6274136987

Committed 22 Sep 2023 12:17PM UTC coverage: 65.383% (+1.3%) from 64.095%

Build # 6274136987

Build Type

push

github

Committed by

web-flow

Commit Message

Upgrade Flask ecosystem dependencies (#838)

* feat (dependencies): update dependencies previously blocked by Flask-Classful

Signed-off-by: F.N. Claessen <felix@seita.nl>

* feat: fix integration of rq-dashboard within Flask app

Signed-off-by: F.N. Claessen <felix@seita.nl>

* chore: update app.txt for Python 3.9

Signed-off-by: F.N. Claessen <felix@seita.nl>

* chore: update requirements for Python 3.9

Signed-off-by: F.N. Claessen <felix@seita.nl>

* fix (test): task lastrun

Signed-off-by: F.N. Claessen <felix@seita.nl>

* Revert "feat (dependencies): update dependencies previously blocked by Flask-Classful"

This reverts commit 8b5670327.

* chore: include Flask patch update in pin, and update requirements for Python 3.9

Signed-off-by: F.N. Claessen <felix@seita.nl>

* chore: so far so good

Signed-off-by: F.N. Claessen <felix@seita.nl>

* chore: upgrade Flask-Login and fix API tests

Signed-off-by: F.N. Claessen <felix@seita.nl>

* chore: upgrade deps for Python 3.9 again

Signed-off-by: F.N. Claessen <felix@seita.nl>

* style: flake8

Signed-off-by: F.N. Claessen <felix@seita.nl>

* chore: clean up pins and inline documentation

Signed-off-by: F.N. Claessen <felix@seita.nl>

* chore: clean up another pin, and update Flask-Marshmallow

Signed-off-by: F.N. Claessen <felix@seita.nl>

* fix: updated rq-dashboard uses different underscore.js

Signed-off-by: F.N. Claessen <felix@seita.nl>

* fix (UI): missing space

Signed-off-by: F.N. Claessen <felix@seita.nl>

* chore (deps): move pin to point to original repo

Signed-off-by: F.N. Claessen <felix@seita.nl>

* chore: upgrade deps

Signed-off-by: F.N. Claessen <felix@seita.nl>

* fix: favicon 500 error

Signed-off-by: F.N. Claessen <felix@seita.nl>

* chore: upgrade deps, incl. Flask-Classful release

Signed-off-by: F.N. Claessen <felix@seita.nl>

* docs: changelog entry

Signed-off-by: F.N.... (continued)

Run Details

3560 of 6089 branches covered (0.0%)

Branch coverage included in aggregate %.

30 of 30 new or added lines in 9 files covered. (100.0%)

6390 of 9129 relevant lines covered (70.0%)

2.8 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

87.18

/flexmeasures/auth/policy.py

"""
Tooling & docs for implementing our auth policy
"""

from __future__ import annotations

# Use | instead of Union, list instead of List and tuple instead of Tuple when FM stops supporting Python 3.9 (because of https://github.com/python/cpython/issues/86399)
from typing import List, Tuple, Union

from flask import current_app
from flask_security import current_user
from werkzeug.exceptions import Unauthorized, Forbidden


PERMISSIONS = ["create-children", "read", "read-children", "update", "delete"]

ADMIN_ROLE = "admin"
ADMIN_READER_ROLE = "admin-reader"

# constants to allow access to certain groups
EVERY_LOGGED_IN_USER = "every-logged-in-user"

PRINCIPALS_TYPE = Union[str, Tuple[str], List[Union[str, Tuple[str]]]]


class AuthModelMixin(object):
    def __acl__(self) -> dict[str, PRINCIPALS_TYPE]:
        """
        This function returns an access control list (ACL) for an instance of a model which is relevant for authorization.

        ACLs in FlexMeasures are inspired by Pyramid's resource ACLs.
        In an ACL, we list which principal (security contexts, see below) allow certain kinds of actions
        ― by mapping supported permissions to the required principals.

        # What is a principal / security context?

        In computer security, a "principal" is the security context of the authenticated user [1].
        For example, within FlexMeasures, an accepted principal is "user:2", which denotes that the user should have ID 2
        (more technical specifications follow below).

