Agent Zero
7c8f2a2222
- Integrate ABAC policies into apply_visibility_filter() (allow/deny with priority) - Add field whitelist (ABAC_ALLOWED_FIELDS) for build_sql_condition() security - Add request-level ContextVar for user principals (group_ids, role_id) - Set principals in deps.py (session + bearer auth) - Use ContextVar in visibility.py and permission_resolver.py (N+1 fix) - Add version validation to get_cached_visible_ids() (cache strategy unification) - Deactivate delegation route (parked — not integrated into resolve_permissions) - Add 7 ABAC integration tests All 70 tests pass (7 ABAC + 63 existing). No regressions.
350 lines
11 KiB
Python
350 lines
11 KiB
Python
"""ABAC policy service — attribute-based access control for entities.
|
|
|
|
This service handles:
|
|
- CRUD for entity_policies
|
|
- apply_policy_filter: translates JSONB conditions into SQLAlchemy filters
|
|
- build_sql_condition: recursive JSONB → SQLAlchemy expression translation
|
|
|
|
Policy evaluation:
|
|
- allow policies: OR-joined (at least one must match for access)
|
|
- deny policies: NOT (none may match — deny takes precedence)
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import logging
|
|
import uuid
|
|
from typing import Any
|
|
|
|
from sqlalchemy import and_, not_, or_, select
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
from sqlalchemy.orm import InstrumentedAttribute
|
|
|
|
from app.models.entity_policy import EntityPolicy
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
# Supported operators for condition translation
|
|
_SUPPORTED_OPS = {
|
|
"eq", "neq", "in", "not_in", "gt", "gte", "lt", "lte",
|
|
"contains", "starts_with", "is_null", "is_not_null",
|
|
}
|
|
|
|
# ─── ABAC Field Whitelist ──────────────────────────────────────────
|
|
# Only these fields may be referenced in policy conditions per entity
|
|
# type. Prevents policies from filtering on sensitive columns such as
|
|
# tenant_id, password_hash, etc.
|
|
ABAC_ALLOWED_FIELDS: dict[str, set[str]] = {
|
|
"contact": {"status", "type", "country", "tags", "created_at", "updated_at", "owner_id"},
|
|
"file": {"status", "size", "mime_type", "created_at"},
|
|
"task": {"status", "priority", "due_date", "created_at"},
|
|
"calendar_event": {"status", "start_time", "end_time", "created_at"},
|
|
"mailbox": {"status", "created_at"},
|
|
"address": {"country", "city", "created_at", "updated_at"},
|
|
"contact_folder": {"name", "created_at"},
|
|
"workflow": {"status", "created_at"},
|
|
}
|
|
|
|
|
|
def _serialize_policy(p: EntityPolicy) -> dict:
|
|
return {
|
|
"id": str(p.id),
|
|
"name": p.name,
|
|
"entity_type": p.entity_type,
|
|
"principal_type": p.principal_type,
|
|
"principal_id": str(p.principal_id),
|
|
"effect": p.effect,
|
|
"conditions": p.conditions,
|
|
"priority": p.priority,
|
|
"tenant_id": str(p.tenant_id),
|
|
"enabled": p.enabled,
|
|
"created_at": p.created_at.isoformat() if p.created_at else None,
|
|
"updated_at": p.updated_at.isoformat() if p.updated_at else None,
|
|
}
|
|
|
|
|
|
def build_sql_condition(
|
|
conditions: dict[str, Any],
|
|
model: type,
|
|
entity_type: str | None = None,
|
|
) -> Any:
|
|
"""Recursively translate a JSONB conditions block into a SQLAlchemy filter expression.
|
|
|
|
Conditions format:
|
|
{
|
|
"operator": "AND" | "OR",
|
|
"rules": [
|
|
{"field": "status", "op": "eq", "value": "active"},
|
|
{"field": "amount", "op": "gte", "value": 1000},
|
|
...
|
|
]
|
|
}
|
|
|
|
Nested conditions are supported via rules that contain a nested conditions block.
|
|
|
|
When *entity_type* is provided, each rule's ``field`` is validated against
|
|
the ABAC_ALLOWED_FIELDS whitelist for that entity type. Unknown fields are
|
|
logged and skipped (not crashed) to prevent policies from filtering on
|
|
sensitive columns such as ``tenant_id`` or ``password_hash``.
|
|
"""
|
|
if not conditions or "operator" not in conditions or "rules" not in conditions:
|
|
return None
|
|
|
|
operator = conditions["operator"]
|
|
rules = conditions["rules"]
|
|
|
|
if not rules:
|
|
return None
|
|
|
|
clauses: list[Any] = []
|
|
|
|
for rule in rules:
|
|
# Nested conditions block
|
|
if "operator" in rule and "rules" in rule:
|
|
nested = build_sql_condition(rule, model, entity_type=entity_type)
|
|
if nested is not None:
|
|
clauses.append(nested)
|
|
continue
|
|
|
|
field_name = rule.get("field")
|
|
op = rule.get("op")
|
|
value = rule.get("value")
|
|
|
|
if not field_name or not op:
|
|
continue
|
|
|
|
if op not in _SUPPORTED_OPS:
|
|
logger.warning(f"Unsupported condition operator: {op}")
|
|
continue
|
|
|
|
# ── Field whitelist check ──────────────────────────────────
|
|
# Prevent policies from filtering on sensitive columns
|
|
if entity_type is not None:
|
|
allowed = ABAC_ALLOWED_FIELDS.get(entity_type)
|
|
if allowed is not None and field_name not in allowed:
|
|
logger.warning(
|
|
f"ABAC field '{field_name}' not in whitelist for "
|
|
f"entity_type '{entity_type}' — skipping rule"
|
|
)
|
|
continue
|
|
|
|
# Get the model attribute
|
|
attr: InstrumentedAttribute | None = getattr(model, field_name, None)
|
|
if attr is None:
|
|
logger.warning(f"Unknown field '{field_name}' on {model.__name__}")
|
|
continue
|
|
|
|
if op == "eq":
|
|
clauses.append(attr == value)
|
|
elif op == "neq":
|
|
clauses.append(attr != value)
|
|
elif op == "in":
|
|
if isinstance(value, list):
|
|
clauses.append(attr.in_(value))
|
|
else:
|
|
clauses.append(attr == value)
|
|
elif op == "not_in":
|
|
if isinstance(value, list):
|
|
clauses.append(not_(attr.in_(value)))
|
|
else:
|
|
clauses.append(attr != value)
|
|
elif op == "gt":
|
|
clauses.append(attr > value)
|
|
elif op == "gte":
|
|
clauses.append(attr >= value)
|
|
elif op == "lt":
|
|
clauses.append(attr < value)
|
|
elif op == "lte":
|
|
clauses.append(attr <= value)
|
|
elif op == "contains":
|
|
clauses.append(attr.contains(value))
|
|
elif op == "starts_with":
|
|
clauses.append(attr.startswith(value))
|
|
elif op == "is_null":
|
|
clauses.append(attr.is_(None))
|
|
elif op == "is_not_null":
|
|
clauses.append(attr.isnot(None))
|
|
|
|
if not clauses:
|
|
return None
|
|
|
|
if operator == "AND":
|
|
return and_(*clauses)
|
|
else: # OR
|
|
return or_(*clauses)
|
|
|
|
|
|
async def list_policies(
|
|
db: AsyncSession,
|
|
tenant_id: uuid.UUID,
|
|
entity_type: str | None = None,
|
|
) -> list[dict]:
|
|
"""List all policies for a tenant, optionally filtered by entity_type."""
|
|
query = select(EntityPolicy).where(EntityPolicy.tenant_id == tenant_id)
|
|
if entity_type:
|
|
query = query.where(EntityPolicy.entity_type == entity_type)
|
|
query = query.order_by(EntityPolicy.priority.desc(), EntityPolicy.created_at)
|
|
result = await db.execute(query)
|
|
policies = result.scalars().all()
|
|
return [_serialize_policy(p) for p in policies]
|
|
|
|
|
|
async def create_policy(
|
|
db: AsyncSession,
|
|
tenant_id: uuid.UUID,
|
|
name: str,
|
|
entity_type: str,
|
|
principal_type: str,
|
|
principal_id: str,
|
|
effect: str = "allow",
|
|
conditions: dict[str, Any] | None = None,
|
|
priority: int = 0,
|
|
) -> dict:
|
|
"""Create a new ABAC policy."""
|
|
policy = EntityPolicy(
|
|
tenant_id=tenant_id,
|
|
name=name,
|
|
entity_type=entity_type,
|
|
principal_type=principal_type,
|
|
principal_id=uuid.UUID(principal_id),
|
|
effect=effect,
|
|
conditions=conditions,
|
|
priority=priority,
|
|
)
|
|
db.add(policy)
|
|
await db.commit()
|
|
await db.refresh(policy)
|
|
return _serialize_policy(policy)
|
|
|
|
|
|
async def update_policy(
|
|
db: AsyncSession,
|
|
tenant_id: uuid.UUID,
|
|
policy_id: str,
|
|
**kwargs: Any,
|
|
) -> dict:
|
|
"""Update an existing ABAC policy."""
|
|
result = await db.execute(
|
|
select(EntityPolicy)
|
|
.where(EntityPolicy.id == uuid.UUID(policy_id))
|
|
.where(EntityPolicy.tenant_id == tenant_id)
|
|
)
|
|
policy = result.scalar_one_or_none()
|
|
if policy is None:
|
|
raise ValueError(f"Policy {policy_id} not found")
|
|
|
|
# Update only provided fields
|
|
updatable_fields = {
|
|
"name", "entity_type", "principal_type", "principal_id",
|
|
"effect", "conditions", "priority", "enabled",
|
|
}
|
|
for key, value in kwargs.items():
|
|
if key in updatable_fields and value is not None:
|
|
if key == "principal_id":
|
|
setattr(policy, key, uuid.UUID(value))
|
|
else:
|
|
setattr(policy, key, value)
|
|
|
|
await db.commit()
|
|
await db.refresh(policy)
|
|
return _serialize_policy(policy)
|
|
|
|
|
|
async def delete_policy(
|
|
db: AsyncSession,
|
|
tenant_id: uuid.UUID,
|
|
policy_id: str,
|
|
) -> None:
|
|
"""Delete an ABAC policy."""
|
|
result = await db.execute(
|
|
select(EntityPolicy)
|
|
.where(EntityPolicy.id == uuid.UUID(policy_id))
|
|
.where(EntityPolicy.tenant_id == tenant_id)
|
|
)
|
|
policy = result.scalar_one_or_none()
|
|
if policy is None:
|
|
raise ValueError(f"Policy {policy_id} not found")
|
|
await db.delete(policy)
|
|
await db.commit()
|
|
|
|
|
|
async def apply_policy_filter(
|
|
db: AsyncSession,
|
|
query: Any,
|
|
entity_type: str,
|
|
user_id: uuid.UUID,
|
|
tenant_id: uuid.UUID,
|
|
model: type,
|
|
) -> Any:
|
|
"""Apply ABAC policy filters to an existing SQLAlchemy query.
|
|
|
|
Logic:
|
|
1. Load all enabled policies for this entity_type + tenant that match the user
|
|
(via principal_type='user' with principal_id=user_id, or via group/role)
|
|
2. Separate into allow and deny policies
|
|
3. For allow policies: OR-join their conditions (at least one must match)
|
|
4. For deny policies: NOT (none may match — deny takes precedence)
|
|
5. Apply: query = query.where(allow_filter & deny_filter)
|
|
|
|
If no policies match, the query is returned unchanged (no ABAC restriction).
|
|
"""
|
|
# Load policies for this user on this entity_type
|
|
# For simplicity, we load user-direct policies + group/role policies
|
|
# In a full implementation, we'd also resolve group memberships
|
|
stmt = select(EntityPolicy).where(
|
|
EntityPolicy.tenant_id == tenant_id,
|
|
EntityPolicy.entity_type == entity_type,
|
|
EntityPolicy.enabled == True, # noqa: E712
|
|
).where(
|
|
or_(
|
|
and_(
|
|
EntityPolicy.principal_type == "user",
|
|
EntityPolicy.principal_id == user_id,
|
|
),
|
|
# Group/role policies would need membership resolution
|
|
# For now, we also match group/role by principal_id
|
|
EntityPolicy.principal_id == user_id,
|
|
)
|
|
)
|
|
result = await db.execute(stmt)
|
|
policies = result.scalars().all()
|
|
|
|
if not policies:
|
|
return query # No ABAC restriction
|
|
|
|
allow_clauses: list[Any] = []
|
|
deny_clauses: list[Any] = []
|
|
|
|
for policy in policies:
|
|
if not policy.conditions:
|
|
# Policy without conditions matches everything
|
|
if policy.effect == "allow":
|
|
allow_clauses.append(True)
|
|
else:
|
|
deny_clauses.append(True)
|
|
continue
|
|
|
|
condition = build_sql_condition(policy.conditions, model, entity_type=entity_type)
|
|
if condition is None:
|
|
continue
|
|
|
|
if policy.effect == "allow":
|
|
allow_clauses.append(condition)
|
|
else:
|
|
deny_clauses.append(condition)
|
|
|
|
filters: list[Any] = []
|
|
|
|
if allow_clauses:
|
|
# At least one allow policy must match
|
|
filters.append(or_(*allow_clauses))
|
|
|
|
if deny_clauses:
|
|
# No deny policy may match
|
|
filters.append(not_(or_(*deny_clauses)))
|
|
|
|
if filters:
|
|
query = query.where(and_(*filters))
|
|
|
|
return query
|