"/users/{id}.{format}/edit",

                  action="edit", conditions=dict(method=["GET"]))

        m.connect("user", "/users/{id}",

                  action="show", conditions=dict(method=["GET"]))

        m.connect("formatted_user", "/users/{id}.{format}",

                  action="show", conditions=dict(method=["GET"]))

        #EXTRAS USER ROUTES

        m.connect("user_perm", "/users_perm/{id}",

                  action="update_perm", conditions=dict(method=["PUT"]))

    #ADMIN USERS REST ROUTES

    #ADMIN GROUP REST ROUTES

    rmap.resource('group', 'groups',

                  controller='admin/groups', path_prefix='/_admin')

    #ADMIN PERMISSIONS REST ROUTES

    rmap.resource('permission', 'permissions',

                  controller='admin/permissions', path_prefix='/_admin')

    ##ADMIN LDAP SETTINGS

    rmap.connect('ldap_settings', '/_admin/ldap',

                 controller='admin/ldap_settings', action='ldap_settings',

import traceback

import formencode

from formencode import htmlfill

from pylons import request, session, tmpl_context as c, url, config

from pylons.controllers.util import abort, redirect

from pylons.i18n.translation import _

from rhodecode.lib import helpers as h

from rhodecode.lib.auth import LoginRequired, HasPermissionAllDecorator

from rhodecode.lib.base import BaseController, render

from rhodecode.model.forms import UserForm, UsersGroupForm

from rhodecode.model.users_group import UsersGroupModel

log = logging.getLogger(__name__)

class UsersGroupsController(BaseController):

    """REST Controller styled on the Atom Publishing Protocol"""

    # To properly map this controller, ensure your config/routing.py

    # file has a resource setup:

    #     map.resource('users_group', 'users_groups')

    @LoginRequired()

                                          old_data=c.users_group.get_dict(),

                                          available_members=[str(x[0]) for x

                                                in c.available_members])()

        try:

            form_result = users_group_form.to_python(request.POST)

            users_group_model.update(id, form_result)

            h.flash(_('updated users group %s') \

                        % form_result['users_group_name'],

                    category='success')

            #action_logger(self.rhodecode_user, 'new_user', '', '', self.sa)

        except formencode.Invalid, errors:

            return htmlfill.render(

                render('admin/users_groups/users_group_edit.html'),

                defaults=errors.value,

                prefix_error=False,

                encoding="UTF-8")

        except Exception:

            log.error(traceback.format_exc())

            h.flash(_('error occurred during update of users group %s') \

                    % request.POST.get('users_group_name'), category='error')

        return redirect(url('users_groups'))

    def delete(self, id):

        """DELETE /users_groups/id: Delete an existing item"""

        # Forms posted to this method should contain a hidden field:

        # url('edit_users_group', id=ID)

        c.users_group = self.sa.query(UsersGroup).get(id)

        if not c.users_group:

            return redirect(url('users_groups'))

        c.users_group.permissions = {}

        c.group_members = [(x.user_id, x.user.username) for x in

                           c.users_group.members]

        c.available_members = [(x.user_id, x.username) for x in

                               self.sa.query(User).all()]

        defaults = c.users_group.get_dict()

        return htmlfill.render(

            render('admin/users_groups/users_group_edit.html'),

            defaults=defaults,

            encoding="UTF-8",

            force_defaults=False

        )

    # Add table `users_groups`

    #==========================================================================

    from rhodecode.model.db import UsersGroup

    UsersGroup().__table__.create()

    #==========================================================================

    # Add table `users_groups_members`

    #==========================================================================

    from rhodecode.model.db import UsersGroupMember

    UsersGroupMember().__table__.create()

    #==========================================================================

    # Add table `users_group_to_perm`

    #==========================================================================

    from rhodecode.model.db import UsersGroupToPerm

    UsersGroupToPerm().__table__.create()

    #==========================================================================

    # Upgrade of `users` table

    #==========================================================================

    from rhodecode.model.db import User

    #add column

    ldap_dn = Column("ldap_dn", String(length=None, convert_unicode=False, assert_unicode=None), nullable=True, unique=None, default=None)

    ldap_dn.create(User().__table__)

    api_key = Column("api_key", String(length=255, convert_unicode=False, assert_unicode=None), nullable=True, unique=None, default=None)

    api_key.create(User().__table__)

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

import logging

from rhodecode.model import meta

log = logging.getLogger(__name__)

def init_model(engine):

    :param engine: engine to bind to

    """

    log.info("initializing db for %s", engine)

    meta.Base.metadata.bind = engine

class BaseModel(object):

    """Base Model for all RhodeCode models, it adds sql alchemy session

    into instance of model

    :param sa: If passed it reuses this session instead of creating a new one

    """

    def __init__(self, sa=None):

        if sa is not None:

            self.sa = sa

        else:

            self.sa = meta.Session()

   retrieves results in/from Beaker.

 * FromCache - a query option that establishes caching

   parameters on a Query

 * RelationshipCache - a variant of FromCache which is specific

   to a query invoked during a lazy load.

 * _params_from_query - extracts value parameters from

   a Query.

The rest of what's here are standard SQLAlchemy and

Beaker constructs.

"""

from beaker.exceptions import BeakerException

from sqlalchemy.orm.interfaces import MapperOption

from sqlalchemy.orm.query import Query

from sqlalchemy.sql import visitors

class CachingQuery(Query):

    """A Query subclass which optionally loads full results from a Beaker

    cache region.

    The CachingQuery stores additional state that allows it to consult

    a Beaker cache before accessing the database:

    * A "region", which is a cache region argument passed to a

      Beaker CacheManager, specifies a particular cache configuration

      (including backend implementation, expiration times, etc.)

    * A "namespace", which is a qualifying name that identifies a

           if particular attributes have been configured.

           Note that this approach does *not* detach the loaded objects from

           the current session. If the cache backend is an in-process cache

           (like "memory") and lives beyond the scope of the current session's

           transaction, those objects may be expired. The method here can be

           modified to first expunge() each loaded item from the current

           session before returning the list of items, so that the items

           in the cache are not the same ones in the current Session.

        """

        if hasattr(self, '_cache_parameters'):

        else:

            return Query.__iter__(self)

    def invalidate(self):

        """Invalidate the value represented by this Query."""

        cache, cache_key = _get_cache_parameters(self)

        cache.remove(cache_key)

    def get_value(self, merge=True, createfunc=None):

        """Return the value from the cache for this query.

        cache, cache_key = _get_cache_parameters(self)

        ret = cache.get_value(cache_key, createfunc=createfunc)

        if merge:

            ret = self.merge_result(ret, load=False)

        return ret

    def set_value(self, value):

        """Set the value in the cache for this query."""

        cache, cache_key = _get_cache_parameters(self)

        cache.put(cache_key, value)

def query_callable(manager):

    def query(*arg, **kw):

        return CachingQuery(manager, *arg, **kw)

    return query

def get_cache_region(name, region):

    if region not in beaker.cache.cache_regions:

        raise BeakerException('Cache region `%s` not configured '

            'Check if proper cache settings are in the .ini files' % region)

    kw = beaker.cache.cache_regions[region]

    return beaker.cache.Cache._get_cache(name, kw)

def _get_cache_parameters(query):

    """For a query with cache_region and cache_namespace configured,

    return the correspoinding Cache instance and cache key, based

    on this query's current criterion and parameter values.

    """

    if not hasattr(query, '_cache_parameters'):

    region, namespace, cache_key = query._cache_parameters

    namespace = _namespace_from_query(namespace, query)

    if cache_key is None:

        # cache key - the value arguments from this query's parameters.

        args = _params_from_query(query)

        cache_key = " ".join([str(x) for x in args])

    # get cache

    #cache = query.cache_manager.get_cache_region(namespace, region)

    cache = get_cache_region(namespace, region)

    # optional - hash the cache_key too for consistent length

    # import uuid

    # cache_key= str(uuid.uuid5(uuid.NAMESPACE_DNS, cache_key))

    return cache, cache_key

def _namespace_from_query(namespace, query):

    # cache namespace - the token handed in by the

    # option + class we're querying against

    namespace = " ".join([namespace] + [str(x) for x in query._entities])

    # memcached wants this

    namespace = namespace.replace(' ', '_')

    return namespace

def _set_cache_parameters(query, region, namespace, cache_key):

    if hasattr(query, '_cache_parameters'):

        region, namespace, cache_key = query._cache_parameters

        raise ValueError("This query is already configured "

                        "for region %r namespace %r" %

                        (region, namespace)

                    )

    query._cache_parameters = region, namespace, cache_key

class FromCache(MapperOption):

    """Specifies that a Query should load results from a cache."""

    propagate_to_loaders = False

    def __init__(self, region, namespace, cache_key=None):

        """Construct a new FromCache.

        :param region: the cache region.  Should be a

        region configured in the Beaker CacheManager.

        :param namespace: the cache namespace.  Should

        if your query has a huge amount of parameters (such

        as when using in_()) which correspond more simply to

        some other identifier.

        """

        self.region = region

        self.namespace = namespace

        self.cache_key = cache_key

    def process_query(self, query):

        """Process a Query during normal loading operation."""

class RelationshipCache(MapperOption):

    """Specifies that a Query as called within a "lazy load"

       should load results from a cache."""

    propagate_to_loaders = True

    def __init__(self, region, namespace, attribute):

        """Construct a new RelationshipCache.

        :param region: the cache region.  Should be a

        region configured in the Beaker CacheManager.

        :param namespace: the cache namespace.  Should

        be a name uniquely describing the target Query's

        lexical structure.

        :param attribute: A Class.attribute which

        indicates a particular class relationship() whose

        lazy loader should be pulled from the cache.

        """

        self.region = region

        self.namespace = namespace

        self._relationship_options = {

        }

    def process_query_conditionally(self, query):

        """Process a Query that is used within a lazy loader.

        (the process_query_conditionally() method is a SQLAlchemy

        hook invoked only within lazyload.)

        """

        if query._current_path:

            mapper, key = query._current_path[-2:]

            for cls in mapper.class_.__mro__:

                if (cls, key) in self._relationship_options:

                    _set_cache_parameters(

                            query,

                            relationship_option.region,

                            relationship_option.namespace,

                            None)

    def and_(self, option):

        """Chain another RelationshipCache option to this one.

        While many RelationshipCache objects can be specified on a single

        Query separately, chaining them together allows for a more efficient

        lookup during load.

def _params_from_query(query):

    """Pull the bind parameter values from a query.

    This takes into account any scalar attribute bindparam set up.

    E.g. params_from_query(query.filter(Cls.foo==5).filter(Cls.bar==7)))

    would return [5, 7].

    """

    v = []

    def visit_bindparam(bind):

        value = query._params.get(bind.key, bind.value)

        # lazyloader may dig a callable in here, intended

        # to late-evaluate params after autoflush is called.

        # convert to a scalar value.

        if callable(value):

            value = value()

        v.append(value)

    if query._criterion is not None:

    return v

class UsersGroup(Base):

    __tablename__ = 'users_groups'

    __table_args__ = {'useexisting':True}

    users_group_id = Column("users_group_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)

    users_group_name = Column("users_group_name", String(length=255, convert_unicode=False, assert_unicode=None), nullable=False, unique=True, default=None)

    users_group_active = Column("users_group_active", Boolean(), nullable=True, unique=None, default=None)

    members = relationship('UsersGroupMember', cascade="all, delete, delete-orphan", lazy="joined")

class UsersGroupMember(Base):

    __tablename__ = 'users_groups_members'

    __table_args__ = {'useexisting':True}

    users_group_member_id = Column("users_group_member_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)

    users_group_id = Column("users_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)

    user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)

    user = relationship('User', lazy='joined')

    users_group = relationship('UsersGroup')

    def __init__(self, gr_id='', u_id=''):

    private = Column("private", Boolean(), nullable=True, unique=None, default=None)

    enable_statistics = Column("statistics", Boolean(), nullable=True, unique=None, default=True)

    enable_downloads = Column("downloads", Boolean(), nullable=True, unique=None, default=True)

    description = Column("description", String(length=10000, convert_unicode=False, assert_unicode=None), nullable=True, unique=None, default=None)

    fork_id = Column("fork_id", Integer(), ForeignKey('repositories.repo_id'), nullable=True, unique=False, default=None)

    group_id = Column("group_id", Integer(), ForeignKey('groups.group_id'), nullable=True, unique=False, default=None)

    user = relationship('User')

    fork = relationship('Repository', remote_side=repo_id)

    group = relationship('Group')

    repo_to_perm = relationship('RepoToPerm', cascade='all', order_by='RepoToPerm.repo_to_perm_id')

    stats = relationship('Statistics', cascade='all', uselist=False)

    followers = relationship('UserFollowing', primaryjoin='UserFollowing.follows_repo_id==Repository.repo_id', cascade='all')

    logs = relationship('UserLog', cascade='all')

    def __repr__(self):

        return "<%s('%s:%s')>" % (self.__class__.__name__,

                                  self.repo_id, self.repo_name)

    @classmethod

    def by_repo_name(cls, repo_name):

    @classmethod

    def revoke_perm(cls, user_id, perm):

        if not isinstance(perm, Permission):

            raise Exception('perm needs to be an instance of Permission class')

        try:

            Session.query(cls).filter(cls.user_id == user_id)\

                .filter(cls.permission == perm).delete()

            Session.commit()

        except:

            Session.rollback()

    __table_args__ = (UniqueConstraint('users_group_id', 'permission_id'), {'useexisting':True})

    users_group_to_perm_id = Column("users_group_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)

    users_group_id = Column("users_group_id", Integer(), ForeignKey('users_groups.users_group_id'), nullable=False, unique=None, default=None)

    permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)

    repository_id = Column("repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=False, unique=None, default=None)

    users_group = relationship('UsersGroup')

    permission = relationship('Permission')

    repository = relationship('Repository')

class GroupToPerm(Base):

    __tablename__ = 'group_to_perm'

    __table_args__ = (UniqueConstraint('group_id', 'permission_id'), {'useexisting':True})

    group_to_perm_id = Column("group_to_perm_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)

    user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)

    permission_id = Column("permission_id", Integer(), ForeignKey('permissions.permission_id'), nullable=False, unique=None, default=None)

    group_id = Column("group_id", Integer(), ForeignKey('groups.group_id'), nullable=False, unique=None, default=None)

    user = relationship('User')

    permission = relationship('Permission')

    group = relationship('Group')

from formencode.validators import UnicodeString, OneOf, Int, Number, Regex, \

    Email, Bool, StringBoolean, Set

from pylons.i18n.translation import _

from webhelpers.pylonslib.secure_form import authentication_token

from rhodecode.lib.utils import repo_name_slug

from rhodecode.lib.auth import authenticate, get_crypt_password

from rhodecode.lib.exceptions import LdapImportError

from rhodecode.model import meta

from rhodecode.model.user import UserModel

from rhodecode.model.repo import RepoModel

from rhodecode.model.db import User, UsersGroup

from rhodecode import BACKENDS

log = logging.getLogger(__name__)

#this is needed to translate the messages using _() in validators

class State_obj(object):

    _ = staticmethod(_)

# VALIDATORS

class ValidAuthToken(formencode.validators.FancyValidator):

    messages = {'invalid_token':_('Token mismatch')}

    def validate_python(self, value, state):

        if value != authentication_token():

            raise formencode.Invalid(self.message('invalid_token', state,

                                            search_number=value), value, state)

def ValidUsername(edit, old_data):

    class _ValidUsername(formencode.validators.FancyValidator):

        def validate_python(self, value, state):

            if value in ['default', 'new_user']:

                raise formencode.Invalid(_('Invalid username'), value, state)

            #check if user is unique

            old_un = None

            if edit:

                old_un = UserModel().get(old_data.get('user_id')).username

            if old_un != value or not edit:

                if UserModel().get_by_username(value, cache=False,

                                               case_insensitive=True):

            if re.match(r'^[a-zA-Z0-9]{1}[a-zA-Z0-9\-\_\.]+$', value) is None:

                raise formencode.Invalid(_('Username may only contain '

    return _ValidUsername

def ValidUsersGroup(edit, old_data):

    class _ValidUsersGroup(formencode.validators.FancyValidator):

        def validate_python(self, value, state):

            if value in ['default']:

                raise formencode.Invalid(_('Invalid group name'), value, state)

            #check if group is unique

            old_ugname = None

            if edit:

            if old_ugname != value or not edit:

                                               case_insensitive=True):

            if re.match(r'^[a-zA-Z0-9]{1}[a-zA-Z0-9\-\_\.]+$', value) is None:

                raise formencode.Invalid(_('Group name may only contain '

    return _ValidUsersGroup

class ValidPassword(formencode.validators.FancyValidator):

    def to_python(self, value, state):

        if value:

            if value.get('password'):

cache_manager = cache.CacheManager()

__all__ = ['Base', 'Session']

#

# SQLAlchemy session manager. Updated by model.init_model()

#

Session = scoped_session(

                sessionmaker(

                    query_cls=caching_query.query_callable(cache_manager)

                )

          )

class BaseModel(object):

    """Base Model for all classess

    """

    @classmethod

    def _get_keys(cls):

        """return column names for this model """

        return class_mapper(cls).c.keys()

    def get_dict(self):

        """return dict with keys and values corresponding

        :param name: name to fetch

        :param cache: Use cache for this query

        """

        perm = self.sa.query(Permission)\

            .filter(Permission.permission_name == name)

        if cache:

            perm = perm.options(FromCache("sql_cache_short",

                                          "get_permission_%s" % name))

        return perm.scalar()

    def update(self, form_result):

        perm_user = self.sa.query(User)\

        if len(u2p) != 3:

            raise Exception('Defined: %s should be 3  permissions for default'

                            ' user. This should not happen please verify'

                            ' your database' % len(u2p))

        try:

            #stage 1 change defaults

            for p in u2p:

                if p.permission.permission_name.startswith('repository.'):

                    p.permission = self.get_permission_by_name(

                                       form_result['default_perm'])

                    self.sa.add(p)

            if form_result['overwrite_default'] == True:

                for r2p in self.sa.query(RepoToPerm)\

                               .filter(RepoToPerm.user == perm_user).all():

                    r2p.permission = self.get_permission_by_name(

                                         form_result['default_perm'])

                    self.sa.add(r2p)

            #stage 3 set anonymous access

            if perm_user.username == 'default':

                perm_user.active = bool(form_result['anonymous'])

                self.sa.add(perm_user)