tegwick
44439f8d8d
Local + HTTP POST /v1/check PEP with fail-closed transport errors; shell:view enforced on /app/. Vocabulary docs for T07. Helm chart lives in railiance-apps; Dockerfile already present for T08.
64 lines
2.2 KiB
Python
64 lines
2.2 KiB
Python
from django.contrib.auth.decorators import login_required
|
|
from django.http import HttpRequest, HttpResponse, HttpResponseForbidden, JsonResponse
|
|
from django.shortcuts import render
|
|
|
|
from coulomb_social.apps.identity import flex_auth
|
|
|
|
|
|
def landing(request: HttpRequest) -> HttpResponse:
|
|
if request.user.is_authenticated:
|
|
from django.shortcuts import redirect
|
|
|
|
return redirect("core:app_home")
|
|
return render(request, "core/landing.html")
|
|
|
|
|
|
@login_required
|
|
def app_home(request: HttpRequest) -> HttpResponse:
|
|
member = getattr(request.user, "member", None)
|
|
subject = member.subject if member else request.user.get_username()
|
|
tenant = member.tenant_id if member else ""
|
|
decision = flex_auth.check(
|
|
"shell:view",
|
|
resource="shell",
|
|
resource_id="app_home",
|
|
subject=subject,
|
|
tenant=tenant,
|
|
attributes={
|
|
"issuer": member.issuer if member else "",
|
|
"user_engine_user_id": str(member.user_engine_user_id) if member else "",
|
|
},
|
|
)
|
|
if not decision.allow:
|
|
return HttpResponseForbidden(
|
|
f"Not authorized to view shell ({decision.reason})."
|
|
)
|
|
|
|
return render(
|
|
request,
|
|
"core/app_home.html",
|
|
{
|
|
"member": member,
|
|
"principal": {
|
|
"username": request.user.get_username(),
|
|
"display_name": (
|
|
member.display_name
|
|
if member and member.display_name
|
|
else request.user.get_full_name() or request.user.get_username()
|
|
),
|
|
"issuer": member.issuer if member else "",
|
|
"subject": member.subject if member else "",
|
|
"user_engine_user_id": (
|
|
str(member.user_engine_user_id) if member else ""
|
|
),
|
|
"tenant_id": member.tenant_id if member else "",
|
|
"user_engine_source": request.session.get("user_engine_source", ""),
|
|
"authz_decision_id": decision.decision_id,
|
|
"authz_reason": decision.reason,
|
|
},
|
|
},
|
|
)
|
|
|
|
|
|
def healthz(_request: HttpRequest) -> JsonResponse:
|
|
return JsonResponse({"status": "ok", "service": "coulomb-social"})
|