On Monday April 27, 2009 10:42:35 Jorge Vargas wrote:
> more interesting than that template_vars.tg.identity returns None when
> the user isn't logged on. which means you will have to precheck all
> your access tests in something along the lines of
> if tg.identity and tg.identity['user'] == "something"
> which is too weird.
You could turn the repoze.who identity dict into a TG2 Bunch and customize
> on top of that it seems to me that checks in the form of are simply not
> possible py:if="'admin' in tg.identity.groups""
It's always been discouraged to deal with that repoze.what stuff directly,
as it's going to change somewhere in v1.X and disappear in v2 -- it's something
internal to repoze.what.
> is there an obvious way of doing this with repoze.what that I'm
You have two options to do that, which are also simpler (from my point of view):
> Also keep in mind this is pure syntax sugar as the real
> security check was done in the controller. Last but not least is this
> a class that is worth including in r.what? or should we keep it TG
> only? IMO this api is nice enough to work on any python
> template/framework and I think it's totally worth pushing into what.
Regarding the repoze.who identity dict, I think TG2 could turn that dict into a
Bunch if you find it necessary.
Regarding accessing the repoze.what credentials dict, it shouldn't be supported
because it's not intended to be used directly. Instead, I'd recommend predicate
evaluators -- and TG2 could have a short-cut to is_met() and not_met() in the
Gustavo Narea <xri://=Gustavo>.
| Tech blog: =Gustavo/(+blog)/tech ~ About me: =Gustavo/about |
Repoze-dev mailing list