Auth Backend Base

dagster_authkit.auth.backends.base

Base Authentication Backend

Abstract base class that all backends must implement. Includes Role hierarchy, AuthUser dataclass, and audit helpers.

Role

Bases: IntEnum

Hierarchical role levels matching Dagster+.

Numeric values allow simple comparisons

user.role >= Role.LAUNCHER

Hierarchy

VIEWER (10) - Read-only access LAUNCHER (20) - Execute runs (launchRun, terminateRun) EDITOR (30) - Manage schedules, sensors, assets ADMIN (40) - Full access + user management

RolePermissions

Defines GraphQL mutation permissions for each role.

Permissions are hierarchical: - ADMIN can do everything (ADMIN + EDITOR + LAUNCHER) - EDITOR can do EDITOR + LAUNCHER - LAUNCHER can do only LAUNCHER - VIEWER can only read

get_required_role classmethod

get_required_role(mutation_name, default_role=None)

Get the minimum required role for a GraphQL mutation.

Parameters:

Name	Type	Description	Default
mutation_name	str	Name of the GraphQL mutation (e.g. launchRun).	required
default_role	Optional[Role]	Role for unrecognized mutations. None (legacy) means no restriction. Set to Role.ADMIN for deny-by-default.	None

Returns:

Type	Description
Optional[Role]	Required Role, default_role for unknown mutations,
Optional[Role]	or None if no restriction.

Example::

>>> RolePermissions.get_required_role("launchRun")
Role.LAUNCHER
>>> RolePermissions.get_required_role("newMutation", Role.ADMIN)
Role.ADMIN

can_execute classmethod

can_execute(user_role, mutation_name, default_role=None)

Check if a role can execute a mutation (respects role hierarchy).

Parameters:

Name	Type	Description	Default
user_role	Role	User's role.	required
mutation_name	str	Name of the GraphQL mutation.	required
default_role	Optional[Role]	Default role for unknown mutations (default: None — no restriction; pass Role.ADMIN for deny-by-default).	None

Returns:

Type	Description
bool	True if the user can execute, False otherwise.

Example::

>>> RolePermissions.can_execute(Role.LAUNCHER, "launchRun")
True
>>> RolePermissions.can_execute(Role.VIEWER, "launchRun")
False

list_permissions classmethod

list_permissions(role)

List all mutations a role can execute.

Includes inherited permissions from lower roles.

Parameters:

Name	Type	Description	Default
role	Role	Role to check	required

Returns:

Type	Description
Set[str]	Set of mutation names

Example

perms = RolePermissions.list_permissions(Role.EDITOR) "launchRun" in perms True "startSchedule" in perms True

AuthUser dataclass

Universal user representation (backend-agnostic).

All backends (SQLite, LDAP, etc) return this format.

Attributes:

Name	Type	Description
username	str	Unique username
role	Role	Role level (VIEWER/LAUNCHER/EDITOR/ADMIN)
email	str	Email address (optional)
full_name	str	Display name (optional)

display_name property

display_name

Friendly name for UI (fallback to username).

can

can(required_role)

Check if user has sufficient permissions.

Parameters:

Name	Type	Description	Default
required_role	Role	Minimum required role	required

Returns:

Type	Description
bool	True if user.role >= required_role

Example

user = AuthUser("john", Role.EDITOR) user.can(Role.LAUNCHER) # True (30 >= 20) user.can(Role.ADMIN) # False (30 < 40)

to_dict

to_dict()

Convert to dict (for session storage).

Uses role.value (int) as the canonical representation for consistency across all backends (SQL, LDAP, OIDC). from_dict() handles both int and string formats for backward compatibility with existing sessions.

Returns:

Type	Description
Dict[str, Any]	Dict with username, role, email, full_name

from_dict classmethod

from_dict(data)

Create AuthUser from dict. Robust enough to handle both String names and Integer values.

AuthBackend

Bases: ABC

Abstract base class for authentication backends.

All backends (SQLite, LDAP, OAuth, etc.) must inherit from this class and implement the abstract methods.

__init__

__init__(config)

Initializes backend with configuration.

Parameters:

Name	Type	Description	Default
config	Dict[str, Any]	Dict with settings (usually config.dict)	required

authenticate abstractmethod

authenticate(username, password)

Authenticates user with username and password.

Parameters:

Name	Type	Description	Default
username	str	Username	required
password	str	Password in plain text	required

Returns:

Type	Description
Optional[AuthUser]	AuthUser if authenticated, None if failed

get_user abstractmethod

get_user(username)

Fetches user info without authenticating.

Used for session validation (already authenticated).

Parameters:

Name	Type	Description	Default
username	str	Username	required

Returns:

Type	Description
Optional[AuthUser]	AuthUser or None if user doesn't exist

get_name abstractmethod

get_name()

Returns backend identifier.

Returns:

Name	Type	Description
str	str	Backend name (e.g., 'sqlite', 'ldap', 'dummy')

add_user

add_user(username, password, role, email='', full_name='', performed_by='system', **kwargs)

Creates a new user (OPTIONAL - only for local backends).

Parameters:

Name	Type	Description	Default
username	str	Username	required
password	str	Password in plain text (will be hashed)	required
role	Role	Role level (Role.ADMIN, Role.EDITOR, etc)	required
email	str	User's email	''
full_name	str	Display name	''
performed_by	str	Who created the user (for auditing)	'system'

Returns:

Name	Type	Description
bool	bool	True if created, False if failed

Raises:

Type	Description
NotImplementedError	If backend doesn't support it (LDAP, OAuth)

delete_user

delete_user(username, performed_by='system')

Removes a user (OPTIONAL - only for local backends).

Parameters:

Name	Type	Description	Default
username	str	Username	required
performed_by	str	Who deleted the user (for auditing)	'system'

Returns:

Name	Type	Description
bool	bool	True if deleted, False if user doesn't exist

Raises:

Type	Description
NotImplementedError	If backend doesn't support it

change_password

change_password(username, new_password, performed_by='system')

Changes a user's password (OPTIONAL - only for local backends).

Parameters:

Name	Type	Description	Default
username	str	Username	required
new_password	str	New password in plain text (will be hashed)	required
performed_by	str	Who changed it (for auditing)	'system'

Returns:

Name	Type	Description
bool	bool	True if changed, False if user doesn't exist

Raises:

Type	Description
NotImplementedError	If backend doesn't support it

list_users

list_users()

Lists all users (OPTIONAL - only for local backends).

Returns:

Type	Description
List[AuthUser]	List of AuthUser instances

Raises:

Type	Description
NotImplementedError	If backend doesn't support it

change_role

change_role(username, new_role, performed_by='system')

Changes a user's role (OPTIONAL).

Parameters:

Name	Type	Description	Default
username	str	Username	required
new_role	Role	New role level	required
performed_by	str	Who changed it (for auditing)	'system'

Returns:

Name	Type	Description
bool	bool	True if updated

Raises:

Type	Description
NotImplementedError	If backend doesn't support it