Bernt
aee0f09db8
- Datafabrik: Dockerfile fix, agentorkestrering fungerar - Vision: Identify-modell, FAISS, OCR alla testade - API: Alla 7 integrationstester passerade - Upplösare: Entitetsupplösning verifierad
139 lines
3.6 KiB
Python
139 lines
3.6 KiB
Python
"""RBAC permission system."""
|
|
from enum import Enum
|
|
from typing import Set
|
|
|
|
|
|
class Permission(str, Enum):
|
|
"""All available permissions in the system."""
|
|
|
|
# Users
|
|
USERS_CREATE = "users.create"
|
|
USERS_READ = "users.read"
|
|
USERS_UPDATE = "users.update"
|
|
USERS_DELETE = "users.delete"
|
|
USERS_IMPERSONATE = "users.impersonate"
|
|
|
|
# Tenants
|
|
TENANTS_CREATE = "tenants.create"
|
|
TENANTS_READ = "tenants.read"
|
|
TENANTS_UPDATE = "tenants.update"
|
|
TENANTS_DELETE = "tenants.delete"
|
|
TENANTS_MANAGE = "tenants.manage"
|
|
|
|
# Roles
|
|
ROLES_CREATE = "roles.create"
|
|
ROLES_READ = "roles.read"
|
|
ROLES_UPDATE = "roles.update"
|
|
ROLES_DELETE = "roles.delete"
|
|
ROLES_ASSIGN = "roles.assign"
|
|
|
|
# API Keys
|
|
API_KEYS_CREATE = "api_keys.create"
|
|
API_KEYS_READ = "api_keys.read"
|
|
API_KEYS_REVOKE = "api_keys.revoke"
|
|
API_KEYS_ROTATE = "api_keys.rotate"
|
|
|
|
# Billing
|
|
BILLING_READ = "billing.read"
|
|
BILLING_MANAGE = "billing.manage"
|
|
BILLING_INVOICES = "billing.invoices"
|
|
BILLING_SUBSCRIBE = "billing.subscribe"
|
|
|
|
# Audit Logs
|
|
AUDIT_READ = "audit.read"
|
|
AUDIT_EXPORT = "audit.export"
|
|
|
|
# Reports
|
|
REPORTS_CREATE = "reports.create"
|
|
REPORTS_READ = "reports.read"
|
|
REPORTS_RUN = "reports.run"
|
|
REPORTS_EXPORT = "reports.export"
|
|
REPORTS_DELETE = "reports.delete"
|
|
|
|
# Plugins
|
|
PLUGINS_INSTALL = "plugins.install"
|
|
PLUGINS_CONFIGURE = "plugins.configure"
|
|
PLUGINS_UNINSTALL = "plugins.uninstall"
|
|
PLUGINS_ENABLE = "plugins.enable"
|
|
|
|
# Settings
|
|
SETTINGS_READ = "settings.read"
|
|
SETTINGS_UPDATE = "settings.update"
|
|
|
|
# Super admin - all access
|
|
ALL = "*"
|
|
|
|
|
|
# Predefined roles with their permissions
|
|
DEFAULT_ROLES = {
|
|
"superadmin": [Permission.ALL],
|
|
"admin": [
|
|
Permission.USERS_CREATE,
|
|
Permission.USERS_READ,
|
|
Permission.USERS_UPDATE,
|
|
Permission.USERS_DELETE,
|
|
Permission.ROLES_READ,
|
|
Permission.ROLES_ASSIGN,
|
|
Permission.API_KEYS_CREATE,
|
|
Permission.API_KEYS_READ,
|
|
Permission.API_KEYS_REVOKE,
|
|
Permission.BILLING_READ,
|
|
Permission.BILLING_INVOICES,
|
|
Permission.AUDIT_READ,
|
|
Permission.AUDIT_EXPORT,
|
|
Permission.REPORTS_CREATE,
|
|
Permission.REPORTS_READ,
|
|
Permission.REPORTS_RUN,
|
|
Permission.REPORTS_EXPORT,
|
|
Permission.PLUGINS_CONFIGURE,
|
|
Permission.PLUGINS_ENABLE,
|
|
Permission.SETTINGS_READ,
|
|
Permission.SETTINGS_UPDATE,
|
|
],
|
|
"editor": [
|
|
Permission.USERS_READ,
|
|
Permission.USERS_UPDATE,
|
|
Permission.REPORTS_CREATE,
|
|
Permission.REPORTS_READ,
|
|
Permission.REPORTS_RUN,
|
|
Permission.REPORTS_EXPORT,
|
|
Permission.SETTINGS_READ,
|
|
],
|
|
"viewer": [
|
|
Permission.USERS_READ,
|
|
Permission.REPORTS_READ,
|
|
Permission.SETTINGS_READ,
|
|
],
|
|
"api": [
|
|
Permission.API_KEYS_READ,
|
|
Permission.API_KEYS_CREATE,
|
|
],
|
|
}
|
|
|
|
|
|
def has_permission(user_permissions: Set[str], required: str) -> bool:
|
|
"""Check if user has the required permission.
|
|
|
|
Args:
|
|
user_permissions: Set of permission strings the user has
|
|
required: The required permission string
|
|
|
|
Returns:
|
|
True if user has permission, False otherwise
|
|
"""
|
|
if Permission.ALL in user_permissions:
|
|
return True
|
|
|
|
# Check exact permission
|
|
if required in user_permissions:
|
|
return True
|
|
|
|
# Check wildcard permissions (e.g., "users.*" matches "users.read")
|
|
parts = required.split(".")
|
|
for i in range(1, len(parts)):
|
|
wildcard = ".".join(parts[:i]) + ".*"
|
|
if wildcard in user_permissions:
|
|
return True
|
|
|
|
return False
|