udata 9.1.5.dev31391__py2.py3-none-any.whl → 9.2.2.dev31715__py2.py3-none-any.whl

tasks/__init__.py

@@ -197,7 +197,7 @@ def qa(ctx):
 def serve(ctx, host="localhost", port="7000"):
     """Run a development server"""
     with ctx.cd(ROOT):
-        ctx.run(f"python manage.py serve -d -r -h {host} -p {port}")
+        ctx.run(f"python manage.py serve -d -r -h {host} -p {port}", pty=True)
 
 
 @task

udata/__init__.py

@@ -4,5 +4,5 @@
 udata
 """
 
-__version__ = "9.1.5.dev"
+__version__ = "9.2.2.dev"
 __description__ = "Open data portal"

udata/api/commands.py

@@ -4,6 +4,7 @@ import os
 import click
 from flask import current_app, json
 from flask_restx import schemas
+from werkzeug.security import gen_salt
 
 from udata.api import api
 from udata.api.oauth2 import OAuth2Client
@@ -77,12 +78,15 @@ def validate():
 @click.option(
     "-r", "--response-types", multiple=True, default=["code"], help="Client's response types"
 )
-def create_oauth_client(client_name, user_email, uri, grant_types, scope, response_types):
+@click.option("-p", "--public", is_flag=True, help="Public client (SPA)")
+def create_oauth_client(client_name, user_email, uri, grant_types, scope, response_types, public):
     """Creates an OAuth2Client instance in DB"""
     user = User.objects(email=user_email).first()
     if user is None:
         exit_with_error("No matching user to email")
 
+    client_secret = gen_salt(50) if not public else None
+
     client = OAuth2Client.objects.create(
         name=client_name,
         owner=user,
@@ -90,11 +94,15 @@ def create_oauth_client(client_name, user_email, uri, grant_types, scope, respon
         scope=scope,
         response_types=response_types,
         redirect_uris=uri,
+        secret=client_secret,
     )
 
     click.echo(f"New OAuth client: {client.name}")
     click.echo(f"Client's ID {client.id}")
-    click.echo(f"Client's secret {client.secret}")
+    if public:
+        click.echo("Client is public and has no secret.")
+    else:
+        click.echo(f"Client's secret {client.secret}")
     click.echo(f"Client's grant_types {client.grant_types}")
     click.echo(f"Client's response_types {client.response_types}")
     click.echo(f"Client's URI {client.redirect_uris}")

udata/api/oauth2.py

@@ -32,7 +32,6 @@ from bson import ObjectId
 from flask import current_app, render_template, request
 from flask_security.utils import verify_password
 from werkzeug.exceptions import Unauthorized
-from werkzeug.security import gen_salt
 
 from udata.app import csrf
 from udata.auth import current_user, login_required, login_user
@@ -60,7 +59,7 @@ SCOPES = {"default": _("Default scope"), "admin": _("System administrator rights
 
 
 class OAuth2Client(ClientMixin, db.Datetimed, db.Document):
-    secret = db.StringField(default=lambda: gen_salt(50))
+    secret = db.StringField(default=None)
 
     name = db.StringField(required=True)
     description = db.StringField()
@@ -209,7 +208,7 @@ class OAuth2Code(db.Document):
 
 
 class AuthorizationCodeGrant(grants.AuthorizationCodeGrant):
-    TOKEN_ENDPOINT_AUTH_METHODS = ["client_secret_basic", "client_secret_post"]
+    TOKEN_ENDPOINT_AUTH_METHODS = ["none", "client_secret_basic", "client_secret_post"]
 
     def save_authorization_code(self, code, request):
         code_challenge = request.data.get("code_challenge")
@@ -265,6 +264,8 @@ class RefreshTokenGrant(grants.RefreshTokenGrant):
 
 
 class RevokeToken(RevocationEndpoint):
+    CLIENT_AUTH_METHODS = ["none", "client_secret_basic"]
+
     def query_token(self, token_string, token_type_hint):
         qs = OAuth2Token.objects()
         if token_type_hint == "access_token":

udata/api_fields.py

@@ -302,7 +302,11 @@ def generate_fields(**kwargs):
             parser.add_argument("q", type=str, location="args")
 
         for filterable in filterables:
-            parser.add_argument(filterable["key"], type=filterable["type"], location="args")
+            parser.add_argument(
+                filterable["key"],
+                type=filterable["type"],
+                location="args",
+            )
 
         cls.__index_parser__ = parser
 

udata/core/dataservices/models.py

@@ -94,7 +94,7 @@ class HarvestMetadata(db.EmbeddedDocument):
     archived_at = field(db.DateTimeField())
 
 
-@generate_fields()
+@generate_fields(searchable=True)
 class Dataservice(WithMetrics, Owned, db.Document):
     meta = {
         "indexes": [
@@ -130,7 +130,7 @@ class Dataservice(WithMetrics, Owned, db.Document):
     authorization_request_url = field(db.URLField())
     availability = field(db.FloatField(min=0, max=100), example="99.99")
     rate_limiting = field(db.StringField())
-    is_restricted = field(db.BooleanField())
+    is_restricted = field(db.BooleanField(), filterable={})
     has_token = field(db.BooleanField())
     format = field(db.StringField(choices=DATASERVICE_FORMATS))
 

udata/core/dataset/csv.py

@@ -1,4 +1,5 @@
-from udata.core.discussions.models import Discussion
+# for backwards compatibility (see https://github.com/opendatateam/udata/pull/3152)
+from udata.core.discussions.csv import DiscussionCsvAdapter  # noqa: F401
 from udata.frontend import csv
 
 from .models import Dataset, Resource
@@ -36,11 +37,13 @@ class DatasetCsvAdapter(csv.Adapter):
         ("archived", lambda o: o.archived or False),
         ("resources_count", lambda o: len(o.resources)),
         ("main_resources_count", lambda o: len([r for r in o.resources if r.type == "main"])),
+        ("resources_formats", lambda o: ",".join(set(r.format for r in o.resources))),
         "downloads",
         ("harvest.backend", lambda r: r.harvest and r.harvest.backend),
         ("harvest.domain", lambda r: r.harvest and r.harvest.domain),
         ("harvest.created_at", lambda r: r.harvest and r.harvest.created_at),
         ("harvest.modified_at", lambda r: r.harvest and r.harvest.modified_at),
+        ("harvest.remote_url", lambda r: r.harvest and r.harvest.remote_url),
         ("quality_score", lambda o: format(o.quality["score"], ".2f")),
         # schema? what is the schema of a dataset?
     )
@@ -90,18 +93,3 @@ class ResourcesCsvAdapter(csv.NestedAdapter):
         ("preview_url", lambda o: o.preview_url or False),
     )
     attribute = "resources"
-
-
-@csv.adapter(Discussion)
-class DiscussionCsvAdapter(csv.Adapter):
-    fields = (
-        "id",
-        "user",
-        "subject",
-        "title",
-        ("size", lambda o: len(o.discussion)),
-        ("messages", lambda o: "\n".join(msg.content for msg in o.discussion)),
-        "created",
-        "closed",
-        "closed_by",
-    )

udata/core/discussions/api.py

@@ -6,6 +6,10 @@ from flask_security import current_user
 
 from udata.api import API, api, fields
 from udata.auth import admin_permission
+from udata.core.dataservices.models import Dataservice
+from udata.core.dataset.models import Dataset
+from udata.core.organization.models import Organization
+from udata.core.reuse.models import Reuse
 from udata.core.spam.api import SpamAPIMixin
 from udata.core.spam.fields import spam_fields
 from udata.core.user.api_fields import user_ref_fields
@@ -73,8 +77,15 @@ comment_discussion_fields = api.model(
 discussion_page_fields = api.model("DiscussionPage", fields.pager(discussion_fields))
 
 parser = api.parser()
+sorting_keys: list[str] = ["created", "title", "closed"]
+sorting_choices: list[str] = sorting_keys + ["-" + k for k in sorting_keys]
 parser.add_argument(
-    "sort", type=str, default="-created", location="args", help="The sorting attribute"
+    "sort",
+    type=str,
+    default="-created",
+    choices=sorting_choices,
+    location="args",
+    help="The field (and direction) on which sorting apply",
 )
 parser.add_argument(
     "closed",
@@ -85,6 +96,9 @@ parser.add_argument(
 parser.add_argument(
     "for", type=str, location="args", action="append", help="Filter discussions for a given subject"
 )
+parser.add_argument(
+    "org", type=str, location="args", help="Filter discussions for a given organization"
+)
 parser.add_argument("user", type=str, location="args", help="Filter discussions created by a user")
 parser.add_argument("page", type=int, default=1, location="args", help="The page to fetch")
 parser.add_argument(
@@ -198,6 +212,15 @@ class DiscussionsAPI(API):
         discussions = Discussion.objects
         if args["for"]:
             discussions = discussions.generic_in(subject=args["for"])
+        if args["org"]:
+            org = Organization.objects.get_or_404(id=id_or_404(args["org"]))
+            if not org:
+                api.abort(404, "Organization does not exist")
+            reuses = Reuse.objects(organization=org).only("id")
+            datasets = Dataset.objects(organization=org).only("id")
+            dataservices = Dataservice.objects(organization=org).only("id")
+            subjects = list(reuses) + list(datasets) + list(dataservices)
+            discussions = discussions(subject__in=subjects)
         if args["user"]:
             discussions = discussions(discussion__posted_by=ObjectId(args["user"]))
         if args["closed"] is False:

udata/core/discussions/csv.py

@@ -0,0 +1,22 @@
+from udata.frontend import csv
+
+from .models import Discussion
+
+
+@csv.adapter(Discussion)
+class DiscussionCsvAdapter(csv.Adapter):
+    fields = (
+        "id",
+        "user",
+        "subject",
+        ("subject_class", "subject._class_name"),
+        ("subject_id", "subject.id"),
+        "title",
+        ("size", lambda o: len(o.discussion)),
+        ("participants", lambda o: ",".join(set(str(msg.posted_by.id) for msg in o.discussion))),
+        ("messages", lambda o: "\n".join(msg.content.replace("\n", " ") for msg in o.discussion)),
+        "created",
+        "closed",
+        "closed_by",
+        ("closed_by_id", "closed_by.id"),
+    )

udata/core/owned.py

@@ -24,6 +24,22 @@ class OwnedQuerySet(UDataQuerySet):
             qs |= Q(owner=owner) | Q(organization=owner)
         return self(qs)
 
+    def visible_by_user(self, user: User, visible_query: Q):
+        """Return EVERYTHING visible to the user."""
+        if user.is_anonymous:
+            return self(visible_query)
+
+        if user.sysadmin:
+            return self()
+
+        owners: list[User | Organization] = list(user.organizations) + [user.id]
+        # We create a new queryset because we want a pristine self._query_obj.
+        owned_qs: OwnedQuerySet = self.__class__(self._document, self._collection_obj).owned_by(
+            *owners
+        )
+
+        return self(visible_query | owned_qs._query_obj)
+
 
 def check_owner_is_current_user(owner):
     from udata.auth import admin_permission, current_user

udata/core/reuse/api.py

@@ -99,8 +99,9 @@ class ReuseListAPI(API):
     @api.expect(Reuse.__index_parser__)
     @api.marshal_with(Reuse.__page_fields__)
     def get(self):
-        query = Reuse.objects(deleted=None, private__ne=True)
-
+        query = Reuse.objects.visible_by_user(
+            current_user, mongoengine.Q(private__ne=True, deleted=None)
+        )
         return Reuse.apply_sort_filters_and_pagination(query)
 
     @api.secure

udata/core/reuse/models.py

@@ -104,7 +104,7 @@ class Reuse(db.Datetimed, WithMetrics, BadgeMixin, Owned, db.Document):
     )
     # badges = db.ListField(db.EmbeddedDocumentField(ReuseBadge))
 
-    private = field(db.BooleanField(default=False))
+    private = field(db.BooleanField(default=False), filterable={})
 
     ext = db.MapField(db.GenericEmbeddedDocumentField())
     extras = field(db.ExtrasField())

udata/cors.py

@@ -1,6 +1,6 @@
 import logging
 
-from flask import request
+from flask import g, request
 from werkzeug.datastructures import Headers
 
 log = logging.getLogger(__name__)
@@ -32,10 +32,15 @@ def is_preflight_request() -> bool:
 
 
 def is_allowed_cors_route():
+    if g and hasattr(g, "lang_code"):
+        path: str = request.path.removeprefix(f"/{g.lang_code}")
+    else:
+        path: str = request.path
     return (
-        request.path.endswith((".js", ".css", ".woff", ".woff2", ".png", ".jpg", ".jpeg", ".svg"))
-        or request.path.startswith("/api")
-        or request.path.startswith("/oauth")
+        path.endswith((".js", ".css", ".woff", ".woff2", ".png", ".jpg", ".jpeg", ".svg"))
+        or path.startswith("/api")
+        or path.startswith("/oauth")
+        or path.startswith("/datasets/r/")
     )