pilot-platform-common 2.2.0__tar.gz → 2.4.0__tar.gz

{pilot_platform_common-2.2.0 → pilot_platform_common-2.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: pilot-platform-common
-Version: 2.2.0
+Version: 2.4.0
 Summary: Generates entity ID and connects with Vault (secret engine) to retrieve credentials
 Author: Indoc Systems
 Author-email: etaylor@indocresearch.org

{pilot_platform_common-2.2.0 → pilot_platform_common-2.4.0}/common/permissions/permissions.py

@@ -2,6 +2,7 @@
 #
 # Contact Indoc Systems for any questions regarding the use of this source code.
 
+import os
 from typing import Any
 from typing import Optional
 
@@ -10,11 +11,19 @@ from httpx import AsyncClient
 from common.logging import logger
 from common.permissions.exceptions import ProjectRoleNotFound
 from common.permissions.permissions_manager import PermissionsManager
+from common.project.project_client import ProjectClient
 from common.services.auth_client import AuthClient
 
 
 async def has_permission(
-    auth_url: str, project_code: str, resource: str, zone: str, operation: str, current_identity: dict[str, Any]
+    auth_url: str,
+    project_url: str,
+    redis_url: str,
+    project_code: str,
+    resource: str,
+    zone: str,
+    operation: str,
+    current_identity: dict[str, Any],
 ) -> bool:
     if current_identity['role'] == 'admin':
         role = 'platform_admin'
@@ -27,6 +36,13 @@ async def has_permission(
             logger.info('Unable to get project role in permissions check, user might not belong to project')
             return False
 
+    enable_state_check = os.environ.get('ENABLE_PROJECT_STATE_CHECK', 'true') == 'true'
+    if enable_state_check:
+        project_client = ProjectClient(project_url, redis_url)
+        project = await project_client.get(project_code)
+        if project.state == 'trashed':
+            return False
+
     try:
         payload = {
             'role': role,
@@ -82,7 +98,13 @@ async def get_project_folder_entity(metadata_url: str, name: str, _type: str, zo
 
 
 async def has_file_permission(
-    auth_url: str, metadata_url: str, file_entity: dict, operation: str, current_identity: dict
+    auth_url: str,
+    metadata_url: str,
+    project_url: str,
+    redis_url: str,
+    file_entity: dict,
+    operation: str,
+    current_identity: dict,
 ) -> bool:
     if file_entity['container_type'] != 'project':
         logger.info('Unsupport container type, permission denied')
@@ -111,18 +133,34 @@ async def has_file_permission(
         project_folder_id = project_folder['id']
 
         if not await has_permission(
-            auth_url, project_code, f'file_shared_{project_folder_id}', zone, operation, current_identity
+            auth_url,
+            project_url,
+            redis_url,
+            project_code,
+            f'file_shared_{project_folder_id}',
+            zone,
+            operation,
+            current_identity,
         ):
             return False
     elif root_folder == 'users':
         name_folder_name = get_name_or_path(file_entity, folder_path_split)
         # If the user has file_any permission return True, if the file is in the users namefolder and the
         # user has file own permissions return True else False
-        if not await has_permission(auth_url, project_code, 'file_any', zone, operation, current_identity):
+        if not await has_permission(
+            auth_url, project_url, redis_url, project_code, 'file_any', zone, operation, current_identity
+        ):
             if name_folder_name != username:
                 return False
             if not await has_permission(
-                auth_url, project_code, 'file_in_own_namefolder', zone, operation, current_identity
+                auth_url,
+                project_url,
+                redis_url,
+                project_code,
+                'file_in_own_namefolder',
+                zone,
+                operation,
+                current_identity,
             ):
                 return False
     else:
@@ -154,9 +192,20 @@ def get_name_or_path(file_entity: dict[str, str], folder_path_split: list[str])
 
 
 async def has_permissions(
-    auth_url: str, project_code: str, permissions: list[dict[str, str]], current_identity: dict[str, Any]
+    auth_url: str,
+    project_url: str,
+    redis_url: str,
+    project_code: str,
+    permissions: list[dict[str, str]],
+    current_identity: dict[str, Any],
 ) -> dict[str, bool]:
     """Performs bulk permission assertions for a project."""
+    enable_state_check = os.environ.get('ENABLE_PROJECT_STATE_CHECK', 'true') == 'true'
+    if enable_state_check:
+        project_client = ProjectClient(project_url, redis_url)
+        project = await project_client.get(project_code)
+        if project.state == 'trashed':
+            return False
 
     permission_manager = PermissionsManager(project_code)
     role = permission_manager.retrieve_project_role(current_identity)

{pilot_platform_common-2.2.0 → pilot_platform_common-2.4.0}/common/project/project_client.py

@@ -33,6 +33,7 @@ class ProjectObject:
         'updated_at',
         'is_favourite',
         'state',
+        'created_by',
     ]
 
     def __init__(self, data, project_client):
@@ -198,6 +199,7 @@ class ProjectClient:
         name: str,
         description: str,
         operator: str,
+        created_by: str,
         image_url: Union[str, None] = None,
         tags: Union[list[str], None] = None,
         system_tags: Union[list[str], None] = None,
@@ -216,6 +218,7 @@ class ProjectClient:
             'tags': tags,
             'system_tags': system_tags,
             'is_discoverable': is_discoverable,
+            'created_by': created_by,
         }
         # remove blank items
         data = {k: v for k, v in data.items() if v is not None}
@@ -226,6 +229,9 @@ class ProjectClient:
             raise ProjectException(status_code=response.status_code, error_msg=response.json())
         return self.project_object(response.json(), self)
 
+    async def clear_cache(self, code: str):
+        self.redis.delete(CACHE_PREFIX + code)
+
 
 class ProjectObjectSync(ProjectObject):
     def __init__(self, *args, **kwargs):

{pilot_platform_common-2.2.0 → pilot_platform_common-2.4.0}/pilot_platform_common.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: pilot-platform-common
-Version: 2.2.0
+Version: 2.4.0
 Summary: Generates entity ID and connects with Vault (secret engine) to retrieve credentials
 Author: Indoc Systems
 Author-email: etaylor@indocresearch.org

{pilot_platform_common-2.2.0 → pilot_platform_common-2.4.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "common"
-version = "2.2.0"
+version = "2.4.0"
 description = ""
 authors = ["Indoc Systems"]
 

{pilot_platform_common-2.2.0 → pilot_platform_common-2.4.0}/setup.py

@@ -11,7 +11,7 @@ long_description = (this_directory / 'README.md').read_text()
 
 setuptools.setup(
     name='pilot-platform-common',
-    version='2.2.0',
+    version='2.4.0',
     author='Indoc Systems',
     author_email='etaylor@indocresearch.org',
     description='Generates entity ID and connects with Vault (secret engine) to retrieve credentials',

{pilot_platform_common-2.2.0 → pilot_platform_common-2.4.0}/tests/conftest.py

@@ -3,6 +3,7 @@
 # Contact Indoc Systems for any questions regarding the use of this source code.
 
 import asyncio
+import re
 import time
 from uuid import uuid4
 
@@ -28,6 +29,7 @@ PROJECT_DATA = {
     'tags': ['tag1', 'tag2'],
     'system_tags': ['system'],
     'state': 'in_use',
+    'created_by': 'Test User',
 }
 
 PROJECT_CREDENTIALS = {
@@ -37,6 +39,12 @@ PROJECT_CREDENTIALS = {
 }
 
 
+@pytest.fixture
+def project_mock(httpx_mock):
+    url = re.compile('^http://project/v1/projects/.*$')
+    httpx_mock.add_response(method='GET', json={'state': 'active'}, url=url)
+
+
 @pytest_asyncio.fixture(scope='session')
 def event_loop(request):
     """Create an instance of the default event loop for each test case."""

{pilot_platform_common-2.2.0 → pilot_platform_common-2.4.0}/tests/permissions/test_permissions.py

@@ -16,275 +16,325 @@ from common.permissions.exceptions import ProjectRoleNotFound
 
 class TestPermissions:
     @pytest.mark.asyncio
-    async def test_has_permission_true(self, httpx_mock):
+    async def test_has_permission_true(self, httpx_mock, redis, project_mock):
+        project_code = str(uuid4())
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
-        url = 'http://auth/authorize?role=admin&resource=project&zone=core&operation=view&project_code=test_project'
+        url = f'http://auth/authorize?role=admin&resource=project&zone=core&operation=view&project_code={project_code}'
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': True}}, url=url)
-        result = await has_permission('http://auth/', 'test_project', 'project', 'core', 'view', current_identity)
+
+        result = await has_permission(
+            'http://auth/', 'http://project', redis.url, project_code, 'project', 'core', 'view', current_identity
+        )
         assert result is True
 
     @pytest.mark.asyncio
-    async def test_has_permission_false(self, httpx_mock):
+    async def test_has_permission_false(self, httpx_mock, redis, project_mock):
+        project_code = str(uuid4())
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
-        url = 'http://auth/authorize?role=admin&resource=project&zone=core&operation=view&project_code=test_project'
+        url = f'http://auth/authorize?role=admin&resource=project&zone=core&operation=view&project_code={project_code}'
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': False}}, url=url)
-        result = await has_permission('http://auth/', 'test_project', 'project', 'core', 'view', current_identity)
+        result = await has_permission(
+            'http://auth/', 'http://project', redis.url, project_code, 'project', 'core', 'view', current_identity
+        )
         assert result is False
 
     @pytest.mark.asyncio
-    async def test_has_permission_platform_admin_true(self, httpx_mock):
+    async def test_has_permission_platform_admin_true(self, httpx_mock, redis, project_mock):
+        project_code = str(uuid4())
         current_identity = {
             'username': 'test',
             'role': 'admin',
         }
         url = (
             'http://auth/authorize?role=platform_admin&resource=project&zone=core&operation=view'
-            '&project_code=test_project'
+            f'&project_code={project_code}'
         )
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': True}}, url=url)
-        result = await has_permission('http://auth/', 'test_project', 'project', 'core', 'view', current_identity)
+        result = await has_permission(
+            'http://auth/', 'http://project', redis.url, project_code, 'project', 'core', 'view', current_identity
+        )
         assert result is True
 
     @pytest.mark.asyncio
-    async def test_has_permission_no_project_code(self, httpx_mock):
+    async def test_has_permission_no_project_code(self, httpx_mock, redis):
+        project_code = str(uuid4())
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
-        result = await has_permission('http://auth/', '', 'project', 'core', 'view', current_identity)
+        result = await has_permission(
+            'http://auth/', 'http://project', redis.url, '', 'project', 'core', 'view', current_identity
+        )
         assert result is False
 
     @pytest.mark.asyncio
-    async def test_has_permission_service_error(self, httpx_mock):
+    async def test_has_permission_service_error(self, httpx_mock, redis, project_mock):
+        project_code = str(uuid4())
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
-        url = 'http://auth/authorize?role=admin&resource=project&zone=core&operation=view&project_code=test_project'
+        url = f'http://auth/authorize?role=admin&resource=project&zone=core&operation=view&project_code={project_code}'
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': True}}, url=url, status_code=500)
         with pytest.raises(Exception):  # noqa: B017
-            await has_permission('http://auth/', 'test_project', 'project', 'core', 'view', current_identity)
+            await has_permission(
+                'http://auth/', 'http://project', redis.url, project_code, 'project', 'core', 'view', current_identity
+            )
 
 
 class TestFilePermissions:
     @pytest.mark.asyncio
-    async def test_has_file_permission_in_namefolder_true(self, httpx_mock):
+    async def test_has_file_permission_in_namefolder_true(self, httpx_mock, redis, project_mock):
+        project_code = str(uuid4())
         file_data = {
             'parent_path': 'users/test',
             'zone': 'core',
-            'container_code': 'test_project',
+            'container_code': project_code,
             'container_type': 'project',
         }
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
-        url = 'http://auth/authorize?role=admin&resource=file_any&zone=core&operation=view' '&project_code=test_project'
+        url = f'http://auth/authorize?role=admin&resource=file_any&zone=core&operation=view&project_code={project_code}'
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': False}}, url=url)
         url = (
             'http://auth/authorize?role=admin&resource=file_in_own_namefolder&zone=core&operation=view'
-            '&project_code=test_project'
+            f'&project_code={project_code}'
         )
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': True}}, url=url)
-        result = await has_file_permission('http://auth/', 'http://metadata/v1/', file_data, 'view', current_identity)
+        result = await has_file_permission(
+            'http://auth/', 'http://metadata/v1/', 'http://project', redis.url, file_data, 'view', current_identity
+        )
         assert result is True
 
     @pytest.mark.asyncio
-    async def test_has_file_permission_in_other_namefolder_true(self, httpx_mock):
+    async def test_has_file_permission_in_other_namefolder_true(self, httpx_mock, redis, project_mock):
+        project_code = str(uuid4())
         file_data = {
             'parent_path': 'users/another',
             'zone': 'core',
-            'container_code': 'test_project',
+            'container_code': project_code,
             'container_type': 'project',
         }
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
-        url = 'http://auth/authorize?role=admin&resource=file_any&zone=core&operation=view' '&project_code=test_project'
+        url = f'http://auth/authorize?role=admin&resource=file_any&zone=core&operation=view&project_code={project_code}'
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': False}}, url=url)
-        result = await has_file_permission('http://auth/', 'http://metadata/v1/', file_data, 'view', current_identity)
+        result = await has_file_permission(
+            'http://auth/', 'http://metadata/v1/', 'http://project', redis.url, file_data, 'view', current_identity
+        )
         assert result is False
 
     @pytest.mark.asyncio
-    async def test_has_file_permission_false(self, httpx_mock):
+    async def test_has_file_permission_false(self, httpx_mock, redis, project_mock):
+        project_code = str(uuid4())
         file_data = {
             'parent_path': 'users/test',
             'zone': 'core',
-            'container_code': 'test_project',
+            'container_code': project_code,
             'container_type': 'project',
         }
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
-        url = 'http://auth/authorize?role=admin&resource=file_any&zone=core&operation=view' '&project_code=test_project'
+        url = f'http://auth/authorize?role=admin&resource=file_any&zone=core&operation=view&project_code={project_code}'
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': False}}, url=url)
         url = (
             'http://auth/authorize?role=admin&resource=file_in_own_namefolder&zone=core&operation=view'
-            '&project_code=test_project'
+            f'&project_code={project_code}'
         )
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': False}}, url=url)
-        result = await has_file_permission('http://auth/', 'http://metadata/v1/', file_data, 'view', current_identity)
+        result = await has_file_permission(
+            'http://auth/', 'http://metadata/v1/', 'http://project', redis.url, file_data, 'view', current_identity
+        )
         assert result is False
 
     @pytest.mark.asyncio
-    async def test_has_file_permission_outside_of_namefolder_false(self, httpx_mock):
+    async def test_has_file_permission_outside_of_namefolder_false(self, httpx_mock, redis, project_mock):
+        project_code = str(uuid4())
         file_data = {
             'parent_path': 'users/test',
             'zone': 'core',
-            'container_code': 'test_project',
+            'container_code': project_code,
             'container_type': 'project',
         }
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
-        url = 'http://auth/authorize?role=admin&resource=file_any&zone=core&operation=view' '&project_code=test_project'
+        url = f'http://auth/authorize?role=admin&resource=file_any&zone=core&operation=view&project_code={project_code}'
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': False}}, url=url)
         url = (
             'http://auth/authorize?role=admin&resource=file_in_own_namefolder&zone=core&operation=view'
-            '&project_code=test_project'
+            f'&project_code={project_code}'
         )
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': False}}, url=url)
-        result = await has_file_permission('http://auth/', 'http://metadata/v1/', file_data, 'view', current_identity)
+        result = await has_file_permission(
+            'http://auth/', 'http://metadata/v1/', 'http://project', redis.url, file_data, 'view', current_identity
+        )
         assert result is False
 
     @pytest.mark.asyncio
-    async def test_has_file_permission_wrong_project(self, httpx_mock):
+    async def test_has_file_permission_wrong_project(self, httpx_mock, redis):
+        project_code = str(uuid4())
         file_data = {
             'parent_path': 'users/test',
             'zone': 'core',
-            'container_code': 'test_project2',
+            'container_code': project_code,
             'container_type': 'project',
         }
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': ['wrongproject-admin'],
         }
-        result = await has_file_permission('http://auth/', 'http://metadata/v1/', file_data, 'view', current_identity)
+        result = await has_file_permission(
+            'http://auth/', 'http://metadata/v1/', 'http://project', redis.url, file_data, 'view', current_identity
+        )
         assert result is False
 
     @pytest.mark.asyncio
-    async def test_has_file_permission_wrong_container_type(self, httpx_mock):
+    async def test_has_file_permission_wrong_container_type(self, httpx_mock, redis):
+        project_code = str(uuid4())
         file_data = {
             'parent_path': 'users/test',
             'zone': 'core',
-            'container_code': 'test_project',
+            'container_code': project_code,
             'container_type': 'dataset',
         }
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
-        result = await has_file_permission('http://auth/', 'http://metadata/v1/', file_data, 'view', current_identity)
+        result = await has_file_permission(
+            'http://auth/', 'http://metadata/v1/', 'http://project', redis.url, file_data, 'view', current_identity
+        )
         assert result is False
 
     @pytest.mark.asyncio
-    async def test_has_file_permission_trashed(self, httpx_mock):
+    async def test_has_file_permission_trashed(self, httpx_mock, redis, project_mock):
+        project_code = str(uuid4())
         file_data = {
             'status': 'TRASHED',
             'restore_path': 'users/test',
             'zone': 'core',
-            'container_code': 'test_project',
+            'container_code': project_code,
             'container_type': 'project',
         }
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
-        url = 'http://auth/authorize?role=admin&resource=file_any&zone=core&operation=view' '&project_code=test_project'
+        url = f'http://auth/authorize?role=admin&resource=file_any&zone=core&operation=view&project_code={project_code}'
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': False}}, url=url)
         url = (
             'http://auth/authorize?role=admin&resource=file_in_own_namefolder&zone=core&operation=view'
-            '&project_code=test_project'
+            f'&project_code={project_code}'
         )
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': True}}, url=url)
-        result = await has_file_permission('http://auth/', 'http://metadata/v1/', file_data, 'view', current_identity)
+        result = await has_file_permission(
+            'http://auth/', 'http://metadata/v1/', 'http://project', redis.url, file_data, 'view', current_identity
+        )
         assert result is True
 
     @pytest.mark.asyncio
-    async def test_has_file_permission_namefolder(self, httpx_mock):
+    async def test_has_file_permission_namefolder(self, httpx_mock, redis, project_mock):
+        project_code = str(uuid4())
         file_data = {
             'parent_path': 'users',
             'type': 'name_folder',
             'name': 'test',
             'zone': 'core',
-            'container_code': 'test_project',
+            'container_code': project_code,
             'container_type': 'project',
         }
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
-        url = 'http://auth/authorize?role=admin&resource=file_any&zone=core&operation=view' '&project_code=test_project'
+        url = f'http://auth/authorize?role=admin&resource=file_any&zone=core&operation=view&project_code={project_code}'
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': False}}, url=url)
         url = (
             'http://auth/authorize?role=admin&resource=file_in_own_namefolder&zone=core&operation=view'
-            '&project_code=test_project'
+            f'&project_code={project_code}'
         )
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': True}}, url=url)
-        result = await has_file_permission('http://auth/', 'http://metadata/v1/', file_data, 'view', current_identity)
+        result = await has_file_permission(
+            'http://auth/', 'http://metadata/v1/', 'http://project', redis.url, file_data, 'view', current_identity
+        )
         assert result is True
 
     @pytest.mark.asyncio
     @pytest.mark.parametrize('is_authorized', [True, False])
-    async def test_has_file_permission_file_in_shared_folder(self, httpx_mock, get_project_folder, is_authorized):
+    async def test_has_file_permission_file_in_shared_folder(
+        self, httpx_mock, get_project_folder, is_authorized, redis, project_mock
+    ):
+        project_code = str(uuid4())
         file_data = {
             'type': 'file',
             'name': 'test.txt',
             'zone': 'core',
-            'container_code': 'test_project',
+            'container_code': project_code,
             'container_type': 'project',
             'parent_path': 'shared/user',
         }
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
         project_folder = get_project_folder
         resource = 'file_shared_' + project_folder['id']
 
-        url = f'http://auth/authorize?role=admin&resource={resource}&zone=core&operation=view&project_code=test_project'
+        url = (
+            f'http://auth/authorize?role=admin&resource={resource}&zone=core&operation=view&project_code={project_code}'
+        )
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': is_authorized}}, url=url)
 
-        result = await has_file_permission('http://auth/', 'http://metadata/v1/', file_data, 'view', current_identity)
+        result = await has_file_permission(
+            'http://auth/', 'http://metadata/v1/', 'http://project', redis.url, file_data, 'view', current_identity
+        )
         assert result is is_authorized
 
     @pytest.mark.asyncio
     @pytest.mark.parametrize('is_authorized', [True, False])
-    async def test_has_file_permission_file_in_shared_folder_trashed_sourced(self, httpx_mock, is_authorized):
+    async def test_has_file_permission_file_in_shared_folder_trashed_sourced(
+        self, httpx_mock, is_authorized, redis, project_mock
+    ):
+        project_code = str(uuid4())
         file_data = {
             'type': 'file',
             'name': 'test.txt',
             'zone': 'core',
-            'container_code': 'test_project',
+            'container_code': project_code,
             'container_type': 'project',
             'parent_path': 'shared/user',
         }
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
         PROJECT_FOLDER_DATA = {
             'type': 'project_folder',
@@ -293,33 +343,40 @@ class TestFilePermissions:
         }
 
         url = (
-            'http://metadata/v1/item/?name=user&container_code=test_project&container_type=project&zone=1'
+            f'http://metadata/v1/item/?name=user&container_code={project_code}&container_type=project&zone=1'
             '&type=project_folder&status=ACTIVE'
         )
         httpx_mock.add_response(status_code=404, method='GET', json={}, url=url)
 
         url = (
-            'http://metadata/v1/item/?name=user&container_code=test_project&container_type=project&zone=1'
+            f'http://metadata/v1/item/?name=user&container_code={project_code}&container_type=project&zone=1'
             '&type=project_folder&status=TRASHED'
         )
         httpx_mock.add_response(method='GET', json={'result': PROJECT_FOLDER_DATA}, url=url)
         project_folder = PROJECT_FOLDER_DATA
 
         resource = 'file_shared_' + project_folder['id']
-        url = f'http://auth/authorize?role=admin&resource={resource}&zone=core&operation=view&project_code=test_project'
+        url = (
+            f'http://auth/authorize?role=admin&resource={resource}&zone=core&operation=view&project_code={project_code}'
+        )
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': is_authorized}}, url=url)
 
-        result = await has_file_permission('http://auth/', 'http://metadata/v1/', file_data, 'view', current_identity)
+        result = await has_file_permission(
+            'http://auth/', 'http://metadata/v1/', 'http://project', redis.url, file_data, 'view', current_identity
+        )
         assert result is is_authorized
 
     @pytest.mark.asyncio
     @pytest.mark.parametrize('is_authorized', [True, False])
-    async def test_has_file_permission_file_in_shared_folder_trash(self, httpx_mock, is_authorized):
+    async def test_has_file_permission_file_in_shared_folder_trash(
+        self, httpx_mock, is_authorized, redis, project_mock
+    ):
+        project_code = str(uuid4())
         file_data = {
             'type': 'file',
             'name': 'test.txt',
             'zone': 'core',
-            'container_code': 'test_project',
+            'container_code': project_code,
             'container_type': 'project',
             'restore_path': 'shared',
             'status': 'TRASHED',
@@ -327,7 +384,7 @@ class TestFilePermissions:
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
         PROJECT_FOLDER_DATA = {
             'type': 'project_folder',
@@ -340,44 +397,56 @@ class TestFilePermissions:
 
         resource = 'file_shared_' + PROJECT_FOLDER_DATA['id']
 
-        url = f'http://auth/authorize?role=admin&resource={resource}&zone=core&operation=view&project_code=test_project'
+        url = (
+            f'http://auth/authorize?role=admin&resource={resource}&zone=core&operation=view&project_code={project_code}'
+        )
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': is_authorized}}, url=url)
 
-        result = await has_file_permission('http://auth/', 'http://metadata/v1/', file_data, 'view', current_identity)
+        result = await has_file_permission(
+            'http://auth/', 'http://metadata/v1/', 'http://project', redis.url, file_data, 'view', current_identity
+        )
         assert result is is_authorized
 
     @pytest.mark.asyncio
     @pytest.mark.parametrize('is_authorized', [True, False])
-    async def test_has_file_permission_shared_folder(self, httpx_mock, get_project_folder, is_authorized):
+    async def test_has_file_permission_shared_folder(
+        self, httpx_mock, get_project_folder, is_authorized, redis, project_mock
+    ):
+        project_code = str(uuid4())
         file_data = {
             'type': 'project_folder',
             'name': 'user',
             'zone': 'core',
-            'container_code': 'test_project',
+            'container_code': project_code,
             'container_type': 'project',
             'parent_path': 'shared',
         }
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
         project_folder = get_project_folder
         resource = 'file_shared_' + project_folder['id']
 
-        url = f'http://auth/authorize?role=admin&resource={resource}&zone=core&operation=view&project_code=test_project'
+        url = (
+            f'http://auth/authorize?role=admin&resource={resource}&zone=core&operation=view&project_code={project_code}'
+        )
         httpx_mock.add_response(method='GET', json={'result': {'has_permission': is_authorized}}, url=url)
 
-        result = await has_file_permission('http://auth/', 'http://metadata/v1/', file_data, 'view', current_identity)
+        result = await has_file_permission(
+            'http://auth/', 'http://metadata/v1/', 'http://project', redis.url, file_data, 'view', current_identity
+        )
         assert result is is_authorized
 
     @pytest.mark.asyncio
-    async def test_has_file_permission_root_level_users(self, httpx_mock):
+    async def test_has_file_permission_root_level_users(self, httpx_mock, redis):
+        project_code = str(uuid4())
         file_data = {
             'type': 'root_folder',
             'name': 'users',
             'zone': 'core',
-            'container_code': 'test_project',
+            'container_code': project_code,
             'container_type': 'project',
             'parent_path': None,
             'parent': None,
@@ -385,18 +454,21 @@ class TestFilePermissions:
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
-        result = await has_file_permission('http://auth/', 'http://metadata/v1/', file_data, 'view', current_identity)
+        result = await has_file_permission(
+            'http://auth/', 'http://metadata/v1/', 'http://project', redis.url, file_data, 'view', current_identity
+        )
         assert result is True
 
     @pytest.mark.asyncio
-    async def test_has_file_permission_root_level_shared(self, httpx_mock):
+    async def test_has_file_permission_root_level_shared(self, httpx_mock, redis):
+        project_code = str(uuid4())
         file_data = {
             'type': 'root_folder',
             'name': 'shared',
             'zone': 'core',
-            'container_code': 'test_project',
+            'container_code': project_code,
             'container_type': 'project',
             'parent_path': None,
             'parent': None,
@@ -404,40 +476,45 @@ class TestFilePermissions:
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
-        result = await has_file_permission('http://auth/', 'http://metadata/v1/', file_data, 'view', current_identity)
+        result = await has_file_permission(
+            'http://auth/', 'http://metadata/v1/', 'http://project', redis.url, file_data, 'view', current_identity
+        )
         assert result is True
 
 
 class TestGetCurrentRole:
     @pytest.mark.asyncio
     async def test_get_current_role_admin(self, httpx_mock):
+        project_code = str(uuid4())
         current_identity = {
             'username': 'test',
             'role': 'admin',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
-        result = await get_project_role('test_project', current_identity)
+        result = await get_project_role(project_code, current_identity)
         assert result == 'platform_admin'
 
     @pytest.mark.asyncio
     async def test_get_current_role_member(self, httpx_mock):
+        project_code = str(uuid4())
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-admin'],
+            'realm_roles': [f'{project_code}-admin'],
         }
-        result = await get_project_role('test_project', current_identity)
+        result = await get_project_role(project_code, current_identity)
         assert result == 'admin'
 
     async def test_get_current_role_non_default(self, httpx_mock):
+        project_code = str(uuid4())
         current_identity = {
             'username': 'test',
             'role': 'member',
-            'realm_roles': ['test_project-customrole'],
+            'realm_roles': [f'{project_code}-customrole'],
         }
-        result = await get_project_role('test_project', current_identity)
+        result = await get_project_role(project_code, current_identity)
         assert result == 'customrole'
 
 
@@ -447,26 +524,31 @@ class TestBulkPermissions:
         {'role': 'admin', 'zone': 'greenroom', 'resource': 'file_any', 'operation': 'copy'},
         {'role': 'admin', 'zone': 'greenroom', 'resource': 'file_any', 'operation': 'view'},
     ]
-    current_identity = {'role': 'collaborator', 'realm_roles': ['test_project-collaborator']}
 
-    async def test_has_permissions_return_mapped_assertions(self, httpx_mock):
+    async def test_has_permissions_return_mapped_assertions(self, httpx_mock, redis, project_mock):
+        project_code = str(uuid4())
+        current_identity = {'role': 'collaborator', 'realm_roles': [f'{project_code}-collaborator']}
         granted = {'has_permission': True}
         mapped_result = {'greenroom_file_any_copy': True, 'greenroom_file_any_view': True}
 
         httpx_mock.add_response(
             method='POST',
-            url=f'{self.auth_service_url}authorize?project_code=test_project',
+            url=f'{self.auth_service_url}authorize?project_code={project_code}',
             status_code=200,
             json=granted,
         )
         mapped = await has_permissions(
-            self.auth_service_url, 'test_project', self.permission_request, self.current_identity
+            self.auth_service_url, 'http://project', redis.url, project_code, self.permission_request, current_identity
         )
 
         assert mapped == mapped_result
 
-    async def test_has_permissions_raise_project_role_not_found_exception_for_invalid_role(self, httpx_mock):
-        identity = self.current_identity
-        identity['realm_roles'] = ['invalidproject-collaborator']
+    async def test_has_permissions_raise_project_role_not_found_exception_for_invalid_role(
+        self, httpx_mock, redis, project_mock
+    ):
+        project_code = str(uuid4())
+        identity = {'role': 'collaborator', 'realm_roles': ['invalid-collaborator']}
         with pytest.raises(ProjectRoleNotFound):
-            await has_permissions(self.auth_service_url, 'test_project', self.permission_request, identity)
+            await has_permissions(
+                self.auth_service_url, 'http://project', redis.url, project_code, self.permission_request, identity
+            )

{pilot_platform_common-2.2.0 → pilot_platform_common-2.4.0}/tests/test_project_client.py

@@ -110,9 +110,11 @@ def test_create_project_200(fake, redis, httpx_mock):
         operator=fake.user_name(),
         tags=PROJECT_DATA['tags'],
         system_tags=PROJECT_DATA['system_tags'],
+        created_by=PROJECT_DATA['created_by'],
     )
     assert project.name == PROJECT_DATA['name']
     assert project.state == PROJECT_DATA['state']
+    assert project.created_by == PROJECT_DATA['created_by']
 
 
 def test_create_project_500(fake, redis, httpx_mock):
@@ -132,6 +134,7 @@ def test_create_project_500(fake, redis, httpx_mock):
             operator=fake.user_name(),
             tags=PROJECT_DATA['tags'],
             system_tags=PROJECT_DATA['system_tags'],
+            created_by=PROJECT_DATA['created_by'],
         )