Almost all has_access
usage is from helpers and security packages. The app.has_access
method is used for mail tasks:
Allura/allura/tasks/mail_tasks.py:59: if not app.has_access(c.user, userpart):
And documented in the first paragraph of https://forge-allura.apache.org/docs/platform_tour.html#email-integration
I think it should be named something different (and fall back to has_access
for backwards compatibility)