app.auth.rbac

Authorization rules: role permissions and reviewer eligibility.

Permissions (read, operate) come from the rbac section of catalog.yaml (RbacConfig). A missing or invalid rbac section grants nothing (deny by default); the loader reports it as a configuration problem (check-config) and /healthz reports rbac: empty.

Reviewing is not a permission: eligibility comes from the approval policy (app.domain.approval.is_eligible()). Read permission never implies review. reviewer_eligibility() phrases the result for GET /api/v1/me and for the decision endpoint (phase 07).

Public API: Permission and RbacConfig (re-exported from app.catalog_config), ReviewerEligibility, permissions_for(), reviewer_eligibility().

class app.auth.rbac.Permission(*values)

Bases: StrEnum

Permissions an IdP role can grant (review comes from the policy).

READ = 'read'

OPERATE = 'operate'

class app.auth.rbac.RbacConfig(roles=dict())

Bases: object

IdP role -> permissions mapping.

Parameters:

roles (Mapping[str, frozenset[Permission]]) – Permissions granted per role name.

roles: Mapping[str, frozenset[Permission]]

permissions_for(roles)

Collect the permissions granted by a caller’s roles.

Parameters:

roles (Iterable[str]) – Role names from the verified token.

Return type:

frozenset[Permission]

Returns:

The union of granted permissions.

class app.auth.rbac.ReviewerEligibility(eligible, reason)

Bases: object

Whether a caller may record approval decisions, and why.

Parameters:

• eligible (bool) – True if the policy lists the caller.

• reason (str) – Readable explanation (no secrets).

eligible: bool

reason: str

app.auth.rbac.permissions_for(rbac, roles)

Collect the permissions a caller’s roles grant.

Parameters:

• rbac (RbacConfig | None) – The role mapping, or None when no configuration was loaded (grants nothing).

• roles (Iterable[str]) – Role names from the verified token.

Return type:

frozenset[Permission]

Returns:

The granted permissions.

app.auth.rbac.reviewer_eligibility(policy, *, issuer, subject, roles)

Evaluate reviewer eligibility under the configured approval policy.

Parameters:

• policy (PolicyConfig | None) – The policy status, or None when no configuration was loaded.

• issuer (str) – Caller’s verified token issuer.

• subject (str) – Caller’s verified token subject.

• roles (Iterable[str]) – Caller’s verified roles.

Return type:

ReviewerEligibility

Returns:

Eligibility with a reason.