doc/book/en/tutorials/advanced/part02_security.rst
author Julien Cristau <julien.cristau@logilab.fr>
Fri, 11 Jul 2014 13:48:07 +0200
changeset 9881 3c2202e7bd31
parent 9878 f3936f64bd98
child 10376 b566c8081832
permissions -rw-r--r--
[doc/book] spelling fixes in security tutorial
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
6876
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
     1
.. _TutosPhotoWebSiteSecurity:
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
     2
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
     3
Security, testing and migration
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
     4
-------------------------------
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
     5
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
     6
This part will cover various topics:
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
     7
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
     8
* configuring security
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
     9
* migrating existing instance
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    10
* writing some unit tests
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    11
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    12
Here is the ``read`` security model I want:
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    13
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    14
* folders, files, images and comments should have one of the following visibility:
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    15
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    16
  - ``public``, everyone can see it
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    17
  - ``authenticated``, only authenticated users can see it
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    18
  - ``restricted``, only a subset of authenticated users can see it
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    19
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    20
* managers (e.g. me) can see everything
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    21
* only authenticated users can see people
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    22
* everyone can see classifier entities, such as tag and zone
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    23
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    24
Also, unless explicitly specified, the visibility of an image should be the same as
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    25
its parent folder, as well as visibility of a comment should be the same as the
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    26
commented entity. If there is no parent entity, the default visibility is
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    27
``authenticated``.
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    28
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    29
Regarding write security, that's much easier:
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    30
* anonymous can't write anything
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    31
* authenticated users can only add comment
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    32
* managers will add the remaining stuff
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    33
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    34
Now, let's implement that!
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    35
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    36
Proper security in CubicWeb is done at the schema level, so you don't have to
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    37
bother with it in views: users will only see what they can see automatically.
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    38
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    39
.. _adv_tuto_security:
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    40
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    41
Step 1: configuring security into the schema
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    42
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    43
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    44
In schema, you can grant access according to groups, or to some RQL expressions:
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    45
users get access if the expression returns some results. To implement the read
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    46
security defined earlier, groups are not enough, we'll need some RQL expression. Here
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    47
is the idea:
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    48
6923
327443ec7120 [doc] update photo web site tutorial: we're starting from cw 3.10/file 1.9+
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6876
diff changeset
    49
* add a `visibility` attribute on Folder, File and Comment, which may be one of
6876
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    50
  the value explained above
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    51
6923
327443ec7120 [doc] update photo web site tutorial: we're starting from cw 3.10/file 1.9+
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6876
diff changeset
    52
* add a `may_be_read_by` relation from Folder, File and Comment to users,
6876
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    53
  which will define who can see the entity
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    54
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    55
* security propagation will be done in hook.
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    56
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    57
So the first thing to do is to modify my cube's schema.py to define those
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    58
relations:
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    59
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    60
.. sourcecode:: python
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    61
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    62
    from yams.constraints import StaticVocabularyConstraint
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    63
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    64
    class visibility(RelationDefinition):
6923
327443ec7120 [doc] update photo web site tutorial: we're starting from cw 3.10/file 1.9+
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6876
diff changeset
    65
	subject = ('Folder', 'File', 'Comment')
6876
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    66
	object = 'String'
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    67
	constraints = [StaticVocabularyConstraint(('public', 'authenticated',
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    68
						   'restricted', 'parent'))]
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    69
	default = 'parent'
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    70
	cardinality = '11' # required
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    71
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    72
    class may_be_read_by(RelationDefinition):
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    73
        __permissions__ = {
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    74
	    'read':   ('managers', 'users'),
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    75
	    'add':    ('managers',),
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    76
	    'delete': ('managers',),
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    77
	    }
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    78
6923
327443ec7120 [doc] update photo web site tutorial: we're starting from cw 3.10/file 1.9+
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6876
diff changeset
    79
	subject = ('Folder', 'File', 'Comment',)
6876
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    80
	object = 'CWUser'
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    81
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    82
We can note the following points:
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    83
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    84
* we've added a new `visibility` attribute to folder, file, image and comment
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    85
  using a `RelationDefinition`
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    86
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    87
* `cardinality = '11'` means this attribute is required. This is usually hidden
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    88
  under the `required` argument given to the `String` constructor, but we can
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    89
  rely on this here (same thing for StaticVocabularyConstraint, which is usually
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    90
  hidden by the `vocabulary` argument)
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    91
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    92
* the `parent` possible value will be used for visibility propagation
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    93
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    94
* think to secure the `may_be_read_by` permissions, else any user can add/delete it
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    95
  by default, which somewhat breaks our security model...
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    96
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    97
Now, we should be able to define security rules in the schema, based on these new
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    98
attribute and relation. Here is the code to add to *schema.py*:
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
    99
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   100
.. sourcecode:: python
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   101
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   102
    from cubicweb.schema import ERQLExpression
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   103
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   104
    VISIBILITY_PERMISSIONS = {
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   105
	'read':   ('managers',
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   106
		   ERQLExpression('X visibility "public"'),
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   107
		   ERQLExpression('X may_be_read_by U')),
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   108
	'add':    ('managers',),
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   109
	'update': ('managers', 'owners',),
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   110
	'delete': ('managers', 'owners'),
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   111
	}
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   112
    AUTH_ONLY_PERMISSIONS = {
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   113
	    'read':   ('managers', 'users'),
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   114
	    'add':    ('managers',),
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   115
	    'update': ('managers', 'owners',),
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   116
	    'delete': ('managers', 'owners'),
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   117
	    }
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   118
    CLASSIFIERS_PERMISSIONS = {
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   119
	    'read':   ('managers', 'users', 'guests'),
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   120
	    'add':    ('managers',),
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   121
	    'update': ('managers', 'owners',),
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   122
	    'delete': ('managers', 'owners'),
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   123
	    }
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   124
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   125
    from cubes.folder.schema import Folder
6923
327443ec7120 [doc] update photo web site tutorial: we're starting from cw 3.10/file 1.9+
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6876
diff changeset
   126
    from cubes.file.schema import File
6876
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   127
    from cubes.comment.schema import Comment
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   128
    from cubes.person.schema import Person
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   129
    from cubes.zone.schema import Zone
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   130
    from cubes.tag.schema import Tag
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   131
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   132
    Folder.__permissions__ = VISIBILITY_PERMISSIONS
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   133
    File.__permissions__ = VISIBILITY_PERMISSIONS
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   134
    Comment.__permissions__ = VISIBILITY_PERMISSIONS.copy()
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   135
    Comment.__permissions__['add'] = ('managers', 'users',)
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   136
    Person.__permissions__ = AUTH_ONLY_PERMISSIONS
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   137
    Zone.__permissions__ = CLASSIFIERS_PERMISSIONS
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   138
    Tag.__permissions__ = CLASSIFIERS_PERMISSIONS
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   139
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   140
What's important in there:
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   141
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   142
* `VISIBILITY_PERMISSIONS` provides read access to managers group, if
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   143
  `visibility` attribute's value is 'public', or if user (designed by the 'U'
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   144
  variable in the expression) is linked to the entity (the 'X' variable) through
9881
3c2202e7bd31 [doc/book] spelling fixes in security tutorial
Julien Cristau <julien.cristau@logilab.fr>
parents: 9878
diff changeset
   145
  the `may_be_read_by` permission
6876
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   146
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   147
* we modify permissions of the entity types we use by importing them and
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   148
  modifying their `__permissions__` attribute
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   149
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   150
* notice the `.copy()`: we only want to modify 'add' permission for `Comment`,
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   151
  not for all entity types using `VISIBILITY_PERMISSIONS`!
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   152
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   153
* the remaining part of the security model is done using regular groups:
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   154
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   155
  - `users` is the group to which all authenticated users will belong
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   156
  - `guests` is the group of anonymous users
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   157
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   158
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   159
.. _adv_tuto_security_propagation:
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   160
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   161
Step 2: security propagation in hooks
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   162
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   163
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   164
To fullfill the requirements, we have to implement::
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   165
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   166
  Also, unless explicity specified, visibility of an image should be the same as
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   167
  its parent folder, as well as visibility of a comment should be the same as the
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   168
  commented entity.
