Merge branch '213-helpful-acl-messages' into 'dev'

Resolve "When refusing access due to missing permission, also indicate which groups would have granted the required permission"

See merge request federez/re2o!432

api/acl.py

@@ -33,7 +33,7 @@ from django.utils.translation import ugettext as _
 
 def _create_api_permission():
     """Creates the 'use_api' permission if not created.
-    
+
     The 'use_api' is a fake permission in the sense it is not associated with an
     existing model and this ensure the permission is created every time this file
     is imported.
@@ -70,6 +70,7 @@ def can_view(user):
         'app_label': settings.API_CONTENT_TYPE_APP_LABEL,
         'codename': settings.API_PERMISSION_CODENAME
     }
-    can = user.has_perm('%(app_label)s.%(codename)s' % kwargs)
+    permission = '%(app_label)s.%(codename)s' % kwargs
+    can = user.has_perm(permission)
     return can, None if can else _("You don't have the right to see this"
-                                   " application.")
+                                   " application."), (permission,)

cotisations/acl.py

@@ -40,7 +40,11 @@ def can_view(user):
     """
     can = user.has_module_perms('cotisations')
     if can:
-        return can, None
+        return can, None, ('cotisations',)
     else:
-        return can, _("You don't have the right to view this application.")
+        return (
+            can,
+            _("You don't have the right to view this application."),
+            ('cotisations',)
+        )
 

cotisations/models.py

@@ -169,44 +169,78 @@ class Facture(BaseInvoice):
         return self.vente_set.all()
 
     def can_edit(self, user_request, *args, **kwargs):
+        user_can, _, permissions = self.user.can_edit(
+            user_request, *args, **kwargs)
         if not user_request.has_perm('cotisations.change_facture'):
-            return False, _("You don't have the right to edit an invoice.")
+            return (
+                False,
+                _("You don't have the right to edit an invoice."),
+                ('cotisations.change_facture',)
+            )
         elif not user_request.has_perm('cotisations.change_all_facture') and \
-                not self.user.can_edit(user_request, *args, **kwargs)[0]:
-            return False, _("You don't have the right to edit this user's "
-                            "invoices.")
+                not user_can:
+            return (
+                False,
+                _("You don't have the right to edit this user's invoices."),
+                ('cotisations.change_all_facture',) + permissions
+            )
         elif not user_request.has_perm('cotisations.change_all_facture') and \
                 (self.control or not self.valid):
-            return False, _("You don't have the right to edit an invoice "
-                            "already controlled or invalidated.")
+            return (
+                False,
+                _("You don't have the right to edit an invoice "
+                  "already controlled or invalidated."),
+                ('cotisations.change_all_facture',)
+            )
         else:
-            return True, None
+            return True, None, None
 
     def can_delete(self, user_request, *args, **kwargs):
+        user_can, _, permissions = self.user.can_edit(
+            user_request, *args, **kwargs)
         if not user_request.has_perm('cotisations.delete_facture'):
-            return False, _("You don't have the right to delete an invoice.")
+            return (
+                False,
+                _("You don't have the right to delete an invoice."),
+                ('cotisations.delete_facture',)
+            )
         elif not user_request.has_perm('cotisations.change_all_facture') and \
-                not self.user.can_edit(user_request, *args, **kwargs)[0]:
-            return False, _("You don't have the right to delete this user's "
-                            "invoices.")
+                not user_can:
+            return (
+                False,
+                _("You don't have the right to delete this user's invoices."),
+                ('cotisations.change_all_facture',) + permissions
+            )
         elif not user_request.has_perm('cotisations.change_all_facture') and \
                 (self.control or not self.valid):
-            return False, _("You don't have the right to delete an invoice "
-                            "already controlled or invalidated.")
+            return (
+                False,
+                _("You don't have the right to delete an invoice "
+                            "already controlled or invalidated."),
+                ('cotisations.change_all_facture',)
+            )
         else:
-            return True, None
+            return True, None, None
 
     def can_view(self, user_request, *_args, **_kwargs):
         if not user_request.has_perm('cotisations.view_facture'):
             if self.user != user_request:
-                return False, _("You don't have the right to view someone else's "
-                                "invoices history.")
+                return (
+                    False,
+                    _("You don't have the right to view someone else's "
+                                "invoices history."),
+                    ('cotisations.view_facture',)
+                )
             elif not self.valid:
-                return False, _("The invoice has been invalidated.")
+                return (
+                    False,
+                    _("The invoice has been invalidated."),
+                    ('cotisations.view_facture',)
+                )
             else:
-                return True, None
+                return True, None, None
         else:
-            return True, None
+            return True, None, None
 
     @staticmethod
     def can_change_control(user_request, *_args, **_kwargs):
@@ -214,7 +248,8 @@ class Facture(BaseInvoice):
         this invoice """
         return (
             user_request.has_perm('cotisations.change_facture_control'),
-            _("You don't have the right to edit the \"controlled\" state.")
+            _("You don't have the right to edit the \"controlled\" state."),
+            ('cotisations.change_facture_control',)
         )
 
     @staticmethod
@@ -226,12 +261,12 @@ class Facture(BaseInvoice):
             an invoice or if the `options.allow_self_subscription` is set.
         """
         if user_request.has_perm('cotisations.add_facture'):
-            return True, None
+            return True, None, None
         if len(Paiement.find_allowed_payments(user_request)) <= 0:
-            return False, _("There are no payment method which you can use.")
+            return False, _("There are no payment method which you can use."), ('cotisations.add_facture',)
         if len(Article.find_allowed_articles(user_request, user_request)) <= 0:
-            return False, _("There are no article that you can buy.")
-        return True, None
+            return False, _("There are no article that you can buy."), ('cotisations.add_facture',)
+        return True, None, None
 
     def __init__(self, *args, **kwargs):
         super(Facture, self).__init__(*args, **kwargs)
@@ -360,12 +395,18 @@ class CostEstimate(CustomInvoice):
 
     def can_delete(self, user_request, *args, **kwargs):
         if not user_request.has_perm('cotisations.delete_costestimate'):
-            return False, _("You don't have the right "
-                            "to delete a cost estimate.")
+            return (
+                False,
+                _("You don't have the right to delete a cost estimate."),
+                ('cotisations.delete_costestimate',)
+            )
         if self.final_invoice is not None:
-            return False, _("The cost estimate has an "
-                            "invoice and can't be deleted.")
-        return True, None
+            return (
+                False,
+                _("The cost estimate has an invoice and can't be deleted."),
+                None
+            )
+        return True, None, None
 
 
 # TODO : change Vente to Purchase
@@ -505,40 +546,66 @@ class Vente(RevMixin, AclMixin, models.Model):
         super(Vente, self).save(*args, **kwargs)
 
     def can_edit(self, user_request, *args, **kwargs):
+        user_can, _, permissions = self.facture.user.can_edit(
+            user_request, *args, **kwargs
+        )
         if not user_request.has_perm('cotisations.change_vente'):
-            return False, _("You don't have the right to edit the purchases.")
-        elif (not user_request.has_perm('cotisations.change_all_facture') and
-              not self.facture.user.can_edit(
-                  user_request, *args, **kwargs
-        )[0]):
-            return False, _("You don't have the right to edit this user's "
-                            "purchases.")
+            return (
+                False,
+                _("You don't have the right to edit the purchases."),
+                ('cotisations.change_vente',)
+            )
+        elif not (
+            user_request.has_perm('cotisations.change_all_facture') or
+            user_can):
+            return (
+                False,
+                _("You don't have the right to edit this user's purchases."),
+                ('cotisations.change_all_facture',) + permissions
+            )
         elif (not user_request.has_perm('cotisations.change_all_vente') and
               (self.facture.control or not self.facture.valid)):
-            return False, _("You don't have the right to edit a purchase "
-                            "already controlled or invalidated.")
+            return (
+                False,
+                _("You don't have the right to edit a purchase "
+                            "already controlled or invalidated."),
+                ('cotisations.change_all_vente',)
+            )
         else:
-            return True, None
+            return True, None, None
 
