infrahub-server 1.1.1__py3-none-any.whl → 1.1.3__py3-none-any.whl

infrahub/graphql/mutations/proposed_change.py

@@ -13,10 +13,9 @@ from infrahub.core.constants import (
 )
 from infrahub.core.manager import NodeManager
 from infrahub.core.node import Node
-from infrahub.core.registry import registry
 from infrahub.core.schema import NodeSchema
 from infrahub.database import InfrahubDatabase, retry_db_transaction
-from infrahub.exceptions import BranchNotFoundError, ValidationError
+from infrahub.exceptions import BranchNotFoundError, PermissionDeniedError, ValidationError
 from infrahub.graphql.mutations.main import InfrahubMutationMixin
 from infrahub.graphql.types.enums import CheckType as GraphQLCheckType
 from infrahub.message_bus import messages
@@ -92,22 +91,6 @@ class InfrahubProposedChangeMutation(InfrahubMutationMixin, Mutation):
     ):
         context: GraphqlContext = info.context
 
-        has_merge_permission = False
-        if context.account_session:
-            for permission_backend in registry.permission_backends:
-                if has_merge_permission := await permission_backend.has_permission(
-                    db=context.db,
-                    account_session=context.active_account_session,
-                    permission=GlobalPermission(
-                        action=GlobalPermissions.MERGE_PROPOSED_CHANGE.value,
-                        decision=PermissionDecision.ALLOW_ALL.value,
-                    ),
-                    branch=branch,
-                ):
-                    break
-        else:
-            has_merge_permission = True
-
         obj = await NodeManager.get_one_by_id_or_default_filter(
             db=context.db,
             kind=cls._meta.schema.kind,
@@ -125,8 +108,16 @@ class InfrahubProposedChangeMutation(InfrahubMutationMixin, Mutation):
             state.validate_state_transition(updated_state)
 
         # Check before starting a transaction, stopping in the middle of the transaction seems to break with memgraph
-        if updated_state == ProposedChangeState.MERGED and not has_merge_permission:
-            raise ValidationError("You do not have the permission to merge proposed changes")
+        if updated_state == ProposedChangeState.MERGED and context.account_session:
+            try:
+                context.active_permissions.raise_for_permission(
+                    permission=GlobalPermission(
+                        action=GlobalPermissions.MERGE_PROPOSED_CHANGE.value,
+                        decision=PermissionDecision.ALLOW_ALL.value,
+                    )
+                )
+            except PermissionDeniedError as exc:
+                raise ValidationError(str(exc)) from exc
 
         if updated_state == ProposedChangeState.MERGED:
             data["state"]["value"] = ProposedChangeState.MERGING.value

infrahub/graphql/mutations/resource_manager.py

@@ -10,6 +10,7 @@ from infrahub.core import registry
 from infrahub.core.constants import InfrahubKind
 from infrahub.core.ipam.constants import PrefixMemberType
 from infrahub.core.schema import NodeSchema
+from infrahub.database import retry_db_transaction
 from infrahub.exceptions import QueryValidationError, SchemaNotFoundError, ValidationError
 
 from ..queries.resource_manager import PoolAllocatedNode
@@ -32,7 +33,7 @@ class IPPrefixPoolGetResourceInput(InputObjectType):
     hfid = InputField(String(required=False), description="HFID of the pool to allocate from")
     identifier = InputField(String(required=False), description="Identifier for the allocated resource")
     prefix_length = InputField(Int(required=False), description="Size of the prefix to allocate")
-    member_type = InputField(String(required=False), description="member_type of the newly created prefix")
+    member_type = InputField(String(required=False), description="Type of members for the newly created prefix")
     prefix_type = InputField(String(required=False), description="Kind of prefix to allocate")
     data = InputField(GenericScalar(required=False), description="Additional data to pass to the newly created prefix")
 
@@ -44,9 +45,9 @@ class IPAddressPoolGetResourceInput(InputObjectType):
     prefix_length = InputField(
         Int(required=False), description="Size of the prefix mask to allocate on the new IP address"
     )
-    address_type = InputField(String(required=False), description="Kind of ip address to allocate")
+    address_type = InputField(String(required=False), description="Kind of IP address to allocate")
     data = InputField(
-        GenericScalar(required=False), description="Additional data to pass to the newly created ip address"
+        GenericScalar(required=False), description="Additional data to pass to the newly created IP address"
     )
 
 
@@ -167,6 +168,7 @@ class InfrahubNumberPoolMutation(InfrahubMutationMixin, Mutation):
         super().__init_subclass_with_meta__(_meta=_meta, **options)
 
     @classmethod
+    @retry_db_transaction(name="resource_manager_create")
     async def mutate_create(
         cls,
         info: GraphQLResolveInfo,
@@ -196,6 +198,7 @@ class InfrahubNumberPoolMutation(InfrahubMutationMixin, Mutation):
         return await super().mutate_create(info=info, data=data, branch=branch)
 
     @classmethod
+    @retry_db_transaction(name="resource_manager_update")
     async def mutate_update(
         cls,
         info: GraphQLResolveInfo,

infrahub/graphql/mutations/schema.py

@@ -126,7 +126,7 @@ class SchemaDropdownRemove(Mutation):
         validate_kind_dropdown(kind=kind, attribute=attribute)
         dropdown = str(data.dropdown)
         nodes_with_dropdown = await NodeManager.query(
-            db=context.db, schema=kind.kind, filters={f"{attribute}__value": dropdown}
+            db=context.db, schema=kind.kind, filters={f"{attribute}__value": dropdown}, branch=context.branch
         )
         if nodes_with_dropdown:
             raise ValidationError(f"There are still {kind.kind} objects using this dropdown")
@@ -208,14 +208,15 @@ class SchemaEnumRemove(Mutation):
         data: SchemaEnumInput,
     ) -> dict[str, bool]:
         context: GraphqlContext = info.context
-        db = context.db
-        branch = context.branch
-        kind = db.schema.get(name=str(data.kind), branch=branch.name)
+
+        kind = context.db.schema.get(name=str(data.kind), branch=context.branch.name)
 
         attribute = str(data.attribute)
         enum = str(data.enum)
         validate_kind_enum(kind=kind, attribute=attribute)
-        nodes_with_enum = await NodeManager.query(db=db, schema=kind.kind, filters={f"{attribute}__value": enum})
+        nodes_with_enum = await NodeManager.query(
+            db=context.db, schema=kind.kind, filters={f"{attribute}__value": enum}, branch=context.branch
+        )
         if nodes_with_enum:
             raise ValidationError(f"There are still {kind.kind} objects using this enum")
 
@@ -231,8 +232,8 @@ class SchemaEnumRemove(Mutation):
 
         await update_registry(
             kind=kind,
-            branch=branch,
-            db=db,
+            branch=context.branch,
+            db=context.db,
             account_id=context.active_account_session.account_id,
             service=context.active_service,
         )

infrahub/graphql/mutations/tasks.py

@@ -31,7 +31,7 @@ async def merge_branch_mutation(branch: str) -> None:
         diff_coordinator = await component_registry.get_component(DiffCoordinator, db=db, branch=obj)
         diff_repository = await component_registry.get_component(DiffRepository, db=db, branch=obj)
         diff_merger = await component_registry.get_component(DiffMerger, db=db, branch=obj)
-        enriched_diff = await diff_coordinator.update_branch_diff(base_branch=base_branch, diff_branch=obj)
+        enriched_diff = await diff_coordinator.update_branch_diff_and_return(base_branch=base_branch, diff_branch=obj)
         if enriched_diff.get_all_conflicts():
             raise ValidationError(
                 f"Branch {obj.name} contains conflicts with the default branch."

infrahub/graphql/permissions.py

@@ -4,15 +4,14 @@ from typing import TYPE_CHECKING, Any
 
 from infrahub.core.registry import registry
 from infrahub.core.schema import GenericSchema
-from infrahub.permissions.report import report_schema_permissions
+from infrahub.permissions import report_schema_permissions
 
 if TYPE_CHECKING:
     from infrahub.core.schema import MainSchemaTypes
-    from infrahub.database import InfrahubDatabase
     from infrahub.graphql.initialization import GraphqlContext
 
