Changes between Initial Version and Version 1 of GenericAuthorization

Timestamp:

May 28, 2006, 1:31:02 PM (18 years ago)

Author:

jkocherhans

Comment:

initial revision

GenericAuthorization

@@ +1 @@
+= Authorization =
+
+[[TOC(inline, GenericAuthorization)]]
+
+== Proposal ==
+
+As part of Google's 2006 Summer of Code, Joseph Kocherhans will be implementing a more flexible authorization system for Django. The new system should allow for ACL's, role-based systems, and Django's current model-level permissions.  {{{peak.security}}} http://peak.telecommunity.com/DevCenter/SecurityRules will be used as a basic model, but things will be made more django-like where it makes sense.
+
+Currently Django's authentication system is tied directly to the User model from django.contrib.auth. Also, there is no way to allow for row-level permissions. Authentication checks will be changed to use a new generic function:
+
+{{{
+#!python
+has_permission(user, permission, object)
+}}}
+
+This function will delegate to other functions based on the type of user, permission and object that are passed to it. This will allow the use of different types of security rules depending on the type of object being accessed, as well as allowing for new user objects that don't need to fulfill the whole {{{django.contrib.auth.models.User}}} interface. You can even create rules that don't depend on the default permission table in the database.
+
+== Scope ==
+
+The scope of this project is limited to providing the underlying support for making ACL's, etc possible, not actually implementing such policies. A policy that mimicks Django's model-level permission system will be included though.
+
+
+== Usage ==
+=== Checking a permission ===
+
+{{{
+#!python
+from django.contrib.auth import has_permission
+if has_permission(user, permission, object):
+    # do something
+}}}
+
+
+=== Adding new rules ===
+
+Here's an example of the low level api for adding new security rules. In reality, this will probably happen under the covers via new Meta settings, but this will be discussed later, probably after the low level stuff has been implemented and tested.
+
+{{{
+#!python
+from django.contrib.auth.models import User
+from django.contrib.auth import has_permission
+
+def default_has_permission(user, permission, object=None):
+    return user.has_perm(permission)
+
+has_permission.register(default_has_permission, User)
+}}}
+
+This is fairly close to what it would look like to implement django's current security policy. The object isn't really important in this case since Django's permissions are based on the Model you're accessing, not the actual object (See RowLevelPermissions for object-specific permissions.) We is we pass more than just {{{User}}} to the register method, we can register different security rules for different Models.
+
+
+== Implementation ==
+
+{{{has_permission}}} will be implemented as a class with a {{{register}}} method and a {{{__call__(self, user, permission, object)}}} method.
+
+This method is similar to Philip J. Eby's [RuleDispatch http://peak.telecommunity.com/PyCon05Talk/] and Guido van Rossum's recent work on generic/overloaded functions. See references for examples.
+
+== Roadmap ==
+
+Here's a simple roadmap for this project. I'll try to keep it as up to date as possible, noting changeset numbers as tasks are completed.
+
+|| Task || Status ||
+|| Implement and test the has_permission generic function. || Not Started ||
+|| Implement a function to mimic Django's current authorization. || Not Started ||
+|| Update the admin system to use {{{has_permission}}} and test. || Not Started ||
+|| Update other views/decorators to use {{{has_permission}}} and test. || Not Started ||
+|| Revise this page and integrate into core django docs. (Is this allowed for SoC, I'l let my mentor decide, if not, I'll just do it after SoC is over) || Not Started ||
+
+
+== References ==
+
+ - http://svn.python.org/view/sandbox/trunk/overload/
+ - http://www.artima.com/weblogs/viewpost.jsp?thread=155123
+ - http://www.artima.com/weblogs/viewpost.jsp?thread=155514
+