From 3c2f95e8049bbd45b144d454daa68005361828b2 Mon Sep 17 00:00:00 2001
From: Matt Russell <mattr@netsight.co.uk>
Date: Thu, 24 Oct 2013 23:52:42 +0100
Subject: Security APIs on pyramid.request.Request

The pyramid.security Authorization API function has_permission is made available on the request.
The pyramid.security Authentication API functions are now available as
properties (unauthenticated_userid, authenticated_userid, effective_principals)
and methods (remember_userid, forget_userid) on pyramid.request.Request.

Backwards compatibility:
    For each of the APIs moved to request method or property,
    the original API in the pyramid.security module proxies to the request.

Reworked tests to check module level b/c wrappers call through to mixins for each API.
Tests that check no reg on request now do the right thing.
Use a response callback to set the request headers for forget_userid and remember_userid.

Update docs.

Attempt to improve a documentation section referencing the pyramid.security.has_permission
function in docs/narr/resources.rst

Ensures backwards compatiblity for `pyramid.security.forget`
and `pyramid.security.remember`.
---
 docs/tutorials/wiki/authorization.rst  | 4 ++--
 docs/tutorials/wiki2/authorization.rst | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

(limited to 'docs/tutorials')

diff --git a/docs/tutorials/wiki/authorization.rst b/docs/tutorials/wiki/authorization.rst
index 460a852e0..2bd8c1f1c 100644
--- a/docs/tutorials/wiki/authorization.rst
+++ b/docs/tutorials/wiki/authorization.rst
@@ -207,8 +207,8 @@ need to be added.)
 
 :meth:`~pyramid.view.forbidden_view_config` will be used
 to customize the default 403 Forbidden page.
-:meth:`~pyramid.security.remember` and
-:meth:`~pyramid.security.forget` help to create and
+:meth:`~pyramid.request.Request.remember_userid` and
+:meth:`~pyramid.request.Request.forget_userid` help to create and
 expire an auth ticket cookie.
 
 Now add the ``login`` and ``logout`` views:
diff --git a/docs/tutorials/wiki2/authorization.rst b/docs/tutorials/wiki2/authorization.rst
index cf20db6d7..2b4263610 100644
--- a/docs/tutorials/wiki2/authorization.rst
+++ b/docs/tutorials/wiki2/authorization.rst
@@ -230,8 +230,8 @@ head of ``tutorial/tutorial/views.py``:
 
 :meth:`~pyramid.view.forbidden_view_config` will be used
 to customize the default 403 Forbidden page.
-:meth:`~pyramid.security.remember` and
-:meth:`~pyramid.security.forget` help to create and
+:meth:`~pyramid.request.Request.remember_userid` and
+:meth:`~pyramid.request.Request.forget_userid` help to create and
 expire an auth ticket cookie.
 
 Now add the ``login`` and ``logout`` views:
-- 
cgit v1.2.3


From 696e0e3bd257fdace57adbb4c3d331af377d9e5b Mon Sep 17 00:00:00 2001
From: Chris McDonough <chrism@plope.com>
Date: Wed, 30 Oct 2013 19:47:52 -0400
Subject: fix zodb tutorial wrt request-based authentication and authorization
 apis

---
 docs/tutorials/wiki/authorization.rst              | 34 +++++++---------------
 .../wiki/src/authorization/tutorial/views.py       | 22 +++++---------
 2 files changed, 18 insertions(+), 38 deletions(-)

(limited to 'docs/tutorials')

diff --git a/docs/tutorials/wiki/authorization.rst b/docs/tutorials/wiki/authorization.rst
index 2bd8c1f1c..bba303d7f 100644
--- a/docs/tutorials/wiki/authorization.rst
+++ b/docs/tutorials/wiki/authorization.rst
@@ -56,10 +56,10 @@ returns one of these values:
   return ``None``.
 
 For example, ``groupfinder('editor', request )`` returns ``['group:editor']``,
-``groupfinder('viewer', request)`` returns ``[]``, and ``groupfinder('admin', request)``
-returns ``None``.  We will use ``groupfinder()`` as an :term:`authentication policy`
-"callback" that will provide the :term:`principal` or principals
-for a user.
+``groupfinder('viewer', request)`` returns ``[]``, and ``groupfinder('admin',
+request)`` returns ``None``.  We will use ``groupfinder()`` as an
+:term:`authentication policy` "callback" that will provide the
+:term:`principal` or principals for a user.
 
 In a production system, user and group
 data will most often come from a database, but here we use "dummy"
@@ -197,15 +197,15 @@ Add the following import statements to the
 head of ``tutorial/tutorial/views.py``:
 
 .. literalinclude:: src/authorization/tutorial/views.py
-   :lines: 6-13,15-17
+   :lines: 6-11
    :linenos:
-   :emphasize-lines: 3,6-9,11
+   :emphasize-lines: 3,6
    :language: python
 
 (Only the highlighted lines, with other necessary modifications,
 need to be added.)
 
-:meth:`~pyramid.view.forbidden_view_config` will be used
+:func:`~pyramid.view.forbidden_view_config` will be used
 to customize the default 403 Forbidden page.
 :meth:`~pyramid.request.Request.remember_userid` and
 :meth:`~pyramid.request.Request.forget_userid` help to create and
@@ -214,7 +214,7 @@ expire an auth ticket cookie.
 Now add the ``login`` and ``logout`` views:
 
 .. literalinclude:: src/authorization/tutorial/views.py
-   :lines: 82-120
+   :lines: 76-102
    :linenos:
    :language: python
 
@@ -251,18 +251,6 @@ in ``views.py``.
 Return a logged_in flag to the renderer
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-Add the following line to the import at the head of
-``tutorial/tutorial/views.py``:
-
-.. literalinclude:: src/authorization/tutorial/views.py
-   :lines: 11-15
-   :linenos:
-   :emphasize-lines: 4
-   :language: python
-
-(Only the highlighted line and a trailing comma on the preceding
-line need to be added.)
-
 Add a  ``logged_in`` parameter to the return value of
 ``view_page()``, ``edit_page()`` and  ``add_page()``,
 like this:
@@ -274,12 +262,12 @@ like this:
    return dict(page = page,
                content = content,
                edit_url = edit_url,
-               logged_in = authenticated_userid(request))
+               logged_in = request.authenticated_userid)
 
 (Only the highlighted line and a trailing comma on the preceding
 line need to be added.)
 
-:meth:`~pyramid.security.authenticated_userid()` will return ``None``
+:attr:`~pyramid.request.Request.authenticated_userid` will return ``None``
 if the user is not authenticated, or a user id if the user is
 authenticated.
 
@@ -329,7 +317,7 @@ when we're done:
 
 .. literalinclude:: src/authorization/tutorial/views.py
    :linenos:
-   :emphasize-lines: 8,11-15,17,24,29,48,52,68,72,80,82-120
+   :emphasize-lines: 8,11,18,23,42,46,62,66,74,80,76-107
    :language: python
 
 (Only the highlighted lines need to be added.)
diff --git a/docs/tutorials/wiki/src/authorization/tutorial/views.py b/docs/tutorials/wiki/src/authorization/tutorial/views.py
index 77956b1e3..57529ac8d 100644
--- a/docs/tutorials/wiki/src/authorization/tutorial/views.py
+++ b/docs/tutorials/wiki/src/authorization/tutorial/views.py
@@ -8,12 +8,6 @@ from pyramid.view import (
     forbidden_view_config,
     )
 
-from pyramid.security import (
-    remember,
-    forget,
-    authenticated_userid,
-    )
-
 from .security import USERS
 from .models import Page
 
@@ -45,7 +39,7 @@ def view_page(context, request):
     edit_url = request.resource_url(context, 'edit_page')
 
     return dict(page = context, content = content, edit_url = edit_url,
-                logged_in = authenticated_userid(request))
+                logged_in = request.authenticated_userid)
 
 @view_config(name='add_page', context='.models.Wiki',
              renderer='templates/edit.pt',
@@ -65,7 +59,7 @@ def add_page(context, request):
     page.__parent__ = context
 
     return dict(page=page, save_url=save_url,
-                logged_in=authenticated_userid(request))
+                logged_in=request.authenticated_userid)
 
 @view_config(name='edit_page', context='.models.Page',
              renderer='templates/edit.pt',
@@ -77,7 +71,7 @@ def edit_page(context, request):
 
     return dict(page=context,
                 save_url=request.resource_url(context, 'edit_page'),
-                logged_in=authenticated_userid(request))
+                logged_in=request.authenticated_userid)
 
