Skip to content

cmem_client.models.access_condition¤

Access control and authorization models for Corporate Memory.

This module defines models for managing access conditions in Corporate Memory, which control user and group permissions for graphs, actions, and other resources. Access conditions form the foundation of Corporate Memory’s authorization system.

The AccessCondition model supports both static permissions (defined at creation) and dynamic permissions (computed via SPARQL queries), providing flexible access control patterns for different organizational needs.

Access conditions can grant various permissions including graph read/write access, action execution rights, and management permissions for other access conditions.

Classes:

Attributes:

AccessCondition¤

Bases: Model, ReadRepositoryItem

An access condition

A condition names who it applies to (requires_account, requires_group) and what they may then do (the grants below). A condition without a requires_* field applies to everyone. The grants of all matching conditions add up, so access is widened by adding a condition and never narrowed.

Attributes:

  • iri (str) – IRI of the access condition, e.g. http://eccenca.com/ac/my-condition. This is the key of the repository, and it has to start with that namespace.
  • name (str) – Short name identifying the condition, e.g. My Access Condition.
  • comment (str | None) – Longer description of what the condition is for.
  • requires_account (str | None) – IRI of the single account the condition applies to, e.g. http://eccenca.com/admin.
  • requires_group (list[str]) – IRIs of the groups an account has to be a member of for the condition to apply, e.g. http://eccenca.com/elds-admins.
  • readable_graphs (list[str]) – IRIs of the graphs this grants read access to. The special https://vocab.eccenca.com/auth/AllGraphs covers every graph.
  • writable_graphs (list[str]) – IRIs of the graphs this grants read and write access to.
  • allowed_actions (list[str]) – IRIs of the actions this grants permission to execute, e.g. https://vocab.eccenca.com/auth/Action/Build. The special .../Action/AllActions covers every action.
  • grant_allowed_actions (list[str]) – Patterns of actions whose granting conditions the holder may manage, e.g. https://vocab.eccenca.com/auth/Action/Build* or *. This delegates administration rather than granting the action itself.
  • grant_read_patterns (list[str]) – Patterns of graphs whose read-granting conditions the holder may manage, e.g. https://example.org/*.
  • grant_write_patterns (list[str]) – Patterns of graphs whose write-granting conditions the holder may manage.
  • query (str | None) – SPARQL SELECT query computing the grants instead of listing them, which is what makes a condition dynamic. It has to project the variables user, group, readGraph and writeGraph.
  • creator (str | None) – IRI of the account which created the condition. Read-only, so it is dropped from a create request.
  • created (datetime | None) – When the condition was created. Read-only as well.

Functions:

  • get_create_request – Create a CreateAccessConditionRequest dict
  • get_id – Get the IRI of the access condition
  • set_iri – Set the IRI of the access condition based on a new local name

allowed_actions¤

allowed_actions: list[str] = Field(alias='allowedActions', default=[])

comment¤

comment: str | None = None

created¤

created: datetime | None = None

creator¤

creator: str | None = None

get_create_request¤

get_create_request()

Create a CreateAccessConditionRequest dict

This object is used to create new access condition.

Returns:

  • dict – The request payload, with the staticId derived from the access condition
  • dict – IRI and the read-only keys removed.

Raises:

  • ValueError – If the access condition IRI does not start with the access condition namespace.

get_id¤

get_id()

Get the IRI of the access condition

grant_allowed_actions¤

grant_allowed_actions: list[str] = Field(alias='grantAllowedActions', default=[])

grant_read_patterns¤

grant_read_patterns: list[str] = Field(alias='grantReadPatterns', default=[])

grant_write_patterns¤

grant_write_patterns: list[str] = Field(alias='grantWritePatterns', default=[])

iri¤

iri: str

model_config¤

model_config = ConfigDict(extra='allow', populate_by_name=True)

name¤

name: str

query¤

query: str | None = Field(alias='dynamicAccessConditionQuery', default=None)

readable_graphs¤

readable_graphs: list[str] = Field(alias='readableGraphs', default=[])

requires_account¤

requires_account: str | None = Field(alias='requiresAccount', default=None)

requires_group¤

requires_group: list[str] = Field(alias='requiresGroup', default=[])

set_iri¤

set_iri(local_name)

Set the IRI of the access condition based on a new local name

this just adds the namespace prefix

writable_graphs¤

writable_graphs: list[str] = Field(alias='writableGraphs', default=[])

AccessConditionResultSet¤

Bases: Model

An access condition result set

Attributes:

content¤

content: list[AccessCondition]

model_config¤

model_config = ConfigDict(extra='allow', populate_by_name=True)

page¤

page: PageDescription

AccessConditionReview¤

Bases: Model

Review of access rights for a given account.

