diff options
41 files changed, 1331 insertions, 869 deletions
diff --git a/archaeological_context_records/ishtar_menu.py b/archaeological_context_records/ishtar_menu.py index 6d4ae1a57..488897aa9 100644 --- a/archaeological_context_records/ishtar_menu.py +++ b/archaeological_context_records/ishtar_menu.py @@ -23,7 +23,7 @@ from ishtar_common.menu_base import SectionItem, MenuItem from . import models -# be carreful: each access_controls must be relevant with check_rights in urls +# be carreful: each access_controls must be relevant with check_permissions in urls MENU_SECTIONS = [ ( @@ -38,21 +38,27 @@ MENU_SECTIONS = [ "record_search", _("Search"), model=models.ContextRecord, - access_controls=["view_contextrecord", "view_own_contextrecord"], + access_controls=[ + "archaeological_context_records.view_contextrecord", + "archaeological_context_records.view_own_contextrecord" + ], ), MenuItem( "record_creation", _("Creation"), model=models.ContextRecord, - access_controls=["add_contextrecord", "add_own_contextrecord"], + access_controls=[ + "archaeological_context_records.add_contextrecord", + "archaeological_context_records.add_own_contextrecord" + ], ), MenuItem( "record_modification", _("Modification"), model=models.ContextRecord, access_controls=[ - "change_contextrecord", - "change_own_contextrecord", + "archaeological_context_records.change_contextrecord", + "archaeological_context_records.change_own_contextrecord", ], ), MenuItem( @@ -60,8 +66,8 @@ MENU_SECTIONS = [ _("Deletion"), model=models.ContextRecord, access_controls=[ - "delete_contextrecord", - "delete_own_contextrecord", + "archaeological_context_records.delete_contextrecord", + "archaeological_context_records.delete_own_contextrecord", ], ), ], diff --git a/archaeological_context_records/models.py b/archaeological_context_records/models.py index ccc145c48..2611b7dfd 100644 --- a/archaeological_context_records/models.py +++ b/archaeological_context_records/models.py @@ -791,14 +791,20 @@ class ContextRecord( icon_class="fa fa-lock", text=_("Lock/Unlock"), target="many", - rights=["change_contextrecord", "change_own_contextrecord"], + rights=[ + "archaeological_context_records.change_contextrecord", + "archaeological_context_records.change_own_contextrecord" + ], ) QA_EDIT = QuickAction( url="contextrecord-qa-bulk-update", icon_class="fa fa-pencil", text=_("Bulk update"), target="many", - rights=["change_contextrecord", "change_own_contextrecord"], + rights=[ + "archaeological_context_records.change_contextrecord", + "archaeological_context_records.change_own_contextrecord" + ], ) QUICK_ACTIONS = [ QA_EDIT, @@ -808,7 +814,10 @@ class ContextRecord( icon_class="fa fa-clone", text=_("Duplicate"), target="one", - rights=["change_contextrecord", "change_own_contextrecord"], + rights=[ + "archaeological_context_records.change_contextrecord", + "archaeological_context_records.change_own_contextrecord" + ], ), ] SERIALIZE_EXCLUDE = MainItem.SERIALIZE_EXCLUDE + ["contextrecord"] @@ -1159,12 +1168,15 @@ class ContextRecord( actions = super().get_extra_actions(request) is_locked = hasattr(self, "is_locked") and self.is_locked(request.user) - can_edit_cr = self.can_do(request, "change_contextrecord") + can_edit_cr = self.can_do( + request, "archaeological_context_records.change_contextrecord" + ) profile = get_current_profile() - can_add_geo = profile.mapping and self.can_do(request, "add_geovectordata") + can_add_geo = profile.mapping and \ + self.can_do(request, "ishtar_common.add_geovectordata") if can_add_geo: actions.append(self.get_add_geo_action()) - can_create_find = self.can_do(request, "add_find") + can_create_find = self.can_do(request, "archaeological_finds.add_find") if can_create_find: actions += [ ( diff --git a/archaeological_context_records/urls.py b/archaeological_context_records/urls.py index 2b95db086..338f5bb2a 100644 --- a/archaeological_context_records/urls.py +++ b/archaeological_context_records/urls.py @@ -20,38 +20,42 @@ from django.conf.urls import url from django.urls import path -from ishtar_common.utils import check_rights +from ishtar_common.utils import check_permissions from archaeological_context_records import models, views, views_api -# be careful: each check_rights must be relevant with ishtar_menu +# be careful: each check_permissions must be relevant with ishtar_menu # forms urlpatterns = [ # Context records url( r"record_search/(?P<step>.+)?$", - check_rights(["view_contextrecord", "view_own_contextrecord"])( + check_permissions(["archaeological_context_records.view_contextrecord", + "archaeological_context_records.view_own_contextrecord"])( views.record_search_wizard ), name="record_search", ), url( r"contextrecord_search/(?P<step>.+)?$", - check_rights(["view_contextrecord", "view_own_contextrecord"])( + check_permissions(["archaeological_context_records.view_contextrecord", + "archaeological_context_records.view_own_contextrecord"])( views.record_search_wizard ), name="contextrecord_search", ), url( r"record_creation/(?P<step>.+)?$", - check_rights(["add_contextrecord", "add_own_contextrecord"])( + check_permissions(["archaeological_context_records.add_contextrecord", + "archaeological_context_records.add_own_contextrecord"])( views.record_creation_wizard ), name="record_creation", ), url( r"record_modification/(?P<step>.+)?$", - check_rights(["change_contextrecord", "change_own_contextrecord"])( + check_permissions(["archaeological_context_records.change_contextrecord", + "archaeological_context_records.change_own_contextrecord"])( views.record_modification_wizard ), name="record_modification", @@ -59,7 +63,8 @@ urlpatterns = [ url(r"record_modify/(?P<pk>.+)/$", views.record_modify, name="record_modify"), url( r"record_deletion/(?P<step>.+)?$", - check_rights(["change_contextrecord", "change_own_contextrecord"])( + check_permissions(["archaeological_context_records.change_contextrecord", + "archaeological_context_records.change_own_contextrecord"])( views.record_deletion_wizard ), name="record_deletion", @@ -151,14 +156,16 @@ urlpatterns = [ ), url( r"^context-record-relations-modify/(?P<pk>.+)/$", - check_rights(["change_contextrecord", "change_own_contextrecord"])( + check_permissions(["archaeological_context_records.change_contextrecord", + "archaeological_context_records.change_own_contextrecord"])( views.context_record_modify_relations ), name="context-record-relation-modify", ), url( r"^operation-qa-contextrecord/(?P<pks>[0-9]+)/$", - check_rights(["add_contextrecord", "add_own_contextrecord"])( + check_permissions(["archaeological_context_records.add_contextrecord", + "archaeological_context_records.add_own_contextrecord"])( views.QAOperationContextRecordView.as_view() ), name="operation-qa-contextrecord", @@ -171,21 +178,24 @@ urlpatterns = [ ), url( r"^contextrecord-qa-duplicate/(?P<pks>[0-9-]+)?/$", - check_rights(["change_contextrecord", "change_own_contextrecord"])( + check_permissions(["archaeological_context_records.change_contextrecord", + "archaeological_context_records.change_own_contextrecord"])( views.QAContextRecordDuplicateFormView.as_view() ), name="contextrecord-qa-duplicate", ), url( r"^contextrecord-qa-bulk-update/(?P<pks>[0-9-]+)?/$", - check_rights(["change_contextrecord", "change_own_contextrecord"])( + check_permissions(["archaeological_context_records.change_contextrecord", + "archaeological_context_records.change_own_contextrecord"])( views.QAContextRecordForm.as_view() ), name="contextrecord-qa-bulk-update", ), url( r"^contextrecord-qa-bulk-update/(?P<pks>[0-9-]+)?/confirm/$", - check_rights(["change_contextrecord", "change_own_contextrecord"])( + check_permissions(["archaeological_context_records.change_contextrecord", + "archaeological_context_records.change_own_contextrecord"])( views.QAContextRecordForm.as_view() ), name="contextrecord-qa-bulk-update-confirm", diff --git a/archaeological_context_records/views.py b/archaeological_context_records/views.py index 15b2aee30..fdee2c459 100644 --- a/archaeological_context_records/views.py +++ b/archaeological_context_records/views.py @@ -51,11 +51,13 @@ revert_contextrecord = revert_item(models.ContextRecord) def autocomplete_contextrecord(request): - if not request.user.has_perm( - "archaeological_context_records.view_contextrecord", models.ContextRecord - ) and not request.user.has_perm( + ishtaruser = getattr(request.user, "ishtaruser", None) + if not ishtaruser: + return HttpResponse(content_type="text/plain") + if not ishtaruser.has_permission( + "archaeological_context_records.view_contextrecord" + ) and not ishtaruser.has_permission( "archaeological_context_records.view_own_contextrecord", - models.ArchaeologicalSite, ): return HttpResponse(content_type="text/plain") if not request.GET.get("term"): @@ -258,7 +260,8 @@ class QAOperationContextRecordView(QAItemForm): icon_class="fa fa-plus", text=_("Add context record"), target="one", - rights=["add_contextrecord", "add_own_contextrecord"], + rights=["archaeological_context_records.add_contextrecord", + "archaeological_context_records.add_own_contextrecord"], ) def form_valid(self, form): diff --git a/archaeological_files/admin.py b/archaeological_files/admin.py index 206e97348..9ed26e68c 100644 --- a/archaeological_files/admin.py +++ b/archaeological_files/admin.py @@ -176,8 +176,10 @@ class CopyPriceAgreementAdmin(GeneralTypeAdmin): def copy_price_agreement(self, request): form = None - if not hasattr(request.user, "ishtaruser") or request.user.ishtaruser.has_right( - "change_priceagreement", session=request.session): + if not request.user.is_superuser and ( + not hasattr(request.user, "ishtaruser") or + not request.user.ishtaruser.has_permission( + "archaeological_files.change_priceagreement")): self.message_user( request, str(_("Cannot change price agreement.")) ) diff --git a/archaeological_files/ishtar_menu.py b/archaeological_files/ishtar_menu.py index bfdd72148..5541fd1d3 100644 --- a/archaeological_files/ishtar_menu.py +++ b/archaeological_files/ishtar_menu.py @@ -25,7 +25,7 @@ from archaeological_operations.models import AdministrativeAct from . import models -# be carreful: each access_controls must be relevant with check_rights in urls +# be carreful: each access_controls must be relevant with check_permissions in urls MENU_SECTIONS = [ ( @@ -40,31 +40,43 @@ MENU_SECTIONS = [ "file_search", _("Search"), model=models.File, - access_controls=["view_file", "view_own_file"], + access_controls=[ + "archaeological_files.view_file", + "archaeological_files.view_own_file" + ], ), MenuItem( "file_creation", _("Creation"), model=models.File, - access_controls=["add_file", "add_own_file"], + access_controls=[ + "archaeological_files.add_file", + "archaeological_files.add_own_file" + ], ), MenuItem( "file_modification", _("Modification"), model=models.File, - access_controls=["change_file", "change_own_file"], + access_controls=[ + "archaeological_files.change_file", + "archaeological_files.change_own_file" + ], ), MenuItem( "file_closing", _("Closing"), model=models.File, - access_controls=["close_file"], + access_controls=["archaeological_files.close_file"], ), MenuItem( "file_deletion", _("Deletion"), model=models.File, - access_controls=["delete_file", "delete_own_file"], + access_controls=[ + "archaeological_files.delete_file", + "archaeological_files.delete_own_file" + ], ), SectionItem( "admin_act_files", @@ -74,25 +86,33 @@ MENU_SECTIONS = [ "file_administrativeactfile_search", _("Search"), model=AdministrativeAct, - access_controls=["change_administrativeact"], + access_controls=[ + "archaeological_operations.change_administrativeact" + ], ), MenuItem( "file_administrativeactfile", _("Creation"), model=AdministrativeAct, - access_controls=["change_administrativeact"], + access_controls=[ + "archaeological_operations.change_administrativeact" + ], ), MenuItem( "file_administrativeactfile_modification", _("Modification"), model=AdministrativeAct, - access_controls=["change_administrativeact"], + access_controls=[ + "archaeological_operations.change_administrativeact" + ], ), MenuItem( "file_administrativeactfile_deletion", _("Deletion"), model=AdministrativeAct, - access_controls=["change_administrativeact"], + access_controls=[ + "archaeological_operations.change_administrativeact" + ], ), ], ), diff --git a/archaeological_files/models.py b/archaeological_files/models.py index 222c7b700..1f164c30d 100644 --- a/archaeological_files/models.py +++ b/archaeological_files/models.py @@ -27,12 +27,13 @@ from django.contrib.gis.db import models from django.contrib.postgres.indexes import GinIndex from django.core.cache import cache from django.core.validators import MinValueValidator, MaxValueValidator -from django.db.models import Q, Count, Sum, Max +from django.db.models import Max from django.db.models.signals import post_save, m2m_changed, post_delete from django.urls import reverse from ishtar_common.models_common import OrderedHierarchicalType -from ishtar_common.utils import ugettext_lazy as _, pgettext_lazy, get_current_profile, InlineClass +from ishtar_common.utils import ugettext_lazy as _, pgettext_lazy, get_current_profile, \ + InlineClass from ishtar_common.utils import ( cached_label_changed, @@ -1548,7 +1549,7 @@ class File( def get_extra_actions(self, request): # url, base_text, icon, extra_text, extra css class, is a quick action actions = super(File, self).get_extra_actions(request) - if self.can_do(request, "change_operation"): + if self.can_do(request, "archaeological_files.change_file"): actions += [ ( reverse("file-parcels-modify", args=[self.pk]), @@ -1571,7 +1572,7 @@ class File( False, ), ] - if self.can_do(request, "add_administrativeact"): + if self.can_do(request, "archaeological_operations.add_administrativeact"): actions += [ ( reverse("file-add-adminact", args=[self.pk]), @@ -1582,7 +1583,7 @@ class File( False, ), ] - if self.can_do(request, "add_operation"): + if self.can_do(request, "archaeological_operations.add_operation"): actions += [ ( reverse("file-add-operation", args=[self.pk]), diff --git a/archaeological_files/urls.py b/archaeological_files/urls.py index 0be30874b..4b50047a6 100644 --- a/archaeological_files/urls.py +++ b/archaeological_files/urls.py @@ -20,24 +20,24 @@ from django.conf.urls import url from django.urls import path -from ishtar_common.utils import check_rights +from ishtar_common.utils import check_permissions from archaeological_files import views, views_api from archaeological_operations.views import administrativeactfile_document -# be carreful: each check_rights must be relevant with ishtar_menu +# be carreful: each check_permissions must be relevant with ishtar_menu # forms: urlpatterns = [ url( r"file_administrativeactfile_search/(?P<step>.+)?$", - check_rights(["change_administrativeact"])( + check_permissions(["archaeological_operations.change_administrativeact"])( views.file_administrativeactfile_search_wizard ), name="file_administrativeactfile_search", ), url( r"^file_administrativeactfile/(?P<step>.+)?$", - check_rights(["change_administrativeact"])( + check_permissions(["archaeological_operations.change_administrativeact"])( views.file_administrativeactfile_wizard ), name="file_administrativeactfile", @@ -49,14 +49,14 @@ urlpatterns = [ ), url( r"file_administrativeactfile_deletion/(?P<step>.+)?$", - check_rights(["change_administrativeact"])( + check_permissions(["archaeological_operations.change_administrativeact"])( views.file_administrativeactfile_deletion_wizard ), name="file_administrativeactfile_deletion", ), url( r"file_administrativeactfile_modification/(?P<step>.+)?$", - check_rights(["change_administrativeact"])( + check_permissions(["archaeological_operations.change_administrativeact"])( views.file_administrativeactfile_modification_wizard ), name="file_administrativeactfile_modification", @@ -68,17 +68,20 @@ urlpatterns = [ ), url( r"file_search/(?P<step>.+)?$", - check_rights(["view_file", "view_own_file"])(views.file_search_wizard), + check_permissions([ + "archaeological_files.view_file", + "archaeological_files.view_own_file"])(views.file_search_wizard), name="file_search", ), url( r"^file_creation/(?P<step>.+)?$", - check_rights(["add_file"])(views.file_creation_wizard), + check_permissions(["archaeological_files.add_file"])(views.file_creation_wizard), name="file_creation", ), url( r"^file_modification/(?P<step>.+)?$", - check_rights(["change_file", "change_own_file"])( + check_permissions(["archaeological_files.change_file", + "archaeological_files.change_own_file"])( views.file_modification_wizard ), name="file_modification", @@ -86,12 +89,16 @@ urlpatterns = [ url(r"^file_modify/(?P<pk>.+)/$", views.file_modify, name="file_modify"), url( r"^file_closing/(?P<step>.+)?$", - check_rights(["change_file"])(views.file_closing_wizard), + check_permissions( + ["archaeological_files.change_file"] + )(views.file_closing_wizard), name="file_closing", ), url( r"file_deletion/(?P<step>.+)?$", - check_rights(["delete_file", "delete_own_file"])(views.file_deletion_wizard), + check_permissions( + ["archaeological_files.delete_file", "archaeological_files.delete_own_file"] + )(views.file_deletion_wizard), name="file_deletion", ), url(r"^file_delete/(?P<pk>.+)/$", views.file_delete, name="delete-file"), @@ -123,7 +130,9 @@ urlpatterns = [ url(r"revert-file/(?P<pk>.+)/(?P<date>.