kQjpKdZddlmZmZmZddlmZmZddlm Z ddl Z ddl m Z m Z mZmZmZddlmZdd lmZgd Zd Zed Ze d ZedGddZedGddZGddee ZedGddZedGddZedGddZedGddZ edGddZ!d2d ed!e ed"efd#Z"d$eeefd"efd%Z#d&e e$d"dfd'Z%d$eeefd"efd(Z&d$e'd"efd)Z(d$e'd"efd*Z)Gd+d,Z*d-eed"efd.Z+d-eed"eefd/Z,Gd0d1Z-y)3a(Deployment-wide authorization through ``catalog.authz``. ACLs grant one privilege on an object to a principal, group, or role. Role bindings grant a role to a principal or group. Identity-provider group membership is read-only. Name resolution and permission checks are performed by the server. ) AsyncIteratorIteratorSequence) dataclassfield)EnumN)LiteralOptionalTypeVarUnioncast)_lancedb)LOOP) AuthorizationAsyncAuthorizationSubjectObject PrivilegeAccessControlEntry RoleBinding IdentityInfo PrincipalInfo GroupInfod_T) principal_idprincipal_namegroup_id group_nameroleprincipal_api_keyunknownT)frozenc\eZdZUdZeed<edZeed<edddZ e jed<dZ e d ed dfd Ze d ed dfd Ze d ed dfdZe d ed dfdZe d ed dfdZe ded dfdZd efdZed efdZdZd efdZe ded dfdZy)raAn immutable identity selector. Prefer the named factory methods. IDs are stable; names must resolve unambiguously on the server. API-key selectors identify the subject of an operation, not its authenticated caller. Secret values are omitted from representations. Unknown canonical subject kinds returned by newer servers use ``kind="unknown"`` and preserve the full wire string in ``value``; they can be passed back to ACL methods. kindF)repr_valueinitr'compare_innerctj|dtj|j|j yNr,)object __setattr__r AuthzSubjectr&r(selfs R/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/lancedb/authz.py __post_init__zSubject.__post_init__>s, (H11$))T[[I idreturnc|d|S)z5Select a principal by canonical identity-provider ID.rclsr7s r4rzSubject.principal_idCs>2&&r6namec|d|S)z3Select a principal by an unambiguous provider name.rr:r<r=s r4rzSubject.principal_nameHs#T**r6c|d|S)z1Select a group by canonical identity-provider ID.rr:r;s r4rzSubject.group_idMs:r""r6c|d|S)z/Select a group by an unambiguous provider name.r r:r?s r4r zSubject.group_nameRs<&&r6c|d|S)z8Select a LanceDB-managed role, without an ``r:`` prefix.r!r:r?s r4r!z Subject.roleWs64  r6api_keyc|d|S)z1Select the principal holding this secret API key.r"r:)r<rCs r4r"zSubject.principal_api_key\s&00r6cT|jj}d|jd|dS)NzSubject.())r, display_valuer&)r3values r4__repr__zSubject.__repr__as* ))$))AeYa00r6c|jS)zpThe selected value, or full wire string for unknown subject kinds. API-key values are secrets. )r(r2s r4rIz Subject.valuees {{r6cHt||j|jffSN)typer&r(r2s r4 __reduce__zSubject.__reduce__msDzDIIt{{333r6c6|jjSrM)r,to_wirer2s r4_wirez Subject._wireps{{""$$r6rIctjj|}|tt|j |j SrM)rr1from_canonicalr _SubjectKindr&rI)r<rIinners r4 _canonicalzSubject._canonicalss4%%44U;4 ejj15;;??r6N)__name__ __module__ __qualname____doc__rU__annotations__rr(strr,rr1r5 classmethodrrrr r!r"rJpropertyrIrOrRrWr:r6r4rr.sf U#FC#$)u5%$PFH ! !P 'c'i''+#+)++###)##'c'i''!! !!11 111#1s4%s%@s@y@@r6rc veZdZUdZeed<edddZejed<dZ e ddZ e d eddfd Z e d d d edeeddfdZe d d d ed edeeddfdZe d d d ed edeeddfdZe d d d ed edeeddfdZe d d d ed edeeddfdZdefdZdZy)raqAn immutable resource name in the authorization syntax. Use the builders to avoid interpreting separators as part of a name. Methods also accept raw object strings, validated by the same Rust parser. Unknown resource types are preserved for compatibility with newer servers. Omitted or empty namespace paths select the database's public namespace. r(Fr)r,cltj|dtj|jyr.)r/r0r AuthzObjectr(r2s r4r5zObject.__post_init__s#48+?+? +LMr6r8c\|ttjjS)z"The deployment-wide system object.)r]rrbsystem)r<s r4rdz Object.systems#3x++224566r6r=c^|ttjj|S)z?A database; slash-containing names remain one logical database.)r]rrbdatabaser?s r4rfzObject.databases%3x++44T:;<4PQRRr6c b|ttjj|||S)z8A secret, defaulting to the database's public namespace.)r]rrbsecretrms r4rqz Object.secrets) 3x++228^TRSTTr6c b|ttjj|||S)z:A function, defaulting to the database's public namespace.)r]rrbfunctionrms r4rszObject.functions) 3x++44X~tTUVVr6c,t|jSrM)r]r,r2s r4__str__zObject.__str__s4;;r6c2t||jffSrM)rNr(r2s r4rOzObject.__reduce__sDzDKK>))r6N)r8r)rXrYrZr[r]r\rr,rrbr5r^rdrfrrjrlrorqrsrurOr:r6r4rrys K#(e%#OFH ON77=C=H==?JRR/7}R RR JUTT%(T:B3-T TT JUSS%(S:B3-S SS JUUU%(U:B3-U UU JUWW%(W:B3-W WW   *r6rcTeZdZdZdefdZdZdZdZdZ dZ d Z d Z d Z d Zd ZdZdZdZdZy)raKnown privileges, validated and serialized by Rust. ACL methods also accept strings such as ``"SELECT"`` and future privilege names such as ``"PRIVILEGE20"``. Future names are preserved verbatim; their meaning and validity are determined by the server. Grant ``CREATE_SECRET`` or ``CREATE_FUNCTION`` on a namespace to delegate creation of those resources without transferring namespace ownership. rIc|ttj|}tj||}||_|SrM)r]rAuthzPrivilege__new___value_)r<rI canonicalmembers r4rzzPrivilege.__new__s3//67 S)," r6 OWNERSHIPUSAGESELECTINSERTUPDATEDELETECREATE_DATABASECREATE_NAMESPACE CREATE_TABLECREATE_MATERIALIZED_VIEW CREATE_VIEW CREATE_SECRETCREATE_FUNCTIONOPERATEN)rXrYrZr[r]rzr~rrrrrrrrrrrrrr:r6r4rrs]C I E F F F F'O)!L9K#M'OGr6rc@eZdZUdZeed<eed<eeed<eed<y)rzLOne object/subject/privilege grant; subject contains a canonical ID or role.r/subject subject_name privilegeN)rXrYrZr[r]r\rr r:r6r4rrsV K 3-Nr6rc6eZdZUdZeed<eeed<eed<y)rzFA direct principal/group role binding, not an expanded effective role.rrr!N)rXrYrZr[rr\r r]r:r6r4rrsP 3- Ir6rc0eZdZUdZeed<dZeeed<y)rz?A canonical identity-provider ID and its optional display name.r7Nr=)rXrYrZr[r]r\r=r r:r6r4rrsI GD(3-r6rcLeZdZUdZeed<eeed<eeed<eeed<y)rzJA principal's groups and effective roles, including group-inherited roles.rrgroupsrolesN rXrYrZr[r]r\r listrr:r6r4rrs*TSM!   9r6rcLeZdZUdZeed<eeed<eeed<eeed<y)rzDA group's provider-managed members and LanceDB-managed direct roles.rr principalsrNrr:r6r4rrs)NM \"" 9r6rrcontextr8cnt|ts td|jj |S)Nz"subject must be a Subject selector) isinstancer ValueErrorr,rQ)rrs r4_subjectr s- gw '=>> >> ! !' **r6rIct|ttfr t|s tdt|tr t|Stt j |S)Nz*object must be a nonempty string or Object)rr]rrrrbrIs r4_objectrsK ec6] +3u:EFF#E623u:XH.entrieslsI#{{ %%w 5  $ $eUm# $ %)AAAAAAA)rrr)r3r/rrrrs` ` @r4rzAsyncAuthorization.list_aclsXsI u    'GH   !)'!2GI  $ yr6rc K|jjtjt |t |t |dd{y7w)zGrant one privilege; requires OWNERSHIP on the object. A duplicate grant raises HTTP 409. Granting OWNERSHIP transfers ownership. Writes are not automatically retried after ambiguous failures. r/rrN)r,add_aclrrrrrr3r/rrs r4rzAsyncAuthorization.add_acltsLkk!! JJ%fo'0!+I!6    AAAAc K|jjtjt |t |t |dd{y7w)zRevoke one privilege; requires OWNERSHIP on the object. A missing grant raises HTTP 404. OWNERSHIP itself cannot be deleted. rN)r, delete_aclrrrrrrs r4rzAsyncAuthorization.delete_aclsLkk$$ JJ%fo'0!+I!6    rrr!rr!cnti|t|dd<||d<fd}|S)zIterate direct bindings, optionally filtered by principal/group and role. Requires USAGE on system. Limit semantics match ``list_acls``. Principals' roles inherited through groups are available through ``get_principal``. role_memberrr!cKjjjd23d{}t|76yw)Nbindings)rr,list_role_bindingsrrs r4rz7AsyncAuthorization.list_role_bindings..bindingssI#{{ ..U  & &euo% & r)rr)r3rr!rrrs` ` @r4rz%AsyncAuthorization.list_role_bindingssF u   !)'=!AGI   "GFO & zr6cK|jjtjt |d|dd{y7w)6Grant a role idempotently; requires OPERATE on system.rrr!N)r,add_role_bindingrrrr3rr!s r4rz#AsyncAuthorization.add_role_bindings:kk** JJ8G]#CTR S   ?A AA cK|jjtjt |d|dd{y7w)7Idempotently revoke a role; requires OPERATE on system.rrN)r,delete_role_bindingrrrrs r4rz&AsyncAuthorization.delete_role_bindings:kk-- JJ8G]#CTR S   rc <Ktj|jjtjdt |did{}t |d|jd|dDcgc] }tdi|c}|dS7Ecc}ww)zLook up groups and effective roles; requires USAGE on system. Select by ID, name, or API key. Missing/ambiguous identities raise HTTP 404/409; unavailable or unconfigured resolution raises HTTP 503/501. principalNrrrrr:) rrr, get_principalrrrrr)r3rrIgroups r4rz AsyncAuthorization.get_principals  ++++ K';)GHI    . ! II& '05h @u\ "E " @ 'N     A$A BB(B8B BBc <Ktj|jjtjdt |did{}t |d|jd|dDcgc] }tdi|c}|dS7Ecc}ww)zLook up a group's members and roles by ID/name; requires USAGE on system. Membership is read-only and comes from the identity provider. Lookup errors have the same HTTP semantics as ``get_principal``. rNrr rrr:) rrr, get_grouprrrrr)r3rrIrs r4rzAsyncAuthorization.get_groups  ++'' GXgw%?@A    *  IIl #8=l8K L9\ &I & L 'N     Mr)rXrYrZr[rAuthorizationClientrdictr]r rrr rrrrrrrrrrrrrrrrr:r6r4rr7sh::2D2s28C=2004%)# sF{+,'"  }  ) * 8 c6k"   i(    , c6k"   i(    0&*"# '"sm  }  { # 6     G 3 4  7 } $ w 9 r6riteratorc>K|jd{S7wrM) __anext__)rs r4_nextrs##% %% %s c# K tjt|!#t$r-Yt |dd}|tj|yywxYw#t |dd}|tj|wwxYww)Naclose)rrunrStopAsyncIterationgetattr)rcloses r4 _sync_iterrs((5?+ + (D1   HHUW   (D1   HHUW  s0B"& AA+BAA,B  Bc :eZdZdZdefdZdddddeeee fdee dee d e e fd Zdeee fde d eeefd dfd Zdeee fde d eeefd dfd Zdddddee deedee d e efdZde ded dfdZde ded dfdZde d efdZde d efdZy)rzSynchronous authorization returned by ``Catalog.authz``. Shares the async API's permissions, errors, and lazy pagination behavior. Group membership comes from the identity provider and cannot be edited here. rVc||_yrMrrs r4rzAuthorization.__init__rr6Nrr/rrr8cPt|jj|||S)znIterate grants. See [list_acls][lancedb.authz.AsyncAuthorization.list_acls] for permissions. r)rr,r)r3r/rrs r4rzAuthorization.list_aclss* KK ! ! ! N  r6rcftj|jj|||y)z^Grant a privilege; duplicates raise HTTP 409. OWNERSHIP transfers ownership. rN)rrr,rrs r4rzAuthorization.add_acls)  KK  vw)  T r6cftj|jj|||y)zaRevoke a privilege. Missing grants raise HTTP 404. OWNERSHIP cannot be deleted. rN)rrr,rrs r4rzAuthorization.delete_acl#s)  KK " "&'Y " W r6rr!cPt|jj|||S)zJIterate direct role bindings, using the same limit semantics as list_acls.r)rr,r)r3rr!rs r4rz Authorization.list_role_bindings2s* KK * *7U * S  r6cdtj|jj||y)rrN)rrr,rrs r4rzAuthorization.add_role_binding>s" --gD-IJr6cdtj|jj||y)rrN)rrr,rrs r4rz!Authorization.delete_role_bindingBs" 00t0LMr6c^tj|jj|S)z=Look up groups and effective roles; requires USAGE on system.)rrr,rr3rs r4rzAuthorization.get_principalFs xx 11':;;r6c^tj|jj|S)z>Look up a group's members and roles; requires USAGE on system.)rrr,rrs r4rzAuthorization.get_groupJs xx --g677r6)rXrYrZr[rrr r r]rrrrrrrrrrrrrrrrrr:r6r4rrs 0 04%)#  sF{+,  '"  }  $ %    c6k"    i(      c6k"    i(    $&*"#  '"  sm  }  +   K7K#K$KNgNSNTNrs >=( ::!   T]  $G@G@G@T $@*@*@*FTB $ $ $ $ $+g+ ++ Y5f%Y#Y H(3-HDH/eCN+// $-D[q q h&-+&& r* x| Q8Q8r6