Oct 12, 2019 · Oct 11, 2019 · Oct 11, 2019 · Oct 11, 2019 · Oct 11, 2019 · Oct 11, 2019
diff --git a/demo/apps/apijson_demo/settings.ini b/demo/apps/apijson_demo/settings.ini
 }

 [APIJSON_REQUESTS]
 user = {
    "POST" :{
        "ADD":{"@role": "ADMIN"},
        "DISALLOW" : ["id"],
        "NECESSARY" : ["username","nickname"],
    },
    "PUT" :{
        "ADD":{"@role": "OWNER"},
        "NECESSARY" : ["id"],
    },
 }
 moment = {
    "POST" :{
        "ADD":{"@role": "OWNER"},
diff --git a/demo/apps/tables/settings.ini b/demo/apps/tables/settings.ini
 [APIJSON_TABLES]
 user = {
    "editable" : "auto",
 }
 moment = {
    "editable" : "auto",
    "table_fields" : [
diff --git a/tests/demo/apps/apijson_demo/dbinit.py b/tests/demo/apps/apijson_demo/dbinit.py
        "username": "admin",
        "nickname": "Administrator",
        "email": "admin@localhost",
        "date_join": "2018-1-1",
        "date_join": "2018-1-1 0:0:0",
    },
    {
        "username": "usera",
        "nickname": "User A",
        "email": "usera@localhost",
        "date_join": "2018-2-2",
        "date_join": "2018-2-2 0:0:0",
    },
    {
        "username": "userb",
        "nickname": "User B",
        "email": "userb@localhost",
        "date_join": "2018-3-3",
        "date_join": "2018-3-3 0:0:0",
    },
    {
        "username": "userc",
        "nickname": "User C",
        "email": "userc@localhost",
        "date_join": "2018-4-4",
        "date_join": "2018-4-4 0:0:0",
    },
 ]

diff --git a/tests/demo/apps/apijson_demo/settings.ini b/tests/demo/apps/apijson_demo/settings.ini
    "secret_fields" : ["password"],
    "GET" : { "roles" : ["LOGIN","ADMIN","OWNER"] },
    "HEAD" : { "roles" : ["LOGIN","ADMIN","OWNER"] },
    "POST" : { "roles" : ["ADMIN"] },
 #"POST" : { "roles" : ["ADMIN"] }, #remove for test case
    "PUT" : { "roles" : ["ADMIN","OWNER"] },
    "DELETE" : { "roles" : ["ADMIN"] },
 }
    "POST" :{
        "ADD" :{"@role": "OWNER"},
        "DISALLOW" : ["id"],
        "NECESSARY" : ["content"]
        "NECESSARY" : ["moment_id","content"]
    },
    "PUT" :{
        "ADD":{"@role": "OWNER"},
diff --git a/tests/test.py b/tests/test.py
diff --git a/uliweb_apijson/apijson/README.md b/uliweb_apijson/apijson/README.md

 # Difference with original apijson

 | feature  | apijson(java) | uliweb-apijson | comment                                                      |
 | -------- | ------------- | -------------- | ------------------------------------------------------------ |
 | @combine | ✔️             | ✖️              | Example:  "@combine":"&key0,&key1,\|key2,key3"               |
 | @expr    | ✖️             | ✔️              | Example:  "@expr":[["username$","&","email$"],"&",["!","nickname$"]] |
 | feature             | apijson(java)   | uliweb-apijson   | comment                                                      |
 | ------------------- | --------------- | ---------------- | ------------------------------------------------------------ |
 | @combine            | ✔️               | ✖️                | Example:  "@combine":"&key0,&key1,\|key2,key3"               |
 | @expr               | ✖️               | ✔️                | Example:  "@expr":[["username$","&","email$"],"&",["!","nickname$"]] |
 | tag in apijson post/put | "tag": "Moment" | "@tag": "Moment" |                                                              |



diff --git a/uliweb_apijson/apijson/__init__.py b/uliweb_apijson/apijson/__init__.py

        #@expr
        model_expr = params.get("@expr")
        if model_expr:
        if model_expr!=None:
            c = self.parent._expr(self.model,params,model_expr)
            q = q.filter(c)
        else:
                    del params[i]
                params.update(refs)
            q = self._get_array_q(params)
            q = q.limit(1)
            item[self.name] = self._get_info(q.one())
diff --git a/uliweb_apijson/apijson/templates/vue/inc_apijson_table.html b/uliweb_apijson/apijson/templates/vue/inc_apijson_table.html
        var thisp = this
        return {
            l_request_tag: null,
            role: "{{=role or ''}}",

            loading: false,
            modal_view: false,
                "@page":thisp.current_page-1,
                "@query":2
            }
            arr_params[thisp.model_name] = {
                "@order":thisp.sort_key+thisp.sort_order,
                "@role":"{{=role}}"
            var model_params = {
                "@order":thisp.sort_key+thisp.sort_order
            }
            if (thisp.role!="") {
                model_params["@role"] = thisp.role
            }
            arr_params[thisp.model_name] = model_params
            var params = {
                "[]":arr_params,
                "total@":"/[]/total"
                }
            }
            else {
                this.viewedit_items.push({title:"id",value:row.id,component:"input"})
                this.viewedit_items.push({key:"id",title:"id",value:row.id,component:"input"})
                var type2comp = {
                    "boolean":"checkbox"
                }
                for (var k in row){
                    if (k!="id" && k[0]!="_") {
                        var value = row[k]
                        var comp = type2comp[typeof value] || "input"
                        this.viewedit_items.push({title:k,value:value,component:comp})
                        this.viewedit_items.push({title:k,key:k,value:value,component:comp})
                    }
                }
            }
                    record_params[d.key] = d.value
                }
            }
            if (thisp.role!="") {
                record_params["@role"] = thisp.role
            }
            params[thisp.l_request_tag] = record_params
            params = thisp.ajax_hook("apijson_put","update",params)
            $.ajax({
            var params = {
                "@tag": thisp.l_request_tag
            }
 params[thisp.l_request_tag] = {
 var model_params = {
                "id": thisp.delete_params.row.id
            }
            if (thisp.role!="") {
                model_params["@role"] = thisp.role
            }
            params[thisp.l_request_tag] = model_params
            params = thisp.ajax_hook("apijson_delete","delete",params)
            $.ajax({
                type: "POST",
                var d = thisp.add_items[k]
                post_params[d.key] = d.value
            }
            if (thisp.role!="") {
                post_params["@role"] = thisp.role
            }
            params[this.l_request_tag] = post_params
            params = thisp.ajax_hook("apijson_post","add",params)
            $.ajax({
diff --git a/uliweb_apijson/apijson/templates/vue/inc_apijson_viewedit.html b/uliweb_apijson/apijson/templates/vue/inc_apijson_viewedit.html
    data: function(){
        return {
            l_request_tag: null,
            role: "{{=role}}",
            role: "{{=role or ''}}",
            row: {},
            row_saved: {},
            viewedit_items: [],
        init_viewedit: function(){
            var params = {}
            var model_params = {
                "id":this.id,
                "@role":this.role
                "id":this.id
            }
            if (this.role!='') {
                model_params["@role"] = this.role
            }
            params[this.model_name] = model_params
            var thisp = this
                    this.row[d.key] = d.value
                }
            }
            if (this.role!='') {
                record_params["@role"] = this.role
            }
            params[this.l_request_tag] = record_params
            params = this.ajax_hook("apijson_put","update",params)
            var thisp = this
diff --git a/uliweb_apijson/apijson/views.py b/uliweb_apijson/apijson/views.py
        roles = GET.get("roles")
        permission_check_ok = False
        if not params_role:
            if hasattr(request,"user"):
            if hasattr(request,"user") and request.user:
                params_role = "LOGIN"
            else:
                params_role = "UNKNOWN"
        elif params_role != "UNKNOWN":
            if not hasattr(request,"user"):
            if not(hasattr(request,"user") and request.user):
                return json({"code":400,"msg":"no login user for role '%s'"%(params_role)})
        if params_role not in roles:
            return json({"code":400,"msg":"'%s' not accessible by role '%s'"%(model_name,params_role)})

