Skip to content

Commit

Permalink
REST Server Role Auth [patch] (#74)
Browse files Browse the repository at this point in the history
  • Loading branch information
@ric-evans
ric-evans authored Sep 1, 2023
1 parent 086f48a commit fad6dd1
Show file tree
Hide file tree
Showing 2 changed files with 19 additions and 20 deletions.
3 changes: 1 addition & 2 deletions rest_server/config.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -30,8 +30,7 @@ class EnvConfig:

ENV = from_environment_as_dataclass(EnvConfig)


AUTH_PREFIX = "mou"
AUTH_SERVICE_ACCOUNT = "mou-service-account"

EXCLUDE_DBS = [
"system.indexes",
Expand Down
36 changes: 18 additions & 18 deletions rest_server/routes.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
from motor.motor_tornado import MotorClient # type: ignore
from rest_tools import server

from .config import AUTH_PREFIX, is_testing
from .config import AUTH_SERVICE_ACCOUNT, is_testing
from .data_sources import mou_db, table_config_cache, todays_institutions, wbs
from .utils import utils

Expand All @@ -24,9 +24,9 @@

if is_testing():

def scope_role_auth(**kwargs): # type: ignore
def make_wrapper(method): # type: ignore[no-untyped-def]
async def wrapper(self, *args, **kwargs): # type: ignore[no-untyped-def]
def keycloak_role_auth(**kwargs): # type: ignore
def make_wrapper(method):
async def wrapper(self, *args, **kwargs):
logging.warning("TESTING: auth disabled")
return await method(self, *args, **kwargs)

Expand All @@ -35,7 +35,7 @@ async def wrapper(self, *args, **kwargs): # type: ignore[no-untyped-def]
return make_wrapper

else:
scope_role_auth = server.scope_role_auth
keycloak_role_auth = server.keycloak_role_auth

# -----------------------------------------------------------------------------

Expand Down Expand Up @@ -122,7 +122,7 @@ async def _get_clientbound_snapshot_info(
"current_snapshot": dc.asdict(curr_snap_info),
}

@scope_role_auth(prefix=AUTH_PREFIX, roles=["read", "write", "admin"]) # type: ignore
@keycloak_role_auth(roles=[AUTH_SERVICE_ACCOUNT]) # type: ignore
async def get(self, wbs_l1: str) -> None:
"""Handle GET."""
is_admin = self.get_argument(
Expand Down Expand Up @@ -191,7 +191,7 @@ async def get(self, wbs_l1: str) -> None:

self.write(clientbound_snapshot_info | {"table": table})

@scope_role_auth(prefix=AUTH_PREFIX, roles=["admin"]) # type: ignore
@keycloak_role_auth(roles=[AUTH_SERVICE_ACCOUNT]) # type: ignore
async def post(self, wbs_l1: str) -> None:
"""Handle POST."""
base64_file = self.get_argument(
Expand Down Expand Up @@ -236,7 +236,7 @@ class RecordHandler(BaseMOUHandler): # pylint: disable=W0223

ROUTE = rf"/record/(?P<wbs_l1>{_WBS_L1_REGEX_VALUES})$"

@scope_role_auth(prefix=AUTH_PREFIX, roles=["write", "admin"]) # type: ignore
@keycloak_role_auth(roles=[AUTH_SERVICE_ACCOUNT]) # type: ignore
async def post(self, wbs_l1: str) -> None:
"""Handle POST."""
record: uut.DBRecord = self.get_argument(
Expand All @@ -258,7 +258,7 @@ async def post(self, wbs_l1: str) -> None:
resp["institution_values"] = dc.asdict(instvals)
self.write(resp)

@scope_role_auth(prefix=AUTH_PREFIX, roles=["write", "admin"]) # type: ignore
@keycloak_role_auth(roles=[AUTH_SERVICE_ACCOUNT]) # type: ignore
async def delete(self, wbs_l1: str) -> None:
"""Handle DELETE."""
record_id = self.get_argument(
Expand Down Expand Up @@ -288,7 +288,7 @@ class TableConfigHandler(BaseMOUHandler): # pylint: disable=W0223

ROUTE = r"/table/config$"

@scope_role_auth(prefix=AUTH_PREFIX, roles=["read", "write", "admin"]) # type: ignore
@keycloak_role_auth(roles=[AUTH_SERVICE_ACCOUNT]) # type: ignore
async def get(self) -> None:
"""Handle GET."""
await self.tc_cache.refresh()
Expand Down Expand Up @@ -329,7 +329,7 @@ class SnapshotsHandler(BaseMOUHandler): # pylint: disable=W0223

ROUTE = rf"/snapshots/list/(?P<wbs_l1>{_WBS_L1_REGEX_VALUES})$"

@scope_role_auth(prefix=AUTH_PREFIX, roles=["read", "write", "admin"]) # type: ignore
@keycloak_role_auth(roles=[AUTH_SERVICE_ACCOUNT]) # type: ignore
async def get(self, wbs_l1: str) -> None:
"""Handle GET."""
is_admin = self.get_argument(
Expand Down Expand Up @@ -358,7 +358,7 @@ class MakeSnapshotHandler(BaseMOUHandler): # pylint: disable=W0223

ROUTE = rf"/snapshots/make/(?P<wbs_l1>{_WBS_L1_REGEX_VALUES})$"

@scope_role_auth(prefix=AUTH_PREFIX, roles=["write", "admin"]) # type: ignore
@keycloak_role_auth(roles=[AUTH_SERVICE_ACCOUNT]) # type: ignore
async def post(self, wbs_l1: str) -> None:
"""Handle POST."""
name = self.get_argument(
Expand Down Expand Up @@ -389,14 +389,14 @@ class InstitutionValuesConfirmationTouchstoneHandler(

ROUTE = rf"/institution/values/confirmation/touchstone/(?P<wbs_l1>{_WBS_L1_REGEX_VALUES})$"

@scope_role_auth(prefix=AUTH_PREFIX, roles=["admin"]) # type: ignore
@keycloak_role_auth(roles=[AUTH_SERVICE_ACCOUNT]) # type: ignore
async def post(self, wbs_l1: str) -> None:
"""Handle POST."""
timestamp = await self.mou_db_client.retouchstone(wbs_l1)

self.write({"touchstone_timestamp": timestamp})

@scope_role_auth(prefix=AUTH_PREFIX, roles=["admin"]) # type: ignore
@keycloak_role_auth(roles=[AUTH_SERVICE_ACCOUNT]) # type: ignore
async def get(self, wbs_l1: str) -> None:
"""Handle POST."""
timestamp = await self.mou_db_client.get_touchstone(wbs_l1)
Expand All @@ -412,7 +412,7 @@ class InstitutionValuesConfirmationHandler(BaseMOUHandler): # pylint: disable=W

ROUTE = rf"/institution/values/confirmation/(?P<wbs_l1>{_WBS_L1_REGEX_VALUES})$"

@scope_role_auth(prefix=AUTH_PREFIX, roles=["write", "admin"]) # type: ignore
@keycloak_role_auth(roles=[AUTH_SERVICE_ACCOUNT]) # type: ignore
async def post(self, wbs_l1: str) -> None:
"""Handle POST."""
institution = self.get_argument(
Expand Down Expand Up @@ -451,7 +451,7 @@ class InstitutionValuesHandler(BaseMOUHandler): # pylint: disable=W0223

ROUTE = rf"/institution/values/(?P<wbs_l1>{_WBS_L1_REGEX_VALUES})$"

@scope_role_auth(prefix=AUTH_PREFIX, roles=["write", "admin"]) # type: ignore
@keycloak_role_auth(roles=[AUTH_SERVICE_ACCOUNT]) # type: ignore
async def get(self, wbs_l1: str) -> None:
"""Handle GET."""
institution = self.get_argument(
Expand All @@ -470,7 +470,7 @@ async def get(self, wbs_l1: str) -> None:

self.write(dc.asdict(vals))

@scope_role_auth(prefix=AUTH_PREFIX, roles=["write", "admin"]) # type: ignore
@keycloak_role_auth(roles=[AUTH_SERVICE_ACCOUNT]) # type: ignore
async def post(self, wbs_l1: str) -> None:
"""Handle POST."""
institution = self.get_argument(
Expand Down Expand Up @@ -538,7 +538,7 @@ class InstitutionStaticHandler(BaseMOUHandler): # pylint: disable=W0223

ROUTE = r"/institution/today$"

@scope_role_auth(prefix=AUTH_PREFIX, roles=["read", "write", "admin"]) # type: ignore
@keycloak_role_auth(roles=[AUTH_SERVICE_ACCOUNT]) # type: ignore
async def get(self) -> None:
"""Handle GET."""
institutions = await todays_institutions.request_krs_institutions()
Expand Down

0 comments on commit fad6dd1

Please sign in to comment.