Changeset - 6d0573ba0721
Parent rev.
Child rev.
[Not reviewed]
default
0 3 0
Mads Kiilerich - 7 years ago 2018-12-29 19:16:56
mads@kiilerich.com
auth: drop "multiple_counter" from computing permissions

This seems to have been something about having some permissions override
existing permissions. It is not clear to me why anybody should want that.

test_user_group_permissions_on_repo_groups.py seems to have been testing for
something we don't want. The new behaviour seems more reasonable. The test user
is inhering access from the default user, and thus in this case getting read
access (except when private).
3 files changed with 10 insertions and 19 deletions:
kallithea/lib/auth.py
4
13
kallithea/tests/models/test_permissions.py
1
1
kallithea/tests/models/test_user_group_permissions_on_repo_groups.py
5
5
0 comments (0 inline, 0 general)
kallithea/lib/auth.py
➞
Show inline comments
 
@@ -276,32 +276,29 @@ def _cached_perms_data(user_id, user_is_
 
        .join((Repository, UserGroupRepoToPerm.repository_id ==
 
               Repository.repo_id)) \
 
        .join((Permission, UserGroupRepoToPerm.permission_id ==
 
               Permission.permission_id)) \
 
        .join((UserGroup, UserGroupRepoToPerm.users_group_id ==
 
               UserGroup.users_group_id)) \
 
        .filter(UserGroup.users_group_active == True) \
 
        .join((UserGroupMember, UserGroupRepoToPerm.users_group_id ==
 
               UserGroupMember.users_group_id)) \
 
        .filter(UserGroupMember.user_id == user_id) \
 
        .all()
 

			




	
	
	
		
 
    multiple_counter = collections.defaultdict(int)

			




	
	
	
		
 
    for perm in user_repo_perms_from_users_groups:

			




	
	
	
		
 
        r_k = perm.UserGroupRepoToPerm.repository.repo_name

			




	
	
	
		
 
        multiple_counter[r_k] += 1

			




	
	
	
		
 
        cur_perm = permissions[RK][r_k]

			




	
	
	
		
 
        p = perm.Permission.permission_name

			




	
	
	
		
 
        cur_perm = permissions[RK][r_k]

			




	
	
	
		
 
        if multiple_counter[r_k] > 1:

			




	
	
	
		
 
            p = _choose_perm(p, cur_perm)

			




	
	
	
		
 
        p = _choose_perm(p, cur_perm)

			




	
	
	
		
 
        permissions[RK][r_k] = p

			




	
	
	
		
 

			




	
	
	
		
 
    # user permissions for repositories

			




	
	
	
		
 
    user_repo_perms = Permission.get_default_perms(user_id)

			




	
	
	
		
 
    for perm in user_repo_perms:

			




	
	
	
		
 
        r_k = perm.UserRepoToPerm.repository.repo_name

			




	
	
	
		
 
        cur_perm = permissions[RK][r_k]

			




	
	
	
		
 
        p = perm.Permission.permission_name

			




	
	
	
		
 
        p = _choose_perm(p, cur_perm)

			




	
	
	
		
 
        permissions[RK][r_k] = p

			




	
	
	
		
 

			




	
	
	
		
 
    #======================================================================

			




	
	
		
 
@@ -316,32 +313,29 @@ def _cached_perms_data(user_id, user_is_

			




	
	
	
		
 
     Session().query(UserGroupRepoGroupToPerm, Permission, RepoGroup) \

			




	
	
	
		
 
     .join((RepoGroup, UserGroupRepoGroupToPerm.group_id == RepoGroup.group_id)) \

			




	
	
	
		
 
     .join((Permission, UserGroupRepoGroupToPerm.permission_id

			




	
	
	
		
 
            == Permission.permission_id)) \

			




	
	
	
		
 
     .join((UserGroup, UserGroupRepoGroupToPerm.users_group_id ==

			




	
	
	
		
 
            UserGroup.users_group_id)) \

			




	
	
	
		
 
     .filter(UserGroup.users_group_active == True) \

			




	
	
	
		
 
     .join((UserGroupMember, UserGroupRepoGroupToPerm.users_group_id

			




	
	
	
		
 
            == UserGroupMember.users_group_id)) \

			




	
	
	
		
 
     .filter(UserGroupMember.user_id == user_id) \

			




	
	
	
		
 
     .all()

			




	
	
	
		
 

			




	
	
	
		
 
    multiple_counter = collections.defaultdict(int)

			




	
	
	
		
 
    for perm in user_repo_group_perms_from_users_groups:

			




	
	
	
		
 
        g_k = perm.UserGroupRepoGroupToPerm.group.group_name

			




	
	
	
		
 
        multiple_counter[g_k] += 1

			




	
	
	
		
 
        p = perm.Permission.permission_name

			




	
	
	
		
 
        cur_perm = permissions[GK][g_k]

			




	
	
	
		
 
        if multiple_counter[g_k] > 1:

			




	
	
	
		
 
            p = _choose_perm(p, cur_perm)

			




	
	
	
		
 
        p = _choose_perm(p, cur_perm)

			




	
	
	
		
 
        permissions[GK][g_k] = p

			




	
	
	
		
 

			




	
	
	
		
 
    # user explicit permissions for repository groups

			




	
	
	
		
 
    user_repo_groups_perms = Permission.get_default_group_perms(user_id)

			




	
	
	
		
 
    for perm in user_repo_groups_perms:

			




	
	
	
		
 
        rg_k = perm.UserRepoGroupToPerm.group.group_name

			




	
	
	
		
 
        p = perm.Permission.permission_name

			




	
	
	
		
 
        cur_perm = permissions[GK][rg_k]

			




	
	
	
		
 
        p = _choose_perm(p, cur_perm)

			




	
	
	
		
 
        permissions[GK][rg_k] = p

			




	
	
	
		
 

			




	
	
	
		
 
    #======================================================================

			




	
	
		
 
@@ -353,32 +347,29 @@ def _cached_perms_data(user_id, user_is_

			




	
	
	
		
 
     .join((UserGroup, UserGroupUserGroupToPerm.target_user_group_id

			




	
	
	
		
 
            == UserGroup.users_group_id)) \

			




	
	
	
		
 
     .join((Permission, UserGroupUserGroupToPerm.permission_id

			




	
	
	
		
 
            == Permission.permission_id)) \

			




	
	
	
		
 
     .join((UserGroupMember, UserGroupUserGroupToPerm.user_group_id

			




	
	
	
		
 
            == UserGroupMember.users_group_id)) \

			




	
	
	
		
 
     .filter(UserGroupMember.user_id == user_id) \

			




	
	
	
		
 
     .join((UserGroup, UserGroupMember.users_group_id ==

			




	
	
	
		
 
            UserGroup.users_group_id), aliased=True, from_joinpoint=True) \

			




	
	
	
		
 
     .filter(UserGroup.users_group_active == True) \

			




	
	
	
		
 
     .all()

			




	
	
	
		
 

			




	
	
	
		
 
    multiple_counter = collections.defaultdict(int)

			




	
	
	
		
 
    for perm in user_group_user_groups_perms:

			




	
	
	
		
 
        g_k = perm.UserGroupUserGroupToPerm.target_user_group.users_group_name

			




	
	
	
		
 
        multiple_counter[g_k] += 1

			




	
	
	
		
 
        p = perm.Permission.permission_name

			




	
	
	
		
 
        cur_perm = permissions[UK][g_k]

			




	
	
	
		
 
        if multiple_counter[g_k] > 1:

			




	
	
	
		
 
            p = _choose_perm(p, cur_perm)

			




	
	
	
		
 
        p = _choose_perm(p, cur_perm)

			




	
	
	
		
 
        permissions[UK][g_k] = p

			




	
	
	
		
 

			




	
	
	
		
 
    # user explicit permission for user groups

			




	
	
	
		
 
    user_user_groups_perms = Permission.get_default_user_group_perms(user_id)

			




	
	
	
		
 
    for perm in user_user_groups_perms:

			




	
	
	
		
 
        u_k = perm.UserUserGroupToPerm.user_group.users_group_name

			




	
	
	
		
 
        p = perm.Permission.permission_name

			




	
	
	
		
 
        cur_perm = permissions[UK][u_k]

			




	
	
	
		
 
        p = _choose_perm(p, cur_perm)

			




	
	
	
		
 
        permissions[UK][u_k] = p

			




	
	
	
		
 

			




	
	
	
		
 
    return permissions

			




        

    


    
    

    

        

                

                    kallithea/tests/models/test_permissions.py
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -590,25 +590,25 @@ class TestPermissions(TestController):

			




	
	
	
		
 
        # he has permissions of admin as owner

			




	
	
	
		
 
        u1_auth = AuthUser(user_id=self.u1.user_id)

			




	
	
	
		
 
        assert u1_auth.permissions['repositories']['myownrepo'] == 'repository.admin'

			




	
	
	
		
 
        # set his permission as user group, he should still be admin

			




	
	
	
		
 
        self.ug1 = fixture.create_user_group(u'G1')

			




	
	
	
		
 
        UserGroupModel().add_user_to_group(self.ug1, self.u1)

			




	
	
	
		
 
        RepoModel().grant_user_group_permission(self.test_repo,

			




	
	
	
		
 
                                                 group_name=self.ug1,

			




	
	
	
		
 
                                                 perm='repository.none')

			




	
	
	
		
 

			




	
	
	
		
 
        Session().commit()

			




	
	
	
		
 
        u1_auth = AuthUser(user_id=self.u1.user_id)

			




	
	
	
		
 
        assert u1_auth.permissions['repositories']['myownrepo'] == 'repository.none' # temporarily, because multiple_counter

			




	
	
	
		
 
        assert u1_auth.permissions['repositories']['myownrepo'] == 'repository.admin'

			




	
	
	
		
 

			




	
	
	
		
 
    def test_owner_permissions_doesnot_get_overwritten_by_others(self):

			




	
	
	
		
 
        # create repo as USER,

			




	
	
	
		
 
        self.test_repo = fixture.create_repo(name=u'myownrepo',

			




	
	
	
		
 
                                             repo_type='hg',

			




	
	
	
		
 
                                             cur_user=self.u1)

			




	
	
	
		
 

			




	
	
	
		
 
        # he has permissions of admin as owner

			




	
	
	
		
 
        u1_auth = AuthUser(user_id=self.u1.user_id)

			




	
	
	
		
 
        assert u1_auth.permissions['repositories']['myownrepo'] == 'repository.admin'

			




	
	
	
		
 
        # set his permission as user, he should still be admin

			




	
	
	
		
 
        RepoModel().grant_user_permission(self.test_repo, user=self.u1,

			




        

    


    
    

    

        

                

                    kallithea/tests/models/test_user_group_permissions_on_repo_groups.py
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -120,49 +120,49 @@ def test_user_permissions_on_group_with_

			




	
	
	
		
 

			




	
	
	
		
 
def test_user_permissions_on_group_with_recursive_mode_inner_group():

			




	
	
	
		
 
    ## set permission to g0_3 group to none

			




	
	
	
		
 
    recursive = 'all'

			




	
	
	
		
 
    group = u'g0/g0_3'

			




	
	
	
		
 
    permissions_setup_func(group, 'group.none', recursive=recursive)

			




	
	
	
		
 

			




	
	
	
		
 
    repo_items = [x for x in _get_repo_perms(group, recursive)]

			




	
	
	
		
 
    items = [x for x in _get_group_perms(group, recursive)]

			




	
	
	
		
 
    _check_expected_count(items, repo_items, expected_count(group, True))

			




	
	
	
		
 

			




	
	
	
		
 
    for name, perm in repo_items:

			




	
	
	
		
 
        check_tree_perms(name, perm, group, 'repository.none')

			




	
	
	
		
 
        check_tree_perms(name, perm, group, 'repository.none' if name.endswith('_private') else 'repository.read')

			




	
	
	
		
 

			




	
	
	
		
 
    for name, perm in items:

			




	
	
	
		
 
        check_tree_perms(name, perm, group, 'group.none')

			




	
	
	
		
 
        check_tree_perms(name, perm, group, 'group.read')

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
def test_user_permissions_on_group_with_recursive_mode_deepest():

			




	
	
	
		
 
    ## set permission to g0_3 group to none

			




	
	
	
		
 
    ## set permission to g0/g0_1/g0_1_1 group to write

			




	
	
	
		
 
    recursive = 'all'

			




	
	
	
		
 
    group = u'g0/g0_1/g0_1_1'

			




	
	
	
		
 
    permissions_setup_func(group, 'group.write', recursive=recursive)

			




	
	
	
		
 

			




	
	
	
		
 
    repo_items = [x for x in _get_repo_perms(group, recursive)]

			




	
	
	
		
 
    items = [x for x in _get_group_perms(group, recursive)]

			




	
	
	
		
 
    _check_expected_count(items, repo_items, expected_count(group, True))

			




	
	
	
		
 

			




	
	
	
		
 
    for name, perm in repo_items:

			




	
	
	
		
 
        check_tree_perms(name, perm, group, 'repository.write')

			




	
	
	
		
 

			




	
	
	
		
 
    for name, perm in items:

			




	
	
	
		
 
        check_tree_perms(name, perm, group, 'group.write')

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
def test_user_permissions_on_group_with_recursive_mode_only_with_repos():

			




	
	
	
		
 
    ## set permission to g0_3 group to none

			




	
	
	
		
 
    ## set permission to g0/g0_2 group to admin

			




	
	
	
		
 
    recursive = 'all'

			




	
	
	
		
 
    group = u'g0/g0_2'

			




	
	
	
		
 
    permissions_setup_func(group, 'group.admin', recursive=recursive)

			




	
	
	
		
 

			




	
	
	
		
 
    repo_items = [x for x in _get_repo_perms(group, recursive)]

			




	
	
	
		
 
    items = [x for x in _get_group_perms(group, recursive)]

			




	
	
	
		
 
    _check_expected_count(items, repo_items, expected_count(group, True))

			




	
	
	
		
 

			




	
	
	
		
 
    for name, perm in repo_items:

			




	
	
	
		
 
        check_tree_perms(name, perm, group, 'repository.admin')

			




	
	
	
		
 

			




	
	
	
		
 
    for name, perm in items:

			




	
	
		
 
@@ -199,13 +199,13 @@ def test_user_permissions_on_group_with_

			




	
	
	
		
 
    group = u'g0/g0_1'

			




	
	
	
		
 
    perm = 'group.none'

			




	
	
	
		
 
    permissions_setup_func(group, perm, recursive=recursive)

			




	
	
	
		
 

			




	
	
	
		
 
    repo_items = [x for x in _get_repo_perms(group, recursive)]

			




	
	
	
		
 
    items = [x for x in _get_group_perms(group, recursive)]

			




	
	
	
		
 
    _check_expected_count(items, repo_items, expected_count(group, True))

			




	
	
	
		
 

			




	
	
	
		
 
    for name, perm in repo_items:

			




	
	
	
		
 
        check_tree_perms(name, perm, group, 'repository.read')

			




	
	
	
		
 

			




	
	
	
		
 
    for name, perm in items:

			




	
	
	
		
 
        check_tree_perms(name, perm, group, 'group.none')

			




	
	
	
		
 
        check_tree_perms(name, perm, group, 'group.read')

			




        

    



    


    



    



      

      





    
    0 comments (0 inline, 0 general)
    





    


  

  







  


    




    








    
        
    
    
        This site is powered by
            Kallithea 0.7.0,
        which is
        © 2010–2025 by various authors & licensed under GPLv3.