fractal-server 2.17.0a4__py3-none-any.whl → 2.17.0a5__py3-none-any.whl

fractal_server/app/routes/auth/users.py

@@ -12,22 +12,18 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from sqlmodel import func
 from sqlmodel import select
 
-from . import current_active_superuser
+from . import current_superuser_act
 from ...db import get_async_db
 from ...schemas.user import UserRead
 from ...schemas.user import UserUpdate
-from ..aux.validate_user_settings import verify_user_has_settings
 from ._aux_auth import _get_default_usergroup_id
 from ._aux_auth import _get_single_user_with_groups
 from ._aux_auth import FRACTAL_DEFAULT_GROUP_NAME
 from fractal_server.app.models import LinkUserGroup
 from fractal_server.app.models import UserGroup
 from fractal_server.app.models import UserOAuth
-from fractal_server.app.models import UserSettings
 from fractal_server.app.models.v2 import Profile
 from fractal_server.app.routes.auth._aux_auth import _user_or_404
-from fractal_server.app.schemas import UserSettingsRead
-from fractal_server.app.schemas import UserSettingsUpdate
 from fractal_server.app.schemas.user import UserUpdateGroups
 from fractal_server.app.security import get_user_manager
 from fractal_server.app.security import UserManager
@@ -43,7 +39,7 @@ logger = set_logger(__name__)
 async def get_user(
     user_id: int,
     group_ids_names: bool = True,
-    superuser: UserOAuth = Depends(current_active_superuser),
+    superuser: UserOAuth = Depends(current_superuser_act),
     db: AsyncSession = Depends(get_async_db),
 ) -> UserRead:
     user = await _user_or_404(user_id, db)
@@ -57,7 +53,7 @@ async def get_user(
 async def patch_user(
     user_id: int,
     user_update: UserUpdate,
-    current_superuser: UserOAuth = Depends(current_active_superuser),
+    current_superuser: UserOAuth = Depends(current_superuser_act),
     user_manager: UserManager = Depends(get_user_manager),
     db: AsyncSession = Depends(get_async_db),
 ):
@@ -113,7 +109,7 @@ async def patch_user(
 @router_users.get("/users/", response_model=list[UserRead])
 async def list_users(
     profile_id: int | None = None,
-    user: UserOAuth = Depends(current_active_superuser),
+    user: UserOAuth = Depends(current_superuser_act),
     db: AsyncSession = Depends(get_async_db),
 ):
     """
@@ -148,7 +144,7 @@ async def list_users(
 async def set_user_groups(
     user_id: int,
     user_update: UserUpdateGroups,
-    superuser: UserOAuth = Depends(current_active_superuser),
+    superuser: UserOAuth = Depends(current_superuser_act),
     db: AsyncSession = Depends(get_async_db),
 ) -> UserRead:
     # Preliminary check that all objects exist in the db
@@ -210,40 +206,3 @@ async def set_user_groups(
     user_with_groups = await _get_single_user_with_groups(user, db)
 
     return user_with_groups
-
-
-@router_users.get(
-    "/users/{user_id}/settings/", response_model=UserSettingsRead
-)
-async def get_user_settings(
-    user_id: int,
-    superuser: UserOAuth = Depends(current_active_superuser),
-    db: AsyncSession = Depends(get_async_db),
-) -> UserSettingsRead:
-    user = await _user_or_404(user_id=user_id, db=db)
-    verify_user_has_settings(user)
-    user_settings = await db.get(UserSettings, user.user_settings_id)
-    return user_settings
-
-
-@router_users.patch(
-    "/users/{user_id}/settings/", response_model=UserSettingsRead
-)
-async def patch_user_settings(
-    user_id: int,
-    settings_update: UserSettingsUpdate,
-    superuser: UserOAuth = Depends(current_active_superuser),
-    db: AsyncSession = Depends(get_async_db),
-) -> UserSettingsRead:
-    user = await _user_or_404(user_id=user_id, db=db)
-    verify_user_has_settings(user)
-    user_settings = await db.get(UserSettings, user.user_settings_id)
-
-    for k, v in settings_update.model_dump(exclude_unset=True).items():
-        setattr(user_settings, k, v)
-
-    db.add(user_settings)
-    await db.commit()
-    await db.refresh(user_settings)
-
-    return user_settings

fractal_server/app/schemas/__init__.py

@@ -1,3 +1,2 @@
 from .user import *  # noqa: F401, F403
 from .user_group import *  # noqa: F401, F403
-from .user_settings import *  # noqa: F401, F403

fractal_server/app/schemas/user.py

@@ -1,9 +1,15 @@
+from typing import Annotated
+
 from fastapi_users import schemas
+from pydantic import AfterValidator
 from pydantic import BaseModel
 from pydantic import ConfigDict
 from pydantic import EmailStr
 from pydantic import Field
 
