oarepo-workflows 2.0.0.dev7__tar.gz → 2.0.0.dev9__tar.gz

{oarepo_workflows-2.0.0.dev7 → oarepo_workflows-2.0.0.dev9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: oarepo-workflows
-Version: 2.0.0.dev7
+Version: 2.0.0.dev9
 Summary: OARepo module allowing record workflow functionality
 Project-URL: Homepage, https://github.com/oarepo/oarepo-workflows
 Author-email: Ronald Krist <krist@cesnet.cz>

{oarepo_workflows-2.0.0.dev7 → oarepo_workflows-2.0.0.dev9}/oarepo_workflows/__init__.py

@@ -13,7 +13,7 @@ from oarepo_workflows.services.permissions import (
     FromRecordWorkflow,
     IfInState,
     WorkflowPermission,
-    WorkflowRecordPermissionPolicy,
+    WorkflowRecordPermissionPolicyMixin,
 )
 
 from .base import Workflow
@@ -27,7 +27,7 @@ from .requests import (
     WorkflowTransitions,
 )
 
-__version__ = "2.0.0dev7"
+__version__ = "2.0.0dev9"
 """Version of the library."""
 
 
@@ -38,7 +38,7 @@ __all__ = (
     "IfInState",
     "Workflow",
     "WorkflowPermission",
-    "WorkflowRecordPermissionPolicy",
+    "WorkflowRecordPermissionPolicyMixin",
     "WorkflowRequest",
     "WorkflowRequestEscalation",
     "WorkflowRequestPolicy",

{oarepo_workflows-2.0.0.dev7 → oarepo_workflows-2.0.0.dev9}/oarepo_workflows/base.py

@@ -12,7 +12,7 @@ from __future__ import annotations
 import dataclasses
 from typing import TYPE_CHECKING, Any, Protocol
 
-from . import WorkflowRecordPermissionPolicy
+from . import WorkflowRecordPermissionPolicyMixin
 from .requests import WorkflowRequestPolicy
 from .services.permissions import DefaultWorkflowPermissions
 
@@ -69,7 +69,7 @@ class Workflow:
 
         This is just a sanity check to raise an error as soon as possible.
         """
-        if issubclass(self.permission_policy_cls, WorkflowRecordPermissionPolicy):
+        if issubclass(self.permission_policy_cls, WorkflowRecordPermissionPolicyMixin):
             raise TypeError(
                 f"Workflow permission policy {self.permission_policy_cls} is not a "
                 f"subclass of WorkflowRecordPermissionPolicy."

{oarepo_workflows-2.0.0.dev7 → oarepo_workflows-2.0.0.dev9}/oarepo_workflows/model/presets/services/records/permission_policy.py

@@ -17,18 +17,16 @@ from __future__ import annotations
 
 from typing import TYPE_CHECKING, Any, override
 
-from invenio_records_permissions.policies.records import RecordPermissionPolicy
-from oarepo_model.customizations import Customization, ReplaceBaseClass
+from oarepo_model.customizations.prepend_mixin import PrependMixin
 from oarepo_model.presets import Preset
 
-from oarepo_workflows.services.permissions.record_permission_policy import (
-    WorkflowRecordPermissionPolicy,
-)
+from oarepo_workflows.services.permissions import WorkflowRecordPermissionPolicyMixin
 
 if TYPE_CHECKING:
     from collections.abc import Generator
 
     from oarepo_model.builder import InvenioModelBuilder
+    from oarepo_model.customizations import Customization
     from oarepo_model.model import InvenioModel
 
 
@@ -44,9 +42,4 @@ class WorkflowsPermissionPolicyPreset(Preset):
         model: InvenioModel,
         dependencies: dict[str, Any],
     ) -> Generator[Customization]:
-        yield ReplaceBaseClass(
-            "PermissionPolicy",
-            RecordPermissionPolicy,
-            WorkflowRecordPermissionPolicy,
-            subclass=True,
-        )
+        yield PrependMixin("PermissionPolicy", WorkflowRecordPermissionPolicyMixin)

{oarepo_workflows-2.0.0.dev7 → oarepo_workflows-2.0.0.dev9}/oarepo_workflows/services/components/workflow.py

@@ -14,6 +14,9 @@ from typing import TYPE_CHECKING, Any, override
 from invenio_records_resources.services.records.components.base import ServiceComponent
 from oarepo_runtime.typing import require_kwargs
 
+from oarepo_workflows import current_oarepo_workflows
+from oarepo_workflows.errors import InvalidWorkflowError
+
 if TYPE_CHECKING:
     from flask_principal import Identity
     from invenio_drafts_resources.records import Record
@@ -50,4 +53,9 @@ class WorkflowComponent(ServiceComponent):
             workflow_id = data["parent"]["workflow"]
         except KeyError:
             return
+        if workflow_id not in current_oarepo_workflows.workflow_by_code:
+            raise InvalidWorkflowError(
+                f"Workflow {workflow_id} does not exist in the configuration.",
+                record=data or record,
+            )
         record.parent.workflow = workflow_id  # type: ignore[reportAttributeAccessIssue, reportOptionalMemberAccess]

{oarepo_workflows-2.0.0.dev7 → oarepo_workflows-2.0.0.dev9}/oarepo_workflows/services/permissions/__init__.py

@@ -10,7 +10,7 @@
 from __future__ import annotations
 
 from .generators import FromRecordWorkflow, IfInState, WorkflowPermission
-from .record_permission_policy import WorkflowRecordPermissionPolicy
+from .record_permission_policy import WorkflowRecordPermissionPolicyMixin
 from .workflow_permissions import DefaultWorkflowPermissions
 
 __all__ = (
@@ -18,5 +18,5 @@ __all__ = (
     "FromRecordWorkflow",
     "IfInState",
     "WorkflowPermission",
-    "WorkflowRecordPermissionPolicy",
+    "WorkflowRecordPermissionPolicyMixin",
 )

{oarepo_workflows-2.0.0.dev7 → oarepo_workflows-2.0.0.dev9}/oarepo_workflows/services/permissions/generators.py

@@ -37,6 +37,55 @@ if TYPE_CHECKING:
     from oarepo_workflows.services.permissions import DefaultWorkflowPermissions
 
 
+def query_filters_from_all_workflows(action: str, **context: Any) -> list[dsl.query.Query]:
+    """Get query filters to match records depending on the records' workflow."""
+    workflows = current_oarepo_workflows.record_workflows
+    queries = []
+    for workflow in workflows:
+        q_in_workflow = dsl.Q("term", **{"parent.workflow": workflow.code})
+        workflow_filters = workflow.permissions(action, **context).query_filters
+        if not workflow_filters:
+            workflow_filters = [dsl.Q("match_none")]
+        query = reduce(lambda f1, f2: f1 | f2, workflow_filters) & q_in_workflow
+        queries.append(query)
+    return [q for q in queries if q]
+
+
+class InAnyWorkflow(Generator):
+    """InAnyWorkflow generator.
+
+    Warning: if some workflow uses generators with excludes, they can clash with needs in different workflows leading
+    to the generator excluding users even though they are allowed in the workflow without the excludes generator.
+    This is due to how flask allows() is implemented.
+
+    Eg. If workflow 1 defines provides need for User 1 and Workflow 2 excludes User 1,
+    the generator will treat user 1 as excluded despite being allowed in the first workflow.
+    """
+
+    def __init__(self, action: str) -> None:
+        """Construct the generator."""
+        self._action = action
+
+    @override
+    def needs(self, **context: Any) -> Sequence[Need]:
+        ret = set()
+        for workflow in current_oarepo_workflows.record_workflows:
+            ret |= set(workflow.permissions(self._action, **context).needs)
+        return list(ret)
+
+    @override
+    def excludes(self, **context: Any) -> Sequence[Need]:
+        ret = set()
+        for workflow in current_oarepo_workflows.record_workflows:
+            ret |= set(workflow.permissions(self._action, **context).excludes)
+        return list(ret)
+
+    @override
+    def query_filter(self, **context: Any) -> dsl.query.Query:
+        queries = query_filters_from_all_workflows(self._action, **context)
+        return reduce(operator.or_, queries)
+
+
 class FromRecordWorkflow(Generator):
     """Permission delegating check to workflow.
 

{oarepo_workflows-2.0.0.dev7 → oarepo_workflows-2.0.0.dev9}/oarepo_workflows/services/permissions/record_permission_policy.py

@@ -9,31 +9,34 @@
 
 from __future__ import annotations
 
-from functools import reduce
 from typing import TYPE_CHECKING
 
-from invenio_records_permissions import RecordPermissionPolicy
 from invenio_records_permissions.generators import (
     AnyUser,
+    AuthenticatedUser,
     SystemProcess,
 )
-from invenio_search.engine import dsl
 
-from ...proxies import current_oarepo_workflows
-from .generators import FromRecordWorkflow
+from .generators import FromRecordWorkflow, SameAs, query_filters_from_all_workflows
 
 if TYPE_CHECKING:
+    from invenio_records_permissions import RecordPermissionPolicy as InvenioRecordPermissionPolicy
     from opensearch_dsl.query import Query
+else:
+    InvenioRecordPermissionPolicy = object
 
 
-class WorkflowRecordPermissionPolicy(RecordPermissionPolicy):
+class WorkflowRecordPermissionPolicyMixin(InvenioRecordPermissionPolicy):
     """Permission policy to be used in permission presets directly on RecordServiceConfig.permission_policy_cls.
 
     Do not use this class in Workflow constructor.
     """
 
     can_commit_files = (FromRecordWorkflow("commit_files"),)
-    can_create = (FromRecordWorkflow("create"),)
+    can_create = (
+        SystemProcess(),
+        AuthenticatedUser(),
+    )
     can_create_files = (FromRecordWorkflow("create_files"),)
     can_delete = (FromRecordWorkflow("delete"),)
     can_delete_draft = (FromRecordWorkflow("delete_draft"),)
@@ -116,6 +119,7 @@ class WorkflowRecordPermissionPolicy(RecordPermissionPolicy):
     can_remove_record = (FromRecordWorkflow("remove_record"),)
     can_review = (FromRecordWorkflow("review"),)
     can_view = (FromRecordWorkflow("view"),)
+    can_view_deposit_page = (SameAs("can_create"),)
 
     @property
     def query_filters(self) -> list[Query]:
@@ -127,13 +131,4 @@ class WorkflowRecordPermissionPolicy(RecordPermissionPolicy):
             "read_all_records",
         ):
             return super().query_filters  # type: ignore[no-any-return]
-        workflows = current_oarepo_workflows.record_workflows
-        queries = []
-        for workflow in workflows:
-            q_in_workflow = dsl.Q("term", **{"parent.workflow": workflow.code})
-            workflow_filters = workflow.permissions(self.action, **self.over).query_filters
-            if not workflow_filters:
-                workflow_filters = [dsl.Q("match_none")]
-            query = reduce(lambda f1, f2: f1 | f2, workflow_filters) & q_in_workflow
-            queries.append(query)
-        return [q for q in queries if q]
+        return query_filters_from_all_workflows(self.action, **self.over)