fractal-server 2.17.2__py3-none-any.whl → 2.18.0__py3-none-any.whl

fractal_server/app/routes/api/v2/_aux_functions.py

@@ -3,11 +3,10 @@ Auxiliary functions to get object from the database or perform simple checks
 """
 
 from typing import Any
-from typing import Literal
+from typing import TypedDict
 
 from fastapi import HTTPException
 from fastapi import status
-from sqlalchemy.exc import MultipleResultsFound
 from sqlalchemy.orm.attributes import flag_modified
 from sqlmodel import select
 from sqlmodel.sql.expression import SelectOfScalar
@@ -23,16 +22,18 @@ from fractal_server.app.models.v2 import ProjectV2
 from fractal_server.app.models.v2 import TaskV2
 from fractal_server.app.models.v2 import WorkflowTaskV2
 from fractal_server.app.models.v2 import WorkflowV2
-from fractal_server.app.schemas.v2 import JobStatusTypeV2
+from fractal_server.app.schemas.v2 import JobStatusType
+from fractal_server.app.schemas.v2 import ProjectPermissions
 from fractal_server.logger import set_logger
 
 logger = set_logger(__name__)
 
 
-async def _get_project_check_owner(
+async def _get_project_check_access(
     *,
     project_id: int,
     user_id: int,
+    required_permissions: ProjectPermissions,
     db: AsyncSession,
 ) -> ProjectV2:
     """
@@ -41,6 +42,7 @@ async def _get_project_check_owner(
     Args:
         project_id:
         user_id:
+        required_permissions:
         db:
 
     Returns:
@@ -48,31 +50,42 @@ async def _get_project_check_owner(
 
     Raises:
         HTTPException(status_code=403_FORBIDDEN):
-            If the user is not a member of the project
+            - If the user is not a member of the project;
+            - If the user has not accepted the invitation yet;
+            - If the user has not the target permissions.
         HTTPException(status_code=404_NOT_FOUND):
             If the project does not exist
     """
     project = await db.get(ProjectV2, project_id)
-
-    link_user_project = await db.get(LinkUserProjectV2, (project_id, user_id))
-    if not project:
+    if project is None:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND, detail="Project not found"
         )
-    if not link_user_project:
+
+    link_user_project = await db.get(LinkUserProjectV2, (project_id, user_id))
+    if (
+        link_user_project is None
+        or not link_user_project.is_verified
+        or required_permissions not in link_user_project.permissions
+    ):
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
-            detail=f"Not allowed on project {project_id}",
+            detail=(
+                "You are not authorized to perform this action. "
+                "If you think this is by mistake, "
+                "please contact the project owner."
+            ),
         )
 
     return project
 
 
-async def _get_workflow_check_owner(
+async def _get_workflow_check_access(
     *,
     workflow_id: int,
     project_id: int,
     user_id: int,
+    required_permissions: ProjectPermissions,
     db: AsyncSession,
 ) -> WorkflowV2:
     """
@@ -96,8 +109,11 @@ async def _get_workflow_check_owner(
     """
 
     # Access control for project
-    await _get_project_check_owner(
-        project_id=project_id, user_id=user_id, db=db
+    await _get_project_check_access(
+        project_id=project_id,
+        user_id=user_id,
+        required_permissions=required_permissions,
+        db=db,
     )
 
     res = await db.execute(
@@ -116,12 +132,13 @@ async def _get_workflow_check_owner(
     return workflow
 
 
-async def _get_workflow_task_check_owner(
+async def _get_workflow_task_check_access(
     *,
     project_id: int,
     workflow_id: int,
     workflow_task_id: int,
     user_id: int,
+    required_permissions: ProjectPermissions,
     db: AsyncSession,
 ) -> tuple[WorkflowTaskV2, WorkflowV2]:
     """
@@ -146,10 +163,11 @@ async def _get_workflow_task_check_owner(
     """
 
     # Access control for workflow
-    workflow = await _get_workflow_check_owner(
+    workflow = await _get_workflow_check_access(
         workflow_id=workflow_id,
         project_id=project_id,
         user_id=user_id,
+        required_permissions=required_permissions,
         db=db,
     )
 
@@ -223,6 +241,7 @@ async def _check_project_exists(
         .join(LinkUserProjectV2, LinkUserProjectV2.project_id == ProjectV2.id)
         .where(ProjectV2.name == project_name)
         .where(LinkUserProjectV2.user_id == user_id)
+        .where(LinkUserProjectV2.is_owner.is_(True))
     )
     res = await db.execute(stm)
     if res.scalars().all():
@@ -232,13 +251,19 @@ async def _check_project_exists(
         )
 
 
-async def _get_dataset_check_owner(
+class DatasetOrProject(TypedDict):
+    dataset: DatasetV2
+    project: ProjectV2
+
+
+async def _get_dataset_check_access(
     *,
     project_id: int,
     dataset_id: int,
     user_id: int,
+    required_permissions: ProjectPermissions,
     db: AsyncSession,
-) -> dict[Literal["dataset", "project"], DatasetV2 | ProjectV2]:
+) -> DatasetOrProject:
     """
     Get a dataset and a project, after access control on the project
 
@@ -260,8 +285,11 @@ async def _get_dataset_check_owner(
             If the user is not a member of the project
     """
     # Access control for project
-    project = await _get_project_check_owner(
-        project_id=project_id, user_id=user_id, db=db
+    project = await _get_project_check_access(
+        project_id=project_id,
+        user_id=user_id,
+        required_permissions=required_permissions,
+        db=db,
     )
 
     res = await db.execute(
@@ -280,13 +308,19 @@ async def _get_dataset_check_owner(
     return dict(dataset=dataset, project=project)
 
 
-async def _get_job_check_owner(
+class JobAndProject(TypedDict):
+    job: JobV2
+    project: ProjectV2
+
+
+async def _get_job_check_access(
     *,
     project_id: int,
     job_id: int,
     user_id: int,
+    required_permissions: ProjectPermissions,
     db: AsyncSession,
-) -> dict[Literal["job", "project"], JobV2 | ProjectV2]:
+) -> JobAndProject:
     """
     Get a job and a project, after access control on the project
 
@@ -308,9 +342,10 @@ async def _get_job_check_owner(
             If the user is not a member of the project
     """
     # Access control for project
-    project = await _get_project_check_owner(
+    project = await _get_project_check_access(
         project_id=project_id,
         user_id=user_id,
+        required_permissions=required_permissions,
         db=db,
     )
 
@@ -335,7 +370,7 @@ def _get_submitted_jobs_statement() -> SelectOfScalar:
         A sqlmodel statement that selects all `Job`s with
         `Job.status` equal to `submitted`.
     """
-    stm = select(JobV2).where(JobV2.status == JobStatusTypeV2.SUBMITTED)
+    stm = select(JobV2).where(JobV2.status == JobStatusType.SUBMITTED)
     return stm
 
 
@@ -345,7 +380,7 @@ async def _workflow_has_submitted_job(
 ) -> bool:
     res = await db.execute(
         select(JobV2.id)
-        .where(JobV2.status == JobStatusTypeV2.SUBMITTED)
+        .where(JobV2.status == JobStatusType.SUBMITTED)
         .where(JobV2.workflow_id == workflow_id)
         .limit(1)
     )
@@ -427,8 +462,9 @@ async def _workflow_insert_task(
     return wf_task
 
 
-async def clean_app_job_list_v2(
-    db: AsyncSession, jobs_list: list[int]
+async def clean_app_job_list(
+    db: AsyncSession,
+    jobs_list: list[int],
 ) -> list[int]:
     """
     Remove from a job list all jobs with status different from submitted.
@@ -440,14 +476,14 @@ async def clean_app_job_list_v2(
     Return:
         List of IDs for submitted jobs.
     """
+    logger.info(f"[clean_app_job_list] START - {jobs_list=}.")
     stmt = select(JobV2).where(JobV2.id.in_(jobs_list))
     result = await db.execute(stmt)
     db_jobs_list = result.scalars().all()
     submitted_job_ids = [
-        job.id
-        for job in db_jobs_list
-        if job.status == JobStatusTypeV2.SUBMITTED
+        job.id for job in db_jobs_list if job.status == JobStatusType.SUBMITTED
     ]
+    logger.info(f"[clean_app_job_list] END - {submitted_job_ids=}.")
     return submitted_job_ids
 
 
@@ -517,41 +553,6 @@ async def _get_workflowtask_or_404(
         return wftask
 
 
-async def _get_submitted_job_or_none(
-    *,
-    dataset_id: int,
-    workflow_id: int,
-    db: AsyncSession,
-) -> JobV2 | None:
-    """
-    Get the submitted job for given dataset/workflow, if any.
-
-    This function also handles the invalid branch where more than one job
-    is found.
-
-    Args:
-        dataset_id:
-        workflow_id:
-        db:
-    """
-    res = await db.execute(
-        _get_submitted_jobs_statement()
-        .where(JobV2.dataset_id == dataset_id)
-        .where(JobV2.workflow_id == workflow_id)
-    )
-    try:
-        return res.scalars().one_or_none()
-    except MultipleResultsFound as e:
-        error_msg = (
-            f"Multiple running jobs found for {dataset_id=} and {workflow_id=}."
-        )
-        logger.error(f"{error_msg} Original error: {str(e)}.")
-        raise HTTPException(
-            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
-            detail=error_msg,
-        )
-
-
 async def _get_user_resource_id(user_id: int, db: AsyncSession) -> int | None:
     res = await db.execute(
         select(Resource.id)

fractal_server/app/routes/api/v2/_aux_functions_history.py

@@ -13,12 +13,13 @@ from fractal_server.app.models.v2 import HistoryUnit
 from fractal_server.app.models.v2 import WorkflowV2
 from fractal_server.app.routes.api.v2._aux_functions import _get_dataset_or_404
 from fractal_server.app.routes.api.v2._aux_functions import (
-    _get_project_check_owner,
+    _get_project_check_access,
 )
 from fractal_server.app.routes.api.v2._aux_functions import _get_workflow_or_404
 from fractal_server.app.routes.api.v2._aux_functions import (
     _get_workflowtask_or_404,
 )
+from fractal_server.app.schemas.v2.sharing import ProjectPermissions
 from fractal_server.logger import set_logger
 from fractal_server.zip_tools import _read_single_file_from_zip
 
@@ -119,6 +120,7 @@ async def _verify_workflow_and_dataset_access(
     workflow_id: int,
     dataset_id: int,
     user_id: int,
+    required_permissions: ProjectPermissions,
     db: AsyncSession,
 ) -> dict[Literal["dataset", "workflow"], DatasetV2 | WorkflowV2]:
     """
@@ -131,9 +133,10 @@ async def _verify_workflow_and_dataset_access(
         user_id:
         db:
     """
-    await _get_project_check_owner(
+    await _get_project_check_access(
         project_id=project_id,
         user_id=user_id,
+        required_permissions=required_permissions,
         db=db,
     )
     workflow = await _get_workflow_or_404(
@@ -158,12 +161,13 @@ async def _verify_workflow_and_dataset_access(
     return dict(dataset=dataset, workflow=workflow)
 
 
-async def get_wftask_check_owner(
+async def get_wftask_check_access(
     *,
     project_id: int,
     dataset_id: int,
     workflowtask_id: int,
     user_id: int,
+    required_permissions: ProjectPermissions,
     db: AsyncSession,
 ) -> WorkflowTaskV2:
     """
@@ -184,6 +188,7 @@ async def get_wftask_check_owner(
         project_id=project_id,
         dataset_id=dataset_id,
         workflow_id=wftask.workflow_id,
+        required_permissions=required_permissions,
         user_id=user_id,
         db=db,
     )

fractal_server/app/routes/api/v2/_aux_functions_sharing.py

@@ -0,0 +1,97 @@
+from fastapi import HTTPException
+from fastapi import status
+from sqlmodel import select
+
+from fractal_server.app.db import AsyncSession
+from fractal_server.app.models import UserOAuth
+from fractal_server.app.models.v2 import LinkUserProjectV2
+
+
+async def raise_403_if_not_owner(
+    *,
+    user_id: int,
+    project_id: int,
+    db: AsyncSession,
+) -> None:
+    """
+    Raises 403 if User[`user_id`] is not owner of Project[`project_id`],
+    regardless of whether the User or Project exists.
+    """
+    res = await db.execute(
+        select(LinkUserProjectV2)
+        .where(LinkUserProjectV2.project_id == project_id)
+        .where(LinkUserProjectV2.user_id == user_id)
+        .where(LinkUserProjectV2.is_owner.is_(True))
+    )
+    link = res.scalars().one_or_none()
+    if link is None:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Current user is not the project owner.",
+        )
+    return link
+
+
+async def get_link_or_404(
+    *, user_id: int, project_id: int, db: AsyncSession
+) -> LinkUserProjectV2:
+    """
+    Raises 404 if User[`user_id`] is not linked to Project[`project_id`],
+    regardless of whether the User or Project exists.
+    """
+    link = await db.get(LinkUserProjectV2, (project_id, user_id))
+    if link is None:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="User is not linked to project.",
+        )
+    return link
+
+
+async def get_pending_invitation_or_404(
+    *, user_id: int, project_id: int, db: AsyncSession
+) -> LinkUserProjectV2:
+    """
+    Raises 404 if User[`user_id`] has not a pending invitation to
+    Project[`project_id`], regardless of whether the User or Project exists.
+    """
+    link = await get_link_or_404(user_id=user_id, project_id=project_id, db=db)
+    if link.is_verified:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="No pending invitation for user on this project.",
+        )
+    return link
+
+
+async def raise_422_if_link_exists(
+    *, user_id: int, project_id: int, db: AsyncSession
+) -> None:
+    """
+    Raises 422 if User[`user_id`] is linked Project[`project_id`], regardless
+    of whether the User or Project exists.
+    """
+    link = await db.get(LinkUserProjectV2, (project_id, user_id))
+    if link is not None:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+            detail="User is already associated to project.",
+        )
+    return
+
+
+async def get_user_id_from_email_or_404(
+    *, user_email: str, db: AsyncSession
+) -> int:
+    """
+    Raises 404 if there is no User with email `user_email`.
+    """
+    res = await db.execute(
+        select(UserOAuth.id).where(UserOAuth.email == user_email)
+    )
+    user_id = res.scalar_one_or_none()
+    if user_id is None:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND, detail="User not found."
+        )
+    return user_id

fractal_server/app/routes/api/v2/_aux_functions_task_lifecycle.py

@@ -14,8 +14,8 @@ from fractal_server.app.models.v2 import TaskGroupV2
 from fractal_server.app.models.v2 import TaskV2
 from fractal_server.app.models.v2 import WorkflowTaskV2
 from fractal_server.app.models.v2 import WorkflowV2
-from fractal_server.app.schemas.v2 import JobStatusTypeV2
-from fractal_server.app.schemas.v2 import TaskGroupActivityStatusV2
+from fractal_server.app.schemas.v2 import JobStatusType
+from fractal_server.app.schemas.v2 import TaskGroupActivityStatus
 from fractal_server.logger import set_logger
 from fractal_server.tasks.v2.utils_package_names import normalize_package_name
 
@@ -171,7 +171,7 @@ async def check_no_ongoing_activity(
     stm = (
         select(TaskGroupActivityV2)
         .where(TaskGroupActivityV2.taskgroupv2_id == task_group_id)
-        .where(TaskGroupActivityV2.status == TaskGroupActivityStatusV2.ONGOING)
+        .where(TaskGroupActivityV2.status == TaskGroupActivityStatus.ONGOING)
     )
     res = await db.execute(stm)
     ongoing_activities = res.scalars().all()
@@ -213,7 +213,7 @@ async def check_no_submitted_job(
         .join(TaskV2, WorkflowTaskV2.task_id == TaskV2.id)
         .where(WorkflowTaskV2.order >= JobV2.first_task_index)
         .where(WorkflowTaskV2.order <= JobV2.last_task_index)
-        .where(JobV2.status == JobStatusTypeV2.SUBMITTED)
+        .where(JobV2.status == JobStatusType.SUBMITTED)
         .where(TaskV2.taskgroupv2_id == task_group_id)
     )
     res = await db.execute(stm)

fractal_server/app/routes/api/v2/_aux_functions_tasks.py

@@ -27,7 +27,7 @@ from fractal_server.app.routes.auth._aux_auth import (
 from fractal_server.app.routes.auth._aux_auth import (
     _verify_user_belongs_to_group,
 )
-from fractal_server.app.schemas.v2 import TaskGroupActivityActionV2
+from fractal_server.app.schemas.v2 import TaskGroupActivityAction
 from fractal_server.images.tools import merge_type_filters
 from fractal_server.logger import set_logger
 
@@ -252,7 +252,7 @@ async def _get_collection_task_group_activity_status_message(
     res = await db.execute(
         select(TaskGroupActivityV2)
         .where(TaskGroupActivityV2.taskgroupv2_id == task_group_id)
-        .where(TaskGroupActivityV2.action == TaskGroupActivityActionV2.COLLECT)
+        .where(TaskGroupActivityV2.action == TaskGroupActivityAction.COLLECT)
     )
     task_group_activity_list = res.scalars().all()
     if len(task_group_activity_list) > 1: