# -*- coding: utf-8 -*-

"""

    rhodecode.model.comment

    ~~~~~~~~~~~~~~~~~~~~~~~

    comments model for RhodeCode

    :created_on: Nov 11, 2011

    :author: marcink

    :copyright: (C) 2011-2012 Marcin Kuzminski <marcin@python-works.com>

    :license: GPLv3, see COPYING for more details.

"""

# This program is free software: you can redistribute it and/or modify

# it under the terms of the GNU General Public License as published by

# the Free Software Foundation, either version 3 of the License, or

# (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

import logging

import traceback

from pylons.i18n.translation import _

from sqlalchemy.util.compat import defaultdict

from rhodecode.lib.utils2 import extract_mentioned_users

from rhodecode.lib import helpers as h

from rhodecode.model import BaseModel

from rhodecode.model.db import ChangesetComment, User, Repository, Notification

from rhodecode.model.notification import NotificationModel

log = logging.getLogger(__name__)

class ChangesetCommentsModel(BaseModel):

    def __get_changeset_comment(self, changeset_comment):

        return self._get_instance(ChangesetComment, changeset_comment)

    def _extract_mentions(self, s):

        user_objects = []

        for username in extract_mentioned_users(s):

            user_obj = User.get_by_username(username, case_insensitive=True)

            if user_obj:

                user_objects.append(user_obj)

        return user_objects

    def create(self, text, repo_id, user_id, revision, f_path=None,

               line_no=None):

        """

        Creates new comment for changeset

        :param text:

        :param repo_id:

        :param user_id:

        :param revision:

        :param f_path:

        :param line_no:

        """

        if text:

            repo = Repository.get(repo_id)

            cs = repo.scm_instance.get_changeset(revision)

            desc = cs.message

            author_email = cs.author_email

            comment = ChangesetComment()

            comment.repo = repo

            comment.user_id = user_id

            comment.revision = revision

            comment.text = text

            comment.f_path = f_path

            comment.line_no = line_no

            self.sa.add(comment)

            self.sa.flush()

            # make notification

            line = ''

            if line_no:

                line = _('on line %s') % line_no

            subj = h.link_to('Re commit: %(commit_desc)s %(line)s' % \

                                    {'commit_desc': desc, 'line': line},

                             h.url('changeset_home', repo_name=repo.repo_name,

                                   revision=revision,

                                   anchor='comment-%s' % comment.comment_id,

                                   qualified=True,

                                   )

                             )

            body = text

            # get the current participants of this changeset

            recipients = ChangesetComment.get_users(revision=revision)

            # add changeset author if it's in rhodecode system

            recipients += [User.get_by_email(author_email)]

            NotificationModel().create(

              created_by=user_id, subject=subj, body=body,

              recipients=recipients, type_=Notification.TYPE_CHANGESET_COMMENT

            )

            mention_recipients = set(self._extract_mentions(body))\

                                    .difference(recipients)

            if mention_recipients:

                subj = _('[Mention]') + ' ' + subj

                NotificationModel().create(

                    created_by=user_id, subject=subj, body=body,

                    recipients=mention_recipients,

                    type_=Notification.TYPE_CHANGESET_COMMENT

                )

            return comment

    def delete(self, comment):

        """

        Deletes given comment

        :param comment_id:

        """

        comment = self.__get_changeset_comment(comment)

        self.sa.delete(comment)

        return comment

    def get_comments(self, repo_id, revision):

        return ChangesetComment.query()\

                .filter(ChangesetComment.repo_id == repo_id)\

                .filter(ChangesetComment.revision == revision)\

                .filter(ChangesetComment.line_no == None)\

                .filter(ChangesetComment.f_path == None).all()

    def get_inline_comments(self, repo_id, revision):

        comments = self.sa.query(ChangesetComment)\

            .filter(ChangesetComment.repo_id == repo_id)\

            .filter(ChangesetComment.revision == revision)\

            .filter(ChangesetComment.line_no != None)\

            .filter(ChangesetComment.f_path != None).all()

        paths = defaultdict(lambda: defaultdict(list))

        for co in comments:

            paths[co.f_path][co.line_no].append(co)

        return paths.items()

            raise Exception('Could not get application settings !')

