Add a plug point for a security policy.

1 files changed, 11 insertions, 8 deletions

diff --git a/repoze/bfg/router.py b/repoze/bfg/router.py
index 626080bdc..fde50b528 100644
--- a/repoze/bfg/router.py
+++ b/repoze/bfg/router.py
@@ -8,18 +8,21 @@ from repoze.bfg.interfaces import IWSGIApplicationFactory
 from repoze.bfg.interfaces import IWebObRequest
 
 class Router:
-    def __init__(self, root_policy, traversal_policy):
+    def __init__(self, root_policy, traversal_policy, security_policy):
         self.root_policy = root_policy
         self.traversal_policy = traversal_policy
+        self.security_policy = security_policy
 
     def __call__(self, environ, start_response):
         root = self.root_policy(environ)
-        context, name, subpath = self.traversal_policy(root, environ)
-        environ['repoze.bfg.subpath'] = subpath
-        request = Request(environ)
-        directlyProvides(request, IWebObRequest)
-        app = queryMultiAdapter((context, request),
-                                IWSGIApplicationFactory, name=name)
+        context, name, subpath = self.traversal_policy(environ, root)
+        app = self.security_policy(environ, context, name)
         if app is None:
-            app = HTTPNotFound(request.url)
+            environ['repoze.bfg.subpath'] = subpath
+            request = Request(environ)
+            directlyProvides(request, IWebObRequest)
+            app = queryMultiAdapter((context, request),
+                                    IWSGIApplicationFactory, name=name)
+            if app is None:
+                app = HTTPNotFound(request.url)
         return app(environ, start_response)