source: main/waeup.kofa/trunk/src/waeup/kofa/permissions.py @ 17651

Last change on this file since 17651 was 16529, checked in by Henrik Bettermann, 3 years ago

Show local roles on faculty, department, course and certificate pages
and provide 'Contact' button so that authenticated users can contact
officers via Kofa.

  • Property svn:eol-style set to native
  • Property svn:keywords set to Id
File size: 29.1 KB
Line 
1# $Id: permissions.py 16529 2021-07-07 06:51:05Z henrik $
2#
3# Copyright (C) 2011 Uli Fouquet & Henrik Bettermann
4# This program is free software; you can redistribute it and/or modify
5# it under the terms of the GNU General Public License as published by
6# the Free Software Foundation; either version 2 of the License, or
7# (at your option) any later version.
8#
9# This program is distributed in the hope that it will be useful,
10# but WITHOUT ANY WARRANTY; without even the implied warranty of
11# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
12# GNU General Public License for more details.
13#
14# You should have received a copy of the GNU General Public License
15# along with this program; if not, write to the Free Software
16# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
17#
18import grok
19from zope.component import getUtilitiesFor
20from zope.interface import Interface
21from zope.securitypolicy.interfaces import IRole, IPrincipalRoleMap
22from waeup.kofa.interfaces import ILocalRolesAssignable
23
24
25class Public(grok.Permission):
26    """The Public or everyone-can-do-this-permission is being applied
27    to views/pages that are used by everyone.
28    """
29    grok.name('waeup.Public')
30
31
32class Anonymous(grok.Permission):
33    """The Anonymous permission is applied to
34    views/pages which are dedicated to anonymous users only.
35    Logged-in users can't access these views.
36    """
37    grok.name('waeup.Anonymous')
38
39
40class Authenticated(grok.Permission):
41    """The Authenticated permission is applied to pages
42    which can only be used by logged-in users and not by anonymous users.
43    """
44    grok.name('waeup.Authenticated')
45
46
47class ViewAcademics(grok.Permission):
48    """The ViewAcademics permission is applied to all
49    views of the Academic Section. Users with this permission can view but
50    not edit content in the Academic Section.
51    """
52    grok.name('waeup.viewAcademics')
53
54
55class ManageAcademics(grok.Permission):
56    """The ManageAcademics permission is applied to all edit/manage
57    pages in the Academic Section. Users who have this permission
58    can change/edit context objects.
59    """
60    grok.name('waeup.manageAcademics')
61
62
63class ManagePortal(grok.Permission):
64    """The ManagePortal permission is used for very few pages
65    (e.g. the DatacenterSettings page). Only PortalManagers have this
66    permission. It is furthermore used to control delete methods of container
67    pages in the Academic Section. The ManageAcademics permission,
68    described above, does enable users to edit content but not to
69    remove sub-containers, like faculties, departments or certificates.
70    Users must have the ManagePortal permission too to remove
71    entire containers.
72    """
73    grok.name('waeup.managePortal')
74
75
76class ManageUsers(grok.Permission):
77    """The ManageUsers permission is a real superuser permission
78    and therefore very 'dangerous'. It allows to add, remove or edit
79    user accounts. Editing a user account includes the option to assign
80    or remove roles. That means that a user with this permission can lock out
81    other users by either removing their account or by removing
82    permissions.
83    """
84    grok.name('waeup.manageUsers')
85
86
87class ShowStudents(grok.Permission):
88    """Users with this permission do not neccessarily see the 'Students' tab
89    but they can search for students at department, certificate or course
90    level. If they additionally have the ExportData permission they can
91    export the data as csv files.
92
93    Bursary or Department Officers don't have the ExportData
94    permission (see Roles section) and are only allowed to export bursary
95    or payments overview data respectively.
96    """
97    grok.name('waeup.showStudents')
98
99
100class ClearAllStudents(grok.Permission):
101    """The ClearAllStudents permission allows to clear all students
102    in a department at one sweep.
103    """
104    grok.name('waeup.clearAllStudents')
105
106
107class EditScores(grok.Permission):
108    """The EditScores permission allows to edit scores in course tickets.
109    """
110    grok.name('waeup.editScores')
111
112
113class TriggerTransition(grok.Permission):
114    """The TriggerTransition permission allows to trigger workflow transitions
115    of student and document objects.
