Wire up a simple forbidden response for merges.

[xonotic/xonstat.git] / xonstat / __init__.py

diff --git a/xonstat/__init__.py b/xonstat/__init__.py
index 3053367721d5cfad6ee5c1968b538ba271c36a85..ef16ec98e54daff6830a025e90cc61f37375638e 100644 (file)
--- a/xonstat/__init__.py
+++ b/xonstat/__init__.py
@@ -1,5 +1,7 @@
 import sqlahelper
 from pyramid_beaker import set_cache_regions_from_settings
+from pyramid.authentication import AuthTktAuthenticationPolicy
+from pyramid.authorization import ACLAuthorizationPolicy
 from pyramid.config import Configurator
 from pyramid.httpexceptions import HTTPNotFound
 from pyramid.renderers import JSONP
@@ -22,6 +24,12 @@ def main(global_config, **settings):
 
     config = Configurator(settings=settings)
 
+    # authentication and authorization policies
+    authn_policy = AuthTktAuthenticationPolicy('secret', hashalg='sha512')
+    authz_policy = ACLAuthorizationPolicy()
+    config.set_authentication_policy(authn_policy)
+    config.set_authorization_policy(authz_policy)
+
     config.add_renderer('jsonp', JSONP(param_name='callback'))
 
     # for static assets
@@ -152,4 +160,10 @@ def main(global_config, **settings):
     config.add_route("search_json", "search.json")
     config.add_view(search_json, route_name="search_json", renderer="jsonp")
 
+    # ADMIN ROUTES
+    config.add_forbidden_view(forbidden, renderer="forbidden.mako")
+
+    config.add_route("merge",      "/merge")
+    config.add_view(route_name="merge", renderer="merge.mako", permission="admin")
+
     return config.make_wsgi_app()