repo_group_name = get_repo_group_slug(request)

        try:

            return user.permissions['repositories_groups'][repo_group_name] in self.required_perms

        except KeyError:

            return False

class HasUserGroupPermissionAnyDecorator(_PermsDecorator):

    """

    Checks for access permission for any of given predicates for specific

    user group. In order to fulfill the request any of predicates must be meet

    """

    def check_permissions(self, user):

        user_group_name = get_user_group_slug(request)

        try:

            return user.permissions['user_groups'][user_group_name] in self.required_perms

        except KeyError:

            return False

#==============================================================================

# CHECK FUNCTIONS

#==============================================================================

class _PermsFunction(object):

    """Base function for other check functions"""

    def __init__(self, *required_perms):

        self.required_perms = required_perms # usually very short - a list is thus fine

    def __nonzero__(self):

        """ Defend against accidentally forgetting to call the object

            and instead evaluating it directly in a boolean context,

            which could have security implications.

        """

        raise AssertionError(self.__class__.__name__ + ' is not a bool and must be called!')

    def __call__(self, *a, **b):

        raise NotImplementedError()

class HasPermissionAny(_PermsFunction):

    def __call__(self, purpose=None):

        global_permissions = request.user.permissions['global'] # usually very short

        ok = any(p in global_permissions for p in self.required_perms)

            (request.user.username, self.required_perms, purpose, ok))

        return ok

class HasRepoPermissionAny(_PermsFunction):

    def __call__(self, repo_name, purpose=None):

        try:

            ok = request.user.permissions['repositories'][repo_name] in self.required_perms

        except KeyError:

            ok = False

            (request.user.username, self.required_perms, repo_name, purpose, ok))

        return ok

class HasRepoGroupPermissionAny(_PermsFunction):

    def __call__(self, group_name, purpose=None):

        try:

            ok = request.user.permissions['repositories_groups'][group_name] in self.required_perms

        except KeyError:

            ok = False

            (request.user.username, self.required_perms, group_name, purpose, ok))

        return ok

class HasUserGroupPermissionAny(_PermsFunction):

    def __call__(self, user_group_name, purpose=None):

        try:

            ok = request.user.permissions['user_groups'][user_group_name] in self.required_perms

        except KeyError:

            ok = False

            (request.user.username, self.required_perms, user_group_name, purpose, ok))

        return ok

#==============================================================================

# SPECIAL VERSION TO HANDLE MIDDLEWARE AUTH

#==============================================================================

class HasPermissionAnyMiddleware(object):

    def __init__(self, *perms):

        self.required_perms = set(perms)

    def __call__(self, user, repo_name, purpose=None):

        # repo_name MUST be unicode, since we handle keys in ok

        # dict by unicode

        repo_name = safe_unicode(repo_name)

        user = AuthUser(user.user_id)

        try:

            ok = user.permissions['repositories'][repo_name] in self.required_perms

        except KeyError:

            ok = False

        log.debug('Middleware check %s for %s for repo %s (%s): %s' % (user.username, self.required_perms, repo_name, purpose, ok))

        return ok

def check_ip_access(source_ip, allowed_ips=None):

    """

    Checks if source_ip is a subnet of any of allowed_ips.

    :param source_ip:

    :param allowed_ips: list of allowed ips together with mask

    """

    from kallithea.lib import ipaddr

    log.debug('checking if ip:%s is subnet of %s', source_ip, allowed_ips)

    if isinstance(allowed_ips, (tuple, list, set)):

        for ip in allowed_ips:

            if ipaddr.IPAddress(source_ip) in ipaddr.IPNetwork(ip):

                log.debug('IP %s is network %s',

                          ipaddr.IPAddress(source_ip), ipaddr.IPNetwork(ip))

                return True

    return False