Capabilities / Rights

DerivedRightsCapability

class teksi_hooks.capabilities.rights.DerivedRightsCapability(rights)[source]

Runtime lookup capability for rights-derivation definitions.

This capability exposes relationships through which rights may be inherited from related canonical objects.

Parameters:: rights (ResolvedRights)

derived_rights(class_id)[source]

Return rights-derivation definitions for a class.

Raises

KeyError: If the class is unknown.

Parameters:: class_id (str)
Return type:: tuple[DerivedRights, …]

try_derived_rights(class_id)[source]

Return rights-derivation definitions if the class exists.

Returns None if the class is unknown.

Parameters:: class_id (str)
Return type:: tuple[DerivedRights, …] | None

Fields

rights

Type: ResolvedRights

Fully resolved runtime rights configuration.

RightsCapability

class teksi_hooks.capabilities.rights.RightsCapability(rights)[source]

Runtime lookup capability for resolved rights definitions.

This capability wraps resolved class definitions and exposes convenient query methods for class-level rules, attribute-level privileges, validations and transition validations.

It should not evaluate whether an operation is allowed. Evaluation belongs to the rights evaluator or hook logic. This capability only answers metadata questions such as:

Which rules apply to class X?
Which privileges are required for attribute Y?
Which validations exist for attribute Z?

Parameters:: rights (ResolvedRights)

class_definition(class_id)[source]

Return the resolved class definition for a canonical class id.

Raises

KeyError: If the class is unknown.

Parameters:: class_id (str)
Return type:: ResolvedClassDefinition

try_class_definition(class_id)[source]

Return the resolved class definition if it exists, otherwise None.

Parameters:: class_id (str)
Return type:: ResolvedClassDefinition | None

attribute_definition(class_id, attribute_name)[source]

Return the attribute definition for a canonical class and attribute.

Raises

KeyError: If the class or attribute is unknown.

Parameters:

class_id (str)
attribute_name (str)

Return type:

AttributeDefinition

try_attribute_definition(class_id, attribute_name)[source]

Return an attribute definition if it exists, otherwise None.

This is useful when attributes may be unmapped, ignored or not relevant for rights validation.

Parameters:

class_id (str)
attribute_name (str)

Return type:

AttributeDefinition | None

update_privileges(class_id, attribute_name)[source]

Return attribute-level update privileges.

Raises

KeyError: If the class or attribute is unknown.

Parameters:

class_id (str)
attribute_name (str)

Return type:

frozenset

try_update_privileges(class_id, attribute_name)[source]

Return attribute-level update privileges if the attribute exists.

Returns None if the class or attribute is unknown.

Parameters:

class_id (str)
attribute_name (str)

Return type:

frozenset[str] | None

crud_rules(class_id)[source]

Return all resolved CRUD rules for a class.

Parameters:: class_id (str)
Return type:: ResolvedCrudRules

validations(class_id, attribute_name)[source]

Return attribute-level validations for a canonical attribute.

Parameters:

class_id (str)
attribute_name (str)

Return type:

list

try_validations(class_id, attribute_name)[source]

Return attribute-level validations if the attribute exists.

Returns None if the class or attribute is unknown.

Parameters:

class_id (str)
attribute_name (str)

Return type:

list[AttributeValidation] | None

transitions(class_id, attribute_name)[source]

Return transition validations for a canonical attribute.

Parameters:

class_id (str)
attribute_name (str)

Return type:

list

try_transitions(class_id, attribute_name)[source]

Return transition validations if the attribute exists.

Returns None if the class or attribute is unknown.

Parameters:

class_id (str)
attribute_name (str)

Return type:

list[TransitionValidation] | None

create_rules(class_id)[source]

Return resolved create rules for a class.

Parameters:: class_id (str)
Return type:: tuple[Rule, …]

read_rules(class_id)[source]

Return resolved read rules for a class.

Parameters:: class_id (str)
Return type:: tuple[Rule, …]

update_rules(class_id)[source]

Return resolved update rules for a class.

Parameters:: class_id (str)
Return type:: tuple[Rule, …]

delete_rules(class_id)[source]

Return resolved delete rules for a class.

Parameters:: class_id (str)
Return type:: tuple[Rule, …]

transition_rules(class_id, attribute_name)[source]

Return resolved transition rules for a canonical attribute.

Raises

KeyError: If the class or attribute is unknown.

Parameters:

class_id (str)
attribute_name (str)

Return type:

frozenset

Fields

rights

Type: ResolvedRights

Fully resolved runtime rights configuration.

SubclassRightsCapability

class teksi_hooks.capabilities.rights.SubclassRightsCapability(rights)[source]

Runtime lookup capability for subclass-based rights inheritance.

The capability exposes child classes whose rights may be considered when evaluating permissions on a parent class.

Parameters:: rights (ResolvedRights)

subclasses(class_id)[source]

Return subclasses contributing rights to the supplied class.

Raises

KeyError: If the class is unknown.

Parameters:: class_id (str)
Return type:: tuple[str, …]

try_subclasses(class_id)[source]

Return subclasses if the class exists.

Returns

tuple[str, …] | None: Contributing subclasses or None if the class is unknown.

Parameters:: class_id (str)
Return type:: tuple[str, …] | None

Fields

rights

Type: ResolvedRights

Fully resolved runtime rights configuration.