feat: create new DOAPs (RDU-11) (#128)

dsp_permissions_scripts/doap/doap_model.py

@@ -38,6 +38,27 @@ def assert_correct_combination(self) -> Self:
         return self
 
 
+class NewDoapTarget(BaseModel):
+    """Represents the target of a DOAP that is yet to be created."""
+
+    group: Group | None = None
+    resource_class: str | None = None
+    property: str | None = None
+
+    @model_validator(mode="after")
+    def assert_correct_combination(self) -> Self:
+        # asserts that DOAP is only defined for Group or ResourceClass or Property
+        # or a combination of ResourceClass and Property
+        match (self.group, self.resource_class, self.property):
+            case (None, None, None):
+                raise ValueError("At least one of group, resource_class or property must be set")
+            case (_, None, None) | (None, _, _):
+                pass
+            case _:
+                raise ValueError("Invalid combination of group, resource_class and property")
+        return self
+
+
 class DoapTargetType(Enum):
     ALL = "all"
     GROUP = "group"

dsp_permissions_scripts/doap/doap_set.py

@@ -2,10 +2,13 @@
 
 from dsp_permissions_scripts.doap.doap_get import create_doap_from_admin_route_response
 from dsp_permissions_scripts.doap.doap_model import Doap
+from dsp_permissions_scripts.doap.doap_model import NewDoapTarget
 from dsp_permissions_scripts.models.errors import ApiError
 from dsp_permissions_scripts.models.scope import PermissionScope
 from dsp_permissions_scripts.utils.dsp_client import DspClient
 from dsp_permissions_scripts.utils.get_logger import get_logger
+from dsp_permissions_scripts.utils.helpers import KNORA_ADMIN_ONTO_NAMESPACE
+from dsp_permissions_scripts.utils.project import get_project_iri_and_onto_iris_by_shortcode
 from dsp_permissions_scripts.utils.scope_serialization import create_admin_route_object_from_scope
 
 logger = get_logger(__name__)
@@ -35,3 +38,26 @@ def apply_updated_scopes_of_doaps_on_server(doaps: list[Doap], host: str, dsp_cl
         except ApiError as err:
             logger.error(err)
     logger.info(f"Finished updating scopes of {len(doaps)} DOAPs on {host}")
+
+
+def create_new_doap_on_server(
+    target: NewDoapTarget,
+    shortcode: str,
+    scope: PermissionScope,
+    dsp_client: DspClient,
+) -> Doap | None:
+    proj_iri, _ = get_project_iri_and_onto_iris_by_shortcode(shortcode, dsp_client)
+    payload = {
+        "forGroup": target.group.val.replace("knora-admin:", KNORA_ADMIN_ONTO_NAMESPACE) if target.group else None,
+        "forProject": proj_iri,
+        "forProperty": target.property,
+        "forResourceClass": target.resource_class,
+        "hasPermissions": create_admin_route_object_from_scope(scope),
+    }
+    try:
+        response = dsp_client.post("/admin/permissions/doap", data=payload)
+        logger.info(f"Successfully created new DOAP for target {target}")
+        return create_doap_from_admin_route_response(response["default_object_access_permission"])
+    except ApiError:
+        logger.error(f"Could not create new DOAP for target {target}")
+        return None

dsp_permissions_scripts/template.py

@@ -9,11 +9,14 @@
 from dsp_permissions_scripts.ap.ap_set import create_new_ap_on_server
 from dsp_permissions_scripts.doap.doap_get import get_doaps_of_project
 from dsp_permissions_scripts.doap.doap_model import Doap
+from dsp_permissions_scripts.doap.doap_model import NewDoapTarget
 from dsp_permissions_scripts.doap.doap_serialize import serialize_doaps_of_project
 from dsp_permissions_scripts.doap.doap_set import apply_updated_scopes_of_doaps_on_server
+from dsp_permissions_scripts.doap.doap_set import create_new_doap_on_server
 from dsp_permissions_scripts.models import group
 from dsp_permissions_scripts.models.host import Hosts
 from dsp_permissions_scripts.models.scope import PUBLIC
+from dsp_permissions_scripts.models.scope import PermissionScope
 from dsp_permissions_scripts.oap.oap_get import get_all_oaps_of_project
 from dsp_permissions_scripts.oap.oap_model import Oap
 from dsp_permissions_scripts.oap.oap_model import OapRetrieveConfig
@@ -108,6 +111,12 @@ def update_doaps(host: str, shortcode: str, dsp_client: DspClient) -> None:
         mode="original",
         host=host,
     )
+    _ = create_new_doap_on_server(
+        target=NewDoapTarget(group=group.CREATOR),
+        shortcode=shortcode,
+        scope=PermissionScope.create(CR=[group.SYSTEM_ADMIN]),
+        dsp_client=dsp_client,
+    )
     project_doaps_modified = modify_doaps(doaps=project_doaps)
     if not project_doaps_modified:
         logger.info("There are no DOAPs to update.")

tests/test_doap_set.py

@@ -0,0 +1,66 @@
+from typing import Any
+from unittest.mock import Mock
+
+import pytest
+
+from dsp_permissions_scripts.doap import doap_set
+from dsp_permissions_scripts.doap.doap_model import NewDoapTarget
+from dsp_permissions_scripts.doap.doap_set import create_new_doap_on_server
+from dsp_permissions_scripts.models import group
+from dsp_permissions_scripts.models.scope import PermissionScope
+
+
+@pytest.fixture()
+def create_new_doap_request() -> dict[str, Any]:
+    return {
+        "forGroup": "http://www.knora.org/ontology/knora-admin#KnownUser",
+        "forProject": "http://rdfh.ch/projects/P7Uo3YvDT7Kvv3EvLCl2tw",
+        "forProperty": None,
+        "forResourceClass": None,
+        "hasPermissions": [
+            {
+                "additionalInformation": "http://www.knora.org/ontology/knora-admin#UnknownUser",
+                "name": "V",
+                "permissionCode": None,
+            }
+        ],
+    }
+
+
+@pytest.fixture()
+def create_new_doap_response() -> dict[str, Any]:
+    return {
+        "default_object_access_permission": {
+            "iri": "http://rdfh.ch/permissions/4123/grKNPv-tQ7aBYq0mDXyatg",
+            "forProject": "http://rdfh.ch/projects/P7Uo3YvDT7Kvv3EvLCl2tw",
+            "forGroup": "http://www.knora.org/ontology/knora-admin#KnownUser",
+            "hasPermissions": [
+                {
+                    "name": "V",
+                    "additionalInformation": "http://www.knora.org/ontology/knora-admin#UnknownUser",
+                    "permissionCode": 2,
+                }
+            ],
+        }
+    }
+
+
+def test_create_new_doap_on_server(
+    create_new_doap_request: dict[str, Any], create_new_doap_response: dict[str, Any]
+) -> None:
+    doap_set.get_project_iri_and_onto_iris_by_shortcode = Mock(  # type: ignore[attr-defined]
+        return_value=("http://rdfh.ch/projects/P7Uo3YvDT7Kvv3EvLCl2tw", None)
+    )
+    doap_set.create_doap_from_admin_route_response = Mock()  # type: ignore[attr-defined]
+    dsp_client = Mock()
+    dsp_client.post = Mock(return_value=create_new_doap_response)
+    _ = create_new_doap_on_server(
+        target=NewDoapTarget(group=group.KNOWN_USER),
+        shortcode="0000",
+        scope=PermissionScope.create(V={group.UNKNOWN_USER}),
+        dsp_client=dsp_client,
+    )
+    dsp_client.post.assert_called_once_with("/admin/permissions/doap", data=create_new_doap_request)
+    doap_set.create_doap_from_admin_route_response.assert_called_once_with(  # type: ignore[attr-defined]
+        create_new_doap_response["default_object_access_permission"]
+    )