rucio 32.8.6__py3-none-any.whl → 35.8.0__py3-none-any.whl

rucio/core/permission/generic.py

@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Copyright European Organization for Nuclear Research (CERN) since 2012
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -13,10 +12,11 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-from typing import TYPE_CHECKING
+from typing import TYPE_CHECKING, Any
 
 import rucio.core.scope
-from rucio.core.account import list_account_attributes, has_account_attribute
+from rucio.common.constants import RseAttr
+from rucio.core.account import has_account_attribute, list_account_attributes
 from rucio.core.identity import exist_identity_account
 from rucio.core.lifetime_exception import list_exceptions
 from rucio.core.rse import list_rse_attributes
@@ -25,11 +25,13 @@ from rucio.db.sqla.constants import IdentityType
 
 if TYPE_CHECKING:
     from typing import Optional
+
     from sqlalchemy.orm import Session
+
     from rucio.common.types import InternalAccount
 
 
-def has_permission(issuer, action, kwargs, *, session: "Optional[Session]" = None):
+def has_permission(issuer: "InternalAccount", action: str, kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account has the specified permission to
     execute an action with parameters.
@@ -124,11 +126,11 @@ def has_permission(issuer, action, kwargs, *, session: "Optional[Session]" = Non
     return perm.get(action, perm_default)(issuer=issuer, kwargs=kwargs, session=session)
 
 
-def _is_root(issuer):
+def _is_root(issuer) -> bool:
     return issuer.external == 'root'
 
 
-def perm_default(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_default(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Default permission.
 
@@ -140,7 +142,7 @@ def perm_default(issuer, kwargs, *, session: "Optional[Session]" = None):
     return _is_root(issuer) or has_account_attribute(account=issuer, key='admin', session=session)
 
 
-def perm_add_rse(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_add_rse(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can add a RSE.
 
@@ -152,7 +154,7 @@ def perm_add_rse(issuer, kwargs, *, session: "Optional[Session]" = None):
     return _is_root(issuer) or has_account_attribute(account=issuer, key='admin', session=session)
 
 
-def perm_update_rse(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_update_rse(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can update a RSE.
 
@@ -164,7 +166,7 @@ def perm_update_rse(issuer, kwargs, *, session: "Optional[Session]" = None):
     return _is_root(issuer) or has_account_attribute(account=issuer, key='admin', session=session)
 
 
-def perm_add_rule(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_add_rule(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can add a replication rule.
 
@@ -180,7 +182,7 @@ def perm_add_rule(issuer, kwargs, *, session: "Optional[Session]" = None):
     return False
 
 
-def perm_add_subscription(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_add_subscription(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can add a subscription.
 
@@ -194,7 +196,7 @@ def perm_add_subscription(issuer, kwargs, *, session: "Optional[Session]" = None
     return False
 
 
-def perm_add_rse_attribute(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_add_rse_attribute(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can add a RSE attribute.
 
@@ -208,7 +210,7 @@ def perm_add_rse_attribute(issuer, kwargs, *, session: "Optional[Session]" = Non
     return False
 
 
-def perm_del_rse_attribute(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_del_rse_attribute(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can delete a RSE attribute.
 
@@ -222,7 +224,7 @@ def perm_del_rse_attribute(issuer, kwargs, *, session: "Optional[Session]" = Non
     return False
 
 
-def perm_del_rse(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_del_rse(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can delete a RSE.
 
@@ -234,7 +236,7 @@ def perm_del_rse(issuer, kwargs, *, session: "Optional[Session]" = None):
     return _is_root(issuer) or has_account_attribute(account=issuer, key='admin', session=session)
 
 
-def perm_add_account(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_add_account(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can add an account.
 
@@ -246,7 +248,7 @@ def perm_add_account(issuer, kwargs, *, session: "Optional[Session]" = None):
     return _is_root(issuer)
 
 
-def perm_del_account(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_del_account(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can del an account.
 
@@ -258,7 +260,7 @@ def perm_del_account(issuer, kwargs, *, session: "Optional[Session]" = None):
     return _is_root(issuer)
 
 
-def perm_update_account(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_update_account(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can update an account.
 
@@ -270,7 +272,7 @@ def perm_update_account(issuer, kwargs, *, session: "Optional[Session]" = None):
     return _is_root(issuer) or has_account_attribute(account=issuer, key='admin', session=session)
 
 
-def perm_add_scope(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_add_scope(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can add a scop to a account.
 
@@ -282,7 +284,7 @@ def perm_add_scope(issuer, kwargs, *, session: "Optional[Session]" = None):
     return _is_root(issuer) or has_account_attribute(account=issuer, key='admin', session=session)
 
 
-def perm_get_auth_token_user_pass(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_get_auth_token_user_pass(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if a user can request a token with user_pass for an account.
 
@@ -296,7 +298,7 @@ def perm_get_auth_token_user_pass(issuer, kwargs, *, session: "Optional[Session]
     return False
 
 
-def perm_get_auth_token_gss(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_get_auth_token_gss(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if a user can request a token with user_pass for an account.
 
@@ -310,7 +312,7 @@ def perm_get_auth_token_gss(issuer, kwargs, *, session: "Optional[Session]" = No
     return False
 
 
-def perm_get_auth_token_x509(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_get_auth_token_x509(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if a user can request a token with user_pass for an account.
 
@@ -324,7 +326,7 @@ def perm_get_auth_token_x509(issuer, kwargs, *, session: "Optional[Session]" = N
     return False
 
 
-def perm_get_auth_token_saml(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_get_auth_token_saml(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if a user can request a token with user_pass for an account.
 
@@ -338,7 +340,7 @@ def perm_get_auth_token_saml(issuer, kwargs, *, session: "Optional[Session]" = N
     return False
 
 
-def perm_add_account_identity(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_add_account_identity(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can add an identity to an account.
 
@@ -351,7 +353,7 @@ def perm_add_account_identity(issuer, kwargs, *, session: "Optional[Session]" =
     return _is_root(issuer) or has_account_attribute(account=issuer, key='admin', session=session)
 
 
-def perm_del_account_identity(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_del_account_identity(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can delete an identity to an account.
 
@@ -364,7 +366,7 @@ def perm_del_account_identity(issuer, kwargs, *, session: "Optional[Session]" =
     return _is_root(issuer) or has_account_attribute(account=issuer, key='admin', session=session)
 
 
-def perm_del_identity(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_del_identity(issuer: "InternalAccount", kwargs, *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can delete an identity.
 
@@ -377,7 +379,7 @@ def perm_del_identity(issuer, kwargs, *, session: "Optional[Session]" = None):
     return _is_root(issuer) or issuer.external in kwargs.get('accounts')
 
 
-def perm_add_did(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_add_did(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can add an data identifier to a scope.
 
@@ -398,7 +400,7 @@ def perm_add_did(issuer, kwargs, *, session: "Optional[Session]" = None):
         or kwargs['scope'].external == 'mock'
 
 
-def perm_add_dids(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_add_dids(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can bulk add data identifiers.
 
@@ -417,7 +419,7 @@ def perm_add_dids(issuer, kwargs, *, session: "Optional[Session]" = None):
     return _is_root(issuer) or has_account_attribute(account=issuer, key='admin', session=session)
 
 
-def perm_attach_dids(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_attach_dids(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can append an data identifier to the other data identifier.
 
@@ -432,7 +434,7 @@ def perm_attach_dids(issuer, kwargs, *, session: "Optional[Session]" = None):
         or kwargs['scope'].external == 'mock'
 
 
-def perm_attach_dids_to_dids(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_attach_dids_to_dids(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can append an data identifier to the other data identifier.
 
@@ -453,7 +455,7 @@ def perm_attach_dids_to_dids(issuer, kwargs, *, session: "Optional[Session]" = N
         return True
 
 
-def perm_create_did_sample(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_create_did_sample(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can create a sample of a data identifier collection.
 
@@ -468,7 +470,7 @@ def perm_create_did_sample(issuer, kwargs, *, session: "Optional[Session]" = Non
         or kwargs['scope'].external == 'mock'
 
 
-def perm_del_rule(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_del_rule(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an issuer can delete a replication rule.
 
@@ -482,7 +484,7 @@ def perm_del_rule(issuer, kwargs, *, session: "Optional[Session]" = None):
     return False
 
 
-def perm_update_rule(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_update_rule(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an issuer can update a replication rule.
 
@@ -496,7 +498,7 @@ def perm_update_rule(issuer, kwargs, *, session: "Optional[Session]" = None):
     return False
 
 
-def perm_approve_rule(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_approve_rule(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an issuer can approve a replication rule.
 
@@ -510,7 +512,7 @@ def perm_approve_rule(issuer, kwargs, *, session: "Optional[Session]" = None):
     return False
 
 
-def perm_reduce_rule(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_reduce_rule(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an issuer can reduce a replication rule.
 
@@ -524,7 +526,7 @@ def perm_reduce_rule(issuer, kwargs, *, session: "Optional[Session]" = None):
     return False
 
 
-def perm_move_rule(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_move_rule(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an issuer can move a replication rule.
 
@@ -538,7 +540,7 @@ def perm_move_rule(issuer, kwargs, *, session: "Optional[Session]" = None):
     return False
 
 
-def perm_update_subscription(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_update_subscription(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can update a subscription.
 
@@ -553,7 +555,7 @@ def perm_update_subscription(issuer, kwargs, *, session: "Optional[Session]" = N
     return False
 
 
-def perm_detach_dids(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_detach_dids(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can detach an data identifier from the other data identifier.
 
@@ -565,7 +567,7 @@ def perm_detach_dids(issuer, kwargs, *, session: "Optional[Session]" = None):
     return perm_attach_dids(issuer, kwargs, session=session)
 
 
-def perm_set_metadata_bulk(issuer: "InternalAccount", kwargs: dict, *, session: "Optional[Session]" = None) -> bool:
+def perm_set_metadata_bulk(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can set a metadata on a data identifier.
 
@@ -577,7 +579,7 @@ def perm_set_metadata_bulk(issuer: "InternalAccount", kwargs: dict, *, session:
     return _is_root(issuer) or has_account_attribute(account=issuer, key='admin', session=session) or rucio.core.scope.is_scope_owner(scope=kwargs['scope'], account=issuer, session=session)
 
 
-def perm_set_metadata(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_set_metadata(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can set a metadata on a data identifier.
 
@@ -589,7 +591,7 @@ def perm_set_metadata(issuer, kwargs, *, session: "Optional[Session]" = None):
     return _is_root(issuer) or has_account_attribute(account=issuer, key='admin', session=session) or rucio.core.scope.is_scope_owner(scope=kwargs['scope'], account=issuer, session=session)
 
 
-def perm_set_status(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_set_status(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can set status on an data identifier.
 
@@ -605,7 +607,7 @@ def perm_set_status(issuer, kwargs, *, session: "Optional[Session]" = None):
     return _is_root(issuer) or has_account_attribute(account=issuer, key='admin', session=session) or rucio.core.scope.is_scope_owner(scope=kwargs['scope'], account=issuer, session=session)
 
 
-def perm_add_protocol(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_add_protocol(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can add a protocol to an RSE.
 
@@ -617,7 +619,7 @@ def perm_add_protocol(issuer, kwargs, *, session: "Optional[Session]" = None):
     return _is_root(issuer) or has_account_attribute(account=issuer, key='admin', session=session)
 
 
-def perm_del_protocol(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_del_protocol(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can delete protocols from an RSE.
 
@@ -629,7 +631,7 @@ def perm_del_protocol(issuer, kwargs, *, session: "Optional[Session]" = None):
     return _is_root(issuer) or has_account_attribute(account=issuer, key='admin', session=session)
 
 
-def perm_update_protocol(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_update_protocol(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can update protocols of an RSE.
 
