--- a/app/soc/views/models/base.py	Tue Nov 25 17:19:37 2008 +0000
+++ b/app/soc/views/models/base.py	Tue Nov 25 23:16:32 2008 +0000
@@ -89,13 +89,16 @@
 
     rights = {}
     rights['unspecified'] = []
-    rights['any_access'] = [access.checkIsUser]
+    rights['any_access'] = [access.checkIsLoggedIn]
     rights['public'] = [access.checkIsUser]
     rights['create'] = [access.checkIsDeveloper]
     rights['edit'] = [access.checkIsDeveloper]
     rights['delete'] = [access.checkIsDeveloper]
     rights['list'] = [access.checkIsDeveloper]
 
+    if 'rights' in params:
+      rights = dicts.merge(params['rights'], rights)
+
     new_params = {}
     new_params['rights'] = rights
     new_params['create_redirect'] = '/%(url_name)s' % params

--- a/app/soc/views/models/request.py	Tue Nov 25 17:19:37 2008 +0000
+++ b/app/soc/views/models/request.py	Tue Nov 25 23:16:32 2008 +0000
@@ -101,7 +101,11 @@
 
     self._logic = soc.logic.models.request.logic
 
+    rights = {}
+    rights['listSelf'] = [access.checkIsUser]
+
     params = {}
+    params['rights'] = rights
 
     params['name'] = "Request"
     params['name_short'] = "Request"
@@ -135,7 +139,7 @@
     """
 
     try:
-      self.checkAccess('list', request)
+      self.checkAccess('listSelf', request)
     except out_of_band.Error, error:
       return error.response(request)
 

--- a/app/soc/views/models/user.py	Tue Nov 25 17:19:37 2008 +0000
+++ b/app/soc/views/models/user.py	Tue Nov 25 23:16:32 2008 +0000
@@ -164,7 +164,12 @@
 
     self._logic = soc.logic.models.user.logic
 
+    rights = {}
+    rights['editSelf'] = [access.allow]
+    rights['roles'] = [access.checkIsUser]
+
     params = {}
+    params['rights'] = rights
 
     params['name'] = "User"
     params['name_short'] = "User"
@@ -195,19 +200,13 @@
       kwargs: The Key Fields for the specified entity
     """
 
-    rights = {}
-    rights['any_access'] = [access.checkIsLoggedIn]
-    rights['unspecified'] = [access.deny]
-    rights['editSelf'] = [access.allow]
-
     try:
-      self.checkAccess('editSelf', request, rights=rights)
+      self.checkAccess('editSelf', request)
     except out_of_band.Error, error:
       return error.response(request, template=self.EDIT_SELF_TMPL)
 
     new_params = {}
     new_params['edit_template'] = self.EDIT_SELF_TMPL
-    new_params['rights'] = rights
 
     params = dicts.merge(params, new_params)
     params = dicts.merge(params, self._params)