kitos
9472fe91fa
Aegis CI / lint-and-test (push) Has been cancelled
- Remove ANN (type annotations) and D (docstrings) from ruff select; not feasible to add thousands of missing annotations/docstrings across the codebase - Add I001 and E501 to ignore: comment-interleaved import style and SQLAlchemy FK definitions naturally exceed line limits - Fix F811 duplicate import blocks in main.py, models/__init__.py, routers (campaigns, system, tests, evidence) and services (test_workflow, test_crud, campaign_service, schemas/test) - Add missing Evidence/IntelItem/Technique/Test/TestTemplate/User imports to models/__init__.py (were only in duplicate block) - Fix F821: add missing JWTError import in auth.py - Fix F401 unused imports across 15+ files (jira_service, sso_service, notification_service, playbook_service, tempo_service, models, schemas, routers: admin_config, attack_paths, executive_dashboard, knowledge, ownership, risk_intelligence, sso, api_keys, email_service) - Fix F841 unused variables: owned_technique_ids (executive_dashboard_service), severity (jira_service), priority_order (revalidation_queue_service) - Fix F541 f-strings without placeholders in system.py and attck_evaluations_service - Fix F601 duplicate dict key G0067 in threat_actor_import_service - Fix E701 multiple-statements-on-one-line in risk_intelligence_service - Fix E741 ambiguous variable name l -> lvl in risk_intelligence_service - Fix N806 uppercase vars in functions: technique.py, heatmap_service.py; add noqa for compliance_import_service.py large unused constant dicts - Fix W293 whitespace on blank lines in tests/conftest.py
50 lines
2.8 KiB
Python
50 lines
2.8 KiB
Python
"""Phase 14: SSO / SAML 2.0 configuration model."""
|
|
|
|
import uuid
|
|
from datetime import datetime
|
|
|
|
from sqlalchemy import Boolean, Column, DateTime, String, Text
|
|
from sqlalchemy.dialects.postgresql import UUID
|
|
|
|
from app.database import Base
|
|
|
|
|
|
class SsoConfig(Base):
|
|
"""
|
|
SAML 2.0 Identity Provider configuration.
|
|
|
|
Exactly one row is expected (use upsert). The SP metadata endpoint
|
|
reads from this row to generate XML for IdP registration.
|
|
"""
|
|
|
|
__tablename__ = "sso_configs"
|
|
|
|
id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
|
|
is_enabled = Column(Boolean, nullable=False, default=False)
|
|
provider_name = Column(String(200), nullable=True) # e.g., "Okta", "Azure AD"
|
|
|
|
# ── Service Provider (Aegis) settings ────────────────────────────────────
|
|
sp_entity_id = Column(String(500), nullable=True) # e.g., https://aegis.co/api/v1/sso/metadata
|
|
sp_acs_url = Column(String(500), nullable=True) # Assertion Consumer Service URL
|
|
sp_slo_url = Column(String(500), nullable=True) # Single Logout URL (optional)
|
|
sp_certificate = Column(Text, nullable=True) # SP public cert for signed requests
|
|
sp_private_key = Column(Text, nullable=True) # SP private key (stored encrypted in future)
|
|
|
|
# ── Identity Provider settings ────────────────────────────────────────────
|
|
idp_entity_id = Column(String(500), nullable=True)
|
|
idp_sso_url = Column(String(500), nullable=True) # IdP redirect/POST binding URL
|
|
idp_slo_url = Column(String(500), nullable=True) # IdP SLO URL
|
|
idp_certificate = Column(Text, nullable=True) # IdP X.509 cert for response validation
|
|
|
|
# ── Attribute mapping ─────────────────────────────────────────────────────
|
|
# SAML attribute name → Aegis field
|
|
attr_email = Column(String(200), nullable=True, default="email")
|
|
attr_username = Column(String(200), nullable=True, default="username")
|
|
attr_role = Column(String(200), nullable=True, default="role")
|
|
default_role = Column(String(50), nullable=True, default="viewer")
|
|
auto_provision = Column(Boolean, nullable=False, default=True) # create user on first login
|
|
|
|
# ── Meta ─────────────────────────────────────────────────────────────────
|
|
created_at = Column(DateTime, default=datetime.utcnow)
|
|
updated_at = Column(DateTime, default=datetime.utcnow, onupdate=datetime.utcnow)
|