This repository has been archived by the owner on Sep 28, 2022. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 19
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #99 from brandicted/acl-refactor
Acl refactor
- Loading branch information
Showing
5 changed files
with
213 additions
and
218 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,134 +1,119 @@ | ||
| from pyramid.security import ALL_PERMISSIONS, Allow, Everyone, Authenticated | ||
| from pyramid.security import( | ||
| ALL_PERMISSIONS, | ||
| Allow, | ||
| Everyone, | ||
| Authenticated, | ||
| ) | ||
|
|
||
|
|
||
| class SelfParamMixin(object): | ||
| """ ACL mixin that implements method to translate input key value | ||
| to a user ID field, when key value equals :param_value: | ||
| class Contained(object): | ||
| """Contained base class resource | ||
| Value is only converted if user is logged in and :request.user: | ||
| is an instance of :__context_class__:, thus for routes that display | ||
| auth users. | ||
| Can inherit its acl from its parent. | ||
| """ | ||
| param_value = 'self' | ||
|
|
||
| def resolve_self_key(self, key): | ||
| if key != self.param_value: | ||
| return key | ||
| user = getattr(self.request, 'user', None) | ||
| if not user or not self.__context_class__: | ||
| return key | ||
| if not isinstance(user, self.__context_class__): | ||
| return key | ||
| obj_id = getattr(user, user.pk_field()) or key | ||
| return obj_id | ||
|
|
||
|
|
||
| class BaseACL(SelfParamMixin): | ||
| """ Base ACL class. | ||
| Grants: | ||
| * all collection and item access to admins. | ||
| """ | ||
| __context_class__ = None | ||
|
|
||
| def __init__(self, request): | ||
| self.__acl__ = [(Allow, 'g:admin', ALL_PERMISSIONS)] | ||
| self.__context_acl__ = [(Allow, 'g:admin', ALL_PERMISSIONS)] | ||
| def __init__(self, request, name='', parent=None): | ||
| self.request = request | ||
| self.__name__ = name | ||
| self.__parent__ = parent | ||
|
|
||
| @property | ||
| def acl(self): | ||
| return self.__acl__ | ||
|
|
||
| @acl.setter | ||
| def acl(self, val): | ||
| assert(isinstance(val, tuple)) | ||
| self.__acl__.append(val) | ||
| class CollectionACL(Contained): | ||
| """Collection resource. | ||
| def context_acl(self, obj): | ||
| return self.__context_acl__ | ||
| You must specify the ``item_model``. It should be a nefertari.engine | ||
| document class. It is the model class for collection items. | ||
| def __getitem__(self, key): | ||
| assert(self.__context_class__) | ||
| key = self.resolve_self_key(key) | ||
| Define a ``__acl__`` attribute on this class to define the container's | ||
| permissions, and default child permissions. Inherits its acl from the | ||
| root, if no acl is set. | ||
| pk_field = self.__context_class__.pk_field() | ||
| obj = self.__context_class__.get( | ||
| __raise=True, **{pk_field: key}) | ||
| obj.__acl__ = self.context_acl(obj) | ||
| obj.__parent__ = self | ||
| obj.__name__ = key | ||
| return obj | ||
| Override the `item_acl` method if you wish to provide custom acls for | ||
| collection items. | ||
| Override the `item_db_id` method if you wish to transform the collection | ||
| item db id, e.g. to support a ``self`` item on a user collection. | ||
| """ | ||
|
|
||
| class RootACL(object): | ||
| __acl__ = [ | ||
| __acl__ = ( | ||
| (Allow, 'g:admin', ALL_PERMISSIONS), | ||
| ] | ||
| ) | ||
|
|
||
| def __init__(self, request): | ||
| self.request = request | ||
| item_model = None | ||
|
|
||
| def __getitem__(self, key): | ||
| db_id = self.item_db_id(key) | ||
| pk_field = self.item_model.pk_field() | ||
| try: | ||
| item = self.item_model.get( | ||
| __raise=True, **{pk_field: db_id} | ||
| ) | ||
| except AttributeError: | ||
| # strangely we get an AttributeError when the item isn't found | ||
| raise KeyError(key) | ||
| acl = self.item_acl(item) | ||
| if acl is not None: | ||
| item.__acl__ = acl | ||
| item.__parent__ = self | ||
| item.__name__ = key | ||
| return item | ||
|
|
||
| def item_acl(self, item): | ||
| return None | ||
|
|
||
| def item_db_id(self, key): | ||
| return key | ||
|
|
||
|
|
||
| def authenticated_userid(request): | ||
| """Helper function that can be used in ``db_key`` to support `self` | ||
| as a collection key. | ||
| """ | ||
| user = request.user | ||
| key = user.pk_field() | ||
| return getattr(user, key) | ||
|
|
||
|
|
||
| class AdminACL(BaseACL): | ||
| """ Admin level ACL. Gives all access to all actions. | ||
| # Example ACL classes and base classes | ||
| # | ||
|
|
||
| May be used as a default factory for root resource. | ||
| """ | ||
| def __getitem__(self, key): | ||
| return 1 | ||
| class RootACL(Contained): | ||
| __acl__ = ( | ||
| (Allow, 'g:admin', ALL_PERMISSIONS), | ||
| ) | ||
|
|
||
|
|
||
| class GuestACL(BaseACL): | ||
| """ Guest level ACL. | ||
| class GuestACL(CollectionACL): | ||
| """Guest level ACL base class | ||
| Gives read permissions to everyone. | ||
| """ | ||
| def __init__(self, request): | ||
| super(GuestACL, self).__init__(request) | ||
| self.acl = ( | ||
| Allow, Everyone, ['index', 'show', 'collection_options', | ||
| 'item_options']) | ||
|
|
||
| def context_acl(self, obj): | ||
| return [ | ||
| (Allow, 'g:admin', ALL_PERMISSIONS), | ||
| (Allow, Everyone, ['index', 'show', 'collection_options', | ||
| 'item_options']), | ||
| ] | ||
| __acl__ = ( | ||
| (Allow, 'g:admin', ALL_PERMISSIONS), | ||
| (Allow, Everyone, ('view', 'options')), | ||
| ) | ||
|
|
||
|
|
||
| class AuthenticatedReadACL(BaseACL): | ||
| """ Authenticated users' ACL. | ||
| class AuthenticatedReadACL(CollectionACL): | ||
| """ Authenticated users ACL base class | ||
| Gives read access to all Authenticated users. | ||
| Gives delete, create, update access to admin only. | ||
| """ | ||
| def __init__(self, request): | ||
| super(AuthenticatedReadACL, self).__init__(request) | ||
| self.acl = (Allow, Authenticated, ['index', 'collection_options']) | ||
|
|
||
| def context_acl(self, obj): | ||
| return [ | ||
| (Allow, 'g:admin', ALL_PERMISSIONS), | ||
| (Allow, Authenticated, ['show', 'item_options']), | ||
| ] | ||
| __acl__ = ( | ||
| (Allow, 'g:admin', ALL_PERMISSIONS), | ||
| (Allow, Authenticated, ('view', 'options')), | ||
| ) | ||
|
|
||
|
|
||
| class AuthenticationACL(BaseACL): | ||
| class AuthenticationACL(Contained): | ||
| """ Special ACL factory to be used with authentication views | ||
| (login, logout, register, etc.) | ||
| Allows 'create', 'show' and option methods to everyone. | ||
| Allows create, view and option methods to everyone. | ||
| """ | ||
| def __init__(self, request): | ||
| super(AuthenticationACL, self).__init__(request) | ||
| self.acl = (Allow, Everyone, [ | ||
| 'create', 'show', 'collection_options', 'item_options']) | ||
|
|
||
| def context_acl(self, obj): | ||
| return [ | ||
| (Allow, 'g:admin', ALL_PERMISSIONS), | ||
| (Allow, Everyone, [ | ||
| 'create', 'show', 'collection_options', 'item_options']), | ||
| ] | ||
|
|
||
| __acl__ = ( | ||
| (Allow, 'g:admin', ALL_PERMISSIONS), | ||
| (Allow, Everyone, ('create', 'view', 'options')), | ||
| ) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.