Zope3 的对象策略

导航

项目链接

统计数据

View statistics for this project via Libraries.io, or by using our public dataset on Google BigQuery

Meta

License: Zope Public License (ZPL 2.1)

作者: Zope Foundation and Contributors

Tags zope3, z3c, objectpolicy

Maintainers

Avatar for agroszer from gravatar.com agroszer Avatar for icemac from gravatar.com icemac

分类

项目描述

objectpolicy 包可以很容易地逐个对象地覆盖默认的 zope.securitypolicy.zopepolicy。

<nav class="contents" id="contents" role="doc-toc">

内容

</nav>

objectpolicy 包可以很容易地逐个对象地覆盖默认的 zope.securitypolicy.zopepolicy。

默认情况下，所有对象都使用 zopepolicy。想要拥有自己的策略的对象应该有一个标记接口IObjectPolicyMarker并有一个到IObjectPolicy 的适配器。

级别

支持两个级别。

  • 低级别是 SecurityMap.getCell 级别。以下是主体或角色存储的权限。这也适用于 ZopePolicy 作为安全策略。使用 Allow、Deny、Unset 值。权限下降（使用 ZopePolicy）到子对象或视图。看：

    • IObjectPolicy.getPrincipalPermission

    • IObjectPolicy.getRolePermission

    • 低级.txt

    安装：将 z3c.objectpolicy-configure.zcml 放到 instance/etc 文件夹中。

  • 高级别是 ISecurityPolicy.checkPermission 级别。在这里，权限通常通过其角色、组和对象父/子关系来概括为主体。ZopePolicy 必须被 ObjectsPolicy 安全策略覆盖。权限不会下降到子对象或视图。使用 True - 访问，False - 无访问值。看：

    • IObjectPolicy.checkPermission

    • 高级别的.txt

    安装：覆盖实例/etc/securitypolicy.zcml中的ZopePolicy

基本设置（用于高级测试）

好的但不完美的例子是用户需要能够修改它自己的属性问题。

>>> from zope import interface, component
>>> from zope.annotation.interfaces import IAttributeAnnotatable
>>> from zope.container.interfaces import IContained
>>> from zope.container.contained import Contained
>>> from z3c.objectpolicy.interfaces import IObjectPolicy
>>> from z3c.objectpolicy.interfaces import IObjectPolicyMarker
>>> class IPerson(interface.Interface):
...     """a person interface for a person class"""
...
>>> class Person(Contained):
...     interface.implements(
...         IObjectPolicyMarker,
...         IAttributeAnnotatable,
...         IPerson)
...     def __init__(self, id, name):
...         self.id = id
...         self.name = name
...         self.groups = []
...
>>> class otherKlass(object):
...     #This class does NOT implement IObjectPolicyMarker
...     interface.implements(
...         IAttributeAnnotatable)
...     def __init__(self, id):
...         self.id = id

如果当前主体 == Person，则将允许 Person 对象上的主体获得这些权限

>>> ALLOW_FOR_SELF = ["zope.View",
...                   "zope.app.dublincore.view",
...                   "zope.ManageContent"]

计数器查看适配器触发的次数

>>> TRIP_WIRE = 0

这是确定权限的自定义策略适配器。注意，这与低级示例有点不同！

>>> from z3c.objectpolicy.objectpolicy import DefaultObjectPolicyAdapter
>>> class PersonPolicy(DefaultObjectPolicyAdapter):
...     component.adapts(IPerson)
...     interface.implements(IObjectPolicy)
...
...     def __init__(self, context):
...         #context is a Person
...         self.context = context
...
...     def checkPermission(self, manager, permissionid):
...         #print permissionid, str(self.context)
...         return self.checkPermissionForParticipation(manager, permissionid)
...
...     def checkPermissionForParticipant(self, manager, principal, permissionid):
...         global TRIP_WIRE
...         TRIP_WIRE += 1
...         if principal.id == self.context.id:
...             #we have the same Person in the participation
...             if permissionid in ALLOW_FOR_SELF:
...                 #we have the Person and the Permission
...                 return True
...
...         #no Person or Permission found
...         #return the Z3 default permissions
...         return super(PersonPolicy, self).checkPermissionForParticipant(
...             manager, principal, permissionid)
...
>>> component.provideAdapter(PersonPolicy)

