<s> """<STR_LIT>""" <EOL> import itertools <EOL> from flask import request , abort , _request_ctx_stack <EOL> try : <EOL> from flask import _app_ctx_stack <EOL> except ImportError : <EOL> _app_ctx_stack = None <EOL> try : <EOL> from flask . ext . login import current_user <EOL> except ImportError : <EOL> current_user = None <EOL> from . model import RoleMixin , UserMixin , anonymous <EOL> __all__ = [ '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' ] <EOL> connection_stack = _app_ctx_stack or _request_ctx_stack <EOL> class AccessControlList ( object ) : <EOL> """<STR_LIT>""" <EOL> def __init__ ( self ) : <EOL> self . _allowed = [ ] <EOL> self . _denied = [ ] <EOL> self . _exempt = [ ] <EOL> self . seted = False <EOL> def allow ( self , role , method , resource , with_children = True ) : <EOL> """<STR_LIT>""" <EOL> if with_children : <EOL> for r in role . get_children ( ) : <EOL> permission = ( r . get_name ( ) , method , resource ) <EOL> if not permission in self . _allowed : <EOL> self . _allowed . append ( permission ) <EOL> permission = ( role . get_name ( ) , method , resource ) <EOL> if not permission in self . _allowed : <EOL> self . _allowed . append ( permission ) <EOL> def deny ( self , role , method , resource , with_children = False ) : <EOL> """<STR_LIT>""" <EOL> if with_children : <EOL> for r in role . get_children ( ) : <EOL> permission = ( r . get_name ( ) , method , resource ) <EOL> if not permission in self . _denied : <EOL> self . _denied . append ( permission ) <EOL> permission = ( role . get_name ( ) , method , resource ) <EOL> if not permission in self . _denied : <EOL> self . _denied . append ( permission ) <EOL> def exempt ( self , view_func ) : <EOL> """<STR_LIT>""" <EOL> if not view_func in self . _exempt : <EOL> self . _exempt . append ( view_func ) <EOL> def is_allowed ( self , role , method , resource ) : <EOL> """<STR_LIT>""" <EOL> return ( role , method , resource ) in self . _allowed <EOL> def is_denied ( self , role , method , resource ) : <EOL> """<STR_LIT>""" <EOL> return ( role , method , resource ) in self . _denied <EOL> def is_exempt ( self , view_func ) : <EOL> """<STR_LIT>""" <EOL> return view_func in self . _exempt <EOL> class _RBACState ( object ) : <EOL> '''<STR_LIT>''' <EOL> def __init__ ( self , rbac , app ) : <EOL> self . rbac = rbac <EOL> self . app = app <EOL> class RBAC ( object ) : <EOL> """<STR_LIT>""" <EOL> def __init__ ( self , app = None , ** kwargs ) : <EOL> """<STR_LIT>""" <EOL> self . acl = AccessControlList ( ) <EOL> self . before_acl = { '<STR_LIT>' : [ ] , '<STR_LIT>' : [ ] } <EOL> self . _role_model = kwargs . get ( '<STR_LIT>' , RoleMixin ) <EOL> self . _user_model = kwargs . get ( '<STR_LIT>' , UserMixin ) <EOL> self . _user_loader = kwargs . get ( '<STR_LIT>' , lambda : current_user ) <EOL> self . permission_failed_hook = kwargs . get ( '<STR_LIT>' ) <EOL> if app is not None : <EOL> self . app = app <EOL> self . init_app ( app ) <EOL> else : <EOL> self . app = None <EOL> def init_app ( self , app ) : <EOL> """<STR_LIT>""" <EOL> app . config . setdefault ( '<STR_LIT>' , False ) <EOL> self . use_white = app . config [ '<STR_LIT>' ] <EOL> if not hasattr ( app , '<STR_LIT>' ) : <EOL> app . extensions = { } <EOL> app . extensions [ '<STR_LIT>' ] = _RBACState ( self , app ) <EOL> self . acl . allow ( anonymous , '<STR_LIT:GET>' , app . view_functions [ '<STR_LIT>' ] ) <EOL> app . before_first_request ( self . _setup_acl ) <EOL> app . before_request ( self . _authenticate ) <EOL> def as_role_model ( self , model_cls ) : <EOL> """<STR_LIT>""" <EOL> self . _role_model = model_cls <EOL> return model_cls <EOL> def as_user_model ( self , model_cls ) : <EOL> """<STR_LIT>""" <EOL> self . _user_model = model_cls <EOL> return model_cls <EOL> def set_role_model ( self , model ) : <EOL> """<STR_LIT>""" <EOL> self . _role_model = model <EOL> def set_user_model ( self , model ) : <EOL> """<STR_LIT>""" <EOL> self . _user_model = model <EOL> def set_user_loader ( self , loader ) : <EOL> """<STR_LIT>""" <EOL> self . _user_loader = loader <EOL> def set_hook ( self , hook ) : <EOL> """<STR_LIT>""" <EOL> self . permission_failed_hook = hook <EOL> def has_permission ( self , method , endpoint , user = None ) : <EOL> """<STR_LIT>""" <EOL> app = self . get_app ( ) <EOL> _user = user or self . _user_loader ( ) <EOL> roles = _user . get_roles ( ) <EOL> view_func = app . view_functions [ endpoint ] <EOL> return self . _check_permission ( roles , method , view_func ) <EOL> def check_perm ( self , role , method , callback = None ) : <EOL> def decorator ( view_func ) : <EOL> if not self . _check_permission ( [ role ] , method , view_func ) : <EOL> if callable ( callback ) : <EOL> callback ( ) <EOL> else : <EOL> self . _deny_hook ( ) <EOL> return view_func <EOL> return decorator <EOL> def user_loader ( self , loader ) : <EOL> self . _user_loader = loader <EOL> return loader <EOL> def allow ( self , roles , methods , with_children = True ) : <EOL> """<STR_LIT>""" <EOL> def decorator ( view_func ) : <EOL> _methods = [ m . upper ( ) for m in methods ] <EOL> for r , m , v in itertools . product ( roles , _methods , [ view_func ] ) : <EOL> self . before_acl [ '<STR_LIT>' ] . append ( ( r , m , v , with_children ) ) <EOL> return view_func <EOL> return decorator <EOL> def deny ( self , roles , methods , with_children = False ) : <EOL> """<STR_LIT>""" <EOL> def decorator ( view_func ) : <EOL> _methods = [ m . upper ( ) for m in methods ] <EOL> for r , m , v in itertools . product ( roles , _methods , [ view_func ] ) : <EOL> self . before_acl [ '<STR_LIT>' ] . append ( ( r , m , v , with_children ) ) <EOL> return view_func <EOL> return decorator <EOL> def exempt ( self , view_func ) : <EOL> """<STR_LIT>""" <EOL> self . acl . exempt ( view_func ) <EOL> return view_func <EOL> def get_app ( self , reference_app = None ) : <EOL> """<STR_LIT>""" <EOL> if reference_app is not None : <EOL> return reference_app <EOL> if self . app is not None : <EOL> return self . app <EOL> ctx = connection_stack . top <EOL> if ctx is not None : <EOL> return ctx . app <EOL> raise RuntimeError ( '<STR_LIT>' <EOL> '<STR_LIT>' <EOL> '<STR_LIT>' ) <EOL> def _authenticate ( self ) : <EOL> app = self . get_app ( ) <EOL> assert app , "<STR_LIT>" <EOL> assert self . _role_model , "<STR_LIT>" <EOL> assert self . _user_model , "<STR_LIT>" <EOL> assert self . _user_loader , "<STR_LIT>" <EOL> current_user = self . _user_loader ( ) <EOL> if not isinstance ( current_user , self . _user_model ) : <EOL> raise TypeError ( <EOL> "<STR_LIT>" % <EOL> ( current_user , self . _user_model . __class__ ) ) <EOL> endpoint = request . endpoint <EOL> resource = app . view_functions . get ( endpoint , None ) <EOL> if not resource : <EOL> abort ( <NUM_LIT> ) <EOL> method = request . method <EOL> if not hasattr ( current_user , '<STR_LIT>' ) : <EOL> roles = [ anonymous ] <EOL> else : <EOL> roles = current_user . get_roles ( ) <EOL> permit = self . _check_permission ( roles , method , resource ) <EOL> if not permit : <EOL> return self . _deny_hook ( ) <EOL> def _check_permission ( self , roles , method , resource ) : <EOL> if self . acl . is_exempt ( resource ) : <EOL> return True <EOL> if not self . acl . seted : <EOL> self . _setup_acl ( ) <EOL> _roles = set ( ) <EOL> _methods = set ( [ '<STR_LIT:*>' , method ] ) <EOL> _resources = set ( [ None , resource ] ) <EOL> if self . use_white : <EOL> _roles . add ( anonymous ) <EOL> is_allowed = None <EOL> _roles . update ( roles ) <EOL> for r , m , res in itertools . product ( _roles , _methods , _resources ) : <EOL> if self . acl . is_denied ( r . get_name ( ) , m , res ) : <EOL> return False <EOL> if self . acl . is_allowed ( r . get_name ( ) , m , res ) : <EOL> is_allowed = True <EOL> if self . use_white : <EOL> permit = ( is_allowed == True ) <EOL> else : <EOL> permit = ( is_allowed != False ) <EOL> return permit <EOL> def _deny_hook ( self ) : <EOL> if self . permission_failed_hook : <EOL> return self . permission_failed_hook ( ) <EOL> else : <EOL> abort ( <NUM_LIT> ) <EOL> def _setup_acl ( self ) : <EOL> for rn , method , resource , with_children in self . before_acl [ '<STR_LIT>' ] : <EOL> role = self . _role_model . get_by_name ( rn ) <EOL> self . acl . allow ( role , method , resource , with_children ) <EOL> for rn , method , resource , with_children in self . before_acl [ '<STR_LIT>' ] : <EOL> role = self . _role_model . get_by_name ( rn ) <EOL> self . acl . deny ( role , method , resource , with_children ) <EOL> self . acl . seted = True </s>
