Permissions for this workflow. Plays nice with
        :meth:`coaster.views.load_models` and
        :class:`coaster.sqlalchemy.PermissionMixin` to determine the available
        permissions to the current user.
761366
def permissions(self):
        
        perms = set(super(DocumentWorkflow, self).permissions())
        if g:
            if hasattr(g, 'permissions'):
                perms.update(g.permissions or [])
            if hasattr(self.document, 'permissions'):
                perms = self.document.permissions(current_auth.actor, perms)
        return perms
35187
def has_permission(self, user):
        
        return user.has_perm(
            self.model._meta.app_label + '.' + self.get_permission()
        )
830034
def _get_user_allowed_fields(self):
        
        model_name = self.Meta.model.__name__.lower()
        app_label = self.Meta.model._meta.app_label
        full_model_name = '%s.%s' % (app_label, model_name)
        permissions = self.cached_allowed_fields.get(full_model_name)

        if not permissions:
            permissions = FieldPermission.objects.filter(
                user_field_permissions__user=self.user,
                content_type__model=model_name,
                content_type__app_label=app_label
            )
            self.cached_allowed_fields[full_model_name] = permissions
        return permissions
540726
def users(self):
        
        return sa.orm.relationship(
            "User",
            secondary="users_resources_permissions",
            passive_deletes=True,
            passive_updates=True,
        )
1007956
def object_permission_set(self):
        '''
        
        '''
        return Or(
            AllowAdmin,
            AllowObjectPermission('team:admin'),
            AllowObjectPermission('org:admin', lambda t: t.organization_id),
            And(
                AllowOnlySafeHttpMethod,
                Or(
                    ObjAttrTrue(
                        lambda r, t: t.users.filter(pk=r.user.pk).exists()),
                    ObjAttrTrue(
                        lambda r, t: t.organization.users.filter(
                            pk=r.user.pk).exists())
                )
            )
        )
699954
def setup_default_permissions(session, instance):
    
    if instance not in session.new or not isinstance(instance, Entity):
        return

    if not current_app:
        # working outside app_context. Raw object manipulation
        return

    _setup_default_permissions(instance)
171799
def has_object_permission(self, request, view, obj):
        

        user = request.user

        if not user.is_superuser and not user.is_anonymous():
            valid = False
            try:
                ct = ContentType.objects.get_for_model(obj)
                fpm = FilterPermissionModel.objects.get(user=user,
                                                        content_type=ct)
                myq = QSerializer(base64=True).loads(fpm.filter)
                try:
                    myobj = obj.__class__.objects.filter(myq).distinct().get(pk=obj.pk)
                    if myobj:
                        valid = True
                except ObjectDoesNotExist:
                    valid = False
            except ObjectDoesNotExist:
                valid = True
            finally:
                return valid
        else:
            return True
292748
def _load_group_permissions(self):
        
        group_names = self._get_groups().get_group_names()

        perms = Permission.objects.filter(group__name__in=group_names)
        perms = perms.values_list('content_type__app_label', 'codename')
        perms = perms.order_by()

        self._group_permissions = set(["%s.%s" % (ct, name) for ct, name in perms])
621284
def get_permissions_description(view, method):
    
    if not hasattr(view, 'permission_classes'):
        return ''

    description = ''
    for permission_class in view.permission_classes:
        if permission_class == core_permissions.ActionsPermission:
            actions_perm_description = get_actions_permission_description(view, method)
            if actions_perm_description:
                description += '\n' + actions_perm_description if description else actions_perm_description
            continue
        perm_description = get_entity_description(permission_class)
        description += '\n' + perm_description if description else perm_description

    return '### Permissions:\n' + description if description else ''
446105
def find_permissions_view_menu(self, view_menu):
        
        return (
            self.get_session.query(self.permissionview_model)
            .filter_by(view_menu_id=view_menu.id)
            .all()
        )
910724
def has_object_permission(self, request, view, obj):
        """"""
        # admins can do anything
        if request.user.is_superuser:
            return True

        # `share` permission is required for editing permissions
        if 'permissions' in view.action:
            self.perms_map['POST'] = ['%(app_label)s.share_%(model_name)s']

        if view.action in ['add_data', 'remove_data']:
            self.perms_map['POST'] = ['%(app_label)s.add_%(model_name)s']

        if hasattr(view, 'get_queryset'):
            queryset = view.get_queryset()
        else:
            queryset = getattr(view, 'queryset', None)

        assert queryset is not None, (
            'Cannot apply DjangoObjectPermissions on a view that '
            'does not set `.queryset` or have a `.get_queryset()` method.'
        )

        model_cls = queryset.model
        user = request.user

        perms = self.get_required_object_permissions(request.method, model_cls)

        if not user.has_perms(perms, obj) and not AnonymousUser().has_perms(perms, obj):
            # If the user does not have permissions we need to determine if
            # they have read permissions to see 403, or not, and simply see
            # a 404 response.

            if request.method in permissions.SAFE_METHODS:
                # Read permissions already checked and failed, no need
                # to make another lookup.
                raise Http404

            read_perms = self.get_required_object_permissions('GET', model_cls)
            if not user.has_perms(read_perms, obj):
                raise Http404

            # Has read permissions.
            return False

        return True
447738
def check_permissions(self, request):
        
        obj = (
            hasattr(self, 'get_controlled_object') and self.get_controlled_object() or
            hasattr(self, 'get_object') and self.get_object() or getattr(self, 'object', None)
        )
        user = request.user

        # Get the permissions to check
        perms = self.get_required_permissions(self)

        # Check permissions
        has_permissions = self.perform_permissions_check(user, obj, perms)

        if not has_permissions and not user.is_authenticated:
            return HttpResponseRedirect('{}?{}={}'.format(
                resolve_url(self.login_url),
                self.redirect_field_name,
                urlquote(request.get_full_path())
            ))
        elif not has_permissions:
            raise PermissionDenied
1169452
def perform_permissions_check(self, user, obj, perms):
        
        return self.request.forum_permission_handler.can_approve_posts(obj, user)
631612
def get_required_permissions(self, request):
        
        perms = []

        if not self.permission_required:
            return perms

        if isinstance(self.permission_required, string_types):
            perms = [self.permission_required, ]
        elif isinstance(self.permission_required, Iterable):
            perms = [perm for perm in self.permission_required]
        else:
            raise ImproperlyConfigured(
                '\'PermissionRequiredMixin\' requires \'permission_required\' '
                'attribute to be set to \'<app_label>.<permission codename>\' but is set to {} '
                'instead'.format(self.permission_required)
            )
        return perms
188486
def find_permission(self, name):
        
        return (
            self.get_session.query(self.permission_model).filter_by(name=name).first()
        )
1132332
def has_permission(self, request):
        """"""
        if not self.object and not self.permission:
            return True

        if not self.permission:
            return request.user.has_perm('{}_{}'.format(
                self.model_permission,
                self.object.__class__.__name__.lower()), self.object
            )

        return request.user.has_perm(self.permission)
199765
def direct_perms_for_user(cls, instance, user, db_session=None):
        
        db_session = get_db_session(db_session, instance)
        query = db_session.query(
            cls.models_proxy.UserResourcePermission.user_id,
            cls.models_proxy.UserResourcePermission.perm_name,
        )
        query = query.filter(cls.models_proxy.UserResourcePermission.user_id == user.id)
        query = query.filter(
            cls.models_proxy.UserResourcePermission.resource_id == instance.resource_id
        )

        perms = [
            PermissionTuple(user, row.perm_name, "user", None, instance, False, True)
            for row in query
        ]

        # include all perms if user is the owner of this resource
        if instance.owner_user_id == user.id:
            perms.append(
                PermissionTuple(user, ALL_PERMISSIONS, "user", None, instance, True)
            )
        return perms