def get(self, key, other=None):

        if isinstance(self.cookie_store, dict):

            return self.cookie_store.get(key, other)

        elif isinstance(self.cookie_store, AuthUser):

            return self.cookie_store.__dict__.get(key, other)

class  AuthUser(object):

    """

    A simple object that handles all attributes of user in RhodeCode

    It does lookup based on API key,given user, or user present in session

    Then it fills all required information for such user. It also checks if

    anonymous access is enabled and if so, it returns default user as logged

    in

    """

    def __init__(self, user_id=None, api_key=None, username=None, ip_addr=None):

        self.user_id = user_id

        self.api_key = None

        self.username = username

        self.ip_addr = ip_addr

        self.name = ''

        self.lastname = ''

        self.email = ''

        self.is_authenticated = False

        self.admin = False

        self.inherit_default_permissions = False

        self.permissions = {}

        self._api_key = api_key

        self.propagate_data()

        self._instance = None

    def propagate_data(self):

        user_model = UserModel()

        self.anonymous_user = User.get_by_username('default', cache=True)

        is_user_loaded = False

        # try go get user by api key

        if self._api_key and self._api_key != self.anonymous_user.api_key:

            log.debug('Auth User lookup by API KEY %s' % self._api_key)

            is_user_loaded = user_model.fill_data(self, api_key=self._api_key)

        # lookup by userid

        elif (self.user_id is not None and

              self.user_id != self.anonymous_user.user_id):

            log.debug('Auth User lookup by USER ID %s' % self.user_id)

            is_user_loaded = user_model.fill_data(self, user_id=self.user_id)

        # lookup by username

        elif self.username and \

            str2bool(config.get('container_auth_enabled', False)):

            log.debug('Auth User lookup by USER NAME %s' % self.username)

            dbuser = login_container_auth(self.username)

            if dbuser is not None:

                log.debug('filling all attributes to object')

                for k, v in dbuser.get_dict().items():

                    setattr(self, k, v)

                self.set_authenticated()

                is_user_loaded = True

        else:

            log.debug('No data in %s that could been used to log in' % self)

        if not is_user_loaded:

            # if we cannot authenticate user try anonymous

            if self.anonymous_user.active is True:

                user_model.fill_data(self, user_id=self.anonymous_user.user_id)

                # then we set this user is logged in

                self.is_authenticated = True

            else:

                self.user_id = None

                self.username = None

                self.is_authenticated = False

        if not self.username:

            self.username = 'None'

        log.debug('Auth User is now %s' % self)

        user_model.fill_perms(self)

    @property

    def is_admin(self):

        return self.admin

    @property

    def repos_admin(self):

        """

        Returns list of repositories you're an admin of

        """

        return [x[0] for x in self.permissions['repositories'].iteritems()

                if x[1] == 'repository.admin']

    @property

    def groups_admin(self):

        """

        """

        return [x[0] for x in self.permissions['repositories_groups'].iteritems()

                if x[1] == 'group.admin']

    @property

    def ip_allowed(self):

        """

        Checks if ip_addr used in constructor is allowed from defined list of

        allowed ip_addresses for user

        :returns: boolean, True if ip is in allowed ip range

        """

        #check IP

        allowed_ips = AuthUser.get_allowed_ips(self.user_id, cache=True)

        if check_ip_access(source_ip=self.ip_addr, allowed_ips=allowed_ips):

            log.debug('IP:%s is in range of %s' % (self.ip_addr, allowed_ips))

            return True

        else:

            log.info('Access for IP:%s forbidden, '

                     'not in %s' % (self.ip_addr, allowed_ips))

            return False

    def __repr__(self):

        return "<AuthUser('id:%s:%s|%s')>" % (self.user_id, self.username,

                                              self.is_authenticated)

    def set_authenticated(self, authenticated=True):

        if self.user_id != self.anonymous_user.user_id:

            self.is_authenticated = authenticated

    def get_cookie_store(self):

        return {'username': self.username,

                'user_id': self.user_id,

                'is_authenticated': self.is_authenticated}

    @classmethod

    def from_cookie_store(cls, cookie_store):

        """

        Creates AuthUser from a cookie store

        :param cls:

        :param cookie_store:

        """

        user_id = cookie_store.get('user_id')

        username = cookie_store.get('username')

        api_key = cookie_store.get('api_key')

        return AuthUser(user_id, api_key, username)

    @classmethod

    def get_allowed_ips(cls, user_id, cache=False):

        _set = set()

        user_ips = UserIpMap.query().filter(UserIpMap.user_id == user_id)

        if cache:

            user_ips = user_ips.options(FromCache("sql_cache_short",

                                                  "get_user_ips_%s" % user_id))

        for ip in user_ips:

            try:

                _set.add(ip.ip_addr)

            except ObjectDeletedError:

                # since we use heavy caching sometimes it happens that we get

                # deleted objects here, we just skip them

                pass

        return _set or set(['0.0.0.0/0', '::/0'])

def set_available_permissions(config):

    """

    This function will propagate pylons globals with all available defined

    permission given in db. We don't want to check each time from db for new

    permissions since adding a new permission also requires application restart

    ie. to decorate new views with the newly created permission

    :param config: current pylons config instance

    """

    log.info('getting information about all available permissions')

    try:

        sa = meta.Session

        all_perms = sa.query(Permission).all()

    except Exception:

        pass

    finally:

        meta.Session.remove()

    config['available_permissions'] = [x.permission_name for x in all_perms]

#==============================================================================

# CHECK DECORATORS

#==============================================================================

class LoginRequired(object):

    """

    Must be logged in to execute this function else

    redirect to login page

    :param api_access: if enabled this checks only for valid auth token

                    revs_ids[0][:12], revs_ids[-1][:12]

                ),

                url('changeset_home', repo_name=repo_name,

                    revision='%s...%s' % (revs_ids[0], revs_ids[-1])

                ),

                _('compare view')

            )

        )

        # if we have exactly one more than normally displayed

        # just display it, takes less space than displaying

        # "and 1 more revisions"

        if len(revs_ids) == revs_limit + 1:

            rev = revs[revs_limit]

            cs_links.append(", " + lnk(rev, repo_name))

        # hidden-by-default ones

        if len(revs_ids) > revs_limit + 1:

            uniq_id = revs_ids[0]

            html_tmpl = (

                '<span> %s <a class="show_more" id="_%s" '

                'href="#more">%s</a> %s</span>'

            )

            if not feed:

                cs_links.append(html_tmpl % (

                      _('and'),

                      uniq_id, _('%s more') % (len(revs_ids) - revs_limit),

                      _('revisions')

                    )

                )

            if not feed:

                html_tmpl = '<span id="%s" style="display:none">, %s </span>'

            else:

                html_tmpl = '<span id="%s"> %s </span>'

            morelinks = ', '.join(

              [lnk(rev, repo_name) for rev in revs[revs_limit:]]

            )

            if len(revs_ids) > revs_top_limit:

                morelinks += ', ...'

            cs_links.append(html_tmpl % (uniq_id, morelinks))

        if len(revs) > 1:

            cs_links.append(compare_view)

        return ''.join(cs_links)

    def get_fork_name():

        repo_name = action_params

        _url = url('summary_home', repo_name=repo_name)

        return _('fork name %s') % link_to(action_params, _url)

    def get_user_name():

        user_name = action_params

        return user_name

    def get_users_group():

        group_name = action_params

        return group_name

    def get_pull_request():

        pull_request_id = action_params

        deleted = user_log.repository is None

        if deleted:

            repo_name = user_log.repository_name

        else:

            repo_name = user_log.repository.repo_name

        return link_to(_('Pull request #%s') % pull_request_id,

                    url('pullrequest_show', repo_name=repo_name,

                    pull_request_id=pull_request_id))

