zenml-nightly 0.55.0.dev20240124__py3-none-any.whl → 0.72.0.dev20250116__py3-none-any.whl

zenml/zen_server/routers/users_endpoints.py

@@ -17,6 +17,7 @@ from typing import List, Optional, Union
 from uuid import UUID
 
 from fastapi import APIRouter, Depends, Security
+from starlette.requests import Request
 
 from zenml.analytics.utils import email_opt_int
 from zenml.constants import (
@@ -32,6 +33,7 @@ from zenml.exceptions import AuthorizationException, IllegalOperationError
 from zenml.logger import get_logger
 from zenml.models import (
     Page,
+    UserAuthModel,
     UserFilter,
     UserRequest,
     UserResponse,
@@ -43,23 +45,20 @@ from zenml.zen_server.auth import (
     authorize,
 )
 from zenml.zen_server.exceptions import error_response
-from zenml.zen_server.rbac.endpoint_utils import (
-    verify_permissions_and_create_entity,
-)
+from zenml.zen_server.rate_limit import RequestLimiter
 from zenml.zen_server.rbac.models import Action, Resource, ResourceType
 from zenml.zen_server.rbac.utils import (
     dehydrate_page,
     dehydrate_response_model,
-    get_allowed_resource_ids,
     get_schema_for_resource_type,
     update_resource_membership,
-    verify_permission,
     verify_permission_for_model,
 )
 from zenml.zen_server.utils import (
     handle_exceptions,
     make_dependable,
     server_config,
+    verify_admin_status_if_no_rbac,
     zen_store,
 )
 
@@ -109,14 +108,18 @@ def list_users(
     Returns:
         A list of all users.
     """
-    allowed_ids = get_allowed_resource_ids(resource_type=ResourceType.USER)
-    if allowed_ids is not None:
-        # Make sure users can see themselves
-        allowed_ids.add(auth_context.user.id)
-
-    user_filter_model.configure_rbac(
-        authenticated_user_id=auth_context.user.id, id=allowed_ids
-    )
+    # allowed_ids = get_allowed_resource_ids(resource_type=ResourceType.USER)
+    # if allowed_ids is not None:
+    #     # Make sure users can see themselves
+    #     allowed_ids.add(auth_context.user.id)
+    # else:
+    #     if not auth_context.user.is_admin and not server_config().rbac_enabled:
+    #         allowed_ids = {auth_context.user.id}
+    if not auth_context.user.is_admin and not server_config().rbac_enabled:
+        user_filter_model.configure_rbac(
+            authenticated_user_id=auth_context.user.id,
+            id={auth_context.user.id},
+        )
 
     page = zen_store().list_users(
         user_filter_model=user_filter_model, hydrate=hydrate
@@ -140,7 +143,7 @@ if server_config().auth_scheme != AuthScheme.EXTERNAL:
     @handle_exceptions
     def create_user(
         user: UserRequest,
-        _: AuthContext = Security(authorize),
+        auth_context: AuthContext = Security(authorize),
     ) -> UserResponse:
         """Creates a user.
 
@@ -148,6 +151,7 @@ if server_config().auth_scheme != AuthScheme.EXTERNAL:
 
         Args:
             user: User to create.
+            auth_context: Authentication context.
 
         Returns:
             The created user.
@@ -164,12 +168,17 @@ if server_config().auth_scheme != AuthScheme.EXTERNAL:
         else:
             user.active = True
 
-        new_user = verify_permissions_and_create_entity(
-            request_model=user,
-            resource_type=ResourceType.USER,
-            create_method=zen_store().create_user,
+        verify_admin_status_if_no_rbac(
+            auth_context.user.is_admin, "create user"
         )
 
+        # new_user = verify_permissions_and_create_entity(
+        #     request_model=user,
+        #     resource_type=ResourceType.USER,
+        #     create_method=zen_store().create_user,
+        # )
+        new_user = zen_store().create_user(user)
+
         # add back the original unhashed activation token, if generated, to
         # send it back to the client
         if token:
@@ -203,7 +212,13 @@ def get_user(
         user_name_or_id=user_name_or_id, hydrate=hydrate
     )
     if user.id != auth_context.user.id:
-        verify_permission_for_model(user, action=Action.READ)
+        verify_admin_status_if_no_rbac(
+            auth_context.user.is_admin, "get other user"
+        )
+        # verify_permission_for_model(
+        #     user,
+        #     action=Action.READ,
+        # )
 
     return dehydrate_response_model(user)
 
@@ -211,6 +226,10 @@ def get_user(
 # When the auth scheme is set to EXTERNAL, users cannot be updated via the
 # API.
 if server_config().auth_scheme != AuthScheme.EXTERNAL:
+    pass_change_limiter = RequestLimiter(
+        day_limit=server_config().login_rate_limit_day,
+        minute_limit=server_config().login_rate_limit_minute,
+    )
 
     @router.put(
         "/{user_name_or_id}",
@@ -225,6 +244,7 @@ if server_config().auth_scheme != AuthScheme.EXTERNAL:
     def update_user(
         user_name_or_id: Union[str, UUID],
         user_update: UserUpdate,
+        request: Request,
         auth_context: AuthContext = Security(authorize),
     ) -> UserResponse:
         """Updates a specific user.
@@ -232,18 +252,152 @@ if server_config().auth_scheme != AuthScheme.EXTERNAL:
         Args:
             user_name_or_id: Name or ID of the user.
             user_update: the user to use for the update.
+            request: The request object.
             auth_context: Authentication context.
 
         Returns:
             The updated user.
+
+        Raises:
+            IllegalOperationError: if the user tries change admin status,
+                while not an admin, if the user tries to change the password
+                of another user, or if the user tries to change their own
+                password without providing the old password or providing
+                an incorrect old password.
         """
         user = zen_store().get_user(user_name_or_id)
+
+        # Use a separate object to compute the update that will be applied to
+        # the user to avoid giving the API requester direct control over the
+        # user attributes that are updated.
+        #
+        # Exclude attributes that cannot be updated through this endpoint:
+        #
+        # - activation_token
+        # - external_user_id
+        # - old_password
+        #
+        # Exclude things that are not always safe to update and need to be
+        # validated first:
+        #
+        # - admin
+        # - active
+        # - password
+        # - email_opted_in + email
+        #
+        safe_user_update = user_update.create_copy(
+            exclude={
+                "activation_token",
+                "external_user_id",
+                "is_admin",
+                "active",
+                "password",
+                "old_password",
+                "email_opted_in",
+                "email",
+            },
+        )
+
         if user.id != auth_context.user.id:
-            verify_permission_for_model(user, action=Action.UPDATE)
+            verify_admin_status_if_no_rbac(
+                auth_context.user.is_admin, "update other user account"
+            )
+            # verify_permission_for_model(
+            #     user,
+            #     action=Action.UPDATE,
+            # )
+
+        # Validate a password change
+        if user_update.password is not None:
+            if user.id != auth_context.user.id:
+                raise IllegalOperationError(
+                    "Users cannot change the password of other users. Use the "
+                    "account deactivation and activation flow instead."
+                )
+
+            # If the user is updating their own password, we need to verify
+            # the old password
+            if user_update.old_password is None:
+                raise IllegalOperationError(
+                    "The current password must be supplied when changing the "
+                    "password."
+                )
+
+            with pass_change_limiter.limit_failed_requests(request):
+                auth_user = zen_store().get_auth_user(user_name_or_id)
+                if not UserAuthModel.verify_password(
+                    user_update.old_password, auth_user
+                ):
+                    raise IllegalOperationError(
+                        "The current password is incorrect."
+                    )
+
+            # Accept the password update
+            safe_user_update.password = user_update.password
+
+        # Validate an admin status change
+        if (
+            user_update.is_admin is not None
+            and user.is_admin != user_update.is_admin
+        ):
+            if user.id == auth_context.user.id:
+                raise IllegalOperationError(
+                    "Cannot change the admin status of your own user account."
+                )
+
+            if (
+                user.id != auth_context.user.id
+                and not auth_context.user.is_admin
+            ):
+                raise IllegalOperationError(
+                    "Only admins are allowed to change the admin status of "
+                    "other user accounts."
+                )
+
+            # Accept the admin status update
+            safe_user_update.is_admin = user_update.is_admin
+
+        # Validate an active status change
+        if (
+            user_update.active is not None
+            and user.active != user_update.active
+        ):
+            if user.id == auth_context.user.id:
+                raise IllegalOperationError(
+                    "Cannot change the active status of your own user account."
+                )
+
+            if (
+                user.id != auth_context.user.id
+                and not auth_context.user.is_admin
+            ):
+                raise IllegalOperationError(
+                    "Only admins are allowed to change the active status of "
+                    "other user accounts."
+                )
+
+            # Accept the admin status update
+            safe_user_update.is_admin = user_update.is_admin
+
+        # Validate changes to private user account information
+        if (
+            user_update.email_opted_in is not None
+            or user_update.email is not None
+        ):
+            if user.id != auth_context.user.id:
+                raise IllegalOperationError(
+                    "Cannot change the private user account information for "
+                    "another user account."
+                )
+
+            # Accept the private user account information update
+            if safe_user_update.email_opted_in is not None:
+                safe_user_update.email_opted_in = user_update.email_opted_in
+                safe_user_update.email = user_update.email
 
