Changes between Version 19 and Version 20 of BluePrintAuthorization

Timestamp:

06/19/10 14:43:31 (14 years ago)

Author:

Fran Boon

Comment:

shn_has_permission()

BluePrintAuthorization

@@ -22 +22 @@
         writable = None,    # All Authenticated users can edit resources which aren't specially protected
         module_type = 2,    # Used to locate the module in the default menu
-        resource_readable = Storage(
-            apikey = 1,     # This resource is only visible to Administrators
+        resources = Storage(
+            apikey = {
+                    read : 1,     # This resource is only visible to Administrators
+                },
+            layer_js = {
+                    create : deployment_settings.auth.roles["AdvancedJS"],    # This resource requires the 'AdvancedJS' role to create (or admin)
+                    delete : deployment_settings.auth.roles["AdvancedJS"],    # This resource requires the 'AdvancedJS' role to delete (or admin)
+                    update : deployment_settings.auth.roles["AdvancedJS"],    # This resource requires the 'AdvancedJS' role to update (or admin)
+                }
         ),
-        resource_writable = Storage(
-            layer_js = deployment_settings.auth.roles["AdvancedJS"],    # This resource requires the 'AdvancedJS' role to edit (or admin)
-        )
     ),
     ...
@@ -43 +47 @@
   * Need a new method: open by default & restricted manually
    * Needs to be a DAL-level method since not all accesses go via S3XRC.
-   * Use an {{{auth_permission}}} table similar to Web2Py 'full' just for tables?
-   * Set within {{{000_config.py}}}, along with module permissions? (see above example)
+   * Option1: Use an {{{auth_permission}}} table similar to Web2Py 'full' just for tables?
+   * Option2: Set within {{{000_config.py}}}, along with module permissions? (see above example)
+    * Means less DAL calls
+   * Option3: Have an onaccept which auto-populates the reader_id/writer_id fields in records?
+    * Means that no additional auth check at table-level needed
+   * Once new solution in-place:
+    * remove security_policy from {{{s3_setting}}} table & session ({{{00_utils.py}}})
+    * modify {{{shn_action_buttons()}}} in {{{00_utils.py}}}
 
  * A Developer needs to be able to restrict access to a record
@@ -55 +65 @@
 {{{
 def shn_accessible_query(table):
-    """ Modified version of current function from models/01_crud.py """
+    """
+    Return a filter of those records which are readable by the currently logged-in user
+    - deleted records are filtered
+    - records to which they don't have permissions are filtered
+    (Modified version of current function from models/01_crud.py)
+    """
 
     deleted = (table.deleted == None)
@@ -82 +97 @@
     return query
 
-def user_function:
+def user_function():
+    ...
     table = db[tablename]
     available = shn_accessible_query(table)
     query = available & query
+    ...
 }}}
     * Advantages:
@@ -93 +110 @@
     * Advantage: Might have better performance than complex DB string?
     * Disadvantage: More records pulled from DB than necessary
-  * writer_id checked with a new API function (called from shn_update(), but also available for other functions)
+  * writer_id checked within a modified {{{shn_has_permission()}}} (called from shn_update(), etc, but also available for other functions)
+{{{
+def shn_has_permission(name, tablename, record_id = 0):
+    """
+        S3 framework function to define whether a user can access a record in manner "name"
+    """
+
+    try:
+        user_id = auth.user.id
+        _memberships = db.auth_membership
+        memberships = db(_memberships.user_id == user_id).select(_memberships.group_id)
+    except:
+        memberships = None
+    
+    roles = []
+    for membership in memberships:
+        roles.append(membership.group_id)
+
+    # Check if table is restricted
+    table = db[tablename]
+    if 1 in roles:
+        # Admins see all tables
+        authorised = True
+    else:   
+        # Option 1
+        #restriction = db(table[name].like('%|%d|%' % role)).select()
+        # Option 2
+        module, resource = tablename.split("_", 1)
+        try:
+            restriction = deployment_settings_modules["module"].resources["resource"]["name"]
+        except:
+            restriction = None
+        
+        if restriction:
+            if restriction in roles:
+                authorised = True
+            else:
+                authorised = False
+        else:
+            # No restriction
+            authorised = True
+        # Option 3
+        # - not necessary!
+
+    if record_id and authorised:
+        # Check if record is deleted
+        record = db(table.id == record_id).select(table.deleted, table.reader_id, table.writer_id, limitby=(0, 1)).first()
+        if record.deleted:
+            authorised = False
+        elif 1 in roles:
+            authorised = True
+        else:
+            if name == "read":
+                if not table.reader_id:
+                    authorised = True
+                else:
+                    authorised = False
+                    restrictions = re.split("\|", table.reader_id)[1:-1]
+                    # Assume we generally have fewer restrictions than roles
+                    for restriction in restrictions:
+                        if restriction in roles:
+                            authorised = True
+                    
+            elif name in ["delete", "update"]:
+                if not table.writer_id:
+                    authorised = True
+                else:
+                    authorised = False
+                    restrictions = re.split("\|", table.writer_id)[1:-1]
+                    # Assume we generally have fewer restrictions than roles
+                    for restriction in restrictions:
+                        if restriction in roles:
+                            authorised = True
+
+            else:
+                # Something went wrong
+                session.error = str(T("Invalid mode sent to")) + " shn_has_permission(): " + name
+                redirect(URL(r=request, f="index"))
+
+return authorised
+}}}
+   * Disadvantage: Slow
   * UI to manage the fields.
    * We expect relatively few groups per instance, so can use the checkboxes widget?