Changes between Version 1 and Version 2 of TracDev/PluginDevelopment/ExtensionPoints/trac.perm.IPermissionPolicy

Timestamp:

Jun 3, 2011, 2:07:23 PM (13 years ago)

Author:

Peter Suter

Comment:

added examples

TracDev/PluginDevelopment/ExtensionPoints/trac.perm.IPermissionPolicy

@@ -16 +16 @@
 Only the ''permission_policies'' configured in [wiki:TracIni#trac-section trac.ini] will be used (in that order).
 
+The policy is called for each action on a resource by a user. It can explicitly allow or deny that action, or abstain to defer the check to the next policy in the chain. (Note: It is first also called without a specific resource for a coarse realm permission check. See API Reference for details.)
+
 == Examples ==
 
 See [#DebugPolicy], [#PublicWikiPolicy], [#SecurityTicketsPolicy]
+
+ * [http://thread.gmane.org/gmane.comp.version-control.subversion.trac.devel/393/focus=401 Mailing list post] with an example IPermissionPolicy implementation that blocks access to ticket 666. Here an updated version:
+{{{
+#!python
+from trac.core import *
+from trac.perm import IPermissionPolicy
+
+class Deny666(Component):
+    implements(IPermissionPolicy)
+
+    def check_permission(self, action, username, resource, perm):
+        if resource is not None and resource.realm == 'ticket' and \
+                resource.id == 666:
+            self.log.info("This is the Devil's work")
+            return False
+}}}
+
+ * Another [http://thread.gmane.org/gmane.comp.version-control.subversion.trac.devel/393/focus=402 mailing list post] with an example IPermissionPolicy implementation based on [h:TagsPlugin]. (Adding a tag 'john:view' on a wiki page or ticket would allow the user 'john' to WIKI_VIEW or TICKET_VIEW that resource. Adding a tag 'john:-view' would disallow it.) Here an updated version:
+{{{
+#!python
+from trac.core import *
+from trac.perm import IPermissionPolicy
+
+class TagPolicy(Component):
+    """ Security policy based on tags. """
+    implements(IPermissionPolicy)
+
+     def check_permission(self, action, username, resource, perm):
+        if resource is None: return None
+
+        if action.startswith('WIKI_') or action.startswith('TICKET_'):
+            from tractags.api import TagSystem
+            
+            class FakeRequest(object):
+                def __init__(self, perm):
+                    self.perm = perm
+
+            req = FakeRequest(perm)
+            tags = TagSystem().get_tags(req, resource)
+
+            permission = action.lower().split('_')[1]
+            ptag = ':'.join((username, permission))
+            if ptag in tags:
+                return True
+
+            nptag = ':-'.join((username, permission))
+            if nptag in tags:
+                return False
+}}}
 
 == Available Implementations ==