aws-python-helper 1.2.0__py3-none-any.whl → 1.4.0__py3-none-any.whl

aws_python_helper/api/base.py

@@ -186,6 +186,28 @@ class API(ABC):
         """
         return self._is_authenticated
     
+    async def granted_permissions(self):
+        """Which permissions the caller holds, or None when this API does not know.
+
+        Override it to turn on permission checking for a service. Where the list
+        comes from is the service's business: its own database, a map cached from
+        core, whatever fits.
+
+        Returning None with AUTHORIZATION=permission is refused, not waved
+        through. An endpoint that cannot say what its caller may do has to be a
+        closed door: the alternative is that forgetting to wire this up leaves it
+        open to anyone holding a token, which is the failure this whole mechanism
+        exists to prevent.
+        """
+        return None
+
+    @property
+    def service_code(self) -> str:
+        """Names this service inside a permission, as in `core:GET /users`."""
+        import os
+
+        return os.getenv('SERVICE_CODE', os.getenv('NAMESPACE', 'service'))
+
     @property
     def auth_data(self) -> Optional[Dict[str, Any]]:
         """

aws_python_helper/api/dispatcher.py

@@ -78,13 +78,27 @@ class Dispatcher:
             
             # 2. Authorization based on mode
             authorization = os.getenv('AUTHORIZATION', '').lower()
-            requires_user = authorization in ('user', 'full')
-            requires_state = authorization in ('state', 'full')
+            requires_user = authorization in ('user', 'full', 'permission')
+            requires_permission = authorization == 'permission'
+
+            # Pedir el state es independiente de pedir un permiso, así que va por
+            # su propia variable. Los valores viejos `state` y `full` la implican,
+            # para que un servicio sin migrar siga comportándose igual.
+            requires_state = (
+                authorization in ('state', 'full')
+                or os.getenv('REQUIRES_STATE', '').lower() in ('1', 'true', 'yes')
+            )
 
             # 2a. Authenticate (if mode requires user)
             if requires_user:
                 await self._authenticate(api)
 
+            # 2a-bis. Check what the caller is allowed to do
+            if requires_permission:
+                denial = await self._authorize(api)
+                if denial:
+                    return denial
+
             # 2b. Validate state header (if mode requires state)
             if requires_state:
                 state = self.headers.get('constitution-state')
@@ -236,6 +250,43 @@ class Dispatcher:
         
         return api
     
+    async def _authorize(self, api: API):
+        """Refuse the request when the caller lacks the permission it needs.
+
+        Returns the response to send back, or None to carry on.
+        """
+        from ..permissions import allows, required_for
+
+        granted = await api.granted_permissions()
+        if granted is None:
+            logger.error(
+                "AUTHORIZATION=permission but %s does not implement "
+                "granted_permissions(); refusing the request",
+                type(api).__name__,
+            )
+            return {
+                'code': 403,
+                'body': {
+                    'error': 'Forbidden',
+                    'message': 'Permission checking is not configured for this endpoint',
+                },
+                'headers': {},
+            }
+
+        required = required_for(api.service_code, self.method, self.endpoint)
+        if allows(granted, required):
+            return None
+
+        logger.warning("Denied: %s lacks %r", self.headers.get('x-caller', 'caller'), required)
+        return {
+            'code': 403,
+            'body': {
+                'error': 'Forbidden',
+                'message': f"Te falta el permiso '{required}'",
+            },
+            'headers': {},
+        }
+
     async def _authenticate(self, api: API):
         """
         Execute authentication middleware

aws_python_helper/permissions/__init__.py

@@ -0,0 +1,9 @@
+from .catalog import ALL, allows, discover, required_for, service_wildcard
+
+__all__ = [
+    "ALL",
+    "allows",
+    "discover",
+    "required_for",
+    "service_wildcard",
+]

aws_python_helper/permissions/catalog.py

@@ -0,0 +1,105 @@
+"""Derives a service's permissions from the API files it actually has.
+
+The endpoints are already declared twice — in the terraform routes and in the
+file convention the dispatcher resolves on. A hand-written list would be a third
+copy, and the first endpoint added without touching it would be an unguarded
+hole nobody notices.
+
+Mirrors `aws_python_helper.api.fetcher` in reverse: that one turns a request into
+a file, this one turns the files into the requests they answer. It lives beside
+the fetcher so the two cannot drift: a routing rule that changes in one would
+otherwise silently stop matching in the other, and an access check that never
+matches fails open or shut without anyone noticing.
+"""
+
+import os
+from typing import Dict, List
+
+from ..api.fetcher import Fetcher
+
+# Cómo se llama el archivo según el método. `list` y `get` son ambos GET: uno
+# responde la colección, el otro un elemento.
+FILE_METHODS = {
+    "list": "GET",
+    "get": "GET",
+    "post": "POST",
+    "put": "PUT",
+    "patch": "PATCH",
+    "delete": "DELETE",
+}
+
+ALL = "*"
+
+
+def discover(api_root: str, service: str) -> List[Dict[str, str]]:
+    """Every endpoint this service answers, as permission records.
+
+    The `{id}` of a route is left out on purpose: holding an id does not change
+    who may call the endpoint, and leaving it out makes the mapping between a
+    file and a permission exact.
+    """
+    found: List[Dict[str, str]] = []
+
+    for current, _, files in os.walk(api_root):
+        for filename in sorted(files):
+            stem, extension = os.path.splitext(filename)
+            if extension != ".py" or stem not in FILE_METHODS:
+                continue
+
+            relative = os.path.relpath(current, api_root)
+            parts = [] if relative == "." else relative.split(os.sep)
+            path = "/" + "/".join(parts)
+            method = FILE_METHODS[stem]
+
+            # `list` responde la colección y `get` un elemento: mismo método
+            # sobre rutas distintas, así que son dos permisos, no uno.
+            if stem == "get":
+                path = f"{path.rstrip('/')}/{{id}}"
+
+            found.append({
+                "code": f"{service}:{method} {path}",
+                "service": service,
+                "method": method,
+                "path": path,
+                "scope": "item" if stem == "get" else "collection",
+            })
+
+    return sorted(found, key=lambda item: item["code"])
+
+
+def service_wildcard(service: str) -> str:
+    return f"{service}:*"
+
+
+def required_for(service: str, method: str, endpoint: str, api_root: str = "api") -> str:
+    """The permission a request needs.
+
+    Asks the framework which file will answer, and names the permission after it.
+    Reimplementing the routing rules here would be a second copy that drifts, and
+    a permission that never matches fails open or shut without anyone noticing —
+    which is the worst way for an access check to be wrong.
+    """
+    resolved = Fetcher(endpoint, method.lower()).file_path
+    marker = os.sep + api_root + os.sep
+    if marker not in resolved:
+        return ""
+
+    relative = resolved.split(marker, 1)[1]
+    directory, filename = os.path.split(relative)
+    stem = os.path.splitext(filename)[0]
+    if stem not in FILE_METHODS:
+        return ""
+
+    path = "/" + directory.replace(os.sep, "/") if directory else "/"
+    if stem == "get":
+        path = f"{path.rstrip('/')}/{{id}}"
+    return f"{service}:{FILE_METHODS[stem]} {path}"
+
+
+def allows(granted: List[str], required: str) -> bool:
+    """Whether a set of granted permissions covers the one an endpoint needs."""
+    if not required:
+        return False
+    if ALL in granted or required in granted:
+        return True
+    return service_wildcard(required.split(":", 1)[0]) in granted

{aws_python_helper-1.2.0.dist-info → aws_python_helper-1.4.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aws-python-helper
-Version: 1.2.0
+Version: 1.4.0
 Summary: AWS Python Helper Framework
 Author-email: Fabian Claros <neufabiae@gmail.com>
 License-Expression: MIT

{aws_python_helper-1.2.0.dist-info → aws_python_helper-1.4.0.dist-info}/RECORD

@@ -2,8 +2,8 @@ aws_python_helper/__init__.py,sha256=fc6TMZCNo4dnxXgbd6_l13GQhPCKsuLtUCbwqP25mpI
 aws_python_helper/api/__init__.py,sha256=2H8s1bbZArgrlecFb0YDQjBQKphhhwl70zx5oGC4fnk,232
 aws_python_helper/api/auth_middleware.py,sha256=KU6tyH6gPOsaG4oLRr-O2Edbmz92sc39GI7ZsIbVhco,3432
 aws_python_helper/api/auth_validators.py,sha256=knpMd6NA5Lo2JLgkgJhAQnFzm38I9LzI_SInrVIR-gk,8563
-aws_python_helper/api/base.py,sha256=CjNc3rUiPKfuxPSEm1AwS8yP7HoSLu0e0LwQCz-RNzw,8975
-aws_python_helper/api/dispatcher.py,sha256=526POV-h-MaZsad9pcx-pvP26ElIpURSOfKA7MZWVAI,8425
+aws_python_helper/api/base.py,sha256=5nUF6MM5dRXUtC_DytM8xlaC3Jx_dBeKoSOBRg2Gc-c,9897
+aws_python_helper/api/dispatcher.py,sha256=ikqsLmxYLNjNFzdN-oXwzsB_ZG7bljJOyqEWRpSnLsg,10337
 aws_python_helper/api/exceptions.py,sha256=C8G5jn0c6sTtHWG4daLdnqe57IbqNzsQolSBsl_YNno,1019
 aws_python_helper/api/fetcher.py,sha256=TVzfL2uIe8uvWzC1kZ9VPE0JOYd73XUjs8xu9ViBl7o,7758
 aws_python_helper/api/handler.py,sha256=IRfJUhYwp8ymBLOXsqsdhEIBmpUFaMuBAGGMjS23jaY,3467
@@ -32,6 +32,8 @@ aws_python_helper/model_index_sync/__init__.py,sha256=pPrS_4uahYF0EMkCds9biZk9Kf
 aws_python_helper/model_index_sync/base.py,sha256=26UpYxxvN5_so7fp79OH-07nQchNNmZzmH8heCNJ4kk,7527
 aws_python_helper/model_query/__init__.py,sha256=c25YrhNsL2FoF9KtLmS50Nud7R8DDS2QwEKT8bdB2Vs,67
 aws_python_helper/model_query/base.py,sha256=AJmkgQlEN4_4-5izfhhd0DERiES7xa6XV0OsdNRkGOU,8842
+aws_python_helper/permissions/__init__.py,sha256=6n6AsbDhfQBctPrTPDpCz8KH9tfKCG1VTtck9d7Vcos,175
+aws_python_helper/permissions/catalog.py,sha256=NgkXw4XjGpuXWzw2MR_Lp0AHkSjnuht4UKDOEYjvk-M,3788
 aws_python_helper/repository/__init__.py,sha256=N-1-RoFm60U4o9dEo_dHCXcPvPy_DjFlxbiwfmYGBQQ,55
 aws_python_helper/repository/base.py,sha256=jPdYRqDwg8tAXEzcqzVLT1ZMl-nBrwsFpnD9-841_mQ,12578
 aws_python_helper/sns/__init__.py,sha256=dNJDBuwObZr2KGlYqfp8DuTp1RQmEnHlyjqvq307rZY,118
@@ -44,7 +46,7 @@ aws_python_helper/utils/__init__.py,sha256=1L4bUGhMKy_UmXx-w03SDZetGo5MDOB_LIP_f
 aws_python_helper/utils/json_encoder.py,sha256=kPrglxttUF7ysW4LkUbzh89Va3jM3s12J98MH-mnKLE,2748
 aws_python_helper/utils/response.py,sha256=IxN6HxUkL_pcOMdfXj1WFjIyCBDV0BU9AC_e4ecOkU8,3633
 aws_python_helper/utils/serializer.py,sha256=WNM5izzL5sm9iPruqZbXrrzK5Kl4VxqEWLz5zQ9FeVs,2869
-aws_python_helper-1.2.0.dist-info/METADATA,sha256=6tv4IZfYkG2fsicGy_jXQ3-cdu8Zu7PWP5vBr_tTZ84,70276
-aws_python_helper-1.2.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-aws_python_helper-1.2.0.dist-info/top_level.txt,sha256=W_0xjk-0rtf9zOwWqSQaNwgZw6EF-cjmNTAdRtXZFHk,18
-aws_python_helper-1.2.0.dist-info/RECORD,,
+aws_python_helper-1.4.0.dist-info/METADATA,sha256=qhaLY1bQTFPhA8A-wEq4XP4U_MKOL5EXQPc8HEA0HAg,70276
+aws_python_helper-1.4.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+aws_python_helper-1.4.0.dist-info/top_level.txt,sha256=W_0xjk-0rtf9zOwWqSQaNwgZw6EF-cjmNTAdRtXZFHk,18
+aws_python_helper-1.4.0.dist-info/RECORD,,