    def _expr(self,model,model_param,model_expr):
        if not isinstance(model_expr,list):
            raise UliwebError("only accept array in @expr: '%s'"%(model_expr))
            raise UliwebError("only accept array in @expr, but get '%s'"%(model_expr))
        num = len(model_expr)
        if (num<2 or num>3):
            raise UliwebError("only accept 2 or 3 items in @expr: '%s'"%(model_expr))
            raise UliwebError("only accept 2 or 3 items in @expr, but get '%s'"%(model_expr))
        op = model_expr[-2]
        if op=='&':
            if num!=3:
                raise UliwebError("'&'(and) expression need 3 items: '%s'"%(model_expr))
                raise UliwebError("'&'(and) expression need 3 items, but get '%s'"%(model_expr))
            c1 = self._get_filter_condition(model,model_param,model_expr[0],expr=True)
            c2 = self._get_filter_condition(model,model_param,model_expr[2],expr=True)
            return and_(c1,c2)
        elif op=='|':
            if num!=3:
                raise UliwebError("'|'(or) expression need 3 items: '%s'"%(model_expr))
                raise UliwebError("'|'(or) expression need 3 items, but get '%s'"%(model_expr))
            c1 = self._get_filter_condition(model,model_param,model_expr[0],expr=True)
            c2 = self._get_filter_condition(model,model_param,model_expr[2],expr=True)
            return or_(c1,c2)
        elif op=='!':
            if num!=2:
                raise UliwebError("'!'(not) expression need 2 items: '%s'"%(model_expr))
                raise UliwebError("'!'(not) expression need 2 items, but get '%s'"%(model_expr))
            return not_(self._get_filter_condition(model,model_param,model_expr[1],expr=True))
        else:
            raise UliwebError("unknown operator: '%s'"%(op))

    def _get_filter_condition(self,model,model_param,item,expr=False):
        #item can be param key, or expr which expected to be a list
        if isinstance(item,list):
            if expr:
                return self._expr(model,model_param,model_expr=item)
            else:
                raise UliwebError("item can be array only in @expr: '%s'"%(item))
                #current implementation won't run here, but keep for safe
                raise UliwebError("item can be list only in @expr: '%s'"%(item))
        if not isinstance(item,string_types):
            #current implementation won't run here, but keep for safe
            raise UliwebError("item should be array or string: '%s'"%(item))
        n = item
        if n[0]=="@":
            #current implementation won't run here, but keep for safe
            raise UliwebError("param key should not begin with @: '%s'"%(n))
        if n[-1]=="$":
            name = n[:-1]
            if hasattr(model,name):
                return getattr(model.c,name).like(model_param[n])
            else:
                raise UliwebError("'%s' does not have '%s'"%(model_name,name))
                raise UliwebError("model does not havethis column:'%s'"%(name))
        elif n[-1]=="}" and n[-2]=="{":
            name = n[:-2]
            if hasattr(model,name):
                # TODO
                # TODO: https://github.com/APIJSON/APIJSON/blob/master/Document.md#32-%E5%8A%9F%E8%83%BD%E7%AC%A6
                pass
            raise UliwebError("still not support '%s'"%(name))
        elif hasattr(model,n):
            return getattr(model.c,n)==model_param[n]
        else:
            raise UliwebError("not support item: '%s'"%(item))
            raise UliwebError("non-existent column ornot support item: '%s'"%(item))

    def head(self):
        try:
        roles = HEAD.get("roles")
        permission_check_ok = False
        if not params_role:
            if request.user:
            ifhasattr(request,"user") andrequest.user:
                params_role = "LOGIN"
            else:
                params_role = "UNKNOWN"
        if params_role not in roles:
            return json({"code":400,"msg":"'%s' notaccessible by role'%s'"%(model_name,params_role)})
            return json({"code":400,"msg":"role'%s' nothave permission HEAD for'%s'"%(params_role,model_name)})
        if params_role == "UNKNOWN":
            permission_check_ok = True
        elif not (hasattr(request,"user") and request.user):
            return json({"code":400,"msg":"no login user for role '%s'"%(params_role)})
        elif functions.has_role(request.user,params_role):
            permission_check_ok = True
        else:
            return json({"code":400,"msg":"user doesn't have role '%s'"%(params_role)})
        #current implementation won't run here, but keep for safe
        if not permission_check_ok:
            return json({"code":400,"msg":"no permission"})

            if roles:
                for role in roles:
                    if role == "OWNER":
                        if request.user:
                        ifhasattr(request,"user") andrequest.user:
                            permission_check_ok = True
                            if user_id_field:
                                params[user_id_field] = request.user.id
            if roles:
                for role in roles:
                    if role == "OWNER":
                        if request.user:
                        ifhasattr(request,"user") andrequest.user:
                            if user_id_field:
                                if obj.to_dict().get(user_id_field)==request.user.id:
                                    permission_check_ok = True
        for k in params:
            if k=="id":
                continue
            elif k[0]=="@":
                continue
            elif hasattr(obj,k):
                kwargs[k] = params[k]
            else:
            if roles:
                for role in roles:
                    if role == "OWNER":
                        if request.user:
                        ifhasattr(request,"user") andrequest.user:
                            if user_id_field:
                                if obj.to_dict().get(user_id_field)==request.user.id:
                                    permission_check_ok = True
Original file line number	Diff line number	Diff line change
Expand Up		@@ -31,6 +31,17 @@ comment = {
		}

		[APIJSON_REQUESTS]
		user = {
		"POST" :{
		"ADD":{"@role": "ADMIN"},
		"DISALLOW" : ["id"],
		"NECESSARY" : ["username","nickname"],
		},
		"PUT" :{
		"ADD":{"@role": "OWNER"},
		"NECESSARY" : ["id"],
		},
		}
		moment = {
		"POST" :{
		"ADD":{"@role": "OWNER"},
Expand Down
Original file line number	Diff line number	Diff line change
		@@ -1,4 +1,7 @@
		[APIJSON_TABLES]
		user = {
		"editable" : "auto",
		}
		moment = {
		"editable" : "auto",
		"table_fields" : [
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -15,25 +15,25 @@
		"username": "admin",
		"nickname": "Administrator",
		"email": "admin@localhost",
		"date_join": "2018-1-1",
		"date_join": "2018-1-1 0:0:0",
		},
		{
		"username": "usera",
		"nickname": "User A",
		"email": "usera@localhost",
		"date_join": "2018-2-2",
		"date_join": "2018-2-2 0:0:0",
		},
		{
		"username": "userb",
		"nickname": "User B",
		"email": "userb@localhost",
		"date_join": "2018-3-3",
		"date_join": "2018-3-3 0:0:0",
		},
		{
		"username": "userc",
		"nickname": "User C",
		"email": "userc@localhost",
		"date_join": "2018-4-4",
		"date_join": "2018-4-4 0:0:0",
		},
		]

Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -10,7 +10,7 @@ user = {
		"secret_fields" : ["password"],
		"GET" : { "roles" : ["LOGIN","ADMIN","OWNER"] },
		"HEAD" : { "roles" : ["LOGIN","ADMIN","OWNER"] },
		"POST" : { "roles" : ["ADMIN"] },
		#"POST" : { "roles" : ["ADMIN"] }, #remove for test case
		"PUT" : { "roles" : ["ADMIN","OWNER"] },
		"DELETE" : { "roles" : ["ADMIN"] },
		}
Expand DownExpand Up		@@ -63,7 +63,7 @@ comment = {
		"POST" :{
		"ADD" :{"@role": "OWNER"},
		"DISALLOW" : ["id"],
		"NECESSARY" : ["content"]
		"NECESSARY" : ["moment_id","content"]
		},
		"PUT" :{
		"ADD":{"@role": "OWNER"},
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -4,10 +4,11 @@ uliweb-apijson is a subset and slightly different variation of [apijson](https:/

		# Difference with original apijson

		\| feature \| apijson(java) \| uliweb-apijson \| comment \|
		\| -------- \| ------------- \| -------------- \| ------------------------------------------------------------ \|
		\| @combine \| ✔️ \| ✖️ \| Example: "@combine":"&key0,&key1,\\|key2,key3" \|
		\| @expr \| ✖️ \| ✔️ \| Example: "@expr":[["username$","&","email$"],"&",["!","nickname$"]] \|
		\| feature \| apijson(java) \| uliweb-apijson \| comment \|
		\| ------------------- \| --------------- \| ---------------- \| ------------------------------------------------------------ \|
		\| @combine \| ✔️ \| ✖️ \| Example: "@combine":"&key0,&key1,\\|key2,key3" \|
		\| @expr \| ✖️ \| ✔️ \| Example: "@expr":[["username$","&","email$"],"&",["!","nickname$"]] \|
		\| tag in apijson post/put \| "tag": "Moment" \| "@tag": "Moment" \| \|



Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -163,7 +163,7 @@ def _get_array_q(self,params):

		#@expr
		model_expr = params.get("@expr")
		if model_expr:
		if model_expr!=None:
		c = self.parent._expr(self.model,params,model_expr)
		q = q.filter(c)
		else:
Expand DownExpand Up		@@ -258,5 +258,4 @@ def associated_query_array(self):
		del params[i]
		params.update(refs)
		q = self._get_array_q(params)
		q = q.limit(1)
		item[self.name] = self._get_info(q.one())
Original file line number	Diff line number	Diff line change
Expand Up		@@ -53,6 +53,7 @@
		var thisp = this
		return {
		l_request_tag: null,
		role: "{{=role or ''}}",

		loading: false,
		modal_view: false,
Expand DownExpand Up		@@ -176,10 +177,13 @@
		"@page":thisp.current_page-1,
		"@query":2
		}
		arr_params[thisp.model_name] = {
		"@order":thisp.sort_key+thisp.sort_order,
		"@role":"{{=role}}"
		var model_params = {
		"@order":thisp.sort_key+thisp.sort_order
		}
		if (thisp.role!="") {
		model_params["@role"] = thisp.role
		}
		arr_params[thisp.model_name] = model_params
		var params = {
		"[]":arr_params,
		"total@":"/[]/total"
Expand DownExpand Up		@@ -253,15 +257,15 @@
		}
		}
		else {
		this.viewedit_items.push({title:"id",value:row.id,component:"input"})
		this.viewedit_items.push({key:"id",title:"id",value:row.id,component:"input"})
		var type2comp = {
		"boolean":"checkbox"
		}
		for (var k in row){
		if (k!="id" && k[0]!="_") {
		var value = row[k]
		var comp = type2comp[typeof value] \|\| "input"
		this.viewedit_items.push({title:k,value:value,component:comp})
		this.viewedit_items.push({title:k,key:k,value:value,component:comp})
		}
		}
		}
Expand DownExpand Up		@@ -297,6 +301,9 @@
		record_params[d.key] = d.value
		}
		}
		if (thisp.role!="") {
		record_params["@role"] = thisp.role
		}
		params[thisp.l_request_tag] = record_params
		params = thisp.ajax_hook("apijson_put","update",params)
		$.ajax({
Expand DownExpand Up		@@ -377,9 +384,13 @@
		var params = {
		"@tag": thisp.l_request_tag
		}
		params[thisp.l_request_tag] = {
		var model_params = {
		"id": thisp.delete_params.row.id
		}
		if (thisp.role!="") {
		model_params["@role"] = thisp.role
		}
		params[thisp.l_request_tag] = model_params
		params = thisp.ajax_hook("apijson_delete","delete",params)
		$.ajax({
		type: "POST",
Expand DownExpand Up		@@ -433,6 +444,9 @@
		var d = thisp.add_items[k]
		post_params[d.key] = d.value
		}
		if (thisp.role!="") {
		post_params["@role"] = thisp.role
		}
		params[this.l_request_tag] = post_params
		params = thisp.ajax_hook("apijson_post","add",params)
		$.ajax({
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -25,7 +25,7 @@
		data: function(){
		return {
		l_request_tag: null,
		role: "{{=role}}",
		role: "{{=role or ''}}",
		row: {},
		row_saved: {},
		viewedit_items: [],
Expand All		@@ -38,8 +38,10 @@
		init_viewedit: function(){
		var params = {}
		var model_params = {
		"id":this.id,
		"@role":this.role
		"id":this.id
		}
		if (this.role!='') {
		model_params["@role"] = this.role
		}
		params[this.model_name] = model_params
		var thisp = this
Expand DownExpand Up		@@ -89,6 +91,9 @@
		this.row[d.key] = d.value
		}
		}
		if (this.role!='') {
		record_params["@role"] = this.role
		}
		params[this.l_request_tag] = record_params
		params = this.ajax_hook("apijson_put","update",params)
		var thisp = this
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -112,12 +112,12 @@ def _get_one(self,key):
		roles = GET.get("roles")
		permission_check_ok = False
		if not params_role:
		if hasattr(request,"user"):
		if hasattr(request,"user") and request.user:
		params_role = "LOGIN"
		else:
		params_role = "UNKNOWN"
		elif params_role != "UNKNOWN":
		if not hasattr(request,"user"):
		if not(hasattr(request,"user") and request.user):
		return json({"code":400,"msg":"no login user for role '%s'"%(params_role)})
		if params_role not in roles:
		return json({"code":400,"msg":"'%s' not accessible by role '%s'"%(model_name,params_role)})
Expand DownExpand Up		@@ -200,57 +200,61 @@ def _filter_owner(self,model,model_setting,q):

		def _expr(self,model,model_param,model_expr):
		if not isinstance(model_expr,list):
		raise UliwebError("only accept array in @expr: '%s'"%(model_expr))
		raise UliwebError("only accept array in @expr, but get '%s'"%(model_expr))
		num = len(model_expr)
		if (num<2 or num>3):
		raise UliwebError("only accept 2 or 3 items in @expr: '%s'"%(model_expr))
		raise UliwebError("only accept 2 or 3 items in @expr, but get '%s'"%(model_expr))
		op = model_expr[-2]
		if op=='&':
		if num!=3:
		raise UliwebError("'&'(and) expression need 3 items: '%s'"%(model_expr))
		raise UliwebError("'&'(and) expression need 3 items, but get '%s'"%(model_expr))
		c1 = self._get_filter_condition(model,model_param,model_expr[0],expr=True)
		c2 = self._get_filter_condition(model,model_param,model_expr[2],expr=True)
		return and_(c1,c2)
		elif op=='\|':
		if num!=3:
		raise UliwebError("'\|'(or) expression need 3 items: '%s'"%(model_expr))
		raise UliwebError("'\|'(or) expression need 3 items, but get '%s'"%(model_expr))
		c1 = self._get_filter_condition(model,model_param,model_expr[0],expr=True)
		c2 = self._get_filter_condition(model,model_param,model_expr[2],expr=True)
		return or_(c1,c2)
		elif op=='!':
		if num!=2:
		raise UliwebError("'!'(not) expression need 2 items: '%s'"%(model_expr))
		raise UliwebError("'!'(not) expression need 2 items, but get '%s'"%(model_expr))
		return not_(self._get_filter_condition(model,model_param,model_expr[1],expr=True))
		else:
		raise UliwebError("unknown operator: '%s'"%(op))

