quay/data/model/permission.py

from peewee import JOIN

from data.database import (RepositoryPermission, User, Repository, Visibility, Role, TeamMember,
                           PermissionPrototype, Team, TeamRole, Namespace)
from data.model import DataModelException, _basequery
from util.names import parse_robot_username

def list_team_permissions(team):
  return (RepositoryPermission
          .select(RepositoryPermission)
          .join(Repository)
          .join(Visibility)
          .switch(RepositoryPermission)
          .join(Role)
          .switch(RepositoryPermission)
          .where(RepositoryPermission.team == team))


def list_robot_permissions(robot_name):
  return (RepositoryPermission
          .select(RepositoryPermission, User, Repository)
          .join(Repository)
          .join(Visibility)
          .switch(RepositoryPermission)
          .join(Role)
          .switch(RepositoryPermission)
          .join(User)
          .where(User.username == robot_name, User.robot == True))


def list_organization_member_permissions(organization, limit_to_user=None):
  query = (RepositoryPermission
           .select(RepositoryPermission, Repository, User)
           .join(Repository)
           .switch(RepositoryPermission)
           .join(User)
           .where(Repository.namespace_user == organization))

  if limit_to_user is not None:
    query = query.where(RepositoryPermission.user == limit_to_user)
  else:
    query = query.where(User.robot == False)

  return query


def get_all_user_repository_permissions(user):
  return _get_user_repo_permissions(user)


def get_user_repo_permissions(user, repo):
  return _get_user_repo_permissions(user, limit_to_repository_obj=repo)


def get_user_repository_permissions(user, namespace, repo_name):
  return _get_user_repo_permissions(user, limit_namespace=namespace, limit_repo_name=repo_name)


def _get_user_repo_permissions(user, limit_to_repository_obj=None, limit_namespace=None,
                               limit_repo_name=None):
  UserThroughTeam = User.alias()

  base_query = (RepositoryPermission
                .select(RepositoryPermission, Role, Repository, Namespace)
                .join(Role)
                .switch(RepositoryPermission)
                .join(Repository)
                .join(Namespace, on=(Repository.namespace_user == Namespace.id))
                .switch(RepositoryPermission))

  if limit_to_repository_obj is not None:
    base_query = base_query.where(RepositoryPermission.repository == limit_to_repository_obj)
  elif limit_namespace and limit_repo_name:
    base_query = base_query.where(Repository.name == limit_repo_name,
                                  Namespace.username == limit_namespace)

  direct = (base_query
            .clone()
            .join(User)
            .where(User.id == user))

  team = (base_query
          .clone()
          .join(Team)
          .join(TeamMember)
          .join(UserThroughTeam, on=(UserThroughTeam.id == TeamMember.user))
          .where(UserThroughTeam.id == user))

  return direct | team


def delete_prototype_permission(org, uid):
  found = get_prototype_permission(org, uid)
  if not found:
    return None

  found.delete_instance()
  return found


def get_prototype_permission(org, uid):
  try:
    return PermissionPrototype.get(PermissionPrototype.org == org,
                                   PermissionPrototype.uuid == uid)
  except PermissionPrototype.DoesNotExist:
    return None


def get_prototype_permissions(org):
  ActivatingUser = User.alias()
  DelegateUser = User.alias()
  query = (PermissionPrototype
           .select()
           .where(PermissionPrototype.org == org)
           .join(ActivatingUser, JOIN.LEFT_OUTER,
                 on=(ActivatingUser.id == PermissionPrototype.activating_user))
           .join(DelegateUser, JOIN.LEFT_OUTER,
                 on=(DelegateUser.id == PermissionPrototype.delegate_user))
           .join(Team, JOIN.LEFT_OUTER,
                 on=(Team.id == PermissionPrototype.delegate_team))
           .join(Role, JOIN.LEFT_OUTER, on=(Role.id == PermissionPrototype.role)))
  return query


def update_prototype_permission(org, uid, role_name):
  found = get_prototype_permission(org, uid)
  if not found:
    return None

  new_role = Role.get(Role.name == role_name)
  found.role = new_role
  found.save()
  return found


def add_prototype_permission(org, role_name, activating_user,
                             delegate_user=None, delegate_team=None):
  new_role = Role.get(Role.name == role_name)
  return PermissionPrototype.create(org=org, role=new_role, activating_user=activating_user,
                                    delegate_user=delegate_user, delegate_team=delegate_team)


def get_org_wide_permissions(user, org_filter=None):
  Org = User.alias()
  team_with_role = Team.select(Team, Org, TeamRole).join(TeamRole)
  with_org = team_with_role.switch(Team).join(Org, on=(Team.organization ==
                                                       Org.id))
  with_user = with_org.switch(Team).join(TeamMember).join(User)

  if org_filter:
    with_user.where(Org.username == org_filter)

  return with_user.where(User.id == user, Org.organization == True)


def get_all_repo_teams(namespace_name, repository_name):
  return (RepositoryPermission
          .select(Team.name, Role.name, RepositoryPermission)
          .join(Team)
          .switch(RepositoryPermission)
          .join(Role)
          .switch(RepositoryPermission)
          .join(Repository)
          .join(Namespace, on=(Repository.namespace_user == Namespace.id))
          .where(Namespace.username == namespace_name, Repository.name == repository_name))


def apply_default_permissions(repo_obj, creating_user_obj):
  org = repo_obj.namespace_user
  user_clause = ((PermissionPrototype.activating_user == creating_user_obj) |
                 (PermissionPrototype.activating_user >> None))

  team_protos = (PermissionPrototype
                 .select()
                 .where(PermissionPrototype.org == org, user_clause,
                        PermissionPrototype.delegate_user >> None))

  def create_team_permission(team, repo, role):
    RepositoryPermission.create(team=team, repository=repo, role=role)

  __apply_permission_list(repo_obj, team_protos, 'name', create_team_permission)

  user_protos = (PermissionPrototype
                 .select()
                 .where(PermissionPrototype.org == org, user_clause,
                        PermissionPrototype.delegate_team >> None))

  def create_user_permission(user, repo, role):
    # The creating user always gets admin anyway
    if user.username == creating_user_obj.username:
      return

    RepositoryPermission.create(user=user, repository=repo, role=role)

  __apply_permission_list(repo_obj, user_protos, 'username', create_user_permission)


def __apply_permission_list(repo, proto_query, name_property, create_permission_func):
  final_protos = {}
  for proto in proto_query:
    applies_to = proto.delegate_team or proto.delegate_user
    name = getattr(applies_to, name_property)
    # We will skip the proto if it is pre-empted by a more important proto
    if name in final_protos and proto.activating_user is None:
      continue

    # By this point, it is either a user specific proto, or there is no
    # proto yet, so we can safely assume it applies
    final_protos[name] = (applies_to, proto.role)

  for delegate, role in final_protos.values():
    create_permission_func(delegate, repo, role)


def __entity_permission_repo_query(entity_id, entity_table, entity_id_property, namespace_name,
                                   repository_name):
  """ This method works for both users and teams. """

  return (RepositoryPermission
          .select(entity_table, Repository, Namespace, Role, RepositoryPermission)
          .join(entity_table)
          .switch(RepositoryPermission)
          .join(Role)
          .switch(RepositoryPermission)
          .join(Repository)
          .join(Namespace, on=(Repository.namespace_user == Namespace.id))
          .where(Repository.name == repository_name, Namespace.username == namespace_name,
                 entity_id_property == entity_id))


def get_user_reponame_permission(username, namespace_name, repository_name):
  fetched = list(__entity_permission_repo_query(username, User, User.username, namespace_name,
                                                repository_name))
  if not fetched:
    raise DataModelException('User does not have permission for repo.')

  return fetched[0]


def get_team_reponame_permission(team_name, namespace_name, repository_name):
  fetched = list(__entity_permission_repo_query(team_name, Team, Team.name, namespace_name,
                                                repository_name))
  if not fetched:
    raise DataModelException('Team does not have permission for repo.')

  return fetched[0]


def delete_user_permission(username, namespace_name, repository_name):
  if username == namespace_name:
    raise DataModelException('Namespace owner must always be admin.')

  fetched = list(__entity_permission_repo_query(username, User, User.username, namespace_name,
                                                repository_name))
  if not fetched:
    raise DataModelException('User does not have permission for repo.')

  fetched[0].delete_instance()


def delete_team_permission(team_name, namespace_name, repository_name):
  fetched = list(__entity_permission_repo_query(team_name, Team, Team.name, namespace_name,
                                                repository_name))
  if not fetched:
    raise DataModelException('Team does not have permission for repo.')

  fetched[0].delete_instance()


def __set_entity_repo_permission(entity, permission_entity_property,
                                 namespace_name, repository_name, role_name):
  repo = _basequery.get_existing_repository(namespace_name, repository_name)
  new_role = Role.get(Role.name == role_name)

  # Fetch any existing permission for this entity on the repo
  try:
    entity_attr = getattr(RepositoryPermission, permission_entity_property)
    perm = RepositoryPermission.get(entity_attr == entity, RepositoryPermission.repository == repo)
    perm.role = new_role
    perm.save()
    return perm
  except RepositoryPermission.DoesNotExist:
    set_entity_kwargs = {permission_entity_property: entity}
    new_perm = RepositoryPermission.create(repository=repo, role=new_role, **set_entity_kwargs)
    return new_perm


def set_user_repo_permission(username, namespace_name, repository_name, role_name):
  if username == namespace_name:
    raise DataModelException('Namespace owner must always be admin.')

  try:
    user = User.get(User.username == username)
  except User.DoesNotExist:
    raise DataModelException('Invalid username: %s' % username)

  if user.robot:
    parts = parse_robot_username(user.username)
    if not parts:
      raise DataModelException('Invalid robot: %s' % username)

    robot_namespace, _ = parts
    if robot_namespace != namespace_name:
      raise DataModelException('Cannot add robot %s under namespace %s' %
                               (username, namespace_name))

  return __set_entity_repo_permission(user, 'user', namespace_name, repository_name, role_name)


def set_team_repo_permission(team_name, namespace_name, repository_name, role_name):
  try:
    team = (Team
            .select()
            .join(User)
            .where(Team.name == team_name, User.username == namespace_name)
            .get())
  except Team.DoesNotExist:
    raise DataModelException('No team %s in organization %s' % (team_name, namespace_name))

  return __set_entity_repo_permission(team, 'team', namespace_name, repository_name, role_name)