source: main/waeup.kofa/trunk/src/waeup/kofa/permissions.py @ 9221

Last change on this file since 9221 was 9186, checked in by Henrik Bettermann, 12 years ago

Add missing permission to PortalManager? role.

  • Property svn:eol-style set to native
  • Property svn:keywords set to Id
File size: 11.3 KB
Line 
1## $Id: permissions.py 9186 2012-09-15 19:04:39Z henrik $
2##
3## Copyright (C) 2011 Uli Fouquet & Henrik Bettermann
4## This program is free software; you can redistribute it and/or modify
5## it under the terms of the GNU General Public License as published by
6## the Free Software Foundation; either version 2 of the License, or
7## (at your option) any later version.
8##
9## This program is distributed in the hope that it will be useful,
10## but WITHOUT ANY WARRANTY; without even the implied warranty of
11## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
12## GNU General Public License for more details.
13##
14## You should have received a copy of the GNU General Public License
15## along with this program; if not, write to the Free Software
16## Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
17##
18import grok
19from zope.component import getUtilitiesFor
20from zope.interface import Interface
21from zope.securitypolicy.interfaces import IRole, IPrincipalRoleMap
22from waeup.kofa.interfaces import ILocalRolesAssignable
23
24class Public(grok.Permission):
25    """Everyone-can-do-this-permission.
26
27    This permission is meant to be applied to objects/views/pages
28    etc., that should be usable/readable by everyone.
29
30    We need this to be able to tune default permissions more
31    restrictive and open up some dedicated objects like the front
32    page.
33    """
34    grok.name('waeup.Public')
35
36class Anonymous(grok.Permission):
37    """Only-anonymous-can-do-this-permission.
38    """
39    grok.name('waeup.Anonymous')
40
41class Authenticated(grok.Permission):
42    """Only-logged-in-users-can-do-this-permission.
43    """
44    grok.name('waeup.Authenticated')
45
46class ViewAcademicsPermission(grok.Permission):
47    grok.name('waeup.viewAcademics')
48
49class ManageAcademicsPermission(grok.Permission):
50    grok.name('waeup.manageAcademics')
51
52class ManagePortal(grok.Permission):
53    grok.name('waeup.managePortal')
54
55class ManageUsers(grok.Permission):
56    grok.name('waeup.manageUsers')
57
58class ShowStudents(grok.Permission):
59    grok.name('waeup.showStudents')
60
61class EditUser(grok.Permission):
62    grok.name('waeup.editUser')
63
64class ManageDataCenter(grok.Permission):
65    grok.name('waeup.manageDataCenter')
66
67class ImportData(grok.Permission):
68    grok.name('waeup.importData')
69
70class ManagePortalConfiguration(grok.Permission):
71    grok.name('waeup.managePortalConfiguration')
72
73class ManageACBatches(grok.Permission):
74    grok.name('waeup.manageACBatches')
75
76# Local Roles
77class DepartmentManager(grok.Role):
78    grok.name('waeup.local.DepartmentManager')
79    grok.title(u'Department Manager')
80    grok.permissions('waeup.manageAcademics','waeup.showStudents')
81
82class ClearanceOfficer(grok.Role):
83    """The clearance officer role is meant for the
84    assignment of dynamic roles only.
85    """
86    grok.name('waeup.local.ClearanceOfficer')
87    grok.title(u'Clearance Officer')
88    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
89
90class UGClearanceOfficer(grok.Role):
91    """The clearance officer role is meant for the
92    assignment of dynamic roles only.
93    """
94    grok.name('waeup.local.UGClearanceOfficer')
95    grok.title(u'UG Clearance Officer')
96    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
97
98class PGClearanceOfficer(grok.Role):
99    """The clearance officer role is meant for the
100    assignment of dynamic roles only.
101    """
102    grok.name('waeup.local.PGClearanceOfficer')
103    grok.title(u'PG Clearance Officer')
104    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
105
106class CourseAdviser100(grok.Role):
107    """The 100 level course adviser role is meant for the
108    assignment of dynamic roles only.
