fix filtering of deployments when adding slivers

[plstackapi.git] / planetstack / core / acl.py

diff --git a/planetstack/core/acl.py b/planetstack/core/acl.py
index 7fc6a02..7856414 100644 (file)
--- a/planetstack/core/acl.py
+++ b/planetstack/core/acl.py
@@ -1,5 +1,22 @@
 from fnmatch import fnmatch
 
+"""
+    A General-purpose ACL mechanism.
+
+    [allow | deny] <type_of_object> <text_pattern>\r
+\r
+    "allow all" and "deny all" are shorthand for allowing or denying all objects.\r
+    Lines are executed from top to bottom until a match was found, typical\r
+    iptables style. An implicit 'deny all' exists at the bottom of the list.\r
+\r
+    For example,\r
+    allow site Max Planck Institute\r
+    deny site Arizona\r
+    allow region US\r
+    deny user scott@onlab.us\r
+    allow user *@onlab.us
+"""
+
 class AccessControlList:
     def __init__(self, aclText=None):
         self.rules = []
@@ -42,17 +59,20 @@ class AccessControlList:
             lines.append( " ".join(rule) )
         return ";\n".join(lines)
 
-    def test(self, user):
+    def test(self, user, site=None):
         for rule in self.rules:
             if self.match_rule(rule, user):
                 return rule[0]
         return "deny"
 
-    def match_rule(self, rule, user):
+    def match_rule(self, rule, user, site=None):
         (action, object, pattern) = rule
 
+        if (site==None):
+            site = user.site
+
         if (object == "site"):
-            if fnmatch(user.site.name, pattern):
+            if fnmatch(site.name, pattern):
                 return True
         elif (object == "user"):
             if fnmatch(user.email, pattern):
@@ -64,6 +84,8 @@ class AccessControlList:
 
 
 if __name__ == '__main__':
+    # self-test
+
     class fakesite:
         def __init__(self, siteName):
             self.name = siteName