okfn/ckan — pull request #1210 by amercader (2013-08-27 15:39:46+00:00)
Title: Auth checks improvements for logged in users

**Goal:** Decouple auth functions from the Pylons environment and provide an automated higher level check for whether a logged in user has been provided.

Auth functions or the auth helpers that they call should not rely at all on any Pylons context object (`c`) property. The `context` object should provide all information necessary: a `user` property (unicode) and an `auth_user_obj` property (User object).

* If the `auth_user_obj` is None, the request will be assumed to anonymous (ie not a logged in user). In this case, the `user` property can still be set, as the controllers may pass the IP of the requester. This can still be used when creating the revision.

* If the `auth_user_obj` is set, this will be assumed to be a validated user (ie it exists on the db)

To ensure that `auth_user_obj` is always passed on the `context` to the auth functions, `check_access` will add it if not already present. This may cause duplicate calls on a first stage, as the `BaseController` already performs this check (to set `c.userobj`), but this can be avoided if the controllers use `c.userobj` to set `context['auth_user_obj']`. `get_action` will be also modified to add `auth_user_obj` to the context automatically if not there.

Once this is in place, all auth functions except those in `get.py` will be assumed to require a logged in user to be performed. If `new_autz.is_authorized` finds that the context does not provide a logged in user and there isn’t a flag to allow anon requests it will directly raise a `NotAuhtorized` exception. Of course there will be exceptions on both sides, and extensions may will to change the default auth setting, so decorators will be provided to allow or disallow anonymous requests on auth functions.