"""

import time

import logging

import traceback

import formencode

from formencode import htmlfill

from pylons import request, response, tmpl_context as c, url

from pylons.controllers.util import abort, redirect

from pylons.i18n.translation import _

from kallithea.model.forms import GistForm

from kallithea.model.gist import GistModel

from kallithea.model.meta import Session

from kallithea.model.db import Gist, User

from kallithea.lib import helpers as h

from kallithea.lib.base import BaseController, render

from kallithea.lib.auth import LoginRequired, NotAnonymous

from kallithea.lib.utils import jsonify

from kallithea.lib.utils2 import safe_str, safe_int, time_to_datetime

from kallithea.lib.helpers import Page

from webob.exc import HTTPNotFound, HTTPForbidden

from sqlalchemy.sql.expression import or_

from kallithea.lib.vcs.exceptions import VCSError, NodeNotChangedError

log = logging.getLogger(__name__)

class GistsController(BaseController):

    """REST Controller styled on the Atom Publishing Protocol"""

    def __load_defaults(self, extra_values=None):

        c.lifetime_values = [

            (str(-1), _('forever')),

            (str(5), _('5 minutes')),

            (str(60), _('1 hour')),

            (str(60 * 24), _('1 day')),

            (str(60 * 24 * 30), _('1 month')),

        ]

        if extra_values:

            c.lifetime_values.append(extra_values)

        c.lifetime_options = [(c.lifetime_values, _("Lifetime"))]

    @LoginRequired()

    def index(self):

        """GET /admin/gists: All items in the collection"""

        # url('gists')

        c.show_private = request.GET.get('private') and not_default_user

        c.show_public = request.GET.get('public') and not_default_user

        gists = Gist().query()\

            .filter(or_(Gist.gist_expires == -1, Gist.gist_expires >= time.time()))\

            .order_by(Gist.created_on.desc())

        # MY private

        if c.show_private and not c.show_public:

            gists = gists.filter(Gist.gist_type == Gist.GIST_PRIVATE)\

        # MY public

        elif c.show_public and not c.show_private:

            gists = gists.filter(Gist.gist_type == Gist.GIST_PUBLIC)\

        # MY public+private

        elif c.show_private and c.show_public:

            gists = gists.filter(or_(Gist.gist_type == Gist.GIST_PUBLIC,

                                     Gist.gist_type == Gist.GIST_PRIVATE))\

        # default show ALL public gists

        if not c.show_public and not c.show_private:

            gists = gists.filter(Gist.gist_type == Gist.GIST_PUBLIC)

        c.gists = gists

        p = safe_int(request.GET.get('page', 1), 1)

        c.gists_pager = Page(c.gists, page=p, items_per_page=10)

        return render('admin/gists/index.html')

    @LoginRequired()

    @NotAnonymous()

    def create(self):

        """POST /admin/gists: Create a new item"""

        # url('gists')

        self.__load_defaults()

        gist_form = GistForm([x[0] for x in c.lifetime_values])()

        try:

            form_result = gist_form.to_python(dict(request.POST))

            #TODO: multiple files support, from the form

            filename = form_result['filename'] or Gist.DEFAULT_FILENAME

            nodes = {

                filename: {

                    'content': form_result['content'],

                    'lexer': form_result['mimetype']  # None is autodetect

                }

            }

            _public = form_result['public']

            gist_type = Gist.GIST_PUBLIC if _public else Gist.GIST_PRIVATE

            gist = GistModel().create(

                description=form_result['description'],

                gist_mapping=nodes,

                gist_type=gist_type,

                lifetime=form_result['lifetime']

            )

            Session().commit()

            new_gist_id = gist.gist_access_id

        except formencode.Invalid, errors:

            defaults = errors.value

            return formencode.htmlfill.render(

                render('admin/gists/new.html'),

                defaults=defaults,

                errors=errors.error_dict or {},

                prefix_error=False,

                encoding="UTF-8"

            )

        except Exception, e:

            log.error(traceback.format_exc())

            h.flash(_('Error occurred during gist creation'), category='error')

            return redirect(url('new_gist'))

        return redirect(url('gist', gist_id=new_gist_id))

    @LoginRequired()

    @NotAnonymous()

    def new(self, format='html'):

        """GET /admin/gists/new: Form to create a new item"""

        # url('new_gist')

        self.__load_defaults()

        return render('admin/gists/new.html')

    @LoginRequired()

    @NotAnonymous()

    def update(self, gist_id):

        """PUT /admin/gists/gist_id: Update an existing item"""

        # Forms posted to this method should contain a hidden field:

        #    <input type="hidden" name="_method" value="PUT" />

        # Or using helpers:

        #    h.form(url('gist', gist_id=ID),

        #           method='put')

        # url('gist', gist_id=ID)

    @LoginRequired()

    @NotAnonymous()

    def delete(self, gist_id):

        """DELETE /admin/gists/gist_id: Delete an existing item"""

        # Forms posted to this method should contain a hidden field:

        #    <input type="hidden" name="_method" value="DELETE" />

        # Or using helpers:

        #    h.form(url('gist', gist_id=ID),

        #           method='delete')

        # url('gist', gist_id=ID)

        gist = GistModel().get_gist(gist_id)

        if h.HasPermissionAny('hg.admin')() or owner:

            GistModel().delete(gist)

            Session().commit()

            h.flash(_('Deleted gist %s') % gist.gist_access_id, category='success')

        else:

            raise HTTPForbidden()

        return redirect(url('gists'))

    @LoginRequired()

    def show(self, gist_id, revision='tip', format='html', f_path=None):

        """GET /admin/gists/gist_id: Show a specific item"""

        # url('gist', gist_id=ID)

        c.gist = Gist.get_or_404(gist_id)

        #check if this gist is not expired

        if c.gist.gist_expires != -1:

            if time.time() > c.gist.gist_expires:

                log.error('Gist expired at %s' %

                          (time_to_datetime(c.gist.gist_expires)))

                raise HTTPNotFound()

        try:

            c.file_changeset, c.files = GistModel().get_gist_files(gist_id,

                                                            revision=revision)

        except VCSError:

            log.error(traceback.format_exc())

            raise HTTPNotFound()

        if format == 'raw':

            content = '\n\n'.join([f.content for f in c.files if (f_path is None or f.path == f_path)])

            response.content_type = 'text/plain'

            return content

        return render('admin/gists/show.html')

    @LoginRequired()

    @NotAnonymous()

    def edit(self, gist_id, format='html'):

        """GET /admin/gists/gist_id/edit: Form to edit an existing item"""

        # url('edit_gist', gist_id=ID)

        c.gist = Gist.get_or_404(gist_id)

        #check if this gist is not expired

        if c.gist.gist_expires != -1:

            if time.time() > c.gist.gist_expires:

                log.error('Gist expired at %s' %

                          (time_to_datetime(c.gist.gist_expires)))

                raise HTTPNotFound()

        try:

            c.file_changeset, c.files = GistModel().get_gist_files(gist_id)

my account controller for rhodecode admin

:created_on: August 20, 2013

:author: marcink

:copyright: (c) 2013 RhodeCode GmbH.

:license: GPLv3, see LICENSE for more details.

"""

import time

import logging

import traceback

import formencode

from sqlalchemy import func, or_

from formencode import htmlfill

from pylons import request, tmpl_context as c, url

from pylons.controllers.util import redirect

from pylons.i18n.translation import _

from kallithea.lib import helpers as h

from kallithea.lib.auth import LoginRequired, NotAnonymous, AuthUser

from kallithea.lib.base import BaseController, render

from kallithea.lib.utils2 import generate_api_key, safe_int

from kallithea.lib.compat import json

from kallithea.model.db import Repository, PullRequest, PullRequestReviewers, \

    UserEmailMap, UserApiKeys, User, UserFollowing

from kallithea.model.forms import UserForm, PasswordChangeForm

from kallithea.model.user import UserModel

from kallithea.model.repo import RepoModel

from kallithea.model.api_key import ApiKeyModel

from kallithea.model.meta import Session

log = logging.getLogger(__name__)

class MyAccountController(BaseController):

    """REST Controller styled on the Atom Publishing Protocol"""

    # To properly map this controller, ensure your config/routing.py

    # file has a resource setup:

    #     map.resource('setting', 'settings', controller='admin/settings',

    #         path_prefix='/admin', name_prefix='admin_')

    @LoginRequired()

    @NotAnonymous()

    def __before__(self):

        super(MyAccountController, self).__before__()

    def __load_data(self):

        if c.user.username == User.DEFAULT_USER:

            h.flash(_("You can't edit this user since it's"

                      " crucial for entire application"), category='warning')

            return redirect(url('users'))

    def _load_my_repos_data(self, watched=False):

        if watched:

            admin = False

            repos_list = [x.follows_repository for x in

                          Session().query(UserFollowing).filter(

                              UserFollowing.user_id ==

        else:

            admin = True

            repos_list = Session().query(Repository)\

                         .filter(Repository.user_id ==

                         .order_by(func.lower(Repository.repo_name)).all()

        repos_data = RepoModel().get_repos_as_dict(repos_list=repos_list,

                                                   admin=admin)

        #json used to render the grid

        return json.dumps(repos_data)

    def my_account(self):

        """

        GET /_admin/my_account Displays info about my account

        """

        # url('my_account')

        c.active = 'profile'

        self.__load_data()

                               ip_addr=self.ip_addr)

        c.extern_type = c.user.extern_type

        c.extern_name = c.user.extern_name

        defaults = c.user.get_dict()

        update = False

        if request.POST:

            _form = UserForm(edit=True,

            form_result = {}

            try:

                post_data = dict(request.POST)

                post_data['new_password'] = ''

                post_data['password_confirmation'] = ''

                form_result = _form.to_python(post_data)

                # skip updating those attrs for my account

                skip_attrs = ['admin', 'active', 'extern_type', 'extern_name',

                              'new_password', 'password_confirmation']

                #TODO: plugin should define if username can be updated

                if c.extern_type != "rhodecode":

                    # forbid updating username for external accounts

                    skip_attrs.append('username')

                                   skip_attrs=skip_attrs)

                h.flash(_('Your account was updated successfully'),

                        category='success')

                Session().commit()

                update = True

            except formencode.Invalid, errors:

                return htmlfill.render(

                    render('admin/my_account/my_account.html'),

                    defaults=errors.value,

                    errors=errors.error_dict or {},

                    prefix_error=False,

                    encoding="UTF-8")

            except Exception:

                log.error(traceback.format_exc())

                h.flash(_('Error occurred during update of user %s') \

                        % form_result.get('username'), category='error')

        if update:

            return redirect('my_account')

        return htmlfill.render(

            render('admin/my_account/my_account.html'),

            defaults=defaults,

            encoding="UTF-8",

            force_defaults=False

        )

    def my_account_password(self):

        c.active = 'password'

        self.__load_data()

        if request.POST:

            try:

                form_result = _form.to_python(request.POST)

                Session().commit()

                h.flash(_("Successfully updated password"), category='success')

            except formencode.Invalid as errors:

                return htmlfill.render(

                    render('admin/my_account/my_account.html'),

                    defaults=errors.value,

                    errors=errors.error_dict or {},

                    prefix_error=False,

                    encoding="UTF-8")

            except Exception:

                log.error(traceback.format_exc())

                h.flash(_('Error occurred during update of user password'),

                        category='error')

        return render('admin/my_account/my_account.html')

    def my_account_repos(self):

        c.active = 'repos'

        self.__load_data()

        #json used to render the grid

        c.data = self._load_my_repos_data()

        return render('admin/my_account/my_account.html')

    def my_account_watched(self):

        c.active = 'watched'

        self.__load_data()

        #json used to render the grid

        c.data = self._load_my_repos_data(watched=True)

        return render('admin/my_account/my_account.html')

    def my_account_perms(self):

        c.active = 'perms'

        self.__load_data()

                               ip_addr=self.ip_addr)

        return render('admin/my_account/my_account.html')

    def my_account_emails(self):

        c.active = 'emails'

        self.__load_data()

        c.user_email_map = UserEmailMap.query()\

            .filter(UserEmailMap.user == c.user).all()

        return render('admin/my_account/my_account.html')

    def my_account_emails_add(self):

        email = request.POST.get('new_email')

        try:

            Session().commit()

            h.flash(_("Added email %s to user") % email, category='success')

        except formencode.Invalid, error:

            msg = error.error_dict['email']

            h.flash(msg, category='error')

        except Exception:

            log.error(traceback.format_exc())

            h.flash(_('An error occurred during email saving'),

                    category='error')

        return redirect(url('my_account_emails'))

    def my_account_emails_delete(self):

        email_id = request.POST.get('del_email_id')

        user_model = UserModel()

        Session().commit()

        h.flash(_("Removed email from user"), category='success')

        return redirect(url('my_account_emails'))

    def my_account_pullrequests(self):

        c.active = 'pullrequests'

        self.__load_data()

        c.show_closed = request.GET.get('pr_show_closed')

        def _filter(pr):

            s = sorted(pr, key=lambda o: o.created_on, reverse=True)

            if not c.show_closed:

                s = filter(lambda p: p.status != PullRequest.STATUS_CLOSED, s)

            return s

        c.my_pull_requests = _filter(PullRequest.query()\

                                .filter(PullRequest.user_id ==

                                .all())

        my_prs = [x.pull_request for x in PullRequestReviewers.query()

                    .filter(PullRequestReviewers.user_id ==

        c.participate_in_pull_requests = _filter(my_prs)

        return render('admin/my_account/my_account.html')

    def my_account_api_keys(self):

        c.active = 'api_keys'

        self.__load_data()

        show_expired = True

        c.lifetime_values = [

            (str(-1), _('forever')),

            (str(5), _('5 minutes')),

            (str(60), _('1 hour')),

            (str(60 * 24), _('1 day')),

            (str(60 * 24 * 30), _('1 month')),

        ]

        c.lifetime_options = [(c.lifetime_values, _("Lifetime"))]

                                                     show_expired=show_expired)

        return render('admin/my_account/my_account.html')

    def my_account_api_keys_add(self):

        lifetime = safe_int(request.POST.get('lifetime'), -1)

        description = request.POST.get('description')

                                           description, lifetime)

        Session().commit()

        h.flash(_("Api key successfully created"), category='success')

        return redirect(url('my_account_api_keys'))

    def my_account_api_keys_delete(self):

        api_key = request.POST.get('del_api_key')

        if request.POST.get('del_api_key_builtin'):

            user = User.get(user_id)

            if user:

                user.api_key = generate_api_key(user.username)

                Session().add(user)

                Session().commit()

                h.flash(_("Api key successfully reset"), category='success')

        elif api_key:

            Session().commit()

            h.flash(_("Api key successfully deleted"), category='success')

        return redirect(url('my_account_api_keys'))

"""

kallithea.controllers.admin.notifications

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

notifications controller for RhodeCode

:created_on: Nov 23, 2010

:author: marcink

:copyright: (c) 2013 RhodeCode GmbH.

:license: GPLv3, see LICENSE for more details.

"""

import logging

import traceback

from pylons import request

from pylons import tmpl_context as c, url

from pylons.controllers.util import redirect, abort

from webob.exc import HTTPBadRequest

from kallithea.model.db import Notification

from kallithea.model.notification import NotificationModel

from kallithea.model.meta import Session

from kallithea.lib.auth import LoginRequired, NotAnonymous

from kallithea.lib.base import BaseController, render

from kallithea.lib import helpers as h

from kallithea.lib.helpers import Page

from kallithea.lib.utils2 import safe_int

log = logging.getLogger(__name__)

class NotificationsController(BaseController):

    """REST Controller styled on the Atom Publishing Protocol"""

    # To properly map this controller, ensure your config/routing.py

    # file has a resource setup:

    #     map.resource('notification', 'notifications', controller='_admin/notifications',

    #         path_prefix='/_admin', name_prefix='_admin_')

    @LoginRequired()

    @NotAnonymous()

    def __before__(self):

        super(NotificationsController, self).__before__()

    def index(self, format='html'):

        """GET /_admin/notifications: All items in the collection"""

        # url('notifications')

                                            filter_=request.GET.getall('type'))

        p = safe_int(request.GET.get('page', 1), 1)

        c.notifications = Page(notif, page=p, items_per_page=10)

        c.pull_request_type = Notification.TYPE_PULL_REQUEST

        c.comment_type = [Notification.TYPE_CHANGESET_COMMENT,

                          Notification.TYPE_PULL_REQUEST_COMMENT]

        _current_filter = request.GET.getall('type')

        c.current_filter = 'all'

        if _current_filter == [c.pull_request_type]:

            c.current_filter = 'pull_request'

        elif _current_filter == c.comment_type:

            c.current_filter = 'comment'

        return render('admin/notifications/notifications.html')

    def mark_all_read(self):

        if request.environ.get('HTTP_X_PARTIAL_XHR'):

            nm = NotificationModel()

            # mark all read

                                      filter_=request.GET.getall('type'))

            Session().commit()

                                    filter_=request.GET.getall('type'))

            c.notifications = Page(notif, page=1, items_per_page=10)

            return render('admin/notifications/notifications_data.html')

    def create(self):

        """POST /_admin/notifications: Create a new item"""

        # url('notifications')

    def new(self, format='html'):

        """GET /_admin/notifications/new: Form to create a new item"""

        # url('new_notification')

    def update(self, notification_id):

        """PUT /_admin/notifications/id: Update an existing item"""

        # Forms posted to this method should contain a hidden field:

        #    <input type="hidden" name="_method" value="PUT" />

        # Or using helpers:

        #    h.form(url('notification', notification_id=ID),

        #           method='put')

        # url('notification', notification_id=ID)

        try:

            no = Notification.get(notification_id)

                        for un in no.notifications_to_users)

            if h.HasPermissionAny('hg.admin')() or owner:

                # deletes only notification2user

                Session().commit()

                return 'ok'

        except Exception:

            Session().rollback()

            log.error(traceback.format_exc())

        raise HTTPBadRequest()

    def delete(self, notification_id):

        """DELETE /_admin/notifications/id: Delete an existing item"""

        # Forms posted to this method should contain a hidden field:

        #    <input type="hidden" name="_method" value="DELETE" />

        # Or using helpers:

        #    h.form(url('notification', notification_id=ID),

        #           method='delete')

        # url('notification', notification_id=ID)

        try:

            no = Notification.get(notification_id)

                        for un in no.notifications_to_users)

            if h.HasPermissionAny('hg.admin')() or owner:

                # deletes only notification2user

                Session().commit()

                return 'ok'

        except Exception:

            Session().rollback()

            log.error(traceback.format_exc())

        raise HTTPBadRequest()

    def show(self, notification_id, format='html'):

        """GET /_admin/notifications/id: Show a specific item"""

        # url('notification', notification_id=ID)

        no = Notification.get(notification_id)

                    for un in no.notifications_to_users)

        repo_admin = h.HasRepoPermissionAny('repository.admin')

        if no and (h.HasPermissionAny('hg.admin')() or repo_admin or owner):

            unotification = NotificationModel()\

                            .get_user_notification(c.user.user_id, no)

            # if this association to user is not valid, we don't want to show

            # this message

            if unotification:

                if not unotification.read:

                    unotification.mark_as_read()

                    Session().commit()

                c.notification = no

                return render('admin/notifications/show_notification.html')

        return abort(403)

    def edit(self, notification_id, format='html'):

        """GET /_admin/notifications/id/edit: Form to edit an existing item"""

        # url('edit_notification', notification_id=ID)

    """REST Controller styled on the Atom Publishing Protocol"""

    @LoginRequired()

    def __before__(self):

        super(RepoGroupsController, self).__before__()

    def __load_defaults(self, allow_empty_group=False, exclude_group_ids=[]):

        if HasPermissionAll('hg.admin')('group edit'):

            #we're global admin, we're ok and we can create TOP level groups

            allow_empty_group = True

        #override the choices for this form, we need to filter choices

        #and display only those we have ADMIN right

        groups_with_admin_rights = RepoGroupList(RepoGroup.query().all(),

                                                 perm_set=['group.admin'])

        c.repo_groups = RepoGroup.groups_choices(groups=groups_with_admin_rights,

                                                 show_empty_group=allow_empty_group)

        # exclude filtered ids

        c.repo_groups = filter(lambda x: x[0] not in exclude_group_ids,

                               c.repo_groups)

        c.repo_groups_choices = map(lambda k: unicode(k[0]), c.repo_groups)

        repo_model = RepoModel()

        c.users_array = repo_model.get_users_js()

        c.user_groups_array = repo_model.get_user_groups_js()

    def __load_data(self, group_id):

        """

        Load defaults settings for edit, and update

        :param group_id:

        """

        repo_group = RepoGroup.get_or_404(group_id)

        data = repo_group.get_dict()

        data['group_name'] = repo_group.name

        # fill repository group users

        for p in repo_group.repo_group_to_perm:

            data.update({'u_perm_%s' % p.user.username:

                             p.permission.permission_name})

        # fill repository group groups

        for p in repo_group.users_group_to_perm:

            data.update({'g_perm_%s' % p.users_group.users_group_name:

                             p.permission.permission_name})

        return data

    def _revoke_perms_on_yourself(self, form_result):

                     form_result['perms_updates'])

                      form_result['perms_new'])

        if _new and _new[0][1] != 'group.admin' or _up and _up[0][1] != 'group.admin':

            return True

        return False

    def index(self, format='html'):

        """GET /repo_groups: All items in the collection"""

        # url('repos_groups')

        _list = RepoGroup.query()\

                    .order_by(func.lower(RepoGroup.group_name))\

                    .all()

        group_iter = RepoGroupList(_list, perm_set=['group.admin'])

        repo_groups_data = []

        total_records = len(group_iter)

        _tmpl_lookup = kallithea.CONFIG['pylons.app_globals'].mako_lookup

        template = _tmpl_lookup.get_template('data_table/_dt_elements.html')

        repo_group_name = lambda repo_group_name, children_groups: (

            template.get_def("repo_group_name")

            .render(repo_group_name, children_groups, _=_, h=h, c=c)

        )

        repo_group_actions = lambda repo_group_id, repo_group_name, gr_count: (

            template.get_def("repo_group_actions")

            .render(repo_group_id, repo_group_name, gr_count, _=_, h=h, c=c,

                    ungettext=ungettext)

        )

        for repo_gr in group_iter:

            children_groups = map(h.safe_unicode,

                itertools.chain((g.name for g in repo_gr.parents),

                                (x.name for x in [repo_gr])))

            repo_count = repo_gr.repositories.count()

            repo_groups_data.append({

                "raw_name": repo_gr.group_name,

                "group_name": repo_group_name(repo_gr.group_name, children_groups),

                "desc": repo_gr.group_description,

                "repos": repo_count,

                "owner": h.person(repo_gr.user.username),

                "action": repo_group_actions(repo_gr.group_id, repo_gr.group_name,

                                             repo_count)

            })

        c.data = json.dumps({

            "totalRecords": total_records,

            "startIndex": 0,

            "sort": None,

            "dir": "asc",

            "records": repo_groups_data

        })

        return render('admin/repo_groups/repo_groups.html')

    def create(self):

        """POST /repo_groups: Create a new item"""

        # url('repos_groups')

        self.__load_defaults()

        # permissions for can create group based on parent_id are checked

        # here in the Form

        repo_group_form = RepoGroupForm(available_groups=

                                map(lambda k: unicode(k[0]), c.repo_groups))()

        try:

            form_result = repo_group_form.to_python(dict(request.POST))

            RepoGroupModel().create(

                group_name=form_result['group_name'],

                group_description=form_result['group_description'],

                parent=form_result['group_parent_id'],

                copy_permissions=form_result['group_copy_permissions']

            )

            Session().commit()

            h.flash(_('Created repository group %s') \

                    % form_result['group_name'], category='success')

            #TODO: in futureaction_logger(, '', '', '', self.sa)

        except formencode.Invalid, errors:

            return htmlfill.render(

                render('admin/repo_groups/repo_group_add.html'),

                defaults=errors.value,

                errors=errors.error_dict or {},

                prefix_error=False,

                encoding="UTF-8")

        except Exception:

            log.error(traceback.format_exc())

            h.flash(_('Error occurred during creation of repository group %s') \

                    % request.POST.get('group_name'), category='error')

        parent_group_id = form_result['group_parent_id']

        #TODO: maybe we should get back to the main view, not the admin one

        return redirect(url('repos_groups', parent_group=parent_group_id))

    def new(self):

        """GET /repo_groups/new: Form to create a new item"""

        # url('new_repos_group')

        if HasPermissionAll('hg.admin')('group create'):

            #we're global admin, we're ok and we can create TOP level groups

            pass

        else:

            # we pass in parent group into creation form, thus we know

            # what would be the group, we can check perms here !

            group_id = safe_int(request.GET.get('parent_group'))

            group = RepoGroup.get(group_id) if group_id else None

            group_name = group.group_name if group else None

            if HasRepoGroupPermissionAll('group.admin')(group_name, 'group create'):