diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/pyramid/authentication.py | 16 | ||||
| -rw-r--r-- | src/pyramid/authorization.py | 84 | ||||
| -rw-r--r-- | src/pyramid/config/routes.py | 2 | ||||
| -rw-r--r-- | src/pyramid/config/views.py | 2 | ||||
| -rw-r--r-- | src/pyramid/httpexceptions.py | 11 | ||||
| -rw-r--r-- | src/pyramid/interfaces.py | 4 | ||||
| -rw-r--r-- | src/pyramid/security.py | 183 |
7 files changed, 184 insertions, 118 deletions
diff --git a/src/pyramid/authentication.py b/src/pyramid/authentication.py index 2d194e309..3bfab78ee 100644 --- a/src/pyramid/authentication.py +++ b/src/pyramid/authentication.py @@ -10,8 +10,8 @@ import warnings from webob.cookies import CookieProfile from zope.interface import implementer +from pyramid.authorization import Authenticated, Everyone from pyramid.interfaces import IAuthenticationPolicy, IDebugLogger -from pyramid.security import Authenticated, Everyone from pyramid.util import ( SimpleSerializer, ascii_, @@ -98,7 +98,7 @@ class CallbackAuthenticationPolicy(object): """ A list of effective principals derived from request. This will return a list of principals including, at least, - :data:`pyramid.security.Everyone`. If there is no authenticated + :data:`pyramid.authorization.Everyone`. If there is no authenticated userid, or the ``callback`` returns ``None``, this will be the only principal: @@ -108,8 +108,9 @@ class CallbackAuthenticationPolicy(object): If the ``callback`` does not return ``None`` and an authenticated userid is found, then the principals will include - :data:`pyramid.security.Authenticated`, the ``authenticated_userid`` - and the list of principals returned by the ``callback``: + :data:`pyramid.authorization.Authenticated`, the + ``authenticated_userid`` and the list of principals returned by the + ``callback``: .. code-block:: python @@ -274,13 +275,14 @@ class RepozeWho1AuthenticationPolicy(CallbackAuthenticationPolicy): """ A list of effective principals derived from the identity. This will return a list of principals including, at least, - :data:`pyramid.security.Everyone`. If there is no identity, or + :data:`pyramid.authorization.Everyone`. If there is no identity, or the ``callback`` returns ``None``, this will be the only principal. If the ``callback`` does not return ``None`` and an identity is found, then the principals will include - :data:`pyramid.security.Authenticated`, the ``authenticated_userid`` - and the list of principals returned by the ``callback``. + :data:`pyramid.authorization.Authenticated`, the + ``authenticated_userid`` and the list of principals returned by the + ``callback``. """ effective_principals = [Everyone] diff --git a/src/pyramid/authorization.py b/src/pyramid/authorization.py index b7c5834f9..42171088f 100644 --- a/src/pyramid/authorization.py +++ b/src/pyramid/authorization.py @@ -1,10 +1,50 @@ +import warnings from zope.interface import implementer from pyramid.interfaces import IAuthorizationPolicy from pyramid.location import lineage -from pyramid.security import ACLAllowed, ACLDenied, Allow, Deny, Everyone from pyramid.util import is_nonstr_iter +# the simplest way to deprecate the attributes in security.py is to +# leave them defined there and then import/re-export them here because +# otherwise there is a difficult-to-resolve circular import between +# the two modules - in the future when we remove the deprecated code and +# move it to live here, we will be able to remove this +with warnings.catch_warnings(): + warnings.simplefilter('ignore') + from pyramid.security import ( + ACLAllowed as _ACLAllowed, + ACLDenied as _ACLDenied, + AllPermissionsList as _AllPermissionsList, + Allow, + Authenticated, + Deny, + Everyone, + ) + + +Everyone = Everyone # api +Authenticated = Authenticated # api +Allow = Allow # api +Deny = Deny # api + + +# subclasses to fix __module__ +class AllPermissionsList(_AllPermissionsList): + pass + + +class ACLAllowed(_ACLAllowed): + pass + + +class ACLDenied(_ACLDenied): + pass + + +ALL_PERMISSIONS = AllPermissionsList() # api +DENY_ALL = (Deny, Everyone, ALL_PERMISSIONS) # api + @implementer(IAuthorizationPolicy) class ACLAuthorizationPolicy(object): @@ -29,9 +69,9 @@ class ACLAuthorizationPolicy(object): def permits(self, context, principals, permission): """ Return an instance of - :class:`pyramid.security.ACLAllowed` instance if the policy + :class:`pyramid.authorization.ACLAllowed` instance if the policy permits access, return an instance of - :class:`pyramid.security.ACLDenied` if not.""" + :class:`pyramid.authorization.ACLDenied` if not.""" return self.helper.permits(context, principals, permission) def principals_allowed_by_permission(self, context, permission): @@ -54,9 +94,9 @@ class ACLHelper: """ def permits(self, context, principals, permission): - """ Return an instance of :class:`pyramid.security.ACLAllowed` if the - ACL allows access a user with the given principals, return an instance - of :class:`pyramid.security.ACLDenied` if not. + """ Return an instance of :class:`pyramid.authorization.ACLAllowed` if + the ACL allows access a user with the given principals, return an + instance of :class:`pyramid.authorization.ACLDenied` if not. When checking if principals are allowed, the security policy consults the ``context`` for an ACL first. If no ACL exists on the context, or @@ -65,18 +105,18 @@ class ACLHelper: so on, until the lineage is exhausted or we determine that the policy permits or denies. - During this processing, if any :data:`pyramid.security.Deny` + During this processing, if any :data:`pyramid.authorization.Deny` ACE is found matching any principal in ``principals``, stop processing by returning an - :class:`pyramid.security.ACLDenied` instance (equals + :class:`pyramid.authorization.ACLDenied` instance (equals ``False``) immediately. If any - :data:`pyramid.security.Allow` ACE is found matching any + :data:`pyramid.authorization.Allow` ACE is found matching any principal, stop processing by returning an - :class:`pyramid.security.ACLAllowed` instance (equals + :class:`pyramid.authorization.ACLAllowed` instance (equals ``True``) immediately. If we exhaust the context's :term:`lineage`, and no ACE has explicitly permitted or denied access, return an instance of - :class:`pyramid.security.ACLDenied` (equals ``False``). + :class:`pyramid.authorization.ACLDenied` (equals ``False``). """ acl = '<No ACL found on any object in resource lineage>' @@ -120,17 +160,17 @@ class ACLHelper: of principals that are explicitly granted the ``permission`` in the provided ``context``. We do this by walking 'up' the object graph *from the root* to the context. During this walking process, if we - find an explicit :data:`pyramid.security.Allow` ACE for a principal - that matches the ``permission``, the principal is included in the allow - list. However, if later in the walking process that principal is - mentioned in any :data:`pyramid.security.Deny` ACE for the permission, - the principal is removed from the allow list. If a - :data:`pyramid.security.Deny` to the principal - :data:`pyramid.security.Everyone` is encountered during the walking - process that matches the ``permission``, the allow list is cleared for - all principals encountered in previous ACLs. The walking process ends - after we've processed the any ACL directly attached to ``context``; a - set of principals is returned. + find an explicit :data:`pyramid.authorization.Allow` ACE for a + principal that matches the ``permission``, the principal is included in + the allow list. However, if later in the walking process that + principal is mentioned in any :data:`pyramid.authorization.Deny` ACE + for the permission, the principal is removed from the allow list. If + a :data:`pyramid.authorization.Deny` to the principal + :data:`pyramid.authorization.Everyone` is encountered during the + walking process that matches the ``permission``, the allow list is + cleared for all principals encountered in previous ACLs. The walking + process ends after we've processed the any ACL directly attached to + ``context``; a set of principals is returned. """ allowed = set() diff --git a/src/pyramid/config/routes.py b/src/pyramid/config/routes.py index 78e708d1e..6e416c384 100644 --- a/src/pyramid/config/routes.py +++ b/src/pyramid/config/routes.py @@ -275,7 +275,7 @@ class RoutesConfiguratorMixin(object): indicates that every principal named in the argument list is present in the current request, this predicate will return True; otherwise it will return False. For example: - ``effective_principals=pyramid.security.Authenticated`` or + ``effective_principals=pyramid.authorization.Authenticated`` or ``effective_principals=('fred', 'group:admins')``. .. versionadded:: 1.4a4 diff --git a/src/pyramid/config/views.py b/src/pyramid/config/views.py index c4fb54dd8..e1026fb07 100644 --- a/src/pyramid/config/views.py +++ b/src/pyramid/config/views.py @@ -718,7 +718,7 @@ class ViewsConfiguratorMixin(object): indicates that every principal named in the argument list is present in the current request, this predicate will return True; otherwise it will return False. For example: - ``effective_principals=pyramid.security.Authenticated`` or + ``effective_principals=pyramid.authorization.Authenticated`` or ``effective_principals=('fred', 'group:admins')``. .. versionadded:: 1.4a4 diff --git a/src/pyramid/httpexceptions.py b/src/pyramid/httpexceptions.py index 51c2e90a0..dcf61b9e5 100644 --- a/src/pyramid/httpexceptions.py +++ b/src/pyramid/httpexceptions.py @@ -755,11 +755,12 @@ class HTTPForbidden(HTTPClientError): argument, ``detail``, should be a string. The value of this string will be used as the ``message`` attribute of the exception object. The second special keyword argument, ``result`` is usually an instance of - :class:`pyramid.security.Denied` or :class:`pyramid.security.ACLDenied` - each of which indicates a reason for the forbidden error. However, - ``result`` is also permitted to be just a plain boolean ``False`` object - or ``None``. The ``result`` value will be used as the ``result`` - attribute of the exception object. It defaults to ``None``. + :class:`pyramid.security.Denied` or + :class:`pyramid.authorization.ACLDenied` each of which indicates a reason + for the forbidden error. However, ``result`` is also permitted to be just + a plain boolean ``False`` object or ``None``. The ``result`` value will + be used as the ``result`` attribute of the exception object. + It defaults to ``None``. The :term:`Forbidden View` can use the attributes of a Forbidden exception as necessary to provide extended information in an error diff --git a/src/pyramid/interfaces.py b/src/pyramid/interfaces.py index 1f089216f..e92662f11 100644 --- a/src/pyramid/interfaces.py +++ b/src/pyramid/interfaces.py @@ -554,8 +554,8 @@ class IAuthenticationPolicy(Interface): """ Return a sequence representing the effective principals typically including the :term:`userid` and any groups belonged to by the current user, always including 'system' groups such - as ``pyramid.security.Everyone`` and - ``pyramid.security.Authenticated``. + as ``pyramid.authorization.Everyone`` and + ``pyramid.authorization.Authenticated``. """ diff --git a/src/pyramid/security.py b/src/pyramid/security.py index c0d01e0a7..657af045a 100644 --- a/src/pyramid/security.py +++ b/src/pyramid/security.py @@ -11,28 +11,6 @@ from pyramid.interfaces import ( ) from pyramid.threadlocal import get_current_registry -Everyone = 'system.Everyone' -Authenticated = 'system.Authenticated' -Allow = 'Allow' -Deny = 'Deny' - - -class AllPermissionsList(object): - """ Stand in 'permission list' to represent all permissions """ - - def __iter__(self): - return iter(()) - - def __contains__(self, other): - return True - - def __eq__(self, other): - return isinstance(other, self.__class__) - - -ALL_PERMISSIONS = AllPermissionsList() -DENY_ALL = (Deny, Everyone, ALL_PERMISSIONS) - NO_PERMISSION_REQUIRED = '__no_permission_required__' @@ -114,7 +92,7 @@ def principals_allowed_by_permission(context, permission): in effect, return a sequence of :term:`principal` ids that possess the permission in the ``context``. If no authorization policy is in effect, this will return a sequence with the single value - :mod:`pyramid.security.Everyone` (the special principal + :mod:`pyramid.authorization.Everyone` (the special principal identifier representing all principals). .. note:: @@ -129,6 +107,8 @@ def principals_allowed_by_permission(context, permission): reg = get_current_registry() policy = reg.queryUtility(IAuthorizationPolicy) if policy is None: + from pyramid.authorization import Everyone # noqa: F811 + return [Everyone] return policy.principals_allowed_by_permission(context, permission) @@ -231,62 +211,6 @@ class Allowed(PermitsResult): boolval = 1 -class ACLPermitsResult(PermitsResult): - def __new__(cls, ace, acl, permission, principals, context): - """ - Create a new instance. - - :param ace: The :term:`ACE` that matched, triggering the result. - :param acl: The :term:`ACL` containing ``ace``. - :param permission: The required :term:`permission`. - :param principals: The list of :term:`principals <principal>` provided. - :param context: The :term:`context` providing the :term:`lineage` - searched. - - """ - fmt = ( - '%s permission %r via ACE %r in ACL %r on context %r for ' - 'principals %r' - ) - inst = PermitsResult.__new__( - cls, fmt, cls.__name__, permission, ace, acl, context, principals - ) - inst.permission = permission - inst.ace = ace - inst.acl = acl - inst.principals = principals - inst.context = context - return inst - - -class ACLDenied(ACLPermitsResult, Denied): - """ - An instance of ``ACLDenied`` is a specialization of - :class:`pyramid.security.Denied` that represents that a security check - made explicitly against ACL was denied. It evaluates equal to all - boolean false types. It also has the following attributes: ``acl``, - ``ace``, ``permission``, ``principals``, and ``context``. These - attributes indicate the security values involved in the request. Its - ``__str__`` method prints a summary of these attributes for debugging - purposes. The same summary is available as the ``msg`` attribute. - - """ - - -class ACLAllowed(ACLPermitsResult, Allowed): - """ - An instance of ``ACLAllowed`` is a specialization of - :class:`pyramid.security.Allowed` that represents that a security check - made explicitly against ACL was allowed. It evaluates equal to all - boolean true types. It also has the following attributes: ``acl``, - ``ace``, ``permission``, ``principals``, and ``context``. These - attributes indicate the security values involved in the request. Its - ``__str__`` method prints a summary of these attributes for debugging - purposes. The same summary is available as the ``msg`` attribute. - - """ - - class SecurityAPIMixin: """ Mixin for Request class providing auth-related properties. """ @@ -398,9 +322,11 @@ class AuthenticationAPIMixin(object): Return the list of 'effective' :term:`principal` identifiers for the ``request``. If no :term:`authentication policy` is in effect, this will return a one-element list containing the - :data:`pyramid.security.Everyone` principal. + :data:`pyramid.authorization.Everyone` principal. """ + from pyramid.authorization import Everyone # noqa: F811 + security = _get_security_policy(self) if security is not None and isinstance(security, LegacySecurityPolicy): authn = security._get_authn_policy(self) @@ -456,3 +382,100 @@ class LegacySecurityPolicy: authz = self._get_authz_policy(request) principals = authn.effective_principals(request) return authz.permits(context, principals, permission) + + +Everyone = 'system.Everyone' +Authenticated = 'system.Authenticated' +Allow = 'Allow' +Deny = 'Deny' + + +class AllPermissionsList(object): + """ Stand in 'permission list' to represent all permissions """ + + def __iter__(self): + return iter(()) + + def __contains__(self, other): + return True + + def __eq__(self, other): + return isinstance(other, self.__class__) + + +ALL_PERMISSIONS = AllPermissionsList() +DENY_ALL = (Deny, Everyone, ALL_PERMISSIONS) + + +class ACLPermitsResult(PermitsResult): + def __new__(cls, ace, acl, permission, principals, context): + """ + Create a new instance. + + :param ace: The :term:`ACE` that matched, triggering the result. + :param acl: The :term:`ACL` containing ``ace``. + :param permission: The required :term:`permission`. + :param principals: The list of :term:`principals <principal>` provided. + :param context: The :term:`context` providing the :term:`lineage` + searched. + + """ + fmt = ( + '%s permission %r via ACE %r in ACL %r on context %r for ' + 'principals %r' + ) + inst = PermitsResult.__new__( + cls, fmt, cls.__name__, permission, ace, acl, context, principals + ) + inst.permission = permission + inst.ace = ace + inst.acl = acl + inst.principals = principals + inst.context = context + return inst + + +class ACLDenied(ACLPermitsResult, Denied): + """ + An instance of ``ACLDenied`` is a specialization of + :class:`pyramid.security.Denied` that represents that a security check + made explicitly against ACL was denied. It evaluates equal to all + boolean false types. It also has the following attributes: ``acl``, + ``ace``, ``permission``, ``principals``, and ``context``. These + attributes indicate the security values involved in the request. Its + ``__str__`` method prints a summary of these attributes for debugging + purposes. The same summary is available as the ``msg`` attribute. + + """ + + +class ACLAllowed(ACLPermitsResult, Allowed): + """ + An instance of ``ACLAllowed`` is a specialization of + :class:`pyramid.security.Allowed` that represents that a security check + made explicitly against ACL was allowed. It evaluates equal to all + boolean true types. It also has the following attributes: ``acl``, + ``ace``, ``permission``, ``principals``, and ``context``. These + attributes indicate the security values involved in the request. Its + ``__str__`` method prints a summary of these attributes for debugging + purposes. The same summary is available as the ``msg`` attribute. + + """ + + +for attr in ( + 'ALL_PERMISSIONS', + 'DENY_ALL', + 'ACLAllowed', + 'ACLDenied', + 'AllPermissionsList', + 'Allow', + 'Authenticated', + 'Deny', + 'Everyone', +): + deprecated( + attr, + '"pyramid.security.{attr}" is deprecated in Pyramid 2.0. Adjust your ' + 'import to "pyramid.authorization.{attr}"'.format(attr=attr), + ) |