m.connect("formatted_users", "/users.{format}",

                  action="index", conditions=dict(method=["GET"]))

        m.connect("new_user", "/users/new",

                  action="new", conditions=dict(method=["GET"]))

        m.connect("update_user", "/users/{id}",

                  action="update", conditions=dict(method=["POST"]))

        m.connect("delete_user", "/users/{id}/delete",

                  action="delete", conditions=dict(method=["POST"]))

        m.connect("edit_user", "/users/{id}/edit",

                  action="edit", conditions=dict(method=["GET"]))

        #EXTRAS USER ROUTES

        m.connect("edit_user_advanced", "/users/{id}/edit/advanced",

                  action="edit_advanced", conditions=dict(method=["GET"]))

        m.connect("edit_user_api_keys", "/users/{id}/edit/api_keys",

                  action="edit_api_keys", conditions=dict(method=["GET"]))

        m.connect("edit_user_api_keys", "/users/{id}/edit/api_keys",

                  action="add_api_key", conditions=dict(method=["POST"]))

        m.connect("edit_user_api_keys_delete", "/users/{id}/edit/api_keys/delete",

                  action="delete_api_key", conditions=dict(method=["POST"]))

        m.connect("edit_user_perms", "/users/{id}/edit/permissions",

                  action="edit_perms", conditions=dict(method=["GET"]))

        m.connect("edit_user_emails", "/users/{id}/edit/emails",

                  action="edit_emails", conditions=dict(method=["GET"]))

        m.connect("edit_user_emails_update", "/users/{id}/edit/emails",

                  action="add_email", conditions=dict(method=["POST"]))

        m.connect("edit_user_emails_delete", "/users/{id}/edit/emails/delete",

                  action="delete_email", conditions=dict(method=["POST"]))

        m.connect("edit_user_ips", "/users/{id}/edit/ips",

                  action="edit_ips", conditions=dict(method=["GET"]))

        m.connect("edit_user_ips_update", "/users/{id}/edit/ips",

                  action="add_ip", conditions=dict(method=["POST"]))

        m.connect("edit_user_ips_delete", "/users/{id}/edit/ips/delete",

                  action="delete_ip", conditions=dict(method=["POST"]))

    #ADMIN USER GROUPS REST ROUTES

    with rmap.submapper(path_prefix=ADMIN_PREFIX,

                        controller='admin/user_groups') as m:

        m.connect("users_groups", "/user_groups",

                  action="create", conditions=dict(method=["POST"]))

        m.connect("users_groups", "/user_groups",

                  action="index", conditions=dict(method=["GET"]))

        m.connect("new_users_group", "/user_groups/new",

                  action="new", conditions=dict(method=["GET"]))

        m.connect("update_users_group", "/user_groups/{id}",

                  action="update", conditions=dict(method=["POST"]))

        m.connect("delete_users_group", "/user_groups/{id}/delete",

                  action="delete", conditions=dict(method=["POST"]))

        m.connect("edit_users_group", "/user_groups/{id}/edit",

                  action="edit", conditions=dict(method=["GET"]),

                  function=check_user_group)

        #EXTRAS USER GROUP ROUTES

        m.connect("edit_user_group_default_perms", "/user_groups/{id}/edit/default_perms",

                  action="edit_default_perms", conditions=dict(method=["GET"]))

        m.connect("edit_user_group_perms", "/user_groups/{id}/edit/perms",

                  action="edit_perms", conditions=dict(method=["GET"]))

        m.connect("edit_user_group_perms_update", "/user_groups/{id}/edit/perms",

                  action="update_perms", conditions=dict(method=["POST"]))

        m.connect("edit_user_group_perms_delete", "/user_groups/{id}/edit/perms/delete",

                  action="delete_perms", conditions=dict(method=["POST"]))

        m.connect("edit_user_group_advanced", "/user_groups/{id}/edit/advanced",

                  action="edit_advanced", conditions=dict(method=["GET"]))

        m.connect("edit_user_group_members", "/user_groups/{id}/edit/members",

                  action="edit_members", conditions=dict(method=["GET"]))

    #ADMIN PERMISSIONS ROUTES

    with rmap.submapper(path_prefix=ADMIN_PREFIX,

                        controller='admin/permissions') as m:

        m.connect("admin_permissions", "/permissions",

                  action="permission_globals", conditions=dict(method=["POST"]))

        m.connect("admin_permissions", "/permissions",

                  action="permission_globals", conditions=dict(method=["GET"]))

<%namespace name="dpb" file="/base/default_perms_box.html"/>

## permissions overview

<%namespace name="p" file="/base/perms_summary.html"/>

${p.perms_summary(c.permissions)}

<%namespace name="dpb" file="/base/default_perms_box.html"/>

## permissions overview

<%namespace name="p" file="/base/perms_summary.html"/>

${p.perms_summary(c.perm_user.permissions, show_all=True)}

## snippet for displaying default permission box

## usage:

##    <%namespace name="dpb" file="/base/default_perms_box.html"/>

##    ${dpb.default_perms_box(<url_to_form>)}

<%def name="default_perms_box(form_url)">

    <div class="form">

        <!-- fields -->

        <div class="fields">

             <div class="field">

                <div class="label label-checkbox">

                    <label for="inherit_default_permissions">${_('Inherit defaults')}:</label>

                </div>

                <div class="checkboxes">

                    ${h.checkbox('inherit_default_permissions',value=True)}

                    <span class="help-block">

                    ${h.literal(_('Select to inherit global settings, IP whitelist and permissions from the %s.')

                                % h.link_to('default permissions', url('admin_permissions')))}

                    </span>

                </div>

             </div>

             <div id="inherit_overlay">

             <div class="field">

                <div class="label label-checkbox">

                    <label for="create_repo_perm">${_('Create repositories')}:</label>

                </div>

                <div class="checkboxes">

                    ${h.checkbox('create_repo_perm',value=True)}

                    <span class="help-block">

            .filter(UserGroup.users_group_name == users_group_name).one()

        response = self.app.post(url('delete_users_group', id=gr.users_group_id),

            params={'_authentication_token': self.authentication_token()})

        gr = Session().query(UserGroup) \

            .filter(UserGroup.users_group_name == users_group_name).scalar()

        assert gr == None

    def test_default_perms_enable_repository_read_on_group(self):

        self.log_user()

        users_group_name = TEST_USER_GROUP + 'another2'

        response = self.app.post(url('users_groups'),

                                 {'users_group_name': users_group_name,

                                  'user_group_description': u'DESC',

                                  'active': True,

                                  '_authentication_token': self.authentication_token()})

        response.follow()

        ug = UserGroup.get_by_group_name(users_group_name)

        self.checkSessionFlash(response,

                               'Created user group ')

        ## ENABLE REPO CREATE ON A GROUP

                                 {'create_repo_perm': True,

                                  '_authentication_token': self.authentication_token()})

        response.follow()

        ug = UserGroup.get_by_group_name(users_group_name)

        p = Permission.get_by_key('hg.create.repository')

        p2 = Permission.get_by_key('hg.usergroup.create.false')

        p3 = Permission.get_by_key('hg.fork.none')

        # check if user has this perms, they should be here since

        # defaults are on

        perms = UserGroupToPerm.query() \

            .filter(UserGroupToPerm.users_group == ug).all()

        assert sorted([[x.users_group_id, x.permission_id, ] for x in perms]) == sorted([[ug.users_group_id, p.permission_id],

                    [ug.users_group_id, p2.permission_id],

                    [ug.users_group_id, p3.permission_id]])

        ## DISABLE REPO CREATE ON A GROUP

            params={'_authentication_token': self.authentication_token()})

        response.follow()

        ug = UserGroup.get_by_group_name(users_group_name)

        p = Permission.get_by_key('hg.create.none')

        p2 = Permission.get_by_key('hg.usergroup.create.false')

        p3 = Permission.get_by_key('hg.fork.none')

        # check if user has this perms, they should be here since

        # defaults are on

        perms = UserGroupToPerm.query() \

            .filter(UserGroupToPerm.users_group == ug).all()

        assert sorted([[x.users_group_id, x.permission_id, ] for x in perms]) == sorted([[ug.users_group_id, p.permission_id],

                    [ug.users_group_id, p2.permission_id],

                    [ug.users_group_id, p3.permission_id]])

        # DELETE !

        ug = UserGroup.get_by_group_name(users_group_name)

        ugid = ug.users_group_id

        response = self.app.post(url('delete_users_group', id=ug.users_group_id),

            params={'_authentication_token': self.authentication_token()})

        response = response.follow()

        gr = Session().query(UserGroup) \

            .filter(UserGroup.users_group_name == users_group_name).scalar()

        assert gr == None

        p = Permission.get_by_key('hg.create.repository')

        perms = UserGroupToPerm.query() \

            .filter(UserGroupToPerm.users_group_id == ugid).all()

        perms = [[x.users_group_id,

                  x.permission_id, ] for x in perms]

        assert perms == []

    def test_default_perms_enable_repository_fork_on_group(self):

        self.log_user()

        users_group_name = TEST_USER_GROUP + 'another2'

        response = self.app.post(url('users_groups'),

                                 {'users_group_name': users_group_name,

                                  'user_group_description': u'DESC',

                                  'active': True,

                                  '_authentication_token': self.authentication_token()})

        response.follow()

        ug = UserGroup.get_by_group_name(users_group_name)

        self.checkSessionFlash(response,

                               'Created user group ')

        ## ENABLE REPO CREATE ON A GROUP

        response.follow()

        ug = UserGroup.get_by_group_name(users_group_name)

        p = Permission.get_by_key('hg.create.none')

        p2 = Permission.get_by_key('hg.usergroup.create.false')

        p3 = Permission.get_by_key('hg.fork.repository')

        # check if user has this perms, they should be here since

        # defaults are on

        perms = UserGroupToPerm.query() \

            .filter(UserGroupToPerm.users_group == ug).all()

        assert sorted([[x.users_group_id, x.permission_id, ] for x in perms]) == sorted([[ug.users_group_id, p.permission_id],

                    [ug.users_group_id, p2.permission_id],

                    [ug.users_group_id, p3.permission_id]])

        ## DISABLE REPO CREATE ON A GROUP

            params={'_authentication_token': self.authentication_token()})

        response.follow()

        ug = UserGroup.get_by_group_name(users_group_name)

        p = Permission.get_by_key('hg.create.none')

        p2 = Permission.get_by_key('hg.usergroup.create.false')

        p3 = Permission.get_by_key('hg.fork.none')

        # check if user has this perms, they should be here since

        # defaults are on

        perms = UserGroupToPerm.query() \

            .filter(UserGroupToPerm.users_group == ug).all()

        assert sorted([[x.users_group_id, x.permission_id, ] for x in perms]) == sorted([[ug.users_group_id, p.permission_id],

                    [ug.users_group_id, p2.permission_id],

                    [ug.users_group_id, p3.permission_id]])

        # DELETE !

        ug = UserGroup.get_by_group_name(users_group_name)

        ugid = ug.users_group_id

        response = self.app.post(url('delete_users_group', id=ug.users_group_id),

            params={'_authentication_token': self.authentication_token()})

        response = response.follow()

        gr = Session().query(UserGroup) \

                           .filter(UserGroup.users_group_name ==

            params={'_authentication_token': self.authentication_token()})

        self.checkSessionFlash(response, 'Successfully deleted user')

    def test_edit(self):

        self.log_user()

        user = User.get_by_username(TEST_USER_ADMIN_LOGIN)

        response = self.app.get(url('edit_user', id=user.user_id))

    def test_add_perm_create_repo(self):

        self.log_user()

        perm_none = Permission.get_by_key('hg.create.none')

        perm_create = Permission.get_by_key('hg.create.repository')

        user = UserModel().create_or_update(username='dummy', password='qwe',

                                            email='dummy', firstname=u'a',

                                            lastname=u'b')

        Session().commit()

        uid = user.user_id

        try:

            #User should have None permission on creation repository

            assert UserModel().has_perm(user, perm_none) == False

            assert UserModel().has_perm(user, perm_create) == False

                                                 _authentication_token=self.authentication_token()))

            perm_none = Permission.get_by_key('hg.create.none')

            perm_create = Permission.get_by_key('hg.create.repository')

            #User should have None permission on creation repository

            assert UserModel().has_perm(uid, perm_none) == False

            assert UserModel().has_perm(uid, perm_create) == True

        finally:

            UserModel().delete(uid)

            Session().commit()

    def test_revoke_perm_create_repo(self):

        self.log_user()

        perm_none = Permission.get_by_key('hg.create.none')

        perm_create = Permission.get_by_key('hg.create.repository')

        user = UserModel().create_or_update(username='dummy', password='qwe',

                                            email='dummy', firstname=u'a',

                                            lastname=u'b')

        Session().commit()

        uid = user.user_id

        try:

            #User should have None permission on creation repository

            assert UserModel().has_perm(user, perm_none) == False

            assert UserModel().has_perm(user, perm_create) == False

            perm_none = Permission.get_by_key('hg.create.none')

            perm_create = Permission.get_by_key('hg.create.repository')

            #User should have None permission on creation repository

            assert UserModel().has_perm(uid, perm_none) == True

            assert UserModel().has_perm(uid, perm_create) == False

        finally:

            UserModel().delete(uid)

            Session().commit()

    def test_add_perm_fork_repo(self):

        self.log_user()

        perm_none = Permission.get_by_key('hg.fork.none')

        perm_fork = Permission.get_by_key('hg.fork.repository')

        user = UserModel().create_or_update(username='dummy', password='qwe',

                                            email='dummy', firstname=u'a',

                                            lastname=u'b')

        Session().commit()

        uid = user.user_id

        try:

            #User should have None permission on creation repository

            assert UserModel().has_perm(user, perm_none) == False

            assert UserModel().has_perm(user, perm_fork) == False

                                                 _authentication_token=self.authentication_token()))

            perm_none = Permission.get_by_key('hg.create.none')

            perm_create = Permission.get_by_key('hg.create.repository')

            #User should have None permission on creation repository

            assert UserModel().has_perm(uid, perm_none) == False

            assert UserModel().has_perm(uid, perm_create) == True

        finally:

            UserModel().delete(uid)

            Session().commit()

    def test_revoke_perm_fork_repo(self):

        self.log_user()

        perm_none = Permission.get_by_key('hg.fork.none')

        perm_fork = Permission.get_by_key('hg.fork.repository')

        user = UserModel().create_or_update(username='dummy', password='qwe',

                                            email='dummy', firstname=u'a',

                                            lastname=u'b')

        Session().commit()

        uid = user.user_id

        try:

            #User should have None permission on creation repository

            assert UserModel().has_perm(user, perm_none) == False

            assert UserModel().has_perm(user, perm_fork) == False

            perm_none = Permission.get_by_key('hg.create.none')

            perm_create = Permission.get_by_key('hg.create.repository')

            #User should have None permission on creation repository

            assert UserModel().has_perm(uid, perm_none) == True

            assert UserModel().has_perm(uid, perm_create) == False

        finally:

            UserModel().delete(uid)

            Session().commit()

    def test_ips(self):

        self.log_user()

        user = User.get_by_username(TEST_USER_REGULAR_LOGIN)

        response = self.app.get(url('edit_user_ips', id=user.user_id))

        response.mustcontain('All IP addresses are allowed')

    @parametrize('test_name,ip,ip_range,failure', [

        ('127/24', '127.0.0.1/24', '127.0.0.0 - 127.0.0.255', False),

        ('10/32', '10.0.0.10/32', '10.0.0.10 - 10.0.0.10', False),

        ('0/16', '0.0.0.0/16', '0.0.0.0 - 0.0.255.255', False),

        ('0/8', '0.0.0.0/8', '0.0.0.0 - 0.255.255.255', False),

        ('127_bad_mask', '127.0.0.1/99', '127.0.0.1 - 127.0.0.1', True),

        ('127_bad_ip', 'foobar', 'foobar', True),

        user = User.get_default_user()

        response = self.app.get(url('edit_user_api_keys', id=user.user_id), status=404)

    def test_add_api_keys_default_user(self):

        self.log_user()

        user = User.get_default_user()

        response = self.app.post(url('edit_user_api_keys', id=user.user_id),

                 {'_method': 'put', '_authentication_token': self.authentication_token()}, status=404)

    def test_delete_api_keys_default_user(self):

        self.log_user()

        user = User.get_default_user()

        response = self.app.post(url('edit_user_api_keys_delete', id=user.user_id),

                 {'_authentication_token': self.authentication_token()}, status=404)

    # Permissions

    def test_edit_perms_default_user(self):

        self.log_user()

        user = User.get_default_user()

        response = self.app.get(url('edit_user_perms', id=user.user_id), status=404)

    def test_update_perms_default_user(self):

        self.log_user()

        user = User.get_default_user()

    # Emails

    def test_edit_emails_default_user(self):

        self.log_user()

        user = User.get_default_user()

        response = self.app.get(url('edit_user_emails', id=user.user_id), status=404)

    def test_add_emails_default_user(self):

        self.log_user()

        user = User.get_default_user()

        response = self.app.post(url('edit_user_emails_update', id=user.user_id),

                 {'_authentication_token': self.authentication_token()}, status=404)

    def test_delete_emails_default_user(self):

        self.log_user()

        user = User.get_default_user()

        response = self.app.post(url('edit_user_emails_delete', id=user.user_id),

                 {'_authentication_token': self.authentication_token()}, status=404)

    # IP addresses

    # Add/delete of IP addresses for the default user is used to maintain

    # the global IP whitelist and thus allowed. Only 'edit' is forbidden.

    def test_edit_ip_default_user(self):

        self.log_user()