source: main/waeup.kofa/branches/uli-py3/src/waeup/kofa/permissions.py @ 17650

Last change on this file since 17650 was 15970, checked in by Henrik Bettermann, 5 years ago

Don't allow students to add former courses in course lists.

  • Property svn:eol-style set to native
  • Property svn:keywords set to Id
File size: 28.8 KB
Line 
1# $Id: permissions.py 15970 2020-01-31 12:12:17Z henrik $
2#
3# Copyright (C) 2011 Uli Fouquet & Henrik Bettermann
4# This program is free software; you can redistribute it and/or modify
5# it under the terms of the GNU General Public License as published by
6# the Free Software Foundation; either version 2 of the License, or
7# (at your option) any later version.
8#
9# This program is distributed in the hope that it will be useful,
10# but WITHOUT ANY WARRANTY; without even the implied warranty of
11# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
12# GNU General Public License for more details.
13#
14# You should have received a copy of the GNU General Public License
15# along with this program; if not, write to the Free Software
16# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
17#
18import grok
19from zope.component import getUtilitiesFor
20from zope.interface import Interface
21from zope.securitypolicy.interfaces import IRole, IPrincipalRoleMap
22from waeup.kofa.interfaces import ILocalRolesAssignable
23
24
25class Public(grok.Permission):
26    """The Public or everyone-can-do-this-permission is being applied
27    to views/pages that are used by everyone.
28    """
29    grok.name('waeup.Public')
30
31
32class Anonymous(grok.Permission):
33    """The Anonymous permission is applied to
34    views/pages which are dedicated to anonymous users only.
35    Logged-in users can't access these views.
36    """
37    grok.name('waeup.Anonymous')
38
39
40class Authenticated(grok.Permission):
41    """The Authenticated permission is applied to pages
42    which can only be used by logged-in users and not by anonymous users.
43    """
44    grok.name('waeup.Authenticated')
45
46
47class ViewAcademics(grok.Permission):
48    """The ViewAcademics permission is applied to all
49    views of the Academic Section. Users with this permission can view but
50    not edit content in the Academic Section.
51    """
52    grok.name('waeup.viewAcademics')
53
54
55class ManageAcademics(grok.Permission):
56    """The ManageAcademics permission is applied to all edit/manage
57    pages in the Academic Section. Users who have this permission
58    can change/edit context objects.
59    """
60    grok.name('waeup.manageAcademics')
61
62
63class ManagePortal(grok.Permission):
64    """The ManagePortal permission is used for very few pages
65    (e.g. the DatacenterSettings page). Only PortalManagers have this
66    permission. It is furthermore used to control delete methods of container
67    pages in the Academic Section. The ManageAcademics permission,
68    described above, does enable users to edit content but not to
69    remove sub-containers, like faculties, departments or certificates.
70    Users must have the ManagePortal permission too to remove
71    entire containers.
72    """
73    grok.name('waeup.managePortal')
74
75
76class ManageUsers(grok.Permission):
77    """The ManageUsers permission is a real superuser permission
78    and therefore very 'dangerous'. It allows to add, remove or edit
79    user accounts. Editing a user account includes the option to assign
80    or remove roles. That means that a user with this permission can lock out
81    other users by either removing their account or by removing
82    permissions.
83    """
84    grok.name('waeup.manageUsers')
85
86
87class ShowStudents(grok.Permission):
88    """Users with this permission do not neccessarily see the 'Students' tab
89    but they can search for students at department, certificate or course
90    level. If they additionally have the ExportData permission they can
91    export the data as csv files.
92
93    Bursary or Department Officers don't have the ExportData
94    permission (see Roles section) and are only allowed to export bursary
95    or payments overview data respectively.
96    """
97    grok.name('waeup.showStudents')
98
99
100class ClearAllStudents(grok.Permission):
101    """The ClearAllStudents permission allows to clear all students
102    in a department at one sweep.
103    """
104    grok.name('waeup.clearAllStudents')
105
106
107class EditScores(grok.Permission):
108    """The EditScores permission allows to edit scores in course tickets.
109    """
110    grok.name('waeup.editScores')
111
112
113class TriggerTransition(grok.Permission):
114    """The TriggerTransition permission allows to trigger workflow transitions
115    of student and document objects.
116    """
117    grok.name('waeup.triggerTransition')
118
119
120class EditUser(grok.Permission):
121    """The EditUser permission is required for editing
122    single user accounts.
123    """
124    grok.name('waeup.editUser')
125
126
127class ManageDataCenter(grok.Permission):
128    """The ManageDataCenter permission allows to access all pages
129    in the Data Center and to upload files. It does not automatically
130    allow to process uploaded data files.
131    """
132    grok.name('waeup.manageDataCenter')
133
134
135class ImportData(grok.Permission):
136    """The ImportData permission allows to batch process (import) any kind of
137    portal data except for user data. The User Data processor
138    requires also the ManageUsers permission.
139    """
140    grok.name('waeup.importData')
141
142
143class ExportData(grok.Permission):
144    """The ExportData permission allows to export any kind of portal data.
145    """
146    grok.name('waeup.exportData')
147
148
149class ExportPaymentsOverview(grok.Permission):
150    """Department Officers don't have the general exportData
151    permission and are only allowed to export payments overviews.
152    The ExportPaymentsOverview permission is only used to filter the
153    respective exporters in the ExportJobContainerJobConfig view.
154    """
155    grok.name('waeup.exportPaymentsOverview')
156
157
158class ExportBursaryData(grok.Permission):
159    """Bursary Officers don't have the general exportData
160    permission and are only allowed to export bursary data.
161    The ExportBursaryData permission is only used to filter the
162    respective exporter in the ExportJobContainerJobConfig view.
163    """
164    grok.name('waeup.exportBursaryData')
165
166
167class ManagePortalConfiguration(grok.Permission):
168    """The ManagePortalConfiguration permission allows to
169    edit global and sessional portal configuration data.
170    """
171    grok.name('waeup.managePortalConfiguration')
172
173
174class ManageACBatches(grok.Permission):
175    """The ManageACBatches permission allows to view and
176    manage accesscodes.
177    """
178    grok.name('waeup.manageACBatches')
179
180
181class PutBiometricDataPermission(grok.Permission):
182    """This permission allows to upload/change biometric data.
183    """
184    grok.name('waeup.putBiometricData')
185
186
187class GetBiometricDataPermission(grok.Permission):
188    """This permission allows to read biometric data.
189    """
190    grok.name('waeup.getBiometricData')
191
192
193# Local Roles
194
195class ApplicationsManager(grok.Role):
196    """The local ApplicationsManager role can be assigned at applicants
197    container and at department level. At department level an Applications
198    Manager can manage all applicants which desire to study a programme
199    offered by the department (1st Choice Course of Study).
200
201    At container level (local) Applications Managers gain permissions which
202    allow to manage the container and all applicants inside the container.  At
203    container level the permission set of this local role corresonds with the
204    permission set of the same-named global role.
205    """
206    grok.name('waeup.local.ApplicationsManager')
207    grok.title(u'Applications Manager')
208    grok.permissions('waeup.viewAcademics',
209                     'waeup.manageApplication', 'waeup.viewApplication',
210                     'waeup.payApplicant')
211
212
213class DepartmentOfficer(grok.Role):
214    """The local DepartmentOfficer role can be assigned at faculty or
215    department level. The role allows to list all student data within the
216    faculty/department the local role is assigned. And it allows to export
217    payment data overviews.
218    """
219    grok.name('waeup.local.DepartmentOfficer')
220    grok.title(u'Department Officer')
221    grok.permissions('waeup.showStudents',
222                     'waeup.viewAcademics',
223                     'waeup.exportPaymentsOverview')
224
225
226class DepartmentManager(grok.Role):
227    """The local DepartmentManager role can be assigned at faculty or
228    department level. The role allows to edit all data within this container.
229    It does not automatically allow to remove sub-containers.
230
231    Department Managers (Dean of Faculty or Head of Department respectively)
232    can also list student data but not access student pages.
233    """
234    grok.name('waeup.local.DepartmentManager')
235    grok.title(u'Department Manager')
236    grok.permissions('waeup.manageAcademics',
237                     'waeup.showStudents',
238                     'waeup.exportData')
239
240
241class ClearanceOfficer(grok.Role):
242    """The local ClearanceOfficer role can be assigned at faculty or
243    department level. The role allows to list or export all student
244    data within the faculty/department the local role is assigned.
