howler-api 4.1.0.dev1635__tar.gz → 4.1.0.dev1643__tar.gz

{howler_api-4.1.0.dev1635 → howler_api-4.1.0.dev1643}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: howler-api
-Version: 4.1.0.dev1635
+Version: 4.1.0.dev1643
 Summary: Howler - API server
 License: MIT
 Keywords: howler,alerting,gc,canada,cse-cst,cse,cst,cyber,cccs

{howler_api-4.1.0.dev1635 → howler_api-4.1.0.dev1643}/howler/api/v1/utils/permission_helper.py

@@ -31,10 +31,12 @@ def add_access_control_endpoints(api: Blueprint, odm: type[Ownership]):
         refresh => ('true' | 'false' | 'wait_for') Whether to refresh the datastore before returning.
 
         Data Block:
-        {
-            "privilege": "members",       # The permission level: 'owner', 'admins', or 'members'
-            "user_ids": ["username"]       # The users receiving the permission
-        }
+        [
+            {
+                "privilege": "members",   # The permission level: 'owner', 'admins', or 'members'
+                "user_id": "username"      # The user receiving the permission
+            }
+        ]
 
         Result Example:
         {
@@ -42,7 +44,7 @@ def add_access_control_endpoints(api: Blueprint, odm: type[Ownership]):
         }
         """
         try:
-            result = permission_service.give_privilege(id, user, odm, refresh=kwargs.get("refresh"))
+            result = permission_service.give_privileges(id, user, odm, refresh=kwargs.get("refresh"))
         except VersionConflictException:
             return conflict(err="Someone has updated this item. Please try again")
         except ForbiddenException as e:
@@ -67,13 +69,21 @@ def add_access_control_endpoints(api: Blueprint, odm: type[Ownership]):
         Optional Arguments:
         refresh => ('true' | 'false' | 'wait_for') Whether to refresh the datastore before returning.
 
+        Data Block:
+        [
+            {
+                "privilege": "members",   # The permission level: 'admins' or 'members'
+                "user_id": "username"      # The user losing the permission
+            }
+        ]
+
         Result Example:
         {
             ...object   # The updated action, dossier, or view
         }
         """
         try:
-            result = permission_service.remove_privilege(id, user, odm, refresh=kwargs.get("refresh"))
+            result = permission_service.remove_privileges(id, user, odm, refresh=kwargs.get("refresh"))
         except VersionConflictException:
             return conflict(err="Someone has updated this item. Please try again")
         except ForbiddenException as e:

howler_api-4.1.0.dev1643/howler/odm/models/permission_request.py

@@ -0,0 +1,12 @@
+from typing import Literal
+
+from howler import odm
+
+
+@odm.model(index=False, store=False, description="A permission entry for ownership permission updates")
+class PermissionRequest(odm.Model):
+    privilege: Literal["admins", "members", "owner"] = odm.Enum(
+        values=["admins", "members", "owner"],
+        description="The permission level to update",
+    )
+    user_id: str = odm.Keyword(description="The user ID to grant or revoke for the selected privilege.")

