Return a string made for indexing roles having :any:`READ`
        permission on this object.
963414
def _indexable_roles_and_users(self):
        """"""
        from abilian.services.indexing import indexable_role
        from abilian.services.security import READ, Admin, Anonymous, Creator, Owner
        from abilian.services import get_service

        result = []
        security = get_service("security")

        # roles - required to match when user has a global role
        assignments = security.get_permissions_assignments(permission=READ, obj=self)
        allowed_roles = assignments.get(READ, set())
        allowed_roles.add(Admin)

        for r in allowed_roles:
            result.append(indexable_role(r))

        for role, attr in ((Creator, "creator"), (Owner, "owner")):
            if role in allowed_roles:
                user = getattr(self, attr)
                if user:
                    result.append(indexable_role(user))

        # users and groups
        principals = set()
        for user, role in security.get_role_assignements(self):
            if role in allowed_roles:
                principals.add(user)

        if Anonymous in principals:
            # it's a role listed in role assignments - legacy when there wasn't
            # permission-role assignments
            principals.remove(Anonymous)

        for p in principals:
            result.append(indexable_role(p))

        return " ".join(result)
750592
def check_read_permission(self, user_id, do_raise=True):
        
        return self.get_resource().check_read_permission(user_id, do_raise=do_raise)
556523
def indexable_role(principal):
    
    principal = unwrap(principal)

    if hasattr(principal, "is_anonymous") and principal.is_anonymous:
        # transform anonymous user to anonymous role
        principal = Anonymous

    if isinstance(principal, Role):
        return f"role:{principal.name}"
    elif isinstance(principal, User):
        fmt = "user:{:d}"
    elif isinstance(principal, Group):
        fmt = "group:{:d}"
    else:
        raise ValueError(repr(principal))

    return fmt.format(principal.id)
357655
def has_object_permission(checker_name, user, obj):
    """"""
    if user and user.is_superuser:
        return True

    checker = PermissionsManager.retrieve_checker(checker_name)
    user_roles = get_user_roles(user)

    if not user_roles:
        user_roles = [None]

    return any([checker(user_role, user, obj) for user_role in user_roles])
440501
def get_permissions(cls):
        
        perms = []
        for kls_name, kls in cls.registry.items():
            for method_name in cls.__dict__.keys():
                if method_name.endswith('_view'):
                    perms.append("%s.%s" % (kls_name, method_name))
        return perms
278204
def permissions(self):
        
        # TODO: optimize this, it's kind of a bad solution for listing a mostly
        # static set of files.
        # We could either add a permissions dict as an attribute or cache this
        # in some way. Creating a dict would be another place we have to define
        # the permission, so I'm not a huge fan, but it would definitely be the
        # easier option.
        permissions_dict = {"self": {}, "parent": {}}

        for field in self.properties._meta.get_fields():
            split_field = field.name.split('_', 1)
            if len(split_field) <= 0 or split_field[0] not in ['self', 'parent']:
                continue
            permissions_dict[split_field[0]][split_field[1]] = getattr(self.properties, field.name)

        return permissions_dict
26648
def accessibles(self, roles=None):
        
        return [org['slug']
                for org in self.get_accessibles(self.request, roles=roles)]
944968
def object_permission_set(self):
        ''''''
        return Or(
            AllowOnlySafeHttpMethod,
            AllowAdmin,
            And(
                AllowPermission('org:admin'),
                ObjAttrTrue(lambda _, u: not u.is_superuser),
                ObjAttrTrue(
                    lambda r, _: r.data.get('admin') is not True)
            ),
            And(
                AllowModify,
                ObjAttrTrue(
                    lambda req, user: user == req.user),
                ObjAttrTrue(
                    lambda r, _: r.data.get('admin') is not True)
            ),
        )
422422
def _get_role(rolename):
    """"""
    path = os.path.join('roles', rolename + '.json')
    if not os.path.exists(path):
        abort("Couldn't read role file {0}".format(path))
    with open(path, 'r') as f:
        try:
            role = json.loads(f.read())
        except ValueError as e:
            msg = "Little Chef found the following error in your"
            msg += " {0}.json file:\n  {1}".format(rolename, str(e))
            abort(msg)
        role['fullname'] = rolename
        return role
95499
def available_perm_status(user):
    
