GovOPlaN/govoplan-access
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Prefer canonical identity and organization directories

Browse Source
This commit is contained in:
Albrecht Degering
2026-07-11 01:13:53 +02:00
parent 5b8baa6cde
commit 002d12e417
8 changed files with 322 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
src/govoplan_access/backend/auth/dependencies.py
View File

@@ -13,7 +13,9 @@ from govoplan_core.core.access import (
PrincipalRef,
PrincipalResolver,
)
from govoplan_core.core.identity import IdentityDirectory
from govoplan_core.core.idm import IdmDirectory, OrganizationFunctionAssignmentRef
from govoplan_core.core.organizations import OrganizationDirectory
from govoplan_core.core.modules import AccessDecision
from govoplan_core.core.registry import PlatformRegistry
from govoplan_core.core.maintenance import MAINTENANCE_ACCESS_SCOPE, maintenance_response_detail, saved_maintenance_mode
@@ -63,6 +65,7 @@ def _build_principal_ref(
api_key: ApiKey | None = None,
auth_session: AuthSession | None = None,
idm_assignments: tuple[OrganizationFunctionAssignmentRef, ...] = (),
identity_directory: IdentityDirectory | None = None,
extra_roles: tuple[Role, ...] = (),
) -> PrincipalRef:
function_assignment_ids = list(collect_function_assignment_ids(session, user))
@@ -74,7 +77,7 @@ def _build_principal_ref(
account_id=account.id,
membership_id=user.id,
tenant_id=tenant_id,
identity_id=identity_id_for_account(session, account.id),
identity_id=identity_id_for_account(session, account.id, identity_directory=identity_directory),
scopes=frozenset(scopes),
group_ids=_principal_group_ids(session, user),
role_ids=frozenset(sorted(dict.fromkeys(role_ids))),
@@ -128,6 +131,8 @@ def _resolve_legacy_principal_ref(
authorization: str | None,
x_api_key: str | None,
idm_directory: IdmDirectory | None = None,
identity_directory: IdentityDirectory | None = None,
organization_directory: OrganizationDirectory | None = None,
) -> PrincipalRef:
token, source = _extract_token(request, authorization, x_api_key)
if not token:
@@ -147,7 +152,7 @@ def _resolve_legacy_principal_ref(
):
raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Inactive or inconsistent API-key principal")
idm_assignments = _idm_assignments_for_account(idm_directory, account.id, tenant_id=api_key.tenant_id)
idm_roles = tuple(collect_external_function_roles(session, user, idm_assignments))
idm_roles = tuple(collect_external_function_roles(session, user, idm_assignments, organization_directory=organization_directory))
user_scopes = _scopes_with_extra_roles(collect_user_scopes(session, user, include_system=False), idm_roles)
effective_scopes = intersect_api_key_scopes(user_scopes, api_key.scopes or [])
session.commit()
@@ -160,6 +165,7 @@ def _resolve_legacy_principal_ref(
scopes=effective_scopes,
auth_method="api_key",
idm_assignments=idm_assignments,
identity_directory=identity_directory,
extra_roles=idm_roles,
)
@@ -181,7 +187,7 @@ def _resolve_legacy_principal_ref(
if not header_token or not cookie_token or header_token != cookie_token or not verify_auth_session_csrf(auth_session, header_token):
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Invalid or missing CSRF token")
idm_assignments = _idm_assignments_for_account(idm_directory, account.id, tenant_id=user.tenant_id)
idm_roles = tuple(collect_external_function_roles(session, user, idm_assignments))
idm_roles = tuple(collect_external_function_roles(session, user, idm_assignments, organization_directory=organization_directory))
scopes = _scopes_with_extra_roles(collect_user_scopes(session, user, include_system=True), idm_roles)
session.commit()
return _build_principal_ref(
@@ -193,6 +199,7 @@ def _resolve_legacy_principal_ref(
scopes=scopes,
auth_method="session",
idm_assignments=idm_assignments,
identity_directory=identity_directory,
extra_roles=idm_roles,
)
@@ -257,8 +264,15 @@ def _permission_evaluator_from_request(request: Request) -> PermissionEvaluator
class LegacyPrincipalResolver:
def __init__(self, idm_directory: IdmDirectory | None = None) -> None:
def __init__(
self,
idm_directory: IdmDirectory | None = None,
identity_directory: IdentityDirectory | None = None,
organization_directory: OrganizationDirectory | None = None,
) -> None:
self._idm_directory = idm_directory
self._identity_directory = identity_directory
self._organization_directory = organization_directory
def resolve_request(self, request: object, *, session: object | None = None) -> PrincipalRef:
if not isinstance(request, Request):
@@ -272,6 +286,8 @@ class LegacyPrincipalResolver:
authorization=authorization,
x_api_key=x_api_key,
idm_directory=self._idm_directory,
identity_directory=self._identity_directory,
organization_directory=self._organization_directory,
)
with get_database().session() as managed_session:
return _resolve_legacy_principal_ref(
@@ -280,6 +296,8 @@ class LegacyPrincipalResolver:
authorization=authorization,
x_api_key=x_api_key,
idm_directory=self._idm_directory,
identity_directory=self._identity_directory,
organization_directory=self._organization_directory,
)