Models / Rulesets

CrudRules

class teksi_hooks.models.rulesets.CrudRules(create_rules=<factory>, read_rules=<factory>, update_rules=<factory>, delete_rules=<factory>)

Mutable rule container for parsed CRUD authorization rules.

This model represents the rules as loaded from configuration before the resolver expands defaults, inheritance and shortcuts. The resolved model should use ResolvedCrudRules.

Parameters:

• create_rules (list[Rule])

• read_rules (list[Rule])

• update_rules (list[Rule])

• delete_rules (list[Rule])

Fields

create_rules

Type: list

Rules governing creation of new objects.

read_rules

Type: list

Rules governing read access. Currently not required by the import validation workflow, but included for future use.

update_rules

Type: list

Rules governing updates to existing objects.

delete_rules

Type: list

Rules governing deletion of existing objects.

InheritRule

class teksi_hooks.models.rulesets.InheritRule(source)

Reuses another rule set.

This is used for declarations such as inherit: create_rules or inherit: update_rules. The resolver expands inherited rules into effective rules before runtime evaluation.

Parameters:

source (str)

Base class: Rule

Fields

source

Type: str

Name of the rule set to inherit from, for example create_rules, update_rules or delete_rules.

OwnershipRule

class teksi_hooks.models.rulesets.OwnershipRule(attribute)

Authorizes an operation based on ownership.

Ownership is evaluated by comparing a provider-related value with the value stored in the configured attribute. For updates and deletes this should be evaluated against the existing database row. For inserts this should be evaluated against the submitted row.

Parameters:

attribute (str)

Base class: Rule

Fields

attribute

Type: str

Attribute used to determine ownership. Typical example: fk_provider.

PrivilegeRule

class teksi_hooks.models.rulesets.PrivilegeRule(privileges, when=None)

Authorizes an operation based on one or more required privileges.

A privilege rule may optionally be guarded by a condition. If a condition is present, the rule only applies when the condition evaluates to true.

Parameters:

• privileges (frozenset[str])

• when (Condition | None)

Base class: Rule

Fields

privileges

Type: frozenset

Privileges that grant the operation if this rule applies. The provider must have at least one of these privileges in the relevant data-owner context.

when

Type: teksi_hooks.models.conditions.Condition | None

Optional condition restricting when this privilege rule applies. If omitted, the rule applies unconditionally.

ResolvedCrudRules

class teksi_hooks.models.rulesets.ResolvedCrudRules(create_rules, read_rules, update_rules, delete_rules)

Immutable rule container for compiled CRUD authorization rules.

This model is produced by the resolver and should be consumed by runtime components such as hooks and validators. Lists from CrudRules are converted to tuples to make the resolved rule set immutable.

Parameters:

• create_rules (tuple[Rule, ...])

• read_rules (tuple[Rule, ...])

• update_rules (tuple[Rule, ...])

• delete_rules (tuple[Rule, ...])

Fields

create_rules

Type: tuple

Resolved rules governing creation of new objects.

read_rules

Type: tuple

Resolved rules governing read access.

update_rules

Type: tuple

Resolved rules governing updates to existing objects.

delete_rules

Type: tuple

Resolved rules governing deletion of existing objects.

StateTransitionRule

class teksi_hooks.models.rulesets.StateTransitionRule(privileges, from_value=None, to_value=None, bilateral=False)

Authorizes a state transition for an attribute.

A state transition rule describes one permitted edge in a state graph. It is usually attached to an attribute such as status.

Parameters:

• privileges (frozenset[str])

• from_value (str | None)

• to_value (str | None)

• bilateral (bool)

Base class: Rule

Fields

privileges

Type: frozenset

Privileges that grant this specific transition.

from_value

Type: str | None

Allowed source value of the transition. If omitted, the transition may be interpreted as matching any source value, depending on the resolver semantics.

to_value

Type: str | None

Allowed target value of the transition. If omitted, the transition may be interpreted as matching any target value, depending on the resolver semantics.

bilateral

Type: bool

Whether the transition is allowed in both directions. If true, from_value -> to_value also allows to_value -> from_value.