{"id":37403509,"url":"https://github.com/oslokommune/okdata-permission-api","last_synced_at":"2026-01-16T05:48:25.255Z","repository":{"id":37093770,"uuid":"379193126","full_name":"oslokommune/okdata-permission-api","owner":"oslokommune","description":"API for managing permissions to okdata resources","archived":false,"fork":false,"pushed_at":"2026-01-12T08:26:11.000Z","size":957,"stargazers_count":1,"open_issues_count":1,"forks_count":1,"subscribers_count":5,"default_branch":"main","last_synced_at":"2026-01-12T18:08:52.542Z","etag":null,"topics":["dataplatform"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/oslokommune.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2021-06-22T08:15:45.000Z","updated_at":"2026-01-12T08:26:13.000Z","dependencies_parsed_at":"2023-10-03T12:58:20.851Z","dependency_job_id":"ac277e10-d9ad-4d1a-83bd-16c0933d1b3e","html_url":"https://github.com/oslokommune/okdata-permission-api","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/oslokommune/okdata-permission-api","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oslokommune%2Fokdata-permission-api","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oslokommune%2Fokdata-permission-api/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oslokommune%2Fokdata-permission-api/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oslokommune%2Fokdata-permission-api/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/oslokommune","download_url":"https://codeload.github.com/oslokommune/okdata-permission-api/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oslokommune%2Fokdata-permission-api/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28477420,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-16T03:13:13.607Z","status":"ssl_error","status_checked_at":"2026-01-16T03:11:47.863Z","response_time":107,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["dataplatform"],"created_at":"2026-01-16T05:48:25.140Z","updated_at":"2026-01-16T05:48:25.239Z","avatar_url":"https://github.com/oslokommune.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"Okdata Permission API\n=====================\n\nAPI for managing permissions to okdata resources such as datasets via [Keycloak Authorization Services](https://www.keycloak.org/docs/latest/authorization_services/#_service_overview).\n\n## API Documentation\n\nAPI documentation can be found here: [OpenAPI Spec](https://api.data.oslo.systems/okdata-permission-api/openapi.json).\n\n### Known issues\n\n#### Listing UMA policies (permissions) fails\n\nDue to a bug in Keycloak ([#11284](https://github.com/keycloak/keycloak/issues/11284), fixed in Keycloak 18), where listing UMA policies fails when a user who was used in a policy gets deleted, the permission API consequently fails when attempting to list these policies:\n\n```\nrequests.exceptions.HTTPError: 500 Server Error: Internal Server Error for url:\n    https://\u003ckeycloak-server-url\u003e/auth/realms/api-catalog/authz/protection/uma-policy/?max=300\u0026first=0\n```\n\nIf this error occurs, all references to the deleted user must be manually deleted from the affected policies. This is done by using previously backed up permissions and the scripts below. If the deleted user is not known, the user must first be identified by narrowing down the affected policies using the above-mentioned Keycloak endpoint (see `scripts/list_permissions.py`).\n\n```sh\n# Replace a deleted user in all policies by another\n$ python -m scripts.clean_backup \\\n    --input permissions_backup.json \\\n    --output permissions_backup_cleaned.json \\\n    replace-user \\\n    --user-id homersimpson \\\n    --user-type user \\\n    --replacement-user-id janedoe \\\n    --replacement-user-type user\n\n# Restore cleaned permissions\n$ python -m scripts.restore_permissions_backup \\\n    --env dev \\\n    --input permissions_backup_cleaned.json \\\n    --skip-deleted-resources \\\n    --apply # Skip for dry-run\n```\n\n**Note**: The restore script works by deleting and re-creating the permissions found in the input file. Be sure to clean out all users that may be deleted since Keycloak does not recreate policies containing these users.\n\n## Setup\n\nIn these examples, we use the default `python3` distribution on your platform.\nIf you need a specific version of Python you need to run the command for that\nspecific version. I.e. for 3.8 run `python3.8 -m venv .venv` instead to get a\nvirtualenv for that version.\n\n### Installing global Python dependencies\n\nYou can choose to install the Python dependencies globally. This might require\nyou to run as root (use sudo).\n\n```bash\npython3 -m pip install tox black pip-tools\n```\n\nOr, you can install for just your user. This is recommended as it does not\nrequire root/sudo, but it does require `~/.local/bin` to be added to `PATH` in\nyour `.bashrc` or similar file for your shell. Eg:\n`PATH=${HOME}/.local/bin:${PATH}`.\n\n```bash\npython3 -m pip install --user tox black pip-tools\n```\n\n\n### Installing local Python dependencies in a virtualenv\n\n```bash\npython3 -m venv .venv\nsource .venv/bin/activate\npip install -r requirements.txt\n```\n\n```bash\nmake init\n```\n\n\n### Run application locally\n\nThis command will run a local instance of Keycloak, populate the local Keycloak\ninstance with necessary entities and run the FastAPI application on localhost.\n\n```bash\nmake run\n```\n\n\n## Tests\n\nTests are run using [tox](https://pypi.org/project/tox/): `make test`\n\nFor tests and linting we use [pytest](https://pypi.org/project/pytest/),\n[flake8](https://pypi.org/project/flake8/) and\n[black](https://pypi.org/project/black/).\n\n\n## Deploy\n\nDeploy to both dev and prod is automatic via GitHub Actions on push to main. You\ncan alternatively deploy from local machine with: `make deploy` or `make\ndeploy-prod`.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Foslokommune%2Fokdata-permission-api","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Foslokommune%2Fokdata-permission-api","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Foslokommune%2Fokdata-permission-api/lists"}