I've recently been playing with Google's latest strange (ad)venture, Google App Engine. I've been addicted to python for a while, and have been playing with some of the web frameworks like TurboGears and pylons. So I jumped on the opportunity to write something I wouldn't have to worry about getting slashdotted for. That is, if I could get slashdotted (or dugg, or whatever).

In any case, it's a interesting framework, the datastore is different from anything you've probably worked with before, but is definitely worth a look, if only to expand your mind.

But, I just recently started writing an application with the App Engine SDK using pylons, and had a need to restrict access to certain pages of the application to logged in, or administrative users. Google's user API allows this fairly easily, but I wanted something nice and simple, so I wrote a decorator for the controller actions.

  1. from decorator import decorator
  2. import google.appengine.api.users as users
  3.  
  4. @decorator
  5. def reqire_user(f, *args, **kws):
  6. if users.get_current_user() is None:
  7. redirect_to(users.create_login_url(request.path_info))
  8. else:
  9. return f(*args, **kws)
  10.  
  11. @decorator
  12. def require_admin_user(f, *args, **kws):
  13. if users.get_current_user() is None:
  14. redirect_to(users.create_login_url(request.path_info))
  15. elif not users.is_current_user_admin():
  16. return render('/need_admin.mako')
  17. else:
  18. return f(*args, **kws)

Free to use, put it in the public domain, no need to credit or anything. Just thought I'd throw this out there for all those people who are new to python and might not think of this solution first.