:created_on: May 09, 2013

:author: marcink

:copyright: (c) 2013 RhodeCode GmbH, and others.

:license: GPLv3, see LICENSE.md for more details.

"""

import os

import sys

import random

import urllib2

import pprint

CONFIG_NAME = '.config/kallithea'

FORMAT_PRETTY = 'pretty'

FORMAT_JSON = 'json'

def api_call(apikey, apihost, method=None, **kw):

    """

    Api_call wrapper for Kallithea.

    :param apikey:

    :param apihost:

                             '--apikey or --apihost in params')

    apikey = args.apikey or conf['apikey']

    apihost = args.apihost or conf['apihost']

    method = args.method

    # if we don't have method here it's an error

    if not method:

        parser.error('Please specify method name')

    try:

        margs = dict(map(lambda s: s.split(':', 1), other))

        sys.stderr.write('Error parsing arguments \n')

        sys.exit()

    if args.format == FORMAT_PRETTY:

        print 'Calling method %s => %s' % (method, apihost)

    json_resp = api_call(apikey, apihost, method, **margs)

    error_prefix = ''

    if json_resp['error']:

        error_prefix = 'ERROR:'

        json_data = json_resp['error']

    else:

        json_data = json_resp['result']

        from mako import exceptions

        print exceptions.text_error_template().render()

def main(argv=None):

    """

    Main execution function for cli

    :param argv:

    """

    if argv is None:

        argv = sys.argv

if __name__ == '__main__':

    sys.exit(main(sys.argv))

This file was forked by the Kallithea project in July 2014.

Original author and date, and relevant copyright and licensing information is below:

:created_on: Mar 06, 2013

:author: marcink

:copyright: (c) 2013 RhodeCode GmbH, and others.

:license: GPLv3, see LICENSE.md for more details.

"""

import ldap

import urllib2

import uuid

from ConfigParser import ConfigParser

config = ConfigParser()

config.read('ldap_sync.conf')

class InvalidResponseIDError(Exception):

    """ Request and response don't have the same UUID. """

class ResponseError(Exception):

    @LoginRequired()

    def __before__(self):

        super(AdminController, self).__before__()

    @HasPermissionAllDecorator('hg.admin')

    def index(self):

        users_log = UserLog.query()\

                .options(joinedload(UserLog.user))\

                .options(joinedload(UserLog.repository))

        #FILTERING

        c.search_term = request.GET.get('filter')

        users_log = users_log.order_by(UserLog.action_date.desc())

        p = safe_int(request.GET.get('page', 1), 1)

        def url_generator(**kw):

            return url.current(filter=c.search_term, **kw)

        c.users_log = Page(users_log, page=p, items_per_page=10, url=url_generator)

        c.log_data = render('admin/admin_log.html')

        if request.environ.get('HTTP_X_PARTIAL_XHR'):

        )

        for repo_gr in group_iter:

            children_groups = map(h.safe_unicode,

                itertools.chain((g.name for g in repo_gr.parents),

                                (x.name for x in [repo_gr])))

            repo_count = repo_gr.repositories.count()

            repo_groups_data.append({

                "raw_name": repo_gr.group_name,

                "group_name": repo_group_name(repo_gr.group_name, children_groups),

                "desc": repo_gr.group_description,

                "repos": repo_count,

                "action": repo_group_actions(repo_gr.group_id, repo_gr.group_name,

                                             repo_count)

            })

        c.data = json.dumps({

            "totalRecords": total_records,

            "startIndex": 0,

            "sort": None,

            "dir": "asc",

            "records": repo_groups_data

        })

            install_git_hooks = request.POST.get('hooks', False)

            invalidate_cache = request.POST.get('invalidate', False)

            log.debug('rescanning repo location with destroy obsolete=%s and '

                      'install git hooks=%s' % (rm_obsolete,install_git_hooks))

            if invalidate_cache:

                log.debug('invalidating all repositories cache')

                for repo in Repository.get_all():

                    ScmModel().mark_for_invalidation(repo.repo_name, delete=True)

            filesystem_repos = ScmModel().repo_scan()

            added, removed = repo2db_mapper(filesystem_repos, rm_obsolete,

            return redirect(url('admin_settings_mapping'))

        defaults = Setting.get_app_settings()

        defaults.update(self._get_hg_ui_settings())

        return htmlfill.render(

            render('admin/settings/settings.html'),

            defaults=defaults,

            encoding="UTF-8",

            force_defaults=False)

    @HasPermissionAllDecorator('hg.admin')

        })

        return render('admin/user_groups/user_groups.html')

    @HasPermissionAnyDecorator('hg.admin', 'hg.usergroup.create.true')

    def create(self):

        """POST /users_groups: Create a new item"""

        # url('users_groups')

        users_group_form = UserGroupForm()()

        try:

            form_result = users_group_form.to_python(dict(request.POST))

            gr = form_result['users_group_name']

            action_logger(self.authuser,

                          'admin_created_users_group:%s' % gr,

                          None, self.ip_addr, self.sa)

            Session().commit()

        except formencode.Invalid, errors:

            return htmlfill.render(

                render('admin/user_groups/user_group_add.html'),

                defaults=errors.value,

                errors=errors.error_dict or {},

                prefix_error=False,

                encoding="UTF-8")

        except Exception:

            log.error(traceback.format_exc())

            h.flash(_('Error occurred during creation of user group %s') \

                    % request.POST.get('users_group_name'), category='error')

                template.get_def("user_gravatar")

                .render(user_email, size, _=_, h=h, c=c))

        username = lambda user_id, username: (

                template.get_def("user_name")

                .render(user_id, username, _=_, h=h, c=c))

        user_actions = lambda user_id, username: (

                template.get_def("user_actions")

                .render(user_id, username, _=_, h=h, c=c))

        for user in c.users_list:

            users_data.append({

                "raw_name": user.username,

                "username": username(user.user_id, user.username),

                "firstname": user.name,

                "lastname": user.lastname,

                "last_login": h.fmt_date(user.last_login),

                "last_login_raw": datetime_to_time(user.last_login),

                "active": h.boolicon(user.active),

                "admin": h.boolicon(user.admin),

                "extern_type": user.extern_type,

                "extern_name": user.extern_name,

                "action": user_actions(user.user_id, user.username),

            })

        })

        return render('admin/users/users.html')

    def create(self):

        """POST /users: Create a new item"""

        # url('users')

        c.default_extern_type = auth_modules.auth_internal.KallitheaAuthPlugin.name

        user_model = UserModel()

        user_form = UserForm()()

        try:

            form_result = user_form.to_python(dict(request.POST))

            usr = form_result['username']

            action_logger(self.authuser, 'admin_created_user:%s' % usr,

                          None, self.ip_addr, self.sa)

                    category='success')

            Session().commit()

        except formencode.Invalid, errors:

            return htmlfill.render(

                render('admin/users/user_add.html'),

                defaults=errors.value,

                errors=errors.error_dict or {},

                prefix_error=False,

                encoding="UTF-8")

        except UserCreationError, e:

            h.flash(e, 'error')

        except Exception:

        params[k] += GET.getall(k)

def anchor_url(revision, path, GET):

    fid = h.FID(revision, path)

    return h.url.current(anchor=fid, **dict(GET))

def get_ignore_ws(fid, GET):

    ig_ws_global = GET.get('ignorews')

    ig_ws = filter(lambda k: k.startswith('WS'), GET.getall(fid))

    if ig_ws:

    return ig_ws_global

def _ignorews_url(GET, fileid=None):

    fileid = str(fileid) if fileid else None

    params = defaultdict(list)

    _update_with_GET(params, GET)

    lbl = _('Show whitespace')

    ig_ws = get_ignore_ws(fileid, GET)

    ln_ctx = get_line_ctx(fileid, GET)

    # global option

    if fileid is None:

    This behavior can be altered by changing the parameters to the

    ErrorDocuments middleware in your config/middleware.py file.

    """

    def __before__(self):

        #disable all base actions since we don't need them here

        pass

    def document(self):

        resp = request.environ.get('pylons.original_response')

        c.site_name = config.get('title')

        e = request.environ

        c.serv_p = r'%(protocol)s://%(host)s/' \

                                    % {'protocol': e.get('wsgi.url_scheme'),

                                       'host': e.get('HTTP_HOST'), }

        return render('/errors/error_document.html')

    def img(self, id):

        """Serve Pylons' stock images"""

        return self._serve_file(os.path.join(media_path, 'img', id))

    def style(self, id):

        """Serve Pylons' stock stylesheets"""

        return self._serve_file(os.path.join(media_path, 'style', id))

    def _serve_file(self, path):

        """Call Paste's FileApp (a WSGI application) to serve the file

        at the specified path

        """

        fapp = paste.fileapp.FileApp(path)

        return fapp(request.environ, self.start_response)

    def get_error_explanation(self, code):

        """ get the error explanations of int codes

            [400, 401, 403, 404, 500]"""

        try:

            code = int(code)

            code = 500

        if code == 400:

            return _('The request could not be understood by the server'

                     ' due to malformed syntax.')

        if code == 401:

            return _('Unauthorized access to resource')

        if code == 403:

            return _("You don't have permission to view this page")

        if code == 404:

            return _('The resource could not be found')

        if code == 500:

                for a in set([x.author for x in _hist]):

                    c.authors.append((h.email(a), h.person(a)))

            else:

                c.authors = c.file_history = []

        except RepositoryError, e:

            h.flash(safe_str(e), category='error')

            raise HTTPNotFound()

        if request.environ.get('HTTP_X_PARTIAL_XHR'):

            return render('files/files_ypjax.html')

        # TODO: tags and bookmarks?

                              _('%s at %s') % (c.changeset.branch, h.short_id(c.changeset.raw_id)))] + \

            [(n, b) for b, n in c.db_repo_scm_instance.branches.items()]

        if c.db_repo_scm_instance.closed_branches:

            prefix = _('(closed)') + ' '

            c.revision_options += [('-', '-')] + \

                [(n, prefix + b) for b, n in c.db_repo_scm_instance.closed_branches.items()]

        return render('files/files.html')

    @LoginRequired()

    @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',

                                   'repository.admin')

Journal controller for pylons

This file was forked by the Kallithea project in July 2014.

Original author and date, and relevant copyright and licensing information is below:

:created_on: Nov 21, 2010

:author: marcink

:copyright: (c) 2013 RhodeCode GmbH, and others.

:license: GPLv3, see LICENSE.md for more details.

"""

import logging

from itertools import groupby

from sqlalchemy import or_

from sqlalchemy.orm import joinedload

from sqlalchemy.sql.expression import func

from webhelpers.feedgenerator import Atom1Feed, Rss201rev2Feed

from webob.exc import HTTPBadRequest

from pylons import request, tmpl_context as c, response, url

from pylons.i18n.translation import _

        if repo_ids and user_ids:

            filtering_criterion = or_(UserLog.repository_id.in_(repo_ids),

                        UserLog.user_id.in_(user_ids))

        if repo_ids and not user_ids:

            filtering_criterion = UserLog.repository_id.in_(repo_ids)

        if not repo_ids and user_ids:

            filtering_criterion = UserLog.user_id.in_(user_ids)

        if filtering_criterion is not None:

            journal = self.sa.query(UserLog)\

                .options(joinedload(UserLog.user))\

                .options(joinedload(UserLog.repository))

            #filter

            journal = journal.filter(filtering_criterion)\

                        .order_by(UserLog.action_date.desc())

        else:

            journal = []

        return journal

    def _atom_feed(self, repos, public=True):

        journal = self._get_journal_data(repos)

        if public:

            _link = h.canonical_url('public_journal_atom')

            _desc = '%s %s %s' % (c.site_name, _('public journal'),

        cur_token = request.POST.get('auth_token')

        token = h.get_token()

        if cur_token == token:

            user_id = request.POST.get('follows_user_id')

            if user_id:

                try:

                    self.scm_model.toggle_following_user(user_id,

                                                self.authuser.user_id)

                    Session.commit()

                    return 'ok'

                except Exception:

                    raise HTTPBadRequest()

            repo_id = request.POST.get('follows_repo_id')

            if repo_id:

                try:

                    self.scm_model.toggle_following_repo(repo_id,

                                                self.authuser.user_id)

                    Session.commit()

                    return 'ok'

                except Exception:

                    raise HTTPBadRequest()

        log.debug('token mismatch %s vs %s' % (cur_token, token))

        raise HTTPBadRequest()

    @LoginRequired()

    def public_journal(self):

        # Return a rendered template

        p = safe_int(request.GET.get('page', 1), 1)

        c.following = self.sa.query(UserFollowing)\

            .filter(UserFollowing.user_id == self.authuser.user_id)\

        c.cs_ranges_org = None # not stored and not important and moving target - could be calculated ...

        revs = [ctx.revision for ctx in reversed(c.cs_ranges)]

        c.jsdata = json.dumps(graph_data(org_scm_instance, revs))

        c.available = []

        c.cs_branch_name = c.cs_ref_name

        other_scm_instance = c.a_repo.scm_instance

        c.update_msg = ""

        c.update_msg_other = ""

        if org_scm_instance.alias == 'hg' and c.a_ref_name != 'ancestor':

            if c.cs_ref_type != 'branch':

                c.cs_branch_name = org_scm_instance.get_changeset(c.cs_ref_name).branch # use ref_type ?

            if c.a_ref_type != 'branch':

                try:

                except EmptyRepositoryError:

            # candidates: descendants of old head that are on the right branch

            #             and not are the old head itself ...

            #             and nothing at all if old head is a descendent of target ref name

            else: # look for children of PR head on source branch in org repo

                arevs = org_scm_instance._repo.revs('%s:: & branch(%s) - %s',

                                                    revs[0], c.cs_branch_name, revs[0])

                if arevs:

                    if c.pull_request.is_closed():

                        c.update_msg = _('This pull request has been closed and can not be updated with descendent changes on %s:') % c.cs_branch_name

                    else:

                        c.update_msg = _('This pull request can be updated with descendent changes on %s:') % c.cs_branch_name

                    c.available = [org_scm_instance.get_changeset(x) for x in arevs]

                else:

                    c.update_msg = _('No changesets found for updating this pull request.')

        elif org_scm_instance.alias == 'git':

            c.update_msg = _("Git pull requests don't support updates yet.")

        raw_ids = [x.raw_id for x in c.cs_ranges]

        c.cs_comments = c.cs_repo.get_comments(raw_ids)

        c.statuses = c.cs_repo.statuses(raw_ids)

        ignore_whitespace = request.GET.get('ignorews') == '1'

        line_context = request.GET.get('context', 3)

        c.ignorews_url = _ignorews_url

        c.context_url = _context_url

        c.fulldiff = request.GET.get('fulldiff')

                        log.debug('Found README file `%s` rendering...' %

                                  readme_file)

                        readme_data = renderer.render(readme.content,

                                                      filename=f)

                        break

                    except NodeDoesNotExistError:

                        continue

            except ChangesetError:

                log.error(traceback.format_exc())

                pass

            except EmptyRepositoryError:

                pass

            return readme_data, readme_file

        kind = 'README'

        valid = CacheInvalidation.test_and_set_valid(repo_name, kind)

        if not valid:

            region_invalidate(_get_readme_from_cache, None, repo_name, kind)

        return _get_readme_from_cache(repo_name, kind)

    @LoginRequired()

    @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',

                                   'repository.admin')

    permission given in db. We don't want to check each time from db for new

    permissions since adding a new permission also requires application restart

    ie. to decorate new views with the newly created permission

    :param config: current pylons config instance

    """

    log.info('getting information about all available permissions')

    try:

        sa = meta.Session

        all_perms = sa.query(Permission).all()

        config['available_permissions'] = [x.permission_name for x in all_perms]

    finally:

        meta.Session.remove()

#==============================================================================

# CHECK DECORATORS

#==============================================================================

class LoginRequired(object):

    """

    Must be logged in to execute this function else

    redirect to login page

#==============================================================================

# SPECIAL VERSION TO HANDLE MIDDLEWARE AUTH

#==============================================================================

class HasPermissionAnyMiddleware(object):

    def __init__(self, *perms):

        self.required_perms = set(perms)

    def __call__(self, user, repo_name):

        # repo_name MUST be unicode, since we handle keys in permission

        # dict by unicode

        repo_name = safe_unicode(repo_name)

        usr = AuthUser(user.user_id)

        self.username = user.username

        self.repo_name = repo_name

        return self.check_permissions()

    def check_permissions(self):

        log.debug('checking VCS protocol '

                  'permissions %s for user:%s repository:%s', self.user_perms,

                                                self.username, self.repo_name)

        if self.required_perms.intersection(self.user_perms):

            log.debug('Permission to repo: %s granted for user: %s @ %s'

                      % (self.repo_name, self.username, 'PermissionMiddleware'))

            return True

def check_ip_access(source_ip, allowed_ips=None):

    """

    Checks if source_ip is a subnet of any of allowed_ips.

    :param source_ip:

    :param allowed_ips: list of allowed ips together with mask

    """

    from kallithea.lib import ipaddr

    log.debug('checking if ip:%s is subnet of %s' % (source_ip, allowed_ips))

    if isinstance(allowed_ips, (tuple, list, set)):

        for ip in allowed_ips:

    return False

                password=passwd,

                email=auth["email"],

                firstname=auth["firstname"],

                lastname=auth["lastname"],

                active=auth["active"],

                admin=auth["admin"],

                extern_name=auth["extern_name"],

                extern_type=self.name

            )

            Session().flush()

            # enforce user is just in given groups, all of them has to be ones

            # created from plugins. We store this info in _group_data JSON field

            Session().commit()

        return auth

def importplugin(plugin):

    """

    Imports and returns the authentication plugin in the module named by plugin

    (e.g., plugin='kallithea.lib.auth_modules.auth_internal'). Returns the

    KallitheaAuthPluginBase subclass on success, raises exceptions on failure.

    raises:

        AttributeError -- no KallitheaAuthPlugin class in the module

        # from .auth() to Kallithea database. If this function returns data

        # then auth is correct.

        plugin_user = plugin._authenticate(user, username, password,

                                           plugin_settings,

                                           environ=environ or {})

        log.debug('PLUGIN USER DATA: %s' % plugin_user)

        if plugin_user:

            log.debug('Plugin returned proper authentication data')

            return plugin_user

        # we failed to Auth because .auth() method didn't return proper the user

    return None