| OLD | NEW |
| 1 # Copyright 2014 The Chromium Authors. All rights reserved. | 1 # Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 # Use of this source code is governed by a BSD-style license that can be | 2 # Use of this source code is governed by a BSD-style license that can be |
| 3 # found in the LICENSE file. | 3 # found in the LICENSE file. |
| 4 | 4 |
| 5 """Access control list implementation. | 5 """Access control list implementation. |
| 6 | 6 |
| 7 See Acl message in proto/project_config.proto. | 7 See Acl message in proto/project_config.proto. |
| 8 """ | 8 """ |
| 9 | 9 |
| 10 import collections | 10 import collections |
| (...skipping 97 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 108 """True if current identity has any of |roles| in |bucket|.""" | 108 """True if current identity has any of |roles| in |bucket|.""" |
| 109 assert bucket | 109 assert bucket |
| 110 assert roles | 110 assert roles |
| 111 errors.validate_bucket_name(bucket) | 111 errors.validate_bucket_name(bucket) |
| 112 roles = set(roles) | 112 roles = set(roles) |
| 113 assert roles.issubset(project_config_pb2.Acl.Role.values()) | 113 assert roles.issubset(project_config_pb2.Acl.Role.values()) |
| 114 | 114 |
| 115 if auth.is_admin(): | 115 if auth.is_admin(): |
| 116 raise ndb.Return(True) | 116 raise ndb.Return(True) |
| 117 | 117 |
| 118 bucket_cfg = yield config.get_bucket_async(bucket) | 118 _, bucket_cfg = yield config.get_bucket_async(bucket) |
| 119 identity_str = auth.get_current_identity().to_bytes() | 119 identity_str = auth.get_current_identity().to_bytes() |
| 120 if bucket_cfg: | 120 if bucket_cfg: |
| 121 for rule in bucket_cfg.acls: | 121 for rule in bucket_cfg.acls: |
| 122 if rule.role not in roles: | 122 if rule.role not in roles: |
| 123 continue | 123 continue |
| 124 if rule.identity == identity_str: | 124 if rule.identity == identity_str: |
| 125 raise ndb.Return(True) | 125 raise ndb.Return(True) |
| 126 if rule.group and auth.is_group_member(rule.group): | 126 if rule.group and auth.is_group_member(rule.group): |
| 127 raise ndb.Return(True) | 127 raise ndb.Return(True) |
| 128 raise ndb.Return(False) | 128 raise ndb.Return(False) |
| (...skipping 56 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 185 memcache.set(cache_key, available_buckets, 10 * 60) | 185 memcache.set(cache_key, available_buckets, 10 * 60) |
| 186 return available_buckets | 186 return available_buckets |
| 187 | 187 |
| 188 | 188 |
| 189 def current_identity_cannot(action_format, *args): # pragma: no cover | 189 def current_identity_cannot(action_format, *args): # pragma: no cover |
| 190 """Returns AuthorizationError.""" | 190 """Returns AuthorizationError.""" |
| 191 action = action_format % args | 191 action = action_format % args |
| 192 msg = 'User %s cannot %s' % (auth.get_current_identity().to_bytes(), action) | 192 msg = 'User %s cannot %s' % (auth.get_current_identity().to_bytes(), action) |
| 193 logging.warning(msg) | 193 logging.warning(msg) |
| 194 return auth.AuthorizationError(msg) | 194 return auth.AuthorizationError(msg) |
| OLD | NEW |