intranet.security
=================

.. py:module:: intranet.security


Functions
---------

.. autoapisummary::

   intranet.security.get_roles_setting
   intranet.security.may_view_static_files_not_logged_in
   intranet.security.may_view_theme_files_not_logged_in
   intranet.security.may_view_auth_not_logged_in
   intranet.security.may_view_public_identity


Module Contents
---------------

.. py:function:: get_roles_setting() -> dict[str, set[type[onegov.core.security.roles.Intent]]]

   Returns the default roles available to onegov.core applications.

   Applications building on onegov.core may add more roles and permissions,
   or replace the existing ones entirely, though it's not something that
   one should do carelessly.

   The default roles are:

   **admin**
       Has access to everything

   **editor**
       Has access to most things

   **member**
       Has access their own data. Be careful though, core doesn't know about
       personal data, so this is just a role to implement registered users.
       As with all permissions, making sure the right information is shown
       is up to the applications.

   **anonymous**
       Has access to public things



.. py:function:: may_view_static_files_not_logged_in(app: onegov.intranet.app.IntranetApp, identity: morepath.authentication.NoIdentity, model: onegov.core.static.StaticFile, permission: type[onegov.core.security.Public]) -> bool

   Always allow to view static files.

   Those files are public anyway, since we are open-source.



.. py:function:: may_view_theme_files_not_logged_in(app: onegov.intranet.app.IntranetApp, identity: morepath.authentication.NoIdentity, model: onegov.core.theme.ThemeFile, permission: type[onegov.core.security.Public]) -> bool

   Always allow to view theme files.

   Those files are public anyway, since we are open-source.



.. py:function:: may_view_auth_not_logged_in(app: onegov.intranet.app.IntranetApp, identity: morepath.authentication.NoIdentity, model: onegov.user.Auth, permission: type[onegov.core.security.Public]) -> bool

   Anonymous needs to be able to log in. 


.. py:function:: may_view_public_identity(app: onegov.intranet.app.IntranetApp, identity: morepath.authentication.NoIdentity, model: onegov.core.metadata.PublicMetadata, permission: type[onegov.core.security.Public]) -> bool

   Even anonymous may view the public metadata of the instance.