 
-async def get_permissions(db: InfrahubDatabase, schema: MainSchemaTypes, context: GraphqlContext) -> dict[str, Any]:
+async def get_permissions(schema: MainSchemaTypes, context: GraphqlContext) -> dict[str, Any]:
     schema_objects = [schema]
     if isinstance(schema, GenericSchema):
         for node_name in schema.used_by:
@@ -28,7 +27,7 @@ async def get_permissions(db: InfrahubDatabase, schema: MainSchemaTypes, context
     response: dict[str, Any] = {"count": len(schema_objects), "edges": []}
 
     nodes = await report_schema_permissions(
-        db=db, schemas=schema_objects, branch=context.branch, account_session=context.active_account_session
+        branch=context.branch, permission_manager=context.active_permissions, schemas=schema_objects
     )
     response["edges"] = [{"node": node} for node in nodes]
 

infrahub/graphql/queries/account.py

@@ -5,7 +5,6 @@ from typing import TYPE_CHECKING, Any
 from graphene import Field, Int, List, ObjectType, String
 from infrahub_sdk.utils import extract_fields_first_node
 
-from infrahub.core import registry
 from infrahub.core.manager import NodeManager
 from infrahub.core.protocols import InternalAccountToken
 from infrahub.exceptions import PermissionDeniedError
@@ -14,7 +13,6 @@ if TYPE_CHECKING:
     from graphql import GraphQLResolveInfo
 
     from infrahub.graphql.initialization import GraphqlContext
-    from infrahub.permissions.constants import AssignedPermissions
 
 
 class AccountTokenNode(ObjectType):
@@ -120,17 +118,10 @@ async def resolve_account_permissions(
         raise ValueError("An account_session is mandatory to execute this query")
 
     fields = await extract_fields_first_node(info)
-    permissions: AssignedPermissions = {"global_permissions": [], "object_permissions": []}
-    for permission_backend in registry.permission_backends:
-        backend_permissions = await permission_backend.load_permissions(
-            db=context.db, account_session=context.account_session, branch=context.branch
-        )
-        permissions["global_permissions"].extend(backend_permissions["global_permissions"])
-        permissions["object_permissions"].extend(backend_permissions["object_permissions"])
 
     response: dict[str, dict[str, Any]] = {}
     if "global_permissions" in fields:
-        global_list = permissions["global_permissions"]
+        global_list = context.active_permissions.permissions["global_permissions"]
         response["global_permissions"] = {"count": len(global_list)}
         response["global_permissions"]["edges"] = [
             {
@@ -145,7 +136,7 @@ async def resolve_account_permissions(
             for obj in global_list
         ]
     if "object_permissions" in fields:
-        object_list = permissions["object_permissions"]
+        object_list = context.active_permissions.permissions["object_permissions"]
         response["object_permissions"] = {"count": len(object_list)}
         response["object_permissions"]["edges"] = [
             {

infrahub/graphql/queries/resource_manager.py

@@ -1,6 +1,6 @@
 from __future__ import annotations
 
-from typing import TYPE_CHECKING, Any, Optional, Union
+from typing import TYPE_CHECKING, Any
 
 from graphene import Field, Float, Int, List, ObjectType, String
 from infrahub_sdk.utils import extract_fields_first_node
@@ -57,7 +57,7 @@ class PoolAllocatedEdge(ObjectType):
     node = Field(PoolAllocatedNode, required=True)
 
 
-def _validate_pool_type(pool_id: str, pool: Optional[CoreNode] = None) -> CoreNode:
+def _validate_pool_type(pool_id: str, pool: CoreNode | None = None) -> CoreNode:
     if not pool or pool.get_kind() not in [
         InfrahubKind.IPADDRESSPOOL,
         InfrahubKind.IPPREFIXPOOL,
@@ -81,15 +81,21 @@ class PoolAllocated(ObjectType):
         limit: int = 10,
     ) -> dict:
         context: GraphqlContext = info.context
-        pool: Optional[CoreNode] = await NodeManager.get_one(id=pool_id, db=context.db, branch=context.branch)
+        pool: CoreNode | None = await NodeManager.get_one(id=pool_id, db=context.db, branch=context.branch)
 
         fields = await extract_fields_first_node(info=info)
 
+        allocated_kinds: list[str] = []
         pool = _validate_pool_type(pool_id=pool_id, pool=pool)
-        if pool.get_kind() == "CoreNumberPool":
-            return await resolve_number_pool_allocation(
-                db=context.db, context=context, pool=pool, fields=fields, offset=offset, limit=limit
-            )
+        match pool.get_kind():
+            case InfrahubKind.NUMBERPOOL:
+                return await resolve_number_pool_allocation(
+                    db=context.db, context=context, pool=pool, fields=fields, offset=offset, limit=limit
+                )
+            case InfrahubKind.IPPREFIXPOOL:
+                allocated_kinds.append(InfrahubKind.IPPREFIX)
+            case InfrahubKind.IPADDRESSPOOL:
+                allocated_kinds.append(InfrahubKind.IPADDRESS)
 
         resources = await pool.resources.get_peers(db=context.db)  # type: ignore[attr-defined,union-attr]
         if resource_id not in resources:
@@ -100,7 +106,12 @@ class PoolAllocated(ObjectType):
         resource = resources[resource_id]
 
         query = await IPPrefixUtilization.init(
-            db=context.db, at=context.at, ip_prefixes=[resource], offset=offset, limit=limit
+            db=context.db,
+            at=context.at,
+            ip_prefixes=[resource],
+            allocated_kinds=allocated_kinds,
+            offset=offset,
+            limit=limit,
         )
         response: dict[str, Any] = {}
         if "count" in fields:
@@ -170,7 +181,7 @@ class PoolUtilization(ObjectType):
     ) -> dict:
         context: GraphqlContext = info.context
         db: InfrahubDatabase = context.db
-        pool: Optional[CoreNode] = await NodeManager.get_one(id=pool_id, db=db, branch=context.branch)
+        pool: CoreNode | None = await NodeManager.get_one(id=pool_id, db=db, branch=context.branch)
         pool = _validate_pool_type(pool_id=pool_id, pool=pool)
         if pool.get_kind() == "CoreNumberPool":
             return await resolve_number_pool_utilization(db=db, context=context, pool=pool)
@@ -212,7 +223,7 @@ class PoolUtilization(ObjectType):
                 for resource_id, resource_node in resources_map.items():
                     resource_total = None
                     default_branch_total = None
-                    node_response: dict[str, Union[str, float, int]] = {}
+                    node_response: dict[str, str | float | int] = {}
                     if "id" in node_fields:
                         node_response["id"] = resource_id
                     if "kind" in node_fields:

infrahub/graphql/query.py

@@ -37,7 +37,9 @@ async def execute_query(
     if not graphql_query:
         raise ValueError(f"Unable to find the {InfrahubKind.GRAPHQLQUERY} {name}")
 
-    gql_params = prepare_graphql_params(branch=branch, db=db, at=at, include_mutation=False, include_subscription=False)
+    gql_params = await prepare_graphql_params(
+        branch=branch, db=db, at=at, include_mutation=False, include_subscription=False
+    )
 
     result = await graphql(
         schema=gql_params.schema,

infrahub/graphql/resolvers/resolver.py

@@ -9,6 +9,7 @@ from infrahub.core.manager import NodeManager
 from infrahub.core.query.node import NodeGetHierarchyQuery
 from infrahub.exceptions import NodeNotFoundError
 
+from ..models import OrderModel
 from ..parser import extract_selection
 from ..permissions import get_permissions
 from ..types import RELATIONS_PROPERTY_MAP, RELATIONS_PROPERTY_MAP_REVERSED
@@ -33,6 +34,7 @@ async def account_resolver(
             filters={"ids": [context.account_session.account_id]},
             fields=fields,
             db=db,
+            order=OrderModel(disable=True),
         )
         if results:
             account_profile = await results[0].to_graphql(db=db, fields=fields)
@@ -132,6 +134,7 @@ async def default_paginated_list_resolver(
     info: GraphQLResolveInfo,
     offset: int | None = None,
     limit: int | None = None,
+    order: OrderModel | None = None,
     partial_match: bool = False,
     **kwargs: dict[str, Any],
 ) -> dict[str, Any]:
@@ -149,7 +152,7 @@ async def default_paginated_list_resolver(
         node_fields = edges.get("node", {})
 
         permission_set: Optional[dict[str, Any]] = None
-        permissions = await get_permissions(db=db, schema=schema, context=context) if context.account_session else None
+        permissions = await get_permissions(schema=schema, context=context) if context.permissions else None
         if fields.get("permissions"):
             response["permissions"] = permissions
 
@@ -173,6 +176,7 @@ async def default_paginated_list_resolver(
                 include_source=True,
                 include_owner=True,
                 partial_match=partial_match,
+                order=order,
             )
 
         if "count" in fields:

infrahub/graphql/types/task.py

@@ -28,9 +28,21 @@ class Task(ObjectType):
     start_time = String(required=False)
 
 
+class TaskRelatedNode(ObjectType):
+    id = String(required=True)
+    kind = String(required=True)
+
+
 class TaskNode(Task):
-    related_node = String(required=False)
-    related_node_kind = String(required=False)
+    related_node = String(
+        required=False,
+        deprecation_reason="This field is deprecated and it will be removed in a future release, use related_nodes instead",
+    )
+    related_node_kind = String(
+        required=False,
+        deprecation_reason="This field is deprecated and it will be removed in a future release, use related_nodes instead",
+    )
+    related_nodes = List(TaskRelatedNode)
     logs = Field(TaskLogEdge)
 
 

infrahub/menu/generator.py

@@ -5,16 +5,14 @@ from typing import TYPE_CHECKING
 from infrahub.core import registry
 from infrahub.core.protocols import CoreMenuItem
 from infrahub.log import get_logger
-from infrahub.permissions.constants import AssignedPermissions
-from infrahub.permissions.local_backend import LocalPermissionBackend
 
 from .constants import FULL_DEFAULT_MENU
 from .models import MenuDict, MenuItemDict
 
 if TYPE_CHECKING:
-    from infrahub.auth import AccountSession
     from infrahub.core.branch import Branch
     from infrahub.database import InfrahubDatabase
+    from infrahub.permissions import PermissionManager
 
 log = get_logger()
 
@@ -24,28 +22,18 @@ def get_full_name(obj: CoreMenuItem) -> str:
 
 
 async def generate_restricted_menu(
-    db: InfrahubDatabase, branch: Branch, menu_items: list[CoreMenuItem], account: AccountSession | None = None
+    db: InfrahubDatabase, branch: Branch, menu_items: list[CoreMenuItem], account_permissions: PermissionManager | None
 ) -> MenuDict:
     menu = await generate_menu(db=db, branch=branch, menu_items=menu_items)
 
-    permissions = AssignedPermissions(global_permissions=[], object_permissions=[])
-    perm_backend = LocalPermissionBackend()
-
-    if account:
-        permissions = await perm_backend.load_permissions(db=db, account_session=account, branch=branch)
-
     for item in menu.data.values():
-        has_permission: bool | None = None
+        has_permission = True
         for permission in item.get_global_permissions():
-            has_permission = perm_backend.resolve_global_permission(
-                permissions=permissions["global_permissions"], permission_to_check=permission
+            has_permission = account_permissions is not None and account_permissions.has_permission(
+                permission=permission
             )
-            if has_permission:
-                has_permission = True
-            elif has_permission is None:
-                has_permission = False
 
-        if has_permission is False:
+        if not has_permission:
             item.hidden = True
 
     return menu

infrahub/message_bus/messages/event_node_mutated.py

@@ -1,4 +1,4 @@
-from typing import Any, Dict
+from typing import Any
 
 from pydantic import Field
 
@@ -12,4 +12,4 @@ class EventNodeMutated(InfrahubMessage):
     kind: str = Field(..., description="The type of object modified")
     node_id: str = Field(..., description="The ID of the mutated node")
     action: str = Field(..., description="The action taken on the node")
-    data: Dict[str, Any] = Field(..., description="Data on modified object")
+    data: dict[str, Any] = Field(..., description="Data on modified object")

infrahub/message_bus/operations/check/repository.py

@@ -1,5 +1,3 @@
-from typing import List
-
 from infrahub_sdk.uuidt import UUIDT
 from prefect import flow
 from prefect.logging import get_run_logger
@@ -29,10 +27,10 @@ async def check_definition(message: messages.CheckRepositoryCheckDefinition, ser
     )
     proposed_change = await service.client.get(kind=InfrahubKind.PROPOSEDCHANGE, id=message.proposed_change)
     validator_execution_id = str(UUIDT())
-    check_execution_ids: List[str] = []
+    check_execution_ids: list[str] = []
     await proposed_change.validations.fetch()
     validator = None
-    events: List[InfrahubMessage] = []
+    events: list[InfrahubMessage] = []
 
     for relationship in proposed_change.validations.peers:
         existing_validator = relationship.peer

infrahub/message_bus/operations/event/branch.py

@@ -1,5 +1,3 @@
-from typing import List
-
 from prefect import flow
 
 from infrahub.core import registry
@@ -24,14 +22,14 @@ async def merge(message: messages.EventBranchMerge, service: InfrahubServices) -
     async with service.database.start_session() as db:
         log.info("Branch merged", source_branch=message.source_branch, target_branch=message.target_branch)
 
-        events: List[InfrahubMessage] = [
+        events: list[InfrahubMessage] = [
             messages.RefreshRegistryBranches(),
         ]
         component_registry = get_component_registry()
         default_branch = registry.get_branch_from_registry()
         diff_repository = await component_registry.get_component(DiffRepository, db=db, branch=default_branch)
         # send diff update requests for every branch-tracking diff
-        branch_diff_roots = await diff_repository.get_empty_roots(base_branch_names=[message.target_branch])
+        branch_diff_roots = await diff_repository.get_roots_metadata(base_branch_names=[message.target_branch])
 
         await service.workflow.submit_workflow(
             workflow=TRIGGER_ARTIFACT_DEFINITION_GENERATE,

infrahub/message_bus/operations/requests/proposed_change.py

@@ -26,7 +26,7 @@ from infrahub.proposed_change.models import (
     RequestProposedChangeSchemaIntegrity,
     RequestProposedChangeUserTests,
 )
-from infrahub.services import InfrahubServices  # noqa: TCH001
+from infrahub.services import InfrahubServices  # noqa: TC001
 from infrahub.workflows.catalogue import (
     REQUEST_PROPOSED_CHANGE_DATA_INTEGRITY,
     REQUEST_PROPOSED_CHANGE_REPOSITORY_CHECKS,

infrahub/message_bus/operations/requests/repository.py

@@ -1,5 +1,3 @@
-from typing import List
-
 from infrahub_sdk.uuidt import UUIDT
 from prefect import flow
 from prefect.logging import get_run_logger
@@ -18,7 +16,7 @@ async def checks(message: messages.RequestRepositoryChecks, service: InfrahubSer
     await add_tags(branches=[message.source_branch], nodes=[message.proposed_change])
     log = get_run_logger()
 
-    events: List[InfrahubMessage] = []
+    events: list[InfrahubMessage] = []
 
     repository = await service.client.get(
         kind=InfrahubKind.GENERICREPOSITORY, id=message.repository, branch=message.source_branch
@@ -26,7 +24,7 @@ async def checks(message: messages.RequestRepositoryChecks, service: InfrahubSer
     proposed_change = await service.client.get(kind=InfrahubKind.PROPOSEDCHANGE, id=message.proposed_change)
 
     validator_execution_id = str(UUIDT())
-    check_execution_ids: List[str] = []
+    check_execution_ids: list[str] = []
     await proposed_change.validations.fetch()
     await repository.checks.fetch()
 
@@ -106,7 +104,7 @@ async def user_checks(message: messages.RequestRepositoryUserChecks, service: In
     await add_tags(branches=[message.source_branch], nodes=[message.proposed_change])
     log = get_run_logger()
 
-    events: List[InfrahubMessage] = []
+    events: list[InfrahubMessage] = []
 
     repository = await service.client.get(
         kind=InfrahubKind.GENERICREPOSITORY, id=message.repository_id, branch=message.source_branch, fragment=True

infrahub/message_bus/types.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 import re
 from enum import Enum
 
-from infrahub_sdk.diff import NodeDiff  # noqa: TCH002
+from infrahub_sdk.diff import NodeDiff  # noqa: TC002
 from pydantic import BaseModel, Field
 
 from infrahub.core.constants import InfrahubKind, RepositoryInternalStatus

infrahub/permissions/__init__.py

@@ -1,4 +1,13 @@
-from .backend import PermissionBackend
-from .local_backend import LocalPermissionBackend
+from infrahub.permissions.backend import PermissionBackend
+from infrahub.permissions.local_backend import LocalPermissionBackend
+from infrahub.permissions.manager import PermissionManager
+from infrahub.permissions.report import report_schema_permissions
+from infrahub.permissions.types import AssignedPermissions
 
-__all__ = ["LocalPermissionBackend", "PermissionBackend"]
+__all__ = [
+    "AssignedPermissions",
+    "LocalPermissionBackend",
+    "PermissionBackend",
+    "PermissionManager",
+    "report_schema_permissions",
+]

infrahub/permissions/backend.py

@@ -5,28 +5,13 @@ from typing import TYPE_CHECKING
 
 if TYPE_CHECKING:
     from infrahub.auth import AccountSession
-    from infrahub.core.account import GlobalPermission, ObjectPermission
     from infrahub.core.branch import Branch
     from infrahub.database import InfrahubDatabase
-    from infrahub.permissions.constants import AssignedPermissions, PermissionDecisionFlag
+    from infrahub.permissions.types import AssignedPermissions
 
 
 class PermissionBackend(ABC):
     @abstractmethod
     async def load_permissions(
-        self, db: InfrahubDatabase, account_session: AccountSession, branch: Branch
+        self, db: InfrahubDatabase, branch: Branch, account_session: AccountSession
     ) -> AssignedPermissions: ...
-
-    @abstractmethod
-    def report_object_permission(
-        self, permissions: list[ObjectPermission], namespace: str, name: str, action: str
-    ) -> PermissionDecisionFlag: ...
-
-    @abstractmethod
-    async def has_permission(
-        self,
-        db: InfrahubDatabase,
-        account_session: AccountSession,
-        permission: GlobalPermission | ObjectPermission,
-        branch: Branch,
-    ) -> bool: ...

infrahub/permissions/constants.py

@@ -1,15 +1,8 @@
 from __future__ import annotations
 
 from enum import IntFlag, StrEnum, auto
-from typing import TYPE_CHECKING, TypedDict
 
-if TYPE_CHECKING:
-    from infrahub.core.account import GlobalPermission, ObjectPermission
-
-
-class AssignedPermissions(TypedDict):
-    global_permissions: list[GlobalPermission]
-    object_permissions: list[ObjectPermission]
+from infrahub.core.constants import GlobalPermissions
 
 
 class PermissionDecisionFlag(IntFlag):
@@ -26,3 +19,14 @@ class BranchRelativePermissionDecision(StrEnum):
     ALLOW = auto()
     ALLOW_DEFAULT = auto()
     ALLOW_OTHER = auto()
+
+
+GLOBAL_PERMISSION_DENIAL_MESSAGE = {
+    GlobalPermissions.EDIT_DEFAULT_BRANCH.value: "You are not allowed to change data in the default branch",
+    GlobalPermissions.MERGE_BRANCH.value: "You are not allowed to merge a branch",
+    GlobalPermissions.MERGE_PROPOSED_CHANGE.value: "You are not allowed to merge proposed changes",
+    GlobalPermissions.MANAGE_SCHEMA.value: "You are not allowed to manage the schema",
+    GlobalPermissions.MANAGE_ACCOUNTS.value: "You are not allowed to manage user accounts, groups or roles",
+    GlobalPermissions.MANAGE_PERMISSIONS.value: "You are not allowed to manage permissions",
+    GlobalPermissions.MANAGE_REPOSITORIES.value: "You are not allowed to manage repositories",
+}