orchestrator-core 4.1.0rc1__tar.gz → 4.2.0rc1__tar.gz

orchestrator_core-4.2.0rc1/PKG-INFO

@@ -0,0 +1,167 @@
+Metadata-Version: 2.4
+Name: orchestrator-core
+Version: 4.2.0rc1
+Summary: This is the orchestrator workflow engine.
+Author-email: SURF <automation-beheer@surf.nl>
+Requires-Python: >=3.11,<3.14
+Description-Content-Type: text/markdown
+License-Expression: Apache-2.0
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Environment :: Web Environment
+Classifier: Framework :: AsyncIO
+Classifier: Framework :: FastAPI
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Intended Audience :: System Administrators
+Classifier: Intended Audience :: Telecommunications Industry
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python
+Classifier: Topic :: Internet :: WWW/HTTP :: HTTP Servers
+Classifier: Topic :: Internet :: WWW/HTTP
+Classifier: Topic :: Internet
+Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Topic :: Software Development :: Libraries
+Classifier: Topic :: Software Development
+Classifier: Typing :: Typed
+License-File: LICENSE
+Requires-Dist: alembic==1.16.1
+Requires-Dist: anyio>=3.7.0
+Requires-Dist: click==8.*
+Requires-Dist: deepmerge==2.0
+Requires-Dist: deprecated>=1.2.18
+Requires-Dist: fastapi~=0.115.2
+Requires-Dist: fastapi-etag==0.4.0
+Requires-Dist: itsdangerous>=2.2.0
+Requires-Dist: jinja2==3.1.6
+Requires-Dist: more-itertools~=10.7.0
+Requires-Dist: nwa-stdlib~=1.9.0
+Requires-Dist: oauth2-lib~=2.4.0
+Requires-Dist: orjson==3.10.18
+Requires-Dist: prometheus-client==0.22.1
+Requires-Dist: psycopg2-binary==2.9.10
+Requires-Dist: pydantic-forms>=1.4.0,<=2.1.0
+Requires-Dist: pydantic-settings~=2.9.1
+Requires-Dist: pydantic[email]~=2.8.2
+Requires-Dist: python-dateutil==2.8.2
+Requires-Dist: python-rapidjson>=1.18,<1.21
+Requires-Dist: pytz==2025.2
+Requires-Dist: redis==5.1.1
+Requires-Dist: schedule==1.1.0
+Requires-Dist: semver==3.0.4
+Requires-Dist: sentry-sdk[fastapi]~=2.29.1
+Requires-Dist: sqlalchemy==2.0.41
+Requires-Dist: sqlalchemy-utils==0.41.2
+Requires-Dist: strawberry-graphql>=0.246.2
+Requires-Dist: structlog>=25.4.0
+Requires-Dist: tabulate==0.9.0
+Requires-Dist: typer==0.15.4
+Requires-Dist: uvicorn[standard]~=0.34.0
+Requires-Dist: celery~=5.5.1 ; extra == "celery"
+Project-URL: Documentation, https://workfloworchestrator.org/orchestrator-core
+Project-URL: Homepage, https://workfloworchestrator.org/orchestrator-core
+Project-URL: Source, https://github.com/workfloworchestrator/orchestrator-core
+Provides-Extra: celery
+
+# Orchestrator-Core
+
+[![Downloads](https://pepy.tech/badge/orchestrator-core/month)](https://pepy.tech/project/orchestrator-core)
+[![codecov](https://codecov.io/gh/workfloworchestrator/orchestrator-core/branch/main/graph/badge.svg?token=5ANQFI2DHS)](https://codecov.io/gh/workfloworchestrator/orchestrator-core)
+[![pypi_version](https://img.shields.io/pypi/v/orchestrator-core?color=%2334D058&label=pypi%20package)](https://pypi.org/project/orchestrator-core)
+[![Supported python versions](https://img.shields.io/pypi/pyversions/orchestrator-core.svg?color=%2334D058)](https://pypi.org/project/orchestrator-core)
+![Discord](https://img.shields.io/discord/1295834294270558280?style=flat&logo=discord&label=discord&link=https%3A%2F%2Fdiscord.gg%2FKNgF6gE8)
+
+<p style="text-align: center"><em>Production ready Orchestration Framework to manage product lifecycle and workflows. Easy to use, built on top of FastAPI and Pydantic</em></p>
+
+## Documentation
+
+The documentation can be found at [workfloworchestrator.org](https://workfloworchestrator.org/orchestrator-core/).
+
+## Installation (quick start)
+
+Simplified steps to install and use the orchestrator-core.
+For more details, read the [Getting started](https://workfloworchestrator.org/orchestrator-core/getting-started/base/) documentation.
+
+### Step 1 - Install the package
+
+Create a virtualenv and install the orchestrator-core.
+
+```shell
+python -m venv .venv
+source .venv/bin/activate
+pip install orchestrator-core
+```
+
+### Step 2 - Setup the database
+
+Create a postgres database:
+
+```shell
+createuser -sP nwa
+createdb orchestrator-core -O nwa  # set password to 'nwa'
+```
+
+Configure the database URI in your local environment:
+
+```
+export DATABASE_URI=postgresql://nwa:nwa@localhost:5432/orchestrator-core
+```
+
+### Step 3 - Create main.py
+
+Create a `main.py` file.
+
+```python
+from orchestrator import OrchestratorCore
+from orchestrator.cli.main import app as core_cli
+from orchestrator.settings import AppSettings
+
+app = OrchestratorCore(base_settings=AppSettings())
+
+if __name__ == "__main__":
+    core_cli()
+```
+
+### Step 4 - Run the database migrations
+
+Initialize the migration environment and database tables.
+
+```shell
+python main.py db init
+python main.py db upgrade heads
+```
+
+### Step 5 - Run the app
+
+```shell
+export OAUTH2_ACTIVE=False
+uvicorn --reload --host 127.0.0.1 --port 8080 main:app
+```
+
+Visit the [ReDoc](http://127.0.0.1:8080/api/redoc) or [OpenAPI](http://127.0.0.1:8080/api/docs) page to view and interact with the API.
+
+## Contributing
+
+We use [uv](https://docs.astral.sh/uv/getting-started/installation/) to manage dependencies.
+
+To get started, follow these steps:
+
+```shell
+# in your postgres database
+createdb orchestrator-core-test -O nwa  # set password to 'nwa'
+
+# on your local machine
+git clone https://github.com/workfloworchestrator/orchestrator-core
+cd orchestrator-core
+export DATABASE_URI=postgresql://nwa:nwa@localhost:5432/orchestrator-core-test
+uv sync --all-extras --all-groups
+uv run pytest
+```
+
+For more details please read the [development docs](https://workfloworchestrator.org/orchestrator-core/contributing/development/).
+

