engineering/unrhodecode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

permissions: properly flush user cache permissions in more cases of permission changes.

Browse source 
- fixed #5560
This commit is contained in:
Marcin Kuzminski 2019-08-20 10:48:36 +02:00
parent b234d9d721
commit 0cbb6b652a
17 changed files with 76 additions and 55 deletions
Download patch file Download diff file Expand all files Collapse all files

13
rhodecode/api/views/repo_api.py
View file

@ -43,6 +43,7 @@ from rhodecode.model.comment import CommentsModel
from rhodecode.model.db import (
Session, ChangesetStatus, RepositoryField, Repository, RepoGroup,
ChangesetComment)
from rhodecode.model.permission import PermissionModel
from rhodecode.model.repo import RepoModel
from rhodecode.model.scm import ScmModel, RepoList
from rhodecode.model.settings import SettingsModel, VcsSettingsModel
@ -1783,8 +1784,9 @@ def grant_user_permission(request, apiuser, repoid, userid, perm):
}
audit_logger.store_api(
'repo.edit.permissions', action_data=action_data, user=apiuser, repo=repo)
Session().commit()
PermissionModel().flush_user_permission_caches(changes)
return {
'msg': 'Granted perm: `%s` for user: `%s` in repo: `%s`' % (
perm.permission_name, user.username, repo.repo_name
@ -1845,8 +1847,9 @@ def revoke_user_permission(request, apiuser, repoid, userid):
}
audit_logger.store_api(
'repo.edit.permissions', action_data=action_data, user=apiuser, repo=repo)
Session().commit()
PermissionModel().flush_user_permission_caches(changes)
return {
'msg': 'Revoked perm for user: `%s` in repo: `%s`' % (
user.username, repo.repo_name
@ -1931,8 +1934,9 @@ def grant_user_group_permission(request, apiuser, repoid, usergroupid, perm):
}
audit_logger.store_api(
'repo.edit.permissions', action_data=action_data, user=apiuser, repo=repo)
Session().commit()
PermissionModel().flush_user_permission_caches(changes)
return {
'msg': 'Granted perm: `%s` for user group: `%s` in '
'repo: `%s`' % (
@ -2004,8 +2008,9 @@ def revoke_user_group_permission(request, apiuser, repoid, usergroupid):
}
audit_logger.store_api(
'repo.edit.permissions', action_data=action_data, user=apiuser, repo=repo)
Session().commit()
PermissionModel().flush_user_permission_caches(changes)
return {
'msg': 'Revoked perm for user group: `%s` in repo: `%s`' % (
user_group.users_group_name, repo.repo_name

13
rhodecode/api/views/repo_group_api.py
View file

@ -31,6 +31,7 @@ from rhodecode.lib import audit_logger
from rhodecode.lib.auth import (
HasRepoGroupPermissionAnyApi, HasUserGroupPermissionAnyApi)
from rhodecode.model.db import Session
from rhodecode.model.permission import PermissionModel
from rhodecode.model.repo_group import RepoGroupModel
from rhodecode.model.scm import RepoGroupList
from rhodecode.model import validation_schema
@ -465,8 +466,9 @@ def grant_user_permission_to_repo_group(
audit_logger.store_api(
'repo_group.edit.permissions', action_data=action_data,
user=apiuser)
Session().commit()
PermissionModel().flush_user_permission_caches(changes)
return {
'msg': 'Granted perm: `%s` (recursive:%s) for user: '
'`%s` in repo group: `%s`' % (
@ -548,8 +550,9 @@ def revoke_user_permission_from_repo_group(
audit_logger.store_api(
'repo_group.edit.permissions', action_data=action_data,
user=apiuser)
Session().commit()
PermissionModel().flush_user_permission_caches(changes)
return {
'msg': 'Revoked perm (recursive:%s) for user: '
'`%s` in repo group: `%s`' % (
@ -641,8 +644,9 @@ def grant_user_group_permission_to_repo_group(
audit_logger.store_api(
'repo_group.edit.permissions', action_data=action_data,
user=apiuser)
Session().commit()
PermissionModel().flush_user_permission_caches(changes)
return {
'msg': 'Granted perm: `%s` (recursive:%s) '
'for user group: `%s` in repo group: `%s`' % (
@ -733,8 +737,9 @@ def revoke_user_group_permission_from_repo_group(
audit_logger.store_api(
'repo_group.edit.permissions', action_data=action_data,
user=apiuser)
Session().commit()
PermissionModel().flush_user_permission_caches(changes)
return {
'msg': 'Revoked perm (recursive:%s) for user group: '
'`%s` in repo group: `%s`' % (

16
rhodecode/api/views/user_group_api.py
View file

@ -29,6 +29,7 @@ from rhodecode.lib import audit_logger
from rhodecode.lib.auth import HasUserGroupPermissionAnyApi, HasPermissionAnyApi
from rhodecode.lib.exceptions import UserGroupAssignedException
from rhodecode.model.db import Session
from rhodecode.model.permission import PermissionModel
from rhodecode.model.scm import UserGroupList
from rhodecode.model.user_group import UserGroupModel
from rhodecode.model import validation_schema
@ -268,6 +269,10 @@ def create_user_group(
'user_group.create', action_data={'data': creation_data},
user=apiuser)
Session().commit()
affected_user_ids = [apiuser.user_id, owner.user_id]
PermissionModel().trigger_permission_flush(affected_user_ids)
return {
'msg': 'created new user group `%s`' % group_name,
'user_group': creation_data
@ -653,8 +658,9 @@ def grant_user_permission_to_user_group(
audit_logger.store_api(
'user_group.edit.permissions', action_data=action_data,
user=apiuser)
Session().commit()
PermissionModel().flush_user_permission_caches(changes)
return {
'msg':
'Granted perm: `%s` for user: `%s` in user group: `%s`' % (
@ -722,8 +728,9 @@ def revoke_user_permission_from_user_group(
audit_logger.store_api(
'user_group.edit.permissions', action_data=action_data,
user=apiuser)
Session().commit()
PermissionModel().flush_user_permission_caches(changes)
return {
'msg': 'Revoked perm for user: `%s` in user group: `%s`' % (
user.username, user_group.users_group_name
@ -799,8 +806,9 @@ def grant_user_group_permission_to_user_group(
audit_logger.store_api(
'user_group.edit.permissions', action_data=action_data,
user=apiuser)
Session().commit()
PermissionModel().flush_user_permission_caches(changes)
return {
'msg': 'Granted perm: `%s` for user group: `%s` '
'in user group: `%s`' % (
@ -877,8 +885,8 @@ def revoke_user_group_permission_from_user_group(
audit_logger.store_api(
'user_group.edit.permissions', action_data=action_data,
user=apiuser)
Session().commit()
PermissionModel().flush_user_permission_caches(changes)
return {
'msg': 'Revoked perm for user group: '

6
rhodecode/apps/admin/views/permissions.py
View file

@ -143,7 +143,7 @@ class AdminPermissionsView(BaseAppView, DataGridAppView):
category='error')
affected_user_ids = [User.get_default_user().user_id]
events.trigger(events.UserPermissionsChange(affected_user_ids))
PermissionModel().trigger_permission_flush(affected_user_ids)
raise HTTPFound(h.route_path('admin_permissions_application'))
@ -219,7 +219,7 @@ class AdminPermissionsView(BaseAppView, DataGridAppView):
category='error')
affected_user_ids = [User.get_default_user().user_id]
events.trigger(events.UserPermissionsChange(affected_user_ids))
PermissionModel().trigger_permission_flush(affected_user_ids)
raise HTTPFound(h.route_path('admin_permissions_object'))
@ -321,7 +321,7 @@ class AdminPermissionsView(BaseAppView, DataGridAppView):
category='error')
affected_user_ids = [User.get_default_user().user_id]
events.trigger(events.UserPermissionsChange(affected_user_ids))
PermissionModel().trigger_permission_flush(affected_user_ids)
raise HTTPFound(h.route_path('admin_permissions_global'))

3
rhodecode/apps/admin/views/repo_groups.py
View file

@ -36,6 +36,7 @@ from rhodecode.lib.auth import (
from rhodecode.lib import helpers as h, audit_logger
from rhodecode.lib.utils2 import safe_int, safe_unicode, datetime_to_time
from rhodecode.model.forms import RepoGroupForm
from rhodecode.model.permission import PermissionModel
from rhodecode.model.repo_group import RepoGroupModel
from rhodecode.model.scm import RepoGroupList
from rhodecode.model.db import (
@ -354,7 +355,7 @@ class AdminRepoGroupsView(BaseAppView, DataGridAppView):
copy_perms = [perm['user_id'] for perm in user_group_perms]
# also include those newly created by copy
affected_user_ids.extend(copy_perms)
events.trigger(events.UserPermissionsChange(affected_user_ids))
PermissionModel().trigger_permission_flush(affected_user_ids)
raise HTTPFound(
h.route_path('repo_group_home',

3
rhodecode/apps/admin/views/repositories.py
View file

@ -39,6 +39,7 @@ from rhodecode.lib import helpers as h
from rhodecode.lib.utils import repo_name_slug
from rhodecode.lib.utils2 import safe_int, safe_unicode
from rhodecode.model.forms import RepoForm
from rhodecode.model.permission import PermissionModel
from rhodecode.model.repo import RepoModel
from rhodecode.model.scm import RepoList, RepoGroupList, ScmModel
from rhodecode.model.settings import SettingsModel
@ -179,7 +180,7 @@ class AdminReposView(BaseAppView, DataGridAppView):
if copy_permissions:
# permission flush is done in repo creating
pass
events.trigger(events.UserPermissionsChange(affected_user_ids))
PermissionModel().trigger_permission_flush(affected_user_ids)
raise HTTPFound(
h.route_path('repo_creating', repo_name=repo_name,

4
rhodecode/apps/admin/views/user_groups.py
View file

@ -266,6 +266,8 @@ class AdminUserGroupsView(BaseAppView, DataGridAppView):
% user_group_name, category='error')
raise HTTPFound(h.route_path('user_groups_new'))
events.trigger(events.UserPermissionsChange([self._rhodecode_user.user_id]))
affected_user_ids = [self._rhodecode_user.user_id]
PermissionModel().trigger_permission_flush(affected_user_ids)
raise HTTPFound(
h.route_path('edit_user_group', user_group_id=user_group_id))

2
rhodecode/apps/admin/views/users.py
View file

@ -597,7 +597,7 @@ class UsersView(UserAppView):
category='error')
affected_user_ids = [user_id]
events.trigger(events.UserPermissionsChange(affected_user_ids))
PermissionModel().trigger_permission_flush(affected_user_ids)
raise HTTPFound(h.route_path('user_edit_global_perms', user_id=user_id))
@LoginRequired()

17
rhodecode/apps/repo_group/views/repo_group_permissions.py
View file

@ -23,14 +23,12 @@ import logging
from pyramid.view import view_config
from pyramid.httpexceptions import HTTPFound
from rhodecode import events
from rhodecode.apps._base import RepoGroupAppView
from rhodecode.lib import helpers as h
from rhodecode.lib import audit_logger
from rhodecode.lib.auth import (
LoginRequired, HasRepoGroupPermissionAnyDecorator, CSRFRequired)
from rhodecode.lib.utils2 import safe_int
from rhodecode.model.db import UserGroup
from rhodecode.model.permission import PermissionModel
from rhodecode.model.repo_group import RepoGroupModel
from rhodecode.model.forms import RepoGroupPermsForm
from rhodecode.model.meta import Session
@ -98,18 +96,7 @@ class RepoGroupPermissionsView(RepoGroupAppView):
Session().commit()
h.flash(_('Repository Group permissions updated'), category='success')
affected_user_ids = []
for change in changes['added'] + changes['updated'] + changes['deleted']:
if change['type'] == 'user':
affected_user_ids.append(change['id'])
if change['type'] == 'user_group':
user_group = UserGroup.get(safe_int(change['id']))
if user_group:
group_members_ids = [x.user_id for x in user_group.members]
affected_user_ids.extend(group_members_ids)
events.trigger(events.UserPermissionsChange(affected_user_ids))
PermissionModel().flush_user_permission_caches(changes)
raise HTTPFound(
h.route_path('edit_repo_group_perms',

