Authentication and Authorization - #104

import base64
import pickle
import typing as t

from ellar.auth.handlers import HeaderAPIKeyAuthenticationHandler
from ellar.auth.identity import UserIdentity
from ellar.common import AnonymousIdentity, Identity, IHostContext
from ellar.di import injectable
from ellar.auth import BasePolicyHandler


@injectable
class SimpleHeaderAuthHandler(HeaderAPIKeyAuthenticationHandler):
    async def authentication_handler(
        self, context: IHostContext, key: str
    ) -> t.Optional[Identity]:
        data = pickle.loads(base64.b64decode(key))
        if isinstance(data, dict):
            return UserIdentity(auth_type="token", **data)
        return AnonymousIdentity()



@injectable
class CheckUserFirstName(BasePolicyHandler):
    async def handle(self, context: IHostContext) -> bool:
        return context.user.first_name == 'ellar'

from ellar.auth import Authorization, AuthorizationGuard, Policy
from ellar.common import Controller, get

from .requirement import CheckUserFirstName


@Controller("/article")
@UseGuards(AuthorizationGuard)
class ArticleController:
    @get("/create")
    @CheckPolicies(RequiredClaimsPolicy("article", "create", "publish"))
    async def create_and_publish(self):
        return "Accessible to user with article claim of values 'create' or 'publish'"

    @get("/admin-only")
    @CheckPolicies(RequiredRolePolicy("admin"))
    async def admin_only(self):
        return "Endpoint is accessible to only admins"

    @get("/staff-only")
    @CheckPolicies(RequiredRolePolicy("admin") | RequiredRolePolicy("staff"))
    async def staff_only(self):
        return "Endpoint is accessible to both staff and admin users"

    @get("/ellar-first-name")
    @CheckPolicies(CheckUserFirstName])
    async def ellar_first_name(self):
        return "Accessible to user with first name == ellar"

## Server
app = AppFactory.create_application()
app.add_authentication_schemes(SimpleHeaderAuthHandler)