fractal-server 2.16.6__py3-none-any.whl → 2.17.0__py3-none-any.whl

fractal_server/app/routes/api/v2/_aux_functions_tasks.py

@@ -12,11 +12,17 @@ from fractal_server.app.db import AsyncSession
 from fractal_server.app.models import LinkUserGroup
 from fractal_server.app.models import UserGroup
 from fractal_server.app.models import UserOAuth
+from fractal_server.app.models.v2 import Profile
 from fractal_server.app.models.v2 import TaskGroupActivityV2
 from fractal_server.app.models.v2 import TaskGroupV2
 from fractal_server.app.models.v2 import TaskV2
 from fractal_server.app.models.v2 import WorkflowTaskV2
-from fractal_server.app.routes.auth._aux_auth import _get_default_usergroup_id
+from fractal_server.app.routes.api.v2._aux_functions import (
+    _get_user_resource_id,
+)
+from fractal_server.app.routes.auth._aux_auth import (
+    _get_default_usergroup_id_or_none,
+)
 from fractal_server.app.routes.auth._aux_auth import (
     _verify_user_belongs_to_group,
 )
@@ -33,7 +39,7 @@ async def _get_task_group_or_404(
     """
     Get an existing task group or raise a 404.
 
-    Arguments:
+    Args:
         task_group_id: The TaskGroupV2 id
         db: An asynchronous db session
     """
@@ -55,7 +61,7 @@ async def _get_task_group_read_access(
     """
     Get a task group or raise a 403 if user has no read access.
 
-    Arguments:
+    Args:
         task_group_id: ID of the required task group.
         user_id: ID of the current user.
         db: An asynchronous db session.
@@ -69,7 +75,7 @@ async def _get_task_group_read_access(
         status_code=status.HTTP_403_FORBIDDEN,
         detail=(
             "Current user has no read access to TaskGroupV2 "
-            f"{task_group_id}.",
+            f"{task_group_id}."
         ),
     )
 
@@ -80,11 +86,16 @@ async def _get_task_group_read_access(
     else:
         stm = (
             select(LinkUserGroup)
+            .join(UserOAuth)
+            .join(Profile)
             .where(LinkUserGroup.group_id == task_group.user_group_id)
             .where(LinkUserGroup.user_id == user_id)
+            .where(UserOAuth.id == user_id)
+            .where(Profile.id == UserOAuth.profile_id)
+            .where(task_group.resource_id == Profile.resource_id)
         )
         res = await db.execute(stm)
-        link = res.scalar_one_or_none()
+        link = res.unique().scalars().one_or_none()
         if link is None:
             raise forbidden_exception
         else:
@@ -100,7 +111,7 @@ async def _get_task_group_full_access(
     """
     Get a task group or raise a 403 if user has no full access.
 
-    Arguments:
+    Args:
         task_group_id: ID of the required task group.
         user_id: ID of the current user.
         db: An asynchronous db session
@@ -125,7 +136,7 @@ async def _get_task_or_404(*, task_id: int, db: AsyncSession) -> TaskV2:
     """
     Get an existing task or raise a 404.
 
-    Arguments:
+    Args:
         task_id: ID of the required task.
         db: An asynchronous db session
     """
@@ -147,15 +158,23 @@ async def _get_task_full_access(
     """
     Get an existing task or raise a 404.
 
-    Arguments:
+    Args:
         task_id: ID of the required task.
         user_id: ID of the current user.
         db: An asynchronous db session.
     """
     task = await _get_task_or_404(task_id=task_id, db=db)
-    await _get_task_group_full_access(
+    task_group = await _get_task_group_full_access(
         task_group_id=task.taskgroupv2_id, user_id=user_id, db=db
     )
+
+    resource_id = await _get_user_resource_id(user_id=user_id, db=db)
+    if resource_id is None or resource_id != task_group.resource_id:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail=f"User {user_id} has no access to TaskGroup's Resource.",
+        )
+
     return task
 
 
@@ -169,7 +188,7 @@ async def _get_task_read_access(
     """
     Get an existing task or raise a 404.
 
-    Arguments:
+    Args:
         task_id: ID of the required task.
         user_id: ID of the current user.
         db: An asynchronous db session.
@@ -179,12 +198,20 @@ async def _get_task_read_access(
     task_group = await _get_task_group_read_access(
         task_group_id=task.taskgroupv2_id, user_id=user_id, db=db
     )
-    if require_active:
-        if not task_group.active:
-            raise HTTPException(
-                status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
-                detail=f"Error: task {task_id} ({task.name}) is not active.",
-            )
+
+    resource_id = await _get_user_resource_id(user_id=user_id, db=db)
+    if resource_id is None or resource_id != task_group.resource_id:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail=f"User {user_id} has no access to TaskGroup's Resource.",
+        )
+
+    if require_active and not task_group.active:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+            detail=f"Error: task {task_id} ({task.name}) is not active.",
+        )
+
     return task
 
 
@@ -198,7 +225,7 @@ async def _get_valid_user_group_id(
     """
     Validate query parameters for endpoints that create some task(s).
 
-    Arguments:
+    Args:
         user_group_id:
         private:
         user_id: ID of the current user
@@ -212,7 +239,7 @@ async def _get_valid_user_group_id(
     elif private is True:
         user_group_id = None
     elif user_group_id is None:
-        user_group_id = await _get_default_usergroup_id(db=db)
+        user_group_id = await _get_default_usergroup_id_or_none(db=db)
     else:
         await _verify_user_belongs_to_group(
             user_id=user_id, user_group_id=user_group_id, db=db
@@ -255,16 +282,19 @@ async def _get_collection_task_group_activity_status_message(
 
 
 async def _verify_non_duplication_user_constraint(
+    *,
     db: AsyncSession,
     user_id: int,
     pkg_name: str,
     version: str | None,
+    user_resource_id: int,
 ):
     stm = (
         select(TaskGroupV2)
         .where(TaskGroupV2.user_id == user_id)
         .where(TaskGroupV2.pkg_name == pkg_name)
         .where(TaskGroupV2.version == version)
+        .where(TaskGroupV2.resource_id == user_resource_id)
     )
     res = await db.execute(stm)
     duplicate = res.scalars().all()
@@ -342,7 +372,9 @@ async def _verify_non_duplication_group_constraint(
 
 
 async def _verify_non_duplication_group_path(
+    *,
     path: str | None,
+    resource_id: int,
     db: AsyncSession,
 ) -> None:
     """
@@ -350,7 +382,11 @@ async def _verify_non_duplication_group_path(
     """
     if path is None:
         return
-    stm = select(TaskGroupV2.id).where(TaskGroupV2.path == path)
+    stm = (
+        select(TaskGroupV2.id)
+        .where(TaskGroupV2.path == path)
+        .where(TaskGroupV2.resource_id == resource_id)
+    )
     res = await db.execute(stm)
     duplicate_ids = res.scalars().all()
     if duplicate_ids:

fractal_server/app/routes/api/v2/_aux_task_group_disambiguation.py

@@ -5,8 +5,10 @@ from sqlmodel import select
 from fractal_server.app.db import AsyncSession
 from fractal_server.app.models import LinkUserGroup
 from fractal_server.app.models.v2 import TaskGroupV2
+from fractal_server.config import get_settings
 from fractal_server.exceptions import UnreachableBranchError
 from fractal_server.logger import set_logger
+from fractal_server.syringe import Inject
 
 
 logger = set_logger(__name__)
@@ -16,7 +18,7 @@ async def _disambiguate_task_groups(
     *,
     matching_task_groups: list[TaskGroupV2],
     user_id: int,
-    default_group_id: int,
+    default_group_id: int | None,
     db: AsyncSession,
 ) -> TaskGroupV2 | None:
     """
@@ -49,21 +51,23 @@ async def _disambiguate_task_groups(
         )
 
     # Medium priority: task groups owned by default user group
+    settings = Inject(get_settings)
     list_user_group_ids = [tg.user_group_id for tg in matching_task_groups]
-    try:
-        ind_user_group_id = list_user_group_ids.index(default_group_id)
-        task_group = matching_task_groups[ind_user_group_id]
-        logger.debug(
-            "[_disambiguate_task_groups] "
-            f"Found task group {task_group.id} with {user_id=}, return."
-        )
-        return task_group
-    except ValueError:
-        logger.debug(
-            "[_disambiguate_task_groups] "
-            "No task group with user_group_id="
-            f"{default_group_id}, continue."
-        )
+    if settings.FRACTAL_DEFAULT_GROUP_NAME is not None:
+        try:
+            ind_user_group_id = list_user_group_ids.index(default_group_id)
+            task_group = matching_task_groups[ind_user_group_id]
+            logger.debug(
+                "[_disambiguate_task_groups] "
+                f"Found task group {task_group.id} with {user_id=}, return."
+            )
+            return task_group
+        except ValueError:
+            logger.debug(
+                "[_disambiguate_task_groups] "
+                "No task group with user_group_id="
+                f"{default_group_id}, continue."
+            )
 
     # Lowest priority: task groups owned by other groups, sorted
     # according to age of the user/usergroup link
@@ -97,7 +101,7 @@ async def _disambiguate_task_groups_not_none(
     *,
     matching_task_groups: list[TaskGroupV2],
     user_id: int,
-    default_group_id: int,
+    default_group_id: int | None,
     db: AsyncSession,
 ) -> TaskGroupV2:
     """
@@ -133,7 +137,7 @@ async def remove_duplicate_task_groups(
     *,
     task_groups: list[TaskGroupV2],
     user_id: int,
-    default_group_id: int,
+    default_group_id: int | None,
     db: AsyncSession,
 ) -> list[TaskGroupV2]:
     """

fractal_server/app/routes/api/v2/dataset.py

@@ -19,7 +19,7 @@ from ._aux_functions import _get_dataset_check_owner
 from ._aux_functions import _get_project_check_owner
 from ._aux_functions import _get_submitted_jobs_statement
 from fractal_server.app.models import UserOAuth
-from fractal_server.app.routes.auth import current_active_user
+from fractal_server.app.routes.auth import current_user_act_ver_prof
 from fractal_server.string_tools import sanitize_string
 from fractal_server.urls import normalize_url
 
@@ -34,7 +34,7 @@ router = APIRouter()
 async def create_dataset(
     project_id: int,
     dataset: DatasetCreateV2,
-    user: UserOAuth = Depends(current_active_user),
+    user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
 ) -> DatasetReadV2 | None:
     """
@@ -45,15 +45,6 @@ async def create_dataset(
     )
 
     if dataset.zarr_dir is None:
-        if user.settings.project_dir is None:
-            raise HTTPException(
-                status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
-                detail=(
-                    "Both 'dataset.zarr_dir' and 'user.settings.project_dir' "
-                    "are null"
-                ),
-            )
-
         db_dataset = DatasetV2(
             project_id=project_id,
             zarr_dir="__PLACEHOLDER__",
@@ -63,7 +54,7 @@ async def create_dataset(
         await db.commit()
         await db.refresh(db_dataset)
         path = (
-            f"{user.settings.project_dir}/fractal/"
+            f"{user.project_dir}/fractal/"
             f"{project_id}_{sanitize_string(project.name)}/"
             f"{db_dataset.id}_{sanitize_string(db_dataset.name)}"
         )
@@ -88,7 +79,7 @@ async def create_dataset(
 )
 async def read_dataset_list(
     project_id: int,
-    user: UserOAuth = Depends(current_active_user),
+    user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
 ) -> list[DatasetReadV2] | None:
     """
@@ -116,7 +107,7 @@ async def read_dataset_list(
 async def read_dataset(
     project_id: int,
     dataset_id: int,
-    user: UserOAuth = Depends(current_active_user),
+    user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
 ) -> DatasetReadV2 | None:
     """
@@ -141,7 +132,7 @@ async def update_dataset(
     project_id: int,
     dataset_id: int,
     dataset_update: DatasetUpdateV2,
-    user: UserOAuth = Depends(current_active_user),
+    user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
 ) -> DatasetReadV2 | None:
     """
@@ -181,7 +172,7 @@ async def update_dataset(
 async def delete_dataset(
     project_id: int,
     dataset_id: int,
-    user: UserOAuth = Depends(current_active_user),
+    user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
 ) -> Response:
     """
@@ -219,7 +210,7 @@ async def delete_dataset(
 
 @router.get("/dataset/", response_model=list[DatasetReadV2])
 async def get_user_datasets(
-    user: UserOAuth = Depends(current_active_user),
+    user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
 ) -> list[DatasetReadV2]:
     """
@@ -243,7 +234,7 @@ async def get_user_datasets(
 async def export_dataset(
     project_id: int,
     dataset_id: int,
-    user: UserOAuth = Depends(current_active_user),
+    user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
 ) -> DatasetExportV2 | None:
     """
@@ -270,7 +261,7 @@ async def export_dataset(
 async def import_dataset(
     project_id: int,
     dataset: DatasetImportV2,
-    user: UserOAuth = Depends(current_active_user),
+    user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
 ) -> DatasetReadV2 | None:
     """

fractal_server/app/routes/api/v2/history.py

@@ -23,7 +23,7 @@ from fractal_server.app.models.v2 import HistoryImageCache
 from fractal_server.app.models.v2 import HistoryRun
 from fractal_server.app.models.v2 import HistoryUnit
 from fractal_server.app.models.v2 import TaskV2
-from fractal_server.app.routes.auth import current_active_user
+from fractal_server.app.routes.auth import current_user_act_ver_prof
 from fractal_server.app.routes.pagination import get_pagination_params
 from fractal_server.app.routes.pagination import PaginationRequest
 from fractal_server.app.routes.pagination import PaginationResponse
@@ -68,7 +68,7 @@ async def get_workflow_tasks_statuses(
     project_id: int,
     dataset_id: int,
     workflow_id: int,
-    user: UserOAuth = Depends(current_active_user),
+    user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
 ) -> JSONResponse:
     # Access control
@@ -179,7 +179,7 @@ async def get_history_run_list(
     project_id: int,
     dataset_id: int,
     workflowtask_id: int,
-    user: UserOAuth = Depends(current_active_user),
+    user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
 ) -> list[HistoryRunReadAggregated]:
     # Access control
@@ -271,7 +271,7 @@ async def get_history_run_units(
     workflowtask_id: int,
     history_run_id: int,
     unit_status: HistoryUnitStatus | None = None,
-    user: UserOAuth = Depends(current_active_user),
+    user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
     pagination: PaginationRequest = Depends(get_pagination_params),
 ) -> PaginationResponse[HistoryUnitRead]:
@@ -330,7 +330,7 @@ async def get_history_images(
     dataset_id: int,
     workflowtask_id: int,
     request_body: ImageQuery,
-    user: UserOAuth = Depends(current_active_user),
+    user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
     pagination: PaginationRequest = Depends(get_pagination_params),
 ) -> ImagePage:
@@ -412,7 +412,7 @@ async def get_history_images(
 async def get_image_log(
     project_id: int,
     request_data: ImageLogsRequest,
-    user: UserOAuth = Depends(current_active_user),
+    user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
 ) -> JSONResponse:
     # Access control
@@ -460,7 +460,7 @@ async def get_history_unit_log(
     history_unit_id: int,
     workflowtask_id: int,
     dataset_id: int,
-    user: UserOAuth = Depends(current_active_user),
+    user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
 ) -> JSONResponse:
     # Access control
@@ -508,7 +508,7 @@ async def get_history_unit_log(
 async def get_dataset_history(
     project_id: int,
     dataset_id: int,
-    user: UserOAuth = Depends(current_active_user),
+    user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
 ) -> list[HistoryRunRead]:
     """

