Warden

So, there is the following method called authorize:

def authorize(self, env, client, path, method):
    if method.debug:
        if not client.debug:
            self.log.info("authorize: failed, client does not have debug enabled")
            return None
        return client

    if method.read:
        if not client.read:
            self.log.info("authorize: failed, client does not have read enabled")
            return None
        return client

    if method.write:
        if not (client.write or client.test):
            self.log.info("authorize: failed, client is not allowed to write or test")
            return None

    return client

And then there are a bunch of exposed methods, the following one called getDebug is interesting:

@expose(read=True, debug=True)
@json_wrapper
def getDebug(self):
    return {
        "environment": self.req.env,
    ...
    }

If in authorize, read was checked before debug, it wouldn't matter what is the value of debug in getDebug, because the method would only check read and then return.

So the question is, is that a bug or a feature? I want to add another flag - managed - but I would need to add it at the beginning of the authorize method. I think it shouldn't depend on the order of checks (if statements).