Merge pull request openwisp#60 from openwisp/permissions

[permissions] Improved patch openwisp#57

.travis.yml

@@ -43,6 +43,7 @@ install:
   # TODO: temporary, remove when django-netjsonconfig 0.9.0 is released
   - if [[ $TRAVIS_PYTHON_VERSION == "2.7" ]]; then pipenv install git+git://github.com/tinio/pysqlite.git@extension-enabled#egg=pysqlite; fi
   - pipenv run pip install https://github.com/openwisp/django-x509/tarball/master
+  - pipenv run pip install git+https://github.com/openwisp/openwisp-users.git
 
 script:
   # for some reason the migrations check is failing only on django 2.0

openwisp_controller/config/migrations/0015_default_groups_permissions.py

@@ -0,0 +1,50 @@
+from django.db import migrations
+from django.contrib.auth.models import Permission
+
+from ...migrations import create_default_permissions
+
+
+def assign_permissions_to_groups(apps, schema_editor):
+    create_default_permissions(apps, schema_editor)
+    Group = apps.get_model('openwisp_users', 'Group')
+    admin = Group.objects.get(name='Administrator')
+    operator = Group.objects.get(name='Operator')
+    operators_and_admins_can_change = ['device', 'config', 'template']
+    operators_read_only_admins_manage = ['vpn']
+    manage_operations = ['add', 'change', 'delete']
+
+    for model_name in operators_and_admins_can_change:
+        for operation in manage_operations:
+            permission = Permission.objects.get(
+                codename='{}_{}'.format(operation, model_name)
+            )
+            admin.permissions.add(permission.pk)
+            operator.permissions.add(permission.pk)
+
+    for model_name in operators_read_only_admins_manage:
+        try:
+            permission = Permission.objects.get(
+                codename="view_{}".format(model_name)
+            )
+            operator.permissions.add(permission.pk)
+        except Permission.DoesNotExist:
+            pass
+
+        for operation in manage_operations:
+            admin.permissions.add(
+                Permission.objects.get(codename="{}_{}".format(operation, model_name)).pk
+            )
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ('openwisp_users', '0004_default_groups'),
+        ('config', '0014_device_hardware_id'),
+    ]
+
+    operations = [
+        migrations.RunPython(
+            assign_permissions_to_groups,
+            reverse_code=migrations.RunPython.noop
+        ),
+    ]

openwisp_controller/geo/migrations/0002_default_groups_permissions.py

@@ -0,0 +1,34 @@
+from django.db import migrations
+from django.contrib.auth.models import Permission
+
+from ...migrations import create_default_permissions
+
+
+def assign_permissions_to_groups(apps, schema_editor):
+    create_default_permissions(apps, schema_editor)
+    Group = apps.get_model('openwisp_users', 'Group')
+    admin = Group.objects.get(name='Administrator')
+    operator = Group.objects.get(name='Operator')
+    operators_and_admins_can_change = ['location', 'floorplan', ]
+    manage_operations = ['add', 'change', 'delete']
+
+    for model_name in operators_and_admins_can_change:
+        for operation in manage_operations:
+            permission = Permission.objects.get(
+                codename='{}_{}'.format(operation, model_name)
+            )
+            admin.permissions.add(permission.pk)
+            operator.permissions.add(permission.pk)
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ('openwisp_users', '0004_default_groups'),
+        ('geo', '0001_initial')
+    ]
+    operations = [
+        migrations.RunPython(
+            assign_permissions_to_groups,
+            reverse_code=migrations.RunPython.noop
+        )
+    ]

openwisp_controller/migrations.py

@@ -0,0 +1,8 @@
+from django.contrib.auth.management import create_permissions
+
+
+def create_default_permissions(apps, schema_editor):
+    for app_config in apps.get_app_configs():
+        app_config.models_module = True
+        create_permissions(app_config, apps=apps, verbosity=0)
+        app_config.models_module = None

openwisp_controller/pki/migrations/0007_default_groups_permissions.py

@@ -0,0 +1,37 @@
+from django.db import migrations
+from django.contrib.auth.models import Permission
+
+from ...migrations import create_default_permissions
+
+
+def assign_permissions_to_groups(apps, schema_editor):
+    create_default_permissions(apps, schema_editor)
+    Group = apps.get_model('openwisp_users', 'Group')
+    admin = Group.objects.get(name='Administrator')
+    operator = Group.objects.get(name='Operator')
+    operators_read_only_admins_manage = ['ca', 'cert']
+    manage_operations = ['add', 'change', 'delete']
+
+    for model_name in operators_read_only_admins_manage:
+        try:
+            permission = Permission.objects.get(codename="view_{}".format(model_name))
+            operator.permissions.add(permission.pk)
+        except Permission.DoesNotExist:
+            pass
+        for operation in manage_operations:
+            admin.permissions.add(
+                Permission.objects.get(codename="{}_{}".format(operation, model_name)).pk
+            )
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ('openwisp_users', '0004_default_groups'),
+        ('pki', '0006_add_x509_passphrase_field'),
+    ]
+    operations = [
+            migrations.RunPython(
+                assign_permissions_to_groups,
+                reverse_code=migrations.RunPython.noop
+            )
+    ]

tests/settings.py

@@ -115,6 +115,8 @@
 EMAIL_PORT = '1025'  # for testing purposes
 LOGIN_REDIRECT_URL = 'admin:index'
 ACCOUNT_LOGOUT_REDIRECT_URL = LOGIN_REDIRECT_URL
+OPENWISP_ORGANIZATON_USER_ADMIN = True  # tests will fail without this setting
+OPENWISP_ORGANIZATON_OWNER_ADMIN = True  # tests will fail without this setting
 
 # during development only
 EMAIL_BACKEND = 'django.core.mail.backends.console.EmailBackend'