diff --git a/config.py b/config.py index fd88dfc2..a546f8e7 100644 --- a/config.py +++ b/config.py @@ -27,9 +27,6 @@ class Config: access_token_url="https://github.com/login/oauth/access_token", access_token_params=None, authorize_url="https://github.com/login/oauth/authorize", - # authorize_params={ - # "state": uuid4().hex, - # }, authorize_params=None, api_base_url="https://api.github.com/", client_kwargs={"scope": "user:email"}, diff --git a/middleware/access_logic.py b/middleware/access_logic.py index a1c2335e..a715becd 100644 --- a/middleware/access_logic.py +++ b/middleware/access_logic.py @@ -146,7 +146,9 @@ def get_access_info(token: str): except Exception: return None return get_jwt_access_info_with_permissions( - user_email=simple_jwt.sub["user_email"], user_id=simple_jwt.sub["id"] + user_email=simple_jwt.sub["user_email"], + user_id=simple_jwt.sub["id"], + permissions_raw_str=simple_jwt.sub["permissions"], ) @@ -179,8 +181,13 @@ def decode_jwt_with_purpose(token: str, purpose: JWTPurpose): ) -def get_jwt_access_info_with_permissions(user_email, user_id): - permissions = get_user_permissions(user_email) +def get_jwt_access_info_with_permissions( + user_email, user_id, permissions_raw_str: list[str] +): + permissions = [] + for permission_raw_str in permissions_raw_str: + permission = PermissionsEnum(permission_raw_str) + permissions.append(permission) return AccessInfoPrimary( user_email=user_email, user_id=user_id, diff --git a/middleware/enums.py b/middleware/enums.py index f39bdb8d..944d6e57 100644 --- a/middleware/enums.py +++ b/middleware/enums.py @@ -19,6 +19,7 @@ class PermissionsEnum(Enum): DB_WRITE = "db_write" READ_ALL_USER_INFO = "read_all_user_info" NOTIFICATIONS = "notifications" + SOURCE_COLLECTOR = "source_collector" @classmethod def values(cls): diff --git a/middleware/primary_resource_logic/login_queries.py b/middleware/primary_resource_logic/login_queries.py index 14a6c103..2ab2ffe9 100644 --- a/middleware/primary_resource_logic/login_queries.py +++ b/middleware/primary_resource_logic/login_queries.py @@ -22,9 +22,13 @@ class JWTAccessRefreshTokens: def __init__(self, email: str): + db_client = DatabaseClient() + user_id = db_client.get_user_id(email) + permissions = db_client.get_user_permissions(user_id) identity = { + "id": db_client.get_user_id(email), "user_email": email, - "id": DatabaseClient().get_user_id(email), + "permissions": [permission.value for permission in permissions], } simple_jwt = SimpleJWT( sub=identity, @@ -32,10 +36,6 @@ def __init__(self, email: str): purpose=JWTPurpose.STANDARD_ACCESS_TOKEN, ) self.access_token = simple_jwt.encode() - # self.access_token = create_access_token( - # identity=identity, - # additional_claims={"purpose": JWTPurpose.STANDARD_ACCESS_TOKEN.value}, - # ) self.refresh_token = create_refresh_token(identity=identity) diff --git a/requirements.txt b/requirements.txt index a9a606f6..ffda286d 100644 --- a/requirements.txt +++ b/requirements.txt @@ -37,7 +37,7 @@ packaging==23.1 pathy==0.10.2 pluggy==1.5.0 preshed==3.0.8 -psycopg~=3.2 +psycopg[binary, pool]~=3.2 py==1.11.0 pycparser==2.21 pydantic==2.10.2 diff --git a/resources/CreateTestUserWithElevatedPermissions.py b/resources/CreateTestUserWithElevatedPermissions.py index a1bc189b..30b53429 100644 --- a/resources/CreateTestUserWithElevatedPermissions.py +++ b/resources/CreateTestUserWithElevatedPermissions.py @@ -97,6 +97,8 @@ def post(self): for permission in [ PermissionsEnum.READ_ALL_USER_INFO, PermissionsEnum.DB_WRITE, + PermissionsEnum.NOTIFICATIONS, + PermissionsEnum.SOURCE_COLLECTOR, ]: db_client.add_user_permission( user_id=db_client.get_user_id(email=auto_user_email), diff --git a/tests/integration/test_data_requests.py b/tests/integration/test_data_requests.py index b6852a59..1eada3ec 100644 --- a/tests/integration/test_data_requests.py +++ b/tests/integration/test_data_requests.py @@ -90,13 +90,10 @@ def test_data_requests_get( assert len(data) == 2 - # Give user admin permission - tdc.db_client.add_user_permission( - user_id=tus_creator.user_info.user_id, permission=PermissionsEnum.DB_WRITE - ) + # Check that admin can pull more columns admin_data = tdc.request_validator.get_data_requests( - headers=tus_creator.jwt_authorization_header, + headers=tdc.get_admin_tus().jwt_authorization_header, )[DATA_KEY] # Assert admin columns are greater than user columns