m.connect("users", "/users",

                  action="index", conditions=dict(method=["GET"]))

        m.connect("formatted_users", "/users.{format}",

                  action="index", conditions=dict(method=["GET"]))

        m.connect("new_user", "/users/new",

                  action="new", conditions=dict(method=["GET"]))

        m.connect("update_user", "/users/{id}",

                  action="update", conditions=dict(method=["PUT"]))

        m.connect("delete_user", "/users/{id}",

                  action="delete", conditions=dict(method=["DELETE"]))

        m.connect("edit_user", "/users/{id}/edit",

                  action="edit", conditions=dict(method=["GET"]))

        #EXTRAS USER ROUTES

        m.connect("edit_user_advanced", "/users/{id}/edit/advanced",

                  action="edit_advanced", conditions=dict(method=["GET"]))

        m.connect("edit_user_advanced", "/users/{id}/edit/advanced",

                  action="update_advanced", conditions=dict(method=["PUT"]))

        m.connect("edit_user_api_keys", "/users/{id}/edit/api_keys",

                  action="edit_api_keys", conditions=dict(method=["GET"]))

        m.connect("edit_user_api_keys", "/users/{id}/edit/api_keys",

                  action="add_api_key", conditions=dict(method=["POST"]))

        m.connect("edit_user_api_keys", "/users/{id}/edit/api_keys",

                  action="create", conditions=dict(method=["POST"]))

        m.connect("users_groups", "/user_groups",

                  action="index", conditions=dict(method=["GET"]))

        m.connect("new_users_group", "/user_groups/new",

                  action="new", conditions=dict(method=["GET"]))

        m.connect("update_users_group", "/user_groups/{id}",

                  action="update", conditions=dict(method=["PUT"]))

        m.connect("delete_users_group", "/user_groups/{id}",

                  action="delete", conditions=dict(method=["DELETE"]))

        m.connect("edit_users_group", "/user_groups/{id}/edit",

                  action="edit", conditions=dict(method=["GET"]),

                  function=check_user_group)

        #EXTRAS USER GROUP ROUTES

        m.connect("edit_user_group_default_perms", "/user_groups/{id}/edit/default_perms",

                  action="edit_default_perms", conditions=dict(method=["GET"]))

        m.connect("edit_user_group_default_perms", "/user_groups/{id}/edit/default_perms",

                  action="update_default_perms", conditions=dict(method=["PUT"]))

        m.connect("edit_user_group_perms", "/user_groups/{id}/edit/perms",

                  action="edit_perms", conditions=dict(method=["GET"]))

        m.connect("edit_user_group_perms", "/user_groups/{id}/edit/perms",

                  action="update_perms", conditions=dict(method=["PUT"]))

    #ADMIN PERMISSIONS ROUTES

    with rmap.submapper(path_prefix=ADMIN_PREFIX,

                        controller='admin/permissions') as m:

        m.connect("admin_permissions", "/permissions",

                  action="permission_globals", conditions=dict(method=["POST"]))

        m.connect("admin_permissions", "/permissions",

                  action="permission_globals", conditions=dict(method=["GET"]))

        m.connect("admin_permissions_ips", "/permissions/ips",

                  action="permission_ips", conditions=dict(method=["GET"]))

        m.connect("admin_permissions_perms", "/permissions/perms",

                  action="permission_perms", conditions=dict(method=["GET"]))

    #ADMIN DEFAULTS REST ROUTES

    rmap.resource('default', 'defaults',

                  controller='admin/defaults', path_prefix=ADMIN_PREFIX)

    #ADMIN AUTH SETTINGS

    rmap.connect('auth_settings', '%s/auth' % ADMIN_PREFIX,

                 controller='admin/auth_settings', action='auth_settings',

                 conditions=dict(method=["POST"]))

    rmap.connect('auth_home', '%s/auth' % ADMIN_PREFIX,

        m.connect("my_account_api_keys", "/my_account/api_keys",

                  action="my_account_api_keys", conditions=dict(method=["GET"]))

        m.connect("my_account_api_keys", "/my_account/api_keys",

                  action="my_account_api_keys_add", conditions=dict(method=["POST"]))

        m.connect("my_account_api_keys", "/my_account/api_keys",

                  action="my_account_api_keys_delete", conditions=dict(method=["DELETE"]))

    #NOTIFICATION REST ROUTES

    with rmap.submapper(path_prefix=ADMIN_PREFIX,

                        controller='admin/notifications') as m:

        m.connect("notifications", "/notifications",

                  action="index", conditions=dict(method=["GET"]))

        m.connect("notifications_mark_all_read", "/notifications/mark_all_read",

                  action="mark_all_read", conditions=dict(method=["GET"]))

        m.connect("formatted_notifications", "/notifications.{format}",

                  action="index", conditions=dict(method=["GET"]))

        m.connect("/notifications/{notification_id}",

                  action="update", conditions=dict(method=["PUT"]))

        m.connect("/notifications/{notification_id}",

                  action="delete", conditions=dict(method=["DELETE"]))

        m.connect("notification", "/notifications/{notification_id}",

                  action="show", conditions=dict(method=["GET"]))

        m.connect("formatted_notification", "/notifications/{notification_id}.{format}",

                  action="show", conditions=dict(method=["GET"]))

    #ADMIN GIST

    with rmap.submapper(path_prefix=ADMIN_PREFIX,

                        controller='admin/gists') as m:

        m.connect("gists", "/gists",

                  action="create", conditions=dict(method=["POST"]))

        m.connect("gists", "/gists",

                  action="index", conditions=dict(method=["GET"]))

        if request.environ.get('HTTP_X_PARTIAL_XHR'):

            nm = NotificationModel()

            # mark all read

            nm.mark_all_read_for_user(self.authuser.user_id,

                                      filter_=request.GET.getall('type'))

            Session().commit()

            c.user = self.authuser

            notif = nm.query_for_user(self.authuser.user_id,

                                      filter_=request.GET.getall('type'))

            c.notifications = Page(notif, page=1, items_per_page=10)

            return render('admin/notifications/notifications_data.html')

    def update(self, notification_id):

        try:

            no = Notification.get(notification_id)

            owner = all(un.user.user_id == c.authuser.user_id

                        for un in no.notifications_to_users)

            if h.HasPermissionAny('hg.admin')() or owner:

                # deletes only notification2user

                NotificationModel().mark_read(c.authuser.user_id, no)

                Session().commit()

                return 'ok'

        except Exception:

            Session().rollback()

        # if this association to user is not valid, we don't want to show

        # this message

        if unotification is None:

            raise HTTPForbidden()

        if not unotification.read:

            unotification.mark_as_read()

            Session().commit()

        c.notification = notification

        c.user = self.authuser

        return render('admin/notifications/show_notification.html')

        try:

            UserGroupModel().delete(usr_gr)

            Session().commit()

            h.flash(_('Successfully deleted user group'), category='success')

        except UserGroupsAssignedException as e:

            h.flash(e, category='error')

        except Exception:

            log.error(traceback.format_exc())

            h.flash(_('An error occurred during deletion of user group'),

                    category='error')

        raise HTTPFound(location=url('users_groups'))

    @HasUserGroupPermissionAnyDecorator('usergroup.admin')

    def edit(self, id, format='html'):

        c.user_group = UserGroup.get_or_404(id)

        c.active = 'settings'

        self.__load_data(id)

        defaults = self.__load_defaults(id)

        return htmlfill.render(

            render('admin/user_groups/user_group_edit.html'),

            defaults=defaults,

            encoding="UTF-8",

        try:

            UserModel().delete(usr)

            Session().commit()

            h.flash(_('Successfully deleted user'), category='success')

        except (UserOwnsReposException, DefaultUserException) as e:

            h.flash(e, category='warning')

        except Exception:

            log.error(traceback.format_exc())

            h.flash(_('An error occurred during deletion of user'),

                    category='error')

        raise HTTPFound(location=url('users'))

    def _get_user_or_raise_if_default(self, id):

        try:

            return User.get_or_404(id, allow_default=False)

        except DefaultUserException:

            h.flash(_("The default user cannot be edited"), category='warning')

            raise HTTPNotFound

    def _render_edit_profile(self, user):

        c.user = user

        c.active = 'profile'

        c.perm_user = AuthUser(dbuser=user)

        c.ip_addr = self.ip_addr

        assert gr == None

        p = Permission.get_by_key('hg.fork.repository')

        perms = UserGroupToPerm.query() \

            .filter(UserGroupToPerm.users_group_id == ugid).all()

        perms = [[x.users_group_id,

                  x.permission_id, ] for x in perms]

        assert perms == []

    def test_delete_browser_fakeout(self):

        response = self.app.post(url('users_group', id=1),

                                 params=dict(_method='delete', _authentication_token=self.authentication_token()))

                               '%s' % (username, groupname))

        # TODO: why do this fail?

        #response = self.app.delete(url('delete_users_group', id=groupname))

        #self.checkSessionFlash(response, 'Removed user group %s' % groupname)

        fixture.destroy_user_group(ug.users_group_id)

        response = self.app.post(url('user', id=new_user.user_id),

            params={'_method': 'delete', '_authentication_token': self.authentication_token()})

        self.checkSessionFlash(response, 'Successfully deleted user')

    def test_edit(self):

        self.log_user()

        user = User.get_by_username(TEST_USER_ADMIN_LOGIN)

        response = self.app.get(url('edit_user', id=user.user_id))

    def test_add_perm_create_repo(self):

        self.log_user()

        perm_none = Permission.get_by_key('hg.create.none')

        perm_create = Permission.get_by_key('hg.create.repository')

        user = UserModel().create_or_update(username='dummy', password='qwe',

                                            email='dummy', firstname=u'a',