Context Navigation

Rules

-              v5
+              v6
 ADMIN has all permissions (=auth.s3_has_permission is always True if the user is ADMIN)
+auth.s3_has_role(ANONYMOUS) is always True (ANONYMOUS role is assigned to all users, even if not logged-in)
+auth.s3_has_role(ANONYMOUS) is always True (ANONYMOUS role is assigned to all users, logged-in or not).
+Logged-in users always have at least the same permissions as anonymous users (because they could gain them anyway by simply logging).
+auth.s3_has_role(ANONYMOUS) is not a suitable means to differentiate between logged-in users and unauthenticated users (because it is always True). Instead, one should use one of the following alternatives:
+- auth.s3_logged_in() (which performs an implicit HTTP BasicAuth if necessary), or
+- auth.user!=None (if no implicit Authentication is desired), or
+- auth.s3_has_role(AUTHENTICATED).
 auth.s3_has_role(AUTHENTICATED) is always True when the user is logged in (AUTHENTICATED role is automatically assigned to the user when logged-in)
+== Override ==
+It is possible to temporarily disable all authorization by setting auth.override=True. This setting applies until the end of the current request cycle.
+This is useful in scripts and tests, but it should ''never'' be done in any permanent functions that could even possibly be exposed to the user.
 == Session Ownership ==