def permission_update(self, application_id, user_id, request_object): """ Before we update the User permissions for this application, we need to make sure that the user requesting them is authenticated and has the `is_admin` permission for the application_id being requested. """ allowed_applications = self.allowed_applications('is_admin') if not application_id in allowed_applications: logger.warning('User %d with Applications %s tried to access Users for Application %d', \ self.current_user.id, allowed_applications, application_id) return status_.status_401('You are not allowed to view this User\'s permissions because you are not an administrator of this Application'), 401 permissions = UserApplications.query.filter_by(application_id=application_id,user_id=user_id).first() altered_permissions = json.loads(request_object.data) if hasattr(permissions, 'read'): permissions.read = sanitize.sanitize_boolean(altered_permissions.get('read', permissions.read)), if hasattr(permissions, 'write'): permissions.write = sanitize.sanitize_boolean(altered_permissions.get('write', permissions.write)), if hasattr(permissions, 'is_admin'): permissions.is_admin = sanitize.sanitize_boolean(altered_permissions.get('is_admin', permissions.is_admin)) db.session.commit() return { 'read': permissions.read, 'write': permissions.write, 'is_admin': permissions.is_admin }
def activity_update(self, activity_id, request_object): if not request_object.data: logger.error('No data was submitted with the activity_create request') return status_.status_400('You didn\'t include any `data` with your request.'), 400 activity_ = self.activity_get(activity_id) """ Prepare the content of the request_object to use in creating an Activity """ activity = json.loads(request_object.data) if hasattr(activity_, 'name'): activity_.name = sanitize.sanitize_string(activity.get('name', activity_.name)) if hasattr(activity_, 'description'): activity_.description = sanitize.sanitize_string(activity.get('description', activity_.description)) if hasattr(activity_, 'result'): activity_.result = sanitize.sanitize_string(activity.get('result', activity_.result)) if hasattr(activity_, 'template_id'): activity_.template_id = sanitize.sanitize_integer(activity.get('template_id', activity_.template_id)) if hasattr(activity_, 'status'): activity_.status = sanitize.sanitize_boolean(activity.get('status', activity_.status)) if hasattr(activity_, 'updated'): activity_.updated = activity.get('updated', activity_.updated) db.session.commit() return activity_
def permission_create(self, template_id, user_id, request_object): """ Before we get the User permissions for this template, we need to make sure that the user requesting them is authenticated and has the `is_admin` permission for the template_id being requested. """ allowed_templates = self.allowed_templates('is_admin') if not template_id in allowed_templates: logger.warning('User %d tried to access Users for Template %d', \ self.current_user.id, template_id) return status_.status_401('You are not allowed to view this User\'s permissions because you are not an administrator of this Template'), 401 permissions_ = json.loads(request_object.data) """ Add the new application to the database """ new_permissions = { 'user_id': user_id, 'template_id': template_id, 'read': sanitize.sanitize_boolean(permissions_.get('read', '')), 'write': sanitize.sanitize_boolean(permissions_.get('write', '')), 'is_moderator': sanitize.sanitize_boolean(permissions_.get('is_moderator', '')), 'is_admin': sanitize.sanitize_boolean(permissions_.get('is_admin', '')) } permission_object = UserTemplates(**new_permissions) db.session.add(permission_object) db.session.commit() return { 'read': permission_object.read, 'write': permission_object.write, 'is_moderator': permission_object.is_moderator, 'is_admin': permission_object.is_admin }
def statistic_update(self, template_id, statistic_id, request_object): explicitly_allowed_templates_ = self.explicitly_allowed_templates() if not template_id in explicitly_allowed_templates_: logger.error('User %d update Statistic request failed because they are\'t allowed to modify the associated Template', \ self.current_user.id) return status_.status_401('You are\'t allowed to modify the Template you\'re trying to add a statistic to'), 401 """ Make sure that some data was submitted before proceeding """ if not request_object.data: logger.error('User %d update Statistic request failed because they didn\'t submit any `data` with their request', \ self.current_user.id) return status_.status_400('You didn\'t include any `data` with your request.'), 400 """ Make sure we can use the request data as json """ statistic_ = Statistic.query.get(statistic_id) if not statistic_.id: logger.error('User %d Statistic request failed because Statistic does\'t exist', \ self.current_user.id) return status_.status_404('The Statistic you\'re looking for doesn\'t exist'), 404 statistic_content = json.loads(request_object.data) if hasattr(statistic_, 'name'): statistic_.name = sanitize.sanitize_string(statistic_content.get('name', statistic_.name)) if hasattr(statistic_, 'units'): statistic_.units = sanitize.sanitize_string(statistic_content.get('units', statistic_.units)) if hasattr(statistic_, 'function'): statistic_.function = sanitize.sanitize_string(statistic_content.get('function', statistic_.function)) if hasattr(statistic_, 'field_id'): statistic_.field_id = sanitize.sanitize_integer(statistic_content.get('field_id', statistic_.field_id)) if hasattr(statistic_, 'status'): statistic_.status = sanitize.sanitize_boolean(statistic_content.get('status', statistic_.status)) db.session.commit() return statistic_
def field_update(self, request_object, template_id, field_id): """ Make sure that we have everything we need to created the template successfully, including things like a Name, an associated Application, and a Storage mechanism """ if not field_id: logger.error('User %d update Field request failed because they didn\'t submit a Field ID with their request', \ self.current_user.id) return status_.status_400('You didn\'t include a Field ID to update this field with'), 400 """ Fields are directly tied to Templates and really have no life of their own outside of Templates. Because of that we need to instantiate a Template object that we can work with """ allowed_fields = self.allowed_fields(permission_type='write') if not field_id in allowed_fields: logger.warning('User %d with Fields %s tried to access Field %d', \ self.current_user.id, allowed_fields, field_id) return status_.status_401('You can\'t edit this Field because it\'s not yours'), 401 """ Make sure that some data was submitted before proceeding """ if not request_object.data: logger.error('User %d update Field request failed because they didn\'t submit any `data` with their request', \ self.current_user.id) return status_.status_400('You didn\'t include any `data` with your request.'), 400 """ Convert our request object into usable data """ field_content = json.loads(request_object.data) """ Fields are directly tied to Templates and really have no life of their own outside of Templates. Because of that we need to instantiate a Template object that we can work with """ field_ = Field().query.get(field_id) """ Part 2: Update the fields that we have data for """ if hasattr(field_, 'label'): field_.label = sanitize.sanitize_string(field_content.get('label', field_.label)) if hasattr(field_, 'help'): field_.help = sanitize.sanitize_string(field_content.get('help', field_.help)) if hasattr(field_, 'is_listed'): field_.is_listed = sanitize.sanitize_boolean(field_content.get('is_listed', field_.is_listed)) if hasattr(field_, 'is_searchable'): field_.is_searchable = sanitize.sanitize_boolean(field_content.get('is_searchable', field_.is_searchable)) if hasattr(field_, 'is_required'): field_.is_required = sanitize.sanitize_boolean(field_content.get('is_required', field_.is_required)) if hasattr(field_, 'weight'): field_.weight = sanitize.sanitize_integer(field_content.get('weight', field_.weight)) if hasattr(field_, 'status'): field_.status = sanitize.sanitize_boolean(field_content.get('status', field_.status)) if hasattr(field_, 'options'): field_.options = sanitize.sanitize_string(field_content.get('options', field_.options)) # # @todo # We probably need to make the API capable of changing # data_types, after all, PostgreSQL does it out of the box # # @see # http://www.postgresql.org/docs/9.3/static/sql-altertable.html # db.session.commit() return field_
def field_create(self, request_object, template_id): """ Make sure that we have everything we need to created the template successfully, including things like a Name, an associated Application, and a Storage mechanism """ if not template_id: logger.error('User %d new Field request failed because they didn\'t submit an Template ID with their request', \ self.current_user.id) return status_.status_400('You didn\'t include a Template to add this field to ... or else you\'re not the admin of this Template'), 400 """ Make sure that some data was submitted before proceeding """ if not request_object.data: logger.error('User %d new Field request failed because they didn\'t submit any `data` with their request', \ self.current_user.id) return status_.status_400('You didn\'t include any `data` with your request.'), 400 """ Convert our request object into usable data """ content_ = json.loads(request_object.data) """ Fields are directly tied to Templates and really have no life of their own outside of Templates. Because of that we need to instantiate a Template object that we can work with """ allowed_fields = self.allowed_fields(template_id) if not template_id in allowed_fields: logger.warning('User %d with Templates %s tried to access Template %d', \ self.current_user.id, allowed_fields, template_id) return status_.status_401(), 401 Template_ = Template().query.get(template_id) """ To create a Field you must at least provide a name for your field """ if not content_.get('name', ''): logger.error('User %d new Field request failed because they didn\'t submit any `name` in the `data` of their request', \ self.current_user.id) return status_.status_400('You didn\'t include a `name` in the `data` of your request.'), 400 """ To create a Field you must at least provide a data_type for your field """ if not content_.get('data_type', ''): logger.error('User %d new Field request failed because they didn\'t submit any `data_type` in the `data` of their request', \ self.current_user.id) return status_.status_400('You didn\'t include a `data_type` in the `data` of your request.'), 400 elif 'relationship' in content_.get('data_type', '') and not content_.get('relationship', ''): logger.error('User %d new Field request failed because they didn\'t submit any `data_type` in the `data` of their request', \ self.current_user.id) return status_.status_400('You can\'t create a Relationship field without specifying the `relationship` ... this starts with type_'), 400 user_defined_label = sanitize.sanitize_string(content_.get('name', '')) """ If someone's creating a relationship the storage string they've specified needs to belong to a template that they are allowed to access """ if content_.get('relationship', ''): relationship_storage = content_.get('relationship', '') storage_check = Template().query.filter_by(storage=relationship_storage).first() if not storage_check.id in allowed_fields: logger.error('User %d tried to add a Field to a Template %d which they do not own', \ self.current_user.id, template_id) return status_.status_401('The Template `relationship` string you entered either doesn\'t exist or you don\'t have permission to use it'), 401 """ Lastly, make sure that an identical relationship doesn't already exist. If the type_ and the template type_ already have a relationship it will cause bad things to happen when searching via the API """ duplicate_check = self.check_relationship_field_duplicate(Template_.fields, relationship_storage) if duplicate_check: logger.warning('User %d tried to add a duplicate relationship type', \ self.current_user.id) return status_.status_400('You already defined a relationship with this Template, you cannot create two relationship fields with the same relationship table.'), 400 new_field = { 'label': user_defined_label, 'name': self.generate_machine_name(user_defined_label), 'help': sanitize.sanitize_string(content_.get('help', '')), 'data_type': sanitize.sanitize_string(content_.get('data_type', 'text')), 'relationship': sanitize.sanitize_string(content_.get('relationship', None)), 'is_public': sanitize.sanitize_boolean(content_.get('is_public', False)), 'is_visible': sanitize.sanitize_boolean(content_.get('is_visible', False)), 'is_listed': sanitize.sanitize_boolean(content_.get('is_listed', False)), 'is_searchable': sanitize.sanitize_boolean(content_.get('is_searchable', True)), 'is_required': sanitize.sanitize_boolean(content_.get('is_required', False)), 'weight': sanitize.sanitize_integer(content_.get('created', 1)), 'status': sanitize.sanitize_boolean(content_.get('status', True)), 'options': sanitize.sanitize_string(content_.get('options', '')), 'templates': [Template_] } logger.debug('Checking Field, %s', new_field) field_ = Field(**new_field) db.session.add(field_) db.session.commit() logger.warning('field %s', field_) """ Section 2: Relate the Template with the Field and the User with the Field """ permission = { 'read': True, 'write': True, 'is_admin': True } self.set_user_field_permissions(field_, permission, self.current_user) self.set_template_field_relationship(field_, Template_) """ Section 3: Create the Field in the Template Storage, if the field will hold data. Some fields, like fieldset, are only for visual and aesthetic purposes and do not need added to the Storage """ if not 'fieldset' in field_.data_type: field_storage = self.create_storage_field(Template_, field_) if 'relationship' in content_.get('data_type', 'text') or 'file' in content_.get('data_type', 'text'): field_.association = field_storage['association'] field_.relationship = field_storage['relationship'] db.session.commit() return field_
def template_update(self, template_id, request_object): """ If there's no template_id we can't do any, so display a 404 """ if not template_id: return status_.status_404('That template doesn\'t seem to exist') """ Before we make a database call to get the template, we should make sure the user is allowed to access that template in the first place. Either because they have explicit permission to access it (i.e., collaborator, owner) or the template is marked as `is_public` """ template_id_list_ = self.allowed_templates(permission_type='is_admin') if not template_id in template_id_list_: return status_.status_401('That isn\'t your template'), 401 """ Part 1: Load the application we wish to make changes to """ template_ = Template.query.get(template_id) """ Make sure that some data was submitted before proceeding """ if not request_object.data: logger.error('User %d updating Template failed because they didn\'t submit any `data` with their request', \ self.current_user.id) return status_.status_400('You didn\'t include any `data` with your request.'), 400 template_content = json.loads(request_object.data) """ Part 2: Update the fields that we have data for """ if hasattr(template_, 'name'): template_.name = sanitize.sanitize_string(template_content.get('name', template_.name)) if hasattr(template_, 'help'): template_.help = sanitize.sanitize_string(template_content.get('help', template_.help)) if hasattr(template_, 'is_crowdsourced'): template_.is_crowdsourced = sanitize.sanitize_boolean(template_content.get('is_crowdsourced', template_.is_crowdsourced)) if hasattr(template_, 'is_listed'): template_.is_listed = sanitize.sanitize_boolean(template_content.get('is_listed', template_.is_listed)) if hasattr(template_, 'is_moderated'): template_.is_moderated = sanitize.sanitize_boolean(template_content.get('is_moderated', template_.is_moderated)) if hasattr(template_, 'is_public'): template_.is_public = sanitize.sanitize_boolean(template_content.get('is_public', template_.is_public)) if hasattr(template_, 'is_geospatial'): template_.is_geospatial = sanitize.sanitize_boolean(template_content.get('is_geospatial', template_.is_geospatial)) if hasattr(template_, 'is_community'): template_.is_community = sanitize.sanitize_boolean(template_content.get('is_community', template_.is_community)) if hasattr(template_, 'status'): template_.status = sanitize.sanitize_boolean(template_content.get('status', template_.status)) db.session.commit() return template_
def template_create(self, request_object, application_id): """ Make sure that we have everything we need to created the template successfully, including things like a Name, an associated Application, and a Storage mechanism """ if not application_id: logger.error('User %d new Template request failed because they didn\'t submit an Application ID with their request', \ self.current_user.id) return status_.status_400('You didn\'t include an Application to associated with the Template'), 400 """ Make sure that some data was submitted before proceeding """ if not request_object.data: logger.error('User %d new Template request failed because they didn\'t submit any `data` with their request', \ self.current_user.id) return status_.status_400('You didn\'t include any `data` with your request.'), 400 """ Part 1: Make sure we can use the request data as json """ content_ = json.loads(request_object.data) allowed_applications = self.allowed_applications('read') if not application_id in allowed_applications: logger.warning('User %d with Applications %s tried to access Application %d', \ self.current_user.id, allowed_applications, application_id) return status_.status_401(), 401 """ Part 3: Make sure we have a table that has been created in the database to associate our Template features with """ storage_name = self.create_storage() """ Part X: Add the new application to the database """ new_template = { 'name': sanitize.sanitize_string(content_.get('name', 'Untitled Template from %s' % (datetime.today()) )), 'help': sanitize.sanitize_string(content_.get('help', '')), 'storage': storage_name, 'is_public': sanitize.sanitize_boolean(content_.get('is_public', True)), 'is_crowdsourced': sanitize.sanitize_boolean(content_.get('is_crowdsourced', False)), 'is_moderated': sanitize.sanitize_boolean(content_.get('is_moderated', False)), 'is_listed': sanitize.sanitize_boolean(content_.get('is_listed', True)), 'is_geospatial': sanitize.sanitize_boolean(content_.get('is_geospatial', True)), 'is_community': sanitize.sanitize_boolean(content_.get('is_community', False)), 'created': datetime.now(), 'status': sanitize.sanitize_boolean(content_.get('status', True)) } template_ = Template(**new_template) db.session.add(template_) db.session.commit() """ Tell the system what user should have permission to access the newly created application """ permission = { 'user_id': self.current_user.id, 'template_id': template_.id, 'read': True, 'write': True, 'is_moderator': True, 'is_admin': True } self.set_user_template_permissions(template_, permission, self.current_user) """ Tell the system what Application this template belongs to """ application_ = Application().query.get(application_id) self.set_application_template_relationship(template_, application_) """ Add an 'owner' field to the Storage engine here, because we can't do it in the 'create_storage' because of the User model stepping on itself and causing problems with permissions """ self.create_owner_field(template_) """ Once the new table is created, we can create a permissions table for this feature table """ self.create_storage_permissions(storage_name) return template_