31 lines
1009 B
Python
31 lines
1009 B
Python
"""Machine-principal and project/environment binding checks."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from datetime import UTC, datetime
|
|
|
|
from .errors import ACCESS_DENIED
|
|
from .models import AliasRecord, PrincipalLike
|
|
|
|
|
|
class AliasAuthorizer:
|
|
def authorize(
|
|
self, principal: PrincipalLike, record: AliasRecord, *, now: datetime | None = None
|
|
) -> None:
|
|
reference = now or datetime.now(UTC)
|
|
if principal.kind != "machine_client" or principal.client_id is None:
|
|
raise ACCESS_DENIED
|
|
if principal.expires_at <= reference:
|
|
raise ACCESS_DENIED
|
|
for binding in record.bindings:
|
|
if (
|
|
binding.enabled
|
|
and binding.client_id == principal.client_id
|
|
and binding.issuer == principal.issuer
|
|
and binding.subject == principal.subject
|
|
):
|
|
if not record.enabled:
|
|
raise ACCESS_DENIED
|
|
return
|
|
raise ACCESS_DENIED
|