rucio 32.8.6__py3-none-any.whl → 35.8.0__py3-none-any.whl

rucio/{api → gateway}/authentication.py

@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Copyright European Organization for Nuclear Research (CERN) since 2012
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -13,22 +12,28 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-from typing import TYPE_CHECKING
+from typing import TYPE_CHECKING, Any, Optional, Union
 
-from rucio.api import permission
 from rucio.common import exception
-from rucio.common.types import InternalAccount
-from rucio.common.utils import api_update_return_dict
+from rucio.common.types import InternalAccount, TokenDict
+from rucio.common.utils import gateway_update_return_dict
 from rucio.core import authentication, identity, oidc
 from rucio.db.sqla.constants import IdentityType
 from rucio.db.sqla.session import transactional_session
+from rucio.gateway import permission
 
 if TYPE_CHECKING:
     from sqlalchemy.orm import Session
 
 
 @transactional_session
-def refresh_cli_auth_token(token_string, account, vo='def', *, session: "Session"):
+def refresh_cli_auth_token(
+    token_string: str,
+    account: str,
+    vo: str = 'def',
+    *,
+    session: "Session"
+) -> Optional[tuple[str, int]]:
     """
     Checks if there is active refresh token and if so returns
     either active token with expiration timestamp or requests a new
@@ -39,12 +44,17 @@ def refresh_cli_auth_token(token_string, account, vo='def', *, session: "Session
 
     :return: tuple of (access token, expiration epoch), None otherswise
     """
-    account = InternalAccount(account, vo=vo)
-    return oidc.refresh_cli_auth_token(token_string, account, session=session)
+    internal_account = InternalAccount(account, vo=vo)
+    return oidc.refresh_cli_auth_token(token_string, internal_account, session=session)
 
 
 @transactional_session
-def redirect_auth_oidc(authn_code, fetchtoken=False, *, session: "Session"):
+def redirect_auth_oidc(
+    authn_code: str,
+    fetchtoken: bool = False,
+    *,
+    session: "Session"
+) -> Optional[str]:
     """
     Finds the Authentication URL in the Rucio DB oauth_requests table
     and redirects user's browser to this URL.
@@ -63,7 +73,13 @@ def redirect_auth_oidc(authn_code, fetchtoken=False, *, session: "Session"):
 
 
 @transactional_session
-def get_auth_oidc(account, vo='def', *, session: "Session", **kwargs):
+def get_auth_oidc(
+    account: str,
+    vo: str = 'def',
+    *,
+    session: "Session",
+    **kwargs
+) -> str:
     """
     Assembles the authorization request of the Rucio Client tailored to the Rucio user
     & Identity Provider. Saves authentication session parameters in the oauth_requests
@@ -98,12 +114,17 @@ def get_auth_oidc(account, vo='def', *, session: "Session", **kwargs):
     """
     # no permission layer for the moment !
 
-    account = InternalAccount(account, vo=vo)
-    return oidc.get_auth_oidc(account, session=session, **kwargs)
+    internal_account = InternalAccount(account, vo=vo)
+    return oidc.get_auth_oidc(internal_account, session=session, **kwargs)
 
 
 @transactional_session
-def get_token_oidc(auth_query_string, ip=None, *, session: "Session"):
+def get_token_oidc(
+    auth_query_string: str,
+    ip: Optional[str] = None,
+    *,
+    session: "Session"
+) -> Optional[dict[str, Optional[Union[str, bool]]]]:
     """
     After Rucio User got redirected to Rucio /auth/oidc_token (or /auth/oidc_code)
     REST endpoints with authz code and session state encoded within the URL.
@@ -122,7 +143,16 @@ def get_token_oidc(auth_query_string, ip=None, *, session: "Session"):
 
 
 @transactional_session
-def get_auth_token_user_pass(account, username, password, appid, ip=None, vo='def', *, session: "Session"):
+def get_auth_token_user_pass(
+    account: str,
+    username: str,
+    password: str,
+    appid: str,
+    ip: Optional[str] = None,
+    vo: str = 'def',
+    *,
+    session: "Session"
+) -> Optional[TokenDict]:
     """
     Authenticate a Rucio account temporarily via username and password.
 