245
246    Clearance Officers can furthermore clear all students or reject clearance
247    of all students in their faculty/department. They get the
248    StudentsClearanceOfficer role for this subset of students.
249    """
250    grok.name('waeup.local.ClearanceOfficer')
251    grok.title(u'Clearance Officer')
252    grok.permissions('waeup.showStudents',
253                     'waeup.viewAcademics',
254                     'waeup.exportData',
255                     'waeup.clearAllStudents')
256
257
258class LocalStudentsManager(grok.Role):
259    """The local LocalStudentsManager role can be assigned at faculty or
260    department level. The role allows to view all data and to view or export
261    all student data within the faculty/department the local role is assigned.
262
263    Local Students Managers can furthermore manage data of students
264    in their faculty/department. They get the StudentsManager role for
265    this subset of students.
266    """
267    grok.name('waeup.local.LocalStudentsManager')
268    grok.title(u'Students Manager')
269    grok.permissions('waeup.showStudents',
270                     'waeup.viewAcademics',
271                     'waeup.exportData')
272
273
274class LocalWorkflowManager(grok.Role):
275    """The local LocalWorkflowManager role can be assigned at faculty level.
276    The role allows to view all data and to list or export
277    all student data within the faculty the local role is assigned.
278
279    Local Workflow Managers can trigger transition of students in their
280    faculty/department. They get the WorkflowManager role for
281    this subset of students.
282    """
283    grok.name('waeup.local.LocalWorkflowManager')
284    grok.title(u'Student Workflow Manager')
285    grok.permissions('waeup.showStudents',
286                     'waeup.viewAcademics',
287                     'waeup.exportData')
288
289class LocalReportsOfficer(grok.Role):
290    """The local ReportsOfficer role can be assigned at department level.
291    The role allows to view all data and to list or export
292    all student data within the department the local role is assigned.
293
294    The LocalReportsOfficer requires the assignment of the global
295    ReportsOfficer role to access the reports section. If set, it reduces
296    the number of available report generators and selectable certificates.
297    Local Reports Officers can create only reports for their department.
298    """
299    grok.name('waeup.local.ReportsOfficer')
300    grok.title(u'Student Reports Officer')
301    grok.permissions('waeup.showStudents',
302                     'waeup.viewAcademics',
303                     'waeup.exportData')
304
305class UGClearanceOfficer(grok.Role):
306    """UG Clearance Officers are regular Clearance Officers with restricted
307    dynamic permission assignment. They can only access undergraduate
308    students.
309    """
310    grok.name('waeup.local.UGClearanceOfficer')
311    grok.title(u'UG Clearance Officer')
312    grok.permissions('waeup.showStudents',
313                     'waeup.viewAcademics',
314                     'waeup.exportData',
315                     'waeup.clearAllStudents')
316
317
318class PGClearanceOfficer(grok.Role):
319    """PG Clearance Officers are regular Clearance Officers with restricted
320    dynamic permission assignment. They can only access postgraduate
321    students.
322    """
323    grok.name('waeup.local.PGClearanceOfficer')
324    grok.title(u'PG Clearance Officer')
325    grok.permissions('waeup.showStudents',
326                     'waeup.viewAcademics',
327                     'waeup.exportData',
328                     'waeup.clearAllStudents')
329
330
331class CourseAdviser100(grok.Role):
332    """The local CourseAdviser100 role can be assigned at faculty,
333    department or certificate level. The role allows to view all data and
334    to list or export all student data within the faculty, department
335    or certificate the local role is assigned.
336
337    Local Course Advisers can validate or reject course lists of students
338    in ther faculty/department/certificate at level 100.
339    They get the StudentsCourseAdviser role for this subset of students.
340    """
341    grok.name('waeup.local.CourseAdviser100')
342    grok.title(u'Course Adviser 100L')
343    grok.permissions('waeup.showStudents',
344                     'waeup.viewAcademics',
345                     'waeup.exportData')
346
347
348class CourseAdviser200(grok.Role):
349    """Same as CourseAdviser100 but for level 200.
