Changes between Version 16 and Version 17 of CookBook/PermissionPolicies

Timestamp:

Sep 19, 2019, 6:46:23 AM (5 years ago)

Author:

Ryan J Ollos

Comment:

Document policy proposed in ​gmessage:trac-users:YcLn-OUkZyk/x5XqjPtbAgAJ.

CookBook/PermissionPolicies

@@ -202 +202 @@
 1. Grant other permissions such as `TICKET_CHGPROP`, `TICKET_APPEND` or `TICKET_MODIFY`. Users can only change tickets they can view, therefore you'll only be granting these permissions for tickets the user reported.
 
+== Restrict Tickets Per Milestone
+
+Milestones access can be restricted per-milestone using [TracFineGrainedPermissions#AuthzPolicy AuthzPolicy].
+This permission policy further allows users to only
+view tickets that are assigned to viewable milestones.
+
+To install and activate the plugin:
+1. Create a [TracDev/PluginDevelopment#Singlefileplugins single file plugin] that implements [wiki:TracDev/PluginDevelopment/ExtensionPoints/trac.perm.IPermissionPolicy IPermissionPolicy]:
+{{{#!python
+# -*- coding: utf-8 -*-
+#
+# Copyright (C) 2019 Edgewall Software
+# All rights reserved.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://trac.edgewall.org/wiki/TracLicense.
+#
+# This software consists of voluntary contributions made by many
+# individuals. For the exact contribution history, see the revision
+# history and logs, available at https://trac.edgewall.org/log/.
+
+from trac.core import *
+from trac.perm import IPermissionPolicy
+from trac.resource import ResourceNotFound
+from trac.ticket.model import Ticket
+
+
+class TicketMilestonePolicy(Component):
+    """Provides a permission for restricting ticket access to
+    viewable milestones.
+    """
+
+    implements(IPermissionPolicy)
+
+    # IPermissionPolicy methods
+
+    def check_permission(self, action, username, resource, perm):
+        if action == 'TICKET_VIEW':
+            if resource is None or \
+                    resource.realm == 'ticket' and \
+                    resource.id is None:
+                return True
+            elif resource.realm == 'ticket' and \
+                    resource.id is not None:
+                try:
+                    ticket = Ticket(self.env, resource.id)
+                except ResourceNotFound:
+                    pass
+                else:
+                    return 'MILESTONE_VIEW' in perm('milestone',
+                                                    ticket['milestone'])
+
+}}}
+1. Edit [[TracIni#trac-permission_policies-option|[trac] permission_policies]] in trac.ini, adding the `TicketMilestonePolicy` and `AuthzPolicy` components ''before'' the default [TracPermissions permission] policy:
+ {{{#!ini
+ [trac]
+ permission_policies = TicketMilestonePolicy, AuthzPolicy, ...
+}}}
+1. Revoke the coarse-grained `MILESTONE_VIEW` and configure [TracFineGrainedPermissions#AuthzPolicy AuthzPolicy] with a policy that grants `MILESTONE_VIEW` per milestone-resource:
+{{{#!ini
+[milestone:milestone1]
+user1 = MILESTONE_VIEW
+
+[milestone:milestone2]
+user2 = MILESTONE_VIEW
+}}}
+1. Grant `TICKET_VIEW` to any users that you wish to view some (but not necessarily all) tickets. The `TicketMilestonePolicy` will deny access to a ticket if the users isn't allowed to view the associated milestone for the ticket, even though the user has coarse-grained `TICKET_VIEW`.
+1. Grant other permissions such as `TICKET_CHGPROP`, `TICKET_APPEND` or `TICKET_MODIFY`. Users can only change tickets they can view, therefore you'll only be granting these permissions for tickets assigned to milestones they can view.
+
 == Restrict Changing Ticket Milestone