[Zope3-Users] questions on the security framework

[Sven Schomaker]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello dear list people,

I'm currently about to evaluate z3 to be able
to suit the needs I face in a wider project
that is about to be started out by me.

So far z3 seems quite promising but there are
still some questions to be solved before being
able to assure (almost) risk-free use of z3 and
I hope you are able to answer some of my questions
(or at least give me a hint about where to look
about for answers).

To get somewhat familiar with the new z3
framework I read the z3 book and started out
to code the message board in an slightly extended
fashion. Now that I'm on the job to implement
some fancy security system on the message board
I'm admittedly stuck a bit and wonder how to do it.


So here is what I intend to do:
- -----------------------------------------

A message board can contain announcements
and topics. Topics are actually nothing more
than renamed messages and can contain replies.

Moderators/Managers are supposed to be able
to post announcements. Valid users of the
message board should be able to post topics,
messages and replies (at this point it doesn't
seem to matter how they become valid users).

If a message/topic gets posted, it is submitted
to the moderator and gets rejected or approved,
i.e. messages are subject to a specific workflow.

And here are my questions:
- --------------------------------------

Since the message board is a container and the
framework uses __setitem__ to add new objects
to the container, how would one distinguish the
permissions to add an announcement from the
permission to add a topic with zcml or with
explicit python coding.

Another question is about involving the workflow
into the security system. As I was able to determine
there is the possibility to configure permissions
to cause state transitions using zcml. Thats fine
so far, but how would one restrict e.g. the ability
to modify messages once they have been submitted,
i.e. bind the permissions on content-objects to a
specific workflow state?

The next question is whether there is something
like a build in role for the owner of an object or
if there is the notion of ownership at all? For me
this seems to be necessary if one would only grant
permissions to modify an object if he/she is the owner
of that particular object as it has been done in z2.

And last but not least is there the concept of local
roles like it has been in z2?


So far so good, many questions, quite a lot of text
and a good hope that somebody can give me a hint.

Great thanks in advance and a happy new year
to all of you

Sven Schomaker


- --
__________________Addressed by:_________________

Dipl.-Inf. (FH) Sven Holger Cochise Schomaker

Linie M - Metall Form Farbe - GmbH
Industriestraße 8
63674 Altenstadt (Hessen)
Germany

Tel.: +49 6047 97 121
~      +49 179  14 79 309

Mail: sven.schomaker at linie-m.de
~      sven.schomaker at gmx.de

Public Key: hkp://blackhole.pca.dfn.de
~            hkp://pgp.mit.edu

Key ID: D581185EFF60FEA0

Key fingerprint: 28FB 599C 4591 D200 BC69
~                 EB88 D581 185E FF60 FEA0

_______________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iQIVAwUBQdPV5uOT94SY/nWQAQIljRAAq0h+LkMjMTWx9Bw0eT98WXgDUbLhS5q2
/ronx/UuWpcyYLHp210ltXZeICj88fVAzoPdXoTh+A5IPAejY5IUIZCzGLUKM1m/
uVS0lez3aT3bkNibh6KMlgGP8D+ostH3V186ZQJoWg33/rOO9+pfxSfLzBeKl1rI
SHN2wTuVEmvn+kjXoR8SLiaehjQDSObtr6Vq+PEPxB5oxLJHLLbkzwdGbdMtkyDw
ISF+zEgX1G7lgi+rBun78OHJiCpq1gz7bQpc3SRD4Ok6mxM9QhhGpIcidD0tt/0w
vlNFcxIMjQ7jkhRqDAI6Uupz9jmzQmt+YHQoX50aiiiT5/tUQsz2bjk1bk4I1JrQ
vTGpo+nx6XIlWDu57hxnIuT3qeTW9TZus5HubFNbyTKLVEDBOxYo+IDDXxx7pQMh
iX4WPJHft5WIspc31L9sS6lHf/4u+MJZmlcxx5REO09rxX/d1GZq1wXfC08ufh6G
2NRRtY02ltXtUngnG9lkJ3GrsewMU5gnw2pjBXBIlHzPgpK1gH/MsdAFM39V2fXE
4cjLfKdq42Cw7q3slminIn0tr67pPtvUrINioRkUOzp1+F+khUrl24jj4FB8KPkg
vYUqPBjGAe7dqxcuzmPHhpD7OLqjDeWHb/R0RlhrPjUPNtZtXYoX06ZYjO3KXMbZ
2vMXaSREuWQ=
=fmUG
-----END PGP SIGNATURE-----