    # action : translated str, callback(extractor), icon

    action_map = {

    'user_deleted_repo':           (_('[deleted] repository'),

                                    None, 'database_delete.png'),

    'user_created_repo':           (_('[created] repository'),

                                    None, 'database_add.png'),

    'user_created_fork':           (_('[created] repository as fork'),

                                    None, 'arrow_divide.png'),

    'user_forked_repo':            (_('[forked] repository'),

                                    get_fork_name, 'arrow_divide.png'),

    'user_updated_repo':           (_('[updated] repository'),

                                    None, 'database_edit.png'),

    'admin_deleted_repo':          (_('[delete] repository'),

                                    None, 'database_delete.png'),

    'admin_created_repo':          (_('[created] repository'),

                                    None, 'database_add.png'),

    'admin_forked_repo':           (_('[forked] repository'),

                                    None, 'arrow_divide.png'),

    'admin_updated_repo':          (_('[updated] repository'),

                                    None, 'database_edit.png'),

    'admin_created_user':          (_('[created] user'),

                                    get_user_name, 'user_add.png'),

    'admin_updated_user':          (_('[updated] user'),

                                    get_user_name, 'user_edit.png'),

                                    get_users_group, 'group_add.png'),

                                    get_users_group, 'group_edit.png'),

    'user_commented_revision':     (_('[commented] on revision in repository'),

                                    get_cs_links, 'comment_add.png'),

    'user_commented_pull_request': (_('[commented] on pull request for'),

                                    get_pull_request, 'comment_add.png'),

    'user_closed_pull_request':    (_('[closed] pull request for'),

                                    get_pull_request, 'tick.png'),

    'push':                        (_('[pushed] into'),

                                    get_cs_links, 'script_add.png'),

    'push_local':                  (_('[committed via RhodeCode] into repository'),

                                    get_cs_links, 'script_edit.png'),

    'push_remote':                 (_('[pulled from remote] into repository'),

                                    get_cs_links, 'connect.png'),

    'pull':                        (_('[pulled] from'),

                                    None, 'down_16.png'),

    'started_following_repo':      (_('[started following] repository'),

                                    None, 'heart_add.png'),

    'stopped_following_repo':      (_('[stopped following] repository'),

                                    None, 'heart_delete.png'),

    }

    action_str = action_map.get(action, action)

    if feed:

        action = action_str[0].replace('[', '').replace(']', '')

    else:

        action = action_str[0]\

            .replace('[', '<span class="journal_highlight">')\

            .replace(']', '</span>')

    action_params_func = lambda: ""

    if callable(action_str[1]):

        action_params_func = action_str[1]

    def action_parser_icon():

        action = user_log.action

        action_params = None

        x = action.split(':')

        if len(x) > 1:

            action, action_params = x

        tmpl = """<img src="%s%s" alt="%s"/>"""

        ico = action_map.get(action, ['', '', ''])[2]

        return literal(tmpl % ((url('/images/icons/')), ico, action))

    # returned callbacks we need to call to get

    return [lambda: literal(action), action_params_func, action_parser_icon]

#==============================================================================

# PERMS

#==============================================================================

from rhodecode.lib.auth import HasPermissionAny, HasPermissionAll, \

HasRepoPermissionAny, HasRepoPermissionAll, HasReposGroupPermissionAll, \

HasReposGroupPermissionAny

#==============================================================================

# GRAVATAR URL

#==============================================================================

def gravatar_url(email_address, size=30):

    from pylons import url  # doh, we need to re-import url to mock it later

    _def = 'anonymous@rhodecode.org'

    use_gravatar = str2bool(config['app_conf'].get('use_gravatar'))

    email_address = email_address or _def

    if (not use_gravatar or not email_address or email_address == _def):

        f = lambda a, l: min(l, key=lambda x: abs(x - a))

        return url("/images/user%s.png" % f(size, [14, 16, 20, 24, 30]))

    if use_gravatar and config['app_conf'].get('alternative_gravatar_url'):

        tmpl = config['app_conf'].get('alternative_gravatar_url', '')

        parsed_url = urlparse.urlparse(url.current(qualified=True))

        tmpl = tmpl.replace('{email}', email_address)\

                   .replace('{md5email}', hashlib.md5(email_address.lower()).hexdigest()) \

                   .replace('{netloc}', parsed_url.netloc)\

                   .replace('{scheme}', parsed_url.scheme)\

                   .replace('{size}', str(size))

        return tmpl

    ssl_enabled = 'https' == request.environ.get('wsgi.url_scheme')

    default = 'identicon'

    baseurl_nossl = "http://www.gravatar.com/avatar/"

    baseurl_ssl = "https://secure.gravatar.com/avatar/"

    baseurl = baseurl_ssl if ssl_enabled else baseurl_nossl

    if isinstance(email_address, unicode):

        #hashlib crashes on unicode items

        email_address = safe_str(email_address)

    # construct the url

    gravatar_url = baseurl + hashlib.md5(email_address.lower()).hexdigest() + "?"

    gravatar_url += urllib.urlencode({'d': default, 's': str(size)})

    return gravatar_url

        """

        owner = cur_user

        repo_name = form_data['repo_name_full']

        repo_type = form_data['repo_type']

        description = form_data['repo_description']

        private = form_data['repo_private']

        clone_uri = form_data.get('clone_uri')

        repos_group = form_data['repo_group']

        landing_rev = form_data['repo_landing_rev']

        copy_fork_permissions = form_data.get('copy_permissions')

        fork_of = form_data.get('fork_parent_id')

        ## repo creation defaults, private and repo_type are filled in form

        defs = RhodeCodeSetting.get_default_repo_settings(strip_prefix=True)

        enable_statistics = defs.get('repo_enable_statistics')

        enable_locking = defs.get('repo_enable_locking')

        enable_downloads = defs.get('repo_enable_downloads')

        return self.create_repo(

            repo_name, repo_type, description, owner, private, clone_uri,

            repos_group, landing_rev, just_db, fork_of, copy_fork_permissions,

            enable_statistics, enable_locking, enable_downloads

        )

    def create_fork(self, form_data, cur_user):

        """

        Simple wrapper into executing celery task for fork creation

        :param form_data:

        :param cur_user:

        """

        from rhodecode.lib.celerylib import tasks, run_task

        run_task(tasks.create_repo_fork, form_data, cur_user)

    def delete(self, repo):

        repo = self._get_repo(repo)

        if repo:

            old_repo_dict = repo.get_dict()

            owner = repo.user

            try:

                self.sa.delete(repo)

                self.__delete_repo(repo)

                log_delete_repository(old_repo_dict,

                                      deleted_by=owner.username)

            except:

                log.error(traceback.format_exc())

                raise

    def grant_user_permission(self, repo, user, perm):

        """

        Grant permission for user on given repository, or update existing one

        if found

        :param repo: Instance of Repository, repository_id, or repository name

        :param user: Instance of User, user_id or username

        :param perm: Instance of Permission, or permission_name

        """

        user = self._get_user(user)

        repo = self._get_repo(repo)

        permission = self._get_perm(perm)

        # check if we have that permission already

        obj = self.sa.query(UserRepoToPerm)\

            .filter(UserRepoToPerm.user == user)\

            .filter(UserRepoToPerm.repository == repo)\

            .scalar()

        if obj is None:

            # create new !

            obj = UserRepoToPerm()

        obj.repository = repo

        obj.user = user

        obj.permission = permission

        self.sa.add(obj)

        log.debug('Granted perm %s to %s on %s' % (perm, user, repo))

    def revoke_user_permission(self, repo, user):

        """

        Revoke permission for user on given repository

        :param repo: Instance of Repository, repository_id, or repository name

        :param user: Instance of User, user_id or username

        """

        user = self._get_user(user)

        repo = self._get_repo(repo)

        obj = self.sa.query(UserRepoToPerm)\

            .filter(UserRepoToPerm.repository == repo)\

            .filter(UserRepoToPerm.user == user)\

            .scalar()

        if obj:

            self.sa.delete(obj)

            log.debug('Revoked perm on %s on %s' % (repo, user))

    def grant_users_group_permission(self, repo, group_name, perm):

        """

        existing one if found

        :param repo: Instance of Repository, repository_id, or repository name

        :param group_name: Instance of UserGroup, users_group_id,

        :param perm: Instance of Permission, or permission_name

        """

        repo = self._get_repo(repo)

        group_name = self.__get_users_group(group_name)

        permission = self._get_perm(perm)

        # check if we have that permission already

        obj = self.sa.query(UsersGroupRepoToPerm)\

            .filter(UsersGroupRepoToPerm.users_group == group_name)\

            .filter(UsersGroupRepoToPerm.repository == repo)\

            .scalar()

        if obj is None:

            # create new

            obj = UsersGroupRepoToPerm()

        obj.repository = repo

        obj.users_group = group_name

        obj.permission = permission

        self.sa.add(obj)

        log.debug('Granted perm %s to %s on %s' % (perm, group_name, repo))

    def revoke_users_group_permission(self, repo, group_name):

        """

        :param repo: Instance of Repository, repository_id, or repository name

        :param group_name: Instance of UserGroup, users_group_id,

        """

        repo = self._get_repo(repo)

        group_name = self.__get_users_group(group_name)

        obj = self.sa.query(UsersGroupRepoToPerm)\

            .filter(UsersGroupRepoToPerm.repository == repo)\

            .filter(UsersGroupRepoToPerm.users_group == group_name)\

            .scalar()

        if obj:

            self.sa.delete(obj)

            log.debug('Revoked perm to %s on %s' % (repo, group_name))

    def delete_stats(self, repo_name):

        """

        removes stats for given repo

        :param repo_name:

        """

        repo = self._get_repo(repo_name)

        try:

            obj = self.sa.query(Statistics)\

                    .filter(Statistics.repository == repo).scalar()

            if obj:

                self.sa.delete(obj)

        except:

            log.error(traceback.format_exc())

            raise

    def __create_repo(self, repo_name, alias, parent, clone_uri=False):

        """

        makes repository on filesystem. It's group aware means it'll create

        a repository within a group, and alter the paths accordingly of

        group location

        :param repo_name:

        :param alias:

        :param parent_id:

        :param clone_uri:

        """

        from rhodecode.lib.utils import is_valid_repo, is_valid_repos_group

        from rhodecode.model.scm import ScmModel

        if parent:

            new_parent_path = os.sep.join(parent.full_path_splitted)

        else:

            new_parent_path = ''

        # we need to make it str for mercurial

        repo_path = os.path.join(*map(lambda x: safe_str(x),

                                [self.repos_path, new_parent_path, repo_name]))

        # check if this path is not a repository

        if is_valid_repo(repo_path, self.repos_path):

            raise Exception('This path %s is a valid repository' % repo_path)

        # check if this path is a group

        if is_valid_repos_group(repo_path, self.repos_path):

            raise Exception('This path %s is a valid group' % repo_path)

        log.info('creating repo %s in %s @ %s' % (

                     repo_name, safe_unicode(repo_path), clone_uri

                )

        )

        backend = get_backend(alias)

        if alias == 'hg':

            backend(repo_path, create=True, src_url=clone_uri)

        elif alias == 'git':

            r = backend(repo_path, create=True, src_url=clone_uri, bare=True)

            # add rhodecode hook into this repo

            ScmModel().install_git_hook(repo=r)

        else:

            raise Exception('Undefined alias %s' % alias)

    def __rename_repo(self, old, new):

        """

        renames repository on filesystem

        :param old: old name

        :param new: new name

        """

        log.info('renaming repo from %s to %s' % (old, new))

        old_path = os.path.join(self.repos_path, old)

        new_path = os.path.join(self.repos_path, new)

        if os.path.isdir(new_path):

            raise Exception(

                'Was trying to rename to already existing dir %s' % new_path

            )

        shutil.move(old_path, new_path)

    def __delete_repo(self, repo):

        """

        removes repo from filesystem, the removal is acctually made by

        added rm__ prefix into dir, and rename internat .hg/.git dirs so this

        repository is no longer valid for rhodecode, can be undeleted later on

        by reverting the renames on this repository

            explicitly override permissions from group, if it's False it will

            make decision based on the algo

        :param algo: algorithm to decide what permission should be choose if

            it's multiple defined, eg user in two different groups. It also

            decides if explicit flag is turned off how to specify the permission

            for case when user is in a group + have defined separate permission

        """

        RK = 'repositories'

        GK = 'repositories_groups'

        GLOBAL = 'global'

        user.permissions[RK] = {}

        user.permissions[GK] = {}

        user.permissions[GLOBAL] = set()

        def _choose_perm(new_perm, cur_perm):

            new_perm_val = PERM_WEIGHTS[new_perm]

            cur_perm_val = PERM_WEIGHTS[cur_perm]

            if algo == 'higherwin':

                if new_perm_val > cur_perm_val:

                    return new_perm

                return cur_perm

            elif algo == 'lowerwin':

                if new_perm_val < cur_perm_val:

                    return new_perm

                return cur_perm

        #======================================================================

        # fetch default permissions

        #======================================================================

        default_user = User.get_by_username('default', cache=True)

        default_user_id = default_user.user_id

        default_repo_perms = Permission.get_default_perms(default_user_id)

        default_repo_groups_perms = Permission.get_default_group_perms(default_user_id)

        if user.is_admin:

            #==================================================================

            # admin user have all default rights for repositories

            # and groups set to admin

            #==================================================================

            user.permissions[GLOBAL].add('hg.admin')

            # repositories

            for perm in default_repo_perms:

                r_k = perm.UserRepoToPerm.repository.repo_name

                p = 'repository.admin'

                user.permissions[RK][r_k] = p

            # repository groups

            for perm in default_repo_groups_perms:

                rg_k = perm.UserRepoGroupToPerm.group.group_name

                p = 'group.admin'

                user.permissions[GK][rg_k] = p

            return user

        #==================================================================

        # SET DEFAULTS GLOBAL, REPOS, REPOS GROUPS

        #==================================================================

        uid = user.user_id

        # default global permissions taken fron the default user

        default_global_perms = self.sa.query(UserToPerm)\

            .filter(UserToPerm.user_id == default_user_id)

        for perm in default_global_perms:

            user.permissions[GLOBAL].add(perm.permission.permission_name)

        # defaults for repositories, taken from default user

        for perm in default_repo_perms:

            r_k = perm.UserRepoToPerm.repository.repo_name

            if perm.Repository.private and not (perm.Repository.user_id == uid):

                # disable defaults for private repos,

                p = 'repository.none'

            elif perm.Repository.user_id == uid:

                # set admin if owner

                p = 'repository.admin'

            else:

                p = perm.Permission.permission_name

            user.permissions[RK][r_k] = p

        # defaults for repository groups taken from default user permission

        # on given group

        for perm in default_repo_groups_perms:

            rg_k = perm.UserRepoGroupToPerm.group.group_name

            p = perm.Permission.permission_name

            user.permissions[GK][rg_k] = p

        #======================================================================

        # !! OVERRIDE GLOBALS !! with user permissions if any found

        #======================================================================

        # those can be configured from groups or users explicitly

        _configurable = set(['hg.fork.none', 'hg.fork.repository',

                             'hg.create.none', 'hg.create.repository'])

        # USER GROUPS comes first

        user_perms_from_users_groups = self.sa.query(UsersGroupToPerm)\

            .options(joinedload(UsersGroupToPerm.permission))\

            .join((UsersGroupMember, UsersGroupToPerm.users_group_id ==

                   UsersGroupMember.users_group_id))\

            .filter(UsersGroupMember.user_id == uid)\

            .order_by(UsersGroupToPerm.users_group_id)\

            .all()

        #need to group here by groups since user can be in more than one group

        _grouped = [[x, list(y)] for x, y in

                    itertools.groupby(user_perms_from_users_groups,

                                      lambda x:x.users_group)]

        for gr, perms in _grouped:

            # since user can be in multiple groups iterate over them and

            # select the lowest permissions first (more explicit)

            ##TODO: do this^^

            if not gr.inherit_default_permissions:

                # NEED TO IGNORE all configurable permissions and

                # replace them with explicitly set

                user.permissions[GLOBAL] = user.permissions[GLOBAL]\

                                                .difference(_configurable)

            for perm in perms:

                user.permissions[GLOBAL].add(perm.permission.permission_name)

        # user specific global permissions

        user_perms = self.sa.query(UserToPerm)\

                .options(joinedload(UserToPerm.permission))\

                .filter(UserToPerm.user_id == uid).all()

        if not user.inherit_default_permissions:

            # NEED TO IGNORE all configurable permissions and

            # replace them with explicitly set

            user.permissions[GLOBAL] = user.permissions[GLOBAL]\

                                            .difference(_configurable)

            for perm in user_perms:

                user.permissions[GLOBAL].add(perm.permission.permission_name)

        #======================================================================

        # !! PERMISSIONS FOR REPOSITORIES !!

        #======================================================================

        #======================================================================

        # check if user is part of user groups for this repository and

        # fill in his permission from it. _choose_perm decides of which

        # permission should be selected based on selected method

        #======================================================================

        user_repo_perms_from_users_groups = \

         self.sa.query(UsersGroupRepoToPerm, Permission, Repository,)\

            .join((Repository, UsersGroupRepoToPerm.repository_id ==

                   Repository.repo_id))\

            .join((Permission, UsersGroupRepoToPerm.permission_id ==

                   Permission.permission_id))\

            .join((UsersGroupMember, UsersGroupRepoToPerm.users_group_id ==

                   UsersGroupMember.users_group_id))\

            .filter(UsersGroupMember.user_id == uid)\

            .all()

        multiple_counter = collections.defaultdict(int)

        for perm in user_repo_perms_from_users_groups:

            r_k = perm.UsersGroupRepoToPerm.repository.repo_name

            multiple_counter[r_k] += 1

            p = perm.Permission.permission_name

            cur_perm = user.permissions[RK][r_k]

            if perm.Repository.user_id == uid:

                # set admin if owner

                p = 'repository.admin'

            else:

                if multiple_counter[r_k] > 1:

                    p = _choose_perm(p, cur_perm)

            user.permissions[RK][r_k] = p

        # user explicit permissions for repositories, overrides any specified

        # by the group permission

        user_repo_perms = \

         self.sa.query(UserRepoToPerm, Permission, Repository)\

            .join((Repository, UserRepoToPerm.repository_id ==

                   Repository.repo_id))\

            .join((Permission, UserRepoToPerm.permission_id ==

                   Permission.permission_id))\

            .filter(UserRepoToPerm.user_id == uid)\

            .all()

        for perm in user_repo_perms:

            r_k = perm.UserRepoToPerm.repository.repo_name

            cur_perm = user.permissions[RK][r_k]

            # set admin if owner

            if perm.Repository.user_id == uid:

                p = 'repository.admin'

            else:

                p = perm.Permission.permission_name

                if not explicit:

                    p = _choose_perm(p, cur_perm)

            user.permissions[RK][r_k] = p

        #======================================================================

        # !! PERMISSIONS FOR REPOSITORY GROUPS !!

        #======================================================================

        #======================================================================

        # check if user is part of user groups for this repository groups and

        # fill in his permission from it. _choose_perm decides of which

        # permission should be selected based on selected method

        #======================================================================

        user_repo_group_perms_from_users_groups = \

         self.sa.query(UsersGroupRepoGroupToPerm, Permission, RepoGroup)\

         .join((RepoGroup, UsersGroupRepoGroupToPerm.group_id == RepoGroup.group_id))\

         .join((Permission, UsersGroupRepoGroupToPerm.permission_id

                == Permission.permission_id))\

         .join((UsersGroupMember, UsersGroupRepoGroupToPerm.users_group_id

                == UsersGroupMember.users_group_id))\

         .filter(UsersGroupMember.user_id == uid)\

         .all()

        multiple_counter = collections.defaultdict(int)

        for perm in user_repo_group_perms_from_users_groups:

            g_k = perm.UsersGroupRepoGroupToPerm.group.group_name

            multiple_counter[g_k] += 1

            p = perm.Permission.permission_name

            cur_perm = user.permissions[GK][g_k]

            if multiple_counter[g_k] > 1:

                p = _choose_perm(p, cur_perm)

            user.permissions[GK][g_k] = p

        # user explicit permissions for repository groups

        user_repo_groups_perms = \

         self.sa.query(UserRepoGroupToPerm, Permission, RepoGroup)\

         .join((RepoGroup, UserRepoGroupToPerm.group_id == RepoGroup.group_id))\

         .join((Permission, UserRepoGroupToPerm.permission_id

                == Permission.permission_id))\

         .filter(UserRepoGroupToPerm.user_id == uid)\

         .all()