Changes between Version 64 and Version 65 of BluePrintAuthorization

Timestamp:

06/19/10 23:39:06 (15 years ago)

Author:

Fran Boon

Comment:

Creator field & be safe with keeping the permissions fields & authorstamp optional

BluePrintAuthorization

@@ -147 +147 @@
 
  * For single records modify {{{shn_has_permission()}}} (called from {{{shn_create()}}}, {{{shn_delete()}}}, {{{shn_read()}}} & {{{shn_update()}}}, but also available for other functions)
+  * Q: Can we merge this with the reading of the record to have a single DAL hit instead of 1 for the permissions check & another for the actual read?
 {{{
 def shn_has_permission(name, tablename, record_id = 0):
@@ -201 +202 @@
         record = None
 
-        if "deleted" in table.fields:
+        _fields = table.fields
+
+        if "deleted" in  _fields:
             # Check if record is deleted
-            record = db(table.id == record_id).select(table.deleted, table.reader_id, table.writer_id, limitby=(0, 1)).first()
+            if "reader_id" in _fields and "created_by" in _fields:
+                record = db(table.id == record_id).select(table.deleted, table.reader_id, table.writer_id, table.created_by, limitby=(0, 1)).first()
+            elif "reader_id" in _fields:
+                record = db(table.id == record_id).select(table.deleted, table.reader_id, table.writer_id, limitby=(0, 1)).first()
+            elif "created_by" in _fields:
+                record = db(table.id == record_id).select(table.deleted, table.created_by, limitby=(0, 1)).first()
+            else:
+                record = db(table.id == record_id).select(table.deleted, limitby=(0, 1)).first()
+
             if record.deleted:
                 authorised = False
@@ -214 +225 @@
 
         # Check the record's auth fields
+        if not "reader_id" in _fields:
+            # No record-level permissions (we assume that reader_id & writer_id fields always present/absent together via use of 'permissions_id')
+            authorised = True
+            return authorised
+
         if not record:
-            record = db(table.id == record_id).select(table.reader_id, table.writer_id, limitby=(0, 1)).first()
+            if "created_by" in _fields:
+                record = db(table.id == record_id).select(table.reader_id, table.writer_id, table.created_by, limitby=(0, 1)).first()
+            else:
+                record = db(table.id == record_id).select(table.reader_id, table.writer_id, limitby=(0, 1)).first()
         if name == "read":
             if not table.reader_id:
@@ -226 +245 @@
                     if restriction in roles:
                         authorised = True
+                    elif restriction == "2" and "created_by" in _fields:
+                        # 'Creator' restriction
+                        if auth.user.id == table.created_by:
+                            authorised = True
                 
         elif name in ["delete", "update"]:
@@ -238 +261 @@
                         # restriction 0 is anonymous
                         authorised = True
+                    elif restriction == "2" and "created_by" in _fields:
+                        # 'Creator' restriction
+                        if auth.user.id == table.created_by:
+                            authorised = True
 
         else: