I really have little idea how ACL do work. I know it's pretty cool and could save me lots of time and pain. But currently i'm a bit lost. All example for pyramid do use traversal. I exclusively use URL Dispatch. I'm not sure to understand how I can build a ressource tree structure.
Here is a sample of code:
class QuestionFactory(object):
def __init__(self, request):
self.__acl__ = default[:]
self.uid = authenticated_userid(request)
self.qid = request.matchdict.get('id')
if self.qid:
self.question = request.db.questions.find_one({'_id': ObjectId(self.qid)})
if str(self.question.get('owner')) == self.uid:
self.__acl__.append((Allow, userid, 'view'))
The thing is that, it works. But I do have to define a new factory for every type of ressource. I'm not certain how I'm supposed to know which ressource I'm trying to access trough URL Dispatch and Factory. I'd see something like that
/accounts/{account} //Owners only but viewable by anyone
/messages/{message} //Owners only
/configs/{config} //Admin only
/pages/{page} //Admins only but viewable by anyone
That said here I'd have such structure
Root -\
+-- account
+-- message
+-- config
+-- page
Each of these factory has it's own special acl. The other thing is that /accounts is the main page. It doesn't have an id or anything. Also /accounts/new is also a special case. It's not an id but the view to create a new item.
I'm using a restful style with GET/PUT/DELETE/POST requirement. I'm not so sure how I'm supposed to match url to a ressource and to the right acl automatically. If I define in my root a special factory like above there is no problems.
edit
I did got it to work with the exception of some things. I finally think I understand what is the purpose of traverse. For example with we have that url: /comments/9494f0eda/new, /comments/{comment}/new
We could have to Node in our ressource tree or even 3 nodes.
The RootFactory will get inspected first, then according to our traversal. It will get the comments attribute of RootFactory, then "comment" of Comment factory and "new" of CommentFactory or of the Object itself
I don't use Factory as dict as in the example of Michael
It looks pretty much like that:
class RessourceFactory(object):
def __init__(self, parent, name):
self.__acl__ = []
self.__name__ = name
self.__parent__ = parent
self.uid = parent.uid
self.locale = parent.locale
self.db = parent.db
self.req = parent.req
This is my base ressource object. On every steps it copies information from the parent to the new child.. I could certainly bubble up my attribute.. context.parent._parent_.uid but that is just not that great.
The reason why I'm not using the dict attribute. I add to make it works with
/comments
For some reasons, it did create my CommentFactory but didn't return it as there wasn't need for a key.
So my root Factory pretty much look like this:
class RootFactory(object):
def __init__(self, request):
self.__acl__ = default[:]
self.req = request
self.db = request.db
self.uid = authenticated_userid(request)
self.locale = request.params.get('locale', 'en')
def __getitem__(self, key):
if key == 'questions':
return QuestionFactory(self, 'questions')
elif key == 'pages':
return PageFactory(self, 'pages')
elif key == 'configs':
return ConfigFactory(self, 'configs')
elif key == 'accounts':
return AccountFactory(self, 'accounts')
return self
if no item is found, RootFactory return itself if not, it return a new Factory. Since I base my code on Michael's code there is a second parameter for Factory constructor. I'm not certain to keep it as a QuestionFactory is well aware to handle "questions" so there is no need to name the factory here. It should already know its name.
class QuestionFactory(RessourceFactory):
def __init__(self, parent, name):
RessourceFactory.__init__(self, parent, name)
self.__acl__.append((Allow, 'g:admin', 'view'))
self.__acl__.append((Allow, 'g:admin', 'edit'))
self.__acl__.append((Allow, 'g:admin', 'create'))
self.__acl__.append((Allow, 'g:admin', 'delete'))
self.__acl__.append((Allow, Everyone, 'create'))
def __getitem__(self, key):
if key=='read':
return self
self.qid = key
self.question = self.db.questions.find_one({'_id': ObjectId(self.qid)})
if str(self.question.get('owner')) == self.uid:
log.info('Allowd user %s' % self.uid)
self.__acl__.append((Allow, self.uid, 'view'))
self.__acl__.append((Allow, self.uid, 'edit'))
self.__acl__.append((Allow, self.uid, 'delete'))
return self
So that is where almost all logic will go. In the init I set acl that will work for /questions in the getitem it will work for /questions/{id}/*
Since I return itself, any getitem past this RessourceFactory will point to itself unless I return a new Factory for some special case. The reason why doing so is that my context isn't just an object in database or an object.
My context handles multiple things like user id, locale and so on... when the acl is done, I have a fresh context object ready to use. It removes most of the logic in the views.
I could probably set events to query locale and uid but it really fits here. If I need anything new, I just have to edit my RootFactory and RessourceFactory to copy them to child factory.
That way if something has to change accross all views, there is no redundancy at all.