role verification for security visibility + tests in scenario service

Author: Leopold-Cramer

doc/.openapi-generator/VERSION

@@ -1 +1 @@
-7.3.0
+7.8.0

runner/src/main/kotlin/com/cosmotech/runner/service/RunnerApiServiceImpl.kt

@@ -12,9 +12,7 @@ import com.cosmotech.api.rbac.PERMISSION_WRITE
 import com.cosmotech.api.rbac.PERMISSION_WRITE_SECURITY
 import com.cosmotech.api.rbac.getScenarioRolesDefinition
 import com.cosmotech.api.utils.constructPageRequest
-import com.cosmotech.api.utils.getCurrentAccountIdentifier
 import com.cosmotech.runner.RunnerApiServiceInterface
-import com.cosmotech.runner.domain.CreatedRun
 import com.cosmotech.runner.domain.Runner
 import com.cosmotech.runner.domain.RunnerAccessControl
 import com.cosmotech.runner.domain.RunnerRole
@@ -38,12 +36,7 @@ internal class RunnerApiServiceImpl(
             .inWorkspace(workspaceId)
             .userHasPermissionOnWorkspace(PERMISSION_CREATE_CHILDREN)
     val runnerInstance =
-        runnerService
-            .getNewInstance()
-            .setValueFrom(runner)
-            .initSecurity(runner)
-            .initParameters()
-            .initDatasetList()
+        runnerService.getNewInstance().setValueFrom(runner).initSecurity(runner).initParameters()
 
     return runnerService.saveInstance(runnerInstance)
   }

scenario/src/integrationTest/kotlin/com/cosmotech/scenario/service/ScenarioServiceIntegrationTest.kt

@@ -445,7 +445,7 @@ class ScenarioServiceIntegrationTest : CsmRedisTestBase() {
     scenarioList =
         scenarioApiService.findAllScenarios(
             organizationSaved.id!!, workspaceSaved.id!!, 0, expectedSize)
-    assertEquals(scenarioList.size, expectedSize)
+    assertEquals(expectedSize, scenarioList.size)
 
     logger.info("should find all Scenarios and assert it returns the second / last page")
     scenarioList =
@@ -1083,6 +1083,64 @@ class ScenarioServiceIntegrationTest : CsmRedisTestBase() {
     assertEquals(ROLE_VIEWER, datasetAC.role)
   }
 
+  @Test
+  fun `As a viewer, I can only see my information in security property for findScenarioById`() {
+    organization = makeOrganization(userName = TEST_USER_MAIL)
+    organizationSaved = organizationApiService.registerOrganization(organization)
+    solution = makeSolution(organizationId = organizationSaved.id!!)
+    solutionSaved = solutionApiService.createSolution(organizationSaved.id!!, solution)
+    workspace = makeWorkspace(organizationId = organizationSaved.id!!, userName = TEST_USER_MAIL)
+    workspaceSaved = workspaceApiService.createWorkspace(organizationSaved.id!!, workspace)
+    dataset = makeDataset(organizationId = organizationSaved.id!!)
+    datasetSaved = datasetApiService.createDataset(organizationSaved.id!!, dataset)
+    scenario
+    scenario =
+        makeScenario(
+            organizationId = organizationSaved.id!!, userName = TEST_USER_MAIL, role = ROLE_VIEWER)
+    scenarioSaved =
+        scenarioApiService.createScenario(organizationSaved.id!!, workspaceSaved.id!!, scenario)
+    every { getCurrentAccountIdentifier(any()) } returns TEST_USER_MAIL
+
+    scenarioSaved =
+        scenarioApiService.findScenarioById(
+            organizationSaved.id!!, workspaceSaved.id!!, scenarioSaved.id!!)
+    assertEquals(
+        ScenarioSecurity(
+            default = ROLE_NONE, mutableListOf(ScenarioAccessControl(TEST_USER_MAIL, ROLE_VIEWER))),
+        scenarioSaved.security)
+    assertEquals(1, scenarioSaved.security!!.accessControlList.size)
+  }
+
+  @Test
+  fun `As a viewer, I can only see my information in security property for findAllScenarios`() {
+    organization = makeOrganization(userName = TEST_USER_MAIL)
+    organizationSaved = organizationApiService.registerOrganization(organization)
+    solution = makeSolution(organizationId = organizationSaved.id!!)
+    solutionSaved = solutionApiService.createSolution(organizationSaved.id!!, solution)
+    workspace = makeWorkspace(organizationId = organizationSaved.id!!, userName = TEST_USER_MAIL)
+    workspaceSaved = workspaceApiService.createWorkspace(organizationSaved.id!!, workspace)
+    dataset = makeDataset(organizationId = organizationSaved.id!!)
+    datasetSaved = datasetApiService.createDataset(organizationSaved.id!!, dataset)
+    scenario
+    scenario =
+        makeScenario(
+            organizationId = organizationSaved.id!!, userName = TEST_USER_MAIL, role = ROLE_VIEWER)
+    scenarioSaved =
+        scenarioApiService.createScenario(organizationSaved.id!!, workspaceSaved.id!!, scenario)
+    every { getCurrentAccountIdentifier(any()) } returns TEST_USER_MAIL
+
+    val scenarios =
+        scenarioApiService.findAllScenarios(organizationSaved.id!!, workspaceSaved.id!!, null, null)
+    scenarios.forEach {
+      assertEquals(
+          ScenarioSecurity(
+              default = ROLE_NONE,
+              mutableListOf(ScenarioAccessControl(TEST_USER_MAIL, ROLE_VIEWER))),
+          it.security)
+      assertEquals(1, it.security!!.accessControlList.size)
+    }
+  }
+
   private fun makeWorkspaceEventHubInfo(eventHubAvailable: Boolean): WorkspaceEventHubInfo {
     return WorkspaceEventHubInfo(
         eventHubNamespace = "eventHubNamespace",

