[logic,auth] Implement publisher auth profile
The publisher profile allows general users to handle harvest sources
based on membership to a certain group (publisher), as opposed to the
default auth profile where only sysadmins can perform any harvesting
task.
To enable it, put this directive in your ini file:
ckan.harvest.auth.profile = publisher
TODO:
* Save publisher id / user id when creating sources
* Show publisher in form and index page
This commit is contained in:
amercader
parent
3b68298bba
commit
2a2397c0ed
|
|
@ -1,3 +1,7 @@
|
|||
from sqlalchemy import or_
|
||||
from ckan.authz import Authorizer
|
||||
from ckan.model import User
|
||||
|
||||
from ckan.plugins import PluginImplementations
|
||||
from ckanext.harvest.interfaces import IHarvester
|
||||
|
||||
|
|
@ -29,18 +33,9 @@ def harvest_source_list(context, data_dict):
|
|||
|
||||
model = context['model']
|
||||
session = context['session']
|
||||
user = context.get('user','')
|
||||
|
||||
only_active = data_dict.get('only_active',False)
|
||||
|
||||
if only_active:
|
||||
sources = session.query(HarvestSource) \
|
||||
.filter(HarvestSource.active==True) \
|
||||
.order_by(HarvestSource.created.desc()) \
|
||||
.all()
|
||||
else:
|
||||
sources = session.query(HarvestSource) \
|
||||
.order_by(HarvestSource.created.desc()) \
|
||||
.all()
|
||||
sources = _get_sources_for_user(context, data_dict)
|
||||
|
||||
context.update({'detailed':False})
|
||||
return [harvest_source_dictize(source, context) for source in sources]
|
||||
|
|
@ -100,13 +95,17 @@ def harvest_object_list(context,data_dict):
|
|||
session = context['session']
|
||||
|
||||
only_current = data_dict.get('only_current',True)
|
||||
source_id = data_dict.get('source_id',False)
|
||||
|
||||
query = session.query(HarvestObject)
|
||||
|
||||
if source_id:
|
||||
query = query.filter(HarvestObject.source_id==source_id)
|
||||
|
||||
if only_current:
|
||||
objects = session.query(HarvestObject) \
|
||||
.filter(HarvestObject.current==True) \
|
||||
.all()
|
||||
else:
|
||||
objects = session.query(HarvestObject).all()
|
||||
query = query.filter(HarvestObject.current==True)
|
||||
|
||||
objects = query.all()
|
||||
|
||||
return [getattr(obj,'id') for obj in objects]
|
||||
|
||||
|
|
@ -124,3 +123,40 @@ def harvesters_info_show(context,data_dict):
|
|||
available_harvesters.append(info)
|
||||
|
||||
return available_harvesters
|
||||
|
||||
def _get_sources_for_user(context,data_dict):
|
||||
|
||||
model = context['model']
|
||||
session = context['session']
|
||||
user = context.get('user','')
|
||||
|
||||
only_active = data_dict.get('only_active',False)
|
||||
|
||||
query = session.query(HarvestSource) \
|
||||
.order_by(HarvestSource.created.desc())
|
||||
|
||||
if only_active:
|
||||
query = query.filter(HarvestSource.active==True) \
|
||||
|
||||
# Sysadmins will get all sources
|
||||
if not Authorizer().is_sysadmin(user):
|
||||
# This only applies to a non sysadmin user when using the
|
||||
# publisher auth profile. When using the default profile,
|
||||
# normal users will never arrive at this point, but even if they
|
||||
# do, they will get an empty list.
|
||||
user_obj = User.get(user)
|
||||
|
||||
publisher_filters = []
|
||||
|
||||
for publisher_id in [g.id for g in user_obj.get_groups()]:
|
||||
publisher_filters.append(HarvestSource.publisher_id==publisher_id)
|
||||
|
||||
if len(publisher_filters):
|
||||
query = query.filter(or_(*publisher_filters))
|
||||
else:
|
||||
# This user does not belong to a publisher yet, no sources for him/her
|
||||
return []
|
||||
|
||||
sources = query.all()
|
||||
|
||||
return sources
|
||||
|
|
|
|||
|
|
@ -114,8 +114,10 @@ def harvest_jobs_run(context,data_dict):
|
|||
|
||||
check_access('harvest_jobs_run',context,data_dict)
|
||||
|
||||
source_id = data_dict.get('source_id',None)
|
||||
|
||||
# Check if there are pending harvest jobs
|
||||
jobs = harvest_job_list(context,{'status':u'New'})
|
||||
jobs = harvest_job_list(context,{'source_id':source_id,'status':u'New'})
|
||||
if len(jobs) == 0:
|
||||
raise Exception('There are no new harvesting jobs')
|
||||
|
||||
|
|
|
|||
|
|
@ -1,7 +1,27 @@
|
|||
try:
|
||||
import pkg_resources
|
||||
pkg_resources.declare_namespace(__name__)
|
||||
except ImportError:
|
||||
import pkgutil
|
||||
__path__ = pkgutil.extend_path(__path__, __name__)
|
||||
from ckan.logic import NotFound
|
||||
from ckanext.harvest.model import HarvestSource, HarvestJob, HarvestObject
|
||||
|
||||
|
||||
def get_source_object(context, data_dict = {}):
|
||||
if not 'source' in context:
|
||||
model = context['model']
|
||||
id = data_dict.get('id',None)
|
||||
source = HarvestSource.get(id)
|
||||
if not source:
|
||||
raise NotFound
|
||||
else:
|
||||
source = context['source']
|
||||
|
||||
return source
|
||||
|
||||
def get_job_object(context, data_dict = {}):
|
||||
if not 'job' in context:
|
||||
model = context['model']
|
||||
id = data_dict.get('id',None)
|
||||
job = HarvestJob.get(id)
|
||||
if not job:
|
||||
raise NotFound
|
||||
else:
|
||||
job = context['job']
|
||||
|
||||
return job
|
||||
|
|
|
|||
|
|
@ -0,0 +1,7 @@
|
|||
try:
|
||||
import pkg_resources
|
||||
pkg_resources.declare_namespace(__name__)
|
||||
except ImportError:
|
||||
import pkgutil
|
||||
__path__ = pkgutil.extend_path(__path__, __name__)
|
||||
|
||||
|
|
@ -0,0 +1,53 @@
|
|||
from ckan.lib.base import _
|
||||
from ckan.authz import Authorizer
|
||||
from ckan.model import User
|
||||
|
||||
from ckanext.harvest.model import HarvestSource
|
||||
|
||||
def harvest_source_create(context,data_dict):
|
||||
model = context['model']
|
||||
user = context.get('user','')
|
||||
|
||||
# Non-logged users can not create sources
|
||||
if not user:
|
||||
return {'success': False, 'msg': _('Non-logged in users are not authorized to create harvest sources')}
|
||||
|
||||
# Sysadmins and the rest of logged users can create sources,
|
||||
# as long as they belong to a publisher
|
||||
user_obj = User.get(user)
|
||||
if not Authorizer().is_sysadmin(user) and len(user_obj.get_groups()) == 0:
|
||||
return {'success': False, 'msg': _('User %s must belong to a publisher to create harvest sources') % str(user)}
|
||||
else:
|
||||
return {'success': True}
|
||||
|
||||
def harvest_job_create(context,data_dict):
|
||||
model = context['model']
|
||||
user = context.get('user')
|
||||
|
||||
source_id = data_dict['source_id']
|
||||
|
||||
if not user:
|
||||
return {'success': False, 'msg': _('Non-logged in users are not authorized to create harvest jobs')}
|
||||
|
||||
if Authorizer().is_sysadmin(user):
|
||||
return {'success': True}
|
||||
|
||||
user_obj = User.get(user)
|
||||
source = HarvestSource.get(source_id)
|
||||
if not source:
|
||||
raise NotFound
|
||||
|
||||
if not source.publisher_id in [g.id for g in user_obj.get_groups()]:
|
||||
return {'success': False, 'msg': _('User %s not authorized to create a job for source %s') % (str(user),source.id)}
|
||||
else:
|
||||
return {'success': True}
|
||||
|
||||
def harvest_job_create_all(context,data_dict):
|
||||
model = context['model']
|
||||
user = context.get('user')
|
||||
|
||||
if not Authorizer().is_sysadmin(user):
|
||||
return {'success': False, 'msg': _('Only sysadmins can create harvest jobs for all sources') % str(user)}
|
||||
else:
|
||||
return {'success': True}
|
||||
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
from ckan.lib.base import _
|
||||
from ckan.authz import Authorizer
|
||||
from ckan.model import User
|
||||
|
||||
from ckanext.harvest.logic.auth import get_source_object
|
||||
|
||||
def harvest_source_delete(context,data_dict):
|
||||
model = context['model']
|
||||
user = context.get('user','')
|
||||
|
||||
source = get_source_object(context,data_dict)
|
||||
|
||||
# Non-logged users can not delete this source
|
||||
if not user:
|
||||
return {'success': False, 'msg': _('Non-logged in users are not authorized to delete harvest sources')}
|
||||
|
||||
# Sysadmins can delete the source
|
||||
if Authorizer().is_sysadmin(user):
|
||||
return {'success': True}
|
||||
|
||||
# Check if the source publisher id exists on the user's groups
|
||||
user_obj = User.get(user)
|
||||
if not source.publisher_id in [g.id for g in user_obj.get_groups()]:
|
||||
return {'success': False, 'msg': _('User %s not authorized to delete harvest source %s') % (str(user),source.id)}
|
||||
else:
|
||||
return {'success': True}
|
||||
|
||||
|
|
@ -0,0 +1,156 @@
|
|||
from ckan.lib.base import _
|
||||
from ckan.authz import Authorizer
|
||||
from ckan.model import User
|
||||
|
||||
from ckanext.harvest.model import HarvestSource
|
||||
from ckanext.harvest.logic.auth import get_source_object, get_job_object
|
||||
|
||||
def harvest_source_show(context,data_dict):
|
||||
model = context['model']
|
||||
user = context.get('user','')
|
||||
|
||||
source = get_source_object(context,data_dict)
|
||||
|
||||
# Non-logged users can not read the source
|
||||
if not user:
|
||||
return {'success': False, 'msg': _('Non-logged in users are not authorized to see harvest sources')}
|
||||
|
||||
# Sysadmins can read the source
|
||||
if Authorizer().is_sysadmin(user):
|
||||
return {'success': True}
|
||||
|
||||
# Check if the source publisher id exists on the user's groups
|
||||
user_obj = User.get(user)
|
||||
if not source.publisher_id in [g.id for g in user_obj.get_groups()]:
|
||||
return {'success': False, 'msg': _('User %s not authorized to read harvest source %s') % (str(user),source.id)}
|
||||
else:
|
||||
return {'success': True}
|
||||
|
||||
def harvest_source_list(context,data_dict):
|
||||
|
||||
model = context['model']
|
||||
user = context.get('user')
|
||||
|
||||
# Here we will just check that the user is logged in.
|
||||
# The logic action will return an empty list if the user does not
|
||||
# have permissons on any source.
|
||||
if not user:
|
||||
return {'success': False, 'msg': _('Only logged users are authorized to see their sources')}
|
||||
else:
|
||||
user_obj = User.get(user)
|
||||
# Only users belonging to a publisher can list sources,
|
||||
# unless they are sysadmins
|
||||
if not Authorizer().is_sysadmin(user) and len(user_obj.get_groups()) == 0:
|
||||
return {'success': False, 'msg': _('User %s must belong to a publisher to list harvest sources') % str(user)}
|
||||
else:
|
||||
return {'success': True}
|
||||
|
||||
|
||||
def harvest_job_show(context,data_dict):
|
||||
model = context['model']
|
||||
user = context.get('user')
|
||||
|
||||
job = get_job_object(context,data_dict)
|
||||
|
||||
if not user:
|
||||
return {'success': False, 'msg': _('Non-logged in users are not authorized to see harvest jobs')}
|
||||
|
||||
if Authorizer().is_sysadmin(user):
|
||||
return {'success': True}
|
||||
|
||||
user_obj = User.get(user)
|
||||
if not job.source.publisher_id in [g.id for g in user_obj.get_groups()]:
|
||||
return {'success': False, 'msg': _('User %s not authorized to read harvest job %s') % (str(user),job.id)}
|
||||
else:
|
||||
return {'success': True}
|
||||
|
||||
def harvest_job_list(context,data_dict):
|
||||
model = context['model']
|
||||
user = context.get('user')
|
||||
|
||||
# Check user is logged in
|
||||
if not user:
|
||||
return {'success': False, 'msg': _('Only logged users are authorized to see their sources')}
|
||||
|
||||
user_obj = User.get(user)
|
||||
|
||||
# Checks for non sysadmin users
|
||||
if not Authorizer().is_sysadmin(user):
|
||||
if len(user_obj.get_groups()) == 0:
|
||||
return {'success': False, 'msg': _('User %s must belong to a publisher to list harvest jobs') % str(user)}
|
||||
|
||||
source_id = data_dict.get('source_id',False)
|
||||
if not source_id:
|
||||
return {'success': False, 'msg': _('Only sysadmins can list all harvest jobs') % str(user)}
|
||||
|
||||
source = HarvestSource.get(source_id)
|
||||
if not source:
|
||||
raise NotFound
|
||||
|
||||
if not source.publisher_id in [g.id for g in user_obj.get_groups()]:
|
||||
return {'success': False, 'msg': _('User %s not authorized to list jobs from source %s') % (str(user),source.id)}
|
||||
|
||||
return {'success': True}
|
||||
|
||||
def harvest_object_show(context,data_dict):
|
||||
model = context['model']
|
||||
user = context.get('user')
|
||||
|
||||
obj = get_obj_object(context,data_dict)
|
||||
|
||||
if not user:
|
||||
return {'success': False, 'msg': _('Non-logged in users are not authorized to see harvest objects')}
|
||||
|
||||
if Authorizer().is_sysadmin(user):
|
||||
return {'success': True}
|
||||
|
||||
user_obj = User.get(user)
|
||||
if not obj.source.publisher_id in [g.id for g in user_obj.get_groups()]:
|
||||
return {'success': False, 'msg': _('User %s not authorized to read harvest object %s') % (str(user),obj.id)}
|
||||
else:
|
||||
return {'success': True}
|
||||
|
||||
def harvest_object_list(context,data_dict):
|
||||
model = context['model']
|
||||
user = context.get('user')
|
||||
|
||||
# Check user is logged in
|
||||
if not user:
|
||||
return {'success': False, 'msg': _('Only logged users are authorized to see their sources')}
|
||||
|
||||
user_obj = User.get(user)
|
||||
|
||||
# Checks for non sysadmin users
|
||||
if not Authorizer().is_sysadmin(user):
|
||||
if len(user_obj.get_groups()) == 0:
|
||||
return {'success': False, 'msg': _('User %s must belong to a publisher to list harvest objects') % str(user)}
|
||||
|
||||
source_id = data_dict.get('source_id',False)
|
||||
if not source_id:
|
||||
return {'success': False, 'msg': _('Only sysadmins can list all harvest objects') % str(user)}
|
||||
|
||||
source = HarvestSource.get(source_id)
|
||||
if not source:
|
||||
raise NotFound
|
||||
|
||||
if not source.publisher_id in [g.id for g in user_obj.get_groups()]:
|
||||
return {'success': False, 'msg': _('User %s not authorized to list objects from source %s') % (str(user),source.id)}
|
||||
|
||||
return {'success': True}
|
||||
|
||||
def harvesters_info_show(context,data_dict):
|
||||
model = context['model']
|
||||
user = context.get('user','')
|
||||
|
||||
# Non-logged users can not create sources
|
||||
if not user:
|
||||
return {'success': False, 'msg': _('Non-logged in users can not see the harvesters info')}
|
||||
|
||||
# Sysadmins and the rest of logged users can see the harvesters info,
|
||||
# as long as they belong to a publisher
|
||||
user_obj = User.get(user)
|
||||
if not Authorizer().is_sysadmin(user) and len(user_obj.get_groups()) == 0:
|
||||
return {'success': False, 'msg': _('User %s must belong to a publisher to see the harvesters info') % str(user)}
|
||||
else:
|
||||
return {'success': True}
|
||||
|
||||
|
|
@ -0,0 +1,83 @@
|
|||
from ckan.lib.base import _
|
||||
from ckan.authz import Authorizer
|
||||
from ckan.model import User
|
||||
|
||||
from ckanext.harvest.logic.auth import get_source_object
|
||||
|
||||
def harvest_source_update(context,data_dict):
|
||||
model = context['model']
|
||||
user = context.get('user','')
|
||||
|
||||
source = get_source_object(context,data_dict)
|
||||
|
||||
# Non-logged users can not update this source
|
||||
if not user:
|
||||
return {'success': False, 'msg': _('Non-logged in users are not authorized to update harvest sources')}
|
||||
|
||||
# Sysadmins can update the source
|
||||
if Authorizer().is_sysadmin(user):
|
||||
return {'success': True}
|
||||
|
||||
# Check if the source publisher id exists on the user's groups
|
||||
user_obj = User.get(user)
|
||||
if not source.publisher_id in [g.id for g in user_obj.get_groups()]:
|
||||
return {'success': False, 'msg': _('User %s not authorized to update harvest source %s') % (str(user),source.id)}
|
||||
else:
|
||||
return {'success': True}
|
||||
|
||||
def harvest_objects_import(context,data_dict):
|
||||
model = context['model']
|
||||
user = context.get('user')
|
||||
|
||||
# Check user is logged in
|
||||
if not user:
|
||||
return {'success': False, 'msg': _('Only logged users are authorized to reimport harvest objects')}
|
||||
|
||||
user_obj = User.get(user)
|
||||
|
||||
# Checks for non sysadmin users
|
||||
if not Authorizer().is_sysadmin(user):
|
||||
if len(user_obj.get_groups()) == 0:
|
||||
return {'success': False, 'msg': _('User %s must belong to a publisher to reimport harvest objects') % str(user)}
|
||||
|
||||
source_id = data_dict.get('source_id',False)
|
||||
if not source_id:
|
||||
return {'success': False, 'msg': _('Only sysadmins can reimport all harvest objects') % str(user)}
|
||||
|
||||
source = HarvestSource.get(source_id)
|
||||
if not source:
|
||||
raise NotFound
|
||||
|
||||
if not source.publisher_id in [g.id for g in user_obj.get_groups()]:
|
||||
return {'success': False, 'msg': _('User %s not authorized to reimport objects from source %s') % (str(user),source.id)}
|
||||
|
||||
return {'success': True}
|
||||
|
||||
def harvest_jobs_run(context,data_dict):
|
||||
model = context['model']
|
||||
user = context.get('user')
|
||||
|
||||
# Check user is logged in
|
||||
if not user:
|
||||
return {'success': False, 'msg': _('Only logged users are authorized to run harvest jobs')}
|
||||
|
||||
user_obj = User.get(user)
|
||||
|
||||
# Checks for non sysadmin users
|
||||
if not Authorizer().is_sysadmin(user):
|
||||
if len(user_obj.get_groups()) == 0:
|
||||
return {'success': False, 'msg': _('User %s must belong to a publisher to run harvest jobs') % str(user)}
|
||||
|
||||
source_id = data_dict.get('source_id',False)
|
||||
if not source_id:
|
||||
return {'success': False, 'msg': _('Only sysadmins can run all harvest jobs') % str(user)}
|
||||
|
||||
source = HarvestSource.get(source_id)
|
||||
if not source:
|
||||
raise NotFound
|
||||
|
||||
if not source.publisher_id in [g.id for g in user_obj.get_groups()]:
|
||||
return {'success': False, 'msg': _('User %s not authorized to run jobs from source %s') % (str(user),source.id)}
|
||||
|
||||
return {'success': True}
|
||||
|
||||
|
|
@ -1,6 +1,7 @@
|
|||
import os
|
||||
from logging import getLogger
|
||||
|
||||
from pylons import config
|
||||
from genshi.input import HTML
|
||||
from genshi.filters import Transformer
|
||||
|
||||
|
|
@ -88,35 +89,36 @@ class Harvest(SingletonPlugin):
|
|||
}
|
||||
|
||||
def get_auth_functions(self):
|
||||
from ckanext.harvest.logic.auth.get import (harvest_source_show,
|
||||
harvest_source_list,
|
||||
harvest_job_show,
|
||||
harvest_job_list,
|
||||
harvest_object_show,
|
||||
harvest_object_list,
|
||||
harvesters_info_show,)
|
||||
from ckanext.harvest.logic.auth.create import (harvest_source_create,
|
||||
harvest_job_create,
|
||||
harvest_job_create_all,)
|
||||
from ckanext.harvest.logic.auth.update import (harvest_source_update,
|
||||
harvest_objects_import,
|
||||
harvest_jobs_run)
|
||||
from ckanext.harvest.logic.auth.delete import (harvest_source_delete,)
|
||||
|
||||
return {
|
||||
'harvest_source_show': harvest_source_show,
|
||||
'harvest_source_list': harvest_source_list,
|
||||
'harvest_job_show': harvest_job_show,
|
||||
'harvest_job_list': harvest_job_list,
|
||||
'harvest_object_show': harvest_object_show,
|
||||
'harvest_object_list': harvest_object_list,
|
||||
'harvesters_info_show': harvesters_info_show,
|
||||
'harvest_source_create': harvest_source_create,
|
||||
'harvest_job_create': harvest_job_create,
|
||||
'harvest_job_create_all': harvest_job_create_all,
|
||||
'harvest_source_update': harvest_source_update,
|
||||
'harvest_source_delete': harvest_source_delete,
|
||||
'harvest_objects_import': harvest_objects_import,
|
||||
'harvest_jobs_run':harvest_jobs_run
|
||||
}
|
||||
module_root = 'ckanext.harvest.logic.auth'
|
||||
auth_profile = config.get('ckan.harvest.auth.profile', '')
|
||||
|
||||
auth_functions = _get_auth_functions(module_root)
|
||||
if auth_profile:
|
||||
module_root = '%s.%s' % (module_root, auth_profile)
|
||||
auth_functions = _get_auth_functions(module_root,auth_functions)
|
||||
|
||||
log.info('Using auth profile at %s' % module_root)
|
||||
|
||||
return auth_functions
|
||||
|
||||
def _get_auth_functions(module_root, auth_functions = {}):
|
||||
|
||||
for auth_module_name in ['get', 'create', 'update','delete']:
|
||||
module_path = '%s.%s' % (module_root, auth_module_name,)
|
||||
try:
|
||||
module = __import__(module_path)
|
||||
except ImportError,e:
|
||||
log.debug('No auth module for action "%s"' % auth_module_name)
|
||||
continue
|
||||
|
||||
for part in module_path.split('.')[1:]:
|
||||
module = getattr(module, part)
|
||||
|
||||
for key, value in module.__dict__.items():
|
||||
if not key.startswith('_'):
|
||||
auth_functions[key] = value
|
||||
|
||||
|
||||
return auth_functions
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue