Pylons/pyramid — Issue #378: matching views according to permissions
Author: reydelamirienda
Created: 2011-12-19 16:10:16+00:00
State: open

Currently, a view conflict is thrown when you try to configure two views like this:

config.add_view(private_profile_view, permission='owner', context='ProtectedResource')
config.add_view(private_profile_view, permission='friend', context='ProtectedResource')

My current solution is to create a custom_predicate to do the matching and avoid ambiguities.

def filter_permissions(has=(), has_not=()):
def pred(info, request):
return all(has_permission(p, request.context, request) for p in has) \
and not any(has_permission(p, request.context, request) for p in has_not)
return pred

config.add_view(private_profile_view,
custom_predicates=(filter_permissions(has=('owner',), has_not=('friend')),),
context='ProtectedResource')
config.add_view(private_profile_view,
custom_predicates=(filter_permissions(has=('friend',)),),
permission='friend', context='ProtectedResource')

It would be nice if pyramid could route the response to either view based on the permissions of the logged in user.

There's the potential for ambiguities if the user has both owner and friend permission (or for example with ALL_PERMISSIONS). In that case we'd need to define some sort of permission priority.

I hope my input helps, pyramid is so far great!