Usage

The library is build on top of two policies: authentication and authorization and public API.

API is policy agnostic, all client code should not call policy code directly but use API only.

Via API application can remember/forget user in local session (remember()/forget()), retrieve userid (authorized_userid()) and check permission for remembered user (permits()).

Authentication

Actions related to retrieving, storing and removing user’s identity.

Authenticated user has no access rights, the system even has no knowledge is there the user still registered in DB.

If aiohttp.web.Request has an identity it means the user has some ID that should be checked by authorization policy.

identity is a string shared between browser and server. Thus it’s not supposed to be database primary key, user login/email etc. Random string like uuid or hash is better choice.