MembershipTool.py

   1 # -*- coding: utf-8 -*-
   2 #######################################################################################
   3 #   Plinn - http://plinn.org                                                          #
   4 #   Copyright (C) 2005-2007  Benoît PIN <benoit.pin@ensmp.fr>                         #
   5 #                                                                                     #
   6 #   This program is free software; you can redistribute it and/or                     #
   7 #   modify it under the terms of the GNU General Public License                       #
   8 #   as published by the Free Software Foundation; either version 2                    #
   9 #   of the License, or (at your option) any later version.                            #
  10 #                                                                                     #
  11 #   This program is distributed in the hope that it will be useful,                   #
  12 #   but WITHOUT ANY WARRANTY; without even the implied warranty of                    #
  13 #   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the                     #
  14 #   GNU General Public License for more details.                                      #
  15 #                                                                                     #
  16 #   You should have received a copy of the GNU General Public License                 #
  17 #   along with this program; if not, write to the Free Software                       #
  18 #   Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.   #
  19 #######################################################################################
  20 """ Plinn portal_membership
  21
  22
  23
  24 """
  25
  26 from AccessControl import ClassSecurityInfo, getSecurityManager
  27 from AccessControl.unauthorized import Unauthorized
  28 from AccessControl.SpecialUsers import nobody
  29 from AccessControl.Permission import Permission
  30 from Acquisition import aq_base, aq_inner
  31 from Globals import InitializeClass, MessageDialog
  32 from Products.PageTemplates.PageTemplateFile import PageTemplateFile
  33
  34 from Products.CMFDefault.MembershipTool import MembershipTool as BaseTool
  35 from Products.CMFCore.permissions import View, ListPortalMembers, ManagePortal, SetOwnPassword, ChangePermissions
  36 from permissions import RemoveMember, SetLocalRoles, CheckMemberPermission
  37 from utils import _checkMemberPermission
  38 from Products.CMFCore.utils import getToolByName, _checkPermission, _getAuthenticatedUser
  39 from utils import formatFullName, translate
  40 from Products.CMFDefault.utils import decode
  41 from Products.CMFDefault.Document import addDocument
  42
  43 from sets import Set
  44 from types import TupleType
  45
  46
  47 from time import time
  48 from logging import getLogger
  49 console = getLogger('Plinn.MembershipTool')
  50
  51
  52 class MembershipTool( BaseTool ):
  53     """ Implement 'portal_membership' interface using "stock" policies.
  54     """
  55
  56
  57     meta_type = 'Plinn Membership Tool'
  58
  59     manage_options=( ({ 'label' : 'Configuration'
  60                         , 'action' : 'manage_mapRoles'
  61                          },) + BaseTool.manage_options[1:])
  62
  63     security = ClassSecurityInfo()
  64
  65     security.declareProtected(ManagePortal, 'manage_mapRoles')
  66     manage_mapRoles = PageTemplateFile('www/configureMembershipTool', globals(),
  67                                    __name__='manage_mapRoles')
  68
  69     #
  70     #   'portal_membership' interface methods
  71     #
  72
  73     # change security settings for inherited methods
  74     security.declareProtected(ListPortalMembers, 'getMemberById')
  75
  76
  77     memberareaPortalType = 'Huge Plinn Folder'
  78
  79
  80 #   security.declareProtected(SetOwnPassword, 'setPassword')
  81 #   def setPassword(self, password, domains=None):
  82 #       '''Allows the authenticated member to set his/her own password.
  83 #       '''
  84 #       user_folder = self.__getPUS()
  85 #       if user_folder.meta_type == 'Group User Folder' :
  86 #           registration = getToolByName(self, 'portal_registration', None)
  87 #           if not self.isAnonymousUser():
  88 #               member = self.getAuthenticatedMember()
  89 #               if registration:
  90 #                   failMessage = registration.testPasswordValidity(password)
  91 #                   if failMessage is not None:
  92 #                       raise 'Bad Request', failMessage
  93 #               member.setSecurityProfile(password=password, domains=domains)
  94 #               member.changePassword(password)
  95 #           else:
  96 #               raise 'Bad Request', 'Not logged in.'
  97 #
  98 #       else :
  99 #           BaseTool.setPassword(self, password, domains=None)
 100
 101
 102
 103     security.declareProtected(ListPortalMembers, 'listMemberIds')
 104     def listMemberIds(self):
 105         '''Lists the ids of all members.    This may eventually be
 106         replaced with a set of methods for querying pieces of the
 107         list rather than the entire list at once.
 108         '''
 109         user_folder = self.__getPUS()
 110         if user_folder.meta_type == 'Group User Folder' :
 111             return user_folder.getPureUserNames()
 112         else :
 113             return [ x.getId() for x in user_folder.getUsers() ]
 114
 115
 116     security.declareProtected(CheckMemberPermission, 'checkMemberPermission')
 117     def checkMemberPermission(self, userid, permissionName, object, subobjectName=None):
 118         '''
 119         Checks whether the current user has the given permission on
 120         the given object or subobject.
 121         '''
 122         if subobjectName is not None:
 123             object = getattr(object, subobjectName)
 124
 125         return _checkMemberPermission(userid, permissionName, object)
 126
 127     security.declareProtected(ListPortalMembers, 'listMembers')
 128     def listMembers(self):
 129         '''Gets the list of all members.
 130         '''
 131         user_folder = self.__getPUS()
 132         if user_folder.meta_type == 'Group User Folder' :
 133             return map(self.wrapUser, user_folder.getPureUsers())
 134         else :
 135             return map(self.wrapUser, user_folder.getUsers())
 136
 137
 138     security.declareProtected(View, 'getCandidateLocalRoles')
 139     def getCandidateLocalRoles(self, obj) :
 140         """ What local roles can I assign?
 141         """
 142         member = self.getAuthenticatedMember()
 143         valid_roles = obj.valid_roles()
 144         if 'Manager' in member.getRoles():
 145             local_roles = [r for r in valid_roles if r != 'Anonymous']
 146         else:
 147             sm = getSecurityManager()
 148             allPermissions = self.ac_inherited_permissions(1)
 149
 150             # construct a dictionary of permissions indexed by role
 151             # and get permissions of user in obj context
 152             memberPermissions = Set()
 153             rolesMappings = {}
 154             for role in valid_roles :
 155                 rolesMappings[role] = Set()
 156
 157             for p in allPermissions:
 158                 name, value = p[:2]
 159
 160                 p=Permission(name,value,obj)
 161                 rolesOfPerm = p.getRoles()
 162
 163                 for role in rolesOfPerm :
 164                     try : rolesMappings[role].add(name)
 165                     except KeyError :
 166                         trName = p._p
 167                         if hasattr(obj, trName):
 168                             l = list(getattr(obj, trName))
 169                             l.remove(role)
 170                             setattr(obj, trName, tuple(l))
 171                             msg = '%s role has been removed for %s permission on %s ' % (role, name, obj.absolute_url())
 172                             #LOG('portal_membership', WARNING, msg)
 173
 174                 parent = obj.aq_inner.aq_parent
 175                 while type(rolesOfPerm) != TupleType :
 176                     p=Permission(name, value, parent)
 177                     rolesOfPerm = p.getRoles()
 178                     for role in rolesOfPerm :
 179                         try : rolesMappings[role].add(name)
 180                         except KeyError : pass
 181                     try : parent = parent.aq_inner.aq_parent
 182                     except AttributeError : break
 183
 184
 185                 if sm.checkPermission(name, obj) :
 186                     memberPermissions.add(name)
 187
 188             local_roles = []
 189             for role in valid_roles :
 190                 if rolesMappings[role] and rolesMappings[role].issubset(memberPermissions) :
 191                     local_roles.append(role)
 192
 193         local_roles = [ role for role in local_roles if role not in ('Shared', 'Authenticated', 'Member', 'Anonymous') ]
 194         local_roles.sort()
 195         return tuple(local_roles)
 196
 197
 198     security.declareProtected(View, 'setLocalRoles')
 199     def setLocalRoles( self, obj, member_ids, role, remove=0, reindex=1 ):
 200         """ Set local roles on an item """
 201         if role not in self.getCandidateLocalRoles(obj) :
 202             raise Unauthorized, "You are not allowed to manage %s role" % role
 203
 204         if self.checkPermission(SetLocalRoles, obj) :
 205             if not remove :
 206                 for member_id in member_ids :
 207                     # current roles for user id in obj
 208                     roles = list(obj.get_local_roles_for_userid( userid=member_id ))
 209                     if role not in roles :
 210                         roles.append(role)
 211                         obj.manage_setLocalRoles( member_id, roles)
 212             else :
 213                 for member_id in member_ids :
 214                     # current roles for user id in obj
 215                     roles = list(obj.get_local_roles_for_userid( userid=member_id ))
 216                     try : roles.remove(role)
 217                     except ValueError : pass
 218                     else :
 219                         if len(roles) >= 1 :
 220                             obj.manage_setLocalRoles( member_id, roles)
 221                         else :
 222                             obj.manage_delLocalRoles( userids=[member_id] )
 223
 224         else :
 225             raise Unauthorized
 226
 227         if reindex:
 228             # It is assumed that all objects have the method
 229             # reindexObjectSecurity, which is in CMFCatalogAware and
 230             # thus PortalContent and PortalFolder.
 231             obj.reindexObjectSecurity()
 232
 233
 234     security.declarePublic('getMemberFullNameById')
 235     def getMemberFullNameById(self, userid, nameBefore = 1) :
 236         """ Return  the best formated representation of user fullname. """
 237
 238         memberFullName = ''
 239         if userid and userid != 'No owner' :
 240             # No owner is a possible value returned by DefaultDublinCoreImpl.Creator
 241             member = self.getMemberById(userid)
 242             if not member :
 243                 return userid
 244             memberFullName = member.getMemberFullName(nameBefore=nameBefore)
 245
 246         return memberFullName
 247
 248     security.declareProtected(ListPortalMembers, 'getMembers')
 249     def getMembers(self, users) :
 250         """ Return wraped users """
 251         members = []
 252         for user in users :
 253             members.append(self.getMemberById(user))
 254
 255         members = filter(None, members)
 256         members.sort( lambda m0, m1 : cmp(m0.getMemberSortableFormat(), m1.getMemberSortableFormat()) )
 257         return members
 258
 259
 260     security.declareProtected(ListPortalMembers, 'getOtherMembers')
 261     def getOtherMembers(self, users) :
 262         """ Return members who are not in users list"""
 263         allMemberIds = self.listMemberIds()
 264         otherMemberIds = [ userId for userId in allMemberIds if userId not in users ]
 265         return self.getMembers(otherMemberIds)
 266
 267
 268
 269     security.declareProtected(ListPortalMembers, 'getMembersMetadata')
 270     def getMembersMetadata(self, users) :
 271         """ return metadatas from portal_catalog """
 272         userDict = {}
 273         for u in users : userDict[u] = True
 274         ctool = getToolByName(self, 'portal_catalog')
 275         memberBrains = ctool(portal_type='Member Data', sort_on='getMemberSortableFormat')
 276         memberList = []
 277         complementList = []
 278
 279         if users :
 280             for mb in memberBrains :
 281                 metadatas = {'id' : mb.getId, 'fullname' : mb.getMemberFullName}
 282                 if userDict.has_key(mb.getId) :
 283                     memberList.append(metadatas)
 284                 else :
 285                     complementList.append(metadatas)
 286         else :
 287             complementList = [{'id' : mb.getId, 'fullname' : mb.getMemberFullName} for mb in memberBrains]
 288
 289         return {'memberList' : memberList, 'complementList' : complementList}
 290
 291
 292
 293     security.declareProtected(RemoveMember, 'removeMembers')
 294     def removeMembers(self, memberIds = []) :
 295         """ remove member
 296         """
 297         # TODO : remove member document ?
 298         mdtool = getToolByName(self, 'portal_memberdata')
 299         for m in self.getMembers(memberIds) :
 300             m.manage_beforeDelete()
 301             mdtool.deleteMemberData(m.getId())
 302
 303         self.aq_inner.acl_users.deleteUsers(users = memberIds)
 304
 305
 306
 307     security.declareProtected(ManagePortal, 'setMemberAreaPortalType')
 308     def setMemberAreaPortalType(self, member_folder_portal_type):
 309         """ Set member area portal type to construct."""
 310         ttool = getToolByName(self, 'portal_types')
 311         if member_folder_portal_type not in ttool.objectIds() :
 312             raise ValueError, "Unknown portal type : %s" % str(member_folder_portal_type)
 313
 314         self.memberareaPortalType = member_folder_portal_type
 315         return MessageDialog(title  ='Type updated',
 316                              message='The member area type have been updated',
 317                              action ='manage_mapRoles')
 318
 319     def getMemberAreaPortalType(self) :
 320         return self.memberareaPortalType
 321
 322
 323     def getHomeFolder(self, id=None, verifyPermission=0):
 324         """ Return a member's home folder object, or None.
 325         """
 326         if id is None:
 327             member = self.getAuthenticatedMember()
 328             if not hasattr(member, 'getMemberId'):
 329                 return None
 330             id = member.getMemberId()
 331         members = self.getMembersFolder()
 332         if members is not None:
 333             if not hasattr(members, id) and getattr(self, 'memberareaCreationFlag', 0) != 0 :
 334                 self.createMemberArea(id)
 335             try:
 336                 folder = members._getOb(id)
 337                 if verifyPermission and not _checkPermission(View, folder):
 338                     # Don't return the folder if the user can't get to it.
 339                     return None
 340                 return folder
 341             except (AttributeError, TypeError, KeyError):
 342                 pass
 343         return None
 344
 345     security.declarePublic('createMemberArea')
 346     def createMemberArea(self, member_id=''):
 347         """ Create a member area for 'member_id' or authenticated user.
 348         """
 349         if not self.getMemberareaCreationFlag():
 350             return None
 351         members = self.getMembersFolder()
 352         if not members:
 353             return None
 354         if self.isAnonymousUser():
 355             return None
 356         # Note: We can't use getAuthenticatedMember() and getMemberById()
 357         # because they might be wrapped by MemberDataTool.
 358         user = _getAuthenticatedUser(self)
 359         user_id = user.getId()
 360         if member_id in ('', user_id):
 361             member = user
 362             member_id = user_id
 363         else:
 364             if _checkPermission(ManageUsers, self):
 365                 member = self.acl_users.getUserById(member_id, None)
 366                 if member:
 367                     member = member.__of__(self.acl_users)
 368                 else:
 369                     raise ValueError, 'Member %s does not exist' % member_id
 370             else:
 371                 return None
 372
 373         if hasattr( aq_base(members), member_id ):
 374             return None
 375
 376         ttool = getToolByName(self, 'portal_types')
 377         info = getattr(ttool, self.memberareaPortalType)
 378
 379         memberFullName = self.getMemberFullNameById(member_id, nameBefore = 0)
 380         f = info._constructInstance( members, member_id, title=memberFullName )
 381
 382         # Grant Ownership and Owner role to Member
 383         f.changeOwnership(user)
 384         f.__ac_local_roles__ = None
 385         f.manage_setLocalRoles(member_id, ['Owner'])
 386
 387         f.reindexObjectSecurity()
 388
 389         # Create Member's initial content.
 390         if hasattr(self, 'createMemberContent') :
 391             self.createMemberContent(member=user,
 392                                      member_id=member_id,
 393                                      member_folder=f)
 394         else :
 395             def _(message, context, expand=()) :
 396                 trmessage = decode(translate(message, context), context)
 397                 expand = tuple([decode(e, context) for e in expand])
 398                 return (trmessage % expand).encode('utf-8')
 399
 400             # Create Member's home page.
 401             addDocument( f
 402                         , 'index_html'
 403                         , title = _("%s's Home", self, (memberFullName,))
 404                         , description = _("%s's front page", self, (memberFullName,))
 405                         , text_format = "html"
 406                         , text = self.default_member_content(memberFullName=memberFullName).encode('utf-8')
 407                         )
 408
 409             # Grant Ownership and Owner role to Member
 410             f.index_html.changeOwnership(user)
 411             f.index_html.__ac_local_roles__ = None
 412             f.index_html.manage_setLocalRoles(member_id, ['Owner'])
 413
 414             f.index_html._setPortalTypeName( 'Document' )
 415
 416             # Overcome an apparent catalog bug.
 417             f.index_html.reindexObject()
 418             wftool = getToolByName( f, 'portal_workflow' )
 419             wftool.notifyCreated( f.index_html )
 420
 421         return f
 422
 423
 424     security.declareProtected(ListPortalMembers, 'looseSearchMembers')
 425     def looseSearchMembers(self, searchString) :
 426         """ """
 427
 428         words = searchString.strip().split()
 429         words = [word.lower() for word in words]
 430
 431         mdtool = getToolByName(self, 'portal_memberdata')
 432         mdProperties = mdtool.propertyIds()
 433         searchableProperties = [ p['id'] for p in mdtool.propertyMap() if p['type'] == 'string' ] + ['id']
 434         try : searchableProperties.remove('portal_skin')
 435         except ValueError : pass
 436
 437         match = []
 438         for m in self.listMembers() :
 439             allWordsMatch = False
 440             for word in words :
 441                 for p in searchableProperties :
 442                     if str(m.getProperty(p, '')).lower().find(word) != -1 :
 443                         allWordsMatch = True
 444                         break
 445                 else :
 446                     allWordsMatch = False
 447
 448                 if not allWordsMatch :
 449                     break
 450             else :
 451                 match.append(m)
 452
 453         return match
 454
 455     def __getPUS(self):
 456         # CMFCore.MembershipTool.MembershipTool tests 'getUsers' method but :
 457         # "enumeration" methods ('getUserNames', 'getUsers') are *not*
 458         # part of the contract!  See IEnumerableUserFolder.
 459         # (from PluggableAuthService.interfaces.authservice #233)
 460         return self.acl_users
 461
 462
 463 InitializeClass(MembershipTool)