has_permission decorator and aiohttp.web.View about aiohttp-security HOT 5 CLOSED

How about that: https://docs.djangoproject.com/en/2.0/topics/auth/default/#the-permissionrequiredmixin-mixin

from aiohttp-security.

There's also method_decorator https://stackoverflow.com/questions/29673549/method-decorator-with-login-required-and-permission-required#29673627

from aiohttp-security.

Hello @alk3mist

1) About method_decorator and has_permission:

Currently we can use aiohttp-security.has_permission decorator with function or method, but we cannot use this decorator with aiohttp.View.

@has_permission('read')  # works
def my_view(request):
    ...

class View:
    @has_permission('read')   # works 
    def read(request):
        ...

class View(aiohttp.web.View):
    @has_permission('read')   # doesn't work. 
    def read(self):
        ...

I don't think that need to add a method_decorator dedicated to the aiohttp.View because currently this decorator works with method except method of aiohttp.web.View.

2) About PermissionRequiredMixin and have a has_permission class decorator (PEP3129):

Django PermissionRequiredMixin use the same permission for all methods, but I would like have a mixin that set various permissions for each page.

We can have Mixin where each method matches a permission name with a suffix according to the CRUD/REST semantics (i.e post => create, get => read, put/patch => update, delete => delete)

class BookingView(HasPermissionMixin, web.View):

    # Define a common prefix of permission for all methods of the View.
    permission_prefix = 'booking'  
    permission_context = None  # Define context used by `has_permission`. 

    # post method needs permission suffixed by '.create' and starts with  `permission_prefix`
    def post(self):
         """
         Require `booking.create` permission
         """

    def get(self):
         """
         Require `booking.read` permission
         """

I think I prefer use Mixin for class instead of class decorator, thanks for your idea.

I would like to know the opinion of @asvetlov

from aiohttp-security.

The issue is in my todo list but I have no estimation for review, sorry.

from aiohttp-security.

Decorators should go away.
Use check_permission explicit call instead.

from aiohttp-security.