+from fractal_server.string_tools import validate_cmd
+from fractal_server.types import AbsolutePathStr
+from fractal_server.types import ListUniqueNonEmptyString
 from fractal_server.types import ListUniqueNonNegativeInt
 from fractal_server.types import NonEmptyStr
 
@@ -37,6 +43,13 @@ class UserRead(schemas.BaseUser[int]):
     group_ids_names: list[tuple[int, str]] | None = None
     oauth_accounts: list[OAuthAccountRead]
     profile_id: int | None = None
+    project_dir: str
+    slurm_accounts: list[str]
+
+
+def _validate_cmd(value: str) -> str:
+    validate_cmd(value)
+    return value
 
 
 class UserUpdate(schemas.BaseUserUpdate):
@@ -50,6 +63,8 @@ class UserUpdate(schemas.BaseUserUpdate):
         is_superuser:
         is_verified:
         profile_id:
+        project_dir:
+        slurm_accounts:
     """
 
     model_config = ConfigDict(extra="forbid")
@@ -59,6 +74,10 @@ class UserUpdate(schemas.BaseUserUpdate):
     is_superuser: bool = None
     is_verified: bool = None
     profile_id: int | None = None
+    project_dir: Annotated[
+        AbsolutePathStr, AfterValidator(_validate_cmd)
+    ] | None = None
+    slurm_accounts: ListUniqueNonEmptyString | None = None
 
 
 class UserUpdateStrict(BaseModel):
@@ -66,9 +85,11 @@ class UserUpdateStrict(BaseModel):
     Schema for `User` self-editing.
 
     Attributes:
+        slurm_accounts:
     """
 
     model_config = ConfigDict(extra="forbid")
+    slurm_accounts: ListUniqueNonEmptyString | None = None
 
 
 class UserCreate(schemas.BaseUserCreate):
@@ -80,6 +101,8 @@ class UserCreate(schemas.BaseUserCreate):
     """
 
     profile_id: int | None = None
+    project_dir: Annotated[AbsolutePathStr, AfterValidator(_validate_cmd)]
+    slurm_accounts: list[str] = Field(default_factory=list)
 
 
 class UserUpdateGroups(BaseModel):

fractal_server/app/schemas/v2/task_group.py

@@ -37,6 +37,7 @@ class TaskGroupActivityActionV2(StrEnum):
 class TaskGroupCreateV2(BaseModel):
     model_config = ConfigDict(extra="forbid")
     user_id: int
+    resource_id: int
     user_group_id: int | None = None
     active: bool = True
     origin: TaskGroupV2OriginEnum

fractal_server/app/security/__init__.py

@@ -1,14 +1,3 @@
-# Copyright 2022 (C) Friedrich Miescher Institute for Biomedical Research and
-# University of Zurich
-#
-# Original authors:
-# Jacopo Nespolo <jacopo.nespolo@exact-lab.it>
-# Tommaso Comparin <tommaso.comparin@exact-lab.it>
-#
-# This file is part of Fractal and was originally developed by eXact lab S.r.l.
-# <exact-lab.it> under contract with Liberali Lab from the Friedrich Miescher
-# Institute for Biomedical Research and Pelkmans Lab from the University of
-# Zurich.
 """
 Auth subsystem
 
@@ -30,6 +19,7 @@ import contextlib
 from collections.abc import AsyncGenerator
 from typing import Any
 from typing import Generic
+from typing import Self
 
 from fastapi import Depends
 from fastapi import Request
@@ -55,10 +45,12 @@ from fractal_server.app.models import LinkUserGroup
 from fractal_server.app.models import OAuthAccount
 from fractal_server.app.models import UserGroup
 from fractal_server.app.models import UserOAuth
-from fractal_server.app.models import UserSettings
 from fractal_server.app.schemas.user import UserCreate
-from fractal_server.app.security.signup_email import mail_new_oauth_signup
+from fractal_server.app.security.signup_email import (
+    send_fractal_email_or_log_failure,
+)
 from fractal_server.config import get_email_settings
+from fractal_server.config import get_settings
 from fractal_server.logger import set_logger
 from fractal_server.syringe import Inject
 
@@ -209,6 +201,131 @@ class UserManager(IntegerIDMixin, BaseUserManager[UserOAuth, int]):
                 f"The password is too long (maximum length: {min_length})."
             )
 
+    async def oauth_callback(
+        self: Self,
+        oauth_name: str,
+        access_token: str,
+        account_id: str,
+        account_email: str,
+        expires_at: int | None = None,
+        refresh_token: str | None = None,
+        request: Request | None = None,
+        *,
+        associate_by_email: bool = False,
+        is_verified_by_default: bool = False,
+    ) -> UserOAuth:
+        """
+        Handle the callback after a successful OAuth authentication.
+
+        This method extends the corresponding `BaseUserManager` method of
+        > fastapi-users v14.0.1, Copyright (c) 2019 François Voron, MIT License
+
+        If the user already exists with this OAuth account, the token is
+        updated.
+
+        If a user with the same e-mail already exists and `associate_by_email`
+        is True, the OAuth account is associated to this user.
+        Otherwise, the `UserNotExists` exception is raised.
+
+        If the user does not exist, send an email to the Fractal admins (if
+        configured) and respond with a 400 error status. NOTE: This is the
+        function branch where the `fractal-server` implementation deviates
+        from the original `fastapi-users` one.
+
+        :param oauth_name: Name of the OAuth client.
+        :param access_token: Valid access token for the service provider.
+        :param account_id: models.ID of the user on the service provider.
+        :param account_email: E-mail of the user on the service provider.
+        :param expires_at: Optional timestamp at which the access token
+        expires.
+        :param refresh_token: Optional refresh token to get a
+        fresh access token from the service provider.
+        :param request: Optional FastAPI request that
+        triggered the operation, defaults to None
+        :param associate_by_email: If True, any existing user with the same
+        e-mail address will be associated to this user. Defaults to False.
+        :param is_verified_by_default: If True, the `is_verified` flag will be
+        set to `True` on newly created user. Make sure the OAuth Provider you
+        are using does verify the email address before enabling this flag.
+        Defaults to False.
+        :return: A user.
+        """
+        from fastapi import HTTPException
+        from fastapi import status
+        from fastapi_users import exceptions
+
+        oauth_account_dict = {
+            "oauth_name": oauth_name,
+            "access_token": access_token,
+            "account_id": account_id,
+            "account_email": account_email,
+            "expires_at": expires_at,
+            "refresh_token": refresh_token,
+        }
+
+        try:
+            user = await self.get_by_oauth_account(oauth_name, account_id)
+        except exceptions.UserNotExists:
+            try:
+                # Associate account
+                user = await self.get_by_email(account_email)
+                if not associate_by_email:
+                    raise exceptions.UserAlreadyExists()
+                user = await self.user_db.add_oauth_account(
+                    user, oauth_account_dict
+                )
+            except exceptions.UserNotExists:
+                # (0) Log
+                logger.warning(
+                    f"Self-registration attempt by {account_email}."
+                )
+
+                # (1) Prepare user-facing error message
+                settings = Inject(get_settings)
+                error_msg = (
+                    "Thank you for registering for the Fractal service. "
+                    "Administrators have been informed to configure your "
+                    "account and will get back to you."
+                )
+                if settings.FRACTAL_HELP_URL is not None:
+                    error_msg = (
+                        f"{error_msg}\n"
+                        "You can find more information about the onboarding "
+                        f"process at {settings.FRACTAL_HELP_URL}."
+                    )
+
+                # (2) Send email to admins
+                email_settings = Inject(get_email_settings)
+                send_fractal_email_or_log_failure(
+                    subject="New OAuth self-registration",
+                    msg=(
+                        f"User '{account_email}' tried to "
+                        "self-register through OAuth.\n"
+                        "Please create the Fractal account manually.\n"
+                        "Here is the error message displayed to the "
+                        f"user:\n{error_msg}"
+                    ),
+                    email_settings=email_settings.public,
+                )
+
+                # (3) Raise
+                raise HTTPException(
+                    status_code=status.HTTP_400_BAD_REQUEST,
+                    detail=error_msg,
+                )
+        else:
+            # Update oauth
+            for existing_oauth_account in user.oauth_accounts:
+                if (
+                    existing_oauth_account.account_id == account_id
+                    and existing_oauth_account.oauth_name == oauth_name
+                ):
+                    user = await self.user_db.update_oauth_account(
+                        user, existing_oauth_account, oauth_account_dict
+                    )
+
+        return user
+
     async def on_after_register(
         self, user: UserOAuth, request: Request | None = None
     ):
@@ -216,7 +333,6 @@ class UserManager(IntegerIDMixin, BaseUserManager[UserOAuth, int]):
             f"New-user registration completed ({user.id=}, {user.email=})."
         )
         async for db in get_async_db():
-            # Find default group
             stm = select(UserGroup).where(
                 UserGroup.name == FRACTAL_DEFAULT_GROUP_NAME
             )
@@ -236,38 +352,6 @@ class UserManager(IntegerIDMixin, BaseUserManager[UserOAuth, int]):
                     f"Added {user.email} user to group {default_group.id=}."
                 )
 
-            this_user = await db.get(UserOAuth, user.id)
-
-            this_user.settings = UserSettings()
-            await db.merge(this_user)
-            await db.commit()
-            await db.refresh(this_user)
-            logger.info(
-                f"Associated empty settings (id={this_user.user_settings_id}) "
-                f"to '{this_user.email}'."
-            )
-
-            # Send mail section
-            email_settings = Inject(get_email_settings)
-
-            if this_user.oauth_accounts and email_settings.public is not None:
-                try:
-                    logger.info(
-                        "START sending email about new signup to "
-                        f"{email_settings.public.recipients}."
-                    )
-                    mail_new_oauth_signup(
-                        msg=f"New user registered: '{this_user.email}'.",
-                        email_settings=email_settings.public,
-                    )
-                    logger.info("END sending email about new signup.")
-                except Exception as e:
-                    logger.error(
-                        "ERROR sending notification email after oauth "
-                        f"registration of {this_user.email}. "
-                        f"Original error: '{e}'."
-                    )
-
 
 async def get_user_manager(
     user_db: SQLModelUserDatabaseAsync = Depends(get_user_db),
@@ -283,6 +367,8 @@ get_user_manager_context = contextlib.asynccontextmanager(get_user_manager)
 async def _create_first_user(
     email: str,
     password: str,
+    project_dir: str,
+    profile_id: int | None = None,
     is_superuser: bool = False,
     is_verified: bool = False,
 ) -> None:
@@ -331,6 +417,8 @@ async def _create_first_user(
                     kwargs = dict(
                         email=email,
                         password=password,
+                        project_dir=project_dir,
+                        profile_id=profile_id,
                         is_superuser=is_superuser,
                         is_verified=is_verified,
                     )

fractal_server/app/security/signup_email.py

@@ -2,47 +2,65 @@ import smtplib
 from email.message import EmailMessage
 from email.utils import formataddr
 
-from cryptography.fernet import Fernet
-
 from fractal_server.config import PublicEmailSettings
+from fractal_server.logger import set_logger
+
+logger = set_logger(__name__)
 
 
-def mail_new_oauth_signup(msg: str, email_settings: PublicEmailSettings):
+def send_fractal_email_or_log_failure(
+    *,
+    subject: str,
+    msg: str,
+    email_settings: PublicEmailSettings | None,
+):
     """
-    Send an email using the specified settings to notify a new OAuth signup.
+    Send an email using the specified settings, or log about failure.
     """
 
-    mail_msg = EmailMessage()
-    mail_msg.set_content(msg)
-    mail_msg["From"] = formataddr(
-        (email_settings.sender, email_settings.sender)
-    )
-    mail_msg["To"] = ", ".join(
-        [
-            formataddr((recipient, recipient))
-            for recipient in email_settings.recipients
-        ]
-    )
-    mail_msg[
-        "Subject"
-    ] = f"[Fractal, {email_settings.instance_name}] New OAuth signup"
+    if email_settings is None:
+        logger.error(
+            f"Cannot send email with {subject=}, because {email_settings=}."
+        )
 
