planar 0.5.0__py3-none-any.whl

planar/security/tests/test_cedar_basics.py

@@ -0,0 +1,41 @@
+from cedarpy import Decision, format_policies, is_authorized
+
+
+def test_cedar_permissions():
+    # Define entities
+    entities = [
+        {
+            "uid": {"__entity": {"type": "Principal", "id": "alice"}},
+            "attrs": {},
+            "parents": [],
+        },
+        {
+            "uid": {"__entity": {"type": "Document", "id": "doc1"}},
+            "attrs": {},
+            "parents": [],
+        },
+    ]
+
+    # Initialize the Cedar policy service
+    policy = """
+    permit (
+        principal,
+        action == Action::"Run",
+        resource
+    );
+    """
+    formatted_policy = format_policies(policy)
+    print(formatted_policy)
+
+    # Create a simple request
+    request = {
+        "principal": 'Principal::"alice"',
+        "action": 'Action::"Run"',
+        "resource": 'Document::"doc1"',
+    }
+
+    # Test the authorization
+    result = is_authorized(request, policy, entities)
+    assert result.decision == Decision.Allow, (
+        "Cedar works and basic permission should be allowed"
+    )

planar/security/tests/test_cedar_policies.py

@@ -0,0 +1,158 @@
+import pytest
+
+from planar.security.auth_context import Principal
+from planar.security.authorization import (
+    AgentAction,
+    CedarEntity,
+    PolicyService,
+    RuleAction,
+    WorkflowAction,
+)
+
+
+@pytest.fixture
+def policy_service():
+    return PolicyService()
+
+
+def test_workflow_permissions(policy_service: PolicyService):
+    # Create a test principal (user)
+    user_principal = Principal(
+        sub="user123"  # type: ignore
+    )
+
+    # Create test resources
+    workflow_resource = CedarEntity.from_workflow("com.example.workflow.ProcessData")
+
+    # Test Workflow Actions
+    assert policy_service.is_allowed(
+        CedarEntity.from_principal(user_principal),
+        WorkflowAction.WORKFLOW_LIST,
+        workflow_resource,
+    ), "User should be able to list workflows"
+
+    assert policy_service.is_allowed(
+        CedarEntity.from_principal(user_principal),
+        WorkflowAction.WORKFLOW_VIEW_DETAILS,
+        workflow_resource,
+    ), "User should be able to view workflow details"
+
+    assert policy_service.is_allowed(
+        CedarEntity.from_principal(user_principal),
+        WorkflowAction.WORKFLOW_RUN,
+        workflow_resource,
+    ), "User should be able to run workflow"
+
+    assert policy_service.is_allowed(
+        CedarEntity.from_principal(user_principal),
+        WorkflowAction.WORKFLOW_CANCEL,
+        workflow_resource,
+    ), "User should be able to cancel workflow"
+
+
+def test_agent_permissions(policy_service: PolicyService):
+    user_principal = Principal(
+        sub="user123"  # type: ignore
+    )
+
+    agent_resource = CedarEntity.from_agent("OcrAgent")
+
+    # Test Agent Actions
+    assert policy_service.is_allowed(
+        CedarEntity.from_principal(user_principal),
+        AgentAction.AGENT_LIST,
+        agent_resource,
+    ), "User should be able to list agents"
+
+    assert policy_service.is_allowed(
+        CedarEntity.from_principal(user_principal),
+        AgentAction.AGENT_VIEW_DETAILS,
+        agent_resource,
+    ), "User should be able to view agent details"
+
+    assert policy_service.is_allowed(
+        CedarEntity.from_principal(user_principal),
+        AgentAction.AGENT_RUN,
+        agent_resource,
+    ), "User should be able to run agent"
+
+    assert policy_service.is_allowed(
+        CedarEntity.from_principal(user_principal),
+        AgentAction.AGENT_UPDATE,
+        agent_resource,
+    ), "User should be able to configure agent"
+
+
+def test_denied_permission(policy_service: PolicyService):
+    # Create a test principal (user)
+    user_principal = Principal(
+        sub="user123"  # type: ignore
+    )
+
+    # Create test resource
+    workflow_resource = CedarEntity.from_workflow("com.example.workflow.ProcessData")
+
+    # Test that a non-existent action is denied
+    assert not policy_service.is_allowed(
+        CedarEntity.from_principal(user_principal),
+        "Workflow::Delete",  # This action is not defined in our policies
+        workflow_resource,
+    ), "User should not be able to delete workflows"
+
+
+def test_deny_edits_to_rules_for_member_role(policy_service: PolicyService):
+    member_jwt_data = {
+        "org_name": "CoPlane",
+        "user_first_name": "Donald",
+        "user_last_name": "Knuth",
+        "user_email": "don@coplane.com",
+        "iss": "https://auth-api.coplane.com",
+        "sub": "user_02JYMGMYETXMAVB0GKT868T8V7",
+        "sid": "session_01JZ6NJVC1MSR86VZNR54BF9D4",
+        "jti": "01JZ8EHD793F6RTY8FC4A3H4E9",
+        "org_id": "org_01JY4QP57Y7H4EQ7HT3BGN7TNK",
+        "role": "member",
+        "permissions": [],
+        "feature_flags": [],
+        "exp": 1751556901,
+        "iat": 1751556601,
+    }
+
+    user_principal = Principal.from_jwt_payload(member_jwt_data)
+
+    rule_resource = CedarEntity.from_rule("complex_business_rule")
+
+    assert not policy_service.is_allowed(
+        CedarEntity.from_principal(user_principal),
+        RuleAction.RULE_UPDATE,
+        rule_resource,
+    )
+
+
+def test_allow_edits_to_rules_for_admin_role(policy_service: PolicyService):
+    member_jwt_data = {
+        "org_name": "CoPlane",
+        "user_first_name": "Donald",
+        "user_last_name": "Knuth",
+        "user_email": "don@coplane.com",
+        "iss": "https://auth-api.coplane.com",
+        "sub": "user_02JYMGMYETXMAVB0GKT868T8V7",
+        "sid": "session_01JZ6NJVC1MSR86VZNR54BF9D4",
+        "jti": "01JZ8EHD793F6RTY8FC4A3H4E9",
+        "org_id": "org_01JY4QP57Y7H4EQ7HT3BGN7TNK",
+        "role": "admin",
+        "permissions": [],
+        "feature_flags": [],
+        "exp": 1751556901,
+        "iat": 1751556601,
+    }
+
+    user_principal = Principal.from_jwt_payload(member_jwt_data)
+
+    rule_resource = CedarEntity.from_rule("complex_business_rule")
+
+    assert policy_service.is_allowed(
+        CedarEntity.from_principal(user_principal),
+        RuleAction.RULE_UPDATE,
+        rule_resource,
+    )

planar/security/tests/test_jwt_principal_context.py

@@ -0,0 +1,179 @@
+import pytest
+
+from planar.security.auth_context import (
+    Principal,
+    clear_principal,
+    get_current_principal,
+    has_role,
+    require_principal,
+    set_principal,
+)
+
+
+def test_principal_from_jwt_payload():
+    # Test with minimal required fields
+    payload = {"sub": "user123"}
+    principal = Principal.from_jwt_payload(payload)
+    assert principal.sub == "user123"
+    assert principal.extra_claims == {}
+
+    # Test with all standard fields
+    payload = {
+        "sub": "user123",
+        "iss": "https://auth-api.coplane.com",
+        "exp": 1234567890,
+        "iat": 1234567890,
+        "sid": "session123",
+        "jti": "jwt123",
+        "org_id": "org123",
+        "org_name": "Test Org",
+        "user_first_name": "John",
+        "user_last_name": "Doe",
+        "user_email": "john@example.com",
+        "role": "admin",
+        "permissions": ["read", "write"],
+    }
+    principal = Principal.from_jwt_payload(payload)
+    assert principal.sub == "user123"
+    assert principal.iss == "https://auth-api.coplane.com"
+    assert principal.exp == 1234567890
+    assert principal.iat == 1234567890
+    assert principal.sid == "session123"
+    assert principal.jti == "jwt123"
+    assert principal.org_id == "org123"
+    assert principal.org_name == "Test Org"
+    assert principal.user_first_name == "John"
+    assert principal.user_last_name == "Doe"
+    assert principal.user_email == "john@example.com"
+    assert principal.role == "admin"
+    assert principal.permissions == ["read", "write"]
+    assert principal.extra_claims == {}
+
+    # Test with extra claims
+    payload = {
+        "sub": "user123",
+        "custom_field": "custom_value",
+        "another_field": 123,
+    }
+    principal = Principal.from_jwt_payload(payload)
+    assert principal.sub == "user123"
+    assert principal.extra_claims == {
+        "custom_field": "custom_value",
+        "another_field": 123,
+    }
+
+    # Test with missing required field
+    with pytest.raises(ValueError, match="JWT payload must contain 'sub' field"):
+        Principal.from_jwt_payload({})
+
+
+def test_get_current_principal():
+    # Test when no principal is set
+    assert get_current_principal() is None
+
+    # Test when principal is set
+    principal = Principal(
+        sub="user123",
+        iss=None,
+        exp=None,
+        iat=None,
+        sid=None,
+        jti=None,
+        org_id=None,
+        org_name=None,
+        user_first_name=None,
+        user_last_name=None,
+        user_email=None,
+        role=None,
+        permissions=None,
+    )
+    token = set_principal(principal)
+    try:
+        assert get_current_principal() == principal
+    finally:
+        clear_principal(token)
+
+    # Verify principal is cleared
+    assert get_current_principal() is None
+
+
+def test_has_role():
+    # Test when no principal is set
+    assert not has_role("admin")
+
+    # Test when principal has matching role
+    principal = Principal(
+        sub="user123",
+        role="admin",
+        iss=None,
+        exp=None,
+        iat=None,
+        sid=None,
+        jti=None,
+        org_id=None,
+        org_name=None,
+        user_first_name=None,
+        user_last_name=None,
+        user_email=None,
+        permissions=None,
+    )
+    token = set_principal(principal)
+    try:
+        assert has_role("admin")
+        assert not has_role("user")
+    finally:
+        clear_principal(token)
+
+    # Test when principal has no role
+    principal = Principal(
+        sub="user123",
+        iss=None,
+        exp=None,
+        iat=None,
+        sid=None,
+        jti=None,
+        org_id=None,
+        org_name=None,
+        user_first_name=None,
+        user_last_name=None,
+        user_email=None,
+        role=None,
+        permissions=None,
+    )
+    token = set_principal(principal)
+    try:
+        assert not has_role("admin")
+    finally:
+        clear_principal(token)
+
+
+def test_require_principal():
+    # Test when no principal is set
+    with pytest.raises(RuntimeError, match="No authenticated principal in context"):
+        require_principal()
+
+    # Test when principal is set
+    principal = Principal(
+        sub="user123",
+        iss=None,
+        exp=None,
+        iat=None,
+        sid=None,
+        jti=None,
+        org_id=None,
+        org_name=None,
+        user_first_name=None,
+        user_last_name=None,
+        user_email=None,
+        role=None,
+        permissions=None,
+    )
+    token = set_principal(principal)
+    try:
+        assert require_principal() == principal
+    finally:
+        clear_principal(token)
+
+    # Verify principal is cleared
+    with pytest.raises(RuntimeError, match="No authenticated principal in context"):
+        require_principal()

planar/session.py

@@ -0,0 +1,40 @@
+from contextlib import asynccontextmanager
+from contextvars import ContextVar
+
+from sqlalchemy.ext.asyncio import AsyncEngine
+
+from planar.config import PlanarConfig
+from planar.db import PlanarSession
+
+session_var: ContextVar[PlanarSession] = ContextVar("session")
+engine_var: ContextVar[AsyncEngine] = ContextVar("engine")
+config_var: ContextVar[PlanarConfig] = ContextVar("config")
+
+
+def get_engine():
+    return engine_var.get()
+
+
+def get_session():
+    return session_var.get()
+
+
+def get_config():
+    return config_var.get()
+
+
+@asynccontextmanager
+async def session_context(engine: AsyncEngine):
+    """Context manager for setting up and tearing down SQLAlchemy session context"""
+    # Set the engine in the context
+    engine_tok = engine_var.set(engine)
+
+    async with PlanarSession(engine) as session:
+        session_tok = session_var.set(session)
+        try:
+            yield session
+        finally:
+            session_var.reset(session_tok)
+
+    # Reset engine context
+    engine_var.reset(engine_tok)