350    """
351    grok.name('waeup.local.CourseAdviser200')
352    grok.title(u'Course Adviser 200L')
353    grok.permissions('waeup.showStudents',
354                     'waeup.viewAcademics',
355                     'waeup.exportData')
356
357
358class CourseAdviser300(grok.Role):
359    """Same as CourseAdviser100 but for level 300.
360    """
361    grok.name('waeup.local.CourseAdviser300')
362    grok.title(u'Course Adviser 300L')
363    grok.permissions('waeup.showStudents',
364                     'waeup.viewAcademics',
365                     'waeup.exportData')
366
367
368class CourseAdviser400(grok.Role):
369    """Same as CourseAdviser100 but for level 400.
370    """
371    grok.name('waeup.local.CourseAdviser400')
372    grok.title(u'Course Adviser 400L')
373    grok.permissions('waeup.showStudents',
374                     'waeup.viewAcademics',
375                     'waeup.exportData')
376
377
378class CourseAdviser500(grok.Role):
379    """Same as CourseAdviser100 but for level 500.
380    """
381    grok.name('waeup.local.CourseAdviser500')
382    grok.title(u'Course Adviser 500L')
383    grok.permissions('waeup.showStudents',
384                     'waeup.viewAcademics',
385                     'waeup.exportData')
386
387
388class CourseAdviser600(grok.Role):
389    """Same as CourseAdviser100 but for level 600.
390    """
391    grok.name('waeup.local.CourseAdviser600')
392    grok.title(u'Course Adviser 600L')
393    grok.permissions('waeup.showStudents',
394                     'waeup.viewAcademics',
395                     'waeup.exportData')
396
397
398class CourseAdviser700(grok.Role):
399    """Same as CourseAdviser100 but for level 700.
400    """
401    grok.name('waeup.local.CourseAdviser700')
402    grok.title(u'Course Adviser 700L')
403    grok.permissions('waeup.showStudents',
404                     'waeup.viewAcademics',
405                     'waeup.exportData')
406
407
408class CourseAdviser800(grok.Role):
409    """Same as CourseAdviser100 but for level 800.
410    """
411    grok.name('waeup.local.CourseAdviser800')
412    grok.title(u'Course Adviser 800L')
413    grok.permissions('waeup.showStudents',
414                     'waeup.viewAcademics',
415                     'waeup.exportData')
416
417
418class LocalTranscriptOfficer(grok.Role):
419    """The LocalTranscriptOfficer role can be assigned at faculty
420    level. The role allows to view, to validate and to
421    release student transcripts at faculty level.
422    Local Transcript Officers get the TranscriptOfficer role
423    for this subset of students.
424    """
425    grok.name('waeup.local.TranscriptOfficer')
426    grok.title(u'Transcript Officer')
427    grok.permissions('waeup.viewAcademics',)
428
429
430class LocalTranscriptSignee(grok.Role):
431    """The LocalTranscriptSignee role can be assigned at faculty
432    level. The role allows to view and to sign student transcripts
433    at faculty level. Local Transcript Signees  get the TranscriptSignee role
434    for this subset of students.
435    """
436    grok.name('waeup.local.TranscriptSignee')
437    grok.title(u'Transcript Signee')
438    grok.permissions('waeup.viewAcademics',)
439
440
441class Lecturer(grok.Role):
442    """The local Lecturer role can be assigned at course level.
443    The role allows to export some student
444    data within the course the local role is assigned. Lecturers can't access
445    student data directly but they can edit the scores in course tickets.
446    """
447    grok.name('waeup.local.Lecturer')
448    grok.title(u'Lecturer')
449    grok.permissions('waeup.editScores',
450                     'waeup.showStudents',
451                     'waeup.viewAcademics',
452                     'waeup.exportData')
453
454
455class Owner(grok.Role):
456    """Each user 'owns' her/his user object and gains permission to edit
457    some of the user attributes.
458    """
459    grok.name('waeup.local.Owner')
460    grok.title(u'Owner')
461    grok.permissions('waeup.editUser')
462
463
464# Site Roles
465class AcademicsOfficer(grok.Role):
466    """An Academics Officer can view but not edit data in the
467    academic section.
