lino.core.permissions

Core tools of Lino's permission system.

(This module's source code is available here.)

Functions

add_requirements(obj, *args)

Add the specified requirements to obj.

make_permission_handler(*args, **kw)

Return a function that will test whether permission is given or not.

make_permission_handler_(elem, actor, ...[, ...])

make_view_permission_handler(*args, **kw)

Similar to make_permission_handler(), but for static view permissions which don't have an object nor states.

make_view_permission_handler_(actor, ...)

Classes

Permittable()

Base class for objects that have view permissions control.

class lino.core.permissions.Permittable

Bases: object

Base class for objects that have view permissions control. Inherited by lino.core.actions.Action, lino.utils.jsgen.VisibleComponent and lino.core.actors.Actor (though the latter is a special case since actors never get instantiated).

required_roles = {}

A set of user roles required to view this actor or action.

Each element of the set must be either a subclass of lino.core.roles.UserRole or a tuple thereof. An empty set means that the actor is visible to everybody, including anonymous users.

The default value on actors is a set with a single element SiteUser, which means that the actor is available only for authenticated users.

Note that this is being ignored when user_types_module is empty.

Examples of recommended ways for specifying this attribute:

# for everybody
required_roles = set()

# only for office users:
required_roles = dd.login_required(OfficeUser)

# only for users who are BOTH OfficeUser AND SiteStaff:
required_roles = dd.login_required(OfficeUser, SiteStaff)

# only for users who are EITHER OfficeUser OR SiteStaff:
required_roles = dd.login_required((OfficeUser, SiteStaff))
workflow_state_field = None

The name of the field that contains the workflow state of an object. Subclasses may override this.

workflow_owner_field = None

The name of the field that contains the user who is considered to own an object when Rule.owned_only is checked.

debug_permissions = False

Whether to log Permission debug messages for this action.

lino.core.permissions.add_requirements(obj, *args)

Add the specified requirements to obj. obj can be an lino.core.actors.Actor or any Permittable. Application code uses this indirectly through the shortcut methods lino.core.actors.Actor.add_view_requirements() or a Permittable.add_requirements().

lino.core.permissions.make_permission_handler(*args, **kw)

Return a function that will test whether permission is given or not.

elem is not used (either an Action or a Permittable.)

actor is who contains the workflow state field

readonly

debug_permissions

The generated function will always expect three arguments user, obj and state. The latter two may be None depending on the context (for example a read_required is expected to not test on obj or state because these values are not known when generating the linoweb.js files.).

The remaining keyword arguments are aka "requirements":

states

List of strings naming the user groups for which membership is required.

allow

An additional custom permission handler

lino.core.permissions.make_view_permission_handler(*args, **kw)

Similar to make_permission_handler(), but for static view permissions which don't have an object nor states.