|
| 1 | +"""Create an asset for Archivist with token. |
| 2 | +
|
| 3 | + Create an access_policy that shares an asset when certain criteria are met. |
| 4 | +
|
| 5 | + Access the asset from another Archivist connection using a second token with different |
| 6 | + access rights. |
| 7 | +""" |
| 8 | + |
| 9 | +from json import dumps as json_dumps |
| 10 | +from os import getenv |
| 11 | + |
| 12 | +from archivist.archivist import Archivist |
| 13 | +from archivist.constants import ASSET_BEHAVIOURS, SUBJECTS_SELF_ID |
| 14 | +from archivist.logger import set_logger |
| 15 | +from archivist.proof_mechanism import ProofMechanism |
| 16 | +from archivist.utils import get_auth |
| 17 | + |
| 18 | + |
| 19 | +def create_example_asset(arch, label): |
| 20 | + """Create an asset using Archivist Connection. |
| 21 | +
|
| 22 | + Args: |
| 23 | + arch: archivist connection. |
| 24 | + label: convenience label to easily distinguish the 2 organizations. |
| 25 | +
|
| 26 | + Returns: |
| 27 | + Asset: a new asset created. |
| 28 | +
|
| 29 | + """ |
| 30 | + attrs = { |
| 31 | + "arc_display_name": f"{label}_display_name", # Asset's display name |
| 32 | + "arc_description": f"{label}_display_description", # Asset's description |
| 33 | + "arc_display_type": f"{label}_display_type", # Arc_display_type is a free text field |
| 34 | + "ext_vendor_name": label, |
| 35 | + } |
| 36 | + |
| 37 | + # Select the mechanism used to prove evidence for the asset. If the selected proof |
| 38 | + # mechanism is not enabled for your tenant then an error will occur. |
| 39 | + # If unspecified then SIMPLE_HASH is used. |
| 40 | + # proof_mechanism = ProofMechanism.KHIPU.name |
| 41 | + # |
| 42 | + props = { |
| 43 | + "proof_mechanism": ProofMechanism.KHIPU.name, |
| 44 | + } |
| 45 | + |
| 46 | + # The first argument is the properties of the asset |
| 47 | + # The second argument is the attributes of the asset |
| 48 | + # The third argument is wait for confirmation: |
| 49 | + # If @confirm@ is True then this function will not |
| 50 | + # return until the asset is confirmed on the blockchain and ready |
| 51 | + # to accept events (or an error occurs) |
| 52 | + # |
| 53 | + return arch.assets.create(props=props, attrs=attrs, confirm=True) |
| 54 | + |
| 55 | + |
| 56 | +def create_archivist(label): |
| 57 | + """Create connection to archivist""" |
| 58 | + # Get authorization token. The token grants certain rights and access permissions. |
| 59 | + # The token can represent the root principal or user in an organization. Different tokens |
| 60 | + # could indicate different users in the same organization or membership of different |
| 61 | + # organiastions. |
| 62 | + auth = get_auth( |
| 63 | + auth_token=getenv(f"ARCHIVIST_AUTHTOKEN_{label}"), |
| 64 | + ) |
| 65 | + # Initialize connection to Archivist. max_time is the time to wait for confirmation |
| 66 | + # of an asset or event creation - the default is 1200 seconds but one can optionally |
| 67 | + # specify a different value here particularly when creating assets on SIMPLE_HASH |
| 68 | + # (rather than KHIPU) as confirmation times are much shorter in this case. |
| 69 | + return Archivist( |
| 70 | + "https://app.rkvst.io", |
| 71 | + auth, |
| 72 | + max_time=300, |
| 73 | + ) |
| 74 | + |
| 75 | + |
| 76 | +def import_subject(acme, weyland): |
| 77 | + """Add subjects record for weyland in acme's environment""" |
| 78 | + subject = acme.subjects.import_subject( |
| 79 | + "weyland", |
| 80 | + weyland.subjects.read(SUBJECTS_SELF_ID), |
| 81 | + ) |
| 82 | + |
| 83 | + # must wait for confirmation |
| 84 | + acme.subjects.wait_for_confirmation(subject["identity"]) |
| 85 | + |
| 86 | + return subject |
| 87 | + |
| 88 | + |
| 89 | +def create_example_access_policy(arch, label, subject): |
| 90 | + """Create access policy""" |
| 91 | + # consists of a filter selection entry and a selection criteria to restrict/redact |
| 92 | + # values of the asset attributes available to the sharee. |
| 93 | + |
| 94 | + # values pertaining to the access polcy itself. |
| 95 | + props = { |
| 96 | + "display_name": f"{label} access policy", |
| 97 | + "description": f"{label} Policy description", |
| 98 | + } |
| 99 | + |
| 100 | + # Filtering - access will be allowed to any asset that contains both these |
| 101 | + # attributes that equal these values. This happens to match the asset created |
| 102 | + # previously. |
| 103 | + filters = [ |
| 104 | + { |
| 105 | + "or": [ |
| 106 | + f"attributes.arc_display_type={label}_display_type", |
| 107 | + ] |
| 108 | + }, |
| 109 | + { |
| 110 | + "or": [ |
| 111 | + f"attributes.ext_vendor_name={label}", |
| 112 | + ] |
| 113 | + }, |
| 114 | + ] |
| 115 | + |
| 116 | + # one must be the subject to gain access and only those fields |
| 117 | + # specified in include_attributes will be emitted. |
| 118 | + access_permissions = [ |
| 119 | + { |
| 120 | + "subjects": [ |
| 121 | + subject["identity"], |
| 122 | + ], |
| 123 | + "behaviours": ASSET_BEHAVIOURS, |
| 124 | + "include_attributes": [ |
| 125 | + "arc_display_name", |
| 126 | + ], |
| 127 | + }, |
| 128 | + ] |
| 129 | + |
| 130 | + return arch.access_policies.create( |
| 131 | + props, |
| 132 | + filters, |
| 133 | + access_permissions, |
| 134 | + ) |
| 135 | + |
| 136 | + |
| 137 | +def main(): |
| 138 | + """Main function of share-asset.""" |
| 139 | + # optional call to set the logger level for all subsystems. The argument can |
| 140 | + # be either "INFO" or "DEBUG". For more sophisticated logging control see the |
| 141 | + # documentation. |
| 142 | + set_logger("INFO") |
| 143 | + |
| 144 | + # For demonstration purposes we are going to assume that 2 organizations are |
| 145 | + # going to share an asset. The 2 organizations are ACME Corp and Weyland-Yutani |
| 146 | + # Corporation. |
| 147 | + acme = create_archivist("acme") |
| 148 | + weyland = create_archivist("weyland") |
| 149 | + |
| 150 | + # set a subject for weyland in acme's environment. The identity will be used as a |
| 151 | + # filter in the access permissions of the access_policy. |
| 152 | + weyland_subject_on_acme = import_subject(acme, weyland) |
| 153 | + print("weyland_subject on acme", json_dumps(weyland_subject_on_acme, indent=4)) |
| 154 | + |
| 155 | + # acme creates an asset |
| 156 | + acme_asset = create_example_asset(acme, "acme") |
| 157 | + print("asset created in acme", json_dumps(acme_asset, indent=4)) |
| 158 | + |
| 159 | + # now we want acme to share this asset to weyland via an access policy. |
| 160 | + access_policy = create_example_access_policy(acme, "acme", weyland_subject_on_acme) |
| 161 | + print("access policy created in acme", json_dumps(access_policy, indent=4)) |
| 162 | + |
| 163 | + # display the asset as retrieved by weyland |
| 164 | + # NB: the attributes dict is redacted... |
| 165 | + weyland_asset = weyland.assets.read(acme_asset["identity"]) |
| 166 | + print("asset read from weyland", json_dumps(weyland_asset, indent=4)) |
| 167 | + |
| 168 | + # list matching access policies |
| 169 | + access_policies = list( |
| 170 | + acme.access_policies.list_matching_access_policies(acme_asset["identity"]) |
| 171 | + ) |
| 172 | + print("access policies read from acme", json_dumps(access_policies, indent=4)) |
| 173 | + |
| 174 | + # delete all the access policies |
| 175 | + for access_policy in access_policies: |
| 176 | + acme.access_policies.delete(access_policy["identity"]) |
| 177 | + |
| 178 | + # list matching access policies |
| 179 | + access_policies = list( |
| 180 | + acme.access_policies.list_matching_access_policies(acme_asset["identity"]) |
| 181 | + ) |
| 182 | + print("access policies read from acme", json_dumps(access_policies, indent=4)) |
| 183 | + |
| 184 | + # display the asset as retrieved by the sharee |
| 185 | + # NB the asset is still shared even though there are no access policies |
| 186 | + weyland_asset = weyland.assets.read(acme_asset["identity"]) |
| 187 | + print("asset read from weyland", json_dumps(weyland_asset, indent=4)) |
| 188 | + |
| 189 | + |
| 190 | +if __name__ == "__main__": |
| 191 | + main() |
0 commit comments