Index: /main/waeup.sirp/trunk/src/waeup/sirp/applicants/__init__.py
===================================================================
--- /main/waeup.sirp/trunk/src/waeup/sirp/applicants/__init__.py	(revision 7158)
+++ /main/waeup.sirp/trunk/src/waeup/sirp/applicants/__init__.py	(revision 7159)
@@ -10,5 +10,5 @@
     ApplicantsRoot, get_applicant_data, application_exists,
     )
-from waeup.sirp.applicants.securitypolicy import (
+from waeup.sirp.applicants.dynamicroles import (
     ApplicantPrincipalRoleManager,)
 
Index: /main/waeup.sirp/trunk/src/waeup/sirp/applicants/dynamicroles.py
===================================================================
--- /main/waeup.sirp/trunk/src/waeup/sirp/applicants/dynamicroles.py	(revision 7159)
+++ /main/waeup.sirp/trunk/src/waeup/sirp/applicants/dynamicroles.py	(revision 7159)
@@ -0,0 +1,53 @@
+##
+## securitypolicy.py
+## Login : <uli@pu.smp.net>
+## Started on  Mon Nov 14 09:37:10 2011 Uli Fouquet
+## $Id$
+## 
+## Copyright (C) 2011 Uli Fouquet & Henrik Bettermann
+## This program is free software; you can redistribute it and/or modify
+## it under the terms of the GNU General Public License as published by
+## the Free Software Foundation; either version 2 of the License, or
+## (at your option) any later version.
+## 
+## This program is distributed in the hope that it will be useful,
+## but WITHOUT ANY WARRANTY; without even the implied warranty of
+## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+## GNU General Public License for more details.
+## 
+## You should have received a copy of the GNU General Public License
+## along with this program; if not, write to the Free Software
+## Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+##
+"""Security policy components for applicants.
+
+Applicants need special security policy treatment, as officers with
+local roles for departments and faculties might have additional
+permissions (local roles on depts/faculties) here.
+"""
+import grok
+from zope.securitypolicy.interfaces import (
+    IPrincipalRoleManager, IPrincipalPermissionManager,)
+from zope.securitypolicy.principalrole import AnnotationPrincipalRoleManager
+from zope.securitypolicy.principalpermission import (
+    AnnotationPrincipalPermissionManager,)
+from zope.securitypolicy.settings import Allow, Deny, Unset
+from waeup.sirp.applicants.interfaces import IApplicant
+from waeup.sirp.students.dynamicroles import StudentPrincipalRoleManager
+
+# All components in here have the same context: Applicant instances
+grok.context(IApplicant)
+
+class ApplicantPrincipalRoleManager(StudentPrincipalRoleManager):
+
+    grok.provides(IPrincipalRoleManager)
+
+    #: The attribute name to lookup for additional roles
+    extra_attrib = 'course1'
+    subcontainer = None
+
+    #: List of role names to look for in `extra_attrib` and parents.
+    external_rolenames = ['waeup.local.ClearanceOfficer',]
+
+    #: Role to add in case one of the above roles was found.
+    additional_rolename = 'waeup.ApplicationsOfficer'
Index: in/waeup.sirp/trunk/src/waeup/sirp/applicants/securitypolicy.py
===================================================================
--- /main/waeup.sirp/trunk/src/waeup/sirp/applicants/securitypolicy.py	(revision 7158)
+++ 	(revision )
@@ -1,53 +1,0 @@
-##
-## securitypolicy.py
-## Login : <uli@pu.smp.net>
-## Started on  Mon Nov 14 09:37:10 2011 Uli Fouquet
-## $Id$
-## 
-## Copyright (C) 2011 Uli Fouquet & Henrik Bettermann
-## This program is free software; you can redistribute it and/or modify
-## it under the terms of the GNU General Public License as published by
-## the Free Software Foundation; either version 2 of the License, or
-## (at your option) any later version.
-## 
-## This program is distributed in the hope that it will be useful,
-## but WITHOUT ANY WARRANTY; without even the implied warranty of
-## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-## GNU General Public License for more details.
-## 
-## You should have received a copy of the GNU General Public License
-## along with this program; if not, write to the Free Software
-## Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
-##
-"""Security policy components for applicants.
-
-Applicants need special security policy treatment, as officers with
-local roles for departments and faculties might have additional
-permissions (local roles on depts/faculties) here.
-"""
-import grok
-from zope.securitypolicy.interfaces import (
-    IPrincipalRoleManager, IPrincipalPermissionManager,)
-from zope.securitypolicy.principalrole import AnnotationPrincipalRoleManager
-from zope.securitypolicy.principalpermission import (
-    AnnotationPrincipalPermissionManager,)
-from zope.securitypolicy.settings import Allow, Deny, Unset
-from waeup.sirp.applicants.interfaces import IApplicant
-from waeup.sirp.students.securitypolicy import StudentPrincipalRoleManager
-
-# All components in here have the same context: Applicant instances
-grok.context(IApplicant)
-
-class ApplicantPrincipalRoleManager(StudentPrincipalRoleManager):
-
-    grok.provides(IPrincipalRoleManager)
-
-    #: The attribute name to lookup for additional roles
-    extra_attrib = 'course1'
-    subcontainer = None
-
-    #: List of role names to look for in `extra_attrib` and parents.
-    external_rolenames = ['waeup.local.ClearanceOfficer',]
-
-    #: Role to add in case one of the above roles was found.
-    additional_rolename = 'waeup.ApplicationsOfficer'
Index: /main/waeup.sirp/trunk/src/waeup/sirp/applicants/tests/test_dynamicroles.py
===================================================================
--- /main/waeup.sirp/trunk/src/waeup/sirp/applicants/tests/test_dynamicroles.py	(revision 7159)
+++ /main/waeup.sirp/trunk/src/waeup/sirp/applicants/tests/test_dynamicroles.py	(revision 7159)
@@ -0,0 +1,86 @@
+## $Id$
+##
+## Copyright (C) 2011 Uli Fouquet & Henrik Bettermann
+## This program is free software; you can redistribute it and/or modify
+## it under the terms of the GNU General Public License as published by
+## the Free Software Foundation; either version 2 of the License, or
+## (at your option) any later version.
+## 
+## This program is distributed in the hope that it will be useful,
+## but WITHOUT ANY WARRANTY; without even the implied warranty of
+## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+## GNU General Public License for more details.
+## 
+## You should have received a copy of the GNU General Public License
+## along with this program; if not, write to the Free Software
+## Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+##
+"""
+Tests for dynamic roles concerning applicants and related.
+"""
+from zope.interface import verify
+from zope.securitypolicy.interfaces import IPrincipalRoleManager
+from zope.securitypolicy.settings import Allow, Deny, Unset
+from zope.securitypolicy.tests.test_securitymap import TestSecurityMap
+from zope.securitypolicy.tests.test_annotationprincipalrolemanager import (
+    Test as APRMTest, Manageable)
+from waeup.sirp.testing import FunctionalLayer
+from waeup.sirp.applicants.tests.test_browser import ApplicantsFullSetup
+from waeup.sirp.applicants import ApplicantPrincipalRoleManager
+
+class ApplicantPrincipalRoleManagerTests(APRMTest):
+    # Make sure our PRM behaves like a regular one for usual cases.
+    # Usual cases are ones, that do not interact with external officers.
+    # See next test case for functional tests including officer perms.
+
+    def _make_roleManager(self, obj=None):
+        # Overriding this method of original testcase we make sure
+        # that really an Applicant PRM is tested.
+        if obj is None:
+            obj = Manageable()
+        return ApplicantPrincipalRoleManager(obj)
+
+class ApplicantPrincipalRoleManagerFunctionalTests(ApplicantsFullSetup):
+
+    layer = FunctionalLayer
+
+    def setUp(self):
+        super(ApplicantPrincipalRoleManagerFunctionalTests, self).setUp()
+        self.applicant.course1 = self.certificate
+        self.officer_role = 'waeup.ApplicationsOfficer'
+        # assign clearance permissions for a virtual officer
+        prm = IPrincipalRoleManager(self.department)
+        prm.assignRoleToPrincipal('waeup.local.ClearanceOfficer', 'alice')
+        return
+
+    def test_iface(self):
+        # make sure out ApplicantPRM really implements required ifaces.
+        obj = ApplicantPrincipalRoleManager(self.applicant)
+        verify.verifyClass(IPrincipalRoleManager,
+                           ApplicantPrincipalRoleManager)
+        verify.verifyObject(IPrincipalRoleManager, obj)
+        return
+
+    def test_get_as_adapter(self):
+        # we can get an ApplicantPRM for Applicants by adapter lookup
+        prm = IPrincipalRoleManager(self.applicant)
+        self.assertTrue(
+            isinstance(prm, ApplicantPrincipalRoleManager))
+        return
+
+    def test_no_officer_set(self):
+        # if the faculty/dept. of the connected cert has no local
+        # roles set, we won't get any additional roles for our
+        # applicant
+        prm = IPrincipalRoleManager(self.applicant)
+        result = prm.getRolesForPrincipal('bob')
+        self.assertEqual(result, [])
+        return
+
+    def test_valid_officer(self):
+        # for an officer that has clearance role on the connected dept
+        # we get the ApplicationsOfficer role on our applicant
+        prm = IPrincipalRoleManager(self.applicant)
+        result = prm.getRolesForPrincipal('alice')
+        self.assertEqual(result, [('waeup.ApplicationsOfficer', Allow)])
+        return
Index: in/waeup.sirp/trunk/src/waeup/sirp/applicants/tests/test_securitypolicy.py
===================================================================
--- /main/waeup.sirp/trunk/src/waeup/sirp/applicants/tests/test_securitypolicy.py	(revision 7158)
+++ 	(revision )
@@ -1,90 +1,0 @@
-##
-## test_securitypolicy.py
-## Login : <uli@pu.smp.net>
-## Started on  Mon Nov 14 09:18:42 2011 Uli Fouquet
-## $Id$
-## 
-## Copyright (C) 2011 Uli Fouquet
-## This program is free software; you can redistribute it and/or modify
-## it under the terms of the GNU General Public License as published by
-## the Free Software Foundation; either version 2 of the License, or
-## (at your option) any later version.
-## 
-## This program is distributed in the hope that it will be useful,
-## but WITHOUT ANY WARRANTY; without even the implied warranty of
-## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-## GNU General Public License for more details.
-## 
-## You should have received a copy of the GNU General Public License
-## along with this program; if not, write to the Free Software
-## Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
-##
-"""
-Tests for local roles concerning applicants and related.
-"""
-from zope.interface import verify
-from zope.securitypolicy.interfaces import IPrincipalRoleManager
-from zope.securitypolicy.settings import Allow, Deny, Unset
-from zope.securitypolicy.tests.test_securitymap import TestSecurityMap
-from zope.securitypolicy.tests.test_annotationprincipalrolemanager import (
-    Test as APRMTest, Manageable)
-from waeup.sirp.testing import FunctionalLayer
-from waeup.sirp.applicants.tests.test_browser import ApplicantsFullSetup
-from waeup.sirp.applicants import ApplicantPrincipalRoleManager
-
-class ApplicantPrincipalRoleManagerTests(APRMTest):
-    # Make sure our PRM behaves like a regular one for usual cases.
-    # Usual cases are ones, that do not interact with external officers.
-    # See next test case for functional tests including officer perms.
-
-    def _make_roleManager(self, obj=None):
-        # Overriding this method of original testcase we make sure
-        # that really an Applicant PRM is tested.
-        if obj is None:
-            obj = Manageable()
-        return ApplicantPrincipalRoleManager(obj)
-
-class ApplicantPrincipalRoleManagerFunctionalTests(ApplicantsFullSetup):
-
-    layer = FunctionalLayer
-
-    def setUp(self):
-        super(ApplicantPrincipalRoleManagerFunctionalTests, self).setUp()
-        self.applicant.course1 = self.certificate
-        self.officer_role = 'waeup.ApplicationsOfficer'
-        # assign clearance permissions for a virtual officer
-        prm = IPrincipalRoleManager(self.department)
-        prm.assignRoleToPrincipal('waeup.local.ClearanceOfficer', 'alice')
-        return
-
-    def test_iface(self):
-        # make sure out ApplicantPRM really implements required ifaces.
-        obj = ApplicantPrincipalRoleManager(self.applicant)
-        verify.verifyClass(IPrincipalRoleManager,
-                           ApplicantPrincipalRoleManager)
-        verify.verifyObject(IPrincipalRoleManager, obj)
-        return
-
-    def test_get_as_adapter(self):
-        # we can get an ApplicantPRM for Applicants by adapter lookup
-        prm = IPrincipalRoleManager(self.applicant)
-        self.assertTrue(
-            isinstance(prm, ApplicantPrincipalRoleManager))
-        return
-
-    def test_no_officer_set(self):
-        # if the faculty/dept. of the connected cert has no local
-        # roles set, we won't get any additional roles for our
-        # applicant
-        prm = IPrincipalRoleManager(self.applicant)
-        result = prm.getRolesForPrincipal('bob')
-        self.assertEqual(result, [])
-        return
-
-    def test_valid_officer(self):
-        # for an officer that has clearance role on the connected dept
-        # we get the ApplicationsOfficer role on our applicant
-        prm = IPrincipalRoleManager(self.applicant)
-        result = prm.getRolesForPrincipal('alice')
-        self.assertEqual(result, [('waeup.ApplicationsOfficer', Allow)])
-        return
Index: /main/waeup.sirp/trunk/src/waeup/sirp/students/__init__.py
===================================================================
--- /main/waeup.sirp/trunk/src/waeup/sirp/students/__init__.py	(revision 7158)
+++ /main/waeup.sirp/trunk/src/waeup/sirp/students/__init__.py	(revision 7159)
@@ -9,5 +9,5 @@
 from waeup.sirp.students.payments import StudentPaymentsContainer
 from waeup.sirp.students.accommodation import StudentAccommodation
-from waeup.sirp.students.securitypolicy import StudentPrincipalRoleManager
+from waeup.sirp.students.dynamicroles import StudentPrincipalRoleManager
 
 
Index: /main/waeup.sirp/trunk/src/waeup/sirp/students/dynamicroles.py
===================================================================
--- /main/waeup.sirp/trunk/src/waeup/sirp/students/dynamicroles.py	(revision 7159)
+++ /main/waeup.sirp/trunk/src/waeup/sirp/students/dynamicroles.py	(revision 7159)
@@ -0,0 +1,113 @@
+## $Id$
+## 
+## Copyright (C) 2011 Uli Fouquet & Henrik Bettermann
+## This program is free software; you can redistribute it and/or modify
+## it under the terms of the GNU General Public License as published by
+## the Free Software Foundation; either version 2 of the License, or
+## (at your option) any later version.
+## 
+## This program is distributed in the hope that it will be useful,
+## but WITHOUT ANY WARRANTY; without even the implied warranty of
+## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+## GNU General Public License for more details.
+## 
+## You should have received a copy of the GNU General Public License
+## along with this program; if not, write to the Free Software
+## Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+##
+"""Security policy components for students.
+
+Students need special security policy treatment, as officers with
+local roles for departments and faculties might have additional
+permissions (local roles on depts/faculties) here.
+"""
+import grok
+from zope.securitypolicy.interfaces import (
+    IPrincipalRoleManager, IPrincipalPermissionManager,)
+from zope.securitypolicy.principalrole import AnnotationPrincipalRoleManager
+from zope.securitypolicy.principalpermission import (
+    AnnotationPrincipalPermissionManager,)
+from zope.securitypolicy.settings import Allow, Deny, Unset
+from waeup.sirp.students.interfaces import IStudent
+
+# All components in here have the same context: Student instances
+grok.context(IStudent)
+
+class StudentPrincipalRoleManager(AnnotationPrincipalRoleManager,
+                                    grok.Adapter):
+    grok.provides(IPrincipalRoleManager)
+
+    #: The attribute name to lookup for additional roles
+    extra_attrib = 'certificate'
+    subcontainer = 'studycourse'
+
+    #: List of role names to look for in `extra_attrib` and parents.
+    external_rolenames = ['waeup.local.ClearanceOfficer',]
+
+    #: Role to add in case one of the above roles was found.
+    additional_rolename = 'waeup.StudentsClearanceOfficer'
+
+    def getRolesForPrincipal(self, principal_id):
+        """Get roles for principal with id `principal_id`.
+
+        Different to the default implementation, this method also
+        takes into account local roles set on any department connected
+        to the context student.
+
+        If the given principal has at least one of the
+        `external_rolenames` roles granted for the external object, it
+        additionally gets `additional_rolename` role for the context
+        student.
+
+        For the additional roles the `extra_attrib` and all its parent
+        objects are looked up, because 'role inheritance' does not
+        work on that basic level of permission handling.
+
+        Some advantages of this approach:
+
+        - we don't have to store extra local roles for clearance
+          officers in ZODB for each student
+
+        - when local roles on a department change, we don't have to
+          update thousands of students; the local role is assigned
+          dynamically.
+
+        Disadvantage:
+
+        - More expensive role lookups when a clearance officer wants
+          to see an student form.
+
+        This implementation is designed to be usable also for other
+        contexts than students. You can inherit from it and set
+        different role names to lookup/set easily via the static class
+        attributes.
+        """
+        apr_manager = AnnotationPrincipalRoleManager(self._context)
+        result = apr_manager.getRolesForPrincipal(principal_id)
+        if result != []:
+            # If there are local roles defined here, no additional
+            # lookup is done.
+            return result
+        # The principal has no local roles yet. Let's lookup the
+        # connected course, dept, etc.
+        if self.subcontainer:
+            obj = getattr(
+                self._context[self.subcontainer], self.extra_attrib, None)
+        else:
+            obj = getattr(self._context, self.extra_attrib, None)
+        # lookup local roles for connected course and all parent
+        # objects. This way we fake 'role inheritance'.
+        while obj is not None:
+            extra_roles = IPrincipalRoleManager(obj).getRolesForPrincipal(
+                principal_id)
+            for role_id, setting in extra_roles:
+                if role_id in self.external_rolenames:
+                    # Found role in external attribute or parent
+                    # thereof. 'Grant' additional role
+                    # permissions (allow, deny or unset) for the
+                    # passed in principal id.
+                    result.append(
+                        (self.additional_rolename, setting))
+                    return result
+            obj = getattr(obj, '__parent__', None)
+        return result
Index: in/waeup.sirp/trunk/src/waeup/sirp/students/securitypolicy.py
===================================================================
--- /main/waeup.sirp/trunk/src/waeup/sirp/students/securitypolicy.py	(revision 7158)
+++ 	(revision )
@@ -1,113 +1,0 @@
-## $Id$
-## 
-## Copyright (C) 2011 Uli Fouquet & Henrik Bettermann
-## This program is free software; you can redistribute it and/or modify
-## it under the terms of the GNU General Public License as published by
-## the Free Software Foundation; either version 2 of the License, or
-## (at your option) any later version.
-## 
-## This program is distributed in the hope that it will be useful,
-## but WITHOUT ANY WARRANTY; without even the implied warranty of
-## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-## GNU General Public License for more details.
-## 
-## You should have received a copy of the GNU General Public License
-## along with this program; if not, write to the Free Software
-## Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
-##
-"""Security policy components for students.
-
-Students need special security policy treatment, as officers with
-local roles for departments and faculties might have additional
-permissions (local roles on depts/faculties) here.
-"""
-import grok
-from zope.securitypolicy.interfaces import (
-    IPrincipalRoleManager, IPrincipalPermissionManager,)
-from zope.securitypolicy.principalrole import AnnotationPrincipalRoleManager
-from zope.securitypolicy.principalpermission import (
-    AnnotationPrincipalPermissionManager,)
-from zope.securitypolicy.settings import Allow, Deny, Unset
-from waeup.sirp.students.interfaces import IStudent
-
-# All components in here have the same context: Student instances
-grok.context(IStudent)
-
-class StudentPrincipalRoleManager(AnnotationPrincipalRoleManager,
-                                    grok.Adapter):
-    grok.provides(IPrincipalRoleManager)
-
-    #: The attribute name to lookup for additional roles
-    extra_attrib = 'certificate'
-    subcontainer = 'studycourse'
-
-    #: List of role names to look for in `extra_attrib` and parents.
-    external_rolenames = ['waeup.local.ClearanceOfficer',]
-
-    #: Role to add in case one of the above roles was found.
-    additional_rolename = 'waeup.StudentsClearanceOfficer'
-
-    def getRolesForPrincipal(self, principal_id):
-        """Get roles for principal with id `principal_id`.
-
-        Different to the default implementation, this method also
-        takes into account local roles set on any department connected
-        to the context student.
-
-        If the given principal has at least one of the
-        `external_rolenames` roles granted for the external object, it
-        additionally gets `additional_rolename` role for the context
-        student.
-
-        For the additional roles the `extra_attrib` and all its parent
-        objects are looked up, because 'role inheritance' does not
-        work on that basic level of permission handling.
-
-        Some advantages of this approach:
-
-        - we don't have to store extra local roles for clearance
-          officers in ZODB for each student
-
-        - when local roles on a department change, we don't have to
-          update thousands of students; the local role is assigned
-          dynamically.
-
-        Disadvantage:
-
-        - More expensive role lookups when a clearance officer wants
-          to see an student form.
-
-        This implementation is designed to be usable also for other
-        contexts than students. You can inherit from it and set
-        different role names to lookup/set easily via the static class
-        attributes.
-        """
-        apr_manager = AnnotationPrincipalRoleManager(self._context)
-        result = apr_manager.getRolesForPrincipal(principal_id)
-        if result != []:
-            # If there are local roles defined here, no additional
-            # lookup is done.
-            return result
-        # The principal has no local roles yet. Let's lookup the
-        # connected course, dept, etc.
-        if self.subcontainer:
-            obj = getattr(
-                self._context[self.subcontainer], self.extra_attrib, None)
-        else:
-            obj = getattr(self._context, self.extra_attrib, None)
-        # lookup local roles for connected course and all parent
-        # objects. This way we fake 'role inheritance'.
-        while obj is not None:
-            extra_roles = IPrincipalRoleManager(obj).getRolesForPrincipal(
-                principal_id)
-            for role_id, setting in extra_roles:
-                if role_id in self.external_rolenames:
-                    # Found role in external attribute or parent
-                    # thereof. 'Grant' additional role
-                    # permissions (allow, deny or unset) for the
-                    # passed in principal id.
-                    result.append(
-                        (self.additional_rolename, setting))
-                    return result
-            obj = getattr(obj, '__parent__', None)
-        return result
Index: /main/waeup.sirp/trunk/src/waeup/sirp/students/tests/test_dynamicroles.py
===================================================================
--- /main/waeup.sirp/trunk/src/waeup/sirp/students/tests/test_dynamicroles.py	(revision 7159)
+++ /main/waeup.sirp/trunk/src/waeup/sirp/students/tests/test_dynamicroles.py	(revision 7159)
@@ -0,0 +1,87 @@
+## $Id$
+## 
+## Copyright (C) 2011 Uli Fouquet & Henrik Bettermann
+## This program is free software; you can redistribute it and/or modify
+## it under the terms of the GNU General Public License as published by
+## the Free Software Foundation; either version 2 of the License, or
+## (at your option) any later version.
+## 
+## This program is distributed in the hope that it will be useful,
+## but WITHOUT ANY WARRANTY; without even the implied warranty of
+## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+## GNU General Public License for more details.
+## 
+## You should have received a copy of the GNU General Public License
+## along with this program; if not, write to the Free Software
+## Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+##
+"""
+Tests for dynamic roles concerning students and related.
+"""
+from zope.interface import verify
+from zope.securitypolicy.interfaces import IPrincipalRoleManager
+from zope.securitypolicy.settings import Allow, Deny, Unset
+from zope.securitypolicy.tests.test_securitymap import TestSecurityMap
+from zope.securitypolicy.tests.test_annotationprincipalrolemanager import (
+    Test as APRMTest, Manageable)
+from waeup.sirp.testing import FunctionalLayer
+from waeup.sirp.students.tests.test_browser import StudentsFullSetup
+from waeup.sirp.students import Student, StudentPrincipalRoleManager
+
+class StudentPrincipalRoleManagerTests(APRMTest):
+    # Make sure our PRM behaves like a regular one for usual cases.
+    # Usual cases are ones, that do not interact with external officers.
+    # See next test case for functional tests including officer perms.
+
+    def _make_roleManager(self, obj=None):
+        # Overriding this method of original testcase we make sure
+        # that really a Student PRM is tested.
+        if obj is None:
+            #obj = Manageable()
+            obj = Student()
+            obj['studycourse'] = Manageable()
+        return StudentPrincipalRoleManager(obj)
+
+class StudentPrincipalRoleManagerFunctionalTests(StudentsFullSetup):
+
+    layer = FunctionalLayer
+
+    def setUp(self):
+        super(StudentPrincipalRoleManagerFunctionalTests, self).setUp()
+        self.officer_role = 'waeup.StudentsClearanceOfficer'
+        # assign clearance permissions for a virtual officer
+        prm = IPrincipalRoleManager(self.app['faculties']['fac1']['dep1'])
+        prm.assignRoleToPrincipal('waeup.local.ClearanceOfficer', 'alice')
+        return
+
+    def test_iface(self):
+        # make sure our StudentPRM really implements required ifaces.
+        obj = StudentPrincipalRoleManager(self.student)
+        verify.verifyClass(IPrincipalRoleManager,
+                           StudentPrincipalRoleManager)
+        verify.verifyObject(IPrincipalRoleManager, obj)
+        return
+
+    def test_get_as_adapter(self):
+        # we can get an StudentPRM for Students by adapter lookup
+        prm = IPrincipalRoleManager(self.student)
+        self.assertTrue(
+            isinstance(prm, StudentPrincipalRoleManager))
+        return
+
+    def test_no_officer_set(self):
+        # if the faculty/dept. of the connected cert has no local
+        # roles set, we won't get any additional roles for our
+        # student
+        prm = IPrincipalRoleManager(self.student)
+        result = prm.getRolesForPrincipal('bob')
+        self.assertEqual(result, [])
+        return
+
+    def test_valid_officer(self):
+        # for an officer that has clearance role on the connected dept
+        # we get the ApplicationsOfficer role on our student
+        prm = IPrincipalRoleManager(self.student)
+        result = prm.getRolesForPrincipal('alice')
+        self.assertEqual(result, [(self.officer_role, Allow)])
+        return
Index: in/waeup.sirp/trunk/src/waeup/sirp/students/tests/test_securitypolicy.py
===================================================================
--- /main/waeup.sirp/trunk/src/waeup/sirp/students/tests/test_securitypolicy.py	(revision 7158)
+++ 	(revision )
@@ -1,87 +1,0 @@
-## $Id$
-## 
-## Copyright (C) 2011 Uli Fouquet & Henrik Bettermann
-## This program is free software; you can redistribute it and/or modify
-## it under the terms of the GNU General Public License as published by
-## the Free Software Foundation; either version 2 of the License, or
-## (at your option) any later version.
