Author: tmckay
Date: 2012-03-22 12:10:56 +0000 (Thu, 22 Mar 2012)
New Revision: 5263
Modified:
branches/roles/cumin/instance/etc/cumin.conf
branches/roles/cumin/python/cumin/authorize.py
branches/roles/cumin/python/cumin/main.py
branches/roles/cumin/python/cumin/widgets.py
branches/roles/wooly/python/wooly/__init__.py
branches/roles/wooly/python/wooly/pages.py
Log:
Prototype a solution for redirects when unauthorized widgets are accessed.
Modified: branches/roles/cumin/instance/etc/cumin.conf
===================================================================
--- branches/roles/cumin/instance/etc/cumin.conf 2012-03-21 20:10:53 UTC (rev 5262)
+++ branches/roles/cumin/instance/etc/cumin.conf 2012-03-22 12:10:56 UTC (rev 5263)
@@ -2,7 +2,7 @@
database: dbname=cumin user=cumin host=localhost
#database: dbname=cumin user=cumin host=172.22.88.13 port=5432 password=cumin
#brokers: cumin/rasca@172.22.88.13:5672
-debug: True
+# debug: True
[web]
# host: localhost
Modified: branches/roles/cumin/python/cumin/authorize.py
===================================================================
--- branches/roles/cumin/python/cumin/authorize.py 2012-03-21 20:10:53 UTC (rev 5262)
+++ branches/roles/cumin/python/cumin/authorize.py 2012-03-22 12:10:56 UTC (rev 5263)
@@ -16,6 +16,7 @@
log.info("Initializing %s", self.__class__.__name__)
regs = []
self.mapping = {}
+ self.fallbacks = {}
self.filepath = None
def __repr__(self):
@@ -28,14 +29,17 @@
for gacc in acctree.getiterator('GroupAccess'):
gkey = gacc.attrib["name"]
self.mapping[gkey] = []
+ self.fallbacks[gkey] = "index.html"
log.debug("Adding group element %s" , gkey)
for child in gacc.getchildren():
if child.tag == "WidgetAccess":
wa = child.attrib['reg']
self.mapping[gkey].append(re.compile(wa))
- log.debug("Addig widget access %s for %s", wa, gkey)
+ log.debug("Adding widget access %s for %s", wa, gkey)
elif child.tag == "SubGroupAccess":
merges[gkey] = child.attrib["name"]
+ elif child.tag == "FallbackPage":
+ self.fallbacks[gkey] = child.attrib["name"]
else:
log.error("Illegal access tag %s in tree", child.tag)
#TODO: handle adding properly
@@ -51,6 +55,12 @@
return False
return False
+ def find_fallback(self, group):
+ try:
+ return self.fallbacks[group]
+ except KeyError:
+ return None
+
class CuminAuthorizator(object):
def __init__(self, app):
self.app = app
@@ -68,6 +78,19 @@
log.error("Path for access files does not exist!")
log.info("NODULES %s", modules)
+ def find_fallback(self, web_session):
+ # Find a fallback page for the current login session.
+ # If the user is part of multiple groups, just pick the
+ # first one. There may be a way to make a priority scheme here,
+ # but does it really matter?
+ try:
+ group = web_session.client_session.attributes['login_session'].group
+ except KeyError:
+ group = "nogroup"
+ if type(group) == type([]):
+ group = group[0]
+ return self.accmap.find_fallback(group)
+
def authorize(self,web_session, widget_name):
try:
group = web_session.client_session.attributes['login_session'].group
Modified: branches/roles/cumin/python/cumin/main.py
===================================================================
--- branches/roles/cumin/python/cumin/main.py 2012-03-21 20:10:53 UTC (rev 5262)
+++ branches/roles/cumin/python/cumin/main.py 2012-03-22 12:10:56 UTC (rev 5263)
@@ -62,6 +62,7 @@
self.authorizator = CuminAuthorizator(self)
self.authorize_cb = self.authorizator.authorize
+ self.fallback_cb = self.authorizator.find_fallback
self.tasks = list()
Modified: branches/roles/cumin/python/cumin/widgets.py
===================================================================
--- branches/roles/cumin/python/cumin/widgets.py 2012-03-21 20:10:53 UTC (rev 5262)
+++ branches/roles/cumin/python/cumin/widgets.py 2012-03-22 12:10:56 UTC (rev 5263)
@@ -1313,20 +1313,27 @@
self.error_tmpl = WidgetTemplate(self, "error_html")
self.not_found_tmpl = WidgetTemplate(self, "not_found_html")
- def do_process(self, session):
+ def _redirect_to_login(self, session):
session.cursor = self.app.database.get_read_cursor()
-
if not self.authorized(session):
page = self.app.login_page
-
sess = Session(page)
page.origin.set(sess, session.marshal())
-
self.redirect.set(session, sess.marshal())
+ return True
+ return False
- return
+ def redirect_on_not_authorized(self, session):
+ # If the user is not logged in, then it doesn't have a
+ # a group identity yet. Check to see if we should
+ # redirect to the login page before looking for a
+ # valid page to redirect to based on group
+ if not self._redirect_to_login(session):
+ super(CuminPage, self).redirect_on_not_authorized(session)
- super(CuminPage, self).do_process(session)
+ def do_process(self, session):
+ if not self._redirect_to_login(session):
+ super(CuminPage, self).do_process(session)
def authorized(self, session):
if not self.protected:
Modified: branches/roles/wooly/python/wooly/__init__.py
===================================================================
--- branches/roles/wooly/python/wooly/__init__.py 2012-03-21 20:10:53 UTC (rev 5262)
+++ branches/roles/wooly/python/wooly/__init__.py 2012-03-22 12:10:56 UTC (rev 5263)
@@ -287,26 +287,31 @@
for child in self.children:
child.save_parameters(session, params)
+ def redirect_on_not_authorized(self, session):
+ # Give an opportunity to redirect to a valid page
+ # when a user is not authorized for this widget.
+ pass
+
def process(self, session, *args):
#TODO: cleanup
log.debug("WOOLY PROCESS: %s", self.my_name)
if not self.app.authorize_cb(session, self.my_name):
- return
+ self.redirect_on_not_authorized(session)
+ else:
+ if self.update_enabled:
+ self.page.enable_update(session, self)
- if self.update_enabled:
- self.page.enable_update(session, self)
+ if self.defer_enabled:
+ self.page.enable_defer(session, self)
- if self.defer_enabled:
- self.page.enable_defer(session, self)
+ if self.app.debug:
+ profile = self.page.profile.get(session)
- if self.app.debug:
- profile = self.page.profile.get(session)
+ call = ProcessCall(profile, self, args)
+ call.do(session)
+ else:
+ self.do_process(session, *args)
- call = ProcessCall(profile, self, args)
- call.do(session)
- else:
- self.do_process(session, *args)
-
def do_process(self, session, *args):
for child in self.children:
child.process(session)
Modified: branches/roles/wooly/python/wooly/pages.py
===================================================================
--- branches/roles/wooly/python/wooly/pages.py 2012-03-21 20:10:53 UTC (rev 5262)
+++ branches/roles/wooly/python/wooly/pages.py 2012-03-22 12:10:56 UTC (rev 5263)
@@ -149,6 +149,14 @@
return sess.marshal()
+ def redirect_on_not_authorized(self, session):
+ fallback_page = self.app.fallback_cb(session)
+ if fallback_page in self.app.pages_by_name:
+ log.debug("Not authorized, redirecting to %s", fallback_page)
+ page = self.app.pages_by_name[fallback_page]
+ sess = Session(page)
+ self.redirect.set(session, sess.marshal())
+
def do_process(self, session):
self.update_script.process(session)
self.defer_script.process(session)