Changes between Version 7 and Version 8 of BluePrintAuthorization

Timestamp:

06/18/10 17:41:45 (14 years ago)

Author:

Fran Boon

Comment:

--

BluePrintAuthorization

@@ -5 +5 @@
   * Add Controller check as well as menu check.
   * Configure permissions in {{{000_config.py}}} instead of {{{01_modules.py}}}?
+   * Change {{{deployment_settings.modules}}} from a list of strings to a list of dicts
+{{{
+deployment_settings_modules = Storage(
+    name = "gis",
+    name_nice = "Mapping",
+    readable = None,
+    writable = None,
+    description = "Situation Awareness & Geospatial Analysis",
+    module_type = 2,
+    resource_readable = Storage(
+        layer_js = None,
+    )
+    resource_writable = Storage(
+        layer_js = "|6|",        # How to look up this 'magic' number before we've got a database yet? :/
+    )
+)
+}}}
  * A Developer needs to be able to restrict access to a Function
   * Decorator function - although it doesn't support OR (we could easily write our own function to do this, though)
  * A Developer needs to be able to restrict access to a resource
   * REST controller can be blocked via a Decorator
-  * Full security policy can be invoked, but this is painful/untested within S3 recently
+  * Full security policy can be invoked, but this is painful (based on protected by default & granted, whereas we want open by default & restricted)/untested within S3 recently
   * We could check for what other functions can access data? Sync. Hard to maintain though.
-  * Need a new method. Do all accesses go via S3XRC? If not, then needs to be a DAL-level method! Use the Web2Py 'full' for tables but not records?
+  * Need a new method. Do all accesses go via S3XRC? If not, then needs to be a DAL-level method! Use an auth_permission table like Web2Py 'full' for tables? Set within 000_config.py, along with modules?
  * A Developer needs to be able to restrict access to a record
   * Add 2 reusable multiple=True fields to each table which needs this: {{{reader_id}}} & {{{writer_id}}} combined as {{{permissions_id}}}
@@ -20 +37 @@
    * Option 1: Do the check alongside deleted as part of a big JOIN
 {{{
-def shn_accessible_query(user, table):
+def shn_accessible_query(table):
     """ Modified version of current function from models/01_crud.py """
 
     deleted = (table.deleted == None)
 
-    _memberships = db.auth_membership
-    memberships = db(_memberships.user_id == user).select(_memberships.group_id)
+    try:
+        user_id = auth.user.id
+        _memberships = db.auth_membership
+        memberships = db(_memberships.user_id == user_id).select(_memberships.group_id)
+    except:
+        memberships = None
+    
     roles = []
     for membership in memberships:
@@ -45 +67 @@
 def user_function:
     table = db[tablename]
-    available = shn_accessible_query(user, table)
+    available = shn_accessible_query(table)
     query = available & query
 }}}
@@ -70 +92 @@
   * unless routed somewhere visible as well!
   * onaccept on message routing (tagging) to check if the only tags are on restricted resources...if they are then restrict the message too.
-
+ * Some tables should be writable by unauthenticated users (writable=|0|)
+  * Need special handling for this in shn_create/shn_update?
 ----
 BluePrintAuthenticationAccess