planar/sse/constants.py

@@ -0,0 +1 @@
+SSE_ENDPOINT = "/sse"

planar/sse/example.html

@@ -0,0 +1,126 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Planar SSE Example</title>
+    <style>
+        body {
+            font-family: sans-serif;
+            max-width: 800px;
+            margin: 0 auto;
+            padding: 20px;
+        }
+        #events {
+            border: 1px solid #ccc;
+            padding: 10px;
+            height: 400px;
+            overflow-y: auto;
+            margin-bottom: 10px;
+            white-space: pre-wrap;
+            font-family: monospace;
+        }
+        .event {
+            margin-bottom: 10px;
+            padding: 5px;
+            border-bottom: 1px solid #eee;
+        }
+        .event-time {
+            color: #888;
+            font-size: 0.8em;
+        }
+    </style>
+</head>
+<body>
+    <h1>Planar SSE</h1>
+    <div>
+        <div style="margin-bottom: 10px;">
+            <label for="endpoint">SSE Endpoint:</label>
+            <input type="text" id="endpoint" style="width: 400px;" value="http://127.0.0.1:8000/api/sse?subscribe=workflow-*">
+        </div>
+        <div>
+            <button id="connect">Connect</button>
+            <button id="disconnect">Disconnect</button>
+            <span id="status">Disconnected</span>
+        </div>
+    </div>
+    <div id="events"></div>
+
+    <script>
+        let eventSource = null;
+        const eventsContainer = document.getElementById('events');
+        const statusEl = document.getElementById('status');
+        const connectBtn = document.getElementById('connect');
+        const disconnectBtn = document.getElementById('disconnect');
+        const endpointInput = document.getElementById('endpoint');
+
+        function appendEvent(eventData, eventType = 'message') {
+            const eventEl = document.createElement('div');
+            eventEl.className = 'event';
+            
+            const time = new Date().toISOString();
+            const timeEl = document.createElement('div');
+            timeEl.className = 'event-time';
+            timeEl.textContent = `[${time}] Type: ${eventType}`;
+            
+            const contentEl = document.createElement('div');
+            contentEl.className = 'event-content';
+            contentEl.textContent = typeof eventData === 'object' ? 
+                JSON.stringify(eventData, null, 2) : 
+                eventData;
+            
+            eventEl.appendChild(timeEl);
+            eventEl.appendChild(contentEl);
+            eventsContainer.appendChild(eventEl);
+            eventsContainer.scrollTop = eventsContainer.scrollHeight;
+        }
+
+        function connect() {
+            if (eventSource) {
+                eventSource.close();
+            }
+
+            const url = endpointInput.value.trim();
+            if (!url) {
+                appendEvent('Please enter a valid endpoint URL', 'error');
+                return;
+            }
+            
+            eventSource = new EventSource(url);
+            
+            eventSource.onopen = () => {
+                statusEl.textContent = 'Connected to ' + url;
+                appendEvent('Connection established');
+            };
+
+            eventSource.onmessage = (event) => {
+                try {
+                    const data = JSON.parse(event.data);
+                    appendEvent(data.payload, data.name);
+                } catch (e) {
+                    appendEvent(event.data);
+                }
+            };
+
+            eventSource.onerror = (error) => {
+                statusEl.textContent = 'Error/Disconnected';
+                appendEvent(`Connection error: ${error.type}`, 'error');
+                eventSource.close();
+                eventSource = null;
+            };
+        }
+
+        function disconnect() {
+            if (eventSource) {
+                eventSource.close();
+                eventSource = null;
+                statusEl.textContent = 'Disconnected';
+                appendEvent('Connection closed');
+            }
+        }
+
+        connectBtn.addEventListener('click', connect);
+        disconnectBtn.addEventListener('click', disconnect);
+    </script>
+</body>
+</html>