-
Notifications
You must be signed in to change notification settings - Fork 0
/
schema.py
194 lines (168 loc) · 7.37 KB
/
schema.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
#
# TRACKER SCHEMA
#
# Class automatically gets these properties:
# creation = Date()
# activity = Date()
# creator = Link('user')
# actor = Link('user')
# Priorities
pri = Class(db, "priority",
name=String(),
order=Number())
pri.setkey("name")
# Statuses
stat = Class(db, "status",
name=String(),
order=Number())
stat.setkey("name")
# Keywords
keyword = Class(db, "keyword",
name=String())
keyword.setkey("name")
# User-defined saved searches
query = Class(db, "query",
klass=String(),
name=String(),
url=String(),
private_for=Link('user'))
# add any additional database schema configuration here
user = Class(db, "user",
username=String(),
password=Password(),
address=String(),
realname=String(),
phone=String(),
organisation=String(),
alternate_addresses=String(),
queries=Multilink('query'),
roles=String(), # comma-separated string of Role names
timezone=String())
user.setkey("username")
db.security.addPermission(name='Register', klass='user',
description='User is allowed to register new user')
# FileClass automatically gets this property in addition to the Class ones:
# content = String() [saved to disk in <tracker home>/db/files/]
# type = String() [MIME type of the content, default 'text/plain']
msg = FileClass(db, "msg",
author=Link("user", do_journal='no'),
recipients=Multilink("user", do_journal='no'),
date=Date(),
summary=String(),
files=Multilink("file"),
messageid=String(),
inreplyto=String())
file = FileClass(db, "file",
name=String())
# IssueClass automatically gets these properties in addition to the Class ones:
# title = String()
# messages = Multilink("msg")
# files = Multilink("file")
# nosy = Multilink("user")
# superseder = Multilink("issue")
issue = IssueClass(db, "issue",
assignedto=Link("user"),
keyword=Multilink("keyword"),
priority=Link("priority"),
status=Link("status"))
#
# TRACKER SECURITY SETTINGS
#
# See the configuration and customisation document for information
# about security setup.
#
# REGULAR USERS
#
# Give the regular users access to the web and email interface
db.security.addPermissionToRole('User', 'Web Access')
db.security.addPermissionToRole('User', 'Email Access')
db.security.addPermissionToRole('User', 'Rest Access')
db.security.addPermissionToRole('User', 'Xmlrpc Access')
# Assign the access and edit Permissions for issue, file and message
# to regular users now
for cl in 'issue', 'file', 'msg', 'keyword':
db.security.addPermissionToRole('User', 'View', cl)
db.security.addPermissionToRole('User', 'Edit', cl)
db.security.addPermissionToRole('User', 'Create', cl)
for cl in 'priority', 'status':
db.security.addPermissionToRole('User', 'View', cl)
# May users view other user information? Comment these lines out
# if you don't want them to
p = db.security.addPermission(name='View', klass='user',
properties=('id', 'organisation', 'phone', 'realname', 'timezone',
'username'))
db.security.addPermissionToRole('User', p)
# Users should be able to edit their own details -- this permission is
# limited to only the situation where the Viewed or Edited item is their own.
def own_record(db, userid, itemid):
'''Determine whether the userid matches the item being accessed.'''
return userid == itemid
p = db.security.addPermission(name='View', klass='user', check=own_record,
description="User is allowed to view their own user details")
db.security.addPermissionToRole('User', p)
p = db.security.addPermission(name='Edit', klass='user', check=own_record,
properties=('username', 'password', 'address', 'realname', 'phone',
'organisation', 'alternate_addresses', 'queries', 'timezone'),
description="User is allowed to edit their own user details")
db.security.addPermissionToRole('User', p)
# Users should be able to edit and view their own queries. They should also
# be able to view any marked as not private. They should not be able to
# edit others' queries, even if they're not private
def view_query(db, userid, itemid):
private_for = db.query.get(itemid, 'private_for')
if not private_for: return True
return userid == private_for
def edit_query(db, userid, itemid):
return userid == db.query.get(itemid, 'creator')
p = db.security.addPermission(name='View', klass='query', check=view_query,
description="User is allowed to view their own and public queries")
db.security.addPermissionToRole('User', p)
p = db.security.addPermission(name='Search', klass='query')
db.security.addPermissionToRole('User', p)
p = db.security.addPermission(name='Edit', klass='query', check=edit_query,
description="User is allowed to edit their queries")
db.security.addPermissionToRole('User', p)
p = db.security.addPermission(name='Retire', klass='query', check=edit_query,
description="User is allowed to retire their queries")
db.security.addPermissionToRole('User', p)
p = db.security.addPermission(name='Restore', klass='query', check=edit_query,
description="User is allowed to restore their queries")
db.security.addPermissionToRole('User', p)
p = db.security.addPermission(name='Create', klass='query',
description="User is allowed to create queries")
db.security.addPermissionToRole('User', p)
#
# ANONYMOUS USER PERMISSIONS
#
# Let anonymous users access the web interface. Note that almost all
# trackers will need this Permission. The only situation where it's not
# required is in a tracker that uses an HTTP Basic Authenticated front-end.
db.security.addPermissionToRole('Anonymous', 'Web Access')
# Let anonymous users access the email interface (note that this implies
# that they will be registered automatically, hence they will need the
# "Register" user Permission below)
# This is disabled by default to stop spam from auto-registering users on
# public trackers.
#db.security.addPermissionToRole('Anonymous', 'Email Access')
# Assign the appropriate permissions to the anonymous user's Anonymous
# Role. Choices here are:
# - Allow anonymous users to register
db.security.addPermissionToRole('Anonymous', 'Register', 'user')
# Allow anonymous users access to view issues (and the related, linked
# information)
for cl in 'issue', 'file', 'msg', 'keyword', 'priority', 'status':
db.security.addPermissionToRole('Anonymous', 'View', cl)
# Allow the anonymous user to use the "Show Unassigned" search.
# It acts like "Show Open" if this permission is not available.
# If you are running a tracker that does not allow read access for
# anonymous, you should remove this entry as it can be used to perform
# a username guessing attack against a roundup install.
p = db.security.addPermission(name='Search', klass='user')
db.security.addPermissionToRole ('Anonymous', p)
# [OPTIONAL]
# Allow anonymous users access to create or edit "issue" items (and the
# related file and message items)
#for cl in 'issue', 'file', 'msg':
# db.security.addPermissionToRole('Anonymous', 'Create', cl)
# db.security.addPermissionToRole('Anonymous', 'Edit', cl)
# vim: set filetype=python sts=4 sw=4 et si :