fix: role-based control #122

Author: fabidick22

commons/data_access_layer/database.py

@@ -33,7 +33,7 @@ def delete(self, id):
         raise NotImplementedError  # pragma: no cover
 
 
-class EventContext():
+class EventContext:
     def __init__(self, container_id: str, action: str, description: str = None,
                  user_id: str = None, tenant_id: str = None, session_id: str = None,
                  app_id: str = None):

time_tracker_api/database.py

@@ -11,7 +11,7 @@
 
 from commons.data_access_layer.cosmos_db import CosmosDBDao
 from commons.data_access_layer.database import EventContext
-from time_tracker_api.security import current_user_id, current_user_tenant_id
+from time_tracker_api.security import current_user_id, current_user_tenant_id, current_role_user, roles
 
 
 class CRUDDao(abc.ABC):
@@ -37,10 +37,11 @@ def delete(self, id):
 
 
 class ApiEventContext(EventContext):
-    def __init__(self, container_id: str, action: str, description: str = None,
-                 user_id: str = None, tenant_id: str = None, session_id: str = None):
+    def __init__(self, container_id: str, action: str, description: str = None, user_id: str = None,
+                 tenant_id: str = None, session_id: str = None, user_role: str = None):
         super(ApiEventContext, self).__init__(container_id, action, description)
         self._user_id = user_id
+        self._user_role = user_role
         self._tenant_id = tenant_id
         self._session_id = session_id
 
@@ -50,6 +51,10 @@ def user_id(self) -> str:
             self._user_id = current_user_id()
         return self._user_id
 
+    @property
+    def user_role(self) -> str:
+        return self._user_role if self._user_role else current_role_user()
+
     @property
     def tenant_id(self) -> str:
         if self._tenant_id is None:
@@ -60,6 +65,10 @@ def tenant_id(self) -> str:
     def session_id(self) -> str:
         return self._session_id
 
+    @property
+    def is_admin(self):
+        return True if self.user_role == roles.get("admin").get("name") else False
+
 
 class APICosmosDBDao(CosmosDBDao):
     def create_event_context(self, action: str = None, description: str = None):

time_tracker_api/security.py

@@ -29,6 +29,13 @@
 
 iss_claim_pattern = re.compile(r"(.*).b2clogin.com/(?P<tenant_id>%s)" % UUID_REGEX)
 
+default_role = frozenset({"client-role"})
+
+roles = {
+    "admin": {"name": "time-tracker-admin"},
+    "client": {"name": "client-role"}
+}
+
 
 def current_user_id() -> str:
     oid_claim = get_token_json().get("oid")
@@ -38,6 +45,11 @@ def current_user_id() -> str:
     return oid_claim
 
 
+def current_role_user() -> str:
+    role_user = get_token_json().get("extension_role", None)
+    return role_user if role_user else roles.get("client").get("name")
+
+
 def current_user_tenant_id() -> str:
     iss_claim = get_token_json().get("iss")
     if iss_claim is None: