[Zope] hierarchical roles

[Oliver Frommel]

Hello,

how can I implement a hierarchical group schema by using roles like this?

comp/deptA/subdeptA
    /deptB/subdeptB
          /subdeptC
    ...

for authentication I want to check if someone has a role corresponding to
the name of a containing folder, i.e. editing should be allowed in subdeptC
when someone has either the subdeptC, the deptB or the comp role.

now I understand that it is a different thing to have a folder object called
"deptB" and a role "deptB" - how can I iterate over the parent folders
and check against each role?

if I try this I get an error (trace below ..):
<dtml-in PARENTS>
 <dtml-let item=sequence-item>
  <dtml-if item>
   .<dtml-var "item.id">.
     <dtml-if "AUTHENTICATED_USER.has_role(item.id,this())">
       X
     </dtml-if>
     <br>
   </dtml-if>
 </dtml-let>
</dtml-in>

The error message is:
Error Type: TypeError
Error Value: loop over non-sequence

...
File /home/oliver/Zope/lib/python/DocumentTemplate/DT_Let.py, line 145, in render
    (Object: item=sequence-item)
  File /home/oliver/Zope/lib/python/DocumentTemplate/DT_Util.py, line 321, in eval
    (Object: AUTHENTICATED_USER.has_role(item.id,this()))
  File <string>, line 0, in ?
  File /home/oliver/Zope/lib/pyt


now the output (omitting the  "AUTHENTICATED_USER..." line) shows me that among
the sequence-items there is one object  called <Python Method object ...>
How can I check against this object without using regex or something like that?

Another question is how to clone an existing role into a new one with just
a different ID..


thanks for your help
oliver