fractal-server 2.17.0a6__tar.gz → 2.17.0a8__tar.gz

{fractal_server-2.17.0a6 → fractal_server-2.17.0a8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fractal-server
-Version: 2.17.0a6
+Version: 2.17.0a8
 Summary: Backend component of the Fractal analytics platform
 License-Expression: BSD-3-Clause
 License-File: LICENSE

fractal_server-2.17.0a8/fractal_server/__init__.py

@@ -0,0 +1 @@
+__VERSION__ = "2.17.0a8"

{fractal_server-2.17.0a6 → fractal_server-2.17.0a8}/fractal_server/app/models/security.py

@@ -92,7 +92,7 @@ class UserOAuth(SQLModel, table=True):
     profile_id: int | None = Field(
         foreign_key="profile.id",
         default=None,
-        ondelete="SET NULL",
+        ondelete="RESTRICT",
     )
 
     # TODO-2.17.1: update to `project_dir: str`
@@ -107,6 +107,12 @@ class UserOAuth(SQLModel, table=True):
         sa_column=Column(ARRAY(String), server_default="{}"),
     )
 
+    # TODO-2.17.1: remove
+    user_settings_id: int | None = Field(
+        foreign_key="user_settings.id",
+        default=None,
+    )
+
 
 class UserGroup(SQLModel, table=True):
     """

{fractal_server-2.17.0a6 → fractal_server-2.17.0a8}/fractal_server/app/models/user_settings.py

@@ -29,5 +29,9 @@ class UserSettings(SQLModel, table=True):
     ssh_host: str | None = None
     ssh_username: str | None = None
     ssh_private_key_path: str | None = None
+
     slurm_user: str | None = None
     project_dir: str | None = None
+
+    ssh_tasks_dir: str | None = None
+    ssh_jobs_dir: str | None = None

{fractal_server-2.17.0a6 → fractal_server-2.17.0a8}/fractal_server/app/models/v2/profile.py

@@ -4,7 +4,7 @@ from sqlmodel import SQLModel
 
 class Profile(SQLModel, table=True):
     id: int | None = Field(default=None, primary_key=True)
-    resource_id: int = Field(foreign_key="resource.id", ondelete="CASCADE")
+    resource_id: int = Field(foreign_key="resource.id", ondelete="RESTRICT")
     resource_type: str
 
     name: str = Field(unique=True)

{fractal_server-2.17.0a6 → fractal_server-2.17.0a8}/fractal_server/app/models/v2/project.py

@@ -14,8 +14,10 @@ from fractal_server.utils import get_timestamp
 class ProjectV2(SQLModel, table=True):
     id: int | None = Field(default=None, primary_key=True)
     name: str
+
+    # TODO-2.17.1: make `resource_id` not nullable
     resource_id: int | None = Field(
-        foreign_key="resource.id", default=None, ondelete="SET NULL"
+        foreign_key="resource.id", default=None, ondelete="RESTRICT"
     )
     timestamp_created: datetime = Field(
         default_factory=get_timestamp,

{fractal_server-2.17.0a6 → fractal_server-2.17.0a8}/fractal_server/app/models/v2/resource.py

@@ -120,11 +120,11 @@ class Resource(SQLModel, table=True):
         # `type` column must be one of "local", "slurm_sudo" or "slurm_ssh"
         CheckConstraint(
             "type IN ('local', 'slurm_sudo', 'slurm_ssh')",
-            name="ck_resource_correct_type",
+            name="correct_type",
         ),
         # If `type` is not "local", `jobs_slurm_python_worker` must be set
         CheckConstraint(
             "(type = 'local') OR (jobs_slurm_python_worker IS NOT NULL)",
-            name="ck_resource_jobs_slurm_python_worker_set",
+            name="jobs_slurm_python_worker_set",
         ),
     )

{fractal_server-2.17.0a6 → fractal_server-2.17.0a8}/fractal_server/app/models/v2/task_group.py

@@ -44,7 +44,7 @@ class TaskGroupV2(SQLModel, table=True):
     )
     # TODO-2.17.1: make `resource_id` not nullable
     resource_id: int | None = Field(
-        foreign_key="resource.id", default=None, ondelete="SET NULL"
+        foreign_key="resource.id", default=None, ondelete="RESTRICT"
     )
 
     origin: str

{fractal_server-2.17.0a6 → fractal_server-2.17.0a8}/fractal_server/app/routes/admin/v2/resource.py

@@ -3,7 +3,7 @@ from fastapi import Depends
 from fastapi import HTTPException
 from fastapi import Response
 from fastapi import status
-from sqlmodel import func
+from sqlalchemy.exc import IntegrityError
 from sqlmodel import select
 
 from ._aux_functions import _check_resource_name
@@ -13,9 +13,7 @@ from fractal_server.app.db import AsyncSession
 from fractal_server.app.db import get_async_db
 from fractal_server.app.models import UserOAuth
 from fractal_server.app.models.v2 import Profile
-from fractal_server.app.models.v2 import ProjectV2
 from fractal_server.app.models.v2 import Resource
-from fractal_server.app.models.v2 import TaskGroupV2
 from fractal_server.app.routes.auth import current_superuser_act
 from fractal_server.app.schemas.v2 import ProfileCreate
 from fractal_server.app.schemas.v2 import ProfileRead
@@ -151,61 +149,20 @@ async def delete_resource(
     Delete single `Resource`.
     """
     resource = await _get_resource_or_404(resource_id=resource_id, db=db)
-
-    # Fail if at least one Profile is associated with the Resource.
-    res = await db.execute(
-        select(func.count(Profile.id)).where(
-            Profile.resource_id == resource_id
-        )
-    )
-    associated_profile_count = res.scalar()
-    if associated_profile_count > 0:
-        raise HTTPException(
-            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
-            detail=(
-                f"Cannot delete Resource {resource_id} because it's associated"
-                f" with {associated_profile_count} Profiles."
-            ),
-        )
-
-    # Fail if at least one Project is associated with the Resource.
-    res = await db.execute(
-        select(func.count(ProjectV2.id)).where(
-            ProjectV2.resource_id == resource_id
-        )
-    )
-    associated_project_count = res.scalar()
-    if associated_project_count > 0:
+    try:
+        await db.delete(resource)
+        await db.commit()
+        return Response(status_code=status.HTTP_204_NO_CONTENT)
+    except IntegrityError as e:
+        await db.rollback()
         raise HTTPException(
             status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
             detail=(
-                f"Cannot delete Resource {resource_id} because it's associated"
-                f" with {associated_project_count} Projects."
+                "IntegrityError for resource deletion. "
+                f"Original error:\n{str(e)}"
             ),
         )
 
-    # Fail if at least one TaskGroupV2 is associated with the Resource.
-    res = await db.execute(
-        select(func.count(TaskGroupV2.id)).where(
-            TaskGroupV2.resource_id == resource_id
-        )
-    )
-    associated_taskgroup_count = res.scalar()
-    if associated_taskgroup_count > 0:
-        raise HTTPException(
-            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
-            detail=(
-                f"Cannot delete Resource {resource_id} because it's associated"
-                f" with {associated_taskgroup_count} TaskGroupV2."
-            ),
-        )
-
-    # Delete
-    await db.delete(resource)
-    await db.commit()
-
-    return Response(status_code=status.HTTP_204_NO_CONTENT)
-
 
 @router.get(
     "/{resource_id}/profile/",

{fractal_server-2.17.0a6 → fractal_server-2.17.0a8}/fractal_server/app/routes/api/v2/_aux_functions.py

@@ -543,24 +543,14 @@ async def _get_submitted_job_or_none(
         )
 
 
-async def _get_resource_and_profile_ids(
-    *,
-    user_id: int,
-    db: AsyncSession,
-) -> tuple[int, int] | tuple[None, None]:
-    """
-    Get `(resource_id, profile_id)` pair for a given user, or `(None,None)`.
-    """
-    stm = (
-        select(Resource.id, Profile.id)
+async def _get_user_resource_id(user_id: int, db: AsyncSession) -> int | None:
+    res = await db.execute(
+        select(Resource.id)
+        .join(Profile)
         .join(UserOAuth)
         .where(Resource.id == Profile.resource_id)
         .where(Profile.id == UserOAuth.profile_id)
         .where(UserOAuth.id == user_id)
     )
-    res = await db.execute(stm)
-    data = res.one_or_none()
-    if data is None:
-        return (None, None)
-    else:
-        return tuple(data)
+    resource_id = res.scalar_one_or_none()
+    return resource_id

{fractal_server-2.17.0a6 → fractal_server-2.17.0a8}/fractal_server/app/routes/api/v2/_aux_functions_tasks.py

@@ -12,10 +12,14 @@ from fractal_server.app.db import AsyncSession
 from fractal_server.app.models import LinkUserGroup
 from fractal_server.app.models import UserGroup
 from fractal_server.app.models import UserOAuth
+from fractal_server.app.models.v2 import Profile
 from fractal_server.app.models.v2 import TaskGroupActivityV2
 from fractal_server.app.models.v2 import TaskGroupV2
 from fractal_server.app.models.v2 import TaskV2
 from fractal_server.app.models.v2 import WorkflowTaskV2
+from fractal_server.app.routes.api.v2._aux_functions import (
+    _get_user_resource_id,
+)
 from fractal_server.app.routes.auth._aux_auth import _get_default_usergroup_id
 from fractal_server.app.routes.auth._aux_auth import (
     _verify_user_belongs_to_group,
@@ -80,11 +84,16 @@ async def _get_task_group_read_access(
     else:
         stm = (
             select(LinkUserGroup)
+            .join(UserOAuth)
+            .join(Profile)
             .where(LinkUserGroup.group_id == task_group.user_group_id)
             .where(LinkUserGroup.user_id == user_id)
+            .where(UserOAuth.id == user_id)
+            .where(Profile.id == UserOAuth.profile_id)
+            .where(TaskGroupV2.resource_id == Profile.resource_id)
         )
         res = await db.execute(stm)
-        link = res.scalar_one_or_none()
+        link = res.unique().scalars().one_or_none()
         if link is None:
             raise forbidden_exception
         else:
@@ -153,9 +162,17 @@ async def _get_task_full_access(
         db: An asynchronous db session.
     """
     task = await _get_task_or_404(task_id=task_id, db=db)
-    await _get_task_group_full_access(
+    task_group = await _get_task_group_full_access(
         task_group_id=task.taskgroupv2_id, user_id=user_id, db=db
     )
+
+    resource_id = await _get_user_resource_id(user_id=user_id, db=db)
+    if resource_id is None or resource_id != task_group.resource_id:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail=f"User {user_id} has no access to TaskGroup's Resource.",
+        )
+
     return task
 
 
@@ -179,12 +196,20 @@ async def _get_task_read_access(
     task_group = await _get_task_group_read_access(
         task_group_id=task.taskgroupv2_id, user_id=user_id, db=db
     )
-    if require_active:
-        if not task_group.active:
-            raise HTTPException(
-                status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
-                detail=f"Error: task {task_id} ({task.name}) is not active.",
-            )
+
+    resource_id = await _get_user_resource_id(user_id=user_id, db=db)
+    if resource_id is None or resource_id != task_group.resource_id:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail=f"User {user_id} has no access to TaskGroup's Resource.",
+        )
+
+    if require_active and not task_group.active:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+            detail=f"Error: task {task_id} ({task.name}) is not active.",
+        )
+
     return task
 
 
@@ -255,16 +280,19 @@ async def _get_collection_task_group_activity_status_message(
 
 
 async def _verify_non_duplication_user_constraint(
+    *,
     db: AsyncSession,
     user_id: int,
     pkg_name: str,
     version: str | None,
+    user_resource_id: int,
 ):
     stm = (
         select(TaskGroupV2)
         .where(TaskGroupV2.user_id == user_id)
         .where(TaskGroupV2.pkg_name == pkg_name)
         .where(TaskGroupV2.version == version)
+        .where(TaskGroupV2.resource_id == user_resource_id)
     )
     res = await db.execute(stm)
     duplicate = res.scalars().all()

{fractal_server-2.17.0a6 → fractal_server-2.17.0a8}/fractal_server/app/routes/api/v2/project.py

@@ -15,9 +15,9 @@ from ....models.v2 import ProjectV2
 from ....schemas.v2 import ProjectCreateV2
 from ....schemas.v2 import ProjectReadV2
 from ....schemas.v2 import ProjectUpdateV2
+from ...aux.validate_user_profile import validate_user_profile
 from ._aux_functions import _check_project_exists
 from ._aux_functions import _get_project_check_owner
-from ._aux_functions import _get_resource_and_profile_ids
 from ._aux_functions import _get_submitted_jobs_statement
 from fractal_server.app.models import UserOAuth
 from fractal_server.app.routes.auth import current_user_act_ver_prof
@@ -54,13 +54,17 @@ async def create_project(
     Create new project
     """
 
+    # Get validated resource and profile
+    resource, profile = await validate_user_profile(
+        user=user,
+        db=db,
+    )
+    resource_id = resource.id
+
     # Check that there is no project with the same user and name
     await _check_project_exists(
         project_name=project.name, user_id=user.id, db=db
     )
-    resource_id, _ = await _get_resource_and_profile_ids(
-        user_id=user.id, db=db
-    )
 
     db_project = ProjectV2(**project.model_dump(), resource_id=resource_id)
     db_project.user_list.append(user)

{fractal_server-2.17.0a6 → fractal_server-2.17.0a8}/fractal_server/app/routes/api/v2/submit.py

@@ -59,6 +59,9 @@ async def apply_workflow(
 ) -> JobReadV2 | None:
     # Remove non-submitted V2 jobs from the app state when the list grows
     # beyond a threshold
+    # NOTE: this may lead to a race condition on `app.state.jobsV2` if two
+    # requests take place at the same time and `clean_app_job_list_v2` is
+    # somewhat slow.
     settings = Inject(get_settings)
     if (
         len(request.app.state.jobsV2)

{fractal_server-2.17.0a6 → fractal_server-2.17.0a8}/fractal_server/app/routes/api/v2/task.py

@@ -9,7 +9,8 @@ from sqlmodel import func
 from sqlmodel import or_
 from sqlmodel import select
 
-from ._aux_functions import _get_resource_and_profile_ids
+from ...aux.validate_user_profile import validate_user_profile
+from ._aux_functions import _get_user_resource_id
 from ._aux_functions_tasks import _get_task_full_access
 from ._aux_functions_tasks import _get_task_read_access
 from ._aux_functions_tasks import _get_valid_user_group_id
@@ -46,10 +47,14 @@ async def get_list_task(
     """
     Get list of available tasks
     """
+
+    user_resource_id = await _get_user_resource_id(user_id=user.id, db=db)
+
     stm = (
         select(TaskV2)
         .join(TaskGroupV2)
         .where(TaskGroupV2.id == TaskV2.taskgroupv2_id)
+        .where(TaskGroupV2.resource_id == user_resource_id)
         .where(
             or_(
                 TaskGroupV2.user_id == user.id,
@@ -144,6 +149,13 @@ async def create_task(
     Create a new task
     """
 
+    # Get validated resource and profile
+    resource, profile = await validate_user_profile(
+        user=user,
+        db=db,
+    )
+    resource_id = resource.id
+
     # Validate query parameters related to user-group ownership
     user_group_id = await _get_valid_user_group_id(
         user_group_id=user_group_id,
@@ -179,7 +191,11 @@ async def create_task(
     db_task = TaskV2(**task.model_dump(exclude_unset=True))
     pkg_name = db_task.name
     await _verify_non_duplication_user_constraint(
-        db=db, pkg_name=pkg_name, user_id=user.id, version=db_task.version
+        db=db,
+        pkg_name=pkg_name,
+        user_id=user.id,
+        version=db_task.version,
+        user_resource_id=resource_id,
     )
     await _verify_non_duplication_group_constraint(
         db=db,
@@ -187,9 +203,6 @@ async def create_task(
         user_group_id=user_group_id,
         version=db_task.version,
     )
-    resource_id, _ = await _get_resource_and_profile_ids(
-        user_id=user.id, db=db
-    )
     db_task_group = TaskGroupV2(
         user_id=user.id,
         user_group_id=user_group_id,

{fractal_server-2.17.0a6 → fractal_server-2.17.0a8}/fractal_server/app/routes/api/v2/task_collection.py

@@ -25,7 +25,6 @@ from ....schemas.v2 import TaskGroupActivityStatusV2
 from ....schemas.v2 import TaskGroupActivityV2Read
 from ....schemas.v2 import TaskGroupCreateV2Strict
 from ...aux.validate_user_profile import validate_user_profile
-from ._aux_functions import _get_resource_and_profile_ids
 from ._aux_functions_task_lifecycle import get_package_version_from_pypi
 from ._aux_functions_tasks import _get_valid_user_group_id
 from ._aux_functions_tasks import _verify_non_duplication_group_constraint
@@ -173,13 +172,11 @@ async def collect_tasks_pip(
         user=user,
         db=db,
     )
+    resource_id = resource.id
+
     # Get some validated request data
     task_collect = request_data.task_collect
 
-    resource_id, _ = await _get_resource_and_profile_ids(
-        user_id=user.id, db=db
-    )
-
     # Initialize task-group attributes
     task_group_attrs = dict(
         user_id=user.id,
@@ -297,6 +294,7 @@ async def collect_tasks_pip(
         user_id=user.id,
         pkg_name=task_group_attrs["pkg_name"],
         version=task_group_attrs["version"],
+        user_resource_id=resource_id,
         db=db,
     )
     await _verify_non_duplication_group_constraint(

{fractal_server-2.17.0a6 → fractal_server-2.17.0a8}/fractal_server/app/routes/api/v2/task_collection_custom.py

@@ -10,7 +10,6 @@ from fastapi import status
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from ...aux.validate_user_profile import validate_user_profile
-from ._aux_functions import _get_resource_and_profile_ids
 from ._aux_functions_tasks import _get_valid_user_group_id
 from ._aux_functions_tasks import _verify_non_duplication_group_constraint
 from ._aux_functions_tasks import _verify_non_duplication_user_constraint
@@ -50,6 +49,7 @@ async def collect_task_custom(
 ) -> list[TaskReadV2]:
     # Get validated resource and profile
     resource, profile = await validate_user_profile(user=user, db=db)
+    resource_id = resource.id
 
     # Validate query parameters related to user-group ownership
     user_group_id = await _get_valid_user_group_id(
@@ -145,10 +145,6 @@ async def collect_task_custom(
         package_version=task_collect.version,
     )
 
-    resource_id, _ = await _get_resource_and_profile_ids(
-        user_id=user.id, db=db
-    )
-
     # Prepare task-group attributes
     task_group_attrs = dict(
         origin=TaskGroupV2OriginEnum.OTHER,
@@ -165,6 +161,7 @@ async def collect_task_custom(
         user_id=user.id,
         pkg_name=task_group_attrs["pkg_name"],
         version=task_group_attrs["version"],
+        user_resource_id=resource_id,
         db=db,
     )
     await _verify_non_duplication_group_constraint(

{fractal_server-2.17.0a6 → fractal_server-2.17.0a8}/fractal_server/app/routes/api/v2/task_collection_pixi.py

@@ -10,7 +10,6 @@ from fastapi import Response
 from fastapi import status
 from fastapi import UploadFile
 
-from ._aux_functions import _get_resource_and_profile_ids
 from fractal_server.app.db import AsyncSession
 from fractal_server.app.db import get_async_db
 from fractal_server.app.models import UserOAuth
@@ -90,6 +89,7 @@ async def collect_task_pixi(
 ) -> TaskGroupActivityV2Read:
     # Get validated resource and profile
     resource, profile = await validate_user_profile(user=user, db=db)
+    resource_id = resource.id
 
     # Check if Pixi is available
     if not resource.tasks_pixi_config:
@@ -133,10 +133,6 @@ async def collect_task_pixi(
         Path(base_tasks_path) / str(user.id) / pkg_name / version
     ).as_posix()
 
-    resource_id, _ = await _get_resource_and_profile_ids(
-        user_id=user.id, db=db
-    )
-
     task_group_attrs = dict(
         user_id=user.id,
         user_group_id=user_group_id,
@@ -152,6 +148,7 @@ async def collect_task_pixi(
         user_id=user.id,
         pkg_name=task_group_attrs["pkg_name"],
         version=task_group_attrs["version"],
+        user_resource_id=resource_id,
         db=db,
     )
     await _verify_non_duplication_group_constraint(

{fractal_server-2.17.0a6 → fractal_server-2.17.0a8}/fractal_server/app/routes/auth/oauth.py

@@ -2,6 +2,7 @@ from fastapi import APIRouter
 from httpx_oauth.clients.github import GitHubOAuth2
 from httpx_oauth.clients.google import GoogleOAuth2
 from httpx_oauth.clients.openid import OpenID
+from httpx_oauth.clients.openid import OpenIDConfigurationError
 
 from . import cookie_backend
 from . import fastapi_users
@@ -26,11 +27,21 @@ def _create_client_google(cfg: OAuthSettings) -> GoogleOAuth2:
 
 
 def _create_client_oidc(cfg: OAuthSettings) -> OpenID:
-    return OpenID(
-        client_id=cfg.OAUTH_CLIENT_ID.get_secret_value(),
-        client_secret=cfg.OAUTH_CLIENT_SECRET.get_secret_value(),
-        openid_configuration_endpoint=cfg.OAUTH_OIDC_CONFIG_ENDPOINT.get_secret_value(),  # noqa
-    )
+    try:
+        open_id = OpenID(
+            client_id=cfg.OAUTH_CLIENT_ID.get_secret_value(),
+            client_secret=cfg.OAUTH_CLIENT_SECRET.get_secret_value(),
+            openid_configuration_endpoint=cfg.OAUTH_OIDC_CONFIG_ENDPOINT.get_secret_value(),  # noqa
+        )
+    except OpenIDConfigurationError as e:
+        OAUTH_OIDC_CONFIG_ENDPOINT = (
+            cfg.OAUTH_OIDC_CONFIG_ENDPOINT.get_secret_value()
+        )
+        raise RuntimeError(
+            f"Cannot initialize OpenID client. Original error: '{e}'. "
+            f"Hint: is {OAUTH_OIDC_CONFIG_ENDPOINT=} reachable?"
+        )
+    return open_id
 
 
 def get_oauth_router() -> APIRouter | None:
@@ -44,7 +55,6 @@ def get_oauth_router() -> APIRouter | None:
         return None
 
     client_name = oauth_settings.OAUTH_CLIENT_NAME
-
     if client_name == "google":
         client = _create_client_google(oauth_settings)
     elif client_name == "github":

{fractal_server-2.17.0a6 → fractal_server-2.17.0a8}/fractal_server/config/_main.py

@@ -51,7 +51,7 @@ class Settings(BaseSettings):
     Only logs of with this level (or higher) will appear in the console logs.
     """
 
-    FRACTAL_API_MAX_JOB_LIST_LENGTH: int = 50
+    FRACTAL_API_MAX_JOB_LIST_LENGTH: int = 25
     """
     Number of ids that can be stored in the `jobsV2` attribute of
     `app.state`.

{fractal_server-2.17.0a6 → fractal_server-2.17.0a8}/fractal_server/migrations/naming_convention.py

@@ -1,7 +1,7 @@
 NAMING_CONVENTION = {
     "ix": "ix_%(column_0_label)s",
     "uq": "uq_%(table_name)s_%(column_0_name)s",
-    "ck": "ck_%(table_name)s_`%(constraint_name)s`",
+    "ck": "ck_%(table_name)s_%(constraint_name)s",
     "fk": "fk_%(table_name)s_%(column_0_name)s_%(referred_table_name)s",
     "pk": "pk_%(table_name)s",
 }