         updated_user = zen_store().update_user(
             user_id=user.id,
-            user_update=user_update,
+            user_update=safe_user_update,
         )
         return dehydrate_response_model(updated_user)
 
@@ -272,16 +426,40 @@ if server_config().auth_scheme != AuthScheme.EXTERNAL:
         """
         user = zen_store().get_user(user_name_or_id)
 
+        # Use a separate object to compute the update that will be applied to
+        # the user to avoid giving the API requester direct control over the
+        # user attributes that are updated.
+        #
+        # Exclude attributes that cannot be updated through this endpoint:
+        #
+        # - activation_token
+        # - external_user_id
+        # - is_admin
+        # - active
+        # - old_password
+        #
+        safe_user_update = user_update.create_copy(
+            exclude={
+                "activation_token",
+                "external_user_id",
+                "is_admin",
+                "active",
+                "old_password",
+            },
+        )
+
         # NOTE: if the activation token is not set, this will raise an
         # exception
         authenticate_credentials(
             user_name_or_id=user_name_or_id,
             activation_token=user_update.activation_token,
         )
-        user_update.active = True
-        user_update.activation_token = None
+
+        # Activate the user: set active to True and clear the activation token
+        safe_user_update.active = True
+        safe_user_update.activation_token = None
         return zen_store().update_user(
-            user_id=user.id, user_update=user_update
+            user_id=user.id, user_update=safe_user_update
         )
 
     @router.put(
@@ -306,13 +484,23 @@ if server_config().auth_scheme != AuthScheme.EXTERNAL:
 
         Returns:
             The generated activation token.
+
+        Raises:
+            IllegalOperationError: if the user is trying to deactivate
+                themselves.
         """
         user = zen_store().get_user(user_name_or_id)
-        if user.id != auth_context.user.id:
-            verify_permission_for_model(user, action=Action.UPDATE)
+        if user.id == auth_context.user.id:
+            raise IllegalOperationError("Cannot deactivate yourself.")
+        verify_admin_status_if_no_rbac(
+            auth_context.user.is_admin, "deactivate user"
+        )
+        # verify_permission_for_model(
+        #     user,
+        #     action=Action.UPDATE,
+        # )
 
         user_update = UserUpdate(
-            name=user.name,
             active=False,
         )
         token = user_update.generate_activation_token()
@@ -355,7 +543,13 @@ if server_config().auth_scheme != AuthScheme.EXTERNAL:
                 "administrator."
             )
         else:
-            verify_permission_for_model(user, action=Action.DELETE)
+            verify_admin_status_if_no_rbac(
+                auth_context.user.is_admin, "delete user"
+            )
+            # verify_permission_for_model(
+            #     user,
+            #     action=Action.DELETE,
+            # )
 
         zen_store().delete_user(user_name_or_id=user_name_or_id)
 
@@ -392,7 +586,6 @@ if server_config().auth_scheme != AuthScheme.EXTERNAL:
 
         if str(auth_context.user.id) == str(user_name_or_id):
             user_update = UserUpdate(
-                name=user.name,
                 email=user_response.email,
                 email_opted_in=user_response.email_opted_in,
             )
@@ -403,7 +596,6 @@ if server_config().auth_scheme != AuthScheme.EXTERNAL:
                     email=user_response.email,
                     source="zenml server",
                 )
-
             updated_user = zen_store().update_user(
                 user_id=user.id, user_update=user_update
             )
@@ -450,19 +642,68 @@ if server_config().auth_scheme != AuthScheme.EXTERNAL:
     @handle_exceptions
     def update_myself(
         user: UserUpdate,
+        request: Request,
         auth_context: AuthContext = Security(authorize),
     ) -> UserResponse:
         """Updates a specific user.
 
         Args:
             user: the user to use for the update.
+            request: The request object.
             auth_context: The authentication context.
 
         Returns:
             The updated user.
+
+        Raises:
+            IllegalOperationError: if the current password is not supplied when
+                changing the password or if the current password is incorrect.
         """
+        # Use a separate object to compute the update that will be applied to
+        # the user to avoid giving the API requester direct control over the
+        # user attributes that are updated.
+        #
+        # Exclude attributes that cannot be updated through this endpoint:
+        #
+        # - activation_token
+        # - external_user_id
+        # - admin
+        # - is_active
+        # - old_password
+        #
+        safe_user_update = user.create_copy(
+            exclude={
+                "activation_token",
+                "external_user_id",
+                "is_admin",
+                "active",
+                "old_password",
+            },
+        )
+
+        # Validate a password change
+        if user.password is not None:
+            # If the user is updating their password, we need to verify
+            # the old password
+            if user.old_password is None:
+                raise IllegalOperationError(
+                    "The current password must be supplied when changing the "
+                    "password."
+                )
+            with pass_change_limiter.limit_failed_requests(request):
+                auth_user = zen_store().get_auth_user(auth_context.user.id)
+                if not UserAuthModel.verify_password(
+                    user.old_password, auth_user
+                ):
+                    raise IllegalOperationError(
+                        "The current password is incorrect."
+                    )
+
+            # Accept the password update
+            safe_user_update.password = user.password
+
         updated_user = zen_store().update_user(
-            user_id=auth_context.user.id, user_update=user
+            user_id=auth_context.user.id, user_update=safe_user_update
         )
         return dehydrate_response_model(updated_user)
 
@@ -503,7 +744,7 @@ if server_config().rbac_enabled:
             KeyError: If no resource with the given type and ID exists.
         """
         user = zen_store().get_user(user_name_or_id)
-        verify_permission_for_model(user, action=Action.READ)
+        # verify_permission_for_model(user, action=Action.READ)
 
         if user.id == auth_context.user.id:
             raise ValueError(
@@ -514,27 +755,21 @@ if server_config().rbac_enabled:
         resource = Resource(type=resource_type, id=resource_id)
 
         schema_class = get_schema_for_resource_type(resource_type)
-        if not zen_store().object_exists(
-            object_id=resource_id, schema_class=schema_class
-        ):
+        model = zen_store().get_entity_by_id(
+            entity_id=resource_id, schema_class=schema_class
+        )
+
+        if not model:
             raise KeyError(
                 f"Resource of type {resource_type} with ID {resource_id} does "
                 "not exist."
             )
 
