esgf_core_utils.models.auth

Models relating to Authorisation for the ESGF Next Gen Core Architecture.

Attributes

`logger`
`Role`

Exceptions

`AuthorizationException`	Authorization Exception
`MissingPermissionException`	Missing Permission Exception

Classes

`RequesterData`	Model describing `Requests Data` for the `Auth` component of a Kafka
`Node`	Model describing Node auth info of a ESGF publisher.
`Project`	Model describing Project auth info of a ESGF publisher.
`Nodes`	Model describing Project auth info of a ESGF publisher.
`Projects`	Model describing Project auth info of a ESGF publisher.
`Authorizer`	Model describing Authentication information of a ESGF publisher.

Package Contents

exception esgf_core_utils.models.auth.AuthorizationException(instance: str)

Bases: RFC9457Exception

Authorization Exception

status_code = 403

type = 'https://esgf.io/publication/errors/missing-permission'

title = 'You do not have permission'

detail = 'You do not have the required permission to perform that operation -- please check with your...

instance

exception esgf_core_utils.models.auth.MissingPermissionException(permission_type: str, target: str, role: str = '')

Bases: Exception

Missing Permission Exception

type

role = ''

target

class esgf_core_utils.models.auth.RequesterData(/, **data: Any)

Bases: pydantic.BaseModel

Model describing Requests Data for the Auth component of a Kafka message in more detail.

client_id: str

iss: str

sub: str

esgf_core_utils.models.auth.logger

esgf_core_utils.models.auth.Role

class esgf_core_utils.models.auth.Node(/, **data: Any)

Bases: pydantic.BaseModel

Model describing Node auth info of a ESGF publisher.

id: str

roles: set[Role]

class esgf_core_utils.models.auth.Project(/, **data: Any)

Bases: pydantic.BaseModel

Model describing Project auth info of a ESGF publisher.

id: str

roles: set[Role]

class esgf_core_utils.models.auth.Nodes(/, **data: Any)

Bases: pydantic.BaseModel

Model describing Project auth info of a ESGF publisher.

nodes: dict[str, Node]

add(node: Node | dict[str, Any]) → None

Add a new project or update roles if project already exists.

Args:: node (Node | dict): node to be added

authorize_href(asset_href: str, role: Role) → None

authorize(assets: dict[str, Any], role: Role) → None

Check for appropriate authorisation.

Args:: assets (dict): item to be authorised role (Role): required role for auhroisation
Raises:: MissingPermissionException: Raised if either node or role permission is missing

class esgf_core_utils.models.auth.Projects(/, **data: Any)

Bases: pydantic.BaseModel

Model describing Project auth info of a ESGF publisher.

projects: dict[str, Project]

add(project: Project | dict[str, Any]) → None

Add a new project or update roles if project already exists.

Args:: project (Project | dict): project to be added

authorize(project: str, role: Role) → None

Check for appropriate authorisation.

Args:: item (Item): item to be authorised role (Role): required role for auhroisation
Raises:: MissingPermissionException: Raised if either node or role permission is missing

class esgf_core_utils.models.auth.Authorizer(/, **data: Any)

Bases: pydantic.BaseModel

Model describing Authentication information of a ESGF publisher.

requester_data: esgf_core_utils.models.kafka.events.RequesterData

nodes: Nodes

projects: Projects

regex: str

authorize(collection_id: str, item: stac_pydantic.item.Item | stac_fastapi.extensions.transaction.request.PartialItem, role: Role, request_id: str, event_id: str) → None

Check for appropriate authorisation.

Args:: collection_id: collection id of request item (Item): item to be authorised role (Role): required role for auhroisation
Raises:: AuthorizationException: Raised if either node or role permission is missing

add(entitlements: list[str]) → None

add entitlements to Authorizer.

Args:: entitlements (list[str]): list of entitlements to be added