app.services.dev_roles

Role names of the loaded catalog, for the dev-login presets.

Used only by the dev-only GET /auth/dev/roles (app.routers.auth_dev, mounted only when dev auth is enabled). It lists the rbac roles with their permissions and the role names the approval policy accepts as reviewers – never the reviewer users (issuer|subject pairs), which a sign-in preset cannot use anyway.

Public API: DevRole, DevRoleCatalog, dev_role_catalog().

class app.services.dev_roles.DevRole(name, permissions)

Bases: object

One rbac role.

Parameters:

  • name (str) – Role name as it appears in the roles claim.

  • permissions (tuple[Permission, ...]) – Permissions it grants, sorted.

name: str
permissions: tuple[Permission, ...]
class app.services.dev_roles.DevRoleCatalog(roles, reviewer_roles)

Bases: object

The role names a dev sign-in can usefully assert.

Parameters:

  • roles (tuple[DevRole, ...]) – rbac roles, sorted by name.

  • reviewer_roles (tuple[str, ...]) – Approval-policy reviewer roles, sorted.

roles: tuple[DevRole, ...]
reviewer_roles: tuple[str, ...]
app.services.dev_roles.dev_role_catalog(config)

Collect the role names of the loaded catalog.

Parameters:

config (CatalogConfig | None) – The loaded configuration, or None when the app lifespan did not run.

Return type:

DevRoleCatalog

Returns:

The rbac roles and the reviewer roles; both empty when nothing was loaded. Reviewer roles are empty when the policy is missing or invalid.