elody 0.0.195__py3-none-any.whl → 0.0.197__py3-none-any.whl

elody/policies/authorization/filter_generic_objects_policy_v2.py

@@ -1,6 +1,7 @@
 import re as regex
 
 from copy import deepcopy
+from elody.policies.helpers import generate_filter_key_and_lookup_from_restricted_key
 from elody.policies.permission_handler import (
     get_permissions,
     mask_protected_content_post_request_hook,
@@ -123,6 +124,11 @@ class PostRequestRules:
                 restrictions = schemas[schema].get("object_restrictions", {})
                 for restricted_key, restricting_value in restrictions.items():
                     index, restricted_key = restricted_key.split(":")
+                    restricted_key, lookup = (
+                        generate_filter_key_and_lookup_from_restricted_key(
+                            restricted_key
+                        )
+                    )
                     key = f"{schema}|{restricted_key}"
                     if group := restrictions_grouped_by_index.get(index):
                         group["key"].append(key)
@@ -130,6 +136,7 @@ class PostRequestRules:
                         restrictions_grouped_by_index.update(
                             {
                                 index: {
+                                    "lookup": lookup,
                                     "key": [key],
                                     "value": restricting_value,
                                 }
@@ -155,6 +162,7 @@ class PostRequestRules:
             for restriction in restrictions_grouped_by_index.values():
                 user_context.access_restrictions.filters.append(  # pyright: ignore
                     {
+                        "lookup": restriction["lookup"],
                         "type": "selection",
                         "key": restriction["key"],
                         "value": restriction["value"],

elody/policies/authorization/generic_object_request_policy_v2.py

@@ -1,7 +1,10 @@
 import re as regex
 
 from configuration import get_object_configuration_mapper  # pyright: ignore
-from elody.policies.helpers import get_content
+from elody.policies.helpers import (
+    generate_filter_key_and_lookup_from_restricted_key,
+    get_content,
+)
 from elody.policies.permission_handler import (
     get_permissions,
     handle_single_item_request,
@@ -82,7 +85,7 @@ class GetRequestRules:
                     type_permissions[schemas[0]].get("object_restrictions", {}).keys()
                 )
                 for i in range(number_of_object_restrictions):
-                    keys, values = [], []
+                    lookup, keys, values = {}, [], []
                     for schema in schemas:
                         object_restrictions = type_permissions[schema].get(
                             "object_restrictions", {}
@@ -92,10 +95,16 @@ class GetRequestRules:
                             for key in object_restrictions.keys()
                             if key.startswith(f"{i}:")
                         ][0]
-                        keys.append(f"{schema}|{key.split(':')[1]}")
                         values = object_restrictions[key]
+                        key, lookup = (
+                            generate_filter_key_and_lookup_from_restricted_key(
+                                key.split(":")[1]
+                            )
+                        )
+                        keys.append(f"{schema}|{key}")
                     filters.append(
                         {
+                            "lookup": lookup,
                             "type": "selection",
                             "key": keys,
                             "value": values,

elody/policies/helpers.py

@@ -1,9 +1,28 @@
 from configuration import get_object_configuration_mapper  # pyright: ignore
 from elody.error_codes import ErrorCode, get_error_code, get_read
+from elody.util import flatten_dict
 from serialization.serialize import serialize  # pyright: ignore
 from werkzeug.exceptions import NotFound
 
 
+def generate_filter_key_and_lookup_from_restricted_key(key):
+    if (keys := key.split("@", 1)) and len(keys) == 1:
+        return key, {}
+
+    local_field = keys[0]
+    document_type, key = keys[1].split("-", 1)
+    collection = (
+        get_object_configuration_mapper().get(document_type).crud()["collection"]
+    )
+    lookup = {
+        "from": collection,
+        "local_field": local_field,
+        "foreign_field": "identifiers",
+        "as": f"__lookup.virtual_relations.{document_type}",
+    }
+    return f"{lookup['as']}.{key}", lookup
+
+
 def get_content(item, request, content):
     return serialize(
         content,
@@ -15,6 +34,12 @@ def get_content(item, request, content):
     )
 
 
+def get_flat_item_and_object_lists(item):
+    config = get_object_configuration_mapper().get(item["type"])
+    object_lists = config.document_info().get("object_lists", {})
+    return flatten_dict(object_lists, item), object_lists
+
+
 def get_item(storage_manager, user_context_bag, view_args) -> dict:
     view_args = view_args or {}
     if id := view_args.get("id"):

elody/policies/permission_handler.py

@@ -1,11 +1,12 @@
 import re as regex
 
-from configuration import get_object_configuration_mapper  # pyright: ignore
 from copy import deepcopy
 from elody.error_codes import ErrorCode, get_error_code, get_read
+from elody.policies.helpers import get_flat_item_and_object_lists, get_item
 from elody.util import flatten_dict, interpret_flat_key
 from inuits_policy_based_auth.contexts.user_context import UserContext
 from logging_elody.log import log  # pyright: ignore
+from storage.storagemanager import StorageManager  # pyright: ignore
 
 
 _permissions = {}
@@ -63,7 +64,7 @@ def handle_single_item_request(
         )
 
         is_allowed_to_crud_item = (
-            __is_allowed_to_crud_item(flat_item, restrictions_schema)
+            __is_allowed_to_crud_item(flat_item, restrictions_schema, user_context)
             if flat_item
             else None
         )
@@ -131,10 +132,7 @@ def __prepare_item_for_permission_check(item, permissions, crud):
     if item.get("type", "") not in permissions[crud].keys():
         return item, None, None, None
 
-    config = get_object_configuration_mapper().get(item["type"])
-    object_lists = config.document_info().get("object_lists", {})
-    flat_item = flatten_dict(object_lists, item)
-
+    flat_item, object_lists = get_flat_item_and_object_lists(item)
     return (
         item,
         flat_item,
@@ -159,13 +157,15 @@ def __get_restrictions_schema(flat_item, permissions, crud):
     return schemas[schema] if schemas and schema else {}
 
 
-def __is_allowed_to_crud_item(flat_item, restrictions_schema):
+def __is_allowed_to_crud_item(
+    flat_item, restrictions_schema, user_context: UserContext
+):
     restrictions = restrictions_schema.get("object_restrictions", {})
 
     for restricted_key, restricting_values in restrictions.items():
         restricted_key = restricted_key.split(":")[1]
         item_value_in_restricting_values = __item_value_in_values(
-            flat_item, restricted_key, restricting_values
+            flat_item, restricted_key, restricting_values, {}, user_context
         )
         if not item_value_in_restricting_values:
             return None
@@ -192,7 +192,11 @@ def __is_allowed_to_crud_item_keys(
         condition_match = True
         for condition_key, condition_values in restricting_conditions.items():
             condition_match = __item_value_in_values(
-                flat_item, condition_key, condition_values, flat_request_body
+                flat_item,
+                condition_key,
+                condition_values,
+                flat_request_body,
+                user_context,
             )
             if not condition_match:
                 break
@@ -228,7 +232,9 @@ def __is_allowed_to_crud_item_keys(
     return len(user_context.bag["restricted_keys"]) == 0
 
 
-def __item_value_in_values(flat_item, key, values: list, flat_request_body: dict = {}):
+def __item_value_in_values(
+    flat_item, key, values: list, flat_request_body, user_context: UserContext
+):
     negate_condition = False
     is_optional = False
 
@@ -239,6 +245,10 @@ def __item_value_in_values(flat_item, key, values: list, flat_request_body: dict
         key = key[1:]
         is_optional = True
 
+    key_of_relation = None
+    if (keys := key.split("@", 1)) and len(keys) == 2:
+        key = keys[0]
+        key_of_relation = keys[1].split("-", 1)[1]
     try:
         item_value = flat_request_body.get(key, flat_item[key])
         if is_optional:
@@ -249,6 +259,15 @@ def __item_value_in_values(flat_item, key, values: list, flat_request_body: dict
                 f"{get_error_code(ErrorCode.METADATA_KEY_UNDEFINED, get_read())} | key:{key} | document:{flat_item.get('_id', flat_item["type"])} - Key {key} not found in document {flat_item.get('_id', flat_item["type"])}. Either prefix the key with '?' in your permission configuration to make it an optional restriction, or patch the document to include the key. '?' will allow access if key does not exist, '!?' will deny access if key does not exist."
             )
         return not negate_condition
+    else:
+        if key_of_relation:
+            if isinstance(item_value, list):
+                item_value = item_value[0]
+            item = get_item(StorageManager(), user_context.bag, {"id": item_value})
+            flat_item, _ = get_flat_item_and_object_lists(item)
+            return __item_value_in_values(
+                flat_item, key_of_relation, values, flat_request_body, user_context
+            )
 
     expected_values = []
     for value in values:

{elody-0.0.195.dist-info → elody-0.0.197.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: elody
-Version: 0.0.195
+Version: 0.0.197
 Summary: elody SDK for Python
 Author-email: Inuits <developers@inuits.eu>
 License:                     GNU GENERAL PUBLIC LICENSE

{elody-0.0.195.dist-info → elody-0.0.197.dist-info}/RECORD

@@ -16,31 +16,31 @@ elody/object_configurations/base_object_configuration.py,sha256=8wyUq_zqRkGb4Mp1
 elody/object_configurations/elody_configuration.py,sha256=H3iqNXPhYX6scR7C57L_hCWQH2MnWKwnH3vegLg-UGw,7645
 elody/object_configurations/job_configuration.py,sha256=HMDxaRUyfqhIy0q3yQDDMH9uW5iCd7VCmqknQofXNt0,2039
 elody/policies/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-elody/policies/helpers.py,sha256=FFpCRNITO-Y9yzTBJEV70FeFwx6xTG93ddYHL5QAl10,1215
-elody/policies/permission_handler.py,sha256=C5wwgAplxmrkrseA-oNjX_Ff1PfVGP5NIvpx0F5PYho,9869
+elody/policies/helpers.py,sha256=LTV_Hmg8AN64e6t4glpKhZMsRNYCLN8FC-KQ0-7EmR8,2035
+elody/policies/permission_handler.py,sha256=dWNGzcfGoJrJjMS80-7egXzHFNaLr0UBrzXB6jwyktg,10559
 elody/policies/authentication/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 elody/policies/authentication/base_user_tenant_validation_policy.py,sha256=yyGiYy-MM63itQYwUc99FPeXt6TBW5B95FeLMfjMEok,5368
 elody/policies/authentication/multi_tenant_policy.py,sha256=g4ZYUQMmCjgLg09wj0-0lGKsJsRt7h4ppI25o1VdZHw,4039
 elody/policies/authorization/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 elody/policies/authorization/filter_generic_objects_policy.py,sha256=mF32moh8hRetBgG8vQW-rz4xjoRQD2yOxdI740SFSUo,6522
-elody/policies/authorization/filter_generic_objects_policy_v2.py,sha256=RrGFARQJnIQUvUSN8i9PvhNxzEVpNInkLGf5mK1Ch0Y,6474
+elody/policies/authorization/filter_generic_objects_policy_v2.py,sha256=_imNTxEa21DOxfn3KwCBsEIUUVkx-IAn25rpZd5gG58,6885
 elody/policies/authorization/generic_object_detail_policy.py,sha256=y6g1i3vdKMKY4xS4H2m0e1DRztrivMEomx6NkDqA0Pk,3672
 elody/policies/authorization/generic_object_mediafiles_policy.py,sha256=1-DMsV-FDkcrQCE4KL-SGlVHjTZSMPwYq1bWln2nXE4,2887
 elody/policies/authorization/generic_object_metadata_policy.py,sha256=xwtOVYmiCKgf75CydfWnV7DLI9X1yVfXPQ4-Ux0Htqk,2787
 elody/policies/authorization/generic_object_relations_policy.py,sha256=hRLeA5gXB44ufiVVaxWtAuwnXBRY1U4bLWgIadzKtmw,3712
 elody/policies/authorization/generic_object_request_policy.py,sha256=kuLczjnK5omMF2Gw5ViY_Z9MNPx_w6bNwexiMzvLiUU,4867
-elody/policies/authorization/generic_object_request_policy_v2.py,sha256=zaoCdV7KVAcMYNNXHYTi8Vtjkw_E8_w8aMqxJ62QqBE,5099
+elody/policies/authorization/generic_object_request_policy_v2.py,sha256=bD7X9zFt0AysbyVljOcvbdmbJNRQsMZRGfqs3jjHuxY,5434
 elody/policies/authorization/mediafile_derivatives_policy.py,sha256=OwNpbS8i7-LzcQDPddMWTrXk_Y4wqZxrB12Lw1dhkr0,2671
 elody/policies/authorization/mediafile_download_policy.py,sha256=XMsKavBucmTh4W1kWOzpFWxJ_ZXgHVK1RS7JB4HjtQo,1979
 elody/policies/authorization/multi_tenant_policy.py,sha256=SA9H7SBjzuh8mY3gYN7pDG8TV7hdI3GEUtNeiZeNL3M,3164
 elody/policies/authorization/tenant_request_policy.py,sha256=dEgblwRAqwWVcE-O7Jn8hVL3OnwDlQhDEOcPlcElBrk,1185
-elody-0.0.195.dist-info/licenses/LICENSE,sha256=gXf5dRMhNSbfLPYYTY_5hsZ1r7UU1OaKQEAQUhuIBkM,18092
+elody-0.0.197.dist-info/licenses/LICENSE,sha256=gXf5dRMhNSbfLPYYTY_5hsZ1r7UU1OaKQEAQUhuIBkM,18092
 tests/__init_.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 tests/data.py,sha256=Q3oxduf-E3m-Z5G_p3fcs8jVy6g10I7zXKL1m94UVMI,2906
 tests/unit/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 tests/unit/test_csv.py,sha256=NQaOhehfQ4GuXku0Y1SA8DYjJeqqidbF50zEHAi8RZA,15923
 tests/unit/test_utils.py,sha256=g63szcEZyHhCOtrW4BnNbcgVca3oYPIOLjBdIzNwwN0,8784
-elody-0.0.195.dist-info/METADATA,sha256=ryafZPjxZIEOt-tgv23aB6yqYkXrP1MtBztr4AxsrVI,23358
-elody-0.0.195.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
-elody-0.0.195.dist-info/top_level.txt,sha256=E0mImupLj0KmtUUCXRYEoLDRaSkuiGaOIIseAa0oQ-M,21
-elody-0.0.195.dist-info/RECORD,,
+elody-0.0.197.dist-info/METADATA,sha256=L8aD51TwE-M6C-b8YfpJVljODpuCw5rN0HIsQKEnjVA,23358
+elody-0.0.197.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
+elody-0.0.197.dist-info/top_level.txt,sha256=E0mImupLj0KmtUUCXRYEoLDRaSkuiGaOIIseAa0oQ-M,21
+elody-0.0.197.dist-info/RECORD,,