Changes between Version 66 and Version 67 of BluePrintAuthorization

Timestamp:

06/20/10 08:15:00 (14 years ago)

Author:

Fran Boon

Comment:

SQLFORM2() to have a single DAL hit

BluePrintAuthorization

@@ -149 +149 @@
 
  * For single records modify {{{shn_has_permission()}}} (called from {{{shn_create()}}}, {{{shn_delete()}}}, {{{shn_read()}}} & {{{shn_update()}}}, but also available for other functions)
-  * Q: Can we merge this with the reading of the record to have a single DAL hit instead of 1 for the permissions check & another for the actual read?
+  * Where possible, we merge this with the reading of the record to have a single DAL hit instead of 1 for the permissions check & another for the actual read by modifying the calling functions appropriately:
+   * {{{modules/sahana.py}}} defines a new SQLFORM2() class which takes a record instead of a record_id
+   * {{{CrudS3}}} modifies {{{Crud.create()}}} to take a record instead of a record_id & calls {{{SQLFORM2()}}}
+   * {{{CrudS3}}} modifies {{{Crud.update()}}} to take a record instead of a record_id & calls {{{SQLFORM2()}}}
 {{{
 def shn_has_permission(name, tablename, record_id = 0):
     """
         S3 framework function to define whether a user can access a record in manner "name"
+        - if checking a table (record_id = 0), then it returns Boolean
+        - if checking a record (record_id > 0), then it returns the record or None
     """
 
@@ -202 +207 @@
     if record_id and authorised:
 
-        record = None
-
         _fields = table.fields
+
+        # We pull back the full record rather than just the fields needed to check permisisons,
+        # so that the caller doesn't need to make a 2nd DAL call to access the data
+        record = db(table.id == record_id).select(limitby=(0, 1)).first()
 
         if "deleted" in  _fields:
             # Check if record is deleted
-            if "reader_id" in _fields and "created_by" in _fields:
-                record = db(table.id == record_id).select(table.deleted, table.reader_id, table.writer_id, table.created_by, limitby=(0, 1)).first()
-            elif "reader_id" in _fields:
-                record = db(table.id == record_id).select(table.deleted, table.reader_id, table.writer_id, limitby=(0, 1)).first()
-            elif "created_by" in _fields:
-                record = db(table.id == record_id).select(table.deleted, table.created_by, limitby=(0, 1)).first()
-            else:
-                record = db(table.id == record_id).select(table.deleted, limitby=(0, 1)).first()
-
             if record.deleted:
-                authorised = False
-                return authorised
-
-        elif 1 in roles:
+                record = None
+                return record
+
+        if 1 in roles:
             # Admin is always authorised to view undeleted data (deleted data accessible through alternate UI)
-            authorised = True
-            return authorised
-
-        # Check the record's auth fields
+            return record
+
         if not "reader_id" in _fields:
             # No record-level permissions (we assume that reader_id & writer_id fields always present/absent together via use of 'permissions_id')
-            authorised = True
-            return authorised
-
-        if not record:
-            if "created_by" in _fields:
-                record = db(table.id == record_id).select(table.reader_id, table.writer_id, table.created_by, limitby=(0, 1)).first()
-            else:
-                record = db(table.id == record_id).select(table.reader_id, table.writer_id, limitby=(0, 1)).first()
+            return record
+
+        # Check the record's auth fields
         if name == "read":
             if not table.reader_id:
-                authorised = True
+                return record
             else:
                 authorised = False
@@ -251 +242 @@
                         if auth.user.id == table.created_by:
                             authorised = True
+                if not authorised: 
+                    record = None
+                return record
                 
         elif name in ["delete", "update"]:
             if not table.writer_id:
-                authorised = True
+                return record
             else:
                 authorised = False
@@ -267 +261 @@
                         if auth.user.id == table.created_by:
                             authorised = True
+                if not authorised: 
+                    record = None
+                return record
 
         else:
@@ -273 +270 @@
             redirect(URL(r=request, f="index"))
 
-return authorised
+if record_id:
+    return None
+else:
+    return authorised
 }}}