Lars
910b1d7e07
Some checks failed
Deploy Development / deploy (push) Successful in 33s
Test Suite / pytest-backend (push) Failing after 4s
Test Suite / k6 /api/health Baseline (push) Has been skipped
Test Suite / playwright-smoke (push) Has been skipped
Test Suite / lint-backend (push) Successful in 1s
Test Suite / compose-smoke (push) Has been skipped
Co-authored-by: Cursor <cursoragent@cursor.com>
125 lines
4.2 KiB
Python
125 lines
4.2 KiB
Python
"""In-memory capability registry with startup sync to PostgreSQL."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from dataclasses import dataclass
|
|
|
|
from db import get_connection
|
|
|
|
RoleGrant = tuple[str, str] # (role_scope, role_code)
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class CapabilityRegistration:
|
|
key: str
|
|
module: str
|
|
description: str
|
|
default_grants: tuple[RoleGrant, ...] = ()
|
|
|
|
|
|
_REGISTRY: dict[str, CapabilityRegistration] = {}
|
|
|
|
|
|
def register_capability(registration: CapabilityRegistration) -> None:
|
|
if not registration.key or not registration.key.strip():
|
|
raise ValueError("Capability key is required")
|
|
if not registration.module or not registration.module.strip():
|
|
raise ValueError("Capability module is required")
|
|
if not registration.description or not registration.description.strip():
|
|
raise ValueError("Capability description is required")
|
|
if registration.key in _REGISTRY:
|
|
raise ValueError(f"Capability already registered: {registration.key}")
|
|
_REGISTRY[registration.key] = registration
|
|
|
|
|
|
def get_registered_capabilities() -> tuple[CapabilityRegistration, ...]:
|
|
return tuple(_REGISTRY.values())
|
|
|
|
|
|
def clear_registry_for_tests() -> None:
|
|
"""Test helper — reset in-memory registry."""
|
|
_REGISTRY.clear()
|
|
|
|
|
|
def sync_rights_registry_to_db() -> int:
|
|
"""Upsert capabilities and ensure default grants from registry."""
|
|
if not _REGISTRY:
|
|
print("[rights_registry] Keine Capabilities registriert — Sync übersprungen")
|
|
return 0
|
|
|
|
conn = get_connection()
|
|
try:
|
|
with conn.cursor() as cur:
|
|
for reg in _REGISTRY.values():
|
|
cur.execute(
|
|
"""
|
|
INSERT INTO capabilities (capability_key, module, description, is_active)
|
|
VALUES (%s, %s, %s, TRUE)
|
|
ON CONFLICT (capability_key) DO UPDATE SET
|
|
module = EXCLUDED.module,
|
|
description = EXCLUDED.description,
|
|
is_active = TRUE,
|
|
updated_at = NOW()
|
|
""",
|
|
(reg.key, reg.module, reg.description),
|
|
)
|
|
for role_scope, role_code in reg.default_grants:
|
|
cur.execute(
|
|
"""
|
|
INSERT INTO role_capability_grants (role_scope, role_code, capability_key)
|
|
VALUES (%s, %s, %s)
|
|
ON CONFLICT (role_scope, role_code, capability_key) DO NOTHING
|
|
""",
|
|
(role_scope, role_code, reg.key),
|
|
)
|
|
conn.commit()
|
|
print(f"[rights_registry] Sync OK — {len(_REGISTRY)} Capability(s)")
|
|
return 0
|
|
except Exception as exc:
|
|
conn.rollback()
|
|
print(f"[rights_registry] Sync FAIL: {exc}")
|
|
return 1
|
|
finally:
|
|
conn.close()
|
|
|
|
|
|
def load_grants_for_roles(
|
|
*,
|
|
portal_role: str,
|
|
tenant_role: str | None,
|
|
) -> set[str]:
|
|
"""Resolve capability keys granted by portal and optional tenant role."""
|
|
conn = get_connection()
|
|
try:
|
|
keys: set[str] = set()
|
|
with conn.cursor() as cur:
|
|
cur.execute(
|
|
"""
|
|
SELECT c.capability_key
|
|
FROM role_capability_grants g
|
|
JOIN capabilities c ON c.capability_key = g.capability_key
|
|
WHERE g.role_scope = 'portal'
|
|
AND g.role_code = %s
|
|
AND c.is_active = TRUE
|
|
""",
|
|
(portal_role,),
|
|
)
|
|
keys.update(row[0] for row in cur.fetchall())
|
|
|
|
if tenant_role:
|
|
cur.execute(
|
|
"""
|
|
SELECT c.capability_key
|
|
FROM role_capability_grants g
|
|
JOIN capabilities c ON c.capability_key = g.capability_key
|
|
WHERE g.role_scope = 'tenant'
|
|
AND g.role_code = %s
|
|
AND c.is_active = TRUE
|
|
""",
|
|
(tenant_role,),
|
|
)
|
|
keys.update(row[0] for row in cur.fetchall())
|
|
return keys
|
|
finally:
|
|
conn.close()
|