lino.core.permissions¶

Core tools of Lino’s permission system.

Functions

`add_requirements`(obj, *args)	Add the specified requirements to obj.
`make_permission_handler`(args, *kw)	Return a function that will test whether permission is given or not.
`make_permission_handler_`(elem, actor, ...[, ...])
`make_static_permission_handler`(args, *kw)	Similar to `make_permission_handler()`, but for static view permissions, which don't have an object nor states.
`make_static_permission_handler_`(actor, ...)

Classes

Permittable()

Base class for objects that have view permissions control.

class lino.core.permissions.Permittable¶

Bases: object

Base class for objects that have view permissions control. Inherited by lino.core.actions.Action, lino.utils.jsgen.VisibleComponent and lino.core.actors.Actor (though the latter is a special case since actors never get instantiated).

required_roles = {}¶

A set of user roles required to view this actor or action.

Each element of the set must be either a subclass of lino.core.roles.UserRole or a tuple thereof. An empty set means that the actor is visible to everybody, including anonymous users.

The default value on actors is a set with a single element SiteUser, which means that the actor is available only for authenticated users.

Note that this is being ignored when user_types_module is empty.

Examples of recommended ways for specifying this attribute:

# for everybody
required_roles = set()

# only for office users:
required_roles = dd.login_required(OfficeUser)

# only for users who are BOTH OfficeUser AND SiteStaff:
required_roles = dd.login_required(OfficeUser, SiteStaff)

# only for users who are EITHER OfficeUser OR SiteStaff:
required_roles = dd.login_required((OfficeUser, SiteStaff))

workflow_state_field = None¶: The name of the field that contains the workflow state of an object. Subclasses may override this.

workflow_owner_field = None¶: The name of the field that contains the user who is considered to own an object when Rule.owned_only is checked.

debug_permissions = False¶: Whether to log Permission debug messages for this action.

lino.core.permissions.add_requirements(obj, *args)¶: Add the specified requirements to obj. obj can be an lino.core.actors.Actor or any Permittable. Application code uses this indirectly through the shortcut methods lino.core.actors.Actor.add_view_requirements() or a Permittable.add_requirements().

lino.core.permissions.make_permission_handler(*args, **kw)¶

Return a function that will test whether permission is given or not.

elem is not used (either an Action or a Permittable.)

actor is who contains the workflow state field

readonly

debug_permissions

The generated function will always expect three arguments user, obj and state. The latter two may be None depending on the context (for example a read_required is expected to not test on obj or state because these values are not known when generating the linoweb.js files.).

The remaining keyword arguments are aka “requirements”:

states

List of strings naming the user groups for which membership is required.

allow

An additional custom permission handler

lino.core.permissions.make_static_permission_handler(*args, **kw)¶: Similar to make_permission_handler(), but for static view permissions, which don’t have an object nor states.