def create_permissions(self):
        # module.(access|create|change|delete)_[name]
        # module.(none|read|write|admin)
        perms = [
         ('repository.none', 'Repository no access'),
         ('repository.read', 'Repository read access'),
         ('repository.write', 'Repository write access'),
         ('repository.admin', 'Repository admin access'),

         ('group.none', 'Repositories Group no access'),
         ('group.read', 'Repositories Group read access'),
         ('group.write', 'Repositories Group write access'),
         ('group.admin', 'Repositories Group admin access'),

         ('hg.admin', 'Hg Administrator'),
         ('hg.create.repository', 'Repository create'),
         ('hg.create.none', 'Repository creation disabled'),
         ('hg.register.none', 'Register disabled'),
         ('hg.register.manual_activate', 'Register new user with RhodeCode '
                                         'without manual activation'),

         ('hg.register.auto_activate', 'Register new user with RhodeCode '
                                        'without auto activation'),
        ]

        for p in perms:
            if not Permission.get_by_key(p[0]):
                new_perm = Permission()
                new_perm.permission_name = p[0]
                new_perm.permission_longname = p[1]
                self.sa.add(new_perm)

    def test_revoke_perm_fork_repo(self):
        self.log_user()
        perm_none = Permission.get_by_key('hg.fork.none')
        perm_fork = Permission.get_by_key('hg.fork.repository')

        user = UserModel().create_or_update(username='dummy', password='qwe',
                                            email='dummy', firstname='a',
                                            lastname='b')
        Session().commit()
        uid = user.user_id

        try:
            #User should have None permission on creation repository
            self.assertEqual(UserModel().has_perm(user, perm_none), False)
            self.assertEqual(UserModel().has_perm(user, perm_fork), False)

            response = self.app.post(url('user_perm', id=uid),
                                     params=dict(_method='put'))

            perm_none = Permission.get_by_key('hg.create.none')
            perm_create = Permission.get_by_key('hg.create.repository')

            #User should have None permission on creation repository
            self.assertEqual(UserModel().has_perm(uid, perm_none), True)
            self.assertEqual(UserModel().has_perm(uid, perm_create), False)
        finally:
            UserModel().delete(uid)
            Session().commit()

    def update_perm(self, id):
        """PUT /users_perm/id: Update an existing item"""
        # url('user_perm', id=ID, method='put')

        grant_perm = request.POST.get('create_repo_perm', False)
        user_model = UserModel()

        if grant_perm:
            perm = Permission.get_by_key('hg.create.none')
            user_model.revoke_perm(id, perm)

            perm = Permission.get_by_key('hg.create.repository')
            user_model.grant_perm(id, perm)
            h.flash(_("Granted 'repository create' permission to user"),
                    category='success')
            Session.commit()
        else:
            perm = Permission.get_by_key('hg.create.repository')
            user_model.revoke_perm(id, perm)

            perm = Permission.get_by_key('hg.create.none')
            user_model.grant_perm(id, perm)
            h.flash(_("Revoked 'repository create' permission to user"),
                    category='success')
            Session.commit()
        return redirect(url('edit_user', id=id))

    def create_permissions(self):
        #module.(access|create|change|delete)_[name]
        #module.(read|write|owner)
        perms = [('repository.none', 'Repository no access'),
                 ('repository.read', 'Repository read access'),
                 ('repository.write', 'Repository write access'),
                 ('repository.admin', 'Repository admin access'),
                 ('hg.admin', 'Hg Administrator'),
                 ('hg.create.repository', 'Repository create'),
                 ('hg.create.none', 'Repository creation disabled'),
                 ('hg.register.none', 'Register disabled'),
                 ('hg.register.manual_activate', 'Register new user with '
                                                 'RhodeCode without manual'
                                                 'activation'),

                 ('hg.register.auto_activate', 'Register new user with '
                                               'RhodeCode without auto '
                                               'activation'),
                ]

        for p in perms:
            new_perm = Permission()
            new_perm.permission_name = p[0]
            new_perm.permission_longname = p[1]
            try:
                self.sa.add(new_perm)
                self.sa.commit()
            except:
                self.sa.rollback()
                raise

    def test_revoke_perm_fork_repo(self):
        self.log_user()
        perm_none = Permission.get_by_key("hg.fork.none")
        perm_fork = Permission.get_by_key("hg.fork.repository")

        user = UserModel().create_or_update(
            username="dummy", password="qwe", email="dummy", firstname="a", lastname="b"
        )
        Session().commit()
        uid = user.user_id

        try:
            # User should have None permission on creation repository
            self.assertEqual(UserModel().has_perm(user, perm_none), False)
            self.assertEqual(UserModel().has_perm(user, perm_fork), False)

            response = self.app.post(url("user_perm", id=uid), params=dict(_method="put"))

            perm_none = Permission.get_by_key("hg.create.none")
            perm_create = Permission.get_by_key("hg.create.repository")

            # User should have None permission on creation repository
            self.assertEqual(UserModel().has_perm(uid, perm_none), True)
            self.assertEqual(UserModel().has_perm(uid, perm_create), False)
        finally:
            UserModel().delete(uid)
            Session().commit()

    def update(self, form_result):
        perm_user = User.get_by_username(username=form_result['perm_user_name'])
        u2p = self.sa.query(UserToPerm).filter(UserToPerm.user == perm_user).all()

        try:
            def _make_new(usr, perm_name):
                new = UserToPerm()
                new.user = usr
                new.permission = Permission.get_by_key(perm_name)
                return new
            # clear current entries, to make this function idempotent
            # it will fix even if we define more permissions or permissions
            # are somehow missing
            for p in u2p:
                self.sa.delete(p)
            #create fresh set of permissions
            for def_perm_key in ['default_repo_perm', 'default_group_perm',
                                 'default_register', 'default_create',
                                 'default_fork']:
                p = _make_new(perm_user, form_result[def_perm_key])
                self.sa.add(p)

            #stage 2 update all default permissions for repos if checked
            if form_result['overwrite_default_repo'] == True:
                _def_name = form_result['default_repo_perm'].split('repository.')[-1]
                _def = Permission.get_by_key('repository.' + _def_name)
                # repos
                for r2p in self.sa.query(UserRepoToPerm)\
                               .filter(UserRepoToPerm.user == perm_user)\
                               .all():

                    #don't reset PRIVATE repositories
                    if not r2p.repository.private:
                        r2p.permission = _def
                        self.sa.add(r2p)

            if form_result['overwrite_default_group'] == True:
                _def_name = form_result['default_group_perm'].split('group.')[-1]
                # groups
                _def = Permission.get_by_key('group.' + _def_name)
                for g2p in self.sa.query(UserRepoGroupToPerm)\
                               .filter(UserRepoGroupToPerm.user == perm_user)\
                               .all():
                    g2p.permission = _def
                    self.sa.add(g2p)

            # stage 3 set anonymous access
            if perm_user.username == 'default':
                perm_user.active = str2bool(form_result['anonymous'])
                self.sa.add(perm_user)

            self.sa.commit()
        except (DatabaseError,):
            log.error(traceback.format_exc())
            self.sa.rollback()
            raise

 def create_permissions(self):
     """
     Create permissions for whole system
     """
     for p in Permission.PERMS:
         if not Permission.get_by_key(p[0]):
             new_perm = Permission()
             new_perm.permission_name = p[0]
             new_perm.permission_longname = p[0]  #translation err with p[1]
             self.sa.add(new_perm)

    def create_permissions(self):
        # module.(access|create|change|delete)_[name]
        # module.(none|read|write|admin)

        for p in Permission.PERMS:
            if not Permission.get_by_key(p[0]):
                new_perm = Permission()
                new_perm.permission_name = p[0]
                new_perm.permission_longname = p[0]
                self.sa.add(new_perm)

    def update(self, id):
        """PUT /users/id: Update an existing item"""
        # Forms posted to this method should contain a hidden field:
        #    <input type="hidden" name="_method" value="PUT" />
        # Or using helpers:
        #    h.form(url('update_user', id=ID),
        #           method='put')
        # url('user', id=ID)
        user_model = UserModel()
        c.user = user_model.get(id)

        _form = UserForm(edit=True, old_data={'user_id': id,
                                              'email': c.user.email})()
        form_result = {}
        try:
            form_result = _form.to_python(dict(request.POST))
            user_model.update(id, form_result)
            h.flash(_('User updated successfully'), category='success')
            Session.commit()
        except formencode.Invalid, errors:
            e = errors.error_dict or {}
            perm = Permission.get_by_key('hg.create.repository')
            e.update({'create_repo_perm': user_model.has_perm(id, perm)})
            return htmlfill.render(
                render('admin/users/user_edit.html'),
                defaults=errors.value,
                errors=e,
                prefix_error=False,
                encoding="UTF-8")

    def tearDown(self):
        perm = Permission.query().all()
        for p in perm:
            UserModel().revoke_perm(self.u1, p)

        UserModel().delete(self.u1)
        Session().commit()

    def test_enable_repository_read_on_group(self):
        self.log_user()
        users_group_name = TEST_USERS_GROUP + 'another2'
        response = self.app.post(url('users_groups'),
                                 {'users_group_name': users_group_name,
                                  'active':True})
        response.follow()

        ug = UsersGroup.get_by_group_name(users_group_name)
        self.checkSessionFlash(response,
                               'created users group %s' % users_group_name)

        response = self.app.put(url('users_group_perm', id=ug.users_group_id),
                                 {'create_repo_perm': True})

        response.follow()
        ug = UsersGroup.get_by_group_name(users_group_name)
        p = Permission.get_by_key('hg.create.repository')
        # check if user has this perm
        perms = UsersGroupToPerm.query()\
            .filter(UsersGroupToPerm.users_group == ug).all()
        perms = [[x.__dict__['users_group_id'],
                  x.__dict__['permission_id'],] for x in perms]
        self.assertEqual(
            perms,
            [[ug.users_group_id, p.permission_id]]
        )

        # DELETE !
        ug = UsersGroup.get_by_group_name(users_group_name)
        ugid = ug.users_group_id
        response = self.app.delete(url('users_group', id=ug.users_group_id))
        response = response.follow()
        gr = self.Session.query(UsersGroup)\
                           .filter(UsersGroup.users_group_name ==
                                   users_group_name).scalar()

        self.assertEqual(gr, None)
        p = Permission.get_by_key('hg.create.repository')
        perms = UsersGroupToPerm.query()\
            .filter(UsersGroupToPerm.users_group_id == ugid).all()
        perms = [[x.__dict__['users_group_id'],
                  x.__dict__['permission_id'],] for x in perms]
        self.assertEqual(
            perms,
            []
        )

    def test_revoke_perm(self):
        perm = Permission.query().all()[0]
        UserModel().grant_perm(self.u1, perm)
        Session().commit()
        self.assertEqual(UserModel().has_perm(self.u1, perm), True)

        #revoke
        UserModel().revoke_perm(self.u1, perm)
        Session().commit()
        self.assertEqual(UserModel().has_perm(self.u1, perm), False)

def get_perm_or_error(permid):
    """
    Get permission by id or name or return JsonRPCError if not found

    :param userid:
    """
    perm = Permission.get_by_key(permid)
    if perm is None:
        raise JSONRPCError('permission `%s` does not exist' % (permid))
    return perm

    def test_set_default_permissions_after_modification(self, perm, modify_to):
        PermissionModel().create_default_permissions(user=self.u1)
        self._test_def_perm_equal(user=self.u1)

        old = Permission.get_by_key(perm)
        new = Permission.get_by_key(modify_to)
        self.assertNotEqual(old, None)
        self.assertNotEqual(new, None)

        #now modify permissions
        p = UserToPerm.query()\
                .filter(UserToPerm.user == self.u1)\
                .filter(UserToPerm.permission == old)\
                .one()
        p.permission = new
        Session().add(p)
        Session().commit()

        PermissionModel().create_default_permissions(user=self.u1)
        self._test_def_perm_equal(user=self.u1)

 def update_user_permission(self, repository, user, permission):
     permission = Permission.get_by_key(permission)
     current = self.get_user_permission(repository, user)
     if current:
         if not current.permission is permission:
             current.permission = permission
     else:
         p = UserRepoToPerm()
         p.user = user
         p.repository = repository
         p.permission = permission
         self.sa.add(p)

 def update_users_group_permission(self, repository, users_group, permission):
     permission = Permission.get_by_key(permission)
     current = self.get_users_group_permission(repository, users_group)
     if current:
         if not current.permission is permission:
             current.permission = permission
     else:
         p = UsersGroupRepoToPerm()
         p.users_group = users_group
         p.repository = repository
         p.permission = permission
         self.sa.add(p)
     Session.commit()

    def test_revoke_perm_create_repo(self):
        self.log_user()
        perm_none = Permission.get_by_key('hg.create.none')
        perm_create = Permission.get_by_key('hg.create.repository')

        user = User.get_by_username(TEST_USER_REGULAR2_LOGIN)


        #User should have None permission on creation repository
        self.assertEqual(UserModel().has_perm(user, perm_none), False)
        self.assertEqual(UserModel().has_perm(user, perm_create), False)

        response = self.app.post(url('user_perm', id=user.user_id),
                                 params=dict(_method='put'))

        perm_none = Permission.get_by_key('hg.create.none')
        perm_create = Permission.get_by_key('hg.create.repository')

        user = User.get_by_username(TEST_USER_REGULAR2_LOGIN)
        #User should have None permission on creation repository
        self.assertEqual(UserModel().has_perm(user, perm_none), True)
        self.assertEqual(UserModel().has_perm(user, perm_create), False)

    def _create_default_perms(self, new_group):
        # create default permission
        default_perm = 'group.read'
        def_user = User.get_default_user()
        for p in def_user.user_perms:
            if p.permission.permission_name.startswith('group.'):
                default_perm = p.permission.permission_name
                break

        repo_group_to_perm = UserRepoGroupToPerm()
        repo_group_to_perm.permission = Permission.get_by_key(default_perm)

        repo_group_to_perm.group = new_group
        repo_group_to_perm.user_id = def_user.user_id
        return repo_group_to_perm

    def _create_default_perms(self, user_group):
        # create default permission
        default_perm = "usergroup.read"
        def_user = User.get_default_user()
        for p in def_user.user_perms:
            if p.permission.permission_name.startswith("usergroup."):
                default_perm = p.permission.permission_name
                break

        user_group_to_perm = UserUserGroupToPerm()
        user_group_to_perm.permission = Permission.get_by_key(default_perm)

        user_group_to_perm.user_group = user_group
        user_group_to_perm.user_id = def_user.user_id
        return user_group_to_perm

    def _create_default_perms(self, repository, private):
        # create default permission
        default = 'repository.read'
        def_user = User.get_default_user()
        for p in def_user.user_perms:
            if p.permission.permission_name.startswith('repository.'):
                default = p.permission.permission_name
                break

        default_perm = 'repository.none' if private else default

        repo_to_perm = UserRepoToPerm()
        repo_to_perm.permission = Permission.get_by_key(default_perm)

        repo_to_perm.repository = repository
        repo_to_perm.user_id = def_user.user_id

        return repo_to_perm