oldaplib 0.3.30__py3-none-any.whl → 0.4.1__py3-none-any.whl

oldaplib/src/user.py

@@ -140,19 +140,22 @@ user3 = User.read(con=self._connection, userId="aedison")
 user3.delete()
 ```
 """
+import textwrap
 from copy import deepcopy
 from enum import Enum
 from functools import partial
 from pprint import pprint
-from typing import List, Self, Optional, Any
+from typing import List, Self, Optional, Any, Tuple
 
 import bcrypt
 
 from oldaplib.src.cachesingleton import CacheSingleton, CacheSingletonRedis
 from oldaplib.src.enums.action import Action
+from oldaplib.src.enums.datapermissions import DataPermission
 from oldaplib.src.enums.userattr import UserAttr
 from oldaplib.src.helpers.context import Context
 from oldaplib.src.helpers.irincname import IriOrNCName
+from oldaplib.src.helpers.observable_dict import ObservableDict
 from oldaplib.src.helpers.observable_set import ObservableSet
 from oldaplib.src.helpers.serializer import serializer
 from oldaplib.src.in_project import InProjectClass
@@ -235,6 +238,18 @@ class User(Model):
                          validate=validate)
 
         self.set_attributes(kwargs, UserAttr)
+
+        #
+        # maybe we have to change the default data permissionss for the user
+        #
+        if self._attributes.get(UserAttr.HAS_ROLE):
+            tmp = ObservableDict()
+            for role, dperm in self._attributes[UserAttr.HAS_ROLE].items():
+                if not isinstance(dperm, DataPermission):
+                    tmp[role] = DataPermission.from_qname(dperm) if isinstance(dperm, Xsd_QName) else DataPermission.from_string(dperm)
+                else:
+                    tmp[role] = dperm
+            self._attributes[UserAttr.HAS_ROLE] = tmp
         #
         # Consistency checks
         #
@@ -246,10 +261,11 @@ class User(Model):
         else:
             self._attributes[UserAttr.IN_PROJECT] = InProjectClass(notifier=self.__inProject_cb)
 
-        if self._attributes.get(UserAttr.HAS_PERMISSIONS):
-            self._attributes[UserAttr.HAS_PERMISSIONS].set_notifier(self.__hasPermission_cb, UserAttr.HAS_PERMISSIONS)
+        if self._attributes.get(UserAttr.HAS_ROLE):
+            #self._attributes[UserAttr.HAS_ROLE].set_on_change(self.__hasRole_cb, UserAttr.HAS_ROLE)
+            self._attributes[UserAttr.HAS_ROLE].set_on_change(self.__hasRole_cb)
         else:
-            self._attributes[UserAttr.HAS_PERMISSIONS] = ObservableSet(notifier=self.__hasPermission_cb)
+            self._attributes[UserAttr.HAS_ROLE] = ObservableDict(on_change=self.__hasRole_cb)
 
         if self._attributes.get(UserAttr.CREDENTIALS):
             if not str(self._attributes[UserAttr.CREDENTIALS]).startswith(('$2a$', '$2b$', '$2y$')):
@@ -292,13 +308,13 @@ class User(Model):
                 self._attributes[UserAttr.IN_PROJECT] = InProjectClass(notifier=self.__inProject_cb)
             else:
                 self._attributes[UserAttr.IN_PROJECT] = InProjectClass(value, notifier=self.__inProject_cb)
-        if attr == UserAttr.HAS_PERMISSIONS:
+        if attr == UserAttr.HAS_ROLE:
             if value is None:
-                self._attributes[UserAttr.HAS_PERMISSIONS] = ObservableSet(notifier=self.__hasPermission_cb)
+                self._attributes[UserAttr.HAS_ROLE] = ObservableDict(on_change=self.__hasRole_cb)
             else:
-                self._attributes[UserAttr.HAS_PERMISSIONS] = ObservableSet(value, notifier=self.__hasPermission_cb)
+                self._attributes[UserAttr.HAS_ROLE] = ObservableDict(value, on_change=self.__hasRole_cb)
 
-    def check_for_permissions(self) -> (bool, str):
+    def check_for_permissions(self) -> Tuple[bool, str]:
         """
         Evaluates whether the currently logged-in user ("actor") has the necessary permissions
         to create a user for the specified project(s). The function checks if the actor has root
@@ -336,9 +352,9 @@ class User(Model):
     # Callbacks for the `ObservableSet`class. This is used whenever the `hasPermission`or
     # `inProject`properties are being modified
     #
-    def __hasPermission_cb(self, data: Enum | Iri = None) -> None:
-        if self._changeset.get(UserAttr.HAS_PERMISSIONS) is None:
-            self._changeset[UserAttr.HAS_PERMISSIONS] = AttributeChange(None, Action.MODIFY)
+    def __hasRole_cb(self, old_value: ObservableDict) -> None:
+        if self._changeset.get(UserAttr.HAS_ROLE) is None:
+            self._changeset[UserAttr.HAS_ROLE] = AttributeChange(old_value, Action.MODIFY)
 
     def __inProject_cb(self, data: Enum | Iri = None) -> None:
         if self._changeset.get(UserAttr.IN_PROJECT) is None:
@@ -391,9 +407,12 @@ class User(Model):
             for p in self.inProject.keys():
                 for admin_p in self.inProject[p]:  # TODO: May be use .get() instead of [] !!!!!!!!!!!!!!!!!!!!!!!!!
                     star += f'{blank:{indent * indent_inc}}<<{self.userIri.toRdf} oldap:inProject {p.toRdf}>> oldap:hasAdminPermission {admin_p.value} .\n'
-        if self.hasPermissions:
-            rdfstr = ", ".join([str(x) for x in self.hasPermissions])
-            sparql += f' ;\n{blank:{(indent + 1) * indent_inc}}oldap:hasPermissions {rdfstr}'
+        if self.hasRole:
+            rdfstr = ", ".join([str(x) for x in self.hasRole.keys()])
+            sparql += f' ;\n{blank:{(indent + 1) * indent_inc}}oldap:hasRole {rdfstr}'
+            for r, p in self.hasRole.items():
+                if p:
+                    star += f'{blank:{(indent + 1) * indent_inc}}<<{self.userIri.toRdf} oldap:hasRole {r.toRdf}>> oldap:hasDefaultDataPermission {p.value} .\n'
         sparql += " .\n\n"
         sparql += star
         return sparql
@@ -427,52 +446,66 @@ class User(Model):
             self.userIri = Iri()
         context = Context(name=self._con.context_name)
         sparql1 = context.sparql_context
-        sparql1 += f"""
-        SELECT ?user
+        #
+        # SPARQL to test if a user with the same userId already exists
+        #
+        sparql1 += textwrap.dedent(f"""
+        ASK
         FROM oldap:admin
         WHERE {{
-            ?user a oldap:User .
-            ?user oldap:userId {self.userId.toRdf} .         
+            ?user oldap:userId {self.userId.toRdf} .
         }}
-        """
+        """)
 
+        #
+        # SPARQL to test if a user with the same userIri already exists
+        #
         sparql2 = context.sparql_context
-        sparql2 += f"""
-        SELECT ?user
+        sparql2 += textwrap.dedent(f"""
+        ASK
         FROM oldap:admin
         WHERE {{
-            ?user a oldap:User .
-            FILTER(?user = {self.userIri.toRdf})
+             {self.userIri.toRdf} ?p ?o
         }}
-        """
+        """)
 
+        #
+        # SPARQL to test if the projects the user should be in do exist...
+        #
         proj_test = None
         if self.inProject:
             projs = [x.toRdf for x in self.inProject.keys()]
             projslist = ", ".join(projs)
             proj_test = context.sparql_context
-            proj_test += f"""
+            proj_test += textwrap.dedent(f"""
             SELECT ?project
             FROM oldap:admin
             WHERE {{
                 ?project a oldap:Project .
