WIP

cookiecutter/app/auth/{{cookiecutter.app}}/config.json

@@ -30,17 +30,6 @@
             }
         ]
     },
-    "auth": {
-        "admin": {
-            "username": "admin",
-            "email": "[email protected]"
-        },
-        "security": {
-            "algorithm": "HS256",
-            "access_token_expire_minutes": 30,
-            "auth_path": "/token"
-        }
-    },
     "asgi": {
         "host": "0.0.0.0",
         "port": 8000,

cookiecutter/app/default/{{cookiecutter.app}}/config.json

@@ -30,17 +30,6 @@
             }
         ]
     },
-    "auth": {
-        "admin": {
-            "username": "admin",
-            "email": "[email protected]"
-        },
-        "security": {
-            "algorithm": "HS256",
-            "access_token_expire_minutes": 30,
-            "auth_path": "/token"
-        }
-    },
     "asgi": {
         "host": "0.0.0.0",
         "port": 8000,

cookiecutter/auth/cookiecutter.json

@@ -0,0 +1,6 @@
+{
+    "auth": "{{cookiecutter.auth}}",
+    "storage": "{{cookiecutter.storage}}",
+    "algorithm": "{{cookiecutter.algorithm}}",
+    "access_token_expire_minutes": "{{cookiecutter.access_token_expire_minutes}}"
+}

cookiecutter/auth/{{cookiecutter.auth}}/acls.py

@@ -0,0 +1,17 @@
+from sowba.security.acl import Acl
+
+
+class CreateItemAcl:
+    __acl__ = [
+        Acl(Allow, "role:user", "create"),
+        Acl(Allow, "role:admin", "create"),
+    ]
+
+
+@dcls.dataclass
+class AclPolicy:
+    get: Callable = None
+    create: CreateItemAcl = None
+
+
+default_acl_policy = AclPolicy(create=CreateItemAcl)

cookiecutter/app/auth/{{cookiecutter.app}}/{{cookiecutter.app}}/services/auth/model.py → cookiecutter/auth/{{cookiecutter.auth}}/model.py

@@ -1,13 +1,13 @@
 from typing import List
 from datetime import datetime
 from contextvars import ContextVar
-from sowba.storage.utils import init_db, get_db
 from pydantic import BaseModel, Field, SecretStr, EmailStr
 from fastapi_permissions import Allow
+from sowba.security import roles
 
 
 class UserPrincipals(BaseModel):
-    principals: List[str] = ["role:user"]
+    principals: List[str] = [roles.user]
 
 
 class Updateprincipals(BaseModel):
@@ -56,9 +56,9 @@ class TokenData(BaseModel):
 
 
 class UserListAcl:
-    __acl__ = [(Allow, "role:admin", "view")]
+    __acl__ = [(Allow, roles.admin, "view")]
 
 
 class UserprincipalsAcl:
-    __acl__ = [(Allow, "role:admin", "update")]
+    __acl__ = [(Allow, roles.admin, "update")]
 

pyproject.toml

@@ -15,6 +15,7 @@ python-rocksdb = "^0.7.0"
 devtools = {extras = ["pygments"], version = "^0.6"}
 pyjwt = "^1.7.1"
 passlib = {extras = ["bcrypt"], version = "^1.7.2"}
+fastapi_permissions = "^0.2.6"
 
 [tool.poetry.dev-dependencies]
 pytest = "^5.2"

snippets/compass/compass/services/auth/__init__.py

@@ -1,3 +0,0 @@
-from sowba.core.utils import get_service_router
-
-router = get_service_router("users")

snippets/compass/compass/services/auth/acls.py

@@ -1,12 +1,4 @@
-from typing import List, Callable
-import dataclasses as dcls
-from collections import namedtuple
-from fastapi_permissions import Allow, Authenticated
-from pydantic import BaseModel
-
-
-class Acl(namedtuple("Acl", ("access", "principal", "permission"))):
-    __slots__ = ()
+from sowba.security.acl import Acl
 
 
 class CreateItemAcl:
@@ -22,18 +14,4 @@ class AclPolicy:
     create: CreateItemAcl = None
 
 
-class BaseResourceAcl(BaseModel):
-    def __acl__(self):
-        assert self.owner is not None, "Owner must be define."
-        return [
-            Acl(Allow, "role:user", "create"),
-            Acl(Allow, "role:admin", "create"),
-            Acl(Allow, Authenticated, "view"),
-            Acl(Allow, "role:admin", "update"),
-            Acl(Allow, f"user:{self.owner}", "update"),
-            Acl(Allow, "role:admin", "delete"),
-            Acl(Allow, f"user:{self.owner}", "delete"),
-        ]
-
-
 default_acl_policy = AclPolicy(create=CreateItemAcl)

snippets/compass/compass/services/auth/model.py

@@ -1,13 +1,13 @@
 from typing import List
 from datetime import datetime
 from contextvars import ContextVar
-from sowba.storage.utils import init_db, get_db
 from pydantic import BaseModel, Field, SecretStr, EmailStr
 from fastapi_permissions import Allow
+from sowba.security import roles
 
 
 class UserPrincipals(BaseModel):
-    principals: List[str] = ["role:user"]
+    principals: List[str] = [roles.user]
 
 
 class Updateprincipals(BaseModel):
@@ -56,9 +56,9 @@ class TokenData(BaseModel):
 
 
 class UserListAcl:
-    __acl__ = [(Allow, "role:admin", "view")]
+    __acl__ = [(Allow, roles.admin, "view")]
 
 
 class UserprincipalsAcl:
-    __acl__ = [(Allow, "role:admin", "update")]
+    __acl__ = [(Allow, roles.admin, "update")]
 

snippets/compass/config.json

@@ -8,14 +8,6 @@
                 "model": "compass.services.items.model.Items",
                 "connector": "rocksdb"
             }
-        },
-        {
-            "name": "member",
-            "status": "enable",
-            "storage": {
-                "model": "compass.services.member.model.Member",
-                "connector": "rocksdb"
-            }
         }
     ],
     "storages": {
@@ -41,17 +33,6 @@
             }
         ]
     },
-    "auth": {
-        "admin": {
-            "username": "admin",
-            "email": "[email protected]"
-        },
-        "security": {
-            "algorithm": "HS256",
-            "access_token_expire_minutes": 30,
-            "auth_path": "/token"
-        }
-    },
     "asgi": {
         "host": "0.0.0.0",
         "port": 8000,
@@ -71,5 +52,13 @@
         "allow_methods": [
             "*"
         ]
+    },
+    "auth": {
+        "storage": {
+            "model": "compass.services.auth.model.User",
+            "connector": "rocksdb"
+        },
+        "algorithm": "HS256",
+        "access_token_expire_minutes": 30
     }
 }