Warning

This document is for an in-development version of Galaxy. You can alternatively view this page in the latest release if it exists or view the top of the latest release's documentation.

galaxy.security package

Galaxy Security

class galaxy.security.Action(action, description, model)

Bases: object

__init__(action, description, model)

class galaxy.security.RBACAgent

Bases: object

Class that handles galaxy security

permitted_actions = <galaxy.util.bunch.Bunch object>

get_action(name, default=None)

Get a permitted action by its dict key or action name

get_actions()

Get all permitted actions as a list of Action objects

get_item_actions(action, item)

guess_derived_permissions_for_datasets(datasets=None)

can_access_dataset(roles, dataset)

can_manage_dataset(roles, dataset)

can_access_library(roles, library)

can_add_library_item(roles, item)

can_modify_library_item(roles, item)

can_manage_library_item(roles, item)

associate_components(**kwd)

create_private_user_role(user)

get_private_user_role(user)

user_set_default_permissions(user, permissions=None, history=False, dataset=False)

history_set_default_permissions(history, permissions=None, dataset=False, bypass_manage_permission=False)

set_all_dataset_permissions(dataset, permissions, new=False)

set_dataset_permission(dataset, permission)

set_all_library_permissions(trans, dataset, permissions)

set_library_item_permission(library_item, permission)

library_is_public(library)

make_library_public(library)

get_accessible_libraries(trans, user)

get_permitted_libraries(trans, user, actions)

folder_is_public(library)

make_folder_public(folder, count=0)

dataset_is_public(dataset)

make_dataset_public(dataset)

get_permissions(library_dataset)

get_all_roles(trans, cntrller)

get_legitimate_roles(trans, item, cntrller)

derive_roles_from_access(trans, item_id, cntrller, library=False, **kwd)

get_component_associations(**kwd)

components_are_associated(**kwd)

convert_permitted_action_strings(permitted_action_strings)

When getting permitted actions from an untrusted source like a form, ensure that they match our actual permitted actions.

galaxy.security.get_permitted_actions(filter=None)

Utility method to return a subset of RBACAgent’s permitted actions

Submodules

galaxy.security.idencoding module

class galaxy.security.idencoding.IdEncodingHelper(**config)

Bases: object

__init__(**config)

encode_id(obj_id, kind=None)

encode_dict_ids(a_dict, kind=None, skip_startswith=None)

Encode all ids in dictionary. Ids are identified by (a) an ‘id’ key or (b) a key that ends with ‘_id’

encode_all_ids(rval, recursive=False)

Encodes all integer values in the dict rval whose keys are ‘id’ or end with ‘_id’ excluding tool_id which are consumed and produced as is via the API.

decode_id(obj_id, kind=None, object_name: Optional[str] = None)

encode_guid(session_key)

decode_guid(session_key)

get_new_guid()

galaxy.security.passwords module

galaxy.security.passwords.hash_password(password)

Hash a password, currently will use the PBKDF2 scheme.

galaxy.security.passwords.check_password(guess, hashed)

Check a hashed password. Supports either PBKDF2 if the hash is prefixed with that string, or sha1 otherwise.

galaxy.security.passwords.hash_password_PBKDF2(password)

galaxy.security.passwords.check_password_PBKDF2(guess, hashed)

galaxy.security.passwords.pbkdf2_bin(data, salt, iterations=100000, keylen=24, hashfunc='sha256')

Returns a binary digest for the PBKDF2 hash algorithm of data with the given salt. It iterates iterations time and produces a key of keylen bytes. By default SHA-256 is used as hash function, a different hashlib hashfunc can be provided.

galaxy.security.validate_user_input module

Utilities for validating inputs related to user objects.

The validate_* methods in this file return simple messages that do not contain user inputs - so these methods do not need to be escaped.

galaxy.security.validate_user_input.validate_email_str(email)

Validates a string containing an email address.

galaxy.security.validate_user_input.validate_password_str(password)

galaxy.security.validate_user_input.validate_publicname_str(publicname)

Validates a string containing a public username.

galaxy.security.validate_user_input.validate_email(trans, email, user=None, check_dup=True, allow_empty=False, validate_domain=False)

Validates the email format, also checks whether the domain is blocklisted in the disposable domains configuration.

galaxy.security.validate_user_input.validate_domain_resolves(domain)

galaxy.security.validate_user_input.extract_domain(email, base_only=False)

galaxy.security.validate_user_input.validate_publicname(trans, publicname, user=None)

Check that publicname respects the minimum and maximum string length, the allowed characters, and that the username is not taken already.

galaxy.security.validate_user_input.transform_publicname(publicname)

Transform publicname to respect the minimum and maximum string length, and the allowed characters. FILL_CHAR is used to extend or replace characters.

galaxy.security.validate_user_input.validate_password(trans, password, confirm)