 @view_config(context='.models.Wiki', name='login',
              renderer='templates/login.pt')
@@ -95,9 +89,8 @@ def login(request):
         login = request.params['login']
         password = request.params['password']
         if USERS.get(login) == password:
-            headers = remember(request, login)
-            return HTTPFound(location = came_from,
-                             headers = headers)
+            request.remember_userid(login)
+            return HTTPFound(location=came_from)
         message = 'Failed login'
 
     return dict(
@@ -110,6 +103,5 @@ def login(request):
 
 @view_config(context='.models.Wiki', name='logout')
 def logout(request):
-    headers = forget(request)
-    return HTTPFound(location = request.resource_url(request.context),
-                     headers = headers)
+    request.forget_userid()
+    return HTTPFound(location=request.resource_url(request.context))
-- 
cgit v1.2.3


From f436d7f5cd19e94378737096d9d21635b157fc46 Mon Sep 17 00:00:00 2001
From: Chris McDonough <chrism@plope.com>
Date: Wed, 30 Oct 2013 20:03:49 -0400
Subject: copy forward views.py changes to tests step

---
 docs/tutorials/wiki/src/tests/tutorial/views.py | 22 +++++++---------------
 1 file changed, 7 insertions(+), 15 deletions(-)

(limited to 'docs/tutorials')

diff --git a/docs/tutorials/wiki/src/tests/tutorial/views.py b/docs/tutorials/wiki/src/tests/tutorial/views.py
index 77956b1e3..57529ac8d 100644
--- a/docs/tutorials/wiki/src/tests/tutorial/views.py
+++ b/docs/tutorials/wiki/src/tests/tutorial/views.py
@@ -8,12 +8,6 @@ from pyramid.view import (
     forbidden_view_config,
     )
 
-from pyramid.security import (
-    remember,
-    forget,
-    authenticated_userid,
-    )
-
 from .security import USERS
 from .models import Page
 
@@ -45,7 +39,7 @@ def view_page(context, request):
     edit_url = request.resource_url(context, 'edit_page')
 
     return dict(page = context, content = content, edit_url = edit_url,
-                logged_in = authenticated_userid(request))
+                logged_in = request.authenticated_userid)
 
 @view_config(name='add_page', context='.models.Wiki',
              renderer='templates/edit.pt',
@@ -65,7 +59,7 @@ def add_page(context, request):
     page.__parent__ = context
 
     return dict(page=page, save_url=save_url,
-                logged_in=authenticated_userid(request))
+                logged_in=request.authenticated_userid)
 
 @view_config(name='edit_page', context='.models.Page',
              renderer='templates/edit.pt',
@@ -77,7 +71,7 @@ def edit_page(context, request):
 
     return dict(page=context,
                 save_url=request.resource_url(context, 'edit_page'),
-                logged_in=authenticated_userid(request))
+                logged_in=request.authenticated_userid)
 
 @view_config(context='.models.Wiki', name='login',
              renderer='templates/login.pt')
@@ -95,9 +89,8 @@ def login(request):
         login = request.params['login']
         password = request.params['password']
         if USERS.get(login) == password:
-            headers = remember(request, login)
-            return HTTPFound(location = came_from,
-                             headers = headers)
+            request.remember_userid(login)
+            return HTTPFound(location=came_from)
         message = 'Failed login'
 
     return dict(
@@ -110,6 +103,5 @@ def login(request):
 
 @view_config(context='.models.Wiki', name='logout')
 def logout(request):
-    headers = forget(request)
-    return HTTPFound(location = request.resource_url(request.context),
-                     headers = headers)
+    request.forget_userid()
+    return HTTPFound(location=request.resource_url(request.context))
-- 
cgit v1.2.3


From 3657ba974660677050fe4a62441c2073bd71203c Mon Sep 17 00:00:00 2001
From: Chris McDonough <chrism@plope.com>
Date: Wed, 30 Oct 2013 20:08:58 -0400
Subject: fix wiki2 tutorial wrt request-method security APIs

---
 docs/tutorials/wiki2/authorization.rst             | 27 +++++++---------------
 .../wiki2/src/authorization/tutorial/views.py      | 22 ++++++------------
 docs/tutorials/wiki2/src/tests/tutorial/views.py   | 22 ++++++------------
 3 files changed, 22 insertions(+), 49 deletions(-)

