Function permitted_resources

sdk/python/feast/permissions/security_manager.py:168–203

A utility function to invoke the `assert_permissions` method on the global security manager. If no global `SecurityManager` is defined (NoAuthConfig), all resources are permitted. If a SecurityManager exists but no user context and actions are requested, deny access for security. I

(
    resources: list[FeastObject],
    actions: Union[AuthzedAction, List[AuthzedAction]],
)

def permitted_resources(
    resources: list[FeastObject],
    actions: Union[AuthzedAction, List[AuthzedAction]],
) -> list[FeastObject]:
    """
    A utility function to invoke the `assert_permissions` method on the global security manager.

    If no global `SecurityManager` is defined (NoAuthConfig), all resources are permitted.
    If a SecurityManager exists but no user context and actions are requested, deny access for security.
    If a SecurityManager exists but user is intra-communication, allow access.

    Args:
        resources: The resources for which we need to enforce authorized permission.
        actions: The requested actions to be authorized.
    Returns:
        list[FeastObject]]: A filtered list of the permitted resources, possibly empty.
    """

    sm = get_security_manager()
    if not is_auth_necessary(sm):
        # Check if this is NoAuthConfig (no security manager) vs missing user context vs intra-communication
        if sm is None:
            # NoAuthConfig: allow all resources
            logger.debug("NoAuthConfig enabled - allowing access to all resources")
            return resources
        elif sm.current_user is not None:
            # Intra-communication user: allow all resources
            logger.debug("Intra-communication user - allowing access to all resources")
            return resources
        else:
            # Security manager exists but no user context - deny access for security
            logger.warning(
                "Security manager exists but no user context - denying access to all resources"
            )
            return []
    return sm.assert_permissions(resources=resources, actions=actions, filter_only=True)  # type: ignore[union-attr]


"""