tba-durability-authorization-policy 0.4.0.dev2__tar.gz

tba_durability_authorization_policy-0.4.0.dev2/PKG-INFO

@@ -0,0 +1,25 @@
+Metadata-Version: 2.4
+Name: tba-durability-authorization-policy
+Version: 0.4.0.dev2
+Summary: Carrier-neutral layer-30 durable table operations.
+License-Expression: Apache-2.0
+Requires-Python: >=3.10,<3.15
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Dist: tba-bases-replay (==0.4.0.dev2)
+Requires-Dist: tba-contracts-authorization (==0.4.0.dev3)
+Requires-Dist: tba-contracts-identity (==0.4.0.dev2)
+Requires-Dist: tba-contracts-security-trust (==0.1.0)
+Requires-Dist: tba-primitives-identity (==0.4.0.dev2)
+Requires-Dist: tba-storage-authorization-policy (==0.4.0.dev2)
+Requires-Dist: tigrbl (==0.4.5.dev8)
+Description-Content-Type: text/markdown
+
+# tba-durability-authorization-policy
+
+Carrier-neutral layer-30 durable operations and derived table specifications.
+

tba_durability_authorization_policy-0.4.0.dev2/README.md

@@ -0,0 +1,3 @@
+# tba-durability-authorization-policy
+
+Carrier-neutral layer-30 durable operations and derived table specifications.

tba_durability_authorization_policy-0.4.0.dev2/pyproject.toml

@@ -0,0 +1,23 @@
+[project]
+name = "tba-durability-authorization-policy"
+version = "0.4.0.dev2"
+description = "Carrier-neutral layer-30 durable table operations."
+readme = "README.md"
+requires-python = ">=3.10,<3.15"
+license = "Apache-2.0"
+dependencies = [
+    "tba-contracts-authorization==0.4.0.dev3",
+    "tigrbl==0.4.5.dev8",
+    "tba-primitives-identity==0.4.0.dev2",
+    "tba-contracts-identity==0.4.0.dev2",
+    "tba-bases-replay==0.4.0.dev2",
+    "tba-contracts-security-trust==0.1.0",
+    "tba-storage-authorization-policy==0.4.0.dev2",
+]
+
+[build-system]
+requires = ["poetry-core>=1.0.0"]
+build-backend = "poetry.core.masonry.api"
+
+[tool.poetry]
+packages = [{ include = "tba_durability_authorization_policy", from = "src" }]

tba_durability_authorization_policy-0.4.0.dev2/src/tba_durability_authorization_policy/__init__.py

@@ -0,0 +1,12 @@
+from .legacy import NormalizedAuthorization, NormalizedRoleGrant, normalize_legacy_authorization
+
+try:
+    from .operations import *
+    from .specifications import *
+    from .inventory import *
+except ImportError:
+    # Normalization is dependency-free so schema migration tooling can run before
+    # the optional Tigrbl storage runtime is installed.
+    pass
+
+__all__ = [name for name in globals() if not name.startswith("_")]

tba_durability_authorization_policy-0.4.0.dev2/src/tba_durability_authorization_policy/inventory.py

@@ -0,0 +1,22 @@
+"""Immutable inventory of this durable family's table specifications."""
+
+from . import specifications as _specifications
+
+RUNTIME_TABLE_SPECS = tuple(
+    value
+    for name, value in vars(_specifications).items()
+    if name.endswith("RuntimeSpec") and getattr(value, "model", None) is not None
+)
+RUNTIME_TABLES = tuple(spec.model for spec in RUNTIME_TABLE_SPECS)
+RUNTIME_OPERATION_BY_ALIAS = {
+    operation.alias: operation
+    for spec in RUNTIME_TABLE_SPECS
+    for operation in spec.ops
+    if operation.extra.get("owner_layer") == "30-storage-runtime"
+}
+
+__all__ = [
+    "RUNTIME_OPERATION_BY_ALIAS",
+    "RUNTIME_TABLE_SPECS",
+    "RUNTIME_TABLES",
+]

tba_durability_authorization_policy-0.4.0.dev2/src/tba_durability_authorization_policy/legacy.py

@@ -0,0 +1,45 @@
+"""Fail-closed normalization for the legacy role JSON representation."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Iterable, Mapping
+
+
+@dataclass(frozen=True, slots=True)
+class NormalizedRoleGrant:
+    grant_id: str
+    tenant_id: str
+    principal_id: str
+    role_id: str
+    resource_type: str
+    resource_id: str
+
+
+@dataclass(frozen=True, slots=True)
+class NormalizedAuthorization:
+    role_permissions: tuple[tuple[str, str, str], ...]
+    role_grants: tuple[NormalizedRoleGrant, ...]
+
+
+def normalize_legacy_authorization(*, roles: Iterable[Mapping[str, object]], memberships: Iterable[Mapping[str, object]]) -> NormalizedAuthorization:
+    by_key: dict[tuple[str, str], Mapping[str, object]] = {}
+    permissions: list[tuple[str, str, str]] = []
+    for role in roles:
+        tenant_id, name, role_id = str(role["tenant_id"]), str(role["name"]), str(role["id"])
+        key = (tenant_id, name)
+        if key in by_key:
+            raise ValueError(f"duplicate legacy role {tenant_id}/{name}")
+        by_key[key] = role
+        permissions.extend((role_id, str(permission), "allow") for permission in role.get("permissions", ()))
+    grants: list[NormalizedRoleGrant] = []
+    for membership in memberships:
+        tenant_id = str(membership["tenant_id"])
+        principal_id = str(membership["principal_id"])
+        for name in membership.get("roles", ()):
+            role = by_key.get((tenant_id, str(name)))
+            if role is None:
+                raise ValueError(f"unknown legacy role {tenant_id}/{name}")
+            role_id = str(role["id"])
+            grants.append(NormalizedRoleGrant(f"legacy:{tenant_id}:{principal_id}:{role_id}", tenant_id, principal_id, role_id, "tenant", tenant_id))
+    return NormalizedAuthorization(tuple(permissions), tuple(grants))

tba_durability_authorization_policy-0.4.0.dev2/src/tba_durability_authorization_policy/operations/__init__.py

@@ -0,0 +1 @@
+from .authorization import *

tba_durability_authorization_policy-0.4.0.dev2/src/tba_durability_authorization_policy/operations/authorization.py

@@ -0,0 +1,231 @@
+"""Durable authorization membership and delegated-scope operations."""
+
+from __future__ import annotations
+
+from collections.abc import Mapping
+from typing import Any
+
+from tba_storage_authorization_policy.tables import AttributePolicy, DelegatedAdminScope, PolicyCondition, Role, TenantMembership
+
+from tigrbl import (
+    create_table_record,
+    clear_table_records,
+    database_from_context,
+    field_value,
+    first_table_record,
+    list_table_records,
+    payload_from_context,
+    record_identifier,
+    update_table_record,
+)
+
+
+def _strings(values: Any) -> tuple[str, ...]:
+    if values is None or values == "" or values is False:
+        return ()
+    if isinstance(values, str):
+        return (values,)
+    return tuple(sorted({str(value) for value in values if value not in {None, ""}}))
+
+
+async def grant_membership(ctx: Mapping[str, Any]) -> object:
+    values = dict(payload_from_context(ctx))
+    db = database_from_context(ctx)
+    tenant_id = str(values["tenant_id"])
+    principal_id = str(values["principal_id"])
+    payload = {
+        "tenant_id": tenant_id,
+        "principal_id": principal_id,
+        "roles": list(_strings(values.get("roles", ()))),
+        "status": str(values.get("status", "active")),
+    }
+    existing = await first_table_record(
+        TenantMembership,
+        db,
+        {"tenant_id": tenant_id, "principal_id": principal_id},
+    )
+    if existing is None:
+        return await create_table_record(TenantMembership, db, payload)
+    return await update_table_record(
+        TenantMembership, db, record_identifier(existing), payload
+    )
+
+
+async def assign_role(ctx: Mapping[str, Any]) -> object:
+    values = dict(payload_from_context(ctx))
+    db = database_from_context(ctx)
+    filters = {
+        "tenant_id": values["tenant_id"],
+        "principal_id": values["principal_id"],
+    }
+    existing = await first_table_record(TenantMembership, db, filters)
+    roles = set(_strings(field_value(existing, "roles", ()))) if existing else set()
+    roles.add(str(values["role_name"]))
+    return await grant_membership(
+        {
+            "db": db,
+            "payload": {**filters, "roles": roles, "status": "active"},
+        }
+    )
+
+
+async def role_names_for_principal(ctx: Mapping[str, Any]) -> tuple[str, ...]:
+    values = dict(payload_from_context(ctx))
+    filters = {"principal_id": values["principal_id"]}
+    if values.get("tenant_id") is not None:
+        filters["tenant_id"] = values["tenant_id"]
+    rows = await list_table_records(
+        TenantMembership, database_from_context(ctx), filters
+    )
+    roles: set[str] = set()
+    for row in rows:
+        if field_value(row, "status", "active") == "active":
+            roles.update(_strings(field_value(row, "roles", ())))
+    return tuple(sorted(roles))
+
+
+async def upsert_role(ctx: Mapping[str, Any]) -> object:
+    values = dict(payload_from_context(ctx))
+    db = database_from_context(ctx)
+    filters = {
+        "name": str(values["name"]),
+        "tenant_id": values.get("tenant_id"),
+    }
+    payload = {
+        **filters,
+        "permissions": list(_strings(values.get("permissions", ()))),
+        "denied_permissions": list(_strings(values.get("denied_permissions", ()))),
+        "inherited_roles": list(_strings(values.get("inherited_roles", ()))),
+        "status": str(values.get("status", "active")),
+    }
+    existing = await first_table_record(Role, db, filters)
+    if existing is None:
+        return await create_table_record(Role, db, payload)
+    return await update_table_record(Role, db, record_identifier(existing), payload)
+
+
+async def list_roles_for_tenant(ctx: Mapping[str, Any]) -> tuple[object, ...]:
+    values = dict(payload_from_context(ctx))
+    tenant_id = values.get("tenant_id")
+    rows = await list_table_records(Role, database_from_context(ctx))
+    return tuple(
+        row for row in rows if field_value(row, "tenant_id") in {None, tenant_id}
+    )
+
+
+async def upsert_attribute_policy(
+    ctx: Mapping[str, Any],
+) -> tuple[object, list[object]]:
+    values = dict(payload_from_context(ctx))
+    db = database_from_context(ctx)
+    filters = {
+        "name": values["name"],
+        "tenant_id": values.get("tenant_id"),
+    }
+    existing = await first_table_record(AttributePolicy, db, filters)
+    payload = {
+        "name": values["name"],
+        "tenant_id": values.get("tenant_id"),
+        "client_id": values.get("client_id"),
+        "permission": values["permission"],
+        "effect": str(values.get("effect", "allow")),
+        "required_attributes": dict(values.get("required_attributes") or {}),
+        "status": "active",
+    }
+    if existing is None:
+        row = await create_table_record(AttributePolicy, db, payload)
+    else:
+        row = await update_table_record(
+            AttributePolicy, db, record_identifier(existing), payload
+        )
+    policy_id = record_identifier(row)
+    await clear_table_records(PolicyCondition, db, {"policy_id": policy_id})
+    conditions = [
+        await create_table_record(
+            PolicyCondition,
+            db,
+            {"policy_id": policy_id, **dict(condition)},
+        )
+        for condition in values.get("dynamic_conditions", ())
+    ]
+    return row, conditions
+
+
+async def list_active_attribute_policies(
+    ctx: Mapping[str, Any],
+) -> tuple[tuple[object, list[object]], ...]:
+    values = dict(payload_from_context(ctx))
+    filters: dict[str, Any] = {"status": "active"}
+    if values.get("tenant_id") is not None:
+        filters["tenant_id"] = values["tenant_id"]
+    db = database_from_context(ctx)
+    rows = await list_table_records(AttributePolicy, db, filters)
+    collected = []
+    for row in rows:
+        conditions = await list_table_records(
+            PolicyCondition, db, {"policy_id": record_identifier(row)}
+        )
+        collected.append((row, conditions))
+    return tuple(collected)
+
+
+async def grant_delegated_scope(ctx: Mapping[str, Any]) -> object:
+    values = dict(payload_from_context(ctx))
+    db = database_from_context(ctx)
+    subject = str(values.pop("subject"))
+    payload = {"subject": subject, "status": "active", **values}
+    existing = await first_table_record(DelegatedAdminScope, db, {"subject": subject})
+    if existing is None:
+        return await create_table_record(DelegatedAdminScope, db, payload)
+    return await update_table_record(
+        DelegatedAdminScope, db, record_identifier(existing), payload
+    )
+
+
+async def revoke_delegated_scope(ctx: Mapping[str, Any]) -> object:
+    subject = str(payload_from_context(ctx).get("subject") or "")
+    db = database_from_context(ctx)
+    existing = await first_table_record(DelegatedAdminScope, db, {"subject": subject})
+    if existing is None:
+        raise LookupError(subject)
+    return await update_table_record(
+        DelegatedAdminScope,
+        db,
+        record_identifier(existing),
+        {"status": "revoked"},
+    )
+
+
+async def delegated_scope_for_subject(ctx: Mapping[str, Any]) -> object | None:
+    subject = str(payload_from_context(ctx).get("subject") or "")
+    return await first_table_record(
+        DelegatedAdminScope,
+        database_from_context(ctx),
+        {"subject": subject},
+    )
+
+
+async def list_active_delegated_scopes(
+    ctx: Mapping[str, Any],
+) -> tuple[object, ...]:
+    rows = await list_table_records(
+        DelegatedAdminScope,
+        database_from_context(ctx),
+        {"status": "active"},
+    )
+    return tuple(rows)
+
+
+__all__ = [
+    "assign_role",
+    "delegated_scope_for_subject",
+    "grant_delegated_scope",
+    "grant_membership",
+    "list_active_attribute_policies",
+    "list_active_delegated_scopes",
+    "list_roles_for_tenant",
+    "revoke_delegated_scope",
+    "role_names_for_principal",
+    "upsert_role",
+    "upsert_attribute_policy",
+]

