@HasPermissionAllDecorator('hg.admin')

    def __before__(self):

        super(AuthSettingsController, self).__before__()

    def __load_defaults(self):

        c.available_plugins = [

            'kallithea.lib.auth_modules.auth_container',

            'kallithea.lib.auth_modules.auth_ldap',

            'kallithea.lib.auth_modules.auth_crowd',

        ]

        c.enabled_plugins = Setting.get_auth_plugins()

    def index(self, defaults=None, errors=None, prefix_error=False):

        self.__load_defaults()

        _defaults = {}

        # default plugins loaded

        formglobals = {

        }

        formglobals.update(Setting.get_auth_settings())

        formglobals["plugin_settings"] = {}

        formglobals["auth_plugins_shortnames"] = {}

        _defaults["auth_plugins"] = formglobals["auth_plugins"]

                post_data['password_confirmation'] = ''

                form_result = _form.to_python(post_data)

                # skip updating those attrs for my account

                skip_attrs = ['admin', 'active', 'extern_type', 'extern_name',

                              'new_password', 'password_confirmation']

                #TODO: plugin should define if username can be updated

                    # forbid updating username for external accounts

                    skip_attrs.append('username')

                UserModel().update(self.authuser.user_id, form_result,

                                   skip_attrs=skip_attrs)

                h.flash(_('Your account was updated successfully'),

import kallithea

from kallithea.lib.exceptions import DefaultUserException, \

    UserOwnsReposException, UserCreationError

from kallithea.lib import helpers as h

from kallithea.lib.auth import LoginRequired, HasPermissionAllDecorator, \

    AuthUser, generate_api_key

from kallithea.lib import auth_modules

from kallithea.lib.base import BaseController, render

from kallithea.model.api_key import ApiKeyModel

from kallithea.model.db import User, UserEmailMap, UserIpMap, UserToPerm

from kallithea.model.forms import UserForm, CustomDefaultPermissionsForm

        return render('admin/users/users.html')

    def create(self):

        """POST /users: Create a new item"""

        # url('users')

        user_model = UserModel()

        user_form = UserForm()()

        try:

            form_result = user_form.to_python(dict(request.POST))

            user_model.create(form_result)

            usr = form_result['username']

                    % request.POST.get('username'), category='error')

        return redirect(url('users'))

    def new(self, format='html'):

        """GET /users/new: Form to create a new item"""

        # url('new_user')

        return render('admin/users/user_add.html')

    def update(self, id):

        """PUT /users/id: Update an existing item"""

        # Forms posted to this method should contain a hidden field:

        #    <input type="hidden" name="_method" value="PUT" />

                                              'email': c.user.email})()

        form_result = {}

        try:

            form_result = _form.to_python(dict(request.POST))

            skip_attrs = ['extern_type', 'extern_name']

            #TODO: plugin should define if username can be updated

                # forbid updating username for external accounts

                skip_attrs.append('username')

            user_model.update(id, form_result, skip_attrs=skip_attrs)

            usr = form_result['username']

            action_logger(self.authuser, 'admin_updated_user:%s' % usr,

        return result

    @HasPermissionAllDecorator('hg.admin')

    def create_user(self, apiuser, username, email, password=Optional(''),

                    firstname=Optional(''), lastname=Optional(''),

                    active=Optional(True), admin=Optional(False),

        """

        Creates new user. Returns new user object. This command can

        be executed only using api_key belonging to user with admin rights.

        :param apiuser: filled automatically from apikey

        :type apiuser: AuthUser

        return auth

def importplugin(plugin):

    """

    Imports and returns the authentication plugin in the module named by plugin

    RhodeCodeAuthPluginBase subclass on success, raises exceptions on failure.

    raises:

        AttributeError -- no RhodeCodeAuthPlugin class in the module

        TypeError -- if the RhodeCodeAuthPlugin is not a subclass of ours RhodeCodeAuthPluginBase

        ImportError -- if we couldn't import the plugin at all

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

"""

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

RhodeCode authentication plugin for built in internal auth

:created_on: Created on Nov 17, 2012

:author: marcink

class RhodeCodeAuthPlugin(auth_modules.RhodeCodeAuthPluginBase):

    def __init__(self):

        pass

    @hybrid_property

    def name(self):

    def settings(self):

        return []

    def user_activation_state(self):

        def_user_perms = User.get_default_user().AuthUser.permissions['global']

        """

        Create default auth plugin settings, and make it active

        :param skip_existing:

        """

            if skip_existing and Setting.get_by_name(k) != None:

                log.debug('Skipping option %s' % k)

                continue

            setting = Setting(k, v, t)

            self.sa.add(setting)

    def create_user(self, username, password, email='', admin=False):

        log.info('creating user %s' % username)

        UserModel().create_or_update(username, password, email,

                                     firstname='RhodeCode', lastname='Admin',

                                     active=True, admin=admin,

    def create_default_user(self):

        log.info('creating default user')

        # create default user for handling default permissions.

        user = UserModel().create_or_update(username=User.DEFAULT_USER,

                                            password=str(uuid.uuid1())[:20],

    for usr in models.User.get_all():

        ldap_dn = usr.ldap_dn

        if ldap_dn:

            usr.extern_name = ldap_dn

            usr.extern_type = 'ldap'

        else:

        _SESSION().add(usr)

        _SESSION().commit()

    meta = MetaData()

    meta.bind = migrate_engine

def fixups(models, _SESSION):

    notify('Fixing default auth modules')

    opts = []

    ldap_enabled = str2bool(getattr(

        models.Setting.get_by_name('ldap_active'),

        'app_settings_value', False))

    if ldap_enabled:

        plugins += ',kallithea.lib.auth_modules.auth_ldap'

        opts.append(('auth_ldap_enabled', 'True', 'bool'))

    opts.append(('auth_plugins', plugins, 'list'),)

    for name, default, type_ in opts:

        setting = models.Setting.get_by_name(name)

        if not setting:

            # if we don't have this option create it

            setting = models.Setting(name, default, type_)

def downgrade(migrate_engine):

    meta = MetaData()

    meta.bind = migrate_engine

def fixups(models, _SESSION):

    for usr in models.User.query().all():

        if not usr.extern_name:

            _SESSION().add(usr)

            _SESSION().commit()

    def create_registration(self, form_data):

        from kallithea.model.notification import NotificationModel

        try:

            form_data['admin'] = False

            new_user = self.create(form_data)

            self.sa.add(new_user)

            self.sa.flush()

            # notification to admins

           </div>

         </div>

        <% readonly = None %>

        <% disabled = "" %>

        <div class="fields">

                <% readonly = "readonly" %>

                <% disabled = " disabled" %>

                <strong>${_('Your user is in an external Source of Record; some details cannot be managed here')}.</strong>

           %endif

             <div class="field">

                <div class="label">

                %endif

           </div>

        </div>

        <% readonly = None %>

        <% disabled = "" %>

        <div class="fields">

             <div class="field">

               <% readonly = "readonly" %>

               <% disabled = " disabled" %>

               <strong>${_('This user is in an external Source of Record (%s); some details cannot be managed here.' % c.extern_type)}.</strong>

             </div>

            %endif

    def test_api_create_user_with_extern_name(self):

        username = 'test_new_api_user_passwordless'

        email = username + "@foo.com"

        id_, params = _build_data(self.apikey, 'create_user',

                                  username=username,

        response = api_call(self, params)

        usr = UserModel().get_by_username(username)

        ret = dict(

            msg='created new user `%s`' % username,

            user=jsonify(usr.get_api_data())

            password='qweqwe',

            email='%s+test@example.com' % name,

            firstname='TestUser',

            lastname='Test',

            active=True,

            admin=False,

            extern_name=None

        )

        defs.update(custom)

        return defs

    def test_ldap_save_settings(self):

        self.log_user()

        if ldap_lib_installed:

            raise SkipTest('skipping due to missing ldap lib')

        params.update({'auth_ldap_host': u'dc.example.com',

                       'auth_ldap_port': '999',

                       'auth_ldap_tls_kind': 'PLAIN',

                       'auth_ldap_tls_reqcert': 'NEVER',

                       'auth_ldap_dn_user': 'test_user',

                       'auth_ldap_dn_pass': 'test_pass',

    def test_ldap_error_form_wrong_port_number(self):

        self.log_user()

        if ldap_lib_installed:

            raise SkipTest('skipping due to missing ldap lib')

        params.update({'auth_ldap_host': '',

                       'auth_ldap_port': 'i-should-be-number',  # bad port num

                       'auth_ldap_tls_kind': 'PLAIN',

                       'auth_ldap_tls_reqcert': 'NEVER',

                       'auth_ldap_dn_user': '',

                       'auth_ldap_dn_pass': '',

    def test_ldap_error_form(self):

        self.log_user()

        if ldap_lib_installed:

            raise SkipTest('skipping due to missing ldap lib')

        params.update({'auth_ldap_host': 'Host',

                       'auth_ldap_port': '123',

                       'auth_ldap_tls_kind': 'PLAIN',

                       'auth_ldap_tls_reqcert': 'NEVER',

                       'auth_ldap_dn_user': '',

                       'auth_ldap_dn_pass': '',

            {'username': username,

             'password': password,

             'password_confirmation': password_confirmation,

             'firstname': name,

             'active': True,

             'lastname': lastname,

             'email': email})

        self.checkSessionFlash(response, '''Created user %s''' % (username))

        new_user = Session().query(User).\

            filter(User.username == username).one()

        #                   'password_confirmation': 'foobar123'})

        ])

    def test_update(self, name, attrs):

        self.log_user()

        usr = fixture.create_user(self.test_user_1, password='qweqwe',

                                  email='testme@example.com',

                                  extern_name=self.test_user_1,

                                  skip_if_exists=True)

        Session().commit()

        params = usr.get_api_data()

        params.update({'password_confirmation': ''})

        params.update({'new_password': ''})

        params.update(attrs)

        if name == 'email':

            params['emails'] = [attrs['email']]

        if name == 'extern_type':

            #cannot update this via form, expected value is original one

        if name == 'extern_name':

            #cannot update this via form, expected value is original one

            params['extern_name'] = self.test_user_1

            # special case since this user is not

                                          # logged in yet his data is not filled

                                          # so we use creation data

        # ('new_password', {'new_password': 'foobar123',

        #                   'password_confirmation': 'foobar123'})

        ])

    def test_my_account_update(self, name, attrs):

        usr = fixture.create_user(self.test_user_1, password='qweqwe',

                                  email='testme@example.com',

                                  extern_name=self.test_user_1,

                                  skip_if_exists=True)

        params = usr.get_api_data()  # current user data

        user_id = usr.user_id

        self.log_user(username=self.test_user_1, password='qweqwe')

        params.update({'password_confirmation': ''})

        params.update({'new_password': ''})

        params.update({'extern_name': self.test_user_1})

        params.update(attrs)

        response = self.app.post(url('my_account'), params)

        self.checkSessionFlash(response,

        params['last_login'] = updated_params['last_login']

        if name == 'email':

            params['emails'] = [attrs['email']]

        if name == 'extern_type':

            #cannot update this via form, expected value is original one

        if name == 'extern_name':

            #cannot update this via form, expected value is original one

            params['extern_name'] = str(user_id)

        if name == 'active':

            #my account cannot deactivate account

            params['active'] = True