Refactor user permissions #454
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
msherman64
approved these changes
Oct 7, 2024
Comment on lines
+50
to
+95
| class UserPermissions(): | ||
| manage: bool | ||
| manage_membership: bool | ||
|
|
||
| def __init__(self, manage, manage_membership): | ||
| self.manage = manage | ||
| self.manage_membership = manage_membership | ||
|
|
||
| @staticmethod | ||
| def _get_user_project_role_scopes(keycloak_client, username, project): | ||
| role, scopes = keycloak_client.get_user_project_role_scopes( | ||
| username, get_charge_code(project) | ||
| ) | ||
| logger.info("SCOPES===") | ||
| logger.info(role) | ||
| logger.info(scopes) | ||
| return role, scopes | ||
|
|
||
| @staticmethod | ||
| def _parse_scopes(scopes): | ||
| # NOTE We have these two scopes defined in KC. In implementation, | ||
| # we do not differentiate between them. See our docs for the specifics | ||
| # https://chameleoncloud.readthedocs.io/en/latest/user/project.html#user-roles | ||
| can_manage = "manage" in scopes or "manage-membership" in scopes | ||
| return UserPermissions( | ||
| manage=can_manage, # Can edit project metadata/allocations | ||
| manage_membership=can_manage, # Can update members | ||
| ) | ||
|
|
||
| @staticmethod | ||
| def get_user_permissions(keycloak_client, username, project): | ||
| _, scopes = UserPermissions._get_user_project_role_scopes( | ||
| keycloak_client, username, project) | ||
| return UserPermissions._parse_scopes(scopes) | ||
|
|
||
| @staticmethod | ||
| def get_manager_projects(keycloak_client, username): | ||
| """Gets project names for all project this user is a manager of | ||
| """ | ||
| return [ | ||
| project["groupName"] | ||
| for project in keycloak_client.get_user_roles(username) | ||
| if UserPermissions._parse_scopes(project["scopes"]).manage | ||
| ] | ||
|
|
||
|
|
There was a problem hiding this comment.
this looks like it's centralizing the mapping from keycloak scopes -> portal permissions, rather than a bunch of if-then? scattered around?
There was a problem hiding this comment.
Yes. Now all of the permissions/scope code is here, and a block of code can check against this class for a portal permission. This should prevent bugs with manually parsing/interacting with keycloak scopes each time we check a user's role.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This fixes a bug where managers could do what they were supposed to. It seems this is caused by having 2 scopes in keycloak:
manageandmanager-members. We may have differentiated this at one point, but now we do now, there are PIs, managers, and members.This introduces a class UserPermissions that we can use to set these, rather than having to parse keycloak scopes everywhere we want to use permissions.
This also fixes a small bug in a migration.