<!doctypehtml><html lang=en><head prefix="og: http://ogp.me/ns#"><title>
   weppy - Docs - The Authorization System
  </title><meta charset=utf-8><meta content=width=device-width,initial-scale=1 name=viewport><meta content="weppy - Docs - The Authorization System
"name=title><meta content=en_US property=og:locale><meta content="weppy - Docs - The Authorization System
"property=og:title><meta content="weppy framework"property=og:site_name><meta content=object property=og:type><meta content=http://weppy.org/docs/0.6/auth property=og:url><script src=/__weppy__/jquery.min.js></script><script src=/__weppy__/helpers.js></script><link href=//fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,700,300italic,400italic rel=stylesheet><link href=//fonts.googleapis.com/css?family=Source+Code+Pro:400,700 rel=stylesheet><link href=//fonts.googleapis.com/css?family=Raleway:400,300,600 rel=stylesheet><link href=//fonts.googleapis.com/css?family=Open+Sans:400,300,300italic rel=stylesheet><link href=//cdn.jsdelivr.net/docsearch.js/1/docsearch.min.css rel=stylesheet><script src=//cdn.jsdelivr.net/docsearch.js/1/docsearch.min.js></script><link href=/static/_2.0.0/pure-min.css rel=stylesheet><link href=/static/_2.0.0/grids-responsive-min.css rel=stylesheet><link href=/static/_2.0.0/main.css rel=stylesheet><link href=/static/_2.0.0/highlight.css rel=stylesheet><script src=/static/_2.0.0/highlight.pack.js></script><link href=/static/_2.0.0/pygments.css rel=stylesheet><script src=/static/_2.0.0/chart.min.js></script><style>/*<![CDATA[*/
    h2 {
        margin-top: 0;
        padding-top: 2em;
    }
    footer {
        margin-bottom: 32px;
    }
    pre code {
        background-color: rgba(0, 35, 55, 0.9);
        color: #eeeeee;
    }
    .doc-content {
        font-size: 17px;
        font-weight: 300;
    }
    .doc-content b, strong {
        font-weight: 500;
    }
/*]]>*/</style><body><header><div class=logo><img height=55 src=/static/_2.0.0/logo.png></div><nav class=clearfix><a href=/> Home </a><a href=/docs/latest> Docs </a><a href=/extensions> Extensions </a><a href=https://github.com/emmett-framework/emmett/tree/1.x> Github </a></nav></header><div class=box><div class="pure-g m30"><div class="pure-u-1 pure-u-lg-4-5 doc-content"><h1 id=the-authorization-system>The Authorization System</h1><p>weppy includes an useful authorization system, based on the once available on <em> web2py </em> , which automatically creates required database tables, and generate forms to add access control in your application writing just a few lines.<p>So how do you use it? Let's find out with an example:<div class=codehilite><pre><span></span><code><span class=kn>from</span> <span class=nn>weppy</span> <span class=kn>import</span> <span class=n>App</span><span class=p>,</span> <span class=n>DAL</span>
<span class=kn>from</span> <span class=nn>weppy.tools</span> <span class=kn>import</span> <span class=n>Auth</span>
<span class=kn>from</span> <span class=nn>weppy.sessions</span> <span class=kn>import</span> <span class=n>SessionCookieManager</span>

<span class=n>app</span> <span class=o>=</span> <span class=n>App</span><span class=p>(</span><span class=vm>__name__</span><span class=p>)</span>
<span class=n>app</span><span class=o>.</span><span class=n>config</span><span class=o>.</span><span class=n>db</span><span class=o>.</span><span class=n>uri</span> <span class=o>=</span> <span class=s2>"sqlite://storage.sqlite"</span>

<span class=n>db</span> <span class=o>=</span> <span class=n>DAL</span><span class=p>(</span><span class=n>app</span><span class=p>)</span>
<span class=n>auth</span> <span class=o>=</span> <span class=n>Auth</span><span class=p>(</span><span class=n>app</span><span class=p>,</span> <span class=n>db</span><span class=p>)</span>

<span class=n>app</span><span class=o>.</span><span class=n>common_handlers</span> <span class=o>=</span> <span class=p>[</span>
    <span class=n>SessionCookieManager</span><span class=p>(</span><span class=s1>'myverysecretkey'</span><span class=p>),</span>
    <span class=n>db</span><span class=o>.</span><span class=n>handler</span><span class=p>,</span>
    <span class=n>auth</span><span class=o>.</span><span class=n>handler</span>
<span class=p>]</span>

<span class=nd>@app.route</span><span class=p>(</span><span class=s1>'/account(/&LTstr:f>)?(/&LTstr:k>)?'</span><span class=p>)</span>
<span class=k>def</span> <span class=nf>account</span><span class=p>(</span><span class=n>f</span><span class=p>,</span> <span class=n>k</span><span class=p>):</span>
    <span class=n>form</span> <span class=o>=</span> <span class=n>auth</span><span class=p>(</span><span class=n>f</span><span class=p>,</span> <span class=n>k</span><span class=p>)</span>
    <span class=k>return</span> <span class=nb>dict</span><span class=p>(</span><span class=n>form</span><span class=o>=</span><span class=n>form</span><span class=p>)</span>
</code></pre></div><p>That's it. Write a template page for the account function including the returned form and open <a href=http://127.0.0.1:8000/account> http://127.0.0.1:8000/account </a> in your browser. weppy should redirect you to the login page and showing you the relative form.<blockquote><p><strong> Note: </strong> weppy's auth module requires session handling and a DAL instance activated on your application to work properly.</blockquote><p>As you've figured out, the exposed <code>
       account
      </code> function will be responsible of the authorization flow in your app. The <code>
       Auth
      </code> module of weppy exposes (with the default settings):<ul><li>http://.../{baseurl}/login<li>http://.../{baseurl}/logout<li>http://.../{baseurl}/register<li>http://.../{baseurl}/verify_email<li>http://.../{baseurl}/retrieve_username<li>http://.../{baseurl}/retrieve_password<li>http://.../{baseurl}/reset_password<li>http://.../{baseurl}/request_reset_password<li>http://.../{baseurl}/change_password<li>http://.../{baseurl}/profile</ul><p>and it also creates all the database tables needed, from users to groups and memberships ones.<p>You can obviously change the routing url for the authorization function:<div class=codehilite><pre><span></span><code><span class=nd>@app.route</span><span class=p>(</span><span class=s1>'/myurl(/&LTstr:f>)?(/&LTstr:k>)?'</span><span class=p>)</span>
<span class=k>def</span> <span class=nf>accunt</span><span class=p>(</span><span class=n>f</span><span class=p>,</span> <span class=n>k</span><span class=p>):</span>
    <span class=c1># code</span>
</code></pre></div><p>and even change the name of the exposed function, but if you do that, you mast tell to the <code>
       Auth
      </code> module to use it to generate urls:<div class=codehilite><pre><span></span><code><span class=n>auth</span> <span class=o>=</span> <span class=n>Auth</span><span class=p>(</span><span class=n>app</span><span class=p>,</span> <span class=n>db</span><span class=p>,</span> <span class=n>base_url</span><span class=o>=</span><span class=s1>'mycontrol'</span><span class=p>)</span>

<span class=nd>@app.route</span><span class=p>(</span><span class=s1>'/myurl(/&LTstr:f>)?(/&LTstr:k>)?'</span><span class=p>)</span>
<span class=k>def</span> <span class=nf>mycontrol</span><span class=p>(</span><span class=n>f</span><span class=p>,</span> <span class=n>k</span><span class=p>):</span>
    <span class=n>form</span> <span class=o>=</span> <span class=n>auth</span><span class=p>(</span><span class=n>f</span><span class=p>,</span> <span class=n>k</span><span class=p>)</span>
    <span class=k>return</span> <span class=nb>dict</span><span class=p>(</span><span class=n>form</span><span class=o>=</span><span class=n>form</span><span class=p>)</span>
</code></pre></div><p>otherwise the authorization module won't work properly.<h3 id=disable-specific-actions>Disable specific actions</h3><p>You may want to disable some actions exposed by the authorization module, let's say for example you don't want the <code>
       retrieve_username
      </code> functionality. To do that, just edit your application configuration:<div class=codehilite><pre><span></span><code><span class=n>app</span><span class=o>.</span><span class=n>config</span><span class=o>.</span><span class=n>auth</span><span class=o>.</span><span class=n>actions_disabled</span> <span class=o>=</span> <span class=p>[</span><span class=s2>"retrieve_username"</span><span class=p>]</span>
</code></pre></div><h3 id=add-custom-actions>Add custom actions</h3><p>You can also define custom actions to be routed by your application. Let's say you want to route "/account/facebook" on your "/account" exposed function:<div class=codehilite><pre><span></span><code><span class=k>def</span> <span class=nf>myfbfunction</span><span class=p>():</span>
    <span class=c1># code</span>

<span class=n>auth</span><span class=o>.</span><span class=n>register_action</span><span class=p>(</span><span class=s2>"facebook"</span><span class=p>,</span> <span class=n>myfbfunction</span><span class=p>)</span>
</code></pre></div><p>and that's it.<h2 id=access-control-with-requires>Access control with "requires"</h2><p>One of the advantages of the authorization module is the simple way you can introduce access controls over your application. Let's say, for example, that you need to allow access to a specific zone only to logged users. In weppy you can do that in just a line of code:<div class=codehilite><pre><span></span><code><span class=kn>from</span> <span class=nn>weppy.tools</span> <span class=kn>import</span> <span class=n>requires</span>

<span class=nd>@app.route</span><span class=p>()</span>
<span class=nd>@requires</span><span class=p>(</span><span class=n>auth</span><span class=o>.</span><span class=n>is_logged_in</span><span class=p>,</span> <span class=n>url</span><span class=p>(</span><span class=s1>'unauthorized_page'</span><span class=p>))</span>
<span class=k>def</span> <span class=nf>myprotected_page</span><span class=p>():</span>
    <span class=c1>#some code</span>
</code></pre></div><p>As you probably figured out, the <code>
       requires
      </code> helper will check the condition passed as the first parameter and if the request doesn't met the requirement, it will redirect the client on the url passed as second parameter.<p>You can also pass a function to be invoked as second parameter, for example:<div class=codehilite><pre><span></span><code><span class=k>def</span> <span class=nf>not_auth</span><span class=p>():</span>
    <span class=n>abort</span><span class=p>(</span><span class=mi>403</span><span class=p>)</span>

<span class=nd>@app.route</span><span class=p>()</span>
<span class=nd>@requires</span><span class=p>(</span><span class=k>lambda</span><span class=p>:</span> <span class=n>auth</span><span class=o>.</span><span class=n>has_membership</span><span class=p>(</span><span class=s1>'administrator'</span><span class=p>),</span> <span class=n>not_auth</span><span class=p>)</span>
<span class=k>def</span> <span class=nf>admin</span><span class=p>():</span>
    <span class=c1># code</span>
</code></pre></div><p>to return an HTTP 403 error.<blockquote><p><strong> Note: </strong> when you need to evaluate the condition during the request, if the first argument passed to <code>
        requires
       </code> is not a callable you should use a <code>
        lambda
       </code> function.</blockquote><p>Sometimes you may need to return specific contents on missing authorization, for example you can write:<div class=codehilite><pre><span></span><code><span class=kn>from</span> <span class=nn>weppy.tools</span> <span class=kn>import</span> <span class=n>service</span>

<span class=k>def</span> <span class=nf>not_auth</span><span class=p>():</span>
    <span class=k>return</span> <span class=nb>dict</span><span class=p>(</span><span class=n>error</span><span class=o>=</span><span class=s2>"Not authorized"</span><span class=p>)</span>

<span class=nd>@app.route</span><span class=p>()</span>
<span class=nd>@requires</span><span class=p>(</span><span class=n>auth</span><span class=o>.</span><span class=n>is_logged_in</span><span class=p>,</span> <span class=n>not_auth</span><span class=p>)</span>
<span class=nd>@service.json</span>
<span class=k>def</span> <span class=nf>protected</span><span class=p>():</span>
    <span class=k>return</span> <span class=nb>dict</span><span class=p>(</span><span class=n>data</span><span class=o>=</span><span class=s2>"Some data here"</span><span class=p>)</span>
</code></pre></div><p>so the client will receive a JSON object also on authorization error.<blockquote><p>– Ok dude. What if I want to protect an entire application module with access control?</blockquote><p>You can use the <code>
       RequireHandler
      </code> instead of decorating any function of your module:<div class=codehilite><pre><span></span><code><span class=kn>from</span> <span class=nn>weppy</span> <span class=kn>import</span> <span class=n>AppModule</span>
<span class=kn>from</span> <span class=nn>weppy.handlers</span> <span class=kn>import</span> <span class=n>RequireHandler</span>

<span class=n>mymodule</span> <span class=o>=</span> <span class=n>AppModule</span><span class=p>(</span><span class=n>app</span><span class=p>,</span> <span class=s2>"mymodule"</span><span class=p>,</span> <span class=vm>__name__</span><span class=p>)</span>
<span class=n>mymodule</span><span class=o>.</span><span class=n>common_handlers</span> <span class=o>=</span> <span class=p>[</span><span class=n>RequireHandler</span><span class=p>(</span><span class=n>some_condition</span><span class=p>,</span> <span class=n>otherwise</span><span class=p>)]</span>
</code></pre></div><p>just remember to not add access control over your authorization exposed function, otherwise your user won't be able to login.<h2 id=authorization-models>Authorization models</h2><p><em> New in version 0.4 </em><p>The <code>
       Auth
      </code> module define five models (and obviously the five related database tables) under default behavior:<ul><li><code>
        AuthUser
       </code><li><code>
        AuthGroup
       </code><li><code>
        AuthMembership
       </code><li><code>
        AuthPermission
       </code><li><code>
        AuthEvent
       </code></ul><p>Now, you can customize the models subclassing them, and the first you want to is the one referred to the user, on which you can add your fields, for example an avatar. You will define your <code>
       User
      </code> model:<div class=codehilite><pre><span></span><code><span class=kn>from</span> <span class=nn>weppy.dal</span> <span class=kn>import</span> <span class=n>Field</span>
<span class=kn>from</span> <span class=nn>weppy.tools.auth</span> <span class=kn>import</span> <span class=n>AuthUser</span>


<span class=k>class</span> <span class=nc>User</span><span class=p>(</span><span class=n>AuthUser</span><span class=p>):</span>
    <span class=n>avatar</span> <span class=o>=</span> <span class=n>Field</span><span class=p>(</span><span class=s2>"upload"</span><span class=p>,</span> <span class=n>uploadfolder</span><span class=o>=</span><span class=s2>"uploads"</span><span class=p>)</span>

    <span class=n>form_profile_rw</span> <span class=o>=</span> <span class=p>{</span>
        <span class=s2>"avatar"</span><span class=p>:</span> <span class=bp>True</span>
    <span class=p>}</span>
</code></pre></div><p>and pass it to the Auth instance:<div class=codehilite><pre><span></span><code><span class=kn>from</span> <span class=nn>weppy.tools</span> <span class=kn>import</span> <span class=n>Auth</span>
<span class=n>auth</span> <span class=o>=</span> <span class=n>Auth</span><span class=p>(</span><span class=n>app</span><span class=p>,</span> <span class=n>db</span><span class=p>,</span> <span class=n>usermodel</span><span class=o>=</span><span class=n>User</span><span class=p>)</span>
</code></pre></div><p>As you can see, defining your user model subclassing <code>
       AuthUser
      </code> is quite the same as for a <code>
       Model
      </code> , except that the fields you define will be the additional fields you want to add to the user table, and instead of the <code>
       form_rw
      </code> attribute you have <code>
       form_profile_rw
      </code> and <code>
       form_registration_rw
      </code> to treat separately the field access during user registration and when the user edits its own profile. As the default visibility is set to <code>
       False
      </code> for any extra field you have defined, in the above example the client will be able to upload an avatar for its account only with the profile function and not during the registration.<p>The default fields included in the <code>
       AuthUser
      </code> model are:<ul><li>email<li>password<li>first_name<li>last_name</ul><p>plus some other columns need by the system and hidden to the users.<p>If you don't want to have the <code>
       first_name
      </code> and <code>
       last_name
      </code> fields inside your user model (they are set to be not-null), you can subclass the <code>
       AuthUserBasic
      </code> model instead, available under <code>
       weppy.tools.auth.models
      </code> which doesn't include them.<p>Before seeing how to customize the remaining auth models, let's see which relations are available as default.<h3 id=auth-relations>Auth relations</h3><p>The default <code>
       Auth
      </code> configuration gives you the ability to use these <code>
       has_many
      </code> relations on the <code>
       AuthUser
      </code> model (and any model subclassing it):<div class=codehilite><pre><span></span><code><span class=n>user</span> <span class=o>=</span> <span class=n>db</span><span class=o>.</span><span class=n>AuthUser</span><span class=p>(</span><span class=nb>id</span><span class=o>=</span><span class=mi>1</span><span class=p>)</span>
<span class=c1># referring membership records</span>
<span class=n>user</span><span class=o>.</span><span class=n>authmemberships</span><span class=p>()</span>
<span class=c1># referring group records</span>
<span class=n>user</span><span class=o>.</span><span class=n>authgroups</span><span class=p>()</span>
<span class=c1># referring permission records</span>
<span class=n>user</span><span class=o>.</span><span class=n>authpermissions</span><span class=p>()</span>
<span class=c1># referring event records</span>
<span class=n>user</span><span class=o>.</span><span class=n>authevents</span><span class=p>()</span>
</code></pre></div><p>The <code>
       AuthGroup
      </code> model has these <code>
       has_many
      </code> relations:<div class=codehilite><pre><span></span><code><span class=n>group</span> <span class=o>=</span> <span class=n>db</span><span class=o>.</span><span class=n>AuthGroup</span><span class=p>(</span><span class=nb>id</span><span class=o>=</span><span class=mi>1</span><span class=p>)</span>
<span class=c1># referring user records</span>
<span class=n>group</span><span class=o>.</span><span class=n>users</span><span class=p>()</span>
<span class=c1># referring permission records</span>
<span class=n>group</span><span class=o>.</span><span class=n>authpermissions</span><span class=p>()</span>
</code></pre></div><p>Consequentially, <code>
       AuthMembership
      </code> , <code>
       AuthPermission
      </code> and <code>
       AuthEvent
      </code> have the inverse <code>
       belongs_to
      </code> relations:<div class=codehilite><pre><span></span><code><span class=n>membership</span> <span class=o>=</span> <span class=n>db</span><span class=o>.</span><span class=n>AuthMembership</span><span class=p>(</span><span class=nb>id</span><span class=o>=</span><span class=mi>1</span><span class=p>)</span>
<span class=c1># referred user record</span>
<span class=n>membership</span><span class=o>.</span><span class=n>user</span>
<span class=c1># referred group record</span>
<span class=n>membership</span><span class=o>.</span><span class=n>authgroup</span>

<span class=n>permission</span> <span class=o>=</span> <span class=n>db</span><span class=o>.</span><span class=n>AuthPermission</span><span class=p>(</span><span class=nb>id</span><span class=o>=</span><span class=mi>1</span><span class=p>)</span>
<span class=c1># referred group record</span>
<span class=n>permission</span><span class=o>.</span><span class=n>authgroup</span>

