361 lines
11 KiB
Python
361 lines
11 KiB
Python
"""
|
|
Classes used to model the roles used in the courseware. Each role is responsible for checking membership,
|
|
adding users, removing users, and listing members
|
|
"""
|
|
|
|
from abc import ABCMeta, abstractmethod
|
|
|
|
from django.contrib.auth.models import User
|
|
import logging
|
|
|
|
from student.models import CourseAccessRole
|
|
from xmodule_django.models import CourseKeyField
|
|
|
|
|
|
log = logging.getLogger(__name__)
|
|
|
|
# A list of registered access roles.
|
|
REGISTERED_ACCESS_ROLES = {}
|
|
|
|
|
|
def register_access_role(cls):
|
|
"""
|
|
Decorator that allows access roles to be registered within the roles module and referenced by their
|
|
string values.
|
|
|
|
Assumes that the decorated class has a "ROLE" attribute, defining its type.
|
|
|
|
"""
|
|
try:
|
|
role_name = getattr(cls, 'ROLE')
|
|
REGISTERED_ACCESS_ROLES[role_name] = cls
|
|
except AttributeError:
|
|
log.exception(u"Unable to register Access Role with attribute 'ROLE'.")
|
|
return cls
|
|
|
|
|
|
class RoleCache(object):
|
|
"""
|
|
A cache of the CourseAccessRoles held by a particular user
|
|
"""
|
|
def __init__(self, user):
|
|
self._roles = set(
|
|
CourseAccessRole.objects.filter(user=user).all()
|
|
)
|
|
|
|
def has_role(self, role, course_id, org):
|
|
"""
|
|
Return whether this RoleCache contains a role with the specified role, course_id, and org
|
|
"""
|
|
return any(
|
|
access_role.role == role and
|
|
access_role.course_id == course_id and
|
|
access_role.org == org
|
|
for access_role in self._roles
|
|
)
|
|
|
|
|
|
class AccessRole(object):
|
|
"""
|
|
Object representing a role with particular access to a resource
|
|
"""
|
|
__metaclass__ = ABCMeta
|
|
|
|
@abstractmethod
|
|
def has_user(self, user): # pylint: disable=unused-argument
|
|
"""
|
|
Return whether the supplied django user has access to this role.
|
|
"""
|
|
return False
|
|
|
|
@abstractmethod
|
|
def add_users(self, *users):
|
|
"""
|
|
Add the role to the supplied django users.
|
|
"""
|
|
pass
|
|
|
|
@abstractmethod
|
|
def remove_users(self, *users):
|
|
"""
|
|
Remove the role from the supplied django users.
|
|
"""
|
|
pass
|
|
|
|
@abstractmethod
|
|
def users_with_role(self):
|
|
"""
|
|
Return a django QuerySet for all of the users with this role
|
|
"""
|
|
return User.objects.none()
|
|
|
|
|
|
class GlobalStaff(AccessRole):
|
|
"""
|
|
The global staff role
|
|
"""
|
|
def has_user(self, user):
|
|
return user.is_staff
|
|
|
|
def add_users(self, *users):
|
|
for user in users:
|
|
if (user.is_authenticated() and user.is_active):
|
|
user.is_staff = True
|
|
user.save()
|
|
|
|
def remove_users(self, *users):
|
|
for user in users:
|
|
# don't check is_authenticated nor is_active on purpose
|
|
user.is_staff = False
|
|
user.save()
|
|
|
|
def users_with_role(self):
|
|
raise Exception("This operation is un-indexed, and shouldn't be used")
|
|
|
|
|
|
class RoleBase(AccessRole):
|
|
"""
|
|
Roles by type (e.g., instructor, beta_user) and optionally org, course_key
|
|
"""
|
|
def __init__(self, role_name, org='', course_key=None):
|
|
"""
|
|
Create role from required role_name w/ optional org and course_key. You may just provide a role
|
|
name if it's a global role (not constrained to an org or course). Provide org if constrained to
|
|
an org. Provide org and course if constrained to a course. Although, you should use the subclasses
|
|
for all of these.
|
|
"""
|
|
super(RoleBase, self).__init__()
|
|
|
|
self.org = org
|
|
self.course_key = course_key
|
|
self._role_name = role_name
|
|
|
|
def has_user(self, user):
|
|
"""
|
|
Return whether the supplied django user has access to this role.
|
|
"""
|
|
if not (user.is_authenticated() and user.is_active):
|
|
return False
|
|
|
|
# pylint: disable=protected-access
|
|
if not hasattr(user, '_roles'):
|
|
# Cache a list of tuples identifying the particular roles that a user has
|
|
# Stored as tuples, rather than django models, to make it cheaper to construct objects for comparison
|
|
user._roles = RoleCache(user)
|
|
|
|
return user._roles.has_role(self._role_name, self.course_key, self.org)
|
|
|
|
def add_users(self, *users):
|
|
"""
|
|
Add the supplied django users to this role.
|
|
"""
|
|
# silently ignores anonymous and inactive users so that any that are
|
|
# legit get updated.
|
|
from student.models import CourseAccessRole
|
|
for user in users:
|
|
if user.is_authenticated and user.is_active and not self.has_user(user):
|
|
entry = CourseAccessRole(user=user, role=self._role_name, course_id=self.course_key, org=self.org)
|
|
entry.save()
|
|
if hasattr(user, '_roles'):
|
|
del user._roles
|
|
|
|
def remove_users(self, *users):
|
|
"""
|
|
Remove the supplied django users from this role.
|
|
"""
|
|
entries = CourseAccessRole.objects.filter(
|
|
user__in=users, role=self._role_name, org=self.org, course_id=self.course_key
|
|
)
|
|
entries.delete()
|
|
for user in users:
|
|
if hasattr(user, '_roles'):
|
|
del user._roles
|
|
|
|
def users_with_role(self):
|
|
"""
|
|
Return a django QuerySet for all of the users with this role
|
|
"""
|
|
# Org roles don't query by CourseKey, so use CourseKeyField.Empty for that query
|
|
if self.course_key is None:
|
|
self.course_key = CourseKeyField.Empty
|
|
entries = User.objects.filter(
|
|
courseaccessrole__role=self._role_name,
|
|
courseaccessrole__org=self.org,
|
|
courseaccessrole__course_id=self.course_key
|
|
)
|
|
return entries
|
|
|
|
|
|
class CourseRole(RoleBase):
|
|
"""
|
|
A named role in a particular course
|
|
"""
|
|
def __init__(self, role, course_key):
|
|
"""
|
|
Args:
|
|
course_key (CourseKey)
|
|
"""
|
|
super(CourseRole, self).__init__(role, course_key.org, course_key)
|
|
|
|
@classmethod
|
|
def course_group_already_exists(self, course_key):
|
|
return CourseAccessRole.objects.filter(org=course_key.org, course_id=course_key).exists()
|
|
|
|
|
|
class OrgRole(RoleBase):
|
|
"""
|
|
A named role in a particular org independent of course
|
|
"""
|
|
def __init__(self, role, org):
|
|
super(OrgRole, self).__init__(role, org)
|
|
|
|
|
|
@register_access_role
|
|
class CourseStaffRole(CourseRole):
|
|
"""A Staff member of a course"""
|
|
ROLE = 'staff'
|
|
|
|
def __init__(self, *args, **kwargs):
|
|
super(CourseStaffRole, self).__init__(self.ROLE, *args, **kwargs)
|
|
|
|
|
|
@register_access_role
|
|
class CourseInstructorRole(CourseRole):
|
|
"""A course Instructor"""
|
|
ROLE = 'instructor'
|
|
|
|
def __init__(self, *args, **kwargs):
|
|
super(CourseInstructorRole, self).__init__(self.ROLE, *args, **kwargs)
|
|
|
|
|
|
@register_access_role
|
|
class CourseFinanceAdminRole(CourseRole):
|
|
"""A course staff member with privileges to review financial data."""
|
|
ROLE = 'finance_admin'
|
|
|
|
def __init__(self, *args, **kwargs):
|
|
super(CourseFinanceAdminRole, self).__init__(self.ROLE, *args, **kwargs)
|
|
|
|
|
|
@register_access_role
|
|
class CourseSalesAdminRole(CourseRole):
|
|
"""A course staff member with privileges to perform sales operations. """
|
|
ROLE = 'sales_admin'
|
|
|
|
def __init__(self, *args, **kwargs):
|
|
super(CourseSalesAdminRole, self).__init__(self.ROLE, *args, **kwargs)
|
|
|
|
|
|
@register_access_role
|
|
class CourseBetaTesterRole(CourseRole):
|
|
"""A course Beta Tester"""
|
|
ROLE = 'beta_testers'
|
|
|
|
def __init__(self, *args, **kwargs):
|
|
super(CourseBetaTesterRole, self).__init__(self.ROLE, *args, **kwargs)
|
|
|
|
|
|
@register_access_role
|
|
class LibraryUserRole(CourseRole):
|
|
"""
|
|
A user who can view a library and import content from it, but not edit it.
|
|
Used in Studio only.
|
|
"""
|
|
ROLE = 'library_user'
|
|
|
|
def __init__(self, *args, **kwargs):
|
|
super(LibraryUserRole, self).__init__(self.ROLE, *args, **kwargs)
|
|
|
|
|
|
class OrgStaffRole(OrgRole):
|
|
"""An organization staff member"""
|
|
def __init__(self, *args, **kwargs):
|
|
super(OrgStaffRole, self).__init__('staff', *args, **kwargs)
|
|
|
|
|
|
class OrgInstructorRole(OrgRole):
|
|
"""An organization instructor"""
|
|
def __init__(self, *args, **kwargs):
|
|
super(OrgInstructorRole, self).__init__('instructor', *args, **kwargs)
|
|
|
|
|
|
class OrgLibraryUserRole(OrgRole):
|
|
"""
|
|
A user who can view any libraries in an org and import content from them, but not edit them.
|
|
Used in Studio only.
|
|
"""
|
|
ROLE = LibraryUserRole.ROLE
|
|
|
|
def __init__(self, *args, **kwargs):
|
|
super(OrgLibraryUserRole, self).__init__(self.ROLE, *args, **kwargs)
|
|
|
|
|
|
@register_access_role
|
|
class CourseCreatorRole(RoleBase):
|
|
"""
|
|
This is the group of people who have permission to create new courses (we may want to eventually
|
|
make this an org based role).
|
|
"""
|
|
ROLE = "course_creator_group"
|
|
|
|
def __init__(self, *args, **kwargs):
|
|
super(CourseCreatorRole, self).__init__(self.ROLE, *args, **kwargs)
|
|
|
|
|
|
class UserBasedRole(object):
|
|
"""
|
|
Backward mapping: given a user, manipulate the courses and roles
|
|
"""
|
|
def __init__(self, user, role):
|
|
"""
|
|
Create a UserBasedRole accessor: for a given user and role (e.g., "instructor")
|
|
"""
|
|
self.user = user
|
|
self.role = role
|
|
|
|
def has_course(self, course_key):
|
|
"""
|
|
Return whether the role's user has the configured role access to the passed course
|
|
"""
|
|
if not (self.user.is_authenticated() and self.user.is_active):
|
|
return False
|
|
|
|
# pylint: disable=protected-access
|
|
if not hasattr(self.user, '_roles'):
|
|
self.user._roles = RoleCache(self.user)
|
|
|
|
return self.user._roles.has_role(self.role, course_key, course_key.org)
|
|
|
|
def add_course(self, *course_keys):
|
|
"""
|
|
Grant this object's user the object's role for the supplied courses
|
|
"""
|
|
if self.user.is_authenticated and self.user.is_active:
|
|
for course_key in course_keys:
|
|
entry = CourseAccessRole(user=self.user, role=self.role, course_id=course_key, org=course_key.org)
|
|
entry.save()
|
|
if hasattr(self.user, '_roles'):
|
|
del self.user._roles
|
|
else:
|
|
raise ValueError("user is not active. Cannot grant access to courses")
|
|
|
|
def remove_courses(self, *course_keys):
|
|
"""
|
|
Remove the supplied courses from this user's configured role.
|
|
"""
|
|
entries = CourseAccessRole.objects.filter(user=self.user, role=self.role, course_id__in=course_keys)
|
|
entries.delete()
|
|
if hasattr(self.user, '_roles'):
|
|
del self.user._roles
|
|
|
|
def courses_with_role(self):
|
|
"""
|
|
Return a django QuerySet for all of the courses with this user x role. You can access
|
|
any of these properties on each result record:
|
|
* user (will be self.user--thus uninteresting)
|
|
* org
|
|
* course_id
|
|
* role (will be self.role--thus uninteresting)
|
|
"""
|
|
return CourseAccessRole.objects.filter(role=self.role, user=self.user)
|