Permission Management - Open Source Site Tracking

Overview

The permission management system provides comprehensive access control for the Open Source Site Tracking platform. It implements role-based access control (RBAC) with fine-grained permissions, resource-level security, and comprehensive audit logging.

Permission Architecture

Permission Model

Core Components

# Permission model definition
class Permission:
    id: str
    name: str
    description: str
    resource_type: str
    action: str
    level: str  # system, organization, project, team
    created_at: datetime
class Role:
    id: str
    name: str
    description: str
    permissions: List[str]
    level: str
    is_system_role: bool
    created_at: datetime
class UserRole:
    id: str
    user_id: str
    role_id: str
    resource_id: str  # project_id, team_id, etc.
    resource_type: str
    granted_by: str
    granted_at: datetime
    expires_at: Optional[datetime]

Permission Hierarchy

System Permissions: Platform-wide permissions
Organization Permissions: Organization-level permissions
Project Permissions: Project-specific permissions
Team Permissions: Team-specific permissions
Resource Permissions: Individual resource permissions

Permission Types

Analytics Permissions

analytics.read: Read analytics data
analytics.write: Create/update analytics
analytics.delete: Delete analytics data
analytics.export: Export analytics data
analytics.share: Share analytics reports

Project Permissions

project.read: Read project information
project.write: Update project settings
project.delete: Delete project
project.manage: Manage project members
project.analytics: Access project analytics

User Permissions

user.read: Read user information
user.write: Update user profile
user.delete: Delete user account
user.manage: Manage user accounts
user.admin: Administrative user access

Resource-Level Security

Resource Access Control

Resource Security Model

# Resource access control
class ResourceAccess:
    resource_id: str
    resource_type: str
    owner_id: str
    access_level: str  # public, private, restricted
    permissions: Dict[str, List[str]]
    created_at: datetime
    updated_at: datetime
class AccessControlList:
    id: str
    resource_id: str
    resource_type: str
    user_id: str
    permissions: List[str]
    granted_by: str
    granted_at: datetime
    expires_at: Optional[datetime]

Access Levels

Public Resources

Read Access: All authenticated users can read
No Write Access: Only owners can modify
No Delete Access: Only owners can delete
Limited Analytics: Basic analytics access

Private Resources

Owner Access: Full access to resource owner
Explicit Permissions: Only explicitly granted access
No Public Access: No public read access
Full Analytics: Complete analytics access

Restricted Resources

Role-based Access: Access based on user roles
Conditional Access: Access based on conditions
Time-based Access: Access with time restrictions
Audit Required: All access is audited

Access Control Middleware

Permission Checking

Middleware Implementation

# Access control middleware
from functools import wraps
from flask import request, jsonify
def require_permission(permission: str, resource_id: str = None):
    def decorator(f):
        @wraps(f)
        def decorated_function(*args, **kwargs):
            user_id = get_current_user_id()
            
            if not has_permission(user_id, permission, resource_id):
                return jsonify({
                    "error": "Insufficient permissions",
                    "required_permission": permission,
                    "resource_id": resource_id
                }), 403
            
            return f(*args, **kwargs)
        return decorated_function
    return decorator
def has_permission(user_id: str, permission: str, resource_id: str = None) -> bool:
    """Check if user has permission for resource"""
    
    # Check system permissions
    if has_system_permission(user_id, permission):
        return True
    
    # Check resource-specific permissions
    if resource_id:
        return has_resource_permission(user_id, permission, resource_id)
    
    # Check role-based permissions
    return has_role_permission(user_id, permission)

Permission Caching

Cache Strategy

User Permissions: Cache user permissions for 15 minutes
Resource Permissions: Cache resource permissions for 10 minutes
Role Permissions: Cache role permissions for 30 minutes
Access Lists: Cache access lists for 5 minutes

Cache Implementation

# Permission caching
import redis
import json
from typing import Optional
class PermissionCache:
    def __init__(self, redis_client):
        self.redis = redis_client
        self.cache_ttl = 900  # 15 minutes
    
    def get_user_permissions(self, user_id: str) -> Optional[List[str]]:
        """Get cached user permissions"""
        key = f"user_permissions:{user_id}"
        cached = self.redis.get(key)
        return json.loads(cached) if cached else None
    
    def set_user_permissions(self, user_id: str, permissions: List[str]):
        """Cache user permissions"""
        key = f"user_permissions:{user_id}"
        self.redis.setex(key, self.cache_ttl, json.dumps(permissions))
    
    def invalidate_user_cache(self, user_id: str):
        """Invalidate user permission cache"""
        key = f"user_permissions:{user_id}"
        self.redis.delete(key)

Audit and Logging

Access Logging

Audit Log Model

# Audit log model
class AuditLog:
    id: str
    user_id: str
    action: str
    resource_type: str
    resource_id: str
    permissions: List[str]
    ip_address: str
    user_agent: str
    success: bool
    error_message: Optional[str]
    timestamp: datetime
    session_id: str
class SecurityEvent:
    id: str
    event_type: str
    severity: str
    user_id: Optional[str]
    description: str
    metadata: Dict
    timestamp: datetime
    resolved: bool
    resolved_by: Optional[str]
    resolved_at: Optional[datetime]

Security Monitoring

Event Types

permission_denied: Access denied event
permission_granted: Permission granted event
role_changed: Role modification event
suspicious_activity: Suspicious access patterns
security_breach: Security breach attempt

Alert System

Real-time Alerts: Immediate security alerts
Daily Reports: Daily security summaries
Weekly Analysis: Weekly security trends
Incident Response: Automated incident response

API Endpoints

Permission Management API

Role Management

# Create role
POST /api/v1/permissions/roles
{
  "name": "Analytics Manager",
  "description": "Can manage analytics",
  "permissions": ["analytics.read", "analytics.write", "analytics.export"],
  "level": "project"
}
# Get roles
GET /api/v1/permissions/roles
# Update role
PUT /api/v1/permissions/roles/{role_id}
{
  "name": "Updated Role",
  "permissions": ["analytics.read", "analytics.write"]
}
# Delete role
DELETE /api/v1/permissions/roles/{role_id}

User Role Assignment

# Assign role to user
POST /api/v1/permissions/users/{user_id}/roles
{
  "role_id": "role-123",
  "resource_id": "project-456",
  "resource_type": "project"
}
# Get user roles
GET /api/v1/permissions/users/{user_id}/roles
# Remove user role
DELETE /api/v1/permissions/users/{user_id}/roles/{role_id}

Permission Checking

# Check user permission
GET /api/v1/permissions/users/{user_id}/check?permission=analytics.read&resource_id=project-456
# Get user permissions
GET /api/v1/permissions/users/{user_id}/permissions
# Get resource permissions
GET /api/v1/permissions/resources/{resource_id}/permissions

Audit API

Audit Logs

# Get audit logs
GET /api/v1/permissions/audit-logs?user_id=user-123&start_date=2024-01-01&end_date=2024-01-31
# Get security events
GET /api/v1/permissions/security-events?severity=high&resolved=false
# Export audit data
GET /api/v1/permissions/audit-export?format=csv&start_date=2024-01-01

Best Practices

Permission Design

Principle of Least Privilege

Minimal Access: Grant only necessary permissions
Role-based: Use roles for permission management
Time-limited: Use temporary permissions when possible
Regular Review: Review permissions regularly

Permission Granularity

Fine-grained: Use specific permissions
Resource-specific: Apply permissions to specific resources
Action-based: Define permissions by actions
Context-aware: Consider context in permission checks

Security Implementation

Security Best Practices

Input Validation: Validate all permission inputs
Output Encoding: Encode permission outputs
SQL Injection Prevention: Use parameterized queries
XSS Prevention: Sanitize permission data
CSRF Protection: Use CSRF tokens

Monitoring and Alerting

Real-time Monitoring: Monitor permission usage
Anomaly Detection: Detect unusual access patterns
Alert System: Alert on security events
Regular Audits: Conduct regular security audits

Performance Optimization

Caching Strategy

Permission Cache: Cache user permissions
Role Cache: Cache role permissions
Resource Cache: Cache resource permissions
Cache Invalidation: Invalidate cache on changes

Database Optimization

Indexing: Proper database indexing
Query Optimization: Optimize permission queries
Connection Pooling: Use connection pooling
Read Replicas: Use read replicas for queries

Implementation Checklist

✅ Implement role-based access control
✅ Add resource-level security
✅ Implement permission caching
✅ Add comprehensive audit logging
✅ Set up security monitoring
✅ Implement permission middleware
✅ Add permission validation
✅ Set up alert system
✅ Document permission model
✅ Test permission system thoroughly