Crivens!

import logging
from copy import copy
from tg.configuration import AppConfig

class DerivedAppConfigAuth(AppConfig):
    """
    Own App-Config class to implement custom repoze.(who|what) plugins

    The class tg.configuration.AppConfig is derived to implement custom plugins
    for authentification and authorization.
    """

    def add_auth_middleware(self, app, skip_authentication):
        """
        Configure authentication and authorization.

        :param app: The TG2 application.
        :param skip_authentication: Should authentication be skipped if
            explicitly requested? (used by repoze.who-testutil)
        :type skip_authentication: bool

        """
        from repoze.what.plugins.quickstart import setup_sql_auth
        from repoze.what.plugins.pylonshq import booleanize_predicates

        # Predicates booleanized:
        booleanize_predicates()

        # Configuring auth logging:
        if 'log_stream' not in self.sa_auth:
            self.sa_auth['log_stream'] = logging.getLogger('auth')

        # Removing keywords not used by repoze.who:
        auth_args = copy(self.sa_auth)
        pprint(auth_args)
        if 'password_encryption_method' in auth_args:
            del auth_args['password_encryption_method']
        if not skip_authentication:
            if not 'cookie_secret' in auth_args.keys():
                msg = "base_config.sa_auth.cookie_secret is required " \
                "you must define it in app_cfg.py or set " \
                "sa_auth.cookie_secret in development.ini"
                print msg
                raise ConfigurationError(message=msg)
        app = setup_derived_auth(app, skip_authentication=skip_authentication,
                             **auth_args)
        return app

from repoze.what.plugins.quickstart import find_plugin_translations
from repoze.what.plugins.sql import configure_sql_adapters
from repoze.who.plugins.auth_tkt import AuthTktCookiePlugin
from repoze.who.plugins.friendlyform import FriendlyFormPlugin
from repoze.what.middleware import setup_auth

def setup_derived_auth(app, user_class, group_class, permission_class,
                   dbsession, form_plugin=None, form_identifies=True,
                   cookie_secret='secret', cookie_name='authtkt',
                   login_url='/login', login_handler='/login_handler',
                   post_login_url=None, logout_handler='/logout_handler',
                   post_logout_url=None, login_counter_name=None,
                   translations={}, **who_args):
    """
    Configure :mod:`repoze.who` and :mod:`repoze.what` with SQL-only 
    authentication and authorization, respectively.
    […]
    """
    plugin_translations = find_plugin_translations(translations)

    if group_class is None or permission_class is None:
        group_adapters = permission_adapters = None
    else:
        source_adapters = configure_sql_adapters(
            user_class,
            group_class,
            permission_class,
            dbsession,
            plugin_translations['group_adapter'],
            plugin_translations['permission_adapter'])
        group_adapters = {'sql_auth': source_adapters['group']}
        permission_adapters = {'sql_auth': source_adapters['permission']}

    # Setting the repoze.who authenticators:
    # using custom class here, removed translations for this class
    if 'authenticators' not in who_args:
        who_args['authenticators'] = []
    orchestra_auth = OrchestraDbTeamUserAuthenticatorPlugin(user_class, dbsession)
    who_args['authenticators'].append(('orchestra_auth', Orchestraauth))

    cookie = AuthTktCookiePlugin(cookie_secret, cookie_name)

    # Setting the repoze.who identifiers
    if 'identifiers' not in who_args:
        who_args['identifiers'] = []
    who_args['identifiers'].append(('cookie', cookie))

    if form_plugin is None:
        form = FriendlyFormPlugin(
            login_url,
            login_handler,
            post_login_url,
            logout_handler,
            post_logout_url,
            login_counter_name=login_counter_name,
            rememberer_name='cookie')
    else:
        form = form_plugin

    if form_identifies:
        who_args['identifiers'].insert(0, ('main_identifier', form))

    # Setting the repoze.who challengers:
    if 'challengers' not in who_args:
        who_args['challengers'] = []
    who_args['challengers'].append(('form', form))

    # Setting up the repoze.who mdproviders:
    # using custom class here, removed translations for this class
    orchestra_user_md = OrchestraDbTeamUserMDPlugin(user_class, dbsession)
    if 'mdproviders' not in who_args:
        who_args['mdproviders'] = []
    who_args['mdproviders'].append(('orchestra_user_md', orchestra_user_md))

    middleware = setup_auth(app, group_adapters, permission_adapters, 
                            **who_args)
    return middleware

from sqlalchemy.orm.exc import NoResultFound, MultipleResultsFound

class _BaseRepozeWhoOrchestraDdPlugin(object):
    """ Baseclass for the custom authenticator and metadata provider """

    def __init__(self, user_class, dbsession):
        """
        Setup the plugin.

        :param user_class: The SQLAlchemy/Elixir class for the users.
        :param session: The SQLAlchemy/Elixir session.

        """
        self.user_class = user_class
        self.dbsession = dbsession

    def get_user(self, email):
        try:
            return self.user_class.by_email_address(email)
        except (NoResultFound, MultipleResultsFound):
            # As recommended in the docs for repoze.who, it's important to
            # verify that there's only _one_ matching userid.
            return None

from zope.interface import implements
from repoze.who.interfaces import IAuthenticator

class OrchestraDbTeamUserAuthenticatorPlugin(_BaseRepozeWhoOrchestraDdPlugin):
    """
    :mod:`repoze.who` custom authenticator for OrchestraDb
    """

    implements(IAuthenticator)

    # IAuthenticator
    def authenticate(self, environ, identity):
        if not ('login' in identity and 'password' in identity):
            return None

        user = self.get_user(identity['login'])

        if user:
            if user.validate_password(identity['password']):
                return identity['login']

from repoze.who.interfaces import IMetadataProvider
class OrchestraDbTeamUserMDPlugin(_BaseRepozeWhoOrchestraDdPlugin):
    """
    :mod:`repoze.who` custom metadata provider that loads the SQLAlchemy-powered
    object for the current user in the OrchestraDb.

    It loads the object into ``identity['user']``.

    """

    implements(IMetadataProvider)

    def add_metadata(self, environ, identity):
        identity['user'] = self.get_user(identity['repoze.who.userid'])

# from tg.configuration import AppConfig
from orchestra.config.derived_app_config_auth import DerivedAppConfigAuth
base_config = DerivedAppConfigAuth()