116    """
117    grok.name('waeup.triggerTransition')
118
119
120class EditUser(grok.Permission):
121    """The EditUser permission is required for editing
122    single user accounts.
123    """
124    grok.name('waeup.editUser')
125
126
127class ManageDataCenter(grok.Permission):
128    """The ManageDataCenter permission allows to access all pages
129    in the Data Center and to upload files. It does not automatically
130    allow to process uploaded data files.
131    """
132    grok.name('waeup.manageDataCenter')
133
134
135class ImportData(grok.Permission):
136    """The ImportData permission allows to batch process (import) any kind of
137    portal data except for user data. The User Data processor
138    requires also the ManageUsers permission.
139    """
140    grok.name('waeup.importData')
141
142
143class ExportData(grok.Permission):
144    """The ExportData permission allows to export any kind of portal data.
145    """
146    grok.name('waeup.exportData')
147
148
149class ExportPaymentsOverview(grok.Permission):
150    """Department Officers don't have the general exportData
151    permission and are only allowed to export payments overviews.
152    The ExportPaymentsOverview permission is only used to filter the
153    respective exporters in the ExportJobContainerJobConfig view.
154    """
155    grok.name('waeup.exportPaymentsOverview')
156
157
158class ExportBursaryData(grok.Permission):
159    """Bursary Officers don't have the general exportData
160    permission and are only allowed to export bursary data.
161    The ExportBursaryData permission is only used to filter the
162    respective exporter in the ExportJobContainerJobConfig view.
163    """
164    grok.name('waeup.exportBursaryData')
165
166
167class ManagePortalConfiguration(grok.Permission):
168    """The ManagePortalConfiguration permission allows to
169    edit global and sessional portal configuration data.
170    """
171    grok.name('waeup.managePortalConfiguration')
172
173
174class ManageACBatches(grok.Permission):
175    """The ManageACBatches permission allows to view and
176    manage accesscodes.
177    """
178    grok.name('waeup.manageACBatches')
179
180
181class PutBiometricDataPermission(grok.Permission):
182    """This permission allows to upload/change biometric data.
183    """
184    grok.name('waeup.putBiometricData')
185
186
187class GetBiometricDataPermission(grok.Permission):
188    """This permission allows to read biometric data.
189    """
190    grok.name('waeup.getBiometricData')
191
192
193# Local Roles
194
195class ApplicationsManager(grok.Role):
196    """The local ApplicationsManager role can be assigned at applicants
197    container and at department level. At department level an Applications
198    Manager can manage all applicants which desire to study a programme
199    offered by the department (1st Choice Course of Study).
200
201    At container level (local) Applications Managers gain permissions which
202    allow to manage the container and all applicants inside the container.  At
203    container level the permission set of this local role corresonds with the
204    permission set of the same-named global role.
205    """
206    grok.name('waeup.local.ApplicationsManager')
207    grok.title(u'Applications Manager')
208    grok.permissions('waeup.viewAcademics',
209                     'waeup.manageApplication', 'waeup.viewApplication',
210                     'waeup.payApplicant')
211
212
213class DepartmentOfficer(grok.Role):
214    """The local DepartmentOfficer role can be assigned at faculty or
215    department level. The role allows to list all student data within the
216    faculty/department the local role is assigned. And it allows to export
217    payment data overviews.
218    """
219    grok.name('waeup.local.DepartmentOfficer')
220    grok.title(u'Department Officer')
221    grok.permissions('waeup.showStudents',
222                     'waeup.viewAcademics',
223                     'waeup.exportPaymentsOverview')
224
225
226class DepartmentManager(grok.Role):
227    """The local DepartmentManager role can be assigned at faculty or
228    department level. The role allows to edit all data within this container.
229    It does not automatically allow to remove sub-containers.
230
231    Department Managers (Dean of Faculty or Head of Department respectively)
232    can also list student data but not access student pages.
233    """
234    grok.name('waeup.local.DepartmentManager')
235    grok.title(u'Department Manager')
236    grok.permissions('waeup.manageAcademics',
237                     'waeup.showStudents',
238                     'waeup.exportData')
239
240
241class ClearanceOfficer(grok.Role):
242    """The local ClearanceOfficer role can be assigned at faculty or
243    department level. The role allows to list or export all student
244    data within the faculty/department the local role is assigned.
