Hello, Today I took some time to review the state of affairs for checking for what used to be identity in TG1.
A little reminder of the API http://docs.turbogears.org/1.0/UsingIdentity#using-identity-in-templates IMO that api was really good as tg.identity (the template variable) was a simple proxy to the current logged in user and some handy methods. Fast forward to TG2 we have a very different API first it's a dict and not a Bunch (aka attribute access) template_vars.tg.identity.keys() ['userdata', 'repoze.who.userid', 'timestamp', 'tokens', 'user', 'groups', 'permissions'] more interesting than that template_vars.tg.identity returns None when the user isn't logged on. which means you will have to precheck all your access tests in something along the lines of if tg.identity and tg.identity['user'] == "something" which is too weird. on top of that it seems to me that checks in the form of are simply not possible py:if="'admin' in tg.identity.groups"" is there an obvious way of doing this with repoze.what that I'm missing? Also keep in mind this is pure syntax sugar as the real security check was done in the controller. Last but not least is this a class that is worth including in r.what? or should we keep it TG only? IMO this api is nice enough to work on any python template/framework and I think it's totally worth pushing into what. _______________________________________________ Repoze-dev mailing list Repoze-dev@lists.repoze.org http://lists.repoze.org/listinfo/repoze-dev
