authentik.rbac.models

  1"""RBAC models"""
  2
  3from uuid import uuid4
  4
  5from django.contrib.auth.management import _get_all_permissions
  6from django.contrib.auth.models import Permission
  7from django.db import models
  8from django.db.transaction import atomic
  9from django.utils.translation import gettext_lazy as _
 10from guardian.shortcuts import assign_perm, remove_perm
 11from rest_framework.serializers import BaseSerializer
 12
 13from authentik.blueprints.models import ManagedModel
 14from authentik.lib.models import SerializerModel
 15from authentik.lib.utils.reflection import get_apps
 16
 17
 18def get_permission_choices():
 19    all_perms = []
 20    for app in get_apps():
 21        for model in app.get_models():
 22            for perm, _desc in _get_all_permissions(model._meta):
 23                all_perms.append((model, perm))
 24    return sorted(
 25        [
 26            (
 27                f"{model._meta.app_label}.{perm}",
 28                f"{model._meta.app_label}.{perm}",
 29            )
 30            for model, perm in all_perms
 31        ]
 32    )
 33
 34
 35class Role(SerializerModel, ManagedModel):
 36    """RBAC role, which can have different permissions (both global and per-object) attached
 37    to it."""
 38
 39    uuid = models.UUIDField(default=uuid4, editable=False, unique=True, primary_key=True)
 40    name = models.TextField(unique=True)
 41
 42    @property
 43    def serializer(self) -> type[BaseSerializer]:
 44        from authentik.rbac.api.roles import RoleSerializer
 45
 46        return RoleSerializer
 47
 48    def __str__(self) -> str:
 49        return f"Role {self.name}"
 50
 51    class Meta:
 52        verbose_name = _("Role")
 53        verbose_name_plural = _("Roles")
 54        permissions = [
 55            ("assign_role_permissions", _("Can assign permissions to roles")),
 56            ("unassign_role_permissions", _("Can unassign permissions from roles")),
 57        ]
 58
 59    def assign_perms(
 60        self,
 61        perms: str | list[str] | Permission | list[Permission],
 62        obj: models.Model | None = None,
 63    ):
 64        """Assign permission to role, can handle multiple permissions,
 65        but when assigning multiple permissions to an object the permissions
 66        must all belong to the object given"""
 67        if not isinstance(perms, list):
 68            perms = [perms]
 69        with atomic():
 70            for perm in perms:
 71                assign_perm(perm, self, obj)
 72
 73    def remove_perms(
 74        self,
 75        perms: str | list[str] | Permission | list[Permission],
 76        obj: models.Model | None = None,
 77    ):
 78        """Assign permission to role, can handle multiple permissions,
 79        but when assigning multiple permissions to an object the permissions
 80        must all belong to the object given"""
 81        if isinstance(perms, str):
 82            perms = [perms]
 83        with atomic():
 84            for perm in perms:
 85                remove_perm(perm, self, obj)
 86
 87
 88class InitialPermissions(SerializerModel):
 89    """Assigns permissions for newly created objects."""
 90
 91    name = models.TextField(max_length=150, unique=True)
 92    role = models.ForeignKey(Role, on_delete=models.CASCADE)
 93    permissions = models.ManyToManyField(Permission, blank=True)
 94
 95    @property
 96    def serializer(self) -> type[BaseSerializer]:
 97        from authentik.rbac.api.initial_permissions import InitialPermissionsSerializer
 98
 99        return InitialPermissionsSerializer
100
101    def __str__(self) -> str:
102        return f"Initial Permissions for Role #{self.role_id}."
103
104    class Meta:
105        verbose_name = _("Initial Permissions")
106        verbose_name_plural = _("Initial Permissions")
107
108
109class SystemPermission(models.Model):
110    """System-wide permissions that are not related to any direct
111    database model"""
112
113    class Meta:
114        managed = False
115        default_permissions = ()
116        verbose_name = _("System permission")
117        verbose_name_plural = _("System permissions")
118        permissions = [
119            ("view_system_info", _("Can view system info")),
120            ("access_admin_interface", _("Can access admin interface")),
121            ("view_system_settings", _("Can view system settings")),
122            ("edit_system_settings", _("Can edit system settings")),
123            ("view_media_files", _("Can view media files")),
124            ("manage_media_files", _("Can manage media files")),
125        ]
126
127    def __str__(self) -> str:
128        return "System Permission"