from trac.core import *
from trac.config import ListOption
from trac.perm import IPermissionPolicy, IPermissionRequestor, PermissionSystem
from trac.ticket.model import Ticket


class SecurityTicketsPolicy(Component):
    """
    Require the VULNERABILITY_VIEW permission to view any ticket with the words
    "security" or "vulnerability" in the summary or keywords fields.
    """
    implements(IPermissionPolicy, IPermissionRequestor)

    # IPermissionPolicy methods
    def check_permission(self, username, action, context):
        # Find available ticket context
        while context.parent:
            if context.realm == 'ticket':
                break
            context = context.parent

        if context.realm == 'ticket' and context.id is not None:
            ticket = Ticket(self.env, context.id)
            fields = (ticket['keywords'] + ticket['summary']).lower()
            if 'security' in fields or 'vulnerability' in fields:
                perms = PermissionSystem(self.env).get_user_permissions(username)
                if 'VULNERABILITY_VIEW' not in perms:
                    return False

    # IPermissionRequestor methods
    def get_permission_actions(self):
        yield 'VULNERABILITY_VIEW'

Add the `vulnerability_tickets.py` sample security plugin to deny access to tickets with "security" or "vulnerability" in the `keywords` or `summary` fields.