Author: tmckay
Date: 2012-03-25 20:24:08 +0000 (Sun, 25 Mar 2012)
New Revision: 5272
Added:
branches/roles_II/cumin/python/cumin/persona.py
Removed:
branches/roles_II/cumin/python/cumin/authorize.py
Modified:
branches/roles_II/cumin/python/cumin/grid/main.py
branches/roles_II/cumin/python/cumin/grid/pool.py
branches/roles_II/cumin/python/cumin/inventory/main.py
branches/roles_II/cumin/python/cumin/inventory/system.py
branches/roles_II/cumin/python/cumin/main.py
branches/roles_II/cumin/python/cumin/messaging/main.py
branches/roles_II/cumin/python/cumin/usergrid/main.py
branches/roles_II/cumin/python/cumin/widgets.py
branches/roles_II/wooly/python/wooly/pages.py
branches/roles_II/wooly/python/wooly/table.py
branches/roles_II/wooly/python/wooly/widgets.py
Log:
Try out an alternative approach to role enforcement with logical modules:
* Uses logical modules to group widgets. Any widget may be part of any module simply by
setting self.cumin_module = "module_name". Widgets that do not have
self.cumin_module set do not
belong to any module and therefore are authorized for all users. Self.cumin_module may be
a list.
* Combines the concepts of persona and authorization into a single solution based around
modules and defined in xml. Persona ("default", "messaging",
"grid") was originally created
to control content and presentation across the whole application. Authorization specifies
what
subset of that content is available from a particular account. A "persona" now
defines which
modules are loaded, which authorization groups are valid for the persona, and which
modules
each group is authorized to interact with. Personas are now also freely definable,
whereas
the original three were hardcoded. Backwards compatibility is maintained.
* The authorization burden should be light, since only a handful of widgets have
self.cumin_module
set to a value (all others will take an early out and the authorize_cb calls will be
trivial).
Since Cumin processes widgets hierarchically, it is only necessary to authorize certain
types of widgets;
in general, these are top level frames and HtmlPages. We also have the flexibility to
scope
functionality arbitrarily anywhere within a hierarchy by associating subwidgets with
particular modules
to control their procesing. The configuration data associated with Wallaby is an example
of this --
certain Inventory table columns have self.cumin_module set to "configuration" so
those columns can be
dropped by turning off the loading of the abstract "configuration" module.
* In addition to the authorize_cb calls during process() and render() for all top level
widgets, a few
more calls are necessary to cover authorization everywhere. Tab sets, page link sets, and
table header/row
widgets (generally, any containers that point to other widgets) must call authorize_cb on
the widgets
they reference to make sure unauthorized widgets are not drawn. Adding the authorize_cb
calls here keep
these indirect render/process calls from being missed.
Deleted: branches/roles_II/cumin/python/cumin/authorize.py
===================================================================
--- branches/roles_II/cumin/python/cumin/authorize.py 2012-03-25 19:57:53 UTC (rev 5271)
+++ branches/roles_II/cumin/python/cumin/authorize.py 2012-03-25 20:24:08 UTC (rev 5272)
@@ -1,145 +0,0 @@
-#!/usr/bin/env python
-import logging
-import os.path
-import re
-
-try:
- import xml.etree.ElementTree as etree
-except ImportError:
- import elementtree.ElementTree as etree
-
-log = logging.getLogger("cumin.authorize")
-
-class CuminAuthorizeMap(object):
-
- def __init__(self):
- log.info("Initializing %s", self.__class__.__name__)
- regs = []
- self.mapping = {}
- self.fallbacks = {}
- self.filepath = None
-
- def __repr__(self):
- return ("%s %s" % ( self.__class__.__name__, self.filepath ))
-
- def parse_accessfile(self, filepath):
- #TODO: handle exceptions during parsing
- acctree = etree.ElementTree().parse(filepath)
- merges = {}
- for gacc in acctree.getiterator('GroupAccess'):
- gkey = gacc.attrib["name"]
- self.mapping[gkey] = []
- self.fallbacks[gkey] = "index.html"
- log.debug("Adding group element %s" , gkey)
- for child in gacc.getchildren():
- if child.tag == "WidgetAccess":
- wa = child.attrib['reg']
- self.mapping[gkey].append(re.compile(wa))
- log.debug("Adding widget access %s for %s", wa, gkey)
- elif child.tag == "SubGroupAccess":
- merges[gkey] = child.attrib["name"]
