nonebot-plugin-onebot-luckperms 0.1.0__py3-none-any.whl

nonebot_plugin_onebot_luckperms/config.py

@@ -0,0 +1,20 @@
+from typing import List, Literal
+from pydantic import BaseModel, Field, ConfigDict
+
+
+class OBLPConfig(BaseModel):
+    model_config = ConfigDict(extra="ignore")
+
+    store_type: Literal["memory", "sqlite", "redis"] = "sqlite"
+    sqlite_path: str = "./data/oblp/permissions.db"
+    redis_url: str = "redis://localhost:6379/0"
+    default_group_owner: List[str] = Field(default_factory=lambda: ["luckperms.help"])
+    default_group_admin: List[str] = Field(default_factory=list)
+    default_group_member: List[str] = Field(default_factory=list)
+    superuser_inherit: List[str] = Field(default_factory=lambda: ["luckperms.*"])
+    cache_ttl: int = 300
+    debug_mode: bool = False
+    message_file: str = "./data/oblp/messages.yml"
+
+
+oblp_config = OBLPConfig()

nonebot_plugin_onebot_luckperms/core/__init__.py

@@ -0,0 +1,20 @@
+from .models import ContextSet, PermissionNode, User, Group, QueryOptions
+from .engine import PermissionEngine
+from .registry import NodeRegistry, register_node
+from .exceptions import CircularInheritanceError, PermissionException
+from .context_provider import register_context_provider, ContextProvider
+
+__all__ = [
+    "ContextSet",
+    "PermissionNode",
+    "User",
+    "Group",
+    "QueryOptions",
+    "PermissionEngine",
+    "NodeRegistry",
+    "register_node",
+    "CircularInheritanceError",
+    "PermissionException",
+    "register_context_provider",
+    "ContextProvider",
+]

nonebot_plugin_onebot_luckperms/core/cache.py

@@ -0,0 +1,44 @@
+from __future__ import annotations
+
+import time
+from typing import Dict, Optional, Tuple
+
+from ..config import oblp_config
+
+
+class PermissionCache:
+    _cache: Dict[str, Tuple[float, dict]] = {}
+
+    @classmethod
+    def get(cls, key: str) -> Optional[dict]:
+        ttl = oblp_config.cache_ttl
+        if ttl <= 0:
+            return None
+        entry = cls._cache.get(key)
+        if entry is None:
+            return None
+        ts, value = entry
+        if time.time() - ts > ttl:
+            del cls._cache[key]
+            return None
+        return value
+
+    @classmethod
+    def set(cls, key: str, value: dict):
+        ttl = oblp_config.cache_ttl
+        if ttl <= 0:
+            return
+        cls._cache[key] = (time.time(), value)
+
+    @classmethod
+    def invalidate(cls, key: str):
+        cls._cache.pop(key, None)
+
+    @classmethod
+    def invalidate_all(cls):
+        cls._cache.clear()
+
+    @classmethod
+    def make_key(cls, user_id: str, ctx: "ContextSet") -> str:
+        ctx_str = "&".join(f"{k}={v}" for k, v in sorted(ctx.data.items()))
+        return f"{user_id}:{ctx_str}"

nonebot_plugin_onebot_luckperms/core/context_provider.py

@@ -0,0 +1,74 @@
+from __future__ import annotations
+
+import logging
+from typing import Dict, List, Protocol
+
+from nonebot.adapters import Bot, Event
+
+from .models import ContextSet
+
+logger = logging.getLogger("oblp")
+
+
+class DuplicateProviderError(Exception):
+    """Raised when a ContextProvider registers a key already claimed by another provider."""
+
+
+class ContextProvider(Protocol):
+    async def __call__(
+        self, bot: Bot, event: Event, current_ctx: ContextSet
+    ) -> Dict[str, str]:
+        ...
+
+
+_context_providers: List[ContextProvider] = []
+_claimed_keys: Dict[str, str] = {}  # key → provider_identity
+
+
+def _provider_identity(provider: ContextProvider) -> str:
+    return f"{type(provider).__module__}.{type(provider).__qualname__}"
+
+
+def register_context_provider(provider: ContextProvider):
+    identity = _provider_identity(provider)
+
+    # Probe which keys this provider returns by running it with an empty context
+    # (We can't call it here since it needs bot/event. Instead, require provider
+    #  to declare its keys statically via a `context_keys` class attribute.)
+
+    if hasattr(provider, "context_keys"):
+        keys: set[str] = provider.context_keys
+    else:
+        keys = set()
+
+    if not keys:
+        logger.warning(
+            f"ContextProvider '{identity}' does not declare `context_keys`. "
+            f"Add a class-level `context_keys = {{\"your_key\"}}` to prevent conflicts."
+        )
+
+    conflicts = []
+    for k in keys:
+        if k in _claimed_keys:
+            conflicts.append((k, _claimed_keys[k]))
+
+    if conflicts:
+        detail = "; ".join(f"key='{k}' already claimed by {owner}" for k, owner in conflicts)
+        raise DuplicateProviderError(
+            f"ContextProvider '{identity}' conflicts: {detail}"
+        )
+
+    for k in keys:
+        _claimed_keys[k] = identity
+
+    _context_providers.append(provider)
+    logger.info(f"ContextProvider registered: {identity} keys={keys}")
+
+
+def get_context_providers() -> List[ContextProvider]:
+    return list(_context_providers)
+
+
+def clear_providers():
+    _context_providers.clear()
+    _claimed_keys.clear()

