#NEWLINE# @ subscriber ( ResourceChanged , for_resources = ( 'group' , ) , for_actions = ( ACTIONS . CREATE , ACTIONS . UPDATE ) ) #NEWLINE# def on_groups_changed( event ) : #NEWLINE# #INDENT# 'Some groups were changed, update users principals.\n    ' #NEWLINE# permission_backend = event . request . registry . permission #NEWLINE# for change in event . impacted_records : #NEWLINE# #INDENT# if ( 'old' in change ) : #NEWLINE# #INDENT# existing_record_members = set ( change [ 'old' ] . get ( 'members' , [ ] ) ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# existing_record_members = set ( ) #NEWLINE# #UNINDENT# group = change [ 'new' ] #NEWLINE# group_uri = '/buckets/{bucket_id}/groups/{id}' . format ( id = group [ 'id' ] , ** event . payload ) #NEWLINE# new_record_members = set ( group . get ( 'members' , [ ] ) ) #NEWLINE# new_members = ( new_record_members - existing_record_members ) #NEWLINE# removed_members = ( existing_record_members - new_record_members ) #NEWLINE# for member in new_members : #NEWLINE# #INDENT# permission_backend . add_user_principal ( member , group_uri ) #NEWLINE# #UNINDENT# for member in removed_members : #NEWLINE# #INDENT# permission_backend . remove_user_principal ( member , group_uri )