diff --git a/backend/dataall/core/environment/services/environment_service.py b/backend/dataall/core/environment/services/environment_service.py index ea4cec5db..bbc0399a9 100644 --- a/backend/dataall/core/environment/services/environment_service.py +++ b/backend/dataall/core/environment/services/environment_service.py @@ -275,22 +275,14 @@ def invite_group(session, uri, data=None) -> (Environment, EnvironmentGroup): @staticmethod def validate_permissions(session, uri, g_permissions, group): + """ + g_permissions: coming from frontend = ENVIRONMENT_INVITATION_REQUEST + + """ if permissions.INVITE_ENVIRONMENT_GROUP in g_permissions: - g_permissions.append(permissions.LIST_ENVIRONMENT_GROUPS) g_permissions.append(permissions.REMOVE_ENVIRONMENT_GROUP) - if permissions.ADD_ENVIRONMENT_CONSUMPTION_ROLES in g_permissions: - g_permissions.append(permissions.LIST_ENVIRONMENT_CONSUMPTION_ROLES) - - if permissions.CREATE_NETWORK in g_permissions: - g_permissions.append(permissions.LIST_ENVIRONMENT_NETWORKS) - - g_permissions.append(permissions.GET_ENVIRONMENT) - g_permissions.append(permissions.LIST_ENVIRONMENT_GROUPS) - g_permissions.append(permissions.LIST_ENVIRONMENT_GROUP_PERMISSIONS) - g_permissions.append(permissions.LIST_ENVIRONMENT_NETWORKS) - g_permissions.append(permissions.CREDENTIALS_ENVIRONMENT) - + g_permissions.extend(permissions.ENVIRONMENT_INVITED_DEFAULT) g_permissions = list(set(g_permissions)) if g_permissions not in permissions.ENVIRONMENT_INVITED: diff --git a/backend/dataall/core/permissions/permissions.py b/backend/dataall/core/permissions/permissions.py index 8f94cde3b..702a98622 100644 --- a/backend/dataall/core/permissions/permissions.py +++ b/backend/dataall/core/permissions/permissions.py @@ -27,7 +27,6 @@ MANAGE_GLOSSARIES = 'MANAGE_GLOSSARIES' MANAGE_ENVIRONMENTS = 'MANAGE_ENVIRONMENTS' MANAGE_ORGANIZATIONS = 'MANAGE_ORGANIZATIONS' -MANAGE_SGMSTUDIO_NOTEBOOKS = 'MANAGE_SGMSTUDIO_NOTEBOOKS' """ ENVIRONMENT @@ -49,21 +48,23 @@ LIST_ENVIRONMENT_NETWORKS = 'LIST_ENVIRONMENT_NETWORKS' -ENVIRONMENT_INVITED = [ - LIST_ENVIRONMENT_GROUP_PERMISSIONS, - GET_ENVIRONMENT, - LIST_ENVIRONMENT_GROUPS, - LIST_ENVIRONMENT_CONSUMPTION_ROLES, - INVITE_ENVIRONMENT_GROUP, - ADD_ENVIRONMENT_CONSUMPTION_ROLES, - CREATE_NETWORK, - LIST_ENVIRONMENT_NETWORKS, -] ENVIRONMENT_INVITATION_REQUEST = [ INVITE_ENVIRONMENT_GROUP, ADD_ENVIRONMENT_CONSUMPTION_ROLES, CREATE_NETWORK, ] + +ENVIRONMENT_INVITED_DEFAULT = [ + GET_ENVIRONMENT, + LIST_ENVIRONMENT_GROUPS, + LIST_ENVIRONMENT_CONSUMPTION_ROLES, + LIST_ENVIRONMENT_GROUP_PERMISSIONS, + LIST_ENVIRONMENT_NETWORKS, + CREDENTIALS_ENVIRONMENT +] + +ENVIRONMENT_INVITED = (ENVIRONMENT_INVITED_DEFAULT + ENVIRONMENT_INVITATION_REQUEST) + ENVIRONMENT_ALL = [ UPDATE_ENVIRONMENT, GET_ENVIRONMENT, @@ -117,7 +118,6 @@ MANAGE_GROUPS, MANAGE_ENVIRONMENTS, MANAGE_ORGANIZATIONS, - MANAGE_SGMSTUDIO_NOTEBOOKS, ] TENANT_ALL_WITH_DESC = {k: k for k in TENANT_ALL} @@ -125,7 +125,6 @@ TENANT_ALL_WITH_DESC[MANAGE_ENVIRONMENTS] = 'Manage environments' TENANT_ALL_WITH_DESC[MANAGE_GROUPS] = 'Manage teams' TENANT_ALL_WITH_DESC[MANAGE_ORGANIZATIONS] = 'Manage organizations' -TENANT_ALL_WITH_DESC[MANAGE_SGMSTUDIO_NOTEBOOKS] = 'Manage ML studio notebooks' """ NETWORKS diff --git a/backend/dataall/modules/dataset_sharing/services/share_permissions.py b/backend/dataall/modules/dataset_sharing/services/share_permissions.py index 6e539f6bb..96b8e37df 100644 --- a/backend/dataall/modules/dataset_sharing/services/share_permissions.py +++ b/backend/dataall/modules/dataset_sharing/services/share_permissions.py @@ -1,8 +1,8 @@ """ SHARE OBJECT """ -from dataall.core.permissions.permissions import ENVIRONMENT_INVITED, ENVIRONMENT_INVITATION_REQUEST, ENVIRONMENT_ALL, RESOURCES_ALL, \ - RESOURCES_ALL_WITH_DESC +from dataall.core.permissions.permissions import ENVIRONMENT_INVITED, ENVIRONMENT_INVITATION_REQUEST, \ + ENVIRONMENT_INVITED_DEFAULT, ENVIRONMENT_ALL, RESOURCES_ALL, RESOURCES_ALL_WITH_DESC ADD_ITEM = 'ADD_ITEM' REMOVE_ITEM = 'REMOVE_ITEM' @@ -46,7 +46,7 @@ ENVIRONMENT_INVITED.append(CREATE_SHARE_OBJECT) ENVIRONMENT_INVITED.append(LIST_ENVIRONMENT_SHARED_WITH_OBJECTS) ENVIRONMENT_INVITATION_REQUEST.append(CREATE_SHARE_OBJECT) -ENVIRONMENT_INVITATION_REQUEST.append(LIST_ENVIRONMENT_SHARED_WITH_OBJECTS) +ENVIRONMENT_INVITED_DEFAULT.append(LIST_ENVIRONMENT_SHARED_WITH_OBJECTS) ENVIRONMENT_ALL.append(CREATE_SHARE_OBJECT) ENVIRONMENT_ALL.append(LIST_ENVIRONMENT_SHARED_WITH_OBJECTS) @@ -54,5 +54,5 @@ for perm in SHARE_OBJECT_ALL: RESOURCES_ALL_WITH_DESC[perm] = perm -RESOURCES_ALL_WITH_DESC[CREATE_SHARE_OBJECT] = 'Request datasets access for this environment' -RESOURCES_ALL_WITH_DESC[LIST_ENVIRONMENT_SHARED_WITH_OBJECTS] = "List datasets shared with this environments" +RESOURCES_ALL_WITH_DESC[CREATE_SHARE_OBJECT] = 'Create dataset Share requests for this environment' +RESOURCES_ALL_WITH_DESC[LIST_ENVIRONMENT_SHARED_WITH_OBJECTS] = 'LIST_ENVIRONMENT_SHARED_WITH_OBJECTS' diff --git a/backend/dataall/modules/datasets/services/dataset_permissions.py b/backend/dataall/modules/datasets/services/dataset_permissions.py index 7c9c3af3a..c6b8e1cf9 100644 --- a/backend/dataall/modules/datasets/services/dataset_permissions.py +++ b/backend/dataall/modules/datasets/services/dataset_permissions.py @@ -1,7 +1,7 @@ from itertools import chain from dataall.core.permissions.permissions import TENANT_ALL, TENANT_ALL_WITH_DESC, RESOURCES_ALL, RESOURCES_ALL_WITH_DESC, \ - ENVIRONMENT_INVITED, ENVIRONMENT_INVITATION_REQUEST, ENVIRONMENT_ALL + ENVIRONMENT_INVITED, ENVIRONMENT_INVITATION_REQUEST, ENVIRONMENT_INVITED_DEFAULT, ENVIRONMENT_ALL from dataall.modules.datasets_base.services.permissions import DATASET_TABLE_READ MANAGE_DATASETS = 'MANAGE_DATASETS' @@ -69,7 +69,7 @@ ENVIRONMENT_INVITED.append(LIST_ENVIRONMENT_DATASETS) ENVIRONMENT_INVITATION_REQUEST.append(CREATE_DATASET) -ENVIRONMENT_INVITATION_REQUEST.append(LIST_ENVIRONMENT_DATASETS) +ENVIRONMENT_INVITED_DEFAULT.append(LIST_ENVIRONMENT_DATASETS) ENVIRONMENT_ALL.append(CREATE_DATASET) ENVIRONMENT_ALL.append(LIST_ENVIRONMENT_DATASETS) @@ -82,4 +82,4 @@ RESOURCES_ALL_WITH_DESC[perm] = perm RESOURCES_ALL_WITH_DESC[CREATE_DATASET] = 'Create datasets on this environment' -RESOURCES_ALL_WITH_DESC[LIST_ENVIRONMENT_DATASETS] = "List datasets on this environment" +RESOURCES_ALL_WITH_DESC[LIST_ENVIRONMENT_DATASETS] = 'LIST_ENVIRONMENT_DATASETS' diff --git a/backend/dataall/modules/mlstudio/services/mlstudio_permissions.py b/backend/dataall/modules/mlstudio/services/mlstudio_permissions.py index 530c41838..77dad99aa 100644 --- a/backend/dataall/modules/mlstudio/services/mlstudio_permissions.py +++ b/backend/dataall/modules/mlstudio/services/mlstudio_permissions.py @@ -36,15 +36,11 @@ # Definition of ENVIRONMENT_PERMISSIONS for SageMaker ML Studio CREATE_SGMSTUDIO_USER = 'CREATE_SGMSTUDIO_USER' -# TODO: cleanup permissions = LIST_ENVIRONMENT_SGMSTUDIO_USERS and other LIST_ENVIRONMENT permissions -LIST_ENVIRONMENT_SGMSTUDIO_USERS = 'LIST_ENVIRONMENT_SGMSTUDIO_USERS' + ENVIRONMENT_ALL.append(CREATE_SGMSTUDIO_USER) -ENVIRONMENT_ALL.append(LIST_ENVIRONMENT_SGMSTUDIO_USERS) ENVIRONMENT_INVITED.append(CREATE_SGMSTUDIO_USER) -ENVIRONMENT_INVITED.append(LIST_ENVIRONMENT_SGMSTUDIO_USERS) ENVIRONMENT_INVITATION_REQUEST.append(CREATE_SGMSTUDIO_USER) -ENVIRONMENT_INVITATION_REQUEST.append(LIST_ENVIRONMENT_SGMSTUDIO_USERS) # Definition of RESOURCE_PERMISSIONS for SageMaker ML Studio GET_SGMSTUDIO_USER = 'GET_SGMSTUDIO_USER' @@ -61,7 +57,6 @@ RESOURCES_ALL.extend(SGMSTUDIO_USER_ALL) RESOURCES_ALL.append(CREATE_SGMSTUDIO_USER) -RESOURCES_ALL.append(LIST_ENVIRONMENT_SGMSTUDIO_USERS) RESOURCES_ALL_WITH_DESC[GET_SGMSTUDIO_USER] = "General permission to get a SageMaker Studio user" @@ -69,4 +64,3 @@ RESOURCES_ALL_WITH_DESC[DELETE_SGMSTUDIO_USER] = "Permission to delete a SageMaker Studio user" RESOURCES_ALL_WITH_DESC[SGMSTUDIO_USER_URL] = "Permission to generate the URL for a SageMaker Studio user" RESOURCES_ALL_WITH_DESC[CREATE_SGMSTUDIO_USER] = "Create SageMaker Studio users on this environment" -RESOURCES_ALL_WITH_DESC[LIST_ENVIRONMENT_SGMSTUDIO_USERS] = "List SageMaker Studio users on this environment" diff --git a/backend/dataall/modules/worksheets/services/worksheet_permissions.py b/backend/dataall/modules/worksheets/services/worksheet_permissions.py index b64678805..bb44893af 