add site read-only mode (#24)

CHANGELOG.rst

@@ -19,6 +19,12 @@ Added
     - App setting ``user_modifiable`` validation (#1536)
     - ``AppSettingAPI.get_all_by_scope()`` helper (#1534)
     - ``removeroles`` management command (#1391, #1541)
+    - Site read only mode (#24)
+    - ``site_read_only`` site app setting (#24)
+    - ``is_site_writable()`` rule predicate (#24)
+    - ``PermissionTestMixin.set_site_read_only()`` helper (#24)
+    - ``PROJECTROLES_READ_ONLY_MSG`` setting (#24)
+    - ``SiteReadOnlySettingAjaxView`` Ajax view (#24)
 
 Changed
 -------
@@ -33,6 +39,10 @@ Changed
     - Deprecate ``AppSettingAPI.get_all()`` (#1534)
     - Allow no role for old owner in ``RoleAssignmentOwnerTransferMixin`` (#836, #1391)
     - Allow no role for old owner in ``perform_owner_transfer()`` (#836, #1391)
+- **Tokens**
+    - Update UI for site read-only mode (#24)
+- **Userprofile**
+    - Update UI for site read-only mode (#24)
 
 Removed
 -------

bgjobs/rules.py

@@ -41,24 +41,31 @@
 # Allow creating background jobs
 rules.add_perm(
     'bgjobs.create_bgjob',
-    pr_rules.is_project_owner
-    | pr_rules.is_project_delegate
-    | pr_rules.is_project_contributor,
+    (
+        pr_rules.is_project_owner
+        | pr_rules.is_project_delegate
+        | pr_rules.is_project_contributor
+    )
+    & pr_rules.is_site_writable,
 )
 
 # Allow modifying or deleting the user's background jobs
 rules.add_perm(
     'bgjobs.update_bgjob_own',
-    pr_rules.is_project_owner
-    | pr_rules.is_project_delegate
-    | pr_rules.is_project_contributor
-    | pr_rules.is_project_guest,
+    (
+        pr_rules.is_project_owner
+        | pr_rules.is_project_delegate
+        | pr_rules.is_project_contributor
+        | pr_rules.is_project_guest
+    )
+    & pr_rules.is_site_writable,
 )
 
 # Allow modifying or deleting all background jobs
 rules.add_perm(
     'bgjobs.update_bgjob_all',
-    pr_rules.is_project_owner | pr_rules.is_project_delegate,
+    (pr_rules.is_project_owner | pr_rules.is_project_delegate)
+    & pr_rules.is_site_writable,
 )
 
 # Allow viewing site-global background jobs (not project-specific).

config/settings/base.py

@@ -626,15 +626,17 @@ def set_logging(level=None):
 )
 
 # Optional projectroles settings
-# Sidebar icon size. Minimum=18, maximum=42.
+# Sidebar icon size (must be between 18-42)
 PROJECTROLES_SIDEBAR_ICON_SIZE = env.int('PROJECTROLES_SIDEBAR_ICON_SIZE', 36)
 # PROJECTROLES_SECRET_LENGTH = 32
 # PROJECTROLES_HELP_HIGHLIGHT_DAYS = 7
 # PROJECTROLES_SEARCH_PAGINATION = 5
-# Support for viewing the site in "kiosk mode" (under work, experimental)
+# Support for viewing the site in "kiosk mode" (experimental)
 # PROJECTROLES_KIOSK_MODE = env.bool('PROJECTROLES_KIOSK_MODE', False)
 # Scroll project navigation with page content if set False
 # PROJECTROLES_BREADCRUMB_STICKY = True
+# Custom message to be displayed if site read-only mode is enabled
+PROJECTROLES_READ_ONLY_MSG = env.str('PROJECTROLES_READ_ONLY_MSG', None)
 
 # Hide project apps from the UI (sidebar, dropdown menus and project details)
 PROJECTROLES_HIDE_PROJECT_APPS = env.list(

docs/source/app_projectroles_api_django.rst

@@ -106,18 +106,25 @@ General utility functions are stored in ``utils.py``.
     :members:
 
 
+.. _app_projectroles_api_django_ajax_common:
+
 Common Use Ajax Views
 =====================
 
 Ajax views intended to be used in a SODAR Core based site are described here.
 
