Skip to content

Commit

Permalink
catalog: study admins can update projects, #TASK-6322
Browse files Browse the repository at this point in the history
  • Loading branch information
pfurio committed May 29, 2024
1 parent d2fd1df commit 7bc1c23
Show file tree
Hide file tree
Showing 2 changed files with 62 additions and 1 deletion.
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@
import org.apache.commons.collections4.CollectionUtils;
import org.apache.commons.lang3.StringUtils;
import org.opencb.commons.datastore.core.Query;
import org.opencb.commons.datastore.core.QueryOptions;
import org.opencb.opencga.catalog.db.DBAdaptorFactory;
import org.opencb.opencga.catalog.db.api.*;
import org.opencb.opencga.catalog.exceptions.CatalogAuthorizationException;
Expand Down Expand Up @@ -79,7 +80,34 @@ public void checkCanEditProject(String organizationId, long projectId, String us
if (isAtLeastOrganizationOwnerOrAdmin(organizationId, userId)) {
return;
}
throw new CatalogAuthorizationException("Permission denied: Only the organization owner or administrators can update the project.");
try {
checkUserIsStudyAdminInAllStudiesOfProject(organizationId, projectId, userId);
} catch (CatalogException e) {
throw new CatalogAuthorizationException("Permission denied: Only the organization owner, administrators, or users who are "
+ "study administrators in all studies within the project can update the project.", e);
}
}

private void checkUserIsStudyAdminInAllStudiesOfProject(String organizationId, long projectUid, String userId) throws CatalogException {
Query query = new Query(StudyDBAdaptor.QueryParams.PROJECT_UID.key(), projectUid);
QueryOptions options = new QueryOptions(QueryOptions.INCLUDE,
Arrays.asList(StudyDBAdaptor.QueryParams.GROUPS.key(), StudyDBAdaptor.QueryParams.FQN.key()));
OpenCGAResult<Study> studyResult = dbAdaptorFactory.getCatalogStudyDBAdaptor(organizationId).get(query, options);
List<String> nonAdminStudyIds = new ArrayList<>();
for (Study study : studyResult.getResults()) {
for (Group group : study.getGroups()) {
if (group.getId().equals(ADMINS_GROUP)) {
if (!group.getUserIds().contains(userId)) {
nonAdminStudyIds.add(study.getFqn());
}
break;
}
}
}
if (!nonAdminStudyIds.isEmpty()) {
throw new CatalogAuthorizationException("Permission denied: User " + userId + " is not an administrator of the following"
+ " studies: " + String.join(", ", nonAdminStudyIds));
}
}

@Override
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -656,6 +656,39 @@ public void testModifyProject() throws CatalogException {
catalogManager.getProjectManager().update(project1, options, null, ownerToken);
}

@Test
public void updateProjectPermissionTest() throws CatalogException {
ObjectMap params = new ObjectMap()
.append(ProjectDBAdaptor.QueryParams.DESCRIPTION.key(), "my new description");
Project project = catalogManager.getProjectManager().update(project1, params, INCLUDE_RESULT, ownerToken).first();
assertEquals("my new description", project.getDescription());

params.put(ProjectDBAdaptor.QueryParams.DESCRIPTION.key(), "my new description 2");
project = catalogManager.getProjectManager().update(project1, params, INCLUDE_RESULT, orgAdminToken2).first();
assertEquals("my new description 2", project.getDescription());

params.put(ProjectDBAdaptor.QueryParams.DESCRIPTION.key(), "my new description 3");
project = catalogManager.getProjectManager().update(project1, params, INCLUDE_RESULT, studyAdminToken1).first();
assertEquals("my new description 3", project.getDescription());

// Make normalUser1 admin of first study
catalogManager.getStudyManager().updateGroup(studyFqn, ParamConstants.ADMINS_GROUP, ParamUtils.BasicUpdateAction.ADD,
new GroupUpdateParams(Collections.singletonList(normalUserId1)), ownerToken);
// And remove normalUser1 from the admins group of the second study (just in case)
catalogManager.getStudyManager().updateGroup(studyFqn2, ParamConstants.ADMINS_GROUP, ParamUtils.BasicUpdateAction.REMOVE,
new GroupUpdateParams(Collections.singletonList(normalUserId1)), ownerToken);

CatalogAuthorizationException catalogAuthorizationException = assertThrows(CatalogAuthorizationException.class,
() -> catalogManager.getProjectManager().update(project1, params, INCLUDE_RESULT, normalToken1));
assertFalse(catalogAuthorizationException.getCause().getMessage().contains(studyFqn));
assertTrue(catalogAuthorizationException.getCause().getMessage().contains(studyFqn2));

catalogAuthorizationException = assertThrows(CatalogAuthorizationException.class,
() -> catalogManager.getProjectManager().update(project1, params, INCLUDE_RESULT, normalToken2));
assertTrue(catalogAuthorizationException.getCause().getMessage().contains(studyFqn));
assertTrue(catalogAuthorizationException.getCause().getMessage().contains(studyFqn2));
}

@Test
public void updatePrivateParamsFromProjectTest() throws CatalogException {
catalogManager.getProjectManager().setDatastoreVariant(projectFqn1, new DataStore(), opencgaToken);
Expand Down

0 comments on commit 7bc1c23

Please sign in to comment.