Produits Entr'ouvert » Authentic 2

class RoleParentForm(LimitQuerysetFormMixin, CssClass, forms.Form):

    role = fields.ChooseManageableMemberRoleField(label=_('Add some roles'))

    action = forms.CharField(initial='add', widget=forms.HiddenInput)

from django.db.models import BooleanField, Count, ExpressionWrapper, F, Prefetch

from django.db.models.functions import Cast

from django_rbac.utils import get_ou_model, get_permission_model, get_role_model, get_role_parenting_model

class RoleAddChildView(RoleViewMixin, views.HideOUColumnMixin, views.BaseSubTableView):

    form_class = forms.ChooseRoleForm

    table_class = tables.InheritanceRolesTable

    search_form_class = forms.RoleSearchForm

    template_name = 'authentic2/manager/roles_inheritance.html'

    success_url = '.'

    slug_field = 'uuid'

    def get_table_queryset(self):

        qs = super().get_table_queryset()

        qs = qs.exclude(pk=self.object.pk)

        children = self.object.children(annotate=True, include_self=False)

        children = children.annotate(is_direct=Cast('direct', output_field=BooleanField()))

        qs = qs.annotate(

            checked=ExpressionWrapper(Q(pk__in=children.filter(is_direct=True)), output_field=BooleanField())

        )

        qs = qs.annotate(

            indeterminate=ExpressionWrapper(

                Q(pk__in=children.filter(is_direct=False)), output_field=BooleanField()

            )

        )

        RoleParenting = get_role_parenting_model()

        rp_qs = RoleParenting.objects.filter(parent__in=children).annotate(name=F('parent__name'))

        qs = qs.prefetch_related(Prefetch('parent_relation', queryset=rp_qs, to_attr='via'))

        return qs

        role = form.cleaned_data['role']

        action = form.cleaned_data['action']

        if action == 'add':

            self.object.add_child(role)

                'event', name='manager-add-child-role', user=self.request.user, parent=self.object, child=role

            self.request.journal.record('manager.role.inheritance.addition', parent=self.object, child=role)

        elif action == 'remove':

            self.object.remove_child(role)

            hooks.call_hooks(

                'event',

                name='manager-remove-child-role',

                user=self.request.user,

                parent=self.object,

                child=role,

            )

            self.request.journal.record('manager.role.inheritance.removal', parent=self.object, child=role)

    def get_search_form_kwargs(self):

        kwargs = super().get_search_form_kwargs()

        kwargs['show_all_ou'] = app_settings.SHOW_ALL_OU

        kwargs['queryset'] = self.request.user.filter_by_perm(

            'a2_rbac.view_role', get_role_model().objects.all()

        )

        return kwargs

class RoleAddParentView(RoleViewMixin, views.HideOUColumnMixin, views.BaseSubTableView):

    form_class = forms.RoleParentForm

    table_class = tables.InheritanceRolesTable

    search_form_class = forms.RoleSearchForm

    template_name = 'authentic2/manager/roles_inheritance.html'

    success_url = '.'

    slug_field = 'uuid'

        if self.get_object().is_internal():

    def get_table_queryset(self):

        qs = super().get_table_queryset()

        qs = self.request.user.filter_by_perm('a2_rbac.manage_members_role', qs)

        qs = qs.exclude(pk=self.object.pk)

        parents = self.object.parents(annotate=True, include_self=False)

        parents = parents.annotate(is_direct=Cast('direct', output_field=BooleanField()))

        qs = qs.annotate(

            checked=ExpressionWrapper(Q(pk__in=parents.filter(is_direct=True)), output_field=BooleanField())

        )

        qs = qs.annotate(

            indeterminate=ExpressionWrapper(

                Q(pk__in=parents.filter(is_direct=False)), output_field=BooleanField()

            )

        )

        RoleParenting = get_role_parenting_model()

        rp_qs = RoleParenting.objects.filter(child__in=parents).annotate(name=F('child__name'))

        qs = qs.prefetch_related(Prefetch('child_relation', queryset=rp_qs, to_attr='via'))

        return qs

        role = form.cleaned_data['role']

        action = form.cleaned_data['action']

        if action == 'add':

            self.object.add_parent(role)

            hooks.call_hooks(

                'event', name='manager-add-child-role', user=self.request.user, parent=role, child=self.object

            )

            self.request.journal.record('manager.role.inheritance.addition', parent=role, child=self.object)

        elif action == 'remove':

            self.object.remove_parent(role)

                'event',

                name='manager-remove-child-role',

                user=self.request.user,

                parent=role,

                child=self.object,

            self.request.journal.record('manager.role.inheritance.removal', parent=role, child=self.object)

    def get_search_form_kwargs(self):

        kwargs = super().get_search_form_kwargs()

        kwargs['show_all_ou'] = app_settings.SHOW_ALL_OU

        kwargs['queryset'] = self.request.user.filter_by_perm(

            'a2_rbac.manage_members_role', get_role_model().objects.all()

        )

        return kwargs

class InheritanceRolesTable(tables.Table):

    name = tables.LinkColumn(

        viewname='a2-manager-role-members', kwargs={'pk': A('pk')}, accessor='name', verbose_name=_('label')

