File size: 2,643 Bytes
d1ceb73 |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 |
"""An Authorizer for use in the Jupyter server.
The default authorizer (AllowAllAuthorizer)
allows all authenticated requests
.. versionadded:: 2.0
"""
# Copyright (c) Jupyter Development Team.
# Distributed under the terms of the Modified BSD License.
from __future__ import annotations
from typing import TYPE_CHECKING, Awaitable
from traitlets import Instance
from traitlets.config import LoggingConfigurable
from .identity import IdentityProvider, User
if TYPE_CHECKING:
from jupyter_server.base.handlers import JupyterHandler
class Authorizer(LoggingConfigurable):
"""Base class for authorizing access to resources
in the Jupyter Server.
All authorizers used in Jupyter Server
should inherit from this base class and, at the very minimum,
implement an ``is_authorized`` method with the
same signature as in this base class.
The ``is_authorized`` method is called by the ``@authorized`` decorator
in JupyterHandler. If it returns True, the incoming request
to the server is accepted; if it returns False, the server
returns a 403 (Forbidden) error code.
The authorization check will only be applied to requests
that have already been authenticated.
.. versionadded:: 2.0
"""
identity_provider = Instance(IdentityProvider)
def is_authorized(
self, handler: JupyterHandler, user: User, action: str, resource: str
) -> Awaitable[bool] | bool:
"""A method to determine if ``user`` is authorized to perform ``action``
(read, write, or execute) on the ``resource`` type.
Parameters
----------
user : jupyter_server.auth.User
An object representing the authenticated user,
as returned by :meth:`jupyter_server.auth.IdentityProvider.get_user`.
action : str
the category of action for the current request: read, write, or execute.
resource : str
the type of resource (i.e. contents, kernels, files, etc.) the user is requesting.
Returns
-------
bool
True if user authorized to make request; False, otherwise
"""
raise NotImplementedError
class AllowAllAuthorizer(Authorizer):
"""A no-op implementation of the Authorizer
This authorizer allows all authenticated requests.
.. versionadded:: 2.0
"""
def is_authorized(
self, handler: JupyterHandler, user: User, action: str, resource: str
) -> bool:
"""This method always returns True.
All authenticated users are allowed to do anything in the Jupyter Server.
"""
return True
|