tegwick
01da195c13
Django scaffold aligned with the business delivery lane: tenant-keyed Member model without passwords, identity app as sole OIDC/session boundary, dev-claims login, authenticated /app/ shell, ADR-0001, and tests. T01/T02/T05/T06 done; OIDC registration, real user-engine HTTP, flex-auth, and packaging remain open.
33 lines
984 B
Python
33 lines
984 B
Python
"""flex-auth PEP port — fail-closed for sensitive actions when PDP missing."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from dataclasses import dataclass
|
|
|
|
from django.conf import settings
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class AuthzDecision:
|
|
allow: bool
|
|
reason: str
|
|
decision_id: str = ""
|
|
|
|
|
|
def check(action: str, *, resource: str = "shell", subject: str = "") -> AuthzDecision:
|
|
"""Decide whether `action` is allowed.
|
|
|
|
- shell:view is allowed for any authenticated principal (shell smoke).
|
|
- other actions require FLEX_AUTH_BASE_URL; until wired, deny.
|
|
"""
|
|
if action == "shell:view":
|
|
return AuthzDecision(allow=True, reason="shell-view-authenticated")
|
|
|
|
if not settings.FLEX_AUTH_BASE_URL:
|
|
return AuthzDecision(
|
|
allow=False,
|
|
reason="flex-auth-not-configured-fail-closed",
|
|
)
|
|
|
|
# TODO(CSOC-WP-0002-T07): HTTP call to flex-auth PDP
|
|
return AuthzDecision(allow=False, reason="flex-auth-http-not-implemented")
|