109    """
110    grok.name('waeup.local.CourseAdviser100')
111    grok.title(u'Course Adviser 100L')
112    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
113
114class CourseAdviser200(grok.Role):
115    """The course 200 level adviser role is meant for the
116    assignment of dynamic roles only.
117    """
118    grok.name('waeup.local.CourseAdviser200')
119    grok.title(u'Course Adviser 200L')
120    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
121
122class CourseAdviser300(grok.Role):
123    """The 300 level course adviser role is meant for the
124    assignment of dynamic roles only.
125    """
126    grok.name('waeup.local.CourseAdviser300')
127    grok.title(u'Course Adviser 300L')
128    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
129
130class CourseAdviser400(grok.Role):
131    """The 400 level course adviser role is meant for the
132    assignment of dynamic roles only.
133    """
134    grok.name('waeup.local.CourseAdviser400')
135    grok.title(u'Course Adviser 400L')
136    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
137
138class CourseAdviser500(grok.Role):
139    """The 500 level course adviser role is meant for the
140    assignment of dynamic roles only.
141    """
142    grok.name('waeup.local.CourseAdviser500')
143    grok.title(u'Course Adviser 500L')
144    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
145
146class CourseAdviser600(grok.Role):
147    """The 600 level course adviser role is meant for the
148    assignment of dynamic roles only.
149    """
150    grok.name('waeup.local.CourseAdviser600')
151    grok.title(u'Course Adviser 600L')
152    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
153
154class Lecturer(grok.Role):
155    """The lecturer role is meant for the
156    assignment of dynamic roles only.
157    """
158    grok.name('waeup.local.Lecturer')
159    grok.title(u'Lecturer')
160    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
161
162class Owner(grok.Role):
163    grok.name('waeup.local.Owner')
164    grok.title(u'Owner')
165    grok.permissions('waeup.editUser')
166
167# Site Roles
168class AcademicsOfficer(grok.Role):
169    grok.name('waeup.AcademicsOfficer')
170    grok.title(u'Academics Officer (view only)')
171    grok.permissions('waeup.viewAcademics')
172
173class AcademicsManager(grok.Role):
174    grok.name('waeup.AcademicsManager')
175    grok.title(u'Academics Manager')
176    grok.permissions('waeup.viewAcademics',
177                     'waeup.manageAcademics')
178
179class ACManager(grok.Role):
180    grok.name('waeup.ACManager')
181    grok.title(u'Access Code Manager')
182    grok.permissions('waeup.manageACBatches')
183
184class DataCenterManager(grok.Role):
185    grok.name('waeup.DataCenterManager')
186    grok.title(u'Datacenter Manager')
187    grok.permissions('waeup.manageDataCenter')
188
189class ImportManager(grok.Role):
190    grok.name('waeup.ImportManager')
191    grok.title(u'Import Manager')
192    grok.permissions('waeup.manageDataCenter',
193                     'waeup.importData')
194
195class UsersManager(grok.Role):
196    grok.name('waeup.UsersManager')
197    grok.title(u'Users Manager')
198    grok.permissions('waeup.manageUsers')
199
200class PortalManager(grok.Role):
201    grok.name('waeup.PortalManager')
202    grok.title(u'Portal Manager')
203    grok.permissions('waeup.managePortal', 'waeup.manageUsers',
204                     'waeup.viewAcademics', 'waeup.manageAcademics',
205                     'waeup.manageACBatches',
206                     'waeup.manageDataCenter', 'waeup.importData',
207                     'waeup.managePortalConfiguration', 'waeup.viewApplication',
208                     'waeup.manageApplication', 'waeup.handleApplication',
209                     'waeup.viewApplicantsTab', 'waeup.payApplicant',
210                     'waeup.viewApplicationStatistics',
211                     'waeup.viewStudent', 'waeup.manageStudent',
212                     'waeup.clearStudent', 'waeup.payStudent',
213                     'waeup.uploadStudentFile', 'waeup.showStudents',
214                     'waeup.viewStudentsContainer','waeup.viewStudentsTab',
215                     'waeup.handleAccommodation',
216                     'waeup.viewHostels', 'waeup.manageHostels',
217                     'waeup.editUser'
218                     )
219
220def get_all_roles():
221    """Return a list of tuples ``<ROLE-NAME>, <ROLE>``.
222    """
223    return getUtilitiesFor(IRole)
224
225def get_waeup_roles(also_local=False):
226    """Get all Kofa roles.
227
228    Kofa roles are ordinary roles whose id by convention starts with
229    a ``waeup.`` prefix.
230
231    If `also_local` is ``True`` (``False`` by default), also local
232    roles are returned. Local Kofa roles are such whose id starts
233    with ``waeup.local.`` prefix (this is also a convention).
234
235    Returns a generator of the found roles.
236    """
237    for name, item in get_all_roles():
238        if not name.startswith('waeup.'):
239            # Ignore non-Kofa roles...
240            continue
241        if not also_local and name.startswith('waeup.local.'):
242            # Ignore local roles...
243            continue
244        yield item
245
246def get_waeup_role_names():
247    """Get the ids of all Kofa roles.
248
249    See :func:`get_waeup_roles` for what a 'KofaRole' is.
250
251    This function returns a sorted list of Kofa role names.
252    """
253    return sorted([x.id for x in get_waeup_roles()])
254
255class LocalRolesAssignable(grok.Adapter):
256    """Default implementation for `ILocalRolesAssignable`.
257
258    This adapter returns a list for dictionaries for objects for which
259    we want to know the roles assignable to them locally.
260
261    The returned dicts contain a ``name`` and a ``title`` entry which
262    give a role (``name``) and a description, for which kind of users
263    the permission is meant to be used (``title``).
264
265    Having this adapter registered we make sure, that for each normal
266    object we get a valid `ILocalRolesAssignable` adapter.
267
268    Objects that want to offer certain local roles, can do so by
269    setting a (preferably class-) attribute to a list of role ids.
270
271    You can also define different adapters for different contexts to
272    have different role lookup mechanisms become available. But in
273    normal cases it should be sufficient to use this basic adapter.
274    """
275    grok.context(Interface)
276    grok.provides(ILocalRolesAssignable)
277
278    _roles = []
279
280    def __init__(self, context):
281        self.context = context
282        role_ids = getattr(context, 'local_roles', self._roles)
283        self._roles = [(name, role) for name, role in get_all_roles()
284                       if name in role_ids]
285        return
286
287    def __call__(self):
288        """Get a list of dictionaries containing ``names`` (the roles to
289        assign) and ``titles`` (some description of the type of user
290        to assign each role to).
291        """
292        list_of_dict = [dict(
293                name=name,
294                title=role.title,
295                description=role.description)
296                for name, role in self._roles]
297        return sorted(list_of_dict, key=lambda x: x['name'])
298
299def get_all_users():
300    """Get a list of dictionaries.
301    """
302    users = sorted(grok.getSite()['users'].items(), key=lambda x: x[1].title)
303    for key, val in users:
304        yield(dict(name=key, val=val))
305
306def get_users_with_local_roles(context):
307    """Get a list of dicts representing the local roles set for `context`.
308
309    Each dict returns `user_name`, `user_title`, `local_role`,
310    `local_role_title`, and `setting` for each entry in the local
311    roles map of the `context` object.
312    """
313    try:
314        role_map = IPrincipalRoleMap(context)
315    except TypeError:
316        # no map no roles.
317        raise StopIteration
318    for local_role, user_name, setting in role_map.getPrincipalsAndRoles():
319        user = grok.getSite()['users'].get(user_name,None)
320        user_title = getattr(user, 'title', user_name)
321        local_role_title = dict(get_all_roles())[local_role].title
322        yield dict(user_name = user_name,
323                   user_title = user_title,
324                   local_role = local_role,
325                   local_role_title = local_role_title,
326                   setting = setting)
Note: See TracBrowser for help on using the repository browser.