Hello, I have an app with several users who each have their own profile. What I would like to do is to use the Identity framework to restrict editing of a user profile to the user who owns it. In other words, a user can only change his own profile.
After looking at the code and reading Jeff's howto, I think it is possible to achieve this using this scheme: 1) Add all users to TG_users. 2) Create a seperate TG_Group for each user. 3) Create a seperate permission for each user and add it to the corresponding user group. Say that the function in the controller that changes the profile is edit_profile(username, new_profile). When this is called, I could check if the current user has the required permission, and act accordingly. Is it possible to do this with decorators when I don't know beforehand which permission will be required, or do I need to call conditions.require_permission() in the function? Does this seem like the right way to do it? This is my first attempt at a system with user authentication so I am a bit unsure about the design pattern. Regards, Tobias.
