matthias/mayan-edms
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Refactored the permissions registration, checking and definition

Browse Source
This commit is contained in:
Roberto Rosario
2011-05-24 22:31:07 -04:00
parent ebaf4165e2
commit d97a862a25
25 changed files with 261 additions and 288 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/permissions/__init__.py
+12 -12
View File
@@ -8,20 +8,20 @@ from navigation.api import register_links
from permissions.conf.settings import DEFAULT_ROLES
from permissions.models import Role
PERMISSION_ROLE_VIEW = 'role_view'
PERMISSION_ROLE_EDIT = 'role_edit'
PERMISSION_ROLE_CREATE = 'role_create'
PERMISSION_ROLE_DELETE = 'role_delete'
PERMISSION_PERMISSION_GRANT = 'permission_grant'
PERMISSION_PERMISSION_REVOKE = 'permission_revoke'
PERMISSION_ROLE_VIEW = {'namespace': 'permissions', 'name': 'role_view', 'label':_(u'View roles')}
PERMISSION_ROLE_EDIT = {'namespace': 'permissions', 'name': 'role_edit', 'label':_(u'Edit roles')}
PERMISSION_ROLE_CREATE = {'namespace': 'permissions', 'name': 'role_create', 'label':_(u'Create roles')}
PERMISSION_ROLE_DELETE = {'namespace': 'permissions', 'name': 'role_delete', 'label':_(u'Delete roles')}
PERMISSION_PERMISSION_GRANT = {'namespace': 'permissions', 'name': 'permission_grant', 'label':_(u'Grant permissions')}
PERMISSION_PERMISSION_REVOKE = {'namespace': 'permissions', 'name': 'permission_revoke', 'label':_(u'Revoke permissions')}
role_list = {'text': _(u'roles'), 'view': 'role_list', 'famfam': 'medal_gold_1', 'permissions': {'namespace': 'permissions', 'permissions': [PERMISSION_ROLE_VIEW]}}
role_create = {'text': _(u'create new role'), 'view': 'role_create', 'famfam': 'medal_gold_add', 'permissions': {'namespace': 'permissions', 'permissions': [PERMISSION_ROLE_CREATE]}}
role_edit = {'text': _(u'edit'), 'view': 'role_edit', 'args': 'object.id', 'famfam': 'medal_gold_1', 'permissions': {'namespace': 'permissions', 'permissions': [PERMISSION_ROLE_EDIT]}}
role_members = {'text': _(u'members'), 'view': 'role_members', 'args': 'object.id', 'famfam': 'group_key', 'permissions': {'namespace': 'permissions', 'permissions': [PERMISSION_ROLE_EDIT]}}
role_permissions = {'text': _(u'role permissions'), 'view': 'role_permissions', 'args': 'object.id', 'famfam': 'key_go', 'permissions': {'namespace': 'permissions', 'permissions': [PERMISSION_PERMISSION_GRANT, PERMISSION_PERMISSION_REVOKE]}}
role_delete = {'text': _(u'delete'), 'view': 'role_delete', 'args': 'object.id', 'famfam': 'medal_gold_delete', 'permissions': {'namespace': 'permissions', 'permissions': [PERMISSION_ROLE_DELETE]}}
role_list = {'text': _(u'roles'), 'view': 'role_list', 'famfam': 'medal_gold_1', 'permissions': [PERMISSION_ROLE_VIEW]}
role_create = {'text': _(u'create new role'), 'view': 'role_create', 'famfam': 'medal_gold_add', 'permissions': [PERMISSION_ROLE_CREATE]}
role_edit = {'text': _(u'edit'), 'view': 'role_edit', 'args': 'object.id', 'famfam': 'medal_gold_1', 'permissions': [PERMISSION_ROLE_EDIT]}
role_members = {'text': _(u'members'), 'view': 'role_members', 'args': 'object.id', 'famfam': 'group_key', 'permissions': [PERMISSION_ROLE_EDIT]}
role_permissions = {'text': _(u'role permissions'), 'view': 'role_permissions', 'args': 'object.id', 'famfam': 'key_go', 'permissions': [PERMISSION_PERMISSION_GRANT, PERMISSION_PERMISSION_REVOKE]}
role_delete = {'text': _(u'delete'), 'view': 'role_delete', 'args': 'object.id', 'famfam': 'medal_gold_delete', 'permissions': [PERMISSION_ROLE_DELETE]}
register_links(Role, [role_edit, role_delete, role_permissions, role_members])
register_links(['role_members', 'role_list', 'role_view', 'role_create', 'role_edit', 'role_permissions', 'role_delete'], [role_create, role_list], menu_name='sidebar')
apps/permissions/api.py
+17 -23
View File
@@ -11,36 +11,30 @@ from permissions import PERMISSION_ROLE_VIEW, PERMISSION_ROLE_EDIT, \
from permissions.models import Permission
def register_permissions(namespace, permissions):
if permissions:
for permission in permissions:
try:
permission_obj, created = Permission.objects.get_or_create(
namespace=namespace, name=permission['name'])
permission_obj.label = unicode(permission['label'])
permission_obj.save()
except DatabaseError:
#Special case for ./manage.py syncdb
pass
def register_permission(permission):
try:
permission_obj, created = Permission.objects.get_or_create(
namespace=permission['namespace'], name=permission['name'])
permission_obj.label = unicode(permission['label'])
permission_obj.save()
except DatabaseError:
#Special case for ./manage.py syncdb
pass
#TODO: Handle anonymous users
def check_permissions(requester, namespace, permission_list):
def check_permissions(requester, permission_list):
for permission_item in permission_list:
permission = get_object_or_404(Permission,
namespace=namespace, name=permission_item)
#if check_permission(requester, permission):
namespace=permission_item['namespace'], name=permission_item['name'])
if permission.has_permission(requester):
return True
raise PermissionDenied(ugettext(u'Insufficient permissions.'))
register_permissions('permissions', [
{'name': PERMISSION_ROLE_VIEW, 'label':_(u'View roles')},
{'name': PERMISSION_ROLE_EDIT, 'label':_(u'Edit roles')},
{'name': PERMISSION_ROLE_CREATE, 'label':_(u'Create roles')},
{'name': PERMISSION_ROLE_DELETE, 'label':_(u'Delete roles')},
{'name': PERMISSION_PERMISSION_GRANT, 'label':_(u'Grant permissions')},
{'name': PERMISSION_PERMISSION_REVOKE, 'label':_(u'Revoke permissions')},
])
register_permission(PERMISSION_ROLE_VIEW)
register_permission(PERMISSION_ROLE_EDIT)
register_permission(PERMISSION_ROLE_CREATE)
register_permission(PERMISSION_ROLE_DELETE)
register_permission(PERMISSION_PERMISSION_GRANT)
register_permission(PERMISSION_PERMISSION_REVOKE)
apps/permissions/templatetags/permission_tags.py
+2 -4
View File
@@ -8,9 +8,8 @@ register = Library()
class CheckPermissionsNode(Node):
def __init__(self, requester, namespace=None, permission_list=None, *args, **kwargs):
def __init__(self, requester, permission_list=None, *args, **kwargs):
self.requester = requester
self.namespace = namespace
self.permission_list = permission_list
def render(self, context):
@@ -21,9 +20,8 @@ class CheckPermissionsNode(Node):
context[u'permission'] = True
return u''
requester = Variable(self.requester).resolve(context)
namespace = Variable(self.namespace).resolve(context)
try:
check_permission_function(requester, namespace, permission_list)
check_permission_function(requester, permission_list)
context[u'permission'] = True
return u''
except PermissionDenied:
apps/permissions/views.py
+8 -8
View File
@@ -23,7 +23,7 @@ from permissions.api import check_permissions
def role_list(request):
check_permissions(request.user, 'permissions', [PERMISSION_ROLE_VIEW])
check_permissions(request.user, [PERMISSION_ROLE_VIEW])
return object_list(
request,
@@ -54,7 +54,7 @@ def _role_permission_link(requester, permission, permission_list):
def role_permissions(request, role_id):
check_permissions(request.user, 'permissions', [PERMISSION_PERMISSION_GRANT, PERMISSION_PERMISSION_REVOKE])
check_permissions(request.user, [PERMISSION_PERMISSION_GRANT, PERMISSION_PERMISSION_REVOKE])
role = get_object_or_404(Role, pk=role_id)
form = RoleForm_view(instance=role)
@@ -89,7 +89,7 @@ def role_permissions(request, role_id):
def role_edit(request, role_id):
check_permissions(request.user, 'permissions', [PERMISSION_ROLE_EDIT])
check_permissions(request.user, [PERMISSION_ROLE_EDIT])
return update_object(request, template_name='generic_form.html',
form_class=RoleForm, object_id=role_id, extra_context={
@@ -97,7 +97,7 @@ def role_edit(request, role_id):
def role_create(request):
check_permissions(request.user, 'permissions', [PERMISSION_ROLE_CREATE])
check_permissions(request.user, [PERMISSION_ROLE_CREATE])
return create_object(request, model=Role,
template_name='generic_form.html',
@@ -105,7 +105,7 @@ def role_create(request):
def role_delete(request, role_id):
check_permissions(request.user, 'permissions', [PERMISSION_ROLE_DELETE])
check_permissions(request.user, [PERMISSION_ROLE_DELETE])
next = request.POST.get('next', request.GET.get('next', request.META.get('HTTP_REFERER', None)))
previous = request.POST.get('previous', request.GET.get('previous', request.META.get('HTTP_REFERER', None)))
@@ -129,12 +129,12 @@ def permission_grant_revoke(request, permission_id, app_label, module_name, pk,
permission = get_object_or_404(Permission, pk=permission_id)
if action == 'grant':
check_permissions(request.user, 'permissions', [PERMISSION_PERMISSION_GRANT])
check_permissions(request.user, [PERMISSION_PERMISSION_GRANT])
title = _(u'Are you sure you wish to grant the permission "%(permission)s" to %(ct_name)s: %(requester)s') % {
'permission': permission, 'ct_name': ct.name, 'requester': requester}
elif action == 'revoke':
check_permissions(request.user, 'permissions', [PERMISSION_PERMISSION_REVOKE])
check_permissions(request.user, [PERMISSION_PERMISSION_REVOKE])
title = _(u'Are you sure you wish to revoke the permission "%(permission)s" from %(ct_name)s: %(requester)s') % {
'permission': permission, 'ct_name': ct.name, 'requester': requester}
else:
@@ -202,7 +202,7 @@ def remove_role_member(role, selection):
def role_members(request, role_id):
check_permissions(request.user, 'permissions', [PERMISSION_ROLE_EDIT])
check_permissions(request.user, [PERMISSION_ROLE_EDIT])
role = get_object_or_404(Role, pk=role_id)
return assign_remove(