Lcra/change security visibility per role prod 14083

build.gradle.kts

@@ -30,13 +30,13 @@ plugins {
   kotlin("plugin.spring") version kotlinVersion apply false
   id("pl.allegro.tech.build.axion-release") version "1.15.5"
   id("com.diffplug.spotless") version "6.22.0"
-  id("org.springframework.boot") version "3.2.5" apply false
+  id("org.springframework.boot") version "3.2.10" apply false
   id("project-report")
   id("org.owasp.dependencycheck") version "9.0.2"
   id("com.github.jk1.dependency-license-report") version "2.5"
   id("org.jetbrains.kotlinx.kover") version "0.7.4"
-  id("io.gitlab.arturbosch.detekt") version "1.23.5"
-  id("org.openapi.generator") version "7.3.0" apply false
+  id("io.gitlab.arturbosch.detekt") version "1.23.6"
+  id("org.openapi.generator") version "7.8.0" apply false
   id("com.google.cloud.tools.jib") version "3.4.0" apply false
 }
 
@@ -68,7 +68,7 @@ val apiValidationVersion = "3.0.2"
 val kubernetesClientVersion = "21.0.0"
 
 // Checks
-val detektVersion = "1.23.5"
+val detektVersion = "1.23.6"
 
 // Tests
 val jUnitBomVersion = "5.10.0"

dataset/src/integrationTest/kotlin/com/cosmotech/dataset/service/DatasetServiceIntegrationTest.kt

@@ -1019,6 +1019,59 @@ class DatasetServiceIntegrationTest : CsmRedisTestBase() {
     assertEquals(dataset1.connector!!.id, dataset2.connector!!.id)
   }
 
+  @Test
+  fun `As viewer, I can only see my information in security property for findDatasetById`() {
+    dataset = makeDatasetWithRole(role = ROLE_VIEWER)
+    datasetSaved = datasetApiService.createDataset(organizationSaved.id!!, dataset)
+
+    datasetSaved = datasetApiService.findDatasetById(organizationSaved.id!!, datasetSaved.id!!)
+    assertEquals(
+        DatasetSecurity(
+            default = ROLE_NONE, mutableListOf(DatasetAccessControl(TEST_USER_MAIL, ROLE_VIEWER))),
+        datasetSaved.security)
+    assertEquals(1, datasetSaved.security!!.accessControlList.size)
+  }
+
+  @Test
+  fun `As viewer, I can only see my information in security property for findAllDatasets`() {
+    every { getCurrentAccountIdentifier(any()) } returns CONNECTED_ADMIN_USER
+    datasetApiService.deleteDataset(organizationSaved.id!!, datasetSaved.id!!)
+    every { getCurrentAccountIdentifier(any()) } returns TEST_USER_MAIL
+    dataset = makeDatasetWithRole(role = ROLE_VIEWER)
+    datasetSaved = datasetApiService.createDataset(organizationSaved.id!!, dataset)
+
+    val datasets = datasetApiService.findAllDatasets(organizationSaved.id!!, null, null)
+    datasets.forEach {
+      assertEquals(
+          DatasetSecurity(
+              default = ROLE_NONE,
+              mutableListOf(DatasetAccessControl(TEST_USER_MAIL, ROLE_VIEWER))),
+          it.security)
+      assertEquals(1, it.security!!.accessControlList.size)
+    }
+  }
+
+  @Test
+  fun `As viewer, I can only see my information in security property for searchDatasets`() {
+    every { getCurrentAccountIdentifier(any()) } returns CONNECTED_ADMIN_USER
+    datasetApiService.deleteDataset(organizationSaved.id!!, datasetSaved.id!!)
+    every { getCurrentAccountIdentifier(any()) } returns TEST_USER_MAIL
+    dataset = makeDatasetWithRole(role = ROLE_VIEWER)
+    datasetSaved = datasetApiService.createDataset(organizationSaved.id!!, dataset)
+
+    val datasets =
+        datasetApiService.searchDatasets(
+            organizationSaved.id!!, DatasetSearch(mutableListOf("dataset")), 0, 10)
+    datasets.forEach {
+      assertEquals(
+          DatasetSecurity(
+              default = ROLE_NONE,
+              mutableListOf(DatasetAccessControl(TEST_USER_MAIL, ROLE_VIEWER))),
+          it.security)
+      assertEquals(1, it.security!!.accessControlList.size)
+    }
+  }
+
   fun makeConnector(): Connector {
     return Connector(
         key = "connector",

dataset/src/integrationTest/kotlin/com/cosmotech/dataset/service/DatasetServiceRBACTest.kt

