see #92

I think the refactoring is over :-) I need to add specifec events that will allow plugins to define their own roles inside the hierarchy.

Otherwise, the graphical part needs some improvment, actually it's not really pretty :p

admin/permissions.py

@@ -0,0 +1,123 @@
+# coding: utf8
+
+from django.utils.translation import ugettext as _
+from django.contrib.auth.models import User, Group
+from modoboa.lib import _render
+from forms import *
+
+class Permissions(object):
+    @staticmethod
+    def is_auhorized(user):
+        return True
+
+    def get_add_form(self, request):
+        raise NotImplementedError
+
+    def add(self, request):
+        raise NotImplementedError
+
+    def delete(self, request, selection):
+        raise NotImplementedError
+
+    def get(self, request):
+        raise NotImplementedError
+
+class SuperAdminsPerms(Permissions):
+    @staticmethod
+    def is_auhorized(user):
+        return user.is_superuser
+    
+    def get_add_form(self, request):
+        form = SuperAdminForm()
+        return _render(request, 'admin/add_permission.html', {
+                "form" : form, 
+                "title" : _("Add super administrator"),
+                "role": "super_admins"
+                })
+
+    def add(self, request):
+        form = SuperAdminForm(request.POST)
+        if form.is_valid():
+            user = User.objects.get(pk=request.POST["user"])
+            user.is_superuser = True
+            user.groups.clear()
+            user.save()
+            return True, None
+
+        ctx = _ctx_ko("admin/add_superadmin.html", {
+                "form" : form
+                })
+        return False, ctx
+    
+    def delete(self, selection):
+        for s in selection:
+            user = User.objects.get(pk=int(s))
+            if user.username == "admin":
+                #messages.error(request, _("admin is intouchable!!"), fail_silently=True)
+                continue
+            user.is_superuser = False
+            user.save()
+
+    def get(self, request):
+        admins = User.objects.filter(is_superuser=True)
+        admins_list = []
+        for admin in admins:
+            admins_list += [{"id" : admin.id, "user_name" : admin.username,
+                             "full_name" : "%s %s" % (admin.first_name, admin.last_name),
+                             "enabled" : admin.is_active}]
+        return SuperAdminsTable(admins_list).render(request)
+   
+
+class DomainAdminsPerms(Permissions):
+    @staticmethod
+    def is_auhorized(user):
+        return True
+
+    def get_add_form(self, request):
+        form = DomainAdminForm()
+        return _render(request, 'admin/add_domain_admin.html', {
+                "form" : form, "title" : _("Add domain administrator"),
+                "role" : "domain_admins"
+                })
+    
+    def add(self, request):
+        form = DomainAdminForm(request.POST)
+        mboxid = request.POST['user']
+        form.fields["user"].choices = \
+            [(mboxid, Mailbox.objects.get(pk=mboxid)),]
+        if form.is_valid():
+            mb = Mailbox.objects.get(pk=request.POST["user"])
+            mb.user.is_superuser = False
+            mb.user.groups.add(Group.objects.get(name="DomainAdmins"))
+            mb.user.save()
+            return True, None
+        ctx = _ctx_ko("admin/add_domain_admin.html", {
+                "form" : form
+                })
+        return False, ctx
+
+    def delete(self, selection):
+        for s in selection:
+            mbox = Mailbox.objects.get(pk=int(s))
+            grp = Group.objects.get(name="DomainAdmins")
+            mbox.user.groups.remove(grp)
+            mbox.user.save()
+
+    def get(self, request):
+        domadmins = Mailbox.objects.filter(user__groups__name="DomainAdmins")
+        domadmins_list = []
+        for admin in domadmins:
+            domadmins_list += [admin.tohash()]
+        return DomainAdminsTable(domadmins_list).render(request)
+
+def get_perms_class(user, role):
+    parts = role.split("_")
+    cname = ""
+    for p in parts:
+        cname += p.capitalize()
+    cname += "Perms"
+    if globals().has_key(cname):
+        if globals()[cname].is_auhorized(user):
+            return globals()[cname]
+        return None
+    # else raise event for plugins

admin/templatetags/admin_extras.py

@@ -123,10 +123,12 @@ def permissions_menu(user):
     entries = [
         {"name" : "addperm",
          "label" : _("Add permission"),
-         "img" : static_url("pics/add.png")},
+         "img" : static_url("pics/add.png"),
+         "url" : reverse(admin.views.add_permission)},
         {"name" : "delperms",
          "label" : _("Remove permissions"),
-         "img" : static_url("pics/remove.png")},
+         "img" : static_url("pics/remove.png"),
+         "url" : reverse(admin.views.delete_permissions)},
         ]
     return render_to_string('common/menu.html', 
                             {"entries" : entries, "user" : user})

admin/urls.py

@@ -16,13 +16,14 @@ urlpatterns = patterns('modoboa.admin.views',
                        url(r'^domains/(?P<dom_id>\d+)/aliases/$', "aliases", name="full-aliases"),
                        url(r'^domains/(?P<dom_id>\d+)/aliases/(?P<mbox_id>\d+)/$', "aliases", name="mbox-aliases"),
                        (r'^domains/(?P<dom_id>\d+)/delalias/(?P<alias_id>\d+)/$', 'delalias'),
+
                        (r'^settings/$', 'viewparameters'),
-                       (r'^settings/delperm/(?P<mbox_id>\d+)/(?P<group>\w+)/$', 'deletepermission'),
                        (r'^settings/parameters/$', 'viewparameters'),
                        (r'^settings/parameters/save/$', 'saveparameters'),
                        (r'^settings/extensions/$', 'viewextensions'),
                        (r'^settings/extensions/save/$', 'saveextensions'),
+
                        (r'^permissions/$', 'permissions'),
-                       (r'^permissions/superadmin/add/$', 'add_superadmin'),
-                       (r'^permissions/domainadmin/add/$', 'add_domain_admin'),
+                       (r'^permissions/add/$', 'add_permission'),
+                       (r'^permissions/delete/$', 'delete_permissions'),
                        )

admin/views.py

@@ -15,7 +15,7 @@ from django.contrib import messages
 
 from modoboa import admin, userprefs
 from models import *
-from forms import *
+from admin.permissions import *
 from modoboa.lib.authbackends import crypt_password
 from modoboa.lib import _render, _ctx_ok, _ctx_ko, getctx, events, parameters
 from modoboa.lib.models import Parameter
@@ -359,28 +359,18 @@ def delalias(request, dom_id, alias_id):
 def permissions(request):
     permtables = []
     if request.user.is_superuser:
-        admins = User.objects.filter(is_superuser=True)
-        admins_list = []
-        for admin in admins:
-            admins_list += [{"id" : admin.id, "user_name" : admin.username,
-                             "full_name" : "%s %s" % (admin.first_name, admin.last_name),
-                             "enabled" : admin.is_active}]
         permtables += [
-            {"title" : _("Super administrators"),
-             "content" :  SuperAdminsTable(admins_list).render(request),
-             "addurl" : reverse(add_superadmin)}
+            {"id" : "super_admins",
+             "title" : _("Super administrators"),
+             "content" : SuperAdminsPerms().get(request)}
             ]
 
     permtables += events.raiseQueryEvent("PermsGetTables", user=request.user)
 
-    domadmins = Mailbox.objects.filter(user__groups__name="DomainAdmins")
-    domadmins_list = []
-    for admin in domadmins:
-        domadmins_list += [admin.tohash()]
     permtables += [
-        {"title" : _("Domain administrators"),
-         "content" : DomainAdminsTable(domadmins_list).render(request),
-         "addurl" : reverse(add_domain_admin)}
+        {"id" : "domain_admins",
+         "title" : _("Domain administrators"),
+         "content" : DomainAdminsPerms().get(request)}
         ]
 
     return _render(request, 'admin/permissions.html', {
@@ -388,72 +378,38 @@ def permissions(request):
             })
 
 @login_required
-@user_passes_test(lambda u: u.is_superuser)
-def add_superadmin(request):
-    if request.method == "POST":
-        form = SuperAdminForm(request.POST)
-        if form.is_valid():
-            user = User.objects.get(pk=request.POST["user"])
-            user.is_superuser = True
-            user.groups.clear()
-            user.save()
-            ctx = _ctx_ok(reverse(admin.views.permissions))
-            return HttpResponse(simplejson.dumps(ctx), 
-                                mimetype="application/json")
-        ctx = _ctx_ko("admin/add_superadmin.html", {
-                "form" : form
-                })
-        return HttpResponse(simplejson.dumps(ctx), mimetype="application/json")
-
-    form = SuperAdminForm()
-    return _render(request, 'admin/add_permission.html', {
-            "form" : form, "title" : _("Add super administrator"),
-            "action" : reverse(add_superadmin)
-            })
-
-@login_required
-@permission_required("domains.create")
-def add_domain_admin(request):
-    if request.method == "POST":
-        form = DomainAdminForm(request.POST)
-        mboxid = request.POST['user']
-        form.fields["user"].choices = \
-            [(mboxid, Mailbox.objects.get(pk=mboxid)),]
-        if form.is_valid():
-            mb = Mailbox.objects.get(pk=request.POST["user"])
-            mb.user.is_superuser = False
-            mb.user.groups.add(Group.objects.get(name="DomainAdmins"))
-            mb.user.save()
-            ctx = _ctx_ok(reverse(admin.views.permissions))
-            return HttpResponse(simplejson.dumps(ctx), 
-                                mimetype="application/json")
-        ctx = _ctx_ko("admin/add_domain_admin.html", {
-                "form" : form
-                })
-        return HttpResponse(simplejson.dumps(ctx), mimetype="application/json")
-
-    form = DomainAdminForm()
-    return _render(request, 'admin/add_domain_admin.html', {
-            "form" : form, "title" : _("Add domain administrator"),
-            "action" : reverse(add_domain_admin)
-            })
-
-@login_required
-@user_passes_test(lambda u: u.is_superuser)
-def deletepermission(request, mbox_id, group):
-    if group == "SuperAdmins":
-        user = User.objects.get(pk=mbox_id)
-        if user.username == "admin":
-            messages.error(request, _("admin is intouchable!!"), fail_silently=True)
-        else:
-            user.is_superuser = False
-            user.save()
+@permission_required("auth.view_permissions")
+def add_permission(request):
+    role = request.method == "GET" and request.GET["role"] or request.POST["role"]
+    pclass = get_perms_class(request.user, role)
+    if pclass is None:
+        messages.error(request, _("Permission denied!"), 
+                       fail_silently=True)
     else:
-        mbox = Mailbox.objects.get(pk=mbox_id)
-        grp = Group.objects.get(name=group)
-        mbox.user.groups.remove(grp)
-        mbox.user.save()
-    return HttpResponseRedirect(reverse(admin.views.settings))
+        pobj = pclass()
+        if request.method == "GET":
+            return pobj.get_add_form(request)
+        status, data = pobj.add(request)
+        if not status:
+            return HttpResponse(simplejson.dumps(data), mimetype="application/json")
+        messages.info(request, _("Permission added."), 
+                      fail_silently=True)
+    ctx = _ctx_ok(reverse(admin.views.permissions))
+    return HttpResponse(simplejson.dumps(ctx), 
+                        mimetype="application/json")
+
+@login_required
+def delete_permissions(request):
+    pclass = get_perms_class(request.user, request.GET["role"])
+    if pclass is None:
+        ctx = getctx("ko", message=_("Permission denied!"))
+    else:
+        selection = request.GET["selection"].split(",")
+        pobj = pclass()
+        pobj.delete(selection)
+        ctx = getctx("ok", content=pobj.get(request), 
+                     message=_("Permissions removed"))
+    return HttpResponse(simplejson.dumps(ctx), mimetype="application/json")
 
 @login_required
 @user_passes_test(lambda u: u.is_superuser)