Authorization? about flask-mongorest HOT 6 CLOSED

Did you see https://github.com/elasticsales/flask-mongorest#authentication ?

from flask-mongorest.

Yep it is authentication (who is this user?). But authorization (can this user get/post/delete/put this object)? maybe something like http://django-tastypie.readthedocs.org/en/latest/authentication_authorization.html ? I think by passing the object to a function as an argument (for get/put/post) and some kind of filtering for list.

from flask-mongorest.

Permission checks at the object/resource level is something we usually do inside Resource.validate_request(). However, I definitely see an advantage to implementing a scheme similar to the link above. It's not a feature currently on the roadmap, would you be up to submit a pull request?

from flask-mongorest.

So this i my idea on how to implement it and please comment, later ill code.

1. Filtering in listing (only show me this users objects)
   This could be done by overriding the Resource.get_queryset . But this is used also on the get single object. My idea is to create a new function called Resource.gets_queryset and the Resource.get_objects calls this function (line 177).
2. Checking on get. Creating a new class.

class AuthorizationBase(object):
    def authorized(self,object=None):
        return False
    def authorized_get(self,object=None):
        return False
    def authorized_post(self,object=None):
        return False
    def authorized_put(self,object=None):
        return False
    def authorized_delete(self,object=None):
        return False

Adding some attributes to ResourceView :authorization_methods, authorization_get_methods etc.
Just like the authentication code in line 28 in views.py adding a check inside get,post,put,delete.

Also how do you check in Resource.validate_request()? Do you override all the code?(post code maybe cause i don't see it)

Thanks

from flask-mongorest.

Looks like you override validate_request and call super ?But only for put and post.

What about adding something like validate_request for get(optional argument pk to tell the difference between get and list) after obj is created and before objs is created?

Something for delete also, after obj is created?

from flask-mongorest.

I did the 'get' authorization by overriding Resource.get_object and 'list' by overriding Resource.get_queryset.

Thanks

from flask-mongorest.