zope.security.interfaces¶
Interfaces for security machinery.
Exceptions¶
Extends: zope.interface.common.interfaces.IException
Some user wasn’t allowed to access a resource
- interface zope.security.interfaces.IForbidden[source]¶
Extends: zope.interface.common.interfaces.IException
- exception zope.security.interfaces.Forbidden[source]¶
A resource cannot be accessed under any circumstances
- interface zope.security.interfaces.IForbiddenAttribute[source]¶
Extends: zope.security.interfaces.IForbidden, zope.interface.common.interfaces.IAttributeError
Utilities¶
- interface zope.security.interfaces.ISecurityChecking[source]¶
Public security API.
- checkPermission(permission, object, interaction=None)[source]¶
Return whether security policy allows permission on object.
‘permission’ is permission name.
‘object’ is the object being accessed according to the permission.
‘interaction’ is an interaction, providing access to information such as authenticated principals. If it is None, the current interaction is used.
- interface zope.security.interfaces.IChecker[source]¶
Security-proxy plugin objects that implement low-level checks
The checker is responsible for creating proxies for operation return values, via the proxy method.
There are check_getattr() and check_setattr() methods for checking getattr and setattr, and a check() method for all other operations.
The check methods may raise errors. They return no value.
Example (for __getitem__):
checker.check(ob, “__getitem__”) return checker.proxy(ob[key])
- check_getattr(ob, name)[source]¶
Check whether attribute access is allowed.
May raise Unauthorized or Forbidden. Returns no value.
If a checker implements __setitem__, then __setitem__ will be called rather than check_getattr to check whether an attribute access is allowed. This is a hack that allows significantly greater performance due to the fact that low-level operator access is much faster than method access.
- check_setattr(ob, name)[source]¶
Check whether attribute assignment is allowed.
May raise Unauthorized or Forbidden. Returns no value.
- check(ob, operation)[source]¶
Check whether operation is allowed.
The operation name is the Python special method name, e.g. “__getitem__”.
May raise Unauthorized or Forbidden. Returns no value.
If a checker implements __setitem__, then __setitem__ will be called rather than check to check whether an operation is allowed. This is a hack that allows significantly greater performance due to the fact that low-level operator access is much faster than method access.
- proxy(value)[source]¶
Return a security proxy for the value.
If a checker implements __getitem__, then __getitem__ will be called rather than proxy to proxy the value. This is a hack that allows significantly greater performance due to the fact that low-level operator access is much faster than method access.
- interface zope.security.interfaces.INameBasedChecker[source]¶
Extends: zope.security.interfaces.IChecker
Security checker that uses permissions to check attribute access.
Principals¶
- interface zope.security.interfaces.IInteraction[source]¶
A representation of an interaction between some actors and the system.
- participations¶
An iterable of participations.
- interface zope.security.interfaces.IParticipation[source]¶
- interaction¶
The interaction
- principal¶
The authenticated principal
- interface zope.security.interfaces.IInteractionManagement[source]¶
Interaction management API.
Every thread has at most one active interaction at a time.
- newInteraction(participation=None)[source]¶
Start a new interaction.
If participation is not None, it is added to the new interaction.
Raises an error if the calling thread already has an interaction.
- interface zope.security.interfaces.IPrincipal[source]¶
Principals are security artifacts that execute actions in a security environment.
The most common examples of principals include user and group objects.
It is likely that IPrincipal objects will have associated views used to list principals in management interfaces. For example, a system in which other meta-data are provided for principals might extend IPrincipal and register a view for the extended interface that displays the extended information. We’ll probably want to define a standard view name (e.g. ‘inline_summary’) for this purpose.
- id¶
Id
The unique identification of the principal.
- title¶
Title
The title of the principal. This is usually used in the UI.
- description¶
Description
A detailed description of the principal.
- interface zope.security.interfaces.IGroupAwarePrincipal[source]¶
Extends: zope.security.interfaces.IPrincipal
Group aware principal interface Extends IPrincipal to contain group information.
- groups¶
An iterable of groups to which the principal directly belongs
- interface zope.security.interfaces.IGroupClosureAwarePrincipal[source]¶
Extends: zope.security.interfaces.IGroupAwarePrincipal
- allGroups¶
An iterable of the full closure of the principal’s groups.
- interface zope.security.interfaces.IGroup[source]¶
Extends: zope.security.interfaces.IPrincipal
Group of principals
- interface zope.security.interfaces.IMemberGetterGroup[source]¶
Extends: zope.security.interfaces.IGroup
a group that can get its members
- interface zope.security.interfaces.IMemberAwareGroup[source]¶
Extends: zope.security.interfaces.IMemberGetterGroup
a group that can both set and get its members.