Merge pull request #53 from permitio/asaf/cto-228-add-bulk-relationsh…

…ip-tuple-api-to-python-sdk

add bulk relationship tuple api to python SDK + add missing APIs to sync python client

permit/api/api_client.py

@@ -144,7 +144,7 @@ def role_assignments(self) -> RoleAssignmentsApi:
  @property
  def relationship_tuples(self) -> RelationshipTuplesApi:
  """
- API for managing role assignments.
+ API for managing relationship tuples.
  See: https://api.permit.io/v2/redoc#tag/Relationship-tuples
  """
  return self._relationship_tuples

permit/api/models.py

@@ -1578,6 +1578,25 @@ class Config:
  )
 
 
+class RelationshipTupleBlockRead(BaseModel):
+ class Config:
+ extra = Extra.allow
+
+ subject: str = Field(
+ ...,
+ description="resource_key:resource_instance_key of the subject",
+ title="Subject",
+ )
+ relation: str = Field(
+ ..., description="key of the assigned relation", title="Relation"
+ )
+ object: str = Field(
+ ...,
+ description="resource_key:resource_instance_key of the object",
+ title="Object",
+ )
+
+
 class RelationshipTupleCreate(BaseModel):
  class Config:
  extra = Extra.allow
@@ -1604,6 +1623,22 @@ class Config:
  )
 
 
+class RelationshipTupleCreateBulkOperation(BaseModel):
+ class Config:
+ extra = Extra.allow
+
+ operations: List[RelationshipTupleCreate] = Field(
+ ..., max_items=1000, title="Operations"
+ )
+
+
+class RelationshipTupleCreateBulkOperationResult(BaseModel):
+ pass
+
+ class Config:
+ extra = Extra.allow
+
+
 class RelationshipTupleDelete(BaseModel):
  class Config:
  extra = Extra.allow
@@ -1625,6 +1660,20 @@ class Config:
  )
 
 
+class RelationshipTupleDeleteBulkOperation(BaseModel):
+ class Config:
+ extra = Extra.allow
+
+ idents: List[RelationshipTupleDelete] = Field(..., max_items=1000, title="Idents")
+
+
+class RelationshipTupleDeleteBulkOperationResult(BaseModel):
+ pass
+
+ class Config:
+ extra = Extra.allow
+
+
 class RelationshipTupleObj(BaseModel):
  class Config:
  extra = Extra.allow

permit/api/relationship_tuples.py

@@ -17,7 +17,11 @@
 from .context import ApiContextLevel, ApiKeyAccessLevel
 from .models import (
  RelationshipTupleCreate,
+ RelationshipTupleCreateBulkOperation,
+ RelationshipTupleCreateBulkOperationResult,
  RelationshipTupleDelete,
+ RelationshipTupleDeleteBulkOperation,
+ RelationshipTupleDeleteBulkOperationResult,
  RelationshipTupleRead,
 )
 
@@ -100,3 +104,69 @@ async def delete(self, tuple_data: RelationshipTupleDelete) -> None:
  PermitContextError: If the configured ApiContext does not match the required endpoint context.
  """
  return await self.__relationship_tuples.delete("", json=tuple_data)
+
+ @required_permissions(ApiKeyAccessLevel.ENVIRONMENT_LEVEL_API_KEY)
+ @required_context(ApiContextLevel.ENVIRONMENT)
+ @validate_arguments
+ async def bulk_create(
+ self, tuples: List[RelationshipTupleCreate]
+ ) -> RelationshipTupleCreateBulkOperationResult:
+ """
+ Creates multiple relationship tuples at once using the provided tuple data.
+
+ Args:
+ tuples: The relationship tuples to create.
+ Each tuple object is of type RelationshipTupleCreate and is essentially
+ a tuple of (subject, relation, object, tenant).
+
+ subject and object are both resource instances, formatted as
+ `<resourcetype:instancekey>` strings (e.g: Folder:budget23).
+ relation is the name of the relation.
+ tenant is the key of the tenant in which to place the relation
+ (optional if at least one of subject/object already exists).
+
+ Subject and object must both be resource instances *in the same tenant*!
+
+ Returns:
+ the tuples creation result (RelationshipTupleCreateBulkOperationResult)
+
+ Raises:
+ PermitApiError: If the API returns an error HTTP status code.
+ PermitContextError: If the configured ApiContext does not match the required endpoint context.
+ """
+ return await self.__relationship_tuples.post(
+ "/bulk",
+ model=RelationshipTupleCreateBulkOperationResult,
+ json=RelationshipTupleCreateBulkOperation(operations=tuples),
+ )
+
+ @required_permissions(ApiKeyAccessLevel.ENVIRONMENT_LEVEL_API_KEY)
+ @required_context(ApiContextLevel.ENVIRONMENT)
+ @validate_arguments
+ async def bulk_delete(
+ self, tuples: List[RelationshipTupleDelete]
+ ) -> RelationshipTupleDeleteBulkOperationResult:
+ """
+ Deletes multiple relationship tuples at once using the provided tuple data.
+
+ Args:
+ tuples: The relationship tuples to delete.
+ Each tuple object is of type RelationshipTupleDelete and is essentially
+ a tuple of (subject, relation, object).
+
+ subject and object are both resource instances, formatted as
+ `<resourcetype:instancekey>` strings (e.g: Folder:budget23).
+ relation is the name of the relation.
+
+ Returns:
+ the tuples deletion result (RelationshipTupleDeleteBulkOperationResult)
+
+ Raises:
+ PermitApiError: If the API returns an error HTTP status code.
+ PermitContextError: If the configured ApiContext does not match the required endpoint context.
+ """
+ return await self.__relationship_tuples.delete(
+ "/bulk",
+ model=RelationshipTupleDeleteBulkOperationResult,
+ json=RelationshipTupleDeleteBulkOperation(idents=tuples),
+ )

