Skip to content

Commit bdb6223

Browse files
committed
global: add roles info in /me endpoint
Signed-off-by: Parth Shandilya <parth.shandilya@cern.ch>
1 parent fc6e9fa commit bdb6223

File tree

4 files changed

+60
-9
lines changed

4 files changed

+60
-9
lines changed

cap/modules/schemas/imp.py

Lines changed: 37 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,12 +25,13 @@
2525
from itertools import groupby
2626

2727
from invenio_access.models import ActionRoles, ActionUsers
28-
from invenio_access.permissions import Permission
28+
from invenio_access.permissions import Permission, superuser_access
2929
from invenio_cache import current_cache
3030
from sqlalchemy.event import listen
3131

3232
from .models import Schema
3333
from .permissions import (
34+
AdminSchemaPermission,
3435
ReadSchemaPermission,
3536
deposit_schema_create_action,
3637
deposit_schema_read_action,
@@ -153,6 +154,41 @@ def _filter_by_read_access(schemas_list):
153154
return [x for x in schemas_list if ReadSchemaPermission(x).can()]
154155

155156

157+
def _filter_by_admin_access(schemas_list):
158+
"""Return only schemas that user has admin access to."""
159+
return [x for x in schemas_list if AdminSchemaPermission(x).can()]
160+
161+
162+
def is_super_user():
163+
return Permission(superuser_access).can()
164+
165+
166+
def get_admin_roles_for_user(latest=True):
167+
"""Return list of roles in schemas, current user has admin/superuser access to."""
168+
roles = []
169+
schemas = get_indexed_schemas(latest=latest)
170+
schemas = _filter_by_admin_access(schemas)
171+
if latest:
172+
schemas = _filter_only_latest(schemas)
173+
174+
for schema in schemas:
175+
roles.append(f"{schema.name}")
176+
177+
return roles
178+
179+
180+
def generate_roles(mapping):
181+
roles = []
182+
for method_name, method in mapping.items():
183+
result = method()
184+
if isinstance(result, bool) and result:
185+
roles.append(method_name)
186+
elif isinstance(result, list):
187+
for role in result:
188+
roles.append(f"{method_name}:{role}")
189+
return roles
190+
191+
156192
def get_schemas_for_user(latest=True):
157193
"""Return all schemas current user has read access to."""
158194
schemas = Schema.query.order_by(

cap/modules/schemas/permissions.py

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -113,15 +113,15 @@ def __init__(self, schema):
113113

114114

115115
class AdminSchemaPermission(Permission):
116-
"""Schema read permission."""
116+
"""Schema admin permission."""
117117

118118
def __init__(self, schema):
119119
"""Initialize state.
120120
121-
Read access for:
121+
Admin access for:
122122
123123
* all members of experiment assigned to schema
124-
* all users/roles assigned to schema-object-read action
124+
* all users/roles assigned to schema-object-admin action
125125
126126
"""
127127
_needs = set()

cap/modules/user/views.py

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,14 +36,25 @@
3636

3737
from cap.config import DEBUG
3838
from cap.modules.access.utils import login_required
39-
from cap.modules.schemas.imp import get_cached_indexed_schemas_for_user_create
39+
from cap.modules.schemas.imp import (
40+
get_admin_roles_for_user,
41+
get_cached_indexed_schemas_for_user_create,
42+
generate_roles,
43+
is_super_user,
44+
)
4045
from cap.modules.user.utils import get_remote_account_by_id
4146

4247
_datastore = LocalProxy(lambda: current_app.extensions['security'].datastore)
4348

4449
user_blueprint = Blueprint('cap_user', __name__, template_folder='templates')
4550

4651

52+
USER_UI_ROLES = {
53+
'superuser': is_super_user,
54+
'schema-admin': get_admin_roles_for_user,
55+
}
56+
57+
4758
@user_blueprint.route('/me')
4859
@login_required
4960
def get_user():
@@ -62,6 +73,7 @@ def get_user():
6273
"email": current_user.email,
6374
"deposit_groups": deposit_groups,
6475
"profile": extra_data,
76+
"roles": generate_roles(USER_UI_ROLES),
6577
}
6678

6779
response = jsonify(_user)

tests/integration/test_user_api.py

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,8 @@ def test_me_when_superuser_returns_correct_user_data(
5454
}],
5555
"email": superuser.email,
5656
"id": superuser.id,
57-
"profile": {}
57+
"profile": {},
58+
'roles': ['superuser', 'schema-admin:cms', 'schema-admin:lhcb']
5859
}
5960

6061

@@ -83,7 +84,8 @@ def test_me_when_cms_user_returns_correct_user_data(client, create_schema,
8384
}],
8485
"email": user.email,
8586
"id": user.id,
86-
"profile": {}
87+
"profile": {},
88+
'roles': [],
8789
}
8890

8991
lhcb_schema.process_action_roles('allow',
@@ -104,5 +106,6 @@ def test_me_when_cms_user_returns_correct_user_data(client, create_schema,
104106
}],
105107
"email": user.email,
106108
"id": user.id,
107-
"profile": {}
108-
}
109+
"profile": {},
110+
'roles': [],
111+
}

0 commit comments

Comments
 (0)