gws.base.auth.user

User objects and conversion of provider records to users.

Source code: gws.base.auth.user

Module Contents

class gws.base.auth.user.AdminUser(provider, roles)

Bases: User

Logged-in user with the admin role, allowed everything.

acl_bit(access, obj)

Get the access decision for an object itself, without parents.

Parameters:

  • access – Access mode.

  • obj – The object.

Returns:

gws.c.ALLOW or gws.c.DENY if the object’s permissions decide for one of the user’s roles, None otherwise.

class gws.base.auth.user.AuthorizedUser(provider, roles)

Bases: User

Logged-in user.

gws.base.auth.user.from_dict(provider: gws.AuthProvider, d: dict) → gws.User

Restore a user from a dict created by to_dict.

Returns the guest user if the roles contain guest, an AdminUser if they contain admin and an AuthorizedUser otherwise.

Parameters:

  • provider – The authentication provider of the user.

  • d – The dict.

Returns:

The user.

gws.base.auth.user.from_record(provider: gws.AuthProvider, user_rec: dict) → gws.User

Create a user from a record returned by a provider.

A provider can return an arbitrary dict of values. The entries authToken, displayName, email, localUid, loginName, mfaSecret and mfaUid (or their lowercase forms) are copied to the user. roles and attributes are copied as well, other entries are stored in the user’s data dict, with common LDAP attribute aliases (for example cn and commonName) filled in both ways.

The role all is always added. A record with the role guest returns the guest user, one with admin creates an AdminUser; all other users get the role user. loginName and email fall back to login and email in the data, localUid to the login name, displayName to the login name.

Parameters:

  • provider – The authentication provider.

  • user_rec – The record.

Returns:

The user.

Raises:

gws.Error – If the record has neither a local uid nor a login name.

class gws.base.auth.user.GuestUser(provider, roles)

Bases: User

Guest user, used for requests without a login.

isGuest = True

The user is the guest user.

class gws.base.auth.user.NobodyUser(provider, roles)

Bases: User

User that is denied everything.

acl_bit(access, obj)

Get the access decision for an object itself, without parents.

Parameters:

  • access – Access mode.

  • obj – The object.

Returns:

gws.c.ALLOW or gws.c.DENY if the object’s permissions decide for one of the user’s roles, None otherwise.

class gws.base.auth.user.Props(*args, **kwargs)

Bases: gws.Props

Object properties.

attributes: dict
displayName: str
class gws.base.auth.user.SystemUser(provider, roles)

Bases: User

System user, allowed everything.

acl_bit(access, obj)

Get the access decision for an object itself, without parents.

Parameters:

  • access – Access mode.

  • obj – The object.

Returns:

gws.c.ALLOW or gws.c.DENY if the object’s permissions decide for one of the user’s roles, None otherwise.

gws.base.auth.user.to_dict(usr) → dict

Convert a user to a dict.

Parameters:

usr – The user.

Returns:

A dict with the user fields, attributes, data, roles and uid.

class gws.base.auth.user.User(provider, roles)

Bases: gws.User

Base user.

Holds the user fields, roles and attributes, and implements the permission checks. Subclasses for special users override the permission decision.

attributes

Public user attributes, sent to the client.

authProvider

The provider that created the user.

data

Private user data from the provider.

isGuest = False

The user is the guest user.

roles

User roles.

uid = ''

Global user uid, made of the provider uid and the local uid.

acl_bit(access, obj)

Get the access decision for an object itself, without parents.

Parameters:

  • access – Access mode.

  • obj – The object.

Returns:

gws.c.ALLOW or gws.c.DENY if the object’s permissions decide for one of the user’s roles, None otherwise.

acquire(uid=None, classref=None, access=None)

Get an object by uid, if the user can access it.

Parameters:

  • uid – Object uid.

  • classref – Class reference. If provided, the object must match it.

  • access – Access mode, Access.read if omitted.

Returns:

The object, or None if it does not exist or the user may not access it.

can(access, obj, *context)

Check if the user can access an object.

If the object’s permissions do not decide, the context objects are checked in turn, then the parents of the last checked object.

Parameters:

  • access – Access mode.

  • obj – The object.

  • *context – Further objects to check, before the parents.

Returns:

True if access is granted.

can_create(obj, *context)

Check if the user has the create permission on an object.

Parameters:

  • obj – The object.

  • *context – Further objects to check, before the parents.

Returns:

True if access is granted.

can_delete(obj, *context)

Check if the user has the delete permission on an object.

Parameters:

  • obj – The object.

  • *context – Further objects to check, before the parents.

Returns:

True if access is granted.

can_edit(obj, *context)

Check if the user has any of the write, create or delete permissions on an object.

Parameters:

  • obj – The object.

  • *context – Further objects to check, before the parents.

Returns:

True if access is granted.

can_read(obj, *context)

Check if the user has the read permission on an object.

Parameters:

  • obj – The object.

  • *context – Further objects to check, before the parents.

Returns:

True if access is granted.

can_use(obj, *context)

Check if the user can use an object, which requires the read permission.

Parameters:

  • obj – The object.

  • *context – Further objects to check, before the parents.

Returns:

True if access is granted.

can_write(obj, *context)

Check if the user has the write permission on an object.

Parameters:

  • obj – The object.

  • *context – Further objects to check, before the parents.

Returns:

True if access is granted.

has_role(role)

Check if the user has a role.

Parameters:

role – Role name.

Returns:

True if the user has the role.

props(user)

Generate a Props struct for this object.

Do not call this method directly, use gws.props_of instead, which also checks permissions.

Parameters:

user – The user for which the props should be generated.

Returns:

A Props object or a dict. Nested objects are converted to props as well.

require(uid=None, classref=None, access=None)

Get an object by uid and fail if it is not found or not accessible.

Parameters:

  • uid – Object uid.

  • classref – Class reference. If provided, the object must match it.

  • access – Access mode, Access.read if omitted.

Returns:

The object.

Raises:
require_layer(uid=None)

Get a layer the user can read.

Parameters:

uid – Layer uid.

Returns:

The layer.

Raises:
require_project(uid=None)

Get a project the user can read.

Parameters:

uid – Project uid.

Returns:

The project.

Raises: