Produits Entr'ouvert » Authentic 2

a2_rbac: allow limiting permissions of OU managers (fixes #7787)

A new setting is added named A2_RBAC_MANAGED_CONTENT_TYPES, it
is a list of pairs of (app, model_name) which specify which object
permissions should be created and associated to the super-user role.

A new global super-user role is also added by this patch.

If A2_RBAC_MANAGED_CONTENT_TYPES is None (the default value), roles
sub-roles are created for each registered contents (currently user,
roles, organizational units, and services). If
A2_RBAC_MANAGED_CONTENT_TYPES is the empty tuple, no role is created
at all.

To limit permissionsto users and roles, set:

A2_RBAC_MANAGED_CONTENT_TYPES = (
        ('custom_user', 'user'),
        ('a2_rbac', 'role')
    )