321 lines
10 KiB
Python
321 lines
10 KiB
Python
#
|
|
# Copyright (c) 2015 Helmut Merz helmutm@cy55.de
|
|
#
|
|
# This program is free software; you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation; either version 2 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program; if not, write to the Free Software
|
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
|
#
|
|
|
|
"""
|
|
Common functions and other stuff for working with permissions and roles.
|
|
"""
|
|
|
|
from persistent import Persistent
|
|
from zope import component
|
|
from zope.annotation.interfaces import IAttributeAnnotatable
|
|
from zope.app.container.interfaces import IObjectAddedEvent
|
|
from zope.app.security.settings import Allow, Deny, Unset
|
|
from zope.cachedescriptors.property import Lazy
|
|
from zope.interface import implements
|
|
from zope.lifecycleevent import IObjectCreatedEvent, IObjectModifiedEvent
|
|
from zope.location.interfaces import IRoot, ILocation
|
|
from zope.security import canAccess, canWrite
|
|
from zope.security import checkPermission as baseCheckPermission
|
|
from zope.security.management import getInteraction
|
|
from zope.securitypolicy.interfaces import IPrincipalRoleManager
|
|
from zope.securitypolicy.interfaces import IRolePermissionManager
|
|
from zope.traversing.api import getName, getParents
|
|
from zope.traversing.interfaces import IPhysicallyLocatable
|
|
|
|
from cybertools.meta.interfaces import IOptions
|
|
from loops.common import adapted
|
|
from loops.interfaces import ILoopsObject, IConcept
|
|
from loops.interfaces import IAssignmentEvent, IDeassignmentEvent
|
|
from loops.security.interfaces import ISecuritySetter, IWorkspaceInformation
|
|
|
|
|
|
allRolesExceptOwner = (
|
|
#'zope.SiteManager' - no, not this one...
|
|
'zope.Anonymous', 'zope.Member', 'zope.ContentManager', 'loops.Staff',
|
|
'loops.xmlrpc.ConceptManager', # relevant for local security?
|
|
#'loops.SiteManager',
|
|
'loops.Person', 'loops.Member', 'loops.Master')
|
|
allRolesExceptOwnerAndMaster = tuple(allRolesExceptOwner[:-1])
|
|
minorPrivilegedRoles = ('zope.Anonymous', 'zope.Member',)
|
|
localRoles = ('zope.Anonymous', 'zope.Member', 'zope.ContentManager',
|
|
'loops.SiteManager', 'loops.Staff', 'loops.Member', 'loops.Master',
|
|
'loops.Owner', 'loops.Person')
|
|
|
|
localPermissions = ('zope.ManageContent', 'zope.View', 'loops.ManageWorkspaces',
|
|
'loops.ViewRestricted', 'loops.EditRestricted', 'loops.AssignAsParent',)
|
|
|
|
acquiringPredicateNames = ('hasType', 'standard', 'ownedby', 'ispartof')
|
|
|
|
allocationPredicateNames = ('isowner', 'ismaster', 'ismember',)
|
|
|
|
workspaceGroupsFolderName = 'gloops_ws'
|
|
|
|
|
|
# checking and querying functions
|
|
|
|
# TODO: activate canAccessObjectWithOption depending on custom.config
|
|
|
|
def getOption(obj, option, checkType=True):
|
|
opts = component.queryAdapter(adapted(obj), IOptions)
|
|
if opts is not None:
|
|
opt = opts(option, None)
|
|
if opt is True:
|
|
return opt
|
|
if opt:
|
|
# TODO: log
|
|
return opt[0]
|
|
if not checkType:
|
|
return None
|
|
typeMethod = getattr(obj, 'getType', None)
|
|
if typeMethod is not None:
|
|
opts = component.queryAdapter(adapted(typeMethod()), IOptions)
|
|
if opts is not None:
|
|
opt = opts(option, None)
|
|
if opt is True:
|
|
return opt
|
|
if opt:
|
|
# TODO: log
|
|
return opt[0]
|
|
return None
|
|
|
|
def canAccessObjectWithOption(obj):
|
|
if not canAccess(obj, 'title'):
|
|
return False
|
|
perm = getOption(obj, 'access_permission')
|
|
if not perm:
|
|
return True
|
|
return checkPermission(perm, obj)
|
|
|
|
def canAccessObject(obj):
|
|
return canAccess(obj, 'title')
|
|
|
|
def canListObject(obj, noCheck=False):
|
|
if noCheck:
|
|
return True
|
|
return canAccessObject(obj)
|
|
|
|
def canAccessRestricted(obj):
|
|
return checkPermission('loops.ViewRestricted', obj)
|
|
|
|
def canWriteObject(obj):
|
|
return canWrite(obj, 'title') or canAssignAsParent(obj)
|
|
|
|
def canEditRestricted(obj):
|
|
return checkPermission('loops.EditRestricted', obj)
|
|
|
|
def canAssignAsParent(obj):
|
|
return checkPermission('loops.AssignAsParent', obj)
|
|
|
|
def checkPermission(permission, obj):
|
|
return baseCheckPermission(permission, obj)
|
|
|
|
|
|
def getCurrentPrincipal():
|
|
interaction = getInteraction()
|
|
if interaction is not None:
|
|
parts = interaction.participations
|
|
if parts:
|
|
return parts[0].principal
|
|
return None
|
|
|
|
|
|
# functions for checking and setting security properties
|
|
|
|
def overrides(s1, s2):
|
|
settings = [Allow, Deny, Unset]
|
|
return settings.index(s1) < settings.index(s2)
|
|
|
|
def setRolePermission(rpm, p, r, setting):
|
|
if setting == Allow:
|
|
rpm.grantPermissionToRole(p, r)
|
|
elif setting == Deny:
|
|
rpm.denyPermissionToRole(p, r)
|
|
else:
|
|
rpm.unsetPermissionFromRole(p, r)
|
|
|
|
def setPrincipalRole(prm, r, p, setting):
|
|
if setting == Allow:
|
|
prm.assignRoleToPrincipal(r, p)
|
|
elif setting == Deny:
|
|
prm.removeRoleFromPrincipal(r, p)
|
|
else:
|
|
prm.unsetRoleForPrincipal(r, p)
|
|
|
|
|
|
def assignOwner(obj, principalId):
|
|
prm = IPrincipalRoleManager(obj, None)
|
|
if prm is not None:
|
|
prm.assignRoleToPrincipal('loops.Owner', principalId)
|
|
|
|
def removeOwner(obj, principalId):
|
|
prm = IPrincipalRoleManager(obj, None)
|
|
if prm is not None:
|
|
prm.unsetRoleForPrincipal('loops.Owner', principalId)
|
|
|
|
def assignPersonRole(obj, principalId):
|
|
prm = IPrincipalRoleManager(obj)
|
|
prm.assignRoleToPrincipal('loops.Person', principalId)
|
|
|
|
def removePersonRole(obj, principalId):
|
|
prm = IPrincipalRoleManager(obj)
|
|
prm.unsetRoleForPrincipal('loops.Person', principalId)
|
|
|
|
|
|
def allowEditingForOwner(obj, deny=allRolesExceptOwner, revert=False):
|
|
rpm = IRolePermissionManager(obj)
|
|
if revert:
|
|
for role in deny:
|
|
rpm.unsetPermissionFromRole('zope.ManageContent', role)
|
|
rpm.unsetPermissionFromRole('zope.ManageContent', 'loops.Owner')
|
|
else:
|
|
for role in deny:
|
|
rpm.denyPermissionToRole('zope.ManageContent', role)
|
|
rpm.grantPermissionToRole('zope.ManageContent', 'loops.Owner')
|
|
|
|
|
|
def restrictView(obj, roles=allRolesExceptOwnerAndMaster, revert=False):
|
|
rpm = IRolePermissionManager(obj)
|
|
if revert:
|
|
for role in roles:
|
|
rpm.unsetPermissionFromRole('zope.View', role)
|
|
else:
|
|
for role in roles:
|
|
rpm.denyPermissionToRole('zope.View', role)
|
|
|
|
|
|
# event handlers
|
|
|
|
#@component.adapter(ILoopsObject, IObjectAddedEvent)
|
|
#@component.adapter(ILoopsObject, IObjectModifiedEvent)
|
|
@component.adapter(ILoopsObject, IObjectCreatedEvent)
|
|
def setDefaultSecurity(obj, event):
|
|
aObj = adapted(obj)
|
|
setter = ISecuritySetter(aObj)
|
|
setter.setDefaultSecurity()
|
|
principal = getCurrentPrincipal()
|
|
if principal is not None:
|
|
assignOwner(obj, principal.id)
|
|
|
|
|
|
@component.adapter(IConcept, IAssignmentEvent)
|
|
def grantAcquiredSecurity(obj, event):
|
|
aObj = adapted(obj)
|
|
setter = ISecuritySetter(aObj)
|
|
setter.setAcquiredSecurity(event.relation)
|
|
|
|
|
|
@component.adapter(IConcept, IDeassignmentEvent)
|
|
def revokeAcquiredSecurity(obj, event):
|
|
aObj = adapted(obj)
|
|
setter = ISecuritySetter(aObj)
|
|
setter.setAcquiredSecurity(event.relation, revert=True)
|
|
|
|
|
|
# workspace handling
|
|
|
|
class WorkspaceInformation(Persistent):
|
|
""" For storing security-related stuff pertaining to
|
|
children and resources of the context (=parent) object.
|
|
"""
|
|
|
|
implements(IPhysicallyLocatable, IWorkspaceInformation)
|
|
|
|
__name__ = u'workspace_information'
|
|
|
|
#propagateRolePermissions = 'object' # or 'none'
|
|
propagateRolePermissions = 'workspace'
|
|
propagateParentSecurity = True # False
|
|
#propagateParentSecurity = False
|
|
allocationPredicateNames = allocationPredicateNames
|
|
workspaceGroupsFolderName = workspaceGroupsFolderName
|
|
|
|
def __init__(self, parent):
|
|
self.__parent__ = parent
|
|
self.workspaceGroupNames = {}
|
|
|
|
def getName(self):
|
|
return self.__name__
|
|
|
|
def getParent(self):
|
|
return self.__parent__
|
|
|
|
def getParents(self):
|
|
p = self.getParent()
|
|
return [p] + getParents(p)
|
|
|
|
|
|
class LocationWSI(object):
|
|
|
|
implements(ILocation)
|
|
component.adapts(WorkspaceInformation)
|
|
|
|
def __init__(self, context):
|
|
self.context = context
|
|
self.__name__ = context.__name__
|
|
self.__parent__ = context.__parent__
|
|
|
|
|
|
def getWorkspaceGroup(obj, predicate):
|
|
wsi = obj.workspaceInformation
|
|
if wsi is None:
|
|
return None
|
|
pn = getName(predicate)
|
|
if pn in wsi.allocationPredicateNames:
|
|
gn = wsi.workspaceGroupNames
|
|
if not isinstance(gn, dict): # backwards compatibility
|
|
return None
|
|
groupName = gn.get(pn)
|
|
if groupName:
|
|
gfName = wsi.workspaceGroupsFolderName
|
|
if gfName:
|
|
from loops.organize.util import getGroupsFolder
|
|
gf = getGroupsFolder(wsi, gfName)
|
|
if gf is not None:
|
|
return gf.get(groupName)
|
|
return None
|
|
|
|
|
|
@component.adapter(ILoopsObject, IAssignmentEvent)
|
|
def addGroupMembershipOnAssignment(obj, event):
|
|
group = getWorkspaceGroup(obj, event.relation.predicate)
|
|
if group is not None:
|
|
person = adapted(event.relation.second)
|
|
from loops.organize.interfaces import IPerson
|
|
if IPerson.providedBy(person):
|
|
userId = person.getUserId()
|
|
if userId:
|
|
members = list(group.principals)
|
|
if userId not in members:
|
|
members.append(userId)
|
|
group.principals = tuple(members)
|
|
#print '*** assign', group.__name__, userId, group.principals
|
|
|
|
@component.adapter(ILoopsObject, IDeassignmentEvent)
|
|
def removeGroupMembershipOnDeassignment(obj, event):
|
|
group = getWorkspaceGroup(obj, event.relation.predicate)
|
|
if group is not None:
|
|
person = adapted(event.relation.second)
|
|
from loops.organize.interfaces import IPerson
|
|
if IPerson.providedBy(person):
|
|
userId = person.getUserId()
|
|
if userId:
|
|
members = list(group.principals)
|
|
if userId in members:
|
|
members.remove(userId)
|
|
group.principals = tuple(members)
|
|
#print '*** remove', group.__name__, userId, group.principals
|