- elif child.tag == "FallbackPage":
- self.fallbacks[gkey] = child.attrib["name"]
- else:
- log.error("Illegal access tag %s in tree", child.tag)
- #TODO: handle adding properly
- for k in merges.iterkeys():
- self.mapping[k].extend(self.mapping[merges[k]])
-
- def lookup(self,group,widget):
- try:
- for w in self.mapping[group]:
- if w.match(widget):
- return True
- except KeyError:
- return False
- return False
-
- def find_fallback(self, group):
- try:
- return self.fallbacks[group]
- except KeyError:
- return None
-
- def map_is_empty(self):
- return len(self.mapping) == 0
-
-class CuminAuthorizator(object):
- def __init__(self, app, access_path):
- self.app = app
- self.access_path = access_path
- log.info("Initializing %s", self)
- self.accmap = CuminAuthorizeMap()
- modules = app.modules
-
- if access_path is not None:
- log.debug("Access file path is %s", access_path)
- if os.path.isdir(access_path):
- files = [os.path.join(access_path, x) \
- for x in os.listdir(access_path)]
- elif os.path.isfile(access_path):
- files = [access_path]
- else:
- files = []
- log.error("Path '%s' for access files does not exist!"
% access_path)
-
- for accfile in files:
- if os.path.isfile(accfile) and \
- os.path.splitext(accfile)[1] == ".xml":
- try:
- self.accmap.parse_accessfile(accfile)
- except:
- log.error("Access file '%s' does not parse!" %
accfile)
- log.info("MODULES %s", modules)
-
- def is_enforcing(self):
- return self.access_path is not None
-
- def map_is_empty(self):
- return self.accmap.map_is_empty()
-
- def find_fallback(self, web_session):
- # Find a fallback page for the current login session.
- # If the user is part of multiple groups, just pick the
- # first one. There may be a way to make a priority scheme here,
- # but does it really matter?
- try:
- group = web_session.client_session.attributes['login_session'].group
- except KeyError:
- group = "nogroup"
- if type(group) == type([]):
- group = group[0]
- return self.accmap.find_fallback(group)
-
- def contains_valid_group(self, groups):
- for g in groups:
- if g in self.accmap.mapping:
- return True
- return False
-
- def authorize(self, web_session, widget):
- if not self.is_enforcing(): # or not widget.do_authorize:
- # The feature is disabled, everything is allowed
- return True
- try:
- group = web_session.client_session.attributes['login_session'].group
- except KeyError:
- group = "nogroup"
- pass
-
- #TODO: bleee ugly ugly ... -> CuminGenericWidget ? .
- # skip wooly widgets ....
- if widget.my_name.startswith("wooly"):
- return True
- if type(group) == type([]):
- for g in group:
- if self.accmap.lookup(g, widget.my_name):
- log.debug("Allowing %s authorization for %s ",
- widget.my_name, group)
- return True
- else:
- return self.accmap.lookup(group,widget.my_name)
-
- log.debug("Denying %s authorization for %s ", widget.my_name, group)
- return False
-
Modified: branches/roles_II/cumin/python/cumin/grid/main.py
===================================================================
--- branches/roles_II/cumin/python/cumin/grid/main.py 2012-03-25 19:57:53 UTC (rev 5271)
+++ branches/roles_II/cumin/python/cumin/grid/main.py 2012-03-25 20:24:08 UTC (rev 5272)
@@ -26,6 +26,8 @@
super(Module, self).init()
self.frame = PoolFrame(self.app, "grid")
+ self.frame.cumin_module = self.name
+
self.app.main_page.main.grid = self.frame
self.app.main_page.main.add_tab(self.frame)
Modified: branches/roles_II/cumin/python/cumin/grid/pool.py
===================================================================
--- branches/roles_II/cumin/python/cumin/grid/pool.py 2012-03-25 19:57:53 UTC (rev 5271)
+++ branches/roles_II/cumin/python/cumin/grid/pool.py 2012-03-25 20:24:08 UTC (rev 5272)
@@ -78,6 +78,7 @@
self.tag = TagsFrame(app, "tag")
self.add_mode(self.tag)
+ self.tag.cumin_module = "configuration"
dashboard = PoolDashboard(app, "dashboard", self.object)
self.view.add_tab(dashboard)
Modified: branches/roles_II/cumin/python/cumin/inventory/main.py
===================================================================
--- branches/roles_II/cumin/python/cumin/inventory/main.py 2012-03-25 19:57:53 UTC (rev
5271)
+++ branches/roles_II/cumin/python/cumin/inventory/main.py 2012-03-25 20:24:08 UTC (rev
5272)
@@ -16,6 +16,7 @@
self.frame = InventoryFrame(app, "inventory")
self.app = app
+ self.frame.cumin_module = name
def init(self):
self.app.main_page.main.inventory = self.frame
Modified: branches/roles_II/cumin/python/cumin/inventory/system.py
