Home       Trees       Indices       Help   
S3
Package s3 :: Module s3aaa :: Class AuthS3
[frames] | no frames]

Class AuthS3

source code

gluon.tools.Auth --+
                   |
                  AuthS3


S3 extensions of the gluon.tools.Auth class

- override:
    - __init__
    - define_tables
    - login_bare
    - set_cookie
    - login
    - register
    - email_reset_password
    - verify_email
    - profile
    - has_membership
    - requires_membership

- S3 extension for user registration:
    - s3_register_validation
    - s3_user_register_onaccept

- S3 extension for user administration:
    - configure_user_fields
    - s3_verify_user
    - s3_approve_user
    - s3_link_user
    - s3_user_profile_onaccept
    - s3_link_to_person
    - s3_link_to_organisation
    - s3_link_to_human_resource
    - s3_link_to_member
    - s3_approver

- S3 custom authentication methods:
    - s3_impersonate
    - s3_logged_in

- S3 user role management:
    - get_system_roles
    - s3_set_roles
    - s3_create_role
    - s3_delete_role
    - s3_assign_role
    - s3_withdraw_role
    - s3_has_role
    - s3_group_members

- S3 ACL management:
    - s3_update_acls

- S3 user identification helpers:
    - s3_get_user_id
    - s3_user_pe_id
    - s3_logged_in_person
    - s3_logged_in_human_resource

- S3 core authorization methods:
    - s3_has_permission
    - s3_accessible_query

- S3 variants of web2py authorization methods:
    - s3_has_membership
    - s3_requires_membership

- S3 record ownership methods:
    - s3_make_session_owner
    - s3_session_owns
    - s3_set_record_owner
Instance Methods
 
__init__(self)
Initialise parent class & make any necessary modifications		 source code
 
define_tables(self, migrate=True, fake_migrate=False)
to be called unless tables are defined manually		 source code
 
login_bare(self, username, password)
Logs user in		 source code
 
set_cookie(self)
Set a Cookie to the client browser so that we know this user has registered & so we should present them with a login form instead of a register form		 source code
 
login(self, next=DEFAULT, onvalidation=DEFAULT, onaccept=DEFAULT, log=DEFAULT, inline=False, lost_pw_link=None, register_link=True)
Overrides Web2Py's login() to use custom flash styles & utcnow		 source code
 
change_password(self, next=DEFAULT, onvalidation=DEFAULT, onaccept=DEFAULT, log=DEFAULT)
Returns a form that lets the user change password		 source code
 
reset_password(self, next=DEFAULT, onvalidation=DEFAULT, onaccept=DEFAULT, log=DEFAULT)
Returns a form to reset the user password, overrides web2py's version of the method to not swallow the _next var.		 source code
 
request_reset_password(self, next=DEFAULT, onvalidation=DEFAULT, onaccept=DEFAULT, log=DEFAULT)
Returns a form to reset the user password, overrides web2py's version of the method to apply Eden formstyles.		 source code
 
login_user(self, user)
Log the user in...		 source code
 
register(self, next=DEFAULT, onvalidation=DEFAULT, onaccept=DEFAULT, log=DEFAULT, js_validation=True)
Overrides Web2Py's register() to add new functionality:		 source code
 
email_reset_password(self, user)
Overrides Web2Py's email_reset_password() to modify the message structure		 source code
 
add_membership(self, group_id=None, user_id=None, role=None, entity=None)
gives user_id membership of group_id or role if user is None than user_id is that of current logged in user S3: extended to support Entities		 source code
 
verify_email(self, next=DEFAULT, log=DEFAULT)
action user to verify the registration email, XXXXXXXXXXXXXXXX		 source code
 
profile(self, next=DEFAULT, onvalidation=DEFAULT, onaccept=DEFAULT, log=DEFAULT)
returns a form that lets the user change his/her profile		 source code
 
configure_user_fields(self, pe_ids=None)
Configure User Fields - for registration & user administration		 source code
 
s3_import_prep(self, data)
Called when users are imported from CSV		 source code
 
auth_user_onaccept(self, email, user_id) source code
 
s3_register_onaccept(self, form)
S3 framework function		 source code
 
s3_user_register_onaccept(self, form)
S3 framework function		 source code
 
s3_verify_user(self, user)
" Designed to be called when a user is verified through:		 source code
 
