# Licensed to the StackStorm, Inc ('StackStorm') under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

"""
RBAC related utility functions.
"""

from oslo_config import cfg

from st2common.constants.types import ResourceType
from st2common.constants.rbac import SystemRole
from st2common.rbac.types import PackPermissionTypes
from st2common.rbac.types import ActionPermissionTypes
from st2common.rbac.types import RulePermissionTypes

__all__ = [
    'request_user_is_admin',
    'request_user_has_role',

    'user_is_admin',
    'user_has_role'
]


def request_user_is_admin(request):
    """
    Check if the logged-in request user has admin role.

    :rtype: ``bool``
    """
    return request_user_has_role(request=request, role=SystemRole.ADMIN)


def request_user_has_role(request, role):
    """
    Check if the logged-in request user has the provided role.

    :rtype: ``bool``
    """
    # TODO: Once RBAC is implemented, we should not support running production (non-dev)
    # deployments with auth disabled.
    if not cfg.CONF.auth.enable:
        return True

    auth_context = request.context.get('auth', {})

    if not auth_context:
        return False

    user_db = auth_context.get('user', None)

    if not user_db:
        return False

    if user_has_role(user=user_db, role=role):
        return True

    return False


def user_is_admin(user):
    """
    Return True if the provided user has admin rule, false otherwise.

    :param user: User object to check for.
    :type user: :class:`UserDB`

    :rtype: ``bool``
    """
    return user_has_role(user=user, role=SystemRole.ADMIN)


def user_has_role(user, role):
    """
    :param user: User object to check for.
    :type user: :class:`UserDB`

    :rtype: ``bool``
    """
    # Note: atm, we onl'y support admin role
    if role == SystemRole.ADMIN and user.name in cfg.CONF.system.admin_users:
        return True

    return False


def get_valid_permission_types_for_resource(resource_db):
    """
    Return a list of valid permission types for the provided resource type.
    """
    resource_type = resource_db.get_resource_type()

    if resource_type == ResourceType.PACK:
        return PackPermissionTypes
    elif resource_type == ResourceType.ACTION:
        return ActionPermissionTypes
    elif resource_type == ResourceType.RULE:
        return RulePermissionTypes
    else:
        raise ValueError('Unsupported resource type: %s' % (resource_type))

@@ -1173,16 +1173,130 @@
 s_role',
+%0A    'request_user_has_permission',%0A%0A    'assert_request_user_is_admin',%0A    'assert_request_user_has_permission',
 %0A%0A    'u
@@ -2133,24 +2133,1175 @@
 urn False%0A%0A%0A
+def request_user_has_permission(request, resource_db, permission_type):%0A    %22%22%22%0A    Check that currently logged-in user has specified permission on the provied resource.%0A%0A    :rtype: %60%60bool%60%60%0A    %22%22%22%0A    # TODO%0A    return True%0A%0A%0Adef assert_request_user_is_admin(request):%0A    %22%22%22%0A    Assert that the currently logged in user is an administrator.%0A%0A    If the user is not an administrator, an exception is thrown.%0A    %22%22%22%0A    is_admin = request_user_is_admin(request=request)%0A%0A    if not is_admin:%0A        # TODO: Throw special AccessDeniedError%0A        raise ValueError('TBW Not admin')%0A%0A%0Adef assert_request_user_has_permission(request, resource_db, permission_type):%0A    %22%22%22%0A    Check that currently logged-in user has specified permission on the provied resource.%0A%0A    If user doesn't have a required permission, AccessDeniedError s thrown.%0A    %22%22%22%0A    has_permission = request_user_has_permission(request=request, resource_db=resource_db,%0A                                                 permission_type=permission_type)%0A%0A    if not has_permission:%0A        # TODO: Throw special AccessDeniedError%0A        raise ValueError('TBW Permission denied')%0A%0A%0A
 def user_is_

Add some RBAC utility functions for checking / asserting the permissions.