- It is no longer permissible to pass a "nested" list of principals to

  ``repoze.bfg.ACLAuthorizer.permits`` (e.g. ['fred', ['larry',
  'bob']).  The principals list must be fully expanded.  This feature
  was never documented, and was never an API, so it's not a backwards
  incompatibility.

2 files changed, 1 insertions, 37 deletions

diff --git a/repoze/bfg/security.py b/repoze/bfg/security.py
index 693f253d0..2b1d3e0de 100644
--- a/repoze/bfg/security.py
+++ b/repoze/bfg/security.py
@@ -75,7 +75,7 @@ class ACLAuthorizer(object):
 
         for ace in acl:
             ace_action, ace_principal, ace_permissions = ace
-            for principal in flatten(principals):
+            for principal in principals:
                 if ace_principal == principal:
                     permissions = flatten(ace_permissions)
                     if permission in permissions:
diff --git a/repoze/bfg/tests/test_security.py b/repoze/bfg/tests/test_security.py
index 4209f8d3d..31b25b774 100644
--- a/repoze/bfg/tests/test_security.py
+++ b/repoze/bfg/tests/test_security.py
@@ -129,42 +129,6 @@ class TestACLAuthorizer(unittest.TestCase):
         self.assertEqual(result, True)
         self.assertEqual(result.ace, allow)
 
-    def test_permits_nested_principals_list_allow(self):
-        context = DummyContext()
-        acl = []
-        from repoze.bfg.security import Allow
-        ace = (Allow, 'larry', 'read')
-        acl = [ace]
-        context.__acl__ = acl
-        authorizer = self._makeOne(context)
-        principals = (['fred', ['jim', ['bob', 'larry']]])
-        result = authorizer.permits('read', *principals)
-        self.assertEqual(result, True)
-        self.assertEqual(result.ace, ace)
-
-    def test_permits_nested_principals_list_deny_explicit(self):
-        context = DummyContext()
-        from repoze.bfg.security import Deny
-        ace = (Deny, 'larry', 'read')
-        acl = [ace]
-        context.__acl__ = acl
-        authorizer = self._makeOne(context)
-        principals = (['fred', ['jim', ['bob', 'larry']]])
-        result = authorizer.permits('read', *principals)
-        self.assertEqual(result, False)
-        self.assertEqual(result.ace, ace)
-
-    def test_permits_nested_principals_list_deny_implicit(self):
-        context = DummyContext()
-        from repoze.bfg.security import Allow
-        ace = (Allow, 'somebodyelse', 'read')
-        acl = [ace]
-        context.__acl__ = acl
-        authorizer = self._makeOne(context)
-        principals = (['fred', ['jim', ['bob', 'larry']]])
-        result = authorizer.permits('read', *principals)
-        self.assertEqual(result, False)
-
     def test_permits_allow_via_location_parent(self):
         context = DummyContext()
         context.__parent__ = None