added settings to reduce access to analytics component

CHANGELOG.md

@@ -11,6 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Ability to configure user agreements for the user registration form (https://github.com/opencv/cvat/pull/1464)
 - Added cuboid interpolation and cuboid drawing from rectangles (<https://github.com/opencv/cvat/pull/1560>)
 - Ability to configure custom pageViewHit, which can be useful for web analytics integration (https://github.com/opencv/cvat/pull/1566)
+- Ability to configure access to the analytics page based on roles (https://github.com/opencv/cvat/pull/1592)
 
 ### Changed
 - Downloaded file name in annotations export became more informative (https://github.com/opencv/cvat/pull/1352)

cvat/apps/log_viewer/views.py

@@ -1,10 +1,16 @@
 import os
+
 from revproxy.views import ProxyView
-from cvat.apps.authentication.decorators import login_required
 from django.utils.decorators import method_decorator
+from django.conf import settings
+from rules.contrib.views import PermissionRequiredMixin
+
+from cvat.apps.authentication.decorators import login_required
 
 @method_decorator(login_required, name='dispatch')
-class LogViewerProxy(ProxyView):
+class LogViewerProxy(PermissionRequiredMixin, ProxyView):
+ permission_required = settings.RESTRICTIONS['analytics_access']
+
  upstream = 'http://{}:{}'.format(os.getenv('DJANGO_LOG_VIEWER_HOST'),
  os.getenv('DJANGO_LOG_VIEWER_PORT'))
  add_remote_user = True

cvat/settings/base.py

@@ -409,11 +409,19 @@ def generate_ssh_keys():
 sys.path.append(DATUMARO_PATH)
 
 RESTRICTIONS = {
- "user_agreements": [],
+ 'user_agreements': [],
 
  # this setting limits the number of tasks for the user
- "task_limit": None,
-
- # this settings reduse task visibility to owner and assignee only
- "reduce_task_visibility": False,
+ 'task_limit': None,
+
+ # this setting reduse task visibility to owner and assignee only
+ 'reduce_task_visibility': False,
+
+ # allow access to analytics component to users with the following roles
+ 'analytics_access': (
+ 'engine.role.observer',
+ 'engine.role.annotator',
+ 'engine.role.user',
+ 'engine.role.admin',
+ ),
 }