source: main/waeup.sirp/trunk/src/waeup/sirp/permissions.py @ 11110

Last change on this file since 11110 was 7335, checked in by Henrik Bettermann, 13 years ago

Make local roles assignable in certificate containers.

  • Property svn:eol-style set to native
  • Property svn:keywords set to Id
File size: 9.3 KB
Line 
1## $Id: permissions.py 7335 2011-12-13 07:30:25Z henrik $
2##
3## Copyright (C) 2011 Uli Fouquet & Henrik Bettermann
4## This program is free software; you can redistribute it and/or modify
5## it under the terms of the GNU General Public License as published by
6## the Free Software Foundation; either version 2 of the License, or
7## (at your option) any later version.
8##
9## This program is distributed in the hope that it will be useful,
10## but WITHOUT ANY WARRANTY; without even the implied warranty of
11## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
12## GNU General Public License for more details.
13##
14## You should have received a copy of the GNU General Public License
15## along with this program; if not, write to the Free Software
16## Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
17##
18import grok
19from zope.component import getUtilitiesFor
20from zope.interface import Interface
21from zope.securitypolicy.interfaces import IRole, IPrincipalRoleMap
22from waeup.sirp.interfaces import ILocalRolesAssignable
23
24class Public(grok.Permission):
25    """Everyone-can-do-this-permission.
26
27    This permission is meant to be applied to objects/views/pages
28    etc., that should be usable/readable by everyone.
29
30    We need this to be able to tune default permissions more
31    restrictive and open up some dedicated objects like the front
32    page.
33    """
34    grok.name('waeup.Public')
35
36class Anonymous(grok.Permission):
37    """Only-anonymous-can-do-this-permission.
38    """
39    grok.name('waeup.Anonymous')
40
41class Authenticated(grok.Permission):
42    """Only-logged-in-users-can-do-this-permission.
43    """
44    grok.name('waeup.Authenticated')
45
46class ViewAcademicsPermission(grok.Permission):
47    grok.name('waeup.viewAcademics')
48
49class ManageUniversity(grok.Permission):
50    grok.name('waeup.manageUniversity')
51
52class ManageUsers(grok.Permission):
53    grok.name('waeup.manageUsers')
54
55class ShowStudents(grok.Permission):
56    grok.name('waeup.showStudents')
57
58class EditUser(grok.Permission):
59    grok.name('waeup.editUser')
60
61class ManageDataCenter(grok.Permission):
62    grok.name('waeup.manageDataCenter')
63
64class ManagePortalConfiguration(grok.Permission):
65    grok.name('waeup.managePortalConfiguration')
66
67class ManageACBatches(grok.Permission):
68    grok.name('waeup.manageACBatches')
69
70# Local Roles
71class DepartmentManager(grok.Role):
72    grok.name('waeup.local.DepartmentManager')
73    grok.title(u'Department Manager')
74    grok.permissions('waeup.manageUniversity','waeup.showStudents')
75
76class ClearanceOfficer(grok.Role):
77    """The clearance officer role is meant for the
78    assignment of dynamic roles only.
79    """
80    grok.name('waeup.local.ClearanceOfficer')
81    grok.title(u'Clearance Officer')
82    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
83
84class CourseAdviser100(grok.Role):
85    """The 100 level course adviser role is meant for the
86    assignment of dynamic roles only.
87    """
88    grok.name('waeup.local.CourseAdviser100')
89    grok.title(u'Course Adviser 100L')
90    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
91
92class CourseAdviser200(grok.Role):
93    """The course 200 level adviser role is meant for the
94    assignment of dynamic roles only.
95    """
96    grok.name('waeup.local.CourseAdviser200')
97    grok.title(u'Course Adviser 200L')
98    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
99
100class CourseAdviser300(grok.Role):
101    """The 300 level course adviser role is meant for the
102    assignment of dynamic roles only.
103    """
104    grok.name('waeup.local.CourseAdviser300')
105    grok.title(u'Course Adviser 300L')
106    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
107
108class CourseAdviser400(grok.Role):
109    """The 400 level course adviser role is meant for the
110    assignment of dynamic roles only.
111    """
112    grok.name('waeup.local.CourseAdviser400')
113    grok.title(u'Course Adviser 400L')
114    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
115
116class CourseAdviser500(grok.Role):
117    """The 500 level course adviser role is meant for the
118    assignment of dynamic roles only.
119    """
120    grok.name('waeup.local.CourseAdviser500')
121    grok.title(u'Course Adviser 500L')
122    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
123
124class CourseAdviser600(grok.Role):
125    """The 600 level course adviser role is meant for the
126    assignment of dynamic roles only.
127    """
128    grok.name('waeup.local.CourseAdviser600')
129    grok.title(u'Course Adviser 600L')
130    grok.permissions('waeup.showStudents', 'waeup.viewAcademics')
131
132class Owner(grok.Role):
133    grok.name('waeup.local.Owner')
134    grok.title(u'Owner')
135    grok.permissions('waeup.editUser')
136
137# Site Roles
138class AcademicsOfficer(grok.Role):