安装 ObjectPolicy，进行测试设置。

>>> from z3c.objectpolicy.objectpolicy import ObjectPrincipalPermissionManager
>>> from z3c.objectpolicy.objectpolicy import ObjectRolePermissionManager
>>> from z3c.objectpolicy.objectpolicy import ObjectPolicy

>>> component.provideAdapter(ObjectPrincipalPermissionManager)
>>> component.provideAdapter(ObjectRolePermissionManager)

>>> bela = Person('b-id', 'bela')
>>> joe = Person('j-id', 'joe')

>>> class Participation:
...     interaction = None
>>> participation = Participation()
>>> participation.principal = joe
>>> import zope.security.management
>>> oldPolicy = zope.security.management.setSecurityPolicy(ObjectPolicy)
>>> zope.security.management.endInteraction()
>>> zope.security.management.newInteraction(participation)
>>> interaction = zope.security.management.getInteraction()

我们来看一个简单的权限检查

joe在未授予任何权限的情况下拥有对joe的ManageContent访问权限

>>> interaction.checkPermission('zope.ManageContent', joe)
True
>>> TRIP_WIRE
1

joe没有对joe的SomePermission访问权限，因为它未在 ALLOW_FOR_SELF 中列出

>>> interaction.checkPermission('myapp.SomePermission', joe)
False
>>> TRIP_WIRE
2

joe没有对bela的ManageContent访问权限

>>> interaction.checkPermission('zope.ManageContent', bela)
False
>>> TRIP_WIRE
3

>>> from zope.securitypolicy.interfaces import IPrincipalPermissionManager
>>> prinperBela = IPrincipalPermissionManager(bela)
>>> prinperJoe = IPrincipalPermissionManager(joe)
>>> prinperBela.grantPermissionToPrincipal('zope.ManageContent', 'j-id')

当我们将权限joe授予bela时， joe具有对bela的ManageContent访问权限

>>> interaction.checkPermission('zope.ManageContent', bela)
True
>>> TRIP_WIRE
4

授予权限也适用于任何任意权限

>>> prinperJoe.grantPermissionToPrincipal('myapp.SomePermission', 'j-id')
>>> interaction.checkPermission('myapp.SomePermission', joe)
True
>>> TRIP_WIRE
5

没有 IObjectPolicyMarker 的对象的行为与以前一样。未经授权 - 没有许可

>>> otherObject = otherKlass('o-id')
>>> prinperOther = IPrincipalPermissionManager(otherObject)
>>> interaction.checkPermission('zope.ManageContent', otherObject)
False
>>> TRIP_WIRE
5

>>> prinperOther.grantPermissionToPrincipal('zope.ManageContent', 'j-id')
>>> interaction.checkPermission('zope.ManageContent', otherObject)
True
>>> TRIP_WIRE
5

当标记在那里但没有适配器时检查发生了什么

>>> class otherKlassWOadapter(object):
...     #This class does NOT implement IObjectPolicyMarker
...     interface.implements(
...         IAttributeAnnotatable,
...         IObjectPolicyMarker)
...     def __init__(self, id):
...         self.id = id

>>> otherObjectWO = otherKlassWOadapter('oa-id')
>>> interaction.checkPermission('zope.ManageContent', otherObjectWO)
False

没有权限，也许应该将某些内容写入日志？

现在是更复杂的父子设置

>>> from zope.container.sample import SampleContainer
>>> from zope.location.location import locate
>>> class IPersonContainer(interface.Interface):
...     """a person container interface"""
...
>>> class PersonContainer(SampleContainer):
...     interface.implements(
...         IAttributeAnnotatable,
...         IPersonContainer)
...     def __init__(self, id):
...         self.id = id
...         super(PersonContainer, self).__init__()
...
>>> class BrowserView(object):
...     interface.implements(
...         IContained)
...
布局是：
用户（PersonContainer）
千斤顶（人）

