| 1 | """Role-based access control. Permissions are coarse-grained verbs over resource families.""" |
| 2 | from enum import Enum |
| 3 | |
| 4 | |
| 5 | class Perm(str, Enum): |
| 6 | READ = "read" |
| 7 | WRITE = "write" |
| 8 | INGEST = "ingest" |
| 9 | MANAGE_WATCHLIST = "manage_watchlist" |
| 10 | RUN_ENRICHMENT = "run_enrichment" |
| 11 | EXPORT = "export" |
| 12 | ADMIN = "admin" |
| 13 | |
| 14 | |
| 15 | ROLE_PERMISSIONS: dict[str, set[Perm]] = { |
| 16 | "viewer": {Perm.READ}, |
| 17 | "analyst": { |
| 18 | Perm.READ, Perm.WRITE, Perm.INGEST, |
| 19 | Perm.MANAGE_WATCHLIST, Perm.RUN_ENRICHMENT, Perm.EXPORT, |
| 20 | }, |
| 21 | "admin": set(Perm), |
| 22 | } |
| 23 | |
| 24 | |
| 25 | def role_has(role: str, perm: Perm) -> bool: |
| 26 | return perm in ROLE_PERMISSIONS.get(role, set()) |