Changeset - 6d0573ba0721
Parent rev.
Child rev.
[Not reviewed]
default
0 3 0
Mads Kiilerich - 7 years ago 2018-12-29 19:16:56
mads@kiilerich.com
auth: drop "multiple_counter" from computing permissions

This seems to have been something about having some permissions override
existing permissions. It is not clear to me why anybody should want that.

test_user_group_permissions_on_repo_groups.py seems to have been testing for
something we don't want. The new behaviour seems more reasonable. The test user
is inhering access from the default user, and thus in this case getting read
access (except when private).
3 files changed with 10 insertions and 19 deletions:
kallithea/lib/auth.py
4
13
kallithea/tests/models/test_permissions.py
1
1
kallithea/tests/models/test_user_group_permissions_on_repo_groups.py
5
5
0 comments (0 inline, 0 general)
kallithea/lib/auth.py
➞
Show inline comments
 
@@ -264,133 +264,124 @@ def _cached_perms_data(user_id, user_is_
 

			




	
	
	
		
 
    #======================================================================

			




	
	
	
		
 
    # !! PERMISSIONS FOR REPOSITORIES !!

			




	
	
	
		
 
    #======================================================================

			




	
	
	
		
 
    #======================================================================

			




	
	
	
		
 
    # check if user is part of user groups for this repository and

			




	
	
	
		
 
    # fill in his permission from it.

			




	
	
	
		
 
    #======================================================================

			




	
	
	
		
 

			




	
	
	
		
 
    # user group for repositories permissions

			




	
	
	
		
 
    user_repo_perms_from_users_groups = \

			




	
	
	
		
 
     Session().query(UserGroupRepoToPerm, Permission, Repository,) \

			




	
	
	
		
 
        .join((Repository, UserGroupRepoToPerm.repository_id ==

			




	
	
	
		
 
               Repository.repo_id)) \

			




	
	
	
		
 
        .join((Permission, UserGroupRepoToPerm.permission_id ==

			




	
	
	
		
 
               Permission.permission_id)) \

			




	
	
	
		
 
        .join((UserGroup, UserGroupRepoToPerm.users_group_id ==

			




	
	
	
		
 
               UserGroup.users_group_id)) \

			




	
	
	
		
 
        .filter(UserGroup.users_group_active == True) \

			




	
	
	
		
 
        .join((UserGroupMember, UserGroupRepoToPerm.users_group_id ==

			




	
	
	
		
 
               UserGroupMember.users_group_id)) \

			




	
	
	
		
 
        .filter(UserGroupMember.user_id == user_id) \

			




	
	
	
		
 
        .all()

			




	
	
	
		
 

			




	
	
	
		
 
    multiple_counter = collections.defaultdict(int)

			




	
	
	
		
 
    for perm in user_repo_perms_from_users_groups:

			




	
	
	
		
 
        r_k = perm.UserGroupRepoToPerm.repository.repo_name

			




	
	
	
		
 
        multiple_counter[r_k] += 1

			




	
	
	
		
 
        cur_perm = permissions[RK][r_k]

			




	
	
	
		
 
        p = perm.Permission.permission_name

			




	
	
	
		
 
        cur_perm = permissions[RK][r_k]

			




	
	
	
		
 
        if multiple_counter[r_k] > 1:

			




	
	
	
		
 
            p = _choose_perm(p, cur_perm)

			




	
	
	
		
 
        p = _choose_perm(p, cur_perm)

			




	
	
	
		
 
        permissions[RK][r_k] = p

			




	
	
	
		
 

			




	
	
	
		
 
    # user permissions for repositories

			




	
	
	
		
 
    user_repo_perms = Permission.get_default_perms(user_id)

			




	
	
	
		
 
    for perm in user_repo_perms:

			




	
	
	
		
 
        r_k = perm.UserRepoToPerm.repository.repo_name

			




	
	
	
		
 
        cur_perm = permissions[RK][r_k]

			




	
	
	
		
 
        p = perm.Permission.permission_name

			




	
	
	
		
 
        p = _choose_perm(p, cur_perm)

			




	
	
	
		
 
        permissions[RK][r_k] = p

			




	
	
	
		
 

			




	
	
	
		
 
    #======================================================================

			




	
	
	
		
 
    # !! PERMISSIONS FOR REPOSITORY GROUPS !!

			




	
	
	
		
 
    #======================================================================

			




	
	
	
		
 
    #======================================================================

			




	
	
	
		
 
    # check if user is part of user groups for this repository groups and

			




	
	
	
		
 
    # fill in his permission from it.

			




	
	
	
		
 
    #======================================================================

			




	
	
	
		
 
    # user group for repo groups permissions

			




	
	
	
		
 
    user_repo_group_perms_from_users_groups = \

			




	
	
	
		
 
     Session().query(UserGroupRepoGroupToPerm, Permission, RepoGroup) \

			




	
	
	
		
 
     .join((RepoGroup, UserGroupRepoGroupToPerm.group_id == RepoGroup.group_id)) \

			




	
	
	
		
 
     .join((Permission, UserGroupRepoGroupToPerm.permission_id

			




	
	
	
		
 
            == Permission.permission_id)) \

			




	
	
	
		
 
     .join((UserGroup, UserGroupRepoGroupToPerm.users_group_id ==

			




	
	
	
		
 
            UserGroup.users_group_id)) \

			




	
	
	
		
 
     .filter(UserGroup.users_group_active == True) \

			




	
	
	
		
 
     .join((UserGroupMember, UserGroupRepoGroupToPerm.users_group_id

			




	
	
	
		
 
            == UserGroupMember.users_group_id)) \

			




	
	
	
		
 
     .filter(UserGroupMember.user_id == user_id) \

			




	
	
	
		
 
     .all()

			




	
	
	
		
 

			




	
	
	
		
 
    multiple_counter = collections.defaultdict(int)

			




	
	
	
		
 
    for perm in user_repo_group_perms_from_users_groups:

			




	
	
	
		
 
        g_k = perm.UserGroupRepoGroupToPerm.group.group_name

			




	
	
	
		
 
        multiple_counter[g_k] += 1

			




	
	
	
		
 
        p = perm.Permission.permission_name

			




	
	
	
		
 
        cur_perm = permissions[GK][g_k]

			




	
	
	
		
 
        if multiple_counter[g_k] > 1:

			




	
	
	
		
 
            p = _choose_perm(p, cur_perm)

			




	
	
	
		
 
        p = _choose_perm(p, cur_perm)

			




	
	
	
		
 
        permissions[GK][g_k] = p

			




	
	
	
		
 

			




	
	
	
		
 
    # user explicit permissions for repository groups

			




	
	
	
		
 
    user_repo_groups_perms = Permission.get_default_group_perms(user_id)

			




	
	
	
		
 
    for perm in user_repo_groups_perms:

			




	
	
	
		
 
        rg_k = perm.UserRepoGroupToPerm.group.group_name

			




	
	
	
		
 
        p = perm.Permission.permission_name

			




	
	
	
		
 
        cur_perm = permissions[GK][rg_k]

			




	
	
	
		
 
        p = _choose_perm(p, cur_perm)

			




	
	
	
		
 
        permissions[GK][rg_k] = p

			




	
	
	
		
 

			




	
	
	
		
 
    #======================================================================

			




	
	
	
		
 
    # !! PERMISSIONS FOR USER GROUPS !!

			




	
	
	
		
 
    #======================================================================

			




	
	
	
		
 
    # user group for user group permissions

			




	
	
	
		
 
    user_group_user_groups_perms = \

			




	
	
	
		
 
     Session().query(UserGroupUserGroupToPerm, Permission, UserGroup) \

			




	
	
	
		
 
     .join((UserGroup, UserGroupUserGroupToPerm.target_user_group_id

			




	
	
	
		
 
            == UserGroup.users_group_id)) \

			




	
	
	
		
 
     .join((Permission, UserGroupUserGroupToPerm.permission_id

			




	
	
	
		
 
            == Permission.permission_id)) \

			




	
	
	
		
 
     .join((UserGroupMember, UserGroupUserGroupToPerm.user_group_id

			




	
	
	
		
 
            == UserGroupMember.users_group_id)) \

			




	
	
	
		
 
     .filter(UserGroupMember.user_id == user_id) \

			




	
	
	
		
 
     .join((UserGroup, UserGroupMember.users_group_id ==

			




	
	
	
		
 
            UserGroup.users_group_id), aliased=True, from_joinpoint=True) \

			




	
	
	
		
 
     .filter(UserGroup.users_group_active == True) \

			




	
	
	
		
 
     .all()

			




	
	
	
		
 

			




	
	
	
		
 
    multiple_counter = collections.defaultdict(int)

			




	
	
	
		
 
    for perm in user_group_user_groups_perms:

			




	
	
	
		
 
        g_k = perm.UserGroupUserGroupToPerm.target_user_group.users_group_name

			




	
	
	
		
 
        multiple_counter[g_k] += 1

			




	
	
	
		
 
        p = perm.Permission.permission_name

			




	
	
	
		
 
        cur_perm = permissions[UK][g_k]

			




	
	
	
		
 
        if multiple_counter[g_k] > 1:

			




	
	
	
		
 
            p = _choose_perm(p, cur_perm)

			




	
	
	
		
 
        p = _choose_perm(p, cur_perm)

			




	
	
	
		
 
        permissions[UK][g_k] = p

			




	
	
	
		
 

			




	
	
	
		
 
    # user explicit permission for user groups

			




	
	
	
		
 
    user_user_groups_perms = Permission.get_default_user_group_perms(user_id)

			




	
	
	
		
 
    for perm in user_user_groups_perms:

			




	
	
	
		
 
        u_k = perm.UserUserGroupToPerm.user_group.users_group_name

			




	
	
	
		
 
        p = perm.Permission.permission_name

			




	
	
	
		
 
        cur_perm = permissions[UK][u_k]

			




	
	
	
		
 
        p = _choose_perm(p, cur_perm)

			




	
	
	
		
 
        permissions[UK][u_k] = p

			




	
	
	
		
 

			




	
	
	
		
 
    return permissions

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
def allowed_api_access(controller_name, whitelist=None, api_key=None):

			




	
	
	
		
 
    """

			




	
	
	
		
 
    Check if given controller_name is in whitelist API access

			




	
	
	
		
 
    """

			




	
	
	
		
 
    if not whitelist:

			




	
	
	
		
 
        from kallithea import CONFIG

			




	
	
	
		
 
        whitelist = aslist(CONFIG.get('api_access_controllers_whitelist'),

			




	
	
	
		
 
                           sep=',')

			




	
	
	
		
 
        log.debug('whitelist of API access is: %s', whitelist)

			




	
	
	
		
 
    api_access_valid = controller_name in whitelist

			




        

    


    
    

    

        

                

                    kallithea/tests/models/test_permissions.py
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -578,49 +578,49 @@ class TestPermissions(TestController):

			




	
	
	
		
 
                                               perm='usergroup.admin')

			




	
	
	
		
 
        Session().commit()

			




	
	
	
		
 
        u1_auth = AuthUser(user_id=self.u1.user_id)

			




	
	
	
		
 
        assert u1_auth.permissions['user_groups'][u'G1'] == u'usergroup.read'

			




	
	
	
		
 
        assert u1_auth.permissions['user_groups'][u'G2'] == u'usergroup.admin'

			




	
	
	
		
 

			




	
	
	
		
 
    def test_owner_permissions_doesnot_get_overwritten_by_group(self):

			




	
	
	
		
 
        # create repo as USER,

			




	
	
	
		
 
        self.test_repo = fixture.create_repo(name=u'myownrepo',

			




	
	
	
		
 
                                             repo_type='hg',

			




	
	
	
		
 
                                             cur_user=self.u1)

			




	
	
	
		
 

			




	
	
	
		
 
        # he has permissions of admin as owner

			




	
	
	
		
 
        u1_auth = AuthUser(user_id=self.u1.user_id)

			




	
	
	
		
 
        assert u1_auth.permissions['repositories']['myownrepo'] == 'repository.admin'

			




	
	
	
		
 
        # set his permission as user group, he should still be admin

			




	
	
	
		
 
        self.ug1 = fixture.create_user_group(u'G1')

			




	
	
	
		
 
        UserGroupModel().add_user_to_group(self.ug1, self.u1)

			




	
	
	
		
 
        RepoModel().grant_user_group_permission(self.test_repo,

			




	
	
	
		
 
                                                 group_name=self.ug1,

			




	
	
	
		
 
                                                 perm='repository.none')

			




	
	
	
		
 

			




	
	
	
		
 
        Session().commit()

			




	
	
	
		
 
        u1_auth = AuthUser(user_id=self.u1.user_id)

			




	
	
	
		
 
        assert u1_auth.permissions['repositories']['myownrepo'] == 'repository.none' # temporarily, because multiple_counter

			




	
	
	
		
 
        assert u1_auth.permissions['repositories']['myownrepo'] == 'repository.admin'

			




	
	
	
		
 

			




	
	
	
		
 
    def test_owner_permissions_doesnot_get_overwritten_by_others(self):

			




	
	
	
		
 
        # create repo as USER,

			




	
	
	
		
 
        self.test_repo = fixture.create_repo(name=u'myownrepo',

			




	
	
	
		
 
                                             repo_type='hg',

			




	
	
	
		
 
                                             cur_user=self.u1)

			




	
	
	
		
 

			




	
	
	
		
 
        # he has permissions of admin as owner

			




	
	
	
		
 
        u1_auth = AuthUser(user_id=self.u1.user_id)

			




	
	
	
		
 
        assert u1_auth.permissions['repositories']['myownrepo'] == 'repository.admin'

			




	
	
	
		
 
        # set his permission as user, he should still be admin

			




	
	
	
		
 
        RepoModel().grant_user_permission(self.test_repo, user=self.u1,

			




	
	
	
		
 
                                          perm='repository.none')

			




	
	
	
		
 
        Session().commit()

			




	
	
	
		
 
        u1_auth = AuthUser(user_id=self.u1.user_id)

			




	
	
	
		
 
        assert u1_auth.permissions['repositories']['myownrepo'] == 'repository.admin'

			




	
	
	
		
 

			




	
	
	
		
 
    def _test_def_perm_equal(self, user, change_factor=0):

			




	
	
	
		
 
        perms = UserToPerm.query() \

			




	
	
	
		
 
                .filter(UserToPerm.user == user) \

			




	
	
	
		
 
                .all()

			




	
	
	
		
 
        assert len(perms) == len(Permission.DEFAULT_USER_PERMISSIONS,)+change_factor, perms

			




	
	
	
		
 

			




	
	
	
		
 
    def test_set_default_permissions(self):

			




        

    


    
    

    

        

                

                    kallithea/tests/models/test_user_group_permissions_on_repo_groups.py
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -108,73 +108,73 @@ def test_user_permissions_on_group_with_

			




	
	
	
		
 
    permissions_setup_func(group, 'group.write', recursive=recursive)

			




	
	
	
		
 

			




	
	
	
		
 
    repo_items = [x for x in _get_repo_perms(group, recursive)]

			




	
	
	
		
 
    items = [x for x in _get_group_perms(group, recursive)]

			




	
	
	
		
 
    _check_expected_count(items, repo_items, expected_count(group, True))

			




	
	
	
		
 

			




	
	
	
		
 
    for name, perm in repo_items:

			




	
	
	
		
 
        check_tree_perms(name, perm, group, 'repository.write')

			




	
	
	
		
 

			




	
	
	
		
 
    for name, perm in items:

			




	
	
	
		
 
        check_tree_perms(name, perm, group, 'group.write')

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
def test_user_permissions_on_group_with_recursive_mode_inner_group():

			




	
	
	
		
 
    ## set permission to g0_3 group to none

			




	
	
	
		
 
    recursive = 'all'

			




	
	
	
		
 
    group = u'g0/g0_3'

			




	
	
	
		
 
    permissions_setup_func(group, 'group.none', recursive=recursive)

			




	
	
	
		
 

			




	
	
	
		
 
    repo_items = [x for x in _get_repo_perms(group, recursive)]

			




	
	
	
		
 
    items = [x for x in _get_group_perms(group, recursive)]

			




	
	
	
		
 
    _check_expected_count(items, repo_items, expected_count(group, True))

			




	
	
	
		
 

			




	
	
	
		
 
    for name, perm in repo_items:

			




	
	
	
		
 
        check_tree_perms(name, perm, group, 'repository.none')

			




	
	
	
		
 
        check_tree_perms(name, perm, group, 'repository.none' if name.endswith('_private') else 'repository.read')

			




	
	
	
		
 

			




	
	
	
		
 
    for name, perm in items:

			




	
	
	
		
 
        check_tree_perms(name, perm, group, 'group.none')

			




	
	
	
		
 
        check_tree_perms(name, perm, group, 'group.read')

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
def test_user_permissions_on_group_with_recursive_mode_deepest():

			




	
	
	
		
 
    ## set permission to g0_3 group to none

			




	
	
	
		
 
    ## set permission to g0/g0_1/g0_1_1 group to write

			




	
	
	
		
 
    recursive = 'all'

			




	
	
	
		
 
    group = u'g0/g0_1/g0_1_1'

			




	
	
	
		
 
    permissions_setup_func(group, 'group.write', recursive=recursive)

			




	
	
	
		
 

			




	
	
	
		
 
    repo_items = [x for x in _get_repo_perms(group, recursive)]

			




	
	
	
		
 
    items = [x for x in _get_group_perms(group, recursive)]

			




	
	
	
		
 
    _check_expected_count(items, repo_items, expected_count(group, True))

			




	
	
	
		
 

			




	
	
	
		
 
    for name, perm in repo_items:

			




	
	
	
		
 
        check_tree_perms(name, perm, group, 'repository.write')

			




	
	
	
		
 

			




	
	
	
		
 
    for name, perm in items:

			




	
	
	
		
 
        check_tree_perms(name, perm, group, 'group.write')

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
def test_user_permissions_on_group_with_recursive_mode_only_with_repos():

			




	
	
	
		
 
    ## set permission to g0_3 group to none

			




	
	
	
		
 
    ## set permission to g0/g0_2 group to admin

			




	
	
	
		
 
    recursive = 'all'

			




	
	
	
		
 
    group = u'g0/g0_2'

			




	
	
	
		
 
    permissions_setup_func(group, 'group.admin', recursive=recursive)

			




	
	
	
		
 

			




	
	
	
		
 
    repo_items = [x for x in _get_repo_perms(group, recursive)]

			




	
	
	
		
 
    items = [x for x in _get_group_perms(group, recursive)]

			




	
	
	
		
 
    _check_expected_count(items, repo_items, expected_count(group, True))

			




	
	
	
		
 

			




	
	
	
		
 
    for name, perm in repo_items:

			




	
	
	
		
 
        check_tree_perms(name, perm, group, 'repository.admin')

			




	
	
	
		
 

			




	
	
	
		
 
    for name, perm in items:

			




	
	
	
		
 
        check_tree_perms(name, perm, group, 'group.admin')

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
def test_user_permissions_on_group_with_recursive_mode_on_repos():

			




	
	
	
		
 
    # set permission to g0/g0_1 with recursive mode on just repositories

			




	
	
	
		
 
    recursive = 'repos'

			




	
	
	
		
 
    group = u'g0/g0_1'

			




	
	
	
		
 
    perm = 'group.write'

			




	
	
	
		
 
    permissions_setup_func(group, perm, recursive=recursive)

			




	
	
	
		
 

			




	
	
	
		
 
    repo_items = [x for x in _get_repo_perms(group, recursive)]

			




	
	
	
		
 
    items = [x for x in _get_group_perms(group, recursive)]

			




	
	
		
 
@@ -187,25 +187,25 @@ def test_user_permissions_on_group_with_

			




	
	
	
		
 
        # permission is set with repos only mode, but we also change the permission

			




	
	
	
		
 
        # on the group we trigger the apply to children from, thus we need

			




	
	
	
		
 
        # to change its permission check

			




	
	
	
		
 
        old_perm = 'group.read'

			




	
	
	
		
 
        if name == group:

			




	
	
	
		
 
            old_perm = perm

			




	
	
	
		
 
        check_tree_perms(name, perm, group, old_perm)

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
def test_user_permissions_on_group_with_recursive_mode_on_repo_groups():

			




	
	
	
		
 
    # set permission to g0/g0_1 with recursive mode on just repository groups

			




	
	
	
		
 
    recursive = 'groups'

			




	
	
	
		
 
    group = u'g0/g0_1'

			




	
	
	
		
 
    perm = 'group.none'

			




	
	
	
		
 
    permissions_setup_func(group, perm, recursive=recursive)

			




	
	
	
		
 

			




	
	
	
		
 
    repo_items = [x for x in _get_repo_perms(group, recursive)]

			




	
	
	
		
 
    items = [x for x in _get_group_perms(group, recursive)]

			




	
	
	
		
 
    _check_expected_count(items, repo_items, expected_count(group, True))

			




	
	
	
		
 

			




	
	
	
		
 
    for name, perm in repo_items:

			




	
	
	
		
 
        check_tree_perms(name, perm, group, 'repository.read')

			




	
	
	
		
 

			




	
	
	
		
 
    for name, perm in items:

			




	
	
	
		
 
        check_tree_perms(name, perm, group, 'group.none')

			




	
	
	
		
 
        check_tree_perms(name, perm, group, 'group.read')

			




        

    



    


    



    



      

      





    
    0 comments (0 inline, 0 general)
    





    


  

  







  


    




    








    
        
    
    
        This site is powered by
            Kallithea 0.7.0,
        which is
        © 2010–2025 by various authors & licensed under GPLv3.