security.py

from pyramid.authentication import AuthTktAuthenticationPolicy
from pyramid.authorization import ACLAuthorizationPolicy
from .models.ziggurat import (
    User,
    UserGroup,
    )


def group_finder(login, request):
    q = request.dbsession.query(User).filter_by(id=login)
    u = q.first()
    if not u or not u.status:
        return  # None means logout
    r = []
    q = request.dbsession.query(UserGroup).filter_by(user_id=u.id)
    for ug in q:
        acl_name = f'group:{ug.group_id}'
        r.append(acl_name)
    return r


def get_user(request):
    uid = request.authenticated_userid
    if uid:
        q = request.dbsession.query(User).filter_by(id=uid)
        return q.first()


def includeme(config):
    authn_policy = AuthTktAuthenticationPolicy(
            'sosecret', callback=group_finder, hashalg='sha512')
    config.set_authentication_policy(authn_policy)
    authz_policy = ACLAuthorizationPolicy()
    config.set_authorization_policy(authz_policy)
    config.add_request_method(get_user, 'user', reify=True)