s3_approve_user(self, user, password=None)
S3 framework function		 source code
 
s3_link_user(self, user)
S3 framework function		 source code
 
s3_link_to_person(self, user=None, organisation_id=None)
Links user accounts to person registry entries		 source code
 
s3_link_to_organisation(self, user)
Link a user account to an organisation		 source code
 
s3_link_to_org_group(self, user, person_id)
Link a user account to an organisation group		 source code
 
s3_link_to_human_resource(self, user, person_id, hr_type)
Take ownership of the HR records of the person record		 source code
 
s3_link_to_member(self, user, person_id=None)
Link to a member Record		 source code
 
s3_approver(self, user)
Returns the Approver for a new Registration & the organisation_id field		 source code
 
s3_send_welcome_email(self, user, password=None)
Send a welcome mail to newly-registered users - especially suitable for users from Facebook/Google who don't verify their emails		 source code
 
s3_impersonate(self, user_id)
S3 framework function		 source code
 
s3_logged_in(self)
Check whether the user is currently logged-in...		 source code
 
get_system_roles(self)
Get the IDs of the session roles by their UIDs, and store them in the current session, as these IDs should never change.		 source code
 
get_managed_orgs(self)
Get the pe_ids of all managed organisations (to authorize role assignments)		 source code
 
s3_set_roles(self)
Update pe_id, roles and realms for the current user		 source code
 
s3_create_role(self, role, description=None, *acls, **args)
Back-end method to create roles with ACLs		 source code
 
s3_delete_role(self, role_id)
Remove a role from the system.		 source code
 
s3_assign_role(self, user_id, group_id, for_pe=None)
Assigns a role to a user (add the user to a user group)		 source code
 
s3_withdraw_role(self, user_id, group_id, for_pe=None)
Removes a role assignment from a user account		 source code
 
s3_get_roles(self, user_id, for_pe=DEFAULT)
Lookup all roles which have been assigned to user for an entity		 source code
 
s3_has_role(self, role, for_pe=None)
Check whether the currently logged-in user has a certain role (auth_group membership).		 source code
 
s3_has_roles(self, roles, for_pe=None, all=False)
Check whether the currently logged-in user has at least one out of a set of roles (or all of them, with all=True)		 source code
 
s3_group_members(self, group_id, for_pe=DEFAULT)
Get a list of members of a group		 source code
 
s3_delegate_role(self, group_id, entity, receiver=None, role=None, role_type=None)
Delegate a role (auth_group) from one entity to another		 source code
 
s3_remove_delegation(self, group_id, entity, receiver=None, role=None)
Remove a delegation.		 source code
 
s3_get_delegations(self, entity, role_type=0, by_role=False)
Lookup delegations for an entity, ordered either by receiver (by_role=False) or by affiliation role (by_role=True)		 source code
 
s3_update_acls(self, role, *acls)
Wrapper for permission.update_acl to allow batch updating		 source code
 
s3_get_user_id(self, person_id=None, pe_id=None)
Get the user_id for a person_id		 source code
 
s3_user_pe_id(self, user_id)
Get the person pe_id for a user ID		 source code
 
s3_bulk_user_pe_id(self, user_ids)
Get the list of person pe_id for list of user_ids		 source code
 
s3_logged_in_person(self)
Get the person record ID for the current logged-in user		 source code
 
s3_logged_in_human_resource(self)
Get the first HR record ID for the current logged-in user		 source code
 
s3_has_permission(self, method, table, record_id=None, c=None, f=None)
S3 framework function to define whether a user can access a record in manner "method".		 source code
 
s3_accessible_query(self, method, table, c=None, f=None)
Returns a query with all accessible records for the currently logged-in user		 source code
 
s3_has_membership(self, group_id=None, user_id=None, role=None)
Checks if user is member of group_id or role		 source code
 
has_membership(self, group_id=None, user_id=None, role=None)
Checks if user is member of group_id or role		 source code
 
s3_requires_membership(self, role)
Decorator that prevents access to action if not logged in or if user logged in is not a member of group_id.		 source code
 
requires_membership(self, role)
Decorator that prevents access to action if not logged in or if user logged in is not a member of group_id.		 source code
 
s3_make_session_owner(self, table, record_id)
Makes the current session owner of a record		 source code
 
s3_session_owns(self, table, record_id)
Checks whether the current session owns a record		 source code
 
s3_clear_session_ownership(self, table=None, record_id=None)
Removes session ownership for a record		 source code
 
