Function user permissions ✨ 🗃️ (#7764)

Author: wvangeit

packages/models-library/src/models_library/api_schemas_api_server/functions.py

@@ -5,20 +5,16 @@
     FunctionClass,
     FunctionClassSpecificData,
     FunctionID,
-    FunctionIDNotFoundError,
     FunctionInputs,
     FunctionInputSchema,
     FunctionInputsList,
-    FunctionInputsValidationError,
     FunctionJob,
     FunctionJobClassSpecificData,
     FunctionJobCollection,
     FunctionJobCollectionID,
-    FunctionJobCollectionIDNotFoundError,
     FunctionJobCollectionsListFilters,
     FunctionJobCollectionStatus,
     FunctionJobID,
-    FunctionJobIDNotFoundError,
     FunctionJobStatus,
     FunctionOutputs,
     FunctionOutputSchema,
@@ -34,6 +30,12 @@
     RegisteredProjectFunctionJob,
     SolverFunction,
     SolverFunctionJob,
+)
+from ..functions_errors import (
+    FunctionIDNotFoundError,
+    FunctionInputsValidationError,
+    FunctionJobCollectionIDNotFoundError,
+    FunctionJobIDNotFoundError,
     UnsupportedFunctionClassError,
     UnsupportedFunctionFunctionJobClassCombinationError,
 )

packages/models-library/src/models_library/api_schemas_webserver/functions.py

@@ -8,20 +8,17 @@
     FunctionClass,
     FunctionClassSpecificData,
     FunctionID,
-    FunctionIDNotFoundError,
+    FunctionIDString,
     FunctionInputs,
     FunctionInputSchema,
     FunctionInputsList,
-    FunctionInputsValidationError,
     FunctionJob,
     FunctionJobClassSpecificData,
     FunctionJobCollection,
     FunctionJobCollectionID,
-    FunctionJobCollectionIDNotFoundError,
     FunctionJobCollectionsListFilters,
     FunctionJobCollectionStatus,
     FunctionJobID,
-    FunctionJobIDNotFoundError,
     FunctionJobStatus,
     FunctionOutputs,
     FunctionOutputSchema,
@@ -39,6 +36,13 @@
     RegisteredSolverFunction,
     SolverFunction,
     SolverFunctionJob,
+)
+from ..functions_errors import (
+    FunctionIDNotFoundError,
+    FunctionInputsValidationError,
+    FunctionJobCollectionIDNotFoundError,
+    FunctionJobIDNotFoundError,
+    FunctionReadAccessDeniedError,
     UnsupportedFunctionClassError,
     UnsupportedFunctionFunctionJobClassCombinationError,
 )
@@ -54,6 +58,7 @@
     "FunctionID",
     "FunctionIDNotFoundError",
     "FunctionIDNotFoundError",
+    "FunctionIDString",
     "FunctionInputSchema",
     "FunctionInputs",
     "FunctionInputs",
@@ -80,6 +85,7 @@
     "FunctionJobStatus",
     "FunctionOutputSchema",
     "FunctionOutputs",
+    "FunctionReadAccessDeniedError",
     "FunctionSchemaClass",
     "FunctionToRegister",
     "FunctionToRegister",

packages/models-library/src/models_library/functions.py

@@ -3,14 +3,16 @@
 from typing import Annotated, Any, Literal, TypeAlias
 from uuid import UUID
 
-from common_library.errors_classes import OsparcErrorMixin
 from models_library import projects
 from models_library.basic_regex import UUID_RE_BASE
 from models_library.basic_types import ConstrainedStr
+from models_library.groups import GroupID
 from models_library.services_types import ServiceKey, ServiceVersion
-from pydantic import BaseModel, Field
+from models_library.users import UserID
+from pydantic import BaseModel, ConfigDict, Field
 
 from .projects import ProjectID
+from .utils.change_case import snake_to_camel
 
 FunctionID: TypeAlias = UUID
 FunctionJobID: TypeAlias = UUID
@@ -207,40 +209,6 @@ class FunctionJobCollectionStatus(BaseModel):
     status: list[str]
 
 
-class FunctionBaseError(OsparcErrorMixin, Exception):
-    pass
-
-
-class FunctionIDNotFoundError(FunctionBaseError):
-    msg_template: str = "Function {function_id} not found"
-
-
-class FunctionJobIDNotFoundError(FunctionBaseError):
-    msg_template: str = "Function job {function_job_id} not found"
-
-
-class FunctionJobCollectionIDNotFoundError(FunctionBaseError):
-    msg_template: str = "Function job collection {function_job_collection_id} not found"
-
-
-class UnsupportedFunctionClassError(FunctionBaseError):
-    msg_template: str = "Function class {function_class} is not supported"
-
-
-class UnsupportedFunctionJobClassError(FunctionBaseError):
-    msg_template: str = "Function job class {function_job_class} is not supported"
-
-
-class UnsupportedFunctionFunctionJobClassCombinationError(FunctionBaseError):
-    msg_template: str = (
-        "Function class {function_class} and function job class {function_job_class} combination is not supported"
-    )
-
-
-class FunctionInputsValidationError(FunctionBaseError):
-    msg_template: str = "Function inputs validation failed: {error}"
-
-
 class FunctionJobDB(BaseModel):
     function_uuid: FunctionID
     title: str = ""
@@ -286,3 +254,47 @@ class FunctionJobCollectionsListFilters(BaseModel):
     """Filters for listing function job collections"""
 
