source: main/waeup.kofa/trunk/src/waeup/kofa/permissions.py @ 9512

Last change on this file since 9512 was 9335, checked in by Henrik Bettermann, 12 years ago

ApplicantAccount? can't reuse checkPassword.

Add new role and permission.

  • Property svn:eol-style set to native
  • Property svn:keywords set to Id
File size: 13.6 KB
Line 
1## $Id: permissions.py 9335 2012-10-15 05:08:01Z henrik $
2##
3## Copyright (C) 2011 Uli Fouquet & Henrik Bettermann
4## This program is free software; you can redistribute it and/or modify
5## it under the terms of the GNU General Public License as published by
6## the Free Software Foundation; either version 2 of the License, or
7## (at your option) any later version.
8##
9## This program is distributed in the hope that it will be useful,
10## but WITHOUT ANY WARRANTY; without even the implied warranty of
11## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
12## GNU General Public License for more details.
13##
14## You should have received a copy of the GNU General Public License
15## along with this program; if not, write to the Free Software
16## Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
17##
18import grok
19from zope.component import getUtilitiesFor
20from zope.interface import Interface
21from zope.securitypolicy.interfaces import IRole, IPrincipalRoleMap
22from waeup.kofa.interfaces import ILocalRolesAssignable
23
24class Public(grok.Permission):
25    """Everyone-can-do-this-permission.
26
27    This permission is meant to be applied to objects/views/pages
28    etc., that should be usable/readable by everyone.
29
30    We need this to be able to tune default permissions more
31    restrictive and open up some dedicated objects like the front
32    page.
33    """
34    grok.name('waeup.Public')
35
36class Anonymous(grok.Permission):
37    """Only-anonymous-can-do-this-permission.
38    """
39    grok.name('waeup.Anonymous')
40
41class Authenticated(grok.Permission):
42    """Only-logged-in-users-can-do-this-permission.
43    """
44    grok.name('waeup.Authenticated')
45
46class ViewAcademicsPermission(grok.Permission):
47    grok.name('waeup.viewAcademics')
48
49class ManageAcademicsPermission(grok.Permission):
50    grok.name('waeup.manageAcademics')
51
52class ManagePortal(grok.Permission):
53    grok.name('waeup.managePortal')
54
55class ManageUsers(grok.Permission):
56    grok.name('waeup.manageUsers')
57
58class ShowStudents(grok.Permission):
59    grok.name('waeup.showStudents')
60
61class EditUser(grok.Permission):
62    grok.name('waeup.editUser')
63
64class ManageDataCenter(grok.Permission):
65    grok.name('waeup.manageDataCenter')
66
67class ImportData(grok.Permission):
68    grok.name('waeup.importData')
69
70class ManagePortalConfiguration(grok.Permission):
71    grok.name('waeup.managePortalConfiguration')
72
73class ManageACBatches(grok.Permission):
74    grok.name('waeup.manageACBatches')
75
76# Local Roles
77class DepartmentManager(grok.Role):
78    grok.name('waeup.local.DepartmentManager')
79    grok.title(u'Department Manager')
80    grok.permissions('waeup.manageAcademics','waeup.showStudents')
81
82class ClearanceOfficer(grok.Role):
83    """The clearance officer role is meant for the
84    assignment of dynamic roles only.
85    """
86    grok.name('waeup.local.ClearanceOfficer')
87    grok.title(u'Clearance Officer')
88    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
89
90class UGClearanceOfficer(grok.Role):
91    """The clearance officer role is meant for the
92    assignment of dynamic roles only.
93    """
94    grok.name('waeup.local.UGClearanceOfficer')
95    grok.title(u'UG Clearance Officer')
96    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
97
98class PGClearanceOfficer(grok.Role):
99    """The clearance officer role is meant for the
100    assignment of dynamic roles only.
101    """
102    grok.name('waeup.local.PGClearanceOfficer')
103    grok.title(u'PG Clearance Officer')
104    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
105
106class CourseAdviser100(grok.Role):
107    """The 100 level course adviser role is meant for the
108    assignment of dynamic roles only.
109    """
110    grok.name('waeup.local.CourseAdviser100')
111    grok.title(u'Course Adviser 100L')
112    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
113
114class CourseAdviser200(grok.Role):
115    """The course 200 level adviser role is meant for the
116    assignment of dynamic roles only.
117    """
118    grok.name('waeup.local.CourseAdviser200')
119    grok.title(u'Course Adviser 200L')
120    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
121
122class CourseAdviser300(grok.Role):
123    """The 300 level course adviser role is meant for the
124    assignment of dynamic roles only.
125    """
126    grok.name('waeup.local.CourseAdviser300')
127    grok.title(u'Course Adviser 300L')
128    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
129
130class CourseAdviser400(grok.Role):
131    """The 400 level course adviser role is meant for the
132    assignment of dynamic roles only.
133    """
134    grok.name('waeup.local.CourseAdviser400')
135    grok.title(u'Course Adviser 400L')
136    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
137
138class CourseAdviser500(grok.Role):
139    """The 500 level course adviser role is meant for the
140    assignment of dynamic roles only.
141    """
142    grok.name('waeup.local.CourseAdviser500')
143    grok.title(u'Course Adviser 500L')
144    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
145
146class CourseAdviser600(grok.Role):
147    """The 600 level course adviser role is meant for the
148    assignment of dynamic roles only.
149    """
150    grok.name('waeup.local.CourseAdviser600')
151    grok.title(u'Course Adviser 600L')
152    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
153
154class Lecturer(grok.Role):
155    """The lecturer role is meant for the
156    assignment of dynamic roles only.
157    """
158    grok.name('waeup.local.Lecturer')
159    grok.title(u'Lecturer')
160    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
161
162class Owner(grok.Role):
163    grok.name('waeup.local.Owner')
164    grok.title(u'Owner')
165    grok.permissions('waeup.editUser')
166
167# Site Roles
168class AcademicsOfficer(grok.Role):
169    grok.name('waeup.AcademicsOfficer')
170    grok.title(u'Academics Officer (view only)')
171    grok.permissions('waeup.viewAcademics')
172
173class AcademicsManager(grok.Role):
174    grok.name('waeup.AcademicsManager')
175    grok.title(u'Academics Manager')
176    grok.permissions('waeup.viewAcademics',
177                     'waeup.manageAcademics')
178
179class ACManager(grok.Role):
180    grok.name('waeup.ACManager')
181    grok.title(u'Access Code Manager')
182    grok.permissions('waeup.manageACBatches')
183
184class DataCenterManager(grok.Role):
185    grok.name('waeup.DataCenterManager')
186    grok.title(u'Datacenter Manager')
187    grok.permissions('waeup.manageDataCenter')
188
189class ImportManager(grok.Role):
190    grok.name('waeup.ImportManager')
191    grok.title(u'Import Manager')
192    grok.permissions('waeup.manageDataCenter',
193                     'waeup.importData')
194
195class UsersManager(grok.Role):
196    grok.name('waeup.UsersManager')
197    grok.title(u'Users Manager')
198    grok.permissions('waeup.manageUsers',
199                     'waeup.editUser')
200
201class WorkflowManager(grok.Role):
202    grok.name('waeup.WorkflowManager')
203    grok.title(u'Workflow Manager')
204    grok.permissions('waeup.triggerTransition')
205
206class PortalManager(grok.Role):
207    grok.name('waeup.PortalManager')
208    grok.title(u'Portal Manager')
209    grok.permissions('waeup.managePortal',
210                     'waeup.manageUsers',
211                     'waeup.viewAcademics', 'waeup.manageAcademics',
212                     'waeup.manageACBatches',
213                     'waeup.manageDataCenter',
214                     'waeup.importData',
215                     'waeup.managePortalConfiguration', 'waeup.viewApplication',
216                     'waeup.manageApplication', 'waeup.handleApplication',
217                     'waeup.viewApplicantsTab', 'waeup.payApplicant',
218                     'waeup.viewApplicationStatistics',
219                     'waeup.viewStudent', 'waeup.manageStudent',
220                     'waeup.clearStudent', 'waeup.payStudent',
221                     'waeup.uploadStudentFile', 'waeup.showStudents',
222                     'waeup.triggerTransition',
223                     'waeup.viewStudentsContainer','waeup.viewStudentsTab',
224                     'waeup.handleAccommodation',
225                     'waeup.viewHostels', 'waeup.manageHostels',
226                     'waeup.editUser',
227                     'waeup.loginAsStudent'
228                     )
229
230class CCOfficer(grok.Role):
231    """This is basically a copy of the the PortalManager class. We exclude some
232    'dangerous' permissions by commenting them out.
233    """
234    grok.name('waeup.CCOfficer')
235    grok.title(u'Computer Center Officer')
236    grok.permissions(#'waeup.managePortal',
237                     #'waeup.manageUsers',
238                     'waeup.viewAcademics', 'waeup.manageAcademics',
239                     #'waeup.manageACBatches',
240                     'waeup.manageDataCenter',
241                     #'waeup.importData',
242                     'waeup.managePortalConfiguration', 'waeup.viewApplication',
243                     'waeup.manageApplication', 'waeup.handleApplication',
244                     'waeup.viewApplicantsTab', 'waeup.payApplicant',
245                     'waeup.viewApplicationStatistics',
246                     'waeup.viewStudent', 'waeup.manageStudent',
247                     'waeup.clearStudent', 'waeup.payStudent',
248                     'waeup.uploadStudentFile', 'waeup.showStudents',
249                     #'waeup.triggerTransition',
250                     'waeup.viewStudentsContainer','waeup.viewStudentsTab',
251                     'waeup.handleAccommodation',
252                     'waeup.viewHostels', 'waeup.manageHostels',
253                     #'waeup.editUser',
254                     #'waeup.loginAsStudent'
255                     )
256
257def get_all_roles():
258    """Return a list of tuples ``<ROLE-NAME>, <ROLE>``.
259    """
260    return getUtilitiesFor(IRole)
261
262def get_waeup_roles(also_local=False):
263    """Get all Kofa roles.
264
265    Kofa roles are ordinary roles whose id by convention starts with
266    a ``waeup.`` prefix.
267
268    If `also_local` is ``True`` (``False`` by default), also local
269    roles are returned. Local Kofa roles are such whose id starts
270    with ``waeup.local.`` prefix (this is also a convention).
271
272    Returns a generator of the found roles.
273    """
274    for name, item in get_all_roles():
275        if not name.startswith('waeup.'):
276            # Ignore non-Kofa roles...
277            continue
278        if not also_local and name.startswith('waeup.local.'):
279            # Ignore local roles...
280            continue
281        yield item
282
283def get_waeup_role_names():
284    """Get the ids of all Kofa roles.
285
286    See :func:`get_waeup_roles` for what a 'KofaRole' is.
287
288    This function returns a sorted list of Kofa role names.
289    """
290    return sorted([x.id for x in get_waeup_roles()])
291
292class LocalRolesAssignable(grok.Adapter):
293    """Default implementation for `ILocalRolesAssignable`.
294
295    This adapter returns a list for dictionaries for objects for which
296    we want to know the roles assignable to them locally.
297
298    The returned dicts contain a ``name`` and a ``title`` entry which
299    give a role (``name``) and a description, for which kind of users
300    the permission is meant to be used (``title``).
301
302    Having this adapter registered we make sure, that for each normal
303    object we get a valid `ILocalRolesAssignable` adapter.
304
305    Objects that want to offer certain local roles, can do so by
306    setting a (preferably class-) attribute to a list of role ids.
307
308    You can also define different adapters for different contexts to
309    have different role lookup mechanisms become available. But in
310    normal cases it should be sufficient to use this basic adapter.
311    """
312    grok.context(Interface)
313    grok.provides(ILocalRolesAssignable)
314
315    _roles = []
316
317    def __init__(self, context):
318        self.context = context
319        role_ids = getattr(context, 'local_roles', self._roles)
320        self._roles = [(name, role) for name, role in get_all_roles()
321                       if name in role_ids]
322        return
323
324    def __call__(self):
325        """Get a list of dictionaries containing ``names`` (the roles to
326        assign) and ``titles`` (some description of the type of user
327        to assign each role to).
328        """
329        list_of_dict = [dict(
330                name=name,
331                title=role.title,
332                description=role.description)
333                for name, role in self._roles]
334        return sorted(list_of_dict, key=lambda x: x['name'])
335
336def get_all_users():
337    """Get a list of dictionaries.
338    """
339    users = sorted(grok.getSite()['users'].items(), key=lambda x: x[1].title)
340    for key, val in users:
341        yield(dict(name=key, val=val))
342
343def get_users_with_local_roles(context):
344    """Get a list of dicts representing the local roles set for `context`.
345
346    Each dict returns `user_name`, `user_title`, `local_role`,
347    `local_role_title`, and `setting` for each entry in the local
348    roles map of the `context` object.
349    """
350    try:
351        role_map = IPrincipalRoleMap(context)
352    except TypeError:
353        # no map no roles.
354        raise StopIteration
355    for local_role, user_name, setting in role_map.getPrincipalsAndRoles():
356        user = grok.getSite()['users'].get(user_name,None)
357        user_title = getattr(user, 'title', user_name)
358        local_role_title = dict(get_all_roles())[local_role].title
359        yield dict(user_name = user_name,
360                   user_title = user_title,
361                   local_role = local_role,
362                   local_role_title = local_role_title,
363                   setting = setting)
364
365def get_users_with_role(role, context):
366    """Get a list of dicts representing the usres who have been granted
367    a role for `context`.
368    """
369    try:
370        role_map = IPrincipalRoleMap(context)
371    except TypeError:
372        # no map no roles.
373        raise StopIteration
374    for user_name, setting in role_map.getPrincipalsForRole(role):
375        user = grok.getSite()['users'].get(user_name,None)
376        user_title = getattr(user, 'title', user_name)
377        user_email = getattr(user, 'email', None)
378        yield dict(user_name = user_name,
379                   user_title = user_title,
380                   user_email = user_email,
381                   setting = setting)
Note: See TracBrowser for help on using the repository browser.