|
| 1 | +import typer |
| 2 | +import pathlib |
| 3 | +import sys |
| 4 | +from typing_extensions import Annotated |
| 5 | +from rich.console import Console |
| 6 | +from rich.table import Table |
| 7 | + |
| 8 | +from nl2sql.common.settings import settings |
| 9 | +from nl2sql.security.policies import PolicyConfig |
| 10 | +from nl2sql.datasources.config import load_configs |
| 11 | +from nl2sql.datasources import DatasourceRegistry |
| 12 | +from pydantic import ValidationError |
| 13 | +from nl2sql.secrets import secret_manager, load_secret_configs |
| 14 | + |
| 15 | +app = typer.Typer(help="Manage RBAC policies and security.") |
| 16 | +console = Console() |
| 17 | + |
| 18 | +@app.command("validate") |
| 19 | +def validate( |
| 20 | + config: Annotated[pathlib.Path, typer.Option("--config", help="Path to datasource config")] = pathlib.Path(settings.datasource_config_path), |
| 21 | + policies: Annotated[pathlib.Path, typer.Option("--policies", help="Path to policies.json")] = pathlib.Path(settings.policies_config_path), |
| 22 | + secrets: Annotated[pathlib.Path, typer.Option("--secrets", help="Path to secrets config")] = pathlib.Path(settings.secrets_config_path), |
| 23 | +): |
| 24 | + """ |
| 25 | + Validate policy syntax and integrity against defined datasources. |
| 26 | + """ |
| 27 | + console.print(f"[bold blue]Validating Policies from:[/bold blue] {policies}") |
| 28 | + |
| 29 | + # 1. Load Policies (Schema Check) |
| 30 | + try: |
| 31 | + if not policies.exists(): |
| 32 | + console.print(f"[bold red]Error:[/bold red] Policy file not found at {policies}") |
| 33 | + sys.exit(1) |
| 34 | + |
| 35 | + with open(policies, "r") as f: |
| 36 | + raw_json = f.read() |
| 37 | + |
| 38 | + policy_cfg = PolicyConfig.model_validate_json(raw_json) |
| 39 | + console.print("[green]✓ Schema Syntax Valid[/green]") |
| 40 | + |
| 41 | + except ValidationError as ve: |
| 42 | + console.print(f"[bold red]Schema Validation Failed:[/bold red]\n{ve}") |
| 43 | + sys.exit(1) |
| 44 | + except Exception as e: |
| 45 | + console.print(f"[bold red]Error loading policies:[/bold red] {e}") |
| 46 | + sys.exit(1) |
| 47 | + |
| 48 | + # 2. Load Datasources (Integrity Check) |
| 49 | + console.print(f"[bold blue]Checking Integrity against Datasources:[/bold blue] {config}") |
| 50 | + try: |
| 51 | + # Secrets are needed to load datasources properly |
| 52 | + if secrets.exists(): |
| 53 | + secret_configs = load_secret_configs(secrets) |
| 54 | + secret_manager.configure(secret_configs) |
| 55 | + |
| 56 | + ds_configs = load_configs(config) |
| 57 | + registry = DatasourceRegistry(ds_configs) |
| 58 | + |
| 59 | + available_ds = set(registry.list_ids()) |
| 60 | + console.print(f"[dim]Available Datasources: {available_ds}[/dim]") |
| 61 | + |
| 62 | + has_errors = False |
| 63 | + |
| 64 | + table = Table(title="Policy Integrity Report") |
| 65 | + table.add_column("Role", style="cyan") |
| 66 | + table.add_column("Target", style="magenta") |
| 67 | + table.add_column("Status", style="green") |
| 68 | + table.add_column("Details", style="white") |
| 69 | + |
| 70 | + for role_id, role_def in policy_cfg.root.items(): |
| 71 | + # Check Datasources |
| 72 | + for ds in role_def.allowed_datasources: |
| 73 | + if ds == "*": |
| 74 | + table.add_row(role_id, "Datasource: *", "[green]OK[/green]", "Global Access") |
| 75 | + continue |
| 76 | + |
| 77 | + if ds not in available_ds: |
| 78 | + table.add_row(role_id, f"Datasource: {ds}", "[red]MISSING[/red]", "Datasource not defined in config") |
| 79 | + has_errors = True |
| 80 | + else: |
| 81 | + table.add_row(role_id, f"Datasource: {ds}", "[green]OK[/green]", "Verified") |
| 82 | + |
| 83 | + # Check Tables (Heuristic only - we can't verify tables without checking DB connection, which is slow/expensive. |
| 84 | + # But we CAN verify the component 'datasource' part of 'datasource.table') |
| 85 | + for rule in role_def.allowed_tables: |
| 86 | + if rule == "*": |
| 87 | + table.add_row(role_id, "Table: *", "[green]OK[/green]", "Global Access") |
| 88 | + continue |
| 89 | + |
| 90 | + parts = rule.split(".") |
| 91 | + if len(parts) >= 2: |
| 92 | + ds_part = parts[0] |
| 93 | + if ds_part not in available_ds and ds_part != "*": |
| 94 | + table.add_row(role_id, f"Table Rule: {rule}", "[red]INVALID DS[/red]", f"Datasource '{ds_part}' unknown") |
| 95 | + has_errors = True |
| 96 | + else: |
| 97 | + table.add_row(role_id, f"Table Rule: {rule}", "[green]OK[/green]", "DS Verified") |
| 98 | + |
| 99 | + console.print(table) |
| 100 | + |
| 101 | + if has_errors: |
| 102 | + console.print("\n[bold red]Integrity Check Failed: Policies reference missing resources.[/bold red]") |
| 103 | + sys.exit(1) |
| 104 | + else: |
| 105 | + console.print("\n[bold green]✓ Policy Integrity Verified[/bold green]") |
| 106 | + |
| 107 | + except Exception as e: |
| 108 | + console.print(f"[bold red]Integrity Check Failed:[/bold red] {e}") |
| 109 | + sys.exit(1) |
0 commit comments