pilot-platform-common 2.0.0__tar.gz → 2.3.0__tar.gz

{pilot-platform-common-2.0.0 → pilot_platform_common-2.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: pilot-platform-common
-Version: 2.0.0
+Version: 2.3.0
 Summary: Generates entity ID and connects with Vault (secret engine) to retrieve credentials
 Author: Indoc Systems
 Author-email: etaylor@indocresearch.org
@@ -8,6 +8,18 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Operating System :: OS Independent
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
+Requires-Dist: python-dotenv>=0.19.1
+Requires-Dist: httpx<0.27.0,>=0.23.0
+Requires-Dist: redis<5.0.0,>=4.5.0
+Requires-Dist: aioboto3==9.6.0
+Requires-Dist: xmltodict==0.13.0
+Requires-Dist: minio==7.1.8
+Requires-Dist: python-json-logger==2.0.2
+Requires-Dist: pyjwt==2.6.0
+Requires-Dist: starlette<0.38.0,>=0.37.2
+Requires-Dist: requests<2.32.0,>=2.26.0
+Requires-Dist: cryptography==39.0.0
+Requires-Dist: pydantic<3.0.0,>=2.7.1
 
 # common
 

{pilot-platform-common-2.0.0 → pilot_platform_common-2.3.0}/common/logging/logging.py

@@ -10,6 +10,8 @@ from collections.abc import Mapping
 from typing import Any
 from typing import Union
 
+from opentelemetry import trace
+
 AUDIT = logging.INFO + 5
 
 
@@ -19,12 +21,22 @@ class Logger(logging.Logger):
 
 
 class JsonFormatter(logging.Formatter):
-    """Convert LogRecord to json string."""
+    """Convert LogRecord to JSON string with trace and span IDs."""
 
     def format(self, record: logging.LogRecord) -> str:
+        # Get the current span
+        span = trace.get_current_span()
+
+        # Extract trace ID and span ID
+        span_context = span.get_span_context()
+        trace_id = format(span_context.trace_id, '032x') if span_context.is_valid else None
+        span_id = format(span_context.span_id, '016x') if span_context.is_valid else None
+        trace_enabled = span_context.trace_flags.sampled if span_context.trace_flags is not None else False
+
         asctime = dt.datetime.fromtimestamp(record.created, tz=dt.timezone.utc).isoformat()
         level = record.levelname
         logger = record.name
+        location = f'{record.filename}:{record.lineno}'
         message = record.getMessage()
         exc_info = None
         if record.exc_info:
@@ -38,9 +50,13 @@ class JsonFormatter(logging.Formatter):
                 'asctime': asctime,
                 'level': level,
                 'logger': logger,
+                'location': location,
                 'message': message,
                 'exc_info': exc_info,
                 'details': details,
+                'trace_id': trace_id,
+                'span_id': span_id,
+                'trace_enabled': trace_enabled,
             }
         )
 

{pilot-platform-common-2.0.0 → pilot_platform_common-2.3.0}/common/permissions/permissions.py

@@ -2,6 +2,7 @@
 #
 # Contact Indoc Systems for any questions regarding the use of this source code.
 
+import os
 from typing import Any
 from typing import Optional
 
@@ -10,11 +11,19 @@ from httpx import AsyncClient
 from common.logging import logger
 from common.permissions.exceptions import ProjectRoleNotFound
 from common.permissions.permissions_manager import PermissionsManager
+from common.project.project_client import ProjectClient
 from common.services.auth_client import AuthClient
 
 
 async def has_permission(
-    auth_url: str, project_code: str, resource: str, zone: str, operation: str, current_identity: dict[str, Any]
+    auth_url: str,
+    project_url: str,
+    redis_url: str,
+    project_code: str,
+    resource: str,
+    zone: str,
+    operation: str,
+    current_identity: dict[str, Any],
 ) -> bool:
     if current_identity['role'] == 'admin':
         role = 'platform_admin'
@@ -27,6 +36,13 @@ async def has_permission(
             logger.info('Unable to get project role in permissions check, user might not belong to project')
             return False
 
+    enable_state_check = os.environ.get('ENABLE_PROJECT_STATE_CHECK', 'true') == 'true'
+    if enable_state_check:
+        project_client = ProjectClient(project_url, redis_url)
+        project = await project_client.get(project_code)
+        if project.state == 'trashed':
+            return False
+
     try:
         payload = {
             'role': role,
@@ -82,7 +98,13 @@ async def get_project_folder_entity(metadata_url: str, name: str, _type: str, zo
 
 
 async def has_file_permission(
-    auth_url: str, metadata_url: str, file_entity: dict, operation: str, current_identity: dict
+    auth_url: str,
+    metadata_url: str,
+    project_url: str,
+    redis_url: str,
+    file_entity: dict,
+    operation: str,
+    current_identity: dict,
 ) -> bool:
     if file_entity['container_type'] != 'project':
         logger.info('Unsupport container type, permission denied')
@@ -111,18 +133,34 @@ async def has_file_permission(
         project_folder_id = project_folder['id']
 
         if not await has_permission(
-            auth_url, project_code, f'file_shared_{project_folder_id}', zone, operation, current_identity
+            auth_url,
+            project_url,
+            redis_url,
+            project_code,
+            f'file_shared_{project_folder_id}',
+            zone,
+            operation,
+            current_identity,
         ):
             return False
     elif root_folder == 'users':
         name_folder_name = get_name_or_path(file_entity, folder_path_split)
         # If the user has file_any permission return True, if the file is in the users namefolder and the
         # user has file own permissions return True else False
-        if not await has_permission(auth_url, project_code, 'file_any', zone, operation, current_identity):
+        if not await has_permission(
+            auth_url, project_url, redis_url, project_code, 'file_any', zone, operation, current_identity
+        ):
             if name_folder_name != username:
                 return False
             if not await has_permission(
-                auth_url, project_code, 'file_in_own_namefolder', zone, operation, current_identity
+                auth_url,
+                project_url,
+                redis_url,
+                project_code,
+                'file_in_own_namefolder',
+                zone,
+                operation,
+                current_identity,
             ):
                 return False
     else:
@@ -154,9 +192,20 @@ def get_name_or_path(file_entity: dict[str, str], folder_path_split: list[str])
 
 
 async def has_permissions(
-    auth_url: str, project_code: str, permissions: list[dict[str, str]], current_identity: dict[str, Any]
+    auth_url: str,
+    project_url: str,
+    redis_url: str,
+    project_code: str,
+    permissions: list[dict[str, str]],
+    current_identity: dict[str, Any],
 ) -> dict[str, bool]:
     """Performs bulk permission assertions for a project."""
+    enable_state_check = os.environ.get('ENABLE_PROJECT_STATE_CHECK', 'true') == 'true'
+    if enable_state_check:
+        project_client = ProjectClient(project_url, redis_url)
+        project = await project_client.get(project_code)
+        if project.state == 'trashed':
+            return False
 
     permission_manager = PermissionsManager(project_code)
     role = permission_manager.retrieve_project_role(current_identity)

{pilot-platform-common-2.0.0 → pilot_platform_common-2.3.0}/common/project/project_client.py

@@ -226,6 +226,9 @@ class ProjectClient:
             raise ProjectException(status_code=response.status_code, error_msg=response.json())
         return self.project_object(response.json(), self)
 
+    async def clear_cache(self, code: str):
+        self.redis.delete(CACHE_PREFIX + code)
+
 
 class ProjectObjectSync(ProjectObject):
     def __init__(self, *args, **kwargs):

{pilot-platform-common-2.0.0 → pilot_platform_common-2.3.0}/pilot_platform_common.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: pilot-platform-common
-Version: 2.0.0
+Version: 2.3.0
 Summary: Generates entity ID and connects with Vault (secret engine) to retrieve credentials
 Author: Indoc Systems
 Author-email: etaylor@indocresearch.org
@@ -8,6 +8,18 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Operating System :: OS Independent
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
+Requires-Dist: python-dotenv>=0.19.1
+Requires-Dist: httpx<0.27.0,>=0.23.0
+Requires-Dist: redis<5.0.0,>=4.5.0
+Requires-Dist: aioboto3==9.6.0
+Requires-Dist: xmltodict==0.13.0
+Requires-Dist: minio==7.1.8
+Requires-Dist: python-json-logger==2.0.2
+Requires-Dist: pyjwt==2.6.0
+Requires-Dist: starlette<0.38.0,>=0.37.2
+Requires-Dist: requests<2.32.0,>=2.26.0
+Requires-Dist: cryptography==39.0.0
+Requires-Dist: pydantic<3.0.0,>=2.7.1
 
 # common
 

{pilot-platform-common-2.0.0 → pilot_platform_common-2.3.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "common"
-version = "2.0.0"
+version = "2.3.0"
 description = ""
 authors = ["Indoc Systems"]
 
@@ -18,6 +18,8 @@ starlette = ">=0.37.2,<0.38.0"
 cryptography = "39.0.0"
 pydantic = "^2.7.1"
 requests = ">=2.26.0,<2.32.0"
+opentelemetry-instrumentation-fastapi = "^0.39b0"
+opentelemetry-sdk = "1.18.0"
 
 [tool.poetry.dev-dependencies]
 pytest = "7.2.1"

{pilot-platform-common-2.0.0 → pilot_platform_common-2.3.0}/setup.py

@@ -11,7 +11,7 @@ long_description = (this_directory / 'README.md').read_text()
 
 setuptools.setup(
     name='pilot-platform-common',
-    version='2.0.0',
+    version='2.3.0',
     author='Indoc Systems',
     author_email='etaylor@indocresearch.org',
     description='Generates entity ID and connects with Vault (secret engine) to retrieve credentials',

{pilot-platform-common-2.0.0 → pilot_platform_common-2.3.0}/tests/conftest.py

@@ -3,6 +3,7 @@
 # Contact Indoc Systems for any questions regarding the use of this source code.
 
 import asyncio
+import re
 import time
 from uuid import uuid4
 
@@ -37,6 +38,12 @@ PROJECT_CREDENTIALS = {
 }
 
 
+@pytest.fixture
+def project_mock(httpx_mock):
+    url = re.compile('^http://project/v1/projects/.*$')
+    httpx_mock.add_response(method='GET', json={'state': 'active'}, url=url)
+
+
 @pytest_asyncio.fixture(scope='session')
 def event_loop(request):
     """Create an instance of the default event loop for each test case."""

{pilot-platform-common-2.0.0 → pilot_platform_common-2.3.0}/tests/permissions/test_permissions.py

@@ -16,275 +16,325 @@ from common.permissions.exceptions import ProjectRoleNotFound
 
 class TestPermissions:
     @pytest.mark.asyncio
-    async def test_has_permission_true(self, httpx_mock):
+    async def test_has_permission_true(self, httpx_mock, redis, project_mock):
+        project_code = str(uuid4())
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
-        url = 'http://auth/authorize?role=admin&resource=project&zone=core&operation=view&project_code=test_project'
+        url = f'http://auth/authorize?role=admin&resource=project&zone=core&operation=view&project_code={project_code}'
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': True}}, url=url)
-        result = await has_permission('http://auth/', 'test_project', 'project', 'core', 'view', current_identity)
+
+        result = await has_permission(
+            'http://auth/', 'http://project', redis.url, project_code, 'project', 'core', 'view', current_identity
+        )
         assert result is True
 
     @pytest.mark.asyncio
-    async def test_has_permission_false(self, httpx_mock):
+    async def test_has_permission_false(self, httpx_mock, redis, project_mock):
+        project_code = str(uuid4())
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
-        url = 'http://auth/authorize?role=admin&resource=project&zone=core&operation=view&project_code=test_project'
+        url = f'http://auth/authorize?role=admin&resource=project&zone=core&operation=view&project_code={project_code}'
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': False}}, url=url)
-        result = await has_permission('http://auth/', 'test_project', 'project', 'core', 'view', current_identity)
+        result = await has_permission(
+            'http://auth/', 'http://project', redis.url, project_code, 'project', 'core', 'view', current_identity
+        )
         assert result is False
 
     @pytest.mark.asyncio
-    async def test_has_permission_platform_admin_true(self, httpx_mock):
+    async def test_has_permission_platform_admin_true(self, httpx_mock, redis, project_mock):
+        project_code = str(uuid4())
         current_identity = {
             'username': 'test',
             'role': 'admin',
         }
         url = (
             'http://auth/authorize?role=platform_admin&resource=project&zone=core&operation=view'
-            '&project_code=test_project'
+            f'&project_code={project_code}'
         )
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': True}}, url=url)
-        result = await has_permission('http://auth/', 'test_project', 'project', 'core', 'view', current_identity)
+        result = await has_permission(
+            'http://auth/', 'http://project', redis.url, project_code, 'project', 'core', 'view', current_identity
+        )
         assert result is True
 
     @pytest.mark.asyncio
-    async def test_has_permission_no_project_code(self, httpx_mock):
+    async def test_has_permission_no_project_code(self, httpx_mock, redis):
+        project_code = str(uuid4())
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
-        result = await has_permission('http://auth/', '', 'project', 'core', 'view', current_identity)
+        result = await has_permission(
+            'http://auth/', 'http://project', redis.url, '', 'project', 'core', 'view', current_identity
+        )
         assert result is False
 
