Python access.from_request函数代码示例

    def has_object_permission(self, request, view, organization):
        if request.user and request.user.is_authenticated() and request.auth:
            request.access = access.from_request(
                request,
                organization,
                scopes=request.auth.get_scopes(),
            )

        elif request.auth:
            if request.auth.organization_id == organization.id:
                request.access = access.from_auth(request.auth)
            else:
                request.access = access.DEFAULT

        else:
            request.access = access.from_request(request, organization)

            if auth.is_user_signed_request(request):
                # if the user comes from a signed request
                # we let them pass if sso is enabled
                logger.info(
                    'access.signed-sso-passthrough',
                    extra={
                        'organization_id': organization.id,
                        'user_id': request.user.id,
                    }
                )
            elif request.user.is_authenticated():
                # session auth needs to confirm various permissions
                if self.needs_sso(request, organization):

                    logger.info(
                        'access.must-sso',
                        extra={
                            'organization_id': organization.id,
                            'user_id': request.user.id,
                        }
                    )

                    raise SsoRequired(organization)

                if self.is_not_2fa_compliant(
                        request.user, organization):
                    logger.info(
                        'access.not-2fa-compliant',
                        extra={
                            'organization_id': organization.id,
                            'user_id': request.user.id,
                        }
                    )
                    raise TwoFactorRequired()

        allowed_scopes = set(self.scope_map.get(request.method, []))
        return any(request.access.has_scope(s) for s in allowed_scopes)

    def has_object_permission(self, request, view, organization):
        if request.user and request.user.is_authenticated() and request.auth:
            request.access = access.from_request(request, organization, scopes=request.auth.get_scopes())

        elif request.auth:
            if request.auth is ROOT_KEY:
                return True
            return request.auth.organization_id == organization.id

        else:
            request.access = access.from_request(request, organization)

        allowed_scopes = set(self.scope_map.get(request.method, []))
        return any(request.access.has_scope(s) for s in allowed_scopes)

    def determine_access(self, request, organization):
        from sentry.api.base import logger

        if request.user and request.user.is_authenticated() and request.auth:
            request.access = access.from_request(
                request,
                organization,
                scopes=request.auth.get_scopes(),
            )

        elif request.auth:
            request.access = access.from_auth(request.auth, organization)

        else:
            request.access = access.from_request(request, organization)

            if auth.is_user_signed_request(request):
                # if the user comes from a signed request
                # we let them pass if sso is enabled
                logger.info(
                    'access.signed-sso-passthrough',
                    extra={
                        'organization_id': organization.id,
                        'user_id': request.user.id,
                    }
                )
            elif request.user.is_authenticated():
                # session auth needs to confirm various permissions
                if self.needs_sso(request, organization):

                    logger.info(
                        'access.must-sso',
                        extra={
                            'organization_id': organization.id,
                            'user_id': request.user.id,
                        }
                    )

                    raise SsoRequired(organization)

                if self.is_not_2fa_compliant(
                        request, organization):
                    logger.info(
                        'access.not-2fa-compliant',
                        extra={
                            'organization_id': organization.id,
                            'user_id': request.user.id,
                        }
                    )
                    raise TwoFactorRequired()

    def serialize(self, obj, attrs, user):
        from sentry import features
        from sentry.app import env
        from sentry.api.serializers.models.team import TeamWithProjectsSerializer

        team_list = list(Team.objects.filter(organization=obj, status=TeamStatus.VISIBLE))

        feature_list = []
        if features.has("organizations:events", obj, actor=user):
            feature_list.append("events")
        if features.has("organizations:sso", obj, actor=user):
            feature_list.append("sso")

        if getattr(obj.flags, "allow_joinleave"):
            feature_list.append("open-membership")

        context = super(DetailedOrganizationSerializer, self).serialize(obj, attrs, user)
        context["quota"] = {
            "maxRate": quotas.get_organization_quota(obj),
            "projectLimit": int(
                OrganizationOption.objects.get_value(organization=obj, key="sentry:project-rate-limit", default=100)
            ),
        }
        context["teams"] = serialize(team_list, user, TeamWithProjectsSerializer())
        if env.request:
            context["access"] = access.from_request(env.request, obj).scopes
        else:
            context["access"] = access.from_user(user, obj).scopes
        context["features"] = feature_list
        context["pendingAccessRequests"] = OrganizationAccessRequest.objects.filter(team__organization=obj).count()
        return context

    def dispatch(self, request, *args, **kwargs):
        """
        Identical to rest framework's dispatch except we add the ability
        to convert arguments (for common URL params).
        """
        self.args = args
        self.kwargs = kwargs
        request = self.initialize_request(request, *args, **kwargs)
        self.load_json_body(request)
        self.request = request
        self.headers = self.default_response_headers  # deprecate?

        if settings.SENTRY_API_RESPONSE_DELAY:
            time.sleep(settings.SENTRY_API_RESPONSE_DELAY / 1000.0)

        origin = request.META.get('HTTP_ORIGIN', 'null')
        # A "null" value should be treated as no Origin for us.
        # See RFC6454 for more information on this behavior.
        if origin == 'null':
            origin = None

        try:
            if origin and request.auth:
                allowed_origins = request.auth.get_allowed_origins()
                if not is_valid_origin(origin, allowed=allowed_origins):
                    response = Response('Invalid origin: %s' %
                                        (origin, ), status=400)
                    self.response = self.finalize_response(
                        request, response, *args, **kwargs)
                    return self.response

            self.initial(request, *args, **kwargs)

            # Get the appropriate handler method
            if request.method.lower() in self.http_method_names:
                handler = getattr(self, request.method.lower(),
                                  self.http_method_not_allowed)

                (args, kwargs) = self.convert_args(request, *args, **kwargs)
                self.args = args
                self.kwargs = kwargs
            else:
                handler = self.http_method_not_allowed

            if getattr(request, 'access', None) is None:
                # setup default access
                request.access = access.from_request(request)

            response = handler(request, *args, **kwargs)

        except Exception as exc:
            response = self.handle_exception(request, exc)

        if origin:
            self.add_cors_headers(request, response)

        self.response = self.finalize_response(
            request, response, *args, **kwargs)

        return self.response

    def get_view_response(self, request, group):
        from sentry.models import Event

        self.selected = request.path == self.get_url(group)

        if not self.selected:
            return

        response = self.view(request, group)

        if not response:
            return

        if isinstance(response, HttpResponseRedirect):
            return response

        if not isinstance(response, Response):
            raise NotImplementedError('Use self.render() when returning responses.')

        event = group.get_latest_event() or Event()
        event.group = group

        request.access = access.from_request(request, group.organization)

        return response.respond(
            request, {
                'plugin': self,
                'project': group.project,
                'group': group,
                'event': event,
                'can_admin_event': request.access.has_scope('event:write'),
                'can_remove_event': request.access.has_scope('event:admin'),
            }
        )

    def get_view_response(self, request, group):
        from sentry.models import Event

        self.selected = request.path == self.get_url(group)

        if not self.selected:
            return

        response = self.view(request, group)

        if not response:
            return

        if isinstance(response, HttpResponseRedirect):
            return response

        if not isinstance(response, Response):
            raise NotImplementedError("Use self.render() when returning responses.")

        event = group.get_latest_event() or Event()
        event.group = group

        request.access = access.from_request(request, group.organization)

        return response.respond(
            request,
            {
                "plugin": self,
                "project": group.project,
                "group": group,
                "event": event,
                "can_admin_event": request.access.has_scope("event:write"),
                "can_remove_event": request.access.has_scope("event:delete"),
            },
        )

    def has_object_permission(self, request, view, organization):
        if request.auth:
            return request.auth.organization_id == organization.id

        request.access = access.from_request(request, organization)
        allowed_scopes = set(self.scope_map.get(request.method, []))
        return any(request.access.has_scope(s) for s in allowed_scopes)

    def serialize(self, obj, attrs, user):
        from sentry import features
        from sentry.app import env
        from sentry.api.serializers.models.team import TeamWithProjectsSerializer

        team_list = list(Team.objects.filter(
            organization=obj,
            status=TeamStatus.VISIBLE,
        ))
        for team in team_list:
            team._organization_cache = obj

        onboarding_tasks = list(OrganizationOnboardingTask.objects.filter(
            organization=obj,
        ).select_related('user'))

        feature_list = []
        if features.has('organizations:sso', obj, actor=user):
            feature_list.append('sso')
        if features.has('organizations:callsigns', obj, actor=user):
            feature_list.append('callsigns')
        if features.has('organizations:new-tracebacks', obj, actor=user):
            feature_list.append('new-tracebacks')
        if features.has('organizations:onboarding', obj, actor=user) and \
                not OrganizationOption.objects.filter(organization=obj).exists():
            feature_list.append('onboarding')
        if features.has('organizations:api-keys', obj, actor=user) or \
                ApiKey.objects.filter(organization=obj).exists():
            feature_list.append('api-keys')

        if getattr(obj.flags, 'allow_joinleave'):
            feature_list.append('open-membership')
        if not getattr(obj.flags, 'disable_shared_issues'):
            feature_list.append('shared-issues')

        context = super(DetailedOrganizationSerializer, self).serialize(
            obj, attrs, user)
        context['quota'] = {
            'maxRate': quotas.get_organization_quota(obj),
            'projectLimit': int(OrganizationOption.objects.get_value(
                organization=obj,
                key='sentry:project-rate-limit',
                default=100,
            )),
        }
        context['teams'] = serialize(
            team_list, user, TeamWithProjectsSerializer())
        if env.request:
            context['access'] = access.from_request(env.request, obj).scopes
        else:
            context['access'] = access.from_user(user, obj).scopes
        context['features'] = feature_list
        context['pendingAccessRequests'] = OrganizationAccessRequest.objects.filter(
            team__organization=obj,
        ).count()
        context['onboardingTasks'] = serialize(onboarding_tasks, user, OnboardingTasksSerializer())
        return context

    def has_object_permission(self, request, view, team):
        if request.auth:
            if request.auth is ROOT_KEY:
                return True
            return request.auth.organization_id == team.organization_id

        request.access = access.from_request(request, team.organization)

        allowed_scopes = set(self.scope_map.get(request.method, []))
        return any(request.access.has_team_scope(team, s) for s in allowed_scopes)

 def build_request(self, user=None, active_superuser=False, **params):
     request = RequestFactory().get('/', params)
     request.session = {}
     if active_superuser:
         request.superuser = MockSuperUser()
     if user is None:
         user = self.user
     request.user = user
     request.access = from_request(request, self.org)
     return request

    def has_object_permission(self, request, view, project):
        if request.auth:
            return request.auth.organization_id == project.organization_id

        request.access = access.from_request(request, project.organization)

        for scope in self.scope_map.get(request.method, []):
            if request.access.has_team_scope(project.team, scope):
                return True
        return False

    def has_object_permission(self, request, view, organization):
        if request.user and request.user.is_authenticated() and request.auth:
            request.access = access.from_request(
                request, organization, scopes=request.auth.get_scopes(),
            )

        elif request.auth:
            if request.auth is ROOT_KEY:
                return True
            return request.auth.organization_id == organization.id

        else:
            request.access = access.from_request(request, organization)
            # session auth needs to confirm various permissions
            if request.user.is_authenticated() and self.needs_sso(request, organization):
                logger.info('access.must-sso', extra={
                    'organization_id': organization.id,
                    'user_id': request.user.id,
                })
                raise NotAuthenticated(detail='Must login via SSO')

        allowed_scopes = set(self.scope_map.get(request.method, []))
        return any(request.access.has_scope(s) for s in allowed_scopes)

    def has_object_permission(self, request, view, organization):
        if request.user and request.user.is_authenticated() and request.auth:
            request.access = access.from_request(
                request,
                organization,
                scopes=request.auth.get_scopes(),
            )

        elif request.auth:
            return request.auth.organization_id == organization.id

        else:
            request.access = access.from_request(request, organization)

            if auth.is_user_signed_request(request):
                # if the user comes from a signed request
                # we let them pass if sso is enabled
                logger.info(
                    'access.signed-sso-passthrough',
                    extra={
                        'organization_id': organization.id,
                        'user_id': request.user.id,
                    }
                )
            elif request.user.is_authenticated() and self.needs_sso(request, organization):
                # session auth needs to confirm various permissions
                logger.info(
                    'access.must-sso',
                    extra={
                        'organization_id': organization.id,
                        'user_id': request.user.id,
                    }
                )
                raise NotAuthenticated(detail='Must login via SSO')

        allowed_scopes = set(self.scope_map.get(request.method, []))
        return any(request.access.has_scope(s) for s in allowed_scopes)

    def serialize(self, obj, attrs, user):
        from sentry import features
        from sentry.app import env
        from sentry.api.serializers.models.team import TeamWithProjectsSerializer

        team_list = list(Team.objects.filter(
            organization=obj,
            status=TeamStatus.VISIBLE,
        ))

        feature_list = []
        if features.has('organizations:sso', obj, actor=user):
            feature_list.append('sso')
        if features.has('organizations:my-issues', obj, actor=user):
            feature_list.append('my-issues')

        if getattr(obj.flags, 'allow_joinleave'):
            feature_list.append('open-membership')

        context = super(DetailedOrganizationSerializer, self).serialize(
            obj, attrs, user)
        context['quota'] = {
            'maxRate': quotas.get_organization_quota(obj),
            'projectLimit': int(OrganizationOption.objects.get_value(
                organization=obj,
                key='sentry:project-rate-limit',
                default=100,
            )),
        }
        context['teams'] = serialize(
            team_list, user, TeamWithProjectsSerializer())
        if env.request:
            context['access'] = access.from_request(env.request, obj).scopes
        else:
            context['access'] = access.from_user(user, obj).scopes
        context['features'] = feature_list
        context['pendingAccessRequests'] = OrganizationAccessRequest.objects.filter(
            team__organization=obj,
        ).count()
        return context