Proxy Pattern in Python

Question

I'm reading a book on design patterns. On proxy pattern the code are following:

class SensitiveInfo:

    def __init__(self):
        self.users = ['nick', 'tom', 'ben', 'mike']

    def read(self):
        nb = len(self.users)
        print(f"There are {nb} users: {' '.join(self.users)}")

    def add(self, user):
        self.users.append(user)
        print(f'Added user {user}')


class Info:
    """protection proxy to SensitiveInfo"""

    def __init__(self):
        self.protected = SensitiveInfo()
        self.secret = '0xdeadbeef'

    def read(self):
        self.protected.read()

    def add(self, user):
        sec = input('what is the secret?')
        self.protected.add(user) if sec == self.secret else print("That's wrong!")

There are several security flaws in this as book mentioned. For example clear-text password. I know how to deal with this.

But nothing prevents the client code from bypassing the security of the application by creating an instance of SensitiveInfo directly.

The book mentioned to use abc module to forbid direct instantiation of SensitiveInfo. I don't know how. Seems to me creating a abstract class then another inherent from it still been able to create an instance of the child class therefore access users.

Answer 1

Using python abstract base classes is super-easy (if you compare it to any other language): https://docs.python.org/3/library/abc.html

In the case you mentioned, the proxy pattern allows you to decouple (read as hide) the SensitiveInfo class from the code that needs access to that info through Info class. This is not a matter of security but rather code dependencies. Also, please note since this is Python, that nothing restricts you from accessing the .protected or .secret member in your client code.

And about information security, you might make a confusion here. To restrict access to a "users" database table you should implement some API that requires authentication / authorization. The design-patterns are just industry best practices related to code structure for a specific outcome (most often code decoupling or dependency inversion).