     @pytest.mark.asyncio
-    async def test_has_permission_service_error(self, httpx_mock):
+    async def test_has_permission_service_error(self, httpx_mock, redis, project_mock):
+        project_code = str(uuid4())
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
-        url = 'http://auth/authorize?role=admin&resource=project&zone=core&operation=view&project_code=test_project'
+        url = f'http://auth/authorize?role=admin&resource=project&zone=core&operation=view&project_code={project_code}'
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': True}}, url=url, status_code=500)
         with pytest.raises(Exception):  # noqa: B017
-            await has_permission('http://auth/', 'test_project', 'project', 'core', 'view', current_identity)
+            await has_permission(
+                'http://auth/', 'http://project', redis.url, project_code, 'project', 'core', 'view', current_identity
+            )
 
 
 class TestFilePermissions:
     @pytest.mark.asyncio
-    async def test_has_file_permission_in_namefolder_true(self, httpx_mock):
+    async def test_has_file_permission_in_namefolder_true(self, httpx_mock, redis, project_mock):
+        project_code = str(uuid4())
         file_data = {
             'parent_path': 'users/test',
             'zone': 'core',
-            'container_code': 'test_project',
+            'container_code': project_code,
             'container_type': 'project',
         }
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
-        url = 'http://auth/authorize?role=admin&resource=file_any&zone=core&operation=view' '&project_code=test_project'
+        url = f'http://auth/authorize?role=admin&resource=file_any&zone=core&operation=view&project_code={project_code}'
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': False}}, url=url)
         url = (
             'http://auth/authorize?role=admin&resource=file_in_own_namefolder&zone=core&operation=view'
-            '&project_code=test_project'
+            f'&project_code={project_code}'
         )
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': True}}, url=url)
-        result = await has_file_permission('http://auth/', 'http://metadata/v1/', file_data, 'view', current_identity)
+        result = await has_file_permission(
+            'http://auth/', 'http://metadata/v1/', 'http://project', redis.url, file_data, 'view', current_identity
+        )
         assert result is True
 
     @pytest.mark.asyncio
-    async def test_has_file_permission_in_other_namefolder_true(self, httpx_mock):
+    async def test_has_file_permission_in_other_namefolder_true(self, httpx_mock, redis, project_mock):
+        project_code = str(uuid4())
         file_data = {
             'parent_path': 'users/another',
             'zone': 'core',
-            'container_code': 'test_project',
+            'container_code': project_code,
             'container_type': 'project',
         }
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
-        url = 'http://auth/authorize?role=admin&resource=file_any&zone=core&operation=view' '&project_code=test_project'
+        url = f'http://auth/authorize?role=admin&resource=file_any&zone=core&operation=view&project_code={project_code}'
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': False}}, url=url)
-        result = await has_file_permission('http://auth/', 'http://metadata/v1/', file_data, 'view', current_identity)
+        result = await has_file_permission(
+            'http://auth/', 'http://metadata/v1/', 'http://project', redis.url, file_data, 'view', current_identity
+        )
         assert result is False
 
     @pytest.mark.asyncio
-    async def test_has_file_permission_false(self, httpx_mock):
+    async def test_has_file_permission_false(self, httpx_mock, redis, project_mock):
+        project_code = str(uuid4())
         file_data = {
             'parent_path': 'users/test',
             'zone': 'core',
-            'container_code': 'test_project',
+            'container_code': project_code,
             'container_type': 'project',
         }
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
-        url = 'http://auth/authorize?role=admin&resource=file_any&zone=core&operation=view' '&project_code=test_project'
+        url = f'http://auth/authorize?role=admin&resource=file_any&zone=core&operation=view&project_code={project_code}'
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': False}}, url=url)
         url = (
             'http://auth/authorize?role=admin&resource=file_in_own_namefolder&zone=core&operation=view'
-            '&project_code=test_project'
+            f'&project_code={project_code}'
         )
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': False}}, url=url)
-        result = await has_file_permission('http://auth/', 'http://metadata/v1/', file_data, 'view', current_identity)
+        result = await has_file_permission(
+            'http://auth/', 'http://metadata/v1/', 'http://project', redis.url, file_data, 'view', current_identity
+        )
         assert result is False
 
     @pytest.mark.asyncio
-    async def test_has_file_permission_outside_of_namefolder_false(self, httpx_mock):
+    async def test_has_file_permission_outside_of_namefolder_false(self, httpx_mock, redis, project_mock):
+        project_code = str(uuid4())
         file_data = {
             'parent_path': 'users/test',
             'zone': 'core',
-            'container_code': 'test_project',
+            'container_code': project_code,
             'container_type': 'project',
         }
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
-        url = 'http://auth/authorize?role=admin&resource=file_any&zone=core&operation=view' '&project_code=test_project'
+        url = f'http://auth/authorize?role=admin&resource=file_any&zone=core&operation=view&project_code={project_code}'
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': False}}, url=url)
         url = (
             'http://auth/authorize?role=admin&resource=file_in_own_namefolder&zone=core&operation=view'
-            '&project_code=test_project'
+            f'&project_code={project_code}'
         )
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': False}}, url=url)
-        result = await has_file_permission('http://auth/', 'http://metadata/v1/', file_data, 'view', current_identity)
+        result = await has_file_permission(
+            'http://auth/', 'http://metadata/v1/', 'http://project', redis.url, file_data, 'view', current_identity
+        )
         assert result is False
 
