✨(backend) add resource server api

Adds a resource server API similar to the one that already
exists for Drive.

src/backend/core/external_api/permissions.py

@@ -0,0 +1,41 @@
+"""Resource Server Permissions for the Docs app."""
+
+from django.conf import settings
+
+from lasuite.oidc_resource_server.authentication import ResourceServerAuthentication
+from rest_framework import permissions
+
+
+class ResourceServerClientPermission(permissions.BasePermission):
+    """
+    Permission class for resource server views.
+    This provides a way to open the resource server views to a limited set of
+    Service Providers.
+    Note: we might add a more complex permission system in the future, based on
+    the Service Provider ID and the requested scopes.
+    """
+
+    def has_permission(self, request, view):
+        """
+        Check if the user is authenticated and the token introspection
+        provides an authorized Service Provider.
+        """
+        if not isinstance(
+            request.successful_authenticator, ResourceServerAuthentication
+        ):
+            # Not a resource server request
+            return False
+
+        # Check if the user is authenticated
+        if not request.user.is_authenticated:
+            return False
+        if (
+            hasattr(view, "resource_server_actions")
+            and view.action not in view.resource_server_actions
+        ):
+            return False
+
+        # When used as a resource server, the request has a token audience
+        return (
+            request.resource_server_token_audience in settings.OIDC_RS_ALLOWED_AUDIENCES
+        )

src/backend/core/external_api/viewsets.py

@@ -0,0 +1,91 @@
+"""Resource Server Viewsets for the Docs app."""
+
+from django.conf import settings
+
+from lasuite.oidc_resource_server.authentication import ResourceServerAuthentication
+
+from core.api.permissions import (
+    CanCreateInvitationPermission,
+    DocumentPermission,
+    IsSelf,
+    ResourceAccessPermission,
+)
+from core.api.viewsets import (
+    DocumentAccessViewSet,
+    DocumentViewSet,
+    InvitationViewset,
+    UserViewSet,
+)
+from core.external_api.permissions import ResourceServerClientPermission
+
+# pylint: disable=too-many-ancestors
+
+
+class ResourceServerRestrictionMixin:
+    """
+    Mixin for Resource Server Viewsets to provide shortcut to get
+    configured actions for a given resource.
+    """
+
+    def _get_resource_server_actions(self, resource_name):
+        """Get resource_server_actions from settings."""
+        external_api_config = settings.EXTERNAL_API.get(resource_name, {})
+        return list(external_api_config.get("actions", []))
+
+
+class ResourceServerDocumentViewSet(ResourceServerRestrictionMixin, DocumentViewSet):
+    """Resource Server Viewset for Documents."""
+
+    authentication_classes = [ResourceServerAuthentication]
+
+    permission_classes = [ResourceServerClientPermission & DocumentPermission]  # type: ignore
+
+    @property
+    def resource_server_actions(self):
+        """Build resource_server_actions from settings."""
+        return self._get_resource_server_actions("documents")
+
+
+class ResourceServerDocumentAccessViewSet(
+    ResourceServerRestrictionMixin, DocumentAccessViewSet
+):
+    """Resource Server Viewset for DocumentAccess."""
+
+    authentication_classes = [ResourceServerAuthentication]
+
+    permission_classes = [ResourceServerClientPermission & ResourceAccessPermission]  # type: ignore
+
+    @property
+    def resource_server_actions(self):
+        """Get resource_server_actions from settings."""
+        return self._get_resource_server_actions("document_access")
+
+
+class ResourceServerInvitationViewSet(
+    ResourceServerRestrictionMixin, InvitationViewset
+):
+    """Resource Server Viewset for Invitations."""
+
+    authentication_classes = [ResourceServerAuthentication]
+
+    permission_classes = [
+        ResourceServerClientPermission & CanCreateInvitationPermission
+    ]
+
+    @property
+    def resource_server_actions(self):
+        """Get resource_server_actions from settings."""
+        return self._get_resource_server_actions("document_invitation")
+
+
+class ResourceServerUserViewSet(ResourceServerRestrictionMixin, UserViewSet):
+    """Resource Server Viewset for User."""
+
+    authentication_classes = [ResourceServerAuthentication]
+
+    permission_classes = [ResourceServerClientPermission & IsSelf]  # type: ignore
+
+    @property
+    def resource_server_actions(self):
+        """Get resource_server_actions from settings."""
+        return self._get_resource_server_actions("users")