fractal-server 2.17.1a1__py3-none-any.whl → 2.18.0__py3-none-any.whl

fractal_server/app/routes/api/v2/project.py

@@ -5,28 +5,33 @@ from fastapi import Response
 from fastapi import status
 from sqlmodel import select
 
-from .....logger import reset_logger_handlers
-from .....logger import set_logger
-from ....db import AsyncSession
-from ....db import get_async_db
-from ....models.v2 import JobV2
-from ....models.v2 import LinkUserProjectV2
-from ....models.v2 import ProjectV2
-from ....schemas.v2 import ProjectCreateV2
-from ....schemas.v2 import ProjectReadV2
-from ....schemas.v2 import ProjectUpdateV2
-from ...aux.validate_user_profile import validate_user_profile
-from ._aux_functions import _check_project_exists
-from ._aux_functions import _get_project_check_owner
-from ._aux_functions import _get_submitted_jobs_statement
+from fractal_server.app.db import AsyncSession
+from fractal_server.app.db import get_async_db
 from fractal_server.app.models import UserOAuth
+from fractal_server.app.models.v2 import JobV2
+from fractal_server.app.models.v2 import LinkUserProjectV2
+from fractal_server.app.models.v2 import ProjectV2
 from fractal_server.app.routes.auth import current_user_act_ver_prof
+from fractal_server.app.routes.aux.validate_user_profile import (
+    validate_user_profile,
+)
+from fractal_server.app.schemas.v2 import ProjectCreate
+from fractal_server.app.schemas.v2 import ProjectPermissions
+from fractal_server.app.schemas.v2 import ProjectRead
+from fractal_server.app.schemas.v2 import ProjectUpdate
+from fractal_server.logger import set_logger
 
+from ._aux_functions import _check_project_exists
+from ._aux_functions import _get_project_check_access
+from ._aux_functions import _get_submitted_jobs_statement
+
+logger = set_logger(__name__)
 router = APIRouter()
 
 
-@router.get("/project/", response_model=list[ProjectReadV2])
+@router.get("/project/", response_model=list[ProjectRead])
 async def get_list_project(
+    is_owner: bool = True,
     user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
 ) -> list[ProjectV2]:
@@ -35,8 +40,10 @@ async def get_list_project(
     """
     stm = (
         select(ProjectV2)
-        .join(LinkUserProjectV2)
+        .join(LinkUserProjectV2, LinkUserProjectV2.project_id == ProjectV2.id)
         .where(LinkUserProjectV2.user_id == user.id)
+        .where(LinkUserProjectV2.is_owner == is_owner)
+        .where(LinkUserProjectV2.is_verified.is_(True))
     )
     res = await db.execute(stm)
     project_list = res.scalars().all()
@@ -44,12 +51,12 @@ async def get_list_project(
     return project_list
 
 
-@router.post("/project/", response_model=ProjectReadV2, status_code=201)
+@router.post("/project/", response_model=ProjectRead, status_code=201)
 async def create_project(
-    project: ProjectCreateV2,
+    project: ProjectCreate,
     user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
-) -> ProjectReadV2 | None:
+) -> ProjectRead | None:
     """
     Create new project
     """
@@ -67,41 +74,55 @@ async def create_project(
     )
 
     db_project = ProjectV2(**project.model_dump(), resource_id=resource_id)
-    db_project.user_list.append(user)
-
     db.add(db_project)
+    await db.flush()
+
+    link = LinkUserProjectV2(
+        project_id=db_project.id,
+        user_id=user.id,
+        is_owner=True,
+        is_verified=True,
+        permissions=ProjectPermissions.EXECUTE,
+    )
+    db.add(link)
+
     await db.commit()
     await db.refresh(db_project)
-    await db.close()
 
     return db_project
 
 
-@router.get("/project/{project_id}/", response_model=ProjectReadV2)
+@router.get("/project/{project_id}/", response_model=ProjectRead)
 async def read_project(
     project_id: int,
     user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
-) -> ProjectReadV2 | None:
+) -> ProjectRead | None:
     """
     Return info on an existing project
     """
-    project = await _get_project_check_owner(
-        project_id=project_id, user_id=user.id, db=db
+    project = await _get_project_check_access(
+        project_id=project_id,
+        user_id=user.id,
+        required_permissions=ProjectPermissions.READ,
+        db=db,
     )
     await db.close()
     return project
 
 
-@router.patch("/project/{project_id}/", response_model=ProjectReadV2)
+@router.patch("/project/{project_id}/", response_model=ProjectRead)
 async def update_project(
     project_id: int,
-    project_update: ProjectUpdateV2,
+    project_update: ProjectUpdate,
     user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
 ):
-    project = await _get_project_check_owner(
-        project_id=project_id, user_id=user.id, db=db
+    project = await _get_project_check_access(
+        project_id=project_id,
+        user_id=user.id,
+        required_permissions=ProjectPermissions.WRITE,
+        db=db,
     )
 
     # Check that there is no project with the same user and name
@@ -129,10 +150,18 @@ async def delete_project(
     Delete project
     """
 
-    project = await _get_project_check_owner(
-        project_id=project_id, user_id=user.id, db=db
+    project = await _get_project_check_access(
+        project_id=project_id,
+        user_id=user.id,
+        required_permissions=ProjectPermissions.EXECUTE,
+        db=db,
     )
-    logger = set_logger(__name__)
+    link_user_project = await db.get(LinkUserProjectV2, (project_id, user.id))
+    if not link_user_project.is_owner:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only the owner can delete a Project.",
+        )
 
     # Fail if there exist jobs that are submitted and in relation with the
     # current project.
@@ -149,13 +178,12 @@ async def delete_project(
             ),
         )
 
-    logger.info(f"Adding Project[{project.id}] to deletion.")
+    logger.debug(f"Add project {project.id} to deletion.")
     await db.delete(project)
 
-    logger.info("Committing changes to db...")
+    logger.debug("Commit changes to db")
     await db.commit()
 
-    logger.info("Everything  has been deleted correctly.")
-    reset_logger_handlers(logger)
+    logger.debug("Everything  has been deleted correctly.")
 
     return Response(status_code=status.HTTP_204_NO_CONTENT)

fractal_server/app/routes/api/v2/sharing.py

@@ -0,0 +1,311 @@
+from fastapi import APIRouter
+from fastapi import Depends
+from fastapi import HTTPException
+from fastapi import Response
+from fastapi import status
+from pydantic import EmailStr
+from sqlmodel import select
+
+from fractal_server.app.db import AsyncSession
+from fractal_server.app.db import get_async_db
+from fractal_server.app.models import UserOAuth
+from fractal_server.app.models.v2 import LinkUserProjectV2
+from fractal_server.app.models.v2 import ProjectV2
+from fractal_server.app.routes.auth import current_user_act_ver_prof
+from fractal_server.app.schemas.v2 import ProjectAccessRead
+from fractal_server.app.schemas.v2 import ProjectGuestCreate
+from fractal_server.app.schemas.v2 import ProjectGuestRead
+from fractal_server.app.schemas.v2 import ProjectGuestUpdate
+from fractal_server.app.schemas.v2 import ProjectInvitationRead
+
+from ._aux_functions_sharing import get_link_or_404
+from ._aux_functions_sharing import get_pending_invitation_or_404
+from ._aux_functions_sharing import get_user_id_from_email_or_404
+from ._aux_functions_sharing import raise_403_if_not_owner
+from ._aux_functions_sharing import raise_422_if_link_exists
+
+router = APIRouter()
+
+
+@router.get(
+    "/project/{project_id}/guest/",
+    response_model=list[ProjectGuestRead],
+)
+async def get_project_guests(
+    project_id: int,
+    owner: UserOAuth = Depends(current_user_act_ver_prof),
+    db: AsyncSession = Depends(get_async_db),
+) -> list[ProjectGuestRead]:
+    """
+    Get the list of all the guests of your project (verified or not).
+    """
+    await raise_403_if_not_owner(user_id=owner.id, project_id=project_id, db=db)
+    # Get (email, is_verified, permissions) for all guests
+    res = await db.execute(
+        select(
+            UserOAuth.email,
+            LinkUserProjectV2.is_verified,
+            LinkUserProjectV2.permissions,
+        )
+        .join(LinkUserProjectV2, LinkUserProjectV2.user_id == UserOAuth.id)
+        .where(LinkUserProjectV2.project_id == project_id)
+        .where(LinkUserProjectV2.is_owner.is_(False))
+        .order_by(UserOAuth.email)
+    )
+    guest_tuples = res.all()
+    return [
+        dict(
+            email=guest_email,
+            is_verified=is_verified,
+            permissions=permissions,
+        )
+        for guest_email, is_verified, permissions in guest_tuples
+    ]
+
+
+@router.post("/project/{project_id}/guest/", status_code=201)
+async def invite_guest(
+    project_id: int,
+    email: EmailStr,
+    project_invitation: ProjectGuestCreate,
+    owner: UserOAuth = Depends(current_user_act_ver_prof),
+    db: AsyncSession = Depends(get_async_db),
+) -> Response:
+    """
+    Add a guest to your project.
+    """
+    await raise_403_if_not_owner(user_id=owner.id, project_id=project_id, db=db)
+
+    guest_id = await get_user_id_from_email_or_404(user_email=email, db=db)
+
+    await raise_422_if_link_exists(
+        user_id=guest_id,
+        project_id=project_id,
+        db=db,
+    )
+
+    db.add(
+        LinkUserProjectV2(
+            project_id=project_id,
+            user_id=guest_id,
+            is_owner=False,
+            is_verified=False,
+            permissions=project_invitation.permissions,
+        )
+    )
+    await db.commit()
+
+    return Response(status_code=status.HTTP_201_CREATED)
+
+
+@router.patch("/project/{project_id}/guest/", status_code=200)
+async def patch_guest(
+    project_id: int,
+    email: EmailStr,
+    update: ProjectGuestUpdate,
+    owner: UserOAuth = Depends(current_user_act_ver_prof),
+    db: AsyncSession = Depends(get_async_db),
+) -> Response:
+    """
+    Change guest's permissions on your project.
+    """
+    await raise_403_if_not_owner(user_id=owner.id, project_id=project_id, db=db)
+
+    guest_id = await get_user_id_from_email_or_404(user_email=email, db=db)
+
+    if guest_id == owner.id:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+            detail="Cannot perform this operation on project owner.",
+        )
+
+    link = await get_link_or_404(
+        user_id=guest_id,
+        project_id=project_id,
+        db=db,
+    )
+
+    # Update link and commit
+    for key, value in update.model_dump(exclude_unset=True).items():
+        setattr(link, key, value)
+    await db.commit()
+
+    return Response(status_code=status.HTTP_200_OK)
+
+
+@router.delete("/project/{project_id}/guest/", status_code=204)
+async def revoke_guest_access(
+    project_id: int,
+    email: EmailStr,
+    owner: UserOAuth = Depends(current_user_act_ver_prof),
+    db: AsyncSession = Depends(get_async_db),
+) -> Response:
+    """
+    Remove a guest from your project.
+    """
+    await raise_403_if_not_owner(user_id=owner.id, project_id=project_id, db=db)
+
+    guest_id = await get_user_id_from_email_or_404(user_email=email, db=db)
+
+    if guest_id == owner.id:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+            detail="Cannot perform this operation on project owner.",
+        )
+
+    link = await get_link_or_404(
+        user_id=guest_id,
+        project_id=project_id,
+        db=db,
+    )
+
+    # Delete link and commit
+    await db.delete(link)
+    await db.commit()
+
+    return Response(status_code=status.HTTP_204_NO_CONTENT)
+
+
+@router.get(
+    "/project/invitation/",
+    response_model=list[ProjectInvitationRead],
+)
+async def get_pending_invitations(
+    user: UserOAuth = Depends(current_user_act_ver_prof),
+    db: AsyncSession = Depends(get_async_db),
+) -> list[ProjectInvitationRead]:
+    """
+    See your current invitations.
+    """
+
+    res = await db.execute(
+        select(
+            ProjectV2.id,
+            ProjectV2.name,
+            LinkUserProjectV2.permissions,
+            (
+                select(UserOAuth.email)
+                .join(
+                    LinkUserProjectV2,
+                    UserOAuth.id == LinkUserProjectV2.user_id,
+                )
+                .where(LinkUserProjectV2.is_owner.is_(True))
+                .where(LinkUserProjectV2.project_id == ProjectV2.id)
+                .scalar_subquery()
+                .correlate(ProjectV2)
+            ),
+        )
+        .join(LinkUserProjectV2, LinkUserProjectV2.project_id == ProjectV2.id)
+        .where(LinkUserProjectV2.user_id == user.id)
+        .where(LinkUserProjectV2.is_verified.is_(False))
+        .order_by(ProjectV2.name)
+    )
+
+    guest_project_info = res.all()
+
+    return [
+        dict(
+            project_id=project_id,
+            project_name=project_name,
+            guest_permissions=guest_permissions,
+            owner_email=owner_email,
+        )
+        for (
+            project_id,
+            project_name,
+            guest_permissions,
+            owner_email,
+        ) in guest_project_info
+    ]
+
+
+@router.get(
+    "/project/{project_id}/access/",
+    response_model=ProjectAccessRead,
+)
+async def get_access_info(
+    project_id: int,
+    user: UserOAuth = Depends(current_user_act_ver_prof),
+    db: AsyncSession = Depends(get_async_db),
+) -> ProjectAccessRead:
+    """
+    Returns information on your relationship with Project[`project_id`].
+    """
+
+    res = await db.execute(
+        select(
+            LinkUserProjectV2.is_owner,
+            LinkUserProjectV2.permissions,
+            (
+                select(UserOAuth.email)
+                .join(
+                    LinkUserProjectV2,
+                    UserOAuth.id == LinkUserProjectV2.user_id,
+                )
+                .where(LinkUserProjectV2.is_owner.is_(True))
+                .where(LinkUserProjectV2.project_id == project_id)
+                .scalar_subquery()
+            ),
+        )
+        .where(LinkUserProjectV2.project_id == project_id)
+        .where(LinkUserProjectV2.user_id == user.id)
+        .where(LinkUserProjectV2.is_verified.is_(True))
+    )
+
+    guest_project_info = res.one_or_none()
+
+    if guest_project_info is None:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail=f"User has no access to project {project_id}.",
+        )
+
+    is_owner, permissions, owner_email = guest_project_info
+
+    return dict(
+        is_owner=is_owner,
+        permissions=permissions,
+        owner_email=owner_email,
+    )
+
+
+@router.post("/project/{project_id}/access/accept/", status_code=200)
+async def accept_project_invitation(
+    project_id: int,
+    user: UserOAuth = Depends(current_user_act_ver_prof),
+    db: AsyncSession = Depends(get_async_db),
+) -> Response:
+    """
+    Accept invitation to project `project_id`.
+    """
+    link = await get_pending_invitation_or_404(
+        user_id=user.id, project_id=project_id, db=db
+    )
+    link.is_verified = True
+    await db.commit()
+
+    return Response(status_code=status.HTTP_200_OK)
+
+
+@router.delete("/project/{project_id}/access/", status_code=204)
+async def leave_project(
+    project_id: int,
+    user: UserOAuth = Depends(current_user_act_ver_prof),
+    db: AsyncSession = Depends(get_async_db),
+) -> Response:
+    """
+    Decline invitation to project `project_id` or stop being a guest of that
+    project.
+    """
+    link = await get_link_or_404(user_id=user.id, project_id=project_id, db=db)
+
+    if link.is_owner:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+            detail=f"You are the owner of project {project_id}.",
+        )
+
+    await db.delete(link)
+    await db.commit()
+
+    return Response(status_code=status.HTTP_204_NO_CONTENT)

fractal_server/app/routes/api/v2/status_legacy.py

@@ -1,19 +1,19 @@
 from fastapi import APIRouter
 from fastapi import Depends
-from fastapi import HTTPException
-from fastapi import status
-
-from .....logger import set_logger
-from ....db import AsyncSession
-from ....db import get_async_db
-from ....models.v2 import JobV2
-from ....schemas.v2.status_legacy import LegacyStatusReadV2
-from ....schemas.v2.status_legacy import WorkflowTaskStatusTypeV2
-from ._aux_functions import _get_dataset_check_owner
-from ._aux_functions import _get_submitted_jobs_statement
-from ._aux_functions import _get_workflow_check_owner
+
+from fractal_server.app.db import AsyncSession
+from fractal_server.app.db import get_async_db
 from fractal_server.app.models import UserOAuth
+from fractal_server.app.models.v2 import JobV2
 from fractal_server.app.routes.auth import current_user_act_ver_prof
+from fractal_server.app.schemas.v2.sharing import ProjectPermissions
+from fractal_server.app.schemas.v2.status_legacy import LegacyStatusRead
+from fractal_server.app.schemas.v2.status_legacy import WorkflowTaskStatusType
+from fractal_server.logger import set_logger
+
+from ._aux_functions import _get_dataset_check_access
+from ._aux_functions import _get_submitted_jobs_statement
+from ._aux_functions import _get_workflow_check_access
 
 router = APIRouter()
 
@@ -22,7 +22,7 @@ logger = set_logger(__name__)
 
 @router.get(
     "/project/{project_id}/status-legacy/",
-    response_model=LegacyStatusReadV2,
+    response_model=LegacyStatusRead,
 )
 async def get_workflowtask_status(
     project_id: int,
@@ -30,7 +30,7 @@ async def get_workflowtask_status(
     workflow_id: int,
     user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
-) -> LegacyStatusReadV2 | None:
+) -> LegacyStatusRead | None:
     """
     Extract the status of all `WorkflowTaskV2` of a given `WorkflowV2` that ran
     on a given `DatasetV2`.
@@ -41,43 +41,33 @@ async def get_workflowtask_status(
     order). See fractal-server GitHub issues: 793, 1083.
     """
     # Get the dataset DB entry
-    output = await _get_dataset_check_owner(
+    output = await _get_dataset_check_access(
         project_id=project_id,
         dataset_id=dataset_id,
         user_id=user.id,
+        required_permissions=ProjectPermissions.READ,
         db=db,
     )
     dataset = output["dataset"]
 
     # Get the workflow DB entry
-    workflow = await _get_workflow_check_owner(
+    workflow = await _get_workflow_check_access(
         project_id=project_id,
         workflow_id=workflow_id,
         user_id=user.id,
+        required_permissions=ProjectPermissions.READ,
         db=db,
     )
 
     # Check whether there exists a submitted job associated to this
     # workflow/dataset pair. If it does exist, it will be used later.
     # If there are multiple jobs, raise an error.
-    stm = _get_submitted_jobs_statement()
-    stm = stm.where(JobV2.dataset_id == dataset_id)
-    stm = stm.where(JobV2.workflow_id == workflow_id)
-    res = await db.execute(stm)
-    running_jobs = res.scalars().all()
-    if len(running_jobs) == 0:
-        running_job = None
-    elif len(running_jobs) == 1:
-        running_job = running_jobs[0]
-    else:
-        string_ids = str([job.id for job in running_jobs])[1:-1]
-        raise HTTPException(
-            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
-            detail=(
-                f"Cannot get WorkflowTaskV2 statuses as DatasetV2 {dataset.id}"
-                f" is linked to multiple active jobs: {string_ids}."
-            ),
-        )
+    res = await db.execute(
+        _get_submitted_jobs_statement()
+        .where(JobV2.dataset_id == dataset_id)
+        .where(JobV2.workflow_id == workflow_id)
+    )
+    running_job = res.scalars().one_or_none()
 
     # Initialize empty dictionary for WorkflowTaskV2 status
     workflow_tasks_status_dict: dict = {}
@@ -112,19 +102,19 @@ async def get_workflowtask_status(
         ]
         try:
             first_submitted_index = running_job_statuses.index(
-                WorkflowTaskStatusTypeV2.SUBMITTED
+                WorkflowTaskStatusType.SUBMITTED
             )
         except ValueError:
             logger.warning(
                 f"Job {running_job.id} is submitted but its task list does not"
-                f" contain a {WorkflowTaskStatusTypeV2.SUBMITTED} task."
+                f" contain a {WorkflowTaskStatusType.SUBMITTED} task."
             )
             first_submitted_index = 0
 
         for wftask in running_job_wftasks[first_submitted_index:]:
-            workflow_tasks_status_dict[
-                wftask.id
-            ] = WorkflowTaskStatusTypeV2.SUBMITTED
+            workflow_tasks_status_dict[wftask.id] = (
+                WorkflowTaskStatusType.SUBMITTED
+            )
 
         # The last workflow task that is included in the submitted job is also
         # the positional-last workflow task to be included in the response.
@@ -153,7 +143,7 @@ async def get_workflowtask_status(
             # If a wftask ID was not found, ignore it and continue
             continue
         clean_workflow_tasks_status_dict[str(wf_task.id)] = wf_task_status
-        if wf_task_status == WorkflowTaskStatusTypeV2.FAILED:
+        if wf_task_status == WorkflowTaskStatusType.FAILED:
             # Starting from the beginning of `workflow.task_list`, stop the
             # first time that you hit a failed job
             break
@@ -162,5 +152,5 @@ async def get_workflowtask_status(
             # first time that you hit `last_valid_wftask_id``
             break
 
-    response_body = LegacyStatusReadV2(status=clean_workflow_tasks_status_dict)
+    response_body = LegacyStatusRead(status=clean_workflow_tasks_status_dict)
     return response_body