aboutsummaryrefslogtreecommitdiff
path: root/gn3/auth/authorisation/resources/models.py
blob: 4049faedf0856bbba417ce36a086ac81a8ef9519 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
"""Handle the management of resources."""
import json
import sqlite3
from uuid import UUID, uuid4
from functools import reduce, partial
from typing import Any, Dict, Sequence, NamedTuple

from gn3.auth import db
from gn3.auth.dictify import dictify
from gn3.auth.authentication.users import User
from gn3.auth.db_utils import with_db_connection

from .checks import authorised_for

from ..checks import authorised_p
from ..errors import NotFoundError, AuthorisationError
from ..groups.models import (
    Group, GroupRole, user_group, group_by_id, is_group_leader)

class MissingGroupError(AuthorisationError):
    """Raised for any resource operation without a group."""

class ResourceCategory(NamedTuple):
    """Class representing a resource category."""
    resource_category_id: UUID
    resource_category_key: str
    resource_category_description: str

    def dictify(self) -> dict[str, Any]:
        """Return a dict representation of `ResourceCategory` objects."""
        return {
            "resource_category_id": self.resource_category_id,
            "resource_category_key": self.resource_category_key,
            "resource_category_description": self.resource_category_description
        }

class Resource(NamedTuple):
    """Class representing a resource."""
    group: Group
    resource_id: UUID
    resource_name: str
    resource_category: ResourceCategory
    public: bool
    resource_data: Sequence[dict[str, Any]] = tuple()

    def dictify(self) -> dict[str, Any]:
        """Return a dict representation of `Resource` objects."""
        return {
            "group": dictify(self.group), "resource_id": self.resource_id,
            "resource_name": self.resource_name,
            "resource_category": dictify(self.resource_category),
            "public": self.public,
            "resource_data": self.resource_data
        }

def __assign_resource_owner_role__(cursor, resource, user):
    """Assign `user` the 'Resource Owner' role for `resource`."""
    cursor.execute(
        "SELECT gr.* FROM group_roles AS gr INNER JOIN roles AS r "
        "ON gr.role_id=r.role_id WHERE r.role_name='resource-owner'")
    role = cursor.fetchone()
    if not role:
        cursor.execute("SELECT * FROM roles WHERE role_name='resource-owner'")
        role = cursor.fetchone()
        cursor.execute(
            "INSERT INTO group_roles VALUES "
            "(:group_role_id, :group_id, :role_id)",
            {"group_role_id": str(uuid4()),
             "group_id": str(resource.group.group_id),
             "role_id": role["role_id"]})

    cursor.execute(
            "INSERT INTO group_user_roles_on_resources "
            "VALUES ("
            ":group_id, :user_id, :role_id, :resource_id"
            ")",
            {"group_id": str(resource.group.group_id),
             "user_id": str(user.user_id),
             "role_id": role["role_id"],
             "resource_id": str(resource.resource_id)})

@authorised_p(("group:resource:create-resource",),
              error_description="Insufficient privileges to create a resource",
              oauth2_scope="profile resource")
def create_resource(
        conn: db.DbConnection, resource_name: str,
        resource_category: ResourceCategory, user: User) -> Resource:
    """Create a resource item."""
    with db.cursor(conn) as cursor:
        group = user_group(conn, user).maybe(
            False, lambda grp: grp)# type: ignore[misc, arg-type]
        if not group:
            raise MissingGroupError(
                "User with no group cannot create a resource.")
        resource = Resource(group, uuid4(), resource_name, resource_category, False)
        cursor.execute(
            "INSERT INTO resources VALUES (?, ?, ?, ?, ?)",
            (str(resource.group.group_id), str(resource.resource_id),
             resource_name,
             str(resource.resource_category.resource_category_id),
             1 if resource.public else 0))
        __assign_resource_owner_role__(cursor, resource, user)

    return resource

def resource_category_by_id(
        conn: db.DbConnection, category_id: UUID) -> ResourceCategory:
    """Retrieve a resource category by its ID."""
    with db.cursor(conn) as cursor:
        cursor.execute(
            "SELECT * FROM resource_categories WHERE "
            "resource_category_id=?",
            (str(category_id),))
        results = cursor.fetchone()
        if results:
            return ResourceCategory(
                UUID(results["resource_category_id"]),
                results["resource_category_key"],
                results["resource_category_description"])

