source: main/waeup.kofa/branches/0.2/src/waeup/kofa/applicants/dynamicroles.py @ 15185

Last change on this file since 15185 was 10226, checked in by Henrik Bettermann, 11 years ago

Add local and global ApplicationsManager? role. Assign role dynamically.

  • Property svn:keywords set to Id
File size: 4.3 KB
Line 
1## $Id: dynamicroles.py 10226 2013-05-24 17:54:10Z henrik $
2##
3## Copyright (C) 2011 Uli Fouquet & Henrik Bettermann
4## This program is free software; you can redistribute it and/or modify
5## it under the terms of the GNU General Public License as published by
6## the Free Software Foundation; either version 2 of the License, or
7## (at your option) any later version.
8##
9## This program is distributed in the hope that it will be useful,
10## but WITHOUT ANY WARRANTY; without even the implied warranty of
11## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
12## GNU General Public License for more details.
13##
14## You should have received a copy of the GNU General Public License
15## along with this program; if not, write to the Free Software
16## Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
17##
18"""Security policy components for applicants.
19
20Applicants need special security policy treatment, as officers with
21local roles for departments and faculties might have additional
22permissions (local roles on depts/faculties) here.
23"""
24import grok
25from zope.securitypolicy.interfaces import IPrincipalRoleManager
26from zope.securitypolicy.principalrole import AnnotationPrincipalRoleManager
27from waeup.kofa.applicants.interfaces import IApplicant
28
29# All components in here have the same context: Applicant instances
30grok.context(IApplicant)
31
32class ApplicantPrincipalRoleManager(AnnotationPrincipalRoleManager,
33                                    grok.Adapter):
34    grok.provides(IPrincipalRoleManager)
35
36    #: The attribute name to lookup for additional roles
37    extra_attrib = 'course1'
38
39    # Role name mapping:
40    # role name to look for in `extra_attrib` and parents
41    # to
42    # role to add in case this role was found
43    rolename_mapping = {
44        'waeup.local.ApplicationsManager':'waeup.ApplicationsManager',
45        }
46
47    def getRolesForPrincipal(self, principal_id):
48        """Get roles for principal with id `principal_id`.
49
50        Different to the default implementation, this method also
51        takes into account local roles set on any department connected
52        to the context student.
53
54        If the given principal has at least one of the
55        `external_rolenames` roles granted for the external object, it
56        additionally gets `additional_rolename` role for the context
57        student.
58
59        For the additional roles the `extra_attrib` and all its parent
60        objects are looked up, because 'role inheritance' does not
61        work on that basic level of permission handling.
62
63        Some advantages of this approach:
64
65        - we don't have to store extra local roles for clearance
66          officers in ZODB for each student
67
68        - when local roles on a department change, we don't have to
69          update thousands of students; the local role is assigned
70          dynamically.
71
72        Disadvantage:
73
74        - More expensive role lookups when a clearance officer wants
75          to see an student form.
76
77        This implementation is designed to be usable also for other
78        contexts than students. You can inherit from it and set
79        different role names to lookup/set easily via the static class
80        attributes.
81        """
82        apr_manager = AnnotationPrincipalRoleManager(self._context)
83        result = apr_manager.getRolesForPrincipal(principal_id)
84        if result != []:
85            # If there are local roles defined here, no additional
86            # lookup is done.
87            return result
88        # The principal has no local roles yet. Let's lookup the
89        # connected course, dept, etc.
90        obj = getattr(self._context, self.extra_attrib, None)
91        # Lookup local roles for connected course and all parent
92        # objects. This way we fake 'role inheritance'.
93        while obj is not None:
94            extra_roles = IPrincipalRoleManager(obj).getRolesForPrincipal(
95                principal_id)
96            for role_id, setting in extra_roles:
97                if role_id in self.rolename_mapping.keys():
98                    # Grant additional role
99                    # permissions (allow, deny or unset)
100                    # according to the rolename mapping above.
101                    result.append(
102                        (self.rolename_mapping[role_id], setting))
103                    return result
104            obj = getattr(obj, '__parent__', None)
105        return result
Note: See TracBrowser for help on using the repository browser.