mirror of
https://github.com/jupyterhub/jupyterhub.git
synced 2025-10-07 18:14:10 +00:00
58dccdb59b
mostly a copy (fork) of singleuser app using public APIs instead of lots of patching. opt-in via `JUPYTERHUB_SINGLEUSER_EXTENSION=1` related changes: - stop running a test single-user server in a thread. It's complicated and fragile. Instead, run it normally, and get the info we need from a custom handler registered via an extension via the `full_spawn` fixture
37 lines
1.2 KiB
Python
37 lines
1.2 KiB
Python
import os
|
|
|
|
from jupyterhub.singleuser.extension import JupyterHubAuthorizer
|
|
|
|
|
|
class GranularJupyterHubAuthorizer(JupyterHubAuthorizer):
|
|
"""Authorizer that looks for permissions in JupyterHub scopes"""
|
|
|
|
def is_authorized(self, handler, user, action, resource):
|
|
# authorize if any of these permissions are present
|
|
# filters check for access to this specific user or server
|
|
# group filters aren't available!
|
|
filters = [
|
|
f"!user={os.environ['JUPYTERHUB_USER']}",
|
|
f"!server={os.environ['JUPYTERHUB_USER']}/{os.environ['JUPYTERHUB_SERVER_NAME']}",
|
|
]
|
|
required_scopes = set()
|
|
for f in filters:
|
|
required_scopes.update(
|
|
{
|
|
f"custom:jupyter_server:{action}:{resource}{f}",
|
|
f"custom:jupyter_server:{action}:*{f}",
|
|
}
|
|
)
|
|
|
|
have_scopes = self.hub_auth.check_scopes(required_scopes, user.hub_user)
|
|
self.log.debug(
|
|
f"{user.username} has permissions {have_scopes} required to {action} on {resource}"
|
|
)
|
|
return bool(have_scopes)
|
|
|
|
|
|
c = get_config() # noqa
|
|
|
|
|
|
c.ServerApp.authorizer_class = GranularJupyterHubAuthorizer
|