Govern hierarchical View projections
This commit is contained in:
@@ -0,0 +1,244 @@
|
||||
from __future__ import annotations
|
||||
|
||||
from collections.abc import Mapping
|
||||
from dataclasses import dataclass
|
||||
from typing import Any
|
||||
|
||||
from sqlalchemy.orm import Session
|
||||
|
||||
from govoplan_policy.backend.db.models import PolicyOverride
|
||||
from govoplan_policy.backend.policy_overrides import (
|
||||
delete_policy_override,
|
||||
get_policy_override,
|
||||
normalize_policy_scope,
|
||||
resolution_policy_overrides,
|
||||
set_policy_override,
|
||||
)
|
||||
from govoplan_policy.backend.view_governance import (
|
||||
VIEW_POLICY_BOOLEAN_FIELDS,
|
||||
ViewPolicyResolution,
|
||||
resolve_view_policy_rows,
|
||||
validate_view_policy,
|
||||
)
|
||||
|
||||
|
||||
class ViewPolicyError(ValueError):
|
||||
pass
|
||||
|
||||
|
||||
@dataclass(frozen=True, slots=True)
|
||||
class ViewPolicyState:
|
||||
row: PolicyOverride | None
|
||||
local_policy: Mapping[str, bool | tuple[str, ...]]
|
||||
effective: ViewPolicyResolution
|
||||
parent: ViewPolicyResolution
|
||||
|
||||
|
||||
def view_policy_state(
|
||||
session: Session,
|
||||
*,
|
||||
tenant_id: str,
|
||||
scope_type: str,
|
||||
scope_id: str | None = None,
|
||||
) -> ViewPolicyState:
|
||||
_, clean_scope_id, _ = normalize_policy_scope(
|
||||
tenant_id=tenant_id,
|
||||
scope_type=scope_type,
|
||||
scope_id=scope_id,
|
||||
)
|
||||
row = get_policy_override(
|
||||
session,
|
||||
policy_family="view",
|
||||
target_key="*",
|
||||
tenant_id=tenant_id,
|
||||
scope_type=scope_type,
|
||||
scope_id=clean_scope_id,
|
||||
)
|
||||
local_policy, malformed = validate_view_policy(
|
||||
row.policy if row is not None else {}
|
||||
)
|
||||
if malformed:
|
||||
local_policy = {}
|
||||
rows = _rows_for_scope(
|
||||
session,
|
||||
tenant_id=tenant_id,
|
||||
scope_type=scope_type,
|
||||
scope_id=clean_scope_id,
|
||||
)
|
||||
rank = _scope_rank(scope_type)
|
||||
return ViewPolicyState(
|
||||
row=row,
|
||||
local_policy=local_policy,
|
||||
effective=resolve_view_policy_rows(rows),
|
||||
parent=resolve_view_policy_rows(
|
||||
tuple(item for item in rows if _scope_rank(item.scope_type) < rank)
|
||||
),
|
||||
)
|
||||
|
||||
|
||||
def save_view_policy(
|
||||
session: Session,
|
||||
*,
|
||||
tenant_id: str,
|
||||
scope_type: str,
|
||||
scope_id: str | None,
|
||||
policy: object,
|
||||
actor_id: str | None,
|
||||
) -> ViewPolicyState:
|
||||
clean_policy, malformed = validate_view_policy(policy)
|
||||
if malformed:
|
||||
raise ViewPolicyError("View policy fields have invalid names or values")
|
||||
before = view_policy_state(
|
||||
session,
|
||||
tenant_id=tenant_id,
|
||||
scope_type=scope_type,
|
||||
scope_id=scope_id,
|
||||
)
|
||||
broadened = sorted(
|
||||
field
|
||||
for field in VIEW_POLICY_BOOLEAN_FIELDS
|
||||
if clean_policy.get(field) is True and before.parent.limits[field] is False
|
||||
)
|
||||
for field, parent_values in (
|
||||
("allowed_view_ids", before.parent.allowed_view_ids),
|
||||
("visible_surface_ids", before.parent.visible_surface_ids),
|
||||
):
|
||||
local_values = clean_policy.get(field)
|
||||
if (
|
||||
isinstance(local_values, tuple)
|
||||
and parent_values is not None
|
||||
and not set(local_values).issubset(parent_values)
|
||||
):
|
||||
broadened.append(field)
|
||||
if broadened:
|
||||
raise ViewPolicyError(
|
||||
"Lower-scope View policy cannot broaden parent restrictions: "
|
||||
+ ", ".join(broadened)
|
||||
)
|
||||
set_policy_override(
|
||||
session,
|
||||
policy_family="view",
|
||||
target_key="*",
|
||||
tenant_id=tenant_id,
|
||||
scope_type=scope_type,
|
||||
scope_id=scope_id,
|
||||
policy={
|
||||
