Coverage for src/edwh_auth_rbac/rbac.py: 57%

86 statements  

« prev     ^ index     » next       coverage.py v7.5.1, created at 2024-05-22 15:42 +0200

1import logging 

2 

3from pydal import DAL 

4 

5from . import model 

6from .model import ( 

7 DEFAULT, 

8 DEFAULT_ENDS, 

9 DEFAULT_STARTS, 

10 Password, 

11 key_lookup, 

12 unstr_datetime, IdentityKey, ObjectTypes, 

13) 

14 

15_pylog = logging.getLogger(__name__) 

16_pylog.setLevel(logging.INFO) 

17 

18 

19class AuthRbac: 

20 name = "auth_rbac" 

21 

22 def __init__(self, db: DAL): 

23 self.db = db 

24 

25 @staticmethod 

26 def _error(msg): 

27 print("ERROR:", msg) 

28 

29 # gebruik event en rpc live templates (mobiel) 

30 

31 def add_user(self, email: str, firstname: str, fullname: str, password: str, member_of: list[IdentityKey]): 

32 # check if exists 

33 email = email.lower().strip() 

34 user = model.get_user(self.db, email) 

35 if user: 

36 raise ValueError("User already exists") 

37 else: 

38 object_id = model.add_identity( 

39 self.db, email, member_of, password=password, firstname=firstname, fullname=fullname, object_type="user" 

40 ) 

41 rec = model.get_user(self.db, object_id) 

42 return dict( 

43 object_id=rec.object_id, 

44 email=rec.email, 

45 firstname=rec.firstname, 

46 fullname=rec.fullname, 

47 ) 

48 

49 def add_item(self, email, name, password, member_of): 

50 # check if exists 

51 email = email.lower().strip() 

52 item = model.get_identity(self.db, email, "item") 

53 if item: 

54 raise ValueError("Item already exists") 

55 else: 

56 object_id = model.add_identity(self.db, email, member_of, name=name, password=password, object_type="item") 

57 rec = model.get_identity(self.db, object_id, object_type="item") 

58 return dict(object_id=rec.object_id, email=rec.email, name=rec.firstname) 

59 

60 def add_identity(self, email: str, name: str, password: str, member_of: list[IdentityKey], 

61 object_type: ObjectTypes): 

62 # check if exists 

63 email = email.lower().strip() 

64 

65 identity = model.get_identity(self.db, email, object_type) 

66 if identity: 

67 raise ValueError("Item already exists") 

68 else: 

69 object_id = model.add_identity(self.db, email, member_of, name, password=password, object_type=object_type) 

70 rec = model.get_identity(self.db, object_id, object_type=object_type) 

71 return dict(object_id=rec.object_id, email=rec.email, name=rec.name) 

72 

73 def add_group(self, email: str, name: str, member_of: list[IdentityKey]): 

74 # check if exists 

75 email = email.lower().strip() 

76 group = model.get_group(self.db, email) 

77 if group: 

78 raise ValueError("Group already exists") 

79 else: 

80 object_id = model.add_group(self.db, email, name, member_of) 

81 rec = model.get_group(self.db, object_id) 

82 return dict(object_id=rec.object_id, email=rec.email, name=rec.firstname) 

83 

84 def update_identity( 

85 self, object_id, email=None, name=None, firstname=None, lastname=None, fullname=None, password=None 

86 ): 

87 user = model.get_identity(self.db, object_id) 

88 user.update_record( 

89 email=email.lower().strip() if email else user.email, 

90 firstname=name if name else firstname if firstname else user.firstname, 

91 lastname=lastname if lastname else user.lastname, 

92 fullname=fullname if fullname else user.fullname, 

93 password=Password.encode(password) if password else user.encoded_password, 

94 ) 

95 self.db.commit() 

96 

97 def get_user(self, key, return_memberships=False): 

98 rec = model.get_user(self.db, key) 

99 result = dict( 

100 object_id=rec.object_id, 

101 email=rec.email, 

102 firstname=rec.firstname, 

103 fullname=rec.fullname, 

104 ) 

105 if return_memberships: 

106 result["memberships"] = [ 

107 dict( 

108 object_id=m.object_id, 

109 object_type=m.object_type, 

110 email=m.email, 

111 firstname=m.firstname, 

112 fullname=m.fullname, 

113 ) 

114 for m in model.get_memberships(self.db, rec.object_id, bare=False) 

115 ] 

116 return result 

117 

118 def get_group(self, key, return_members=True): 

119 group_rec = model.get_group(self.db, key) 

120 members = [] 

121 if return_members: 

122 members = model.get_members(self.db, group_rec.object_id, bare=False) 

123 members = [ 

124 dict( 

125 object_id=member.object_id, 

126 object_type=member.object_type, 

127 email=member.email, 

128 name=member.firstname, 

129 ) 

130 for member in members 

131 ] 

132 

133 result = dict(object_id=group_rec.object_id, email=group_rec.email, name=group_rec.firstname) 

134 if return_members: 

135 result["members"] = members 

136 return result 

137 

138 def authenticate_user(self, key, password): 

139 return model.authenticate_user(self.db, key=key, password=password) 

140 

141 def add_membership(self, identity_key, group_key): 

142 return model.add_membership(self.db, identity_key, group_key) 

143 

144 def remove_membership(self, identity_key, group_key): 

145 return model.remove_membership(self.db, identity_key, group_key) 

146 

147 def has_membership(self, user_or_group_key, group_key): 

148 key = key_lookup(self.db, user_or_group_key) 

149 group = key_lookup(self.db, group_key) 

150 memberships = [m.object_id for m in model.get_memberships(self.db, key, bare=False)] 

151 return group in memberships 

152 

153 def add_permission(self, identity_key, target_oid, privilege, starts=DEFAULT_STARTS, ends=DEFAULT_ENDS): 

154 starts = unstr_datetime(starts) 

155 ends = unstr_datetime(ends) 

156 model.add_permission(self.db, identity_key, target_oid, privilege, starts, ends) 

157 

158 def has_permission(self, identity_key, target_oid, privilege, when=None): 

159 when = DEFAULT if when is None else unstr_datetime(when) 

160 return model.has_permission(self.db, identity_key, target_oid, privilege, when) 

161 

162 def remove_permission(self, identity_key, target_oid, privilege, when=None): 

163 when = DEFAULT if when is None else unstr_datetime(when) 

164 return model.remove_permission(self.db, identity_key, target_oid, privilege, when=when)