Merge branch... (5fc5738d) · Commits · OCF / capif

services/TS29222_CAPIF_Discover_Service_API/service_apis/core/discoveredapis.py

+41 −2

Original line number	Diff line number	Diff line

		import json
		import os
		import requests

		from flask import current_app

		@@ -11,6 +13,7 @@ from ..util import serialize_clean_camel_case
		from ..vendor_specific import (filter_apis_with_vendor_specific_params,
		find_attribute_in_body,
		remove_vendor_specific_fields)
		from ..encoder import CustomJSONEncoder

		TOTAL_FEATURES = 4
		SUPPORTED_FEATURES_HEX = "2"
		@@ -20,7 +23,8 @@ def filter_fields(filtered_apis):
		key_filter = [
		"api_name", "api_id", "aef_profiles", "description",
		"supported_features", "shareable_info", "service_api_category",
		"api_supp_feats", "pub_api_path", "ccf_id", "api_status"
		"api_supp_feats", "pub_api_path", "ccf_id", "api_status",
		"api_prov_name"
		]
		field_filtered_api = {}
		for key in filtered_apis.keys():
		@@ -117,6 +121,42 @@ class DiscoverApisOperations(Resource):
		if len(json_docs) == 0:
		return not_found_error(detail="API Invoker " + api_invoker_id + " has no API Published that accomplish filter conditions", cause="No API Published accomplish filter conditions")

		# Visibility Control Integration

		try:
		visibility_control_url = os.getenv(
		"VISIBILITY_CONTROL_URL",
		"http://helper:8080/helper/visibility-control/decision/invokers/{}/discoverable-apis"
		).format(api_invoker_id)
		visibility_payload = {
		"serviceAPIDescriptions": json_docs
		}

		current_app.logger.debug("Calling visibility control for invoker: " + api_invoker_id)
		visibility_response = requests.post(
		visibility_control_url,
		data=json.dumps(visibility_payload, cls=CustomJSONEncoder),
		headers={"Content-Type": "application/json"},
		timeout=int(os.getenv("TIMEOUT", "10"))
		)

		if visibility_response.status_code == 200:
		filtered_data = visibility_response.json()
		json_docs = filtered_data.get("serviceAPIDescriptions", [])
		current_app.logger.debug(f"Visibility control filtered {len(json_docs)} APIs for invoker {api_invoker_id}")
		else:
		current_app.logger.warning(f"Visibility control returned status {visibility_response.status_code}: {visibility_response.text}")

		except requests.exceptions.RequestException as e:
		current_app.logger.warning(f"Visibility control unreachable for invoker {api_invoker_id}: {str(e)}")
		except Exception as e:
		current_app.logger.warning(f"Error filtering APIs for invoker {api_invoker_id}: {str(e)}")

		if len(json_docs) == 0:
		return not_found_error(detail="API Invoker " + api_invoker_id + " has no visible APIs after applying visibility rules", cause="No APIs visible after visibility filtering")

		# End of Visibility Control Integration

		apis_discovered = DiscoveredAPIs(service_api_descriptions=json_docs)
		res = make_response(object=serialize_clean_camel_case(apis_discovered), status=200)
		return res
		@@ -125,4 +165,3 @@ class DiscoverApisOperations(Resource):
		exception = "An exception occurred in discover services"
		current_app.logger.error(exception + "::" + str(e))
		return internal_server_error(detail=exception, cause=str(e))

services/helper/helper_service/openapi_helper_visibility_control.yaml

deleted100644 → 0

+0 −536

Original line number	Diff line number	Diff line
		openapi: 3.0.3
		info:
		title: OpenCAPIF Access Control
		version: 1.0.0
		description: \|
		Access-control API to manage visibility rules and evaluate decisions for API discovery and
		security-context access within OpenCAPIF. This API controls whether APIs are visible to invokers
		(discovery) and whether invokers are allowed to create a security context to access them.
		- Rules are global and evaluated with "more specific wins" precedence.
		- If no rule matches, the decision uses OpenCAPIF's global default (outside this API).
		- Provider selector is mandatory in rules and must contain at least one selector field.
		servers:
		- url: https://capif.example.com/access-control
		description: Production
		- url: https://sandbox.capif.example.com/access-control
		description: Sandbox

		tags:
		- name: Rules
		description: Manage visibility rules
		- name: Decision
		description: Evaluate discovery and access decisions

		paths:
		/rules:
		get:
		tags: [Rules]
		summary: List rules
		responses:
		'200':
		description: List of rules
		content:
		application/json:
		schema:
		type: object
		properties:
		items:
		type: array
		items:
		$ref: '#/components/schemas/Rule'
		nextPageToken:
		type: string
		required: [items]
		post:
		tags: [Rules]
		summary: Create a rule
		description: Server generates the ruleId. Provider selector must include at least one field.
		requestBody:
		required: true
		content:
		application/json:
		schema:
		$ref: '#/components/schemas/RuleCreateRequest'
		examples:
		allow_except_some_invokers:
		value:
		providerSelector:
		userName: "userA"
		apiProviderId: [ "capif-prov-01", "capif-prov-02" ]
		apiName: [ "apiName-001" ]
		apiId: [ "apiId-001" ]
		aefId: [ "aef-001" ]
		invokerExceptions:
		apiInvokerId: [ "invk-123", "invk-999" ]
		default_access: ALLOW
		enabled: true
		responses:
		'201':
		description: Rule created
		content:
		application/json:
		schema:
		$ref: '#/components/schemas/Rule'
		'400':
		description: Invalid input
		content:
		application/json:
		schema: { $ref: '#/components/schemas/Error' }

		/rules/{ruleId}:
		get:
		tags: [Rules]
		summary: Get a rule
		parameters:
		- $ref: '#/components/parameters/RuleId'
		responses:
		'200':
		description: Rule
		content:
		application/json:
		schema:
		$ref: '#/components/schemas/Rule'
		'404':
		description: Rule not found
		content:
		application/json:
		schema: { $ref: '#/components/schemas/Error' }
		patch:
		tags: [Rules]
		summary: Update a rule (partial)
		parameters:
		- $ref: '#/components/parameters/RuleId'
		requestBody:
		required: true
		content:
		application/json:
		schema:
		$ref: '#/components/schemas/RulePatchRequest'
		responses:
		'200':
		description: Rule updated
		content:
		application/json:
		schema:
		$ref: '#/components/schemas/Rule'
		'400':
		description: Invalid input
		content:
		application/json:
		schema: { $ref: '#/components/schemas/Error' }
		'404':
		description: Rule not found
		content:
		application/json:
		schema: { $ref: '#/components/schemas/Error' }
		delete:
		tags: [Rules]
		summary: Delete a rule
		parameters:
		- $ref: '#/components/parameters/RuleId'
		responses:
		'204':
		description: Deleted
		'404':
		description: Rule not found
		content:
		application/json:
		schema: { $ref: '#/components/schemas/Error' }

		/decision/invokers/{apiInvokerId}/discoverable-apis:
		get:
		tags: [Decision]
		summary: Get discoverable APIs filter for an invoker (global scope)
		description: \|
		Returns a filtered list of APIs for the API Invoker.
		parameters:
		- $ref: '#/components/parameters/ApiInvokerId'
		responses:
		'200':
		description: Discover filter
		content:
		application/json:
		schema:
		$ref: '#/components/schemas/DiscoveredAPIs'
		'400':
		description: Invalid input
		content:
		application/json:
		schema: { $ref: '#/components/schemas/Error' }
		'404':
		description: Invoker not found (optional behavior)
		content:
		application/json:
		schema: { $ref: '#/components/schemas/Error' }

		components:
		parameters:
		RuleId:
		in: path
		name: ruleId
		required: true
		schema:
		type: string
		description: Server-generated rule identifier
		ApiInvokerId:
		in: path
		name: apiInvokerId
		required: true
		schema:
		type: string
		description: CAPIF API Invoker identifier

		schemas:
		# ---------- Core Rule Schemas ----------
		RuleCreateRequest:
		type: object
		required: [providerSelector, default_access]
		properties:
		providerSelector:
		$ref: '#/components/schemas/ProviderSelector'
		invokerExceptions:
		$ref: '#/components/schemas/InvokerSelector'
		default_access:
		type: string
		enum: [ALLOW, DENY]
		enabled:
		type: boolean
		default: true
		startsAt:
		type: string
		format: date-time
		endsAt:
		type: string
		format: date-time
		notes:
		type: string
		description: \|
		Create a new rule. Provider selector is mandatory and must include at least one field.
		If both startsAt and endsAt are present, endsAt must be greater than startsAt.

		RulePatchRequest:
		type: object
		properties:
		providerSelector:
		$ref: '#/components/schemas/PatchProviderSelector'
		invokerExceptions:
		$ref: '#/components/schemas/InvokerSelector'
		default_access:
		type: string
		enum: [ALLOW, DENY]
		enabled:
		type: boolean
		startsAt:
		type: string
		format: date-time
		endsAt:
		type: string
		format: date-time
		notes:
		type: string
		description: Partial update. Any omitted field remains unchanged.

		Rule:
		type: object
		properties:
		ruleId:
		type: string
		providerSelector:
		$ref: '#/components/schemas/ProviderSelector'
		invokerExceptions:
		$ref: '#/components/schemas/InvokerSelector'
		default_access:
		type: string
		enum: [ALLOW, DENY]
		enabled:
		type: boolean
		default: true
		startsAt:
		type: string
		format: date-time
		endsAt:
		type: string
		format: date-time
		notes:
		type: string
		updatedAt:
		type: string
		format: date-time
		updatedBy:
		type: string
		required: [ruleId, providerSelector, default_access]

		PatchProviderSelector:
		type: object
		description: \|
		Patch Provider-side selector.
		properties:
		apiProviderId:
		type: array
		items: { type: string }
		minItems: 0
		uniqueItems: true
		apiName:
		type: array
		items: { type: string }
		minItems: 0
		uniqueItems: true
		apiId:
		type: array
		items: { type: string }
		minItems: 0
		uniqueItems: true
		aefId:
		type: array
		items: { type: string }
		minItems: 0
		uniqueItems: true
		userName:
		type: string
		minLength: 1
		additionalProperties: false

		ProviderSelector:
		type: object
		description: \|
		Provider-side selector. Arrays apply OR within the field; AND across fields.
		At least one of these fields must be present.
		required:
		- userName
		properties:
		userName:
		type: string
		minLength: 1
		apiProviderId:
		type: array
		items: { type: string }
		minItems: 0
		uniqueItems: true
		apiName:
		type: array
		items: { type: string }
		minItems: 0
		uniqueItems: true
		apiId:
		type: array
		items: { type: string }
		minItems: 0
		uniqueItems: true
		aefId:
		type: array
		items: { type: string }
		minItems: 0
		uniqueItems: true
		additionalProperties: false

		InvokerSelector:
		type: object
		description: Invoker-side selector used for exceptions. Optional; arrays use OR within the field; AND across fields.
		properties:
		invokerOnboardedByUser:
		type: array
		items: { type: string }
		minItems: 0
		uniqueItems: true
		apiInvokerId:
		type: array
		items: { type: string }
		minItems: 0
		uniqueItems: true
		additionalProperties: false

		# ---------- Decision Schemas (3GPP Based) ----------
		DiscoveredAPIs:
		type: object
		properties:
		serviceAPIDescriptions:
		type: array
		items:
		$ref: '#/components/schemas/ServiceAPIDescription'
		minItems: 1
		suppFeat:
		$ref: '#/components/schemas/SupportedFeatures'

		ServiceAPIDescription:
		type: object
		required: [apiName]
		properties:
		apiName: { type: string }
		apiId: { type: string }
		apiStatus: { $ref: '#/components/schemas/ApiStatus' }
		aefProfiles:
		type: array
		items: { $ref: '#/components/schemas/AefProfile' }
		minItems: 1
		description: { type: string }
		supportedFeatures: { $ref: '#/components/schemas/SupportedFeatures' }
		shareableInfo: { $ref: '#/components/schemas/ShareableInformation' }
		serviceAPICategory: { type: string }
		apiSuppFeats: { $ref: '#/components/schemas/SupportedFeatures' }
		pubApiPath: { $ref: '#/components/schemas/PublishedApiPath' }
		ccfId: { type: string }
		apiProvName: { type: string }
		#apiProvName is apiProviderId?


		AefProfile:
		type: object
		required: [aefId, versions]
		properties:
		aefId: { type: string }
		versions:
		type: array
		items: { $ref: '#/components/schemas/Version' }
		minItems: 1
		protocol: { $ref: '#/components/schemas/Protocol' }
		dataFormat: { $ref: '#/components/schemas/DataFormat' }
		securityMethods:
		type: array
		items: { $ref: '#/components/schemas/SecurityMethod' }
		grantTypes:
		type: array
		items: { $ref: '#/components/schemas/OAuthGrantType' }
		domainName: { type: string }
		interfaceDescriptions:
		type: array
		items: { $ref: '#/components/schemas/InterfaceDescription' }
		aefLocation: { $ref: '#/components/schemas/AefLocation' }
		serviceKpis: { $ref: '#/components/schemas/ServiceKpis' }
		ueIpRange: { $ref: '#/components/schemas/IpAddrRange' }

		Version:
		type: object
		required: [apiVersion]
		properties:
		apiVersion: { type: string }
		expiry: { type: string, format: date-time }
		resources:
		type: array
		items: { $ref: '#/components/schemas/Resource' }
		custOperations:
		type: array
		items: { $ref: '#/components/schemas/CustomOperation' }

		Resource:
		type: object
		required: [commType, resourceName, uri]
		properties:
		resourceName: { type: string }
		commType: { $ref: '#/components/schemas/CommunicationType' }
		uri: { type: string }
		custOpName: { type: string }
		operations:
		type: array
		items: { $ref: '#/components/schemas/Operation' }
		description: { type: string }

		CustomOperation:
		type: object
		required: [commType, custOpName]
		properties:
		commType: { $ref: '#/components/schemas/CommunicationType' }
		custOpName: { type: string }
		operations:
		type: array
		items: { $ref: '#/components/schemas/Operation' }
		description: { type: string }

		ApiStatus:
		type: object
		required: [aefIds]
		properties:
		aefIds:
		type: array
		items: { type: string }

		InterfaceDescription:
		type: object
		properties:
		ipv4Addr: { type: string }
		ipv6Addr: { type: string }
		fqdn: { type: string }
		port: { type: integer }
		apiPrefix: { type: string }
		securityMethods:
		type: array
		items: { $ref: '#/components/schemas/SecurityMethod' }
		grantTypes:
		type: array
		items: { $ref: '#/components/schemas/OAuthGrantType' }

		# ---------- Supporting 3GPP Types ----------
		SupportedFeatures:
		type: string
		pattern: "^[A-Fa-f0-9]*$"
		CommunicationType:
		type: string
		enum: [REQUEST_RESPONSE, SUBSCRIBE_NOTIFY]
		Protocol:
		type: string
		enum: [HTTP_1_1, HTTP_2, MQTT, WEBSOCKET]
		DataFormat:
		type: string
		enum: [JSON, XML, PROTOBUF3]
		Operation:
		type: string
		enum: [GET, POST, PUT, PATCH, DELETE]
		SecurityMethod:
		type: string
		enum: [PSK, PKI, OAUTH]
		OAuthGrantType:
		type: string
		enum: [CLIENT_CREDENTIALS, AUTHORIZATION_CODE, AUTHORIZATION_CODE_WITH_PKCE]

		ShareableInformation:
		type: object
		required: [isShareable]
		properties:
		isShareable: { type: boolean }
		capifProvDoms:
		type: array
		items: { type: string }

		PublishedApiPath:
		type: object
		properties:
		ccfIds:
		type: array
		items: { type: string }

		AefLocation:
		type: object
		properties:
		dcId: { type: string }
		# Simplified for brevity, you can add GeographicArea/CivicAddress if needed

		ServiceKpis:
		type: object
		properties:
		maxReqRate: { type: integer }
		maxRestime: { type: integer }
		availability: { type: integer }
		avalComp: { type: string }
		avalMem: { type: string }
		avalStor: { type: string }

		IpAddrRange:
		type: object
		properties:
		ueIpv4AddrRanges:
		type: array
		items:
		type: object
		properties:
		start: { type: string }
		end: { type: string }

		# ---------- Errors ----------
		Error:
		type: object
		required: [code, message]
		properties:
		code: { type: string }
		message: { type: string }
		details:
		type: object
		additionalProperties: true
		No newline at end of file

services/helper/helper_service/services/visibility_control/controllers/decision_controller.py

+38 −2

Original line number	Diff line number	Diff line
		import connexion
		import logging
		from typing import Dict
		from typing import Tuple
		from typing import Union

		from visibility_control.auth import cert_validation
		from visibility_control.models.discovered_apis import DiscoveredAPIs # noqa: E501
		from visibility_control.models.discovery_request import DiscoveryRequest # noqa: E501
		from visibility_control.models.error import Error # noqa: E501
		from visibility_control import util
		from visibility_control.core import visibility_control_core

		logger = logging.getLogger(__name__)

		def decision_invokers_api_invoker_id_discoverable_apis_get(api_invoker_id): # noqa: E501
		#@cert_validation()
		def decision_invokers_api_invoker_id_discoverable_apis_post(api_invoker_id, body=None): # noqa: E501
		"""Get discoverable APIs filter for an invoker (global scope)

		Returns a filtered list of APIs for the API Invoker. # noqa: E501

		:param api_invoker_id: CAPIF API Invoker identifier
		:type api_invoker_id: str
		:param body: List of all discovered APIs to be filtered
		:type body: DiscoveryRequest

		:rtype: Union[DiscoveredAPIs, Tuple[DiscoveredAPIs, int], Tuple[DiscoveredAPIs, int, Dict[str, str]]
		"""
		return 'do some magic!'
		# Handle body parameter - it may come as None from Connexion
		if body is None:
		if connexion.request.is_json:
		body = connexion.request.get_json()
		else:
		return {'code': 400, 'message': 'JSON body required'}, 400

		if body is None or body.get('serviceAPIDescriptions') is None:
		return {'code': 400, 'message': 'Missing serviceAPIDescriptions in request body'}, 400

		logger.debug(
		f"Visibility decision request for invoker {api_invoker_id}, request body keys: {list(body.keys())}"
		)

		try:
		apis_list = body.get('serviceAPIDescriptions', [])
		logger.debug(
		f"Visibility decision input API count: {len(apis_list)} for invoker {api_invoker_id}"
		)
		result = visibility_control_core.get_discoverable_apis(api_invoker_id, apis_list)
		logger.debug(
		f"Visibility decision returned {len(result)} APIs for invoker {api_invoker_id}"
		)
		return {"serviceAPIDescriptions": result}, 200
		except Exception as e:
		logger.error(
		f"Visibility decision processing failed for invoker {api_invoker_id}: {str(e)}"
		)
		return {"error": str(e)}, 400

services/helper/helper_service/services/visibility_control/core/visibility_control_core.py

+266 −1

File changed.

Preview size limit exceeded, changes collapsed.

services/helper/helper_service/services/visibility_control/models/discovery_request.py

0 → 100644

+3 −0

Original line number	Diff line number	Diff line
		class DiscoveryRequest:
		def __init__(self, args, *kwargs):
		pass