Package: horae.auth
IntroductionThehorae.authpackage provides a pluggable users and groups architecture for the Horae
resource planning system and includes the following functionality:Provides an authenticator and session credentials plugin usingzope.pluggableauthDefines default roles and permissions for HoraeDefines generic interfaces for users and groups and hooks for additional packages to provide themProvides basic login and logout views based onhorae.layoutSharingAuthenticator and session credentials pluginBoth plugins are defined inhorae.auth.authand setup by thehorae.auth.auth.setup_authenticationfunction. To use the plugins they have to be registered with the grok application which the following
example illustrates:import grok
from zope.app.authentication.authentication import (
    PluggableAuthentication)
from zope.app.security.interfaces import IAuthentication

from horae.auth import auth

class SampleApplication(grok.Application):
    grok.local_utility(PluggableAuthentication,
                       provides=IAuthentication,
                       setup=auth.setup_authentication)Roles and permissionsThe following default permissions are defined byhorae.auth:ViewPermission required to view an objectEditPermission required to edit an objectDeletePermission required to delete an objectViewHistoryPermission required to view the history of an objectAddClientPermission required to add a clientAddProjectPermission required to add a projectAddMilestonePermission required to add a milestoneAddTicketPermission required to add a ticketChangeTicketPermission required to change a ticketViewHiddenPropertiesPermission required to view hidden propertiesManageManagement permissionManageGroupsPermission required to manage groupsManageUsersPermission required to manage usersSharingPermission required to share objectsBased on those permissions the following roles are defined:ManagerView, Edit, Delete, ViewHistory, AddClient, AddProject, AddMilestone, AddTicket, ChangeTicket, ViewHiddenProperties, Manage, ManageGroups, ManageUsers, SharingAdministratorView, Edit, Delete, ViewHistory, AddClient, AddProject, AddMilestone, AddTicket, ChangeTicket, ViewHiddenProperties, ManageUsers, SharingOwnerView, Edit, ManageMemberAssigned to every userReaderView, ViewHistoryEditorView, Edit, ViewHistory, ChangeTicketContributorView, Edit, Delete, AddClient, AddProject, AddMilestone, AddTicket, ViewHistory, ChangeTicketTicketEditorView, AddTicket, ViewHistory, ChangeTicketResponsibleView, Edit, ViewHistory, ChangeTicketGeneric interfaces and hooksThe main interfaces defined byhorae.authare:horae.auth.interfaces.IUserhorae.auth.interfaces.IGrouphorae.auth.interfaces.IUserProviderhorae.auth.interfaces.IGroupProviderhorae.authdoes not provide any implementation of those interfaces which is done by
packages likehorae.usersandgroups.
This architecture makes it possible to quite easily plug in new user and group sources
such as LDAP[1].As mentioned above a sample implementation may be found in the packagehorae.usersandgroupswhich provides persistent users
and groups and basic CRUD[2]functionality.SharingMarking objects as shareable (implementinghorae.auth.interfaces.IShareable)
makes it possible to grant roles for users and groups on the specific object. The roles
are inherited from parent objects by default making it possible to grant a role for an
object and all its childs. Role inheritance may be disabled individually for shareable
objects. The roles available to be granted are defined by named utilities implementinghorae.auth.interfaces.ISelectableRoleProvider. The default implementation is located
athorae.auth.authand looks like this:from horae.auth import interfaces

class SelectableRoleProvider(grok.GlobalUtility):
    """ Provider for selectable roles
    """
    grok.implements(interfaces.ISelectableRoleProvider)
    grok.provides(interfaces.ISelectableRoleProvider)
    grok.name('horae.auth.selectableroles')

    def roles(self):
        """ Returns a list of role names
        """
        return ['horae.Reader', 'horae.Editor', 'horae.Contributor', 'horae.TicketEditor']and thus makes the rolesReader,Editor,ContributorandTicketEditoravailable
to be granted for shareable objects. To make other roles available additional providers may be
registered:class SampleSelectableRoleProvider(grok.GlobalUtility):
    """ Provider for selectable roles
    """
    grok.implements(interfaces.ISelectableRoleProvider)
    grok.provides(interfaces.ISelectableRoleProvider)
    grok.name('horae.sampleadditionalroles.selectableroles')

    def roles(self):
        """ Returns a list of role names
        """
        return ['horae.SampleRole1', 'horae.SampleRole2']Enabling the sharing functionality on an object is simply done by letting it implement the marker
interfacehorae.auth.interfaces.IShareable. This may be done by having the class directly
implement the interface:class MyShareableContent(grok.Model):
    grok.implements(interfaces.IShareable)or by doing so from outside the class definition which is especially usable if the desired class
is part of a module not related tohorae.auth:from zope.interface import classImplements

from some.other.unrelated.module import OtherContent

classImplements(OtherContent, interfaces.IShareable)DependenciesHoraehorae.cachehorae.corehorae.layoutThird partygrokzope.pluggableauth[1]Lightweight Directory Access Protocol[2]CreateReadUpdateDelete.Changelog1.0a1 (2012-01-16)Initial release