Metadata-Version: 1.0
Name: tg.ext.repoze.who
Version: 0.1-r11
Summary: tg.ext.repoze.who are repoze.who plugins for TurboGears 2
Home-page: http://www.repoze.org
Author: Chris McDonough, Florent Aide, Christopher Perkins
Author-email: repoze-dev@lists.repoze.org
License: BSD-derived (http://www.repoze.org/LICENSE.txt)
Description: Sample repoze.who middleware config and plugins for TG2.  This package
        depends on repoze.who 0.8 or better.
        
        Trying it Out
        
        - Install TG2 into a virtualenv.
        
        - Install this package into the same virtualenv via "setup.py
        install".
        
        - Create a TG2 quickstart project using the virtualenv's python.
        
        - In the development.ini of you project...
        
        - In the config.middleware module of your project, add the following
        just under "CUSTOM MIDDLEWARE HERE"::
        
        # CUSTOM MIDDLEWARE HERE (filtered by error handling middlewares)
        
        from tgrepozewho.middleware import make_who_middleware
        app = make_who_middleware(app, config, User, user_criterion, user_id_col,
        DBSession)
        
        - Add the following definitions in you model.__init__::
        
        groups_table = Table('tg_group', metadata,
        Column('group_id', Integer, primary_key=True),
        Column('group_name', Unicode(16), unique=True),
        Column('display_name', Unicode(255)),
        Column('created', DateTime, default=datetime.datetime.now)
        )
        
        users_table = Table('tg_user', metadata,
        Column('user_id', Integer, primary_key=True),
        Column('user_name', Unicode(16), unique=True),
        Column('email_address', Unicode(255), unique=True),
        Column('display_name', Unicode(255)),
        Column('password', Unicode(40)),
        Column('created', DateTime, default=datetime.datetime.now)
        )
        
        permissions_table = Table('tg_permission', metadata,
        Column('permission_id', Integer, primary_key=True),
        Column('permission_name', Unicode(16), unique=True),
        Column('description', Unicode(255))
        )
        
        user_group_table = Table('tg_user_group', metadata,
        Column('user_id', Integer, ForeignKey('tg_user.user_id',
        onupdate="CASCADE", ondelete="CASCADE")),
        Column('group_id', Integer, ForeignKey('tg_group.group_id',
        onupdate="CASCADE", ondelete="CASCADE"))
        )
        
        group_permission_table = Table('tg_group_permission', metadata,
        Column('group_id', Integer, ForeignKey('tg_group.group_id',
        onupdate="CASCADE", ondelete="CASCADE")),
        Column('permission_id', Integer, ForeignKey('tg_permission.permission_id',
        onupdate="CASCADE", ondelete="CASCADE"))
        )
        
        # identity model
        class Group(object):
        """An ultra-simple group definition.
        """
        def __repr__(self):
        return '<Group: name=%s>' % self.group_name
        
        class User(object):
        """Reasonably basic User definition. Probably would want additional
        attributes.
        """
        def __repr__(self):
        return '<User: email="%s", display name="%s">' % (
        self.email_address, self.display_name)
        
        def permissions(self):
        perms = set()
        for g in self.groups:
        perms = perms | set(g.permissions)
        return perms
        permissions = property(permissions)
        
        def by_email_address(klass, email):
        """A class method that can be used to search users
        based on their email addresses since it is unique.
        """
        session = DBSession()
        return session.query(klass).filter(klass.email_address==email).first()
        
        by_email_address = classmethod(by_email_address)
        
        def by_user_name(klass, username):
        """A class method that permits to search users
        based on their user_name attribute.
        """
        session = DBSession()
        return session.query(klass).filter(klass.user_name==username).first()
        
        by_user_name = classmethod(by_user_name)
        
        def _set_password(self, password):
        """encrypts password on the fly using the encryption
        algo defined in the configuration
        """
        algorithm = config.get('authorize.hashmethod', None)
        self._password = self.__encrypt_password(algorithm, password)
        
        def _get_password(self):
        """returns password
        """
        return self._password
        
        password = property(_get_password, _set_password)
        
        def __encrypt_password(self, algorithm, password):
        """Hash the given password with the specified algorithm. Valid values
        for algorithm are 'md5' and 'sha1'. All other algorithm values will
        be essentially a no-op."""
        hashed_password = password
        
        if isinstance(password, unicode):
        password_8bit = password.encode('UTF-8')
        
        else:
        password_8bit = password
        
        if "md5" == algorithm:
        hashed_password = md5.new(password_8bit).hexdigest()
        
        elif "sha1" == algorithm:
        hashed_password = sha.new(password_8bit).hexdigest()
        
        # TODO: re-add the possibility to provide own hasing algo
        # here... just get the real config...
        
        #elif "custom" == algorithm:
        #    custom_encryption_path = turbogears.config.get(
        #        "identity.custom_encryption", None )
        #
        #    if custom_encryption_path:
        #        custom_encryption = turbogears.util.load_class(
        #            custom_encryption_path)
        
        #    if custom_encryption:
        #        hashed_password = custom_encryption(password_8bit)
        
        # make sure the hased password is an UTF-8 object at the end of the
        # process because SQLAlchemy _wants_ a unicode object for Unicode columns
        if not isinstance(hashed_password, unicode):
        hashed_password = hashed_password.decode('UTF-8')
        
        return hashed_password
        
        def validate_password(self, password):
        """Check the password against existing credentials.
        """
        algorithm = config.get('authorize.hashmethod', None)
        return self.password == self.__encrypt_password(algorithm, password)
        
        class Permission(object):
        """A relationship that determines what each Group can do
        """
        pass
        
        mapper(User, users_table,
        properties=dict(_password=users_table.c.password))
        
        mapper(Group, groups_table,
        properties=dict(users=relation(User,
        secondary=user_group_table, backref='groups')))
        
        mapper(Permission, permissions_table,
        properties=dict(groups=relation(Group,
        secondary=group_permission_table, backref='permissions')))
        
        
        - Add the following import in you controllers.root file::
        
        from tgrepozewho import authorize
        
        - Add the following methods to your controllers.root:RootController
        class::
        
        @expose('whotg.templates.about')
        @authorize.require(authorize.has_permission('manage'))
        def manage_permission_only(self, **kw):
        return dict(now=now, page='about')
        
        @expose('whotg.templates.about')
        @authorize.require(authorize.is_user('editor'))
        def editor_user_only(self, **kw):
        return dict(now=now, page='about')
        
        @expose('whotg.templates.login')
        def login(self, **kw):
        came_from = kw.get('came_from', '/')
        return dict(now=now, page='login', header=lambda *arg: None,
        footer=lambda *arg: None, came_from=came_from)
        
        
        
        - Add the following template as "login.html" into your project's
        'templates' directory::
        
        <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
        "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
        <html xmlns="http://www.w3.org/1999/xhtml"
        xmlns:py="http://genshi.edgewall.org/"
        xmlns:xi="http://www.w3.org/2001/XInclude">
        
        <xi:include href="master.html" />
        
        <head>
        <meta content="text/html; charset=UTF-8" http-equiv="content-type" py:replace="''"/>
        <title>Login Form</title>
        </head>
        
        <body>
        
        <form action="/login_handler?came_from=${came_from}" method="POST">
        Login: <input type="text" name="login"></input><br/>
        Password: <input type="password" name="password"></input><br/>
        <input type="submit" name="submit"/>
        </form>
        
        </body>
        </html>
        
        - Setup you database config in the normal way by tweaking the development.ini file
        
        - Create the necessary tables by using::
        
        paster setup-app development.ini
        
        - Create a user manually in your database
        
        - Create a group (any name), and a permission named "manage", link this permission
        to the group you just created and also add a user to your group.
        
        - Create another user which is in no group but is named "editor"
        
        - Start the project's server via paster serve::
        
        paster server --reload development.ini
        
        - Visit http://localhost:8080/editor_user_only in your browser.  You
        will be presented with the login form.  The "right"
        username/password combination is "editor/editpass" (this user has the
        username 'editor').  Submitting this set of credentials will show
        the about page.  Any other username/password combination will
        result in the user being presented the login form again.  Note that
        once you've obtained the credentials for the first time, if you
        visit the /editor_user_only page again, you are not asked to
        reauthenticate.  Log out forcibly by visiting
        http://localhost:8080/logout_handler.
        
        - Visit http://localhost:8080/manage_permission_only in your browser.
        You will be presented with the login form.  The "right"
        username/password combination is "manager/managepass" (this user
        possesses the manage permission).  Submitting this set of
        credentials will show the about page.  Any other username/password
        combination will result in the user being presented the login form
        again.  Note that if you've authenticated as the 'editor' user, and
        you visit the /manage_permission_only page, you will be logged out
        and asked for credentials (editors cannot see this page).  Note
        that once you've obtained the credentials for the first time, if
        you visit the /manage_permission_only page again, you are not asked
        to reauthenticate.  Log out forcibly by visiting
        http://localhost:8080/logout_handler.
        
        Misc
        
        If you start "paster serve" in a shell with the WHO_LOG environment
        variable set to "1", you will see repoze.who logging output on the
        console.
        
        Not yet finished
        
        You can run the unit tests by using "python setup.py test" in the
        source package.
        
        
        
Keywords: web application server wsgi tg2
Platform: UNKNOWN
Classifier: Development Status :: 1 - Planning
Classifier: Intended Audience :: Developers
Classifier: Programming Language :: Python
Classifier: Topic :: Internet :: WWW/HTTP
Classifier: Topic :: Internet :: WWW/HTTP :: Dynamic Content
Classifier: Topic :: Internet :: WWW/HTTP :: WSGI
Classifier: Topic :: Internet :: WWW/HTTP :: WSGI :: Application
