- Add authenticated_userid and effective_principals API to security

    policy.

1 files changed, 20 insertions, 8 deletions

diff --git a/repoze/bfg/security.py b/repoze/bfg/security.py
index eb260fea8..7e0ba6ffe 100644
--- a/repoze/bfg/security.py
+++ b/repoze/bfg/security.py
@@ -89,22 +89,34 @@ class RemoteUserACLSecurityPolicy(object):
     def permits(self, context, request, permission):
         """ Return ``Allowed`` if the policy permits access,
         ``Denied`` if not."""
-        userid = request.environ.get('REMOTE_USER', None)
-        effective_principals = [Everyone]
-
-        if userid is not None:
-            effective_principals.append(Authenticated)
-            effective_principals.append(userid)
-
+        principals = self.effective_principals(request)
         for location in LocationIterator(context):
             authorizer = self.authorizer_factory(location, self.logger)
             try:
-                return authorizer.permits(permission, *effective_principals)
+                return authorizer.permits(permission, *principals)
             except NoAuthorizationInformation:
                 continue
 
         return False
 
+    def authenticated_userid(self, request):
+        """ Return the id of the currently authenticated user or
+        None if the user is not authenticated """
+        return request.environ.get('REMOTE_USER', None)
+
+    def effective_principals(self, request):
+        """ Return the list of 'effective' principals for the request.
+        This will include the userid of the currently authenticated
+        user if a user is currently authenticated. """
+        userid = self.authenticated_userid(request)
+        effective_principals = [Everyone]
+
+        if userid is not None:
+            effective_principals.append(Authenticated)
+            effective_principals.append(userid)
+        return effective_principals
+
+
 class PermitsResult:
     def __init__(self, ace, acl, permission, principals, context):
         self.acl = acl