@@ -641,7 +643,7 @@ def perm_update_protocol(issuer, kwargs, *, session: "Optional[Session]" = None)
     return _is_root(issuer) or has_account_attribute(account=issuer, key='admin', session=session)
 
 
-def perm_add_qos_policy(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_add_qos_policy(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can add QoS policies to an RSE.
 
@@ -653,7 +655,7 @@ def perm_add_qos_policy(issuer, kwargs, *, session: "Optional[Session]" = None):
     return _is_root(issuer) or has_account_attribute(account=issuer, key='admin', session=session)
 
 
-def perm_delete_qos_policy(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_delete_qos_policy(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can delete QoS policies from an RSE.
 
@@ -665,7 +667,7 @@ def perm_delete_qos_policy(issuer, kwargs, *, session: "Optional[Session]" = Non
     return _is_root(issuer) or has_account_attribute(account=issuer, key='admin', session=session)
 
 
-def perm_declare_bad_file_replicas(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_declare_bad_file_replicas(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can declare bad file replicas.
 
@@ -677,7 +679,7 @@ def perm_declare_bad_file_replicas(issuer, kwargs, *, session: "Optional[Session
     return _is_root(issuer)
 
 
-def perm_declare_suspicious_file_replicas(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_declare_suspicious_file_replicas(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can declare suspicious file replicas.
 
@@ -689,7 +691,7 @@ def perm_declare_suspicious_file_replicas(issuer, kwargs, *, session: "Optional[
     return True
 
 
-def perm_add_replicas(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_add_replicas(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can add replicas.
 
@@ -706,7 +708,7 @@ def perm_add_replicas(issuer, kwargs, *, session: "Optional[Session]" = None):
         or has_account_attribute(account=issuer, key='admin', session=session)
 
 
-def perm_skip_availability_check(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_skip_availability_check(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can skip the availabity check to add/delete file replicas.
 
@@ -718,7 +720,7 @@ def perm_skip_availability_check(issuer, kwargs, *, session: "Optional[Session]"
     return _is_root(issuer) or has_account_attribute(account=issuer, key='admin', session=session)
 
 
-def perm_delete_replicas(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_delete_replicas(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can delete replicas.
 
@@ -730,7 +732,7 @@ def perm_delete_replicas(issuer, kwargs, *, session: "Optional[Session]" = None)
     return False
 
 
-def perm_update_replicas_states(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_update_replicas_states(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can delete replicas.
 
@@ -742,7 +744,7 @@ def perm_update_replicas_states(issuer, kwargs, *, session: "Optional[Session]"
     return _is_root(issuer) or has_account_attribute(account=issuer, key='admin', session=session)
 
 
-def perm_queue_requests(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_queue_requests(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can submit transfer or deletion requests on destination RSEs for data identifiers.
 
@@ -754,7 +756,7 @@ def perm_queue_requests(issuer, kwargs, *, session: "Optional[Session]" = None):
     return _is_root(issuer)
 
 
-def perm_list_requests(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_list_requests(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can list requests.
 
@@ -766,7 +768,7 @@ def perm_list_requests(issuer, kwargs, *, session: "Optional[Session]" = None):
     return _is_root(issuer) or has_account_attribute(account=issuer, key='admin', session=session)
 
 
-def perm_list_requests_history(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_list_requests_history(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can list historical requests.
 
@@ -778,7 +780,7 @@ def perm_list_requests_history(issuer, kwargs, *, session: "Optional[Session]" =
     return _is_root(issuer) or has_account_attribute(account=issuer, key='admin', session=session)
 
 
-def perm_get_request_by_did(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_get_request_by_did(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can get a request by DID.
 
@@ -790,7 +792,7 @@ def perm_get_request_by_did(issuer, kwargs, *, session: "Optional[Session]" = No
     return True
 
 
-def perm_get_request_history_by_did(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_get_request_history_by_did(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can get a historical request by DID.
 
@@ -802,7 +804,7 @@ def perm_get_request_history_by_did(issuer, kwargs, *, session: "Optional[Sessio
     return _is_root(issuer) or has_account_attribute(account=issuer, key='admin', session=session)
 
 
-def perm_cancel_request(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_cancel_request(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can cancel a request.
 
@@ -814,7 +816,7 @@ def perm_cancel_request(issuer, kwargs, *, session: "Optional[Session]" = None):
     return _is_root(issuer)
 
 
-def perm_get_next(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_get_next(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can retrieve the next request matching the request type and state.
 
@@ -826,7 +828,7 @@ def perm_get_next(issuer, kwargs, *, session: "Optional[Session]" = None):
     return _is_root(issuer)
 
 
-def perm_set_rse_usage(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_set_rse_usage(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can set RSE usage information.
 
@@ -838,7 +840,7 @@ def perm_set_rse_usage(issuer, kwargs, *, session: "Optional[Session]" = None):
     return _is_root(issuer)
 
 
-def perm_set_rse_limits(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_set_rse_limits(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can set RSE limits.
 
@@ -850,7 +852,7 @@ def perm_set_rse_limits(issuer, kwargs, *, session: "Optional[Session]" = None):
     return _is_root(issuer) or has_account_attribute(account=issuer, key='admin', session=session)
 
 
-def perm_set_local_account_limit(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_set_local_account_limit(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can set an account limit.
 
@@ -866,12 +868,12 @@ def perm_set_local_account_limit(issuer, kwargs, *, session: "Optional[Session]"
     for kv in list_account_attributes(account=issuer, session=session):
         if kv['key'].startswith('country-') and kv['value'] == 'admin':
             admin_in_country.append(kv['key'].partition('-')[2])
-    if admin_in_country and list_rse_attributes(rse_id=kwargs['rse_id'], session=session).get('country') in admin_in_country:
+    if admin_in_country and list_rse_attributes(rse_id=kwargs['rse_id'], session=session).get(RseAttr.COUNTRY) in admin_in_country:
         return True
     return False
 
 
-def perm_set_global_account_limit(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_set_global_account_limit(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can set a global account limit.
 
@@ -887,14 +889,14 @@ def perm_set_global_account_limit(issuer, kwargs, *, session: "Optional[Session]
     for kv in list_account_attributes(account=issuer, session=session):
         if kv['key'].startswith('country-') and kv['value'] == 'admin':
             admin_in_country.add(kv['key'].partition('-')[2])
-    resolved_rse_countries = {list_rse_attributes(rse_id=rse['rse_id'], session=session).get('country')
+    resolved_rse_countries = {list_rse_attributes(rse_id=rse['rse_id'], session=session).get(RseAttr.COUNTRY)
                               for rse in parse_expression(kwargs['rse_expression'], filter_={'vo': issuer.vo}, session=session)}
     if resolved_rse_countries.issubset(admin_in_country):
         return True
     return False
 
 
-def perm_delete_local_account_limit(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_delete_local_account_limit(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can delete an account limit.
 
@@ -910,12 +912,12 @@ def perm_delete_local_account_limit(issuer, kwargs, *, session: "Optional[Sessio
     for kv in list_account_attributes(account=issuer, session=session):
         if kv['key'].startswith('country-') and kv['value'] == 'admin':
             admin_in_country.append(kv['key'].partition('-')[2])
-    if admin_in_country and list_rse_attributes(rse_id=kwargs['rse_id'], session=session).get('country') in admin_in_country:
+    if admin_in_country and list_rse_attributes(rse_id=kwargs['rse_id'], session=session).get(RseAttr.COUNTRY) in admin_in_country:
         return True
     return False
 
 
-def perm_delete_global_account_limit(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_delete_global_account_limit(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can delete a global account limit.
 
@@ -932,14 +934,14 @@ def perm_delete_global_account_limit(issuer, kwargs, *, session: "Optional[Sessi
         if kv['key'].startswith('country-') and kv['value'] == 'admin':
             admin_in_country.add(kv['key'].partition('-')[2])
     if admin_in_country:
-        resolved_rse_countries = {list_rse_attributes(rse_id=rse['rse_id'], session=session).get('country')
+        resolved_rse_countries = {list_rse_attributes(rse_id=rse['rse_id'], session=session).get(RseAttr.COUNTRY)
                                   for rse in parse_expression(kwargs['rse_expression'], filter_={'vo': issuer.vo}, session=session)}
         if resolved_rse_countries.issubset(admin_in_country):
             return True
     return False
 
 
-def perm_config(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_config(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can read/write the configuration.
 
@@ -951,7 +953,7 @@ def perm_config(issuer, kwargs, *, session: "Optional[Session]" = None):
     return _is_root(issuer) or has_account_attribute(account=issuer, key='admin', session=session)
 
 
-def perm_get_local_account_usage(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_get_local_account_usage(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can get the account usage of an account.
 
@@ -969,7 +971,7 @@ def perm_get_local_account_usage(issuer, kwargs, *, session: "Optional[Session]"
     return False
 
 
-def perm_get_global_account_usage(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_get_global_account_usage(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can get the account usage of an account.
 
@@ -988,7 +990,7 @@ def perm_get_global_account_usage(issuer, kwargs, *, session: "Optional[Session]
     return False
 
 
-def perm_add_account_attribute(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_add_account_attribute(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can add attributes to accounts.
 
@@ -1000,7 +1002,7 @@ def perm_add_account_attribute(issuer, kwargs, *, session: "Optional[Session]" =
     return _is_root(issuer) or has_account_attribute(account=issuer, key='admin', session=session)
 
 
-def perm_del_account_attribute(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_del_account_attribute(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can add attributes to accounts.
 
@@ -1012,7 +1014,7 @@ def perm_del_account_attribute(issuer, kwargs, *, session: "Optional[Session]" =
     return perm_add_account_attribute(issuer, kwargs, session=session)
 
 
-def perm_list_heartbeats(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_list_heartbeats(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can list heartbeats.
 
@@ -1024,7 +1026,7 @@ def perm_list_heartbeats(issuer, kwargs, *, session: "Optional[Session]" = None)
     return _is_root(issuer)
 
 
-def perm_resurrect(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_resurrect(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can resurrect DIDS.
 
@@ -1036,7 +1038,7 @@ def perm_resurrect(issuer, kwargs, *, session: "Optional[Session]" = None):
     return _is_root(issuer) or has_account_attribute(account=issuer, key='admin', session=session)
 
 
-def perm_update_lifetime_exceptions(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_update_lifetime_exceptions(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can approve/reject Lifetime Model exceptions.
 
@@ -1062,7 +1064,7 @@ def perm_get_auth_token_ssh(issuer: "InternalAccount", kwargs: dict, *, session:
     return True
 
 
-def perm_get_signed_url(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_get_signed_url(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can request a signed URL.
 
@@ -1073,7 +1075,7 @@ def perm_get_signed_url(issuer, kwargs, *, session: "Optional[Session]" = None):
     return _is_root(issuer)
 
 
-def perm_add_bad_pfns(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_add_bad_pfns(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can declare bad PFNs.
 
@@ -1085,7 +1087,7 @@ def perm_add_bad_pfns(issuer, kwargs, *, session: "Optional[Session]" = None):
     return _is_root(issuer)
 
 
-def perm_remove_did_from_followed(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_remove_did_from_followed(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can remove did from followed table.
 
@@ -1100,7 +1102,7 @@ def perm_remove_did_from_followed(issuer, kwargs, *, session: "Optional[Session]
         or kwargs['scope'].external == 'mock'
 
 
-def perm_remove_dids_from_followed(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_remove_dids_from_followed(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can bulk remove dids from followed table.
 
@@ -1116,7 +1118,7 @@ def perm_remove_dids_from_followed(issuer, kwargs, *, session: "Optional[Session
     return True
 
 
-def perm_export(issuer, kwargs, *, session: "Optional[Session]" = None):
+def perm_export(issuer: "InternalAccount", kwargs: dict[str, Any], *, session: "Optional[Session]" = None) -> bool:
     """
     Checks if an account can export the RSE info.