angee.iam.roles

IAM permission-hub role and grant computations.

PermissionSources

@dataclass(frozen=True, slots=True)
class PermissionSources()

Flattened REBAC permission-expression leaves for the IAM console.

RoleInfo

@dataclass(frozen=True, slots=True)
class RoleInfo()

Tuple-derived role projected by the IAM permission hub.

from_relationships

@classmethod
def from_relationships(cls, rows: QuerySet[Any]) -> list[RoleInfo]

Return distinct role types from relationship rows.

GrantInfo

@dataclass(frozen=True, slots=True)
class GrantInfo()

Direct user role grant projected by the IAM permission hub.

from_relationships

@classmethod
def from_relationships(cls,
                       rows: QuerySet[Any],
                       *,
                       request: HttpRequest | None = None) -> list[GrantInfo]

Project direct user role-grant tuples with batched principal labels.

RelationInfo

@dataclass(frozen=True, slots=True)
class RelationInfo()

Installed REBAC relation declaration.

PermissionConditionInfo

@dataclass(frozen=True, slots=True)
class PermissionConditionInfo()

Flattened permission expression leaf.

PermissionInfo

@dataclass(frozen=True, slots=True)
class PermissionInfo()

Installed REBAC permission declaration.

ResourceSchemaInfo

@dataclass(frozen=True, slots=True)
class ResourceSchemaInfo()

Installed REBAC resource definition projected for IAM.

OverviewNamespaceInfo

@dataclass(frozen=True, slots=True)
class OverviewNamespaceInfo()

Namespace aggregate shown by the IAM overview.

OverviewInfo

@dataclass(frozen=True, slots=True)
class OverviewInfo()

IAM dashboard facts computed by the IAM role owner.

build

@classmethod
def build(cls,
          peek_limit: int,
          *,
          request: HttpRequest | None = None) -> OverviewInfo

Return IAM dashboard facts independent of paginated list rows.

role_namespace

def role_namespace(resource_type: str) -> str

Return the namespace portion of a role resource type.

is_role_type

def is_role_type(resource_type: str) -> bool

Return whether resource_type names a role resource.

role_label

def role_label(role_id: str) -> str

Return a display label for a role id.

role_ref

def role_ref(resource_type: str, resource_id: str) -> str

Return the canonical role object ref string.

validate_role

def validate_role(value: str) -> ObjectRef

Return value as a role object ref or raise.

relationship_rows

def relationship_rows(
        limit: int | None = PERMISSION_HUB_LIST_CAP) -> QuerySet[Any]

Return active relationship rows in stable order.

permission_hub_roles

def permission_hub_roles(
        limit: int | None = PERMISSION_HUB_LIST_CAP) -> list[RoleInfo]

Return roles visible from active role relationship rows.

permission_hub_role_rows

def permission_hub_role_rows(
        limit: int | None = PERMISSION_HUB_LIST_CAP) -> QuerySet[Any]

Return relationship rows that mention schema-declared role objects.

permission_hub_grants

def permission_hub_grants(
        *,
        request: HttpRequest | None = None,
        limit: int | None = PERMISSION_HUB_LIST_CAP) -> list[GrantInfo]

Return direct user role grants with principal labels batched.

permission_hub_grant_rows

def permission_hub_grant_rows(
        limit: int | None = PERMISSION_HUB_LIST_CAP) -> QuerySet[Any]

Return direct user role-grant rows in stable order.

schema_role_resource_types

def schema_role_resource_types() -> set[str]

Return role resource types declared by the installed REBAC schema.

schema_allowed_subject_name

def schema_allowed_subject_name(allowed: Any) -> str

Return one relation allowed-subject declaration as a compact string.

permission_sources

def permission_sources(schema: Schema, resource_type: str,
                       permission_name: str) -> PermissionSources

Return flattened source labels for a REBAC permission expression.

roles_reaching_permission

def roles_reaching_permission(
        schema: Schema, resource_type: str, permission_name: str, *,
        role_resource_type: str) -> tuple[ObjectRef, ...]

Return schema-named role objects that can feed one permission.

_MutablePermissionSources

@dataclass(slots=True)
class _MutablePermissionSources()

freeze

def freeze() -> PermissionSources

Return an immutable projection.

permission_conditions

def permission_conditions(
        schema: Any, resource_type: str,
        permission_name: str) -> list[PermissionConditionInfo]

Return source condition labels for a REBAC permission.

permission_schema

def permission_schema() -> list[ResourceSchemaInfo]

Return the installed REBAC schema projected for the IAM console.

iam_overview

def iam_overview(peek_limit: int,
                 *,
                 request: HttpRequest | None = None) -> OverviewInfo

Return IAM dashboard facts independent of paginated list rows.

clamped_peek_limit

def clamped_peek_limit(value: int) -> int

Return a bounded overview preview size.

overview_namespaces

def overview_namespaces(roles: list[RoleInfo],
                        grants: QuerySet[Any]) -> list[OverviewNamespaceInfo]

Return namespace-level role and direct-grant counts.

unassigned_user_queryset

def unassigned_user_queryset() -> QuerySet[Any]

Return users without direct role grants.

user_subject_lookup

def user_subject_lookup(user_model: type[Any] | None = None) -> str

Return the User field lookup used by REBAC actor subject ids.

user_ordering

def user_ordering(user_model: type[Any] | None = None) -> tuple[str, ...]

Return deterministic ordering for IAM overview user previews.

privileged_role_refs

def privileged_role_refs() -> set[str]

Return role refs that the installed REBAC schema treats as privileged.