Re: [Repoze-dev] Model-based vs. view-based security

Hi Tim, |--== On Thu, 29 Jul 2010 07:36:57 +0800, Tim Hoffman zutes...@gmail.com said: TH Hi 2) With the security proxy machinery I can have a view that conditionally displays certain HTML elements (like form fields) depending on the permissions that the accessing user has on the

Re: [Repoze-dev] Model-based vs. view-based security

Hi Chris, |--== On Wed, 28 Jul 2010 12:38:30 -0400, Chris McDonough chr...@plope.com said: CM Thanks for asking this question, by the way, I have added it (and a CM variation on my answer) to the design defense documentation that is CM present in BFG: CM

Re: [Repoze-dev] Model-based vs. view-based security

Am 29.07.2010, 10:25 Uhr, schrieb Free Ekanayaka free.ekanay...@gmail.com: I agree that model objects and forms are not generally tight together, even though I'd argue that virtually every web application will need basic CRUD for the core entities. Form inference via schema adapter should

Re: [Repoze-dev] Model-based vs. view-based security

Hi TH I use a UML modeling tool to generate all my models and form schemas so I TH tend not to write much code in these entities. That's interesting, any pointer/link for this specific tool? I am using enterprise architect. http://www.sparxsystems.com.au/ It can actually reverse

[Repoze-dev] Model-based vs. view-based security

Hi, I'm starting to explore Repoze.bfg and I find it great. Reading the documentation I gather that the default security model is view-based, that means the authorization policy is basically defined and checked at the view level. If I understand it correctly, an __acl__ attribute on a context

Re: [Repoze-dev] Model-based vs. view-based security

On Wed, 2010-07-28 at 16:58 +0200, Free Ekanayaka wrote: Hi, I'm starting to explore Repoze.bfg and I find it great. Thanks for letting us know! Reading the documentation I gather that the default security model is view-based, that means the authorization policy is basically defined and

Re: [Repoze-dev] Model-based vs. view-based security

Thanks for asking this question, by the way, I have added it (and a variation on my answer) to the design defense documentation that is present in BFG: http://lists.repoze.org/pipermail/repoze-checkins/2010-July/009583.html (The rendered version, which doesn't yet include the above addition is

Re: [Repoze-dev] Model-based vs. view-based security

Hi 2) With the security proxy machinery I can have a view that conditionally displays certain HTML elements (like form fields) depending on the permissions that the accessing user has on the context object. I too came to bfg from zope2 and zope 3 and was used to model based security,