component server based authentication

[nerdoc]

Hi Adam, is there a way of getting the request within a component at the backend?
If I want to check if a user has a certain permission - how do I do that?
Given that Unicorn uses AJAX, there must be a request object 'somewhere' - under self I didn't find anything useful, and the docs don't tell nothin' 'bout it.

If not, wouldn't be that a great (and necessary) addon?
Thanks!

[nerdoc]

Oh, I just saw that there IS a self.requestobject in the UnicornView...
Nevermind & sorry for the spam.

[adamghill]

No worries! Yep, it's mentioned at https://www.django-unicorn.com/docs/advanced/#request, but let me know if it would make sense to mention it in other places in the documentation. 👍

[nerdoc]

Yes, maybe it should mention something like "Authentication" - Because in the search on the page, if you try to find this word, bummer. Auth is needed pretty often, so it should be mentioned.

I tried a bit myself, and introduced a permission = []in the Component class, and in the handle() method at the bottom a simple check before the actual calling happens:

#...
   # Handle the validate special action
     validate_all_fields = True
 else:
     access_granted = False
     if not component.permissions:
         access_granted = True
     else:
         for perm in component.permissions:
             if component_request.request.user.has_perm(perm):
                 access_granted = True
                 break
     if access_granted:
         component.calling(method_name, args)
         return_data.value = _call_method_name(component, method_name, args,
                                               kwargs)
         component.called(method_name, args)

This works, but is not really a good solution, as it allows no fine-grained control. Some methods maybe are allowed, some not for certain permissions.

So the best thing would IMHO be a @permission_required decorator to be applied at each method. But I didn't see how to get the request into that decorator at a first glance.