From a314c14fc48a7fcc818390133a84d1d045b8dca6 Mon Sep 17 00:00:00 2001
From: Antoine Nguyen <tonio@ngyn.org>
Date: Fri, 4 May 2012 10:15:43 +0200
Subject: [PATCH] wip: UI refactoring

Better behaviour on role change:
* If an account is promoted superuser, give it access to everything
* If an account is demoted from his position as superuser, remove all its accesses.

see #204
---
 admin/forms.py                | 15 +++++++++++++++
 extensions/limits/controls.py |  7 +++++++
 lib/permissions.py            | 16 ++++++++++++++++
 3 files changed, 38 insertions(+)

diff --git a/admin/forms.py b/admin/forms.py
index 2595970e5..0d296b7e0 100644
--- a/admin/forms.py
+++ b/admin/forms.py
@@ -367,6 +367,18 @@ class AccountFormGeneral(forms.ModelForm):
             raise forms.ValidationError(_("The two password fields didn't match."))
         return password2
 
+    def give_all_accesses(self, account):
+        """Give access to all objects defined in the database
+
+        Must be used when an account is promoted as a super user.
+
+        :param account: a ``User`` instance
+        """
+        grant_access_to_objects(account, User.objects.all(), get_content_type(User))
+        grant_access_to_objects(account, Domain.objects.all(), get_content_type(Domain))
+        grant_access_to_objects(account, DomainAlias.objects.all(), get_content_type(DomainAlias))
+        grant_access_to_objects(account, Mailbox.objects.all(), get_content_type(Mailbox))
+        grant_access_to_objects(account, Alias.objects.all(), get_content_type(Alias))
 
     def save(self, commit=True):
         account = super(AccountFormGeneral, self).save(commit=False)
@@ -383,7 +395,10 @@ class AccountFormGeneral(forms.ModelForm):
                 account.groups.clear()
                 if role == "SuperAdmins":
                     account.is_superuser = True
+                    self.give_all_accesses(account)
                 else:
+                    if account.is_superuser:
+                        ObjectAccess.objects.filter(user=account).delete()
                     account.is_superuser = False
                     account.groups.add(Group.objects.get(name=role))
                 account.save()
diff --git a/extensions/limits/controls.py b/extensions/limits/controls.py
index a42b07e26..9f225b900 100644
--- a/extensions/limits/controls.py
+++ b/extensions/limits/controls.py
@@ -138,6 +138,13 @@ def on_account_modified(old, new):
     if not new.group in ["DomainAdmins", "Resellers"]:
         move_pool_resource(owner, new)
 
+    try:
+        pool = new.limitspool
+    except LimitsPool.DoesNotExist:
+        p = LimitsPool(user=new)
+        p.save()
+        p.create_limits()
+
     if old.oldgroup == "DomainAdmins":
         if new.group != "DomainAdmins":
             dec_limit(owner, 'domain_admins_limit')
diff --git a/lib/permissions.py b/lib/permissions.py
index 98b99a256..11ccf01e3 100644
--- a/lib/permissions.py
+++ b/lib/permissions.py
@@ -68,6 +68,22 @@ def grant_access_to_object(user, obj, is_owner=False):
     except IntegrityError, e:
         raise ModoboaException(_("Failed to grant access (%s)" % str(e)))
 
+def grant_access_to_objects(user, objects, ct):
+    """Grant access to a collection of objects
+
+    All objects in the collection must share the same type (ie. ``ct``
+    applies to all objects).
+
+    :param user: a ``User`` object
+    :param objects: a list of objects
+    :param ct: the content type
+    """
+    for obj in objects:
+        try:
+            ObjectAccess.objects.create(user=user, content_type=ct, object_id=obj.id)
+        except IntegrityError:
+            pass
+    
 def ungrant_access_to_object(obj, user=None):
     """Ungrant access to an object for a specific user