@LoginRequired()

    def index(self):

        c.show_private = request.GET.get('private') and not_default_user

        c.show_public = request.GET.get('public') and not_default_user

        # MY private

        if c.show_private and not c.show_public:

            gists = gists.filter(Gist.gist_type == Gist.GIST_PRIVATE) \

        # MY public

        elif c.show_public and not c.show_private:

            gists = gists.filter(Gist.gist_type == Gist.GIST_PUBLIC) \

        # MY public+private

        elif c.show_private and c.show_public:

            gists = gists.filter(or_(Gist.gist_type == Gist.GIST_PUBLIC,

                                     Gist.gist_type == Gist.GIST_PRIVATE)) \

        # default show ALL public gists

        if not c.show_public and not c.show_private:

            gist_type = Gist.GIST_PUBLIC if _public else Gist.GIST_PRIVATE

            gist = GistModel().create(

                description=form_result['description'],

                gist_mapping=nodes,

                gist_type=gist_type,

                lifetime=form_result['lifetime']

    @NotAnonymous()

    def delete(self, gist_id):

        gist = GistModel().get_gist(gist_id)

        if h.HasPermissionAny('hg.admin')() or owner:

            GistModel().delete(gist)

            Session().commit()

        super(MyAccountController, self).__before__()

    def __load_data(self):

        if c.user.username == User.DEFAULT_USER:

            h.flash(_("You can't edit this user since it's"

                      " crucial for entire application"), category='warning')

            repos_list = Session().query(Repository) \

                         .join(UserFollowing) \

                         .filter(UserFollowing.user_id ==

        else:

            admin = True

            repos_list = Session().query(Repository) \

                         .filter(Repository.owner_id ==

        repos_data = RepoModel().get_repos_as_dict(repos_list=repos_list,

                                                   admin=admin)

    def my_account(self):

        c.active = 'profile'

        self.__load_data()

        managed_fields = auth_modules.get_managed_fields(c.user)

        def_user_perms = User.get_default_user().AuthUser.permissions['global']

        if 'hg.register.none' in def_user_perms:

        update = False

        if request.POST:

            _form = UserForm(edit=True,

            form_result = {}

            try:

                post_data = dict(request.POST)

                              'new_password', 'password_confirmation',

                             ] + managed_fields

                                   skip_attrs=skip_attrs)

                h.flash(_('Your account was updated successfully'),

                        category='success')

        c.can_change_password = 'password' not in managed_fields

        if request.POST and c.can_change_password:

            try:

                form_result = _form.to_python(request.POST)

                Session().commit()

                h.flash(_("Successfully updated password"), category='success')

            except formencode.Invalid as errors:

    def my_account_perms(self):

        c.active = 'perms'

        self.__load_data()

        return render('admin/my_account/my_account.html')

        email = request.POST.get('new_email')

        try:

            Session().commit()

            h.flash(_("Added email %s to user") % email, category='success')

        except formencode.Invalid as error:

    def my_account_emails_delete(self):

        email_id = request.POST.get('del_email_id')

        user_model = UserModel()

        Session().commit()

        h.flash(_("Removed email from user"), category='success')

        raise HTTPFound(location=url('my_account_emails'))

            (str(60 * 24 * 30), _('1 month')),

        ]

        c.lifetime_options = [(c.lifetime_values, _("Lifetime"))]

                                                     show_expired=show_expired)

        return render('admin/my_account/my_account.html')

    def my_account_api_keys_add(self):

        lifetime = safe_int(request.POST.get('lifetime'), -1)

        description = request.POST.get('description')

        Session().commit()

        h.flash(_("API key successfully created"), category='success')

        raise HTTPFound(location=url('my_account_api_keys'))

    def my_account_api_keys_delete(self):

        api_key = request.POST.get('del_api_key')

        if request.POST.get('del_api_key_builtin'):

            user.api_key = generate_api_key()

            Session().commit()

            h.flash(_("API key successfully reset"), category='success')

        elif api_key:

            Session().commit()

            h.flash(_("API key successfully deleted"), category='success')

        super(NotificationsController, self).__before__()

    def index(self, format='html'):

                                            filter_=request.GET.getall('type'))

        p = safe_int(request.GET.get('page'), 1)

        if request.environ.get('HTTP_X_PARTIAL_XHR'):

            nm = NotificationModel()

            # mark all read

                                      filter_=request.GET.getall('type'))

            Session().commit()

                                      filter_=request.GET.getall('type'))

            c.notifications = Page(notif, page=1, items_per_page=10)

            return render('admin/notifications/notifications_data.html')

    def update(self, notification_id):

        try:

            no = Notification.get(notification_id)

                        for un in no.notifications_to_users)

            if h.HasPermissionAny('hg.admin')() or owner:

                # deletes only notification2user

                Session().commit()

                return 'ok'

        except Exception:

    def delete(self, notification_id):

        try:

            no = Notification.get(notification_id)

                        for un in no.notifications_to_users)

            if h.HasPermissionAny('hg.admin')() or owner:

                # deletes only notification2user

                Session().commit()

                return 'ok'

        except Exception:

        notification = Notification.get_or_404(notification_id)

        unotification = NotificationModel() \

        # if this association to user is not valid, we don't want to show

        # this message

            Session().commit()

        c.notification = notification

        return render('admin/notifications/show_notification.html')

        return data

    def _revoke_perms_on_yourself(self, form_result):

                     form_result['perms_updates'])

                      form_result['perms_new'])

        if _new and _new[0][1] != 'group.admin' or _up and _up[0][1] != 'group.admin':

            return True

                group_name=form_result['group_name'],

                group_description=form_result['group_description'],

                parent=form_result['parent_group_id'],

                copy_permissions=form_result['group_copy_permissions']

            )

            Session().commit()

        c.repo_group = RepoGroupModel()._get_repo_group(group_name)

        valid_recursive_choices = ['none', 'repos', 'groups', 'all']

        form_result = RepoGroupPermsForm(valid_recursive_choices)().to_python(request.POST)

            if self._revoke_perms_on_yourself(form_result):

                msg = _('Cannot revoke permission for yourself as admin')

                h.flash(msg, category='warning')

                                             form_result['perms_updates'],

                                             recursive)

        #TODO: implement this

        Session().commit()

        h.flash(_('Repository group permissions updated'), category='success')

        raise HTTPFound(location=url('edit_repo_group_perms', group_name=group_name))

            elif obj_type == 'user_group':

                obj_id = safe_int(request.POST.get('user_group_id'))

                    msg = _('Cannot revoke permission for yourself as admin')

                    h.flash(msg, category='warning')

                    raise Exception('revoke admin permission on self')

            # create is done sometimes async on celery, db transaction

            # management is handled there.

            task_id = task.task_id

        except formencode.Invalid as errors:

            log.info(errors)

            h.flash(_('Repository %s updated successfully') % repo_name,

                    category='success')

            changed_name = repo.repo_name

            Session().commit()

        except formencode.Invalid as errors:

            log.info(errors)

                    handle_forks = 'delete'

                    h.flash(_('Deleted %s forks') % _forks, category='success')

            repo_model.delete(repo, forks=handle_forks)

            ScmModel().mark_for_invalidation(repo_name)

            h.flash(_('Deleted repository %s') % repo_name, category='success')

            Session().commit()

        RepoModel()._update_permissions(repo_name, form['perms_new'],

                                        form['perms_updates'])

        #TODO: implement this

        Session().commit()

        h.flash(_('Repository permissions updated'), category='success')

        raise HTTPFound(location=url('edit_repo_perms', repo_name=repo_name))

                    repo=repo_name, group_name=obj_id

                )

            #TODO: implement this

            Session().commit()

        except Exception:

            log.error(traceback.format_exc())

        try:

            fork_id = request.POST.get('id_fork_of')

            repo = ScmModel().mark_as_fork(repo_name, fork_id,

            fork = repo.fork.repo_name if repo.fork else _('Nothing')

            Session().commit()

            h.flash(_('Marked repository %s as fork of %s') % (repo_name, fork),

        try:

            repo = Repository.get_by_repo_name(repo_name)

            if request.POST.get('set_lock'):

                h.flash(_('Repository has been locked'), category='success')

            elif request.POST.get('set_unlock'):

                Repository.unlock(repo)

                    Repository.unlock(repo)

                    h.flash(_('Repository has been unlocked'), category='success')

                else:

                    h.flash(_('Repository has been locked'), category='success')

        except Exception as e:

        c.active = 'remote'

        if request.POST:

            try:

                h.flash(_('Pulled from remote location'), category='success')

            except Exception as e:

                log.error(traceback.format_exc())

            filesystem_repos = ScmModel().repo_scan()

            added, removed = repo2db_mapper(filesystem_repos, rm_obsolete,

                                            install_git_hooks=install_git_hooks,

                                            overwrite_git_hooks=overwrite_git_hooks)

            h.flash(h.literal(_('Repositories successfully rescanned. Added: %s. Removed: %s.') %

