def patch(self, role_id): """ --- summary: Partially update a Role description: | The body of the request needs to contain a set of instructions detailing the updates to apply: ```JSON { "operations": [ { "operation": "add", "path": "/permissions", "value": "ALL" } ] } ``` parameters: - name: role_id in: path required: true description: The ID of the Role type: string - name: patch in: body required: true description: Instructions for how to update the Role schema: $ref: '#/definitions/Patch' responses: 200: description: Role with the given ID schema: $ref: '#/definitions/Role' 400: $ref: '#/definitions/400Error' 404: $ref: '#/definitions/404Error' 50x: $ref: '#/definitions/50xError' tags: - Roles """ role = Role.objects.get(id=str(role_id)) operations = MongoParser.parse_patch(self.request.decoded_body, many=True, from_string=True) for op in operations: if op.path == "/permissions": try: if op.operation == "add": role.permissions.append(Permissions(op.value).value) elif op.operation == "remove": role.permissions.remove(Permissions(op.value).value) elif op.operation == "set": role.permissions = [ Permissions(perm).value for perm in op.value ] else: raise ModelValidationError( "Unsupported operation '%s'" % op.operation) except ValueError: raise ModelValidationError( "Permission '%s' does not exist" % op.value) elif op.path == "/roles": try: if op.operation == "add": new_nested = Role.objects.get(name=op.value) ensure_no_cycles(role, new_nested) role.roles.append(new_nested) elif op.operation == "remove": role.roles.remove(Role.objects.get(name=op.value)) elif op.operation == "set": # Do this one at a time to be super sure about cycles role.roles = [] for role_name in op.value: new_role = Role.objects.get(name=role_name) ensure_no_cycles(role, new_role) role.roles.append(new_role) else: raise ModelValidationError( "Unsupported operation '%s'" % op.operation) except DoesNotExist: raise ModelValidationError("Role '%s' does not exist" % op.value) elif op.path == "/description": if op.operation != "update": raise ModelValidationError("Unsupported operation '%s'" % op.operation) role.description = op.value else: raise ModelValidationError("Unsupported path '%s'" % op.path) role.save() # Any modification to roles will possibly modify the anonymous user brew_view.anonymous_principal = anonymous_principal() self.write(MongoParser.serialize_role(role, to_string=False))
def patch(self, user_id): """ --- summary: Partially update a User description: | The body of the request needs to contain a set of instructions detailing the updates to apply: ```JSON { "operations": [ { "operation": "add", "path": "/roles", "value": "admin" } ] } ``` parameters: - name: user_id in: path required: true description: The ID of the User type: string - name: patch in: body required: true description: Instructions for how to update the User schema: $ref: '#/definitions/Patch' responses: 200: description: User with the given ID schema: $ref: '#/definitions/User' 400: $ref: '#/definitions/400Error' 404: $ref: '#/definitions/404Error' 50x: $ref: '#/definitions/50xError' tags: - Users """ principal = Principal.objects.get(id=str(user_id)) operations = MongoParser.parse_patch(self.request.decoded_body, many=True, from_string=True) # Most things only need a permission check if updating a different user if user_id != str(self.current_user.id): check_permission(self.current_user, [Permissions.USER_UPDATE]) for op in operations: if op.path == "/roles": # Updating roles always requires USER_UPDATE check_permission(self.current_user, [Permissions.USER_UPDATE]) try: if op.operation == "add": principal.roles.append(Role.objects.get(name=op.value)) elif op.operation == "remove": principal.roles.remove(Role.objects.get(name=op.value)) elif op.operation == "set": principal.roles = [ Role.objects.get(name=name) for name in op.value ] else: raise ModelValidationError( "Unsupported operation '%s'" % op.operation) except DoesNotExist: raise ModelValidationError("Role '%s' does not exist" % op.value) elif op.path == "/username": if op.operation == "update": principal.username = op.value else: raise ModelValidationError("Unsupported operation '%s'" % op.operation) elif op.path == "/password": if op.operation != "update": raise ModelValidationError("Unsupported operation '%s'" % op.operation) if isinstance(op.value, dict): current_password = op.value.get("current_password") new_password = op.value.get("new_password") else: current_password = None new_password = op.value if user_id == str(self.current_user.id): if current_password is None: raise ModelValidationError( "In order to update your own password, you must provide " "your current password") if not custom_app_context.verify(current_password, self.current_user.hash): raise RequestForbidden("Invalid password") principal.hash = custom_app_context.hash(new_password) if "changed" in principal.metadata: principal.metadata["changed"] = True elif op.path == "/preferences/theme": if op.operation == "set": principal.preferences["theme"] = op.value else: raise ModelValidationError("Unsupported operation '%s'" % op.operation) else: raise ModelValidationError("Unsupported path '%s'" % op.path) principal.save() principal.permissions = coalesce_permissions(principal.roles)[1] self.write(MongoParser.serialize_principal(principal, to_string=False))