GeneralManager 0.20.1__py3-none-any.whl → 0.21.0__py3-none-any.whl

general_manager/_types/general_manager.py

@@ -14,6 +14,8 @@ __all__ = [
     "get_logger",
     "graph_ql_mutation",
     "graph_ql_property",
+    "permission_functions",
+    "register_permission",
 ]
 
 from general_manager.interface.calculation_interface import CalculationInterface
@@ -27,3 +29,5 @@ from general_manager.rule.rule import Rule
 from general_manager.logging import get_logger
 from general_manager.api.mutation import graph_ql_mutation
 from general_manager.api.property import graph_ql_property
+from general_manager.permission.permission_checks import permission_functions
+from general_manager.permission.permission_checks import register_permission

general_manager/_types/permission.py

@@ -3,11 +3,27 @@ from __future__ import annotations
 """Type-only imports for public API re-exports."""
 
 __all__ = [
+    "AuditLogger",
     "BasePermission",
+    "DatabaseAuditLogger",
+    "FileAuditLogger",
     "ManagerBasedPermission",
     "MutationPermission",
+    "PermissionAuditEvent",
+    "configure_audit_logger",
+    "configure_audit_logger_from_settings",
+    "permission_functions",
+    "register_permission",
 ]
 
+from general_manager.permission.audit import AuditLogger
 from general_manager.permission.base_permission import BasePermission
+from general_manager.permission.audit import DatabaseAuditLogger
+from general_manager.permission.audit import FileAuditLogger
 from general_manager.permission.manager_based_permission import ManagerBasedPermission
 from general_manager.permission.mutation_permission import MutationPermission
+from general_manager.permission.audit import PermissionAuditEvent
+from general_manager.permission.audit import configure_audit_logger
+from general_manager.permission.audit import configure_audit_logger_from_settings
+from general_manager.permission.permission_checks import permission_functions
+from general_manager.permission.permission_checks import register_permission

general_manager/apps.py

@@ -20,6 +20,7 @@ from general_manager.logging import get_logger
 from general_manager.manager.general_manager import GeneralManager
 from general_manager.manager.input import Input
 from general_manager.manager.meta import GeneralManagerMeta
+from general_manager.permission.audit import configure_audit_logger_from_settings
 
 
 class MissingRootUrlconfError(RuntimeError):
@@ -66,6 +67,7 @@ class GeneralmanagerConfig(AppConfig):
             GeneralManagerMeta.pending_attribute_initialization,
             GeneralManagerMeta.all_classes,
         )
+        configure_audit_logger_from_settings(settings)
         if getattr(settings, "AUTOCREATE_GRAPHQL", False):
             self.handle_graph_ql(GeneralManagerMeta.pending_graphql_interfaces)
 