permit/api/sync_api_client.py

@@ -5,9 +5,13 @@
 from .deprecated import DeprecatedApi
 from .environments import EnvironmentsApi
 from .projects import ProjectsApi
+from .relationship_tuples import RelationshipTuplesApi
 from .resource_action_groups import ResourceActionGroupsApi
 from .resource_actions import ResourceActionsApi
 from .resource_attributes import ResourceAttributesApi
+from .resource_instances import ResourceInstancesApi
+from .resource_relations import ResourceRelationsApi
+from .resource_roles import ResourceRolesApi
 from .resources import ResourcesApi
 from .role_assignments import RoleAssignmentsApi
 from .roles import RolesApi
@@ -35,6 +39,10 @@ class SyncProjectsApi(ProjectsApi, metaclass=SyncClass):
  pass
 
 
+class SyncRelationshipTuplesApi(RelationshipTuplesApi, metaclass=SyncClass):
+ pass
+
+
 class SyncResourceActionGroupsApi(ResourceActionGroupsApi, metaclass=SyncClass):
  pass
 
@@ -47,6 +55,18 @@ class SyncResourceAttributesApi(ResourceAttributesApi, metaclass=SyncClass):
  pass
 
 
+class SyncResourceInstancesApi(ResourceInstancesApi, metaclass=SyncClass):
+ pass
+
+
+class SyncResourceRelationsApi(ResourceRelationsApi, metaclass=SyncClass):
+ pass
+
+
+class SyncResourceRolesApi(ResourceRolesApi, metaclass=SyncClass):
+ pass
+
+
 class SyncResourcesApi(ResourcesApi, metaclass=SyncClass):
  pass
 
@@ -81,9 +101,13 @@ def __init__(self, config: PermitConfig):
  self._condition_sets = SyncConditionSetsApi(config)
  self._environments = SyncEnvironmentsApi(config)
  self._projects = SyncProjectsApi(config)
+ self._relationship_tuples = SyncRelationshipTuplesApi(config)
  self._action_groups = SyncResourceActionGroupsApi(config)
  self._resource_actions = SyncResourceActionsApi(config)
  self._resource_attributes = SyncResourceAttributesApi(config)
+ self._resource_instances = SyncResourceInstancesApi(config)
+ self._resource_relations = SyncResourceRelationsApi(config)
+ self._resource_roles = SyncResourceRolesApi(config)
  self._resources = SyncResourcesApi(config)
  self._role_assignments = SyncRoleAssignmentsApi(config)
  self._roles = SyncRolesApi(config)
@@ -146,6 +170,30 @@ def resource_attributes(self) -> SyncResourceAttributesApi:
  """
  return self._resource_attributes
 
+ @property
+ def resource_roles(self) -> SyncResourceRolesApi:
+ """
+ API for managing resource roles.
+ See: https://api.permit.io/v2/redoc#tag/Resource-Roles
+ """
+ return self._resource_roles
+
+ @property
+ def resource_relations(self) -> SyncResourceRelationsApi:
+ """
+ API for managing resource relations.
+ See: https://api.permit.io/v2/redoc#tag/Resource-Relations
+ """
+ return self._resource_relations
+
+ @property
+ def resource_instances(self) -> SyncResourceInstancesApi:
+ """
+ API for managing resource instances.
+ See: https://api.permit.io/v2/redoc#tag/Resource-Instances
+ """
+ return self._resource_instances
+
  @property
  def resources(self) -> SyncResourcesApi:
  """
@@ -162,6 +210,14 @@ def role_assignments(self) -> SyncRoleAssignmentsApi:
  """
  return self._role_assignments
 
+ @property
+ def relationship_tuples(self) -> SyncRelationshipTuplesApi:
+ """
+ API for managing relationship tuples.
+ See: https://api.permit.io/v2/redoc#tag/Relationship-tuples
+ """
+ return self._relationship_tuples
+
  @property
  def roles(self) -> SyncRolesApi:
  """

setup.py

@@ -10,7 +10,7 @@ def get_requirements(env=""):
 
 setup(
  name="permit",
- version="2.2.0",
+ version="2.2.1",
  packages=find_packages(),
  author="Asaf Cohen",
  author_email="asaf@permit.io",

tests/test_rebac_e2e.py

@@ -14,6 +14,7 @@
  RelationshipTupleCreate,
  RelationshipTupleDelete,
  ResourceCreate,
+ ResourceInstanceCreate,
  ResourceRoleCreate,
  RoleAssignmentCreate,
  RoleAssignmentRemove,
@@ -284,6 +285,18 @@ class PermissionAssertions:
  (f"{ACCOUNT.key}:cocacola", "account", f"{FOLDER.key}:recipes", TENANT_CC.key),
 ]
 
+BULK_RELATIONSHIPS = [
+ # rnd folder contains 2 documents
+ (f"{FOLDER.key}:media", "parent", f"{DOCUMENT.key}:movie1", TENANT_PERMIT.key),
+ (f"{FOLDER.key}:media", "parent", f"{DOCUMENT.key}:movie2", TENANT_PERMIT.key),
+]
+
+BULK_RELATIONSHIPS_INSTANCES = [
+ f"{FOLDER.key}:media",
+ f"{DOCUMENT.key}:movie1",
+ f"{DOCUMENT.key}:movie2",
+]
+
 ASSIGNMENTS_AND_ASSERTIONS: List[PermissionAssertions] = [
  # direct access
  PermissionAssertions(
@@ -718,6 +731,66 @@ async def test_rebac_policy(permit: Permit):
  assert rel_tuple.relation == relation
  assert rel_tuple.object == object
  assert rel_tuple.tenant == tenant
+
+ tuples = await permit.api.relationship_tuples.list()
+ len_tuples = len(tuples)
+ logger.debug(
+ f"there are currently {len_tuples} relationship tuples in the system"
+ )
+
+ # bulk create relationship tuples
+ bulk_relationships_to_create = [
+ RelationshipTupleCreate(
+ subject=subject, relation=relation, object=object, tenant=tenant
+ )
+ for (subject, relation, object, tenant) in BULK_RELATIONSHIPS
+ ]
+ bulk_relationships_to_delete = [
+ RelationshipTupleDelete(subject=subject, relation=relation, object=object)
+ for (subject, relation, object, tenant) in BULK_RELATIONSHIPS
+ ]
+
+ for instance_key in BULK_RELATIONSHIPS_INSTANCES:
+ parts = instance_key.split(":")
+ logger.debug(f"creating resource instance: {instance_key}")
+ await permit.api.resource_instances.create(
+ ResourceInstanceCreate(
+ key=parts[1], resource=parts[0], tenant=TENANT_PERMIT.key
+ )
+ )
+
+ async def create_relationships_in_bulk():
+ await permit.api.relationship_tuples.bulk_create(
+ tuples=bulk_relationships_to_create
+ )
+
+ tuples = await permit.api.relationship_tuples.list()
+ assert len(tuples) == len_tuples + len(BULK_RELATIONSHIPS)
+ logger.debug(
+ f"there are currently {len(tuples)} relationship tuples in the system"
+ )
+
+ async def remove_relationships_in_bulk():
+ await permit.api.relationship_tuples.bulk_delete(
+ tuples=bulk_relationships_to_delete
+ )
+
+ tuples = await permit.api.relationship_tuples.list()
+ assert len(tuples) == len_tuples
+ logger.debug(
+ f"there are currently {len(tuples)} relationship tuples in the system"
+ )
+
+ logger.debug(
+ f"creating {len(BULK_RELATIONSHIPS)} relationship tuples in bulk: {str(BULK_RELATIONSHIPS)}"
+ )
+ await create_relationships_in_bulk()
+
+ logger.debug(
+ f"removing the same {len(BULK_RELATIONSHIPS)} relationship tuples in bulk: {str(BULK_RELATIONSHIPS)}"
+ )
+ await remove_relationships_in_bulk()
+
  # assign roles and then run permission checks
  for test_step in ASSIGNMENTS_AND_ASSERTIONS:
  try: