Changeset 48

Timestamp:

08/27/06 02:11:07 (4 years ago)

Author:

johnbywater

Message:

Tests all pass again.

Location:

trunk/src/dm

Files:

• accesscontrol.py (modified) (6 diffs)
• dom/meta.py (modified) (1 diff)
• exceptions.py (modified) (1 diff)
• test.py (modified) (2 diffs)

trunk/src/dm/accesscontrol.py

@@ -3 +3 @@
 from dm.dictionarywords import VISITOR_NAME
 
-class AbstractAccessController(object):
-    "Authorises a person to take an action with an object."
+class BaseAccessController(object):
+    "Controls authorisations for named actions with protected objects."
     
     dictionary = RequiredFeature('SystemDictionary')
@@ -11 +11 @@
     debug      = RequiredFeature('Debug')
 
-    def __init__(self):
-        self.visitor = None
+    def isAuthorised(self, **kwds):
+        singleuseInstance = self.__class__()
+        return singleuseInstance.isAccessAuthorised(**kwds)
+
+    def isAccessAuthorised(self, person, actionName, protectedObject, **kwds):
+        self.action           = None
+        self.person           = None
         self.permissionObject = None
-        
-    def getVisitor(self):
-        if self.visitor == None:
-            visitorName = self.dictionary[VISITOR_NAME]
-            self.visitor = self.registry.persons[visitorName]
-        return self.visitor
-            
-    def isAuthorised(self, person=None, actionName='', protectedObject=None):
+        self.protectionObject = None
+        self.protectedObject  = None
+        self.visitor          = None
         if not actionName:
             return False
@@ -29 +29 @@
         self.setAction(actionName)
         self.setProtectedObject(protectedObject)
-        if self.hasAuthorisedRole():
+        try:
+            self.assertAccessAuthorised()
+        except AccessNotAuthorised, inst:
+            self.logger.info(
+                "Access Denied: Person '%s' to '%s' object '%s': %s" % (
+                    self.person.name, 
+                    self.actionName,
+                    self.protectedObject,
+                    inst,
+                )
+            )
+            return False
+        else:
             if self.debug:
                 self.logger.debug(
-                    "Access allowed: Person '%s' to '%s' object '%s'" % (
-                        self.person.name, self.actionName, self.protectedObject
+                    "Access Authorised: Person '%s' to '%s' object '%s'" % (
+                        self.person.name,
+                        self.actionName,
+                        self.protectedObject,
                     )
                 )
             return True
-        elif self.debug:
-            self.logger.info(
-                "Access denied: Person '%s' to '%s' object '%s'" % (
-                    self.person.name, self.actionName, self.protectedObject
-                )
-            )
-            return False
 
     def setPerson(self, person=None):
@@ -60 +67 @@
         self.setProtectionObject()
 
-    def hasAuthorisedRole(self):
-        message = "Abstract method not implemented on: %s" % str(self)
-        raise Exception(message)
+    def assertAccessAuthorised(self):
+        raise AccessNotAuthorised("Access not authorised by default.")
         
     def getPermissionObject(self):
@@ -74 +80 @@
         if permission in role.grants:
             if self.debug:
-                msg = "Access by role authorised: '%s' to '%s' with '%s'." % (
-                    role.name, self.actionName, self.protectedObject
-                )
-                self.logger.debug(msg)
-            return True
-        else:
-            if self.debug:
-                msg = "Access by role not authorised: '%s' to '%s' with '%s'."%(
-                    role.name, self.actionName, self.protectedObject
-                )
+                msg = "Access authorised against '%s' role." % role.name
+                self.logger.debug(msg)
+            return True
+        else:
+            if self.debug:
+                msg = "Access not authorised by '%s' role." % role.name
                 self.logger.debug(msg)
             return False
@@ -108 +110 @@
         raise "No protection object available for %s" % self.protectedNames
 
-
-class SystemAccessController(AbstractAccessController):
-    "Authorises a person to take an action with an object in the system."
-
-    def hasAuthorisedRole(self):
+    def getVisitor(self):
+        if self.visitor == None:
+            visitorName = self.dictionary[VISITOR_NAME]
+            self.visitor = self.registry.persons[visitorName]
+        return self.visitor
+           
+    def isPersonNotVisitor(self):
+        return self.person.name != self.getVisitor().name
+            
+
+class SystemAccessController(BaseAccessController):
+    "Introduces personal role, person system role, and visitor system role."
+
+    def assertAccessAuthorised(self):
         if self.isPersonBarred():
-            return False
-        if self.isSystemRoleAuthorised():
-            return True
-        if self.isPersonAuthorised():
-            return True
-        return False
-
+            raise AccessNotAuthorised(
+                "Access barred to person."
+            )
+        if self.isPersonAuthorisedPersonally():
+            return
+        if self.isPersonAuthorisedOnSystem():
+            return
+        if self.isPersonNotVisitor() and self.isVisitorBarred():
+            raise AccessNotAuthorised(
+                "Access barred to visitor person."
+            )
+        if self.isPersonNotVisitor() and self.isVisitorAuthorisedOnSystem():
+            return
+        super(SystemAccessController, self).assertAccessAuthorised()
+    
     def isPersonBarred(self):
         permission = self.getPermissionObject()
         if self.person in permission.personalBars:
             if self.debug:
-                msg = "Access personal barred: '%s' to '%s' with '%s'." % (
-                    self.person.name, self.actionName, self.protectedObject
-                )
-                self.logger.debug(msg)
-            return True
-        else:
-            if self.debug:
-                msg = "Access personal not barred: '%s' to '%s' with '%s'." %(
-                    self.person.name, self.actionName, self.protectedObject
-                )
-                self.logger.debug(msg)
-            return False
-        
-    def isPersonAuthorised(self):
+                msg = "Access personally barred."
+                self.logger.debug(msg)
+            return True
+        else:
+            if self.debug:
+                msg = "Access not personally barred."
+                self.logger.debug(msg)
+            return False
+        
+    def isVisitorBarred(self):
+        permission = self.getPermissionObject()
+        if self.getVisitor() in permission.personalBars:
+            if self.debug:
+                msg = "Access barred to visitor."
+                self.logger.debug(msg)
+            return True
+        else:
+            if self.debug:
+                msg = "Access not barred to visitor."
+                self.logger.debug(msg)
+            return False
+        
+    def isPersonAuthorisedPersonally(self):
         permission = self.getPermissionObject()
         if self.person in permission.personalGrants:
             if self.debug:
-                msg = "Access personal authorised: '%s' to '%s' with '%s'." %(
-                    self.person.name, self.actionName, self.protectedObject
-                )
-                self.logger.debug(msg)
-            return True
-        else:
-            if self.debug:
-                msg = "Access personal not auth'd: '%s' to '%s' with '%s'." % (
-                    self.person.name, self.actionName, self.protectedObject
-                )
-                self.logger.debug(msg)
-            return False
-        
-    def isSystemRoleAuthorised(self):
-        systemRole = self.getSystemRole()
+                msg = "Access personally authorised"
+                self.logger.debug(msg)
+            return True
+        else:
+            if self.debug:
+                msg = "Access not personally authorised"
+                self.logger.debug(msg)
+            return False
+        
+    def isPersonAuthorisedOnSystem(self):
+        systemRole = self.getPersonSystemRole()
         if self.isRoleAuthorised(systemRole):
             if self.debug:
-                msg = "Access system authorised: '%s' to '%s' with '%s'." %(
-                    self.person.name, self.actionName, self.protectedObject
-                )
-                self.logger.debug(msg)
-            return True
-        else:
-            if self.debug:
-                msg = "Access system not authorised: '%s' to '%s' with '%s'." %(
-                    self.person.name, self.actionName, self.protectedObject
-                )
-                self.logger.debug(msg)
-            return False
-
-    def getSystemRole(self):
+                msg = "Access authorised by person's system role."
+                self.logger.debug(msg)
+            return True
+        else:
+            if self.debug:
+                msg = "Access not authorised by person's system role."
+                self.logger.debug(msg)
+            return False
+
+    def isVisitorAuthorisedOnSystem(self):
+        systemRole = self.getVisitorSystemRole()
+        if self.isRoleAuthorised(systemRole):
+            if self.debug:
+                msg = "Access authorised by visitor's system role."
+                self.logger.debug(msg)
+            return True
+        else:
+            if self.debug:
+                msg = "Access not authorised by visitor's system role."
+                self.logger.debug(msg)
+            return False
+
+    def getPersonSystemRole(self):
         return self.person.role
 
+    def getVisitorSystemRole(self):
+        return self.getVisitor().role
+

trunk/src/dm/dom/meta.py

@@ -459 +459 @@
         # create where missing
         for associatedObjectKey in associatedObjectKeys:
+            if associatedObjectKey == None:
+                continue
+                
             if self.isKeyDomainObject():
                 associatedObjectKey = associatedObjectRegister[associatedObjectKey]

trunk/src/dm/exceptions.py

@@ -1 @@
-"""KForge exception Classes."""
+"""System exception classes."""
 
+# todo: Rename Kforge out of this module.
+
+class DmException(StandardError):
+    "System exception super class."
+    pass
+
+class AccessControlException(DmException):
+    pass
+
+class AccessNotAuthorised(AccessControlException):
+    pass
 
 class KforgeError(StandardError):

trunk/src/dm/test.py

@@ -11 +11 @@
 import dm.commandtest
 import dm.filesystemtest
+import dm.accesscontroltest
 import dm.applicationtest
 import dm.viewtest
@@ -27 +28 @@
         dm.dictionarytest.suite(),
         dm.commandtest.suite(),
+        #dm.filesystemtest.suite(),
+        dm.accesscontroltest.suite(),
+        dm.viewtest.suite(),
         dm.applicationtest.suite(),
-        dm.viewtest.suite(),
     ]
     return ApplicationTestSuite(suites)