===================================================================
--- branches/roles_II/cumin/python/cumin/inventory/system.py 2012-03-25 19:57:53 UTC (rev
5271)
+++ branches/roles_II/cumin/python/cumin/inventory/system.py 2012-03-25 20:24:08 UTC (rev
5272)
@@ -47,9 +47,11 @@
col = SystemTagsColumn(app, "Tags",
app.model.com_redhat_cumin_grid.Node.Tags, "Tags")
self.add_column(col)
+ col.cumin_module = "configuration"
col = SystemCheckinColumn(app, "Checkin",
app.model.com_redhat_cumin_grid.Node.Checkin, "Checkin")
self.add_column(col)
+ col.cumin_module = "configuration"
self.enable_csv_export()
@@ -74,6 +76,7 @@
configuration = SystemTags(app, "configuration", self.object)
self.view.add_tab(configuration)
+ configuration.cumin_module = "configuration"
def do_process(self, session):
try:
@@ -445,6 +448,7 @@
self.attr = attr
self.title = title
self.format_method = getattr(attr, "unit", None)
+ self.cumin_module = "configuration"
def get_field(self):
field = CheckinField(self.table.adapter, self.name)
Modified: branches/roles_II/cumin/python/cumin/main.py
===================================================================
--- branches/roles_II/cumin/python/cumin/main.py 2012-03-25 19:57:53 UTC (rev 5271)
+++ branches/roles_II/cumin/python/cumin/main.py 2012-03-25 20:24:08 UTC (rev 5272)
@@ -21,7 +21,7 @@
from util import *
from widgets import *
from authenticator import *
-from authorize import *
+from persona import CuminAuthorizator
from sage.catalog import Catalog
from sage.qmf.qmfoperations import QmfOperations
from sage.wallaby.wallabyoperations import WallabyOperations
@@ -76,14 +76,10 @@
self.form_defaults = self.CuminFormDefaults()
- # Persona methods are used to control what pages and/or
- # modules are present
-
+ # Persona value maps to xml definitions handled
+ # in persona.py
self.persona = persona
- self.personas = dict()
- self.personas["default"] = self._init_default_persona
- self.personas["grid"] = self._init_grid_persona
- self.personas["messaging"] = self._init_messaging_persona
+
self._page_links = list()
# we need the modules list to authorize
@@ -121,58 +117,45 @@
self.model.check()
self.database.check()
+
+ def _init_persona(self, modules):
- def _init_grid_persona(self):
- self.main_page = GridMainPage(self, "index.html")
+ # Determine the view based on which modules are enabled
+ if "messaging" in modules:
+ if "grid" in modules:
+ view = MainView(self, "main")
+ else:
+ view = MessagingMainView(self, "main")
+ else:
+ view = GridMainView(self, "main")
+
+ self.main_page = MainPage(self, "index.html", view)
self.add_page(self.main_page, add_to_link_set=True)
self.set_default_page(self.main_page)
-
- self.add_common_pages()
- import account
- import grid
- import inventory
- import usergrid
+ self.form_page = CuminFormPage(self, "form.html")
+ self.add_page(self.form_page)
- account.Module(self, "account")
- grid.Module(self, "grid")
- inventory.Module(self, "inventory")
- usergrid.Module(self, "usergrid")
+ self.add_page(StatFlashPage(self, "chart.json"))
+ self.add_page(FlashFullPage(self, "flashpage.html"))
- def _init_messaging_persona(self):
- self.main_page = MessagingMainPage(self, "index.html")
- self.add_page(self.main_page, add_to_link_set=True)
- self.set_default_page(self.main_page)
+ self.export_page = CuminExportPage(self, "csv")
+ self.add_page(self.export_page)
+
+ self.about_page = AboutPage(self, "about.html")
+ self.add_page(self.about_page)
- self.add_common_pages()
+ self.resource_page.protected = False
- import account
- import messaging
- import inventory
+ # Enable the modules that are associated with the
+ # persona (from persona.py)
+ for name in modules:
+ try:
+ m = __import__(name, globals())
+ m.Module(self, name)
+ except:
+ pass
- account.Module(self, "account")
- messaging.Module(self, "messaging")
- inventory.Module(self, "inventory")
-
- def _init_default_persona(self):
- self.main_page = MainPage(self, "index.html")
- self.add_page(self.main_page, add_to_link_set=True)
- self.set_default_page(self.main_page)
-
- self.add_common_pages()
-
- import account
- import messaging
- import grid
- import inventory
- import usergrid
-
- account.Module(self, "account")
- messaging.Module(self, "messaging")
- grid.Module(self, "grid")
- inventory.Module(self, "inventory")
- usergrid.Module(self, "usergrid")
-
def init(self, schema_version_check=True):
log.info("Initializing %s", self)
@@ -180,12 +163,14 @@
# the application can set a value for self.access_path.
# Alternatively, it can be an argument to the constructor.
self.authorizator = CuminAuthorizator(self, self.access_path)
- if self.access_path is not None and self.authorizator.map_is_empty():
- msg = "Access map does not exit or does not parse '%s'"
- raise Exception(msg % self.access_path)
+ try:
+ self.authorizator.set_persona(self.persona)
+ except:
+ msg = "Persona is not defined '%s'"
+ raise Exception(msg % self.persona)
self.authorize_cb = self.authorizator.authorize
- self.fallback_cb = self.authorizator.find_fallback
+ self.mainpage_cb = self.authorizator.find_mainpage
# Create RPC interfaces for QMF and aviary.
# These service have overlapping functionality,
@@ -240,12 +225,15 @@
self.database.init(schema_version_check)
self.server.init()
- # Create the correct persona
- if self.persona in self.personas:
- self.personas[self.persona]()
- else:
- self._init_default_persona()
+# Find a way to mark the pages, so that index.html is not
+# seeable by user in grid or default mode,
+# and so that usergrid is not visible in messaging mode.
+
+ # This will set up the main view and enable the
+ # modules that are associated with the persona
+ self._init_persona(self.authorizator.get_enabled_modules())
+
for module in self.modules:
module.init()
@@ -254,21 +242,6 @@
super(Cumin, self).init()
- def add_common_pages(self):
- self.form_page = CuminFormPage(self, "form.html")
- self.add_page(self.form_page)
-
- self.add_page(StatFlashPage(self, "chart.json"))
- self.add_page(FlashFullPage(self, "flashpage.html"))
-
- self.export_page = CuminExportPage(self, "csv")
- self.add_page(self.export_page)
-
- self.about_page = AboutPage(self, "about.html")
- self.add_page(self.about_page)
-
- self.resource_page.protected = False
-
def start(self):
log.info("Starting %s", self)
@@ -324,45 +297,10 @@
def init_test(self, test):
pass
-class GridMainPage(CuminPage, ModeSet):
- def __init__(self, app, name):
- super(GridMainPage, self).__init__(app, name)
-
- self.main = GridMainView(app, "main")
- self.add_mode(self.main)
- self.set_default_frame(self.main)
-
- self.page_html_class = "Cumin"
-
- def render_title(self, session):
- return self.get_title(session)
-
- def get_title(self, session):
- return "Administrator"
-
class GridMainView(CuminMainView):
def __init__(self, app, name):
super(GridMainView, self).__init__(app, name)
- #self.overview = GridOverviewFrame(app, "overview")
- #self.add_tab(self.overview)
-
-class MessagingMainPage(CuminPage, ModeSet):
- def __init__(self, app, name):
- super(MessagingMainPage, self).__init__(app, name)
-
- self.main = MessagingMainView(app, "main")
- self.add_mode(self.main)
- self.set_default_frame(self.main)
-
- self.page_html_class = "Cumin"
-
- def render_title(self, session):
- return self.get_title(session)
-
- def get_title(self, session):
- return "Administrator"
-
class MessagingMainView(CuminMainView):
def __init__(self, app, name):
super(MessagingMainView, self).__init__(app, name)
@@ -370,13 +308,21 @@
self.overview = MessagingOverviewFrame(app, "overview")
self.add_tab(self.overview)
-class MainPage(CuminPage, ModeSet):
+class MainView(CuminMainView):
def __init__(self, app, name):
+ super(MainView, self).__init__(app, name)
+
+ self.overview = OverviewFrame(app, "overview")
+ self.add_tab(self.overview)
