orionis.auth.authorization.Policy

THE ORIONIS API

Build with clarity.

Explore the building blocks of an async-first Python framework. Every module, class, and method — connected, searchable, and ready to build with.

Explore modules View classes

class documentation

class Policy(IPolicy): (source)

View In Hierarchy

Base class for resource policies.

Subclasses declare one method per ability. Every ability receives the authenticated identity first and the resource second. Methods may be synchronous or asynchronous:

class PostPolicy(Policy):
    async def update(self, identity, post) -> bool:
        return post.user_id == identity.getAuthIdentifier()

Policies are resolved through the container, so they may declare dependencies in their constructor. Each evaluation receives a fresh instance built in the current request scope; only class lookups are cached.

Async Method	`before`	Short circuit the policy before the ability method runs.
Class Variable	`__slots__`	Undocumented

async def before(self, identity: object, ability: str) -> bool | None: (source) ¶

overrides orionis.auth.contracts.IPolicy.before

Short circuit the policy before the ability method runs.

The default implementation never short circuits. Override it to grant every ability to a super administrator, for instance.

Parameters
identity:`object`	Authenticated identity being evaluated.
ability:`str`	Name of the ability requested on the resource.

Returns
`bool \| None`	`None` so the ability method decides the outcome.

__slots__: tuple = (source) ¶

overrides orionis.auth.contracts.IPolicy.__slots__

Undocumented