# HG changeset patch
# User Thierry Florac <tflorac@ulthar.net>
# Date 1425133408 -3600
# Node ID 181b8ff133b7b81068662b80e1f579a68f05ea4c
# Parent  ec4cd04d4a8c18333f73a02345f138cf8e909c4e
Handle recursion for groups containing groups...

diff -r ec4cd04d4a8c -r 181b8ff133b7 src/pyams_security/plugin/group.py
--- a/src/pyams_security/plugin/group.py	Sat Feb 28 15:22:56 2015 +0100
+++ b/src/pyams_security/plugin/group.py	Sat Feb 28 15:23:28 2015 +0100
@@ -54,8 +54,10 @@
             self._principals = value
             registry = check_request().registry
             if added:
+                print(">> added =", added)
                 registry.notify(PrincipalsAddedToGroupEvent(self, added))
             if removed:
+                print("<< removed =", removed)
                 registry.notify(PrincipalsRemovedFromGroupEvent(self, removed))
 
 
@@ -85,13 +87,23 @@
         prefix, group_id = principal_id.split(':', 1)
         group = self.get(group_id)
         if group is not None:
-            return PrincipalInfo(id='{0}:{1}'.format(self.prefix, group.group_id),
+            return PrincipalInfo(id='{prefix}:{group_id}'.format(prefix=self.prefix,
+                                                                 group_id=group.group_id),
                                  title=group.title)
 
-    def get_all_principals(self, principal_id):
+    def get_all_principals(self, principal_id, seen=None):
         if not self.enabled:
             return set()
-        return self.groups_by_principal.get(principal_id) or set()
+        principals = self.groups_by_principal.get(principal_id) or set()
+        principals = principals.copy()
+        if principals:
+            if seen is None:
+                seen = set()
+            for principal in (p for p in principals.copy() if p not in seen):
+                if principal.startswith(self.prefix + ':'):
+                    principals.update(self.get_all_principals(principal, seen))
+                seen.add(principal)
+        return principals
 
     def find_principals(self, query):
         if not self.enabled:
@@ -101,7 +113,8 @@
         query = query.lower()
         for group in self.values():
             if query in group.title.lower():
-                yield PrincipalInfo(id='{0}:{1}'.format(self.prefix, group.group_id),
+                yield PrincipalInfo(id='{prefix}:{group_id}'.format(prefix=self.prefix,
+                                                                    group_id=group.group_id),
                                     title=group.title)
 
 
@@ -115,7 +128,8 @@
         groups_set = principals_map.get(principal_id)
         if groups_set is None:
             groups_set = set()
-        group_id = '{0}:{1}'.format(folder.prefix, group.group_id)
+        group_id = '{prefix}:{group_id}'.format(prefix=folder.prefix,
+                                                group_id=group.group_id)
         groups_set.add(group_id)
         principals_map[principal_id] = groups_set
 
@@ -131,7 +145,8 @@
         groups_set = principals_map.get(principal_id)
         if groups_set is None:
             groups_set = set()
-        group_id = '{0}:{1}'.format(group.__parent__.prefix, group.group_id)
+        group_id = '{prefix}:{group_id}'.format(prefix=group.__parent__.prefix,
+                                                group_id=group.group_id)
         groups_set.add(group_id)
         principals_map[principal_id] = groups_set
 
@@ -144,7 +159,8 @@
     for principal_id in event.principals:
         groups_set = principals_map.get(principal_id)
         if groups_set:
-            group_id = '{0}:{1}'.format(group.__parent__.prefix, group.group_id)
+            group_id = '{prefix}:{group_id}'.format(prefix=group.__parent__.prefix,
+                                                    group_id=group.group_id)
             if group_id in groups_set:
                 groups_set.remove(group_id)
             if groups_set: