IAM User: add custom_props field for admin usage

gmelikov · gmelikov · commit 5c885fc32f14 · 2026-02-25T16:04:33.000+03:00
diff --git a/genesis_core/tests/functional/restapi/iam/test_users.py b/genesis_core/tests/functional/restapi/iam/test_users.py
@@ -239,7 +239,7 @@ def test_update_my_user_update_password_test1_auth_bad_request(
     ):
         client = user_api_client(auth_test1_user)
 
-        with pytest.raises(bazooka_exc.BadRequestError):
+        with pytest.raises(bazooka_exc.ForbiddenError):
             client.update_user(
                 auth_test1_user.uuid,
                 password="new password",
diff --git a/genesis_core/user_api/compute/api/controllers.py b/genesis_core/user_api/compute/api/controllers.py
@@ -16,7 +16,7 @@
 
 import uuid as sys_uuid
 
-from gcl_iam import controllers as iam_controllers
+from gcl_iam.api import controllers as iam_controllers
 from restalchemy.api import actions
 from restalchemy.api import controllers
 from restalchemy.api import resources
diff --git a/genesis_core/user_api/config/api/controllers.py b/genesis_core/user_api/config/api/controllers.py
@@ -14,7 +14,7 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-from gcl_iam import controllers as iam_controllers
+from gcl_iam.api import controllers as iam_controllers
 from restalchemy.api import controllers
 from restalchemy.api import resources
 
diff --git a/genesis_core/user_api/dns/api/controllers.py b/genesis_core/user_api/dns/api/controllers.py
@@ -15,7 +15,7 @@
 #    under the License.
 
 from oslo_config import cfg
-from gcl_iam import controllers as iam_controllers
+from gcl_iam.api import controllers as iam_controllers
 from restalchemy.api import controllers as ra_controllers
 from restalchemy.api import constants
 from restalchemy.api import field_permissions as field_p
diff --git a/genesis_core/user_api/em/api/controllers.py b/genesis_core/user_api/em/api/controllers.py
@@ -15,7 +15,7 @@
 #    under the License.
 
 
-from gcl_iam import controllers as iam_controllers
+from gcl_iam.api import controllers as iam_controllers
 from restalchemy.dm import filters as dm_filters
 from restalchemy.api import actions
 from restalchemy.api import controllers
diff --git a/genesis_core/user_api/iam/api/controllers.py b/genesis_core/user_api/iam/api/controllers.py
@@ -24,8 +24,11 @@
 
 from authlib.integrations import requests_client
 import jinja2
-from gcl_iam import controllers as iam_controllers
+from gcl_iam.api import controllers as iam_controllers
+from gcl_iam.api import field_perms as iam_fp
+from gcl_iam import rules
 from restalchemy.api import actions
+from restalchemy.api import constants as ra_c
 from restalchemy.api import controllers
 from restalchemy.api import resources
 from restalchemy.common import contexts
@@ -119,50 +122,30 @@ class UserController(
         models.User,
         convert_underscore=False,
         process_filters=True,
-        hidden_fields=resources.HiddenFieldMap(
-            get=[
-                "user_source",
-                "salt",
-                "secret_hash",
-                "secret",
-                "otp_secret",
-                "confirmation_code",
-                "confirmation_code_made_at",
-            ],
-            create=[
-                "salt",
-                "secret_hash",
-                "otp_secret",
-                "confirmation_code",
-                "confirmation_code_made_at",
-            ],
-            update=[
-                "user_source",
-                "salt",
-                "secret_hash",
-                "secret",
-                "otp_secret",
-                "confirmation_code",
-                "confirmation_code_made_at",
-            ],
-            filter=[
-                "user_source",
-                "salt",
-                "secret_hash",
-                "secret",
-                "otp_secret",
-                "confirmation_code",
-                "confirmation_code_made_at",
-            ],
-            action_post=[
-                "user_source",
-                "salt",
-                "secret_hash",
-                "secret",
-                "otp_secret",
-                "confirmation_code",
-                "confirmation_code_made_at",
-            ],
+        fields_permissions=iam_fp.FieldsIamPermissions(
+            default=iam_fp.Permissions.RW,
+            fields={
+                "salt": {ra_c.ALL: iam_fp.Permissions.HIDDEN},
+                "user_source": {
+                    ra_c.ALL: iam_fp.Permissions.HIDDEN,
+                    ra_c.CREATE: iam_fp.Permissions.RW,
+                },
+                "secret": {
+                    ra_c.ALL: iam_fp.Permissions.HIDDEN,
+                    ra_c.CREATE: iam_fp.Permissions.RW,
+                },
+                "secret_hash": {ra_c.ALL: iam_fp.Permissions.HIDDEN},
+                "otp_secret": {ra_c.ALL: iam_fp.Permissions.HIDDEN},
+                "confirmation_code": {ra_c.ALL: iam_fp.Permissions.HIDDEN},
+                "confirmation_code_made_at": {ra_c.ALL: iam_fp.Permissions.HIDDEN},
+                "custom_props": {
+                    ra_c.GET: rules.Rule("iam", "user_custom_props", "read"),
+                    ra_c.FILTER: rules.Rule("iam", "user_custom_props", "list"),
+                    ra_c.CREATE: rules.Rule("iam", "user_custom_props", "create"),
+                    ra_c.UPDATE: rules.Rule("iam", "user_custom_props", "update"),
+                    ra_c.DELETE: rules.Rule("iam", "user_custom_props", "delete"),
+                },
+            },
         ),
         name_map={"secret": "password", "name": "username"},
     )
diff --git a/genesis_core/user_api/iam/dm/models.py b/genesis_core/user_api/iam/dm/models.py
@@ -227,6 +227,39 @@ def process_secret(self, user, secret):
         user.update()
 
 
+class IamUserCustomProps(ra_types_dynamic.AbstractKindModel):
+    KIND = "basic"
+
+    role = properties.property(
+        ra_types.String(min_length=0, max_length=255),
+        default=None,
+    )
+    legal_entity = properties.property(
+        ra_types.String(min_length=0, max_length=255),
+        default=None,
+    )
+    employment_format = properties.property(
+        ra_types.String(min_length=0, max_length=255),
+        default=None,
+    )
+    hire_date = properties.property(
+        ra_types.AllowNone(ra_types.UTCDateTimeZ()),
+        default=None,
+    )
+    layoff_date = properties.property(
+        ra_types.AllowNone(ra_types.UTCDateTimeZ()),
+        default=None,
+    )
+    birth_date = properties.property(
+        ra_types.AllowNone(ra_types.UTCDateTimeZ()),
+        default=None,
+    )
+    other = properties.property(
+        ra_types.Dict(),
+        default=dict,
+    )
+
+
 class User(
     models.ModelWithUUID,
     models.ModelWithRequiredNameDesc,
@@ -294,6 +327,15 @@ class User(
         default=False,
     )
 
+    custom_props = properties.property(
+        ra_types.AllowNone(
+            KindModelSelectorType(
+                ra_types_dynamic.KindModelType(IamUserCustomProps),
+            )
+        ),
+        default=None,
+    )
+
     def get_response_body(self):
         return {
             "uuid": str(self.uuid),
@@ -774,6 +816,7 @@ def get_response_body(self):
             "confirmation_code",
             "confirmation_code_made_at",
             "user_source",
+            "custom_props",
         ]
         user = self._user.get_storable_snapshot()
         for drop_field in skip_fields:
diff --git a/genesis_core/user_api/network/api/controllers.py b/genesis_core/user_api/network/api/controllers.py
@@ -15,7 +15,7 @@
 #    under the License.
 
 from oslo_config import cfg
-from gcl_iam import controllers as iam_controllers
+from gcl_iam.api import controllers as iam_controllers
 from restalchemy.api import controllers as ra_controllers
 from restalchemy.api import constants
 from restalchemy.api import field_permissions as field_p
diff --git a/genesis_core/user_api/secret/api/controllers.py b/genesis_core/user_api/secret/api/controllers.py
@@ -14,7 +14,7 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-from gcl_iam import controllers as iam_controllers
+from gcl_iam.api import controllers as iam_controllers
 from restalchemy.api import controllers
 from restalchemy.api import constants as ra_c
 from restalchemy.api import field_permissions as field_p
diff --git a/genesis_core/user_api/security/api/controllers.py b/genesis_core/user_api/security/api/controllers.py
@@ -14,7 +14,7 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-from gcl_iam import controllers as iam_controllers
+from gcl_iam.api import controllers as iam_controllers
 from restalchemy.api import controllers as ra_controllers
 from restalchemy.api import resources
 
diff --git a/genesis_core/user_api/vs/api/controllers.py b/genesis_core/user_api/vs/api/controllers.py
@@ -23,7 +23,7 @@
 from restalchemy.api import field_permissions as field_p
 from restalchemy.common import exceptions as ra_e
 from gcl_sdk.infra import constants as infra_c
-from gcl_iam import controllers as iam_controllers
+from gcl_iam.api import controllers as iam_controllers
 
 from genesis_core.vs.dm import models as models
 
diff --git a/migrations/0052-iam-user-custom-props-bc80b5.py b/migrations/0052-iam-user-custom-props-bc80b5.py
@@ -0,0 +1,57 @@
+# Copyright 2026 Genesis Corporation
+#
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from restalchemy.storage.sql import migrations
+
+
+class MigrationStep(migrations.AbstractMigrationStep):
+    def __init__(self):
+        self._depends = [
+            "0051-sdk-1-5-0-migration-eea262.py",
+        ]
+
+    @property
+    def migration_id(self):
+        return "bc80b5db-ee1e-490c-8b17-6b80fc096475"
+
+    @property
+    def is_manual(self):
+        return False
+
+    def upgrade(self, session):
+        expressions = [
+            """
+                ALTER TABLE "iam_users"
+                    ADD COLUMN IF NOT EXISTS "custom_props" JSONB NULL DEFAULT NULL;
+            """,
+        ]
+
+        for expression in expressions:
+            session.execute(expression)
+
+    def downgrade(self, session):
+        expressions = [
+            """
+                ALTER TABLE "iam_users"
+                    DROP COLUMN IF EXISTS "custom_props";
+            """,
+        ]
+
+        for expression in expressions:
+            session.execute(expression)
+
+
+migration_step = MigrationStep()
diff --git a/pyproject.toml b/pyproject.toml
@@ -29,7 +29,7 @@ dependencies = [
     "bazooka>=1.3.0,<2.0.0",  # Apache-2.0
     "Jinja2>=3.1.5,<4.0.0",  # BSD License (BSD-3-Clause)
     "izulu>=0.50.0,<1.0.0",  # MIT License
-    "gcl_iam>=1.0.3,<2.0.0",  # Apache-2.0
+    "gcl_iam>=1.1.0,<2.0.0",  # Apache-2.0
     "gcl_sdk>=2.0.0,<3.0.0",  # Apache-2.0
     "gcl_certbot_plugin>=0.0.5,<1.0.0",  # Apache-2.0
     "pyotp>=2.9.0,<3.0.0",  # MIT License
@@ -221,4 +221,4 @@ directory = "cover"
 
 
 [tool.coverage.xml]
-output = "cover/coverage.xml"
+output = "cover/coverage.xml"
diff --git a/uv.lock b/uv.lock
