From: Thierry Parmentelat <thierry.parmentelat@sophia.inria.fr>
Date: Thu, 25 Nov 2010 15:06:28 +0000 (+0100)
Subject: permission checking on node tags factorized in Node.caller_may_write_tag
X-Git-Tag: plcapi-5.0-19~28
X-Git-Url: http://git.onelab.eu/?a=commitdiff_plain;h=dcc6f482920ecb0762646729200323408cce436f;p=plcapi.git

permission checking on node tags factorized in Node.caller_may_write_tag
---

diff --git a/PLC/AuthorizeHelpers.py b/PLC/AuthorizeHelpers.py
index 9b772384..5651c109 100644
--- a/PLC/AuthorizeHelpers.py
+++ b/PLC/AuthorizeHelpers.py
@@ -77,6 +77,7 @@ class AuthorizeHelpers:
             site=Sites(api,[node['site_id']])[0]
             return AuthorizeHelpers.person_in_site (api, person, site)
         except:
+            import traceback
             return False
 
     # does the slice belong to the site that the (pi) user is in ?
@@ -84,3 +85,19 @@ class AuthorizeHelpers:
     def slice_belongs_to_pi (api, slice, pi):
         return slice['site_id'] in pi['site_ids']
 
+
+# authorization method - check if a given caller can set tag on this object
+# called in {Add,Update,Delete}NodeTags methods and in the accessors factory
+def caller_may_write_node_tag (node, api, caller, tag_type):
+    if 'admin' in caller['roles']:
+        pass
+    elif not AuthorizeHelpers.caller_may_access_tag_type (api, caller, tag_type):
+        raise PLCPermissionDenied, "Role mismatch for writing tag %s"%(tag_type['tagname'])
+    elif AuthorizeHelpers.node_belongs_to_person (api, node, caller):
+        pass
+    else:
+        raise PLCPermissionDenied, "Writing node tag: must belong in the same site as %s"%\
+            (node['hostname'])
+
+setattr(Node,'caller_may_write_tag',caller_may_write_node_tag)
+        
diff --git a/PLC/Methods/AddNodeTag.py b/PLC/Methods/AddNodeTag.py
index af593f18..d885cacc 100644
--- a/PLC/Methods/AddNodeTag.py
+++ b/PLC/Methods/AddNodeTag.py
@@ -11,8 +11,6 @@ from PLC.Nodes import Node, Nodes
 from PLC.TagTypes import TagType, TagTypes
 from PLC.NodeTags import NodeTag, NodeTags
 
-from PLC.AuthorizeHelpers import AuthorizeHelpers
-
 class AddNodeTag(Method):
     """
     Sets the specified tag for the specified node
@@ -60,18 +58,8 @@ class AddNodeTag(Method):
             raise PLCInvalidArgument, "Node %d already has tag %d"%(node['node_id'],
                                                                     tag_type['tag_type_id'])
 
-
         # check authorizations
-        if 'admin' in self.caller['roles']:
-            pass
-        elif not AuthorizeHelpers.caller_may_access_tag_type (self.api, self.caller, tag_type):
-            raise PLCPermissionDenied, "%s, forbidden tag %s (%s)"%(self.name,tag_type['tagname'],self.caller['email'])
-        elif AuthorizeHelpers.node_belongs_to_person (self.api, node, self.caller):
-            pass
-        else:
-            raise PLCPermissionDenied, "%s: caller %r must belong in the same site as subject node %s"%\
-                (self.name,self.caller,node['hostname'])
-
+        node.caller_may_write_tag(self.api,self.caller,tag_type)
 
         node_tag = NodeTag(self.api)
         node_tag['node_id'] = node['node_id']
diff --git a/PLC/Methods/DeleteNodeTag.py b/PLC/Methods/DeleteNodeTag.py
index 019670ca..2afa446f 100644
--- a/PLC/Methods/DeleteNodeTag.py
+++ b/PLC/Methods/DeleteNodeTag.py
@@ -12,8 +12,6 @@ from PLC.Nodes import Node, Nodes
 from PLC.TagTypes import TagType, TagTypes
 from PLC.NodeTags import NodeTag, NodeTags
 
-from PLC.AuthorizeHelpers import AuthorizeHelpers
-
 class DeleteNodeTag(Method):
     """
     Deletes the specified node tag
@@ -49,14 +47,7 @@ class DeleteNodeTag(Method):
         node=nodes[0]
 
         # check authorizations
-        if 'admin' in self.caller['roles']:
-            pass
-        elif not AuthorizeHelpers.caller_may_access_tag_type (self.api, self.caller, tag_type):
-            raise PLCPermissionDenied, "%s, forbidden tag %s"%(self.name,tag_type['tagname'])
-        elif AuthorizeHelpers.node_belongs_to_person (self.api, node, self.caller):
-            pass
-        else:
-            raise PLCPermissionDenied, "%s: you must belong in the same site as subject node"%self.name
+        node.caller_may_write_tag(self.api,self.caller,tag_type)
 
         node_tag.delete()
         self.object_ids = [node_tag['node_tag_id']]
diff --git a/PLC/Methods/UpdateNodeTag.py b/PLC/Methods/UpdateNodeTag.py
index c3b4e287..8fd0c888 100644
--- a/PLC/Methods/UpdateNodeTag.py
+++ b/PLC/Methods/UpdateNodeTag.py
@@ -12,8 +12,6 @@ from PLC.Nodes import Node, Nodes
 from PLC.TagTypes import TagType, TagTypes
 from PLC.NodeTags import NodeTag, NodeTags
 
-from PLC.AuthorizeHelpers import AuthorizeHelpers
-
 class UpdateNodeTag(Method):
     """
     Updates the value of an existing node tag
@@ -50,15 +48,7 @@ class UpdateNodeTag(Method):
         node=nodes[0]
 
         # check authorizations
-        if 'admin' in self.caller['roles']:
-            pass
-        elif not AuthorizeHelpers.caller_may_access_tag_type (self.api, self.caller, tag_type):
-            raise PLCPermissionDenied, "%s, forbidden tag %s"%(self.name,tag_type['tagname'])
-        elif AuthorizeHelpers.node_belongs_to_person (self.api, node, self.caller):
-            pass
-        else:
-            raise PLCPermissionDenied, "%s: you must belong in the same site as subject node"%self.name
-
+        node.caller_may_write_tag(self.api,self.caller,tag_type)
 
         node_tag['value'] = value
         node_tag.sync()