authentik.rbac.api.rbac_assigned_by_roles

  1"""common RBAC serializers"""
  2
  3from django.contrib.auth.models import Permission
  4from django.db.models import Q, QuerySet
  5from django.db.transaction import atomic
  6from django_filters.filters import CharFilter, ChoiceFilter
  7from django_filters.filterset import FilterSet
  8from drf_spectacular.utils import OpenApiResponse, extend_schema
  9from guardian.models import RoleModelPermission, RoleObjectPermission
 10from guardian.shortcuts import assign_perm, remove_perm
 11from rest_framework.decorators import action
 12from rest_framework.fields import CharField, ReadOnlyField
 13from rest_framework.mixins import ListModelMixin
 14from rest_framework.request import Request
 15from rest_framework.response import Response
 16from rest_framework.viewsets import GenericViewSet
 17
 18from authentik.core.api.utils import ModelSerializer, PassiveSerializer
 19from authentik.lib.api import model_choices
 20from authentik.rbac.api.rbac import PermissionAssignResultSerializer, PermissionAssignSerializer
 21from authentik.rbac.decorators import permission_required
 22from authentik.rbac.models import Role
 23
 24
 25class RoleObjectPermissionSerializer(ModelSerializer):
 26    """Role-bound object level permission"""
 27
 28    app_label = ReadOnlyField(source="content_type.app_label")
 29    model = ReadOnlyField(source="content_type.model")
 30    codename = ReadOnlyField(source="permission.codename")
 31    name = ReadOnlyField(source="permission.name")
 32    object_pk = CharField()
 33
 34    class Meta:
 35        model = RoleObjectPermission
 36        fields = ["id", "codename", "model", "app_label", "object_pk", "name"]
 37
 38
 39class RoleModelPermissionSerializer(ModelSerializer):
 40    """Role-bound object level permission"""
 41
 42    app_label = ReadOnlyField(source="content_type.app_label")
 43    model = ReadOnlyField(source="content_type.model")
 44    codename = ReadOnlyField(source="permission.codename")
 45    name = ReadOnlyField(source="permission.name")
 46
 47    class Meta:
 48        model = RoleModelPermission
 49        fields = ["id", "codename", "model", "app_label", "name"]
 50
 51
 52class RoleAssignedObjectPermissionSerializer(PassiveSerializer):
 53    """Roles assigned object permission serializer"""
 54
 55    role_pk = CharField(source="pk", read_only=True)
 56    name = CharField(read_only=True)
 57    object_permissions = RoleObjectPermissionSerializer(
 58        many=True, source="roleobjectpermission_set"
 59    )
 60    model_permissions = RoleModelPermissionSerializer(many=True, source="rolemodelpermission_set")
 61
 62    class Meta:
 63        model = Role
 64        fields = ["role_pk", "name", "object_permissions", "model_permissions"]
 65
 66
 67class RoleAssignedPermissionFilter(FilterSet):
 68    """Assigned permission filter"""
 69
 70    model = ChoiceFilter(choices=model_choices(), method="filter_model", required=True)
 71    object_pk = CharFilter(method="filter_object_pk")
 72
 73    def filter_queryset(self, queryset):
 74        queryset = super().filter_queryset(queryset)
 75        data = self.form.cleaned_data
 76        model: str = data["model"]
 77        object_pk: str | None = data.get("object_pk", None)
 78        app, _, model = model.partition(".")
 79
 80        permissions = Permission.objects.filter(
 81            content_type__app_label=app,
 82            content_type__model=model,
 83        )
 84
 85        role_pks_with_model_permission = (
 86            permissions.order_by().values_list("rolemodelpermission__role", flat=True).distinct()
 87        )
 88        role_pks_with_object_permission = []
 89        if object_pk:
 90            role_pks_with_object_permission = (
 91                RoleObjectPermission.objects.filter(
 92                    permission__in=permissions,
 93                    object_pk=object_pk,
 94                )
 95                .order_by()
 96                .values_list("role", flat=True)
 97                .distinct()
 98            )
 99
100        return queryset.filter(
101            Q(pk__in=role_pks_with_model_permission) | Q(pk__in=role_pks_with_object_permission)
102        )
103
104    def filter_model(self, queryset: QuerySet, name, value: str) -> QuerySet:
105        """Filter by object type"""
106        # Actual filtering is handled by the above method where both `model` and `object_pk` are
107        # available. Don't do anything here, this method is only left here to avoid overriding too
108        # much of filter_queryset.
109        return queryset
110
111    def filter_object_pk(self, queryset: QuerySet, name, value: str) -> QuerySet:
112        """Filter by object primary key"""
113        # Actual filtering is handled by the above method where both `model` and `object_pk` are
114        # available. Don't do anything here, this method is only left here to avoid overriding too
115        # much of filter_queryset.
116        return queryset
117
118
119class RoleAssignedPermissionViewSet(ListModelMixin, GenericViewSet):
120    """Get assigned object permissions for a single object"""
121
122    serializer_class = RoleAssignedObjectPermissionSerializer
123    ordering = ["name"]
124    # The filtering is done in the filterset,
125    # which has a required filter that does the heavy lifting
126    queryset = Role.objects.all()
127    filterset_class = RoleAssignedPermissionFilter
128    search_fields = ["name"]
129
130    @permission_required("authentik_rbac.assign_role_permissions")
131    @extend_schema(
132        request=PermissionAssignSerializer(),
133        responses={
134            200: PermissionAssignResultSerializer(many=True),
135        },
136        operation_id="rbac_permissions_assigned_by_roles_assign",
137    )
138    @action(methods=["POST"], detail=True, pagination_class=None, filter_backends=[])
139    def assign(self, request: Request, *args, **kwargs) -> Response:
140        """Assign permission(s) to role. When `object_pk` is set, the permissions
141        are only assigned to the specific object, otherwise they are assigned globally."""
142        role: Role = self.get_object()
143        data = PermissionAssignSerializer(data=request.data)
144        data.is_valid(raise_exception=True)
145        ids = []
146        with atomic():
147            for perm in data.validated_data["permissions"]:
148                assigned_perm = assign_perm(perm, role, data.validated_data["model_instance"])
149                ids.append(PermissionAssignResultSerializer(instance={"id": assigned_perm.pk}).data)
150        return Response(ids, status=200)
151
152    @permission_required("authentik_rbac.unassign_role_permissions")
153    @extend_schema(
154        request=PermissionAssignSerializer(),
155        responses={
156            204: OpenApiResponse(description="Successfully unassigned"),
157        },
158    )
159    @action(methods=["PATCH"], detail=True, pagination_class=None, filter_backends=[])
160    def unassign(self, request: Request, *args, **kwargs) -> Response:
161        """Unassign permission(s) to role. When `object_pk` is set, the permissions
162        are only assigned to the specific object, otherwise they are assigned globally."""
163        role: Role = self.get_object()
164        data = PermissionAssignSerializer(data=request.data)
165        data.is_valid(raise_exception=True)
166        with atomic():
167            for perm in data.validated_data["permissions"]:
168                remove_perm(perm, role, data.validated_data["model_instance"])
169        return Response(status=204)