-        verify_permission(
-            resource_type=resource_type,
-            action=Action.SHARE,
-            resource_id=resource_id,
-        )
+        verify_permission_for_model(model=model, action=Action.SHARE)
         for action in actions:
             # Make sure users aren't able to share permissions they don't have
             # themselves
-            verify_permission(
-                resource_type=resource_type,
-                action=Action(action),
-                resource_id=resource_id,
-            )
+            verify_permission_for_model(model=model, action=Action(action))
 
         update_resource_membership(
             user=user,

zenml/zen_server/routers/webhook_endpoints.py

@@ -0,0 +1,127 @@
+#  Copyright (c) ZenML GmbH 2022. All Rights Reserved.
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at:
+#
+#       https://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+#  or implied. See the License for the specific language governing
+#  permissions and limitations under the License.
+"""Endpoint definitions for webhooks."""
+
+from typing import Dict
+from uuid import UUID
+
+from fastapi import APIRouter, BackgroundTasks, Depends, Request
+
+from zenml.constants import API, VERSION_1, WEBHOOKS
+from zenml.enums import PluginSubType, PluginType
+from zenml.event_sources.webhooks.base_webhook_event_source import (
+    BaseWebhookEventSourceHandler,
+)
+from zenml.exceptions import AuthorizationException, WebhookInactiveError
+from zenml.logger import get_logger
+from zenml.zen_server.utils import (
+    handle_exceptions,
+    plugin_flavor_registry,
+    zen_store,
+)
+
+logger = get_logger(__name__)
+
+router = APIRouter(
+    prefix=API + VERSION_1 + WEBHOOKS,
+    tags=["webhook"],
+)
+
+
+async def get_body(request: Request) -> bytes:
+    """Get access to the raw body.
+
+    Args:
+        request: The request
+
+    Returns:
+        The raw request body.
+    """
+    return await request.body()
+
+
+@router.post(
+    "/{event_source_id}",
+    response_model=Dict[str, str],
+)
+@handle_exceptions
+def webhook(
+    event_source_id: UUID,
+    request: Request,
+    background_tasks: BackgroundTasks,
+    raw_body: bytes = Depends(get_body),
+) -> Dict[str, str]:
+    """Webhook to receive events from external event sources.
+
+    Args:
+        event_source_id: The event_source_id
+        request: The request object
+        background_tasks: Background task handler
+        raw_body: The raw request body
+
+    Returns:
+        Static dict stating that event is received.
+
+    Raises:
+        AuthorizationException: If the Event Source does not exist.
+        KeyError: If no appropriate Plugin found in the plugin registry
+        ValueError: If the id of the Event Source is not actually a webhook event source
+        WebhookInactiveError: In case this webhook has been deactivated
+    """
+    # Get the Event Source
+    try:
+        event_source = zen_store().get_event_source(event_source_id)
+    except KeyError:
+        logger.error(
+            f"Webhook HTTP request received for unknown event source "
+            f"'{event_source_id}'."
+        )
+        raise AuthorizationException(  # TODO: Are we sure about this error message?
+            f"No webhook is registered at '{router.prefix}/{event_source_id}'"
+        )
+    if not event_source.is_active:
+        raise WebhookInactiveError(f"Webhook {event_source_id} is inactive.")
+
+    flavor = event_source.flavor
+    try:
+        plugin = plugin_flavor_registry().get_plugin(
+            name=flavor,
+            _type=PluginType.EVENT_SOURCE,
+            subtype=PluginSubType.WEBHOOK,
+        )
+    except KeyError:
+        logger.error(
+            f"Webhook HTTP request received for event source "
+            f"'{event_source_id}' and flavor {flavor} but no matching "
+            f"plugin was found."
+        )
+        raise KeyError(
+            f"No listener plugin found for event source {event_source_id}."
+        )
+
+    if not isinstance(plugin, BaseWebhookEventSourceHandler):
+        raise ValueError(
+            f"Event Source {event_source_id} is not a valid Webhook event "
+            "source!"
+        )
+
+    # Pass the raw event and headers to the plugin
+    background_tasks.add_task(
+        plugin.process_webhook_event,
+        event_source=event_source,
+        raw_body=raw_body,
+        headers=dict(request.headers.items()),
+    )
+
+    return {"status": "Event Received."}