wip: UI refactoring

Better behaviour on role change:
* If an account is promoted superuser, give it access to everything
* If an account is demoted from his position as superuser, remove all its accesses.

see #204

admin/forms.py

@@ -367,6 +367,18 @@ class AccountFormGeneral(forms.ModelForm):
             raise forms.ValidationError(_("The two password fields didn't match."))
         return password2
 
+    def give_all_accesses(self, account):
+        """Give access to all objects defined in the database
+
+        Must be used when an account is promoted as a super user.
+
+        :param account: a ``User`` instance
+        """
+        grant_access_to_objects(account, User.objects.all(), get_content_type(User))
+        grant_access_to_objects(account, Domain.objects.all(), get_content_type(Domain))
+        grant_access_to_objects(account, DomainAlias.objects.all(), get_content_type(DomainAlias))
+        grant_access_to_objects(account, Mailbox.objects.all(), get_content_type(Mailbox))
+        grant_access_to_objects(account, Alias.objects.all(), get_content_type(Alias))
 
     def save(self, commit=True):
         account = super(AccountFormGeneral, self).save(commit=False)
@@ -383,7 +395,10 @@ class AccountFormGeneral(forms.ModelForm):
                 account.groups.clear()
                 if role == "SuperAdmins":
                     account.is_superuser = True
+                    self.give_all_accesses(account)
                 else:
+                    if account.is_superuser:
+                        ObjectAccess.objects.filter(user=account).delete()
                     account.is_superuser = False
                     account.groups.add(Group.objects.get(name=role))
                 account.save()

extensions/limits/controls.py

@@ -138,6 +138,13 @@ def on_account_modified(old, new):
     if not new.group in ["DomainAdmins", "Resellers"]:
         move_pool_resource(owner, new)
 
+    try:
+        pool = new.limitspool
+    except LimitsPool.DoesNotExist:
+        p = LimitsPool(user=new)
+        p.save()
+        p.create_limits()
+
     if old.oldgroup == "DomainAdmins":
         if new.group != "DomainAdmins":
             dec_limit(owner, 'domain_admins_limit')

lib/permissions.py

@@ -68,6 +68,22 @@ def grant_access_to_object(user, obj, is_owner=False):
     except IntegrityError, e:
         raise ModoboaException(_("Failed to grant access (%s)" % str(e)))
 
+def grant_access_to_objects(user, objects, ct):
+    """Grant access to a collection of objects
+
+    All objects in the collection must share the same type (ie. ``ct``
+    applies to all objects).
+
+    :param user: a ``User`` object
+    :param objects: a list of objects
+    :param ct: the content type
+    """
+    for obj in objects:
+        try:
+            ObjectAccess.objects.create(user=user, content_type=ct, object_id=obj.id)
+        except IntegrityError:
+            pass
+    
 def ungrant_access_to_object(obj, user=None):
     """Ungrant access to an object for a specific user