Add global functions user permissions 🎨 #7868
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
wvangeit
added
the
a:database
wvangeit
requested review from
GitHK,
matusdrobuliak66 and
giancarloromeo
as code owners
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #7868 +/- ##
==========================================
+ Coverage 87.80% 87.98% +0.18%
==========================================
Files 1791 1753 -38
Lines 69717 68606 -1111
Branches 1220 1065 -155
==========================================
- Hits 61214 60366 -848
+ Misses 8151 7924 -227
+ Partials 352 316 -36
Continue to review full report in Codecov by Sentry.
🚀 New features to boost your workflow:
|
JavierGOrdonnez
approved these changes
Jun 10, 2025
sanderegg
reviewed
Jun 11, 2025
There was a problem hiding this comment.
Looks sound.
I am wondering a few things here:
- why are the permissions + access rights only checked on the webserver level and not already in the api-server?
- what is the concept/difference between permissions and abilities?
- you are missing some tests on these new exceptions on the api-server side.
...re_postgres_database/migration/versions/4e015ffa304e_add_functions_global_group_abilities.py
Outdated
Show resolved
Hide resolved
services/web/server/src/simcore_service_webserver/functions/_functions_repository.py
Outdated
Show resolved
Hide resolved
services/api-server/src/simcore_service_api_server/api/routes/functions_routes.py
Outdated
Show resolved
Hide resolved
GitHK
reviewed
Jun 11, 2025
...re_postgres_database/migration/versions/4e015ffa304e_add_functions_global_group_abilities.py
Outdated
Show resolved
Hide resolved
services/web/server/src/simcore_service_webserver/functions/_controller/_functions_rpc.py
Show resolved
Hide resolved
services/web/server/src/simcore_service_webserver/functions/_functions_service.py
Show resolved
Hide resolved
services/web/server/tests/unit/with_dbs/04/functions_rpc/test_functions_controller_rpc.py
Outdated
Show resolved
Hide resolved
pcrespov
reviewed
Jun 11, 2025
...stgres-database/src/simcore_postgres_database/models/funcapi_function_api_group_abilities.py
Outdated
Show resolved
Hide resolved
...stgres-database/src/simcore_postgres_database/models/funcapi_function_api_group_abilities.py
Outdated
Show resolved
Hide resolved
…geit/osparc-simcore into add_global_functions_user_abilities
Wrt to 1. I just checked on the deepest level which looked like the safest/most efficient. If i do it in the api-server I would also have to pull the permissions out of the db with rpc calls. I consider it better to avoid that and let the repository layer handle all this immediately? One exception is running functions, because there the function is implemented in the api server, for now. |
…geit/osparc-simcore into add_global_functions_user_abilities
sanderegg
approved these changes
Jun 13, 2025
…geit/osparc-simcore into add_global_functions_user_abilities
|
@mergify queue |
🟠 Waiting for conditions to match
|
|
@mergify update |
☑️ Nothing to do, the required conditions are not met
|
|
@mergify refresh |
✅ Pull request refreshed |
|
@mergify refresh |
✅ Pull request refreshed |
|
@mergify queue |
🟠 Waiting for conditions to match
|
|
|
@mergify refresh |
✅ Pull request refreshed |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What do these changes do?
This will allow control of which users/user groups are allowed to read/write(create)/execute functions, function jobs and function job collections, on a global level per product. This is different from a PR where the permissions 'per function object' were introduced.
This could be linked to the frontend in a future PR, by exposing a webserver rest api where the frontend can ask for the global permissions of a user to affect e.g. the appearance of the 'create function' panel.
Related issue/s
How to test
Try to run/read/create a function as a user who doesn't have access to, the appropriate permission denied error should be returned.
Dev-ops
No changes to ENV.
Migration script will introduce a new table that will by default deny all access to function abilities to all users. To enable access for a certain group, add a row to the funcapi_group_api_access_rights table, with in each column a bool enabling/disabling the particular right for that group.