rucio 32.8.6__py3-none-any.whl

rucio/api/meta.py

@@ -0,0 +1,85 @@
+# -*- coding: utf-8 -*-
+# Copyright European Organization for Nuclear Research (CERN) since 2012
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from typing import TYPE_CHECKING
+
+from rucio.api.permission import has_permission
+from rucio.common.exception import AccessDenied
+from rucio.core import meta
+from rucio.db.sqla.session import read_session, transactional_session
+
+if TYPE_CHECKING:
+    from sqlalchemy.orm import Session
+
+
+@read_session
+def list_keys(*, session: "Session"):
+    """
+    Lists all keys.
+
+    :param session: The database session in use.
+
+    :returns: A list containing all keys.
+    """
+    return meta.list_keys(session=session)
+
+
+@read_session
+def list_values(key, *, session: "Session"):
+    """
+    Lists all values for a key.
+
+    :param key: the name for the key.
+    :param session: The database session in use.
+
+
+    :returns: A list containing all values.
+    """
+    return meta.list_values(key=key, session=session)
+
+
+@transactional_session
+def add_key(key, key_type, issuer, value_type=None, value_regexp=None, vo='def', *, session: "Session"):
+    """
+    Add a new allowed key.
+
+    :param key: the name for the new key.
+    :param key_type: the type of the key: all(container, dataset, file), collection(dataset or container), file, derived(compute from file for collection).
+    :param issuer: The issuer account.
+    :param value_type: the type of the value, if defined.
+    :param value_regexp: the regular expression that values should match, if defined.
+    :param vo: The vo to act on
+    :param session: The database session in use.
+    """
+    kwargs = {'key': key, 'key_type': key_type, 'value_type': value_type, 'value_regexp': value_regexp}
+    if not has_permission(issuer=issuer, vo=vo, action='add_key', kwargs=kwargs, session=session):
+        raise AccessDenied('Account %s can not add key' % (issuer))
+    return meta.add_key(key=key, key_type=key_type, value_type=value_type, value_regexp=value_regexp, session=session)
+
+
+@transactional_session
+def add_value(key, value, issuer, vo='def', *, session: "Session"):
+    """
+    Add a new value to a key.
+
+    :param key: the name for the key.
+    :param value: the value.
+    :param vo: the vo to act on.
+    :param session: The database session in use.
+    """
+    kwargs = {'key': key, 'value': value}
+    if not has_permission(issuer=issuer, vo=vo, action='add_value', kwargs=kwargs, session=session):
+        raise AccessDenied('Account %s can not add value %s to key %s' % (issuer, value, key))
+    return meta.add_value(key=key, value=value, session=session)

rucio/api/permission.py

@@ -0,0 +1,72 @@
+# -*- coding: utf-8 -*-
+# Copyright European Organization for Nuclear Research (CERN) since 2012
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from copy import deepcopy
+from typing import TYPE_CHECKING
+
+from rucio.common.exception import RSENotFound
+from rucio.common.types import InternalAccount, InternalScope
+from rucio.core import permission
+from rucio.core.rse import get_rse_id
+from rucio.db.sqla.session import read_session
+
+if TYPE_CHECKING:
+    from sqlalchemy.orm import Session
+
+
+@read_session
+def has_permission(issuer, action, kwargs, vo='def', *, session: "Session"):
+    """
+    Checks if an account has the specified permission to
+    execute an action with parameters.
+
+    :param issuer:  The Account issuer.
+    :param vo:      The VO to check against.
+    :param action:  The action (API call) called by the account.
+    :param session: The db session to use
+    :param kwargs:  List of arguments for the action.
+    :returns: True if account is allowed to call the API call, otherwise False
+    """
+
+    kwargs = deepcopy(kwargs)
+    if 'rse' in kwargs and 'rse_id' not in kwargs:
+        try:
+            rse_id = get_rse_id(rse=kwargs.get('rse'), vo=vo, session=session)
+        except RSENotFound:
+            rse_id = None
+        kwargs.update({'rse_id': rse_id})
+
+    if 'scope' in kwargs:
+        kwargs['scope'] = InternalScope(kwargs['scope'], vo=vo)
+    if 'attachments' in kwargs:
+        for a in kwargs['attachments']:
+            a['scope'] = InternalScope(a['scope'], vo=vo)
+
+    if 'account' in kwargs:
+        kwargs['account'] = InternalAccount(kwargs['account'], vo=vo)
+    if 'accounts' in kwargs:
+        kwargs['accounts'] = [InternalAccount(a, vo=vo) for a in kwargs['accounts']]
+    if 'rules' in kwargs:
+        for r in kwargs['rules']:
+            r['account'] = InternalAccount(r['account'], vo=vo)
+    if 'dids' in kwargs:
+        for d in kwargs['dids']:
+            if 'rules' in d:
+                for r in d['rules']:
+                    r['account'] = InternalAccount(r['account'], vo=vo)
+
+    issuer = InternalAccount(issuer, vo=vo)
+
+    return permission.has_permission(issuer=issuer, action=action, kwargs=kwargs, session=session)

rucio/api/quarantined_replica.py

@@ -0,0 +1,69 @@
+# -*- coding: utf-8 -*-
+# Copyright European Organization for Nuclear Research (CERN) since 2012
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from typing import TYPE_CHECKING
+
+from rucio.api import permission
+from rucio.common import exception
+from rucio.common.types import InternalScope
+from rucio.core.quarantined_replica import add_quarantined_replicas
+from rucio.core.rse import get_rse_id
+from rucio.db.sqla.session import transactional_session
+
+if TYPE_CHECKING:
+    from sqlalchemy.orm import Session
+
+
+@transactional_session
+def quarantine_file_replicas(replicas, issuer, rse=None, rse_id=None, vo='def', *, session: "Session"):
+    """
+    Quarantine replicas.
+
+    :param replicas: List of replica infos: {'scope': <scope> (optional), 'name': <name> (optional), 'path':<path> (required)}
+    :param issuer: The issuer account.
+    :param vo: The VO to act on.
+    :param rse: RSE name
+    :param rse_id: RSE id - either RSE name or RSE id must be specified
+    :param session: The database session in use.
+    """
+
+    if not replicas:
+        return
+
+    if (rse is None) == (rse_id is None):
+        raise exception.InputValidationError("Either RSE name or RSE id must be specified, but not both")
+
+    if rse_id is None:
+        rse_id = get_rse_id(rse, vo=vo, session=session)
+
+    if not permission.has_permission(issuer, 'quarantine_file_replicas', {}, vo=vo, session=session):
+        raise exception.AccessDenied('Account %s can not quarantine replicas' % (issuer))
+
+    replica_infos = []
+    for r in replicas:
+        if "path" not in r:
+            raise exception.InputValidationError("Replica info must include path")
+        scope = r.get("scope")
+        if scope and isinstance(scope, str):
+            scope = InternalScope(scope, vo=vo)
+        replica_infos.append(
+            {
+                "scope": scope or None,
+                "name": r.get("name"),
+                "path": r["path"]
+            }
+        )
+
+    add_quarantined_replicas(rse_id, replica_infos, session=session)