def filterprotected(*filters, **callback):
 def _filterprotected(f):
  @functools.wraps(f)
  def wrapper(self, request, **kwargs):
   request.assert_authenticated()
   if (not request.context.is_admin):
    target = dict()
    if filters:
     for item in filters:
      if (item in request.params):
       target[item] = request.params[item]
     LOG.debug('RBAC: Adding query filter params (%s)', ', '.join([('%s=%s' % (item, target[item])) for item in target]))
    if (('callback' in callback) and (callback['callback'] is not None)):
     prep_info = {'f_name': f.__name__, 'input_attr': kwargs, 'filter_attr': target}
     callback['callback'](self, request, prep_info, **kwargs)
    else:
     action = ('identity:%s' % f.__name__)
     creds = _build_policy_check_credentials(self, action, request.context_dict, kwargs)
     for key in kwargs:
      target[key] = kwargs[key]
     self.policy_api.enforce(creds, action, utils.flatten_dict(target))
     LOG.debug('RBAC: Authorization granted')
   else:
    LOG.warning(_LW('RBAC: Bypassing authorization'))
   return f(self, request, filters, **kwargs)
  return wrapper
 return _filterprotected

def filterprotected ( * filters , ** callback ) : def _filterprotected ( f ) : @ functools . wraps ( f ) def wrapper ( self , request , ** kwargs ) : request . assert_authenticated ( ) if ( not request . context . is_admin ) : target = dict ( ) if filters : for item in filters : if ( item in request . params ) : target [ item ] = request . params [ item ] LOG . debug ( 'RBAC: Adding query filter params (%s)' , ', ' . join ( [ ( '%s=%s' % ( item , target [ item ] ) ) for item in target ] ) ) if ( ( 'callback' in callback ) and ( callback [ 'callback' ] is not None ) ) : prep_info = { 'f_name' : f . __name__ , 'input_attr' : kwargs , 'filter_attr' : target } callback [ 'callback' ] ( self , request , prep_info , ** kwargs ) else : action = ( 'identity:%s' % f . __name__ ) creds = _build_policy_check_credentials ( self , action , request . context_dict , kwargs ) for key in kwargs : target [ key ] = kwargs [ key ] self . policy_api . enforce ( creds , action , utils . flatten_dict ( target ) ) LOG . debug ( 'RBAC: Authorization granted' ) else : LOG . warning ( _LW ( 'RBAC: Bypassing authorization' ) ) return f ( self , request , filters , ** kwargs ) return wrapper return _filterprotected
wraps filtered api calls with role based access controls .