Roles¶

With clearance.roles: every change to roles, and where a person's roles are read from.

RoleService ¶

RoleService(actor: User | None)

Makes, changes and gives out roles, for one actor - None for the system.

create_role ¶

create_role(code: str, name: str, *, ceiling: Iterable[str] | None = (), bundles: Iterable[Group] = ()) -> Role

A new role. Nobody has it yet, so making it changes nobody's access; but a ceiling other than "nothing" - None is none at all - is a ceiling set, and needs role_ceiling_edit.

rename_role ¶

rename_role(role: Role, name: str) -> Role

Renaming changes nobody's access, so even somebody holding the role may do it.

delete_role ¶

delete_role(role: Role) -> None

Delete role: whoever had it loses its starting bundles - and, when it was limited, its ceiling, which needs role_ceiling_edit.

ceiling_of ¶

ceiling_of(role: Role) -> Ceiling

What role lets its holders have: permission names, or None for no ceiling.

set_ceiling ¶

set_ceiling(role: Role, permissions: Iterable[str] | None) -> None

What role lets its holders have from now on - None for no ceiling at all. Needs role_ceiling_edit, and is refused to anybody holding the role.

give_bundle ¶

give_bundle(role: Role, bundle: Group) -> None

Everybody with role starts with bundle - the actor must hold what it gives.

take_bundle ¶

take_bundle(role: Role, bundle: Group) -> None

Nobody with role starts with bundle any more.

assign ¶

assign(person: UserModel, role: Role) -> None

Give person role: its starting bundles - which the actor must hold - and its ceiling. When they are under a ceiling already and the role would widen it, or lift it, that needs role_ceiling_edit.

unassign ¶

unassign(person: UserModel, role: Role) -> None

Take role from person. When it is limited, that lifts its ceiling from them, and needs role_ceiling_edit.

RoleResolver ¶

Bases: ABC

Reads which roles people have.

roles `abstractmethod` ¶

roles(user: User) -> QuerySet[Role]

The roles user has.

holders `abstractmethod` ¶

holders(roles: QuerySet[Role]) -> QuerySet[Any]

Everybody with any of roles.

fields ¶

fields() -> frozenset[str]

The fields of the user model this resolver reads roles from - none, unless it says so. The admin site keeps them for the superuser: whoever writes one gives a role, round every rule about giving one.

AssignmentResolver ¶

Bases: RoleResolver

Roles given in the admin site, or by RoleService.assign.

AttributeResolver ¶