# copyright 2003-2010 LOGILAB S.A. (Paris, FRANCE), all rights reserved.
# contact http://www.logilab.fr/ -- mailto:contact@logilab.fr
#
# This file is part of CubicWeb.
#
# CubicWeb is free software: you can redistribute it and/or modify it under the
# terms of the GNU Lesser General Public License as published by the Free
# Software Foundation, either version 2.1 of the License, or (at your option)
# any later version.
#
# CubicWeb is distributed in the hope that it will be useful, but WITHOUT
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
# FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more
# details.
#
# You should have received a copy of the GNU Lesser General Public License along
# with CubicWeb. If not, see <http://www.gnu.org/licenses/>.
"""some utilities to define schema permissions
"""
__docformat__ = "restructuredtext en"
from rql.utils import quote
from cubicweb.schema import RO_REL_PERMS, RO_ATTR_PERMS, \
PUB_SYSTEM_ENTITY_PERMS, PUB_SYSTEM_REL_PERMS, \
ERQLExpression, RRQLExpression
# permissions for "meta" entity type (readable by anyone, can only be
# added/deleted by managers)
META_ETYPE_PERMS = PUB_SYSTEM_ENTITY_PERMS # XXX deprecates
# permissions for "meta" relation type (readable by anyone, can only be
# added/deleted by managers)
META_RTYPE_PERMS = PUB_SYSTEM_REL_PERMS # XXX deprecates
# permissions for relation type that should only set by hooks using unsafe
# execute, readable by anyone
HOOKS_RTYPE_PERMS = RO_REL_PERMS # XXX deprecates
def _perm(names):
if isinstance(names, (list, tuple)):
if len(names) == 1:
names = quote(names[0])
else:
names = 'IN (%s)' % (','.join(quote(name) for name in names))
else:
names = quote(names)
#return u' require_permission P, P name %s, U in_group G, P require_group G' % names
return u' require_permission P, P name %s, U has_group_permission P' % names
def xperm(*names):
return 'X' + _perm(names)
def xexpr(*names):
return ERQLExpression(xperm(*names))
def xrexpr(relation, *names):
return ERQLExpression('X %s Y, Y %s' % (relation, _perm(names)))
def xorexpr(relation, etype, *names):
return ERQLExpression('Y %s X, X is %s, Y %s' % (relation, etype, _perm(names)))
def sexpr(*names):
return RRQLExpression('S' + _perm(names), 'S')
def restricted_sexpr(restriction, *names):
rql = '%s, %s' % (restriction, 'S' + _perm(names))
return RRQLExpression(rql, 'S')
def restricted_oexpr(restriction, *names):
rql = '%s, %s' % (restriction, 'O' + _perm(names))
return RRQLExpression(rql, 'O')
def oexpr(*names):
return RRQLExpression('O' + _perm(names), 'O')
# def supdate_perm():
# return RRQLExpression('U has_update_permission S', 'S')
# def oupdate_perm():
# return RRQLExpression('U has_update_permission O', 'O')
def relxperm(rel, role, *names):
assert role in ('subject', 'object')
if role == 'subject':
zxrel = ', X %s Z' % rel
else:
zxrel = ', Z %s X' % rel
return 'Z' + _perm(names) + zxrel
def relxexpr(rel, role, *names):
return ERQLExpression(relxperm(rel, role, *names))