schemas/base.py
branchstable
changeset 4556 43c14e0e8972
parent 4535 71c86a315a9a
child 4590 2172c8c29fe6
equal deleted inserted replaced
4555:8968c50818db 4556:43c14e0e8972
    14                              ERQLExpression, RRQLExpression)
    14                              ERQLExpression, RRQLExpression)
    15 from cubicweb.schemas import META_ETYPE_PERMS, META_RTYPE_PERMS
    15 from cubicweb.schemas import META_ETYPE_PERMS, META_RTYPE_PERMS
    16 
    16 
    17 class CWUser(WorkflowableEntityType):
    17 class CWUser(WorkflowableEntityType):
    18     """define a CubicWeb user"""
    18     """define a CubicWeb user"""
    19     permissions = {
    19     __permissions__ = {
    20         'read':   ('managers', 'users', ERQLExpression('X identity U')),
    20         'read':   ('managers', 'users', ERQLExpression('X identity U')),
    21         'add':    ('managers',),
    21         'add':    ('managers',),
    22         'delete': ('managers',),
    22         'delete': ('managers',),
    23         'update': ('managers', ERQLExpression('X identity U, NOT U in_group G, G name "guests"'),),
    23         'update': ('managers', ERQLExpression('X identity U, NOT U in_group G, G name "guests"'),),
    24         }
    24         }
    40                                description=_('groups grant permissions to the user'))
    40                                description=_('groups grant permissions to the user'))
    41 
    41 
    42 
    42 
    43 class EmailAddress(EntityType):
    43 class EmailAddress(EntityType):
    44     """an electronic mail address associated to a short alias"""
    44     """an electronic mail address associated to a short alias"""
    45     permissions = {
    45     __permissions__ = {
    46         'read':   ('managers', 'users', 'guests',), # XXX if P use_email X, U has_read_permission P
    46         'read':   ('managers', 'users', 'guests',), # XXX if P use_email X, U has_read_permission P
    47         'add':    ('managers', 'users',),
    47         'add':    ('managers', 'users',),
    48         'delete': ('managers', 'owners', ERQLExpression('P use_email X, U has_update_permission P')),
    48         'delete': ('managers', 'owners', ERQLExpression('P use_email X, U has_update_permission P')),
    49         'update': ('managers', 'owners', ERQLExpression('P use_email X, U has_update_permission P')),
    49         'update': ('managers', 'owners', ERQLExpression('P use_email X, U has_update_permission P')),
    50         }
    50         }
    57 (such as python-projects@logilab.org and python-projects@lists.logilab.org), set this \
    57 (such as python-projects@logilab.org and python-projects@lists.logilab.org), set this \
    58 to indicate which is the preferred form.'))
    58 to indicate which is the preferred form.'))
    59 
    59 
    60 class use_email(RelationType):
    60 class use_email(RelationType):
    61     """ """
    61     """ """
    62     permissions = {
    62     __permissions__ = {
    63         'read':   ('managers', 'users', 'guests',),
    63         'read':   ('managers', 'users', 'guests',),
    64         'add':    ('managers', RRQLExpression('U has_update_permission S'),),
    64         'add':    ('managers', RRQLExpression('U has_update_permission S'),),
    65         'delete': ('managers', RRQLExpression('U has_update_permission S'),),
    65         'delete': ('managers', RRQLExpression('U has_update_permission S'),),
    66         }
    66         }
    67     fulltext_container = 'subject'
    67     fulltext_container = 'subject'
    68 
    68 
    69 class primary_email(RelationType):
    69 class primary_email(RelationType):
    70     """the prefered email"""
    70     """the prefered email"""
    71     permissions = use_email.permissions
    71     __permissions__ = use_email.__permissions__
    72 
    72 
    73 class prefered_form(RelationType):
