[Zope3-dev] Event suscribing and permissions

[Tarek Ziadé]

Hello,

it looks like 'provides' is mandatory for the 'subscriber' directive if
I need
to set a permission.

If I want to add a permission on a simple handler, it won't work:

No go:
...     <subscriber
...          handler="my_handler"
...          for="IMyEvent"
...          permission="InYourDreams"
...       />

this is because the subscriber directives checks the permission upon the
interface
provided by the 'provides' attribute.

How can I apply a permission then on a simple handler, since i don't
have a 'provides' attribute in this case ? is there another technique ?

If not, I guess we could change this behavior a bit to allow
handler-permission combos, otherwise
it makes it quite complicated to set up a simple, secured event handler.

Maybe we could check rights directly on the event interface ?   

Furthermore, the current behavior is not properly raising a TypeError
when a 'permission' is set together with a 'handler', we need to correct
this as well.

Regards,

Tarek