nmdc-runtime 2.1.0__tar.gz → 2.1.1__tar.gz

{nmdc_runtime-2.1.0/nmdc_runtime.egg-info → nmdc_runtime-2.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: nmdc_runtime
-Version: 2.1.0
+Version: 2.1.1
 Summary: A runtime system for NMDC data management and orchestration
 Home-page: https://github.com/microbiomedata/nmdc-runtime
 Author: Donny Winston

{nmdc_runtime-2.1.0 → nmdc_runtime-2.1.1}/nmdc_runtime/api/endpoints/queries.py

@@ -11,7 +11,7 @@ from nmdc_runtime.api.db.mongo import (
     get_mongo_db,
     get_nonempty_nmdc_schema_collection_names,
 )
-from nmdc_runtime.api.endpoints.util import permitted, users_allowed
+from nmdc_runtime.api.endpoints.util import permitted, users_allowed, strip_oid
 from nmdc_runtime.api.models.query import (
     Query,
     QueryResponseOptions,
@@ -23,6 +23,7 @@ from nmdc_runtime.api.models.query import (
     UpdateCommand,
 )
 from nmdc_runtime.api.models.user import get_current_active_user, User
+from nmdc_runtime.util import OverlayDB, validate_json
 
 router = APIRouter()
 
@@ -165,6 +166,42 @@ def _run_query(query, mdb) -> CommandResponse:
             {"filter": up_statement.q, "limit": 0 if up_statement.multi else 1}
             for up_statement in query.cmd.updates
         ]
+        # Execute this "update" command on a temporary "overlay" database so we can
+        # validate its outcome before executing it on the real database. If its outcome
+        # is invalid, we will abort and raise an "HTTP 422" exception.
+        #
+        # TODO: Consider wrapping this entire "preview-then-apply" sequence within a
+        #       MongoDB transaction so as to avoid race conditions where the overlay
+        #       database at "preview" time does not reflect the state of the database
+        #       at "apply" time. This will be necessary once the "preview" step
+        #       accounts for referential integrity.
+        #
+        with OverlayDB(mdb) as odb:
+            odb.apply_updates(
+                collection_name,
+                [u.model_dump(mode="json", exclude="hint") for u in query.cmd.updates],
+            )
+            _ids_to_check = set()
+            for spec in update_specs:
+                for doc in mdb[collection_name].find(
+                    filter=spec["filter"],
+                    limit=spec["limit"],
+                    projection={
+                        "_id": 1
+                    },  # unique `id` not guaranteed (see e.g. `functional_annotation_agg`)
+                ):
+                    _ids_to_check.add(doc["_id"])
+            docs_to_check = odb._top_db[collection_name].find(
+                {"_id": {"$in": list(_ids_to_check)}}
+            )
+            rv = validate_json(
+                {collection_name: [strip_oid(d) for d in docs_to_check]}, mdb
+            )
+            if rv["result"] == "errors":
+                raise HTTPException(
+                    status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
+                    detail=f"Schema document(s) would be invalid after proposed update: {rv['detail']}",
+                )
         for spec in update_specs:
             docs = list(mdb[collection_name].find(**spec))
             if not docs:

{nmdc_runtime-2.1.0 → nmdc_runtime-2.1.1}/nmdc_runtime/api/models/user.py

@@ -14,6 +14,9 @@ from nmdc_runtime.api.core.auth import (
     TokenData,
     bearer_scheme,
 )
+
+from nmdc_runtime.api.models.site import get_site
+
 from nmdc_runtime.api.db.mongo import get_mongo_db
 
 
@@ -60,21 +63,44 @@ async def get_current_user(
         subject: str = payload.get("sub")
         if subject is None:
             raise credentials_exception
-        if not subject.startswith("user:"):
+        if not subject.startswith("user:") and not subject.startswith("client:"):
             raise credentials_exception
-        username = subject.split("user:", 1)[1]
+
+        # subject is in the form "user:foo" or "client:bar"
+        username = subject.split(":", 1)[1]
         token_data = TokenData(subject=username)
     except (JWTError, AttributeError) as e:
         print(f"jwt error: {e}")
         raise credentials_exception
-    user = get_user(mdb, username=token_data.subject)
+
+    # Coerce a "client" into a "user"
+    # TODO: consolidate the client/user distinction.
+    if subject.startswith("user:"):
+        user = get_user(mdb, username=token_data.subject)
+    elif subject.startswith("client:"):
+        # construct a user from the client_id
+        user = get_client_user(mdb, client_id=token_data.subject)
+    else:
+        raise credentials_exception
     if user is None:
         raise credentials_exception
     return user
 
 
+def get_client_user(mdb, client_id: str) -> UserInDB:
+    site = get_site(mdb, client_id)
+    if site is None:
+        raise credentials_exception
+    client = next(client for client in site.clients if client.id == client_id)
+    if client is None:
+        raise credentials_exception
+    # Coerce the client into a user
+    user = UserInDB(username=client.id, hashed_password=client.hashed_secret)
+    return user
+
+
 async def get_current_active_user(
-    current_user: User = Depends(get_current_user),
+    current_user: UserInDB = Depends(get_current_user),
 ) -> UserInDB:
     if current_user.disabled:
         raise HTTPException(status_code=400, detail="Inactive user")

{nmdc_runtime-2.1.0 → nmdc_runtime-2.1.1/nmdc_runtime.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: nmdc_runtime
-Version: 2.1.0
+Version: 2.1.1
 Summary: A runtime system for NMDC data management and orchestration
 Home-page: https://github.com/microbiomedata/nmdc-runtime
 Author: Donny Winston

{nmdc_runtime-2.1.0 → nmdc_runtime-2.1.1}/tests/test_api/test_endpoints.py

@@ -20,7 +20,12 @@ from nmdc_runtime.api.models.site import SiteInDB, SiteClientInDB
 from nmdc_runtime.api.models.user import UserInDB, UserIn, User
 from nmdc_runtime.site.ops import materialize_alldocs
 from nmdc_runtime.site.repository import run_config_frozen__normal_env
-from nmdc_runtime.site.resources import get_mongo, RuntimeApiSiteClient, mongo_resource
+from nmdc_runtime.site.resources import (
+    get_mongo,
+    RuntimeApiSiteClient,
+    mongo_resource,
+    RuntimeApiUserClient,
+)
 from nmdc_runtime.util import REPO_ROOT_DIR, ensure_unique_id_indexes
 
 
@@ -105,6 +110,20 @@ def ensure_test_resources(mdb):
     }
 
 
+@pytest.fixture
+def api_site_client():
+    mdb = get_mongo_db()
+    rs = ensure_test_resources(mdb)
+    return RuntimeApiSiteClient(base_url=os.getenv("API_HOST"), **rs["site_client"])
+
+
+@pytest.fixture
+def api_user_client():
+    mdb = get_mongo_db()
+    rs = ensure_test_resources(mdb)
+    return RuntimeApiUserClient(base_url=os.getenv("API_HOST"), **rs["user"])
+
+
 @pytest.mark.skip(reason="Skipping because test causes suite to hang")
 def test_update_operation():
     mdb = get_mongo(run_config_frozen__normal_env).db
@@ -173,13 +192,6 @@ def test_create_user():
         )
 
 
-@pytest.fixture
-def api_site_client():
-    mdb = get_mongo_db()
-    rs = ensure_test_resources(mdb)
-    return RuntimeApiSiteClient(base_url=os.getenv("API_HOST"), **rs["site_client"])
-
-
 def test_metadata_validate_json_0(api_site_client):
     rv = api_site_client.request(
         "POST",
@@ -289,10 +301,10 @@ def test_submit_workflow_activities(api_site_client):
                 "has_output": [
                     "nmdc:dobj-11-w5dak635",
                     "nmdc:dobj-11-g6d71n77",
-                    "nmdc:dobj-11-bds7qq03"
+                    "nmdc:dobj-11-bds7qq03",
                 ],
                 "type": "nmdc:ReadQcAnalysis",
-                "version": "v1.0.8"
+                "version": "v1.0.8",
             }
         ]
     }
@@ -379,6 +391,7 @@ def test_find_planned_processes(api_site_client):
     )
     assert rv.json()["meta"]["count"] >= 9
 
+
 def test_find_planned_process_by_id(api_site_client):
     # Seed the database with documents that represent instances of the `PlannedProcess` class or any of its subclasses.
     mdb = get_mongo_db()
@@ -418,3 +431,157 @@ def test_find_planned_process_by_id(api_site_client):
             "GET",
             f"/planned_processes/nmdc:sty-11-00000001",
         )
+
+
+def test_run_query_find_user(api_user_client):
+    mdb = get_mongo_db()
+    if not mdb.biosample_set.find_one({"id": "nmdc:bsm-12-7mysck21"}):
+        mdb.biosample_set.insert_one(
+            json.loads(
+                (
+                    REPO_ROOT_DIR / "tests" / "files" / "nmdc_bsm-12-7mysck21.json"
+                ).read_text()
+            )
+        )
+
+    # Make sure user client works
+    response = api_user_client.request(
+        "POST",
+        "/queries:run",
+        {"find": "biosample_set", "filter": {"id": "nmdc:bsm-12-7mysck21"}},
+    )
+    assert response.status_code == 200
+    assert "cursor" in response.json()
+
+
+def test_run_query_find_site(api_site_client):
+    mdb = get_mongo_db()
+    if not mdb.biosample_set.find_one({"id": "nmdc:bsm-12-7mysck21"}):
+        mdb.biosample_set.insert_one(
+            json.loads(
+                (
+                    REPO_ROOT_DIR / "tests" / "files" / "nmdc_bsm-12-7mysck21.json"
+                ).read_text()
+            )
+        )
+
+    # Make sure site client works
+    response = api_site_client.request(
+        "POST",
+        "/queries:run",
+        {"find": "biosample_set", "filter": {"id": "nmdc:bsm-12-7mysck21"}},
+    )
+    assert response.status_code == 200
+    assert "cursor" in response.json()
+
+
+def test_run_query_delete(api_user_client):
+    mdb = get_mongo_db()
+    biosample_id = "nmdc:bsm-12-deleteme"
+
+    if not mdb.biosample_set.find_one({"id": biosample_id}):
+        mdb.biosample_set.insert_one({"id": biosample_id})
+
+    # Access should not work without permissions
+    mdb["_runtime"].api.allow.delete_many(
+        {
+            "username": api_user_client.username,
+            "action": "/queries:run(query_cmd:DeleteCommand)",
+        }
+    )
+    with pytest.raises(requests.exceptions.HTTPError) as excinfo:
+        response = api_user_client.request(
+            "POST",
+            "/queries:run",
+            {
+                "delete": "biosample_set",
+                "deletes": [{"q": {"id": biosample_id}, "limit": 1}],
+            },
+        )
+    assert excinfo.value.response.status_code == 403
+
+    # Add persmissions to DB
+    mdb["_runtime"].api.allow.insert_one(
+        {
+            "username": api_user_client.username,
+            "action": "/queries:run(query_cmd:DeleteCommand)",
+        }
+    )
+    try:
+        response = api_user_client.request(
+            "POST",
+            "/queries:run",
+            {
+                "delete": "biosample_set",
+                "deletes": [{"q": {"id": biosample_id}, "limit": 1}],
+            },
+        )
+        assert response.status_code == 200
+        assert response.json()["n"] == 1
+    finally:
+        mdb["_runtime"].api.allow.delete_one({"username": api_user_client.username})
+
+
+def test_run_query_delete_site(api_site_client):
+    mdb = get_mongo_db()
+    biosample_id = "nmdc:bsm-12-deleteme"
+
+    if not mdb.biosample_set.find_one({"id": biosample_id}):
+        mdb.biosample_set.insert_one({"id": biosample_id})
+
+    # Access should not work without permissions
+    with pytest.raises(requests.exceptions.HTTPError) as excinfo:
+        response = api_site_client.request(
+            "POST",
+            "/queries:run",
+            {
+                "delete": "biosample_set",
+                "deletes": [{"q": {"id": biosample_id}, "limit": 1}],
+            },
+        )
+    assert excinfo.value.response.status_code == 403
+
+    # Add persmissions to DB
+    mdb["_runtime"].api.allow.insert_one(
+        {
+            "username": api_site_client.client_id,
+            "action": "/queries:run(query_cmd:DeleteCommand)",
+        }
+    )
+    try:
+        response = api_site_client.request(
+            "POST",
+            "/queries:run",
+            {
+                "delete": "biosample_set",
+                "deletes": [{"q": {"id": biosample_id}, "limit": 1}],
+            },
+        )
+        assert response.status_code == 200
+        assert response.json()["n"] == 1
+    finally:
+        mdb["_runtime"].api.allow.delete_one({"username": api_site_client.client_id})
+
+
+def test_run_query_update(api_user_client):
+    """Submit a request to store data that does not comply with the schema."""
+    mdb = get_mongo_db()
+    allow_spec = {
+        "username": api_user_client.username,
+        "action": "/queries:run(query_cmd:DeleteCommand)",
+    }
+    mdb["_runtime.api.allow"].replace_one(allow_spec, allow_spec, upsert=True)
+    with pytest.raises(requests.HTTPError):
+        api_user_client.request(
+            "POST",
+            "/queries:run",
+            {
+                "update": "biosample_set",
+                "updates": [
+                    {
+                        "q": {"id": "nmdc:bsm-13-amrnys72"},
+                        "u": {"$set": {"associated_studies.0": 42}},
+                    }
+                ],
+            },
+        )