    raise NotFoundError(
        f"Could not find a ResourceCategory with ID '{category_id}'")

def resource_categories(conn: db.DbConnection) -> Sequence[ResourceCategory]:
    """Retrieve all available resource categories"""
    with db.cursor(conn) as cursor:
        cursor.execute("SELECT * FROM resource_categories")
        return tuple(
            ResourceCategory(UUID(row[0]), row[1], row[2])
            for row in cursor.fetchall())
    return tuple()

def public_resources(conn: db.DbConnection) -> Sequence[Resource]:
    """List all resources marked as public"""
    categories = {
        str(cat.resource_category_id): cat for cat in resource_categories(conn)
    }
    with db.cursor(conn) as cursor:
        cursor.execute("SELECT * FROM resources WHERE public=1")
        results = cursor.fetchall()
        group_uuids = tuple(row[0] for row in results)
        query = ("SELECT * FROM groups WHERE group_id IN "
                 f"({', '.join(['?'] * len(group_uuids))})")
        cursor.execute(query, group_uuids)
        groups = {
            row[0]: Group(
                UUID(row[0]), row[1], json.loads(row[2] or "{}"))
            for row in cursor.fetchall()
        }
        return tuple(
            Resource(groups[row[0]], UUID(row[1]), row[2], categories[row[3]],
                     bool(row[4]))
            for row in results)

def group_leader_resources(
        conn: db.DbConnection, user: User, group: Group,
        res_categories: Dict[UUID, ResourceCategory]) -> Sequence[Resource]:
    """Return all the resources available to the group leader"""
    if is_group_leader(conn, user, group):
        with db.cursor(conn) as cursor:
            cursor.execute("SELECT * FROM resources WHERE group_id=?",
                           (str(group.group_id),))
            return tuple(
                Resource(group, UUID(row[1]), row[2],
                         res_categories[UUID(row[3])], bool(row[4]))
                for row in cursor.fetchall())
    return tuple()

def user_resources(conn: db.DbConnection, user: User) -> Sequence[Resource]:
    """List the resources available to the user"""
    categories = { # Repeated in `public_resources` function
        cat.resource_category_id: cat for cat in resource_categories(conn)
    }
    with db.cursor(conn) as cursor:
        def __all_resources__(group) -> Sequence[Resource]:
            gl_resources = group_leader_resources(conn, user, group, categories)

            cursor.execute(
                ("SELECT resources.* FROM group_user_roles_on_resources "
                 "LEFT JOIN resources "
                 "ON group_user_roles_on_resources.resource_id=resources.resource_id "
                 "WHERE group_user_roles_on_resources.group_id = ? "
                 "AND group_user_roles_on_resources.user_id = ?"),
                (str(group.group_id), str(user.user_id)))
            rows = cursor.fetchall()
            private_res = tuple(
                Resource(group, UUID(row[1]), row[2], categories[UUID(row[3])],
                         bool(row[4]))
                for row in rows)
            return tuple({
                res.resource_id: res
                for res in
                (private_res + gl_resources + public_resources(conn))# type: ignore[operator]
            }.values())

        # Fix the typing here
        return user_group(conn, user).map(__all_resources__).maybe(# type: ignore[arg-type,misc]
            public_resources(conn), lambda res: res)# type: ignore[arg-type,return-value]

def attach_resource_data(cursor: db.DbCursor, resource: Resource) -> Resource:
    """Attach the linked data to the resource"""
    resource_data_function = {
        "mrna": mrna_resource_data,
        "genotype": genotype_resource_data,
        "phenotype": phenotype_resource_data
    }
    category = resource.resource_category
    data_rows = tuple(
        dict(data_row) for data_row in
        resource_data_function[category.resource_category_key](
            cursor, resource.resource_id))
    return Resource(
        resource.group, resource.resource_id, resource.resource_name,
        resource.resource_category, resource.public, data_rows)

def mrna_resource_data(
        cursor: db.DbCursor, resource_id: UUID) -> Sequence[sqlite3.Row]:
    """Fetch data linked to a mRNA resource"""
    cursor.execute(
        "SELECT * FROM mrna_resources AS mr INNER JOIN linked_group_data AS lgd"
        " ON (mr.dataset_id=lgd.dataset_or_trait_id "
        "AND mr.dataset_type=lgd.dataset_type) "
        "WHERE mr.resource_id=?",
        (str(resource_id),))
    return cursor.fetchall()

def genotype_resource_data(
        cursor: db.DbCursor, resource_id: UUID) -> Sequence[sqlite3.Row]:
    """Fetch data linked to a Genotype resource"""
    cursor.execute(
        "SELECT * FROM genotype_resources AS gr "
        "INNER JOIN linked_group_data AS lgd "
        "ON (gr.trait_id=lgd.dataset_or_trait_id "
        "AND gr.dataset_type=lgd.dataset_type) "
        "WHERE gr.resource_id=?",
        (str(resource_id),))
    return cursor.fetchall()

def phenotype_resource_data(
        cursor: db.DbCursor, resource_id: UUID) -> Sequence[sqlite3.Row]:
    """Fetch data linked to a Phenotype resource"""
    cursor.execute(
        "SELECT * FROM phenotype_resources AS pr "
        "INNER JOIN linked_group_data AS lgd "
        "ON (pr.trait_id=lgd.dataset_or_trait_id "
        "AND pr.dataset_type=lgd.dataset_type) "
        "WHERE pr.resource_id=?",
        (str(resource_id),))
    return cursor.fetchall()

def resource_by_id(
        conn: db.DbConnection, user: User, resource_id: UUID) -> Resource:
    """Retrieve a resource by its ID."""
    if not authorised_for(
            conn, user, ("group:resource:view-resource",),
            (resource_id,))[resource_id]:
        raise AuthorisationError(
            "You are not authorised to access resource with id "
            f"'{resource_id}'.")

    with db.cursor(conn) as cursor:
        cursor.execute("SELECT * FROM resources WHERE resource_id=:id",
                       {"id": str(resource_id)})
        row = cursor.fetchone()
        if row:
            return attach_resource_data(cursor, Resource(
                group_by_id(conn, UUID(row["group_id"])),
                UUID(row["resource_id"]), row["resource_name"],
                resource_category_by_id(conn, row["resource_category_id"]),
                bool(int(row["public"]))))

    raise NotFoundError(f"Could not find a resource with id '{resource_id}'")

def __link_mrna_data_to_resource__(
        conn: db.DbConnection, resource: Resource, dataset_id: str) -> dict:
    """Link mRNA Assay data with a resource."""
    with db.cursor(conn) as cursor:
        params = {
            "group_id": str(resource.group.group_id),
            "resource_id": str(resource.resource_id),
            "dataset_type": "mRNA",
            "dataset_id": dataset_id
        }
        cursor.execute(
            "INSERT INTO mrna_resources VALUES"
            "(:group_id, :resource_id, :dataset_type, :dataset_id)",
            params)
        return params

def __link_geno_data_to_resource__(
        conn: db.DbConnection, resource: Resource, dataset_id: str) -> dict:
    """Link Genotype data with a resource."""
    with db.cursor(conn) as cursor:
        params = {
            "group_id": str(resource.group.group_id),
            "resource_id": str(resource.resource_id),
            "dataset_type": "Genotype",
            "trait_id": dataset_id
        }
        cursor.execute(
            "INSERT INTO genotype_resources VALUES"
            "(:group_id, :resource_id, :dataset_type, :trait_id)",
            params)
        return params

def __link_pheno_data_to_resource__(
        conn: db.DbConnection, resource: Resource, dataset_id: str) -> dict:
    """Link Phenotype data with a resource."""
    with db.cursor(conn) as cursor:
        params = {
            "group_id": str(resource.group.group_id),
            "resource_id": str(resource.resource_id),
            "dataset_type": "Phenotype",
            "trait_id": dataset_id
        }
        cursor.execute(
            "INSERT INTO phenotype_resources VALUES"
            "(:group_id, :resource_id, :dataset_type, :trait_id)",
            params)
        return params

def link_data_to_resource(
        conn: db.DbConnection, user: User, resource_id: UUID, dataset_type: str,
        dataset_id: str):
    """Link data to resource."""
    if not authorised_for(
            conn, user, ("group:resource:edit-resource",),
            (resource_id,))[resource_id]:
        raise AuthorisationError(
            "You are not authorised to link data to resource with id "
            f"{resource_id}")

    resource = with_db_connection(partial(
        resource_by_id, user=user, resource_id=resource_id))
    return {
        "mrna": __link_mrna_data_to_resource__,
        "genotype": __link_geno_data_to_resource__,
        "phenotype": __link_pheno_data_to_resource__,
    }[dataset_type.lower()](conn, resource, dataset_id)

def __unlink_mrna_data_to_resource__(
        conn: db.DbConnection, resource: Resource, dataset_id: str) -> dict:
    """Unlink data from mRNA Assay resources"""
    with db.cursor(conn) as cursor:
        cursor.execute("DELETE FROM mrna_resources "
                       "WHERE resource_id=? AND dataset_id=?",
                       (str(resource.resource_id), dataset_id))
        return {
            "resource_id": str(resource.resource_id),
            "dataset_type": resource.resource_category.resource_category_key,
            "dataset_id": dataset_id
        }

def __unlink_geno_data_to_resource__(
        conn: db.DbConnection, resource: Resource, trait_id: str) -> dict:
    """Unlink data from Genotype resources"""
    with db.cursor(conn) as cursor:
        cursor.execute("DELETE FROM genotype_resources "
                       "WHERE resource_id=? AND trait_id=?",
                       (str(resource.resource_id), trait_id))
        return {
            "resource_id": str(resource.resource_id),
            "dataset_type": resource.resource_category.resource_category_key,
            "dataset_id": trait_id
        }

def __unlink_pheno_data_to_resource__(
        conn: db.DbConnection, resource: Resource, trait_id: str) -> dict:
    """Unlink data from Phenotype resources"""
    with db.cursor(conn) as cursor:
        cursor.execute("DELETE FROM phenotype_resources "
                       "WHERE resource_id=? AND trait_id=?",
                       (str(resource.resource_id), trait_id))
        return {
            "resource_id": str(resource.resource_id),
            "dataset_type": resource.resource_category.resource_category_key,
            "dataset_id": trait_id
        }

def unlink_data_from_resource(
        conn: db.DbConnection, user: User, resource_id: UUID, dataset_id: str):
    """Unlink data from resource."""
    if not authorised_for(
            conn, user, ("group:resource:edit-resource",),
            (resource_id,))[resource_id]:
        raise AuthorisationError(
            "You are not authorised to link data to resource with id "
            f"{resource_id}")

    resource = with_db_connection(partial(
        resource_by_id, user=user, resource_id=resource_id))
    dataset_type = resource.resource_category.resource_category_key
    return {
        "mrna": __unlink_mrna_data_to_resource__,
        "genotype": __unlink_geno_data_to_resource__,
        "phenotype": __unlink_pheno_data_to_resource__,
    }[dataset_type.lower()](conn, resource, dataset_id)

def organise_resources_by_category(resources: Sequence[Resource]) -> dict[
        ResourceCategory, tuple[Resource]]:
    """Organise the `resources` by their categories."""
    def __organise__(accumulator, resource):
        category = resource.resource_category
        return {
            **accumulator,
            category: accumulator.get(category, tuple()) + (resource,)
        }
    return reduce(__organise__, resources, {})

def __attach_data__(
        data_rows: Sequence[sqlite3.Row],
        resources: Sequence[Resource]) -> Sequence[Resource]:
    def __organise__(acc, row):
        resource_id = UUID(row["resource_id"])
        return {
            **acc,
            resource_id: acc.get(resource_id, tuple()) + (dict(row),)
        }
    organised: dict[UUID, tuple[dict, ...]] = reduce(__organise__, data_rows, {})
    return tuple(
        Resource(
            resource.group, resource.resource_id, resource.resource_name,
            resource.resource_category, resource.public,
            organised.get(resource.resource_id, tuple()))
        for resource in resources)

def attach_mrna_resources_data(
        cursor, resources: Sequence[Resource]) -> Sequence[Resource]:
    """Attach linked data to mRNA Assay resources"""
    placeholders = ", ".join(["?"] * len(resources))
    cursor.execute(
        "SELECT * FROM mrna_resources AS mr INNER JOIN linked_group_data AS lgd"
        " ON (mr.dataset_id=lgd.dataset_or_trait_id "
        "AND mr.dataset_type=lgd.dataset_type) "
        f"WHERE mr.resource_id IN ({placeholders})",
        tuple(str(resource.resource_id) for resource in resources))
    return __attach_data__(cursor.fetchall(), resources)

def attach_genotype_resources_data(
        cursor, resources: Sequence[Resource]) -> Sequence[Resource]:
    """Attach linked data to Genotype resources"""
    placeholders = ", ".join(["?"] * len(resources))
    cursor.execute(
        "SELECT * FROM genotype_resources AS gr "
        "INNER JOIN linked_group_data AS lgd "
        "ON (gr.trait_id=lgd.dataset_or_trait_id "
        "AND gr.dataset_type=lgd.dataset_type) "
        f"WHERE gr.resource_id IN {placeholders}",
        tuple(str(resource.resource_id) for resource in resources))
    return __attach_data__(cursor.fetchall(), resources)

def attach_phenotype_resources_data(
        cursor, resources: Sequence[Resource]) -> Sequence[Resource]:
    """Attach linked data to Phenotype resources"""
    placeholders = ", ".join(["?"] * len(resources))
    cursor.execute(
        "SELECT * FROM phenotype_resources AS pr "
        "INNER JOIN linked_group_data AS lgd "
        "ON (pr.trait_id=lgd.dataset_or_trait_id "
        "AND pr.dataset_type=lgd.dataset_type) "
        f"WHERE pr.resource_id IN {placeholders}",
        tuple(str(resource.resource_id) for resource in resources))
    return __attach_data__(cursor.fetchall(), resources)

def attach_resources_data(
        conn: db.DbConnection, resources: Sequence[Resource]) -> Sequence[
            Resource]:
    """Attach linked data for each resource in `resources`"""
    resource_data_function = {
        "mrna": attach_mrna_resources_data,
        "genotype": attach_genotype_resources_data,
        "phenotype": attach_phenotype_resources_data
    }
    organised = organise_resources_by_category(resources)
    with db.cursor(conn) as cursor:
        return tuple(
            resource for categories in
            (resource_data_function[category.resource_category_key](
                cursor, rscs)
             for category, rscs in organised.items())
            for resource in categories)

@authorised_p(
    ("group:user:assign-role",),
    "You cannot assign roles to users for this group.",
    oauth2_scope="profile group role resource")
def assign_resource_user(
        conn: db.DbConnection, resource: Resource, user: User,
        role: GroupRole) -> dict:
    """Assign `role` to `user` for the specific `resource`."""
    with db.cursor(conn) as cursor:
        cursor.execute(
            "INSERT INTO "
            "group_user_roles_on_resources(group_id, user_id, role_id, "
            "resource_id) "
            "VALUES (?, ?, ?, ?) "
            "ON CONFLICT (group_id, user_id, role_id, resource_id) "
            "DO NOTHING",
            (str(resource.group.group_id), str(user.user_id),
             str(role.role.role_id), str(resource.resource_id)))
        return {
            "resource": dictify(resource),
            "user": dictify(user),
            "role": dictify(role),
            "description": (
                f"The user '{user.name}'({user.email}) was assigned the "
                f"'{role.role.role_name}' role on resource with ID "
                f"'{resource.resource_id}'.")}

@authorised_p(
    ("group:user:assign-role",),
    "You cannot assign roles to users for this group.",
    oauth2_scope="profile group role resource")
def unassign_resource_user(
        conn: db.DbConnection, resource: Resource, user: User,
        role: GroupRole) -> dict:
    """Assign `role` to `user` for the specific `resource`."""
    with db.cursor(conn) as cursor:
        cursor.execute(
            "DELETE FROM group_user_roles_on_resources "
            "WHERE group_id=? AND user_id=? AND role_id=? AND resource_id=?",
            (str(resource.group.group_id), str(user.user_id),
             str(role.role.role_id), str(resource.resource_id)))
        return {
            "resource": dictify(resource),
            "user": dictify(user),
            "role": dictify(role),
            "description": (
                f"The user '{user.name}'({user.email}) had the "
                f"'{role.role.role_name}' role on resource with ID "
                f"'{resource.resource_id}' taken away.")}