source: main/waeup.kofa/trunk/src/waeup/kofa/permissions.py @ 9078

Last change on this file since 9078 was 9002, checked in by Henrik Bettermann, 12 years ago

Add lecturer local role which has no dynamic role assignment yet.

Add test_import to CourseProcessorTests?.

  • Property svn:eol-style set to native
  • Property svn:keywords set to Id
File size: 11.3 KB
Line 
1## $Id: permissions.py 9002 2012-07-13 16:36:21Z henrik $
2##
3## Copyright (C) 2011 Uli Fouquet & Henrik Bettermann
4## This program is free software; you can redistribute it and/or modify
5## it under the terms of the GNU General Public License as published by
6## the Free Software Foundation; either version 2 of the License, or
7## (at your option) any later version.
8##
9## This program is distributed in the hope that it will be useful,
10## but WITHOUT ANY WARRANTY; without even the implied warranty of
11## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
12## GNU General Public License for more details.
13##
14## You should have received a copy of the GNU General Public License
15## along with this program; if not, write to the Free Software
16## Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
17##
18import grok
19from zope.component import getUtilitiesFor
20from zope.interface import Interface
21from zope.securitypolicy.interfaces import IRole, IPrincipalRoleMap
22from waeup.kofa.interfaces import ILocalRolesAssignable
23
24class Public(grok.Permission):
25    """Everyone-can-do-this-permission.
26
27    This permission is meant to be applied to objects/views/pages
28    etc., that should be usable/readable by everyone.
29
30    We need this to be able to tune default permissions more
31    restrictive and open up some dedicated objects like the front
32    page.
33    """
34    grok.name('waeup.Public')
35
36class Anonymous(grok.Permission):
37    """Only-anonymous-can-do-this-permission.
38    """
39    grok.name('waeup.Anonymous')
40
41class Authenticated(grok.Permission):
42    """Only-logged-in-users-can-do-this-permission.
43    """
44    grok.name('waeup.Authenticated')
45
46class ViewAcademicsPermission(grok.Permission):
47    grok.name('waeup.viewAcademics')
48
49class ManageAcademicsPermission(grok.Permission):
50    grok.name('waeup.manageAcademics')
51
52class ManagePortal(grok.Permission):
53    grok.name('waeup.managePortal')
54
55class ManageUsers(grok.Permission):
56    grok.name('waeup.manageUsers')
57
58class ShowStudents(grok.Permission):
59    grok.name('waeup.showStudents')
60
61class EditUser(grok.Permission):
62    grok.name('waeup.editUser')
63
64class ManageDataCenter(grok.Permission):
65    grok.name('waeup.manageDataCenter')
66
67class ImportData(grok.Permission):
68    grok.name('waeup.importData')
69
70class ManagePortalConfiguration(grok.Permission):
71    grok.name('waeup.managePortalConfiguration')
72
73class ManageACBatches(grok.Permission):
74    grok.name('waeup.manageACBatches')
75
76# Local Roles
77class DepartmentManager(grok.Role):
78    grok.name('waeup.local.DepartmentManager')
79    grok.title(u'Department Manager')
80    grok.permissions('waeup.manageAcademics','waeup.showStudents')
81
82class ClearanceOfficer(grok.Role):
83    """The clearance officer role is meant for the
84    assignment of dynamic roles only.
85    """
86    grok.name('waeup.local.ClearanceOfficer')
87    grok.title(u'Clearance Officer')
88    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
89
90class UGClearanceOfficer(grok.Role):
91    """The clearance officer role is meant for the
92    assignment of dynamic roles only.
93    """
94    grok.name('waeup.local.UGClearanceOfficer')
95    grok.title(u'UG Clearance Officer')
96    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
97
98class PGClearanceOfficer(grok.Role):
99    """The clearance officer role is meant for the
100    assignment of dynamic roles only.
101    """
102    grok.name('waeup.local.PGClearanceOfficer')
103    grok.title(u'PG Clearance Officer')
104    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
105
106class CourseAdviser100(grok.Role):
107    """The 100 level course adviser role is meant for the
108    assignment of dynamic roles only.
