Changes between Version 51 and Version 52 of BluePrintAuthenticationAccess

Timestamp:

05/11/09 09:39:50 (16 years ago)

Author:

Fran Boon

Comment:

Authorization implementation

BluePrintAuthenticationAccess

@@ -58 +58 @@
  * DeveloperGuidelinesAuthenticationAccess
 
-Anonymous access is currently granted for all Read operations, with Create/Update/Delete requiring a user to be Authenticated: {{{auth.is_logged_in()}}}
- * Web2Py can extend this by protecting resources with {{{auth.has_membership()}}} (table level security which can be separated for C/R/U/D) & {{{auth.has_permission()}}} (record-level security)
-  * Field-level security example: http://groups.google.com/group/web2py/browse_thread/thread/e4b54f08ec6b66f9
- * we should probably support these by adding hooks into the [wiki:BluePrintREST RESTlike controller]
+There are 2 modes for Authorisation right now:[[BR]]
+ * simple: Anonymous access is currently granted for all Read operations, with Create/Update/Delete requiring a user to be Authenticated
+ * full: Uses Web2Py's Role-Based Access Control for both table-level (can be separated for C/R/U/D) & record-level security (http://groups.google.com/group/web2py/browse_thread/thread/e4b54f08ec6b66f9)
+
+NB 'full' mode require each permission to be explicitly granted, so is currently difficult to administer.[[BR]]
+This can be made easier by allowing all basic permissions to start with & then refining down from there:[[BR]]
+ * {{{for table in db.tables: auth.add_permission(group_id,'read',db[table])}}}
+
+Whether a user is authorised or not is defined using {{{has_permission()}}} in {{{models/__db.py}}} & called by the [wiki:BluePrintREST RESTlike controller]
 
 We use {{{sahana_group}}} table for Roles & {{{sahana_membership}}} to show which roles a user has.