31 lines
939 B
Python
31 lines
939 B
Python
from __future__ import annotations
|
|
|
|
from govoplan_core.auth import has_scope
|
|
from govoplan_core.core.modules import AccessDecision
|
|
|
|
|
|
class CaseAclProvider:
|
|
"""Expose the tenant-level Case permission boundary to generic consumers."""
|
|
|
|
resource_type = "case"
|
|
|
|
def can_read(self, principal: object, resource_id: str) -> bool:
|
|
del resource_id
|
|
return has_scope(principal, "cases:case:read")
|
|
|
|
def can_write(self, principal: object, resource_id: str) -> bool:
|
|
del resource_id
|
|
return has_scope(principal, "cases:case:update")
|
|
|
|
def explain(self, principal: object, resource_id: str) -> AccessDecision:
|
|
del resource_id
|
|
allowed = self.can_read(principal, "")
|
|
return AccessDecision(
|
|
allowed=allowed,
|
|
reason=None if allowed else "Missing scope: cases:case:read",
|
|
requirements=("cases:case:read",),
|
|
)
|
|
|
|
|
|
__all__ = ["CaseAclProvider"]
|