code-71d8025784d0/doc/.cvsignore0000644000000000000000000000047411052420374014265 0ustar 00000000000000announcement.html customizing.html developers.html implementation.html index.html installation.html user_guide.html FAQ.html security.html features.html upgrading.html glossary.html design.html admin_guide.html overview.html mysql.html postgresql.html tracker_templates.html whatsnew-0.7.html whatsnew-0.8.html *.ht code-71d8025784d0/doc/FAQ.txt0000644000000000000000000001374311052420374013440 0ustar 00000000000000=========== Roundup FAQ =========== :Version: $Revision: 1.23 $ .. contents:: Installation ------------ Living without a mailserver ~~~~~~~~~~~~~~~~~~~~~~~~~~~ Remove the nosy reactor - delete the tracker file ``detectors/nosyreactor.py`` from your tracker home. The cgi-bin is very slow! ~~~~~~~~~~~~~~~~~~~~~~~~~ Yep, it sure is. It has to start up Python and load all of the support libraries for *every* request. The solution is to use the built in server (or possibly the mod_python or WSGI support). To make Roundup more seamless with your website, you may place the built in server behind apache and link it into your web tree (see below). How do I put Roundup behind Apache ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ We have a project (foo) running on ``tracker.example:8080``. We want ``http://tracker.example/issues`` to use the roundup server, so we set that up on port 8080 on ``tracker.example`` with the ``config.ini`` line:: [tracker] ... web = 'http://tracker.example/issues/' We have a "foo_issues" tracker and we run the server with:: roundup-server -p 8080 issues=/home/roundup/trackers/issues Then, on the Apache machine (eg. redhat 7.3 with apache 1.3), in ``/etc/httpd/conf/httpd.conf`` uncomment:: LoadModule proxy_module modules/libproxy.so and:: AddModule mod_proxy.c Then add:: # roundup stuff (added manually) # proxy through one tracker ProxyPass /issues/ http://tracker.example:8080/issues/ # proxy through all tracker(*) #ProxyPass /roundup/ http://tracker.example:8080/ Then restart Apache. Now Apache will proxy the request on to the roundup-server. Note that if you're proxying multiple trackers, you'll need to use the second ProxyPass rule described above. It will mean that your TRACKER_WEB will change to:: TRACKER_WEB = 'http://tracker.example/roundup/issues/' Once you're done, you can firewall off port 8080 from the rest of the world. Note that in some situations (eg. virtual hosting) you might need to use a more complex rewrite rule instead of the simpler ProxyPass above. The following should be useful as a starting template:: # roundup stuff (added manually) RewriteEngine on # General Roundup RewriteRule ^/roundup$ roundup/ [R] RewriteRule ^/roundup/(.*)$ http://tracker.example:8080/$1 [P,L] # Handle Foo Issues RewriteRule ^/issues$ issues/ [R] RewriteRule ^/issues/(.*)$ http://tracker.example:8080/issues/$1 [P,L] How do I run Roundup through SSL (HTTPS)? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ You should proxy through apache and use its SSL service. See the previous question on how to proxy through apache. Roundup runs very slowly on my XP machine when accessed from the Internet ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The issue is probably related to host name resolution for the client performing the request. You can turn off the resolution of the names when it's so slow like this. To do so, edit the module roundup/scripts/roundup_server.py around line 77 to add the following to the RoundupRequestHandler class: def address_string(self): return self.client_address[0] Templates --------- What is that stuff in the tracker html directory? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This is the template code that Roundup uses to display the various pages. This is based upon the template markup language in Zope called, oddly enough "Zope Page Templates". There's documentation in the Roundup customisation_ documentation. For more information have a look at: http://www.zope.org/Documentation/Books/ZopeBook/2_6Edition/ specifically chapter 10 "Using Zope Page Templates" and chapter 14 "Advanced Page Templates". But I just want a select/option list for .... ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Really easy... edit ``html/issue.item``. For 'nosy', change line 53 from:: to:: For 'assigned to', change line 61 from:: assignedto menu to:: assignedto menu Great! But now the select/option list is too big ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Thats a little harder (but only a little ;^) Again, edit ``html/issue.item``. For nosy, change line 53 from: to:: for more information, go and read about Zope Page Templates. Using Roundup ------------- I got an error and I cant reload it! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ If you're using Netscape/Mozilla, try holding shift and pressing reload. If you're using IE then install Mozilla and try again ;^) I keep getting logged out ~~~~~~~~~~~~~~~~~~~~~~~~~ Make sure that the ``tracker`` -> ``web`` setting in your tracker's config.ini is set to the URL of the tracker. How is sorting performed, and why does it seem to fail sometimes? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ When we sort items in the hyperdb, we use one of a number of methods, depending on the properties being sorted on: 1. If it's a String, Number, Date or Interval property, we just sort the scalar value of the property. Strings are sorted case-sensitively. 2. If it's a Link property, we sort by either the linked item's "order" property (if it has one) or the linked item's "id". 3. Mulitlinks sort similar to #2, but we start with the first Multilink list item, and if they're the same, we sort by the second item, and so on. Note that if an "order" property is defined on a Class that is used for sorting, all items of that Class *must* have a value against the "order" property, or sorting will result in random ordering. ----------------- Back to `Table of Contents`_ .. _`Table of Contents`: index.html .. _`customisation`: customizing.html code-71d8025784d0/doc/Makefile0000644000000000000000000000120711052420374013720 0ustar 00000000000000STXTOHTML = rst2html STXTOHT = rst2ht.py WEBDIR = ../../htdocs/htdocs/doc-1.0 SOURCE = announcement.txt customizing.txt developers.txt FAQ.txt features.txt \ glossary.txt implementation.txt index.txt design.txt mysql.txt \ installation.txt upgrading.txt user_guide.txt admin_guide.txt \ postgresql.txt tracker_templates.txt xmlrpc.txt COMPILED := $(SOURCE:.txt=.html) WEBHT := $(SOURCE:.txt=.ht) all: html ht html: ${COMPILED} ht: ${WEBHT} website: ${WEBHT} cp *.ht ${WEBDIR} cp -r images ${WEBDIR} %.html: %.txt ${STXTOHTML} --report=warning -d $< $@ %.ht: %.txt ${STXTOHT} --report=warning -d $< $@ clean: rm -f ${COMPILED} code-71d8025784d0/doc/ZPL.txt0000644000000000000000000000447611052420374013501 0ustar 00000000000000Zope Public License (ZPL) Version 2.0 ----------------------------------------------- This software is Copyright (c) Zope Corporation (tm) and Contributors. All rights reserved. This license has been certified as open source. It has also been designated as GPL compatible by the Free Software Foundation (FSF). Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions in source code must retain the above copyright notice, this list of conditions, and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions, and the following disclaimer in the documentation and/or other materials provided with the distribution. 3. The name Zope Corporation (tm) must not be used to endorse or promote products derived from this software without prior written permission from Zope Corporation. 4. The right to distribute this software or to use it for any purpose does not give you the right to use Servicemarks (sm) or Trademarks (tm) of Zope Corporation. Use of them is covered in a separate agreement (see http://www.zope.com/Marks). 5. If any files are modified, you must cause the modified files to carry prominent notices stating that you changed the files and the date of any change. Disclaimer THIS SOFTWARE IS PROVIDED BY ZOPE CORPORATION ``AS IS'' AND ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL ZOPE CORPORATION OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. This software consists of contributions made by Zope Corporation and many individuals on behalf of Zope Corporation. Specific attributions are listed in the accompanying credits file. code-71d8025784d0/doc/admin_guide.txt0000644000000000000000000003273611052420374015301 0ustar 00000000000000==================== Administration Guide ==================== :Version: $Revision: 1.27 $ .. contents:: What does Roundup install? ========================== There's two "installations" that we talk about when using Roundup: 1. The installation of the software and its support files. This uses the standard Python mechanism called "distutils" and thus Roundup's core code, executable scripts and support data files are installed in Python's directories. On Windows, this is typically: Scripts ``\scripts\...`` Core code ``\lib\site-packages\roundup\...`` Support files ``\share\roundup\...`` and on Unix-like systems (eg. Linux): Scripts ``/bin/...`` Core code ``/lib-/site-packages/roundup/...`` Support files ``/share/roundup/...`` 2. The installation of a specific tracker. When invoking the roundup-admin "inst" (and "init") commands, you're creating a new Roundup tracker. This installs configuration files, HTML templates, detector code and a new database. You have complete control over where this stuff goes through both choosing your "tracker home" and the ``main`` -> ``database`` variable in the tracker's config.ini. Configuring Roundup's Logging of Messages For Sysadmins ======================================================= You may configure where Roundup logs messages in your tracker's config.ini file. Roundup will use the standard Python (2.3+) logging implementation when available. If not, then a very basic logging implementation will be used (see BasicLogging in the roundup.rlog module for details). Configuration for standard "logging" module: - tracker configuration file specifies the location of a logging configration file as ``logging`` -> ``config`` - ``roundup-server`` specifies the location of a logging configuration file on the command line Configuration for "BasicLogging" implementation: - tracker configuration file specifies the location of a log file ``logging`` -> ``filename`` - tracker configuration file specifies the level to log to as ``logging`` -> ``level`` - ``roundup-server`` specifies the location of a log file on the command line - ``roundup-server`` specifies the level to log to on the command line (``roundup-mailgw`` always logs to the tracker's log file) In both cases, if no logfile is specified then logging will simply be sent to sys.stderr with only logging of ERROR messages. Configuring roundup-server ========================== The basic configuration file layout is as follows (take from the ``roundup-server.ini.example`` file in the "doc" directory):: [main] port = 8080 ;hostname = ;user = ;group = ;log_ip = yes ;pidfile = ;logfile = ;template = ;ssl = no ;pem = [trackers] ; Add one of these per tracker being served name = /path/to/tracker/name Values ";commented out" are optional. The meaning of the various options are as follows: **port** Defines the local TCP port to listen for clients on. **hostname** Defines the local hostname to listen for clients on. Only required if "localhost" is not sufficient. **user** and **group** Defines the Unix user and group to run the server as. Only work if the server is started as root. **log_ip** If ``yes`` then we log IP addresses against accesses. If ``no`` then we log the hostname of the client. The latter can be much slower. **pidfile** If specified, the server will fork at startup and write its new PID to the file. **logfile** Any unhandled exception messages or other output from Roundup will be written to this file. It must be specified if **pidfile** is specified. If per-tracker logging is specified, then very little will be written to this file. **template** Specifies a template used for displaying the tracker index when multiple trackers are being used. The variable "trackers" is available to the template and is a dict of all configured trackers. **ssl** Enables the use of SSL to secure the connection to the roundup-server. If you enable this, ensure that your tracker's config.ini specifies an *https* URL. **pem** If specified, the SSL PEM file containing the private key and certificate. If not specified, roundup will generate a temporary, self-signed certificate for use. **trackers** section Each line denotes a mapping from a URL component to a tracker home. Make sure the name part doesn't include any url-unsafe characters like spaces. Stick to alphanumeric characters and you'll be ok. Users and Security ================== Roundup holds its own user database which primarily contains a username, password and email address for the user. Roundup *must* have its own user listing, in order to maintain internal consistency of its data. It is a relatively simple exercise to update this listing on a regular basis, or on demand, so that it matches an external listing (eg. unix passwd file, LDAP, etc.) Roundup identifies users in a number of ways: 1. Through the web, users may be identified by either HTTP Basic Authentication or cookie authentication. If you are running the web server (roundup-server) through another HTTP server (eg. apache or IIS) then that server may require HTTP Basic Authentication, and it will pass the ``REMOTE_USER`` variable through to Roundup. If this variable is not present, then Roundup defaults to using its own cookie-based login mechanism. 2. In email messages handled by roundup-mailgw, users are identified by the From address in the message. In both cases, Roundup's behaviour when dealing with unknown users is controlled by Permissions defined in the "SECURITY SETTINGS" section of the tracker's ``schema.py`` module: Web Registration If granted to the Anonymous Role, then anonymous users will be able to register through the web. Email Registration If granted to the Anonymous Role, then email messages from unknown users will result in those users being registered with the tracker. More information about how to customise your tracker's security settings may be found in the `customisation documentation`_. Tasks ===== Maintenance of Roundup can involve one of the following: 1. `tracker backup`_ 2. `software upgrade`_ 3. `migrating backends`_ 4. `moving a tracker`_ 5. `migrating from other software`_ 6. `adding a user from the command-line`_ Tracker Backup -------------- The roundup-admin import and export commands are **not** recommended for performing backup. Optionally stop the web and email frontends and to copy the contents of the tracker home directory to some other place using standard backup tools. This means using *pg_dump* to take a snapshot of your Postgres backend database, for example. A simple copy of the tracker home (and files storage area if you've configured it to be elsewhere) will then complete the backup. Software Upgrade ---------------- Always make a backup of your tracker before upgrading software. Steps you may take: 1. Ensure that the unit tests run on your system:: python run_tests.py 2. If you're using an RDBMS backend, make a backup of its contents now. 3. Make a backup of the tracker home itself. 4. Stop the tracker web and email frontends. 5. Follow the steps in the `upgrading documentation`_ for the new version of the software in the copied. Usually you will be asked to run `roundup_admin migrate` on your tracker before you allow users to start accessing the tracker. It's safe to run this even if it's not required, so just get into the habit. 6. You may test each of the admin tool, web interface and mail gateway using the new version of the software. To do this, invoke the scripts directly in the source directory with:: PYTHONPATH=. python roundup/scripts/roundup_server.py PYTHONPATH=. python roundup/scripts/roundup_admin.py PYTHONPATH=. python roundup/scripts/roundup_mailgw.py Note that on Windows, this would read:: C:\sources\roundup-0.7.4> SET PYTHONPATH=. C:\sources\roundup-0.7.4> python roundup/scripts/roundup_server.py 7. Once you're comfortable that the upgrade will work using that copy, you should install the new version of the software:: python setup.py install 8. Restart your tracker web and email frontends. If something bad happens, you may reinstate your backup of the tracker and reinstall the older version of the sofware using the same install command:: python setup.py install Migrating Backends ------------------ 1. Stop the existing tracker web and email frontends (preventing changes). 2. Use the roundup-admin tool "export" command to export the contents of your tracker to disk. 3. Copy the tracker home to a new directory. 4. Delete the "db" directory from the new directory. 5. Enter the new backend name in the tracker home ``db/backend_name`` file. 6. Use the roundup-admin "import" command to import the previous export with the new tracker home. If non-interactively:: roundup-admin -i import If interactively, enter 'commit' before exitting. 7. Test each of the admin tool, web interface and mail gateway using the new backend. 8. Move the old tracker home out of the way (rename to "tracker.old") and move the new tracker home into its place. 9. Restart web and email frontends. Moving a Tracker ---------------- If you're moving the tracker to a similar machine, you should: 1. install Roundup on the new machine and test that it works there, 2. stop the existing tracker web and email frontends (preventing changes), 3. copy the tracker home directory over to the new machine, and 4. start the tracker web and email frontends on the new machine. Most of the backends are actually portable across platforms (ie. from Unix to Windows to Mac). If this isn't the case (ie. the tracker doesn't work when moved using the above steps) then you'll need to: 1. install Roundup on the new machine and test that it works there, 2. stop the existing tracker web and email frontends (preventing changes), 3. use the roundup-admin tool "export" command to export the contents of the existing tracker, 4. copy the export to the new machine, 5. use the roundup-admin "import" command to import the tracker on the new machine, and 6. start the tracker web and email frontends on the new machine. Migrating From Other Software ----------------------------- You have a couple of choices. You can either use a CSV import into Roundup, or you can write a simple Python script which uses the Roundup API directly. The latter is almost always simpler -- see the "scripts" directory in the Roundup source for some example uses of the API. "roundup-admin import" will import data into your tracker from a directory containing files with the following format: - one colon-separated-values file per Class with columns for each property, named .csv - one colon-separated-values file per Class with journal information, named -journals.csv (this is required, even if it's empty) - if the Class is a FileClass, you may have the "content" property stored in separate files from the csv files. This goes in a directory structure:: -files// where ```` is the item's ```` combination. The ```` value is ``int( / 1000)``. Adding A User From The Command-Line ----------------------------------- The ``roundup-admin`` program can create any data you wish to in the database. To create a new user, use:: roundup-admin create user To figure out what good values might be for some of the fields (eg. Roles) you can just display another user:: roundup-admin list user (or if you know their username, and it happens to be "richard"):: roundup-admin find username=richard then using the user id you get from one of the above commands, you may display the user's details:: roundup-admin display Running the Servers =================== Unix ---- On Unix systems, use the scripts/server-ctl script to control the roundup-server server. Copy it somewhere and edit the variables at the top to reflect your specific installation. Windows ------- On Windows, the roundup-server program runs as a Windows Service, and therefore may be controlled through the Services control panel. The roundup-server program may also control the service directly: **install the service** ``roundup-server -C /path/to/my/roundup-server.ini -c install`` **start the service** ``roundup-server -c start`` **stop the service** ``roundup-server -c stop`` To bring up the services panel: Windows 2000 and later Start/Control Panel/Administrative Tools/Services Windows NT4 Start/Control Panel/Services You will need a server configuration file (as described in `Configuring roundup-server`_) for specifying tracker homes and other roundup-server configuration. Specify the name of this file using the ``-C`` switch when installing the service. Running the Mail Gateway Script ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The mail gateway script should be scheduled to run regularly on your Windows server. Normally this will result in a window popping up. The solution to this is to: 1. Create a new local account on the Roundup server 2. Set the scheduled task to run in the context of this user instead of your normal login ------------------- Back to `Table of Contents`_ .. _`Table of Contents`: index.html .. _`customisation documentation`: customizing.html .. _`upgrading documentation`: upgrading.html code-71d8025784d0/doc/announcement.txt0000644000000000000000000000352711052420374015522 0ustar 00000000000000I'm proud to release version 1.4.4 of Roundup. 1.4.4 is a security fix release. All installations of Roundup are strongly encouraged to update. If you're upgrading from an older version of Roundup you *must* follow the "Software Upgrade" guidelines given in the maintenance documentation. Roundup requires python 2.3 or later for correct operation. To give Roundup a try, just download (see below), unpack and run:: roundup-demo Release info and download page: http://cheeseshop.python.org/pypi/roundup Source and documentation is available at the website: http://roundup.sourceforge.net/ Mailing lists - the place to ask questions: http://sourceforge.net/mail/?group_id=31577 About Roundup ============= Roundup is a simple-to-use and -install issue-tracking system with command-line, web and e-mail interfaces. It is based on the winning design from Ka-Ping Yee in the Software Carpentry "Track" design competition. Note: Ping is not responsible for this project. The contact for this project is richard@users.sourceforge.net. Roundup manages a number of issues (with flexible properties such as "description", "priority", and so on) and provides the ability to: (a) submit new issues, (b) find and edit existing issues, and (c) discuss issues with other participants. The system will facilitate communication among the participants by managing discussions and notifying interested parties when issues are edited. One of the major design goals for Roundup that it be simple to get going. Roundup is therefore usable "out of the box" with any python 2.3+ installation. It doesn't even need to be "installed" to be operational, though a disutils-based install script is provided. It comes with two issue tracker templates (a classic bug/feature tracker and a minimal skeleton) and four database back-ends (anydbm, sqlite, mysql and postgresql). code-71d8025784d0/doc/customizing.txt0000644000000000000000000055136611052420374015414 0ustar 00000000000000=================== Customising Roundup =================== :Version: $Revision: 1.223 $ .. This document borrows from the ZopeBook section on ZPT. The original is at: http://www.zope.org/Documentation/Books/ZopeBook/current/ZPT.stx .. contents:: :depth: 1 What You Can Do =============== Before you get too far, it's probably worth having a quick read of the Roundup `design documentation`_. Customisation of Roundup can take one of six forms: 1. `tracker configuration`_ changes 2. database, or `tracker schema`_ changes 3. "definition" class `database content`_ changes 4. behavioural changes, through detectors_ 5. `security / access controls`_ 6. change the `web interface`_ The third case is special because it takes two distinctly different forms depending upon whether the tracker has been initialised or not. The other two may be done at any time, before or after tracker initialisation. Yes, this includes adding or removing properties from classes. Trackers in a Nutshell ====================== Trackers have the following structure: =================== ======================================================== Tracker File Description =================== ======================================================== config.ini Holds the basic `tracker configuration`_ schema.py Holds the `tracker schema`_ initial_data.py Holds any data to be entered into the database when the tracker is initialised. db/ Holds the tracker's database db/files/ Holds the tracker's upload files and messages db/backend_name Names the database back-end for the tracker detectors/ Auditors and reactors for this tracker extensions/ Additional web actions and templating utilities. html/ Web interface templates, images and style sheets lib/ optional common imports for detectors and extensions =================== ======================================================== Tracker Configuration ===================== The ``config.ini`` located in your tracker home contains the basic configuration for the web and e-mail components of roundup's interfaces. Changes to the data captured by your tracker is controlled by the `tracker schema`_. Some configuration is also performed using permissions - see the `security / access controls`_ section. For example, to allow users to automatically register through the email interface, you must grant the "Anonymous" Role the "Email Access" Permission. The following is taken from the `Python Library Reference`__ (May 20, 2004) section "ConfigParser -- Configuration file parser": The configuration file consists of sections, led by a "[section]" header and followed by "name = value" entries, with line continuations on a newline with leading whitespace. Note that leading whitespace is removed from values. The optional values can contain format strings which refer to other values in the same section. Lines beginning with "#" or ";" are ignored and may be used to provide comments. For example:: [My Section] foodir = %(dir)s/whatever dir = frob would resolve the "%(dir)s" to the value of "dir" ("frob" in this case) resulting in "foodir" being "frob/whatever". __ http://docs.python.org/lib/module-ConfigParser.html Section **main** database -- ``db`` Database directory path. The path may be either absolute or relative to the directory containig this config file. templates -- ``html`` Path to the HTML templates directory. The path may be either absolute or relative to the directory containig this config file. static_files -- default *blank* Path to directory holding additional static files available via Web UI. This directory may contain sitewide images, CSS stylesheets etc. and is searched for these files prior to the TEMPLATES directory specified above. If this option is not set, all static files are taken from the TEMPLATES directory The path may be either absolute or relative to the directory containig this config file. admin_email -- ``roundup-admin`` Email address that roundup will complain to if it runs into trouble. If the email address doesn't contain an ``@`` part, the MAIL_DOMAIN defined below is used. dispatcher_email -- ``roundup-admin`` The 'dispatcher' is a role that can get notified of new items to the database. It is used by the ERROR_MESSAGES_TO config setting. If the email address doesn't contain an ``@`` part, the MAIL_DOMAIN defined below is used. email_from_tag -- default *blank* Additional text to include in the "name" part of the From: address used in nosy messages. If the sending user is "Foo Bar", the From: line is usually: ``"Foo Bar" `` the EMAIL_FROM_TAG goes inside the "Foo Bar" quotes like so: ``"Foo Bar EMAIL_FROM_TAG" `` new_web_user_roles -- ``User`` Roles that a user gets when they register with Web User Interface. This is a comma-separated list of role names (e.g. ``Admin,User``). new_email_user_roles -- ``User`` Roles that a user gets when they register with Email Gateway. This is a comma-separated string of role names (e.g. ``Admin,User``). error_messages_to -- ``user`` Send error message emails to the ``dispatcher``, ``user``, or ``both``? The dispatcher is configured using the DISPATCHER_EMAIL setting. Allowed values: ``dispatcher``, ``user``, or ``both`` html_version -- ``html4`` HTML version to generate. The templates are ``html4`` by default. If you wish to make them xhtml, then you'll need to change this var to ``xhtml`` too so all auto-generated HTML is compliant. Allowed values: ``html4``, ``xhtml`` timezone -- ``0`` Numeric timezone offset used when users do not choose their own in their settings. instant_registration -- ``yes`` Register new users instantly, or require confirmation via email? Allowed values: ``yes``, ``no`` email_registration_confirmation -- ``yes`` Offer registration confirmation by email or only through the web? Allowed values: ``yes``, ``no`` indexer_stopwords -- default *blank* Additional stop-words for the full-text indexer specific to your tracker. See the indexer source for the default list of stop-words (e.g. ``A,AND,ARE,AS,AT,BE,BUT,BY, ...``). umask -- ``02`` Defines the file creation mode mask. Section **tracker** name -- ``Roundup issue tracker`` A descriptive name for your roundup instance. web -- ``http://host.example/demo/`` The web address that the tracker is viewable at. This will be included in information sent to users of the tracker. The URL MUST include the cgi-bin part or anything else that is required to get to the home page of the tracker. You MUST include a trailing '/' in the URL. email -- ``issue_tracker`` Email address that mail to roundup should go to. language -- default *blank* Default locale name for this tracker. If this option is not set, the language is determined by the environment variable LANGUAGE, LC_ALL, LC_MESSAGES, or LANG, in that order of preference. Section **web** http_auth -- ``yes`` Whether to use HTTP Basic Authentication, if present. Roundup will use either the REMOTE_USER or HTTP_AUTHORIZATION variables supplied by your web server (in that order). Set this option to 'no' if you do not wish to use HTTP Basic Authentication in your web interface. use_browser_language -- ``yes`` Whether to use HTTP Accept-Language, if present. Browsers send a language-region preference list. It's usually set in the client's browser or in their Operating System. Set this option to 'no' if you want to ignore it. debug -- ``no`` Setting this option makes Roundup display error tracebacks in the user's browser rather than emailing them to the tracker admin."), Section **rdbms** Settings in this section are used by Postgresql and MySQL backends only name -- ``roundup`` Name of the database to use. host -- ``localhost`` Database server host. port -- default *blank* TCP port number of the database server. Postgresql usually resides on port 5432 (if any), for MySQL default port number is 3306. Leave this option empty to use backend default. user -- ``roundup`` Database user name that Roundup should use. password -- ``roundup`` Database user password. read_default_file -- ``~/.my.cnf`` Name of the MySQL defaults file. Only used in MySQL connections. read_default_group -- ``roundup`` Name of the group to use in the MySQL defaults file. Only used in MySQL connections. Section **logging** config -- default *blank* Path to configuration file for standard Python logging module. If this option is set, logging configuration is loaded from specified file; options 'filename' and 'level' in this section are ignored. The path may be either absolute or relative to the directory containig this config file. filename -- default *blank* Log file name for minimal logging facility built into Roundup. If no file name specified, log messages are written on stderr. If above 'config' option is set, this option has no effect. The path may be either absolute or relative to the directory containig this config file. level -- ``ERROR`` Minimal severity level of messages written to log file. If above 'config' option is set, this option has no effect. Allowed values: ``DEBUG``, ``INFO``, ``WARNING``, ``ERROR`` Section **mail** Outgoing email options. Used for nosy messages, password reset and registration approval requests. domain -- ``localhost`` Domain name used for email addresses. host -- default *blank* SMTP mail host that roundup will use to send mail username -- default *blank* SMTP login name. Set this if your mail host requires authenticated access. If username is not empty, password (below) MUST be set! password -- default *blank* SMTP login password. Set this if your mail host requires authenticated access. port -- default *25* SMTP port on mail host. Set this if your mail host runs on a different port. local_hostname -- default *blank* The fully qualified domain name (FQDN) to use during SMTP sessions. If left blank, the underlying SMTP library will attempt to detect your FQDN. If your mail host requires something specific, specify the FQDN to use. tls -- ``no`` If your SMTP mail host provides or requires TLS (Transport Layer Security) then you may set this option to 'yes'. Allowed values: ``yes``, ``no`` tls_keyfile -- default *blank* If TLS is used, you may set this option to the name of a PEM formatted file that contains your private key. The path may be either absolute or relative to the directory containig this config file. tls_certfile -- default *blank* If TLS is used, you may set this option to the name of a PEM formatted certificate chain file. The path may be either absolute or relative to the directory containig this config file. charset -- utf-8 Character set to encode email headers with. We use utf-8 by default, as it's the most flexible. Some mail readers (eg. Eudora) can't cope with that, so you might need to specify a more limited character set (eg. iso-8859-1). debug -- default *blank* Setting this option makes Roundup to write all outgoing email messages to this file *instead* of sending them. This option has the same effect as environment variable SENDMAILDEBUG. Environment variable takes precedence. The path may be either absolute or relative to the directory containig this config file. add_authorinfo -- ``yes`` Add a line with author information at top of all messages send by roundup. add_authoremail -- ``yes`` Add the mail address of the author to the author information at the top of all messages. If this is false but add_authorinfo is true, only the name of the actor is added which protects the mail address of the actor from being exposed at mail archives, etc. Section **mailgw** Roundup Mail Gateway options keep_quoted_text -- ``yes`` Keep email citations when accepting messages. Setting this to ``no`` strips out "quoted" text from the message. Signatures are also stripped. Allowed values: ``yes``, ``no`` leave_body_unchanged -- ``no`` Preserve the email body as is - that is, keep the citations *and* signatures. Allowed values: ``yes``, ``no`` default_class -- ``issue`` Default class to use in the mailgw if one isn't supplied in email subjects. To disable, leave the value blank. language -- default *blank* Default locale name for the tracker mail gateway. If this option is not set, mail gateway will use the language of the tracker instance. subject_prefix_parsing -- ``strict`` Controls the parsing of the [prefix] on subject lines in incoming emails. ``strict`` will return an error to the sender if the [prefix] is not recognised. ``loose`` will attempt to parse the [prefix] but just pass it through as part of the issue title if not recognised. ``none`` will always pass any [prefix] through as part of the issue title. subject_suffix_parsing -- ``strict`` Controls the parsing of the [suffix] on subject lines in incoming emails. ``strict`` will return an error to the sender if the [suffix] is not recognised. ``loose`` will attempt to parse the [suffix] but just pass it through as part of the issue title if not recognised. ``none`` will always pass any [suffix] through as part of the issue title. subject_suffix_delimiters -- ``[]`` Defines the brackets used for delimiting the commands suffix in a subject line. subject_content_match -- ``always`` Controls matching of the incoming email subject line against issue titles in the case where there is no designator [prefix]. ``never`` turns off matching. ``creation + interval`` or ``activity + interval`` will match an issue for the interval after the issue's creation or last activity. The interval is a standard Roundup interval. refwd_re -- ``(\s*\W?\s*(fw|fwd|re|aw|sv|ang)\W)+`` Regular expression matching a single reply or forward prefix prepended by the mailer. This is explicitly stripped from the subject during parsing. Value is Python Regular Expression (UTF8-encoded). origmsg_re -- `` ^[>|\s]*-----\s?Original Message\s?-----$`` Regular expression matching start of an original message if quoted the in body. Value is Python Regular Expression (UTF8-encoded). sign_re -- ``^[>|\s]*-- ?$`` Regular expression matching the start of a signature in the message body. Value is Python Regular Expression (UTF8-encoded). eol_re -- ``[\r\n]+`` Regular expression matching end of line. Value is Python Regular Expression (UTF8-encoded). blankline_re -- ``[\r\n]+\s*[\r\n]+`` Regular expression matching a blank line. Value is Python Regular Expression (UTF8-encoded). Section **pgp** OpenPGP mail processing options enable -- ``no`` Enable PGP processing. Requires pyme. roles -- default *blank* If specified, a comma-separated list of roles to perform PGP processing on. If not specified, it happens for all users. homedir -- default *blank* Location of PGP directory. Defaults to $HOME/.gnupg if not specified. Section **nosy** Nosy messages sending messages_to_author -- ``no`` Send nosy messages to the author of the message. Allowed values: ``yes``, ``no``, ``new`` signature_position -- ``bottom`` Where to place the email signature. Allowed values: ``top``, ``bottom``, ``none`` add_author -- ``new`` Does the author of a message get placed on the nosy list automatically? If ``new`` is used, then the author will only be added when a message creates a new issue. If ``yes``, then the author will be added on followups too. If ``no``, they're never added to the nosy. Allowed values: ``yes``, ``no``, ``new`` add_recipients -- ``new`` Do the recipients (``To:``, ``Cc:``) of a message get placed on the nosy list? If ``new`` is used, then the recipients will only be added when a message creates a new issue. If ``yes``, then the recipients will be added on followups too. If ``no``, they're never added to the nosy. Allowed values: ``yes``, ``no``, ``new`` email_sending -- ``single`` Controls the email sending from the nosy reactor. If ``multiple`` then a separate email is sent to each recipient. If ``single`` then a single email is sent with each recipient as a CC address. max_attachment_size -- ``2147483647`` Attachments larger than the given number of bytes won't be attached to nosy mails. They will be replaced by a link to the tracker's download page for the file. You may generate a new default config file using the ``roundup-admin genconfig`` command. Configuration variables may be referred to in lower or upper case. In code, variables not in the "main" section are referred to using their section and name, so "domain" in the section "mail" becomes MAIL_DOMAIN. The configuration variables available are: Extending the configuration file -------------------------------- You can't add new variables to the config.ini file in the tracker home but you can add two new config.ini files: - a config.ini in the ``extensions`` directory will be loaded and attached to the config variable as "ext". - a config.ini in the ``detectors`` directory will be loaded and attached to the config variable as "detectors". For example, the following in ``detectors/config.ini``:: [main] qa_recipients = email@example.com is accessible as:: db.config.detectors['QA_RECIPIENTS'] Note that the name grouping applied to the main configuration file is applied to the extension config files, so if you instead have:: [qa] recipients = email@example.com then the above ``db.config.detectors['QA_RECIPIENTS']`` will still work. Tracker Schema ============== .. note:: if you modify the schema, you'll most likely need to edit the `web interface`_ HTML template files and `detectors`_ to reflect your changes. A tracker schema defines what data is stored in the tracker's database. Schemas are defined using Python code in the ``schema.py`` module of your tracker. The ``schema.py`` module ------------------------ The ``schema.py`` module contains two functions: **open** This function defines what your tracker looks like on the inside, the **schema** of the tracker. It defines the **Classes** and **properties** on each class. It also defines the **security** for those Classes. The next few sections describe how schemas work and what you can do with them. **init** This function is responsible for setting up the initial state of your tracker. It's called exactly once - but the ``roundup-admin initialise`` command. See the start of the section on `database content`_ for more info about how this works. The "classic" schema -------------------- The "classic" schema looks like this (see section `setkey(property)`_ below for the meaning of ``'setkey'`` -- you may also want to look into the sections `setlabelprop(property)`_ and `setorderprop(property)`_ for specifying (default) labelling and ordering of classes.):: pri = Class(db, "priority", name=String(), order=String()) pri.setkey("name") stat = Class(db, "status", name=String(), order=String()) stat.setkey("name") keyword = Class(db, "keyword", name=String()) keyword.setkey("name") user = Class(db, "user", username=String(), organisation=String(), password=String(), address=String(), realname=String(), phone=String(), alternate_addresses=String(), queries=Multilink('query'), roles=String(), timezone=String()) user.setkey("username") msg = FileClass(db, "msg", author=Link("user"), summary=String(), date=Date(), recipients=Multilink("user"), files=Multilink("file"), messageid=String(), inreplyto=String()) file = FileClass(db, "file", name=String()) issue = IssueClass(db, "issue", keyword=Multilink("keyword"), status=Link("status"), assignedto=Link("user"), priority=Link("priority")) issue.setkey('title') What you can't do to the schema ------------------------------- You must never: **Remove the users class** This class is the only *required* class in Roundup. **Remove the "username", "address", "password" or "realname" user properties** Various parts of Roundup require these properties. Don't remove them. **Change the type of a property** Property types must *never* be changed - the database simply doesn't take this kind of action into account. Note that you can't just remove a property and re-add it as a new type either. If you wanted to make the assignedto property a Multilink, you'd need to create a new property assignedto_list and remove the old assignedto property. What you can do to the schema ----------------------------- Your schema may be changed at any time before or after the tracker has been initialised (or used). You may: **Add new properties to classes, or add whole new classes** This is painless and easy to do - there are generally no repurcussions from adding new information to a tracker's schema. **Remove properties** Removing properties is a little more tricky - you need to make sure that the property is no longer used in the `web interface`_ *or* by the detectors_. Classes and Properties - creating a new information store --------------------------------------------------------- In the tracker above, we've defined 7 classes of information: priority Defines the possible levels of urgency for issues. status Defines the possible states of processing the issue may be in. keyword Initially empty, will hold keywords useful for searching issues. user Initially holding the "admin" user, will eventually have an entry for all users using roundup. msg Initially empty, will hold all e-mail messages sent to or generated by roundup. file Initially empty, will hold all files attached to issues. issue Initially empty, this is where the issue information is stored. We define the "priority" and "status" classes to allow two things: reduction in the amount of information stored on the issue and more powerful, accurate searching of issues by priority and status. By only requiring a link on the issue (which is stored as a single number) we reduce the chance that someone mis-types a priority or status - or simply makes a new one up. Class and Items ~~~~~~~~~~~~~~~ A Class defines a particular class (or type) of data that will be stored in the database. A class comprises one or more properties, which gives the information about the class items. The actual data entered into the database, using ``class.create()``, are called items. They have a special immutable property called ``'id'``. We sometimes refer to this as the *itemid*. Properties ~~~~~~~~~~ A Class is comprised of one or more properties of the following types: * String properties are for storing arbitrary-length strings. * Password properties are for storing encoded arbitrary-length strings. The default encoding is defined on the ``roundup.password.Password`` class. * Date properties store date-and-time stamps. Their values are Timestamp objects. * Number properties store numeric values. * Boolean properties store on/off, yes/no, true/false values. * A Link property refers to a single other item selected from a specified class. The class is part of the property; the value is an integer, the id of the chosen item. * A Multilink property refers to possibly many items in a specified class. The value is a list of integers. All Classes automatically have a number of properties by default: *creator* Link to the user that created the item. *creation* Date the item was created. *actor* Link to the user that last modified the item. *activity* Date the item was last modified. FileClass ~~~~~~~~~ FileClasses save their "content" attribute off in a separate file from the rest of the database. This reduces the number of large entries in the database, which generally makes databases more efficient, and also allows us to use command-line tools to operate on the files. They are stored in the files sub-directory of the ``'db'`` directory in your tracker. FileClasses also have a "type" attribute to store the MIME type of the file. IssueClass ~~~~~~~~~~ IssueClasses automatically include the "messages", "files", "nosy", and "superseder" properties. The messages and files properties list the links to the messages and files related to the issue. The nosy property is a list of links to users who wish to be informed of changes to the issue - they get "CC'ed" e-mails when messages are sent to or generated by the issue. The nosy reactor (in the ``'detectors'`` directory) handles this action. The superseder link indicates an issue which has superseded this one. They also have the dynamically generated "creation", "activity" and "creator" properties. The value of the "creation" property is the date when an item was created, and the value of the "activity" property is the date when any property on the item was last edited (equivalently, these are the dates on the first and last records in the item's journal). The "creator" property holds a link to the user that created the issue. setkey(property) ~~~~~~~~~~~~~~~~ Select a String property of the class to be the key property. The key property must be unique, and allows references to the items in the class by the content of the key property. That is, we can refer to users by their username: for example, let's say that there's an issue in roundup, issue 23. There's also a user, richard, who happens to be user 2. To assign an issue to him, we could do either of:: roundup-admin set issue23 assignedto=2 or:: roundup-admin set issue23 assignedto=richard Note, the same thing can be done in the web and e-mail interfaces. setlabelprop(property) ~~~~~~~~~~~~~~~~~~~~~~ Select a property of the class to be the label property. The label property is used whereever an item should be uniquely identified, e.g., when displaying a link to an item. If setlabelprop is not specified for a class, the following values are tried for the label: * the key of the class (see the `setkey(property)`_ section above) * the "name" property * the "title" property * the first property from the sorted property name list So in most cases you can get away without specifying setlabelprop explicitly. setorderprop(property) ~~~~~~~~~~~~~~~~~~~~~~ Select a property of the class to be the order property. The order property is used whenever using a default sort order for the class, e.g., when grouping or sorting class A by a link to class B in the user interface, the order property of class B is used for sorting. If setorderprop is not specified for a class, the following values are tried for the order property: * the property named "order" * the label property (see `setlabelprop(property)`_ above) So in most cases you can get away without specifying setorderprop explicitly. create(information) ~~~~~~~~~~~~~~~~~~~ Create an item in the database. This is generally used to create items in the "definitional" classes like "priority" and "status". A note about ordering ~~~~~~~~~~~~~~~~~~~~~ When we sort items in the hyperdb, we use one of a number of methods, depending on the properties being sorted on: 1. If it's a String, Number, Date or Interval property, we just sort the scalar value of the property. Strings are sorted case-sensitively. 2. If it's a Link property, we sort by either the linked item's "order" property (if it has one) or the linked item's "id". 3. Mulitlinks sort similar to #2, but we start with the first Multilink list item, and if they're the same, we sort by the second item, and so on. Note that if an "order" property is defined on a Class that is used for sorting, all items of that Class *must* have a value against the "order" property, or sorting will result in random ordering. Examples of adding to your schema --------------------------------- The Roundup wiki has examples of how schemas can be customised to add new functionality. Detectors - adding behaviour to your tracker ============================================ .. _detectors: Detectors are initialised every time you open your tracker database, so you're free to add and remove them any time, even after the database is initialised via the ``roundup-admin initialise`` command. The detectors in your tracker fire *before* (**auditors**) and *after* (**reactors**) changes to the contents of your database. They are Python modules that sit in your tracker's ``detectors`` directory. You will have some installed by default - have a look. You can write new detectors or modify the existing ones. The existing detectors installed for you are: **nosyreaction.py** This provides the automatic nosy list maintenance and email sending. The nosy reactor (``nosyreaction``) fires when new messages are added to issues. The nosy auditor (``updatenosy``) fires when issues are changed, and figures out what changes need to be made to the nosy list (such as adding new authors, etc.) **statusauditor.py** This provides the ``chatty`` auditor which changes the issue status from ``unread`` or ``closed`` to ``chatting`` if new messages appear. It also provides the ``presetunread`` auditor which pre-sets the status to ``unread`` on new items if the status isn't explicitly defined. **messagesummary.py** Generates the ``summary`` property for new messages based on the message content. **userauditor.py** Verifies the content of some of the user fields (email addresses and roles lists). If you don't want this default behaviour, you're completely free to change or remove these detectors. See the detectors section in the `design document`__ for details of the interface for detectors. __ design.html Detector API ------------ Auditors are called with the arguments:: audit(db, cl, itemid, newdata) where ``db`` is the database, ``cl`` is an instance of Class or IssueClass within the database, and ``newdata`` is a dictionary mapping property names to values. For a ``create()`` operation, the ``itemid`` argument is None and newdata contains all of the initial property values with which the item is about to be created. For a ``set()`` operation, newdata contains only the names and values of properties that are about to be changed. For a ``retire()`` or ``restore()`` operation, newdata is None. Reactors are called with the arguments:: react(db, cl, itemid, olddata) where ``db`` is the database, ``cl`` is an instance of Class or IssueClass within the database, and ``olddata`` is a dictionary mapping property names to values. For a ``create()`` operation, the ``itemid`` argument is the id of the newly-created item and ``olddata`` is None. For a ``set()`` operation, ``olddata`` contains the names and previous values of properties that were changed. For a ``retire()`` or ``restore()`` operation, ``itemid`` is the id of the retired or restored item and ``olddata`` is None. Additional Detectors Ready For Use ---------------------------------- Sample additional detectors that have been found useful will appear in the ``'detectors'`` directory of the Roundup distribution. If you want to use one, copy it to the ``'detectors'`` of your tracker instance: **newissuecopy.py** This detector sends an email to a team address whenever a new issue is created. The address is hard-coded into the detector, so edit it before you use it (look for the text 'team@team.host') or you'll get email errors! **creator_resolution.py** Catch attempts to set the status to "resolved" - if the assignedto user isn't the creator, then set the status to "confirm-done". Note that "classic" Roundup doesn't have that status, so you'll have to add it. If you don't want to though, it'll just use "in-progress" instead. **email_auditor.py** If a file added to an issue is of type message/rfc822, we tack on the extension .eml. The reason for this is that Microsoft Internet Explorer will not open things with a .eml attachment, as they deem it 'unsafe'. Worse yet, they'll just give you an incomprehensible error message. For more information, see the detector code - it has a length explanation. Auditor or Reactor? ------------------- Generally speaking, the following rules should be observed: **Auditors** Are used for `vetoing creation of or changes to items`_. They might also make automatic changes to item properties. **Reactors** Detect changes in the database and react accordingly. They should avoid making changes to the database where possible, as this could create detector loops. Vetoing creation of or changes to items --------------------------------------- Auditors may raise the ``Reject`` exception to prevent the creation of or changes to items in the database. The mail gateway, for example, will not attach files or messages to issues when the creation of those files or messages are prevented through the ``Reject`` exception. It'll also not create users if that creation is ``Reject``'ed too. To use, simply add at the top of your auditor:: from roundup.exceptions import Reject And then when your rejection criteria have been detected, simply:: raise Reject Generating email from Roundup ----------------------------- The module ``roundup.mailer`` contains most of the nuts-n-bolts required to generate email messages from Roundup. In addition, the ``IssueClass`` methods ``nosymessage()`` and ``send_message()`` are used to generate nosy messages, and may generate messages which only consist of a change note (ie. the message id parameter is not required - this is referred to as a "System Message" because it comes from "the system" and not a user). Database Content ================ .. note:: If you modify the content of definitional classes, you'll most likely need to edit the tracker `detectors`_ to reflect your changes. Customisation of the special "definitional" classes (eg. status, priority, resolution, ...) may be done either before or after the tracker is initialised. The actual method of doing so is completely different in each case though, so be careful to use the right one. **Changing content before tracker initialisation** Edit the initial_data.py module in your tracker to alter the items created using the ``create( ... )`` methods. **Changing content after tracker initialisation** As the "admin" user, click on the "class list" link in the web interface to bring up a list of all database classes. Click on the name of the class you wish to change the content of. You may also use the ``roundup-admin`` interface's create, set and retire methods to add, alter or remove items from the classes in question. See "`adding a new field to the classic schema`_" for an example that requires database content changes. Security / Access Controls ========================== A set of Permissions is built into the security module by default: - Create (everything) - Edit (everything) - View (everything) These are assigned to the "Admin" Role by default, and allow a user to do anything. Every Class you define in your `tracker schema`_ also gets an Create, Edit and View Permission of its own. The web and email interfaces also define: *Email Access* If defined, the user may use the email interface. Used by default to deny Anonymous users access to the email interface. When granted to the Anonymous user, they will be automatically registered by the email interface (see also the ``new_email_user_roles`` configuration option). *Web Access* If defined, the user may use the web interface. All users are able to see the login form, regardless of this setting (thus enabling logging in). *Web Roles* Controls user access to editing the "roles" property of the "user" class. TODO: deprecate in favour of a property-based control. These are hooked into the default Roles: - Admin (Create, Edit, View and everything; Web Roles) - User (Web Access; Email Access) - Anonymous (Web Access) And finally, the "admin" user gets the "Admin" Role, and the "anonymous" user gets "Anonymous" assigned when the tracker is installed. For the "User" Role, the "classic" tracker defines: - Create, Edit and View issue, file, msg, query, keyword - View priority, status - View user - Edit their own user record And the "Anonymous" Role is defined as: - Web interface access - Create user (for registration) - View issue, file, msg, query, keyword, priority, status Put together, these settings appear in the tracker's ``schema.py`` file:: # # TRACKER SECURITY SETTINGS # # See the configuration and customisation document for information # about security setup. # # REGULAR USERS # # Give the regular users access to the web and email interface db.security.addPermissionToRole('User', 'Web Access') db.security.addPermissionToRole('User', 'Email Access') # Assign the access and edit Permissions for issue, file and message # to regular users now for cl in 'issue', 'file', 'msg', 'query', 'keyword': db.security.addPermissionToRole('User', 'View', cl) db.security.addPermissionToRole('User', 'Edit', cl) db.security.addPermissionToRole('User', 'Create', cl) for cl in 'priority', 'status': db.security.addPermissionToRole('User', 'View', cl) # May users view other user information? Comment these lines out # if you don't want them to db.security.addPermissionToRole('User', 'View', 'user') # Users should be able to edit their own details -- this permission # is limited to only the situation where the Viewed or Edited item # is their own. def own_record(db, userid, itemid): '''Determine whether the userid matches the item being accessed.''' return userid == itemid p = db.security.addPermission(name='View', klass='user', check=own_record, description="User is allowed to view their own user details") db.security.addPermissionToRole('User', p) p = db.security.addPermission(name='Edit', klass='user', check=own_record, description="User is allowed to edit their own user details") db.security.addPermissionToRole('User', p) # # ANONYMOUS USER PERMISSIONS # # Let anonymous users access the web interface. Note that almost all # trackers will need this Permission. The only situation where it's not # required is in a tracker that uses an HTTP Basic Authenticated front-end. db.security.addPermissionToRole('Anonymous', 'Web Access') # Let anonymous users access the email interface (note that this implies # that they will be registered automatically, hence they will need the # "Create" user Permission below) # This is disabled by default to stop spam from auto-registering users on # public trackers. #db.security.addPermissionToRole('Anonymous', 'Email Access') # Assign the appropriate permissions to the anonymous user's Anonymous # Role. Choices here are: # - Allow anonymous users to register db.security.addPermissionToRole('Anonymous', 'Create', 'user') # Allow anonymous users access to view issues (and the related, linked # information) for cl in 'issue', 'file', 'msg', 'keyword', 'priority', 'status': db.security.addPermissionToRole('Anonymous', 'View', cl) # [OPTIONAL] # Allow anonymous users access to create or edit "issue" items (and the # related file and message items) #for cl in 'issue', 'file', 'msg': # db.security.addPermissionToRole('Anonymous', 'Create', cl) # db.security.addPermissionToRole('Anonymous', 'Edit', cl) Automatic Permission Checks --------------------------- Permissions are automatically checked when information is rendered through the web. This includes: 1. View checks for properties when being rendered via the ``plain()`` or similar methods. If the check fails, the text "[hidden]" will be displayed. 2. Edit checks for properties when the edit field is being rendered via the ``field()`` or similar methods. If the check fails, the property will be rendered via the ``plain()`` method (see point 1. for subsequent checking performed) 3. View checks are performed in index pages for each item being displayed such that if the user does not have permission, the row is not rendered. 4. View checks are performed at the top of item pages for the Item being displayed. If the user does not have permission, the text "You are not allowed to view this page." will be displayed. 5. View checks are performed at the top of index pages for the Class being displayed. If the user does not have permission, the text "You are not allowed to view this page." will be displayed. New User Roles -------------- New users are assigned the Roles defined in the config file as: - NEW_WEB_USER_ROLES - NEW_EMAIL_USER_ROLES The `users may only edit their issues`_ example shows customisation of these parameters. Changing Access Controls ------------------------ You may alter the configuration variables to change the Role that new web or email users get, for example to not give them access to the web interface if they register through email. You may use the ``roundup-admin`` "``security``" command to display the current Role and Permission configuration in your tracker. Adding a new Permission ~~~~~~~~~~~~~~~~~~~~~~~ When adding a new Permission, you will need to: 1. add it to your tracker's ``schema.py`` so it is created, using ``security.addPermission``, for example:: self.security.addPermission(name="View", klass='frozzle', description="User is allowed to access frozzles") will set up a new "View" permission on the Class "frozzle". 2. enable it for the Roles that should have it (verify with "``roundup-admin security``") 3. add it to the relevant HTML interface templates 4. add it to the appropriate xxxPermission methods on in your tracker interfaces module The ``addPermission`` method takes a couple of optional parameters: **properties** A sequence of property names that are the only properties to apply the new Permission to (eg. ``... klass='user', properties=('name', 'email') ...``) **check** A function to be execute which returns boolean determining whether the Permission is allowed. The function has the signature ``check(db, userid, itemid)`` where ``db`` is a handle on the open database, ``userid`` is the user attempting access and ``itemid`` is the specific item being accessed. Example Scenarios ~~~~~~~~~~~~~~~~~ See the `examples`_ section for longer examples of customisation. **anonymous access through the e-mail gateway** Give the "anonymous" user the "Email Access", ("Edit", "issue") and ("Create", "msg") Permissions but do not not give them the ("Create", "user") Permission. This means that when an unknown user sends email into the tracker, they're automatically logged in as "anonymous". Since they don't have the ("Create", "user") Permission, they won't be automatically registered, but since "anonymous" has permission to use the gateway, they'll still be able to submit issues. Note that the Sender information - their email address - will not be available - they're *anonymous*. **automatic registration of users in the e-mail gateway** By giving the "anonymous" user the ("Create", "user") Permission, any unidentified user will automatically be registered with the tracker (with no password, so they won't be able to log in through the web until an admin sets their password). By default new Roundup trackers don't allow this as it opens them up to spam. It may be enabled by uncommenting the appropriate addPermissionToRole in your tracker's ``schema.py`` file. The new user is given the Roles list defined in the "new_email_user_roles" config variable. **only developers may be assigned issues** Create a new Permission called "Fixer" for the "issue" class. Create a new Role "Developer" which has that Permission, and assign that to the appropriate users. Filter the list of users available in the assignedto list to include only those users. Enforce the Permission with an auditor. See the example `restricting the list of users that are assignable to a task`_. **only managers may sign off issues as complete** Create a new Permission called "Closer" for the "issue" class. Create a new Role "Manager" which has that Permission, and assign that to the appropriate users. In your web interface, only display the "resolved" issue state option when the user has the "Closer" Permissions. Enforce the Permission with an auditor. This is very similar to the previous example, except that the web interface check would look like:: **don't give web access to users who register through email** Create a new Role called "Email User" which has all the Permissions of the normal "User" Role minus the "Web Access" Permission. This will allow users to send in emails to the tracker, but not access the web interface. **let some users edit the details of all users** Create a new Role called "User Admin" which has the Permission for editing users:: db.security.addRole(name='User Admin', description='Managing users') p = db.security.getPermission('Edit', 'user') db.security.addPermissionToRole('User Admin', p) and assign the Role to the users who need the permission. Web Interface ============= .. contents:: :local: The web interface is provided by the ``roundup.cgi.client`` module and is used by ``roundup.cgi``, ``roundup-server`` and ``ZRoundup`` (``ZRoundup`` is broken, until further notice). In all cases, we determine which tracker is being accessed (the first part of the URL path inside the scope of the CGI handler) and pass control on to the ``roundup.cgi.client.Client`` class - which handles the rest of the access through its ``main()`` method. This means that you can do pretty much anything you want as a web interface to your tracker. Repercussions of changing the tracker schema --------------------------------------------- If you choose to change the `tracker schema`_ you will need to ensure the web interface knows about it: 1. Index, item and search pages for the relevant classes may need to have properties added or removed, 2. The "page" template may require links to be changed, as might the "home" page's content arguments. How requests are processed -------------------------- The basic processing of a web request proceeds as follows: 1. figure out who we are, defaulting to the "anonymous" user 2. figure out what the request is for - we call this the "context" 3. handle any requested action (item edit, search, ...) 4. render the template requested by the context, resulting in HTML output In some situations, exceptions occur: - HTTP Redirect (generally raised by an action) - SendFile (generally raised by ``determine_context``) here we serve up a FileClass "content" property - SendStaticFile (generally raised by ``determine_context``) here we serve up a file from the tracker "html" directory - Unauthorised (generally raised by an action) here the action is cancelled, the request is rendered and an error message is displayed indicating that permission was not granted for the action to take place - NotFound (raised wherever it needs to be) this exception percolates up to the CGI interface that called the client Determining web context ----------------------- To determine the "context" of a request, we look at the URL and the special request variable ``@template``. The URL path after the tracker identifier is examined. Typical URL paths look like: 1. ``/tracker/issue`` 2. ``/tracker/issue1`` 3. ``/tracker/@@file/style.css`` 4. ``/cgi-bin/roundup.cgi/tracker/file1`` 5. ``/cgi-bin/roundup.cgi/tracker/file1/kitten.png`` where the "tracker identifier" is "tracker" in the above cases. That means we're looking at "issue", "issue1", "@@file/style.css", "file1" and "file1/kitten.png" in the cases above. The path is generally only one entry long - longer paths are handled differently. a. if there is no path, then we are in the "home" context. See `the "home" context`_ below for more information about how it may be used. b. if the path starts with "@@file" (as in example 3, "/tracker/@@file/style.css"), then the additional path entry, "style.css" specifies the filename of a static file we're to serve up from the tracker TEMPLATES (or STATIC_FILES, if configured) directory. This is usually the tracker's "html" directory. Raises a SendStaticFile exception. c. if there is something in the path (as in example 1, "issue"), it identifies the tracker class we're to display. d. if the path is an item designator (as in examples 2 and 4, "issue1" and "file1"), then we're to display a specific item. e. if the path starts with an item designator and is longer than one entry (as in example 5, "file1/kitten.png"), then we're assumed to be handling an item of a ``FileClass``, and the extra path information gives the filename that the client is going to label the download with (i.e. "file1/kitten.png" is nicer to download than "file1"). This raises a ``SendFile`` exception. Both b. and e. stop before we bother to determine the template we're going to use. That's because they don't actually use templates. The template used is specified by the ``@template`` CGI variable, which defaults to: - only classname suplied: "index" - full item designator supplied: "item" The "home" Context ------------------ The "home" context is special because it allows you to add templated pages to your tracker that don't rely on a class or item (ie. an issues list or specific issue). Let's say you wish to add frames to control the layout of your tracker's interface. You'd probably have: - A top-level frameset page. This page probably wouldn't be templated, so it could be served as a static file (see `serving static content`_) - A sidebar frame that is templated. Let's call this page "home.navigation.html" in your tracker's "html" directory. To load that page up, you use the URL: /home?@template=navigation Serving static content ---------------------- See the previous section `determining web context`_ where it describes ``@@file`` paths. Performing actions in web requests ---------------------------------- When a user requests a web page, they may optionally also request for an action to take place. As described in `how requests are processed`_, the action is performed before the requested page is generated. Actions are triggered by using a ``@action`` CGI variable, where the value is one of: **login** Attempt to log a user in. **logout** Log the user out - make them "anonymous". **register** Attempt to create a new user based on the contents of the form and then log them in. **edit** Perform an edit of an item in the database. There are some `special form variables`_ you may use. **new** Add a new item to the database. You may use the same `special form variables`_ as in the "edit" action. **retire** Retire the item in the database. **editCSV** Performs an edit of all of a class' items in one go. See also the *class*.csv templating method which generates the CSV data to be edited, and the ``'_generic.index'`` template which uses both of these features. **search** Mangle some of the form variables: - Set the form ":filter" variable based on the values of the filter variables - if they're set to anything other than "dontcare" then add them to :filter. - Also handle the ":queryname" variable and save off the query to the user's query list. Each of the actions is implemented by a corresponding ``*XxxAction*`` (where "Xxx" is the name of the action) class in the ``roundup.cgi.actions`` module. These classes are registered with ``roundup.cgi.client.Client``. If you need to define new actions, you may add them there (see `defining new web actions`_). Each action class also has a ``*permission*`` method which determines whether the action is permissible given the current user. The base permission checks for each action are: **login** Determine whether the user has the "Web Access" Permission. **logout** No permission checks are made. **register** Determine whether the user has the ("Create", "user") Permission. **edit** Determine whether the user has permission to edit this item. If we're editing the "user" class, users are allowed to edit their own details - unless they try to edit the "roles" property, which requires the special Permission "Web Roles". **new** Determine whether the user has permission to create this item. No additional property checks are made. Additionally, new user items may be created if the user has the ("Create", "user") Permission. **editCSV** Determine whether the user has permission to edit this class. **search** Determine whether the user has permission to view this class. Special form variables ---------------------- Item properties and their values are edited with html FORM variables and their values. You can: - Change the value of some property of the current item. - Create a new item of any class, and edit the new item's properties, - Attach newly created items to a multilink property of the current item. - Remove items from a multilink property of the current item. - Specify that some properties are required for the edit operation to be successful. - Set up user interface locale. These operations will only take place if the form action (the ``@action`` variable) is "edit" or "new". In the following, values are variable, "@" may be either ":" or "@", and other text "required" is fixed. Two special form variables are used to specify user language preferences: ``@language`` value may be locale name or ``none``. If this variable is set to locale name, web interface language is changed to given value (provided that appropriate translation is available), the value is stored in the browser cookie and will be used for all following requests. If value is ``none`` the cookie is removed and the language is changed to the tracker default, set up in the tracker configuration or OS environment. ``@charset`` value may be character set name or ``none``. Character set name is stored in the browser cookie and sets output encoding for all HTML pages generated by Roundup. If value is ``none`` the cookie is removed and HTML output is reset to Roundup internal encoding (UTF-8). Most properties are specified as form variables: ```` property on the current context item ``"@"`` property on the indicated item (for editing related information) Designators name a specific item of a class. ```` Name an existing item of class . ``"-"`` Name the th new item of class . If the form submission is successful, a new item of is created. Within the submitted form, a particular designator of this form always refers to the same new item. Once we have determined the "propname", we look at it to see if it's special: ``@required`` The associated form value is a comma-separated list of property names that must be specified when the form is submitted for the edit operation to succeed. When the is missing, the properties are for the current context item. When is present, they are for the item specified by . The "@required" specifier must come before any of the properties it refers to are assigned in the form. ``@remove@=id(s)`` or ``@add@=id(s)`` The "@add@" and "@remove@" edit actions apply only to Multilink properties. The form value must be a comma-separate list of keys for the class specified by the simple form variable. The listed items are added to (respectively, removed from) the specified property. ``@link@=`` If the edit action is "@link@", the simple form variable must specify a Link or Multilink property. The form value is a comma-separated list of designators. The item corresponding to each designator is linked to the property given by simple form variable. None of the above (ie. just a simple form value) The value of the form variable is converted appropriately, depending on the type of the property. For a Link('klass') property, the form value is a single key for 'klass', where the key field is specified in schema.py. For a Multilink('klass') property, the form value is a comma-separated list of keys for 'klass', where the key field is specified in schema.py. Note that for simple-form-variables specifiying Link and Multilink properties, the linked-to class must have a key field. For a String() property specifying a filename, the file named by the form value is uploaded. This means we try to set additional properties "filename" and "type" (if they are valid for the class). Otherwise, the property is set to the form value. For Date(), Interval(), Boolean(), and Number() properties, the form value is converted to the appropriate Any of the form variables may be prefixed with a classname or designator. Two special form values are supported for backwards compatibility: @note This is equivalent to:: @link@messages=msg-1 msg-1@content=value except that in addition, the "author" and "date" properties of "msg-1" are set to the userid of the submitter, and the current time, respectively. @file This is equivalent to:: @link@files=file-1 file-1@content=value The String content value is handled as described above for file uploads. If both the "@note" and "@file" form variables are specified, the action:: @link@msg-1@files=file-1 is also performed. We also check that FileClass items have a "content" property with actual content, otherwise we remove them from all_props before returning. Default templates ----------------- The default templates are html4 compliant. If you wish to change them to be xhtml compliant, you'll need to change the ``html_version`` configuration variable in ``config.ini`` to ``'xhtml'`` instead of ``'html4'``. Most customisation of the web view can be done by modifying the templates in the tracker ``'html'`` directory. There are several types of files in there. The *minimal* template includes: **page.html** This template usually defines the overall look of your tracker. When you view an issue, it appears inside this template. When you view an index, it also appears inside this template. This template defines a macro called "icing" which is used by almost all other templates as a coating for their content, using its "content" slot. It also defines the "head_title" and "body_title" slots to allow setting of the page title. **home.html** the default page displayed when no other page is indicated by the user **home.classlist.html** a special version of the default page that lists the classes in the tracker **classname.item.html** displays an item of the *classname* class **classname.index.html** displays a list of *classname* items **classname.search.html** displays a search page for *classname* items **_generic.index.html** used to display a list of items where there is no ``*classname*.index`` available **_generic.help.html** used to display a "class help" page where there is no ``*classname*.help`` **user.register.html** a special page just for the user class, that renders the registration page **style.css.html** a static file that is served up as-is The *classic* template has a number of additional templates. Remember that you can create any template extension you want to, so if you just want to play around with the templating for new issues, you can copy the current "issue.item" template to "issue.test", and then access the test template using the "@template" URL argument:: http://your.tracker.example/tracker/issue?@template=test and it won't affect your users using the "issue.item" template. How the templates work ---------------------- Basic Templating Actions ~~~~~~~~~~~~~~~~~~~~~~~~ Roundup's templates consist of special attributes on the HTML tags. These attributes form the `Template Attribute Language`_, or TAL. The basic TAL commands are: **tal:define="variable expression; variable expression; ..."** Define a new variable that is local to this tag and its contents. For example:: In this example, the variable "title" is defined as the result of the expression "request/description". The "tal:content" command inside the tag may then use the "title" variable. **tal:condition="expression"** Only keep this tag and its contents if the expression is true. For example::

Display some issue information.

In the example, the

tag and its contents are only displayed if the user has the "View" permission for issues. We consider the number zero, a blank string, an empty list, and the built-in variable nothing to be false values. Nearly every other value is true, including non-zero numbers, and strings with anything in them (even spaces!). **tal:repeat="variable expression"** Repeat this tag and its contents for each element of the sequence that the expression returns, defining a new local variable and a special "repeat" variable for each element. For example:: The example would iterate over the sequence of users returned by "user/list" and define the local variable "u" for each entry. Using the repeat command creates a new variable called "repeat" which you may access to gather information about the iteration. See the section below on `the repeat variable`_. **tal:replace="expression"** Replace this tag with the result of the expression. For example:: The example would replace the tag and its contents with the user's realname. If the user's realname was "Bruce", then the resultant output would be "Bruce". **tal:content="expression"** Replace the contents of this tag with the result of the expression. For example:: user's name appears here The example would replace the contents of the tag with the user's realname. If the user's realname was "Bruce" then the resultant output would be "Bruce". **tal:attributes="attribute expression; attribute expression; ..."** Set attributes on this tag to the results of expressions. For example:: My Details In the example, the "href" attribute of the tag is set to the value of the "string:user${request/user/id}" expression, which will be something like "user123". **tal:omit-tag="expression"** Remove this tag (but not its contents) if the expression is true. For example:: Hello, world! would result in output of:: Hello, world! Note that the commands on a given tag are evaulated in the order above, so *define* comes before *condition*, and so on. Additionally, you may include tags such as , which are removed from output. Its content is kept, but the tag itself is not (so don't go using any "tal:attributes" commands on it). This is useful for making arbitrary blocks of HTML conditional or repeatable (very handy for repeating multiple table rows, which would othewise require an illegal tag placement to effect the repeat). .. _TAL: .. _Template Attribute Language: http://dev.zope.org/Wikis/DevSite/Projects/ZPT/TAL%20Specification%201.4 Templating Expressions ~~~~~~~~~~~~~~~~~~~~~~ Templating Expressions are covered by `Template Attribute Language Expression Syntax`_, or TALES. The expressions you may use in the attribute values may be one of the following forms: **Path Expressions** - eg. ``item/status/checklist`` These are object attribute / item accesses. Roughly speaking, the path ``item/status/checklist`` is broken into parts ``item``, ``status`` and ``checklist``. The ``item`` part is the root of the expression. We then look for a ``status`` attribute on ``item``, or failing that, a ``status`` item (as in ``item['status']``). If that fails, the path expression fails. When we get to the end, the object we're left with is evaluated to get a string - if it is a method, it is called; if it is an object, it is stringified. Path expressions may have an optional ``path:`` prefix, but they are the default expression type, so it's not necessary. If an expression evaluates to ``default``, then the expression is "cancelled" - whatever HTML already exists in the template will remain (tag content in the case of ``tal:content``, attributes in the case of ``tal:attributes``). If an expression evaluates to ``nothing`` then the target of the expression is removed (tag content in the case of ``tal:content``, attributes in the case of ``tal:attributes`` and the tag itself in the case of ``tal:replace``). If an element in the path may not exist, then you can use the ``|`` operator in the expression to provide an alternative. So, the expression ``request/form/foo/value | default`` would simply leave the current HTML in place if the "foo" form variable doesn't exist. You may use the python function ``path``, as in ``path("item/status")``, to embed path expressions in Python expressions. **String Expressions** - eg. ``string:hello ${user/name}`` These expressions are simple string interpolations - though they can be just plain strings with no interpolation if you want. The expression in the ``${ ... }`` is just a path expression as above. **Python Expressions** - eg. ``python: 1+1`` These expressions give the full power of Python. All the "root level" variables are available, so ``python:item.status.checklist()`` would be equivalent to ``item/status/checklist``, assuming that ``checklist`` is a method. Modifiers: **structure** - eg. ``structure python:msg.content.plain(hyperlink=1)`` The result of expressions are normally *escaped* to be safe for HTML display (all "<", ">" and "&" are turned into special entities). The ``structure`` expression modifier turns off this escaping - the result of the expression is now assumed to be HTML, which is passed to the web browser for rendering. **not:** - eg. ``not:python:1=1`` This simply inverts the logical true/false value of another expression. .. _TALES: .. _Template Attribute Language Expression Syntax: http://dev.zope.org/Wikis/DevSite/Projects/ZPT/TALES%20Specification%201.3 Template Macros ~~~~~~~~~~~~~~~ Macros are used in Roundup to save us from repeating the same common page stuctures over and over. The most common (and probably only) macro you'll use is the "icing" macro defined in the "page" template. Macros are generated and used inside your templates using special attributes similar to the `basic templating actions`_. In this case, though, the attributes belong to the `Macro Expansion Template Attribute Language`_, or METAL. The macro commands are: **metal:define-macro="macro name"** Define that the tag and its contents are now a macro that may be inserted into other templates using the *use-macro* command. For example:: ... defines a macro called "page" using the ```` tag and its contents. Once defined, macros are stored on the template they're defined on in the ``macros`` attribute. You can access them later on through the ``templates`` variable, eg. the most common ``templates/page/macros/icing`` to access the "page" macro of the "page" template. **metal:use-macro="path expression"** Use a macro, which is identified by the path expression (see above). This will replace the current tag with the identified macro contents. For example:: ... will replace the tag and its contents with the "page" macro of the "page" template. **metal:define-slot="slot name"** and **metal:fill-slot="slot name"** To define *dynamic* parts of the macro, you define "slots" which may be filled when the macro is used with a *use-macro* command. For example, the ``templates/page/macros/icing`` macro defines a slot like so:: title goes here In your *use-macro* command, you may now use a *fill-slot* command like this:: My Title where the tag that fills the slot completely replaces the one defined as the slot in the macro. Note that you may not mix `METAL`_ and `TAL`_ commands on the same tag, but TAL commands may be used freely inside METAL-using tags (so your *fill-slots* tags may have all manner of TAL inside them). .. _METAL: .. _Macro Expansion Template Attribute Language: http://dev.zope.org/Wikis/DevSite/Projects/ZPT/METAL%20Specification%201.0 Information available to templates ---------------------------------- This is implemented by ``roundup.cgi.templating.RoundupPageTemplate`` The following variables are available to templates. **context** The current context. This is either None, a `hyperdb class wrapper`_ or a `hyperdb item wrapper`_ **request** Includes information about the current request, including: - the current index information (``filterspec``, ``filter`` args, ``properties``, etc) parsed out of the form. - methods for easy filterspec link generation - "form" The current CGI form information as a mapping of form argument name to value (specifically a cgi.FieldStorage) - "env" the CGI environment variables - "base" the base URL for this instance - "user" a HTMLItem instance for the current user - "language" as determined by the browser or config - "classname" the current classname (possibly None) - "template" the current template (suffix, also possibly None) **config** This variable holds all the values defined in the tracker config.ini file (eg. TRACKER_NAME, etc.) **db** The current database, used to access arbitrary database items. **templates** Access to all the tracker templates by name. Used mainly in *use-macro* commands. **utils** This variable makes available some utility functions like batching. **nothing** This is a special variable - if an expression evaluates to this, then the tag (in the case of a ``tal:replace``), its contents (in the case of ``tal:content``) or some attributes (in the case of ``tal:attributes``) will not appear in the the output. So, for example:: Hello, World! would result in:: Hello, World! **default** Also a special variable - if an expression evaluates to this, then the existing HTML in the template will not be replaced or removed, it will remain. So:: Hello, World! would result in:: Hello, World! **true**, **false** Boolean constants that may be used in `templating expressions`_ instead of ``python:1`` and ``python:0``. **i18n** Internationalization service, providing two string translation methods: **gettext** (*message*) Return the localized translation of message **ngettext** (*singular*, *plural*, *number*) Like ``gettext()``, but consider plural forms. If a translation is found, apply the plural formula to *number*, and return the resulting message (some languages have more than two plural forms). If no translation is found, return singular if *number* is 1; return plural otherwise. This function requires python2.3; in earlier python versions may not work as expected. The context variable ~~~~~~~~~~~~~~~~~~~~ The *context* variable is one of three things based on the current context (see `determining web context`_ for how we figure this out): 1. if we're looking at a "home" page, then it's None 2. if we're looking at a specific hyperdb class, it's a `hyperdb class wrapper`_. 3. if we're looking at a specific hyperdb item, it's a `hyperdb item wrapper`_. If the context is not None, we can access the properties of the class or item. The only real difference between cases 2 and 3 above are: 1. the properties may have a real value behind them, and this will appear if the property is displayed through ``context/property`` or ``context/property/field``. 2. the context's "id" property will be a false value in the second case, but a real, or true value in the third. Thus we can determine whether we're looking at a real item from the hyperdb by testing "context/id". Hyperdb class wrapper ::::::::::::::::::::: This is implemented by the ``roundup.cgi.templating.HTMLClass`` class. This wrapper object provides access to a hyperb class. It is used primarily in both index view and new item views, but it's also usable anywhere else that you wish to access information about a class, or the items of a class, when you don't have a specific item of that class in mind. We allow access to properties. There will be no "id" property. The value accessed through the property will be the current value of the same name from the CGI form. There are several methods available on these wrapper objects: =========== ============================================================= Method Description =========== ============================================================= properties return a `hyperdb property wrapper`_ for all of this class's properties. list lists all of the active (not retired) items in the class. csv return the items of this class as a chunk of CSV text. propnames lists the names of the properties of this class. filter lists of items from this class, filtered and sorted. Two options are avaible for sorting: 1. by the current *request* filterspec/filter/sort/group args 2. by the "filterspec", "sort" and "group" keyword args. "filterspec" is ``{propname: value(s)}``. "sort" and "group" are an optionally empty list ``[(dir, prop)]`` where dir is '+', '-' or None and prop is a prop name or None. The propname in filterspec and prop in a sort/group spec may be transitive, i.e., it may contain properties of the form link.link.link.name. eg. All issues with a priority of "1" with messages added in the last week, sorted by activity date: ``issue.filter(filterspec={"priority": "1", 'messages.creation' : '.-1w;'}, sort=[('activity', '+')])`` filter_sql **Only in SQL backends** Lists the items that match the SQL provided. The SQL is a complete "select" statement. The SQL select must include the item id as the first column. This function **does not** filter out retired items, add on a where clause "__retired__ <> 1" if you don't want retired nodes. classhelp display a link to a javascript popup containing this class' "help" template. This generates a link to a popup window which displays the properties indicated by "properties" of the class named by "classname". The "properties" should be a comma-separated list (eg. 'id,name,description'). Properties defaults to all the properties of a class (excluding id, creator, created and activity). You may optionally override the "label" displayed, the "width", the "height", the number of items per page ("pagesize") and the field on which the list is sorted ("sort"). With the "filter" arg it is possible to specify a filter for which items are supposed to be displayed. It has to be of the format "=;=;...". The popup window will be resizable and scrollable. If the "property" arg is given, it's passed through to the javascript help_window function. This allows updating of a property in the calling HTML page. If the "form" arg is given, it's passed through to the javascript help_window function - it's the name of the form the "property" belongs to. submit generate a submit button (and action hidden element) renderWith render this class with the given template. history returns 'New node - no history' :) is_edit_ok is the user allowed to Edit the current class? is_view_ok is the user allowed to View the current class? =========== ============================================================= Note that if you have a property of the same name as one of the above methods, you'll need to access it using a python "item access" expression. For example:: python:context['list'] will access the "list" property, rather than the list method. Hyperdb item wrapper :::::::::::::::::::: This is implemented by the ``roundup.cgi.templating.HTMLItem`` class. This wrapper object provides access to a hyperb item. We allow access to properties. There will be no "id" property. The value accessed through the property will be the current value of the same name from the CGI form. There are several methods available on these wrapper objects: =============== ======================================================== Method Description =============== ======================================================== submit generate a submit button (and action hidden element) journal return the journal of the current item (**not implemented**) history render the journal of the current item as HTML renderQueryForm specific to the "query" class - render the search form for the query hasPermission specific to the "user" class - determine whether the user has a Permission. The signature is:: hasPermission(self, permission, [classname=], [property=], [itemid=]) where the classname defaults to the current context. hasRole specific to the "user" class - determine whether the user has a Role. The signature is:: hasRole(self, rolename) is_edit_ok is the user allowed to Edit the current item? is_view_ok is the user allowed to View the current item? is_retired is the item retired? download_url generate a url-quoted link for download of FileClass item contents (ie. file/) copy_url generate a url-quoted link for creating a copy of this item. By default, the copy will acquire all properties of the current item except for ``messages`` and ``files``. This can be overridden by passing ``exclude`` argument which contains a list (or any iterable) of property names that shall not be copied. Database-driven properties like ``id`` or ``activity`` cannot be copied. =============== ======================================================== Note that if you have a property of the same name as one of the above methods, you'll need to access it using a python "item access" expression. For example:: python:context['journal'] will access the "journal" property, rather than the journal method. Hyperdb property wrapper :::::::::::::::::::::::: This is implemented by subclasses of the ``roundup.cgi.templating.HTMLProperty`` class (``HTMLStringProperty``, ``HTMLNumberProperty``, and so on). This wrapper object provides access to a single property of a class. Its value may be either: 1. if accessed through a `hyperdb item wrapper`_, then it's a value from the hyperdb 2. if access through a `hyperdb class wrapper`_, then it's a value from the CGI form The property wrapper has some useful attributes: =============== ======================================================== Attribute Description =============== ======================================================== _name the name of the property _value the value of the property if any - this is the actual value retrieved from the hyperdb for this property =============== ======================================================== There are several methods available on these wrapper objects: =========== ================================================================ Method Description =========== ================================================================ plain render a "plain" representation of the property. This method may take two arguments: escape If true, escape the text so it is HTML safe (default: no). The reason this defaults to off is that text is usually escaped at a later stage by the TAL commands, unless the "structure" option is used in the template. The following ``tal:content`` expressions are all equivalent:: "structure python:msg.content.plain(escape=1)" "python:msg.content.plain()" "msg/content/plain" "msg/content" Usually you'll only want to use the escape option in a complex expression. hyperlink If true, turn URLs, email addresses and hyperdb item designators in the text into hyperlinks (default: no). Note that you'll need to use the "structure" TAL option if you want to use this ``tal:content`` expression:: "structure python:msg.content.plain(hyperlink=1)" The text is automatically HTML-escaped before the hyperlinking transformation done in the plain() method. hyperlinked The same as msg.content.plain(hyperlink=1), but nicer:: "structure msg/content/hyperlinked" field render an appropriate form edit field for the property - for most types this is a text entry box, but for Booleans it's a tri-state yes/no/neither selection. This method may take some arguments: size Sets the width in characters of the edit field format (Date properties only) Sets the format of the date in the field - uses the same format string argument as supplied to the ``pretty`` method below. popcal (Date properties only) Include the Javascript-based popup calendar for date selection. Defaults to on. stext only on String properties - render the value of the property as StructuredText (requires the StructureText module to be installed separately) multiline only on String properties - render a multiline form edit field for the property email only on String properties - render the value of the property as an obscured email address confirm only on Password properties - render a second form edit field for the property, used for confirmation that the user typed the password correctly. Generates a field with name "name:confirm". now only on Date properties - return the current date as a new property reldate only on Date properties - render the interval between the date and now local only on Date properties - return this date as a new property with some timezone offset, for example:: python:context.creation.local(10) will render the date with a +10 hour offset. pretty Date properties - render the date as "dd Mon YYYY" (eg. "19 Mar 2004"). Takes an optional format argument, for example:: python:context.activity.pretty('%Y-%m-%d') Will format as "2004-03-19" instead. Interval properties - render the interval in a pretty format (eg. "yesterday"). The format arguments are those used in the standard ``strftime`` call (see the `Python Library Reference: time module`__) popcal Generate a link to a popup calendar which may be used to edit the date field, for example:: you still need to include the ``field`` for the property, so typically you'd have:: menu only on Link and Multilink properties - render a form select list for this property. Takes a number of optional arguments size is used to limit the length of the list labels height is used to set the File   submit button will go here When a change is submitted, the system automatically generates a message describing the changed properties. As shown in the example, the editor template can use the ":note" and ":file" fields, which are added to the standard changenote message generated by Roundup. Form values ::::::::::: We have a number of ways to pull properties out of the form in order to meet the various needs of: 1. editing the current item (perhaps an issue item) 2. editing information related to the current item (eg. messages or attached files) 3. creating new information to be linked to the current item (eg. time spent on an issue) In the following, ```` values are variable, ":" may be one of ":" or "@", and other text ("required") is fixed. Properties are specified as form variables: ```` property on the current context item ``:`` property on the indicated item (for editing related information) ``-:`` property on the Nth new item of classname (generally for creating new items to attach to the current item) Once we have determined the "propname", we check to see if it is one of the special form values: ``@required`` The named property values must be supplied or a ValueError will be raised. ``@remove@=id(s)`` The ids will be removed from the multilink property. ``:add:=id(s)`` The ids will be added to the multilink property. ``:link:=`` Used to add a link to new items created during edit. These are collected and returned in ``all_links``. This will result in an additional linking operation (either Link set or Multilink append) after the edit/create is done using ``all_props`` in ``_editnodes``. The on the current item will be set/appended the id of the newly created item of class (where must be -). Any of the form variables may be prefixed with a classname or designator. Two special form values are supported for backwards compatibility: ``:note`` create a message (with content, author and date), linked to the context item. This is ALWAYS designated "msg-1". ``:file`` create a file, attached to the current item and any message created by :note. This is ALWAYS designated "file-1". Spool Section ~~~~~~~~~~~~~ The spool section lists related information like the messages and files of an issue. TODO History Section ~~~~~~~~~~~~~~~ The final section displayed is the history of the item - its database journal. This is generally generated with the template:: *To be done:* *The actual history entries of the item may be accessed for manual templating through the "journal" method of the item*:: a journal entry *where each journal entry is an HTMLJournalEntry.* Defining new web actions ------------------------ You may define new actions to be triggered by the ``@action`` form variable. These are added to the tracker ``extensions`` directory and registered using ``instance.registerAction``. All the existing Actions are defined in ``roundup.cgi.actions``. Adding action classes takes three steps; first you `define the new action class`_, then you `register the action class`_ with the cgi interface so it may be triggered by the ``@action`` form variable. Finally you `use the new action`_ in your HTML form. See "`setting up a "wizard" (or "druid") for controlled adding of issues`_" for an example. Define the new action class ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Create a new action class in your tracker's ``extensions`` directory, for example ``myaction.py``:: from roundup.cgi.actions import Action class MyAction(Action): def handle(self): ''' Perform some action. No return value is required. ''' The *self.client* attribute is an instance of ``roundup.cgi.client.Client``. See the docstring of that class for details of what it can do. The method will typically check the ``self.form`` variable's contents. It may then: - add information to ``self.client.ok_message`` or ``self.client.error_message`` - change the ``self.client.template`` variable to alter what the user will see next - raise Unauthorised, SendStaticFile, SendFile, NotFound or Redirect exceptions (import them from roundup.cgi.exceptions) Register the action class ~~~~~~~~~~~~~~~~~~~~~~~~~~ The class is now written, but isn't available to the user until you register it with the following code appended to your ``myaction.py`` file:: def init(instance): instance.registerAction('myaction', myActionClass) This maps the action name "myaction" to the action class we defined. Use the new action ~~~~~~~~~~~~~~~~~~ In your HTML form, add a hidden form element like so:: where "myaction" is the name you registered in the previous step. Actions may return content to the user ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Actions generally perform some database manipulation and then pass control on to the rendering of a template in the current context (see `Determining web context`_ for how that works.) Some actions will want to generate the actual content returned to the user. Action methods may return their own content string to be displayed to the user, overriding the templating step. In this situation, we assume that the content is HTML by default. You may override the content type indicated to the user by calling ``setHeader``:: self.client.setHeader('Content-Type', 'text/csv') This example indicates that the value sent back to the user is actually comma-separated value content (eg. something to be loaded into a spreadsheet or database). 8-bit character set support in Web interface -------------------------------------------- The web interface uses UTF-8 default. It may be overridden in both forms and a browser cookie. - In forms, use the ``@charset`` variable. - To use the cookie override, have the ``roundup_charset`` cookie set. In both cases, the value is a valid charset name (eg. ``utf-8`` or ``kio8-r``). Inside Roundup, all strings are stored and processed in utf-8. Unfortunately, some older browsers do not work properly with utf-8-encoded pages (e.g. Netscape Navigator 4 displays wrong characters in form fields). This version allows one to change the character set for http transfers. To do so, you may add the following code to your ``page.html`` template:: utf-8 koi8-r (substitute ``koi8-r`` with appropriate charset for your language). Charset preference is kept in the browser cookie ``roundup_charset``. ``meta http-equiv`` lines added to the tracker templates in version 0.6.0 should be changed to include actual character set name:: The charset is also sent in the http header. Examples ======== .. contents:: :local: :depth: 2 Changing what's stored in the database -------------------------------------- The following examples illustrate ways to change the information stored in the database. Adding a new field to the classic schema ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This example shows how to add a simple field (a due date) to the default classic schema. It does not add any additional behaviour, such as enforcing the due date, or causing automatic actions to fire if the due date passes. You add new fields by editing the ``schema.py`` file in you tracker's home. Schema changes are automatically applied to the database on the next tracker access (note that roundup-server would need to be restarted as it caches the schema). 1. Modify the ``schema.py``:: issue = IssueClass(db, "issue", assignedto=Link("user"), keyword=Multilink("keyword"), priority=Link("priority"), status=Link("status"), due_date=Date()) 2. Add an edit field to the ``issue.item.html`` template:: Due Date If you want to show only the date part of due_date then do this instead:: Due Date 3. Add the property to the ``issue.index.html`` page:: (in the heading row) Due Date (in the data row) If you want format control of the display of the due date you can enter the following in the data row to show only the actual due date::   4. Add the property to the ``issue.search.html`` page:: Due Date: 5. If you wish for the due date to appear in the standard views listed in the sidebar of the web interface then you'll need to add "due_date" to the columns and columns_showall lists in your ``page.html``:: columns string:id,activity,due_date,title,creator,status; columns_showall string:id,activity,due_date,title,creator,assignedto,status; Adding a new constrained field to the classic schema ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This example shows how to add a new constrained property (i.e. a selection of distinct values) to your tracker. Introduction :::::::::::: To make the classic schema of Roundup useful as a TODO tracking system for a group of systems administrators, it needs an extra data field per issue: a category. This would let sysadmins quickly list all TODOs in their particular area of interest without having to do complex queries, and without relying on the spelling capabilities of other sysadmins (a losing proposition at best). Adding a field to the database :::::::::::::::::::::::::::::: This is the easiest part of the change. The category would just be a plain string, nothing fancy. To change what is in the database you need to add some lines to the ``schema.py`` file of your tracker instance. Under the comment:: # add any additional database schema configuration here add:: category = Class(db, "category", name=String()) category.setkey("name") Here we are setting up a chunk of the database which we are calling "category". It contains a string, which we are refering to as "name" for lack of a more imaginative title. (Since "name" is one of the properties that Roundup looks for on items if you do not set a key for them, it's probably a good idea to stick with it for new classes if at all appropriate.) Then we are setting the key of this chunk of the database to be that "name". This is equivalent to an index for database types. This also means that there can only be one category with a given name. Adding the above lines allows us to create categories, but they're not tied to the issues that we are going to be creating. It's just a list of categories off on its own, which isn't much use. We need to link it in with the issues. To do that, find the lines in ``schema.py`` which set up the "issue" class, and then add a link to the category:: issue = IssueClass(db, "issue", ... , category=Multilink("category"), ... ) The ``Multilink()`` means that each issue can have many categories. If you were adding something with a one-to-one relationship to issues (such as the "assignedto" property), use ``Link()`` instead. That is all you need to do to change the schema. The rest of the effort is fiddling around so you can actually use the new category. Populating the new category class ::::::::::::::::::::::::::::::::: If you haven't initialised the database with the ``roundup-admin`` "initialise" command, then you can add the following to the tracker ``initial_data.py`` under the comment:: # add any additional database creation steps here - but only if you # haven't initialised the database with the admin "initialise" command Add:: category = db.getclass('category') category.create(name="scipy") category.create(name="chaco") category.create(name="weave") If the database has already been initalised, then you need to use the ``roundup-admin`` tool:: % roundup-admin -i Roundup ready for input. Type "help" for help. roundup> create category name=scipy 1 roundup> create category name=chaco 2 roundup> create category name=weave 3 roundup> exit... There are unsaved changes. Commit them (y/N)? y Setting up security on the new objects :::::::::::::::::::::::::::::::::::::: By default only the admin user can look at and change objects. This doesn't suit us, as we want any user to be able to create new categories as required, and obviously everyone needs to be able to view the categories of issues for it to be useful. We therefore need to change the security of the category objects. This is also done in ``schema.py``. There are currently two loops which set up permissions and then assign them to various roles. Simply add the new "category" to both lists:: # Assign the access and edit permissions for issue, file and message # to regular users now for cl in 'issue', 'file', 'msg', 'category': p = db.security.getPermission('View', cl) db.security.addPermissionToRole('User', 'View', cl) db.security.addPermissionToRole('User', 'Edit', cl) db.security.addPermissionToRole('User', 'Create', cl) These lines assign the "View" and "Edit" Permissions to the "User" role, so that normal users can view and edit "category" objects. This is all the work that needs to be done for the database. It will store categories, and let users view and edit them. Now on to the interface stuff. Changing the web left hand frame :::::::::::::::::::::::::::::::: We need to give the users the ability to create new categories, and the place to put the link to this functionality is in the left hand function bar, under the "Issues" area. The file that defines how this area looks is ``html/page.html``, which is what we are going to be editing next. If you look at this file you can see that it contains a lot of "classblock" sections which are chunks of HTML that will be included or excluded in the output depending on whether the condition in the classblock is met. We are going to add the category code at the end of the classblock for the *issue* class::

Categories
New Category

The first two lines is the classblock definition, which sets up a condition that only users who have "View" permission for the "category" object will have this section included in their output. Next comes a plain "Categories" header in bold. Everyone who can view categories will get that. Next comes the link to the editing area of categories. This link will only appear if the condition - that the user has "Edit" permissions for the "category" objects - is matched. If they do have permission then they will get a link to another page which will let the user add new categories. Note that if you have permission to *view* but not to *edit* categories, then all you will see is a "Categories" header with nothing underneath it. This is obviously not very good interface design, but will do for now. I just claim that it is so I can add more links in this section later on. However, to fix the problem you could change the condition in the classblock statement, so that only users with "Edit" permission would see the "Categories" stuff. Setting up a page to edit categories :::::::::::::::::::::::::::::::::::: We defined code in the previous section which let users with the appropriate permissions see a link to a page which would let them edit conditions. Now we have to write that page. The link was for the *item* template of the *category* object. This translates into Roundup looking for a file called ``category.item.html`` in the ``html`` tracker directory. This is the file that we are going to write now. First, we add an info tag in a comment which doesn't affect the outcome of the code at all, but is useful for debugging. If you load a page in a browser and look at the page source, you can see which sections come from which files by looking for these comments:: Next we need to add in the METAL macro stuff so we get the normal page trappings:: Category editing

Category editing

Next we need to setup up a standard HTML form, which is the whole purpose of this file. We link to some handy javascript which sends the form through only once. This is to stop users hitting the send button multiple times when they are impatient and thus having the form sent multiple times::
Next we define some code which sets up the minimum list of fields that we require the user to enter. There will be only one field - "name" - so they better put something in it, otherwise the whole form is pointless:: To get everything to line up properly we will put everything in a table, and put a nice big header on it so the user has an idea what is happening:: Next, we need the field into which the user is going to enter the new category. The ``context.name.field(size=60)`` bit tells Roundup to generate a normal HTML field of size 60, and the contents of that field will be the "name" variable of the current context (namely "category"). The upshot of this is that when the user types something in to the form, a new category will be created with that name:: Then a submit button so that the user can submit the new category:: Finally we finish off the tags we used at the start to do the METAL stuff:: So putting it all together, and closing the table and form we get:: Category editing This is quite a lot to just ask the user one simple question, but there is a lot of setup for basically one line (the form line) to do its work. To add another field to "category" would involve one more line (well, maybe a few extra to get the formatting correct). Adding the category to the issue :::::::::::::::::::::::::::::::: We now have the ability to create issues to our heart's content, but that is pointless unless we can assign categories to issues. Just like the ``html/category.item.html`` file was used to define how to add a new category, the ``html/issue.item.html`` is used to define how a new issue is created. Just like ``category.issue.html``, this file defines a form which has a table to lay things out. It doesn't matter where in the table we add new stuff, it is entirely up to your sense of aesthetics:: First, we define a nice header so that the user knows what the next section is, then the middle line does what we are most interested in. This ``context/category/field`` gets replaced by a field which contains the category in the current context (the current context being the new issue). The classhelp lines generate a link (labelled "list") to a popup window which contains the list of currently known categories. Searching on categories ::::::::::::::::::::::: Now we can add categories, and create issues with categories. The next obvious thing that we would like to be able to do, would be to search for issues based on their category, so that, for example, anyone working on the web server could look at all issues in the category "Web". If you look for "Search Issues" in the ``html/page.html`` file, you will find that it looks something like ``Search Issues``. This shows us that when you click on "Search Issues" it will be looking for a ``issue.search.html`` file to display. So that is the file that we will change. If you look at this file it should begin to seem familiar, although it does use some new macros. You can add the new category search code anywhere you like within that form:: The definitions in the ```` opening tag are used by the macros: - ``search_select`` expands to a drop-down box with all categories using ``db_klass`` and ``db_content``. - ``column_input`` expands to a checkbox for selecting what columns should be displayed. - ``sort_input`` expands to a radio button for selecting what property should be sorted on. - ``group_input`` expands to a radio button for selecting what property should be grouped on. The category search code above would expand to the following:: Adding category to the default view ::::::::::::::::::::::::::::::::::: We can now add categories, add issues with categories, and search for issues based on categories. This is everything that we need to do; however, there is some more icing that we would like. I think the category of an issue is important enough that it should be displayed by default when listing all the issues. Unfortunately, this is a bit less obvious than the previous steps. The code defining how the issues look is in ``html/issue.index.html``. This is a large table with a form down at the bottom for redisplaying and so forth. Firstly we need to add an appropriate header to the start of the table:: The *condition* part of this statement is to avoid displaying the Category column if the user has selected not to see it. The rest of the table is a loop which will go through every issue that matches the display criteria. The loop variable is "i" - which means that every issue gets assigned to "i" in turn. The new part of code to display the category will look like this:: The condition is the same as above: only display the condition when the user hasn't asked for it to be hidden. The next part is to set the content of the cell to be the category part of "i" - the current issue. Finally we have to edit ``html/page.html`` again. This time, we need to tell it that when the user clicks on "Unassigned Issues" or "All Issues", the category column should be included in the resulting list. If you scroll down the page file, you can see the links with lots of options. The option that we are interested in is the ``:columns=`` one which tells roundup which fields of the issue to display. Simply add "category" to that list and it all should work. Adding a time log to your issues ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ We want to log the dates and amount of time spent working on issues, and be able to give a summary of the total time spent on a particular issue. 1. Add a new class to your tracker ``schema.py``:: # storage for time logging timelog = Class(db, "timelog", period=Interval()) Note that we automatically get the date of the time log entry creation through the standard property "creation". You will need to grant "Creation" permission to the users who are allowed to add timelog entries. You may do this with:: db.security.addPermissionToRole('User', 'Create', 'timelog') db.security.addPermissionToRole('User', 'View', 'timelog') If users are also able to *edit* timelog entries, then also include:: db.security.addPermissionToRole('User', 'Edit', 'timelog') 2. Link to the new class from your issue class (again, in ``schema.py``):: issue = IssueClass(db, "issue", assignedto=Link("user"), keyword=Multilink("keyword"), priority=Link("priority"), status=Link("status"), times=Multilink("timelog")) the "times" property is the new link to the "timelog" class. 3. We'll need to let people add in times to the issue, so in the web interface we'll have a new entry field. This is a special field because unlike the other fields in the ``issue.item`` template, it affects a different item (a timelog item) and not the template's item (an issue). We have a special syntax for form fields that affect items other than the template default item (see the cgi documentation on `special form variables`_). In particular, we add a field to capture a new timelog item's period:: and another hidden field that links that new timelog item (new because it's marked as having id "-1") to the issue item. It looks like this:: On submission, the "-1" timelog item will be created and assigned a real item id. The "times" property of the issue will have the new id added to it. The full entry will now look like this:: 4. We want to display a total of the timelog times that have been accumulated for an issue. To do this, we'll need to actually write some Python code, since it's beyond the scope of PageTemplates to perform such calculations. We do this by adding a module ``timespent.py`` to the ``extensions`` directory in our tracker. The contents of this file is as follows:: from roundup import date def totalTimeSpent(times): ''' Call me with a list of timelog items (which have an Interval "period" property) ''' total = date.Interval('0d') for time in times: total += time.period._value return total def init(instance): instance.registerUtil('totalTimeSpent', totalTimeSpent) We will now be able to access the ``totalTimeSpent`` function via the ``utils`` variable in our templates, as shown in the next step. 5. Display the timelog for an issue::
Category
Name name
  submit button will go here

Category editing
Category
Name name
  submit button will go here
Category
Priority:
Category:
Category
Time Log (enter as '3y 1m 4d 2:40:02' or parts thereof)
Time Log (enter as '3y 1m 4d 2:40:02' or parts thereof)
Time Log
DatePeriodLogged By
I put this just above the Messages log in my issue display. Note our use of the ``totalTimeSpent`` method which will total up the times for the issue and return a new Interval. That will be automatically displayed in the template as text like "+ 1y 2:40" (1 year, 2 hours and 40 minutes). 6. If you're using a persistent web server - ``roundup-server`` or ``mod_python`` for example - then you'll need to restart that to pick up the code changes. When that's done, you'll be able to use the new time logging interface. An extension of this modification attaches the timelog entries to any change message entered at the time of the timelog entry: A. Add a link to the timelog to the msg class in ``schema.py``: msg = FileClass(db, "msg", author=Link("user", do_journal='no'), recipients=Multilink("user", do_journal='no'), date=Date(), summary=String(), files=Multilink("file"), messageid=String(), inreplyto=String(), times=Multilink("timelog")) B. Add a new hidden field that links that new timelog item (new because it's marked as having id "-1") to the new message. The link is placed in ``issue.item.html`` in the same section that handles the timelog entry. It looks like this after this addition:: Time Log (enter as '3y 1m 4d 2:40:02' or parts thereof) The "times" property of the message will have the new id added to it. C. Add the timelog listing from step 5. to the ``msg.item.html`` template so that the timelog entry appears on the message view page. Note that the call to totalTimeSpent is not used here since there will only be one single timelog entry for each message. I placed it after the Date entry like this:: Date:
Time Log
DatePeriodLogged By
Tracking different types of issues ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Sometimes you will want to track different types of issues - developer, customer support, systems, sales leads, etc. A single Roundup tracker is able to support multiple types of issues. This example demonstrates adding a system support issue class to a tracker. 1. Figure out what information you're going to want to capture. OK, so this is obvious, but sometimes it's better to actually sit down for a while and think about the schema you're going to implement. 2. Add the new issue class to your tracker's ``schema.py``. Just after the "issue" class definition, add:: # list our systems system = Class(db, "system", name=String(), order=Number()) system.setkey("name") # store issues related to those systems support = IssueClass(db, "support", assignedto=Link("user"), keyword=Multilink("keyword"), status=Link("status"), deadline=Date(), affects=Multilink("system")) 3. Copy the existing ``issue.*`` (item, search and index) templates in the tracker's ``html`` to ``support.*``. Edit them so they use the properties defined in the ``support`` class. Be sure to check for hidden form variables like "required" to make sure they have the correct set of required properties. 4. Edit the modules in the ``detectors``, adding lines to their ``init`` functions where appropriate. Look for ``audit`` and ``react`` registrations on the ``issue`` class, and duplicate them for ``support``. 5. Create a new sidebar box for the new support class. Duplicate the existing issues one, changing the ``issue`` class name to ``support``. 6. Re-start your tracker and start using the new ``support`` class. Optionally, you might want to restrict the users able to access this new class to just the users with a new "SysAdmin" Role. To do this, we add some security declarations:: db.security.addPermissionToRole('SysAdmin', 'View', 'support') db.security.addPermissionToRole('SysAdmin', 'Create', 'support') db.security.addPermissionToRole('SysAdmin', 'Edit', 'support') You would then (as an "admin" user) edit the details of the appropriate users, and add "SysAdmin" to their Roles list. Alternatively, you might want to change the Edit/View permissions granted for the ``issue`` class so that it's only available to users with the "System" or "Developer" Role, and then the new class you're adding is available to all with the "User" Role. Using External User Databases ----------------------------- Using an external password validation source ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ .. note:: You will need to either have an "admin" user in your external password source *or* have one of your regular users have the Admin Role assigned. If you need to assign the Role *after* making the changes below, you may use the ``roundup-admin`` program to edit a user's details. We have a centrally-managed password changing system for our users. This results in a UN*X passwd-style file that we use for verification of users. Entries in the file consist of ``name:password`` where the password is encrypted using the standard UN*X ``crypt()`` function (see the ``crypt`` module in your Python distribution). An example entry would be:: admin:aamrgyQfDFSHw Each user of Roundup must still have their information stored in the Roundup database - we just use the passwd file to check their password. To do this, we need to override the standard ``verifyPassword`` method defined in ``roundup.cgi.actions.LoginAction`` and register the new class. The following is added as ``externalpassword.py`` in the tracker ``extensions`` directory:: import os, crypt from roundup.cgi.actions import LoginAction class ExternalPasswordLoginAction(LoginAction): def verifyPassword(self, userid, password): '''Look through the file, line by line, looking for a name that matches. ''' # get the user's username username = self.db.user.get(userid, 'username') # the passwords are stored in the "passwd.txt" file in the # tracker home file = os.path.join(self.db.config.TRACKER_HOME, 'passwd.txt') # see if we can find a match for ent in [line.strip().split(':') for line in open(file).readlines()]: if ent[0] == username: return crypt.crypt(password, ent[1][:2]) == ent[1] # user doesn't exist in the file return 0 def init(instance): instance.registerAction('login', ExternalPasswordLoginAction) You should also remove the redundant password fields from the ``user.item`` template. Using a UN*X passwd file as the user database ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ On some systems the primary store of users is the UN*X passwd file. It holds information on users such as their username, real name, password and primary user group. Roundup can use this store as its primary source of user information, but it needs additional information too - email address(es), roundup Roles, vacation flags, roundup hyperdb item ids, etc. Also, "retired" users must still exist in the user database, unlike some passwd files in which the users are removed when they no longer have access to a system. To make use of the passwd file, we therefore synchronise between the two user stores. We also use the passwd file to validate the user logins, as described in the previous example, `using an external password validation source`_. We keep the user lists in sync using a fairly simple script that runs once a day, or several times an hour if more immediate access is needed. In short, it: 1. parses the passwd file, finding usernames, passwords and real names, 2. compares that list to the current roundup user list: a. entries no longer in the passwd file are *retired* b. entries with mismatching real names are *updated* c. entries only exist in the passwd file are *created* 3. send an email to administrators to let them know what's been done. The retiring and updating are simple operations, requiring only a call to ``retire()`` or ``set()``. The creation operation requires more information though - the user's email address and their Roundup Roles. We're going to assume that the user's email address is the same as their login name, so we just append the domain name to that. The Roles are determined using the passwd group identifier - mapping their UN*X group to an appropriate set of Roles. The script to perform all this, broken up into its main components, is as follows. Firstly, we import the necessary modules and open the tracker we're to work on:: import sys, os, smtplib from roundup import instance, date # open the tracker tracker_home = sys.argv[1] tracker = instance.open(tracker_home) Next we read in the *passwd* file from the tracker home:: # read in the users from the "passwd.txt" file file = os.path.join(tracker_home, 'passwd.txt') users = [x.strip().split(':') for x in open(file).readlines()] Handle special users (those to ignore in the file, and those who don't appear in the file):: # users to not keep ever, pre-load with the users I know aren't # "real" users ignore = ['ekmmon', 'bfast', 'csrmail'] # users to keep - pre-load with the roundup-specific users keep = ['comment_pool', 'network_pool', 'admin', 'dev-team', 'cs_pool', 'anonymous', 'system_pool', 'automated'] Now we map the UN*X group numbers to the Roles that users should have:: roles = { '501': 'User,Tech', # tech '502': 'User', # finance '503': 'User,CSR', # customer service reps '504': 'User', # sales '505': 'User', # marketing } Now we do all the work. Note that the body of the script (where we have the tracker database open) is wrapped in a ``try`` / ``finally`` clause, so that we always close the database cleanly when we're finished. So, we now do all the work:: # open the database db = tracker.open('admin') try: # store away messages to send to the tracker admins msg = [] # loop over the users list read in from the passwd file for user,passw,uid,gid,real,home,shell in users: if user in ignore: # this user shouldn't appear in our tracker continue keep.append(user) try: # see if the user exists in the tracker uid = db.user.lookup(user) # yes, they do - now check the real name for correctness if real != db.user.get(uid, 'realname'): db.user.set(uid, realname=real) msg.append('FIX %s - %s'%(user, real)) except KeyError: # nope, the user doesn't exist db.user.create(username=user, realname=real, address='%s@ekit-inc.com'%user, roles=roles[gid]) msg.append('ADD %s - %s (%s)'%(user, real, roles[gid])) # now check that all the users in the tracker are also in our # "keep" list - retire those who aren't for uid in db.user.list(): user = db.user.get(uid, 'username') if user not in keep: db.user.retire(uid) msg.append('RET %s'%user) # if we did work, then send email to the tracker admins if msg: # create the email msg = '''Subject: %s user database maintenance %s '''%(db.config.TRACKER_NAME, '\n'.join(msg)) # send the email smtp = smtplib.SMTP(db.config.MAILHOST) addr = db.config.ADMIN_EMAIL smtp.sendmail(addr, addr, msg) # now we're done - commit the changes db.commit() finally: # always close the database cleanly db.close() And that's it! Using an LDAP database for user information ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ A script that reads users from an LDAP store using http://python-ldap.sf.net/ and then compares the list to the users in the roundup user database would be pretty easy to write. You'd then have it run once an hour / day (or on demand if you can work that into your LDAP store workflow). See the example `Using a UN*X passwd file as the user database`_ for more information about doing this. To authenticate off the LDAP store (rather than using the passwords in the Roundup user database) you'd use the same python-ldap module inside an extension to the cgi interface. You'd do this by overriding the method called ``verifyPassword`` on the ``LoginAction`` class in your tracker's ``extensions`` directory (see `using an external password validation source`_). The method is implemented by default as:: def verifyPassword(self, userid, password): ''' Verify the password that the user has supplied ''' stored = self.db.user.get(self.userid, 'password') if password == stored: return 1 if not password and not stored: return 1 return 0 So you could reimplement this as something like:: def verifyPassword(self, userid, password): ''' Verify the password that the user has supplied ''' # look up some unique LDAP information about the user username = self.db.user.get(self.userid, 'username') # now verify the password supplied against the LDAP store Changes to Tracker Behaviour ---------------------------- Preventing SPAM ~~~~~~~~~~~~~~~ The following detector code may be installed in your tracker's ``detectors`` directory. It will block any messages being created that have HTML attachments (a very common vector for spam and phishing) and any messages that have more than 2 HTTP URLs in them. Just copy the following into ``detectors/anti_spam.py`` in your tracker:: from roundup.exceptions import Reject def reject_html(db, cl, nodeid, newvalues): if newvalues['type'] == 'text/html': raise Reject, 'not allowed' def reject_manylinks(db, cl, nodeid, newvalues): content = newvalues['content'] if content.count('http://') > 2: raise Reject, 'not allowed' def init(db): db.file.audit('create', reject_html) db.msg.audit('create', reject_manylinks) You may also wish to block image attachments if your tracker does not need that ability:: if newvalues['type'].startswith('image/'): raise Reject, 'not allowed' Stop "nosy" messages going to people on vacation ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ When users go on vacation and set up vacation email bouncing, you'll start to see a lot of messages come back through Roundup "Fred is on vacation". Not very useful, and relatively easy to stop. 1. add a "vacation" flag to your users:: user = Class(db, "user", username=String(), password=Password(), address=String(), realname=String(), phone=String(), organisation=String(), alternate_addresses=String(), roles=String(), queries=Multilink("query"), vacation=Boolean()) 2. So that users may edit the vacation flags, add something like the following to your ``user.item`` template:: 3. edit your detector ``nosyreactor.py`` so that the ``nosyreaction()`` consists of:: def nosyreaction(db, cl, nodeid, oldvalues): users = db.user messages = db.msg # send a copy of all new messages to the nosy list for msgid in determineNewMessages(cl, nodeid, oldvalues): try: # figure the recipient ids sendto = [] seen_message = {} recipients = messages.get(msgid, 'recipients') for recipid in messages.get(msgid, 'recipients'): seen_message[recipid] = 1 # figure the author's id, and indicate they've received # the message authid = messages.get(msgid, 'author') # possibly send the message to the author, as long as # they aren't anonymous if (db.config.MESSAGES_TO_AUTHOR == 'yes' and users.get(authid, 'username') != 'anonymous'): sendto.append(authid) seen_message[authid] = 1 # now figure the nosy people who weren't recipients nosy = cl.get(nodeid, 'nosy') for nosyid in nosy: # Don't send nosy mail to the anonymous user (that # user shouldn't appear in the nosy list, but just # in case they do...) if users.get(nosyid, 'username') == 'anonymous': continue # make sure they haven't seen the message already if not seen_message.has_key(nosyid): # send it to them sendto.append(nosyid) recipients.append(nosyid) # generate a change note if oldvalues: note = cl.generateChangeNote(nodeid, oldvalues) else: note = cl.generateCreateNote(nodeid) # we have new recipients if sendto: # filter out the people on vacation sendto = [i for i in sendto if not users.get(i, 'vacation', 0)] # map userids to addresses sendto = [users.get(i, 'address') for i in sendto] # update the message's recipients list messages.set(msgid, recipients=recipients) # send the message cl.send_message(nodeid, msgid, note, sendto) except roundupdb.MessageSendError, message: raise roundupdb.DetectorError, message Note that this is the standard nosy reaction code, with the small addition of:: # filter out the people on vacation sendto = [i for i in sendto if not users.get(i, 'vacation', 0)] which filters out the users that have the vacation flag set to true. Adding in state transition control ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Sometimes tracker admins want to control the states to which users may move issues. You can do this by following these steps: 1. make "status" a required variable. This is achieved by adding the following to the top of the form in the ``issue.item.html`` template:: This will force users to select a status. 2. add a Multilink property to the status class:: stat = Class(db, "status", ... , transitions=Multilink('status'), ...) and then edit the statuses already created, either: a. through the web using the class list -> status class editor, or b. using the ``roundup-admin`` "set" command. 3. add an auditor module ``checktransition.py`` in your tracker's ``detectors`` directory, for example:: def checktransition(db, cl, nodeid, newvalues): ''' Check that the desired transition is valid for the "status" property. ''' if not newvalues.has_key('status'): return current = cl.get(nodeid, 'status') new = newvalues['status'] if new == current: return ok = db.status.get(current, 'transitions') if new not in ok: raise ValueError, 'Status not allowed to move from "%s" to "%s"'%( db.status.get(current, 'name'), db.status.get(new, 'name')) def init(db): db.issue.audit('set', checktransition) 4. in the ``issue.item.html`` template, change the status editing bit from:: to:: which displays only the allowed status to transition to. Blocking issues that depend on other issues ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ We needed the ability to mark certain issues as "blockers" - that is, they can't be resolved until another issue (the blocker) they rely on is resolved. To achieve this: 1. Create a new property on the ``issue`` class: ``blockers=Multilink("issue")``. To do this, edit the definition of this class in your tracker's ``schema.py`` file. Change this:: issue = IssueClass(db, "issue", assignedto=Link("user"), keyword=Multilink("keyword"), priority=Link("priority"), status=Link("status")) to this, adding the blockers entry:: issue = IssueClass(db, "issue", blockers=Multilink("issue"), assignedto=Link("user"), keyword=Multilink("keyword"), priority=Link("priority"), status=Link("status")) 2. Add the new ``blockers`` property to the ``issue.item.html`` edit page, using something like:: You'll need to fiddle with your item page layout to find an appropriate place to put it - I'll leave that fun part up to you. Just make sure it appears in the first table, possibly somewhere near the "superseders" field. 3. Create a new detector module (see below) which enforces the rules: - issues may not be resolved if they have blockers - when a blocker is resolved, it's removed from issues it blocks The contents of the detector should be something like this:: def blockresolution(db, cl, nodeid, newvalues): ''' If the issue has blockers, don't allow it to be resolved. ''' if nodeid is None: blockers = [] else: blockers = cl.get(nodeid, 'blockers') blockers = newvalues.get('blockers', blockers) # don't do anything if there's no blockers or the status hasn't # changed if not blockers or not newvalues.has_key('status'): return # get the resolved state ID resolved_id = db.status.lookup('resolved') # format the info u = db.config.TRACKER_WEB s = ', '.join(['%s'%( u,id,id) for id in blockers]) if len(blockers) == 1: s = 'issue %s is'%s else: s = 'issues %s are'%s # ok, see if we're trying to resolve if newvalues['status'] == resolved_id: raise ValueError, "This issue can't be resolved until %s resolved."%s def resolveblockers(db, cl, nodeid, oldvalues): ''' When we resolve an issue that's a blocker, remove it from the blockers list of the issue(s) it blocks. ''' newstatus = cl.get(nodeid,'status') # no change? if oldvalues.get('status', None) == newstatus: return resolved_id = db.status.lookup('resolved') # interesting? if newstatus != resolved_id: return # yes - find all the blocked issues, if any, and remove me from # their blockers list issues = cl.find(blockers=nodeid) for issueid in issues: blockers = cl.get(issueid, 'blockers') if nodeid in blockers: blockers.remove(nodeid) cl.set(issueid, blockers=blockers) def init(db): # might, in an obscure situation, happen in a create db.issue.audit('create', blockresolution) db.issue.audit('set', blockresolution) # can only happen on a set db.issue.react('set', resolveblockers) Put the above code in a file called "blockers.py" in your tracker's "detectors" directory. 4. Finally, and this is an optional step, modify the tracker web page URLs so they filter out issues with any blockers. You do this by adding an additional filter on "blockers" for the value "-1". For example, the existing "Show All" link in the "page" template (in the tracker's "html" directory) looks like this:: Show All
modify it to add the "blockers" info to the URL (note, both the "@filter" *and* "blockers" values must be specified):: Show All
The above examples are line-wrapped on the trailing & and should be unwrapped. That's it. You should now be able to set blockers on your issues. Note that if you want to know whether an issue has any other issues dependent on it (i.e. it's in their blockers list) you can look at the journal history at the bottom of the issue page - look for a "link" event to another issue's "blockers" property. Add users to the nosy list based on the keyword ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Let's say we need the ability to automatically add users to the nosy list based on the occurance of a keyword. Every user should be allowed to edit their own list of keywords for which they want to be added to the nosy list. Below, we'll show that this change can be done with minimal understanding of the Roundup system, using only copy and paste. This requires three changes to the tracker: a change in the database to allow per-user recording of the lists of keywords for which he wants to be put on the nosy list, a change in the user view allowing them to edit this list of keywords, and addition of an auditor which updates the nosy list when a keyword is set. Adding the nosy keyword list :::::::::::::::::::::::::::: The change to make in the database, is that for any user there should be a list of keywords for which he wants to be put on the nosy list. Adding a ``Multilink`` of ``keyword`` seems to fullfill this. As such, all that has to be done is to add a new field to the definition of ``user`` within the file ``schema.py``. We will call this new field ``nosy_keywords``, and the updated definition of user will be:: user = Class(db, "user", username=String(), password=Password(), address=String(), realname=String(), phone=String(), organisation=String(), alternate_addresses=String(), queries=Multilink('query'), roles=String(), timezone=String(), nosy_keywords=Multilink('keyword')) Changing the user view to allow changing the nosy keyword list :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: We want any user to be able to change the list of keywords for which he will by default be added to the nosy list. We choose to add this to the user view, as is generated by the file ``html/user.item.html``. We can easily see that the keyword field in the issue view has very similar editing requirements as our nosy keywords, both being lists of keywords. As such, we look for Keywords in ``issue.item.html``, and extract the associated parts from there. We add this to ``user.item.html`` at the bottom of the list of viewed items (i.e. just below the 'Alternate E-mail addresses' in the classic template):: Addition of an auditor to update the nosy list :::::::::::::::::::::::::::::::::::::::::::::: The more difficult part is the logic to add the users to the nosy list when required. We choose to perform this action whenever the keywords on an item are set (this includes the creation of items). Here we choose to start out with a copy of the ``detectors/nosyreaction.py`` detector, which we copy to the file ``detectors/nosy_keyword_reaction.py``. This looks like a good start as it also adds users to the nosy list. A look through the code reveals that the ``nosyreaction`` function actually sends the e-mail. We don't need this. Therefore, we can change the ``init`` function to:: def init(db): db.issue.audit('create', update_kw_nosy) db.issue.audit('set', update_kw_nosy) After that, we rename the ``updatenosy`` function to ``update_kw_nosy``. The first two blocks of code in that function relate to setting ``current`` to a combination of the old and new nosy lists. This functionality is left in the new auditor. The following block of code, which handled adding the assignedto user(s) to the nosy list in ``updatenosy``, should be replaced by a block of code to add the interested users to the nosy list. We choose here to loop over all new keywords, than looping over all users, and assign the user to the nosy list when the keyword occurs in the user's ``nosy_keywords``. The next part in ``updatenosy`` -- adding the author and/or recipients of a message to the nosy list -- is obviously not relevant here and is thus deleted from the new auditor. The last part, copying the new nosy list to ``newvalues``, can stay as is. This results in the following function:: def update_kw_nosy(db, cl, nodeid, newvalues): '''Update the nosy list for changes to the keywords ''' # nodeid will be None if this is a new node current = {} if nodeid is None: ok = ('new', 'yes') else: ok = ('yes',) # old node, get the current values from the node if they haven't # changed if not newvalues.has_key('nosy'): nosy = cl.get(nodeid, 'nosy') for value in nosy: if not current.has_key(value): current[value] = 1 # if the nosy list changed in this transaction, init from the new value if newvalues.has_key('nosy'): nosy = newvalues.get('nosy', []) for value in nosy: if not db.hasnode('user', value): continue if not current.has_key(value): current[value] = 1 # add users with keyword in nosy_keywords to the nosy list if newvalues.has_key('keyword') and newvalues['keyword'] is not None: keyword_ids = newvalues['keyword'] for keyword in keyword_ids: # loop over all users, # and assign user to nosy when keyword in nosy_keywords for user_id in db.user.list(): nosy_kw = db.user.get(user_id, "nosy_keywords") found = 0 for kw in nosy_kw: if kw == keyword: found = 1 if found: current[user_id] = 1 # that's it, save off the new nosy list newvalues['nosy'] = current.keys() These two function are the only ones needed in the file. TODO: update this example to use the ``find()`` Class method. Caveats ::::::: A few problems with the design here can be noted: Multiple additions When a user, after automatic selection, is manually removed from the nosy list, he is added to the nosy list again when the keyword list of the issue is updated. A better design might be to only check which keywords are new compared to the old list of keywords, and only add users when they have indicated interest on a new keyword. The code could also be changed to only trigger on the ``create()`` event, rather than also on the ``set()`` event, thus only setting the nosy list when the issue is created. Scalability In the auditor, there is a loop over all users. For a site with only few users this will pose no serious problem; however, with many users this will be a serious performance bottleneck. A way out would be to link from the keywords to the users who selected these keywords as nosy keywords. This will eliminate the loop over all users. Changes to Security and Permissions ----------------------------------- Restricting the list of users that are assignable to a task ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1. In your tracker's ``schema.py``, create a new Role, say "Developer":: db.security.addRole(name='Developer', description='A developer') 2. Just after that, create a new Permission, say "Fixer", specific to "issue":: p = db.security.addPermission(name='Fixer', klass='issue', description='User is allowed to be assigned to fix issues') 3. Then assign the new Permission to your "Developer" Role:: db.security.addPermissionToRole('Developer', p) 4. In the issue item edit page (``html/issue.item.html`` in your tracker directory), use the new Permission in restricting the "assignedto" list:: For extra security, you may wish to setup an auditor to enforce the Permission requirement (install this as ``assignedtoFixer.py`` in your tracker ``detectors`` directory):: def assignedtoMustBeFixer(db, cl, nodeid, newvalues): ''' Ensure the assignedto value in newvalues is used with the Fixer Permission ''' if not newvalues.has_key('assignedto'): # don't care return # get the userid userid = newvalues['assignedto'] if not db.security.hasPermission('Fixer', userid, cl.classname): raise ValueError, 'You do not have permission to edit %s'%cl.classname def init(db): db.issue.audit('set', assignedtoMustBeFixer) db.issue.audit('create', assignedtoMustBeFixer) So now, if an edit action attempts to set "assignedto" to a user that doesn't have the "Fixer" Permission, the error will be raised. Users may only edit their issues ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In this case, users registering themselves are granted Provisional access, meaning they have access to edit the issues they submit, but not others. We create a new Role called "Provisional User" which is granted to newly-registered users, and has limited access. One of the Permissions they have is the new "Edit Own" on issues (regular users have "Edit".) First up, we create the new Role and Permission structure in ``schema.py``:: # # New users not approved by the admin # db.security.addRole(name='Provisional User', description='New user registered via web or email') # These users need to be able to view and create issues but only edit # and view their own db.security.addPermissionToRole('Provisional User', 'Create', 'issue') def own_issue(db, userid, itemid): '''Determine whether the userid matches the creator of the issue.''' return userid == db.issue.get(itemid, 'creator') p = db.security.addPermission(name='Edit', klass='issue', check=own_issue, description='Can only edit own issues') db.security.addPermissionToRole('Provisional User', p) p = db.security.addPermission(name='View', klass='issue', check=own_issue, description='Can only view own issues') db.security.addPermissionToRole('Provisional User', p) # Assign the Permissions for issue-related classes for cl in 'file', 'msg', 'query', 'keyword': db.security.addPermissionToRole('Provisional User', 'View', cl) db.security.addPermissionToRole('Provisional User', 'Edit', cl) db.security.addPermissionToRole('Provisional User', 'Create', cl) for cl in 'priority', 'status': db.security.addPermissionToRole('Provisional User', 'View', cl) # and give the new users access to the web and email interface db.security.addPermissionToRole('Provisional User', 'Web Access') db.security.addPermissionToRole('Provisional User', 'Email Access') # make sure they can view & edit their own user record def own_record(db, userid, itemid): '''Determine whether the userid matches the item being accessed.''' return userid == itemid p = db.security.addPermission(name='View', klass='user', check=own_record, description="User is allowed to view their own user details") db.security.addPermissionToRole('Provisional User', p) p = db.security.addPermission(name='Edit', klass='user', check=own_record, description="User is allowed to edit their own user details") db.security.addPermissionToRole('Provisional User', p) Then, in ``config.ini``, we change the Role assigned to newly-registered users, replacing the existing ``'User'`` values:: [main] ... new_web_user_roles = 'Provisional User' new_email_user_roles = 'Provisional User' All users may only view and edit issues, files and messages they create ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Replace the standard "classic" tracker View and Edit Permission assignments for the "issue", "file" and "msg" classes with the following:: def checker(klass): def check(db, userid, itemid, klass=klass): return db.getclass(klass).get(itemid, 'creator') == userid return check for cl in 'issue', 'file', 'msg': p = db.security.addPermission(name='View', klass=cl, check=checker(cl)) db.security.addPermissionToRole('User', p) p = db.security.addPermission(name='Edit', klass=cl, check=checker(cl)) db.security.addPermissionToRole('User', p) db.security.addPermissionToRole('User', 'Create', cl) Changes to the Web User Interface --------------------------------- Adding action links to the index page ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Add a column to the ``item.index.html`` template. Resolving the issue:: resolve "Take" the issue:: take ... and so on. Colouring the rows in the issue index according to priority ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ A simple ``tal:attributes`` statement will do the bulk of the work here. In the ``issue.index.html`` template, add this to the ```` that displays the rows of data:: and then in your stylesheet (``style.css``) specify the colouring for the different priorities, as follows:: tr.priority-critical td { background-color: red; } tr.priority-urgent td { background-color: orange; } and so on, with far less offensive colours :) Editing multiple items in an index view ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To edit the status of all items in the item index view, edit the ``issue.item.html``: 1. add a form around the listing table (separate from the existing index-page form), so at the top it reads::
On Vacation vacation
Status statusStatus Waiting On
View:
Nosy Keywords
and at the bottom of that table::
`` from the list table, not the navigation table or the subsequent form table. 2. in the display for the issue property, change::   to::   this will result in an edit field for the status property. 3. after the ``tal:block`` which lists the index items (marked by ``tal:repeat="i batch"``) add a new table row:: which gives us a submit button, indicates that we are performing an edit on any changed statuses. The final ``tal:block`` will make sure that the current index view parameters (filtering, columns, etc) will be used in rendering the next page (the results of the editing). Displaying only message summaries in the issue display ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Alter the ``issue.item`` template section for messages to::
Messages
author date summary remove
Enabling display of either message summaries or the entire messages ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This is pretty simple - all we need to do is copy the code from the example `displaying only message summaries in the issue display`_ into our template alongside the summary display, and then introduce a switch that shows either the one or the other. We'll use a new form variable, ``@whole_messages`` to achieve this::
Messages show entire messages
author date summary remove
Messages show only summaries
author date (remove)
Setting up a "wizard" (or "druid") for controlled adding of issues ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1. Set up the page templates you wish to use for data input. My wizard is going to be a two-step process: first figuring out what category of issue the user is submitting, and then getting details specific to that category. The first page includes a table of help, explaining what the category names mean, and then the core of the form::
Category: The next page has the usual issue entry information, with the addition of the following form fragments::
. . .
Note that later in the form, I use the value of "cat" to decide which form elements should be displayed. For example:: Operating System Web Browser ... the above section will only be displayed if the category is one of 6, 10, 13, 14, 15, 16 or 17. 3. Determine what actions need to be taken between the pages - these are usually to validate user choices and determine what page is next. Now encode those actions in a new ``Action`` class (see `defining new web actions`_):: from roundup.cgi.actions import Action class Page1SubmitAction(Action): def handle(self): ''' Verify that the user has selected a category, and then move on to page 2. ''' category = self.form['category'].value if category == '-1': self.error_message.append('You must select a category of report') return # everything's ok, move on to the next page self.template = 'add_page2' def init(instance): instance.registerAction('page1_submit', Page1SubmitAction) 4. Use the usual "new" action as the ``@action`` on the final page, and you're done (the standard context/submit method can do this for you). Debugging Trackers ================== There are three switches in tracker configs that turn on debugging in Roundup: 1. web :: debug 2. mail :: debug 3. logging :: level See the config.ini file or the `tracker configuration`_ section above for more information. Additionally, the ``roundup-server.py`` script has its own debugging mode in which it reloads edited templates immediately when they are changed, rather than requiring a web server restart. ------------------- Back to `Table of Contents`_ .. _`Table of Contents`: index.html .. _`design documentation`: design.html .. _`admin guide`: admin_guide.html code-71d8025784d0/doc/debugging.txt0000644000000000000000000000154411052420374014760 0ustar 00000000000000Debugging Flags --------------- Roundup uses a number of debugging environment variables to help you figure out what the heck it's doing. HYPERDBDEBUG ============ This environment variable should be set to a filename - the hyperdb will write debugging information for various events (including, for instance, the SQL used). This is only obeyed when python is _not_ running in -O mode. HYPERDBTRACE ============ This environment variable should be set to a filename - the hyperdb will write a timestamp entry for various events. This appears to be suffering rather extreme bit-rot and may go away soon. This is only obeyed when python is _not_ running in -O mode. SENDMAILDEBUG ============= Set to a filename and roundup will write a copy of each email message that it sends to that file. This environment variable is independent of the python -O flag. code-71d8025784d0/doc/default.css0000644000000000000000000000757611052420374014435 0ustar 00000000000000/* :Author: David Goodger :Contact: goodger@users.sourceforge.net :date: $Date: 2004-06-09 00:25:32 $ :version: $Revision: 1.13 $ :copyright: This stylesheet has been placed in the public domain. Default cascading style sheet for the HTML output of Docutils. */ a.target { color: blue } a.toc-backref { text-decoration: none ; color: black } dd { margin-bottom: 0.5em } div.abstract { margin: 2em 5em } div.abstract p.topic-title { font-weight: bold ; text-align: center } div.attention, div.caution, div.danger, div.error, div.important, div.tip, div.warning { margin: 2em ; border: medium outset ; padding: 1em } div.hint, div.note { font-size: 80%; float: right; width: 15em; margin: 0.5em; margin-left: 1em ; border: solid #aaa; background: #eee; padding: 1em; } div.attention p.admonition-title, div.caution p.admonition-title, div.danger p.admonition-title, div.error p.admonition-title, div.warning p.admonition-title { color: red ; font-weight: bold ; font-family: sans-serif } div.hint p.admonition-title, div.important p.admonition-title, div.note p.admonition-title, div.tip p.admonition-title { font-weight: bold ; font-family: sans-serif } div.dedication { margin: 2em 5em ; text-align: center ; font-style: italic } div.dedication p.topic-title { font-weight: bold ; font-style: normal } div.figure { margin-left: 2em } div.footer, div.header { font-size: smaller } div.system-messages { margin: 5em } div.system-messages h1 { color: red } div.system-message { border: medium outset ; padding: 1em } div.system-message p.system-message-title { color: red ; font-weight: bold } div.topic { margin: 2em } h1 { margin-top: 2em; text-decoration: underline; } h1.title { text-align: center; margin-top: .5em; } h2.subtitle { text-align: center } hr { width: 75% } ol.simple, ul.simple { margin-top: 0; margin-bottom: 1em } ol.arabic { list-style: decimal } ol.loweralpha { list-style: lower-alpha } ol.upperalpha { list-style: upper-alpha } ol.lowerroman { list-style: lower-roman } ol.upperroman { list-style: upper-roman } p.caption { font-style: italic } p.credits { font-style: italic ; font-size: smaller } p.first { margin-top: 0 } p.label { white-space: nowrap } p.topic-title { font-weight: bold } pre.address { margin-bottom: 0 ; margin-top: 0 ; font-family: serif ; font-size: 100% } pre.line-block { font-family: serif ; font-size: 100% } pre.literal-block, pre.doctest-block { margin-left: 2em ; margin-right: 2em ; background-color: #eeeeee } span.classifier { font-family: sans-serif ; font-style: oblique } span.classifier-delimiter { font-family: sans-serif ; font-weight: bold } span.field-argument { font-style: italic } span.interpreted { font-family: sans-serif } span.option-argument { font-style: italic } span.pre { white-space: pre } span.problematic { color: red } table { margin-top: 0.5em ; margin-bottom: 0.5em ; } table.citation { border-top: 0; border-bottom: 0; border-right: 0; border-left: solid thin gray ; padding-left: 0.5ex } table.docinfo { margin: 2em 4em } table.footnote { border-left: solid thin black ; padding-left: 0.5ex } td, th { padding-left: 0.5em ; padding-right: 0.5em ; vertical-align: baseline; } table.table { border-spacing: 0px; border-collapse: separate; } table.table td { text-align: left; border: solid thin gray; } table.table th { text-align: left; border: solid thin gray; } td > p:first-child, th > p:first-child { margin-top: 0em } th.docinfo-name { font-weight: bold ; text-align: right } th.field-name { font-weight: bold ; text-align: right } h1 tt, h2 tt, h3 tt, h4 tt, h5 tt, h6 tt { font-size: 100% } tt { background-color: #eeeeee } tt.literal span.pre { background-color: #eeeeee } ul.auto-toc { list-style-type: none } code-71d8025784d0/doc/design.txt0000644000000000000000000017227511052420374014310 0ustar 00000000000000======================================================== Roundup - An Issue-Tracking System for Knowledge Workers ======================================================== :Authors: Ka-Ping Yee (original), Richard Jones (implementation) .. contents:: Introduction --------------- This document presents a description of the components of the Roundup system and specifies their interfaces and behaviour in sufficient detail to guide an implementation. For the philosophy and rationale behind the Roundup design, see the first-round Software Carpentry `submission for Roundup`__. This document fleshes out that design as well as specifying interfaces so that the components can be developed separately. __ spec.html The Layer Cake ----------------- Lots of software design documents come with a picture of a cake. Everybody seems to like them. I also like cakes (i think they are tasty). So I, too, shall include a picture of a cake here:: ________________________________________________________________ | E-mail Client | Web Browser | Detector Scripts | Shell | |---------------+---------------+--------------------+-----------| | E-mail User | Web User | Detector | Command | |----------------------------------------------------------------| | Roundup Database Layer | |----------------------------------------------------------------| | Hyperdatabase Layer | |----------------------------------------------------------------| | Storage Layer | ---------------------------------------------------------------- The colourful parts of the cake are part of our system; the faint grey parts of the cake are external components. I will now proceed to forgo all table manners and eat from the bottom of the cake to the top. You may want to stand back a bit so you don't get covered in crumbs. Hyperdatabase ------------- The lowest-level component to be implemented is the hyperdatabase. The hyperdatabase is a flexible data store that can hold configurable data in records which we call items. The hyperdatabase is implemented on top of the storage layer, an external module for storing its data. The "batteries-includes" distribution implements the hyperdatabase on the standard anydbm module. The storage layer could be a third-party RDBMS; for a low-maintenance solution, implementing the hyperdatabase on the SQLite RDBMS is suggested. Dates and Date Arithmetic ~~~~~~~~~~~~~~~~~~~~~~~~~ Before we get into the hyperdatabase itself, we need a way of handling dates. The hyperdatabase module provides Timestamp objects for representing date-and-time stamps and Interval objects for representing date-and-time intervals. As strings, date-and-time stamps are specified with the date in international standard format (``yyyy-mm-dd``) joined to the time (``hh:mm:ss``) by a period "``.``". Dates in this form can be easily compared and are fairly readable when printed. An example of a valid stamp is "``2000-06-24.13:03:59``". We'll call this the "full date format". When Timestamp objects are printed as strings, they appear in the full date format with the time always given in GMT. The full date format is always exactly 19 characters long. For user input, some partial forms are also permitted: the whole time or just the seconds may be omitted; and the whole date may be omitted or just the year may be omitted. If the time is given, the time is interpreted in the user's local time zone. The Date constructor takes care of these conversions. In the following examples, suppose that ``yyyy`` is the current year, ``mm`` is the current month, and ``dd`` is the current day of the month; and suppose that the user is on Eastern Standard Time. - "2000-04-17" means - "01-25" means - "2000-04-17.03:45" means - "08-13.22:13" means - "11-07.09:32:43" means - "14:25" means - - "8:47:11" means - - the special date "." means "right now" Date intervals are specified using the suffixes "y", "m", and "d". The suffix "w" (for "week") means 7 days. Time intervals are specified in hh:mm:ss format (the seconds may be omitted, but the hours and minutes may not). - "3y" means three years - "2y 1m" means two years and one month - "1m 25d" means one month and 25 days - "2w 3d" means two weeks and three days - "1d 2:50" means one day, two hours, and 50 minutes - "14:00" means 14 hours - "0:04:33" means four minutes and 33 seconds The Date class should understand simple date expressions of the form *stamp* ``+`` *interval* and *stamp* ``-`` *interval*. When adding or subtracting intervals involving months or years, the components are handled separately. For example, when evaluating "``2000-06-25 + 1m 10d``", we first add one month to get 2000-07-25, then add 10 days to get 2000-08-04 (rather than trying to decide whether 1m 10d means 38 or 40 or 41 days). Here is an outline of the Date and Interval classes:: class Date: def __init__(self, spec, offset): """Construct a date given a specification and a time zone offset. 'spec' is a full date or a partial form, with an optional added or subtracted interval. 'offset' is the local time zone offset from GMT in hours. """ def __add__(self, interval): """Add an interval to this date to produce another date.""" def __sub__(self, interval): """Subtract an interval from this date to produce another date. """ def __cmp__(self, other): """Compare this date to another date.""" def __str__(self): """Return this date as a string in the yyyy-mm-dd.hh:mm:ss format. """ def local(self, offset): """Return this date as yyyy-mm-dd.hh:mm:ss in a local time zone. """ class Interval: def __init__(self, spec): """Construct an interval given a specification.""" def __cmp__(self, other): """Compare this interval to another interval.""" def __str__(self): """Return this interval as a string.""" Here are some examples of how these classes would behave in practice. For the following examples, assume that we are on Eastern Standard Time and the current local time is 19:34:02 on 25 June 2000:: >>> Date(".") >>> _.local(-5) "2000-06-25.19:34:02" >>> Date(". + 2d") >>> Date("1997-04-17", -5) >>> Date("01-25", -5) >>> Date("08-13.22:13", -5) >>> Date("14:25", -5) >>> Interval(" 3w 1 d 2:00") >>> Date(". + 2d") - Interval("3w") Items and Classes ~~~~~~~~~~~~~~~~~ Items contain data in properties. To Python, these properties are presented as the key-value pairs of a dictionary. Each item belongs to a class which defines the names and types of its properties. The database permits the creation and modification of classes as well as items. Identifiers and Designators ~~~~~~~~~~~~~~~~~~~~~~~~~~~ Each item has a numeric identifier which is unique among items in its class. The items are numbered sequentially within each class in order of creation, starting from 1. The designator for an item is a way to identify an item in the database, and consists of the name of the item's class concatenated with the item's numeric identifier. For example, if "spam" and "eggs" are classes, the first item created in class "spam" has id 1 and designator "spam1". The first item created in class "eggs" also has id 1 but has the distinct designator "eggs1". Item designators are conventionally enclosed in square brackets when mentioned in plain text. This permits a casual mention of, say, "[patch37]" in an e-mail message to be turned into an active hyperlink. Property Names and Types ~~~~~~~~~~~~~~~~~~~~~~~~ Property names must begin with a letter. A property may be one of five basic types: - String properties are for storing arbitrary-length strings. - Boolean properties are for storing true/false, or yes/no values. - Number properties are for storing numeric values. - Date properties store date-and-time stamps. Their values are Timestamp objects. - A Link property refers to a single other item selected from a specified class. The class is part of the property; the value is an integer, the id of the chosen item. - A Multilink property refers to possibly many items in a specified class. The value is a list of integers. *None* is also a permitted value for any of these property types. An attempt to store None into a Multilink property stores an empty list. A property that is not specified will return as None from a *get* operation. Hyperdb Interface Specification ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ TODO: replace the Interface Specifications with links to the pydoc The hyperdb module provides property objects to designate the different kinds of properties. These objects are used when specifying what properties belong in classes:: class String: def __init__(self, indexme='no'): """An object designating a String property.""" class Boolean: def __init__(self): """An object designating a Boolean property.""" class Number: def __init__(self): """An object designating a Number property.""" class Date: def __init__(self): """An object designating a Date property.""" class Link: def __init__(self, classname, do_journal='yes'): """An object designating a Link property that links to items in a specified class. If the do_journal argument is not 'yes' then changes to the property are not journalled in the linked item. """ class Multilink: def __init__(self, classname, do_journal='yes'): """An object designating a Multilink property that links to items in a specified class. If the do_journal argument is not 'yes' then changes to the property are not journalled in the linked item(s). """ Here is the interface provided by the hyperdatabase:: class Database: """A database for storing records containing flexible data types. """ def __init__(self, config, journaltag=None): """Open a hyperdatabase given a specifier to some storage. The 'storagelocator' is obtained from config.DATABASE. The meaning of 'storagelocator' depends on the particular implementation of the hyperdatabase. It could be a file name, a directory path, a socket descriptor for a connection to a database over the network, etc. The 'journaltag' is a token that will be attached to the journal entries for any edits done on the database. If 'journaltag' is None, the database is opened in read-only mode: the Class.create(), Class.set(), Class.retire(), and Class.restore() methods are disabled. """ def __getattr__(self, classname): """A convenient way of calling self.getclass(classname).""" def getclasses(self): """Return a list of the names of all existing classes.""" def getclass(self, classname): """Get the Class object representing a particular class. If 'classname' is not a valid class name, a KeyError is raised. """ class Class: """The handle to a particular class of items in a hyperdatabase. """ def __init__(self, db, classname, **properties): """Create a new class with a given name and property specification. 'classname' must not collide with the name of an existing class, or a ValueError is raised. The keyword arguments in 'properties' must map names to property objects, or a TypeError is raised. A proxied reference to the database is available as the 'db' attribute on instances. For example, in 'IssueClass.send_message', the following is used to lookup users, messages and files:: users = self.db.user messages = self.db.msg files = self.db.file """ # Editing items: def create(self, **propvalues): """Create a new item of this class and return its id. The keyword arguments in 'propvalues' map property names to values. The values of arguments must be acceptable for the types of their corresponding properties or a TypeError is raised. If this class has a key property, it must be present and its value must not collide with other key strings or a ValueError is raised. Any other properties on this class that are missing from the 'propvalues' dictionary are set to None. If an id in a link or multilink property does not refer to a valid item, an IndexError is raised. """ def get(self, itemid, propname): """Get the value of a property on an existing item of this class. 'itemid' must be the id of an existing item of this class or an IndexError is raised. 'propname' must be the name of a property of this class or a KeyError is raised. """ def set(self, itemid, **propvalues): """Modify a property on an existing item of this class. 'itemid' must be the id of an existing item of this class or an IndexError is raised. Each key in 'propvalues' must be the name of a property of this class or a KeyError is raised. All values in 'propvalues' must be acceptable types for their corresponding properties or a TypeError is raised. If the value of the key property is set, it must not collide with other key strings or a ValueError is raised. If the value of a Link or Multilink property contains an invalid item id, a ValueError is raised. """ def retire(self, itemid): """Retire an item. The properties on the item remain available from the get() method, and the item's id is never reused. Retired items are not returned by the find(), list(), or lookup() methods, and other items may reuse the values of their key properties. """ def restore(self, nodeid): '''Restore a retired node. Make node available for all operations like it was before retirement. ''' def history(self, itemid): """Retrieve the journal of edits on a particular item. 'itemid' must be the id of an existing item of this class or an IndexError is raised. The returned list contains tuples of the form (date, tag, action, params) 'date' is a Timestamp object specifying the time of the change and 'tag' is the journaltag specified when the database was opened. 'action' may be: 'create' or 'set' -- 'params' is a dictionary of property values 'link' or 'unlink' -- 'params' is (classname, itemid, propname) 'retire' -- 'params' is None """ # Locating items: def setkey(self, propname): """Select a String property of this class to be the key property. 'propname' must be the name of a String property of this class or None, or a TypeError is raised. The values of the key property on all existing items must be unique or a ValueError is raised. """ def getkey(self): """Return the name of the key property for this class or None. """ def lookup(self, keyvalue): """Locate a particular item by its key property and return its id. If this class has no key property, a TypeError is raised. If the 'keyvalue' matches one of the values for the key property among the items in this class, the matching item's id is returned; otherwise a KeyError is raised. """ def find(self, **propspec): """Get the ids of items in this class which link to the given items. 'propspec' consists of keyword args propname=itemid or propname={:1, : 1, ...} 'propname' must be the name of a property in this class, or a KeyError is raised. That property must be a Link or Multilink property, or a TypeError is raised. Any item in this class whose 'propname' property links to any of the itemids will be returned. Examples:: db.issue.find(messages='1') db.issue.find(messages={'1':1,'3':1}, files={'7':1}) """ def filter(self, search_matches, filterspec, sort, group): """Return a list of the ids of the active nodes in this class that match the 'filter' spec, sorted by the group spec and then the sort spec. "filterspec" is {propname: value(s)} "sort" and "group" are [(dir, prop), ...] where dir is '+', '-' or None and prop is a prop name or None. Note that for backward-compatibility reasons a single (dir, prop) tuple is also allowed. "search_matches" is {nodeid: marker} The filter must match all properties specificed. If the property value to match is a list: 1. String properties must match all elements in the list, and 2. Other properties must match any of the elements in the list. The propname in filterspec and prop in a sort/group spec may be transitive, i.e., it may contain properties of the form link.link.link.name, e.g. you can search for all issues where a message was added by a certain user in the last week with a filterspec of {'messages.author' : '42', 'messages.creation' : '.-1w;'} """ def list(self): """Return a list of the ids of the active items in this class. """ def count(self): """Get the number of items in this class. If the returned integer is 'numitems', the ids of all the items in this class run from 1 to numitems, and numitems+1 will be the id of the next item to be created in this class. """ # Manipulating properties: def getprops(self): """Return a dictionary mapping property names to property objects. """ def addprop(self, **properties): """Add properties to this class. The keyword arguments in 'properties' must map names to property objects, or a TypeError is raised. None of the keys in 'properties' may collide with the names of existing properties, or a ValueError is raised before any properties have been added. """ def getitem(self, itemid, cache=1): """ Return a Item convenience wrapper for the item. 'itemid' must be the id of an existing item of this class or an IndexError is raised. 'cache' indicates whether the transaction cache should be queried for the item. If the item has been modified and you need to determine what its values prior to modification are, you need to set cache=0. """ class Item: """ A convenience wrapper for the given item. It provides a mapping interface to a single item's properties """ Hyperdatabase Implementations ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Hyperdatabase implementations exist to create the interface described in the `hyperdb interface specification`_ over an existing storage mechanism. Examples are relational databases, \*dbm key-value databases, and so on. Several implementations are provided - they belong in the ``roundup.backends`` package. Application Example ~~~~~~~~~~~~~~~~~~~ Here is an example of how the hyperdatabase module would work in practice:: >>> import hyperdb >>> db = hyperdb.Database("foo.db", "ping") >>> db >>> hyperdb.Class(db, "status", name=hyperdb.String()) >>> _.setkey("name") >>> db.status.create(name="unread") 1 >>> db.status.create(name="in-progress") 2 >>> db.status.create(name="testing") 3 >>> db.status.create(name="resolved") 4 >>> db.status.count() 4 >>> db.status.list() [1, 2, 3, 4] >>> db.status.lookup("in-progress") 2 >>> db.status.retire(3) >>> db.status.list() [1, 2, 4] >>> hyperdb.Class(db, "issue", title=hyperdb.String(), status=hyperdb.Link("status")) >>> db.issue.create(title="spam", status=1) 1 >>> db.issue.create(title="eggs", status=2) 2 >>> db.issue.create(title="ham", status=4) 3 >>> db.issue.create(title="arguments", status=2) 4 >>> db.issue.create(title="abuse", status=1) 5 >>> hyperdb.Class(db, "user", username=hyperdb.String(), ... password=hyperdb.String()) >>> db.issue.addprop(fixer=hyperdb.Link("user")) >>> db.issue.getprops() {"title": , "status": , "user": } >>> db.issue.set(5, status=2) >>> db.issue.get(5, "status") 2 >>> db.status.get(2, "name") "in-progress" >>> db.issue.get(5, "title") "abuse" >>> db.issue.find("status", db.status.lookup("in-progress")) [2, 4, 5] >>> db.issue.history(5) [(, "ping", "create", {"title": "abuse", "status": 1}), (, "ping", "set", {"status": 2})] >>> db.status.history(1) [(, "ping", "link", ("issue", 5, "status")), (, "ping", "unlink", ("issue", 5, "status"))] >>> db.status.history(2) [(, "ping", "link", ("issue", 5, "status"))] For the purposes of journalling, when a Multilink property is set to a new list of items, the hyperdatabase compares the old list to the new list. The journal records "unlink" events for all the items that appear in the old list but not the new list, and "link" events for all the items that appear in the new list but not in the old list. Roundup Database ---------------- The Roundup database layer is implemented on top of the hyperdatabase and mediates calls to the database. Some of the classes in the Roundup database are considered issue classes. The Roundup database layer adds detectors and user items, and on issues it provides mail spools, nosy lists, and superseders. Reserved Classes ~~~~~~~~~~~~~~~~ Internal to this layer we reserve three special classes of items that are not issues. Users """"" Users are stored in the hyperdatabase as items of class "user". The "user" class has the definition:: hyperdb.Class(db, "user", username=hyperdb.String(), password=hyperdb.String(), address=hyperdb.String()) db.user.setkey("username") Messages """""""" E-mail messages are represented by hyperdatabase items of class "msg". The actual text content of the messages is stored in separate files. (There's no advantage to be gained by stuffing them into the hyperdatabase, and if messages are stored in ordinary text files, they can be grepped from the command line.) The text of a message is saved in a file named after the message item designator (e.g. "msg23") for the sake of the command interface (see below). Attachments are stored separately and associated with "file" items. The "msg" class has the definition:: hyperdb.Class(db, "msg", author=hyperdb.Link("user"), recipients=hyperdb.Multilink("user"), date=hyperdb.Date(), summary=hyperdb.String(), files=hyperdb.Multilink("file")) The "author" property indicates the author of the message (a "user" item must exist in the hyperdatabase for any messages that are stored in the system). The "summary" property contains a summary of the message for display in a message index. Files """"" Submitted files are represented by hyperdatabase items of class "file". Like e-mail messages, the file content is stored in files outside the database, named after the file item designator (e.g. "file17"). The "file" class has the definition:: hyperdb.Class(db, "file", user=hyperdb.Link("user"), name=hyperdb.String(), type=hyperdb.String()) The "user" property indicates the user who submitted the file, the "name" property holds the original name of the file, and the "type" property holds the MIME type of the file as received. Issue Classes ~~~~~~~~~~~~~ All issues have the following standard properties: =========== ========================== Property Definition =========== ========================== title hyperdb.String() messages hyperdb.Multilink("msg") files hyperdb.Multilink("file") nosy hyperdb.Multilink("user") superseder hyperdb.Multilink("issue") =========== ========================== Also, two Date properties named "creation" and "activity" are fabricated by the Roundup database layer. Two user Link properties, "creator" and "actor" are also fabricated. By "fabricated" we mean that no such properties are actually stored in the hyperdatabase, but when properties on issues are requested, the "creation"/"creator" and "activity"/"actor" properties are made available. The value of the "creation"/"creator" properties relate to issue creation, and the value of the "activity"/ "actor" properties relate to the last editing of any property on the issue (equivalently, these are the dates on the first and last records in the issue's journal). Roundupdb Interface Specification ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The interface to a Roundup database delegates most method calls to the hyperdatabase, except for the following changes and additional methods:: class Database: def getuid(self): """Return the id of the "user" item associated with the user that owns this connection to the hyperdatabase.""" class Class: # Overridden methods: def create(self, **propvalues): def set(self, **propvalues): def retire(self, itemid): """These operations trigger detectors and can be vetoed. Attempts to modify the "creation", "creator", "activity" properties or "actor" cause a KeyError. """ class IssueClass(Class): # Overridden methods: def __init__(self, db, classname, **properties): """The newly-created class automatically includes the "messages", "files", "nosy", and "superseder" properties. If the 'properties' dictionary attempts to specify any of these properties or a "creation", "creator", "activity" or "actor" property, a ValueError is raised.""" def get(self, itemid, propname): def getprops(self): """In addition to the actual properties on the item, these methods provide the "creation", "creator", "activity" and "actor" properties.""" # New methods: def addmessage(self, itemid, summary, text): """Add a message to an issue's mail spool. A new "msg" item is constructed using the current date, the user that owns the database connection as the author, and the specified summary text. The "files" and "recipients" fields are left empty. The given text is saved as the body of the message and the item is appended to the "messages" field of the specified issue. """ def nosymessage(self, itemid, msgid): """Send a message to the members of an issue's nosy list. The message is sent only to users on the nosy list who are not already on the "recipients" list for the message. These users are then added to the message's "recipients" list. """ Default Schema ~~~~~~~~~~~~~~ The default schema included with Roundup turns it into a typical software bug tracker. The database is set up like this:: pri = Class(db, "priority", name=hyperdb.String(), order=hyperdb.String()) pri.setkey("name") pri.create(name="critical", order="1") pri.create(name="urgent", order="2") pri.create(name="bug", order="3") pri.create(name="feature", order="4") pri.create(name="wish", order="5") stat = Class(db, "status", name=hyperdb.String(), order=hyperdb.String()) stat.setkey("name") stat.create(name="unread", order="1") stat.create(name="deferred", order="2") stat.create(name="chatting", order="3") stat.create(name="need-eg", order="4") stat.create(name="in-progress", order="5") stat.create(name="testing", order="6") stat.create(name="done-cbb", order="7") stat.create(name="resolved", order="8") Class(db, "keyword", name=hyperdb.String()) Class(db, "issue", fixer=hyperdb.Multilink("user"), keyword=hyperdb.Multilink("keyword"), priority=hyperdb.Link("priority"), status=hyperdb.Link("status")) (The "order" property hasn't been explained yet. It gets used by the Web user interface for sorting.) The above isn't as pretty-looking as the schema specification in the first-stage submission, but it could be made just as easy with the addition of a convenience function like Choice for setting up the "priority" and "status" classes:: def Choice(name, *options): cl = Class(db, name, name=hyperdb.String(), order=hyperdb.String()) for i in range(len(options)): cl.create(name=option[i], order=i) return hyperdb.Link(name) Detector Interface ------------------ Detectors are Python functions that are triggered on certain kinds of events. The definitions of the functions live in Python modules placed in a directory set aside for this purpose. Importing the Roundup database module also imports all the modules in this directory, and the ``init()`` function of each module is called when a database is opened to provide it a chance to register its detectors. There are two kinds of detectors: 1. an auditor is triggered just before modifying an item 2. a reactor is triggered just after an item has been modified When the Roundup database is about to perform a ``create()``, ``set()``, ``retire()``, or ``restore`` operation, it first calls any *auditors* that have been registered for that operation on that class. Any auditor may raise a *Reject* exception to abort the operation. If none of the auditors raises an exception, the database proceeds to carry out the operation. After it's done, it then calls all of the *reactors* that have been registered for the operation. Detector Interface Specification ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The ``audit()`` and ``react()`` methods register detectors on a given class of items:: class Class: def audit(self, event, detector, priority=100): """Register an auditor on this class. 'event' should be one of "create", "set", "retire", or "restore". 'detector' should be a function accepting four arguments. Detectors are called in priority order, execution order is undefined for detectors with the same priority. """ def react(self, event, detector, priority=100): """Register a reactor on this class. 'event' should be one of "create", "set", "retire", or "restore". 'detector' should be a function accepting four arguments. Detectors are called in priority order, execution order is undefined for detectors with the same priority. """ Auditors are called with the arguments:: audit(db, cl, itemid, newdata) where ``db`` is the database, ``cl`` is an instance of Class or IssueClass within the database, and ``newdata`` is a dictionary mapping property names to values. For a ``create()`` operation, the ``itemid`` argument is None and newdata contains all of the initial property values with which the item is about to be created. For a ``set()`` operation, newdata contains only the names and values of properties that are about to be changed. For a ``retire()`` or ``restore()`` operation, newdata is None. Reactors are called with the arguments:: react(db, cl, itemid, olddata) where ``db`` is the database, ``cl`` is an instance of Class or IssueClass within the database, and ``olddata`` is a dictionary mapping property names to values. For a ``create()`` operation, the ``itemid`` argument is the id of the newly-created item and ``olddata`` is None. For a ``set()`` operation, ``olddata`` contains the names and previous values of properties that were changed. For a ``retire()`` or ``restore()`` operation, ``itemid`` is the id of the retired or restored item and ``olddata`` is None. Detector Example ~~~~~~~~~~~~~~~~ Here is an example of detectors written for a hypothetical project-management application, where users can signal approval of a project by adding themselves to an "approvals" list, and a project proceeds when it has three approvals:: # Permit users only to add themselves to the "approvals" list. def check_approvals(db, cl, id, newdata): if newdata.has_key("approvals"): if cl.get(id, "status") == db.status.lookup("approved"): raise Reject, "You can't modify the approvals list " \ "for a project that has already been approved." old = cl.get(id, "approvals") new = newdata["approvals"] for uid in old: if uid not in new and uid != db.getuid(): raise Reject, "You can't remove other users from " \ "the approvals list; you can only remove " \ "yourself." for uid in new: if uid not in old and uid != db.getuid(): raise Reject, "You can't add other users to the " \ "approvals list; you can only add yourself." # When three people have approved a project, change its status from # "pending" to "approved". def approve_project(db, cl, id, olddata): if (olddata.has_key("approvals") and len(cl.get(id, "approvals")) == 3): if cl.get(id, "status") == db.status.lookup("pending"): cl.set(id, status=db.status.lookup("approved")) def init(db): db.project.audit("set", check_approval) db.project.react("set", approve_project) Here is another example of a detector that can allow or prevent the creation of new items. In this scenario, patches for a software project are submitted by sending in e-mail with an attached file, and we want to ensure that there are text/plain attachments on the message. The maintainer of the package can then apply the patch by setting its status to "applied":: # Only accept attempts to create new patches that come with patch # files. def check_new_patch(db, cl, id, newdata): if not newdata["files"]: raise Reject, "You can't submit a new patch without " \ "attaching a patch file." for fileid in newdata["files"]: if db.file.get(fileid, "type") != "text/plain": raise Reject, "Submitted patch files must be " \ "text/plain." # When the status is changed from "approved" to "applied", apply the # patch. def apply_patch(db, cl, id, olddata): if (cl.get(id, "status") == db.status.lookup("applied") and olddata["status"] == db.status.lookup("approved")): # ...apply the patch... def init(db): db.patch.audit("create", check_new_patch) db.patch.react("set", apply_patch) Command Interface ----------------- The command interface is a very simple and minimal interface, intended only for quick searches and checks from the shell prompt. (Anything more interesting can simply be written in Python using the Roundup database module.) Command Interface Specification ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ A single command, roundup, provides basic access to the hyperdatabase from the command line:: roundup-admin help roundup-admin get [-list] designator[, designator,...] propname roundup-admin set designator[, designator,...] propname=value ... roundup-admin find [-list] classname propname=value ... See ``roundup-admin help commands`` for a complete list of commands. Property values are represented as strings in command arguments and in the printed results: - Strings are, well, strings. - Numbers are displayed the same as strings. - Booleans are displayed as 'Yes' or 'No'. - Date values are printed in the full date format in the local time zone, and accepted in the full format or any of the partial formats explained above. - Link values are printed as item designators. When given as an argument, item designators and key strings are both accepted. - Multilink values are printed as lists of item designators joined by commas. When given as an argument, item designators and key strings are both accepted; an empty string, a single item, or a list of items joined by commas is accepted. When multiple items are specified to the roundup get or roundup set commands, the specified properties are retrieved or set on all the listed items. When multiple results are returned by the roundup get or roundup find commands, they are printed one per line (default) or joined by commas (with the -list) option. Usage Example ~~~~~~~~~~~~~ To find all messages regarding in-progress issues that contain the word "spam", for example, you could execute the following command from the directory where the database dumps its files:: shell% for issue in `roundup find issue status=in-progress`; do > grep -l spam `roundup get $issue messages` > done msg23 msg49 msg50 msg61 shell% Or, using the -list option, this can be written as a single command:: shell% grep -l spam `roundup get \ \`roundup find -list issue status=in-progress\` messages` msg23 msg49 msg50 msg61 shell% E-mail User Interface --------------------- The Roundup system must be assigned an e-mail address at which to receive mail. Messages should be piped to the Roundup mail-handling script by the mail delivery system (e.g. using an alias beginning with "|" for sendmail). Message Processing ~~~~~~~~~~~~~~~~~~ Incoming messages are examined for multiple parts. In a multipart/mixed message or part, each subpart is extracted and examined. In a multipart/alternative message or part, we look for a text/plain subpart and ignore the other parts. The text/plain subparts are assembled to form the textual body of the message, to be stored in the file associated with a "msg" class item. Any parts of other types are each stored in separate files and given "file" class items that are linked to the "msg" item. The "summary" property on message items is taken from the first non-quoting section in the message body. The message body is divided into sections by blank lines. Sections where the second and all subsequent lines begin with a ">" or "|" character are considered "quoting sections". The first line of the first non-quoting section becomes the summary of the message. All of the addresses in the To: and Cc: headers of the incoming message are looked up among the user items, and the corresponding users are placed in the "recipients" property on the new "msg" item. The address in the From: header similarly determines the "author" property of the new "msg" item. The default handling for addresses that don't have corresponding users is to create new users with no passwords and a username equal to the address. (The web interface does not permit logins for users with no passwords.) If we prefer to reject mail from outside sources, we can simply register an auditor on the "user" class that prevents the creation of user items with no passwords. The subject line of the incoming message is examined to determine whether the message is an attempt to create a new issue or to discuss an existing issue. A designator enclosed in square brackets is sought as the first thing on the subject line (after skipping any "Fwd:" or "Re:" prefixes). If an issue designator (class name and id number) is found there, the newly created "msg" item is added to the "messages" property for that issue, and any new "file" items are added to the "files" property for the issue. If just an issue class name is found there, we attempt to create a new issue of that class with its "messages" property initialized to contain the new "msg" item and its "files" property initialized to contain any new "file" items. Both cases may trigger detectors (in the first case we are calling the set() method to add the message to the issue's spool; in the second case we are calling the create() method to create a new item). If an auditor raises an exception, the original message is bounced back to the sender with the explanatory message given in the exception. Nosy Lists ~~~~~~~~~~ A standard detector is provided that watches for additions to the "messages" property. When a new message is added, the detector sends it to all the users on the "nosy" list for the issue that are not already on the "recipients" list of the message. Those users are then appended to the "recipients" property on the message, so multiple copies of a message are never sent to the same user. The journal recorded by the hyperdatabase on the "recipients" property then provides a log of when the message was sent to whom. Setting Properties ~~~~~~~~~~~~~~~~~~ The e-mail interface also provides a simple way to set properties on issues. At the end of the subject line, ``propname=value`` pairs can be specified in square brackets, using the same conventions as for the roundup ``set`` shell command. Web User Interface ------------------ The web interface is provided by a CGI script that can be run under any web server. A simple web server can easily be built on the standard CGIHTTPServer module, and should also be included in the distribution for quick out-of-the-box deployment. The user interface is constructed from a number of template files containing mostly HTML. Among the HTML tags in templates are interspersed some nonstandard tags, which we use as placeholders to be replaced by properties and their values. Views and View Specifiers ~~~~~~~~~~~~~~~~~~~~~~~~~ There are two main kinds of views: *index* views and *issue* views. An index view displays a list of issues of a particular class, optionally sorted and filtered as requested. An issue view presents the properties of a particular issue for editing and displays the message spool for the issue. A view specifier is a string that specifies all the options needed to construct a particular view. It goes after the URL to the Roundup CGI script or the web server to form the complete URL to a view. When the result of selecting a link or submitting a form takes the user to a new view, the Web browser should be redirected to a canonical location containing a complete view specifier so that the view can be bookmarked. Displaying Properties ~~~~~~~~~~~~~~~~~~~~~ Properties appear in the user interface in three contexts: in indices, in editors, and as search filters. For each type of property, there are several display possibilities. For example, in an index view, a string property may just be printed as a plain string, but in an editor view, that property should be displayed in an editable field. The display of a property is handled by functions in the ``cgi.templating`` module. Displayer functions are triggered by ``tal:content`` or ``tal:replace`` tag attributes in templates. The value of the attribute provides an expression for calling the displayer function. For example, the occurrence of:: tal:content="context/status/plain" in a template triggers a call to:: context['status'].plain() where the context would be an item of the "issue" class. The displayer functions can accept extra arguments to further specify details about the widgets that should be generated. Some of the standard displayer functions include: ========= ============================================================== Function Description ========= ============================================================== plain display a String property directly; display a Date property in a specified time zone with an option to omit the time from the date stamp; for a Link or Multilink property, display the key strings of the linked items (or the ids if the linked class has no key property) field display a property like the plain displayer above, but in a text field to be edited menu for a Link property, display a menu of the available choices ========= ============================================================== See the `customisation`_ documentation for the complete list. Index Views ~~~~~~~~~~~ An index view contains two sections: a filter section and an index section. The filter section provides some widgets for selecting which issues appear in the index. The index section is a table of issues. Index View Specifiers """"""""""""""""""""" An index view specifier looks like this (whitespace has been added for clarity):: /issue?status=unread,in-progress,resolved& keyword=security,ui& :group=priority,-status& :sort=-activity& :filters=status,keyword& :columns=title,status,fixer The index view is determined by two parts of the specifier: the layout part and the filter part. The layout part consists of the query parameters that begin with colons, and it determines the way that the properties of selected items are displayed. The filter part consists of all the other query parameters, and it determines the criteria by which items are selected for display. The filter part is interactively manipulated with the form widgets displayed in the filter section. The layout part is interactively manipulated by clicking on the column headings in the table. The filter part selects the union of the sets of issues with values matching any specified Link properties and the intersection of the sets of issues with values matching any specified Multilink properties. The example specifies an index of "issue" items. Only issues with a "status" of either "unread" or "in-progres" or "resolved" are displayed, and only issues with "keyword" values including both "security" and "ui" are displayed. The items are grouped by priority arranged in ascending order and in descending order by status; and within groups, sorted by activity, arranged in descending order. The filter section shows filters for the "status" and "keyword" properties, and the table includes columns for the "title", "status", and "fixer" properties. Associated with each issue class is a default layout specifier. The layout specifier in the above example is the default layout to be provided with the default bug-tracker schema described above in section 4.4. Index Section """"""""""""" The template for an index section describes one row of the index table. Fragments protected by a ``tal:condition="request/show/"`` are included or omitted depending on whether the view specifier requests a column for a particular property. The table cells are filled by the ``tal:content="context/"`` directive, which displays the value of the property. Here's a simple example of an index template:: Sorting """"""" String and Date values are sorted in the natural way. Link properties are sorted according to the value of the "order" property on the linked items if it is present; or otherwise on the key string of the linked items; or finally on the item ids. Multilink properties are sorted according to how many links are present. Issue Views ~~~~~~~~~~~ An issue view contains an editor section and a spool section. At the top of an issue view, links to superseding and superseded issues are always displayed. Issue View Specifiers """"""""""""""""""""" An issue view specifier is simply the issue's designator:: /patch23 Editor Section """""""""""""" The editor section is generated from a template containing ``tal:content="context//"`` directives to insert the appropriate widgets for editing properties. Here's an example of a basic editor template::
As shown in the example, the editor template can also include a ":note" field, which is a text area for entering a note to go along with a change. When a change is submitted, the system automatically generates a message describing the changed properties. The message displays all of the property values on the issue and indicates which ones have changed. An example of such a message might be this:: title: Polly Parrot is dead priority: critical status: unread -> in-progress fixer: (none) keywords: parrot,plumage,perch,nailed,dead If a note is given in the ":note" field, the note is appended to the description. The message is then added to the issue's message spool (thus triggering the standard detector to react by sending out this message to the nosy list). Spool Section """"""""""""" The spool section lists messages in the issue's "messages" property. The index of messages displays the "date", "author", and "summary" properties on the message items, and selecting a message takes you to its content. Access Control -------------- At each point that requires an action to be performed, the security mechanisms are asked if the current user has permission. This permission is defined as a Permission. Individual assignment of Permission to user is unwieldy. The concept of a Role, which encompasses several Permissions and may be assigned to many Users, is quite well developed in many projects. Roundup will take this path, and allow the multiple assignment of Roles to Users, and multiple Permissions to Roles. These definitions are not persistent - they're defined when the application initialises. There will be three levels of Permission. The Class level permissions define logical permissions associated with all items of a particular class (or all classes). The Item level permissions define logical permissions associated with specific items by way of their user-linked properties. The Property level permissions define logical permissions associated with a specific property of an item. Access Control Interface Specification ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The security module defines:: class Permission: ''' Defines a Permission with the attributes - name - description - klass (optional) - properties (optional) - check function (optional) The klass may be unset, indicating that this permission is not locked to a particular hyperdb class. There may be multiple Permissions for the same name for different classes. If property names are set, permission is restricted to those properties only. If check function is set, permission is granted only when the function returns value interpreted as boolean true. The function is called with arguments db, userid, itemid. ''' class Role: ''' Defines a Role with the attributes - name - description - permissions ''' class Security: def __init__(self, db): ''' Initialise the permission and role stores, and add in the base roles (for admin user). ''' def getPermission(self, permission, classname=None, properties=None, check=None): ''' Find the Permission exactly matching the name, class, properties list and check function. Raise ValueError if there is no exact match. ''' def hasPermission(self, permission, userid, classname=None, property=None, itemid=None): ''' Look through all the Roles, and hence Permissions, and see if "permission" exists given the constraints of classname, property and itemid. If classname is specified (and only classname) then the search will match if there is *any* Permission for that classname, even if the Permission has additional constraints. If property is specified, the Permission matched must have either no properties listed or the property must appear in the list. If itemid is specified, the Permission matched must have either no check function defined or the check function, when invoked, must return a True value. Note that this functionality is actually implemented by the Permission.test() method. ''' def addPermission(self, **propspec): ''' Create a new Permission with the properties defined in 'propspec'. See the Permission class for the possible keyword args. ''' def addRole(self, **propspec): ''' Create a new Role with the properties defined in 'propspec' ''' def addPermissionToRole(self, rolename, permission): ''' Add the permission to the role's permission list. 'rolename' is the name of the role to add permission to. ''' Modules such as ``cgi/client.py`` and ``mailgw.py`` define their own permissions like so (this example is ``cgi/client.py``):: def initialiseSecurity(security): ''' Create some Permissions and Roles on the security object This function is directly invoked by security.Security.__init__() as a part of the Security object instantiation. ''' p = security.addPermission(name="Web Registration", description="Anonymous users may register through the web") security.addToRole('Anonymous', p) Detectors may also define roles in their init() function:: def init(db): # register an auditor that checks that a user has the "May # Resolve" Permission before allowing them to set an issue # status to "resolved" db.issue.audit('set', checkresolvedok) p = db.security.addPermission(name="May Resolve", klass="issue") security.addToRole('Manager', p) The tracker dbinit module then has in ``open()``:: # open the database - it must be modified to init the Security class # from security.py as db.security db = Database(config, name) # add some extra permissions and associate them with roles ei = db.security.addPermission(name="Edit", klass="issue", description="User is allowed to edit issues") db.security.addPermissionToRole('User', ei) ai = db.security.addPermission(name="View", klass="issue", description="User is allowed to access issues") db.security.addPermissionToRole('User', ai) In the dbinit ``init()``:: # create the two default users user.create(username="admin", password=Password(adminpw), address=config.ADMIN_EMAIL, roles='Admin') user.create(username="anonymous", roles='Anonymous') Then in the code that matters, calls to ``hasPermission`` and ``hasItemPermission`` are made to determine if the user has permission to perform some action:: if db.security.hasPermission('issue', 'Edit', userid): # all ok if db.security.hasItemPermission('issue', itemid, assignedto=userid): # all ok Code in the core will make use of these methods, as should code in auditors in custom templates. The HTML templating may access the access controls through the *user* attribute of the *request* variable. It exposes a ``hasPermission()`` method:: tal:condition="python:request.user.hasPermission('Edit', 'issue')" or, if the *context* is *issue*, then the following is the same:: tal:condition="python:request.user.hasPermission('Edit')" Authentication of Users ~~~~~~~~~~~~~~~~~~~~~~~ Users must be authenticated correctly for the above controls to work. This is not done in the current mail gateway at all. Use of digital signing of messages could alleviate this problem. The exact mechanism of registering the digital signature should be flexible, with perhaps a level of trust. Users who supply their signature through their first message into the tracker should be at a lower level of trust to those who supply their signature to an admin for submission to their user details. Anonymous Users ~~~~~~~~~~~~~~~ The "anonymous" user must always exist, and defines the access permissions for anonymous users. Unknown users accessing Roundup through the web or email interfaces will be logged in as the "anonymous" user. Use Cases ~~~~~~~~~ public - end users can submit bugs, request new features, request support The Users would be given the default "User" Role which gives "View" and "Edit" Permission to the "issue" class. developer - developers can fix bugs, implement new features, provide support A new Role "Developer" is created with the Permission "Fixer" which is checked for in custom auditors that see whether the issue is being resolved with a particular resolution ("fixed", "implemented", "supported") and allows that resolution only if the permission is available. manager - approvers/managers can approve new features and signoff bug fixes A new Role "Manager" is created with the Permission "Signoff" which is checked for in custom auditors that see whether the issue status is being changed similar to the developer example. admin - administrators can add users and set user's roles The existing Role "Admin" has the Permissions "Edit" for all classes (including "user") and "Web Roles" which allow the desired actions. system - automated request handlers running various report/escalation scripts A combination of existing and new Roles, Permissions and auditors could be used here. privacy - issues that are only visible to some users A new property is added to the issue which marks the user or group of users who are allowed to view and edit the issue. An auditor will check for edit access, and the template user object can check for view access. Deployment Scenarios -------------------- The design described above should be general enough to permit the use of Roundup for bug tracking, managing projects, managing patches, or holding discussions. By using items of multiple types, one could deploy a system that maintains requirement specifications, catalogs bugs, and manages submitted patches, where patches could be linked to the bugs and requirements they address. Acknowledgements ---------------- My thanks are due to Christy Heyl for reviewing and contributing suggestions to this paper and motivating me to get it done, and to Jesse Vincent, Mark Miller, Christopher Simons, Jeff Dunmall, Wayne Gramlich, and Dean Tribble for their assistance with the first-round submission. Changes to this document ------------------------ - Added Boolean and Number types - Added section Hyperdatabase Implementations - "Item" has been renamed to "Issue" to account for the more specific nature of the Class. - New Templating - Access Controls - Added "actor" property ------------------ Back to `Table of Contents`_ .. _`Table of Contents`: index.html .. _customisation: customizing.html code-71d8025784d0/doc/developers.txt0000644000000000000000000004204011052420374015171 0ustar 00000000000000================== Developing Roundup ================== :Version: $Revision: 1.16 $ .. note:: The intended audience of this document is the developers of the core Roundup code. If you just wish to alter some behaviour of your Roundup installation, see `customising roundup`_. .. contents:: Getting Started --------------- Anyone wishing to help in the development of Roundup must read `Roundup's Design Document`_ and the `implementation notes`_. All development is coordinated through two resources: - roundup-dev mailing list at http://lists.sourceforge.net/mailman/listinfo/roundup-devel - Sourceforge's issue trackers at https://sourceforge.net/tracker/?group_id=31577 Small Changes ------------- Most small changes can be submitted through the `feature tracker`_, with patches attached that give context diffs of the affected source. CVS Access ---------- To get CVS access, contact richard@users.sourceforge.net. CVS stuff: 1. to tag a release (eg. the pre-release of 0.5.0):: cvs tag release-0-5-0-pr1 1. to make a branch (eg. branching for code freeze/release):: cvs co -d maint-0-5 -r release-0-5-0-pr1 roundup cd maint-0-5 cvs tag -b maint-0-5 2. to check out a branch (eg. the maintenance branch for 0.5.x):: cvs co -d maint-0-5 -r maint-0-5 3. to merge changes from the maintenance branch to the trunk, in the directory containing the HEAD checkout:: cvs up -j maint-0-5 though this is highly discouraged, as it generally creates a whole swag of conflicts :( Standard tag names: *release-maj-min-patch[-sub]* Release of the major.minor.patch release, possibly a beta or pre-release, in which case *sub* will be one of "b*N*" or "pr*N*". *maint-maj-min* Maintenance branch for the major.minor release. Patch releases are tagged in this branch. Typically, release happen like this: 1. work progresses in the HEAD branch until milestones are met, 2. a series of beta releases are tagged in the HEAD until the code is stable enough to freeze, 3. the pre-release is tagged in the HEAD, with the resultant code branched to the maintenance branch for that release, 4. bugs in the release are patched in the maintenance branch, and the final and patch releases are tagged there, and 5. further major work happens in the HEAD. Project Rules ------------- Mostly the project follows Guido's Style (though naming tends to be a little relaxed sometimes). In short: - 80 column width code - 4-space indentations - All modules must have a CVS Id line near the top Other project rules: - New functionality must be documented, even briefly (so at least we know where there's missing documentation) and changes to tracker configuration must be logged in the upgrading document. - subscribe to roundup-checkins to receive checkin notifications from the other developers with CVS access - discuss any changes with the other developers on roundup-dev. If nothing else, this makes sure there's no rude shocks - write unit tests for changes you make (where possible), and ensure that all unit tests run before committing changes - run pychecker over changed code The administrators of the project reserve the right to boot developers who consistently check in code which is either broken or takes the codebase in directions that have not been agreed to. Debugging Aids -------------- Try turning on logging of DEBUG level messages. This may be done a number of ways, depending on what it is you're testing: 1. If you're testing the database unit tests, then set the environment variable ``LOGGING_LEVEL=DEBUG``. This may be done like so: LOGGING_LEVEL=DEBUG python run_tests.py This variable replaces the older HYPERDBDEBUG environment var. 2. If you're testing a particular tracker, then set the logging level in your tracker's ``config.ini``. Internationalization Notes -------------------------- How stuff works: 1. Strings that may require translation (messages in human language) are marked in the source code. This step is discussed in `Marking Strings for Translation`_ section. 2. These strings are all extracted into Message Template File ``locale/roundup.pot`` (_`POT` file). See `Extracting Translatable Messages`_ below. 3. Language teams use POT file to make Message Files for national languages (_`PO` files). All PO files for Roundup are kept in the ``locale`` directory. Names of these files are target locale names, usually just 2-letter language codes. `Translating Messages`_ section of this chapter gives useful hints for message translators. 4. Translated Message Files are compiled into binary form (_`MO` files) and stored in ``locale`` directory (but not kept in the `Roundup CVS`_ repository, as they may be easily made from PO files). See `Compiling Message Catalogs`_ section. 5. Roundup installer creates runtime locale structure on the file system, putting MO files in their appropriate places. 6. Runtime internationalization (_`I18N`) services use these MO files to translate program messages into language selected by current Roundup user. Roundup command line interface uses locale name set in OS environment variable ``LANGUAGE``, ``LC_ALL``, ``LC_MESSAGES``, or ``LANG`` (in that order). Roundup Web User Interface uses language selected by currently authenticated user. Additional details may be found in `GNU gettext`_ and Python `gettext module`_ documentation. `Roundup source distribution`_ includes POT and PO files for message translators, and also pre-built MO files to facilitate installations from source. Roundup binary distribution includes MO files only. .. _GNU gettext: GNU gettext package ^^^^^^^^^^^^^^^^^^^ This chapter is full of references to GNU `gettext package`_. GNU gettext is a "must have" for nearly all steps of internationalizing any program, and it's manual is definetely a recommended reading for people involved in `I18N`_. There are GNU gettext ports to all major OS platforms. Windows binaries are available from `GNU mirror sites`_. Roundup does not use GNU gettext at runtime, but it's tools are used for `extracting translatable messages`_, `compiling message catalogs`_ and, optionally, for `translating messages`_. Note that ``gettext`` package in some OS distributions means just runtime tools and libraries. In such cases gettext development tools are usually distributed in separate package named ``gettext-devel``. Marking Strings for Translation ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Strings that need translation must be marked in the source code. Following subsections explain how this is done in different cases. If translatable string is used as a format string, it is recommended to always use *named* format specifiers:: _('Index of %(classname)s') % locals() This helps translators to better understand the context of the message and, with Python formatting, remove format specifier altogether (which is sometimes useful, especially in singular cases of `Plural Forms`_). When there is more than one format specifier in the translatable format string, named format specifiers **must** be used almost always, because translation may require different order of items. It is better to *not* mark for translation strings that are not locale-dependent, as this makes it more difficult to keep track of translation completeness. For example, string ```` (in ``index()`` method of the request handler in ``roundup_server`` script) has no human readable parts at all, and needs no translations. Such strings are left untranslated in PO files, and are reported as such by PO status checkers (e.g. ``msgfmt --statistics``). Command Line Interfaces ~~~~~~~~~~~~~~~~~~~~~~~ Scripts and routines run from the command line use "static" language defined by environment variables recognized by ``gettext`` module from Python library (``LANGUAGE``, ``LC_ALL``, ``LC_MESSAGES``, and ``LANG``). Primarilly, these are ``roundup-admin`` script and ``admin.py`` module, but also help texts and startup error messages in other scripts and their supporting modules. For these interfaces, Python ``gettext`` engine must be initialized to use Roundup message catalogs. This is normally done by including the following line in the module imports:: from i18n import _, ngettext Simple translations are automatically marked by calls to builtin message translation function ``_()``:: print _("This message is translated") Translations for messages whose grammatical depends on a number must be done by ``ngettext()`` function:: print ngettext("Nuked %i file", "Nuked %i files", number_of_files_nuked) Deferred Translations ~~~~~~~~~~~~~~~~~~~~~ Sometimes translatable strings appear in the source code in untranslated form [#note_admin.py]_ and must be translated elsewhere. Example:: for meal in ("spam", "egg", "beacon"): print _(meal) In such cases, strings must be marked for translation without actual call to the translating function. To mark these strings, we use Python feature of automatic concatenation of adjacent strings and different types of string quotes:: strings_to_translate = ( ''"This string will be translated", ""'me too', ''r"\raw string", ''""" multiline string""" ) .. [#note_admin.py] In current Roundup sources, this feature is extensively used in the ``admin`` module using method docstrings as help messages. Web User Interface ~~~~~~~~~~~~~~~~~~ For Web User Interface, translation services are provided by Client object. Action classes have methods ``_()`` and ``gettext()``, delegating translation to the Client instance. In HTML templates, translator object is available as context variable ``i18n``. HTML templates have special markup for translatable strings. The syntax for this markup is defined on `ZPTInternationalizationSupport`_ page. Roundup translation service currently ignores values for ``i18n:domain``, ``i18n:source`` and ``i18n:target``. Template markup examples: * simplest case::
Say no more!
this will result in msgid ``"Say no more!"``, with all leading and trailing whitespace stripped, and inner blanks replaced with single space character. * using variable slots::
And now...
No.
THE LARCH
Msgid will be: ``"And now...
No.${slideNo}
THE LARCH"``. Template rendering will use context variable ``number`` (you may use any expression) to put instead of ``${slideNo}`` in translation. * attribute translation::