    73 class prefered_form(RelationType):
    74     permissions = {
    74     __permissions__ = {
    75         'read':   ('managers', 'users', 'guests',),
    75         'read':   ('managers', 'users', 'guests',),
    76         # XXX should have update permissions on both subject and object,
    76         # XXX should have update __permissions__ on both subject and object,
    77         #     though by doing this we will probably have no way to add
    77         #     though by doing this we will probably have no way to add
    78         #     this relation in the web ui. The easiest way to acheive this
    78         #     this relation in the web ui. The easiest way to acheive this
    79         #     is probably to be able to have "U has_update_permission O" as
    79         #     is probably to be able to have "U has_update_permission O" as
    80         #     RQLConstraint of the relation definition, though this is not yet
    80         #     RQLConstraint of the relation definition, though this is not yet
    81         #     possible
    81         #     possible
    83         'delete': ('managers', RRQLExpression('U has_update_permission S'),),
    83         'delete': ('managers', RRQLExpression('U has_update_permission S'),),
    84         }
    84         }
    85 
    85 
    86 class in_group(RelationType):
    86 class in_group(RelationType):
    87     """core relation indicating a user's groups"""
    87     """core relation indicating a user's groups"""
    88     permissions = META_RTYPE_PERMS
    88     __permissions__ = META_RTYPE_PERMS
    89 
    89 
    90 class owned_by(RelationType):
    90 class owned_by(RelationType):
    91     """core relation indicating owners of an entity. This relation
    91     """core relation indicating owners of an entity. This relation
    92     implicitly put the owner into the owners group for the entity
    92     implicitly put the owner into the owners group for the entity
    93     """
    93     """
    94     permissions = {
    94     __permissions__ = {
    95         'read':   ('managers', 'users', 'guests'),
    95         'read':   ('managers', 'users', 'guests'),
    96         'add':    ('managers', RRQLExpression('S owned_by U'),),
    96         'add':    ('managers', RRQLExpression('S owned_by U'),),
    97         'delete': ('managers', RRQLExpression('S owned_by U'),),
    97         'delete': ('managers', RRQLExpression('S owned_by U'),),
    98         }
    98         }
    99     # 0..n cardinality for entities created by internal session (no attached user)
    99     # 0..n cardinality for entities created by internal session (no attached user)
   102     subject = '*'
   102     subject = '*'
   103     object = 'CWUser'
   103     object = 'CWUser'
   104 
   104 
   105 class created_by(RelationType):
   105 class created_by(RelationType):
   106     """core relation indicating the original creator of an entity"""
   106     """core relation indicating the original creator of an entity"""
   107     permissions = {
   107     __permissions__ = {
   108         'read':   ('managers', 'users', 'guests'),
   108         'read':   ('managers', 'users', 'guests'),
   109         'add':    ('managers',),
   109         'add':    ('managers',),
   110         'delete': ('managers',),
   110         'delete': ('managers',),
   111         }
   111         }
   112     # 0..1 cardinality for entities created by internal session (no attached user)
   112     # 0..1 cardinality for entities created by internal session (no attached user)
   133     cardinality = '11'
   133     cardinality = '11'
   134     subject = '*'
   134     subject = '*'
   135     object = 'String'
   135     object = 'String'
   136 
   136 
   137 
   137 
   138 class CWProperty(EntityType):
   138 # XXX find a better relation name
   139     """used for cubicweb configuration. Once a property has been created you
       
   140     can't change the key.
       
   141     """
       
   142     permissions = {
       
   143         'read':   ('managers', 'users', 'guests'),
       
   144         'add':    ('managers', 'users',),
       
   145         'update': ('managers', 'owners',),
       
   146         'delete': ('managers', 'owners',),
       
   147         }
       
   148     # key is a reserved word for mysql
       
   149     pkey = String(required=True, internationalizable=True, maxsize=256,
       
   150                   description=_('defines what\'s the property is applied for. '
       
   151                                 'You must select this first to be able to set '
       
   152                                 'value'))
       
   153     value = String(internationalizable=True, maxsize=256)
       
   154 
       
   155     for_user = SubjectRelation('CWUser', cardinality='?*', composite='object',
       
   156                                description=_('user for which this property is '
       
   157                                              'applying. If this relation is not '
       
   158                                              'set, the property is considered as'
       
   159                                              ' a global property'))
       
   160 
       
   161 
       
   162 class for_user(RelationType):
   139 class for_user(RelationType):
   163     """link a property to the user which want this property customization. Unless
   140     """link a property to the user which want this property customization. Unless
   164     you're a site manager, this relation will be handled automatically.
   141     you're a site manager, this relation will be handled automatically.
   165     """
   142     """
   166     permissions = {
   143     __permissions__ = {
   167         'read':   ('managers', 'users', 'guests'),
   144         'read':   ('managers', 'users', 'guests'),
   168         'add':    ('managers',),
   145         'add':    ('managers',),
   169         'delete': ('managers',),
   146         'delete': ('managers',),
   170         }
   147         }
   171     inlined = True
   148     inlined = True
       
   149     subject = 'CWProperty'
       
   150     object = 'CWUser'
       
   151     composite = 'object'
       
   152     cardinality = '?*'
   172 
   153 
   173 
   154 
   174 class CWPermission(EntityType):
   155 class CWPermission(EntityType):
   175     """entity type that may be used to construct some advanced security configuration
   156     """entity type that may be used to construct some advanced security configuration
   176     """
   157     """
   177     permissions = META_ETYPE_PERMS
   158     __permissions__ = META_ETYPE_PERMS
   178 
   159 
   179     name = String(required=True, indexed=True, internationalizable=True, maxsize=100,
   160     name = String(required=True, indexed=True, internationalizable=True, maxsize=100,
   180                   description=_('name or identifier of the permission'))
   161                   description=_('name or identifier of the permission'))
   181     label = String(required=True, internationalizable=True, maxsize=100,
   162     label = String(required=True, internationalizable=True, maxsize=100,
   182                    description=_('distinct label to distinguate between other permission entity of the same name'))
   163                    description=_('distinct label to distinguate between other permission entity of the same name'))
   187 # configurable security
   168 # configurable security
   188 class require_permission(RelationType):
   169 class require_permission(RelationType):
   189     """link a permission to the entity. This permission should be used in the
   170     """link a permission to the entity. This permission should be used in the
   190     security definition of the entity's type to be useful.
   171     security definition of the entity's type to be useful.
   191     """
   172     """
   192     permissions = {
   173     __permissions__ = {
   193         'read':   ('managers', 'users', 'guests'),
   174         'read':   ('managers', 'users', 'guests'),
   194         'add':    ('managers',),
   175         'add':    ('managers',),
   195         'delete': ('managers',),
   176         'delete': ('managers',),
   196         }
   177         }
   197 
   178 
   198 class require_group(RelationType):
   179 class require_group(RelationType):
   199     """used to grant a permission to a group"""
   180     """used to grant a permission to a group"""
   200     permissions = {
   181     __permissions__ = {
   201         'read':   ('managers', 'users', 'guests'),
   182         'read':   ('managers', 'users', 'guests'),
   202         'add':    ('managers',),
   183         'add':    ('managers',),
   203         'delete': ('managers',),
   184         'delete': ('managers',),
   204         }
   185         }
   205 
   186 
   211 
   192 
   212 class same_as(RelationType):
   193 class same_as(RelationType):
   213     """generic relation to specify that an external entity represent the same
   194     """generic relation to specify that an external entity represent the same
   214     object as a local one:
   195     object as a local one:
   215        http://www.w3.org/TR/owl-ref/#sameAs-def
   196        http://www.w3.org/TR/owl-ref/#sameAs-def
   216 
   197     """
   217     NOTE: You'll have to explicitly declare which entity types can have a
   198     #NOTE: You'll have to explicitly declare which entity types can have a
   218     same_as relation
   199     #same_as relation
   219     """
   200     __permissions__ = {
   220     permissions = {
       
   221         'read':   ('managers', 'users', 'guests',),
   201         'read':   ('managers', 'users', 'guests',),
   222         'add':    ('managers', 'users'),
   202         'add':    ('managers', 'users'),
   223         'delete': ('managers', 'owners'),
   203         'delete': ('managers', 'owners'),
   224         }
   204         }
   225     cardinality = '*1'
   205     cardinality = '*1'
   226     symetric = True
   206     symmetric = True
   227     # NOTE: the 'object = ExternalUri' declaration will still be mandatory
   207     # NOTE: the 'object = ExternalUri' declaration will still be mandatory
   228     #       in the cube's schema.
   208     #       in the cube's schema.
   229     object = 'ExternalUri'
   209     object = 'ExternalUri'
   230 
   210 
   231 class CWCache(EntityType):
   211 class CWCache(EntityType):
   235     The target application is responsible for updating timestamp
   215     The target application is responsible for updating timestamp
   236     when necessary to invalidate the cache (typically in hooks).
   216     when necessary to invalidate the cache (typically in hooks).
   237 
   217 
   238     Also, checkout the AppObject.get_cache() method.
   218     Also, checkout the AppObject.get_cache() method.
   239     """
   219     """
   240     permissions = {
   220     __permissions__ = {
   241         'read':   ('managers', 'users', 'guests'),
   221         'read':   ('managers', 'users', 'guests'),
   242         'add':    ('managers',),
   222         'add':    ('managers',),
   243         'update': ('managers', 'users',), # XXX
   223         'update': ('managers', 'users',), # XXX
   244         'delete': ('managers',),
   224         'delete': ('managers',),
   245         }
   225         }
   251 
   231 
   252 # "abtract" relation types, not used in cubicweb itself
   232 # "abtract" relation types, not used in cubicweb itself
   253 
   233 
   254 class identical_to(RelationType):
   234 class identical_to(RelationType):
   255     """identical to"""
   235     """identical to"""
   256     symetric = True
   236     symmetric = True
   257     permissions = {
   237     __permissions__ = {
   258         'read':   ('managers', 'users', 'guests',),
   238         'read':   ('managers', 'users', 'guests',),
   259         # XXX should have update permissions on both subject and object,
   239         # XXX should have update __permissions__ on both subject and object,
   260         #     though by doing this we will probably have no way to add
   240         #     though by doing this we will probably have no way to add
   261         #     this relation in the web ui. The easiest way to acheive this
   241         #     this relation in the web ui. The easiest way to acheive this
   262         #     is probably to be able to have "U has_update_permission O" as
   242         #     is probably to be able to have "U has_update_permission O" as
   263         #     RQLConstraint of the relation definition, though this is not yet
   243         #     RQLConstraint of the relation definition, though this is not yet
   264         #     possible
   244         #     possible
   266         'delete': ('managers', RRQLExpression('U has_update_permission S'),),
   246         'delete': ('managers', RRQLExpression('U has_update_permission S'),),
   267         }
   247         }
   268 
   248 
   269 class see_also(RelationType):
   249 class see_also(RelationType):
   270     """generic relation to link one entity to another"""
   250     """generic relation to link one entity to another"""
   271     symetric = True
   251     symmetric = True
   272     permissions = {
   252     __permissions__ = {
   273         'read':   ('managers', 'users', 'guests',),
   253         'read':   ('managers', 'users', 'guests',),
   274         'add':    ('managers', RRQLExpression('U has_update_permission S'),),
   254         'add':    ('managers', RRQLExpression('U has_update_permission S'),),
   275         'delete': ('managers', RRQLExpression('U has_update_permission S'),),
   255         'delete': ('managers', RRQLExpression('U has_update_permission S'),),
   276         }
   256         }