        # Example

        Here are some examples of principals mapped to permissions in a fictional ACL:

        {
            "create-children": "account:3",      # Everyone in Account 3 can create child items (e.g. beliefs for a sensor)
            "read": EVERYONE,                    # Reading is available to every logged-in user
            "update": ["user:14",                # This user can update, ...
                        user:15"],               # and also this user, ...
            "update": "account-role:MDC",        # also people in such accounts can update
            "delete": ("account:3", "role:CEO"), # Only CEOs of Account 3 can delete
        }

        Such a list of principals can be checked with match_principals, see below.

        # Specifications of principals

        Within FlexMeasures, a principal is handled as a string, usually defining context and identification, like so:

            <context>:<identification>.

        Supported contexts are user and account IDs, as well as user and account roles. All of them feature in the example above.

        Iterable principal descriptors should be treated as follows:
        - a list contains OR-connected items, which can be principal or tuples of principals (one of the items in the list is sufficient to grant the permission)
        - a tuple contains AND-connected strings (you need all of the items in the list to grant the permission).

        # Row-level authorization

        This ACL approach to authorization is usually called "row-level authorization" ― it always requires an instance, from which to get the ACL.
        Unlike pyramid, we have not implemented table-level authorization, where a class also can provide an ACL.
        This works because we make use of the hierarchy in our model.
        The highest level (e.g. an account) is created by site-admins and usually not in the API, but CLI. For everything else, we can ask the ACL
        on an instance, if we can handle it like we intend to. For creation of instances (where there is no instance to ask), it makes sense to use the instance one level up to look up the correct permission ("create-children"). E.g. to create belief data for a sensor, we can check the "create-children" - permission on the sensor.

        [1] https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/security-principals#a-href-idw2k3tr-princ-whatawhat-are-security-principals
        """
        return {}


def check_access(context: AuthModelMixin, permission: str):
    """
    Check if current user can access this auth context if this permission
    is required, either with admin rights or principal(s).

    Raises 401 or 403 otherwise.
    """
    # check permission and current user before taking context into account
    if permission not in PERMISSIONS:
        raise Forbidden(f"Permission '{permission}' cannot be handled.")
    if current_user.is_anonymous:
        raise Unauthorized()

    # check context
    if context is None:
        raise Forbidden(
            f"Context needs {permission}-permission, but no context was passed."
        )
    if not isinstance(context, AuthModelMixin):
        raise Forbidden(
            f"Context {context} needs {permission}-permission, but is no AuthModelMixin."
        )

    # look up principals
    acl = context.__acl__()
    principals: PRINCIPALS_TYPE = acl.get(permission, [])
    current_app.logger.debug(
        f"Looking for {permission}-permission on {context} ... Principals: {principals}"
    )

    # check access
    if not user_has_admin_access(
        current_user, permission
    ) and not user_matches_principals(current_user, principals):
        raise Forbidden(
            f"Authorization failure (accessing {context} to {permission}) ― cannot match {current_user} against {principals}!"
        )


def user_has_admin_access(user, permission: str) -> bool:
    if user.has_role(ADMIN_ROLE) or (
        user.has_role(ADMIN_READER_ROLE) and permission == "read"
    ):
        return True
    return False


def user_matches_principals(user, principals: PRINCIPALS_TYPE) -> bool:
    """
    Tests if the user matches all passed principals.
    Returns False if no principals are passed.
    """
    if not isinstance(principals, list):
        principals = [principals]  # now we handle a list of str or Tuple[str]
    for matchable_principals in principals:
        if isinstance(matchable_principals, str):
            matchable_principals = (
                matchable_principals,
            )  # now we handle only Tuple[str]
        if EVERY_LOGGED_IN_USER in matchable_principals:
            return True
        if user is not None and all(
            [
                (
                    check_user_identity(user, principal)
                    or check_user_role(user, principal)
                    or check_account_membership(user, principal)
                    or check_account_role(user, principal)
                )
                for principal in matchable_principals
            ]
        ):
            return True
    return False


def check_user_identity(user, principal: str) -> bool:
    if principal.startswith("user:"):
        user_id = principal.split("user:")[1]
        if not user_id.isdigit():
            current_app.logger.warning(
                f"Cannot match principal for user ID {user_id} ― no digit."
            )
        elif user.id == int(user_id):
            return True
    return False


def check_user_role(user, principal: str) -> bool:
    if principal.startswith("role:"):
        user_role = principal.split("role:")[1]
        if user.has_role(user_role):
            return True
    return False


def check_account_membership(user, principal: str) -> bool:
    if principal.startswith("account:"):
        account_id = principal.split("account:")[1]
        if not account_id.isdigit():
            current_app.logger.warning(
                f"Cannot match principal for account ID {account_id} ― no digit."
            )
        elif user.account.id == int(account_id):
            return True
    return False


def check_account_role(user, principal: str) -> bool:
    if principal.startswith("account-role:"):
        account_role = principal.split("account-role:")[1]
        if user.account.has_role(account_role):
            return True
    return False

1	"""	4✔
2	Tooling & docs for implementing our auth policy
3	"""
4
5	from __future__ import annotations	4✔
6
7	# Use \| instead of Union, list instead of List and tuple instead of Tuple when FM stops supporting Python 3.9 (because of https://github.com/python/cpython/issues/86399)
8	from typing import List, Tuple, Union	4✔
9
10	from flask import current_app	4✔
11	from flask_security import current_user	4✔
12	from werkzeug.exceptions import Unauthorized, Forbidden	4✔
13
14
15	PERMISSIONS = ["create-children", "read", "read-children", "update", "delete"]	4✔
16
17	ADMIN_ROLE = "admin"	4✔
18	ADMIN_READER_ROLE = "admin-reader"	4✔
19
20	# constants to allow access to certain groups
21	EVERY_LOGGED_IN_USER = "every-logged-in-user"	4✔
22
23	PRINCIPALS_TYPE = Union[str, Tuple[str], List[Union[str, Tuple[str]]]]	4✔
24
25
26	class AuthModelMixin(object):	4✔
27	def __acl__(self) -> dict[str, PRINCIPALS_TYPE]:	4✔
28	"""
29	This function returns an access control list (ACL) for an instance of a model which is relevant for authorization.
30
31	ACLs in FlexMeasures are inspired by Pyramid's resource ACLs.
32	In an ACL, we list which principal (security contexts, see below) allow certain kinds of actions
33	― by mapping supported permissions to the required principals.
34
35	# What is a principal / security context?
36
37	In computer security, a "principal" is the security context of the authenticated user [1].
38	For example, within FlexMeasures, an accepted principal is "user:2", which denotes that the user should have ID 2
39	(more technical specifications follow below).
40
41	# Example
42
43	Here are some examples of principals mapped to permissions in a fictional ACL:
44
45	{
46	"create-children": "account:3", # Everyone in Account 3 can create child items (e.g. beliefs for a sensor)
47	"read": EVERYONE, # Reading is available to every logged-in user
48	"update": ["user:14", # This user can update, ...
49	user:15"], # and also this user, ...
50	"update": "account-role:MDC", # also people in such accounts can update
51	"delete": ("account:3", "role:CEO"), # Only CEOs of Account 3 can delete
52	}
53
54	Such a list of principals can be checked with match_principals, see below.
55
56	# Specifications of principals
57
58	Within FlexMeasures, a principal is handled as a string, usually defining context and identification, like so:
59
60	<context>:<identification>.
61
62	Supported contexts are user and account IDs, as well as user and account roles. All of them feature in the example above.
63
64	Iterable principal descriptors should be treated as follows:
65	- a list contains OR-connected items, which can be principal or tuples of principals (one of the items in the list is sufficient to grant the permission)
66	- a tuple contains AND-connected strings (you need all of the items in the list to grant the permission).
67
68	# Row-level authorization
69
70	This ACL approach to authorization is usually called "row-level authorization" ― it always requires an instance, from which to get the ACL.
71	Unlike pyramid, we have not implemented table-level authorization, where a class also can provide an ACL.
72	This works because we make use of the hierarchy in our model.
73	The highest level (e.g. an account) is created by site-admins and usually not in the API, but CLI. For everything else, we can ask the ACL
74	on an instance, if we can handle it like we intend to. For creation of instances (where there is no instance to ask), it makes sense to use the instance one level up to look up the correct permission ("create-children"). E.g. to create belief data for a sensor, we can check the "create-children" - permission on the sensor.
75
76	[1] https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/security-principals#a-href-idw2k3tr-princ-whatawhat-are-security-principals
77	"""
78	return {}	×
79
80
81	def check_access(context: AuthModelMixin, permission: str):	4✔
82	"""
83	Check if current user can access this auth context if this permission
84	is required, either with admin rights or principal(s).
85
86	Raises 401 or 403 otherwise.
87	"""
88	# check permission and current user before taking context into account
89	if permission not in PERMISSIONS:	4✔
90	raise Forbidden(f"Permission '{permission}' cannot be handled.")	×
91	if current_user.is_anonymous:	4✔
92	raise Unauthorized()	×
93
94	# check context
95	if context is None:	4✔
96	raise Forbidden(	×
97	f"Context needs {permission}-permission, but no context was passed."
98	)
99	if not isinstance(context, AuthModelMixin):	4✔
100	raise Forbidden(	×
101	f"Context {context} needs {permission}-permission, but is no AuthModelMixin."
102	)
103
104	# look up principals
105	acl = context.__acl__()	4✔
106	principals: PRINCIPALS_TYPE = acl.get(permission, [])	4✔
107	current_app.logger.debug(	4✔
108	f"Looking for {permission}-permission on {context} ... Principals: {principals}"
109	)
110
111	# check access
112	if not user_has_admin_access(	4✔
113	current_user, permission
114	) and not user_matches_principals(current_user, principals):
115	raise Forbidden(	4✔
116	f"Authorization failure (accessing {context} to {permission}) ― cannot match {current_user} against {principals}!"
117	)
118
119
120	def user_has_admin_access(user, permission: str) -> bool:	4✔
121	if user.has_role(ADMIN_ROLE) or (	4✔
122	user.has_role(ADMIN_READER_ROLE) and permission == "read"
123	):
124	return True	4✔
125	return False	4✔
126
127
128	def user_matches_principals(user, principals: PRINCIPALS_TYPE) -> bool:	4✔
129	"""
130	Tests if the user matches all passed principals.
131	Returns False if no principals are passed.
132	"""
133	if not isinstance(principals, list):	4✔
134	principals = [principals] # now we handle a list of str or Tuple[str]	4✔
135	for matchable_principals in principals:	4✔
136	if isinstance(matchable_principals, str):	4✔
137	matchable_principals = (	4✔
138	matchable_principals,
139	) # now we handle only Tuple[str]
140	if EVERY_LOGGED_IN_USER in matchable_principals:	4✔
141	return True	×
142	if user is not None and all(	4✔
143	[
144	(
145	check_user_identity(user, principal)
146	or check_user_role(user, principal)
147	or check_account_membership(user, principal)
148	or check_account_role(user, principal)
149	)
150	for principal in matchable_principals
151	]
152	):
153	return True	4✔
154	return False	4✔
155
156
157	def check_user_identity(user, principal: str) -> bool:	4✔
158	if principal.startswith("user:"):	4✔
159	user_id = principal.split("user:")[1]	4✔
160	if not user_id.isdigit():	4✔
161	current_app.logger.warning(	×
162	f"Cannot match principal for user ID {user_id} ― no digit."
163	)
164	elif user.id == int(user_id):	4✔
165	return True	4✔
166	return False	4✔
167
168
169	def check_user_role(user, principal: str) -> bool:	4✔
170	if principal.startswith("role:"):	4✔
171	user_role = principal.split("role:")[1]	4✔
172	if user.has_role(user_role):	4✔
173	return True	4✔
174	return False	4✔
175
176
177	def check_account_membership(user, principal: str) -> bool:	4✔
178	if principal.startswith("account:"):	4✔
179	account_id = principal.split("account:")[1]	4✔
180	if not account_id.isdigit():	4✔
181	current_app.logger.warning(	×
182	f"Cannot match principal for account ID {account_id} ― no digit."
183	)
184	elif user.account.id == int(account_id):	4✔
185	return True	4✔
186	return False	4✔
187
188
189	def check_account_role(user, principal: str) -> bool:	4✔
190	if principal.startswith("account-role:"):	4✔
191	account_role = principal.split("account-role:")[1]	4✔
192	if user.account.has_role(account_role):	4✔
193	return True	4✔
194	return False	4✔

FlexMeasures / flexmeasures / 6274136987

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous