Permissions Matrix

RBAC: Dict[Tuple[str, str], Dict[str, PolicyValue]] = {
    ("resource", "action"): {"admin": policy, "assistant": policy, "artist": policy}
}

def can(
    role: str,
    resource: str,
    action: str,
    *,
    owner_id: Optional[int] = None,         # Resource owner's artist_id
    user_artist_id: Optional[int] = None,   # Current user's artist_id
    user_id: Optional[int] = None,          # For elevation check
) -> bool:
    """Check if role can perform action on resource."""

from services.permissions import can

user = get_current_user()

# Show edit button only if user has permission
if can(user.role, "clients", "edit", user_id=user.id):
    show_edit_button()

# Disable delete button if not allowed
if not can(user.role, "clients", "delete", user_id=user.id):
    disable_delete_button()

from services.permissions import enforce, PermissionError

def delete_client(client_id: int, db: Session):
    # Enforce permission before proceeding
    try:
        enforce(resource="clients", action="delete", db=db)
    except PermissionError as e:
        raise HTTPException(status_code=403, detail=str(e))
    
    # Proceed with deletion
    client = db.query(Client).get(client_id)
    db.delete(client)
    db.commit()

@app.delete("/api/clients/{client_id}")
def delete_client_endpoint(client_id: int, db: Session = Depends(get_db)):
    # Permission enforced automatically by enforce() in service
    delete_client(client_id, db)
    return {"message": "Client deleted"}

def assistant_needs_code(resource: str, action: str) -> bool:
    """Returns True if assistant needs master code for this action."""
    return _policy_for("assistant", resource, action) == "locked"

from services.permissions import (
    verify_master_code,
    elevate_for,
    is_elevated_now
)

# User attempts locked action
if assistant_needs_code("clients", "edit"):
    if not is_elevated_now(user.id):
        # Prompt for master code
        code = prompt_master_code()
        
        # Verify code
        if verify_master_code(code, db):
            # Elevate for 5 minutes
            elevate_for(user.id, minutes=5)
            show_message("Elevated for 5 minutes")
        else:
            show_error("Invalid master code")
            return
    
    # Proceed with action
    edit_client(client_id)

# In-memory elevation tracking
_elevations: Dict[int, datetime] = {}  # user_id -> expiration

def is_elevated_now(user_id: int) -> bool:
    """Check if user is currently elevated."""
    exp = _elevations.get(user_id)
    return bool(exp and datetime.now() <= exp)

def _policy_for(role: str, resource: str, action: str) -> PolicyValue:
    entry = RBAC.get((resource, action))
    if not entry:
        # Fail-safe: undefined permissions are denied
        return "deny"
    return entry.get(role, "deny")

("resource", "action"): {"admin": "allow", ...}

# Daily operations
("agenda", "view"):   {"assistant": "allow"}
("clients", "view"):  {"assistant": "allow"}

# Sensitive operations
("clients", "delete"):   {"assistant": "locked"}
("reports", "refund_void"): {"assistant": "locked"}

# View all, modify own
("agenda", "view"):   {"artist": "allow"}
("agenda", "edit"):   {"artist": "own"}

("reports", "view"):  {"artist": "own"}  # Only view own

("security", "*"): {"admin": "allow", "assistant": "deny", "artist": "deny"}

# Add to services/permissions.py
RBAC: Dict[Tuple[str, str], Dict[str, PolicyValue]] = {
    # Existing permissions...
    
    # New feature
    ("messages", "view"):   {"admin": "allow", "assistant": "allow", "artist": "own"},
    ("messages", "send"):   {"admin": "allow", "assistant": "allow", "artist": "own"},
    ("messages", "delete"): {"admin": "allow", "assistant": "locked", "artist": "own"},
}

import pytest
from services.permissions import can

def test_artist_can_edit_own_appointment():
    assert can(
        role="artist",
        resource="agenda",
        action="edit",
        owner_id=3,
        user_artist_id=3
    ) == True

def test_artist_cannot_edit_other_appointment():
    assert can(
        role="artist",
        resource="agenda",
        action="edit",
        owner_id=3,
        user_artist_id=5
    ) == False

def test_assistant_needs_elevation_for_client_delete():
    # Without elevation
    assert can(
        role="assistant",
        resource="clients",
        action="delete",
        user_id=10
    ) == False
    
    # With elevation
    elevate_for(user_id=10, minutes=5)
    assert can(
        role="assistant",
        resource="clients",
        action="delete",
        user_id=10
    ) == True