<s> from biicode . common . exception import NotInStoreException , ForbiddenException , NotFoundException <EOL> from biicode . server . model . payment . user_subscription import CURRENT_PLANS <EOL> class PlanUpgradeNeeded ( ForbiddenException ) : <EOL> '''<STR_LIT>''' <EOL> pass <EOL> class PlanDowngradeNotAllowed ( ForbiddenException ) : <EOL> '''<STR_LIT>''' <EOL> pass <EOL> class SubscriptionError ( ForbiddenException ) : <EOL> '''<STR_LIT>''' <EOL> pass <EOL> class Security ( object ) : <EOL> '''<STR_LIT>''' <EOL> def __init__ ( self , auth_user , store ) : <EOL> """<STR_LIT>""" <EOL> self . auth_user = auth_user <EOL> self . _store = store <EOL> def check_act_as_admin_of ( self , brl_user ) : <EOL> if self . auth_user != brl_user and self . _can_act_as_admin_of ( brl_user ) is not True : <EOL> raise ForbiddenException ( "<STR_LIT>" % brl_user ) <EOL> return <EOL> check_read_user_subscription = check_act_as_admin_of <EOL> check_update_card = check_act_as_admin_of <EOL> check_handle_coupons = check_act_as_admin_of <EOL> def check_are_own_user ( self , brl_user ) : <EOL> """<STR_LIT>""" <EOL> if brl_user != self . auth_user : <EOL> raise ForbiddenException ( "<STR_LIT>" ) <EOL> return <EOL> def check_can_change_current_subscription ( self , brl_user , plan_id ) : <EOL> self . check_act_as_admin_of ( brl_user ) <EOL> dest_plan = CURRENT_PLANS [ plan_id ] <EOL> if not dest_plan [ "<STR_LIT>" ] : <EOL> raise ForbiddenException ( "<STR_LIT>" ) <EOL> users , num_private_blocks = self . _get_subscription_utilisation_status ( brl_user ) <EOL> if dest_plan [ "<STR_LIT>" ] != - <NUM_LIT:1> : <EOL> if len ( users ) > dest_plan [ "<STR_LIT>" ] : <EOL> raise PlanDowngradeNotAllowed ( "<STR_LIT>" <EOL> "<STR_LIT>" % <EOL> ( len ( users ) , dest_plan [ "<STR_LIT>" ] ) ) <EOL> if dest_plan [ "<STR_LIT>" ] != - <NUM_LIT:1> : <EOL> if num_private_blocks > dest_plan [ "<STR_LIT>" ] : <EOL> raise PlanDowngradeNotAllowed ( "<STR_LIT>" <EOL> "<STR_LIT>" % <EOL> ( num_private_blocks , dest_plan [ "<STR_LIT>" ] ) ) <EOL> def check_subscription_limit_reached ( self , brl_user , brl_new_user = None ) : <EOL> contributors , num_private_blocks = self . _get_subscription_utilisation_status ( brl_user ) <EOL> user_subscription = self . _store . read_user_subscription ( brl_user ) <EOL> print user_subscription . max_users <EOL> if brl_new_user : <EOL> contributors . add ( brl_new_user ) <EOL> if len ( contributors ) > user_subscription . max_users : <EOL> more = "<STR_LIT>" if user_subscription . max_users > <NUM_LIT:0> else "<STR_LIT>" <EOL> raise PlanUpgradeNeeded ( "<STR_LIT>" % more ) <EOL> if user_subscription . max_private_blocks != - <NUM_LIT:1> : <EOL> if num_private_blocks > user_subscription . max_private_blocks : <EOL> self . raise_upgrade_blocks ( user_subscription ) <EOL> def raise_upgrade_blocks ( self , user_subscription ) : <EOL> more = "<STR_LIT>" if user_subscription . max_private_blocks > <NUM_LIT:0> else "<STR_LIT>" <EOL> raise PlanUpgradeNeeded ( "<STR_LIT>" % more ) <EOL> check_update_user = check_act_as_admin_of <EOL> check_change_password = check_act_as_admin_of <EOL> check_read_user_permissions = check_act_as_admin_of <EOL> def check_grant_administrator_for ( self , brl_user , brl_new_user ) : <EOL> self . check_act_as_admin_of ( brl_user ) <EOL> self . check_subscription_limit_reached ( brl_user , brl_new_user ) <EOL> def check_revoke_administrator_for ( self , brl_user ) : <EOL> return self . check_act_as_admin_of ( brl_user ) <EOL> def check_handle_block_permissions ( self , brl_block ) : <EOL> self . check_act_as_admin_of ( brl_block . owner ) <EOL> block_access = self . _store . read_block_permissions ( brl_block ) <EOL> if block_access . is_private : <EOL> self . check_subscription_limit_reached ( brl_block . owner ) <EOL> def check_grant_read_or_write_permissions_to ( self , brl_new_user , brl_block ) : <EOL> self . check_act_as_admin_of ( brl_block . owner ) <EOL> block_access = self . _store . read_block_permissions ( brl_block ) <EOL> if block_access . is_private : <EOL> self . check_subscription_limit_reached ( brl_block . owner , brl_new_user ) <EOL> def check_revoke_read_or_write_permissions_to ( self , brl_block ) : <EOL> self . check_act_as_admin_of ( brl_block . owner ) <EOL> def check_create_block ( self , brl_user , private = False ) : <EOL> self . check_act_as_admin_of ( brl_user ) <EOL> if private : <EOL> _ , num_private_blocks = self . _get_subscription_utilisation_status ( brl_user ) <EOL> user_subscription = self . _store . read_user_subscription ( brl_user ) <EOL> if user_subscription . max_private_blocks != - <NUM_LIT:1> : <EOL> if num_private_blocks + <NUM_LIT:1> > user_subscription . max_private_blocks : <EOL> self . raise_upgrade_blocks ( user_subscription ) <EOL> def check_make_private_a_block ( self , brl_user ) : <EOL> self . check_create_block ( brl_user , True ) <EOL> check_make_public_a_block = check_act_as_admin_of <EOL> def check_read_block ( self , brl_block ) : <EOL> block_access = self . _store . read_block_permissions ( brl_block ) <EOL> if block_access . is_private : <EOL> if not self . _read_granted ( brl_block , block_access ) : <EOL> raise ForbiddenException ( "<STR_LIT>" % ( brl_block ) ) <EOL> def check_write_block ( self , brl_block ) : <EOL> try : <EOL> block_access = self . _store . read_block_permissions ( brl_block ) <EOL> except NotFoundException : <EOL> return self . check_create_block ( brl_block . owner , False ) <EOL> if block_access . is_private : <EOL> self . check_subscription_limit_reached ( brl_block . owner ) <EOL> if self . _can_act_as_admin_of ( brl_block . owner ) is not True : <EOL> if not block_access . write . is_granted ( self . auth_user ) : <EOL> raise ForbiddenException ( "<STR_LIT>" % brl_block ) <EOL> def check_publish_block ( self , brl_block , publish_request ) : <EOL> self . check_write_block ( brl_block ) <EOL> user = self . _store . read_user ( publish_request . parent . block . owner ) <EOL> if user . blocks_bytes + publish_request . bytes > user . max_workspace_size : <EOL> raise ForbiddenException ( "<STR_LIT>" ) <EOL> def check_delete_block ( self , brl_block ) : <EOL> self . check_act_as_admin_of ( brl_block . owner ) <EOL> def check_read_blocks_permissions ( self , brl_block ) : <EOL> self . check_act_as_admin_of ( brl_block . owner ) <EOL> def is_private ( self , brl_block ) : <EOL> """<STR_LIT>""" <EOL> return self . _store . read_block_permissions ( brl_block ) . is_private <EOL> def _can_act_as_admin_of ( self , brl_user_owner ) : <EOL> """<STR_LIT>""" <EOL> if not self . auth_user : <EOL> return False <EOL> if brl_user_owner == self . auth_user : <EOL> return True <EOL> try : <EOL> admins = self . _store . read_user ( brl_user_owner ) . administrators <EOL> except NotInStoreException : <EOL> return False <EOL> return admins . is_granted ( self . auth_user ) <EOL> def _get_subscription_utilisation_status ( self , brl_user_owner ) : <EOL> """<STR_LIT>""" <EOL> admins = set ( self . _store . read_user ( brl_user_owner ) . administrators ) <EOL> users_granted = set ( [ ] ) <EOL> user = self . _store . read_user ( brl_user_owner ) <EOL> num_private_blocks = <NUM_LIT:0> <EOL> for brl_block in user . blocks . iterkeys ( ) : <EOL> perms = self . _store . read_block_permissions ( brl_block ) <EOL> if perms . is_private : <EOL> num_private_blocks += <NUM_LIT:1> <EOL> users_granted |= perms . write | perms . read <EOL> return admins . union ( users_granted ) , num_private_blocks <EOL> def _read_granted ( self , brl_block , block_access ) : <EOL> """<STR_LIT>""" <EOL> return ( block_access . write . is_granted ( self . auth_user ) or <EOL> block_access . read . is_granted ( self . auth_user ) or <EOL> self . _can_act_as_admin_of ( brl_block . owner ) ) </s>
