class UserRoleController:
def __init__(self, connection):
self.connection = connection
from models.user import User
from models.role import Role
from models.user_role import UserRole
self.user = User(connection)
self.role = Role(connection)
self.user_role = UserRole(connection)
def find_by_user_id(self, user_id):
user_roles = self.user_role.find({'user_id': user_id})
print user_roles
ids = [ user_role['role_id'] for user_role in user_roles ]
if ADMIN_ROLE_ID in ids:
params = {}
else:
ids = [ user_role['role_id'] for user_role in user_roles if user_role['is_admin'] ]
params = {'ids': ids}
print params
return self.role.find(params)
def find_by_role_id(self, role_id):
user_roles = self.user_role.find({'role_id': role_id})
print user_roles
ids = [row['user_id'] for row in user_roles]
params = {'ids': ids}
print params
return self.user.find(params)
class UserRoleController:
def __init__(self, connection):
self.connection = connection
from models.user import User
from models.role import Role
from models.user_role import UserRole
self.user = User(connection)
self.role = Role(connection)
self.user_role = UserRole(connection)
def find_by_user_id(self, user_id):
user_roles = self.user_role.find({'user_id': user_id})
print user_roles
ids = [user_role['role_id'] for user_role in user_roles]
if ADMIN_ROLE_ID in ids:
params = {}
else:
ids = [
user_role['role_id'] for user_role in user_roles
if user_role['is_admin']
]
params = {'ids': ids}
print params
return self.role.find(params)
def find_by_role_id(self, role_id):
user_roles = self.user_role.find({'role_id': role_id})
print user_roles
ids = [row['user_id'] for row in user_roles]
params = {'ids': ids}
print params
return self.user.find(params)
class RoleController:
def __init__(self, connection):
self.connection = connection
from models.role import Role
from models.user_role import UserRole
self.role = Role(connection)
self.user_role = UserRole(connection)
from token_controller import TokenController
self.token_controller = TokenController(connection)
from user_role_controller import UserRoleController
self.user_role_controller = UserRoleController(connection)
def is_admin(self, user_id):
row = self.user_role.find({
'user_id': user_id,
'role_id': ADMIN_ROLE_ID
})
if len(row) > 0: return True
else: return False
# only the admin can create a role
def create(self, access_token, params):
rows = self.token_controller.find(access_token)
user_id = rows[0]['user_id']
if not self.is_admin(user_id): raise Exception("not permitted")
self.role.create(params)
return True
def update(self, access_token, params):
raise Exception("not supported")
def delete(self, access_token, params):
raise Exception("not supported")
"""
1. find all roles if I'm the admin
2. find only roles where I'm the role admin
"""
def find_all(self, access_token, params=None):
rows = self.token_controller.find(access_token)
user_id = rows[0]['user_id']
return self.user_role_controller.find_by_user_id(user_id)
def find_one(self, access_token, params):
raise Exception("not supported")
class RoleController:
def __init__(self, connection):
self.connection = connection
from models.role import Role
from models.user_role import UserRole
self.role = Role(connection)
self.user_role = UserRole(connection)
from token_controller import TokenController
self.token_controller = TokenController(connection)
from user_role_controller import UserRoleController
self.user_role_controller = UserRoleController(connection)
def is_admin(self, user_id):
row = self.user_role.find({'user_id': user_id, 'role_id': ADMIN_ROLE_ID})
if len(row) > 0: return True
else: return False
# only the admin can create a role
def create(self, access_token, params):
rows = self.token_controller.find(access_token)
user_id = rows[0]['user_id']
if not self.is_admin(user_id): raise Exception("not permitted")
self.role.create(params)
return True
def update(self, access_token, params):
raise Exception("not supported")
def delete(self, access_token, params):
raise Exception("not supported")
"""
1. find all roles if I'm the admin
2. find only roles where I'm the role admin
"""
def find_all(self, access_token, params=None):
rows = self.token_controller.find(access_token)
user_id = rows[0]['user_id']
return self.user_role_controller.find_by_user_id(user_id)
def find_one(self, access_token, params):
raise Exception("not supported")
import sys
sys.path.insert(0, r'../..')
