trovesuite 1.0.1__py3-none-any.whl → 1.0.31__py3-none-any.whl

trovesuite/__init__.py

@@ -1,16 +1,23 @@
 """
-TroveSuite Auth Package
+TroveSuite Package
 
-A comprehensive authentication and authorization service for ERP systems.
-Provides JWT token validation, user authorization, and permission checking.
+A comprehensive authentication, authorization, notification, and storage service for ERP systems.
+Provides JWT token validation, user authorization, permission checking, notification capabilities,
+Azure Storage blob management, and utility functions for multi-tenant applications.
 """
 
 from .auth import AuthService
+from .notification import NotificationService
+from .storage import StorageService
+from .utils import Helper
 
-__version__ = "1.0.8"
+__version__ = "1.0.29"
 __author__ = "Bright Debrah Owusu"
 __email__ = "owusu.debrah@deladetech.com"
 
 __all__ = [
-    "AuthService"
+    "AuthService",
+    "NotificationService",
+    "StorageService",
+    "Helper",
 ]

trovesuite/auth/__init__.py

@@ -5,13 +5,10 @@ Authentication and authorization services for ERP systems.
 """
 
 from .auth_service import AuthService
-from .auth_base import AuthBase
-from .auth_read_dto import AuthServiceReadDto, AuthControllerReadDto
+from .auth_write_dto import AuthServiceWriteDto
 
 __all__ = [
     "AuthService",
-    "AuthBase", 
-    "AuthServiceReadDto",
-    "AuthControllerReadDto"
+    "AuthServiceWriteDto"
 ]
 

trovesuite/auth/auth_controller.py

@@ -1,10 +1,11 @@
 from fastapi import APIRouter
-from src.trovesuite.auth.auth_write_dto import AuthControllerWriteDto
-from src.trovesuite.auth.auth_read_dto import AuthControllerReadDto
-from src.trovesuite.auth.auth_service import AuthService
+from .auth_write_dto import AuthControllerWriteDto
+from .auth_read_dto import AuthControllerReadDto
+from .auth_service import AuthService
+from ..entities.sh_response import Respons
 
-auth_router = APIRouter()
+auth_router = APIRouter(tags=["Auth"])
 
-@auth_router.post("/auth", response_model=AuthControllerReadDto)
+@auth_router.post("/auth", response_model=Respons[AuthControllerReadDto])
 async def authorize(data: AuthControllerWriteDto):
     return AuthService.authorize(data=data)

trovesuite/auth/auth_read_dto.py

@@ -3,16 +3,16 @@ from pydantic import BaseModel
 
 class AuthControllerReadDto(BaseModel):
     org_id: Optional[str] = None
-    bus_id: Optional[str] = None 
-    app_id: Optional[str] = None 
+    bus_id: Optional[str] = None
+    app_id: Optional[str] = None
     shared_resource_id: Optional[str] = None
     user_id: Optional[str] = None
     group_id: Optional[str] = None
     role_id: Optional[str] = None
     tenant_id: Optional[str] = None
     permissions: Optional[List[str]] = None
-    shared_resource_id: Optional[str] = None
     resource_id: Optional[str] = None
+    resource_type: Optional[str] = None
 
 class AuthServiceReadDto(AuthControllerReadDto):
     pass

trovesuite/auth/auth_service.py

@@ -45,7 +45,7 @@ class AuthService:
         
     @staticmethod
     def authorize(data: AuthServiceWriteDto) -> Respons[AuthServiceReadDto]:
-        
+
         user_id: str = data.user_id
         tenant_id: str = data.tenant_id
 
@@ -59,7 +59,7 @@ class AuthService:
                 status_code=400,
                 error="INVALID_USER_ID"
             )
-        
+
         if not tenant_id or not isinstance(tenant_id, str):
             return Respons[AuthServiceReadDto](
                 detail="Invalid tenant_id: must be a non-empty string",
@@ -68,16 +68,16 @@ class AuthService:
                 status_code=400,
                 error="INVALID_TENANT_ID"
             )
-        
+
         try:
 
             is_tenant_verified = DatabaseManager.execute_query(
-                f"SELECT is_verified FROM {db_settings.MAIN_TENANTS_TABLE} WHERE delete_status = 'NOT_DELETED' AND id = %s",
+                f"SELECT is_verified FROM {db_settings.CORE_PLATFORM_TENANTS_TABLE} WHERE delete_status = 'NOT_DELETED' AND id = %s",
                 (tenant_id,),
             )
 
             if not is_tenant_verified or len(is_tenant_verified) == 0:
-                logger.warning("Login failed - tenant not found: %s", tenant_id)
+                logger.warning("Authorization failed - tenant not found: %s", tenant_id)
                 return Respons[AuthServiceReadDto](
                     detail=f"Tenant '{tenant_id}' not found or has been deleted",
                     data=[],
@@ -85,9 +85,9 @@ class AuthService:
                     status_code=404,
                     error="TENANT_NOT_FOUND"
                 )
-            
+
             if not is_tenant_verified[0]['is_verified']:
-                logger.warning("Login failed - tenant not verified for user: %s, tenant: %s", user_id, tenant_id)
+                logger.warning("Authorization failed - tenant not verified for user: %s, tenant: %s", user_id, tenant_id)
                 return Respons[AuthServiceReadDto](
                     detail=f"Tenant '{tenant_id}' is not verified. Please contact your administrator.",
                     data=[],
@@ -96,14 +96,37 @@ class AuthService:
                     error="TENANT_NOT_VERIFIED"
                 )
 
-            login_settings_details = DatabaseManager.execute_query(
-                f"""SELECT user_id, group_id, is_suspended, can_always_login,
-                is_multi_factor_enabled, is_login_before, working_days,
-                login_on, logout_on FROM "{tenant_id}".{db_settings.TENANT_LOGIN_SETTINGS_TABLE} 
-                WHERE (delete_status = 'NOT_DELETED' AND is_active = true ) AND user_id = %s""",
-                (user_id,),
+            # 1️⃣ Get all groups the user belongs to
+            user_groups = DatabaseManager.execute_query(
+                f"""SELECT group_id FROM {db_settings.CORE_PLATFORM_USER_GROUPS_TABLE}
+                    WHERE tenant_id = %s AND delete_status = 'NOT_DELETED' AND is_active = true AND user_id = %s AND (is_system = false OR is_system IS NULL)""",
+                (tenant_id, user_id,),
             )
 
+            # 2️⃣ Prepare list of group_ids
+            group_ids = [g["group_id"] for g in user_groups] if user_groups else []
+
+            # 3️⃣ Get login settings - check user-level first, then group-level
+            if group_ids:
+                login_settings_details = DatabaseManager.execute_query(
+                    f"""SELECT user_id, group_id, is_suspended, can_always_login,
+                    is_multi_factor_enabled, is_login_before, working_days,
+                    login_on, logout_on FROM {db_settings.CORE_PLATFORM_LOGIN_SETTINGS_TABLE}
+                    WHERE tenant_id = %s AND (delete_status = 'NOT_DELETED' AND is_active = true )
+                    AND (user_id = %s OR group_id = ANY(%s))
+                    ORDER BY user_id NULLS LAST
+                    LIMIT 1""",
+                    (tenant_id, user_id, group_ids),
+                )
+            else:
+                login_settings_details = DatabaseManager.execute_query(
+                    f"""SELECT user_id, group_id, is_suspended, can_always_login,
+                    is_multi_factor_enabled, is_login_before, working_days,
+                    login_on, logout_on FROM {db_settings.CORE_PLATFORM_LOGIN_SETTINGS_TABLE}
+                    WHERE tenant_id = %s AND (delete_status = 'NOT_DELETED' AND is_active = true ) AND user_id = %s""",
+                    (tenant_id, user_id,),
+                )
+
             if not login_settings_details or len(login_settings_details) == 0:
                 logger.warning("Authorization failed - user not found: %s in tenant: %s", user_id, tenant_id)
                 return Respons[AuthServiceReadDto](
@@ -124,86 +147,194 @@ class AuthService:
                     error="USER_SUSPENDED"
                 )
 
+            # ✅ UPDATED: Mutually exclusive login restrictions logic
             if not login_settings_details[0]['can_always_login']:
-                current_day = datetime.now().strftime("%A").upper()
-                
-                if current_day not in login_settings_details[0]['working_days']:
-                    logger.warning("Authorization failed - outside working days for user: %s checking custom login period", user_id)
-              
-                    # Get current datetime (full date and time) with timezone
-                    current_datetime = datetime.now(timezone.utc).replace(microsecond=0, second=0)
-                    
-                    # Get from database (should already be datetime objects)
-                    login_on = login_settings_details[0]['login_on']
-                    logout_on = login_settings_details[0]['logout_on']
+                # Get from database (should already be datetime objects)
+                login_on = login_settings_details[0]['login_on']
+                logout_on = login_settings_details[0]['logout_on']
+                working_days = login_settings_details[0]['working_days']
+
+                # Only ONE restriction type can be active at a time:
+                # 1. working_days restriction (if login_on/logout_on are NULL)
+                # 2. time period restriction (if login_on/logout_on are set)
+
+                if login_on and logout_on:
                     
-                    # Set defaults if None (with timezone awareness)
-                    if not login_on:
-                        login_on = datetime.min.replace(tzinfo=timezone.utc)
-                    if not logout_on:
-                        logout_on = datetime.max.replace(tzinfo=timezone.utc)
+                    # Time period restriction is active
+                    logger.info(f"Checking time period restriction for user: {user_id}")
+
+                    # Get current datetime (full date and time) with timezone
+                    current_datetime = datetime.now(timezone.utc).replace(
+                        microsecond=0, second=0
+                    )
 
                     # Compare full datetime objects (both date and time)
                     if not (login_on <= current_datetime <= logout_on):
-                        logger.warning("Authorization failed - outside allowed period for user: %s", user_id)
+                        logger.warning(
+                            f"Authorization failed - outside allowed period for user: {user_id}"
+                        )
                         return Respons[AuthServiceReadDto](
-                            detail="Login is not allowed at this time. Please check your access schedule.",
+                            detail="Access is not allowed at this time. Please check your access schedule.",
                             data=[],
                             success=False,
                             status_code=403,
                             error="LOGIN_TIME_RESTRICTED"
                         )
-            
-            # 1️⃣ Get all groups the user belongs to
-            user_groups = DatabaseManager.execute_query(
-                f"""SELECT group_id FROM "{tenant_id}".{db_settings.USER_GROUPS_TABLE}
-                    WHERE delete_status = 'NOT_DELETED' AND is_active = true AND user_id = %s""",(user_id,),
-            )
+                elif working_days:
+                    # Working days restriction is active
+                    logger.info(f"Checking working days restriction for user: {user_id}")
+                    current_day = datetime.now().strftime("%A").upper()
 
-            # 2️⃣ Prepare list of group_ids
-            group_ids = [g["group_id"] for g in user_groups] if user_groups else []
+                    if current_day not in working_days:
+                        logger.warning(
+                            f"Authorization failed - not a working day for user: {user_id}"
+                        )
+                        return Respons[AuthServiceReadDto](
+                            detail="Access is not allowed on this day. Please contact your administrator.",
+                            data=[],
+                            success=False,
+                            status_code=403,
+                            error="LOGIN_DAY_RESTRICTED"
+                        )
 
-            # 3️⃣ Build query dynamically to include groups (if any) + user
+            # 4️⃣ Build query dynamically to include groups (if any) + user
+            # ⚠️ CHANGED: Simplified to new schema - only select user_id, group_id, role_id, resource_type
             if group_ids:
                 get_user_roles = DatabaseManager.execute_query(
                     f"""
-                        SELECT DISTINCT ON (org_id, group_id, bus_id, app_id, shared_resource_id, resource_id, user_id, role_id)
-                            org_id, group_id, bus_id, app_id, shared_resource_id, resource_id, user_id, role_id
-                        FROM "{tenant_id}".{db_settings.ASSIGN_ROLES_TABLE}
-                        WHERE delete_status = 'NOT_DELETED'
+                        SELECT DISTINCT ON (group_id, user_id, role_id)
+                            group_id, user_id, role_id, resource_type
+                        FROM {db_settings.CORE_PLATFORM_ASSIGN_ROLES_TABLE}
+                        WHERE tenant_id = %s AND delete_status = 'NOT_DELETED'
                         AND is_active = true
+                        AND (is_system = false OR is_system IS NULL)
                         AND (user_id = %s OR group_id = ANY(%s))
-                        ORDER BY org_id, group_id, bus_id, app_id, shared_resource_id, resource_id, user_id, role_id;
+                        ORDER BY group_id, user_id, role_id;
                     """,
-                    (user_id, group_ids),
+                    (tenant_id, user_id, group_ids),
                 )
             else:
                 # No groups, just check roles for user
                 get_user_roles = DatabaseManager.execute_query(
                     f"""
-                        SELECT DISTINCT ON (org_id, bus_id, app_id, shared_resource_id, resource_id, user_id, role_id)
-                            org_id, bus_id, app_id, shared_resource_id, resource_id, user_id, role_id
-                        FROM "{tenant_id}".{db_settings.ASSIGN_ROLES_TABLE}
-                        WHERE delete_status = 'NOT_DELETED'
+                        SELECT DISTINCT ON (user_id, role_id)
+                            user_id, role_id, resource_type
+                        FROM {db_settings.CORE_PLATFORM_ASSIGN_ROLES_TABLE}
+                        WHERE tenant_id = %s AND delete_status = 'NOT_DELETED'
                         AND is_active = true
+                        AND (is_system = false OR is_system IS NULL)
                         AND user_id = %s
-                        ORDER BY org_id, bus_id, app_id, shared_resource_id, resource_id, user_id, role_id;
+                        ORDER BY user_id, role_id;
                     """,
-                    (user_id,),
+                    (tenant_id, user_id,),
                 )
 
+            # ✅ NEW: Get system-level roles from cp_assign_roles with is_system=true
+            # NOTE: system_groups, system_user_groups, and system_assign_roles are now consolidated
+            # into cp_groups, cp_user_groups, and cp_assign_roles with is_system flag
+            # Use LEFT JOIN starting from cp_assign_roles to find BOTH direct user assignments AND group-based assignments
+            logger.info(f"Fetching system-level roles for user: {user_id}")
+
+            system_roles = DatabaseManager.execute_query(
+                f"""
+                    SELECT DISTINCT COALESCE(sar.group_id::TEXT, NULL) as group_id, sar.user_id, sar.role_id, sar.resource_type
+                    FROM {db_settings.CORE_PLATFORM_ASSIGN_ROLES_TABLE} sar
+                    LEFT JOIN {db_settings.CORE_PLATFORM_USER_GROUPS_TABLE} sug 
+                        ON sar.group_id = sug.group_id AND sar.tenant_id = sug.tenant_id
+                    WHERE sar.tenant_id = 'system-tenant-id'
+                    AND sar.is_system = true
+                    AND sar.delete_status = 'NOT_DELETED'
+                    AND sar.is_active = true
+                    AND (sar.user_id = %s OR (sug.user_id = %s AND sug.tenant_id = 'system-tenant-id' AND sug.is_system = true AND sug.is_active = true AND sug.delete_status = 'NOT_DELETED'))
+                """,
+                (user_id, user_id)
+            )
+
+            if system_roles:
+                logger.info(f"Found {len(system_roles)} system-level role(s) for user: {user_id}")
+            else:
+                logger.info(f"No system-level roles found for user: {user_id}")
+
+            # ✅ NEW: Merge tenant-level and system-level roles
+            all_roles = get_user_roles + system_roles
+            logger.info(f"Total roles (tenant + system) for user {user_id}: {len(all_roles)}")
+
             # GET permissions and Append to Role
             get_user_roles_with_tenant_and_permissions = []
-            for role in get_user_roles:
-                permissions = DatabaseManager.execute_query(
-                    f"""SELECT permission_id FROM {db_settings.ROLE_PERMISSIONS_TABLE} WHERE role_id = %s""",
-                    params=(role["role_id"],),)
+            
+            # Track system role IDs by querying cp_roles table for is_system flag (more reliable)
+            system_role_ids = set()
+            if all_roles:
+                role_ids = [r.get("role_id") for r in all_roles if r.get("role_id")]
+                if role_ids:
+                    try:
+                        # Check which roles are system roles by querying the roles table
+                        system_roles_check = DatabaseManager.execute_query(
+                            f"""SELECT id FROM {db_settings.CORE_PLATFORM_ROLES_TABLE} 
+                            WHERE id = ANY(%s) AND is_system = true AND delete_status = 'NOT_DELETED'""",
+                            params=(role_ids,),
+                        )
+                        if system_roles_check:
+                            for role_record in system_roles_check:
+                                role_id = role_record.get("id") if isinstance(role_record, dict) else (role_record[0] if isinstance(role_record, (list, tuple)) and len(role_record) > 0 else None)
+                                if role_id:
+                                    system_role_ids.add(role_id)
+                        
+                        logger.info(f"Identified {len(system_role_ids)} system roles for user {user_id}")
+                    except Exception as e:
+                        logger.warning(f"Error checking system roles: {str(e)}")
+                        # Fallback: use system_roles query results
+                        system_role_ids = {r.get("role_id") for r in system_roles if r.get("role_id")} if system_roles else set()
+            
+            for role in all_roles:
+                role_id = role.get("role_id")
+                if not role_id:
+                    logger.warning(f"Skipping role with missing role_id: {role}")
+                    continue
+                
+                # Determine which tenant_id to use for querying permissions
+                # For system roles, use 'system-tenant-id'; for tenant roles, use the user's tenant_id
+                is_system_role = role_id in system_role_ids
+                
+                # Try the primary tenant_id first based on whether it's a system role
+                if is_system_role:
+                    primary_tenant_id = 'system-tenant-id'
+                    fallback_tenant_id = tenant_id
+                else:
+                    primary_tenant_id = tenant_id
+                    fallback_tenant_id = 'system-tenant-id'
+                
+                # Query permissions for this role with primary tenant_id
+                permissions = []
+                try:
+                    permissions = DatabaseManager.execute_query(
+                        f"""SELECT permission_id FROM {db_settings.CORE_PLATFORM_ROLE_PERMISSIONS_TABLE} 
+                        WHERE role_id = %s AND tenant_id = %s AND delete_status = 'NOT_DELETED'""",
+                        params=(role_id, primary_tenant_id),
+                    )
+                    
+                    # If no permissions found with primary tenant_id, try fallback (handles edge cases)
+                    if not permissions or len(permissions) == 0:
+                        logger.debug(f"No permissions found for role {role_id} with tenant {primary_tenant_id}, trying fallback {fallback_tenant_id}")
+                        fallback_permissions = DatabaseManager.execute_query(
+                            f"""SELECT permission_id FROM {db_settings.CORE_PLATFORM_ROLE_PERMISSIONS_TABLE} 
+                            WHERE role_id = %s AND tenant_id = %s AND delete_status = 'NOT_DELETED'""",
+                            params=(role_id, fallback_tenant_id),
+                        )
+                        if fallback_permissions and len(fallback_permissions) > 0:
+                            permissions = fallback_permissions
+                            logger.info(f"Found permissions for role {role_id} in fallback tenant {fallback_tenant_id}")
+                except Exception as e:
+                    logger.error(f"Error querying permissions for role {role_id}: {str(e)}", exc_info=True)
+                    permissions = []
 
                 role_dict = {**role, "tenant_id": tenant_id, "permissions": [p['permission_id'] for p in permissions]}
                 get_user_roles_with_tenant_and_permissions.append(role_dict)
 
             roles_dto = Helper.map_to_dto(get_user_roles_with_tenant_and_permissions, AuthServiceReadDto)
 
+            logger.info(f"Authorization successful for user: {user_id} with {len(roles_dto)} total role entries")
+
             return Respons[AuthServiceReadDto](
                 detail="Authorized",
                 data=roles_dto,
@@ -216,7 +347,7 @@ class AuthService:
             raise http_ex
 
         except Exception as e:
-            logger.error("Authorization check failed for user: %s", str(e))
+            logger.error("Authorization check failed for user: %s - Error: %s", user_id, str(e), exc_info=True)
             return Respons[AuthServiceReadDto](
                 detail=None,
                 data=[],
@@ -224,31 +355,27 @@ class AuthService:
                 status_code=500,
                 error="Authorization check failed due to an internal error"
             )
-        
+
     @staticmethod
-    def check_permission(users_data: list, action=None, org_id=None, bus_id=None, app_id=None,
-                     resource_id=None, shared_resource_id=None) -> bool:
+    def check_permission(users_data: list, action=None, resource_type=None) -> bool:
         """
-        Check if user has a given permission (action) for a specific target.
-        
-        Hierarchy: organization > business > app > location > resource/shared_resource
-        If a field in role is None, it applies to all under that level.
+        Check if user has a given permission (action).
+
+        Args:
+            users_data: List of user authorization data containing roles and permissions
+            action: The permission/action to check for
+            resource_type: Optional resource type filter (e.g., 'rt-user', 'rt-group')
+
+        Returns:
+            bool: True if user has the permission, False otherwise
         """
         for user_data in users_data:
-            # Check hierarchy: None means "all"
-            if user_data.org_id not in (None, org_id):
-                continue
-            if user_data.bus_id not in (None, bus_id):
-                continue
-            if user_data.app_id not in (None, app_id):
-                continue
-            if user_data.resource_id not in (None, resource_id):
-                continue
-            if user_data.shared_resource_id not in (None, shared_resource_id):
+            # Check resource_type if specified
+            if resource_type and user_data.resource_type and user_data.resource_type != resource_type:
                 continue
 
             # Check if the permission exists
-            if action in user_data.permissions:
+            if action and action in user_data.permissions:
                 return True
 
         return False
@@ -273,18 +400,34 @@ class AuthService:
     def authorize_user_from_token(token: str) -> Respons[AuthServiceReadDto]:
         """
         Convenience method to authorize a user directly from a JWT token.
-        
+
         Args:
             token: JWT token string
-            
+
         Returns:
             Respons[AuthServiceReadDto]: Authorization result with user roles and permissions
-            
+
         Raises:
             HTTPException: If token is invalid
         """
-        user_info = AuthService.decode_token(token)
-        return AuthService.authorize(user_info["user_id"], user_info["tenant_id"])
+        credentials_exception = HTTPException(
+            status_code=401,
+            detail="Could not validate credentials",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+        try:
+            payload = jwt.decode(token, db_settings.SECRET_KEY, algorithms=[db_settings.ALGORITHM])
+            user_id = payload.get("user_id")
+            tenant_id = payload.get("tenant_id")
+
+            if user_id is None or tenant_id is None:
+                raise credentials_exception
+
+            data = AuthServiceWriteDto(user_id=user_id, tenant_id=tenant_id)
+            return AuthService.authorize(data=data)
+
+        except jwt.InvalidTokenError as exc:
+            raise credentials_exception from exc
     
     @staticmethod
     def get_user_permissions(user_roles: list) -> list:

trovesuite/auth/auth_write_dto.py

@@ -4,7 +4,7 @@ from pydantic import BaseModel
 
 class AuthControllerWriteDto(BaseModel):
     user_id: Optional[str] = None
-    tenant: Optional[str] = None
+    tenant_id: Optional[str] = None
 
 class AuthServiceWriteDto(AuthControllerWriteDto):
     pass