@property

    def repos_admin(self):

        """

        Returns list of repositories you're an admin of

        """

        return [x[0] for x in self.permissions['repositories'].iteritems()

                if x[1] == 'repository.admin']

    @property

    def groups_admin(self):

        """

        """

        return [x[0] for x in self.permissions['repositories_groups'].iteritems()

                if x[1] == 'group.admin']

    @property

    def ip_allowed(self):

        """

        Checks if ip_addr used in constructor is allowed from defined list of

        allowed ip_addresses for user

        :returns: boolean, True if ip is in allowed ip range

        """

    'admin_deleted_repo':          (_('[delete] repository'),

                                    None, 'database_delete.png'),

    'admin_created_repo':          (_('[created] repository'),

                                    None, 'database_add.png'),

    'admin_forked_repo':           (_('[forked] repository'),

                                    None, 'arrow_divide.png'),

    'admin_updated_repo':          (_('[updated] repository'),

                                    None, 'database_edit.png'),

    'admin_created_user':          (_('[created] user'),

                                    get_user_name, 'user_add.png'),

    'admin_updated_user':          (_('[updated] user'),

                                    get_user_name, 'user_edit.png'),

                                    get_users_group, 'group_add.png'),

                                    get_users_group, 'group_edit.png'),

    'user_commented_revision':     (_('[commented] on revision in repository'),

                                    get_cs_links, 'comment_add.png'),

    'user_commented_pull_request': (_('[commented] on pull request for'),

                                    get_pull_request, 'comment_add.png'),

    'user_closed_pull_request':    (_('[closed] pull request for'),

                                    get_pull_request, 'tick.png'),

    'push':                        (_('[pushed] into'),

                                    get_cs_links, 'script_add.png'),

    'push_local':                  (_('[committed via RhodeCode] into repository'),

                                    get_cs_links, 'script_edit.png'),

    'push_remote':                 (_('[pulled from remote] into repository'),

        repo = self._get_repo(repo)

        obj = self.sa.query(UserRepoToPerm)\

            .filter(UserRepoToPerm.repository == repo)\

            .filter(UserRepoToPerm.user == user)\

            .scalar()

        if obj:

            self.sa.delete(obj)

            log.debug('Revoked perm on %s on %s' % (repo, user))

    def grant_users_group_permission(self, repo, group_name, perm):

        """

        existing one if found

        :param repo: Instance of Repository, repository_id, or repository name

        :param group_name: Instance of UserGroup, users_group_id,

        :param perm: Instance of Permission, or permission_name

        """

        repo = self._get_repo(repo)

        group_name = self.__get_users_group(group_name)

        permission = self._get_perm(perm)

        # check if we have that permission already

        obj = self.sa.query(UsersGroupRepoToPerm)\

            .filter(UsersGroupRepoToPerm.users_group == group_name)\

            .filter(UsersGroupRepoToPerm.repository == repo)\

            .scalar()

        if obj is None:

            # create new

            obj = UsersGroupRepoToPerm()

        obj.repository = repo

        obj.users_group = group_name

        obj.permission = permission

        self.sa.add(obj)

        log.debug('Granted perm %s to %s on %s' % (perm, group_name, repo))

    def revoke_users_group_permission(self, repo, group_name):

        """

        :param repo: Instance of Repository, repository_id, or repository name

        :param group_name: Instance of UserGroup, users_group_id,

        """

        repo = self._get_repo(repo)

        group_name = self.__get_users_group(group_name)

        obj = self.sa.query(UsersGroupRepoToPerm)\

            .filter(UsersGroupRepoToPerm.repository == repo)\

            .filter(UsersGroupRepoToPerm.users_group == group_name)\

            .scalar()

        if obj:

            self.sa.delete(obj)

            log.debug('Revoked perm to %s on %s' % (repo, group_name))

            rg_k = perm.UserRepoGroupToPerm.group.group_name

            p = perm.Permission.permission_name

            user.permissions[GK][rg_k] = p

        #======================================================================

        # !! OVERRIDE GLOBALS !! with user permissions if any found

        #======================================================================

        # those can be configured from groups or users explicitly

        _configurable = set(['hg.fork.none', 'hg.fork.repository',

                             'hg.create.none', 'hg.create.repository'])

        # USER GROUPS comes first

        user_perms_from_users_groups = self.sa.query(UsersGroupToPerm)\

            .options(joinedload(UsersGroupToPerm.permission))\

            .join((UsersGroupMember, UsersGroupToPerm.users_group_id ==

                   UsersGroupMember.users_group_id))\

            .filter(UsersGroupMember.user_id == uid)\

            .order_by(UsersGroupToPerm.users_group_id)\

            .all()

        #need to group here by groups since user can be in more than one group

        _grouped = [[x, list(y)] for x, y in

                    itertools.groupby(user_perms_from_users_groups,

                                      lambda x:x.users_group)]

        for gr, perms in _grouped:

            for perm in user_perms:

                user.permissions[GLOBAL].add(perm.permission.permission_name)

        #======================================================================

        # !! PERMISSIONS FOR REPOSITORIES !!

        #======================================================================

        #======================================================================

        # check if user is part of user groups for this repository and

        # fill in his permission from it. _choose_perm decides of which

        # permission should be selected based on selected method

        #======================================================================

        user_repo_perms_from_users_groups = \

         self.sa.query(UsersGroupRepoToPerm, Permission, Repository,)\

            .join((Repository, UsersGroupRepoToPerm.repository_id ==

                   Repository.repo_id))\

            .join((Permission, UsersGroupRepoToPerm.permission_id ==

                   Permission.permission_id))\

            .join((UsersGroupMember, UsersGroupRepoToPerm.users_group_id ==

                   UsersGroupMember.users_group_id))\

            .filter(UsersGroupMember.user_id == uid)\

            .all()

        multiple_counter = collections.defaultdict(int)

                if not explicit:

                    p = _choose_perm(p, cur_perm)

            user.permissions[RK][r_k] = p

        #======================================================================

        # !! PERMISSIONS FOR REPOSITORY GROUPS !!

        #======================================================================

        #======================================================================

        # check if user is part of user groups for this repository groups and

        # fill in his permission from it. _choose_perm decides of which

        # permission should be selected based on selected method

        #======================================================================

        user_repo_group_perms_from_users_groups = \

         self.sa.query(UsersGroupRepoGroupToPerm, Permission, RepoGroup)\

         .join((RepoGroup, UsersGroupRepoGroupToPerm.group_id == RepoGroup.group_id))\

         .join((Permission, UsersGroupRepoGroupToPerm.permission_id

                == Permission.permission_id))\

         .join((UsersGroupMember, UsersGroupRepoGroupToPerm.users_group_id

                == UsersGroupMember.users_group_id))\

         .filter(UsersGroupMember.user_id == uid)\

         .all()

        multiple_counter = collections.defaultdict(int)

        for perm in user_repo_group_perms_from_users_groups:

            except Exception:

                msg = M(self, 'invalid_username', state, username=value)

                raise formencode.Invalid(msg, value, state,

                    error_dict=dict(username=msg)

                )

    return _validator

def ValidUsersGroup(edit=False, old_data={}):

    class _validator(formencode.validators.FancyValidator):

        messages = {

            'group_exist': _(u'Users group "%(usersgroup)s" already exists'),

            'invalid_usersgroup_name':

                  'characters underscores, periods or dashes and must begin '

                  'with alphanumeric character')

        }

        def validate_python(self, value, state):

            if value in ['default']:

                msg = M(self, 'invalid_group', state)

                raise formencode.Invalid(msg, value, state,

                    error_dict=dict(users_group_name=msg)

                )

            #check if group is unique

            old_ugname = None

    return _validator

def ValidPerms(type_='repo'):

    if type_ == 'group':

        EMPTY_PERM = 'group.none'

    elif type_ == 'repo':

        EMPTY_PERM = 'repository.none'

    class _validator(formencode.validators.FancyValidator):

        messages = {

            'perm_new_member_name':

        }

        def to_python(self, value, state):

            perms_update = OrderedSet()

            perms_new = OrderedSet()

            # build a list of permission to update and new permission to create

            #CLEAN OUT ORG VALUE FROM NEW MEMBERS, and group them using

            new_perms_group = defaultdict(dict)

            for k, v in value.copy().iteritems():

                if k.startswith('perm_new_member'):

                    del value[k]

## -*- coding: utf-8 -*-

<%inherit file="/base/base.html"/>

<%def name="title()">

    ${_('Repository groups administration')} - ${c.rhodecode_name}

</%def>

<%def name="breadcrumbs_links()">

    ${h.link_to(_('Admin'),h.url('admin_home'))}

    »

</%def>

<%def name="page_nav()">

    ${self.menu('admin')}

</%def>

<%def name="main()">

<div class="box">

    <!-- box / title -->

    <div class="title">

        ${self.breadcrumbs()}

        <ul class="links">

          <li>

            %if h.HasPermissionAny('hg.admin')():

## -*- coding: utf-8 -*-

<%inherit file="/base/base.html"/>

<%def name="title()">

</%def>

<%def name="breadcrumbs_links()">

    ${h.link_to(_('Admin'),h.url('admin_home'))}

    »

    ${h.link_to(_('UsersGroups'),h.url('users_groups'))}

    »

    ${_('edit')} "${c.users_group.users_group_name}"

</%def>

<%def name="page_nav()">

    ${self.menu('admin')}

        self._compare_ok(id_, expected, given=response.body)

        UsersGroupModel().delete(users_group='test_users_group2')

        Session().commit()

    def test_api_create_users_group(self):

        group_name = 'some_new_group'

        id_, params = _build_data(self.apikey, 'create_users_group',

                                  group_name=group_name)

        response = api_call(self, params)

        ret = {

            'users_group': jsonify(UsersGroupModel()\

                                   .get_by_name(group_name)\

                                   .get_api_data())

        }

        expected = ret

        self._compare_ok(id_, expected, given=response.body)

        destroy_users_group(group_name)

    def test_api_get_users_group_that_exist(self):

        id_, params = _build_data(self.apikey, 'create_users_group',

                                  group_name=TEST_USERS_GROUP)

        response = api_call(self, params)

        self._compare_error(id_, expected, given=response.body)

    @mock.patch.object(UsersGroupModel, 'create', crash)

    def test_api_get_users_group_exception_occurred(self):

        group_name = 'exception_happens'

        id_, params = _build_data(self.apikey, 'create_users_group',

                                  group_name=group_name)

        response = api_call(self, params)

        expected = 'failed to create group `%s`' % group_name

        self._compare_error(id_, expected, given=response.body)

    def test_api_add_user_to_users_group(self):

        gr_name = 'test_group'

        UsersGroupModel().create(gr_name)

        Session().commit()

        id_, params = _build_data(self.apikey, 'add_user_to_users_group',

                                  usersgroupid=gr_name,

                                  userid=TEST_USER_ADMIN_LOGIN)

        response = api_call(self, params)

        expected = {

                                TEST_USER_ADMIN_LOGIN, gr_name

                            ),

                    'success': True}

        self._compare_ok(id_, expected, given=response.body)

        UsersGroupModel().delete(users_group=gr_name)

        Session().commit()

    def test_api_add_user_to_users_group_that_doesnt_exist(self):

        id_, params = _build_data(self.apikey, 'add_user_to_users_group',

                                  usersgroupid='false-group',

                                  userid=TEST_USER_ADMIN_LOGIN)

        response = api_call(self, params)

        self._compare_error(id_, expected, given=response.body)

    @mock.patch.object(UsersGroupModel, 'add_user_to_group', crash)

    def test_api_add_user_to_users_group_exception_occurred(self):

        gr_name = 'test_group'

        UsersGroupModel().create(gr_name)

        Session().commit()

        id_, params = _build_data(self.apikey, 'add_user_to_users_group',

                                  usersgroupid=gr_name,

                                  userid=TEST_USER_ADMIN_LOGIN)

        response = api_call(self, params)

        self._compare_error(id_, expected, given=response.body)

        UsersGroupModel().delete(users_group=gr_name)

        Session().commit()

    def test_api_remove_user_from_users_group(self):

        gr_name = 'test_group_3'

        gr = UsersGroupModel().create(gr_name)

        UsersGroupModel().add_user_to_group(gr, user=TEST_USER_ADMIN_LOGIN)

        Session().commit()

        id_, params = _build_data(self.apikey, 'remove_user_from_users_group',

                                  usersgroupid=gr_name,

                                  userid=TEST_USER_ADMIN_LOGIN)

        response = api_call(self, params)

        expected = {

                                TEST_USER_ADMIN_LOGIN, gr_name

                            ),

                    'success': True}

        self._compare_ok(id_, expected, given=response.body)

        UsersGroupModel().delete(users_group=gr_name)

        Session().commit()

    @mock.patch.object(UsersGroupModel, 'remove_user_from_group', crash)

    def test_api_remove_user_from_users_group_exception_occurred(self):

        gr_name = 'test_group_3'

        gr = UsersGroupModel().create(gr_name)

        UsersGroupModel().add_user_to_group(gr, user=TEST_USER_ADMIN_LOGIN)

        Session().commit()

        id_, params = _build_data(self.apikey, 'remove_user_from_users_group',

                                  usersgroupid=gr_name,

                                  userid=TEST_USER_ADMIN_LOGIN)

        response = api_call(self, params)

        self._compare_error(id_, expected, given=response.body)

        UsersGroupModel().delete(users_group=gr_name)

        Session().commit()

    @parameterized.expand([('none', 'repository.none'),

                           ('read', 'repository.read'),

                           ('write', 'repository.write'),

                           ('admin', 'repository.admin')])

    def test_api_grant_user_permission(self, name, perm):

        id_, params = _build_data(self.apikey, 'grant_user_permission',

                                  repoid=self.REPO,

    @parameterized.expand([('none', 'repository.none'),

                           ('read', 'repository.read'),

                           ('write', 'repository.write'),

                           ('admin', 'repository.admin')])

    def test_api_grant_users_group_permission(self, name, perm):

        id_, params = _build_data(self.apikey, 'grant_users_group_permission',

                                  repoid=self.REPO,

                                  usersgroupid=TEST_USERS_GROUP,

                                  perm=perm)

        response = api_call(self, params)

        ret = {

                perm, TEST_USERS_GROUP, self.REPO

            ),

            'success': True

        }

        expected = ret

        self._compare_ok(id_, expected, given=response.body)

    def test_api_grant_users_group_permission_wrong_permission(self):

        perm = 'haha.no.permission'

        id_, params = _build_data(self.apikey, 'grant_users_group_permission',

                                  repoid=self.REPO,

                                  usersgroupid=TEST_USERS_GROUP,

        expected = 'permission `%s` does not exist' % perm

        self._compare_error(id_, expected, given=response.body)

    @mock.patch.object(RepoModel, 'grant_users_group_permission', crash)

    def test_api_grant_users_group_permission_exception_when_adding(self):

        perm = 'repository.read'

        id_, params = _build_data(self.apikey, 'grant_users_group_permission',

                                  repoid=self.REPO,

                                  usersgroupid=TEST_USERS_GROUP,

                                  perm=perm)

        response = api_call(self, params)

                    TEST_USERS_GROUP, self.REPO

                )

        self._compare_error(id_, expected, given=response.body)

    def test_api_revoke_users_group_permission(self):

        RepoModel().grant_users_group_permission(repo=self.REPO,

                                                 group_name=TEST_USERS_GROUP,

                                                 perm='repository.read')

        Session().commit()

        id_, params = _build_data(self.apikey, 'revoke_users_group_permission',

                                  repoid=self.REPO,

                                  usersgroupid=TEST_USERS_GROUP,)

        response = api_call(self, params)

        expected = {

                TEST_USERS_GROUP, self.REPO

            ),

            'success': True

        }

        self._compare_ok(id_, expected, given=response.body)

    @mock.patch.object(RepoModel, 'revoke_users_group_permission', crash)

    def test_api_revoke_users_group_permission_exception_when_adding(self):

        id_, params = _build_data(self.apikey, 'revoke_users_group_permission',

                                  repoid=self.REPO,

                                  usersgroupid=TEST_USERS_GROUP,)

        response = api_call(self, params)

                    TEST_USERS_GROUP, self.REPO

                )

        self._compare_error(id_, expected, given=response.body)

    def test_index_as_xml(self):

        response = self.app.get(url('formatted_users_groups', format='xml'))

    def test_create(self):

        self.log_user()

        users_group_name = TEST_USERS_GROUP

        response = self.app.post(url('users_groups'),

                                 {'users_group_name': users_group_name,

                                  'active':True})

        response.follow()

        self.checkSessionFlash(response,

    def test_new(self):

        response = self.app.get(url('new_users_group'))

    def test_new_as_xml(self):

        response = self.app.get(url('formatted_new_users_group', format='xml'))

    def test_update(self):

        response = self.app.put(url('users_group', id=1))

    def test_update_browser_fakeout(self):

        response = self.app.post(url('users_group', id=1),

                                 params=dict(_method='put'))

    def test_delete(self):

        self.log_user()

        users_group_name = TEST_USERS_GROUP + 'another'

        response = self.app.post(url('users_groups'),

                                 {'users_group_name':users_group_name,

                                  'active':True})

        response.follow()

        self.checkSessionFlash(response,

        gr = self.Session.query(UsersGroup)\

                           .filter(UsersGroup.users_group_name ==

                                   users_group_name).one()

        response = self.app.delete(url('users_group', id=gr.users_group_id))

        gr = self.Session.query(UsersGroup)\

                           .filter(UsersGroup.users_group_name ==

                                   users_group_name).scalar()

        self.assertEqual(gr, None)

    def test_enable_repository_read_on_group(self):

        self.log_user()

        users_group_name = TEST_USERS_GROUP + 'another2'

        response = self.app.post(url('users_groups'),

                                 {'users_group_name': users_group_name,

                                  'active': True})

        response.follow()

        ug = UsersGroup.get_by_group_name(users_group_name)

        self.checkSessionFlash(response,

        ## ENABLE REPO CREATE ON A GROUP

        response = self.app.put(url('users_group_perm', id=ug.users_group_id),

                                 {'create_repo_perm': True})

        response.follow()

        ug = UsersGroup.get_by_group_name(users_group_name)

        p = Permission.get_by_key('hg.create.repository')

        p2 = Permission.get_by_key('hg.fork.none')

        # check if user has this perms, they should be here since

        # defaults are on

        perms = UsersGroupToPerm.query()\

            .filter(UsersGroupToPerm.users_group == ug).all()

        )

    def test_enable_repository_fork_on_group(self):

        self.log_user()

        users_group_name = TEST_USERS_GROUP + 'another2'

        response = self.app.post(url('users_groups'),

                                 {'users_group_name': users_group_name,

                                  'active': True})

        response.follow()

        ug = UsersGroup.get_by_group_name(users_group_name)

        self.checkSessionFlash(response,

        ## ENABLE REPO CREATE ON A GROUP

        response = self.app.put(url('users_group_perm', id=ug.users_group_id),

                                 {'fork_repo_perm': True})

        response.follow()

        ug = UsersGroup.get_by_group_name(users_group_name)

        p = Permission.get_by_key('hg.create.none')

        p2 = Permission.get_by_key('hg.fork.repository')

        # check if user has this perms, they should be here since

        # defaults are on

        perms = UsersGroupToPerm.query()\

            .filter(UsersGroupToPerm.users_group == ug).all()

    def test_owner_permissions_doesnot_get_overwritten_by_group(self):

        #create repo as USER,

        self.test_repo = repo = RepoModel().create_repo(repo_name='myownrepo',

                                repo_type='hg',

                                description='desc',

                                owner=self.u1)

        Session().commit()

        #he has permissions of admin as owner

        u1_auth = AuthUser(user_id=self.u1.user_id)

        self.assertEqual(u1_auth.permissions['repositories']['myownrepo'],

                         'repository.admin')

        self.ug1 = UsersGroupModel().create('G1')

        # add user to group

        UsersGroupModel().add_user_to_group(self.ug1, self.u1)

        RepoModel().grant_users_group_permission(repo, group_name=self.ug1,

                                                 perm='repository.none')

        Session().commit()

        u1_auth = AuthUser(user_id=self.u1.user_id)

        self.assertEqual(u1_auth.permissions['repositories']['myownrepo'],

                         'repository.admin')

    def test_owner_permissions_doesnot_get_overwritten_by_others(self):

    def __init__(self, methodName='runTest'):

        Session.remove()

        super(TestUser, self).__init__(methodName=methodName)

    def test_create_and_remove(self):

        usr = UserModel().create_or_update(username=u'test_user',

                                           password=u'qweqwe',

                                     email=u'u232@rhodecode.org',

                                     firstname=u'u1', lastname=u'u1')

        Session().commit()

        self.assertEqual(User.get_by_username(u'test_user'), usr)

        users_group = UsersGroupModel().create('some_example_group')

        Session().commit()

        UsersGroupModel().add_user_to_group(users_group, usr)

        Session().commit()

        self.assertEqual(UsersGroup.get(users_group.users_group_id), users_group)

        self.assertEqual(UsersGroupMember.query().count(), 1)

        UserModel().delete(usr.user_id)

        Session().commit()

        self.assertEqual(UsersGroupMember.query().all(), [])