245
246    Clearance Officers can furthermore clear all students or reject clearance
247    of all students in their faculty/department. They get the
248    StudentsClearanceOfficer role for this subset of students.
249    """
250    grok.name('waeup.local.ClearanceOfficer')
251    grok.title(u'Clearance Officer')
252    grok.permissions('waeup.showStudents',
253                     'waeup.viewAcademics',
254                     'waeup.exportData',
255                     'waeup.clearAllStudents')
256
257
258class LocalStudentsManager(grok.Role):
259    """The local LocalStudentsManager role can be assigned at faculty or
260    department level. The role allows to view all data and to view or export
261    all student data within the faculty/department the local role is assigned.
262
263    Local Students Managers can furthermore manage data of students
264    in their faculty/department. They get the StudentsManager role for
265    this subset of students.
266    """
267    grok.name('waeup.local.LocalStudentsManager')
268    grok.title(u'Students Manager')
269    grok.permissions('waeup.showStudents',
270                     'waeup.viewAcademics',
271                     'waeup.exportData')
272
273
274class LocalWorkflowManager(grok.Role):
275    """The local LocalWorkflowManager role can be assigned at faculty level.
276    The role allows to view all data and to list or export
277    all student data within the faculty the local role is assigned.
278
279    Local Workflow Managers can trigger transition of students in their
280    faculty/department. They get the WorkflowManager role for
281    this subset of students.
282    """
283    grok.name('waeup.local.LocalWorkflowManager')
284    grok.title(u'Student Workflow Manager')
285    grok.permissions('waeup.showStudents',
286                     'waeup.viewAcademics',
287                     'waeup.exportData')
288
289class LocalReportsOfficer(grok.Role):
290    """The local ReportsOfficer role can be assigned at department level.
291    The role allows to view all data and to list or export
292    all student data within the department the local role is assigned.
293
294    The LocalReportsOfficer requires the assignment of the global
295    ReportsOfficer role to access the reports section. If set, it reduces
296    the number of available report generators and selectable certificates.
297    Local Reports Officers can create only reports for their department.
298    """
299    grok.name('waeup.local.ReportsOfficer')
300    grok.title(u'Student Reports Officer')
301    grok.permissions('waeup.showStudents',
302                     'waeup.viewAcademics',
303                     'waeup.exportData')
304
305class UGClearanceOfficer(grok.Role):
306    """UG Clearance Officers are regular Clearance Officers with restricted
307    dynamic permission assignment. They can only access undergraduate
308    students.
309    """
310    grok.name('waeup.local.UGClearanceOfficer')
311    grok.title(u'UG Clearance Officer')
312    grok.permissions('waeup.showStudents',
313                     'waeup.viewAcademics',
314                     'waeup.exportData',
315                     'waeup.clearAllStudents')
316
317
318class PGClearanceOfficer(grok.Role):
319    """PG Clearance Officers are regular Clearance Officers with restricted
320    dynamic permission assignment. They can only access postgraduate
321    students.
322    """
323    grok.name('waeup.local.PGClearanceOfficer')
324    grok.title(u'PG Clearance Officer')
325    grok.permissions('waeup.showStudents',
326                     'waeup.viewAcademics',
327                     'waeup.exportData',
328                     'waeup.clearAllStudents')
329
330
331class CourseAdviser100(grok.Role):
332    """The local CourseAdviser100 role can be assigned at faculty,
333    department or certificate level. The role allows to view all data and
334    to list or export all student data within the faculty, department
335    or certificate the local role is assigned.
336
337    Local Course Advisers can validate or reject course lists of students
338    in ther faculty/department/certificate at level 100.
339    They get the StudentsCourseAdviser role for this subset of students.
340    """
341    grok.name('waeup.local.CourseAdviser100')
342    grok.title(u'Course Adviser 100L')
343    grok.permissions('waeup.showStudents',
344                     'waeup.viewAcademics',
345                     'waeup.exportData')
346
347
348class CourseAdviser200(grok.Role):
349    """Same as CourseAdviser100 but for level 200.
