o ?7ih>@sUdZddlZddlmZddlmZddlZddlZddlZddl m Z ddl m Z ddl mZeeZedid Zeeed <daeejed <daeejed <d ejfddZd ejfddZ dCdedededededeef ddZdededededef ddZdDdeded efd!d"Z dedededed ef d#d$Z!dededed efd%d&Z"dededed efd'd(Z#deded e$efd)d*Z%deded e$efd+d,Z&deded e$efd-d.Z'dedededed ef d/d0Z(dedededed ef d1d2Z)deded e$e$efd3d4Z*d efd5d6Z+d efd7d8Z,deded dfd9d:Z-deded dfd;d<Z.d efd=d>Z/d efd?d@Z0d e$efdAdBZ1dS)Ez# Casbin RBAC Permission Management N)Adapter)Optional)settings) SessionLocal) ContextVarrequest_context)default_request_context _enforcer _redis_clientreturncCsBtdurtjrtjtjddatStjtjtjtjtj ddatS)zGet or create Redis clientNT)decode_responses)hostportdbpasswordr ) r r REDIS_URLredisfrom_urlRedis REDIS_HOST REDIS_PORTREDIS_DBREDIS_PASSWORDrr.domain_match resource1 resource2cSr r!r)r%r&rrrresource_match=r$z$get_enforcer..resource_matchaction1action2cSr r!r)r(r)rrr action_match@r$z"get_enforcer..action_match domainMatch resourceMatch actionMatchu5✅ Casbin enforcer initialized with database adapterz Model: z Database: @)r ospathdirnameabspath__file__joinrr DATABASE_URLrEnforcerstrbool add_functionloggerinfosplit)base_dir model_pathadapterr#r'r*rrr get_enforcer%s $      rAuser_id tenant_idresourceactionresultrole_idc Csz$ddlm}t}|j|||||||d|d|dd WdSty?}ztd|WYd}~dSd}~ww) z+Log permission check to audit table (async)r)log_permission_check ip_address user_agentr1) rBrCrDrErFrGrIrJ request_pathz&Failed to queue permission check log: N)app.tasks.audit_tasksrHr getdelay Exceptionr;error) rBrCrDrErFrGrHctxerrr_log_permission_checkNs$   rS action_typerolec Csz(ddlm}t}|j||||||dd|d|d|dd Wd StyC}ztd|WYd }~d Sd }~ww) z2Log permission grant/revoke to audit table (async)r)log_permission_changerBrIrJr1) rTrCrDrErUrBrIrJrKz'Failed to queue permission change log: N)rLrVr rMrNrOr;rP)rTrCrDrErUrVrQrRrrr_log_permission_changejs$    rWrIrJr1cCst|||ddS)z%Set request context for audit loggingrIrJr1N)r setrXrrrset_request_contexts  rZc Csd|d|d|d|}zt}||}|dur |dkWSWnty;}ztd|WYd}~nd}~wwt}d|} t|} || | ||} td|d|d |d |d | z| |d | rmdnd W| Sty}ztd|WYd}~| Sd}~ww)a^ Check if user has permission to perform action on resource Args: user_id: User ID tenant_id: Tenant ID (domain) resource: Resource name (e.g., "knowledge_bases", "agents") action: Action name (e.g., "read", "create", "update", "delete") Returns: True if user has permission, False otherwise perm::N1zRedis cache error: user:zPermission check: user= , tenant= , resource= , action=z -> i,0zRedis cache write error: ) rrMrOr;warningrAr8enforcedebugsetex) rBrCrDrE cache_key redis_clientcachedrRenforcersubjectdomainrFrrrcheck_permissions@   rmcCsddlm}ddlm}ddlm}t}z|||j |k }|s-t d|d|||j |k }|sDt d|d|j durX|j |krXt d|d |d |vrc| d d n|} |||j| k } | s|t d | d| jr|j dur| d vrt d| d| j dur| j |krt d | d |t} d|} t|} | | || }|r| td|d|d|t||ntd|d|d||W|S|w)a Add a role for user in a specific tenant with validation Args: user_id: User ID role: Role name (e.g., "role:customer_admin") tenant_id: Tenant ID Returns: True if successful Raises: ValueError: If validation fails r)User)Tenant)RolezUser z does not existzTenant Nz does not belong to tenant r\r/zRole > platform_userplatform_adminzCannot assign platform role z to tenant userr^u✅ Added role z for user in tenant u⚠️ Failed to add role )app.models.userrnapp.models.tenantroapp.models.rolerprqueryfilteridfirst ValueErrorrCr=code is_systemrAr8add_grouping_policy load_policyr;r<invalidate_user_permissionsrcclose)rBrUrCrnrorprusertenant role_coderole_objrjrkrlsuccessrrradd_role_for_users@     