gistfile1.rb

diff --git a/src/app/controllers/api/api_controller.rb b/src/app/controllers/api/api_controller.rb
index e2f336e..c9cfb80 100644
--- a/src/app/controllers/api/api_controller.rb
+++ b/src/app/controllers/api/api_controller.rb
@@ -136,7 +136,8 @@ class Api::ApiController < ActionController::Base
   def render_exception(status_code, exception)
     logger.error pp_exception(exception)
     respond_to do |format|
-      format.json { render :json => {:errors => [ exception.message ]}, :status => status_code }
+      #json has to be displayMessage for older RHEL 5.7 subscription managers
+      format.json { render :json => {:displayMessage => exception.message, :errors => [exception.message] }, :status => status_code }
       format.all  { render :text => exception.message, :status => status_code }
     end
   end
diff --git a/src/app/controllers/api/systems_controller.rb b/src/app/controllers/api/systems_controller.rb
index fe6bc80..2ce61d7 100644
--- a/src/app/controllers/api/systems_controller.rb
+++ b/src/app/controllers/api/systems_controller.rb
@@ -47,6 +47,7 @@ class Api::SystemsController < Api::ApiController
       :unsubscribe => edit_system,
       :subscriptions => read_system,
       :pools => read_system,
+      :activate => register_system
     }
   end
 
@@ -192,8 +193,17 @@ class Api::SystemsController < Api::ApiController
   end
 
   def verify_presence_of_organization_or_environment
+    # This has to grab the first default org associated with this user AND
+    # the environment that goes with him.
     return if params.has_key?(:organization_id) or params.has_key?(:owner) or params.has_key?(:environment_id)
-    raise HttpErrors::BadRequest, _("Either organization id or environment id needs to be specified")
+
+    #At this point we know that they didn't supply an org or environment, so we can look up the default
+    @environment = current_user.default_environment
+    if @environment
+      @organization = @environment.organization
+    else
+      raise _("You have not set a default organization and environment on the user #{@name}.")
+    end
   end
 
   def find_system
diff --git a/src/app/controllers/application_controller.rb b/src/app/controllers/application_controller.rb
index 7bf80d9..868d400 100644
--- a/src/app/controllers/application_controller.rb
+++ b/src/app/controllers/application_controller.rb
@@ -104,7 +104,7 @@ class ApplicationController < ActionController::Base
       details = options[:details] unless options[:details].nil?
     end
 
-    notice_dialog = build_notice notice, options[:list_items]
+    notice_dialog = build_notice(notice, options[:list_items], options[:include_class_name])
 
     notice_string = notice_dialog["notices"].join("<br />")
     if notice_dialog.has_key?("validation_errors")
@@ -320,7 +320,7 @@ class ApplicationController < ActionController::Base
     end
   end
 
-  def build_notice notice, list_items
+  def build_notice notice, list_items, error_class_name = nil
     items = { "notices" => [] }
 
     if notice.kind_of? Array
@@ -333,14 +333,20 @@ class ApplicationController < ActionController::Base
       end
       items["notices"].push(notice)
     else
-      handle_notice_type notice, items
+      handle_notice_type notice, items, error_class_name
     end
     return items
   end
 
-  def handle_notice_type notice, items
+  def handle_notice_type notice, items, error_class_name = nil
     if notice.kind_of? ActiveRecord::RecordInvalid
-      items["validation_errors"] = notice.record.errors.full_messages.to_a
+      items["validation_errors"] = notice.record.errors.full_messages.to_a.map do |er|
+        if error_class_name
+          error_class_name + " " + er
+        else
+          er
+        end
+      end
       return items
     elsif notice.kind_of? RestClient::InternalServerError
       items["notices"].push(notice.response)
@@ -444,9 +450,9 @@ class ApplicationController < ActionController::Base
     flash_to_headers
   end
 
-  def first_env_in_path accessible_envs, include_locker=false
+  def first_env_in_path accessible_envs, include_locker=false, organization = current_organization
     return current_organization.locker if include_locker && accessible_envs.member?(current_organization.locker)
-    current_organization.promotion_paths.each{|path|
+    organization.promotion_paths.each{|path|
       path.each{|env|
         if accessible_envs.member?(env)
           return env
diff --git a/src/app/controllers/environments_controller.rb b/src/app/controllers/environments_controller.rb
index 14fda5c..ce690df 100644
--- a/src/app/controllers/environments_controller.rb
+++ b/src/app/controllers/environments_controller.rb
@@ -48,6 +48,7 @@ class EnvironmentsController < ApplicationController
     render :partial=>"new", :layout => "tupane_layout"
   end
 
+
   # GET /environments/1/edit
   def edit
     # Create a hash of the available environments and convert to json to be included
diff --git a/src/app/controllers/organizations_controller.rb b/src/app/controllers/organizations_controller.rb
index cc69a69..790abf3 100644
--- a/src/app/controllers/organizations_controller.rb
+++ b/src/app/controllers/organizations_controller.rb
@@ -11,14 +11,13 @@
 # have received a copy of GPLv2 along with this software; if not, see
 # http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
 
-require 'pp'
-
 class OrganizationsController < ApplicationController
   navigation :organizations
   include AutoCompleteSearch
   respond_to :html, :js
   skip_before_filter :authorize
   before_filter :find_organization, :only => [:edit, :update, :destroy]
+  before_filter :find_organization_by_id, :only => [:environments_partial]
   before_filter :authorize #call authorize after find_organization so we call auth based on the id instead of cp_id
   before_filter :setup_options, :only=>[:index, :items]
   before_filter :search_filter, :only => [:auto_complete_search]
@@ -38,6 +37,7 @@ class OrganizationsController < ApplicationController
       :edit => read_test,
       :update => edit_test,
       :destroy => delete_test,
+      :environments_partial => index_test,
     }
   end
 
@@ -55,11 +55,22 @@ class OrganizationsController < ApplicationController
 
   def create
     begin
+      @new_env = KTEnvironment.new(:name => params[:envname], :description => params[:envdescription])
       @organization = Organization.new(:name => params[:name], :description => params[:description], :cp_key => params[:name].tr(' ', '_'))
       @organization.save!
+      @new_env.organization = @organization
+      @new_env.prior = @organization.locker
+      @new_env.save!
+      notice [_("Organization '#{@organization["name"]}' was created.")]
+        # TODO: example - create permission for the organization
     rescue Exception => error
-      errors error
+      errors(error, {:include_class_name => KTEnvironment::ERROR_CLASS_NAME})
       Rails.logger.info error.backtrace.join("\n")
+      #rollback creation of the org if the org creation passed but the environment was not created
+      if @organization && @organization.id #it is saved to the db
+        @organization.destroy
+      end
+
       render :text=> error.to_s, :status=>:bad_request and return
     end
     
@@ -121,11 +132,19 @@ class OrganizationsController < ApplicationController
       render :partial => "common/list_remove", :locals => {:id=> id, :name=> controller_display_name}
     else
       errors [_("Could not delete organization '#{params[:id]}'."),  _("At least one organization must exist.")]
-      
+
       render :text => "At least one organization must exist.", :status=>:bad_request and return
     end
   end
 
+  def environments_partial
+    @organization = Organization.find(params[:id])
+    accessible_envs = KTEnvironment.systems_registerable(@organization)
+    setup_environment_selector(@organization, accessible_envs)
+    @environment = first_env_in_path(accessible_envs, false, @organization)
+    render :partial=>"environments", :locals=>{:accessible_envs => accessible_envs}
+  end
+
   protected
 
   def find_organization
@@ -139,6 +158,17 @@ class OrganizationsController < ApplicationController
     end
   end
 
+  def find_organization_by_id
+    begin
+      @organization = Organization.find(params[:id])
+      raise if @organization.nil?
+    rescue Exception => error
+      errors _("Couldn't find organization with ID=#{params[:id]}")
+      execute_after_filters
+      render :text => error, :status => :bad_request
+    end
+  end
+
   def setup_options
     @panel_options = { :title => _('Organizations'),
                :col => ['name'],
diff --git a/src/app/controllers/users_controller.rb b/src/app/controllers/users_controller.rb
index 423b587..c7ace47 100644
--- a/src/app/controllers/users_controller.rb
+++ b/src/app/controllers/users_controller.rb
@@ -18,7 +18,8 @@ class UsersController < ApplicationController
   end
    
   before_filter :setup_options, :only => [:items, :index]
-  before_filter :find_user, :only => [:edit, :update, :update_roles, :clear_helptips, :destroy]
+  before_filter :find_user, :only => [:edit, :edit_environment, :update_environment,
+                                      :update, :update_roles, :clear_helptips, :destroy]
   before_filter :authorize
   skip_before_filter :require_org
 
@@ -39,6 +40,8 @@ class UsersController < ApplicationController
        :new => create_test,
        :create => create_test,
        :edit => read_test,
+       :edit_environment => read_test,
+       :update_environment => read_test,
        :update => edit_details_test,
        :update_roles => edit_test,
        :clear_helptips => edit_details_test,
@@ -53,25 +56,51 @@ class UsersController < ApplicationController
   end
 
   
-  def edit 
-    render :partial=>"edit", :layout => "tupane_layout", :locals=>{:user=>@user, :editable=>@user.editable?, :name=>controller_display_name}
+  def edit
+    @organization = current_organization
+    accessible_envs = current_organization.environments
+    setup_environment_selector(current_organization, accessible_envs)
+    @environment = first_env_in_path(accessible_envs)
+    render :partial=>"edit", :layout => "tupane_layout", :locals=>{:user=>@user,
+                                                                   :editable=>@user.editable?,
+                                                                   :name=>controller_display_name,
+                                                                   :accessible_envs => accessible_envs}
   end
   
   def new
     @user = User.new
-    render :partial=>"new", :layout => "tupane_layout", :locals=>{:user=>@user}
+    @organization = current_organization
+    accessible_envs = current_organization.environments
+    setup_environment_selector(current_organization, accessible_envs)
+    @environment = first_env_in_path(accessible_envs)
+    render :partial=>"new", :layout => "tupane_layout", :locals=>{:user=>@user, :accessible_envs => accessible_envs}
   end
 
   def create
-    @user = User.new(params[:user])
-    @user.save!
-    notice @user.username + _(" created successfully.")
-   
-    if User.where(:id => @user.id).search_for(params[:search]).include?(@user) 
-      render :partial=>"common/list_item", :locals=>{:item=>@user, :accessor=>"id", :columns=>["username"], :name=>controller_display_name}
-    else
-      notice _("'#{@user["name"]}' did not meet the current search criteria and is not being shown."), { :level => 'message', :synchronous_request => false }
-      render :json => { :no_match => true }
+    begin
+      @user = User.new(params[:user])
+      @environment = KTEnvironment.find(params[:user]['env_id'])
+      @organization = @environment.organization
+      @user.save!
+      perm = Permission.create! :role => @user.own_role,
+                         :resource_type=> ResourceType.find_or_create_by_name("environments"),
+                         :verbs=>[Verb.find_or_create_by_verb("register_systems")],
+                         :name=>"default systems reg permission",
+                         :organization=> @organization
+      PermissionTag.create!(:permission_id => perm.id, :tag_id => @environment.id)
+
+      notice @user.username + _(" created successfully.")
+      if User.where(:id => @user.id).search_for(params[:search]).include?(@user) 
+        render :partial=>"common/list_item", :locals=>{:item=>@user, :accessor=>"id", :columns=>["username"], :name=>controller_display_name}
+      else
+        notice _("'#{@user["name"]}' did not meet the current search criteria and is not being shown."), { :level => 'message', :synchronous_request => false }
+        render :json => { :no_match => true }
+      end
+    rescue Exception => error
+      errors error
+      #transaction, if something goes wrong with the creation of the permission, we will need to delete the user
+      @user.destroy if @user.id
+      render :json=>@user.errors, :status=>:bad_request
     end
   rescue Exception => error
     errors error
@@ -96,6 +125,66 @@ class UsersController < ApplicationController
     render :text => @user.errors, :status=>:ok
   end
 
