{'extend_existing': True, 'mysql_engine': 'InnoDB',

         'mysql_charset': 'utf8', 'sqlite_autoincrement': True},

    )

    __mapper_args__ = {'order_by': 'group_name'}

    SEP = ' » '

    group_id = Column("group_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)

    group_name = Column("group_name", String(255, convert_unicode=False), nullable=False, unique=True, default=None)

    group_parent_id = Column("group_parent_id", Integer(), ForeignKey('groups.group_id'), nullable=True, unique=None, default=None)

    group_description = Column("group_description", String(10000, convert_unicode=False), nullable=True, unique=None, default=None)

    enable_locking = Column("enable_locking", Boolean(), nullable=False, unique=None, default=False)

    user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=False, default=None)

    created_on = Column('created_on', DateTime(timezone=False), nullable=False, default=datetime.datetime.now)

    repo_group_to_perm = relationship('UserRepoGroupToPerm', cascade='all', order_by='UserRepoGroupToPerm.group_to_perm_id')

    users_group_to_perm = relationship('UserGroupRepoGroupToPerm', cascade='all')

    parent_group = relationship('RepoGroup', remote_side=group_id)

    user = relationship('User')

    def __init__(self, group_name='', parent_group=None):

        self.group_name = group_name

        self.parent_group = parent_group

    def __unicode__(self):

        return u"<%s('id:%s:%s')>" % (self.__class__.__name__, self.group_id,

                                      self.group_name)

    @classmethod

    def _generate_choice(cls, repo_group):

        from webhelpers.html import literal as _literal

        _name = lambda k: _literal(cls.SEP.join(k))

        return repo_group.group_id, _name(repo_group.full_path_splitted)

    @classmethod

    def groups_choices(cls, groups=None, show_empty_group=True):

        if not groups:

            groups = cls.query().all()

        repo_groups = []

        if show_empty_group:

            repo_groups = [('-1', u'-- %s --' % _('top level'))]

        repo_groups.extend([cls._generate_choice(x) for x in groups])

        repo_groups = sorted(repo_groups, key=lambda t: t[1].split(cls.SEP)[0])

        return repo_groups

    @classmethod

    def url_sep(cls):

        return URL_SEP

    @classmethod

    def get_by_group_name(cls, group_name, cache=False, case_insensitive=False):

        if case_insensitive:

            gr = cls.query()\

                .filter(cls.group_name.ilike(group_name))

        else:

            gr = cls.query()\

                .filter(cls.group_name == group_name)

        if cache:

            gr = gr.options(FromCache(

                            "sql_cache_short",

                            "get_group_%s" % _hash_key(group_name)

                            )

            )

        return gr.scalar()

    @property

    def parents(self):

        parents_recursion_limit = 10

        groups = []

        if self.parent_group is None:

            return groups

        cur_gr = self.parent_group

        groups.insert(0, cur_gr)

        cnt = 0

        while 1:

            cnt += 1

            gr = getattr(cur_gr, 'parent_group', None)

            cur_gr = cur_gr.parent_group

            if gr is None:

                break

            if cnt == parents_recursion_limit:

                # this will prevent accidental infinite loops

                log.error(('more than %s parents found for group %s, stopping '

                           'recursive parent fetching' % (parents_recursion_limit, self)))

                break

            groups.insert(0, gr)

        return groups

    @property

    def children(self):

        return RepoGroup.query().filter(RepoGroup.parent_group == self)

    @property

    def name(self):

        return self.group_name.split(RepoGroup.url_sep())[-1]

    @property

    def full_path(self):

        return self.group_name

    @property

    def full_path_splitted(self):

        return self.group_name.split(RepoGroup.url_sep())

    @property

    def repositories(self):

        return Repository.query()\

                .filter(Repository.group == self)\

                .order_by(Repository.repo_name)

    @property

    def repositories_recursive_count(self):

        cnt = self.repositories.count()

        def children_count(group):

            cnt = 0

            for child in group.children:

                cnt += child.repositories.count()

                cnt += children_count(child)

            return cnt

        return cnt + children_count(self)

    def _recursive_objects(self, include_repos=True):

        all_ = []

        def _get_members(root_gr):

            if include_repos:

                for r in root_gr.repositories:

                    all_.append(r)

            childs = root_gr.children.all()

            if childs:

                for gr in childs:

                    all_.append(gr)

                    _get_members(gr)

        _get_members(self)

        return [self] + all_

    def recursive_groups_and_repos(self):

        """

        Recursive return all groups, with repositories in those groups

        """

        return self._recursive_objects()

    def recursive_groups(self):

        """

        Returns all children groups for this group including children of children

        """

        return self._recursive_objects(include_repos=False)

    def get_new_name(self, group_name):

        """

        returns new full group name based on parent and new name

        :param group_name:

        """

        path_prefix = (self.parent_group.full_path_splitted if

                       self.parent_group else [])

        return RepoGroup.url_sep().join(path_prefix + [group_name])

    def get_api_data(self):

        """

        Common function for generating api data

        """

        group = self

        data = dict(

            group_id=group.group_id,

            group_name=group.group_name,

            group_description=group.group_description,

            parent_group=group.parent_group.group_name if group.parent_group else None,

            repositories=[x.repo_name for x in group.repositories],

            owner=group.user.username

        )

        return data

class Permission(Base, BaseModel):

    __tablename__ = 'permissions'

    __table_args__ = (

        Index('p_perm_name_idx', 'permission_name'),

        {'extend_existing': True, 'mysql_engine': 'InnoDB',

         'mysql_charset': 'utf8', 'sqlite_autoincrement': True},

    )

    PERMS = [

        ('hg.admin', _('Kallithea Administrator')),

        ('hg.create.write_on_repogroup.true', _('Repository creation enabled with write permission to a repository group')),

        ('hg.create.write_on_repogroup.false', _('Repository creation disabled with write permission to a repository group')),

        ('hg.register.none', _('Registration disabled')),

        ('hg.register.manual_activate', _('User Registration with manual account activation')),

        ('hg.register.auto_activate', _('User Registration with automatic account activation')),

        ('hg.extern_activate.manual', _('Manual activation of external account')),

        ('hg.extern_activate.auto', _('Automatic activation of external account')),

    ]

    #definition of system default permissions for DEFAULT user

    DEFAULT_USER_PERMISSIONS = [

        'repository.read',

        'group.read',

        'usergroup.read',

        'hg.create.repository',

        'hg.create.write_on_repogroup.true',

        'hg.fork.repository',

        'hg.register.manual_activate',

        'hg.extern_activate.auto',

    ]

    # defines which permissions are more important higher the more important

    # Weight defines which permissions are more important.

    # The higher number the more important.

    PERM_WEIGHTS = {

        'repository.none': 0,

        'repository.read': 1,

        'repository.write': 3,

        'repository.admin': 4,

        'group.none': 0,

        'group.read': 1,

        'group.write': 3,

        'group.admin': 4,

        'usergroup.none': 0,

        'usergroup.read': 1,

        'usergroup.write': 3,

        'usergroup.admin': 4,

        'hg.repogroup.create.false': 0,

        'hg.repogroup.create.true': 1,

        'hg.usergroup.create.false': 0,

        'hg.usergroup.create.true': 1,

        'hg.fork.none': 0,

        'hg.fork.repository': 1,

        'hg.create.none': 0,

        'hg.create.repository': 1

    }

    permission_id = Column("permission_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)

    permission_name = Column("permission_name", String(255, convert_unicode=False), nullable=True, unique=None, default=None)

    permission_longname = Column("permission_longname", String(255, convert_unicode=False), nullable=True, unique=None, default=None)

    def __unicode__(self):

        return u"<%s('%s:%s')>" % (

            self.__class__.__name__, self.permission_id, self.permission_name

        )

    @classmethod

    def get_by_key(cls, key):

        return cls.query().filter(cls.permission_name == key).scalar()

    @classmethod

    def get_default_perms(cls, default_user_id):

        q = Session().query(UserRepoToPerm, Repository, cls)\

         .join((Repository, UserRepoToPerm.repository_id == Repository.repo_id))\

         .join((cls, UserRepoToPerm.permission_id == cls.permission_id))\

         .filter(UserRepoToPerm.user_id == default_user_id)

        return q.all()