		def _get_filter_condition(self,model,model_param,item,expr=False):
		#item can be param key, or expr which expected to be a list
		if isinstance(item,list):
		if expr:
		return self._expr(model,model_param,model_expr=item)
		else:
		raise UliwebError("item can be array only in @expr: '%s'"%(item))
		#current implementation won't run here, but keep for safe
		raise UliwebError("item can be list only in @expr: '%s'"%(item))
		if not isinstance(item,string_types):
		#current implementation won't run here, but keep for safe
		raise UliwebError("item should be array or string: '%s'"%(item))
		n = item
		if n[0]=="@":
		#current implementation won't run here, but keep for safe
		raise UliwebError("param key should not begin with @: '%s'"%(n))
		if n[-1]=="$":
		name = n[:-1]
		if hasattr(model,name):
		return getattr(model.c,name).like(model_param[n])
		else:
		raise UliwebError("'%s' does not have '%s'"%(model_name,name))
		raise UliwebError("model does not havethis column:'%s'"%(name))
		elif n[-1]=="}" and n[-2]=="{":
		name = n[:-2]
		if hasattr(model,name):
		# TODO
		# TODO: https://github.com/APIJSON/APIJSON/blob/master/Document.md#32-%E5%8A%9F%E8%83%BD%E7%AC%A6
		pass
		raise UliwebError("still not support '%s'"%(name))
		elif hasattr(model,n):
		return getattr(model.c,n)==model_param[n]
		else:
		raise UliwebError("not support item: '%s'"%(item))
		raise UliwebError("non-existent column ornot support item: '%s'"%(item))

		def head(self):
		try:
Expand DownExpand Up		@@ -286,18 +290,21 @@ def _head(self,key):
		roles = HEAD.get("roles")
		permission_check_ok = False
		if not params_role:
		if request.user:
		ifhasattr(request,"user") andrequest.user:
		params_role = "LOGIN"
		else:
		params_role = "UNKNOWN"
		if params_role not in roles:
		return json({"code":400,"msg":"'%s' notaccessible by role'%s'"%(model_name,params_role)})
		return json({"code":400,"msg":"role'%s' nothave permission HEAD for'%s'"%(params_role,model_name)})
		if params_role == "UNKNOWN":
		permission_check_ok = True
		elif not (hasattr(request,"user") and request.user):
		return json({"code":400,"msg":"no login user for role '%s'"%(params_role)})
		elif functions.has_role(request.user,params_role):
		permission_check_ok = True
		else:
		return json({"code":400,"msg":"user doesn't have role '%s'"%(params_role)})
		#current implementation won't run here, but keep for safe
		if not permission_check_ok:
		return json({"code":400,"msg":"no permission"})

Expand DownExpand Up		@@ -381,7 +388,7 @@ def _post_one(self,key,tag):
		if roles:
		for role in roles:
		if role == "OWNER":
		if request.user:
		ifhasattr(request,"user") andrequest.user:
		permission_check_ok = True
		if user_id_field:
		params[user_id_field] = request.user.id
Expand DownExpand Up		@@ -500,7 +507,7 @@ def _put_one(self,key,tag):
		if roles:
		for role in roles:
		if role == "OWNER":
		if request.user:
		ifhasattr(request,"user") andrequest.user:
		if user_id_field:
		if obj.to_dict().get(user_id_field)==request.user.id:
		permission_check_ok = True
Expand DownExpand Up		@@ -535,6 +542,8 @@ def _put_one(self,key,tag):
		for k in params:
		if k=="id":
		continue
		elif k[0]=="@":
		continue
		elif hasattr(obj,k):
		kwargs[k] = params[k]
		else:
Expand DownExpand Up		@@ -621,7 +630,7 @@ def _delete_one(self,key,tag):
		if roles:
		for role in roles:
		if role == "OWNER":
		if request.user:
		ifhasattr(request,"user") andrequest.user:
		if user_id_field:
		if obj.to_dict().get(user_id_field)==request.user.id:
		permission_check_ok = True
Expand Down