     @pytest.mark.asyncio
-    async def test_has_file_permission_wrong_project(self, httpx_mock):
+    async def test_has_file_permission_wrong_project(self, httpx_mock, redis):
+        project_code = str(uuid4())
         file_data = {
             'parent_path': 'users/test',
             'zone': 'core',
-            'container_code': 'test_project2',
+            'container_code': project_code,
             'container_type': 'project',
         }
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': ['wrongproject-admin'],
         }
-        result = await has_file_permission('http://auth/', 'http://metadata/v1/', file_data, 'view', current_identity)
+        result = await has_file_permission(
+            'http://auth/', 'http://metadata/v1/', 'http://project', redis.url, file_data, 'view', current_identity
+        )
         assert result is False
 
     @pytest.mark.asyncio
-    async def test_has_file_permission_wrong_container_type(self, httpx_mock):
+    async def test_has_file_permission_wrong_container_type(self, httpx_mock, redis):
+        project_code = str(uuid4())
         file_data = {
             'parent_path': 'users/test',
             'zone': 'core',
-            'container_code': 'test_project',
+            'container_code': project_code,
             'container_type': 'dataset',
         }
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
-        result = await has_file_permission('http://auth/', 'http://metadata/v1/', file_data, 'view', current_identity)
+        result = await has_file_permission(
+            'http://auth/', 'http://metadata/v1/', 'http://project', redis.url, file_data, 'view', current_identity
+        )
         assert result is False
 
     @pytest.mark.asyncio
-    async def test_has_file_permission_trashed(self, httpx_mock):
+    async def test_has_file_permission_trashed(self, httpx_mock, redis, project_mock):
+        project_code = str(uuid4())
         file_data = {
             'status': 'TRASHED',
             'restore_path': 'users/test',
             'zone': 'core',
-            'container_code': 'test_project',
+            'container_code': project_code,
             'container_type': 'project',
         }
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
-        url = 'http://auth/authorize?role=admin&resource=file_any&zone=core&operation=view' '&project_code=test_project'
+        url = f'http://auth/authorize?role=admin&resource=file_any&zone=core&operation=view&project_code={project_code}'
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': False}}, url=url)
         url = (
             'http://auth/authorize?role=admin&resource=file_in_own_namefolder&zone=core&operation=view'
-            '&project_code=test_project'
+            f'&project_code={project_code}'
         )
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': True}}, url=url)
-        result = await has_file_permission('http://auth/', 'http://metadata/v1/', file_data, 'view', current_identity)
+        result = await has_file_permission(
+            'http://auth/', 'http://metadata/v1/', 'http://project', redis.url, file_data, 'view', current_identity
+        )
         assert result is True
 
     @pytest.mark.asyncio
-    async def test_has_file_permission_namefolder(self, httpx_mock):
+    async def test_has_file_permission_namefolder(self, httpx_mock, redis, project_mock):
+        project_code = str(uuid4())
         file_data = {
             'parent_path': 'users',
             'type': 'name_folder',
             'name': 'test',
             'zone': 'core',
-            'container_code': 'test_project',
+            'container_code': project_code,
             'container_type': 'project',
         }
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
-        url = 'http://auth/authorize?role=admin&resource=file_any&zone=core&operation=view' '&project_code=test_project'
+        url = f'http://auth/authorize?role=admin&resource=file_any&zone=core&operation=view&project_code={project_code}'
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': False}}, url=url)
         url = (
             'http://auth/authorize?role=admin&resource=file_in_own_namefolder&zone=core&operation=view'
-            '&project_code=test_project'
+            f'&project_code={project_code}'
         )
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': True}}, url=url)
-        result = await has_file_permission('http://auth/', 'http://metadata/v1/', file_data, 'view', current_identity)
+        result = await has_file_permission(
+            'http://auth/', 'http://metadata/v1/', 'http://project', redis.url, file_data, 'view', current_identity
+        )
         assert result is True
 
     @pytest.mark.asyncio
     @pytest.mark.parametrize('is_authorized', [True, False])
-    async def test_has_file_permission_file_in_shared_folder(self, httpx_mock, get_project_folder, is_authorized):
+    async def test_has_file_permission_file_in_shared_folder(
+        self, httpx_mock, get_project_folder, is_authorized, redis, project_mock
+    ):
+        project_code = str(uuid4())
         file_data = {
             'type': 'file',
             'name': 'test.txt',
             'zone': 'core',
-            'container_code': 'test_project',
+            'container_code': project_code,
             'container_type': 'project',
             'parent_path': 'shared/user',
         }
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
         project_folder = get_project_folder
         resource = 'file_shared_' + project_folder['id']
 
-        url = f'http://auth/authorize?role=admin&resource={resource}&zone=core&operation=view&project_code=test_project'
+        url = (
+            f'http://auth/authorize?role=admin&resource={resource}&zone=core&operation=view&project_code={project_code}'
+        )
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': is_authorized}}, url=url)
 
-        result = await has_file_permission('http://auth/', 'http://metadata/v1/', file_data, 'view', current_identity)
+        result = await has_file_permission(
+            'http://auth/', 'http://metadata/v1/', 'http://project', redis.url, file_data, 'view', current_identity
+        )
         assert result is is_authorized
 
     @pytest.mark.asyncio
     @pytest.mark.parametrize('is_authorized', [True, False])
-    async def test_has_file_permission_file_in_shared_folder_trashed_sourced(self, httpx_mock, is_authorized):
+    async def test_has_file_permission_file_in_shared_folder_trashed_sourced(
+        self, httpx_mock, is_authorized, redis, project_mock
+    ):
+        project_code = str(uuid4())
         file_data = {
             'type': 'file',
             'name': 'test.txt',
             'zone': 'core',
-            'container_code': 'test_project',
+            'container_code': project_code,
             'container_type': 'project',
             'parent_path': 'shared/user',
         }
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
         PROJECT_FOLDER_DATA = {
             'type': 'project_folder',
@@ -293,33 +343,40 @@ class TestFilePermissions:
         }
 
         url = (
-            'http://metadata/v1/item/?name=user&container_code=test_project&container_type=project&zone=1'
+            f'http://metadata/v1/item/?name=user&container_code={project_code}&container_type=project&zone=1'
             '&type=project_folder&status=ACTIVE'
         )
         httpx_mock.add_response(status_code=404, method='GET', json={}, url=url)
 
         url = (
-            'http://metadata/v1/item/?name=user&container_code=test_project&container_type=project&zone=1'
+            f'http://metadata/v1/item/?name=user&container_code={project_code}&container_type=project&zone=1'
             '&type=project_folder&status=TRASHED'
         )
         httpx_mock.add_response(method='GET', json={'result': PROJECT_FOLDER_DATA}, url=url)
         project_folder = PROJECT_FOLDER_DATA
 
         resource = 'file_shared_' + project_folder['id']
-        url = f'http://auth/authorize?role=admin&resource={resource}&zone=core&operation=view&project_code=test_project'
+        url = (
+            f'http://auth/authorize?role=admin&resource={resource}&zone=core&operation=view&project_code={project_code}'
+        )
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': is_authorized}}, url=url)
 
-        result = await has_file_permission('http://auth/', 'http://metadata/v1/', file_data, 'view', current_identity)
+        result = await has_file_permission(
+            'http://auth/', 'http://metadata/v1/', 'http://project', redis.url, file_data, 'view', current_identity
+        )
         assert result is is_authorized
 
     @pytest.mark.asyncio
     @pytest.mark.parametrize('is_authorized', [True, False])
-    async def test_has_file_permission_file_in_shared_folder_trash(self, httpx_mock, is_authorized):
+    async def test_has_file_permission_file_in_shared_folder_trash(
+        self, httpx_mock, is_authorized, redis, project_mock
+    ):
+        project_code = str(uuid4())
         file_data = {
             'type': 'file',
             'name': 'test.txt',
             'zone': 'core',
-            'container_code': 'test_project',
+            'container_code': project_code,
             'container_type': 'project',
             'restore_path': 'shared',
             'status': 'TRASHED',
@@ -327,7 +384,7 @@ class TestFilePermissions:
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
         PROJECT_FOLDER_DATA = {
             'type': 'project_folder',
@@ -340,44 +397,56 @@ class TestFilePermissions:
 
         resource = 'file_shared_' + PROJECT_FOLDER_DATA['id']
 
-        url = f'http://auth/authorize?role=admin&resource={resource}&zone=core&operation=view&project_code=test_project'
+        url = (
+            f'http://auth/authorize?role=admin&resource={resource}&zone=core&operation=view&project_code={project_code}'
+        )
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': is_authorized}}, url=url)
 
-        result = await has_file_permission('http://auth/', 'http://metadata/v1/', file_data, 'view', current_identity)
+        result = await has_file_permission(
+            'http://auth/', 'http://metadata/v1/', 'http://project', redis.url, file_data, 'view', current_identity
+        )
         assert result is is_authorized
 
     @pytest.mark.asyncio
     @pytest.mark.parametrize('is_authorized', [True, False])
-    async def test_has_file_permission_shared_folder(self, httpx_mock, get_project_folder, is_authorized):
+    async def test_has_file_permission_shared_folder(
+        self, httpx_mock, get_project_folder, is_authorized, redis, project_mock
+    ):
+        project_code = str(uuid4())
         file_data = {
             'type': 'project_folder',
             'name': 'user',
             'zone': 'core',
-            'container_code': 'test_project',
+            'container_code': project_code,
             'container_type': 'project',
             'parent_path': 'shared',
         }
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
         project_folder = get_project_folder
         resource = 'file_shared_' + project_folder['id']
 
-        url = f'http://auth/authorize?role=admin&resource={resource}&zone=core&operation=view&project_code=test_project'
+        url = (
+            f'http://auth/authorize?role=admin&resource={resource}&zone=core&operation=view&project_code={project_code}'
+        )
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': is_authorized}}, url=url)
 
-        result = await has_file_permission('http://auth/', 'http://metadata/v1/', file_data, 'view', current_identity)
+        result = await has_file_permission(
+            'http://auth/', 'http://metadata/v1/', 'http://project', redis.url, file_data, 'view', current_identity
+        )
         assert result is is_authorized
 
     @pytest.mark.asyncio
-    async def test_has_file_permission_root_level_users(self, httpx_mock):
+    async def test_has_file_permission_root_level_users(self, httpx_mock, redis):
+        project_code = str(uuid4())
         file_data = {
             'type': 'root_folder',
             'name': 'users',
             'zone': 'core',
-            'container_code': 'test_project',
+            'container_code': project_code,
             'container_type': 'project',
             'parent_path': None,
             'parent': None,
@@ -385,18 +454,21 @@ class TestFilePermissions:
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
-        result = await has_file_permission('http://auth/', 'http://metadata/v1/', file_data, 'view', current_identity)
+        result = await has_file_permission(
+            'http://auth/', 'http://metadata/v1/', 'http://project', redis.url, file_data, 'view', current_identity
+        )
         assert result is True
 
     @pytest.mark.asyncio
-    async def test_has_file_permission_root_level_shared(self, httpx_mock):
+    async def test_has_file_permission_root_level_shared(self, httpx_mock, redis):
+        project_code = str(uuid4())
         file_data = {
             'type': 'root_folder',
             'name': 'shared',
             'zone': 'core',
-            'container_code': 'test_project',
+            'container_code': project_code,
             'container_type': 'project',
             'parent_path': None,
             'parent': None,
@@ -404,40 +476,45 @@ class TestFilePermissions:
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
-        result = await has_file_permission('http://auth/', 'http://metadata/v1/', file_data, 'view', current_identity)
+        result = await has_file_permission(
+            'http://auth/', 'http://metadata/v1/', 'http://project', redis.url, file_data, 'view', current_identity
+        )
         assert result is True
 
 
 class TestGetCurrentRole:
     @pytest.mark.asyncio
     async def test_get_current_role_admin(self, httpx_mock):
+        project_code = str(uuid4())
         current_identity = {
             'username': 'test',
             'role': 'admin',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
-        result = await get_project_role('test_project', current_identity)
+        result = await get_project_role(project_code, current_identity)
         assert result == 'platform_admin'
 
     @pytest.mark.asyncio
     async def test_get_current_role_member(self, httpx_mock):
+        project_code = str(uuid4())
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
-        result = await get_project_role('test_project', current_identity)
+        result = await get_project_role(project_code, current_identity)
         assert result == 'admin'
 
     async def test_get_current_role_non_default(self, httpx_mock):
+        project_code = str(uuid4())
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-customrole'],
+            'realm_roles': [f'{project_code}-customrole'],
         }
-        result = await get_project_role('test_project', current_identity)
+        result = await get_project_role(project_code, current_identity)
         assert result == 'customrole'
 
 
@@ -447,26 +524,31 @@ class TestBulkPermissions:
         {'role': 'admin', 'zone': 'greenroom', 'resource': 'file_any', 'operation': 'copy'},
         {'role': 'admin', 'zone': 'greenroom', 'resource': 'file_any', 'operation': 'view'},
     ]
-    current_identity = {'role': 'collaborator', 'realm_roles': ['test_project-collaborator']}
 
-    async def test_has_permissions_return_mapped_assertions(self, httpx_mock):
+    async def test_has_permissions_return_mapped_assertions(self, httpx_mock, redis, project_mock):
+        project_code = str(uuid4())
+        current_identity = {'role': 'collaborator', 'realm_roles': [f'{project_code}-collaborator']}
         granted = {'has_permission': True}
         mapped_result = {'greenroom_file_any_copy': True, 'greenroom_file_any_view': True}
 
         httpx_mock.add_response(
             method='POST',
-            url=f'{self.auth_service_url}authorize?project_code=test_project',
+            url=f'{self.auth_service_url}authorize?project_code={project_code}',
             status_code=200,
             json=granted,
         )
         mapped = await has_permissions(
-            self.auth_service_url, 'test_project', self.permission_request, self.current_identity
+            self.auth_service_url, 'http://project', redis.url, project_code, self.permission_request, current_identity
         )
 
         assert mapped == mapped_result
 
-    async def test_has_permissions_raise_project_role_not_found_exception_for_invalid_role(self, httpx_mock):
-        identity = self.current_identity
-        identity['realm_roles'] = ['invalidproject-collaborator']
+    async def test_has_permissions_raise_project_role_not_found_exception_for_invalid_role(
+        self, httpx_mock, redis, project_mock
+    ):
+        project_code = str(uuid4())
+        identity = {'role': 'collaborator', 'realm_roles': ['invalid-collaborator']}
         with pytest.raises(ProjectRoleNotFound):
-            await has_permissions(self.auth_service_url, 'test_project', self.permission_request, identity)
+            await has_permissions(
+                self.auth_service_url, 'http://project', redis.url, project_code, self.permission_request, identity
+            )

{pilot-platform-common-2.0.0 → pilot_platform_common-2.3.0}/tests/test_logging.py

@@ -8,6 +8,11 @@ import logging
 from logging import LogRecord
 from logging import getLevelName
 
+from opentelemetry import trace
+from opentelemetry.sdk.trace import TracerProvider
+from opentelemetry.sdk.trace.export import BatchSpanProcessor
+from opentelemetry.sdk.trace.export import ConsoleSpanExporter
+
 from common.logging.logging import AUDIT
 from common.logging.logging import JsonFormatter
 from common.logging.logging import Logger
@@ -17,6 +22,12 @@ from common.logging.logging import extend_logger_class
 
 class TestJsonFormatter:
     def test_format_converts_log_record_into_expected_json_string(self, fake):
+        provider = TracerProvider()
+        processor = BatchSpanProcessor(ConsoleSpanExporter())
+        provider.add_span_processor(processor)
+        trace.set_tracer_provider(provider)
+        tracer = trace.get_tracer('test.format.logging')
+
         logger = fake.word()
         level = fake.pyint(0, 5) * 10
         message = fake.word()
@@ -24,20 +35,32 @@ class TestJsonFormatter:
         exception = Exception(exception_message)
         exc_info = (type(exception), exception, exception.__traceback__)
         details = fake.pydict(allowed_types=(str, int, float, bool))
-        record = LogRecord(logger, level, '', 0, message, details, exc_info)
+        record = LogRecord(logger, level, 'test.py', 0, message, details, exc_info)
         asctime = dt.datetime.fromtimestamp(record.created, tz=dt.timezone.utc).isoformat()
-        expected_string = json.dumps(
-            {
-                'asctime': asctime,
-                'level': getLevelName(level),
-                'logger': logger,
-                'message': message,
-                'exc_info': f'Exception: {exception_message}',
-                'details': details,
-            }
-        )
-
-        received_string = JsonFormatter().format(record)
+        with tracer.start_as_current_span('test-log-record-format') as span:
+            span_context = span.get_span_context()
+            trace_id = format(span_context.trace_id, '032x') if span_context.is_valid else None
+            span_id = format(span_context.span_id, '016x') if span_context.is_valid else None
+            trace_enabled = span_context.trace_flags.sampled if span_context.trace_flags is not None else False
+            expected_string = json.dumps(
+                {
+                    'asctime': asctime,
+                    'level': getLevelName(level),
+                    'logger': logger,
+                    'location': 'test.py:0',
+                    'message': message,
+                    'exc_info': f'Exception: {exception_message}',
+                    'details': details,
+                    'trace_id': trace_id,
+                    'span_id': span_id,
+                    'trace_enabled': trace_enabled,
+                }
+            )
+            received_string = JsonFormatter().format(record)
+        trace.get_tracer_provider().shutdown()
+        # Normalize newlines by replacing them with `\\n` in both strings for comparison
+        expected_string = expected_string.replace('\n', '\\n')
+        received_string = received_string.replace('\n', '\\n')
 
         assert received_string == expected_string