orionis.auth.authorization.authorizer.Authorizer

THE ORIONIS API

Build with clarity.

Explore the building blocks of an async-first Python framework. Every module, class, and method — connected, searchable, and ready to build with.

Explore modules View classes

class documentation

class Authorizer(IAuthorizer): (source)

Constructor: Authorizer(app)

View In Hierarchy

Answer authorization questions for a given request context.

The authorizer never stores the current identity: every method takes the request context as its first argument. That keeps the service stateless and therefore safe as a container singleton shared by every concurrent request.

Concurrency

Only policy classes are cached. Each evaluation builds a fresh policy in the caller's container scope, so injected request dependencies and mutable policy state are never retained by this singleton.

Method	`__init__`	Initialise the authorizer with the application container.
Async Method	`allows`	Evaluate a policy ability against a concrete resource.
Async Method	`can`	Report whether the context grants a permission.
Async Method	`canAll`	Report whether the context grants every permission.
Async Method	`canAny`	Report whether the context grants at least one permission.
Async Method	`hasRole`	Report whether the context owns a role.
Method	`registerPolicy`	Bind a policy class to a resource type.
Method	`registry`	Return the policy registry backing this authorizer.
Class Variable	`__slots__`	Undocumented
Instance Variable	`__app`	Undocumented
Instance Variable	`__registry`	Undocumented

def __init__(self, app: IApplication): (source) ¶

Initialise the authorizer with the application container.

Parameters
app:`IApplication`	Container used to build policy instances with their own dependencies injected.

Returns
`None`	The registry starts empty and is filled during boot.

async def allows(self, context: IAuthenticationContext, ability: str, resource: object) -> bool: (source) ¶

overrides orionis.auth.contracts.IAuthorizer.allows

Evaluate a policy ability against a concrete resource.

Parameters
context:`IAuthenticationContext`	Authentication context of the current request.
ability:`str`	Ability declared by the policy of the resource.
resource:`object`	Resource instance, or the resource class when the ability does not need an instance.

Returns
`bool`	True only when the policy explicitly allows the operation and the credential permits the named ability. Hooks cannot override credential restrictions.

Raises
`PolicyNotFoundException`	When the resource type has no policy, or the policy does not declare the requested ability.

async def can(self, context: IAuthenticationContext, permission: str) -> bool: (source) ¶

overrides orionis.auth.contracts.IAuthorizer.can

Report whether the context grants a permission.

Parameters
context:`IAuthenticationContext`	Authentication context of the current request.
permission:`str`	Permission name to evaluate.

Returns
`bool`	True when the permission is granted.

async def canAll(self, context: IAuthenticationContext, permissions: Iterable[str]) -> bool: (source) ¶

overrides orionis.auth.contracts.IAuthorizer.canAll

Report whether the context grants every permission.

Parameters
context:`IAuthenticationContext`	Authentication context of the current request.
permissions:`Iterable[str]`	Permission names to evaluate.

Returns
`bool`	True when every permission is granted.

async def canAny(self, context: IAuthenticationContext, permissions: Iterable[str]) -> bool: (source) ¶

overrides orionis.auth.contracts.IAuthorizer.canAny

Report whether the context grants at least one permission.

Parameters
context:`IAuthenticationContext`	Authentication context of the current request.
permissions:`Iterable[str]`	Permission names to evaluate.

Returns
`bool`	True when at least one permission is granted.

async def hasRole(self, context: IAuthenticationContext, role: str) -> bool: (source) ¶

overrides orionis.auth.contracts.IAuthorizer.hasRole

Report whether the context owns a role.

Parameters
context:`IAuthenticationContext`	Authentication context of the current request.
role:`str`	Role name to evaluate.

Returns
`bool`	True when the role is assigned to the identity.

def registerPolicy(self, resource: type, policy: type[IPolicy]): (source) ¶

overrides orionis.auth.contracts.IAuthorizer.registerPolicy

Bind a policy class to a resource type.

Parameters
resource:`type`	Resource class protected by the policy.
policy:`type[IPolicy]`	Policy class implementing the abilities.

Returns
`None`	The registry is updated as a side effect.

def registry(self) -> PolicyRegistry: (source) ¶

Return the policy registry backing this authorizer.

Returns
`PolicyRegistry`	Registry holding the resource to policy bindings.

__slots__: tuple[str, ...] = (source) ¶

overrides orionis.auth.contracts.IAuthorizer.__slots__

Undocumented

__app = (source) ¶

Undocumented

__registry = (source) ¶

Undocumented