750 lines
31 KiB
Python
750 lines
31 KiB
Python
# Copyright (C) 2010-2024 RhodeCode GmbH
|
|
#
|
|
# This program is free software: you can redistribute it and/or modify
|
|
# it under the terms of the GNU Affero General Public License, version 3
|
|
# (only), as published by the Free Software Foundation.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU Affero General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
#
|
|
# This program is dual-licensed. If you wish to learn more about the
|
|
# RhodeCode Enterprise Edition, including its added features, Support services,
|
|
# and proprietary license terms, please see https://rhodecode.com/licenses/
|
|
|
|
import pytest
|
|
|
|
from rhodecode.lib.auth import AuthUser
|
|
from rhodecode.model.db import RepoGroup, User, UserGroupRepoGroupToPerm, Permission, UserToPerm, UserGroupToPerm
|
|
from rhodecode.model.meta import Session
|
|
from rhodecode.model.permission import PermissionModel
|
|
from rhodecode.model.repo import RepoModel
|
|
from rhodecode.model.repo_group import RepoGroupModel
|
|
from rhodecode.model.user import UserModel
|
|
from rhodecode.model.user_group import UserGroupModel
|
|
from rhodecode.tests.fixtures.rc_fixture import Fixture
|
|
|
|
|
|
fixture = Fixture()
|
|
|
|
|
|
@pytest.fixture()
|
|
def repo_name(backend_hg):
|
|
return backend_hg.repo_name
|
|
|
|
|
|
class TestPermissions(object):
|
|
@pytest.fixture(scope="class", autouse=True)
|
|
def default_permissions(self, request, baseapp):
|
|
# recreate default user to get a clean start
|
|
PermissionModel().create_default_user_permissions(user=User.DEFAULT_USER, force=True)
|
|
Session().commit()
|
|
|
|
@pytest.fixture(autouse=True)
|
|
def prepare_users(self, request):
|
|
# TODO: User creation is a duplicate of test_nofitications, check
|
|
# if that can be unified
|
|
self.u1 = UserModel().create_or_update(
|
|
username="u1", password="qweqwe", email="u1@rhodecode.org", firstname="u1", lastname="u1"
|
|
)
|
|
self.u2 = UserModel().create_or_update(
|
|
username="u2", password="qweqwe", email="u2@rhodecode.org", firstname="u2", lastname="u2"
|
|
)
|
|
self.u3 = UserModel().create_or_update(
|
|
username="u3", password="qweqwe", email="u3@rhodecode.org", firstname="u3", lastname="u3"
|
|
)
|
|
self.anon = User.get_default_user()
|
|
self.a1 = UserModel().create_or_update(
|
|
username="a1", password="qweqwe", email="a1@rhodecode.org", firstname="a1", lastname="a1", admin=True
|
|
)
|
|
Session().commit()
|
|
|
|
request.addfinalizer(self.cleanup)
|
|
|
|
def cleanup(self):
|
|
if hasattr(self, "test_repo"):
|
|
RepoModel().delete(repo=self.test_repo)
|
|
Session().commit()
|
|
|
|
if hasattr(self, "g1"):
|
|
RepoGroupModel().delete(self.g1.group_id)
|
|
if hasattr(self, "g2"):
|
|
RepoGroupModel().delete(self.g2.group_id)
|
|
Session().commit()
|
|
|
|
self._clean_repos_and_repo_groups()
|
|
|
|
if hasattr(self, "ug1"):
|
|
UserGroupModel().delete(self.ug1, force=True)
|
|
Session().commit()
|
|
|
|
def _clean_repos_and_repo_groups(self):
|
|
for u in [self.u1, self.u2, self.u3, self.a1]:
|
|
for repo in u.repositories:
|
|
RepoModel().delete(repo, forks="detach")
|
|
|
|
for repo_group in u.repository_groups:
|
|
RepoGroupModel().delete(repo_group)
|
|
|
|
UserModel().delete(u)
|
|
Session().commit()
|
|
|
|
def test_default_perms_set(self, repo_name):
|
|
assert repo_perms(self.u1)[repo_name] == "repository.read"
|
|
new_perm = "repository.write"
|
|
RepoModel().grant_user_permission(repo=repo_name, user=self.u1, perm=new_perm)
|
|
Session().commit()
|
|
assert repo_perms(self.u1)[repo_name] == new_perm
|
|
|
|
def test_default_admin_perms_set(self, repo_name):
|
|
assert repo_perms(self.a1)[repo_name] == "repository.admin"
|
|
RepoModel().grant_user_permission(repo=repo_name, user=self.a1, perm="repository.write")
|
|
Session().commit()
|
|
# cannot really downgrade admins permissions !? they still gets set as
|
|
# admin !
|
|
assert repo_perms(self.a1)[repo_name] == "repository.admin"
|
|
|
|
def test_default_group_perms(self, repo_name):
|
|
self.g1 = fixture.create_repo_group("test1", skip_if_exists=True)
|
|
self.g2 = fixture.create_repo_group("test2", skip_if_exists=True)
|
|
|
|
assert repo_perms(self.u1)[repo_name] == "repository.read"
|
|
assert group_perms(self.u1) == {"test1": "group.read", "test2": "group.read"}
|
|
assert global_perms(self.u1) == set(Permission.DEFAULT_USER_PERMISSIONS)
|
|
|
|
def test_default_admin_group_perms(self, repo_name):
|
|
self.g1 = fixture.create_repo_group("test1", skip_if_exists=True)
|
|
self.g2 = fixture.create_repo_group("test2", skip_if_exists=True)
|
|
|
|
assert repo_perms(self.a1)[repo_name] == "repository.admin"
|
|
assert group_perms(self.a1) == {"test1": "group.admin", "test2": "group.admin"}
|
|
|
|
def test_default_owner_repo_perms(self, backend, user_util, test_repo):
|
|
user = user_util.create_user()
|
|
repo = test_repo("minimal", backend.alias)
|
|
org_owner = repo.user
|
|
assert repo_perms(user)[repo.repo_name] == "repository.read"
|
|
|
|
repo.user = user
|
|
assert repo_perms(user)[repo.repo_name] == "repository.admin"
|
|
repo.user = org_owner
|
|
|
|
def test_default_owner_branch_perms(self, user_util, test_user_group):
|
|
user = user_util.create_user()
|
|
assert branch_perms(user) == {}
|
|
|
|
def test_default_owner_repo_group_perms(self, user_util, test_repo_group):
|
|
user = user_util.create_user()
|
|
org_owner = test_repo_group.user
|
|
|
|
assert group_perms(user)[test_repo_group.group_name] == "group.read"
|
|
|
|
test_repo_group.user = user
|
|
assert group_perms(user)[test_repo_group.group_name] == "group.admin"
|
|
test_repo_group.user = org_owner
|
|
|
|
def test_default_owner_user_group_perms(self, user_util, test_user_group):
|
|
user = user_util.create_user()
|
|
org_owner = test_user_group.user
|
|
|
|
assert user_group_perms(user)[test_user_group.users_group_name] == "usergroup.read"
|
|
|
|
test_user_group.user = user
|
|
assert user_group_perms(user)[test_user_group.users_group_name] == "usergroup.admin"
|
|
|
|
test_user_group.user = org_owner
|
|
|
|
def test_propagated_permissions_from_repo_group_to_private_repo(self, repo_name):
|
|
# make group
|
|
self.g1 = fixture.create_repo_group("TOP_LEVEL", skip_if_exists=True)
|
|
# both perms should be read !
|
|
assert group_perms(self.anon) == {"TOP_LEVEL": "group.read"}
|
|
|
|
# Create repo inside the TOP_LEVEL
|
|
repo_name_in_group = RepoGroup.url_sep().join([self.g1.group_name, "test_perm_on_private_repo"])
|
|
self.test_repo = fixture.create_repo(
|
|
name=repo_name_in_group,
|
|
repo_type="hg",
|
|
repo_group=self.g1,
|
|
cur_user=self.u1,
|
|
)
|
|
assert repo_perms(self.anon)[repo_name_in_group] == "repository.read"
|
|
assert repo_perms(self.anon)["vcs_test_git"] == "repository.read"
|
|
assert repo_perms(self.anon)["vcs_test_hg"] == "repository.read"
|
|
assert repo_perms(self.anon)["vcs_test_svn"] == "repository.read"
|
|
|
|
# Now change default user permissions
|
|
new_perm = "repository.write"
|
|
perm_updates = [[self.anon.user_id, new_perm, "user"]]
|
|
RepoGroupModel().update_permissions(repo_group=self.g1, perm_updates=perm_updates, recursive="all")
|
|
|
|
Session().commit()
|
|
assert repo_perms(self.anon)[repo_name_in_group] == new_perm
|
|
assert repo_perms(self.anon)["vcs_test_git"] == "repository.read"
|
|
assert repo_perms(self.anon)["vcs_test_hg"] == "repository.read"
|
|
assert repo_perms(self.anon)["vcs_test_svn"] == "repository.read"
|
|
|
|
# NOW MARK repo as private
|
|
changes = {"repo_private": True}
|
|
repo = RepoModel().get_by_repo_name(repo_name_in_group)
|
|
RepoModel().update(repo, **changes)
|
|
Session().commit()
|
|
|
|
# Private repo sets 'none' permission for default user
|
|
assert repo_perms(self.anon)[repo_name_in_group] == "repository.none"
|
|
assert repo_perms(self.anon)["vcs_test_git"] == "repository.read"
|
|
assert repo_perms(self.anon)["vcs_test_hg"] == "repository.read"
|
|
assert repo_perms(self.anon)["vcs_test_svn"] == "repository.read"
|
|
|
|
# apply same logic of "updated" recursive, but now the anon permissions should be not be impacted
|
|
new_perm = "repository.write"
|
|
perm_updates = [[self.anon.user_id, new_perm, "user"]]
|
|
RepoGroupModel().update_permissions(repo_group=self.g1, perm_updates=perm_updates, recursive="all")
|
|
|
|
Session().commit()
|
|
assert repo_perms(self.anon)[repo_name_in_group] == "repository.none"
|
|
assert repo_perms(self.anon)["vcs_test_git"] == "repository.read"
|
|
assert repo_perms(self.anon)["vcs_test_hg"] == "repository.read"
|
|
assert repo_perms(self.anon)["vcs_test_svn"] == "repository.read"
|
|
|
|
def test_propagated_permission_from_users_group_by_explicit_perms_exist(self, repo_name):
|
|
# make group
|
|
self.ug1 = fixture.create_user_group("G1")
|
|
UserGroupModel().add_user_to_group(self.ug1, self.u1)
|
|
|
|
# set permission to lower
|
|
new_perm = "repository.none"
|
|
RepoModel().grant_user_permission(repo=repo_name, user=self.u1, perm=new_perm)
|
|
Session().commit()
|
|
assert repo_perms(self.u1)[repo_name] == new_perm
|
|
|
|
# grant perm for group this should not override permission from user
|
|
# since it has explicitly set
|
|
new_perm_gr = "repository.write"
|
|
RepoModel().grant_user_group_permission(repo=repo_name, group_name=self.ug1, perm=new_perm_gr)
|
|
Session().commit()
|
|
|
|
assert repo_perms(self.u1)[repo_name] == new_perm
|
|
assert group_perms(self.u1) == {}
|
|
|
|
def test_propagated_permission_from_users_group(self, repo_name):
|
|
# make group
|
|
self.ug1 = fixture.create_user_group("G1")
|
|
UserGroupModel().add_user_to_group(self.ug1, self.u3)
|
|
|
|
# grant perm for group
|
|
# this should override default permission from user
|
|
new_perm_gr = "repository.write"
|
|
RepoModel().grant_user_group_permission(repo=repo_name, group_name=self.ug1, perm=new_perm_gr)
|
|
Session().commit()
|
|
|
|
assert repo_perms(self.u3)[repo_name] == new_perm_gr
|
|
assert group_perms(self.u3) == {}
|
|
|
|
def test_propagated_permission_from_users_group_lower_weight(self, repo_name):
|
|
# make group with user
|
|
self.ug1 = fixture.create_user_group("G1")
|
|
UserGroupModel().add_user_to_group(self.ug1, self.u1)
|
|
|
|
# set permission to lower
|
|
new_perm_h = "repository.write"
|
|
RepoModel().grant_user_permission(repo=repo_name, user=self.u1, perm=new_perm_h)
|
|
Session().commit()
|
|
|
|
assert repo_perms(self.u1)[repo_name] == new_perm_h
|
|
|
|
# grant perm for group this should NOT override permission from user
|
|
# since it's lower than granted
|
|
new_perm_l = "repository.read"
|
|
RepoModel().grant_user_group_permission(repo=repo_name, group_name=self.ug1, perm=new_perm_l)
|
|
Session().commit()
|
|
|
|
assert repo_perms(self.u1)[repo_name] == new_perm_h
|
|
assert group_perms(self.u1) == {}
|
|
|
|
def test_repo_in_group_permissions(self):
|
|
self.g1 = fixture.create_repo_group("group1", skip_if_exists=True)
|
|
self.g2 = fixture.create_repo_group("group2", skip_if_exists=True)
|
|
# both perms should be read !
|
|
assert group_perms(self.u1) == {"group1": "group.read", "group2": "group.read"}
|
|
|
|
assert group_perms(self.anon) == {"group1": "group.read", "group2": "group.read"}
|
|
|
|
# Change perms to none for both groups
|
|
RepoGroupModel().grant_user_permission(repo_group=self.g1, user=self.anon, perm="group.none")
|
|
RepoGroupModel().grant_user_permission(repo_group=self.g2, user=self.anon, perm="group.none")
|
|
|
|
assert group_perms(self.u1) == {"group1": "group.none", "group2": "group.none"}
|
|
assert group_perms(self.anon) == {"group1": "group.none", "group2": "group.none"}
|
|
|
|
# add repo to group
|
|
name = RepoGroup.url_sep().join([self.g1.group_name, "test_perm"])
|
|
self.test_repo = fixture.create_repo(
|
|
name=name,
|
|
repo_type="hg",
|
|
repo_group=self.g1,
|
|
cur_user=self.u1,
|
|
)
|
|
|
|
assert group_perms(self.u1) == {"group1": "group.none", "group2": "group.none"}
|
|
assert group_perms(self.anon) == {"group1": "group.none", "group2": "group.none"}
|
|
|
|
# grant permission for u2 !
|
|
RepoGroupModel().grant_user_permission(repo_group=self.g1, user=self.u2, perm="group.read")
|
|
RepoGroupModel().grant_user_permission(repo_group=self.g2, user=self.u2, perm="group.read")
|
|
Session().commit()
|
|
assert self.u1 != self.u2
|
|
|
|
# u1 and anon should have not change perms while u2 should !
|
|
assert group_perms(self.u1) == {"group1": "group.none", "group2": "group.none"}
|
|
assert group_perms(self.u2) == {"group1": "group.read", "group2": "group.read"}
|
|
assert group_perms(self.anon) == {"group1": "group.none", "group2": "group.none"}
|
|
|
|
def test_repo_group_user_as_user_group_member(self):
|
|
# create Group1
|
|
self.g1 = fixture.create_repo_group("group1", skip_if_exists=True)
|
|
assert group_perms(self.anon) == {"group1": "group.read"}
|
|
|
|
# set default permission to none
|
|
RepoGroupModel().grant_user_permission(repo_group=self.g1, user=self.anon, perm="group.none")
|
|
Session().commit()
|
|
|
|
# make group
|
|
self.ug1 = fixture.create_user_group("G1")
|
|
# add user to group
|
|
UserGroupModel().add_user_to_group(self.ug1, self.u1)
|
|
Session().commit()
|
|
|
|
# check if user is in the group
|
|
ug1 = UserGroupModel().get(self.ug1.users_group_id)
|
|
members = [x.user_id for x in ug1.members]
|
|
assert members == [self.u1.user_id]
|
|
# add some user to that group
|
|
|
|
# check his permissions
|
|
assert group_perms(self.anon) == {"group1": "group.none"}
|
|
assert group_perms(self.u1) == {"group1": "group.none"}
|
|
|
|
# grant ug1 read permissions for
|
|
RepoGroupModel().grant_user_group_permission(repo_group=self.g1, group_name=self.ug1, perm="group.read")
|
|
Session().commit()
|
|
|
|
# check if the
|
|
obj = (
|
|
Session()
|
|
.query(UserGroupRepoGroupToPerm)
|
|
.filter(UserGroupRepoGroupToPerm.group == self.g1)
|
|
.filter(UserGroupRepoGroupToPerm.users_group == self.ug1)
|
|
.scalar()
|
|
)
|
|
assert obj.permission.permission_name == "group.read"
|
|
|
|
assert group_perms(self.anon) == {"group1": "group.none"}
|
|
assert group_perms(self.u1) == {"group1": "group.read"}
|
|
|
|
def test_inherited_permissions_from_default_on_user_enabled(self):
|
|
# enable fork and create on default user
|
|
_form_result = {"default_repo_create": "hg.create.repository", "default_fork_create": "hg.fork.repository"}
|
|
PermissionModel().set_new_user_perms(User.get_default_user(), _form_result)
|
|
Session().commit()
|
|
|
|
# make sure inherit flag is turned on
|
|
self.u1.inherit_default_permissions = True
|
|
Session().commit()
|
|
|
|
# this user will have inherited permissions from default user
|
|
assert global_perms(self.u1) == default_perms()
|
|
|
|
def test_inherited_permissions_from_default_on_user_disabled(self):
|
|
# disable fork and create on default user
|
|
_form_result = {"default_repo_create": "hg.create.none", "default_fork_create": "hg.fork.none"}
|
|
PermissionModel().set_new_user_perms(User.get_default_user(), _form_result)
|
|
Session().commit()
|
|
|
|
# make sure inherit flag is turned on
|
|
self.u1.inherit_default_permissions = True
|
|
Session().commit()
|
|
|
|
# this user will have inherited permissions from default user
|
|
expected_perms = default_perms(
|
|
added=["hg.create.none", "hg.fork.none"], removed=["hg.create.repository", "hg.fork.repository"]
|
|
)
|
|
assert global_perms(self.u1) == expected_perms
|
|
|
|
def test_non_inherited_permissions_from_default_on_user_enabled(self):
|
|
user_model = UserModel()
|
|
# enable fork and create on default user
|
|
usr = User.DEFAULT_USER
|
|
user_model.revoke_perm(usr, "hg.create.none")
|
|
user_model.grant_perm(usr, "hg.create.repository")
|
|
user_model.revoke_perm(usr, "hg.fork.none")
|
|
user_model.grant_perm(usr, "hg.fork.repository")
|
|
|
|
# disable global perms on specific user
|
|
user_model.revoke_perm(self.u1, "hg.create.repository")
|
|
user_model.grant_perm(self.u1, "hg.create.none")
|
|
user_model.revoke_perm(self.u1, "hg.fork.repository")
|
|
user_model.grant_perm(self.u1, "hg.fork.none")
|
|
|
|
# TODO(marcink): check branch permissions now ?
|
|
|
|
# make sure inherit flag is turned off
|
|
self.u1.inherit_default_permissions = False
|
|
Session().commit()
|
|
|
|
# this user will have non inherited permissions from he's
|
|
# explicitly set permissions
|
|
assert global_perms(self.u1) == {
|
|
"hg.create.none",
|
|
"hg.fork.none",
|
|
"hg.register.manual_activate",
|
|
"hg.password_reset.enabled",
|
|
"hg.extern_activate.auto",
|
|
"repository.read",
|
|
"group.read",
|
|
"usergroup.read",
|
|
"branch.push_force",
|
|
}
|
|
|
|
def test_non_inherited_permissions_from_default_on_user_disabled(self):
|
|
user_model = UserModel()
|
|
# disable fork and create on default user
|
|
usr = User.DEFAULT_USER
|
|
user_model.revoke_perm(usr, "hg.create.repository")
|
|
user_model.grant_perm(usr, "hg.create.none")
|
|
user_model.revoke_perm(usr, "hg.fork.repository")
|
|
user_model.grant_perm(usr, "hg.fork.none")
|
|
|
|
# enable global perms on specific user
|
|
user_model.revoke_perm(self.u1, "hg.create.none")
|
|
user_model.grant_perm(self.u1, "hg.create.repository")
|
|
user_model.revoke_perm(self.u1, "hg.fork.none")
|
|
user_model.grant_perm(self.u1, "hg.fork.repository")
|
|
|
|
# make sure inherit flag is turned off
|
|
self.u1.inherit_default_permissions = False
|
|
Session().commit()
|
|
|
|
# TODO(marcink): check branch perms
|
|
|
|
# this user will have non inherited permissions from he's
|
|
# explicitly set permissions
|
|
assert global_perms(self.u1) == {
|
|
"hg.create.repository",
|
|
"hg.fork.repository",
|
|
"hg.register.manual_activate",
|
|
"hg.password_reset.enabled",
|
|
"hg.extern_activate.auto",
|
|
"repository.read",
|
|
"group.read",
|
|
"usergroup.read",
|
|
"branch.push_force",
|
|
}
|
|
|
|
@pytest.mark.parametrize(
|
|
"perm, expected_perm",
|
|
[
|
|
(
|
|
"hg.inherit_default_perms.false",
|
|
"repository.none",
|
|
),
|
|
(
|
|
"hg.inherit_default_perms.true",
|
|
"repository.read",
|
|
),
|
|
],
|
|
)
|
|
def test_inherited_permissions_on_objects(self, perm, expected_perm):
|
|
_form_result = {
|
|
"default_inherit_default_permissions": perm,
|
|
}
|
|
PermissionModel().set_new_user_perms(User.get_default_user(), _form_result)
|
|
Session().commit()
|
|
|
|
# make sure inherit flag is turned on
|
|
self.u1.inherit_default_permissions = True
|
|
Session().commit()
|
|
|
|
# TODO(marcink): check branch perms
|
|
|
|
# this user will have inherited permissions from default user
|
|
assert global_perms(self.u1) == {
|
|
"hg.create.none",
|
|
"hg.fork.none",
|
|
"hg.register.manual_activate",
|
|
"hg.password_reset.enabled",
|
|
"hg.extern_activate.auto",
|
|
"repository.read",
|
|
"group.read",
|
|
"usergroup.read",
|
|
"branch.push_force",
|
|
"hg.create.write_on_repogroup.true",
|
|
"hg.usergroup.create.false",
|
|
"hg.repogroup.create.false",
|
|
perm,
|
|
}
|
|
|
|
assert set(repo_perms(self.u1).values()) == set([expected_perm])
|
|
|
|
def test_repo_owner_permissions_not_overwritten_by_group(self):
|
|
# create repo as USER,
|
|
self.test_repo = fixture.create_repo(name="myownrepo", repo_type="hg", cur_user=self.u1)
|
|
|
|
# he has permissions of admin as owner
|
|
assert repo_perms(self.u1)["myownrepo"] == "repository.admin"
|
|
|
|
# set his permission as user group, he should still be admin
|
|
self.ug1 = fixture.create_user_group("G1")
|
|
UserGroupModel().add_user_to_group(self.ug1, self.u1)
|
|
RepoModel().grant_user_group_permission(self.test_repo, group_name=self.ug1, perm="repository.none")
|
|
Session().commit()
|
|
|
|
assert repo_perms(self.u1)["myownrepo"] == "repository.admin"
|
|
|
|
def test_repo_owner_permissions_not_overwritten_by_others(self):
|
|
# create repo as USER,
|
|
self.test_repo = fixture.create_repo(name="myownrepo", repo_type="hg", cur_user=self.u1)
|
|
|
|
# he has permissions of admin as owner
|
|
assert repo_perms(self.u1)["myownrepo"] == "repository.admin"
|
|
|
|
# set his permission as user, he should still be admin
|
|
RepoModel().grant_user_permission(self.test_repo, user=self.u1, perm="repository.none")
|
|
Session().commit()
|
|
|
|
assert repo_perms(self.u1)["myownrepo"] == "repository.admin"
|
|
|
|
def test_repo_group_owner_permissions_not_overwritten_by_group(self):
|
|
# "u1" shall be owner without any special permission assigned
|
|
self.g1 = fixture.create_repo_group("test1")
|
|
|
|
# Make user group and grant a permission to user group
|
|
self.ug1 = fixture.create_user_group("G1")
|
|
UserGroupModel().add_user_to_group(self.ug1, self.u1)
|
|
RepoGroupModel().grant_user_group_permission(repo_group=self.g1, group_name=self.ug1, perm="group.write")
|
|
Session().commit()
|
|
|
|
# Verify that user does not get any special permission if he is not
|
|
# owner
|
|
assert group_perms(self.u1) == {"test1": "group.write"}
|
|
|
|
# Make him owner of the repo group
|
|
self.g1.user = self.u1
|
|
assert group_perms(self.u1) == {"test1": "group.admin"}
|
|
|
|
def test_repo_group_owner_permissions_not_overwritten_by_others(self):
|
|
# "u1" shall be owner without any special permission assigned
|
|
self.g1 = fixture.create_repo_group("test1")
|
|
RepoGroupModel().grant_user_permission(repo_group=self.g1, user=self.u1, perm="group.write")
|
|
Session().commit()
|
|
|
|
# Verify that user does not get any special permission if he is not
|
|
# owner
|
|
assert group_perms(self.u1) == {"test1": "group.write"}
|
|
|
|
# Make him owner of the repo group
|
|
self.g1.user = self.u1
|
|
assert group_perms(self.u1) == {"test1": "group.admin"}
|
|
|
|
def assert_user_perm_equal(self, user, change_factor=0, compare_keys=None):
|
|
perms = UserToPerm.query().filter(UserToPerm.user == user).all()
|
|
assert len(perms) == len(Permission.DEFAULT_USER_PERMISSIONS) + change_factor
|
|
if compare_keys:
|
|
assert set(x.permissions.permission_name for x in perms) == compare_keys
|
|
|
|
def assert_def_user_group_perm_equal(self, user_group, change_factor=0, compare_keys=None):
|
|
perms = UserGroupToPerm.query().filter(UserGroupToPerm.users_group == user_group).all()
|
|
assert len(perms) == len(Permission.DEFAULT_USER_PERMISSIONS) + change_factor
|
|
if compare_keys:
|
|
assert set(x.permissions.permission_name for x in perms) == compare_keys
|
|
|
|
def test_set_default_permissions(self):
|
|
PermissionModel().create_default_user_permissions(user=self.u1)
|
|
self.assert_user_perm_equal(user=self.u1)
|
|
|
|
def test_set_default_permissions_after_one_is_missing(self):
|
|
PermissionModel().create_default_user_permissions(user=self.u1)
|
|
self.assert_user_perm_equal(user=self.u1)
|
|
# now we delete one, it should be re-created after another call
|
|
perms = UserToPerm.query().filter(UserToPerm.user == self.u1).all()
|
|
Session().delete(perms[0])
|
|
Session().commit()
|
|
|
|
self.assert_user_perm_equal(user=self.u1, change_factor=-1)
|
|
|
|
# create missing one !
|
|
PermissionModel().create_default_user_permissions(user=self.u1)
|
|
self.assert_user_perm_equal(user=self.u1)
|
|
|
|
@pytest.mark.parametrize(
|
|
"perm, modify_to",
|
|
[
|
|
("repository.read", "repository.none"),
|
|
("group.read", "group.none"),
|
|
("usergroup.read", "usergroup.none"),
|
|
("hg.create.repository", "hg.create.none"),
|
|
("hg.fork.repository", "hg.fork.none"),
|
|
(
|
|
"hg.register.manual_activate",
|
|
"hg.register.auto_activate",
|
|
),
|
|
],
|
|
)
|
|
def test_set_default_permissions_after_modification(self, perm, modify_to):
|
|
PermissionModel().create_default_user_permissions(user=self.u1)
|
|
self.assert_user_perm_equal(user=self.u1)
|
|
|
|
old = Permission.get_by_key(perm)
|
|
new = Permission.get_by_key(modify_to)
|
|
assert old is not None
|
|
assert new is not None
|
|
|
|
# now modify permissions
|
|
p = UserToPerm.query().filter(UserToPerm.user == self.u1).filter(UserToPerm.permission == old).one()
|
|
p.permission = new
|
|
Session().add(p)
|
|
Session().commit()
|
|
|
|
PermissionModel().create_default_user_permissions(user=self.u1)
|
|
self.assert_user_perm_equal(user=self.u1)
|
|
|
|
def test_clear_user_perms(self):
|
|
PermissionModel().create_default_user_permissions(user=self.u1)
|
|
self.assert_user_perm_equal(user=self.u1)
|
|
|
|
# now clear permissions
|
|
cleared = PermissionModel()._clear_user_perms(self.u1.user_id)
|
|
self.assert_user_perm_equal(user=self.u1, change_factor=len(cleared) * -1)
|
|
|
|
def test_clear_user_group_perms(self):
|
|
self.ug1 = fixture.create_user_group("G1")
|
|
PermissionModel().create_default_user_group_permissions(user_group=self.ug1)
|
|
self.assert_def_user_group_perm_equal(user_group=self.ug1)
|
|
|
|
# now clear permissions
|
|
cleared = PermissionModel()._clear_user_group_perms(self.ug1.users_group_id)
|
|
self.assert_def_user_group_perm_equal(user_group=self.ug1, change_factor=len(cleared) * -1)
|
|
|
|
@pytest.mark.parametrize(
|
|
"form_result",
|
|
[
|
|
{},
|
|
{"default_repo_create": "hg.create.repository"},
|
|
{"default_repo_create": "hg.create.repository", "default_repo_perm": "repository.read"},
|
|
{
|
|
"default_repo_create": "hg.create.none",
|
|
"default_repo_perm": "repository.write",
|
|
"default_fork_create": "hg.fork.none",
|
|
},
|
|
],
|
|
)
|
|
def test_set_new_user_permissions(self, form_result):
|
|
_form_result = {}
|
|
_form_result.update(form_result)
|
|
PermissionModel().set_new_user_perms(self.u1, _form_result)
|
|
Session().commit()
|
|
change_factor = -1 * (len(Permission.DEFAULT_USER_PERMISSIONS) - len(form_result.keys()))
|
|
self.assert_user_perm_equal(self.u1, change_factor=change_factor)
|
|
|
|
@pytest.mark.parametrize(
|
|
"form_result",
|
|
[
|
|
{},
|
|
{"default_repo_create": "hg.create.repository"},
|
|
{"default_repo_create": "hg.create.repository", "default_repo_perm": "repository.read"},
|
|
{
|
|
"default_repo_create": "hg.create.none",
|
|
"default_repo_perm": "repository.write",
|
|
"default_fork_create": "hg.fork.none",
|
|
},
|
|
],
|
|
)
|
|
def test_set_new_user_group_permissions(self, form_result):
|
|
_form_result = {}
|
|
_form_result.update(form_result)
|
|
self.ug1 = fixture.create_user_group("G1")
|
|
PermissionModel().set_new_user_group_perms(self.ug1, _form_result)
|
|
Session().commit()
|
|
change_factor = -1 * (len(Permission.DEFAULT_USER_PERMISSIONS) - len(form_result.keys()))
|
|
self.assert_def_user_group_perm_equal(self.ug1, change_factor=change_factor)
|
|
|
|
@pytest.mark.parametrize(
|
|
"group_active, expected_perm",
|
|
[
|
|
(True, "repository.admin"),
|
|
(False, "repository.read"),
|
|
],
|
|
)
|
|
def test_get_default_repo_perms_from_user_group_with_active_group(
|
|
self, backend, user_util, group_active, expected_perm
|
|
):
|
|
repo = backend.create_repo()
|
|
user = user_util.create_user()
|
|
user_group = user_util.create_user_group(members=[user], users_group_active=group_active)
|
|
|
|
user_util.grant_user_group_permission_to_repo(repo, user_group, "repository.admin")
|
|
permissions = repo_perms(user)
|
|
repo_permission = permissions.get(repo.repo_name)
|
|
assert repo_permission == expected_perm
|
|
|
|
@pytest.mark.parametrize("group_active, expected_perm", [(True, "group.admin"), (False, "group.read")])
|
|
def test_get_default_group_perms_from_user_group_with_active_group(self, user_util, group_active, expected_perm):
|
|
user = user_util.create_user()
|
|
repo_group = user_util.create_repo_group()
|
|
user_group = user_util.create_user_group(members=[user], users_group_active=group_active)
|
|
|
|
user_util.grant_user_group_permission_to_repo_group(repo_group, user_group, "group.admin")
|
|
permissions = group_perms(user)
|
|
group_permission = permissions.get(repo_group.name)
|
|
assert group_permission == expected_perm
|
|
|
|
@pytest.mark.parametrize("group_active, expected_perm", [(True, "usergroup.admin"), (False, "usergroup.read")])
|
|
def test_get_default_user_group_perms_from_user_group_with_active_group(
|
|
self, user_util, group_active, expected_perm
|
|
):
|
|
user = user_util.create_user()
|
|
user_group = user_util.create_user_group(members=[user], users_group_active=group_active)
|
|
target_user_group = user_util.create_user_group()
|
|
|
|
user_util.grant_user_group_permission_to_user_group(target_user_group, user_group, "usergroup.admin")
|
|
permissions = user_group_perms(user)
|
|
group_permission = permissions.get(target_user_group.users_group_name)
|
|
assert group_permission == expected_perm
|
|
|
|
|
|
def repo_perms(user):
|
|
auth_user = AuthUser(user_id=user.user_id)
|
|
return auth_user.permissions["repositories"]
|
|
|
|
|
|
def branch_perms(user):
|
|
auth_user = AuthUser(user_id=user.user_id)
|
|
return auth_user.permissions["repository_branches"]
|
|
|
|
|
|
def group_perms(user):
|
|
auth_user = AuthUser(user_id=user.user_id)
|
|
return auth_user.permissions["repositories_groups"]
|
|
|
|
|
|
def user_group_perms(user):
|
|
auth_user = AuthUser(user_id=user.user_id)
|
|
return auth_user.permissions["user_groups"]
|
|
|
|
|
|
def global_perms(user):
|
|
auth_user = AuthUser(user_id=user.user_id)
|
|
return auth_user.permissions["global"]
|
|
|
|
|
|
def default_perms(added=None, removed=None):
|
|
expected_perms = set(Permission.DEFAULT_USER_PERMISSIONS)
|
|
if removed:
|
|
expected_perms.difference_update(removed)
|
|
if added:
|
|
expected_perms.update(added)
|
|
return expected_perms
|