[Zope-Checkins] CVS: Zope3/lib/python/Zope/Security - IChecker.py:1.1.2.1

[Jim Fulton]

Update of /cvs-repository/Zope3/lib/python/Zope/Security
In directory cvs.zope.org:/tmp/cvs-serv12817

Added Files:
      Tag: SecurityProxy-branch
	IChecker.py 
Log Message:
Initial checkin to communicate interface ideas.


=== Added File Zope3/lib/python/Zope/Security/IChecker.py ===
##############################################################################
#
# Copyright (c) 2001, 2002 Zope Corporation and Contributors.
# All Rights Reserved.
# 
# This software is subject to the provisions of the Zope Public License,
# Version 2.0 (ZPL).  A copy of the ZPL should accompany this distribution.
# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY AND ALL EXPRESS OR IMPLIED
# WARRANTIES ARE DISCLAIMED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
# WARRANTIES OF TITLE, MERCHANTABILITY, AGAINST INFRINGEMENT, AND FITNESS
# FOR A PARTICULAR PURPOSE.
# 
##############################################################################
"""

$Id: IChecker.py,v 1.1.2.1 2002/04/17 21:56:33 jim Exp $
"""

from Interface import Interface

class IChecker(Interface):
    """Security-proxy plugin objects that implement low-level checks

    The checker is responsible for checking and creating proxies for
    operation return values, via the checkValue method.

    There are individual check_* methods for checking individual
    operations.

    Note that two different naming conventions are used to separate
    the individual operation checkers from other methods.
    """

    def check_getattr(ob, name):
        """Check whether attribute access is allowed

        Returns None or a non-None boolean value. None means we don't
        know. In this case, the caller should do the attribute access
        and call checkValue with the value and a false value::

           v = getattr(ob, name)
           v = Wrapper(v, ob, name=name)
           v = checkValue(v, 0)
           return v

        If a non-None false value is returned, then access should be
        denied.

        If a true value is returned, then the attribute access should
        be performed and the attribute value should be passed to
        checkValue along with a true value::

           v = getattr(ob, name)
           v = Wrapper(v, ob, name=name)
           v = checkValue(v, 1)
           return v

        """

    def check_getitem(ob, key):
        """Check whether an item access is allowed

        Return a boolean value indicating whether access is allowed.
        """

    def checkValue(value, allowed_by_default):
        """Check access to a value

        The value must have a __permission__ attribute unless
        allowed_by_default is true. If the value has a __permission__
        attribute, then the permission is checked on the object.

        If access is unallowed, then an exception is raised. This may
        be an Unauthorized exception, if the current security context
        doesn't have the necessary permission. A Forbidden exception
        is raised if there is no __permission__ attribute and not
        allowed_by_default.

        If access is allowed, then the value is returned, wrapped in a
        security proxy, if necessary.
        """