fractal-server 2.17.2__tar.gz → 2.18.0a0__tar.gz

{fractal_server-2.17.2 → fractal_server-2.18.0a0}/PKG-INFO

@@ -1,16 +1,17 @@
 Metadata-Version: 2.4
 Name: fractal-server
-Version: 2.17.2
+Version: 2.18.0a0
 Summary: Backend component of the Fractal analytics platform
 License-Expression: BSD-3-Clause
 License-File: LICENSE
 Author: Tommaso Comparin
 Author-email: tommaso.comparin@exact-lab.it
-Requires-Python: >=3.11,<3.14
+Requires-Python: >=3.11,<3.15
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Requires-Dist: alembic (>=1.13.1,<2.0.0)
 Requires-Dist: fabric (>=3.2.2,<3.3.0)
 Requires-Dist: fastapi (>=0.120.0,<0.121.0)

fractal_server-2.18.0a0/fractal_server/__init__.py

@@ -0,0 +1 @@
+__VERSION__ = "2.18.0a0"

fractal_server-2.18.0a0/fractal_server/app/models/linkuserproject.py

@@ -0,0 +1,53 @@
+from sqlmodel import BOOLEAN
+from sqlmodel import CheckConstraint
+from sqlmodel import Column
+from sqlmodel import Field
+from sqlmodel import Index
+from sqlmodel import SQLModel
+from sqlmodel import String
+from sqlmodel import column
+
+
+class LinkUserProjectV2(SQLModel, table=True):
+    """
+    Crossing table between User and ProjectV2
+    """
+
+    project_id: int = Field(
+        foreign_key="projectv2.id", primary_key=True, ondelete="CASCADE"
+    )
+    user_id: int = Field(foreign_key="user_oauth.id", primary_key=True)
+
+    # TODO-2.18.1 drop server_default
+    is_owner: bool = Field(
+        sa_column=Column(BOOLEAN, server_default="true", nullable=False)
+    )
+    # TODO-2.18.1 drop server_default
+    is_verified: bool = Field(
+        sa_column=Column(BOOLEAN, server_default="true", nullable=False)
+    )
+    # TODO-2.18.1 drop server_default
+    permissions: str = Field(
+        sa_column=Column(String, server_default="'rwx'", nullable=False)
+    )
+
+    __table_args__ = (
+        Index(
+            "ix_linkuserprojectv2_one_owner_per_project",
+            "project_id",
+            unique=True,
+            postgresql_where=column("is_owner").is_(True),
+        ),
+        CheckConstraint(
+            "NOT (is_owner AND NOT is_verified)",
+            name="owner_is_verified",
+        ),
+        CheckConstraint(
+            "NOT (is_owner AND permissions <> 'rwx')",
+            name="owner_full_permissions",
+        ),
+        CheckConstraint(
+            "permissions IN ('r', 'rw', 'rwx')",
+            name="valid_permissions",
+        ),
+    )

{fractal_server-2.17.2 → fractal_server-2.18.0a0}/fractal_server/app/routes/admin/v2/__init__.py

@@ -9,6 +9,7 @@ from .impersonate import router as impersonate_router
 from .job import router as job_router
 from .profile import router as profile_router
 from .resource import router as resource_router
+from .sharing import router as sharing_router
 from .task import router as task_router
 from .task_group import router as task_group_router
 from .task_group_lifecycle import router as task_group_lifecycle_router
@@ -25,3 +26,4 @@ router_admin_v2.include_router(
 router_admin_v2.include_router(impersonate_router, prefix="/impersonate")
 router_admin_v2.include_router(resource_router, prefix="/resource")
 router_admin_v2.include_router(profile_router, prefix="/profile")
+router_admin_v2.include_router(sharing_router, prefix="/linkuserproject")

{fractal_server-2.17.2 → fractal_server-2.18.0a0}/fractal_server/app/routes/admin/v2/job.py

@@ -56,6 +56,7 @@ async def view_job(
 
     Args:
         id: If not `None`, select a given `applyworkflow.id`.
+        user_id:
         project_id: If not `None`, select a given `applyworkflow.project_id`.
         dataset_id: If not `None`, select a given
             `applyworkflow.input_dataset_id`.
@@ -84,12 +85,22 @@ async def view_job(
         stm = stm.where(JobV2.id == id)
         stm_count = stm_count.where(JobV2.id == id)
     if user_id is not None:
-        stm = stm.join(
-            LinkUserProjectV2, LinkUserProjectV2.project_id == JobV2.project_id
-        ).where(LinkUserProjectV2.user_id == user_id)
-        stm_count = stm_count.join(
-            LinkUserProjectV2, LinkUserProjectV2.project_id == JobV2.project_id
-        ).where(LinkUserProjectV2.user_id == user_id)
+        stm = (
+            stm.join(
+                LinkUserProjectV2,
+                LinkUserProjectV2.project_id == JobV2.project_id,
+            )
+            .where(LinkUserProjectV2.user_id == user_id)
+            .where(LinkUserProjectV2.is_owner.is_(True))
+        )
+        stm_count = (
+            stm_count.join(
+                LinkUserProjectV2,
+                LinkUserProjectV2.project_id == JobV2.project_id,
+            )
+            .where(LinkUserProjectV2.user_id == user_id)
+            .where(LinkUserProjectV2.is_owner.is_(True))
+        )
     if project_id is not None:
         stm = stm.where(JobV2.project_id == project_id)
         stm_count = stm_count.where(JobV2.project_id == project_id)

fractal_server-2.18.0a0/fractal_server/app/routes/admin/v2/sharing.py

@@ -0,0 +1,103 @@
+from fastapi import APIRouter
+from fastapi import Depends
+from sqlalchemy import func
+from sqlmodel import select
+
+from fractal_server.app.db import AsyncSession
+from fractal_server.app.db import get_async_db
+from fractal_server.app.models import LinkUserProjectV2
+from fractal_server.app.models import UserOAuth
+from fractal_server.app.models.v2 import ProjectV2
+from fractal_server.app.routes.auth import current_superuser_act
+from fractal_server.app.routes.pagination import PaginationRequest
+from fractal_server.app.routes.pagination import PaginationResponse
+from fractal_server.app.routes.pagination import get_pagination_params
+from fractal_server.app.schemas.v2 import LinkUserProjectRead
+
+router = APIRouter()
+
+
+@router.get("/", response_model=PaginationResponse[LinkUserProjectRead])
+async def view_link_user_project(
+    # User info
+    user_id: int | None = None,
+    # Project info
+    project_id: int | None = None,
+    project_name: str | None = None,
+    # Permissions
+    is_owner: bool | None = None,
+    is_verified: bool | None = None,
+    # -----
+    pagination: PaginationRequest = Depends(get_pagination_params),
+    superuser: UserOAuth = Depends(current_superuser_act),
+    db: AsyncSession = Depends(get_async_db),
+) -> PaginationResponse[LinkUserProjectRead]:
+    page = pagination.page
+    page_size = pagination.page_size
+
+    stm = (
+        select(
+            LinkUserProjectV2,
+            UserOAuth.email,
+            ProjectV2.name,
+        )
+        .join(UserOAuth, UserOAuth.id == LinkUserProjectV2.user_id)
+        .join(ProjectV2, ProjectV2.id == LinkUserProjectV2.project_id)
+        .order_by(UserOAuth.email, ProjectV2.name)
+    )
+    stm_count = (
+        select(func.count())
+        .select_from(LinkUserProjectV2)
+        .join(UserOAuth, UserOAuth.id == LinkUserProjectV2.user_id)
+        .join(ProjectV2, ProjectV2.id == LinkUserProjectV2.project_id)
+    )
+
+    if project_id is not None:
+        stm = stm.where(LinkUserProjectV2.project_id == project_id)
+        stm_count = stm_count.where(LinkUserProjectV2.project_id == project_id)
+    if project_name is not None:
+        stm = stm.where(ProjectV2.name.icontains(project_name))
+        stm_count = stm_count.where(ProjectV2.name.icontains(project_name))
+    if user_id is not None:
+        stm = stm.where(LinkUserProjectV2.user_id == user_id)
+        stm_count = stm_count.where(LinkUserProjectV2.user_id == user_id)
+    if is_owner is not None:
+        stm = stm.where(LinkUserProjectV2.is_owner == is_owner)
+        stm_count = stm_count.where(LinkUserProjectV2.is_owner == is_owner)
+    if is_verified is not None:
+        stm = stm.where(LinkUserProjectV2.is_verified == is_verified)
+        stm_count = stm_count.where(
+            LinkUserProjectV2.is_verified == is_verified
+        )
+
+    res_total_count = await db.execute(stm_count)
+
+    total_count = res_total_count.scalar()
+    if page_size is None:
+        page_size = total_count
+    else:
+        stm = stm.offset((page - 1) * page_size).limit(page_size)
+
+    res = await db.execute(stm)
+    items = res.all()
+
+    return PaginationResponse[LinkUserProjectRead](
+        total_count=total_count,
+        page_size=page_size,
+        current_page=page,
+        items=[
+            dict(
+                # User info
+                user_id=linkuserproject.user_id,
+                user_email=user_email,
+                # Project info
+                project_id=linkuserproject.project_id,
+                project_name=project_name,
+                # Permissions
+                is_verified=linkuserproject.is_verified,
+                is_owner=linkuserproject.is_owner,
+                permissions=linkuserproject.permissions,
+            )
+            for linkuserproject, user_email, project_name in items
+        ],
+    )

{fractal_server-2.17.2 → fractal_server-2.18.0a0}/fractal_server/app/routes/admin/v2/task.py

@@ -148,6 +148,7 @@ async def query_tasks(
                     LinkUserProjectV2.user_id == UserOAuth.id,
                 )
                 .where(LinkUserProjectV2.project_id == project_id)
+                .where(LinkUserProjectV2.is_owner.is_(True))
             )
             project_users[project_id] = [
                 ProjectUser(id=p_user[0], email=p_user[1])

{fractal_server-2.17.2 → fractal_server-2.18.0a0}/fractal_server/app/routes/api/v2/__init__.py

@@ -13,6 +13,7 @@ from .images import router as images_routes_v2
 from .job import router as job_router_v2
 from .pre_submission_checks import router as pre_submission_checks_router
 from .project import router as project_router_v2
+from .sharing import router as sharing_router_v2
 from .status_legacy import router as status_legacy_router_v2
 from .submit import router as submit_job_router_v2
 from .task import router as task_router_v2
@@ -32,6 +33,7 @@ router_api_v2.include_router(dataset_router_v2, tags=["V2 Dataset"])
 router_api_v2.include_router(pre_submission_checks_router, tags=["V2 Job"])
 router_api_v2.include_router(job_router_v2, tags=["V2 Job"])
 router_api_v2.include_router(images_routes_v2, tags=["V2 Images"])
+router_api_v2.include_router(sharing_router_v2, tags=["Project Sharing"])
 router_api_v2.include_router(project_router_v2, tags=["V2 Project"])
 router_api_v2.include_router(submit_job_router_v2, tags=["V2 Job"])
 router_api_v2.include_router(history_router_v2, tags=["V2 History"])

{fractal_server-2.17.2 → fractal_server-2.18.0a0}/fractal_server/app/routes/api/v2/_aux_functions.py

@@ -24,15 +24,17 @@ from fractal_server.app.models.v2 import TaskV2
 from fractal_server.app.models.v2 import WorkflowTaskV2
 from fractal_server.app.models.v2 import WorkflowV2
 from fractal_server.app.schemas.v2 import JobStatusTypeV2
+from fractal_server.app.schemas.v2 import ProjectPermissions
 from fractal_server.logger import set_logger
 
 logger = set_logger(__name__)
 
 
-async def _get_project_check_owner(
+async def _get_project_check_access(
     *,
     project_id: int,
     user_id: int,
+    required_permissions: ProjectPermissions,
     db: AsyncSession,
 ) -> ProjectV2:
     """
@@ -41,6 +43,7 @@ async def _get_project_check_owner(
     Args:
         project_id:
         user_id:
+        required_permissions:
         db:
 
     Returns:
@@ -48,31 +51,42 @@ async def _get_project_check_owner(
 
     Raises:
         HTTPException(status_code=403_FORBIDDEN):
-            If the user is not a member of the project
+            - If the user is not a member of the project;
+            - If the user has not accepted the invitation yet;
+            - If the user has not the target permissions.
         HTTPException(status_code=404_NOT_FOUND):
             If the project does not exist
     """
     project = await db.get(ProjectV2, project_id)
-
-    link_user_project = await db.get(LinkUserProjectV2, (project_id, user_id))
-    if not project:
+    if project is None:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND, detail="Project not found"
         )
-    if not link_user_project:
+
+    link_user_project = await db.get(LinkUserProjectV2, (project_id, user_id))
+    if (
+        link_user_project is None
+        or not link_user_project.is_verified
+        or required_permissions not in link_user_project.permissions
+    ):
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
-            detail=f"Not allowed on project {project_id}",
+            detail=(
+                "You are not authorized to perform this action. "
+                "If you think this is by mistake, "
+                "please contact the project owner."
+            ),
         )
 
     return project
 
 
-async def _get_workflow_check_owner(
+async def _get_workflow_check_access(
     *,
     workflow_id: int,
     project_id: int,
     user_id: int,
+    required_permissions: ProjectPermissions,
     db: AsyncSession,
 ) -> WorkflowV2:
     """
@@ -96,8 +110,11 @@ async def _get_workflow_check_owner(
     """
 
     # Access control for project
-    await _get_project_check_owner(
-        project_id=project_id, user_id=user_id, db=db
+    await _get_project_check_access(
+        project_id=project_id,
+        user_id=user_id,
+        required_permissions=required_permissions,
+        db=db,
     )
 
     res = await db.execute(
@@ -116,12 +133,13 @@ async def _get_workflow_check_owner(
     return workflow
 
 
-async def _get_workflow_task_check_owner(
+async def _get_workflow_task_check_access(
     *,
     project_id: int,
     workflow_id: int,
     workflow_task_id: int,
     user_id: int,
+    required_permissions: ProjectPermissions,
     db: AsyncSession,
 ) -> tuple[WorkflowTaskV2, WorkflowV2]:
     """
@@ -146,10 +164,11 @@ async def _get_workflow_task_check_owner(
     """
 
     # Access control for workflow
-    workflow = await _get_workflow_check_owner(
+    workflow = await _get_workflow_check_access(
         workflow_id=workflow_id,
         project_id=project_id,
         user_id=user_id,
+        required_permissions=required_permissions,
         db=db,
     )
 
@@ -223,6 +242,7 @@ async def _check_project_exists(
         .join(LinkUserProjectV2, LinkUserProjectV2.project_id == ProjectV2.id)
         .where(ProjectV2.name == project_name)
         .where(LinkUserProjectV2.user_id == user_id)
+        .where(LinkUserProjectV2.is_owner.is_(True))
     )
     res = await db.execute(stm)
     if res.scalars().all():
@@ -232,11 +252,12 @@ async def _check_project_exists(
         )
 
 
-async def _get_dataset_check_owner(
+async def _get_dataset_check_access(
     *,
     project_id: int,
     dataset_id: int,
     user_id: int,
+    required_permissions: ProjectPermissions,
     db: AsyncSession,
 ) -> dict[Literal["dataset", "project"], DatasetV2 | ProjectV2]:
     """
@@ -260,8 +281,11 @@ async def _get_dataset_check_owner(
             If the user is not a member of the project
     """
     # Access control for project
-    project = await _get_project_check_owner(
-        project_id=project_id, user_id=user_id, db=db
+    project = await _get_project_check_access(
+        project_id=project_id,
+        user_id=user_id,
+        required_permissions=required_permissions,
+        db=db,
     )
 
     res = await db.execute(
@@ -280,11 +304,12 @@ async def _get_dataset_check_owner(
     return dict(dataset=dataset, project=project)
 
 
-async def _get_job_check_owner(
+async def _get_job_check_access(
     *,
     project_id: int,
     job_id: int,
     user_id: int,
+    required_permissions: ProjectPermissions,
     db: AsyncSession,
 ) -> dict[Literal["job", "project"], JobV2 | ProjectV2]:
     """
@@ -308,9 +333,10 @@ async def _get_job_check_owner(
             If the user is not a member of the project
     """
     # Access control for project
-    project = await _get_project_check_owner(
+    project = await _get_project_check_access(
         project_id=project_id,
         user_id=user_id,
+        required_permissions=required_permissions,
         db=db,
     )
 

{fractal_server-2.17.2 → fractal_server-2.18.0a0}/fractal_server/app/routes/api/v2/_aux_functions_history.py

@@ -13,12 +13,13 @@ from fractal_server.app.models.v2 import HistoryUnit
 from fractal_server.app.models.v2 import WorkflowV2
 from fractal_server.app.routes.api.v2._aux_functions import _get_dataset_or_404
 from fractal_server.app.routes.api.v2._aux_functions import (
-    _get_project_check_owner,
+    _get_project_check_access,
 )
 from fractal_server.app.routes.api.v2._aux_functions import _get_workflow_or_404
 from fractal_server.app.routes.api.v2._aux_functions import (
     _get_workflowtask_or_404,
 )
+from fractal_server.app.schemas.v2.sharing import ProjectPermissions
 from fractal_server.logger import set_logger
 from fractal_server.zip_tools import _read_single_file_from_zip
 
@@ -119,6 +120,7 @@ async def _verify_workflow_and_dataset_access(
     workflow_id: int,
     dataset_id: int,
     user_id: int,
+    required_permissions: ProjectPermissions,
     db: AsyncSession,
 ) -> dict[Literal["dataset", "workflow"], DatasetV2 | WorkflowV2]:
     """
@@ -131,9 +133,10 @@ async def _verify_workflow_and_dataset_access(
         user_id:
         db:
     """
-    await _get_project_check_owner(
+    await _get_project_check_access(
         project_id=project_id,
         user_id=user_id,
+        required_permissions=required_permissions,
         db=db,
     )
     workflow = await _get_workflow_or_404(
@@ -158,12 +161,13 @@ async def _verify_workflow_and_dataset_access(
     return dict(dataset=dataset, workflow=workflow)
 
 
-async def get_wftask_check_owner(
+async def get_wftask_check_access(
     *,
     project_id: int,
     dataset_id: int,
     workflowtask_id: int,
     user_id: int,
+    required_permissions: ProjectPermissions,
     db: AsyncSession,
 ) -> WorkflowTaskV2:
     """
@@ -184,6 +188,7 @@ async def get_wftask_check_owner(
         project_id=project_id,
         dataset_id=dataset_id,
         workflow_id=wftask.workflow_id,
+        required_permissions=required_permissions,
         user_id=user_id,
         db=db,
     )

fractal_server-2.18.0a0/fractal_server/app/routes/api/v2/_aux_functions_sharing.py

@@ -0,0 +1,97 @@
+from fastapi import HTTPException
+from fastapi import status
+from sqlmodel import select
+
+from fractal_server.app.db import AsyncSession
+from fractal_server.app.models import UserOAuth
+from fractal_server.app.models.v2 import LinkUserProjectV2
+
+
+async def raise_403_if_not_owner(
+    *,
+    user_id: int,
+    project_id: int,
+    db: AsyncSession,
+) -> None:
+    """
+    Raises 403 if User[`user_id`] is not owner of Project[`project_id`],
+    regardless of whether the User or Project exists.
+    """
+    res = await db.execute(
+        select(LinkUserProjectV2)
+        .where(LinkUserProjectV2.project_id == project_id)
+        .where(LinkUserProjectV2.user_id == user_id)
+        .where(LinkUserProjectV2.is_owner.is_(True))
+    )
+    link = res.scalars().one_or_none()
+    if link is None:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Current user is not the project owner.",
+        )
+    return link
+
+
+async def get_link_or_404(
+    *, user_id: int, project_id: int, db: AsyncSession
+) -> LinkUserProjectV2:
+    """
+    Raises 404 if User[`user_id`] is not linked to Project[`project_id`],
+    regardless of whether the User or Project exists.
+    """
+    link = await db.get(LinkUserProjectV2, (project_id, user_id))
+    if link is None:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="User is not linked to project.",
+        )
+    return link
+
+
+async def get_pending_invitation_or_404(
+    *, user_id: int, project_id: int, db: AsyncSession
+) -> LinkUserProjectV2:
+    """
+    Raises 404 if User[`user_id`] has not a pending invitation to
+    Project[`project_id`], regardless of whether the User or Project exists.
+    """
+    link = await get_link_or_404(user_id=user_id, project_id=project_id, db=db)
+    if link.is_verified:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="No pending invitation for user on this project.",
+        )
+    return link
+
+
+async def raise_422_if_link_exists(
+    *, user_id: int, project_id: int, db: AsyncSession
+) -> None:
+    """
+    Raises 422 if User[`user_id`] is linked Project[`project_id`], regardless
+    of whether the User or Project exists.
+    """
+    link = await db.get(LinkUserProjectV2, (project_id, user_id))
+    if link is not None:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+            detail="User is already associated to project.",
+        )
+    return
+
+
+async def get_user_id_from_email_or_404(
+    *, user_email: str, db: AsyncSession
+) -> int:
+    """
+    Raises 404 if there is no User with email `user_email`.
+    """
+    res = await db.execute(
+        select(UserOAuth.id).where(UserOAuth.email == user_email)
+    )
+    user_id = res.scalar_one_or_none()
+    if user_id is None:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND, detail="User not found."
+        )
+    return user_id