-
Notifications
You must be signed in to change notification settings - Fork 6
RBAC - 4 #542
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
RBAC - 4 #542
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
73 changes: 73 additions & 0 deletions
73
aegis/templates/copier-aegis-project/{{ project_slug }}/app/models/org.py.jinja
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,73 @@ | ||
| """Organization and membership models.""" | ||
| {% if include_auth_org %} | ||
|
|
||
| from datetime import UTC, datetime | ||
|
|
||
| from sqlmodel import Field, SQLModel | ||
|
|
||
|
|
||
| # Org membership role constants | ||
| ORG_ROLE_OWNER = "owner" | ||
| ORG_ROLE_ADMIN = "admin" | ||
| ORG_ROLE_MEMBER = "member" | ||
| VALID_ORG_ROLES = {ORG_ROLE_OWNER, ORG_ROLE_ADMIN, ORG_ROLE_MEMBER} | ||
|
|
||
|
|
||
| class OrganizationBase(SQLModel): | ||
| """Base organization model with shared fields.""" | ||
|
|
||
| name: str = Field(index=True) | ||
| slug: str = Field(unique=True, index=True) | ||
| description: str | None = None | ||
| is_active: bool = Field(default=True) | ||
|
|
||
|
|
||
| class Organization(OrganizationBase, table=True): | ||
| """Organization database model.""" | ||
|
|
||
| id: int | None = Field(default=None, primary_key=True) | ||
| created_at: datetime = Field( | ||
| default_factory=lambda: datetime.now(UTC).replace(tzinfo=None) | ||
| ) | ||
| updated_at: datetime | None = None | ||
|
|
||
|
|
||
| class OrganizationMember(SQLModel, table=True): | ||
| """Organization membership database model.""" | ||
|
|
||
| __tablename__ = "organization_member" | ||
|
|
||
| id: int | None = Field(default=None, primary_key=True) | ||
| organization_id: int = Field(foreign_key="organization.id", index=True) | ||
| user_id: int = Field(foreign_key="user.id", index=True) | ||
| role: str = Field(default=ORG_ROLE_MEMBER) | ||
| joined_at: datetime = Field( | ||
| default_factory=lambda: datetime.now(UTC).replace(tzinfo=None) | ||
| ) | ||
|
|
||
|
|
||
| class OrgCreate(OrganizationBase): | ||
| """Organization creation model.""" | ||
|
|
||
| pass | ||
|
|
||
|
|
||
| class OrgResponse(OrganizationBase): | ||
| """Organization response model.""" | ||
|
|
||
| id: int | ||
| created_at: datetime | ||
| updated_at: datetime | None = None | ||
|
|
||
|
|
||
| class MemberResponse(SQLModel): | ||
| """Organization member response model.""" | ||
|
|
||
| id: int | ||
| organization_id: int | ||
| user_id: int | ||
| role: str | ||
| joined_at: datetime | ||
| {% else %} | ||
| # Organization models not included (auth_level != org) | ||
| {% endif %} |
96 changes: 96 additions & 0 deletions
96
...tes/copier-aegis-project/{{ project_slug }}/app/services/auth/membership_service.py.jinja
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,96 @@ | ||
| """Membership service for managing organization members.""" | ||
| {% if include_auth_org %} | ||
|
|
||
| from datetime import UTC, datetime | ||
|
|
||
| from sqlmodel import select | ||
| from sqlmodel.ext.asyncio.session import AsyncSession | ||
|
|
||
| from app.models.org import ( | ||
| VALID_ORG_ROLES, | ||
| Organization, | ||
| OrganizationMember, | ||
| ) | ||
|
|
||
|
|
||
| class MembershipService: | ||
| """Service for managing organization memberships.""" | ||
|
|
||
| def __init__(self, db: AsyncSession) -> None: | ||
| self.db = db | ||
|
|
||
| async def add_member( | ||
| self, org_id: int, user_id: int, role: str = "member" | ||
| ) -> OrganizationMember: | ||
| """Add a user to an organization.""" | ||
| if role not in VALID_ORG_ROLES: | ||
| raise ValueError(f"Invalid org role: {role}. Valid: {VALID_ORG_ROLES}") | ||
| member = OrganizationMember( | ||
| organization_id=org_id, | ||
| user_id=user_id, | ||
| role=role, | ||
| joined_at=datetime.now(UTC).replace(tzinfo=None), | ||
| ) | ||
| self.db.add(member) | ||
| await self.db.commit() | ||
| await self.db.refresh(member) | ||
| return member | ||
|
|
||
| async def remove_member(self, org_id: int, user_id: int) -> bool: | ||
| """Remove a user from an organization.""" | ||
| member = await self.get_member(org_id, user_id) | ||
| if not member: | ||
| return False | ||
| await self.db.delete(member) | ||
| await self.db.commit() | ||
| return True | ||
|
|
||
| async def get_member( | ||
| self, org_id: int, user_id: int | ||
| ) -> OrganizationMember | None: | ||
| """Get a specific membership.""" | ||
| statement = select(OrganizationMember).where( | ||
| OrganizationMember.organization_id == org_id, | ||
| OrganizationMember.user_id == user_id, | ||
| ) | ||
| result = await self.db.exec(statement) | ||
| return result.first() | ||
|
|
||
| async def update_member_role( | ||
| self, org_id: int, user_id: int, role: str | ||
| ) -> OrganizationMember | None: | ||
| """Update a member's role within an organization.""" | ||
| if role not in VALID_ORG_ROLES: | ||
| raise ValueError(f"Invalid org role: {role}. Valid: {VALID_ORG_ROLES}") | ||
| member = await self.get_member(org_id, user_id) | ||
| if not member: | ||
| return None | ||
| member.role = role | ||
| self.db.add(member) | ||
| await self.db.commit() | ||
| await self.db.refresh(member) | ||
| return member | ||
|
|
||
| async def list_org_members(self, org_id: int) -> list[OrganizationMember]: | ||
| """List all members of an organization.""" | ||
| statement = select(OrganizationMember).where( | ||
| OrganizationMember.organization_id == org_id | ||
| ) | ||
| result = await self.db.exec(statement) | ||
| return list(result.all()) | ||
|
|
||
| async def list_user_orgs(self, user_id: int) -> list[Organization]: | ||
| """List all organizations a user belongs to.""" | ||
| statement = ( | ||
| select(Organization) | ||
| .join( | ||
| OrganizationMember, | ||
| OrganizationMember.organization_id == Organization.id, | ||
| ) | ||
| .where(OrganizationMember.user_id == user_id) | ||
| ) | ||
| result = await self.db.exec(statement) | ||
| return list(result.all()) | ||
| {% else %} | ||
| # Membership service not included (auth_level != org) | ||
| {% endif %} |
66 changes: 66 additions & 0 deletions
66
.../templates/copier-aegis-project/{{ project_slug }}/app/services/auth/org_service.py.jinja
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,66 @@ | ||
| """Organization service for CRUD operations.""" | ||
| {% if include_auth_org %} | ||
|
|
||
| from datetime import UTC, datetime | ||
|
|
||
| from sqlmodel import select | ||
| from sqlmodel.ext.asyncio.session import AsyncSession | ||
|
|
||
| from app.models.org import OrgCreate, Organization | ||
|
|
||
|
|
||
| class OrgService: | ||
| """Service for managing organizations.""" | ||
|
|
||
| def __init__(self, db: AsyncSession) -> None: | ||
| self.db = db | ||
|
|
||
| async def create_org(self, org_data: OrgCreate) -> Organization: | ||
| """Create a new organization.""" | ||
| org = Organization.model_validate(org_data) | ||
| self.db.add(org) | ||
| await self.db.commit() | ||
| await self.db.refresh(org) | ||
| return org | ||
|
|
||
| async def get_org_by_id(self, org_id: int) -> Organization | None: | ||
| """Get an organization by ID.""" | ||
| return await self.db.get(Organization, org_id) | ||
|
|
||
| async def get_org_by_slug(self, slug: str) -> Organization | None: | ||
| """Get an organization by slug.""" | ||
| statement = select(Organization).where(Organization.slug == slug) | ||
| result = await self.db.exec(statement) | ||
| return result.first() | ||
|
|
||
| async def update_org(self, org_id: int, **updates: str) -> Organization | None: | ||
| """Update an organization's fields.""" | ||
| org = await self.get_org_by_id(org_id) | ||
| if not org: | ||
| return None | ||
| for field, value in updates.items(): | ||
| if hasattr(org, field): | ||
| setattr(org, field, value) | ||
| org.updated_at = datetime.now(UTC).replace(tzinfo=None) | ||
| self.db.add(org) | ||
| await self.db.commit() | ||
| await self.db.refresh(org) | ||
| return org | ||
|
|
||
| async def delete_org(self, org_id: int) -> bool: | ||
| """Delete an organization.""" | ||
| org = await self.get_org_by_id(org_id) | ||
| if not org: | ||
| return False | ||
| await self.db.delete(org) | ||
| await self.db.commit() | ||
| return True | ||
|
|
||
| async def list_orgs(self) -> list[Organization]: | ||
| """List all organizations.""" | ||
| statement = select(Organization).order_by(Organization.created_at.desc()) | ||
| result = await self.db.exec(statement) | ||
| return list(result.all()) | ||
| {% else %} | ||
| # Organization service not included (auth_level != org) | ||
| {% endif %} |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.