@auth_sysadmins_check auth function decorator

ckan/logic/__init__.py

@@ -383,6 +383,18 @@ def wrapper(context, data_dict):
     return wrapper
 
 
+def auth_sysadmins_check(action):
+    ''' Prevent sysadmins from automatically being authenticated.  Instead
+    they are treated like any other user and the auth function is called.
+    '''
+    @functools.wraps(action)
+    def wrapper(context, data_dict):
+        return action(context, data_dict)
+    wrapper.auth_sysadmins_check = True
+    return wrapper
+
+
+
 class UnknownValidator(Exception):
     pass
 

ckan/new_authz.py

@@ -58,12 +58,15 @@ def is_authorized(action, context, data_dict=None):
     if context.get('ignore_auth'):
         return {'success': True}
 
-    # sysadmins can do anything
-    if is_sysadmin(context.get('user')):
-        return {'success': True}
-
     auth_function = _get_auth_function(action)
     if auth_function:
+        # sysadmins can do anything unless the auth_sysadmins_check
+        # decorator was used in which case they are treated like all other
+        # users.
+        if is_sysadmin(context.get('user')):
+            if not getattr(auth_function, 'auth_sysadmins_check', False):
+                return {'success': True}
+
         return auth_function(context, data_dict)
     else:
         raise ValueError(_('Authorization function not found: %s' % action))