utils.roles.rbac package¶

Submodules¶

utils.roles.rbac.scoped module¶

Which role names a user holds on one application.

Most role names are global: roles: [administrator] means administrator everywhere it is declared. APPLICATION_SCOPED_ROLES are the exception. Those carry a distinct grant per application, so reading them from the unscoped list would hand a user every deployed application’s copy at once. They come only from application_roles:

users:
  alice:
    application_roles:
      web-app-baserow: [mcp]

This module is the single source of truth for that rule. The Keycloak realm group builder, the LDAP role entry builder and the Open WebUI group reconciler all resolve membership through it, so the three paths cannot drift.

utils.roles.rbac.scoped.expand_mcp_role(role_name: str) → str¶

Return the role a grant confers, resolving the pre-split name.

Parameters:: role_name – a role as written in a user’s grants.

utils.roles.rbac.scoped.granted_roles(user_config: Mapping[str, object], application_id: str) → set[str]¶

Return the role names this user holds on one application.

Parameters:

user_config – the user’s merged configuration.
application_id – the application whose grants are being resolved.

utils.roles.rbac.scoped.members_with_role(users: Mapping[str, Mapping[str, object]] | None, application_id: str, role_name: str) → list[str]¶

Return the usernames holding role_name on application_id.

Parameters:

users – the merged users mapping.
application_id – the application whose grants are being resolved.
role_name – the role to filter by.

utils.roles.rbac package¶

Submodules¶

utils.roles.rbac.scoped module¶

Module contents¶