From d6a3b21d517df598a1512ea26ee05c888dda2384 Mon Sep 17 00:00:00 2001 From: seba Date: Fri, 30 Sep 2011 22:29:02 +0200 Subject: [PATCH] auth blob handling (UI) works --- k4ever/api2/decorators.py | 3 +- k4ever/api2/handlers.py | 20 ++++ k4ever/api2/urls.py | 2 + k4ever/main/models.py | 13 +- k4ever/main/templates/main/startpage.html | 6 +- k4ever/main/templates/settings/settings.html | 120 +++++++------------ k4ever/main/urls.py | 3 + k4ever/main/views.py | 80 ++++++++++++- 8 files changed, 159 insertions(+), 88 deletions(-) diff --git a/k4ever/api2/decorators.py b/k4ever/api2/decorators.py index e90c59f..9d60333 100644 --- a/k4ever/api2/decorators.py +++ b/k4ever/api2/decorators.py @@ -73,8 +73,9 @@ def requirePlugin(apiFunc): if request.user: group = request.user.groups.get(name="Plugin") # no exception, exec apiFunc! + request.plugin = Plugin.objects.get(user=request.user) return apiFunc(self, request, *args, **kwargs) - except Groups.DoesNotExist: + except Group.DoesNotExist: pass ret = rc.FORBIDDEN diff --git a/k4ever/api2/handlers.py b/k4ever/api2/handlers.py index 0baf20d..fe2c79c 100644 --- a/k4ever/api2/handlers.py +++ b/k4ever/api2/handlers.py @@ -136,6 +136,26 @@ class AuthBlobHandler(BaseHandler): # model = pass +class AuthUserHandler(BaseHandler): + allowed_methods = ('GET') + fields = ('id', 'username') + + @requirePlugin + def read(self, request): + if not request.plugin.uniqueAuthblob: + ret = rc.BAD_REQUEST + ret.write("\nThis plugin does not support unique auth blobs, therefore we can't identify an user uniquely by its authblob\n") + return ret + + if not request.GET.has_key('authblob'): + return rc.BAD_REQUEST + + try: + perm = PluginPermission.objects.get(plugin=request.plugin, authblob=request.GET['authblob']) + return perm.user + except PluginPermission.DoesNotExist: + return rc.NOT_FOUND + class ConfigHandler(BaseHandler): allowed_methods = ('GET',) diff --git a/k4ever/api2/urls.py b/k4ever/api2/urls.py index 52ea539..c61a026 100644 --- a/k4ever/api2/urls.py +++ b/k4ever/api2/urls.py @@ -22,6 +22,7 @@ accountBalanceRes = CsrfExemptResource(handler=AccountBalanceHandler, **ad) authBlobRes = CsrfExemptResource(handler=AuthBlobHandler, **ad) +authUserRes = CsrfExemptResource(handler=AuthUserHandler, **ad) configRes = CsrfExemptResource(handler=ConfigHandler, **ad) @@ -37,6 +38,7 @@ urlpatterns = patterns('', url(r'account/balance/?$', accountBalanceRes), url(r'auth/blob/?$', authBlobRes), + url(r'auth/user/?$', authUserRes), url(r'config/?$', configRes), ) diff --git a/k4ever/main/models.py b/k4ever/main/models.py index 27f20be..107363e 100644 --- a/k4ever/main/models.py +++ b/k4ever/main/models.py @@ -19,12 +19,21 @@ def createUserProfile(sender, instance, created, **kwargs): post_save.connect(createUserProfile, sender=User) class Plugin(models.Model): - name = models.CharField(max_length=40) user = models.ForeignKey(User, unique=True) + + # plugin info + name = models.CharField(max_length=40) author = models.CharField(max_length=40) version = models.CharField(max_length=40) descr = models.TextField(default='') + + # plugin config uniqueAuthblob = models.BooleanField(default=False) + userCanWriteAuthblob = models.BooleanField(default=True) + # automatically set when write is allowed + userCanReadAuthblob = models.BooleanField(default=True) + pluginCanWriteAuthblob = models.BooleanField(default=False) + pluginCanReadAuthblob = models.BooleanField(default=False) def __unicode__(self): return self.name @@ -32,7 +41,7 @@ class Plugin(models.Model): class PluginPermission(models.Model): user = models.ForeignKey(User) plugin = models.ForeignKey('Plugin') - authBlob = models.TextField(default='') + authblob = models.TextField(default='') def __unicode__(self): return "%s allows %s" % (self.user, self.plugin) diff --git a/k4ever/main/templates/main/startpage.html b/k4ever/main/templates/main/startpage.html index 33d9986..e327d96 100644 --- a/k4ever/main/templates/main/startpage.html +++ b/k4ever/main/templates/main/startpage.html @@ -4,7 +4,7 @@ {% if allMost %} Am beliebtesten ist:

{% for buyable in allMost %} - {{ buyable.buyable__name }} ( {{ buyable.num_buys }} mal)
+ {{ buyable.buyable__name }} ( {{ buyable.num_buys }} mal)
{% endfor %}
{% else %} @@ -15,7 +15,7 @@ {% if usersMost %} Am oeftesten hattest du:

{% for buyable in usersMost %} - {{ buyable.buyable__name }} ( {{ buyable.num_buys }} mal)
+ {{ buyable.buyable__name }} ( {{ buyable.num_buys }} mal)
{% endfor %}
{% else %} @@ -26,7 +26,7 @@ {% if usersLast %} Als letztes hattest du:

{% for buyable in usersLast %} - {{ buyable.buyable__name }}
+ {{ buyable.buyable__name }}
{% endfor %}
{% else %} diff --git a/k4ever/main/templates/settings/settings.html b/k4ever/main/templates/settings/settings.html index 0206990..2559542 100644 --- a/k4ever/main/templates/settings/settings.html +++ b/k4ever/main/templates/settings/settings.html @@ -9,89 +9,57 @@

Plugin Berechtigungen

-

-

- - -
-

+ {% if pluginerror %} + {{ pluginerror|safe }} + {% endif %} + {% if pluginmsg %} + {{ pluginmsg|safe }} + {% endif %}

+ + + - + - {% if pluginpermissions %} - {% for pperm in pluginpermissions %} - {% if pperm.plugin in plugins %} - end test + {% for p in permissions %} + + + + + + - - - - {% endfor %} - {% else %} - - - - {% endif %} -
NameAuthorVersionBeschreibung AuthBlobOptionenErlauben/Verbieten
{{ p.plugin.name }}{{ p.plugin.author }}{{ p.plugin.version }}{{ p.plugin.descr }} + {% if p.plugin.userCanWriteAuthblob %} +
+ {% csrf_token %} + + +
+ {% else %} + {% if p.plugin.userCanReadAuthblob %} + {{ p.authblob }} + {% else %} + --- + {% endif %} {% endif %} -
{{ pperm.plugin }} -
- - -
- 		-
- -
- 		-
Du hast bisher keinem Plugin zugriff auf deinen Account gewährt
- Perms {{ pluginpermissions }}
-

-

Second Idea for Plugin interface

-
-

- - - - - - - {% if pluginpermissions %} - {% for plugin in plugins %} - - - - - {% endfor %} - {% else %} - - - - {% endif %} + + + + {% endfor %} + {% for plugin in unallowed %} + + + + + + + + + {% endfor %} +
NameAuthBlobOptionen
{{ plugin }} - {%if plugin not in unallowedplugins %} -
- - -
- {%endif%} - 		-
- {%if plugin in unallowedplugins %} - - {%else%} - - {%endif%} -
- 		-
Du hast bisher keinem Plugin zugriff auf deinen Account gewährt
Plugin verbieten
{{ plugin.name }}{{ plugin.author }}{{ plugin.version }}{{ plugin.descr }} Plugin erlauben

{% endblock %} diff --git a/k4ever/main/urls.py b/k4ever/main/urls.py index 780a285..6115090 100644 --- a/k4ever/main/urls.py +++ b/k4ever/main/urls.py @@ -11,4 +11,7 @@ urlpatterns = patterns('', {'template_name': 'registration/logout.html', 'next_page': '/user/login/'}), (r'^settings/$', 'main.views.settings'), + #plugin stuff + (r'^settings/plugin/(?P(?:allow|deny))/(?P\d+)/$', 'main.views.pluginPermission'), + (r'^settings/plugin/authblob/(?P\d+)/$', 'main.views.pluginAuthblob'), ) diff --git a/k4ever/main/views.py b/k4ever/main/views.py index b0f2776..f41e176 100644 --- a/k4ever/main/views.py +++ b/k4ever/main/views.py @@ -2,6 +2,7 @@ from django.shortcuts import render_to_response from django.template import RequestContext from django.contrib.auth.decorators import login_required from django.db.models import Count +from django.http import HttpResponseRedirect from main.models import Plugin, PluginPermission @@ -12,17 +13,84 @@ def startpage(request): ''' Diese Funktion wird wahrscheinlich viel Last erzeugen, da sie ueber mehrere Tabellen joined,filtered und wieder reduced. ''' - allMost = Purchase.objects.filter(isDeposit=False).values('buyable__name').annotate(num_buys=Count('buyable')).order_by('-num_buys') - usersMost = Purchase.objects.filter(isDeposit=False).values('buyable__name').filter(order__user=request.user.id).annotate(num_buys=Count('buyable')).order_by('-num_buys') - usersLast = Purchase.objects.filter(isDeposit=False).values('buyable__name').filter(order__user=request.user.id).order_by('-order__dateTime') + allMost = Purchase.objects.filter(isDeposit=False).values('buyable__name', 'buyable__id').annotate(num_buys=Count('buyable')).order_by('-num_buys') + usersMost = Purchase.objects.filter(isDeposit=False).values('buyable__name','buyable__id').filter(order__user=request.user.id).annotate(num_buys=Count('buyable')).order_by('-num_buys') + usersLast = Purchase.objects.filter(isDeposit=False).values('buyable__name','buyable__id').filter(order__user=request.user.id).order_by('-order__dateTime') return render_to_response("main/startpage.html", {'allMost' : allMost,'usersMost': usersMost, 'usersLast' : usersLast}, RequestContext(request)) def register(request): return render_to_response("registration/register.html", RequestContext(request)) -@login_required -def settings(request): + +def getPluginDict(request): plugins = Plugin.objects.all() + allowed = Plugin.objects.filter(pluginpermission__user=request.user) unallowed = Plugin.objects.exclude(pluginpermission__user=request.user) perms = PluginPermission.objects.filter(user=request.user) - return render_to_response("settings/settings.html", {'plugins': plugins, 'unallowedplugins': unallowed, 'pluginpermissions': perms}, RequestContext(request)) + + return {'plugins': plugins, 'allowed': allowed, 'unallowed': unallowed, 'permissions': perms} + +@login_required +def settings(request): + return render_to_response("settings/settings.html", getPluginDict(request), RequestContext(request)) + +@login_required +def pluginPermission(request, method, pluginId): + plugin = None + try: + plugin = Plugin.objects.get(id=pluginId) + except Plugin.DoesNotExist: + d = getPluginDict(request) + d['pluginerror'] = "Ein Plugin mit der angegebenen ID existiert nicht" + return render_to_response("settings/settings.html", d, RequestContext(request)) + + if method == "allow": + try: + p = PluginPermission.objects.get(user=request.user, plugin=plugin) + d = getPluginDict(request) + d['pluginerror'] = "Dieses Plugin wurde bereits erlaubt" + return render_to_response("settings/settings.html", d, RequestContext(request)) + except PluginPermission.DoesNotExist: + p = PluginPermission(user=request.user, plugin=plugin) + p.save() + else: + try: + p = PluginPermission.objects.get(user=request.user, plugin=plugin) + p.delete() + except PluginPermission.DoesNotExist: + d = getPluginDict(request) + d['pluginerror'] = "Keine Berechtigungen für dieses Plugin gefunden - kann also auch nicht zurückgezogen werden" + return render_to_response("settings/settings.html", d, RequestContext(request)) + return HttpResponseRedirect("/user/settings/") + +@login_required +def pluginAuthblob(request, pluginId): + if request.method != "POST": + return HttpResponseRedirect("/user/settings/") + plugin = None + try: + plugin = Plugin.objects.get(id=pluginId) + except Plugin.DoesNotExist: + d = getPluginDict(request) + d['pluginerror'] = "Ein Plugin mit der angegebenen ID existiert nicht" + return render_to_response("settings/settings.html", d, RequestContext(request)) + + p = None + try: + p = PluginPermission.objects.get(user=request.user, plugin=plugin) + except PluginPermission.DoesNotExist: + d = getPluginDict(request) + d['pluginerror'] = "Vor dem editieren vom Authblob muss das Plugin ersteinmal erlaubt werden" + return render_to_response("settings/settings.html", d, RequestContext(request)) + + if not p.plugin.userCanWriteAuthblob or not request.POST.has_key("authblob"): + d = getPluginDict(request) + d['pluginerror'] = "Der Authblob darf für dieses Plugin nicht vom User verändert werden (oder der Authblob war kaputt)" + return render_to_response("settings/settings.html", d, RequestContext(request)) + + p.authblob = request.POST['authblob'] + p.save() + d = getPluginDict(request) + d['pluginmsg'] = "Authblob erfolgreich geändert" + return render_to_response("settings/settings.html", d, RequestContext(request)) +