+  def edit_environment
+    if @user.has_default_env?
+      @old_perm = Permission.find_all_by_role_id(@user.own_role.id)[0]
+      @old_env = @user.default_environment
+      @organization = Organization.find(@old_env.attributes['organization_id'])
+    else
+      @organization = current_organization
+    end
+    accessible_envs = KTEnvironment.systems_registerable(@organization)
+    setup_environment_selector(@organization, accessible_envs)
+    @environment = first_env_in_path(accessible_envs, false, @organization)
+    #accessible_envs = current_organization.environments
+    #setup_environment_selector(current_organization, accessible_envs)
+    #@environment = first_env_in_path(accessible_envs)
+    render :partial=>"edit_environment", :layout => "tupane_layout", :locals=>{:user=>@user,
+                                                                   :editable=>@user.editable?,
+                                                                   :name=>controller_display_name,
+                                                                   :accessible_envs => accessible_envs}
+
+  end
+
+  def update_environment
+    begin
+
+      new_env =  params["env_id"]["env_id"].to_i
+      if @user.has_default_env?
+        old_perm = Permission.find_all_by_role_id(@user.own_role.id)[0]
+        old_env = old_perm.tags[0].tag_id
+      end
+      if (old_perm.nil? || (old_env != new_env))
+        #First delete the old role if it is not equal to the old one
+        old_perm.destroy if @user.has_default_env?
+
+        @environment = KTEnvironment.find(new_env)
+        @organization = @environment.organization
+
+        #Second create a new one with the newly selected env
+        perm = Permission.create! :role => @user.own_role,
+                     :resource_type=> ResourceType.find_or_create_by_name("environments"),
+                     :verbs=>[Verb.find_or_create_by_verb("register_systems")],
+                     :name=>"default systems reg permission",
+                     :organization=> @organization
+        PermissionTag.create!(:permission_id => perm.id, :tag_id => new_env)
+
+        notice _("User environment updated successfully.")
+        #attr = params[:user].first.last if params[:user].first
+        #attr ||= ""
+        render :json => {:org => @organization.name, :env => @environment.name} and return
+      else
+        err_msg = N_("The default you supplied was the same as the old default.")
+        errors err_msg
+        render(:text => err_msg, :status => 400) and return
+      end
+
+    rescue Exception => error
+      errors error.message
+      render :text =>error.message, :status=>400
+    end
+  end
+
   def update_roles
     params[:user] = {"role_ids"=>[]} unless params.has_key? :user
 
diff --git a/src/app/helpers/users_helper.rb b/src/app/helpers/users_helper.rb
index 33001c0..051e51c 100644
--- a/src/app/helpers/users_helper.rb
+++ b/src/app/helpers/users_helper.rb
@@ -11,10 +11,17 @@
 # http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
 
 module UsersHelper
-	
+
   def mask_password user
-   return "" if user.password.nil?
-	 user.password.gsub(/./, "&#9679;")
+    return "" if user.password.nil?
+    user.password.gsub(/./, "&#9679;")
+  end
+
+  def organization_select(org_id=nil)
+    select(:org_id, "org_id",
+           current_user.allowed_organizations.map {|a| [a.name, a.id]},
+           {:prompt => _('Select Organization'), :id=>"org_field",
+           :selected => (org_id ||= current_organization.id)})
   end
-	
+
 end
diff --git a/src/app/models/kt_environment.rb b/src/app/models/kt_environment.rb
index a0bf5c1..fb695a9 100644
--- a/src/app/models/kt_environment.rb
+++ b/src/app/models/kt_environment.rb
@@ -22,7 +22,10 @@ class PriorValidator < ActiveModel::Validator
     #environment already does not have a successor
     #this is because in v1.0 we want
     # prior to have only one child (unless its the Locker)
-    has_no_prior = record.organization.environments.reject{|env| env == record || env.prior != record.prior || env.prior == env.organization.locker}.empty?
+    has_no_prior = true
+    if record.organization
+      has_no_prior = record.organization.environments.reject{|env| env == record || env.prior != record.prior || env.prior == env.organization.locker}.empty?
+    end
     record.errors[:prior] << _("environment cannot be a prior to a different environment") unless has_no_prior
 
     # only Locker can have prior=nil
@@ -86,6 +89,10 @@ class KTEnvironment < ActiveRecord::Base
   validates_with PriorValidator
   validates_with PathDescendentsValidator
 
+
+   ERROR_CLASS_NAME = "Environment"
+
+
   def locker?
     self.locker
   end
@@ -234,6 +241,7 @@ class KTEnvironment < ActiveRecord::Base
       authorized_items(org, SYSTEMS_READABLE)
     end
   }
+  scope :systems_registerable, lambda{|org|  authorized_items(org, [:register_systems]) }
 
   def self.any_viewable_for_promotions? org
     User.allowed_to?(CHANGE_SETS_READABLE + CONTENTS_READABLE, :environments, org.environment_ids, org, true)
@@ -283,6 +291,11 @@ class KTEnvironment < ActiveRecord::Base
         User.allowed_to?([:delete_systems], :environments, self.id, self.organization)
   end
 
+  def systems_registerable?
+    User.allowed_to?([:register_systems], :organizations, nil, self.organization) ||
+        User.allowed_to?([:register_systems], :environments, self.id, self.organization)
+  end
+
 
   def self.authorized_items org, verbs, resource = :environments
     raise "scope requires an organization" if org.nil?
diff --git a/src/app/models/organization.rb b/src/app/models/organization.rb
index 37defd2..e3b915c 100644
--- a/src/app/models/organization.rb
+++ b/src/app/models/organization.rb
@@ -95,6 +95,10 @@ class Organization < ActiveRecord::Base
     User.allowed_to?(SYSTEMS_READABLE, :organizations, nil, self)
   end
 
+  def systems_readable?
+    User.allowed_to?(SYSTEMS_READABLE, :organizations, nil, self)
+  end
+
   def self.list_verbs global = false
     org_verbs = {
       :update => N_("Manage Organization and Environments"),
diff --git a/src/app/models/user.rb b/src/app/models/user.rb
index e3622fa..27bffc4 100644
--- a/src/app/models/user.rb
+++ b/src/app/models/user.rb
@@ -29,7 +29,6 @@ class User < ActiveRecord::Base
   has_many :search_favorites, :dependent => :destroy
   has_many :search_histories, :dependent => :destroy
 
-
   validates :username, :uniqueness => true, :presence => true, :username => true, :length => { :maximum => 255 }
   validate :own_role_included_in_roles
 
@@ -47,10 +46,28 @@ class User < ActiveRecord::Base
   # validate the password length before hashing
   validates_each :password do |model, attr, value|
     if model.password_changed?
-      model.errors.add(attr, "at least 5 characters") if value.length < 5
+      model.errors.add(attr, _("at least 5 characters")) if value.length < 5
     end
   end
 
+#  validates_each :own_role do |model, attr, value|
+#    #This is enforced throught a user's self role where a permission with a tag is created
+#    #that has the environment id of the default environment for the user
+#    err_msg =  _("A user must have a default org and environment associated.")
+#    if model.blank?
+#      model.errors.add(attr,err_msg)
+#    else
+#      perm = Permission.find_all_by_role_id(@user.own_role.id)
+#      if perm.blank?
+#        model.errors.add(attr,err_msg)
+#      else
+#        if !perm[0].tags
+#          model.errors.add(attr,err_msg)
+#        end
+#      end
+#    end
+#  end
+
   # hash the password before creating or updateing the record
   before_save do |u|
     u.password = Password::update(u.password) if u.password.length != 192
@@ -352,6 +369,27 @@ class User < ActiveRecord::Base
     User.allowed_to?([:delete], :users, nil)
   end
 
+  def has_default_env?
+    #the own_role is used exclusively for storing a perm with a tag that tells the default env
+    if !self.own_role
+      return false
+    else
+      if Permission.find_all_by_role_id(self.own_role.id).empty?
+        return false
+      end
+    end
+    true
+  end
+
+  def default_environment
+    sr = self.own_role
+    perm = Permission.find_all_by_role_id(self.own_role.id)
+    if sr && !perm.empty? && perm[0].tags
+      return KTEnvironment.find(perm[0].tags[0].tag_id)
+    end
+    nil
+  end
+
   protected
 
   def can_be_deleted?
diff --git a/src/app/views/common/_env_select.html.haml b/src/app/views/common/_env_select.html.haml
index 51d65dd..dd8da35 100644
--- a/src/app/views/common/_env_select.html.haml
+++ b/src/app/views/common/_env_select.html.haml
@@ -1,35 +1,38 @@
-#path-widget{:class => path_widget_class}
-  #path-controller
-    - if @paths.length > 1
-      #path-collapsed.path_selector
-        = image_tag('icons/expander-collapsed-left.png', :alt => _('Expand'))
-      #path-expanded.path_selector
-        = image_tag('icons/expander-expanded.png', :alt => _('Collapse'))
+- if @environment.nil?
+  #{_("No environments are currently available in this organization.  Please add some to be able to create users.")}
+- else
+  #path-widget{:class => path_widget_class}
+    #path-controller
+      - if @paths.length > 1
+        #path-collapsed.path_selector
+          = image_tag('icons/expander-collapsed-left.png', :alt => _('Expand'))
+        #path-expanded.path_selector
+          = image_tag('icons/expander-expanded.png', :alt => _('Collapse'))
 
-    #path-selected.path_selected
-      .jbreadcrumb
+      #path-selected.path_selected
+        .jbreadcrumb
 
-        %ul.breadcrumb
-          - @path.each_with_index do |env, count|
-            %li
-              %a{"data-env_id"=> env.id, "data-url"=>env_select_url(url_proc, env, @path[count+1], @organization),
-                 "data-templates_url"=>env_select_url(url_templates_proc, env, @path[count+1], @organization),
-                 "data-products_url"=>env_select_url(url_products_proc, env, @path[count+1], @organization),
-                 :class=>env_select_class(env, @environment, @path, @path, accessible_envs, locker_clickable)}
-                %div
-                  #{env.name}
+          %ul.breadcrumb
+            - @path.each_with_index do |env, count|
+              %li
+                %a{"data-env_id"=> env.id, "data-url"=>env_select_url(url_proc, env, @path[count+1], @organization),
+                   "data-templates_url"=>env_select_url(url_templates_proc, env, @path[count+1], @organization),
+                   "data-products_url"=>env_select_url(url_products_proc, env, @path[count+1], @organization),
+                   :class=>env_select_class(env, @environment, @path, @path, accessible_envs, locker_clickable)}
+                  %div
+                    #{env.name}
 
-  - if @paths.length > 1
-    #path-entries.path_entries{:class => path_entries_class}
-      - for path in @paths
-        %div.path_entry
-          .jbreadcrumb
-            %ul
-              - path.each_with_index do |env, count|
-                %li
-                  %a{"data-env_id"=> env.id, "data-url"=>env_select_url(url_proc, env, path[count+1], @organization),
-                     "data-templates_url"=>env_select_url(url_templates_proc, env, @path[count+1], @organization),
-                     "data-products_url"=>env_select_url(url_products_proc, env, @path[count+1], @organization),
-                     :class=>env_select_class(env, @environment, @path, path, accessible_envs, locker_clickable)}
-                    %div
-                      #{env.name}
\ No newline at end of file
+    - if @paths.length > 1
+      #path-entries.path_entries{:class => path_entries_class}
+        - for path in @paths
+          %div.path_entry
+            .jbreadcrumb
+              %ul
+                - path.each_with_index do |env, count|
+                  %li
+                    %a{"data-env_id"=> env.id, "data-url"=>env_select_url(url_proc, env, path[count+1], @organization),
+                       "data-templates_url"=>env_select_url(url_templates_proc, env, @path[count+1], @organization),
+                       "data-products_url"=>env_select_url(url_products_proc, env, @path[count+1], @organization),
+                       :class=>env_select_class(env, @environment, @path, path, accessible_envs, locker_clickable)}
+                      %div
+                        #{env.name}
\ No newline at end of file
diff --git a/src/app/views/organizations/_environments.html.haml b/src/app/views/organizations/_environments.html.haml
new file mode 100644
index 0000000..96dc435
--- /dev/null
+++ b/src/app/views/organizations/_environments.html.haml
@@ -0,0 +1,2 @@
+= environment_selector(:path_widget_class=>"grid_5", :path_entries_class=>"grid_5", :locker_clickable=>false,
+  :accessible_envs=>accessible_envs, :url_templates_proc=>url_templates_proc)
\ No newline at end of file
diff --git a/src/app/views/organizations/_new.html.haml b/src/app/views/organizations/_new.html.haml
index 24e9f5c..fbec60a 100644
--- a/src/app/views/organizations/_new.html.haml
+++ b/src/app/views/organizations/_new.html.haml
@@ -1,6 +1,9 @@
 = content_for :title do
   #{_("New Organization")}
-  
+
+= content_for :navigation do
+  / pretty
+
 = content_for :content do
   .grid_8#new_organization123
     = form_tag organizations_path, :method => "post", :id => "new_organization" do
@@ -14,5 +17,20 @@
           %label #{_("Description")}:
         .grid_5.la
           = text_area_tag :description, params[:description], :tabindex => auto_tab_index
+      %fieldset
+        .grid_2.la
+          %label #{_("Environment Information")}:
+      %fieldset
+        .grid_2.ra
+          %label #{_("Environment Name")}:
+        .grid_5.la
+          = text_field_tag :envname, params[:envname], :tabindex => auto_tab_index
+      %fieldset
+        .grid_2.ra
+          %label #{_("Environment Description")}:
+        .grid_5.la
+          = text_area_tag :envdescription, params[:envdescription], :tabindex => auto_tab_index
+        .grid_6.ra
+          %label #{_("Note: This will be set as your initial default environment.")}
       .grid_5.push_2.la
         = button_to _("Save"), {:action => "create", :controller => "organizations"}, :method => :post, :id => :organization_save, :tabindex => auto_tab_index
diff --git a/src/app/views/roles/_self_role_edit.html.haml b/src/app/views/roles/_self_role_edit.html.haml
index 23040f1..2b95fa3 100644
--- a/src/app/views/roles/_self_role_edit.html.haml
+++ b/src/app/views/roles/_self_role_edit.html.haml
@@ -1,5 +1,3 @@
-= javascript :user_edit
-
 = content_for :title do
   #{@user.username}
 
diff --git a/src/app/views/users/_edit.html.haml b/src/app/views/users/_edit.html.haml
index 99022d7..a33ec94 100644
--- a/src/app/views/users/_edit.html.haml
+++ b/src/app/views/users/_edit.html.haml
@@ -9,4 +9,4 @@
   = render_navigation(:items=>user_navigation, :expand_all => true, :level => 1)
 
 = content_for :content do
-  = render :partial => "edit_form", :locals=>{:editable=>editable}
\ No newline at end of file
+  = render :partial => "edit_form", :locals=>{:editable=>editable, :accessible_envs => accessible_envs}
\ No newline at end of file
diff --git a/src/app/views/users/_edit_environment.html.haml b/src/app/views/users/_edit_environment.html.haml
new file mode 100644
index 0000000..b26342b
--- /dev/null
+++ b/src/app/views/users/_edit_environment.html.haml
@@ -0,0 +1,46 @@
+= content_for :title do
+  #{@user.username}
+
+= content_for :navigation do
+  = render_navigation(:items=>user_navigation, :expand_all => true, :level => 1)
+
+= content_for :content do
+  %fieldset.fl.clear
+    .grid_3.ra
+      = label :user, :org, _("Default Organization:")
+    .grid_5.la#org_name
+      = @old_env ? @old_env.organization.name : _("No default set for this user.")
+    .grid_3.ra
+      = label :user, :env, _("Default Environment:")
+    .grid_5.la#env_name
+      = @old_env ? @old_env.name : _("No default set for this user.")
+  %fieldset.fl.clear
+    .grid_3.ra
+      = N_("Choose new defaults:")
+  %fieldset.fl.clear
+    .grid_3.ra
+      = label :user, :org, _("New Default Organization:")
+    .grid_5.la
+      = organization_select @organization.id
+  %fieldset.fl.clear
+  .promotion_paths
+    = hidden_field_tag 'user[environment_id]', @environment.id unless @environment.nil?
+    .grid_3.ra
+      %label #{_("New Default Environment")}:
+    .grid_5.la
+      - if @environment.nil?
+        #env_box
+          #{_("No environments are currently available in this organization.  Please add some to be able to create users.")}
+      - else
+        #env_box
+          = environment_selector(:path_widget_class=>"grid_5", :path_entries_class=>"grid_5", :locker_clickable=>false,
+            :accessible_envs=>accessible_envs, :url_templates_proc=>url_templates_proc)
+    .clear
+      &nbsp;
+    .grid_5.la.prefix_3
+      - if @environment.nil?
+        #update_user.verify_password.button.disabled{'data-url'=>update_environment_user_path(@user.id)}
+          #{_("Save")}
+      -else
+        #update_user.verify_password.button{'data-url'=>update_environment_user_path(@user.id)}
+          #{_("Save")}
\ No newline at end of file
diff --git a/src/app/views/users/_edit_form.html.haml b/src/app/views/users/_edit_form.html.haml
index c08e290..bd43f32 100644
--- a/src/app/views/users/_edit_form.html.haml
+++ b/src/app/views/users/_edit_form.html.haml
@@ -46,11 +46,8 @@
           = label :user, :username, _("Confirm")
         .grid_5.la
           = text_field :user, :username, :id=>"confirm_field", :value=>"", :type=>"password"
-      .grid_5.la.prefix_3
-        #save_password.verify_password.button{'data-url'=>user_path(@user.id)}
-          #{_("Save")}
       .grid_5.la.prefix_2
         #password_conflict
-
-
-= javascript :user_edit
\ No newline at end of file
+      .grid_5.la.prefix_3
+        #change_password.verify_password.button{'data-url'=>user_path(@user.id)}
+          #{_("Save")}
diff --git a/src/app/views/users/_new.html.haml b/src/app/views/users/_new.html.haml
index b3d8f21..1bab208 100644
--- a/src/app/views/users/_new.html.haml
+++ b/src/app/views/users/_new.html.haml
@@ -1,5 +1,3 @@
-= javascript :user_edit
-
 = content_for :title do
   #{_("New User")}
 
@@ -29,7 +27,28 @@
         .grid_2.ra
         .grid_5.la
           #password_conflict
-        
+      %fieldset.fl.clear
+        .grid_2.ra
+          = label :user, :org, _("Default Organization:")
+        .grid_5.la
+          = organization_select
+      %fieldset.fl.clear
+
+      .promotion_paths
+        = hidden_field_tag 'user[environment_id]', @environment.id unless @environment.nil?
+        .grid_2.ra
+          %label #{_("Environment")}:
+        .grid_5.la
+          - if @environment.nil?
+            #no_env_box
+            #{_("No environments are currently available in this organization.  Please add some to be able to create users.")}
+          - else
+            #env_box
+              = environment_selector(:path_widget_class=>"grid_5", :path_entries_class=>"grid_5", :locker_clickable=>false,
+                :accessible_envs=>accessible_envs, :url_templates_proc=>url_templates_proc)
+
+        .clear
+          &nbsp;
     .grid_5.la.prefix_2
       #save_user.verify_password.button{'data-url' => users_path, :tabindex => auto_tab_index}
         #{_("Save User")}
diff --git a/src/app/views/users/show.html.haml b/src/app/views/users/show.html.haml
index 7ee50ac..39d73f3 100644
--- a/src/app/views/users/show.html.haml
+++ b/src/app/views/users/show.html.haml
@@ -1,3 +1,3 @@
-= javascript :multiselect, :user, :user_edit
+= javascript :multiselect, :user
 /this page is used on the Roles users pane
 = collection_select(:user, :roles, Role.all, :id, :name, {}, {:multiple=>:multiple, :class=>"multiselect", :style=>"width:500px; height:400px"})
\ No newline at end of file
diff --git a/src/config/assets.yml b/src/config/assets.yml
index 166138a..c151a87 100644
--- a/src/config/assets.yml
+++ b/src/config/assets.yml
@@ -108,8 +108,6 @@ javascripts:
     - public/javascripts/user.js
     - public/javascripts/user_methods.js
     - public/javascripts/jquery/plugins/jquery.simplePassMeter.js
-  user_edit:
-    - public/javascripts/user_edit.js
   role:
     - public/javascripts/role.js
     - public/javascripts/slidingtree.js
diff --git a/src/config/katello.yml b/src/config/katello.yml
index 458bacb..ac0b07f 100644
--- a/src/config/katello.yml
+++ b/src/config/katello.yml
@@ -72,7 +72,7 @@ common:
   pulp:
     url: https://localhost/pulp/api
     oauth_key: katello
-    oauth_secret: shhhh
+    oauth_secret: lmYz0oIMXBqDGp/VtMjiXWmu
     sync_threads: 4
     sync_KBlimit: 100
 
diff --git a/src/config/routes.rb b/src/config/routes.rb
index 07f5d34..5d31332 100644
--- a/src/config/routes.rb
+++ b/src/config/routes.rb
@@ -118,6 +118,8 @@ Src::Application.routes.draw do
     member do
       post :clear_helptips
       put :update_roles
+      get :edit_environment
+      put :update_environment
     end
   end
 
@@ -194,6 +196,13 @@ Src::Application.routes.draw do
   match '/organizations/:org_id/environments/:env_id/edit' => 'environments#update', :via => :put
 
   resources :organizations do
+    collection do
+      get :auto_complete_search
+      get :items
+    end
+    member do
+      get :environments_partial
+    end
     resources :environments do
       member do
         get :system_templates
@@ -201,12 +210,9 @@ Src::Application.routes.draw do
       end
     end
     resources :providers
-    collection do
-      get :auto_complete_search
-      get :items
-    end
   end
   match '/organizations/:id/edit' => 'organizations#update', :via => :put
+  #match '/organizations/:id/environments_partial' => 'organizations#environments_partial', :via => :get
 
   resources :changesets, :only => [:update, :index, :show, :create, :new, :edit, :show, :destroy, :auto_complete_search] do
     member do
diff --git a/src/lib/navigation/administration.rb b/src/lib/navigation/administration.rb
index 88a514a..636e914 100644
--- a/src/lib/navigation/administration.rb
+++ b/src/lib/navigation/administration.rb
@@ -25,6 +25,12 @@ module Navigation
             :if => lambda{!@user.nil?},
             :options => {:class=>"navigation_element"}
           },
+          { :key => :environment,
+            :name =>N_("Environments"),
+            :url => (@user.nil? || @user.new_record?) ? "" : edit_environment_user_path(@user.id),
+            :if => lambda{!@user.nil?},
+            :options => {:class=>"navigation_element"}
+          },
           { :key => :roles_and_permissions,
             :name =>N_("Roles & Permissions"),
             :url => (@user.nil? || @user.new_record?) ? "" : edit_role_path(@user.own_role_id),
diff --git a/src/public/javascripts/user.js b/src/public/javascripts/user.js
index e2752ae..01a9f41 100644
--- a/src/public/javascripts/user.js
+++ b/src/public/javascripts/user.js
@@ -9,17 +9,68 @@
  NON-INFRINGEMENT, or FITNESS FOR A PARTICULAR PURPOSE. You should
  have received a copy of GPLv2 along with this software; if not, see
  http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
-*/
+ */
 
 KT.panel.list.registerPage('users', { create : 'new_user' });
 
 $(document).ready(function() {
-   
+
     KT.user_page.registerEdits();
 
+    ratings =
+        [{'minScore': 0,
+            'className': 'meterFail',
+            'text': i18n.very_weak
+        },
+            {'minScore': 25,
+                'className': 'meterWarn',
+                'text': i18n.weak
+            },
+            {'minScore': 50,
+                'className': 'meterGood',
+                'text': i18n.good
+            },
+            {'minScore': 75,
+                'className': 'meterExcel',
+                'text': i18n.strong
+            }];
+
     KT.panel.set_expand_cb(function() {
         //taken out of user_edit, so it can be resused on accounts
         $(".multiselect").multiselect({"dividerLocation":0.5, "sortable":false});
+
+        var org_selector = $('#org_id_org_id');
+        org_selector.change(function(event) {
+        var refill = $('#env_box');
+        var selected_org_id = org_selector.val();
+        var url = KT.common.rootURL() + 'organizations/' + selected_org_id +  '/environments_partial';
+        $.ajax({
+            type: "GET",
+            url: url,
+            success: function(data) {
+                  refill.html(data);
+           }
+        });
+   });
+
+        $('#password_field').simplePassMeter({
+            'container': '#password_meter',
+            'offset': 10,
+            'showOnFocus':false,
+            'requirements': {
+                'noUsernameMatch': {
+                    value: "#match",
+                    message: i18n.usernameMatch,
+                    callback: function(password, value) {
+                        return password.indexOf($("#username").text().trim()) === -1;
+                    }
+                }
+            },
+            'defaultText':i18n.meterText,
+            'ratings':ratings});
+
+        //from user.js
+        $('#helptips_enabled').bind('change', KT.user_page.checkboxChanged);
     })
 
 });
diff --git a/src/public/javascripts/user_edit.js b/src/public/javascripts/user_edit.js
deleted file mode 100644
index 20885e6..0000000
--- a/src/public/javascripts/user_edit.js
+++ /dev/null
@@ -1,56 +0,0 @@
-/**
- Copyright 2011 Red Hat, Inc.
-
- This software is licensed to you under the GNU General Public
- License as published by the Free Software Foundation; either version
- 2 of the License (GPLv2) or (at your option) any later version.
- There is NO WARRANTY for this software, express or implied,
- including the implied warranties of MERCHANTABILITY,
- NON-INFRINGEMENT, or FITNESS FOR A PARTICULAR PURPOSE. You should
- have received a copy of GPLv2 along with this software; if not, see
- http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
-*/
-
-
-$(document).ready(function() {
-
-
-
-
-   ratings =
-      [{'minScore': 0,
-       'className': 'meterFail',
-       'text': i18n.very_weak
-      },
-      {'minScore': 25,
-       'className': 'meterWarn',
-       'text': i18n.weak
-      },
-      {'minScore': 50,
-       'className': 'meterGood',
-       'text': i18n.good
-      },
-      {'minScore': 75,
-       'className': 'meterExcel',
-       'text': i18n.strong
-      }];
-
-   $('#password_field').simplePassMeter({
-      'container': '#password_meter',
-      'offset': 10,
-      'showOnFocus':false,
-      'requirements': {
-          'noUsernameMatch': {
-              value: "#match",
-              message: i18n.usernameMatch,
-              callback: function(password, value) {
-                return password.indexOf($("#username").text().trim()) === -1;
-              }
-          }
-      },
-      'defaultText':i18n.meterText,
-      'ratings':ratings});
-
-    //from user.js
-    $('#helptips_enabled').bind('change', KT.user_page.checkboxChanged);
-});
diff --git a/src/public/javascripts/user_methods.js b/src/public/javascripts/user_methods.js
index 06c4294..a6fca53 100644
--- a/src/public/javascripts/user_methods.js
+++ b/src/public/javascripts/user_methods.js
@@ -65,16 +65,24 @@ KT.user_page = function() {
             return false;
         }
         else {
-            $("#password_conflict").text("");
-            $(match_button).removeClass("disabled");
+            //this is to say, if there is an environment available from which to select, then
+            //allow the creation of a user
+            if ($('#no_env_box').length == 0)
+            {
+                $("#password_conflict").text("");
+                $(match_button).removeClass("disabled");
 
-            //reset the edit user button
-            $('#save_password').die('click');
-            $('#save_password').live('click',changePassword);
-            //reset the new user button
-            $('#save_user').die('click');
-            $('#save_user').live('click',createNewUser);
-            return true;
+                //reset the edit user button
+                $('#save_password').die('click');
+                $('#save_password').live('click',changePassword);
+                //reset the new user button
+                $('#save_user').die('click');
+                $('#save_user').live('click',createNewUser);
+                return true;
+            }
+            else {
+                return false;
+            }
         }
 
     },
@@ -88,10 +96,11 @@ KT.user_page = function() {
             button.addClass('disabled');
             var username = $('#username_field').val();
             var password = $('#password_field').val();
+            var env_id = $(".path_link, active").attr('data-env_id');
             $.ajax({
                 type: "POST",
                 url: button.attr('data-url'),
-                data: { "user":{"username":username, "password":password}},
+                data: { "user":{"username":username, "password":password, "env_id":env_id }},
                 cache: false,
                 success: function(data) {
                     button.removeClass('disabled');
@@ -121,6 +130,27 @@ KT.user_page = function() {
             }
         });
     },
+    updateUser = function() {
+        var button = $(this);
+        var url = button.attr("data-url");
+        var password = $('#password_field').val();
+        var env_id = $(".path_link, active").attr('data-env_id');
+        button.addClass("disabled");
+        $.ajax({
+            type: "PUT",
+            url: url,
+            data: {"env_id":{"env_id":env_id}},
+            cache: false,
+            success: function(data) {
+                $('#env_name').html(data.env);
+                $('#org_name').html(data.org);
+                button.removeClass("disabled");
+            },
+            error: function(e) {
+                button.removeClass('disabled');
+            }
+        });
+    },
     updateRoles = function(e) {
         e.preventDefault();
         var button = $(this).find('input[type|="submit"]');
@@ -140,12 +170,14 @@ KT.user_page = function() {
         $('#save_user').live('click', createNewUser);
         $('#clear_helptips').live('click',clearHelptips);
         $('#save_password').live('click',changePassword);
+        $('#update_user').live('click',updateUser);
         $('#update_roles').live('submit', updateRoles);
     };
 
     return {
         createNewUser: createNewUser,
         verifyPassword: verifyPassword,
+        updateUser: updateUser,
         changePassword: changePassword,
         checkboxChanged: checkboxChanged,
         clearHelptips: clearHelptips,
diff --git a/src/spec/controllers/api/systems_controller_spec.rb b/src/spec/controllers/api/systems_controller_spec.rb
index 5195626..888e4a0 100644
--- a/src/spec/controllers/api/systems_controller_spec.rb
+++ b/src/spec/controllers/api/systems_controller_spec.rb
@@ -170,7 +170,7 @@ describe Api::SystemsController do
 
     it "requires either organization_id, owner, or environment_id" do
       get :index
-      response.code.should == "400"
+      response.code.should == "404"
     end
 
     it "should show all systems in the organization" do
diff --git a/src/spec/controllers/organizations_controller_spec.rb b/src/spec/controllers/organizations_controller_spec.rb
index 9131afd..fb6e7eb 100644
--- a/src/spec/controllers/organizations_controller_spec.rb
+++ b/src/spec/controllers/organizations_controller_spec.rb
@@ -20,7 +20,7 @@ describe OrganizationsController do
 
   module OrgControllerTest
     ORG_ID = 1
-    ORGANIZATION = {:name => "organization_name", :description => "organization_description", :cp_key => "organization_name"}
+    ORGANIZATION = {:name => "organization_name", :description => "organization_description", :cp_key => "organization_name", :envname => "organization_env"}
   end
 
   describe "rules" do
@@ -91,7 +91,7 @@ describe OrganizationsController do
       end
 
       it 'should create organization and account for spaces' do
-        post 'create', {:name => "multi word organization", :description => "spaced out organization"}
+        post 'create', {:name => "multi word organization", :description => "spaced out organization", :envname => "first-env"}
         response.should_not redirect_to(:action => 'new')
         response.should be_success
         assigns[:organization].name.should == "multi word organization"
diff --git a/src/spec/controllers/users_controller_spec.rb b/src/spec/controllers/users_controller_spec.rb
index f9ee4ff..387ac84 100644
--- a/src/spec/controllers/users_controller_spec.rb
+++ b/src/spec/controllers/users_controller_spec.rb
@@ -18,6 +18,7 @@ describe UsersController do
   include LocaleHelperMethods
   include AuthorizationHelperMethods
   include OrchestrationHelper
+  include OrganizationHelperMethods
 
     before(:each) do
       disable_user_orchestration
@@ -31,22 +32,31 @@ describe UsersController do
     before(:each) do
       controller.stub!(:notice)
       controller.stub!(:errors)
+      @organization = new_test_org
+      @environment = KTEnvironment.create!(:name => 'first-env', :prior => @organization.locker.id, :organization => @organization)
     end
 
     it "should create a user correctly" do
       name = "foo-user"
-      post 'create', {:user => {:username=>name, :password=>"password1234"}}
+      post 'create', {:user => {:username=>name, :password=>"password1234", :env_id => @environment.id}}
       response.should be_success
       User.where(:username=>name).should_not be_empty
     end
-    
-    it "should error if no username " do
-      post 'create', {:user => {:username=>"", :password=>"password1234"}}
+
+    it "should error if no username" do
+      post 'create', {:user => {:username=>"", :password=>"password1234", :env_id => @environment.id}}
       response.should_not be_success
-      
+
+      post 'create', {:user => { :password=>"password1234"}}
+      response.should_not be_success
+    end
+
+    it "should error if no environment" do
+      post 'create', {:user => {:username=>"bar-user", :password=>"password1234"}}
+      response.should_not be_success
+
       post 'create', {:user => { :password=>"password1234"}}
       response.should_not be_success
-      
     end
     
   end
diff --git a/src/spec/helpers/organization_helper_methods.rb b/src/spec/helpers/organization_helper_methods.rb
index fb43a24..1eaa1d2 100644
--- a/src/spec/helpers/organization_helper_methods.rb
+++ b/src/spec/helpers/organization_helper_methods.rb
@@ -2,6 +2,7 @@ module OrganizationHelperMethods
   def new_test_org user=nil
     Candlepin::Owner.stub!(:create_user).and_return(true)
     Candlepin::Owner.stub!(:create).and_return({})
+    Candlepin::Owner.stub!(:destroy).and_return({})
     suffix = Organization.count + 1
     @organization = Organization.create!(:name => "test_organization#{suffix}", :cp_key => "test_organization#{suffix}")