source: main/waeup.kofa/trunk/src/waeup/kofa/permissions.py @ 9637

Last change on this file since 9637 was 9637, checked in by Henrik Bettermann, 12 years ago

Add viewlets for reports.py

Add permission to roles.

Set label attribbute of views.

  • Property svn:eol-style set to native
  • Property svn:keywords set to Id
File size: 13.7 KB
Line 
1## $Id: permissions.py 9637 2012-11-15 14:25:56Z henrik $
2##
3## Copyright (C) 2011 Uli Fouquet & Henrik Bettermann
4## This program is free software; you can redistribute it and/or modify
5## it under the terms of the GNU General Public License as published by
6## the Free Software Foundation; either version 2 of the License, or
7## (at your option) any later version.
8##
9## This program is distributed in the hope that it will be useful,
10## but WITHOUT ANY WARRANTY; without even the implied warranty of
11## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
12## GNU General Public License for more details.
13##
14## You should have received a copy of the GNU General Public License
15## along with this program; if not, write to the Free Software
16## Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
17##
18import grok
19from zope.component import getUtilitiesFor
20from zope.interface import Interface
21from zope.securitypolicy.interfaces import IRole, IPrincipalRoleMap
22from waeup.kofa.interfaces import ILocalRolesAssignable
23
24class Public(grok.Permission):
25    """Everyone-can-do-this-permission.
26
27    This permission is meant to be applied to objects/views/pages
28    etc., that should be usable/readable by everyone.
29
30    We need this to be able to tune default permissions more
31    restrictive and open up some dedicated objects like the front
32    page.
33    """
34    grok.name('waeup.Public')
35
36class Anonymous(grok.Permission):
37    """Only-anonymous-can-do-this-permission.
38    """
39    grok.name('waeup.Anonymous')
40
41class Authenticated(grok.Permission):
42    """Only-logged-in-users-can-do-this-permission.
43    """
44    grok.name('waeup.Authenticated')
45
46class ViewAcademicsPermission(grok.Permission):
47    grok.name('waeup.viewAcademics')
48
49class ManageAcademicsPermission(grok.Permission):
50    grok.name('waeup.manageAcademics')
51
52class ManagePortal(grok.Permission):
53    grok.name('waeup.managePortal')
54
55class ManageUsers(grok.Permission):
56    grok.name('waeup.manageUsers')
57
58class ShowStudents(grok.Permission):
59    grok.name('waeup.showStudents')
60
61class EditUser(grok.Permission):
62    grok.name('waeup.editUser')
63
64class ManageDataCenter(grok.Permission):
65    grok.name('waeup.manageDataCenter')
66
67class ImportData(grok.Permission):
68    grok.name('waeup.importData')
69
70class ManagePortalConfiguration(grok.Permission):
71    grok.name('waeup.managePortalConfiguration')
72
73class ManageACBatches(grok.Permission):
74    grok.name('waeup.manageACBatches')
75
76# Local Roles
77class DepartmentManager(grok.Role):
78    grok.name('waeup.local.DepartmentManager')
79    grok.title(u'Department Manager')
80    grok.permissions('waeup.manageAcademics','waeup.showStudents')
81
82class ClearanceOfficer(grok.Role):
83    """The clearance officer role is meant for the
84    assignment of dynamic roles only.
85    """
86    grok.name('waeup.local.ClearanceOfficer')
87    grok.title(u'Clearance Officer')
88    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
89
90class UGClearanceOfficer(grok.Role):
91    """The clearance officer role is meant for the
92    assignment of dynamic roles only.
93    """
94    grok.name('waeup.local.UGClearanceOfficer')
95    grok.title(u'UG Clearance Officer')
96    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
97
98class PGClearanceOfficer(grok.Role):
99    """The clearance officer role is meant for the
100    assignment of dynamic roles only.
101    """
102    grok.name('waeup.local.PGClearanceOfficer')
103    grok.title(u'PG Clearance Officer')
104    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
105
106class CourseAdviser100(grok.Role):
107    """The 100 level course adviser role is meant for the
108    assignment of dynamic roles only.
109    """
110    grok.name('waeup.local.CourseAdviser100')
111    grok.title(u'Course Adviser 100L')
112    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
113
114class CourseAdviser200(grok.Role):
115    """The course 200 level adviser role is meant for the
116    assignment of dynamic roles only.
117    """
118    grok.name('waeup.local.CourseAdviser200')
119    grok.title(u'Course Adviser 200L')
120    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
121
122class CourseAdviser300(grok.Role):
123    """The 300 level course adviser role is meant for the
124    assignment of dynamic roles only.
125    """
126    grok.name('waeup.local.CourseAdviser300')
127    grok.title(u'Course Adviser 300L')
128    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
129
130class CourseAdviser400(grok.Role):
131    """The 400 level course adviser role is meant for the
132    assignment of dynamic roles only.
133    """
134    grok.name('waeup.local.CourseAdviser400')
135    grok.title(u'Course Adviser 400L')
136    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
137
138class CourseAdviser500(grok.Role):
139    """The 500 level course adviser role is meant for the
140    assignment of dynamic roles only.
141    """
142    grok.name('waeup.local.CourseAdviser500')
143    grok.title(u'Course Adviser 500L')
144    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
145
146class CourseAdviser600(grok.Role):
147    """The 600 level course adviser role is meant for the
148    assignment of dynamic roles only.
149    """
150    grok.name('waeup.local.CourseAdviser600')
151    grok.title(u'Course Adviser 600L')
152    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
153
154class Lecturer(grok.Role):
155    """The lecturer role is meant for the
156    assignment of dynamic roles only.
157    """
158    grok.name('waeup.local.Lecturer')
159    grok.title(u'Lecturer')
160    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
161
162class Owner(grok.Role):
163    grok.name('waeup.local.Owner')
164    grok.title(u'Owner')
165    grok.permissions('waeup.editUser')
166
167# Site Roles
168class AcademicsOfficer(grok.Role):
169    grok.name('waeup.AcademicsOfficer')
170    grok.title(u'Academics Officer (view only)')
171    grok.permissions('waeup.viewAcademics')
172
173class AcademicsManager(grok.Role):
174    grok.name('waeup.AcademicsManager')
175    grok.title(u'Academics Manager')
176    grok.permissions('waeup.viewAcademics',
177                     'waeup.manageAcademics')
178
179class ACManager(grok.Role):
180    grok.name('waeup.ACManager')
181    grok.title(u'Access Code Manager')
182    grok.permissions('waeup.manageACBatches')
183
184class DataCenterManager(grok.Role):
185    grok.name('waeup.DataCenterManager')
186    grok.title(u'Datacenter Manager')
187    grok.permissions('waeup.manageDataCenter')
188
189class ImportManager(grok.Role):
190    grok.name('waeup.ImportManager')
191    grok.title(u'Import Manager')
192    grok.permissions('waeup.manageDataCenter',
193                     'waeup.importData')
194
195class UsersManager(grok.Role):
196    grok.name('waeup.UsersManager')
197    grok.title(u'Users Manager')
198    grok.permissions('waeup.manageUsers',
199                     'waeup.editUser')
200
201class WorkflowManager(grok.Role):
202    grok.name('waeup.WorkflowManager')
203    grok.title(u'Workflow Manager')
204    grok.permissions('waeup.triggerTransition')
205
206class PortalManager(grok.Role):
207    grok.name('waeup.PortalManager')
208    grok.title(u'Portal Manager')
209    grok.permissions('waeup.managePortal',
210                     'waeup.manageUsers',
211                     'waeup.viewAcademics', 'waeup.manageAcademics',
212                     'waeup.manageACBatches',
213                     'waeup.manageDataCenter',
214                     'waeup.importData',
215                     'waeup.managePortalConfiguration', 'waeup.viewApplication',
216                     'waeup.manageApplication', 'waeup.handleApplication',
217                     'waeup.viewApplicantsTab', 'waeup.payApplicant',
218                     'waeup.viewApplicationStatistics',
219                     'waeup.viewStudent', 'waeup.manageStudent',
220                     'waeup.clearStudent', 'waeup.payStudent',
221                     'waeup.uploadStudentFile', 'waeup.showStudents',
222                     'waeup.triggerTransition',
223                     'waeup.viewStudentsContainer','waeup.viewStudentsTab',
224                     'waeup.handleAccommodation',
225                     'waeup.viewHostels', 'waeup.manageHostels',
226                     'waeup.editUser',
227                     'waeup.loginAsStudent',
228                     'waeup.manageReports',
229                     )
230
231class CCOfficer(grok.Role):
232    """This is basically a copy of the the PortalManager class. We exclude some
233    'dangerous' permissions by commenting them out.
234    """
235    grok.name('waeup.CCOfficer')
236    grok.title(u'Computer Center Officer')
237    grok.permissions(#'waeup.managePortal',
238                     #'waeup.manageUsers',
239                     'waeup.viewAcademics', 'waeup.manageAcademics',
240                     #'waeup.manageACBatches',
241                     'waeup.manageDataCenter',
242                     #'waeup.importData',
243                     'waeup.managePortalConfiguration', 'waeup.viewApplication',
244                     'waeup.manageApplication', 'waeup.handleApplication',
245                     'waeup.viewApplicantsTab', 'waeup.payApplicant',
246                     'waeup.viewApplicationStatistics',
247                     'waeup.viewStudent', 'waeup.manageStudent',
248                     'waeup.clearStudent', 'waeup.payStudent',
249                     'waeup.uploadStudentFile', 'waeup.showStudents',
250                     #'waeup.triggerTransition',
251                     'waeup.viewStudentsContainer','waeup.viewStudentsTab',
252                     'waeup.handleAccommodation',
253                     'waeup.viewHostels', 'waeup.manageHostels',
254                     #'waeup.editUser',
255                     #'waeup.loginAsStudent',
256                     'waeup.manageReports',
257                     )
258
259def get_all_roles():
260    """Return a list of tuples ``<ROLE-NAME>, <ROLE>``.
261    """
262    return getUtilitiesFor(IRole)
263
264def get_waeup_roles(also_local=False):
265    """Get all Kofa roles.
266
267    Kofa roles are ordinary roles whose id by convention starts with
268    a ``waeup.`` prefix.
269
270    If `also_local` is ``True`` (``False`` by default), also local
271    roles are returned. Local Kofa roles are such whose id starts
272    with ``waeup.local.`` prefix (this is also a convention).
273
274    Returns a generator of the found roles.
275    """
276    for name, item in get_all_roles():
277        if not name.startswith('waeup.'):
278            # Ignore non-Kofa roles...
279            continue
280        if not also_local and name.startswith('waeup.local.'):
281            # Ignore local roles...
282            continue
283        yield item
284
285def get_waeup_role_names():
286    """Get the ids of all Kofa roles.
287
288    See :func:`get_waeup_roles` for what a 'KofaRole' is.
289
290    This function returns a sorted list of Kofa role names.
291    """
292    return sorted([x.id for x in get_waeup_roles()])
293
294class LocalRolesAssignable(grok.Adapter):
295    """Default implementation for `ILocalRolesAssignable`.
296
297    This adapter returns a list for dictionaries for objects for which
298    we want to know the roles assignable to them locally.
299
300    The returned dicts contain a ``name`` and a ``title`` entry which
301    give a role (``name``) and a description, for which kind of users
302    the permission is meant to be used (``title``).
303
304    Having this adapter registered we make sure, that for each normal
305    object we get a valid `ILocalRolesAssignable` adapter.
306
307    Objects that want to offer certain local roles, can do so by
308    setting a (preferably class-) attribute to a list of role ids.
309
310    You can also define different adapters for different contexts to
311    have different role lookup mechanisms become available. But in
312    normal cases it should be sufficient to use this basic adapter.
313    """
314    grok.context(Interface)
315    grok.provides(ILocalRolesAssignable)
316
317    _roles = []
318
319    def __init__(self, context):
320        self.context = context
321        role_ids = getattr(context, 'local_roles', self._roles)
322        self._roles = [(name, role) for name, role in get_all_roles()
323                       if name in role_ids]
324        return
325
326    def __call__(self):
327        """Get a list of dictionaries containing ``names`` (the roles to
328        assign) and ``titles`` (some description of the type of user
329        to assign each role to).
330        """
331        list_of_dict = [dict(
332                name=name,
333                title=role.title,
334                description=role.description)
335                for name, role in self._roles]
336        return sorted(list_of_dict, key=lambda x: x['name'])
337
338def get_all_users():
339    """Get a list of dictionaries.
340    """
341    users = sorted(grok.getSite()['users'].items(), key=lambda x: x[1].title)
342    for key, val in users:
343        yield(dict(name=key, val=val))
344
345def get_users_with_local_roles(context):
346    """Get a list of dicts representing the local roles set for `context`.
347
348    Each dict returns `user_name`, `user_title`, `local_role`,
349    `local_role_title`, and `setting` for each entry in the local
350    roles map of the `context` object.
351    """
352    try:
353        role_map = IPrincipalRoleMap(context)
354    except TypeError:
355        # no map no roles.
356        raise StopIteration
357    for local_role, user_name, setting in role_map.getPrincipalsAndRoles():
358        user = grok.getSite()['users'].get(user_name,None)
359        user_title = getattr(user, 'title', user_name)
360        local_role_title = dict(get_all_roles())[local_role].title
361        yield dict(user_name = user_name,
362                   user_title = user_title,
363                   local_role = local_role,
364                   local_role_title = local_role_title,
365                   setting = setting)
366
367def get_users_with_role(role, context):
368    """Get a list of dicts representing the usres who have been granted
369    a role for `context`.
370    """
371    try:
372        role_map = IPrincipalRoleMap(context)
373    except TypeError:
374        # no map no roles.
375        raise StopIteration
376    for user_name, setting in role_map.getPrincipalsForRole(role):
377        user = grok.getSite()['users'].get(user_name,None)
378        user_title = getattr(user, 'title', user_name)
379        user_email = getattr(user, 'email', None)
380        yield dict(user_name = user_name,
381                   user_title = user_title,
382                   user_email = user_email,
383                   setting = setting)
Note: See TracBrowser for help on using the repository browser.