@@ -143,13 +173,21 @@ def get_auth_token_user_pass(account, username, password, appid, ip=None, vo='de
     if not permission.has_permission(issuer=account, vo=vo, action='get_auth_token_user_pass', kwargs=kwargs, session=session):
         raise exception.AccessDenied('User with identity %s can not log to account %s' % (username, account))
 
-    account = InternalAccount(account, vo=vo)
+    internal_account = InternalAccount(account, vo=vo)
 
-    return authentication.get_auth_token_user_pass(account, username, password, appid, ip, session=session)
+    return authentication.get_auth_token_user_pass(internal_account, username, password, appid, ip, session=session)
 
 
 @transactional_session
-def get_auth_token_gss(account, gsscred, appid, ip=None, vo='def', *, session: "Session"):
+def get_auth_token_gss(
+    account: str,
+    gsscred: str,
+    appid: str,
+    ip: Optional[str] = None,
+    vo: str = 'def',
+    *,
+    session: "Session"
+) -> Optional[TokenDict]:
     """
     Authenticate a Rucio account temporarily via a GSS token.
 
@@ -169,13 +207,21 @@ def get_auth_token_gss(account, gsscred, appid, ip=None, vo='def', *, session: "
     if not permission.has_permission(issuer=account, vo=vo, action='get_auth_token_gss', kwargs=kwargs, session=session):
         raise exception.AccessDenied('User with identity %s can not log to account %s' % (gsscred, account))
 
-    account = InternalAccount(account, vo=vo)
+    internal_account = InternalAccount(account, vo=vo)
 
-    return authentication.get_auth_token_gss(account, gsscred, appid, ip, session=session)
+    return authentication.get_auth_token_gss(internal_account, gsscred, appid, ip, session=session)
 
 
 @transactional_session
-def get_auth_token_x509(account, dn, appid, ip=None, vo='def', *, session: "Session"):
+def get_auth_token_x509(
+    account: Optional[str],
+    dn: str,
+    appid: str,
+    ip: Optional[str] = None,
+    vo: str = 'def',
+    *,
+    session: "Session"
+) -> Optional[TokenDict]:
     """
     Authenticate a Rucio account temporarily via an x509 certificate.
 
@@ -198,13 +244,21 @@ def get_auth_token_x509(account, dn, appid, ip=None, vo='def', *, session: "Sess
     if not permission.has_permission(issuer=account, vo=vo, action='get_auth_token_x509', kwargs=kwargs, session=session):
         raise exception.AccessDenied('User with identity %s can not log to account %s' % (dn, account))
 
-    account = InternalAccount(account, vo=vo)
+    internal_account = InternalAccount(account, vo=vo)
 
-    return authentication.get_auth_token_x509(account, dn, appid, ip, session=session)
+    return authentication.get_auth_token_x509(internal_account, dn, appid, ip, session=session)
 
 
 @transactional_session
-def get_auth_token_ssh(account, signature, appid, ip=None, vo='def', *, session: "Session"):
+def get_auth_token_ssh(
+    account: str,
+    signature: str,
+    appid: str,
+    ip: Optional[str] = None,
+    vo: str = 'def',
+    *,
+    session: "Session"
+) -> Optional[TokenDict]:
     """
     Authenticate a Rucio account temporarily via SSH key exchange.
 
@@ -224,13 +278,20 @@ def get_auth_token_ssh(account, signature, appid, ip=None, vo='def', *, session:
     if not permission.has_permission(issuer=account, vo=vo, action='get_auth_token_ssh', kwargs=kwargs, session=session):
         raise exception.AccessDenied('User with provided signature can not log to account %s' % account)
 
-    account = InternalAccount(account, vo=vo)
+    internal_account = InternalAccount(account, vo=vo)
 
-    return authentication.get_auth_token_ssh(account, signature, appid, ip, session=session)
+    return authentication.get_auth_token_ssh(internal_account, signature, appid, ip, session=session)
 
 
 @transactional_session
-def get_ssh_challenge_token(account, appid, ip=None, vo='def', *, session: "Session"):
+def get_ssh_challenge_token(
+    account: str,
+    appid: str,
+    ip: Optional[str] = None,
+    vo: str = 'def',
+    *,
+    session: "Session"
+) -> Optional[TokenDict]:
     """
     Get a challenge token for subsequent SSH public key authentication.
 
