text: #
  # Copyright (c) 2015-2019 Thierry Florac <tflorac AT ulthar.net>
  # All Rights Reserved.
  #
  # This software is subject to the provisions of the Zope Public License,
  # Version 2.1 (ZPL).  A copy of the ZPL should accompany this distribution.
  # THIS SOFTWARE IS PROVIDED "AS IS" AND ANY AND ALL EXPRESS OR IMPLIED
  # WARRANTIES ARE DISCLAIMED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  # WARRANTIES OF TITLE, MERCHANTABILITY, AGAINST INFRINGEMENT, AND FITNESS
  # FOR A PARTICULAR PURPOSE.
  #
  
  """PyAMS_security.interfaces.base module
  
  This module defines base security permissions and interfaces.
  """
  
  from zope.interface import Interface
  from zope.schema import Dict, Set, Text, TextLine
  
  
  __docformat__ = 'restructuredtext'
  
  
  FORBIDDEN_PERMISSION = 'system.forbidden'
  '''Custom permission which is never granted to any user, even system manager'''
  
  PUBLIC_PERMISSION = 'public'
  '''Public permission which is granted to every principal'''
  
  VIEW_PERMISSION = 'view'
  '''View permission is a custom permission used to view contents'''
  
  MANAGE_PERMISSION = 'manage'
  '''Permission used to manage basic information; this permission is generally not used by custom
  contents'''
  
  VIEW_SYSTEM_PERMISSION = 'pyams.ViewSystem'
  '''Permission used to access management screens'''
  
  MANAGE_SYSTEM_PERMISSION = 'pyams.ManageSystem'
  '''Permission used to manage system settings'''
  
  MANAGE_SECURITY_PERMISSION = 'pyams.ManageSecurity'
  '''Permission used to manage security settings'''
  
  MANAGE_ROLES_PERMISSION = 'pyams.ManageRoles'
  '''Permission used to manage roles'''
  
  
  class IPermission(Interface):
      """Permission interface"""
  
      # pylint: disable=invalid-name
      id = TextLine(title="Unique ID",
                    required=True)
  
      title = TextLine(title="Title",
                       required=True)
  
      description = Text(title="Description",
                         required=False)
  
  
  ROLE_ID = 'role:{}'
  '''Role ID formatter string'''
  
  
  class IRole(Interface):
      """Role interface
  
      A role is a set of permissions; by assigning the role to a principal,
      these permissions are also granted to the principal.
      """
  
      # pylint: disable=invalid-name
      id = TextLine(title="Unique ID",
                    required=True)
  
      title = TextLine(title="Title",
                       required=True)
  
      description = Text(title="Description",
                         required=False)
  
      permissions = Set(title="Permissions",
                        description="ID of role's permissions",
                        value_type=TextLine(),
                        required=False)
  
      managers = Set(title="Managers",
                     description="List of principal IDs allowed to manage this role. "
                                 "If it's a role, use 'role:role_id' syntax...",
                     value_type=TextLine(),
                     required=False)
  
  
  class IPrincipalInfo(Interface):
      """Principal info class
  
      This is the generic interface of objects defined in request 'principal' attribute.
      """
  
      # pylint: disable=invalid-name
      id = TextLine(title="Globally unique ID",
                    required=True)
  
      title = TextLine(title="Principal name",
                       required=True)
  
      attributes = Dict(title="Principal groups",
                        description="IDs of principals to which this principal directly belongs",
                        value_type=TextLine())
  