    roles = get_user_roles(user)
    permission_hash = {}

    for role in roles:
        permission_names = role.permission_names_list()

        for permission_name in permission_names:
            permission_hash[permission_name] = get_permission(
                permission_name) in user.user_permissions.all()

    return permission_hash
964490
def generate_permissions(urlpatterns, permissions={}):
    """"""
    for pattern in urlpatterns:
        if isinstance(pattern, urlresolvers.RegexURLPattern):
            perm = generate_perm_name(pattern.callback)
            if is_allowed_view(perm) and perm not in permissions:
                permissions[ACL_CODE_PREFIX + perm] = ACL_NAME_PREFIX + perm
        elif isinstance(pattern, urlresolvers.RegexURLResolver):
            generate_permissions(pattern.url_patterns, permissions)
    return permissions
529109
def _get_role_description(self, role):
        

        parameter = 'role-' + role.lower()
        if self.configure.has_parameter(parameter):
            return self.configure.get_parameter(parameter)
        return None
261445
def get_permissions(self, virtual_host):
        
        virtual_host = quote(virtual_host, '')
        return self.http_client.get(API_VIRTUAL_HOSTS_PERMISSION %
                                    (
                                        virtual_host
                                    ))
803131
def _checkPermissions(self, user, event):
        """"""

        for role in user.account.roles:
            if role in event.roles:
                self.log('Access granted', lvl=verbose)
                return True

        self.log('Access denied', lvl=verbose)
        return False
88835
def _get_permission_description(permission_name):
    

    parts = permission_name.split('_')
    parts.pop(0)
    method = parts.pop()
    resource = ('_'.join(parts)).lower()
    return 'Can %s %s' % (method.upper(), resource)
74178
def check_role_permissions(role, permissions, current_permissions):
    
    role_permissions = []

    # get all the current permissions, we'll remove these as we verify they should still be granted
    for permission in permissions:
        splits = permission.split(".")
        if len(splits) != 2 and len(splits) != 3:
            sys.stderr.write("  invalid permission %s, ignoring\n" % permission)
            continue

        app = splits[0]
        codenames = []

        if len(splits) == 2:
            codenames.append(splits[1])
        else:
            (object, action) = splits[1:]

            # if this is a wildcard, then query our database for all the permissions that exist on this object
            if action == '*':
                for perm in Permission.objects.filter(codename__startswith="%s_" % object, content_type__app_label=app):
                    codenames.append(perm.codename)
            # otherwise, this is an error, continue
            else:
                sys.stderr.write("  invalid permission %s, ignoring\n" % permission)
                continue

        if len(codenames) == 0:
            continue

        for codename in codenames:
            # the full codename for this permission
            full_codename = "%s.%s" % (app, codename)

            # this marks all the permissions which should remain
            role_permissions.append(full_codename)

            try:
                assign_perm(full_codename, role)
            except ObjectDoesNotExist:
                pass
                # sys.stderr.write("  unknown permission %s, ignoring\n" % permission)

    # remove any that are extra
    for permission in current_permissions:
        if isinstance(permission, str):
            key = permission
        else:
            key = "%s.%s" % (permission.content_type.app_label, permission.codename)

        if key not in role_permissions:
            remove_perm(key, role)
188216
def getPermissionText(self, t, m):
        '''
        
        '''
        try:
            return self.rights[t][m]['TEXT']
        except KeyError:
            raise CommandExecutionError((
                'No right "{0}".  It should be one of the following:  {1}')
                .format(m, ', '.join(self.rights[t])))