Changeset - 1ab83bed8115
Parent rev.
Child rev.
[Not reviewed]
default
0 1 0
Mads Kiilerich - 7 years ago 2018-12-29 18:39:46
mads@kiilerich.com
auth: drop the internal "explicit" flag - the new default is all we want; explicit permissions should never blindly overrule indirect permissions

The "explicit" flag is already always false. Just hardcode it everywhere and
remove dead code.
1 file changed with 7 insertions and 16 deletions:
kallithea/lib/auth.py
7
16
0 comments (0 inline, 0 general)
kallithea/lib/auth.py
➞
Show inline comments
 
@@ -123,26 +123,25 @@ def check_password(password, hashed):
 
        import bcrypt
 
        try:
 
            return bcrypt.checkpw(safe_str(password), safe_str(hashed))
 
        except ValueError as e:
 
            # bcrypt will throw ValueError 'Invalid hashed_password salt' on all password errors
 
            log.error('error from bcrypt checking password: %s', e)
 
            return False
 
    else:
 
        raise Exception('Unknown or unsupported platform %s'
 
                        % __platform__)
 

			




	
	
	
		
 

			




	
	
	
		
 
def _cached_perms_data(user_id, user_is_admin,

			




	
	
	
		
 
                       explicit):

			




	
	
	
		
 
def _cached_perms_data(user_id, user_is_admin):

			




	
	
	
		
 
    RK = 'repositories'

			




	
	
	
		
 
    GK = 'repositories_groups'

			




	
	
	
		
 
    UK = 'user_groups'

			




	
	
	
		
 
    GLOBAL = 'global'

			




	
	
	
		
 
    PERM_WEIGHTS = Permission.PERM_WEIGHTS

			




	
	
	
		
 
    permissions = {RK: {}, GK: {}, UK: {}, GLOBAL: set()}

			




	
	
	
		
 

			




	
	
	
		
 
    def _choose_perm(new_perm, cur_perm):

			




	
	
	
		
 
        new_perm_val = PERM_WEIGHTS[new_perm]

			




	
	
	
		
 
        cur_perm_val = PERM_WEIGHTS[cur_perm]

			




	
	
	
		
 
        if new_perm_val > cur_perm_val:

			




	
	
	
		
 
            return new_perm

			




	
	
		
 
@@ -295,37 +294,35 @@ def _cached_perms_data(user_id, user_is_

			




	
	
	
		
 
        multiple_counter[r_k] += 1

			




	
	
	
		
 
        p = perm.Permission.permission_name

			




	
	
	
		
 
        cur_perm = permissions[RK][r_k]

			




	
	
	
		
 

			




	
	
	
		
 
        if perm.Repository.owner_id == user_id:

			




	
	
	
		
 
            # set admin if owner

			




	
	
	
		
 
            p = 'repository.admin'

			




	
	
	
		
 
        else:

			




	
	
	
		
 
            if multiple_counter[r_k] > 1:

			




	
	
	
		
 
                p = _choose_perm(p, cur_perm)

			




	
	
	
		
 
        permissions[RK][r_k] = p

			




	
	
	
		
 

			




	
	
	
		
 
    # user explicit permissions for repositories, overrides any specified

			




	
	
	
		
 
    # by the group permission

			




	
	
	
		
 
    # user permissions for repositories

			




	
	
	
		
 
    user_repo_perms = Permission.get_default_perms(user_id)

			




	
	
	
		
 
    for perm in user_repo_perms:

			




	
	
	
		
 
        r_k = perm.UserRepoToPerm.repository.repo_name

			




	
	
	
		
 
        cur_perm = permissions[RK][r_k]

			




	
	
	
		
 
        # set admin if owner

			




	
	
	
		
 
        if perm.Repository.owner_id == user_id:

			




	
	
	
		
 
            p = 'repository.admin'

			




	
	
	
		
 
        else:

			




	
	
	
		
 
            p = perm.Permission.permission_name

			




	
	
	
		
 
            if not explicit:

			




	
	
	
		
 
                p = _choose_perm(p, cur_perm)

			




	
	
	
		
 
            p = _choose_perm(p, cur_perm)

			




	
	
	
		
 
        permissions[RK][r_k] = p

			




	
	
	
		
 

			




	
	
	
		
 
    #======================================================================

			




	
	
	
		
 
    # !! PERMISSIONS FOR REPOSITORY GROUPS !!

			




	
	
	
		
 
    #======================================================================

			




	
	
	
		
 
    #======================================================================

			




	
	
	
		
 
    # check if user is part of user groups for this repository groups and

			




	
	
	
		
 
    # fill in his permission from it.

			




	
	
	
		
 
    #======================================================================

			




	
	
	
		
 
    # user group for repo groups permissions

			




	
	
	
		
 
    user_repo_group_perms_from_users_groups = \

			




	
	
	
		
 
     Session().query(UserGroupRepoGroupToPerm, Permission, RepoGroup) \

			




	
	
		
 
@@ -347,26 +344,25 @@ def _cached_perms_data(user_id, user_is_

			




	
	
	
		
 
        p = perm.Permission.permission_name

			




	
	
	
		
 
        cur_perm = permissions[GK][g_k]

			




	
	
	
		
 
        if multiple_counter[g_k] > 1:

			




	
	
	
		
 
            p = _choose_perm(p, cur_perm)

			




	
	
	
		
 
        permissions[GK][g_k] = p

			




	
	
	
		
 

			




	
	
	
		
 
    # user explicit permissions for repository groups

			




	
	
	
		
 
    user_repo_groups_perms = Permission.get_default_group_perms(user_id)

			




	
	
	
		
 
    for perm in user_repo_groups_perms:

			




	
	
	
		
 
        rg_k = perm.UserRepoGroupToPerm.group.group_name

			




	
	
	
		
 
        p = perm.Permission.permission_name

			




	
	
	
		
 
        cur_perm = permissions[GK][rg_k]

			




	
	
	
		
 
        if not explicit:

			




	
	
	
		
 
            p = _choose_perm(p, cur_perm)

			




	
	
	
		
 
        p = _choose_perm(p, cur_perm)

			




	
	
	
		
 
        permissions[GK][rg_k] = p

			




	
	
	
		
 

			




	
	
	
		
 
    #======================================================================

			




	
	
	
		
 
    # !! PERMISSIONS FOR USER GROUPS !!

			




	
	
	
		
 
    #======================================================================

			




	
	
	
		
 
    # user group for user group permissions

			




	
	
	
		
 
    user_group_user_groups_perms = \

			




	
	
	
		
 
     Session().query(UserGroupUserGroupToPerm, Permission, UserGroup) \

			




	
	
	
		
 
     .join((UserGroup, UserGroupUserGroupToPerm.target_user_group_id

			




	
	
	
		
 
            == UserGroup.users_group_id)) \

			




	
	
	
		
 
     .join((Permission, UserGroupUserGroupToPerm.permission_id

			




	
	
	
		
 
            == Permission.permission_id)) \

			




	
	
		
 
@@ -385,26 +381,25 @@ def _cached_perms_data(user_id, user_is_

			




	
	
	
		
 
        p = perm.Permission.permission_name

			




	
	
	
		
 
        cur_perm = permissions[UK][g_k]

			




	
	
	
		
 
        if multiple_counter[g_k] > 1:

			




	
	
	
		
 
            p = _choose_perm(p, cur_perm)

			




	
	
	
		
 
        permissions[UK][g_k] = p

			




	
	
	
		
 

			




	
	
	
		
 
    # user explicit permission for user groups

			




	
	
	
		
 
    user_user_groups_perms = Permission.get_default_user_group_perms(user_id)

			




	
	
	
		
 
    for perm in user_user_groups_perms:

			




	
	
	
		
 
        u_k = perm.UserUserGroupToPerm.user_group.users_group_name

			




	
	
	
		
 
        p = perm.Permission.permission_name

			




	
	
	
		
 
        cur_perm = permissions[UK][u_k]

			




	
	
	
		
 
        if not explicit:

			




	
	
	
		
 
            p = _choose_perm(p, cur_perm)

			




	
	
	
		
 
        p = _choose_perm(p, cur_perm)

			




	
	
	
		
 
        permissions[UK][u_k] = p

			




	
	
	
		
 

			




	
	
	
		
 
    return permissions

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
def allowed_api_access(controller_name, whitelist=None, api_key=None):

			




	
	
	
		
 
    """

			




	
	
	
		
 
    Check if given controller_name is in whitelist API access

			




	
	
	
		
 
    """

			




	
	
	
		
 
    if not whitelist:

			




	
	
	
		
 
        from kallithea import CONFIG

			




	
	
	
		
 
        whitelist = aslist(CONFIG.get('api_access_controllers_whitelist'),

			




	
	
		
 
@@ -550,43 +545,39 @@ class AuthUser(object):

			




	
	
	
		
 
            'admin': ['usergroup.admin'],

			




	
	
	
		
 
        }[level]

			




	
	
	
		
 
        actual_perm = self.permissions['user_groups'].get(user_group_name)

			




	
	
	
		
 
        ok = actual_perm in required_perms

			




	
	
	
		
 
        log.debug('Checking if user %r can %r user group %r (%s): %s (has %r)',

			




	
	
	
		
 
            self.username, level, user_group_name, purpose, ok, actual_perm)

			




	
	
	
		
 
        return ok

			




	
	
	
		
 

			




	
	
	
		
 
    @property

			




	
	
	
		
 
    def api_keys(self):

			




	
	
	
		
 
        return self._get_api_keys()

			




	
	
	
		
 

			




	
	
	
		
 
    def __get_perms(self, user, explicit=False, cache=False):

			




	
	
	
		
 
    def __get_perms(self, user, cache=False):

			




	
	
	
		
 
        """

			




	
	
	
		
 
        Fills user permission attribute with permissions taken from database

			




	
	
	
		
 
        works for permissions given for repositories, and for permissions that

			




	
	
	
		
 
        are granted to groups

			




	
	
	
		
 

			




	
	
	
		
 
        :param user: `AuthUser` instance

			




	
	
	
		
 
        :param explicit: In case there are permissions both for user and a group

			




	
	
	
		
 
            that user is part of, explicit flag will define if user will

			




	
	
	
		
 
            explicitly override permissions from group, if it's False it will

			




	
	
	
		
 
            compute the decision

			




	
	
	
		
 
        """

			




	
	
	
		
 
        user_id = user.user_id

			




	
	
	
		
 
        user_is_admin = user.is_admin

			




	
	
	
		
 

			




	
	
	
		
 
        log.debug('Getting PERMISSION tree')

			




	
	
	
		
 
        compute = conditional_cache('short_term', 'cache_desc',

			




	
	
	
		
 
                                    condition=cache, func=_cached_perms_data)

			




	
	
	
		
 
        return compute(user_id, user_is_admin, explicit)

			




	
	
	
		
 
        return compute(user_id, user_is_admin)

			




	
	
	
		
 

			




	
	
	
		
 
    def _get_api_keys(self):

			




	
	
	
		
 
        api_keys = [self.api_key]

			




	
	
	
		
 
        for api_key in UserApiKeys.query() \

			




	
	
	
		
 
                .filter_by(user_id=self.user_id, is_expired=False):

			




	
	
	
		
 
            api_keys.append(api_key.api_key)

			




	
	
	
		
 

			




	
	
	
		
 
        return api_keys

			




	
	
	
		
 

			




	
	
	
		
 
    @property

			




	
	
	
		
 
    def is_admin(self):

			




	
	
	
		
 
        return self.admin

			




        

    



    


    



    



      

      





    
    0 comments (0 inline, 0 general)
    





    


  

  







  


    




    








    
        
    
    
        This site is powered by
            Kallithea 0.7.0,
        which is
        © 2010–2025 by various authors & licensed under GPLv3.