scenario/src/integrationTest/kotlin/com/cosmotech/scenario/service/ScenarioServiceRBACTest.kt

@@ -4480,7 +4480,7 @@ class ScenarioServiceRBACTest : CsmRedisTestBase() {
   @TestFactory
   fun `test Scenario RBAC getScenarioPermissions`() =
       mapOf(
-              ROLE_VIEWER to false,
+              ROLE_VIEWER to true,
               ROLE_EDITOR to false,
               ROLE_VALIDATOR to false,
               ROLE_NONE to true,
@@ -4802,7 +4802,7 @@ class ScenarioServiceRBACTest : CsmRedisTestBase() {
   @TestFactory
   fun `test Scenario RBAC getScenarioSecurity`() =
       mapOf(
-              ROLE_VIEWER to false,
+              ROLE_VIEWER to true,
               ROLE_EDITOR to false,
               ROLE_VALIDATOR to false,
               ROLE_NONE to true,
@@ -5902,7 +5902,7 @@ class ScenarioServiceRBACTest : CsmRedisTestBase() {
   @TestFactory
   fun `test Scenario RBAC getScenarioAccessControl`() =
       mapOf(
-              ROLE_VIEWER to false,
+              ROLE_VIEWER to true,
               ROLE_EDITOR to false,
               ROLE_VALIDATOR to false,
               ROLE_NONE to true,
@@ -6986,7 +6986,7 @@ class ScenarioServiceRBACTest : CsmRedisTestBase() {
   @TestFactory
   fun `test Scenario RBAC getScenarioSecurityUsers`() =
       mapOf(
-              ROLE_VIEWER to false,
+              ROLE_VIEWER to true,
               ROLE_EDITOR to false,
               ROLE_VALIDATOR to false,
               ROLE_NONE to true,

scenario/src/main/kotlin/com/cosmotech/scenario/service/ScenarioServiceImpl.kt

@@ -43,6 +43,7 @@ import com.cosmotech.dataset.DatasetApiServiceInterface
 import com.cosmotech.dataset.domain.IngestionStatusEnum
 import com.cosmotech.dataset.domain.SubDatasetGraphQuery
 import com.cosmotech.dataset.service.getRbac
+import com.cosmotech.organization.service.getRbac
 import com.cosmotech.scenario.ScenarioApiServiceInterface
 import com.cosmotech.scenario.domain.Scenario
 import com.cosmotech.scenario.domain.ScenarioAccessControl
@@ -432,15 +433,21 @@ internal class ScenarioServiceImpl(
     workspaceService.getVerifiedWorkspace(organizationId, workspaceId)
     val defaultPageSize = csmPlatformProperties.twincache.scenario.defaultPageSize
     val pageable = constructPageRequest(page, size, defaultPageSize)
+    var scenarios = listOf<Scenario>()
     if (pageable != null) {
-      return this.findPaginatedScenariosStateOption(
-          organizationId, workspaceId, pageable.pageNumber, pageable.pageSize, true)
-    }
-    return findAllPaginated(defaultPageSize) {
-      this.findPaginatedScenariosStateOption(
-              organizationId, workspaceId, it.pageNumber, it.pageSize, true)
-          .toMutableList()
+      scenarios =
+          this.findPaginatedScenariosStateOption(
+              organizationId, workspaceId, pageable.pageNumber, pageable.pageSize, true)
+    } else {
+      scenarios =
+          findAllPaginated(defaultPageSize) {
+            this.findPaginatedScenariosStateOption(
+                    organizationId, workspaceId, it.pageNumber, it.pageSize, true)
+                .toMutableList()
+          }
     }
+    scenarios.forEach { it.security = updateSecurityVisibility(it).security }
+    return scenarios
   }
 
   override fun findAllScenariosByValidationStatus(
@@ -590,7 +597,8 @@ internal class ScenarioServiceImpl(
       scenarioId: String
   ): Scenario {
     checkInternalResultDataServiceConfiguration()
-    return findScenarioById(organizationId, workspaceId, scenarioId, withState = true)
+    val scenario = findScenarioById(organizationId, workspaceId, scenarioId, withState = true)
+    return updateSecurityVisibility(scenario)
   }
 
   override fun findScenarioById(
@@ -1167,4 +1175,24 @@ internal class ScenarioServiceImpl(
       throw NotImplementedException(notImplementedExceptionMessage)
     }
   }
+
+  fun updateSecurityVisibility(scenario: Scenario): Scenario {
+    if (csmRbac.check(scenario.getRbac(), PERMISSION_READ_SECURITY).not()) {
+      val username = getCurrentAccountIdentifier(csmPlatformProperties)
+      val retrievedAC = scenario.security!!.accessControlList.firstOrNull { it.id == username }
+      return if (retrievedAC != null) {
+        scenario.copy(
+            security =
+                ScenarioSecurity(
+                    default = scenario.security!!.default,
+                    accessControlList = mutableListOf(retrievedAC)))
+      } else {
+        scenario.copy(
+            security =
+                ScenarioSecurity(
+                    default = scenario.security!!.default, accessControlList = mutableListOf()))
+      }
+    }
+    return scenario
+  }
 }

solution/src/integrationTest/kotlin/com/cosmotech/solution/service/SolutionServiceIntegrationTest.kt

@@ -126,8 +126,8 @@ class SolutionServiceIntegrationTest : CsmRedisTestBase() {
             runTemplates =
                 mutableListOf(RunTemplate(id = "one", name = "name_one"), RunTemplate(id = "two")))
     // Assert that no runTemplate were deleted
-    assertEquals(expectedSolution.runTemplates.size, endTemplates.size)
-    assertEquals(expectedSolution.runTemplates, endTemplates)
+    assertEquals(expectedSolution.runTemplates!!.size, endTemplates.size)
+    assertEquals(expectedSolution.runTemplates!!, endTemplates)
   }
 
   @Test
@@ -389,7 +389,7 @@ class SolutionServiceIntegrationTest : CsmRedisTestBase() {
 
     assertNotNull(solutionWithNullRunTemplatesSaved)
     assertNotNull(solutionWithNullRunTemplatesSaved.runTemplates)
-    assertEquals(0, solutionWithNullRunTemplatesSaved.runTemplates.size)
+    assertEquals(0, solutionWithNullRunTemplatesSaved.runTemplates!!.size)
   }
 
   @Test
@@ -402,7 +402,7 @@ class SolutionServiceIntegrationTest : CsmRedisTestBase() {
 
     assertNotNull(solutionWithNullRunTemplatesSaved)
     assertNotNull(solutionWithNullRunTemplatesSaved.runTemplates)
-    assertEquals(0, solutionWithNullRunTemplatesSaved.runTemplates.size)
+    assertEquals(0, solutionWithNullRunTemplatesSaved.runTemplates!!.size)
   }
 
   @Test
@@ -531,7 +531,10 @@ class SolutionServiceIntegrationTest : CsmRedisTestBase() {
   @Test
   fun `test update solution with runTemplates null`() {
 
-    val baseSolution = makeSolution(organizationSaved.id!!, runTemplates = null)
+    val baseSolution =
+        makeSolution(
+            organizationSaved.id!!,
+        )
     val baseSolutionSaved = solutionApiService.createSolution(organizationSaved.id!!, baseSolution)
 
     val assertThrows =