编辑杰克（浏览器视图）

简（人）

编辑简（浏览器视图）

>>> users = PersonContainer('users')
>>> jack = Person('jack-id','jack')
>>> users['jack'] = jack
>>> locate(jack, users, 'jack')
>>> jane = Person('jane-id','jane')
>>> users['jane'] = jane
>>> locate(jane, users, 'jane')

>>> editJack = BrowserView()
>>> locate(editJack, jack, None)
>>> editJane = BrowserView()
>>> locate(editJane, jane, None)

>>> prinperUsers = IPrincipalPermissionManager(users)
>>> prinperJack = IPrincipalPermissionManager(jack)
>>> prinperJane = IPrincipalPermissionManager(jane)

>>> participation = Participation()

主要演员是杰克

>>> participation.principal = jack
>>> zope.security.management.endInteraction()
>>> zope.security.management.newInteraction(participation)
>>> interaction = zope.security.management.getInteraction()

当我们不授予权限时，只有 jack 对自己和它的 editView 有权限。

>>> interaction.checkPermission('zope.ManageContent', users)
False
>>> interaction.checkPermission('zope.ManageContent', jack)
True
>>> interaction.checkPermission('zope.ManageContent', editJack)
False
>>> interaction.checkPermission('zope.ManageContent', jane)
False
>>> interaction.checkPermission('zope.ManageContent', editJane)
False

当我们授予简权限时，杰克仍然拥有相同的权限。

>>> prinperUsers.grantPermissionToPrincipal('zope.ManageContent', 'jane-id')
>>> interaction.checkPermission('zope.ManageContent', users)
False
>>> interaction.checkPermission('zope.ManageContent', jack)
True
>>> interaction.checkPermission('zope.ManageContent', editJack)
False
>>> interaction.checkPermission('zope.ManageContent', jane)
False
>>> interaction.checkPermission('zope.ManageContent', editJane)
False

当我们授予杰克权限时，他将拥有整个包的权限。

>>> prinperUsers.grantPermissionToPrincipal('zope.ManageContent', 'jack-id')
>>> interaction.checkPermission('zope.ManageContent', users)
True
>>> interaction.checkPermission('zope.ManageContent', jack)
True
>>> interaction.checkPermission('zope.ManageContent', editJack)
True
>>> interaction.checkPermission('zope.ManageContent', jane)
True
>>> interaction.checkPermission('zope.ManageContent', editJane)
True

清理

我们清理了我们在这些示例中所做的更改：

>>> zope.security.management.endInteraction()
>>> ignore = zope.security.management.setSecurityPolicy(oldPolicy)

基本设置（用于低级测试）

好的但不完美的例子是用户需要能够修改它自己的属性问题。

>>> from zope import interface, component
>>> from zope.annotation.interfaces import IAttributeAnnotatable
>>> from zope.container.interfaces import IContained
>>> from zope.container.contained import Contained
>>> from z3c.objectpolicy.interfaces import IObjectPolicy
>>> from z3c.objectpolicy.interfaces import IObjectPolicyMarker
>>> class IPerson(interface.Interface):
...     """a person interface for a person class"""
...
>>> class Person(Contained):
...     interface.implements(
...         IObjectPolicyMarker,
...         IAttributeAnnotatable,
...         IPerson)
...     def __init__(self, id, name):
...         self.id = id
...         self.name = name
...         self.groups = []
...
>>> class otherKlass(object):
...     #This class does NOT implement IObjectPolicyMarker
...     interface.implements(
...         IAttributeAnnotatable)
...     def __init__(self, id):
...         self.id = id

如果当前主体 == Person，则将允许 Person 对象上的主体获得这些权限

>>> ALLOW_FOR_SELF = ["zope.View",
...                   "zope.app.dublincore.view",
...                   "zope.ManageContent"]

计数器查看适配器触发的次数

>>> TRIP_WIRE = 0

这是确定权限的自定义策略适配器。

>>> from zope.securitypolicy.interfaces import Allow, Deny, Unset
>>> from z3c.objectpolicy.objectpolicy import DefaultObjectPolicyAdapter
>>> class PersonPolicy(DefaultObjectPolicyAdapter):
...     component.adapts(IPerson)
...     interface.implements(IObjectPolicy)
...
...     def __init__(self, context):
...         #context is a Person
...         self.context = context
...
...     def getPrincipalPermission(self, manager, permissionid, principalid, default):
...         global TRIP_WIRE
...         TRIP_WIRE += 1
...         if principalid == self.context.id:
...             #we have the same Person in the participation
...             if permissionid in ALLOW_FOR_SELF:
...                 #we have the Person and the Permission
...                 return Allow
...
...         #no Person or Permission found
...         #return the Z3 default permissions
...         return super(PersonPolicy, self).getPrincipalPermission(
...             manager, permissionid, principalid, default)
...
>>> component.provideAdapter(PersonPolicy)

安装 ObjectPolicy，进行测试设置。

>>> from z3c.objectpolicy.objectpolicy import ObjectPrincipalPermissionManager
>>> from z3c.objectpolicy.objectpolicy import ObjectRolePermissionManager

>>> component.provideAdapter(ObjectPrincipalPermissionManager)
>>> component.provideAdapter(ObjectRolePermissionManager)

>>> bela = Person('b-id', 'bela')
>>> joe = Person('j-id', 'joe')

>>> 班级参与：
... 交互 = 无
>>> participation = Participation()
>>> 参与.principal = 乔
>>> 导入 zope.security.management
>>> 从 zope.securitypolicy.zopepolicy 导入 ZopeSecurityPolicy
>>> oldPolicy = zope.security.management.setSecurityPolicy(ZopeSecurityPolicy)
>>> zope.security.management.endInteraction()
>>> zope.security.management.newInteraction（参与）
>>> 交互 = zope.security.management.getInteraction()

我们来看一个简单的权限检查

joe在未授予任何权限的情况下拥有对joe的ManageContent访问权限

>>> interaction.checkPermission('zope.ManageContent', joe)
True
>>> TRIP_WIRE
1

joe没有对joe的SomePermission访问权限，因为它未在 ALLOW_FOR_SELF 中列出

>>> interaction.checkPermission('myapp.SomePermission', joe)
False
>>> TRIP_WIRE
2

joe没有对bela的ManageContent访问权限

>>> interaction.checkPermission('zope.ManageContent', bela)
False
>>> TRIP_WIRE
3

>>> from zope.securitypolicy.interfaces import IPrincipalPermissionManager
>>> prinperBela = IPrincipalPermissionManager(bela)
>>> prinperJoe = IPrincipalPermissionManager(joe)
>>> prinperBela.grantPermissionToPrincipal('zope.ManageContent', 'j-id')

当我们将权限joe授予bela时， joe具有对bela的ManageContent访问权限

>>> interaction.checkPermission('zope.ManageContent', bela)
True
>>> TRIP_WIRE
4

授予权限也适用于任何任意权限

>>> prinperJoe.grantPermissionToPrincipal('myapp.SomePermission', 'j-id')
>>> interaction.checkPermission('myapp.SomePermission', joe)
True
>>> TRIP_WIRE
5

没有 IObjectPolicyMarker 的对象的行为与以前一样。未经授权 - 没有许可

>>> otherObject = otherKlass('o-id')
>>> prinperOther = IPrincipalPermissionManager(otherObject)
>>> interaction.checkPermission('zope.ManageContent', otherObject)
False
>>> TRIP_WIRE
5

>>> prinperOther.grantPermissionToPrincipal('zope.ManageContent', 'j-id')
>>> interaction.checkPermission('zope.ManageContent', otherObject)
True
>>> TRIP_WIRE
5

当标记在那里但没有适配器时检查发生了什么

>>> class otherKlassWOadapter(object):
...     #This class does NOT implement IObjectPolicyMarker
...     interface.implements(
...         IAttributeAnnotatable,
...         IObjectPolicyMarker)
...     def __init__(self, id):
...         self.id = id

>>> otherObjectWO = otherKlassWOadapter('oa-id')
>>> interaction.checkPermission('zope.ManageContent', otherObjectWO)
False

没有权限，也许应该将某些内容写入日志？

现在是更复杂的父子设置

>>> from zope.container.sample import SampleContainer
>>> from zope.location.location import locate
>>> class IPersonContainer(interface.Interface):
...     """a person container interface"""
...
>>> class PersonContainer(SampleContainer):
...     interface.implements(
...         IAttributeAnnotatable,
...         IPersonContainer)
...     def __init__(self, id):
...         self.id = id
...         super(PersonContainer, self).__init__()
...
>>> class BrowserView(object):
...     interface.implements(
...         IContained)
...
布局是：
用户（PersonContainer）
千斤顶（人）

编辑杰克（浏览器视图）

简（人）

编辑简（浏览器视图）

>>> users = PersonContainer('users')
>>> jack = Person('jack-id','jack')
>>> users['jack'] = jack
>>> locate(jack, users, 'jack')
>>> jane = Person('jane-id','jane')
>>> users['jane'] = jane
>>> locate(jane, users, 'jane')

>>> editJack = BrowserView()
>>> locate(editJack, jack, None)
>>> editJane = BrowserView()
>>> locate(editJane, jane, None)

>>> prinperUsers = IPrincipalPermissionManager(users)
>>> prinperJack = IPrincipalPermissionManager(jack)
>>> prinperJane = IPrincipalPermissionManager(jane)

>>> participation = Participation()

主要演员是杰克

>>> participation.principal = jack
>>> zope.security.management.endInteraction()
>>> zope.security.management.newInteraction(participation)
>>> interaction = zope.security.management.getInteraction()

当我们不授予权限时，只有 jack 对自己和它的 editView 有权限。

>>> interaction.checkPermission('zope.ManageContent', users)
False
>>> interaction.checkPermission('zope.ManageContent', jack)
True
>>> interaction.checkPermission('zope.ManageContent', editJack)
True
>>> interaction.checkPermission('zope.ManageContent', jane)
False
>>> interaction.checkPermission('zope.ManageContent', editJane)
False

当我们授予简权限时，杰克仍然拥有相同的权限。

>>> prinperUsers.grantPermissionToPrincipal('zope.ManageContent', 'jane-id')
>>> interaction.checkPermission('zope.ManageContent', users)
False
>>> interaction.checkPermission('zope.ManageContent', jack)
True
>>> interaction.checkPermission('zope.ManageContent', editJack)
True
>>> interaction.checkPermission('zope.ManageContent', jane)
False
>>> interaction.checkPermission('zope.ManageContent', editJane)
False

当我们授予杰克权限时，他将拥有整个包的权限。

>>> prinperUsers.grantPermissionToPrincipal('zope.ManageContent', 'jack-id')
>>> interaction.checkPermission('zope.ManageContent', users)
True
>>> interaction.checkPermission('zope.ManageContent', jack)
True
>>> interaction.checkPermission('zope.ManageContent', editJack)
True
>>> interaction.checkPermission('zope.ManageContent', jane)
True
>>> interaction.checkPermission('zope.ManageContent', editJane)
True

清理

我们清理了我们在这些示例中所做的更改：

>>> zope.security.management.endInteraction()
>>> ignore = zope.security.management.setSecurityPolicy(oldPolicy)

变化

0.1 (2010-08-10)

  • 初始发行。

项目详情

项目链接

统计数据

通过Libraries.io或使用我们在 Google BigQuery 上的公共数据集 查看此项目的统计信息

元

许可证： Zope 公共许可证（ZPL 2.1）

作者： Zope 基金会和贡献者

标签 zope3, z3c, objectpolicy

维护者

来自 gravatar.com 的 agroszer 头像 阿格罗泽 冰淇淋 来自 gravatar.com 的 icemac 头像

分类器


发布历史 发布通知| RSS订阅

这个版本

0.1

下载文件

下载适用于您平台的文件。如果您不确定要选择哪个，请了解有关安装包的更多信息。

源分布

z3c.objectpolicy-0.1.tar.gz （16.2 kB 查看哈希）

已上传 source