Repo-based permissions when adopting packages.

2 files changed, 15 insertions, 3 deletions

diff --git a/main/models.py b/main/models.py
index 9bdfbd06..89ffb916 100644
--- a/main/models.py
+++ b/main/models.py
@@ -30,6 +30,7 @@ class UserProfile(models.Model):
     picture = models.FileField(upload_to='devs', default='devs/silhouette.png')
     user = models.ForeignKey(
         User, related_name='userprofile_user', unique=True)
+    allowed_repos = models.ManyToManyField('Repo')
     class Meta:
         db_table = 'user_profiles'
         verbose_name = 'Additional Profile Data'
diff --git a/packages/views.py b/packages/views.py
index 835323fc..2ea444a6 100644
--- a/packages/views.py
+++ b/packages/views.py
@@ -24,13 +24,24 @@ def update(request):
         maint_id = 0
 
     if mode:
-        for id in ids:
-            pkg = Package.objects.get(id=id)
+        pkgs = Package.objects.filter(
+                id__in=ids,
+                repo__in=request.user.userprofile_user.all(
+                    )[0].allowed_repos.all())
+        disallowed_pkgs = Package.objects.filter(id__in=ids).exclude(
+                repo__in=request.user.userprofile_user.all(
+                    )[0].allowed_repos.all())
+        for pkg in pkgs:
             pkg.maintainer_id = maint_id
             pkg.save()
 
         request.user.message_set.create(message="%d packages %sed" % (
-            len(ids), mode))
+            len(pkgs), mode))
+        if disallowed_pkgs:
+            request.user.message_set.create(
+                    message="You do not have permmission to adopt: %s" % (
+                        ' '.join([p.pkgname for p in disallowed_pkgs])
+                        ))
     else:
         request.user.message_set.create(message="update called without adopt/disown")
     return HttpResponseRedirect('/packages/')