    )

    via = tables.TemplateColumn(

        '''{% for rel in record.via %}{{ rel.name }} {% if not forloop.last %}, {% endif %}{% endfor %}''',

        verbose_name=_('Inherited from'),

        orderable=False,

    )

    member = tables.TemplateColumn(

        '<input class="role-member{% if record.indeterminate %} indeterminate{% endif %}" name="role-{{ record.pk }}" type="checkbox" {% if record.checked %}checked{% endif %}/>',

        verbose_name='',

    )

    class Meta:

        model = get_role_model()

        attrs = {'class': 'main plaintable', 'id': 'inheritance-role-table'}

        fields = ('name', 'ou')

        empty_text = _('None')

    <a href="{% url "a2-manager-role-add-child" pk=object.pk %}" class="role-add icon-add-sign"></a>

     <a href="{% url "a2-manager-role-add-parent" pk=object.pk %}" class="role-add icon-add-sign"></a>

{% extends "authentic2/manager/role_common.html" %}

{% load i18n static django_tables2 %}

{% block breadcrumb %}

  {{ block.super }}

  <a href="..">{{ object }}</a>

  <a href="#">{% trans "Role inheritance" %}</a>

{% endblock %}

{% block extrascripts %}

  {{ block.super }}

  <script src="{% static "authentic2/manager/js/roles_ajax_checkbox.js" %}"></script>

{% endblock %}

{% block main %}

 {% with row_link=0 %}

   {% render_table table "authentic2/manager/table.html" %}

 {% endwith %}

{% endblock %}

{% block sidebar %}

  <aside id="sidebar">

    {% include "authentic2/manager/search_form.html" %}

  </aside>

{% endblock %}

{% load static django_tables2 %}

    from authentic2.manager.forms import RoleParentForm

    form = RoleParentForm(request=None)

    field_id = form.fields['role'].widget.build_attrs({})['data-field_id']

    token = str(response.context['csrf_token'])

    params = {'action': 'add', 'role': role.pk, 'csrfmiddlewaretoken': token}

    response = app.post('/manage/roles/%s/add-child/' % simple_role.pk, params=params)

    response = app.get('/manage/roles/%s/' % simple_role.pk)

    token = str(response.context['csrf_token'])

    params = {'action': 'add', 'role': simple_role.pk, 'csrfmiddlewaretoken': token}

    response = app.post('/manage/roles/%s/add-parent/' % role.pk, params=params)

    # try to add arbitrary role

    admin_role = Role.objects.get(slug='_a2-manager')

    response = app.get('/manage/roles/%s/add-parent/' % role.pk)

    token = str(response.context['csrf_token'])

    params = {'action': 'add', 'role': admin_role.pk, 'csrfmiddlewaretoken': token}

    response = app.post('/manage/roles/%s/add-parent/' % simple_role.pk, params=params)

    assert admin_role not in role.parents()

    response = app.get('/manage/roles/%s/' % simple_role.pk)

        RoleParentForm,

    form = RoleParentForm(request=request, data={'role': visible_role.pk, 'action': 'add'})

    assert error_message in form.errors['role'][0]

    form = RoleParentForm(request=request, data={'role': visible_role.pk, 'action': 'add'})

def test_manager_role_inheritance_list(app, simple_user, simple_role, ou1):

    visible_role_2 = Role.objects.create(name='visible_role_2', ou=ou1)

    for role in (visible_role, visible_role_2):

        view_role_perm = get_permission_model().objects.create(

            operation=get_operation(VIEW_OP),

            target_ct=ContentType.objects.get_for_model(Role),

            target_id=role.pk,

        )

        simple_role.permissions.add(view_role_perm)

    # all visible roles are shown, except current role

    q = response.pyquery.remove_namespaces()

    assert len(q('table tbody tr')) == 2

    assert {e.text_content() for e in q('table tbody td.name')} == {visible_role.name, visible_role_2.name}

    # filter by ou

    response.form['search-ou'] = ou1.pk

    response = response.form.submit()

    q = response.pyquery.remove_namespaces()

    assert len(q('table tbody tr')) == 1

    assert {e.text_content() for e in q('table tbody td.name')} == {visible_role_2.name}

    # filter by name

    response.form['search-text'] = '2'

    response.form['search-ou'] = 'all'

    response = response.form.submit()

    q = response.pyquery.remove_namespaces()

    assert len(q('table tbody tr')) == 1

    assert {e.text_content() for e in q('table tbody td.name')} == {visible_role_2.name}

    # all roles with manage_members permissions are shown

    response = app.get('/manage/roles/%s/add-parent/' % visible_role.pk)

    q = response.pyquery.remove_namespaces()

    assert len(q('table tbody tr')) == 1

    assert {e.text_content() for e in q('table tbody td.name')} == {simple_role.name}

    response.form['search-internals'] = True

    response = response.form.submit()

    q = response.pyquery.remove_namespaces()

    assert len(q('table tbody tr')) == 2

    assert {e.text_content() for e in q('table tbody td.name')} == {

        simple_role.name,

        admin_of_simple_role.name,

    }