@@ -1858,7 +1858,7 @@ class DatasetServiceRBACTest : CsmRedisTestBase() {
   @TestFactory
   fun `test Dataset RBAC getDatasetAccessControl`() =
       mapOf(
-              ROLE_VIEWER to false,
+              ROLE_VIEWER to true,
               ROLE_EDITOR to false,
               ROLE_USER to false,
               ROLE_NONE to true,
@@ -2104,7 +2104,7 @@ class DatasetServiceRBACTest : CsmRedisTestBase() {
   @TestFactory
   fun `test Dataset RBAC getDatasetSecurityUsers`() =
       mapOf(
-              ROLE_VIEWER to false,
+              ROLE_VIEWER to true,
               ROLE_EDITOR to false,
               ROLE_USER to false,
               ROLE_NONE to true,
@@ -2180,7 +2180,7 @@ class DatasetServiceRBACTest : CsmRedisTestBase() {
   @TestFactory
   fun `test Dataset RBAC getDatasetSecurity`() =
       mapOf(
-              ROLE_VIEWER to false,
+              ROLE_VIEWER to true,
               ROLE_EDITOR to false,
               ROLE_USER to false,
               ROLE_NONE to true,

dataset/src/main/kotlin/com/cosmotech/dataset/service/DatasetServiceImpl.kt

@@ -167,12 +167,12 @@ class DatasetServiceImpl(
             datasetRepository.findAll(pageable).toList()
           }
     }
-
+    result.forEach { it.security = updateSecurityVisibility(it).security }
     return result
   }
 
   override fun findDatasetById(organizationId: String, datasetId: String): Dataset {
-    return getVerifiedDataset(organizationId, datasetId)
+    return updateSecurityVisibility(getVerifiedDataset(organizationId, datasetId))
   }
 
   override fun removeAllDatasetCompatibilityElements(organizationId: String, datasetId: String) {
@@ -237,7 +237,6 @@ class DatasetServiceImpl(
         version = existingConnector.version
       }
     }
-
     return datasetRepository.save(createdDataset)
   }
 
@@ -866,12 +865,15 @@ class DatasetServiceImpl(
       datasetId: String,
       workspaceId: String
   ): Dataset {
+    this.getVerifiedDataset(organizationId, datasetId, PERMISSION_WRITE)
     sendAddDatasetToWorkspaceEvent(organizationId, workspaceId, datasetId)
     return addWorkspaceToLinkedWorkspaceIdList(organizationId, datasetId, workspaceId)
   }
 
   @EventListener(AddWorkspaceToDataset::class)
   fun processEventAddWorkspace(addWorkspaceToDataset: AddWorkspaceToDataset) {
+    this.getVerifiedDataset(
+        addWorkspaceToDataset.organizationId, addWorkspaceToDataset.datasetId, PERMISSION_WRITE)
     addWorkspaceToLinkedWorkspaceIdList(
         addWorkspaceToDataset.organizationId,
         addWorkspaceToDataset.datasetId,
@@ -902,14 +904,17 @@ class DatasetServiceImpl(
       datasetId: String,
       workspaceId: String
   ): Dataset {
-
+    this.getVerifiedDataset(organizationId, datasetId, PERMISSION_WRITE)
     sendRemoveDatasetFromWorkspaceEvent(organizationId, workspaceId, datasetId)
-
     return removeWorkspaceFromLinkedWorkspaceIdList(organizationId, datasetId, workspaceId)
   }
 
   @EventListener(RemoveWorkspaceFromDataset::class)
   fun processEventRemoveWorkspace(removeWorkspaceFromDataset: RemoveWorkspaceFromDataset) {
+    this.getVerifiedDataset(
+        removeWorkspaceFromDataset.organizationId,
+        removeWorkspaceFromDataset.datasetId,
+        PERMISSION_WRITE)
     removeWorkspaceFromLinkedWorkspaceIdList(
         removeWorkspaceFromDataset.organizationId,
         removeWorkspaceFromDataset.datasetId,
@@ -1029,16 +1034,21 @@ class DatasetServiceImpl(
 
     val defaultPageSize = csmPlatformProperties.twincache.dataset.defaultPageSize
     val pageable = constructPageRequest(page, size, defaultPageSize)
+    var datasetList = listOf<Dataset>()
     if (pageable != null) {
-      return datasetRepository
-          .findDatasetByTags(organizationId, datasetSearch.datasetTags.toSet(), pageable)
-          .toList()
-    }
-    return findAllPaginated(defaultPageSize) {
-      datasetRepository
-          .findDatasetByTags(organizationId, datasetSearch.datasetTags.toSet(), it)
-          .toList()
+      datasetList =
+          datasetRepository
+              .findDatasetByTags(organizationId, datasetSearch.datasetTags.toSet(), pageable)
+              .toList()
     }
+    datasetList =
+        findAllPaginated(defaultPageSize) {
+          datasetRepository
+              .findDatasetByTags(organizationId, datasetSearch.datasetTags.toSet(), it)
+              .toList()
+        }
+    datasetList.forEach { it.security = updateSecurityVisibility(it).security }
+    return datasetList
   }
 
   override fun getDatasetSecurity(organizationId: String, datasetId: String): DatasetSecurity {
@@ -1209,6 +1219,7 @@ class DatasetServiceImpl(
       }
     }
   }
+
   private fun sendTwingraphImportJobInfoRequestEvent(
       dataset: Dataset,
       organizationId: String
@@ -1276,6 +1287,26 @@ class DatasetServiceImpl(
     csmRbac.verify(dataset.getRbac(), requiredPermission)
     return dataset
   }
+
+  fun updateSecurityVisibility(dataset: Dataset): Dataset {
+    if (csmRbac.check(dataset.getRbac(), PERMISSION_READ_SECURITY).not()) {
+      val username = getCurrentAccountIdentifier(csmPlatformProperties)
+      val retrievedAC = dataset.security!!.accessControlList.firstOrNull { it.id == username }
+      if (retrievedAC != null) {
+        return dataset.copy(
+            security =
+                DatasetSecurity(
+                    default = dataset.security!!.default,
+                    accessControlList = mutableListOf(retrievedAC)))
+      } else {
+        return dataset.copy(
+            security =
+                DatasetSecurity(
+                    default = dataset.security!!.default, accessControlList = mutableListOf()))
+      }
+    }
+    return dataset
+  }
 }
 
 fun Dataset.getRbac(): RbacSecurity {

dataset/src/test/kotlin/com/cosmotech/dataset/service/DatasetServiceImplTests.kt

@@ -12,6 +12,7 @@ import com.cosmotech.api.id.CsmIdGenerator
 import com.cosmotech.api.rbac.CsmAdmin
 import com.cosmotech.api.rbac.CsmRbac
 import com.cosmotech.api.rbac.PERMISSION_CREATE_CHILDREN
+import com.cosmotech.api.rbac.ROLE_NONE
 import com.cosmotech.api.security.ROLE_PLATFORM_ADMIN
 import com.cosmotech.api.utils.ResourceScanner
 import com.cosmotech.api.utils.getCurrentAccountIdentifier
@@ -59,7 +60,10 @@ fun baseDataset() =
         name = "My Dataset",
         description = "My Dataset description",
         organizationId = ORGANIZATION_ID,
-    )
+        security =
+            DatasetSecurity(
+                default = ROLE_NONE,
+                accessControlList = mutableListOf(DatasetAccessControl(USER_ID, ROLE_NONE))))
 
 @ExtendWith(MockKExtension::class)
 class DatasetServiceImplTests {
@@ -427,11 +431,7 @@ class DatasetServiceImplTests {
 
   @Test
   fun `deleteDataset should delete Dataset and its twingraph`() {
-    val dataset =
-        baseDataset()
-            .copy(
-                twingraphId = "twingraphId",
-            )
+    val dataset = baseDataset().copy(twingraphId = "twingraphId")
     every { organizationService.getVerifiedOrganization(ORGANIZATION_ID) } returns Organization()
     every { datasetRepository.findBy(ORGANIZATION_ID, DATASET_ID) } returns Optional.of(dataset)
     every { getCurrentAuthenticatedRoles(csmPlatformProperties) } returns

doc/.openapi-generator/VERSION

@@ -1 +1 @@
-7.3.0
+7.8.0