tba-concrete-authorization-policy-rules 0.4.0.dev2__tar.gz

tba_concrete_authorization_policy_rules-0.4.0.dev2/PKG-INFO

@@ -0,0 +1,35 @@
+Metadata-Version: 2.4
+Name: tba-concrete-authorization-policy-rules
+Version: 0.4.0.dev2
+Summary: Concrete authorization policy rule variants.
+License-Expression: Apache-2.0
+Keywords: tigrbl,identity,auth,security
+Requires-Python: >=3.10,<3.15
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Typing :: Typed
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Dist: tba-bases-authorization-policy (==0.4.0.dev2)
+Requires-Dist: tba-contracts-identity (==0.4.0.dev2)
+Project-URL: Homepage, https://github.com/tigrbl/tigrbl_auth
+Project-URL: PyPI, https://pypi.org/project/tba-concrete-authorization-policy-rules/
+Project-URL: Repository, https://github.com/tigrbl/tigrbl_auth
+Project-URL: Source, https://github.com/tigrbl/tigrbl_auth/tree/master/pkgs/10-concrete/tba-concrete-authorization-policy-rules
+Project-URL: SSOT, https://github.com/tigrbl/tigrbl_auth/blob/master/.ssot/registry.json
+Description-Content-Type: text/markdown
+
+# tba-concrete-authorization-policy-rules
+
+Concrete authorization policy rule variants.
+
+Import root: `tba_concrete_authorization_policy_rules`.
+

tba_concrete_authorization_policy_rules-0.4.0.dev2/README.md

@@ -0,0 +1,5 @@
+# tba-concrete-authorization-policy-rules
+
+Concrete authorization policy rule variants.
+
+Import root: `tba_concrete_authorization_policy_rules`.

tba_concrete_authorization_policy_rules-0.4.0.dev2/pyproject.toml

@@ -0,0 +1,41 @@
+[project]
+name = "tba-concrete-authorization-policy-rules"
+version = "0.4.0.dev2"
+description = "Concrete authorization policy rule variants."
+readme = "README.md"
+requires-python = ">=3.10,<3.15"
+license = "Apache-2.0"
+keywords = ["tigrbl", "identity", "auth", "security"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: Apache Software License",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+    "Programming Language :: Python :: 3 :: Only",
+    "Typing :: Typed",
+    "Topic :: Security",
+    "Topic :: Software Development :: Libraries :: Python Modules",
+]
+dependencies = [
+    "tba-bases-authorization-policy==0.4.0.dev2",
+    "tba-contracts-identity==0.4.0.dev2",
+]
+
+[project.urls]
+Homepage = "https://github.com/tigrbl/tigrbl_auth"
+Repository = "https://github.com/tigrbl/tigrbl_auth"
+Source = "https://github.com/tigrbl/tigrbl_auth/tree/master/pkgs/10-concrete/tba-concrete-authorization-policy-rules"
+SSOT = "https://github.com/tigrbl/tigrbl_auth/blob/master/.ssot/registry.json"
+PyPI = "https://pypi.org/project/tba-concrete-authorization-policy-rules/"
+
+[build-system]
+requires = ["poetry-core>=1.0.0"]
+build-backend = "poetry.core.masonry.api"
+
+[tool.poetry]
+packages = [{ include = "tba_concrete_authorization_policy_rules", from = "src" }]

tba_concrete_authorization_policy_rules-0.4.0.dev2/src/tba_concrete_authorization_policy_rules/__init__.py

@@ -0,0 +1,120 @@
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import Any, Mapping
+
+from tba_bases_authorization_policy import PolicyRuleBase
+from tba_contracts_identity.policy.conditions import DynamicCondition
+from tba_contracts_identity.policy.kinds import PolicyKind
+
+
+def _clean_tuple(values: tuple[str, ...] | list[str]) -> tuple[str, ...]:
+    return tuple(str(value).strip() for value in values if str(value).strip())
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class RolePolicy(PolicyRuleBase):
+    kind: PolicyKind = field(default=PolicyKind.RBAC, init=False)
+    role: str
+    permissions: tuple[str, ...]
+
+    def __post_init__(self) -> None:
+        role = str(self.role).strip()
+        if not role:
+            raise ValueError("role policy requires role")
+        object.__setattr__(self, "role", role)
+        object.__setattr__(self, "policy_id", self.policy_id or role)
+        object.__setattr__(self, "permissions", _clean_tuple(self.permissions))
+        PolicyRuleBase.__post_init__(self)
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class AttributePolicy(PolicyRuleBase):
+    kind: PolicyKind = field(default=PolicyKind.ABAC, init=False)
+    required_attributes: Mapping[str, Any]
+    action: str = ""
+    name: str = ""
+    permission: str = ""
+    dynamic_conditions: tuple[DynamicCondition, ...] = ()
+    client_id: str | None = None
+
+    def __post_init__(self) -> None:
+        policy_id = self.policy_id or self.name
+        action = self.action or self.permission
+        name = self.name or policy_id
+        permission = self.permission or action
+        if not policy_id:
+            raise ValueError("attribute policy requires policy_id or name")
+        if not action:
+            raise ValueError("attribute policy requires action or permission")
+        object.__setattr__(self, "policy_id", str(policy_id).strip())
+        object.__setattr__(self, "action", str(action).strip())
+        object.__setattr__(self, "name", str(name).strip())
+        object.__setattr__(self, "permission", str(permission).strip())
+        object.__setattr__(self, "required_attributes", dict(self.required_attributes))
+        object.__setattr__(self, "dynamic_conditions", tuple(self.dynamic_conditions))
+        PolicyRuleBase.__post_init__(self)
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class PermissionPolicy(PolicyRuleBase):
+    kind: PolicyKind = field(default=PolicyKind.PBAC, init=False)
+    policy_id: str
+    permissions: tuple[str, ...]
+
+    def __post_init__(self) -> None:
+        if not str(self.policy_id).strip():
+            raise ValueError("permission policy requires policy_id")
+        object.__setattr__(self, "permissions", _clean_tuple(self.permissions))
+        PolicyRuleBase.__post_init__(self)
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class DelegationPolicy(PolicyRuleBase):
+    kind: PolicyKind = field(default=PolicyKind.DELEGATION, init=False)
+    delegate: str
+    delegator: str
+    tenant_ids: tuple[str, ...]
+    actions: tuple[str, ...]
+
+    def __post_init__(self) -> None:
+        delegate = str(self.delegate).strip()
+        delegator = str(self.delegator).strip()
+        if not delegate:
+            raise ValueError("delegation policy requires delegate")
+        if not delegator:
+            raise ValueError("delegation policy requires delegator")
+        object.__setattr__(self, "delegate", delegate)
+        object.__setattr__(self, "delegator", delegator)
+        object.__setattr__(self, "policy_id", self.policy_id or f"{delegator}->{delegate}")
+        object.__setattr__(self, "tenant_ids", _clean_tuple(self.tenant_ids))
+        object.__setattr__(self, "actions", _clean_tuple(self.actions))
+        PolicyRuleBase.__post_init__(self)
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class AdminPolicy(PolicyRuleBase):
+    kind: PolicyKind = field(default=PolicyKind.ADMIN, init=False)
+    subject: str
+    tenant_ids: tuple[str, ...]
+    actions: tuple[str, ...]
+    superuser: bool = False
+
+    def __post_init__(self) -> None:
+        subject = str(self.subject).strip()
+        if not subject:
+            raise ValueError("admin policy requires subject")
+        object.__setattr__(self, "subject", subject)
+        object.__setattr__(self, "policy_id", self.policy_id or subject)
+        object.__setattr__(self, "tenant_ids", _clean_tuple(self.tenant_ids))
+        object.__setattr__(self, "actions", _clean_tuple(self.actions))
+        PolicyRuleBase.__post_init__(self)
+
+
+__all__ = [
+    "AdminPolicy",
+    "AttributePolicy",
+    "DelegationPolicy",
+    "PermissionPolicy",
+    "RolePolicy",
+]