
    j	4                     N    d dl mZ d dlmZ d dlmZmZmZ  G d de          ZdS )    )partial)ManagementEnforcer)
join_slicearray_remove_duplicatesset_subtractc                       e Zd ZdZ	 d Zd Zd Zd Zd Zd Z	d Z
d	 Zd
 Zd Zd Zd Zd Zd Zd dZd!dZd!dZd Zd Zd Zd Zd Zd Zd Zd Zd Zd ZdS )"EnforcerzI
    Enforcer = ManagementEnforcer + RBAC_API + RBAC_WITH_DOMAIN_API
    c                 b    | j         j         d         d         j                            |          S )zgets the roles that a user has.gmodelrm	get_rolesselfnames     Y/lsinfo/ai/hellotax_ai/base_platform/venv/lib/python3.11/site-packages/casbin/enforcer.pyget_roles_for_userzEnforcer.get_roles_for_user#   (    z$S),66t<<<    c                 b    | j         j         d         d         j                            |          S )zgets the users that has a role.r   r   r   	get_usersr   s     r   get_users_for_rolezEnforcer.get_users_for_role'   r   r   c                 d    |                      |          }t          fd|D                       S )z%determines whether a user has a role.c              3   $   K   | ]
}|k    V  d S N ).0rroles     r   	<genexpr>z-Enforcer.has_role_for_user.<locals>.<genexpr>.   s'      ,,19,,,,,,r   )r   any)r   r   r!   roless     ` r   has_role_for_userzEnforcer.has_role_for_user+   s9    ''--,,,,e,,,,,,r   c                 .    |                      ||          S )zt
        adds a role for a user.
        Returns false if the user already has the role (aka not affected).
        add_grouping_policyr   userr!   s      r   add_role_for_userzEnforcer.add_role_for_user0   s    
 ''d333r   c                 .    |                      ||          S )zy
        deletes a role for a user.
        Returns false if the user does not have the role (aka not affected).
        )remove_grouping_policyr)   s      r   delete_role_for_userzEnforcer.delete_role_for_user7   s    
 **4666r   c                 .    |                      d|          S )z}
        deletes all roles for a user.
        Returns false if the user does not have any roles (aka not affected).
        r   remove_filtered_grouping_policyr   r*   s     r   delete_roles_for_userzEnforcer.delete_roles_for_user>   s    
 33At<<<r   c                 b    |                      d|          }|                     d|          }|p|S )zf
        deletes a user.
        Returns false if the user does not exist (aka not affected).
        r   r1   remove_filtered_policy)r   r*   res1res2s       r   delete_userzEnforcer.delete_userE   8    
 33At<<**1d33|tr   c                 b    |                      d|          }|                     d|          }|p|S )zf
        deletes a role.
        Returns false if the role does not exist (aka not affected).
           r   r5   )r   r!   r7   r8   s       r   delete_rolezEnforcer.delete_roleO   r:   r   c                      | j         dg|R  S )zr
        deletes a permission.
        Returns false if the permission does not exist (aka not affected).
        r<   r6   )r   
permissions     r   delete_permissionzEnforcer.delete_permissionY   s    
 +t*1:z::::r   c                 B    |                      t          |g|R            S )z
        adds a permission for a user or role.
        Returns false if the user or role already has the permission (aka not affected).
        )
add_policyr   r   r*   r@   s      r   add_permission_for_userz Enforcer.add_permission_for_user`   s&    
 z$<<<<===r   c                 B    |                      t          |g|R            S )z
        deletes a permission for a user or role.
        Returns false if the user or role does not have the permission (aka not affected).
        )remove_policyr   rD   s      r   delete_permission_for_userz#Enforcer.delete_permission_for_userg   s(    
 !!*T"?J"?"?"?@@@r   c                 .    |                      d|          S )z
        deletes permissions for a user or role.
        Returns false if the user or role does not have any permissions (aka not affected).
        r   r?   r2   s     r   delete_permissions_for_userz$Enforcer.delete_permissions_for_usern   s    
 **1d333r   c                 .    |                      d|          S )z6
        gets permissions for a user or role.
        r   )get_filtered_policyr2   s     r   get_permissions_for_userz!Enforcer.get_permissions_for_useru   s     ''4000r   c                 B    |                      t          |g|R            S )z=
        determines whether a user has a permission.
        )
has_policyr   rD   s      r   has_permission_for_userz Enforcer.has_permission_for_user{   s&     z$<<<<===r    c                    g }|g}|r||                     d          }| j                                        D ]K}|                    ||          }|D ]0}||vr*|                    |           |                    |           1L|||S )a  
        gets implicit roles that a user has.
        Compared to get_roles_for_user(), this function retrieves indirect roles besides direct roles.
        For example:
        g, alice, role:admin
        g, role:admin, role:user

        get_roles_for_user("alice") can only get: ["role:admin"].
        But get_implicit_roles_for_user("alice") will get: ["role:admin", "role:user"].
        r   )poprm_mapvaluesr   append)r   r   domainresqueuer   r$   r    s           r   get_implicit_roles_for_userz$Enforcer.get_implicit_roles_for_user   s      	(99Q<<Dk((** ( (T622 ( (A||

1Q(  	( 
r   Tc                 2    |                      d|||          S )a7  
        gets implicit permissions for a user or role.
        Compared to get_permissions_for_user(), this function retrieves permissions for inherited roles.
        For example:
        p, admin, data1, read
        p, alice, data2, read
        g, alice, admin

        get_permissions_for_user("alice") can only get: [["alice", "data2", "read"]].
        But get_implicit_permissions_for_user("alice") will get: [["admin", "data1", "read"], ["alice", "data2", "read"]].

        For given domain policies are filtered by corresponding domain matching function of DomainManager
        Inherited roles can be matched by domain. For domain neutral policies set:
         filter_policy_dom = False

        filter_policy_dom: bool - For given *domain*, policies will be filtered by domain as well. Default = True
        p)'get_named_implicit_permissions_for_user)r   r*   rW   filter_policy_doms       r   !get_implicit_permissions_for_userz*Enforcer.get_implicit_permissions_for_user   s    $ ;;CvO`aaar   c                 .   |                      ||          }|                    d|           g }|                                 j        }|r|dk    rt	          ||          }|D ]2}|                     |||r|nd          }	|                    |	           3|S )aG  
        gets implicit permissions for a user or role by named policy.
        Compared to get_permissions_for_user(), this function retrieves permissions for inherited roles.
        For example:
        p, admin, data1, read
        p, alice, data2, read
        g, alice, admin

        get_permissions_for_user("alice") can only get: [["alice", "data2", "read"]].
        But get_implicit_permissions_for_user("alice") will get: [["admin", "data1", "read"], ["alice", "data2", "read"]].

        For given domain policies are filtered by corresponding domain matching function of DomainManager
        Inherited roles can be matched by domain. For domain neutral policies set:
         filter_policy_dom = False

        filter_policy_dom: bool - For given *domain*, policies will be filtered by domain as well. Default = True
        r   NrQ   )rZ   insertget_role_managerdomain_matching_funcr   (get_named_permissions_for_user_in_domainextend)
r   ptyper*   rW   r^   r$   rX   rc   r!   permissionss
             r   r]   z0Enforcer.get_named_implicit_permissions_for_user   s    $ 00v>>Q  $4466K 	;*d2216::F 	$ 	$DGGt'8@VVb K JJ{####
r   c                 d   |                                  }| j                            ddd          }| j                            ddd          }t          ||z             }t	                      }t          ||          }|D ]0}t          |g|R  } | j        | }	|	r|                    |           1|S )aJ  
        gets implicit users for a permission.
        For example:
        p, admin, data1, read
        p, bob, data1, read
        g, alice, admin

        get_implicit_users_for_permission("data1", "read") will get: ["alice", "bob"].
        Note: only users will be returned, roles (2nd arg in "g") will be excluded.
        r   r<   r   )	get_all_subjectsr   get_values_for_field_in_policyr   listr   r   enforcerV   )
r   r@   
p_subjects	g_inherit
g_subjectssubjectsrX   r*   reqalloweds
             r   !get_implicit_users_for_permissionz*Enforcer.get_implicit_users_for_permission   s     **,,
J==c3JJ	Z>>sCKK
*:
+BCCff)44 	! 	!DT/J///C"dlC(G !

