34 lines
984 B
Python
34 lines
984 B
Python
|
"""flex-auth PEP port — fail-closed for sensitive actions when PDP missing."""
|
||
|
|
|
||
|
|
from __future__ import annotations
|
||
|
|
|
||
|
|
from dataclasses import dataclass
|
||
|
|
|
||
|
|
from django.conf import settings
|
||
|
|
|
||
|
|
|
||
|
|
@dataclass(frozen=True)
|
||
|
|
class AuthzDecision:
|
||
|
|
allow: bool
|
||
|
|
reason: str
|
||
|
|
decision_id: str = ""
|
||
|
|
|
||
|
|
|
||
|
|
def check(action: str, *, resource: str = "shell", subject: str = "") -> AuthzDecision:
|
||
|
|
"""Decide whether `action` is allowed.
|
||
|
|
|
||
|
|
- shell:view is allowed for any authenticated principal (shell smoke).
|
||
|
|
- other actions require FLEX_AUTH_BASE_URL; until wired, deny.
|
||
|
|
"""
|
||
|
|
if action == "shell:view":
|
||
|
|
return AuthzDecision(allow=True, reason="shell-view-authenticated")
|
||
|
|
|
||
|
|
if not settings.FLEX_AUTH_BASE_URL:
|
||
|
|
return AuthzDecision(
|
||
|
|
allow=False,
|
||
|
|
reason="flex-auth-not-configured-fail-closed",
|
||
|
|
)
|
||
|
|
|
||
|
|
# TODO(CSOC-WP-0002-T07): HTTP call to flex-auth PDP
|
||
|
|
return AuthzDecision(allow=False, reason="flex-auth-http-not-implemented")
|