468
469    This is the default role which is automatically assigned to all
470    officers of the portal. A user with this role can access all display pages
471    at faculty, department, course, certificate and certificate course level.
472    """
473    grok.name('waeup.AcademicsOfficer')
474    grok.title(u'Academics Officer (view only)')
475    grok.permissions('waeup.viewAcademics')
476
477
478class AcademicsManager(grok.Role):
479    """An Academics Manager can view and edit all data in the
480    scademic section, i.e. access all manage pages
481    at faculty, department, course, certificate and certificate course level.
482    """
483    grok.name('waeup.AcademicsManager')
484    grok.title(u'Academics Manager')
485    title = u'Academics Manager'
486    grok.permissions('waeup.viewAcademics',
487                     'waeup.manageAcademics')
488
489
490class ACManager(grok.Role):
491    """This is the role for Access Code Managers.
492    An AC Manager can view and manage the Accesscodes Section, see
493    ManageACBatches permission above.
494    """
495    grok.name('waeup.ACManager')
496    grok.title(u'Access Code Manager')
497    grok.permissions('waeup.manageACBatches')
498
499
500class DataCenterManager(grok.Role):
501    """This single-permission role is dedicated to those users
502    who are charged with batch processing of portal data.
503    A Data Center Manager can access all pages in the Data Center,
504    see ManageDataCenter permission above.
505    """
506    grok.name('waeup.DataCenterManager')
507    grok.title(u'Datacenter Manager')
508    grok.permissions('waeup.manageDataCenter')
509
510
511class ImportManager(grok.Role):
512    """An Import Manager is a Data Center Manager who is also allowed
513    to batch process (import) data. All batch processors (importers) are
514    available except for the User Processor. This processor requires the
515    Users Manager role too. The ImportManager role includes the
516    DataCenterManager role but not vice versa.
517    """
518    grok.name('waeup.ImportManager')
519    grok.title(u'Import Manager')
520    grok.permissions('waeup.manageDataCenter',
521                     'waeup.importData')
522
523
524class ExportManager(grok.Role):
525    """An Export Manager is a Data Center Manager who is also allowed
526    to export all kind of portal data. The ExportManager role includes the
527    DataCenterManager role but not vice versa.
528    """
529    grok.name('waeup.ExportManager')
530    grok.title(u'Export Manager')
531    grok.permissions('waeup.manageDataCenter',
532                     'waeup.exportData',
533                     'waeup.showStudents')
534
535
536class BursaryOfficer(grok.Role):
537    """Bursary Officers can export bursary and payments data. They can't 
538    access the Data Center but see student data export buttons in the
539    Academic Section.
540    """
541    grok.name('waeup.BursaryOfficer')
542    grok.title(u'Bursary Officer')
543    grok.permissions('waeup.showStudents',
544                     'waeup.viewAcademics',
545                     'waeup.exportBursaryData',
546                     'waeup.exportPaymentsOverview',
547                     'waeup.viewApplicantsTab')
548
549
550class UsersManager(grok.Role):
551    """A Users Manager can add, remove or edit
552    user accounts, see ManageUsers permission for further information.
553    Be very careful with this role.
554    """
555    grok.name('waeup.UsersManager')
556    grok.title(u'Users Manager')
557    grok.permissions('waeup.manageUsers',
558                     'waeup.editUser')
559
560
561class WorkflowManager(grok.Role):
562    """The Workflow Manager can trigger workflow transitions
563    of student and document objects, see TriggerTransition permission
564    for further information.
565    """
566    grok.name('waeup.WorkflowManager')
567    grok.title(u'Workflow Manager')
568    grok.permissions('waeup.triggerTransition')
569
570
571class FingerprintReaderDeviceRole(grok.Role):
572    """Fingerprint Reader Devices.
573
574    Fingerprint readers are remote devices that can store and retrieve
575    fingerprint data.
576    """
577    grok.name('waeup.FingerprintDevice')
578    grok.title(u'Fingerprint Reader')
579    grok.permissions(
580        'waeup.getBiometricData',
581        'waeup.putBiometricData',
582    )
583
584
585class PortalManager(grok.Role):
586    """The PortalManager role is the maximum set of Kofa permissions
587    which are needed to manage the entire portal. This set must not
588    be customized. It is recommended to assign this role only
589    to a few certified Kofa administrators.
590    A less dangerous manager role is the CCOfficer role described below.
591    For the most tasks the CCOfficer role is sufficient.
592    """
593    grok.name('waeup.PortalManager')
594    grok.title(u'Portal Manager')
595    grok.permissions('waeup.managePortal',
596                     'waeup.manageUsers',
597                     'waeup.viewAcademics', 'waeup.manageAcademics',
598                     'waeup.manageACBatches',
599                     'waeup.manageDataCenter',
600                     'waeup.importData',
601                     'waeup.exportData',
602                     'waeup.viewTranscript',
603                     'waeup.processTranscript',
604                     'waeup.viewDocuments', 'waeup.manageDocuments',
605                     'waeup.managePortalConfiguration',
606                     'waeup.viewApplication',
607                     'waeup.manageApplication', 'waeup.handleApplication',
608                     'waeup.viewApplicantsTab', 'waeup.payApplicant',
609                     'waeup.viewApplicationStatistics',
610                     'waeup.viewStudent', 'waeup.manageStudent',
611                     'waeup.clearStudent', 'waeup.payStudent',
612                     'waeup.clearStudentFinancially',  # not used in base pkg
613                     'waeup.uploadStudentFile', 'waeup.showStudents',
614                     'waeup.clearAllStudents',
615                     'waeup.createStudents',
616                     'waeup.editScores',
617                     'waeup.triggerTransition',
618                     'waeup.validateStudent',
619                     'waeup.viewStudentsContainer',
620                     'waeup.handleAccommodation',
621                     'waeup.viewHostels', 'waeup.manageHostels',
622                     'waeup.editUser',
623                     'waeup.loginAsStudent',
624                     'waeup.handleReports',
625                     'waeup.manageReports',
626                     'waeup.manageJobs',
627                     )
628
629
630class CCOfficer(grok.Role):
631    """The role of the Computer Center Officer is basically a copy
632    of the the PortalManager role. Some 'dangerous' permissions are excluded
633    by commenting them out (see source code). If officers need to gain more
634    access rights than defined in this role, do not hastily switch to the
635    PortalManager role but add further manager roles instead. Additional
636    roles could be: UsersManager, ACManager, ImportManager, WorkflowManager
637    or StudentImpersonator.
638
639    CCOfficer is a base class which means that this role is subject to
640    customization. It is not used in the ``waeup.kofa`` base package.
641    """
642    grok.baseclass()
643    grok.name('waeup.CCOfficer')
644    grok.title(u'Computer Center Officer')
645    grok.permissions(
646        # 'waeup.managePortal',
647        # 'waeup.manageUsers',
648        'waeup.viewAcademics',
649        'waeup.manageAcademics',
650        # 'waeup.manageACBatches',
651        'waeup.manageDataCenter',
652        # 'waeup.importData',
653        'waeup.exportData',
654        'waeup.viewTranscript',
655        'waeup.processTranscript',
656        'waeup.viewDocuments', 'waeup.manageDocuments',
657        'waeup.managePortalConfiguration', 'waeup.viewApplication',
658        'waeup.manageApplication', 'waeup.handleApplication',
659        'waeup.viewApplicantsTab', 'waeup.payApplicant',
660        'waeup.viewApplicationStatistics',
661        'waeup.viewStudent', 'waeup.manageStudent',
662        'waeup.clearStudent', 'waeup.payStudent',
663        'waeup.uploadStudentFile', 'waeup.showStudents',
664        'waeup.clearAllStudents',
665        # 'waeup.createStudents',
666        'waeup.editScores',
667        # 'waeup.triggerTransition',
668        'waeup.validateStudent',
669        'waeup.viewStudentsContainer',
670        'waeup.handleAccommodation',
671        'waeup.viewHostels', 'waeup.manageHostels',
672        # 'waeup.editUser',
673        # 'waeup.loginAsStudent',
674        'waeup.handleReports',
675        'waeup.manageReports',
676        # 'waeup.manageJobs',
677        )
678
679
680def get_all_roles():
681    """Return a list of tuples ``<ROLE-NAME>, <ROLE>``.
682    """
683    return getUtilitiesFor(IRole)
684
685
686def get_waeup_roles(also_local=False):
687    """Get all Kofa roles.
688
689    Kofa roles are ordinary roles whose id by convention starts with
690    a ``waeup.`` prefix.
691
692    If `also_local` is ``True`` (``False`` by default), also local
693    roles are returned. Local Kofa roles are such whose id starts
694    with ``waeup.local.`` prefix (this is also a convention).
695
696    Returns a generator of the found roles.
697    """
698    for name, item in get_all_roles():
699        if not name.startswith('waeup.'):
700            # Ignore non-Kofa roles...
701            continue
702        if not also_local and name.startswith('waeup.local.'):
703            # Ignore local roles...
704            continue
705        yield item
706
707
708def get_waeup_role_names():
709    """Get the ids of all Kofa roles.
710
711    See :func:`get_waeup_roles` for what a 'KofaRole' is.
712
713    This function returns a sorted list of Kofa role names.
714    """
715    return sorted([x.id for x in get_waeup_roles()])
716
717
718class LocalRolesAssignable(grok.Adapter):
719    """Default implementation for `ILocalRolesAssignable`.
720
721    This adapter returns a list for dictionaries for objects for which
722    we want to know the roles assignable to them locally.
723
724    The returned dicts contain a ``name`` and a ``title`` entry which
725    give a role (``name``) and a description, for which kind of users
726    the permission is meant to be used (``title``).
727
728    Having this adapter registered we make sure, that for each normal
729    object we get a valid `ILocalRolesAssignable` adapter.
730
731    Objects that want to offer certain local roles, can do so by
732    setting a (preferably class-) attribute to a list of role ids.
733
734    You can also define different adapters for different contexts to
735    have different role lookup mechanisms become available. But in
736    normal cases it should be sufficient to use this basic adapter.
737    """
738    grok.context(Interface)
739    grok.provides(ILocalRolesAssignable)
740
741    _roles = []
742
743    def __init__(self, context):
744        self.context = context
745        role_ids = getattr(context, 'local_roles', self._roles)
746        self._roles = [(name, role) for name, role in get_all_roles()
747                       if name in role_ids]
748        return
749
750    def __call__(self):
751        """Get a list of dictionaries containing ``names`` (the roles to
752        assign) and ``titles`` (some description of the type of user
753        to assign each role to).
754        """
755        list_of_dict = [dict(
756                name=name,
757                title=role.title,
758                description=role.description)
759                for name, role in self._roles]
760        return sorted(list_of_dict, key=lambda x: x['name'])
761
762
763def get_users_with_local_roles(context):
764    """Get a list of dicts representing the local roles set for `context`.
765
766    Each dict returns `user_name`, `user_title`, `local_role`,
767    `local_role_title`, and `setting` for each entry in the local
768    roles map of the `context` object.
769    """
770    try:
771        role_map = IPrincipalRoleMap(context)
772    except TypeError:
773        # no map no roles.
774        raise StopIteration
775    for local_role, user_name, setting in role_map.getPrincipalsAndRoles():
776        user = grok.getSite()['users'].get(user_name, None)
777        user_title = getattr(user, 'title', user_name)
778        local_role_title = getattr(
779            dict(get_all_roles()).get(local_role, None), 'title', None)
780        yield dict(user_name=user_name,
781                   user_title=user_title,
782                   local_role=local_role,
783                   local_role_title=local_role_title,
784                   setting=setting)
785
786
787def get_users_with_role(role, context):
788    """Get a list of dicts representing the usres who have been granted
789    a role for `context`.
790    """
791    try:
792        role_map = IPrincipalRoleMap(context)
793    except TypeError:
794        # no map no roles.
795        raise StopIteration
796    for user_name, setting in role_map.getPrincipalsForRole(role):
797        user = grok.getSite()['users'].get(user_name, None)
798        user_title = getattr(user, 'title', user_name)
799        user_email = getattr(user, 'email', None)
800        yield dict(user_name=user_name,
801                   user_title=user_title,
802                   user_email=user_email,
803                   setting=setting)
Note: See TracBrowser for help on using the repository browser.