update: Rewrite permissions

@sylvain Done, here's how it works:

• On djangoldp Model.Meta.
• permission_classes is not mandatory anymore if not provided it'll be LDPPermissions.
• By default, no one have any right.
• Model.Meta now have anonymous_perms, authenticated_perms, owner_perms
• anonymous_perms, authenticated_perms and owner_perms can have view, add, change, control, or delete
• They can also have inherit - that is activated by default. Owner inherit from Auth who inherit from Anons.

egs. :

class EveryoneCanRead(Model):
    class Meta:
        anonymous_perms = ['view']
# Because default owner & auth are inherit.

class NoOneCanUseMe(Model):
    class Meta:

class AuthOnly(Model):
    class Meta:
        anonymous_perms = []
        authenticated_perms = ['view', 'add']
        owner_perms = ['inherit', 'change', 'control', 'delete']

class Notifications(Model):
    class Meta:
        anonymous_perms = ['add']
        authenticated_perms = []
        owner_perms = ['view', 'change']

class OhNoOwnerCantRead(Model):
    class Meta:
        anonymous_perms = ['view']
        authenticated_perms = ['inherit', 'add']
        owner_perms = ['change', 'control', 'delete']
# I supposed this is bad, but we don't want to always inherit permissions..?

Also, you can still overload it if you need more precise permissions (Member of a project for example)

@bleme If you can take a look too.

added CheckValid Proposition labels

Aaaaand pipeline failed because I missed tests. I'll rewrite them tomorrow.

You can still have a look. ;-)

changed the description

added 1 commit

• 329e2185 - update: Add tests & correct default permissions

Compare with previous version

So, I correct tests. But I'll need one of you @bleme or @sylvain for anonymous tests.

On tests files, it always return 201. But with curl, it works as intended.

>>> request = self.factory.post('/job-offers/', json.dumps(data), content_type='application/ld+json')
>>> my_view = LDPViewSet.as_view({'post': 'create'}, model=JobOffer, nested_fields=["skills"])
>>> response = my_view(request, pk=1)
>>> response
<Response status_code=201, "text/html; charset=utf-8">

Even if I use a pk that I'm sure that it's not on.

>>> request = self.factory.post('/job-offers/', json.dumps(data), content_type='application/ld+json')
>>> my_view = LDPViewSet.as_view({'post': 'create'}, model=JobOffer, nested_fields=["skills"])
>>> response = my_view(request, pk=999)
>>> response
<Response status_code=201, "text/html; charset=utf-8">

If I ask him to render the response, it sounds like a nonsense:

>>> response.render()
<Response status_code=201, "application/ld+json">
>>> response.content
b'{"@id":"http://testserver/job-offers/None/","title":null,"skills":{"@id":"http://testserver/job-offers/None/skills/","@type":"ldp:Container","ldp:contains":[],"permissions":[{"mode":{"@type":"view"}}]},"recent_skills":{"@id":"http://happy-dev.fr/job-offers/None/recent_skills/","@type":"ldp:Container","ldp:contains":[],"permissions":[{"mode":{"@type":"view"}}]},"permissions":[{"mode":{"@type":"view"}}],"@context":{"@context":{"@vocab":"http://happy-dev.fr/owl/#","foaf":"http://xmlns.com/foaf/0.1/","doap":"http://usefulinc.com/ns/doap#","ldp":"http://www.w3.org/ns/ldp#","rdfs":"http://www.w3.org/2000/01/rdf-schema#","rdf":"http://www.w3.org/1999/02/22-rdf-syntax-ns#","xsd":"http://www.w3.org/2001/XMLSchema#","geo":"http://www.w3.org/2003/01/geo/wgs84_pos#","acl":"http://www.w3.org/ns/auth/acl#","name":"rdfs:label","website":"foaf:homepage","deadline":"xsd:dateTime","lat":"geo:lat","lng":"geo:long","jabberID":"foaf:jabberID","permissions":"acl:accessControl","mode":"acl:mode","view":"acl:Read","change":"acl:Write","add":"acl:Append","delete":"acl:Delete","control":"acl:Control"}}}'

But, with curl.

$ curl -d '{"title": "new idea"}' -H "Content-Type: application/ld+json" http://127.0.0.1:8000/job-offers/
{"detail":"Authentication credentials were not provided.","@context":"https://cdn.happy-dev.fr/owl/hdcontext.jsonld"}%

$ curl --request PATCH -H "Content-Type: application/ld+json" http://127.0.0.1:8000/job-offers/1/
{"detail":"Authentication credentials were not provided.","@context":"https://cdn.happy-dev.fr/owl/hdcontext.jsonld"}%

Model is exactly the same & requests too.

class JobOffer(Model):
    title = models.CharField(max_length=255, blank=True, null=True)
    skills = models.ManyToManyField(Skill, blank=True)
    slug = models.SlugField(blank=True, null=True, unique=True)
    date = models.DateTimeField(auto_now_add=True, blank=True)

    def recent_skills(self):
        return self.skills.filter(date__gte=date.today())

    class Meta:
        anonymous_perms = ['view']
        authenticated_perms = ['inherit', 'add']
        owner_perms = ['inherit', 'change', 'delete', 'control']
        nested_fields = ["skills"]
        serializer_fields = ["@id", "title", "skills", "recent_skills"]
        container_path = "job-offers/"
        lookup_field = 'slug'

Every other tests are fine.

The problem is that my_view.cls.permissions_classes doesn't contains LDPPermissions. It contains AllowAny

I fixed it.

Another way to avoid this kind of errors is to user self.client.[put|get|post] instead of building and calling the view manually. you have examples on other tests

By Jean-Baptiste on 2019-07-25T07:45:16 (imported from GitLab project)

added 1 commit

• e67821fe - update: fix test by setting LDPPermissions on views.permissions_classes

Compare with previous version

By Jean-Baptiste on 2019-07-25T07:42:44 (imported from GitLab project)

By the way, there's still 2 interesting tests commented.

Otherwise, very good work, I love the new permissions API! Well done.

By Jean-Baptiste on 2019-07-25T07:48:03 (imported from GitLab project)

added 1 commit

• a5aed3d6 - update: fix test model & rewrite test_user_permissions

Compare with previous version

added 1 commit

• 5f588062 - update: Fix tests - remove guardian from them

Compare with previous version

Everything's fine now.

@sylvain waiting for your review. If everything is ok for you too, we may inform everyone to update packages & merge.

changed the description

added 4 commits

• 5f588062...90655732 - 3 commits from branch master
• c1cc6a25 - Merge branch 'master' into 'jbpasquier/permissions'

Compare with previous version

Nice!

My idea was more to place the 3 lists in a permission class, but maybe your solution is better.

What happens if we only provide one of the 3 lists?

assigned to @bleme

@bleme I'm assigning this MR to you so that you can review what's been done

I've already done the review. It looks good for me.

By Jean-Baptiste on 2019-07-29T12:24:38 (imported from GitLab project)

closed

By Jean-Baptiste on 2019-07-29T12:24:57 (imported from GitLab project)

reopened

By Jean-Baptiste on 2019-07-29T12:25:51 (imported from GitLab project)

merged

By Jean-Baptiste on 2019-07-29T12:26:08 (imported from GitLab project)