elody 0.0.63__py3-none-any.whl → 0.0.163__py3-none-any.whl

elody/policies/authentication/base_user_tenant_validation_policy.py

@@ -1,10 +1,15 @@
+import re as regex
+
 from abc import ABC, abstractmethod
+from configuration import get_object_configuration_mapper  # pyright: ignore
+from copy import deepcopy
+from elody.util import get_raw_id
 from inuits_policy_based_auth.contexts.user_context import (  # pyright: ignore
     UserContext,
 )
 from inuits_policy_based_auth.helpers.tenant import Tenant  # pyright: ignore
 from storage.storagemanager import StorageManager  # pyright: ignore
-from werkzeug.exceptions import Unauthorized  # pyright: ignore
+from werkzeug.exceptions import Forbidden  # pyright: ignore
 
 
 class BaseUserTenantValidationPolicy(ABC):
@@ -14,16 +19,16 @@ class BaseUserTenantValidationPolicy(ABC):
         self.user = {}
 
     @abstractmethod
-    def get_user(self, id: str) -> dict:
-        pass
+    def get_user(self, id: str, user_context: UserContext) -> dict:
+        user_context.bag["roles_from_idp"] = deepcopy(user_context.x_tenant.roles)
 
     @abstractmethod
-    def build_user_context(self, request, user_context: UserContext, user: dict):
+    def build_user_context_for_authenticated_user(
+        self, request, user_context: UserContext, user: dict
+    ):
         self.user = user
         user_context.x_tenant = Tenant()
-        user_context.x_tenant.id = request.headers.get(
-            "X-tenant-id", self.super_tenant_id
-        )
+        user_context.x_tenant.id = self._determine_tenant_id(request, user)
         user_context.x_tenant.roles = self.__get_tenant_roles(
             user_context.x_tenant.id, request
         )
@@ -33,20 +38,45 @@ class BaseUserTenantValidationPolicy(ABC):
         user_context.bag["tenant_defining_entity_id"] = user_context.x_tenant.id
         user_context.bag["tenant_relation_type"] = "isIn"
         user_context.bag["user_ids"] = self.user["identifiers"]
+        user_context.bag["http_method"] = request.method
+        user_context.bag["requested_endpoint"] = request.endpoint
+        user_context.bag["full_path"] = request.full_path
+
+    @abstractmethod
+    def build_user_context_for_anonymous_user(
+        self, user_context: UserContext, user: dict
+    ):
+        self.user = user
+        user_context.id = get_raw_id(user)
+        user_context.x_tenant = Tenant()
+        user_context.x_tenant.id = self.super_tenant_id
+        user_context.x_tenant.roles = ["anonymous"]
+        user_context.x_tenant.raw = self.__get_x_tenant_raw(user_context.x_tenant.id)
+        user_context.tenants = [user_context.x_tenant]
+        user_context.bag["x_tenant_id"] = user_context.x_tenant.id
+        user_context.bag["tenant_defining_entity_id"] = user_context.x_tenant.id
+        user_context.bag["tenant_relation_type"] = "isIn"
+        user_context.bag["user_ids"] = self.user["identifiers"]
+
+    @abstractmethod
+    def _determine_tenant_id(self, request, user) -> str:
+        pass
 
     def __get_tenant_roles(self, x_tenant_id: str, request) -> list[str]:
         roles = self.__get_user_tenant_relation(self.super_tenant_id).get("roles", [])
         if x_tenant_id != self.super_tenant_id:
             try:
                 user_tenant_relation = self.__get_user_tenant_relation(x_tenant_id)
-            except Unauthorized as error:
+            except Forbidden as error:
                 user_tenant_relation = {}
                 if len(roles) == 0:
-                    raise Unauthorized(error.description)
+                    raise Forbidden(error.description)
             roles.extend(user_tenant_relation.get("roles", []))
 
-        if len(roles) == 0 and request.path != "/tenants":
-            raise Unauthorized("User has no global roles, switch to a specific tenant.")
+        if len(roles) == 0 and not regex.match(
+            "(/[^/]+/v[0-9]+)?/tenants$", request.path
+        ):
+            raise Forbidden("User has no global roles, switch to a specific tenant.")
         return roles
 
     def __get_user_tenant_relation(self, x_tenant_id: str) -> dict:
@@ -58,18 +88,21 @@ class BaseUserTenantValidationPolicy(ABC):
 
         if not user_tenant_relation:
             if x_tenant_id != self.super_tenant_id:
-                raise Unauthorized(f"User is not a member of tenant {x_tenant_id}.")
+                raise Forbidden(f"User is not a member of tenant {x_tenant_id}.")
             else:
                 return {}
 
         return user_tenant_relation
 
     def __get_x_tenant_raw(self, x_tenant_id: str) -> dict:
+        collection = (
+            get_object_configuration_mapper().get("tenant").crud()["collection"]
+        )
         x_tenant_raw = (
-            self.storage.get_item_from_collection_by_id("entities", x_tenant_id) or {}
+            self.storage.get_item_from_collection_by_id(collection, x_tenant_id) or {}
         )
         if x_tenant_raw.get("type") != "tenant":
-            raise Unauthorized(f"No tenant {x_tenant_id} exists.")
+            raise Forbidden(f"No tenant {x_tenant_id} exists.")
 
         return x_tenant_raw
 
@@ -85,7 +118,7 @@ class BaseUserTenantValidationPolicy(ABC):
                 tenant_defining_entity_id = relation["key"]
                 break
         if not tenant_defining_entity_id:
-            raise Unauthorized(
+            raise Forbidden(
                 f"{x_tenant_raw['_id']} has no relation with a tenant defining entity."
             )
 

elody/policies/authorization/filter_generic_objects_policy.py

@@ -3,7 +3,7 @@ import re as regex
 from copy import deepcopy
 from elody.policies.permission_handler import (
     get_permissions,
-    get_mask_protected_content_post_request_hook,
+    mask_protected_content_post_request_hook,
 )
 from flask import Request  # pyright: ignore
 from inuits_policy_based_auth import BaseAuthorizationPolicy  # pyright: ignore
@@ -20,9 +20,7 @@ class FilterGenericObjectsPolicy(BaseAuthorizationPolicy):
         self, policy_context: PolicyContext, user_context: UserContext, request_context
     ):
         request: Request = request_context.http_request
-        if not user_context.auth_objects.get("token") or not regex.match(
-            "^/[^/]+/filter$", request.path
-        ):
+        if not regex.match("^(/[^/]+/v[0-9]+)?/[^/]+/filter$", request.path):
             return policy_context
 
         if not isinstance(user_context.access_restrictions.filters, list):
@@ -32,6 +30,7 @@ class FilterGenericObjectsPolicy(BaseAuthorizationPolicy):
             policy_context.access_verdict = True
             return policy_context
 
+        policy_context.access_verdict = False
         for role in user_context.x_tenant.roles:
             permissions = get_permissions(role, user_context)
             if not permissions:
@@ -46,7 +45,7 @@ class FilterGenericObjectsPolicy(BaseAuthorizationPolicy):
                 if access_verdict != None:
                     policy_context.access_verdict = access_verdict
                     if not policy_context.access_verdict:
-                        return policy_context
+                        break
 
             if policy_context.access_verdict:
                 return policy_context
@@ -60,7 +59,7 @@ class FilterGenericObjectsPolicy(BaseAuthorizationPolicy):
                 type_filter = filter
             elif (
                 filter["type"] == "selection"
-                and filter["parent_key"] == ""
+                and filter.get("parent_key", "") == ""
                 and filter["key"] == "type"
             ):
                 type_filter = filter
@@ -69,12 +68,26 @@ class FilterGenericObjectsPolicy(BaseAuthorizationPolicy):
             user_context.access_restrictions.filters.append(  # pyright: ignore
                 {
                     "type": "selection",
-                    "parent_key": "relations",
-                    "key": user_context.bag["tenant_relation_type"],
+                    "key": "type",
+                    # TODO refactor this in a more generic way
                     "value": [
-                        user_context.bag.get(
-                            "tenant_defining_entity_id", user_context.x_tenant.id
-                        )
+                        "language",
+                        "type",
+                        "collectionForm",
+                        "institution",
+                        "tag",
+                        "triple",
+                        "person",
+                        "externalRecord",
+                        "verzameling",
+                        "arches_record",
+                        "photographer",
+                        "creator",
+                        "assetPart",
+                        "set",
+                        "license",
+                        "mediafile",
+                        "share_link",
                     ],
                     "match_exact": True,
                 }
@@ -103,24 +116,57 @@ class PostRequestRules:
                 type_filter_values.remove(type_filter_value)
                 continue
 
-            restrictions = permissions["read"][type_filter_value].get(
-                "restrictions", {}
-            )
-            for parent_key in restrictions.keys():
-                for restriction in restrictions[parent_key]:
+            restrictions_grouped_by_index = {}
+            schemas = permissions["read"][type_filter_value]
+            for schema in schemas.keys():
+                restrictions = schemas[schema].get("object_restrictions", {})
+                for restricted_key, restricting_value in restrictions.items():
+                    index, restricted_key = restricted_key.split(":")
+                    prefix = ""
+                    if restricted_key[0] == "!":
+                        restricted_key = restricted_key[1:]
+                        prefix += "!"
+                    if restricted_key[0] == "?":
+                        restricted_key = restricted_key[1:]
+                        prefix += "?"
+                    key = f"{schema}|{restricted_key}"
+
+                    if group := restrictions_grouped_by_index.get(index):
+                        group["key"].append(key)
+                    else:
+                        restrictions_grouped_by_index.update(
+                            {
+                                index: {
+                                    "key": [key],
+                                    "value": restricting_value,
+                                    "prefix": prefix,
+                                }
+                            }
+                        )
+
+            for restriction in restrictions_grouped_by_index.values():
+                user_context.access_restrictions.filters.append(  # pyright: ignore
+                    {
+                        "type": "selection",
+                        "key": restriction["key"],
+                        "value": restriction["value"],
+                        "match_exact": True,
+                        "operator": "or" if restriction["prefix"] == "?" else "and",
+                    }
+                )
+                if restriction["prefix"] == "?":
                     user_context.access_restrictions.filters.append(  # pyright: ignore
                         {
-                            "type": "selection",
-                            "parent_key": parent_key if parent_key != "root" else "",
+                            "type": "text",
                             "key": restriction["key"],
-                            "value": restriction["value"],
-                            "match_exact": True,
+                            "value": "",
+                            "operator": "or",
                         }
                     )
 
         if len(type_filter_values) == 0:
-            return None
+            return False
         user_context.access_restrictions.post_request_hook = (
-            get_mask_protected_content_post_request_hook(user_context, permissions)
+            mask_protected_content_post_request_hook(user_context, permissions)
         )
         return True

elody/policies/authorization/filter_generic_objects_policy_v2.py

@@ -0,0 +1,166 @@
+import re as regex
+
+from copy import deepcopy
+from elody.policies.permission_handler import (
+    get_permissions,
+    mask_protected_content_post_request_hook,
+)
+from flask import Request  # pyright: ignore
+from inuits_policy_based_auth import BaseAuthorizationPolicy  # pyright: ignore
+from inuits_policy_based_auth.contexts.policy_context import (  # pyright: ignore
+    PolicyContext,
+)
+from inuits_policy_based_auth.contexts.user_context import (  # pyright: ignore
+    UserContext,
+)
+
+
+class FilterGenericObjectsPolicyV2(BaseAuthorizationPolicy):
+    def authorize(
+        self, policy_context: PolicyContext, user_context: UserContext, request_context
+    ):
+        request: Request = request_context.http_request
+        if not regex.match("^(/[^/]+/v[0-9]+)?/[^/]+/filter$", request.path):
+            return policy_context
+
+        if not isinstance(user_context.access_restrictions.filters, list):
+            user_context.access_restrictions.filters = []
+        type_filter, filters = self.__split_type_filter(
+            user_context, deepcopy(request.json or [])
+        )
+        if not type_filter:
+            policy_context.access_verdict = True
+            return policy_context
+
+        policy_context.access_verdict = False
+        for role in user_context.x_tenant.roles:
+            permissions = get_permissions(role, user_context)
+            if not permissions:
+                continue
+
+            rules = [PostRequestRules]
+            access_verdict = None
+            for rule in rules:
+                access_verdict = rule().apply(
+                    type_filter["value"], filters, user_context, request, permissions
+                )
+                if access_verdict != None:
+                    policy_context.access_verdict = access_verdict
+                    if not policy_context.access_verdict:
+                        break
+
+            if policy_context.access_verdict:
+                return policy_context
+
+        return policy_context
+
+    def __split_type_filter(self, user_context: UserContext, request_body: list):
+        type_filter = None
+        for filter in request_body:
+            if filter["type"] == "type":
+                type_filter = filter
+            elif filter["type"] == "selection" and filter["key"] == "type":
+                type_filter = filter
+            elif item_types := filter.get("item_types"):
+                type_filter = {
+                    "type": "selection",
+                    "key": "type",
+                    "value": item_types,
+                    "match_exact": True,
+                }
+
+        if not type_filter:
+            if tenant_relation_type := user_context.bag.get("tenant_relation_type"):
+                user_context.access_restrictions.filters.append(  # pyright: ignore
+                    {
+                        "type": "selection",
+                        "key": tenant_relation_type,
+                        "value": [
+                            user_context.bag.get(
+                                "tenant_defining_entity_id", user_context.x_tenant.id
+                            )
+                        ],
+                        "match_exact": True,
+                    }
+                )
+            return None, request_body
+
+        try:
+            request_body.remove(type_filter)
+        except ValueError:
+            pass
+        return type_filter, request_body
+
+
+class PostRequestRules:
+    def apply(
+        self,
+        type_filter_values: str | list[str],
+        filters: list[dict],
+        user_context: UserContext,
+        request: Request,
+        permissions,
+    ) -> bool | None:
+        if request.method != "POST":
+            return None
+
+        if isinstance(type_filter_values, str):
+            type_filter_values = [type_filter_values]
+
+        type_filter_values_copy = deepcopy(type_filter_values)
+        for type_filter_value in type_filter_values_copy:
+            if type_filter_value not in permissions["read"].keys():
+                type_filter_values.remove(type_filter_value)
+                continue
+
+            restrictions_grouped_by_index = {}
+            schemas = permissions["read"][type_filter_value]
+            for schema in schemas.keys():
+                restrictions = schemas[schema].get("object_restrictions", {})
+                for restricted_key, restricting_value in restrictions.items():
+                    index, restricted_key = restricted_key.split(":")
+                    key = f"{schema}|{restricted_key}"
+                    if group := restrictions_grouped_by_index.get(index):
+                        group["key"].append(key)
+                    else:
+                        restrictions_grouped_by_index.update(
+                            {
+                                index: {
+                                    "key": [key],
+                                    "value": restricting_value,
+                                }
+                            }
+                        )
+
+            # support false soft call read responses
+            for filter in filters:
+                key = filter.get("key", "")
+                if isinstance(key, list):
+                    key = ",".join(key)
+                for restriction in restrictions_grouped_by_index.values():
+                    if key not in ",".join(restriction["key"]):
+                        continue
+                    values = (
+                        filter["value"]
+                        if isinstance(filter["value"], list)
+                        else [filter["value"]]
+                    )
+                    if not any(value in restriction["value"] for value in values):
+                        return False
+
+            for restriction in restrictions_grouped_by_index.values():
+                user_context.access_restrictions.filters.append(  # pyright: ignore
+                    {
+                        "type": "selection",
+                        "key": restriction["key"],
+                        "value": restriction["value"],
+                        "match_exact": True,
+                    }
+                )
+
+        if len(type_filter_values) == 0:
+            return False
+        user_context.access_restrictions.post_request_hook = (
+            mask_protected_content_post_request_hook(user_context, permissions)
+        )
+        return True

elody/policies/authorization/generic_object_detail_policy.py

@@ -1,12 +1,11 @@
 import re as regex
 
+from elody.policies.helpers import get_content, get_item
 from elody.policies.permission_handler import (
-    get_mask_protected_content_post_request_hook,
     get_permissions,
     handle_single_item_request,
 )
 from flask import Request  # pyright: ignore
-from flask_restful import abort  # pyright: ignore
 from inuits_policy_based_auth import BaseAuthorizationPolicy  # pyright: ignore
 from inuits_policy_based_auth.contexts.policy_context import (  # pyright: ignore
     PolicyContext,
@@ -22,27 +21,10 @@ class GenericObjectDetailPolicy(BaseAuthorizationPolicy):
         self, policy_context: PolicyContext, user_context: UserContext, request_context
     ):
         request: Request = request_context.http_request
-        if not user_context.auth_objects.get("token") or not regex.match(
-            "^/[^/]+/[^/]+$|^/ngsi-ld/v1/entities/[^/]+$", request.path
-        ):
+        if not regex.match("^(/[^/]+/v[0-9]+)?/[^/]+/[^/]+$", request.path):
             return policy_context
 
-        view_args = request.view_args or {}
-        collection = "entities"
-        if not request.path.startswith("/ngsi-ld/v1/entities"):
-            collection = request.path.split("/")[1]
-        id = view_args.get("id")
-        item = (
-            StorageManager()
-            .get_db_engine()
-            .get_item_from_collection_by_id(view_args.get("collection", collection), id)
-        )
-        if not item:
-            abort(
-                404,
-                message=f"Item with id {id} doesn't exist in collection {collection}",
-            )
-
+        item = get_item(StorageManager(), user_context.bag, request.view_args)
         for role in user_context.x_tenant.roles:
             permissions = get_permissions(role, user_context)
             if not permissions:
@@ -61,7 +43,7 @@ class GenericObjectDetailPolicy(BaseAuthorizationPolicy):
                 if access_verdict != None:
                     policy_context.access_verdict = access_verdict
                     if not policy_context.access_verdict:
-                        return policy_context
+                        break
 
             if policy_context.access_verdict:
                 return policy_context
@@ -75,6 +57,7 @@ class PostRequestRules:
     ) -> bool | None:
         if request.method != "POST":
             return None
+
         return handle_single_item_request(user_context, item, permissions, "create")
 
 
@@ -85,9 +68,6 @@ class GetRequestRules:
         if request.method != "GET":
             return None
 
-        user_context.access_restrictions.post_request_hook = (
-            get_mask_protected_content_post_request_hook(user_context, permissions)
-        )
         return handle_single_item_request(user_context, item, permissions, "read")
 
 
@@ -98,8 +78,9 @@ class PutRequestRules:
         if request.method != "PUT":
             return None
 
+        content = get_content(item, request, request.json)
         return handle_single_item_request(
-            user_context, item, permissions, "update", request.json
+            user_context, item, permissions, "update", content
         )
 
 
@@ -110,8 +91,9 @@ class PatchRequestRules:
         if request.method != "PATCH":
             return None
 
+        content = get_content(item, request, request.json)
         return handle_single_item_request(
-            user_context, item, permissions, "update", request.json
+            user_context, item, permissions, "update", content
         )
 
 
@@ -121,4 +103,5 @@ class DeleteRequestRules:
     ) -> bool | None:
         if request.method != "DELETE":
             return None
+
         return handle_single_item_request(user_context, item, permissions, "delete")

elody/policies/authorization/generic_object_mediafiles_policy.py

@@ -0,0 +1,82 @@
+import re as regex
+
+from elody.error_codes import ErrorCode, get_error_code, get_read, get_write
+from elody.policies.permission_handler import (
+    get_permissions,
+    handle_single_item_request,
+)
+from flask import Request  # pyright: ignore
+from flask_restful import abort  # pyright: ignore
+from inuits_policy_based_auth import BaseAuthorizationPolicy  # pyright: ignore
+from inuits_policy_based_auth.contexts.policy_context import (  # pyright: ignore
+    PolicyContext,
+)
+from inuits_policy_based_auth.contexts.user_context import (  # pyright: ignore
+    UserContext,
+)
+from storage.storagemanager import StorageManager  # pyright: ignore
+
+
+class GenericObjectMediafilesPolicy(BaseAuthorizationPolicy):
+    def authorize(
+        self, policy_context: PolicyContext, user_context: UserContext, request_context
+    ):
+        request: Request = request_context.http_request
+        if not regex.match("^(/[^/]+/v[0-9]+)?/[^/]+/[^/]+/mediafiles$", request.path):
+            return policy_context
+
+        view_args = request.view_args or {}
+        collection = view_args.get("collection", request.path.split("/")[-3])
+        id = view_args.get("id")
+        item = (
+            StorageManager()
+            .get_db_engine()
+            .get_item_from_collection_by_id(collection, id)
+        )
+        if not item:
+            abort(
+                404,
+                message=f"{get_error_code(ErrorCode.ITEM_NOT_FOUND_IN_COLLECTION, get_read())} | id:{id} | collection:{collection} - Item with id {id} doesn't exist in collection {collection}",
+            )
+
+        for role in user_context.x_tenant.roles:
+            permissions = get_permissions(role, user_context)
+            if not permissions:
+                continue
+
+            rules = [
+                PostRequestRules,
+                GetRequestRules,
+            ]
+            access_verdict = None
+            for rule in rules:
+                access_verdict = rule().apply(item, user_context, request, permissions)
+                if access_verdict != None:
+                    policy_context.access_verdict = access_verdict
+                    if not policy_context.access_verdict:
+                        break
+
+            if policy_context.access_verdict:
+                return policy_context
+
+        return policy_context
+
+
+class PostRequestRules:
+    def apply(
+        self, item, user_context: UserContext, request: Request, permissions
+    ) -> bool | None:
+        if request.method != "POST":
+            return None
+
+        return handle_single_item_request(user_context, item, permissions, "create")
+
+
+class GetRequestRules:
+    def apply(
+        self, item, user_context: UserContext, request: Request, permissions
+    ) -> bool | None:
+        if request.method != "GET":
+            return None
+
+        return handle_single_item_request(user_context, item, permissions, "read")