elody 0.0.63__py3-none-any.whl → 0.0.162__py3-none-any.whl

elody/policies/authorization/filter_generic_objects_policy.py

@@ -3,7 +3,7 @@ import re as regex
 from copy import deepcopy
 from elody.policies.permission_handler import (
     get_permissions,
-    get_mask_protected_content_post_request_hook,
+    mask_protected_content_post_request_hook,
 )
 from flask import Request  # pyright: ignore
 from inuits_policy_based_auth import BaseAuthorizationPolicy  # pyright: ignore
@@ -20,9 +20,7 @@ class FilterGenericObjectsPolicy(BaseAuthorizationPolicy):
         self, policy_context: PolicyContext, user_context: UserContext, request_context
     ):
         request: Request = request_context.http_request
-        if not user_context.auth_objects.get("token") or not regex.match(
-            "^/[^/]+/filter$", request.path
-        ):
+        if not regex.match("^(/[^/]+/v[0-9]+)?/[^/]+/filter$", request.path):
             return policy_context
 
         if not isinstance(user_context.access_restrictions.filters, list):
@@ -32,6 +30,7 @@ class FilterGenericObjectsPolicy(BaseAuthorizationPolicy):
             policy_context.access_verdict = True
             return policy_context
 
+        policy_context.access_verdict = False
         for role in user_context.x_tenant.roles:
             permissions = get_permissions(role, user_context)
             if not permissions:
@@ -46,7 +45,7 @@ class FilterGenericObjectsPolicy(BaseAuthorizationPolicy):
                 if access_verdict != None:
                     policy_context.access_verdict = access_verdict
                     if not policy_context.access_verdict:
-                        return policy_context
+                        break
 
             if policy_context.access_verdict:
                 return policy_context
@@ -60,7 +59,7 @@ class FilterGenericObjectsPolicy(BaseAuthorizationPolicy):
                 type_filter = filter
             elif (
                 filter["type"] == "selection"
-                and filter["parent_key"] == ""
+                and filter.get("parent_key", "") == ""
                 and filter["key"] == "type"
             ):
                 type_filter = filter
@@ -69,12 +68,26 @@ class FilterGenericObjectsPolicy(BaseAuthorizationPolicy):
             user_context.access_restrictions.filters.append(  # pyright: ignore
                 {
                     "type": "selection",
-                    "parent_key": "relations",
-                    "key": user_context.bag["tenant_relation_type"],
+                    "key": "type",
+                    # TODO refactor this in a more generic way
                     "value": [
-                        user_context.bag.get(
-                            "tenant_defining_entity_id", user_context.x_tenant.id
-                        )
+                        "language",
+                        "type",
+                        "collectionForm",
+                        "institution",
+                        "tag",
+                        "triple",
+                        "person",
+                        "externalRecord",
+                        "verzameling",
+                        "arches_record",
+                        "photographer",
+                        "creator",
+                        "assetPart",
+                        "set",
+                        "license",
+                        "mediafile",
+                        "share_link",
                     ],
                     "match_exact": True,
                 }
@@ -103,24 +116,57 @@ class PostRequestRules:
                 type_filter_values.remove(type_filter_value)
                 continue
 
-            restrictions = permissions["read"][type_filter_value].get(
-                "restrictions", {}
-            )
-            for parent_key in restrictions.keys():
-                for restriction in restrictions[parent_key]:
+            restrictions_grouped_by_index = {}
+            schemas = permissions["read"][type_filter_value]
+            for schema in schemas.keys():
+                restrictions = schemas[schema].get("object_restrictions", {})
+                for restricted_key, restricting_value in restrictions.items():
+                    index, restricted_key = restricted_key.split(":")
+                    prefix = ""
+                    if restricted_key[0] == "!":
+                        restricted_key = restricted_key[1:]
+                        prefix += "!"
+                    if restricted_key[0] == "?":
+                        restricted_key = restricted_key[1:]
+                        prefix += "?"
+                    key = f"{schema}|{restricted_key}"
+
+                    if group := restrictions_grouped_by_index.get(index):
+                        group["key"].append(key)
+                    else:
+                        restrictions_grouped_by_index.update(
+                            {
+                                index: {
+                                    "key": [key],
+                                    "value": restricting_value,
+                                    "prefix": prefix,
+                                }
+                            }
+                        )
+
+            for restriction in restrictions_grouped_by_index.values():
+                user_context.access_restrictions.filters.append(  # pyright: ignore
+                    {
+                        "type": "selection",
+                        "key": restriction["key"],
+                        "value": restriction["value"],
+                        "match_exact": True,
+                        "operator": "or" if restriction["prefix"] == "?" else "and",
+                    }
+                )
+                if restriction["prefix"] == "?":
                     user_context.access_restrictions.filters.append(  # pyright: ignore
                         {
-                            "type": "selection",
-                            "parent_key": parent_key if parent_key != "root" else "",
+                            "type": "text",
                             "key": restriction["key"],
-                            "value": restriction["value"],
-                            "match_exact": True,
+                            "value": "",
+                            "operator": "or",
                         }
                     )
 
         if len(type_filter_values) == 0:
-            return None
+            return False
         user_context.access_restrictions.post_request_hook = (
-            get_mask_protected_content_post_request_hook(user_context, permissions)
+            mask_protected_content_post_request_hook(user_context, permissions)
         )
         return True

elody/policies/authorization/filter_generic_objects_policy_v2.py

@@ -0,0 +1,166 @@
+import re as regex
+
+from copy import deepcopy
+from elody.policies.permission_handler import (
+    get_permissions,
+    mask_protected_content_post_request_hook,
+)
+from flask import Request  # pyright: ignore
+from inuits_policy_based_auth import BaseAuthorizationPolicy  # pyright: ignore
+from inuits_policy_based_auth.contexts.policy_context import (  # pyright: ignore
+    PolicyContext,
+)
+from inuits_policy_based_auth.contexts.user_context import (  # pyright: ignore
+    UserContext,
+)
+
+
+class FilterGenericObjectsPolicyV2(BaseAuthorizationPolicy):
+    def authorize(
+        self, policy_context: PolicyContext, user_context: UserContext, request_context
+    ):
+        request: Request = request_context.http_request
+        if not regex.match("^(/[^/]+/v[0-9]+)?/[^/]+/filter$", request.path):
+            return policy_context
+
+        if not isinstance(user_context.access_restrictions.filters, list):
+            user_context.access_restrictions.filters = []
+        type_filter, filters = self.__split_type_filter(
+            user_context, deepcopy(request.json or [])
+        )
+        if not type_filter:
+            policy_context.access_verdict = True
+            return policy_context
+
+        policy_context.access_verdict = False
+        for role in user_context.x_tenant.roles:
+            permissions = get_permissions(role, user_context)
+            if not permissions:
+                continue
+
+            rules = [PostRequestRules]
+            access_verdict = None
+            for rule in rules:
+                access_verdict = rule().apply(
+                    type_filter["value"], filters, user_context, request, permissions
+                )
+                if access_verdict != None:
+                    policy_context.access_verdict = access_verdict
+                    if not policy_context.access_verdict:
+                        break
+
+            if policy_context.access_verdict:
+                return policy_context
+
+        return policy_context
+
+    def __split_type_filter(self, user_context: UserContext, request_body: list):
+        type_filter = None
+        for filter in request_body:
+            if filter["type"] == "type":
+                type_filter = filter
+            elif filter["type"] == "selection" and filter["key"] == "type":
+                type_filter = filter
+            elif item_types := filter.get("item_types"):
+                type_filter = {
+                    "type": "selection",
+                    "key": "type",
+                    "value": item_types,
+                    "match_exact": True,
+                }
+
+        if not type_filter:
+            if tenant_relation_type := user_context.bag.get("tenant_relation_type"):
+                user_context.access_restrictions.filters.append(  # pyright: ignore
+                    {
+                        "type": "selection",
+                        "key": tenant_relation_type,
+                        "value": [
+                            user_context.bag.get(
+                                "tenant_defining_entity_id", user_context.x_tenant.id
+                            )
+                        ],
+                        "match_exact": True,
+                    }
+                )
+            return None, request_body
+
+        try:
+            request_body.remove(type_filter)
+        except ValueError:
+            pass
+        return type_filter, request_body
+
+
+class PostRequestRules:
+    def apply(
+        self,
+        type_filter_values: str | list[str],
+        filters: list[dict],
+        user_context: UserContext,
+        request: Request,
+        permissions,
+    ) -> bool | None:
+        if request.method != "POST":
+            return None
+
+        if isinstance(type_filter_values, str):
+            type_filter_values = [type_filter_values]
+
+        type_filter_values_copy = deepcopy(type_filter_values)
+        for type_filter_value in type_filter_values_copy:
+            if type_filter_value not in permissions["read"].keys():
+                type_filter_values.remove(type_filter_value)
+                continue
+
+            restrictions_grouped_by_index = {}
+            schemas = permissions["read"][type_filter_value]
+            for schema in schemas.keys():
+                restrictions = schemas[schema].get("object_restrictions", {})
+                for restricted_key, restricting_value in restrictions.items():
+                    index, restricted_key = restricted_key.split(":")
+                    key = f"{schema}|{restricted_key}"
+                    if group := restrictions_grouped_by_index.get(index):
+                        group["key"].append(key)
+                    else:
+                        restrictions_grouped_by_index.update(
+                            {
+                                index: {
+                                    "key": [key],
+                                    "value": restricting_value,
+                                }
+                            }
+                        )
+
+            # support false soft call read responses
+            for filter in filters:
+                key = filter.get("key", "")
+                if isinstance(key, list):
+                    key = ",".join(key)
+                for restriction in restrictions_grouped_by_index.values():
+                    if key not in ",".join(restriction["key"]):
+                        continue
+                    values = (
+                        filter["value"]
+                        if isinstance(filter["value"], list)
+                        else [filter["value"]]
+                    )
+                    if not any(value in restriction["value"] for value in values):
+                        return False
+
+            for restriction in restrictions_grouped_by_index.values():
+                user_context.access_restrictions.filters.append(  # pyright: ignore
+                    {
+                        "type": "selection",
+                        "key": restriction["key"],
+                        "value": restriction["value"],
+                        "match_exact": True,
+                    }
+                )
+
+        if len(type_filter_values) == 0:
+            return False
+        user_context.access_restrictions.post_request_hook = (
+            mask_protected_content_post_request_hook(user_context, permissions)
+        )
+        return True

elody/policies/authorization/generic_object_detail_policy.py

@@ -1,12 +1,11 @@
 import re as regex
 
+from elody.policies.helpers import get_content, get_item
 from elody.policies.permission_handler import (
-    get_mask_protected_content_post_request_hook,
     get_permissions,
     handle_single_item_request,
 )
 from flask import Request  # pyright: ignore
-from flask_restful import abort  # pyright: ignore
 from inuits_policy_based_auth import BaseAuthorizationPolicy  # pyright: ignore
 from inuits_policy_based_auth.contexts.policy_context import (  # pyright: ignore
     PolicyContext,
@@ -22,27 +21,10 @@ class GenericObjectDetailPolicy(BaseAuthorizationPolicy):
         self, policy_context: PolicyContext, user_context: UserContext, request_context
     ):
         request: Request = request_context.http_request
-        if not user_context.auth_objects.get("token") or not regex.match(
-            "^/[^/]+/[^/]+$|^/ngsi-ld/v1/entities/[^/]+$", request.path
-        ):
+        if not regex.match("^(/[^/]+/v[0-9]+)?/[^/]+/[^/]+$", request.path):
             return policy_context
 
