Changes between Version 6 and Version 7 of CookBook/PermissionPolicies

Timestamp:

Mar 19, 2017, 12:29:38 AM (7 years ago)

Author:

Ryan J Ollos

Comment:

Add permission policy for a support desk.

CookBook/PermissionPolicies

@@ -121 +121 @@
 * Change `ticket['owner']` to `ticket['reporter']` to grant the permissions to the Ticket Reporter instead.
 
+== Support Desk Policy
+
+This permission policy allows users to view only tickets they have reported.
+
+To install and activate the plugin:
+1. Create a [TracDev/PluginDevelopment#Singlefileplugins single file plugin] that implements [wiki:TracDev/PluginDevelopment/ExtensionPoints/trac.perm.IPermissionPolicy IPermissionPolicy]:
+{{{#!python
+# -*- coding: utf-8 -*-
+#
+# Copyright (C) 2017 Edgewall Software
+# All rights reserved.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at http://trac.edgewall.org/wiki/TracLicense.
+#
+# This software consists of voluntary contributions made by many
+# individuals. For the exact contribution history, see the revision
+# history and logs, available at http://trac.edgewall.org/log/.
+
+from trac.core import *
+from trac.perm import IPermissionPolicy, IPermissionRequestor
+from trac.ticket.model import Ticket
+
+
+class SupportDeskPolicy(Component):
+    """Provides a permission for restricting ticket actions to the
+    ticket owner.
+    """
+
+    implements(IPermissionPolicy, IPermissionRequestor)
+
+    # IPermissionRequestor methods
+
+    def get_permission_actions(self):
+        return ['TICKET_VIEW_REPORTED']
+
+    # IPermissionPolicy methods
+
+    def check_permission(self, action, username, resource, perm):
+        if username != 'anonymous' and \
+                action == 'TICKET_VIEW' and \
+                resource is not None and \
+                resource.realm == 'ticket' and \
+                resource.id is not None and \
+                'TICKET_VIEW_REPORTED' in perm:
+            ticket = Ticket(self.env, resource.id)
+            return ticket['reporter'] == username
+}}}
+1. Revoke `TICKET_VIEW` and grant `TICKET_VIEW_REPORTED` for users that should only view tickets they reported.
+1. Grant other permissions such as `TICKET_CHGPROP`, `TICKET_APPEND` or `TICKET_MODIFY`. Users can only change tickets they can view, therefore you'll only be granting these permissions for tickets the user reported.
+
 ----