Add product permissions to functions 🎨 🗃️

packages/models-library/src/models_library/functions.py

@@ -7,6 +7,7 @@
 from models_library.basic_regex import UUID_RE_BASE
 from models_library.basic_types import ConstrainedStr
 from models_library.groups import GroupID
+from models_library.products import ProductName
 from models_library.services_types import ServiceKey, ServiceVersion
 from models_library.users import UserID
 from pydantic import BaseModel, ConfigDict, Field
@@ -278,6 +279,7 @@ class FunctionGroupAccessRights(FunctionAccessRights):
 
 class FunctionAccessRightsDB(BaseModel):
     group_id: GroupID | None = None
+    product_name: ProductName | None = None
     read: bool = False
     write: bool = False
     execute: bool = False

packages/postgres-database/src/simcore_postgres_database/migration/versions/afb1ba08f3c2_add_functions_product_access.py

@@ -0,0 +1,83 @@
+"""Add functions product access
+
+Revision ID: afb1ba08f3c2
+Revises: 275642b33db0
+Create Date: 2025-05-30 14:24:46.198755+00:00
+
+"""
+
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision = "afb1ba08f3c2"
+down_revision = "275642b33db0"
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.add_column(
+        "funcapi_function_job_collections_access_rights",
+        sa.Column("product_name", sa.String(), nullable=False),
+    )
+    op.create_foreign_key(
+        "fk_func_access_to_products_product_name",
+        "funcapi_function_job_collections_access_rights",
+        "products",
+        ["product_name"],
+        ["name"],
+        onupdate="CASCADE",
+        ondelete="CASCADE",
+    )
+    op.add_column(
+        "funcapi_function_jobs_access_rights",
+        sa.Column("product_name", sa.String(), nullable=False),
+    )
+    op.create_foreign_key(
+        "fk_func_access_to_products_product_name",
+        "funcapi_function_jobs_access_rights",
+        "products",
+        ["product_name"],
+        ["name"],
+        onupdate="CASCADE",
+        ondelete="CASCADE",
+    )
+    op.add_column(
+        "funcapi_functions_access_rights",
+        sa.Column("product_name", sa.String(), nullable=False),
+    )
+    op.create_foreign_key(
+        "fk_func_access_to_products_product_name",
+        "funcapi_functions_access_rights",
+        "products",
+        ["product_name"],
+        ["name"],
+        onupdate="CASCADE",
+        ondelete="CASCADE",
+    )
+    # ### end Alembic commands ###
+
+
+def downgrade():
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.drop_constraint(
+        "fk_func_access_to_products_product_name",
+        "funcapi_functions_access_rights",
+        type_="foreignkey",
+    )
+    op.drop_column("funcapi_functions_access_rights", "product_name")
+    op.drop_constraint(
+        "fk_func_access_to_products_product_name",
+        "funcapi_function_jobs_access_rights",
+        type_="foreignkey",
+    )
+    op.drop_column("funcapi_function_jobs_access_rights", "product_name")
+    op.drop_constraint(
+        "fk_func_access_to_products_product_name",
+        "funcapi_function_job_collections_access_rights",
+        type_="foreignkey",
+    )
+    op.drop_column("funcapi_function_job_collections_access_rights", "product_name")
+    # ### end Alembic commands ###

packages/postgres-database/src/simcore_postgres_database/models/funcapi_function_job_collections_access_rights_table.py

@@ -32,9 +32,20 @@
             onupdate=RefActions.CASCADE,
             ondelete=RefActions.CASCADE,
         ),
-        nullable=True,
+        nullable=False,
         doc="Group id",
     ),
+    sa.Column(
+        "product_name",
+        sa.ForeignKey(
+            "products.name",
+            name="fk_func_access_to_products_product_name",
+            onupdate=RefActions.CASCADE,
+            ondelete=RefActions.CASCADE,
+        ),
+        nullable=False,
+        doc="Name of the product",
+    ),
     sa.Column(
         "read",
         sa.Boolean,
@@ -58,6 +69,7 @@
     sa.PrimaryKeyConstraint(
         "function_job_collection_uuid",
         "group_id",
+        "product_name",
         name="pk_func_access_to_func_job_colls_group",
     ),
 )

packages/postgres-database/src/simcore_postgres_database/models/funcapi_function_jobs_access_rights_table.py

@@ -35,6 +35,17 @@
         nullable=False,
         doc="Group id",
     ),
+    sa.Column(
+        "product_name",
+        sa.ForeignKey(
+            "products.name",
+            name="fk_func_access_to_products_product_name",
+            onupdate=RefActions.CASCADE,
+            ondelete=RefActions.CASCADE,
+        ),
+        nullable=False,
+        doc="Name of the product",
+    ),
     sa.Column(
         "read",
         sa.Boolean,
@@ -56,6 +67,9 @@
     column_created_datetime(),
     column_modified_datetime(),
     sa.PrimaryKeyConstraint(
-        "function_job_uuid", "group_id", name="pk_func_access_to_func_jobs_group"
+        "function_job_uuid",
+        "group_id",
+        "product_name",
+        name="pk_func_access_to_func_jobs_group",
     ),
 )

packages/postgres-database/src/simcore_postgres_database/models/funcapi_functions_access_rights_table.py

@@ -35,6 +35,17 @@
         nullable=False,
         doc="Group id",
     ),
+    sa.Column(
+        "product_name",
+        sa.ForeignKey(
+            "products.name",
+            name="fk_func_access_to_products_product_name",
+            onupdate=RefActions.CASCADE,
+            ondelete=RefActions.CASCADE,
+        ),
+        nullable=False,
+        doc="Name of the product",
+    ),
     sa.Column(
         "read",
         sa.Boolean,
@@ -56,6 +67,6 @@
     column_created_datetime(),
     column_modified_datetime(),
     sa.PrimaryKeyConstraint(
-        "function_uuid", "group_id", name="pk_func_access_to_func_group"
+        "function_uuid", "group_id", "product_name", name="pk_func_access_to_func_group"
     ),
 )