ckanext-permissions 0.2.0__py3-none-any.whl

ckanext/__init__.py

@@ -0,0 +1,9 @@
+# this is a namespace package
+try:
+    import pkg_resources
+
+    pkg_resources.declare_namespace(__name__)
+except ImportError:
+    import pkgutil
+
+    __path__ = pkgutil.extend_path(__path__, __name__)

ckanext/permissions/cli.py

@@ -0,0 +1,80 @@
+import click
+
+import ckan.model as model
+
+import ckanext.permissions.const as perm_const
+from ckanext.permissions import model as perm_model
+from ckanext.permissions import utils
+
+__all__ = ["permissions"]
+
+
+@click.group()
+def permissions():
+    """Permissions management commands."""
+
+
+@permissions.command()
+def init_default_roles():
+    """Create default roles (anonymous, authenticated, administrator) in the database"""
+    created_count = utils.ensure_default_roles()
+
+    if created_count > 0:
+        click.secho(f"{created_count} role(s) created successfully", fg="green")
+    else:
+        click.secho("All default roles already exist", fg="yellow")
+
+    return created_count
+
+
+@permissions.command()
+@click.argument("role", default=perm_const.Roles.Authenticated.value, required=False)
+def assign_default_user_roles(role: str):
+    """Assign automatic roles to users (initializes default roles if needed)"""
+    # Ensure default roles exist
+    click.echo("Checking default roles...")
+    created_count = utils.ensure_default_roles()
+
+    if created_count > 0:
+        click.secho(f"{created_count} role(s) created", fg="green")
+        click.echo()  # Empty line for readability
+
+    # Check if the specified role exists
+    if not perm_model.Role.get(role):
+        click.secho(f"Error: Role '{role}' does not exist", fg="red")
+        return
+
+    users = model.Session.query(model.User).filter(model.User.state == "active").all()
+
+    for user in users:
+        utils.assign_role_to_user(user.id, role)
+
+    click.secho(f"Role '{role}' assigned to {len(users)} active user(s)", fg="green")
+
+
+@permissions.command()
+@click.argument("role", default=perm_const.Roles.Authenticated.value, required=False)
+@click.option(
+    "--user-ids",
+    "-u",
+    multiple=True,
+    help="User IDs to remove role from (if not specified, removes from all users)",
+)
+def remove_role_from_users(role: str, user_ids: tuple[str, ...]):
+    """Remove automatic roles from users"""
+    if user_ids:
+        users = (
+            model.Session.query(model.User).filter(model.User.id.in_(user_ids)).all()
+        )
+    else:
+        users = model.User.all()
+
+    for user in users:
+        utils.remove_role_from_user(user.id, role)
+
+    if user_ids:
+        click.secho(
+            f"Role '{role}' removed from {len(users)} specified user(s)", fg="green"
+        )
+    else:
+        click.secho(f"Role '{role}' removed from all users", fg="green")

ckanext/permissions/const.py

@@ -0,0 +1,10 @@
+from enum import Enum
+
+ROLE_ID_MIN_LENGTH = 1
+ROLE_ID_MAX_LENGTH = 50
+
+
+class Roles(Enum):
+    Anonymous = "anonymous"
+    Authenticated = "authenticated"
+    Administrator = "administrator"

ckanext/permissions/helpers.py

@@ -0,0 +1,51 @@
+from __future__ import annotations
+
+from ckanext.permissions import const, model, utils
+
+
+def get_registered_roles() -> dict[str, str]:
+    """Get the registered roles
+
+    Returns:
+        The registered roles
+    """
+    return utils.get_registered_roles()
+
+
+def get_role_permissions(role_id: str, permission: str) -> bool:
+    """Check if a role has a permission
+
+    Args:
+        role_id (str): The id of the role
+        permission (str): The permission to check
+
+    Returns:
+        True if the role has the permission, False otherwise
+    """
+    return model.RolePermission.get(role_id, permission) is not None
+
+
+def get_user_roles(user_id: str, scope: str = "global", scope_id: str | None = None) -> list[str]:
+    """Get the roles of a user
+
+    Args:
+        user_id (str): The id of the user
+        scope (str): The scope of the role
+        scope_id (str | None): The id of the scope
+
+    Returns:
+        The roles of the user
+    """
+    return [str(role.role_id) for role in model.UserRole.get(user_id, scope, scope_id)]
+
+
+def is_default_role(role_id: str) -> bool:
+    """Check if the role is a default role
+
+    Args:
+        role_id (str): The id of the role to check
+
+    Returns:
+        True if the role is a default role, False otherwise
+    """
+    return any(role_id == role.value for role in const.Roles)

ckanext/permissions/implementation/__init__.py

@@ -0,0 +1,5 @@
+from .permission_labels import PermissionLabels
+
+__all__ = [
+    "PermissionLabels",
+]

ckanext/permissions/implementation/permission_labels.py

@@ -0,0 +1,45 @@
+from __future__ import annotations
+
+import ckan.plugins as p
+from ckan import model
+from ckan.lib.plugins import DefaultPermissionLabels
+
+import ckanext.permissions.utils as perm_utils
+
+
+class PermissionLabels(p.SingletonPlugin, DefaultPermissionLabels):
+    p.implements(p.IPermissionLabels)
+
+    def get_dataset_labels(self, dataset_obj: model.Package) -> list[str]:
+        labels: list[str] = super().get_dataset_labels(dataset_obj)
+
+        labels.append("permission-allowed")
+
+        if dataset_obj.owner_org:
+            labels.append(f"permission-allowed-org:{dataset_obj.owner_org}")
+
+        return labels
+
+    def get_user_dataset_labels(self, user_obj: model.User | None) -> list[str]:
+        """Get permission labels for a user.
+
+        Extends the default CKAN permission labels by checking if the user has
+        special read permissions (read_any_dataset or read_private_dataset).
+        If they do, adds a 'permission-allowed' label that grants access to
+        the dataset.
+
+        Args:
+            user_obj: The user to get labels for. Can be None for anonymous users.
+
+        Returns:
+            List of permission labels for this user
+        """
+        labels: list[str] = super().get_user_dataset_labels(user_obj)  # type: ignore
+
+        user = user_obj or model.AnonymousUser()
+
+        for permission in ["read_any_dataset", "read_private_dataset"]:
+            if perm_utils.check_permission(permission, user):
+                labels.append("permission-allowed")
+
+        return labels

ckanext/permissions/logic/action.py

@@ -0,0 +1,113 @@
+from __future__ import annotations
+
+from typing import cast
+
+import ckan.plugins.toolkit as tk
+from ckan import model
+from ckan.logic import validate
+from ckan.types import Context, DataDict
+
+from ckanext.permissions import model as perm_model
+from ckanext.permissions import types as perm_types
+from ckanext.permissions import utils as perm_utils
+from ckanext.permissions.logic import schema
+
+
+@validate(schema.role_create)
+def permission_role_create(context: Context, data_dict: DataDict) -> perm_types.Role:
+    tk.check_access("manage_user_roles", context, data_dict)
+    return perm_model.Role.create(**data_dict).dictize(context)
+
+
+@validate(schema.role_delete)
+def permission_role_delete(context: Context, data_dict: DataDict) -> None:
+    tk.check_access("manage_user_roles", context, data_dict)
+
+    if role := perm_model.Role.get(data_dict["id"]):
+        role.delete()
+
+
+@validate(schema.role_update)
+def permission_role_update(context: Context, data_dict: DataDict) -> perm_types.Role:
+    tk.check_access("manage_user_roles", context, data_dict)
+
+    role = cast(perm_model.Role, perm_model.Role.get(data_dict["id"]))
+
+    role.update(data_dict["description"])
+
+    return role.dictize(context)
+
+
+@validate(schema.permissions_update)
+def permissions_update(context: Context, data_dict: DataDict) -> DataDict:
+    """Update the permissions for a given permission key.
+
+    Returns:
+        A dictionary with the updated permissions and the missing permissions
+    """
+    tk.check_access("manage_permissions", context, data_dict)
+
+    _validate_permission_data(data_dict)
+    registered_permissions = perm_utils.get_permissions()
+
+    updated_permissions = {}
+    missing_permissions = []
+
+    for permission_key, roles_data in data_dict["permissions"].items():
+        if permission_key not in registered_permissions:
+            missing_permissions.append(permission_key)
+            continue
+
+        permission_data = {}
+
+        for role_id, flag in roles_data.items():
+            role_permission = perm_model.RolePermission.get(role_id, permission_key)
+
+            if flag and role_permission:
+                continue
+
+            if not flag and not role_permission:
+                continue
+
+            if not flag and role_permission:
+                role_permission.delete()
+            else:
+                perm_model.RolePermission.create(role_id, permission_key)
+
+            permission_data[role_id] = flag
+
+        updated_permissions[permission_key] = permission_data
+
+    model.Session.commit()
+
+    return {
+        "updated_permissions": updated_permissions,
+        "missing_permissions": missing_permissions,
+    }
+
+
+def _validate_permission_data(data: DataDict) -> None:
+    for permission_key, roles_data in data["permissions"].items():
+        if not isinstance(permission_key, str):
+            raise tk.ValidationError("Invalid permission key")
+
+        if not isinstance(roles_data, dict):
+            raise tk.ValidationError("Invalid permission mapping")
+
+        for role_id, flag in roles_data.items():
+            if not isinstance(flag, bool):
+                raise tk.ValidationError("Invalid permission value")
+
+            data, errors = tk.navl_validate(
+                {"id": role_id},
+                {
+                    "id": [
+                        tk.get_validator("not_empty"),
+                        tk.get_validator("unicode_safe"),
+                        tk.get_validator("permission_role_exists"),
+                    ],
+                },
+            )
+
+            if errors:
+                raise tk.ValidationError(errors)

ckanext/permissions/logic/auth.py

@@ -0,0 +1,82 @@
+from __future__ import annotations
+
+import ckan.plugins.toolkit as tk
+from ckan import model, types
+
+import ckanext.permissions.utils as perm_utils
+
+
+@tk.chained_auth_function
+@tk.auth_allow_anonymous_access
+def package_show(
+    next_: types.AuthFunction,
+    context: types.Context,
+    data_dict: types.DataDict | None,
+) -> types.AuthResult:
+    user = model.User.get(context.get("user")) or model.AnonymousUser()
+    package = context.get("package")  # type: ignore
+
+    if not package:
+        return next_(context, data_dict or {})
+
+    # Check permissions in order of precedence
+    permission_checks = [
+        ("read_any_dataset", None),
+        ("read_private_dataset", lambda: package.private),
+    ]
+
+    for permission, condition in permission_checks:
+        if condition is not None and not condition():
+            continue
+
+        if perm_utils.check_permission(permission, user):
+            return {"success": True}
+
+    return next_(context, data_dict or {})
+
+
+@tk.chained_auth_function
+@tk.auth_allow_anonymous_access
+def package_update(
+    next_: types.AuthFunction, context: types.Context, data_dict: types.DataDict | None
+) -> types.AuthResult:
+    user = model.User.get(context.get("user")) or model.AnonymousUser()
+
+    if perm_utils.check_permission("update_any_dataset", user):
+        return {"success": True}
+
+    return next_(context, data_dict or {})
+
+
+@tk.chained_auth_function
+@tk.auth_allow_anonymous_access
+def package_delete(
+    next_: types.AuthFunction, context: types.Context, data_dict: types.DataDict | None
+) -> types.AuthResult:
+    user = model.User.get(context.get("user")) or model.AnonymousUser()
+
+    if perm_utils.check_permission("delete_any_dataset", user):
+        return {"success": True}
+
+    return next_(context, data_dict or {})
+
+
+@tk.chained_auth_function
+@tk.auth_allow_anonymous_access
+def resource_delete(
+    next_: types.AuthFunction, context: types.Context, data_dict: types.DataDict | None
+) -> types.AuthResult:
+    user = model.User.get(context.get("user")) or model.AnonymousUser()
+
+    if perm_utils.check_permission("delete_any_resource", user):
+        return {"success": True}
+
+    return next_(context, data_dict or {})
+
+
+def manage_user_roles(context: types.Context, data_dict: types.DataDict) -> types.AuthResult:
+    return {"success": False}
+
+
+def manage_permissions(context: types.Context, data_dict: types.DataDict) -> types.AuthResult:
+    return {"success": False}

ckanext/permissions/logic/schema.py

@@ -0,0 +1,54 @@
+from __future__ import annotations
+
+from ckan import types
+from ckan.logic.schema import validator_args
+
+
+@validator_args
+def role_create(not_empty, unicode_safe, role_id_validator, role_doesnt_exists, ignore) -> types.Schema:
+    return {
+        "id": [not_empty, unicode_safe, role_id_validator, role_doesnt_exists],
+        "label": [not_empty, unicode_safe],
+        "description": [not_empty, unicode_safe],
+        "__extras": [ignore],
+    }
+
+
+@validator_args
+def role_delete(not_empty, unicode_safe, permission_role_exists, not_default_role) -> types.Schema:
+    return {
+        "id": [not_empty, unicode_safe, permission_role_exists, not_default_role],
+    }
+
+
+@validator_args
+def role_update(not_empty, unicode_safe, permission_role_exists) -> types.Schema:
+    return {
+        "id": [not_empty, unicode_safe, permission_role_exists],
+        "description": [not_empty, unicode_safe],
+    }
+
+
+@validator_args
+def permissions_update(default, convert_to_json_if_string, dict_only) -> types.Schema:
+    return {
+        "permissions": [default("{}"), convert_to_json_if_string, dict_only],
+    }
+
+
+@validator_args
+def permission_group_schema(not_empty, unicode_safe) -> types.Schema:
+    return {
+        "name": [not_empty, unicode_safe],
+        "description": [not_empty, unicode_safe],
+        "permissions": permission_schema(),
+    }
+
+
+@validator_args
+def permission_schema(not_empty, unicode_safe, ignore_missing) -> types.Schema:
+    return {
+        "key": [not_empty, unicode_safe],
+        "label": [not_empty, unicode_safe],
+        "description": [ignore_missing, unicode_safe],
+    }

ckanext/permissions/logic/validators.py

@@ -0,0 +1,112 @@
+from __future__ import annotations
+
+import re
+
+import ckan.plugins.toolkit as tk
+
+import ckanext.permissions.const as perm_const
+import ckanext.permissions.model as perm_model
+
+
+def role_doesnt_exists(role: str) -> str:
+    """Ensure that a role doesn't exists.
+
+    Args:
+        role (str): role name
+
+    Raises:
+        tk.Invalid: if the role exists
+
+    Returns:
+        role name
+    """
+    if perm_model.Role.get(role) is not None:
+        raise tk.Invalid(f"Role {role} is already exists")
+
+    return role
+
+
+def permission_role_exists(role: str) -> str:
+    """Ensure that a role exists.
+
+    Args:
+        role (str): role name
+
+    Raises:
+        tk.Invalid: if the role doesn't exists
+
+    Returns:
+        role name
+    """
+    if perm_model.Role.get(role) is None:
+        raise tk.Invalid(f"Role {role} doesn't exists")
+
+    return role
+
+
+def roles_exists(roles: list[str]) -> list[str]:
+    """Ensure that all roles exists.
+
+    Args:
+        roles (list[str]): list of roles
+
+    Raises:
+        tk.Invalid: if a role doesn't exists
+
+    Returns:
+        list of roles
+    """
+    for role in roles:
+        permission_role_exists(role)
+
+    return roles
+
+
+def role_id_validator(value: str) -> str:
+    """Validate a role ID.
+
+    Ensures that:
+        - the role ID is a string
+        - is at least N characters long
+        - is at most N characters long
+        - contains only lowercase alpha (ascii) characters and these symbols: -_
+
+    Args:
+        value (str): role ID
+
+    Raises:
+        tk.Invalid: if the role ID is invalid
+
+    Returns:
+        role ID
+    """
+    name_match = re.compile(r"[a-z_\-]*$")
+
+    if len(value) < perm_const.ROLE_ID_MIN_LENGTH:
+        raise tk.Invalid(f"Role ID must be at least {perm_const.ROLE_ID_MIN_LENGTH} characters long.")
+
+    if len(value) > perm_const.ROLE_ID_MAX_LENGTH:
+        raise tk.Invalid(f"Role ID must be a maximum of {perm_const.ROLE_ID_MAX_LENGTH} characters long.")
+
+    if not name_match.match(value):
+        raise tk.Invalid("Role ID must be purely lowercase alpha(ascii) characters and these symbols: -_")
+
+    return value
+
+
+def not_default_role(role_id: str) -> str:
+    """Ensure that the role is not a default role.
+
+    Args:
+        role_id (str): role ID
+
+    Raises:
+        tk.Invalid: if the role is a default role
+
+    Returns:
+        role ID
+    """
+    if role_id in [role.value for role in perm_const.Roles]:
+        raise tk.Invalid(f"Role {role_id} is a default role.")
+
+    return role_id

ckanext/permissions/migration/permissions/alembic.ini

@@ -0,0 +1,74 @@
+# A generic, single database configuration.
+
+[alembic]
+# path to migration scripts
+script_location = %(here)s
+
+# template used to generate migration files
+# file_template = %%(rev)s_%%(slug)s
+
+# timezone to use when rendering the date
+# within the migration file as well as the filename.
+# string value is passed to dateutil.tz.gettz()
+# leave blank for localtime
+# timezone =
+
+# max length of characters to apply to the
+# "slug" field
+#truncate_slug_length = 40
+
+# set to 'true' to run the environment during
+# the 'revision' command, regardless of autogenerate
+# revision_environment = false
+
+# set to 'true' to allow .pyc and .pyo files without
+# a source .py file to be detected as revisions in the
+# versions/ directory
+# sourceless = false
+
+# version location specification; this defaults
+# to /home/berry/projects/master/ckanext-permissions/ckanext/permissions/migration/permissions/versions.  When using multiple version
+# directories, initial revisions must be specified with --version-path
+# version_locations = %(here)s/bar %(here)s/bat /home/berry/projects/master/ckanext-permissions/ckanext/permissions/migration/permissions/versions
+
+# the output encoding used when revision files
+# are written from script.py.mako
+# output_encoding = utf-8
+
+sqlalchemy.url = driver://user:pass@localhost/dbname
+
+
+# Logging configuration
+[loggers]
+keys = root,sqlalchemy,alembic
+
+[handlers]
+keys = console
+
+[formatters]
+keys = generic
+
+[logger_root]
+level = WARN
+handlers = console
+qualname =
+
+[logger_sqlalchemy]
+level = WARN
+handlers =
+qualname = sqlalchemy.engine
+
+[logger_alembic]
+level = INFO
+handlers =
+qualname = alembic
+
+[handler_console]
+class = StreamHandler
+args = (sys.stderr,)
+level = NOTSET
+formatter = generic
+
+[formatter_generic]
+format = %(levelname)-5.5s [%(name)s] %(message)s
+datefmt = %H:%M:%S