angee.iam.permissions

GraphQL access control for Angee IAM.

iam owns "who is a platform admin", so the platform-admin GraphQL gate lives here — not buried in iam.schema — and downstream addons (e.g. integrate) import it without pulling in iam's whole schema module. Also the home of the small request/auth context helpers shared between the permission and iam's resolvers.

request_from_info

def request_from_info(info: strawberry.Info) -> HttpRequest

Return the Django request from Strawberry's context.

is_authenticated

def is_authenticated(user: Any) -> bool

Return whether user is a real authenticated session user.

session_user

def session_user(info: strawberry.Info) -> Any

Return the authenticated session user or raise a REBAC denial.

The shared "this resolver requires a signed-in user" gate; iam's resolvers and downstream self-service mutations (e.g. integrate) use it so the anonymous-deny check lives in exactly one place.

is_platform_admin

def is_platform_admin(user: Any) -> bool

Return whether user reaches IAM's platform-admin role.

current_actor_has_role

def current_actor_has_role(role: ObjectRef) -> bool

Return whether the ambient REBAC actor is an effective member of role.

require_platform_admin

def require_platform_admin(info: strawberry.Info) -> Any

Return the session user or raise when it lacks platform-admin reach.

RolePermission

class RolePermission(BasePermission)

Allow actors that reach role_ref through effective_member.

has_permission

def has_permission(source: Any, info: strawberry.Info, **kwargs: Any) -> bool

Return whether the current actor reaches the configured role.

PlatformAdminPermission

class PlatformAdminPermission(RolePermission)

Allow only actors that reach IAM's const-backed platform admin role.

has_permission

def has_permission(source: Any, info: strawberry.Info, **kwargs: Any) -> bool

Return whether the request user has platform-admin reach.