permissions ¶

Permission utilities.

Verb vocabulary: get / create / update / delete / manage Format: . or ..

Role-to-permission mappings are defined in the host application's own configuration (e.g. under a permissions: key), not in this module. This module only provides the has_permission helper and the Permissions class built on top of it.

Classes:

Permissions –

Framework-agnostic permission checker bound to a role-permissions mapping.

Functions:

has_permission –

Return True if the user holds any role that grants the given permission.
parse_role_permissions –

Parse a permissions config dict into a resolved role → permissions mapping.

Permissions ¶

Permissions(role_permissions: dict[str, frozenset[str]])

Framework-agnostic permission checker bound to a role-permissions mapping.

Instantiate once with the resolved mapping and use :meth:has_permission in route handlers or templates.

For dependency-injection-based web frameworks, see the optional framework-specific extension modules (e.g. :mod:oqtopus_auth.fastapi for FastAPI), which extend this class with a :meth:require method.

Methods:

has_permission –

Return True if the user holds the given permission.

has_permission ¶

has_permission(
    user: AuthUser | None, permission: str
) -> bool

Return True if the user holds the given permission.

Returns:

bool –

True if the user has the permission, False otherwise.

has_permission ¶

has_permission(
    user: AuthUser | None,
    permission: str,
    role_permissions: dict[str, frozenset[str]],
) -> bool

Return True if the user holds any role that grants the given permission.

Returns:

bool –

True if the user has the permission, False otherwise.

parse_role_permissions ¶

parse_role_permissions(
    raw: dict,
) -> dict[str, frozenset[str]]

Parse a permissions config dict into a resolved role → permissions mapping.

The _extends_ key defines single-level inheritance: a role listed there inherits all permissions of its parent role in addition to its own.

Returns:

dict[str, frozenset[str]] –

Mapping of role name to resolved frozenset of permission strings.