    @classmethod

    def get_default_group_perms(cls, default_user_id):

        q = Session().query(UserRepoGroupToPerm, RepoGroup, cls)\

         .join((RepoGroup, UserRepoGroupToPerm.group_id == RepoGroup.group_id))\

         .join((cls, UserRepoGroupToPerm.permission_id == cls.permission_id))\

         .filter(UserRepoGroupToPerm.user_id == default_user_id)

        return q.all()

    @classmethod

    def get_default_user_group_perms(cls, default_user_id):

        q = Session().query(UserUserGroupToPerm, UserGroup, cls)\

         .join((UserGroup, UserUserGroupToPerm.user_group_id == UserGroup.users_group_id))\

         .join((cls, UserUserGroupToPerm.permission_id == cls.permission_id))\

         .filter(UserUserGroupToPerm.user_id == default_user_id)

        return q.all()

class UserRepoToPerm(Base, BaseModel):

    __tablename__ = 'repo_to_perm'

    __table_args__ = (

        UniqueConstraint('user_id', 'repository_id', 'permission_id'),

        {'extend_existing': True, 'mysql_engine': 'InnoDB',

         'mysql_charset': 'utf8', 'sqlite_autoincrement': True}

    )

    repo_to_perm_id = Column("repo_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)

    user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)

    permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)

    repository_id = Column("repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=False, unique=None, default=None)

    user = relationship('User')

    repository = relationship('Repository')

    permission = relationship('Permission')

    @classmethod

    def create(cls, user, repository, permission):

        n = cls()

        n.user = user

        n.repository = repository

        n.permission = permission

        Session().add(n)

        return n

    def __unicode__(self):

        return u'<%s => %s >' % (self.user, self.repository)

class UserUserGroupToPerm(Base, BaseModel):

    __tablename__ = 'user_user_group_to_perm'

    __table_args__ = (

        UniqueConstraint('user_id', 'user_group_id', 'permission_id'),

        {'extend_existing': True, 'mysql_engine': 'InnoDB',

         'mysql_charset': 'utf8', 'sqlite_autoincrement': True}

    )

    user_user_group_to_perm_id = Column("user_user_group_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)

    user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)

    permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)

    user_group_id = Column("user_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)

    user = relationship('User')

    user_group = relationship('UserGroup')

    permission = relationship('Permission')

    @classmethod

    def create(cls, user, user_group, permission):

        n = cls()

        n.user = user

        n.user_group = user_group

        n.permission = permission

        Session().add(n)

        return n

    def __unicode__(self):

        return u'<%s => %s >' % (self.user, self.user_group)

class UserToPerm(Base, BaseModel):

    __tablename__ = 'user_to_perm'

    __table_args__ = (

        UniqueConstraint('user_id', 'permission_id'),

        {'extend_existing': True, 'mysql_engine': 'InnoDB',

         'mysql_charset': 'utf8', 'sqlite_autoincrement': True}

    )

    user_to_perm_id = Column("user_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)

    user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)

    permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)

    user = relationship('User')

    permission = relationship('Permission')

    def __unicode__(self):

        return u'<%s => %s >' % (self.user, self.permission)

class UserGroupRepoToPerm(Base, BaseModel):

    __tablename__ = 'users_group_repo_to_perm'

    __table_args__ = (

        UniqueConstraint('repository_id', 'users_group_id', 'permission_id'),

        {'extend_existing': True, 'mysql_engine': 'InnoDB',

         'mysql_charset': 'utf8', 'sqlite_autoincrement': True}

    )

    users_group_to_perm_id = Column("users_group_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)

    users_group_id = Column("users_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)

    permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)

    repository_id = Column("repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=False, unique=None, default=None)

    users_group = relationship('UserGroup')

    permission = relationship('Permission')

    repository = relationship('Repository')

    @classmethod

    def create(cls, users_group, repository, permission):

        n = cls()

        n.users_group = users_group

        n.repository = repository

        n.permission = permission

        Session().add(n)

        return n

    def __unicode__(self):

        return u'<UserGroupRepoToPerm:%s => %s >' % (self.users_group, self.repository)

class UserGroupUserGroupToPerm(Base, BaseModel):

    __tablename__ = 'user_group_user_group_to_perm'

${h.form(url('admin_permissions'), method='post')}

    <div class="form">

        <!-- fields -->

        <div class="fields">

            <div class="field">

                <div class="label label-checkbox">

                    <label for="anonymous">${_('Anonymous access')}:</label>

                </div>

                <div class="checkboxes">

                    <div class="checkbox">

                        ${h.checkbox('anonymous',True)}

                    </div>

                     <span class="help-block">${h.literal(_('Allow access to Kallithea without needing to log in. Anonymous users use %s user permissions.' % (h.link_to('*default*',h.url('admin_permissions_perms')))))}</span>

                </div>

            </div>

            <div class="field">

                <div class="label">

                    <label for="default_repo_perm">${_('Repository')}:</label>

                </div>

                <div class="select">

                    ${h.select('default_repo_perm','',c.repo_perms_choices)}

                    ${h.checkbox('overwrite_default_repo','true')}

                    <label for="overwrite_default_repo">

                    <span class="tooltip"

                    title="${h.tooltip(_('All default permissions on each repository will be reset to chosen permission, note that all custom default permission on repositories will be lost'))}">

                </div>

            </div>

            <div class="field">

                <div class="label">

                    <label for="default_group_perm">${_('Repository group')}:</label>

                </div>

                <div class="select">

                    ${h.select('default_group_perm','',c.group_perms_choices)}

                    ${h.checkbox('overwrite_default_group','true')}

                    <label for="overwrite_default_group">

                    <span class="tooltip"

                    title="${h.tooltip(_('All default permissions on each repository group will be reset to chosen permission, note that all custom default permission on repository groups will be lost'))}">

                </div>

            </div>

            <div class="field">

                <div class="label">

                    <label for="default_group_perm">${_('User group')}:</label>

                </div>

                <div class="select">

                    ${h.select('default_user_group_perm','',c.user_group_perms_choices)}

                    ${h.checkbox('overwrite_default_user_group','true')}

                    <label for="overwrite_default_user_group">

                    <span class="tooltip"

                    title="${h.tooltip(_('All default permissions on each user group will be reset to chosen permission, note that all custom default permission on repository groups will be lost'))}">

                </div>

            </div>

             <div class="field">

                <div class="label">

                </div>

                <div class="select">

                    ${h.select('default_repo_create','',c.repo_create_choices)}

                </div>

             </div>

            <div class="field">

                <div class="label label-checkbox">

                    <label for="create_on_write">${_('Repository creation with group write access')}:</label>

                </div>

                <div class="select">

                    ${h.select('create_on_write','',c.repo_create_on_write_choices)}

                </div>

            </div>

             <div class="field">

                <div class="label">

                    <label for="default_user_group_create">${_('User group creation')}:</label>

                </div>

                <div class="select">

                    ${h.select('default_user_group_create','',c.user_group_create_choices)}

                </div>

             </div>

             <div class="field">

                <div class="label">

                    <label for="default_fork">${_('Repository forking')}:</label>

                </div>

                <div class="select">

                    ${h.select('default_fork','',c.fork_choices)}

                </div>

             </div>

             <div class="field">

                <div class="label">

                    <label for="default_register">${_('Registration')}:</label>

                </div>

                <div class="select">

                    ${h.select('default_register','',c.register_choices)}

                </div>

             </div>

             <div class="field">

                <div class="label">

                    <label for="default_extern_activate">${_('External auth account activation')}:</label>

                </div>

                <div class="select">

                    ${h.select('default_extern_activate','',c.extern_activate_choices)}

                </div>

             </div>

            <div class="buttons">

              ${h.submit('save',_('Save'),class_="btn")}

              ${h.reset('reset',_('Reset'),class_="btn")}

            </div>

        </div>

    </div>

${h.end_form()}