zope.security.interfaces
¶
Interfaces for security machinery.
Exceptions¶
Extends:
zope.interface.common.interfaces.IException
Some user wasn’t allowed to access a resource
- interface
zope.security.interfaces.
IForbidden
[source]¶Extends:
zope.interface.common.interfaces.IException
- exception
zope.security.interfaces.
Forbidden
[source]¶A resource cannot be accessed under any circumstances
- interface
zope.security.interfaces.
IForbiddenAttribute
[source]¶Extends:
zope.security.interfaces.IForbidden
,zope.interface.common.interfaces.IAttributeError
Utilities¶
- interface
zope.security.interfaces.
ISecurityManagement
[source]¶Public security management API.
getSecurityPolicy
()¶Get the system default security policy.
setSecurityPolicy
(aSecurityPolicy)¶Set the system default security policy.
This method should only be called by system startup code. It should never, for example, be called during a web request.
- interface
zope.security.interfaces.
ISecurityChecking
[source]¶Public security API.
checkPermission
(permission, object, interaction=None)¶Return whether security policy allows permission on object.
‘permission’ is permission name.
‘object’ is the object being accessed according to the permission.
‘interaction’ is an interaction, providing access to information such as authenticated principals. If it is None, the current interaction is used.
- interface
zope.security.interfaces.
ISecurityProxyFactory
[source]¶
__call__
(object, checker=None)¶Create a security proxy
If a checker is given, then use it, otherwise, try to figure out a checker.
If the object is already a security proxy, then it will be returned.
- interface
zope.security.interfaces.
IChecker
[source]¶Security-proxy plugin objects that implement low-level checks
The checker is responsible for creating proxies for operation return values, via the proxy method.
There are check_getattr() and check_setattr() methods for checking getattr and setattr, and a check() method for all other operations.
The check methods may raise errors. They return no value.
Example (for __getitem__):
checker.check(ob, “__getitem__”) return checker.proxy(ob[key])
check_getattr
(ob, name)¶Check whether attribute access is allowed.
May raise Unauthorized or Forbidden. Returns no value.
If a checker implements __setitem__, then __setitem__ will be called rather than check_getattr to check whether an attribute access is allowed. This is a hack that allows significantly greater performance due to the fact that low-level operator access is much faster than method access.
check_setattr
(ob, name)¶Check whether attribute assignment is allowed.
May raise Unauthorized or Forbidden. Returns no value.
check
(ob, operation)¶Check whether operation is allowed.
The operation name is the Python special method name, e.g. “__getitem__”.
May raise Unauthorized or Forbidden. Returns no value.
If a checker implements __setitem__, then __setitem__ will be called rather than check to check whether an operation is allowed. This is a hack that allows significantly greater performance due to the fact that low-level operator access is much faster than method access.
proxy
(value)¶Return a security proxy for the value.
If a checker implements __getitem__, then __getitem__ will be called rather than proxy to proxy the value. This is a hack that allows significantly greater performance due to the fact that low-level operator access is much faster than method access.
- interface
zope.security.interfaces.
INameBasedChecker
[source]¶Extends:
zope.security.interfaces.IChecker
Security checker that uses permissions to check attribute access.
permission_id
(name)¶Return the permission used to check attribute access on name.
This permission is used by both check and check_getattr.
setattr_permission_id
(name)¶Return the permission used to check attribute assignment on name.
This permission is used by check_setattr.
Principals¶
- interface
zope.security.interfaces.
IInteraction
[source]¶A representation of an interaction between some actors and the system.
participations
¶An iterable of participations.
add
(participation)¶Add a participation.
remove
(participation)¶Remove a participation.
checkPermission
(permission, object)¶Return whether security context allows permission on object.
Arguments: permission – A permission name object – The object being accessed according to the permission
- interface
zope.security.interfaces.
IParticipation
[source]¶
interaction
¶The interaction
principal
¶The authenticated principal
- interface
zope.security.interfaces.
IInteractionManagement
[source]¶Interaction management API.
Every thread has at most one active interaction at a time.
newInteraction
(participation=None)¶Start a new interaction.
If participation is not None, it is added to the new interaction.
Raises an error if the calling thread already has an interaction.
queryInteraction
()¶Return the current interaction.
Return None if there is no interaction.
getInteraction
()¶Return the current interaction.
Raise NoInteraction if there isn’t a current interaction.
endInteraction
()¶End the current interaction.
Does nothing if there is no interaction.
- interface
zope.security.interfaces.
IPrincipal
[source]¶Principals are security artifacts that execute actions in a security environment.
The most common examples of principals include user and group objects.
It is likely that IPrincipal objects will have associated views used to list principals in management interfaces. For example, a system in which other meta-data are provided for principals might extend IPrincipal and register a view for the extended interface that displays the extended information. We’ll probably want to define a standard view name (e.g. ‘inline_summary’) for this purpose.
id
¶Id
The unique identification of the principal.
title
¶Title
The title of the principal. This is usually used in the UI.
description
¶Description
A detailed description of the principal.
- interface
zope.security.interfaces.
IGroupAwarePrincipal
[source]¶Extends:
zope.security.interfaces.IPrincipal
Group aware principal interface Extends IPrincipal to contain group information.
groups
¶An iterable of groups to which the principal directly belongs
- interface
zope.security.interfaces.
IGroupClosureAwarePrincipal
[source]¶Extends:
zope.security.interfaces.IGroupAwarePrincipal
allGroups
¶An iterable of the full closure of the principal’s groups.
- interface
zope.security.interfaces.
IGroup
[source]¶Extends:
zope.security.interfaces.IPrincipal
Group of principals
- interface
zope.security.interfaces.
IMemberGetterGroup
[source]¶Extends:
zope.security.interfaces.IGroup
a group that can get its members
getMembers
()¶return an iterable of the members of the group
- interface
zope.security.interfaces.
IMemberAwareGroup
[source]¶Extends:
zope.security.interfaces.IMemberGetterGroup
a group that can both set and get its members.
setMembers
(value)¶set members of group to the principal ids in the iterable value