        settings = {}

        for each in ret:

            settings['rhodecode_' + each.app_settings_name] = \

                each.app_settings_value

        return settings

    @classmethod

    def get_ldap_settings(cls, cache=False):

        ret = cls.query()\

                .filter(cls.app_settings_name.startswith('ldap_')).all()

        fd = {}

        for row in ret:

            fd.update({row.app_settings_name:row.app_settings_value})

        return fd

class RhodeCodeUi(Base, BaseModel):

    __tablename__ = 'rhodecode_ui'

    __table_args__ = (

        UniqueConstraint('ui_key'),

        {'extend_existing': True, 'mysql_engine':'InnoDB',

         'mysql_charset': 'utf8'}

    )

    HOOK_UPDATE = 'changegroup.update'

    HOOK_REPO_SIZE = 'changegroup.repo_size'

    HOOK_PUSH = 'pretxnchangegroup.push_logger'

    HOOK_PULL = 'preoutgoing.pull_logger'

    ui_id = Column("ui_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)

    ui_section = Column("ui_section", String(length=255, convert_unicode=False, assert_unicode=None), nullable=True, unique=None, default=None)

    ui_key = Column("ui_key", String(length=255, convert_unicode=False, assert_unicode=None), nullable=True, unique=None, default=None)

    ui_value = Column("ui_value", String(length=255, convert_unicode=False, assert_unicode=None), nullable=True, unique=None, default=None)

    ui_active = Column("ui_active", Boolean(), nullable=True, unique=None, default=True)

    @classmethod

    def get_by_key(cls, key):

        return cls.query().filter(cls.ui_key == key)

    @classmethod

    def get_builtin_hooks(cls):

        q = cls.query()

        q = q.filter(cls.ui_key.in_([cls.HOOK_UPDATE,

                                    cls.HOOK_REPO_SIZE,

                                    cls.HOOK_PUSH, cls.HOOK_PULL]))

        return q.all()

    @classmethod

    def get_custom_hooks(cls):

        q = cls.query()

        q = q.filter(~cls.ui_key.in_([cls.HOOK_UPDATE,

                                    cls.HOOK_REPO_SIZE,

                                    cls.HOOK_PUSH, cls.HOOK_PULL]))

        q = q.filter(cls.ui_section == 'hooks')

        return q.all()

    @classmethod

    def create_or_update_hook(cls, key, val):

        new_ui = cls.get_by_key(key).scalar() or cls()

        new_ui.ui_section = 'hooks'

        new_ui.ui_active = True

        new_ui.ui_key = key

        new_ui.ui_value = val

        Session.add(new_ui)

class User(Base, BaseModel):

    __tablename__ = 'users'

    __table_args__ = (

        UniqueConstraint('username'), UniqueConstraint('email'),

        {'extend_existing': True, 'mysql_engine':'InnoDB',

         'mysql_charset': 'utf8'}

    )

    user_id = Column("user_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)

    username = Column("username", String(length=255, convert_unicode=False, assert_unicode=None), nullable=True, unique=None, default=None)

    password = Column("password", String(length=255, convert_unicode=False, assert_unicode=None), nullable=True, unique=None, default=None)

    active = Column("active", Boolean(), nullable=True, unique=None, default=None)

    admin = Column("admin", Boolean(), nullable=True, unique=None, default=False)

    name = Column("name", String(length=255, convert_unicode=False, assert_unicode=None), nullable=True, unique=None, default=None)

    lastname = Column("lastname", String(length=255, convert_unicode=False, assert_unicode=None), nullable=True, unique=None, default=None)

    _email = Column("email", String(length=255, convert_unicode=False, assert_unicode=None), nullable=True, unique=None, default=None)

    last_login = Column("last_login", DateTime(timezone=False), nullable=True, unique=None, default=None)

    ldap_dn = Column("ldap_dn", String(length=255, convert_unicode=False, assert_unicode=None), nullable=True, unique=None, default=None)

    api_key = Column("api_key", String(length=255, convert_unicode=False, assert_unicode=None), nullable=True, unique=None, default=None)

    user_log = relationship('UserLog', cascade='all')

    user_perms = relationship('UserToPerm', primaryjoin="User.user_id==UserToPerm.user_id", cascade='all')

    repositories = relationship('Repository')

    user_followers = relationship('UserFollowing', primaryjoin='UserFollowing.follows_user_id==User.user_id', cascade='all')

    repo_to_perm = relationship('UserRepoToPerm', primaryjoin='UserRepoToPerm.user_id==User.user_id', cascade='all')

    repo_group_to_perm = relationship('UserRepoGroupToPerm', primaryjoin='UserRepoGroupToPerm.user_id==User.user_id', cascade='all')

    group_member = relationship('UsersGroupMember', cascade='all')

    notifications = relationship('UserNotification',)

    @hybrid_property

    def email(self):

        return self._email

    @email.setter

    def email(self, val):

        self._email = val.lower() if val else None

    @property

    def full_name(self):

        return '%s %s' % (self.name, self.lastname)

    @property

    def full_name_or_username(self):

        return ('%s %s' % (self.name, self.lastname)

                if (self.name and self.lastname) else self.username)

    @property

    def full_contact(self):

        return '%s %s <%s>' % (self.name, self.lastname, self.email)

    @property

    def short_contact(self):

        return '%s %s' % (self.name, self.lastname)

    @property

    def is_admin(self):

        return self.admin

    def __repr__(self):

        return "<%s('id:%s:%s')>" % (self.__class__.__name__,

                                     self.user_id, self.username)

    @classmethod

    def get_by_username(cls, username, case_insensitive=False, cache=False):

        if case_insensitive:

            q = cls.query().filter(cls.username.ilike(username))

        else:

            q = cls.query().filter(cls.username == username)

        if cache:

            q = q.options(FromCache(

                            "sql_cache_short",

                            "get_user_%s" % _hash_key(username)

                          )

            )

        return q.scalar()

    @classmethod

    def get_by_api_key(cls, api_key, cache=False):

        q = cls.query().filter(cls.api_key == api_key)

        if cache:

            q = q.options(FromCache("sql_cache_short",

                                    "get_api_key_%s" % api_key))

        return q.scalar()

    @classmethod

    def get_by_email(cls, email, case_insensitive=False, cache=False):

        if case_insensitive:

            q = cls.query().filter(cls.email.ilike(email))

        else:

            q = cls.query().filter(cls.email == email)

        if cache:

            q = q.options(FromCache("sql_cache_short",

                                    "get_api_key_%s" % email))

        return q.scalar()

    def update_lastlogin(self):

        """Update user lastlogin"""

        self.last_login = datetime.datetime.now()

        Session.add(self)

        log.debug('updated user %s lastlogin' % self.username)

    def __json__(self):

        return dict(

            email=self.email,

            full_name=self.full_name,

            full_name_or_username=self.full_name_or_username,

            short_contact=self.short_contact,

            full_contact=self.full_contact

        )

class UserLog(Base, BaseModel):

    __tablename__ = 'user_logs'

    __table_args__ = (

        {'extend_existing': True, 'mysql_engine':'InnoDB',

         'mysql_charset': 'utf8'},

    )

    user_log_id = Column("user_log_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)

    @classmethod

    def get_default_perms(cls, default_user_id):

        q = Session.query(UserRepoToPerm, Repository, cls)\

         .join((Repository, UserRepoToPerm.repository_id == Repository.repo_id))\

         .join((cls, UserRepoToPerm.permission_id == cls.permission_id))\

         .filter(UserRepoToPerm.user_id == default_user_id)

        return q.all()

    @classmethod

    def get_default_group_perms(cls, default_user_id):

        q = Session.query(UserRepoGroupToPerm, RepoGroup, cls)\

         .join((RepoGroup, UserRepoGroupToPerm.group_id == RepoGroup.group_id))\

         .join((cls, UserRepoGroupToPerm.permission_id == cls.permission_id))\

         .filter(UserRepoGroupToPerm.user_id == default_user_id)

        return q.all()

class UserRepoToPerm(Base, BaseModel):

    __tablename__ = 'repo_to_perm'

    __table_args__ = (

        UniqueConstraint('user_id', 'repository_id', 'permission_id'),

        {'extend_existing': True, 'mysql_engine':'InnoDB',

         'mysql_charset': 'utf8'}

    )

    repo_to_perm_id = Column("repo_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)

    user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)

    permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)

    repository_id = Column("repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=False, unique=None, default=None)

    user = relationship('User')

    repository = relationship('Repository')

    permission = relationship('Permission')

    @classmethod

    def create(cls, user, repository, permission):

        n = cls()

        n.user = user

        n.repository = repository

        n.permission = permission

        Session.add(n)

        return n

    def __repr__(self):

        return '<user:%s => %s >' % (self.user, self.repository)

class UserToPerm(Base, BaseModel):

    __tablename__ = 'user_to_perm'

    __table_args__ = (

        UniqueConstraint('user_id', 'permission_id'),

        {'extend_existing': True, 'mysql_engine':'InnoDB',

         'mysql_charset': 'utf8'}

    )

    user_to_perm_id = Column("user_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)

    user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)

    permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)

    user = relationship('User')

    permission = relationship('Permission', lazy='joined')

class UsersGroupRepoToPerm(Base, BaseModel):

    __tablename__ = 'users_group_repo_to_perm'

    __table_args__ = (

        UniqueConstraint('repository_id', 'users_group_id', 'permission_id'),

        {'extend_existing': True, 'mysql_engine':'InnoDB',

         'mysql_charset': 'utf8'}

    )

    users_group_to_perm_id = Column("users_group_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)

    users_group_id = Column("users_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)

    permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)

    repository_id = Column("repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=False, unique=None, default=None)

    users_group = relationship('UsersGroup')

    permission = relationship('Permission')

    repository = relationship('Repository')

    @classmethod

    def create(cls, users_group, repository, permission):

        n = cls()

        n.users_group = users_group

        n.repository = repository

        n.permission = permission

        Session.add(n)

        return n

    def __repr__(self):

        return '<userGroup:%s => %s >' % (self.users_group, self.repository)

class UsersGroupToPerm(Base, BaseModel):

    __tablename__ = 'users_group_to_perm'

    __table_args__ = (

        UniqueConstraint('users_group_id', 'permission_id',),

         'mysql_charset': 'utf8'}

    )

    users_group_to_perm_id = Column("users_group_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)

    users_group_id = Column("users_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)

    permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)

    users_group = relationship('UsersGroup')

    permission = relationship('Permission')

class UserRepoGroupToPerm(Base, BaseModel):

    __tablename__ = 'user_repo_group_to_perm'

    __table_args__ = (

        UniqueConstraint('user_id', 'group_id', 'permission_id'),

         'mysql_charset': 'utf8'}

    )

    group_to_perm_id = Column("group_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)

    user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)

    group_id = Column("group_id", Integer(), ForeignKey('groups.group_id'), nullable=False, unique=None, default=None)

    permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)

    user = relationship('User')

    group = relationship('RepoGroup')

    permission = relationship('Permission')

class UsersGroupRepoGroupToPerm(Base, BaseModel):

    __tablename__ = 'users_group_repo_group_to_perm'

    __table_args__ = (

        UniqueConstraint('users_group_id', 'group_id'),

        {'extend_existing': True, 'mysql_engine':'InnoDB',

         'mysql_charset': 'utf8'}

    )

    users_group_repo_group_to_perm_id = Column("users_group_repo_group_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)

    users_group_id = Column("users_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)

    group_id = Column("group_id", Integer(), ForeignKey('groups.group_id'), nullable=False, unique=None, default=None)

    permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)

    users_group = relationship('UsersGroup')

    permission = relationship('Permission')

    group = relationship('RepoGroup')

class Statistics(Base, BaseModel):

    __tablename__ = 'statistics'

    __table_args__ = (

          'mysql_charset': 'utf8'}

    )

    stat_id = Column("stat_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)

    repository_id = Column("repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=False, unique=True, default=None)

    stat_on_revision = Column("stat_on_revision", Integer(), nullable=False)

    commit_activity = Column("commit_activity", LargeBinary(1000000), nullable=False)#JSON data

    commit_activity_combined = Column("commit_activity_combined", LargeBinary(), nullable=False)#JSON data

    languages = Column("languages", LargeBinary(1000000), nullable=False)#JSON data

    repository = relationship('Repository', single_parent=True)

class UserFollowing(Base, BaseModel):

    __tablename__ = 'user_followings'

    __table_args__ = (

        UniqueConstraint('user_id', 'follows_repository_id'),

        UniqueConstraint('user_id', 'follows_user_id'),

        {'extend_existing': True, 'mysql_engine':'InnoDB',

         'mysql_charset': 'utf8'}

    )

    user_following_id = Column("user_following_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)

    user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)

    follows_repo_id = Column("follows_repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=True, unique=None, default=None)

    follows_user_id = Column("follows_user_id", Integer(), ForeignKey('users.user_id'), nullable=True, unique=None, default=None)

    follows_from = Column('follows_from', DateTime(timezone=False), nullable=True, unique=None, default=datetime.datetime.now)

    user = relationship('User', primaryjoin='User.user_id==UserFollowing.user_id')

    follows_user = relationship('User', primaryjoin='User.user_id==UserFollowing.follows_user_id')

    follows_repository = relationship('Repository', order_by='Repository.repo_name')

    @classmethod

    def get_repo_followers(cls, repo_id):

        return cls.query().filter(cls.follows_repo_id == repo_id)

class CacheInvalidation(Base, BaseModel):

    __tablename__ = 'cache_invalidation'

    __table_args__ = (

        UniqueConstraint('cache_key'),

        {'extend_existing': True, 'mysql_engine':'InnoDB',

         'mysql_charset': 'utf8'},

    )

    cache_id = Column("cache_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)

    cache_key = Column("cache_key", String(length=255, convert_unicode=False, assert_unicode=None), nullable=True, unique=None, default=None)

    cache_args = Column("cache_args", String(length=255, convert_unicode=False, assert_unicode=None), nullable=True, unique=None, default=None)

    cache_active = Column("cache_active", Boolean(), nullable=True, unique=None, default=False)

    def __init__(self, cache_key, cache_args=''):

        self.cache_key = cache_key

        self.cache_args = cache_args

        self.cache_active = False

    def __repr__(self):

        return "<%s('%s:%s')>" % (self.__class__.__name__,

                                  self.cache_id, self.cache_key)

    @classmethod

    def clear_cache(cls):

        cls.query().delete()

    @classmethod

    def _get_key(cls, key):

        """

        Wrapper for generating a key, together with a prefix

        :param key:

        """

        import rhodecode

        prefix = ''

        iid = rhodecode.CONFIG.get('instance_id')

        if iid:

            prefix = iid

        return "%s%s" % (prefix, key), prefix, key.rstrip('_README')

    @classmethod

    def get_by_key(cls, key):

        return cls.query().filter(cls.cache_key == key).scalar()

    @classmethod

    def _get_or_create_key(cls, key, prefix, org_key):

        inv_obj = Session.query(cls).filter(cls.cache_key == key).scalar()

        if not inv_obj:

            try:

                inv_obj = CacheInvalidation(key, org_key)

                Session.add(inv_obj)

                Session.commit()

            except Exception:

                log.error(traceback.format_exc())

                Session.rollback()

        return inv_obj

    @classmethod

    def invalidate(cls, key):

        """

        Returns Invalidation object if this given key should be invalidated

                user.permissions[GK][rg_k] = p

            #==================================================================

            # overwrite defaults with user permissions if any found

            #==================================================================

            # user global permissions

            user_perms = self.sa.query(UserToPerm)\

                    .options(joinedload(UserToPerm.permission))\

                    .filter(UserToPerm.user_id == uid).all()

            for perm in user_perms:

                user.permissions[GLOBAL].add(perm.permission.permission_name)

            # user explicit permissions for repositories

            user_repo_perms = \

             self.sa.query(UserRepoToPerm, Permission, Repository)\

             .join((Repository, UserRepoToPerm.repository_id == Repository.repo_id))\

             .join((Permission, UserRepoToPerm.permission_id == Permission.permission_id))\

             .filter(UserRepoToPerm.user_id == uid)\

             .all()

            for perm in user_repo_perms:

                # set admin if owner

                r_k = perm.UserRepoToPerm.repository.repo_name

                if perm.Repository.user_id == uid:

                    p = 'repository.admin'

                else:

                    p = perm.Permission.permission_name

                user.permissions[RK][r_k] = p

            #==================================================================

            # check if user is part of user groups for this repository and

            # fill in (or replace with higher) permissions

            #==================================================================

            # users group global

            user_perms_from_users_groups = self.sa.query(UsersGroupToPerm)\

                .options(joinedload(UsersGroupToPerm.permission))\

                .join((UsersGroupMember, UsersGroupToPerm.users_group_id ==

                       UsersGroupMember.users_group_id))\

                .filter(UsersGroupMember.user_id == uid).all()

            for perm in user_perms_from_users_groups:

                user.permissions[GLOBAL].add(perm.permission.permission_name)

            # users group for repositories permissions

            user_repo_perms_from_users_groups = \

             self.sa.query(UsersGroupRepoToPerm, Permission, Repository,)\

             .join((Repository, UsersGroupRepoToPerm.repository_id == Repository.repo_id))\

             .join((Permission, UsersGroupRepoToPerm.permission_id == Permission.permission_id))\

             .join((UsersGroupMember, UsersGroupRepoToPerm.users_group_id == UsersGroupMember.users_group_id))\

             .filter(UsersGroupMember.user_id == uid)\

             .all()

            for perm in user_repo_perms_from_users_groups:

                r_k = perm.UsersGroupRepoToPerm.repository.repo_name

                p = perm.Permission.permission_name

                cur_perm = user.permissions[RK][r_k]

                # overwrite permission only if it's greater than permission

                # given from other sources

                if PERM_WEIGHTS[p] > PERM_WEIGHTS[cur_perm]:

                    user.permissions[RK][r_k] = p

            #==================================================================

            # get access for this user for repos group and override defaults

            #==================================================================

            # user explicit permissions for repository

            user_repo_groups_perms = \

             self.sa.query(UserRepoGroupToPerm, Permission, RepoGroup)\

             .join((RepoGroup, UserRepoGroupToPerm.group_id == RepoGroup.group_id))\

             .join((Permission, UserRepoGroupToPerm.permission_id == Permission.permission_id))\

             .filter(UserRepoGroupToPerm.user_id == uid)\

             .all()

            for perm in user_repo_groups_perms:

                rg_k = perm.UserRepoGroupToPerm.group.group_name

                p = perm.Permission.permission_name

                cur_perm = user.permissions[GK][rg_k]

                if PERM_WEIGHTS[p] > PERM_WEIGHTS[cur_perm]:

                    user.permissions[GK][rg_k] = p

            #==================================================================

            # check if user is part of user groups for this repo group and

            # fill in (or replace with higher) permissions

            #==================================================================

            # users group for repositories permissions

            user_repo_group_perms_from_users_groups = \

             self.sa.query(UsersGroupRepoGroupToPerm, Permission, RepoGroup)\

             .join((RepoGroup, UsersGroupRepoGroupToPerm.group_id == RepoGroup.group_id))\

             .join((Permission, UsersGroupRepoGroupToPerm.permission_id == Permission.permission_id))\

             .join((UsersGroupMember, UsersGroupRepoGroupToPerm.users_group_id == UsersGroupMember.users_group_id))\

             .filter(UsersGroupMember.user_id == uid)\

             .all()

            for perm in user_repo_group_perms_from_users_groups:

                g_k = perm.UsersGroupRepoGroupToPerm.group.group_name

                print perm, g_k

                p = perm.Permission.permission_name

                cur_perm = user.permissions[GK][g_k]

                # overwrite permission only if it's greater than permission

                # given from other sources

                if PERM_WEIGHTS[p] > PERM_WEIGHTS[cur_perm]:

                    user.permissions[GK][g_k] = p

        return user

    def has_perm(self, user, perm):

        if not isinstance(perm, Permission):

            raise Exception('perm needs to be an instance of Permission class '

                            'got %s instead' % type(perm))

        user = self.__get_user(user)

        return UserToPerm.query().filter(UserToPerm.user == user)\

            .filter(UserToPerm.permission == perm).scalar() is not None

    def grant_perm(self, user, perm):

        """

        Grant user global permissions

        :param user:

        :param perm:

        """

        user = self.__get_user(user)

        perm = self.__get_perm(perm)

        # if this permission is already granted skip it

        _perm = UserToPerm.query()\

            .filter(UserToPerm.user == user)\

            .filter(UserToPerm.permission == perm)\

            .scalar()

        if _perm:

            return

        new = UserToPerm()

        new.user = user

        new.permission = perm

        self.sa.add(new)

    def revoke_perm(self, user, perm):

        """

        Revoke users global permissions

        :param user:

        :param perm:

        """

        user = self.__get_user(user)

        perm = self.__get_perm(perm)

        obj = UserToPerm.query()\

                .filter(UserToPerm.user == user)\

                .filter(UserToPerm.permission == perm)\

                .scalar()

        if obj:

            self.sa.delete(obj)

            </td>

            <td>

              %if r2p.user.username !='default':

                <span class="delete_icon action_button" onclick="ajaxActionUser(${r2p.user.user_id},'${'id%s'%id(r2p.user.username)}')">

                ${_('revoke')}

                </span>

              %endif

            </td>

        </tr>

        %endif

    %endfor

    ## USERS GROUPS

    %for g2p in c.repo_info.users_group_to_perm:

        <tr id="id${id(g2p.users_group.users_group_name)}">

            <td>${h.radio('g_perm_%s' % g2p.users_group.users_group_name,'repository.none')}</td>

            <td>${h.radio('g_perm_%s' % g2p.users_group.users_group_name,'repository.read')}</td>

            <td>${h.radio('g_perm_%s' % g2p.users_group.users_group_name,'repository.write')}</td>

            <td>${h.radio('g_perm_%s' % g2p.users_group.users_group_name,'repository.admin')}</td>

            <td style="white-space: nowrap;">

                <img class="perm-gravatar" src="${h.url('/images/icons/group.png')}"/>${g2p.users_group.users_group_name}

            </td>

            <td>

                <span class="delete_icon action_button" onclick="ajaxActionUsersGroup(${g2p.users_group.users_group_id},'${'id%s'%id(g2p.users_group.users_group_name)}')">

                ${_('revoke')}

                </span>

            </td>

        </tr>

    %endfor

    <tr id="add_perm_input">

        <td>${h.radio('perm_new_member','repository.none')}</td>

        <td>${h.radio('perm_new_member','repository.read')}</td>

        <td>${h.radio('perm_new_member','repository.write')}</td>

        <td>${h.radio('perm_new_member','repository.admin')}</td>

        <td class='ac'>

            <div class="perm_ac" id="perm_ac">

                ${h.text('perm_new_member_name',class_='yui-ac-input')}

                ${h.hidden('perm_new_member_type')}

                <div id="perm_container"></div>

            </div>

        </td>

        <td></td>

    </tr>

    <tr>

        <td colspan="6">

            <span id="add_perm" class="add_icon" style="cursor: pointer;">

            ${_('Add another member')}

            </span>

        </td>

    </tr>

</table>

<script type="text/javascript">

function ajaxActionUser(user_id, field_id) {

    var sUrl = "${h.url('delete_repo_user',repo_name=c.repo_name)}";

    var callback = {

        success: function (o) {

            var tr = YUD.get(String(field_id));

            tr.parentNode.removeChild(tr);

        },

        failure: function (o) {

            alert("${_('Failed to remove user')}");

        },

    };

    var postData = '_method=delete&user_id=' + user_id;

    var request = YAHOO.util.Connect.asyncRequest('POST', sUrl, callback, postData);

};

function ajaxActionUsersGroup(users_group_id,field_id){

    var sUrl = "${h.url('delete_repo_users_group',repo_name=c.repo_name)}";

    var callback = {

    	success:function(o){

    	    var tr = YUD.get(String(field_id));

    		tr.parentNode.removeChild(tr);

    	},

        failure:function(o){

            alert("${_('Failed to remove users group')}");

        },

    };

    var postData = '_method=delete&users_group_id='+users_group_id;

    var request = YAHOO.util.Connect.asyncRequest('POST', sUrl, callback, postData);

};

YUE.onDOMReady(function () {

    if (!YUD.hasClass('perm_new_member_name', 'error')) {

        YUD.setStyle('add_perm_input', 'display', 'none');

    }

    YAHOO.util.Event.addListener('add_perm', 'click', function () {

        YUD.setStyle('add_perm_input', 'display', '');

        YUD.setStyle('add_perm', 'opacity', '0.6');

        YUD.setStyle('add_perm', 'cursor', 'default');

    });

    MembersAutoComplete(

    		  ${c.users_array|n},

    		  ${c.users_groups_array|n},

    		  "${_('Group')}",

    		  "${_('members')}"

});

</script>

                <img class="perm-gravatar" src="${h.gravatar_url(r2p.user.email,14)}"/>${r2p.user.username}

            </td>

            <td>

              %if r2p.user.username !='default':

                <span class="delete_icon action_button" onclick="ajaxActionUser(${r2p.user.user_id},'${'id%s'%id(r2p.user.username)}')">