                (', '.join(h.link_to(safe_unicode(repo_name), h.url('summary_home', repo_name=repo_name))

            form_result = users_group_form.to_python(dict(request.POST))

            ug = UserGroupModel().create(name=form_result['users_group_name'],

                                         description=form_result['user_group_description'],

                                         active=form_result['users_group_active'])

            gr = form_result['users_group_name']

                          'admin_created_users_group:%s' % gr,

            h.flash(h.literal(_('Created user group %s') % h.link_to(h.escape(gr), url('edit_users_group', id=ug.users_group_id))),

                category='success')

            Session().commit()

            form_result = users_group_form.to_python(request.POST)

            UserGroupModel().update(c.user_group, form_result)

            gr = form_result['users_group_name']

                          'admin_updated_users_group:%s' % gr,

            h.flash(_('Updated user group %s') % gr, category='success')

            Session().commit()

        except formencode.Invalid as errors:

            h.flash(_('Target group cannot be the same'), category='error')

            raise HTTPFound(location=url('edit_user_group_perms', id=id))

        #TODO: implement this

        Session().commit()

        h.flash(_('User group permissions updated'), category='success')

        raise HTTPFound(location=url('edit_user_group_perms', id=id))

            elif obj_type == 'user_group':

                obj_id = safe_int(request.POST.get('user_group_id'))

                    msg = _('Cannot revoke permission for yourself as admin')

                    h.flash(msg, category='warning')

                    raise Exception('revoke admin permission on self')

        try:

            form_result = user_form.to_python(dict(request.POST))

            user = user_model.create(form_result)

            h.flash(_('Created user %s') % user.username,

                    category='success')

            Session().commit()

            user_model.update(id, form_result, skip_attrs=skip_attrs)

            usr = form_result['username']

            h.flash(_('User updated successfully'), category='success')

            Session().commit()

        except formencode.Invalid as errors:

        c.user = user

        c.active = 'profile'

        c.perm_user = AuthUser(dbuser=user)

        managed_fields = auth_modules.get_managed_fields(user)

        c.readonly = lambda n: 'readonly' if n in managed_fields else None

        return render('admin/users/user_edit.html')

        c.user = self._get_user_or_raise_if_default(id)

        c.active = 'advanced'

        c.perm_user = AuthUser(dbuser=c.user)

        umodel = UserModel()

        defaults = c.user.get_dict()

        c.user = self._get_user_or_raise_if_default(id)

        c.active = 'perms'

        c.perm_user = AuthUser(dbuser=c.user)

        umodel = UserModel()

        defaults = c.user.get_dict()

    def _handle_request(self, environ, start_response):

        start = time.time()

        self._req_id = None

        if 'CONTENT_LENGTH' not in environ:

            log.debug("No Content-Length")

        # this is little trick to inject logged in user for

        # perms decorators to work they expect the controller class to have

        # authuser attribute set

        # This attribute will need to be first param of a method that uses

        # api_key, which is translated to instance of user at that name

import logging

from sqlalchemy import or_

from kallithea.controllers.api import JSONRPCController, JSONRPCError

from kallithea.lib.auth import (

    PasswordGenerator, AuthUser, HasPermissionAnyDecorator,

    """

    API Controller

    Example function::

        try:

            ScmModel().pull_changes(repo.repo_name,

            return dict(

                msg='Pulled from `%s`' % repo.repo_name,

                repository=repo.repo_name

                                  'repository.write')(repo_name=repo.repo_name):

            # make sure normal user does not pass someone else userid,

            # he is not allowed to do that

                raise JSONRPCError(

                    'userid is not the same as your user'

                )

            raise JSONRPCError('repository `%s` does not exist' % (repoid,))

        if isinstance(userid, Optional):

        user = get_user_or_error(userid)

        if not HasPermissionAny('hg.admin')():

            # make sure normal user does not pass someone else userid,

            # he is not allowed to do that

                raise JSONRPCError(

                    'userid is not the same as your user'

                )

        """

        if isinstance(userid, Optional):

        user = get_user_or_error(userid)

        ips = UserIpMap.query().filter(UserIpMap.user == user).all()

        return dict(

            user_ips=ips

        )

        if not HasPermissionAny('hg.admin')():

            # make sure normal user does not pass someone else userid,

            # he is not allowed to do that

                raise JSONRPCError(

                    'userid is not the same as your user'

                )

        if isinstance(userid, Optional):

        user = get_user_or_error(userid)

        data = user.get_api_data()

        try:

            if isinstance(owner, Optional):

            owner = get_user_or_error(owner)

            active = Optional.extract(active)

        """

        result = []

        if not HasPermissionAny('hg.admin')():

        else:

            repos = Repository.query()

                    'Only Kallithea admin can specify `owner` param'

                )

        if isinstance(owner, Optional):

        owner = get_user_or_error(owner)

            raise JSONRPCError('repository `%s` does not exist' % (repoid,))

        if isinstance(owner, Optional):

        owner = get_user_or_error(owner)

            raise JSONRPCError("repo group `%s` already exist" % (group_name,))

        if isinstance(owner, Optional):

        group_description = Optional.extract(description)

        parent_group = Optional.extract(parent)

        if not isinstance(parent, Optional):

        """

        gist = get_gist_or_error(gistid)

        if not HasPermissionAny('hg.admin')():

                raise JSONRPCError('gist `%s` does not exist' % (gistid,))

        return gist.get_api_data()

        if not HasPermissionAny('hg.admin')():

            # make sure normal user does not pass someone else userid,

            # he is not allowed to do that

                raise JSONRPCError(

                    'userid is not the same as your user'

                )

        if isinstance(userid, Optional):

        else:

            user_id = get_user_or_error(userid).user_id

        """

        try:

            if isinstance(owner, Optional):

            owner = get_user_or_error(owner)

            description = Optional.extract(description)

        """

        gist = get_gist_or_error(gistid)

        if not HasPermissionAny('hg.admin')():

                raise JSONRPCError('gist `%s` does not exist' % (gistid,))

        try:

    comment = ChangesetCommentsModel().create(

        text=text,

        repo=c.db_repo.repo_id,

        revision=revision,

        pull_request=pull_request_id,

        f_path=f_path,

                ChangesetStatusModel().set_status(

                    c.db_repo.repo_id,

                    status,

                    c.comment,

                    revision=revision,

                    dont_allow_on_closed_pull_request=True,

                log.debug('cannot change status on %s with closed pull request', revision)

                raise HTTPBadRequest()

                      'user_commented_revision:%s' % revision,

        Session().commit()

        co = ChangesetComment.get_or_404(comment_id)

        if co.repo.repo_name != repo_name:

            raise HTTPNotFound()

        repo_admin = h.HasRepoPermissionAny('repository.admin')(repo_name)

        if h.HasPermissionAny('hg.admin')() or repo_admin or owner:

            ChangesetCommentsModel().delete(comment=co)

        c.default_message = _('Deleted file %s via Kallithea') % (f_path)

        c.f_path = f_path

        node_path = f_path

        if r_post:

            message = r_post.get('message') or c.default_message

                    }

                }

                self.scm_model.delete_nodes(

                    message=message,

                    nodes=nodes,

                    parent_cs=c.cs,

            content = convert_line_endings(r_post.get('content', ''), mode)

            message = r_post.get('message') or c.default_message

            if content == old_content:

                h.flash(_('No changes'), category='warning')

            try:

                self.scm_model.commit_change(repo=c.db_repo_scm_instance,

                                             repo_name=repo_name, cs=c.cs,

                                             author=author, message=message,

                                             content=content, f_path=f_path)

                h.flash(_('Successfully committed to %s') % f_path,

            #strip all crap out of file, just leave the basename

            filename = os.path.basename(filename)

            node_path = posixpath.join(location, filename)

            try:

                nodes = {

                    }

                }

                self.scm_model.create_nodes(

                    message=message,

                    nodes=nodes,

                    parent_cs=c.cs,

                log.debug('Destroying temp archive %s', archive_path)

                os.remove(archive_path)

                      action='user_downloaded_archive:%s' % (archive_name),

        response.content_disposition = str('attachment; filename=%s' % (archive_name))

        response.content_type = str(content_type)

            # create fork is done sometimes async on celery, db transaction

            # management is handled there.

            task_id = task.task_id

        except formencode.Invalid as errors:

            return htmlfill.render(

    def index(self):

        # Return a rendered template

        p = safe_int(request.GET.get('page'), 1)

        c.following = self.sa.query(UserFollowing) \

            .options(joinedload(UserFollowing.follows_repository)) \

            .all()