Models / Rights

AttributeDefaultDefinition

class teksi_hooks.models.rights.AttributeDefaultDefinition(pattern, update_privileges=<factory>)[source]

Default attribute rights applied by attribute-name pattern.

This is mainly used for compact model definitions where many attributes share the same privilege pattern. Example:

ag64_* -> update: [DBW_WI] ag96_* -> update: [DBW_GEP]

The parser stores the pattern. The resolver decides which concrete attributes match the pattern.

Parameters:

  • pattern (str)

  • update_privileges (frozenset[str])

Fields

pattern

Type: str

Attribute-name pattern used to match source or canonical attributes. Usually a simple wildcard pattern such as ag64_*.

update_privileges

Type: frozenset[PrivilegeId]

Default update privileges applied to attributes matching the pattern.

AttributeDefinition

class teksi_hooks.models.rights.AttributeDefinition(update_privileges=<factory>, validations=<factory>, transitions=<factory>)[source]

Rights and validation definition for one canonical attribute.

Attribute definitions describe attribute-level update privileges, generic validations and state transition validations.

Parameters:

Fields

update_privileges

Type: frozenset[PrivilegeId]

Privileges allowed to update this attribute. If empty, the attribute has no explicit attribute-level update privilege.

validations

Type: list[AttributeValidation]

Attribute-level validation rules, for example freshness or data-quality checks.

transitions

Type: list[TransitionValidation]

Transition validations for state-like attributes. These define which value transitions are allowed and under which privileges.

CanonicalDerivedRights

class teksi_hooks.models.rights.CanonicalDerivedRights(local_objects=<factory>, remote_objects=<factory>)[source]

Result of a derived-rights resolution.

Represents the canonical objects participating in a rights-derivation relationship after join evaluation has been performed.

Parameters:

Fields

local_objects

Type: tuple[CanonicalObjectIdentity, ...]

Canonical local objects participating in the resolved rights-derivation relationship.

remote_objects

Type: tuple[CanonicalObjectIdentity, ...]

Canonical remote objects from which rights may be derived.

ClassDefinition

class teksi_hooks.models.rights.ClassDefinition(id, superclass_id=None, rights_from_subclass=False, derive_rights_from=<factory>, crud_rules=<factory>, attributes=<factory>)[source]

Parsed class-level rights definition.

This model represents the rights configuration as loaded from the source definition before inheritance, defaults, derived rights, and rule shortcuts are resolved.

ClassDefinition is part of the source model. Runtime validation should consume ResolvedClassDefinition instead.

Parameters:

Fields

id

Type: str

Canonical class identifier. Usually corresponds to a TEKSI semantic class or table identifier.

superclass_id

Type: str | None

Optional canonical class identifier of the superclass from which this class inherits rights and attributes.

rights_from_subclass

Type: bool

Whether rights should be evaluated from subclass definitions. This is mainly used for abstract or inheritance-root classes whose concrete rights are defined on subclasses.

derive_rights_from

Type: tuple[DerivedRights, ...]

Optional relations from which rights can be derived. Derived rights are resolved against related objects and combined with local rights according to resolver semantics.

crud_rules

Type: CrudRules

Parsed CRUD rules for this class. These may include direct rules, ownership rules and inheritance references.

attributes

Type: dict[str, AttributeDefinition]

Attribute definitions keyed by canonical attribute identifier.

DefaultDefinitions

class teksi_hooks.models.rights.DefaultDefinitions(crud_rules=<factory>, attribute_defaults=<factory>, attribute_validation_rules=<factory>, object_validation_rules=<factory>)[source]

Global default rights definitions.

Defaults are applied by the resolver when a class does not define its own corresponding rule set. Class-level definitions override these defaults.

Parameters:

Fields

crud_rules

Type: CrudRules

Default CRUD rules applied to classes that do not explicitly define their own rules.

attribute_defaults

Type: tuple[AttributeDefaultDefinition, ...]

Default attribute-level rights applied by attribute-name pattern. These defaults are resolved against concrete attributes by the resolver. Example: ag64_* may grant DBW_WI, while ag96_* may grant DBW_GEP.

attribute_validation_rules

Type: Mapping[str, tuple[AttributeValidation, ...]]

Default attribute validation rules keyed by canonical attribute identifier. The resolver copies matching rules into AttributeDefinition.validations.

object_validation_rules

Type: Mapping[str, ObjectValidation]

Named object-level validation definitions. The resolver applies a definition to classes containing all canonical value names required by its rules.

DerivedRights

class teksi_hooks.models.rights.DerivedRights(class_id, local_attribute='obj_id', remote_attribute='obj_id')[source]

Rights derivation definition.

Defines how rights of the current class can be derived from a related canonical class. The relation is expressed as an attribute equality between the local object and the remote object.

Examples

Local foreign key:

local.fk_wastewater_structure

=

wastewater_structure.obj_id

YAML:

derive_rights_from:

  • class: wastewater_structure local_attribute: fk_wastewater_structure

Reverse foreign key:

obj_id

=

reach.fk_reach_point_from

YAML:

derive_rights_from:

  • class: reach remote_attribute: fk_reach_point_from

Explicit join:

local.fk_baz

=

foo.fk_bar

YAML:

derive_rights_from:

  • class: foo local_attribute: fk_baz remote_attribute: fk_bar

Parameters:

  • class_id (str)

  • local_attribute (str)

  • remote_attribute (str)

Fields

class_id

Type: str

Canonical class identifier from which rights may be derived.

local_attribute

Type: str

Local attribute participating in the rights-derivation join. Defaults to obj_id.

remote_attribute

Type: str

Attribute on the related canonical class participating in the rights-derivation join. Defaults to obj_id.

PermissionFinding

class teksi_hooks.models.rights.PermissionFinding(severity, message, code, attribute_name=None, rule_id=None, provider_oid=None, dataowner_oid=None, required_privilege=None, available_privileges=<factory>, evaluation_path=<factory>, transitive_evaluation_enabled=None, details=<factory>)[source]

Finding produced by rights / permission evaluation.

A permission finding means the proposed change may be structurally valid, but is not allowed for the current provider, data owner, privilege context or rights rule configuration.

Parameters:

  • severity (Severity)

  • message (str)

  • code (str)

  • attribute_name (str | None)

  • rule_id (str | None)

  • provider_oid (Oid | None)

  • dataowner_oid (Oid | None)

  • required_privilege (str | None)

  • available_privileges (tuple[str, ...])

  • evaluation_path (tuple[str, ...])

  • transitive_evaluation_enabled (bool | None)

  • details (dict[str, Any])

Base class: Finding

Fields

severity

Type: Severity

Severity level assigned to the finding.

message

Type: str

Human-readable description of the validation issue.

code

Type: str

Stable permission finding code. Examples: ‘permission_denied’, ‘missing_privilege’, ‘provider_not_authorized’.

attribute_name

Type: str | None

Canonical attribute involved in the permission finding, or None if the finding applies to the whole object/change.

rule_id

Type: str | None

Identifier of the rights rule or condition that denied the change, if available.

provider_oid

Type: Oid | None

Provider organisation oid used during rights evaluation, if relevant.

dataowner_oid

Type: Oid | None

Data owner organisation oid used during rights evaluation, if relevant.

required_privilege

Type: PrivilegeId | None

Privilege required for the attempted operation, if known.

available_privileges

Type: tuple[PrivilegeId, ...]

Privileges available to the evaluated provider/data owner context.

evaluation_path

Type: tuple[str, ...]

Optional rights evaluation path. Useful for derived or recursive rights, for example (‘reach_point’, ‘reach’, ‘wastewater_structure’).

transitive_evaluation_enabled

Type: bool | None

Whether transitive or recursive rights evaluation was enabled when this permission finding was produced.

details

Type: dict[str, Any]

Additional permission finding details that are useful for debugging, reporting or future rule types.

ResolutionInfo

class teksi_hooks.models.rights.ResolutionInfo(superclass_id=None, derived_from=<factory>, inherited_attributes=<factory>, inherited_rules=<factory>)[source]

Optional debug information produced during rights resolution.

This model is not required for runtime validation. It can be attached to resolved models later if traceability, explanations or debugging output become necessary.

Parameters:

  • superclass_id (str | None)

  • derived_from (tuple[DerivedRights, ...])

  • inherited_attributes (frozenset[str])

  • inherited_rules (frozenset[str])

Fields

superclass_id

Type: str | None

Identifier of the superclass used during resolution, if any.

derived_from

Type: tuple[DerivedRights, ...]

Derived-rights declarations that contributed to the resolved definition.

inherited_attributes

Type: frozenset[str]

Attribute identifiers inherited from superclass definitions.

inherited_rules

Type: frozenset[str]

Rule-set identifiers inherited or expanded during resolution.

ResolvedAttributeDefinition

class teksi_hooks.models.rights.ResolvedAttributeDefinition(update_privileges=<factory>, validations=<factory>, transitions=<factory>)[source]

Effective runtime attribute definition.

Produced by the rights resolver after wildcard defaults, inheritance, attribute defaults and future resolver expansions have been applied.

Runtime code should consume this model rather than AttributeDefinition.

Parameters:

Fields

update_privileges

Type: frozenset[PrivilegeId]

Effective privileges allowed to update this attribute after all defaults and inheritance have been resolved.

validations

Type: tuple[AttributeValidation, ...]

Effective validation rules for this attribute after resolution.

transitions

Type: tuple[TransitionValidation, ...]

Effective transition validations for this attribute after resolution.

ResolvedClassDefinition

class teksi_hooks.models.rights.ResolvedClassDefinition(id, crud_rules, attributes, transition_rules, object_validations=<factory>, mandatory_attributes=<factory>)[source]

Resolved and immutable class-level rights definition.

This model is produced by the rights resolver. It should contain the effective rule set after defaults, inheritance, CRUD shortcuts and rule inheritance have been applied.

Runtime hooks and validators should use this model instead of ClassDefinition.

Parameters:

Fields

id

Type: str

Canonical class identifier of the resolved class.

crud_rules

Type: ResolvedCrudRules

Fully resolved immutable CRUD rules for this class.

attributes

Type: Mapping[str, ResolvedAttributeDefinition]

Resolved attribute definitions keyed by canonical attribute identifier.

transition_rules

Type: Mapping[str, StateTransitionRule]

Resolved state transition rules keyed by canonical attribute identifier.

object_validations

Type: tuple[ObjectValidation, ...]

Resolved object-level validation rules for this canonical class.

mandatory_attributes

Type: frozenset[str]

Effective canonical attributes that require a value. Class-specific declarations extend the validation defaults.

ResolvedRights

class teksi_hooks.models.rights.ResolvedRights(classes, derived_rights, subclass_rights, allow_transitive_transitions=True)[source]

Fully resolved rights configuration.

This object aggregates all resolver outputs required by runtime capabilities and evaluators.

Parameters:

  • classes (Mapping[str, ResolvedClassDefinition])

  • derived_rights (Mapping[str, tuple[DerivedRights, ...]])

  • subclass_rights (Mapping[str, tuple[str, ...]])

  • allow_transitive_transitions (bool)

Fields

classes

Type: Mapping[str, ResolvedClassDefinition]

Resolved class definitions keyed by canonical class identifier.

derived_rights

Type: Mapping[str, tuple[DerivedRights, ...]]

Rights derivation definitions keyed by canonical class identifier.

subclass_rights

Type: Mapping[str, tuple[str, ...]]

Subclass rights mappings keyed by canonical parent class identifier.

allow_transitive_transitions

Type: bool

Whether rights mappings allow for transitive transitions. Defaults to True.

RightsDefinition

class teksi_hooks.models.rights.RightsDefinition(privileges=<factory>, defaults=<factory>, classes=<factory>, validation_rules=<factory>, allow_transitive_transitions=True)[source]

Parsed rights configuration.

This is the top-level object produced by the rights parser before inheritance, defaults, derived rights and rule references are resolved.

Runtime validation should use resolved class definitions instead.

Parameters:

Fields

privileges

Type: Mapping[PrivilegeId, PrivilegeMetadata]

Privilege definitions keyed by privilege identifier. These definitions provide metadata such as localized labels and descriptions for privilege references used throughout the rights configuration.

defaults

Type: DefaultDefinitions

Global default definitions applied by the resolver when class-level rules are missing.

classes

Type: Mapping[str, ClassDefinition]

Parsed class definitions keyed by canonical class identifier.

validation_rules

Type: Mapping[str, tuple[AttributeValidation, ...]]

Global attribute validation rules keyed by attribute name. Example: last_modification.

allow_transitive_transitions

Type: bool

Whether transition validation may accept transitive paths through the configured transition graph.

RightsProfile

class teksi_hooks.models.rights.RightsProfile(identifier: 'str', provider_rights_path: 'Path', provider_privileges_path: 'Path')[source]
Parameters:

  • identifier (str)

  • provider_rights_path (Path)

  • provider_privileges_path (Path)

Fields

identifier

Type: str

Unique identifier of the entity to which the rights profile applies. If None, defaults to the template path.

provider_rights_path

Type: Path

Path to the provider rights yaml. If None, defaults to the template path.

provider_privileges_path

Type: Path

Path to the provider privilege yaml. If None, defaults to the template path.