Changes between Initial Version and Version 1 of CookBook/PermissionPolicies

Timestamp:

Nov 20, 2014, 10:13:11 PM (9 years ago)

Author:

Ryan J Ollos

Comment:

Summarized mailing list discussion about RestrictTicketActionsPolicy.

CookBook/PermissionPolicies

@@ +1 @@
+= Custom Permission Policies
+
+Permission policies were introduced on the [TracFineGrainedPermissions#PermissionPolicies TracFineGrainedPermissions] page. Many policies can be implemented with a short plugin. Some custom permission policy examples are given on this page.
+
+== Restrict a Workflow Action to the Ticket Owner
+
+This permissions policy can be used to restrict a workflow action to the ticket's owner.
+
+To install and activate the plugin:
+ 1. Create a [TracDev/PluginDevelopment#Singlefileplugins single file plugin] that implements [wiki:TracDev/PluginDevelopment/ExtensionPoints/trac.perm.IPermissionPolicy IPermissionPolicy]:
+{{{#!python
+# -*- coding: utf-8 -*-
+#
+# Copyright (C) 2014 Edgewall Software
+# All rights reserved.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at http://trac.edgewall.org/wiki/TracLicense.
+#
+# This software consists of voluntary contributions made by many
+# individuals. For the exact contribution history, see the revision
+# history and logs, available at http://trac.edgewall.org/log/.
+
+from trac.core import *
+from trac.perm import IPermissionPolicy, IPermissionRequestor
+from trac.ticket.model import Ticket
+
+
+class RestrictTicketActionsPolicy(Component):
+    """Provides a permission for restricting ticket actions to the
+    ticket owner.
+    """
+
+    implements(IPermissionPolicy, IPermissionRequestor)
+
+    # IPermissionRequestor methods
+
+    def get_permission_actions(self):
+        return ['TICKET_CHANGE_STATE']
+
+    # IPermissionPolicy methods
+
+    def check_permission(self, action, username, resource, perm):
+        if action == 'TICKET_CHANGE_STATE' \
+                and resource is not None \
+                and resource.realm == 'ticket' \
+                and resource.id is not None:
+            ticket = Ticket(self.env, resource.id)
+            return ticket['owner'] == username
+        return None
+}}}
+ 1. Edit the `permission_policies` option in the [TracIni#trac-section [trac]] section of trac.ini, adding the component ''before'' the default [TracPermissions permission] policy:
+ {{{#!ini
+ [trac]
+ permission_policies = RestrictTicketActions, ...
+}}}
+ 1. Require `TICKET_CHANGE_STATE` for one or more workflow actions. For example, the [TracWorkflow#Environmentscreatedwith0.11 default workflow] could be modified so that only the ticket owner can assign tickets:
+ {{{#!diff
+-reassign.permissions = TICKET_MODIFY
++reassign.permissions = TICKET_CHANGE_STATE
+}}}
+ 1. Grant the `TICKET_CHANGE_STATE` permission to your users.
+
+----
+
+See also: [CookBook/Configuration/SignedTickets#Readonlylogic ReadonlySignedTickets policy], [gmessage:trac-users:0XDa9f9fAos/PFsiA32GLJAJ mailing list discussion] about !RestrictTicketActionsPolicy