simple-rbac 0.1.1

1. 安装Simple RBAC

pip install simple-rbac

2. 创建访问控制列表

import rbac.acl

acl = rbac.acl.Registry()

3. 注册角色和资源

acl.add_role("member")
acl.add_role("student", ["member"])
acl.add_role("teacher", ["member"])
acl.add_role("junior-student", ["student"])

acl.add_resource("course")
acl.add_resource("senior-course", ["course"])

4. 添加规则

acl.allow("member", "view", "course")
acl.allow("student", "learn", "course")
acl.allow("teacher", "teach", "course")
acl.deny("junior-student", "learn", "senior-course")

5. 使用它来检查权限

if acl.is_allowed("student", "view", "course"):
    print("Students chould view courses.")
else:
    print("Students chould not view courses.")

if acl.is_allowed("junior-student", "learn", "senior-course"):
    print("Junior students chould learn senior courses.")
else:
    print("Junior students chould not learn senior courses.")

示例

class Role(db.Model):
    """The role."""

    id = db.Column(db.Integer, primary_key=True)
    screen_name = db.Column(db.Unicode, nullable=False, unique=True)

    def __hash__(self):
        return hash("ROLE::%d" % self.id)

    def __eq__(self, other):
        return self.id == other.id


class Resource(db.Model):
    """The resource."""

    id = db.Column(db.Integer, primary_key=True)
    screen_name = db.Column(db.Unicode, nullable=False, unique=True)

    def __hash__(self):
        return hash("RESOURCE::%d" % self.id)

    def __eq__(self, other):
        return self.id == other.id

当然，您也可以使用内置的可哈希类型，例如元组、namedtuple、frozenset等。

1. 创建上下文管理器

acl = Registry()
context = IdentityContext(acl)

2. 设置加载器

加载器应该加载当前用户的角色。

from myapp import get_current_user

@context.set_roles_loader
def second_load_roles():
    user = get_current_user()
    yield "everyone"
    for role in user.roles:
        yield str(role)

3. 保护您的操作

现在您可以保护您的操作免受未经授权的访问。您可以根据需要选择多种方式来检查权限，包括Python 装饰器、Python with语句 或简单的方法调用。

@context.check_permission("view", "article", message="can't view")
def article_page():
    return "your-article"

def article_page():
    with context.check_permission("view", "article", message="can't view"):
        return "your-article"

def article_page():
    context.check_permission("view", "article", message="can't view").check()
    return "your-article"

@context.check_permission("view", "article", message="can not view")
def article_page():
    return "your-article"

try:
    print article_page()
except PermissionDenied as exception:
    print "The access has been denied, you %s" % exception.kwargs['message']

if not context.check_permission("view", "article"):
    print "Oh! the access has been denied."

is_allowed = bool(context.check_permission("view", "article"))