orionis.auth.authorization.registrar.PermissionRegistrar

THE ORIONIS API

Build with clarity.

Explore the building blocks of an async-first Python framework. Every module, class, and method — connected, searchable, and ready to build with.

Explore modules View classes

class documentation

class PermissionRegistrar: (source)

Constructor: PermissionRegistrar(db)

View In Hierarchy

Create permissions and roles, and attach them to identities.

Database unique constraints decide concurrent insertions. Duplicate recovery uses a transaction or savepoint and verifies that the desired row exists before treating the operation as idempotent.

Concurrency

The registrar is stateless and safe as a singleton. Duplicate inserts lose against the primary or unique key and are resolved by reading the row that won.

Async Method	`__attach`	Insert a pivot row, ignoring an already existing one.
Async Method	`__findId`	Return the identifier of a named permission or role.
Async Method	`__firstOrCreate`	Return the identifier of a row, inserting it when missing.
Method	`__init__`	Initialise the registrar with the model-less query gateway.
Async Method	`assignRole`	Attach roles to an identity.
Async Method	`createPermission`	Create a permission, or return the existing one.
Async Method	`createRole`	Create a role, or return the existing one.
Async Method	`givePermissionTo`	Attach direct permissions to an identity.
Async Method	`grantToRole`	Attach permissions to a role.
Async Method	`removeRole`	Detach roles from an identity.
Async Method	`revokeFromRole`	Detach permissions from a role.
Async Method	`revokePermissionFrom`	Detach direct permissions from an identity.
Class Variable	`__slots__`	Undocumented
Instance Variable	`__db`	Undocumented

async def __attach(self, table: str, values: dict[str, object]): (source) ¶

Insert a pivot row, ignoring an already existing one.

Parameters
table:`str`	Pivot table receiving the row.
values:`dict[str, object]`	Columns forming the composite primary key.

Returns
`None`	The row is inserted, or silently skipped when present.

Raises
`QueryException`	If insertion fails and no identical pivot row exists.

async def __findId(self, table: str, name: str) -> object | None: (source) ¶

Return the identifier of a named permission or role.

Parameters
table:`str`	Table to search in.
name:`str`	Name of the row.

Returns
`object \| None`	Identifier of the row, or `None` when it does not exist.

async def __firstOrCreate(self, table: str, name: str) -> object: (source) ¶

Return the identifier of a row, inserting it when missing.

The unique key decides concurrent insertions. A nested transaction rolls back a losing insert before the winning row is read, without aborting the caller's transaction.

Parameters
table:`str`	Table holding the named rows.
name:`str`	Name of the row.

Returns
`object`	Identifier of the existing or freshly created row.

Raises
`QueryException`	When the insert fails for a reason other than a duplicate.
`AuthException`	When the name is empty, padded or longer than the schema permits.

def __init__(self, db: IQueryBuilder): (source) ¶

Initialise the registrar with the model-less query gateway.

Parameters
db:`IQueryBuilder`	Gateway used to build queries over the authorization tables.

Returns
`None`	The registrar keeps only the injected gateway.

async def assignRole(self, authorizable: IAuthorizable, *roles: str): (source) ¶

Attach roles to an identity.

Parameters
authorizable:`IAuthorizable`	Identity receiving the roles.
*roles:`str`	Role names. Missing roles are created.

Returns
`None`	The pivot table is updated as a side effect.

async def createPermission(self, name: str) -> object: (source) ¶

Create a permission, or return the existing one.

Parameters
name:`str`	Permission name, such as `"users.view"`.

Returns
`object`	Identifier of the permission row.

async def createRole(self, name: str) -> object: (source) ¶

Create a role, or return the existing one.

Parameters
name:`str`	Role name, such as `"admin"`.

Returns
`object`	Identifier of the role row.

async def givePermissionTo(self, authorizable: IAuthorizable, *permissions: str): (source) ¶

Attach direct permissions to an identity.

Parameters
authorizable:`IAuthorizable`	Identity receiving the permissions.
*permissions:`str`	Permission names. Missing permissions are created.

Returns
`None`	The pivot table is updated as a side effect.

async def grantToRole(self, role: str, *permissions: str): (source) ¶

Attach permissions to a role.

Parameters
role:`str`	Role name. It is created when missing.
*permissions:`str`	Permission names. Missing permissions are created.

Returns
`None`	The pivot table is updated as a side effect.

async def removeRole(self, authorizable: IAuthorizable, *roles: str): (source) ¶

Detach roles from an identity.

Parameters
authorizable:`IAuthorizable`	Identity losing the roles.
*roles:`str`	Role names. Unknown names are ignored.

Returns
`None`	The pivot table is updated as a side effect.

async def revokeFromRole(self, role: str, *permissions: str): (source) ¶

Detach permissions from a role.

Parameters
role:`str`	Role name. Unknown roles are ignored.
*permissions:`str`	Permission names. Unknown names are ignored.

Returns
`None`	The pivot table is updated as a side effect.

async def revokePermissionFrom(self, authorizable: IAuthorizable, *permissions: str): (source) ¶

Detach direct permissions from an identity.

Parameters
authorizable:`IAuthorizable`	Identity losing the permissions.
*permissions:`str`	Permission names. Unknown names are ignored.

Returns
`None`	The pivot table is updated as a side effect.

__slots__: tuple[str, ...] = (source) ¶

Undocumented

__db = (source) ¶

Undocumented