tba-concrete-authorization-policy-rules 0.4.0.dev2__py3-none-any.whl

tba_concrete_authorization_policy_rules/__init__.py

@@ -0,0 +1,120 @@
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import Any, Mapping
+
+from tba_bases_authorization_policy import PolicyRuleBase
+from tba_contracts_identity.policy.conditions import DynamicCondition
+from tba_contracts_identity.policy.kinds import PolicyKind
+
+
+def _clean_tuple(values: tuple[str, ...] | list[str]) -> tuple[str, ...]:
+    return tuple(str(value).strip() for value in values if str(value).strip())
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class RolePolicy(PolicyRuleBase):
+    kind: PolicyKind = field(default=PolicyKind.RBAC, init=False)
+    role: str
+    permissions: tuple[str, ...]
+
+    def __post_init__(self) -> None:
+        role = str(self.role).strip()
+        if not role:
+            raise ValueError("role policy requires role")
+        object.__setattr__(self, "role", role)
+        object.__setattr__(self, "policy_id", self.policy_id or role)
+        object.__setattr__(self, "permissions", _clean_tuple(self.permissions))
+        PolicyRuleBase.__post_init__(self)
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class AttributePolicy(PolicyRuleBase):
+    kind: PolicyKind = field(default=PolicyKind.ABAC, init=False)
+    required_attributes: Mapping[str, Any]
+    action: str = ""
+    name: str = ""
+    permission: str = ""
+    dynamic_conditions: tuple[DynamicCondition, ...] = ()
+    client_id: str | None = None
+
+    def __post_init__(self) -> None:
+        policy_id = self.policy_id or self.name
+        action = self.action or self.permission
+        name = self.name or policy_id
+        permission = self.permission or action
+        if not policy_id:
+            raise ValueError("attribute policy requires policy_id or name")
+        if not action:
+            raise ValueError("attribute policy requires action or permission")
+        object.__setattr__(self, "policy_id", str(policy_id).strip())
+        object.__setattr__(self, "action", str(action).strip())
+        object.__setattr__(self, "name", str(name).strip())
+        object.__setattr__(self, "permission", str(permission).strip())
+        object.__setattr__(self, "required_attributes", dict(self.required_attributes))
+        object.__setattr__(self, "dynamic_conditions", tuple(self.dynamic_conditions))
+        PolicyRuleBase.__post_init__(self)
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class PermissionPolicy(PolicyRuleBase):
+    kind: PolicyKind = field(default=PolicyKind.PBAC, init=False)
+    policy_id: str
+    permissions: tuple[str, ...]
+
+    def __post_init__(self) -> None:
+        if not str(self.policy_id).strip():
+            raise ValueError("permission policy requires policy_id")
+        object.__setattr__(self, "permissions", _clean_tuple(self.permissions))
+        PolicyRuleBase.__post_init__(self)
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class DelegationPolicy(PolicyRuleBase):
+    kind: PolicyKind = field(default=PolicyKind.DELEGATION, init=False)
+    delegate: str
+    delegator: str
+    tenant_ids: tuple[str, ...]
+    actions: tuple[str, ...]
+
+    def __post_init__(self) -> None:
+        delegate = str(self.delegate).strip()
+        delegator = str(self.delegator).strip()
+        if not delegate:
+            raise ValueError("delegation policy requires delegate")
+        if not delegator:
+            raise ValueError("delegation policy requires delegator")
+        object.__setattr__(self, "delegate", delegate)
+        object.__setattr__(self, "delegator", delegator)
+        object.__setattr__(self, "policy_id", self.policy_id or f"{delegator}->{delegate}")
+        object.__setattr__(self, "tenant_ids", _clean_tuple(self.tenant_ids))
+        object.__setattr__(self, "actions", _clean_tuple(self.actions))
+        PolicyRuleBase.__post_init__(self)
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class AdminPolicy(PolicyRuleBase):
+    kind: PolicyKind = field(default=PolicyKind.ADMIN, init=False)
+    subject: str
+    tenant_ids: tuple[str, ...]
+    actions: tuple[str, ...]
+    superuser: bool = False
+
+    def __post_init__(self) -> None:
+        subject = str(self.subject).strip()
+        if not subject:
+            raise ValueError("admin policy requires subject")
+        object.__setattr__(self, "subject", subject)
+        object.__setattr__(self, "policy_id", self.policy_id or subject)
+        object.__setattr__(self, "tenant_ids", _clean_tuple(self.tenant_ids))
+        object.__setattr__(self, "actions", _clean_tuple(self.actions))
+        PolicyRuleBase.__post_init__(self)
+
+
+__all__ = [
+    "AdminPolicy",
+    "AttributePolicy",
+    "DelegationPolicy",
+    "PermissionPolicy",
+    "RolePolicy",
+]

tba_concrete_authorization_policy_rules-0.4.0.dev2.dist-info/METADATA

@@ -0,0 +1,35 @@
+Metadata-Version: 2.4
+Name: tba-concrete-authorization-policy-rules
+Version: 0.4.0.dev2
+Summary: Concrete authorization policy rule variants.
+License-Expression: Apache-2.0
+Keywords: tigrbl,identity,auth,security
+Requires-Python: >=3.10,<3.15
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Typing :: Typed
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Dist: tba-bases-authorization-policy (==0.4.0.dev2)
+Requires-Dist: tba-contracts-identity (==0.4.0.dev2)
+Project-URL: Homepage, https://github.com/tigrbl/tigrbl_auth
+Project-URL: PyPI, https://pypi.org/project/tba-concrete-authorization-policy-rules/
+Project-URL: Repository, https://github.com/tigrbl/tigrbl_auth
+Project-URL: Source, https://github.com/tigrbl/tigrbl_auth/tree/master/pkgs/10-concrete/tba-concrete-authorization-policy-rules
+Project-URL: SSOT, https://github.com/tigrbl/tigrbl_auth/blob/master/.ssot/registry.json
+Description-Content-Type: text/markdown
+
+# tba-concrete-authorization-policy-rules
+
+Concrete authorization policy rule variants.
+
+Import root: `tba_concrete_authorization_policy_rules`.
+

tba_concrete_authorization_policy_rules-0.4.0.dev2.dist-info/RECORD

@@ -0,0 +1,5 @@
+tba_concrete_authorization_policy_rules/__init__.py,sha256=jtPOIWJzPVgw2VuI8qO0kcYLgoqHTQsr9V5_qXxdlsM,4643
+tba_concrete_authorization_policy_rules/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+tba_concrete_authorization_policy_rules-0.4.0.dev2.dist-info/METADATA,sha256=pnbNbQ1xCMyRUxUeGl89wnN-msmz6p6cOCJvP4Mi_Ws,1611
+tba_concrete_authorization_policy_rules-0.4.0.dev2.dist-info/WHEEL,sha256=L-WvLdSBvJWHXv5zrQxDvNRnIgoBzLUpcbuiw19KCuQ,88
+tba_concrete_authorization_policy_rules-0.4.0.dev2.dist-info/RECORD,,

tba_concrete_authorization_policy_rules-0.4.0.dev2.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: poetry-core 2.5.0
+Root-Is-Purelib: true
+Tag: py3-none-any