<span class=n>event</span> <span class=o>=</span> <span class=n>db</span><span class=o>.</span><span class=n>AuthEvent</span><span class=p>(</span><span class=nb>id</span><span class=o>=</span><span class=mi>1</span><span class=p>)</span>
<span class=c1># referred user record</span>
<span class=n>event</span><span class=o>.</span><span class=n>user</span>
</code></pre></div><h3 id=customizing-auth-models>Customizing auth models</h3><p><em> section in development </em><h2 id=users-management>Users management</h2><p>Thanks to the models and relations defined by the <code>
       Auth
      </code> module, you can easily manage the users in your application. Let's say, for example, you want to add a <strong> group </strong> of administrators:<div class=codehilite><pre><span></span><code><span class=n>admins</span> <span class=o>=</span> <span class=n>auth</span><span class=o>.</span><span class=n>add_group</span><span class=p>(</span><span class=s1>'administrators'</span><span class=p>)</span>
</code></pre></div><p>then you can add users to the administrators' group easily:<div class=codehilite><pre><span></span><code><span class=n>admin</span> <span class=o>=</span> <span class=n>db</span><span class=o>.</span><span class=n>User</span><span class=p>(</span><span class=nb>id</span><span class=o>=</span><span class=mi>42</span><span class=p>)</span>
<span class=c1># 1st way:</span>
<span class=n>auth</span><span class=o>.</span><span class=n>add_membership</span><span class=p>(</span><span class=n>admins</span><span class=p>,</span> <span class=n>admin</span><span class=p>)</span>
<span class=c1># 2nd way:</span>
<span class=n>auth</span><span class=o>.</span><span class=n>add_membership</span><span class=p>(</span><span class=s1>'administrators'</span><span class=p>,</span> <span class=n>admin</span><span class=p>)</span>
<span class=c1># 3rd way:</span>
<span class=n>admins</span><span class=o>.</span><span class=n>users</span><span class=o>.</span><span class=n>add</span><span class=p>(</span><span class=n>admin</span><span class=p>)</span>
<span class=c1># 4th way:</span>
<span class=n>admin</span><span class=o>.</span><span class=n>authgroups</span><span class=o>.</span><span class=n>add</span><span class=p>(</span><span class=n>admins</span><span class=p>)</span>
</code></pre></div><p>Once you have added groups and memberships, you can use the <code>
       has_membership
      </code> helper of the <code>
       Auth
      </code> model (that we've already seen before in the <em> requires </em> paragraph):<div class=codehilite><pre><span></span><code><span class=c1># on the logged user:</span>
<span class=n>auth</span><span class=o>.</span><span class=n>has_membership</span><span class=p>(</span><span class=s1>'administrators'</span><span class=p>)</span>
<span class=c1># specifying a user:</span>
<span class=n>auth</span><span class=o>.</span><span class=n>has_membership</span><span class=p>(</span><span class=s1>'administrator'</span><span class=p>,</span> <span class=n>user</span><span class=p>)</span>
</code></pre></div><p>and you can obviously get all the groups user has membership with using relation:<div class=codehilite><pre><span></span><code><span class=n>user</span><span class=o>.</span><span class=n>authgroups</span><span class=p>()</span>
</code></pre></div><p>But weppy's <code>
       Auth
      </code> module also have a finer management for users, considering permissions:<div class=codehilite><pre><span></span><code><span class=n>auth</span><span class=o>.</span><span class=n>add_permission</span><span class=p>(</span><span class=n>admins</span><span class=p>,</span> <span class=s1>'ban_users'</span><span class=p>)</span>
</code></pre></div><p>As you got from the example, this allows you to bind specific permissions to groups, and then checks for them both on groups and users:<div class=codehilite><pre><span></span><code><span class=c1># on the logged user:</span>
<span class=n>auth</span><span class=o>.</span><span class=n>has_permission</span><span class=p>(</span><span class=s1>'ban_users'</span><span class=p>)</span>
<span class=c1># on specific user:</span>
<span class=n>auth</span><span class=o>.</span><span class=n>has_permission</span><span class=p>(</span><span class=s1>'ban_users'</span><span class=p>,</span> <span class=n>user</span><span class=o>=</span><span class=n>admin</span><span class=p>)</span>
<span class=c1># on specific group:</span>
<span class=n>auth</span><span class=o>.</span><span class=n>has_permission</span><span class=p>(</span><span class=s1>'ban_users'</span><span class=p>,</span> <span class=n>group</span><span class=o>=</span><span class=n>admins</span><span class=p>)</span>
</code></pre></div><p>weppy's <code>
       Auth
      </code> permissions also support more details, like a model name and a record:<div class=codehilite><pre><span></span><code><span class=n>maintenance</span> <span class=o>=</span> <span class=n>db</span><span class=o>.</span><span class=n>Preference</span><span class=p>(</span><span class=n>name</span><span class=o>=</span><span class=s1>'maintenance'</span><span class=p>)</span><span class=o>.</span><span class=n>first</span><span class=p>()</span>
<span class=n>auth</span><span class=o>.</span><span class=n>add_permission</span><span class=p>(</span><span class=n>admins</span><span class=p>,</span> <span class=s1>'write'</span><span class=p>,</span> <span class=s1>'Setting'</span><span class=p>,</span> <span class=n>maintenance</span><span class=o>.</span><span class=n>id</span><span class=p>)</span>
<span class=c1># then you will check</span>
<span class=n>auth</span><span class=o>.</span><span class=n>has_permission</span><span class=p>(</span><span class=s1>'write'</span><span class=p>,</span> <span class=s1>'Setting'</span><span class=p>,</span> <span class=n>maintenance</span><span class=o>.</span><span class=n>id</span><span class=p>)</span>
</code></pre></div><h3 id=blocking-users>Blocking users</h3><p><em> New in version 0.6 </em><p>Sometimes you need to lock user operations on your application. The auth module have 2 different <em> locking </em> statuses for this:<ul><li><strong> disabled: </strong> the user won't be able to perform the normal auth operation until the reset of the password<li><strong> blocked: </strong> the user won't be able to perform any auth operation (aka banned)</ul><p>You can change an user status in two different ways, the first is directly with you <code>
       Auth
      </code> instance:<div class=codehilite><pre><span></span><code><span class=n>auth</span><span class=o>.</span><span class=n>disable_user</span><span class=p>(</span><span class=n>user</span><span class=p>)</span>
<span class=n>auth</span><span class=o>.</span><span class=n>block_user</span><span class=p>(</span><span class=n>user</span><span class=p>)</span>
<span class=n>auth</span><span class=o>.</span><span class=n>allow_user</span><span class=p>(</span><span class=n>user</span><span class=p>)</span>
</code></pre></div><p>where the only accepted parameter is an user row (including the id) or just the id of the user involved.<p>But you can also change the user status directly on a user you've selected from the database:<div class=codehilite><pre><span></span><code><span class=n>user</span> <span class=o>=</span> <span class=n>User</span><span class=o>.</span><span class=n>first</span><span class=p>()</span>
<span class=n>user</span><span class=o>.</span><span class=n>disable</span><span class=p>()</span>
<span class=n>user</span><span class=o>.</span><span class=n>block</span><span class=p>()</span>
<span class=n>user</span><span class=o>.</span><span class=n>allow</span><span class=p>()</span>
</code></pre></div><p>The allow methods will simply reset any blocking status on the users.<h2 id=auth-module-configuration>Auth module configuration</h2><p><em> section in development </em><h2 id=additional-login-methods>Additional login methods</h2><p><em> section in development </em></div><div class="pure-u-1 pure-u-lg-1-5"><div class=page-sections><ul><li class=tree-section><a href=#access-control-with-requires> Access control with "requires" </a><li class=tree-section><a href=#authorization-models> Authorization models </a><li class=tree-section><a href=#users-management> Users management </a><li class=tree-section><a href=#auth-module-configuration> Auth module configuration </a><li class=tree-section><a href=#additional-login-methods> Additional login methods </a></ul></div></div></div><div class=navigator><div class=navigator-left><a href=/docs/0.6/forms> < Forms </a></div><div class=navigator-right><a href=/docs/0.6/caching> Caching > </a></div></div></div><footer><p>© 2021 <span> Giovanni Barillari </span></footer><script>// <![CDATA[
    (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
    (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
    m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
    })(window,document,'script','//www.google-analytics.com/analytics.js','ga');
    ga('create', 'UA-432541-9', 'auto');
    ga('send', 'pageview');
// ]]></script>