# python-service-scan-authz-baseline

An [Agent Skill](https://agentskills.io) that scans a Python microservice for existing
authentication/authorization patterns and generates a prioritized migration plan for adding
[Permissions Platform](https://github.com/theorchard/ows-pdp) (PP) authorization checks.

## What it does

Given a Python microservice repo, the skill:

1. Detects how `flask_request.setup` is configured — whether `access_rules` enforcement is active, logging-only, or disabled entirely
2. Parses `access_rules.yml` and maps each rule to the routes it covers
3. Finds inline `verify_grass_access` / `verify_grass_headers` calls
4. Identifies other auth patterns (`only_for_identity`, JWT checks, `PdpAuthorizationBackend`)
5. Classifies every endpoint's current auth posture and flags coverage gaps
6. Produces a **two-phase migration plan**:
   - **Phase 1** — integration tests that capture current access behavior as a baseline
   - **Phase 2** — endpoint-by-endpoint PP authorization checks using `python-pdp-sdk`

## When to use it

- Before touching any code on a service being onboarded to PP
- To get a prioritized list of endpoints needing PP checks, ordered by migration risk
- To scaffold pseudocode and helpers for a specific service before opening a PR

## Related skills

Use these pp-pilot `skills` alongside this `python-service-scan-authz-baseline` skill in the following order or relevance:

| Skill | Purpose |
|-------|---------|
| [`endpoint-resource-action-pp-authorization-table`](../endpoint-resource-action-pp-authorization-table/SKILL.md) | Generate the CSV mapping endpoints → `resource_type` / `action` / `proposed_roles` |
| [`python-microservice-add-owsclient`](../python-microservice-add-owsclient/SKILL.md) | Set up `OwsClient` (prerequisite for the backend) |
| [`python-microservice-add-authorization-backend`](../python-microservice-add-authorization-backend/SKILL.md) | Wire `PdpAuthorizationBackend` into a Flask or FastAPI service |

## Files

```
SKILL.md          ← skill instructions read by the agent
Makefile          ← eval runner targets
evals/
├── README.md     ← eval methodology and usage
├── evals.json    ← test cases and assertions
├── files/        ← synthetic fixture services used as eval inputs
│   ├── ows-catalog/       (fully enforced access_rules)
│   ├── ows-releases/      (enforcement disabled despite rules file)
│   ├── ows-media/         (no legacy auth; PP backend already wired)
│   └── ows-content/       (config-variable enforcement + mixed patterns)
└── runner/
    ├── run_evals.py       ← LangGraph-based eval orchestrator + grader
    └── requirements.txt
```

## Running evals

```bash
# GitHub Models (default) — requires a fine-grained PAT with Models → Read-only
# Create at: github.com → Settings → Developer settings → Fine-grained tokens
export GITHUB_MODEL_API_TOKEN=github_pat_...
make eval              # all cases, with- and without-skill, grade, benchmark
make eval-skill-only   # with-skill only (faster for iterating)
make grade             # re-grade existing outputs without re-running agents

# Anthropic / Claude
export ANTHROPIC_API_KEY=sk-...
make eval-claude
```

See [`evals/README.md`](evals/README.md) for the full methodology.