<s> from __future__ import absolute_import , unicode_literals <EOL> from django . contrib . auth import get_user_model <EOL> from django . contrib . auth . models import Group , Permission <EOL> from django . core . exceptions import FieldDoesNotExist , ImproperlyConfigured <EOL> from django . db . models import Q <EOL> from wagtail . wagtailcore . models import Collection , GroupCollectionPermission <EOL> from . base import BaseDjangoAuthPermissionPolicy <EOL> class CollectionPermissionLookupMixin ( object ) : <EOL> def _get_permission_objects_for_actions ( self , actions ) : <EOL> """<STR_LIT>""" <EOL> permission_codenames = [ '<STR_LIT>' % ( action , self . model_name ) for action in actions ] <EOL> return Permission . objects . filter ( <EOL> content_type = self . _content_type , <EOL> codename__in = permission_codenames <EOL> ) <EOL> def _check_perm ( self , user , actions , collection = None ) : <EOL> """<STR_LIT>""" <EOL> if not ( user . is_active and user . is_authenticated ( ) ) : <EOL> return False <EOL> if user . is_superuser : <EOL> return True <EOL> collection_permissions = GroupCollectionPermission . objects . filter ( <EOL> group__user = user , <EOL> permission__in = self . _get_permission_objects_for_actions ( actions ) , <EOL> ) <EOL> if collection : <EOL> collection_permissions = collection_permissions . filter ( <EOL> collection__in = collection . get_ancestors ( inclusive = True ) <EOL> ) <EOL> return collection_permissions . exists ( ) <EOL> def _collections_with_perm ( self , user , actions ) : <EOL> """<STR_LIT>""" <EOL> permissions = self . _get_permission_objects_for_actions ( actions ) <EOL> collection_root_paths = Collection . objects . filter ( <EOL> group_permissions__group__in = user . groups . all ( ) , <EOL> group_permissions__permission__in = permissions <EOL> ) . values_list ( '<STR_LIT:path>' , flat = True ) <EOL> if collection_root_paths : <EOL> collection_path_filter = Q ( path__startswith = collection_root_paths [ <NUM_LIT:0> ] ) <EOL> for path in collection_root_paths [ <NUM_LIT:1> : ] : <EOL> collection_path_filter = collection_path_filter | Q ( path__startswith = path ) <EOL> return Collection . objects . filter ( collection_path_filter ) <EOL> else : <EOL> return Collection . objects . none ( ) <EOL> def _users_with_perm_filter ( self , actions , collection = None ) : <EOL> """<STR_LIT>""" <EOL> permissions = self . _get_permission_objects_for_actions ( actions ) <EOL> groups = Group . objects . filter ( <EOL> collection_permissions__permission__in = permissions , <EOL> ) <EOL> if collection is not None : <EOL> collections = collection . get_ancestors ( inclusive = True ) <EOL> groups = groups . filter ( <EOL> collection_permissions__collection__in = collections <EOL> ) <EOL> return ( Q ( is_superuser = True ) | Q ( groups__in = groups ) ) & Q ( is_active = True ) <EOL> def _users_with_perm ( self , actions , collection = None ) : <EOL> """<STR_LIT>""" <EOL> return get_user_model ( ) . objects . filter ( <EOL> self . _users_with_perm_filter ( actions , collection = collection ) <EOL> ) . distinct ( ) <EOL> def collections_user_has_permission_for ( self , user , action ) : <EOL> """<STR_LIT>""" <EOL> return self . collections_user_has_any_permission_for ( user , [ action ] ) <EOL> class CollectionPermissionPolicy ( CollectionPermissionLookupMixin , BaseDjangoAuthPermissionPolicy ) : <EOL> """<STR_LIT>""" <EOL> def user_has_permission ( self , user , action ) : <EOL> """<STR_LIT>""" <EOL> return self . _check_perm ( user , [ action ] ) <EOL> def user_has_any_permission ( self , user , actions ) : <EOL> """<STR_LIT>""" <EOL> return self . _check_perm ( user , actions ) <EOL> def users_with_any_permission ( self , actions ) : <EOL> """<STR_LIT>""" <EOL> return self . _users_with_perm ( actions ) <EOL> def user_has_permission_for_instance ( self , user , action , instance ) : <EOL> """<STR_LIT>""" <EOL> return self . _check_perm ( user , [ action ] , collection = instance . collection ) <EOL> def user_has_any_permission_for_instance ( self , user , actions , instance ) : <EOL> """<STR_LIT>""" <EOL> return self . _check_perm ( user , actions , collection = instance . collection ) <EOL> def instances_user_has_any_permission_for ( self , user , actions ) : <EOL> """<STR_LIT>""" <EOL> if not ( user . is_active and user . is_authenticated ( ) ) : <EOL> return self . model . objects . none ( ) <EOL> elif user . is_superuser : <EOL> return self . model . objects . all ( ) <EOL> else : <EOL> return self . model . objects . filter ( <EOL> collection__in = list ( self . _collections_with_perm ( user , actions ) ) <EOL> ) <EOL> def users_with_any_permission_for_instance ( self , actions , instance ) : <EOL> """<STR_LIT>""" <EOL> return self . _users_with_perm ( actions , collection = instance . collection ) <EOL> def collections_user_has_any_permission_for ( self , user , actions ) : <EOL> """<STR_LIT>""" <EOL> if user . is_active and user . is_superuser : <EOL> return Collection . objects . all ( ) <EOL> elif not user . is_authenticated ( ) : <EOL> return Collection . objects . none ( ) <EOL> else : <EOL> return self . _collections_with_perm ( user , actions ) <EOL> class CollectionOwnershipPermissionPolicy ( <EOL> CollectionPermissionLookupMixin , BaseDjangoAuthPermissionPolicy <EOL> ) : <EOL> """<STR_LIT>""" <EOL> def __init__ ( self , model , auth_model = None , owner_field_name = '<STR_LIT>' ) : <EOL> super ( CollectionOwnershipPermissionPolicy , self ) . __init__ ( model , auth_model = auth_model ) <EOL> self . owner_field_name = owner_field_name <EOL> try : <EOL> self . model . _meta . get_field ( self . owner_field_name ) <EOL> except FieldDoesNotExist : <EOL> raise ImproperlyConfigured ( <EOL> "<STR_LIT>" <EOL> "<STR_LIT>" <EOL> "<STR_LIT>" <EOL> % ( self . model , self . owner_field_name ) <EOL> ) <EOL> def user_has_permission ( self , user , action ) : <EOL> if action == '<STR_LIT>' : <EOL> return self . _check_perm ( user , [ '<STR_LIT>' ] ) <EOL> elif action == '<STR_LIT>' or action == '<STR_LIT>' : <EOL> return self . _check_perm ( user , [ '<STR_LIT>' , '<STR_LIT>' ] ) <EOL> else : <EOL> return user . is_active and user . is_superuser <EOL> def users_with_any_permission ( self , actions ) : <EOL> if '<STR_LIT>' in actions or '<STR_LIT>' in actions : <EOL> real_actions = [ '<STR_LIT>' , '<STR_LIT>' ] <EOL> elif '<STR_LIT>' in actions : <EOL> real_actions = [ '<STR_LIT>' ] <EOL> else : <EOL> return get_user_model ( ) . objects . filter ( is_active = True , is_superuser = True ) <EOL> return self . _users_with_perm ( real_actions ) <EOL> def user_has_permission_for_instance ( self , user , action , instance ) : <EOL> return self . user_has_any_permission_for_instance ( user , [ action ] , instance ) <EOL> def user_has_any_permission_for_instance ( self , user , actions , instance ) : <EOL> if '<STR_LIT>' in actions or '<STR_LIT>' in actions : <EOL> if self . _check_perm ( user , [ '<STR_LIT>' ] , collection = instance . collection ) : <EOL> return True <EOL> elif ( <EOL> self . _check_perm ( user , [ '<STR_LIT>' ] , collection = instance . collection ) and <EOL> getattr ( instance , self . owner_field_name ) == user <EOL> ) : <EOL> return True <EOL> else : <EOL> return False <EOL> else : <EOL> return user . is_active and user . is_superuser <EOL> def instances_user_has_any_permission_for ( self , user , actions ) : <EOL> if user . is_active and user . is_superuser : <EOL> return self . model . objects . all ( ) <EOL> elif not user . is_authenticated ( ) : <EOL> return self . model . objects . none ( ) <EOL> elif '<STR_LIT>' in actions or '<STR_LIT>' in actions : <EOL> change_perm_filter = Q ( <EOL> collection__in = list ( self . _collections_with_perm ( user , [ '<STR_LIT>' ] ) ) <EOL> ) <EOL> add_perm_filter = Q ( <EOL> collection__in = list ( self . _collections_with_perm ( user , [ '<STR_LIT>' ] ) ) <EOL> ) & Q ( ** { self . owner_field_name : user } ) <EOL> return self . model . objects . filter ( change_perm_filter | add_perm_filter ) <EOL> else : <EOL> return self . model . objects . none ( ) <EOL> def users_with_any_permission_for_instance ( self , actions , instance ) : <EOL> if '<STR_LIT>' in actions or '<STR_LIT>' in actions : <EOL> filter_expr = self . _users_with_perm_filter ( <EOL> [ '<STR_LIT>' ] , collection = instance . collection <EOL> ) <EOL> owner = getattr ( instance , self . owner_field_name ) <EOL> if owner is not None and self . _check_perm ( <EOL> owner , [ '<STR_LIT>' ] , collection = instance . collection <EOL> ) : <EOL> filter_expr = filter_expr | Q ( pk = owner . pk ) <EOL> return get_user_model ( ) . objects . filter ( filter_expr ) . distinct ( ) <EOL> else : <EOL> return get_user_model ( ) . objects . filter ( is_active = True , is_superuser = True ) <EOL> def collections_user_has_any_permission_for ( self , user , actions ) : <EOL> """<STR_LIT>""" <EOL> if user . is_active and user . is_superuser : <EOL> return Collection . objects . all ( ) <EOL> elif not user . is_authenticated ( ) : <EOL> return Collection . objects . none ( ) <EOL> elif '<STR_LIT>' in actions or '<STR_LIT>' in actions : <EOL> return self . _collections_with_perm ( user , [ '<STR_LIT>' , '<STR_LIT>' ] ) <EOL> elif '<STR_LIT>' in actions : <EOL> return self . _collections_with_perm ( user , [ '<STR_LIT>' ] ) <EOL> else : <EOL> return Collection . objects . none ( ) </s>