s3_update_record_owner(self, table, record, update=False, **fields)
Update ownership fields in a record (DRY helper method for s3_set_record_owner and set_realm_entity)		 source code
 
s3_set_record_owner(self, table, record, force_update=False, **fields)
Set the record owned_by_user, owned_by_group and realm_entity for a record (auto-detect values).		 source code
 
set_realm_entity(self, table, records, entity=0, force_update=False)
Update the realm entity for records, will also update the realm in all configured realm-entities, see:		 source code
 
get_realm_entity(self, table, record, entity=0)
Lookup the realm entity for a record		 source code
 
update_shared_fields(self, table, record, **data)
Update the shared fields in data in all super-entity rows linked with this record.		 source code
 
permitted_facilities(self, table=None, error_msg=None, redirect_on_error=True, facility_type=None)
If there are no facilities that the user has permission for, prevents create & update of records in table & gives a warning if the user tries to.		 source code
 
permitted_organisations(self, table=None, error_msg=None, redirect_on_error=True)
If there are no organisations that the user has update permission for, prevents create & update of a record in table & gives an warning if the user tries to.		 source code
 
root_org(self)
Return the current user's root organisation ID or None		 source code
 
root_org_name(self)
Return the current user's root organisation name or None		 source code
 
filter_by_root_org(self, table)
Function to return a query to filter a table to only display results for the user's root org OR record with no root org		 source code
Static Methods
 
s3_register_validation()
JavaScript client-side validation for Registration / User profile...		 source code
 
s3_user_profile_onaccept(form)
Update the UI locale from user profile		 source code
Class Variables
  S3_SYSTEM_ROLES = Storage(ADMIN= "ADMIN", AUTHENTICATED= "AUTH...
Method Details

__init__(self)
(Constructor)

source code 

Initialise parent class & make any necessary modifications

define_tables(self, migrate=True, fake_migrate=False)

source code 

to be called unless tables are defined manually

usages:

   # defines all needed tables and table files
   # UUID + "_auth_user.table", ...
   auth.define_tables()

   # defines all needed tables and table files
   # "myprefix_auth_user.table", ...
   auth.define_tables(migrate="myprefix_")

   # defines all needed tables without migration/table files
   auth.define_tables(migrate=False)

login_bare(self, username, password)

source code 

Logs user in

  • extended to understand session.s3.roles

set_cookie(self)

source code 

Set a Cookie to the client browser so that we know this user has registered & so we should present them with a login form instead of a register form

login(self, next=DEFAULT, onvalidation=DEFAULT, onaccept=DEFAULT, log=DEFAULT, inline=False, lost_pw_link=None, register_link=True)

source code 

Overrides Web2Py's login() to use custom flash styles & utcnow

Returns:
a login form

change_password(self, next=DEFAULT, onvalidation=DEFAULT, onaccept=DEFAULT, log=DEFAULT)

source code 

Returns a form that lets the user change password

reset_password(self, next=DEFAULT, onvalidation=DEFAULT, onaccept=DEFAULT, log=DEFAULT)

source code 

Returns a form to reset the user password, overrides web2py's version of the method to not swallow the _next var.

request_reset_password(self, next=DEFAULT, onvalidation=DEFAULT, onaccept=DEFAULT, log=DEFAULT)

source code 

Returns a form to reset the user password, overrides web2py's version of the method to apply Eden formstyles.

Parameters:
  • next - URL to redirect to after successful form submission
  • onvalidation - callback to validate password reset form
  • onaccept - callback to post-process password reset request
  • log - event description for the log (string)

login_user(self, user)

source code  

Log the user in
- common function called by login() & register()

register(self, next=DEFAULT, onvalidation=DEFAULT, onaccept=DEFAULT, log=DEFAULT, js_validation=True)

source code 

Overrides Web2Py's register() to add new functionality:

  • Checks whether registration is permitted
  • Custom Flash styles
  • Allow form to be embedded in other pages
  • Optional addition of Mobile Phone field to the Register form
  • Optional addition of Organisation field to the Register form
  • Lookup Domains/Organisations to check for Whitelists &/or custom Approver
Returns:
a registration form

email_reset_password(self, user)

source code 

Overrides Web2Py's email_reset_password() to modify the message structure

Parameters:
  • user - the auth_user record (Row)

add_membership(self, group_id=None, user_id=None, role=None, entity=None)

source code 

gives user_id membership of group_id or role if user is None than user_id is that of current logged in user S3: extended to support Entities

verify_email(self, next=DEFAULT, log=DEFAULT)

source code  

action user to verify the registration email, XXXXXXXXXXXXXXXX

.. method:: Auth.verify_email([next=DEFAULT [, onvalidation=DEFAULT
    [, log=DEFAULT]]])

profile(self, next=DEFAULT, onvalidation=DEFAULT, onaccept=DEFAULT, log=DEFAULT)

source code  

returns a form that lets the user change his/her profile

.. method:: Auth.profile([next=DEFAULT [, onvalidation=DEFAULT
    [, onaccept=DEFAULT [, log=DEFAULT]]]])

Patched for S3 to use s3_mark_required and handle opt_in mailing lists

configure_user_fields(self, pe_ids=None)

source code  

Configure User Fields - for registration & user administration

pe_ids: an optional list of pe_ids for the Org Filter
        i.e. org_admin coming from admin.py/user()

s3_import_prep(self, data)

source code 

Called when users are imported from CSV

Lookups Pseudo-reference Integer fields from Names e.g.: auth_membership.pe_id from organisation.name=<Org Name>

s3_register_validation()
Static Method

source code  

JavaScript client-side validation for Registration / User profile
- needed to check for passwords being same, etc

auth_user_onaccept(self, email, user_id)

source code 

s3_register_onaccept(self, form)

source code 

S3 framework function

Designed to be called when a user is created through:

  • registration via OAuth, LDAP, etc

Does the following:

  • Sets session.auth.user for authorstamp, etc
  • Approves user (to set registration groups, such as AUTHENTICATED, link to Person)

s3_user_register_onaccept(self, form)

source code 

S3 framework function

Designed to be called when a user is created through:

  • registration

Does the following:

  • Stores the user's email & profile image in auth_user_temp to be added to their person record when created on approval

To Do: If these fields are implemented with the InlineForms functionality, this function may become redundant

s3_verify_user(self, user)

source code 

" Designed to be called when a user is verified through:

  • responding to their verification email
  • if verification isn't required

Does the following:

  • Sends a message to the approver to notify them if a user needs approval
  • If deployment_settings.auth.always_notify_approver = True, send them notification regardless
  • If approval isn't required - calls s3_approve_user

@returns boolean - if the user has been approved

s3_approve_user(self, user, password=None)

source code 

S3 framework function

Designed to be called when a user is created through:

  • prepop
  • approved automatically during registration
  • approved by admin
  • added by admin
  • updated by admin

Does the following:

  • Adds user to the 'Authenticated' role
  • Adds any default roles for the user
  • @ToDo: adds them to the Org_x Access role
Parameters:
  • user - the user Storage() or Row
  • password - optional password to include in a custom welcome_email

s3_link_user(self, user)

source code 

S3 framework function

Designed to be called when a user is created & approved through:

  • prepop
  • approved automatically during registration
  • approved by admin
  • added by admin
  • updated by admin

Does the following:

  • Calls s3_link_to_organisation: Creates (if not existing) User's Organisation and links User
  • Calls s3_link_to_person: Creates (if not existing) User's Person Record and links User
  • Calls s3_link_to_human_resource: Creates (if not existing) User's Human Resource Record and links User
  • Calls s3_link_to_member

s3_user_profile_onaccept(form)
Static Method

source code 

Update the UI locale from user profile

s3_link_to_person(self, user=None, organisation_id=None)

source code  

Links user accounts to person registry entries

@param user: the user record
@param organisation_id: the user's organisation_id
                        to get the person's realm_entity

Policy for linking to pre-existing person records:

If this user is already linked to a person record with a different
first_name, last_name, email or realm_entity these will be
updated to those of the user.

If a person record with exactly the same first name and
last name exists, which has a contact information record
with exactly the same email address as used in the user
account, and is not linked to another user account, then
this person record will be linked to this user account.

