Python group.GroupPermissionAPI类代码示例

def delete(entry_id, inc_page=0):
    if not GroupPermissionAPI.can_write('navigation'):
        return abort(403)

    if inc_page and not GroupPermissionAPI.can_write('page'):
        return abort(403)

    entry = db.session.query(NavigationEntry).filter_by(id=entry_id).first()
    if not entry:
        abort(404)

    if not entry.parent:
        if entry.children.count() > 0:
            flash('Deze item heeft nog subitems.', 'danger')
            return redirect(url_for('navigation.edit', entry_id=entry.id))

    if inc_page:
        if entry.external or entry.activity_list:
            flash('Deze item verwijst niet naar een pagina op deze website.',
                  'danger')
        else:
            path = entry.url.lstrip('/')
            if PageAPI.remove_page(path):
                flash('De pagina is verwijderd.', 'success')
            else:
                flash('De te verwijderen pagina kon niet worden gevonden.',
                      'danger')

    db.session.delete(entry)
    db.session.commit()

    flash('De navigatie-item is verwijderd.', 'success')

    return redirect(url_for('navigation.view'))

def view_list(page=1):
    if not GroupPermissionAPI.can_read('company'):
        return abort(403)

    if request.args.get('search') is not None:
        search = request.args.get('search')

        companies = Company.query.join(Location)\
            .filter(or_(Company.name.like('%' + search + '%'),
                        Location.city.like('%' + search + '%')))\
            .order_by(Company.name).order_by(Company.rank)

        if not GroupPermissionAPI.can_write('company'):
            companies = companies\
                .filter(and_(Company.contract_start_date < datetime.utcnow(),
                             Company.contract_end_date > datetime.utcnow()))\
                .paginate(page, 15, True)
        else:
            for i, company in enumerate(companies):
                print(i, company)
                if company.contract_start_date < datetime\
                        .date(datetime.utcnow()) and \
                        company.contract_end_date < datetime\
                        .date(datetime.utcnow()):
                    companies[i].expired = True
            companies = companies.paginate(page, 15, False)

        return render_template('company/list.htm', companies=companies,
                               search=search, path=FILE_FOLDER)

    if not GroupPermissionAPI.can_write('company'):
        companies = Company.query\
            .filter(and_(Company.contract_start_date < datetime.utcnow(),
                         Company.contract_end_date > datetime.utcnow()))\
            .order_by(Company.name).order_by(Company.rank).paginate(page, 15,
                                                                    True)
    else:
        companies = Company.query.filter().order_by(Company.name)\
            .order_by(Company.rank)
        for i, company in enumerate(companies):
            print(i, company)
            if company.contract_start_date < datetime.date(datetime.utcnow()) \
                    and company.contract_end_date < datetime.date(datetime
                                                                  .utcnow()):
                print(i)
                companies[i].expired = True
        companies = companies.paginate(page, 15, False)
        # todo fix message if inactive

    # companies = Company.query.paginate(page, 15, False)

    return render_template('company/list.htm', companies=companies, search="",
                           path=FILE_FOLDER)

def remove_avatar(user_id=None):
    user = User.query.get(user_id)
    if not GroupPermissionAPI.can_write('user') and\
            (not current_user or current_user.id != user_id):
        return abort(403)
    UserAPI.remove_avatar(user)
    return redirect(url_for('user.view_single', user_id=user_id))

def view():

    page = request.args.get('page_nr', '')

    if not page:
        page = 1
    else:
        page = int(page)

    if not GroupPermissionAPI.can_write('custom_form'):
        return abort(403)

    custom_forms = CustomForm.query.order_by(desc("id"))

    if current_user and current_user.id > 0:
        follows = CustomFormFollower.query\
            .filter(CustomFormFollower.owner_id == current_user.id).all()

        ids = []

        for follow in follows:
            ids.append(follow.form_id)

        followed_forms = CustomForm.query.filter(CustomForm.id.in_(ids)).all()
    else:
        followed_forms = []
        ids = []

    # TODO Custom forms for specific groups (i.e coordinator can only see own
    # forms)
    return render_template('custom_form/overview.htm',
                           custom_forms=custom_forms.paginate(page, 20, False),
                           followed_forms=followed_forms, followed_ids=ids)

def view_single(user_id=None):
    if not GroupPermissionAPI.can_read('user') and\
            (not current_user or current_user.id != user_id):
        return abort(403)

    if not user_id:
        return abort(404)
    user = User.query.get(user_id)
    if not user:
        return abort(404)

    user.avatar = UserAPI.avatar(user)
    user.groups = UserAPI.get_groups_for_user_id(user)

    user.groups_amount = user.groups.count()

    # Get all activity entrees from these forms, order by start_time of
    # activity.
    activities = Activity.query.join(CustomForm).join(CustomFormResult).\
        filter(CustomFormResult.owner_id == user_id and
               CustomForm.id == CustomFormResult.form_id and
               Activity.form_id == CustomForm.id)

    user.activities_amount = activities.count()

    new_activities = activities\
        .filter(Activity.end_time > datetime.datetime.today()).distinct()\
        .order_by(Activity.start_time)
    old_activities = activities\
        .filter(Activity.end_time < datetime.datetime.today()).distinct()\
        .order_by(Activity.start_time.desc())

    return render_template('user/view_single.htm', user=user,
                           new_activities=new_activities,
                           old_activities=old_activities)

    def can_view(entry):
        '''
        Check whether the current user can view the entry, so if not it can be
        removed from the navigation.
        '''
        blueprints = [(name, b.url_prefix) for name, b in
                      application.blueprints.iteritems()]

        if entry.external or entry.activity_list:
            return True

        url = entry.url
        if not url[-1:] == '/':
            path = url
            url += '/'
        else:
            path = url[:-1]

        for blueprint, url_prefix in blueprints:
            if not url_prefix:
                continue

            if url_prefix == url:
                return GroupPermissionAPI.can_read(blueprint)

        page = Page.query.filter_by(path=path).first()
        if not page:
            return True

        return UserAPI.can_read(page)

    def commit_book_to_db(book_id, title, price, isbn, stock):
        """
        Adds a new book to the database

        Returns succes(boolean), message (string). Message is the book.id if
        succes is true, otherwise it contains what exactly went wrong.

        In case of succes the book is entered into the database
        """

        if not GroupPermissionAPI.can_write('booksales'):
            abort(403)

        if book_id == -1:
            book = Book(title, price, isbn, stock)
            db.session.add(book)
            db.session.commit()
            return True, book.id

        book = Book.query.filter(Book.id == book_id).first()
        book.title = title
        book.price = price
        book.isbn = isbn
        book.stock = stock
        db.session.add(book)
        db.session.commit()

        return True, book.id

def edit(company_id=None):
    '''
    FRONTEND
    Create, view or edit a company.
    '''
    if not GroupPermissionAPI.can_read('company'):
        return abort(403)

    # Select company.
    if company_id:
        company = Company.query.get(company_id)
    else:
        company = Company()

    form = CompanyForm(request.form, company)

    # Add locations.
    locations = Location.query.order_by('address').order_by('city')
    form.location_id.choices = \
        [(l.id, l.address + ', ' + l.city) for l in locations]

    # Add contacts.
    # form.contact_id.choices = \
    #       [(c.id, c.name) for c in Contact.query\
    #               .filter_by(location=location).order_by('name')]
    form.contact_id.choices = \
        [(c.id, c.name) for c in Contact.query.filter_by().order_by('name')]

    return render_template('company/edit.htm', company=company, form=form)

    def get_minutes(group_id):
        """
        Load all minutes in the given group
        """
        if not GroupPermissionAPI.can_read('pimpy'):
            abort(403)
        if not current_user:
            flash('Huidige gebruiker niet gevonden', 'danger')
            return redirect(url_for('pimpy.view_minutes'))

        list_items = {}

        if group_id != 'all':
            query = Minute.query.filter(Minute.group_id == group_id).\
                order_by(Minute.minute_date.desc())
            list_items[Group.query.filter(Group.id == group_id).first().name]\
                = query.all()
        # this should be done with a sql in statement, or something, but meh
        else:
            for group in current_user.groups:
                query = Minute.query.filter(Minute.group_id == group.id)
                query = query.order_by(Minute.minute_date.desc())
                list_items[group.name] = query.all()

        return Markup(render_template('pimpy/api/minutes.htm',
                                      list_items=list_items, type='minutes',
                                      group_id=group_id, line_number=-1,
                                      title='PimPy'))

def view():
    if not GroupPermissionAPI.can_read('navigation'):
        return abort(403)

    entries = NavigationAPI.get_entries()

    return render_template('navigation/view.htm', nav_entries=entries)

def has_payed(submit_id=None):
    response = "success"

    if not GroupPermissionAPI.can_write('custom_form'):
        return abort(403)

    # Logged in user
    if not current_user or current_user.id <= 0:
        # Need to be logged in
        return abort(403)

    # Test if user already signed up
    submission = CustomFormResult.query.filter(
        CustomFormResult.id == submit_id
    ).first()

    if not submission:
        response = "Error, submission could not be found"

    # Adjust the "has_payed"
    if submission.has_payed:
        submission.has_payed = False
    else:
        submission.has_payed = True

    db.session.add(submission)
    db.session.commit()

    return response

def update(contact_id=None):
    '''
    Create or edit a contact, backend.
    '''
    if not GroupPermissionAPI.can_write('contact'):
        return abort(403)

    if contact_id:
        contact = Contact.query.get(contact_id)
    else:
        contact = Contact()

    form = ContactForm(request.form, contact)
    if not validate_form(form, ['name', 'email', 'phone_nr', 'location_id']):
        return redirect(url_for('contact.edit', contact_id=contact_id))

    form.populate_obj(contact)
    db.session.add(contact)
    db.session.commit()

    if contact_id:
        flash('Contactpersoon opgeslagen', 'success')
    else:
        contact_id = contact.id
        flash('Contactpersoon aangemaakt', 'success')

    return redirect(url_for('contact.edit', contact_id=contact_id))

def new_submission(challenge_id=None):
    if not GroupPermissionAPI.can_read('challenge'):
        abort(403)

    if request.args.get('challenge_id'):
        challenge_id = request.args.get('challenge_id')
    else:
        return "Error, no 'challenge_id' given"

    if request.args.get('submission'):
        submission = request.args.get('submission')
    else:
        return "Error, no 'submission' given"

    new_submission = ChallengeAPI.create_submission(challenge_id=challenge_id,
                                                    user_id=current_user.id,
                                                    submission=submission,
                                                    image_path=None)

    if new_submission is False:
        return "Question is already submitted"

    challenge = ChallengeAPI.fetch_challenge(challenge_id)

    return ChallengeAPI.validate_question(new_submission, challenge)

def get_ranking():
    if not GroupPermissionAPI.can_read('challenge'):
        abort(403)

    ranking = ChallengeAPI.get_ranking()

    return jsonify(ranking=[user.serialize for user in ranking])

def create():
    if not(GroupPermissionAPI.can_write('group')):
        return abort(403)

    if request.method == 'POST':
        name = request.form['name'].strip()
        valid_form = True

        if not name:
            flash('No group name has been specified.', 'danger')
            valid_form = False
        elif Group.query.filter(Group.name == name).count() > 0:
            flash('The group name that has been specified is in use already.',
                  'danger')
            valid_form = False

        if valid_form:
            group = Group(name)

            db.session.add(group)
            db.session.commit()

            flash('The group has been created.', 'success')

            return redirect(url_for('group.view'))

    return render_template('group/create.htm', title='Create group')