Coverage for src/edwh_auth_rbac/rbac.py: 57%

1 import logging

2

3 from pydal import DAL

4

5 from . import model

6 from .model import (

7 DEFAULT,

8 DEFAULT_ENDS,

9 DEFAULT_STARTS,

10 Password,

11 key_lookup,

12 unstr_datetime, IdentityKey, ObjectTypes,

13)

14

15 _pylog = logging.getLogger(__name__)

16 _pylog.setLevel(logging.INFO)

17

18

19 class AuthRbac:

20 name = "auth_rbac"

21

22 def __init__(self, db: DAL):

23 self.db = db

24

25 @staticmethod

26 def _error(msg):

27 print("ERROR:", msg)

28

29 # gebruik event en rpc live templates (mobiel)

30

31 def add_user(self, email: str, firstname: str, fullname: str, password: str, member_of: list[IdentityKey]):

32 # check if exists

33 email = email.lower().strip()

34 user = model.get_user(self.db, email)

35 if user:

36 raise ValueError("User already exists")

37 else:

38 object_id = model.add_identity(

39 self.db, email, member_of, password=password, firstname=firstname, fullname=fullname, object_type="user"

40 )

41 rec = model.get_user(self.db, object_id)

42 return dict(

43 object_id=rec.object_id,

44 email=rec.email,

45 firstname=rec.firstname,

46 fullname=rec.fullname,

47 )

48

49 def add_item(self, email, name, password, member_of):

50 # check if exists

51 email = email.lower().strip()

52 item = model.get_identity(self.db, email, "item")

53 if item:

54 raise ValueError("Item already exists")

55 else:

56 object_id = model.add_identity(self.db, email, member_of, name=name, password=password, object_type="item")

57 rec = model.get_identity(self.db, object_id, object_type="item")

58 return dict(object_id=rec.object_id, email=rec.email, name=rec.firstname)

59

60 def add_identity(self, email: str, name: str, password: str, member_of: list[IdentityKey],

61 object_type: ObjectTypes):

62 # check if exists

63 email = email.lower().strip()

64

65 identity = model.get_identity(self.db, email, object_type)

66 if identity:

67 raise ValueError("Item already exists")

68 else:

69 object_id = model.add_identity(self.db, email, member_of, name, password=password, object_type=object_type)

70 rec = model.get_identity(self.db, object_id, object_type=object_type)

71 return dict(object_id=rec.object_id, email=rec.email, name=rec.name)

72

73 def add_group(self, email: str, name: str, member_of: list[IdentityKey]):

74 # check if exists

75 email = email.lower().strip()

76 group = model.get_group(self.db, email)

77 if group:

78 raise ValueError("Group already exists")

79 else:

80 object_id = model.add_group(self.db, email, name, member_of)

81 rec = model.get_group(self.db, object_id)

82 return dict(object_id=rec.object_id, email=rec.email, name=rec.firstname)

83

84 def update_identity(

85 self, object_id, email=None, name=None, firstname=None, lastname=None, fullname=None, password=None

86 ):

87 user = model.get_identity(self.db, object_id)

88 user.update_record(

89 email=email.lower().strip() if email else user.email,

90 firstname=name if name else firstname if firstname else user.firstname,

91 lastname=lastname if lastname else user.lastname,

92 fullname=fullname if fullname else user.fullname,

93 password=Password.encode(password) if password else user.encoded_password,

94 )

95 self.db.commit()

96

97 def get_user(self, key, return_memberhips=False):

98 rec = model.get_user(self.db, key)

99 result = dict(

100 object_id=rec.object_id,

101 email=rec.email,

102 firstname=rec.firstname,

103 fullname=rec.fullname,

104 )

105 if return_memberhips:

106 result["memberships"] = [

107 dict(

108 object_id=m.object_id,

109 object_type=m.object_type,

110 email=m.email,

111 firstname=m.firstname,

112 fullname=m.fullname,

113 )

114 for m in model.get_memberships(self.db, rec.object_id, bare=False)

115 ]

116 return result

117

118 def get_group(self, key, return_members=True):

119 group_rec = model.get_group(self.db, key)

120 members = []

121 if return_members:

122 members = model.get_members(self.db, group_rec.object_id, bare=False)

123 members = [

124 dict(

125 object_id=member.object_id,

126 object_type=member.object_type,

127 email=member.email,

128 name=member.firstname,

129 )

130 for member in members

131 ]

132

133 result = dict(object_id=group_rec.object_id, email=group_rec.email, name=group_rec.firstname)

134 if return_members:

135 result["members"] = members

136 return result

137

138 def authenticate_user(self, key, password):

139 return model.authenticate_user(self.db, key=key, password=password)

140

141 def add_membership(self, identity_key, group_key):

142 return model.add_membership(self.db, identity_key, group_key)

143

144 def remove_membership(self, identity_key, group_key):

145 return model.remove_membership(self.db, identity_key, group_key)

146

147 def has_membership(self, user_or_group_key, group_key):

148 key = key_lookup(self.db, user_or_group_key)

149 group = key_lookup(self.db, group_key)

150 memberships = [m.object_id for m in model.get_memberships(self.db, key, bare=False)]

151 return group in memberships

152

153 def add_permission(self, identity_key, target_oid, privilege, starts=DEFAULT_STARTS, ends=DEFAULT_ENDS):

154 starts = unstr_datetime(starts)

155 ends = unstr_datetime(ends)

156 model.add_permission(self.db, identity_key, target_oid, privilege, starts, ends)

157

158 def has_permission(self, identity_key, target_oid, privilege, when=None):

159 when = DEFAULT if when is None else unstr_datetime(when)

160 return model.has_permission(self.db, identity_key, target_oid, privilege, when)

161

162 def remove_permission(self, identity_key, target_oid, privilege, when=None):

163 when = DEFAULT if when is None else unstr_datetime(when)

164 return model.remove_permission(self.db, identity_key, target_oid, privilege, when=when)