Python model.Group类代码示例

    def grant_owner(self, group_id=None, id=None, **kw):

        if group_id is not None and id is not None:
            group = Group.by_id(group_id)
            user = User.by_id(id)
            service = 'WEBUI'
        else:
            group = Group.by_name(kw['group_name'])
            user = User.by_user_name(kw['member_name'])
            service = 'XMLRPC'

        if group.ldap:
            raise GroupOwnerModificationForbidden('An LDAP group does not have an owner')

        if not group.can_edit(identity.current.user):
            raise GroupOwnerModificationForbidden('You are not an owner of the group %s' % group)

        if user not in group.users:
            raise GroupOwnerModificationForbidden('User is not a group member')
        else:
            for assoc in group.user_group_assocs:
                if assoc.user == user:
                    if not assoc.is_owner:
                        assoc.is_owner = True
                        group.record_activity(user=identity.current.user, service=service,
                                              field=u'Owner', action='Added',
                                              old=u'', new=user.user_name)
                        return ''

    def setUp(self):
        self.selenium = self.get_selenium()
        self.password = 'password'

        # create users
        self.user_1 = data_setup.create_user(password=self.password)
        self.user_2 = data_setup.create_user(password=self.password)
        self.user_3 = data_setup.create_user(password=self.password)

        # create admin users
        self.admin_1 = data_setup.create_user(password=self.password)
        self.admin_1.groups.append(Group.by_name(u'admin'))
        self.admin_2 = data_setup.create_user(password=self.password)
        self.admin_2.groups.append(Group.by_name(u'admin'))

        # create systems
        self.system_1 = data_setup.create_system(shared=True)
        self.system_2 = data_setup.create_system(shared=True)
        self.system_3 = data_setup.create_system(shared=False,
                                                 owner=self.user_3)

        # create group and add users/systems to it
        self.group_1 = data_setup.create_group()
        self.user_3.groups.append(self.group_1)
        self.admin_2.groups.append(self.group_1)
        self.system_2.groups.append(self.group_1)

        lc = data_setup.create_labcontroller()
        self.system_1.lab_controller = lc
        self.system_2.lab_controller = lc
        self.system_3.lab_controller = lc

        self.selenium.start()

    def save_group_permissions(self, **kw):
        try:
            permission_name = kw['permissions']['text']
        except KeyError:
            log.exception('Permission not submitted correctly')
            response.status = 403
            return ['Permission not submitted correctly']
        try:
            permission = Permission.by_name(permission_name)
        except NoResultFound:
            log.exception('Invalid permission: %s' % permission_name)
            response.status = 403
            return ['Invalid permission value']
        try:
            group_id = kw['group_id']
        except KeyError:
            log.exception('Group id not submitted')
            response.status = 403
            return ['No group id given']
        try:
            group = Group.by_id(group_id)
        except NoResultFound:
            log.exception('Group id %s is not a valid group id' % group_id)
            response.status = 403
            return ['Invalid Group Id']

        group = Group.by_id(group_id)
        if permission not in group.permissions:
            group.permissions.append(permission)
        else:
            response.status = 403
            return ['%s already exists in group %s' %
                (permission.permission_name, group.group_name)]

        return {'name':permission_name, 'id':permission.permission_id}

    def revoke_owner(self, group_id=None, id=None, **kw):

        if group_id is not None and id is not None:
            group = Group.by_id(group_id)
            user = User.by_id(id)
            service = 'WEBUI'
        else:
            group = Group.by_name(kw['group_name'])
            user = User.by_user_name(kw['member_name'])
            service = 'XMLRPC'

        if group.ldap:
            raise GroupOwnerModificationForbidden('An LDAP group does not have an owner')

        if not group.can_edit(identity.current.user):
            raise GroupOwnerModificationForbidden('You are not an owner of group %s' % group)

        if user not in group.users:
            raise GroupOwnerModificationForbidden('User is not a group member')

        if len(group.owners())==1 and not identity.current.user.is_admin():
            raise GroupOwnerModificationForbidden('Cannot remove the only owner')
        else:
            for assoc in group.user_group_assocs:
                if assoc.user == user:
                    if assoc.is_owner:
                        assoc.is_owner = False
                        group.record_activity(user=identity.current.user, service=service,
                                              field=u'Owner', action='Removed',
                                              old=user.user_name, new=u'')
                        # hack to return the user removing this owner
                        # so that if the user was logged in as a group
                        # owner, he/she can be redirected appropriately
                        return str(identity.current.user.user_id)

    def revoke_owner(self, group_id=None, id=None, **kw):

        if group_id is not None and id is not None:
            group = Group.by_id(group_id)
            user = User.by_id(id)
            service = 'WEBUI'
        else:
            group = Group.by_name(kw['group_name'])
            user = User.by_user_name(kw['member_name'])
            service = 'XMLRPC'

        if group.membership_type == GroupMembershipType.ldap:
            raise GroupOwnerModificationForbidden('An LDAP group does not have an owner')

        if not group.can_edit(identity.current.user):
            raise GroupOwnerModificationForbidden('You are not an owner of group %s' % group)

        if user not in group.users:
            raise GroupOwnerModificationForbidden('User is not a group member')

        if len(group.owners())==1 and not identity.current.user.is_admin():
            raise GroupOwnerModificationForbidden('Cannot remove the only owner')
        else:
            group.revoke_ownership(user=user, agent=identity.current.user, service=service)
            # hack to return the user removing this owner
            # so that if the user was logged in as a group
            # owner, he/she can be redirected appropriately
            return str(identity.current.user.user_id)

    def by_name(self, input,*args,**kw):
        input = input.lower()
        if 'anywhere' in kw:
            search = Group.list_by_name(input, find_anywhere=True)
        else:
            search = Group.list_by_name(input)

        groups =  [match.group_name for match in search]
        return dict(matches=groups)

    def create(self, kw):
        """
        Creates a new group.

        The *kw* argument must be an XML-RPC structure (dict)
        specifying the following keys:

            'group_name'
                 Group name (maximum 16 characters)
            'display_name'
                 Group display name
            'ldap'
                 Populate users from LDAP (True/False)

        Returns a message whether the group was successfully created or
        raises an exception on failure.

        """
        display_name = kw.get('display_name')
        group_name = kw.get('group_name')
        ldap = kw.get('ldap')
        password = kw.get('root_password')

        if ldap and not identity.current.user.is_admin():
            raise BX(_(u'Only admins can create LDAP groups'))
        try:
            group = Group.by_name(group_name)
        except NoResultFound:
            #validate
            GroupFormSchema.fields['group_name'].to_python(group_name)
            GroupFormSchema.fields['display_name'].to_python(display_name)

            group = Group()
            session.add(group)
            group.record_activity(user=identity.current.user, service=u'XMLRPC',
                    field=u'Group', action=u'Created')
            group.display_name = display_name
            group.group_name = group_name
            group.ldap = ldap
            group.root_password = password
            user = identity.current.user

            if not ldap:
                group.user_group_assocs.append(UserGroup(user=user, is_owner=True))
                group.activity.append(GroupActivity(user, service=u'XMLRPC',
                    action=u'Added', field_name=u'User',
                    old_value=None, new_value=user.user_name))
                group.activity.append(GroupActivity(user, service=u'XMLRPC',
                    action=u'Added', field_name=u'Owner',
                    old_value=None, new_value=user.user_name))

            if group.ldap:
                group.refresh_ldap_members()
            return 'Group created: %s.' % group_name
        else:
            raise BX(_(u'Group already exists: %s.' % group_name))

def create_group():
    """
    Creates a new user group in Beaker. The request must be 
    :mimetype:`application/json`.

    :jsonparam string group_name: Symbolic name for the group.
    :jsonparam string display_name: Human-friendly display name for the group.
    :jsonparam string description: Description of the group.
    :jsonparam string root_password: Optional root password for group jobs.
      If this is not set, group jobs will use the root password preferences of 
      the job submitter.
    :jsonparam string membership_type: Specifies how group membership is populated.
      Possible values are:

      * normal: Group is initially empty, members are explicitly added and removed by
        group owner.
      * ldap: Membership is populated from the LDAP group with the same group name.
      * inverted: Group contains all Beaker users *except* users who have been explicitly
        excluded by the group owner.

    :status 201: The group was successfully created.
    """
    user = identity.current.user
    data = read_json_request(request)
    if 'group_name' not in data:
        raise BadRequest400('Missing group_name key')
    if 'display_name' not in data:
        raise BadRequest400('Missing display_name key')
    # for backwards compatibility
    if data.pop('ldap', False):
        data['membership_type'] = 'ldap'
    try:
        Group.by_name(data['group_name'])
    except NoResultFound:
        pass
    else:
        raise Conflict409("Group '%s' already exists" % data['group_name'])
    with convert_internal_errors():
        group = Group.lazy_create(group_name=data['group_name'])
        group.display_name = data['display_name']
        group.description = data.get('description')
        group.root_password = data.get('root_password')
        session.add(group)
        group.record_activity(user=user, service=u'HTTP',
                field=u'Group', action=u'Created')
        if data.get('membership_type'):
            group.membership_type = GroupMembershipType.from_string(
                data['membership_type'])
        if group.membership_type == GroupMembershipType.ldap:
            group.refresh_ldap_members()
        else: # LDAP groups don't have any owners
            group.add_member(user, is_owner=True, agent=identity.current.user)
    response = jsonify(group.__json__())
    response.status_code = 201
    response.headers.add('Location', absolute_url(group.href))
    return response

 def test_adds_existing_user_to_admin_group(self):
     with session.begin():
         admin_group = Group.by_name(u'admin')
         existing_user = data_setup.create_user()
         self.assertNotIn(admin_group, existing_user.groups)
     populate_db(user_name=existing_user.user_name)
     with session.begin():
         admin_group = Group.by_name(u'admin')
         existing_user = User.query.get(existing_user.user_id)
         self.assertIn(admin_group, existing_user.groups)
     # run the same thing again, should have no effect but should not break
     populate_db(user_name=existing_user.user_name)

 def test_adds_existing_user_to_admin_group(self):
     with session.begin():
         admin_group = Group.by_name(u'admin')
         existing_user = data_setup.create_user()
         self.assertNotIn(admin_group, existing_user.groups)
     run_command('init.py', 'beaker-init', ['--user', existing_user.user_name])
     with session.begin():
         admin_group = Group.by_name(u'admin')
         existing_user = User.query.get(existing_user.user_id)
         self.assertIn(admin_group, existing_user.groups)
     # run the same thing again, should have no effect but should not break
     run_command('init.py', 'beaker-init', ['--user', existing_user.user_name])

    def edit(self, group_id=None, group_name=None, **kw):
        # Not just for editing, also provides a read-only view
        if group_id is not None:
            try:
                group = Group.by_id(group_id)
            except DatabaseLookupError:
                log.exception('Group id %s is not a valid group id' % group_id)
                flash(_(u'Need a valid group to search on'))
                redirect('../groups/mine')
        elif group_name is not None:
            try:
                group = Group.by_name(group_name)
            except NoResultFound:
                log.exception('Group name %s is not a valid group name' % group_name)
                flash(_(u'Need a valid group to search on'))
                redirect('../groups/mine')
        else:
            redirect('../groups/mine')

        usergrid = self.show_members(group)

        can_edit = False
        if identity.current.user:
            can_edit = group.can_edit(identity.current.user)

        permissions_fields = [('Permission', lambda x: x.permission_name)]
        if can_edit:
            permissions_fields.append((' ', lambda x: XML(
                    '<a class="btn" href="#" id="remove_permission_%s">'
                    '<i class="fa fa-times"/> Remove</a>' % x.permission_id)))
        group_permissions_grid = BeakerDataGrid(name='group_permission_grid',
                fields=permissions_fields)
        group_permissions = GroupPermissions()

        return dict(
            form = self.group_form,
            user_form = self.group_user_form,
            group_edit_js = LocalJSLink('bkr', '/static/javascript/group_users_v2.js'),
            action = './save',
            user_action = './save_user',
            options = {},
            value = group,
            group_pw = group.root_password,
            usergrid = usergrid,
            disabled_fields=[],
            group_permissions = group_permissions,
            group_form = self.permissions_form,
            group_permissions_grid = group_permissions_grid,
        )

    def test_group_modify_grant_owner(self):
        with session.begin():
            user1 = data_setup.create_user()
            self.group.add_member(user1)
            user2 = data_setup.create_user()
            self.group.add_member(user2)
            user3 = data_setup.create_user()

        out = run_client(['bkr', 'group-modify',
                          '--grant-owner', user1.user_name,
                          '--grant-owner', user2.user_name,
                          self.group.group_name],
                         config = self.client_config)

        with session.begin():
            session.refresh(self.group)
            group = Group.by_name(self.group.group_name)
            self.assert_(user1.user_id in [u.user_id for u in group.owners()])
            self.assert_(user2.user_id in [u.user_id for u in group.owners()])
            self.assertEquals(Activity.query.filter_by(service=u'HTTP',
                                                       field_name=u'Owner', action=u'Added',
                                                       new_value=user2.user_name).count(), 1)
            group = Group.by_name(group.group_name)
            self.assertEquals(group.activity[-1].action, u'Added')
            self.assertEquals(group.activity[-1].field_name, u'Owner')
            self.assertEquals(group.activity[-1].new_value, user2.user_name)
            self.assertEquals(group.activity[-1].service, u'HTTP')

        # If the user is not a group member, add the user into the members list
        # first and then grant the group ownership.
        out = run_client(['bkr', 'group-modify',
                          '--grant-owner', user3.user_name,
                          self.group.group_name],
                         config = self.client_config)
        with session.begin():
            session.refresh(self.group)
            group = Group.by_name(self.group.group_name)
            self.assertIn(user3, group.users)
            self.assertTrue(group.has_owner(user3))

        try:
            out = run_client(['bkr', 'group-modify',
                              '--grant-owner', user3.user_name,
                              self.fake_ldap_group.group_name],
                             config = self.client_config)
            self.fail('Must fail or die')
        except ClientError, e:
            self.assert_('Cannot modify group ownership')

    def test_remove_user_from_owning_group(self):
        with session.begin():
            user = data_setup.create_user(password='password')

        group_name = data_setup.unique_name('AAAAAA%s')
        display_name = data_setup.unique_name('Group Display Name %s')

        b = self.browser
        login(b, user=self.user.user_name, password='password')
        b.get(get_server_base() + 'groups/mine')
        b.find_element_by_link_text('Add').click()
        b.find_element_by_xpath('//input[@id="Group_display_name"]').send_keys(display_name)
        b.find_element_by_xpath('//input[@id="Group_group_name"]').send_keys(group_name)
        b.find_element_by_id('Group').submit()
        b.find_element_by_xpath('//title[text()="My Groups"]')
        b.find_element_by_link_text(group_name).click()

        # add an user
        b.find_element_by_xpath('//input[@id="GroupUser_user_text"]').send_keys(user.user_name)
        b.find_element_by_id('GroupUser').submit()

        self.mail_capture.captured_mails[:] = []

        group_id = Group.by_name(group_name).group_id
        username = user.user_name
        user_id = user.user_id

        b.find_element_by_xpath('//td[preceding-sibling::td[2]/text()="%s"]' % username)\
                .find_element_by_link_text('Remove').click()
        self.assertEquals(b.find_element_by_class_name('flash').text,
                          '%s Removed' % username)
        with session.begin():
            group = Group.by_name(group_name)
        self.check_notification(user, group, action='Removed')

        # remove self when I am the only owner of the group
        b.find_element_by_xpath('//td[preceding-sibling::td[2]/text()="%s"]' % self.user.user_name)\
                .find_element_by_link_text('Remove').click()
        self.assert_('Cannot remove member' in b.find_element_by_class_name('flash').text)

        # admin should be able to remove an owner, even if only one
        logout(b)
        #login back as admin
        login(b)
        b.get(get_server_base() + 'groups/edit?group_id=%s' % group_id)
        b.find_element_by_xpath('//td[preceding-sibling::td[2]/text()="%s"]' % self.user.user_name)\
                .find_element_by_link_text('Remove').click()
        self.assert_('%s Removed' % self.user.user_name in b.find_element_by_class_name('flash').text)

    def members(self, group_name):
        """
        List the members of an existing group.

        :param group_name: An existing group name
        :type group_name: string

        Returns a list of the members (a dictionary containing each
        member's username, email, and whether the member is an owner
        or not).

        """
        try:
            group = Group.by_name(group_name)
        except NoResultFound:
            raise BX(_(u'Group does not exist: %s.' % group_name))

        users=[]
        for u in group.users:
            user={}
            user['username']=u.user_name
            user['email'] = u.email_address
            if group.has_owner(u):
                user['owner'] = True
            else:
                user['owner'] = False
            users.append(user)

        return users

    def remove(self, **kw):
        u = identity.current.user
        try:
            group = Group.by_id(kw['group_id'])
        except DatabaseLookupError:
            flash(unicode('Invalid group or already removed'))
            redirect('../groups/mine')

        if not group.can_edit(u):
            flash(_(u'You are not an owner of group %s' % group))
            redirect('../groups/mine')

        if group.is_protected_group():
            flash(_(u'This group %s is predefined and cannot be deleted' % group))
            redirect('../groups/mine')

        if group.jobs:
            flash(_(u'Cannot delete a group which has associated jobs'))
            redirect('../groups/mine')

        # Record the access policy rules that will be removed
        # before deleting the group
        for rule in group.system_access_policy_rules:
            rule.record_deletion()

        # For any system pool owned by this group, unset owning_group
        # and set owning_user to the user deleting this group
        pools = SystemPool.query.filter_by(owning_group_id=group.group_id)
        for pool in pools:
            pool.change_owner(user=u, service='WEBUI')
        session.delete(group)
        activity = Activity(u, u'WEBUI', u'Removed', u'Group', group.display_name, u"")
        session.add(activity)
        flash( _(u"%s deleted") % group.display_name )
        raise redirect(".")