fractal_server/app/routes/api/v2/images.py

@@ -13,7 +13,7 @@ from fractal_server.app.db import AsyncSession
 from fractal_server.app.db import get_async_db
 from fractal_server.app.models import HistoryImageCache
 from fractal_server.app.models import UserOAuth
-from fractal_server.app.routes.auth import current_active_user
+from fractal_server.app.routes.auth import current_user_act_ver_prof
 from fractal_server.app.routes.pagination import get_pagination_params
 from fractal_server.app.routes.pagination import PaginationRequest
 from fractal_server.app.routes.pagination import PaginationResponse
@@ -60,7 +60,7 @@ async def post_new_image(
     project_id: int,
     dataset_id: int,
     new_image: SingleImage,
-    user: UserOAuth = Depends(current_active_user),
+    user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
 ) -> Response:
     output = await _get_dataset_check_owner(
@@ -112,7 +112,7 @@ async def query_dataset_images(
     dataset_id: int,
     query: ImageQueryWithZarrUrl | None = None,
     pagination: PaginationRequest = Depends(get_pagination_params),
-    user: UserOAuth = Depends(current_active_user),
+    user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
 ) -> ImagePage:
     page = pagination.page
@@ -183,7 +183,7 @@ async def delete_dataset_images(
     project_id: int,
     dataset_id: int,
     zarr_url: str,
-    user: UserOAuth = Depends(current_active_user),
+    user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
 ) -> Response:
     output = await _get_dataset_check_owner(
@@ -227,7 +227,7 @@ async def patch_dataset_image(
     project_id: int,
     dataset_id: int,
     image_update: SingleImageUpdate,
-    user: UserOAuth = Depends(current_active_user),
+    user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
 ):
     output = await _get_dataset_check_owner(

fractal_server/app/routes/api/v2/job.py

@@ -23,7 +23,7 @@ from ._aux_functions import _get_job_check_owner
 from ._aux_functions import _get_project_check_owner
 from ._aux_functions import _get_workflow_check_owner
 from fractal_server.app.models import UserOAuth
-from fractal_server.app.routes.auth import current_active_user
+from fractal_server.app.routes.auth import current_user_act_ver_prof
 from fractal_server.runner.filenames import WORKFLOW_LOG_FILENAME
 
 
@@ -39,7 +39,7 @@ router = APIRouter()
 
 @router.get("/job/", response_model=list[JobReadV2])
 async def get_user_jobs(
-    user: UserOAuth = Depends(current_active_user),
+    user: UserOAuth = Depends(current_user_act_ver_prof),
     log: bool = True,
     db: AsyncSession = Depends(get_async_db),
 ) -> list[JobReadV2]:
@@ -68,7 +68,7 @@ async def get_user_jobs(
 async def get_workflow_jobs(
     project_id: int,
     workflow_id: int,
-    user: UserOAuth = Depends(current_active_user),
+    user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
 ) -> list[JobReadV2] | None:
     """
@@ -88,7 +88,7 @@ async def get_latest_job(
     project_id: int,
     workflow_id: int,
     dataset_id: int,
-    user: UserOAuth = Depends(current_active_user),
+    user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
 ) -> JobReadV2:
     await _get_workflow_check_owner(
@@ -120,7 +120,7 @@ async def read_job(
     project_id: int,
     job_id: int,
     show_tmp_logs: bool = False,
-    user: UserOAuth = Depends(current_active_user),
+    user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
 ) -> JobReadV2 | None:
     """
@@ -153,7 +153,7 @@ async def read_job(
 async def download_job_logs(
     project_id: int,
     job_id: int,
-    user: UserOAuth = Depends(current_active_user),
+    user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
 ) -> StreamingResponse:
     """
@@ -183,7 +183,7 @@ async def download_job_logs(
 )
 async def get_job_list(
     project_id: int,
-    user: UserOAuth = Depends(current_active_user),
+    user: UserOAuth = Depends(current_user_act_ver_prof),
     log: bool = True,
     db: AsyncSession = Depends(get_async_db),
 ) -> list[JobReadV2] | None:
@@ -212,7 +212,7 @@ async def get_job_list(
 async def stop_job(
     project_id: int,
     job_id: int,
-    user: UserOAuth = Depends(current_active_user),
+    user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
 ) -> Response:
     """

fractal_server/app/routes/api/v2/pre_submission_checks.py

@@ -11,7 +11,7 @@ from .images import ImageQuery
 from fractal_server.app.db import AsyncSession
 from fractal_server.app.db import get_async_db
 from fractal_server.app.models import UserOAuth
-from fractal_server.app.routes.auth import current_active_user
+from fractal_server.app.routes.auth import current_user_act_ver_prof
 from fractal_server.app.schemas.v2 import HistoryUnitStatus
 from fractal_server.app.schemas.v2 import TaskType
 from fractal_server.images.status_tools import enrich_images_unsorted_async
@@ -32,7 +32,7 @@ async def verify_unique_types(
     dataset_id: int,
     workflowtask_id: int,
     query: ImageQuery | None = None,
-    user: UserOAuth = Depends(current_active_user),
+    user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
 ) -> list[str]:
     # Get dataset
@@ -93,7 +93,7 @@ async def check_non_processed_images(
     workflow_id: int,
     workflowtask_id: int,
     filters: NonProcessedImagesPayload,
-    user: UserOAuth = Depends(current_active_user),
+    user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
 ) -> JSONResponse:
     db_workflow_task, db_workflow = await _get_workflow_task_check_owner(

fractal_server/app/routes/api/v2/project.py

@@ -15,18 +15,19 @@ from ....models.v2 import ProjectV2
 from ....schemas.v2 import ProjectCreateV2
 from ....schemas.v2 import ProjectReadV2
 from ....schemas.v2 import ProjectUpdateV2
+from ...aux.validate_user_profile import validate_user_profile
 from ._aux_functions import _check_project_exists
 from ._aux_functions import _get_project_check_owner
 from ._aux_functions import _get_submitted_jobs_statement
 from fractal_server.app.models import UserOAuth
-from fractal_server.app.routes.auth import current_active_user
+from fractal_server.app.routes.auth import current_user_act_ver_prof
 
 router = APIRouter()
 
 
 @router.get("/project/", response_model=list[ProjectReadV2])
 async def get_list_project(
-    user: UserOAuth = Depends(current_active_user),
+    user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
 ) -> list[ProjectV2]:
     """
@@ -46,19 +47,26 @@ async def get_list_project(
 @router.post("/project/", response_model=ProjectReadV2, status_code=201)
 async def create_project(
     project: ProjectCreateV2,
-    user: UserOAuth = Depends(current_active_user),
+    user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
 ) -> ProjectReadV2 | None:
     """
     Create new project
     """
 
+    # Get validated resource and profile
+    resource, profile = await validate_user_profile(
+        user=user,
+        db=db,
+    )
+    resource_id = resource.id
+
     # Check that there is no project with the same user and name
     await _check_project_exists(
         project_name=project.name, user_id=user.id, db=db
     )
 
-    db_project = ProjectV2(**project.model_dump())
+    db_project = ProjectV2(**project.model_dump(), resource_id=resource_id)
     db_project.user_list.append(user)
 
     db.add(db_project)
@@ -72,7 +80,7 @@ async def create_project(
 @router.get("/project/{project_id}/", response_model=ProjectReadV2)
 async def read_project(
     project_id: int,
-    user: UserOAuth = Depends(current_active_user),
+    user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
 ) -> ProjectReadV2 | None:
     """
@@ -89,7 +97,7 @@ async def read_project(
 async def update_project(
     project_id: int,
     project_update: ProjectUpdateV2,
-    user: UserOAuth = Depends(current_active_user),
+    user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
 ):
     project = await _get_project_check_owner(
@@ -114,7 +122,7 @@ async def update_project(
 @router.delete("/project/{project_id}/", status_code=204)
 async def delete_project(
     project_id: int,
-    user: UserOAuth = Depends(current_active_user),
+    user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
 ) -> Response:
     """

fractal_server/app/routes/api/v2/status_legacy.py

@@ -13,7 +13,7 @@ from ._aux_functions import _get_dataset_check_owner
 from ._aux_functions import _get_submitted_jobs_statement
 from ._aux_functions import _get_workflow_check_owner
 from fractal_server.app.models import UserOAuth
-from fractal_server.app.routes.auth import current_active_user
+from fractal_server.app.routes.auth import current_user_act_ver_prof
 
 router = APIRouter()
 
@@ -28,7 +28,7 @@ async def get_workflowtask_status(
     project_id: int,
     dataset_id: int,
     workflow_id: int,
-    user: UserOAuth = Depends(current_active_user),
+    user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
 ) -> LegacyStatusReadV2 | None:
     """