(limited to 'docs/tutorials')

diff --git a/docs/tutorials/wiki2/authorization.rst b/docs/tutorials/wiki2/authorization.rst
index 2b4263610..830cb0277 100644
--- a/docs/tutorials/wiki2/authorization.rst
+++ b/docs/tutorials/wiki2/authorization.rst
@@ -221,14 +221,14 @@ Add the following import statements to the
 head of ``tutorial/tutorial/views.py``:
 
 .. literalinclude:: src/authorization/tutorial/views.py
-   :lines: 9-16,18,24-25
+   :lines: 9-12,19
    :linenos:
-   :emphasize-lines: 3,6-9,11
+   :emphasize-lines: 3,5
    :language: python
 
 (Only the highlighted lines need to be added.)
 
-:meth:`~pyramid.view.forbidden_view_config` will be used
+:func:`~pyramid.view.forbidden_view_config` will be used
 to customize the default 403 Forbidden page.
 :meth:`~pyramid.request.Request.remember_userid` and
 :meth:`~pyramid.request.Request.forget_userid` help to create and
@@ -237,7 +237,7 @@ expire an auth ticket cookie.
 Now add the ``login`` and ``logout`` views:
 
 .. literalinclude:: src/authorization/tutorial/views.py
-   :lines: 91-123
+   :lines: 85-115
    :linenos:
    :language: python
 
@@ -274,17 +274,6 @@ added to ``views.py``.
 Return a logged_in flag to the renderer
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-Add the following line to the import at the head of
-``tutorial/tutorial/views.py``:
-
-.. literalinclude:: src/authorization/tutorial/views.py
-   :lines: 14-18
-   :linenos:
-   :emphasize-lines: 4
-   :language: python
-
-(Only the highlighted line needs to be added.)
-
 Add a  ``logged_in`` parameter to the return value of
 ``view_page()``, ``edit_page()`` and  ``add_page()``,
 like this:
@@ -296,12 +285,12 @@ like this:
    return dict(page = page,
                content = content,
                edit_url = edit_url,
-               logged_in = authenticated_userid(request))
+               logged_in = request.authenticated_userid)
 
 (Only the highlighted line needs to be added.)
 
-The :meth:`~pyramid.security.authenticated_userid` method will return None
-if the user is not authenticated.
+The :attr:`~pyramid.request.Request.authenticated_userid` property will return
+``None`` if the user is not authenticated.
 
 Add a "Logout" link when logged in
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -349,7 +338,7 @@ when we're done:
 
 .. literalinclude:: src/authorization/tutorial/views.py
    :linenos:
-   :emphasize-lines: 11,14-18,25,31,37,58,61,73,76,88,91-117,119-123
+   :emphasize-lines: 11,19,25,31,52,55,67,70,82,85-115
    :language: python
 
 (Only the highlighted lines need to be added.)
diff --git a/docs/tutorials/wiki2/src/authorization/tutorial/views.py b/docs/tutorials/wiki2/src/authorization/tutorial/views.py
index b6dbbf5f6..110d738c2 100644
--- a/docs/tutorials/wiki2/src/authorization/tutorial/views.py
+++ b/docs/tutorials/wiki2/src/authorization/tutorial/views.py
@@ -11,12 +11,6 @@ from pyramid.view import (
     forbidden_view_config,
     )
 
-from pyramid.security import (
-    remember,
-    forget,
-    authenticated_userid,
-    )
-
 from .models import (
     DBSession,
     Page,
@@ -55,7 +49,7 @@ def view_page(request):
     content = wikiwords.sub(check, content)
     edit_url = request.route_url('edit_page', pagename=pagename)
     return dict(page=page, content=content, edit_url=edit_url,
-                logged_in=authenticated_userid(request))
+                logged_in=request.authenticated_userid)
 
 @view_config(route_name='add_page', renderer='templates/edit.pt',
              permission='edit')
@@ -70,7 +64,7 @@ def add_page(request):
     save_url = request.route_url('add_page', pagename=pagename)
     page = Page(name='', data='')
     return dict(page=page, save_url=save_url,
-                logged_in=authenticated_userid(request))
+                logged_in=request.authenticated_userid)
 
 @view_config(route_name='edit_page', renderer='templates/edit.pt',
              permission='edit')
@@ -85,7 +79,7 @@ def edit_page(request):
     return dict(
         page=page,
         save_url = request.route_url('edit_page', pagename=pagename),
-        logged_in=authenticated_userid(request),
+        logged_in=request.authenticated_userid,
         )
 
 @view_config(route_name='login', renderer='templates/login.pt')
@@ -103,9 +97,8 @@ def login(request):
         login = request.params['login']
         password = request.params['password']
         if USERS.get(login) == password:
-            headers = remember(request, login)
-            return HTTPFound(location = came_from,
-                             headers = headers)
+            request.remember_userid(login)
+            return HTTPFound(location = came_from)
         message = 'Failed login'
 
     return dict(
@@ -118,7 +111,6 @@ def login(request):
 
 @view_config(route_name='logout')
 def logout(request):
-    headers = forget(request)
-    return HTTPFound(location = request.route_url('view_wiki'),
-                     headers = headers)
+    request.forget_userid()
+    return HTTPFound(location = request.route_url('view_wiki'))
     
diff --git a/docs/tutorials/wiki2/src/tests/tutorial/views.py b/docs/tutorials/wiki2/src/tests/tutorial/views.py
index b6dbbf5f6..110d738c2 100644
--- a/docs/tutorials/wiki2/src/tests/tutorial/views.py
+++ b/docs/tutorials/wiki2/src/tests/tutorial/views.py
@@ -11,12 +11,6 @@ from pyramid.view import (
     forbidden_view_config,
     )
 
-from pyramid.security import (
-    remember,
-    forget,
-    authenticated_userid,
-    )
-
 from .models import (
     DBSession,
     Page,
@@ -55,7 +49,7 @@ def view_page(request):
     content = wikiwords.sub(check, content)
     edit_url = request.route_url('edit_page', pagename=pagename)
     return dict(page=page, content=content, edit_url=edit_url,
-                logged_in=authenticated_userid(request))
+                logged_in=request.authenticated_userid)
 
 @view_config(route_name='add_page', renderer='templates/edit.pt',
              permission='edit')
@@ -70,7 +64,7 @@ def add_page(request):
     save_url = request.route_url('add_page', pagename=pagename)
     page = Page(name='', data='')
     return dict(page=page, save_url=save_url,
-                logged_in=authenticated_userid(request))
+                logged_in=request.authenticated_userid)
 
 @view_config(route_name='edit_page', renderer='templates/edit.pt',
              permission='edit')
@@ -85,7 +79,7 @@ def edit_page(request):
     return dict(
         page=page,
         save_url = request.route_url('edit_page', pagename=pagename),
-        logged_in=authenticated_userid(request),
+        logged_in=request.authenticated_userid,
         )
 
 @view_config(route_name='login', renderer='templates/login.pt')
@@ -103,9 +97,8 @@ def login(request):
         login = request.params['login']
         password = request.params['password']
         if USERS.get(login) == password:
-            headers = remember(request, login)
-            return HTTPFound(location = came_from,
-                             headers = headers)
+            request.remember_userid(login)
+            return HTTPFound(location = came_from)
         message = 'Failed login'
 
     return dict(
@@ -118,7 +111,6 @@ def login(request):
 
 @view_config(route_name='logout')
 def logout(request):
-    headers = forget(request)
-    return HTTPFound(location = request.route_url('view_wiki'),
-                     headers = headers)
+    request.forget_userid()
+    return HTTPFound(location = request.route_url('view_wiki'))
     
-- 
cgit v1.2.3


From 2885a7b96545c037109d7999319f74869a640050 Mon Sep 17 00:00:00 2001
From: Chris McDonough <chrism@plope.com>
Date: Wed, 30 Oct 2013 20:40:12 -0400
Subject: fix failing test (unrelated to security stuff)

---
 docs/tutorials/wiki2/src/tests/tutorial/tests.py | 21 ---------------------
 1 file changed, 21 deletions(-)

(limited to 'docs/tutorials')

diff --git a/docs/tutorials/wiki2/src/tests/tutorial/tests.py b/docs/tutorials/wiki2/src/tests/tutorial/tests.py
index 4ee30685e..c50e05b6d 100644
--- a/docs/tutorials/wiki2/src/tests/tutorial/tests.py
+++ b/docs/tutorials/wiki2/src/tests/tutorial/tests.py
@@ -26,27 +26,6 @@ def _registerRoutes(config):
     config.add_route('add_page', 'add_page/{pagename}')
 
 
-class PageModelTests(unittest.TestCase):
-
-    def setUp(self):
-        self.session = _initTestingDB()
-
-    def tearDown(self):
-        self.session.remove()
-
-    def _getTargetClass(self):
-        from tutorial.models import Page
-        return Page
-
-    def _makeOne(self, name='SomeName', data='some data'):
-        return self._getTargetClass()(name, data)
-
-    def test_constructor(self):
-        instance = self._makeOne()
-        self.assertEqual(instance.name, 'SomeName')
-        self.assertEqual(instance.data, 'some data')
-
-
 class ViewWikiTests(unittest.TestCase):
     def setUp(self):
         self.config = testing.setUp()
-- 
cgit v1.2.3


From 0dcd56c2c30863c6683c0cf442aa73dfdcd11b13 Mon Sep 17 00:00:00 2001
From: Chris McDonough <chrism@plope.com>
Date: Sat, 9 Nov 2013 17:11:16 -0500
Subject: undeprecate remember/forget functions and remove
 remember_userid/forget_userid methods from request

---
 docs/tutorials/wiki/authorization.rst              | 19 +++++++++---------
 .../wiki/src/authorization/tutorial/views.py       | 16 +++++++++++----
 docs/tutorials/wiki/src/tests/tutorial/views.py    | 16 +++++++++++----
 docs/tutorials/wiki2/authorization.rst             | 16 +++++++--------
 .../wiki2/src/authorization/tutorial/views.py      | 22 ++++++++++++++-------
 docs/tutorials/wiki2/src/tests/tutorial/views.py   | 23 ++++++++++++++--------
 6 files changed, 71 insertions(+), 41 deletions(-)

(limited to 'docs/tutorials')

diff --git a/docs/tutorials/wiki/authorization.rst b/docs/tutorials/wiki/authorization.rst
index bba303d7f..62b1164e3 100644
--- a/docs/tutorials/wiki/authorization.rst
+++ b/docs/tutorials/wiki/authorization.rst
@@ -197,24 +197,24 @@ Add the following import statements to the
 head of ``tutorial/tutorial/views.py``:
 
 .. literalinclude:: src/authorization/tutorial/views.py
-   :lines: 6-11
+   :lines: 6-13,15-17
    :linenos:
-   :emphasize-lines: 3,6
+   :emphasize-lines: 3,6-9,11
    :language: python
 
 (Only the highlighted lines, with other necessary modifications,
 need to be added.)
 
-:func:`~pyramid.view.forbidden_view_config` will be used
+:meth:`~pyramid.view.forbidden_view_config` will be used
 to customize the default 403 Forbidden page.
-:meth:`~pyramid.request.Request.remember_userid` and
-:meth:`~pyramid.request.Request.forget_userid` help to create and
+:meth:`~pyramid.security.remember` and
+:meth:`~pyramid.security.forget` help to create and
 expire an auth ticket cookie.
 
 Now add the ``login`` and ``logout`` views:
 
 .. literalinclude:: src/authorization/tutorial/views.py
-   :lines: 76-102
+   :lines: 82-120
    :linenos:
    :language: python
 
@@ -267,9 +267,8 @@ like this:
 (Only the highlighted line and a trailing comma on the preceding
 line need to be added.)
 
-:attr:`~pyramid.request.Request.authenticated_userid` will return ``None``
-if the user is not authenticated, or a user id if the user is
-authenticated.
+The :meth:`pyramid.request.Request.authenticated_userid` will be ``None`` if
+the user is not authenticated, or a user id if the user is authenticated.
 
 Add a "Logout" link when logged in
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -317,7 +316,7 @@ when we're done:
 
 .. literalinclude:: src/authorization/tutorial/views.py
    :linenos:
-   :emphasize-lines: 8,11,18,23,42,46,62,66,74,80,76-107
+   :emphasize-lines: 8,11-15,17,24,29,48,52,68,72,80,82-120
    :language: python
 
 (Only the highlighted lines need to be added.)
diff --git a/docs/tutorials/wiki/src/authorization/tutorial/views.py b/docs/tutorials/wiki/src/authorization/tutorial/views.py
index 57529ac8d..62e96e0e7 100644
--- a/docs/tutorials/wiki/src/authorization/tutorial/views.py
+++ b/docs/tutorials/wiki/src/authorization/tutorial/views.py
@@ -8,6 +8,12 @@ from pyramid.view import (
     forbidden_view_config,
     )
 
+from pyramid.security import (
+    remember,
+    forget,
+    )
+
+
 from .security import USERS
 from .models import Page
 
@@ -89,8 +95,9 @@ def login(request):
         login = request.params['login']
         password = request.params['password']
         if USERS.get(login) == password:
-            request.remember_userid(login)
-            return HTTPFound(location=came_from)
+            headers = remember(request, login)
+            return HTTPFound(location = came_from,
+                             headers = headers)
         message = 'Failed login'
 
     return dict(
@@ -103,5 +110,6 @@ def login(request):
 
 @view_config(context='.models.Wiki', name='logout')
 def logout(request):
-    request.forget_userid()
-    return HTTPFound(location=request.resource_url(request.context))
+    headers = forget(request)
+    return HTTPFound(location = request.resource_url(request.context),
+                     headers = headers)
diff --git a/docs/tutorials/wiki/src/tests/tutorial/views.py b/docs/tutorials/wiki/src/tests/tutorial/views.py
index 57529ac8d..62e96e0e7 100644
--- a/docs/tutorials/wiki/src/tests/tutorial/views.py
+++ b/docs/tutorials/wiki/src/tests/tutorial/views.py
@@ -8,6 +8,12 @@ from pyramid.view import (
     forbidden_view_config,
     )
 
+from pyramid.security import (
+    remember,
+    forget,
+    )
+
+
 from .security import USERS
 from .models import Page
 
@@ -89,8 +95,9 @@ def login(request):
         login = request.params['login']
         password = request.params['password']
         if USERS.get(login) == password:
-            request.remember_userid(login)
-            return HTTPFound(location=came_from)
+            headers = remember(request, login)
+            return HTTPFound(location = came_from,
+                             headers = headers)
         message = 'Failed login'
 
     return dict(
@@ -103,5 +110,6 @@ def login(request):
 
 @view_config(context='.models.Wiki', name='logout')
 def logout(request):
-    request.forget_userid()
-    return HTTPFound(location=request.resource_url(request.context))
+    headers = forget(request)
+    return HTTPFound(location = request.resource_url(request.context),
+                     headers = headers)
diff --git a/docs/tutorials/wiki2/authorization.rst b/docs/tutorials/wiki2/authorization.rst
index 830cb0277..1e5d0dcbf 100644
--- a/docs/tutorials/wiki2/authorization.rst
+++ b/docs/tutorials/wiki2/authorization.rst
@@ -221,23 +221,23 @@ Add the following import statements to the
 head of ``tutorial/tutorial/views.py``:
 
 .. literalinclude:: src/authorization/tutorial/views.py
-   :lines: 9-12,19
+   :lines: 9-19
    :linenos:
-   :emphasize-lines: 3,5
+   :emphasize-lines: 3,6-9,11
    :language: python
 
 (Only the highlighted lines need to be added.)
 
-:func:`~pyramid.view.forbidden_view_config` will be used
+:meth:`~pyramid.view.forbidden_view_config` will be used
 to customize the default 403 Forbidden page.
-:meth:`~pyramid.request.Request.remember_userid` and
-:meth:`~pyramid.request.Request.forget_userid` help to create and
+:meth:`~pyramid.security.remember` and
+:meth:`~pyramid.security.forget` help to create and
 expire an auth ticket cookie.
 
 Now add the ``login`` and ``logout`` views:
 
 .. literalinclude:: src/authorization/tutorial/views.py
-   :lines: 85-115
+   :lines: 91-123
    :linenos:
    :language: python
 
@@ -289,7 +289,7 @@ like this:
 
 (Only the highlighted line needs to be added.)
 
-The :attr:`~pyramid.request.Request.authenticated_userid` property will return
+The :meth:`~pyramid.request.Request.authenticated_userid` property will be
 ``None`` if the user is not authenticated.
 
 Add a "Logout" link when logged in
@@ -338,7 +338,7 @@ when we're done:
 
 .. literalinclude:: src/authorization/tutorial/views.py
    :linenos:
-   :emphasize-lines: 11,19,25,31,52,55,67,70,82,85-115
+   :emphasize-lines: 11,14-19,25,31,37,58,61,73,76,88,91-117,119-123
    :language: python
 
 (Only the highlighted lines need to be added.)
diff --git a/docs/tutorials/wiki2/src/authorization/tutorial/views.py b/docs/tutorials/wiki2/src/authorization/tutorial/views.py
index 110d738c2..e954d5a31 100644
--- a/docs/tutorials/wiki2/src/authorization/tutorial/views.py
+++ b/docs/tutorials/wiki2/src/authorization/tutorial/views.py
@@ -11,12 +11,18 @@ from pyramid.view import (
     forbidden_view_config,
     )
 
+from pyramid.security import (
+    remember,
+    forget,
+    )
+
+from .security import USERS
+
 from .models import (
     DBSession,
     Page,
     )
 
-from .security import USERS
 
 # regular expression used to find WikiWords
 wikiwords = re.compile(r"\b([A-Z]\w+[A-Z]+\w+)")
@@ -78,8 +84,8 @@ def edit_page(request):
                                                       pagename=pagename))
     return dict(
         page=page,
-        save_url = request.route_url('edit_page', pagename=pagename),
-        logged_in=request.authenticated_userid,
+        save_url=request.route_url('edit_page', pagename=pagename),
+        logged_in=request.authenticated_userid
         )
 
 @view_config(route_name='login', renderer='templates/login.pt')
@@ -97,8 +103,9 @@ def login(request):
         login = request.params['login']
         password = request.params['password']
         if USERS.get(login) == password:
-            request.remember_userid(login)
-            return HTTPFound(location = came_from)
+            headers = remember(request, login)
+            return HTTPFound(location = came_from,
+                             headers = headers)
         message = 'Failed login'
 
     return dict(
@@ -111,6 +118,7 @@ def login(request):
 
 @view_config(route_name='logout')
 def logout(request):
-    request.forget_userid()
-    return HTTPFound(location = request.route_url('view_wiki'))
+    headers = forget(request)
+    return HTTPFound(location = request.route_url('view_wiki'),
+                     headers = headers)
     
diff --git a/docs/tutorials/wiki2/src/tests/tutorial/views.py b/docs/tutorials/wiki2/src/tests/tutorial/views.py
index 110d738c2..41bea4785 100644
--- a/docs/tutorials/wiki2/src/tests/tutorial/views.py
+++ b/docs/tutorials/wiki2/src/tests/tutorial/views.py
@@ -11,12 +11,18 @@ from pyramid.view import (
     forbidden_view_config,
     )
 
+from pyramid.security import (
+    remember,
+    forget,
+    )
+
+from .security import USERS
+
 from .models import (
     DBSession,
     Page,
     )
 
-from .security import USERS
 
 # regular expression used to find WikiWords
 wikiwords = re.compile(r"\b([A-Z]\w+[A-Z]+\w+)")
@@ -78,8 +84,8 @@ def edit_page(request):
                                                       pagename=pagename))
     return dict(
         page=page,
-        save_url = request.route_url('edit_page', pagename=pagename),
-        logged_in=request.authenticated_userid,
+        save_url=request.route_url('edit_page', pagename=pagename),
+        logged_in=request.authenticated_userid
         )
 
 @view_config(route_name='login', renderer='templates/login.pt')
@@ -97,8 +103,9 @@ def login(request):
         login = request.params['login']
         password = request.params['password']
         if USERS.get(login) == password:
-            request.remember_userid(login)
-            return HTTPFound(location = came_from)
+            headers = remember(request, login)
+            return HTTPFound(location = came_from,
+                             headers = headers)
         message = 'Failed login'
 
     return dict(
@@ -111,6 +118,6 @@ def login(request):
 
 @view_config(route_name='logout')
 def logout(request):
-    request.forget_userid()
-    return HTTPFound(location = request.route_url('view_wiki'))
-    
+    headers = forget(request)
+    return HTTPFound(location = request.route_url('view_wiki'),
+                     headers = headers)
-- 
cgit v1.2.3