pangea-sdk 6.0.0__py3-none-any.whl → 6.2.0b1__py3-none-any.whl

pangea/services/authn/authn.py

@@ -2,14 +2,17 @@
 # Author: Pangea Cyber Corporation
 from __future__ import annotations
 
-from typing import Dict, List, Optional, Union
+from typing import Dict, List, Literal, Optional, Union
 
 import pangea.services.authn.models as m
 from pangea.config import PangeaConfig
 from pangea.response import PangeaResponse, PangeaResponseResult
 from pangea.services.base import ServiceBase
 
-SERVICE_NAME = "authn"
+__all__ = ["AuthN"]
+
+
+_SERVICE_NAME = "authn"
 
 
 class AuthN(ServiceBase):
@@ -35,7 +38,7 @@ class AuthN(ServiceBase):
         authn = AuthN(token=PANGEA_TOKEN, config=authn_config)
     """
 
-    service_name = SERVICE_NAME
+    service_name = _SERVICE_NAME
 
     def __init__(
         self,
@@ -63,9 +66,10 @@ class AuthN(ServiceBase):
         self.client = AuthN.Client(token, config, logger_name=logger_name)
         self.session = AuthN.Session(token, config, logger_name=logger_name)
         self.agreements = AuthN.Agreements(token, config, logger_name=logger_name)
+        self.group = AuthN.Group(token, config, logger_name=logger_name)
 
     class Session(ServiceBase):
-        service_name = SERVICE_NAME
+        service_name = _SERVICE_NAME
 
         def __init__(
             self,
@@ -161,7 +165,7 @@ class AuthN(ServiceBase):
             )
 
     class Client(ServiceBase):
-        service_name = SERVICE_NAME
+        service_name = _SERVICE_NAME
 
         def __init__(
             self,
@@ -221,7 +225,7 @@ class AuthN(ServiceBase):
             return self.request.post("v2/client/jwks", m.ClientJWKSResult, {})
 
         class Session(ServiceBase):
-            service_name = SERVICE_NAME
+            service_name = _SERVICE_NAME
 
             def __init__(
                 self,
@@ -359,7 +363,7 @@ class AuthN(ServiceBase):
                 )
 
         class Password(ServiceBase):
-            service_name = SERVICE_NAME
+            service_name = _SERVICE_NAME
 
             def __init__(
                 self,
@@ -419,7 +423,7 @@ class AuthN(ServiceBase):
                 return self.request.post("v2/user/password/expire", PangeaResponseResult, {"id": user_id})
 
         class Token(ServiceBase):
-            service_name = SERVICE_NAME
+            service_name = _SERVICE_NAME
 
             def __init__(
                 self,
@@ -456,18 +460,19 @@ class AuthN(ServiceBase):
                 )
 
     class User(ServiceBase):
-        service_name = SERVICE_NAME
+        service_name = _SERVICE_NAME
 
         def __init__(
             self,
-            token,
-            config=None,
-            logger_name="pangea",
-        ):
+            token: str,
+            config: PangeaConfig | None = None,
+            logger_name: str = "pangea",
+        ) -> None:
             super().__init__(token, config, logger_name=logger_name)
             self.profile = AuthN.User.Profile(token, config, logger_name=logger_name)
             self.authenticators = AuthN.User.Authenticators(token, config, logger_name=logger_name)
             self.invites = AuthN.User.Invites(token, config, logger_name=logger_name)
+            self.group = AuthN.User.Group(token, config, logger_name=logger_name)
 
         def create(
             self,
@@ -663,7 +668,7 @@ class AuthN(ServiceBase):
             return self.request.post("v2/user/list", m.UserListResult, data=input.model_dump(exclude_none=True))
 
         class Invites(ServiceBase):
-            service_name = SERVICE_NAME
+            service_name = _SERVICE_NAME
 
             def __init__(
                 self,
@@ -735,7 +740,7 @@ class AuthN(ServiceBase):
                 )
 
         class Authenticators(ServiceBase):
-            service_name = SERVICE_NAME
+            service_name = _SERVICE_NAME
 
             def __init__(
                 self,
@@ -817,7 +822,7 @@ class AuthN(ServiceBase):
                 )
 
         class Profile(ServiceBase):
-            service_name = SERVICE_NAME
+            service_name = _SERVICE_NAME
 
             def __init__(
                 self,
@@ -901,8 +906,57 @@ class AuthN(ServiceBase):
                     "v2/user/profile/update", m.UserProfileUpdateResult, data=input.model_dump(exclude_none=True)
                 )
 
