Changes between Version 28 and Version 29 of BluePrintAuthorization

Timestamp:

06/19/10 16:56:24 (15 years ago)

Author:

Fran Boon

Comment:

--

BluePrintAuthorization

@@ -24 +24 @@
         resources = Storage(
             apikey = {
-                    read : 1,     # This resource is only visible to Administrators
+                    read : "|1|",     # This resource is only visible to Administrators
                 },
             layer_js = {
-                    create : deployment_settings.auth.roles["AdvancedJS"],    # This resource requires the 'AdvancedJS' role to create (or admin)
-                    delete : deployment_settings.auth.roles["AdvancedJS"],    # This resource requires the 'AdvancedJS' role to delete (or admin)
-                    update : deployment_settings.auth.roles["AdvancedJS"],    # This resource requires the 'AdvancedJS' role to update (or admin)
+                    create : "|%d|" % deployment_settings.auth.roles["AdvancedJS"],    # This resource requires the 'AdvancedJS' role to create (or admin)
+                    delete : "|%d|" % deployment_settings.auth.roles["AdvancedJS"],    # This resource requires the 'AdvancedJS' role to delete (or admin)
+                    update : "|%d|" % deployment_settings.auth.roles["AdvancedJS"],    # This resource requires the 'AdvancedJS' role to update (or admin)
                 }
         ),
@@ -128 +128 @@
         roles.append(membership.group_id)
 
-    # Check if table is restricted
     table = db[tablename]
+    # Check if table is restricted (Options 1 & 2)
     if 1 in roles:
         # Admins see all tables
@@ -145 +145 @@
         #else:
         #    authorised = True 
+
         # Option 2
         module, resource = tablename.split("_", 1)
@@ -153 +154 @@
         
         if restriction:
-            if restriction in roles:
-                authorised = True
-            else:
-                authorised = False
+            authorised = False
+            restrictions = re.split("\|", restriction)[1:-1]
+            # Assume we generally have fewer restrictions than roles
+            for restriction in restrictions:
+                if restriction in roles:
+                    authorised = True
+                
         else:
             # No restriction
             authorised = True
-        # Option 3
-        # - not necessary!
-
+
+    # Options 3:
+    #if record_id:
+    # Options 1 & 2:
     if record_id and authorised:
+        record = db(table.id == record_id).select(table.deleted, table.reader_id, table.writer_id, limitby=(0, 1)).first()
         # Check if record is deleted
-        record = db(table.id == record_id).select(table.deleted, table.reader_id, table.writer_id, limitby=(0, 1)).first()
         if record.deleted:
             authorised = False
         elif 1 in roles:
+            # Admin is always authorised to view undeleted data (deleted data accessible through alternate UI)
             authorised = True
         else:
+            # Need to check the record's auth fields
             if name == "read":
                 if not table.reader_id:
@@ -200 +207 @@
 return authorised
 }}}
-   * Disadvantage: Slow
 
   * UI to manage the fields.
@@ -224 +230 @@
     table.field.readable = False
 }}}
-   * NB If doing this then the roles checks inside {{{shn_has_permission()}}} & {{{shn_accessible_fields()}}} should be modified to read this global value
+   * NB If doing this then the roles checks inside {{{shn_has_permission()}}} & {{{shn_accessible_fields()}}} should be modified to read this global value instead of more DAL queries (even cached)!
+
+ * A Developer should be able to restrict access to records to just those within a certain '''GIS Location''' (e.g. Country or Region)
+  * Add a special role 'Geographic' which can be added to {{{writer_id}}} (& maybe {{{reader_id}}} although less use case for this)
+   * Patch {{{shn_has_permission()}}} & maybe {{{shn_accessible_query()}}} to spot this special case &, if no other roles match, then do a lookup in another table (or deployment_settings dict)
+
+ * A Developer should be able to restrict access to records to just those within a certain ''Organisation'''
+  * This could be all members of the Organisation or just the 'Focal Point'
+  * Add a special role 'Organisation' which can be added to {{{writer_id}}} (& maybe {{{reader_id}}} although less use case for this)
+   * Patch {{{shn_has_permission()}}} & maybe {{{shn_accessible_query()}}} to spot this special case &, if no other roles match, then do a lookup in another table (or deployment_settings dict)
+
+ * A Developer should be able to restrict access to records to just those which the person created
+  * Add a special role 'Creator' which can be added to {{{writer_id}}} (& maybe {{{reader_id}}} although less use case for this)
+   * Patch {{{shn_has_permission()}}} & maybe {{{shn_accessible_query()}}} to spot this special case &, if no other roles match, then do a check between {{{auth.user.id}}} & {{{table.created_by}}}
 
 === Specific Examples ===
@@ -245 +264 @@
      * Currently this requires modifying {{{shn_register()}}} in {{{modules/sahana.py}}}
 
- * A Developer should be able to restrict access to records to just those within a certain GIS location (e.g. Country or Region)
-  * Add a special role 'Geographic' which can be added to {{{writer_id}}} (& maybe {{{reader_id}}} although less use case for this)
-   * Patch {{{shn_has_permission()}}} & maybe {{{shn_accessible_query()}}} to spot this special case &, if no other roles match, then do a lookup in another table (or deployment_settings dict)
-
- * A Developer should be able to restrict access to records to just those within a certain organisation (or the Focal Point for the organisation)
-  * Add a special role 'Organisation' which can be added to {{{writer_id}}} (& maybe {{{reader_id}}} although less use case for this)
-   * Patch {{{shn_has_permission()}}} & maybe {{{shn_accessible_query()}}} to spot this special case &, if no other roles match, then do a lookup in another table (or deployment_settings dict)
-
- * A Developer should be able to restrict access to records to just those which the person created
-  * Add a special role 'Creator' which can be added to {{{writer_id}}} (& maybe {{{reader_id}}} although less use case for this)
-   * Patch {{{shn_has_permission()}}} & maybe {{{shn_accessible_query()}}} to spot this special case &, if no other roles match, then do a check between {{{auth.user.id}}} & {{{table.created_by}}}
-
  * If access to a record is restricted then access to messages relating to that record should also be restricted
-  * i.e. block subscription
   * unless routed somewhere visible as well!
-  * onaccept on message routing (tagging) to check if the only tags are on restricted resources...if they are then restrict the message too.
+  * block subscription
+  * onvalidation on message routing (i.e. tagging) to check if the only tags are on restricted resources...if they are then restrict the message too.
+   * onvalidation not onaccept so that only 1 DAL update() is done
 
  * Some tables should be writable by unauthenticated users (writable=|0|)