Package SPyRO :: Module policies
[show private | hide private]
[frames | no frames]

Module SPyRO.policies

This module implements a set of predefined sharing policies in SPyRO
The policies are very important in order to keep safe your servers.

Sharing Policies specifies what kind of clients must be allowed to connect
and what resources are capable of use in SPyRO servers and objects.

Policies exists at object granularity and to attribute object granularity.
Every client requesting objects and actions in SPyRO are granted with the
authorization of a guardian object called Authority that must implements the
following methods:

    def can_set(self, auth, handler):
        Return True if |auth| is granted to perform a set operation in
        the guarded object (i.e. obj.x = y), False otherwise. Handler is the
        call connection handler as a PeerConnection instance

    def can_get(self, auth, handler):
        Return True if |auth| is granted to perform a get operation in
        the guarded object (i.e. obj.x), False otherwise. Handler is the
        call connection handler, a PeerConnection instance

    def can_del(self, auth, handler):
        ** TODO & Warning:
            this method must (and will) be renamed to can_unregister and
            and del must be used as del attribute **
        Return True if |auth| is granted to unregister the guarded object.
        Handler is the call connection handler, a PeerConnection instance

    def can_call(self, auth, handler):
        Return True if |auth| is granted to perform a call in a method
        of the guarded object (i.e. obj.meth()).
        Note that is necesary return True in can_get to use transparent
        mode in SPyRO. In transluced mode is not necesary.
        Handler is the call connection handler, a PeerConnection instance

    def can_follow_objname(self, auth, handler):
        Return True if |auth| is granted to access using the dot operator
        in the method or attribute name to access attributes of attributes
        (i.e. obj.attr1.attr2[...])
        Handler is the call connection handler, a PeerConnection instance

    def can_register(self, auth, handler):
        Return True if |auth| is granted to register new objects in server,
        is needed to return objects by reference.
        Handler is the call connection handler a PeerConnection instance


Note: A bunch of predefined authorities are provided in this module, but if
a more specific Authority is needed it must be implemented

The PeerConnection objects has information about all the connection and
request. By example, if peerconn is an instance of PeerConnection it has
the following information:
    + peerconn.obj, The object been requested
    
    + peerconn.spyreq, The SPyRO request, with attributes:
        |objname| The object name (ID in the server)
        |attrname| The name of the requested attribute
        |reqtype| The type of the request. It can be ReqBye (BYE), ReqGetAttr (GET),
        ReqSetAttr (SET), ReqCallMethod (CALL), (ReqDelObj) DEL
        And depending of the request type:
            |local_server| The server of the remote caller
            |value| in the SET reqtype
            |rettype| (in CALL and GET) that specifies the type of the return (Value VAL or Reference REF)
            In the CALL request:
                args. Positional arguments
                kwargs. Keyword arguments
                rettype. The return type
                local_server. Remote server (local to the cliend :P)
                And posibly:
                    extra. Used as an oscure data passed between calls (as user level routing info) 

    - peerconn.do_next_loop: If the request client must do more resolutions to this client
    - peerconn.authobj: The auth object (the same that self in the Authority object)
    - And others, see documentation of PeerConnection and Request

Note: auth argument can be None, because is the default (no authorization provided from the client side)
      The meaning of null and the effect is responsability of the Authority implementation
Note: If the Policy is None (at server side) all properties are granted, this is the default.

Classes
AuthAllowAll Allow all operations Every request must be qualified by the MixinCheckDB _auth method
AuthAllowAllButDenyUnderscore Allow all operations, but deny attrname starting with underscore '_'.
AuthAllowAllCall Allow all call request (even starting '_') Every request must be qualified by the MixinCheckDB _auth method
AuthAllowCall Allow call methods that does not start with underscore Every request must be qualified by the MixinCheckDB _auth method
AuthorizationRequest  
AuthPasswordRequest A Request to authenticate with the user/password schema
MixinAllowAllChecking Mixin that allows all options, useful as parent class
MixinAllowCall Allow call methods, the methods must not start with '_' underscore.
MixinCheckDB Mixin to check against username-password pairs (dictionary like object)
MixinDenyAll Mixin that deny all options, it must be taken as parent class
MixinDenyUnderscore Mixin to deny every attribute starting with underscore '_' character
MixinPublicAuth  
PublicAllowAll Allow all operations
PublicAllowAllButDenyUnderscore Allow all operations, but deny attrname starting with underscore '_'
PublicAllowAllCall Allow all call request (even private methods aka.
PublicAllowCall Allow call methods that does not start with underscore

Exceptions
AuthError Authentication Error

Generated by Epydoc 2.1 on Sat Oct 14 11:50:52 2006 http://epydoc.sf.net