Changes between Version 60 and Version 61 of BluePrintAuthorization

Timestamp:

06/19/10 22:28:45 (15 years ago)

Author:

Fran Boon

Comment:

Store roles in session

BluePrintAuthorization

@@ -1 +1 @@
 = !BluePrint for Authorization =
+== Roles ==
+Roles are stored in the {{auth_group}}.
+
+These have no links to the groups in {{{pr_group}}}.
+
+We are currently adopting a simplistic 3-tier approach of Person -> Role -> Permissions.
+
+We consider that the 4-tier approach of Person -> Group -> Role -> Permissions is unnecessarily complex for users, despite giving strong flexibility & the potential for advanced admins to move persons into roles in bulk & including future members of the group.
+
+Roles for the currently logged-in user are cached in the session for easy access throughout Model, Controllers & Views.
+In {{{models/00_utils.py}}}:
+{{{
+def shn_sessions():
+    ...
+    roles = []
+    try:
+        user_id = auth.user.id
+        _memberships = db.auth_membership
+        memberships = db(_memberships.user_id == user_id).select(_memberships.group_id, cache=(cache.ram, 60)) # 60s cache
+        for membership in memberships:
+            roles.append(membership.group_id)
+    except:
+        # User not authenticated therefore has no roles other than '0'
+        pass
+    session.s3.roles = roles
+}}}
 == Restrictions ==
 === Module restriction ===