def resources_with_perms(
        cls, instance, perms, resource_ids=None, resource_types=None, db_session=None
    ):
        """
        returns all resources that user has perms for
            (note that at least one perm needs to be met)

        :param instance:
        :param perms:
        :param resource_ids: restricts the search to specific resources
        :param resource_types:
        :param db_session:
        :return:
        """
        # owned entities have ALL permissions so we return those resources too
        # even without explict perms set
        # TODO: implement admin superrule perm - maybe return all apps
        db_session = get_db_session(db_session, instance)
        query = db_session.query(cls.models_proxy.Resource).distinct()
        group_ids = [gr.id for gr in instance.groups]
        # if user has some groups lets try to join based on their permissions
        if group_ids:
            join_conditions = (
                cls.models_proxy.GroupResourcePermission.group_id.in_(group_ids),
                cls.models_proxy.Resource.resource_id
                == cls.models_proxy.GroupResourcePermission.resource_id,
                cls.models_proxy.GroupResourcePermission.perm_name.in_(perms),
            )
            query = query.outerjoin(
                (cls.models_proxy.GroupResourcePermission, sa.and_(*join_conditions))
            )
            # ensure outerjoin permissions are correct -
            # dont add empty rows from join
            # conditions are - join ON possible group permissions
            # OR owning group/user
            query = query.filter(
                sa.or_(
                    cls.models_proxy.Resource.owner_user_id == instance.id,
                    cls.models_proxy.Resource.owner_group_id.in_(group_ids),
                    cls.models_proxy.GroupResourcePermission.perm_name != None,
                )  # noqa
            )
        else:
            # filter just by username
            query = query.filter(cls.models_proxy.Resource.owner_user_id == instance.id)
        # lets try by custom user permissions for resource
        query2 = db_session.query(cls.models_proxy.Resource).distinct()
        query2 = query2.filter(
            cls.models_proxy.UserResourcePermission.user_id == instance.id
        )
        query2 = query2.filter(
            cls.models_proxy.Resource.resource_id
            == cls.models_proxy.UserResourcePermission.resource_id
        )
        query2 = query2.filter(
            cls.models_proxy.UserResourcePermission.perm_name.in_(perms)
        )
        if resource_ids:
            query = query.filter(
                cls.models_proxy.Resource.resource_id.in_(resource_ids)
            )
            query2 = query2.filter(
                cls.models_proxy.Resource.resource_id.in_(resource_ids)
            )

        if resource_types:
            query = query.filter(
                cls.models_proxy.Resource.resource_type.in_(resource_types)
            )
            query2 = query2.filter(
                cls.models_proxy.Resource.resource_type.in_(resource_types)
            )
        query = query.union(query2)
        query = query.order_by(cls.models_proxy.Resource.resource_name)
        return query
def resources_with_perms ( cls , instance , perms , resource_ids = None , resource_types = None , db_session = None ) : db_session = get_db_session ( db_session , instance ) query = db_session . query ( cls . models_proxy . Resource ) . distinct ( ) group_ids = [ gr . id for gr in instance . groups ] if group_ids : join_conditions = ( cls . models_proxy . GroupResourcePermission . group_id . in_ ( group_ids ) , cls . models_proxy . Resource . resource_id == cls . models_proxy . GroupResourcePermission . resource_id , cls . models_proxy . GroupResourcePermission . perm_name . in_ ( perms ) , ) query = query . outerjoin ( ( cls . models_proxy . GroupResourcePermission , sa . and_ ( * join_conditions ) ) ) query = query . filter ( sa . or_ ( cls . models_proxy . Resource . owner_user_id == instance . id , cls . models_proxy . Resource . owner_group_id . in_ ( group_ids ) , cls . models_proxy . GroupResourcePermission . perm_name != None , ) ) else : query = query . filter ( cls . models_proxy . Resource . owner_user_id == instance . id ) query2 = db_session . query ( cls . models_proxy . Resource ) . distinct ( ) query2 = query2 . filter ( cls . models_proxy . UserResourcePermission . user_id == instance . id ) query2 = query2 . filter ( cls . models_proxy . Resource . resource_id == cls . models_proxy . UserResourcePermission . resource_id ) query2 = query2 . filter ( cls . models_proxy . UserResourcePermission . perm_name . in_ ( perms ) ) if resource_ids : query = query . filter ( cls . models_proxy . Resource . resource_id . in_ ( resource_ids ) ) query2 = query2 . filter ( cls . models_proxy . Resource . resource_id . in_ ( resource_ids ) ) if resource_types : query = query . filter ( cls . models_proxy . Resource . resource_type . in_ ( resource_types ) ) query2 = query2 . filter ( cls . models_proxy . Resource . resource_type . in_ ( resource_types ) ) query = query . union ( query2 ) query = query . order_by ( cls . models_proxy . Resource . resource_name ) return query
returns all resources that user has perms for
            (note that at least one perm needs to be met)

        :param instance:
        :param perms:
        :param resource_ids: restricts the search to specific resources
        :param resource_types:
        :param db_session:
        :return: