raise PermissionDenied if someone tries to save an object without can_update rights

[plstackapi.git] / planetstack / core / models / plcorebase.py

diff --git a/planetstack/core/models/plcorebase.py b/planetstack/core/models/plcorebase.py
index 606ea85..b9692c6 100644 (file)
--- a/planetstack/core/models/plcorebase.py
+++ b/planetstack/core/models/plcorebase.py
@@ -1,10 +1,11 @@
-import datetime
 import os
 import sys
 from django.db import models
 from django.forms.models import model_to_dict
 from django.core.urlresolvers import reverse
 from django.forms.models import model_to_dict
+from django.utils import timezone
+from django.core.exceptions import PermissionDenied
 import model_policy
 
 try:
@@ -22,14 +23,30 @@ except:
 # This manager will be inherited by all subclasses because
 # the core model is abstract.
 class PlCoreBaseDeletionManager(models.Manager):
+    def get_queryset(self):
+        parent=super(PlCoreBaseDeletionManager, self)
+        if hasattr(parent, "get_queryset"):
+            return parent.get_queryset().filter(deleted=True)
+        else:
+            return parent.get_query_set().filter(deleted=True)
+
+    # deprecated in django 1.7 in favor of get_queryset().
     def get_query_set(self):
-        return super(PlCoreBaseDeletionManager, self).get_query_set().filter(deleted=True)
+        return self.get_queryset()
 
 # This manager will be inherited by all subclasses because
 # the core model is abstract.
 class PlCoreBaseManager(models.Manager):
+    def get_queryset(self):
+        parent=super(PlCoreBaseManager, self)
+        if hasattr(parent, "get_queryset"):
+            return parent.get_queryset().filter(deleted=False)
+        else:
+            return parent.get_query_set().filter(deleted=False)
+
+    # deprecated in django 1.7 in favor of get_queryset().
     def get_query_set(self):
-        return super(PlCoreBaseManager, self).get_query_set().filter(deleted=False)
+        return self.get_queryset()
 
 class PlCoreBase(models.Model):
     objects = PlCoreBaseManager()
@@ -37,8 +54,8 @@ class PlCoreBase(models.Model):
 
     # default values for created and updated are only there to keep evolution
     # from failing.
-    created = models.DateTimeField(auto_now_add=True, default=datetime.datetime.now())
-    updated = models.DateTimeField(auto_now=True, default=datetime.datetime.now())
+    created = models.DateTimeField(auto_now_add=True, default=timezone.now)
+    updated = models.DateTimeField(auto_now=True, default=timezone.now)
     enacted = models.DateTimeField(null=True, default=None)
     backend_status = models.CharField(max_length=140,
                                       default="Provisioning in progress")
@@ -53,6 +70,7 @@ class PlCoreBase(models.Model):
     def __init__(self, *args, **kwargs):
         super(PlCoreBase, self).__init__(*args, **kwargs)
         self.__initial = self._dict
+        self.silent = False
 
     @property
     def diff(self):
@@ -82,35 +100,43 @@ class PlCoreBase(models.Model):
     def delete(self, *args, **kwds):
         # so we have something to give the observer
         purge = kwds.get('purge',False)
+        silent = kwds.get('silent',False)
         try:
             purge = purge or observer_disabled
         except NameError:
             pass
-            
+
         if (purge):
             del kwds['purge']
             super(PlCoreBase, self).delete(*args, **kwds)
         else:
             self.deleted = True
             self.enacted=None
-            self.save(update_fields=['enacted','deleted'])
-
+            self.save(update_fields=['enacted','deleted'], silent=silent)
 
     def save(self, *args, **kwargs):
+        # let the user specify silence as either a kwarg or an instance varible
+        silent = self.silent
+        if "silent" in kwargs:
+            silent=silent or kwargs.pop("silent")
+
         super(PlCoreBase, self).save(*args, **kwargs)
 
         # This is a no-op if observer_disabled is set
-        notify_observer()
+        if not silent:
+            notify_observer()
 
         self.__initial = self._dict
 
     def save_by_user(self, user, *args, **kwds):
-        if self.can_update(user):
-            self.save(*args, **kwds)
+        if not self.can_update(user):
+            raise PermissionDenied("You do not have permission to update %s objects" % self.__class__.__name__)
+        self.save(*args, **kwds)
 
     def delete_by_user(self, user, *args, **kwds):
-        if self.can_update(user):
-            self.delete(*args, **kwds)
+        if not self.can_update(user):
+            raise PermissionDenied("You do not have permission to delete %s objects" % self.__class__.__name__)
+        self.delete(*args, **kwds)
 
     @property
     def _dict(self):