Agent Zero
6555655ecf
Check Cross-Plugin Imports / check (push) Has been cancelled
- Add OwnedMixin to 29 model files (78 tables that had owner_id in DB but not in model) - Add search/embedding columns to 9 model files (18 columns: search_tsv, embedding, indexed_at, content_text, content_tsv, body_tsv, company_id, deleted_at) - Fix import syntax errors in calendar/models.py, mail/models.py, notification.py, contact.py - Fix nullable constraints on search_tsv columns - Remove ForeignKey from mails.company_id (companies table not always loaded in test context) - All 36 tests pass (24 Phase J + 12 Phase K) - Models now match production DB schema
104 lines
3.3 KiB
Python
104 lines
3.3 KiB
Python
"""ABAC entity policy model — attribute-based access control policies.
|
|
|
|
⚠️ ABAC EntityPolicy ist implementiert aber wird nicht aktiv genutzt.
|
|
Bei echtem Bedarf aktivieren, sonst bei Gelegenheit entfernen.
|
|
|
|
Each policy defines a rule for a specific entity type:
|
|
- allow policies: at least one must match for access
|
|
- deny policies: if any matches, access is denied (deny takes precedence)
|
|
|
|
Conditions use JSONB with format:
|
|
{
|
|
"operator": "AND" | "OR",
|
|
"rules": [
|
|
{"field": "status", "op": "eq", "value": "active"},
|
|
{"field": "amount", "op": "gte", "value": 1000},
|
|
{"field": "tags", "op": "contains", "value": "vip"}
|
|
]
|
|
}
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import uuid
|
|
from datetime import datetime
|
|
|
|
from sqlalchemy import (
|
|
Boolean,
|
|
CheckConstraint,
|
|
DateTime,
|
|
Index,
|
|
Integer,
|
|
String,
|
|
func,
|
|
)
|
|
from sqlalchemy.dialects.postgresql import JSONB
|
|
from sqlalchemy.dialects.postgresql import UUID as PGUUID
|
|
from sqlalchemy.orm import Mapped, mapped_column
|
|
|
|
from app.core.db import Base, TenantMixin
|
|
from app.models.owned_mixin import OwnedMixin
|
|
|
|
|
|
class EntityPolicy(Base, TenantMixin, OwnedMixin):
|
|
"""ABAC policy entry for any entity type in the system.
|
|
|
|
entity_type examples: 'contact', 'dms_file', 'mailbox', 'calendar_event',
|
|
'task', 'workflow', 'contact_folder', etc.
|
|
|
|
principal_type: 'user', 'group', 'role'
|
|
|
|
effect: 'allow' | 'deny'
|
|
- allow: grants access if conditions match
|
|
- deny: blocks access if conditions match (deny takes precedence over allow)
|
|
|
|
conditions: JSONB with operator (AND/OR) and rules array
|
|
priority: higher priority policies are evaluated first
|
|
"""
|
|
|
|
__tablename__ = "entity_policies"
|
|
__table_args__ = (
|
|
CheckConstraint(
|
|
"principal_type IN ('user', 'group', 'role')",
|
|
name="ck_epol_principal_type",
|
|
),
|
|
CheckConstraint(
|
|
"effect IN ('allow', 'deny')",
|
|
name="ck_epol_effect",
|
|
),
|
|
Index("ix_epol_entity_type", "entity_type"),
|
|
Index("ix_epol_principal", "principal_type", "principal_id"),
|
|
Index("ix_epol_tenant", "tenant_id"),
|
|
Index("ix_epol_priority", "priority"),
|
|
Index("ix_epol_enabled", "enabled"),
|
|
)
|
|
|
|
id: Mapped[uuid.UUID] = mapped_column(
|
|
PGUUID(as_uuid=True), primary_key=True, default=uuid.uuid4
|
|
)
|
|
name: Mapped[str] = mapped_column(String(200), nullable=False)
|
|
entity_type: Mapped[str] = mapped_column(String(50), nullable=False)
|
|
principal_type: Mapped[str] = mapped_column(String(10), nullable=False)
|
|
principal_id: Mapped[uuid.UUID] = mapped_column(
|
|
PGUUID(as_uuid=True), nullable=False
|
|
)
|
|
effect: Mapped[str] = mapped_column(
|
|
String(10), nullable=False, default="allow"
|
|
)
|
|
conditions: Mapped[dict | None] = mapped_column(
|
|
JSONB, nullable=True, default=None
|
|
)
|
|
priority: Mapped[int] = mapped_column(
|
|
Integer, nullable=False, default=0
|
|
)
|
|
enabled: Mapped[bool] = mapped_column(
|
|
Boolean, nullable=False, default=True
|
|
)
|
|
created_at: Mapped[datetime] = mapped_column(
|
|
DateTime(timezone=True), nullable=False, server_default=func.now()
|
|
)
|
|
updated_at: Mapped[datetime] = mapped_column(
|
|
DateTime(timezone=True), nullable=False, server_default=func.now(),
|
|
onupdate=func.now(),
|
|
)
|