Issue #196 Add permission checking to application registration

[trbs]

Add an addition setting called APPLICATION_REGISTRATION_PERMISSIONS
which controls which permissions must be set on a user to allow the
creation of applications.

By default (in this PR) this is the 'add_application' permission which
regretfully is not backwards compatible but it does seem to make the
most sense from a security perspective as a default.

Reverting to the old behaviour is easily done by using None for the
settings key.

[coveralls]

Coverage decreased (-0.02%) to 95.91% when pulling 3ca899f on trbs:application_permissions into 75cd656 on evonove:master.

[coveralls]

Coverage decreased (-0.02%) to 95.91% when pulling 3ca899f on trbs:application_permissions into 75cd656 on evonove:master.

[coveralls]

Coverage decreased (-0.02%) to 95.91% when pulling 3ca899f on trbs:application_permissions into 75cd656 on evonove:master.

[synasius]

HI @trbs,
great work!

I'd prefer to leave the default behavior unchanged, so the app is backwards compatible.

Can you add some docs for the settings APPLICATION_REGISTRATION_PERMISSIONS with an example and some specifc tests?

Thanks a lot for your effort

[coveralls]

Coverage increased (+0.02%) to 95.95% when pulling ffed538 on trbs:application_permissions into 75cd656 on evonove:master.

[coveralls]

Coverage increased (+0.02%) to 95.95% when pulling ffed538 on trbs:application_permissions into 75cd656 on evonove:master.

[trbs]

@synasius the default is now backwards compatible and I put the old settings as the example in the documentation. Two extra tests now test creating an application with and without the correct permission.

[masci]

s/none/non/

[pySilver]

Isn't it better to have a configurable callback that tests if user has rights to create apps? Originally it won't be defined and would do nothing but in real life experience one can supply own callback which will receive lets say User instance and will be expected to return boolean. So, implementation would be up to the developer.

[synasius]

@pySilver

Isn't it better to have a configurable callback that tests if user has rights to create apps?

Definitely! That way we're not bound to how django handles permissions. I'm closing this PR.
@trbs thanks for the great work but it's not what we're looking for.