group.py

class Group(Base, mixins.Timestamps):
    ...
    
    def __acl__(self):
        terms = []

        read_principal = _read_principal(self)
        if read_principal is not None:
            terms.append((security.Allow, read_principal, 'read'))

        write_principal = _write_principal(self)
        if write_principal is not None:
            terms.append((security.Allow, write_principal, 'write'))

        join_principal = _join_principal(self)
        if join_principal is not None:
            terms.append((security.Allow, join_principal, 'join'))
            
        terms.append((security.Allow, self.creator.userid, 'admin'))
        terms.append(security.DENY_ALL)

        return terms
    

def _read_principal(group):
    return {
        ReadableBy.world: security.Everyone,
        ReadableBy.authority: 'authority:{}'.format(group.authority),
        ReadableBy.members: 'group:{}'.format(self.pubid),
    }.get(group.readable_by)


def _write_principal(group):
    return {
        WriteableBy.authority: 'authority:{}'.format(group.authority),
        WriteableBy.members: 'group:{}'.format(self.pubid),
    }.get(group.writeable_by)


def _join_principal(group):
    return {
        JoinableBy.authority: 'authority:{}'.format(group.authority),
    }.get(group.joinable_by)