source: main/waeup.kofa/trunk/src/waeup/kofa/students/dynamicroles.py @ 8959

Last change on this file since 8959 was 7811, checked in by uli, 13 years ago

Rename all non-locales stuff from sirp to kofa.

  • Property svn:keywords set to Id
File size: 5.4 KB
Line 
1## $Id: dynamicroles.py 7811 2012-03-08 19:00:51Z uli $
2##
3## Copyright (C) 2011 Uli Fouquet & Henrik Bettermann
4## This program is free software; you can redistribute it and/or modify
5## it under the terms of the GNU General Public License as published by
6## the Free Software Foundation; either version 2 of the License, or
7## (at your option) any later version.
8##
9## This program is distributed in the hope that it will be useful,
10## but WITHOUT ANY WARRANTY; without even the implied warranty of
11## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
12## GNU General Public License for more details.
13##
14## You should have received a copy of the GNU General Public License
15## along with this program; if not, write to the Free Software
16## Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
17##
18"""Security policy components for students.
19
20Students need special security policy treatment, as officers with
21local roles for departments and faculties might have additional
22permissions (local roles on depts/faculties) here.
23"""
24import grok
25from zope.securitypolicy.interfaces import IPrincipalRoleManager
26from zope.securitypolicy.principalpermission import (
27    AnnotationPrincipalPermissionManager,)
28from zope.securitypolicy.principalrole import AnnotationPrincipalRoleManager
29from waeup.kofa.students.interfaces import IStudent
30
31# All components in here have the same context: Student instances
32grok.context(IStudent)
33
34class StudentPrincipalRoleManager(AnnotationPrincipalRoleManager,
35                                    grok.Adapter):
36    grok.provides(IPrincipalRoleManager)
37
38    #: The attribute name to lookup for additional roles
39    extra_attrib = 'certificate'
40    subcontainer = 'studycourse'
41
42    # Role name mapping:
43    # role name to look for in `extra_attrib` and parents
44    # to
45    # role to add in case this role was found
46    rolename_mapping = {
47        'waeup.local.ClearanceOfficer':'waeup.StudentsClearanceOfficer',
48        }
49
50    def getRolesForPrincipal(self, principal_id):
51        """Get roles for principal with id `principal_id`.
52
53        Different to the default implementation, this method also
54        takes into account local roles set on any department connected
55        to the context student.
56
57        If the given principal has at least one of the
58        `external_rolenames` roles granted for the external object, it
59        additionally gets `additional_rolename` role for the context
60        student.
61
62        For the additional roles the `extra_attrib` and all its parent
63        objects are looked up, because 'role inheritance' does not
64        work on that basic level of permission handling.
65
66        Some advantages of this approach:
67
68        - we don't have to store extra local roles for clearance
69          officers in ZODB for each student
70
71        - when local roles on a department change, we don't have to
72          update thousands of students; the local role is assigned
73          dynamically.
74
75        Disadvantage:
76
77        - More expensive role lookups when a clearance officer wants
78          to see an student form.
79
80        This implementation is designed to be usable also for other
81        contexts than students. You can inherit from it and set
82        different role names to lookup/set easily via the static class
83        attributes.
84        """
85        apr_manager = AnnotationPrincipalRoleManager(self._context)
86        result = apr_manager.getRolesForPrincipal(principal_id)
87        if result != []:
88            # If there are local roles defined here, no additional
89            # lookup is done.
90            return result
91        # The principal has no local roles yet. Let's lookup the
92        # connected course, dept, etc.
93        if self.subcontainer:
94            obj = getattr(
95                self._context[self.subcontainer], self.extra_attrib, None)
96            current_level = getattr(
97                self._context[self.subcontainer], 'current_level', 0)
98        else:
99            obj = getattr(self._context, self.extra_attrib, None)
100            current_level = 0
101        # Lookup local roles for connected course and all parent
102        # objects. This way we fake 'role inheritance'.
103        while obj is not None:
104            extra_roles = IPrincipalRoleManager(obj).getRolesForPrincipal(
105                principal_id)
106            for role_id, setting in extra_roles:
107                if 'CourseAdviser' in role_id:
108                    # Found a Course Adviser role in external attribute or parent
109                    # thereof. We need a special treatment for Course Advisers.
110                    if str(100*(current_level/100)) in role_id:
111                        # Grant additional role, which allows to validate or reject
112                        # course lists, only if external role corresponds
113                        # with current_level of student.
114                        result.append(
115                            ('waeup.StudentsCourseAdviser', setting))
116                    else:
117                        # Otherwise grant at least view permissions.
118                        result.append(
119                            ('waeup.StudentsOfficer', setting))
120                elif role_id in self.rolename_mapping.keys():
121                    # Grant additional role
122                    # permissions (allow, deny or unset)
123                    # according to the rolename mapping above.
124                    result.append(
125                        (self.rolename_mapping[role_id], setting))
126                    return result
127            obj = getattr(obj, '__parent__', None)
128        return result
Note: See TracBrowser for help on using the repository browser.