# HG changeset patch
# Parent 72d09bb1ae5c688930b7cc47954014ba3ddd408a
# Date 1287066659 -7200

New users get the role "Provisional User" with less privileges.

diff -r 72d09bb1ae5c config.ini
--- a/config.ini	Thu Oct 14 16:10:10 2010 +0200
+++ b/config.ini	Thu Oct 14 16:30:59 2010 +0200
@@ -57,12 +57,12 @@
 # Roles that a user gets when they register with Web User Interface.
 # This is a comma-separated string of role names (e.g. 'Admin,User').
 # Default: User
-new_web_user_roles = User
+new_web_user_roles = Provisional User
 
 # Roles that a user gets when they register with Email Gateway.
 # This is a comma-separated string of role names (e.g. 'Admin,User').
 # Default: User
-new_email_user_roles = User
+new_email_user_roles = Provisional User
 
 # Send error message emails to the dispatcher, user, or both?
 # The dispatcher is configured using the DISPATCHER_EMAIL setting.
diff -r 72d09bb1ae5c detectors/provuserauditor.py
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/detectors/provuserauditor.py	Thu Oct 14 16:30:59 2010 +0200
@@ -0,0 +1,72 @@
+from roundup.exceptions import Reject
+
+def list_diff(old, new):
+    in_old = [x for x in old if x not in new]
+    in_both = [x for x in new if x in old]
+    in_new = [x for x in new if x not in old]
+    return in_old, in_both, in_new
+
+def creator(db, attribute, value):
+    if attribute == 'messages':
+        creator = db.getclass('msg').get(value, 'author')
+    elif attribute == 'files':
+        creator = db.getclass('file').get(value, 'creator')
+    elif attribute == 'nosy':
+        creator = value
+    else:
+        raise ValueError, ("creator called with wrong attribute '%r'" %
+                           (attribute,))
+    return creator
+
+def audit_provuser(db, cl, nodeid, newvalues):
+    '''Audit Provisional Users
+
+    - allowed to modify their own issues.
+    - allowed to add some information to other issues.
+    '''
+    role_limits = [
+        # role, limited attributes, others unlimited?
+        ('provisional user', ['messages', 'files', 'nosy'], False),
+    ]
+    rejects = {
+        'messages': (
+            'Do not remove messages of other users!',
+            'Error while adding message!'
+        ),
+        'files': (
+            'Do not remove files of other users!',
+            'Error while adding file!'
+        ),
+        'nosy': (
+            'Please do not remove other users from the nosy list.',
+            'Please only add yourself to the nosy list.',
+        ),
+    }
+    uid = db.getuid()
+    if uid != cl.get(nodeid, 'creator'):
+        roles = [x.lower().strip() for x in db.user.get(uid, 'roles').split(',')]
+        for role, limited, unlimited in role_limits:
+            if role in roles:
+                for key, new in newvalues.items():
+                    if key in limited:
+                        old = cl.get(nodeid, key)
+                        in_old, in_both, in_new = list_diff(old, new)
+                        for value in in_old:
+                            if creator(db, key, value) != uid:
+                                raise Reject, rejects[key][0]
+                        for value in in_new:
+                            if creator(db, key, value) != uid:
+                                raise Reject, rejects[key][1]
+                    elif not unlimited:
+                        del newvalues[key]
+
+
+def init(db):
+    # fire before changes are made
+    db.issue.audit('set', audit_provuser)
+    db.issue.audit('retire', audit_provuser)
+    db.issue.audit('restore', audit_provuser)
+
+
+
+# vim: set filetype=python ts=4 sw=4 et si
diff -r 72d09bb1ae5c html/issue.item.html
--- a/html/issue.item.html	Thu Oct 14 16:10:10 2010 +0200
+++ b/html/issue.item.html	Thu Oct 14 16:30:59 2010 +0200
@@ -54,7 +54,7 @@
  <th i18n:translate="">Superseder</th>
  <td>
   <span tal:replace="structure python:context.superseder.field(showid=1, size=20)" />
-  <span tal:condition="context/is_edit_ok" tal:replace="structure python:db.issue.classhelp('id,title', property='superseder')" />
+  <span tal:condition="context/superseder/is_edit_ok" tal:replace="structure python:db.issue.classhelp('id,title', property='superseder')" />
   <span tal:condition="context/superseder">
    <br><span i18n:translate="">View:</span>
      <a tal:repeat="sup context/superseder"
@@ -79,7 +79,7 @@
  <th i18n:translate="">Keywords</th>
  <td>
   <span tal:replace="structure context/keyword/field" />
-  <span tal:condition="context/is_edit_ok" tal:replace="structure python:db.keyword.classhelp(property='keyword')" />
+  <span tal:condition="context/keyword/is_edit_ok" tal:replace="structure python:db.keyword.classhelp(property='keyword')" />
  </td>
 </tr>
 
@@ -152,7 +152,7 @@
           tal:attributes="href string:file${file/id}">edit</a>
   </td>
   <td>
-   <form style="padding:0" method="POST" tal:condition="context/is_edit_ok"
+   <form style="padding:0" method="POST" tal:condition="file/is_edit_ok"
          tal:attributes="action string:issue${context/id}">
     <input type="hidden" name="@remove@files" tal:attributes="value file/id">
     <input type="hidden" name="@action" value="edit">
@@ -173,7 +173,7 @@
    <th i18n:translate="">Date: <tal:x replace="msg/date"
        i18n:name="date" /></th>
    <th>
-    <form style="padding:0" method="POST" tal:condition="context/is_edit_ok"
+    <form style="padding:0" method="POST" tal:condition="msg/is_edit_ok"
           tal:attributes="action string:issue${context/id}">
      <input type="hidden" name="@remove@messages" tal:attributes="value msg/id">
      <input type="hidden" name="@action" value="edit">
diff -r 72d09bb1ae5c schema.py
--- a/schema.py	Thu Oct 14 16:10:10 2010 +0200
+++ b/schema.py	Thu Oct 14 16:30:59 2010 +0200
@@ -82,6 +82,18 @@
 # See the configuration and customisation document for information
 # about security setup.
 
+def own_issue(db, userid, itemid):
+    '''Determine whether the userid matches the creator of the issue.'''
+    return userid == db.issue.get(itemid, 'creator') 
+
+def own_file(db, userid, itemid):
+    '''Determine whether the userid matches the creator of the issue.'''
+    return userid == db.file.get(itemid, 'creator') 
+
+def own_msg(db, userid, itemid):
+    '''Determine whether the userid matches the creator of the msg.'''
+    return userid == db.msg.get(itemid, 'author') 
+
 #
 # REGULAR USERS
 #
@@ -144,6 +156,74 @@
 
 
 #
+# NEW USERS
+#
+db.security.addRole(name='Provisional User',
+        description='New user not yet approved by the admin')
+
+# Give the new users access to the web and email interface
+db.security.addPermissionToRole('Provisional User', 'Web Access')
+db.security.addPermissionToRole('Provisional User', 'Email Access')
+
+# New users should be able to view and create issues but only edit their own
+for cl in 'issue', 'file', 'msg':
+    db.security.addPermissionToRole('Provisional User', 'View', cl)
+    db.security.addPermissionToRole('Provisional User', 'Create', cl)
+for cl in 'keyword', 'priority', 'status':
+    db.security.addPermissionToRole('Provisional User', 'View', cl)
+
+p = db.security.addPermission(name='Edit', klass='issue',
+    check=own_issue, description='Can only edit own issues')
+db.security.addPermissionToRole('Provisional User', p)
+
+p = db.security.addPermission(name='Edit', klass='file',
+    check=own_file, description='Can only edit own files')
+db.security.addPermissionToRole('Provisional User', p)
+
+p = db.security.addPermission(name='Edit', klass='msg',
+    check=own_msg, description='Can only edit own messages')
+db.security.addPermissionToRole('Provisional User', p)
+
+p = db.security.addPermission(name='Edit', klass='issue',
+    properties=('title', 'messages', 'nosy', 'files'),
+    description='Can edit some properties in other issues')
+db.security.addPermissionToRole('Provisional User', p)
+
+# Provisional Users are allowed to view some properties of other users
+p = db.security.addPermission(name='View', klass='user',
+    properties=('username', 'realname', 'organisation', 'roles'),
+    description="Provisional User is allowed to view some properties of other users")
+db.security.addPermissionToRole('Provisional User', p)
+
+# Provisional Users should be able to edit their own details -- this permission is
+# limited to only the situation where the Viewed or Edited item is their own.
+p = db.security.addPermission(name='View', klass='user', check=own_record,
+    description="Provisional User is allowed to view their own user details")
+db.security.addPermissionToRole('Provisional User', p)
+p = db.security.addPermission(name='Edit', klass='user', check=own_record,
+    properties=('username', 'password', 'address', 'realname',
+        'organisation', 'alternate_addresses', 'queries', 'timezone'),
+    description="Provisional User is allowed to edit their own user details")
+db.security.addPermissionToRole('Provisional User', p)
+
+# Users should be able to edit and view their own queries. They should also
+# be able to view any marked as not private. They should not be able to
+# edit others' queries, even if they're not private
+p = db.security.addPermission(name='View', klass='query', check=view_query,
+    description="Provisional User is allowed to view their own and public queries")
+db.security.addPermissionToRole('Provisional User', p)
+p = db.security.addPermission(name='Edit', klass='query', check=edit_query,
+    description="Provisional User is allowed to edit their queries")
+db.security.addPermissionToRole('Provisional User', p)
+p = db.security.addPermission(name='Retire', klass='query', check=edit_query,
+    description="Provisional User is allowed to retire their queries")
+db.security.addPermissionToRole('Provisional User', p)
+p = db.security.addPermission(name='Create', klass='query',
+    description="Provisional User is allowed to create queries")
+db.security.addPermissionToRole('Provisional User', p)
+
+
+#
 # ANONYMOUS USER PERMISSIONS
 #
 # Let anonymous users access the web interface. Note that almost all