+        class Group(ServiceBase):
+            service_name = _SERVICE_NAME
+
+            def __init__(
+                self,
+                token: str,
+                config: PangeaConfig | None = None,
+                logger_name: str = "pangea",
+            ) -> None:
+                super().__init__(token, config, logger_name=logger_name)
+
+            def assign(self, user_id: str, group_ids: list[str]) -> PangeaResponse[PangeaResponseResult]:
+                """
+                Assign groups to a user
+
+                Add a list of groups to a specified user
+
+                OperationId: authn_post_v2_user_group_assign
+                """
+                return self.request.post(
+                    "v2/user/group/assign",
+                    data={"id": user_id, "group_ids": group_ids},
+                    result_class=m.PangeaResponseResult,
+                )
+
+            def remove(self, user_id: str, group_id: str) -> PangeaResponse[PangeaResponseResult]:
+                """
+                Remove a group assigned to a user
+
+                Remove a group assigned to a user
+
+                OperationId: authn_post_v2_user_group_remove
+                """
+                return self.request.post(
+                    "v2/user/group/remove",
+                    data={"id": user_id, "group_id": group_id},
+                    result_class=m.PangeaResponseResult,
+                )
+
+            def list(self, user_id: str) -> PangeaResponse[m.GroupList]:
+                """
+                List of groups assigned to a user
+
+                Return a list of ids for groups assigned to a user
+
+                OperationId: authn_post_v2_user_group_list
+                """
+                return self.request.post("v2/user/group/list", data={"id": user_id}, result_class=m.GroupList)
+
     class Flow(ServiceBase):
-        service_name = SERVICE_NAME
+        service_name = _SERVICE_NAME
 
         def __init__(
             self,
@@ -1042,7 +1096,7 @@ class AuthN(ServiceBase):
             return self.request.post("v2/flow/update", m.FlowUpdateResult, data=input.model_dump(exclude_none=True))
 
     class Agreements(ServiceBase):
-        service_name = SERVICE_NAME
+        service_name = _SERVICE_NAME
 
         def __init__(
             self,
@@ -1192,3 +1246,108 @@ class AuthN(ServiceBase):
             return self.request.post(
                 "v2/agreements/update", m.AgreementUpdateResult, data=input.model_dump(exclude_none=True)
             )
+
+    class Group(ServiceBase):
+        service_name = _SERVICE_NAME
+
+        def __init__(
+            self,
+            token: str,
+            config: PangeaConfig | None = None,
+            logger_name: str = "pangea",
+        ) -> None:
+            super().__init__(token, config, logger_name=logger_name)
+
+        def create(
+            self, name: str, type: str, *, description: str | None = None, attributes: dict[str, str] | None = None
+        ) -> PangeaResponse[m.GroupInfo]:
+            """
+            Create a new group
+
+            Create a new group
+
+            OperationId: authn_post_v2_group_create
+            """
+            return self.request.post(
+                "v2/group/create",
+                data={"name": name, "type": type, "description": description, "attributes": attributes},
+                result_class=m.GroupInfo,
+            )
+
+        def delete(self, id: str) -> PangeaResponse[PangeaResponseResult]:
+            """
+            Delete a group
+
+            Delete a group
+
+            OperationId: authn_post_v2_group_delete
+            """
+            return self.request.post("v2/group/delete", data={"id": id}, result_class=PangeaResponseResult)
+
+        def get(self, id: str) -> PangeaResponse[m.GroupInfo]:
+            """
+            Get group information
+
+            Look up a group by ID and return its information.
+
+            OperationId: authn_post_v2_group_get
+            """
+            return self.request.post("v2/group/get", data={"id": id}, result_class=m.GroupInfo)
+
+        def list(
+            self,
+            *,
+            filter: m.GroupsFilter | None = None,
+            last: str | None = None,
+            order: Literal["asc", "desc"] | None = None,
+            order_by: Literal["id", "created_at", "updated_at", "name", "type"] | None = None,
+            size: int | None = None,
+        ) -> PangeaResponse[m.GroupList]:
+            """
+            List groups
+
+            Look up groups by name, type, or attributes.
+            """
+            return self.request.post(
+                "v2/group/list",
+                data={"filter": filter, "last": last, "order": order, "order_by": order_by, "size": size},
+                result_class=m.GroupList,
+            )
+
+        def list_users(
+            self, id: str, *, last: str | None = None, size: int | None = None
+        ) -> PangeaResponse[m.GroupUserList]:
+            """
+            List of users assigned to a group
+
+            Return a list of ids for users assigned to a group
+
+            OperationId: authn_post_v2_group_user_list
+            """
+            return self.request.post(
+                "v2/group/user/list",
+                data={"id": id, "last": last, "size": size},
+                result_class=m.GroupUserList,
+            )
+
+        def update(
+            self,
+            id: str,
+            *,
+            name: str | None = None,
+            description: str | None = None,
+            type: str | None = None,
+            attributes: dict[str, str] | None = None,
+        ) -> PangeaResponse[m.GroupInfo]:
+            """
+            Update group information
+
+            Update group information
+
+            OperationId: authn_post_v2_group_update
+            """
+            return self.request.post(
+                "v2/group/update",
+                data={"id": id, "name": name, "description": description, "type": type, "attributes": attributes},
+                result_class=m.GroupInfo,
+            )

pangea/services/authn/models.py

@@ -939,3 +939,97 @@ class AgreementUpdateRequest(APIRequestModel):
 
 class AgreementUpdateResult(AgreementInfo):
     pass
+
+
+class GroupInfo(PangeaResponseResult):
+    """A group and its information"""
+
+    id: str
+    name: str
+    type: str
+
+    description: Optional[str] = None
+    attributes: Optional[Dict[str, str]] = None
+    created_at: Optional[str] = None
+    updated_at: Optional[str] = None
+
+
+class GroupsFilter(APIRequestModel):
+    """Search filter for groups"""
+
+    created_at: Optional[str] = None
+    """Only records where created_at equals this value."""
+
+    created_at__gt: Optional[str] = None
+    """Only records where created_at is greater than this value."""
+
+    created_at__gte: Optional[str] = None
+    """Only records where created_at is greater than or equal to this value."""
+
+    created_at__lt: Optional[str] = None
+    """Only records where created_at is less than this value."""
+
+    created_at__lte: Optional[str] = None
+    """Only records where created_at is less than or equal to this value."""
+
+    created_at__contains: Optional[str] = None
+    """Only records where created_at includes this value."""
+
+    id: Optional[str] = None
+    """Only records where id equals this value."""
+
+    id__contains: Optional[List[str]] = None
+    """Only records where id includes each substring."""
+
+    id__in: Optional[List[str]] = None
+    """Only records where id equals one of the provided substrings."""
+
+    name: Optional[str] = None
+    """Only records where name equals this value."""
+
+    name__contains: Optional[List[str]] = None
+    """Only records where name includes each substring."""
+
+    name__in: Optional[List[str]] = None
+    """Only records where name equals one of the provided substrings."""
+
+    type: Optional[str] = None
+    """Only records where type equals this value."""
+
+    type__contains: Optional[List[str]] = None
+    """Only records where type includes each substring."""
+
+    type__in: Optional[List[str]] = None
+    """Only records where type equals one of the provided substrings."""
+
+    updated_at: Optional[str] = None
+    """Only records where updated_at equals this value."""
+
+    updated_at__gt: Optional[str] = None
+    """Only records where updated_at is greater than this value."""
+
+    updated_at__gte: Optional[str] = None
+    """Only records where updated_at is greater than or equal to this value."""
+
+    updated_at__lt: Optional[str] = None
+    """Only records where updated_at is less than this value."""
+
+    updated_at__lte: Optional[str] = None
+    """Only records where updated_at is less than or equal to this value."""
+
+    updated_at__contains: Optional[str] = None
+    """Only records where updated_at includes this value."""
+
+
+class GroupList(PangeaResponseResult):
+    groups: List[GroupInfo]
+    """List of matching groups"""
+
+    count: int
+    last: Optional[str] = None
+
+
+class GroupUserList(PangeaResponseResult):
+    users: List[User]
+    count: int
+    last: Optional[str] = None

pangea/services/authz.py

@@ -51,6 +51,8 @@ class Tuple(PangeaResponseResult):
     resource: Resource
     relation: str
     subject: Subject
+    expires_at: Optional[str] = None
+    """A time in ISO-8601 format"""
 
 
 class TupleCreateRequest(APIRequestModel):
@@ -63,23 +65,51 @@ class TupleCreateResult(PangeaResponseResult):
 
 class TupleListFilter(APIRequestModel):
     resource_type: Optional[str] = None
+    """Only records where resource type equals this value."""
     resource_type__contains: Optional[List[str]] = None
+    """Only records where resource type includes each substring."""
     resource_type__in: Optional[List[str]] = None
+    """Only records where resource type equals one of the provided substrings."""
     resource_id: Optional[str] = None
+    """Only records where resource id equals this value."""
     resource_id__contains: Optional[List[str]] = None
+    """Only records where resource id includes each substring."""
     resource_id__in: Optional[List[str]] = None
+    """Only records where resource id equals one of the provided substrings."""
     relation: Optional[str] = None
+    """Only records where relation equals this value."""
     relation__contains: Optional[List[str]] = None
+    """Only records where relation includes each substring."""
     relation__in: Optional[List[str]] = None
+    """Only records where relation equals one of the provided substrings."""
     subject_type: Optional[str] = None
+    """Only records where subject type equals this value."""
     subject_type__contains: Optional[List[str]] = None
+    """Only records where subject type includes each substring."""
     subject_type__in: Optional[List[str]] = None
+    """Only records where subject type equals one of the provided substrings."""
     subject_id: Optional[str] = None
+    """Only records where subject id equals this value."""
     subject_id__contains: Optional[List[str]] = None
+    """Only records where subject id includes each substring."""
     subject_id__in: Optional[List[str]] = None
+    """Only records where subject id equals one of the provided substrings."""
     subject_action: Optional[str] = None
+    """Only records where subject action equals this value."""
     subject_action__contains: Optional[List[str]] = None
+    """Only records where subject action includes each substring."""
     subject_action__in: Optional[List[str]] = None
+    """Only records where subject action equals one of the provided substrings."""
+    expires_at: Optional[str] = None
+    """Only records where expires_at equals this value."""
+    expires_at__gt: Optional[str] = None
+    """Only records where expires_at is greater than this value."""
+    expires_at__gte: Optional[str] = None
+    """Only records where expires_at is greater than or equal to this value."""
+    expires_at__lt: Optional[str] = None
+    """Only records where expires_at is less than this value."""
+    expires_at__lte: Optional[str] = None
+    """Only records where expires_at is less than or equal to this value."""
 
 
 class TupleListRequest(APIRequestModel):
@@ -109,7 +139,9 @@ class CheckRequest(APIRequestModel):
     action: str
     subject: Subject
     debug: Optional[bool] = None
+    """In the event of an allowed check, return a path that granted access."""
     attributes: Optional[Dict[str, Any]] = None
+    """A JSON object of attribute data."""
 
 
 class DebugPath(APIResponseModel):
@@ -145,6 +177,8 @@ class ListSubjectsRequest(APIRequestModel):
     resource: Resource
     action: str
     attributes: Optional[Dict[str, Any]] = None
+    debug: Optional[bool] = None
+    """Return a path for each found subject"""
 
 
 class ListSubjectsResult(PangeaResponseResult):
@@ -194,14 +228,14 @@ class AuthZ(ServiceBase):
 
         super().__init__(token, config, logger_name, config_id=config_id)
 
-    def tuple_create(self, tuples: List[Tuple]) -> PangeaResponse[TupleCreateResult]:
+    def tuple_create(self, tuples: list[Tuple]) -> PangeaResponse[TupleCreateResult]:
         """Create tuples.
 
         Create tuples in the AuthZ Service. The request will fail if there is no schema
         or the tuples do not validate against the schema.
 
         Args:
-            tuples (List[Tuple]): List of tuples to be created.
+            tuples: Tuples to be created.
 
         Raises:
             PangeaAPIException: If an API Error happens.
@@ -229,10 +263,10 @@ class AuthZ(ServiceBase):
     def tuple_list(
         self,
         filter: TupleListFilter,
-        size: Optional[int] = None,
-        last: Optional[str] = None,
-        order: Optional[ItemOrder] = None,
-        order_by: Optional[TupleOrderBy] = None,
+        size: int | None = None,
+        last: str | None = None,
+        order: ItemOrder | None = None,
+        order_by: TupleOrderBy | None = None,
     ) -> PangeaResponse[TupleListResult]:
         """List tuples.
 
@@ -241,11 +275,11 @@ class AuthZ(ServiceBase):
         is empty it will return all the tuples.
 
         Args:
-            filter (TupleListFilter): The filter for listing tuples.
-            size (Optional[int]): The size of the result set. Default is None.
-            last (Optional[str]): The last token from a previous response. Default is None.
-            order (Optional[ItemOrder]): Order results asc(ending) or desc(ending).
-            order_by (Optional[TupleOrderBy]): Which field to order results by.
+            filter: The filter for listing tuples.
+            size: The size of the result set. Default is None.
+            last: The last token from a previous response. Default is None.
+            order: Order results asc(ending) or desc(ending).
+            order_by: Which field to order results by.
 
         Raises:
             PangeaAPIException: If an API Error happens.
@@ -263,13 +297,13 @@ class AuthZ(ServiceBase):
         )
         return self.request.post("v1/tuple/list", TupleListResult, data=input_data.model_dump(exclude_none=True))
 
-    def tuple_delete(self, tuples: List[Tuple]) -> PangeaResponse[TupleDeleteResult]:
+    def tuple_delete(self, tuples: list[Tuple]) -> PangeaResponse[TupleDeleteResult]:
         """Delete tuples.
 
         Delete tuples in the AuthZ Service.
 
         Args:
-            tuples (List[Tuple]): List of tuples to be deleted.
+            tuples: Tuples to be deleted.
 
         Raises:
             PangeaAPIException: If an API Error happens.
@@ -299,19 +333,19 @@ class AuthZ(ServiceBase):
         resource: Resource,
         action: str,
         subject: Subject,
-        debug: Optional[bool] = None,
-        attributes: Optional[Dict[str, Any]] = None,
+        debug: bool | None = None,
+        attributes: dict[str, Any] | None = None,
     ) -> PangeaResponse[CheckResult]:
         """Perform a check request.
 
         Check if a subject has permission to perform an action on the resource.
 
         Args:
-            resource (Resource): The resource to check.
-            action (str): The action to check.
-            subject (Subject): The subject to check.
-            debug (Optional[bool]): Setting this value to True will provide a detailed analysis of the check.
-            attributes (Optional[Dict[str, Any]]): Additional attributes for the check.
+            resource: The resource to check.
+            action: The action to check.
+            subject: The subject to check.
+            debug: In the event of an allowed check, return a path that granted access.
+            attributes: Additional attributes for the check.
 
         Raises:
             PangeaAPIException: If an API Error happens.
@@ -334,7 +368,7 @@ class AuthZ(ServiceBase):
         return self.request.post("v1/check", CheckResult, data=input_data.model_dump(exclude_none=True))
 
     def list_resources(
-        self, type: str, action: str, subject: Subject, attributes: Optional[Dict[str, Any]] = None
+        self, type: str, action: str, subject: Subject, attributes: dict[str, Any] | None = None
     ) -> PangeaResponse[ListResourcesResult]:
         """List resources.
 
@@ -342,10 +376,10 @@ class AuthZ(ServiceBase):
         type that the subject has access to the action with.
 
         Args:
-            type (str): The type to filter resources.
-            action (str): The action to filter resources.
-            subject (Subject): The subject to filter resources.
-            attributes (Optional[Dict[str, Any]]): A JSON object of attribute data.
+            type: The type to filter resources.
+            action: The action to filter resources.
+            subject: The subject to filter resources.
+            attributes: A JSON object of attribute data.
 
         Raises:
             PangeaAPIException: If an API Error happens.
@@ -369,7 +403,7 @@ class AuthZ(ServiceBase):
         )
 
     def list_subjects(
-        self, resource: Resource, action: str, attributes: Optional[Dict[str, Any]] = None
+        self, resource: Resource, action: str, attributes: dict[str, Any] | None = None, *, debug: bool | None = None
     ) -> PangeaResponse[ListSubjectsResult]:
         """List subjects.
 
@@ -377,9 +411,10 @@ class AuthZ(ServiceBase):
         access to the action for the given resource.
 
         Args:
-            resource (Resource): The resource to filter subjects.
-            action (str): The action to filter subjects.
-            attributes (Optional[Dict[str, Any]]): A JSON object of attribute data.
+            resource: The resource to filter subjects.
+            action: The action to filter subjects.
+            attributes: A JSON object of attribute data.
+            debug: Return a path for each found subject.
 
         Raises:
             PangeaAPIException: If an API Error happens.
@@ -396,5 +431,5 @@ class AuthZ(ServiceBase):
             )
         """
 
-        input_data = ListSubjectsRequest(resource=resource, action=action, attributes=attributes)
+        input_data = ListSubjectsRequest(resource=resource, action=action, attributes=attributes, debug=debug)
         return self.request.post("v1/list-subjects", ListSubjectsResult, data=input_data.model_dump(exclude_none=True))