Changeset 6375

Timestamp:

09/19/07 11:50:30 (1 year ago)

Author:

jacob

Message:

Fixed $5457 - the auth system now delegates permission checking to auth backend(s). As an added bonus, the auth backends now have some unit tests! Thanks, Florian Apolloner.

Files:

• django/trunk/AUTHORS (modified) (1 diff)
• django/trunk/django/contrib/auth/backends.py (modified) (2 diffs)
• django/trunk/django/contrib/auth/models.py (modified) (4 diffs)
• django/trunk/docs/authentication.txt (modified) (1 diff)
• django/trunk/tests/regressiontests/auth_backends (added)
• django/trunk/tests/regressiontests/auth_backends/__init__.py (added)
• django/trunk/tests/regressiontests/auth_backends/models.py (added)
• django/trunk/tests/regressiontests/auth_backends/tests.py (added)

django/trunk/AUTHORS

@@ -50 +50 @@
-    Fabrice Aneche <akh@nobugware.com>
-    ant9000@netwise.it
+    Florian Apolloner 
-    David Ascher <http://ascher.ca/>
-    david@kazserve.org

django/trunk/django/contrib/auth/backends.py

@@ +1 @@
+from django.db import connection
-from django.contrib.auth.models import User
-
@@ -15 +16 @@
-            return None
-
+    def get_group_permissions(self, user_obj):
+        "Returns a list of permission strings that this user has through his/her groups."
+        if not hasattr(user_obj, '_group_perm_cache'):
+            cursor = connection.cursor()
+            # The SQL below works out to the following, after DB quoting:
+            # cursor.execute("""
+            #     SELECT ct."app_label", p."codename"
+            #     FROM "auth_permission" p, "auth_group_permissions" gp, "auth_user_groups" ug, "django_content_type" ct
+            #     WHERE p."id" = gp."permission_id"
+            #         AND gp."group_id" = ug."group_id"
+            #         AND ct."id" = p."content_type_id"
+            #         AND ug."user_id" = %s, [self.id])
+            qn = connection.ops.quote_name
+            sql = """
+                SELECT ct.%s, p.%s
+                FROM %s p, %s gp, %s ug, %s ct
+                WHERE p.%s = gp.%s
+                    AND gp.%s = ug.%s
+                    AND ct.%s = p.%s
+                    AND ug.%s = %%s""" % (
+                qn('app_label'), qn('codename'),
+                qn('auth_permission'), qn('auth_group_permissions'),
+                qn('auth_user_groups'), qn('django_content_type'),
+                qn('id'), qn('permission_id'),
+                qn('group_id'), qn('group_id'),
+                qn('id'), qn('content_type_id'),
+                qn('user_id'),)
+            cursor.execute(sql, [user_obj.id])
+            user_obj._group_perm_cache = set(["%s.%s" % (row[0], row[1]) for row in cursor.fetchall()])
+        return user_obj._group_perm_cache
+    
+    def get_all_permissions(self, user_obj):
+        if not hasattr(user_obj, '_perm_cache'):
+            user_obj._perm_cache = set([u"%s.%s" % (p.content_type.app_label, p.codename) for p in user_obj.user_permissions.select_related()])
+            user_obj._perm_cache.update(self.get_group_permissions(user_obj))
+        return user_obj._perm_cache
+
+    def has_perm(self, user_obj, perm):
+        return perm in self.get_all_permissions(user_obj)
+
+    def has_module_perms(self, user_obj, app_label):
+        return bool(len([p for p in self.get_all_permissions(user_obj) if p[:p.index('.')] == app_label]))
+
-    def get_user(self, user_id):
-        try:

django/trunk/django/contrib/auth/models.py

@@ +1 @@
+from django.contrib import auth
-from django.core import validators
-from django.core.exceptions import ImproperlyConfigured
-connection, 
+
-from django.db.models.manager import EmptyManager
-from django.contrib.contenttypes.models import ContentType
@@ -211 +212 @@
-
-    def get_group_permissions(self):
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
-
-    def get_all_permissions(self):
-
-
-
-
+
+
+
+
+
-
-    def has_perm(self, perm):
-
+
+
+
+
+
+
+
-        if not self.is_active:
-            return False
+        
+        # Superusers have all permissions.
-        if self.is_superuser:
-            return True
-
+
+
+
+
+
+
+
-
-    def has_perms(self, perm_list):
-Returns True if the user has each of the specified permissions.
+""Returns True if the user has each of the specified permissions.""
-        for perm in perm_list:
-            if not self.has_perm(perm):
@@ -263 +259 @@
-
-    def has_module_perms(self, app_label):
-
+
+
+
+
-        if not self.is_active:
-            return False
+
-        if self.is_superuser:
-            return True
-
+
+
+
+
+
+
-
-    def get_and_delete_messages(self):
@@ -301 +306 @@
-class Message(models.Model):
-    """
-
+
+
+
+
+
+
-    """
-    user = models.ForeignKey(User)

django/trunk/docs/authentication.txt

@@ -1063 +1063 @@
-            except User.DoesNotExist:
-                return None
+
+Handling authorization in custom backends
+-----------------------------------------
+
+Custom auth backends can provide their own permissions. 
+
+The user model will delegate permission lookup functions
+(``get_group_permissions()``, ``get_all_permissions()``, ``has_perm()``, and
+``has_module_perms()``) to any authentication backend that implements these
+functions.
+
+The permissions given to the user will be the superset of all permissions
+returned by all backends. That is, Django grants a permission to a user that any
+one backend grants.
+
+The simple backend above could implement permissions for the magic admin fairly
+simply::
+        
+    class SettingsBackend:
+    
+        # ...
+
+        def has_perm(self, user_obj, perm):
+            if user_obj.username == settings.ADMIN_LOGIN:
+                return True
+            else:
+                return False
+                
+This gives full permissions to user granted access in the above example. Notice
+that the backend auth functions all take the user object as an argument, and
+also accept the same arguments given to the associated ``User`` functions.
+
+A full authorization implementation can be found in
+``django/contrib/auth/backends.py`` _, which is the default backend and queries
+the ``auth_permission``-table most of the time.
+
+.. _django/contrib/auth/backends.py: http://code.djangoproject.com/browser/django/trunk/django/contrib/auth/backends.py