vantage6-algorithm-store 4.15.1__tar.gz → 4.15.2__tar.gz

{vantage6_algorithm_store-4.15.1 → vantage6_algorithm_store-4.15.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vantage6_algorithm_store
-Version: 4.15.1
+Version: 4.15.2
 Summary: Vantage6 algorithm store
 Home-page: https://github.com/vantage6/vantage6
 Requires-Python: >=3.10
@@ -17,8 +17,8 @@ Requires-Dist: requests==2.33.1
 Requires-Dist: schema==0.7.5
 Requires-Dist: SQLAlchemy==1.4.46
 Requires-Dist: werkzeug==3.1.8
-Requires-Dist: vantage6==4.15.1
-Requires-Dist: vantage6-common==4.15.1
+Requires-Dist: vantage6==4.15.2
+Requires-Dist: vantage6-common==4.15.2
 Provides-Extra: dev
 Requires-Dist: coverage==6.4.4; extra == "dev"
 Dynamic: description

{vantage6_algorithm_store-4.15.1 → vantage6_algorithm_store-4.15.2}/tests_store/resources/test_algorithm.py

@@ -157,6 +157,83 @@ class TestAlgorithmResources(TestResources):
         whitelisted_server.delete()
         user.delete()
 
+    @patch("vantage6.algorithm.store.resource.request_validate_node_token")
+    def test_view_algorithm_decorator_node(self, validate_node_token_mock):
+        """
+        Test that a request self-identifying as a node (Client-Type: node header) is
+        allowed to list approved algorithms (`allow_node=True` on the decorator) once
+        its own server confirms the token, even under the store's most restrictive
+        algorithm_view policy and without any store User being registered - and that
+        this does not extend to non-approved algorithms.
+        """
+        # even the most restrictive policy should not block a node
+        policy = Policy(
+            key=StorePolicies.ALGORITHM_VIEW,
+            value=AlgorithmViewPolicies.ONLY_WITH_EXPLICIT_PERMISSION,
+        )
+        policy.save()
+        whitelisted_server = self.register_server()
+        node_headers = {
+            "server_url": SERVER_URL,
+            "Authorization": "Mock",
+            "Client-Type": "node",
+        }
+
+        # the node's own server says the token is not valid -> denied
+        validate_node_token_mock.return_value = (
+            MockResponse(),
+            HTTPStatus.UNAUTHORIZED,
+        )
+        rv = self.app.get("/api/algorithm", headers=node_headers)
+        self.assertNotEqual(rv.status_code, HTTPStatus.OK)
+
+        # the node's own server confirms the token is valid -> allowed
+        validate_node_token_mock.return_value = (MockResponse(), HTTPStatus.OK)
+        rv = self.app.get("/api/algorithm", headers=node_headers)
+        self.assertEqual(rv.status_code, HTTPStatus.OK)
+
+        # a node cannot use this to see non-approved algorithms
+        for arg in [
+            "awaiting_reviewer_assignment",
+            "under_review",
+            "in_review_process",
+            "invalidated",
+        ]:
+            rv = self.app.get(f"/api/algorithm?{arg}=1", headers=node_headers)
+            self.assertNotEqual(rv.status_code, HTTPStatus.OK)
+
+        # this is not a blanket bypass: a request without the Client-Type header is
+        # still governed by the normal (server/user-based) auth flow, which under
+        # this policy requires a registered, permissioned store user
+        rv = self.app.get("/api/algorithm", headers=HEADERS)
+        self.assertNotEqual(rv.status_code, HTTPStatus.OK)
+
+        # cleanup
+        policy.delete()
+        whitelisted_server.delete()
+
+    def test_view_algorithm_single_not_affected_by_node_bypass(self):
+        """
+        Test that the node bypass on the algorithm list endpoint does not extend to
+        /api/algorithm/<id>, which was deliberately left on the un-modified
+        decorator.
+        """
+        algorithm = Algorithm(name="test_algorithm", status=AlgorithmStatus.APPROVED)
+        algorithm.save()
+
+        node_headers = {
+            "server_url": SERVER_URL,
+            "Authorization": "Mock",
+            "Client-Type": "node",
+        }
+        # no policy is defined, so the default applies - and a node token is not
+        # recognized at all here, since this endpoint never got `allow_node=True`
+        rv = self.app.get(f"/api/algorithm/{algorithm.id}", headers=node_headers)
+        self.assertNotEqual(rv.status_code, HTTPStatus.OK)
+
+        # cleanup
+        algorithm.delete()
+
     @patch("vantage6.algorithm.store.resource.request_validate_server_token")
     def test_algorithm_view_multi(self, validate_token_mock):
         """Test GET /api/algorithm"""
@@ -562,6 +639,31 @@ class TestAlgorithmResources(TestResources):
         self.assertEqual(response.status_code, 200)
         self.assertEqual(response.json["description"], "new_description")
 
+        # check that another developer cannot update this algorithm - they are
+        # not its owner
+        other_username = "other_developer"
+        self.register_user(
+            server.id,
+            username=other_username,
+            user_rules=[Rule.get_by_("algorithm", Operation.EDIT)],
+        )
+        validate_token_mock.return_value = (
+            MockResponse({"username": other_username}),
+            HTTPStatus.OK,
+        )
+        response = self.app.patch(
+            f"/api/algorithm/{algorithm.id}",
+            json={"description": "other_description"},
+            headers=HEADERS,
+        )
+        self.assertEqual(response.status_code, 403)
+
+        # switch back to the algorithm's own developer for the remaining checks
+        validate_token_mock.return_value = (
+            MockResponse({"username": USERNAME}),
+            HTTPStatus.OK,
+        )
+
         # check that algorithm cannot be updated if it is approved
         algorithm.status = AlgorithmStatus.APPROVED
         algorithm.approved_at = datetime.datetime.now(datetime.timezone.utc)

{vantage6_algorithm_store-4.15.1 → vantage6_algorithm_store-4.15.2}/vantage6/algorithm/store/_version.py

@@ -7,7 +7,7 @@ with open(os.path.join(here, "__build__")) as fp:
     __build__ = json.load(fp)
 
 # Module version
-version_info = (4, 15, 1, "final", __build__, 0)
+version_info = (4, 15, 2, "final", __build__, 0)
 
 # Module version stage suffix map
 _specifier_ = {"alpha": "a", "beta": "b", "candidate": "rc", "final": ""}

{vantage6_algorithm_store-4.15.1 → vantage6_algorithm_store-4.15.2}/vantage6/algorithm/store/resource/__init__.py

@@ -1,25 +1,26 @@
-import os
 import logging
-import requests
+import os
+from collections.abc import Callable
 from functools import wraps
 from http import HTTPStatus
-from flask import Response, request, current_app, g
+
+import requests
+from flask import Response, current_app, g, request
 from flask_mail import Mail
 from flask_principal import Identity, identity_changed
 from flask_restful import Api
-
 from vantage6.algorithm.store import PermissionManager
-from vantage6.algorithm.store.model.rule import Operation
-from vantage6.common import logger_name
-from vantage6.common.enum import AlgorithmViewPolicies, StorePolicies
-from vantage6.algorithm.store.model.vantage6_server import Vantage6Server
-from vantage6.algorithm.store.model.user import User
-from vantage6.backend.common.permission import RuleNeed
-from vantage6.backend.common.services_resources import BaseServicesResources
 from vantage6.algorithm.store.model.common.enums import (
     DefaultStorePolicies,
 )
 from vantage6.algorithm.store.model.policy import Policy
+from vantage6.algorithm.store.model.rule import Operation
+from vantage6.algorithm.store.model.user import User
+from vantage6.algorithm.store.model.vantage6_server import Vantage6Server
+from vantage6.backend.common.permission import RuleNeed
+from vantage6.backend.common.services_resources import BaseServicesResources
+from vantage6.common import logger_name
+from vantage6.common.enum import AlgorithmViewPolicies, StorePolicies
 
 log = logging.getLogger(logger_name(__name__))
 
@@ -124,9 +125,68 @@ def request_validate_server_token(
         return None, None
 
 
-def _authenticate_with_server(*args, **kwargs):
+def request_validate_node_token(
+    server_url: str,
+) -> tuple[Response, int] | tuple[None, None]:
+    """
+    Validate the token of a node.
+
+    Parameters
+    ----------
+    server_url : str
+        URL of the server to validate the token of.
+
+    Returns
+    -------
+    tuple[Response, int] | tuple[None, None]
+        Response object from the request, or None if the server could not be reached
     """
-    Authenticate with a vantage6 server.
+    url = f"{server_url}/token/node/validate"
+    try:
+        return request_from_store_to_v6_server(url, method="post")
+    except requests.exceptions.ConnectionError:
+        return None, None
+
+
+def _is_node_client_request() -> bool:
+    """
+    Check whether the request self-identifies as coming from a node.
+
+    This is only a routing hint - it decides which remote endpoint to validate the
+    token against (see `_authenticate_node_with_server`), not a trust decision by
+    itself. A request that sets this header with e.g. a user's token will simply fail
+    node validation at the server, since the server's node-validate endpoint only
+    accepts node tokens.
+
+    Returns
+    -------
+    bool
+        Whether the request identifies itself as coming from a node.
+    """
+    return request.headers.get("Client-Type") == "node"
+
+
+def _authenticate_entity_with_server(
+    validate_token: Callable[[str], tuple[Response, int] | tuple[None, None]],
+) -> tuple[Response | dict, HTTPStatus]:
+    """
+    Authenticate the caller (a user or a node) with its own vantage6 server.
+
+    Shared by `_authenticate_with_server` and `_authenticate_node_with_server`, which
+    differ only in which server endpoint confirms the token.
+
+    Parameters
+    ----------
+    validate_token : Callable[[str], tuple[Response, int] | tuple[None, None]]
+        Function that asks the server at the given URL whether the caller's token
+        (from the `Authorization` header) is valid - `request_validate_server_token`
+        for users, `request_validate_node_token` for nodes.
+
+    Returns
+    -------
+    tuple[Response | dict, HTTPStatus]
+        The server's response and 200 if the token is valid, or an error message and
+        an appropriate status code otherwise.
     """
     msg = "Missing Server-Url header"
     if not request.headers.get("Server-Url"):
@@ -149,7 +209,7 @@ def _authenticate_with_server(*args, **kwargs):
         return {"msg": msg}, HTTPStatus.FORBIDDEN
 
     # check if token is valid
-    response, status_code = request_validate_server_token(server_url)
+    response, status_code = validate_token(server_url)
     if response is None or status_code == HTTPStatus.NOT_FOUND:
         msg = "Could not connect to the vantage6 server. Please check the server URL."
         log.warning(msg)
@@ -167,6 +227,25 @@ def _authenticate_with_server(*args, **kwargs):
     return response, HTTPStatus.OK
 
 
+def _authenticate_with_server(*args, **kwargs) -> tuple[Response | dict, HTTPStatus]:
+    """
+    Authenticate a user with its own vantage6 server.
+    """
+    return _authenticate_entity_with_server(request_validate_server_token)
+
+
+def _authenticate_node_with_server() -> tuple[Response | dict, HTTPStatus]:
+    """
+    Authenticate a node with its own vantage6 server.
+
+    Unlike `_authenticate_with_server`, a successful result here never looks the node
+    up as a store `User` - nodes are recognized purely by their own server confirming
+    the token is valid, for the small number of endpoints that explicitly opt in to
+    accepting them (see `with_permission_to_view_algorithms`'s `allow_node` option).
+    """
+    return _authenticate_entity_with_server(request_validate_node_token)
+
+
 def _authorize_user(
     auth_response: requests.Response, resource: str, operation: Operation
 ) -> tuple | None:
@@ -295,10 +374,17 @@ def with_permission(resource: str, operation: Operation) -> callable:
     return protection_decorator
 
 
-def with_permission_to_view_algorithms() -> callable:
+def with_permission_to_view_algorithms(allow_node: bool = False) -> callable:
     """
     Decorator to verify that the user has as a permission on a resource.
 
+    Parameters
+    ----------
+    allow_node : bool, optional
+        If True, also allow requests that self-identify as coming from a node (see
+        `_is_node_client_request`) to view approved algorithms, regardless of the
+        store's `algorithm_view` policy.
+
     Returns
     -------
     callable
@@ -309,12 +395,6 @@ def with_permission_to_view_algorithms() -> callable:
     def protection_decorator(fn):
         @wraps(fn)
         def decorator(self, *args, **kwargs):
-            policies = Policy.get_as_dict()
-            # check if everyone has permission to view algorithms
-            algorithm_view_policy = policies.get(
-                StorePolicies.ALGORITHM_VIEW, DefaultStorePolicies.ALGORITHM_VIEW.value
-            )
-
             # check if user is trying to view algorithms that are not approved by review
             # or have been invalidated - these algorithms always require authentication
             # even when algorithms are open to all
@@ -326,6 +406,26 @@ def with_permission_to_view_algorithms() -> callable:
                 or request_args.get("invalidated")
             )
 
+            # a node re-verifying an image against this store's catalog is always
+            # allowed to see approved algorithms, independent of the store's
+            # algorithm_view policy - it is never allowed to see non-approved ones.
+            # Unlike the user path below, a node that identifies itself here but
+            # fails authentication is rejected outright rather than falling through
+            # to the user flow, since a node's token would never pass user
+            # authentication either.
+            if allow_node and request_approved and _is_node_client_request():
+                response, status = _authenticate_node_with_server()
+                if status != HTTPStatus.OK:
+                    return response, status
+                g.node = True
+                return fn(self, *args, **kwargs)
+
+            policies = Policy.get_as_dict()
+            # check if everyone has permission to view algorithms
+            algorithm_view_policy = policies.get(
+                StorePolicies.ALGORITHM_VIEW, DefaultStorePolicies.ALGORITHM_VIEW.value
+            )
+
             # TODO v5+ remove this deprecated policy "algorithms_open"
             anyone_can_view = policies.get("algorithms_open", False)
             if (

{vantage6_algorithm_store-4.15.1 → vantage6_algorithm_store-4.15.2}/vantage6/algorithm/store/resource/algorithm.py

@@ -181,7 +181,7 @@ class AlgorithmBaseResource(AlgorithmStoreResources):
 class Algorithms(AlgorithmBaseResource):
     """Resource for /algorithm"""
 
-    @with_permission_to_view_algorithms()
+    @with_permission_to_view_algorithms(allow_node=True)
     def get(self):
         """List algorithms
         ---
@@ -192,6 +192,12 @@ class Algorithms(AlgorithmBaseResource):
           algorithms, set the 'awaiting_reviewer_assignment', 'under_review' or
           'invalidated' parameter to True.
 
+          Nodes are always allowed to list approved algorithms here (e.g. filtered by
+          'image'), regardless of this store's algorithm_view policy - this lets a node
+          independently verify that an image is a registered, approved algorithm for
+          its own allowed_algorithm_stores policy. Nodes cannot use the non-approved
+          filters above.
+
         parameters:
           - in: query
             name: name
@@ -971,6 +977,12 @@ class Algorithm(AlgorithmBaseResource):
         if not algorithm:
             return {"msg": "Algorithm not found"}, HTTPStatus.NOT_FOUND
 
+        # only the algorithm's own developer may edit it
+        if algorithm.developer_id != g.user.id:
+            return {
+                "msg": "You can only edit algorithms you submitted yourself."
+            }, HTTPStatus.FORBIDDEN
+
         data = request.get_json()
 
         # validate the request body

{vantage6_algorithm_store-4.15.1 → vantage6_algorithm_store-4.15.2}/vantage6_algorithm_store.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vantage6_algorithm_store
-Version: 4.15.1
+Version: 4.15.2
 Summary: Vantage6 algorithm store
 Home-page: https://github.com/vantage6/vantage6
 Requires-Python: >=3.10
@@ -17,8 +17,8 @@ Requires-Dist: requests==2.33.1
 Requires-Dist: schema==0.7.5
 Requires-Dist: SQLAlchemy==1.4.46
 Requires-Dist: werkzeug==3.1.8
-Requires-Dist: vantage6==4.15.1
-Requires-Dist: vantage6-common==4.15.1
+Requires-Dist: vantage6==4.15.2
+Requires-Dist: vantage6-common==4.15.2
 Provides-Extra: dev
 Requires-Dist: coverage==6.4.4; extra == "dev"
 Dynamic: description

{vantage6_algorithm_store-4.15.1 → vantage6_algorithm_store-4.15.2}/vantage6_algorithm_store.egg-info/requires.txt

@@ -10,8 +10,8 @@ requests==2.33.1
 schema==0.7.5
 SQLAlchemy==1.4.46
 werkzeug==3.1.8
-vantage6==4.15.1
-vantage6-common==4.15.1
+vantage6==4.15.2
+vantage6-common==4.15.2
 
 [dev]
 coverage==6.4.4