abs-auth-rbac-core 0.1.4__tar.gz → 0.1.6__tar.gz

{abs_auth_rbac_core-0.1.4 → abs_auth_rbac_core-0.1.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: abs-auth-rbac-core
-Version: 0.1.4
+Version: 0.1.6
 Summary: RBAC and Auth core utilities including JWT token management.
 License: MIT
 Author: AutoBridgeSystems

{abs_auth_rbac_core-0.1.4 → abs_auth_rbac_core-0.1.6}/abs_auth_rbac_core/auth/middleware.py

@@ -43,7 +43,7 @@ def auth_middleware(
 
             # Attach user to request state
             request.state.user = user
-            return user  # Still return user for backward compatibility
+            return user 
 
         except Exception as e:
             logger.error(f"Authentication error: {str(e)}", exc_info=True)

{abs_auth_rbac_core-0.1.4 → abs_auth_rbac_core-0.1.6}/abs_auth_rbac_core/models/__init__.py

@@ -3,5 +3,6 @@ from .roles import Role
 from .user_role import UserRole
 from .user import Users
 from .role_permission import RolePermission
+from .user_permission import UserPermission
 
-__all__ = ["Permission", "Role", "UserRole", "Users","RolePermission"]
+__all__ = ["Permission", "Role", "UserRole", "Users","RolePermission","UserPermission"]

{abs_auth_rbac_core-0.1.4 → abs_auth_rbac_core-0.1.6}/abs_auth_rbac_core/models/permissions.py

@@ -24,3 +24,9 @@ class Permission(RBACBaseModel):
     roles = relationship(
         "Role", secondary="gov_role_permissions", back_populates="permissions"
     )
+
+    user_permissions = relationship(
+        "UserPermission",
+        back_populates="permission",
+        cascade="all, delete-orphan"
+    )

{abs_auth_rbac_core-0.1.4 → abs_auth_rbac_core-0.1.6}/abs_auth_rbac_core/models/user.py

@@ -24,4 +24,10 @@ class Users(BaseModel):
         overlaps="roles"
     )
 
-    eagers = ["roles"]
+    user_permissions = relationship(
+        "UserPermission",
+        back_populates="user",
+        cascade="all, delete-orphan"
+    )
+
+    eagers = ["roles","user_permissions"]

abs_auth_rbac_core-0.1.6/abs_auth_rbac_core/models/user_permission.py

@@ -0,0 +1,15 @@
+from sqlalchemy import Column, ForeignKey, String
+from sqlalchemy.orm import relationship
+from abs_auth_rbac_core.models.base_model import BaseModel
+
+
+class UserPermission(BaseModel):
+    """Association model between users and permissions"""
+
+    __tablename__ = "gov_user_permissions"
+
+    user_uuid = Column(String(36), ForeignKey("gov_users.uuid"), index=True)
+    permission_uuid = Column(String(36), ForeignKey("gov_permissions.uuid"), index=True)
+
+    user = relationship("Users", back_populates="user_permissions")
+    permission = relationship("Permission", back_populates="user_permissions")

{abs_auth_rbac_core-0.1.4 → abs_auth_rbac_core-0.1.6}/abs_auth_rbac_core/rbac/decorator.py

@@ -23,8 +23,8 @@ def rbac_require_permission(permissions: Union[str, List[str]]):
             request:Request,
             *args,rbac_service:RBACService, **kwargs,
         ):
-            current_user_id = request.state.user.uuid
-            if not current_user_id:
+            current_user_uuid = request.state.user.uuid
+            if not current_user_uuid:
                 raise PermissionDeniedError(
                     detail="User not found (missing 'uuid')."
                 )
@@ -37,7 +37,7 @@ def rbac_require_permission(permissions: Union[str, List[str]]):
                     )
                 
                 has_permission = rbac_service.check_permission(
-                    user_uuid=current_user_id, resource=resource, action=action,module=module
+                    user_uuid=current_user_uuid, resource=resource, action=action,module=module
                 )
 
                 if not has_permission:

{abs_auth_rbac_core-0.1.4 → abs_auth_rbac_core-0.1.6}/abs_auth_rbac_core/rbac/service.py

@@ -1,16 +1,17 @@
-from typing import List, Optional, Callable,Any
+from typing import List, Optional, Callable,Any,Tuple
 import os
 import casbin
 from casbin_sqlalchemy_adapter import Adapter
 from sqlalchemy import and_, select
 from sqlalchemy.orm import Session, joinedload
-
+from ..schema import CreatePermissionSchema
 from ..models import (
     Role,
     RolePermission,
     UserRole,
     Users,
-    Permission
+    Permission,
+    UserPermission
 )
 
 from abs_exception_core.exceptions import (
@@ -52,8 +53,151 @@ class RBACService:
             )
             # Load policies
             self.enforcer.load_policy()
+
+    def add_policy(self,role:str,resource:str,action:str,module:str):
+        """
+        Add a policy to the casbin enforcer
+        """
+        self.enforcer.add_policy(role,resource,action,module)
+        self.enforcer.save_policy()
+
+    def remove_policy(self,role:str,resource:str,action:str,module:str):
+        """
+        Remove a policy from the casbin enforcer
+        """
+        self.enforcer.remove_policy(role,resource,action,module)
+        self.enforcer.save_policy()
+
+    def add_policies(self,policies:List[Tuple[str,str,str,str]]):
+        """
+        Add a list of policies to the casbin enforcer
+        """
+        self.enforcer.add_policies(policies)
+        self.enforcer.save_policy()
+
+    def remove_policies(self,policies:List[List[str]]):
+        """
+        Remove a list of policies from the casbin enforcer
+        """
+        self.enforcer.remove_policies(policies)
+        self.enforcer.save_policy()
+
+    def enforce_policy(self,role:str,resource:str,action:str,module:str):
+        """
+        Enforce a policy
+        """
+        return self.enforcer.enforce(role,resource,action,module)
+    
+    def remove_filter_policy(self,index:int,value:str):
+        """
+        Remove a policy by filtering the policy
+        Args:
+            index: The index of the policy to remove
+            value: The value of the policy to remove
+        """
+        self.enforcer.remove_filtered_policy(index,value)
+        self.enforcer.save_policy()
+
+    async def bulk_create_permissions(self,permissions:List[CreatePermissionSchema]):
+        """
+        Bulk create permissions for user
+        """
+        with self.db() as session:
+            try:
+                permission_objs = [Permission(**permission.model_dump()) for permission in permissions]
+                session.bulk_save_objects(permission_objs)
+                session.commit()
+                return permission_objs
+            except Exception as e:
+                raise e
             
+    async def get_permissions_by_condition(self, condition: dict, use_filter_by: bool = True):
+        """
+        Get permission(s) based on a condition dict.
+        If use_filter_by is True, assumes all conditions are `==`.
+        """
+        with self.db() as session:
+            try:
+                query = session.query(Permission)
+                if use_filter_by:
+                    query = query.filter_by(**condition)
+                else:
+                    filters = [getattr(Permission, k) == v for k, v in condition.items()]
+                    query = query.filter(*filters)
+                return query.all()
+            except Exception as e:
+                raise e
+            
+    async def delete_permission_by_uuids(self,permission_uuids:List[str]):
+        """
+        Delete a permission by uuids
+        """
+        with self.db() as session:
+            try:
+                permissions = session.query(Permission).filter(Permission.uuid.in_(permission_uuids))
+                for permission in permissions:
+                    self.enforcer.remove_filtered_policy(1,permission.resource)
+                    self.enforcer.save_policy()
+
+                permissions.delete(synchronize_session=False)
+                session.commit()
+                return True
+            except Exception as e:
+                raise e
+
+    def assign_permissions_to_user(self,user_uuid:str,permission_uuids:List[str]):
+        """
+        Assign permissions to a user
+        """
+        with self.db() as session:
+            current_permissions = session.query(UserPermission).filter(UserPermission.user_uuid==user_uuid).all()
+            current_permission_uuids = [permission.permission_uuid for permission in current_permissions]
+            remove_permissions = set(current_permission_uuids) - set(permission_uuids)
+            add_permissions = set(permission_uuids) - set(current_permission_uuids)
+            if remove_permissions:
+                self.revoke_user_permissions(user_uuid,list(remove_permissions))
+            if add_permissions:
+                self.attach_permissions_to_user(user_uuid,list(add_permissions))
+            return True
 
+    def attach_permissions_to_user(self, user_uuid: str, permission_uuids: List[str]):
+        with self.db() as session:
+            user_permissions = [
+                UserPermission(user_uuid=user_uuid, permission_uuid=permission_uuid)
+                for permission_uuid in permission_uuids
+            ]
+            session.bulk_save_objects(user_permissions)
+            session.commit()
+
+            permissions = session.query(Permission).filter(Permission.uuid.in_(permission_uuids)).all()
+            policies = [
+                [f"user:{user_uuid}", permission.resource, permission.action, permission.module]
+                for permission in permissions
+            ]
+            self.enforcer.add_policies(policies)
+            self.enforcer.save_policy()
+            return user_permissions
+
+
+    def revoke_user_permissions(self, user_uuid: str, permission_uuids: List[str]):
+        with self.db() as session:
+            user_permissions = session.query(UserPermission).filter(
+                UserPermission.user_uuid == user_uuid,
+                UserPermission.permission_uuid.in_(permission_uuids)
+            )
+
+            permissions = session.query(Permission).filter(Permission.uuid.in_(permission_uuids)).all()
+            policies = [
+                [f"user:{user_uuid}", permission.resource, permission.action, permission.module]
+                for permission in permissions
+            ]
+            self.enforcer.remove_policies(policies)
+            self.enforcer.save_policy()
+
+            user_permissions.delete(synchronize_session=False)
+            session.commit()
+            return True
+            
     def list_roles(self) -> Any:
         """
         Get the list of all roles
@@ -136,7 +280,7 @@ class RBACService:
 
                     # Batch add Casbin policies
                     policies = [
-                        (role.name, permission.resource, permission.action, permission.module)
+                        [role.uuid, permission.resource, permission.action, permission.module]
                         for permission in existing_permissions
                     ]
                     self.enforcer.add_policies(policies)
@@ -213,13 +357,11 @@ class RBACService:
                     existing_permissions = role.permissions
 
                     # Remove Casbin policies for existing permissions
-                    for existing_permission in existing_permissions:
-                        self.enforcer.remove_policy(
-                            role.name,
-                            existing_permission.resource,
-                            existing_permission.action,
-                            existing_permission.module
-                        )
+                    remove_policies = [
+                        [role_uuid, existing_permission.resource, existing_permission.action, existing_permission.module]
+                        for existing_permission in existing_permissions
+                    ]
+                    self.enforcer.remove_policies(remove_policies)
                     self.enforcer.save_policy()
 
                     # Delete existing role permissions
@@ -250,11 +392,11 @@ class RBACService:
                     session.bulk_insert_mappings(RolePermission, role_permissions)
 
                     # Add Casbin policies
-                    for permission in permissions_objs:
-                        self.enforcer.add_policy(
-                            role.name, permission.resource, permission.action, permission.module
-                        )
-
+                    policies = [
+                        [role_uuid, permission.resource, permission.action, permission.module]
+                        for permission in permissions_objs
+                    ]
+                    self.enforcer.add_policies(policies)
                     self.enforcer.save_policy()
 
                 session.commit()
@@ -290,7 +432,7 @@ class RBACService:
 
                 # Collect all policies to remove from the eagerly loaded permissions
                 remove_policies = [
-                    [role.name, permission.resource, permission.action, permission.module]
+                    [role.uuid, permission.resource, permission.action, permission.module]
                     for permission in role.permissions
                 ]
                 
@@ -317,6 +459,30 @@ class RBACService:
         with self.db() as session:
             return session.query(Permission).filter(Permission.module == module).all()
         
+    def get_user_only_permissions(self, user_uuid: str) -> List[Any]:
+        """Get all allowed permissions for a user"""
+        with self.db() as session:
+            user_permissions = (
+                session.query(UserPermission)
+                .filter(UserPermission.user_uuid == user_uuid)
+                .options(joinedload(UserPermission.permission))
+                .all()
+            )
+            result = []
+            for user_permission in user_permissions:
+                result.append(
+                    {
+                        "permission_id": user_permission.permission.id,
+                        "created_at": user_permission.permission.created_at,
+                        "updated_at": user_permission.permission.updated_at,
+                        "name": user_permission.permission.name,
+                        "resource": user_permission.permission.resource,
+                        "action": user_permission.permission.action,
+                        "module": user_permission.permission.module
+                    }
+                )
+            return result
+        
     def get_user_permissions(self, user_uuid: str) -> List[Any]:
         """Get all allowed permissions for a user"""
         with self.db() as session:
@@ -397,7 +563,7 @@ class RBACService:
 
                 # Remove Casbin policies
                 policies_to_remove = [
-                    (role.name, permission.resource, permission.action, permission.module)
+                    (role.uuid, permission.resource, permission.action, permission.module)
                     for permission in permissions_to_revoke
                 ]
                 self.enforcer.remove_policies(policies_to_remove)
@@ -465,7 +631,7 @@ class RBACService:
 
                 # Add Casbin policies
                 policies_to_add = [
-                    (role.name, permission.resource, permission.action, permission.module)
+                    (role.uuid, permission.resource, permission.action, permission.module)
                     for permission in new_permissions
                 ]
                 self.enforcer.add_policies(policies_to_add)
@@ -648,15 +814,15 @@ class RBACService:
             )
             for role in roles:
                 # Try with module first
-                if self.enforcer.enforce(role.name, resource, action, module):
+                if self.enforcer.enforce(role.uuid, resource, action, module):
                     return True
             return False
 
     def check_permission_by_role(
-        self, role_name: str, resource: str, action: str, module: str
+        self, role_uuid: str, resource: str, action: str, module: str
     ) -> bool:
         # Try with module first
-        if self.enforcer.enforce(role_name, resource, action, module):
+        if self.enforcer.enforce(role_uuid, resource, action, module):
             return True
         return False
 

abs_auth_rbac_core-0.1.6/abs_auth_rbac_core/schema/__init__.py

@@ -0,0 +1 @@
+from .permission import CreatePermissionSchema

abs_auth_rbac_core-0.1.6/abs_auth_rbac_core/schema/permission.py

@@ -0,0 +1,9 @@
+from pydantic import BaseModel
+from typing import Optional
+
+class CreatePermissionSchema(BaseModel):
+    name: str
+    description: Optional[str] = None
+    resource: str
+    action: str
+    module: str

{abs_auth_rbac_core-0.1.4 → abs_auth_rbac_core-0.1.6}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "abs-auth-rbac-core"
-version = "0.1.4"
+version = "0.1.6"
 description = "RBAC and Auth core utilities including JWT token management."
 authors = [
     {name = "AutoBridgeSystems", email = "info@autobridgesystems.com"}