100644 --- a/backend/dataall/modules/worksheets/services/worksheet_permissions.py +++ b/backend/dataall/modules/worksheets/services/worksheet_permissions.py @@ -37,4 +37,4 @@ ENVIRONMENT_ALL.append(RUN_ATHENA_QUERY) RESOURCES_ALL.append(RUN_ATHENA_QUERY) -RESOURCES_ALL_WITH_DESC[RUN_ATHENA_QUERY] = "Run Athena queries on this environment" +RESOURCES_ALL_WITH_DESC[RUN_ATHENA_QUERY] = "Run Worksheet Athena queries on this environment" diff --git a/backend/migrations/versions/4a0618805341_rename_sgm_studio_permissions.py b/backend/migrations/versions/4a0618805341_rename_sgm_studio_permissions.py index 7cc3ab5df..508856d3e 100644 --- a/backend/migrations/versions/4a0618805341_rename_sgm_studio_permissions.py +++ b/backend/migrations/versions/4a0618805341_rename_sgm_studio_permissions.py @@ -30,6 +30,8 @@ UPDATE_SGMSTUDIO_NOTEBOOK = 'UPDATE_SGMSTUDIO_NOTEBOOK' DELETE_SGMSTUDIO_NOTEBOOK = 'DELETE_SGMSTUDIO_NOTEBOOK' SGMSTUDIO_NOTEBOOK_URL = 'SGMSTUDIO_NOTEBOOK_URL' +RUN_ATHENA_QUERY = 'RUN_ATHENA_QUERY' +CREATE_SHARE_OBJECT = 'CREATE_SHARE_OBJECT' OLD_PERMISSIONS = [ CREATE_SGMSTUDIO_NOTEBOOK, @@ -37,11 +39,14 @@ GET_SGMSTUDIO_NOTEBOOK, UPDATE_SGMSTUDIO_NOTEBOOK, DELETE_SGMSTUDIO_NOTEBOOK, - SGMSTUDIO_NOTEBOOK_URL + SGMSTUDIO_NOTEBOOK_URL, + RUN_ATHENA_QUERY, + CREATE_SHARE_OBJECT + ] old_permissions = {k: k for k in OLD_PERMISSIONS} old_permissions[CREATE_SGMSTUDIO_NOTEBOOK] = 'Create ML Studio profiles on this environment' - +old_permissions[CREATE_SHARE_OBJECT] = 'Request datasets access for this environment' CREATE_SGMSTUDIO_USER = 'CREATE_SGMSTUDIO_USER' LIST_ENVIRONMENT_SGMSTUDIO_USERS = 'LIST_ENVIRONMENT_SGMSTUDIO_USERS' @@ -50,6 +55,7 @@ UPDATE_SGMSTUDIO_USER = 'UPDATE_SGMSTUDIO_USER' DELETE_SGMSTUDIO_USER = 'DELETE_SGMSTUDIO_USER' SGMSTUDIO_USER_URL = 'SGMSTUDIO_USER_URL' +RUN_ATHENA_QUERY = 'RUN_ATHENA_QUERY' NEW_PERMISSIONS = [ CREATE_SGMSTUDIO_USER, @@ -57,10 +63,14 @@ GET_SGMSTUDIO_USER, UPDATE_SGMSTUDIO_USER, DELETE_SGMSTUDIO_USER, - SGMSTUDIO_USER_URL + SGMSTUDIO_USER_URL, + RUN_ATHENA_QUERY, + CREATE_SHARE_OBJECT ] new_permissions = {k: k for k in NEW_PERMISSIONS} new_permissions[CREATE_SGMSTUDIO_USER] = 'Create SageMaker Studio users on this environment' +new_permissions[RUN_ATHENA_QUERY] = 'Run Worksheet Athena queries on this environment' +new_permissions[CREATE_SHARE_OBJECT] = 'Create dataset Share requests for this environment' def upgrade(): @@ -68,6 +78,7 @@ def upgrade(): The script does the following migration: 1) create missing permissions MANAGE_SGMSTUDIO_USERS from MANAGE_NOTEBOOKS tenant permission 2) Rename SageMaker Studio permissions from SGMSTUDIO_NOTEBOOK to SGMSTUDIO_USER + and add description to RUN_ATHENA_QUERY and create share object 3) Rename sagemaker_studio_user_profile column names """ try: