Re: Creating an auditor to prevent some users from deleting issues/messages/files

----- Original Message -----
> From: "Ralf Schlatterbeck" <[email protected]>
> To: [email protected]
> Sent: Wednesday, March 4, 2015 11:55:58 PM
> Subject: Re: [Roundup-users] Creating an auditor to prevent some users from deleting issues/messages/files
> 
> On Wed, Mar 04, 2015 at 05:34:36PM -0800, Dan Tenenbaum wrote:
> > 
> > #!/usr/bin/env python
> > from roundup.exceptions import Reject
> > 
> > def auditme(db, cl, nodeid, newvalues):
> >     roles = db.getnode("user", db.getuid())['roles'].split(",")
> >     roles = [x.strip() for x in roles]
> >     if not ("Admin" in roles or "User" in roles):
> >         raise Reject("You cannot delete this item.")
> > 
> > def init(db):
> >     db.issue.audit('retire', auditme)
> >     db.msg.audit('retire', auditme)
> >     db.file.audit('retire', auditme)
> > 
> > The "auditme" function is never called. I tried changing 'retire'
> > to
> > 'remove' but got an error. What are the various verbs that can be
> > passed to audit() and where are they defined?
> 
> The actions you can pass to the audit registration method (as well as
> the 'react' registration method) are 'set', 'create', 'retire',
> 'restore'. You find them in the backend implementations (mostly
> backends/rdbms_common.py for all the sql backends and back_anydbm.py
> for
> dbm) in the fireAuditors / fireReactors calls. The actual definitions
> for which values are allowed are in the 'Class' constructor in
> hyperdb.py, you want to look for
> actions = "create set retire restore".split()
> And they should also be described in the documentation, I've not
> checked.
> 
> Note that removing a message or a file from an issue does *not*
> automagically retire it, that's probably the reason why your auditor
> isn't called (but you don't tell us how you're trying to retire the
> issue). 

Maybe "retire" is the wrong word. I just want to catch it when the user clicks the "remove" button to the right of a message or file. 

The above code does not catch it and none of the other options seem appropriate. This is the source fragment of the button I'm talking about:

<form style="padding:0" method="POST" action="issue1">
     <input type="hidden" name="@remove@messages" value="3">
     <input type="hidden" name="@action" value="edit">
     <input type="submit" value="remove">
    </form>


> The message is just unlinked from the 'messages' (or 'files')
> multilink property of the issue. This means you should create an
> auditor
> on issue that checks if any messages/files are deleted from the
> lists.
> You would checks this by comparing 'newvalues' (a dictionary with the
> changed property names as a key and the new value as the value) to
> 'cl.get (nodeid, 'messages')'. (I'm qouting 'messages' and 'files'
> from
> memory here, maybe I'm not remembering the names correctly)
> 

OK, but what do I put in init()? I need to call db.something.audit('something else', auditme) but I'm not sure what the somethings should be. You can see above what I already tried and I know that's not working because I set a breakpoint in auditme() which is never encountered.

Thanks,
Dan


> Ralf
> --
> Dr. Ralf Schlatterbeck                  Tel:   +43/2243/26465-16
> Open Source Consulting                  www:   http://www.runtux.com
> Reichergasse 131, A-3411 Weidling       email: [email protected]
> allmenda.com member                     email: [email protected]
> 
> ------------------------------------------------------------------------------
> Dive into the World of Parallel Programming The Go Parallel Website,
> sponsored
> by Intel and developed in partnership with Slashdot Media, is your
> hub for all
> things parallel software development, from weekly thought leadership
> blogs to
> news, videos, case studies, tutorials and more. Take a look and join
> the
> conversation now. http://goparallel.sourceforge.net/
> _______________________________________________
> Roundup-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/roundup-users
> 

------------------------------------------------------------------------------
Dive into the World of Parallel Programming The Go Parallel Website, sponsored
by Intel and developed in partnership with Slashdot Media, is your hub for all
things parallel software development, from weekly thought leadership blogs to
news, videos, case studies, tutorials and more. Take a look and join the 
conversation now. http://goparallel.sourceforge.net/