Actually implement permission checking for RPC handlers

class RemoteExecutionError(CCNodeError):

    """Thrown when a remote command execution error occurs."""

    pass

class ForbiddenHandler(CCNodeError):

    """Raised when a handler is called but disabled by configuration."""

    pass

import os

import logging

import logging.config

from functools import wraps

from cloudcontrol.common.client.loop import RPCStartHandler, MainLoop

from cloudcontrol.common.client.tags import Tag

from cloudcontrol.node import __version__

from cloudcontrol.node.config import NodeConfigParser, configure_logging

from cloudcontrol.node.jobs import JobManager

from cloudcontrol.node.exc import ForbiddenHandler

logger = logging.getLogger(__name__)

def _rights_check(handler_name):

    """Method instance decorator for checking permissions before executing an

    RPC handler.

    """

    def decorator(func):

        @wraps(func)

        def decorated(*args, **kwargs):

            if handler_name in func.im_self.main.config.forbidden_handlers:

                logger.error('Remote tried to call forbidden handler "%s"',

                             handler_name)

                raise ForbiddenHandler('Forbidden handler "%s"' % handler_name)

            return func(*args, **kwargs)

        return decorated

    return decorator

class NodeRPCStartHandler(RPCStartHandler):

    def handle_authentication_response(self, response=None):

        # set handler according to which role was returned by the cc-server

        MainLoop.__init__(self, config_path)

        self.job_manager = JobManager(self)

    def reset_handler(self, name, handl):

        # we decorate each handler for permissions to be checked before each

        # invocation

        MainLoop.reset_handler(self, name, _rights_check(name)(handl))

    def configure_logging(self):

        configure_logging(self.config.logging_level, self.config.logging_output)