mirror of https://gitlab.com/tildes/tildes.git
Browse Source
Rework permissions/ACL system
Rework permissions/ACL system
This is a major rework of the permissions system to enable various new capabilities and clean up some of the oddities that were there. Highlights: - The concept of "admin" permission is removed. All permissions must be granted individually. - Permissions can now be granted on a group-specific level, such as giving a user the ability to tag topics only in a specific group. - Permissions can also be denied for a specific group (or all groups), enabling uses like "tag topics in all groups except ~music". - Removed the two cases where "all permissions" were granted: users on themselves and the sender and recipient on messages. This was dangerous, we should always grant permissions explicitly. - Eliminated all the granular permissions for changing a user's settings (which were all granted implicitly), and replaced with an overall "change_settings" permission.merge-requests/102/head
Deimos
5 years ago
16 changed files with 329 additions and 143 deletions
-
40tildes/alembic/versions/84dc19f6e876_rename_column_for_restricted_posting_.py
-
26tildes/tests/test_comment.py
-
39tildes/tests/test_topic_permissions.py
-
6tildes/tests/test_user.py
-
38tildes/tildes/lib/auth.py
-
62tildes/tildes/models/comment/comment.py
-
5tildes/tildes/models/comment/comment_notification.py
-
28tildes/tildes/models/group/group.py
-
11tildes/tildes/models/group/group_wiki_page.py
-
17tildes/tildes/models/message/message.py
-
99tildes/tildes/models/topic/topic.py
-
32tildes/tildes/models/user/user.py
-
23tildes/tildes/models/user/user_permissions.py
-
10tildes/tildes/typing.py
-
32tildes/tildes/views/api/web/user.py
-
4tildes/tildes/views/user.py
@ -0,0 +1,40 @@ |
|||
"""Rename column for restricted-posting groups |
|||
|
|||
Revision ID: 84dc19f6e876 |
|||
Revises: 054aaef690cd |
|||
Create Date: 2020-02-29 03:03:31.968814 |
|||
|
|||
""" |
|||
from alembic import op |
|||
import sqlalchemy as sa |
|||
|
|||
|
|||
# revision identifiers, used by Alembic. |
|||
revision = "84dc19f6e876" |
|||
down_revision = "054aaef690cd" |
|||
branch_labels = None |
|||
depends_on = None |
|||
|
|||
|
|||
def upgrade(): |
|||
op.alter_column( |
|||
"groups", |
|||
"is_admin_posting_only", |
|||
new_column_name="requires_permission_to_post_topics", |
|||
) |
|||
|
|||
op.execute( |
|||
"update user_permissions set permission = 'wiki.edit' where permission = 'wiki'" |
|||
) |
|||
|
|||
|
|||
def downgrade(): |
|||
op.alter_column( |
|||
"groups", |
|||
"requires_permission_to_post_topics", |
|||
new_column_name="is_admin_posting_only", |
|||
) |
|||
|
|||
op.execute( |
|||
"update user_permissions set permission = 'wiki' where permission = 'wiki.edit'" |
|||
) |
@ -0,0 +1,38 @@ |
|||
# Copyright (c) 2020 Tildes contributors <code@tildes.net> |
|||
# SPDX-License-Identifier: AGPL-3.0-or-later |
|||
|
|||
"""Functions to help with authorization, such as generating ACLs.""" |
|||
|
|||
from typing import List, Optional |
|||
|
|||
from pyramid.security import Allow, Deny |
|||
|
|||
from tildes.typing import AceType |
|||
|
|||
|
|||
def aces_for_permission( |
|||
required_permission: str, |
|||
group_id: Optional[int] = None, |
|||
granted_permission: Optional[str] = None, |
|||
) -> List[AceType]: |
|||
"""Return the ACEs for manually-granted (or denied) entries in UserPermissions.""" |
|||
aces = [] |
|||
|
|||
# If the granted permission wasn't specified, use the required one without the type. |
|||
# So if required is "topic.lock", the granted permission defaults to "lock". |
|||
if granted_permission is None: |
|||
granted_permission = required_permission.split(".", maxsplit=1)[1] |
|||
|
|||
contexts = ["*"] |
|||
if group_id is not None: |
|||
contexts.append(str(group_id)) |
|||
|
|||
# add Deny entries first |
|||
for context in contexts: |
|||
aces.append((Deny, f"{context}:!{required_permission}", granted_permission)) |
|||
|
|||
# then Allow entries |
|||
for context in contexts: |
|||
aces.append((Allow, f"{context}:{required_permission}", granted_permission)) |
|||
|
|||
return aces |
@ -0,0 +1,10 @@ |
|||
# Copyright (c) 2018 Tildes contributors <code@tildes.net> |
|||
# SPDX-License-Identifier: AGPL-3.0-or-later |
|||
|
|||
"""Custom type aliases to use in type annotations.""" |
|||
|
|||
from typing import Any, List, Tuple |
|||
|
|||
# types for an ACE (Access Control Entry), and the ACL (Access Control List) of them |
|||
AceType = Tuple[str, Any, str] |
|||
AclType = List[AceType] |
Write
Preview
Loading…
Cancel
Save
Reference in new issue