Authz policy doesn't apply anonymous permissions to authenticated group

[Ryan J Ollos]

AuthzPolicy claims to follow the normal Trac permission rules​, however the authenticated group does not inherit permissions granted to anonymous.

For example, the following grants MILESTONE_VIEW on milestone1 to anonymous users, but not authenticated users as would be expected:

[milestone:milestone1]
anonymous = MILESTONE_VIEW

authenticated users can view the milestone when the following rule is added:

[milestone:milestone1]
authenticated = MILESTONE_VIEW

The following change seems to fix the issue:

tracopt/perm/authz_policy.py

@@ -234 +234 @@
         # TODO: Handle permission negation in sections. eg. "if in this
         # ticket, remove TICKET_MODIFY"
         if username and username != 'anonymous':
-            valid_users = ['*', 'authenticated', username]
+            valid_users = ['*', 'authenticated', 'anonymous', username]
         else:
             valid_users = ['*', 'anonymous']
         for resource_section in [a for a in self.authz.sections()

[Ryan J Ollos]

Committed in [15660:15663].