],

from vigigraph.lib import app_globals, helpers 

base_config = AppConfig()

base_config.model = vigigraph.model

base_config.DBSession = vigigraph.model.DBSession

base_config.sa_auth.group_class = model.Group

    :param global_conf: The global settings for vigigraph (those

        defined under the ``[DEFAULT]`` section).

    :type global_conf: dict

    :param full_stack: Should the whole TG2 stack be set up?

    :type full_stack: str or bool

    :return: The vigigraph application with all the relevant middleware

        loaded.

    ``app_conf`` contains all the application-specific settings (those defined

    under ``[app:main]``.

    app = make_base_app(global_conf, full_stack=True, **app_conf)

    # Wrap your base TurboGears 2 application with custom middleware here

    @expose('vigigraph.templates.error')

from catwalk.tg2 import Catwalk

from vigigraph.controllers.secure import SecureController

    secc = SecureController()

    admin = Catwalk(model, DBSession)

    @expose('vigigraph.templates.index')

    @expose('vigigraph.templates.about')

    def about(self):

        """Handle the 'about' page."""

        return dict(page='about')

    @expose('vigigraph.templates.authentication')

    def auth(self):

        """Display some information about auth* on this application."""

        return dict(page='auth')

    @expose('vigigraph.templates.index')

    @require(predicates.has_permission('manage', msg=l_('Only for managers')))

    def manage_permission_only(self, **kw):

        """Illustrate how a page for managers only works."""

        return dict(page='managers stuff')

    @expose('vigigraph.templates.index')

    @require(predicates.is_user('editor', msg=l_('Only for the editor')))

    def editor_user_only(self, **kw):

        """Illustrate how a page exclusive for the editor works."""

        return dict(page='editor stuff')

    @expose('vigigraph.templates.login')

# -*- coding: utf-8 -*-

"""Sample controller with all its actions protected."""

from tg import expose, flash

from pylons.i18n import ugettext as _, lazy_ugettext as l_

from repoze.what.predicates import has_permission

#from dbsprockets.dbmechanic.frameworks.tg2 import DBMechanic

#from dbsprockets.saprovider import SAProvider

from vigigraph.lib.base import BaseController

#from vigigraph.model import DBSession, metadata

__all__ = ['SecureController']

class SecureController(BaseController):

    """Sample controller-wide authorization"""

    # The predicate that must be met for all the actions in this controller:

    allow_only = has_permission('manage',

                                msg=l_('Only for people with the "manage" permission'))

    @expose('vigigraph.templates.index')

    def index(self):

        """Let the user know that's visiting a protected controller."""

        flash(_("Secure Controller here"))

        return dict(page='index')

    @expose('vigigraph.templates.index')

    def some_where(self):

        """Let the user know that this action is protected too."""

        return dict(page='some_where')

from zope.sqlalchemy import ZopeTransactionExtension

from sqlalchemy.orm import scoped_session, sessionmaker

#from sqlalchemy import MetaData

from sqlalchemy.ext.declarative import declarative_base

# Global session manager: DBSession() returns the Thread-local

# session object appropriate for the current web request.

maker = sessionmaker(autoflush=True, autocommit=False,

                     extension=ZopeTransactionExtension())

DBSession = scoped_session(maker)

# Base class for all of our model classes: By default, the data model is

# defined with SQLAlchemy's declarative extension, but if you need more

# control, you can switch to the traditional method.

DeclarativeBase = declarative_base()

# There are two convenient ways for you to spare some typing.

# You can have a query property on all your model classes by doing this:

# DeclarativeBase.query = DBSession.query_property()

# Or you can use a session-aware mapper as it was used in TurboGears 1:

# DeclarativeBase = declarative_base(mapper=DBSession.mapper)

# Global metadata.

# The default metadata is the one from the declarative base.

metadata = DeclarativeBase.metadata

# If you have multiple databases with overlapping table names, you'll need a

# metadata for each database. Feel free to rename 'metadata2'.

#metadata2 = MetaData()

def init_model(engine):

    """Call me before using any of the tables or classes in the model."""

    DBSession.configure(bind=engine)

    # If you are using reflection to introspect your database and create

    # table objects for you, your tables must be defined and mapped inside

    # the init_model function, so that the engine is available if you

    # use the model outside tg2, you need to make sure this is called before

    # you use the model.

    #

    # See the following example:

    #global t_reflected

    #t_reflected = Table("Reflected", metadata,

    #    autoload=True, autoload_with=engine)

    #mapper(Reflected, t_reflected)

# Import your model modules here.

from vigigraph.model.auth import User, Group, Permission

# -*- coding: utf-8 -*-

"""

Auth* related model.

This is where the models used by :mod:`repoze.who` and :mod:`repoze.what` are

defined.

It's perfectly fine to re-use this definition in the vigigraph application,

though.

"""

import os

from datetime import datetime

import sys

try:

    from hashlib import sha1

except ImportError:

    sys.exit('ImportError: No module named hashlib\n'

             'If you are on python2.4 this library is not part of python. '

             'Please install it. Example: easy_install hashlib')

from sqlalchemy import Table, ForeignKey, Column

from sqlalchemy.types import Unicode, Integer, DateTime

from sqlalchemy.orm import relation, synonym

from vigigraph.model import DeclarativeBase, metadata, DBSession

__all__ = ['User', 'Group', 'Permission']

#{ Association tables

# This is the association table for the many-to-many relationship between

# groups and permissions. This is required by repoze.what.

group_permission_table = Table('tg_group_permission', metadata,

    Column('group_id', Integer, ForeignKey('tg_group.group_id',

        onupdate="CASCADE", ondelete="CASCADE")),

    Column('permission_id', Integer, ForeignKey('tg_permission.permission_id',

        onupdate="CASCADE", ondelete="CASCADE"))

)

# This is the association table for the many-to-many relationship between

# groups and members - this is, the memberships. It's required by repoze.what.

user_group_table = Table('tg_user_group', metadata,

    Column('user_id', Integer, ForeignKey('tg_user.user_id',

        onupdate="CASCADE", ondelete="CASCADE")),

    Column('group_id', Integer, ForeignKey('tg_group.group_id',

        onupdate="CASCADE", ondelete="CASCADE"))

)

#{ The auth* model itself

class Group(DeclarativeBase):

    """

    Group definition for :mod:`repoze.what`.

    Only the ``group_name`` column is required by :mod:`repoze.what`.

    """

    __tablename__ = 'tg_group'

    #{ Columns

    group_id = Column(Integer, autoincrement=True, primary_key=True)

    group_name = Column(Unicode(16), unique=True, nullable=False)

    display_name = Column(Unicode(255))

    created = Column(DateTime, default=datetime.now)

    #{ Relations

    users = relation('User', secondary=user_group_table, backref='groups')

    #{ Special methods

    def __repr__(self):

        return '<Group: name=%s>' % self.group_name

    def __unicode__(self):

        return self.group_name

    #}

# The 'info' argument we're passing to the email_address and password columns

# contain metadata that Rum (http://python-rum.org/) can use generate an

# admin interface for your models.

class User(DeclarativeBase):

    """

    User definition.

    This is the user definition used by :mod:`repoze.who`, which requires at

    least the ``user_name`` column.

    """

    __tablename__ = 'tg_user'

    #{ Columns

    user_id = Column(Integer, autoincrement=True, primary_key=True)

    user_name = Column(Unicode(16), unique=True, nullable=False)

    email_address = Column(Unicode(255), unique=True, nullable=False,

                           info={'rum': {'field':'Email'}})

    display_name = Column(Unicode(255))

    _password = Column('password', Unicode(80),

                       info={'rum': {'field':'Password'}})

    created = Column(DateTime, default=datetime.now)

    #{ Special methods

    def __repr__(self):

        return '<User: email="%s", display name="%s">' % (

                self.email_address, self.display_name)

    def __unicode__(self):

        return self.display_name or self.user_name

    #{ Getters and setters

    @property

    def permissions(self):

        """Return a set of strings for the permissions granted."""

        perms = set()

        for g in self.groups:

            perms = perms | set(g.permissions)

        return perms

    @classmethod

    def by_email_address(cls, email):

        """Return the user object whose email address is ``email``."""

        return DBSession.query(cls).filter(cls.email_address==email).first()

    @classmethod

    def by_user_name(cls, username):

        """Return the user object whose user name is ``username``."""

        return DBSession.query(cls).filter(cls.user_name==username).first()

    def _set_password(self, password):

        """Hash ``password`` on the fly and store its hashed version."""

        hashed_password = password

        if isinstance(password, unicode):

            password_8bit = password.encode('UTF-8')

        else:

            password_8bit = password

        salt = sha1()

        salt.update(os.urandom(60))

        hash = sha1()

        hash.update(password_8bit + salt.hexdigest())

        hashed_password = salt.hexdigest() + hash.hexdigest()

        # Make sure the hashed password is an UTF-8 object at the end of the

        # process because SQLAlchemy _wants_ a unicode object for Unicode

        # columns

        if not isinstance(hashed_password, unicode):

            hashed_password = hashed_password.decode('UTF-8')

        self._password = hashed_password

    def _get_password(self):

        """Return the hashed version of the password."""

        return self._password

    password = synonym('_password', descriptor=property(_get_password,

                                                        _set_password))

    #}

    def validate_password(self, password):

        """

        Check the password against existing credentials.

        :param password: the password that was provided by the user to

            try and authenticate. This is the clear text version that we will

            need to match against the hashed one in the database.

        :type password: unicode object.

        :return: Whether the password is valid.

        :rtype: bool

        """

        hashed_pass = sha1()

        hashed_pass.update(password + self.password[:40])

        return self.password[40:] == hashed_pass.hexdigest()

class Permission(DeclarativeBase):

    """

    Permission definition for :mod:`repoze.what`.

    Only the ``permission_name`` column is required by :mod:`repoze.what`.

    """

    __tablename__ = 'tg_permission'

    #{ Columns

    permission_id = Column(Integer, autoincrement=True, primary_key=True)

    permission_name = Column(Unicode(16), unique=True, nullable=False)

    description = Column(Unicode(255))

    #{ Relations

    groups = relation(Group, secondary=group_permission_table,

                      backref='permissions')

    #{ Special methods

    def __repr__(self):

        return '<Permission: name=%s>' % self.permission_name

    def __unicode__(self):

        return self.permission_name

    #}

#}

def setup_app(command, conf, vars):

    model.metadata.create_all(bind=config['pylons.app_globals'].sa_engine)

    manager.display_name = u'Example manager'

    manager.email_address = u'manager@somedomain.com'

    manager.password = u'managepass'

    group = model.Group()

    group.display_name = u'Managers Group'

    permission.description = u'This permission give an administrative right to the bearer'

    permission.groups.append(group)

    editor.display_name = u'Example editor'

    editor.email_address = u'editor@somedomain.com'

    editor.password = u'editpass'

    model.DBSession.flush()