auth: data migration: Data migration outline

Provide an outline of the data migration steps to be taken from some results
of the experiments with the data in redis.

1 files changed, 48 insertions, 1 deletions

diff --git a/gn3/auth/authorisation/data/views.py b/gn3/auth/authorisation/data/views.py
index 08032db..89898c6 100644
--- a/gn3/auth/authorisation/data/views.py
+++ b/gn3/auth/authorisation/data/views.py
@@ -2,17 +2,21 @@
 import uuid
 import json
 
+from email_validator import validate_email, EmailNotValidError
 from authlib.integrations.flask_oauth2.errors import _HTTPException
 from flask import request, jsonify, Response, Blueprint, current_app as app
 
 from gn3.db.traits import build_trait_name
 
 from gn3.auth import db
-from gn3.auth.authentication.oauth2.resource_server import require_oauth
+from gn3.auth.authorisation.users.views import validate_password
 from gn3.auth.authorisation.resources.checks import authorised_for
+from gn3.auth.authorisation.errors import ForbiddenAccess, AuthorisationError
 from gn3.auth.authorisation.resources.models import (
     user_resources, public_resources, attach_resources_data)
 
+from gn3.auth.authentication.oauth2.resource_server import require_oauth
+
 data = Blueprint("data", __name__)
 
 @data.route("/authorisation", methods=["GET"])
@@ -83,3 +87,46 @@ def authorisation() -> Response:
             } for trait in
             (build_trait_name(trait_fullname)
              for trait_fullname in traits_names)))
+
+@data.route("/user/migrate", methods=["POST"])
+@require_oauth("migrate-data")
+def migrate_user_data():
+    """
+    Special, protected endpoint to enable the migration of data from the older
+    system to the newer system with groups, resources and privileges.
+
+    This is a temporary endpoint and should be removed after all the data has
+    been migrated.
+    """
+    authorised_clients = app.config.get(
+        "OAUTH2_CLIENTS_WITH_DATA_MIGRATION_PRIVILEGE", [])
+    with require_oauth.acquire("migrate-data") as the_token:
+        if the_token.client.client_id in authorised_clients:
+            try:
+                _user_id = uuid.UUID(request.form.get("user_id", ""))
+                _email = validate_email(request.form.get("email", ""))
+                _password = validate_password(
+                    request.form.get("password", ""),
+                    request.form.get("confirm_password", ""))
+                ## TODO: Save the user: possible exception for duplicate emails
+                ##       Create group from user's name
+                ##       Filter all resources from redis owned by this user
+                ##         resources = {key: json.loads(val)
+                ##                      for key,val
+                ##                      in rconn.hgetall("resources").items()}
+                ##         filtered = dict((
+                ##             (key,val) for key,val
+                ##             in resources.items()
+                ##             if uuid.UUID(val.get("owner_id")) == user_id))
+                ##       Check that no resource is owned by existing user, use
+                ##         'name' and 'type' fields to check in
+                ##         `linked_group_data` table
+                ##       Link remaining data to the new group
+                ##       Delete user from redis
+                return "WOULD TRIGGER DATA MIGRATION ..."
+            except EmailNotValidError as enve:
+                raise AuthorisationError(f"Email Error: {str(enve)}") from enve
+            except ValueError as verr:
+                raise AuthorisationError(verr.args[0]) from verr
+
+        raise ForbiddenAccess("You cannot access this endpoint.")