fractal-server 2.17.2__py3-none-any.whl → 2.18.0__py3-none-any.whl

fractal_server/app/routes/api/v2/job.py

@@ -18,14 +18,15 @@ from fractal_server.app.models.v2 import LinkUserProjectV2
 from fractal_server.app.routes.auth import current_user_act_ver_prof
 from fractal_server.app.routes.aux._job import _write_shutdown_file
 from fractal_server.app.routes.aux._runner import _check_shutdown_is_supported
-from fractal_server.app.schemas.v2 import JobReadV2
-from fractal_server.app.schemas.v2 import JobStatusTypeV2
+from fractal_server.app.schemas.v2 import JobRead
+from fractal_server.app.schemas.v2 import JobStatusType
+from fractal_server.app.schemas.v2.sharing import ProjectPermissions
 from fractal_server.runner.filenames import WORKFLOW_LOG_FILENAME
 from fractal_server.zip_tools import _zip_folder_to_byte_stream_iterator
 
-from ._aux_functions import _get_job_check_owner
-from ._aux_functions import _get_project_check_owner
-from ._aux_functions import _get_workflow_check_owner
+from ._aux_functions import _get_job_check_access
+from ._aux_functions import _get_project_check_access
+from ._aux_functions import _get_workflow_check_access
 
 
 # https://docs.python.org/3/library/asyncio-task.html#asyncio.to_thread
@@ -38,12 +39,12 @@ async def zip_folder_threaded(folder: str) -> Iterator[bytes]:
 router = APIRouter()
 
 
-@router.get("/job/", response_model=list[JobReadV2])
+@router.get("/job/", response_model=list[JobRead])
 async def get_user_jobs(
     user: UserOAuth = Depends(current_user_act_ver_prof),
     log: bool = True,
     db: AsyncSession = Depends(get_async_db),
-) -> list[JobReadV2]:
+) -> list[JobRead]:
     """
     Returns all the jobs of the current user
     """
@@ -53,6 +54,7 @@ async def get_user_jobs(
             LinkUserProjectV2, LinkUserProjectV2.project_id == JobV2.project_id
         )
         .where(LinkUserProjectV2.user_id == user.id)
+        .where(LinkUserProjectV2.is_owner.is_(True))
     )
     res = await db.execute(stm)
     job_list = res.scalars().all()
@@ -66,19 +68,23 @@ async def get_user_jobs(
 
 @router.get(
     "/project/{project_id}/workflow/{workflow_id}/job/",
-    response_model=list[JobReadV2],
+    response_model=list[JobRead],
 )
 async def get_workflow_jobs(
     project_id: int,
     workflow_id: int,
     user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
-) -> list[JobReadV2] | None:
+) -> list[JobRead] | None:
     """
     Returns all the jobs related to a specific workflow
     """
-    await _get_workflow_check_owner(
-        project_id=project_id, workflow_id=workflow_id, user_id=user.id, db=db
+    await _get_workflow_check_access(
+        project_id=project_id,
+        workflow_id=workflow_id,
+        user_id=user.id,
+        required_permissions=ProjectPermissions.READ,
+        db=db,
     )
     stm = select(JobV2).where(JobV2.workflow_id == workflow_id)
     res = await db.execute(stm)
@@ -93,9 +99,13 @@ async def get_latest_job(
     dataset_id: int,
     user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
-) -> JobReadV2:
-    await _get_workflow_check_owner(
-        project_id=project_id, workflow_id=workflow_id, user_id=user.id, db=db
+) -> JobRead:
+    await _get_workflow_check_access(
+        project_id=project_id,
+        workflow_id=workflow_id,
+        user_id=user.id,
+        required_permissions=ProjectPermissions.READ,
+        db=db,
     )
     stm = (
         select(JobV2)
@@ -117,7 +127,7 @@ async def get_latest_job(
 
 @router.get(
     "/project/{project_id}/job/{job_id}/",
-    response_model=JobReadV2,
+    response_model=JobRead,
 )
 async def read_job(
     project_id: int,
@@ -125,21 +135,22 @@ async def read_job(
     show_tmp_logs: bool = False,
     user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
-) -> JobReadV2 | None:
+) -> JobRead | None:
     """
     Return info on an existing job
     """
 
-    output = await _get_job_check_owner(
+    output = await _get_job_check_access(
         project_id=project_id,
         job_id=job_id,
         user_id=user.id,
+        required_permissions=ProjectPermissions.READ,
         db=db,
     )
     job = output["job"]
     await db.close()
 
-    if show_tmp_logs and (job.status == JobStatusTypeV2.SUBMITTED):
+    if show_tmp_logs and (job.status == JobStatusType.SUBMITTED):
         try:
             with open(f"{job.working_dir}/{WORKFLOW_LOG_FILENAME}") as f:
                 job.log = f.read()
@@ -162,10 +173,11 @@ async def download_job_logs(
     """
     Download zipped job folder
     """
-    output = await _get_job_check_owner(
+    output = await _get_job_check_access(
         project_id=project_id,
         job_id=job_id,
         user_id=user.id,
+        required_permissions=ProjectPermissions.READ,
         db=db,
     )
     job = output["job"]
@@ -182,19 +194,22 @@ async def download_job_logs(
 
 @router.get(
     "/project/{project_id}/job/",
-    response_model=list[JobReadV2],
+    response_model=list[JobRead],
 )
 async def get_job_list(
     project_id: int,
     user: UserOAuth = Depends(current_user_act_ver_prof),
     log: bool = True,
     db: AsyncSession = Depends(get_async_db),
-) -> list[JobReadV2] | None:
+) -> list[JobRead] | None:
     """
     Get job list for given project
     """
-    project = await _get_project_check_owner(
-        project_id=project_id, user_id=user.id, db=db
+    project = await _get_project_check_access(
+        project_id=project_id,
+        user_id=user.id,
+        required_permissions=ProjectPermissions.READ,
+        db=db,
     )
 
     stm = select(JobV2).where(JobV2.project_id == project.id)
@@ -225,10 +240,11 @@ async def stop_job(
     _check_shutdown_is_supported()
 
     # Get job from DB
-    output = await _get_job_check_owner(
+    output = await _get_job_check_access(
         project_id=project_id,
         job_id=job_id,
         user_id=user.id,
+        required_permissions=ProjectPermissions.EXECUTE,
         db=db,
     )
     job = output["job"]

fractal_server/app/routes/api/v2/pre_submission_checks.py

@@ -11,14 +11,15 @@ from fractal_server.app.models import UserOAuth
 from fractal_server.app.routes.auth import current_user_act_ver_prof
 from fractal_server.app.schemas.v2 import HistoryUnitStatus
 from fractal_server.app.schemas.v2 import TaskType
+from fractal_server.app.schemas.v2.sharing import ProjectPermissions
 from fractal_server.images.status_tools import IMAGE_STATUS_KEY
 from fractal_server.images.status_tools import enrich_images_unsorted_async
 from fractal_server.images.tools import aggregate_types
 from fractal_server.images.tools import filter_image_list
 from fractal_server.types import AttributeFilters
 
-from ._aux_functions import _get_dataset_check_owner
-from ._aux_functions import _get_workflow_task_check_owner
+from ._aux_functions import _get_dataset_check_access
+from ._aux_functions import _get_workflow_task_check_access
 from .images import ImageQuery
 
 router = APIRouter()
@@ -37,8 +38,12 @@ async def verify_unique_types(
     db: AsyncSession = Depends(get_async_db),
 ) -> list[str]:
     # Get dataset
-    output = await _get_dataset_check_owner(
-        project_id=project_id, dataset_id=dataset_id, user_id=user.id, db=db
+    output = await _get_dataset_check_access(
+        project_id=project_id,
+        dataset_id=dataset_id,
+        user_id=user.id,
+        required_permissions=ProjectPermissions.READ,
+        db=db,
     )
     dataset = output["dataset"]
 
@@ -97,11 +102,12 @@ async def check_non_processed_images(
     user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
 ) -> JSONResponse:
-    db_workflow_task, db_workflow = await _get_workflow_task_check_owner(
+    db_workflow_task, db_workflow = await _get_workflow_task_check_access(
         project_id=project_id,
         workflow_task_id=workflowtask_id,
         workflow_id=workflow_id,
         user_id=user.id,
+        required_permissions=ProjectPermissions.READ,
         db=db,
     )
 
@@ -121,10 +127,11 @@ async def check_non_processed_images(
         # Skip check if previous task is converter
         return JSONResponse(status_code=200, content=[])
 
-    res = await _get_dataset_check_owner(
+    res = await _get_dataset_check_access(
         project_id=project_id,
         dataset_id=dataset_id,
         user_id=user.id,
+        required_permissions=ProjectPermissions.READ,
         db=db,
     )
     dataset = res["dataset"]

fractal_server/app/routes/api/v2/project.py

@@ -15,21 +15,23 @@ from fractal_server.app.routes.auth import current_user_act_ver_prof
 from fractal_server.app.routes.aux.validate_user_profile import (
     validate_user_profile,
 )
-from fractal_server.app.schemas.v2 import ProjectCreateV2
-from fractal_server.app.schemas.v2 import ProjectReadV2
-from fractal_server.app.schemas.v2 import ProjectUpdateV2
-from fractal_server.logger import reset_logger_handlers
+from fractal_server.app.schemas.v2 import ProjectCreate
+from fractal_server.app.schemas.v2 import ProjectPermissions
+from fractal_server.app.schemas.v2 import ProjectRead
+from fractal_server.app.schemas.v2 import ProjectUpdate
 from fractal_server.logger import set_logger
 
 from ._aux_functions import _check_project_exists
-from ._aux_functions import _get_project_check_owner
+from ._aux_functions import _get_project_check_access
 from ._aux_functions import _get_submitted_jobs_statement
 
+logger = set_logger(__name__)
 router = APIRouter()
 
 
-@router.get("/project/", response_model=list[ProjectReadV2])
+@router.get("/project/", response_model=list[ProjectRead])
 async def get_list_project(
+    is_owner: bool = True,
     user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
 ) -> list[ProjectV2]:
@@ -40,6 +42,8 @@ async def get_list_project(
         select(ProjectV2)
         .join(LinkUserProjectV2, LinkUserProjectV2.project_id == ProjectV2.id)
         .where(LinkUserProjectV2.user_id == user.id)
+        .where(LinkUserProjectV2.is_owner == is_owner)
+        .where(LinkUserProjectV2.is_verified.is_(True))
     )
     res = await db.execute(stm)
     project_list = res.scalars().all()
@@ -47,12 +51,12 @@ async def get_list_project(
     return project_list
 
 
-@router.post("/project/", response_model=ProjectReadV2, status_code=201)
+@router.post("/project/", response_model=ProjectRead, status_code=201)
 async def create_project(
-    project: ProjectCreateV2,
+    project: ProjectCreate,
     user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
-) -> ProjectReadV2 | None:
+) -> ProjectRead | None:
     """
     Create new project
     """
@@ -73,7 +77,13 @@ async def create_project(
     db.add(db_project)
     await db.flush()
 
-    link = LinkUserProjectV2(project_id=db_project.id, user_id=user.id)
+    link = LinkUserProjectV2(
+        project_id=db_project.id,
+        user_id=user.id,
+        is_owner=True,
+        is_verified=True,
+        permissions=ProjectPermissions.EXECUTE,
+    )
     db.add(link)
 
     await db.commit()
@@ -82,31 +92,37 @@ async def create_project(
     return db_project
 
 
-@router.get("/project/{project_id}/", response_model=ProjectReadV2)
+@router.get("/project/{project_id}/", response_model=ProjectRead)
 async def read_project(
     project_id: int,
     user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
-) -> ProjectReadV2 | None:
+) -> ProjectRead | None:
     """
     Return info on an existing project
     """
-    project = await _get_project_check_owner(
-        project_id=project_id, user_id=user.id, db=db
+    project = await _get_project_check_access(
+        project_id=project_id,
+        user_id=user.id,
+        required_permissions=ProjectPermissions.READ,
+        db=db,
     )
     await db.close()
     return project
 
 
-@router.patch("/project/{project_id}/", response_model=ProjectReadV2)
+@router.patch("/project/{project_id}/", response_model=ProjectRead)
 async def update_project(
     project_id: int,
-    project_update: ProjectUpdateV2,
+    project_update: ProjectUpdate,
     user: UserOAuth = Depends(current_user_act_ver_prof),
     db: AsyncSession = Depends(get_async_db),
 ):
-    project = await _get_project_check_owner(
-        project_id=project_id, user_id=user.id, db=db
+    project = await _get_project_check_access(
+        project_id=project_id,
+        user_id=user.id,
+        required_permissions=ProjectPermissions.WRITE,
+        db=db,
     )
 
     # Check that there is no project with the same user and name
@@ -134,10 +150,18 @@ async def delete_project(
     Delete project
     """
 
-    project = await _get_project_check_owner(
-        project_id=project_id, user_id=user.id, db=db
+    project = await _get_project_check_access(
+        project_id=project_id,
+        user_id=user.id,
+        required_permissions=ProjectPermissions.EXECUTE,
+        db=db,
     )
-    logger = set_logger(__name__)
+    link_user_project = await db.get(LinkUserProjectV2, (project_id, user.id))
+    if not link_user_project.is_owner:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only the owner can delete a Project.",
+        )
 
     # Fail if there exist jobs that are submitted and in relation with the
     # current project.
@@ -154,13 +178,12 @@ async def delete_project(
             ),
         )
 
-    logger.info(f"Adding Project[{project.id}] to deletion.")
+    logger.debug(f"Add project {project.id} to deletion.")
     await db.delete(project)
 
-    logger.info("Committing changes to db...")
+    logger.debug("Commit changes to db")
     await db.commit()
 
-    logger.info("Everything  has been deleted correctly.")
-    reset_logger_handlers(logger)
+    logger.debug("Everything  has been deleted correctly.")
 
     return Response(status_code=status.HTTP_204_NO_CONTENT)

fractal_server/app/routes/api/v2/sharing.py

@@ -0,0 +1,311 @@
+from fastapi import APIRouter
+from fastapi import Depends
+from fastapi import HTTPException
+from fastapi import Response
+from fastapi import status
+from pydantic import EmailStr
+from sqlmodel import select
+
+from fractal_server.app.db import AsyncSession
+from fractal_server.app.db import get_async_db
+from fractal_server.app.models import UserOAuth
+from fractal_server.app.models.v2 import LinkUserProjectV2
+from fractal_server.app.models.v2 import ProjectV2
+from fractal_server.app.routes.auth import current_user_act_ver_prof
+from fractal_server.app.schemas.v2 import ProjectAccessRead
+from fractal_server.app.schemas.v2 import ProjectGuestCreate
+from fractal_server.app.schemas.v2 import ProjectGuestRead
+from fractal_server.app.schemas.v2 import ProjectGuestUpdate
+from fractal_server.app.schemas.v2 import ProjectInvitationRead
+
+from ._aux_functions_sharing import get_link_or_404
+from ._aux_functions_sharing import get_pending_invitation_or_404
+from ._aux_functions_sharing import get_user_id_from_email_or_404
+from ._aux_functions_sharing import raise_403_if_not_owner
+from ._aux_functions_sharing import raise_422_if_link_exists
+
+router = APIRouter()
+
+
+@router.get(
+    "/project/{project_id}/guest/",
+    response_model=list[ProjectGuestRead],
+)
+async def get_project_guests(
+    project_id: int,
+    owner: UserOAuth = Depends(current_user_act_ver_prof),
+    db: AsyncSession = Depends(get_async_db),
+) -> list[ProjectGuestRead]:
+    """
+    Get the list of all the guests of your project (verified or not).
+    """
+    await raise_403_if_not_owner(user_id=owner.id, project_id=project_id, db=db)
+    # Get (email, is_verified, permissions) for all guests
+    res = await db.execute(
+        select(
+            UserOAuth.email,
+            LinkUserProjectV2.is_verified,
+            LinkUserProjectV2.permissions,
+        )
+        .join(LinkUserProjectV2, LinkUserProjectV2.user_id == UserOAuth.id)
+        .where(LinkUserProjectV2.project_id == project_id)
+        .where(LinkUserProjectV2.is_owner.is_(False))
+        .order_by(UserOAuth.email)
+    )
+    guest_tuples = res.all()
+    return [
+        dict(
+            email=guest_email,
+            is_verified=is_verified,
+            permissions=permissions,
+        )
+        for guest_email, is_verified, permissions in guest_tuples
+    ]
+
+
+@router.post("/project/{project_id}/guest/", status_code=201)
+async def invite_guest(
+    project_id: int,
+    email: EmailStr,
+    project_invitation: ProjectGuestCreate,
+    owner: UserOAuth = Depends(current_user_act_ver_prof),
+    db: AsyncSession = Depends(get_async_db),
+) -> Response:
+    """
+    Add a guest to your project.
+    """
+    await raise_403_if_not_owner(user_id=owner.id, project_id=project_id, db=db)
+
+    guest_id = await get_user_id_from_email_or_404(user_email=email, db=db)
+
+    await raise_422_if_link_exists(
+        user_id=guest_id,
+        project_id=project_id,
+        db=db,
+    )
+
+    db.add(
+        LinkUserProjectV2(
+            project_id=project_id,
+            user_id=guest_id,
+            is_owner=False,
+            is_verified=False,
+            permissions=project_invitation.permissions,
+        )
+    )
+    await db.commit()
+
+    return Response(status_code=status.HTTP_201_CREATED)
+
+
+@router.patch("/project/{project_id}/guest/", status_code=200)
+async def patch_guest(
+    project_id: int,
+    email: EmailStr,
+    update: ProjectGuestUpdate,
+    owner: UserOAuth = Depends(current_user_act_ver_prof),
+    db: AsyncSession = Depends(get_async_db),
+) -> Response:
+    """
+    Change guest's permissions on your project.
+    """
+    await raise_403_if_not_owner(user_id=owner.id, project_id=project_id, db=db)
+
+    guest_id = await get_user_id_from_email_or_404(user_email=email, db=db)
+
+    if guest_id == owner.id:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+            detail="Cannot perform this operation on project owner.",
+        )
+
+    link = await get_link_or_404(
+        user_id=guest_id,
+        project_id=project_id,
+        db=db,
+    )
+
+    # Update link and commit
+    for key, value in update.model_dump(exclude_unset=True).items():
+        setattr(link, key, value)
+    await db.commit()
+
+    return Response(status_code=status.HTTP_200_OK)
+
+
+@router.delete("/project/{project_id}/guest/", status_code=204)
+async def revoke_guest_access(
+    project_id: int,
+    email: EmailStr,
+    owner: UserOAuth = Depends(current_user_act_ver_prof),
+    db: AsyncSession = Depends(get_async_db),
+) -> Response:
+    """
+    Remove a guest from your project.
+    """
+    await raise_403_if_not_owner(user_id=owner.id, project_id=project_id, db=db)
