[logic,auth] Implement publisher auth profile

The publisher profile allows general users to handle harvest sources
based on membership to a certain group (publisher), as opposed to the
default auth profile where only sysadmins can perform any harvesting
task.
To enable it, put this directive in your ini file:

    ckan.harvest.auth.profile = publisher

TODO:
 * Save publisher id / user id when creating sources
 * Show publisher in form and index page

ckanext/harvest/logic/action/get.py

@@ -1,3 +1,7 @@
+from sqlalchemy import or_
+from ckan.authz import Authorizer
+from ckan.model import User
+
 from ckan.plugins import PluginImplementations
 from ckanext.harvest.interfaces import IHarvester
 
@@ -29,18 +33,9 @@ def harvest_source_list(context, data_dict):
 
     model = context['model']
     session = context['session']
+    user = context.get('user','')
 
-    only_active = data_dict.get('only_active',False)
+    sources = _get_sources_for_user(context, data_dict)
-
-    if only_active:
-        sources = session.query(HarvestSource) \
-                    .filter(HarvestSource.active==True) \
-                    .order_by(HarvestSource.created.desc()) \
-                    .all()
-    else:
-        sources = session.query(HarvestSource) \
-                    .order_by(HarvestSource.created.desc()) \
-                    .all()
 
     context.update({'detailed':False})
     return [harvest_source_dictize(source, context) for source in sources]
@@ -100,13 +95,17 @@ def harvest_object_list(context,data_dict):
     session = context['session']
 
     only_current = data_dict.get('only_current',True)
+    source_id = data_dict.get('source_id',False)
+
+    query = session.query(HarvestObject)
+
+    if source_id:
+        query = query.filter(HarvestObject.source_id==source_id)
 
     if only_current:
-        objects = session.query(HarvestObject) \
+        query = query.filter(HarvestObject.current==True)
-                    .filter(HarvestObject.current==True) \
+
-                    .all()
+    objects = query.all()
-    else:
-        objects = session.query(HarvestObject).all()
 
     return [getattr(obj,'id') for obj in objects]
 
@@ -124,3 +123,40 @@ def harvesters_info_show(context,data_dict):
         available_harvesters.append(info)
 
     return available_harvesters
+
+def _get_sources_for_user(context,data_dict):
+
+    model = context['model']
+    session = context['session']
+    user = context.get('user','')
+
+    only_active = data_dict.get('only_active',False)
+
+    query = session.query(HarvestSource) \
+                .order_by(HarvestSource.created.desc())
+
+    if only_active:
+        query = query.filter(HarvestSource.active==True) \
+
+    # Sysadmins will get all sources
+    if not Authorizer().is_sysadmin(user):
+        # This only applies to a non sysadmin user when using the
+        # publisher auth profile. When using the default profile,
+        # normal users will never arrive at this point, but even if they
+        # do, they will get an empty list.
+        user_obj = User.get(user)
+
+        publisher_filters = []
+
+        for publisher_id in [g.id for g in user_obj.get_groups()]:
+            publisher_filters.append(HarvestSource.publisher_id==publisher_id)
+
+        if len(publisher_filters):
+            query = query.filter(or_(*publisher_filters))
+        else:
+            # This user does not belong to a publisher yet, no sources for him/her
+            return []
+
+    sources = query.all()
+
+    return sources

ckanext/harvest/logic/action/update.py

@@ -114,8 +114,10 @@ def harvest_jobs_run(context,data_dict):
 
     check_access('harvest_jobs_run',context,data_dict)
 
+    source_id = data_dict.get('source_id',None)
+
     # Check if there are pending harvest jobs
-    jobs = harvest_job_list(context,{'status':u'New'})
+    jobs = harvest_job_list(context,{'source_id':source_id,'status':u'New'})
     if len(jobs) == 0:
         raise Exception('There are no new harvesting jobs')
 

ckanext/harvest/logic/auth/__init__.py

@@ -1,7 +1,27 @@
-try:
+from ckan.logic import NotFound
-    import pkg_resources
+from ckanext.harvest.model import HarvestSource, HarvestJob, HarvestObject
-    pkg_resources.declare_namespace(__name__)
-except ImportError:
-    import pkgutil
-    __path__ = pkgutil.extend_path(__path__, __name__)
 
+
+def get_source_object(context, data_dict = {}):
+    if not 'source' in context:
+        model = context['model']
+        id = data_dict.get('id',None)
+        source = HarvestSource.get(id)
+        if not source:
+            raise NotFound
+    else:
+        source = context['source']
+
+    return source
+
+def get_job_object(context, data_dict = {}):
+    if not 'job' in context:
+        model = context['model']
+        id = data_dict.get('id',None)
+        job = HarvestJob.get(id)
+        if not job:
+            raise NotFound
+    else:
+        job = context['job']
+
+    return job

ckanext/harvest/logic/auth/publisher/__init__.py

@@ -0,0 +1,7 @@
+try:
+    import pkg_resources
+    pkg_resources.declare_namespace(__name__)
+except ImportError:
+    import pkgutil
+    __path__ = pkgutil.extend_path(__path__, __name__)
+

ckanext/harvest/logic/auth/publisher/create.py

@@ -0,0 +1,53 @@
+from ckan.lib.base import _
+from ckan.authz import Authorizer
+from ckan.model import User
+
+from ckanext.harvest.model import HarvestSource
+
+def harvest_source_create(context,data_dict):
+    model = context['model']
+    user = context.get('user','')
+
+    # Non-logged users can not create sources
+    if not user:
+        return {'success': False, 'msg': _('Non-logged in users are not authorized to create harvest sources')}
+
+    # Sysadmins and the rest of logged users can create sources,
+    # as long as they belong to a publisher
+    user_obj = User.get(user)
+    if not Authorizer().is_sysadmin(user) and len(user_obj.get_groups()) == 0:
+        return {'success': False, 'msg': _('User %s must belong to a publisher to create harvest sources') % str(user)}
+    else:
+        return {'success': True}
+
+def harvest_job_create(context,data_dict):
+    model = context['model']
+    user = context.get('user')
+
+    source_id = data_dict['source_id']
+
+    if not user:
+        return {'success': False, 'msg': _('Non-logged in users are not authorized to create harvest jobs')}
+
+    if Authorizer().is_sysadmin(user):
+        return {'success': True}
+
+    user_obj = User.get(user)
+    source = HarvestSource.get(source_id)
+    if not source:
+        raise NotFound
+
+    if not source.publisher_id in [g.id for g in user_obj.get_groups()]:
+        return {'success': False, 'msg': _('User %s not authorized to create a job for source %s') % (str(user),source.id)}
+    else:
+        return {'success': True}
+
+def harvest_job_create_all(context,data_dict):
+    model = context['model']
+    user = context.get('user')
+
+    if not Authorizer().is_sysadmin(user):
+        return {'success': False, 'msg': _('Only sysadmins can create harvest jobs for all sources') % str(user)}
+    else:
+        return {'success': True}
+

ckanext/harvest/logic/auth/publisher/delete.py

@@ -0,0 +1,27 @@
+from ckan.lib.base import _
+from ckan.authz import Authorizer
+from ckan.model import User
+
+from ckanext.harvest.logic.auth import get_source_object
+
+def harvest_source_delete(context,data_dict):
+    model = context['model']
+    user = context.get('user','')
+    
+    source = get_source_object(context,data_dict)
+    
+    # Non-logged users can not delete this source
+    if not user:
+        return {'success': False, 'msg': _('Non-logged in users are not authorized to delete harvest sources')} 
+
+    # Sysadmins can delete the source
+    if Authorizer().is_sysadmin(user):
+        return {'success': True}
+        
+    # Check if the source publisher id exists on the user's groups
+    user_obj = User.get(user)
+    if not source.publisher_id in [g.id for g in user_obj.get_groups()]:
+        return {'success': False, 'msg': _('User %s not authorized to delete harvest source %s') % (str(user),source.id)}
+    else:
+        return {'success': True}
+

ckanext/harvest/logic/auth/publisher/get.py

@@ -0,0 +1,156 @@
+from ckan.lib.base import _
+from ckan.authz import Authorizer
+from ckan.model import User
+
+from ckanext.harvest.model import HarvestSource
+from ckanext.harvest.logic.auth import get_source_object, get_job_object
+
+def harvest_source_show(context,data_dict):
+    model = context['model']
+    user = context.get('user','')
+
+    source = get_source_object(context,data_dict)
+
+    # Non-logged users can not read the source
+    if not user:
+        return {'success': False, 'msg': _('Non-logged in users are not authorized to see harvest sources')}
+
+    # Sysadmins can read the source
+    if Authorizer().is_sysadmin(user):
+        return {'success': True}
+
+    # Check if the source publisher id exists on the user's groups
+    user_obj = User.get(user)
+    if not source.publisher_id in [g.id for g in user_obj.get_groups()]:
+        return {'success': False, 'msg': _('User %s not authorized to read harvest source %s') % (str(user),source.id)}
+    else:
+        return {'success': True}
+
+def harvest_source_list(context,data_dict):
+
+    model = context['model']
+    user = context.get('user')
+
+    # Here we will just check that the user is logged in.
+    # The logic action will return an empty list if the user does not
+    # have permissons on any source.
+    if not user:
+        return {'success': False, 'msg': _('Only logged users are authorized to see their sources')}
+    else:
+        user_obj = User.get(user)
+        # Only users belonging to a publisher can list sources,
+        # unless they are sysadmins
+        if not Authorizer().is_sysadmin(user) and len(user_obj.get_groups()) == 0:
+            return {'success': False, 'msg': _('User %s must belong to a publisher to list harvest sources') % str(user)}
+        else:
+            return {'success': True}
+
+
+def harvest_job_show(context,data_dict):
+    model = context['model']
+    user = context.get('user')
+
+    job = get_job_object(context,data_dict)
+
+    if not user:
+        return {'success': False, 'msg': _('Non-logged in users are not authorized to see harvest jobs')}
+
+    if Authorizer().is_sysadmin(user):
+        return {'success': True}
+
+    user_obj = User.get(user)
+    if not job.source.publisher_id in [g.id for g in user_obj.get_groups()]:
+        return {'success': False, 'msg': _('User %s not authorized to read harvest job %s') % (str(user),job.id)}
+    else:
+        return {'success': True}
+
+def harvest_job_list(context,data_dict):
+    model = context['model']
+    user = context.get('user')
+
+    # Check user is logged in
+    if not user:
+        return {'success': False, 'msg': _('Only logged users are authorized to see their sources')}
+
+    user_obj = User.get(user)
+
+    # Checks for non sysadmin users
+    if not Authorizer().is_sysadmin(user):
+        if len(user_obj.get_groups()) == 0:
+            return {'success': False, 'msg': _('User %s must belong to a publisher to list harvest jobs') % str(user)}
+
+        source_id = data_dict.get('source_id',False)
+        if not source_id:
+            return {'success': False, 'msg': _('Only sysadmins can list all harvest jobs') % str(user)}
+
+        source = HarvestSource.get(source_id)
+        if not source:
+            raise NotFound
+
+        if not source.publisher_id in [g.id for g in user_obj.get_groups()]:
+            return {'success': False, 'msg': _('User %s not authorized to list jobs from source %s') % (str(user),source.id)}
+
+    return {'success': True}
+
+def harvest_object_show(context,data_dict):
+    model = context['model']
+    user = context.get('user')
+
+    obj = get_obj_object(context,data_dict)
+
+    if not user:
+        return {'success': False, 'msg': _('Non-logged in users are not authorized to see harvest objects')}
+
+    if Authorizer().is_sysadmin(user):
+        return {'success': True}
+
+    user_obj = User.get(user)
+    if not obj.source.publisher_id in [g.id for g in user_obj.get_groups()]:
+        return {'success': False, 'msg': _('User %s not authorized to read harvest object %s') % (str(user),obj.id)}
+    else:
+        return {'success': True}
+
+def harvest_object_list(context,data_dict):
+    model = context['model']
+    user = context.get('user')
+
+    # Check user is logged in
+    if not user:
+        return {'success': False, 'msg': _('Only logged users are authorized to see their sources')}
+
+    user_obj = User.get(user)
+
+    # Checks for non sysadmin users
+    if not Authorizer().is_sysadmin(user):
+        if len(user_obj.get_groups()) == 0:
+            return {'success': False, 'msg': _('User %s must belong to a publisher to list harvest objects') % str(user)}
+
+        source_id = data_dict.get('source_id',False)
+        if not source_id:
+            return {'success': False, 'msg': _('Only sysadmins can list all harvest objects') % str(user)}
+
+        source = HarvestSource.get(source_id)
+        if not source:
+            raise NotFound
+
+        if not source.publisher_id in [g.id for g in user_obj.get_groups()]:
+            return {'success': False, 'msg': _('User %s not authorized to list objects from source %s') % (str(user),source.id)}
+
+    return {'success': True}
+
+def harvesters_info_show(context,data_dict):
+    model = context['model']
+    user = context.get('user','')
+
+    # Non-logged users can not create sources
+    if not user:
+        return {'success': False, 'msg': _('Non-logged in users can not see the harvesters info')}
+
+    # Sysadmins and the rest of logged users can see the harvesters info,
+    # as long as they belong to a publisher
+    user_obj = User.get(user)
+    if not Authorizer().is_sysadmin(user) and len(user_obj.get_groups()) == 0:
+        return {'success': False, 'msg': _('User %s must belong to a publisher to see the harvesters info') % str(user)}
+    else:
+        return {'success': True}
+

ckanext/harvest/logic/auth/publisher/update.py

@@ -0,0 +1,83 @@
+from ckan.lib.base import _
+from ckan.authz import Authorizer
+from ckan.model import User
+
+from ckanext.harvest.logic.auth import get_source_object
+
+def harvest_source_update(context,data_dict):
+    model = context['model']
+    user = context.get('user','')
+
+    source = get_source_object(context,data_dict)
+
+    # Non-logged users can not update this source
+    if not user:
+        return {'success': False, 'msg': _('Non-logged in users are not authorized to update harvest sources')}
+
+    # Sysadmins can update the source
+    if Authorizer().is_sysadmin(user):
+        return {'success': True}
+
+    # Check if the source publisher id exists on the user's groups
+    user_obj = User.get(user)
+    if not source.publisher_id in [g.id for g in user_obj.get_groups()]:
+        return {'success': False, 'msg': _('User %s not authorized to update harvest source %s') % (str(user),source.id)}
+    else:
+        return {'success': True}
+
+def harvest_objects_import(context,data_dict):
+    model = context['model']
+    user = context.get('user')
+
+    # Check user is logged in
+    if not user:
+        return {'success': False, 'msg': _('Only logged users are authorized to reimport harvest objects')}
+
+    user_obj = User.get(user)
+
+    # Checks for non sysadmin users
+    if not Authorizer().is_sysadmin(user):
+        if len(user_obj.get_groups()) == 0:
+            return {'success': False, 'msg': _('User %s must belong to a publisher to reimport harvest objects') % str(user)}
+
+        source_id = data_dict.get('source_id',False)
+        if not source_id:
+            return {'success': False, 'msg': _('Only sysadmins can reimport all harvest objects') % str(user)}
+
+        source = HarvestSource.get(source_id)
+        if not source:
+            raise NotFound
+
+        if not source.publisher_id in [g.id for g in user_obj.get_groups()]:
+            return {'success': False, 'msg': _('User %s not authorized to reimport objects from source %s') % (str(user),source.id)}
+
+    return {'success': True}
+
+def harvest_jobs_run(context,data_dict):
+    model = context['model']
+    user = context.get('user')
+
+    # Check user is logged in
+    if not user:
+        return {'success': False, 'msg': _('Only logged users are authorized to run harvest jobs')}
+
+    user_obj = User.get(user)
+
+    # Checks for non sysadmin users
+    if not Authorizer().is_sysadmin(user):
+        if len(user_obj.get_groups()) == 0:
+            return {'success': False, 'msg': _('User %s must belong to a publisher to run harvest jobs') % str(user)}
+
+        source_id = data_dict.get('source_id',False)
+        if not source_id:
+            return {'success': False, 'msg': _('Only sysadmins can run all harvest jobs') % str(user)}
+
+        source = HarvestSource.get(source_id)
+        if not source:
+            raise NotFound
+
+        if not source.publisher_id in [g.id for g in user_obj.get_groups()]:
+            return {'success': False, 'msg': _('User %s not authorized to run jobs from source %s') % (str(user),source.id)}
+
+    return {'success': True}
+

ckanext/harvest/plugin.py

@@ -1,6 +1,7 @@
 import os
 from logging import getLogger
 
+from pylons import config
 from genshi.input import HTML
 from genshi.filters import Transformer
 
@@ -88,35 +89,36 @@ class Harvest(SingletonPlugin):
         }
 
     def get_auth_functions(self):
-        from ckanext.harvest.logic.auth.get import (harvest_source_show,
-                                                      harvest_source_list,
-                                                      harvest_job_show,
-                                                      harvest_job_list,
-                                                      harvest_object_show,
-                                                      harvest_object_list,
-                                                      harvesters_info_show,)
-        from ckanext.harvest.logic.auth.create import (harvest_source_create,
-                                                         harvest_job_create,
-                                                         harvest_job_create_all,)
-        from ckanext.harvest.logic.auth.update import (harvest_source_update,
-                                                         harvest_objects_import,
-                                                         harvest_jobs_run)
-        from ckanext.harvest.logic.auth.delete import (harvest_source_delete,)
 
-        return {
+        module_root = 'ckanext.harvest.logic.auth'
-            'harvest_source_show': harvest_source_show,
+        auth_profile = config.get('ckan.harvest.auth.profile', '')
-            'harvest_source_list': harvest_source_list,
+
-            'harvest_job_show': harvest_job_show,
+        auth_functions = _get_auth_functions(module_root)
-            'harvest_job_list': harvest_job_list,
+        if auth_profile:
-            'harvest_object_show': harvest_object_show,
+            module_root = '%s.%s' % (module_root, auth_profile)
-            'harvest_object_list': harvest_object_list,
+            auth_functions = _get_auth_functions(module_root,auth_functions)
-            'harvesters_info_show': harvesters_info_show,
+
-            'harvest_source_create': harvest_source_create,
+        log.info('Using auth profile at %s' % module_root)
-            'harvest_job_create': harvest_job_create,
+
-            'harvest_job_create_all': harvest_job_create_all,
+        return auth_functions
-            'harvest_source_update': harvest_source_update,
+
-            'harvest_source_delete': harvest_source_delete,
+def _get_auth_functions(module_root, auth_functions = {}):
-            'harvest_objects_import': harvest_objects_import,
+
-            'harvest_jobs_run':harvest_jobs_run
+    for auth_module_name in ['get', 'create', 'update','delete']:
-        }
+        module_path = '%s.%s' % (module_root, auth_module_name,)
+        try:
+            module = __import__(module_path)
+        except ImportError,e:
+            log.debug('No auth module for action "%s"' % auth_module_name)
+            continue
+
+        for part in module_path.split('.')[1:]:
+            module = getattr(module, part)
+
+        for key, value in module.__dict__.items():
+            if not key.startswith('_'):
+                auth_functions[key] = value
+
+
+    return auth_functions