geonode.security.utils

Attributes

logger
AdminViewPermissionsSet
ResourceGroupsAndMembersSet

Classes

AdvancedSecurityWorkflowManager

Functions

get_visible_resources(queryset, user[, request, ...])
get_users_with_perms(obj)	Override of the Guardian get_users_with_perms
perms_as_set(→ set)
get_resources_with_perms(user[, filter_options, ...])	Returns resources a user has access to.
get_geoapp_subtypes()	Returns a list of geoapp subtypes.
skip_registered_members_common_group(user_group)
get_user_groups(owner[, group])	Returns all the groups belonging to the "owner"
get_user_visible_groups(user[, include_public_invite])	Retrieves all the groups accordingly to the following conditions:

Module Contents

geonode.security.utils.logger

geonode.security.utils.get_visible_resources(queryset, user, request=None, metadata_only=False, admin_approval_required=False, unpublished_not_visible=False, private_groups_not_visibile=False)

geonode.security.utils.get_users_with_perms(obj)

Override of the Guardian get_users_with_perms

geonode.security.utils.perms_as_set(perm) → set

geonode.security.utils.get_resources_with_perms(user, filter_options={}, shortcut_kwargs={})

Returns resources a user has access to.

geonode.security.utils.get_geoapp_subtypes()

Returns a list of geoapp subtypes. Example [‘geostory’]

geonode.security.utils.skip_registered_members_common_group(user_group)

geonode.security.utils.get_user_groups(owner, group=None)

Returns all the groups belonging to the “owner”

geonode.security.utils.get_user_visible_groups(user, include_public_invite: bool = False)

Retrieves all the groups accordingly to the following conditions:

• The user is member of

• The group is public

geonode.security.utils.AdminViewPermissionsSet

geonode.security.utils.ResourceGroupsAndMembersSet

class geonode.security.utils.AdvancedSecurityWorkflowManager

static is_anonymous_can_view()

static is_anonymous_can_download()

static is_group_private_mode()

static is_manager_publish_mode()

static is_admin_moderate_mode()

static is_auto_publishing_workflow()

AUTO PUBLISHING

• RESOURCE_PUBLISHING = False

• ADMIN_MODERATE_UPLOADS = False

• When user creates a resource:

  • OWNER gets all the owner permissions (publish resource included)

  • ANONYMOUS can view and download

• No change to the Group Manager is applied

static is_simple_publishing_workflow()

SIMPLE PUBLISHING

• RESOURCE_PUBLISHING = True (Autopublishing is disabled)

• ADMIN_MODERATE_UPLOADS = False

• When user creates a resource:

  • OWNER gets all the owner permissions (publish_resource and change_resourcebase_permissions INCLUDED)

  • Group MANAGERS of the user’s groups will get the owner permissions (publish_resource EXCLUDED)

  • Group MEMBERS of the user’s groups will get the view_resourcebase, download_resourcebase permission

  • ANONYMOUS can not view and download if the resource is not published

• When resource has a group assigned:

  • OWNER gets all the owner permissions (publish_resource and change_resourcebase_permissions INCLUDED)

  • Group MANAGERS of the resource’s group will get the owner permissions (publish_resource EXCLUDED)

  • Group MEMBERS of the resource’s group will get the view_resourcebase, download_resourcebase permission

static is_advanced_workflow()

ADVANCED WORKFLOW

• RESOURCE_PUBLISHING = True

• ADMIN_MODERATE_UPLOADS = True

• When user creates a resource:

  • OWNER gets all the owner permissions (publish_resource and change_resourcebase_permissions EXCLUDED)

  • Group MANAGERS of the user’s groups will get the owner permissions (publish_resource INCLUDED)

  • Group MEMBERS of the user’s groups will get the view_resourcebase, download_resourcebase permission

  • ANONYMOUS can not view and download if the resource is not published

• When resource has a group assigned:

  • OWNER gets all the owner permissions (publish_resource and change_resourcebase_permissions EXCLUDED)

  • Group MANAGERS of the resource’s group will get the owner permissions (publish_resource INCLUDED)

  • Group MEMBERS of the resource’s group will get the view_resourcebase, download_resourcebase permission

static is_simplified_workflow()

SIMPLIFIED WORKFLOW

• RESOURCE_PUBLISHING = False

• ADMIN_MODERATE_UPLOADS = True

  Note

  Is it even possibile? when the resource is automatically published, can it be un-published?

  If this combination is not allowed, we should either stop the process when reading the settings or log a warning and force a safe combination.

• When user creates a resource:

  • OWNER gets all the owner permissions (publish_resource and change_resourcebase_permissions INCLUDED)

  • Group MANAGERS of the user’s groups will get the owner permissions (publish_resource INCLUDED)

  • Group MEMBERS of the user’s group will get the view_resourcebase, download_resourcebase permission

  • ANONYMOUS can view and download

static is_allowed_to_approve(user, resource)

static is_allowed_to_publish(user, resource)

static assignable_perm_condition(perm, resource_type)

static get_instance(uuid: str)

static compute_admin_and_view_permissions_set(uuid: str, /, instance=None) → AdminViewPermissionsSet

Returns a copy of the ADMIN_PERMISSIONS and VIEW_PERMISISONS of a resource accordinlgy to:

• The resource_type

• The resource_subtype

static compute_resource_groups_and_members_set(uuid: str, /, instance=None, group=None) → ResourceGroupsAndMembersSet

Returns a tuple containing:

• The “Anonymous” Group

• The “Registered Members” Group

• The “Groups” belonging to the Resource Owner

• The “managers” of the Groups affecting the Resource

• The “members” of the Groups affecting the Resource

static get_workflow_permissions(uuid: str, /, instance=None, perm_spec: dict = {'users': {}, 'groups': {}}, created: bool = False, approval_status_changed: bool = False, group_status_changed: bool = False) → dict

Adapts the provided “perm_spec” according to the following schema:

Publishing Workflow Schema

	RESOURCE_PUBLISHING	ADMIN_MODERATE_UPLOADS
AUTO PUBLISH	X	X
SIMPLE PUBLISHING	✓	X
SIMPLIFIED WORKFLOW	X	✓
ADVANCED WORKFLOW	✓	✓

General Rules:

• OWNER can never publish, except in the AUTO_PUBLISHING workflow.

• MANAGERS can always “publish” the resource.

• MEMBERS can always “view” and “download” the resource.

• When the OWNER is also a MANAGER, the MANAGER wins and can publish.

• Others, except in the AUTO_PUBLISHING workflow.

Approval and Publishing Schema

	N/PUBLISHED	PUBLISHED
N/APPROVED	GM/OWR
APPROVED	registered	all

Exceptions based on the enabled workflow:

• SIMPLIFIED WORKFLOW: If the resource is “approved” or “published”, OWNERS won’t be able to change the resource data and permissions.

• ADVANCED WORKFLOW: If the resource is “approved” or “published”, OWNERS won’t be able to change the resource data, metadata, and permissions.

static get_permissions(uuid: str, /, instance=None, permissions: dict = {}, created: bool = False, approval_status_changed: bool = False, group_status_changed: bool = False) → dict

Fix-ups the perm_spec accordingly to the enabled workflow (if any). For more details check the “get_workflow_permissions” method

static handle_moderated_uploads(uuid: str, /, instance=None) → object

static set_group_member_permissions(user, group, role)