741 permissions refactoring

backend/api_handler.py

@@ -16,10 +16,9 @@
 from dataall.base.aws.sqs import SqsQueue
 from dataall.base.aws.parameter_store import ParameterStoreManager
 from dataall.base.context import set_context, dispose_context, RequestContext
-from dataall.core.permissions.db import save_permissions_with_tenant
-from dataall.core.permissions.db.tenant_policy_repositories import TenantPolicy
+from dataall.core.permissions.services.tenant_policy_service import TenantPolicyService
 from dataall.base.db import get_engine
-from dataall.core.permissions import permissions
+from dataall.core.permissions.services.tenant_permissions import TENANT_ALL
 from dataall.base.loader import load_modules, ImportMode
 
 logger = logging.getLogger()
@@ -38,7 +37,7 @@
 ENGINE = get_engine(envname=ENVNAME)
 Worker.queue = SqsQueue.send
 
-save_permissions_with_tenant(ENGINE)
+TenantPolicyService.save_permissions_with_tenant(ENGINE)
 
 
 def resolver_adapter(resolver):
@@ -143,14 +142,14 @@ def handler(event, context):
             log.debug('groups are %s', ','.join(groups))
             with ENGINE.scoped_session() as session:
                 for group in groups:
-                    policy = TenantPolicy.find_tenant_policy(session, group, 'dataall')
+                    policy = TenantPolicyService.find_tenant_policy(session, group, TenantPolicyService.TENANT_NAME)
                     if not policy:
                         print(f'No policy found for Team {group}. Attaching TENANT_ALL permissions')
-                        TenantPolicy.attach_group_tenant_policy(
+                        TenantPolicyService.attach_group_tenant_policy(
                             session=session,
                             group=group,
-                            permissions=permissions.TENANT_ALL,
-                            tenant_name='dataall',
+                            permissions=TENANT_ALL,
+                            tenant_name=TenantPolicyService.TENANT_NAME,
                         )
 
         except Exception as e:

backend/dataall/core/environment/api/resolvers.py

@@ -16,19 +16,28 @@
 from dataall.core.environment.services.environment_resource_manager import EnvironmentResourceManager
 from dataall.core.environment.services.environment_service import EnvironmentService
 from dataall.core.environment.api.enums import EnvironmentPermission
-from dataall.core.permissions.db.resource_policy_repositories import ResourcePolicy
+from dataall.core.permissions.services.resource_policy_service import ResourcePolicyService
 from dataall.core.stacks.api import stack_helper
 from dataall.core.stacks.aws.cloudformation import CloudFormation
 from dataall.core.stacks.db.stack_repositories import Stack
 from dataall.core.vpc.services.vpc_service import VpcService
 from dataall.base.aws.ec2_client import EC2
-from dataall.core.permissions import permissions
 from dataall.base.feature_toggle_checker import is_feature_enabled
 from dataall.base.utils.naming_convention import (
     NamingConventionService,
     NamingConventionPattern,
 )
+
 from dataall.core.organizations.api.resolvers import Context, exceptions, get_organization_simplified
+from dataall.core.permissions.services.environment_permissions import (
+    CREDENTIALS_ENVIRONMENT,
+    ENABLE_ENVIRONMENT_SUBSCRIPTIONS,
+)
+from dataall.core.permissions.services.organization_permissions import (
+    GET_ORGANIZATION,
+    LINK_ENVIRONMENT,
+)
+
 
 log = logging.getLogger()
 
@@ -92,7 +101,7 @@ def check_environment(context: Context, source, account_id, region, data):
 def create_environment(context: Context, source, input={}):
     if input.get('SamlGroupName') and input.get('SamlGroupName') not in context.groups:
         raise exceptions.UnauthorizedOperation(
-            action=permissions.LINK_ENVIRONMENT,
+            action=LINK_ENVIRONMENT,
             message=f'User: {context.username} is not a member of the group {input["SamlGroupName"]}',
         )
 
@@ -122,7 +131,7 @@ def create_environment(context: Context, source, input={}):
 def update_environment(context: Context, source, environmentUri: str = None, input: dict = None):
     if input.get('SamlGroupName') and input.get('SamlGroupName') not in context.groups:
         raise exceptions.UnauthorizedOperation(
-            action=permissions.LINK_ENVIRONMENT,
+            action=LINK_ENVIRONMENT,
             message=f'User: {context.username} is not part of the group {input["SamlGroupName"]}',
         )
 
@@ -442,12 +451,12 @@ def get_environment_assume_role_url(
     groupUri: str = None,
 ):
     with context.engine.scoped_session() as session:
-        ResourcePolicy.check_user_resource_permission(
+        ResourcePolicyService.check_user_resource_permission(
             session=session,
             username=context.username,
             groups=context.groups,
             resource_uri=environmentUri,
-            permission_name=permissions.CREDENTIALS_ENVIRONMENT,
+            permission_name=CREDENTIALS_ENVIRONMENT,
         )
         environment = EnvironmentService.get_environment_by_uri(session, environmentUri)
         url = SessionHelper.get_console_access_url(
@@ -466,12 +475,12 @@ def get_environment_assume_role_url(
 @is_feature_enabled('core.features.env_aws_actions')
 def generate_environment_access_token(context, source, environmentUri: str = None, groupUri: str = None):
     with context.engine.scoped_session() as session:
-        ResourcePolicy.check_user_resource_permission(
+        ResourcePolicyService.check_user_resource_permission(
             session=session,
             username=context.username,
             groups=context.groups,
             resource_uri=environmentUri,
-            permission_name=permissions.CREDENTIALS_ENVIRONMENT,
+            permission_name=CREDENTIALS_ENVIRONMENT,
         )
         environment = EnvironmentService.get_environment_by_uri(session, environmentUri)
         c = _get_environment_group_aws_session(
@@ -514,12 +523,12 @@ def delete_environment(context: Context, source, environmentUri: str = None, del
 
 def enable_subscriptions(context: Context, source, environmentUri: str = None, input: dict = None):
     with context.engine.scoped_session() as session:
-        ResourcePolicy.check_user_resource_permission(
+        ResourcePolicyService.check_user_resource_permission(
             session=session,
             username=context.username,
             groups=context.groups,
             resource_uri=environmentUri,
-            permission_name=permissions.ENABLE_ENVIRONMENT_SUBSCRIPTIONS,
+            permission_name=ENABLE_ENVIRONMENT_SUBSCRIPTIONS,
         )
         environment = EnvironmentService.get_environment_by_uri(session, environmentUri)
         if input.get('producersTopicArn'):
@@ -549,12 +558,12 @@ def enable_subscriptions(context: Context, source, environmentUri: str = None, i
 
 def disable_subscriptions(context: Context, source, environmentUri: str = None):
     with context.engine.scoped_session() as session:
-        ResourcePolicy.check_user_resource_permission(
+        ResourcePolicyService.check_user_resource_permission(
             session=session,
             username=context.username,
             groups=context.groups,
             resource_uri=environmentUri,
-            permission_name=permissions.ENABLE_ENVIRONMENT_SUBSCRIPTIONS,
+            permission_name=ENABLE_ENVIRONMENT_SUBSCRIPTIONS,
         )
         environment = EnvironmentService.get_environment_by_uri(session, environmentUri)
 
@@ -572,12 +581,12 @@ def get_pivot_role_template(context: Context, source, organizationUri=None):
     from dataall.base.utils import Parameter
 
     with context.engine.scoped_session() as session:
-        ResourcePolicy.check_user_resource_permission(
+        ResourcePolicyService.check_user_resource_permission(
             session=session,
             username=context.username,
             groups=context.groups,
             resource_uri=organizationUri,
-            permission_name=permissions.GET_ORGANIZATION,
+            permission_name=GET_ORGANIZATION,
         )
         pivot_role_bucket = Parameter().get_parameter(
             env=os.getenv('envname', 'local'), path='s3/resources_bucket_name'
@@ -612,12 +621,12 @@ def get_pivot_role_template(context: Context, source, organizationUri=None):
 
 def get_cdk_exec_policy_template(context: Context, source, organizationUri=None):
     with context.engine.scoped_session() as session:
-        ResourcePolicy.check_user_resource_permission(
+        ResourcePolicyService.check_user_resource_permission(
             session=session,
             username=context.username,
             groups=context.groups,
             resource_uri=organizationUri,
-            permission_name=permissions.GET_ORGANIZATION,
+            permission_name=GET_ORGANIZATION,
         )
         cdk_exec_policy_bucket = Parameter().get_parameter(
             env=os.getenv('envname', 'local'), path='s3/resources_bucket_name'
@@ -652,12 +661,12 @@ def get_cdk_exec_policy_template(context: Context, source, organizationUri=None)
 
 def get_external_id(context: Context, source, organizationUri=None):
     with context.engine.scoped_session() as session:
-        ResourcePolicy.check_user_resource_permission(
+        ResourcePolicyService.check_user_resource_permission(
             session=session,
             username=context.username,
             groups=context.groups,
             resource_uri=organizationUri,
-            permission_name=permissions.GET_ORGANIZATION,
+            permission_name=GET_ORGANIZATION,
         )
         external_id = SessionHelper.get_external_id_secret()
         if not external_id:
@@ -670,12 +679,12 @@ def get_external_id(context: Context, source, organizationUri=None):
 
 def get_pivot_role_name(context: Context, source, organizationUri=None):
     with context.engine.scoped_session() as session:
-        ResourcePolicy.check_user_resource_permission(
+        ResourcePolicyService.check_user_resource_permission(
             session=session,
             username=context.username,
             groups=context.groups,
             resource_uri=organizationUri,
-            permission_name=permissions.GET_ORGANIZATION,
+            permission_name=GET_ORGANIZATION,
         )
         pivot_role_name = SessionHelper.get_delegation_role_name()
         if not pivot_role_name:

backend/dataall/core/environment/env_permission_checker.py

@@ -1,11 +1,11 @@
 from dataall.base.context import get_context, RequestContext
-from dataall.core.permissions.db.group_policy_repositories import GroupPolicy
 from dataall.base.utils.decorator_utls import process_func
+from dataall.core.permissions.services.group_policy_service import GroupPolicyService
 
 
 def _check_group_environment_permission(session, permission, uri, admin_group):
     context: RequestContext = get_context()
-    GroupPolicy.check_group_environment_permission(
+    GroupPolicyService.check_group_environment_permission(
         session=session,
         username=context.username,
         groups=context.groups,