     def can_delete(self, user_request, *args, **kwargs):
+        user_can, _, permissions = self.facture.user.can_edit(
+            user_request, *args, **kwargs)
         if not user_request.has_perm('cotisations.delete_vente'):
-            return False, _("You don't have the right to delete a purchase.")
-        if not self.facture.user.can_edit(user_request, *args, **kwargs)[0]:
-            return False, _("You don't have the right to delete this user's "
-                            "purchases.")
+            return (
+                False,
+                _("You don't have the right to delete a purchase."),
+                ('cotisations.delete_vente',)
+            )
+        if not user_can:
+            return (
+                False,
+                _("You don't have the right to delete this user's purchases."),
+                permissions
+            )
         if self.facture.control or not self.facture.valid:
             return False, _("You don't have the right to delete a purchase "
-                            "already controlled or invalidated.")
+                            "already controlled or invalidated."), None
         else:
-            return True, None
+            return True, None, None
 
     def can_view(self, user_request, *_args, **_kwargs):
         if (not user_request.has_perm('cotisations.view_vente') and
                 self.facture.user != user_request):
-            return False, _("You don't have the right to view someone "
-                            "else's purchase history.")
+            return (
+                False,
+                _("You don't have the right to view someone "
+                            "else's purchase history."),
+                ('cotisations.view_vente',)
+            )
         else:
-            return True, None
+            return True, None, None
 
     def __str__(self):
         return str(self.name) + ' ' + str(self.facture)
@@ -683,7 +750,8 @@ class Article(RevMixin, AclMixin, models.Model):
             self.available_for_everyone
             or user.has_perm('cotisations.buy_every_article')
             or user.has_perm('cotisations.add_facture'),
-            _("You can't buy this article.")
+            _("You can't buy this article."),
+            ('cotisations.buy_every_article', 'cotisations.add_facture')
         )
 
     @classmethod
@@ -838,7 +906,8 @@ class Paiement(RevMixin, AclMixin, models.Model):
             self.available_for_everyone
             or user.has_perm('cotisations.use_every_payment')
             or user.has_perm('cotisations.add_facture'),
-            _("You can't use this payment method.")
+            _("You can't use this payment method."),
+            ('cotisations.use_every_payment', 'cotisations.add_facture')
         )
 
     @classmethod
@@ -907,32 +976,51 @@ class Cotisation(RevMixin, AclMixin, models.Model):
 
     def can_edit(self, user_request, *_args, **_kwargs):
         if not user_request.has_perm('cotisations.change_cotisation'):
-            return False, _("You don't have the right to edit a subscription.")
+            return (
+                False,
+                _("You don't have the right to edit a subscription."),
+                ('cotisations.change_cotisation',)
+            )
         elif not user_request.has_perm('cotisations.change_all_cotisation') \
                 and (self.vente.facture.control or
                      not self.vente.facture.valid):
-            return False, _("You don't have the right to edit a subscription "
-                            "already controlled or invalidated.")
+            return (
+                False,
+                _("You don't have the right to edit a subscription "
+                            "already controlled or invalidated."),
+                ('cotisations.change_all_cotisation',)
+            )
         else:
-            return True, None
+            return True, None, None
 
     def can_delete(self, user_request, *_args, **_kwargs):
         if not user_request.has_perm('cotisations.delete_cotisation'):
-            return False, _("You don't have the right to delete a "
-                            "subscription.")
+            return (
+                False,
+                _("You don't have the right to delete a subscription."),
+                ('cotisations.delete_cotisation',)
+            )
         if self.vente.facture.control or not self.vente.facture.valid:
-            return False, _("You don't have the right to delete a subscription "
-                            "already controlled or invalidated.")
+            return (
+                False,
+                _("You don't have the right to delete a subscription "
+                            "already controlled or invalidated."),
+                None
+            )
         else:
-            return True, None
+            return True, None, None
 
     def can_view(self, user_request, *_args, **_kwargs):
         if not user_request.has_perm('cotisations.view_cotisation') and\
                 self.vente.facture.user != user_request:
-            return False, _("You don't have the right to view someone else's "
-                            "subscription history.")
+            return (
+                False,
+                _("You don't have the right to view someone else's "
+                            "subscription history."),
+                ('cotisations.view_cotisation',)
+            )
         else:
-            return True, None
+            return True, None, None
 
     def __str__(self):
         return str(self.vente)

logs/acl.py

@@ -39,6 +39,10 @@ def can_view(user):
         viewing is granted and msg is a message (can be None).
     """
     can = user.has_module_perms('admin')
-    return can, None if can else _("You don't have the right to view this"
-                                   " application.")
+    return (
+        can,
+        None if can else _("You don't have the right to view this"
+                                   " application."),
+        'admin'
+    )
 

machines/acl.py

@@ -39,5 +39,10 @@ def can_view(user):
         viewing is granted and msg is a message (can be None).
     """
     can = user.has_module_perms('machines')
-    return can, None if can else _("You don't have the right to view this"
-                                   " application.")
+    return (
+        can,
+        None if can else _("You don't have the right to view this"
+                                   " application."),
+        ('machines',)
+    )
+

machines/models.py

@@ -105,8 +105,11 @@ class Machine(RevMixin, FieldPermissionModelMixin, models.Model):
             A tuple with a boolean stating if edition is allowed and an
             explanation message.
         """
-        return (user_request.has_perm('machines.change_machine_user'),
-                _("You don't have the right to change the machine's user."))
+        return (
+            user_request.has_perm('machines.change_machine_user'),
+            _("You don't have the right to change the machine's user."),
+            ('machines.change_machine_user',)
+        )
 
     @staticmethod
     def can_view_all(user_request, *_args, **_kwargs):
@@ -115,9 +118,12 @@ class Machine(RevMixin, FieldPermissionModelMixin, models.Model):
         :param user_request: instance user qui fait l'edition
         :return: True ou False avec la raison de l'échec le cas échéant"""
         if not user_request.has_perm('machines.view_machine'):
-            return False, _("You don't have the right to view all the"
-                            " machines.")
-        return True, None
+            return (
+                False,
+                _("You don't have the right to view all the machines."),
+                ('machines.view_machine',)
+            )
+        return True, None, None
 
     @staticmethod
     def can_create(user_request, userid, *_args, **_kwargs):
@@ -129,7 +135,7 @@ class Machine(RevMixin, FieldPermissionModelMixin, models.Model):
         try:
             user = users.models.User.objects.get(pk=userid)
         except users.models.User.DoesNotExist:
-            return False, _("Nonexistent user.")
+            return False, _("Nonexistent user."), None
         max_lambdauser_interfaces = (preferences.models.OptionalMachine
             .get_cached_value(
             'max_lambdauser_interfaces'
@@ -137,15 +143,23 @@ class Machine(RevMixin, FieldPermissionModelMixin, models.Model):
         if not user_request.has_perm('machines.add_machine'):
             if not (preferences.models.OptionalMachine
                     .get_cached_value('create_machine')):
-                return False, (_("You don't have the right to add a machine."))
+                return (
+                    False,
+                    _("You don't have the right to add a machine."),
+                    ('machines.add_machine',)
+                )
             if user != user_request:
-                return False, (_("You don't have the right to add a machine"
-                                 " to another user."))
+                return (
+                    False,
+                    _("You don't have the right to add a machine"
+                      " to another user."),
+                    ('machines.add_machine',)
+                )
             if user.user_interfaces().count() >= max_lambdauser_interfaces:
-                return False, (_("You reached the maximum number of interfaces"
+                return False, _("You reached the maximum number of interfaces"
                                  " that you are allowed to create yourself"
-                                 " (%s)." % max_lambdauser_interfaces))
-        return True, None
+                                 " (%s)." % max_lambdauser_interfaces), None
+        return True, None, None
 
     def can_edit(self, user_request, *args, **kwargs):
         """Vérifie qu'on peut bien éditer cette instance particulière (soit
@@ -154,16 +168,22 @@ class Machine(RevMixin, FieldPermissionModelMixin, models.Model):
         :param user_request: instance user qui fait l'edition
         :return: True ou False avec la raison le cas échéant"""
         if self.user != user_request:
-            if (not user_request.has_perm('machines.change_interface') or
-                    not self.user.can_edit(
-                        self.user,
-                        user_request,
-                        *args,
-                        **kwargs
-                    )[0]):
-                return False, (_("You don't have the right to edit a machine"
-                                 " of another user."))
-        return True, None
+            can_user, _, permissions = self.user.can_edit(
+                self.user,
+                user_request,
+                *args,
+                **kwargs
+            )
+            if not (
+                user_request.has_perm('machines.change_interface') and
+                can_user):
+                return (
+                    False,
+                    _("You don't have the right to edit a machine"
+                                 " of another user."),
+                    ('machines.change_interface',) + permissions
+                )
+        return True, None, None
 
     def can_delete(self, user_request, *args, **kwargs):
         """Vérifie qu'on peut bien supprimer cette instance particulière (soit
@@ -172,16 +192,22 @@ class Machine(RevMixin, FieldPermissionModelMixin, models.Model):
         :param user_request: instance user qui fait l'edition
         :return: True ou False avec la raison de l'échec le cas échéant"""
         if self.user != user_request:
-            if (not user_request.has_perm('machines.change_interface') or
-                    not self.user.can_edit(
-                        self.user,
-                        user_request,
-                        *args,
-                        **kwargs
-                    )[0]):
-                return False, _("You don't have the right to delete a machine"
-                                " of another user.")
-        return True, None
+            can_user, _, permissions = self.user.can_edit(
+                self.user,
+                user_request,
+                *args,
+                **kwargs
+            )
+            if not (
+                user_request.has_perm('machines.change_interface') and
+                can_user):
+                return (
+                    False,
+                    _("You don't have the right to delete a machine"
+                      " of another user."),
+                    ('machines.change_interface',) + permissions
+                )
+        return True, None, None
 
     def can_view(self, user_request, *_args, **_kwargs):
         """Vérifie qu'on peut bien voir cette instance particulière (soit
@@ -191,9 +217,13 @@ class Machine(RevMixin, FieldPermissionModelMixin, models.Model):
         :return: True ou False avec la raison de l'échec le cas échéant"""
         if (not user_request.has_perm('machines.view_machine') and
                 self.user != user_request):
-            return False, _("You don't have the right to view other machines"
-                            " than yours.")
-        return True, None
+            return (
+                False,
+                _("You don't have the right to view other machines"
+                  " than yours."),
+                ('machines.view_machine',)
+            )
+        return True, None, None
 
     @cached_property
     def short_name(self):
@@ -285,9 +315,12 @@ class MachineType(RevMixin, AclMixin, models.Model):
             message is acces is not allowed.
         """
         if not user_request.has_perm('machines.use_all_machinetype'):
-            return False, (_("You don't have the right to use all machine"
-                             " types."))
-        return True, None
+            return (
+                False,
+                _("You don't have the right to use all machine types."),
+                ('machines.use_all_machinetype',)
+            )
+        return True, None, None
 
     def __str__(self):
         return self.name
@@ -528,7 +561,11 @@ class IpType(RevMixin, AclMixin, models.Model):
         restrictions
         :param user_request: instance user qui fait l'edition
         :return: True ou False avec la raison de l'échec le cas échéant"""
-        return user_request.has_perm('machines.use_all_iptype'), None
+        return (
+            user_request.has_perm('machines.use_all_iptype'),
+            None,
+            ('machines.use_all_iptype',)
+        )
 
     def __str__(self):
         return self.name
@@ -766,7 +803,11 @@ class Extension(RevMixin, AclMixin, models.Model):
         restrictions
         :param user_request: instance user qui fait l'edition
         :return: True ou False avec la raison de l'échec le cas échéant"""
-        return user_request.has_perm('machines.use_all_extension'), None
+        return (
+            user_request.has_perm('machines.use_all_extension'),
+            _("You cannot use all extensions."),
+            ('machines.use_all_extension',)
+        )
 
     def __str__(self):
         return self.name
@@ -1222,31 +1263,42 @@ class Interface(RevMixin, AclMixin, FieldPermissionModelMixin, models.Model):
         try:
             machine = Machine.objects.get(pk=machineid)
         except Machine.DoesNotExist:
-            return False, _("Nonexistent machine.")
+            return False, _("Nonexistent machine."), None
         if not user_request.has_perm('machines.add_interface'):
             if not (preferences.models.OptionalMachine
                     .get_cached_value('create_machine')):
-                return False, _("You can't add a machine.")
+                return False, _("You can't add a machine."), ('machines.add_interface',)
             max_lambdauser_interfaces = (preferences.models.OptionalMachine
                 .get_cached_value(
                 'max_lambdauser_interfaces'
             ))
             if machine.user != user_request:
-                return False, _("You don't have the right to add an interface"
-                                " to a machine of another user.")
+                return (
+                    False,
+                    _("You don't have the right to add an interface"
+                      " to a machine of another user."),
+                    ('machines.add_interface',)
+                )
             if (machine.user.user_interfaces().count() >=
                     max_lambdauser_interfaces):
-                return False, (_("You reached the maximum number of interfaces"
-                                 " that you are allowed to create yourself"
-                                 " (%s)." % max_lambdauser_interfaces))
-        return True, None
+                return (
+                    False,
+                    _("You reached the maximum number of interfaces"
+                      " that you are allowed to create yourself"
+                      " (%s)." % max_lambdauser_interfaces),
+                    ('machines.add_interface',)
+                )
+        return True, None, None
 
     @staticmethod
     def can_change_machine(user_request, *_args, **_kwargs):
         """Check if a user can change the machine associated with an
         Interface object """
-        return (user_request.has_perm('machines.change_interface_machine'),
-                _("Permission required to edit the machine."))
+        return (
+            user_request.has_perm('machines.change_interface_machine'),
+            _("Permission required to edit the machine."),
+            ('machines.change_interface_machine',)
+        )
 
     def can_edit(self, user_request, *args, **kwargs):
         """Verifie que l'user a les bons droits infra pour editer
@@ -1255,15 +1307,21 @@ class Interface(RevMixin, AclMixin, FieldPermissionModelMixin, models.Model):
         :param user_request: Utilisateur qui fait la requête
         :return: soit True, soit False avec la raison de l'échec"""
         if self.machine.user != user_request:
-            if (not user_request.has_perm('machines.change_interface') or
-                    not self.machine.user.can_edit(
-                        user_request,
-                        *args,
-                        **kwargs
-                    )[0]):
-                return False, _("You don't have the right to edit a machine of"
-                                " another user.")
-        return True, None
+            can_user, _, permissions = self.machine.user.can_edit(
+                user_request,
+                *args,
+                **kwargs
+            )
+            if not (
+                user_request.has_perm('machines.change_interface') and
+                can_user ):
+                return (
+                    False,
+                    _("You don't have the right to edit a machine of"
+                      " another user."),
+                    ('machines.change_interface',) + permissions
+                )
+        return True, None, None
 
     def can_delete(self, user_request, *args, **kwargs):
         """Verifie que l'user a les bons droits delete object pour del
@@ -1272,15 +1330,21 @@ class Interface(RevMixin, AclMixin, FieldPermissionModelMixin, models.Model):
         :param user_request: Utilisateur qui fait la requête
         :return: soit True, soit False avec la raison de l'échec"""
         if self.machine.user != user_request:
-            if (not user_request.has_perm('machines.change_interface') or
-                    not self.machine.user.can_edit(
-                        user_request,
-                        *args,
-                        **kwargs
-                    )[0]):
-                return False, _("You don't have the right to edit a machine of"
-                                " another user.")
-        return True, None
+            can_user, _, permissions = self.machine.user.can_edit(
+                user_request,
+                *args,
+                **kwargs
+            )
+            if not (
+                user_request.has_perm('machines.change_interface') and
+                can_user):
+                return (
+                    False,
+                    _("You don't have the right to edit a machine of"
+                      " another user."),
+                    ('machines.change_interface',) + permissions
+                )
+        return True, None, None
 
     def can_view(self, user_request, *_args, **_kwargs):
         """Vérifie qu'on peut bien voir cette instance particulière avec
@@ -1290,9 +1354,12 @@ class Interface(RevMixin, AclMixin, FieldPermissionModelMixin, models.Model):
         :return: True ou False avec la raison de l'échec le cas échéant"""
         if (not user_request.has_perm('machines.view_interface') and
                 self.machine.user != user_request):
-            return False, _("You don't have the right to view machines other"
-                            " than yours.")
-        return True, None
+            return (
+                False,
+                _("You don't have the right to view machines other than yours."),
+                ('machines.view_interface',)
+            )
+        return True, None, None
 
     def __init__(self, *args, **kwargs):
         super(Interface, self).__init__(*args, **kwargs)
@@ -1340,19 +1407,26 @@ class Ipv6List(RevMixin, AclMixin, FieldPermissionModelMixin, models.Model):
         try:
             interface = Interface.objects.get(pk=interfaceid)
         except Interface.DoesNotExist:
-            return False, _("Nonexistent interface.")
+            return False, _("Nonexistent interface."), None
         if not user_request.has_perm('machines.add_ipv6list'):
             if interface.machine.user != user_request:
-                return False, _("You don't have the right to add an alias to a"
-                                " machine of another user.")
-        return True, None
+                return (
+                    False,
+                    _("You don't have the right to add an alias to a"
+                      " machine of another user."),
+                    ('machines.add_ipv6list',)
+                )
+        return True, None, None
 
     @staticmethod
     def can_change_slaac_ip(user_request, *_args, **_kwargs):
         """ Check if a user can change the slaac value """
-        return (user_request.has_perm('machines.change_ipv6list_slaac_ip'),
-                _("Permission required to change the SLAAC value of an IPv6"
-                  " address"))
+        return (
+            user_request.has_perm('machines.change_ipv6list_slaac_ip'),
+            _("Permission required to change the SLAAC value of an IPv6"
+              " address"),
+            ('machines.change_ipv6list_slaac_ip',)
+        )
 
     def can_edit(self, user_request, *args, **kwargs):
         """Verifie que l'user a les bons droits infra pour editer
@@ -1361,15 +1435,21 @@ class Ipv6List(RevMixin, AclMixin, FieldPermissionModelMixin, models.Model):
         :param user_request: Utilisateur qui fait la requête
         :return: soit True, soit False avec la raison de l'échec"""
         if self.interface.machine.user != user_request:
-            if (not user_request.has_perm('machines.change_ipv6list') or
-                    not self.interface.machine.user.can_edit(
-                        user_request,
-                        *args,
-                        **kwargs
-                    )[0]):
-                return False, _("You don't have the right to edit a machine of"
-                                " another user.")
-        return True, None
+            can_user, _, permissions = self.interface.machine.user.can_edit(
+                user_request,
+                *args,
+                **kwargs
+            )
+            if not (
+                user_request.has_perm('machines.change_ipv6list') and
+                can_user):
+                return (
+                    False,
+                    _("You don't have the right to edit a machine of"
+                      " another user."),
+                    ('machines.change_ipv6list',)
+                )
+        return True, None, None
 
     def can_delete(self, user_request, *args, **kwargs):
         """Verifie que l'user a les bons droits delete object pour del
@@ -1378,15 +1458,20 @@ class Ipv6List(RevMixin, AclMixin, FieldPermissionModelMixin, models.Model):
         :param user_request: Utilisateur qui fait la requête
         :return: soit True, soit False avec la raison de l'échec"""
         if self.interface.machine.user != user_request:
-            if (not user_request.has_perm('machines.change_ipv6list') or
-                    not self.interface.machine.user.can_edit(
-                        user_request,
-                        *args,
-                        **kwargs
-                    )[0]):
-                return False, _("You don't have the right to edit a machine of"
-                                " another user.")
-        return True, None
+            can_user, _, permissions = self.interface.machine.user.can_edit(
+                user_request,
+                *args,
+                **kwargs
+            )
+            if not (user_request.has_perm('machines.change_ipv6list') and
+                can_user):
+                return (
+                    False,
+                    _("You don't have the right to edit a machine of"
+                      " another user."),
+                    ('machines.change_ipv6list',) + permissions
+                )
+        return True, None, None
 
     def can_view(self, user_request, *_args, **_kwargs):
         """Vérifie qu'on peut bien voir cette instance particulière avec
@@ -1396,9 +1481,12 @@ class Ipv6List(RevMixin, AclMixin, FieldPermissionModelMixin, models.Model):
         :return: True ou False avec la raison de l'échec le cas échéant"""
         if (not user_request.has_perm('machines.view_ipv6list') and
                 self.interface.machine.user != user_request):
-            return False, _("You don't have the right to view machines other"
-                            " than yours.")
-        return True, None
+            return (
+                False,
+                _("You don't have the right to view machines other than yours."),
+                ('machines.view_ipv6list',)
+            )
+        return True, None, None
 
     def __init__(self, *args, **kwargs):
         super(Ipv6List, self).__init__(*args, **kwargs)
@@ -1554,25 +1642,33 @@ class Domain(RevMixin, AclMixin, models.Model):
         try:
             interface = Interface.objects.get(pk=interfaceid)
         except Interface.DoesNotExist:
-            return False, _("Nonexistent interface.")
+            return False, _("Nonexistent interface."), None
         if not user_request.has_perm('machines.add_domain'):
             max_lambdauser_aliases = (preferences.models.OptionalMachine
                 .get_cached_value(
                 'max_lambdauser_aliases'
             ))
             if interface.machine.user != user_request:
-                return False, _("You don't have the right to add an alias to a"
-                                " machine of another user.")
+                return (
+                    False,
+                    _("You don't have the right to add an alias to a"
+                      " machine of another user."),
+                    ('machines.add_domain',)
+                )
             if Domain.objects.filter(
                     cname__in=Domain.objects.filter(
                         interface_parent__in=(interface.machine.user
                                 .user_interfaces())
                     )
             ).count() >= max_lambdauser_aliases:
-                return False, _("You reached the maximum number of alias that"
-                                " you are allowed to create yourself (%s). "
-                                % max_lambdauser_aliases)
-        return True, None
+                return (
+                    False,
+                    _("You reached the maximum number of alias that"
+                      " you are allowed to create yourself (%s). "
+                      % max_lambdauser_aliases),
+                    ('machines.add_domain',)
+                )
+        return True, None, None
 
     def can_edit(self, user_request, *_args, **_kwargs):
         """Verifie que l'user a les bons droits pour editer
@@ -1582,9 +1678,13 @@ class Domain(RevMixin, AclMixin, models.Model):
         :return: soit True, soit False avec la raison de l'échec"""
         if (not user_request.has_perm('machines.change_domain') and
                 self.get_source_interface.machine.user != user_request):
-            return False, _("You don't have the right to edit an alias of a"
-                            " machine of another user.")
-        return True, None
+            return (
+                False,
+                _("You don't have the right to edit an alias of a"
+                  " machine of another user."),
+                ('machines.change_domain',)
+            )
+        return True, None, None
 
     def can_delete(self, user_request, *_args, **_kwargs):
         """Verifie que l'user a les bons droits delete object pour del
@@ -1594,9 +1694,13 @@ class Domain(RevMixin, AclMixin, models.Model):
         :return: soit True, soit False avec la raison de l'échec"""
         if (not user_request.has_perm('machines.delete_domain') and
                 self.get_source_interface.machine.user != user_request):
-            return False, _("You don't have the right to delete an alias of a"
-                            " machine of another user.")
-        return True, None
+            return (
+                False,
+                _("You don't have the right to delete an alias of a"
+                  " machine of another user."),
+                ('machines.delete_domain',)
+            )
+        return True, None, None
 
     def can_view(self, user_request, *_args, **_kwargs):
         """Vérifie qu'on peut bien voir cette instance particulière avec
@@ -1606,9 +1710,12 @@ class Domain(RevMixin, AclMixin, models.Model):
         :return: True ou False avec la raison de l'échec le cas échéant"""
         if (not user_request.has_perm('machines.view_domain') and
                 self.get_source_interface.machine.user != user_request):
-            return False, _("You don't have the right to view machines other"
-                            " than yours.")
-        return True, None
+            return (
+                False,
+                _("You don't have the right to view machines other than yours."),
+                ('machines.view_domain',)
+            )
+        return True, None, None
 
     def __str__(self):
         return str(self.name) + str(self.extension)
@@ -1840,11 +1947,14 @@ class OuverturePortList(RevMixin, AclMixin, models.Model):
         :param user_request: Utilisateur qui fait la requête
         :return: soit True, soit False avec la raison de l'échec"""
         if not user_request.has_perm('machines.delete_ouvertureportlist'):
-            return False, _("You don't have the right to delete a ports"
-                            " opening list.")
+            return (
+                False,
+                _("You don't have the right to delete a ports opening list."),
+                ('machines.delete_ouvertureportlist',)
+            )
         if self.interface_set.all():
-            return False, _("This ports opening list is used.")
-        return True, None
+            return False, _("This ports opening list is used."), None
+        return True, None, None
 
     def __str__(self):
         return self.name

preferences/acl.py

@@ -39,6 +39,10 @@ def can_view(user):
         viewing is granted and msg is a message (can be None).
     """
     can = user.has_module_perms('preferences')
-    return can, None if can else _("You don't have the right to view this"
-                                   " application.")
+    return (
+        can,
+        None if can else _("You don't have the right to view this"
+                                   " application."),
+        ('preferences',)
+    )
 

preferences/views.py

@@ -43,7 +43,7 @@ from reversion import revisions as reversion
 from importlib import import_module
 from re2o.settings_local import OPTIONNAL_APPS_RE2O
 from re2o.views import form
-from re2o.acl import can_create, can_edit, can_delete_set, can_view_all, can_delete
+from re2o.acl import can_create, can_edit, can_delete_set, can_view_all, can_delete, acl_error_message
 
 from .forms import MailContactForm, DelMailContactForm
 from .forms import (
@@ -130,10 +130,9 @@ def edit_options(request, section):
         return redirect(reverse('preferences:display-options'))
 
     options_instance, _created = model.objects.get_or_create()
-    can, msg = options_instance.can_edit(request.user)
+    can, msg, permissions = options_instance.can_edit(request.user)
     if not can:
-        messages.error(request, msg or _("You don't have the right to edit"
-                                         " this option."))
+        messages.error(request, acl_error_message(msg, permissions))
         return redirect(reverse('index'))
     options = form_instance(
         request.POST or None,

re2o/acl.py

@@ -36,6 +36,28 @@ from django.shortcuts import redirect
 from django.urls import reverse
 from django.utils.translation import ugettext as _
 
+from re2o.utils import get_group_having_permission
+
+
+def acl_error_message(msg, permissions):
+    """Create an error message for msg and permissions."""
+    groups = ", ".join([
+        g.name for g in get_group_having_permission(*permissions)
+    ])
+    message = msg or _("You don't have the right to edit"
+                                         " this option.")
+    if groups:
+        return message + _(
+                " You need to be a member of one of those"
+                " groups : %s"
+            ) % groups
+    else:
+        return message + " No group have the %s permission(s) !" % " or ".join([
+            ",".join(permissions[:-1]),
+            permissions[-1]]
+            if len(permissions) > 2 else permissions
+        )
+
 
 def acl_base_decorator(method_name, *targets, on_instance=True):
     """Base decorator for acl. It checks if the `request.user` has the
@@ -53,9 +75,10 @@ def acl_base_decorator(method_name, *targets, on_instance=True):
             then no error will be triggered, the decorator will act as if
             permission was granted. This is to allow you to run ACL tests on
             fields only. If the method exists, it has to return a 2-tuple
-            `(can, reason)` with `can` being a boolean stating whether the
-            access is granted and `reason` a message to be displayed if `can`
-            equals `False` (can be `None`)
+            `(can, reason, permissions)` with `can` being a boolean stating
+            whether the access is granted, `reason` a message to be
+            displayed if `can` equals `False` (can be `None`) and `permissions`
+            a list of permissions needed for access (can be `None`).
         *targets: The targets. Targets are specified like a sequence of models
             and fields names. As an example
             ```
@@ -139,7 +162,7 @@ ModelC)
                         target = target.get_instance(*args, **kwargs)
                         instances.append(target)
                     except target.DoesNotExist:
-                        yield False, _("Nonexistent entry.")
+                        yield False, _("Nonexistent entry."), []
                         return
                 if hasattr(target, method_name):
                     can_fct = getattr(target, method_name)
@@ -148,11 +171,12 @@ ModelC)
                     can_change_fct = getattr(target, 'can_change_' + field)
                     yield can_change_fct(request.user, *args, **kwargs)
 
-            error_messages = [
-                x[1] for x in chain.from_iterable(
-                    process_target(x[0], x[1]) for x in group_targets()
-                ) if not x[0]
-            ]
+            error_messages = []
+            for target, fields in group_targets():
+                for can, msg, permissions in process_target(target, fields):
+                    if not can:
+                        error_messages.append(acl_error_message(msg, permissions))
+
             if error_messages:
                 for msg in error_messages:
                     messages.error(

re2o/field_permissions.py

@@ -69,7 +69,7 @@ class FieldPermissionModelMixin:
         # Try to find a user setting that qualifies them for permission.
         for perm in checks:
             if callable(perm):
-                result, _reason = perm(user_request=user)
+                result, _reason, _permissions = perm(user_request=user)
                 if result is not None:
                     return result
             else:

re2o/mixins.py

@@ -104,12 +104,12 @@ class AclMixin(object):
         un object
         :param user_request: instance utilisateur qui fait la requête
         :return: soit True, soit False avec la raison de l'échec"""
+        permission = cls.get_modulename() + '.add_' + cls.get_classname()
         return (
-            user_request.has_perm(
-                cls.get_modulename() + '.add_' + cls.get_classname()
-            ),
-            (_("You don't have the right to create a %s object.")
-                % cls.get_classname())
+            user_request.has_perm(permission),
+            _("You don't have the right to create a %s object.")
+                % cls.get_classname(),
+            (permission,)
         )
 
     def can_edit(self, user_request, *_args, **_kwargs):
@@ -118,12 +118,12 @@ class AclMixin(object):
         :param self: Instance à editer
         :param user_request: Utilisateur qui fait la requête
         :return: soit True, soit False avec la raison de l'échec"""
+        permission = self.get_modulename() + '.change_' + self.get_classname()
         return (
-            user_request.has_perm(
-                self.get_modulename() + '.change_' + self.get_classname()
-            ),
-            (_("You don't have the right to edit a %s object.")
-                % self.get_classname())
+            user_request.has_perm(permission),
+            _("You don't have the right to edit a %s object.")
+                % self.get_classname(),
+            (permission,)
         )
 
     def can_delete(self, user_request, *_args, **_kwargs):
@@ -132,12 +132,12 @@ class AclMixin(object):
         :param self: Instance à delete
         :param user_request: Utilisateur qui fait la requête
         :return: soit True, soit False avec la raison de l'échec"""
+        permission = self.get_modulename() + '.delete_' + self.get_classname()
         return (
-            user_request.has_perm(
-                self.get_modulename() + '.delete_' + self.get_classname()
-            ),
-            (_("You don't have the right to delete a %s object.")
-                % self.get_classname())
+            user_request.has_perm(permission),
+            _("You don't have the right to delete a %s object.")
+                % self.get_classname(),
+            (permission,)
         )
 
     @classmethod
@@ -146,12 +146,12 @@ class AclMixin(object):
         droit particulier view objet correspondant
         :param user_request: instance user qui fait l'edition
         :return: True ou False avec la raison de l'échec le cas échéant"""
+        permission = cls.get_modulename() + '.view_' + cls.get_classname()
         return (
-            user_request.has_perm(
-                cls.get_modulename() + '.view_' + cls.get_classname()
-            ),
-            (_("You don't have the right to view every %s object.")
-                % cls.get_classname())
+            user_request.has_perm(permission),
+            _("You don't have the right to view every %s object.")
+                % cls.get_classname(),
+            (permission,)
         )
 
     def can_view(self, user_request, *_args, **_kwargs):
@@ -160,11 +160,11 @@ class AclMixin(object):
         :param self: instance à voir
         :param user_request: instance user qui fait l'edition
         :return: True ou False avec la raison de l'échec le cas échéant"""
+        permission = self.get_modulename() + '.view_' + self.get_classname()
         return (
-            user_request.has_perm(
-                self.get_modulename() + '.view_' + self.get_classname()
-            ),
-            (_("You don't have the right to view a %s object.")
-                % self.get_classname())
+            user_request.has_perm(permission),
+            _("You don't have the right to view a %s object.")
+                % self.get_classname(),
+            (permission,)
         )
 

re2o/templatetags/acl.py

@@ -147,6 +147,7 @@ def get_callback(tag_name, obj=None):
         return acl_fct(
             lambda x: (
                 not any(not sys.modules[o].can_view(x)[0] for o in obj),
+                None,
                 None
             ),
             False
@@ -155,28 +156,29 @@ def get_callback(tag_name, obj=None):
         return acl_fct(
             lambda x: (
                 not any(not sys.modules[o].can_view(x)[0] for o in obj),
+                None,
                 None
             ),
             True
         )
     if tag_name == 'can_edit_history':
         return acl_fct(
-            lambda user: (user.has_perm('admin.change_logentry'), None),
+            lambda user: (user.has_perm('admin.change_logentry'), None, None),
             False
         )
     if tag_name == 'cannot_edit_history':
         return acl_fct(
-            lambda user: (user.has_perm('admin.change_logentry'), None),
+            lambda user: (user.has_perm('admin.change_logentry'), None, None),
             True
         )
     if tag_name == 'can_view_any_app':
         return acl_fct(
-            lambda x: (any(sys.modules[o].can_view(x)[0] for o in obj), None),
+            lambda x: (any(sys.modules[o].can_view(x)[0] for o in obj), None, None),
             False
         )
     if tag_name == 'cannot_view_any_app':
         return acl_fct(
-            lambda x: (any(sys.modules[o].can_view(x)[0] for o in obj), None),
+            lambda x: (any(sys.modules[o].can_view(x)[0] for o in obj), None, None),
             True
         )
 
@@ -194,8 +196,8 @@ def acl_fct(callback, reverse):
 
     def acl_fct_reverse(user, *args, **kwargs):
         """The cannot_xxx checker callback"""
-        can, msg = callback(user, *args, **kwargs)
-        return not can, msg
+        can, msg, permissions = callback(user, *args, **kwargs)
+        return not can, msg, permissions
 
     return acl_fct_reverse if reverse else acl_fct_normal
 
@@ -217,7 +219,7 @@ def acl_history_filter(parser, token):
 
     assert token.contents == 'acl_end'
 
-    return AclNode(callback, oknodes, konodes)
+    return AclNode(tag_name, callback, oknodes, konodes)
 
 
 @register.tag('can_view_any_app')
@@ -254,7 +256,7 @@ def acl_app_filter(parser, token):
 
     assert token.contents == 'acl_end'
 
-    return AclNode(callback, oknodes, konodes)
+    return AclNode(tag_name, callback, oknodes, konodes)
 
 
 @register.tag('can_change')
@@ -264,7 +266,7 @@ def acl_change_filter(parser, token):
 
     try:
         tag_content = token.split_contents()
-        # tag_name = tag_content[0]
+        tag_name = tag_content[0]
         model_name = tag_content[1]
         field_name = tag_content[2]
         args = tag_content[3:]
@@ -291,7 +293,7 @@ def acl_change_filter(parser, token):
     # {% can_create_end %}
     assert token.contents == 'acl_end'
 
-    return AclNode(callback, oknodes, konodes, *args)
+    return AclNode(tag_name, callback, oknodes, konodes, *args)
 
 
 @register.tag('can_create')
@@ -333,7 +335,7 @@ def acl_model_filter(parser, token):
     # {% can_create_end %}
     assert token.contents == 'acl_end'
 
-    return AclNode(callback, oknodes, konodes, *args)
+    return AclNode(tag_name, callback, oknodes, konodes, *args)
 
 
 @register.tag('can_edit')
@@ -377,7 +379,8 @@ class AclNode(Node):
     """A node for the compiled ACL block when acl callback doesn't require
     context."""
 
-    def __init__(self, callback, oknodes, konodes, *args):
+    def __init__(self, tag_name, callback, oknodes, konodes, *args):
+        self.tag_name = tag_name
         self.callback = callback
         self.oknodes = oknodes
         self.konodes = konodes
@@ -388,11 +391,14 @@ class AclNode(Node):
         if context['user'].is_anonymous():
             can = False
         else:
-            can, _ = self.callback(context['user'], *(resolved_args))
+            can, _, _ = self.callback(context['user'], *(resolved_args))
         if can:
             return self.oknodes.render(context)
         return self.konodes.render(context)
 
+    def __repr__(self):
+        return '<AclNode %s>' % self.tag_name
+
 
 class AclInstanceNode(Node):
     """A node for the compiled ACL block when acl is based on instance"""
@@ -410,7 +416,10 @@ class AclInstanceNode(Node):
         if context['user'].is_anonymous():
             can = False
         else:
-            can, _ = callback(context['user'], *(resolved_args))
+            can, _, _  = callback(context['user'], *(resolved_args))
         if can:
             return self.oknodes.render(context)
         return self.konodes.render(context)
+
+    def __repr__(self):
+        return '<AclInstanceNode %s>' % self.tag_name

re2o/utils.py

@@ -38,12 +38,23 @@ from __future__ import unicode_literals
 
 from django.utils import timezone
 from django.db.models import Q
+from django.contrib.auth.models import Permission
 
 from cotisations.models import Cotisation, Facture, Vente
 from machines.models import Interface, Machine
 from users.models import Adherent, User, Ban, Whitelist
 from preferences.models import AssoOption
 
+def get_group_having_permission(*permission_name):
+    """Returns every group having the permission `permission_name`
+    """
+    groups = set()
+    for name in permission_name:
+        app_label, codename = name.split('.')
+        permission = Permission.objects.get(content_type__app_label=app_label, codename=codename)
+        groups = groups.union(permission.group_set.all())
+    return groups
+
 def all_adherent(search_time=None, including_asso=True):
     """ Fonction renvoyant tous les users adherents. Optimisee pour n'est
     qu'une seule requete sql

tickets/models.py

@@ -17,7 +17,7 @@ class Ticket(AclMixin, models.Model):
     """Model of a ticket"""
 
     user = models.ForeignKey(
-        'users.User', 
+        'users.User',
         on_delete=models.CASCADE,
         related_name="tickets",
         blank=True,
@@ -35,7 +35,7 @@ class Ticket(AclMixin, models.Model):
     date = models.DateTimeField(auto_now_add=True)
     email = models.EmailField(
         help_text = _("An email address to get back to you"),
-        max_length=100, 
+        max_length=100,
         null=True)
     solved = models.BooleanField(default=False)
 
@@ -67,26 +67,31 @@ class Ticket(AclMixin, models.Model):
             GeneralOption.get_cached_value('email_from'),
             [to_addr],
             fail_silently = False)
-    
+
     def can_view(self, user_request, *_args, **_kwargs):
         """ Check that the user has the right to view the ticket
         or that it is the author"""
         if (not user_request.has_perm('tickets.view_ticket') and self.user != user_request):
-            return False, _("You don't have the right to view other tickets than yours.")
+            return (
+                False,
+                _("You don't have the right to view other tickets than yours."),
+                ('tickets.view_ticket',)
+            )
         else:
-            return True, None
-    
+            return True, None, None
+
     @staticmethod
     def can_view_all(user_request, *_args, **_kwargs):
         """ Check that the user has access to the list of all tickets"""
         return(
             user_request.has_perm('tickets.view_tickets'),
-            _("You don't have the right to view the list of tickets.")
+            _("You don't have the right to view the list of tickets."),
+            ('tickets.view_tickets',)
         )
 
     def can_create(user_request,*_args, **_kwargs):
         """ Authorise all users to open tickets """
-        return True,None
+        return True, None, None
 
 @receiver(post_save, sender=Ticket)
 def ticket_post_save(**kwargs):

topologie/acl.py

@@ -39,6 +39,10 @@ def can_view(user):
         viewing is granted and msg is a message (can be None).
     """
     can = user.has_module_perms('topologie')
-    return can, None if can else _("You don't have the right to view this"
-                                   " application.")
+    return (
+        can,
+        None if can else _("You don't have the right to view this"
+                                   " application."),
+        ('topologie',)
+    )
 

users/acl.py

@@ -38,6 +38,10 @@ def can_view(user):
         viewing is granted and msg is a message (can be None).
     """
     can = user.has_module_perms('users')
-    return can, None if can else _("You don't have the right to view this"
-                                   " application.")
+    return (
+        can,
+        None if can else _("You don't have the right to view this"
+                                   " application."),
+        ('users',)
+    )
 

users/models.py

@@ -864,29 +864,38 @@ class User(RevMixin, FieldPermissionModelMixin, AbstractBaseUser,
             if (self == user_request or
                     user_request.has_perm('users.change_user') or
                     user_request.adherent in self.club.administrators.all()):
-                return True, None
+                return True, None, None
             else:
-                return False, _("You don't have the right to edit this club.")
+                return False, _("You don't have the right to edit this club."), ('users.change_user',)
         else:
             if self == user_request:
-                return True, None
+                return True, None, None
             elif user_request.has_perm('users.change_all_users'):
-                return True, None
+                return True, None, None
             elif user_request.has_perm('users.change_user'):
                 if self.groups.filter(listright__critical=True):
-                    return False, (_("User with critical rights, can't be"
-                                     " edited."))
+                    return (
+                        False,
+                        _("User with critical rights, can't be edited. "),
+                        ('users.change_all_users',)
+                    )
                 elif self == AssoOption.get_cached_value('utilisateur_asso'):
-                    return False, (_("Impossible to edit the organisation's"
-                                     " user without the 'change_all_users'"
-                                     " right."))
+                    return (
+                        False,
+                        _("Impossible to edit the organisation's"
+                          " user without the 'change_all_users' right."),
+                        ('users.change_all_users', )
+                    )
                 else:
-                    return True, None
+                    return True, None, None
             elif user_request.has_perm('users.change_all_users'):
-                return True, None
+                return True, None, None
             else:
-                return False, (_("You don't have the right to edit another"
-                                 " user."))
+                return (
+                    False,
+                    _("You don't have the right to edit another user."),
+                    ('users.change_user', 'users.change_all_users')
+                )
 
     def can_change_password(self, user_request, *_args, **_kwargs):
         """Check if a user can change a user's password
@@ -901,27 +910,34 @@ class User(RevMixin, FieldPermissionModelMixin, AbstractBaseUser,
             if (self == user_request or
                     user_request.has_perm('users.change_user_password') or
                     user_request.adherent in self.club.administrators.all()):
-                return True, None
+                return True, None, None
             else:
-                return False, _("You don't have the right to edit this club.")
+                return (
+                    False,
+                    _("You don't have the right to edit this club."),
+                    ('users.change_user_password',)
+                )
         else:
             if (self == user_request or
                     user_request.has_perm('users.change_user_groups')):
                 # Peut éditer les groupes d'un user,
                 # c'est un privilège élevé, True
-                return True, None
+                return True, None, None
             elif (user_request.has_perm('users.change_user') and
                   not self.groups.all()):
-                return True, None
+                return True, None, None
             else:
-                return False, (_("You don't have the right to edit another"
-                                 " user."))
+                return (
+                    False,
+                    _("You don't have the right to edit another user."),
+                    ('users.change_user_groups', 'users.change_user')
+                )
 
     def check_selfpasswd(self, user_request, *_args, **_kwargs):
-        """ Returns (True, None) if user_request is self, else returns
-        (False, None)
+        """ Returns (True, None, None) if user_request is self, else returns
+        (False, None, None)
         """
-        return user_request == self, None
+        return user_request == self, None, None
 
     def can_change_room(self, user_request, *_args, **_kwargs):
         """ Check if a user can change a room
@@ -932,9 +948,13 @@ class User(RevMixin, FieldPermissionModelMixin, AbstractBaseUser,
         """
         if not ((self.pk == user_request.pk and OptionalUser.get_cached_value('self_change_room'))
             or user_request.has_perm('users.change_user')):
-            return False, _("Permission required to change the room.")
+            return (
+                False,
+                _("Permission required to change the room."),
+                ('users.change_user',)
+            )
         else:
-            return True, None
+            return True, None, None
 
     @staticmethod
     def can_change_state(user_request, *_args, **_kwargs):
@@ -946,7 +966,8 @@ class User(RevMixin, FieldPermissionModelMixin, AbstractBaseUser,
         """
         return (
             user_request.has_perm('users.change_user_state'),
-            _("Permission required to change the state.")
+            _("Permission required to change the state."),
+            ('users.change_user_state',)
         )
 
     def can_change_shell(self, user_request, *_args, **_kwargs):
@@ -958,9 +979,13 @@ class User(RevMixin, FieldPermissionModelMixin, AbstractBaseUser,
         """
         if not ((self.pk == user_request.pk and OptionalUser.get_cached_value('self_change_shell'))
             or user_request.has_perm('users.change_user_shell')):
-            return False, _("Permission required to change the shell.")
+            return (
+                False,
+                _("Permission required to change the shell."),
+                ('users.change_user_shell',)
+            )
         else:
-            return True, None
+            return True, None, None
 
     @staticmethod
     def can_change_local_email_redirect(user_request, *_args, **_kwargs):
@@ -972,7 +997,8 @@ class User(RevMixin, FieldPermissionModelMixin, AbstractBaseUser,
         """
         return (
             OptionalUser.get_cached_value('local_email_accounts_enabled'),
-            _("Local email accounts must be enabled.")
+            _("Local email accounts must be enabled."),
+            None
         )
 
     @staticmethod
@@ -985,7 +1011,8 @@ class User(RevMixin, FieldPermissionModelMixin, AbstractBaseUser,
         """
         return (
             OptionalUser.get_cached_value('local_email_accounts_enabled'),
-            _("Local email accounts must be enabled.")
+            _("Local email accounts must be enabled."),
+            None
         )
 
     @staticmethod
@@ -998,7 +1025,8 @@ class User(RevMixin, FieldPermissionModelMixin, AbstractBaseUser,
         """
         return (
             user_request.has_perm('users.change_user_force'),
-            _("Permission required to force the move.")
+            _("Permission required to force the move."),
+            ('users.change_user_force',)
         )
 
     @staticmethod
@@ -1011,7 +1039,8 @@ class User(RevMixin, FieldPermissionModelMixin, AbstractBaseUser,
         """
         return (
             user_request.has_perm('users.change_user_groups'),
-            _("Permission required to edit the user's groups of rights.")
+            _("Permission required to edit the user's groups of rights."),
+            ('users.change_user_groups')
         )
 
     @staticmethod
@@ -1023,7 +1052,8 @@ class User(RevMixin, FieldPermissionModelMixin, AbstractBaseUser,
         """
         return (
             user_request.is_superuser,
-            _("'superuser' right required to edit the superuser flag.")
+            _("'superuser' right required to edit the superuser flag."),
+            []
         )
 
     def can_view(self, user_request, *_args, **_kwargs):
@@ -1039,16 +1069,23 @@ class User(RevMixin, FieldPermissionModelMixin, AbstractBaseUser,
                     user_request.has_perm('users.view_user') or
                     user_request.adherent in self.club.administrators.all() or
                     user_request.adherent in self.club.members.all()):
-                return True, None
+                return True, None, None
             else:
-                return False, _("You don't have the right to view this club.")
+                return (
+                    False,
+                    _("You don't have the right to view this club."),
+                    ('users.view_user',)
+                )
         else:
             if (self == user_request or
                     user_request.has_perm('users.view_user')):
-                return True, None
+                return True, None, None
             else:
-                return False, (_("You don't have the right to view another"
-                                 " user."))
+                return (
+                    False,
+                    _("You don't have the right to view another user."),
+                    ('users.view_user',)
+                )
 
     @staticmethod
     def can_view_all(user_request, *_args, **_kwargs):
@@ -1060,7 +1097,8 @@ class User(RevMixin, FieldPermissionModelMixin, AbstractBaseUser,
         """
         return (
             user_request.has_perm('users.view_user'),
-            _("You don't have the right to view the list of users.")
+            _("You don't have the right to view the list of users."),
+            ('users.view_user',)
         )
 
     def can_delete(self, user_request, *_args, **_kwargs):
@@ -1073,7 +1111,8 @@ class User(RevMixin, FieldPermissionModelMixin, AbstractBaseUser,
         """
         return (
             user_request.has_perm('users.delete_user'),
-            _("You don't have the right to delete this user.")
+            _("You don't have the right to delete this user."),
+            ('users.delete_user',)
         )
 
     def __init__(self, *args, **kwargs):
@@ -1160,15 +1199,16 @@ class Adherent(User):
         """
         if (not user_request.is_authenticated and
                 not OptionalUser.get_cached_value('self_adhesion')):
-            return False, None
+            return False, _("Self adhesion is disabled."), None
         else:
             if (OptionalUser.get_cached_value('all_can_create_adherent') or
                     OptionalUser.get_cached_value('self_adhesion')):
-                return True, None
+                return True, None, None
             else:
                 return (
                     user_request.has_perm('users.add_user'),
-                    _("You don't have the right to create a user.")
+                    _("You don't have the right to create a user."),
+                    ('users.add_user',)
                 )
 
     def clean(self, *args, **kwargs):
@@ -1216,14 +1256,15 @@ class Club(User):
             an user or if the `options.all_can_create` is set.
         """
         if not user_request.is_authenticated:
-            return False, None
+            return False, _("You must be authenticated."), None
         else:
             if OptionalUser.get_cached_value('all_can_create_club'):
-                return True, None
+                return True, None, None
             else:
                 return (
                     user_request.has_perm('users.add_user'),
-                    _("You don't have the right to create a club.")
+                    _("You don't have the right to create a club."),
+                    ('users.add_user',)
                 )
 
     @staticmethod
@@ -1235,13 +1276,17 @@ class Club(User):
             message.
         """
         if user_request.has_perm('users.view_user'):
-            return True, None
+            return True, None, None
         if (hasattr(user_request, 'is_class_adherent') and
                 user_request.is_class_adherent):
             if (user_request.adherent.club_administrator.all() or
                     user_request.adherent.club_members.all()):
-                return True, None
-        return False, _("You don't have the right to view the list of users.")
+                return True, None, None
+        return (
+            False,
+            _("You don't have the right to view the list of users."),
+            ('users.view_user',)
+        )
 
     @classmethod
     def get_instance(cls, clubid, *_args, **_kwargs):
@@ -1553,10 +1598,13 @@ class Ban(RevMixin, AclMixin, models.Model):
         """
         if (not user_request.has_perm('users.view_ban') and
                 self.user != user_request):
-            return False, (_("You don't have the right to view bans other"
-                             " than yours."))
+            return (
+                False,
+                _("You don't have the right to view bans other than yours."),
+                ('users.view_ban',)
+            )
         else:
-            return True, None
+            return True, None, None
 
     def __str__(self):
         return str(self.user) + ' ' + str(self.raison)
@@ -1620,10 +1668,13 @@ class Whitelist(RevMixin, AclMixin, models.Model):
         """
         if (not user_request.has_perm('users.view_whitelist') and
                 self.user != user_request):
-            return False, (_("You don't have the right to view whitelists"
-                             " other than yours."))
+            return (
+                False,
+                _("You don't have the right to view whitelists other than yours."),
+                ('users.view_whitelist',)
+            )
         else:
-            return True, None
+            return True, None, None
 
     def __str__(self):
         return str(self.user) + ' ' + str(self.raison)
@@ -1892,17 +1943,29 @@ class EMailAddress(RevMixin, AclMixin, models.Model):
             a local email account.
         """
         if user_request.has_perm('users.add_emailaddress'):
-            return True, None
+            return True, None, None
         if not OptionalUser.get_cached_value('local_email_accounts_enabled'):
-            return False, _("The local email accounts are not enabled.")
+            return (
+                False,
+                _("The local email accounts are not enabled."),
+                None
+            )
         if int(user_request.id) != int(userid):
-            return False, _("You don't have the right to add a local email"
-                            " account to another user.")
+            return (
+                False,
+                _("You don't have the right to add a local email"
+                  " account to another user."),
+                ('users.add_emailaddress',)
+            )
         elif user_request.email_address.count() >= OptionalUser.get_cached_value('max_email_address'):
-            return False, _("You reached the limit of {} local email accounts.").format(
-                OptionalUser.get_cached_value('max_email_address')
+            return (
+                False,
+                _("You reached the limit of {} local email accounts.").format(
+                    OptionalUser.get_cached_value('max_email_address')
+                ),
+                None
             )
-        return True, None
+        return True, None, None
 
     def can_view(self, user_request, *_args, **_kwargs):
         """Check if a user can view the local email account
@@ -1915,13 +1978,21 @@ class EMailAddress(RevMixin, AclMixin, models.Model):
             the local email account.
         """
         if user_request.has_perm('users.view_emailaddress'):
-            return True, None
+            return True, None, None
         if not OptionalUser.get_cached_value('local_email_accounts_enabled'):
-            return False, _("The local email accounts are not enabled.")
+            return (
+                False,
+                _("The local email accounts are not enabled."),
+                None
+            )
         if user_request == self.user:
-            return True, None
-        return False, _("You don't have the right to edit another user's local"
-                        " email account.")
+            return True, None, None
+        return (
+            False,
+            _("You don't have the right to edit another user's local"
+              " email account."),
+            ('users.view_emailaddress',)
+        )
 
     def can_delete(self, user_request, *_args, **_kwargs):
         """Check if a user can delete the alias
@@ -1934,16 +2005,24 @@ class EMailAddress(RevMixin, AclMixin, models.Model):
             the local email account.
         """
         if self.local_part == self.user.pseudo.lower():
-            return False, _("You can't delete a local email account whose"
-                            " local part is the same as the username.")
+            return (
+                False,
+                _("You can't delete a local email account whose"
+                  " local part is the same as the username."),
+                None
+            )
         if user_request.has_perm('users.delete_emailaddress'):
-            return True, None
+            return True, None, None
         if not OptionalUser.get_cached_value('local_email_accounts_enabled'):
-            return False, _("The local email accounts are not enabled.")
+            return False, _("The local email accounts are not enabled."), None
         if user_request == self.user:
-            return True, None
-        return False, _("You don't have the right to delete another user's"
-                       " local email account")
+            return True, None, None
+        return (
+            False,
+            _("You don't have the right to delete another user's"
+              " local email account"),
+            ('users.delete_emailaddress',)
+        )
 
     def can_edit(self, user_request, *_args, **_kwargs):
         """Check if a user can edit the alias
@@ -1956,16 +2035,24 @@ class EMailAddress(RevMixin, AclMixin, models.Model):
             the local email account.
         """
         if self.local_part == self.user.pseudo.lower():
-            return False, _("You can't edit a local email account whose local"
-                            " part is the same as the username.")
+            return (
+                False,
+                _("You can't edit a local email account whose local"
+                            " part is the same as the username."),
+                None
+            )
         if user_request.has_perm('users.change_emailaddress'):
-            return True, None
+            return True, None, None
         if not OptionalUser.get_cached_value('local_email_accounts_enabled'):
-            return False, _("The local email accounts are not enabled.")
+            return False, _("The local email accounts are not enabled."), None
         if user_request == self.user:
-            return True, None
-        return False, _("You don't have the right to edit another user's local"
-                        " email account.")
+            return True, None, None
+        return (
+            False,
+            _("You don't have the right to edit another user's local"
+                        " email account."),
+            ('users.change_emailaddress',)
+        )
 
     def clean(self, *args, **kwargs):
         self.local_part = self.local_part.lower()