Features

  - The ``BFG_DEBUG_AUTHORIZATION`` envvar and the
    ``debug_authorization`` config file value now only imply debugging
    of view-invoked security checks.  Previously, information was
    printed for every call to ``has_permission`` as well, which made
    output confusing.  To debug ``has_permission`` checks and other
    manual permission checks, use the debugger and print statements in
    your own code.

  - Authorization debugging info is now only present in the HTTP
    response body oif ``debug_authorization`` is true.

  - The format of authorization debug messages was improved.

  - A new ``BFG_DEBUG_NOTFOUND`` envvar was added and a symmetric
    ``debug_notfound`` config file value was added.  When either is
    true, and a NotFound response is returned by the BFG router
    (because a view could not be found), debugging information is
    printed to stderr.  When this value is set true, the body of
    HTTPNotFound responses will also contain the same debugging
    information.

  - ``Allowed`` and ``Denied`` responses from the security machinery
    are now specialized into two types: ACL types, and non-ACL types.
    The ACL-related responses are instances of
    ``repoze.bfg.security.ACLAllowed`` and
    ``repoze.bfg.security.ACLDenied``.  The non-ACL-related responses
    are ``repoze.bfg.security.Allowed`` and
    ``repoze.bfg.security.Denied``.  The allowed-type responses
    continue to evaluate equal to things that themselves evaluate
    equal to the ``True`` boolean, while the denied-type responses
    continue to evaluate equal to things that themselves evaluate
    equal to the ``False`` boolean.  The only difference between the
    two types is the information attached to them for debugging
    purposes.

  - Added a new ``BFG_DEBUG_ALL`` envvar and a symmetric ``debug_all``
    config file value.  When either is true, all other debug-related
    flags are set true unconditionally (e.g. ``debug_notfound`` and
    ``debug_authorization``).

  Documentation

  - Added info about debug flag changes.

  - Added a section to the security chapter named "Debugging
    Imperative Authorization Failures" (for e.g. ``has_permssion``).

1 files changed, 16 insertions, 2 deletions

diff --git a/docs/narr/environment.rst b/docs/narr/environment.rst
index 9ace43048..3fe3457c0 100644
--- a/docs/narr/environment.rst
+++ b/docs/narr/environment.rst
@@ -27,11 +27,18 @@ application-specific configuration settings.
 |                             |                          |  See also:                          |
 |                             |                          |  :ref:`reload_templates_section`    |
 +-----------------------------+--------------------------+-------------------------------------+
-| ``BFG_DEBUG_AUTHORIZATION`` |  ``debug_authorization`` |  Print authorization failure/success|
-|                             |                          |  messages to stderr when true       |
+| ``BFG_DEBUG_AUTHORIZATION`` |  ``debug_authorization`` |  Print view authorization failure & |
+|                             |                          |  success info to stderr when true   |
 |                             |                          |  See also:                          |
 |                             |                          |  :ref:`debug_authorization_section` |
 +-----------------------------+--------------------------+-------------------------------------+
+| ``BFG_DEBUG_NOTFOUND``      |  ``debug_notfound``      |  Print view-related NotFound debug  |
+|                             |                          |  messages to stderr when true       |
+|                             |                          |  See also:                          |
+|                             |                          |  :ref:`debug_notfound_section`      |
++-----------------------------+--------------------------+-------------------------------------+
+| ``BFG_DEBUG_ALL``           |  ``debug_all``           |  Turns all debug_* settings on.     |
++-----------------------------+--------------------------+-------------------------------------+
 
 Examples
 --------
@@ -58,3 +65,10 @@ If you started your application this way, your :mod:`repoze.bfg`
 application would behave in the same manner as if you had placed the
 respective settings in the ``[app:main]`` section of your
 application's ``.ini`` file.
+
+If you want to turn all ``debug`` settings (every debug setting that
+starts with ``debug_``). on in one fell swoop, you can use
+``BFG_DEBUG_ALL=1`` as an environment variable setting or you may use
+``debug_all=true`` in the config file.  Note that this does not effect
+settings that do not start with ``debug_*`` such as
+``reload_templates``.