Deprecate has_permission and login_required in favor of new API about aiohttp-security HOT 8 CLOSED

Completely agree with your points but I am afraid that decorator feature will be asked a lot of times, since this is how other frameworks doing permissions (both Django and flask advocate login_required decorator)

from aiohttp-security.

We can document the reason for decision

from aiohttp-security.

Ok I understand your position but if I want offer a more hight-level API, can I do it without have line to put a breakpoint ?
Perhaps a debug mode can be added, I saw that Python3.7 will add new built-in breakpoint() function (https://www.python.org/dev/peps/pep-0553/)

from aiohttp-security.

I'd like to have the issue implemented first, after that we can consider high-level API for class based views.
#148 is not necessary, not sure about #150

from aiohttp-security.

@asvetlov

Setting a breakpoint to decorator itself leads to debugging all handlers with decorator applied, not the specific one.

Here is one possible workaround

def login_required(f):
    if f.__name__ == 'handler2':
        import pdb; pdb.set_trace()

Alternatively IDEs like PyCharm have conditional breakpoints - in this case you don't need two lines above.

from aiohttp-security.

It requires changing or setting a breakpoint on the outer project, not user's application.

from aiohttp-security.

Isn't it better if the implementation of the check_permission remains for the user. In that case there is no need to remove decorator, just some func parameter in has_permission, which by default will be the current implementation of the permission checking. It will also allow to use more sofisticated permission checks, e.g. http://www.django-rest-framework.org/api-guide/permissions/#examples

from aiohttp-security.

Done by 0.3 release

from aiohttp-security.