 .. currentmodule:: projectroles.views_ajax
 
+.. autoclass:: CurrentUserRetrieveAjaxView
+
+.. autoclass:: SiteReadOnlySettingAjaxView
+
 .. autoclass:: SidebarContentAjaxView
 
 .. autoclass:: UserDropdownContentAjaxView
 
 
+
 .. _app_projectroles_api_django_rest:
 
 Base REST API View Classes

docs/source/app_projectroles_usage.rst

@@ -569,6 +569,5 @@ name and/or description.
 REST API
 ========
 
-Several SODAR Core functionalities are also available via a HTTP REST API
-starting in version 0.8. See :ref:`app_projectroles_api_rest` for instructions
-on REST API usage.
+Many SODAR Core features are also available via a REST API. See
+:ref:`app_projectroles_api_rest` for instructions on REST API usage.

docs/source/dev_project_app.rst

@@ -165,9 +165,18 @@ app if needed.
 .. hint::
 
     For permissions dealing with modifying data, you are strongly recommend to
-    use the ``can_modify_project_data`` predicate. For more, see
+    use the ``can_modify_project_data`` predicate. For more information, see
     :ref:`dev_project_app_archiving`.
 
+.. hint::
+
+    To support the site read-only mode introduced in SODAR Core v1.1, the rules
+    for your app's views need to be implemented accordingly. A check for the
+    read-only mode is contained in the ``can_modify_project_data()`` predicate.
+    If your view already uses that predicate, no further steps are necessary.
+    For site views, ``is_site_writable`` should be used. For more information,
+    see :ref:`dev_resources_read_only`.
+
 
 ProjectAppPlugin
 ================

docs/source/dev_resource.rst

@@ -469,6 +469,85 @@ when creating multi-plugin apps:
   This, again, ensures apps are correctly detected and highlighted in the UI.
 
 
+.. _dev_resources_read_only:
+
+Site Read-Only Mode
+===================
+
+A superuser can temporarily set the site into read-only mode. When the mode is
+enabled, all data on the site is only accessible for reading. No project or user
+data should be modifiable, except for superusers who still have full access.
+
+SODAR Core apps enforce this mode by prohibiting access to views and/or UI
+elements which enable the user to modify data. Apps developed for a SODAR Core
+based site must implement this within their rule and UI logic.
+
+If your data modifying view is in a project app and uses the
+``can_modify_project_data()`` rule predicate, checks for view access are already
+performed for that view in the permission checks. Example of this in a
+``rules.py`` file:
+
+.. code-block:: python
+
+    import rules
+    from projectroles import rules as pr_rules
+
+    rules.add_perm(
+        'your_project_app.update_data',
+        pr_rules.can_modify_project_data
+        & (
+            pr_rules.is_project_owner
+            | pr_rules.is_project_delegate
+            | pr_rules.is_project_contributor
+        ),
+    )
+
+For site views, you can use the ``is_site_writable()`` predicate. Example:
+
+.. code-block:: python
+
+    import rules
+    from projectroles import rules as pr_rules
+
+    rules.add_perm(
+        'your_site_app.update_data',
+        rules.is_authenticated & pr_rules.is_site_writable,
+    )
+
+To check for the mode in your Python code, you should use the app settings API
+as follows:
+
+.. code-block:: python
+
+    from projectroles.app_settings import AppSettingAPI
+    app_settings = AppSettingAPI()
+
+    if app_settings.get('projectroles', 'site_read_only'):
+        pass  # Add logic for read-only mode here
+
+In templates, the same can be done using the ``get_app_setting()`` template tag.
+Example:
+
+.. code-block:: django
+
+    {% load projectroles_common_tags %}
+    {% get_app_setting 'projectroles' 'site_read_only' as site_read_only %}
+    {% if site_read_only %}
+      {# ... #}
+    {% endif %}
+
+If you need to check the site read-only status in client-side apps, you can
+query the ``SiteReadOnlySettingAjaxView`` Ajax view. See
+:ref:`app_projectroles_api_django_ajax_common` for more information.
+
+.. note::
+
+    It is assumed that in read-only mode, superusers are still able to access
+    data modifying views and operations. The rule settings also allow this.
+    Actions within management commands should thus also be allowed in read-only
+    mode.
+
+
 Management Command Logger
 =========================
 

docs/source/major_changes.rst

@@ -16,6 +16,7 @@ v1.1.0 (WIP)
 Release Highlights
 ==================
 
+- Add site read-only mode
 - Add removeroles management command
 - Add app setting type constants
 - Add app setting definition as objects
@@ -26,6 +27,14 @@ Release Highlights
 Breaking Changes
 ================
 
+Site Read-Only Mode
+-------------------
+
+This release adds the site-wide read-only mode, which is intended to temporarily
+prohibit modifying all data on the site. Rules, logic and/or UI of your apps'
+views may have to be changed to support this functionality. For more
+information, see :ref:`dev_resources_read_only`.
+
 AppSettingAPI Definition Getter Return Data
 -------------------------------------------