Users:v2 expand access rights and user attributes

[obervinov]

Context
For more flexible management of telegram bot users and their rights to the bot, it is necessary to expand user attributes, add additional methods for working with these attributes and rewrite existing class methods for a new model.

Data structure requirements

• role attributes (configuration)

{'roles': ['role_admin', 'role_guest'']}

• rate limit attributes (configuration)

{'requests': {'requests_per_day': 10, 'requests_per_hour': 1, 'random_shift_minutes': 15}}

• rate limit history (data)

{'requests_ counters': {'requests_per_day': 9, 'requests_per_hour': 1}}

• rate limit applied (data)

{'rate_limits': {'end_time': '2023-08-07 10:39:00.000000' }}

Requirements

• add a rate limit check method for an account: if rl is applied, return the end time, if not applied, none
• the rights check method should accept user_id and role_name as input: return allowed if user_id contains role_name and denied if not
• for the convenience of using the module by bots, select an entry point in a separate method that will immediately call all three methods: authentication(), authorization(), rl_controller() - aggregate the responses of these methods into a single dictionary and give in the response
• if the authorization of the role and user was successful, write +1 request to the request counter
• if the incoming role is startup, the rate limit counter should not be taken into account
• if the hourly rate_limit + random_shift_minutes has expired, reset the hourly rate_limit counter

Data structure in vault
For configuration:

• configuration/users/{user_id}:status -> authentication()
• configuration/users/{user_id}:roles -> authorization()
• configuration/users/{user_id}:requests -> rl_controller()

For dynamic data:

• data/users/{user_id}:requests_counters -> rl_controller()
• data/users/{user_id}:rate_limits -> rl_controller()
• data/users/{user_id}:authorization -> authorization()
• data/users/{user_id}:authentication -> authentication()

New methods:

• user_access_check() - an entry point that aggregates function calls and responses for unification and ease of use in bots.
• authentication() - method for checking user access rights to the bot
• authorization() - method for checking access rights to a specific bot functionality (assigning roles)
• rl_controller() - method for implementing request accounting and request rate limiting in the context of users

Documentation:

• Assigning methods
• General concept of the module
• Configuration Structure
• Persistent data structure
• Usage examples
• Diagram with the logic of the module
• More information about vault client and module

[obervinov]

done
4911923
ee18c20
48966d4
0b2a79d
ec24cd1
1cf6d67
8d0a568
dd5163a