fix filtering of deployments when adding slivers
diff --git a/planetstack/core/acl.py b/planetstack/core/acl.py
index 7fc6a02..7856414 100644
--- a/planetstack/core/acl.py
+++ b/planetstack/core/acl.py
@@ -1,5 +1,22 @@
from fnmatch import fnmatch
+"""
+ A General-purpose ACL mechanism.
+
+ [allow | deny] <type_of_object> <text_pattern>
+
+ "allow all" and "deny all" are shorthand for allowing or denying all objects.
+ Lines are executed from top to bottom until a match was found, typical
+ iptables style. An implicit 'deny all' exists at the bottom of the list.
+
+ For example,
+ allow site Max Planck Institute
+ deny site Arizona
+ allow region US
+ deny user scott@onlab.us
+ allow user *@onlab.us
+"""
+
class AccessControlList:
def __init__(self, aclText=None):
self.rules = []
@@ -42,17 +59,20 @@
lines.append( " ".join(rule) )
return ";\n".join(lines)
- def test(self, user):
+ def test(self, user, site=None):
for rule in self.rules:
if self.match_rule(rule, user):
return rule[0]
return "deny"
- def match_rule(self, rule, user):
+ def match_rule(self, rule, user, site=None):
(action, object, pattern) = rule
+ if (site==None):
+ site = user.site
+
if (object == "site"):
- if fnmatch(user.site.name, pattern):
+ if fnmatch(site.name, pattern):
return True
elif (object == "user"):
if fnmatch(user.email, pattern):
@@ -64,6 +84,8 @@
if __name__ == '__main__':
+ # self-test
+
class fakesite:
def __init__(self, siteName):
self.name = siteName
diff --git a/planetstack/core/admin.py b/planetstack/core/admin.py
index 6fe9095..8bf7976 100644
--- a/planetstack/core/admin.py
+++ b/planetstack/core/admin.py
@@ -232,10 +232,10 @@
return Sliver.select_by_user(request.user)
def formfield_for_foreignkey(self, db_field, request=None, **kwargs):
- field = super(SliverInline, self).formfield_for_foreignkey(db_field, request, **kwargs)
-
if db_field.name == 'deploymentNetwork':
- kwargs['queryset'] = Deployment.select_by_user(request.user)
+ kwargs['queryset'] = Deployment.select_by_acl(request.user)
+
+ field = super(SliverInline, self).formfield_for_foreignkey(db_field, request, **kwargs)
return field