✨ Add Function groups permissions management endpoints (#8226)

Co-authored-by: Odei Maiz <[email protected]>

Author: giancarloromeo

api/specs/web-server/_functions.py

@@ -10,12 +10,18 @@
 from _common import as_query
 from fastapi import APIRouter, Depends, status
 from models_library.api_schemas_webserver.functions import (
+    FunctionGroupAccessRightsGet,
+    FunctionGroupAccessRightsUpdate,
     FunctionToRegister,
     RegisteredFunctionGet,
     RegisteredFunctionUpdate,
 )
 from models_library.generics import Envelope
+from models_library.groups import GroupID
 from simcore_service_webserver._meta import API_VTAG
+from simcore_service_webserver.functions._controller._functions_rest import (
+    FunctionGroupPathParams,
+)
 from simcore_service_webserver.functions._controller._functions_rest_schemas import (
     FunctionGetQueryParams,
     FunctionPathParams,
@@ -75,3 +81,33 @@ async def update_function(
 async def delete_function(
     _path: Annotated[FunctionPathParams, Depends()],
 ): ...
+
+
+@router.get(
+    "/functions/{function_id}/groups",
+    response_model=Envelope[dict[GroupID, FunctionGroupAccessRightsGet]],
+)
+async def get_function_groups(
+    _path: Annotated[FunctionPathParams, Depends()],
+): ...
+
+
+@router.put(
+    "/functions/{function_id}/groups/{group_id}",
+    summary="Create or update a Function Group",
+    response_model=Envelope[FunctionGroupAccessRightsGet],
+)
+async def create_or_update_function_group(
+    _path: Annotated[FunctionGroupPathParams, Depends()],
+    _body: FunctionGroupAccessRightsUpdate,
+): ...
+
+
+@router.delete(
+    "/functions/{function_id}/groups/{group_id}",
+    summary="Delete a Function Group",
+    status_code=status.HTTP_204_NO_CONTENT,
+)
+async def delete_function_group(
+    _path: Annotated[FunctionGroupPathParams, Depends()],
+): ...

packages/models-library/src/models_library/api_schemas_webserver/functions.py

@@ -5,7 +5,6 @@
 
 from ..functions import (
     Function,
-    FunctionAccessRights,
     FunctionBase,
     FunctionClass,
     FunctionClassSpecificData,
@@ -49,6 +48,7 @@
     UnsupportedFunctionClassError,
     UnsupportedFunctionFunctionJobClassCombinationError,
 )
+from ..groups import GroupID
 from ..projects import ProjectID
 from ._base import InputSchema, OutputSchema
 
@@ -114,11 +114,23 @@
 ]
 
 
+class FunctionGroupAccessRightsGet(OutputSchema):
+    read: bool
+    write: bool
+    execute: bool
+
+
+class FunctionGroupAccessRightsUpdate(InputSchema):
+    read: bool
+    write: bool
+    execute: bool
+
+
 class RegisteredSolverFunctionGet(RegisteredSolverFunction, OutputSchema):
     uid: Annotated[FunctionID, Field(alias="uuid")]
     created_at: Annotated[datetime.datetime, Field(alias="creationDate")]
     modified_at: Annotated[datetime.datetime, Field(alias="lastChangeDate")]
-    access_rights: FunctionAccessRights | None = None
+    access_rights: dict[GroupID, FunctionGroupAccessRightsGet]
     thumbnail: HttpUrl | None = None
 
 
@@ -127,7 +139,7 @@ class RegisteredProjectFunctionGet(RegisteredProjectFunction, OutputSchema):
     project_id: Annotated[ProjectID, Field(alias="templateId")]
     created_at: Annotated[datetime.datetime, Field(alias="creationDate")]
     modified_at: Annotated[datetime.datetime, Field(alias="lastChangeDate")]
-    access_rights: FunctionAccessRights | None = None
+    access_rights: dict[GroupID, FunctionGroupAccessRightsGet]
     thumbnail: HttpUrl | None = None
 
 

services/web/server/src/simcore_service_webserver/api/v0/openapi.yaml

@@ -3761,6 +3761,86 @@ paths:
       responses:
         '204':
           description: Successful Response
+  /v0/functions/{function_id}/groups:
+    get:
+      tags:
+      - functions
+      summary: Get Function Groups
+      operationId: get_function_groups
+      parameters:
+      - name: function_id
+        in: path
+        required: true
+        schema:
+          type: string
+          format: uuid
+          title: Function Id
+      responses:
+        '200':
+          description: Successful Response
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Envelope_dict_Annotated_int__Gt___FunctionGroupAccessRightsGet__'
+  /v0/functions/{function_id}/groups/{group_id}:
+    put:
+      tags:
+      - functions
+      summary: Create or update a Function Group
+      operationId: create_or_update_function_group
+      parameters:
+      - name: function_id
+        in: path
+        required: true
+        schema:
+          type: string
+          format: uuid
+          title: Function Id
+      - name: group_id
+        in: path
+        required: true
+        schema:
+          type: integer
+          exclusiveMinimum: true
+          title: Group Id
+          minimum: 0
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/FunctionGroupAccessRightsUpdate'
+      responses:
+        '200':
+          description: Successful Response
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Envelope_FunctionGroupAccessRightsGet_'
+    delete:
+      tags:
+      - functions
+      summary: Delete a Function Group
+      operationId: delete_function_group
+      parameters:
+      - name: function_id
+        in: path
+        required: true
+        schema:
+          type: string
+          format: uuid
+          title: Function Id
+      - name: group_id
+        in: path
+        required: true
+        schema:
+          type: integer
+          exclusiveMinimum: true
+          title: Group Id
+          minimum: 0
+      responses:
+        '204':
+          description: Successful Response
   /v0/tasks:
     get:
       tags:
@@ -10802,6 +10882,19 @@ components:
           title: Error
       type: object
       title: Envelope[FolderGet]
+    Envelope_FunctionGroupAccessRightsGet_:
+      properties:
+        data:
+          anyOf:
+          - $ref: '#/components/schemas/FunctionGroupAccessRightsGet'
+          - type: 'null'
+        error:
+          anyOf:
+          - {}
+          - type: 'null'
+          title: Error
+      type: object
+      title: Envelope[FunctionGroupAccessRightsGet]
     Envelope_GetProjectInactivityResponse_:
       properties:
         data:
@@ -11511,6 +11604,22 @@ components:
           title: Error
       type: object
       title: Envelope[_ProjectNodePreview]
+    Envelope_dict_Annotated_int__Gt___FunctionGroupAccessRightsGet__:
+      properties:
+        data:
+          anyOf:
+          - additionalProperties:
+              $ref: '#/components/schemas/FunctionGroupAccessRightsGet'
+            type: object
+          - type: 'null'
+          title: Data
+        error:
+          anyOf:
+          - {}
+          - type: 'null'
+          title: Error
+      type: object
+      title: Envelope[dict[Annotated[int, Gt], FunctionGroupAccessRightsGet]]
     Envelope_dict_Annotated_str__StringConstraints___ImageResources__:
       properties:
         data:
@@ -12632,23 +12741,40 @@ components:
       required:
       - name
       title: FolderReplaceBodyParams
-    FunctionAccessRights:
+    FunctionGroupAccessRightsGet:
       properties:
         read:
           type: boolean
           title: Read
-          default: false
         write:
           type: boolean
           title: Write
-          default: false
         execute:
           type: boolean
           title: Execute
-          default: false
-      additionalProperties: false
       type: object
-      title: FunctionAccessRights
+      required:
+      - read
+      - write
+      - execute
+      title: FunctionGroupAccessRightsGet
+    FunctionGroupAccessRightsUpdate:
+      properties:
+        read:
+          type: boolean
+          title: Read
+        write:
+          type: boolean
+          title: Write
+        execute:
+          type: boolean
+          title: Execute
+      type: object
+      required:
+      - read
+      - write
+      - execute
+      title: FunctionGroupAccessRightsUpdate
     GetProjectInactivityResponse:
       properties:
         is_inactive:
@@ -16463,9 +16589,10 @@ components:
           format: uuid
           title: Templateid
         accessRights:
-          anyOf:
-          - $ref: '#/components/schemas/FunctionAccessRights'
-          - type: 'null'
+          additionalProperties:
+            $ref: '#/components/schemas/FunctionGroupAccessRightsGet'
+          type: object
+          title: Accessrights
         thumbnail:
           anyOf:
           - type: string
@@ -16483,6 +16610,7 @@ components:
       - creationDate
       - lastChangeDate
       - templateId
+      - accessRights
       title: RegisteredProjectFunctionGet
     RegisteredSolverFunctionGet:
       properties:
@@ -16542,9 +16670,10 @@ components:
           pattern: ^(0|[1-9]\d*)(\.(0|[1-9]\d*)){2}(-(0|[1-9]\d*|\d*[-a-zA-Z][-\da-zA-Z]*)(\.(0|[1-9]\d*|\d*[-a-zA-Z][-\da-zA-Z]*))*)?(\+[-\da-zA-Z]+(\.[-\da-zA-Z-]+)*)?$
           title: Solverversion
         accessRights:
-          anyOf:
-          - $ref: '#/components/schemas/FunctionAccessRights'
-          - type: 'null'
+          additionalProperties:
+            $ref: '#/components/schemas/FunctionGroupAccessRightsGet'
+          type: object
+          title: Accessrights
         thumbnail:
           anyOf:
           - type: string
@@ -16563,6 +16692,7 @@ components:
       - lastChangeDate
       - solverKey
       - solverVersion
+      - accessRights
       title: RegisteredSolverFunctionGet
     ReplaceWalletAutoRecharge:
       properties: