WuttaWeb 0.14.1__tar.gz → 0.15.0__tar.gz

{wuttaweb-0.14.1 → wuttaweb-0.15.0}/CHANGELOG.md

@@ -5,6 +5,24 @@ All notable changes to wuttaweb will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
+## v0.15.0 (2024-11-24)
+
+### Feat
+
+- add logic to prevent edit for some user accounts
+
+### Fix
+
+- fix default form value logic for bool checkbox fields
+- always use configured app dist for appinfo/index page
+
+## v0.14.2 (2024-11-24)
+
+### Fix
+
+- remove 'email' extra from wuttjamaican dependency
+- omit `id` attr when rendering hidden input for CSRF token
+
 ## v0.14.1 (2024-08-30)
 
 ### Fix

{wuttaweb-0.14.1 → wuttaweb-0.15.0}/PKG-INFO

@@ -1,13 +1,12 @@
 Metadata-Version: 2.3
 Name: WuttaWeb
-Version: 0.14.1
+Version: 0.15.0
 Summary: Web App for Wutta Framework
 Project-URL: Homepage, https://wuttaproject.org/
 Project-URL: Repository, https://forgejo.wuttaproject.org/wutta/wuttaweb
 Project-URL: Changelog, https://forgejo.wuttaproject.org/wutta/wuttaweb/src/branch/master/CHANGELOG.md
 Author-email: Lance Edgar <lance@edbob.org>
 License: GNU GPL v3+
-License-File: COPYING.txt
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Web Environment
 Classifier: Framework :: Pyramid
@@ -36,7 +35,7 @@ Requires-Dist: pyramid-tm
 Requires-Dist: pyramid>=2
 Requires-Dist: waitress
 Requires-Dist: webhelpers2
-Requires-Dist: wuttjamaican[db,email]>=0.13.2
+Requires-Dist: wuttjamaican[db]>=0.15.0
 Requires-Dist: zope-sqlalchemy>=1.5
 Provides-Extra: continuum
 Requires-Dist: wutta-continuum; extra == 'continuum'

{wuttaweb-0.14.1 → wuttaweb-0.15.0}/pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "WuttaWeb"
-version = "0.14.1"
+version = "0.15.0"
 description = "Web App for Wutta Framework"
 readme = "README.md"
 authors = [{name = "Lance Edgar", email = "lance@edbob.org"}]
@@ -42,7 +42,7 @@ dependencies = [
         "pyramid_tm",
         "waitress",
         "WebHelpers2",
-        "WuttJamaican[db,email]>=0.13.2",
+        "WuttJamaican[db]>=0.15.0",
         "zope.sqlalchemy>=1.5",
 ]
 

{wuttaweb-0.14.1 → wuttaweb-0.15.0}/src/wuttaweb/forms/base.py

@@ -1002,7 +1002,7 @@ class Form:
             # for now we explicitly translate here, ugh.  also
             # note this does not yet allow for null values.. :(
             if isinstance(field.typ, colander.Boolean):
-                value = True if field.typ.true_val else False
+                value = True if value == field.typ.true_val else False
 
             model_data[field.oid] = make_json_safe(value)
 

{wuttaweb-0.14.1 → wuttaweb-0.15.0}/src/wuttaweb/templates/appinfo/index.mako

@@ -8,10 +8,10 @@
     <div class="panel-block">
       <div style="width: 100%;">
         <b-field horizontal label="Distribution">
-          <span>${app.get_distribution(obj=app.get_web_handler()) or f'?? - set config for `{app.appname}.app_dist`'}</span>
+          <span>${app.get_distribution() or f'?? - set config for `{app.appname}.app_dist`'}</span>
         </b-field>
         <b-field horizontal label="Version">
-          <span>${app.get_version(obj=app.get_web_handler()) or f'?? - set config for `{app.appname}.app_dist`'}</span>
+          <span>${app.get_version() or f'?? - set config for `{app.appname}.app_dist`'}</span>
         </b-field>
         <b-field horizontal label="App Title">
           <span>${app.get_title()}</span>

{wuttaweb-0.14.1 → wuttaweb-0.15.0}/src/wuttaweb/templates/base.mako

@@ -661,7 +661,9 @@
               </a>
               ${h.end_form()}
           % endif
-          ${h.link_to("Change Password", url('change_password'), class_='navbar-item')}
+          % if request.is_root or not request.user.prevent_edit:
+              ${h.link_to("Change Password", url('change_password'), class_='navbar-item')}
+          % endif
           ${h.link_to("Logout", url('logout'), class_='navbar-item')}
         </div>
       </div>

{wuttaweb-0.14.1 → wuttaweb-0.15.0}/src/wuttaweb/util.py

@@ -473,7 +473,7 @@ def render_csrf_token(request, name='_csrf'):
     See also :func:`get_csrf_token()`.
     """
     token = get_csrf_token(request)
-    return HTML.tag('div', tags.hidden(name, value=token), style='display:none;')
+    return HTML.tag('div', tags.hidden(name, value=token, id=None), style='display:none;')
 
 
 def get_model_fields(config, model_class=None):

{wuttaweb-0.14.1 → wuttaweb-0.15.0}/src/wuttaweb/views/auth.py

@@ -157,6 +157,9 @@ class AuthView(View):
         if not self.request.user:
             return self.redirect(self.request.route_url('home'))
 
+        if self.request.user.prevent_edit:
+            raise self.forbidden()
+
         form = self.make_form(schema=self.change_password_make_schema(),
                               show_button_cancel=False,
                               show_button_reset=True)

{wuttaweb-0.14.1 → wuttaweb-0.15.0}/src/wuttaweb/views/users.py

@@ -95,6 +95,15 @@ class UserView(MasterView):
         if not user.active:
             return 'has-background-warning'
 
+    def is_editable(self, user):
+        """ """
+
+        # only root can edit certain users
+        if user.prevent_edit and not self.request.is_root:
+            return False
+
+        return True
+
     def configure_form(self, f):
         """ """
         super().configure_form(f)

{wuttaweb-0.14.1 → wuttaweb-0.15.0}/tests/views/test_auth.py

@@ -80,11 +80,18 @@ class TestAuthView(WebTestCase):
         redirect = view.change_password()
         self.assertIsInstance(redirect, HTTPFound)
 
-        # now "login" the user, and set initial password
-        self.request.user = barney
+        # set initial password
         auth.set_user_password(barney, 'foo')
         self.session.commit()
 
+        # forbidden if prevent_edit is set for user
+        self.request.user = barney
+        barney.prevent_edit = True
+        self.assertRaises(HTTPForbidden, view.change_password)
+
+        # okay let's test with edit allowed
+        barney.prevent_edit = False
+
         # view should now return context w/ form
         context = view.change_password()
         self.assertIn('form', context)

{wuttaweb-0.14.1 → wuttaweb-0.15.0}/tests/views/test_users.py

@@ -42,6 +42,26 @@ class TestUserView(WebTestCase):
         user.active = False
         self.assertEqual(view.grid_row_class(user, data, 1), 'has-background-warning')
 
+    def test_is_editable(self):
+        model = self.app.model
+        view = self.make_view()
+
+        # active user is editable
+        user = model.User(username='barney', active=True)
+        self.assertTrue(view.is_editable(user))
+
+        # inactive also editable
+        user = model.User(username='barney', active=False)
+        self.assertTrue(view.is_editable(user))
+
+        # but not if prevent_edit flag is set
+        user = model.User(username='barney', prevent_edit=True)
+        self.assertFalse(view.is_editable(user))
+
+        # unless request user is root
+        self.request.is_root = True
+        self.assertTrue(view.is_editable(user))
+
     def test_configure_form(self):
         model = self.app.model
         barney = model.User(username='barney')

{wuttaweb-0.14.1 → wuttaweb-0.15.0}/src/wuttaweb/views/essential.py

@@ -29,8 +29,8 @@ Most apps should include this module::
 
 That will in turn include the following modules:
 
-* :mod:`wuttaweb.views.auth`
 * :mod:`wuttaweb.views.common`
+* :mod:`wuttaweb.views.auth`
 * :mod:`wuttaweb.views.settings`
 * :mod:`wuttaweb.views.progress`
 * :mod:`wuttaweb.views.people`
@@ -43,8 +43,8 @@ That will in turn include the following modules:
 def defaults(config, **kwargs):
     mod = lambda spec: kwargs.get(spec, spec)
 
-    config.include(mod('wuttaweb.views.auth'))
     config.include(mod('wuttaweb.views.common'))
+    config.include(mod('wuttaweb.views.auth'))
     config.include(mod('wuttaweb.views.settings'))
     config.include(mod('wuttaweb.views.progress'))
     config.include(mod('wuttaweb.views.people'))