4   
r   c                 d    | j         j         d         d         j                            ||          S )z/gets the roles that a user has inside a domain.r   r   r   r   rW   s      r   get_roles_for_user_in_domainz%Enforcer.get_roles_for_user_in_domain   *    z$S),66tVDDDr   c                 d    | j         j         d         d         j                            ||          S )z/gets the users that has a role inside a domain.r   r   ru   s      r   get_users_for_role_in_domainz%Enforcer.get_users_for_role_in_domain   rw   r   c                 2    	 |                      |||          S )z'adds a role for a user inside a domain.r'   r   r*   r!   rW   s       r   add_role_for_user_in_domainz$Enforcer.add_role_for_user_in_domain   s    P''dF;;;r   c                 4    	 |                      d|||          S )z*deletes a role for a user inside a domain.r   r0   r{   s       r   delete_roles_for_user_in_domainz(Enforcer.delete_roles_for_user_in_domain   s    S33AtT6JJJr   c                 0    |                      d||          S )z2gets permissions for a user or role inside domain.r\   )rd   )r   r*   rW   s      r   "get_permissions_for_user_in_domainz+Enforcer.get_permissions_for_user_in_domain  s    <<S$OOOr   c                 2    |                      |d||          S )zDgets permissions for a user or role with named policy inside domain.r   )get_filtered_named_policy)r   rf   r*   rW   s       r   rd   z1Enforcer.get_named_permissions_for_user_in_domain  s    --eQfEEEr   c                    | j         j         d         d         }|j        }t                      }|D ]O}|t          |          dz
           |k    r1|t          |          dz
           }||vr|                    |           Pt          |          S )zgets all roles associated with the domain.
        note: Not applicable to Domains with inheritance relationship  (implicit roles)r   r<      )r   policysetlenaddrk   )r   rW   r   policiesr$   r   r!   s          r   get_all_roles_by_domainz Enforcer.get_all_roles_by_domain
  s     JS!#&8 	$ 	$Fc&kkAo&&00c&kkAo.u$$IIdOOOE{{r   c                 (   t                      }|                     dd          }|                     dd          }|                                 }|                                 }|                                 D ]r}||         |k    rd||         }||vrd|t          |          <   -|                    |          }	|	D ]-}
|                                }|
||<   d|t          |          <   .sd d |                                D             D             }|S )a  gets implicit user based on resource.
        for example:
            p, alice, data1, read
            p, bob, data2, write
            p, data2_admin, data2, read
            p, data2_admin, data2, write
            g, alice, data2_admin
        get_implicit_users_for_resource("data2") will return [[bob data2 write] [alice data2 read] [alice data2 write]]
        get_implicit_users_for_resource("data1") will return [[alice data1 read]]
        Note: only users will be returned, roles (2nd arg in "g") will be excluded.r\   subobjTc                 ,    g | ]}t          |          S r   rk   r   ts     r   
<listcomp>z<Enforcer.get_implicit_users_for_resource.<locals>.<listcomp>5      RRR1tAwwRRRr   c              3   4   K   | ]}t          |          V  d S r   r   r   keys     r   r"   z;Enforcer.get_implicit_users_for_resource.<locals>.<genexpr>5  (      (Q(Qsc(Q(Q(Q(Q(Q(Qr   )	dictget_field_indexrb   get_all_roles
get_policytupler   copykeys)r   resourcerg   subject_indexobject_indexr   r$   ruler   usersr*   implicit_rules               r   get_implicit_users_for_resourcez(Enforcer.get_implicit_users_for_resource  s/    ff,,S%88++C77""$$""$$OO%% 
	A 
	ADL!X--=)e##/3Kd,,LL--E % A A(,		7;m4<@E-$8$899RR(Q(Qk>N>N>P>P(Q(Q(QRRRr   c                 r   t                      }|                     dd          }|                     dd          }|                     dd          }|                                 }|                     |          }|                                 D ]}	|	|         |k    rr|	|         }
|
|vrd|t          |	          <   -||	|         k    r:|                    |
|          }|D ]-}|	                                }|||<   d|t          |          <   .d d |                                D             D             }|S )ztget implicit user based on resource and domain.
        Compared to GetImplicitUsersForResource, domain is supportedr\   r   r   domTc                 ,    g | ]}t          |          S r   r   r   s     r   r   zFEnforcer.get_implicit_users_for_resource_by_domain.<locals>.<listcomp>P  r   r   c              3   4   K   | ]}t          |          V  d S r   r   r   s     r   r"   zEEnforcer.get_implicit_users_for_resource_by_domain.<locals>.<genexpr>P  r   r   )	r   r   rb   r   r   r   r   r   r   )r   r   rW   rg   r   r   	dom_indexr   r$   r   r   r   r*   r   s                 r   )get_implicit_users_for_resource_by_domainz2Enforcer.get_implicit_users_for_resource_by_domain8  sZ    ff,,S%88++C77((e44	""$$,,V44OO%% 	A 	ADL!X--=)e##/3Kd,,i00 LLf55E % A A(,		7;m4<@E-$8$899RR(Q(Qk>N>N>P>P(Q(Q(QRRRr   N)rQ   )rQ   T)__name__
__module____qualname____doc__r   r   r%   r+   r.   r3   r9   r=   rA   rE   rH   rJ   rM   rP   rZ   r_   r]   rs   rv   ry   r|   r~   r   rd   r   r   r   r   r   r   r	   r	      s        = = == = =- - -
4 4 47 7 7= = =    ; ; ;> > >A A A4 4 41 1 1> > >   4b b b b(# # # #J  8E E EE E E< < <
K K K
P P PF F F    @    r   r	   N)		functoolsr   casbin.management_enforcerr   casbin.utilr   r   r   r	   r   r   r   <module>r      s          9 9 9 9 9 9 I I I I I I I I I I| | | | |! | | | | |r   