audit-logs: added action logs for repository groups.
This commit is contained in:
Marcin Kuzminski
parent
dbcc488137
commit
3e76f23368
3 changed files with 67 additions and 39 deletions
|
|
@ -34,6 +34,7 @@ from pylons.i18n.translation import _, ungettext
|
|||
|
||||
from rhodecode.lib import auth
|
||||
from rhodecode.lib import helpers as h
|
||||
from rhodecode.lib import audit_logger
|
||||
from rhodecode.lib.ext_json import json
|
||||
from rhodecode.lib.auth import (
|
||||
LoginRequired, NotAnonymous, HasPermissionAll,
|
||||
|
|
@ -153,9 +154,6 @@ class RepoGroupsController(BaseController):
|
|||
|
||||
@NotAnonymous()
|
||||
def index(self):
|
||||
"""GET /repo_groups: All items in the collection"""
|
||||
# url('repo_groups')
|
||||
|
||||
repo_group_list = RepoGroup.get_all_repo_groups()
|
||||
_perms = ['group.admin']
|
||||
repo_group_list_acl = RepoGroupList(repo_group_list, perm_set=_perms)
|
||||
|
|
@ -168,8 +166,6 @@ class RepoGroupsController(BaseController):
|
|||
@NotAnonymous()
|
||||
@auth.CSRFRequired()
|
||||
def create(self):
|
||||
"""POST /repo_groups: Create a new item"""
|
||||
# url('repo_groups')
|
||||
|
||||
parent_group_id = safe_int(request.POST.get('group_parent_id'))
|
||||
can_create = self._can_create_repo_group(parent_group_id)
|
||||
|
|
@ -183,20 +179,27 @@ class RepoGroupsController(BaseController):
|
|||
try:
|
||||
owner = c.rhodecode_user
|
||||
form_result = repo_group_form.to_python(dict(request.POST))
|
||||
RepoGroupModel().create(
|
||||
repo_group = RepoGroupModel().create(
|
||||
group_name=form_result['group_name_full'],
|
||||
group_description=form_result['group_description'],
|
||||
owner=owner.user_id,
|
||||
copy_permissions=form_result['group_copy_permissions']
|
||||
)
|
||||
Session().commit()
|
||||
repo_group_data = repo_group.get_api_data()
|
||||
_new_group_name = form_result['group_name_full']
|
||||
|
||||
audit_logger.store(
|
||||
action='repo_group.create',
|
||||
action_data={'repo_group_data': repo_group_data},
|
||||
user=c.rhodecode_user, commit=True)
|
||||
|
||||
repo_group_url = h.link_to(
|
||||
_new_group_name,
|
||||
h.route_path('repo_group_home', repo_group_name=_new_group_name))
|
||||
h.flash(h.literal(_('Created repository group %s')
|
||||
% repo_group_url), category='success')
|
||||
# TODO: in future action_logger(, '', '', '', self.sa)
|
||||
|
||||
except formencode.Invalid as errors:
|
||||
return htmlfill.render(
|
||||
render('admin/repo_groups/repo_group_add.mako'),
|
||||
|
|
@ -216,8 +219,6 @@ class RepoGroupsController(BaseController):
|
|||
# perm checks inside
|
||||
@NotAnonymous()
|
||||
def new(self):
|
||||
"""GET /repo_groups/new: Form to create a new item"""
|
||||
# url('new_repo_group')
|
||||
# perm check for admin, create_group perm or admin of parent_group
|
||||
parent_group_id = safe_int(request.GET.get('parent_group'))
|
||||
if not self._can_create_repo_group(parent_group_id):
|
||||
|
|
@ -229,11 +230,6 @@ class RepoGroupsController(BaseController):
|
|||
@HasRepoGroupPermissionAnyDecorator('group.admin')
|
||||
@auth.CSRFRequired()
|
||||
def update(self, group_name):
|
||||
"""PUT /repo_groups/group_name: Update an existing item"""
|
||||
# Forms posted to this method should contain a hidden field:
|
||||
# <input type="hidden" name="_method" value="PUT" />
|
||||
# Or using helpers:
|
||||
# h.form(url('repos_group', group_name=GROUP_NAME), method='put')
|
||||
|
||||
c.repo_group = RepoGroupModel()._get_repo_group(group_name)
|
||||
can_create_in_root = self._can_create_repo_group()
|
||||
|
|
@ -249,16 +245,21 @@ class RepoGroupsController(BaseController):
|
|||
available_groups=c.repo_groups_choices,
|
||||
can_create_in_root=can_create_in_root, allow_disabled=True)()
|
||||
|
||||
old_values = c.repo_group.get_api_data()
|
||||
try:
|
||||
form_result = repo_group_form.to_python(dict(request.POST))
|
||||
gr_name = form_result['group_name']
|
||||
new_gr = RepoGroupModel().update(group_name, form_result)
|
||||
|
||||
audit_logger.store(
|
||||
'repo_group.edit', action_data={'old_data': old_values},
|
||||
user=c.rhodecode_user)
|
||||
|
||||
Session().commit()
|
||||
h.flash(_('Updated repository group %s') % (gr_name,),
|
||||
category='success')
|
||||
# we now have new name !
|
||||
group_name = new_gr.group_name
|
||||
# TODO: in future action_logger(, '', '', '', self.sa)
|
||||
except formencode.Invalid as errors:
|
||||
c.active = 'settings'
|
||||
return htmlfill.render(
|
||||
|
|
@ -278,12 +279,6 @@ class RepoGroupsController(BaseController):
|
|||
@HasRepoGroupPermissionAnyDecorator('group.admin')
|
||||
@auth.CSRFRequired()
|
||||
def delete(self, group_name):
|
||||
"""DELETE /repo_groups/group_name: Delete an existing item"""
|
||||
# Forms posted to this method should contain a hidden field:
|
||||
# <input type="hidden" name="_method" value="DELETE" />
|
||||
# Or using helpers:
|
||||
# h.form(url('repos_group', group_name=GROUP_NAME), method='delete')
|
||||
|
||||
gr = c.repo_group = RepoGroupModel()._get_repo_group(group_name)
|
||||
repos = gr.repositories.all()
|
||||
if repos:
|
||||
|
|
@ -305,11 +300,18 @@ class RepoGroupsController(BaseController):
|
|||
return redirect(url('repo_groups'))
|
||||
|
||||
try:
|
||||
old_values = gr.get_api_data()
|
||||
RepoGroupModel().delete(group_name)
|
||||
|
||||
audit_logger.store(
|
||||
'repo_group.delete',
|
||||
action_data={'old_data': old_values,
|
||||
'source': audit_logger.SOURCE_WEB},
|
||||
user=c.rhodecode_user)
|
||||
|
||||
Session().commit()
|
||||
h.flash(_('Removed repository group %s') % group_name,
|
||||
category='success')
|
||||
# TODO: in future action_logger(, '', '', '', self.sa)
|
||||
except Exception:
|
||||
log.exception("Exception during deletion of repository group")
|
||||
h.flash(_('Error occurred during deletion of repository group %s')
|
||||
|
|
@ -319,8 +321,7 @@ class RepoGroupsController(BaseController):
|
|||
|
||||
@HasRepoGroupPermissionAnyDecorator('group.admin')
|
||||
def edit(self, group_name):
|
||||
"""GET /repo_groups/group_name/edit: Form to edit an existing item"""
|
||||
# url('edit_repo_group', group_name=GROUP_NAME)
|
||||
|
||||
c.active = 'settings'
|
||||
|
||||
c.repo_group = RepoGroupModel()._get_repo_group(group_name)
|
||||
|
|
@ -344,8 +345,6 @@ class RepoGroupsController(BaseController):
|
|||
|
||||
@HasRepoGroupPermissionAnyDecorator('group.admin')
|
||||
def edit_repo_group_advanced(self, group_name):
|
||||
"""GET /repo_groups/group_name/edit: Form to edit an existing item"""
|
||||
# url('edit_repo_group', group_name=GROUP_NAME)
|
||||
c.active = 'advanced'
|
||||
c.repo_group = RepoGroupModel()._get_repo_group(group_name)
|
||||
|
||||
|
|
@ -353,8 +352,6 @@ class RepoGroupsController(BaseController):
|
|||
|
||||
@HasRepoGroupPermissionAnyDecorator('group.admin')
|
||||
def edit_repo_group_perms(self, group_name):
|
||||
"""GET /repo_groups/group_name/edit: Form to edit an existing item"""
|
||||
# url('edit_repo_group', group_name=GROUP_NAME)
|
||||
c.active = 'perms'
|
||||
c.repo_group = RepoGroupModel()._get_repo_group(group_name)
|
||||
self.__load_defaults()
|
||||
|
|
@ -372,8 +369,6 @@ class RepoGroupsController(BaseController):
|
|||
def update_perms(self, group_name):
|
||||
"""
|
||||
Update permissions for given repository group
|
||||
|
||||
:param group_name:
|
||||
"""
|
||||
|
||||
c.repo_group = RepoGroupModel()._get_repo_group(group_name)
|
||||
|
|
@ -391,14 +386,21 @@ class RepoGroupsController(BaseController):
