kdex-entitlements 0.1.19__tar.gz

kdex_entitlements-0.1.19/Makefile

@@ -0,0 +1,21 @@
+VENV = .venv
+VENV_BIN = $(VENV)/bin
+
+.PHONY: all
+all: test
+
+.PHONY: test
+test: $(VENV) ## Run Python tests.
+	$(VENV_BIN)/pytest
+
+.PHONY: coverage
+coverage: $(VENV) ## Run Python tests with coverage.
+	$(VENV_BIN)/pytest --cov=entitlements --cov-report=term-missing
+
+.PHONY: lint
+lint: $(VENV) ## Run Python linter (ruff).
+	$(VENV_BIN)/ruff check .
+
+$(VENV):
+	python3 -m venv $(VENV)
+	$(VENV_BIN)/pip install pytest pytest-cov

kdex_entitlements-0.1.19/PKG-INFO

@@ -0,0 +1,8 @@
+Metadata-Version: 2.4
+Name: kdex-entitlements
+Version: 0.1.19
+Summary: A simple entitlements checking library
+Author: KDEX Tech
+Provides-Extra: test
+Requires-Dist: pytest>=8.0.0; extra == "test"
+Requires-Dist: pytest-cov>=4.1.0; extra == "test"

kdex_entitlements-0.1.19/pyproject.toml

@@ -0,0 +1,26 @@
+[project]
+name = "kdex-entitlements"
+dynamic = ["version"]
+description = "A simple entitlements checking library"
+authors = [
+    {name = "KDEX Tech"}
+]
+dependencies = []
+
+[build-system]
+requires = ["setuptools>=61.0", "setuptools_scm[toml]>=6.2"]
+build-backend = "setuptools.build_meta"
+
+[tool.setuptools_scm]
+fallback_version = "0.0.0"
+
+
+[project.optional-dependencies]
+test = [
+    "pytest>=8.0.0",
+    "pytest-cov>=4.1.0",
+]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+pythonpath = ["src"]

kdex_entitlements-0.1.19/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

kdex_entitlements-0.1.19/src/entitlements/__init__.py

@@ -0,0 +1,115 @@
+from typing import Dict, List, Optional, Union
+import dataclasses
+
+# Types
+SecurityScheme = str
+Entitlements = Dict[SecurityScheme, List[str]]
+RequirementSet = Dict[SecurityScheme, List[str]]
+Requirements = List[RequirementSet]
+
+@dataclasses.dataclass(frozen=True)
+class Pattern:
+    """Represents a parsed entitlement or requirement pattern."""
+    resource: Optional[str] = None
+    name: Optional[str] = None
+    verb: Optional[str] = None
+    opaque: Optional[str] = None
+
+    @classmethod
+    def parse(cls, s: str) -> "Pattern":
+        parts = s.split(":")
+        if len(parts) == 3:
+            return cls(resource=parts[0], name=parts[1], verb=parts[2])
+        elif len(parts) == 2:
+            return cls(resource=parts[0], name="*", verb=parts[1])
+        else:
+            return cls(opaque=s)
+
+    def satisfies(self, required: "Pattern") -> bool:
+        # Both opaque: must match exactly
+        if self.opaque is not None and required.opaque is not None:
+            return self.opaque == required.opaque
+        
+        # Mixed: no match unless strings are identical (unlikely given parse)
+        if (self.opaque is not None) != (required.opaque is not None):
+            return False
+
+        # Structured:
+        # Resource must match
+        if self.resource != required.resource:
+            return False
+        
+        # Verb must match exactly or entitlement is "all"
+        if self.verb != required.verb and self.verb != "all":
+            return False
+        
+        # Name must match exactly, or either is a wildcard
+        if self.name != required.name and self.name not in ("*", "") and required.name not in ("*", ""):
+            return False
+        
+        return True
+
+class EntitlementsChecker:
+    def __init__(self, anonymous_entitlements: Optional[List[str]] = None, default_scheme: str = "bearer"):
+        self.anonymous_entitlements = anonymous_entitlements or []
+        self.default_scheme = default_scheme
+
+    def verify(self, user_entitlements: Entitlements, requirements: Requirements) -> bool:
+        if not requirements:
+            return True
+
+        # Merge with anonymous
+        merged = {k: list(v) for k, v in user_entitlements.items()}
+        if self.anonymous_entitlements:
+            scheme_list = merged.setdefault(self.default_scheme, [])
+            for anon in self.anonymous_entitlements:
+                if anon not in scheme_list:
+                    scheme_list.append(anon)
+
+        # Pre-parse entitlements
+        parsed_entitlements: Dict[SecurityScheme, List[Pattern]] = {
+            scheme: [Pattern.parse(e) for e in entries]
+            for scheme, entries in merged.items()
+        }
+
+        # OR logic for requirements list
+        for req_set in requirements:
+            if self._verify_set(parsed_entitlements, req_set):
+                return True
+        
+        return False
+
+    def _verify_set(self, user_patterns: Dict[SecurityScheme, List[Pattern]], req_set: RequirementSet) -> bool:
+        # AND logic for a requirement set
+        for scheme, required_patterns in req_set.items():
+            user_list = user_patterns.get(scheme)
+            if user_list is None:
+                return False
+            
+            for req_str in required_patterns:
+                req_p = Pattern.parse(req_str)
+                if not any(user_p.satisfies(req_p) for user_p in user_list):
+                    return False
+        return True
+
+    def verify_resource(
+        self,
+        user_entitlements: Entitlements,
+        resource: str,
+        name: str,
+        verb: str,
+        additional_requirements: Optional[Requirements] = None
+    ) -> bool:
+        identity_req = f"{resource}:{name}:{verb}"
+        
+        if not additional_requirements:
+            return self.verify(user_entitlements, [{self.default_scheme: [identity_req]}])
+        
+        # Identity AND (additional requirements OR...)
+        combined: Requirements = []
+        for req_set in additional_requirements:
+            new_set = dict(req_set)
+            new_set.setdefault(self.default_scheme, []).append(identity_req)
+            combined.append(new_set)
+        
+        return self.verify(user_entitlements, combined)

kdex_entitlements-0.1.19/src/kdex_entitlements.egg-info/PKG-INFO

@@ -0,0 +1,8 @@
+Metadata-Version: 2.4
+Name: kdex-entitlements
+Version: 0.1.19
+Summary: A simple entitlements checking library
+Author: KDEX Tech
+Provides-Extra: test
+Requires-Dist: pytest>=8.0.0; extra == "test"
+Requires-Dist: pytest-cov>=4.1.0; extra == "test"

kdex_entitlements-0.1.19/src/kdex_entitlements.egg-info/SOURCES.txt

@@ -0,0 +1,9 @@
+Makefile
+pyproject.toml
+src/entitlements/__init__.py
+src/kdex_entitlements.egg-info/PKG-INFO
+src/kdex_entitlements.egg-info/SOURCES.txt
+src/kdex_entitlements.egg-info/dependency_links.txt
+src/kdex_entitlements.egg-info/requires.txt
+src/kdex_entitlements.egg-info/top_level.txt
+tests/test_entitlements.py

kdex_entitlements-0.1.19/src/kdex_entitlements.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

kdex_entitlements-0.1.19/src/kdex_entitlements.egg-info/requires.txt

@@ -0,0 +1,4 @@
+
+[test]
+pytest>=8.0.0
+pytest-cov>=4.1.0

kdex_entitlements-0.1.19/src/kdex_entitlements.egg-info/top_level.txt

@@ -0,0 +1 @@
+entitlements

kdex_entitlements-0.1.19/tests/test_entitlements.py

@@ -0,0 +1,67 @@
+import pytest
+from entitlements import EntitlementsChecker, Pattern
+
+def test_pattern_parse():
+    assert Pattern.parse("pages:/foo:read") == Pattern(resource="pages", name="/foo", verb="read")
+    assert Pattern.parse("pages:read") == Pattern(resource="pages", name="*", verb="read")
+    assert Pattern.parse("admin") == Pattern(opaque="admin")
+
+def test_pattern_satisfies():
+    ent = Pattern.parse("pages:*:read")
+    req = Pattern.parse("pages:/foo:read")
+    assert ent.satisfies(req)
+
+    ent = Pattern.parse("pages:all")
+    req = Pattern.parse("pages:/foo:read")
+    assert ent.satisfies(req)
+
+    ent = Pattern.parse("pages:/bar:read")
+    req = Pattern.parse("pages:/foo:read")
+    assert not ent.satisfies(req)
+
+    ent = Pattern.parse("admin")
+    req = Pattern.parse("admin")
+    assert ent.satisfies(req)
+
+def test_verify():
+    checker = EntitlementsChecker(anonymous_entitlements=["anonymous:read"], default_scheme="bearer")
+    
+    user_entitlements = {"bearer": ["pages:foo:read"]}
+    
+    # Simple match
+    requirements = [{"bearer": ["pages:foo:read"]}]
+    assert checker.verify(user_entitlements, requirements)
+    
+    # Wildcard match
+    requirements = [{"bearer": ["pages:*:read"]}]
+    assert checker.verify(user_entitlements, requirements)
+
+    # Anonymous match
+    requirements = [{"bearer": ["anonymous:*:read"]}]
+    assert checker.verify(user_entitlements, requirements)
+
+    # Failing match
+    requirements = [{"bearer": ["pages:foo:write"]}]
+    assert not checker.verify(user_entitlements, requirements)
+
+    # OR match
+    requirements = [
+        {"bearer": ["pages:foo:write"]},
+        {"bearer": ["pages:foo:read"]}
+    ]
+    assert checker.verify(user_entitlements, requirements)
+
+def test_verify_resource():
+    checker = EntitlementsChecker(default_scheme="bearer")
+    user_entitlements = {"bearer": ["pages:foo:read", "admin"]}
+
+    # Identity check
+    assert checker.verify_resource(user_entitlements, "pages", "foo", "read")
+    assert not checker.verify_resource(user_entitlements, "pages", "bar", "read")
+
+    # Identity + additional requirements
+    additional = [{"bearer": ["admin"]}]
+    assert checker.verify_resource(user_entitlements, "pages", "foo", "read", additional)
+
+    additional = [{"bearer": ["superadmin"]}]
+    assert not checker.verify_resource(user_entitlements, "pages", "foo", "read", additional)