+)$", views.revert_file, name="revert-file"), url( r"^file-add-adminact/(?P<pk>[0-9-]+)/$", - check_rights(["add_administrativeact"])(views.file_adminact_add), + check_permissions(["archaeological_operations.add_administrativeact"])( + views.file_adminact_add + ), name="file-add-adminact", ), url( @@ -134,12 +143,15 @@ urlpatterns = [ ), url( r"^file-add-operation/(?P<pk>[0-9-]+)/$", - check_rights(["add_operation"])(views.file_add_operation), + check_permissions(["archaeological_operations.add_operation"])( + views.file_add_operation + ), name="file-add-operation", ), url( r'^file/edit-preventive-price/(?P<pk>\d+)/$', - check_rights(["change_file", "change_own_file"])( + check_permissions(["archaeological_files.change_file", + "archaeological_files.change_own_file"])( views.PreventiveSimpleEditView.as_view() ), name="file-edit-preventive-price", @@ -151,21 +163,24 @@ urlpatterns = [ ), url( r'^file/edit-preventive/(?P<pk>\d+)/$', - check_rights(["change_file", "change_own_file"])( + check_permissions(["archaeological_files.change_file", + "archaeological_files.change_own_file"])( views.PreventiveEditView.as_view() ), name="file-edit-preventive", ), url( r'^file/edit-preventive/add-default-cost/(?P<pk>\d+)/$', - check_rights(["change_file", "change_own_file"])( + check_permissions(["archaeological_files.change_file", + "archaeological_files.change_own_file"])( views.file_edit_preventive_add_default ), name="file-edit-preventive-default-cost", ), url( r'^file/edit-preventive/copy-planned/(?P<pk>\d+)/$', - check_rights(["change_file", "change_own_file"])( + check_permissions(["archaeological_files.change_file", + "archaeological_files.change_own_file"])( views.file_edit_preventive_copy_planned ), name="file-edit-preventive-copy-planned", diff --git a/archaeological_files/views.py b/archaeological_files/views.py index 44ba75947..0d3f978b5 100644 --- a/archaeological_files/views.py +++ b/archaeological_files/views.py @@ -24,7 +24,7 @@ from django.db.models import Q, F from django.http import HttpResponse, Http404, HttpResponseRedirect from django.forms.formsets import formset_factory from django.views.generic.edit import UpdateView -from django.shortcuts import redirect, render +from django.shortcuts import redirect from django.urls import reverse from ishtar_common.utils import ugettext_lazy as _ @@ -56,18 +56,18 @@ from archaeological_operations.forms import FinalAdministrativeActDeleteForm from ishtar_common.forms import ClosingDateFormSelection from . import forms, models -from archaeological_operations.models import Operation, AdministrativeAct +from archaeological_operations.models import AdministrativeAct RE_YEAR_INDEX = re.compile(r"([1-2][0-9]{3})-([0-9]+)") # eg.: 2014-123 def autocomplete_file(request): + ishtaruser = getattr(request.user, "ishtaruser", None) + if not ishtaruser: + return HttpResponse(content_type="text/plain") if ( - not request.user.has_perm("ishtar_common.view_file", models.File) - and not request.user.has_perm("ishtar_common.view_own_file", models.File) - and not request.user.ishtaruser.has_right( - "file_search", session=request.session - ) + not ishtaruser.has_permission("archaeological_files.view_file") + and not ishtaruser.has_permission("archaeological_files.view_own_file") ): return HttpResponse(content_type="text/plain") if not request.GET.get("term"): @@ -103,9 +103,9 @@ revert_file = revert_item(models.File) def extra_file_dct(request, item): dct = {} - if request.user.has_perm( - "ishtar_common.add_operation", Operation - ) or request.user.ishtaruser.has_right("add_operation"): + if request.user.ishtaruser.has_permission( + "archaeological_operations.add_operation" + ): dct["can_add_operation"] = True return dct diff --git a/archaeological_finds/forms.py b/archaeological_finds/forms.py index 094e6be21..23531aeb0 100644 --- a/archaeological_finds/forms.py +++ b/archaeological_finds/forms.py @@ -2619,11 +2619,12 @@ class FindBasketAddItemForm(forms.Form): basket_id = forms.IntegerField(required=True) item_id = forms.IntegerField(required=True) - def save(self, user): + def save(self, ishtaruser): try: basket = ( models.FindBasket.objects.filter( - Q(user=user) | Q(shared_with=user) | Q(shared_write_with=user) + Q(user=ishtaruser) | Q(shared_with=ishtaruser) | + Q(shared_write_with=ishtaruser) ) .distinct() .get(pk=self.cleaned_data["basket_id"]) @@ -2634,9 +2635,11 @@ class FindBasketAddItemForm(forms.Form): raise PermissionDenied # check rights if ( - not user.user_ptr.is_superuser - and not user.has_right("view_find") - and not (user.has_right("view_own_find") and item.is_own(user)) + not ishtaruser.user_ptr.is_superuser + and not ishtaruser.has_permission("archaeological_finds.view_find") + and not ishtaruser.has_permission( + "archaeological_finds.view_own_find", + obj=item) ): raise PermissionDenied basket.items.add(item) diff --git a/archaeological_finds/ishtar_menu.py b/archaeological_finds/ishtar_menu.py index aa658023d..6ca50182e 100644 --- a/archaeological_finds/ishtar_menu.py +++ b/archaeological_finds/ishtar_menu.py @@ -24,7 +24,7 @@ from ishtar_common.menu_base import SectionItem, MenuItem from archaeological_operations.models import AdministrativeAct from . import models -# be careful: each access_controls must be relevant with check_rights in urls +# be careful: each access_controls must be relevant with check_permissions in urls MENU_SECTIONS = [ ( @@ -39,25 +39,37 @@ MENU_SECTIONS = [ "find_search", _("Search"), model=models.Find, - access_controls=["view_find", "view_own_find"], + access_controls=[ + "archeological_finds.view_find", + "archeological_finds.view_own_find" + ], ), MenuItem( "find_creation", _("Creation"), model=models.Find, - access_controls=["add_find", "add_own_find"], + access_controls=[ + "archeological_finds.add_find", + "archeological_finds.add_own_find" + ], ), MenuItem( "find_modification", _("Modification"), model=models.Find, - access_controls=["change_find", "change_own_find"], + access_controls=[ + "archeological_finds.change_find", + "archeological_finds.change_own_find" + ], ), MenuItem( "find_deletion", _("Deletion"), model=models.Find, - access_controls=["change_find", "change_own_find"], + access_controls=[ + "archeological_finds.change_find", + "archeological_finds.change_own_find" + ], ), SectionItem( "find_basket", @@ -67,31 +79,46 @@ MENU_SECTIONS = [ "find_basket_search", _("Search"), model=models.FindBasket, - access_controls=["view_find", "view_own_find"], + access_controls=[ + "archeological_finds.view_find", + "archeological_finds.view_own_find" + ], ), MenuItem( "find_basket_creation", _("Creation"), model=models.FindBasket, - access_controls=["view_find", "view_own_find"], + access_controls=[ + "archeological_finds.view_find", + "archeological_finds.view_own_find" + ], ), MenuItem( "find_basket_modification", _("Modification"), model=models.FindBasket, - access_controls=["view_find", "view_own_find"], + access_controls=[ + "archeological_finds.view_find", + "archeological_finds.view_own_find" + ], ), MenuItem( "find_basket_modification_add", _("Manage items"), model=models.FindBasket, - access_controls=["view_find", "view_own_find"], + access_controls=[ + "archeological_finds.view_find", + "archeological_finds.view_own_find" + ], ), MenuItem( "find_basket_deletion", _("Deletion"), model=models.FindBasket, - access_controls=["view_find", "view_own_find"], + access_controls=[ + "archeological_finds.view_find", + "archeological_finds.view_own_find" + ], ), ], ), @@ -115,15 +142,18 @@ MENU_SECTIONS = [ "treatmentfle_search", _("Search"), model=models.TreatmentFile, - access_controls=["view_treatmentfile", "view_own_treatmentfile"], + access_controls=[ + "archeological_finds.view_treatmentfile", + "archeological_finds.view_own_treatmentfile" + ], ), MenuItem( "treatmentfle_creation", _("Creation"), model=models.TreatmentFile, access_controls=[ - "change_treatmentfile", - "change_own_treatmentfile", + "archeological_finds.change_treatmentfile", + "archeological_finds.change_own_treatmentfile", ], ), MenuItem( @@ -131,8 +161,8 @@ MENU_SECTIONS = [ _("Modification"), model=models.TreatmentFile, access_controls=[ - "change_treatmentfile", - "change_own_treatmentfile", + "archeological_finds.change_treatmentfile", + "archeological_finds.change_own_treatmentfile", ], ), MenuItem( @@ -140,8 +170,8 @@ MENU_SECTIONS = [ _("Deletion"), model=models.TreatmentFile, access_controls=[ - "change_treatmentfile", - "change_own_treatmentfile", + "archeological_finds.change_treatmentfile", + "archeological_finds.change_own_treatmentfile", ], ), SectionItem( @@ -152,25 +182,33 @@ MENU_SECTIONS = [ "treatmentfle_admacttreatmentfle_search", _("Search"), model=AdministrativeAct, - access_controls=["change_administrativeact"], + access_controls=[ + "archaeological_operations.view_administrativeact" + ], ), MenuItem( "treatmentfle_admacttreatmentfle", _("Creation"), model=AdministrativeAct, - access_controls=["change_administrativeact"], + access_controls=[ + "archaeological_operations.change_administrativeact" + ], ), MenuItem( "treatmentfle_admacttreatmentfle_modification", _("Modification"), model=AdministrativeAct, - access_controls=["change_administrativeact"], + access_controls=[ + "archaeological_operations.change_administrativeact" + ], ), MenuItem( "treatmentfle_admacttreatmentfle_deletion", _("Deletion"), model=AdministrativeAct, - access_controls=["change_administrativeact"], + access_controls=[ + "archaeological_operations.change_administrativeact" + ], ), ], ), @@ -189,37 +227,54 @@ MENU_SECTIONS = [ "treatment_search", _("Search"), model=models.Treatment, - access_controls=["view_treatment", "view_own_treatment"], + access_controls=[ + "archaeological_finds.view_treatment", + "archaeological_finds.view_own_treatment" + ], ), MenuItem( "treatment_creation", _("Simple treatment - creation"), model=models.Treatment, - access_controls=["change_find", "change_own_find"], + access_controls=[ + "archaeological_finds.change_find", + "archaeological_finds.change_own_find"], ), MenuItem( "treatment_creation_n1", _("Treatment many to one - creation"), model=models.Treatment, - access_controls=["change_find", "change_own_find"], + access_controls=[ + "archaeological_finds.change_find", + "archaeological_finds.change_own_find" + ], ), MenuItem( "treatment_creation_1n", _("Treatment one to many - creation"), model=models.Treatment, - access_controls=["change_find", "change_own_find"], + access_controls=[ + "archaeological_finds.change_find", + "archaeological_finds.change_own_find" + ], ), MenuItem( "treatment_modification", _("Modification"), model=models.Treatment, - access_controls=["change_treatment", "change_own_treatment"], + access_controls=[ + "archaeological_finds.change_treatment", + "archaeological_finds.change_own_treatment" + ], ), MenuItem( "treatment_deletion", _("Deletion"), model=models.Treatment, - access_controls=["change_treatment", "change_own_treatment"], + access_controls=[ + "archaeological_finds.change_treatment", + "archaeological_finds.change_own_treatment" + ], ), SectionItem( "admin_act_treatments", @@ -229,25 +284,33 @@ MENU_SECTIONS = [ "treatment_admacttreatment_search", _("Search"), model=AdministrativeAct, - access_controls=["view_administrativeact"], + access_controls=[ + "archaeological_operations.view_administrativeact" + ], ), MenuItem( "treatment_admacttreatment", _("Creation"), model=AdministrativeAct, - access_controls=["add_administrativeact"], + access_controls=[ + "archaeological_operations.add_administrativeact" + ], ), MenuItem( "treatment_admacttreatment_modification", _("Modification"), model=AdministrativeAct, - access_controls=["change_administrativeact"], + access_controls=[ + "archaeological_operations.change_administrativeact" + ], ), MenuItem( "treatment_admacttreatment_deletion", _("Deletion"), model=AdministrativeAct, - access_controls=["change_administrativeact"], + access_controls=[ + "archaeological_operations.change_administrativeact" + ], ), ], ), diff --git a/archaeological_finds/models_finds.py b/archaeological_finds/models_finds.py index 464076caf..1863ba450 100644 --- a/archaeological_finds/models_finds.py +++ b/archaeological_finds/models_finds.py @@ -925,14 +925,18 @@ WEIGHT_UNIT = ( class FindBasket(Basket, MainItem, ValueGetter): SHOW_URL = "show-findbasket" SLUG = "findbasket" - items = models.ManyToManyField("Find", blank=True, related_name="basket", verbose_name=_("Associated finds")) + items = models.ManyToManyField("Find", blank=True, related_name="basket", + verbose_name=_("Associated finds")) QA_EDIT = QuickAction( url="findbasket-qa-bulk-update", icon_class="fa fa-pencil", text=_("Modify"), target="many", - rights=["view_find", "view_own_find"], + rights=[ + "archaeological_finds.view_find", + "archaeological_finds.view_own_find" + ], ) QUICK_ACTIONS = [ QA_EDIT, @@ -941,7 +945,10 @@ class FindBasket(Basket, MainItem, ValueGetter): icon_class="fa fa-clone", text=_("Duplicate"), target="one", - rights=["view_find", "view_own_find"], + rights=[ + "archaeological_finds.view_find", + "archaeological_finds.view_own_find" + ], ), ] @@ -976,7 +983,7 @@ class FindBasket(Basket, MainItem, ValueGetter): """ # url, base_text, icon, extra_text, extra css class, is a quick action - if not request.user or not request.user.ishtaruser: + if not request.user or not getattr(request.user, "ishtaruser", None): return [] ishtaruser = request.user.ishtaruser @@ -994,7 +1001,7 @@ class FindBasket(Basket, MainItem, ValueGetter): False, ), ] - can_edit_find = self.can_do(request, "change_find") + can_edit_find = self.can_do(request, "archaeological_finds.change_find") if can_edit_find: actions += [ ( @@ -1006,7 +1013,7 @@ class FindBasket(Basket, MainItem, ValueGetter): False, ), ] - if self.can_do(request, "add_treatmentfile"): + if self.can_do(request, "archaeological_finds.add_treatmentfile"): actions += [ ( reverse("findbasket-add-treatmentfile", args=[self.pk]), @@ -1857,14 +1864,16 @@ class Find( icon_class="fa fa-pencil", text=_("Bulk update"), target="many", - rights=["change_find", "change_own_find"], + rights=["archaeological_finds.change_find", + "archaeological_finds.change_own_find"], ) QA_LOCK = QuickAction( url="find-qa-lock", icon_class="fa fa-lock", text=_("Lock/Unlock"), target="many", - rights=["change_find", "change_own_find"], + rights=["archaeological_finds.change_find", + "archaeological_finds.change_own_find"], ) QUICK_ACTIONS = [ @@ -1874,21 +1883,30 @@ class Find( icon_class="fa fa-clone", text=_("Duplicate"), target="one", - rights=["change_find", "change_own_find"], + rights=[ + "archaeological_finds.change_find", + "archaeological_finds.change_own_find" + ], ), QuickAction( url="find-qa-basket", icon_class="fa fa-shopping-basket", text=_("Basket"), target="many", - rights=["change_find", "change_own_find"], + rights=[ + "archaeological_finds.change_find", + "archaeological_finds.change_own_find" + ], ), QuickAction( url="find-qa-packaging", icon_class="fa fa-gift", text=_("Packaging"), target="many", - rights=["change_find", "change_own_find"], + rights=[ + "archaeological_finds.change_find", + "archaeological_finds.change_own_find" + ], module="warehouse", ), QuickAction( @@ -1896,7 +1914,10 @@ class Find( icon_class="fa fa-object-group", text=_("Treatment many to one"), target="many", - rights=["change_find", "change_own_find"], + rights=[ + "archaeological_finds.change_find", + "archaeological_finds.change_own_find" + ], is_popup=False, ), QA_LOCK, @@ -2641,11 +2662,12 @@ class Find( is_locked = hasattr(self, "is_locked") and self.is_locked(request.user) profile = get_current_profile() - can_add_geo = profile.mapping and self.can_do(request, "add_geovectordata") + can_add_geo = profile.mapping and self.can_do(request, + "ishtar_common.add_geovectordata") if can_add_geo: if self.base_finds.count() == 1: actions.append(self.base_finds.all()[0].get_add_geo_action()) - can_edit_find = self.can_do(request, "change_find") + can_edit_find = self.can_do(request, "archaeological_finds.change_find") if can_edit_find and not is_locked: actions += [ ( diff --git a/archaeological_finds/models_treatments.py b/archaeological_finds/models_treatments.py index cbca04c9a..d23843226 100644 --- a/archaeological_finds/models_treatments.py +++ b/archaeological_finds/models_treatments.py @@ -22,14 +22,14 @@ import datetime from django.conf import settings from django.contrib.gis.db import models from django.contrib.postgres.indexes import GinIndex -from django.db import transaction from django.db.models import Max, Q from django.db.models.signals import post_save, post_delete, pre_delete, m2m_changed from django.template.defaultfilters import slugify from django.urls import reverse from ishtar_common.utils import ugettext_lazy as _, pgettext_lazy, SheetItem -from archaeological_finds.models_finds import Find, FindBasket, TreatmentType, FindTreatment +from archaeological_finds.models_finds import Find, FindBasket, TreatmentType, \ + FindTreatment from archaeological_operations.models import ClosedItem, Operation from archaeological_context_records.models import Dating from archaeological_warehouse.models import Warehouse, Container @@ -413,7 +413,7 @@ class Treatment( def get_extra_actions(self, request): # url, base_text, icon, extra_text, extra css class, is a quick action actions = super(Treatment, self).get_extra_actions(request) - if self.can_do(request, "add_administrativeact"): + if self.can_do(request, "archaeological_operations.add_administrativeact"): actions += [ ( reverse("treatment-add-adminact", args=[self.pk]), @@ -1309,7 +1309,7 @@ class TreatmentFile( def get_extra_actions(self, request): # url, base_text, icon, extra_text, extra css class, is a quick action actions = super(TreatmentFile, self).get_extra_actions(request) - if self.can_do(request, "add_administrativeact"): + if self.can_do(request, "archaeological_operations.add_administrativeact"): actions += [ ( reverse("treatmentfile-add-adminact", args=[self.pk]), @@ -1330,7 +1330,7 @@ class TreatmentFile( ): # a treatment of this type already exists return actions - can_edit_find = self.can_do(request, "change_find") + can_edit_find = self.can_do(request, "archaeological_finds.change_find") if can_edit_find: actions += [ ( diff --git a/archaeological_finds/tests.py b/archaeological_finds/tests.py index b521e0b97..16fb575c7 100644 --- a/archaeological_finds/tests.py +++ b/archaeological_finds/tests.py @@ -35,7 +35,6 @@ from django.test import LiveServerTestCase from django.test.client import Client from django.urls import reverse from ishtar_common.models import ( - ImporterGroup, ImporterType, IshtarUser, ImporterColumn, @@ -95,7 +94,8 @@ from ishtar_common.tests import ( GenericSerializationTest, SearchText, ) -from archaeological_operations.tests import ImportTest, create_operation, create_administrativact +from archaeological_operations.tests import ImportTest, create_operation, \ + create_administrativact from archaeological_context_records.tests import ContextRecordInit from archaeological_operations.serializers import operation_serialization @@ -1994,6 +1994,7 @@ class FindPermissionTest(FindInit, TestCase): response = c.get(reverse("get-find")) # only one "own" operation available content = response.content.decode() + self.assertTrue(content) self.assertTrue(json.loads(content)) self.assertEqual(json.loads(content)["recordsTotal"], 1) diff --git a/archaeological_finds/urls.py b/archaeological_finds/urls.py index a1b240363..ba10750d2 100644 --- a/archaeological_finds/urls.py +++ b/archaeological_finds/urls.py @@ -20,47 +20,56 @@ from django.conf.urls import url from django.urls import path -from ishtar_common.utils import check_rights, get_urls_for_model +from ishtar_common.utils import check_permissions, get_urls_for_model from archaeological_finds import views from archaeological_finds import views_api from archaeological_operations.views import administrativeactfile_document from archaeological_finds import models -# be careful: each check_rights must be relevant with ishtar_menu +# be careful: each check_permissions must be relevant with ishtar_menu # forms urlpatterns = [ url( r"find_search/(?P<step>.+)?$", - check_rights(["view_find", "view_own_find"])(views.find_search_wizard), + check_permissions( + ["archaeological_finds.view_find", "archaeological_finds.view_own_find"] + )(views.find_search_wizard), name="find_search", ), url( r"find_creation/(?P<step>.+)?$", - check_rights(["add_find", "add_own_find"])(views.find_creation_wizard), + check_permissions( + ["archaeological_finds.add_find", "archaeological_finds.add_own_find"] + )(views.find_creation_wizard), name="find_creation", ), url( r"find_modification/(?P<step>.+)?$", - check_rights(["change_find", "change_own_find"])( - views.find_modification_wizard - ), + check_permissions( + ["archaeological_finds.change_find", + "archaeological_finds.change_own_find"] + )(views.find_modification_wizard), name="find_modification", ), url(r"find_modify/(?P<pk>.+)/$", views.find_modify, name="find_modify"), url(r"find_create/(?P<pk>.+)/$", views.find_create, name="find_create"), url( r"find_deletion/(?P<step>.+)?$", - check_rights(["change_find", "change_own_find"])(views.find_deletion_wizard), + check_permissions( + ["archaeological_finds.change_find", + "archaeological_finds.change_own_find"] + )(views.find_deletion_wizard), name="find_deletion", ), url(r"find_delete/(?P<pk>.+)/$", views.find_delete, name="delete-find"), url( r"^find-qa-duplicate/(?P<pks>[0-9-]+)?/$", - check_rights(["change_find", "change_own_find"])( - views.QAFindDuplicateFormView.as_view() - ), + check_permissions( + ["archaeological_finds.change_find", + "archaeological_finds.change_own_find"] + )(views.QAFindDuplicateFormView.as_view()), name="find-qa-duplicate", ), url(r"get-findbasket/$", views.get_find_basket, name="get-findbasket"), @@ -71,17 +80,26 @@ urlpatterns = [ ), url( r"find_basket_search/(?P<step>.+)?$", - check_rights(["view_find", "view_own_find"])(views.basket_search_wizard), + check_permissions( + ["archaeological_finds.view_find", + "archaeological_finds.view_own_find"] + )(views.basket_search_wizard), name="find_basket_search", ), url( r"^find_basket_creation/$", - check_rights(["view_find", "view_own_find"])(views.NewFindBasketView.as_view()), + check_permissions( + ["archaeological_finds.view_find", + "archaeological_finds.view_own_find"] + )(views.NewFindBasketView.as_view()), name="new_findbasket", ), url( r"^find_basket_modification/(?P<step>.+)?$", - check_rights(["view_find", "view_own_find"])(views.basket_modify_wizard), + check_permissions( + ["archaeological_finds.view_find", + "archaeological_finds.view_own_find"] + )(views.basket_modify_wizard), name="find_basket_modification", ), url( @@ -91,139 +109,163 @@ urlpatterns = [ ), url( r"^find_basket_modification_add/$", - check_rights(["view_find", "view_own_find"])( - views.SelectBasketForManagement.as_view() - ), + check_permissions( + ["archaeological_finds.view_find", + "archaeological_finds.view_own_find"] + )(views.SelectBasketForManagement.as_view()), name="select_findbasketforadd", ), url( r"^find_basket_modification_add/(?P<pk>[0-9]+)?/$", - check_rights(["view_find", "view_own_find"])( - views.SelectItemsInBasket.as_view() - ), + check_permissions( + ["archaeological_finds.view_find", + "archaeological_finds.view_own_find"] + )(views.SelectItemsInBasket.as_view()), name="select_itemsinbasket", ), url( r"^find_basket_modification_add_item/$", - check_rights(["view_find", "view_own_find"])( - views.FindBasketAddItemView.as_view() - ), + check_permissions( + ["archaeological_finds.view_find", + "archaeological_finds.view_own_find"] + )(views.FindBasketAddItemView.as_view()), name="add_iteminbasket", ), url( r"^find_basket_modification_delete_item/(?P<basket>[0-9]+)?" r"/(?P<find_pk>[0-9]+)?/$", - check_rights(["view_find", "view_own_find"])( - views.FindBasketDeleteItemView.as_view() - ), + check_permissions( + ["archaeological_finds.view_find", + "archaeological_finds.view_own_find"] + )(views.FindBasketDeleteItemView.as_view()), name="delete_iteminbasket", ), url( r"^find_basket_list/(?P<pk>[0-9]+)?/$", - check_rights(["view_find", "view_own_find"])( - views.FindBasketListView.as_view() - ), + check_permissions( + ["archaeological_finds.view_find", + "archaeological_finds.view_own_find"] + )(views.FindBasketListView.as_view()), name="list_iteminbasket", ), url( r"^find_basket_deletion/(?P<step>.+)?$", - check_rights(["view_find", "view_own_find"])(views.basket_delete_wizard), + check_permissions( + ["archaeological_finds.view_find", + "archaeological_finds.view_own_find"] + )(views.basket_delete_wizard), name="find_basket_deletion", ), url( r"^findbasket-qa-duplicate/(?P<pks>[0-9-]+)?/$", - check_rights(["view_find", "view_own_find"])( - views.QAFindbasketDuplicateFormView.as_view() - ), + check_permissions( + ["archaeological_finds.view_find", + "archaeological_finds.view_own_find"] + )(views.QAFindbasketDuplicateFormView.as_view()), name="findbasket-qa-duplicate", ), url( r"^findbasket-add-treatment/(?P<pk>[0-9-]+)/$", - check_rights(["change_find", "change_own_find"])( - views.findbasket_treatment_add - ), + check_permissions( + ["archaeological_finds.change_find", + "archaeological_finds.change_own_find"] + )(views.findbasket_treatment_add), name="findbasket-add-treatment", ), url( r"^findbasket-add-treatmentfile/(?P<pk>[0-9-]+)/$", - check_rights(["add_treatmentfile", "add_own_treatmentfile"])( - views.findbasket_treatmentfile_add - ), + check_permissions( + ["archaeological_finds.add_treatmentfile", + "archaeological_finds.add_own_treatmentfile"] + )(views.findbasket_treatmentfile_add), name="findbasket-add-treatmentfile", ), url( r"^find-add-treatment/(?P<pk>[0-9-]+)/$", - check_rights(["change_find", "change_own_find"])(views.find_treatment_add), + check_permissions( + ["archaeological_finds.change_find", + "archaeological_finds.change_own_find"] + )(views.find_treatment_add), name="find-add-treatment", ), url( r"^find-add-divide-treatment/(?P<pk>[0-9-]+)/$", - check_rights(["change_find", "change_own_find"])( - views.find_divide_treatment_add - ), + check_permissions( + ["archaeological_finds.change_find", + "archaeological_finds.change_own_find"] + )(views.find_divide_treatment_add), name="find-add-divide-treatment", ), url( r"^treatmentfile-add-treatment/(?P<pk>[0-9-]+)/$", - check_rights(["change_find", "change_own_find"])( - views.treatmentfile_treatment_add - ), + check_permissions( + ["archaeological_finds.change_find", + "archaeological_finds.change_own_find"] + )(views.treatmentfile_treatment_add), name="treatmentfile-add-treatment", ), url( r"^treatment-add-adminact/(?P<pk>[0-9-]+)/$", - check_rights(["add_administrativeact"])(views.treatment_adminact_add), + check_permissions( + ["archaeological_operations.add_administrativeact"] + )(views.treatment_adminact_add), name="treatment-add-adminact", ), url( r"^treatmentfile-add-adminact/(?P<pk>[0-9-]+)/$", - check_rights(["add_administrativeact"])(views.treatmentfile_adminact_add), + check_permissions( + ["archaeological_operations.add_administrativeact"] + )(views.treatmentfile_adminact_add), name="treatmentfile-add-adminact", ), url( r"^find-qa-bulk-update/(?P<pks>[0-9-]+)?/$", - check_rights(["change_find", "change_own_find"])(views.QAFindForm.as_view()), + check_permissions( + ["archaeological_finds.change_find", + "archaeological_finds.change_own_find"] + )(views.QAFindForm.as_view()), name="find-qa-bulk-update", ), url( r"^find-qa-bulk-update/(?P<pks>[0-9-]+)?/confirm/$", - check_rights(["change_find", "change_own_find"])(views.QAFindForm.as_view()), + check_permissions( + ["archaeological_finds.change_find", + "archaeological_finds.change_own_find"] + )(views.QAFindForm.as_view()), name="find-qa-bulk-update-confirm", kwargs={"confirm": True}, ), url( r"^find-qa-basket/(?P<pks>[0-9-]+)?/$", - check_rights(["change_find", "change_own_find"])( - views.QAFindBasketFormView.as_view() - ), + check_permissions( + ["archaeological_finds.change_find", + "archaeological_finds.change_own_find"] + )(views.QAFindBasketFormView.as_view()), name="find-qa-basket", ), url( r"findbasket-qa-bulk-update/(?P<pks>[0-9-]+)?/$", - check_rights([ - "change_find", - "change_own_find", - ])( - views.QAFindBasketModifyView.as_view() - ), + check_permissions([ + "archaeological_finds.change_find", + "archaeological_finds.change_own_find", + ])(views.QAFindBasketModifyView.as_view()), name="findbasket-qa-bulk-update", ), url( r"findbasket-qa-bulk-update/(?P<pks>[0-9-]+)?/confirm/$", - check_rights([ - "change_find", - "change_own_find", - ])( - views.QAFindBasketModifyView.as_view() - ), + check_permissions([ + "archaeological_finds.change_find", + "archaeological_finds.change_own_find", + ])(views.QAFindBasketModifyView.as_view()), name="findbasket-qa-bulk-update-confirm", kwargs={"confirm": True}, ), url( r"^find-qa-packaging/(?P<pks>[0-9-]+)?/$", - check_rights(["change_find", "change_own_find"])( - views.QAFindTreatmentFormView.as_view() - ), + check_permissions( + ["archaeological_finds.change_find", + "archaeological_finds.change_own_find"] + )(views.QAFindTreatmentFormView.as_view()), name="find-qa-packaging", ), url( @@ -234,16 +276,18 @@ urlpatterns = [ ), url( r"^treatment_creation/(?P<step>.+)?$", - check_rights(["change_find", "change_own_find"])( - views.treatment_creation_wizard - ), + check_permissions( + ["archaeological_finds.change_find", + "archaeological_finds.change_own_find"] + )(views.treatment_creation_wizard), name="treatment_creation", ), url( r"^treatment_creation_n1/(?P<step>.+)?$", - check_rights(["change_find", "change_own_find"])( - views.treatment_creation_n1_wizard - ), + check_permissions( + ["archaeological_finds.change_find", + "archaeological_finds.change_own_find"] + )(views.treatment_creation_n1_wizard), name="treatment_creation_n1", ), url( @@ -253,16 +297,18 @@ urlpatterns = [ ), url( r"^treatment_creation_1n/(?P<step>.+)?$", - check_rights(["change_find", "change_own_find"])( - views.treatment_creation_1n_wizard - ), + check_permissions( + ["archaeological_finds.change_find", + "archaeological_finds.change_own_find"] + )(views.treatment_creation_1n_wizard), name="treatment_creation_1n", ), url( r"^treatment_modification/(?P<step>.+)?$", - check_rights(["change_find", "change_own_find"])( - views.treatment_modification_wizard - ), + check_permissions( + ["archaeological_finds.change_find", + "archaeological_finds.change_own_find"] + )(views.treatment_modification_wizard), name="treatment_modification", ), url( @@ -272,14 +318,18 @@ urlpatterns = [ ), url( r"^treatment_search/(?P<step>.+)?$", - check_rights(["view_find", "view_own_find"])(views.treatment_search_wizard), + check_permissions( + ["archaeological_finds.view_find", + "archaeological_finds.view_own_find"] + )(views.treatment_search_wizard), name="treatment_search", ), url( r"^treatment_deletion/(?P<step>.+)?$", - check_rights(["change_treatmentfile", "change_own_treatmentfile"])( - views.treatment_deletion_wizard - ), + check_permissions( + ["archaeological_finds.change_treatmentfile", + "archaeological_finds.change_own_treatmentfile"] + )(views.treatment_deletion_wizard), name="treatment_deletion", ), url( @@ -289,21 +339,21 @@ urlpatterns = [ ), url( r"^treatment_admacttreatment_search/(?P<step>.+)?$", - check_rights(["change_administrativeact"])( + check_permissions(["archaeological_operations.change_administrativeact"])( views.treatment_administrativeact_search_wizard ), name="treatment_admacttreatment_search", ), url( r"^treatment_admacttreatment/(?P<step>.+)?$", - check_rights(["change_administrativeact"])( + check_permissions(["archaeological_operations.change_administrativeact"])( views.treatment_administrativeact_wizard ), name="treatment_admacttreatment", ), url( r"^treatment_admacttreatment_modification/(?P<step>.+)?$", - check_rights(["change_administrativeact"])( + check_permissions(["archaeological_operations.change_administrativeact"])( views.treatment_administrativeact_modification_wizard ), name="treatment_admacttreatment_modification", @@ -315,7 +365,7 @@ urlpatterns = [ ), url( r"^treatment_admacttreatment_deletion/(?P<step>.+)?$", - check_rights(["change_administrativeact"])( + check_permissions(["archaeological_operations.change_administrativeact"])( views.treatment_admacttreatment_deletion_wizard ), name="treatment_admacttreatment_deletion", @@ -332,21 +382,21 @@ urlpatterns = [ ), url( r"^treatmentfle_admacttreatmentfle_search/(?P<step>.+)?$", - check_rights(["change_administrativeact"])( + check_permissions(["archaeological_operations.change_administrativeact"])( views.treatmentfile_admacttreatmentfile_search_wizard ), name="treatmentfle_admacttreatmentfle_search", ), url( r"^treatmentfle_admacttreatmentfle_modification/(?P<step>.+)?$", - check_rights(["change_administrativeact"])( + check_permissions(["archaeological_operations.change_administrativeact"])( views.treatmentfile_admacttreatmentfile_modification_wizard ), name="treatmentfle_admacttreatmentfle_modification", ), url( r"^treatmentfle_admacttreatmentfle/(?P<step>.+)?$", - check_rights(["change_administrativeact"])( + check_permissions(["archaeological_operations.change_administrativeact"])( views.treatmentfile_admacttreatmentfile_wizard ), name="treatmentfle_admacttreatmentfle", @@ -358,7 +408,7 @@ urlpatterns = [ ), url( r"^treatmentfle_admacttreatmentfle_deletion/(?P<step>.+)?$", - check_rights(["change_administrativeact"])( + check_permissions(["archaeological_operations.change_administrativeact"])( views.treatmentfile_admacttreatmentfile_deletion_wizard ), name="treatmentfle_admacttreatmentfle_deletion", @@ -370,23 +420,26 @@ urlpatterns = [ ), url( r"^treatmentfle_search/(?P<step>.+)?$", - check_rights(["view_treatmentfile", "view_own_treatmentfile"])( - views.treatmentfile_search_wizard - ), + check_permissions( + ["archaeological_finds.view_treatmentfile", + "archaeological_finds.view_own_treatmentfile"] + )(views.treatmentfile_search_wizard), name="treatmentfile_search", ), url( r"treatmentfle_creation/(?P<step>.+)?$", - check_rights(["change_treatmentfile", "change_own_treatmentfile"])( - views.treatmentfile_creation_wizard - ), + check_permissions( + ["archaeological_finds.change_treatmentfile", + "archaeological_finds.change_own_treatmentfile"] + )(views.treatmentfile_creation_wizard), name="treatmentfile_creation", ), url( r"treatmentfle_modification/(?P<step>.+)?$", - check_rights(["change_treatmentfile", "change_own_treatmentfile"])( - views.treatmentfile_modification_wizard - ), + check_permissions( + ["archaeological_finds.change_treatmentfile", + "archaeological_finds.change_own_treatmentfile"] + )(views.treatmentfile_modification_wizard), name="treatmentfile_modification", ), url( @@ -396,9 +449,10 @@ urlpatterns = [ ), url( r"^treatmentfle_deletion/(?P<step>.+)?$", - check_rights(["change_find", "change_own_find"])( - views.treatmentfile_deletion_wizard - ), + check_permissions( + ["archaeological_finds.change_find", + "archaeological_finds.change_own_find"] + )(views.treatmentfile_deletion_wizard), name="treatmentfile_deletion", ), url( @@ -600,14 +654,18 @@ urlpatterns = [ ), url( r"autocomplete-findbasket/$", - check_rights(["change_find", "change_own_find"])(views.autocomplete_findbasket), + check_permissions( + ["archaeological_finds.change_find", + "archaeological_finds.change_own_find"] + )(views.autocomplete_findbasket), name="autocomplete-findbasket", ), url( r"autocomplete-findbasket-write/$", - check_rights(["change_find", "change_own_find"])( - views.autocomplete_findbasket_write - ), + check_permissions( + ["archaeological_finds.change_find", + "archaeological_finds.change_own_find"] + )(views.autocomplete_findbasket_write), name="autocomplete-findbasket-write", ), url( @@ -615,9 +673,10 @@ urlpatterns = [ ), url( r"api/ishtar/base-finds/get-geo$", - check_rights(["view_find", "view_own_find"])( - views.get_geo_items, - ), + check_permissions( + ["archaeological_finds.view_find", + "archaeological_finds.view_own_find"] + )(views.get_geo_items), name="api-get-geo", ), url( @@ -639,9 +698,10 @@ urlpatterns = [ ), url( r"autocomplete-basefind/$", - check_rights(["view_basefind", "view_own_basefind"])( - views.autocomplete_basefind - ), + check_permissions( + ["archaeological_finds.view_basefind", + "archaeological_finds.view_own_basefind"] + )(views.autocomplete_basefind), name="autocomplete-basefind", ), ] diff --git a/archaeological_finds/views.py b/archaeological_finds/views.py index 866349ce2..0b286531c 100644 --- a/archaeological_finds/views.py +++ b/archaeological_finds/views.py @@ -151,14 +151,12 @@ get_administrativeacttreatmentfile = get_item( def autocomplete_treatmentfile(request): + ishtaruser = getattr(request.user, "ishtaruser", None) + if not ishtaruser: + return HttpResponse(content_type="text/plain") if ( - not request.user.has_perm("ishtar_common.view_treatment", models.Treatment) - and not request.user.has_perm( - "ishtar_common.view_own_treatment", models.Treatment - ) - and not request.user.ishtaruser.has_right( - "treatmentfile_search", session=request.session - ) + not ishtaruser.has_permission("archaeological_finds.view_treatment") + and not ishtaruser.has_permission("archaeological_finds.view_own_treatment") ): return HttpResponse(content_type="text/plain") if not request.GET.get("term"): @@ -193,7 +191,7 @@ def show_basefind(request, pk, **dct): def show_find_extra(request, find): - if not request.user or not request.user.ishtaruser: + if not request.user or not getattr(request.user, "ishtaruser", None): return {} user = request.user.ishtaruser if isinstance(find, dict): @@ -607,8 +605,8 @@ class FindBasketDeleteItemView( basket = self.get_basket(user=ishtaruser, pk=self.kwargs["basket"]) if ( not user.is_superuser - and not ishtaruser.has_right("view_find") - and not (ishtaruser.has_right("view_own_find") and find.is_own(user)) + and not ishtaruser.has_permission("archaeological_finds.view_find") + and not ishtaruser.has_permission("archaeological_finds.view_own_find", find) ): raise PermissionDenied basket.items.remove(find) diff --git a/archaeological_operations/ishtar_menu.py b/archaeological_operations/ishtar_menu.py index b58fb5078..31d7ade34 100644 --- a/archaeological_operations/ishtar_menu.py +++ b/archaeological_operations/ishtar_menu.py @@ -24,7 +24,7 @@ from ishtar_common.menu_base import SectionItem, MenuItem from ishtar_common.models import IshtarSiteProfile from archaeological_operations import models -# be careful: each access_controls must be relevant with check_rights in urls +# be careful: each access_controls must be relevant with check_permissions in urls MENU_SECTIONS = [ @@ -39,31 +39,43 @@ MENU_SECTIONS = [ "operation_search", _("Search"), model=models.Operation, - access_controls=["view_operation", "view_own_operation"], + access_controls=[ + "archaeological_operations.view_operation", + "archaeological_operations.view_own_operation" + ], ), MenuItem( "operation_creation", _("Creation"), model=models.Operation, - access_controls=["add_operation", "add_own_operation"], + access_controls=[ + "archaeological_operations.add_operation", + "archaeological_operations.add_own_operation" + ], ), MenuItem( "operation_modification", _("Modification"), model=models.Operation, - access_controls=["change_operation", "change_own_operation"], + access_controls=[ + "archaeological_operations.change_operation", + "archaeological_operations.change_own_operation" + ], ), MenuItem( "operation_closing", _("Closing"), model=models.Operation, - access_controls=["close_operation"], + access_controls=["archaeological_operations.close_operation"], ), MenuItem( "operation_deletion", _("Deletion"), model=models.Operation, - access_controls=["change_operation", "change_own_operation"], + access_controls=[ + "archaeological_operations.change_operation", + "archaeological_operations.change_own_operation" + ], ), SectionItem( "admin_act_operations", @@ -74,25 +86,33 @@ MENU_SECTIONS = [ "operation_administrativeactop_search", _("Search"), model=models.AdministrativeAct, - access_controls=["change_administrativeact"], + access_controls=[ + "archaeological_operations.change_administrativeact" + ], ), MenuItem( "operation_administrativeactop", _("Creation"), model=models.AdministrativeAct, - access_controls=["change_administrativeact"], + access_controls=[ + "archaeological_operations.change_administrativeact" + ], ), MenuItem( "operation_administrativeactop_modification", _("Modification"), model=models.AdministrativeAct, - access_controls=["change_administrativeact"], + access_controls=[ + "archaeological_operations.change_administrativeact" + ], ), MenuItem( "operation_administrativeactop_deletion", _("Deletion"), model=models.AdministrativeAct, - access_controls=["change_administrativeact"], + access_controls=[ + "archaeological_operations.change_administrativeact" + ], ), ], ), @@ -112,8 +132,8 @@ MENU_SECTIONS = [ pgettext_lazy("admin act register", "Register"), model=models.AdministrativeAct, access_controls=[ - "view_administrativeact", - "view_own_administrativeact", + "archaeological_operations.view_administrativeact", + "archaeological_operations.view_own_administrativeact", ], ), ], @@ -132,8 +152,8 @@ MENU_SECTIONS = [ _("Search"), model=models.ArchaeologicalSite, access_controls=[ - "view_archaeologicalsite", - "view_own_archaeologicalsite", + "archaeological_operations.view_archaeologicalsite", + "archaeological_operations.view_own_archaeologicalsite", ], ), MenuItem( @@ -141,8 +161,8 @@ MENU_SECTIONS = [ _("Creation"), model=models.ArchaeologicalSite, access_controls=[ - "add_archaeologicalsite", - "add_own_archaeologicalsite", + "archaeological_operations.add_archaeologicalsite", + "archaeological_operations.add_own_archaeologicalsite", ], ), MenuItem( @@ -150,15 +170,17 @@ MENU_SECTIONS = [ _("Modification"), model=models.ArchaeologicalSite, access_controls=[ - "change_archaeologicalsite", - "change_own_archaeologicalsite", + "archaeological_operations.change_archaeologicalsite", + "archaeological_operations.change_own_archaeologicalsite", ], ), MenuItem( "site_deletion", _("Deletion"), model=models.ArchaeologicalSite, - access_controls=["change_archaeologicalsite"], + access_controls=[ + "archaeological_operations.change_archaeologicalsite" + ], ), ], ), diff --git a/archaeological_operations/models.py b/archaeological_operations/models.py index 9119a5c72..a074adc9a 100644 --- a/archaeological_operations/models.py +++ b/archaeological_operations/models.py @@ -31,7 +31,7 @@ from django.contrib.gis.db.models.functions import Centroid from django.contrib.postgres.indexes import GinIndex from django.contrib.sites.models import Site from django.db import transaction, OperationalError, IntegrityError -from django.db.models import Q, Count, Sum, Max, Avg +from django.db.models import Q, Max from django.db.models.signals import post_save, m2m_changed, post_delete from django.forms import ValidationError from django.urls import reverse @@ -579,14 +579,20 @@ class ArchaeologicalSite( icon_class="fa fa-lock", text=_("Lock/Unlock"), target="many", - rights=["change_archaeologicalsite", "change_own_archaeologicalsite"], + rights=[ + "archaeological_operations.change_archaeologicalsite", + "archaeological_operations.change_own_archaeologicalsite" + ], ) QA_EDIT = QuickAction( url="site-qa-bulk-update", icon_class="fa fa-pencil", text=_("Bulk update"), target="many", - rights=["change_archaeologicalsite", "change_own_archaeologicalsite"], + rights=[ + "archaeological_operations.change_archaeologicalsite", + "archaeological_operations.change_own_archaeologicalsite" + ], ) QUICK_ACTIONS = [ QA_EDIT, @@ -596,7 +602,7 @@ class ArchaeologicalSite( icon_class="fa fa-plus", text=_("Create associated operation"), target="many", - rights=["change_operation"], + rights=["archaeological_operations.add_operation"], is_popup=False ), QuickAction( @@ -604,7 +610,10 @@ class ArchaeologicalSite( icon_class="fa fa-clone", text=_("Duplicate"), target="one", - rights=["change_archaeologicalsite", "change_own_archaeologicalsite"], + rights=[ + "archaeological_operations.change_archaeologicalsite", + "archaeological_operations.change_own_archaeologicalsite" + ], ), ] @@ -780,8 +789,12 @@ class ArchaeologicalSite( actions = super(ArchaeologicalSite, self).get_extra_actions(request) is_locked = self.is_locked(request.user) profile = get_current_profile() - can_edit_site = self.can_do(request, "change_archaeologicalsite") - can_add_geo = profile.mapping and self.can_do(request, "add_geovectordata") + can_edit_site = self.can_do( + request, "archaeological_operations.change_archaeologicalsite" + ) + can_add_geo = profile.mapping and self.can_do( + request, "ishtar_common.add_geovectordata" + ) if can_add_geo: actions.append(self.get_add_geo_action()) @@ -797,7 +810,9 @@ class ArchaeologicalSite( ), ] - can_create_operation = self.can_do(request, "change_operation") + can_create_operation = self.can_do( + request, "archaeological_operations.change_operation" + ) if can_create_operation and not self.operations.count(): actions.append( ( @@ -1439,14 +1454,20 @@ class Operation( icon_class="fa fa-pencil", text=_("Bulk update"), target="many", - rights=["change_operation", "change_own_operation"], + rights=[ + "archaeological_operations.change_operation", + "archaeological_operations.change_own_operation" + ], ) QA_LOCK = QuickAction( url="operation-qa-lock", icon_class="fa fa-lock", text=_("Lock/Unlock"), target="many", - rights=["change_operation", "change_own_operation"], + rights=[ + "archaeological_operations.change_operation", + "archaeological_operations.change_own_operation" + ], ) QUICK_ACTIONS = [ QA_EDIT, @@ -1456,7 +1477,10 @@ class Operation( icon_class="fa fa-clone", text=_("Duplicate"), target="one", - rights=["change_operation", "change_own_operation"], + rights=[ + "archaeological_operations.change_operation", + "archaeological_operations.change_own_operation" + ], ), ] @@ -2124,7 +2148,9 @@ class Operation( actions = super(Operation, self).get_extra_actions(request) is_locked = self.is_locked(request.user) - can_edit_operation = self.can_do(request, "change_operation") + can_edit_operation = self.can_do( + request, "archaeological_operations.change_operation" + ) if can_edit_operation and not is_locked: actions = [ ( @@ -2138,10 +2164,14 @@ class Operation( ] + actions profile = get_current_profile() - can_add_geo = profile.mapping and self.can_do(request, "add_geovectordata") + can_add_geo = profile.mapping and self.can_do( + request, "ishtar_common.add_geovectordata" + ) if can_add_geo: actions.append(self.get_add_geo_action()) - can_add_cr = self.can_do(request, "add_contextrecord") + can_add_cr = self.can_do( + request, "archaeological_context_records.add_contextrecord" + ) if can_add_cr and not is_locked: start = actions end = [] @@ -2158,7 +2188,8 @@ class Operation( True, ), ] + end - if profile.files and self.can_do(request, "add_administrativeact"): + if profile.files and self.can_do( + request, "archaeological_operations.add_administrativeact"): actions += [ ( reverse("operation-add-adminact", args=[self.pk]), diff --git a/archaeological_operations/urls.py b/archaeological_operations/urls.py index 7f5080c39..ba96c64b2 100644 --- a/archaeological_operations/urls.py +++ b/archaeological_operations/urls.py @@ -21,7 +21,7 @@ from django.conf.urls import url from django.urls import path, register_converter from ishtar_common import urls_converters -from ishtar_common.utils import check_rights +from ishtar_common.utils import check_permissions from archaeological_operations import views from archaeological_operations import views_api from archaeological_operations import models @@ -29,27 +29,27 @@ from archaeological_operations import models register_converter(urls_converters.UnderscoreSlug, "uslug") -# be carreful: each check_rights must be relevant with ishtar_menu +# be carreful: each check_permissions must be relevant with ishtar_menu # forms urlpatterns = [ url( r"operation_administrativeactop_search/(?P<step>.+)?$", - check_rights(["change_administrativeact"])( + check_permissions(["archaeological_operations.change_administrativeact"])( views.operation_administrativeactop_search_wizard ), name="operation_administrativeactop_search", ), url( r"operation_administrativeactop/(?P<step>.+)?$", - check_rights(["change_administrativeact"])( + check_permissions(["archaeological_operations.change_administrativeact"])( views.operation_administrativeactop_wizard ), name="operation_administrativeactop", ), url( r"operation_administrativeactop_modification/(?P<step>.+)?$", - check_rights(["change_administrativeact"])( + check_permissions(["archaeological_operations.change_administrativeact"])( views.operation_administrativeactop_modification_wizard ), name="operation_administrativeactop_modification", @@ -61,7 +61,7 @@ urlpatterns = [ ), url( r"operation_administrativeactop_deletion/(?P<step>.+)?$", - check_rights(["change_administrativeact"])( + check_permissions(["archaeological_operations.change_administrativeact"])( views.operation_administrativeactop_deletion_wizard ), name="operation_administrativeactop_deletion", @@ -73,29 +73,34 @@ urlpatterns = [ ), url( r"operation_search/(?P<step>.+)?$", - check_rights(["view_operation", "view_own_operation"])( - views.operation_search_wizard - ), + check_permissions( + ["archaeological_operations.view_operation", + "archaeological_operations.view_own_operation"] + )(views.operation_search_wizard), name="operation_search", ), url( r"^operation-add-adminact/(?P<pk>[0-9-]+)/$", - check_rights(["add_administrativeact"])(views.operation_adminact_add), + check_permissions( + ["archaeological_operations.add_administrativeact"] + )(views.operation_adminact_add), name="operation-add-adminact", ), url( r"operation_creation/(?P<step>.+)?$", - check_rights(["add_operation", "add_own_operation"])( - views.operation_creation_wizard - ), + check_permissions( + ["archaeological_operations.add_operation", + "archaeological_operations.add_own_operation"] + )(views.operation_creation_wizard), name="operation_creation", ), url(r"operation_add/(?P<file_id>\d+)$", views.operation_add, name="operation_add"), url( r"operation_modification/(?P<step>.+)?$", - check_rights(["change_operation", "change_own_operation"])( - views.operation_modification_wizard - ), + check_permissions( + ["archaeological_operations.change_operation", + "archaeological_operations.change_own_operation"] + )(views.operation_modification_wizard), name="operation_modification", ), url( @@ -105,14 +110,17 @@ urlpatterns = [ ), url( r"operation_closing/(?P<step>.+)?$", - check_rights(["change_operation"])(views.operation_closing_wizard), + check_permissions( + ["archaeological_operations.change_operation"] + )(views.operation_closing_wizard), name="operation_closing", ), url( r"operation_deletion/(?P<step>.+)?$", - check_rights(["change_operation", "change_own_operation"])( - views.operation_deletion_wizard - ), + check_permissions( + ["archaeological_operations.change_operation", + "archaeological_operations.change_own_operation"] + )(views.operation_deletion_wizard), name="operation_deletion", ), url( @@ -122,9 +130,10 @@ urlpatterns = [ ), url( r"administrativact_register/(?P<step>.+)?$", - check_rights(["view_administrativeact", "view_own_administrativeact"])( - views.administrativact_register_wizard - ), + check_permissions( + ["archaeological_operations.view_administrativeact", + "archaeological_operations.view_own_administrativeact"] + )(views.administrativact_register_wizard), name="administrativact_register", ), url( @@ -267,29 +276,34 @@ urlpatterns = [ ), url( r"site_search/(?P<step>.+)?$", - check_rights(["view_archaeologicalsite", "view_own_archaeologicalsite"])( - views.site_search_wizard - ), + check_permissions( + ["archaeological_operations.view_archaeologicalsite", + "archaeological_operations.view_own_archaeologicalsite"] + )(views.site_search_wizard), name="site_search", ), url( r"site_creation/(?P<step>.+)?$", - check_rights(["add_archaeologicalsite", "add_own_archaeologicalsite"])( - views.site_creation_wizard - ), + check_permissions( + ["archaeological_operations.add_archaeologicalsite", + "archaeological_operations.add_own_archaeologicalsite"] + )(views.site_creation_wizard), name="site_creation", ), url( r"site_modification/(?P<step>.+)?$", - check_rights(["change_archaeologicalsite", "change_own_archaeologicalsite"])( - views.site_modification_wizard - ), + check_permissions( + ["archaeological_operations.change_archaeologicalsite", + "archaeological_operations.change_own_archaeologicalsite"] + )(views.site_modification_wizard), name="site_modification", ), url(r"site_modify/(?P<pk>.+)/$", views.site_modify, name="site_modify"), url( r"site_deletion/(?P<step>.+)?$", - check_rights(["change_archaeologicalsite"])(views.site_deletion_wizard), + check_permissions( + ["archaeological_operations.change_archaeologicalsite"] + )(views.site_deletion_wizard), name="site_deletion", ), url(r"site_delete/(?P<pk>.+)/$", views.site_delete, name="delete-site"), @@ -310,59 +324,67 @@ urlpatterns = [ ), url( r"^operation-relations-modify/(?P<pk>.+)/$", - check_rights(["change_operation", "change_own_operation"])( - views.operation_modify_relations - ), + check_permissions( + ["archaeological_operations.change_operation", + "archaeological_operations.change_own_operation"] + )(views.operation_modify_relations), name="operation-relation-modify", ), path( "operation-site-relations-modify/<int:pk>/", - check_rights(["change_operation", "change_own_operation"])( - views.operation_site_modify_relations - ), + check_permissions( + ["archaeological_operations.change_operation", + "archaeological_operations.change_own_operation"] + )(views.operation_site_modify_relations), name="operation-site-relations-modify", ), path( "operation-site-relations-modify/<int:pk>/<uslug:window_id>/", - check_rights(["change_operation", "change_own_operation"])( - views.operation_site_modify_relations - ), + check_permissions( + ["archaeological_operations.change_operation", + "archaeological_operations.change_own_operation"] + )(views.operation_site_modify_relations), name="operation-site-relations-modify", ), path( "site-operation-relations-modify/<int:pk>/", - check_rights(["change_operation", "change_own_operation"])( - views.site_operation_modify_relations - ), + check_permissions( + ["archaeological_operations.change_operation", + "archaeological_operations.change_own_operation"] + )(views.site_operation_modify_relations), name="site-operation-relations-modify", ), path( "site-operation-relations-modify/<int:pk>/<uslug:window_id>/", - check_rights(["change_operation", "change_own_operation"])( - views.site_operation_modify_relations - ), + check_permissions( + ["archaeological_operations.change_operation", + "archaeological_operations.change_own_operation"] + )(views.site_operation_modify_relations), name="site-operation-relations-modify", ), url( r"^operation-qa-bulk-update/(?P<pks>[0-9-]+)?/$", - check_rights(["change_operation", "change_own_operation"])( - views.QAOperationForm.as_view() - ), + check_permissions( + ["archaeological_operations.change_operation", + "archaeological_operations.change_own_operation"] + )(views.QAOperationForm.as_view()), name="operation-qa-bulk-update", ), url( r"^operation-qa-bulk-update/(?P<pks>[0-9-]+)?/confirm/$", - check_rights(["change_operation", "change_own_operation"])( - views.QAOperationForm.as_view() - ), + check_permissions( + ["archaeological_operations.change_operation", + "archaeological_operations.change_own_operation"] + )(views.QAOperationForm.as_view()), name="operation-qa-bulk-update-confirm", kwargs={"confirm": True}, ), url( r"^operation-qa-duplicate/(?P<pks>[0-9-]+)?/$", - check_rights(["change_operation", "change_own_operation"])( - views.QAOperationdDuplicateFormView.as_view() - ), + check_permissions( + ["archaeological_operations.change_operation", + "archaeological_operations.change_own_operation"] + )(views.QAOperationdDuplicateFormView.as_view()), name="operation-qa-duplicate", ), url( @@ -373,9 +395,10 @@ urlpatterns = [ ), url( r"^site-qa-duplicate/(?P<pks>[0-9-]+)?/$", - check_rights(["change_archaeologicalsite", "change_own_archaeologicalsite"])( - views.QAArchaeologicalSiteDuplicateFormView.as_view() - ), + check_permissions( + ["archaeological_operations.change_archaeologicalsite", + "archaeological_operations.change_own_archaeologicalsite"] + )(views.QAArchaeologicalSiteDuplicateFormView.as_view()), name="site-qa-duplicate", ), url( @@ -386,29 +409,31 @@ urlpatterns = [ ), url( r"^site-qa-bulk-update/(?P<pks>[0-9-]+)?/$", - check_rights(["change_archaeologicalsite", "change_own_archaeologicalsite"])( - views.QAArchaeologicalSiteForm.as_view() - ), + check_permissions( + ["archaeological_operations.change_archaeologicalsite", + "archaeological_operations.change_own_archaeologicalsite"] + )(views.QAArchaeologicalSiteForm.as_view()), name="site-qa-bulk-update", ), url( r"^site-qa-bulk-update/(?P<pks>[0-9-]+)?/confirm/$", - check_rights(["change_archaeologicalsite", "change_own_archaeologicalsite"])( - views.QAArchaeologicalSiteForm.as_view() - ), + check_permissions( + ["archaeological_operations.change_archaeologicalsite", + "archaeological_operations.change_own_archaeologicalsite"] + )(views.QAArchaeologicalSiteForm.as_view()), name="site-qa-bulk-update-confirm", kwargs={"confirm": True}, ), url( r"^site-add-operation/(?P<pks>[0-9-]+)?/$", - check_rights(["change_operation"])( + check_permissions(["archaeological_operations.change_operation"])( views.site_add_operation ), name="site-add-operation", ), url( r"^site-add-top-operation/(?P<pks>\d+)?/$", - check_rights(["change_operation"])( + check_permissions(["archaeological_operations.change_operation"])( views.site_add_top_operation ), name="site-add-top-operation", diff --git a/archaeological_operations/views.py b/archaeological_operations/views.py index 20193e197..7b6a56597 100644 --- a/archaeological_operations/views.py +++ b/archaeological_operations/views.py @@ -23,14 +23,14 @@ from jinja2 import TemplateSyntaxError from django.conf import settings from django.core.exceptions import PermissionDenied from django.db.models import Q -from django.forms.utils import ErrorDict, ErrorList +from django.forms.utils import ErrorList from django.http import HttpResponse, HttpResponseRedirect, Http404 from django.shortcuts import render, redirect from django.urls import reverse from django.views.generic import RedirectView from ishtar_common.utils import ugettext_lazy as _, pgettext_lazy from archaeological_operations.utils import parse_parcels -from django.forms import formset_factory, ValidationError +from django.forms import ValidationError from archaeological_operations import models from archaeological_operations import forms @@ -43,7 +43,7 @@ from ishtar_common.models import ( DocumentTemplate, ) from archaeological_context_records.models import ContextRecord -from ishtar_common.utils import put_session_message, check_rights_condition +from ishtar_common.utils import check_permissions_condition from ishtar_common.views import ( gen_generate_doc, QAItemEditForm, @@ -58,14 +58,12 @@ from ishtar_common.wizards import SearchWizard def autocomplete_patriarche(request): + ishtaruser = getattr(request.user, "ishtaruser", None) + if not ishtaruser: + return HttpResponse(content_type="text/plain") if ( - not request.user.has_perm("ishtar_common.view_operation", models.Operation) - and not request.user.has_perm( - "ishtar_common.view_own_operation", models.Operation - ) - and not request.user.ishtaruser.has_right( - "operation_search", session=request.session - ) + not ishtaruser.has_permission("archaeological_operations.view_operation") + and not ishtaruser.has_permission("archaeological_operations.view_own_operation") ): return HttpResponse(content_type="text/plain") if not request.GET.get("term"): @@ -88,11 +86,13 @@ def autocomplete_patriarche(request): def autocomplete_archaeologicalsite(request): - if not request.user.has_perm( - "archaeological_operations.view_archaeologicalsite", models.ArchaeologicalSite - ) and not request.user.has_perm( + ishtaruser = getattr(request.user, "ishtaruser", None) + if not ishtaruser: + return HttpResponse(content_type="text/plain") + if not ishtaruser.has_permission( + "archaeological_operations.view_archaeologicalsite" + ) and not ishtaruser.has_permission( "archaeological_operations.view_own_archaeologicalsite", - models.ArchaeologicalSite, ): return HttpResponse(content_type="text/plain") if not request.GET.get("term"): @@ -121,14 +121,14 @@ new_archaeologicalsite = new_qa_item( def autocomplete_operation(request): + ishtaruser = getattr(request.user, "ishtaruser", None) + if not ishtaruser: + return HttpResponse(content_type="text/plain") # person_types = request.user.ishtaruser.person.person_type if ( - not request.user.has_perm("ishtar_common.view_operation", models.Operation) - and not request.user.has_perm( - "ishtar_common.view_own_operation", models.Operation - ) - and not request.user.ishtaruser.has_right( - "operation_search", session=request.session + not ishtaruser.has_permission("archaeological_operations.view_operation") + and not ishtaruser.has_permission( + "archaeological_operations.view_own_operation" ) ): return HttpResponse(content_type="text/plain") @@ -161,10 +161,13 @@ def autocomplete_operation(request): def get_available_operation_code(request, year=None): - if not request.user.has_perm( - "ishtar_common.view_operation", models.Operation - ) and not request.user.has_perm( - "ishtar_common.view_own_operation", models.Operation + ishtaruser = getattr(request.user, "ishtaruser", None) + if not ishtaruser: + return HttpResponse(content_type="text/plain") + if not ishtaruser.has_permission( + "archaeological_operations.view_operation" + ) and not ishtaruser.has_permission( + "archaeological_operations.view_own_operation" ): return HttpResponse(content_type="text/plain") data = json.dumps({"id": models.Operation.get_available_operation_code(year)}) @@ -211,9 +214,8 @@ wizard_steps = [ def get_check_files_for_operation(other_check=None): def func(self): - if not get_current_profile().files or not check_rights_condition(["view_file"])( - self - ): + if not get_current_profile().files or \ + not check_permissions_condition(["archaeological_files.view_file"])(self): return False if not other_check: return True @@ -975,7 +977,10 @@ def administrativeactfile_document( search_form = AdministrativeActTreatmentFileFormSelection document_type = "TF" - if not request.user.has_perm("view_administrativeact", models.AdministrativeAct): + ishtaruser = getattr(request.user, "ishtaruser", None) + if not ishtaruser: + return HttpResponse(content_type="text/plain") + if not ishtaruser.has_permission("archaeological_operations.view_administrativeact"): return HttpResponse(content_type="text/plain") dct = {} DocumentGenerationAdminActForm = forms.DocumentGenerationAdminActForm @@ -1032,10 +1037,13 @@ def administrativeactfile_document( def autocomplete_administrativeact(request): - if not request.user.has_perm( - "archaeological_operations.view_administrativeact", models.AdministrativeAct - ) and not request.user.has_perm( - "archaeological_operations.view_own_administrativeact", models.AdministrativeAct + ishtaruser = getattr(request.user, "ishtaruser", None) + if not ishtaruser: + return HttpResponse(content_type="text/plain") + if not ishtaruser.has_permission( + "archaeological_operations.view_administrativeact" + ) and not ishtaruser.has_permission( + "archaeological_operations.view_own_administrativeact" ): return HttpResponse(content_type="text/plain") if not request.GET.get("term"): diff --git a/archaeological_warehouse/ishtar_menu.py b/archaeological_warehouse/ishtar_menu.py index 851ec3643..c0b8d658b 100644 --- a/archaeological_warehouse/ishtar_menu.py +++ b/archaeological_warehouse/ishtar_menu.py @@ -23,7 +23,7 @@ from ishtar_common.menu_base import SectionItem, MenuItem from . import models -# be careful: each access_controls must be relevant with check_rights in urls +# be careful: each access_controls must be relevant with check_permissions in urls MENU_SECTIONS = [ @@ -39,14 +39,17 @@ MENU_SECTIONS = [ "warehouse_search", _("Search"), model=models.Warehouse, - access_controls=["view_warehouse", "view_own_warehouse"], + access_controls=[ + "archaeological_warehouse.view_warehouse", + "archaeological_warehouse.view_own_warehouse" + ], ), MenuItem( "warehouse_creation", _("Creation"), model=models.Warehouse, access_controls=[ - "add_warehouse", + "archaeological_warehouse.add_warehouse", ], ), MenuItem( @@ -54,7 +57,7 @@ MENU_SECTIONS = [ _("Modification"), model=models.Warehouse, access_controls=[ - "change_warehouse", + "archaeological_warehouse.change_warehouse", ], ), MenuItem( @@ -62,7 +65,7 @@ MENU_SECTIONS = [ _("Deletion"), model=models.Warehouse, access_controls=[ - "change_warehouse", + "archaeological_warehouse.change_warehouse", ], ), ], @@ -80,42 +83,48 @@ MENU_SECTIONS = [ "container_search", _("Search"), model=models.Warehouse, - access_controls=["view_container", "view_own_container"], + access_controls=[ + "archaeological_warehouse.view_container", + "archaeological_warehouse.view_own_container" + ], ), MenuItem( "container_creation", _("Creation"), model=models.Warehouse, - access_controls=["add_container", "add_own_container"], + access_controls=[ + "archaeological_warehouse.add_container", + "archaeological_warehouse.add_own_container" + ], ), MenuItem( "container_modification", _("Modification"), model=models.Warehouse, access_controls=[ - "change_container", - "change_own_container", + "archaeological_warehouse.change_container", + "archaeological_warehouse.change_own_container", ], ), MenuItem( "container-merge", _("Automatic merge"), model=models.Container, - access_controls=["administrator"], + access_controls=["ishtaradmin"], ), MenuItem( "container-manual-merge", _("Manual merge"), model=models.Container, - access_controls=["administrator"], + access_controls=["ishtaradmin"], ), MenuItem( "container_deletion", _("Deletion"), model=models.Warehouse, access_controls=[ - "change_container", - "change_own_container", + "archaeological_warehouse.change_container", + "archaeological_warehouse.change_own_container", ], ), ], diff --git a/archaeological_warehouse/models.py b/archaeological_warehouse/models.py index 3cb04816d..9aa5549db 100644 --- a/archaeological_warehouse/models.py +++ b/archaeological_warehouse/models.py @@ -32,7 +32,8 @@ from django.urls import reverse from ishtar_common.utils import ugettext_lazy as _, pgettext_lazy from django.apps import apps -from ishtar_common.data_importer import post_importer_action, pre_importer_action, ImporterError +from ishtar_common.data_importer import post_importer_action, pre_importer_action, \ + ImporterError from ishtar_common.model_managers import UUIDModelManager from ishtar_common.models import ValueGetter, get_current_profile, HistoryModel, Imported from ishtar_common.models_common import ( @@ -377,7 +378,10 @@ class Warehouse( icon_class="fa fa-pencil", text=_("Bulk update"), target="many", - rights=["change_warehouse", "change_own_warhouse"], + rights=[ + "archaeological_warehouse.change_warehouse", + "archaeological_warehouse.change_own_warhouse" + ], ) QA_LOCK = QuickAction( @@ -385,7 +389,10 @@ class Warehouse( icon_class="fa fa-lock", text=_("Lock/Unlock"), target="many", - rights=["change_warehouse", "change_own_warehouse"], + rights=[ + "archaeological_warehouse.change_warehouse", + "archaeological_warehouse.change_own_warehouse" + ], ) QUICK_ACTIONS = [ QA_LOCK, @@ -1105,21 +1112,30 @@ class Container( icon_class="fa fa-pencil", text=_("Bulk update"), target="many", - rights=["change_container", "change_own_container"], + rights=[ + "archaeological_warehouse.change_container", + "archaeological_warehouse.change_own_container" + ], ) QA_MOVE = QuickAction( url="container-qa-move", icon_class="fa fa-arrow-right", text=pgettext_lazy("action", "Move"), target="many", - rights=["change_container", "change_own_container"], + rights=[ + "archaeological_warehouse.change_container", + "archaeological_warehouse.change_own_container" + ], ) QA_LOCK = QuickAction( url="container-qa-lock", icon_class="fa fa-lock", text=_("Lock/Unlock"), target="many", - rights=["change_container", "change_own_container"], + rights=[ + "archaeological_warehouse.change_container", + "archaeological_warehouse.change_own_container" + ], ) QUICK_ACTIONS = [QA_EDIT, QA_MOVE, QA_LOCK] @@ -1939,7 +1955,7 @@ class Container( """ # url, base_text, icon, extra_text, extra css class, is a quick action actions = super(Container, self).get_extra_actions(request) - can_edit_find = self.can_do(request, "change_find") + can_edit_find = self.can_do(request, "archaeological_finds.change_find") if can_edit_find: actions += [ ( diff --git a/archaeological_warehouse/tests.py b/archaeological_warehouse/tests.py index c218b7d0e..96df83024 100644 --- a/archaeological_warehouse/tests.py +++ b/archaeological_warehouse/tests.py @@ -20,7 +20,7 @@ import datetime import json -from django.contrib.auth.models import Permission +from django.contrib.auth.models import Permission, User from django.db.utils import IntegrityError from django.test.client import Client from django.urls import reverse @@ -560,6 +560,7 @@ class ContainerQATest(FindInit, TestCase): def setUp(self): self.get_default_user() + self.alt_username, self.alt_password, self.alt_user = create_user() self.main_warehouse = models.Warehouse.objects.create( name="Main", warehouse_type=models.WarehouseType.objects.all()[0] ) @@ -638,16 +639,16 @@ class ContainerQATest(FindInit, TestCase): response = c.get(url) self.assertRedirects(response, "/") c = Client() - c.login(username=self.username, password=self.password) + c.login(username=self.alt_username, password=self.alt_password) response = c.get(url) # change_container permission is needed - self.assertEqual(response.status_code, 404) + self.assertEqual(response.status_code, 302) c.logout() - self.user.user_permissions.add( + self.alt_user.user_permissions.add( Permission.objects.get(codename="change_container") ) - c.login(username=self.username, password=self.password) + c.login(username=self.alt_username, password=self.alt_password) response = c.get(url) self.assertEqual(response.status_code, 200) diff --git a/archaeological_warehouse/urls.py b/archaeological_warehouse/urls.py index a41852b8b..669732a57 100644 --- a/archaeological_warehouse/urls.py +++ b/archaeological_warehouse/urls.py @@ -20,19 +20,20 @@ from django.conf.urls import url from django.urls import path -from ishtar_common.utils import check_rights +from ishtar_common.utils import check_permissions from archaeological_warehouse import models, views, views_api -# be careful: each check_rights must be relevant with ishtar_menu +# be careful: each check_permissions must be relevant with ishtar_menu # forms urlpatterns = [ url( r"warehouse_packaging/(?P<step>.+)?$", # AFAC - check_rights(["change_find", "change_own_find"])( - views.warehouse_packaging_wizard - ), + check_permissions( + ["archaeological_finds.change_find", + "archaeological_finds.change_own_find"] + )(views.warehouse_packaging_wizard), name="warehouse_packaging", ), url( @@ -105,19 +106,24 @@ urlpatterns = [ ), url( r"^warehouse_search/(?P<step>.+)?$", - check_rights(["view_warehouse", "view_own_warehouse"])( - views.warehouse_search_wizard - ), + check_permissions( + ["archaeological_warehouse.view_warehouse", + "archaeological_warehouse.view_own_warehouse"] + )(views.warehouse_search_wizard), name="warehouse_search", ), url( r"^warehouse_creation/(?P<step>.+)?$", - check_rights(["add_warehouse"])(views.warehouse_creation_wizard), + check_permissions( + ["archaeological_warehouse.add_warehouse"] + )(views.warehouse_creation_wizard), name="warehouse_creation", ), url( r"^warehouse_modification/(?P<step>.+)?$", - check_rights(["change_warehouse"])(views.warehouse_modification_wizard), + check_permissions( + ["archaeological_warehouse.change_warehouse"] + )(views.warehouse_modification_wizard), name="warehouse_modification", ), url( @@ -127,7 +133,9 @@ urlpatterns = [ ), url( r"^warehouse_deletion/(?P<step>.+)?$", - check_rights(["change_warehouse"])(views.warehouse_deletion_wizard), + check_permissions( + ["archaeological_warehouse.change_warehouse"] + )(views.warehouse_deletion_wizard), name="warehouse_deletion", ), url( @@ -143,49 +151,51 @@ urlpatterns = [ ), url( r"^warehouse-qa-bulk-update/(?P<pks>[0-9-]+)?/$", - check_rights([ - "change_warehouse", - "change_own_warehouse" - ])( - views.QAWarehouseForm.as_view() - ), + check_permissions([ + "archaeological_warehouse.change_warehouse", + "archaeological_warehouse.change_own_warehouse" + ])(views.QAWarehouseForm.as_view()), name="warehouse-qa-bulk-update", ), url( r"^warehouse-qa-bulk-update/(?P<pks>[0-9-]+)?/confirm/$", - check_rights([ - "change_warehouse", - "change_own_warehouse", - ])( - views.QAWarehouseForm.as_view() - ), + check_permissions([ + "archaeological_warehouse.change_warehouse", + "archaeological_warehouse.change_own_warehouse", + ])(views.QAWarehouseForm.as_view()), name="warehouse-qa-bulk-update-confirm", kwargs={"confirm": True}, ), url( r"^container-add-treatment/(?P<pk>[0-9-]+)/$", - check_rights(["change_find", "change_own_find"])(views.container_treatment_add), + check_permissions( + ["archaeological_finds.change_find", + "archaeological_finds.change_own_find"] + )(views.container_treatment_add), name="container-add-treatment", ), url( r"^container_search/(?P<step>.+)?$", - check_rights(["view_container", "view_own_container"])( - views.container_search_wizard - ), + check_permissions( + ["archaeological_warehouse.view_container", + "archaeological_warehouse.view_own_container"] + )(views.container_search_wizard), name="container_search", ), url( r"^container_creation/(?P<step>.+)?$", - check_rights(["add_container", "add_own_container"])( - views.container_creation_wizard - ), + check_permissions( + ["archaeological_warehouse.add_container", + "archaeological_warehouse.add_own_container"] + )(views.container_creation_wizard), name="container_creation", ), url( r"^container_modification/(?P<step>.+)?$", - check_rights(["change_container", "change_own_container"])( - views.container_modification_wizard - ), + check_permissions( + ["archaeological_warehouse.change_container", + "archaeological_warehouse.change_own_container"] + )(views.container_modification_wizard), name="container_modification", ), url( @@ -195,9 +205,10 @@ urlpatterns = [ ), url( r"^container_deletion/(?P<step>.+)?$", - check_rights(["change_container", "change_own_container"])( - views.container_deletion_wizard - ), + check_permissions( + ["archaeological_warehouse.change_container", + "archaeological_warehouse.change_own_container"] + )(views.container_deletion_wizard), name="container_deletion", ), url( @@ -207,24 +218,27 @@ urlpatterns = [ ), url( r"^container-qa-bulk-update/(?P<pks>[0-9-]+)?/$", - check_rights(["change_container", "change_own_container"])( - views.QAContainerForm.as_view() - ), + check_permissions( + ["archaeological_warehouse.change_container", + "archaeological_warehouse.change_own_container"] + )(views.QAContainerForm.as_view()), name="container-qa-bulk-update", ), url( r"^container-qa-bulk-update/(?P<pks>[0-9-]+)?/confirm/$", - check_rights(["change_container", "change_own_container"])( - views.QAContainerForm.as_view() - ), + check_permissions( + ["archaeological_warehouse.change_container", + "archaeological_warehouse.change_own_container"] + )(views.QAContainerForm.as_view()), name="container-qa-bulk-update-confirm", kwargs={"confirm": True}, ), url( r"^container-qa-move/(?P<pks>[0-9-]+)?/$", - check_rights(["change_container", "change_own_container"])( - views.QAContainerMoveForm.as_view() - ), + check_permissions( + ["archaeological_warehouse.change_container", + "archaeological_warehouse.change_own_container"] + )(views.QAContainerMoveForm.as_view()), name="container-qa-move", ), url( diff --git a/archaeological_warehouse/views.py b/archaeological_warehouse/views.py index 4b3f494d8..416849c9a 100644 --- a/archaeological_warehouse/views.py +++ b/archaeological_warehouse/views.py @@ -95,10 +95,13 @@ new_container = new_qa_item( def autocomplete_warehouse(request): - if not request.user.has_perm( - "ishtar_common.view_warehouse", models.Warehouse - ) and not request.user.has_perm( - "ishtar_common.view_own_warehouse", models.Warehouse + ishtaruser = getattr(request.user, "ishtaruser", None) + if not ishtaruser: + return HttpResponse(content_type="text/plain") + if not ishtaruser.has_permission( + "archaeological_warehouse.view_warehouse" + ) and not ishtaruser.has_permission( + "archaeological_warehouse.view_own_warehouse", models.Warehouse ): return HttpResponse(content_type="text/plain") if not request.GET.get("term"): @@ -106,7 +109,8 @@ def autocomplete_warehouse(request): q = request.GET.get("term") query = Q() for q in q.split(" "): - extra = Q(name__icontains=q) | Q(slug__icontains=q) | Q(warehouse_type__label__icontains=q) + extra = Q(name__icontains=q) | Q(slug__icontains=q) | \ + Q(warehouse_type__label__icontains=q) query = query & extra limit = 15 warehouses = models.Warehouse.objects.filter(query)[:limit] @@ -117,10 +121,13 @@ def autocomplete_warehouse(request): def autocomplete_container(request, warehouse_id=None): - if not request.user.has_perm( - "ishtar_common.view_warehouse", models.Warehouse - ) and not request.user.has_perm( - "ishtar_common.view_own_warehouse", models.Warehouse + ishtaruser = getattr(request.user, "ishtaruser", None) + if not ishtaruser: + return HttpResponse(content_type="text/plain") + if not ishtaruser.has_permission( + "archaeological_warehouse.view_container" + ) and not ishtaruser.has_permission( + "archaeological_warehouse.view_own_container" ): return HttpResponse(content_type="text/plain") if not request.GET.get("term"): diff --git a/ishtar_common/backend.py b/ishtar_common/backend.py index 00f90f444..c69a92d10 100644 --- a/ishtar_common/backend.py +++ b/ishtar_common/backend.py @@ -32,6 +32,7 @@ class ObjectPermBackend(ModelBackend): supports_object_permissions = True supports_anonymous_user = True + """ def has_perm(self, user_obj, perm, model=None, obj=None, session=None): if not user_obj.is_authenticated: return False @@ -48,7 +49,7 @@ class ObjectPermBackend(ModelBackend): is_ownperm = perm.split(".")[-1].split("_")[1] == "own" except IndexError: is_ownperm = False - if ishtar_user.has_right("administrator", session=session): + if ishtar_user.has_permission("ishtaradmin"): return True main_right = ishtar_user.person.has_right( perm, session=session @@ -65,3 +66,4 @@ class ObjectPermBackend(ModelBackend): return False return not is_ownperm or model.has_item_of(ishtar_user) return not is_ownperm or obj.is_own(user_obj) + """ diff --git a/ishtar_common/context_processors.py b/ishtar_common/context_processors.py index 74e38efc4..59d517192 100644 --- a/ishtar_common/context_processors.py +++ b/ishtar_common/context_processors.py @@ -181,7 +181,7 @@ def get_base_context(request): "search_model__app_label", "search_model__model" ).distinct() ] - if request.user.ishtaruser.has_right("administrator", session=request.session): + if request.user.ishtaruser.has_permission("ishtaradmin"): dct["ADMIN"] = True if ( request.user.ishtaruser.current_profile diff --git a/ishtar_common/forms.py b/ishtar_common/forms.py index ad76d63cd..e5ffeefb5 100644 --- a/ishtar_common/forms.py +++ b/ishtar_common/forms.py @@ -722,7 +722,7 @@ class IshtarForm(forms.Form, BSForm): if not any( True for permission in permissions - if ishtar_user.has_perm(permission) + if ishtar_user.has_permission(permission) ): continue for option, value in options.items(): @@ -1010,7 +1010,10 @@ class ImportSelect(HistorySelect): def __init__(self, *args, **kwargs): user = kwargs.get("user", None) super().__init__(*args, **kwargs) - if not user or (not user.has_perm("view_import") and not user.has_perm("view_own_import")): + ishtaruser = getattr(user, "ishtaruser", None) + if not ishtaruser or ( + not ishtaruser.has_permission("ishtar_common.view_import") + and not ishtaruser.has_permission("ishtar_common.view_own_import")): self.fields.pop("imports") diff --git a/ishtar_common/forms_common.py b/ishtar_common/forms_common.py index b1e4e7ef4..22e23f3ca 100644 --- a/ishtar_common/forms_common.py +++ b/ishtar_common/forms_common.py @@ -257,9 +257,13 @@ class BaseImportForm(IshtarForm, forms.ModelForm): self._post_init() def _filter_importer_type_query(self, q, user): - if user.is_superuser or user.ishtaruser.has_right("add_import"): + ishtaruser = getattr(user, "ishtaruser", None) + if not ishtaruser: + self.fields["importer_type"].choices = [("", "--")] + return + if user.is_superuser or ishtaruser.has_permission("ishtar_common.add_import"): return q - if not user.ishtaruser.has_right("add_own_import"): + if not user.ishtaruser.has_permission("ishtar_common.add_own_import"): self.fields["importer_type"].choices = [("", "--")] return q = q.filter(users__pk=user.ishtaruser.pk) @@ -555,10 +559,12 @@ class TargetKeyForm(forms.ModelForm): self.associated_import = None if instance and instance.pk: model = instance.target.associated_model + ishtaruser = getattr(self.user, "ishtaruser", None) + meta = model._meta if ( model - and self.user.has_perm( - "{}.change_{}".format(model._meta.app_label, model._meta.model_name) + and ishtaruser.has_permission( + f"{meta.app_label}.change_{meta.model_name}" ) and hasattr(model, "admin_url") ): diff --git a/ishtar_common/ishtar_menu.py b/ishtar_common/ishtar_menu.py index 5c2d1bdb1..aa8ed3b8f 100644 --- a/ishtar_common/ishtar_menu.py +++ b/ishtar_common/ishtar_menu.py @@ -23,7 +23,7 @@ from ishtar_common.menu_base import SectionItem, MenuItem from . import models -# be careful: each access_controls must be relevant with check_rights in urls +# be careful: each access_controls must be relevant with check_permissions in urls MENU_SECTIONS = [ (1, SectionItem("home", _("Home"), childs=[])), @@ -41,37 +41,39 @@ MENU_SECTIONS = [ "person_search", _("Search"), model=models.Person, - access_controls=["add_person"], + access_controls=["ishtar_common.add_person"], ), MenuItem( "person_creation", _("Creation"), model=models.Person, - access_controls=["add_person"], + access_controls=["ishtar_common.add_person"], ), MenuItem( "person_modification", _("Modification"), model=models.Person, - access_controls=["change_person", "change_own_person"], + access_controls=["ishtar_common.change_person", + "ishtar_common.change_own_person"], ), MenuItem( "person-merge", _("Automatic merge"), model=models.Person, - access_controls=["administrator"], + access_controls=["ishtaradmin"], ), MenuItem( "person-manual-merge", _("Manual merge"), model=models.Person, - access_controls=["administrator"], + access_controls=["ishtaradmin"], ), MenuItem( "person_deletion", _("Deletion"), model=models.Person, - access_controls=["change_person", "change_own_person"], + access_controls=["ishtar_common.change_person", + "ishtar_common.change_own_person"], ), ], ), @@ -84,7 +86,7 @@ MENU_SECTIONS = [ _("Addition/modification"), model=models.IshtarUser, access_controls=[ - "administrator", + "ishtaradmin", ], ), MenuItem( @@ -92,7 +94,7 @@ MENU_SECTIONS = [ _("Deletion"), model=models.IshtarUser, access_controls=[ - "administrator", + "ishtaradmin", ], ), ], @@ -106,8 +108,8 @@ MENU_SECTIONS = [ _("Search"), model=models.Organization, access_controls=[ - "add_organization", - "add_own_organization", + "ishtar_common.add_organization", + "ishtar_common.add_own_organization", ], ), MenuItem( @@ -115,8 +117,8 @@ MENU_SECTIONS = [ _("Creation"), model=models.Organization, access_controls=[ - "add_organization", - "add_own_organization", + "ishtar_common.add_organization", + "ishtar_common.add_own_organization", ], ), MenuItem( @@ -124,29 +126,29 @@ MENU_SECTIONS = [ _("Modification"), model=models.Organization, access_controls=[ - "change_organization", - "change_own_organization", + "ishtar_common.change_organization", + "ishtar_common.change_own_organization", ], ), MenuItem( "organization-merge", _("Automatic merge"), model=models.Organization, - access_controls=["administrator"], + access_controls=["ishtaradmin"], ), MenuItem( "orga-manual-merge", _("Manual merge"), model=models.Organization, - access_controls=["administrator"], + access_controls=["ishtaradmin"], ), MenuItem( "organization_deletion", _("Deletion"), model=models.Organization, access_controls=[ - "change_organization", - "change_own_organization", + "ishtar_common.change_organization", + "ishtar_common.change_own_organization", ], ), ], @@ -164,13 +166,15 @@ MENU_SECTIONS = [ "import-list", _("Current imports"), model=models.Import, - access_controls=["view_import", "change_import"], + access_controls=["ishtar_common.view_import", + "ishtar_common.change_import"], ), MenuItem( "import-list-old", _("Old imports"), model=models.Import, - access_controls=["view_import", "change_import"], + access_controls=["ishtar_common.view_import", + "ishtar_common.change_import"], ), ], ), @@ -185,25 +189,29 @@ MENU_SECTIONS = [ "document/search", _("Search"), model=models.Document, - access_controls=["view_document", "view_own_document"], + access_controls=["ishtar_common.view_document", + "ishtar_common.view_own_document"], ), MenuItem( "document/create", _("Creation"), model=models.Document, - access_controls=["add_document", "add_own_document"], + access_controls=["ishtar_common.add_document", + "ishtar_common.add_own_document"], ), MenuItem( "document/edit", _("Modification"), model=models.Document, - access_controls=["change_document", "change_own_document"], + access_controls=["ishtar_common.change_document", + "ishtar_common.change_own_document"], ), MenuItem( "document/delete", _("Deletion"), model=models.Document, - access_controls=["change_document", "change_own_document"], + access_controls=["ishtar_common.change_document", + "ishtar_common.change_own_document"], ), ], ), diff --git a/ishtar_common/menu_base.py b/ishtar_common/menu_base.py index e8470787a..e0f206a57 100644 --- a/ishtar_common/menu_base.py +++ b/ishtar_common/menu_base.py @@ -43,28 +43,28 @@ class SectionItem: return False return True - def can_be_available(self, user, session=None): + def can_be_available(self, user): if not self.check_profile_restriction(): return False if not self.childs: return True for child in self.childs: - if child.can_be_available(user, session=session): + if child.can_be_available(user): return True return False - def is_available(self, user, obj=None, session=None): + def is_available(self, user, obj=None): if not self.childs: return True for child in self.childs: - if child.is_available(user, obj, session=session): + if child.is_available(user, obj): return True return False def set_items(self, user, items, current_action=None, session=None): selected = None if user: - self.available = self.can_be_available(user, session=session) + self.available = self.can_be_available(user) for child in self.childs: selected = ( child.set_items(user, items, current_action, session=session) @@ -101,35 +101,37 @@ class MenuItem: return False return True - def can_be_available(self, user, session=None): + def can_be_available(self, user): if not self.check_profile_restriction(): return False if not self.access_controls: return True if not hasattr(user, "ishtaruser"): return False + ishtaruser = user.ishtaruser for access_control in self.access_controls: # check by profile - if user.ishtaruser.person.has_right(access_control, session=session): + if ishtaruser.has_permission(access_control): return True return False - def is_available(self, user, obj=None, session=None): + def is_available(self, user, obj=None): if not self.check_profile_restriction(): return False if not self.access_controls: return True if not hasattr(user, "ishtaruser"): return False + ishtaruser = user.ishtaruser for access_control in self.access_controls: - if user.ishtaruser.person.has_right( - access_control, obj=obj, session=session + if ishtaruser.has_permission( + access_control, obj=obj ): return True return False def set_items(self, user, items, current_action=None, session=None): if user: - self.available = self.can_be_available(user, session=session) + self.available = self.can_be_available(user) if self.idx == current_action: return True diff --git a/ishtar_common/menus.py b/ishtar_common/menus.py index b167c1765..aae127a09 100644 --- a/ishtar_common/menus.py +++ b/ishtar_common/menus.py @@ -135,20 +135,20 @@ class Menu: self.items_by_idx = {} childs = deepcopy(self.ref_childs) for idx, main_menu in enumerate(reversed(childs)): - if not main_menu.can_be_available(self.user, self.session): + if not main_menu.can_be_available(self.user): childs.pop(len(self.ref_childs) - idx - 1) continue self.items_by_idx[main_menu.idx] = main_menu sub_childs = main_menu.childs[:] for s_idx, child in enumerate(reversed(main_menu.childs)): - if not child.can_be_available(self.user, self.session): + if not child.can_be_available(self.user): sub_childs.pop(len(main_menu.childs) - s_idx - 1) continue self.items_by_idx[child.idx] = child if hasattr(child, "childs"): sub_sub_childs = child.childs[:] for ss_idx, subchild in enumerate(reversed(child.childs)): - if not subchild.can_be_available(self.user, self.session): + if not subchild.can_be_available(self.user): sub_sub_childs.pop(len(child.childs) - ss_idx - 1) continue self.items_by_idx[subchild.idx] = subchild diff --git a/ishtar_common/models.py b/ishtar_common/models.py index 5f57e8398..b1f226088 100644 --- a/ishtar_common/models.py +++ b/ishtar_common/models.py @@ -2665,7 +2665,7 @@ class Organization(Address, Merge, OwnPerms, BaseGenderedType, ValueGetter, Main icon_class="fa fa-pencil", text=_("Bulk update"), target="many", - rights=["change_organization"], + rights=["ishtar_common.change_organization"], ) QUICK_ACTIONS = [QA_EDIT] @@ -2946,7 +2946,7 @@ class Person(Address, Merge, OwnPerms, ValueGetter, MainItem): icon_class="fa fa-pencil", text=_("Bulk update"), target="many", - rights=["change_person"], + rights=["ishtar_common.change_person"], ) QUICK_ACTIONS = [QA_EDIT] @@ -3130,72 +3130,6 @@ class Person(Address, Merge, OwnPerms, ValueGetter, MainItem): def is_natural(self): return not self.attached_to - def has_right(self, right_name, session=None, obj=None): - if "." in right_name: - right_name = right_name.split(".")[-1] - res, cache_key = "", "" - if session: - cache_key = "session-{}-{}".format(session.session_key, right_name) - res = cache.get(cache_key) - if res in (True, False): - return res - # list all cache key in order to clean them on profile change - cache_key_list = "sessionlist-{}".format(session.session_key) - key_list = cache.get(cache_key_list, []) - key_list.append(cache_key) - cache.set(cache_key_list, key_list, settings.CACHE_TIMEOUT) - if isinstance(right_name, (list, tuple)): - res = ( - bool( - self.profiles.filter( - current=True, profile_type__txt_idx__in=right_name - ).count() - ) - or bool( - self.profiles.filter( - current=True, - profile_type__groups__permissions__codename__in=right_name, - ).count() - ) - or bool( - self.ishtaruser.user_ptr.groups.filter( - permissions__codename__in=right_name - ).count() - ) - or bool( - self.ishtaruser.user_ptr.user_permissions.filter( - codename__in=right_name - ).count() - ) - ) - else: - res = ( - bool( - self.profiles.filter( - current=True, profile_type__txt_idx=right_name - ).count() - ) - or bool( - self.profiles.filter( - current=True, - profile_type__groups__permissions__codename=right_name, - ).count() - ) - or bool( - self.ishtaruser.user_ptr.groups.filter( - permissions__codename__in=[right_name] - ).count() - ) - or bool( - self.ishtaruser.user_ptr.user_permissions.filter( - codename__in=[right_name] - ).count() - ) - ) - if session: - cache.set(cache_key, res, settings.CACHE_TIMEOUT) - return res - def full_label(self): values = [] if self.title: @@ -3330,7 +3264,8 @@ class BiographicalNote(BaseHistorizedItem, ValueGetter, MainItem): url="biographicalnote-qa-edit", icon_class="fa fa-pencil", text=_("Edit biographical note"), - rights=["change_biographicalnote", "change_own_biographicalnote"], + rights=["ishtar_common.change_biographicalnote", + "ishtar_common.change_own_biographicalnote"], ) class Meta: @@ -3367,7 +3302,8 @@ class BiographicalNote(BaseHistorizedItem, ValueGetter, MainItem): return res def set_slug(self): - self.slug = create_slug(self.__class__, self.denomination, max_length=250, pk=self.pk) + self.slug = create_slug(self.__class__, self.denomination, max_length=250, + pk=self.pk) def get_extra_actions(self, request): """ @@ -3375,7 +3311,7 @@ class BiographicalNote(BaseHistorizedItem, ValueGetter, MainItem): """ # url, base_text, icon, extra_text, extra css class, is a quick action, actions = super().get_extra_actions(request) - can_edit = self.can_do(request, "change_biographicalnote") + can_edit = self.can_do(request, "ishtar_common.change_biographicalnote") if not can_edit: return actions actions += [ @@ -3823,11 +3759,54 @@ class IshtarUser(FullSearch): ) return cls.objects.create(user_ptr=user, person=person) - def has_right(self, right_name, session=None): - return self.person.has_right(right_name, session=session) - - def has_perm(self, perm, model=None, session=None, obj=None): - return self.person.has_right(perm, session=session, obj=None) + @property + def is_ishtaradmin(self): + is_ishtaradmin = getattr(self, "_is_ishtaradmin", None) + if is_ishtaradmin is not None: + return is_ishtaradmin + self._is_ishtaradmin = bool( + self.person.profiles.filter( + current=True, profile_type__txt_idx="administrator" + ).exists() + ) + return self._is_ishtaradmin + + def has_permission(self, permission, obj=None): + if permission == "ishtaradmin": + return self.is_ishtaradmin + if "." not in permission: + # TODO: perm delete + print(permission) + raise + if obj: + return self.user_ptr.has_perm(permission, obj) + return self.user_ptr.has_perm(permission) + """ + res = ( + bool( + self.profiles.filter( + current=True, profile_type__txt_idx=permission + ).count() + ) + or bool( + self.profiles.filter( + current=True, + profile_type__groups__permissions__codename=permission, + ).count() + ) + or bool( + self.ishtaruser.user_ptr.groups.filter( + permissions__codename__in=[permission] + ).count() + ) + or bool( + self.ishtaruser.user_ptr.user_permissions.filter( + codename__in=[permission] + ).count() + ) + ) + return res + """ def full_label(self): return self.person.full_label() @@ -4557,7 +4536,7 @@ class Document( icon_class="fa fa-pencil", text=_("Bulk update"), target="many", - rights=["change_document", "change_own_document"], + rights=["ishtar_common.change_document", "ishtar_common.change_own_document"], ) QUICK_ACTIONS = [ QA_EDIT, @@ -4566,14 +4545,14 @@ class Document( icon_class="fa fa-clone", text=_("Duplicate"), target="one", - rights=["change_document", "change_own_document"], + rights=["ishtar_common.change_document", "ishtar_common.change_own_document"], ), QuickAction( url="document-qa-packaging", icon_class="fa fa-gift", text=_("Packaging"), target="many", - rights=["change_document", "change_own_document"], + rights=["ishtar_common.change_document", "ishtar_common.change_own_document"], module="warehouse", ), ] @@ -4937,7 +4916,7 @@ class Document( actions = super(Document, self).get_extra_actions(request) # is_locked = self.is_locked(request.user) - can_edit_document = self.can_do(request, "change_document") + can_edit_document = self.can_do(request, "ishtar_common.change_document") if not can_edit_document: return actions actions += [ @@ -4961,7 +4940,7 @@ class Document( True, ) ) - can_create_document = self.can_do(request, "add_document") + can_create_document = self.can_do(request, "ishtar_common.add_document") if can_create_document: actions += [ ( diff --git a/ishtar_common/models_common.py b/ishtar_common/models_common.py index 6f995569c..4a266af9c 100644 --- a/ishtar_common/models_common.py +++ b/ishtar_common/models_common.py @@ -1182,13 +1182,17 @@ class Imported(models.Model): abstract = True def _get_imports(self, user, key, limit): - if not user.ishtaruser: + ishtaruser = getattr(user, "ishtaruser", None) + if not ishtaruser: return [] q = getattr(self, key) - if user.is_superuser or user.ishtaruser.has_right("view_import"): + if ishtaruser.has_permission("ishtaradmin") or \ + ishtaruser.has_permission("ishtar_common.view_import"): q = q.all() - elif user.ishtaruser.has_right("view_own_import"): - q = q.filter(Q(user=user.ishtaruser) | Q(importer_type__users__pk=user.ishtaruser.pk)) + elif ishtaruser.has_permission("ishtar_common.view_own_import"): + q = q.filter(Q(user=user.ishtaruser) | Q( + importer_type__users__pk=user.ishtaruser.pk) + ) else: return [] q = q.order_by("-id") @@ -1946,7 +1950,8 @@ class DocumentItem: @property def pdf_attached(self): for document in self.documents.filter( - Q(associated_file__isnull=False) | Q(source__associated_file__isnull=False) + Q(associated_file__isnull=False) | + Q(source__associated_file__isnull=False) ).all(): return document.pdf_attached @@ -1967,7 +1972,7 @@ class DocumentItem: print(f"**WARNING** can_do not implemented for {self.__class__}") return actions - can_add_doc = self.can_do(request, "add_document") + can_add_doc = self.can_do(request, "ishtar_common.add_document") if can_add_doc and ( not hasattr(self, "is_locked") or not self.is_locked(request.user) ): @@ -3318,13 +3323,13 @@ class MainItem(ShortMenuItem, SerializeItem, SheetItem): pass @classmethod - def get_quick_actions(cls, user, session=None, obj=None): + def get_quick_actions(cls, user): """ Get a list of (url, title, icon, target) actions for an user """ qas = [] for action in cls.QUICK_ACTIONS: - if not action.is_available(user, session=session, obj=obj): + if not action.is_available(user): continue qas.append( [ @@ -3376,14 +3381,14 @@ class MainItem(ShortMenuItem, SerializeItem, SheetItem): """ Check permission availability for the current object. :param request: request object - :param action_name: action name eg: "change_find" + :param action_name: action name eg: "archaeological_finds.change_find" :return: boolean """ # overload with OwnPerm when _own_ is relevant if not getattr(request.user, "ishtaruser", None): return False user = request.user - return user.ishtaruser.has_right(action_name, request.session) + return user.ishtaruser.has_permission(action_name) def get_extra_actions(self, request): if not hasattr(self, "SLUG"): @@ -3636,7 +3641,9 @@ class Town(GeographicItem, Imported, DocumentItem, MainItem, models.Model): # url, base_text, icon, extra_text, extra css class, is a quick action actions = super().get_extra_actions(request) profile = get_current_profile() - can_add_geo = profile.mapping and self.can_do(request, "add_geovectordata") + can_add_geo = profile.mapping and self.can_do( + request, "ishtar_common.add_geovectordata" + ) if can_add_geo: actions.append(self.get_add_geo_action()) return actions @@ -4168,7 +4175,7 @@ class QuickAction: if self.target not in ("one", "many", None): raise AttributeError("target must be one, many or None") - def is_available(self, user, session=None, obj=None): + def is_available(self, user, obj=None): if self.module and not getattr(get_current_profile(), self.module): return False if not self.rights: # no restriction @@ -4178,7 +4185,7 @@ class QuickAction: user = user.ishtaruser for right in self.rights: - if user.has_perm(right, session=session, obj=obj): + if user.has_permission(right, obj=obj): return True return False diff --git a/ishtar_common/models_imports.py b/ishtar_common/models_imports.py index 5e29b98ed..ddb23e490 100644 --- a/ishtar_common/models_imports.py +++ b/ishtar_common/models_imports.py @@ -1447,25 +1447,28 @@ class BaseImport(models.Model, OwnPerms, SheetItem): abstract = True @classmethod - def get_permissions_for_actions(cls, user, session): + def get_permissions_for_actions(cls, user): if not hasattr(user, "ishtaruser") or not user.ishtaruser: return False, False, False, False - can_edit_all, can_delete_all, can_edit_own, can_delete_own = False, False, False, False - if user.is_superuser: + can_edit_all, can_delete_all = False, False + can_edit_own, can_delete_own = False, False + ishtaruser = user.ishtaruser + if ishtaruser.has_permission("ishtaradmin"): can_edit_all = True can_delete_all = True - if user.ishtaruser.has_right("change_import", session=session): - can_edit_all = True - elif user.ishtaruser.has_right("change_own_import", session=session): - can_edit_own = True - if user.ishtaruser.has_right("delete_import", session=session): - can_delete_all = True - elif user.ishtaruser.has_right("delete_own_import", session=session): - can_delete_own = True + else: + if ishtaruser.has_permission("ishtar_common.change_import"): + can_edit_all = True + elif ishtaruser.has_permission("ishtar_common.change_own_import"): + can_edit_own = True + if ishtaruser.has_permission("ishtar_common.delete_import"): + can_delete_all = True + elif ishtaruser.has_permission("ishtar_common.delete_own_import"): + can_delete_own = True return can_edit_all, can_delete_all, can_edit_own, can_delete_own @classmethod - def query_can_access(cls, user, perm="view_import"): + def query_can_access(cls, user, perm="ishtar_common.view_import"): """ Filter the query to check access permissions :param user: User instance @@ -1474,8 +1477,11 @@ class BaseImport(models.Model, OwnPerms, SheetItem): q = cls.objects if not isinstance(perm, (list, tuple)): perm = [perm] - if user.is_superuser or (hasattr(user, "ishtaruser") and user.ishtaruser and - any(user.ishtaruser.has_right(p) for p in perm)): + ishtaruser = getattr(user, "ishtaruser", None) + if not ishtaruser: + return q.filter(pk__isnull=True) + if ishtaruser.has_permission("ishtaradmin") or ( + any(ishtaruser.has_permission(p) for p in perm)): return q q = q.filter(Q(importer_type__users__pk=user.ishtaruser.pk)) return q diff --git a/ishtar_common/templatetags/window_header.py b/ishtar_common/templatetags/window_header.py index bfcd95883..23d779944 100644 --- a/ishtar_common/templatetags/window_header.py +++ b/ishtar_common/templatetags/window_header.py @@ -19,7 +19,9 @@ def window_nav(context, item, window_id, show_url, modify_url='', histo_url='', extra_actions = [] if hasattr(item, 'get_extra_actions'): try: - extra_actions = item.get_extra_actions(context['request'], context["window_id_underscore"]) + extra_actions = item.get_extra_actions( + context['request'], context["window_id_underscore"] + ) except (KeyError, TypeError): extra_actions = item.get_extra_actions(context['request']) extra_actions = sorted_actions(extra_actions) @@ -27,14 +29,8 @@ def window_nav(context, item, window_id, show_url, modify_url='', histo_url='', if hasattr(item, 'get_extra_templates'): extra_templates = item.get_extra_templates(context['request']) - slug = None - if hasattr(item, "LONG_SLUG"): - slug = item.LONG_SLUG - elif hasattr(item, "SLUG"): - slug = item.SLUG modify_url_value, delete_url = None, None - can_edit = hasattr(item, 'can_do') and slug and \ - item.can_do(context['request'], 'change_' + slug) + can_edit = hasattr(item, 'can_edit') and item.can_edit(context['request']) if can_edit: modify_url_value = modify_url delete_url = getattr(item, "DELETE_URL", False) @@ -81,8 +77,7 @@ def window_file_nav(context, item, window_id, previous=None, nxt=None): revert_url = 'revert-file' add_operation = "" modify_url_value, delete_url = None, None - can_edit = hasattr(item, 'can_do') and \ - item.can_do(context['request'], 'change_file') + can_edit = hasattr(item, 'can_edit') and item.can_edit(context['request']) if can_edit: modify_url_value = modify_url delete_url = getattr(item, "DELETE_URL", False) diff --git a/ishtar_common/urls.py b/ishtar_common/urls.py index a205e3b01..8bb8dd356 100644 --- a/ishtar_common/urls.py +++ b/ishtar_common/urls.py @@ -26,9 +26,9 @@ from django.views.generic import TemplateView from .menus import Menu from ishtar_common import views, models, views_item -from ishtar_common.utils import check_rights, get_urls_for_model +from ishtar_common.utils import check_permissions, get_urls_for_model -# be careful: each check_rights must be relevant with ishtar_menu +# be careful: each check_permissions must be relevant with ishtar_menu # forms urlpatterns = [ @@ -69,72 +69,76 @@ urlpatterns = [ ), url( r"person_search/(?P<step>.+)?$", - check_rights(["add_person"])(views.person_search_wizard), + check_permissions(["ishtar_common.add_person"])(views.person_search_wizard), name="person_search", ), url( r"person_creation/(?P<step>.+)?$", - check_rights(["add_person"])(views.person_creation_wizard), + check_permissions(["ishtar_common.add_person"])(views.person_creation_wizard), name="person_creation", ), url( r"person_modification/(?P<step>.+)?$", - check_rights(["change_person", "change_own_person"])( - views.person_modification_wizard - ), + check_permissions( + ["ishtar_common.change_person", "ishtar_common.change_own_person"] + )(views.person_modification_wizard), name="person_modification", ), url(r"person_modify/(?P<pk>.+)/$", views.person_modify, name="person_modify"), url( r"person_deletion/(?P<step>.+)?$", - check_rights(["change_person", "change_own_person"])( - views.person_deletion_wizard - ), + check_permissions( + ["ishtar_common.change_person", "ishtar_common.change_own_person"] + )(views.person_deletion_wizard), name="person_deletion", ), url(r"person_delete/(?P<pk>.+)/$", views.person_delete, name="person_delete"), url( r"^person-edit/$", - check_rights(["add_person"])(views.PersonCreate.as_view()), + check_permissions(["ishtar_common.add_person"])(views.PersonCreate.as_view()), name="person_create", ), url( r"^person-edit/(?P<pk>\d+)$", - check_rights(["change_person", "change_own_person"])( - views.PersonEdit.as_view() - ), + check_permissions( + ["ishtar_common.change_person", "ishtar_common.change_own_person"] + )(views.PersonEdit.as_view()), name="person_edit", ), url( r"^person-qa-bulk-update/(?P<pks>[0-9-]+)?/$", - check_rights(["change_person", "change_own_person"])( - views.QAPersonForm.as_view() - ), + check_permissions( + ["ishtar_common.change_person", "ishtar_common.change_own_person"] + )(views.QAPersonForm.as_view()), name="person-qa-bulk-update", ), url( r"^person-qa-bulk-update/(?P<pks>[0-9-]+)?/confirm/$", - check_rights(["change_person", "change_own_person"])( - views.QAPersonForm.as_view() - ), + check_permissions( + ["ishtar_common.change_person", "ishtar_common.change_own_person"] + )(views.QAPersonForm.as_view()), name="person-qa-bulk-update-confirm", kwargs={"confirm": True}, ), url( r"organization_search/(?P<step>.+)?$", - check_rights(["add_organization"])(views.organization_search_wizard), + check_permissions( + ["ishtar_common.add_organization"] + )(views.organization_search_wizard), name="organization_search", ), url( r"organization_creation/(?P<step>.+)?$", - check_rights(["add_organization"])(views.organization_creation_wizard), + check_permissions( + ["ishtar_common.add_organization"] + )(views.organization_creation_wizard), name="organization_creation", ), url( r"organization_modification/(?P<step>.+)?$", - check_rights(["change_organization", "change_own_organization"])( - views.organization_modification_wizard - ), + check_permissions( + ["ishtar_common.change_organization", "ishtar_common.change_own_organization"] + )(views.organization_modification_wizard), name="organization_modification", ), url( @@ -144,9 +148,9 @@ urlpatterns = [ ), url( r"organization_deletion/(?P<step>.+)?$", - check_rights(["change_organization", "change_own_organization"])( - views.organization_deletion_wizard - ), + check_permissions( + ["ishtar_common.change_organization", "ishtar_common.change_own_organization"] + )(views.organization_deletion_wizard), name="organization_deletion", ), url( @@ -156,47 +160,54 @@ urlpatterns = [ ), url( r"organization-edit/$", - check_rights(["add_organization"])(views.OrganizationCreate.as_view()), + check_permissions( + ["ishtar_common.add_organization"] + )(views.OrganizationCreate.as_view()), name="organization_create", ), url( r"organization-edit/(?P<pk>\d+)$", - check_rights(["change_organization", "change_own_organization"])( - views.OrganizationEdit.as_view() - ), + check_permissions( + ["ishtar_common.change_organization", + "ishtar_common.change_own_organization"] + )(views.OrganizationEdit.as_view()), name="organization_edit", ), url( r"organization-person-edit/$", - check_rights(["add_organization"])(views.OrganizationPersonCreate.as_view()), + check_permissions( + ["ishtar_common.add_organization"] + )(views.OrganizationPersonCreate.as_view()), name="organization_person_create", ), url( r"organization-person-edit/(?P<pk>\d+)$", - check_rights(["change_organization", "change_own_organization"])( - views.OrganizationPersonEdit.as_view() - ), + check_permissions( + ["ishtar_common.change_organization", "ishtar_common.change_own_organization"] + )(views.OrganizationPersonEdit.as_view()), name="organization_person_edit", ), url( r"^organization-qa-bulk-update/(?P<pks>[0-9-]+)?/$", - check_rights(["change_organization", "change_own_organization"])( - views.QAOrganizationForm.as_view() - ), + check_permissions( + ["ishtar_common.change_organization", "ishtar_common.change_own_organization"] + )(views.QAOrganizationForm.as_view()), name="organization-qa-bulk-update", ), url( r"^organization-qa-bulk-update/(?P<pks>[0-9-]+)?/confirm/$", - check_rights(["change_organization", "change_own_organization"])( - views.QAOrganizationForm.as_view() - ), + check_permissions( + ["ishtar_common.change_organization", "ishtar_common.change_own_organization"] + )(views.QAOrganizationForm.as_view()), name="organization-qa-bulk-update-confirm", kwargs={"confirm": True}, ), url(r"get-ishtaruser/(?P<type>.+)?$", views.get_ishtaruser, name="get-ishtaruser"), url( r"account_management/(?P<step>.+)?$", - check_rights(["add_ishtaruser"])(views.account_management_wizard), + check_permissions( + ["ishtar_common.add_ishtaruser"] + )(views.account_management_wizard), name="account_management", ), url( @@ -206,67 +217,97 @@ urlpatterns = [ ), url( r"account_deletion/(?P<step>.+)?$", - check_rights(["add_ishtaruser"])(views.account_deletion_wizard), + check_permissions( + ["ishtar_common.add_ishtaruser"] + )(views.account_deletion_wizard), name="account_deletion", ), url( r"^import-new/$", - check_rights(["add_import", "add_own_import"])(views.NewImportView.as_view()), + check_permissions( + ["ishtar_common.add_import", "ishtar_common.add_own_import"] + )(views.NewImportView.as_view()), name="new_import", ), url( r"^import-edit/(?P<pk>[0-9]+)/$", - check_rights(["change_import", "change_own_import"])(views.EditImportView.as_view()), + check_permissions( + ["ishtar_common.change_import", "ishtar_common.change_own_import"] + )(views.EditImportView.as_view()), name="edit_import", ), url( r"^import-new-gis/$", - check_rights(["add_import", "add_own_import"])(views.NewImportGISView.as_view()), + check_permissions( + ["ishtar_common.add_import", "ishtar_common.add_own_import"] + )(views.NewImportGISView.as_view()), name="new_import_gis", ), url( r"^import-new-group/$", - check_rights(["add_import", "add_own_import"])(views.NewImportGroupView.as_view()), + check_permissions( + ["ishtar_common.add_import", "ishtar_common.add_own_import"] + )(views.NewImportGroupView.as_view()), name="new_import_group", ), url( r"^import-list/$", - check_rights(["view_import", "change_import", "change_own_import"])(views.ImportListView.as_view()), + check_permissions( + ["ishtar_common.view_import", "ishtar_common.change_import", + "ishtar_common.change_own_import"] + )(views.ImportListView.as_view()), name="current_imports", ), url( r"^import-list-table/$", - check_rights(["view_import", "change_import", "change_own_import"])(views.ImportListTableView.as_view()), + check_permissions( + ["ishtar_common.view_import", "ishtar_common.change_import", + "ishtar_common.change_own_import"] + )(views.ImportListTableView.as_view()), name="current_imports_table", ), url( r"^import-get-status/$", - check_rights(["view_import", "change_import", "change_own_import"])(views.import_get_status), - name="import_get_status", + check_permissions( + ["ishtar_common.view_import", "ishtar_common.change_import", + "ishtar_common.change_own_import"] + )(views.import_get_status), + name="import_get_status", ), url( r"^import-list-old/$", - check_rights(["view_import", "change_import", "change_own_import"])(views.ImportOldListView.as_view()), + check_permissions( + ["ishtar_common.view_import", "ishtar_common.change_import", + "ishtar_common.change_own_import"] + )(views.ImportOldListView.as_view()), name="old_imports", ), url( r"^import-delete/(?P<pk>[0-9]+)/$", - check_rights(["delete_import", "delete_own_import"])(views.ImportDeleteView.as_view()), + check_permissions( + ["ishtar_common.delete_import", "ishtar_common.delete_own_import"] + )(views.ImportDeleteView.as_view()), name="import_delete", ), url( r"^import-group-delete/(?P<pk>[0-9]+)/$", - check_rights(["delete_import", "delete_own_import"])(views.ImportGroupDeleteView.as_view()), + check_permissions( + ["ishtar_common.delete_import", "ishtar_common.delete_own_import"] + )(views.ImportGroupDeleteView.as_view()), name="import_group_delete", ), url( r"^import-link-unmatched/(?P<pk>[0-9]+)/$", - check_rights(["change_import", "change_own_import"])(views.ImportMatchView.as_view()), + check_permissions( + ["ishtar_common.change_import", "ishtar_common.change_own_import"] + )(views.ImportMatchView.as_view()), name="import_link_unmatched", ), url( r"^import-csv-view/(?P<target>source|result|match|error)/(?P<group>group\-)?(?P<pk>[0-9]+)/$", - check_rights(["view_import", "view_own_import"])(views.ImportCSVView.as_view()), + check_permissions( + ["ishtar_common.view_import", "ishtar_common.view_own_import"] + )(views.ImportCSVView.as_view()), name="import_display_csv", ), url( @@ -282,12 +323,16 @@ urlpatterns = [ ), url( r"^import-pre-form/(?P<import_id>[0-9]+)/$", - check_rights(["change_import", "change_own_import"])(views.ImportPreFormView.as_view()), + check_permissions( + ["ishtar_common.change_import", "ishtar_common.change_own_import"] + )(views.ImportPreFormView.as_view()), name="import_pre_import_form", ), url( r"^import-ignore-line/(?P<line_id>[0-9]+)/$", - check_rights(["change_import", "change_own_import"])(views.line_error), + check_permissions( + ["ishtar_common.change_import", "ishtar_common.change_own_import"] + )(views.line_error), name="import_ignore_line", ), url(r"^profile(?:/(?P<pk>[0-9]+))?/$", views.ProfileEdit.as_view(), name="profile"), @@ -417,9 +462,10 @@ urlpatterns += [ ), url( r"^biographicalnote-qa-edit/(?P<pks>[0-9-]+)?/$", - check_rights(["change_biographicalnote", "change_own_biographicalnote"])( - views.QABiographicalNoteForm.as_view() - ), + check_permissions( + ["ishtar_common.change_biographicalnote", + "ishtar_common.change_own_biographicalnote"] + )(views.QABiographicalNoteForm.as_view()), name="biographicalnote-qa-edit", ), url( @@ -551,44 +597,44 @@ urlpatterns += [ ), url( r"document/search/(?P<step>.+)?$", - check_rights(["view_document", "view_own_document"])( - views.document_search_wizard - ), + check_permissions( + ["ishtar_common.view_document", "ishtar_common.view_own_document"] + )(views.document_search_wizard), name="search-document", ), url( r"document/search/(?P<step>.+)?$", - check_rights(["view_document", "view_own_document"])( - views.document_search_wizard - ), + check_permissions( + ["ishtar_common.view_document", "ishtar_common.view_own_document"] + )(views.document_search_wizard), name="document_search", ), url( r"document/create/$", - check_rights(["add_document", "add_own_document"])( - views.DocumentCreateView.as_view() - ), + check_permissions( + ["ishtar_common.add_document", "ishtar_common.add_own_document"] + )(views.DocumentCreateView.as_view()), name="create-document", ), url( r"document/edit/$", - check_rights(["change_document", "change_own_document"])( - views.DocumentSelectView.as_view() - ), + check_permissions( + ["ishtar_common.change_document", "ishtar_common.change_own_document"] + )(views.DocumentSelectView.as_view()), name="edit-document", ), url( r"document/edit/(?P<pk>.+)/$", - check_rights(["change_document", "change_own_document"])( - views.DocumentEditView.as_view() - ), + check_permissions( + ["ishtar_common.change_document", "ishtar_common.change_own_document"] + )(views.DocumentEditView.as_view()), name="edit-document", ), url( r"document/delete/(?P<step>.+)?$", - check_rights(["change_document", "change_own_document"])( - views.document_deletion_wizard - ), + check_permissions( + ["ishtar_common.change_document", "ishtar_common.change_own_document"] + )(views.document_deletion_wizard), name="document_deletion", ), url( @@ -603,31 +649,31 @@ urlpatterns += [ ), url( r"^document-qa-bulk-update/(?P<pks>[0-9-]+)?/$", - check_rights(["change_document", "change_own_document"])( - views.QADocumentForm.as_view() - ), + check_permissions( + ["ishtar_common.change_document", "ishtar_common.change_own_document"] + )(views.QADocumentForm.as_view()), name="document-qa-bulk-update", ), url( r"^document-qa-bulk-update/(?P<pks>[0-9-]+)?/confirm/$", - check_rights(["change_document", "change_own_document"])( - views.QADocumentForm.as_view() - ), + check_permissions( + ["ishtar_common.change_document", "ishtar_common.change_own_document"] + )(views.QADocumentForm.as_view()), name="document-qa-bulk-update-confirm", kwargs={"confirm": True}, ), url( r"^document-qa-duplicate/(?P<pks>[0-9-]+)?/$", - check_rights(["change_document", "change_own_document"])( - views.QADocumentDuplicateFormView.as_view() - ), + check_permissions( + ["ishtar_common.change_document", "ishtar_common.change_own_document"] + )(views.QADocumentDuplicateFormView.as_view()), name="document-qa-duplicate", ), url( r"^document-qa-packaging/(?P<pks>[0-9-]+)?/$", - check_rights(["change_document", "change_own_document"])( - views.QADocumentPackagingFormView.as_view() - ), + check_permissions( + ["ishtar_common.change_document", "ishtar_common.change_own_document"] + )(views.QADocumentPackagingFormView.as_view()), name="document-qa-packaging", ), url( @@ -642,30 +688,32 @@ urlpatterns += [ ), url( r"geo/create/(?P<app_source>[-\w]+)/(?P<model_source>[-\w]+)/(?P<source_pk>\d+)/$", - check_rights(["add_geovectordata", "add_own_geovectordata"])( - views.GeoPreCreateView.as_view() - ), + check_permissions( + ["ishtar_common.add_geovectordata", "ishtar_common.add_own_geovectordata"] + )(views.GeoPreCreateView.as_view()), name="create-pre-geo", ), url( r"geo/create/(?P<app_source>[-\w]+)/(?P<model_source>[-\w]+)/(?P<source_pk>\d+)/(?P<geom_type>[-\w]+)/$", - check_rights(["add_geovectordata", "add_own_geovectordata"])( - views.GeoCreateView.as_view() - ), + check_permissions( + ["ishtar_common.add_geovectordata", "ishtar_common.add_own_geovectordata"] + )(views.GeoCreateView.as_view()), name="create-geo", ), url( r"geo/edit/(?P<pk>\d+)/$", - check_rights(["change_geovectordata", "change_own_geovectordata"])( - views.GeoEditView.as_view() - ), + check_permissions( + ["ishtar_common.change_geovectordata", + "ishtar_common.change_own_geovectordata"] + )(views.GeoEditView.as_view()), name="edit-geo", ), url( r"geo/delete/(?P<pk>\d+)/$", - check_rights(["change_geovectordata", "change_own_geovectordata"])( - views.GeoDeleteView.as_view() - ), + check_permissions( + ["ishtar_common.change_geovectordata", + "ishtar_common.change_own_geovectordata"] + )(views.GeoDeleteView.as_view()), name="delete-geo", ), url( diff --git a/ishtar_common/utils.py b/ishtar_common/utils.py index 09e83714b..8de745874 100644 --- a/ishtar_common/utils.py +++ b/ishtar_common/utils.py @@ -21,8 +21,9 @@ from csv import QUOTE_ALL import datetime import feedparser from functools import wraps +from guardian.exceptions import WrongAppError from itertools import chain -from inspect import currentframe, getframeinfo +from inspect import currentframe import json import logging import hashlib @@ -225,24 +226,25 @@ def import_class(full_path_classname): return model -def check_rights(rights=None, redirect_url="/"): +def check_permissions(permissions=None, redirect_url="/"): """ Decorator that checks the rights to access the view. """ def decorator(view_func): def _wrapped_view(request, *args, **kwargs): - if not rights: + if not permissions: return view_func(request, *args, **kwargs) if hasattr(request.user, "ishtaruser"): - if request.user.ishtaruser.has_right("administrator", request.session): + ishtaruser = request.user.ishtaruser + if ishtaruser.has_permission("ishtaradmin"): kwargs["current_right"] = "administrator" return view_func(request, *args, **kwargs) - for right in rights: + for permission in permissions: # be careful to put the more permissive rights first # if granted it can allow more - if request.user.ishtaruser.has_right(right, request.session): - kwargs["current_right"] = right + if ishtaruser.has_permission(permission): + kwargs["current_right"] = permission return view_func(request, *args, **kwargs) put_session_message( request.session.session_key, @@ -256,17 +258,18 @@ def check_rights(rights=None, redirect_url="/"): return decorator -def check_rights_condition(rights): +def check_permissions_condition(permissions): """ To be used to check in wizard condition_dict """ def func(self): request = self.request - if request.user.ishtaruser.has_right("administrator", request.session): + ishtaruser = request.user.ishtaruser + if ishtaruser.has_permission("ishtaradmin"): return True - for right in rights: - if request.user.ishtaruser.has_right(right, request.session): + for permission in permissions: + if ishtaruser.has_permission(permission): return True return False @@ -297,7 +300,7 @@ def check_model_access_control(request, model, available_perms=None): ishtaruser = request.user.ishtaruser except request.user._meta.model.ishtaruser.RelatedObjectDoesNotExist: return False, True - if ishtaruser.has_right("administrator", session=request.session): + if ishtaruser.has_permission("ishtaradmin"): allowed = True own = False return allowed, own @@ -305,10 +308,10 @@ def check_model_access_control(request, model, available_perms=None): content_type__app_label=model._meta.app_label, content_type__model=model._meta.model_name ) - for perm in q.values_list("codename", flat=True): + for app_name, perm in q.values_list("content_type__app_label", "codename"): if perm not in available_perms: continue - if ishtaruser.person.has_right(perm, session=request.session): + if ishtaruser.has_permission(f"{app_name}.{perm}"): allowed = True if "_own_" not in perm: own = False @@ -343,48 +346,56 @@ class OwnPerms: return None # implement for each object def can_view(self, request): - if hasattr(self, "LONG_SLUG"): - perm = "view_" + self.LONG_SLUG - else: - perm = "view_" + self.SLUG + meta = self.__class__._meta + perm = f"{meta.app_label}.view_{meta.model_name}" return self.can_do(request, perm) def can_edit(self, request): if not getattr(request.user, "ishtaruser", None): return False ishtaruser = request.user.ishtaruser - slug = self.LONG_SLUG if hasattr(self, "LONG_SLUG") else self.SLUG - if ishtaruser.has_perm("change_" + slug, session=request.session): + meta = self.__class__._meta + perm = f"{meta.app_label}.change_{meta.model_name}" + if ishtaruser.has_permission(perm): return True - if not ishtaruser.has_perm("change_own_" + slug, session=request.session): + own_perm = f"{meta.app_label}.change_own_{meta.model_name}" + if not ishtaruser.has_permission(own_perm): return False return self.is_own(ishtaruser) - def can_do(self, request, action_name): + def can_do(self, request, permission): """ Check permission availability for the current object. :param request: request object - :param action_name: action name eg: "change_find" - "own" variation is - checked + :param permission: action name eg: "archaelogical_finds.change_find" - "own" + variation is checked :return: boolean """ if not getattr(request.user, "ishtaruser", None): return False - splited = action_name.split("_") - action_own_name = splited[0] + "_own_" + "_".join(splited[1:]) - user = request.user - if action_name == "view_findbasket": - action_own_name = "view_own_find" - action_name = "view_find" - return user.ishtaruser.has_right(action_name, request.session) or ( - user.ishtaruser.has_right(action_own_name, request.session) - and self.is_own(user.ishtaruser) - ) + + if "_findbasket" in permission: + permission = permission.replace("basket", "") + ishtaruser = request.user.ishtaruser + + if ishtaruser.has_permission(permission): + return True + app, perm = permission.split(".") + p = perm.split("_") + own = f"{app}.{p[0]}_own_{('_').join(p[1:])}" + try: + return ishtaruser.has_permission(own, self) + except WrongAppError: + # normaly occurs when, for instance, add doc permission is required + # for an item with document attached but the item is not a document. + # own permission is irrelevant: return False + return False def is_own(self, user, alt_query_own=None): """ Check if the current object is owned by the user """ + print("ishtar_common/utils.py - 370 - DELETE") IshtarUser = apps.get_model("ishtar_common", "IshtarUser") if isinstance(user, IshtarUser): ishtaruser = user @@ -406,6 +417,7 @@ class OwnPerms: """ Check if the user own some items """ + print("ishtar_common/utils.py - 392 - DELETE") IshtarUser = apps.get_model("ishtar_common", "IshtarUser") if isinstance(user, IshtarUser): ishtaruser = user @@ -1139,9 +1151,7 @@ def get_random_item_image_link(request): return "" ishtar_user = request.user.ishtaruser - if not ishtar_user.has_right( - "ishtar_common.view_document", session=request.session - ): + if not ishtar_user.has_permission("ishtar_common.view_document"): return "" q = ( @@ -1945,17 +1955,23 @@ def get_urls_for_model( """ Generate get and show url for a model """ + app_label = model._meta.app_label + model_name = model._meta.model_name urls = [ url( r"show-{}(?:/(?P<pk>.+))?/(?P<type>.+)?$".format(model.SLUG), - check_rights(["view_" + model.SLUG, "view_own_" + model.SLUG])( + check_permissions( + [f"{app_label}.view_{model_name}", + f"{app_label}.view_own_{model_name}"])( getattr(views, "show_" + model.SLUG) ), name="show-" + model.SLUG, ), url( r"^display-{}/(?P<pk>.+)/$".format(model.SLUG), - check_rights(["view_" + model.SLUG, "view_own_" + model.SLUG])( + check_permissions( + [f"{app_label}.view_{model_name}", + f"{app_label}.view_own_{model_name}"])( getattr(views, "display_" + model.SLUG) ), name="display-" + model.SLUG, @@ -1965,7 +1981,9 @@ def get_urls_for_model( urls += [ url( r"get-{}/own/(?P<type>.+)?$".format(model.SLUG), - check_rights(["view_" + model.SLUG, "view_own_" + model.SLUG])( + check_permissions( + [f"{app_label}.view_{model_name}", + f"{app_label}.view_own_{model_name}"])( getattr(views, "get_" + model.SLUG) ), name="get-own-" + model.SLUG, @@ -1976,7 +1994,9 @@ def get_urls_for_model( urls += [ url( r"get-{}/(?P<type>.+)?$".format(model.SLUG), - check_rights(["view_" + model.SLUG, "view_own_" + model.SLUG])( + check_permissions( + [f"{app_label}.view_{model_name}", + f"{app_label}.view_own_{model_name}"])( getattr(views, "get_" + model.SLUG) ), name="get-" + model.SLUG, @@ -1987,7 +2007,9 @@ def get_urls_for_model( urls += [ url( r"autocomplete-{}/$".format(model.SLUG), - check_rights(["view_" + model.SLUG, "view_own_" + model.SLUG])( + check_permissions( + [f"{app_label}.view_{model_name}", + f"{app_label}.view_own_{model_name}"])( getattr(views, "autocomplete_" + model.SLUG) ), name="autocomplete-" + model.SLUG, diff --git a/ishtar_common/views.py b/ishtar_common/views.py index 780a2253b..6c209a848 100644 --- a/ishtar_common/views.py +++ b/ishtar_common/views.py @@ -863,7 +863,10 @@ def autocomplete_person_permissive( def autocomplete_user(request): - if not request.user.has_perm("ishtar_common.view_person", models.Person): + ishtaruser = getattr(request.user, "ishtaruser", None) + if not ishtaruser: + return HttpResponse("[]", content_type="text/plain") + if not ishtaruser.has_permission("ishtar_common.view_person"): return HttpResponse("[]", content_type="text/plain") q = request.GET.get("term") limit = request.GET.get("limit", 20) @@ -893,7 +896,10 @@ def autocomplete_user(request): def autocomplete_ishtaruser(request): - if not request.user.has_perm("ishtar_common.view_person", models.Person): + ishtaruser = getattr(request.user, "ishtaruser", None) + if not ishtaruser: + return HttpResponse("[]", content_type="text/plain") + if not ishtaruser.has_permission("ishtar_common.view_person"): return HttpResponse("[]", content_type="text/plain") q = request.GET.get("term", "") limit = request.GET.get("limit", 20) @@ -917,12 +923,13 @@ def autocomplete_ishtaruser(request): def autocomplete_person( request, person_types=None, attached_to=None, is_ishtar_user=None, permissive=False ): - all_items = request.user.has_perm("ishtar_common.view_person", models.Person) + ishtaruser = getattr(request.user, "ishtaruser", None) + if not ishtaruser: + return HttpResponse("[]", content_type="text/plain") + all_items = ishtaruser.has_permission("ishtar_common.view_person") own_items = False if not all_items: - own_items = request.user.has_perm( - "ishtar_common.view_own_person", models.Person - ) + own_items = ishtaruser.has_permission("ishtar_common.view_own_person") if not all_items and not own_items or not request.GET.get("term"): return HttpResponse("[]", content_type="text/plain") q = request.GET.get("term") @@ -966,12 +973,13 @@ def autocomplete_person( def autocomplete_import(request): - all_items = request.user.has_perm("ishtar_common.view_import", models.Import) + ishtaruser = getattr(request.user, "ishtaruser", None) + if not ishtaruser: + return HttpResponse("[]", content_type="text/plain") + all_items = ishtaruser.has_permission("ishtar_common.view_import") own_items = False if not all_items: - own_items = request.user.has_perm( - "ishtar_common.view_own_import", models.Import - ) + own_items = ishtaruser.has_permission("ishtar_common.view_own_import") if not all_items and not own_items or not request.GET.get("term"): return HttpResponse("[]", content_type="text/plain") q = request.GET.get("term") @@ -982,7 +990,8 @@ def autocomplete_import(request): return HttpResponseBadRequest() query = Q() for q in q.split(" "): - query = query & (Q(name__unaccent__icontains=q) | Q(group__name__unaccent__icontains=q)) + query = query & (Q(name__unaccent__icontains=q) | + Q(group__name__unaccent__icontains=q)) if own_items: if not hasattr(request.user, "ishtaruser"): return HttpResponse(json.dumps([]), content_type="text/plain") @@ -1116,16 +1125,12 @@ def department_by_state(request, state_id=""): def autocomplete_organization(request, orga_type=None): + ishtaruser = getattr(request.user, "ishtaruser", None) + if not ishtaruser: + return HttpResponse("[]", content_type="text/plain") if ( - not request.user.has_perm( - "ishtar_common.view_organization", models.Organization - ) - and not request.user.has_perm( - "ishtar_common.view_own_organization", models.Organization - ) - and not request.user.ishtaruser.has_right( - "person_search", session=request.session - ) + not ishtaruser.has_permission("ishtar_common.view_organization") + and not ishtaruser.has_permission("ishtar_common.view_own_organization") ): return HttpResponse("[]", content_type="text/plain") if not request.GET.get("term"): @@ -1149,9 +1154,13 @@ def autocomplete_organization(request, orga_type=None): def autocomplete_author(request): - if not request.user.has_perm( - "ishtar_common.view_author", models.Author - ) and not request.user.has_perm("ishtar_common.view_own_author", models.Author): + ishtaruser = getattr(request.user, "ishtaruser", None) + if not ishtaruser: + return HttpResponse("[]", content_type="text/plain") + if not ishtaruser.has_permission( + "ishtar_common.view_author" + ) and not ishtaruser.has_permission( + "ishtar_common.view_own_author"): return HttpResponse("[]", content_type="text/plain") if not request.GET.get("term"): return HttpResponse("[]", content_type="text/plain") @@ -1172,7 +1181,10 @@ def autocomplete_author(request): def autocomplete_biographical_note(request): - if not request.user.has_perm("ishtar_common.view_person", models.Person): + ishtaruser = getattr(request.user, "ishtaruser", None) + if not ishtaruser: + return HttpResponse("[]", content_type="text/plain") + if not ishtaruser.has_permission("ishtar_common.view_person"): return HttpResponse("[]", content_type="text/plain") q = request.GET.get("term", "") limit = request.GET.get("limit", 20) @@ -1637,18 +1649,20 @@ class NewImportView(BaseImportView, CreateView): class ImportPermissionMixin: - permission_full = "change_import" - permission_own = "change_own_import" + permission_full = "ishtar_common.change_import" + permission_own = "ishtar_common.change_own_import" def dispatch(self, request, *args, **kwargs): import_pk = self.kwargs["pk"] user = request.user if not user or not user.ishtaruser: return redirect("/") + ishtaruser = user.ishtaruser model = models.ImportGroup if self.kwargs.get("group", None) else models.Import q = model.query_can_access(user, perm=self.permission_full).filter(pk=import_pk) - if not user.is_superuser and not user.ishtaruser.has_right(self.permission_full): - if not user.ishtaruser.has_right(self.permission_own): + if not ishtaruser.has_permission("ishtaradmin") and \ + not ishtaruser.has_permission(self.permission_full): + if not ishtaruser.has_permission(self.permission_own): return redirect("/") q = q.filter(Q(importer_type__users__pk=user.ishtaruser.pk)) if not q.count(): @@ -1711,7 +1725,8 @@ class ImportPreFormView(IshtarMixin, LoginRequiredMixin, FormView): return HttpResponseRedirect(self.get_success_url()) -def get_permissions_for_actions(user, imprt, owns, can_edit_all, can_delete_all, can_edit_own, can_delete_own): +def get_permissions_for_actions( + user, imprt, owns, can_edit_all, can_delete_all, can_edit_own, can_delete_own): can_edit, can_delete = False, False is_own = None if can_edit_own or can_delete_own: # need to check owner @@ -1741,21 +1756,38 @@ class ImportListView(IshtarMixin, LoginRequiredMixin, ListView): user = self.request.user if not user.pk or not user.ishtaruser: raise Http404() - q1 = self._queryset_filter(self.model.query_can_access(user, ["view_import", "change_import"])) + q1 = self._queryset_filter( + self.model.query_can_access( + user, + ["ishtar_common.view_import", "ishtar_common.change_import"] + ) + ) q1 = q1.filter(group__isnull=True).order_by("-end_date", "-creation_date", "-pk") - q2 = self._queryset_filter(models.ImportGroup.query_can_access(user, ["view_import", "change_import"])) - q2 = q2.order_by("-end_date", "-creation_date", "-pk") - values = list(reversed(sorted(list(q1) + list(q2), key=lambda x: (x.end_date or x.creation_date)))) - can_edit_all, can_delete_all, can_edit_own, can_delete_own = models.Import.get_permissions_for_actions( - user, self.request.session + q2 = self._queryset_filter( + models.ImportGroup.query_can_access( + user, + ["ishtar_common.view_import", "ishtar_common.change_import"] + ) ) + q2 = q2.order_by("-end_date", "-creation_date", "-pk") + values = list(reversed( + sorted( + list(q1) + list(q2), + key=lambda x: (x.end_date or x.creation_date) + ) + )) + can_edit_all, can_delete_all, can_edit_own, can_delete_own = \ + models.Import.get_permissions_for_actions(user) imports = [] owns = {} for imprt in values: can_edit, can_delete = get_permissions_for_actions( - user, imprt, owns, can_edit_all, can_delete_all, can_edit_own, can_delete_own + user, imprt, owns, can_edit_all, + can_delete_all, can_edit_own, can_delete_own + ) + imprt.action_list = imprt.get_actions( + can_edit=can_edit, can_delete=can_delete ) - imprt.action_list = imprt.get_actions(can_edit=can_edit, can_delete=can_delete) imports.append(imprt) self.imports_len = len(imports) self.current_page = 0 @@ -1768,9 +1800,8 @@ class ImportListView(IshtarMixin, LoginRequiredMixin, ListView): return imports def post(self, request, *args, **kwargs): - can_edit_all, can_delete_all, can_edit_own, can_delete_own = models.Import.get_permissions_for_actions( - request.user, request.session - ) + can_edit_all, can_delete_all, can_edit_own, can_delete_own = \ + models.Import.get_permissions_for_actions(request.user) owns = {} for field in request.POST: if not field.startswith("import-action-") or not request.POST[field]: @@ -1785,7 +1816,8 @@ class ImportListView(IshtarMixin, LoginRequiredMixin, ListView): except (models.Import.DoesNotExist, ValueError): continue can_edit, can_delete = get_permissions_for_actions( - request.user, imprt, owns, can_edit_all, can_delete_all, can_edit_own, can_delete_own + request.user, imprt, owns, can_edit_all, + can_delete_all, can_edit_own, can_delete_own ) action = request.POST[field] if can_delete and action == "D": @@ -1843,15 +1875,28 @@ class ImportListView(IshtarMixin, LoginRequiredMixin, ListView): if self.imports_len > self.page_step and self.pagination: dct["current_page"] = self.current_page dct["page_range"] = (n + 1 for n in range(self.page_number)) - add_import_perm = self.request.user.ishtaruser.has_right("add_import", session=self.request.session) - import_type_table = models.ImporterType.objects.filter(available=True, is_import=True, type='tab') - import_type_gis = models.ImporterType.objects.filter(available=True, is_import=True, type='gis') + add_import_perm = self.request.user.ishtaruser.has_permission( + "ishtar_common.add_import" + ) + import_type_table = models.ImporterType.objects.filter( + available=True, is_import=True, type='tab' + ) + import_type_gis = models.ImporterType.objects.filter( + available=True, is_import=True, type='gis' + ) import_type_group = models.ImporterGroup.objects.filter(available=True) - if not add_import_perm and self.request.user.ishtaruser.has_right("add_own_import", - session=self.request.session): - import_type_table = import_type_table.filter(users__pk=self.request.user.ishtaruser.pk) - import_type_gis = import_type_gis.filter(users__pk=self.request.user.ishtaruser.pk) - import_type_group = import_type_group.filter(users__pk=self.request.user.ishtaruser.pk) + ishtaruser = self.request.user.ishtaruser + if not add_import_perm and ishtaruser.has_permission( + "ishtar_common.add_own_import"): + import_type_table = import_type_table.filter( + users__pk=self.request.user.ishtaruser.pk + ) + import_type_gis = import_type_gis.filter( + users__pk=self.request.user.ishtaruser.pk + ) + import_type_group = import_type_group.filter( + users__pk=self.request.user.ishtaruser.pk + ) add_import_perm = True has_import_table, has_import_gis, has_import_group = False, False, False if add_import_perm: @@ -2313,11 +2358,11 @@ def import_get_status(request, current_right=None): "number_of_line": item.number_of_line, "progress_percent": item.progress_percent, }) - can_edit_all, can_delete_all, can_edit_own, can_delete_own = models.Import.get_permissions_for_actions( - request.user, request.session - ) + can_edit_all, can_delete_all, can_edit_own, can_delete_own = \ + models.Import.get_permissions_for_actions(request.user) can_edit, can_delete = get_permissions_for_actions( - request.user, item, {}, can_edit_all, can_delete_all, can_edit_own, can_delete_own + request.user, item, {}, can_edit_all, + can_delete_all, can_edit_own, can_delete_own ) item_dct["actions"] = [ (key, str(lbl)) @@ -2404,11 +2449,11 @@ class ImportCSVView(ImportPermissionMixin, IshtarMixin, LoginRequiredMixin, Temp TITLES = { "source": ("fa fa-file-text-o", _("Source")), "error": ("text-danger fa fa-exclamation-triangle", _("Error")), - "result": ("fa fa-th", _("Result")) , + "result": ("fa fa-th", _("Result")), "match": ("fa fa-arrows-h", _("Match")), } - permission_full = "view_import" - permission_own = "view_own_import" + permission_full = "ishtar_common.view_import" + permission_own = "ishtar_common.view_own_import" def get(self, request, *args, **kwargs): user = self.request.user @@ -2416,7 +2461,9 @@ class ImportCSVView(ImportPermissionMixin, IshtarMixin, LoginRequiredMixin, Temp raise Http404() self.is_group = kwargs.get("group", None) model = models.ImportGroup if self.is_group else models.Import - q = model.query_can_access(self.request.user, perm=self.permission_full).filter(pk=kwargs.get("pk", -1)) + q = model.query_can_access( + self.request.user, perm=self.permission_full + ).filter(pk=kwargs.get("pk", -1)) if not q.count(): raise Http404() self.import_item = q.all()[0] @@ -2491,7 +2538,9 @@ def line_error(request, line_id, current_right=None): if not q.count(): return line = q.all()[0] - q = models.Import.query_can_access(request.user, perm="change_import").filter(pk=line.import_item_id) + q = models.Import.query_can_access( + request.user, perm="ishtar_common.change_import" + ).filter(pk=line.import_item_id) if not q.count(): raise Http404() line.ignored = not line.ignored @@ -2853,7 +2902,12 @@ def get_bookmark(request, pk): def gen_generate_doc(model): def func(request, pk, template_pk=None): - if not request.user.has_perm("view_" + model.SLUG, model): + ishtaruser = getattr(request.user, "ishtaruser", None) + if not ishtaruser: + return HttpResponse(content_type="text/plain") + meta = model._meta + perm = f"{meta.app_label}.view_{meta.model_name}" + if not ishtaruser.has_permission(perm): return HttpResponse(content_type="text/plain") try: item = model.objects.get(pk=pk) @@ -3075,10 +3129,10 @@ class QAItemForm(IshtarMixin, LoginRequiredMixin, FormView): quick_action = self.get_quick_action() if not quick_action: raise Http404() - if not quick_action.is_available(user=request.user, session=request.session): + if not quick_action.is_available(user=request.user): for item in self.items: if not quick_action.is_available( - user=request.user, session=request.session, obj=item + user=request.user, obj=item ): raise Http404() @@ -3431,13 +3485,15 @@ class GeoCreateView(GeoFormMixin, CreateView): obj = model.objects.get(pk=self.kwargs.get("source_pk")) except model.DoesNotExist: raise Http404() - if not ishtaruser.has_perm("add_geovectordata"): # -> add_own_geovectordata + if not ishtaruser.has_permission( + "ishtar_common.add_geovectordata"): + # -> add_own_geovectordata # check permission to view attached item - if not getattr(model, "SLUG", None): - raise Http404() - if not ishtaruser.has_right(f"view_{model.SLUG}") \ - or not ishtaruser.has_right(f"view_own_{model.SLUG}") \ - or not obj.is_own(ishtaruser): + meta = model._meta + perm = f"{meta.app_label}.view_{meta.model_name}" + perm_own = f"{meta.app_label}.view_own_{meta.model_name}" + if not ishtaruser.has_permission(perm) \ + and not ishtaruser.has_permission(perm_own, obj=obj): # check permission to view own attached item raise Http404() kwargs["main_items_fields"] = {} diff --git a/ishtar_common/views_item.py b/ishtar_common/views_item.py index 48d8e229b..a88cb48b3 100644 --- a/ishtar_common/views_item.py +++ b/ishtar_common/views_item.py @@ -222,11 +222,9 @@ def check_permission(request, action_slug, obj_id=None): return True if obj_id: return main_menu.items[action_slug].is_available( - request.user, obj_id, session=request.session + request.user, obj_id ) - return main_menu.items[action_slug].can_be_available( - request.user, session=request.session - ) + return main_menu.items[action_slug].can_be_available(request.user) def new_qa_item( diff --git a/ishtar_common/wizards.py b/ishtar_common/wizards.py index 43e84fbcb..e41c4c811 100644 --- a/ishtar_common/wizards.py +++ b/ishtar_common/wizards.py @@ -55,25 +55,6 @@ from ishtar_common.utils import get_all_field_names, get_person_gdpr_log, MultiV logger = logging.getLogger(__name__) -# buggy and unecessary at least for the moment... -""" -def _check_right(step, condition=True): - '''Return a method to check the right for a specific step''' - def check_right(self): - cond = condition - if callable(condition): - cond = condition(self) - if not cond: - return False - return True - # TODO: to be check - if not hasattr(self.request.user, 'ishtaruser'): - return False - return self.request.user.ishtaruser.has_right( - ('administrator', step), session=self.request.session) - return check_right -""" - def filter_no_fields_form(form, other_check=None): def func(self): |