Really should have split this into many more commits:

- Now use proxy to pull trait data and hide traits/results that the user
doesn't have view permission for

- Created a factory method for creating trait ob so it can return None
when user doesn't have view permissions (this is why such a large number
of files are changed)

- Added metadata to permutation export

- Added current group management code

- Added fixed password verification e-mail code

1 files changed, 71 insertions, 106 deletions

diff --git a/wqflask/base/trait.py b/wqflask/base/trait.py
index 1b7cb23c..b133bf21 100644
--- a/wqflask/base/trait.py
+++ b/wqflask/base/trait.py
@@ -11,6 +11,7 @@ from base.data_set import create_dataset
 from db import webqtlDatabaseFunction
 from utility import webqtlUtil
 from utility import hmac
+from utility.authentication_tools import check_resource_availability
 from utility.tools import GN2_BASE_URL
 from utility.redis_tools import get_redis_conn
 Redis = get_redis_conn()
@@ -21,11 +22,33 @@ import simplejson as json
 from MySQLdb import escape_string as escape
 from pprint import pformat as pf
 
-from flask import Flask, g, request, url_for
+from flask import Flask, g, request, url_for, redirect
 
 from utility.logger import getLogger
 logger = getLogger(__name__ )
 
+def create_trait(**kw):
+    assert bool(kw.get('dataset')) != bool(kw.get('dataset_name')), "Needs dataset ob. or name";
+
+    permitted = True
+    if kw.get('name'):
+        if kw.get('dataset_name'):
+            if kw.get('dataset_name') != "Temp":
+                dataset = create_dataset(kw.get('dataset_name'))
+        else:
+            dataset = kw.get('dataset')
+
+        if kw.get('dataset_name') != "Temp":
+            if dataset.type == 'Publish':
+                permitted = check_resource_availability(dataset, kw.get('name'))
+            else:
+                permitted = check_resource_availability(dataset)
+
+    if permitted:
+        return GeneralTrait(**kw)
+    else:
+        return None
+
 class GeneralTrait(object):
     """
     Trait class defines a trait in webqtl, can be either Microarray,
@@ -50,6 +73,7 @@ class GeneralTrait(object):
         self.haveinfo = kw.get('haveinfo', False)
         self.sequence = kw.get('sequence')         # Blat sequence, available for ProbeSet
         self.data = kw.get('data', {})
+        self.view = True
 
         # Sets defaults
         self.locus = None
@@ -77,6 +101,7 @@ class GeneralTrait(object):
         # So we could add a simple if statement to short-circuit this if necessary
         if self.dataset.type != "Temp":
             self = retrieve_trait_info(self, self.dataset, get_qtl_info=get_qtl_info)
+
         if get_sample_info != False:
             self = retrieve_sample_data(self, self.dataset)
 
@@ -212,26 +237,28 @@ def get_sample_data():
     trait = params['trait']
     dataset = params['dataset']
 
