def post_user():
data = json.loads(request.data)
app.logger.warn(data)
action = data.get('action', '')
old_password = data.get('old_password', '')
new_password = data.get('new_password', '')
if action == UserPostAction.MODIFY:
posted_user = User.from_dict(data['user'])
existing_user = UserCollectionManager.find_user_by_name(
posted_user.username)
if not existing_user:
return make_fail_response('User not found'), 404
if g.user.username != posted_user.username and IAMPolicies.IS_ADMIN not in g.user.policies:
return make_fail_response(
'You don`t have permission to modify this user'), 401
if set(posted_user.policies) != set(existing_user.policies):
if IAMPolicies.IS_ADMIN not in g.user.policies:
return make_fail_response(
'You don`t have permission to modify policies'), 401
existing_user.policies = posted_user.policies
if new_password:
if not existing_user.verify_password(old_password):
return make_fail_response('Incorrect password'), 401
existing_user.hash_password(new_password)
existing_user.settings = posted_user.settings
existing_user.save()
if g.user.username == posted_user.username:
g.user = posted_user
is_admin = IAMPolicies.IS_ADMIN in g.user.policies
user_obj = existing_user.to_dict()
user_obj['_is_admin'] = is_admin
user_obj[
'_readonly'] = existing_user._id != g.user._id and not is_admin
del user_obj['password_hash']
return make_success_response({
'user': user_obj,
})
else:
raise Exception('Unknown action: `{}`'.format(action))
raise NotImplementedError("Nothing is to return")
def run_list_users():
for user_dict in User.find_users():
user = User.from_dict(user_dict)
print(','.join(map(str, [user._id, user.username])))