Ticket #14249: 14249.diff

django/contrib/auth/__init__.py

@@ -29 +29 @@
         warn("Authentication backends without a `supports_anonymous_user` attribute are deprecated. Please define it in %s." % cls,
              DeprecationWarning)
         cls.supports_anonymous_user = False
+        
+    if not hasattr(cls, 'supports_inactive_user'):
+        warn("Authentication backends without a `supports_inactive_user` attribute are deprecated. Please define it in %s." % cls,
+             DeprecationWarning)
+        cls.supports_inactive_user = False
     return cls()
 
 def get_backends():

django/contrib/auth/backends.py

@@ -8 +8 @@
     """
     supports_object_permissions = False
     supports_anonymous_user = True
+    supports_inactive_user = True
 
     # TODO: Model, login attribute name and password attribute name should be
     # configurable.
@@ -40 +41 @@
         return user_obj._perm_cache
 
     def has_perm(self, user_obj, perm):
+        if not user_obj.is_active:
+            return False
         return perm in self.get_all_permissions(user_obj)
 
     def has_module_perms(self, user_obj, app_label):
         """
         Returns True if user_obj has any permissions in the given app_label.
         """
+        if not user_obj.is_active:
+            return False
         for perm in self.get_all_permissions(user_obj):
             if perm[:perm.index('.')] == app_label:
                 return True

django/contrib/auth/models.py

@@ -160 +160 @@
 
 def _user_has_perm(user, perm, obj):
     anon = user.is_anonymous()
+    active = user.is_active
     for backend in auth.get_backends():
-        if not anon or backend.supports_anonymous_user:
+        if (not active and not anon and backend.supports_inactive_user) or \
+                    (not anon or backend.supports_anonymous_user):
             if hasattr(backend, "has_perm"):
                 if obj is not None:
                     if (backend.supports_object_permissions and
@@ -175 +177 @@
 
 def _user_has_module_perms(user, app_label):
     anon = user.is_anonymous()
+    active = user.is_active
     for backend in auth.get_backends():
-        if not anon or backend.supports_anonymous_user:
+        if (not active and not anon and backend.supports_inactive_user) or \
+                    (not anon or backend.supports_anonymous_user):
             if hasattr(backend, "has_module_perms"):
                 if backend.has_module_perms(user, app_label):
                     return True
@@ -300 +304 @@
         auth backend is assumed to have permission in general. If an object
         is provided, permissions for this specific object are checked.
         """
-        # Inactive users have no permissions.
-        if not self.is_active:
-            return False
-
-        # Superusers have all permissions.
-        if self.is_superuser:
+        
+        # Active superusers have all permissions.
+        if self.is_active and self.is_superuser:
             return True
 
         # Otherwise we need to check the backends.
@@ -327 +328 @@
         Returns True if the user has any permissions in the given app
         label. Uses pretty much the same logic as has_perm, above.
         """
-        if not self.is_active:
-            return False
-
-        if self.is_superuser:
+        # Active superusers have all permissions.
+        if self.is_active and self.is_superuser:
             return True
 
         return _user_has_module_perms(self, app_label)

django/contrib/auth/tests/__init__.py

@@ -1 @@
-from django.contrib.auth.tests.auth_backends import BackendTest, RowlevelBackendTest, AnonymousUserBackendTest, NoAnonymousUserBackendTest
+from django.contrib.auth.tests.auth_backends \
+    import BackendTest, RowlevelBackendTest, AnonymousUserBackendTest, NoAnonymousUserBackendTest, InActiveUserBackendTest, NoInActiveUserBackendTest
 from django.contrib.auth.tests.basic import BasicTestCase
 from django.contrib.auth.tests.decorators import LoginRequiredTestCase
 from django.contrib.auth.tests.forms import UserCreationFormTest, AuthenticationFormTest, SetPasswordFormTest, PasswordChangeFormTest, UserChangeFormTest, PasswordResetFormTest

django/contrib/auth/tests/auth_backends.py

@@ -96 +96 @@
 
 class SimpleRowlevelBackend(object):
     supports_object_permissions = True
+    supports_inactive_user = False
 
-    # This class also supports tests for anonymous user permissions,
-    # via subclasses which just set the 'supports_anonymous_user' attribute.
+    # This class also supports tests for anonymous user permissions, and
+    # inactive user permissions via subclasses which just set the 
+    # 'supports_anonymous_user' or 'supports_inactive_user' attribute.
+    
 
     def has_perm(self, user, perm, obj=None):
         if not obj:
@@ -110 +113 @@
             elif user.is_anonymous() and perm == 'anon':
                 # not reached due to supports_anonymous_user = False
                 return True
+            elif not user.is_active and perm == 'inactive':
+                return True
         return False
 
     def has_module_perms(self, user, app_label):
+        if not user.is_anonymous() and not user.is_active:
+            return False
         return app_label == "app1"
 
     def get_all_permissions(self, user, obj=None):
@@ -186 +193 @@
 class AnonymousUserBackend(SimpleRowlevelBackend):
 
     supports_anonymous_user = True
+    supports_inactive_user = False
 
 
 class NoAnonymousUserBackend(SimpleRowlevelBackend):
 
     supports_anonymous_user = False
+    supports_inactive_user = False
 
 
 class AnonymousUserBackendTest(TestCase):
@@ -251 +260 @@
 
     def test_get_all_permissions(self):
         self.assertEqual(self.user1.get_all_permissions(TestObj()), set())
+        
+        
+        
+class InActiveUserBackend(SimpleRowlevelBackend):
+    
+    supports_anonymous_user = False
+    supports_inactive_user = True
+
+
+class NoInActiveUserBackend(SimpleRowlevelBackend):
+    
+    supports_anonymous_user = False
+    supports_inactive_user = False
+
+
+class InActiveUserBackendTest(TestCase):
+    """
+    Tests for a inactive user delegating to backend if it has 'supports_inactive_user' = True
+    """
+
+    backend = 'django.contrib.auth.tests.auth_backends.InActiveUserBackend'
+
+    def setUp(self):
+        self.curr_auth = settings.AUTHENTICATION_BACKENDS
+        settings.AUTHENTICATION_BACKENDS = (self.backend,)
+        self.user1 = User.objects.create_user('test', 'test@example.com', 'test')
+        self.user1.is_active = False
+        self.user1.save()
+
+    def tearDown(self):
+        settings.AUTHENTICATION_BACKENDS = self.curr_auth
+
+    def test_has_perm(self):
+        self.assertEqual(self.user1.has_perm('perm', TestObj()), False)
+        self.assertEqual(self.user1.has_perm('inactive', TestObj()), True)
+        
+    def test_has_module_perms(self):
+        self.assertEqual(self.user1.has_module_perms("app1"), False)
+        self.assertEqual(self.user1.has_module_perms("app2"), False)
+
+
+class NoInActiveUserBackendTest(TestCase):
+    """
+    Tests that an inactive user does not delegate to backend if it has 'supports_inactive_user' = False
+    """
+    backend = 'django.contrib.auth.tests.auth_backends.NoInActiveUserBackend'
+
+    def setUp(self):
+        self.curr_auth = settings.AUTHENTICATION_BACKENDS
+        settings.AUTHENTICATION_BACKENDS = tuple(self.curr_auth) + (self.backend,)
+        self.user1 = User.objects.create_user('test', 'test@example.com', 'test')
+        self.user1.is_active = False
+        self.user1.save()
+
+    def tearDown(self):
+        settings.AUTHENTICATION_BACKENDS = self.curr_auth
+
+    def test_has_perm(self):
+        self.assertEqual(self.user1.has_perm('perm', TestObj()), False)
+        self.assertEqual(self.user1.has_perm('inactive', TestObj()), True) 
+        
+    def test_has_module_perms(self):
+        self.assertEqual(self.user1.has_module_perms("app1"), False)
+        self.assertEqual(self.user1.has_module_perms("app2"), False) 

docs/internals/deprecation.txt

@@ -98 +98 @@
         * The ``no`` language code has been deprecated in favor of the ``nb``
           language code.
 
+        * Authentication backends need to define the boolean attribute
+          ``supports_inactive_user``.
+
     * 1.5
         * The ``mod_python`` request handler has been deprecated since the 1.3
           release. The ``mod_wsgi`` handler should be used instead.
@@ -136 +139 @@
           template variable, not an implied string. The new-style
           behavior is provided in the ``future`` template tag library.
 
+        * Authentication backends need to support a inactive user
+          being passed to all methods dealing with permissions.
+          The ``supports_inactive_user`` variable is not checked any
+          longer and can be removed.
+
     * 2.0
         * ``django.views.defaults.shortcut()``. This function has been moved
           to ``django.contrib.contenttypes.views.shortcut()`` as part of the

docs/releases/1.3-alpha-2.txt

@@ -55 +55 @@
 
 For more information, see :ref:`translator-comments`.
 
+Permissions for inactive users
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+If you provide a custom auth backend with ``supports_inactive_user`` set to
+``True``, an inactive user model will check the backend for permissions.
+This is useful for further centralizing the permission handling. See the 
+:ref:`authentication docs <topics-auth>` for more details.
+
 Backwards-incompatible changes in 1.3 alpha 2
 =============================================
 

docs/releases/1.3.txt

@@ -133 +133 @@
 For more information, see :ref:`contextual-markers` and
 :ref:`translator-comments`.
 
+Permissions for inactive users
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+If you provide a custom auth backend with ``supports_inactive_user`` set to
+``True``, an inactive user model will check the backend for permissions.
+This is useful for further centralizing the permission handling. See the 
+:ref:`authentication docs <topics-auth>` for more details.
+
 Everything else
 ~~~~~~~~~~~~~~~
 

docs/topics/auth.txt

@@ -1606 +1606 @@
 Django 1.4 will assume that every backend supports anonymous users being
 passed to the authorization methods.
 
+Authorization for inactive users
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+.. versionchanged:: 1.3
+
+An inactive user is a one that is authenticated but has it's attribute 
+``is_active`` set to ``False``. However this does not mean they are not
+authrozied to do anything. For example they are allowed to activate their 
+account.
+
+The change to support anonymous users in the permission system allowed for 
+anonymous users to have permissions to do something while inactive 
+authenticated users did not.
+
+To enable this on your own backend, you must set the class attribute
+``supports_inactive_user`` to ``True``.
+
+A nonexisting ``supports_inactive_user`` attrivute will raise a hidden
+``PendingDeprecationWarning`` if used in Django 1.3. In Django 1.3, this
+warning will be updated to a ``DeprecationWarning`` which will be displayed
+loudly. Additionally ``supports_inactive_user`` will be set to ``False``.
+Django 1.5 will assyme that every backend supports inactive users being 
+passed to the authorization methods.
+
+
 Handling object permissions
 ---------------------------