Updates to permissions

permissions are now returns as an object keyed by site_id
individual user requests include permissions
user/permission handlers take user_id to represent self.

nsot/decorators.py

@@ -4,7 +4,11 @@
 
 
 def _has_any_perm(user, site_id, perms):
-    permissions = user.get_permissions(site_id)
+    permissions = set(
+        user.get_permissions(site_id)
+            .get(site_id, {})
+            .get("permissions", [])
+    )
     for perm in perms:
         if perm in permissions:
             return True

nsot/handlers/api.py

@@ -1357,11 +1357,18 @@ def get(self, user_id):
                     "user": {
                         "id": 1
                         "email": "user@localhost"
+                        "permissions": {
+                            1: {
+                                "user_id": 1,
+                                "site_id": 1,
+                                "permissions": ["admin"]
+                            }
+                        }
                     }
                 }
             }
 
-        :param user_id: ID of the User to retrieve.
+        :param user_id: ID of the User to retrieve or 0 for self.
         :type user_id: int
 
         :reqheader X-NSoT-Email: required for all api requests.
@@ -1371,17 +1378,20 @@ def get(self, user_id):
         :statuscode 404: The Site at site_id was not found.
         """
 
-        user = self.session.query(models.User).filter_by(
-            id=user_id,
-        ).scalar()
+        if user_id == "0":
+            user = self.current_user
+        else:
+            user = self.session.query(models.User).filter_by(
+                id=user_id,
+            ).scalar()
 
         if not user:
             return self.notfound(
                 "No such User found at (id) = ({})".format(user_id)
             )
 
         self.success({
-            "user": user.to_dict(),
+            "user": user.to_dict(with_permissions=True),
         })
 
 class UserPermissionsHandler(ApiHandler):
@@ -1406,17 +1416,17 @@ def get(self, user_id):
             {
                 "status": "ok",
                 "data": {
-                    "permissions": [
-                        {
+                    "permissions": {
+                        1: {
                             "user_id": 1,
                             "site_id": 1,
                             "permissions": ["admin"]
                         }
-                    ]
+                    }
                 }
             }
 
-        :param user_id: ID of the User to retrieve.
+        :param user_id: ID of the User to retrieve or 0 for self.
         :type user_id: int
 
         :reqheader X-NSoT-Email: required for all api requests.
@@ -1426,21 +1436,24 @@ def get(self, user_id):
         :statuscode 404: The User was not found.
         """
 
-        user = self.session.query(models.User).filter_by(
-            id=user_id,
-        ).scalar()
+        if user_id == "0":
+            user = self.current_user
+        else:
+            user = self.session.query(models.User).filter_by(
+                id=user_id,
+            ).scalar()
 
         if not user:
             return self.notfound(
                 "No such User found at (id) = ({})".format(user_id)
             )
 
         permissions = self.session.query(models.Permission).filter_by(
-            user_id=user_id
+            user_id=user.id
         )
 
         self.success({
-            "permissions": [permission.to_dict() for permission in permissions],
+            "permissions": user.get_permissions(),
         })
 
 class UserPermissionHandler(ApiHandler):
@@ -1473,7 +1486,7 @@ def get(self, user_id, site_id):
                 }
             }
 
-        :param user_id: ID of the User
+        :param user_id: ID of the User or 0 for self.
         :type user_id: int
 
         :param site_id: ID of the Site
@@ -1486,7 +1499,12 @@ def get(self, user_id, site_id):
         :statuscode 404: The User or Site was not found.
         """
 
-        user = self.session.query(models.User).filter_by(id=user_id).scalar()
+        if user_id == "0":
+            user = self.current_user
+        else:
+            user = self.session.query(models.User).filter_by(
+                id=user_id,
+            ).scalar()
         if not user:
             return self.notfound("No such User found at (id) = ({})".format(user_id))
 
@@ -1495,13 +1513,13 @@ def get(self, user_id, site_id):
             return self.notfound("No such Site found at id {}".format(site_id))
 
         permission = self.session.query(models.Permission).filter_by(
-            user_id=user_id, site_id=site_id
+            user_id=user.id, site_id=site_id
         ).scalar()
 
         if not permission:
             return self.notfound(
                 "No such Permission found at (user_id, site_id) = ({})".format(
-                    user_id, site_id
+                    user.id, site_id
                 )
             )
 

nsot/models.py

@@ -197,25 +197,32 @@ def validate_email(self, key, value):
             raise exc.ValidationError("Must contain a valid e-mail address")
         return value
 
-    def to_dict(self):
-        return {
+    def to_dict(self, with_permissions=False):
+        out = {
             "id": self.id,
             "email": self.email,
         }
+        if with_permissions:
+            out["permissions"] = self.get_permissions()
+
+        return out
 
-    def get_permissions(self, site_id):
-        perm = self.session.query(Permission).filter_by(
-            site_id=site_id,
+    def get_permissions(self, site_id=None):
+        query = self.session.query(Permission).filter_by(
             user_id=self.id
-        ).scalar()
+        )
 
-        if perm is not None:
-            return set(perm.permissions)
+        if site_id is not None:
+            query = query.filter_by(site_id=site_id)
 
-        return set()
+        permissions = query.all()
 
-    def is_admin(self, site_id):
-        return get_permissions(site_id).has("admin")
+        return {
+            # JSON keys can't be ints so be consistent in
+            # python
+            str(permission.site_id): permission.to_dict()
+            for permission in permissions
+        }
 
 
 class Permission(Model):

tests/api_tests/test_permissions.py

@@ -20,7 +20,7 @@ def test_permissions(tornado_server):
 
     assert_success(
         user_client.get("/users/1/permissions"),
-        {"permissions": [{"permissions": ["admin"], "site_id": 1, "user_id": 1}]}
+        {"permissions": {"1": {"permissions": ["admin"], "site_id": 1, "user_id": 1}}}
     )
 
     assert_success(