def gen_password(self, length, alphabet=ALPHABETS_FULL):

        assert len(alphabet) <= 256, alphabet

        l = []

        while len(l) < length:

            i = ord(os.urandom(1))

            if i < len(alphabet):

                l.append(alphabet[i])

        return ''.join(l)

class KallitheaCrypto(object):

    @classmethod

    def hash_string(cls, str_):

        """

        Cryptographic function used for password hashing based on pybcrypt

        or pycrypto in windows

        :param password: password to hash

        """

        if is_windows:

            from hashlib import sha256

            return sha256(str_).hexdigest()

        elif is_unix:

            import bcrypt

            return bcrypt.hashpw(str_, bcrypt.gensalt(10))

        else:

            raise Exception('Unknown or unsupported platform %s' \

                            % __platform__)

    @classmethod

    def hash_check(cls, password, hashed):

        """

        Checks matching password with it's hashed value, runs different

        implementation based on platform it runs on

        :param password: password

        :param hashed: password in hashed form

        """

        if is_windows:

            from hashlib import sha256

            return sha256(password).hexdigest() == hashed

        elif is_unix:

            import bcrypt

            return bcrypt.hashpw(password, hashed) == hashed

        else:

            raise Exception('Unknown or unsupported platform %s' \

                            % __platform__)

def get_crypt_password(password):

    return KallitheaCrypto.hash_string(password)

def check_password(password, hashed):

    return KallitheaCrypto.hash_check(password, hashed)

class CookieStoreWrapper(object):

    def __init__(self, cookie_store):

        self.cookie_store = cookie_store

    def __repr__(self):

        return 'CookieStore<%s>' % (self.cookie_store)

    def get(self, key, other=None):

        if isinstance(self.cookie_store, dict):

            return self.cookie_store.get(key, other)

        elif isinstance(self.cookie_store, AuthUser):

            return self.cookie_store.__dict__.get(key, other)

def _cached_perms_data(user_id, user_is_admin, user_inherit_default_permissions,

                       explicit, algo):

    RK = 'repositories'

    GK = 'repositories_groups'

    UK = 'user_groups'

    GLOBAL = 'global'

    PERM_WEIGHTS = Permission.PERM_WEIGHTS

    permissions = {RK: {}, GK: {}, UK: {}, GLOBAL: set()}

    def _choose_perm(new_perm, cur_perm):

        new_perm_val = PERM_WEIGHTS[new_perm]

        cur_perm_val = PERM_WEIGHTS[cur_perm]

        if algo == 'higherwin':

            if new_perm_val > cur_perm_val:

                return new_perm

            return cur_perm

        elif algo == 'lowerwin':

            if new_perm_val < cur_perm_val:

                return new_perm

            return cur_perm

    #======================================================================

    # fetch default permissions

    #======================================================================

    default_user = User.get_by_username('default', cache=True)

    default_user_id = default_user.user_id

    default_repo_perms = Permission.get_default_perms(default_user_id)

    default_repo_groups_perms = Permission.get_default_group_perms(default_user_id)

    default_user_group_perms = Permission.get_default_user_group_perms(default_user_id)

    if user_is_admin:

        #==================================================================

        # admin user have all default rights for repositories

        # and groups set to admin

        #==================================================================

        permissions[GLOBAL].add('hg.admin')

        permissions[GLOBAL].add('hg.create.write_on_repogroup.true')

        # repositories

        for perm in default_repo_perms:

            r_k = perm.UserRepoToPerm.repository.repo_name

            p = 'repository.admin'

            permissions[RK][r_k] = p

        # repository groups

        for perm in default_repo_groups_perms:

            rg_k = perm.UserRepoGroupToPerm.group.group_name

            p = 'group.admin'

            permissions[GK][rg_k] = p

        # user groups

        for perm in default_user_group_perms:

            u_k = perm.UserUserGroupToPerm.user_group.users_group_name

            p = 'usergroup.admin'

            permissions[UK][u_k] = p

        return permissions

    #==================================================================

    # SET DEFAULTS GLOBAL, REPOS, REPOSITORY GROUPS

    #==================================================================

    uid = user_id

    # default global permissions taken from the default user

    default_global_perms = UserToPerm.query()\

        .filter(UserToPerm.user_id == default_user_id)\

        .options(joinedload(UserToPerm.permission))

    for perm in default_global_perms:

        permissions[GLOBAL].add(perm.permission.permission_name)

    # defaults for repositories, taken from default user

    for perm in default_repo_perms:

        r_k = perm.UserRepoToPerm.repository.repo_name

        if perm.Repository.private and not (perm.Repository.user_id == uid):

            # disable defaults for private repos,

            p = 'repository.none'

        elif perm.Repository.user_id == uid:

            # set admin if owner

            p = 'repository.admin'

        else:

            p = perm.Permission.permission_name

        permissions[RK][r_k] = p

    # defaults for repository groups taken from default user permission

    # on given group

    for perm in default_repo_groups_perms:

        rg_k = perm.UserRepoGroupToPerm.group.group_name

        p = perm.Permission.permission_name

        permissions[GK][rg_k] = p

    # defaults for user groups taken from default user permission

    # on given user group

    for perm in default_user_group_perms:

        u_k = perm.UserUserGroupToPerm.user_group.users_group_name

        p = perm.Permission.permission_name

        permissions[UK][u_k] = p

    #======================================================================

    # !! OVERRIDE GLOBALS !! with user permissions if any found

    #======================================================================

    # those can be configured from groups or users explicitly

    _configurable = set([

        'hg.fork.none', 'hg.fork.repository',

        'hg.create.none', 'hg.create.repository',

        'hg.usergroup.create.false', 'hg.usergroup.create.true'

    ])

    # USER GROUPS comes first

    # user group global permissions

    user_perms_from_users_groups = Session().query(UserGroupToPerm)\

        .options(joinedload(UserGroupToPerm.permission))\

        .join((UserGroupMember, UserGroupToPerm.users_group_id ==

               UserGroupMember.users_group_id))\

        .filter(UserGroupMember.user_id == uid)\

        .order_by(UserGroupToPerm.users_group_id)\

        .all()

    # need to group here by groups since user can be in more than

    # one group

    _grouped = [[x, list(y)] for x, y in

                itertools.groupby(user_perms_from_users_groups,

                                  lambda x:x.users_group)]

    for gr, perms in _grouped:

        # since user can be in multiple groups iterate over them and

        # select the lowest permissions first (more explicit)

        ##TODO: do this^^

        if not gr.inherit_default_permissions:

            # NEED TO IGNORE all configurable permissions and

            # replace them with explicitly set

            permissions[GLOBAL] = permissions[GLOBAL]\

                                            .difference(_configurable)

        for perm in perms:

            permissions[GLOBAL].add(perm.permission.permission_name)

    # user specific global permissions

    user_perms = Session().query(UserToPerm)\

            .options(joinedload(UserToPerm.permission))\

            .filter(UserToPerm.user_id == uid).all()

    if not user_inherit_default_permissions:

        # NEED TO IGNORE all configurable permissions and

        # replace them with explicitly set

        permissions[GLOBAL] = permissions[GLOBAL]\

                                        .difference(_configurable)

        for perm in user_perms:

            permissions[GLOBAL].add(perm.permission.permission_name)

    ## END GLOBAL PERMISSIONS

    #======================================================================

    # !! PERMISSIONS FOR REPOSITORIES !!

    #======================================================================

    #======================================================================

    # check if user is part of user groups for this repository and

    # fill in his permission from it. _choose_perm decides of which

    # permission should be selected based on selected method

    #======================================================================

    # user group for repositories permissions

    user_repo_perms_from_users_groups = \

     Session().query(UserGroupRepoToPerm, Permission, Repository,)\

        .join((Repository, UserGroupRepoToPerm.repository_id ==

               Repository.repo_id))\

        .join((Permission, UserGroupRepoToPerm.permission_id ==

               Permission.permission_id))\

        .join((UserGroupMember, UserGroupRepoToPerm.users_group_id ==

               UserGroupMember.users_group_id))\

        .filter(UserGroupMember.user_id == uid)\

        .all()

    multiple_counter = collections.defaultdict(int)

    for perm in user_repo_perms_from_users_groups:

        r_k = perm.UserGroupRepoToPerm.repository.repo_name

        multiple_counter[r_k] += 1

        p = perm.Permission.permission_name

        cur_perm = permissions[RK][r_k]

        if perm.Repository.user_id == uid:

