Features

--------

- Two new security policies were added:
  RemoteUserInheritingACLSecurityPolicy and
  WhoInheritingACLSecurityPolicy.  These are security policies which
  take into account *all* ACLs defined in the lineage of a context
  rather than stopping at the first ACL found in a lineage.  See the
  "Security" chapter of the API documentation for more information.

- The API and narrative documentation dealing with security was
  changed to introduce the new "inheriting" security policy variants.

- Added glossary entry for "lineage".

Deprecations
------------

- The security policy previously named
  ``RepozeWhoIdentityACLSecurityPolicy`` now has the slightly saner
  name of ``WhoACLSecurityPolicy``.  A deprecation warning is emitted
  when this policy is imported under the "old" name; usually this is
  due to its use in ZCML within your application.  If you're getting
  this deprecation warning, change your ZCML to use the new name,
  e.g. change::

   <utility
     provides="repoze.bfg.interfaces.ISecurityPolicy"
     factory="repoze.bfg.security.RepozeWhoIdentityACLSecurityPolicy"
     />

  To::

   <utility
     provides="repoze.bfg.interfaces.ISecurityPolicy"
     factory="repoze.bfg.security.WhoACLSecurityPolicy"
     />

1 files changed, 6 insertions, 0 deletions

diff --git a/docs/glossary.rst b/docs/glossary.rst
index fc346252d..b55f8395c 100644
--- a/docs/glossary.rst
+++ b/docs/glossary.rst
@@ -332,3 +332,9 @@ Glossary
     is typically the physical root object (the object returned by the
     application root factory) unless :ref:`vhosting_chapter` is in
     use.
+  Lineage
+    An ordered sequence of objects based on a ":term:`location` -aware"
+    context.  The lineage of any given :term:`context` is composed of
+    itself, its parent, its parent's parent, and so on.  The order of
+    the sequence is context-first, then the parent of the context,
+    then its parent's parent, and so on.