First functionnal version of permissions handling! Many thanks to Django developers :D

admin/models.py

@@ -10,6 +10,12 @@ class Domain(models.Model):
     quota = models.IntegerField()
     enabled = models.BooleanField(_('enabled'))
 
+    class Meta:
+        permissions = (
+            ("view_domain", "View domain"),
+            ("view_domains", "View domains"),
+            )
+
     def create_dir(self):
         code, output = exec_pipe("sudo -u %s mkdir %s/%s" \
                                      % (settings.VIRTUAL_UID, 
@@ -55,6 +61,11 @@ class Mailbox(models.Model):
     user = models.ForeignKey(User)
     path = models.CharField(max_length=255)
 
+    class Meta:
+        permissions = (
+            ("view_mailboxes", "View mailboxes"),
+            )
+
     def __str__(self):
         return "%s" % (self.address)
 
@@ -92,3 +103,8 @@ class Alias(models.Model):
     full_address = models.CharField(max_length=150)
     mbox = models.ForeignKey(Mailbox, verbose_name=_('mailbox'))
     enabled = models.BooleanField(_('enabled'))
+
+    class Meta:
+        permissions = (
+            ("view_aliases", "View aliases"),
+            )

admin/views.py

@@ -6,7 +6,8 @@ from django.utils import simplejson
 from django.utils.translation import ugettext as _
 from django.core import serializers
 from django.core.urlresolvers import reverse
-from django.contrib.auth.decorators import login_required
+from django.contrib.auth.decorators \
+    import login_required, permission_required, user_passes_test
 from django.contrib.auth.models import User, Group
 from mailng import admin
 from mailng.admin.models import Domain, Mailbox, Alias
@@ -23,8 +24,18 @@ def _render(request, tpl, user_context):
     return render_to_response(tpl, user_context, 
                               context_instance=RequestContext(request))
 
+def is_superuser(user):
+    if not user.is_superuser:
+        user.message_set.create(message=_("Permission denied."))
+        return False
+    return True
+
 @login_required
 def domains(request):
+    if not request.user.has_perm("admin.view_domains"):
+        mb = Mailbox.objects.get(user=request.user.id)
+        return mailboxes(request, dom_id=mb.domain.id)
+
     domains = Domain.objects.all()
     counters = {}
     for dom in domains:
@@ -34,7 +45,10 @@ def domains(request):
             })
 
 @login_required
+@permission_required("admin.add_mailbox")
 def newdomain(request):
+    if not is_superuser(request.user):
+        return mailboxes(request, dom_id)
     if request.method == "POST":
         form = DomainForm(request.POST)
         error = None
@@ -59,8 +73,11 @@ def newdomain(request):
             "form" : form
             })
 
-@login_required   
+@login_required
+@permission_required("admin.change_mailbox")
 def editdomain(request, dom_id):
+    if not is_superuser(request.user):
+        return mailboxes(request, dom_id)
     domain = Domain.objects.get(pk=dom_id)
     if request.method == "POST":
         form = DomainForm(request.POST, instance=domain)
@@ -87,13 +104,17 @@ def editdomain(request, dom_id):
             })
 
 @login_required
+@permission_required("admin.delete_domain")
 def deldomain(request, dom_id):
+    if not is_superuser(request.user):
+        return mailboxes(request, dom_id)
     domain = Domain.objects.get(pk=dom_id)
     domain.delete_dir()
     domain.delete()
     return HttpResponseRedirect('/mailng/admin/')
 
 @login_required
+@permission_required("admin.view_mailboxes")
 def mailboxes(request, dom_id=None):
     domain = Domain.objects.get(pk=dom_id)
     mailboxes = Mailbox.objects.filter(domain=dom_id)
@@ -102,6 +123,7 @@ def mailboxes(request, dom_id=None):
             })
 
 @login_required
+@permission_required("admin.view_mailboxes")
 def mailboxes_raw(request, dom_id=None):
     mailboxes = Mailbox.objects.filter(domain=dom_id)
     return _render(request, 'admin/mailboxes_raw.html', {
@@ -109,6 +131,7 @@ def mailboxes_raw(request, dom_id=None):
             })
 
 @login_required
+@permission_required("admin.add_mailbox")
 def newmailbox(request, dom_id=None):
     domain = Domain.objects.get(pk=dom_id)
     if request.method == "POST":
@@ -123,7 +146,6 @@ def newmailbox(request, dom_id=None):
                 if mb.create_dir(domain):
                     user = User()
                     user.username = user.email = "%s@%s" % (mb.address, domain.name)
-#                    user.set_password(request.POST["password1"])
                     user.set_unusable_password()
                     user.is_active = request.POST.has_key("enabled") \
                         and True or False
@@ -156,6 +178,7 @@ def newmailbox(request, dom_id=None):
             })
 
 @login_required
+@permission_required("admin.change_mailbox")
 def editmailbox(request, dom_id, mbox_id=None):
     mb = Mailbox.objects.get(pk=mbox_id)
     if request.method == "POST":
@@ -201,6 +224,7 @@ def editmailbox(request, dom_id, mbox_id=None):
             })
 
 @login_required
+@permission_required("admin.delete_mailbox")
 def delmailbox(request, dom_id, mbox_id=None):
     mb = Mailbox.objects.get(pk=mbox_id)
     mb.delete_dir()
@@ -210,6 +234,7 @@ def delmailbox(request, dom_id, mbox_id=None):
                                         args=[dom_id]))
 
 @login_required
+@permission_required("admin.view_aliases")
 def aliases(request, dom_id=None, mbox_id=None):
     domain = Domain.objects.get(pk=dom_id)
     if not mbox_id:
@@ -224,6 +249,7 @@ def aliases(request, dom_id=None, mbox_id=None):
             })
 
 @login_required
+@permission_required("admin.add_alias")
 def newalias(request, dom_id, mbox_id):
     mbox = Mailbox.objects.get(pk=mbox_id)
     if request.method == "POST":
@@ -251,6 +277,7 @@ def newalias(request, dom_id, mbox_id):
             })
 
 @login_required
+@permission_required("admin.change_alias")
 def editalias(request, dom_id, alias_id):
     alias = Alias.objects.get(pk=alias_id)
     if request.method == "POST":
@@ -279,6 +306,7 @@ def editalias(request, dom_id, alias_id):
             })
 
 @login_required
+@permission_required("admin.delete_alias")
 def delalias(request, dom_id, alias_id):
     alias = Alias.objects.get(pk=alias_id)
     alias.delete()
@@ -286,14 +314,16 @@ def delalias(request, dom_id, alias_id):
                                         args=[dom_id]))
 
 @login_required
+@user_passes_test(lambda u: u.is_superuser)
 def settings(request):
     admins = User.objects.filter(is_superuser=True)
-    domadmins = User.objects.filter(groups__name="DomainAdmins")
+    domadmins = Mailbox.objects.filter(user__groups__name="DomainAdmins")
     return _render(request, 'admin/permissions.html', {
             "admins" : admins, "domadmins" : domadmins
             })
 
 @login_required
+@user_passes_test(lambda u: u.is_superuser)
 def addpermission(request):
     if request.method == "POST":
         form = PermissionForm(request.POST)
@@ -304,7 +334,7 @@ def addpermission(request):
         if form.is_valid():
             mb = Mailbox.objects.get(pk=request.POST["user"])
             if request.POST["role"] == "SuperAdmins":
-                mb.user.is_superadmin = True
+                mb.user.is_superuser = True
             else:
                 mb.user.groups.add(Group.objects.get(name=request.POST["role"]))
             mb.user.save()

scripts/populate.py

@@ -1,10 +1,15 @@
 #!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
-from django.contrib.auth.models import Group
+from django.contrib.auth.models import Group, Permission
 
 if __name__ == "__main__":
-    for gname in ["DomainAdmins", "Users"]:
-        grp = Group()
-        grp.name = gname
-        grp.save()
+    grp = Group()
+    grp.name = "DomainAdmins"
+    grp.save()
+    
+    for pcode in  ["add_mailbox", "change_mailbox", "delete_mailbox", "add_alias", 
+                   "change_alias", "delete_alias", "view_domain", "view_mailboxes",
+                   "view_aliases"]:
+        grp.permissions.add(Permission.objects.get(codename=pcode))
+    grp.save()

templates/admin/domain_menu.html

@@ -20,9 +20,11 @@
     <a href="{{ aliases_url }}">
       <img src="/static/pics/alias.png" border="0"/>
       {% trans "Aliases" %}</a></li>
+  {% if perms.admin.change_domain %}
   <li>
     <a href="{{ edit_url }}" class="boxed"
        rel="{handler:'iframe',size:{x:300,y:180}}">
       <img src="/static/pics/edit.png" border="0"/>
       {% trans "Properties" %}</a></li>
+  {% endif %}
 </ul>

templates/admin/layout.html

@@ -18,6 +18,7 @@
       </ul>
     </div>
     <br/>
+    {% if user.is_superuser %}
     <div id="menubox" class="leftbox">
       <ul>
         <li>
@@ -44,6 +45,7 @@
         </li>
       </ul>
     </div>
+    {% endif %}
   </div>
   <div id="content">
     {%block mainframe %}{% endblock %}

templates/admin/mailboxes.html

@@ -6,6 +6,16 @@
 
 {% block domcontent %}
 {% load i18n %}
+{% if messages %}
+<div class="error">
+<ul>
+  {% for msg in messages %}
+  <li>{{ msg }}</li>
+  {% endfor %}
+</ul>
+</div>
+{% endif %}
+
 {% if not mailboxes %}
 <p>{% trans "No mailbox defined." %}</p>
 {% else %}

templates/admin/permissions.html

@@ -12,9 +12,9 @@
 <table>
   <tr>
     <th width="50px">{% trans "Actions" %}</th>
-    <th>{% trans "Full name" %}</th>
+    <th width="210px">{% trans "Full name" %}</th>
     <th>{% trans "User name" %}</th>
-    <th>{% trans "Enabled" %}</th>
+    <th width="50px">{% trans "Enabled" %}</th>
   </tr>
   {% for admin in admins %}
   <tr class="{% cycle 'odd' 'even' %}">
@@ -36,9 +36,9 @@
 <table>
   <tr>
     <th width="50px">{% trans "Actions" %}</th>
-    <th>{% trans "Domain" %}</th>
+    <th width="210px">{% trans "Domain" %}</th>
     <th>{% trans "Name" %}</th>
-    <th>{% trans "Enabled" %}</th>
+    <th width="50px">{% trans "Enabled" %}</th>
   </tr>
   {% for admin in domadmins %}
   <tr class="{% cycle 'odd' 'even' %}">
@@ -46,7 +46,7 @@
       <a href=""><img src="/static/pics/remove.png" border="0" title="{% trans 'Remove permission' %}" /></a>
     </td>
     <td>{{ admin.domain.name }}</td>
-    <td>{{ admin.first_name }} {{ admin.last_name }}</td>
+    <td>{{ admin.name }}</td>
     <td>{{ admin.is_active|yesno }}</td>
   </tr>
   {% endfor %}