A review answers what an account may actually do, after every condition which applies to it has been evaluated and their grants added up.

Attributes:

  • principal_name (str) – Name of the reviewed account.
  • account_iri (str) – IRI of the reviewed account.
  • has_root_access (bool) – Whether the account bypasses access control entirely.
  • can_read_all (bool) – Whether the account may read every graph, which makes readable_graphs beside the point.
  • can_write_all (bool) – Whether the account may write every graph.
  • are_all_actions_allowed (bool) – Whether the account may execute every action.
  • readable_graphs (list[str]) – IRIs of the graphs the account may read.
  • writable_graphs (list[str]) – IRIs of the graphs the account may write.
  • allowed_actions (list[str]) – IRIs of the actions the account may execute.
  • read_graph_grants (list[str]) – Graph patterns whose read-granting conditions the account may manage.
  • write_graph_grants (list[str]) – Graph patterns whose write-granting conditions it may manage.
  • matching_access_conditions (list[MatchingAccessCondition]) – The conditions which produced this result, with the grants each one contributed. Use it to find out why an account has an access it should not have.
  • validity_time_stamp (datetime) – When the review was computed. A dynamic condition can change its outcome afterwards.
  • group_iri (list[str] | None) – IRIs of the groups the account belongs to.

account_iri¤

account_iri: str = Field(alias='accountIri')

allowed_actions¤

allowed_actions: list[str] = Field(alias='allowedActions', default=[])

are_all_actions_allowed¤

are_all_actions_allowed: bool = Field(alias='areAllActionsAllowed')

can_read_all¤

can_read_all: bool = Field(alias='canReadAll')

can_write_all¤

can_write_all: bool = Field(alias='canWriteAll')

group_iri¤

group_iri: list[str] | None = Field(alias='groupIri', default=None)

has_root_access¤

has_root_access: bool = Field(alias='hasRootAccess')

matching_access_conditions¤

matching_access_conditions: list[MatchingAccessCondition] = Field(alias='matchingAccessConditions', default=[])

model_config¤

model_config = ConfigDict(extra='allow', populate_by_name=True)

principal_name¤

principal_name: str = Field(alias='principalName')

read_graph_grants¤

read_graph_grants: list[str] = Field(alias='readGraphGrants', default=[])

readable_graphs¤

readable_graphs: list[str] = Field(alias='readableGraphs', default=[])

validity_time_stamp¤

validity_time_stamp: datetime = Field(alias='validityTimeStamp')

writable_graphs¤

writable_graphs: list[str] = Field(alias='writableGraphs', default=[])

write_graph_grants¤

write_graph_grants: list[str] = Field(alias='writeGraphGrants', default=[])

AccessControlConfiguration¤

Bases: Model

An access condition configuration

Attributes:

  • enabled (bool) – Whether access control is switched on for the deployment. With it off, the conditions are kept but not enforced.
  • admin_action (str | None) – IRI of the action which grants administration of access conditions.

admin_action¤

admin_action: str | None = Field(alias='adminAction', default=None)

enabled¤

enabled: bool = Field(default=False)

model_config¤

model_config = ConfigDict(extra='allow', populate_by_name=True)

AclAction¤

Bases: Model

An action that can be granted by an access condition.

Attributes:

  • iri (str) – IRI of the action, as used in AccessCondition.allowed_actions.
  • name (str) – Short name of the action.

iri¤

iri: str

model_config¤

model_config = ConfigDict(extra='allow', populate_by_name=True)

name¤

name: str

MatchingAccessCondition¤

Bases: Model

A single access condition that matched during a review.

Attributes:

access_condition_iri¤

access_condition_iri: str = Field(alias='accessConditionIri')

model_config¤

model_config = ConfigDict(extra='allow', populate_by_name=True)

read_graph_grants¤

read_graph_grants: list[str] = Field(alias='readGraphGrants', default=[])

write_graph_grants¤

write_graph_grants: list[str] = Field(alias='writeGraphGrants', default=[])

NS_AC¤

NS_AC = 'http://eccenca.com/ac/'

NS_ACTION¤

NS_ACTION = 'https://vocab.eccenca.com/auth/Action/'

Comments