permissions: properly flush user cache permissions in more cases of permission changes.

- fixed #5560

rhodecode/api/views/repo_api.py

@@ -43,6 +43,7 @@ from rhodecode.model.comment import CommentsModel
 from rhodecode.model.db import (
     Session, ChangesetStatus, RepositoryField, Repository, RepoGroup,
     ChangesetComment)
+from rhodecode.model.permission import PermissionModel
 from rhodecode.model.repo import RepoModel
 from rhodecode.model.scm import ScmModel, RepoList
 from rhodecode.model.settings import SettingsModel, VcsSettingsModel
@@ -1783,8 +1784,9 @@ def grant_user_permission(request, apiuser, repoid, userid, perm):
         }
         audit_logger.store_api(
             'repo.edit.permissions', action_data=action_data, user=apiuser, repo=repo)
-
         Session().commit()
+        PermissionModel().flush_user_permission_caches(changes)
+
         return {
             'msg': 'Granted perm: `%s` for user: `%s` in repo: `%s`' % (
                 perm.permission_name, user.username, repo.repo_name
@@ -1845,8 +1847,9 @@ def revoke_user_permission(request, apiuser, repoid, userid):
         }
         audit_logger.store_api(
             'repo.edit.permissions', action_data=action_data, user=apiuser, repo=repo)
-
         Session().commit()
+        PermissionModel().flush_user_permission_caches(changes)
+
         return {
             'msg': 'Revoked perm for user: `%s` in repo: `%s`' % (
                 user.username, repo.repo_name
@@ -1931,8 +1934,9 @@ def grant_user_group_permission(request, apiuser, repoid, usergroupid, perm):
         }
         audit_logger.store_api(
             'repo.edit.permissions', action_data=action_data, user=apiuser, repo=repo)
-
         Session().commit()
+        PermissionModel().flush_user_permission_caches(changes)
+
         return {
             'msg': 'Granted perm: `%s` for user group: `%s` in '
                    'repo: `%s`' % (
@@ -2004,8 +2008,9 @@ def revoke_user_group_permission(request, apiuser, repoid, usergroupid):
         }
         audit_logger.store_api(
             'repo.edit.permissions', action_data=action_data, user=apiuser, repo=repo)
-
         Session().commit()
+        PermissionModel().flush_user_permission_caches(changes)
+
         return {
             'msg': 'Revoked perm for user group: `%s` in repo: `%s`' % (
                 user_group.users_group_name, repo.repo_name

rhodecode/api/views/repo_group_api.py

@@ -31,6 +31,7 @@ from rhodecode.lib import audit_logger
 from rhodecode.lib.auth import (
     HasRepoGroupPermissionAnyApi, HasUserGroupPermissionAnyApi)
 from rhodecode.model.db import Session
+from rhodecode.model.permission import PermissionModel
 from rhodecode.model.repo_group import RepoGroupModel
 from rhodecode.model.scm import RepoGroupList
 from rhodecode.model import validation_schema
@@ -465,8 +466,9 @@ def grant_user_permission_to_repo_group(
         audit_logger.store_api(
             'repo_group.edit.permissions', action_data=action_data,
             user=apiuser)
-
         Session().commit()
+        PermissionModel().flush_user_permission_caches(changes)
+
         return {
             'msg': 'Granted perm: `%s` (recursive:%s) for user: '
                    '`%s` in repo group: `%s`' % (
@@ -548,8 +550,9 @@ def revoke_user_permission_from_repo_group(
         audit_logger.store_api(
             'repo_group.edit.permissions', action_data=action_data,
             user=apiuser)
-
         Session().commit()
+        PermissionModel().flush_user_permission_caches(changes)
+
         return {
             'msg': 'Revoked perm (recursive:%s) for user: '
                    '`%s` in repo group: `%s`' % (
@@ -641,8 +644,9 @@ def grant_user_group_permission_to_repo_group(
         audit_logger.store_api(
             'repo_group.edit.permissions', action_data=action_data,
             user=apiuser)
-
         Session().commit()
+        PermissionModel().flush_user_permission_caches(changes)
+
         return {
             'msg': 'Granted perm: `%s` (recursive:%s) '
                    'for user group: `%s` in repo group: `%s`' % (
@@ -733,8 +737,9 @@ def revoke_user_group_permission_from_repo_group(
         audit_logger.store_api(
             'repo_group.edit.permissions', action_data=action_data,
             user=apiuser)
-
         Session().commit()
+        PermissionModel().flush_user_permission_caches(changes)
+
         return {
             'msg': 'Revoked perm (recursive:%s) for user group: '
                    '`%s` in repo group: `%s`' % (

rhodecode/api/views/user_group_api.py

@@ -29,6 +29,7 @@ from rhodecode.lib import audit_logger
 from rhodecode.lib.auth import HasUserGroupPermissionAnyApi, HasPermissionAnyApi
 from rhodecode.lib.exceptions import UserGroupAssignedException
 from rhodecode.model.db import Session
+from rhodecode.model.permission import PermissionModel
 from rhodecode.model.scm import UserGroupList
 from rhodecode.model.user_group import UserGroupModel
 from rhodecode.model import validation_schema
@@ -268,6 +269,10 @@ def create_user_group(
             'user_group.create', action_data={'data': creation_data},
             user=apiuser)
         Session().commit()
+
+        affected_user_ids = [apiuser.user_id, owner.user_id]
+        PermissionModel().trigger_permission_flush(affected_user_ids)
+
         return {
             'msg': 'created new user group `%s`' % group_name,
             'user_group': creation_data
@@ -653,8 +658,9 @@ def grant_user_permission_to_user_group(
         audit_logger.store_api(
             'user_group.edit.permissions', action_data=action_data,
             user=apiuser)
-
         Session().commit()
+        PermissionModel().flush_user_permission_caches(changes)
+
         return {
             'msg':
                 'Granted perm: `%s` for user: `%s` in user group: `%s`' % (
@@ -722,8 +728,9 @@ def revoke_user_permission_from_user_group(
         audit_logger.store_api(
             'user_group.edit.permissions', action_data=action_data,
             user=apiuser)
-
         Session().commit()
+        PermissionModel().flush_user_permission_caches(changes)
+
         return {
             'msg': 'Revoked perm for user: `%s` in user group: `%s`' % (
                 user.username, user_group.users_group_name
@@ -799,8 +806,9 @@ def grant_user_group_permission_to_user_group(
         audit_logger.store_api(
             'user_group.edit.permissions', action_data=action_data,
             user=apiuser)
-
         Session().commit()
+        PermissionModel().flush_user_permission_caches(changes)
+
         return {
             'msg': 'Granted perm: `%s` for user group: `%s` '
                    'in user group: `%s`' % (
@@ -877,8 +885,8 @@ def revoke_user_group_permission_from_user_group(
         audit_logger.store_api(
             'user_group.edit.permissions', action_data=action_data,
             user=apiuser)
-
         Session().commit()
+        PermissionModel().flush_user_permission_caches(changes)
 
         return {
             'msg': 'Revoked perm for user group: '