+++ /dev/null
-# -*- coding: utf-8 -*-
-## GroupUserFolder
-## Copyright (C)2006 Ingeniweb
-
-## This program is free software; you can redistribute it and/or modify
-## it under the terms of the GNU General Public License as published by
-## the Free Software Foundation; either version 2 of the License, or
-## (at your option) any later version.
-
-## This program is distributed in the hope that it will be useful,
-## but WITHOUT ANY WARRANTY; without even the implied warranty of
-## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-## GNU General Public License for more details.
-
-## You should have received a copy of the GNU General Public License
-## along with this program; see the file COPYING. If not, write to the
-## Free Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-"""
-VOCABULARY:
-
- - [Pure] User: A user is a user atom who can log itself on, and
- have additional properties such as domains and password.
-
- - Group: A group is a user atom other atoms can belong to.
-
- - User atom: Abstract representation of either a User or
- a Group.
-
- - Member (of a group): User atom inside a group.
-
- - Name (of an atom): For a user, the name can be set by
- the underlying user folder but usually id == name.
- For a group, its id is prefixed, but its name is NOT prefixed by 'group_'.
- For method taking a name instead of an id (eg. getUserByName()),
- if a user and a group have the same name,
- the USER will have precedence over the group.
-"""
-__version__ = "$Revision: $"
-# $Source: $
-# $Id: IUserFolder.py 30098 2006-09-08 12:35:01Z encolpe $
-__docformat__ = 'restructuredtext'
-
-from zope.interface import Interface, Attribute
-
-
-class IUserFolder(Interface):
-
- # #
- # Regular Zope UserFolder API #
- # #
-
- # User atom access
-
- def getUserNames():
- """
- Return a list of all possible user atom names in the system.
- Groups will be returned WITHOUT their prefix by this method.
- So, there might be a collision between a user name and a group name.
- [NOTA: This method is time-expensive !]
- """
-
- def getUserIds():
- """
- Return a list of all possible user atom ids in the system.
- WARNING: Please see the id Vs. name consideration at the
- top of this document. So, groups will be returned
- WITH their prefix by this method
- [NOTA: This method is time-expensive !]
- """
-
- def getUser(name):
- """Return the named user atom object or None
- NOTA: If no user can be found, we try to append a group prefix
- and fetch the user again before returning 'None'. This will ensure
- backward compatibility. So in fact, both group id and group name can be
- specified to this method.
- """
-
- def getUsers():
- """Return a list of user atom objects in the users cache.
- In case of some UF implementations, the returned object may only be a subset
- of all possible users.
- In other words, you CANNOT assert that len(getUsers()) equals len(getUserNames()).
- With cache-support UserFolders, such as LDAPUserFolder, the getUser() method will
- return only cached user objects instead of fetching all possible users.
- So this method won't be very time-expensive, but won't be accurate !
- """
-
- def getUserById(id, default):
- """Return the user atom corresponding to the given id.
- If default is provided, return default if no user found, else return None.
- """
-
- def getUserByName(name, default):
- """Same as getUserById() but works with a name instead of an id.
- If default is provided, return default if no user found, else return None.
- [NOTA: Theorically, the id is a handle, while the name is the actual login name.
- But difference between a user id and a user name is unsignificant in
- all current User Folder implementations... except for GROUPS.]
- """
-
- def hasUsers():
- """
- From Zope 2.7's User.py:
- This is not a formal API method: it is used only to provide
- a way for the quickstart page to determine if the default user
- folder contains any users to provide instructions on how to
- add a user for newbies. Using getUserNames or getUsers would have
- posed a denial of service risk.
- In GRUF, this method always return 1."""
-
-
- # Search interface for users; they won't return groups in any case.
-
- def searchUsersByName(search_term):
- """Return user ids which match the specified search_term.
- If search_term is an empty string, behaviour depends on the underlying user folder:
- it may return all users, return only cached users (for LDAPUF) or return no users.
- """
-
- def searchUsersById(search_term):
- """Return users whose id match the specified search_term.
- If search_term is an empty string, behaviour depends on the underlying user folder:
- it may return all users, return only cached users (for LDAPUF) or return no users.
- """
-
- def searchUsersByAttribute(attribute, search_term):
- """Return user ids whose 'attribute' match the specified search_term.
- If search_term is an empty string, behaviour depends on the underlying user folder:
- it may return all users, return only cached users (for LDAPUF) or return no users.
- This will return all users whose name contains search_term (whaterver its case).
- THIS METHOD MAY BE VERY EXPENSIVE ON USER FOLDER KINDS WHICH DO NOT PROVIDE A
- SEARCHING METHOD (ie. every UF kind except LDAPUF).
- 'attribute' can be 'id' or 'name' for all UF kinds, or anything else for LDAPUF.
- [NOTA: This method is time-expensive !]
- """
-
- # Search interface for groups;
-
- def searchGroupsByName(search_term):
- """Return group ids which match the specified search_term.
- If search_term is an empty string, behaviour depends on the underlying group folder:
- it may return all groups, return only cached groups (for LDAPUF) or return no groups.
- """
-
- def searchGroupsById(search_term):
- """Return groups whose id match the specified search_term.
- If search_term is an empty string, behaviour depends on the underlying group folder:
- it may return all groups, return only cached groups (for LDAPUF) or return no groups.
- """
-
- def searchGroupsByAttribute(attribute, search_term):
- """Return group ids whose 'attribute' match the specified search_term.
- If search_term is an empty string, behaviour depends on the underlying group folder:
- it may return all groups, return only cached groups (for LDAPUF) or return no groups.
- This will return all groups whose name contains search_term (whaterver its case).
- THIS METHOD MAY BE VERY EXPENSIVE ON GROUP FOLDER KINDS WHICH DO NOT PROVIDE A
- SEARCHING METHOD (ie. every UF kind except LDAPUF).
- 'attribute' can be 'id' or 'name' for all UF kinds, or anything else for LDAPUF.
- [NOTA: This method is time-expensive !]
- """
-
-
- # User access
-
- def getPureUserNames():
- """Same as getUserNames() but without groups
- """
-
- def getPureUserIds():
- """Same as getUserIds() but without groups
- """
-
- def getPureUsers():
- """Same as getUsers() but without groups.
- """
-
- def getPureUser(id):
- """Same as getUser() but forces returning a user and not a group
- """
-
- # Group access
-
- def getGroupNames():
- """Same as getUserNames() but without pure users.
- """
-
- def getGroupIds():
- """Same as getUserIds() but without pure users.
- """
-
- def getGroups():
- """Same as getUsers() but without pure users.
- In case of some UF implementations, the returned object may only be a subset
- of all possible users.
- In other words, you CANNOT assert that len(getUsers()) equals len(getUserNames()).
- With cache-support UserFolders, such as LDAPUserFolder, the getUser() method will
- return only cached user objects instead of fetching all possible users.
- So this method won't be very time-expensive, but won't be accurate !
- """
-
- def getGroup(name):
- """Return the named group object or None. As usual, 'id' is prefixed.
- """
-
- def getGroupById(id):
- """Same as getUserById(id) but forces returning a group.
- """
-
- def getGroupByName(name):
- """Same as getUserByName(name) but forces returning a group.
- The specified name MUST NOT be prefixed !
- """
-
-
- # Mutators
-
- def userFolderAddUser(name, password, roles, domains, groups, **kw):
- """API method for creating a new user object. Note that not all
- user folder implementations support dynamic creation of user
- objects.
- Groups can be specified by name or by id (preferabily by name)."""
-
- def userFolderEditUser(name, password, roles, domains, groups, **kw):
- """API method for changing user object attributes. Note that not
- all user folder implementations support changing of user object
- attributes.
- Groups can be specified by name or by id (preferabily by name)."""
-
- def userFolderUpdateUser(name, password, roles, domains, groups, **kw):
- """Same as userFolderEditUser, but with all arguments except name
- being optional.
- """
-
- def userFolderDelUsers(names):
- """API method for deleting one or more user atom objects. Note that not
- all user folder implementations support deletion of user objects."""
-
- def userFolderAddGroup(name, roles, groups, **kw):
- """API method for creating a new group.
- """
-
- def userFolderEditGroup(name, roles, groups, **kw):
- """API method for changing group object attributes.
- """
-
- def userFolderUpdateGroup(name, roles, groups, **kw):
- """Same as userFolderEditGroup but with all arguments (except name) being
- optinal.
- """
-
- def userFolderDelGroups(names):
- """API method for deleting one or more group objects.
- Implem. note : All ids must be prefixed with 'group_',
- so this method ends up beeing only a filter of non-prefixed ids
- before calling userFolderDelUsers().
- """
-
- # User mutation
-
-
- # XXX do we have to allow a user to be renamed ?
-## def setUserId(id, newId):
-## """Change id of a user atom. The user name might be changed as well by this operation.
-## """
-
-## def setUserName(id, newName):
-## """Change the name of a user atom. The user id might be changed as well by this operation.
-## """
-
- def userSetRoles(id, roles):
- """Change the roles of a user atom
- """
-
- def userAddRole(id, role):
- """Append a role for a user atom
- """
-
- def userRemoveRole(id, role):
- """Remove the role of a user atom.
- This will not, of course, affect implicitly-acquired roles from the user groups.
- """
-
- def userSetPassword(id, newPassword):
- """Set the password of a user
- """
-
- def userSetDomains(id, domains):
- """Set domains for a user
- """
-
- def userGetDomains(id, ):
- """Get domains for a user
- """
-
- def userAddDomain(id, domain):
- """Append a domain to a user
- """
-
- def userRemoveDomain(id, domain):
- """Remove a domain from a user
- """
-
- def userSetGroups(userid, groupnames):
- """Set the groups of a user. Groupnames are, as usual, not prefixed.
- However, a groupid can be given as a fallback
- """
-
- def userAddGroup(id, groupname):
- """add a group to a user atom. Groupnames are, as usual, not prefixed.
- However, a groupid can be given as a fallback
- """
-
- def userRemoveGroup(id, groupname):
- """remove a group from a user atom. Groupnames are, as usual, not prefixed.
- However, a groupid can be given as a fallback
- """
-
-
- # Security management
-
- def setRolesOnUsers(roles, userids):
- """Set a common set of roles for a bunch of user atoms.
- """
-
-## def setUsersOfRole(usernames, role):
-## """Sets the users of a role.
-## XXX THIS METHOD SEEMS TO BE SEAMLESS.
-## """
-
- def getUsersOfRole(role, object = None):
- """Gets the user (and group) ids having the specified role...
- ...on the specified Zope object if it's not None
- ...on their own information if the object is None.
- NOTA: THIS METHOD IS VERY EXPENSIVE.
- """
-
- def getRolesOfUser(userid):
- """Alias for user.getRoles()
- """
-
- def userFolderAddRole(role):
- """Add a new role. The role will be appended, in fact, in GRUF's surrounding folder.
- """
-
- def userFolderDelRoles(roles):
- """Delete roles.
- The removed roles will be removed from the UserFolder's users and groups as well,
- so this method can be very time consuming with a large number of users.
- """
-
- def userFolderGetRoles():
- """List the roles defined at the top of GRUF's folder.
- """
-
-
- # Groups support
- def setMembers(groupid, userids):
- """Set the members of the group
- """
-
- def addMember(groupid, id):
- """Add a member to a group
- """
-
- def removeMember(groupid, id):
- """Remove a member from a group
- """
-
- def hasMember(groupid, id):
- """Return true if the specified atom id is in the group.
- This is the contrary of IUserAtom.isInGroup(groupid).
- THIS CAN BE VERY EXPENSIVE"""
-
- def getMemberIds(groupid):
- """Return the list of member ids (groups and users) in this group.
- It will unmangle nested groups as well.
- THIS METHOD CAN BE VERY EXPENSIVE AS IT NEEDS TO FETCH ALL USERS.
- """
-
- def getUserMemberIds(groupid):
- """Same as listMemberIds but only return user ids
- THIS METHOD CAN BE VERY EXPENSIVE AS IT NEEDS TO FETCH ALL USERS.
- """
-
- def getGroupMemberIds(groupid):
- """Same as listMemberUserIds but only return group ids.
- THIS METHOD CAN BE VERY EXPENSIVE AS IT NEEDS TO FETCH ALL USERS.
- """
-
-
- # Local roles acquisition blocking support
- def acquireLocalRoles(folder, status):
- """Enable or disable local role acquisition on the specified folder.
- If status is true, it will enable, else it will disable.
- """
-
- def isLocalRoleAcquired(folder):
- """Return true if the specified folder allows local role acquisition.
- """
-
- # Audit & security checking methods
-
- def getAllLocalRoles(object):
- """getAllLocalRoles(self, object): return a dictionnary {user: roles} of local
- roles defined AND herited at a certain point. This will handle lr-blocking
- as well.
- """
-
-
-class IUserAtom(Interface):
- """
- This interface is an abstract representation of what both a User and a Group can do.
- """
- # Accessors
-
- def getId(unprefixed = 0):
- """Get the ID of the user. The ID can be used, at least from
- Python, to get the user from the user's UserDatabase.
- If unprefixed, remove all prefixes in any case."""
-
- def getUserName():
- """Alias for getName()
- """
-
- def getName():
- """Get user's or group's name.
- For a user, the name can be set by the underlying user folder but usually id == name.
- For a group, the ID is prefixed, but the NAME is NOT prefixed by 'group_'.
- """
-
- def getRoles():
- """Return the list of roles assigned to a user atom.
- This will never return gruf-related roles.
- """
-
- # Properties are defined depending on the underlying user folder: some support
- # properties mutation (such as LDAPUserFolder), some do not (such as regular UF).
-
- def getProperty(name):
- """Get a property's value.
- Will raise if not available.
- """
-
- def hasProperty(name):
- """Return true if the underlying user object has a value for the property.
- """
-
- # Mutators
-
- def setProperty(name, value):
- """Set a property's value.
- As some user folders cannot set properties, this method is not guaranteed to work
- and will raise a NotImplementedError if the underlying user folder cannot store
- properties (or _this_ particular property) for a user.
- """
-
- # XXX We do not allow user name / id changes
-## def setId(newId):
-## """Set the id of the user or group. This might change its name as well.
-## """
-
-## def setName(newName):
-## """Set the name of the user or group. Depending on the UserFolder implementation,
-## this might change the id as well.
-## """
-
- def setRoles(roles):
- """Change user's roles
- """
-
- def addRole(role):
- """Append a role to the user
- """
-
- def removeRole(role):
- """Remove a role from the user's ones
- """
-
- # Security-related methods
-
- def getRolesInContext(object):
- """Return the list of roles assigned to the user,
- including local roles assigned in context of
- the passed in object."""
-
- def has_permission(permission, object):
- """Check to see if a user has a given permission on an object."""
-
- def allowed(object, object_roles=None):
- """Check whether the user has access to object. The user must
- have one of the roles in object_roles to allow access."""
-
- def has_role(roles, object=None):
- """Check to see if a user has a given role or roles."""
-
-
-
- # Group management
-
- # XXX TODO: CLARIFY ID VS. NAME
-
- def isGroup():
- """Return true if this atom is a group.
- """
-
- def getGroupNames():
- """Return the names of the groups that the user or group is directly a member of.
- Return an empty list if the user or group doesn't belong to any group.
- Doesn't include transitive groups."""
-
- def getGroupIds():
- """Return the names of the groups that the user or group is a member of.
- Return an empty list if the user or group doesn't belong to any group.
- Doesn't include transitive groups."""
-
- def getGroups():
- """getAllGroupIds() alias.
- Return the IDS (not names) of the groups that the user or group is a member of.
- Return an empty list if the user or group doesn't belong to any group.
- THIS WILL INCLUDE TRANSITIVE GROUPS AS WELL."""
-
- def getAllGroupIds():
- """Return the names of the groups that the user or group is a member of.
- Return an empty list if the user or group doesn't belong to any group.
- Include transitive groups."""
-
- def getAllGroupNames():
- """Return the names of the groups that the user or group is directly a member of.
- Return an empty list if the user or group doesn't belong to any group.
- Include transitive groups."""
-
- def isInGroup(groupid):
- """Return true if the user is member of the specified group id
- (including transitive groups)"""
-
- def setGroups(groupids):
- """Set 'groupids' groups for the user or group.
- """
-
- def addGroup(groupid):
- """Append a group to the current object's groups.
- """
-
- def removeGroup(groupid):
- """Remove a group from the object's groups
- """
-
- def getRealId():
- """Return group id WITHOUT group prefix.
- For a user, return regular user id.
- This method is essentially internal.
- """
-
-
-class IUser(IUserAtom):
- """
- A user is a user atom who can log itself on, and
- have additional properties such as domains and password.
- """
-
- # Accessors
-
- def getDomains():
- """Return the list of domain restrictions for a user"""
-
- # Mutators
-
- def setPassword(newPassword):
- """Set user's password
- """
-
- def setDomains(domains):
- """Replace domains for the user
- """
-
- def addDomain(domain):
- """Append a domain for the user
- """
-
- def removeDomain(domain):
- """Remove a domain for the user
- """
-
-
-class IGroup(Interface):
- """
- A group is a user atom other atoms can belong to.
- """
- def getMemberIds(transitive = 1, ):
- """Return the member ids (users and groups) of the atoms of this group.
- This method can be very expensive !"""
-
- def getUserMemberIds(transitive = 1, ):
- """Return the member ids (users only) of the users of this group"""
-
- def getGroupMemberIds(transitive = 1, ):
- """Return the members ids (groups only) of the groups of this group"""
-
- def hasMember(id):
- """Return true if the specified atom id is in the group.
- This is the contrary of IUserAtom.isInGroup(groupid)"""
-
- def addMember(userid):
- """Add a user the the current group"""
-
- def removeMember(userid):
- """Remove a user from the current group"""
projects / GroupUserFolder.git / blobdiff