            # set admin if owner

            p = 'repository.admin'

        else:

            if multiple_counter[r_k] > 1:

                p = _choose_perm(p, cur_perm)

        permissions[RK][r_k] = p

    # user explicit permissions for repositories, overrides any specified

    # by the group permission

    user_repo_perms = Permission.get_default_perms(uid)

    for perm in user_repo_perms:

        r_k = perm.UserRepoToPerm.repository.repo_name

        cur_perm = permissions[RK][r_k]

        # set admin if owner

        if perm.Repository.user_id == uid:

            p = 'repository.admin'

        else:

            p = perm.Permission.permission_name

            if not explicit:

                p = _choose_perm(p, cur_perm)

        permissions[RK][r_k] = p

    #======================================================================

    # !! PERMISSIONS FOR REPOSITORY GROUPS !!

    #======================================================================

    #======================================================================

    # check if user is part of user groups for this repository groups and

    # fill in his permission from it. _choose_perm decides of which

    # permission should be selected based on selected method

    #======================================================================

    # user group for repo groups permissions

    user_repo_group_perms_from_users_groups = \

     Session().query(UserGroupRepoGroupToPerm, Permission, RepoGroup)\

     .join((RepoGroup, UserGroupRepoGroupToPerm.group_id == RepoGroup.group_id))\

     .join((Permission, UserGroupRepoGroupToPerm.permission_id

            == Permission.permission_id))\

     .join((UserGroupMember, UserGroupRepoGroupToPerm.users_group_id

            == UserGroupMember.users_group_id))\

     .filter(UserGroupMember.user_id == uid)\

     .all()

    multiple_counter = collections.defaultdict(int)

    for perm in user_repo_group_perms_from_users_groups:

        g_k = perm.UserGroupRepoGroupToPerm.group.group_name

        multiple_counter[g_k] += 1

        p = perm.Permission.permission_name

        cur_perm = permissions[GK][g_k]

        if multiple_counter[g_k] > 1:

            p = _choose_perm(p, cur_perm)

        permissions[GK][g_k] = p

    # user explicit permissions for repository groups

    user_repo_groups_perms = Permission.get_default_group_perms(uid)

    for perm in user_repo_groups_perms:

        rg_k = perm.UserRepoGroupToPerm.group.group_name

        p = perm.Permission.permission_name

        cur_perm = permissions[GK][rg_k]

        if not explicit:

            p = _choose_perm(p, cur_perm)

        permissions[GK][rg_k] = p

    #======================================================================

    # !! PERMISSIONS FOR USER GROUPS !!

    #======================================================================

    # user group for user group permissions

    user_group_user_groups_perms = \

     Session().query(UserGroupUserGroupToPerm, Permission, UserGroup)\

     .join((UserGroup, UserGroupUserGroupToPerm.target_user_group_id

            == UserGroup.users_group_id))\

     .join((Permission, UserGroupUserGroupToPerm.permission_id

            == Permission.permission_id))\

     .join((UserGroupMember, UserGroupUserGroupToPerm.user_group_id

            == UserGroupMember.users_group_id))\

     .filter(UserGroupMember.user_id == uid)\

     .all()

    multiple_counter = collections.defaultdict(int)

    for perm in user_group_user_groups_perms:

        g_k = perm.UserGroupUserGroupToPerm.target_user_group.users_group_name

        multiple_counter[g_k] += 1

        p = perm.Permission.permission_name

        cur_perm = permissions[UK][g_k]

        if multiple_counter[g_k] > 1:

            p = _choose_perm(p, cur_perm)

        permissions[UK][g_k] = p

    #user explicit permission for user groups

    user_user_groups_perms = Permission.get_default_user_group_perms(uid)

    for perm in user_user_groups_perms:

        u_k = perm.UserUserGroupToPerm.user_group.users_group_name

        p = perm.Permission.permission_name

        cur_perm = permissions[UK][u_k]

        if not explicit:

            p = _choose_perm(p, cur_perm)

        permissions[UK][u_k] = p

    return permissions

def allowed_api_access(controller_name, whitelist=None, api_key=None):

