Re: msg permissions issue

Hi Chuck:

What version of Roundup are you running? What version of Python?

In message
<CAH-41398iTPhze7D_pZB8tqTBHF=q6HYonbcG++YN-ioDssXBw@mail.gmail.com>,
Chuck Cunningham writes:
>I have my tracker set up so that users only see issues they create or
>assigned to them by doing this:
>
>def user_issue(db, userid, itemid):
>    return userid == db.issue.get(itemid, 'assignedto') or userid ==
>db.issue.get(itemid, 'creator')

I don't think you need this check. It should be a subset of the nosy
list permission check. The creator and assignedto people should be on
the nosy list. Also depending on the ticket, you might want to exclude
the creator. In a tracker I built, I use the nosy list (and a
'verynosy') as ACL's for access to the files and msg as well as the
issue.  (See:
https://rouilj.dynamic-dns.net/fossil/roundup_sysadmin/file?name=schema.py&ci=tip
for the (messy) schema.)

>p = db.security.addPermission(name='View', klass='issue',
>    check=user_issue,description="User is allowed to access this")
>db.security.addPermissionToRole('User', p)
>p = db.security.addPermission(name='Edit', klass='issue',
>    check=user_issue,description="User is allowed to edit this")
>db.security.addPermissionToRole('User', p)
>db.security.addPermissionToRole('User', 'Create', 'issue')
>
>for cl in 'file', 'msg':
>    db.security.addPermissionToRole('User', 'View', cl)
>    db.security.addPermissionToRole('User', 'Edit', cl)
>    db.security.addPermissionToRole('User', 'Create', cl)

This should allow every person with the User role to create/edit/view
any msg or file. Note that this set of permissions doesn't restrict
access to an individual msg or file.

>I then wanted to make it so that users also see issues for which they
>are on the nosy list:
>
>def user_nosy_issue(db, userid, itemid):
>    nosy = db.issue.get(itemid, 'nosy')
>    # check if userid is in the list and return 1 if yes, 0 otherwise
>    return nosy.count(userid)

Although 'return userid in nosy' is more idiomatic, this should
work. Using count() is less efficient though. Count has to visit each
value in the nosy array to count all matching values. It doesn't stop
once it finds a match.

I'm trying to remember if the nosy value is a list of strings or
integers. I think userid and the items in the nosy list are both
strings. So your code should work as expected.

I raise this because:

    nosy = ['1', '2', '3']
    c = nosy.count(1)

c will be 0.

    c = nosy.count('1')

c will be 1. Also vice versa.

># add permission for issue view and edit for people on nosy list
>p = db.security.addPermission(name='View', klass='issue',
>    check=user_nosy_issue, description="User is allowed to access this")
>db.security.addPermissionToRole('User', p)
>p = db.security.addPermission(name='Edit', klass='issue',
>    check=user_nosy_issue,description="User is allowed to edit this")
>db.security.addPermissionToRole('User', p)

I suggest changing your descriptions to include nosy somehow. E.G.

  description="User is allowed to access this (on nosy list)"

>This works great except people on the nosy list can't reply (and
>create a 'msg')..I know there is something I need to do to the
>permissions for messages, but can't figure it out.  Any pointers much
>appreciated.

Your msg permissions look like you are allowing Create, so I am also
bewildered.

What does running:

   roundup-admin -i <tracker/home/dir> security user

report? (note: internally role names are all lowercase hence 'user'
not 'User'., This is also a bug and will be fixed to lowercase the
role string.)

Have a great day.
--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.