Package: collective.powertoken.core
Table of ContentsIntroductionHow to useRegistering more that one actionWhat action is executed?Special parametersFinal security noteAuthorsChangelog0.3.0 (2012-02-15)0.2.0 (2012-01-15)0.1.0 (2012-01-11)IntroductionA product for Plone developers. You will be able to register actions on site’s contents, protected
by asecret token.Using an internal utility, or calling a provided view (@@consume-powertoken) you can run the action you
have configured previously.How to useFirst of all you need the utility:>>> from collective.powertoken.core.interfaces import IPowerTokenUtility
>>> utility = getUtility(IPowerTokenUtility)With this you can register a new action on a site content (for example, a document):>>> token = utility.enablePowerToken(document, 'myMagicAction')Thetokenmust (probably) kept secret, and you must use it has you prefer (for example: develop an
application that send the token by e-mail)You can then execute the given action using the same utility:>>> result = utility.consumeActions(document, token)Or calling the provided view that needtokenandpathparameters, for example:http://myplonesite/@@consume-powertoken?token=aaaa-bbbb-cccc&path=path/to/the/contentTheconsumeActionscan also be called with additionalruntime argumentsthat can be used later
when the action is executed:>>> result = utility.consumeActions(document, token, runtime_parameter1='foo', runtime_parameter2=5.4)Registering more that one actionYou can also register (and then run all of theme) more that one action for a token.>>> token = utility.enablePowerToken(document, 'myMagicAction')
>>> utility.addAction(document, token, 'myMagicAction')
>>> utility.addAction(document, token, 'aDifferentAction')When you consume the token, all registered actions are executed in order.>>> result = utility.consumeActions(document, token)What action is executed?This is only the core package so you need to look for other packages that add possible actions (or develop
your own).When you call:>>> token = utility.enablePowerToken(document, 'myMagicAction', parameter1='foo', parameter2=5)… you are preparing the call for an adapter calledmyMagicAction, saving also additionalconfiguration parametersprovided (in a specialactionobject, see below).
Know that 3rd party adapter can require specific configuration parameters to works properly.WhenconsumeActionsis called, internally a new adapter is searched:>>> from collective.powertoken.core.interfaces import IPowerActionProvider
>>> adapter = getMultiAdapter((document, request),
...                           IPowerActionProvider,
...                           name='myMagicAction')
>>> result = adapter.doAction(action, runtime_parameter1='foo', runtime_parameter2=5.4)What to do with results (you can also don’t provide results) is under your control. Result is always a
Python list with all results from all executed actions.Alist of all know action providersis available online (feel free to contribute and update this page
with your own).Special parametersWhen callingenablePowerTokenand you give additional parameters, they are stored in theactionobject:rolesDefault to empty list. Commonly when you callconsumeActionsyou are performing an action keeping user’s
privileges. Providing there a list of Zope roles will give youthoseroles instead. In this way,
knowing a token, you can commonly perform unauthorized actions.oneTimeDefault to True. When you callconsumeActionsyou commonly execute the action and remove the action
from the action list.
Instead you can configure an action that never expire the token when executed, so you can call it many
times as you want (using the same token every time).paramsDefault is an empty dict, automatically filled with every other keyword argument passed,
commonly used by adapters.Additional advanced, parameters:unrestrictedDefaut: False. Use an unrestricted user, that always pass security check. Please note thatyou commonly don’t need this, just configure wellroles.usernameDefaut: None. When using a different security context, like when using therolesparameter, instead
of the current user’s id (or an empty string when anonymous) you can choose a new one.Final security noteThis product play with Zope security, potentially giving great power to users, simply knowing the secret token.Be careful!AuthorsThis product was developed by RedTurtle Technology team.Changelog0.3.0 (2012-02-15)now you can addruntime parameterswhen consuming actions [keul]updated documentation and fixed from errors [keul]0.2.0 (2012-01-15)added new option:unrestricted(you commonly don’t need this, really) [keul]added new option:username[keul]0.1.0 (2012-01-11)Initial release