    """

    Check if given controller_name is in whitelist API access

    """

    if not whitelist:

        from kallithea import CONFIG

        whitelist = aslist(CONFIG.get('api_access_controllers_whitelist'),

                           sep=',')

        log.debug('whitelist of API access is: %s' % (whitelist))

    api_access_valid = controller_name in whitelist

    if api_access_valid:

        log.debug('controller:%s is in API whitelist' % (controller_name))

    else:

        msg = 'controller: %s is *NOT* in API whitelist' % (controller_name)

        if api_key:

            #if we use API key and don't have access it's a warning

            log.warning(msg)

        else:

            log.debug(msg)

    return api_access_valid

class AuthUser(object):

    """

    A simple object that handles all attributes of user in Kallithea

    It does lookup based on API key,given user, or user present in session

    Then it fills all required information for such user. It also checks if

    anonymous access is enabled and if so, it returns default user as logged in

    """

    def __init__(self, user_id=None, api_key=None, username=None, ip_addr=None):

        self.user_id = user_id

        self._api_key = api_key

        self.api_key = None

        self.username = username

        self.ip_addr = ip_addr

        self.name = ''

        self.lastname = ''

        self.email = ''

        self.is_authenticated = False

        self.admin = False

        self.inherit_default_permissions = False

        self.propagate_data()

        self._instance = None

    @LazyProperty

    def permissions(self):

        return self.get_perms(user=self, cache=False)

    @property

    def api_keys(self):

        return self.get_api_keys()

    def propagate_data(self):

        user_model = UserModel()

        self.anonymous_user = User.get_default_user(cache=True)

        is_user_loaded = False

        # lookup by userid

        if self.user_id is not None and self.user_id != self.anonymous_user.user_id:

            log.debug('Auth User lookup by USER ID %s' % self.user_id)

            is_user_loaded = user_model.fill_data(self, user_id=self.user_id)

        # try go get user by api key

        elif self._api_key and self._api_key != self.anonymous_user.api_key:

            log.debug('Auth User lookup by API KEY %s' % self._api_key)

            is_user_loaded = user_model.fill_data(self, api_key=self._api_key)

        # lookup by username

        elif self.username:

            log.debug('Auth User lookup by USER NAME %s' % self.username)

            is_user_loaded = user_model.fill_data(self, username=self.username)

        else:

            log.debug('No data in %s that could been used to log in' % self)

        if not is_user_loaded:

            # if we cannot authenticate user try anonymous

            if self.anonymous_user.active:

                user_model.fill_data(self, user_id=self.anonymous_user.user_id)

                # then we set this user is logged in

                self.is_authenticated = True

            else:

                self.user_id = None

                self.username = None

                self.is_authenticated = False

        if not self.username:

            self.username = 'None'

        log.debug('Auth User is now %s' % self)

    def get_perms(self, user, explicit=True, algo='higherwin', cache=False):

        """

        Fills user permission attribute with permissions taken from database

        works for permissions given for repositories, and for permissions that

        are granted to groups

        :param user: instance of User object from database

        :param explicit: In case there are permissions both for user and a group

            that user is part of, explicit flag will define if user will

            explicitly override permissions from group, if it's False it will

            make decision based on the algo

        :param algo: algorithm to decide what permission should be choose if

            it's multiple defined, eg user in two different groups. It also

            decides if explicit flag is turned off how to specify the permission

            for case when user is in a group + have defined separate permission

        """

        user_id = user.user_id

        user_is_admin = user.is_admin

        user_inherit_default_permissions = user.inherit_default_permissions

        log.debug('Getting PERMISSION tree')

        compute = conditional_cache('short_term', 'cache_desc',

                                    condition=cache, func=_cached_perms_data)

        return compute(user_id, user_is_admin,

                       user_inherit_default_permissions, explicit, algo)

    def get_api_keys(self):

        api_keys = [self.api_key]

        for api_key in UserApiKeys.query()\

                .filter(UserApiKeys.user_id == self.user_id)\

                .filter(or_(UserApiKeys.expires == -1,

                            UserApiKeys.expires >= time.time())).all():

            api_keys.append(api_key.api_key)

        return api_keys

    @property

    def is_admin(self):

        return self.admin

    @property

    def repositories_admin(self):

        """

        Returns list of repositories you're an admin of

        """

        return [x[0] for x in self.permissions['repositories'].iteritems()

                if x[1] == 'repository.admin']

    @property

    def repository_groups_admin(self):

        """

        Returns list of repository groups you're an admin of

        """

        return [x[0] for x in self.permissions['repositories_groups'].iteritems()

                if x[1] == 'group.admin']

    @property

    def user_groups_admin(self):

        """

        Returns list of user groups you're an admin of

        """

        return [x[0] for x in self.permissions['user_groups'].iteritems()

                if x[1] == 'usergroup.admin']

    @property

    def ip_allowed(self):

        """

        Checks if ip_addr used in constructor is allowed from defined list of

        allowed ip_addresses for user

        :returns: boolean, True if ip is in allowed ip range

        """

        user_group_to_perm = UserUserGroupToPerm()

        user_group_to_perm.permission = Permission.get_by_key(default_perm)

        user_group_to_perm.user_group = user_group

        user_group_to_perm.user_id = def_user.user_id

        return user_group_to_perm

    def _update_permissions(self, user_group, perms_new=None,

                            perms_updates=None):

        from kallithea.lib.auth import HasUserGroupPermissionAny

        if not perms_new:

            perms_new = []

        if not perms_updates:

            perms_updates = []

        # update permissions

        for member, perm, member_type in perms_updates:

            if member_type == 'user':

                # this updates existing one

                self.grant_user_permission(

                    user_group=user_group, user=member, perm=perm

                )

            else:

                #check if we have permissions to alter this usergroup

                if HasUserGroupPermissionAny('usergroup.read', 'usergroup.write',

                                             'usergroup.admin')(member):

                    self.grant_user_group_permission(

                        target_user_group=user_group, user_group=member, perm=perm

                    )

        # set new permissions

        for member, perm, member_type in perms_new:

            if member_type == 'user':

                self.grant_user_permission(

                    user_group=user_group, user=member, perm=perm

                )

            else:

                #check if we have permissions to alter this usergroup

                if HasUserGroupPermissionAny('usergroup.read', 'usergroup.write',

                                             'usergroup.admin')(member):

                    self.grant_user_group_permission(

                        target_user_group=user_group, user_group=member, perm=perm

                    )

    def get(self, user_group_id, cache=False):

        return UserGroup.get(user_group_id)

    def get_group(self, user_group):

        return self._get_user_group(user_group)

    def get_by_name(self, name, cache=False, case_insensitive=False):

        return UserGroup.get_by_group_name(name, cache, case_insensitive)

    def create(self, name, description, owner, active=True, group_data=None):

        try:

            new_user_group = UserGroup()

            new_user_group.user = self._get_user(owner)

            new_user_group.users_group_name = name

            new_user_group.user_group_description = description

            new_user_group.users_group_active = active

            if group_data:

                new_user_group.group_data = group_data

            self.sa.add(new_user_group)

            perm_obj = self._create_default_perms(new_user_group)

            self.sa.add(perm_obj)

            self.grant_user_permission(user_group=new_user_group,

                                       user=owner, perm='usergroup.admin')

            return new_user_group

        except Exception:

            log.error(traceback.format_exc())

            raise

    def update(self, user_group, form_data):

        try:

            user_group = self._get_user_group(user_group)

            for k, v in form_data.items():

                if k == 'users_group_members':

                    user_group.members = []

                    self.sa.flush()

                    members_list = []

                    if v:

                        v = [v] if isinstance(v, basestring) else v

                        for u_id in set(v):

                            member = UserGroupMember(user_group.users_group_id, u_id)

                            members_list.append(member)

                    setattr(user_group, 'members', members_list)

                setattr(user_group, k, v)

            self.sa.add(user_group)

        except Exception:

            log.error(traceback.format_exc())

            raise

    def delete(self, user_group, force=False):

        """

        Deletes user group, unless force flag is used

        raises exception if there are members in that group, else deletes

        group and users

        :param user_group:

        :param force:

        """

        user_group = self._get_user_group(user_group)

        try:

            # check if this group is not assigned to repo

            assigned_groups = UserGroupRepoToPerm.query()\

                .filter(UserGroupRepoToPerm.users_group == user_group).all()

            assigned_groups = [x.repository.repo_name for x in assigned_groups]

            if assigned_groups and not force:

                raise UserGroupsAssignedException(

                    'User Group assigned to %s' % ", ".join(assigned_groups))

            self.sa.delete(user_group)

        except Exception:

            log.error(traceback.format_exc())

            raise

    def add_user_to_group(self, user_group, user):

        user_group = self._get_user_group(user_group)

        user = self._get_user(user)

        for m in user_group.members:

            u = m.user

            if u.user_id == user.user_id:

                # user already in the group, skip

                return True

        try:

            user_group_member = UserGroupMember()

            user_group_member.user = user

            user_group_member.users_group = user_group

            user_group.members.append(user_group_member)

            user.group_member.append(user_group_member)

            self.sa.add(user_group_member)

            return user_group_member

        except Exception:

            log.error(traceback.format_exc())

            raise

    def remove_user_from_group(self, user_group, user):

        user_group = self._get_user_group(user_group)

        user = self._get_user(user)

        user_group_member = None

        for m in user_group.members:

            if m.user.user_id == user.user_id:

                # Found this user's membership row

                user_group_member = m

                break

        if user_group_member:

            try:

                self.sa.delete(user_group_member)

                return True

            except Exception:

                log.error(traceback.format_exc())

                raise

        else:

            # User isn't in that group

            return False

    def has_perm(self, user_group, perm):

        user_group = self._get_user_group(user_group)

        perm = self._get_perm(perm)

        return UserGroupToPerm.query()\

            .filter(UserGroupToPerm.users_group == user_group)\

            .filter(UserGroupToPerm.permission == perm).scalar() is not None

    def grant_perm(self, user_group, perm):

        user_group = self._get_user_group(user_group)

        perm = self._get_perm(perm)

        # if this permission is already granted skip it

        _perm = UserGroupToPerm.query()\

            .filter(UserGroupToPerm.users_group == user_group)\

            .filter(UserGroupToPerm.permission == perm)\

            .scalar()

        if _perm:

            return

        new = UserGroupToPerm()

        new.users_group = user_group

        new.permission = perm

        self.sa.add(new)

        return new

        user_group = self._get_user_group(user_group)

        perm = self._get_perm(perm)

        obj = UserGroupToPerm.query()\

            .filter(UserGroupToPerm.users_group == user_group)\

            .filter(UserGroupToPerm.permission == perm).scalar()

        if obj:

            self.sa.delete(obj)

    def grant_user_permission(self, user_group, user, perm):

        """

        Grant permission for user on given user group, or update

        existing one if found

        :param user_group: Instance of UserGroup, users_group_id,

            or users_group_name

        :param user: Instance of User, user_id or username

        :param perm: Instance of Permission, or permission_name

        """

        user_group = self._get_user_group(user_group)

        user = self._get_user(user)

        permission = self._get_perm(perm)

        # check if we have that permission already

        obj = self.sa.query(UserUserGroupToPerm)\

            .filter(UserUserGroupToPerm.user == user)\

            .filter(UserUserGroupToPerm.user_group == user_group)\

            .scalar()

        if obj is None:

            # create new !

            obj = UserUserGroupToPerm()

        obj.user_group = user_group

        obj.user = user

        obj.permission = permission

        self.sa.add(obj)

        log.debug('Granted perm %s to %s on %s' % (perm, user, user_group))

        return obj

    def revoke_user_permission(self, user_group, user):

        """

        Revoke permission for user on given repository group

        :param user_group: Instance of RepoGroup, repositories_group_id,

            or repositories_group name

        :param user: Instance of User, user_id or username

        """

        user_group = self._get_user_group(user_group)

        user = self._get_user(user)

        obj = self.sa.query(UserUserGroupToPerm)\

            .filter(UserUserGroupToPerm.user == user)\

            .filter(UserUserGroupToPerm.user_group == user_group)\

            .scalar()

        if obj:

            self.sa.delete(obj)

            log.debug('Revoked perm on %s on %s' % (user_group, user))

    def grant_user_group_permission(self, target_user_group, user_group, perm):

        """

        Grant user group permission for given target_user_group

        :param target_user_group:

        :param user_group:

        :param perm:

        """

        target_user_group = self._get_user_group(target_user_group)

        user_group = self._get_user_group(user_group)

        permission = self._get_perm(perm)

        # forbid assigning same user group to itself

        if target_user_group == user_group:

            raise RepoGroupAssignmentError('target repo:%s cannot be '

                                           'assigned to itself' % target_user_group)

        # check if we have that permission already

        obj = self.sa.query(UserGroupUserGroupToPerm)\

            .filter(UserGroupUserGroupToPerm.target_user_group == target_user_group)\

            .filter(UserGroupUserGroupToPerm.user_group == user_group)\

            .scalar()

        if obj is None:

            # create new !

            obj = UserGroupUserGroupToPerm()

        obj.user_group = user_group

        obj.target_user_group = target_user_group

        obj.permission = permission

        self.sa.add(obj)

        log.debug('Granted perm %s to %s on %s' % (perm, target_user_group, user_group))

        return obj

    def revoke_user_group_permission(self, target_user_group, user_group):

        """

        Revoke user group permission for given target_user_group

        :param target_user_group:

        :param user_group:

        """

        target_user_group = self._get_user_group(target_user_group)

        user_group = self._get_user_group(user_group)

        obj = self.sa.query(UserGroupUserGroupToPerm)\

            .filter(UserGroupUserGroupToPerm.target_user_group == target_user_group)\

            .filter(UserGroupUserGroupToPerm.user_group == user_group)\

            .scalar()

        if obj:

            self.sa.delete(obj)

            log.debug('Revoked perm on %s on %s' % (target_user_group, user_group))

    def enforce_groups(self, user, groups, extern_type=None):

        user = self._get_user(user)

        log.debug('Enforcing groups %s on user %s' % (user, groups))

        current_groups = user.group_member

        # find the external created groups

        externals = [x.users_group for x in current_groups

                     if 'extern_type' in x.users_group.group_data]

        # calculate from what groups user should be removed

        # externals that are not in groups

        for gr in externals:

            if gr.users_group_name not in groups:

                log.debug('Removing user %s from user group %s' % (user, gr))

                self.remove_user_from_group(gr, user)

        # now we calculate in which groups user should be == groups params

        owner = User.get_first_admin().username

        for gr in set(groups):

            existing_group = UserGroup.get_by_group_name(gr)

            if not existing_group:

                desc = 'Automatically created from plugin:%s' % extern_type

                # we use first admin account to set the owner of the group

                existing_group = UserGroupModel().create(gr, desc, owner,

                                        group_data={'extern_type': extern_type})

            # we can only add users to special groups created via plugins

            managed = 'extern_type' in existing_group.group_data

            if managed:

                log.debug('Adding user %s to user group %s' % (user, gr))

                UserGroupModel().add_user_to_group(existing_group, user)

            else:

                log.debug('Skipping addition to group %s since it is '

                          'not managed by auth plugins' % gr)