109    """
110    grok.name('waeup.local.CourseAdviser100')
111    grok.title(u'Course Adviser 100L')
112    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
113
114class CourseAdviser200(grok.Role):
115    """The course 200 level adviser role is meant for the
116    assignment of dynamic roles only.
117    """
118    grok.name('waeup.local.CourseAdviser200')
119    grok.title(u'Course Adviser 200L')
120    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
121
122class CourseAdviser300(grok.Role):
123    """The 300 level course adviser role is meant for the
124    assignment of dynamic roles only.
125    """
126    grok.name('waeup.local.CourseAdviser300')
127    grok.title(u'Course Adviser 300L')
128    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
129
130class CourseAdviser400(grok.Role):
131    """The 400 level course adviser role is meant for the
132    assignment of dynamic roles only.
133    """
134    grok.name('waeup.local.CourseAdviser400')
135    grok.title(u'Course Adviser 400L')
136    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
137
138class CourseAdviser500(grok.Role):
139    """The 500 level course adviser role is meant for the
140    assignment of dynamic roles only.
141    """
142    grok.name('waeup.local.CourseAdviser500')
143    grok.title(u'Course Adviser 500L')
144    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
145
146class CourseAdviser600(grok.Role):
147    """The 600 level course adviser role is meant for the
148    assignment of dynamic roles only.
149    """
150    grok.name('waeup.local.CourseAdviser600')
151    grok.title(u'Course Adviser 600L')
152    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
153
154class Lecturer(grok.Role):
155    """The lecturer role is meant for the
156    assignment of dynamic roles only.
157    """
158    grok.name('waeup.local.Lecturer')
159    grok.title(u'Lecturer')
160    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
161
162class Owner(grok.Role):
163    grok.name('waeup.local.Owner')
164    grok.title(u'Owner')
165    grok.permissions('waeup.editUser')
166
167# Site Roles
168class AcademicsOfficer(grok.Role):
169    grok.name('waeup.AcademicsOfficer')
170    grok.title(u'Academics Officer (view only)')
171    grok.permissions('waeup.viewAcademics')
172
173class AcademicsManager(grok.Role):
174    grok.name('waeup.AcademicsManager')
175    grok.title(u'Academics Manager')
176    grok.permissions('waeup.viewAcademics',
177                     'waeup.manageAcademics')
178
179class ACManager(grok.Role):
180    grok.name('waeup.ACManager')
181    grok.title(u'Access Code Manager')
182    grok.permissions('waeup.manageACBatches')
183
184class DataCenterManager(grok.Role):
185    grok.name('waeup.DataCenterManager')
186    grok.title(u'Datacenter Manager')
187    grok.permissions('waeup.manageDataCenter')
188
189class ImportManager(grok.Role):
190    grok.name('waeup.ImportManager')
191    grok.title(u'Import Manager')
192    grok.permissions('waeup.manageDataCenter',
193                     'waeup.importData')
194
195class UsersManager(grok.Role):
196    grok.name('waeup.UsersManager')
197    grok.title(u'Users Manager')
198    grok.permissions('waeup.manageUsers')
199
200class PortalManager(grok.Role):
201    grok.name('waeup.PortalManager')
202    grok.title(u'Portal Manager')
203    grok.permissions('waeup.managePortal', 'waeup.manageUsers',
204                     'waeup.viewAcademics', 'waeup.manageAcademics',
205                     'waeup.manageACBatches',
206                     'waeup.manageDataCenter', 'waeup.importData',
207                     'waeup.managePortalConfiguration', 'waeup.viewApplication',
208                     'waeup.manageApplication', 'waeup.handleApplication',
209                     'waeup.viewApplicantsTab', 'waeup.payApplicant',
210                     'waeup.viewApplicationStatistics',
211                     'waeup.viewStudent', 'waeup.manageStudent',
212                     'waeup.clearStudent', 'waeup.payStudent',
213                     'waeup.uploadStudentFile', 'waeup.showStudents',
214                     'waeup.viewStudentsContainer','waeup.viewStudentsTab',
215                     'waeup.viewHostels', 'waeup.manageHostels',
216                     'waeup.editUser'
217                     )
218
219def get_all_roles():
220    """Return a list of tuples ``<ROLE-NAME>, <ROLE>``.
221    """
222    return getUtilitiesFor(IRole)
223
224def get_waeup_roles(also_local=False):
225    """Get all Kofa roles.
226
227    Kofa roles are ordinary roles whose id by convention starts with
228    a ``waeup.`` prefix.
229
230    If `also_local` is ``True`` (``False`` by default), also local
231    roles are returned. Local Kofa roles are such whose id starts
232    with ``waeup.local.`` prefix (this is also a convention).
233
234    Returns a generator of the found roles.
235    """
236    for name, item in get_all_roles():
237        if not name.startswith('waeup.'):
238            # Ignore non-Kofa roles...
239            continue
240        if not also_local and name.startswith('waeup.local.'):
241            # Ignore local roles...
242            continue
243        yield item
244
245def get_waeup_role_names():
246    """Get the ids of all Kofa roles.
247
248    See :func:`get_waeup_roles` for what a 'KofaRole' is.
249
250    This function returns a sorted list of Kofa role names.
251    """
252    return sorted([x.id for x in get_waeup_roles()])
253
254class LocalRolesAssignable(grok.Adapter):
255    """Default implementation for `ILocalRolesAssignable`.
256
257    This adapter returns a list for dictionaries for objects for which
258    we want to know the roles assignable to them locally.
259
260    The returned dicts contain a ``name`` and a ``title`` entry which
261    give a role (``name``) and a description, for which kind of users
262    the permission is meant to be used (``title``).
263
264    Having this adapter registered we make sure, that for each normal
265    object we get a valid `ILocalRolesAssignable` adapter.
266
267    Objects that want to offer certain local roles, can do so by
268    setting a (preferably class-) attribute to a list of role ids.
269
270    You can also define different adapters for different contexts to
271    have different role lookup mechanisms become available. But in
272    normal cases it should be sufficient to use this basic adapter.
273    """
274    grok.context(Interface)
275    grok.provides(ILocalRolesAssignable)
276
277    _roles = []
278
279    def __init__(self, context):
280        self.context = context
281        role_ids = getattr(context, 'local_roles', self._roles)
282        self._roles = [(name, role) for name, role in get_all_roles()
283                       if name in role_ids]
284        return
285
286    def __call__(self):
287        """Get a list of dictionaries containing ``names`` (the roles to
288        assign) and ``titles`` (some description of the type of user
289        to assign each role to).
290        """
291        list_of_dict = [dict(
292                name=name,
293                title=role.title,
294                description=role.description)
295                for name, role in self._roles]
296        return sorted(list_of_dict, key=lambda x: x['name'])
297
298def get_all_users():
299    """Get a list of dictionaries.
300    """
301    users = sorted(grok.getSite()['users'].items(), key=lambda x: x[1].title)
302    for key, val in users:
303        yield(dict(name=key, val=val))
304
305def get_users_with_local_roles(context):
306    """Get a list of dicts representing the local roles set for `context`.
307
308    Each dict returns `user_name`, `user_title`, `local_role`,
309    `local_role_title`, and `setting` for each entry in the local
310    roles map of the `context` object.
311    """
312    try:
313        role_map = IPrincipalRoleMap(context)
314    except TypeError:
315        # no map no roles.
316        raise StopIteration
317    for local_role, user_name, setting in role_map.getPrincipalsAndRoles():
318        user = grok.getSite()['users'].get(user_name,None)
319        user_title = getattr(user, 'title', user_name)
320        local_role_title = dict(get_all_roles())[local_role].title
321        yield dict(user_name = user_name,
322                   user_title = user_title,
323                   local_role = local_role,
324                   local_role_title = local_role_title,
325                   setting = setting)
Note: See TracBrowser for help on using the repository browser.