general_manager/permission/audit.py

@@ -0,0 +1,380 @@
+"""Lightweight audit logging hooks for permission evaluations."""
+
+from __future__ import annotations
+
+import atexit
+import json
+from dataclasses import dataclass
+from pathlib import Path
+from queue import Empty, SimpleQueue
+from threading import Event, Thread, Lock
+from typing import Any, Iterable, Mapping, Protocol, runtime_checkable, Literal
+
+from django.apps import apps
+from django.db import connections, models
+from django.utils import timezone
+
+
+AuditAction = Literal["create", "read", "update", "delete", "mutation"]
+
+
+@dataclass(slots=True)
+class PermissionAuditEvent:
+    """
+    Payload describing a permission evaluation outcome.
+
+    Attributes:
+        action (AuditAction): CRUD or mutation action that was evaluated.
+        attributes (tuple[str, ...]): Collection of attribute names covered by this evaluation.
+        granted (bool): True when the action was permitted.
+        user (Any): User object involved in the evaluation; consumers may extract ids.
+        manager (str | None): Name of the manager class (when applicable).
+        permissions (tuple[str, ...]): Permission expressions that were considered.
+        bypassed (bool): True when the decision relied on a superuser bypass.
+        metadata (Mapping[str, Any] | None): Optional additional context.
+    """
+
+    action: AuditAction
+    attributes: tuple[str, ...]
+    granted: bool
+    user: Any
+    manager: str | None
+    permissions: tuple[str, ...] = ()
+    bypassed: bool = False
+    metadata: Mapping[str, Any] | None = None
+
+
+@runtime_checkable
+class AuditLogger(Protocol):
+    """Protocol describing the expected behaviour of an audit logger implementation."""
+
+    def record(self, event: PermissionAuditEvent) -> None:
+        """Persist or forward a permission audit event."""
+
+
+class _NoOpAuditLogger:
+    """Fallback logger used when no audit logger is configured."""
+
+    __slots__ = ()
+
+    def record(self, _event: PermissionAuditEvent) -> None:
+        """Ignore the audit event."""
+        return
+
+
+_NOOP_LOGGER = _NoOpAuditLogger()
+_audit_logger: AuditLogger = _NOOP_LOGGER
+_SETTINGS_KEY = "GENERAL_MANAGER"
+_AUDIT_LOGGER_KEY = "AUDIT_LOGGER"
+
+
+def configure_audit_logger(logger: AuditLogger | None) -> None:
+    """
+    Configure the audit logger used by permission checks.
+
+    Parameters:
+        logger (AuditLogger | None): Concrete logger implementation. Passing ``None``
+            resets the logger to a no-op implementation.
+    """
+    global _audit_logger
+    _audit_logger = logger or _NOOP_LOGGER
+
+
+def get_audit_logger() -> AuditLogger:
+    """Return the currently configured audit logger."""
+    return _audit_logger
+
+
+def audit_logging_enabled() -> bool:
+    """Return True when audit logging is active."""
+    return _audit_logger is not _NOOP_LOGGER
+
+
+def emit_permission_audit_event(event: PermissionAuditEvent) -> None:
+    """
+    Forward an audit event to the configured logger when logging is enabled.
+
+    Parameters:
+        event (PermissionAuditEvent): Event payload to record.
+    """
+    if _audit_logger is _NOOP_LOGGER:
+        return
+    _audit_logger.record(event)
+
+
+def _serialize_event(event: PermissionAuditEvent) -> dict[str, Any]:
+    """Convert an audit event into a JSON-serialisable mapping."""
+    user_pk = getattr(event.user, "pk", None)
+    user_id = None if user_pk is None else str(user_pk)
+    return {
+        "timestamp": timezone.now().isoformat(),
+        "action": event.action,
+        "attributes": list(event.attributes),
+        "granted": event.granted,
+        "bypassed": event.bypassed,
+        "manager": event.manager,
+        "user_id": user_id,
+        "user": None if user_id is not None else repr(event.user),
+        "permissions": list(event.permissions),
+        "metadata": event.metadata,
+    }
+
+
+def _resolve_logger_reference(value: Any) -> AuditLogger | None:
+    """Resolve audit logger setting values into concrete logger instances."""
+    if value is None:
+        return None
+    if isinstance(value, str):
+        from django.utils.module_loading import import_string
+
+        resolved = import_string(value)
+    elif isinstance(value, Mapping):
+        from django.utils.module_loading import import_string
+
+        class_path = value.get("class")
+        options = value.get("options", {})
+        if class_path is None:
+            return None
+        resolved = (
+            import_string(class_path) if isinstance(class_path, str) else class_path
+        )
+        if isinstance(resolved, type):
+            resolved = resolved(**options)
+        elif callable(resolved):
+            resolved = resolved(**options)
+        return resolved if hasattr(resolved, "record") else None
+    else:
+        resolved = value
+
+    if isinstance(resolved, type):
+        resolved = resolved()
+    elif callable(resolved) and not hasattr(resolved, "record"):
+        resolved = resolved()
+
+    if resolved is None or not hasattr(resolved, "record"):
+        return None
+    return resolved  # type: ignore[return-value]
+
+
+def configure_audit_logger_from_settings(django_settings: Any) -> None:
+    """
+    Configure the audit logger based on Django settings.
+
+    Expects either ``settings.GENERAL_MANAGER['AUDIT_LOGGER']`` or a top-level
+    ``settings.AUDIT_LOGGER`` value pointing to an audit logger implementation
+    (instance, callable, or dotted import path).
+    """
+    config: Mapping[str, Any] | None = getattr(django_settings, _SETTINGS_KEY, None)
+    logger_setting: Any = None
+    if isinstance(config, Mapping):
+        logger_setting = config.get(_AUDIT_LOGGER_KEY)
+    if logger_setting is None:
+        logger_setting = getattr(django_settings, _AUDIT_LOGGER_KEY, None)
+
+    logger_instance = _resolve_logger_reference(logger_setting)
+    configure_audit_logger(logger_instance)
+
+
+_MODEL_CACHE: dict[str, type[models.Model]] = {}
+_MODEL_CACHE_LOCK = Lock()
+
+
+def _build_field_definitions() -> dict[str, models.Field[Any, Any]]:
+    return {
+        "created_at": models.DateTimeField(auto_now_add=True),
+        "action": models.CharField(max_length=32),
+        "attributes": models.JSONField(default=list),
+        "granted": models.BooleanField(),
+        "bypassed": models.BooleanField(),
+        "manager": models.CharField(max_length=255, null=True, blank=True),
+        "user_id": models.CharField(max_length=255, null=True, blank=True),
+        "user_repr": models.TextField(null=True, blank=True),
+        "permissions": models.JSONField(default=list),
+        "metadata": models.JSONField(null=True, blank=True),
+    }
+
+
+def _get_audit_model(table_name: str) -> type[models.Model]:
+    """Return (and register) a concrete audit model for the given table."""
+    with _MODEL_CACHE_LOCK:
+        cached = _MODEL_CACHE.get(table_name)
+        if cached is not None:
+            return cached
+
+        app_config = apps.get_app_config("general_manager")
+        for model in app_config.get_models():
+            if model._meta.db_table == table_name:
+                _MODEL_CACHE[table_name] = model
+                return model
+
+        attrs: dict[str, Any] = _build_field_definitions()
+        attrs["__module__"] = __name__
+        attrs["Meta"] = type(
+            "Meta",
+            (),
+            {"db_table": table_name, "app_label": "general_manager"},
+        )
+        model_name = f"PermissionAuditEntry_{abs(hash(table_name))}"
+        model = type(model_name, (models.Model,), attrs)
+        registry_key = model.__name__.lower()
+        if registry_key not in app_config.models:
+            apps.register_model("general_manager", model)
+        _MODEL_CACHE[table_name] = model
+        return model
+
+
+class _BufferedAuditLogger:
+    """Base class implementing a background worker that processes audit events in batches."""
+
+    _SENTINEL = object()
+
+    def __init__(
+        self,
+        *,
+        batch_size: int = 100,
+        flush_interval: float = 0.5,
+        use_worker: bool = True,
+    ) -> None:
+        self._batch_size = max(batch_size, 1)
+        self._flush_interval = flush_interval
+        self._use_worker = use_worker
+        self._closed = Event()
+        if self._use_worker:
+            self._queue: SimpleQueue[PermissionAuditEvent | object] = SimpleQueue()
+            self._worker = Thread(target=self._worker_loop, daemon=True)
+            self._worker.start()
+            atexit.register(self.close)
+        else:
+            self._queue = None  # type: ignore[assignment]
+            self._worker = None  # type: ignore[assignment]
+
+    def record(self, event: PermissionAuditEvent) -> None:
+        if self._closed.is_set():
+            return
+        if not self._use_worker:
+            self._handle_batch((event,))
+            return
+        self._queue.put(event)
+
+    def close(self) -> None:
+        if self._closed.is_set() or not self._use_worker:
+            return
+        self._closed.set()
+        self._queue.put(self._SENTINEL)
+        self._worker.join(timeout=2.0)
+
+    def flush(self) -> None:
+        """Block until all queued events are processed."""
+        if self._use_worker:
+            self.close()
+
+    def _worker_loop(self) -> None:
+        pending: list[PermissionAuditEvent] = []
+        while True:
+            try:
+                item = self._queue.get(timeout=self._flush_interval)
+            except Empty:
+                item = None
+            if item is self._SENTINEL:
+                break
+            if isinstance(item, PermissionAuditEvent):
+                pending.append(item)
+            if len(pending) >= self._batch_size or (item is None and pending):
+                self._handle_batch(pending)
+                pending = []
+        if pending:
+            self._handle_batch(pending)
+
+    def _handle_batch(self, events: Iterable[PermissionAuditEvent]) -> None:
+        raise NotImplementedError
+
+
+class FileAuditLogger(_BufferedAuditLogger):
+    """Persist audit events as newline-delimited JSON records in a file."""
+
+    def __init__(
+        self,
+        path: str | Path,
+        *,
+        batch_size: int = 100,
+        flush_interval: float = 0.5,
+    ) -> None:
+        self._path = Path(path)
+        self._path.parent.mkdir(parents=True, exist_ok=True)
+        super().__init__(batch_size=batch_size, flush_interval=flush_interval)
+
+    def _handle_batch(self, events: Iterable[PermissionAuditEvent]) -> None:
+        records = [json.dumps(_serialize_event(event)) for event in events]
+        if not records:
+            return
+        data = "\n".join(records) + "\n"
+        with self._path.open("a", encoding="utf-8") as handle:
+            handle.write(data)
+
+
+class DatabaseAuditLogger(_BufferedAuditLogger):
+    """Store audit events inside a dedicated database table using Django connections."""
+
+    def __init__(
+        self,
+        *,
+        using: str = "default",
+        table_name: str = "general_manager_permissionauditlog",
+        batch_size: int = 100,
+        flush_interval: float = 0.5,
+    ) -> None:
+        self._using = using
+        self.table_name = table_name
+        self.model = _get_audit_model(table_name)
+        connection = connections[self._using]
+        use_worker = connection.vendor != "sqlite"
+        super().__init__(
+            batch_size=batch_size,
+            flush_interval=flush_interval,
+            use_worker=use_worker,
+        )
+        self._ensure_table()
+
+    def _ensure_table(self) -> None:
+        connection = connections[self._using]
+        table_names = connection.introspection.table_names()
+        if self.model._meta.db_table in table_names:
+            return
+        with connection.schema_editor(atomic=False) as editor:
+            editor.create_model(self.model)
+
+    def _handle_batch(self, events: Iterable[PermissionAuditEvent]) -> None:
+        entries = []
+        for event in events:
+            serialized = _serialize_event(event)
+            entries.append(
+                self.model(
+                    action=event.action,
+                    attributes=serialized["attributes"],
+                    granted=event.granted,
+                    bypassed=event.bypassed,
+                    manager=event.manager,
+                    user_id=serialized["user_id"],
+                    user_repr=serialized["user"],
+                    permissions=serialized["permissions"],
+                    metadata=serialized["metadata"],
+                )
+            )
+        if not entries:
+            return
+        self.model.objects.using(self._using).bulk_create(
+            entries, batch_size=self._batch_size
+        )
+
+
+__all__ = [
+    "AuditLogger",
+    "DatabaseAuditLogger",
+    "FileAuditLogger",
+    "PermissionAuditEvent",
+    "audit_logging_enabled",
+    "configure_audit_logger",
+    "configure_audit_logger_from_settings",
+    "emit_permission_audit_event",
+    "get_audit_logger",
+]

general_manager/permission/base_permission.py

@@ -3,11 +3,16 @@
 from __future__ import annotations
 
 from abc import ABC, abstractmethod
-from typing import TYPE_CHECKING, Any, Literal, TypeAlias, cast
+from typing import TYPE_CHECKING, Any, Literal, TypeAlias
 
-from django.contrib.auth.models import AbstractBaseUser, AbstractUser, AnonymousUser
+from django.contrib.auth.models import AbstractBaseUser, AnonymousUser
 
 from general_manager.logging import get_logger
+from general_manager.permission.audit import (
+    PermissionAuditEvent,
+    audit_logging_enabled,
+    emit_permission_audit_event,
+)
 from general_manager.permission.permission_checks import permission_functions
 from general_manager.permission.permission_data_manager import PermissionDataManager
 from general_manager.permission.utils import (
@@ -64,6 +69,18 @@ class BasePermission(ABC):
         """Return the user being evaluated for permission checks."""
         return self._request_user
 
+    def describe_permissions(
+        self,
+        action: Literal["create", "read", "update", "delete"],
+        attribute: str,
+    ) -> tuple[str, ...]:
+        """Return permission expressions associated with an action/attribute pair."""
+        return ()
+
+    def _is_superuser(self) -> bool:
+        """Return True when the current request user bypasses permission checks."""
+        return bool(getattr(self.request_user, "is_superuser", False))
+
     @classmethod
     def check_create_permission(
         cls,
@@ -85,17 +102,45 @@ class BasePermission(ABC):
             PermissionCheckError: If one or more attributes in `data` are denied for the resolved `request_user`.
         """
         request_user = cls.get_user_with_id(request_user)
-        errors = []
         permission_data = PermissionDataManager(permission_data=data, manager=manager)
         Permission = cls(permission_data, request_user)
+        manager_name = manager.__name__ if manager is not None else None
+        if Permission._is_superuser():
+            if audit_logging_enabled():
+                for key in data.keys():
+                    emit_permission_audit_event(
+                        PermissionAuditEvent(
+                            action="create",
+                            attributes=(key,),
+                            granted=True,
+                            user=request_user,
+                            manager=manager_name,
+                            permissions=Permission.describe_permissions("create", key),
+                            bypassed=True,
+                        )
+                    )
+            return
+
+        errors: list[str] = []
         user_identifier = getattr(request_user, "id", None)
         for key in data.keys():
             is_allowed = Permission.check_permission("create", key)
+            if audit_logging_enabled():
+                emit_permission_audit_event(
+                    PermissionAuditEvent(
+                        action="create",
+                        attributes=(key,),
+                        granted=is_allowed,
+                        user=request_user,
+                        manager=manager_name,
+                        permissions=Permission.describe_permissions("create", key),
+                    )
+                )
             if not is_allowed:
                 logger.info(
                     "permission denied",
                     context={
-                        "manager": manager.__name__,
+                        "manager": manager_name,
                         "action": "create",
                         "attribute": key,
                         "user_id": user_identifier,
@@ -124,20 +169,47 @@ class BasePermission(ABC):
             PermissionCheckError: Raised with a list of error messages when one or more fields are not permitted to be updated.
         """
         request_user = cls.get_user_with_id(request_user)
-
-        errors = []
         permission_data = PermissionDataManager.for_update(
             base_data=old_manager_instance, update_data=data
         )
         Permission = cls(permission_data, request_user)
+        manager_name = old_manager_instance.__class__.__name__
+        if Permission._is_superuser():
+            if audit_logging_enabled():
+                for key in data.keys():
+                    emit_permission_audit_event(
+                        PermissionAuditEvent(
+                            action="update",
+                            attributes=(key,),
+                            granted=True,
+                            user=request_user,
+                            manager=manager_name,
+                            permissions=Permission.describe_permissions("update", key),
+                            bypassed=True,
+                        )
+                    )
+            return
+
+        errors: list[str] = []
         user_identifier = getattr(request_user, "id", None)
         for key in data.keys():
             is_allowed = Permission.check_permission("update", key)
+            if audit_logging_enabled():
+                emit_permission_audit_event(
+                    PermissionAuditEvent(
+                        action="update",
+                        attributes=(key,),
+                        granted=is_allowed,
+                        user=request_user,
+                        manager=manager_name,
+                        permissions=Permission.describe_permissions("update", key),
+                    )
+                )
             if not is_allowed:
                 logger.info(
                     "permission denied",
                     context={
-                        "manager": old_manager_instance.__class__.__name__,
+                        "manager": manager_name,
                         "action": "update",
                         "attribute": key,
                         "user_id": user_identifier,
@@ -166,18 +238,45 @@ class BasePermission(ABC):
             PermissionCheckError: If one or more attributes are not permitted for deletion by request_user. The exception carries the user and the list of denial messages.
         """
         request_user = cls.get_user_with_id(request_user)
-
-        errors = []
         permission_data = PermissionDataManager(manager_instance)
         Permission = cls(permission_data, request_user)
+        manager_name = manager_instance.__class__.__name__
+        if Permission._is_superuser():
+            if audit_logging_enabled():
+                for key in manager_instance.__dict__.keys():
+                    emit_permission_audit_event(
+                        PermissionAuditEvent(
+                            action="delete",
+                            attributes=(key,),
+                            granted=True,
+                            user=request_user,
+                            manager=manager_name,
+                            permissions=Permission.describe_permissions("delete", key),
+                            bypassed=True,
+                        )
+                    )
+            return
+
+        errors: list[str] = []
         user_identifier = getattr(request_user, "id", None)
         for key in manager_instance.__dict__.keys():
             is_allowed = Permission.check_permission("delete", key)
+            if audit_logging_enabled():
+                emit_permission_audit_event(
+                    PermissionAuditEvent(
+                        action="delete",
+                        attributes=(key,),
+                        granted=is_allowed,
+                        user=request_user,
+                        manager=manager_name,
+                        permissions=Permission.describe_permissions("delete", key),
+                    )
+                )
             if not is_allowed:
                 logger.info(
                     "permission denied",
                     context={
-                        "manager": manager_instance.__class__.__name__,
+                        "manager": manager_name,
                         "action": "delete",
                         "attribute": key,
                         "user_id": user_identifier,
@@ -251,15 +350,14 @@ class BasePermission(ABC):
         Raises:
             PermissionNotFoundError: If no permission function matches the leading name in `permission`.
         """
+        if self._is_superuser():
+            return {"filter": {}, "exclude": {}}
         permission_function, *config = permission.split(":")
         if permission_function not in permission_functions:
             raise PermissionNotFoundError(permission)
         permission_filter = permission_functions[permission_function][
             "permission_filter"
-        ](
-            cast(AbstractUser | AnonymousUser, self.request_user),
-            config,
-        )
+        ](self.request_user, config)
         if permission_filter is None:
             return {"filter": {}, "exclude": {}}
         return permission_filter
@@ -277,8 +375,6 @@ class BasePermission(ABC):
         Returns:
             bool: True when every sub-permission evaluates to True for the current user.
         """
-        return validate_permission_string(
-            permission,
-            self.instance,
-            cast(AbstractUser | AnonymousUser, self.request_user),
-        )
+        if self._is_superuser():
+            return True
+        return validate_permission_string(permission, self.instance, self.request_user)

general_manager/permission/manager_based_permission.py

@@ -2,14 +2,13 @@
 
 from __future__ import annotations
 from typing import TYPE_CHECKING, Literal, Optional, Dict
-from general_manager.permission.base_permission import BasePermission
+from general_manager.permission.base_permission import BasePermission, UserLike
 
 if TYPE_CHECKING:
     from general_manager.permission.permission_data_manager import (
         PermissionDataManager,
     )
     from general_manager.manager.general_manager import GeneralManager
-    from django.contrib.auth.models import AbstractUser
 
 type permission_type = Literal[
     "create",
@@ -76,14 +75,14 @@ class ManagerBasedPermission(BasePermission):
     def __init__(
         self,
         instance: PermissionDataManager | GeneralManager,
-        request_user: AbstractUser,
+        request_user: UserLike,
     ) -> None:
         """
         Initialise the permission object and gather default and attribute-level rules.
 
         Parameters:
             instance (PermissionDataManager | GeneralManager): Target data used for permission evaluation.
-            request_user (AbstractUser): User whose permissions are being checked.
+            request_user (UserLike): User whose permissions are being checked.
         """
         super().__init__(instance, request_user)
         self.__set_permissions()
@@ -182,6 +181,9 @@ class ManagerBasedPermission(BasePermission):
         Raises:
             UnknownPermissionActionError: If `action` is not one of "create", "read", "update", or "delete".
         """
+        if self._is_superuser():
+            self.__overall_results[action] = True
+            return True
         if (
             self.__based_on_permission
             and not self.__based_on_permission.check_permission(action, attribute)
@@ -241,6 +243,8 @@ class ManagerBasedPermission(BasePermission):
         Returns:
             list[dict[Literal["filter", "exclude"], dict[str, str]]]: A list of dictionaries each containing "filter" and "exclude" mappings where keys are queryset lookups and values are lookup values.
         """
+        if self._is_superuser():
+            return [{"filter": {}, "exclude": {}}]
         __based_on__ = self.__based_on__
         filters: list[dict[Literal["filter", "exclude"], dict[str, str]]] = []
 
@@ -266,3 +270,32 @@ class ManagerBasedPermission(BasePermission):
             filters.append(self._get_permission_filter(permission))
 
         return filters
+
+    def describe_permissions(
+        self,
+        action: permission_type,
+        attribute: str,
+    ) -> tuple[str, ...]:
+        """Return permission expressions considered for the given action/attribute."""
+        if action == "create":
+            base_permissions: tuple[str, ...] = tuple(self.__create__)
+        elif action == "read":
+            base_permissions = tuple(self.__read__)
+        elif action == "update":
+            base_permissions = tuple(self.__update__)
+        elif action == "delete":
+            base_permissions = tuple(self.__delete__)
+        else:
+            raise UnknownPermissionActionError(action)
+
+        attribute_source = self.__attribute_permissions.get(attribute)
+        if isinstance(attribute_source, dict):
+            attribute_permissions = tuple(attribute_source.get(action, []))
+        else:
+            attribute_permissions = tuple()
+        combined = base_permissions + attribute_permissions
+        if self.__based_on_permission is not None:
+            combined += self.__based_on_permission.describe_permissions(
+                action, attribute
+            )
+        return combined

general_manager/permission/mutation_permission.py

@@ -1,15 +1,26 @@
 """Permission helper for GraphQL mutations."""
 
 from __future__ import annotations
-from django.contrib.auth.models import AbstractUser, AnonymousUser
+
 from typing import Any
+
+from django.contrib.auth.models import AbstractBaseUser, AnonymousUser
+
+from general_manager.permission.audit import (
+    PermissionAuditEvent,
+    audit_logging_enabled,
+    emit_permission_audit_event,
+)
 from general_manager.permission.base_permission import (
     BasePermission,
     PermissionCheckError,
 )
-
 from general_manager.permission.permission_data_manager import PermissionDataManager
 from general_manager.permission.utils import validate_permission_string
+from general_manager.logging import get_logger
+
+
+logger = get_logger("permission.mutation")
 
 
 class MutationPermission:
@@ -18,18 +29,19 @@ class MutationPermission:
     __mutate__: list[str]
 
     def __init__(
-        self, data: dict[str, Any], request_user: AbstractUser | AnonymousUser
+        self, data: dict[str, Any], request_user: AbstractBaseUser | AnonymousUser
     ) -> None:
         """
         Create a mutation permission context for the given data and user.
 
         Parameters:
             data (dict[str, Any]): Input payload for the mutation.
-            request_user (AbstractUser | AnonymousUser): User attempting the mutation.
+            request_user (AbstractBaseUser | AnonymousUser): User attempting the mutation.
         """
         self._data: PermissionDataManager = PermissionDataManager(data)
         self._request_user = request_user
         self.__attribute_permissions = self.__get_attribute_permissions()
+        self._mutate_permissions: list[str] = getattr(self.__class__, "__mutate__", [])
 
         self.__overall_result: bool | None = None
 
@@ -39,7 +51,7 @@ class MutationPermission:
         return self._data
 
     @property
-    def request_user(self) -> AbstractUser | AnonymousUser:
+    def request_user(self) -> AbstractBaseUser | AnonymousUser:
         """Return the user whose permissions are being evaluated."""
         return self._request_user
 
@@ -53,31 +65,74 @@ class MutationPermission:
                 attribute_permissions[attribute] = getattr(self.__class__, attribute)
         return attribute_permissions
 
+    def describe_permissions(self, attribute: str) -> tuple[str, ...]:
+        """Return mutate-level and attribute-specific permissions for the field."""
+        base_permissions = tuple(self._mutate_permissions)
+        attribute_permissions = tuple(self.__attribute_permissions.get(attribute, []))
+        return base_permissions + attribute_permissions
+
     @classmethod
     def check(
         cls,
         data: dict[str, Any],
-        request_user: AbstractUser | AnonymousUser | Any,
+        request_user: AbstractBaseUser | AnonymousUser | Any,
     ) -> None:
         """
         Validate that the given user is authorized to perform the mutation described by `data`.
 
         Parameters:
             data (dict[str, Any]): Mutation payload mapping field names to values.
-            request_user (AbstractUser | AnonymousUser | Any): A user object or a user identifier; if an identifier is provided it will be resolved to a user.
+            request_user (AbstractBaseUser | AnonymousUser | Any): A user object or a user identifier; if an identifier is provided it will be resolved to a user.
 
         Raises:
             PermissionCheckError: Raised with the `request_user` and a list of field-level error messages when one or more fields fail their permission checks.
         """
-        errors = []
-        if not isinstance(request_user, (AbstractUser, AnonymousUser)):
+        errors: list[str] = []
+        if not isinstance(request_user, (AbstractBaseUser, AnonymousUser)):
             request_user = BasePermission.get_user_with_id(request_user)
         Permission = cls(data, request_user)
+        class_name = cls.__name__
+        is_audit_enabled = audit_logging_enabled()
+        if getattr(request_user, "is_superuser", False):
+            if is_audit_enabled:
+                for key in data:
+                    emit_permission_audit_event(
+                        PermissionAuditEvent(
+                            action="mutation",
+                            attributes=(key,),
+                            granted=True,
+                            user=request_user,
+                            manager=class_name,
+                            permissions=Permission.describe_permissions(key),
+                            bypassed=True,
+                        )
+                    )
+            return
         for key in data:
-            if not Permission.check_permission(key):
-                errors.append(
-                    f"Permission denied for {key} with value {data[key]} for user {request_user}"
+            is_allowed = Permission.check_permission(key)
+            if is_audit_enabled:
+                emit_permission_audit_event(
+                    PermissionAuditEvent(
+                        action="mutation",
+                        attributes=(key,),
+                        granted=is_allowed,
+                        user=request_user,
+                        manager=class_name,
+                        permissions=Permission.describe_permissions(key),
+                    )
+                )
+            if not is_allowed:
+                user_identifier = getattr(request_user, "id", None)
+                logger.info(
+                    "permission denied",
+                    context={
+                        "mutation": class_name,
+                        "action": "mutation",
+                        "attribute": key,
+                        "user_id": user_identifier,
+                    },
                 )
+                errors.append(f"Mutation permission denied for attribute '{key}'")
         if errors:
             raise PermissionCheckError(request_user, errors)
 
@@ -109,7 +164,7 @@ class MutationPermission:
                 self.__attribute_permissions[attribute]
             )
 
-        permission = self.__check_specific_permission(self.__mutate__)
+        permission = self.__check_specific_permission(self._mutate_permissions)
         self.__overall_result = permission
         return permission and attribute_permission
 

general_manager/permission/permission_checks.py

@@ -1,25 +1,26 @@
 """Registry of reusable permission checks and their queryset filters."""
 
+from __future__ import annotations
+
 from typing import Any, Callable, TYPE_CHECKING, TypedDict, Literal
 
 if TYPE_CHECKING:
-    from django.contrib.auth.models import AbstractUser, AnonymousUser
+    from django.contrib.auth.models import AbstractBaseUser, AnonymousUser
     from general_manager.permission.permission_data_manager import (
         PermissionDataManager,
     )
     from general_manager.manager.general_manager import GeneralManager
     from general_manager.manager.meta import GeneralManagerMeta
 
-
 type permission_filter = Callable[
-    [AbstractUser | AnonymousUser, list[str]],
-    dict[Literal["filter", "exclude"], dict[str, str]] | None,
+    [AbstractBaseUser | AnonymousUser, list[str]],
+    dict[Literal["filter", "exclude"], dict[str, Any]] | None,
 ]
 
 type permission_method = Callable[
     [
         PermissionDataManager | GeneralManager | GeneralManagerMeta,
-        AbstractUser | AnonymousUser,
+        AbstractBaseUser | AnonymousUser,
         list[str],
     ],
     bool,
@@ -33,36 +34,205 @@ class PermissionDict(TypedDict):
     permission_filter: permission_filter
 
 
-permission_functions: dict[str, PermissionDict] = {
-    "public": {
-        "permission_method": lambda _instance, _user, _config: True,
-        "permission_filter": lambda _user, _config: None,
-    },
-    "matches": {
-        "permission_method": lambda instance, _user, config: getattr(
-            instance, config[0]
-        )
-        == config[1],
-        "permission_filter": lambda _user, config: {"filter": {config[0]: config[1]}},
-    },
-    "ends_with": {
-        "permission_method": lambda instance, _user, config: getattr(
-            instance, config[0]
-        ).endswith(config[1]),
-        "permission_filter": lambda _user, config: {
-            "filter": {f"{config[0]}__endswith": config[1]}
-        },
-    },
-    "isAdmin": {
-        "permission_method": lambda _instance, user, _config: user.is_staff,
-        "permission_filter": lambda _user, _config: None,
-    },
-    "isSelf": {
-        "permission_method": lambda instance, user, _config: instance.creator == user,  # type: ignore
-        "permission_filter": lambda user, _config: {"filter": {"creator_id": user.id}},  # type: ignore
-    },
-    "isAuthenticated": {
-        "permission_method": lambda _instance, user, _config: user.is_authenticated,
-        "permission_filter": lambda _user, _config: None,
-    },
-}
+permission_functions: dict[str, PermissionDict] = {}
+
+__all__ = ["permission_functions", "register_permission"]
+
+_PERMISSION_ALREADY_REGISTERED_MESSAGE = "Permission function is already registered."
+
+
+def _default_permission_filter(
+    _user: AbstractBaseUser | AnonymousUser, _config: list[str]
+) -> dict[Literal["filter", "exclude"], dict[str, Any]] | None:
+    return None
+
+
+def register_permission(
+    name: str, *, permission_filter: permission_filter | None = None
+) -> Callable[[permission_method], permission_method]:
+    """
+    Register a permission function in the global registry.
+
+    Parameters:
+        name (str): Identifier used in permission expressions.
+        permission_filter (permission_filter | None): Optional callable that
+            provides queryset filters corresponding to the permission.
+
+    Returns:
+        Callable[[permission_method], permission_method]: Decorator that
+        registers the decorated function and returns it unchanged.
+
+    Raises:
+        ValueError: If another permission with the same name has already been
+            registered.
+    """
+
+    def decorator(func: permission_method) -> permission_method:
+        if name in permission_functions:
+            raise ValueError(_PERMISSION_ALREADY_REGISTERED_MESSAGE)
+        filter_callable = permission_filter or _default_permission_filter
+        permission_functions[name] = {
+            "permission_method": func,
+            "permission_filter": filter_callable,
+        }
+        return func
+
+    return decorator
+
+
+@register_permission("public")
+def _permission_public(
+    _instance: PermissionDataManager | GeneralManager | GeneralManagerMeta,
+    _user: AbstractBaseUser | AnonymousUser,
+    _config: list[str],
+) -> bool:
+    return True
+
+
+def _matches_permission_filter(
+    _user: AbstractBaseUser | AnonymousUser, config: list[str]
+) -> dict[Literal["filter", "exclude"], dict[str, Any]] | None:
+    if len(config) < 2:
+        return None
+    return {"filter": {config[0]: config[1]}}
+
+
+@register_permission("matches", permission_filter=_matches_permission_filter)
+def _permission_matches(
+    instance: PermissionDataManager | GeneralManager | GeneralManagerMeta,
+    _user: AbstractBaseUser | AnonymousUser,
+    config: list[str],
+) -> bool:
+    return bool(
+        len(config) >= 2 and str(getattr(instance, config[0], None)) == config[1]
+    )
+
+
+@register_permission("isAdmin")
+def _permission_is_admin(
+    _instance: PermissionDataManager | GeneralManager | GeneralManagerMeta,
+    user: AbstractBaseUser | AnonymousUser,
+    _config: list[str],
+) -> bool:
+    return bool(getattr(user, "is_staff", False))
+
+
+def _is_self_permission_filter(
+    user: AbstractBaseUser | AnonymousUser,
+    _config: list[str],
+) -> dict[Literal["filter", "exclude"], dict[str, Any]] | None:
+    return {"filter": {"creator_id": getattr(user, "id", None)}}
+
+
+@register_permission("isSelf", permission_filter=_is_self_permission_filter)
+def _permission_is_self(
+    instance: PermissionDataManager | GeneralManager | GeneralManagerMeta,
+    user: AbstractBaseUser | AnonymousUser,
+    _config: list[str],
+) -> bool:
+    return bool(instance.creator == user)  # type: ignore[union-attr]
+
+
+@register_permission("isAuthenticated")
+def _permission_is_authenticated(
+    _instance: PermissionDataManager | GeneralManager | GeneralManagerMeta,
+    user: AbstractBaseUser | AnonymousUser,
+    _config: list[str],
+) -> bool:
+    return bool(getattr(user, "is_authenticated", False))
+
+
+@register_permission("isActive")
+def _permission_is_active(
+    _instance: PermissionDataManager | GeneralManager | GeneralManagerMeta,
+    user: AbstractBaseUser | AnonymousUser,
+    _config: list[str],
+) -> bool:
+    return bool(getattr(user, "is_active", False))
+
+
+@register_permission("hasPermission")
+def _permission_has_permission(
+    _instance: PermissionDataManager | GeneralManager | GeneralManagerMeta,
+    user: AbstractBaseUser | AnonymousUser,
+    config: list[str],
+) -> bool:
+    if not config:
+        return False
+    has_perm = getattr(user, "has_perm", None)
+    if not callable(has_perm):
+        return False
+    return bool(has_perm(config[0]))
+
+
+@register_permission("inGroup")
+def _permission_in_group(
+    _instance: PermissionDataManager | GeneralManager | GeneralManagerMeta,
+    user: AbstractBaseUser | AnonymousUser,
+    config: list[str],
+) -> bool:
+    if not config:
+        return False
+    group_manager = getattr(user, "groups", None)
+    if group_manager is None or not hasattr(group_manager, "filter"):
+        return False
+    filtered = group_manager.filter(name=config[0])  # type: ignore[attr-defined]
+    return bool(hasattr(filtered, "exists") and filtered.exists())  # type: ignore[call-arg]
+
+
+def _related_user_field_permission_filter(
+    user: AbstractBaseUser | AnonymousUser, config: list[str]
+) -> dict[Literal["filter", "exclude"], dict[str, Any]] | None:
+    if not config:
+        return None
+    user_id = getattr(user, "id", None)
+    if user_id is None:
+        return None
+    return {"filter": {f"{config[0]}_id": user_id}}
+
+
+@register_permission(
+    "relatedUserField",
+    permission_filter=_related_user_field_permission_filter,
+)
+def _permission_related_user_field(
+    instance: PermissionDataManager | GeneralManager | GeneralManagerMeta,
+    user: AbstractBaseUser | AnonymousUser,
+    config: list[str],
+) -> bool:
+    if not config:
+        return False
+    related_object = getattr(instance, config[0], None)
+    return bool(related_object == user)  # type: ignore[arg-type]
+
+
+def _many_to_many_contains_user_permission_filter(
+    user: AbstractBaseUser | AnonymousUser, config: list[str]
+) -> dict[Literal["filter", "exclude"], dict[str, Any]] | None:
+    if not config:
+        return None
+    user_id = getattr(user, "id", None)
+    if user_id is None:
+        return None
+    return {"filter": {f"{config[0]}__id": user_id}}
+
+
+@register_permission(
+    "manyToManyContainsUser",
+    permission_filter=_many_to_many_contains_user_permission_filter,
+)
+def _permission_many_to_many_contains_user(
+    instance: PermissionDataManager | GeneralManager | GeneralManagerMeta,
+    user: AbstractBaseUser | AnonymousUser,
+    config: list[str],
+) -> bool:
+    if not config:
+        return False
+    related_manager = getattr(instance, config[0], None)
+    if related_manager is None or not hasattr(related_manager, "filter"):
+        return False
+    user_pk = getattr(user, "pk", None)
+    if user_pk is None:
+        return False
+    filtered = related_manager.filter(pk=user_pk)  # type: ignore[attr-defined]
+    return bool(hasattr(filtered, "exists") and filtered.exists())  # type: ignore[call-arg]

general_manager/permission/permission_data_manager.py

@@ -2,7 +2,6 @@
 
 from __future__ import annotations
 from typing import Callable, Optional, TypeVar, Generic, cast
-from django.contrib.auth.models import AbstractUser
 
 from general_manager.manager.general_manager import GeneralManager
 

general_manager/permission/utils.py

@@ -4,7 +4,7 @@ from general_manager.permission.permission_checks import (
     permission_functions,
 )
 from general_manager.permission.permission_data_manager import PermissionDataManager
-from django.contrib.auth.models import AbstractUser, AnonymousUser
+from django.contrib.auth.models import AbstractBaseUser, AnonymousUser
 
 from general_manager.manager.general_manager import GeneralManager
 from general_manager.manager.meta import GeneralManagerMeta
@@ -26,7 +26,7 @@ class PermissionNotFoundError(ValueError):
 def validate_permission_string(
     permission: str,
     data: PermissionDataManager | GeneralManager | GeneralManagerMeta,
-    request_user: AbstractUser | AnonymousUser,
+    request_user: AbstractBaseUser | AnonymousUser,
 ) -> bool:
     """
     Evaluate a compound permission expression joined by '&' operators.
@@ -34,7 +34,7 @@ def validate_permission_string(
     Parameters:
         permission (str): Permission expression where sub-permissions are joined with '&'. Individual sub-permissions may include ':'-separated configuration parts (for example, "isAuthenticated&admin:level").
         data (PermissionDataManager | GeneralManager | GeneralManagerMeta): Object passed to each permission function.
-        request_user (AbstractUser | AnonymousUser): User for whom permissions are evaluated.
+        request_user (AbstractBaseUser | AnonymousUser): User for whom permissions are evaluated.
 
     Returns:
         `true` if every sub-permission evaluates to True, `false` otherwise.

general_manager/public_api_registry.py

@@ -35,6 +35,14 @@ GENERAL_MANAGER_EXPORTS: LazyExportMap = {
         "general_manager.permission.manager_based_permission",
         "ManagerBasedPermission",
     ),
+    "register_permission": (
+        "general_manager.permission.permission_checks",
+        "register_permission",
+    ),
+    "permission_functions": (
+        "general_manager.permission.permission_checks",
+        "permission_functions",
+    ),
     "Rule": ("general_manager.rule.rule", "Rule"),
 }
 
@@ -124,6 +132,35 @@ PERMISSION_EXPORTS: LazyExportMap = {
         "general_manager.permission.mutation_permission",
         "MutationPermission",
     ),
+    "register_permission": (
+        "general_manager.permission.permission_checks",
+        "register_permission",
+    ),
+    "permission_functions": (
+        "general_manager.permission.permission_checks",
+        "permission_functions",
+    ),
+    "configure_audit_logger": (
+        "general_manager.permission.audit",
+        "configure_audit_logger",
+    ),
+    "configure_audit_logger_from_settings": (
+        "general_manager.permission.audit",
+        "configure_audit_logger_from_settings",
+    ),
+    "FileAuditLogger": (
+        "general_manager.permission.audit",
+        "FileAuditLogger",
+    ),
+    "DatabaseAuditLogger": (
+        "general_manager.permission.audit",
+        "DatabaseAuditLogger",
+    ),
+    "PermissionAuditEvent": (
+        "general_manager.permission.audit",
+        "PermissionAuditEvent",
+    ),
+    "AuditLogger": ("general_manager.permission.audit", "AuditLogger"),
 }
 
 

{generalmanager-0.20.1.dist-info → generalmanager-0.21.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: GeneralManager
-Version: 0.20.1
+Version: 0.21.0
 Summary: Modular Django-based data management framework with ORM, GraphQL, fine-grained permissions, rule validation, calculations and caching.
 Author-email: Tim Kleindick <tkleindick@yahoo.de>
 License: MIT License

{generalmanager-0.20.1.dist-info → generalmanager-0.21.0.dist-info}/RECORD

@@ -1,18 +1,18 @@
 general_manager/__init__.py,sha256=Xy4_fFjChIYtlBPDv7K3JEHOulq9_IFXkCc4CElS32Q,1035
-general_manager/apps.py,sha256=bz_A2IfgVba2b8lZC5aeQqe40IH7GaavpTEg828Ltm4,27343
+general_manager/apps.py,sha256=1wzMof8IKn_Zw4QyD3WwD7zVedAvsZKhCwsa0ajx6U8,27480
 general_manager/logging.py,sha256=bL2dEdNnxo74qRmhOCG06lbPtVCOozfF3GS133T9HH8,4250
-general_manager/public_api_registry.py,sha256=mDpKIE3fmFAMTbQnQdLAZGc_CKNNA6p22Jrql9R6Y4w,7817
+general_manager/public_api_registry.py,sha256=zAYG6UPfbv5NDSM59kvLxUZBJce5NF8lzEB4op8LnPM,8974
 general_manager/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 general_manager/_types/__init__.py,sha256=RmS0Ok-1-CwWOZL_socLWksEk9MfsshL9eQx879I4mU,60
 general_manager/_types/api.py,sha256=i5fi7O3C3frI74oqPT-tAoztDplgNDOShyvPNxhw7CY,496
 general_manager/_types/bucket.py,sha256=DZ3GC-1iR4RiNBKydsMhp_R4GTaYMfsonwe7MCADVP4,435
 general_manager/_types/cache.py,sha256=jMbIEXDq1pUvVxTN8hvD8rSH7QRjE3ewrMx2gEhYP3w,660
 general_manager/_types/factory.py,sha256=cPG_td05KCWv2j6_h_vYCKETPol3k_nXkEMWCcUdNHM,1726
-general_manager/_types/general_manager.py,sha256=Izs47-pOnYJqPmMF7m5DRodSISEztXKSxtBGIHgN8sA,1031
+general_manager/_types/general_manager.py,sha256=m-VA1968DYEFiunWyA72fUI1EicMLKarYJ5bkSyKJ7I,1241
 general_manager/_types/interface.py,sha256=JlPn3G3ompn1PRfFQfsrIJv2Pf0I3n1RL2ki5_fDX54,605
 general_manager/_types/manager.py,sha256=rXM6NrQaPdfE9CQoRV_jhbI3SK23rvdpvyBpybVgWi8,506
 general_manager/_types/measurement.py,sha256=Unkpf3H7TGaUKfkjmFDR7QWBU4lPp5I2A4GlK8pps-Y,443
-general_manager/_types/permission.py,sha256=HJBEOIDYbkYSZkEbT4_6qRDyUk2Ek153K_RchmeYd5I,416
+general_manager/_types/permission.py,sha256=olbtZNPkYoI1mbtzs6FDuVlKyGiP6VfGwufe8G56CQQ,1196
 general_manager/_types/rule.py,sha256=aNbx3jlVinAYQGJlmFwW8rOwTjf19F6khq5xbGTdD3U,238
 general_manager/_types/utils.py,sha256=8VyD6EKkcRIzdVs6FANP5Ri71eT4BT4c3dTUeyjDr40,1043
 general_manager/api/__init__.py,sha256=ChV1UPCUjW1Lci0BajmXVtE-3C-WLQTvjO058BMu1Bs,1020
@@ -51,13 +51,13 @@ general_manager/measurement/__init__.py,sha256=38-6kTERbw7EeOQAw3eZ9DDEu6hwwqkGJ
 general_manager/measurement/measurement.py,sha256=ArEnntLu3ffHID71uFbXwiB5e5tpsBT2_TbBPJfCWJI,26070
 general_manager/measurement/measurement_field.py,sha256=zQbyLZT7E9Lx4f3u_wQ-rEoLPqH0FWhfWyOd1BaW--M,13950
 general_manager/permission/__init__.py,sha256=s4Ka11uYBrymM5O-n5kIxOjwUprZ394jTuzGf5prO_8,981
-general_manager/permission/base_permission.py,sha256=IKi5n8t1sKUP_F2eZnzTC8lg7HI8OVo5p1jxCBpyCgw,11961
-general_manager/permission/file_based_permission.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-general_manager/permission/manager_based_permission.py,sha256=OdDGKwutkHTT13bhSeGGycd3xr7wGhuRXsYym3Z9j2A,10613
-general_manager/permission/mutation_permission.py,sha256=5JV6pluIFPGzJPQ_pr-44zwFg_TgzNwDTHcdpwHettU,4606
-general_manager/permission/permission_checks.py,sha256=4OVQz0QVnmHN-KPge4pz2Zm_oMxo2PUytW7JoDoHjL0,2297
-general_manager/permission/permission_data_manager.py,sha256=vNWbPrcw1NUZ-oTRjc3PME479ubbOqxlKx020GY5wzQ,3905
-general_manager/permission/utils.py,sha256=yojrcF1kD6KjKugrGyiaf8XOyS_tUA4yB5_RideKJeg,2905
+general_manager/permission/audit.py,sha256=mOT4Dj5LnAMbHWXKf6JCM01L-jd7GsMSmAIBTR1hTS0,12802
+general_manager/permission/base_permission.py,sha256=69mgDS7iuxEA1V8lDanDBAH20BY3yc4vp8E0sjrqzmE,16045
+general_manager/permission/manager_based_permission.py,sha256=SfqEvC3RbXjWxxm6JOgEJI9li_6uiB4-avihhgfjynw,11902
+general_manager/permission/mutation_permission.py,sha256=QG-cH1T8anIS4DYRdUHwHOilpop9UzkwMUTiak-sG8s,6871
+general_manager/permission/permission_checks.py,sha256=S0agZzG-tdZWLKWAF_1jdrvsLVbhVk1k1MrBdqNYc8o,7710
+general_manager/permission/permission_data_manager.py,sha256=aqmj5rpslOgCT0GdXnsBtjpFoRerFOa3xG84Jus17b8,3853
+general_manager/permission/utils.py,sha256=Q3E9aq3jUOhBXOdLwWSQsXgNMuV6Bp7R84xM_JLB6Y0,2917
 general_manager/rule/__init__.py,sha256=dFQLJNr0qpkpuzuBbMY-74jz_Y033YyB9X_OfeJYhSs,1026
 general_manager/rule/handler.py,sha256=qSBXmXvl7fRgjxUo4wyUOzdZm14a8Umd2Jec4zPXJQc,16309
 general_manager/rule/rule.py,sha256=41VXFTSWkBEOj8045vZTezm38VEGimjrk22J4YRl144,22691
@@ -71,8 +71,8 @@ general_manager/utils/none_to_zero.py,sha256=Z2KVXBKCz02V2ZBs-7tIs_32n7YDxiXyood
 general_manager/utils/path_mapping.py,sha256=f3sd3OFh9aJgyF-ayqr22mHnCo-uoIXqio5DRQmziGM,9931
 general_manager/utils/public_api.py,sha256=bas4SKchJUg2dI2SLRQwkF_CoXJKKwkzQx_JOjMJ2VY,3272
 general_manager/utils/testing.py,sha256=_V4Y5SXvu-ocoq-AntPFPd140igclUJUT2xVXxhRrSs,14954
-generalmanager-0.20.1.dist-info/licenses/LICENSE,sha256=OcRwUgM4iiESN1oNELgyuwuah39XX-EPZiPDDHndNVI,1070
-generalmanager-0.20.1.dist-info/METADATA,sha256=aZ08I7nii3gn6zicyZnhavmaZlbQHZIlb8PEaYuT5is,8266
-generalmanager-0.20.1.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
-generalmanager-0.20.1.dist-info/top_level.txt,sha256=sTDtExP9ga-YP3h3h42yivUY-A2Q23C2nw6LNKOho4I,16
-generalmanager-0.20.1.dist-info/RECORD,,
+generalmanager-0.21.0.dist-info/licenses/LICENSE,sha256=OcRwUgM4iiESN1oNELgyuwuah39XX-EPZiPDDHndNVI,1070
+generalmanager-0.21.0.dist-info/METADATA,sha256=ubnYLTNd5AzlLYju1ykPewMtGIMF-e7lVKl4Hqo2Os8,8266
+generalmanager-0.21.0.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
+generalmanager-0.21.0.dist-info/top_level.txt,sha256=sTDtExP9ga-YP3h3h42yivUY-A2Q23C2nw6LNKOho4I,16
+generalmanager-0.21.0.dist-info/RECORD,,