139    grok.name('waeup.AcademicsOfficer')
140    grok.title(u'Academics Officer (view only)')
141    grok.permissions('waeup.viewAcademics')
142
143class ACManager(grok.Role):
144    grok.name('waeup.ACManager')
145    grok.title(u'Access Code Manager')
146    grok.permissions('waeup.manageACBatches')
147
148class PortalManager(grok.Role):
149    grok.name('waeup.PortalManager')
150    grok.title(u'Portal Manager')
151    grok.permissions('waeup.manageUniversity', 'waeup.manageUsers',
152                     'waeup.viewAcademics', 'waeup.manageACBatches',
153                     'waeup.manageDataCenter','waeup.managePortalSettings',
154                     'waeup.managePortalConfiguration', 'waeup.viewApplication',
155                     'waeup.manageApplication', 'waeup.handleApplication',
156                     'waeup.viewApplicantsTab', 'waeup.payApplicant',
157                     'waeup.viewStudent', 'waeup.manageStudent',
158                     'waeup.clearStudent', 'waeup.payStudent',
159                     'waeup.uploadStudentFile', 'waeup.showStudents',
160                     'waeup.viewStudentsContainer','waeup.viewStudentsTab',
161                     'waeup.viewHostels', 'waeup.manageHostels',
162                     )
163
164def get_all_roles():
165    """Return a list of tuples ``<ROLE-NAME>, <ROLE>``.
166    """
167    return getUtilitiesFor(IRole)
168
169def get_waeup_roles(also_local=False):
170    """Get all SIRP roles.
171
172    SIRP roles are ordinary roles whose id by convention starts with
173    a ``waeup.`` prefix.
174
175    If `also_local` is ``True`` (``False`` by default), also local
176    roles are returned. Local SIRP roles are such whose id starts
177    with ``waeup.local.`` prefix (this is also a convention).
178
179    Returns a generator of the found roles.
180    """
181    for name, item in get_all_roles():
182        if not name.startswith('waeup.'):
183            # Ignore non-SIRP roles...
184            continue
185        if not also_local and name.startswith('waeup.local.'):
186            # Ignore local roles...
187            continue
188        yield item
189
190def get_waeup_role_names():
191    """Get the ids of all SIRP roles.
192
193    See :func:`get_waeup_roles` for what a 'SIRPRole' is.
194
195    This function returns a sorted list of SIRP role names.
196    """
197    return sorted([x.id for x in get_waeup_roles()])
198
199class LocalRolesAssignable(grok.Adapter):
200    """Default implementation for `ILocalRolesAssignable`.
201
202    This adapter returns a list for dictionaries for objects for which
203    we want to know the roles assignable to them locally.
204
205    The returned dicts contain a ``name`` and a ``title`` entry which
206    give a role (``name``) and a description, for which kind of users
207    the permission is meant to be used (``title``).
208
209    Having this adapter registered we make sure, that for each normal
210    object we get a valid `ILocalRolesAssignable` adapter.
211
212    Objects that want to offer certain local roles, can do so by
213    setting a (preferably class-) attribute to a list of role ids.
214
215    You can also define different adapters for different contexts to
216    have different role lookup mechanisms become available. But in
217    normal cases it should be sufficient to use this basic adapter.
218    """
219    grok.context(Interface)
220    grok.provides(ILocalRolesAssignable)
221
222    _roles = []
223
224    def __init__(self, context):
225        self.context = context
226        role_ids = getattr(context, 'local_roles', self._roles)
227        self._roles = [(name, role) for name, role in get_all_roles()
228                       if name in role_ids]
229        return
230
231    def __call__(self):
232        """Get a list of dictionaries containing ``names`` (the roles to
233        assign) and ``titles`` (some description of the type of user
234        to assign each role to).
235        """
236        list_of_dict = [dict(
237                name=name,
238                title=role.title,
239                description=role.description)
240                for name, role in self._roles]
241        return sorted(list_of_dict, key=lambda x: x['name'])
242
243def get_users_with_local_roles(context):
244    """Get a list of dicts representing the local roles set for `context`.
245
246    Each dict returns `user_name`, `user_title`, `local_role`,
247    `local_role_title`, and `setting` for each entry in the local
248    roles map of the `context` object.
249    """
250    try:
251        role_map = IPrincipalRoleMap(context)
252    except TypeError:
253        # no map no roles.
254        raise StopIteration
255    for local_role, user_name, setting in role_map.getPrincipalsAndRoles():
256        user = grok.getSite()['users'].get(user_name,None)
257        user_title = getattr(user, 'title', user_name)
258        local_role_title = dict(get_all_roles())[local_role].title
259        yield dict(user_name = user_name,
260                   user_title = user_title,
261                   local_role = local_role,
262                   local_role_title = local_role_title,
263                   setting = setting)
Note: See TracBrowser for help on using the repository browser.