Routeur: Ajout temporaire des modules workflow et dae en écriture

[auf_rh_dae.git] / project / decorators.py

# -*- encoding: utf-8 -*-
"""
Décorateurs AUF
"""
from django.core.cache import cache
from django.http import HttpResponseRedirect
from django.conf import settings
from django.contrib import messages
from django.contrib.auth import REDIRECT_FIELD_NAME
from django.db.models import Q
from django.utils.http import urlquote

from project import groups


def redirect_interdiction(request, msg=u"Vous n'avez pas accès à cette page"):
    """
    Redirection du la page de login avec un message d'erreur.
    """
    login_url = settings.LOGIN_URL
    path = urlquote(request.get_full_path())
    tup = login_url, REDIRECT_FIELD_NAME, path
    messages.add_message(
        request, messages.ERROR,
        "Votre compte ne permet pas d'accéder à cette partie de l'application."
    )
    return HttpResponseRedirect('%s?%s=%s' % tup)


def in_drh_or_admin(user):
    """
    Teste si un user Django fait parti du groupe DRH, DRH2 ou s'il est admin
    """
    key = "in_drh_or_admin_%s" % user.id
    granted = cache.get(key, None)
    if granted is not None:
        return granted

    user_groups = [g.name for g in user.groups.all()]
    if user.is_superuser or \
            groups.DRH_NIVEAU_1 in user_groups or \
            groups.DRH_NIVEAU_2 in user_groups:
        granted = True
    else:
        granted = False
    cache.set(key, granted)
    return granted


def drh_or_admin_required(fn):
    """
    Teste si un user Django fait parti du groupe DRH, DRH2 ou s'il est admin
    """
    def inner(request, *args, **kwargs):
        user = request.user
        if in_drh_or_admin(user):
            return fn(request, *args, **kwargs)

        msg = u"Votre compte ne permet pas d'accéder à " \
              u"cette partie de l'application."
        return redirect_interdiction(request, msg)

    return inner


def region_protected(model):
    def wrapper(func):
        def wrapped(request, id):
            if request.user.is_superuser:
                return func(request, id)
            user_groups = [g.name for g in request.user.groups.all()]
            if groups.DRH_NIVEAU_1 in user_groups or \
               groups.DRH_NIVEAU_2 in user_groups:
                return func(request, id)
            if groups.CORRESPONDANT_RH in user_groups or \
               groups.ADMINISTRATEURS in user_groups or \
               groups.DIRECTEUR_DE_BUREAU in user_groups:
                zones = groups.get_zones_from_user(request.user)
                qkey = '%s__in' % model.prefix_implantation
                q = Q(**{qkey: zones})
                qs = model.objects.filter(q)
                if int(id) in [o.id for o in qs]:
                    return func(request, id)
            return redirect_interdiction(request)
        return wrapped
    return wrapper


def in_one_of_group(groups):
    """
    Test si le user appartient au moins 1 des ces groupes
    """
    def wrapper(fn):
        def wrapped(request, *args, **kwargs):
            user_groups = [g.name for g in request.user.groups.all()]
            for g in user_groups:
                if g in groups:
                    return fn(request, *args, **kwargs)
            msg = u"Votre compte ne permet pas d'accéder "\
                  u"à cette partie de l'application."
            return redirect_interdiction(request, msg)
        return wrapped
    return wrapper