350    """
351    grok.name('waeup.local.CourseAdviser200')
352    grok.title(u'Course Adviser 200L')
353    grok.permissions('waeup.showStudents',
354                     'waeup.viewAcademics',
355                     'waeup.exportData')
356
357
358class CourseAdviser300(grok.Role):
359    """Same as CourseAdviser100 but for level 300.
360    """
361    grok.name('waeup.local.CourseAdviser300')
362    grok.title(u'Course Adviser 300L')
363    grok.permissions('waeup.showStudents',
364                     'waeup.viewAcademics',
365                     'waeup.exportData')
366
367
368class CourseAdviser400(grok.Role):
369    """Same as CourseAdviser100 but for level 400.
370    """
371    grok.name('waeup.local.CourseAdviser400')
372    grok.title(u'Course Adviser 400L')
373    grok.permissions('waeup.showStudents',
374                     'waeup.viewAcademics',
375                     'waeup.exportData')
376
377
378class CourseAdviser500(grok.Role):
379    """Same as CourseAdviser100 but for level 500.
380    """
381    grok.name('waeup.local.CourseAdviser500')
382    grok.title(u'Course Adviser 500L')
383    grok.permissions('waeup.showStudents',
384                     'waeup.viewAcademics',
385                     'waeup.exportData')
386
387
388class CourseAdviser600(grok.Role):
389    """Same as CourseAdviser100 but for level 600.
390    """
391    grok.name('waeup.local.CourseAdviser600')
392    grok.title(u'Course Adviser 600L')
393    grok.permissions('waeup.showStudents',
394                     'waeup.viewAcademics',
395                     'waeup.exportData')
396
397
398class CourseAdviser700(grok.Role):
399    """Same as CourseAdviser100 but for level 700.
400    """
401    grok.name('waeup.local.CourseAdviser700')
402    grok.title(u'Course Adviser 700L')
403    grok.permissions('waeup.showStudents',
404                     'waeup.viewAcademics',
405                     'waeup.exportData')
406
407
408class CourseAdviser800(grok.Role):
409    """Same as CourseAdviser100 but for level 800.
410    """
411    grok.name('waeup.local.CourseAdviser800')
412    grok.title(u'Course Adviser 800L')
413    grok.permissions('waeup.showStudents',
414                     'waeup.viewAcademics',
415                     'waeup.exportData')
416
417
418class LocalTranscriptOfficer(grok.Role):
419    """The LocalTranscriptOfficer role can be assigned at faculty
420    level. The role allows to view, to validate and to
421    release student transcripts at faculty level.
422    Local Transcript Officers get the TranscriptOfficer role
423    for this subset of students.
424    """
425    grok.name('waeup.local.TranscriptOfficer')
426    grok.title(u'Transcript Officer')
427    grok.permissions('waeup.viewAcademics',)
428
429
430class LocalTranscriptSignee(grok.Role):
431    """The LocalTranscriptSignee role can be assigned at faculty
432    level. The role allows to view and to sign student transcripts
433    at faculty level. Local Transcript Signees  get the TranscriptSignee role
434    for this subset of students.
435    """
436    grok.name('waeup.local.TranscriptSignee')
437    grok.title(u'Transcript Signee')
438    grok.permissions('waeup.viewAcademics',)
439
440
441class Lecturer(grok.Role):
442    """The local Lecturer role can be assigned at course level.
443    The role allows to export some student
444    data within the course the local role is assigned. Lecturers can't access
445    student data directly but they can edit the scores in course tickets.
446    """
447    grok.name('waeup.local.Lecturer')
448    grok.title(u'Lecturer')
449    grok.permissions('waeup.editScores',
450                     'waeup.showStudents',
451                     'waeup.viewAcademics',
452                     'waeup.exportData')
453
454
455class Owner(grok.Role):
456    """Each user 'owns' her/his user object and gains permission to edit
457    some of the user attributes.
458    """
459    grok.name('waeup.local.Owner')
460    grok.title(u'Owner')
461    grok.permissions('waeup.editUser')
462
463
464# Site Roles
465class AcademicsOfficer(grok.Role):
466    """An Academics Officer can view but not edit data in the
467    academic section.
468
469    This is the default role which is automatically assigned to all
470    officers of the portal. A user with this role can access all display pages
471    at faculty, department, course, certificate and certificate course level.
472    """
473    grok.name('waeup.AcademicsOfficer')
474    grok.title(u'Academics Officer (view only)')
475    grok.permissions('waeup.viewAcademics')
476
477
478class AcademicsManager(grok.Role):
479    """An Academics Manager can view and edit all data in the
480    scademic section, i.e. access all manage pages
481    at faculty, department, course, certificate and certificate course level.
482    """
483    grok.name('waeup.AcademicsManager')
484    grok.title(u'Academics Manager')
485    title = u'Academics Manager'
486    grok.permissions('waeup.viewAcademics',
487                     'waeup.manageAcademics')
488
489
490class ACManager(grok.Role):
491    """This is the role for Access Code Managers.
492    An AC Manager can view and manage the Accesscodes Section, see
493    ManageACBatches permission above.
494    """
495    grok.name('waeup.ACManager')
496    grok.title(u'Access Code Manager')
497    grok.permissions('waeup.manageACBatches')
498
499
500class DataCenterManager(grok.Role):
501    """This single-permission role is dedicated to those users
502    who are charged with batch processing of portal data.
503    A Data Center Manager can access all pages in the Data Center,
504    see ManageDataCenter permission above.
505    """
506    grok.name('waeup.DataCenterManager')
507    grok.title(u'Datacenter Manager')
508    grok.permissions('waeup.manageDataCenter')
509
510
511class ImportManager(grok.Role):
512    """An Import Manager is a Data Center Manager who is also allowed
513    to batch process (import) data. All batch processors (importers) are
514    available except for the User Processor. This processor requires the
515    Users Manager role too. The ImportManager role includes the
516    DataCenterManager role but not vice versa.
517    """
518    grok.name('waeup.ImportManager')
519    grok.title(u'Import Manager')
520    grok.permissions('waeup.manageDataCenter',
521                     'waeup.importData')
522
523
524class ExportManager(grok.Role):
525    """An Export Manager is a Data Center Manager who is also allowed
526    to export all kind of portal data. The ExportManager role includes the
527    DataCenterManager role but not vice versa.
528    """
529    grok.name('waeup.ExportManager')
530    grok.title(u'Export Manager')
531    grok.permissions('waeup.manageDataCenter',
532                     'waeup.exportData',
533                     'waeup.showStudents')
534
535
536class BursaryOfficer(grok.Role):
537    """Bursary Officers can export bursary and payments data. They can't 
538    access the Data Center but see student data export buttons in the
539    Academic Section.
540    """
541    grok.name('waeup.BursaryOfficer')
542    grok.title(u'Bursary Officer')
543    grok.permissions('waeup.showStudents',
544                     'waeup.viewAcademics',
545                     'waeup.exportBursaryData',
546                     'waeup.exportPaymentsOverview',
547                     'waeup.viewApplicantsTab')
548
549
550class UsersManager(grok.Role):
551    """A Users Manager can add, remove or edit
552    user accounts, see ManageUsers permission for further information.
553    Be very careful with this role.
554    """
555    grok.name('waeup.UsersManager')
556    grok.title(u'Users Manager')
557    grok.permissions('waeup.manageUsers',
558                     'waeup.editUser')
559
560
561class WorkflowManager(grok.Role):
562    """The Workflow Manager can trigger workflow transitions
563    of student and document objects, see TriggerTransition permission
564    for further information.
565    """
566    grok.name('waeup.WorkflowManager')
567    grok.title(u'Workflow Manager')
568    grok.permissions('waeup.triggerTransition')
569
570
571class FingerprintReaderDeviceRole(grok.Role):
572    """Fingerprint Reader Devices.
573
574    Fingerprint readers are remote devices that can store and retrieve
575    fingerprint data.
576    """
577    grok.name('waeup.FingerprintDevice')
578    grok.title(u'Fingerprint Reader')
579    grok.permissions(
580        'waeup.getBiometricData',
581        'waeup.putBiometricData',
582    )
583
584
585class PortalManager(grok.Role):
586    """The PortalManager role is the maximum set of Kofa permissions
587    which are needed to manage the entire portal. This set must not
588    be customized. It is recommended to assign this role only
589    to a few certified Kofa administrators.
590    A less dangerous manager role is the CCOfficer role described below.
591    For the most tasks the CCOfficer role is sufficient.
592    """
593    grok.name('waeup.PortalManager')
594    grok.title(u'Portal Manager')
595    grok.permissions('waeup.managePortal',
596                     'waeup.manageUsers',
597                     'waeup.viewAcademics', 'waeup.manageAcademics',
598                     'waeup.manageACBatches',
599                     'waeup.manageDataCenter',
600                     'waeup.importData',
601                     'waeup.exportData',
602                     'waeup.viewTranscript',
603                     'waeup.downloadTranscript',
604                     'waeup.processTranscript',
605                     'waeup.viewDocuments', 'waeup.manageDocuments',
606                     'waeup.managePortalConfiguration',
607                     'waeup.viewApplication',
608                     'waeup.manageApplication', 'waeup.handleApplication',
609                     'waeup.viewApplicantsTab', 'waeup.payApplicant',
610                     'waeup.viewApplicationStatistics',
611                     'waeup.viewStudent', 'waeup.manageStudent',
612                     'waeup.clearStudent', 'waeup.payStudent',
613                     'waeup.clearStudentFinancially',  # not used in base pkg
614                     'waeup.uploadStudentFile', 'waeup.showStudents',
615                     'waeup.clearAllStudents',
616                     'waeup.createStudents',
617                     'waeup.editScores',
618                     'waeup.triggerTransition',
619                     'waeup.validateStudent',
620                     'waeup.viewStudentsContainer',
621                     'waeup.handleAccommodation',
622                     'waeup.viewHostels', 'waeup.manageHostels',
623                     'waeup.editUser',
624                     'waeup.loginAsStudent',
625                     'waeup.handleReports',
626                     'waeup.manageReports',
627                     'waeup.manageJobs',
628                     )
629
630
631class CCOfficer(grok.Role):
632    """The role of the Computer Center Officer is basically a copy
633    of the the PortalManager role. Some 'dangerous' permissions are excluded
634    by commenting them out (see source code). If officers need to gain more
635    access rights than defined in this role, do not hastily switch to the
636    PortalManager role but add further manager roles instead. Additional
637    roles could be: UsersManager, ACManager, ImportManager, WorkflowManager
638    or StudentImpersonator.
639
640    CCOfficer is a base class which means that this role is subject to
641    customization. It is not used in the ``waeup.kofa`` base package.
642    """
643    grok.baseclass()
644    grok.name('waeup.CCOfficer')
645    grok.title(u'Computer Center Officer')
646    grok.permissions(
647        # 'waeup.managePortal',
648        # 'waeup.manageUsers',
649        'waeup.viewAcademics',
650        'waeup.manageAcademics',
651        # 'waeup.manageACBatches',
652        'waeup.manageDataCenter',
653        # 'waeup.importData',
654        'waeup.exportData',
655        'waeup.viewTranscript',
656        'waeup.downloadTranscript',
657        'waeup.processTranscript',
658        'waeup.viewDocuments', 'waeup.manageDocuments',
659        'waeup.managePortalConfiguration', 'waeup.viewApplication',
660        'waeup.manageApplication', 'waeup.handleApplication',
661        'waeup.viewApplicantsTab', 'waeup.payApplicant',
662        'waeup.viewApplicationStatistics',
663        'waeup.viewStudent', 'waeup.manageStudent',
664        'waeup.clearStudent', 'waeup.payStudent',
665        'waeup.uploadStudentFile', 'waeup.showStudents',
666        'waeup.clearAllStudents',
667        # 'waeup.createStudents',
668        'waeup.editScores',
669        # 'waeup.triggerTransition',
670        'waeup.validateStudent',
671        'waeup.viewStudentsContainer',
672        'waeup.handleAccommodation',
673        'waeup.viewHostels', 'waeup.manageHostels',
674        # 'waeup.editUser',
675        # 'waeup.loginAsStudent',
676        'waeup.handleReports',
677        'waeup.manageReports',
678        # 'waeup.manageJobs',
679        )
680
681
682def get_all_roles():
683    """Return a list of tuples ``<ROLE-NAME>, <ROLE>``.
