atraxis 1.0.2__py3-none-any.whl

atraxis/__init__.py

@@ -0,0 +1 @@
+"""Private Atraxis prototype: read-only observations."""

atraxis/__main__.py

@@ -0,0 +1,3 @@
+from atraxis.cli import main
+
+raise SystemExit(main())

atraxis/account_admin.py

@@ -0,0 +1,140 @@
+"""Trusted identity mapping and shared administration service for web/CLI/Textual."""
+import hashlib
+import json
+import os
+from pathlib import Path
+import uuid
+
+import yaml
+
+from atraxis.accounts import AccountError, Directory, identifier
+from atraxis.account_store import AccountStore
+from atraxis.account_storage import storage_config
+from atraxis.account_delegation import checked_request, propose, view
+from atraxis.config import _StrictLoader
+from atraxis.rule_files import read_private
+
+MAX_PROFILE_BYTES = 65536
+
+
+def load_admin_profile(path):
+    try:
+        raw = read_private(path,MAX_PROFILE_BYTES)
+        data = yaml.load(raw,Loader=_StrictLoader)
+        if (type(data) is not dict or set(data) != {'version','store','identities'}
+                or type(data['version']) is not int or data['version'] != 1
+                or type(data['identities']) is not list
+                or not 1 <= len(data['identities']) <= 128):
+            raise ValueError()
+        seen=set()
+        for entry in data['identities']:
+            if type(entry) is not dict or set(entry) not in ({'username','subject'},{'uid','subject'}) or not identifier(entry['subject']):
+                raise ValueError()
+            key = 'username' if 'username' in entry else 'uid'
+            value=entry[key]
+            if (key=='username' and not identifier(value) or key=='uid' and (type(value) is not int or value<0)
+                    or (key,value) in seen):
+                raise ValueError()
+            seen.add((key,value))
+        destination=storage_config(data['store'], Path(path).absolute().parent)
+        return data['identities'],destination,hashlib.sha256(raw).hexdigest()
+    except (OSError,ValueError,TypeError,KeyError,RecursionError,yaml.YAMLError):
+        raise AccountError('invalid_account_admin_profile') from None
+
+
+class AccountAdmin:
+    def __init__(self,path,username=None):
+        self.path=Path(path).absolute()
+        self.web=username is not None
+        self.username=username if self.web else 'uid:'+str(os.getuid())
+        self.initial=self.entry()
+
+    def entry(self):
+        entries,path,digest=load_admin_profile(self.path)
+        key,value=('username',self.username) if self.web else ('uid',os.getuid())
+        matches=[entry for entry in entries if entry.get(key)==value]
+        if len(matches)!=1:raise PermissionError('account_admin_not_mapped')
+        result={'subject':matches[0]['subject'],'store':path,'profile':digest}
+        if hasattr(self,'initial') and result!=self.initial:
+            raise PermissionError('account_admin_identity_changed')
+        return result
+
+    def inspect(self):
+        entry=self.entry();store=AccountStore(entry['store']);snapshot=store.snapshot(audit=False)
+        result={'revision':snapshot['revision'],'subject':entry['subject'],
+                'organizations':view(Directory(snapshot['directory']),entry['subject'])}
+        from atraxis.account_entities import view as entity_view
+        result.update(entity_view(Directory(snapshot['directory']), entry['subject']))
+        if store.revision()!=snapshot['revision']:raise PermissionError('account_administration_changed')
+        self.entry()
+        if not result['organizations'] and not result['entity_grants']:raise PermissionError('account_administration_denied')
+        return result
+
+    def search(self,query):
+        entry = self.entry()
+        store = AccountStore(entry['store'])
+        result = store.search(entry['subject'],query)
+        self.entry()
+        if store.revision() != result['revision']:
+            raise PermissionError('account_search_access_changed')
+        self.entry()
+        return result
+
+    def prepare(self,request,expected_revision):
+        entry=self.entry();snapshot=AccountStore(entry['store']).snapshot(audit=False)
+        if snapshot['revision']!=expected_revision:raise AccountError('account_revision_conflict')
+        request=checked_request(request);created_id=uuid.uuid4().hex
+        _,audit=propose(Directory(snapshot['directory']),entry['subject'],request,new_id=created_id)
+        self.entry()
+        return {'request':request,'revision':snapshot['revision'],'identity':entry,'created_id':created_id,'audit':audit}
+
+    def commit(self,plan):
+        entry=self.entry()
+        if plan['identity']!=entry:raise PermissionError('account_admin_identity_changed')
+        store=AccountStore(entry['store']);snapshot=store.snapshot(audit=False)
+        if snapshot['revision']!=plan['revision']:raise AccountError('account_revision_conflict')
+        candidate,audit=propose(Directory(snapshot['directory']),entry['subject'],plan['request'],new_id=plan['created_id'])
+        def authorize(current,proposed):
+            self.entry()  # Current identity and delegation under the snapshot writer lock.
+            checked,metadata=propose(current,entry['subject'],plan['request'],new_id=plan['created_id'])
+            if checked.document()!=proposed.document() or metadata!=audit:
+                raise PermissionError('account_administration_changed')
+        return store.apply(candidate,plan['revision'],authorize=authorize,actor=audit)
+
+
+def request_from_fields(fields):
+    """Finite form contract shared by web and terminal; no identity/grant overrides."""
+    operation=fields.get('operation')
+    from atraxis.account_entities import OPERATIONS as ENTITY_OPERATIONS, DELEGATE_OPERATIONS, checked_request as entity_request
+    from atraxis.account_forms import FIELDS
+    if operation in ENTITY_OPERATIONS | DELEGATE_OPERATIONS:
+        if set(fields) != {'operation'} | {field[0] for field in FIELDS[operation]}:
+            raise AccountError('invalid_account_form')
+        values = {key:value for key,value in fields.items() if key!='operation'}
+        for key in ('enabled','inherit_parent','delegable'):
+            if key in values:
+                if values[key] not in ('yes','no'): raise AccountError('invalid_account_form')
+                values[key] = values[key]=='yes'
+        if operation in ENTITY_OPERATIONS:
+            if 'parent' in values: values['parent'] = values['parent'] or None
+            return entity_request(dict(operation=operation,entity=values))
+        if operation == 'entity_delegation.create':
+            values['scope'] = dict(kind=values.pop('scope_kind'),id=values.pop('scope_id') or None)
+            values['operations'] = [value.strip() for value in values['operations'].split(',') if value.strip()]
+        return entity_request(dict(values, operation=operation))
+    if operation in ('membership.add','membership.remove'):
+        if set(fields)!={'operation','organization','subject','group'}:raise AccountError('invalid_account_form')
+        return checked_request(dict(operation=operation,organization=fields['organization'],subject=fields['subject'],group=fields['group'] or None))
+    if operation=='delegation.revoke':
+        if set(fields)!={'operation','grant'}:raise AccountError('invalid_account_form')
+        return checked_request(fields)
+    if operation=='delegation.create':
+        if set(fields)!={'operation','parent','subject','groups','operations','organization_membership','delegable'}:
+            raise AccountError('invalid_account_form')
+        if fields['organization_membership'] not in ('yes','no') or fields['delegable'] not in ('yes','no'):
+            raise AccountError('invalid_account_form')
+        return checked_request(dict(operation=operation,parent=fields['parent'],subject=fields['subject'],
+            groups=[g.strip() for g in fields['groups'].split(',') if g.strip()],
+            operations=[o.strip() for o in fields['operations'].split(',') if o.strip()],
+            organization_membership=fields['organization_membership']=='yes',delegable=fields['delegable']=='yes'))
+    raise AccountError('invalid_account_form')

