python
/
aiohttp-security
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Improve doc

This commit is contained in:
Andrew Svetlov 2015-11-18 12:07:42 +02:00
parent 01ebd42d8f
commit c379fb4beb
1 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
docs/usage.rst
View File

@ -9,7 +9,15 @@
.. highlight:: python .. highlight:: python
The library is build on top of two policies: :term:`authentication` The library is build on top of two policies: :term:`authentication`
and :term:`authorization`. and :term:`authorization` and public API.
API is policy agnostic, all client code should not call policy code
directly but use API only.
Via API application can remember/forget user in local session
(:func:`remember`/:func:`forget`), retrieve :term:`userid`
(:func:`authorized_userid`) and check :term:`permission` for
remembered user (:func:`permits`).
Authentication Authentication
@ -21,7 +29,7 @@ Actions related to retrieving, storing and removing user's
Authenticated user has no access rights, the system even has no Authenticated user has no access rights, the system even has no
knowledge is there the user still registered in DB. knowledge is there the user still registered in DB.
If :term:`request` has an :term:`identity` it means the user has If :class:`aiohttp.web.Request` has an :term:`identity` it means the user has
some ID that should be checked by :term:`authorization` policy. some ID that should be checked by :term:`authorization` policy.
@ -32,4 +40,3 @@ some ID that should be checked by :term:`authorization` policy.
identity is a string shared between browser and server. identity is a string shared between browser and server.
Thus it's not supposed to be database primary key, user login/email etc. Thus it's not supposed to be database primary key, user login/email etc.
Random string like uuid or hash is better choice. Random string like uuid or hash is better choice.