Authorization Patterns

# rbac.py
from dataclasses import dataclass, field
from functools import wraps
from typing import Callable

@dataclass
class Permission:
    resource: str   # e.g., "post", "user", "report"
    action: str     # e.g., "read", "write", "delete", "admin"

    def __str__(self) -> str:
        return f"{self.resource}:{self.action}"

@dataclass
class Role:
    name: str
    permissions: set[str] = field(default_factory=set)  # Set of "resource:action"

    def has_permission(self, resource: str, action: str) -> bool:
        return f"{resource}:{action}" in self.permissions or f"{resource}:admin" in self.permissions

@dataclass
class User:
    user_id: int
    username: str
    roles: list[str] = field(default_factory=list)

# Define roles and permissions
ROLES: dict[str, Role] = {
    "viewer": Role("viewer", {"post:read", "report:read"}),
    "editor": Role("editor", {"post:read", "post:write", "report:read"}),
    "admin": Role("admin", {"post:admin", "user:admin", "report:admin"}),
}

def user_has_permission(user: User, resource: str, action: str) -> bool:
    """Check if any of the user's roles grant the requested permission."""
    return any(
        ROLES[role_name].has_permission(resource, action)
        for role_name in user.roles
        if role_name in ROLES
    )

# Decorator for enforcing RBAC in functions/routes
def require_permission(resource: str, action: str):
    def decorator(func: Callable) -> Callable:
        @wraps(func)
        def wrapper(user: User, *args, **kwargs):
            if not user_has_permission(user, resource, action):
                raise PermissionError(
                    f"User '{user.username}' lacks {resource}:{action}"
                )
            return func(user, *args, **kwargs)
        return wrapper
    return decorator

# Example routes
@require_permission("post", "write")
def create_post(user: User, title: str) -> str:
    return f"Post '{title}' created by {user.username}"

@require_permission("user", "admin")
def delete_user(user: User, target_id: int) -> str:
    return f"User {target_id} deleted by {user.username}"

# Test
alice = User(1, "alice", roles=["editor"])
bob = User(2, "bob", roles=["viewer"])
carol = User(3, "carol", roles=["admin"])

print(create_post(alice, "My Article"))   # ✅ editor has post:write

try:
    create_post(bob, "Hacking in")   # ❌ viewer has no post:write
except PermissionError as e:
    print(f"Denied: {e}")

print(delete_user(carol, target_id=99))   # ✅ admin has user:admin

# abac.py
from dataclasses import dataclass
from datetime import datetime, timezone

@dataclass
class UserAttrs:
    user_id: int
    department: str
    clearance_level: int   # 1-5
    is_contractor: bool

@dataclass
class ResourceAttrs:
    resource_id: str
    classification: str    # public, internal, confidential, secret
    owner_dept: str
    min_clearance: int

@dataclass
class EnvironmentAttrs:
    ip_address: str
    current_hour: int      # 0-23 (business hours check)

CLASSIFICATION_LEVEL = {"public": 1, "internal": 2, "confidential": 3, "secret": 4}

def can_access_document(
    user: UserAttrs,
    resource: ResourceAttrs,
    env: EnvironmentAttrs,
) -> tuple[bool, str]:
    """ABAC policy for document access."""
    # Rule 1: Minimum clearance level
    if user.clearance_level < resource.min_clearance:
        return False, f"Clearance {user.clearance_level} < required {resource.min_clearance}"

    # Rule 2: Contractors cannot access secret documents
    if user.is_contractor and resource.classification == "secret":
        return False, "Contractors may not access secret documents"

    # Rule 3: Business hours only for confidential/secret
    if resource.classification in ("confidential", "secret") and not (9 <= env.current_hour <= 17):
        return False, "Confidential documents only accessible during business hours"

    # Rule 4: Same department or admin
    if resource.owner_dept != "public" and resource.owner_dept != user.department:
        if user.clearance_level < 4:
            return False, f"Cross-department access requires clearance >= 4"

    return True, "Access granted"

# Test
doc = ResourceAttrs("doc-001", "confidential", "engineering", min_clearance=3)
env = EnvironmentAttrs("10.0.0.1", current_hour=14)   # 2pm = business hours

alice = UserAttrs(1, "engineering", clearance_level=4, is_contractor=False)
bob = UserAttrs(2, "marketing", clearance_level=2, is_contractor=True)
carol = UserAttrs(3, "finance", clearance_level=3, is_contractor=False)

for user in [alice, bob, carol]:
    allowed, reason = can_access_document(user, doc, env)
    status = "✅" if allowed else "❌"
    print(f"{status} User {user.user_id} ({user.department}): {reason}")