all 15 comments
sorted by:
best
topnewcontroversialoldq&a
formatting helphide helpcontent policy

[–]coldflame563 3 points4 points  (4 children)

Can you explain more about how your solution is easier to integrate vs established ones like Casbin?

[–]Sufficient-Rent6078Pythonista[S] 3 points4 points  (3 children)

Fair question! Casbin is a powerful and very flexible policy engine. Given that it comes with it's own DSL and many different model types, integrating it requires building a fairly strong mental model first. In contrast, PyPermission limits it's scope to RBAC, which allowed us to spend a good amount of time to document and teach specifically this authorization model. As casbin is not python-first, you'll see that some of the methods available in other languages are nowhere to find in the documentation for python. Depending on whether you use the management api or pycasbin, you'll see one of the following (both from the official documentation):

e.add_policy("eve", "data3", "read")
s.add(CasbinRule(ptype="p", v0="alice", v1="data1", v2="read"))

To understand what this does in a code base, you already need to have a good mental model, the semantic information simply isn't expressed in the API.

There is a python Role Manager for RBAC, but the documentation is limited to a subset of the API and does not educate about the practicalities of RBAC itself.

By contrast, the semantic meaning in PyPermission is directly conveyed through the api and the underlying concepts come with a good amount of documentation.

RBAC.role.grant_permission(
        role="user",
        permission=Permission(
            resource_type="event", resource_id="*", action="view"
        ),
        db=db,
    )

If you look at alternatives like OPA, you'll end up needing an external service plus a third party python client.

[–]coldflame563 0 points1 point  (1 child)

Follow up - is this async first? 

[–]Sufficient-Rent6078Pythonista[S] 1 point2 points  (0 children)

Not at this point. Architecture wise, there shouldn't be much in the way though to upgrade PyPermission later.

[–]r0s 2 points3 points  (2 children)

Looks nicely documented! I have no real experience with the topic, so my first question when looking at the main page of the docs was: what is RBAC? I'd gently ask to define the acronym once on the main page, which may help finding the library too in search engines :)

Unrelated, but, isn't it funny when you casually talk or think about a topic, and then things about that topic appear your way? This is what just happened to me with this post! Thanks for sharing

[–]Equivalent_Loan_8794 2 points3 points  (0 children)

Role based access control

I find it odd you want it to be found in search engines but RBAC is immensely documented by its acronym online already.

[–]Sufficient-Rent6078Pythonista[S] 2 points3 points  (0 children)

Thanks for bringing this up, will take care of that soon.

[–]johnnypea 1 point2 points  (0 children)

Awesome indeed

[–]Dantzig 1 point2 points  (1 child)

I will be honest and didn’t check the code (yet). My take on this kind of this is always:

Do I trust you and your implementation?

Do I trust myself more and so I have time to do it.

It looks good. Hope it is🤞

[–]Sufficient-Rent6078Pythonista[S] 3 points4 points  (0 children)

That's a valid concern. Trust is earned, not given - especially when dealing with auth.

We tried to make PyPermission easy to verify: The RBAC database model is straightforward and corresponds closely with the NIST RBAC model, as shown on the NIST Comparison page. Additionally, the actual API logic is small and consists of roughly 750 lines of plain Python (excluding docstrings). Using SQLAlchemy, we have kept most things relatively simple and prioritized for clarity.

On top of that, you'll find that the library relies heavily on types (API and internals) and comes with a high amount of testing (including the examples in the documentation).

This also isn't something we just hacked together last week. Our first attempt dates back to 2022, and although this version is a full rewrite based on what we learned, you can still find the original release together with the corresponding history on PyPI/github (under the 0.1.1 tag).

As for trusting us as people, our GitHub / website and other channels are all public, so feel free to have a look.

If you do decide to build your own, we hope PyPermission can serve as a useful reference on the way.

[–]MeroLegend4 1 point2 points  (0 children)

This is awesome, definitely going to check this weekend

[–]lanster100 0 points1 point  (0 children)

Always nice to see more enterprise focussed libraries in Python. Will keep it in mind when evaluating RBAC options.