+
+class MainPage(CuminPage, ModeSet):
+ def __init__(self, app, name, main_view):
super(MainPage, self).__init__(app, name)
- self.main = MainView(app, "main")
+ self.main = main_view
self.add_mode(self.main)
self.set_default_frame(self.main)
+ self.cumin_module = ["messaging", "grid"]
self.page_html_class = "Cumin"
@@ -386,13 +332,6 @@
def get_title(self, session):
return "Administrator"
-class MainView(CuminMainView):
- def __init__(self, app, name):
- super(MainView, self).__init__(app, name)
-
- self.overview = OverviewFrame(app, "overview")
- self.add_tab(self.overview)
-
# XXX Add qmf tab
class OverviewFrame(CuminFrame):
@@ -430,46 +369,12 @@
systems = TopSystemTable(app, "systems")
self.add_child(systems)
+ systems.cumin_module = "inventory"
submissions = TopSubmissionTable(app, "submissions")
self.add_child(submissions)
+ submissions.cumin_module = "grid"
- # XXX
-
- #queues = messaging.queue.TopQueueSet(app, "queues")
- #self.add_child(queues)
-
- #submissions = grid.submission.TopSubmissionSet(app, "submissions")
- #self.add_child(submissions)
-
- #systems = inventory.system.TopSystemSet(app, "systems")
- #self.add_child(systems)
-
-# don't appear to need this....
- # class Heading(CuminHeading):
- # def render_title(self, session):
- # return "Overview"
-
- # def render_icon_href(self, session):
- # return "resource?name=action-36.png"
-
-class GridOverviewFrame(OverviewFrame):
- def __init__(self, app, name):
- super(GridOverviewFrame, self).__init__(app, name)
-
- def get_overview_view(self, app):
- return GridOverviewView(app, "view")
-
-class GridOverviewView(Widget):
- def __init__(self, app, name):
- super(GridOverviewView, self).__init__(app, name)
-
- systems = TopSystemTable(app, "systems")
- self.add_child(systems)
-
- submissions = TopSubmissionTable(app, "submissions")
- self.add_child(submissions)
-
class MessagingOverviewFrame(OverviewFrame):
def __init__(self, app, name):
super(MessagingOverviewFrame, self).__init__(app, name)
Modified: branches/roles_II/cumin/python/cumin/messaging/main.py
===================================================================
--- branches/roles_II/cumin/python/cumin/messaging/main.py 2012-03-25 19:57:53 UTC (rev
5271)
+++ branches/roles_II/cumin/python/cumin/messaging/main.py 2012-03-25 20:24:08 UTC (rev
5272)
@@ -16,6 +16,7 @@
super(Module, self).__init__(app, name)
self.frame = MessagingFrame(self.app, "messaging")
+ self.frame.cumin_module = name
def init(self):
super(Module, self).init()
Added: branches/roles_II/cumin/python/cumin/persona.py
===================================================================
--- branches/roles_II/cumin/python/cumin/persona.py (rev 0)
+++ branches/roles_II/cumin/python/cumin/persona.py 2012-03-25 20:24:08 UTC (rev 5272)
@@ -0,0 +1,165 @@
+#!/usr/bin/env python
+import logging
+import os.path
+import re
+
+try:
+ import xml.etree.ElementTree as etree
+except ImportError:
+ import elementtree.ElementTree as etree
+
+log = logging.getLogger("cumin.authorize")
+
+class CuminGroup(object):
+ def __init__(self, name):
+ self.name = name
+ self.mainpage = "index.html"
+ self.allowed = [] # which modules the group can access
+
+class CuminPersona(object):
+ def __init__(self, name, auth):
+ self.name = name # may be handy to have this here
+
+ self.auth = auth.lower() == "true" # should groups be checked?
+ self.modules = [] # which modules are enabled
+ self.mapping = {} # dictionary of CuminGroup objects
+
+ def find_mainpage(self, group):
+ return self.mapping[group].mainpage
+
+ def lookup(self, group, module):
+ try:
+ if type(module) in (list, tuple):
+ return len(set(module) & \
+ set(self.mapping[group].allowed)) > 0
+ else:
+ return module in self.mapping[group].allowed
+ except KeyError:
+ return False
+
+class CuminPersonaMap(object):
+ def __init__(self):
+ log.info("Initializing %s", self.__class__.__name__)
+ self.personas = {}
+ self.filepath = None
+
+ def __repr__(self):
+ return ("%s %s" % ( self.__class__.__name__, self.filepath ))
+
+ def parse_personafile(self, filepath):
+ #TODO: handle exceptions during parsing
+ acctree = etree.ElementTree().parse(filepath)
+ for prec in acctree.getiterator('Persona'):
+ pkey = prec.attrib["name"]
+ auth = prec.attrib["auth"]
+ persona = CuminPersona(pkey, auth)
+ self.personas[pkey] = persona
+
+ for pchild in prec.getchildren():
+ if pchild.tag == "Module":
+ persona.modules.append(pchild.attrib["name"])
+ elif pchild.tag == "GroupAccess":
+ gkey = pchild.attrib["name"]
+ group = CuminGroup(gkey)
+ persona.mapping[gkey] = group
+ for gchild in pchild.getchildren():
+ if gchild.tag == "MainPage":
+ group.mainpage = gchild.attrib["name"]
+ elif gchild.tag == "ModuleAccess":
+ if gchild.attrib["name"] == "*":
+ group.allowed.extend(persona.modules)
+ else:
+ group.allowed.append(gchild.attrib["name"])
+
+class CuminAuthorizator(object):
+ def __init__(self, app, access_path):
+ self.app = app
+ self.access_path = access_path
+ log.info("Initializing %s", self)
+ self.personas = CuminPersonaMap()
+ self.persona = None
+
+ log.debug("Access file path is %s", access_path)
+ if os.path.isdir(access_path):
+ files = [os.path.join(access_path, x) \
+ for x in os.listdir(access_path)]
+ elif os.path.isfile(access_path):
+ files = [access_path]
+ else:
+ files = []
+ log.error("Path '%s' for access files does not exist!" %
access_path)
+
+ for accfile in files:
+ if os.path.isfile(accfile) and \
+ os.path.splitext(accfile)[1] == ".xml":
+ try:
+ self.personas.parse_personafile(accfile)
+ except:
+ log.error("Access file '%s' does not parse!" %
accfile)
+
+ def set_persona(self, name):
+ self.persona = self.personas.personas[name]
+
+ def is_enforcing(self):
+ return self.persona.auth
+
+ def find_mainpage(self, web_session):
+ # Find a main page for the current login session.
+ # If the user is part of multiple groups, just pick the
+ # first one. There may be a way to make a priority scheme here,
+ # but does it really matter?
+ try:
+ group = web_session.client_session.attributes['login_session'].group
+ except KeyError:
+ group = "nogroup"
+ if type(group) == type([]):
+ group = group[0]
+ return self.persona.find_mainpage(group)
+
+ def get_enabled_modules(self):
+ return self.persona.modules
+
+ def contains_valid_group(self, groups):
+ for g in groups:
+ if g in self.persona.mapping:
+ return True
+ return False
+
+ def authorize(self, web_session, widget):
+ if not hasattr(widget, "cumin_module") or \
+ widget.cumin_module is None:
+ # no module for this widget, we have to allow it
+ return True
+
+ # We can't logically be authorized for a module we haven't even
+ # enabled! This may occur when parts of a display have
+ # associated themselves with a module explicitly.
+ # (like a column in a table that is only valid if a
+ # particular module has been loaded).
+ if type(widget.cumin_module) in (list, tuple):
+ if len(set(widget.cumin_module) & set(self.persona.modules)) == 0:
+ return False
+ elif not widget.cumin_module in self.persona.modules:
+ return False
+
+ if not self.is_enforcing():
+ # Auth checks against group are off.