-    with smtplib.SMTP(
-        email_settings.smtp_server, email_settings.port
-    ) as server:
-        server.ehlo()
-        if email_settings.use_starttls:
-            server.starttls()
+    try:
+        logger.info(f"START sending email with {subject=}.")
+        mail_msg = EmailMessage()
+        mail_msg.set_content(msg)
+        mail_msg["From"] = formataddr(
+            (email_settings.sender, email_settings.sender)
+        )
+        mail_msg["To"] = ", ".join(
+            [
+                formataddr((recipient, recipient))
+                for recipient in email_settings.recipients
+            ]
+        )
+        mail_msg[
+            "Subject"
+        ] = f"[Fractal, {email_settings.instance_name}] {subject}"
+        with smtplib.SMTP(
+            email_settings.smtp_server,
+            email_settings.port,
+        ) as server:
             server.ehlo()
-        if email_settings.use_login:
-            password = (
-                Fernet(email_settings.encryption_key.get_secret_value())
-                .decrypt(email_settings.encrypted_password.get_secret_value())
-                .decode("utf-8")
+            if email_settings.use_starttls:
+                server.starttls()
+                server.ehlo()
+            if email_settings.use_login:
+                server.login(
+                    user=email_settings.sender,
+                    password=email_settings.password.get_secret_value(),
+                )
+            server.sendmail(
+                from_addr=email_settings.sender,
+                to_addrs=email_settings.recipients,
+                msg=mail_msg.as_string(),
             )
-            server.login(user=email_settings.sender, password=password)
-        server.sendmail(
-            from_addr=email_settings.sender,
-            to_addrs=email_settings.recipients,
-            msg=mail_msg.as_string(),
+        logger.info(f"END sending email with {subject=}.")
+
+    except Exception as e:
+        logger.error(
+            "Could not send self-registration email, "
+            f"original error: {str(e)}."
         )

fractal_server/config/__init__.py

@@ -2,6 +2,7 @@ from ._database import DatabaseSettings
 from ._email import EmailSettings
 from ._email import PublicEmailSettings  # noqa F401
 from ._main import Settings
+from ._main import ViewerAuthScheme  # noqa F401
 from ._oauth import OAuthSettings
 
 

fractal_server/config/_email.py

@@ -1,6 +1,6 @@
 from typing import Literal
+from typing import Self
 
-from cryptography.fernet import Fernet
 from pydantic import BaseModel
 from pydantic import EmailStr
 from pydantic import Field
@@ -31,8 +31,7 @@ class PublicEmailSettings(BaseModel):
     recipients: list[EmailStr] = Field(min_length=1)
     smtp_server: str
     port: int
-    encrypted_password: SecretStr | None = None
-    encryption_key: SecretStr | None = None
+    password: SecretStr | None = None
     instance_name: str
     use_starttls: bool
     use_login: bool
@@ -53,10 +52,6 @@ class EmailSettings(BaseSettings):
     """
     Password for the OAuth-signup email sender.
     """
-    FRACTAL_EMAIL_PASSWORD_KEY: SecretStr | None = None
-    """
-    Key value for `cryptography.fernet` decrypt
-    """
     FRACTAL_EMAIL_SMTP_SERVER: str | None = None
     """
     SMTP server for the OAuth-signup emails.
@@ -81,8 +76,7 @@ class EmailSettings(BaseSettings):
     FRACTAL_EMAIL_USE_LOGIN: Literal["true", "false"] = "true"
     """
     Whether to use login when using the SMTP server.
-    If 'true', FRACTAL_EMAIL_PASSWORD and FRACTAL_EMAIL_PASSWORD_KEY must be
-    provided.
+    If 'true', FRACTAL_EMAIL_PASSWORD  must be provided.
     Accepted values: 'true', 'false'.
     """
 
@@ -93,7 +87,7 @@ class EmailSettings(BaseSettings):
     """
 
     @model_validator(mode="after")
-    def validate_email_settings(self):
+    def validate_email_settings(self: Self) -> Self:
         """
         Set `self.public`.
         """
@@ -119,49 +113,18 @@ class EmailSettings(BaseSettings):
             use_starttls = self.FRACTAL_EMAIL_USE_STARTTLS == "true"
             use_login = self.FRACTAL_EMAIL_USE_LOGIN == "true"
 
-            if use_login:
-                if self.FRACTAL_EMAIL_PASSWORD is None:
-                    raise ValueError(
-                        "'FRACTAL_EMAIL_USE_LOGIN' is 'true' but "
-                        "'FRACTAL_EMAIL_PASSWORD' is not provided."
-                    )
-                if self.FRACTAL_EMAIL_PASSWORD_KEY is None:
-                    raise ValueError(
-                        "'FRACTAL_EMAIL_USE_LOGIN' is 'true' but "
-                        "'FRACTAL_EMAIL_PASSWORD_KEY' is not provided."
-                    )
-                try:
-                    (
-                        Fernet(
-                            self.FRACTAL_EMAIL_PASSWORD_KEY.get_secret_value()
-                        )
-                        .decrypt(
-                            self.FRACTAL_EMAIL_PASSWORD.get_secret_value()
-                        )
-                        .decode("utf-8")
-                    )
-                except Exception as e:
-                    raise ValueError(
-                        "Invalid pair (FRACTAL_EMAIL_PASSWORD, "
-                        "FRACTAL_EMAIL_PASSWORD_KEY). "
-                        f"Original error: {str(e)}."
-                    )
-                password = self.FRACTAL_EMAIL_PASSWORD.get_secret_value()
-            else:
-                password = None
-
-            if self.FRACTAL_EMAIL_PASSWORD_KEY is not None:
-                key = self.FRACTAL_EMAIL_PASSWORD_KEY.get_secret_value()
-            else:
-                key = None
+            if use_login and self.FRACTAL_EMAIL_PASSWORD is None:
+                raise ValueError(
+                    "'FRACTAL_EMAIL_USE_LOGIN' is 'true' but "
+                    "'FRACTAL_EMAIL_PASSWORD' is not provided."
+                )
 
             self.public = PublicEmailSettings(
                 sender=self.FRACTAL_EMAIL_SENDER,
                 recipients=self.FRACTAL_EMAIL_RECIPIENTS.split(","),
                 smtp_server=self.FRACTAL_EMAIL_SMTP_SERVER,
                 port=self.FRACTAL_EMAIL_SMTP_PORT,
-                encrypted_password=password,
-                encryption_key=key,
+                password=self.FRACTAL_EMAIL_PASSWORD,
                 instance_name=self.FRACTAL_EMAIL_INSTANCE_NAME,
                 use_starttls=use_starttls,
                 use_login=use_login,

fractal_server/config/_main.py

@@ -1,7 +1,9 @@
 import logging
+from enum import StrEnum
 from typing import Literal
 from typing import TypeVar
 
+from pydantic import HttpUrl
 from pydantic import SecretStr
 from pydantic_settings import BaseSettings
 from pydantic_settings import SettingsConfigDict
@@ -14,6 +16,12 @@ class FractalConfigurationError(ValueError):
     pass
 
 
+class ViewerAuthScheme(StrEnum):
+    VIEWER_PATHS = "viewer-paths"
+    USERS_FOLDERS = "users-folders"
+    NONE = "none"
+
+
 T = TypeVar("T")
 
 
@@ -72,9 +80,7 @@ class Settings(BaseSettings):
     Waiting time for the shutdown phase of executors
     """
 
-    FRACTAL_VIEWER_AUTHORIZATION_SCHEME: Literal[
-        "viewer-paths", "users-folders", "none"
-    ] = "none"
+    FRACTAL_VIEWER_AUTHORIZATION_SCHEME: ViewerAuthScheme = "none"
     """
     Defines how the list of allowed viewer paths is built.
 
@@ -119,3 +125,8 @@ class Settings(BaseSettings):
                     "FRACTAL_VIEWER_AUTHORIZATION_SCHEME is set to "
                     "users-folders"
                 )
+
+    FRACTAL_HELP_URL: HttpUrl | None = None
+    """
+    The URL of an instance-specific Fractal help page.
+    """