| OLD | NEW |
| 1 # Copyright 2015 The LUCI Authors. All rights reserved. | 1 # Copyright 2015 The LUCI Authors. All rights reserved. |
| 2 # Use of this source code is governed by the Apache v2.0 license that can be | 2 # Use of this source code is governed under the Apache License, Version 2.0 |
| 3 # found in the LICENSE file. | 3 # that can be found in the LICENSE file. |
| 4 | 4 |
| 5 """Top level access control for Auth API itself.""" | 5 """Top level access control for Auth API itself.""" |
| 6 | 6 |
| 7 from .. import api | 7 from .. import api |
| 8 | 8 |
| 9 | 9 |
| 10 ACCESS_GROUP_NAME = 'auth-service-access' | 10 ACCESS_GROUP_NAME = 'auth-service-access' |
| 11 | 11 |
| 12 | 12 |
| 13 def has_access(identity=None): | 13 def has_access(identity=None): |
| 14 """Returns True if current caller can access groups and other auth data. | 14 """Returns True if current caller can access groups and other auth data. |
| 15 | 15 |
| 16 Used in @require(...) decorators of API handlers. | 16 Used in @require(...) decorators of API handlers. |
| 17 | 17 |
| 18 It is a top level check that acts as an access guard for both reads and | 18 It is a top level check that acts as an access guard for both reads and |
| 19 writes. Individual entities are protected by additional checks. | 19 writes. Individual entities are protected by additional checks. |
| 20 | 20 |
| 21 By default, passing 'has_access' check grants read-only access to everything | 21 By default, passing 'has_access' check grants read-only access to everything |
| 22 (via UI or API). Write access is controlled by more fine-grain ACLs. | 22 (via UI or API). Write access is controlled by more fine-grain ACLs. |
| 23 """ | 23 """ |
| 24 # TODO(vadimsh): Remove 'groups-readonly-access' once everything is migrated | 24 # TODO(vadimsh): Remove 'groups-readonly-access' once everything is migrated |
| 25 # to 'auth-service-access'. | 25 # to 'auth-service-access'. |
| 26 identity = identity or api.get_current_identity() | 26 identity = identity or api.get_current_identity() |
| 27 return ( | 27 return ( |
| 28 api.is_admin(identity) or | 28 api.is_admin(identity) or |
| 29 api.is_group_member(ACCESS_GROUP_NAME, identity) or | 29 api.is_group_member(ACCESS_GROUP_NAME, identity) or |
| 30 api.is_group_member('groups-readonly-access', identity)) | 30 api.is_group_member('groups-readonly-access', identity)) |
| OLD | NEW |