abs-auth-rbac-core 0.3.2__py3-none-any.whl → 0.3.18__py3-none-any.whl

abs_auth_rbac_core/auth/__init__.py

@@ -1,3 +1,15 @@
 from .jwt_functions import JWTFunctions
+from .middleware import (
+    CustomHTTPBearer,
+    auth_middleware,
+    contacts_auth_middleware,
+    unified_auth_middleware
+)
 
-__all__ = ["JWTFunctions"]
+__all__ = [
+    "JWTFunctions",
+    "CustomHTTPBearer",
+    "auth_middleware",
+    "contacts_auth_middleware",
+    "unified_auth_middleware"
+]

abs_auth_rbac_core/auth/auth_functions.py

@@ -20,7 +20,10 @@ def get_user_by_attribute(db_session: Callable[...,Any],attribute: str, value: s
             if not hasattr(Users, attribute):
                 raise ValidationError(detail=f"Attribute {attribute} does not exist on the User model")
             
-            user = session.query(Users).filter(getattr(Users, attribute) == value).first()
+            user = session.query(Users).filter(
+                getattr(Users, attribute) == value,
+                Users.deleted_at.is_(None)  # Filter out soft-deleted users
+            ).first()
 
             if not user:
                 raise NotFoundError(detail="User not found")

abs_auth_rbac_core/auth/middleware.py

@@ -6,7 +6,8 @@ from typing import Callable, Any, Optional
 
 from .jwt_functions import JWTFunctions
 from .auth_functions import get_user_by_attribute
-from abs_exception_core.exceptions import UnauthorizedError, AuthError
+from abs_exception_core.exceptions import UnauthorizedError, AuthError, NotFoundError
+from abs_nosql_repository_core.repository import BaseRepository
 from fastapi.security.utils import get_authorization_scheme_param
 
 class CustomHTTPBearer(HTTPBearer):
@@ -77,4 +78,168 @@ def auth_middleware(
             logger.error(f"Authentication error: {str(e)}", exc_info=True)
             raise UnauthorizedError(detail="Authentication failed")
     
+    return get_auth
+
+
+def contacts_auth_middleware(
+    entity_records_service,
+    jwt_secret_key: str,
+    jwt_algorithm: str
+):
+    """
+    Contact authentication middleware using EntityRecordsService.
+
+    This middleware validates contact JWT tokens and attaches contact data to request.state.
+
+    JWT Payload Structure:
+        {
+            "sub": "contact@example.com",
+            "cid": "contact_record_id",  # KEY IDENTIFIER for contacts
+            "uuid": "unique-uuid",
+            "exp": 1234567890,
+            "iat": 1234567890
+        }
+
+    Args:
+        entity_records_service: EntityRecordsService for entity operations
+        jwt_secret_key: JWT secret key
+        jwt_algorithm: JWT algorithm (e.g., HS256)
+
+    Returns:
+        FastAPI dependency function that validates contact authentication
+    """
+
+    async def get_auth(
+        request: Request,
+        token: HTTPAuthorizationCredentials = Depends(security)
+    ):
+        jwt_functions = JWTFunctions(
+            secret_key=jwt_secret_key,
+            algorithm=jwt_algorithm
+        )
+
+        try:
+            if not token or not token.credentials:
+                raise UnauthorizedError(detail="Invalid authentication credentials")
+
+            # Decode JWT and extract payload
+            payload = jwt_functions.get_data(token=token.credentials)
+
+            # Extract cid (required for contact authentication)
+            cid = payload.get("cid")
+            if not cid:
+                raise UnauthorizedError(detail="Invalid contact token")
+
+            # Extract app_id from path parameters
+            app_id = request.path_params.get("app_id")
+            if not app_id:
+                raise UnauthorizedError(detail="App ID is required")
+
+            logger.info(f"Contact auth: app_id={app_id}, cid={cid}")
+
+            # Get app configuration (apps collection is not an entity collection)
+            # We still need BaseRepository for this until apps get moved to a service
+            base_repo = BaseRepository(db=entity_records_service.repository.db)
+            app = await base_repo.get_by_attr("id", app_id, collection_name="apps")
+            if not app:
+                logger.error(f"App not found: {app_id}")
+                raise UnauthorizedError(detail="App not found")
+
+            # Extract contact entity ID from app metadata
+            metadata = app.get("metadata", {})
+            if not metadata:
+                raise UnauthorizedError(detail="App doesn't have support for contacts")
+
+            features_entities = metadata.get("features_entities", {})
+            if "CONTACT" not in features_entities:
+                raise UnauthorizedError(detail="App doesn't have support for contacts")
+
+            contact_config = features_entities.get("CONTACT", {})
+            contact_entity_id = contact_config.get("Contacts")
+
+            if not contact_entity_id:
+                raise UnauthorizedError(detail="Contact entity not configured")
+
+            logger.info(f"Contact entity ID: {contact_entity_id}")
+
+            # Get contact record using EntityRecordsService
+            try:
+                contact = await entity_records_service.get_record_by_id(
+                    entity_id=contact_entity_id,
+                    record_id=cid,
+                    convert_ids=False  # Keep ObjectIds for internal use
+                )
+            except NotFoundError:
+                logger.error(f"Authentication failed: contact with id {cid} not found")
+                raise UnauthorizedError(detail="Authentication failed")
+
+            logger.info(f"✅ Contact authenticated: {cid}")
+
+            # Attach contact to request state
+            request.state.contact = contact
+            request.state.contact_entity_id = contact_entity_id
+
+            return contact
+
+        except UnauthorizedError:
+            raise
+        except Exception as e:
+            logger.error(f"Authentication error: {str(e)}", exc_info=True)
+            raise UnauthorizedError(detail="Authentication failed")
+
+    return get_auth
+
+
+def unified_auth_middleware(
+    jwt_secret_key: str,
+    jwt_algorithm: str,
+    get_user_auth_middleware: Callable,
+    get_contact_auth_middleware: Callable,
+):
+    """
+    Unified authentication middleware that intelligently routes to the correct
+    authentication flow based on JWT payload.
+
+    Detection Logic:
+        - If JWT contains "cid" field → Contact authentication
+        - Otherwise → User authentication
+
+    Benefits:
+        - Single entry point for all authentication
+        - JWT decoded only once for efficiency
+        - Transparent routing based on token type
+        - No code changes needed in route handlers
+
+    Args:
+        jwt_secret_key: JWT secret key
+        jwt_algorithm: JWT algorithm (e.g., HS256)
+        get_user_auth_middleware: User auth middleware callable
+        get_contact_auth_middleware: Contact auth middleware callable
+
+    Returns:
+        FastAPI dependency that handles unified authentication
+    """
+    async def get_auth(
+        request: Request,
+        token: HTTPAuthorizationCredentials = Depends(security)
+    ):
+        if not token or not token.credentials:
+            raise UnauthorizedError(detail="Invalid authentication credentials")
+
+        # Decode JWT once to inspect payload
+        jwt_functions = JWTFunctions(
+            secret_key=jwt_secret_key,
+            algorithm=jwt_algorithm
+        )
+        payload = jwt_functions.get_data(token=token.credentials)
+
+        # Route based on payload content
+        cid = payload.get("cid")
+        if cid:
+            # Contact flow: JWT contains contact ID
+            return await get_contact_auth_middleware(request=request, token=token)
+
+        # User flow: Standard user authentication
+        return await get_user_auth_middleware(request=request, token=token)
+
     return get_auth

abs_auth_rbac_core/models/user.py

@@ -12,6 +12,7 @@ class Users(BaseModel):
     name = Column(String(100), nullable=False)
     is_active = Column(Boolean, default=True)
     last_login_at = Column(DateTime, nullable=True)
+    deleted_at = Column(DateTime, nullable=True)  # Soft delete timestamp
 
     # Relationships
     roles = relationship(

abs_auth_rbac_core/rbac/service.py

@@ -4,7 +4,7 @@ from pydantic import BaseModel
 import casbin
 from casbin_sqlalchemy_adapter import Adapter
 from casbin_redis_watcher import RedisWatcher, WatcherOptions,new_watcher
-from sqlalchemy import and_, select
+from sqlalchemy import and_, or_, select
 from sqlalchemy.orm import Session, joinedload
 from ..schema import CreatePermissionSchema
 from ..models import (
@@ -47,6 +47,43 @@ class RBACService:
         self.watcher = None
 
 
+    def _save_policy_if_watcher_active(self):
+        """
+        Helper method to save policy only if Redis watcher is active.
+        This ensures distributed systems stay in sync while avoiding
+        unnecessary load_policy calls on the current instance.
+        """
+        if self.is_watcher_active():
+            self.enforcer.save_policy()
+
+    def _bulk_operation_context(self):
+        """
+        Context manager for bulk Casbin operations.
+        Temporarily disables auto_save, executes operations, then saves once at the end.
+        This significantly reduces overhead for bulk policy changes.
+
+        Usage:
+            with self._bulk_operation_context():
+                self.enforcer.add_policies(policies)
+        """
+        class BulkOperationContext:
+            def __init__(self, service):
+                self.service = service
+                self.original_auto_save = None
+
+            def __enter__(self):
+                self.original_auto_save = self.service.enforcer.auto_save
+                self.service.enforcer.enable_auto_save(False)
+                return self
+
+            def __exit__(self, exc_type, exc_val, exc_tb):
+                if exc_type is None:  # Only save if no exception occurred
+                    self.service._save_policy_if_watcher_active()
+                self.service.enforcer.enable_auto_save(self.original_auto_save)
+                return False
+
+        return BulkOperationContext(self)
+
     def _initialize_casbin(self,redis_config:Optional[RedisWatcherSchema]=None):
         """
         Initiates the casbin policy using the default rules
@@ -65,8 +102,7 @@ class RBACService:
             self.enforcer = casbin.Enforcer(
                 policy_path, adapter
             )
-            # Load policies
-            self.enforcer.load_policy()
+            self.enforcer.enable_auto_save(True)
 
             if redis_config:
                 try:
@@ -109,8 +145,6 @@ class RBACService:
 
                     self.enforcer.set_watcher(watcher)
                     self.watcher = watcher
-                    self.enforcer.save_policy()
-                    
                 except Exception as e:
                     logger.error(f"Failed to initialize Redis watcher: {e}")
                     self.watcher = None
@@ -119,31 +153,31 @@ class RBACService:
 
     def add_policy(self,role:str,resource:str,action:str,module:str):
         """
-        Add a policy to the casbin enforcer
+        Add a policy to the casbin enforcer (optimized for distributed systems)
         """
-        self.enforcer.add_policy(role,resource,action,module)
-        self.enforcer.save_policy()
+        with self._bulk_operation_context():
+            self.enforcer.add_policy(role,resource,action,module)
 
     def remove_policy(self,role:str,resource:str,action:str,module:str):
         """
-        Remove a policy from the casbin enforcer
+        Remove a policy from the casbin enforcer (optimized for distributed systems)
         """
-        self.enforcer.remove_policy(role,resource,action,module)
-        self.enforcer.save_policy()
+        with self._bulk_operation_context():
+            self.enforcer.remove_policy(role,resource,action,module)
 
     def add_policies(self,policies:List[Tuple[str,str,str,str]]):
         """
-        Add a list of policies to the casbin enforcer
+        Add a list of policies to the casbin enforcer (optimized for distributed systems)
         """
-        self.enforcer.add_policies(policies)
-        self.enforcer.save_policy()
+        with self._bulk_operation_context():
+            self.enforcer.add_policies(policies)
 
     def remove_policies(self,policies:List[List[str]]):
         """
-        Remove a list of policies from the casbin enforcer
+        Remove a list of policies from the casbin enforcer (optimized for distributed systems)
         """
-        self.enforcer.remove_policies(policies)
-        self.enforcer.save_policy()
+        with self._bulk_operation_context():
+            self.enforcer.remove_policies(policies)
 
     def enforce_policy(self,role:str,resource:str,action:str,module:str):
         """
@@ -153,13 +187,13 @@ class RBACService:
     
     def remove_filter_policy(self,index:int,value:str):
         """
-        Remove a policy by filtering the policy
+        Remove a policy by filtering the policy (optimized for distributed systems)
         Args:
             index: The index of the policy to remove
             value: The value of the policy to remove
         """
-        self.enforcer.remove_filtered_policy(index,value)
-        self.enforcer.save_policy()
+        with self._bulk_operation_context():
+            self.enforcer.remove_filtered_policy(index,value)
 
     async def bulk_create_permissions(self,permissions:List[CreatePermissionSchema]):
         """
@@ -181,34 +215,64 @@ class RBACService:
             except Exception as e:
                 raise e
             
-    async def get_permissions_by_condition(self, condition: dict, use_filter_by: bool = True):
+    def build_filter(self,cond: dict):
+        if "and" in cond:
+            return and_(*[self.build_filter(c) for c in cond["and"]])
+        elif "or" in cond:
+            return or_(*[self.build_filter(c) for c in cond["or"]])
+        else:
+            # Multiple simple field=value pairs in the same dict
+            return and_(*[
+                getattr(Permission, field) == value
+                for field, value in cond.items()
+            ])
+
+
+    async def get_permissions_by_condition(self, condition: dict):
         """
-        Get permission(s) based on a condition dict.
-        If use_filter_by is True, assumes all conditions are `==`.
+        Get permission(s) based on nested logical conditions.
+
+        Example:
+        {
+            "and": [
+                {"entity_id": "123"},
+                {"or": [
+                    {"user_id": "456"},
+                    {"group_id": "789"}
+                ]}
+            ]
+        }
         """
         with self.db() as session:
             try:
-                query = session.query(Permission)
-                if use_filter_by:
-                    query = query.filter_by(**condition)
-                else:
-                    filters = [getattr(Permission, k) == v for k, v in condition.items()]
-                    query = query.filter(*filters)
+                query = session.query(Permission).filter(self.build_filter(condition))
                 return query.all()
             except Exception as e:
                 raise e
-            
+
     async def delete_permission_by_uuids(self,permission_uuids:List[str]):
         """
-        Delete a permission by uuids
+        Delete permissions by uuids (optimized for distributed systems)
+        Handles cascade deletion in proper order:
+        1. Delete UserPermission associations
+        2. Delete RolePermission associations
+        3. Delete Permissions
         """
         with self.db() as session:
             try:
+                # Step 1: Delete user_permissions associations
                 user_permissions = session.query(UserPermission).filter(UserPermission.permission_uuid.in_(permission_uuids)).delete(synchronize_session=False)
+
+                # Step 2: Delete role_permissions associations (CRITICAL for FK constraint)
+                role_permissions = session.query(RolePermission).filter(RolePermission.permission_uuid.in_(permission_uuids)).delete(synchronize_session=False)
+
+                # Step 3: Delete permissions
                 permissions = session.query(Permission).filter(Permission.uuid.in_(permission_uuids))
-                for permission in permissions:
-                    self.enforcer.remove_filtered_policy(1,permission.resource)
-                self.enforcer.save_policy()
+
+                with self._bulk_operation_context():
+                    for permission in permissions:
+                        self.enforcer.remove_filtered_policy(1,permission.resource)
+
                 permissions.delete(synchronize_session=False)
                 session.commit()
                 return True
@@ -234,29 +298,38 @@ class RBACService:
                 raise e
 
     def attach_permissions_to_user(self, user_uuid: str, permission_uuids: List[str]):
+        """
+        Attach permissions to user (optimized for distributed systems)
+        """
         with self.db() as session:
             try:
-                user_permissions = [
-                    UserPermission(user_uuid=user_uuid, permission_uuid=permission_uuid)
+                # Use bulk_insert_mappings for better performance
+                user_permissions_data = [
+                    {"user_uuid": user_uuid, "permission_uuid": permission_uuid}
                     for permission_uuid in permission_uuids
                 ]
-                session.bulk_save_objects(user_permissions)
+                session.bulk_insert_mappings(UserPermission, user_permissions_data)
                 session.commit()
 
+                # Fetch permissions and build policies
                 permissions = session.query(Permission).filter(Permission.uuid.in_(permission_uuids)).all()
                 policies = [
                     [f"user:{user_uuid}", permission.resource, permission.action, permission.module]
                     for permission in permissions
                 ]
-                added_policies = self.enforcer.add_policies(policies)
-                if added_policies:
-                    self.enforcer.save_policy()
-                    self.enforcer.load_policy()
+
+                # Use context manager for optimized bulk operation
+                with self._bulk_operation_context():
+                    self.enforcer.add_policies(policies)
+
                 return self.get_user_only_permissions(user_uuid)
             except Exception as e:
                 raise e
 
     def revoke_user_permissions(self, user_uuid: str, permission_uuids: List[str]):
+        """
+        Revoke permissions from user (optimized for distributed systems)
+        """
         with self.db() as session:
             try:
                 user_permissions = session.query(UserPermission).filter(
@@ -269,16 +342,91 @@ class RBACService:
                     [f"user:{user_uuid}", permission.resource, permission.action, permission.module]
                     for permission in permissions
                 ]
-                removed_policies = self.enforcer.remove_policies(policies)
-                if removed_policies:
-                    self.enforcer.save_policy()
-                    self.enforcer.load_policy()
+                with self._bulk_operation_context():
+                    self.enforcer.remove_policies(policies)
+
                 user_permissions.delete(synchronize_session=False)
                 session.commit()
                 return self.get_user_only_permissions(user_uuid)
             except Exception as e:
                 raise e
-            
+
+    def revoke_all_user_access(self, user_uuid: str) -> dict:
+        """
+        Revoke all roles and permissions from a user in a single operation.
+        This is typically used when soft-deleting a user.
+
+        Args:
+            user_uuid: The UUID of the user to revoke all access from
+
+        Returns:
+            dict: Summary of revoked roles and permissions
+        """
+        with self.db() as session:
+            try:
+                if not session.is_active:
+                    session.begin()
+
+                # Get all user roles
+                user_roles = (
+                    session.query(UserRole)
+                    .options(joinedload(UserRole.role))
+                    .filter(UserRole.user_uuid == user_uuid)
+                    .all()
+                )
+
+                role_uuids = [ur.role.uuid for ur in user_roles] if user_roles else []
+
+                # Get all direct user permissions
+                user_permissions = (
+                    session.query(UserPermission)
+                    .options(joinedload(UserPermission.permission))
+                    .filter(UserPermission.user_uuid == user_uuid)
+                    .all()
+                )
+
+                permission_uuids = [up.permission.uuid for up in user_permissions] if user_permissions else []
+
+                # Revoke all roles
+                if role_uuids:
+                    session.query(UserRole).filter(
+                        UserRole.user_uuid == user_uuid,
+                        UserRole.role_uuid.in_(role_uuids)
+                    ).delete(synchronize_session=False)
+
+                # Revoke all direct permissions and remove from Casbin
+                if permission_uuids:
+                    permissions = session.query(Permission).filter(
+                        Permission.uuid.in_(permission_uuids)
+                    ).all()
+
+                    # Remove Casbin policies (optimized)
+                    policies = [
+                        [f"user:{user_uuid}", permission.resource, permission.action, permission.module]
+                        for permission in permissions
+                    ]
+                    with self._bulk_operation_context():
+                        self.enforcer.remove_policies(policies)
+
+                    # Delete from database
+                    session.query(UserPermission).filter(
+                        UserPermission.user_uuid == user_uuid,
+                        UserPermission.permission_uuid.in_(permission_uuids)
+                    ).delete(synchronize_session=False)
+
+                session.commit()
+
+                return {
+                    "user_uuid": user_uuid,
+                    "roles_revoked": len(role_uuids),
+                    "permissions_revoked": len(permission_uuids),
+                    "role_uuids": role_uuids,
+                    "permission_uuids": permission_uuids
+                }
+
+            except Exception as e:
+                raise e
+
     def list_roles(self) -> Any:
         """
         Get the list of all roles
@@ -362,13 +510,13 @@ class RBACService:
                     ]
                     session.bulk_insert_mappings(RolePermission, role_permissions)
 
-                    # Batch add Casbin policies
+                    # Batch add Casbin policies (optimized)
                     policies = [
                         [role.uuid, permission.resource, permission.action, permission.module]
                         for permission in existing_permissions
                     ]
-                    self.enforcer.add_policies(policies)
-                    self.enforcer.save_policy()
+                    with self._bulk_operation_context():
+                        self.enforcer.add_policies(policies)
 
                 # Commit transaction
                 session.commit()
@@ -392,7 +540,7 @@ class RBACService:
             if not role:
                 raise NotFoundError(detail="Requested role does not exist")
                 
-            return role
+            return role    
 
     def update_role_permissions(
         self,
@@ -402,6 +550,7 @@ class RBACService:
         description: Optional[str] = None,
     ) -> Any:
         """Update role permissions by replacing all existing permissions with new ones"""
+
         with self.db() as session:
             try:
                 if not session.is_active:
@@ -438,50 +587,45 @@ class RBACService:
                         role.description = description
 
                 if permissions is not None:
-                    existing_permissions = role.permissions
-
-                    # Remove Casbin policies for existing permissions
-                    remove_policies = [
-                        [role_uuid, existing_permission.resource, existing_permission.action, existing_permission.module]
-                        for existing_permission in existing_permissions
-                    ]
-                    self.enforcer.remove_policies(remove_policies)
-                    self.enforcer.save_policy()
-
-                    # Delete existing role permissions
-                    session.query(RolePermission).filter(
-                        RolePermission.role_uuid == role_uuid
-                    ).delete(synchronize_session=False)
-
-                if permissions:
-                    # Fetch all permissions in a single query
-                    permissions_objs = (
-                        session.query(Permission)
-                        .filter(Permission.uuid.in_(permissions))
-                        .all()
-                    )
-
-                    found_permission_ids = {p.uuid for p in permissions_objs}
-                    missing_permission_ids = set(permissions) - found_permission_ids
-                    if missing_permission_ids:
-                        raise NotFoundError(
-                            detail=f"Permissions with UUIDs '{', '.join(missing_permission_ids)}' not found"
-                        )
-
-                    # Bulk insert role permissions
-                    role_permissions = [
-                        {"role_uuid": role_uuid, "permission_uuid": permission.uuid}
-                        for permission in permissions_objs
-                    ]
-                    session.bulk_insert_mappings(RolePermission, role_permissions)
-
-                    # Add Casbin policies
-                    policies = [
-                        [role_uuid, permission.resource, permission.action, permission.module]
-                        for permission in permissions_objs
-                    ]
-                    self.enforcer.add_policies(policies)
-                    self.enforcer.save_policy()
+                    # Update permissions with optimized Casbin operations
+                    with self._bulk_operation_context():
+                        # Remove ALL existing policies for this role from Casbin
+                        self.enforcer.remove_filtered_policy(0, str(role_uuid))
+
+                        # Delete existing role permissions from database
+                        session.query(RolePermission).filter(
+                            RolePermission.role_uuid == role_uuid
+                        ).delete(synchronize_session=False)
+
+                        # Add new permissions if provided
+                        if permissions:
+                            # Fetch all permissions in a single query
+                            permissions_objs = (
+                                session.query(Permission)
+                                .filter(Permission.uuid.in_(permissions))
+                                .all()
+                            )
+
+                            found_permission_ids = {p.uuid for p in permissions_objs}
+                            missing_permission_ids = set(permissions) - found_permission_ids
+                            if missing_permission_ids:
+                                raise NotFoundError(
+                                    detail=f"Permissions with UUIDs '{', '.join(missing_permission_ids)}' not found"
+                                )
+
+                            # Bulk insert role permissions
+                            role_permissions = [
+                                {"role_uuid": role_uuid, "permission_uuid": permission.uuid}
+                                for permission in permissions_objs
+                            ]
+                            session.bulk_insert_mappings(RolePermission, role_permissions)
+
+                            # Add new Casbin policies
+                            policies = [
+                                [role_uuid, permission.resource, permission.action, permission.module]
+                                for permission in permissions_objs
+                            ]
+                            self.enforcer.add_policies(policies)
 
                 session.commit()
 
@@ -519,12 +663,11 @@ class RBACService:
                     [role.uuid, permission.resource, permission.action, permission.module]
                     for permission in role.permissions
                 ]
-                
-                # Remove all policies at once
-                if remove_policies:
 
-                    self.enforcer.remove_policies(remove_policies)
-                    self.enforcer.save_policy()
+                # Remove all policies at once (optimized)
+                if remove_policies:
+                    with self._bulk_operation_context():
+                        self.enforcer.remove_policies(remove_policies)
 
                 # Delete role (cascade will handle role_permissions and user_roles)
                 session.delete(role)
@@ -645,13 +788,13 @@ class RBACService:
                     )
                 ).delete(synchronize_session=False)
 
-                # Remove Casbin policies
+                # Remove Casbin policies (optimized)
                 policies_to_remove = [
                     [role.uuid, permission.resource, permission.action, permission.module]
                     for permission in permissions_to_revoke
                 ]
-                self.enforcer.remove_policies(policies_to_remove)
-                self.enforcer.save_policy()
+                with self._bulk_operation_context():
+                    self.enforcer.remove_policies(policies_to_remove)
                 
                 session.commit()
 
@@ -713,13 +856,13 @@ class RBACService:
                 ]
                 session.bulk_insert_mappings(RolePermission, role_permissions)
 
-                # Add Casbin policies
+                # Add Casbin policies (optimized)
                 policies_to_add = [
                     [role.uuid, permission.resource, permission.action, permission.module]
                     for permission in new_permissions
                 ]
-                self.enforcer.add_policies(policies_to_add)
-                self.enforcer.save_policy()
+                with self._bulk_operation_context():
+                    self.enforcer.add_policies(policies_to_add)
 
                 session.commit()
 

abs_auth_rbac_core/repository/__init__.py

@@ -0,0 +1,4 @@
+from .role_repository import RoleRepository
+from .permission_repository import PermissionRepository
+
+__all__ = ["RoleRepository", "PermissionRepository"]

abs_auth_rbac_core/repository/permission_repository.py

@@ -0,0 +1,12 @@
+from typing import Any, List, Optional, Callable
+from sqlalchemy.orm import joinedload
+from contextlib import AbstractContextManager
+from sqlalchemy.orm import Session
+from abs_repository_core.repository.base_repository import BaseRepository
+from abs_repository_core.schemas.base_schema import FindBase, FindUniqueValues
+from abs_auth_rbac_core.models.permissions import Permission
+
+class PermissionRepository(BaseRepository):
+    def __init__(self, db: Callable[..., Session]):
+        self.db = db
+        super().__init__(db, Permission)

abs_auth_rbac_core/repository/role_repository.py

@@ -0,0 +1,18 @@
+from typing import Any, List, Optional, Callable
+from sqlalchemy.orm import joinedload
+from contextlib import AbstractContextManager
+from sqlalchemy.orm import Session
+from abs_repository_core.repository.base_repository import BaseRepository
+from abs_auth_rbac_core.models.roles import Role
+from abs_exception_core.exceptions import NotFoundError
+from abs_repository_core.schemas import FilterSchema, FindBase
+
+
+class RoleRepository(BaseRepository):
+    def __init__(self, db: Callable[..., Session]):
+        self.db = db
+        super().__init__(db, Role)
+
+
+
+

abs_auth_rbac_core/service/__init__.py

@@ -0,0 +1,4 @@
+from .role_service import RoleService
+from .permission_service import PermissionService
+
+__all__ = ["RoleService", "PermissionService"]

abs_auth_rbac_core/service/permission_service.py

@@ -0,0 +1,15 @@
+from typing import Any, List, Optional
+from abs_repository_core.services.base_service import BaseService
+from abs_repository_core.schemas.base_schema import FindBase, FindUniqueValues
+from abs_auth_rbac_core.models.roles import Role
+from abs_auth_rbac_core.repository.permission_repository import PermissionRepository
+from pydantic import BaseModel
+
+
+class PermissionService(BaseService):
+    def __init__(self, repository:PermissionRepository):
+        super().__init__(repository)
+        self.repository = repository
+        
+    def list_permissions(self, schema: FindBase, eager: bool = True):
+        return self.repository.read_by_options(schema, eager)

abs_auth_rbac_core/service/role_service.py

@@ -0,0 +1,18 @@
+from typing import Any, List, Optional
+from abs_repository_core.services.base_service import BaseService
+from abs_repository_core.schemas.base_schema import FindBase, FindUniqueValues
+from abs_auth_rbac_core.models.roles import Role
+from abs_auth_rbac_core.repository.role_repository import RoleRepository
+from pydantic import BaseModel
+
+
+class RoleService(BaseService):
+    def __init__(self, repository:RoleRepository):
+        self.repository = repository
+        super().__init__(repository)
+
+
+    def list_roles(self, schema: FindBase, eager: bool = True):
+        return self.repository.read_by_options(schema, eager)
+    
+    

abs_auth_rbac_core/util/permission_constants.py

@@ -153,6 +153,11 @@ class PermissionAction(str, Enum):
     VIEW_IMPORT_DATA = "VIEW_IMPORT_DATA"
     VIEW_WORKFLOW = "VIEW_WORKFLOW"
     VIEW_ERROR_DATA = "VIEW_ERROR_DATA"
+    VIEW_ENTITY_RECORD = "VIEW_ENTITY_RECORD"
+    EDIT_ENTITY_RECORD = "EDIT_ENTITY_RECORD"
+    DELETE_ENTITY_RECORD = "DELETE_ENTITY_RECORD"
+    CREATE_ENTITY_RECORD = "CREATE_ENTITY_RECORD"
+    CREATE_ENTITY_VIEW = "CREATE_ENTITY_VIEW"
 
 
 
@@ -172,12 +177,18 @@ class PermissionModule(str, Enum):
     ASL = "ASL"
     EDS = "EDS"
     WORKFORCE_AGENT = "WORKFORCE_AGENT"
-
+    ENTITY = "ENTITY"
+    ENTITY_VIEW = "ENTITY_VIEW"
+    ENTITY_RECORD = "ENTITY_RECORD"
+    CHATBOT = "CHATBOT"
+    APPS = "APPS"
 
 
 class PermissionResource(str, Enum):
+    ENTITIES = "ENTITIES"
     DASHBOARD = "DASHBOARDS"
     WORKFORCE_AGENT = "WORKFORCE_AGENT"
+    CHATBOT = "CHATBOT"
     EPAR = "EPAR"
     EPARS = "EPARS"
     OCFO = "OCFO"
@@ -262,6 +273,7 @@ class PermissionResource(str, Enum):
     AUTOMATION_ACTION = "AUTOMATION_ACTION"
     AUTOMATION_INPUT = "AUTOMATION_INPUT"
     AUTOMATION_HISTORY = "AUTOMATION_HISTORY"
+    USER_PROFILE = "USER_PROFILE"
 
 
 class PermissionData(NamedTuple):
@@ -273,6 +285,22 @@ class PermissionData(NamedTuple):
 
 
 class PermissionConstants:
+    # User Profile Permissions
+    USER_PROFILE_VIEW = PermissionData(
+        name="View User Profile",
+        description="Permission to view user profile",
+        module=PermissionModule.USER_MANAGEMENT,
+        resource=PermissionResource.USER_PROFILE,
+        action=PermissionAction.VIEW,
+    )
+    USER_PROFILE_EDIT = PermissionData(
+        name="Edit User Profile",
+        description="Permission to edit user profile",
+        module=PermissionModule.USER_MANAGEMENT,
+        resource=PermissionResource.USER_PROFILE,
+        action=PermissionAction.EDIT,
+    )
+
     # Automation Builder Permissions
     AUTOMATION_HISTORY_VIEW = PermissionData(
         name="View Automation History",

{abs_auth_rbac_core-0.3.2.dist-info → abs_auth_rbac_core-0.3.18.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: abs-auth-rbac-core
-Version: 0.3.2
+Version: 0.3.18
 Summary: RBAC and Auth core utilities including JWT token management.
 License: MIT
 Author: AutoBridgeSystems
@@ -11,12 +11,14 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
-Requires-Dist: abs-exception-core (>=0.2.0,<0.3.0)
-Requires-Dist: abs-utils (>=0.4.1,<0.5.0)
+Requires-Dist: abs-exception-core (>=0.2.2,<0.3.0)
+Requires-Dist: abs-nosql-repository-core (>=0.11.8,<0.12.0)
+Requires-Dist: abs-repository-core (>=0.3.0,<0.4.0)
+Requires-Dist: abs-utils (>=0.4.3,<0.5.0)
 Requires-Dist: casbin (>=1.41.0,<2.0.0)
 Requires-Dist: casbin-redis-watcher (>=1.3.0,<2.0.0)
 Requires-Dist: casbin-sqlalchemy-adapter (>=1.4.0,<2.0.0)
-Requires-Dist: fastapi[standard] (>=0.115.12,<0.116.0)
+Requires-Dist: fastapi[standard] (>=0.115.2)
 Requires-Dist: passlib (>=1.7.4,<2.0.0)
 Requires-Dist: psycopg2-binary (>=2.9.10,<3.0.0)
 Requires-Dist: pyjwt (>=2.10.1,<3.0.0)

{abs_auth_rbac_core-0.3.2.dist-info → abs_auth_rbac_core-0.3.18.dist-info}/RECORD

@@ -1,8 +1,8 @@
 abs_auth_rbac_core/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-abs_auth_rbac_core/auth/__init__.py,sha256=Pvetd98VD9jsok1F9e82yS9kLZMFqTpbN51hkxZQHzw,67
-abs_auth_rbac_core/auth/auth_functions.py,sha256=fhfKRhtpE_J9MHu2jSsIA-cy77A3wCAQKbGGZeh4pe4,947
+abs_auth_rbac_core/auth/__init__.py,sha256=5PUd5wjIVgdfoD8Zce2uOOE8TtBUhznVHPVwWaiw_9A,312
+abs_auth_rbac_core/auth/auth_functions.py,sha256=p9sOExXOUDXHaP4dccraJ6Xv3RZu2dH4AtRv22yPKXU,1054
 abs_auth_rbac_core/auth/jwt_functions.py,sha256=9vhjWrxXdE8fVQ4FGrPj9y6PoSEsaeFohPhgI-3hToI,4111
-abs_auth_rbac_core/auth/middleware.py,sha256=sAHhPiSSiS1iqSl8-thsaZXRK4EQLFJ08BKzKPpgmmQ,2965
+abs_auth_rbac_core/auth/middleware.py,sha256=09gpOdvfgV8QsFEQO46QIRgtTy9-0kPRCVob6RJeE1U,8897
 abs_auth_rbac_core/models/__init__.py,sha256=9ImboxQ04XxRjd5o1RDBn465BOj3F2pahuVXF15NuqE,292
 abs_auth_rbac_core/models/base_model.py,sha256=AaWObslm8sTetv4H1Ia_gPpi_75uF5z1o7Et9WAvstU,612
 abs_auth_rbac_core/models/gov_casbin_rule.py,sha256=9PpCQWg6TWeBvgjRcC2VxSSFMkNW-B9a4e2LmmDmmiY,1000
@@ -11,17 +11,23 @@ abs_auth_rbac_core/models/rbac_model.py,sha256=GbgMA-lJoU__xYP7wCw2FB9P1ftMzRAU2
 abs_auth_rbac_core/models/role_permission.py,sha256=KQ7MGwFvHhXgWL73TGH_elfG0rTLj5Ct11EWi6ypNb8,414
 abs_auth_rbac_core/models/roles.py,sha256=3g52YoCAnVdId4iaQa6Jz1NUTnaZTM_i_4oGF-FneA0,657
 abs_auth_rbac_core/models/seeder/permission_seeder.py,sha256=j-aUy8uLHnUWpMmw1DqXq8yJcqWxQo-D5QjY1S-ifyA,3652
-abs_auth_rbac_core/models/user.py,sha256=rLsK-Qy4AUbnfGUchr9hOPmdzaNcZ8whZpL9V4LU-AI,990
+abs_auth_rbac_core/models/user.py,sha256=rlNXyQ22GKwrg4nIKhpyH-arDIgLOovZr0ZTQNjkLco,1064
 abs_auth_rbac_core/models/user_permission.py,sha256=t1_VUSFyyZAfJK71liDkFkg51yCshCbuRMG9rxFyOro,600
 abs_auth_rbac_core/models/user_role.py,sha256=20pqmtJPzlUrI9ulHGouk8XlFgrGG7I6ikctb8sMUGs,706
 abs_auth_rbac_core/rbac/__init__.py,sha256=oYjtpmfrkEbwWCBAWuRoU1fM4fCpBxkF_lwQrelK1As,79
 abs_auth_rbac_core/rbac/decorator.py,sha256=pEFAW0Nn2iE4KBctPhNOmO_VLeJFDX2V9v2LsCu6kHY,1824
 abs_auth_rbac_core/rbac/policy.conf,sha256=wghhhKxgZH0rPhh1QFrIpq9nevJT3s7OxxvXiU3zzuI,305
-abs_auth_rbac_core/rbac/service.py,sha256=A0Mg6HFUKzRo2pksOJGu-t_QztaB20ZECc5FfIQ8IDU,38447
+abs_auth_rbac_core/rbac/service.py,sha256=rztdSP0wZ-uSv4ASzvxuoHoz3Yng2sYAXSHo-j_-18s,44315
+abs_auth_rbac_core/repository/__init__.py,sha256=tuEdEV5HsePiaEg2Jrakf-QOR3evTeS-2Tq5VqbywyU,154
+abs_auth_rbac_core/repository/permission_repository.py,sha256=SQJyyErrrMnTnLJjhwZythPbYVGt5z0N5GJ5fV6Gvuo,541
+abs_auth_rbac_core/repository/role_repository.py,sha256=OEPpWIm_61rOljPEcejqXyOvowYDK8Uh5K_pvRLfb3Y,562
 abs_auth_rbac_core/schema/__init__.py,sha256=v9xibJ8Wr9k0u6PEYNK0LCGUJD71SB5vxu9BZG0S7tM,46
 abs_auth_rbac_core/schema/permission.py,sha256=XvxPU68FY0PFgkF4GR2bSrzNvFB8c8OgY_d0JOJvMc8,203
+abs_auth_rbac_core/service/__init__.py,sha256=zzzxVCUYYb4heFksjbktWqbST3IcTcTfOMWWC-L5_A0,136
+abs_auth_rbac_core/service/permission_service.py,sha256=tWasmKe0lr1QokmKzjD08O251_ppTnfN9amqVZX_CCU,661
+abs_auth_rbac_core/service/role_service.py,sha256=Q68igKS-cArHaq-tqrjWPpptnrXYImRAEwKQep0ZOBQ,633
 abs_auth_rbac_core/util/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-abs_auth_rbac_core/util/permission_constants.py,sha256=EHM4ZkQmMWR-AyoSEf-pJL-EC_eZ4Q_JEp9w62GknHY,102747
-abs_auth_rbac_core-0.3.2.dist-info/METADATA,sha256=7q_MiRXEV0O829MFDvvqk0GMpa8ym0nvdGPASQ1_8Ys,23591
-abs_auth_rbac_core-0.3.2.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
-abs_auth_rbac_core-0.3.2.dist-info/RECORD,,
+abs_auth_rbac_core/util/permission_constants.py,sha256=P7r6uW6f9YsuxSSsk_oRVN4YqD2CdYvfgnjEmID3czU,103776
+abs_auth_rbac_core-0.3.18.dist-info/METADATA,sha256=5NYRBQI6vSXcu1c7KZl__Q2xgXNFQDyG5mJ7DbPFOzM,23694
+abs_auth_rbac_core-0.3.18.dist-info/WHEEL,sha256=fGIA9gx4Qxk2KDKeNJCbOEwSrmLtjWCwzBz351GyrPQ,88
+abs_auth_rbac_core-0.3.18.dist-info/RECORD,,

{abs_auth_rbac_core-0.3.2.dist-info → abs_auth_rbac_core-0.3.18.dist-info}/WHEEL

@@ -1,4 +1,4 @@
 Wheel-Version: 1.0
-Generator: poetry-core 2.1.3
+Generator: poetry-core 2.1.2
 Root-Is-Purelib: true
 Tag: py3-none-any