howler_api-4.1.0.dev1643/howler/services/permission_service.py

@@ -0,0 +1,152 @@
+from collections.abc import Sequence
+from typing import TYPE_CHECKING, Any, Literal, Protocol, cast
+
+from flask import request
+
+from howler.common.exceptions import ForbiddenException, HowlerTypeError, InvalidDataException
+from howler.common.loader import datastore
+from howler.odm.models.ownership import Ownership
+from howler.odm.models.permission_request import PermissionRequest
+from howler.odm.models.user import User
+
+if TYPE_CHECKING:
+    from howler.datastore.collection import ESCollection
+
+
+class _VisibilityItem(Protocol):
+    @property
+    def owner(self) -> str: ...
+
+    @property
+    def type(self) -> str: ...
+
+    @property
+    def admins(self) -> Sequence[str]: ...
+
+    @property
+    def members(self) -> Sequence[str]: ...
+
+
+def _is_allowed_to_change(level_requested: str, user: User, existing_item: Ownership) -> bool:
+    if "admin" in user.type:
+        return True
+
+    if user.uname not in existing_item.admins and user.uname != existing_item.owner:
+        return False
+
+    return level_requested != "owner" or user.uname == existing_item.owner
+
+
+def _build_permissions_request() -> list[PermissionRequest]:
+    payload = cast(list[dict[str, Any]], request.json)
+    if not isinstance(payload, list):
+        raise InvalidDataException("Request body must be a JSON array.")
+    if not payload:
+        raise InvalidDataException("Request body must contain at least one permission.")
+
+    try:
+        permission_requests = [PermissionRequest(entry) for entry in payload]
+    except (TypeError, ValueError, HowlerTypeError) as e:
+        raise InvalidDataException(message=str(e))
+
+    user_ids = [permission_request.user_id for permission_request in permission_requests]
+    if any(not user_id for user_id in user_ids):
+        raise InvalidDataException("user_id must contain a user.")
+    if len(user_ids) != len(set(user_ids)):
+        raise InvalidDataException("Each user can only be included once per request.")
+
+    return permission_requests
+
+
+def give_privileges(
+    id: str,
+    user: User,
+    object_type: type[Ownership],
+    refresh: Literal["true", "false", "wait_for"] | None = None,
+) -> dict[str, Any]:
+    """Grant privileges to users on an ownership object."""
+    permission_requests = _build_permissions_request()
+
+    storage = datastore()
+    index_name = object_type.__name__.lower()
+    collection: "ESCollection[Ownership]" = storage[index_name]
+
+    result, version = collection.get(id, as_obj=True, version=True)
+    if not result:
+        raise InvalidDataException(message=f"{index_name.capitalize()} {id} does not exist")
+
+    owner_requests = [
+        permission_request for permission_request in permission_requests if permission_request.privilege == "owner"
+    ]
+    if len(owner_requests) > 1:
+        raise InvalidDataException("Only one owner can be set per request.")
+
+    for permission_request in permission_requests:
+        user_id = permission_request.user_id
+        if not _is_allowed_to_change(permission_request.privilege, user, result):
+            raise ForbiddenException("The user requesting the change is not allowed to make the change.")
+
+        if not storage.user.exists(user_id):
+            raise InvalidDataException(message=f"User {user_id} does not exist")
+
+        if permission_request.privilege != "owner" and user_id in result[permission_request.privilege]:
+            raise InvalidDataException(message=f"User {user_id} already has permission {permission_request.privilege}")
+
+    # Apply all changes only after the complete request has been validated.
+    for permission_request in permission_requests:
+        user_id = permission_request.user_id
+        if permission_request.privilege == "owner":
+            result.owner = user_id
+
+            for privilege in ("admins", "members"):
+                current_members = cast(list[str], result[privilege])
+                current_members[:] = [member_id for member_id in current_members if member_id != user_id]
+        else:
+            current_members = cast(list[str], result[permission_request.privilege])
+            other_privilege = "members" if permission_request.privilege == "admins" else "admins"
+            other_members = cast(list[str], result[other_privilege])
+
+            # Switching between non-owner privileges removes the previous privilege.
+            other_members[:] = [member_id for member_id in other_members if member_id != user_id]
+            current_members.append(user_id)
+
+    collection.save(id, result, version=version, refresh=refresh)
+    return result.as_primitives()
+
+
+def remove_privileges(  # noqa: C901
+    id: str,
+    user: User,
+    object_type: type[Ownership],
+    refresh: Literal["true", "false", "wait_for"] | None = None,
+) -> dict[str, Any]:
+    """Revoke privileges from users on an ownership object."""
+    permission_requests = _build_permissions_request()
+
+    storage = datastore()
+    index_name = object_type.__name__.lower()
+    collection: "ESCollection[Ownership]" = storage[index_name]
+
+    result, version = collection.get(id, as_obj=True, version=True)
+    if not result:
+        raise InvalidDataException(message=f"{index_name.capitalize()} {id} does not exist")
+
+    for permission_request in permission_requests:
+        if not _is_allowed_to_change(permission_request.privilege, user, result):
+            raise ForbiddenException("The user requesting the change is not allowed to make the change.")
+
+        if permission_request.privilege == "owner":
+            raise InvalidDataException(message="You cannot remove the owner privilege. Only transfer is allowed.")
+
+        user_id = permission_request.user_id
+        current_members = result.admins if permission_request.privilege == "admins" else result.members
+        if user_id not in current_members:
+            raise InvalidDataException(
+                message=f"The user '{user_id}' does not have the '{permission_request.privilege}' privilege."
+            )
+
+    for permission_request in permission_requests:
+        cast(list[str], result[permission_request.privilege]).remove(permission_request.user_id)
+
+    collection.save(id, result, version=version, refresh=refresh)
+    return result.as_primitives()

{howler_api-4.1.0.dev1635 → howler_api-4.1.0.dev1643}/pyproject.toml

@@ -244,7 +244,7 @@ suppress-none-returning = true
 [tool.poetry]
 package-mode = true
 name = "howler-api"
-version = "4.1.0.dev1635"
+version = "4.1.0.dev1643"
 description = "Howler - API server"
 authors = [
     "Canadian Centre for Cyber Security <howler@cyber.gc.ca>",

howler_api-4.1.0.dev1635/howler/odm/models/permission_request.py

@@ -1,17 +0,0 @@
-from typing import Literal
-
-from howler import odm
-
-
-@odm.model(index=False, store=False, description="Request payload for ownership permission updates")
-class PermissionRequest(odm.Model):
-    privilege: Literal["admins", "members", "owner"] = odm.Enum(
-        values=["admins", "members", "owner"],
-        description="The permission level to update",
-    )
-    user_ids: list[str] = odm.List(
-        odm.Keyword(),
-        description="The list of user IDs to grant or revoke for the selected privilege.",
-        default=[],
-        optional=False,
-    )

howler_api-4.1.0.dev1635/howler/services/permission_service.py

@@ -1,150 +0,0 @@
-from collections.abc import Sequence
-from typing import TYPE_CHECKING, Any, Literal, Protocol, cast
-
-from flask import request
-
-from howler.common.exceptions import ForbiddenException, HowlerTypeError, InvalidDataException
-from howler.common.loader import datastore
-from howler.odm.models.ownership import Ownership
-from howler.odm.models.permission_request import PermissionRequest
-from howler.odm.models.user import User
-
-if TYPE_CHECKING:
-    from howler.datastore.collection import ESCollection
-
-
-class _VisibilityItem(Protocol):
-    @property
-    def owner(self) -> str: ...
-
-    @property
-    def type(self) -> str: ...
-
-    @property
-    def admins(self) -> Sequence[str]: ...
-
-    @property
-    def members(self) -> Sequence[str]: ...
-
-
-def _is_allowed_to_change(level_requested: str, user: User, existing_item: Ownership) -> bool:
-    if "admin" in user.type:
-        return True
-
-    if user.uname not in existing_item.admins and user.uname != existing_item.owner:
-        return False
-
-    return level_requested != "owner" or user.uname == existing_item.owner
-
-
-def _build_permissions_request() -> PermissionRequest:
-    payload = cast(dict[str, Any], request.json)
-    if not isinstance(payload, dict):
-        raise InvalidDataException("Request body must be a JSON object.")
-
-    try:
-        permission_request = PermissionRequest(payload)
-    except (ValueError, HowlerTypeError) as e:
-        raise InvalidDataException(message=str(e))
-
-    if not permission_request.user_ids:
-        raise InvalidDataException("user_ids must contain at least one user.")
-
-    return permission_request
-
-
-def give_privilege(
-    id: str,
-    user: User,
-    object_type: type[Ownership],
-    refresh: Literal["true", "false", "wait_for"] | None = None,
-) -> dict[str, Any]:
-    """Grant a privilege to one or more users on an ownership object."""
-    permission_request = _build_permissions_request()
-    user_ids = list(dict.fromkeys(permission_request.user_ids))
-
-    storage = datastore()
-    index_name = object_type.__name__.lower()
-    collection: "ESCollection[Ownership]" = storage[index_name]
-
-    result, version = collection.get(id, as_obj=True, version=True)
-    if not result:
-        raise InvalidDataException(message=f"{index_name.capitalize()} {id} does not exist")
-
-    if not _is_allowed_to_change(permission_request.privilege, user, result):
-        raise ForbiddenException("The user requesting the change is not allowed to make the change.")
-
-    if permission_request.privilege == "owner" and len(user_ids) != 1:
-        raise InvalidDataException("When setting the owner, user_ids must be a single entry long.")
-
-    errors: list[str] = []
-    for user_id in user_ids:
-        if not storage.user.exists(user_id):
-            errors.append(f"User {user_id} does not exist")
-            continue
-
-        if permission_request.privilege != "owner" and user_id in result[permission_request.privilege]:
-            errors.append(f"User {user_id} already has permission {permission_request.privilege}")
-
-    if errors:
-        raise InvalidDataException(message=f"Failed to grant privileges for some users: {'; '.join(errors)}")
-
-    if permission_request.privilege == "owner":
-        new_owner = user_ids[0]
-        result.owner = new_owner
-
-        # Ownership supersedes any non-owner privilege held by the new owner.
-        for privilege in ("admins", "members"):
-            current_members = cast(list[str], result[privilege])
-            current_members[:] = [user_id for user_id in current_members if user_id != new_owner]
-    else:
-        current_members = cast(list[str], result[permission_request.privilege])
-        other_privilege = "members" if permission_request.privilege == "admins" else "admins"
-        other_members = cast(list[str], result[other_privilege])
-
-        # Switching between non-owner privileges removes the previous privilege.
-        other_members[:] = [user_id for user_id in other_members if user_id not in user_ids]
-        current_members.extend(user_ids)
-
-    collection.save(id, result, version=version, refresh=refresh)
-    return result.as_primitives()
-
-
-def remove_privilege(  # noqa: C901
-    id: str,
-    user: User,
-    object_type: type[Ownership],
-    refresh: Literal["true", "false", "wait_for"] | None = None,
-) -> dict[str, Any]:
-    """Revoke a privilege from one or more users on an ownership object."""
-    permission_request = _build_permissions_request()
-    user_ids = list(dict.fromkeys(permission_request.user_ids))
-
-    storage = datastore()
-    index_name = object_type.__name__.lower()
-    collection: "ESCollection[Ownership]" = storage[index_name]
-
-    result, version = collection.get(id, as_obj=True, version=True)
-    if not result:
-        raise InvalidDataException(message=f"{index_name.capitalize()} {id} does not exist")
-
-    if not _is_allowed_to_change(permission_request.privilege, user, result):
-        raise ForbiddenException("The user requesting the change is not allowed to make the change.")
-
-    if permission_request.privilege == "owner":
-        raise InvalidDataException(message="You cannot remove the owner privilege. Only transfer is allowed.")
-
-    errors: list[str] = []
-    current_members = result.admins if permission_request.privilege == "admins" else result.members
-    for user_id in user_ids:
-        if user_id not in current_members:
-            errors.append(f"The user '{user_id}' does not have the '{permission_request.privilege}' privilege.")
-
-    if errors:
-        raise InvalidDataException(message=f"Failed to revoke privileges for some users: {'; '.join(errors)}")
-
-    for user_id in user_ids:
-        cast(list[str], result[permission_request.privilege]).remove(user_id)
-
-    collection.save(id, result, version=version, refresh=refresh)
-    return result.as_primitives()