rcCs\t}d|}t|}||||}|r,|td|d|d|t|||S)z Remove a role from user in a specific tenant Args: user_id: User ID role: Role name tenant_id: Tenant ID Returns: True if successful r^u✅ Removed role z from user rs)rAr8remove_grouping_policyrr;r<r)rBrUrCrjrkrlrrrrremove_role_for_user s  rcCs(t}d|}t|}|||}|S)z Get all roles for user in a specific tenant Args: user_id: User ID tenant_id: Tenant ID Returns: List of role names r^)rAr8get_roles_for_user_in_domain)rBrCrjrkrlrolesrrrget_roles_for_user)s   rcCst||}dd|DS)z Get user roles in format expected by API permissions Args: user_id: User ID tenant_id: Tenant ID Returns: List of dicts with role_code: [{'role_code': 'platform_admin'}, ...] cSsg|] }d|ddiqS)rzrole:)replace).0rUrrr Nsz"get_user_roles..)r)rBrCrrrrget_user_rolesBs rcCst}t|}|||}|S)z Get all users with a specific role in a tenant Args: role: Role name tenant_id: Tenant ID Returns: List of user IDs (as strings with "user:" prefix) )rAr8get_users_for_role_in_domain)rUrCrjrlusersrrrget_users_for_roleQs rc Cjt}t|}|||||}|r3|td|d|d|d|td||||t|||S)z Add a permission for a role in a specific tenant Args: role: Role name tenant_id: Tenant ID resource: Resource name action: Action name Returns: True if successful u✅ Added permission: role=r_r`ragrant)rAr8 add_policyrr;r<rW_invalidate_role_permissionsrUrCrDrErjrlrrrradd_permission_for_roleis rc Cr)z Remove a permission from a role in a specific tenant Args: role: Role name tenant_id: Tenant ID resource: Resource name action: Action name Returns: True if successful u✅ Removed permission: role=r_r`rarevoke)rAr8 remove_policyrr;r<rWrrrrrremove_permission_for_roles rcCs t}t|}|d||}|S)z Get all permissions for a role in a specific tenant Args: role: Role name tenant_id: Tenant ID Returns: List of permissions (each permission is a list: [role, domain, resource, action]) r)rAr8get_filtered_policy)rUrCrjrl permissionsrrrget_permissions_for_rolesrcCt}|S)zN Save current policy to file Returns: True if successful )rA save_policyrjrrrrrcCr)zJ Reload policy from file Returns: True if successful )rArrrrrrrrc Csz+t}d|d|d}||}|r)|j|tdt|d|WdSWdStyF}ztd|WYd}~dSd}~ww)zs Invalidate cached permissions for a user Args: user_id: User ID tenant_id: Tenant ID r[r\z:*z Invalidated z cached permissions for user z(Failed to invalidate permissions cache: N)rkeysdeleter;r<lenrOrc)rBrCrhpatternrrRrrrrs   rc Csxz t||}|D]}|drt|dd}t||qWdSty;}ztd|WYd}~dSd}~ww)z Invalidate cached permissions for all users with a specific role Args: role: Role name tenant_id: Tenant ID r^r\z'Failed to invalidate role permissions: N)r startswithintr=rrOr;rc)rUrCr user_subjectrBrRrrrrs   rcCsJ|jdvrdS|jdkr|j|jkS|jdkr#|j|jkp"|j|jkSdS)zDCheck if user has permission to access a knowledge base (deprecated)rrrqTcustomer_admin customer_userF)rUrC created_byry)rkbrrrcan_access_knowledge_base s    rcCs>|jdvrdS|jdkr|j|jkS|jdkr|j|jkSdS)z>Check if user has permission to access a document (deprecated)rTrrF)rUrC)rdocrrrcan_access_documents     rcCsddlm}ddlm}|jdvrdd||jDS|jdkr7dd||j|j |j kDS|jd krWd d||j||j |jk|j |j kDSgS) z@Get list of knowledge base IDs that user can access (deprecated)r) KnowledgeBase)or_rcSg|]}|jqSrryrrrrrr%z2get_accessible_knowledge_bases..rcSrrrrrrrr'rrcSrrrrrrrr+r) app.models.knowledge_baser sqlalchemyrrUrwryallrxrCr)rrrrrrrget_accessible_knowledge_basess(        r)N)NNN)2__doc__rcasbin_sqlalchemy_adapterrtypingrr0loggingr app.configrapp.db.sessionr contextvarsr getLogger__name__r;r dict__annotations__r r7r rrrArr8r9rSrWrZrmrrlistrrrrrrrrrrrrrrrrrs       /    3 I    & $