add CASBIN_USER_NAME_HEADERS configuration and audit log when attempts to access a restricted resource

Author: jessecooper

flask_authz/casbin_enforcer.py

@@ -28,6 +28,7 @@ def __init__(self, app, adapter, watcher=None):
         if watcher:
             self.e.set_watcher(watcher)
         self._owner_loader = None
+        self.user_name_headers = app.config.get("CASBIN_USER_NAME_HEADERS", None)
 
     def set_watcher(self, watcher):
         """
@@ -55,6 +56,9 @@ def enforcer(self, func):
         def wrapper(*args, **kwargs):
             if self.e.watcher and self.e.watcher.should_reload():
                 self.e.watcher.update_callback()
+            # String used to hold the owners user name for audit logging
+            owner_audit = ""
+
             # Check sub, obj act against Casbin polices
             self.app.logger.debug(
                 "Enforce Headers Config: %s\nRequest Headers: %s"
@@ -85,6 +89,9 @@ def wrapper(*args, **kwargs):
                                 "decoding is unsupported by flask-casbin at this time"
                             )
                             continue
+
+                        if self.user_name_headers and header in self.user_name_headers:
+                            owner_audit = owner
                         if self.e.enforce(owner, uri, request.method):
                             return func(*args, **kwargs)
                     else:
@@ -97,11 +104,20 @@ def wrapper(*args, **kwargs):
                                 "Enforce against owner: %s header: %s"
                                 % (owner.strip('"'), header)
                             )
+                            if self.user_name_headers and header in self.user_name_headers:
+                                owner_audit = owner
                             if self.e.enforce(
                                 owner.strip('"'), uri, request.method
                             ):
                                 return func(*args, **kwargs)
             else:
+                self.app.logger.error(
+                    "Unauthorized attempt: method: %s resource: %s%s" % (
+                        request.method,
+                        uri,
+                        "" if not self.user_name_headers and owner_audit != "" else " by user: %s" % owner_audit
+                    )
+                )
                 return (jsonify({"message": "Unauthorized"}), 401)
 
         return wrapper