|
|||
# iterate over all members(if in recursive mode) of this groups and
|
||||
# set the permissions !
|
||||
# this can be potentially heavy operation
|
||||
RepoGroupModel().update_permissions(
|
||||
changes = RepoGroupModel().update_permissions(
|
||||
c.repo_group,
|
||||
form['perm_additions'], form['perm_updates'],
|
||||
form['perm_deletions'], form['recursive'])
|
||||
form['perm_additions'], form['perm_updates'], form['perm_deletions'],
|
||||
form['recursive'])
|
||||
|
||||
action_data = {
|
||||
'added': changes['added'],
|
||||
'updated': changes['updated'],
|
||||
'deleted': changes['deleted'],
|
||||
'source': audit_logger.SOURCE_WEB
|
||||
}
|
||||
audit_logger.store(
|
||||
'repo_group.edit.permissions', action_data=action_data,
|
||||
user=c.rhodecode_user)
|
||||
|
||||
# TODO: implement this
|
||||
# action_logger(c.rhodecode_user, 'admin_changed_repo_permissions',
|
||||
# repo_name, self.ip_addr, self.sa)
|
||||
Session().commit()
|
||||
h.flash(_('Repository Group permissions updated'), category='success')
|
||||
return redirect(url('edit_repo_group_perms', group_name=group_name))
|
||||
|
|
|
|||
|
|
@ -42,6 +42,11 @@ ACTIONS = {
|
|||
'repo.delete': {},
|
||||
'repo.commit.strip': {},
|
||||
'repo.archive.download': {},
|
||||
|
||||
'repo_group.create': {},
|
||||
'repo_group.edit': {},
|
||||
'repo_group.edit.permissions': {},
|
||||
'repo_group.delete': {},
|
||||
}
|
||||
|
||||
SOURCE_WEB = 'source_web'
|
||||
|
|
|
|||
|
|
@ -340,6 +340,12 @@ class RepoGroupModel(BaseModel):
|
|||
|
||||
req_perms = ('usergroup.read', 'usergroup.write', 'usergroup.admin')
|
||||
|
||||
changes = {
|
||||
'added': [],
|
||||
'updated': [],
|
||||
'deleted': []
|
||||
}
|
||||
|
||||
def _set_perm_user(obj, user, perm):
|
||||
if isinstance(obj, RepoGroup):
|
||||
self.grant_user_permission(
|
||||
|
|
@ -382,7 +388,6 @@ class RepoGroupModel(BaseModel):
|
|||
repo=obj, group_name=user_group)
|
||||
|
||||
# start updates
|
||||
updates = []
|
||||
log.debug('Now updating permissions for %s in recursive mode:%s',
|
||||
repo_group, recursive)
|
||||
|
||||
|
|
@ -408,10 +413,13 @@ class RepoGroupModel(BaseModel):
|
|||
# in recursive mode
|
||||
obj = repo_group
|
||||
|
||||
change_obj = obj.get_api_data()
|
||||
|
||||
# update permissions
|
||||
for member_id, perm, member_type in perm_updates:
|
||||
member_id = int(member_id)
|
||||
if member_type == 'user':
|
||||
member_name = User.get(member_id).username
|
||||
# this updates also current one if found
|
||||
_set_perm_user(obj, user=member_id, perm=perm)
|
||||
else: # set for user group
|
||||
|
|
@ -420,10 +428,15 @@ class RepoGroupModel(BaseModel):
|
|||
user=cur_user):
|
||||
_set_perm_group(obj, users_group=member_id, perm=perm)
|
||||
|
||||
changes['updated'].append(
|
||||
{'change_obj': change_obj, 'type': member_type,
|
||||
'id': member_id, 'name': member_name, 'new_perm': perm})
|
||||
|
||||
# set new permissions
|
||||
for member_id, perm, member_type in perm_additions:
|
||||
member_id = int(member_id)
|
||||
if member_type == 'user':
|
||||
member_name = User.get(member_id).username
|
||||
_set_perm_user(obj, user=member_id, perm=perm)
|
||||
else: # set for user group
|
||||
# check if we have permissions to alter this usergroup
|
||||
|
|
@ -432,10 +445,15 @@ class RepoGroupModel(BaseModel):
|
|||
user=cur_user):
|
||||
_set_perm_group(obj, users_group=member_id, perm=perm)
|
||||
|
||||
changes['added'].append(
|
||||
{'change_obj': change_obj, 'type': member_type,
|
||||
'id': member_id, 'name': member_name, 'new_perm': perm})
|
||||
|
||||
# delete permissions
|
||||
for member_id, perm, member_type in perm_deletions:
|
||||
member_id = int(member_id)
|
||||
if member_type == 'user':
|
||||
member_name = User.get(member_id).username
|
||||
_revoke_perm_user(obj, user=member_id)
|
||||
else: # set for user group
|
||||
# check if we have permissions to alter this usergroup
|
||||
|
|
@ -444,13 +462,16 @@ class RepoGroupModel(BaseModel):
|
|||
user=cur_user):
|
||||
_revoke_perm_group(obj, user_group=member_id)
|
||||
|
||||
updates.append(obj)
|
||||
changes['deleted'].append(
|
||||
{'change_obj': change_obj, 'type': member_type,
|
||||
'id': member_id, 'name': member_name, 'new_perm': perm})
|
||||
|
||||
# if it's not recursive call for all,repos,groups
|
||||
# break the loop and don't proceed with other changes
|
||||
if recursive not in ['all', 'repos', 'groups']:
|
||||
break
|
||||
|
||||
return updates
|
||||
return changes
|
||||
|
||||
def update(self, repo_group, form_data):
|
||||
try:
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue