Spaces:
Sleeping
Sleeping
| """ | |
| User authentication and management module. | |
| Handles demo users and user role verification. | |
| """ | |
| from typing import Optional, List | |
| from metadata_schema import User | |
| from config import DEMO_USERS, UserRole, ROLE_COLLECTION_ACCESS | |
| class UserManager: | |
| """ | |
| Manages user authentication and authorization. | |
| For production, this would integrate with OAuth/LDAP. | |
| """ | |
| def __init__(self): | |
| """Initialize user manager with demo users.""" | |
| self.users = { | |
| username: User( | |
| username=data["username"], | |
| name=data["name"], | |
| role=data["role"], | |
| department=data["department"], | |
| ) | |
| for username, data in DEMO_USERS.items() | |
| } | |
| def get_user(self, username: str) -> Optional[User]: | |
| """ | |
| Get user by username. | |
| Args: | |
| username: Username to look up | |
| Returns: | |
| User object if found, None otherwise | |
| """ | |
| return self.users.get(username) | |
| def list_users(self) -> List[User]: | |
| """ | |
| Get list of all available users (for demo/login screen). | |
| Returns: | |
| List of User objects | |
| """ | |
| return list(self.users.values()) | |
| def get_user_accessible_collections(self, role: str) -> List[str]: | |
| """ | |
| Get list of document collections accessible to a user by their role. | |
| Args: | |
| role: User role (from UserRole enum) | |
| Returns: | |
| List of collection names the role can access | |
| """ | |
| try: | |
| role_enum = UserRole(role) | |
| collections = ROLE_COLLECTION_ACCESS.get(role_enum, []) | |
| return [c.value for c in collections] | |
| except ValueError: | |
| # Unknown role | |
| return [] | |
| def is_role_authorized_for_collection(self, role: str, collection: str) -> bool: | |
| """ | |
| Check if a user role is authorized to access a specific collection. | |
| This is used for RBAC enforcement. | |
| Args: | |
| role: User role | |
| collection: Collection name | |
| Returns: | |
| True if role has access to collection, False otherwise | |
| """ | |
| accessible = self.get_user_accessible_collections(role) | |
| return collection in accessible | |
| def verify_user_credentials(self, username: str) -> bool: | |
| """ | |
| Verify that a user exists. | |
| For demo purposes, we just check existence. | |
| In production, verify against auth system. | |
| Args: | |
| username: Username to verify | |
| Returns: | |
| True if user exists, False otherwise | |
| """ | |
| return username in self.users | |
| # Global user manager instance | |
| _user_manager = None | |
| def get_user_manager() -> UserManager: | |
| """ | |
| Get singleton user manager instance. | |
| """ | |
| global _user_manager | |
| if _user_manager is None: | |
| _user_manager = UserManager() | |
| return _user_manager | |