@@ -249,13 +310,21 @@ def get_ssh_challenge_token(account, appid, ip=None, vo='def', *, session: "Sess
     if not permission.has_permission(issuer=account, vo=vo, action='get_auth_token_ssh', kwargs=kwargs, session=session):
         raise exception.AccessDenied('User can not get challenge token for account %s' % account)
 
-    account = InternalAccount(account, vo=vo)
+    internal_account = InternalAccount(account, vo=vo)
 
-    return authentication.get_ssh_challenge_token(account, appid, ip, session=session)
+    return authentication.get_ssh_challenge_token(internal_account, appid, ip, session=session)
 
 
 @transactional_session
-def get_auth_token_saml(account, saml_nameid, appid, ip=None, vo='def', *, session: "Session"):
+def get_auth_token_saml(
+    account: str,
+    saml_nameid: str,
+    appid: str,
+    ip: Optional[str] = None,
+    vo: str = 'def',
+    *,
+    session: "Session"
+) -> Optional[TokenDict]:
     """
     Authenticate a Rucio account temporarily via SSO.
 
@@ -274,13 +343,17 @@ def get_auth_token_saml(account, saml_nameid, appid, ip=None, vo='def', *, sessi
     if not permission.has_permission(issuer=account, vo=vo, action='get_auth_token_saml', kwargs=kwargs, session=session):
         raise exception.AccessDenied('User with identity %s can not log to account %s' % (saml_nameid, account))
 
-    account = InternalAccount(account, vo=vo)
+    internal_account = InternalAccount(account, vo=vo)
 
-    return authentication.get_auth_token_saml(account, saml_nameid, appid, ip, session=session)
+    return authentication.get_auth_token_saml(internal_account, saml_nameid, appid, ip, session=session)
 
 
 @transactional_session
-def validate_auth_token(token, *, session: "Session"):
+def validate_auth_token(
+    token: str,
+    *,
+    session: "Session"
+) -> dict[str, Any]:
     """
     Validate an authentication token.
 
@@ -297,6 +370,6 @@ def validate_auth_token(token, *, session: "Session"):
 
     auth = authentication.validate_auth_token(token, session=session)
     vo = auth['account'].vo
-    auth = api_update_return_dict(auth, session=session)
+    auth = gateway_update_return_dict(auth, session=session)
     auth['vo'] = vo
     return auth

rucio/{api → gateway}/config.py

@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Copyright European Organization for Nuclear Research (CERN) since 2012
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -13,13 +12,13 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-from typing import TYPE_CHECKING
+from typing import TYPE_CHECKING, Any, Optional
 
-from rucio.api import permission
 from rucio.common import exception
 from rucio.common.config import convert_to_any_type
 from rucio.core import config
 from rucio.db.sqla.session import read_session, transactional_session
+from rucio.gateway import permission
 
 if TYPE_CHECKING:
     from sqlalchemy.orm import Session
@@ -33,7 +32,7 @@ ConfigParser compatible interface.
 
 
 @read_session
-def sections(issuer=None, vo='def', *, session: "Session"):
+def sections(issuer: Optional[str] = None, vo: str = 'def', *, session: "Session") -> list[str]:
     """
     Return a list of the sections available.
 
@@ -50,7 +49,7 @@ def sections(issuer=None, vo='def', *, session: "Session"):
 
 
 @transactional_session
-def add_section(section, issuer=None, vo='def', *, session: "Session"):
+def add_section(section: str, issuer: Optional[str] = None, vo: str = 'def', *, session: "Session") -> None:
     """
     Add a section to the configuration.
 
@@ -67,7 +66,7 @@ def add_section(section, issuer=None, vo='def', *, session: "Session"):
 
 
 @read_session
-def has_section(section, issuer=None, vo='def', *, session: "Session"):
+def has_section(section: str, issuer: Optional[str] = None, vo: str = 'def', *, session: "Session") -> bool:
     """
     Indicates whether the named section is present in the configuration.
 
@@ -85,7 +84,7 @@ def has_section(section, issuer=None, vo='def', *, session: "Session"):
 
 
 @read_session
-def options(section, issuer=None, vo='def', *, session: "Session"):
+def options(section: str, issuer: Optional[str] = None, vo: str = 'def', *, session: "Session") -> list[str]:
     """
     Returns a list of options available in the specified section.
 
@@ -103,7 +102,7 @@ def options(section, issuer=None, vo='def', *, session: "Session"):
 
 
 @read_session
-def has_option(section, option, issuer=None, vo='def', *, session: "Session"):
+def has_option(section: str, option: str, issuer: Optional[str] = None, vo: str = 'def', *, session: "Session") -> bool:
     """
     Check if the given section exists and contains the given option.
 
@@ -122,7 +121,7 @@ def has_option(section, option, issuer=None, vo='def', *, session: "Session"):
 
 
 @read_session
-def get(section, option, issuer=None, vo='def', *, session: "Session"):
+def get(section: str, option: str, issuer: Optional[str] = None, vo: str = 'def', *, session: "Session") -> Any:
     """
     Get an option value for the named section. Value can be auto-coerced to int, float, and bool; string otherwise.
 
@@ -144,7 +143,7 @@ def get(section, option, issuer=None, vo='def', *, session: "Session"):
 
 
 @read_session
-def items(section, issuer=None, vo='def', *, session: "Session"):
+def items(section: str, issuer: Optional[str] = None, vo: str = 'def', *, session: "Session") -> list[tuple[str, Any]]:
     """
     Return a list of (option, value) pairs for each option in the given section. Values are auto-coerced as in get().
 
@@ -163,7 +162,7 @@ def items(section, issuer=None, vo='def', *, session: "Session"):
 
 
 @transactional_session
-def set(section, option, value, issuer=None, vo='def', *, session: "Session"):
+def set(section: str, option: str, value: Any, issuer: Optional[str] = None, vo: str = 'def', *, session: "Session") -> None:
     """
     Set the given option to the specified value.
 
@@ -182,7 +181,7 @@ def set(section, option, value, issuer=None, vo='def', *, session: "Session"):
 
 
 @transactional_session
-def remove_section(section, issuer=None, vo='def', *, session: "Session"):
+def remove_section(section: str, issuer: Optional[str] = None, vo: str = 'def', *, session: "Session") -> bool:
     """
     Remove the specified option from the specified section.
 
@@ -200,7 +199,7 @@ def remove_section(section, issuer=None, vo='def', *, session: "Session"):
 
 
 @transactional_session
-def remove_option(section, option, issuer=None, vo='def', *, session: "Session"):
+def remove_option(section: str, option: str, issuer: Optional[str] = None, vo: str = 'def', *, session: "Session") -> bool:
     """
     Remove the specified section from the configuration.
 

rucio/{api → gateway}/credential.py

@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # Copyright European Organization for Nuclear Research (CERN) since 2012
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -13,20 +12,32 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-from typing import TYPE_CHECKING
+from typing import TYPE_CHECKING, Literal
 
-from rucio.api import permission
 from rucio.common import exception
 from rucio.core import credential
 from rucio.core.rse import get_rse_id
 from rucio.db.sqla.session import read_session
+from rucio.gateway import permission
 
 if TYPE_CHECKING:
     from sqlalchemy.orm import Session
 
 
 @read_session
-def get_signed_url(account, appid, ip, rse, service, operation, url, lifetime, vo='def', *, session: "Session"):
+def get_signed_url(
+    account: str,
+    appid: str,
+    ip: str,
+    rse: str,
+    service: Literal['gsc', 's3', 'swift'],
+    operation: Literal['read', 'write', 'delete'],
+    url: str,
+    lifetime: int,
+    vo: str = 'def',
+    *,
+    session: "Session"
+) -> str:
     """
     Get a signed URL for a particular service and operation.