-
Notifications
You must be signed in to change notification settings - Fork 4
Expand file tree
/
Copy pathinterceptor.py
More file actions
76 lines (59 loc) · 2.42 KB
/
Copy pathinterceptor.py
File metadata and controls
76 lines (59 loc) · 2.42 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
import typing as t
from functools import partial
from ellar.common import APIException, EllarInterceptor, IExecutionContext, constants
from ellar.core.services import reflector
from ellar.di import injectable
from starlette import status
from .constants import POLICY_KEYS
from .policy import Policy, PolicyType
@injectable
class AuthorizationInterceptor(EllarInterceptor):
"""
Interceptor responsible for handling request authorization.
Verifies user authentication and evaluates policies required for route access.
"""
status_code = status.HTTP_403_FORBIDDEN
exception_class = APIException
__slots__ = ()
@t.no_type_check
def get_route_handler_policy(
self, context: IExecutionContext
) -> t.Optional[t.List[t.Union[PolicyType, str]]]:
"""
Retrieves policy requirements for the current route handler.
"""
return context.get_app().reflector.get_all_and_override(
POLICY_KEYS, context.get_handler(), context.get_class()
)
def _get_policy_instance(
self, context: IExecutionContext, policy: t.Union[t.Type, t.Any, str]
) -> t.Union[Policy, t.Any]:
if isinstance(policy, type):
return context.get_service_provider().get(policy)
return policy
async def intercept(
self, context: IExecutionContext, next_interceptor: t.Callable[..., t.Coroutine]
) -> t.Any:
"""
Intercepts the request to enforce authorization logic.
- Checks if `@SkipAuth` is present.
- Verifies if the user is authenticated.
- Evaluates any registered policies.
"""
skip_auth = reflector.get_all_and_override(
constants.SKIP_AUTH, context.get_handler(), context.get_class()
)
if skip_auth is True:
return await next_interceptor()
if not context.user.is_authenticated:
raise self.exception_class(status_code=401)
policies = self.get_route_handler_policy(context)
if policies:
partial_get_policy_instance = partial(self._get_policy_instance, context)
for policy in map(partial_get_policy_instance, policies):
result = await policy.handle(context)
if not result:
self.raise_exception()
return await next_interceptor()
def raise_exception(self) -> None:
raise self.exception_class(status_code=self.status_code)