infrahub-server 1.1.6__py3-none-any.whl → 1.2.0rc0__py3-none-any.whl

infrahub/graphql/app.py

@@ -76,8 +76,6 @@ if TYPE_CHECKING:
 
     from .auth.query_permission_checker.checker import GraphQLQueryPermissionChecker
 
-# pylint: disable=unused-argument,raise-missing-from
-
 
 GQL_CONNECTION_ACK = "connection_ack"
 GQL_CONNECTION_ERROR = "connection_error"
@@ -208,13 +206,32 @@ class InfrahubGraphQLApp:
         graphql_params = await prepare_graphql_params(
             db=db, branch=branch, at=at, account_session=account_session, request=request
         )
+        schema_branch = db.schema.get_schema_branch(name=branch.name)
+
         analyzed_query = InfrahubGraphQLQueryAnalyzer(
             query=query,
+            schema_branch=schema_branch,
             query_variables=variable_values,
             schema=graphql_params.schema,
             operation_name=operation_name,
             branch=branch,
         )
+
+        # if the query contains some mutation, it's not currently supported to set AT manually
+        if analyzed_query.contains_mutation:
+            graphql_params.context.at = Timestamp()
+        elif at and branch.schema_changed_at and Timestamp(branch.schema_changed_at) > Timestamp(at):
+            schema_branch = await registry.schema.load_schema_from_db(db=db, branch=branch, at=Timestamp(at))
+            db.add_schema(name=branch.name, schema=schema_branch)
+            analyzed_query = InfrahubGraphQLQueryAnalyzer(
+                query=query,
+                schema_branch=schema_branch,
+                query_variables=variable_values,
+                schema=graphql_params.schema,
+                operation_name=operation_name,
+                branch=branch,
+            )
+
         await self._evaluate_permissions(
             db=db,
             request=request,
@@ -224,13 +241,6 @@ class InfrahubGraphQLApp:
             branch=branch,
         )
 
-        # if the query contains some mutation, it's not currently supported to set AT manually
-        if analyzed_query.contains_mutation:
-            graphql_params.context.at = Timestamp()
-        elif at and branch.schema_changed_at and Timestamp(branch.schema_changed_at) > Timestamp(at):
-            schema_branch = await registry.schema.load_schema_from_db(db=db, branch=branch, at=Timestamp(at))
-            db.add_schema(name=branch.name, schema=schema_branch)
-
         if operation_name == "IntrospectionQuery":
             nbr_object_in_schema = len(graphql_params.schema.type_map)
             self.logger.debug(
@@ -272,17 +282,15 @@ class InfrahubGraphQLApp:
         GRAPHQL_QUERY_HEIGHT_METRICS.labels(**labels).observe(await analyzed_query.calculate_height())
         # GRAPHQL_QUERY_VARS_METRICS.labels(**labels).observe(len(analyzed_query.variables))
         GRAPHQL_TOP_LEVEL_QUERIES_METRICS.labels(**labels).observe(analyzed_query.nbr_queries)
-        GRAPHQL_QUERY_OBJECTS_METRICS.labels(**labels).observe(
-            len(await analyzed_query.get_models_in_use(types=graphql_params.context.types))
-        )
+        GRAPHQL_QUERY_OBJECTS_METRICS.labels(**labels).observe(len(analyzed_query.query_report.impacted_models))
 
-        valid, errors = analyzed_query.is_valid
-        if not valid:
+        _, errors = analyzed_query.is_valid
+        if errors:
             GRAPHQL_QUERY_ERRORS_METRICS.labels(**labels).observe(len(errors))
 
         return json_response
 
-    def _set_labels(self, request: Request, branch: Branch, query: InfrahubGraphQLQueryAnalyzer) -> dict[str, Any]:
+    def _set_labels(self, request: Request, branch: Branch, query: InfrahubGraphQLQueryAnalyzer) -> dict[str, Any]:  # noqa: ARG002
         return {
             "type": "mutation" if query.contains_mutation else "query",
             "branch": branch.name,
@@ -293,7 +301,7 @@ class InfrahubGraphQLApp:
 
     async def _evaluate_permissions(
         self,
-        request: Request,
+        request: Request,  # noqa: ARG002
         db: InfrahubDatabase,
         query: InfrahubGraphQLQueryAnalyzer,
         query_parameters: GraphqlParams,
@@ -450,7 +458,7 @@ class InfrahubGraphQLApp:
             async for result in asyncgen:
                 payload = {"data": result.data}
                 await websocket.send_json({"type": GQL_DATA, "id": operation_id, "payload": payload})
-        except Exception as error:  # pylint: disable=broad-exception-caught
+        except Exception as error:
             if not isinstance(error, GraphQLError):
                 self.logger.error("An exception occurred in resolvers", exc_info=error)
                 error = GraphQLError(str(error), original_error=error)
@@ -471,8 +479,8 @@ async def _get_operation_from_request(request: Request) -> Union[dict[str, Any],
     if content_type == "application/json":
         try:
             return cast(Union[dict[str, Any], list[Any]], await request.json())
-        except (TypeError, ValueError):
-            raise ValueError("Request body is not a valid JSON")
+        except (TypeError, ValueError) as err:
+            raise ValueError("Request body is not a valid JSON") from err
     elif content_type == "multipart/form-data":
         return await _get_operation_from_multipart(request)
     else:
@@ -482,24 +490,24 @@ async def _get_operation_from_request(request: Request) -> Union[dict[str, Any],
 async def _get_operation_from_multipart(request: Request) -> Union[dict[str, Any], list[Any]]:
     try:
         request_body = await request.form()
-    except Exception:
-        raise ValueError("Request body is not a valid multipart/form-data")
+    except Exception as err:
+        raise ValueError("Request body is not a valid multipart/form-data") from err
 
     try:
         operations_value = request_body.get("operations")
         operations_data = operations_value if isinstance(operations_value, str) else ""
         operations = ujson.loads(operations_data)
-    except (TypeError, ValueError):
-        raise ValueError("'operations' must be a valid JSON")
-    if not isinstance(operations, (dict, list)):
+    except (TypeError, ValueError) as err:
+        raise ValueError("'operations' must be a valid JSON") from err
+    if not isinstance(operations, dict | list):
         raise ValueError("'operations' field must be an Object or an Array")
 
     try:
         map_value = request_body.get("map")
         map_data = map_value if isinstance(map_value, str) else ""
         name_path_map = ujson.loads(map_data)
-    except (TypeError, ValueError):
-        raise ValueError("'map' field must be a valid JSON")
+    except (TypeError, ValueError) as err:
+        raise ValueError("'map' field must be a valid JSON") from err
     if not isinstance(name_path_map, dict):
         raise ValueError("'map' field must be an Object")
 

infrahub/graphql/auth/query_permission_checker/anonymous_checker.py

@@ -14,16 +14,16 @@ class AnonymousGraphQLPermissionChecker(GraphQLQueryPermissionCheckerInterface):
     def __init__(self, anonymous_access_allowed_func: Callable[[], bool]) -> None:
         self.anonymous_access_allowed_func = anonymous_access_allowed_func
 
-    async def supports(self, db: InfrahubDatabase, account_session: AccountSession, branch: Branch) -> bool:
+    async def supports(self, db: InfrahubDatabase, account_session: AccountSession, branch: Branch) -> bool:  # noqa: ARG002
         return not account_session.authenticated
 
     async def check(
         self,
-        db: InfrahubDatabase,
-        account_session: AccountSession,
+        db: InfrahubDatabase,  # noqa: ARG002
+        account_session: AccountSession,  # noqa: ARG002
         analyzed_query: InfrahubGraphQLQueryAnalyzer,
-        query_parameters: GraphqlParams,
-        branch: Branch,
+        query_parameters: GraphqlParams,  # noqa: ARG002
+        branch: Branch,  # noqa: ARG002
     ) -> CheckerResolution:
         if not self.anonymous_access_allowed_func() or analyzed_query.contains_mutation:
             raise AuthorizationError("Authentication is required to perform this operation")

infrahub/graphql/auth/query_permission_checker/default_branch_checker.py

@@ -25,16 +25,16 @@ class DefaultBranchPermissionChecker(GraphQLQueryPermissionCheckerInterface):
         "InfrahubAccountTokenDelete",
     ]
 
-    async def supports(self, db: InfrahubDatabase, account_session: AccountSession, branch: Branch) -> bool:
+    async def supports(self, db: InfrahubDatabase, account_session: AccountSession, branch: Branch) -> bool:  # noqa: ARG002
         return config.SETTINGS.main.allow_anonymous_access or account_session.authenticated
 
     async def check(
         self,
-        db: InfrahubDatabase,
-        account_session: AccountSession,
+        db: InfrahubDatabase,  # noqa: ARG002
+        account_session: AccountSession,  # noqa: ARG002
         analyzed_query: InfrahubGraphQLQueryAnalyzer,
         query_parameters: GraphqlParams,
-        branch: Branch,
+        branch: Branch,  # noqa: ARG002
     ) -> CheckerResolution:
         operates_on_default_branch = analyzed_query.branch is None or analyzed_query.branch.name in (
             GLOBAL_BRANCH_NAME,

infrahub/graphql/auth/query_permission_checker/merge_operation_checker.py

@@ -17,16 +17,16 @@ class MergeBranchPermissionChecker(GraphQLQueryPermissionCheckerInterface):
         action=GlobalPermissions.MERGE_BRANCH.value, decision=PermissionDecision.ALLOW_ALL.value
     )
 
-    async def supports(self, db: InfrahubDatabase, account_session: AccountSession, branch: Branch) -> bool:
+    async def supports(self, db: InfrahubDatabase, account_session: AccountSession, branch: Branch) -> bool:  # noqa: ARG002
         return config.SETTINGS.main.allow_anonymous_access or account_session.authenticated
 
     async def check(
         self,
-        db: InfrahubDatabase,
-        account_session: AccountSession,
+        db: InfrahubDatabase,  # noqa: ARG002
+        account_session: AccountSession,  # noqa: ARG002
         analyzed_query: InfrahubGraphQLQueryAnalyzer,
         query_parameters: GraphqlParams,
-        branch: Branch,
+        branch: Branch,  # noqa: ARG002
     ) -> CheckerResolution:
         if "BranchMerge" in [operation.name for operation in analyzed_query.operations]:
             query_parameters.context.active_permissions.raise_for_permission(permission=self.permission_required)

infrahub/graphql/auth/query_permission_checker/object_permission_checker.py

@@ -18,16 +18,16 @@ from .interface import CheckerResolution, GraphQLQueryPermissionCheckerInterface
 class ObjectPermissionChecker(GraphQLQueryPermissionCheckerInterface):
     """Checker that makes sure a user account can perform some action on some kind of objects."""
 
-    async def supports(self, db: InfrahubDatabase, account_session: AccountSession, branch: Branch) -> bool:
+    async def supports(self, db: InfrahubDatabase, account_session: AccountSession, branch: Branch) -> bool:  # noqa: ARG002
         return config.SETTINGS.main.allow_anonymous_access or account_session.authenticated
 
     async def check(
         self,
-        db: InfrahubDatabase,
-        account_session: AccountSession,
+        db: InfrahubDatabase,  # noqa: ARG002
+        account_session: AccountSession,  # noqa: ARG002
         analyzed_query: InfrahubGraphQLQueryAnalyzer,
         query_parameters: GraphqlParams,
-        branch: Branch,
+        branch: Branch,  # noqa: ARG002
     ) -> CheckerResolution:
         required_decision = (
             PermissionDecisionFlag.ALLOW_DEFAULT
@@ -36,34 +36,27 @@ class ObjectPermissionChecker(GraphQLQueryPermissionCheckerInterface):
             else PermissionDecisionFlag.ALLOW_OTHER
         )
 
-        kinds = await analyzed_query.get_models_in_use(types=query_parameters.context.types)
-
-        # Identify which operations are performed. As we don't have a mapping between kinds and the
-        # operation we currently require permissions all defined permissions for all objects
-        # within the GraphQL query / mutation
-        actions: set[str] = set()
-        for operation in analyzed_query.operations:
-            for kind in kinds:
-                if operation.name and operation.name.startswith(kind):
-                    # An empty string after prefix removal means a query to "view"
-                    query_action = operation.name[len(kind) :].lower() or "view"
-                    if query_action == "upsert":
-                        # Require both create and update for Upsert mutations
-                        actions.add("create")
-                        actions.add("update")
-                    else:
-                        actions.add(query_action)
-
-        # Infer required permissions from the kind/operation map
         permissions: list[ObjectPermission] = []
-        for action in actions:
-            for kind in kinds:
+        for kind, object_access in analyzed_query.query_report.requested_read.items():
+            if object_access.attributes or object_access.relationships:
+                extracted_words = extract_camelcase_words(kind)
+                permissions.append(
+                    ObjectPermission(
+                        namespace=extracted_words[0],
+                        name="".join(extracted_words[1:]),
+                        action="view",
+                        decision=required_decision,
+                    )
+                )
+
+        for kind, requested_permissions in analyzed_query.query_report.kind_action_map.items():
+            for requested_permission in requested_permissions:
                 extracted_words = extract_camelcase_words(kind)
                 permissions.append(
                     ObjectPermission(
                         namespace=extracted_words[0],
                         name="".join(extracted_words[1:]),
-                        action=action.lower(),
+                        action=requested_permission.value,
                         decision=required_decision,
                     )
                 )
@@ -83,19 +76,19 @@ class AccountManagerPermissionChecker(GraphQLQueryPermissionCheckerInterface):
         action=GlobalPermissions.MANAGE_ACCOUNTS.value, decision=PermissionDecision.ALLOW_ALL.value
     )
 
-    async def supports(self, db: InfrahubDatabase, account_session: AccountSession, branch: Branch) -> bool:
+    async def supports(self, db: InfrahubDatabase, account_session: AccountSession, branch: Branch) -> bool:  # noqa: ARG002
         return config.SETTINGS.main.allow_anonymous_access or account_session.authenticated
 
     async def check(
         self,
         db: InfrahubDatabase,
-        account_session: AccountSession,
+        account_session: AccountSession,  # noqa: ARG002
         analyzed_query: InfrahubGraphQLQueryAnalyzer,
         query_parameters: GraphqlParams,
         branch: Branch,
     ) -> CheckerResolution:
         is_account_operation = False
-        kinds = await analyzed_query.get_models_in_use(types=query_parameters.context.types)
+        kinds = analyzed_query.query_report.impacted_models
         operation_names = [operation.name for operation in analyzed_query.operations]
 
         for kind in kinds:
@@ -127,19 +120,19 @@ class PermissionManagerPermissionChecker(GraphQLQueryPermissionCheckerInterface)
         action=GlobalPermissions.MANAGE_PERMISSIONS.value, decision=PermissionDecision.ALLOW_ALL.value
     )
 
-    async def supports(self, db: InfrahubDatabase, account_session: AccountSession, branch: Branch) -> bool:
+    async def supports(self, db: InfrahubDatabase, account_session: AccountSession, branch: Branch) -> bool:  # noqa: ARG002
         return config.SETTINGS.main.allow_anonymous_access or account_session.authenticated
 
     async def check(
         self,
         db: InfrahubDatabase,
-        account_session: AccountSession,
+        account_session: AccountSession,  # noqa: ARG002
         analyzed_query: InfrahubGraphQLQueryAnalyzer,
         query_parameters: GraphqlParams,
         branch: Branch,
     ) -> CheckerResolution:
         is_permission_operation = False
-        kinds = await analyzed_query.get_models_in_use(types=query_parameters.context.types)
+        kinds = analyzed_query.query_report.impacted_models
 
         for kind in kinds:
             schema = get_schema(db=db, branch=branch, node_schema=kind)
@@ -168,19 +161,19 @@ class RepositoryManagerPermissionChecker(GraphQLQueryPermissionCheckerInterface)
         action=GlobalPermissions.MANAGE_REPOSITORIES.value, decision=PermissionDecision.ALLOW_ALL.value
     )
 
-    async def supports(self, db: InfrahubDatabase, account_session: AccountSession, branch: Branch) -> bool:
+    async def supports(self, db: InfrahubDatabase, account_session: AccountSession, branch: Branch) -> bool:  # noqa: ARG002
         return config.SETTINGS.main.allow_anonymous_access or account_session.authenticated
 
     async def check(
         self,
         db: InfrahubDatabase,
-        account_session: AccountSession,
+        account_session: AccountSession,  # noqa: ARG002
         analyzed_query: InfrahubGraphQLQueryAnalyzer,
         query_parameters: GraphqlParams,
         branch: Branch,
     ) -> CheckerResolution:
         is_repository_operation = False
-        kinds = await analyzed_query.get_models_in_use(types=query_parameters.context.types)
+        kinds = analyzed_query.query_report.impacted_models
 
         for kind in kinds:
             schema = get_schema(db=db, branch=branch, node_schema=kind)

infrahub/graphql/auth/query_permission_checker/super_admin_checker.py

@@ -17,16 +17,16 @@ class SuperAdminPermissionChecker(GraphQLQueryPermissionCheckerInterface):
         action=GlobalPermissions.SUPER_ADMIN.value, decision=PermissionDecision.ALLOW_ALL.value
     )
 
-    async def supports(self, db: InfrahubDatabase, account_session: AccountSession, branch: Branch) -> bool:
+    async def supports(self, db: InfrahubDatabase, account_session: AccountSession, branch: Branch) -> bool:  # noqa: ARG002
         return config.SETTINGS.main.allow_anonymous_access or account_session.authenticated
 
     async def check(
         self,
-        db: InfrahubDatabase,
-        account_session: AccountSession,
-        analyzed_query: InfrahubGraphQLQueryAnalyzer,
+        db: InfrahubDatabase,  # noqa: ARG002
+        account_session: AccountSession,  # noqa: ARG002
+        analyzed_query: InfrahubGraphQLQueryAnalyzer,  # noqa: ARG002
         query_parameters: GraphqlParams,
-        branch: Branch,
+        branch: Branch,  # noqa: ARG002
     ) -> CheckerResolution:
         return (
             CheckerResolution.TERMINATE

infrahub/graphql/enums.py

@@ -6,7 +6,7 @@ import graphene
 from infrahub.core.enums import generate_python_enum
 from infrahub.core.schema import AttributeSchema, MainSchemaTypes
 
-ENUM_NAME_REGEX = re.compile("[_a-zA-Z0-9]+")
+ENUM_NAME_REGEX = re.compile(r"[_a-zA-Z0-9]+")
 
 
 def get_enum_attribute_type_name(node_schema: MainSchemaTypes, attr_schema: AttributeSchema) -> str:

infrahub/graphql/initialization.py

@@ -5,6 +5,7 @@ from typing import TYPE_CHECKING
 
 from starlette.background import BackgroundTasks
 
+from infrahub.context import InfrahubContext
 from infrahub.core import registry
 from infrahub.core.timestamp import Timestamp
 from infrahub.exceptions import InitializationError
@@ -35,9 +36,9 @@ class GraphqlContext:
     branch: Branch
     types: dict
     single_relationship_resolver: SingleRelationshipResolver
+    service: InfrahubServices | None = None
     at: Timestamp | None = None
     related_node_ids: set | None = None
-    service: InfrahubServices | None = None
     account_session: AccountSession | None = None
     permissions: PermissionManager | None = None
     background: BackgroundTasks | None = None
@@ -70,6 +71,9 @@ class GraphqlContext:
             return self.service
         raise InitializationError("GraphQLContext doesn't contain a service")
 
+    def get_context(self) -> InfrahubContext:
+        return InfrahubContext.init(branch=self.branch, account=self.active_account_session)
+
 
 async def prepare_graphql_params(
     db: InfrahubDatabase,

infrahub/graphql/loaders/node.py

@@ -50,7 +50,7 @@ class NodeDataLoader(DataLoader[str, Node | None]):
         self.query_params = query_params
         self.db = db
 
-    async def batch_load_fn(self, keys: list[Any]) -> list[Node | None]:  # pylint: disable=method-hidden
+    async def batch_load_fn(self, keys: list[Any]) -> list[Node | None]:
         async with self.db.start_session() as db:
             nodes_by_id = await NodeManager.get_many(
                 db=db,
@@ -75,7 +75,7 @@ def to_frozen_set(to_freeze: dict[str, Any]) -> frozenset:
     for k, v in to_freeze.items():
         if isinstance(v, dict):
             freezing_dict[k] = to_frozen_set(v)
-        elif isinstance(v, (list, set)):
+        elif isinstance(v, list | set):
             freezing_dict[k] = frozenset(v)
         else:
             freezing_dict[k] = v