-        view_args = request.view_args or {}
-        collection = "entities"
-        if not request.path.startswith("/ngsi-ld/v1/entities"):
-            collection = request.path.split("/")[1]
-        id = view_args.get("id")
-        item = (
-            StorageManager()
-            .get_db_engine()
-            .get_item_from_collection_by_id(view_args.get("collection", collection), id)
-        )
-        if not item:
-            abort(
-                404,
-                message=f"Item with id {id} doesn't exist in collection {collection}",
-            )
-
+        item = get_item(StorageManager(), user_context.bag, request.view_args)
         for role in user_context.x_tenant.roles:
             permissions = get_permissions(role, user_context)
             if not permissions:
@@ -61,7 +43,7 @@ class GenericObjectDetailPolicy(BaseAuthorizationPolicy):
                 if access_verdict != None:
                     policy_context.access_verdict = access_verdict
                     if not policy_context.access_verdict:
-                        return policy_context
+                        break
 
             if policy_context.access_verdict:
                 return policy_context
@@ -75,6 +57,7 @@ class PostRequestRules:
     ) -> bool | None:
         if request.method != "POST":
             return None
+
         return handle_single_item_request(user_context, item, permissions, "create")
 
 
@@ -85,9 +68,6 @@ class GetRequestRules:
         if request.method != "GET":
             return None
 
-        user_context.access_restrictions.post_request_hook = (
-            get_mask_protected_content_post_request_hook(user_context, permissions)
-        )
         return handle_single_item_request(user_context, item, permissions, "read")
 
 
@@ -98,8 +78,9 @@ class PutRequestRules:
         if request.method != "PUT":
             return None
 
+        content = get_content(item, request, request.json)
         return handle_single_item_request(
-            user_context, item, permissions, "update", request.json
+            user_context, item, permissions, "update", content
         )
 
 
@@ -110,8 +91,9 @@ class PatchRequestRules:
         if request.method != "PATCH":
             return None
 
+        content = get_content(item, request, request.json)
         return handle_single_item_request(
-            user_context, item, permissions, "update", request.json
+            user_context, item, permissions, "update", content
         )
 
 
@@ -121,4 +103,5 @@ class DeleteRequestRules:
     ) -> bool | None:
         if request.method != "DELETE":
             return None
+
         return handle_single_item_request(user_context, item, permissions, "delete")

elody/policies/authorization/generic_object_mediafiles_policy.py

@@ -0,0 +1,82 @@
+import re as regex
+
+from elody.error_codes import ErrorCode, get_error_code, get_read, get_write
+from elody.policies.permission_handler import (
+    get_permissions,
+    handle_single_item_request,
+)
+from flask import Request  # pyright: ignore
+from flask_restful import abort  # pyright: ignore
+from inuits_policy_based_auth import BaseAuthorizationPolicy  # pyright: ignore
+from inuits_policy_based_auth.contexts.policy_context import (  # pyright: ignore
+    PolicyContext,
+)
+from inuits_policy_based_auth.contexts.user_context import (  # pyright: ignore
+    UserContext,
+)
+from storage.storagemanager import StorageManager  # pyright: ignore
+
+
+class GenericObjectMediafilesPolicy(BaseAuthorizationPolicy):
+    def authorize(
+        self, policy_context: PolicyContext, user_context: UserContext, request_context
+    ):
+        request: Request = request_context.http_request
+        if not regex.match("^(/[^/]+/v[0-9]+)?/[^/]+/[^/]+/mediafiles$", request.path):
+            return policy_context
+
+        view_args = request.view_args or {}
+        collection = view_args.get("collection", request.path.split("/")[-3])
+        id = view_args.get("id")
+        item = (
+            StorageManager()
+            .get_db_engine()
+            .get_item_from_collection_by_id(collection, id)
+        )
+        if not item:
+            abort(
+                404,
+                message=f"{get_error_code(ErrorCode.ITEM_NOT_FOUND_IN_COLLECTION, get_read())} | id:{id} | collection:{collection} - Item with id {id} doesn't exist in collection {collection}",
+            )
+
+        for role in user_context.x_tenant.roles:
+            permissions = get_permissions(role, user_context)
+            if not permissions:
+                continue
+
+            rules = [
+                PostRequestRules,
+                GetRequestRules,
+            ]
+            access_verdict = None
+            for rule in rules:
+                access_verdict = rule().apply(item, user_context, request, permissions)
+                if access_verdict != None:
+                    policy_context.access_verdict = access_verdict
+                    if not policy_context.access_verdict:
+                        break
+
+            if policy_context.access_verdict:
+                return policy_context
+
+        return policy_context
+
+
+class PostRequestRules:
+    def apply(
+        self, item, user_context: UserContext, request: Request, permissions
+    ) -> bool | None:
+        if request.method != "POST":
+            return None
+
+        return handle_single_item_request(user_context, item, permissions, "create")
+
+
+class GetRequestRules:
+    def apply(
+        self, item, user_context: UserContext, request: Request, permissions
+    ) -> bool | None:
+        if request.method != "GET":
+            return None
+
+        return handle_single_item_request(user_context, item, permissions, "read")

elody/policies/authorization/generic_object_metadata_policy.py

@@ -1,12 +1,11 @@
 import re as regex
 
+from elody.policies.helpers import get_content, get_item
 from elody.policies.permission_handler import (
-    get_mask_protected_content_post_request_hook,
     get_permissions,
     handle_single_item_request,
 )
 from flask import Request  # pyright: ignore
-from flask_restful import abort  # pyright: ignore
 from inuits_policy_based_auth import BaseAuthorizationPolicy  # pyright: ignore
 from inuits_policy_based_auth.contexts.policy_context import (  # pyright: ignore
     PolicyContext,
@@ -22,25 +21,10 @@ class GenericObjectMetadataPolicy(BaseAuthorizationPolicy):
         self, policy_context: PolicyContext, user_context: UserContext, request_context
     ):
         request: Request = request_context.http_request
-        if not user_context.auth_objects.get("token") or not regex.match(
-            "^/[^/]+/[^/]+/metadata$", request.path
-        ):
+        if not regex.match("^(/elody/v[0-9]+)?/[^/]+/[^/]+/metadata$", request.path):
             return policy_context
 
-        view_args = request.view_args or {}
-        collection = view_args.get("collection", request.path.split("/")[1])
-        id = view_args.get("id")
-        item = (
-            StorageManager()
-            .get_db_engine()
-            .get_item_from_collection_by_id(collection, id)
-        )
-        if not item:
-            abort(
-                404,
-                message=f"Item with id {id} doesn't exist in collection {collection}",
-            )
-
+        item = get_item(StorageManager(), user_context.bag, request.view_args)
         for role in user_context.x_tenant.roles:
             permissions = get_permissions(role, user_context)
             if not permissions:
@@ -53,7 +37,7 @@ class GenericObjectMetadataPolicy(BaseAuthorizationPolicy):
                 if access_verdict != None:
                     policy_context.access_verdict = access_verdict
                     if not policy_context.access_verdict:
-                        return policy_context
+                        break
 
             if policy_context.access_verdict:
                 return policy_context
@@ -68,11 +52,6 @@ class GetRequestRules:
         if request.method != "GET":
             return None
 
-        user_context.access_restrictions.post_request_hook = (
-            get_mask_protected_content_post_request_hook(
-                user_context, permissions, item["type"]
-            )
-        )
         return handle_single_item_request(user_context, item, permissions, "read")
 
 
@@ -83,8 +62,9 @@ class PutRequestRules:
         if request.method != "PUT":
             return None
 
+        content = get_content(item, request, {"metadata": request.json})
         return handle_single_item_request(
-            user_context, item, permissions, "update", {"metadata": request.json}
+            user_context, item, permissions, "update", content
         )
 
 
@@ -95,6 +75,7 @@ class PatchRequestRules:
         if request.method != "PATCH":
             return None
 
+        content = get_content(item, request, {"metadata": request.json})
         return handle_single_item_request(
-            user_context, item, permissions, "update", {"metadata": request.json}
+            user_context, item, permissions, "update", content
         )

elody/policies/authorization/generic_object_relations_policy.py

@@ -1,12 +1,11 @@
 import re as regex
 
+from elody.policies.helpers import get_content, get_item
 from elody.policies.permission_handler import (
-    get_mask_protected_content_post_request_hook,
     get_permissions,
     handle_single_item_request,
 )
 from flask import Request  # pyright: ignore
-from flask_restful import abort  # pyright: ignore
 from inuits_policy_based_auth import BaseAuthorizationPolicy  # pyright: ignore
 from inuits_policy_based_auth.contexts.policy_context import (  # pyright: ignore
     PolicyContext,
@@ -22,25 +21,10 @@ class GenericObjectRelationsPolicy(BaseAuthorizationPolicy):
         self, policy_context: PolicyContext, user_context: UserContext, request_context
     ):
         request: Request = request_context.http_request
-        if not user_context.auth_objects.get("token") or not regex.match(
-            "^/[^/]+/[^/]+/relations$", request.path
-        ):
+        if not regex.match("^(/elody/v[0-9]+)?/[^/]+/[^/]+/relations$", request.path):
             return policy_context
 
-        view_args = request.view_args or {}
-        collection = view_args.get("collection", request.path.split("/")[1])
-        id = view_args.get("id")
-        item = (
-            StorageManager()
-            .get_db_engine()
-            .get_item_from_collection_by_id(collection, id)
-        )
-        if not item:
-            abort(
-                404,
-                message=f"Item with id {id} doesn't exist in collection {collection}",
-            )
-
+        item = get_item(StorageManager(), user_context.bag, request.view_args)
         for role in user_context.x_tenant.roles:
             permissions = get_permissions(role, user_context)
             if not permissions:
@@ -59,7 +43,7 @@ class GenericObjectRelationsPolicy(BaseAuthorizationPolicy):
                 if access_verdict != None:
                     policy_context.access_verdict = access_verdict
                     if not policy_context.access_verdict:
-                        return policy_context
+                        break
 
             if policy_context.access_verdict:
                 return policy_context
@@ -74,8 +58,9 @@ class PostRequestRules:
         if request.method != "POST":
             return None
 
+        content = get_content(item, request, {"relations": request.json})
         return handle_single_item_request(
-            user_context, item, permissions, "create", {"relations": request.json}
+            user_context, item, permissions, "create", content
         )
 
 
@@ -86,11 +71,6 @@ class GetRequestRules:
         if request.method != "GET":
             return None
 
-        user_context.access_restrictions.post_request_hook = (
-            get_mask_protected_content_post_request_hook(
-                user_context, permissions, item["type"]
-            )
-        )
         return handle_single_item_request(user_context, item, permissions, "read")
 
 
@@ -101,8 +81,9 @@ class PutRequestRules:
         if request.method != "PUT":
             return None
 
+        content = get_content(item, request, {"relations": request.json})
         return handle_single_item_request(
-            user_context, item, permissions, "update", {"relations": request.json}
+            user_context, item, permissions, "update", content
         )
 
 
@@ -113,8 +94,9 @@ class PatchRequestRules:
         if request.method != "PATCH":
             return None
 
+        content = get_content(item, request, {"relations": request.json})
         return handle_single_item_request(
-            user_context, item, permissions, "update", {"relations": request.json}
+            user_context, item, permissions, "update", content
         )
 
 
@@ -125,6 +107,7 @@ class DeleteRequestRules:
         if request.method != "DELETE":
             return None
 
+        content = get_content(item, request, {"relations": request.json})
         return handle_single_item_request(
-            user_context, item, permissions, "delete", {"relations": request.json}
+            user_context, item, permissions, "delete", content
         )