keys: Introduce permissions model

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/src/buildservice/keys.py b/src/buildservice/keys.py
index f438eca5b837a9ed858bcd5903383c21492535da..bde0a842843e3e8e4611dbf233ff3bcc227cda05 100644 (file)
--- a/src/buildservice/keys.py
+++ b/src/buildservice/keys.py
@@ -126,6 +126,14 @@ class Key(base.DataObject):
                self.db.execute("DELETE FROM keys_subkeys WHERE key_id = %s", self.id)
                self.db.execute("DELETE FROM keys WHERE id = %s", self.id)
 
+       def has_perm(self, user):
+               # Anonymous users have no permission
+               if not user:
+                       return False
+
+               # Admins have all permissions
+               return user.is_admin()
+
        @property
        def fingerprint(self):
                return self.data.fingerprint[-16:]

diff --git a/src/templates/keys-list.html b/src/templates/keys-list.html
index 2c695f8fdc92076623ee21dde159c49359b2b73d..29dd25b17a4032249a18b6d4d188dc3e819dd895 100644 (file)
--- a/src/templates/keys-list.html
+++ b/src/templates/keys-list.html
@@ -56,7 +56,7 @@
                                                        </a>
                                                </div>
 
-                                               {% if current_user and current_user.has_perm("manage_keys") and key.can_be_deleted() %}
+                                               {% if key.has_perm(current_user) and key.can_be_deleted() %}
                                                        <div class="btn-group">
                                                                <a class="btn btn-mini btn-danger" href="/key/{{ key.fingerprint }}/delete">
                                                                        <i class="icon-trash icon-white"></i>
@@ -100,7 +100,7 @@
                </tbody>
        </table>
 
-       {% if current_user and current_user.has_perm("manage_keys") %}
+       {% if current_user and current_user.is_admin() %}
                <a class="btn btn-danger pull-right" href="/key/import">
                        <i class="icon-star icon-white"></i>
                        {{ _("Import new key") }}

diff --git a/src/web/keys.py b/src/web/keys.py
index 097aa71af45aa4bff37e46ab2c98ae25ef68aa76..c23354b517b4afd774a003ada8b6549c8b3259fa 100644 (file)
--- a/src/web/keys.py
+++ b/src/web/keys.py
@@ -5,10 +5,7 @@ import tornado.web
 from . import base
 
 class KeysActionHandler(base.BaseHandler):
-       def prepare(self):
-               if not self.current_user.has_perm("manage_keys"):
-                       raise tornado.web.HTTPError(403)
-
+       pass
 
 class KeysImportHandler(KeysActionHandler):
        @tornado.web.authenticated
@@ -19,6 +16,10 @@ class KeysImportHandler(KeysActionHandler):
        def post(self):
                data = self.get_argument("data")
 
+               # Check permissions
+               if not key.has_perm(self.current_user):
+                       raise tornado.web.HTTPError(403)
+
                key = self.backend.keys.create(data)
                assert key
 
@@ -32,6 +33,10 @@ class KeysDeleteHandler(KeysActionHandler):
                if not key:
                        raise tornado.web.HTTPError(404, "Could not find key: %s" % fingerprint)
 
+               # Check permissions
+               if not key.has_perm(self.current_user):
+                       raise tornado.web.HTTPError(403)
+
                confirmed = self.get_argument("confirmed", False)
                if confirmed:
                        key.delete()