684    """
685    return getUtilitiesFor(IRole)
686
687
688def get_waeup_roles(also_local=False):
689    """Get all Kofa roles.
690
691    Kofa roles are ordinary roles whose id by convention starts with
692    a ``waeup.`` prefix.
693
694    If `also_local` is ``True`` (``False`` by default), also local
695    roles are returned. Local Kofa roles are such whose id starts
696    with ``waeup.local.`` prefix (this is also a convention).
697
698    Returns a generator of the found roles.
699    """
700    for name, item in get_all_roles():
701        if not name.startswith('waeup.'):
702            # Ignore non-Kofa roles...
703            continue
704        if not also_local and name.startswith('waeup.local.'):
705            # Ignore local roles...
706            continue
707        yield item
708
709
710def get_waeup_role_names():
711    """Get the ids of all Kofa roles.
712
713    See :func:`get_waeup_roles` for what a 'KofaRole' is.
714
715    This function returns a sorted list of Kofa role names.
716    """
717    return sorted([x.id for x in get_waeup_roles()])
718
719
720class LocalRolesAssignable(grok.Adapter):
721    """Default implementation for `ILocalRolesAssignable`.
722
723    This adapter returns a list for dictionaries for objects for which
724    we want to know the roles assignable to them locally.
725
726    The returned dicts contain a ``name`` and a ``title`` entry which
727    give a role (``name``) and a description, for which kind of users
728    the permission is meant to be used (``title``).
729
730    Having this adapter registered we make sure, that for each normal
731    object we get a valid `ILocalRolesAssignable` adapter.
732
733    Objects that want to offer certain local roles, can do so by
734    setting a (preferably class-) attribute to a list of role ids.
735
736    You can also define different adapters for different contexts to
737    have different role lookup mechanisms become available. But in
738    normal cases it should be sufficient to use this basic adapter.
739    """
740    grok.context(Interface)
741    grok.provides(ILocalRolesAssignable)
742
743    _roles = []
744
745    def __init__(self, context):
746        self.context = context
747        role_ids = getattr(context, 'local_roles', self._roles)
748        self._roles = [(name, role) for name, role in get_all_roles()
749                       if name in role_ids]
750        return
751
752    def __call__(self):
753        """Get a list of dictionaries containing ``names`` (the roles to
754        assign) and ``titles`` (some description of the type of user
755        to assign each role to).
756        """
757        list_of_dict = [dict(
758                name=name,
759                title=role.title,
760                description=role.description)
761                for name, role in self._roles]
762        return sorted(list_of_dict, key=lambda x: x['name'])
763
764
765def get_users_with_local_roles(context):
766    """Get a list of dicts representing the local roles set for `context`.
767
768    Each dict returns `user_name`, `user_title`, `local_role`,
769    `local_role_title`, and `setting` for each entry in the local
770    roles map of the `context` object.
771    """
772    try:
773        role_map = IPrincipalRoleMap(context)
774    except TypeError:
775        # no map no roles.
776        raise StopIteration
777    for local_role, user_name, setting in role_map.getPrincipalsAndRoles():
778        user = grok.getSite()['users'].get(user_name, None)
779        user_title = getattr(user, 'title', user_name)
780        public_name = getattr(user, 'public_name', None)
781        if not public_name:
782            public_name = user_title
783        local_role_title = getattr(
784            dict(get_all_roles()).get(local_role, None), 'title', None)
785        yield dict(user=user,
786                   user_name=user_name,
787                   user_title=user_title,
788                   public_name=public_name,
789                   local_role=local_role,
790                   local_role_title=local_role_title,
791                   setting=setting,
792                   )
793
794
795def get_users_with_role(role, context):
796    """Get a list of dicts representing the usres who have been granted
797    a role for `context`.
798    """
799    try:
800        role_map = IPrincipalRoleMap(context)
801    except TypeError:
802        # no map no roles.
803        raise StopIteration
804    for user_name, setting in role_map.getPrincipalsForRole(role):
805        user = grok.getSite()['users'].get(user_name, None)
806        user_title = getattr(user, 'title', user_name)
807        user_email = getattr(user, 'email', None)
808        yield dict(user_name=user_name,
809                   user_title=user_title,
810                   user_email=user_email,
811                   setting=setting)
Note: See TracBrowser for help on using the repository browser.