"owner" :     "<onwer_name_or_id = Optional(=apiuser)>",

__dbversion__ = 12  # defines current db version for migrations

        #add repo perm member

        m.connect('set_repo_group_perm_member',

                  "/set_repo_group_perm_member/{group_name:.*?}",

             action="set_repo_group_perm_member",

             conditions=dict(method=["POST"], function=check_group))

        # update

        m.connect("users_group_perm", "/users_groups/{id}/update_global_perm",

        #add user group perm member

        m.connect('set_user_group_perm_member', "/users_groups/{id}/grant_perm",

             action="set_user_group_perm_member",

             conditions=dict(method=["POST"]))

        #ajax delete user group perm

        m.connect('delete_user_group_perm_member', "/users_groups/{id}/revoke_perm",

             action="delete_user_group_perm_member",

             conditions=dict(method=["DELETE"]))

from rhodecode.model.scm import ScmModel, RepoGroupList

        acl_groups = RepoGroupList(RepoGroup.query().all(),

        acl_groups = RepoGroupList(RepoGroup.query().all(),

        RepoModel()._update_permissions(repo_name, form['perms_new'],

                                        form['perms_updates'])

from rhodecode.model.scm import RepoGroupList

from rhodecode.model.forms import ReposGroupForm, RepoGroupPermsForm

        groups_with_admin_rights = RepoGroupList(RepoGroup.query().all(),

        # fill repository group users

        # fill repository group groups

        group_iter = RepoGroupList(RepoGroup.query().all(),

                                   perm_set=['group.admin'])

        c.repos_group = ReposGroupModel()._get_repo_group(group_name)

        gr = c.repos_group = ReposGroupModel()._get_repo_group(group_name)

    def set_repo_group_perm_member(self, group_name):

        c.repos_group = ReposGroupModel()._get_repo_group(group_name)

        form = RepoGroupPermsForm()().to_python(request.POST)

        recursive = form['recursive']

        # iterate over all members(if in recursive mode) of this groups and

        # set the permissions !

        # this can be potentially heavy operation

        ReposGroupModel()._update_permissions(c.repos_group, form['perms_new'],

                                              form['perms_updates'], recursive)

        #TODO: implement this

        #action_logger(self.rhodecode_user, 'admin_changed_repo_permissions',

        #              repo_name, self.ip_addr, self.sa)

        Session().commit()

        h.flash(_('Repository Group permissions updated'), category='success')

        return redirect(url('edit_repos_group', group_name=group_name))

    @HasReposGroupPermissionAnyDecorator('group.admin')

        c.group = c.repos_group = ReposGroupModel()._get_repo_group(group_name)

        c.repos_group = ReposGroupModel()._get_repo_group(group_name)

from rhodecode.model.scm import ScmModel, RepoGroupList

from rhodecode.lib.utils2 import safe_unicode, str2bool, safe_int

from rhodecode.lib.auth import LoginRequired, HasPermissionAllDecorator,\

    HasUserGroupPermissionAnyDecorator

from rhodecode.model.scm import UserGroupList

from rhodecode.model.repo import RepoModel

from rhodecode.model.forms import UserGroupForm, UserGroupPermsForm

from webob.exc import HTTPInternalServerError

    def __load_data(self, user_group_id):

        ugroup_repo_perms = UserGroupRepoToPerm.query()\

            .options(joinedload(UserGroupRepoToPerm.permission))\

            .options(joinedload(UserGroupRepoToPerm.repository))\

            .filter(UserGroupRepoToPerm.users_group_id == user_group_id)\

            .all()

        for gr in ugroup_repo_perms:

            c.users_group.permissions['repositories'][gr.repository.repo_name]  \

                = gr.permission.permission_name

        ugroup_group_perms = UserGroupRepoGroupToPerm.query()\

            .options(joinedload(UserGroupRepoGroupToPerm.permission))\

            .options(joinedload(UserGroupRepoGroupToPerm.group))\

            .filter(UserGroupRepoGroupToPerm.users_group_id == user_group_id)\

            .all()

        for gr in ugroup_group_perms:

            c.users_group.permissions['repositories_groups'][gr.group.group_name] \

                = gr.permission.permission_name

        c.group_members_obj = sorted((x.user for x in c.users_group.members),

                                     key=lambda u: u.username.lower())

        c.group_members = [(x.user_id, x.username) for x in c.group_members_obj]

        c.available_members = sorted(((x.user_id, x.username) for x in

                                      User.query().all()),

                                     key=lambda u: u[1].lower())

        repo_model = RepoModel()

        c.users_array = repo_model.get_users_js()

        # commented out due to not now supporting assignment for user group

        # on user group

        c.users_groups_array = "[]"  # repo_model.get_users_groups_js()

        c.available_permissions = config['available_permissions']

    def __load_defaults(self, user_group_id):

        """

        Load defaults settings for edit, and update

        :param user_group_id:

        """

        user_group = UserGroup.get_or_404(user_group_id)

        data = user_group.get_dict()

        ug_model = UserGroupModel()

        data.update({

            'create_repo_perm': ug_model.has_perm(user_group,

                                                  'hg.create.repository'),

            'fork_repo_perm': ug_model.has_perm(user_group,

                                                'hg.fork.repository'),

        })

        # fill user group users

        for p in user_group.user_user_group_to_perm:

            data.update({'u_perm_%s' % p.user.username:

                             p.permission.permission_name})

        return data

        group_iter = UserGroupList(UserGroup().query().all(),

                                   perm_set=['usergroup.admin'])

        sk = lambda g: g.users_group_name

        c.users_groups_list = sorted(group_iter, key=sk)

    @HasPermissionAllDecorator('hg.admin')

                                    owner=self.rhodecode_user.user_id,

    @HasPermissionAllDecorator('hg.admin')

    @HasUserGroupPermissionAnyDecorator('usergroup.admin')

        self.__load_data(id)

    @HasUserGroupPermissionAnyDecorator('usergroup.admin')

    @HasUserGroupPermissionAnyDecorator('usergroup.admin')

    def set_user_group_perm_member(self, id):

        """

        grant permission for given usergroup

        :param id:

        """

        user_group = UserGroup.get_or_404(id)

        form = UserGroupPermsForm()().to_python(request.POST)

        # set the permissions !

        UserGroupModel()._update_permissions(user_group, form['perms_new'],

                                            form['perms_updates'])

        #TODO: implement this

        #action_logger(self.rhodecode_user, 'admin_changed_repo_permissions',

        #              repo_name, self.ip_addr, self.sa)

        Session().commit()

        h.flash(_('User Group permissions updated'), category='success')

        return redirect(url('edit_users_group', id=id))

    @HasUserGroupPermissionAnyDecorator('usergroup.admin')

    def delete_user_group_perm_member(self, id):

        """

        DELETE an existing repository group permission user

        :param group_name:

        """

        try:

            obj_type = request.POST.get('obj_type')

            obj_id = None

            if obj_type == 'user':

                obj_id = safe_int(request.POST.get('user_id'))

            elif obj_type == 'user_group':

                obj_id = safe_int(request.POST.get('user_group_id'))

            if not c.rhodecode_user.is_admin:

                if obj_type == 'user' and c.rhodecode_user.user_id == obj_id:

                    msg = _('Cannot revoke permission for yourself as admin')

                    h.flash(msg, category='warning')

                    raise Exception('revoke admin permission on self')

            if obj_type == 'user':

                UserGroupModel().revoke_user_permission(user_group=id,

                                                        user=obj_id)

            elif obj_type == 'user_group':

                pass

            Session().commit()

        except Exception:

            log.error(traceback.format_exc())

            h.flash(_('An error occurred during deletion of group user'),

                    category='error')

            raise HTTPInternalServerError()

    @HasUserGroupPermissionAnyDecorator('usergroup.admin')

        self.__load_data(id)

        defaults = self.__load_defaults(id)

    @HasUserGroupPermissionAnyDecorator('usergroup.admin')

    def create_users_group(self, apiuser, group_name,

                           owner=Optional(OAttr('apiuser')),

                           active=Optional(True)):

        :param owner:

            if isinstance(owner, Optional):

                owner = apiuser.user_id

            owner = get_user_or_error(owner)

            ug = UserGroupModel().create(name=group_name,

                                         owner=owner,

                                         active=active)

from rhodecode.model.scm import ScmModel, RepoGroupList

        acl_groups = RepoGroupList(RepoGroup.query().all(),

from rhodecode.lib.utils import get_repo_slug, get_repos_group_slug,\

    get_user_group_slug

    def repository_groups_admin(self):

    def user_groups_admin(self):

        """

        Returns list of user groups you're an admin of

        """

        return [x[0] for x in self.permissions['user_groups'].iteritems()

                if x[1] == 'usergroup.admin']

    @property

    repository group. All of them have to be meet in order to fulfill the request

    repository group. In order to fulfill the request any of predicates must be meet

class HasUserGroupPermissionAllDecorator(PermsDecorator):

    """

    Checks for access permission for all given predicates for specific

    user group. All of them have to be meet in order to fulfill the request

    """

    def check_permissions(self):

        group_name = get_user_group_slug(request)

        try:

            user_perms = set([self.user_perms['user_groups'][group_name]])

        except KeyError:

            return False

        if self.required_perms.issubset(user_perms):

            return True

        return False

class HasUserGroupPermissionAnyDecorator(PermsDecorator):

    """

    Checks for access permission for any of given predicates for specific

    user group. In order to fulfill the request any of predicates must be meet

    """

    def check_permissions(self):

        group_name = get_user_group_slug(request)

        try:

            user_perms = set([self.user_perms['user_groups'][group_name]])

        except KeyError:

            return False

        if self.required_perms.intersection(user_perms):

            return True

        return False

class HasUserGroupPermissionAny(PermsFunction):

    def __call__(self, user_group_name=None, check_location=''):

        self.user_group_name = user_group_name

        return super(HasUserGroupPermissionAny, self).__call__(check_location)

    def check_permissions(self):

        try:

            self._user_perms = set(

                [self.user_perms['user_groups'][self.user_group_name]]

            )

        except KeyError:

            return False

        if self.required_perms.intersection(self._user_perms):

            return True

        return False

class HasUserGroupPermissionAll(PermsFunction):

    def __call__(self, user_group_name=None, check_location=''):

        self.user_group_name = user_group_name

        return super(HasUserGroupPermissionAll, self).__call__(check_location)

    def check_permissions(self):

        try:

            self._user_perms = set(

                [self.user_perms['user_groups'][self.user_group_name]]

            )

        except KeyError:

            return False

        if self.required_perms.issubset(self._user_perms):

            return True

        return False

            sys.exit('Nothing tables created')

            sys.exit('No upgrade performed')

            def step_12(self):

                self.klass.create_permissions()

                self.klass.populate_default_permissions()

                perm_obj = ReposGroupModel()._create_default_perms(g)

                self.sa.add(perm_obj)

import logging

import datetime

from sqlalchemy import *

from sqlalchemy.exc import DatabaseError

from sqlalchemy.orm import relation, backref, class_mapper, joinedload

from sqlalchemy.orm.session import Session

from sqlalchemy.ext.declarative import declarative_base

from rhodecode.lib.dbmigrate.migrate import *

from rhodecode.lib.dbmigrate.migrate.changeset import *

from rhodecode.model.meta import Base

from rhodecode.model import meta

from rhodecode.lib.dbmigrate.versions import _reset_base

log = logging.getLogger(__name__)

def upgrade(migrate_engine):

    """

    Upgrade operations go here.

    Don't create your own engine; bind migrate_engine to your metadata

    """

    _reset_base(migrate_engine)

    #==========================================================================

    # UserUserGroupToPerm

    #==========================================================================

    from rhodecode.lib.dbmigrate.schema.db_1_7_0 import UserUserGroupToPerm

    tbl = UserUserGroupToPerm.__table__

    tbl.create()

    #==========================================================================

    # UserGroupUserGroupToPerm

    #==========================================================================

    from rhodecode.lib.dbmigrate.schema.db_1_7_0 import UserGroupUserGroupToPerm

    tbl = UserGroupUserGroupToPerm.__table__

    tbl.create()

    #==========================================================================

    # UserGroup

    #==========================================================================

    from rhodecode.lib.dbmigrate.schema.db_1_7_0 import UserGroup

    tbl = UserGroup.__table__

    user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=True, unique=False, default=None)

    # create username column

    user_id.create(table=tbl)

    #==========================================================================

    # UserGroup

    #==========================================================================

    from rhodecode.lib.dbmigrate.schema.db_1_7_0 import RepoGroup

    tbl = RepoGroup.__table__

    user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=True, unique=False, default=None)

    # create username column

    user_id.create(table=tbl)

def downgrade(migrate_engine):

    meta = MetaData()

    meta.bind = migrate_engine

    UserLog, RepoGroup, RhodeCodeSetting, CacheInvalidation, UserGroup

def get_user_group_slug(request):

    _group = request.environ['pylons.routes_dict'].get('id')

    _group = UserGroup.get(_group)

    if _group:

        _group = _group.users_group_name

    return _group