zope.security.interfaces — zope.security 4.0dev documentation

### Navigation

- index
- modules |
- next |
- previous |
- zope.security 4.0dev documentation »

# `zope.security.interfaces`

Interfaces for security machinery.

## Exceptions

> interface `zope.security.interfaces.` `IUnauthorized`

>   Extends: `zope.interface.common.interfaces.IException`

> exception `zope.security.interfaces.` `Unauthorized`

>   Some user wasn’t allowed to access a resource

> interface `zope.security.interfaces.` `IForbidden`

>   Extends: `zope.interface.common.interfaces.IException`

> exception `zope.security.interfaces.` `Forbidden`

>   A resource cannot be accessed under any circumstances

> interface `zope.security.interfaces.` `IForbiddenAttribute`

>   Extends: `zope.security.interfaces.IForbidden`, `zope.interface.common.interfaces.IAttributeError`

> exception `zope.security.interfaces.` `ForbiddenAttribute`

>   An attribute is unavailable because it is forbidden (private)

## Utilities

> interface `zope.security.interfaces.` `ISecurityManagement`

>   Public security management API.

>   `getSecurityPolicy`()

>     Get the system default security policy.

>   `setSecurityPolicy`(aSecurityPolicy)

>     Set the system default security policy.

>     This method should only be called by system startup code. It should never, for example, be called during a web request.

> interface `zope.security.interfaces.` `ISecurityChecking`

>   Public security API.

>   `checkPermission`(permission, object, interaction=None)

>     Return whether security policy allows permission on object.

>     ‘permission’ is permission name.

>     ‘object’ is the object being accessed according to the permission.

>     ‘interaction’ is an interaction, providing access to information such as authenticated principals. If it is None, the current interaction is used.

> interface `zope.security.interfaces.` `ISecurityProxyFactory`
>   `__call__`(object, checker=None)

>     Create a security proxy

>     If a checker is given, then use it, otherwise, try to figure out a checker.

>     If the object is already a security proxy, then it will be returned.

> interface `zope.security.interfaces.` `IChecker`

>   Security-proxy plugin objects that implement low-level checks

>   The checker is responsible for creating proxies for operation return values, via the proxy method.

>   There are check_getattr() and check_setattr() methods for checking getattr and setattr, and a check() method for all other operations.

>   The check methods may raise errors. They return no value.

>   Example (for __getitem__):

>   > checker.check(ob, “__getitem__”) return checker.proxy(ob[key])

>   `check_getattr`(ob, name)

>     Check whether attribute access is allowed.

>     May raise Unauthorized or Forbidden. Returns no value.

>     If a checker implements __setitem__, then __setitem__ will be called rather than check_getattr to check whether an attribute access is allowed. This is a hack that allows significantly greater performance due to the fact that low-level operator access is much faster than method access.

>   `check_setattr`(ob, name)

>     Check whether attribute assignment is allowed.

>     May raise Unauthorized or Forbidden. Returns no value.

>   `check`(ob, operation)

>     Check whether operation is allowed.

>     The operation name is the Python special method name, e.g. “__getitem__”.

>     May raise Unauthorized or Forbidden. Returns no value.

>     If a checker implements __setitem__, then __setitem__ will be called rather than check to chack whether an operation is allowed. This is a hack that allows significantly greater performance due to the fact that low-level operator access is much faster than method access.

>   `proxy`(value)

>     Return a security proxy for the value.

>     If a checker implements __getitem__, then __getitem__ will be called rather than proxy to proxy the value. This is a hack that allows significantly greater performance due to the fact that low-level operator access is much faster than method access.

> interface `zope.security.interfaces.` `INameBasedChecker`

>   Extends: `zope.security.interfaces.IChecker`

>   Security checker that uses permissions to check attribute access.

>   `permission_id`(name)

>     Return the permission used to check attribute access on name.

>     This permission is used by both check and check_getattr.

>   `setattr_permission_id`(name)

>     Return the permission used to check attribute assignment on name.

>     This permission is used by check_setattr.

> interface `zope.security.interfaces.` `ISecurityPolicy`
>   `__call__`(participation=None)

>     Creates a new interaction for a given request.

>     If participation is not None, it is added to the new interaction.

## Principals

> interface `zope.security.interfaces.` `IInteraction`

>   A representation of an interaction between some actors and the system.

>   `participations`

>     An iterable of participations.

>   `add`(participation)

>     Add a participation.

>   `remove`(participation)

>     Remove a participation.

>   `checkPermission`(permission, object)

>     Return whether security context allows permission on object.

>     Arguments: permission – A permission name object – The object being accessed according to the permission

> interface `zope.security.interfaces.` `IParticipation`
>   `interaction`

>     The interaction

>   `principal`

>     The authenticated principal

> exception `zope.security.interfaces.` `NoInteraction`

>   No interaction started

> interface `zope.security.interfaces.` `IInteractionManagement`

>   Interaction management API.

>   Every thread has at most one active interaction at a time.

>   `newInteraction`(participation=None)

>     Start a new interaction.

>     If participation is not None, it is added to the new interaction.

>     Raises an error if the calling thread already has an interaction.

>   `queryInteraction`()

>     Return the current interaction.

>     Return None if there is no interaction.

>   `getInteraction`()

>     Return the current interaction.

>     Raise NoInteraction if there isn’t a current interaction.

>   `endInteraction`()

>     End the current interaction.

>     Does nothing if there is no interaction.

> interface `zope.security.interfaces.` `IPrincipal`

>   Principals are security artifacts that execute actions in a security environment.

>   The most common examples of principals include user and group objects.

>   It is likely that IPrincipal objects will have associated views used to list principals in management interfaces. For example, a system in which other meta-data are provided for principals might extend IPrincipal and register a view for the extended interface that displays the extended information. We’ll probably want to define a standard view name (e.g. ‘inline_summary’) for this purpose.

>   `id`

>     Id

>     The unique identification of the principal.

>   `title`

>     Title

>     The title of the principal. This is usually used in the UI.

>   `description`

>     Description

>     A detailed description of the principal.

> interface `zope.security.interfaces.` `IGroupAwarePrincipal`

>   Extends: `zope.security.interfaces.IPrincipal`

>   Group aware principal interface Extends IPrincipal to contain group information.

>   `groups`

>     An iterable of groups to which the principal directly belongs

> interface `zope.security.interfaces.` `IGroupClosureAwarePrincipal`

>   Extends: `zope.security.interfaces.IGroupAwarePrincipal`

>   `allGroups`

>     An iterable of the full closure of the principal’s groups.

> interface `zope.security.interfaces.` `IGroup`

>   Extends: `zope.security.interfaces.IPrincipal`

>   Group of principals

> interface `zope.security.interfaces.` `IMemberGetterGroup`

>   Extends: `zope.security.interfaces.IGroup`

>   a group that can get its members

>   `getMembers`()

>     return an iterable of the members of the group

> interface `zope.security.interfaces.` `IMemberAwareGroup`

>   Extends: `zope.security.interfaces.IMemberGetterGroup`

>   a group that can both set and get its members.

>   `setMembers`(value)

>     set members of group to the principal ids in the iterable value

> interface `zope.security.interfaces.` `IPermission`

>   A permission object.

>   `id`

>     Id

>     Id as which this permission will be known and used.

>   `title`

>     Title

>     Provides a title for the permission.

>   `description`

>     Description

>     Provides a description for the permission.

### Navigation

- index
- modules |
- next |
- previous |
- zope.security 4.0dev documentation »