zope.security.interfaces

Interfaces for security machinery.

Exceptions

interface zope.security.interfaces.IUnauthorized[source]

Extends: zope.interface.common.interfaces.IException

exception zope.security.interfaces.Unauthorized[source]

Some user wasn’t allowed to access a resource

interface zope.security.interfaces.IForbidden[source]

Extends: zope.interface.common.interfaces.IException

exception zope.security.interfaces.Forbidden[source]

A resource cannot be accessed under any circumstances

interface zope.security.interfaces.IForbiddenAttribute[source]

Extends: zope.security.interfaces.IForbidden, zope.interface.common.interfaces.IAttributeError

exception zope.security.interfaces.ForbiddenAttribute[source]

An attribute is unavailable because it is forbidden (private)

Utilities

interface zope.security.interfaces.ISecurityManagement[source]

Public security management API.

getSecurityPolicy()[source]

Get the system default security policy.

setSecurityPolicy(aSecurityPolicy)[source]

Set the system default security policy.

This method should only be called by system startup code. It should never, for example, be called during a web request.

interface zope.security.interfaces.ISecurityChecking[source]

Public security API.

checkPermission(permission, object, interaction=None)[source]

Return whether security policy allows permission on object.

‘permission’ is permission name.

‘object’ is the object being accessed according to the permission.

‘interaction’ is an interaction, providing access to information such as authenticated principals. If it is None, the current interaction is used.

interface zope.security.interfaces.ISecurityProxyFactory[source]
__call__(object, checker=None)[source]

Create a security proxy

If a checker is given, then use it, otherwise, try to figure out a checker.

If the object is already a security proxy, then it will be returned.

interface zope.security.interfaces.IChecker[source]

Security-proxy plugin objects that implement low-level checks

The checker is responsible for creating proxies for operation return values, via the proxy method.

There are check_getattr() and check_setattr() methods for checking getattr and setattr, and a check() method for all other operations.

The check methods may raise errors. They return no value.

Example (for __getitem__):

checker.check(ob, “__getitem__”) return checker.proxy(ob[key])
check_getattr(ob, name)[source]

Check whether attribute access is allowed.

May raise Unauthorized or Forbidden. Returns no value.

If a checker implements __setitem__, then __setitem__ will be called rather than check_getattr to check whether an attribute access is allowed. This is a hack that allows significantly greater performance due to the fact that low-level operator access is much faster than method access.

check_setattr(ob, name)[source]

Check whether attribute assignment is allowed.

May raise Unauthorized or Forbidden. Returns no value.

check(ob, operation)[source]

Check whether operation is allowed.

The operation name is the Python special method name, e.g. “__getitem__”.

May raise Unauthorized or Forbidden. Returns no value.

If a checker implements __setitem__, then __setitem__ will be called rather than check to check whether an operation is allowed. This is a hack that allows significantly greater performance due to the fact that low-level operator access is much faster than method access.

proxy(value)[source]

Return a security proxy for the value.

If a checker implements __getitem__, then __getitem__ will be called rather than proxy to proxy the value. This is a hack that allows significantly greater performance due to the fact that low-level operator access is much faster than method access.

interface zope.security.interfaces.INameBasedChecker[source]

Extends: zope.security.interfaces.IChecker

Security checker that uses permissions to check attribute access.

permission_id(name)[source]

Return the permission used to check attribute access on name.

This permission is used by both check and check_getattr.

setattr_permission_id(name)[source]

Return the permission used to check attribute assignment on name.

This permission is used by check_setattr.

interface zope.security.interfaces.ISecurityPolicy[source]
__call__(participation=None)[source]

Creates a new interaction for a given request.

If participation is not None, it is added to the new interaction.

Principals

interface zope.security.interfaces.IInteraction[source]

A representation of an interaction between some actors and the system.

participations

An iterable of participations.

add(participation)[source]

Add a participation.

remove(participation)[source]

Remove a participation.

checkPermission(permission, object)[source]

Return whether security context allows permission on object.

Arguments: permission – A permission name object – The object being accessed according to the permission

interface zope.security.interfaces.IParticipation[source]
interaction

The interaction

principal

The authenticated principal

exception zope.security.interfaces.NoInteraction[source]

No interaction started

interface zope.security.interfaces.IInteractionManagement[source]

Interaction management API.

Every thread has at most one active interaction at a time.

newInteraction(participation=None)[source]

Start a new interaction.

If participation is not None, it is added to the new interaction.

Raises an error if the calling thread already has an interaction.

queryInteraction()[source]

Return the current interaction.

Return None if there is no interaction.

getInteraction()[source]

Return the current interaction.

Raise NoInteraction if there isn’t a current interaction.

endInteraction()[source]

End the current interaction.

Does nothing if there is no interaction.

interface zope.security.interfaces.IPrincipal[source]

Principals are security artifacts that execute actions in a security environment.

The most common examples of principals include user and group objects.

It is likely that IPrincipal objects will have associated views used to list principals in management interfaces. For example, a system in which other meta-data are provided for principals might extend IPrincipal and register a view for the extended interface that displays the extended information. We’ll probably want to define a standard view name (e.g. ‘inline_summary’) for this purpose.

id

Id

The unique identification of the principal.

title

Title

The title of the principal. This is usually used in the UI.

description

Description

A detailed description of the principal.

interface zope.security.interfaces.IGroupAwarePrincipal[source]

Extends: zope.security.interfaces.IPrincipal

Group aware principal interface Extends IPrincipal to contain group information.

groups

An iterable of groups to which the principal directly belongs

interface zope.security.interfaces.IGroupClosureAwarePrincipal[source]

Extends: zope.security.interfaces.IGroupAwarePrincipal

allGroups

An iterable of the full closure of the principal’s groups.

interface zope.security.interfaces.IGroup[source]

Extends: zope.security.interfaces.IPrincipal

Group of principals

interface zope.security.interfaces.IMemberGetterGroup[source]

Extends: zope.security.interfaces.IGroup

a group that can get its members

getMembers()[source]

return an iterable of the members of the group

interface zope.security.interfaces.IMemberAwareGroup[source]

Extends: zope.security.interfaces.IMemberGetterGroup

a group that can both set and get its members.

setMembers(value)[source]

set members of group to the principal ids in the iterable value

interface zope.security.interfaces.IPermission[source]

A permission object.

id

Id

Id as which this permission will be known and used.

title

Title

Provides a title for the permission.

description

Description

Provides a description for the permission.