orchestrator_core-4.2.0rc1/README.md

@@ -0,0 +1,96 @@
+# Orchestrator-Core
+
+[![Downloads](https://pepy.tech/badge/orchestrator-core/month)](https://pepy.tech/project/orchestrator-core)
+[![codecov](https://codecov.io/gh/workfloworchestrator/orchestrator-core/branch/main/graph/badge.svg?token=5ANQFI2DHS)](https://codecov.io/gh/workfloworchestrator/orchestrator-core)
+[![pypi_version](https://img.shields.io/pypi/v/orchestrator-core?color=%2334D058&label=pypi%20package)](https://pypi.org/project/orchestrator-core)
+[![Supported python versions](https://img.shields.io/pypi/pyversions/orchestrator-core.svg?color=%2334D058)](https://pypi.org/project/orchestrator-core)
+![Discord](https://img.shields.io/discord/1295834294270558280?style=flat&logo=discord&label=discord&link=https%3A%2F%2Fdiscord.gg%2FKNgF6gE8)
+
+<p style="text-align: center"><em>Production ready Orchestration Framework to manage product lifecycle and workflows. Easy to use, built on top of FastAPI and Pydantic</em></p>
+
+## Documentation
+
+The documentation can be found at [workfloworchestrator.org](https://workfloworchestrator.org/orchestrator-core/).
+
+## Installation (quick start)
+
+Simplified steps to install and use the orchestrator-core.
+For more details, read the [Getting started](https://workfloworchestrator.org/orchestrator-core/getting-started/base/) documentation.
+
+### Step 1 - Install the package
+
+Create a virtualenv and install the orchestrator-core.
+
+```shell
+python -m venv .venv
+source .venv/bin/activate
+pip install orchestrator-core
+```
+
+### Step 2 - Setup the database
+
+Create a postgres database:
+
+```shell
+createuser -sP nwa
+createdb orchestrator-core -O nwa  # set password to 'nwa'
+```
+
+Configure the database URI in your local environment:
+
+```
+export DATABASE_URI=postgresql://nwa:nwa@localhost:5432/orchestrator-core
+```
+
+### Step 3 - Create main.py
+
+Create a `main.py` file.
+
+```python
+from orchestrator import OrchestratorCore
+from orchestrator.cli.main import app as core_cli
+from orchestrator.settings import AppSettings
+
+app = OrchestratorCore(base_settings=AppSettings())
+
+if __name__ == "__main__":
+    core_cli()
+```
+
+### Step 4 - Run the database migrations
+
+Initialize the migration environment and database tables.
+
+```shell
+python main.py db init
+python main.py db upgrade heads
+```
+
+### Step 5 - Run the app
+
+```shell
+export OAUTH2_ACTIVE=False
+uvicorn --reload --host 127.0.0.1 --port 8080 main:app
+```
+
+Visit the [ReDoc](http://127.0.0.1:8080/api/redoc) or [OpenAPI](http://127.0.0.1:8080/api/docs) page to view and interact with the API.
+
+## Contributing
+
+We use [uv](https://docs.astral.sh/uv/getting-started/installation/) to manage dependencies.
+
+To get started, follow these steps:
+
+```shell
+# in your postgres database
+createdb orchestrator-core-test -O nwa  # set password to 'nwa'
+
+# on your local machine
+git clone https://github.com/workfloworchestrator/orchestrator-core
+cd orchestrator-core
+export DATABASE_URI=postgresql://nwa:nwa@localhost:5432/orchestrator-core-test
+uv sync --all-extras --all-groups
+uv run pytest
+```
+
+For more details please read the [development docs](https://workfloworchestrator.org/orchestrator-core/contributing/development/).

{orchestrator_core-4.1.0rc1 → orchestrator_core-4.2.0rc1}/orchestrator/__init__.py

@@ -13,7 +13,7 @@
 
 """This is the orchestrator workflow engine."""
 
-__version__ = "4.1.0rc1"
+__version__ = "4.2.0rc1"
 
 from orchestrator.app import OrchestratorCore
 from orchestrator.settings import app_settings

{orchestrator_core-4.1.0rc1 → orchestrator_core-4.2.0rc1}/orchestrator/api/api_v1/endpoints/processes.py

@@ -25,7 +25,7 @@ from fastapi.param_functions import Body, Depends, Header
 from fastapi.routing import APIRouter
 from fastapi.websockets import WebSocket
 from fastapi_etag.dependency import CacheHit
-from more_itertools import chunked
+from more_itertools import chunked, last
 from sentry_sdk.tracing import trace
 from sqlalchemy import CompoundSelect, Select, select
 from sqlalchemy.orm import defer, joinedload
@@ -56,6 +56,7 @@ from orchestrator.services.processes import (
 )
 from orchestrator.services.settings import get_engine_settings
 from orchestrator.settings import app_settings
+from orchestrator.utils.auth import Authorizer
 from orchestrator.utils.enrich_process import enrich_process
 from orchestrator.websocket import (
     WS_CHANNELS,
@@ -63,7 +64,7 @@ from orchestrator.websocket import (
     broadcast_process_update_to_websocket,
     websocket_manager,
 )
-from orchestrator.workflow import ProcessStatus
+from orchestrator.workflow import ProcessStat, ProcessStatus, StepList, Workflow
 from pydantic_forms.types import JSON, State
 
 router = APIRouter()
@@ -86,6 +87,48 @@ def check_global_lock() -> None:
         )
 
 
+def get_current_steps(pstat: ProcessStat) -> StepList:
+    """Extract past and current steps from the ProcessStat."""
+    remaining_steps = pstat.log
+    past_steps = pstat.workflow.steps[: -len(remaining_steps)]
+    return StepList(past_steps + [pstat.log[0]])
+
+
+def get_auth_callbacks(steps: StepList, workflow: Workflow) -> tuple[Authorizer | None, Authorizer | None]:
+    """Iterate over workflow and prior steps to determine correct authorization callbacks for the current step.
+
+    It's safest to always iterate through the steps. We could track these callbacks statefully
+    as we progress through the workflow, but if we fail a step and the system restarts, the previous
+    callbacks will be lost if they're only available in the process state.
+
+    Priority:
+    - RESUME callback is explicit RESUME callback, else previous START/RESUME callback
+    - RETRY callback is explicit RETRY, else explicit RESUME, else previous RETRY
+    """
+    # Default to workflow start callbacks
+    auth_resume = workflow.authorize_callback
+    # auth_retry defaults to the workflow start callback if not otherwise specified.
+    # A workflow SHOULD have both callbacks set to not-None. This enforces the correct default regardless.
+    auth_retry = workflow.retry_auth_callback or auth_resume  # type: ignore[unreachable, truthy-function]
+
+    # Choose the most recently established value for resume.
+    auth_resume = last(filter(None, (step.resume_auth_callback for step in steps)), auth_resume)
+    # Choose the most recently established value for retry, unless there is a more recent value for resume.
+    auth_retry = last(
+        filter(None, (step.retry_auth_callback or step.resume_auth_callback for step in steps)), auth_retry
+    )
+    return auth_resume, auth_retry
+
+
+def can_be_resumed(status: ProcessStatus) -> bool:
+    return status in (
+        ProcessStatus.SUSPENDED,  # Can be resumed
+        ProcessStatus.FAILED,  # Can be retried
+        ProcessStatus.API_UNAVAILABLE,  # subtype of FAILED
+        ProcessStatus.INCONSISTENT_DATA,  # subtype of FAILED
+    )
+
+
 def resolve_user_name(
     *,
     reporter: Reporter | None,
@@ -115,6 +158,9 @@ def delete(process_id: UUID) -> None:
     if not process:
         raise_status(HTTPStatus.NOT_FOUND)
 
+    if not process.is_task:
+        raise_status(HTTPStatus.BAD_REQUEST)
+
     db.session.delete(db.session.get(ProcessTable, process_id))
     db.session.commit()
 
@@ -150,18 +196,25 @@ def new_process(
     dependencies=[Depends(check_global_lock, use_cache=False)],
 )
 def resume_process_endpoint(
-    process_id: UUID, request: Request, json_data: JSON = Body(...), user: str = Depends(user_name)
+    process_id: UUID,
+    request: Request,
+    json_data: JSON = Body(...),
+    user: str = Depends(user_name),
+    user_model: OIDCUserModel | None = Depends(authenticate),
 ) -> None:
     process = _get_process(process_id)
 
-    if process.last_status == ProcessStatus.COMPLETED:
-        raise_status(HTTPStatus.CONFLICT, "Resuming a completed workflow is not possible")
-
-    if process.last_status == ProcessStatus.RUNNING:
-        raise_status(HTTPStatus.CONFLICT, "Resuming a running workflow is not possible")
+    if not can_be_resumed(process.last_status):
+        raise_status(HTTPStatus.CONFLICT, f"Resuming a {process.last_status.lower()} workflow is not possible")
 
-    if process.last_status == ProcessStatus.RESUMED:
-        raise_status(HTTPStatus.CONFLICT, "Resuming a resumed workflow is not possible")
+    pstat = load_process(process)
+    auth_resume, auth_retry = get_auth_callbacks(get_current_steps(pstat), pstat.workflow)
+    if process.last_status == ProcessStatus.SUSPENDED:
+        if auth_resume is not None and not auth_resume(user_model):
+            raise_status(HTTPStatus.FORBIDDEN, "User is not authorized to resume step")
+    elif process.last_status == ProcessStatus.FAILED:
+        if auth_retry is not None and not auth_retry(user_model):
+            raise_status(HTTPStatus.FORBIDDEN, "User is not authorized to retry step")
 
     broadcast_invalidate_status_counts()
     broadcast_func = api_broadcast_process_data(request)
@@ -220,7 +273,7 @@ def update_progress_on_awaiting_process_endpoint(
 @router.put(
     "/resume-all", response_model=ProcessResumeAllSchema, dependencies=[Depends(check_global_lock, use_cache=False)]
 )
-async def resume_all_processess_endpoint(request: Request, user: str = Depends(user_name)) -> dict[str, int]:
+async def resume_all_processes_endpoint(request: Request, user: str = Depends(user_name)) -> dict[str, int]:
     """Retry all task processes in status Failed, Waiting, API Unavailable or Inconsistent Data.
 
     The retry is started in the background, returning status 200 and number of processes in message.

{orchestrator_core-4.1.0rc1 → orchestrator_core-4.2.0rc1}/orchestrator/api/api_v1/endpoints/subscriptions.py

@@ -47,10 +47,12 @@ from orchestrator.services.subscriptions import (
     subscription_workflows,
 )
 from orchestrator.settings import app_settings
+from orchestrator.targets import Target
 from orchestrator.types import SubscriptionLifecycle
 from orchestrator.utils.deprecation_logger import deprecated_endpoint
 from orchestrator.utils.get_subscription_dict import get_subscription_dict
 from orchestrator.websocket import sync_invalidate_subscription_cache
+from orchestrator.workflows import get_workflow
 
 router = APIRouter()
 
@@ -100,6 +102,25 @@ def _filter_statuses(filter_statuses: str | None = None) -> list[str]:
     return statuses
 
 
+def _authorized_subscription_workflows(
+    subscription: SubscriptionTable, current_user: OIDCUserModel | None
+) -> dict[str, list[dict[str, list[Any] | str]]]:
+    subscription_workflows_dict = subscription_workflows(subscription)
+
+    for workflow_target in Target.values():
+        for workflow_dict in subscription_workflows_dict[workflow_target.lower()]:
+            workflow = get_workflow(workflow_dict["name"])
+            if not workflow:
+                continue
+            if (
+                not workflow.authorize_callback(current_user)  # The current user isn't allowed to run this workflow
+                and "reason" not in workflow_dict  # and there isn't already a reason why this workflow cannot run
+            ):
+                workflow_dict["reason"] = "subscription.insufficient_workflow_permissions"
+
+    return subscription_workflows_dict
+
+
 @router.get(
     "/domain-model/{subscription_id}",
     response_model=SubscriptionDomainModelSchema | None,
@@ -169,7 +190,9 @@ def subscriptions_search(
     description="This endpoint is deprecated and will be removed in a future release. Please use the GraphQL query",
     dependencies=[Depends(deprecated_endpoint)],
 )
-def subscription_workflows_by_id(subscription_id: UUID) -> dict[str, list[dict[str, list[Any] | str]]]:
+def subscription_workflows_by_id(
+    subscription_id: UUID, current_user: OIDCUserModel | None = Depends(authenticate)
+) -> dict[str, list[dict[str, list[Any] | str]]]:
     subscription = db.session.get(
         SubscriptionTable,
         subscription_id,
@@ -181,7 +204,7 @@ def subscription_workflows_by_id(subscription_id: UUID) -> dict[str, list[dict[s
     if not subscription:
         raise_status(HTTPStatus.NOT_FOUND)
 
-    return subscription_workflows(subscription)
+    return _authorized_subscription_workflows(subscription, current_user)
 
 
 @router.put("/{subscription_id}/set_in_sync", response_model=None, status_code=HTTPStatus.OK)

{orchestrator_core-4.1.0rc1 → orchestrator_core-4.2.0rc1}/orchestrator/cli/generator/templates/create_product.j2

@@ -11,7 +11,6 @@ from pydantic_forms.types import FormGenerator, State, UUIDstr
 
 from orchestrator.forms import FormPage
 from orchestrator.forms.validators import Divider, Label, CustomerId, MigrationSummary
-from orchestrator.targets import Target
 from orchestrator.types import SubscriptionLifecycle
 from orchestrator.workflow import StepList, begin, step
 from orchestrator.workflows.steps import store_process_subscription
@@ -119,6 +118,6 @@ def create_{{ product.variable }}() -> StepList:
     return (
         begin
         >> construct_{{ product.variable }}_model
-        >> store_process_subscription(Target.CREATE)
+        >> store_process_subscription()
         # TODO add provision step(s)
     )

{orchestrator_core-4.1.0rc1 → orchestrator_core-4.2.0rc1}/orchestrator/db/models.py

@@ -117,7 +117,7 @@ class ProcessTable(BaseModel):
     is_task = mapped_column(Boolean, nullable=False, server_default=text("false"), index=True)
 
     steps = relationship(
-        "ProcessStepTable", cascade="delete", passive_deletes=True, order_by="asc(ProcessStepTable.executed_at)"
+        "ProcessStepTable", cascade="delete", passive_deletes=True, order_by="asc(ProcessStepTable.completed_at)"
     )
     input_states = relationship("InputStateTable", cascade="delete", order_by="desc(InputStateTable.input_time)")
     process_subscriptions = relationship("ProcessSubscriptionTable", back_populates="process", passive_deletes=True)
@@ -141,7 +141,8 @@ class ProcessStepTable(BaseModel):
     status = mapped_column(String(50), nullable=False)
     state = mapped_column(pg.JSONB(), nullable=False)
     created_by = mapped_column(String(255), nullable=True)
-    executed_at = mapped_column(UtcTimestamp, server_default=text("statement_timestamp()"), nullable=False)
+    completed_at = mapped_column(UtcTimestamp, server_default=text("statement_timestamp()"), nullable=False)
+    started_at = mapped_column(UtcTimestamp, server_default=text("statement_timestamp()"), nullable=False)
     commit_hash = mapped_column(String(40), nullable=True, default=GIT_COMMIT_HASH)
 
 
@@ -154,7 +155,9 @@ class ProcessSubscriptionTable(BaseModel):
     )
     subscription_id = mapped_column(UUIDType, ForeignKey("subscriptions.subscription_id"), nullable=False, index=True)
     created_at = mapped_column(UtcTimestamp, server_default=text("current_timestamp()"), nullable=False)
-    workflow_target = mapped_column(String(255), nullable=False, server_default=Target.CREATE)
+
+    # FIXME: workflow_target is already stored in the workflow table, this column should get removed in a later release.
+    workflow_target = mapped_column(String(255), nullable=True)
 
     process = relationship("ProcessTable", back_populates="process_subscriptions")
     subscription = relationship("SubscriptionTable", back_populates="processes")

{orchestrator_core-4.1.0rc1 → orchestrator_core-4.2.0rc1}/orchestrator/graphql/schemas/process.py

@@ -6,14 +6,17 @@ from strawberry.federation.schema_directives import Key
 from strawberry.scalars import JSON
 
 from oauth2_lib.strawberry import authenticated_field
+from orchestrator.api.api_v1.endpoints.processes import get_auth_callbacks, get_current_steps
 from orchestrator.db import ProcessTable, ProductTable, db
 from orchestrator.graphql.pagination import EMPTY_PAGE, Connection
 from orchestrator.graphql.schemas.customer import CustomerType
 from orchestrator.graphql.schemas.helpers import get_original_model
 from orchestrator.graphql.schemas.product import ProductType
-from orchestrator.graphql.types import GraphqlFilter, GraphqlSort, OrchestratorInfo
+from orchestrator.graphql.types import FormUserPermissionsType, GraphqlFilter, GraphqlSort, OrchestratorInfo
 from orchestrator.schemas.process import ProcessSchema, ProcessStepSchema
+from orchestrator.services.processes import load_process
 from orchestrator.settings import app_settings
+from orchestrator.workflows import get_workflow
 
 if TYPE_CHECKING:
     from orchestrator.graphql.schemas.subscription import SubscriptionInterface
@@ -29,7 +32,11 @@ class ProcessStepType:
     name: strawberry.auto
     status: strawberry.auto
     created_by: strawberry.auto
-    executed: strawberry.auto
+    executed: strawberry.auto = strawberry.field(
+        deprecation_reason="Deprecated, use 'started' and 'completed' for step start and completion times"
+    )
+    started: strawberry.auto
+    completed: strawberry.auto
     commit_hash: strawberry.auto
     state: JSON | None
     state_delta: JSON | None
@@ -74,6 +81,18 @@ class ProcessType:
             shortcode=app_settings.DEFAULT_CUSTOMER_SHORTCODE,
         )
 
+    @strawberry.field(description="Returns user permissions for operations on this process")  # type: ignore
+    def user_permissions(self, info: OrchestratorInfo) -> FormUserPermissionsType:
+        oidc_user = info.context.get_current_user
+        workflow = get_workflow(self.workflow_name)
+        process = load_process(db.session.get(ProcessTable, self.process_id))  # type: ignore[arg-type]
+        auth_resume, auth_retry = get_auth_callbacks(get_current_steps(process), workflow)  # type: ignore[arg-type]
+
+        return FormUserPermissionsType(
+            retryAllowed=auth_retry and auth_retry(oidc_user),  # type: ignore[arg-type]
+            resumeAllowed=auth_resume and auth_resume(oidc_user),  # type: ignore[arg-type]
+        )
+
     @authenticated_field(description="Returns list of subscriptions of the process")  # type: ignore
     async def subscriptions(
         self,

{orchestrator_core-4.1.0rc1 → orchestrator_core-4.2.0rc1}/orchestrator/graphql/schemas/product.py

@@ -52,21 +52,20 @@ class ProductType:
         return await resolve_subscriptions(info, filter_by_with_related_subscriptions, sort_by, first, after)
 
     @strawberry.field(description="Returns list of all nested productblock names")  # type: ignore
-    async def all_pb_names(self) -> list[str]:
-
+    async def all_product_block_names(self) -> list[str]:
         model = get_original_model(self, ProductTable)
 
-        def get_all_pb_names(product_blocks: list[ProductBlockTable]) -> Iterable[str]:
+        def get_names(product_blocks: list[ProductBlockTable], visited: set) -> Iterable[str]:
             for product_block in product_blocks:
+                if product_block.product_block_id in visited:
+                    continue
+                visited.add(product_block.product_block_id)
                 yield product_block.name
-
                 if product_block.depends_on:
-                    yield from get_all_pb_names(product_block.depends_on)
-
-        names: list[str] = list(get_all_pb_names(model.product_blocks))
-        names.sort()
+                    yield from get_names(product_block.depends_on, visited)
 
-        return names
+        names = set(get_names(model.product_blocks, set()))
+        return sorted(names)
 
     @strawberry.field(description="Return product blocks")  # type: ignore
     async def product_blocks(self) -> list[Annotated["ProductBlock", strawberry.lazy(".product_block")]]:

{orchestrator_core-4.1.0rc1 → orchestrator_core-4.2.0rc1}/orchestrator/graphql/schemas/workflow.py

@@ -5,6 +5,7 @@ import strawberry
 from orchestrator.config.assignee import Assignee
 from orchestrator.db import WorkflowTable
 from orchestrator.graphql.schemas.helpers import get_original_model
+from orchestrator.graphql.types import OrchestratorInfo
 from orchestrator.schemas import StepSchema, WorkflowSchema
 from orchestrator.workflows import get_workflow
 
@@ -30,3 +31,11 @@ class Workflow:
     @strawberry.field(description="Return all steps for this workflow")  # type: ignore
     def steps(self) -> list[Step]:
         return [Step(name=step.name, assignee=step.assignee) for step in get_workflow(self.name).steps]  # type: ignore
+
+    @strawberry.field(description="Return whether the currently logged-in used is allowed to start this workflow")  # type: ignore
+    def is_allowed(self, info: OrchestratorInfo) -> bool:
+        oidc_user = info.context.get_current_user
+        workflow_table = get_original_model(self, WorkflowTable)
+        workflow = get_workflow(workflow_table.name)
+
+        return workflow.authorize_callback(oidc_user)  # type: ignore

{orchestrator_core-4.1.0rc1 → orchestrator_core-4.2.0rc1}/orchestrator/graphql/types.py

@@ -1,4 +1,4 @@
-# Copyright 2022-2023 SURF, GÉANT.
+# Copyright 2022-2025 SURF, GÉANT.
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
@@ -132,6 +132,12 @@ SCALAR_OVERRIDES: ScalarOverrideType = {
 }
 
 
+@strawberry.type(description="User permissions on a specific process")
+class FormUserPermissionsType:
+    retryAllowed: bool
+    resumeAllowed: bool
+
+
 @strawberry.type(description="Generic class to capture errors")
 class MutationError:
     message: str = strawberry.field(description="Error message")