gae-init/gae-init — pull request #113 by joernhees (2014-03-11 03:44:08+00:00)
Title: methods kwd for permission_required decorator

This change makes it easy to use the `permission_required`
decorator for the often occurring use case of allowing
read-access while restricting write-access.

If `methods` is specified, the decorator will only enforce the given
permission for requests with a `method` as in `methods`
(e.g., `@auth.permission_required('foo_w', methods=['POST'])` will
only check the user for permission `'foo_w'` in POST requests
but won't restrict other requests).
If `methods` is `None` (default), the permissions will be enforced
on all requests regardless of their method.

This enhanced version of the decorator can be combined with
the old one as in the example below. This only allows access to
`endpoint` in GET requests if the user has `'foo_r'` permission.
For POST requests the user needs both `'foo_r'` and `'foo_w'`:
```python
@app.route('/endpoint/')
@auth.permission_required('foo_r')
@auth.permission_required('foo_w', methods=['POST'])
def endpoint():
pass
```
For the typical usecase of allowing everyone to read: just
leave out the second line.
Read for every logged in user: replace the second line with
`@auth.login_required`.

The order of the statements is not important as the permissions
are wrapped around each other. All of the permission guards have to
be passed in order to reach `endpoint`. Passing one of them does
**not** skip the others.