fix User.get_teams()

Author: apdavison

validation_service_api/validation_service/auth.py

@@ -1,3 +1,4 @@
+import asyncio
 import base64
 import requests
 import logging
@@ -88,15 +89,16 @@ def __init__(self, token, allow_anonymous=False):
         self._teams = None
         self._collab_info = {}
         self._connection_error = False
+        self.username = None
 
     @property
     def is_anonymous(self):
         return self.token is None or self.token.credentials == "undefined"
 
-    async def get_identity(self):
+    def get_identity(self):
         if self._identity is None:
             payload = _decode_jwt_payload(self.token.credentials)
-            username = payload.get("preferred_username", "unknown")
+            username = payload.get("preferred_username", None)
             self._identity = {
                 "sub": payload["sub"],
                 "id": payload["sub"],
@@ -105,19 +107,45 @@ async def get_identity(self):
                 "given_name": payload.get("given_name", ""),
                 "family_name": payload.get("family_name", ""),
             }
+            self.username = username
         return self._identity
 
     async def get_teams(self):
         if self._teams is None:
-            identity = await self.get_identity()
+            identity = self.get_identity()
             url = f"{settings.EBRAINS_IDM_API_URL}/teams"
             headers = {"Authorization": f"Bearer {self.token.credentials}"}
             params = {"username": identity["username"]}
             async with AsyncClient() as client:
                 res = await client.get(url, headers=headers, params=params,
                                        timeout=settings.AUTHENTICATION_TIMEOUT)
             res.raise_for_status()
-            self._teams = [t["name"] for t in res.json() if isinstance(t, dict) and "name" in t]
+            self._teams = []
+            collab_names = set(
+                item["name"] for item in res.json()
+                if not (
+                    item["name"].startswith("d-")  # ignore dataset collabs
+                    or item["name"].startswith("nmc-test")  # ignore NMC test collabs
+                )
+            )
+            for role in ("administrator", "editor"):
+                for collab_name in collab_names.copy():
+                    roles_url = f"{settings.EBRAINS_IDM_API_URL}/teams/{collab_name}/{role}/users"
+                    # todo: get groups as well and check for group membership
+                    async with AsyncClient() as client:
+                        res2 = await client.get(roles_url, headers=headers,
+                                                timeout=settings.AUTHENTICATION_TIMEOUT)
+                        res2.raise_for_status()  # do we want to raise an exception, or just log an error?
+                                                 # for robustness, perhaps just log
+                        for user in res2.json():
+                            if self.username == user["username"]:
+                                self._teams.append(f"collab-{collab_name}-{role}")
+                                collab_names.discard(collab_name)
+                                print(collab_name)
+                                break
+            # we assume user must have viewer permissions for any collab still in collab_names
+            for collab_name in collab_names:
+                self._teams.append(f"collab-{collab_name}-viewer")
         return self._teams
 
     async def get_collab_info(self, collab_id):
@@ -134,8 +162,8 @@ async def get_collab_info(self, collab_id):
                 self._collab_info[collab_id] = {}
         return self._collab_info[collab_id]
 
-    async def get_person(self, kg_client):
-        identity = await self.get_identity()
+    def get_person(self, kg_client):
+        identity = self.get_identity()
         family_name = identity["family_name"]
         given_name = identity["given_name"]
         person = omcore.Person.list(kg_client, family_name=family_name, given_name=given_name, release_status="any")
@@ -195,12 +223,3 @@ async def can_edit_collab(self, collab_id):
     async def is_admin(self):
         return await self.can_edit_collab(settings.ADMIN_COLLAB_ID)
         # todo: replace this check with a group membership check
-
-    async def get_editable_collabs(self):
-        teams = await self.get_teams()
-        editable_collab_ids = set()
-        for team_name in teams:
-            if team_name.endswith("-editor") or team_name.endswith("-administrator"):
-                collab_id = "-".join(team_name.split("-")[1:-1])
-                editable_collab_ids.add(collab_id)
-        return sorted(editable_collab_ids)

validation_service_api/validation_service/resources/auth.py

@@ -96,7 +96,7 @@ async def get_person(
 ):
     kg_user_client = get_kg_client_for_user_account(token)
     user = User(token, allow_anonymous=False)
-    kg_person = await user.get_person(kg_user_client)
+    kg_person = user.get_person(kg_user_client)
     if kg_person:
         return Person.from_kg_object(kg_person, kg_user_client)
     else:

validation_service_api/validation_service/resources/comments.py

@@ -78,7 +78,7 @@ async def create_comment(
 ):
     kg_user_client = get_kg_client_for_user_account(token)
     user = User(token, allow_anonymous=False)
-    commenter = await user.get_person(kg_user_client)
+    commenter = user.get_person(kg_user_client)
     if commenter is None:
         raise HTTPException(
             status_code=status_codes.HTTP_404_NOT_FOUND,

validation_service_api/validation_service/resources/models.py

@@ -53,7 +53,7 @@ async def api_status(token: HTTPAuthorizationCredentials = Depends(auth)):
         }
     }
     if token:
-        identity = await User(token).get_identity()
+        identity = User(token).get_identity()
         info["user"] = identity["preferred_username"]
     service_status = getattr(settings, "SERVICE_STATUS", "ok")
     return info

validation_service_api/validation_service/resources/tests.py

@@ -263,7 +263,7 @@ async def create_test(test: ValidationTest, token: HTTPAuthorizationCredentials
     try:
         test_definition.save(kg_user_client, recursive=True, space=kg_space, ignore_duplicates=True)
     except AuthenticationError as err:
-        identity = await user.get_identity()
+        identity = user.get_identity()
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
             detail=f"User {identity['username']} cannot access space {kg_space}. Error message: {err}"