atraxis/account_admin_commands.py

@@ -0,0 +1,56 @@
+"""Scoped administration commands. The OS mapping supplies the acting subject."""
+import json
+import sys
+import yaml
+from atraxis.account_admin import AccountAdmin
+from atraxis.account_delegation import checked_request
+from atraxis.config import _StrictLoader
+from atraxis.rule_files import read_private
+
+MAX_REQUEST_BYTES = 32768
+
+
+def add_parser(commands):
+    parser=commands.add_parser('accounts-admin',help='scoped account administration')
+    parser.add_argument('--config',required=True)
+    actions=parser.add_subparsers(dest='admin_command',required=True)
+    actions.add_parser('show');actions.add_parser('tui')
+    search=actions.add_parser('search',help='search the complete authorized account scope')
+    search.add_argument('-q','--query',default='')
+    search.add_argument('--kind',choices=('all','tenant','user','group','organization'),default='all')
+    search.add_argument('-o','--organization',default='')
+    search.add_argument('--page',type=int,default=1);search.add_argument('--limit',type=int,default=50)
+    search.add_argument('--tui',action='store_true')
+    for name in ('check','apply'):
+        command=actions.add_parser(name);command.add_argument('--file',required=True)
+        if name=='apply':
+            command.add_argument('--expected-revision',required=True)
+            command.add_argument('--confirm',required=True,action='store_true')
+
+
+def main(options):
+    try:
+        admin=AccountAdmin(options.config)
+        if options.admin_command=='search':
+            from atraxis.account_search import AccountQuery
+            query=AccountQuery(q=options.query,kind=options.kind,organization=options.organization,page=options.page,limit=options.limit)
+            if options.tui:
+                from atraxis.account_search_textual import run
+                return run(admin,query)
+            print(json.dumps(admin.search(query),indent=2));return 0
+        if options.admin_command=='tui':
+            from atraxis.account_textual import run
+            return run(admin)
+        data=admin.inspect()
+        if options.admin_command=='show':result=data
+        else:
+            request=checked_request(yaml.load(read_private(options.file,MAX_REQUEST_BYTES),Loader=_StrictLoader))
+            revision=options.expected_revision if options.admin_command=='apply' else data['revision']
+            plan=admin.prepare(request,revision)
+            result=({'revision':admin.commit(plan)} if options.admin_command=='apply' else
+                    {'revision':plan['revision'],'request':plan['request'],'actor':plan['audit']})
+        print(json.dumps(result,indent=2));return 0
+    except PermissionError:
+        print('Account administration denied.',file=sys.stderr);return 3
+    except Exception:
+        print('Account operation unconfirmed. Check the current directory before retrying.',file=sys.stderr);return 2

atraxis/account_backup.py

@@ -0,0 +1,128 @@
+"""Trusted-host, data-only account backups and fresh SQLite restoration."""
+import hashlib
+import json
+import os
+from pathlib import Path
+import stat
+import tempfile
+
+from atraxis.accounts import AccountError
+from atraxis.account_storage import storage_config, open_storage
+from atraxis.account_store import AccountStore
+from atraxis.account_sqlite import SQLiteTransaction
+from atraxis.account_lock import private_lock
+from atraxis.rule_files import read_private
+
+FORMAT = 1
+MAX_BYTES = 32 * 1024 * 1024
+MAX_AUDIT_ROWS = 100000
+FIELDS = frozenset({'version', 'backend', 'snapshot'})
+
+
+def canonical(value):
+    return json.dumps(value, sort_keys=True, separators=(',', ':'), allow_nan=False).encode()
+
+
+def parent_private(path):
+    metadata = path.parent.lstat()
+    if (not stat.S_ISDIR(metadata.st_mode) or metadata.st_uid != os.getuid()
+            or stat.S_IMODE(metadata.st_mode) & 0o077):
+        raise AccountError('backup_requires_private_directory')
+
+
+def sync_directory(path):
+    fd = os.open(path.parent, os.O_RDONLY | os.O_DIRECTORY)
+    try: os.fsync(fd)
+    finally: os.close(fd)
+
+
+def summary(payload):
+    snapshot = payload['snapshot']
+    return dict(version=FORMAT, backend='sqlite', revision=snapshot['revision'],
+                audit_entries=len(snapshot['audit']), sha256=hashlib.sha256(canonical(payload)).hexdigest())
+
+
+def checked(payload):
+    if (type(payload) is not dict or set(payload) != FIELDS
+            or type(payload['version']) is not int or payload['version'] != FORMAT
+            or payload['backend'] != 'sqlite'):
+        raise AccountError('invalid_account_backup')
+    AccountStore._decode(payload['snapshot'])
+    if len(payload['snapshot']['audit']) > MAX_AUDIT_ROWS:
+        raise AccountError('account_backup_limit_exceeded')
+    return payload
+
+
+def read_backup(path):
+    return decode_backup(read_private(path, MAX_BYTES))
+
+
+def decode_backup(raw):
+    if len(raw) > MAX_BYTES: raise AccountError('account_backup_limit_exceeded')
+    outer = json.loads(raw)
+    if (type(outer) is not dict or set(outer) != {'sha256', 'payload'}
+            or outer['sha256'] != hashlib.sha256(canonical(outer['payload'])).hexdigest()):
+        raise AccountError('account_backup_integrity_failed')
+    return checked(outer['payload'])
+
+
+def sqlite_adapter(config):
+    config = storage_config(config)
+    if config['backend'] != 'sqlite': raise AccountError('unsupported_account_backup_backend')
+    return open_storage(config)
+
+
+def backup(config, output):
+    adapter = sqlite_adapter(config)
+    # One read snapshot includes directory, all audit and the membership projection.
+    with adapter._connect() as connection:
+        connection.execute('BEGIN'); adapter._schema(connection, False)
+        if connection.execute('SELECT COUNT(*) FROM account_audit').fetchone()[0] > MAX_AUDIT_ROWS:
+            raise AccountError('account_backup_limit_exceeded')
+        snapshot = AccountStore._decode(SQLiteTransaction(connection).read())
+    payload = checked(dict(version=FORMAT, backend='sqlite', snapshot=snapshot))
+    raw = canonical(dict(payload=payload, sha256=hashlib.sha256(canonical(payload)).hexdigest()))
+    if len(raw) > MAX_BYTES: raise AccountError('account_backup_limit_exceeded')
+    path = Path(output); parent_private(path)
+    fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600)
+    try:
+        with os.fdopen(fd, 'wb') as stream:
+            stream.write(raw); stream.flush(); os.fsync(stream.fileno())
+    except BaseException:
+        path.unlink()
+        raise
+    sync_directory(path)
+    return summary(payload)
+
+
+def restore(config, archive, *, services_stopped=False):
+    if services_stopped is not True: raise AccountError('services_stop_confirmation_required')
+    adapter = sqlite_adapter(config)
+    payload = read_backup(archive)
+    path = adapter.path; parent_private(path)
+    with private_lock(path):
+        if any(os.path.lexists(str(path) + suffix) for suffix in ('', '-wal', '-shm', '-journal')):
+            raise AccountError('account_restore_requires_new_database')
+        fd, temporary = tempfile.mkstemp(prefix='.account-restore-', suffix='.db', dir=path.parent)
+        os.close(fd)
+        temporary = Path(temporary)
+        try:
+            target = sqlite_adapter(str(temporary))
+            data = payload['snapshot']
+            with target.transaction(initialize=True) as transaction:
+                for event in data['audit'][:-1]: transaction.append_audit(event)
+                transaction.write(data)
+                if AccountStore._decode(transaction.read()) != data:
+                    raise AccountError('account_restore_validation_failed')
+                if transaction.connection.execute('PRAGMA foreign_key_check').fetchone() is not None:
+                    raise AccountError('account_restore_validation_failed')
+            # Publish only a complete, closed database; never overwrite a destination.
+            with temporary.open('rb') as stream: os.fsync(stream.fileno())
+            os.link(temporary, path)
+            temporary.unlink()
+            sync_directory(path)
+        finally:
+            for suffix in ('', '.lock', '-wal', '-shm', '-journal'):
+                candidate = Path(str(temporary) + suffix)
+                if candidate.exists(): candidate.unlink()
+    return summary(payload)

atraxis/account_commands.py

@@ -0,0 +1,98 @@
+"""Explicit, local account administration using trusted POSIX file ownership."""
+import json
+import sys
+from pathlib import Path
+
+import yaml
+
+from atraxis.config import _StrictLoader
+from atraxis.rule_files import read_private
+from atraxis.account_storage import storage_config
+from atraxis.accounts import AccountError, Directory, default_directory
+from atraxis.account_store import AccountStore, load_candidate
+
+MAX_STORAGE_CONFIG_BYTES = 65536
+
+
+def add_parser(commands):
+    parser = commands.add_parser('accounts', help='local private account directory administration')
+    location = parser.add_mutually_exclusive_group(required=True)
+    location.add_argument('--store', help='storage URL or SQLite path')
+    location.add_argument('--storage-config', help='private backend/url/options YAML file')
+    parser.add_argument('--backend', help='installed account storage backend (with --store)')
+    actions = parser.add_subparsers(dest='account_command', required=True)
+    init = actions.add_parser('init')
+    init.add_argument('--subject', required=True)
+    init.add_argument('--administrator', action='store_true', help='explicit local bootstrap of global account administration')
+    actions.add_parser('show')
+    actions.add_parser('audit')
+    actions.add_parser('export')
+    backup = actions.add_parser('backup', help='write a private complete SQLite account archive')
+    backup.add_argument('--output', required=True)
+    restore = actions.add_parser('restore', help='restore into a new SQLite database with services stopped')
+    restore.add_argument('--input', required=True)
+    restore.add_argument('--confirm-services-stopped', action='store_true')
+    contexts = actions.add_parser('contexts')
+    contexts.add_argument('--subject', required=True)
+    for name in ('check', 'apply'):
+        action = actions.add_parser(name)
+        action.add_argument('--file', required=True)
+        if name == 'apply':
+            action.add_argument('--expected-revision', required=True)
+            action.add_argument('--confirm', action='store_true', required=True)
+
+
+def main(options):
+    try:
+        if options.storage_config:
+            if options.backend is not None:
+                raise AccountError('invalid_account_storage')
+            path = Path(options.storage_config).absolute()
+            config = storage_config(yaml.load(read_private(path, MAX_STORAGE_CONFIG_BYTES), Loader=_StrictLoader), path.parent)
+        else:
+            config = {'backend': options.backend or 'sqlite', 'url': options.store}
+        store = AccountStore(config)
+        command = options.account_command
+        if command in ('backup', 'restore'):
+            from atraxis.account_backup import backup, restore
+            result = (backup(config, options.output) if command == 'backup' else
+                      restore(config, options.input, services_stopped=options.confirm_services_stopped))
+        elif command == 'init':
+            directory = default_directory(options.subject)
+            if options.administrator:
+                from atraxis.account_entities import GRANT_OPERATIONS
+                document = directory.document()
+                document['entity_delegations'].append(dict(id='root-entities',subject=options.subject,scope=dict(kind='global',id=None),
+                    operations=sorted(GRANT_OPERATIONS),parent=None,enabled=True,delegable=True))
+                directory = Directory(document)
+            result = {'revision': store.apply(directory, None)}
+        elif command in ('check', 'apply'):
+            candidate = load_candidate(options.file)
+            if command == 'apply':
+                result = {'revision': store.apply(candidate, options.expected_revision)}
+            else:
+                current = store.snapshot(audit=False)
+                result = {'revision': current['revision'], 'changes': {}}
+                for key in ('tenants', 'organizations', 'groups', 'users', 'memberships', 'delegations', 'entity_delegations'):
+                    before = {json.dumps(item, sort_keys=True) for item in current['directory'][key]}
+                    after = {json.dumps(item, sort_keys=True) for item in candidate.document()[key]}
+                    result['changes'][key] = {'removed': [json.loads(item) for item in sorted(before-after)],
+                                              'added': [json.loads(item) for item in sorted(after-before)]}
+        else:
+            snapshot = store.snapshot(audit=command=='audit')
+            if command == 'contexts':
+                directory = Directory(snapshot['directory'])
+                result = [{'organization': org, 'tenant': directory.organizations[org]['tenant'],
+                           'groups': directory.effective_groups(options.subject, org)}
+                          for org in directory.contexts(options.subject)]
+            elif command == 'export':
+                result = snapshot['directory']
+            elif command == 'audit':
+                result = snapshot['audit']
+            else:
+                result = {'revision': snapshot['revision'], 'directory': snapshot['directory']}
+        print(json.dumps(result, indent=2, sort_keys=True))
+        return 0
+    except (AccountError, OSError, ValueError, TypeError, RecursionError, yaml.YAMLError):
+        print('Account operation failed; check private files, input and current revision.', file=sys.stderr)
+        return 2

atraxis/account_delegation.py

@@ -0,0 +1,182 @@
+"""Bounded account administration; no rule/engine permissions are assigned here."""
+from copy import deepcopy
+import uuid
+
+from atraxis.accounts import AccountError, identifier, require
+
+MAX_DELEGATIONS = 1024
+MAX_DELEGATION_DEPTH = 8
+MEMBERSHIP_OPERATIONS = frozenset({'membership.add', 'membership.remove'})
+OPERATIONS = MEMBERSHIP_OPERATIONS | {'delegation.create', 'delegation.revoke'}
+GRANT_FIELDS = frozenset({'id','subject','organization','groups','operations',
+                         'organization_membership','delegable','enabled','parent'})
+
+
+def validate_delegations(directory, entries):
+    require(type(entries) is list and len(entries) <= MAX_DELEGATIONS)
+    grants = {}
+    for item in entries:
+        require(type(item) is dict and set(item) == GRANT_FIELDS)
+        require(identifier(item['id']) and item['id'] not in grants)
+        require(identifier(item['subject']) and item['subject'] in directory.users)
+        require(identifier(item['organization']) and item['organization'] in directory.organizations)
+        require(type(item['groups']) is list and len(item['groups']) <= len(directory.groups))
+        require(all(identifier(g) and g in directory.groups and directory.groups[g]['organization'] == item['organization'] for g in item['groups']))
+        require(len(set(item['groups'])) == len(item['groups']))
+        require(type(item['operations']) is list and all(type(o) is str for o in item['operations']))
+        require(bool(item['operations']) and set(item['operations']) <= MEMBERSHIP_OPERATIONS
+                and len(set(item['operations'])) == len(item['operations']))
+        require(all(type(item[k]) is bool for k in ('organization_membership','delegable','enabled')))
+        require(item['organization_membership'] or bool(item['groups']))
+        require(item['parent'] is None or identifier(item['parent']))
+        grants[item['id']] = item
+    for grant in grants.values():
+        seen, subjects, current = set(), set(), grant
+        while current is not None:
+            require(current['id'] not in seen and current['subject'] not in subjects and len(seen) < MAX_DELEGATION_DEPTH)
+            seen.add(current['id']); subjects.add(current['subject'])
+            parent_id = current['parent']
+            if parent_id is None:
+                break
+            require(parent_id in grants)
+            parent = grants[parent_id]
+            require(parent['subject'] != current['subject'] and parent['delegable'])
+            require(parent['organization'] == current['organization'])
+            require(set(current['groups']) <= set(parent['groups']) and set(current['operations']) <= set(parent['operations']))
+            require(not current['organization_membership'] or parent['organization_membership'])
+            current = parent
+    return grants
+
+
+def active(directory, grant):
+    current = grant
+    while current is not None:
+        if not current['enabled'] or not directory.allows_membership(current['subject'], current['organization']):
+            return False
+        current = directory.delegations.get(current['parent'])
+    return True
+
+
+def owned(directory, subject):
+    return [g for g in directory.delegations.values() if g['subject'] == subject and active(directory,g)]
+
+
+def checked_request(request):
+    from atraxis.account_entities import ALL_OPERATIONS, checked_request as entity_request
+    if type(request) is dict and request.get('operation') in ALL_OPERATIONS:
+        return entity_request(request)
+    if type(request) is not dict or request.get('operation') not in OPERATIONS:
+        raise AccountError('invalid_account_operation')
+    operation = request['operation']
+    fields = ({'operation','organization','subject','group'} if operation in MEMBERSHIP_OPERATIONS else
+              {'operation','parent','subject','groups','operations','organization_membership','delegable'}
+              if operation == 'delegation.create' else {'operation','grant'})
+    require(set(request) == fields)
+    if operation in MEMBERSHIP_OPERATIONS:
+        require(identifier(request['organization']) and identifier(request['subject']))
+        require(request['group'] is None or identifier(request['group']))
+    elif operation == 'delegation.create':
+        require(identifier(request['parent']) and identifier(request['subject']))
+        require(type(request['groups']) is list and len(request['groups']) <= 4096
+                and all(identifier(g) for g in request['groups']) and len(set(request['groups'])) == len(request['groups']))
+        require(type(request['operations']) is list and len(request['operations']) <= 2
+                and all(type(o) is str for o in request['operations']) and bool(request['operations'])
+                and set(request['operations']) <= MEMBERSHIP_OPERATIONS and len(set(request['operations'])) == len(request['operations']))
+        require(type(request['organization_membership']) is bool and type(request['delegable']) is bool)
+    else:
+        require(identifier(request['grant']))
+    return deepcopy(request)
+
+
+def propose(directory, subject, request, *, new_id=None):
+    """Return a candidate and scoped audit metadata, or deny without side effects."""
+    from atraxis.accounts import Directory
+    from atraxis.account_entities import ALL_OPERATIONS, propose as entity_propose
+    if type(request) is dict and request.get('operation') in ALL_OPERATIONS:
+        return entity_propose(directory, subject, request, new_id=new_id or uuid.uuid4().hex)
+    request = checked_request(request)
+    operation = request['operation']
+    grants = owned(directory, subject)
+    candidate = directory.document()
+    if operation in MEMBERSHIP_OPERATIONS:
+        org, target, group = request['organization'], request['subject'], request['group']
+        from atraxis.account_entities import membership_grants
+        grants = grants + membership_grants(directory,subject,org)
+        if target == subject or target not in directory.users:
+            raise PermissionError('account_administration_denied')
+        if group is not None and (group not in directory.groups or directory.groups[group]['organization'] != org):
+            raise PermissionError('account_administration_denied')
+        if group is not None and (target,org,None) not in directory.memberships:
+            raise PermissionError('account_administration_denied')
+        row = {'user':target,'organization':org,'group':group}
+        adding = operation == 'membership.add'
+        exists = row in candidate['memberships']
+        if exists == adding:
+            raise AccountError('account_membership_unchanged')
+        if adding:
+            candidate['memberships'].append(row)
+        else:
+            candidate['memberships'].remove(row)
+        updated = Directory(candidate)
+        before = set(directory.effective_groups(target,org))
+        after = set(updated.effective_groups(target,org))
+        # An explicit parent membership can affect inherited descendants. Bound all effects.
+        affected = before ^ after
+        if group is not None:
+            affected.add(group)
+        if not any(g['organization'] == org and operation in g['operations']
+                   and affected <= set(g['groups']) and (group is not None or g['organization_membership']) for g in grants):
+            raise PermissionError('account_administration_denied')
+        # Membership changes must not indirectly reactivate another administrator's chain.
+        if (any(g['subject'] == target and g['organization'] == org for g in directory.delegations.values())
+                or any(g['subject']==target for g in directory.entity_delegations.values())):
+            raise PermissionError('administrator_membership_requires_local_authority')
+    elif operation == 'delegation.create':
+        parent = next((g for g in grants if g['id'] == request['parent']),None)
+        target = request['subject']
+        if parent is None or not parent['delegable'] or target == subject or not directory.allows_membership(target,parent['organization']):
+            raise PermissionError('account_delegation_denied')
+        org = parent['organization']
+        if (not set(request['groups']) <= set(parent['groups']) or not set(request['operations']) <= set(parent['operations'])
+                or request['organization_membership'] and not parent['organization_membership']):
+            raise PermissionError('account_delegation_denied')
+        # Do not delegate back to an ancestor subject, even through a different grant ID.
+        current = parent
+        while current is not None:
+            if current['subject'] == target:
+                raise PermissionError('account_delegation_cycle')
+            current = directory.delegations.get(current['parent'])
+        candidate['delegations'].append(dict(id=new_id or uuid.uuid4().hex,subject=target,organization=org,
+            groups=request['groups'],operations=request['operations'],organization_membership=request['organization_membership'],
+            delegable=request['delegable'],enabled=True,parent=parent['id']))
+        updated = Directory(candidate)
+    else:
+        grant = directory.delegations.get(request['grant'])
+        parent = next((g for g in grants if grant is not None and g['id'] == grant['parent']),None)
+        if grant is None or parent is None or not parent['delegable'] or not grant['enabled']:
+            raise PermissionError('account_delegation_denied')
+        org, target = grant['organization'], grant['subject']
+        next(g for g in candidate['delegations'] if g['id']==grant['id'])['enabled']=False
+        updated = Directory(candidate)
+    return updated, {'subject':subject,'operation':operation,'organization':org,'target':target}
+
+
+def view(directory, subject):
+    grants = owned(directory,subject)
+    legacy_ids = {g['id'] for g in grants}
+    from atraxis.account_entities import membership_grants
+    for organization in directory.organizations:
+        grants += membership_grants(directory,subject,organization)
+    result = []
+    for org in sorted({g['organization'] for g in grants}):
+        applicable = [g for g in grants if g['organization']==org]
+        groups = set().union(*(set(g['groups']) for g in applicable))
+        organization_membership = any(g['organization_membership'] for g in applicable)
+        memberships = [m for m in directory.document()['memberships'] if m['organization']==org
+                       and (m['group'] in groups or m['group'] is None and organization_membership)]
+        tenant = directory.tenants[directory.organizations[org]['tenant']]
+        result.append({'id':org,'name':directory.organizations[org]['name'],'tenant':tenant['name'],
+            'groups':[{'id':g,'name':directory.groups[g]['name']} for g in sorted(groups)],
+            'memberships':memberships,'grants':deepcopy(applicable),
+            'delegated':[deepcopy(g) for g in directory.delegations.values() if g['parent'] in legacy_ids & {p['id'] for p in applicable}]})
+    return result