Otherwise, a new person record is created, and a new email
contact record with the email address from the user record
is registered for that person.

s3_link_to_organisation(self, user)

source code 

Link a user account to an organisation

Parameters:
  • user - the user account record

s3_link_to_org_group(self, user, person_id)

source code 

Link a user account to an organisation group

Parameters:
  • user - the user account record
  • person_id - the person record ID associated with this user

s3_link_to_human_resource(self, user, person_id, hr_type)

source code 

Take ownership of the HR records of the person record

To Do: Add user to the Org Access role.

s3_link_to_member(self, user, person_id=None)

source code 

Link to a member Record

s3_approver(self, user)

source code  

Returns the Approver for a new Registration &
the organisation_id field

@param: user - the user record (form.vars when done direct)
@ToDo: Support multiple approvers per Org - via Org Admin (or specific Role?)
       Split into separate functions to returning approver & finding users' org from auth_organisations

@returns approver, organisation_id - if approver = False, user is automatically approved by whitelist

s3_send_welcome_email(self, user, password=None)

source code  

Send a welcome mail to newly-registered users
- especially suitable for users from Facebook/Google who don't
  verify their emails

@param user: the user dict, must contain "email", and can
             contain "language" for translation of the message
@param password: optional password to include in a custom welcome_email

s3_impersonate(self, user_id)

source code 

S3 framework function

Designed to be used within tasks, which are run in a separate request & hence don't have access to current.auth

Parameters:
  • user_id - auth.user.id or auth.user.email

s3_logged_in(self)

source code  

Check whether the user is currently logged-in
- tries Basic if not

get_system_roles(self)

source code 

Get the IDs of the session roles by their UIDs, and store them in the current session, as these IDs should never change.

get_managed_orgs(self)

source code 

Get the pe_ids of all managed organisations (to authorize role assignments)

TODO use this in admin/user controller

s3_set_roles(self)

source code 

Update pe_id, roles and realms for the current user

s3_create_role(self, role, description=None, *acls, **args)

source code 

Back-end method to create roles with ACLs

Parameters:
  • role - display name for the role
  • description - description of the role (optional)
  • acls - list of initial ACLs to assign to this role
  • args - keyword arguments (see below)
  • name - a unique name for the role
  • hidden - hide this role completely from the RoleManager
  • system - role can be assigned, but neither modified nor deleted in the RoleManager
  • protected - role can be assigned and edited, but not deleted in the RoleManager

s3_delete_role(self, role_id)

source code 

Remove a role from the system.

Parameters:
  • role_id - the ID or UID of the role

Note: protected roles cannot be deleted with this function, need to reset the protected-flag first to override

s3_assign_role(self, user_id, group_id, for_pe=None)

source code  

Assigns a role to a user (add the user to a user group)

@param user_id: the record ID of the user account
@param group_id: the record ID(s)/UID(s) of the group
@param for_pe: the person entity (pe_id) to restrict the group
               membership to, possible values:

               - None: use default realm (entities the user is
                 affiliated with)
               - 0: site-wide realm (no entity-restriction)
               - X: restrict to records owned by entity X

@note: strings are assumed to be group UIDs
@note: for_pe will be ignored for ADMIN, ANONYMOUS and AUTHENTICATED

s3_withdraw_role(self, user_id, group_id, for_pe=None)

source code  

Removes a role assignment from a user account

@param user_id: the record ID of the user account
@param group_id: the record ID(s)/UID(s) of the role
@param for_pe: only remove the group membership for this
               realm, possible values:

               - None: only remove for the default realm
               - 0: only remove for the site-wide realm
               - X: only remove for entity X
               - []: remove for any realms

@note: strings are assumed to be role UIDs

s3_get_roles(self, user_id, for_pe=DEFAULT)

source code 

Lookup all roles which have been assigned to user for an entity

Parameters:
  • user_id - the user_id
  • for_pe - the entity (pe_id) or list of entities

s3_has_role(self, role, for_pe=None)

source code 

Check whether the currently logged-in user has a certain role (auth_group membership).

Parameters:
  • role - the record ID or UID of the role
  • for_pe - check for this particular realm, possible values:

    None - for any entity 0 - site-wide X - for entity X

s3_has_roles(self, roles, for_pe=None, all=False)

source code 

Check whether the currently logged-in user has at least one out of a set of roles (or all of them, with all=True)

Parameters:
  • roles - list|tuple|set of role IDs or UIDs
  • for_pe - check for this particular realm, possible values: None - for any entity 0 - site-wide X - for entity X
  • all - check whether the user has all of the roles

s3_group_members(self, group_id, for_pe=DEFAULT)

source code 

Get a list of members of a group

Parameters:
  • group_id - the group record ID
  • for_pe - show only group members for this PE
Returns:
a list of the user_ids for members of a group

s3_delegate_role(self, group_id, entity, receiver=None, role=None, role_type=None)

source code 

Delegate a role (auth_group) from one entity to another

Parameters:
  • group_id - the role ID or UID (or a list of either)
  • entity - the delegating entity
  • receiver - the pe_id of the receiving entity (or a list of pe_ids)
  • role - the affiliation role
  • role_type - the role type for the affiliation role (default=9)
Notes:
  • if role is None, a new role of role_type 0 will be created for each entity in receiver and used for the delegation (1:1 delegation)
  • if both receiver and role are specified, the delegation will add all receivers to this role and create a 1:N delegation to this role. If the role does not exist, it will be created (using the given role type)

s3_remove_delegation(self, group_id, entity, receiver=None, role=None)

source code 

Remove a delegation.

Parameters:
  • group_id - the auth_group ID or UID (or a list of either)
  • entity - the delegating entity
  • receiver - the receiving entity
  • role - the affiliation role
Notes:
  • if receiver is specified, only 1:1 delegations (to role_type 0) will be removed, but not 1:N delegations => to remove for 1:N you must specify the role instead of the receiver
  • if both receiver and role are None, all delegations with this group_id will be removed for the entity

s3_get_delegations(self, entity, role_type=0, by_role=False)

source code 

Lookup delegations for an entity, ordered either by receiver (by_role=False) or by affiliation role (by_role=True)

Parameters:
  • entity - the delegating entity (pe_id)
  • role_type - limit the lookup to this affiliation role type, (can use 0 to lookup 1:1 delegations)
  • by_role - group by affiliation roles
Returns:
a Storage {<receiver>: [group_ids]}, or a Storage {<rolename>: {entities:[pe_ids], groups:[group_ids]}}

s3_update_acls(self, role, *acls)

source code 

Wrapper for permission.update_acl to allow batch updating

s3_get_user_id(self, person_id=None, pe_id=None)

source code 

Get the user_id for a person_id

Parameters:
  • person_id - the pr_person record ID, or a user email address
  • pe_id - the person entity ID, alternatively

s3_user_pe_id(self, user_id)

source code 

Get the person pe_id for a user ID

Parameters:
  • user_id - the user ID

s3_bulk_user_pe_id(self, user_ids)

source code 

Get the list of person pe_id for list of user_ids

Parameters:
  • user_id - list of user IDs

s3_logged_in_person(self)

source code 

Get the person record ID for the current logged-in user

s3_logged_in_human_resource(self)

source code 

Get the first HR record ID for the current logged-in user

s3_has_permission(self, method, table, record_id=None, c=None, f=None)

source code 

S3 framework function to define whether a user can access a record in manner "method". Designed to be called from the RESTlike controller.

Parameters:
  • method - the access method as string, one of "create", "read", "update", "delete"
  • table - the table or tablename
  • record_id - the record ID (if any)
  • c - the controller name (overrides current.request)
  • f - the function name (overrides current.request)

s3_accessible_query(self, method, table, c=None, f=None)

source code 

Returns a query with all accessible records for the currently logged-in user

Parameters:
  • method - the access method as string, one of: "create", "read", "update" or "delete"
  • table - the table or table name
  • c - the controller name (overrides current.request)
  • f - the function name (overrides current.request)

Note: This method does not work on GAE because it uses JOIN and IN

s3_has_membership(self, group_id=None, user_id=None, role=None)

source code 

Checks if user is member of group_id or role

Extends Web2Py's requires_membership() to add new functionality:

  • Custom Flash style
  • Uses s3_has_role()

has_membership(self, group_id=None, user_id=None, role=None)

source code 

Checks if user is member of group_id or role

Extends Web2Py's requires_membership() to add new functionality:

  • Custom Flash style
  • Uses s3_has_role()

s3_requires_membership(self, role)

source code 

Decorator that prevents access to action if not logged in or if user logged in is not a member of group_id. If role is provided instead of group_id then the group_id is calculated.

Extends Web2Py's requires_membership() to add new functionality:

  • Custom Flash style
  • Uses s3_has_role()
  • Administrators (id=1) are deemed to have all roles

requires_membership(self, role)

source code 

Decorator that prevents access to action if not logged in or if user logged in is not a member of group_id. If role is provided instead of group_id then the group_id is calculated.

Extends Web2Py's requires_membership() to add new functionality:

  • Custom Flash style
  • Uses s3_has_role()
  • Administrators (id=1) are deemed to have all roles

s3_make_session_owner(self, table, record_id)

source code 

Makes the current session owner of a record

Parameters:
  • table - the table or table name
  • record_id - the record ID

s3_session_owns(self, table, record_id)

source code 

Checks whether the current session owns a record

Parameters:
  • table - the table or table name
  • record_id - the record ID

s3_clear_session_ownership(self, table=None, record_id=None)

source code 

Removes session ownership for a record

Parameters:
  • table - the table or table name (default: all tables)
  • record_id - the record ID (default: all records)

s3_update_record_owner(self, table, record, update=False, **fields)

source code 

Update ownership fields in a record (DRY helper method for s3_set_record_owner and set_realm_entity)

Parameters:
  • table - the table
  • record - the record or record ID
  • update - True to update realm_entity in all realm-components
  • fields - dict of {ownership_field:value}

s3_set_record_owner(self, table, record, force_update=False, **fields)

source code 

Set the record owned_by_user, owned_by_group and realm_entity for a record (auto-detect values).

To be called by CRUD and Importer during record creation.

Parameters:
  • table - the Table (or table name)
  • record - the record (or record ID)
  • force_update - True to update all fields regardless of the current value in the record, False to only update if current value is None
  • fields - override auto-detected values, see keywords
  • owned_by_user - the auth_user ID of the owner user
  • owned_by_group - the auth_group ID of the owner group
  • realm_entity - the pe_id of the realm entity, or a tuple (instance_type, instance_id) to lookup the pe_id, e.g. ("org_organisation", 2)
Notes:
  • Only use with force_update for deliberate owner changes (i.e. with explicit owned_by_user/owned_by_group) - autodetected values can have undesirable side-effects. For mere realm updates use set_realm_entity instead.
  • If used with force_update, this will also update the realm_entity in all configured realm_components, i.e. no separate call to set_realm_entity required.

set_realm_entity(self, table, records, entity=0, force_update=False)

source code 

Update the realm entity for records, will also update the realm in all configured realm-entities, see:

http://eden.sahanafoundation.org/wiki/S3AAA/OrgAuth#Realms1

To be called by CRUD and Importer during record update.

Parameters:
  • table - the Table (or tablename)
  • records - - a single record
    • a single record ID
    • a list of records, or a Rows object
    • a list of record IDs
    • a query to find records in table
  • entity - - an entity ID
    • a tuple (table, instance_id)
    • 0 for default lookup

get_realm_entity(self, table, record, entity=0)

source code 

Lookup the realm entity for a record

Parameters:
  • table - the Table
  • record - the record (as Row or dict)
  • entity - the entity (pe_id)

update_shared_fields(self, table, record, **data)

source code 

Update the shared fields in data in all super-entity rows linked with this record.

Parameters:
  • table - the table
  • record - a record, record ID or a query
  • data - the field/value pairs to update

permitted_facilities(self, table=None, error_msg=None, redirect_on_error=True, facility_type=None)

source code 

If there are no facilities that the user has permission for, prevents create & update of records in table & gives a warning if the user tries to.

Parameters:
  • table - the table or table name
  • error_msg - error message
  • redirect_on_error - whether to redirect on error
  • facility_type - restrict to this particular type of facilities (a tablename)

permitted_organisations(self, table=None, error_msg=None, redirect_on_error=True)

source code 

If there are no organisations that the user has update permission for, prevents create & update of a record in table & gives an warning if the user tries to.

Parameters:
  • table - the table or table name
  • error_msg - error message
  • redirect_on_error - whether to redirect on error

root_org(self)

source code 

Return the current user's root organisation ID or None

root_org_name(self)

source code 

Return the current user's root organisation name or None

filter_by_root_org(self, table)

source code 

Function to return a query to filter a table to only display results for the user's root org OR record with no root org

To Do: Restore Realms and add a role/functionality support for Master Data Then this function is redundant


Class Variable Details

S3_SYSTEM_ROLES

Value:
Storage(ADMIN= "ADMIN", AUTHENTICATED= "AUTHENTICATED", ANONYMOUS= "AN\
ONYMOUS", EDITOR= "EDITOR", MAP_ADMIN= "MAP_ADMIN", ORG_ADMIN= "ORG_AD\
MIN", ORG_GROUP_ADMIN= "ORG_GROUP_ADMIN",)

   Home       Trees       Indices       Help   
S3
Generated by Epydoc 3.0.1 on Fri Mar 15 08:51:49 2019 http://epydoc.sourceforge.net