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   169
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   170
This kind of `active` rule will be done using CubicWeb's hook
9881
3c2202e7bd31 [doc/book] spelling fixes in security tutorial
Julien Cristau <julien.cristau@logilab.fr>
parents: 9878
diff changeset
   171
system. Hooks are triggered on database events such as addition of a new
6876
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   172
entity or relation.
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   173
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   174
The tricky part of the requirement is in *unless explicitly specified*, notably
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   175
because when the entity is added, we don't know yet its 'parent'
6923
327443ec7120 [doc] update photo web site tutorial: we're starting from cw 3.10/file 1.9+
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6876
diff changeset
   176
entity (e.g. Folder of an File, File commented by a Comment). To handle such things,
6876
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   177
CubicWeb provides `Operation`, which allow to schedule things to do at commit time.
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   178
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   179
In our case we will:
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   180
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   181
* on entity creation, schedule an operation that will set default visibility
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   182
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   183
* when a "parent" relation is added, propagate parent's visibility unless the
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   184
  child already has a visibility set
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   185
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   186
Here is the code in cube's *hooks.py*:
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   187
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   188
.. sourcecode:: python
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   189
8190
2a3c1b787688 [vreg] move base registry implementation to logilab.common. Closes #1916014
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 7286
diff changeset
   190
    from cubicweb.predicates import is_instance
6876
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   191
    from cubicweb.server import hook
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   192
7286
a0d3ea01f4bf [doc] fix doc and tutorials about hooks and operations
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents: 6923
diff changeset
   193
    class SetVisibilityOp(hook.DataOperationMixIn, hook.Operation):
a0d3ea01f4bf [doc] fix doc and tutorials about hooks and operations
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents: 6923
diff changeset
   194
6876
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   195
	def precommit_event(self):
7286
a0d3ea01f4bf [doc] fix doc and tutorials about hooks and operations
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents: 6923
diff changeset
   196
	    for eid in self.get_data():
6876
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   197
		entity = self.session.entity_from_eid(eid)
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   198
		if entity.visibility == 'parent':
8483
4ba11607d84a [entity api] unify set_attributes / set_relations into a cw_set method. Closes #2423719
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 8190
diff changeset
   199
		    entity.cw_set(visibility=u'authenticated')
6876
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   200
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   201
    class SetVisibilityHook(hook.Hook):
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   202
	__regid__ = 'sytweb.setvisibility'
6923
327443ec7120 [doc] update photo web site tutorial: we're starting from cw 3.10/file 1.9+
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 6876
diff changeset
   203
	__select__ = hook.Hook.__select__ & is_instance('Folder', 'File', 'Comment')
6876
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   204
	events = ('after_add_entity',)
7286
a0d3ea01f4bf [doc] fix doc and tutorials about hooks and operations
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents: 6923
diff changeset
   205
6876
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   206
	def __call__(self):
7286
a0d3ea01f4bf [doc] fix doc and tutorials about hooks and operations
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents: 6923
diff changeset
   207
	    SetVisibilityOp.get_instance(self._cw).add_data(self.entity.eid)
6876
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   208
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   209
    class SetParentVisibilityHook(hook.Hook):
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   210
	__regid__ = 'sytweb.setparentvisibility'
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   211
	__select__ = hook.Hook.__select__ & hook.match_rtype('filed_under', 'comments')
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   212
	events = ('after_add_relation',)
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   213
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   214
	def __call__(self):
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   215
	    parent = self._cw.entity_from_eid(self.eidto)
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   216
	    child = self._cw.entity_from_eid(self.eidfrom)
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   217
	    if child.visibility == 'parent':
8483
4ba11607d84a [entity api] unify set_attributes / set_relations into a cw_set method. Closes #2423719
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 8190
diff changeset
   218
		child.cw_set(visibility=parent.visibility)
6876
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   219
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   220
Notice:
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   221
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   222
* hooks are application objects, hence have selectors that should match entity or
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   223
  relation types to which the hook applies. To match a relation type, we use the
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   224
  hook specific `match_rtype` selector.
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   225
9881
3c2202e7bd31 [doc/book] spelling fixes in security tutorial
Julien Cristau <julien.cristau@logilab.fr>
parents: 9878
diff changeset
   226
* usage of `DataOperationMixIn`: instead of adding an operation for each added entity,
3c2202e7bd31 [doc/book] spelling fixes in security tutorial
Julien Cristau <julien.cristau@logilab.fr>
parents: 9878
diff changeset
   227
  DataOperationMixIn allows to create a single one and to store entity's eids to be
3c2202e7bd31 [doc/book] spelling fixes in security tutorial
Julien Cristau <julien.cristau@logilab.fr>
parents: 9878
diff changeset
   228
  processed in the transaction data. This is a good pratice to avoid heavy
6876
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   229
  operations manipulation cost when creating a lot of entities in the same
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   230
  transaction.
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   231
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   232
* the `precommit_event` method of the operation will be called at transaction's
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   233
  commit time.
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   234
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   235
* in a hook, `self._cw` is the repository session, not a web request as usually
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   236
  in views
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   237
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   238
* according to hook's event, you have access to different attributes on the hook
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   239
  instance. Here:
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   240
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   241
  - `self.entity` is the newly added entity on 'after_add_entity' events
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   242
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   243
  - `self.eidfrom` / `self.eidto` are the eid of the subject / object entity on
7286
a0d3ea01f4bf [doc] fix doc and tutorials about hooks and operations
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents: 6923
diff changeset
   244
    'after_add_relation' events (you may also get the relation type using
6876
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   245
    `self.rtype`)
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   246
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   247
The `parent` visibility value is used to tell "propagate using parent security"
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   248
because we want that attribute to be required, so we can't use None value else
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   249
we'll get an error before we get any chance to propagate...
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   250
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   251
Now, we also want to propagate the `may_be_read_by` relation. Fortunately,
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   252
CubicWeb provides some base hook classes for such things, so we only have to add
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   253
the following code to *hooks.py*:
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   254
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   255
.. sourcecode:: python
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   256
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   257
    # relations where the "parent" entity is the subject
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   258
    S_RELS = set()
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   259
    # relations where the "parent" entity is the object
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   260
    O_RELS = set(('filed_under', 'comments',))
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   261
9391
5537c3b64841 [book] replace PropagateSubjectRelation*Hook references
Samuel Trégouët <samuel.tregouet@logilab.fr>
parents: 8483
diff changeset
   262
    class AddEntitySecurityPropagationHook(hook.PropagateRelationHook):
6876
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   263
	"""propagate permissions when new entity are added"""
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   264
	__regid__ = 'sytweb.addentity_security_propagation'
9391
5537c3b64841 [book] replace PropagateSubjectRelation*Hook references
Samuel Trégouët <samuel.tregouet@logilab.fr>
parents: 8483
diff changeset
   265
	__select__ = (hook.PropagateRelationHook.__select__
6876
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   266
		      & hook.match_rtype_sets(S_RELS, O_RELS))
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   267
	main_rtype = 'may_be_read_by'
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   268
	subject_relations = S_RELS
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   269
	object_relations = O_RELS
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   270
9391
5537c3b64841 [book] replace PropagateSubjectRelation*Hook references
Samuel Trégouët <samuel.tregouet@logilab.fr>
parents: 8483
diff changeset
   271
    class AddPermissionSecurityPropagationHook(hook.PropagateRelationAddHook):
6876
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   272
	"""propagate permissions when new entity are added"""
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   273
	__regid__ = 'sytweb.addperm_security_propagation'
9391
5537c3b64841 [book] replace PropagateSubjectRelation*Hook references
Samuel Trégouët <samuel.tregouet@logilab.fr>
parents: 8483
diff changeset
   274
	__select__ = (hook.PropagateRelationAddHook.__select__
6876
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   275
		      & hook.match_rtype('may_be_read_by',))
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   276
	subject_relations = S_RELS
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   277
	object_relations = O_RELS
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   278
9391
5537c3b64841 [book] replace PropagateSubjectRelation*Hook references
Samuel Trégouët <samuel.tregouet@logilab.fr>
parents: 8483
diff changeset
   279
    class DelPermissionSecurityPropagationHook(hook.PropagateRelationDelHook):
6876
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   280
	__regid__ = 'sytweb.delperm_security_propagation'
9391
5537c3b64841 [book] replace PropagateSubjectRelation*Hook references
Samuel Trégouët <samuel.tregouet@logilab.fr>
parents: 8483
diff changeset
   281
	__select__ = (hook.PropagateRelationDelHook.__select__
6876
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   282
		      & hook.match_rtype('may_be_read_by',))
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   283
	subject_relations = S_RELS
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   284
	object_relations = O_RELS
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   285
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   286
* the `AddEntitySecurityPropagationHook` will propagate the relation
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   287
  when `filed_under` or `comments` relations are added
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   288
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   289
  - the `S_RELS` and `O_RELS` set as well as the `match_rtype_sets` selector are
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   290
    used here so that if my cube is used by another one, it'll be able to
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   291
    configure security propagation by simply adding relation to one of the two
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   292
    sets.
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   293
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   294
* the two others will propagate permissions changes on parent entities to
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   295
  children entities
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   296
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   297
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   298
.. _adv_tuto_tesing_security:
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   299
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   300
Step 3: testing our security
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   301
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   302
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   303
Security is tricky. Writing some tests for it is a very good idea. You should
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   304
even write them first, as Test Driven Development recommends!
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   305
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   306
Here is a small test case that will check the basis of our security
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   307
model, in *test/unittest_sytweb.py*:
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   308
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   309
.. sourcecode:: python
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   310
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   311
    from cubicweb.devtools.testlib import CubicWebTC
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   312
    from cubicweb import Binary
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   313
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   314
    class SecurityTC(CubicWebTC):
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   315
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   316
	def test_visibility_propagation(self):
9878
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   317
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   318
            with self.admin_access.repo_cnx() as cnx:
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   319
                # create a user for later security checks
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   320
                toto = self.create_user(cnx, 'toto')
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   321
                cnx.commit()
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   322
                # init some data using the default manager connection
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   323
                folder = cnx.create_entity('Folder',
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   324
                                           name=u'restricted',
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   325
    				           visibility=u'restricted')
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   326
                photo1 = cnx.create_entity('File',
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   327
    	                                   data_name=u'photo1.jpg',
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   328
                                           data=Binary('xxx'),
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   329
                                           filed_under=folder)
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   330
                cnx.commit()
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   331
                # visibility propagation
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   332
                self.assertEquals(photo1.visibility, 'restricted')
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   333
                # unless explicitly specified
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   334
                photo2 = cnx.create_entity('File',
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   335
                                           data_name=u'photo2.jpg',
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   336
				           data=Binary('xxx'),
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   337
				           visibility=u'public',
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   338
				           filed_under=folder)
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   339
                cnx.commit()
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   340
                self.assertEquals(photo2.visibility, 'public')
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   341
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   342
            with self.new_access('toto').repo_cnx() as cnx:
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   343
                # test security
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   344
                self.assertEqual(1, len(cnx.execute('File X'))) # only the public one
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   345
                self.assertEqual(0, len(cnx.execute('Folder X'))) # restricted...
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   346
                # may_be_read_by propagation
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   347
                folder = cnx.entity_from_eid(folder.eid)
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   348
                folder.cw_set(may_be_read_by=toto)
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   349
                cnx.commit()
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   350
                photo1 = cnx.entity_from_eid(photo1)
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   351
                self.failUnless(photo1.may_be_read_by)
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   352
                # test security with permissions
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   353
                self.assertEquals(2, len(cnx.execute('File X'))) # now toto has access to photo2
f3936f64bd98 [doc/book] update examples, using the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 9391
diff changeset
   354
                self.assertEquals(1, len(cnx.execute('Folder X'))) # and to restricted folder
6876
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   355
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   356
    if __name__ == '__main__':
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   357
	from logilab.common.testlib import unittest_main
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   358
	unittest_main()
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   359
9881
3c2202e7bd31 [doc/book] spelling fixes in security tutorial
Julien Cristau <julien.cristau@logilab.fr>
parents: 9878
diff changeset
   360
It's not complete, but shows most things you'll want to do in tests: adding some
6876
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   361
content, creating users and connecting as them in the test, etc...
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   362
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   363
To run it type:
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   364
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   365
.. sourcecode:: bash
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   366
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   367
    $ pytest unittest_sytweb.py
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   368
    ========================  unittest_sytweb.py  ========================
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   369
    -> creating tables [....................]
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   370
    -> inserting default user and default groups.
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   371
    -> storing the schema in the database [....................]
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   372
    -> database for instance data initialized.
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   373
    .
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   374
    ----------------------------------------------------------------------
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   375
    Ran 1 test in 22.547s
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   376
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   377
    OK
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   378
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   379
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   380
The first execution is taking time, since it creates a sqlite database for the
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   381
test instance. The second one will be much quicker:
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   382
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   383
.. sourcecode:: bash
7286
a0d3ea01f4bf [doc] fix doc and tutorials about hooks and operations
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents: 6923
diff changeset
   384
6876
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   385
    $ pytest unittest_sytweb.py
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   386
    ========================  unittest_sytweb.py  ========================
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   387
    .
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   388
    ----------------------------------------------------------------------
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   389
    Ran 1 test in 2.662s
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   390
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   391
    OK
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   392
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   393
If you do some changes in your schema, you'll have to force regeneration of that
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   394
database. You do that by removing the tmpdb files before running the test: ::
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   395
9881
3c2202e7bd31 [doc/book] spelling fixes in security tutorial
Julien Cristau <julien.cristau@logilab.fr>
parents: 9878
diff changeset
   396
    $ rm data/database/tmpdb*
6876
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   397
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   398
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   399
.. Note::
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   400
  pytest is a very convenient utility used to control test execution. It is available from the `logilab-common`_ package.
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   401
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   402
.. _`logilab-common`: http://www.logilab.org/project/logilab-common
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   403
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   404
.. _adv_tuto_migration_script:
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   405
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   406
Step 4: writing the migration script and migrating the instance
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   407
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   408
9881
3c2202e7bd31 [doc/book] spelling fixes in security tutorial
Julien Cristau <julien.cristau@logilab.fr>
parents: 9878
diff changeset
   409
Prior to those changes, I created an instance, fed it with some data, so I
6876
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   410
don't want to create a new one, but to migrate the existing one. Let's see how to
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   411
do that.
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   412
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   413
Migration commands should be put in the cube's *migration* directory, in a
9881
3c2202e7bd31 [doc/book] spelling fixes in security tutorial
Julien Cristau <julien.cristau@logilab.fr>
parents: 9878
diff changeset
   414
file named file:`<X.Y.Z>_Any.py` ('Any' being there mostly for historical reasons).
6876
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   415
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   416
Here I'll create a *migration/0.2.0_Any.py* file containing the following
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   417
instructions:
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   418
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   419
.. sourcecode:: python
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   420
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   421
  add_relation_type('may_be_read_by')
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   422
  add_relation_type('visibility')
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   423
  sync_schema_props_perms()
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   424
9881
3c2202e7bd31 [doc/book] spelling fixes in security tutorial
Julien Cristau <julien.cristau@logilab.fr>
parents: 9878
diff changeset
   425
Then I update the version number in the cube's *__pkginfo__.py* to 0.2.0. And
6876
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   426
that's it! Those instructions will:
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   427
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   428
* update the instance's schema by adding our two new relations and update the
9881
3c2202e7bd31 [doc/book] spelling fixes in security tutorial
Julien Cristau <julien.cristau@logilab.fr>
parents: 9878
diff changeset
   429
  underlying database tables accordingly (the first two instructions)
6876
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   430
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   431
* update schema's permissions definition (the last instruction)
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   432
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   433
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   434
To migrate my instance I simply type::
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   435
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   436
   cubicweb-ctl upgrade sytweb
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   437
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   438
You'll then be asked some questions to do the migration step by step. You should say
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   439
YES when it asks if a backup of your database should be done, so you can get back
4b0b9d8207c5 [doc] backport part 3 & 4 of the sytweb's tutorial + to be published part 5
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
diff changeset
   440
to initial state if anything goes wrong...