Initial curated ITWorx_MCP_Hub source from 368fba691ea8d23403b4d56b53b5ec670d7c5020

services/dataplane_router/authz.py

@@ -0,0 +1,30 @@
+"""Machine-principal and project/environment binding checks."""
+
+from __future__ import annotations
+
+from datetime import UTC, datetime
+
+from .errors import ACCESS_DENIED
+from .models import AliasRecord, PrincipalLike
+
+
+class AliasAuthorizer:
+    def authorize(
+        self, principal: PrincipalLike, record: AliasRecord, *, now: datetime | None = None
+    ) -> None:
+        reference = now or datetime.now(UTC)
+        if principal.kind != "machine_client" or principal.client_id is None:
+            raise ACCESS_DENIED
+        if principal.expires_at <= reference:
+            raise ACCESS_DENIED
+        for binding in record.bindings:
+            if (
+                binding.enabled
+                and binding.client_id == principal.client_id
+                and binding.issuer == principal.issuer
+                and binding.subject == principal.subject
+            ):
+                if not record.enabled:
+                    raise ACCESS_DENIED
+                return
+        raise ACCESS_DENIED