hash and test claims

Author: AlanCoding

ansible_base/rbac/claims.py

@@ -1,3 +1,5 @@
+import hashlib
+import json
 from typing import Union
 
 from django.apps import apps
@@ -107,3 +109,76 @@ def get_user_claims(user: Model) -> dict[str, Union[list[str], dict[str, Union[s
         claims['global_roles'].append(rd.name)
 
     return claims
+
+
+def get_user_claims_hashable_form(claims: dict) -> dict[str, Union[list[str], dict[str, list[str]]]]:
+    """Convert user claims to hashable form suitable for generating deterministic hashes.
+
+    Args:
+        claims: Claims dictionary from get_user_claims()
+
+    The hashable form:
+    - Removes the 'objects' section entirely
+    - Converts object role references from array indexes to ansible_id values
+    - Sorts all collections for deterministic ordering
+    - Uses ansible_id for object references (or id if no ansible_id, for future use)
+
+    Returns:
+        {
+            'global_roles': ['Platform Auditor', 'System Admin'],  # sorted
+            'object_roles': {
+                'Organization Admin': ['uuid1', 'uuid2'],  # sorted ansible_ids
+                'Team Member': ['uuid3', 'uuid4']         # sorted ansible_ids
+            }
+        }
+    """
+
+    hashable_claims = {'global_roles': sorted(claims['global_roles']), 'object_roles': {}}
+
+    # Convert object_roles from indexes to ansible_ids
+    for role_name, role_data in claims['object_roles'].items():
+        content_type = role_data['content_type']
+        object_indexes = role_data['objects']
+
+        # Get the objects array for this content type
+        objects_array = claims['objects'].get(content_type, [])
+
+        # Convert indexes to ansible_ids
+        ansible_ids = []
+        for index in object_indexes:
+            if index < len(objects_array):
+                obj_data = objects_array[index]
+                # Use ansible_id if available, otherwise fall back to id (for future use)
+                ansible_id = obj_data.get('ansible_id') or str(obj_data.get('id', ''))
+                if ansible_id:
+                    ansible_ids.append(ansible_id)
+
+        # Sort ansible_ids for deterministic ordering
+        hashable_claims['object_roles'][role_name] = sorted(ansible_ids)
+
+    return hashable_claims
+
+
+def get_claims_hash(hashable_claims: dict) -> str:
+    """Generate a deterministic SHA-256 hash from hashable claims data.
+
+    Args:
+        hashable_claims: Output from get_user_claims_hashable_form()
+
+    Returns:
+        64-character hex string representing the SHA-256 hash of the claims
+
+    The hash is generated by:
+    1. Serializing the hashable claims to JSON with sorted keys
+    2. Encoding to UTF-8 bytes
+    3. Computing SHA-256 hash
+    4. Returning as hexadecimal string
+    """
+    # Serialize to JSON with sorted keys for deterministic output
+    json_str = json.dumps(hashable_claims, sort_keys=True, separators=(',', ':'))
+
+    # Encode to bytes and compute SHA-256 hash
+    json_bytes = json_str.encode('utf-8')
+    hash_digest = hashlib.sha256(json_bytes).hexdigest()
+
+    return hash_digest