htfdZddlZddlmZddlmZddlmZddlm Z ddl m Z ddl m Z mZdd lmZdd lmZdd lmZmZmZdd lmZdd lmZddlmZmZddlmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&ddl'm(Z(ddl)m*Z*ddl+m,Z,m-Z-m.Z.ddl/m0Z0m1Z1m2Z2m3Z3e1Z4e3Z5d dZ6d dZ7d!dZ8dZ9dZ:dZ;dZ< d"dZ=d#dZ> d$dZ?d%dZ@dZAy)&z= Convenient shortcuts to manage or check object permissions. N) defaultdict)partial)groupby)apps)get_user_model)Group Permission) ContentType) connection)CountQQuerySet) _get_queryset)Value)CastReplace) AutoFieldBigIntegerField CharField ForeignKey IntegerFieldPositiveIntegerFieldPositiveSmallIntegerFieldSmallIntegerField UUIDField)ObjectPermissionChecker)get_content_type)MixedContentTypeError WrongAppErrorMultipleIdentityAndObjectError)get_anonymous_userget_group_obj_perms_model get_identityget_user_obj_perms_modelct|\}}|t|ts7 |jdd\}}tj j ||}|r|jj||S|r|jj||St|tsd|vr|jdd\}}t|ttfrt|ttfr td|rGtt|tr|dn |j}|j j|||S|rGt!t|tr|dn |j}|j j|||St|ttfrT|r(t|}|j j#|||S|r(t!|}|j j#|||S|r(t|}|j j%|||S|r(t!|}|j j%|||Sy#t$rt d|zwxYw)a6 Assigns permission to user/group and object pair. :param perm: proper permission for given ``obj``, as string (in format: ``app_label.codename`` or ``codename``) or ``Permission`` instance. If ``obj`` is not given, must be in format ``app_label.codename`` or ``Permission`` instance. :param user_or_group: instance of ``User``, ``AnonymousUser``, ``Group``, list of ``User`` or ``Group``, or queryset of ``User`` or ``Group``; passing any other object would raise ``guardian.exceptions.NotUserNorGroup`` exception :param obj: persisted Django's ``Model`` instance or QuerySet of Django ``Model`` instances or list of Django ``Model`` instances or ``None`` if assigning global permission. Default is ``None``. We can assign permission for ``Model`` instance for specific user: >>> from django.contrib.sites.models import Site >>> from guardian.models import User >>> from guardian.shortcuts import assign_perm >>> site = Site.objects.get_current() >>> user = User.objects.create(username='joe') >>> assign_perm("change_site", user, site) >>> user.has_perm("change_site", site) True ... or we can assign permission for group: >>> group = Group.objects.create(name='joe-group') >>> user.groups.add(group) >>> assign_perm("delete_site", group, site) >>> user.has_perm("delete_site", site) True **Global permissions** This function may also be used to assign standard, *global* permissions if ``obj`` parameter is omitted. Added Permission would be returned in that case: >>> assign_perm("sites.change_site", user) N.VFor global permissions, first argument must be in format: 'app_label.codename' (is %r)content_type__app_labelcodenamez@Only bulk operations on either users/groups OR objects supportedr)r# isinstancer split ValueErrorobjectsgetuser_permissionsadd permissionsrlistr r$modelbulk_assign_permr"assign_perm_to_many assign_permperm user_or_groupobjusergroup app_labelr+r5s \/var/www/html/software/conda/envs/higlass/lib/python3.12/site-packages/guardian/shortcuts.pyr8r8%s@b}-KD% {$ + Q&*jja&8# 8%%)))3;*=D   ! ! % %d +K     ! !$ 'K dJ ' $;"jja0OIt#$'( mh%5 601st t ,(d3CFDE==11$cB B -(d3CFDE==11$sC C-(D!12 ,S1E==44T4E E -c2E==44T5#F F (-}}((tS99 )#.}}((uc:: S Q "IKO"PQQ Qs IIcPtjdtt|||S)z4 Depreciated function name left in for compatibilityzShortcut function 'assign' is being renamed to 'assign_perm'. Update your code accordingly as old name will be depreciated in 2.0 version.)warningswarnDeprecationWarningr8)r:r;r<s r@assignrEs( MM U t]C 00c@t|\}}|t|ts7 |jdd\}}tj j ||}|r|jj|y|r|jj|yt|ts|jdd}t|trh|r2t|j}|j j|||S|r2t|j}|j j|||S|r(t|}|j j|||S|r(t|}|j j|||Sy#t$rt d|zwxYw)ae Removes permission from user/group and object pair. :param perm: proper permission for given ``obj``, as string (in format: ``app_label.codename`` or ``codename``). If ``obj`` is not given, must be in format ``app_label.codename``. :param user_or_group: instance of ``User``, ``AnonymousUser`` or ``Group``; passing any other object would raise ``guardian.exceptions.NotUserNorGroup`` exception :param obj: persisted Django's ``Model`` instance or QuerySet of Django ``Model`` instances or ``None`` if assigning global permission. Default is ``None``. Nr&r'r(r))r#r,r r-r.r/r0r1remover3rr$r5bulk_remove_permr" remove_permr9s r@rKrKs"}-KD% {$ + Q&*jja&8# 8%%)))3;*=D   ! ! ( ( .      $ $T *  dJ 'zz#r"#x ,SYY7E==11$cB B -cii8E==11$sC C (-}}((tS99 )#.}}((uc:: 7 Q "IKO"PQQ Qs FFc:t|}|j|S)z[ Returns permissions for given user/group and object pair, as list of strings. )r get_permsr;r<checks r@rMrMs $M 2E ??3 rFc:t|}|j|S)z Returns permissions for given user and object pair, as list of strings, only those assigned directly for the user. )rget_user_perms)r=r<rOs r@rQrQs $D )E    $$rFc:t|}|j|S)z Returns permissions for given user/group and object pair, as list of strings. It returns only those which are inferred through groups. )rget_group_permsrNs r@rSrSs $M 2E   %%rFct|tr+|jd\}}tj||}n|}t |}t jj|S)z Returns queryset of all Permission objects for the given class. It is possible to pass Model as class or instance. r&) content_type) r,strr-r get_modelrr r/filter)clsr? model_namer5ctypes r@get_perms_for_modelr\sY #s # # :y*5 U #E    $ $% $ 88rFct|}|st|}|jjj }|j j rd|z|d|z|ji}nd|z|i}tdi|} |Etj j||jdd} | tdid|z| iz} |rt|} | j j r||jd } nd |i} || jd  it| j jdi| jd dj} | t| z} |r| tdz} t!j j| jSi}t#||||D]7}|s|rt%t'||||< t%t)||||<9|S)a Returns queryset of all ``User`` objects with *any* object permissions for the given ``obj``. :param obj: persisted Django's ``Model`` instance :param attach_perms: Default: ``False``. If set to ``True`` result would be dictionary of ``User`` instances with permissions' codenames list as values. This would fetch users eagerly! :param with_superusers: Default: ``False``. If set to ``True`` result would contain all superusers. :param with_group_users: Default: ``True``. If set to ``False`` result would **not** contain those users who have only group permissions for given ``obj``. :param only_with_perms_in: Default: ``None``. If set to an iterable of permission strings then only users with those permissions would be returned. Example:: >>> from django.contrib.flatpages.models import FlatPage >>> from django.contrib.auth.models import User >>> from guardian.shortcuts import assign_perm, get_users_with_perms >>> >>> page = FlatPage.objects.create(title='Some page', path='/some/page/') >>> joe = User.objects.create_user('joe', 'joe@example.com', 'joesecret') >>> dan = User.objects.create_user('dan', 'dan@example.com', 'dansecret') >>> assign_perm('change_flatpage', joe, page) >>> assign_perm('delete_flatpage', dan, page) >>> >>> get_users_with_perms(page) [, ] >>> >>> get_users_with_perms(page, attach_perms=True) {: [u'change_flatpage'], : [u'delete_flatpage']} >>> get_users_with_perms(page, only_with_perms_in=['change_flatpage']) [] %s__content_type %s__object_pk%s__content_object)rU codename__inidTflatz%s__permission_id__in)rU object_pkcontent_objectpermission_id__ingroup_id) groups__in) is_superuser)with_group_usersonly_with_perms_inwith_superusers)rr$r=fieldrelated_query_namer/ is_genericpkr r rX values_listr"updatesetdistinctrget_users_with_permssortedrMrQ)r< attach_permsrmrkrlr[ user_model related_name user_filtersqsetpermission_ids group_modelgroup_obj_perm_filters group_idsusersr=s r@rwrws+X S !E .c2 !,,??A    ( ( *"\15,.L 1<?EL <   )'//66EXj6kwwx|DHwIN A',6 D 3C8K""--/$)!$*& %c*&"-&--'/6K//66P9OP\\]gnr\s||~I!y11D !..D''..t4==??(:J?d  @ rFct|}t|}|s|jjj }|j j rd|z|d|z|ji}nd|z|i}tj jd i|jStt}t|}|j j|jdd}|tur|j|j|}n|j|j}|D]4} || jj!| j"j$6t'|S) a Returns queryset of all ``Group`` objects with *any* object permissions for the given ``obj``. :param obj: persisted Django's ``Model`` instance :param attach_perms: Default: ``False``. If set to ``True`` result would be dictionary of ``Group`` instances with permissions' codenames list as values. This would fetch groups eagerly! Example:: >>> from django.contrib.flatpages.models import FlatPage >>> from guardian.shortcuts import assign_perm, get_groups_with_perms >>> from guardian.models import Group >>> >>> page = FlatPage.objects.create(title='Some page', path='/some/page/') >>> admins = Group.objects.create(name='Admins') >>> assign_perm('change_flatpage', admins, page) >>> >>> get_groups_with_perms(page) [] >>> >>> get_groups_with_perms(page, attach_perms=True) {: [u'change_flatpage']} r^r_r`) group__inr> permission)rerU)content_object_idrn)rr"r>rorpr/rqrrrrXrvrr4get_groups_with_permsprefetch_relatedGroupObjectPermissionappendrr+dict) r<ryr[rgroup_rel_name group_filtersgroup_perms_mappinggroups_with_permsqs group_perms r@rrSsL8 S !E+C0K $**00CCE    ) ) +"^3U.0#&&M 2NBCHM}}##4m4==??)$/1#6  ' '2C ' D U UV]_k l / /SVV%@BSVV4B YJ  0 0 1 8 89N9N9W9W X Y'((rFc t|tr|g}d}d}t} |D]} d| vr1| jdd\} } ||| k7rt d|d| d| }n| } | j | |Nt jj|| } ||| k7rt d|d | | }|#|!t|}t|j}n^||t|j}n@| td t|}|j|jk7r t d |r|jr|S|jr t!}t}d }|r|r| D]5}|j#|j$dz|zs%|j |7|D]}| j'|t)|d kDrt)| d k(s|r|St)|d kDrt)| d kDrd}t+|j}|jj-|j-|}t)| r|j-| }ddg}ddg}|jj/r|}n|}|rWt1|j}d|dt3j4j6j9z|i}t)| r|j;d| i|jj,d!i|}|jj/r|}n|}|st)| dkDr|s|j<|}|j<|}t?|t?|z}d}tA||}g}tC||D]:\} }!|!D"chc]}"|"d }#}"| jE|#s*|jG| <|j-|}$|$S|sYt)| dkDrK|jI|d jKtM|d }%|%j-t)| }|d }&|}'tO|}(|(|'jK|(|&}'d}&|'j=|&d }'tQ|'})|rFd }&}'|(|'jK|(|&}'d}&|'j=|&d }'|)tQ|'z})|j-|)Scc}"w)"a Returns queryset of objects for which a given ``user`` has *all* permissions present at ``perms``. :param user: ``User`` or ``AnonymousUser`` instance for which objects would be returned. :param perms: single permission string, or sequence of permission strings which should be checked. If ``klass`` parameter is not given, those should be full permission names rather than only codenames (i.e. ``auth.change_user``). If more than one permission is present within sequence, their content type **must** be the same or ``MixedContentTypeError`` exception would be raised. :param klass: may be a Model, Manager or QuerySet object. If not given this parameter would be computed based on given ``params``. :param use_groups: if ``False``, wouldn't check user's groups object permissions. Default is ``True``. :param any_perm: if True, any of permission in sequence is accepted. Default is ``False``. :param with_superuser: if ``True`` and if ``user.is_superuser`` is set, returns the entire queryset. Otherwise will only return objects the user has explicit permissions. This must be ``True`` for the accept_global_perms parameter to have any affect. Default is ``True``. :param accept_global_perms: if ``True`` takes global permissions into account. Object based permissions are taken into account if more than one permission is handed in in perms and at least one of these perms is not globally set. If any_perm is set to false then the intersection of matching object is returned. Note, that if with_superuser is False, accept_global_perms will be ignored, which means that only object permissions will be checked! Default is ``True``. :raises MixedContentTypeError: when computed content type for ``perms`` and/or ``klass`` clashes. :raises WrongAppError: if cannot compute app label for given ``perms``/ ``klass``. Example:: >>> from django.contrib.auth.models import User >>> from guardian.shortcuts import get_objects_for_user >>> joe = User.objects.get(username='joe') >>> get_objects_for_user(joe, 'auth.change_group') [] >>> from guardian.shortcuts import assign_perm >>> group = Group.objects.create('some group') >>> assign_perm('auth.change_group', joe, group) >>> get_objects_for_user(joe, 'auth.change_group') [] The permission string can also be an iterable. Continuing with the previous example: >>> get_objects_for_user(joe, ['auth.change_group', 'auth.delete_group']) [] >>> get_objects_for_user(joe, ['auth.change_group', 'auth.delete_group'], any_perm=True) [] >>> assign_perm('auth.delete_group', joe, group) >>> get_objects_for_user(joe, ['auth.change_group', 'auth.delete_group']) [] Take global permissions into account: >>> jack = User.objects.get(username='jack') >>> assign_perm('auth.change_group', jack) # this will set a global permission >>> get_objects_for_user(jack, 'auth.change_group') [] >>> group2 = Group.objects.create('other group') >>> assign_perm('auth.delete_group', jack, group2) >>> get_objects_for_user(jack, ['auth.change_group', 'auth.delete_group']) # this retrieves intersection [] >>> get_objects_for_user(jack, ['auth.change_group', 'auth.delete_group'], any_perm) # this retrieves union [, ] If accept_global_perms is set to ``True``, then all assigned global permissions will also be taken into account. - Scenario 1: a user has view permissions generally defined on the model 'books' but no object based permission on a single book instance: - If accept_global_perms is ``True``: List of all books will be returned. - If accept_global_perms is ``False``: list will be empty. - Scenario 2: a user has view permissions generally defined on the model 'books' and also has an object based permission to view book 'Whatever': - If accept_global_perms is ``True``: List of all books will be returned. - If accept_global_perms is ``False``: list will only contain book 'Whatever'. - Scenario 3: a user only has object based permission on book 'Whatever': - If accept_global_perms is ``True``: List will only contain book 'Whatever'. - If accept_global_perms is ``False``: List will only contain book 'Whatever'. - Scenario 4: a user does not have any permission: - If accept_global_perms is ``True``: Empty list. - If accept_global_perms is ``False``: Empty list. Nr&r'&Given perms must have same app label ( != )r?permission__codename$ContentType was once computed to be  and another one Cannot determine content type.Content type for given perms and klass differsFrT)r=permission__content_typepermission__codename__incontent_object__pkrrerz group__%src |dSNrrnts r@z&get_objects_for_user..es !rFkeypk__in)object_pk_count)object_pk_count__gte expressionobj_pkrrcrn))r,rVrur-rr2r r/r0rrr5 model_classrrj is_anonymousr!has_permr?rIlenr$rXrqr"rgroupsrorprtrsr4rxrissubsetrvaluesannotater _handle_pk_fieldr )*r=permsklass use_groupsany_permwith_superuseraccept_global_permsr[r? codenamesr: new_app_labelr+ new_ctypequeryset global_permshas_global_permscoderzuser_obj_perms_queryset direct_fieldsgeneric_fields user_fieldsrrgroups_obj_perms_queryset group_fieldsuser_obj_permsgroups_obj_permsdatakeyfuncpk_listrrr>e obj_codenamesr/countsfield_pkrhandle_pk_fieldqs* r@get_objects_for_userrs>J% EII" $;&*jja&8 #M8$m)C+BK]-\]]* H h  #++//)EM0OI Ui%7+MRT]-_``"%"* }* ' 0  u} !2!2!45 ;<< '    (.. 0')89 9$++  !#5L~ 'D}}U__s2T9:  & '! #D   T " # | q c)n&9XO  "I(:# *(..9J)11 &D 1 & F 9~"9"@"@%.#A#0)+ABM!#9:N$$&$ # /? & .*1177JJL Ld  y>  *I" %?K$7$7$>$>$O$O!    ) ) +)L(LC NQ.7G@4@@+NND8DDlS '$/?*@@D$G$G,DG$T73 ' E/4 5!1 5 5%%m4NN2& 'ooWo5GN I*(// N$HU;q>5JHK "(--!$Y#0#11~H $F&x0O"8(LM   t  4F A?*  &__Ox,P_QFH##H4#8 Qf  ??1 ?!6s ScDt|tr|g}d}d}t}|D]}d|vr1|jdd\} } ||| k7rt d|d| d| }n|} |j | |Nt jj|| } ||| k7rt d|d | | }|#|!t|} t| j}n^||t|j} n@| td t|} |j| jk7r t d t} |rr|jjd d }|D]}||vs| j || D]}|j!|t#| dkDrt#|dk(s|r| St%| j}|jj'|j'|}t#|r|j'|}|jj)rddg}nddg}|st#|r|j|}t+|}d}t-||}g}t/||D]<\}}|Dchc]}|d }}|s|j1|s,|j3|>| j'|}|S|d}|}t5| }||j7||}d}|j|d }| j'|Scc}w)a Returns queryset of objects for which a given ``group`` has *all* permissions present at ``perms``. :param group: ``Group`` instance for which objects would be returned. :param perms: single permission string, or sequence of permission strings which should be checked. If ``klass`` parameter is not given, those should be full permission names rather than only codenames (i.e. ``auth.change_user``). If more than one permission is present within sequence, their content type **must** be the same or ``MixedContentTypeError`` exception would be raised. :param klass: may be a Model, Manager or QuerySet object. If not given this parameter would be computed based on given ``params``. :param any_perm: if True, any of permission in sequence is accepted :param accept_global_perms: if ``True`` takes global permissions into account. If any_perm is set to false then the intersection of matching objects based on global and object based permissions is returned. Default is ``True``. :raises MixedContentTypeError: when computed content type for ``perms`` and/or ``klass`` clashes. :raises WrongAppError: if cannot compute app label for given ``perms``/ ``klass``. Example: Let's assume we have a ``Task`` model belonging to the ``tasker`` app with the default add_task, change_task and delete_task permissions provided by Django:: >>> from guardian.shortcuts import get_objects_for_group >>> from tasker import Task >>> group = Group.objects.create('some group') >>> task = Task.objects.create('some task') >>> get_objects_for_group(group, 'tasker.add_task') [] >>> from guardian.shortcuts import assign_perm >>> assign_perm('tasker.add_task', group, task) >>> get_objects_for_group(group, 'tasker.add_task') [] The permission string can also be an iterable. Continuing with the previous example: >>> get_objects_for_group(group, ['tasker.add_task', 'tasker.delete_task']) [] >>> assign_perm('tasker.delete_task', group, task) >>> get_objects_for_group(group, ['tasker.add_task', 'tasker.delete_task']) [] Global permissions assigned to the group are also taken into account. Continuing with previous example: >>> task_other = Task.objects.create('other task') >>> assign_perm('tasker.change_task', group) >>> get_objects_for_group(group, ['tasker.change_task']) [, ] >>> get_objects_for_group(group, ['tasker.change_task'], accept_global_perms=False) [] Nr&r'rrrrrrrrr+Trcr)r>rrrerrc |dSrrnrs r@rz'get_objects_for_group.. s AaDrFrrrrr)r,rVrur-rr2r r/r0rrr5rrr3rsrIrr"rXrqr4rxrrrrr)r>rrrrr[r?rr:rr+rrrglobal_perm_setrrrfieldsrrrrrrrrr/rrrs r@get_objects_for_grouprs|r% EII" $;&*jja&8 #M8$m)C+BK]-\]]* H h  #++//)EM0OI Ui%7+MRT]-_``"%"* }* ' 0  u} !2!2!45 ;<< '    (.. 0')89 95L++77 7N 'D&  & '! #D   T " # | q c)n&9XO,HNN;K!,!4!4"(&u&"5"(&%&"H 9~$=$D$D%.%E%0!%%'56&(>? I@4@@&I$% d( w/ #IB+01aQqT1M19--m<r" #///1ayH &F&x0O"8(LM   t  4F ??&? ))2s Lc |jjj}t|trt |j St|ttttttfrtttSt|tr`t j"j$rtttStt&t)dt)dt+Sy)N) output_field-)text replacementr)r5_metarrr,rr target_fieldrrrrrrrrrr featureshas_native_uuid_fieldrrr)rrrs r@rr#s    B"j!00    %    t/*;<<"i    4 44ik: : sb "    rF)N)NN)FFTN)F)NTFTT)NFT)B__doc__rB collectionsr functoolsr itertoolsr django.appsrdjango.contrib.authrdjango.contrib.auth.modelsrr "django.contrib.contenttypes.modelsr django.dbr django.db.modelsr r rdjango.shortcutsrdjango.db.models.expressionsrdjango.db.models.functionsrrrrrrrrrrr guardian.corerguardian.ctypesrguardian.exceptionsrrr guardian.utilsr!r"r#r$rUserObjectPermissionr8rErKrMrQrSr\rwrrrrrnrFr@rs#.8: //*.4   2,ddpp13/1b;J13;l %& 9CHCG_D5)pMRBF}@U*prF