howler-api 4.1.0.dev1631__tar.gz → 4.1.0.dev1643__tar.gz

{howler_api-4.1.0.dev1631 → howler_api-4.1.0.dev1643}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: howler-api
-Version: 4.1.0.dev1631
+Version: 4.1.0.dev1643
 Summary: Howler - API server
 License: MIT
 Keywords: howler,alerting,gc,canada,cse-cst,cse,cst,cyber,cccs

{howler_api-4.1.0.dev1631 → howler_api-4.1.0.dev1643}/howler/api/v1/hit.py

@@ -27,7 +27,8 @@ from howler.datastore.exceptions import DataStoreException, VersionConflictExcep
 from howler.datastore.operations import OdmHelper, OdmUpdateOperation
 from howler.helper.workflow import WorkflowException
 from howler.odm.models.hit import Hit
-from howler.odm.models.howler_data import Comment, HitOperationType, HitStatusTransition
+from howler.odm.models.howler_data import Comment, HitStatusTransition
+from howler.odm.models.log import LogOperationType
 from howler.odm.models.user import User
 from howler.security.login import api_login
 from howler.security.utils import is_classification_accessible, validate_bulk_operation_targets
@@ -407,7 +408,7 @@ def update_hit(
                     "explanation": f"Hit updated by {user.uname}\n\n" + "\n".join(explanation),
                     "new_value": "N/A",
                     "previous_value": "None",
-                    "type": HitOperationType.APPENDED,
+                    "type": LogOperationType.APPENDED,
                     "user": user.uname,
                 },
                 silent=True,

{howler_api-4.1.0.dev1631 → howler_api-4.1.0.dev1643}/howler/api/v1/utils/permission_helper.py

@@ -31,10 +31,12 @@ def add_access_control_endpoints(api: Blueprint, odm: type[Ownership]):
         refresh => ('true' | 'false' | 'wait_for') Whether to refresh the datastore before returning.
 
         Data Block:
-        {
-            "privilege": "members",       # The permission level: 'owner', 'admins', or 'members'
-            "user_ids": ["username"]       # The users receiving the permission
-        }
+        [
+            {
+                "privilege": "members",   # The permission level: 'owner', 'admins', or 'members'
+                "user_id": "username"      # The user receiving the permission
+            }
+        ]
 
         Result Example:
         {
@@ -42,7 +44,7 @@ def add_access_control_endpoints(api: Blueprint, odm: type[Ownership]):
         }
         """
         try:
-            result = permission_service.give_privilege(id, user, odm, refresh=kwargs.get("refresh"))
+            result = permission_service.give_privileges(id, user, odm, refresh=kwargs.get("refresh"))
         except VersionConflictException:
             return conflict(err="Someone has updated this item. Please try again")
         except ForbiddenException as e:
@@ -67,13 +69,21 @@ def add_access_control_endpoints(api: Blueprint, odm: type[Ownership]):
         Optional Arguments:
         refresh => ('true' | 'false' | 'wait_for') Whether to refresh the datastore before returning.
 
+        Data Block:
+        [
+            {
+                "privilege": "members",   # The permission level: 'admins' or 'members'
+                "user_id": "username"      # The user losing the permission
+            }
+        ]
+
         Result Example:
         {
             ...object   # The updated action, dossier, or view
         }
         """
         try:
-            result = permission_service.remove_privilege(id, user, odm, refresh=kwargs.get("refresh"))
+            result = permission_service.remove_privileges(id, user, odm, refresh=kwargs.get("refresh"))
         except VersionConflictException:
             return conflict(err="Someone has updated this item. Please try again")
         except ForbiddenException as e:

{howler_api-4.1.0.dev1631 → howler_api-4.1.0.dev1643}/howler/odm/models/event.py

@@ -1,10 +1,10 @@
 # mypy: ignore-errors
 
 from howler import odm
-from howler.common.exceptions import HowlerValueError
 from howler.common.logging import get_logger
 from howler.odm.howler_enum import HowlerEnum
 from howler.odm.mixins import DatastoreMixin
+from howler.odm.models.log import Log
 from howler.odm.models.record import Record
 
 logger = get_logger(__file__)
@@ -30,26 +30,6 @@ class Comment(odm.Model):
     )
 
 
-@odm.model(index=True, store=True, description="Log definition.")
-class Log(odm.Model):
-    timestamp = odm.Date(description="Timestamp at which the Log event took place.")
-    key = odm.Optional(odm.Keyword(description="The key whose value changed."))
-    explanation = odm.Optional(odm.Text(description="A manual description of the changes made."))
-    new_value = odm.Optional(odm.Keyword(description="The value the key is changing to."))
-    previous_value = odm.Optional(odm.Keyword(description="The value the key is changing from."))
-    user = odm.Keyword(description="User ID who created the log event.")
-
-    def __init__(self, data: dict = None, *args, **kwargs):
-        if "explanation" not in data:
-            required_keys = {"key", "new_value", "previous_value"}
-            if required_keys.intersection(set(data.keys())) != required_keys:
-                raise HowlerValueError(
-                    f"If no explanation provided, you must provide the following values: {','.join(required_keys)}"
-                )
-
-        super().__init__(data, *args, **kwargs)
-
-
 DEFAULT_LABELS = {"assignments": [], "generic": []}
 
 

{howler_api-4.1.0.dev1631 → howler_api-4.1.0.dev1643}/howler/odm/models/howler_data.py

@@ -3,10 +3,10 @@ from datetime import datetime
 from typing import Optional
 
 from howler import odm
-from howler.common.exceptions import HowlerValueError
 from howler.odm.constants import Status
 from howler.odm.howler_enum import HowlerEnum
 from howler.odm.models.lead import Lead
+from howler.odm.models.log import Log
 
 
 class Scrutiny(str, HowlerEnum):
@@ -31,12 +31,6 @@ class HitStatusTransition(str, HowlerEnum):
     DEMOTE = "demote"
 
 
-class HitOperationType(str, HowlerEnum):
-    APPENDED = "appended"
-    REMOVED = "removed"
-    SET = "set"
-
-
 class Escalation(str, HowlerEnum):
     MISS = "miss"
     HIT = "hit"
@@ -107,28 +101,6 @@ class Comment(odm.Model):
     )
 
 
-@odm.model(index=True, store=True, description="Log definition.")
-class Log(odm.Model):
-    timestamp = odm.Date(description="Timestamp at which the Log event took place.")
-    key = odm.Optional(odm.Keyword(description="The key whose value changed."))
-    explanation = odm.Optional(odm.Text(description="A manual description of the changes made."))
-    previous_version = odm.Optional(odm.Keyword(description="The version this action was applied to."))
-    new_value = odm.Optional(odm.Keyword(description="The value the key is changing to."))
-    type = odm.Optional(odm.Enum(values=HitOperationType, description="The operation performed on the value."))
-    previous_value = odm.Optional(odm.Keyword(description="The value the key is changing from."))
-    user = odm.Keyword(description="User ID who created the log event.")
-
-    def __init__(self, data: dict = None, *args, **kwargs):
-        if "explanation" not in data:
-            required_keys = {"key", "new_value", "type", "previous_value"}
-            if required_keys.intersection(set(data.keys())) != required_keys:
-                raise HowlerValueError(
-                    f"If no explanation provided, you must provide the following values: {','.join(required_keys)}"
-                )
-
-        super().__init__(data, *args, **kwargs)
-
-
 @odm.model(index=True, store=True, description="Hit outline header.")
 class Header(odm.Model):
     threat: str | None = odm.Optional(odm.Keyword(description="The IP of the threat."))

howler_api-4.1.0.dev1643/howler/odm/models/log.py

@@ -0,0 +1,31 @@
+from howler import odm
+from howler.common.exceptions import HowlerValueError
+from howler.odm.howler_enum import HowlerEnum
+
+
+class LogOperationType(str, HowlerEnum):
+    APPENDED = "appended"
+    REMOVED = "removed"
+    SET = "set"
+
+
+@odm.model(index=True, store=True, description="Log definition.")  # noqa: F821
+class Log(odm.Model):
+    timestamp = odm.Date(description="Timestamp at which the Log event took place.")
+    key = odm.Optional(odm.Keyword(description="The key whose value changed."))
+    explanation = odm.Optional(odm.Text(description="A manual description of the changes made."))
+    previous_version = odm.Optional(odm.Keyword(description="The version this action was applied to."))
+    new_value = odm.Optional(odm.Keyword(description="The value the key is changing to."))
+    type = odm.Optional(odm.Enum(values=LogOperationType, description="The operation performed on the value."))
+    previous_value = odm.Optional(odm.Keyword(description="The value the key is changing from."))
+    user = odm.Keyword(description="User ID who created the log event.")
+
+    def __init__(self, data: dict = None, *args, **kwargs):
+        if "explanation" not in data:
+            required_keys = {"key", "new_value", "previous_value"}
+            if required_keys.intersection(set(data.keys())) != required_keys:
+                raise HowlerValueError(
+                    f"If no explanation provided, you must provide the following values: {','.join(required_keys)}"
+                )
+
+        super().__init__(data, *args, **kwargs)

howler_api-4.1.0.dev1643/howler/odm/models/permission_request.py

@@ -0,0 +1,12 @@
+from typing import Literal
+
+from howler import odm
+
+
+@odm.model(index=False, store=False, description="A permission entry for ownership permission updates")
+class PermissionRequest(odm.Model):
+    privilege: Literal["admins", "members", "owner"] = odm.Enum(
+        values=["admins", "members", "owner"],
+        description="The permission level to update",
+    )
+    user_id: str = odm.Keyword(description="The user ID to grant or revoke for the selected privilege.")

{howler_api-4.1.0.dev1631 → howler_api-4.1.0.dev1643}/howler/services/case_service.py

@@ -26,6 +26,7 @@ from howler.odm.models.case import Case, CaseItem, CaseItemTypes, CaseLog, CaseR
 from howler.odm.models.ecs.related import Related
 from howler.odm.models.event import Event
 from howler.odm.models.hit import Hit
+from howler.odm.models.log import Log
 from howler.odm.models.user import User
 from howler.security.utils import is_classification_accessible
 from howler.services import comms_service, event_service, hit_service
@@ -788,7 +789,7 @@ def remove_case_items(  # noqa: C901
     case.items = [item for item in case.items if item.id not in ids_to_remove]
 
     for backing_obj, backing_obj_version in backing_objs:
-        remove_backreference(backing_obj, case.case_id)
+        remove_backreference(backing_obj, case.case_id, user=user)
         backing_obj.save(version=backing_obj_version)
 
     recompute_case_metadata(case)
@@ -845,7 +846,7 @@ def append_hit(
 
     case.items.append(item)
 
-    add_backreference(hit, case.case_id)
+    add_backreference(hit, case.case_id, user=user)
     hit.save(version=hit_version)
 
     recompute_case_metadata(case)
@@ -889,7 +890,7 @@ def append_event(
 
     case.items.append(item)
 
-    add_backreference(event, case.case_id)
+    add_backreference(event, case.case_id, user=user)
     event.save(version=event_version)
 
     recompute_case_metadata(case)
@@ -996,7 +997,11 @@ def recompute_case_metadata(case: Case) -> None:  # noqa: C901
     case.indicators = sorted(indicators)
 
 
-def add_backreference(backing_obj: Hit | Event | None, case_id: str) -> bool:
+def add_backreference(
+    backing_obj: Hit | Event | None,
+    case_id: str,
+    user: User | None = None,
+) -> bool:
     """Add a back-reference from a hit or event to a case, in memory only.
 
     Records the case ID in the backing object's ``howler.related`` list so
@@ -1023,12 +1028,23 @@ def add_backreference(backing_obj: Hit | Event | None, case_id: str) -> bool:
         return False
 
     backing_obj.howler.related.append(case_id)
+    backing_obj.howler.log.append(
+        Log(
+            {
+                "timestamp": "NOW",
+                "explanation": f"Added to case {case_id}",
+                "user": user.uname if user else "system",
+            }
+        )
+    )
+
     return True
 
 
 def remove_backreference(
     backing_obj: Hit | Event | None,
     case_id: str,
+    user: User | None = None,
 ):
     """Remove a back-reference from a hit or event to a case, in memory only.
 
@@ -1052,6 +1068,16 @@ def remove_backreference(
     if case_id in backing_obj.howler.related:
         backing_obj.howler.related.remove(case_id)
 
+        backing_obj.howler.log.append(
+            Log(
+                {
+                    "timestamp": "NOW",
+                    "explanation": f"Removed from case {case_id}",
+                    "user": user.uname if user else "system",
+                }
+            )
+        )
+
 
 def rename_case_item(
     case: str | Case | None,

{howler_api-4.1.0.dev1631 → howler_api-4.1.0.dev1643}/howler/services/hit_service.py

@@ -29,7 +29,8 @@ from howler.helper.hit import (
 from howler.helper.workflow import Transition, Workflow
 from howler.odm.models.ecs.event import ECSEvent
 from howler.odm.models.hit import Hit
-from howler.odm.models.howler_data import HitOperationType, HitStatusTransition, Log, Status
+from howler.odm.models.howler_data import HitStatusTransition, Status
+from howler.odm.models.log import Log, LogOperationType
 from howler.odm.models.user import User
 from howler.security.utils import is_classification_accessible
 from howler.services import action_service, analytic_service, dossier_service, overview_service, template_service
@@ -625,16 +626,16 @@ def _update_hit(
 
         if is_list:
             operation_type = (
-                HitOperationType.APPENDED
+                LogOperationType.APPENDED
                 if operation.operation
                 in (
                     ESCollection.UPDATE_APPEND,
                     ESCollection.UPDATE_APPEND_IF_MISSING,
                 )
-                else HitOperationType.REMOVED
+                else LogOperationType.REMOVED
             )
         else:
-            operation_type = HitOperationType.SET
+            operation_type = LogOperationType.SET
 
         logger.debug("%s - %s - %s -> %s", hit_id, operation.key, previous_value, operation.value)
         final_operations.append(operation)

howler_api-4.1.0.dev1643/howler/services/permission_service.py

@@ -0,0 +1,152 @@
+from collections.abc import Sequence
+from typing import TYPE_CHECKING, Any, Literal, Protocol, cast
+
+from flask import request
+
+from howler.common.exceptions import ForbiddenException, HowlerTypeError, InvalidDataException
+from howler.common.loader import datastore
+from howler.odm.models.ownership import Ownership
+from howler.odm.models.permission_request import PermissionRequest
+from howler.odm.models.user import User
+
+if TYPE_CHECKING:
+    from howler.datastore.collection import ESCollection
+
+
+class _VisibilityItem(Protocol):
+    @property
+    def owner(self) -> str: ...
+
+    @property
+    def type(self) -> str: ...
+
+    @property
+    def admins(self) -> Sequence[str]: ...
+
+    @property
+    def members(self) -> Sequence[str]: ...
+
+
+def _is_allowed_to_change(level_requested: str, user: User, existing_item: Ownership) -> bool:
+    if "admin" in user.type:
+        return True
+
+    if user.uname not in existing_item.admins and user.uname != existing_item.owner:
+        return False
+
+    return level_requested != "owner" or user.uname == existing_item.owner
+
+
+def _build_permissions_request() -> list[PermissionRequest]:
+    payload = cast(list[dict[str, Any]], request.json)
+    if not isinstance(payload, list):
+        raise InvalidDataException("Request body must be a JSON array.")
+    if not payload:
+        raise InvalidDataException("Request body must contain at least one permission.")
+
+    try:
+        permission_requests = [PermissionRequest(entry) for entry in payload]
+    except (TypeError, ValueError, HowlerTypeError) as e:
+        raise InvalidDataException(message=str(e))
+
+    user_ids = [permission_request.user_id for permission_request in permission_requests]
+    if any(not user_id for user_id in user_ids):
+        raise InvalidDataException("user_id must contain a user.")
+    if len(user_ids) != len(set(user_ids)):
+        raise InvalidDataException("Each user can only be included once per request.")
+
+    return permission_requests
+
+
+def give_privileges(
+    id: str,
+    user: User,
+    object_type: type[Ownership],
+    refresh: Literal["true", "false", "wait_for"] | None = None,
+) -> dict[str, Any]:
+    """Grant privileges to users on an ownership object."""
+    permission_requests = _build_permissions_request()
+
+    storage = datastore()
+    index_name = object_type.__name__.lower()
+    collection: "ESCollection[Ownership]" = storage[index_name]
+
+    result, version = collection.get(id, as_obj=True, version=True)
+    if not result:
+        raise InvalidDataException(message=f"{index_name.capitalize()} {id} does not exist")
+
+    owner_requests = [
+        permission_request for permission_request in permission_requests if permission_request.privilege == "owner"
+    ]
+    if len(owner_requests) > 1:
+        raise InvalidDataException("Only one owner can be set per request.")
+
+    for permission_request in permission_requests:
+        user_id = permission_request.user_id
+        if not _is_allowed_to_change(permission_request.privilege, user, result):
+            raise ForbiddenException("The user requesting the change is not allowed to make the change.")
+
+        if not storage.user.exists(user_id):
+            raise InvalidDataException(message=f"User {user_id} does not exist")
+
+        if permission_request.privilege != "owner" and user_id in result[permission_request.privilege]:
+            raise InvalidDataException(message=f"User {user_id} already has permission {permission_request.privilege}")
+
+    # Apply all changes only after the complete request has been validated.
+    for permission_request in permission_requests:
+        user_id = permission_request.user_id
+        if permission_request.privilege == "owner":
+            result.owner = user_id
+
+            for privilege in ("admins", "members"):
+                current_members = cast(list[str], result[privilege])
+                current_members[:] = [member_id for member_id in current_members if member_id != user_id]
+        else:
+            current_members = cast(list[str], result[permission_request.privilege])
+            other_privilege = "members" if permission_request.privilege == "admins" else "admins"
+            other_members = cast(list[str], result[other_privilege])
+
+            # Switching between non-owner privileges removes the previous privilege.
+            other_members[:] = [member_id for member_id in other_members if member_id != user_id]
+            current_members.append(user_id)
+
+    collection.save(id, result, version=version, refresh=refresh)
+    return result.as_primitives()
+
+
+def remove_privileges(  # noqa: C901
+    id: str,
+    user: User,
+    object_type: type[Ownership],
+    refresh: Literal["true", "false", "wait_for"] | None = None,
+) -> dict[str, Any]:
+    """Revoke privileges from users on an ownership object."""
+    permission_requests = _build_permissions_request()
+
+    storage = datastore()
+    index_name = object_type.__name__.lower()
+    collection: "ESCollection[Ownership]" = storage[index_name]
+
+    result, version = collection.get(id, as_obj=True, version=True)
+    if not result:
+        raise InvalidDataException(message=f"{index_name.capitalize()} {id} does not exist")
+
+    for permission_request in permission_requests:
+        if not _is_allowed_to_change(permission_request.privilege, user, result):
+            raise ForbiddenException("The user requesting the change is not allowed to make the change.")
+
+        if permission_request.privilege == "owner":
+            raise InvalidDataException(message="You cannot remove the owner privilege. Only transfer is allowed.")
+
+        user_id = permission_request.user_id
+        current_members = result.admins if permission_request.privilege == "admins" else result.members
+        if user_id not in current_members:
+            raise InvalidDataException(
+                message=f"The user '{user_id}' does not have the '{permission_request.privilege}' privilege."
+            )
+
+    for permission_request in permission_requests:
+        cast(list[str], result[permission_request.privilege]).remove(permission_request.user_id)
+
+    collection.save(id, result, version=version, refresh=refresh)
+    return result.as_primitives()

{howler_api-4.1.0.dev1631 → howler_api-4.1.0.dev1643}/pyproject.toml

@@ -244,7 +244,7 @@ suppress-none-returning = true
 [tool.poetry]
 package-mode = true
 name = "howler-api"
-version = "4.1.0.dev1631"
+version = "4.1.0.dev1643"
 description = "Howler - API server"
 authors = [
     "Canadian Centre for Cyber Security <howler@cyber.gc.ca>",

howler_api-4.1.0.dev1631/howler/odm/models/permission_request.py

@@ -1,17 +0,0 @@
-from typing import Literal
-
-from howler import odm
-
-
-@odm.model(index=False, store=False, description="Request payload for ownership permission updates")
-class PermissionRequest(odm.Model):
-    privilege: Literal["admins", "members", "owner"] = odm.Enum(
-        values=["admins", "members", "owner"],
-        description="The permission level to update",
-    )
-    user_ids: list[str] = odm.List(
-        odm.Keyword(),
-        description="The list of user IDs to grant or revoke for the selected privilege.",
-        default=[],
-        optional=False,
-    )

howler_api-4.1.0.dev1631/howler/services/permission_service.py

@@ -1,150 +0,0 @@
-from collections.abc import Sequence
-from typing import TYPE_CHECKING, Any, Literal, Protocol, cast
-
-from flask import request
-
-from howler.common.exceptions import ForbiddenException, HowlerTypeError, InvalidDataException
-from howler.common.loader import datastore
-from howler.odm.models.ownership import Ownership
-from howler.odm.models.permission_request import PermissionRequest
-from howler.odm.models.user import User
-
-if TYPE_CHECKING:
-    from howler.datastore.collection import ESCollection
-
-
-class _VisibilityItem(Protocol):
-    @property
-    def owner(self) -> str: ...
-
-    @property
-    def type(self) -> str: ...
-
-    @property
-    def admins(self) -> Sequence[str]: ...
-
-    @property
-    def members(self) -> Sequence[str]: ...
-
-
-def _is_allowed_to_change(level_requested: str, user: User, existing_item: Ownership) -> bool:
-    if "admin" in user.type:
-        return True
-
-    if user.uname not in existing_item.admins and user.uname != existing_item.owner:
-        return False
-
-    return level_requested != "owner" or user.uname == existing_item.owner
-
-
-def _build_permissions_request() -> PermissionRequest:
-    payload = cast(dict[str, Any], request.json)
-    if not isinstance(payload, dict):
-        raise InvalidDataException("Request body must be a JSON object.")
-
-    try:
-        permission_request = PermissionRequest(payload)
-    except (ValueError, HowlerTypeError) as e:
-        raise InvalidDataException(message=str(e))
-
-    if not permission_request.user_ids:
-        raise InvalidDataException("user_ids must contain at least one user.")
-
-    return permission_request
-
-
-def give_privilege(
-    id: str,
-    user: User,
-    object_type: type[Ownership],
-    refresh: Literal["true", "false", "wait_for"] | None = None,
-) -> dict[str, Any]:
-    """Grant a privilege to one or more users on an ownership object."""
-    permission_request = _build_permissions_request()
-    user_ids = list(dict.fromkeys(permission_request.user_ids))
-
-    storage = datastore()
-    index_name = object_type.__name__.lower()
-    collection: "ESCollection[Ownership]" = storage[index_name]
-
-    result, version = collection.get(id, as_obj=True, version=True)
-    if not result:
-        raise InvalidDataException(message=f"{index_name.capitalize()} {id} does not exist")
-
-    if not _is_allowed_to_change(permission_request.privilege, user, result):
-        raise ForbiddenException("The user requesting the change is not allowed to make the change.")
-
-    if permission_request.privilege == "owner" and len(user_ids) != 1:
-        raise InvalidDataException("When setting the owner, user_ids must be a single entry long.")
-
-    errors: list[str] = []
-    for user_id in user_ids:
-        if not storage.user.exists(user_id):
-            errors.append(f"User {user_id} does not exist")
-            continue
-
-        if permission_request.privilege != "owner" and user_id in result[permission_request.privilege]:
-            errors.append(f"User {user_id} already has permission {permission_request.privilege}")
-
-    if errors:
-        raise InvalidDataException(message=f"Failed to grant privileges for some users: {'; '.join(errors)}")
-
-    if permission_request.privilege == "owner":
-        new_owner = user_ids[0]
-        result.owner = new_owner
-
-        # Ownership supersedes any non-owner privilege held by the new owner.
-        for privilege in ("admins", "members"):
-            current_members = cast(list[str], result[privilege])
-            current_members[:] = [user_id for user_id in current_members if user_id != new_owner]
-    else:
-        current_members = cast(list[str], result[permission_request.privilege])
-        other_privilege = "members" if permission_request.privilege == "admins" else "admins"
-        other_members = cast(list[str], result[other_privilege])
-
-        # Switching between non-owner privileges removes the previous privilege.
-        other_members[:] = [user_id for user_id in other_members if user_id not in user_ids]
-        current_members.extend(user_ids)
-
-    collection.save(id, result, version=version, refresh=refresh)
-    return result.as_primitives()
-
-
-def remove_privilege(  # noqa: C901
-    id: str,
-    user: User,
-    object_type: type[Ownership],
-    refresh: Literal["true", "false", "wait_for"] | None = None,
-) -> dict[str, Any]:
-    """Revoke a privilege from one or more users on an ownership object."""
-    permission_request = _build_permissions_request()
-    user_ids = list(dict.fromkeys(permission_request.user_ids))
-
-    storage = datastore()
-    index_name = object_type.__name__.lower()
-    collection: "ESCollection[Ownership]" = storage[index_name]
-
-    result, version = collection.get(id, as_obj=True, version=True)
-    if not result:
-        raise InvalidDataException(message=f"{index_name.capitalize()} {id} does not exist")
-
-    if not _is_allowed_to_change(permission_request.privilege, user, result):
-        raise ForbiddenException("The user requesting the change is not allowed to make the change.")
-
-    if permission_request.privilege == "owner":
-        raise InvalidDataException(message="You cannot remove the owner privilege. Only transfer is allowed.")
-
-    errors: list[str] = []
-    current_members = result.admins if permission_request.privilege == "admins" else result.members
-    for user_id in user_ids:
-        if user_id not in current_members:
-            errors.append(f"The user '{user_id}' does not have the '{permission_request.privilege}' privilege.")
-
-    if errors:
-        raise InvalidDataException(message=f"Failed to revoke privileges for some users: {'; '.join(errors)}")
-
-    for user_id in user_ids:
-        cast(list[str], result[permission_request.privilege]).remove(user_id)
-
-    collection.save(id, result, version=version, refresh=refresh)
-    return result.as_primitives()