-    trait_ob = GeneralTrait(name=trait, dataset_name=dataset)
-
-    trait_dict = {}
-    trait_dict['name'] = trait
-    trait_dict['db'] = dataset
-    trait_dict['type'] = trait_ob.dataset.type
-    trait_dict['group'] = trait_ob.dataset.group.name
-    trait_dict['tissue'] = trait_ob.dataset.tissue
-    trait_dict['species'] = trait_ob.dataset.group.species
-    trait_dict['url'] = url_for('show_trait_page', trait_id = trait, dataset = dataset)
-    trait_dict['description'] = trait_ob.description_display
-    if trait_ob.dataset.type == "ProbeSet":
-        trait_dict['symbol'] = trait_ob.symbol
-        trait_dict['location'] = trait_ob.location_repr
-    elif trait_ob.dataset.type == "Publish":
-        if trait_ob.pubmed_id:
-            trait_dict['pubmed_link'] = trait_ob.pubmed_link
-        trait_dict['pubmed_text'] = trait_ob.pubmed_text
-
-    return json.dumps([trait_dict, {key: value.value for key, value in trait_ob.data.iteritems() }])
+    trait_ob = create_trait(name=trait, dataset_name=dataset)
+    if trait_ob:
+        trait_dict = {}
+        trait_dict['name'] = trait
+        trait_dict['db'] = dataset
+        trait_dict['type'] = trait_ob.dataset.type
+        trait_dict['group'] = trait_ob.dataset.group.name
+        trait_dict['tissue'] = trait_ob.dataset.tissue
+        trait_dict['species'] = trait_ob.dataset.group.species
+        trait_dict['url'] = url_for('show_trait_page', trait_id = trait, dataset = dataset)
+        trait_dict['description'] = trait_ob.description_display
+        if trait_ob.dataset.type == "ProbeSet":
+            trait_dict['symbol'] = trait_ob.symbol
+            trait_dict['location'] = trait_ob.location_repr
+        elif trait_ob.dataset.type == "Publish":
+            if trait_ob.pubmed_id:
+                trait_dict['pubmed_link'] = trait_ob.pubmed_link
+            trait_dict['pubmed_text'] = trait_ob.pubmed_text
+
+        return json.dumps([trait_dict, {key: value.value for key, value in trait_ob.data.iteritems() }])
+    else:
+        return None
     
 def jsonable(trait):
     """Return a dict suitable for using as json
@@ -350,91 +377,36 @@ def retrieve_trait_info(trait, dataset, get_qtl_info=False):
     assert dataset, "Dataset doesn't exist"
 
     if dataset.type == 'Publish':
-        resource_id = hmac.data_hmac("{}:{}".format(dataset.id, trait.name))
-
-        the_url = "http://localhost:8080/run_action/?resource={}&user={}&branch=data&action=view".format(resource_id, g.user_session.user_id)
-        trait_data = json.loads(requests.get("http://localhost:8080/run_action/?resource={}&user={}&branch=data&action=view".format(resource_id, g.user_session.user_id)))
-
-        query = """
-                SELECT
-                        PublishXRef.Id, InbredSet.InbredSetCode, Publication.PubMed_ID,
-                        Phenotype.Pre_publication_description, Phenotype.Post_publication_description, Phenotype.Original_description,
-                        Phenotype.Pre_publication_abbreviation, Phenotype.Post_publication_abbreviation, PublishXRef.mean,
-                        Phenotype.Lab_code, Phenotype.Submitter, Phenotype.Owner, Phenotype.Authorized_Users,
-                        Publication.Authors, Publication.Title, Publication.Abstract,
-                        Publication.Journal, Publication.Volume, Publication.Pages,
-                        Publication.Month, Publication.Year, PublishXRef.Sequence,
-                        Phenotype.Units, PublishXRef.comments
-                FROM
-                        PublishXRef, Publication, Phenotype, PublishFreeze, InbredSet
-                WHERE
-                        PublishXRef.Id = %s AND
-                        Phenotype.Id = PublishXRef.PhenotypeId AND
-                        Publication.Id = PublishXRef.PublicationId AND
-                        PublishXRef.InbredSetId = PublishFreeze.InbredSetId AND
-                        PublishXRef.InbredSetId = InbredSet.Id AND
-                        PublishFreeze.Id = %s
-                """ % (trait.name, dataset.id)
-
-        logger.sql(query)
-        trait_info = g.db.execute(query).fetchone()
-
-
-    #XZ, 05/08/2009: Xiaodong add this block to use ProbeSet.Id to find the probeset instead of just using ProbeSet.Name
-    #XZ, 05/08/2009: to avoid the problem of same probeset name from different platforms.
+        resource_id = hmac.hmac_creation("{}:{}:{}".format('dataset-publish', dataset.id, trait.name))
+        the_url = "http://localhost:8080/run-action?resource={}&user={}&branch=data&action=view".format(resource_id, g.user_session.user_id)
     elif dataset.type == 'ProbeSet':
-        display_fields_string = ', ProbeSet.'.join(dataset.display_fields)
-        display_fields_string = 'ProbeSet.' + display_fields_string
-        query = """
-                SELECT %s
-                FROM ProbeSet, ProbeSetFreeze, ProbeSetXRef
-                WHERE
-                        ProbeSetXRef.ProbeSetFreezeId = ProbeSetFreeze.Id AND
-                        ProbeSetXRef.ProbeSetId = ProbeSet.Id AND
-                        ProbeSetFreeze.Name = '%s' AND
-                        ProbeSet.Name = '%s'
-                """ % (escape(display_fields_string),
-                       escape(dataset.name),
-                       escape(str(trait.name)))
-        logger.sql(query)
-        trait_info = g.db.execute(query).fetchone()
-    #XZ, 05/08/2009: We also should use Geno.Id to find marker instead of just using Geno.Name
-    # to avoid the problem of same marker name from different species.
-    elif dataset.type == 'Geno':
-        display_fields_string = string.join(dataset.display_fields,',Geno.')
-        display_fields_string = 'Geno.' + display_fields_string
-        query = """
-                SELECT %s
-                FROM Geno, GenoFreeze, GenoXRef
-                WHERE
-                        GenoXRef.GenoFreezeId = GenoFreeze.Id AND
-                        GenoXRef.GenoId = Geno.Id AND
-                        GenoFreeze.Name = '%s' AND
-                        Geno.Name = '%s'
-                """ % (escape(display_fields_string),
-                       escape(dataset.name),
-                       escape(trait.name))
-        logger.sql(query)
-        trait_info = g.db.execute(query).fetchone()
-    else: #Temp type
-        query = """SELECT %s FROM %s WHERE Name = %s"""
-        logger.sql(query)
-        trait_info = g.db.execute(query,
-                                  (string.join(dataset.display_fields,','),
-                                               dataset.type, trait.name)).fetchone()
+        resource_id = hmac.hmac_creation("{}:{}".format('dataset-probeset', dataset.id))
+        the_url = "http://localhost:8080/run-action?resource={}&user={}&branch=data&action=view&trait={}".format(resource_id, g.user_session.user_id, trait.name)
+    else:
+        resource_id = hmac.hmac_creation("{}:{}".format('dataset-geno', dataset.id))
+        the_url = "http://localhost:8080/run-action?resource={}&user={}&branch=data&action=view&trait={}".format(resource_id, g.user_session.user_id, trait.name)
+
+    try:
+        response = requests.get(the_url).content
+        if response.strip() == "no-access":
+            trait.view = False
+            return trait
+    except:
+        resource_info = get_resource_info(resource_id)
+        default_permissions = resource_info['default_mask']['data']
+        if 'view' not in default_persmissions:
+            trait.view = False
+            return trait
+
+    trait_info = json.loads(response)
 
     if trait_info:
         trait.haveinfo = True
 
-        #XZ: assign SQL query result to trait attributes.
         for i, field in enumerate(dataset.display_fields):
             holder = trait_info[i]
-            # if isinstance(trait_info[i], basestring):
-            #     logger.debug("HOLDER:", holder)
-            #     logger.debug("HOLDER2:", holder.decode(encoding='latin1'))
-            #     holder = unicode(trait_info[i], "utf-8", "ignore")
-            if isinstance(trait_info[i], basestring):
-                holder = holder.encode('latin1')
+            #if isinstance(trait_info[i], basestring):
+            #    holder = holder.encode('latin1')
             setattr(trait, field, holder)
 
         if dataset.type == 'Publish':
@@ -453,13 +425,6 @@ def retrieve_trait_info(trait, dataset, get_qtl_info=False):
             if trait.confidential:
                 trait.abbreviation = trait.pre_publication_abbreviation
                 trait.description_display = trait.pre_publication_description
-
-                #if not webqtlUtil.hasAccessToConfidentialPhenotypeTrait(
-                #        privilege=self.dataset.privilege,
-                #        userName=self.dataset.userName,
-                #        authorized_users=self.authorized_users):
-                #
-                #    description = self.pre_publication_description
             else:
                 trait.abbreviation = trait.post_publication_abbreviation
                 if description: