umacs 0.7.2__tar.gz

umacs-0.7.2/PKG-INFO

@@ -0,0 +1,54 @@
+Metadata-Version: 2.4
+Name: umacs
+Version: 0.7.2
+Summary: UMACS is a unified management and access control service.
+Requires-Python: >=3.13
+Description-Content-Type: text/markdown
+Requires-Dist: pydantic>=2.11.7
+Requires-Dist: httpx>=0.28.1
+
+# UMACS User Management and Access Control Service
+
+[![codecov](https://codecov.io/github/csed-ucm/umacs/graph/badge.svg?token=NDVM21XN8W)](https://codecov.io/github/csed-ucm/umacs)
+
+UMACS (User Management and Access Control Service) is a lightweight, reusable Authorization service.
+
+## Features
+
+- [x] **Policy Engine** based on Casbin for flexible access control, supporting RBAC and ABAC.
+- [x] **Logging** using SQL tables for efficient storage and auditing of decision logs.
+- [x] **JWKS discovery** + **caching** for validating tokens from configured IdPs and rejecting invalid tokens.
+- [x] **API** for managing users, roles, and permissions.
+
+## Core Dependencies
+
+The service is built using:
+
+- FastAPI + Uvicorn
+- Authlib (OIDC JWT verification)
+- Casbin (RBAC + optional ABAC)
+- SQLModel + AsyncSQLAlchemy (Policies, Users, Resources, Decision Logs)
+- Alembic (Database Migrations)
+
+## Quickstart
+
+### Prerequisites
+
+#### Environment
+
+Create a `.env` file based on `.env.example`.
+
+### Database Setup
+
+Run migrations to set up the SQL database:
+
+```sh
+uv run alembic upgrade head
+```
+
+### Install and run (using uv):
+
+```sh
+uv sync
+uv run fastapi dev
+```

umacs-0.7.2/README.md

@@ -0,0 +1,45 @@
+# UMACS User Management and Access Control Service
+
+[![codecov](https://codecov.io/github/csed-ucm/umacs/graph/badge.svg?token=NDVM21XN8W)](https://codecov.io/github/csed-ucm/umacs)
+
+UMACS (User Management and Access Control Service) is a lightweight, reusable Authorization service.
+
+## Features
+
+- [x] **Policy Engine** based on Casbin for flexible access control, supporting RBAC and ABAC.
+- [x] **Logging** using SQL tables for efficient storage and auditing of decision logs.
+- [x] **JWKS discovery** + **caching** for validating tokens from configured IdPs and rejecting invalid tokens.
+- [x] **API** for managing users, roles, and permissions.
+
+## Core Dependencies
+
+The service is built using:
+
+- FastAPI + Uvicorn
+- Authlib (OIDC JWT verification)
+- Casbin (RBAC + optional ABAC)
+- SQLModel + AsyncSQLAlchemy (Policies, Users, Resources, Decision Logs)
+- Alembic (Database Migrations)
+
+## Quickstart
+
+### Prerequisites
+
+#### Environment
+
+Create a `.env` file based on `.env.example`.
+
+### Database Setup
+
+Run migrations to set up the SQL database:
+
+```sh
+uv run alembic upgrade head
+```
+
+### Install and run (using uv):
+
+```sh
+uv sync
+uv run fastapi dev
+```

umacs-0.7.2/app/__init__.py

@@ -0,0 +1 @@
+

umacs-0.7.2/app/actions/auth.py

@@ -0,0 +1,28 @@
+from typing import Optional
+from sqlalchemy.ext.asyncio import AsyncSession
+from app.actions.users import authenticate_user
+import jwt
+from app.config import settings
+from datetime import datetime, timedelta, timezone
+
+
+def create_access_token(data: dict, expires_delta: Optional[timedelta] = None) -> str:
+    to_encode = data.copy()
+    if expires_delta:
+        expire = datetime.now(timezone.utc) + expires_delta
+    else:
+        expire = datetime.now(timezone.utc) + timedelta(minutes=15)
+    to_encode.update({"exp": expire})
+    encoded_jwt = jwt.encode(
+        to_encode, settings.SECRET_KEY, algorithm=settings.JWT_ALGORITHM
+    )
+    return encoded_jwt
+
+
+async def login(session: AsyncSession, username: str, password: str) -> Optional[dict]:
+    user = await authenticate_user(session, username, password)
+    if not user:
+        return None
+
+    access_token = create_access_token(data={"sub": user.username})
+    return {"access_token": access_token, "token_type": "bearer", "user": user}

umacs-0.7.2/app/actions/groups.py

@@ -0,0 +1,85 @@
+from typing import List, Optional
+from sqlmodel import select
+from sqlalchemy.ext.asyncio import AsyncSession
+from app.tables import Group, GroupMemberLink
+from app.schemas import GroupCreate
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from app.tables import User
+
+
+async def create_group(session: AsyncSession, group_in: GroupCreate) -> Group:
+    db_group = Group(
+        name=group_in.name,
+        description=group_in.description,
+        workspace_id=group_in.workspace_id,
+    )
+    session.add(db_group)
+    await session.commit()
+    await session.refresh(db_group)
+
+    # Add members if provided
+    if group_in.member_ids:
+        for user_id in group_in.member_ids:
+            link = GroupMemberLink(group_id=db_group.id, user_id=user_id)
+            session.add(link)
+        await session.commit()
+        await session.refresh(db_group)  # refresh to load members if needed
+
+    return db_group
+
+
+async def get_group(session: AsyncSession, group_id: int) -> Optional[Group]:
+    return await session.get(Group, group_id)
+
+
+async def list_groups(session: AsyncSession) -> List[Group]:
+    result = await session.execute(select(Group))
+    return list(result.scalars().all())
+
+
+async def delete_group(session: AsyncSession, group_id: int) -> bool:
+    group = await session.get(Group, group_id)
+    if not group:
+        return False
+    await session.delete(group)
+    await session.commit()
+    return True
+
+
+async def add_user_to_group(session: AsyncSession, group_id: int, user_id: int) -> bool:
+    # Check bounds would be good, but simple link insert matches other patterns
+    link = GroupMemberLink(group_id=group_id, user_id=user_id)
+    session.add(link)
+    try:
+        await session.commit()
+        return True
+    except Exception:
+        # Likely constraint violation (already member or invalid IDs)
+        await session.rollback()
+        return False
+
+
+async def remove_user_from_group(
+    session: AsyncSession, group_id: int, user_id: int
+) -> bool:
+    link = await session.get(GroupMemberLink, (group_id, user_id))
+    if not link:
+        return False
+    await session.delete(link)
+    await session.commit()
+    return True
+
+
+async def get_group_members(session: AsyncSession, group_id: int) -> List["User"]:
+    # Depending on output, maybe return User objects?
+    from app.tables import User
+
+    stmt = (
+        select(User)
+        .join(GroupMemberLink, User.id == GroupMemberLink.user_id)  # type: ignore[arg-type]
+        .where(GroupMemberLink.group_id == group_id)
+    )
+    result = await session.execute(stmt)
+    return list(result.scalars().all())

umacs-0.7.2/app/actions/policies.py

@@ -0,0 +1,27 @@
+from typing import List
+from app.authz import get_enforcer
+
+# Policy structure: sub, obj, act (from rbac_model.conf)
+
+
+async def add_policy(sub: str, obj: str, act: str, meta: str = "") -> bool:
+    e = await get_enforcer()
+    return await e.add_policy(sub, obj, act, meta)  # type: ignore[no-any-return]
+
+
+async def remove_policy(sub: str, obj: str, act: str) -> bool:
+    e = await get_enforcer()
+    # Use remove_filtered_policy to match sub, obj, act (indices 0, 1, 2)
+    # and ignore metadata (index 3).
+    # remove_filtered_policy(field_index, *field_values)
+    return await e.remove_filtered_policy(0, sub, obj, act)  # type: ignore[no-any-return]
+
+
+async def get_policies() -> List[List[str]]:
+    e = await get_enforcer()
+    return e.get_policy()  # type: ignore[no-any-return]
+
+
+async def get_policies_for_subject(sub: str) -> List[List[str]]:
+    e = await get_enforcer()
+    return e.get_filtered_policy(0, sub)  # type: ignore[no-any-return]

umacs-0.7.2/app/actions/resources.py

@@ -0,0 +1,36 @@
+from typing import List
+from sqlmodel import select
+from sqlalchemy.ext.asyncio import AsyncSession
+from app.tables import Resource
+from app.schemas import ResourceCreate
+
+
+async def create_resource(
+    session: AsyncSession, resource_in: ResourceCreate
+) -> Resource:
+    db_resource = Resource(
+        name=resource_in.name,
+        workspace_id=resource_in.workspace_id,
+        type=resource_in.type,
+    )
+    session.add(db_resource)
+    await session.commit()
+    await session.refresh(db_resource)
+    return db_resource
+
+
+async def list_resources(session: AsyncSession) -> List[Resource]:
+    result = await session.execute(select(Resource))
+    return list(result.scalars().all())
+
+
+async def delete_resource_by_name(session: AsyncSession, name: str) -> bool:
+    # Logic to delete by name (as per old endpoint style)
+    stmt = select(Resource).where(Resource.name == name)
+    result = await session.execute(stmt)
+    resource = result.scalars().first()
+    if not resource:
+        return False
+    await session.delete(resource)
+    await session.commit()
+    return True

umacs-0.7.2/app/actions/roles.py

@@ -0,0 +1,27 @@
+from typing import List
+from app.authz import get_enforcer
+
+
+async def add_role_for_user(user: str, role: str) -> bool:
+    e = await get_enforcer()
+    return await e.add_grouping_policy(user, role)  # type: ignore[no-any-return]
+
+
+async def remove_role_for_user(user: str, role: str) -> bool:
+    e = await get_enforcer()
+    return await e.remove_grouping_policy(user, role)  # type: ignore[no-any-return]
+
+
+async def get_roles_for_user(user: str) -> List[str]:
+    e = await get_enforcer()
+    return await e.get_roles_for_user(user)  # type: ignore[no-any-return]
+
+
+async def get_users_for_role(role: str) -> List[str]:
+    e = await get_enforcer()
+    return await e.get_users_for_role(role)  # type: ignore[no-any-return]
+
+
+async def get_all_roles() -> List[str]:
+    e = await get_enforcer()
+    return await e.get_all_roles()  # type: ignore[no-any-return]

umacs-0.7.2/app/actions/users.py

@@ -0,0 +1,111 @@
+from typing import Optional
+from sqlmodel import select
+from sqlalchemy.ext.asyncio import AsyncSession
+from app.tables import User
+from app.schemas import UserCreate
+from app.utils.auth.password import hash_password, verify_password
+
+
+async def get_user_by_username(session: AsyncSession, username: str) -> Optional[User]:
+    stmt = select(User).where(User.username == username)
+    result = await session.execute(stmt)
+    return result.scalar_one_or_none()
+
+
+async def create_user(session: AsyncSession, user_in: UserCreate) -> User:
+    if await get_user_by_username(session, user_in.username):
+        raise ValueError("Username already exists")
+
+    hashed = hash_password(user_in.password)
+    db_user = User(
+        username=user_in.username,
+        email=user_in.email,
+        name=user_in.name,
+        hashed_password=hashed,
+        external_idp_id=None,
+    )
+    session.add(db_user)
+    await session.commit()
+    await session.refresh(db_user)
+    return db_user
+
+
+async def authenticate_user(
+    session: AsyncSession, username: str, password: str
+) -> Optional[User]:
+    user = await get_user_by_username(session, username)
+    if not user:
+        return None
+    if not user.hashed_password:
+        return None
+    if verify_password(password, user.hashed_password):
+        return user
+    return None
+
+
+async def get_user_by_identity(
+    session: AsyncSession, iss: str, sub: str
+) -> Optional[User]:
+    """Find user by OIDC identity (issuer + subject)"""
+    stmt = select(User).where(User.iss == iss, User.sub == sub)
+    result = await session.execute(stmt)
+    return result.scalar_one_or_none()
+
+
+async def upsert_user(
+    session: AsyncSession,
+    iss: str,
+    sub: str,
+    email: str,
+    username: str,
+    name: str = "",
+    claims: Optional[str] = None,
+) -> User:
+    """
+    Create or update a user based on OIDC identity.
+    Atomic-like behavior: checks existence first.
+    """
+    # 1. Try to find by identity
+    user = await get_user_by_identity(session, iss, sub)
+
+    if user:
+        # Update existing user
+        # Avoid overwriting PII if not changed? SQLModel updates dirty fields.
+        user.email = email
+        user.name = name
+        if claims:
+            user.claims = claims
+        # Don't change username - it's a stable identifier locally
+    else:
+        # 2. Check if username is taken (by legacy account?)
+        # If taken, we might need a fallback strategy (e.g. append random suffix)
+        # For now, simplistic approach: fail or reuse?
+        # Better: JIT provisioning should tolerate username collisions by suffixing.
+        # But for this iteration, let's assume unique usernames provided by mapping or fail.
+        existing_username = await get_user_by_username(session, username)
+        if existing_username:
+            # Strategy: link if email matches? Or generic error?
+            # If emails match, we COULD link accounts.
+            # Let's link if email matches, else error.
+            if existing_username.email == email:
+                user = existing_username
+                user.iss = iss
+                user.sub = sub
+                user.claims = claims
+            else:
+                raise ValueError(f"Username {username} already taken by another user")
+        else:
+            # Create new
+            user = User(
+                username=username,
+                email=email,
+                name=name,
+                iss=iss,
+                sub=sub,
+                claims=claims,
+            )
+            session.add(user)
+
+    await session.commit()
+    await session.refresh(user)
+    return user

umacs-0.7.2/app/actions/workspaces.py

@@ -0,0 +1,37 @@
+from typing import List, Optional
+from sqlmodel import select
+from sqlalchemy.ext.asyncio import AsyncSession
+from app.tables import Workspace, WorkspaceMemberLink
+from app.schemas import WorkspaceCreate
+
+
+async def create_workspace(
+    session: AsyncSession, workspace_in: WorkspaceCreate, owner_id: int
+) -> Workspace:
+    db_workspace = Workspace(name=workspace_in.name, owner_id=owner_id)
+    session.add(db_workspace)
+    await session.commit()
+    await session.refresh(db_workspace)
+    return db_workspace
+
+
+async def get_workspace(
+    session: AsyncSession, workspace_id: int
+) -> Optional[Workspace]:
+    return await session.get(Workspace, workspace_id)
+
+
+async def list_workspaces(session: AsyncSession) -> List[Workspace]:
+    # Placeholder: currently listing all. Logic usually entails listing only accessible ones.
+    stmt = select(Workspace)
+    result = await session.execute(stmt)
+    return list(result.scalars().all())
+
+
+async def add_workspace_member(
+    session: AsyncSession, workspace_id: int, user_id: int
+) -> None:
+    # Check existence logic omitted for brevity, usually handled or throws FK error
+    link = WorkspaceMemberLink(workspace_id=workspace_id, user_id=user_id)
+    session.add(link)
+    await session.commit()

umacs-0.7.2/app/api/__init__.py

@@ -0,0 +1,14 @@
+# # Initializing routers, importing key modules, and register routes into main router
+
+# from fastapi import FastAPI
+# from . import policies
+# from ...schemas import users
+# from . import roles
+# from . import auth
+
+# app = FastAPI()
+
+# app.include_router(policies.router, prefix="/policies", tags=["Policies"])
+# app.include_router(users.router, prefix="/user", tags=["Users"])
+# app.include_router(roles.router, prefix="/roles", tags=["Roles"])
+# app.include_router(auth.router, prefix="/auth", tags=["Auth"])

umacs-0.7.2/app/api/auth.py

@@ -0,0 +1,40 @@
+from fastapi import APIRouter, Depends, HTTPException, status
+from sqlalchemy.ext.asyncio import AsyncSession
+from fastapi.security import OAuth2PasswordRequestForm
+
+from app.utils.db import get_session
+from app.actions import auth as auth_actions
+
+router = APIRouter()
+
+
+@router.post("/login")
+async def login(
+    form_data: OAuth2PasswordRequestForm = Depends(),
+    session: AsyncSession = Depends(get_session),
+) -> dict:
+    token = await auth_actions.login(session, form_data.username, form_data.password)
+    if not token:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Incorrect username or password",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+    return token
+
+
+@router.post("/register", status_code=status.HTTP_200_OK)
+async def register(
+    user_data: dict,  # Or UserCreate, but let's stick to dict for flexibility or import UserCreate
+    session: AsyncSession = Depends(get_session),
+) -> dict:
+    from app.schemas.user import UserCreate
+    from app.actions.users import create_user
+
+    # Adapt validation
+    try:
+        user_in = UserCreate(**user_data)
+        await create_user(session, user_in)
+        return {"message": "User created successfully"}
+    except Exception as e:
+        raise HTTPException(status_code=400, detail=str(e))

umacs-0.7.2/app/api/enforce.py

@@ -0,0 +1,21 @@
+from fastapi import APIRouter, Depends
+from app.authz import get_enforcer
+from app.utils.db import get_session
+from sqlalchemy.ext.asyncio import AsyncSession
+from app.schemas import EnforceRequest, EnforceResponse
+
+router = APIRouter()
+
+
+@router.post("/check", response_model=EnforceResponse)
+async def check_permission(
+    req: EnforceRequest, session: AsyncSession = Depends(get_session)
+) -> EnforceResponse:
+    e = await get_enforcer()
+    allowed = e.enforce(req.sub, req.obj, req.act)
+
+    from app.utils.logging import log_decision
+
+    await log_decision(sub=req.sub, obj=req.obj, act=req.act, authorized=allowed)
+
+    return EnforceResponse(allow=allowed)

umacs-0.7.2/app/api/groups.py

@@ -0,0 +1,60 @@
+from fastapi import APIRouter, Depends, HTTPException, status
+from sqlalchemy.ext.asyncio import AsyncSession
+from typing import List
+
+from app.utils.db import get_session
+from app.schemas import GroupCreate, GroupOut, UserRead
+from app.actions import groups as group_actions
+
+router = APIRouter()
+
+
+@router.post("/", response_model=GroupOut, status_code=status.HTTP_201_CREATED)
+async def create_group(
+    group: GroupCreate, session: AsyncSession = Depends(get_session)
+) -> GroupOut:
+    return await group_actions.create_group(session, group)  # type: ignore[return-value]
+
+
+@router.get("/", response_model=List[GroupOut])
+async def list_groups(session: AsyncSession = Depends(get_session)) -> List[GroupOut]:
+    return await group_actions.list_groups(session)  # type: ignore[return-value]
+
+
+@router.get("/{group_id}", response_model=GroupOut)
+async def get_group(
+    group_id: int, session: AsyncSession = Depends(get_session)
+) -> GroupOut:
+    group = await group_actions.get_group(session, group_id)
+    if not group:
+        raise HTTPException(status_code=404, detail="Group not found")
+    return group  # type: ignore[return-value]
+
+
+@router.delete("/{group_id}")
+async def delete_group(
+    group_id: int, session: AsyncSession = Depends(get_session)
+) -> dict:
+    success = await group_actions.delete_group(session, group_id)
+    if not success:
+        raise HTTPException(status_code=404, detail="Group not found")
+    return {"detail": "Group deleted"}
+
+
+@router.post("/{group_id}/users/{user_id}")
+async def add_user_to_group(
+    group_id: int, user_id: int, session: AsyncSession = Depends(get_session)
+) -> dict:
+    success = await group_actions.add_user_to_group(session, group_id, user_id)
+    if not success:
+        raise HTTPException(
+            status_code=400, detail="Could not add user (already member?)"
+        )
+    return {"detail": "User added to group"}
+
+
+@router.get("/{group_id}/users", response_model=List[UserRead])
+async def list_group_members(
+    group_id: int, session: AsyncSession = Depends(get_session)
+) -> List[UserRead]:
+    return await group_actions.get_group_members(session, group_id)  # type: ignore[return-value]

umacs-0.7.2/app/api/models_route.py

@@ -0,0 +1,47 @@
+from fastapi import APIRouter, File, UploadFile, HTTPException
+from app.authz import get_enforcer, BASE_DIR
+import os
+import shutil
+
+router = APIRouter()
+
+
+@router.post("/upload")
+async def upload_model(file: UploadFile = File(...)) -> dict:
+    if not file.filename or not file.filename.endswith(".conf"):
+        raise HTTPException(status_code=400, detail="Only .conf files are allowed.")
+
+    # Securely save the file
+    # For simplicity, we overwrite a "dynamic_model.conf" or similar,
+    # but the user might want to replace "rbac_model.conf".
+    # Let's save it as "custom_model.conf" and reload.
+
+    target_path = os.path.join(BASE_DIR, "custom_model.conf")
+
+    try:
+        with open(target_path, "wb") as buffer:
+            shutil.copyfileobj(file.file, buffer)
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=f"Could not save file: {str(e)}")
+
+    # Reload Enforcer with new model
+    try:
+        _ = await get_enforcer("custom_model.conf")
+        # get_enforcer needs to support swapping models dynamically.
+        # Currently it defaults to "rbac_model.conf".
+        # We need to ensure get_enforcer can load this new file.
+        # My implementation of get_enforcer takes optional `model_file`.
+        # But `e` is a singleton in app.state usually, or fresh every time?
+        # get_enforcer creates a new instance every time in my impl.
+        # This is fine for per-request, but we might want a global one?
+        # For now, this confirms the model is valid.
+        pass
+    except Exception as e:
+        # If invalid, revert?
+        os.remove(target_path)
+        raise HTTPException(status_code=400, detail=f"Invalid model content: {str(e)}")
+
+    return {
+        "message": "Model uploaded and verified.",
+        "model_file": "custom_model.conf",
+    }

umacs-0.7.2/app/api/policies.py

@@ -0,0 +1,36 @@
+from app.actions import policies as policy_actions
+from app.schemas import PolicyCreate
+from typing import List
+from fastapi import APIRouter, HTTPException
+
+router = APIRouter()
+
+
+# Adding policies
+@router.post("/add", response_model=bool)
+async def add_policy(payload: PolicyCreate) -> bool:
+    meta_json = payload.get_metadata_json()
+    return await policy_actions.add_policy(
+        payload.sub, payload.obj, payload.act, meta_json
+    )
+
+
+# Listing all policies
+@router.get("/", response_model=List[List[str]])
+async def list_policies() -> List[List[str]]:
+    return await policy_actions.get_policies()
+
+
+# Delete a policy
+@router.delete("/remove", response_model=bool)
+async def delete_policy(sub: str, obj: str, act: str) -> bool:
+    removed = await policy_actions.remove_policy(sub, obj, act)
+    if not removed:
+        raise HTTPException(status_code=404, detail="Policy not found")
+    return removed
+
+
+# Retrieving policies for a subject
+@router.get("/subject/{sub}", response_model=List[List[str]])
+async def get_policy_for_subject(sub: str) -> List[List[str]]:
+    return await policy_actions.get_policies_for_subject(sub)