tba_durability_authorization_policy-0.4.0.dev2/src/tba_durability_authorization_policy/py.typed

@@ -0,0 +1 @@
+

tba_durability_authorization_policy-0.4.0.dev2/src/tba_durability_authorization_policy/specifications/__init__.py

@@ -0,0 +1 @@
+from .authorization import *

tba_durability_authorization_policy-0.4.0.dev2/src/tba_durability_authorization_policy/specifications/authorization.py

@@ -0,0 +1,172 @@
+"""Authorization table aliases and executable runtime specifications."""
+
+from tba_storage_authorization_policy.tables import AttributePolicy, AuthorizationInvariant, DelegatedAdminScope, InvariantEvaluation, InvariantViolation, Policy, PolicyVersion, Role, TenantMembership
+
+from tigrbl import deriveTableSpec
+from tigrbl import makeOp
+from tba_durability_authorization_policy.operations.authorization import (
+    assign_role,
+    delegated_scope_for_subject,
+    grant_delegated_scope,
+    grant_membership,
+    list_active_attribute_policies,
+    list_active_delegated_scopes,
+    list_roles_for_tenant,
+    revoke_delegated_scope,
+    role_names_for_principal,
+    upsert_role,
+    upsert_attribute_policy,
+)
+
+TenantMembershipTable = TenantMembership
+DelegatedAdminScopeTable = DelegatedAdminScope
+RoleTable = Role
+AttributePolicyTable = AttributePolicy
+AuthorizationInvariantTable = AuthorizationInvariant
+InvariantEvaluationTable = InvariantEvaluation
+InvariantViolationTable = InvariantViolation
+PolicyTable = Policy
+PolicyVersionTable = PolicyVersion
+
+AttributePolicyRuntimeSpec = deriveTableSpec(
+    AttributePolicyTable,
+    ops=(
+        makeOp(
+            extra={"owner_layer": "30-storage-runtime"},
+            expose_routes=False,
+            expose_rpc=False,
+            expose_method=True,
+            tx_scope="read_write",
+            alias="upsert_with_conditions",
+            handler=upsert_attribute_policy,
+        ),
+        makeOp(
+            extra={"owner_layer": "30-storage-runtime"},
+            expose_routes=False,
+            expose_rpc=False,
+            expose_method=True,
+            alias="list_active_with_conditions",
+            handler=list_active_attribute_policies,
+            tx_scope="read_only",
+            persist="skip",
+        ),
+    ),
+)
+
+RoleRuntimeSpec = deriveTableSpec(
+    RoleTable,
+    ops=(
+        makeOp(
+            extra={"owner_layer": "30-storage-runtime"},
+            expose_routes=False,
+            expose_rpc=False,
+            expose_method=True,
+            tx_scope="read_write",
+            alias="create_role",
+            handler=upsert_role,
+        ),
+        makeOp(
+            extra={"owner_layer": "30-storage-runtime"},
+            expose_routes=False,
+            expose_rpc=False,
+            expose_method=True,
+            alias="list_for_tenant",
+            handler=list_roles_for_tenant,
+            tx_scope="read_only",
+            persist="skip",
+        ),
+    ),
+)
+
+TenantMembershipRuntimeSpec = deriveTableSpec(
+    TenantMembershipTable,
+    ops=(
+        makeOp(
+            extra={"owner_layer": "30-storage-runtime"},
+            expose_routes=False,
+            expose_rpc=False,
+            expose_method=True,
+            tx_scope="read_write",
+            alias="grant_membership",
+            handler=grant_membership,
+        ),
+        makeOp(
+            extra={"owner_layer": "30-storage-runtime"},
+            expose_routes=False,
+            expose_rpc=False,
+            expose_method=True,
+            tx_scope="read_write",
+            alias="assign_role",
+            handler=assign_role,
+        ),
+        makeOp(
+            extra={"owner_layer": "30-storage-runtime"},
+            expose_routes=False,
+            expose_rpc=False,
+            expose_method=True,
+            alias="role_names_for_principal",
+            handler=role_names_for_principal,
+            tx_scope="read_only",
+            persist="skip",
+        ),
+    ),
+)
+DelegatedAdminScopeRuntimeSpec = deriveTableSpec(
+    DelegatedAdminScopeTable,
+    ops=(
+        makeOp(
+            extra={"owner_layer": "30-storage-runtime"},
+            expose_routes=False,
+            expose_rpc=False,
+            expose_method=True,
+            tx_scope="read_write",
+            alias="grant_scope",
+            handler=grant_delegated_scope,
+        ),
+        makeOp(
+            extra={"owner_layer": "30-storage-runtime"},
+            expose_routes=False,
+            expose_rpc=False,
+            expose_method=True,
+            tx_scope="read_write",
+            alias="revoke_scope",
+            handler=revoke_delegated_scope,
+        ),
+        makeOp(
+            extra={"owner_layer": "30-storage-runtime"},
+            expose_routes=False,
+            expose_rpc=False,
+            expose_method=True,
+            alias="lookup",
+            handler=delegated_scope_for_subject,
+            tx_scope="read_only",
+            persist="skip",
+        ),
+        makeOp(
+            extra={"owner_layer": "30-storage-runtime"},
+            expose_routes=False,
+            expose_rpc=False,
+            expose_method=True,
+            alias="list_active",
+            handler=list_active_delegated_scopes,
+            tx_scope="read_only",
+            persist="skip",
+        ),
+    ),
+)
+
+__all__ = [
+    "AttributePolicyRuntimeSpec",
+    "AttributePolicyTable",
+    "AuthorizationInvariantTable",
+    "DelegatedAdminScopeRuntimeSpec",
+    "DelegatedAdminScopeTable",
+    "InvariantEvaluationTable",
+    "InvariantViolationTable",
+    "PolicyTable",
+    "PolicyVersionTable",
+    "TenantMembershipRuntimeSpec",
+    "TenantMembershipTable",
+    "RoleRuntimeSpec",
+    "RoleTable",
+]