nonebot_plugin_onebot_luckperms/core/engine.py

@@ -0,0 +1,162 @@
+from __future__ import annotations
+
+from typing import Dict, List, Optional
+
+from .models import User, PermissionNode, QueryOptions, ContextSet
+from .registry import NodeRegistry
+
+
+def _match_segments(pattern: str, target: str) -> bool:
+    """Segment-based wildcard matching.
+
+    *   matches zero or more segments (multi-segment wildcard).
+    **  alias for *, identical behavior.
+    Literals must match exactly.
+
+    Per our spec, * matches "a.b" and also "a.b.c" (not single-segment).
+    """
+    pat_parts = pattern.split(".")
+    tgt_parts = target.split(".")
+    return _match_dp(pat_parts, tgt_parts)
+
+
+def _match_dp(p: list[str], t: list[str]) -> bool:
+    n, m = len(p), len(t)
+    dp = [[False] * (m + 1) for _ in range(n + 1)]
+    dp[0][0] = True
+    for i in range(1, n + 1):
+        dp[i][0] = dp[i - 1][0] if p[i - 1] in ("*", "**") else False
+    for i in range(1, n + 1):
+        for j in range(1, m + 1):
+            if p[i - 1] in ("*", "**"):
+                dp[i][j] = dp[i - 1][j] or dp[i][j - 1]
+            elif p[i - 1] == t[j - 1]:
+                dp[i][j] = dp[i - 1][j - 1]
+            else:
+                dp[i][j] = False
+    return dp[n][m]
+
+
+class PermissionEngine:
+    @staticmethod
+    def check(user_nodes: Dict[str, bool], target: str) -> bool:
+        # Stage 1: Exact match (highest priority)
+        if target in user_nodes:
+            return user_nodes[target]
+
+        # Stage 2: Parent deny inheritance (security critical)
+        parts = target.split(".")
+        for i in range(len(parts) - 1, 0, -1):
+            parent = ".".join(parts[:i])
+            if parent in user_nodes and not user_nodes[parent]:
+                return False
+
+        # Stage 3: Wildcard match (segment-based)
+        for pattern, value in user_nodes.items():
+            if "*" in pattern and _match_segments(pattern, target):
+                return value
+
+        # Stage 4: Prefix inheritance (allow only)
+        for node_key, value in user_nodes.items():
+            if value and target.startswith(node_key + "."):
+                return True
+
+        # Stage 5: Inheritance chain via NodeRegistry
+        for ancestor in NodeRegistry.get_ancestors(target):
+            if ancestor in user_nodes:
+                return user_nodes[ancestor]
+
+        # Stage 6: Default deny
+        return False
+
+    @staticmethod
+    async def resolve_effective_nodes(
+        user: User,
+        store,
+        options: QueryOptions,
+        current_ctx: Optional[ContextSet] = None,
+    ) -> Dict[str, bool]:
+        candidates: List[tuple[int, PermissionNode]] = []
+        # sort_key: user nodes = 0, group nodes = 1 + (10000 - weight)
+        # This ensures user's own nodes always beat any group-inherited node.
+
+        for node in user.nodes:
+            candidates.append((0, node))
+
+        if "include_inherited" in options.flags:
+            for group_name in user.groups:
+                group = await store.get_group(group_name)
+                if group is None:
+                    continue
+                try:
+                    group_nodes = await group.get_effective_nodes(store)
+                except Exception:
+                    continue
+                for node in group_nodes:
+                    sort_key = 1 + (10000 - group.weight)
+                    candidates.append((sort_key, node))
+
+        candidates.sort(key=lambda x: x[0])
+
+        ctx_for_match = options.contexts
+        grouped: Dict[str, List[tuple[int, PermissionNode]]] = {}
+        for sort_key, node in candidates:
+            if node.is_expired():
+                continue
+            if options.mode == "contextual" and not node.applies_in(ctx_for_match):
+                continue
+            grouped.setdefault(node.key, []).append((sort_key, node))
+
+        seen: Dict[str, bool] = {}
+
+        for key, entries in grouped.items():
+            best = None
+            best_key = None
+            best_match = -1
+
+            for sort_key, node in entries:
+                if options.mode == "contextual" and not node.contexts.is_empty():
+                    match_cnt = sum(
+                        1 for k in node.contexts.data
+                        if ctx_for_match.data.get(k) == node.contexts.data[k]
+                    )
+                else:
+                    match_cnt = 0
+
+                if best is None:
+                    best = node
+                    best_key = sort_key
+                    best_match = match_cnt
+                elif sort_key < best_key:
+                    best = node
+                    best_key = sort_key
+                    best_match = match_cnt
+                elif sort_key == best_key and match_cnt > best_match:
+                    best = node
+                    best_match = match_cnt
+
+            if best is not None:
+                seen[key] = best.value
+
+        # Parent deny inheritance
+        for key in list(seen.keys()):
+            if not seen[key]:
+                continue
+            parts = key.split(".")
+            for i in range(len(parts) - 1, 0, -1):
+                parent = ".".join(parts[:i])
+                if parent in seen and not seen[parent]:
+                    del seen[key]
+                    break
+
+        # NodeRegistry defaults
+        ctx_for_defaults = current_ctx or options.contexts
+        for info in NodeRegistry.list_all():
+            key = info["key"]
+            if key in seen:
+                continue
+            default_ctx: ContextSet = info.get("contexts", ContextSet())
+            if ctx_for_defaults.matches(default_ctx):
+                seen[key] = info["default"]
+
+        return seen

nonebot_plugin_onebot_luckperms/core/exceptions.py

@@ -0,0 +1,6 @@
+class PermissionException(Exception):
+    """Base exception for the luckperms permission system."""
+
+
+class CircularInheritanceError(PermissionException):
+    """Raised when circular group inheritance is detected."""

nonebot_plugin_onebot_luckperms/core/models.py

@@ -0,0 +1,123 @@
+from __future__ import annotations
+
+import time
+from dataclasses import dataclass, field
+from typing import Dict, List, Optional, Set, Literal
+
+from .exceptions import CircularInheritanceError
+
+
+@dataclass(frozen=True)
+class ContextSet:
+    data: Dict[str, str] = field(default_factory=dict)
+
+    def with_context(self, key: str, value: str) -> ContextSet:
+        return ContextSet(data={**self.data, key: value})
+
+    def matches(self, requirement: ContextSet) -> bool:
+        if requirement.is_empty():
+            return True
+        for k, v in requirement.data.items():
+            if self.data.get(k) != v:
+                return False
+        return True
+
+    def is_empty(self) -> bool:
+        return len(self.data) == 0
+
+    @classmethod
+    def from_dict(cls, d: Dict[str, str]) -> ContextSet:
+        return cls(data=dict(d))
+
+    def to_dict(self) -> Dict[str, str]:
+        return dict(self.data)
+
+
+@dataclass
+class PermissionNode:
+    key: str
+    value: bool = True
+    expiry: Optional[int] = None
+    contexts: ContextSet = field(default_factory=ContextSet)
+
+    def is_expired(self) -> bool:
+        if self.expiry is None:
+            return False
+        return time.time() > self.expiry
+
+    def applies_in(self, ctx: ContextSet) -> bool:
+        return ctx.matches(self.contexts)
+
+
+@dataclass
+class QueryOptions:
+    mode: Literal["contextual", "all"] = "contextual"
+    contexts: ContextSet = field(default_factory=ContextSet)
+    flags: Set[str] = field(default_factory=lambda: {"include_inherited", "resolve_inheritance"})
+
+
+@dataclass
+class Group:
+    name: str
+    display_name: Optional[str] = None
+    weight: int = 0
+    nodes: List[PermissionNode] = field(default_factory=list)
+    parents: List[str] = field(default_factory=list)
+
+    async def get_effective_nodes(
+        self,
+        store,
+        visited: Optional[Set[str]] = None,
+    ) -> List[PermissionNode]:
+        if visited is None:
+            visited = set()
+        if self.name in visited:
+            raise CircularInheritanceError(
+                f"Circular inheritance detected: group '{self.name}' already visited"
+            )
+        visited.add(self.name)
+
+        result = list(self.nodes)
+
+        for parent_name in self.parents:
+            parent = await store.get_group(parent_name)
+            if parent is None:
+                continue
+            if parent.name in visited:
+                raise CircularInheritanceError(
+                    f"Circular inheritance detected: group '{parent.name}' already visited"
+                )
+            parent_nodes = await parent.get_effective_nodes(store, visited)
+            result.extend(parent_nodes)
+
+        return result
+
+
+@dataclass
+class User:
+    user_id: str
+    username: Optional[str] = None
+    primary_group: Optional[str] = None
+    groups: List[str] = field(default_factory=list)
+    nodes: List[PermissionNode] = field(default_factory=list)
+
+    async def get_effective_nodes(
+        self,
+        store,
+        options: QueryOptions,
+        current_ctx: Optional["ContextSet"] = None,
+    ) -> Dict[str, bool]:
+        from .engine import PermissionEngine
+        return await PermissionEngine.resolve_effective_nodes(self, store, options, current_ctx)
+
+    async def has_permission(
+        self,
+        node_key: str,
+        store,
+        options: QueryOptions,
+    ) -> bool:
+        from .engine import PermissionEngine
+        return PermissionEngine.check(
+            await self.get_effective_nodes(store, options),
+            node_key,
+        )

nonebot_plugin_onebot_luckperms/core/registry.py

@@ -0,0 +1,72 @@
+from __future__ import annotations
+
+import logging
+from typing import Dict, List, Optional
+
+from .models import PermissionNode, ContextSet
+
+logger = logging.getLogger("oblp")
+
+
+class NodeRegistry:
+    _nodes: Dict[str, dict] = {}
+
+    @classmethod
+    def register(
+        cls,
+        key: str,
+        description: str = "",
+        default: bool = False,
+        contexts: Optional[ContextSet] = None,
+    ):
+        if key in cls._nodes:
+            existing = cls._nodes[key]
+            if existing.get("description") != description or existing.get("contexts") != (contexts or ContextSet()):
+                logger.warning(
+                    f"Node '{key}' already registered with different parameters, "
+                    f"keeping first registration"
+                )
+            return
+        cls._nodes[key] = {
+            "key": key,
+            "description": description,
+            "default": default,
+            "contexts": contexts or ContextSet(),
+        }
+
+    @classmethod
+    def get(cls, key: str) -> Optional[dict]:
+        return cls._nodes.get(key)
+
+    @classmethod
+    def list_all(cls) -> List[dict]:
+        return list(cls._nodes.values())
+
+    @classmethod
+    def get_ancestors(cls, key: str) -> List[str]:
+        parts = key.split(".")
+        ancestors = []
+        for i in range(len(parts) - 1, 0, -1):
+            ancestors.append(".".join(parts[:i]))
+        return ancestors
+
+    @classmethod
+    def get_default(cls, key: str) -> bool:
+        info = cls._nodes.get(key)
+        if info is None:
+            for pattern, val in cls._nodes.items():
+                if "*" in pattern:
+                    import fnmatch
+                    if fnmatch.fnmatch(key, pattern):
+                        return val.get("default", False)
+            return False
+        return info.get("default", False)
+
+
+def register_node(
+    key: str,
+    description: str = "",
+    default: bool = False,
+    contexts: Optional[ContextSet] = None,
+):
+    NodeRegistry.register(key, description, default, contexts)

nonebot_plugin_onebot_luckperms/message.py

@@ -0,0 +1,126 @@
+from __future__ import annotations
+
+import asyncio
+import logging
+from pathlib import Path
+from typing import Dict, Optional
+import yaml
+
+logger = logging.getLogger("oblp")
+
+_DEFAULT_MESSAGES: Dict[str, str] = {
+    "deny": "Permission denied. You do not have the required permission node.",
+    "deny_hint": "You can ask the bot administrator to grant you the required permission.",
+    "data_reloaded": "Data reloaded.",
+    "unknown_command": "Unknown command: {cmd}. Use /lp help",
+    "not_initialized": "OBLP not initialized.",
+    "user_not_found": "User {user_id} not found.",
+    "user_created": "User {user_id} created.",
+    "user_deleted": "User {user_id} deleted.",
+    "user_cloned": "User {user_id} cloned to {target}.",
+    "user_cleared": "User {user_id} permissions cleared.",
+    "user_promoted": "User {user_id} promoted to {track}.",
+    "user_demoted": "User {user_id} demoted from {track}.",
+    "perm_set": "{entity}: {action} {node}",
+    "perm_set_context": "{entity}: {action} {node} (ctx: {context})",
+    "perm_temp": "{entity}: temp {action} {node} ({duration})",
+    "perm_removed": "{entity}: removed {node}",
+    "perm_cleared": "{entity}: permissions cleared",
+    "perm_no_nodes": "No permission nodes.",
+    "perm_check_result": "{entity} check {node}: {result}",
+    "perm_check_allow": "ALLOW",
+    "perm_check_deny": "DENY",
+    "group_not_found": "Group {name} not found.",
+    "group_created": "Group {name} created (weight={weight}).",
+    "group_deleted": "Group {name} deleted.",
+    "group_already_exists": "Group {name} already exists.",
+    "group_renamed": "Group {name} renamed to {new_name}.",
+    "group_cloned": "Group {name} cloned to {new_name}.",
+    "group_weight_set": "Group {name} weight set to {weight}.",
+    "group_displayname_set": "Group {name} display name set to {display_name}.",
+    "group_cleared": "Group {name} permissions cleared.",
+    "group_no_members": "No members in group {name}.",
+    "parent_added": "Added parent {parent} to {entity}.",
+    "parent_removed": "Removed parent {parent} from {entity}.",
+    "parent_cleared": "{entity}: parents cleared",
+    "parent_no_parents": "{entity} has no parents.",
+    "primary_group_set": "User {entity} primary group set to {group}.",
+    "editor_opened": "Web Editor opened: {url}",
+    "editor_failed": "Editor failed: {error}",
+    "editor_apply_ok": "Applied edits for code: {code}",
+    "editor_apply_failed": "Apply failed: {error}",
+}
+
+_messages: Dict[str, str] = {}
+_loaded_path: Optional[Path] = None
+
+
+async def load_messages(path: Optional[str] = None):
+    global _messages, _loaded_path
+    _messages = dict(_DEFAULT_MESSAGES)
+
+    if not path:
+        return
+
+    p = Path(path)
+
+    # If file doesn't exist, try to export defaults
+    if not await asyncio.to_thread(p.exists):
+        try:
+            await _export_defaults(str(p))
+            logger.info(f"Default message file created at {path}")
+        except Exception as e:
+            logger.warning(f"Could not create message file at {path}: {e}")
+        return
+
+    try:
+        loop = asyncio.get_event_loop()
+        raw = await loop.run_in_executor(None, _read_file, p)
+        if not raw.strip():
+            logger.warning(f"Message file {path} is empty, using defaults")
+            return
+        custom = yaml.safe_load(raw) or {}
+        if not isinstance(custom, dict):
+            logger.warning(f"Message file {path} is not a valid YAML mapping, using defaults")
+            return
+        for k, v in custom.items():
+            if k in _messages and isinstance(v, str):
+                _messages[k] = v
+        _loaded_path = p
+        logger.info(f"Messages loaded from {path} ({len(custom)} overrides)")
+    except yaml.YAMLError as e:
+        logger.error(f"YAML parse error in {path}: {e}")
+    except Exception as e:
+        logger.error(f"Failed to load message file {path}: {e}")
+
+
+def _read_file(p: Path) -> str:
+    with open(p, "r", encoding="utf-8") as f:
+        return f.read()
+
+
+def msg(key: str, **kwargs) -> str:
+    template = _messages.get(key, _DEFAULT_MESSAGES.get(key, key))
+    if kwargs:
+        try:
+            return template.format(**kwargs)
+        except KeyError as e:
+            logger.warning(f"Missing placeholder {e} in message '{key}'")
+            return template
+    return template
+
+
+async def _export_defaults(path: str):
+    """Write default messages to a YAML file as a template for users."""
+    p = Path(path)
+    await asyncio.to_thread(p.parent.mkdir, parents=True, exist_ok=True)
+    await asyncio.to_thread(_write_yaml, p, _DEFAULT_MESSAGES)
+    logger.info(f"Default message template exported to {path}")
+
+
+def _write_yaml(p: Path, data: dict):
+    with open(p, "w", encoding="utf-8") as f:
+        yaml.dump(
+            data,
+            f, allow_unicode=True, default_flow_style=False, sort_keys=False,
+        )

nonebot_plugin_onebot_luckperms/storage/__init__.py

@@ -0,0 +1,29 @@
+from typing import Optional
+
+from .protocol import PermissionStore
+from .memory import MemoryStore
+from .sqlite import SQLiteStore
+
+_store: Optional[PermissionStore] = None
+
+
+def _get_redis_store(**kwargs):
+    from .redis import RedisStore
+    return RedisStore(url=kwargs.get("redis_url", "redis://localhost:6379/0"))
+
+
+def init_store(store_type: str, **kwargs) -> PermissionStore:
+    global _store
+    if store_type == "memory":
+        _store = MemoryStore()
+    elif store_type == "sqlite":
+        _store = SQLiteStore(db_path=kwargs.get("db_path", "./data/oblp/permissions.db"))
+    elif store_type == "redis":
+        _store = _get_redis_store(**kwargs)
+    else:
+        raise ValueError(f"Unknown store type: {store_type}")
+    return _store
+
+
+def get_store() -> Optional[PermissionStore]:
+    return _store