2016-11-02 00:09:59 +01:00
|
|
|
from copy import deepcopy
|
2018-11-03 23:40:20 +01:00
|
|
|
from typing import Any, Dict, List
|
2016-11-02 00:09:59 +01:00
|
|
|
|
2018-08-22 22:00:08 +02:00
|
|
|
from ..utils.access_permissions import BaseAccessPermissions
|
2018-11-01 17:30:18 +01:00
|
|
|
from ..utils.auth import async_has_perm, async_in_some_groups
|
2016-02-11 22:58:32 +01:00
|
|
|
|
|
|
|
|
|
|
|
class MotionAccessPermissions(BaseAccessPermissions):
|
|
|
|
"""
|
|
|
|
Access permissions container for Motion and MotionViewSet.
|
|
|
|
"""
|
2019-01-06 16:22:33 +01:00
|
|
|
|
|
|
|
base_permission = "motions.can_see"
|
2016-02-11 22:58:32 +01:00
|
|
|
|
2018-11-01 17:30:18 +01:00
|
|
|
async def get_restricted_data(
|
2019-01-06 16:22:33 +01:00
|
|
|
self, full_data: List[Dict[str, Any]], user_id: int
|
|
|
|
) -> List[Dict[str, Any]]:
|
2016-07-29 23:33:47 +02:00
|
|
|
"""
|
|
|
|
Returns the restricted serialized data for the instance prepared for
|
2016-12-09 18:00:45 +01:00
|
|
|
the user. Removes motion if the user has not the permission to see
|
2018-08-31 15:33:41 +02:00
|
|
|
the motion in this state. Removes comments sections for
|
2017-05-01 23:12:42 +02:00
|
|
|
some unauthorized users. Ensures that a user can only see his own
|
|
|
|
personal notes.
|
2016-07-29 23:33:47 +02:00
|
|
|
"""
|
2017-05-01 23:12:42 +02:00
|
|
|
# Parse data.
|
2019-01-06 16:22:33 +01:00
|
|
|
if await async_has_perm(user_id, "motions.can_see"):
|
2017-05-01 23:12:42 +02:00
|
|
|
# TODO: Refactor this after personal_notes system is refactored.
|
|
|
|
data = []
|
|
|
|
for full in full_data:
|
|
|
|
# Check if user is submitter of this motion.
|
2018-11-03 23:40:20 +01:00
|
|
|
if user_id:
|
|
|
|
is_submitter = user_id in [
|
2019-01-06 16:22:33 +01:00
|
|
|
submitter["user_id"] for submitter in full.get("submitters", [])
|
|
|
|
]
|
2017-05-01 23:12:42 +02:00
|
|
|
else:
|
|
|
|
# Anonymous users can not be submitters.
|
|
|
|
is_submitter = False
|
|
|
|
|
|
|
|
# Check see permission for this motion.
|
2019-03-20 17:21:01 +01:00
|
|
|
restriction = full["state_restriction"]
|
|
|
|
|
|
|
|
# Managers can see all motions.
|
|
|
|
permission = await async_has_perm(user_id, "motions.can_manage")
|
|
|
|
# If restriction field is an empty list, everybody can see the motion.
|
|
|
|
permission = permission or not restriction
|
|
|
|
|
|
|
|
if not permission:
|
|
|
|
# Parse values of restriction field.
|
|
|
|
for value in restriction:
|
|
|
|
if value == "managers_only":
|
|
|
|
# permission remains false
|
|
|
|
break
|
2019-04-01 14:35:02 +02:00
|
|
|
elif value in (
|
|
|
|
"motions.can_see_internal",
|
|
|
|
"motions.can_manage_metadata",
|
|
|
|
):
|
2019-03-20 17:21:01 +01:00
|
|
|
if await async_has_perm(user_id, value):
|
|
|
|
permission = True
|
|
|
|
break
|
|
|
|
elif value == "is_submitter":
|
|
|
|
if is_submitter:
|
|
|
|
permission = True
|
|
|
|
break
|
2017-05-01 23:12:42 +02:00
|
|
|
|
|
|
|
# Parse single motion.
|
|
|
|
if permission:
|
2018-08-31 15:33:41 +02:00
|
|
|
full_copy = deepcopy(full)
|
2019-01-06 16:22:33 +01:00
|
|
|
full_copy["comments"] = []
|
|
|
|
for comment in full["comments"]:
|
|
|
|
if await async_in_some_groups(
|
|
|
|
user_id, comment["read_groups_id"]
|
|
|
|
):
|
|
|
|
full_copy["comments"].append(comment)
|
2018-08-31 15:33:41 +02:00
|
|
|
data.append(full_copy)
|
2017-05-01 23:12:42 +02:00
|
|
|
else:
|
|
|
|
data = []
|
2017-09-04 00:25:45 +02:00
|
|
|
return data
|
2016-07-29 23:33:47 +02:00
|
|
|
|
2016-02-11 22:58:32 +01:00
|
|
|
|
2016-09-10 18:49:38 +02:00
|
|
|
class MotionChangeRecommendationAccessPermissions(BaseAccessPermissions):
|
|
|
|
"""
|
|
|
|
Access permissions container for MotionChangeRecommendation and MotionChangeRecommendationViewSet.
|
|
|
|
"""
|
2019-01-06 16:22:33 +01:00
|
|
|
|
|
|
|
base_permission = "motions.can_see"
|
2016-09-10 18:49:38 +02:00
|
|
|
|
2018-11-01 17:30:18 +01:00
|
|
|
async def get_restricted_data(
|
2019-01-06 16:22:33 +01:00
|
|
|
self, full_data: List[Dict[str, Any]], user_id: int
|
|
|
|
) -> List[Dict[str, Any]]:
|
2018-10-25 15:11:38 +02:00
|
|
|
"""
|
|
|
|
Removes change recommendations if they are internal and the user has
|
|
|
|
not the can_manage permission. To see change recommendation the user needs
|
|
|
|
the can_see permission.
|
|
|
|
"""
|
|
|
|
# Parse data.
|
2019-01-06 16:22:33 +01:00
|
|
|
if await async_has_perm(user_id, "motions.can_see"):
|
2019-04-05 12:33:34 +02:00
|
|
|
has_manage_perms = await async_has_perm(user_id, "motions.can_manage")
|
2018-10-25 15:11:38 +02:00
|
|
|
data = []
|
|
|
|
for full in full_data:
|
2019-01-06 16:22:33 +01:00
|
|
|
if not full["internal"] or has_manage_perms:
|
2018-10-25 15:11:38 +02:00
|
|
|
data.append(full)
|
|
|
|
else:
|
|
|
|
data = []
|
|
|
|
|
|
|
|
return data
|
|
|
|
|
2016-09-10 18:49:38 +02:00
|
|
|
|
2018-08-31 15:33:41 +02:00
|
|
|
class MotionCommentSectionAccessPermissions(BaseAccessPermissions):
|
|
|
|
"""
|
|
|
|
Access permissions container for MotionCommentSection and MotionCommentSectionViewSet.
|
|
|
|
"""
|
2019-01-06 16:22:33 +01:00
|
|
|
|
|
|
|
base_permission = "motions.can_see"
|
2018-08-31 15:33:41 +02:00
|
|
|
|
2018-11-01 17:30:18 +01:00
|
|
|
async def get_restricted_data(
|
2019-01-06 16:22:33 +01:00
|
|
|
self, full_data: List[Dict[str, Any]], user_id: int
|
|
|
|
) -> List[Dict[str, Any]]:
|
2018-08-31 15:33:41 +02:00
|
|
|
"""
|
|
|
|
If the user has manage rights, he can see all sections. If not all sections
|
|
|
|
will be removed, when the user is not in at least one of the read_groups.
|
|
|
|
"""
|
|
|
|
data: List[Dict[str, Any]] = []
|
2019-01-06 16:22:33 +01:00
|
|
|
if await async_has_perm(user_id, "motions.can_manage"):
|
2018-08-31 15:33:41 +02:00
|
|
|
data = full_data
|
|
|
|
else:
|
|
|
|
for full in full_data:
|
2019-01-06 16:22:33 +01:00
|
|
|
read_groups = full.get("read_groups_id", [])
|
2018-11-03 23:40:20 +01:00
|
|
|
if await async_in_some_groups(user_id, read_groups):
|
2018-08-31 15:33:41 +02:00
|
|
|
data.append(full)
|
|
|
|
return data
|
|
|
|
|
|
|
|
|
2018-09-24 10:28:31 +02:00
|
|
|
class StatuteParagraphAccessPermissions(BaseAccessPermissions):
|
|
|
|
"""
|
|
|
|
Access permissions container for StatuteParagraph and StatuteParagraphViewSet.
|
|
|
|
"""
|
2019-01-06 16:22:33 +01:00
|
|
|
|
|
|
|
base_permission = "motions.can_see"
|
2018-09-24 10:28:31 +02:00
|
|
|
|
|
|
|
|
2016-02-11 22:58:32 +01:00
|
|
|
class CategoryAccessPermissions(BaseAccessPermissions):
|
|
|
|
"""
|
|
|
|
Access permissions container for Category and CategoryViewSet.
|
|
|
|
"""
|
2019-01-06 16:22:33 +01:00
|
|
|
|
|
|
|
base_permission = "motions.can_see"
|
2016-02-11 22:58:32 +01:00
|
|
|
|
|
|
|
|
2016-10-01 20:42:44 +02:00
|
|
|
class MotionBlockAccessPermissions(BaseAccessPermissions):
|
|
|
|
"""
|
|
|
|
Access permissions container for Category and CategoryViewSet.
|
|
|
|
"""
|
2019-01-06 16:22:33 +01:00
|
|
|
|
|
|
|
base_permission = "motions.can_see"
|
2016-10-01 20:42:44 +02:00
|
|
|
|
|
|
|
|
2016-02-11 22:58:32 +01:00
|
|
|
class WorkflowAccessPermissions(BaseAccessPermissions):
|
|
|
|
"""
|
|
|
|
Access permissions container for Workflow and WorkflowViewSet.
|
|
|
|
"""
|
2019-01-06 16:22:33 +01:00
|
|
|
|
|
|
|
base_permission = "motions.can_see"
|