from models.connection import connection
from models.user_role import UserRole
user_role = UserRole(connection)
print user_role.find({'user_id': 'b2fc88a6-7253-4850-8d5a-07639b1315aa'})
print user_role.find({'role_id': '3867c370-552f-43b8-bed9-6aa00ffc41b4'})
print user_role.find({
'user_id': 'c8b5dbbe-edd1-4e78-b03a-63b0d779be85',
'role_id': '435a6417-6c1f-4d7c-87dd-e8f6c0effc7a'
})
print user_role.create({
'user_id': 'b2fc88a6-7253-4850-8d5a-07639b1315aa',
'role_id': 'ffffffff-ffff-ffff-ffff-ffffffffffff',
'is_admin': False
})
print user_role.create({
'user_id': '49d8bc68-f57e-11e3-ba1d-005056ba0d15',
'role_id': '3867c370-552f-43b8-bed9-6aa00ffc41b4',
'is_admin': False
})
print user_role.create({
'user_id': '49d8bc68-f57e-11e3-ba1d-005056ba0d15',
'role_id': '435a6417-6c1f-4d7c-87dd-e8f6c0effc7a',
'is_admin': False
})
print user_role.create({
class InvitedUserController:
def __init__(self, connection):
self.connection = connection
from models.invited_user import InvitedUser
self.invited_user = InvitedUser(connection)
from models.user_role import UserRole
self.user_role = UserRole(connection)
from token_controller import TokenController
self.token_controller = TokenController(connection)
def is_admin(self, user_id):
row = self.user_role.find({
'user_id': user_id,
'role_id': ADMIN_ROLE_ID
})
if len(row) > 0: return True
else: return False
def is_role_admin(self, user_id, role_id):
rows = self.user_role.find({'user_id': user_id, 'role_id': role_id})
if len(rows) > 0 and rows[0]['is_admin']: return True
else: return False
def create(self, access_token, params):
rows = self.token_controller.find(access_token)
user_id = rows[0]['user_id']
# allowed if I'm an admin
if self.is_admin(user_id):
self.save(user_id, params)
return True
# allowed if I'm the role admin of the given role
role_id = params['role_id']
if self.is_role_admin(user_id, role_id):
self.save(user_id, params)
return True
raise Exception("not permitted")
def save(self, user_id, params):
invited_users = self.invited_user.find(params)
if len(invited_users) > 0:
print 'already invited'
return True
if not params.get('invited_by'):
params['invited_by'] = user_id
if not params.get('invited_at'):
params['invited_at'] = str(datetime.utcnow())
if not params.get('state'):
params['state'] = self.invited_user.INVITED
if not params.get('is_admin'):
params['is_admin'] = '0'
return self.invited_user.create(params)
def update(self, access_token, params):
rows = self.token_controller.find(access_token)
user_id = rows[0]['user_id']
# allowed if I'm an admin
if self.is_admin(user_id):
self.invited_user.update(params)
return True
# allowed if I'm the role admin of the given role
role_id = params['role_id']
if self.is_role_admin(user_id, role_id):
self.invited_user.update(params)
return True
raise Exception("not permitted")
"""
1. return all invited users if I'm the admin
2. return all invited users of a given role if I'm the role admin
"""
def find_all(self, access_token, params):
rows = self.token_controller.find(access_token)
user_id = rows[0]['user_id']
# return all invited users if I'm an admin
if self.is_admin(user_id): return self.invited_user.find({})
if not params.get('role_id'):
# return all invited users of roles where I'm the role admin
user_roles = self.user_role.find({'user_id': user_id})
role_ids = [
user_role['role_id'] for user_role in user_roles
if user_role['is_admin']
]
if len(role_ids) > 0:
return self.invited_user.find({'role_ids': role_ids})
else:
# return all invited users of the given role if I'm the role admin
role_id = params['role_id']
if self.is_role_admin(user_id, role_id):
return self.invited_user.find(params)
raise Exception("not permitted")
class InvitedUserController:
def __init__(self, connection):
self.connection = connection
from models.invited_user import InvitedUser
self.invited_user = InvitedUser(connection)
from models.user_role import UserRole
self.user_role = UserRole(connection)
from token_controller import TokenController
self.token_controller = TokenController(connection)
def is_admin(self, user_id):
row = self.user_role.find({'user_id': user_id, 'role_id': ADMIN_ROLE_ID})
if len(row) > 0: return True
else: return False
def is_role_admin(self, user_id, role_id):
rows = self.user_role.find({'user_id': user_id, 'role_id': role_id})
if len(rows) > 0 and rows[0]['is_admin']: return True
else: return False
def create(self, access_token, params):
rows = self.token_controller.find(access_token)
user_id = rows[0]['user_id']
# allowed if I'm an admin
if self.is_admin(user_id):
self.save(user_id, params)
return True
# allowed if I'm the role admin of the given role
role_id = params['role_id']
if self.is_role_admin(user_id, role_id):
self.save(user_id, params)
return True
raise Exception("not permitted")
def save(self, user_id, params):
invited_users = self.invited_user.find(params)
if len(invited_users) > 0:
print 'already invited'
return True
if not params.get('invited_by'):
params['invited_by'] = user_id
if not params.get('invited_at'):
params['invited_at'] = str(datetime.utcnow())
if not params.get('state'):
params['state'] = self.invited_user.INVITED
if not params.get('is_admin'):
params['is_admin'] = '0'
return self.invited_user.create(params)
def update(self, access_token, params):
rows = self.token_controller.find(access_token)
user_id = rows[0]['user_id']
# allowed if I'm an admin
if self.is_admin(user_id):
self.invited_user.update(params)
return True
# allowed if I'm the role admin of the given role
role_id = params['role_id']
if self.is_role_admin(user_id, role_id):
self.invited_user.update(params)
return True
raise Exception("not permitted")
"""
1. return all invited users if I'm the admin
2. return all invited users of a given role if I'm the role admin
"""
def find_all(self, access_token, params):
rows = self.token_controller.find(access_token)
user_id = rows[0]['user_id']
# return all invited users if I'm an admin
if self.is_admin(user_id): return self.invited_user.find({})
if not params.get('role_id'):
# return all invited users of roles where I'm the role admin
user_roles = self.user_role.find({'user_id': user_id})
role_ids = [ user_role['role_id'] for user_role in user_roles if user_role['is_admin'] ]
if len(role_ids) > 0: return self.invited_user.find({'role_ids': role_ids})
else:
# return all invited users of the given role if I'm the role admin
role_id = params['role_id']
if self.is_role_admin(user_id, role_id): return self.invited_user.find(params)
raise Exception("not permitted")
class UserController:
def __init__(self, connection):
self.connection = connection
from models.user import User
from models.user_role import UserRole
from models.invited_user import InvitedUser
self.user = User(connection)
self.user_role = UserRole(connection)
self.invited_user = InvitedUser(connection)
from token_controller import TokenController
self.token_controller = TokenController(connection)
def is_admin(self, user_id):
row = self.user_role.find({'user_id': user_id, 'role_id': ADMIN_ROLE_ID})
if len(row) > 0: return True
else: return False
def is_role_admin(self, user_id, role_id):
rows = self.user_role.find({'user_id': user_id, 'role_id': role_id})
if len(rows) > 0 and rows[0]['is_admin']: return True
else: return False
def is_member(self, user_id, role_id):
rows = self.user_role.find({'user_id': user_id, 'role_id': role_id})
if len(rows) > 0: return True
else: return False
def create(self, access_token, params):
# if this is the first user, save it as an admin
users = self.user.find({})
if len(users) == 0:
# set this user to the admin
self.user.create(params)
self.user_role.create({'user_id': params['id'], 'role_id': ADMIN_ROLE_ID})
return True
# add a user to a role if I'm an admin or the role admin of the given role
if params.get('role_id'):
rows = self.token_controller.find(access_token)
user_id = rows[0]['user_id']
if self.is_admin(user_id) or self.is_role_admin(user_id, role_id):
self.user_role.create(params)
return True
else:
raise Exception("not permitted")
rows = self.user.find(params)
if len(rows) > 0:
print 'already exists'
return True
# add the user if this user was invited before
invited_users = self.invited_user.find(params)
if len(invited_users) == 1:
invited_user = invited_users[0]
self.user.create(params)
self.user_role.create({'user_id': params['id'], 'role_id': invited_user['role_id'], 'is_admin': invited_user['is_admin']})
self.invited_user.update({'email':params['email'], 'state':self.invited_user.REGISTERED})
return True
else:
raise Exception("not permitted")
"""
1. return requested users if I'm the admin
2. return all users of roles where I'm the role admin
3. return myself if I'm not the role admin of any role
4. return all members of the given role if I'm a member of the given role
"""
def find_all(self, access_token, params):
rows = self.token_controller.find(access_token)
user_id = rows[0]['user_id']
# return all users if I'm an admin
if self.is_admin(user_id): return self.user.find(params)
if not params.get('role_id'):
# return all users of roles where I'm the role admin
user_roles = self.user_role.find({'user_id': user_id})
role_ids = [ user_role['role_id'] for user_role in user_roles if user_role['is_admin'] ]
if len(role_ids) > 0: return self.user.find({'role_ids': role_ids})
# if role is not given, return only itself
return self.user.find({'id': user_id})
# return all members of the given role if I'm a member of the given role
if self.is_member(user_id, params['role_id']): return self.user.find(params)
raise Exception("not permitted")
import sys
sys.path.insert(0, r'../..')
from models.connection import connection
from models.user_role import UserRole
user_role = UserRole(connection)
print user_role.find({'user_id':'b2fc88a6-7253-4850-8d5a-07639b1315aa'})
print user_role.find({'role_id':'3867c370-552f-43b8-bed9-6aa00ffc41b4'})
print user_role.find({'user_id':'c8b5dbbe-edd1-4e78-b03a-63b0d779be85', 'role_id':'435a6417-6c1f-4d7c-87dd-e8f6c0effc7a'})
print user_role.create({'user_id':'b2fc88a6-7253-4850-8d5a-07639b1315aa', 'role_id':'ffffffff-ffff-ffff-ffff-ffffffffffff', 'is_admin':False})
print user_role.create({'user_id':'49d8bc68-f57e-11e3-ba1d-005056ba0d15', 'role_id':'3867c370-552f-43b8-bed9-6aa00ffc41b4', 'is_admin':False})
print user_role.create({'user_id':'49d8bc68-f57e-11e3-ba1d-005056ba0d15', 'role_id':'435a6417-6c1f-4d7c-87dd-e8f6c0effc7a', 'is_admin':False})
print user_role.create({'user_id':'c8b5dbbe-edd1-4e78-b03a-63b0d779be85', 'role_id':'435a6417-6c1f-4d7c-87dd-e8f6c0effc7a', 'is_admin':False})
print user_role.create({'user_id':'c8b5dbbe-edd1-4e78-b03a-63b0d779be85', 'role_id':'3867c370-552f-43b8-bed9-6aa00ffc41b4', 'is_admin':False})
print user_role.create({'user_id':'117043220775623860708', 'role_id':'435a6417-6c1f-4d7c-87dd-e8f6c0effc7a', 'is_admin':False})
print user_role.create({'user_id':'117043220775623860708', 'role_id':'3867c370-552f-43b8-bed9-6aa00ffc41b4', 'is_admin':True})
class PermissionController:
def __init__(self, connection):
self.connection = connection
from models.permission import Permission
from models.user_role import UserRole
self.permission = Permission(connection)
self.user_role = UserRole(connection)
from token_controller import TokenController
self.token_controller = TokenController(connection)
from user_role_controller import UserRoleController
self.user_role_controller = UserRoleController(connection)
def is_admin(self, user_id):
row = self.user_role.find({'user_id': user_id, 'role_id': ADMIN_ROLE_ID})
if len(row) > 0: return True
else: return False
def is_role_admin(self, user_id, role_id):
rows = self.user_role.find({'user_id': user_id, 'role_id': role_id})
if len(rows) > 0 and rows[0]['is_admin']: return True
else: return False
def are_permitted(self, access_token, params_list):
rows = self.token_controller.find(access_token)
user_id = rows[0]['user_id']
for params in params_list:
if not self.is_permitted(user_id, params): return False
return True
def is_permitted(self, user_id, params):
params['user_id'] = user_id
params['all'] = True
rows = self.permission.find(params)
print "permitted : %s" % rows
if len(rows) == 0: return False
for row in rows:
if not row.get('condition'): return True
if not params.get('parent'): return False # parent must be given because all permissions have conditions
# now check if the parent permissions include the given 'parent' value
for row in rows:
parent_params = json.loads(row['condition'])
parent_params['user_id'] = user_id
#parent_params['role_id'] = row['role_id']
parent_params['value'] = params['parent']
parent_params['all'] = True
parent_rows = self.permission.find(parent_params)
print "permitted parents : %s" % parent_rows
if len(parent_rows) == 0: return False #### TODO: not sure if all have to be true......
return True
def create(self, access_token, params):
rows = self.token_controller.find(access_token)
user_id = rows[0]['user_id']
if not self.is_admin(user_id): raise Exception("not permitted")
self.permission.create(params)
return True
def update(self, access_token, params):
raise Exception("not supported")
def delete(self, access_token, params):
rows = self.token_controller.find(access_token)
user_id = rows[0]['user_id']
if not self.is_admin(user_id): raise Exception("not permitted")
self.permission.delete(params)
return True
"""
1. find all of my permissions from access_token
2. find all permissions of given user if I'm the admin
3. find all permissions of given role if I'm the admin
4. find member's all permissions if I'm the role admin of the given role
5. find member's all permissions if I'm the role admin of any roles where the given user belongs
6. find member's all permissions if I'm the given user
"""
def find_all(self, access_token, params):
rows = self.token_controller.find(access_token)
user_id = rows[0]['user_id']
# return my permissions
if not params.get('user_id') and not params.get('role_id'):
params['user_id'] = user_id
return self.permission.find(params)
# return requested user/role's permissions if I'm an admin
if self.is_admin(user_id): return self.permission.find(params)
# return requested role's permissions if I'm a role admin
if params.get('role_id'):
if self.is_role_admin(user_id, params['role_id']): return self.permission.find(params)
else: raise Exception("not permitted")
if params.get('user_id'):
# return my permissions when the given user is me
if user_id == params['user_id']: return self.permission.find(params)
# return requested user's permissions if I'm a role admin of any roles the given user belongs
user_roles = self.user_role.find({'user_id': params['user_id']})
if len(user_roles) == 0: raise Exception("not permitted")
for user_role in user_roles:
if self.is_role_admin(user_id, user_role['role_id']): return self.permission.find(params)
raise Exception("not permitted")
def find_one(self, access_token, params):
raise Exception("not supported")
