from enum import Enum
[docs]
class Role(str, Enum):
"""
Canonical roles within SKAO systems.
Role membership is determined by mapping group claims from the token issuer
(Entra ID or Indigo IAM) using ENTRA_GROUP_ROLES or INDIGO_GROUP_ROLES respectively.
"""
ANY = "ANY"
"""
Generic role automatically granted to all requests in addition to
any specific roles derived from the access token.
"""
APP2APP = "APP2APP"
"""
Role for apps using the OAuth2 client credentials grant to make
automated requests, rather than acting on behalf of the user.
"""
INTERNAL = "INTERNAL"
"""
Role for internal SKAO staff/affiliates.
"""
SCI_COMMUNITY = "SCI_COMMUNITY"
"""
Role for external scientists.
"""
SW_ENGINEER = "SW_ENGINEER"
"""
Develops, maintains, and debugs software applications within SKAO.
Member of any of the software development teams.
"""
PROD_SW_ENGINEER = "PROD_SW_ENGINEER"
"""
Responsible for debugging issues live in a production environment
"""
LOW_TELESCOPE_OPERATOR = "LOW_TELESCOPE_OPERATOR"
"""
Schedules and executes an observing session on SKA-Low and ensure the
correctness of science experiment data by controlling and monitoring
telescope subsystems.
"""
MID_TELESCOPE_OPERATOR = "MID_TELESCOPE_OPERATOR"
"""
Schedules and executes an observing session on SKA-Mid and ensure the
correctness of science experiment data by controlling and monitoring
telescope subsystems.
"""
OPERATIONS_SCIENTIST = "OPERATIONS_SCIENTIST"
"""
Oversees the creation of the Project and SBDefinitions to achieve the Science aim.
"""
OPS_PROPOSAL_ADMIN = "OPS_PROPOSAL_ADMIN"
"""
Individual who is able to perform all activities associated with proposals
"""
OPS_REVIEWER_SCIENCE = "OPS_REVIEWER_SCIENCE"
"""
Individual who is able to provide a review of the science behind a proposal
"""
OPS_REVIEWER_TECHNICAL = "OPS_REVIEWER_TECHNICAL"
"""
Individual who is able to validate the feasibility of the technical aspects required
for a proposal
"""
def __str__(self):
return self.value
def __repr__(self):
return f"Role.{self.name}"
# Roles listed here are valid for backwards compatibility, but their usage
# should be phased out by applications over time.
_pht_specific = "This is an application-specific position in the PHT not a global role."
ROLE_DEPRECATIONS: dict[Role, str] = {
Role.OPS_REVIEWER_TECHNICAL: _pht_specific,
Role.OPS_REVIEWER_SCIENCE: _pht_specific,
Role.OPS_PROPOSAL_ADMIN: _pht_specific,
}
def deprecated_role_reason(role: Role) -> str | None:
return ROLE_DEPRECATIONS.get(role)
# Maps Entra ID group object IDs to canonical roles.
# Group display names are noted for reference.
ENTRA_ROLE_GRANTING_GROUPS: dict[str, Role] = {
# obs-integrationenvs-oauth2role-sweng
"2d650a1e-dc34-4452-ab3b-15175d59e5d0": Role.SW_ENGINEER,
# obs-aa05-oauth2role-sweng
"69d67c05-f536-481e-98b2-35c7f2254592": Role.PROD_SW_ENGINEER,
# low-aa05-oauth2role-teloperator
"47a4523e-6fbe-441d-914c-14c6ca01922e": Role.LOW_TELESCOPE_OPERATOR,
# mid-aa05-oauth2role-teloperator
"405e6fd0-a361-447f-bb5e-9f6d03b2b474": Role.MID_TELESCOPE_OPERATOR,
# obs-integrationenvs-oauth2role-opsscientist
"bdc4b862-882c-461a-a2a4-6f0ac89910c4": Role.OPERATIONS_SCIENTIST,
# obs-oauth2role-opsproposaladmin
"ce3627de-8ec2-4a35-ab1e-300eec6a0a50": Role.OPS_PROPOSAL_ADMIN,
# obs-oauth2role-opsreviewersci
"05883c37-b723-4b63-9216-0a789a61cb07": Role.OPS_REVIEWER_SCIENCE,
# obs-oauth2role-opsreviewertec
"4c45b2ea-1b56-4b2d-b209-8d970b4e39dc": Role.OPS_REVIEWER_TECHNICAL,
}
# Maps Indigo IAM group names to canonical roles.
# Group names follow the convention "role/<snake_case_role_name>".
INDIGO_ROLE_GRANTING_GROUPS: dict[str, Role] = {
"role": Role.ANY,
"role/internal": Role.INTERNAL,
"role/sci_community": Role.SCI_COMMUNITY,
"role/sw_engineer": Role.SW_ENGINEER,
"role/prod_sw_engineer": Role.PROD_SW_ENGINEER,
"role/low_telescope_operator": Role.LOW_TELESCOPE_OPERATOR,
"role/mid_telescope_operator": Role.MID_TELESCOPE_OPERATOR,
"role/operations_scientist": Role.OPERATIONS_SCIENTIST,
# Note these are not role-groups and will be removed from Role enum in the future.
"app:pht:ops_proposal_admin": Role.OPS_PROPOSAL_ADMIN,
"app:pht:ops_reviewer_science": Role.OPS_REVIEWER_SCIENCE,
"app:pht:ops_reviewer_technical": Role.OPS_REVIEWER_TECHNICAL,
}