                 FILTER(?project IN ({projslist}))
             }}
-            """
-
-        pset_test = None
-        if self.hasPermissions:
-            perms = [x.toRdf for x in self.hasPermissions]
-            perms = ", ".join(perms)
-            pset_test = context.sparql_context
-            pset_test += f"""
-            SELECT ?permissionset
+            """)
+        else:
+            projs = []
+
+        #
+        # SPARQL to test if the roles the user should have do exist...
+        #
+        roles_test = None
+        if self.hasRole:
+            roles = [x.toRdf for x in self.hasRole]
+            roles = ", ".join(roles)
+            roles_test = context.sparql_context
+            roles_test += textwrap.dedent(f"""
+            SELECT ?role
             FROM oldap:admin
             WHERE {{
-                ?permissionset a oldap:PermissionSet .
-                FILTER(?permissionset IN ({perms}))
+                ?role a oldap:Role .
+                FILTER(?role IN ({roles}))
             }}
-            """
+            """)
+        else:
+            roles = []
 
         timestamp = Xsd_dateTime.now()
         blank = ''
@@ -492,31 +525,6 @@ class User(Model):
                                        contributor=self._con.userIri,
                                        modified=timestamp,
                                        indent=indent + 2, indent_inc=indent_inc)
-        # sparql += f'{blank:{(indent + 2) * indent_inc}}{self.userIri.toRdf} a oldap:User'
-        # sparql += f' ;\n{blank:{(indent + 3) * indent_inc}}dcterms:creator {self._con.userIri.toRdf}'
-        # sparql += f' ;\n{blank:{(indent + 3) * indent_inc}}dcterms:created {timestamp.toRdf}'
-        # sparql += f' ;\n{blank:{(indent + 3) * indent_inc}}dcterms:contributor {self._con.userIri.toRdf}'
-        # sparql += f' ;\n{blank:{(indent + 3) * indent_inc}}dcterms:modified {timestamp.toRdf}'
-        # sparql += f' ;\n{blank:{(indent + 3) * indent_inc}}oldap:userId {self.userId.toRdf}'
-        # sparql += f' ;\n{blank:{(indent + 3) * indent_inc}}schema:familyName {self.familyName.toRdf}'
-        # sparql += f' ;\n{blank:{(indent + 3) * indent_inc}}schema:givenName {self.givenName.toRdf}'
-        # sparql += f' ;\n{blank:{(indent + 3) * indent_inc}}schema:email {self.email.toRdf}'
-        # sparql += f' ;\n{blank:{(indent + 3) * indent_inc}}oldap:credentials {self.credentials.toRdf}'
-        # activeval = "true" if self.isActive else "false"
-        # sparql += f' ;\n{blank:{(indent + 3) * indent_inc}}oldap:isActive {activeval}'
-        # star = ''
-        # if self.inProject:
-        #     project = [p.toRdf for p in self.inProject.keys()]
-        #     rdfstr = ", ".join(project)
-        #     sparql += f' ;\n{blank:{(indent + 3) * indent_inc}}oldap:inProject {rdfstr}'
-        #     for p in self.inProject.keys():
-        #         for admin_p in self.inProject[p]:  # TODO: May be use .get() instead of [] !!!!!!!!!!!!!!!!!!!!!!!!!
-        #             star += f'{blank:{(indent + 2) * indent_inc}}<<{self.userIri.toRdf} oldap:inProject {p.toRdf}>> oldap:hasAdminPermission {admin_p.value} .\n'
-        # if self.hasPermissions:
-        #     rdfstr = ", ".join([str(x) for x in self.hasPermissions])
-        #     sparql += f' ;\n{blank:{(indent + 3) * indent_inc}}oldap:hasPermissions {rdfstr}'
-        # sparql += " .\n\n"
-        # sparql += star
         sparql += f'{blank:{(indent + 1) * indent_inc}}}}\n'
         sparql += f'{blank:{indent * indent_inc}}}}\n'
 
@@ -526,8 +534,7 @@ class User(Model):
         except OldapError:
             self._con.transaction_abort()
             raise
-        res = QueryProcessor(context, jsonobj)
-        if len(res) > 0:
+        if jsonobj['boolean']:
             self._con.transaction_abort()
             raise OldapErrorAlreadyExists(f'A user with a user ID "{self.userId}" already exists')
 
@@ -536,8 +543,7 @@ class User(Model):
         except OldapError:
             self._con.transaction_abort()
             raise
-        res = QueryProcessor(context, jsonobj)
-        if len(res) > 0:
+        if jsonobj['boolean']:
             self._con.transaction_abort()
             raise OldapErrorAlreadyExists(f'A user with a user IRI "{self.userIri}" already exists')
 
@@ -552,16 +558,16 @@ class User(Model):
                 self._con.transaction_abort()
                 raise OldapErrorValue("One of the projects is not existing!")
 
-        if self.hasPermissions:
+        if self.hasRole:
             try:
-                jsonobj = self._con.transaction_query(pset_test)
+                jsonobj = self._con.transaction_query(roles_test)
             except OldapError:
                 self._con.transaction_abort()
                 raise
             res = QueryProcessor(context, jsonobj)
-            if len(res) != len(self.hasPermissions):
+            if len(res) != len(self.hasRole):
                 self._con.transaction_abort()
-                raise OldapErrorValue("One of the permission sets is not existing!")
+                raise OldapErrorValue(f"One of the Roles {self.hasRole} is not existing!")
 
         try:
             self._con.transaction_update(sparql)
@@ -640,7 +646,7 @@ class User(Model):
                        credentials=userdata.credentials,
                        isActive=userdata.isActive,
                        inProject=userdata.inProject,
-                       hasPermissions=userdata.hasPermissions)
+                       hasRole=userdata.hasRole)
         cache = CacheSingletonRedis()
         cache.set(instance.userIri, instance)
         instance.clear_changeset()
@@ -745,6 +751,14 @@ class User(Model):
             ?user a oldap:User .
             ?user oldap:userId {self.userId.toRdf} .
         }} ;
+        WITH oldap:admin
+        DELETE {{
+            <<?user oldap:hasRole ?role>> oldap:hasDefaultDataPermission ?dval .    
+        }}
+        WHERE {{
+            ?user a oldap:User .
+            ?user oldap:userId {self.userId.toRdf} .
+        }} ;
         DELETE WHERE {{
             ?user a oldap:User .
             ?user oldap:userId {self.userId.toRdf} .
@@ -804,7 +818,7 @@ class User(Model):
         blank = ''
         sparql_list = []
         for field, change in self._changeset.items():
-            if field == UserAttr.HAS_PERMISSIONS or field == UserAttr.IN_PROJECT:
+            if field == UserAttr.HAS_ROLE or field == UserAttr.IN_PROJECT:
                 continue
             sparql = f'{blank:{indent * indent_inc}}# User field "{field.value}" with action "{change.action.value}"\n'
             sparql += f'{blank:{indent * indent_inc}}WITH oldap:admin\n'
@@ -823,33 +837,48 @@ class User(Model):
             sparql += f'{blank:{indent * indent_inc}}}}'
             sparql_list.append(sparql)
 
-        if UserAttr.HAS_PERMISSIONS in self._changeset:
-            added = set()
-            removed = set()
-            if self._changeset[UserAttr.HAS_PERMISSIONS].action == Action.CREATE:
-                added = self._attributes[UserAttr.HAS_PERMISSIONS]
-            elif self._changeset[UserAttr.HAS_PERMISSIONS].action == Action.DELETE:
-                removed = self._changeset[UserAttr.HAS_PERMISSIONS].old_value
-            elif self._changeset[UserAttr.HAS_PERMISSIONS].action == Action.REPLACE:
-                added = self._attributes[UserAttr.HAS_PERMISSIONS]
-                removed = self._changeset[UserAttr.HAS_PERMISSIONS].old_value
-            elif self._changeset[UserAttr.HAS_PERMISSIONS].action == Action.MODIFY:
-                A = self._attributes[UserAttr.HAS_PERMISSIONS]
-                B = self._attributes[UserAttr.HAS_PERMISSIONS].old_value
-                added = A - B
-                removed = B - A
-
-            sparql = f'{blank:{indent * indent_inc}}# User field "hasPermission"\n'
+        if UserAttr.HAS_ROLE in self._changeset:
+            added = {}
+            removed = {}
+            changed = {}
+            if self._changeset[UserAttr.HAS_ROLE].action == Action.CREATE:
+                added = self._attributes[UserAttr.HAS_ROLE]
+            elif self._changeset[UserAttr.HAS_ROLE].action == Action.DELETE:
+                removed = self._changeset[UserAttr.HAS_ROLE].old_value
+            elif self._changeset[UserAttr.HAS_ROLE].action == Action.REPLACE:
+                added = self._attributes[UserAttr.HAS_ROLE]
+                removed = self._changeset[UserAttr.HAS_ROLE].old_value
+            elif self._changeset[UserAttr.HAS_ROLE].action == Action.MODIFY:
+                if self._changeset[UserAttr.HAS_ROLE].old_value:
+                    added = {key: self._attributes[UserAttr.HAS_ROLE][key] for key in self._attributes[UserAttr.HAS_ROLE].keys() - self._changeset[UserAttr.HAS_ROLE].old_value.keys()}
+                else:
+                    added = self._attributes[UserAttr.HAS_ROLE]
+                if self._changeset[UserAttr.HAS_ROLE].old_value:
+                    removed = {key: self._changeset[UserAttr.HAS_ROLE].old_value[key] for key in self._changeset[UserAttr.HAS_ROLE].old_value.keys() - self._attributes[UserAttr.HAS_ROLE].keys()}
+                else:
+                    removed = {}
+                if self._changeset[UserAttr.HAS_ROLE].old_value:
+                    changed = {key: {'old': self._changeset[UserAttr.HAS_ROLE].old_value.get(key), 'new': self._attributes[UserAttr.HAS_ROLE].get(key)}
+                               for key in self._changeset[UserAttr.HAS_ROLE].old_value.keys() & self._attributes[UserAttr.HAS_ROLE].keys()
+                               if self._attributes[UserAttr.HAS_ROLE][key] != self._changeset[UserAttr.HAS_ROLE].old_value[key]}
+                else:
+                    changed = {}
+
+            #
+            # first we add new roles or delete removed roles from the user (oldap:hasRole). Roles where the
+            # oldap:hasDefaultDataPermission has changed are not considered here (but below) since its a RDF*star thing!
+            #
+            sparql = f'{blank:{indent * indent_inc}}# User field "hasRole"\n'
             sparql += f'{blank:{indent * indent_inc}}WITH oldap:admin\n'
             if removed:
                 sparql += f'{blank:{indent * indent_inc}}DELETE {{\n'
-                for perm in removed:
-                    sparql += f'{blank:{(indent + 1) * indent_inc}}?user oldap:hasPermissions {perm} .\n'
+                for role in removed.keys():
+                    sparql += f'{blank:{(indent + 1) * indent_inc}}?user oldap:hasRole {role.toRdf} .\n'
                 sparql += f'{blank:{indent * indent_inc}}}}\n'
             if added:
                 sparql += f'{blank:{indent * indent_inc}}INSERT {{\n'
-                for perm in added:
-                    sparql += f'{blank:{(indent + 1) * indent_inc}}?user oldap:hasPermissions {perm} .\n'
+                for role in added.keys():
+                    sparql += f'{blank:{(indent + 1) * indent_inc}}?user oldap:hasRole {role.toRdf} .\n'
                 sparql += f'{blank:{indent * indent_inc}}}}\n'
             sparql += f'{blank:{indent * indent_inc}}WHERE {{\n'
             sparql += f'{blank:{(indent + 1) * indent_inc}}BIND({self.userIri.toRdf} as ?user)\n'
@@ -859,17 +888,73 @@ class User(Model):
                 sparql_list.append(sparql)
 
             #
-            # check if existing :PermissionSet's have been given!
+            # Now we process the RDF*star triples where a Role has been added/deleted or the
+            # oldap:hasDefaultDataPermission has changed!
+            #
+            rdfstar = False
+            sparql = ''
+            if removed or changed:
+                sparql += f'{blank:{indent * indent_inc}}# RDF*Star DELETE: <<.. oldap:hasRole ...>> oldap:hasDefaultDataPermission ...\n'
+                sparql += f'{blank:{indent * indent_inc}}DELETE DATA {{\n'
+                sparql += f'{blank:{(indent + 1) * indent_inc}}GRAPH oldap:admin {{\n'
+                rdfstar = True
+            if removed:
+                tmp = [role for role, dperm in removed.items() if dperm] # check if we have roles with dterm not None
+                if tmp:
+                    for role, dperm in removed.items():
+                        if dperm:
+                            sparql += f'{blank:{(indent + 2) * indent_inc}}<<{self.userIri.toRdf} oldap:hasRole {role.toRdf}>> oldap:hasDefaultDataPermission {dperm.toRdf} .\n'
+            if changed:  # remove RDF*Star triples of the roles that have changed
+                tmp = [role for role, dperm in changed.items() if dperm['old']]
+                if tmp:
+                    for role, changes in changed.items():
+                        if changes['old']:
+                            sparql += f'{blank:{(indent + 1) * indent_inc}}<<{self.userIri.toRdf} oldap:hasRole {role.toRdf}>> oldap:hasDefaultDataPermission {changes["old"].toRdf} .\n'
+
+            if rdfstar:
+                sparql += f'{blank:{(indent + 1) * indent_inc}}}}\n'
+                sparql += f'{blank:{indent * indent_inc}}}}\n'
+            if added or changed:
+                if rdfstar:
+                    sparql += f'{blank:{indent * indent_inc}};\n'
+                sparql += f'{blank:{indent * indent_inc}}# RDF*Star INSERT: <<.. oldap:hasRole ...>> oldap:hasDefaultDataPermission ...\n'
+                sparql += f'{blank:{indent * indent_inc}}INSERT DATA {{\n'
+                sparql += f'{blank:{(indent + 1) * indent_inc}}GRAPH oldap:admin {{\n'
+                rdfstar = True
+            else:
+                rdfstar = False
+            if added:
+                tmp = [role for role, dperm in added.items() if dperm]  # check if we have roles with dterm not None
+                if tmp:
+                    for role, dperm in added.items():
+                        if dperm:
+                            sparql += f'{blank:{(indent + 2) * indent_inc}}<<{self.userIri.toRdf} oldap:hasRole {role.toRdf}>> oldap:hasDefaultDataPermission {dperm.toRdf} .\n'
+                    rdfstar = True
+            if changed:  # add the RDF*Star triples of the roles that have changed
+                tmp = [role for role, dperm in changed.items() if dperm['new']]
+                if tmp:
+                    for role, changes in changed.items():
+                        if changes['new']:
+                            sparql += f'{blank:{(indent + 1) * indent_inc}}<<{self.userIri.toRdf} oldap:hasRole {role.toRdf}>> oldap:hasDefaultDataPermission {changes["new"].toRdf} .\n'
+                    rdfstar = True
+            if rdfstar:
+                sparql += f'{blank:{(indent + 1) * indent_inc}}}}\n'
+                sparql += f'{blank:{indent * indent_inc}}}}\n'
+            if sparql:
+                sparql_list.append(sparql)
+
+            #
+            # check if existing :Roles's have been given!
             #
             if added:
                 tmp = [x.toRdf for x in added]
                 tmp = ", ".join(tmp)
                 ptest = f"""
-                SELECT ?permissionset
+                SELECT ?role
                 FROM oldap:admin
                 WHERE {{
-                    ?permissionset a oldap:PermissionSet .
-                    FILTER(?permissionset IN ({tmp}))
+                    ?role a oldap:Role .
+                    FILTER(?role IN ({tmp}))
                 }}
                 """
                 ptest_len = len(added)
@@ -1036,6 +1121,7 @@ class User(Model):
             self.set_modified_by_iri(Xsd_QName('oldap:admin'), self.userIri, self.modified, timestamp)
             modtime = self.get_modified_by_iri(Xsd_QName('oldap:admin'), self.userIri)
         except OldapError:
+            print(sparql)
             self._con.transaction_abort()
             raise
         if timestamp != modtime: