ACL uses enums, some more tests, other stuff.

[python_utils.git] / acl.py

diff --git a/acl.py b/acl.py
index 5040304a7913fe4e452ceb2dc5ef5f2a76b36491..e6bb9033f89319eb986adab2574a59171dbe899d 100644 (file)
--- a/acl.py
+++ b/acl.py
@@ -1,17 +1,25 @@
 #!/usr/bin/env python3
 
 from abc import ABC, abstractmethod
+import enum
 import fnmatch
 import logging
 import re
 from typing import Any, Callable, List, Optional, Set
 
+# This module is commonly used by others in here and should avoid
+# taking any unnecessary dependencies back on them.
 
 logger = logging.getLogger(__name__)
 
 
-ACL_ORDER_ALLOW_DENY = 1
-ACL_ORDER_DENY_ALLOW = 2
+class Order(enum.Enum):
+    """A helper to express the order of evaluation for allows/denies
+    in an Access Control List.
+    """
+    UNDEFINED = 0
+    ALLOW_DENY = 1
+    DENY_ALLOW = 2
 
 
 class SimpleACL(ABC):
@@ -20,22 +28,22 @@ class SimpleACL(ABC):
     def __init__(
         self,
         *,
-        order_to_check_allow_deny: int,
+        order_to_check_allow_deny: Order,
         default_answer: bool
     ):
         if order_to_check_allow_deny not in (
-                ACL_ORDER_ALLOW_DENY, ACL_ORDER_DENY_ALLOW
+                Order.ALLOW_DENY, Order.DENY_ALLOW
         ):
             raise Exception(
-                'order_to_check_allow_deny must be ACL_ORDER_ALLOW_DENY or ' +
-                'ACL_ORDER_DENY_ALLOW')
+                'order_to_check_allow_deny must be Order.ALLOW_DENY or ' +
+                'Order.DENY_ALLOW')
         self.order_to_check_allow_deny = order_to_check_allow_deny
         self.default_answer = default_answer
 
     def __call__(self, x: Any) -> bool:
         """Returns True if x is allowed, False otherwise."""
         logger.debug(f'SimpleACL checking {x}')
-        if self.order_to_check_allow_deny == ACL_ORDER_ALLOW_DENY:
+        if self.order_to_check_allow_deny == Order.ALLOW_DENY:
             logger.debug('Checking allowed first...')
             if self.check_allowed(x):
                 logger.debug(f'{x} was allowed explicitly.')
@@ -44,7 +52,7 @@ class SimpleACL(ABC):
             if self.check_denied(x):
                 logger.debug(f'{x} was denied explicitly.')
                 return False
-        elif self.order_to_check_allow_deny == ACL_ORDER_DENY_ALLOW:
+        elif self.order_to_check_allow_deny == Order.DENY_ALLOW:
             logger.debug('Checking denied first...')
             if self.check_denied(x):
                 logger.debug(f'{x} was denied explicitly.')
@@ -76,7 +84,7 @@ class SetBasedACL(SimpleACL):
                  *,
                  allow_set: Optional[Set[Any]] = None,
                  deny_set: Optional[Set[Any]] = None,
-                 order_to_check_allow_deny: int,
+                 order_to_check_allow_deny: Order,
                  default_answer: bool) -> None:
         super().__init__(
             order_to_check_allow_deny=order_to_check_allow_deny,
@@ -96,13 +104,39 @@ class SetBasedACL(SimpleACL):
         return x in self.deny_set
 
 
+class AllowListACL(SetBasedACL):
+    """Convenience subclass for a list that only allows known items.
+    i.e. a 'whitelist'
+    """
+    def __init__(self,
+                 *,
+                 allow_set: Optional[Set[Any]]) -> None:
+        super().__init__(
+            allow_set = allow_set,
+            order_to_check_allow_deny = Order.ALLOW_DENY,
+            default_answer = False)
+
+
+class DenyListACL(SetBasedACL):
+    """Convenience subclass for a list that only disallows known items.
+    i.e. a 'blacklist'
+    """
+    def __init__(self,
+                 *,
+                 deny_set: Optional[Set[Any]]) -> None:
+        super().__init__(
+            deny_set = deny_set,
+            order_to_check_allow_deny = Order.ALLOW_DENY,
+            default_answer = True)
+
+
 class PredicateListBasedACL(SimpleACL):
     """An ACL that allows or denies by applying predicates."""
     def __init__(self,
                  *,
                  allow_predicate_list: List[Callable[[Any], bool]] = None,
                  deny_predicate_list: List[Callable[[Any], bool]] = None,
-                 order_to_check_allow_deny: int,
+                 order_to_check_allow_deny: Order,
                  default_answer: bool) -> None:
         super().__init__(
             order_to_check_allow_deny=order_to_check_allow_deny,
@@ -128,7 +162,7 @@ class StringWildcardBasedACL(PredicateListBasedACL):
                  *,
                  allowed_patterns: Optional[List[str]] = None,
                  denied_patterns: Optional[List[str]] = None,
-                 order_to_check_allow_deny: int,
+                 order_to_check_allow_deny: Order,
                  default_answer: bool) -> None:
         allow_predicates = []
         if allowed_patterns is not None:
@@ -158,7 +192,7 @@ class StringREBasedACL(PredicateListBasedACL):
                  *,
                  allowed_regexs: Optional[List[re.Pattern]] = None,
                  denied_regexs: Optional[List[re.Pattern]] = None,
-                 order_to_check_allow_deny: int,
+                 order_to_check_allow_deny: Order,
                  default_answer: bool) -> None:
         allow_predicates = None
         if allowed_regexs is not None:
@@ -182,21 +216,49 @@ class StringREBasedACL(PredicateListBasedACL):
         )
 
 
-class AnyCompoundACL(object):
+class AnyCompoundACL(SimpleACL):
     """An ACL that allows if any of its subacls allow."""
-    def __init__(self, subacls: List[SimpleACL]):
-        assert subacls is not None
+    def __init__(self,
+                 *,
+                 subacls: Optional[List[SimpleACL]] = None,
+                 order_to_check_allow_deny: Order,
+                 default_answer: bool) -> None:
+        super().__init__(
+            order_to_check_allow_deny = order_to_check_allow_deny,
+            default_answer = default_answer
+        )
         self.subacls = subacls
 
-    def __call__(self, x: Any):
+    def check_allowed(self, x: Any) -> bool:
+        if self.subacls is None:
+            return False
         return any(acl(x) for acl in self.subacls)
 
+    def check_denied(self, x: Any) -> bool:
+        if self.subacls is None:
+            return False
+        return any(not acl(x) for acl in self.subacls)
+
 
-class AllCompoundACL(object):
+class AllCompoundACL(SimpleACL):
     """An ACL that allows if all of its subacls allow."""
-    def __init__(self, subacls: List[SimpleACL]):
-        assert subacls is not None
+    def __init__(self,
+                 *,
+                 subacls: Optional[List[SimpleACL]] = None,
+                 order_to_check_allow_deny: Order,
+                 default_answer: bool) -> None:
+        super().__init__(
+            order_to_check_allow_deny = order_to_check_allow_deny,
+            default_answer = default_answer
+        )
         self.subacls = subacls
 
-    def __call__(self, x: Any):
+    def check_allowed(self, x: Any) -> bool:
+        if self.subacls is None:
+            return False
         return all(acl(x) for acl in self.subacls)
+
+    def check_denied(self, x: Any) -> bool:
+        if self.subacls is None:
+            return False
+        return any(not acl(x) for acl in self.subacls)