32 lines
1.0 KiB
Python
32 lines
1.0 KiB
Python
from __future__ import annotations
|
|
|
|
from govoplan_core.auth import has_scope
|
|
from govoplan_core.core.modules import AccessDecision
|
|
|
|
|
|
class ProjectScopeAclProvider:
|
|
"""Expose coarse scope checks; the Projects registry rechecks object grants."""
|
|
|
|
def __init__(self, resource_type: str) -> None:
|
|
self.resource_type = resource_type
|
|
|
|
def can_read(self, principal: object, resource_id: str) -> bool:
|
|
del resource_id
|
|
return has_scope(principal, "projects:project:read")
|
|
|
|
def can_write(self, principal: object, resource_id: str) -> bool:
|
|
del resource_id
|
|
return has_scope(principal, "projects:project:write")
|
|
|
|
def explain(self, principal: object, resource_id: str) -> AccessDecision:
|
|
del resource_id
|
|
allowed = self.can_read(principal, "")
|
|
return AccessDecision(
|
|
allowed=allowed,
|
|
reason=None if allowed else "Missing scope: projects:project:read",
|
|
requirements=("projects:project:read",),
|
|
)
|
|
|
|
|
|
__all__ = ["ProjectScopeAclProvider"]
|