     has_function_id: FunctionIDString | None = None
+
+
+class FunctionAccessRights(BaseModel):
+    read: bool = False
+    write: bool = False
+    execute: bool = False
+
+    model_config = ConfigDict(
+        alias_generator=snake_to_camel,
+        populate_by_name=True,
+        extra="forbid",
+    )
+
+
+class FunctionUserAccessRights(FunctionAccessRights):
+    user_id: UserID
+
+
+class FunctionGroupAccessRights(FunctionAccessRights):
+    group_id: GroupID
+
+
+class FunctionAccessRightsDB(BaseModel):
+    group_id: GroupID | None = None
+    read: bool = False
+    write: bool = False
+    execute: bool = False
+
+    model_config = ConfigDict(
+        alias_generator=snake_to_camel,
+        populate_by_name=True,
+        extra="forbid",
+    )
+
+
+FunctionJobAccessRights: TypeAlias = FunctionAccessRights
+FunctionJobAccessRightsDB: TypeAlias = FunctionAccessRightsDB
+FunctionJobUserAccessRights: TypeAlias = FunctionUserAccessRights
+FunctionJobGroupAccessRights: TypeAlias = FunctionGroupAccessRights
+
+FunctionJobCollectionAccessRights: TypeAlias = FunctionAccessRights
+FunctionJobCollectionAccessRightsDB: TypeAlias = FunctionAccessRightsDB
+FunctionJobCollectionUserAccessRights: TypeAlias = FunctionUserAccessRights
+FunctionJobCollectionGroupAccessRights: TypeAlias = FunctionGroupAccessRights

packages/models-library/src/models_library/functions_errors.py

@@ -0,0 +1,85 @@
+from common_library.errors_classes import OsparcErrorMixin
+
+
+class FunctionBaseError(OsparcErrorMixin, Exception):
+    pass
+
+
+class FunctionJobReadAccessDeniedError(FunctionBaseError):
+    msg_template: str = (
+        "Function job {function_job_id} read access denied for user {user_id}"
+    )
+
+
+class FunctionIDNotFoundError(FunctionBaseError):
+    msg_template: str = "Function {function_id} not found"
+
+
+class FunctionJobIDNotFoundError(FunctionBaseError):
+    msg_template: str = "Function job {function_job_id} not found"
+
+
+class FunctionInputsValidationError(FunctionBaseError):
+    msg_template: str = "Function inputs validation failed: {error}"
+
+
+class FunctionReadAccessDeniedError(FunctionBaseError):
+    msg_template: str = "Function {function_id} read access denied for user {user_id}"
+
+
+class FunctionJobCollectionIDNotFoundError(FunctionBaseError):
+    msg_template: str = "Function job collection {function_job_collection_id} not found"
+
+
+class UnsupportedFunctionClassError(FunctionBaseError):
+    msg_template: str = "Function class {function_class} is not supported"
+
+
+class UnsupportedFunctionJobClassError(FunctionBaseError):
+    msg_template: str = "Function job class {function_job_class} is not supported"
+
+
+class UnsupportedFunctionFunctionJobClassCombinationError(FunctionBaseError):
+    msg_template: str = (
+        "Function class {function_class} and function job class {function_job_class} combination is not supported"
+    )
+
+
+class FunctionJobCollectionReadAccessDeniedError(FunctionBaseError):
+    msg_template: str = (
+        "Function job collection {function_job_collection_id} read access denied for user {user_id}"
+    )
+
+
+class FunctionWriteAccessDeniedError(FunctionBaseError):
+    msg_template: str = "Function {function_id} write access denied for user {user_id}"
+
+
+class FunctionJobWriteAccessDeniedError(FunctionBaseError):
+    msg_template: str = (
+        "Function job {function_job_id} write access denied for user {user_id}"
+    )
+
+
+class FunctionJobCollectionWriteAccessDeniedError(FunctionBaseError):
+    msg_template: str = (
+        "Function job collection {function_job_collection_id} write access denied for user {user_id}"
+    )
+
+
+class FunctionExecuteAccessDeniedError(FunctionBaseError):
+    msg_template: str = (
+        "Function {function_id} execute access denied for user {user_id}"
+    )
+
+
+class FunctionJobExecuteAccessDeniedError(FunctionBaseError):
+    msg_template: str = (
+        "Function job {function_job_id} execute access denied for user {user_id}"
+    )
+
+
+class FunctionJobCollectionExecuteAccessDeniedError(FunctionBaseError):
+    msg_template: str = (
+        "Function job collection {function_job_collection_id} execute access denied for user {user_id}"
+    )