3
rhodecode/apps/repo_group/views/repo_group_settings.py
View file

@ -33,6 +33,7 @@ from rhodecode.lib.auth import (
LoginRequired, HasPermissionAll,
HasRepoGroupPermissionAny, HasRepoGroupPermissionAnyDecorator, CSRFRequired)
from rhodecode.model.db import Session, RepoGroup, User
from rhodecode.model.permission import PermissionModel
from rhodecode.model.scm import RepoGroupList
from rhodecode.model.repo_group import RepoGroupModel
from rhodecode.model.validation_schema.schemas import repo_group_schema
@ -187,7 +188,7 @@ class RepoGroupSettingsView(RepoGroupAppView):
owner = User.get_by_username(schema_data['repo_group_owner'])
owner_id = owner.user_id if owner else self._rhodecode_user.user_id
affected_user_ids.extend([self._rhodecode_user.user_id, owner_id])
events.trigger(events.UserPermissionsChange(affected_user_ids))
PermissionModel().trigger_permission_flush(affected_user_ids)
raise HTTPFound(
h.route_path('edit_repo_group', repo_group_name=new_repo_group_name))

3
rhodecode/apps/repository/views/repo_checks.py
View file

@ -28,6 +28,7 @@ from rhodecode.apps._base import BaseAppView
from rhodecode.lib import helpers as h
from rhodecode.lib.auth import (NotAnonymous, HasRepoPermissionAny)
from rhodecode.model.db import Repository
from rhodecode.model.permission import PermissionModel
from rhodecode.model.validation_schema.types import RepoNameType
log = logging.getLogger(__name__)
@ -122,4 +123,4 @@ class RepoChecksView(BaseAppView):
# repo is finished and created, we flush the permissions now
user_group_perms = db_repo.permissions(expand_from_user_groups=True)
affected_user_ids = [perm['user_id'] for perm in user_group_perms]
events.trigger(events.UserPermissionsChange(affected_user_ids))
PermissionModel().trigger_permission_flush(affected_user_ids)

3
rhodecode/apps/repository/views/repo_forks.py
View file

@ -36,6 +36,7 @@ from rhodecode.lib.auth import (
import rhodecode.lib.helpers as h
from rhodecode.lib.celerylib.utils import get_task_id
from rhodecode.model.db import coalesce, or_, Repository, RepoGroup
from rhodecode.model.permission import PermissionModel
from rhodecode.model.repo import RepoModel
from rhodecode.model.forms import RepoForkForm
from rhodecode.model.scm import ScmModel, RepoGroupList
@ -257,7 +258,7 @@ class RepoForksView(RepoAppView, DataGridAppView):
# permission flush is done in repo creating
pass
events.trigger(events.UserPermissionsChange(affected_user_ids))
PermissionModel().trigger_permission_flush(affected_user_ids)
raise HTTPFound(
h.route_path('repo_creating', repo_name=repo_name,

16
rhodecode/apps/repository/views/repo_permissions.py
View file

@ -23,16 +23,14 @@ import logging
from pyramid.httpexceptions import HTTPFound
from pyramid.view import view_config
from rhodecode import events
from rhodecode.apps._base import RepoAppView
from rhodecode.lib import helpers as h
from rhodecode.lib import audit_logger
from rhodecode.lib.auth import (
LoginRequired, HasRepoPermissionAnyDecorator, CSRFRequired)
from rhodecode.lib.utils2 import safe_int
from rhodecode.model.db import UserGroup
from rhodecode.model.forms import RepoPermsForm
from rhodecode.model.meta import Session
from rhodecode.model.permission import PermissionModel
from rhodecode.model.repo import RepoModel
log = logging.getLogger(__name__)
@ -91,17 +89,7 @@ class RepoSettingsPermissionsView(RepoAppView):
Session().commit()
h.flash(_('Repository permissions updated'), category='success')
affected_user_ids = []
for change in changes['added'] + changes['updated'] + changes['deleted']:
if change['type'] == 'user':
affected_user_ids.append(change['id'])
if change['type'] == 'user_group':
user_group = UserGroup.get(safe_int(change['id']))
if user_group:
group_members_ids = [x.user_id for x in user_group.members]
affected_user_ids.extend(group_members_ids)
events.trigger(events.UserPermissionsChange(affected_user_ids))
PermissionModel().flush_user_permission_caches(changes)
raise HTTPFound(
h.route_path('edit_repo_perms', repo_name=self.db_repo_name))

3
rhodecode/apps/repository/views/repo_settings.py
View file

@ -33,6 +33,7 @@ from rhodecode.lib.auth import (
LoginRequired, HasRepoPermissionAnyDecorator, CSRFRequired)
from rhodecode.model.db import RepositoryField, RepoGroup, Repository, User
from rhodecode.model.meta import Session
from rhodecode.model.permission import PermissionModel
from rhodecode.model.repo import RepoModel
from rhodecode.model.scm import RepoGroupList, ScmModel
from rhodecode.model.validation_schema.schemas import repo_schema
@ -184,7 +185,7 @@ class RepoSettingsView(RepoAppView):
owner = User.get_by_username(schema_data['repo_owner'])
owner_id = owner.user_id if owner else self._rhodecode_user.user_id
affected_user_ids.extend([self._rhodecode_user.user_id, owner_id])
events.trigger(events.UserPermissionsChange(affected_user_ids))
PermissionModel().trigger_permission_flush(affected_user_ids)
raise HTTPFound(
h.route_path('edit_repo', repo_name=new_repo_name))

3
rhodecode/apps/repository/views/repo_settings_advanced.py
View file

@ -34,6 +34,7 @@ from rhodecode.lib.exceptions import AttachedForksError, AttachedPullRequestsErr
from rhodecode.lib.utils2 import safe_int
from rhodecode.lib.vcs import RepositoryError
from rhodecode.model.db import Session, UserFollowing, User, Repository
from rhodecode.model.permission import PermissionModel
from rhodecode.model.repo import RepoModel
from rhodecode.model.scm import ScmModel
@ -110,7 +111,7 @@ class RepoSettingsView(RepoAppView):
# flush permissions for all users defined in permissions
affected_user_ids = self._get_users_with_permissions().keys()
events.trigger(events.UserPermissionsChange(affected_user_ids))
PermissionModel().trigger_permission_flush(affected_user_ids)
raise HTTPFound(h.route_path('home'))

4
rhodecode/apps/user_group/views/__init__.py
View file

@ -199,7 +199,7 @@ class UserGroupsView(UserGroupAppView):
affected_user_ids.append(self._rhodecode_user.user_id)
affected_user_ids.append(owner_id)
events.trigger(events.UserPermissionsChange(affected_user_ids))
PermissionModel().trigger_permission_flush(affected_user_ids)
Session().commit()
except formencode.Invalid as errors:
@ -383,7 +383,7 @@ class UserGroupsView(UserGroupAppView):
group_members_ids = [x.user_id for x in user_group.members]
affected_user_ids.extend(group_members_ids)
events.trigger(events.UserPermissionsChange(affected_user_ids))
PermissionModel().trigger_permission_flush(affected_user_ids)
raise HTTPFound(
h.route_path('edit_user_group_perms', user_group_id=user_group_id))

19
rhodecode/model/permission.py
View file

@ -28,6 +28,7 @@ import traceback
from sqlalchemy.exc import DatabaseError
from rhodecode import events
from rhodecode.model import BaseModel
from rhodecode.model.db import (
User, Permission, UserToPerm, UserRepoToPerm, UserRepoGroupToPerm,
@ -556,3 +557,21 @@ class PermissionModel(BaseModel):
self.sa.rollback()
raise
def trigger_permission_flush(self, affected_user_ids):
events.trigger(events.UserPermissionsChange(affected_user_ids))
def flush_user_permission_caches(self, changes, affected_user_ids=None):
affected_user_ids = affected_user_ids or []
for change in changes['added'] + changes['updated'] + changes['deleted']:
if change['type'] == 'user':
affected_user_ids.append(change['id'])
if change['type'] == 'user_group':
user_group = UserGroup.get(safe_int(change['id']))
if user_group:
group_members_ids = [x.user_id for x in user_group.members]
affected_user_ids.extend(group_members_ids)
self.trigger_permission_flush(affected_user_ids)
return affected_user_ids