References/Permission Association: Difference between revisions
From OHC Network Wiki
More languages
More actions
Content deleted Content added
Automated edit (via update-page on MediaWiki MCP Server) |
Migrate to {{SourceCode}} template |
||
| Line 13: | Line 13: | ||
The Django model (<code>care/security/models/permission_association.py</code>) is the storage layer: the <code>user</code>/<code>role</code> foreign keys, the generic <code>context</code>/<code>context_id</code> pair, and <code>expiry</code>. It has no resource spec of its own — it is a platform-internal authorization join, not a client-writable EMR resource. Two sets of Pydantic resource specs surround it: those that govern the [[References/Role|<code>role</code>]] it points at (<code>care/emr/resources/role/spec.py</code>), and the permission-resolution mixins (<code>care/emr/resources/permissions.py</code>) that read these rows to compute a user's effective permissions in a context. |
The Django model (<code>care/security/models/permission_association.py</code>) is the storage layer: the <code>user</code>/<code>role</code> foreign keys, the generic <code>context</code>/<code>context_id</code> pair, and <code>expiry</code>. It has no resource spec of its own — it is a platform-internal authorization join, not a client-writable EMR resource. Two sets of Pydantic resource specs surround it: those that govern the [[References/Role|<code>role</code>]] it points at (<code>care/emr/resources/role/spec.py</code>), and the permission-resolution mixins (<code>care/emr/resources/permissions.py</code>) that read these rows to compute a user's effective permissions in a context. |
||
'''Source:''' |
|||
* Model: [<nowiki/>https://github.com/ohcnetwork/care/blob/develop/care/security/models/permission_association.py <code>care/security/models/permission_association.py</code>] |
|||
* Role spec (the granted role): [<nowiki/>https://github.com/ohcnetwork/care/blob/develop/care/emr/resources/role/spec.py <code>care/emr/resources/role/spec.py</code>] |
|||
* Permission-resolution mixins: [<nowiki/>https://github.com/ohcnetwork/care/blob/develop/care/emr/resources/permissions.py <code>care/emr/resources/permissions.py</code>] |
|||
* Role definitions / <code>RoleContext</code>: [<nowiki/>https://github.com/ohcnetwork/care/blob/develop/care/security/roles/role.py <code>care/security/roles/role.py</code>] |
|||
* Permission contexts: [<nowiki/>https://github.com/ohcnetwork/care/blob/develop/care/security/permissions/constants.py <code>care/security/permissions/constants.py</code>] |
|||
== Models == |
== Models == |
||
| Line 288: | Line 281: | ||
* The granted <code>role</code> is written and read through the role specs (<code>RoleCreateSpec</code> / <code>RoleReadSpec</code>), and each role's <code>contexts</code> is bound to the <code>RoleContext</code> enum rather than an open string at the API layer. |
* The granted <code>role</code> is written and read through the role specs (<code>RoleCreateSpec</code> / <code>RoleReadSpec</code>), and each role's <code>contexts</code> is bound to the <code>RoleContext</code> enum rather than an open string at the API layer. |
||
{{SourceCode |
|||
|model=care/security/models/permission_association.py |
|||
|extra1_label=Role spec (the granted role) |
|||
|extra1_path=care/emr/resources/role/spec.py |
|||
|extra2_label=Permission-resolution mixins |
|||
|extra2_path=care/emr/resources/permissions.py |
|||
|extra3_label=Role definitions / <code>RoleContext</code> |
|||
|extra3_path=care/security/roles/role.py |
|||
|extra4_label=Permission contexts |
|||
|extra4_path=care/security/permissions/constants.py |
|||
}} |
|||
{{Navbox access governance}} |
{{Navbox access governance}} |
||