- fixes javascript notations (not working on Chrome)

pboard/pboard/controllers/api.py

 
     menu = pcam.PODApiMenuController()
 
+    def on_off_to_boolean(self, on_or_off):
+        return True if on_or_off=='on' else False
+
     @expose()
-    def create_event(self, parent_id=None, data_label='', data_datetime=None, data_content='', data_reminder_datetime=None, add_reminder=False, **kw):
+    def create_event(self, parent_id=None, data_label='', data_datetime=None, data_content='', data_reminder_datetime=None, add_reminder=False, inherit_rights='off', **kw):
       loCurrentUser   = pld.PODStaticController.getCurrentUser()
       loApiController = pld.PODUserFilteredApiController(loCurrentUser.user_id)
-      
-      loNewNode = loApiController.createNode(int(parent_id))
+
+      loNewNode = loApiController.createNode(int(parent_id), self.on_off_to_boolean(inherit_rights))
       loNewNode.node_type     = pmd.PBNodeType.Event
       loNewNode.data_label    = data_label
       loNewNode.data_content  = data_content
       redirect(lurl('/document/%i'%(loNewNode.parent_id)))
 
     @expose()
-    def create_contact(self, parent_id=None, data_label='', data_content='', **kw):
+    def create_contact(self, parent_id=None, data_label='', data_content='', inherit_rights='off', **kw):
       loCurrentUser   = pld.PODStaticController.getCurrentUser()
       loApiController = pld.PODUserFilteredApiController(loCurrentUser.user_id)
       
-      loNewNode = loApiController.createNode(int(parent_id))
+      loNewNode = loApiController.createNode(int(parent_id), self.on_off_to_boolean(inherit_rights))
       loNewNode.node_type     = pmd.PBNodeType.Contact
       loNewNode.data_label    = data_label
       loNewNode.data_content  = data_content
       loCurrentUser   = pld.PODStaticController.getCurrentUser()
       loApiController = pld.PODUserFilteredApiController(loCurrentUser.user_id)
 
-      loNewNode = loApiController.createNode(int(parent_id))
+      loNewNode = loApiController.createNode(int(parent_id), self.on_off_to_boolean(is_shared))
       loNewNode.node_type     = pmd.PBNodeType.Comment
       loNewNode.data_label    = data_label
       loNewNode.data_content  = data_content
       redirect(lurl('/document/%i'%(loNewNode.parent_id)))
 
     @expose()
-    def create_file(self, parent_id=None, data_label='', data_content='', data_file=None, **kw):
+    def create_file(self, parent_id=None, data_label='', data_content='', data_file=None, inherit_rights='off', **kw):
       loCurrentUser   = pld.PODStaticController.getCurrentUser()
       loApiController = pld.PODUserFilteredApiController(loCurrentUser.user_id)
       
-      loNewNode = loApiController.createNode(int(parent_id))
+      loNewNode = loApiController.createNode(int(parent_id), self.on_off_to_boolean(inherit_rights))
       loNewNode.node_type     = pmd.PBNodeType.File
       loNewNode.data_label    = data_label
       loNewNode.data_content  = data_content
       redirect(lurl('/document/%s'%(node_id)))
 
     @expose()
-    def create_document(self, parent_id=None, data_label='', data_content=''):
+    def create_document(self, parent_id=None, data_label='', data_content='', inherit_rights='off'):
       loCurrentUser   = pld.PODStaticController.getCurrentUser()
       loApiController = pld.PODUserFilteredApiController(loCurrentUser.user_id)
 
         loParent = loApiController.getNode(parent_id)
         lsNodeName = 'Subdocument of (%s)' % loParent.data_label
 
-      loNewNode = loApiController.createDummyNode(parent_id)
+      loNewNode = loApiController.createDummyNode(parent_id, self.on_off_to_boolean(inherit_rights))
       loNewNode.data_label   = lsNodeName
       loNewNode.data_content = 'insert content...'
 
       redirect(lurl('/document/%s#tab-comments'%(loNode._oParent.node_id)))
 
     @expose()
-    @require(can_read())
+    @require(can_write())
     def set_access_management(self, node_id, is_shared='off', read=[0], write=[0]):
 
       llReadAccessGroupIds = [int(liGroupId) for liGroupId in read]

pboard/pboard/controllers/apimenu.py

             print("Node not found: {0}".format(current_node_id))
 
         allowed_nodes = api_controller.getListOfAllowedNodes()
-        initial_menu_structure = api_controller.buildTreeListForMenu(current_node, pmd.PBNodeStatus.getVisibleIdsList(), allowed_nodes)
+        initial_menu_structure = api_controller.buildTreeListForMenu(current_node, allowed_nodes)
 
         return initial_menu_structure
 

pboard/pboard/lib/dbapi.py

     return self._iUserIdFilteringList
 
 
-  def createNode(self, parent_id=0):
+  def createNode(self, parent_id=0, inherit_rights=True):
     loNode          = pbmd.PBNode()
     loNode.owner_id = self._iCurrentUserId
     if int(parent_id)!=0:
-      loNode.parent_id = parent_id
-    parent_rights = DBSession.query(pbma.Rights).filter(pbma.Rights.node_id==parent_id).all()
-    loNode.rights = parent_rights
-    loNode.rights = [pbma.Rights(group_id=r.group_id, rights=r.rights) for r in parent_rights]
+        loNode.parent_id = parent_id
+
+    if inherit_rights:
+        parent_node = DBSession.query(pbmd.PBNode).filter(pbmd.PBNode.node_id==parent_id).one()
+        self.copy_rights(parent_node, loNode)
+
     DBSession.add(loNode)
+
     return loNode
-  
-  def createDummyNode(self, parent_id):
-    loNewNode = self.createNode(parent_id)
+
+  def copy_rights(self, from_node: pbmd.PBNode, to_node: pbmd.PBNode, copy_also_is_shared=True):
+    """
+    copy rights from first node to second one
+    """
+    for parent_right in from_node._lRights:
+        new_right = self.createRight()
+        new_right.group_id = parent_right.group_id
+        new_right.rights = parent_right.rights
+        to_node._lRights.append(new_right)
+
+    if copy_also_is_shared:
+        to_node.is_shared = from_node.is_shared
+
+  def createDummyNode(self, parent_id, inherit_rights=True):
+    loNewNode = self.createNode(parent_id, inherit_rights)
     loNewNode.data_label   = ''
     loNewNode.data_content = ''
     return loNewNode
             FROM
                 pod_group_node AS pgn
                 join pod_user_group AS pug ON pug.group_id = pgn.group_id
-                join pod_nodes AS pn ON pgn.node_id=pn.node_id
+                join pod_nodes AS pn ON pgn.node_id=pn.node_id AND pn.is_shared='t'
             WHERE
                 pn.node_type='data'
                 AND pn.node_status NOT IN ('deleted', 'closed')
                 AND pn.node_id=pgn.node_id
                 AND pgn.rights > 0
-                AND pug.user_id = 3
+                AND pug.user_id = :owner_id
 
             UNION
                 SELECT
                 FROM
                     pod_nodes AS pn
                 WHERE
-                    pn.node_type='data'
+                    pn.node_type = 'data'
                     AND pn.node_status NOT IN ('deleted', 'closed')
-                    AND pn.owner_id=:owner_id
+                    AND pn.owner_id = :owner_id
 
             ORDER BY node_id ASC
         """
 
 
 
-  def buildTreeListForMenu(self, poCurrentNode: pbmd.PBNode, plViewableStatusId: [], plAllowedNodes: [pbmd.PBNode]) -> [pbmd.NodeTreeItem]:
+  def buildTreeListForMenu(self, current_node: pbmd.PBNode, allowed_nodes: [pbmd.PBNode]) -> [pbmd.NodeTreeItem]:
     # The algorithm is:
     # 1. build an intermediate tree containing only current node and parent path
     #    + complete it with sibling at each level (except root)
     previous_tree_item = None
     tmp_children_nodes = []
 
-    print("============================> ",poCurrentNode)
-    if poCurrentNode is not None:
-        breadcrumb_nodes = poCurrentNode.getBreadCrumbNodes()
-        print("====================> NODES", breadcrumb_nodes)
-        breadcrumb_nodes.append(poCurrentNode) # by default the current node is not included
+    if current_node is not None:
+        breadcrumb_nodes = current_node.getBreadCrumbNodes()
+        breadcrumb_nodes.append(current_node) # by default the current node is not included
 
         for breadcrumb_node in reversed(breadcrumb_nodes):
             if previous_tree_item is None:
                 # First iteration. We add all current_node children
                 for child_node in breadcrumb_node.getChildren():
-                    child_item = pbmd.NodeTreeItem(child_node, [])
-                    assert(isinstance(child_item, pbmd.NodeTreeItem))
-                    tmp_children_nodes.append(child_item)
+                    if child_node in allowed_nodes:
+                        child_item = pbmd.NodeTreeItem(child_node, [])
+                        tmp_children_nodes.append(child_item)
+
                 previous_tree_item = pbmd.NodeTreeItem(breadcrumb_node, tmp_children_nodes)
+
             else:
                 tmp_children_nodes = []
                 for child_node in breadcrumb_node.getChildren():
-                    if child_node == previous_tree_item.node:
-                        assert(isinstance(previous_tree_item, pbmd.NodeTreeItem))
-                        tmp_children_nodes.append(previous_tree_item)
-                    else:
-                        sibling_node = pbmd.NodeTreeItem(child_node, [])
-                        assert(isinstance(sibling_node, pbmd.NodeTreeItem))
-                        tmp_children_nodes.append(sibling_node)
+                    if child_node in allowed_nodes:
+                        if child_node == previous_tree_item.node:
+                            tmp_children_nodes.append(previous_tree_item)
+                        else:
+                            sibling_node = pbmd.NodeTreeItem(child_node, [])
+                            tmp_children_nodes.append(sibling_node)
 
                 previous_tree_item = pbmd.NodeTreeItem(breadcrumb_node, tmp_children_nodes)
 
-    for node in plAllowedNodes:
+    for node in allowed_nodes:
         # This part of the algorithm insert root items
         if node.parent_id==0 or node.parent_id is None:
             if previous_tree_item is not None and node == previous_tree_item.node:
             # Try to add nodes shared with me but with a parent which is not shared
             if node.owner_id!=self._iCurrentUserId:
                 # this is a node shared with me
-                if node._oParent!=None and node._oParent not in plAllowedNodes:
+                if node._oParent!=None and node._oParent not in allowed_nodes:
                     # the node is shared but not the parent => put it in the root
-                    node_tree.append(pbmd.NodeTreeItem(node))
+                    node_tree.append(pbmd.NodeTreeItem(node, []))
 
 
     return node_tree

pboard/pboard/public/javascript/pod.js

-  function generateStringId(charNb = 32, allowedChars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789") {
+  function generateStringId(charNb, allowedChars) {
+    if (typeof charNb === 'undefined') { charNb = 32; }
+    if (typeof allowedChars === 'undefined') { allowedChars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"; }
+  
     var text = "";
 
     for( var i=0; i < charNb; i++ ) {

pboard/pboard/templates/document-widgets-tabs.mak

           <div id="document-share-people-selector">
             <p>${_('Select read and write access for each group or people...')}</p>
             <script>
-            function updateRights(psUserId, piNewValue = -1) {
+            function updateRights(psUserId, piNewValue) {
+              if (typeof piNewValue === 'undefined') { piNewValue = -1; }
               var ACCESS_UNDEFINED = -1;
               var ACCESS_NONE = 0;
               var ACCESS_READ = 1;
   % endfor
 </%def>
 
-<%def name="CommentTabContent(poNode)">
+<%def name="CommentTabContent(current_user, poNode)">
   <h4>${_('Comment thread')}</h4>
   
   % if len(poNode.getComments())<=0:
     % endif
     <div>
       % for comment in poNode.getComments():
-        <p>
-          <a href="${tg.url('/api/toggle_share_status', dict(node_id=comment.node_id))}">
-            % if comment.is_shared:
-              <span class="label label-warning" title="${_('Shared comment. Click to make private.')}">${h.ICON.Shared|n}</span>
-            % else:
-              <span class="label label-info" title="${_('Private comment. Click to share.')}">${h.ICON.Private|n}</span>
-            % endif
-          </a>
-          <strong>${comment._oOwner.display_name}</strong>
-          <i class="pull-right">
-            The ${comment.getFormattedDate(comment.updated_at)} 
-            at ${comment.getFormattedTime(comment.updated_at)}
-          </i>
-          <br/>
-          ${comment.data_content|n}
-          <hr style="border-top: 1px dotted #ccc; margin: 0;"/>
-        </p>
+         % if comment.is_shared or comment.owner_id==current_user.user_id:
+##
+## FIXME - 2014-05-29
+## We do not check specific rights on comment but on document instead
+## In the future full-API architecture, it should be fixed
+##
+          <p>
+            <a href="${tg.url('/api/toggle_share_status', dict(node_id=comment.node_id))}">
+              % if comment.is_shared:
+                <span class="label label-warning" title="${_('Shared comment. Click to make private.')}">${h.ICON.Shared|n}</span>
+              % else:
+                <span class="label label-info" title="${_('Private comment. Click to share.')}">${h.ICON.Private|n}</span>
+              % endif
+            </a>
+            <strong>${comment._oOwner.display_name}</strong>
+            <i class="pull-right">
+              The ${comment.getFormattedDate(comment.updated_at)} 
+              at ${comment.getFormattedTime(comment.updated_at)}
+            </i>
+            <br/>
+            ${comment.data_content|n}
+            <hr style="border-top: 1px dotted #ccc; margin: 0;"/>
+          </p>
+        % endif
       % endfor
     </div>
   % endif

pboard/pboard/templates/document-widgets.mak

   </div>
 </%def>
 
-<%def name="BreadCrumb(poNode)">
+<%def name="BreadCrumb(poNode, allowed_nodes)">
   <ul class="breadcrumb span12">
     <li>
       <span class="divider">/</span>
     </li>
     % if poNode!=None:
       % for breadcrumb_node in poNode.getBreadCrumbNodes():
-      <li>
-        <span class="divider">/</span>
-        <a href="${tg.url('/document/%s'%(breadcrumb_node.node_id))}">${breadcrumb_node.getTruncatedLabel(30)}</a>
-      </li>
+##
+## HACK - D.A - 2014-05-29
+## Here we remove forbidden nodes from the breadcrumb
+## This should not be done in the templates!
+##
+        % if breadcrumb_node in allowed_nodes:
+          <li>
+            <span class="divider">/</span>
+            <a href="${tg.url('/document/%s'%(breadcrumb_node.node_id))}">${breadcrumb_node.getTruncatedLabel(30)}</a>
+          </li>
+        % endif
       % endfor
       <li class="active">
         <span class="divider">/</span>
   </div>
 </%def>
 
-<%def name="DocumentEditModalDialog(piParentNodeId, poNode, psPostUrl, psModalId, psTitle)">
+<%def name="DocumentEditModalDialog(poParentNode, poNode, psPostUrl, psModalId, psTitle)">
   <div
     id="${psModalId}"
     class="modal hide"
           % if poNode!=None:
             <input type="hidden" name="node_id" value="${poNode.node_id}"/>
           % endif
-          <input type="hidden" name="parent_id" value="${piParentNodeId if piParentNodeId else 0}"/>
+          <input type="hidden" name="parent_id" value="${poParentNode.node_id if poParentNode else 0}"/>
           
           <input type="hidden" name="data_content" id="${psModalId}-textarea" />
           <input
         <div>
           ${POD.RichTextEditor(psModalId+'-textarea-wysiwyg', poNode.data_content if poNode!=None else '')}
         </div>
+        % if poParentNode and poParentNode.is_shared:
+          <p>
+            <input type="checkbox" name="inherit_rights" checked="checked"/> 
+            ${_('Share:')}
+            <span class="pod-grey">${_('if checked, then copy share properties from current item')}</span>
+          </p>
+        % endif
       </form>
 
 ## MODAL BODY [END]
 </%def>
 
 
-<%def name="FileEditModalDialog(piParentNodeId, poNode, psPostUrl, psModalId, psTitle)">
+<%def name="FileEditModalDialog(poParentNode, poNode, psPostUrl, psModalId, psTitle)">
   <div
     id="${psModalId}"
     class="modal hide"
           % if poNode!=None:
             <input type="hidden" name="node_id" value="${poNode.node_id}"/>
           % endif
-          <input type="hidden" name="parent_id" value="${piParentNodeId if piParentNodeId else 0}"/>
+          <input type="hidden" name="parent_id" value="${poParentNode.node_id if poParentNode else 0}"/>
           <input type="hidden" name="data_content" id="${psModalId}-textarea" />
         <div>
           <label>
           <label>${_('File description (optionnal)')}</label>
           ${POD.RichTextEditor(psModalId+'-textarea-wysiwyg', poNode.data_content if poNode!=None else '', '')}
         </div>
+        % if poParentNode and poParentNode.is_shared:
+          <p>
+            <input type="checkbox" name="inherit_rights" checked="checked"/>
+            ${_('Share:')}
+            <span class="pod-grey">${_('if checked, then copy share properties from current item')}</span>
+          </p>
+        % endif
       </form>
     ## MODAL BODY [END]
     </div>
   </div>
 </%def>
 
-<%def name="EventEditModalDialog(piParentNodeId, poNode, psPostUrl, psModalId, psTitle)">
+<%def name="EventEditModalDialog(poParentNode, poNode, psPostUrl, psModalId, psTitle)">
   <div
     id="${psModalId}"
     class="modal hide"
     <div class="modal-body">
     ###### MODAL BODY
       <form id='${psModalId}-form' action='${psPostUrl}' method='POST'>
-        <input type="hidden" name='parent_id' value='${current_node.node_id}'/>
+        <input type="hidden" name='parent_id' value="${poParentNode.node_id if poParentNode else 0}"/>
         <fieldset>
           <label>
             ${_('Event')}
               ${POD.RichTextEditor(psModalId+'-textarea-wysiwyg', poNode.data_content if poNode!=None else '', 'boldanditalic')}
             </div>
           </label>
+          % if poParentNode and poParentNode.is_shared:
+            <label>
+              <p>
+                <input type="checkbox" name="inherit_rights" checked="checked"/>
+                ${_('Share:')}
+                <span class="pod-grey">${_('if checked, then copy share properties from current item')}</span>
+              </p>
+            <label>
+          % endif
         </fieldset>
       </form>
     ###### MODAL BODY [END]
   </div>
 </%def>
 
-<%def name="ContactEditModalDialog(piParentNodeId, poNode, psPostUrl, psModalId, psTitle)">
+<%def name="ContactEditModalDialog(poParentNode, poNode, psPostUrl, psModalId, psTitle)">
   <div
     id="${psModalId}"
     class="modal hide"
           % if poNode!=None:
             <input type="hidden" name="node_id" value="${poNode.node_id}"/>
           % endif
-          <input type="hidden" name="parent_id" value="${piParentNodeId if piParentNodeId else 0}"/>
+          <input type="hidden" name="parent_id" value="${poParentNode.node_id if poParentNode else 0}"/>
           <input type="hidden" name="data_content" id="${psModalId}-textarea" />
         <div>
           <label>
           <label>${_('Address, phone, email, company...')}</label>
           ${POD.RichTextEditor(psModalId+'-textarea-wysiwyg', poNode.data_content if poNode!=None else '', 'boldanditalic')}
         </div>
+        % if poParentNode and poParentNode.is_shared:
+          <label>
+            <p>
+              <input type="checkbox" name="inherit_rights" checked="checked"/>
+              ${_('Share:')}
+              <span class="pod-grey">${_('if checked, then copy share properties from current item')}</span>
+            </p>
+          <label>
+        % endif
+
       </form>
     ## MODAL BODY [END]
     </div>

pboard/pboard/templates/document.mak

 ## HERE COMES THE BREADCRUMB
 ##
   <div class="row">
-    ${DOC.BreadCrumb(current_node)}
+    ${DOC.BreadCrumb(current_node, allowed_nodes)}
   </div>
 
   <div class="row">
           ##
           ## HERE WE INCLUDE ALL MODAL DIALOG WHICH WILL BE ACCESSIBLE THROUGH TABS OR MENU
           ##
-          ${DOC.DocumentEditModalDialog(current_node.node_id, None, tg.url('/api/create_document'), h.ID.AddDocumentModalForm(current_node), _('New Sub-document'))}
-          ${DOC.EventEditModalDialog(current_node.node_id, None, tg.url('/api/create_event'), h.ID.AddEventModalForm(current_node), _('Add an event'))}
-          ${DOC.ContactEditModalDialog(current_node.node_id, None, tg.url('/api/create_contact'), h.ID.AddContactModalForm(current_node), _('Add a new contact'))}
-          ${DOC.FileEditModalDialog(current_node.node_id, None, tg.url('/api/create_file'), h.ID.AddFileModalForm(current_node), _('Add a new file'))}
+          ${DOC.DocumentEditModalDialog(current_node, None, tg.url('/api/create_document'), h.ID.AddDocumentModalForm(current_node), _('New Sub-document'))}
+          ${DOC.EventEditModalDialog(current_node, None, tg.url('/api/create_event'), h.ID.AddEventModalForm(current_node), _('Add an event'))}
+          ${DOC.ContactEditModalDialog(current_node, None, tg.url('/api/create_contact'), h.ID.AddContactModalForm(current_node), _('Add a new contact'))}
+          ${DOC.FileEditModalDialog(current_node, None, tg.url('/api/create_file'), h.ID.AddFileModalForm(current_node), _('Add a new file'))}
           ${DOC.MoveDocumentModalDialog(current_node, tg.url('/api/set_parent_node'), h.ID.MoveDocumentModalForm(current_node), _('Move the document'))}
 
           <div class="tabbable">
               <div class="tab-pane" id="subdocuments">${DOCTABS.SubdocumentContent(current_node)}</div>
               <div class="tab-pane active" id="events">${DOCTABS.EventTabContent(current_node)}</div>
               <div class="tab-pane" id="contacts">${DOCTABS.ContactTabContent(current_node)}</div>
-              <div class="tab-pane" id="comments">${DOCTABS.CommentTabContent(current_node)}</div>
+              <div class="tab-pane" id="comments">${DOCTABS.CommentTabContent(current_user, current_node)}</div>
               <div class="tab-pane" id="files">${DOCTABS.FileTabContent(current_node)}</div>
               <div class="tab-pane" id="history">${DOCTABS.HistoryTabContent(current_node)}</div>
               <div class="tab-pane" id="accessmanagement">${DOCTABS.AccessManagementTab(current_node)}</div>