Source code for wheezy.security.authorization

""" ``authorization`` module.
"""

from wheezy.security.errors import SecurityError


def authorized(wrapped=None, roles=None):
    """Demand the user accessing protected resource is
    authenticated and optionally in one of allowed ``roles``.

    Requires wrapped object to provide attribute principal.

    ``roles`` - a list of authorized roles.

    Here is an example::

        from wheezy.security.principal import Principal

        class Context(object):
            principal = None

            @authorized
            def op_a(self):
                return True

            @authorized(roles=('operator',))
            def op_b(self):
                return True
    """

    def decorate(func):
        if roles:

            def check_roles(context, *args, **kwargs):
                principal = context.principal
                if principal:
                    principal_roles = principal.roles
                    for role in roles:
                        if role in principal_roles:
                            break
                    else:
                        raise SecurityError("Not authorized.")
                    return func(context, *args, **kwargs)
                else:
                    raise SecurityError("Not authorized.")

            return check_roles
        else:

            def check_authenticated(context, *args, **kwargs):
                if context.principal:
                    return func(context, *args, **kwargs)
                else:
                    raise SecurityError("Not authorized.")

            return check_authenticated

    if wrapped is None:
        return decorate
    else:
        return decorate(wrapped)