4915205678
* core: start migrating to flows for authorisation * sources/oauth: start type-hinting * core: create default user * core: only show user delete button if an unenrollment flow exists * flows: Correctly check initial policies on flow with context * policies: add more verbosity to engine * sources/oauth: migrate to flows * sources/oauth: fix typing errors * flows: add more tests * sources/oauth: start implementing unittests * sources/ldap: add option to disable user sync, move connection init to model * sources/ldap: re-add default PropertyMappings * providers/saml: re-add default PropertyMappings * admin: fix missing stage count * stages/identification: fix sources not being shown * crypto: fix being unable to save with private key * crypto: re-add default self-signed keypair * policies: rewrite cache_key to prevent wrong cache * sources/saml: migrate to flows for auth and enrollment * stages/consent: add new stage * admin: fix PropertyMapping widget not rendering properly * core: provider.authorization_flow is mandatory * flows: add support for "autosubmit" attribute on form * flows: add InMemoryStage for dynamic stages * flows: optionally allow empty flows from FlowPlanner * providers/saml: update to authorization_flow * sources/*: fix flow executor URL * flows: fix pylint error * flows: wrap responses in JSON object to easily handle redirects * flow: dont cache plan's context * providers/oauth: rewrite OAuth2 Provider to use flows * providers/*: update docstrings of models * core: fix forms not passing help_text through safe * flows: fix HttpResponses not being converted to JSON * providers/oidc: rewrite to use flows * flows: fix linting
41 lines
1.4 KiB
Python
41 lines
1.4 KiB
Python
"""passbook access helper classes"""
|
|
from django.contrib import messages
|
|
from django.http import HttpRequest
|
|
from django.utils.translation import gettext as _
|
|
from structlog import get_logger
|
|
|
|
from passbook.core.models import Application, Provider, User
|
|
from passbook.policies.engine import PolicyEngine
|
|
from passbook.policies.types import PolicyResult
|
|
|
|
LOGGER = get_logger()
|
|
|
|
|
|
class AccessMixin:
|
|
"""Mixin class for usage in Authorization views.
|
|
Provider functions to check application access, etc"""
|
|
|
|
# request is set by view but since this Mixin has no base class
|
|
request: HttpRequest = None
|
|
|
|
def provider_to_application(self, provider: Provider) -> Application:
|
|
"""Lookup application assigned to provider, throw error if no application assigned"""
|
|
try:
|
|
return provider.application
|
|
except Application.DoesNotExist as exc:
|
|
messages.error(
|
|
self.request,
|
|
_(
|
|
'Provider "%(name)s" has no application assigned'
|
|
% {"name": provider}
|
|
),
|
|
)
|
|
raise exc
|
|
|
|
def user_has_access(self, application: Application, user: User) -> PolicyResult:
|
|
"""Check if user has access to application."""
|
|
LOGGER.debug("Checking permissions", user=user, application=application)
|
|
policy_engine = PolicyEngine(application, user, self.request)
|
|
policy_engine.build()
|
|
return policy_engine.result
|