feat(auth): permission-resource compat helper fns

.gitignore

@@ -10,5 +10,6 @@ build
 dist
 htmlcov
 env
+bento_lib/search/elastic.py
 __pycache__
 *.egg-info

bento_lib/auth/helpers.py

@@ -0,0 +1,20 @@
+from .permissions import Permission, LEVEL_PROJECT, LEVEL_DATASET, PERMISSIONS
+
+__all__ = [
+    "permission_valid_for_resource",
+    "valid_permissions_for_resource",
+]
+
+
+def permission_valid_for_resource(permission: Permission, resource: dict) -> bool:
+    if permission.min_level_required == LEVEL_DATASET:
+        return True
+    elif permission.min_level_required == LEVEL_PROJECT:
+        return "dataset" not in resource
+    else:  # LEVEL_INSTANCE
+        return "dataset" not in resource and "project" not in resource and resource.get("everything", False)
+        # otherwise, invalid resource (so False)
+
+
+def valid_permissions_for_resource(resource: dict) -> list[Permission]:
+    return [p for p in PERMISSIONS if permission_valid_for_resource(p, resource)]

bento_lib/auth/permissions.py

@@ -76,6 +76,10 @@ def __repr__(self):
     def gives(self) -> frozenset["Permission"]:
         return self._gives
 
+    @property
+    def min_level_required(self) -> Level:
+        return self._min_level_required
+
 
 # Verb/noun definitions ---------------------------------------------------------------------------
 

bento_lib/package.cfg

@@ -1,5 +1,5 @@
 [package]
 name = bento_lib
-version = 11.3.0
+version = 11.4.0
 authors = David Lougheed, Paul Pillot
 author_emails = [email protected], [email protected]

requirements.txt

@@ -25,7 +25,7 @@ Django==4.2.7
 djangorestframework==3.14.0
 entrypoints==0.4
 exceptiongroup==1.2.0
-fastapi==0.108.0
+fastapi==0.109.0
 filelock==3.13.1
 flake8==6.1.0
 Flask==3.0.0
@@ -82,7 +82,7 @@ rpds-py==0.13.2
 six==1.16.0
 sniffio==1.3.0
 sqlparse==0.4.4
-starlette==0.32.0.post1
+starlette==0.35.1
 taskgroup==0.0.0a4
 toml==0.10.2
 tomli==2.0.1

tests/test_auth.py

@@ -1,15 +1,19 @@
 import json
 
 import pytest
+from bento_lib.auth.helpers import permission_valid_for_resource, valid_permissions_for_resource
 from bento_lib.auth.permissions import (
     Permission,
     PermissionDefinitionError,
+    PERMISSIONS,
+    LEVEL_INSTANCE,
     QUERY_VERB,
     DATA,
     P_QUERY_PROJECT_LEVEL_BOOLEAN,
     P_QUERY_PROJECT_LEVEL_COUNTS,
     P_QUERY_DATA,
     P_DELETE_DATA,
+    P_VIEW_DROP_BOX,
 )
 from bento_lib.auth.resources import RESOURCE_EVERYTHING, build_resource
 
@@ -53,3 +57,25 @@ def test_build_resource():
         {"dataset": "z", "project": "a"}, sort_keys=True)
     assert json.dumps(build_resource(project="a", dataset="z", data_type="t"), sort_keys=True) == json.dumps(
         {"data_type": "t", "dataset": "z", "project": "a"}, sort_keys=True)
+
+
+def test_permissions_valid_for_resource():
+    assert permission_valid_for_resource(P_QUERY_DATA, RESOURCE_EVERYTHING)
+    assert permission_valid_for_resource(P_QUERY_DATA, {"project": "aaa"})
+    assert permission_valid_for_resource(P_QUERY_DATA, {"project": "aaa", "dataset": "bbb"})
+
+    # project and above
+    assert permission_valid_for_resource(P_QUERY_PROJECT_LEVEL_BOOLEAN, RESOURCE_EVERYTHING)
+    assert permission_valid_for_resource(P_QUERY_PROJECT_LEVEL_BOOLEAN, {"project": "aaa"})
+    assert not permission_valid_for_resource(P_QUERY_PROJECT_LEVEL_BOOLEAN, {"project": "aaa", "dataset": "bbb"})
+
+    # instance only
+    assert permission_valid_for_resource(P_VIEW_DROP_BOX, RESOURCE_EVERYTHING)
+    assert not permission_valid_for_resource(P_VIEW_DROP_BOX, {"project": "aaa"})
+    assert not permission_valid_for_resource(P_VIEW_DROP_BOX, {"project": "aaa", "dataset": "bbb"})
+
+
+def test_all_valid_permissions_for_resource():
+    assert valid_permissions_for_resource(RESOURCE_EVERYTHING) == PERMISSIONS
+    assert valid_permissions_for_resource({"project": "aaa"}) == [
+        p for p in PERMISSIONS if p.min_level_required != LEVEL_INSTANCE]