key: list(value) if isinstance(value, tuple) else value
|
||||
for key, value in clean_policy.items()
|
||||
},
|
||||
actor_id=actor_id,
|
||||
)
|
||||
_clear_resolution_cache(session)
|
||||
return view_policy_state(
|
||||
session,
|
||||
tenant_id=tenant_id,
|
||||
scope_type=scope_type,
|
||||
scope_id=scope_id,
|
||||
)
|
||||
|
||||
|
||||
def remove_view_policy(
|
||||
session: Session,
|
||||
*,
|
||||
tenant_id: str,
|
||||
scope_type: str,
|
||||
scope_id: str | None,
|
||||
) -> bool:
|
||||
row = get_policy_override(
|
||||
session,
|
||||
policy_family="view",
|
||||
target_key="*",
|
||||
tenant_id=tenant_id,
|
||||
scope_type=scope_type,
|
||||
scope_id=scope_id,
|
||||
)
|
||||
if row is None:
|
||||
return False
|
||||
delete_policy_override(session, row)
|
||||
_clear_resolution_cache(session)
|
||||
return True
|
||||
|
||||
|
||||
def view_policy_response_payload(state: ViewPolicyState) -> dict[str, Any]:
|
||||
local_policy: Mapping[str, Any] = state.local_policy
|
||||
if state.row is not None:
|
||||
_, malformed = validate_view_policy(state.row.policy)
|
||||
if malformed:
|
||||
local_policy = {"configuration_status": "invalid_fail_closed"}
|
||||
return {
|
||||
"id": state.row.id if state.row is not None else None,
|
||||
"revision": state.row.revision if state.row is not None else None,
|
||||
"policy": _json_policy(local_policy),
|
||||
"effective_policy": _resolution_payload(state.effective),
|
||||
"parent_policy": _resolution_payload(state.parent),
|
||||
"source_path": [step.to_dict() for step in state.effective.source_path],
|
||||
"diagnostics": [dict(item) for item in state.effective.diagnostics],
|
||||
}
|
||||
|
||||
|
||||
def _resolution_payload(resolution: ViewPolicyResolution) -> dict[str, Any]:
|
||||
return {
|
||||
**dict(resolution.limits),
|
||||
"allowed_view_ids": (
|
||||
sorted(resolution.allowed_view_ids)
|
||||
if resolution.allowed_view_ids is not None
|
||||
else None
|
||||
),
|
||||
"visible_surface_ids": (
|
||||
sorted(resolution.visible_surface_ids)
|
||||
if resolution.visible_surface_ids is not None
|
||||
else None
|
||||
),
|
||||
}
|
||||
|
||||
|
||||
def _json_policy(policy: Mapping[str, Any]) -> dict[str, Any]:
|
||||
return {
|
||||
key: list(value) if isinstance(value, tuple) else value
|
||||
for key, value in policy.items()
|
||||
}
|
||||
|
||||
|
||||
def _rows_for_scope(
|
||||
session: Session,
|
||||
*,
|
||||
tenant_id: str,
|
||||
scope_type: str,
|
||||
scope_id: str | None,
|
||||
) -> tuple[PolicyOverride, ...]:
|
||||
clean_scope = scope_type.strip().casefold()
|
||||
rows = resolution_policy_overrides(
|
||||
session,
|
||||
policy_family="view",
|
||||
target_keys=("*",),
|
||||
tenant_id=tenant_id,
|
||||
group_ids=(scope_id,) if clean_scope == "group" and scope_id else (),
|
||||
user_ids=(scope_id,) if clean_scope == "user" and scope_id else (),
|
||||
)
|
||||
maximum_rank = _scope_rank(clean_scope)
|
||||
return tuple(row for row in rows if _scope_rank(row.scope_type) <= maximum_rank)
|
||||
|
||||
|
||||
def _scope_rank(scope_type: str) -> int:
|
||||
try:
|
||||
return ("system", "tenant", "group", "user").index(
|
||||
scope_type.strip().casefold()
|
||||
)
|
||||
except ValueError as exc:
|
||||
raise ViewPolicyError(
|
||||
"View policy scope must be system, tenant, group, or user"
|
||||
) from exc
|
||||
|
||||
|
||||
def _clear_resolution_cache(session: Session) -> None:
|
||||
session.info.pop("govoplan_policy_override_resolution", None)
|
||||
|
||||
|
||||
__all__ = [
|
||||
"ViewPolicyError",
|
||||
"ViewPolicyState",
|
||||
"remove_view_policy",
|
||||
"save_view_policy",
|
||||
"view_policy_response_payload",
|
||||
"view_policy_state",
|
||||
]
|
||||
Reference in New Issue
Block a user