[davidlougheed]

Work in progress (currently just a skeleton implementation.)

Adds a policy engine to bento_authorization_service backed by the PCGL authorization service, for integration of Bento into the PCGL system.

[codecov]

Codecov Report

❌ Patch coverage is 76.19048% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 93.37%. Comparing base (dd36973) to head (eb4ea2d).

Files with missing lines	Patch %	Lines
bento_authorization_service/policy_engine/pcgl.py	76.92%	3 Missing ⚠️
..._authorization_service/policy_engine/dependency.py	60.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #79      +/-   ##
==========================================
- Coverage   93.75%   93.37%   -0.39%     
==========================================
  Files          26       27       +1     
  Lines         977      996      +19     
  Branches       74       75       +1     
==========================================
+ Hits          916      930      +14     
- Misses         56       60       +4     
- Partials        5        6       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[v-rocheleau]

Based on the discussions for RP integration with pcgl-authz, I think we will need an hybrid approach.

Bottom line:

• Aggregate data: we'll need to use our own authorization service
  • Anonymous access is not within the pcgl-authz scope for release
• Internal service-to-service (e.g. ETL => Katsu): we'll need to use our own authorization service
  • Service permissions wrt other services is not within the pcgl-authz scope for release
  • "Allow ETL to ingest any Study into Katsu" is not a grant that can be expressed by pcgl-authz
• External service-to-service (e.g. ETL => Submission/File-Manager): policy enforcement is owned by Submission services, no authz checks on our end since we are the client in this scenario
  • I need to document the process and operations to provide ETL with access creds for the service
• Files manifest permission check: this is the only check we will need to delegate to pcgl-authz for release

This means that our authz service needs to accommodate:

• Vanilla bento grants for resources out of pcgl-authz's scope
• Pcgl-authz permission checks delegation for resources within pcgl-authz's scope

I'm unsure how this would fit with the implementation you had in mind with PolicyEngine dependency injection.

I guess that in this case PcglPolicyEngine could be an extension of BentoPolicyEngine, and we could "route" authorization checks based on the target resource.

For instance, if we add a Resource that is pcgl scoped like pcgl:file-manager:study:<id>:files (pseudo resource, forgot the exact format), PcglPolicyEngine would delegate it to pcgl-authz, for other resources it can fallback to bento policies inherited from the parent BentoPolicyEngine. Or something like that 🤔