On 1/31/07, Chris Shenton <[EMAIL PROTECTED]> wrote: > I've got a pylons app that started out mostly as an internal > customer/sytem/contact management system. Until now it's been > internal only so we've had no auth whatsoever. > > I've been adding a way to send email to customers with status and > give them a URL back to the webapp where they can search a KB or > confirm a problem. They don't need authentication for this. > > Both rely on the same MySQL DB and SQLAlchemy ORM. > > But I really really really don't want them to be able to know about, > see, or access the customer manager part. > > What's the best way to handle this? > > I need to hide the internal O-wrap decoration of menus and such for > external folks. Perhaps if there's no REMOTE_USER I can make Myghty > not supply the menu and other internal-only decoration? > > I suppose I *could* create a new app and move the customer-facing > features into it but I have a bunch of library code and config info > I'd have to share. Same for the SQLAlchemy stuff. > > I probably could setup authentication for internal users and deny > access to nonpublic parts but I'd have to make darn sure I didn't miss > any. > > I could set up an Apache proxy that handle JUST the public URL parts. > Or could I really? AFAIK, mod_python wants you to give it the whole > egg. > > Is there a way to create "sub routes" such that internal customer > manager stuff has all its URLs under 'cm/*' and public URLs would > start under 'pub/*'? That seems it might give me a better way to do > apache front end or authentication against a top-level URL -- less > chance to miss blocking some internal-only URL. All my routes are now > at the same top level, like /kb/search or /customer/add which seems a > bit risky. > > Any other ideas for separating public from private, both in URL access > and look-n-feel?
I think you're on the right path. It sounds like you're having a hard time figuring out what you should do than figuring out how to do it. If I had to implement different access controls based on different URLs, I'd probably just do it in base.py :-/ My biggest question is how do you know if someone is "internal"? Best Regards, -jj -- http://jjinux.blogspot.com/ --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "pylons-discuss" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/pylons-discuss?hl=en -~----------~----~----~----~------~----~------~--~---