+
+    guest_id = await get_user_id_from_email_or_404(user_email=email, db=db)
+
+    if guest_id == owner.id:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+            detail="Cannot perform this operation on project owner.",
+        )
+
+    link = await get_link_or_404(
+        user_id=guest_id,
+        project_id=project_id,
+        db=db,
+    )
+
+    # Delete link and commit
+    await db.delete(link)
+    await db.commit()
+
+    return Response(status_code=status.HTTP_204_NO_CONTENT)
+
+
+@router.get(
+    "/project/invitation/",
+    response_model=list[ProjectInvitationRead],
+)
+async def get_pending_invitations(
+    user: UserOAuth = Depends(current_user_act_ver_prof),
+    db: AsyncSession = Depends(get_async_db),
+) -> list[ProjectInvitationRead]:
+    """
+    See your current invitations.
+    """
+
+    res = await db.execute(
+        select(
+            ProjectV2.id,
+            ProjectV2.name,
+            LinkUserProjectV2.permissions,
+            (
+                select(UserOAuth.email)
+                .join(
+                    LinkUserProjectV2,
+                    UserOAuth.id == LinkUserProjectV2.user_id,
+                )
+                .where(LinkUserProjectV2.is_owner.is_(True))
+                .where(LinkUserProjectV2.project_id == ProjectV2.id)
+                .scalar_subquery()
+                .correlate(ProjectV2)
+            ),
+        )
+        .join(LinkUserProjectV2, LinkUserProjectV2.project_id == ProjectV2.id)
+        .where(LinkUserProjectV2.user_id == user.id)
+        .where(LinkUserProjectV2.is_verified.is_(False))
+        .order_by(ProjectV2.name)
+    )
+
+    guest_project_info = res.all()
+
+    return [
+        dict(
+            project_id=project_id,
+            project_name=project_name,
+            guest_permissions=guest_permissions,
+            owner_email=owner_email,
+        )
+        for (
+            project_id,
+            project_name,
+            guest_permissions,
+            owner_email,
+        ) in guest_project_info
+    ]
+
+
+@router.get(
+    "/project/{project_id}/access/",
+    response_model=ProjectAccessRead,
+)
+async def get_access_info(
+    project_id: int,
+    user: UserOAuth = Depends(current_user_act_ver_prof),
+    db: AsyncSession = Depends(get_async_db),
+) -> ProjectAccessRead:
+    """
+    Returns information on your relationship with Project[`project_id`].
+    """
+
+    res = await db.execute(
+        select(
+            LinkUserProjectV2.is_owner,
+            LinkUserProjectV2.permissions,
+            (
+                select(UserOAuth.email)
+                .join(
+                    LinkUserProjectV2,
+                    UserOAuth.id == LinkUserProjectV2.user_id,
+                )
+                .where(LinkUserProjectV2.is_owner.is_(True))
+                .where(LinkUserProjectV2.project_id == project_id)
+                .scalar_subquery()
+            ),
+        )
+        .where(LinkUserProjectV2.project_id == project_id)
+        .where(LinkUserProjectV2.user_id == user.id)
+        .where(LinkUserProjectV2.is_verified.is_(True))
+    )
+
+    guest_project_info = res.one_or_none()
+
+    if guest_project_info is None:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail=f"User has no access to project {project_id}.",
+        )
+
+    is_owner, permissions, owner_email = guest_project_info
+
+    return dict(
+        is_owner=is_owner,
+        permissions=permissions,
+        owner_email=owner_email,
+    )
+
+
+@router.post("/project/{project_id}/access/accept/", status_code=200)
+async def accept_project_invitation(
+    project_id: int,
+    user: UserOAuth = Depends(current_user_act_ver_prof),
+    db: AsyncSession = Depends(get_async_db),
+) -> Response:
+    """
+    Accept invitation to project `project_id`.
+    """
+    link = await get_pending_invitation_or_404(
+        user_id=user.id, project_id=project_id, db=db
+    )
+    link.is_verified = True
+    await db.commit()
+
+    return Response(status_code=status.HTTP_200_OK)
+
+
+@router.delete("/project/{project_id}/access/", status_code=204)
+async def leave_project(
+    project_id: int,
+    user: UserOAuth = Depends(current_user_act_ver_prof),
+    db: AsyncSession = Depends(get_async_db),
+) -> Response:
+    """
+    Decline invitation to project `project_id` or stop being a guest of that
+    project.
+    """
+    link = await get_link_or_404(user_id=user.id, project_id=project_id, db=db)
+
+    if link.is_owner:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+            detail=f"You are the owner of project {project_id}.",
+        )
+
+    await db.delete(link)
+    await db.commit()
+
+    return Response(status_code=status.HTTP_204_NO_CONTENT)