UserModel()

    user_ids = []

    user_ids.append(User.get_by_username(TEST_USER_REGULAR_LOGIN).user_id)

    for user_id in user_ids:

        for ip in UserIpMap.query().filter(UserIpMap.user_id == user_id):

            user_model.delete_extra_ip(user_id, ip.ip_id)

    # IP permissions are cached, need to invalidate this cache explicitly

    invalidate_all_caches()

    session = Session()

    session.commit()

from kallithea.model.db import User, UserIpMap

from kallithea.tests import base

class TestAdminPermissionsController(base.TestController):

    def test_index(self):

        self.log_user()

        response = self.app.get(base.url('admin_permissions'))

        # Test response...

    def test_index_ips(self):

        self.log_user()

        response = self.app.get(base.url('admin_permissions_ips'))

        # Test response...

        response.mustcontain('All IP addresses are allowed')

    def test_add_delete_ips(self, auto_clear_ip_permissions):

        self.log_user()

        # Add IP and verify it is shown in UI and both gives access and rejects

        response = self.app.post(base.url('edit_user_ips_update', id=default_user_id),

                                 params=dict(new_ip='0.0.0.0/24',

                                 _session_csrf_secret_token=self.session_csrf_secret_token()))

        base.invalidate_all_caches()

        response = self.app.get(base.url('admin_permissions_ips'),

                                extra_environ={'REMOTE_ADDR': '0.0.0.1'})

        response.mustcontain('0.0.0.0/24')

        response.mustcontain('0.0.0.0 - 0.0.0.255')

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

import pytest

from sqlalchemy.orm.exc import NoResultFound

from tg.util.webtest import test_context

from webob.exc import HTTPNotFound

from kallithea.controllers.admin.users import UsersController

from kallithea.lib import helpers as h

from kallithea.lib.auth import check_password

from kallithea.model import validators

from kallithea.model.db import Permission, RepoGroup, User, UserApiKeys, UserSshKeys

from kallithea.model.meta import Session

from kallithea.model.user import UserModel

from kallithea.tests import base

from kallithea.tests.fixture import Fixture

fixture = Fixture()

    def test_get_user_or_raise_if_default(self, monkeypatch, test_context_fixture):

        # flash complains about an non-existing session

        def flash_mock(*args, **kwargs):

            pass

        monkeypatch.setattr(h, 'flash', flash_mock)

        u = UsersController()

        # a regular user should work correctly

        user = User.get_by_username(base.TEST_USER_REGULAR_LOGIN)

        assert u._get_user_or_raise_if_default(user.user_id) == user

        # the default user should raise

        with pytest.raises(HTTPNotFound):

class TestAdminUsersControllerForDefaultUser(base.TestController):

    """

    Edit actions on the default user are not allowed.

    Validate that they throw a 404 exception.

    """

    def test_edit_default_user(self):

        self.log_user()

        user = User.get_default_user()

        response = self.app.get(base.url('edit_user', id=user.user_id), status=404)

import functools

from kallithea.model.meta import Session

from kallithea.model.repo_group import RepoGroupModel

from kallithea.tests.models.common import _check_expected_count, _create_project_tree, _destroy_project_tree, _get_perms, check_tree_perms, expected_count

test_u1_id = None

_get_repo_perms = None

_get_group_perms = None

def permissions_setup_func(group_name='g0', perm='group.read', recursive='all',

                           user_id=None):

    """

    Resets all permissions to perm attribute

    """

    if not user_id:

        user_id = test_u1_id

        permissions_setup_func(group_name, perm, recursive,

    repo_group = RepoGroup.get_by_group_name(group_name=group_name)

    if not repo_group:

        raise Exception('Cannot get group %s' % group_name)

    # Start with a baseline that current group can read recursive

    perms_updates = [[user_id, 'group.read', 'user']]

    RepoGroupModel()._update_permissions(repo_group,

                                         perms_updates=perms_updates,

                                         recursive='all', check_perms=False)

    perms_updates = [[user_id, perm, 'user']]

        check_tree_perms(name, perm, group, 'repository.write')

    for name, perm in items:

        check_tree_perms(name, perm, group, 'group.write')

def test_user_permissions_on_group_with_recursive_mode_for_default_user():

    # set permission to g0 recursive mode, all children including

    # other repos and groups should have this permission now set !

    recursive = 'all'

    group = 'g0'

    permissions_setup_func(group, 'group.write', recursive=recursive,

                           user_id=default_user_id)

    # change default to get perms for default user

    _get_repo_perms = functools.partial(_get_perms, key='repositories',

                                        test_u1_id=default_user_id)

    _get_group_perms = functools.partial(_get_perms, key='repositories_groups',

                                         test_u1_id=default_user_id)

    repo_items = [x for x in _get_repo_perms(group, recursive)]

    items = [x for x in _get_group_perms(group, recursive)]

    _check_expected_count(items, repo_items, expected_count(group, True))

        check_tree_perms(name, perm, group, 'repository.admin')

    for name, perm in items:

        check_tree_perms(name, perm, group, 'group.admin')

def test_user_permissions_on_group_with_recursive_repo_mode_for_default_user():

    # set permission to g0/g0_1 recursive repos only mode, all children including

    # other repos should have this permission now set, inner groups are excluded!

    recursive = 'repos'

    group = 'g0/g0_1'

    perm = 'group.none'

    permissions_setup_func(group, perm, recursive=recursive,

                           user_id=default_user_id)

    # change default to get perms for default user

    _get_repo_perms = functools.partial(_get_perms, key='repositories',

                                        test_u1_id=default_user_id)

    _get_group_perms = functools.partial(_get_perms, key='repositories_groups',

                                         test_u1_id=default_user_id)

    repo_items = [x for x in _get_repo_perms(group, recursive)]

    items = [x for x in _get_group_perms(group, recursive)]

        old_perm = 'group.read'

        if name == group:

            old_perm = perm

        check_tree_perms(name, perm, group, old_perm)

def test_user_permissions_on_group_with_recursive_group_mode_for_default_user():

    # set permission to g0/g0_1 with recursive groups only mode, all children including

    # other groups should have this permission now set. repositories should

    # remain intact as we use groups only mode !

    recursive = 'groups'

    group = 'g0/g0_1'

    permissions_setup_func(group, 'group.write', recursive=recursive,

                           user_id=default_user_id)

    # change default to get perms for default user

    _get_repo_perms = functools.partial(_get_perms, key='repositories',

                                        test_u1_id=default_user_id)

    _get_group_perms = functools.partial(_get_perms, key='repositories_groups',

                                         test_u1_id=default_user_id)

    repo_items = [x for x in _get_repo_perms(group, recursive)]

    items = [x for x in _get_group_perms(group, recursive)]

    _check_expected_count(items, repo_items, expected_count(group, True))