permission check refactor - DONE!

permission checker integrated into project

statics/db.py → helpers/db.py

@@ -1,6 +1,6 @@
 import sqlalchemy.ext.declarative
 from flask_login import UserMixin
-from sqlalchemy import Column, Integer, String, TEXT, DateTime, Enum, JSON
+from sqlalchemy import Column, Integer, String, TEXT, DateTime, JSON
 from sqlalchemy.orm import sessionmaker
 
 from routes.user import User

statics/init.py → helpers/init.py

@@ -2,8 +2,8 @@
 
 import pymysql
 
+from helpers import db
 from statics import config as conf
-from statics import db
 
 
 def init_db():

permissions.py → helpers/permissions.py

@@ -1,6 +1,6 @@
 from contextlib import suppress
 
-from statics import db
+from helpers import db
 
 
 def permission_merger(permission_set: list):
@@ -39,6 +39,10 @@ def group_permission_getter(user):
 def user_element_permission_getter(user, element):
     session = db.factory()
     element = session.query(db.Content).filter_by(id=element).first()
+    while element.permissions == {}:
+        if element.location is None:
+            break
+        element = session.query(db.Content).filter_by(id=element.location).first()
 
     ele_permissions = element.permissions
     session.close()
@@ -51,6 +55,10 @@ def user_element_permission_getter(user, element):
 def group_element_permission_getter(user, element):
     session = db.factory()
     element = session.query(db.Content).filter_by(id=element).first()
+    while element.permissions == {}:
+        if element.location is None:
+            break
+        element = session.query(db.Content).filter_by(id=element.location).first()
 
     group_ids = [x for x in element.permissions.keys() if x in [str(y) for y in user.groups]]
 

main.py

@@ -1,12 +1,13 @@
 from flask_scss import Scss
 
 from globals import app
+from helpers import init
 from routes import user
 from routes.api_create import api_create
 from routes.api_get import api_get
 from routes.api_moderate import api_moderate
 from routes.permissions import api_permissions
-from statics import config, init
+from statics import config
 
 app.config["environment"] = "development"
 

routes/api_comments.py

@@ -1,12 +1,10 @@
-import json
-
 from flask import Blueprint, request
 from flask_login import login_required, current_user
 
+import helpers.permissions
 from crossdomain import crossdomain
 from globals import app
-from statics import db
-from statics.helpers import permissions_checker
+from helpers import db
 
 api_moderate = Blueprint("api_comment", __name__)
 
@@ -17,7 +15,7 @@ def comment():
     content_id = request.args["id"]
     content = request.args["content"]
 
-    if permissions_checker(current_user, "interact", "comment", content_id):
+    if helpers.permissions.permission_check(current_user, content_id, "interact", "comment"):
         session = db.factory()
         old = session.query(db.Content).filter_by(id=content_id)[0]
 

routes/api_create.py

@@ -1,13 +1,11 @@
-import json
-
 from flask import Blueprint, request
 from flask_login import login_required, current_user
 
+import helpers.permissions
 from crossdomain import crossdomain
 from globals import app
+from helpers import db
 from statics import config
-from statics import db
-from statics.helpers import permissions_checker
 
 api_create = Blueprint("api_create", __name__)
 
@@ -19,7 +17,7 @@ def create_content():
     if not request.args["type"] in config.known_types:
         return {"error": "Unknown type"}, 400
 
-    permission = permissions_checker(current_user, "create", request.args["type"], request.args["location"])
+    permission = helpers.permissions.permission_check(current_user, request.args["location"], "create", request.args["type"])
     if not permission:
         return {"error": "missing permissions"}, 403
 

routes/api_get.py

@@ -1,13 +1,11 @@
-import json
-
 import flask
 from flask import Blueprint, request, jsonify
 from flask_login import login_required, current_user
 
+import helpers.permissions
 from crossdomain import crossdomain
 from globals import app
-from statics import db
-from statics.helpers import permissions_checker
+from helpers import db
 
 api_get = Blueprint("api_get", __name__)
 
@@ -23,7 +21,7 @@ def get_content():
     if res is None:
         return flask.abort(flask.Response(response="Location not found", status=404))
 
-    if not permissions_checker(current_user, "view", "all", location):
+    if not helpers.permissions.permission_check(current_user, location, "view", "all"):
         return flask.abort(flask.Response(response="No permission to view this location", status=906))
 
     content = session.query(db.Content).filter_by(location=location).all()
@@ -85,7 +83,7 @@ def breadcrumb():
 def versions():
     location = request.args["location"]
 
-    if not permissions_checker(current_user, "view", "all", location):
+    if not helpers.permissions.permission_check(current_user, location, "view", "all"):
         return {"error": "missing permissions"}, 403
 
     session = db.factory()

routes/api_moderate.py

@@ -3,10 +3,10 @@
 from flask import Blueprint, request
 from flask_login import login_required, current_user
 
+import helpers.permissions
 from crossdomain import crossdomain
 from globals import app, cut_objects
-from statics import db
-from statics.helpers import permissions_checker
+from helpers import db
 
 api_moderate = Blueprint("api_moderate", __name__)
 
@@ -19,7 +19,7 @@ def delete_content():
     if int(content_id) == 0:
         return {"message": "Hey! You are doing that wrong! Don't delete the forum root please...",  "error": "id 0 not deleteable"}, 406
 
-    if permissions_checker(current_user, "moderate", "delete", content_id):
+    if helpers.permissions.permission_check(current_user, content_id, "moderate", "delete"):
         session = db.factory()
 
         parent_id = session.query(db.Content).filter_by(id=content_id).first()
@@ -44,7 +44,7 @@ def cut_content():
     if int(content_id) == 0:
         return {"message": "Hey! You are doing that wrong! Don't move the forum root please...",  "error": "id 0 not moveable"}, 406
 
-    if permissions_checker(current_user, "moderate", "move", content_id):
+    if helpers.permissions.permission_check(current_user, content_id, "moderate", "move"):
         cut_objects[current_user.email] = content_id
 
         return {"message": "success", "redirect": content_id}, 200
@@ -70,7 +70,7 @@ def paste_content():
 
     content_type = session.query(db.Content).filter_by(id=content_id).first()["type"]
 
-    if permissions_checker(current_user, "create", content_type, target_id):
+    if helpers.permissions.permission_check(current_user, target_id, "create", content_type):
         session.query(db.Content).filter_by(id=content_id).first().location = target_id
 
         session.commit()
@@ -93,7 +93,7 @@ def edit():
     else:
         new_content = None
 
-    if not permissions_checker(current_user, "moderate", "edit", content_id):
+    if not helpers.permissions.permission_check(current_user, content_id, "moderate", "edit"):
         return {"error": "missing permissions"}, 403
 
     session = db.factory()

routes/permissions.py

@@ -4,18 +4,18 @@
 from flask import Blueprint, request
 from flask_login import login_required, current_user
 
+import helpers.permissions
 from crossdomain import crossdomain
 from globals import app
-from statics import db
-from statics.helpers import permissions_checker
+from helpers import db
 
 api_permissions = Blueprint("api_permissions", __name__)
 
 @crossdomain(origin="*", current_app=app)
 @api_permissions.route("/api/permission/user_add_group/")
 @login_required
 def user_add_group():
-    if not permissions_checker(current_user, "groups", "add"):
+    if not helpers.permissions.permission_check(current_user, 0, "groups", "add"):
         return flask.abort(flask.Response(status=401, response="You are not permitted to do that."))
 
     data = request.args
@@ -44,7 +44,7 @@ def user_add_group():
 @api_permissions.route("/api/permission/user_remove_group/")
 @login_required
 def user_remove_group():
-    if not permissions_checker(current_user, "groups", "remove"):
+    if not helpers.permissions.permission_check(current_user, 0, "groups", "remove"):
         return flask.abort(flask.Response(status=401, response="You are not permitted to do that."))
 
     data = request.args

routes/user.py

@@ -26,7 +26,7 @@ def get_id(self):
 
 from crossdomain import crossdomain
 from globals import app
-from statics.forms import LoginForm, RegisterForm
+from helpers.forms import LoginForm, RegisterForm
 
 user_management = Blueprint("user", __name__)