use bulk job to set project ACLs (#1446)

designsafe/apps/api/projects_v2/operations/project_system_operations.py

@@ -155,41 +155,46 @@ def setup_project_file_system(project_uuid: str, users: list[str]):
  # User creates the system and adds their credential
  resp = create_workspace_system(service_client, project_uuid)
 
- for username in users:
- add_user_to_project_async.apply_async(args=[project_uuid, username])
+ # Add tg458981 to ensure it can read externally transferred data
+ acl_users = ["tg458981", *users]
+
+ add_users_to_project_async.apply_async(args=[project_uuid, acl_users])
 
  return resp
 
 
-def add_user_to_project(project_uuid: str, username: str, set_acls=True):
+def add_user_to_project(project_uuid: str, username: str):
  """
  Give a user POSIX and Tapis permissions on a workspace system.
  """
  service_client = service_account()
  system_id = f"project-{project_uuid}"
  logger.debug("Adding user %s to system %s", username, system_id)
- if set_acls:
- job_res = submit_workspace_acls_job(username, project_uuid, action="add")
- logger.debug(
- "Submitted workspace ACL job %s with UUID %s", job_res.name, job_res.uuid
- )
+
  service_client.systems.shareSystem(systemId=system_id, users=[username])
  set_workspace_permissions(service_client, username, system_id, role="writer")
 
  return project_uuid
 
 
+def add_users_to_project(project_uuid: str, usernames: list[str]):
+ """Add multiple users to a project and set their ACLs using a single Tapis job."""
+ for username in usernames:
+ add_user_to_project(project_uuid, username)
+
+ job_res = submit_workspace_acls_job(",".join(usernames), project_uuid, action="add")
+ logger.debug(
+ "Submitted workspace ACL job %s with UUID %s", job_res.name, job_res.uuid
+ )
+
+
 def remove_user_from_project(project_uuid: str, username: str):
  """
  Unshare the system and remove all permissions and credentials.
  """
  service_client = service_account()
  system_id = f"project-{project_uuid}"
  logger.debug("Removing user %s from system %s", username, system_id)
- job_res = submit_workspace_acls_job(username, project_uuid, action="remove")
- logger.debug(
- "Submitted workspace ACL job %s with UUID %s", job_res.name, job_res.uuid
- )
 
  service_client.systems.unShareSystem(systemId=system_id, users=[username])
  service_client.systems.revokeUserPerms(
@@ -202,20 +207,33 @@ def remove_user_from_project(project_uuid: str, username: str):
  return project_uuid
 
 
+def remove_users_from_project(project_uuid: str, usernames: list[str]):
+ """Remove multiple users from project, setting ACLs using a single Tapis job."""
+ for username in usernames:
+ remove_user_from_project(project_uuid, username)
+
+ acl_usernames = ",".join(usernames)
+
+ job_res = submit_workspace_acls_job(acl_usernames, project_uuid, action="remove")
+ logger.debug(
+ "Submitted workspace ACL job %s with UUID %s", job_res.name, job_res.uuid
+ )
+
+
 ##########################################
 # ASYNC TASKS FOR USER ADDITION/REMOVAL
 ##########################################
 
 
 @shared_task(bind=True)
-def add_user_to_project_async(self, project_uuid: str, username: str):
+def add_users_to_project_async(self, project_uuid: str, usernames: list[str]):
  """Async wrapper around add_user_to_project"""
  with AsyncTaskContext():
- add_user_to_project(project_uuid, username)
+ add_users_to_project(project_uuid, usernames)
 
 
 @shared_task(bind=True)
-def remove_user_from_project_async(self, project_uuid: str, username: str):
+def remove_users_from_project_async(self, project_uuid: str, usernames: str):
  """Async wrapper around remove_user_from_project"""
  with AsyncTaskContext():
- remove_user_from_project(project_uuid, username)
+ remove_users_from_project(project_uuid, usernames)

designsafe/apps/api/projects_v2/tasks.py

@@ -7,8 +7,8 @@
 
 # pylint: disable=unused-import
 from designsafe.apps.api.projects_v2.operations.project_system_operations import (
- add_user_to_project_async,
- remove_user_from_project_async,
+ add_users_to_project_async,
+ remove_users_from_project_async,
 )
 from designsafe.apps.api.projects_v2.models.project_metadata import ProjectMetadata
 from designsafe.apps.api.projects_v2.operations.project_publish_operations import (

designsafe/apps/api/projects_v2/views.py

@@ -41,8 +41,8 @@
 from designsafe.apps.api.projects_v2.operations.project_system_operations import (
  increment_workspace_count,
  setup_project_file_system,
- add_user_to_project_async,
- remove_user_from_project_async,
+ add_users_to_project_async,
+ remove_users_from_project_async,
 )
 from designsafe.apps.api.projects_v2.schema_models.base import FileObj
 from designsafe.apps.api.decorators import tapis_jwt_login
@@ -176,10 +176,10 @@ def put(self, request: HttpRequest, project_id: str):
  BaseProject.model_validate(project.value),
  BaseProject.model_validate(updated_project.value),
  )
- for user_to_add in users_to_add:
- add_user_to_project_async.apply_async([project.uuid, user_to_add])
- for user_to_remove in users_to_remove:
- remove_user_from_project_async.apply_async([project.uuid, user_to_remove])
+ if users_to_add:
+ add_users_to_project_async.apply_async([project.uuid, users_to_add])
+ if users_to_remove:
+ remove_users_from_project_async.apply_async([project.uuid, users_to_remove])
 
  return JsonResponse({"result": "OK"})
 
@@ -207,10 +207,10 @@ def patch(self, request: HttpRequest, project_id: str):
  users_to_add, users_to_remove = get_changed_users(
  prev_metadata, updated_metadata
  )
- for user_to_add in users_to_add:
- add_user_to_project_async.apply_async([project.uuid, user_to_add])
- for user_to_remove in users_to_remove:
- remove_user_from_project_async.apply_async([project.uuid, user_to_remove])
+ if users_to_add:
+ add_users_to_project_async.apply_async([project.uuid, users_to_add])
+ if users_to_remove:
+ remove_users_from_project_async.apply_async([project.uuid, users_to_remove])
 
  return JsonResponse({"result": "OK"})