-## 
-## This program is distributed in the hope that it will be useful,
-## but WITHOUT ANY WARRANTY; without even the implied warranty of
-## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-## GNU General Public License for more details.
-## 
-## You should have received a copy of the GNU General Public License
-## along with this program; if not, write to the Free Software
-## Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
-##
-"""
-Tests for dynamic roles concerning students and related.
-"""
-from zope.interface import verify
-from zope.securitypolicy.interfaces import IPrincipalRoleManager
-from zope.securitypolicy.settings import Allow, Deny, Unset
-from zope.securitypolicy.tests.test_securitymap import TestSecurityMap
-from zope.securitypolicy.tests.test_annotationprincipalrolemanager import (
-    Test as APRMTest, Manageable)
-from waeup.sirp.testing import FunctionalLayer
-from waeup.sirp.students.tests.test_browser import StudentsFullSetup
-from waeup.sirp.students import Student, StudentPrincipalRoleManager
-
-class StudentPrincipalRoleManagerTests(APRMTest):
-    # Make sure our PRM behaves like a regular one for usual cases.
-    # Usual cases are ones, that do not interact with external officers.
-    # See next test case for functional tests including officer perms.
-
-    def _make_roleManager(self, obj=None):
-        # Overriding this method of original testcase we make sure
-        # that really a Student PRM is tested.
-        if obj is None:
-            #obj = Manageable()
-            obj = Student()
-            obj['studycourse'] = Manageable()
-        return StudentPrincipalRoleManager(obj)
-
-class StudentPrincipalRoleManagerFunctionalTests(StudentsFullSetup):
-
-    layer = FunctionalLayer
-
-    def setUp(self):
-        super(StudentPrincipalRoleManagerFunctionalTests, self).setUp()
-        self.officer_role = 'waeup.StudentsClearanceOfficer'
-        # assign clearance permissions for a virtual officer
-        prm = IPrincipalRoleManager(self.app['faculties']['fac1']['dep1'])
-        prm.assignRoleToPrincipal('waeup.local.ClearanceOfficer', 'alice')
-        return
-
-    def test_iface(self):
-        # make sure our StudentPRM really implements required ifaces.
-        obj = StudentPrincipalRoleManager(self.student)
-        verify.verifyClass(IPrincipalRoleManager,
-                           StudentPrincipalRoleManager)
-        verify.verifyObject(IPrincipalRoleManager, obj)
-        return
-
-    def test_get_as_adapter(self):
-        # we can get an StudentPRM for Students by adapter lookup
-        prm = IPrincipalRoleManager(self.student)
-        self.assertTrue(
-            isinstance(prm, StudentPrincipalRoleManager))
-        return
-
-    def test_no_officer_set(self):
-        # if the faculty/dept. of the connected cert has no local
-        # roles set, we won't get any additional roles for our
-        # student
-        prm = IPrincipalRoleManager(self.student)
-        result = prm.getRolesForPrincipal('bob')
-        self.assertEqual(result, [])
-        return
-
-    def test_valid_officer(self):
-        # for an officer that has clearance role on the connected dept
-        # we get the ApplicationsOfficer role on our student
-        prm = IPrincipalRoleManager(self.student)
-        result = prm.getRolesForPrincipal('alice')
-        self.assertEqual(result, [(self.officer_role, Allow)])
-        return