+ return True
+
+ try:
+ group = web_session.client_session.attributes['login_session'].group
+ except KeyError:
+ group = "nogroup"
+
+ if type(group) == type([]):
+ for g in group:
+ if self.persona.lookup(g, widget.cumin_module):
+ log.debug("Allowing %s authorization for %s ",
+ widget.cumin_module, group)
+ return True
+ else:
+ return self.persona.lookup(group, widget.cumin_module)
+
+ log.debug("Denying %s authorization for %s ", widget.my_name, group)
+ return False
+
Modified: branches/roles_II/cumin/python/cumin/usergrid/main.py
===================================================================
--- branches/roles_II/cumin/python/cumin/usergrid/main.py 2012-03-25 19:57:53 UTC (rev
5271)
+++ branches/roles_II/cumin/python/cumin/usergrid/main.py 2012-03-25 20:24:08 UTC (rev
5272)
@@ -11,3 +11,4 @@
self.app.user_grid_page = MainPage(self.app, "usergrid.html")
self.app.add_page(self.app.user_grid_page, add_to_link_set=True)
+ self.app.user_grid_page.cumin_module = self.name
Modified: branches/roles_II/cumin/python/cumin/widgets.py
===================================================================
--- branches/roles_II/cumin/python/cumin/widgets.py 2012-03-25 19:57:53 UTC (rev 5271)
+++ branches/roles_II/cumin/python/cumin/widgets.py 2012-03-25 20:24:08 UTC (rev 5272)
@@ -1362,7 +1362,7 @@
# of an infinite redirect loop.
cls, value, traceback = sys.exc_info()
if self.app.authorizator.is_enforcing():
- mainpage = self.app.authorizator.find_fallback(session)
+ mainpage = self.app.authorizator.find_mainpage(session)
if not mainpage.startswith("/"):
mainpage = "/" + mainpage
else:
Modified: branches/roles_II/wooly/python/wooly/pages.py
===================================================================
--- branches/roles_II/wooly/python/wooly/pages.py 2012-03-25 19:57:53 UTC (rev 5271)
+++ branches/roles_II/wooly/python/wooly/pages.py 2012-03-25 20:24:08 UTC (rev 5272)
@@ -151,10 +151,10 @@
return sess.marshal()
def redirect_on_not_authorized(self, session):
- fallback_page = self.app.fallback_cb(session)
- if fallback_page in self.app.pages_by_name:
- log.debug("Not authorized, redirecting to %s", fallback_page)
- page = self.app.pages_by_name[fallback_page]
+ mainpage = self.app.mainpage_cb(session)
+ if mainpage in self.app.pages_by_name:
+ log.debug("Not authorized, redirecting to %s", mainpage)
+ page = self.app.pages_by_name[mainpage]
sess = Session(page)
self.redirect.set(session, sess.marshal())
Modified: branches/roles_II/wooly/python/wooly/table.py
===================================================================
--- branches/roles_II/wooly/python/wooly/table.py 2012-03-25 19:57:53 UTC (rev 5271)
+++ branches/roles_II/wooly/python/wooly/table.py 2012-03-25 20:24:08 UTC (rev 5272)
@@ -70,6 +70,7 @@
writer = Writer()
for column in self.get_visible_columns(session):
+
writer.write(column.render(session))
return writer.to_string()
@@ -272,7 +273,8 @@
writer = Writer()
for column in self.table.get_visible_columns(session):
- writer.write(column.header.render(session))
+ if self.app.authorize_cb(session, column):
+ writer.write(column.header.render(session))
return writer.to_string()
@@ -285,7 +287,8 @@
writer = Writer()
for column in self.table.get_visible_columns(session):
- writer.write(column.cell.render(session, record))
+ if self.app.authorize_cb(session, column):
+ writer.write(column.cell.render(session, record))
return writer.to_string()
Modified: branches/roles_II/wooly/python/wooly/widgets.py
===================================================================
--- branches/roles_II/wooly/python/wooly/widgets.py 2012-03-25 19:57:53 UTC (rev 5271)
+++ branches/roles_II/wooly/python/wooly/widgets.py 2012-03-25 20:24:08 UTC (rev 5272)
@@ -58,7 +58,8 @@
writer = Writer()
for tab in self.__tabs:
- self.__tab_tmpl.render(writer, session, tab)
+ if self.app.authorize_cb(session, tab):
+ self.__tab_tmpl.render(writer, session, tab)
return writer.to_string()