check for valid repositories group for proper 404 handling

        :param environ:

        :param match_dict:

        """

        repos_group_name = match_dict.get('group_name')

        return is_valid_repos_group(repos_group_name, config['base_path'])

    def check_int(environ, match_dict):

        return match_dict.get('id').isdigit()

    # The ErrorController route (handles 404/500 error pages); it should

        m.connect("formatted_repos_groups", "/repos_groups.{format}",

                  action="index", conditions=dict(method=["GET"]))

        m.connect("new_repos_group", "/repos_groups/new",

                  action="new", conditions=dict(method=["GET"]))

        m.connect("formatted_new_repos_group", "/repos_groups/new.{format}",

                  action="new", conditions=dict(method=["GET"]))

                  action="update", conditions=dict(method=["PUT"],

                  action="delete", conditions=dict(method=["DELETE"],

                  action="edit", conditions=dict(method=["GET"],))

        m.connect("formatted_edit_repos_group",

                  action="edit", conditions=dict(method=["GET"],

                  action="show", conditions=dict(method=["GET"],

                  action="show", conditions=dict(method=["GET"],

        # ajax delete repos group perm user

        m.connect('delete_repos_group_user_perm',

             action="delete_repos_group_user_perm",

             conditions=dict(method=["DELETE"], function=check_group))

        # ajax delete repos group perm users_group

        m.connect('delete_repos_group_users_group_perm',

                  action="delete_repos_group_users_group_perm",

                  conditions=dict(method=["DELETE"], function=check_group))

    #ADMIN USER REST ROUTES

    with rmap.submapper(path_prefix=ADMIN_PREFIX,

                        controller='admin/users') as m:

import traceback

import formencode

from formencode import htmlfill

from pylons import request, tmpl_context as c, url

from pylons.i18n.translation import _

from sqlalchemy.exc import IntegrityError

import rhodecode

from rhodecode.lib import helpers as h

from rhodecode.lib.ext_json import json

from rhodecode.lib.auth import LoginRequired, HasPermissionAnyDecorator,\

from rhodecode.lib.base import BaseController, render

from rhodecode.model.db import RepoGroup, Repository

from rhodecode.model.repos_group import ReposGroupModel

from rhodecode.model.forms import ReposGroupForm

from rhodecode.model.meta import Session

from rhodecode.model.repo import RepoModel

from webob.exc import HTTPInternalServerError, HTTPNotFound

from sqlalchemy.sql.expression import func

log = logging.getLogger(__name__)

class ReposGroupsController(BaseController):

    """REST Controller styled on the Atom Publishing Protocol"""

    #     map.resource('repos_group', 'repos_groups')

    @LoginRequired()

    def __before__(self):

        super(ReposGroupsController, self).__before__()

        c.repo_groups_choices = map(lambda k: unicode(k[0]), c.repo_groups)

        repo_model = RepoModel()

        c.users_array = repo_model.get_users_js()

        c.users_groups_array = repo_model.get_users_groups_js()

    def __load_data(self, group_id):

        """

        Load defaults settings for edit, and update

        :param group_id:

        """

        repo_group = RepoGroup.get_or_404(group_id)

        data = repo_group.get_dict()

        data['group_name'] = repo_group.name

        # fill repository users

        for p in repo_group.repo_group_to_perm:

        for p in repo_group.users_group_to_perm:

            data.update({'g_perm_%s' % p.users_group.users_group_name:

                             p.permission.permission_name})

        return data

    def index(self, format='html'):

        """GET /repos_groups: All items in the collection"""

        # url('repos_groups')

        sk = lambda g: g.parents[0].group_name if g.parents else g.group_name

        return render('admin/repos_groups/repos_groups_show.html')

    def create(self):

        """POST /repos_groups: Create a new item"""

        # url('repos_groups')

        self.__load_defaults()

        repos_group_form = ReposGroupForm(available_groups =

        try:

            form_result = repos_group_form.to_python(dict(request.POST))

            ReposGroupModel().create(

                    group_name=form_result['group_name'],

                    group_description=form_result['group_description'],

            )

            Session().commit()

            h.flash(_('created repos group %s') \

                    % form_result['group_name'], category='success')

            #TODO: in futureaction_logger(, '', '', '', self.sa)

        except formencode.Invalid, errors:

            return htmlfill.render(

                render('admin/repos_groups/repos_groups_add.html'),

                defaults=errors.value,

                errors=errors.error_dict or {},

                prefix_error=False,

                encoding="UTF-8")

        except Exception:

            log.error(traceback.format_exc())

            h.flash(_('error occurred during creation of repos group %s') \

                    % request.POST.get('group_name'), category='error')

    def new(self, format='html'):

        """GET /repos_groups/new: Form to create a new item"""

        # url('new_repos_group')

        self.__load_defaults()

        return render('admin/repos_groups/repos_groups_add.html')

        # Forms posted to this method should contain a hidden field:

        #    <input type="hidden" name="_method" value="PUT" />

        # Or using helpers:

        #           method='put')

        repos_group_form = ReposGroupForm(

            edit=True,

            old_data=c.repos_group.get_dict(),

        )()

        try:

            form_result = repos_group_form.to_python(dict(request.POST))

            Session().commit()

            h.flash(_('updated repos group %s') \

                    % form_result['group_name'], category='success')

            #TODO: in future action_logger(, '', '', '', self.sa)

        except formencode.Invalid, errors:

            return htmlfill.render(

                render('admin/repos_groups/repos_groups_edit.html'),

                defaults=errors.value,

                encoding="UTF-8")

        except Exception:

            log.error(traceback.format_exc())

            h.flash(_('error occurred during update of repos group %s') \

                    % request.POST.get('group_name'), category='error')

        # Forms posted to this method should contain a hidden field:

        #    <input type="hidden" name="_method" value="DELETE" />

        # Or using helpers:

        #           method='delete')

        repos = gr.repositories.all()

        if repos:

            h.flash(_('This group contains %s repositores and cannot be '

                      'deleted') % len(repos),

                    category='error')

            return redirect(url('repos_groups'))

        try:

            Session().commit()

            h.flash(_('removed repos group %s') % gr.group_name,

                    category='success')

            #TODO: in future action_logger(, '', '', '', self.sa)

        except IntegrityError, e:

            if str(e.message).find('groups_group_parent_id_fkey') != -1:

        if id_:

            return self.show(id_.group_id)

        raise HTTPNotFound

    @HasReposGroupPermissionAnyDecorator('group.read', 'group.write',

                                         'group.admin')

        c.group_repos = c.group.repositories.all()

        #overwrite our cached list with current filter

        gr_filter = c.group_repos

        c.repo_cnt = 0

        groups = RepoGroup.query().order_by(RepoGroup.group_name)\

        c.groups = self.scm_model.get_repos_groups(groups)

        if c.visual.lightweight_dashboard is False:

            c.repos_list = self.scm_model.get_repos(all_repos=gr_filter)

        ## lightweight version of dashboard

        else:

            c.repos_list = Repository.query()\

                            .order_by(func.lower(Repository.repo_name))\

                            .all()

            repos_data = RepoModel().get_repos_as_dict(repos_list=c.repos_list,

                                                       admin=False)

            #json used to render the grid

            c.data = json.dumps(repos_data)

        return render('admin/repos_groups/repos_groups.html')

        return htmlfill.render(

            render('admin/repos_groups/repos_groups_edit.html'),

            defaults=defaults,

            encoding="UTF-8",

            force_defaults=False

    Checks for access permission for any of given predicates for specific

    repository. In order to fulfill the request any of predicates must be meet

    """

    def check_permissions(self):

        repo_name = get_repo_slug(request)

        try:

            user_perms = set([self.user_perms['repositories'][repo_name]])

        except KeyError:

            return False

        if self.required_perms.intersection(user_perms):

    def check_permissions(self):

        group_name = get_repos_group_slug(request)

        try:

            user_perms = set([self.user_perms['repositories_groups'][group_name]])

        except KeyError:

            return False

        if self.required_perms.issubset(user_perms):

            return True

        return False

class HasReposGroupPermissionAnyDecorator(PermsDecorator):

    Checks for access permission for any of given predicates for specific

    repository. In order to fulfill the request any of predicates must be meet

    """

    def check_permissions(self):

        group_name = get_repos_group_slug(request)

        try:

            user_perms = set([self.user_perms['repositories_groups'][group_name]])

        except KeyError:

            return False

        if self.required_perms.intersection(user_perms):

            return True

        return False

#==============================================================================

#==============================================================================

# PERMS

#==============================================================================

from rhodecode.lib.auth import HasPermissionAny, HasPermissionAll, \

#==============================================================================

# GRAVATAR URL

#==============================================================================

    def __unicode__(self):

        return u"<%s('%s:%s')>" % (self.__class__.__name__, self.group_id,

                                  self.group_name)

    @classmethod

        from webhelpers.html import literal as _literal

        from rhodecode.model.scm import ScmModel

        groups = cls.query().all()

        if check_perms:

            #filter group user have access to, it's done

            #magically inside ScmModel based on current user

            groups = ScmModel().get_repos_groups(groups)

        sep = ' » '

        _name = lambda k: _literal(sep.join(k))

        repo_groups.extend([(x.group_id, _name(x.full_path_splitted))

                              for x in groups])

                if_missing=None, not_empty=False

            )

    return _UsersGroupForm

    class _ReposGroupForm(formencode.Schema):

        allow_extra_fields = True

        filter_extra_fields = False

        group_name = All(v.UnicodeString(strip=True, min=1, not_empty=True),

                               v.SlugifyName())

        group_description = v.UnicodeString(strip=True, min=1,

                                        testValueList=True,

        enable_locking = v.StringBoolean(if_missing=False)

        recursive = v.StringBoolean(if_missing=False)

        chained_validators = [v.ValidReposGroup(edit, old_data),

                              v.ValidPerms('group')]

    return _ReposGroupForm

                _now = datetime.datetime.now()

                _ms = str(_now.microsecond).rjust(6, '0')

                _d = 'rm__%s_GROUP_%s' % (_now.strftime('%Y%m%d_%H%M%S_' + _ms),

                                          group.name)

                shutil.move(rm_path, os.path.join(self.repos_path, _d))

        try:

            new_repos_group = RepoGroup()

            new_repos_group.parent_group = self._get_repos_group(parent)

            new_repos_group.group_name = new_repos_group.get_new_name(group_name)

            self.sa.add(new_repos_group)

            self._create_default_perms(new_repos_group)

            if not just_db:

                # we need to flush here, in order to check if database won't

                # throw any exceptions, create filesystem dirs at the very end

                self.sa.flush()

                self.__create_group(new_repos_group.group_name)

            #if it's not recursive call

            # break the loop and don't proceed with other changes

            if not recursive:

                break

        return updates

        try:

            recursive = form_data['recursive']

            # iterate over all members(if in recursive mode) of this groups and

            # set the permissions !

            # this can be potentially heavy operation

            self._update_permissions(repos_group, form_data['perms_new'],

                                     form_data['perms_updates'], recursive)

class CachedRepoList(object):

    """

    Cached repo list, uses in-memory cache after initialization, that is

    super fast

    """

        self.db_repo_list = db_repo_list

        self.repos_path = repos_path

        self.order_by = order_by

        self.reversed = (order_by or '').startswith('-')

    def __len__(self):

        return len(self.db_repo_list)

    def __repr__(self):

        return '<%s (%s)>' % (self.__class__.__name__, self.__len__())

        cache_map = CacheInvalidation.get_cache_map()

        for dbr in self.db_repo_list:

            scmr = dbr.scm_instance_cached(cache_map)

            # check permission at this level

            if not HasRepoPermissionAny(

            )(dbr.repo_name, 'get repo check'):

                continue

            if scmr is None:

                log.error(

                    '%s this repository is present in database but it '

    """

    def __iter__(self):

        for dbr in self.db_repo_list:

            # check permission at this level

            if not HasRepoPermissionAny(

            )(dbr.repo_name, 'get repo check'):

                continue

            tmp_d = {}

            tmp_d['name'] = dbr.repo_name

            tmp_d['name_sort'] = tmp_d['name'].lower()

            tmp_d['dbrepo_fork'] = dbr.fork.get_dict() if dbr.fork else {}

            yield tmp_d

class GroupList(object):

        self.db_repo_group_list = db_repo_group_list

    def __len__(self):

        return len(self.db_repo_group_list)

    def __repr__(self):

        return '<%s (%s)>' % (self.__class__.__name__, self.__len__())

    def __iter__(self):

        for dbgr in self.db_repo_group_list:

            # check permission at this level

            if not HasReposGroupPermissionAny(

            )(dbgr.group_name, 'get group repo check'):

                continue

            yield dbgr

    class _validator(formencode.validators.FancyValidator):

        messages = {

            'permission_denied': _(u"You don't have permissions "

                                   "to create repository in this group")

        }

        def validate_python(self, value, state):

            gr = RepoGroup.get(value)

                msg = M(self, 'permission_denied', state)

                raise formencode.Invalid(msg, value, state,

                    error_dict=dict(repo_type=msg)

                )

    return _validator

def ValidPerms(type_='repo'):

    if type_ == 'group':

        EMPTY_PERM = 'group.none'

    elif type_ == 'repo':

        EMPTY_PERM = 'repository.none'

#perms .perm_tag.admin{

  background-color: #B94A48;

  color: #ffffff;

}

#perms .perm_tag.write{

  color: #ffffff;    

}

#perms .perm_tag.read{

  background-color: #468847;

  color: #ffffff;    

                            %endif

                        </td>

                        <td>

                            %if section == 'repositories':

                                <a href="${h.url('edit_repo',repo_name=k,anchor='permissions_manage')}">${_('edit')}</a>

                            %elif section == 'repositories_groups':

                            %else:

                                --

                            %endif

                        </td>

                    </tr>

                %endfor

          <li>

            <span>${h.link_to(_(u'Add new child group'),h.url('new_repos_group', parent_group=c.repos_group.group_id))}</span>

          </li>

        </ul>

    </div>

    <!-- end box / title -->

    <div class="form">

        <!-- fields -->

        <div class="fields">

            <div class="field">

                <div class="label">

                    <label for="group_name">${_('Group name')}:</label>

                          ${h.link_to(h.literal(' » '.join(map(h.safe_unicode,[g.name for g in gr.parents+[gr]]))), url('repos_group_home',group_name=gr.group_name))}

                          </div>

                      </td>

                      <td>${gr.group_description}</td>

                      <td><b>${gr_cn}</b></td>

                      <td>

                         ${h.submit('edit_%s' % gr.group_name,_('edit'),class_="edit_icon action_button")}

                       </a>

                      </td>

                      <td>

                         ${h.submit('remove_%s' % gr.name,_('delete'),class_="delete_icon action_button",onclick="return confirm('"+ungettext('Confirm to delete this group: %s with %s repository','Confirm to delete this group: %s with %s repositories',gr_cn) % (gr.name,gr_cn)+"');")}

                       ${h.end_form()}

                      </td>

                  </tr>

                % endfor

                            %endif

                        </td>

                        <td>

                            %if section == 'repositories':

                                <a href="${h.url('edit_repo',repo_name=k,anchor='permissions_manage')}">${_('edit')}</a>

                            %elif section == 'repositories_groups':