feat: add share reason in share requests

backend/dataall/api/Objects/ShareObject/input_types.py

@@ -8,6 +8,7 @@
         gql.Argument(name='groupUri', type=gql.NonNullableType(gql.String)),
         gql.Argument(name='principalId', type=gql.NonNullableType(gql.String)),
         gql.Argument(name='principalType', type=gql.NonNullableType(gql.String)),
+        gql.Argument(name='requestPurpose', type=gql.String),
     ],
 )
 

backend/dataall/api/Objects/ShareObject/mutations.py

@@ -56,7 +56,10 @@
 
 rejectShareObject = gql.MutationField(
     name='rejectShareObject',
-    args=[gql.Argument(name='shareUri', type=gql.NonNullableType(gql.String))],
+    args=[
+        gql.Argument(name='shareUri', type=gql.NonNullableType(gql.String)),
+        gql.Argument(name='rejectPurpose', type=gql.String),
+    ],
     type=gql.Ref('ShareObject'),
     resolver=reject_share_object,
 )
@@ -67,3 +70,24 @@
     type=gql.Ref('ShareObject'),
     resolver=revoke_items_share_object,
 )
+
+updateShareRejectReason = gql.MutationField(
+    name='updateShareRejectReason',
+    args=[
+        gql.Argument(name='shareUri', type=gql.NonNullableType(gql.String)),
+        gql.Argument(name='rejectPurpose', type=gql.String)
+    ],
+    type=gql.Boolean,
+    resolver=update_share_reject_purpose,
+)
+
+
+updateShareRequestReason = gql.MutationField(
+    name='updateShareRequestReason',
+    args=[
+        gql.Argument(name='shareUri', type=gql.NonNullableType(gql.String)),
+        gql.Argument(name='requestPurpose', type=gql.String)
+    ],
+    type=gql.Boolean,
+    resolver=update_share_request_purpose,
+)

backend/dataall/api/Objects/ShareObject/resolvers.py

@@ -85,14 +85,14 @@ def approve_share_object(context: Context, source, shareUri: str = None):
     return share
 
 
-def reject_share_object(context: Context, source, shareUri: str = None):
+def reject_share_object(context: Context, source, shareUri: str = None, rejectPurpose: str = None,):
     with context.engine.scoped_session() as session:
         return db.api.ShareObject.reject_share_object(
             session=session,
             username=context.username,
             groups=context.groups,
             uri=shareUri,
-            data=None,
+            data={"rejectPurpose": rejectPurpose},
             check_perm=True,
         )
 
@@ -222,25 +222,19 @@ def resolve_user_role(context: Context, source: models.ShareObject, **kwargs):
         return None
     with context.engine.scoped_session() as session:
         dataset: models.Dataset = db.api.Dataset.get_dataset_by_uri(session, source.datasetUri)
-        if dataset and dataset.stewards in context.groups:
+        if (
+            dataset and (
+                dataset.stewards in context.groups
+                or dataset.SamlAdminGroupName in context.groups
+                or dataset.owner == context.username
+            )
+        ):
             return ShareObjectPermission.Approvers.value
         if (
             source.owner == context.username
-            or source.principalId in context.groups
-            or dataset.owner == context.username
-            or dataset.SamlAdminGroupName in context.groups
+            or source.groupUri in context.groups
         ):
             return ShareObjectPermission.Requesters.value
-        if (
-            dataset and dataset.stewards in context.groups
-            and (
-                source.owner == context.username
-                or source.principalId in context.groups
-                or dataset.owner == context.username
-                or dataset.SamlAdminGroupName in context.groups
-            )
-        ):
-            return ShareObjectPermission.ApproversAndRequesters.value
         else:
             return ShareObjectPermission.NoPermission.value
 
@@ -375,3 +369,27 @@ def list_shares_in_my_outbox(context: Context, source, filter: dict = None):
             data=filter,
             check_perm=None,
         )
+
+
+def update_share_request_purpose(context: Context, source, shareUri: str = None, requestPurpose: str = None):
+    with context.engine.scoped_session() as session:
+        return db.api.ShareObject.update_share_request_purpose(
+            session=session,
+            username=context.username,
+            groups=context.groups,
+            uri=shareUri,
+            data={"requestPurpose": requestPurpose},
+            check_perm=True,
+        )
+
+
+def update_share_reject_purpose(context: Context, source, shareUri: str = None, rejectPurpose: str = None):
+    with context.engine.scoped_session() as session:
+        return db.api.ShareObject.update_share_reject_purpose(
+            session=session,
+            username=context.username,
+            groups=context.groups,
+            uri=shareUri,
+            data={"rejectPurpose": rejectPurpose},
+            check_perm=True,
+        )

backend/dataall/api/Objects/ShareObject/schema.py

@@ -115,6 +115,8 @@
         gql.Field(name='deleted', type=gql.String),
         gql.Field(name='updated', type=gql.String),
         gql.Field(name='datasetUri', type=gql.String),
+        gql.Field(name='requestPurpose', type=gql.String),
+        gql.Field(name='rejectPurpose', type=gql.String),
         gql.Field(name='dataset', type=DatasetLink, resolver=resolve_dataset),
         gql.Field(name='consumptionData', type=gql.Ref('ConsumptionData'), resolver=resolve_consumption_data),
         gql.Field(name='existingSharedItems', type=gql.Boolean, resolver=resolve_existing_shared_items),

backend/dataall/db/api/dataset.py

@@ -358,26 +358,44 @@ def update_dataset(
 
     @staticmethod
     def transfer_stewardship_to_owners(session, dataset):
+        # Remove Steward Resource Policy on Dataset
+        env = Environment.get_environment_by_uri(session, dataset.environmentUri)
+        if dataset.stewards != env.SamlGroupName:
+            ResourcePolicy.delete_resource_policy(
+                session=session,
+                group=dataset.stewards,
+                resource_uri=dataset.datasetUri,
+            )
+
+        # Remove Steward Resource Policy on Dataset Tables
+        dataset_tables = [t.tableUri for t in Dataset.get_dataset_tables(session, dataset.datasetUri)]
+        for tableUri in dataset_tables:
+            if dataset.stewards != env.SamlGroupName:
+                ResourcePolicy.delete_resource_policy(
+                    session=session,
+                    group=dataset.stewards,
+                    resource_uri=tableUri,
+                )
+
+        # Remove Steward Resource Policy on Dataset Share Objects
         dataset_shares = (
             session.query(models.ShareObject)
             .filter(models.ShareObject.datasetUri == dataset.datasetUri)
             .all()
         )
         if dataset_shares:
             for share in dataset_shares:
-                ResourcePolicy.attach_resource_policy(
+                ResourcePolicy.delete_resource_policy(
                     session=session,
-                    group=dataset.SamlAdminGroupName,
-                    permissions=permissions.SHARE_OBJECT_APPROVER,
+                    group=dataset.stewards,
                     resource_uri=share.shareUri,
-                    resource_type=models.ShareObject.__name__,
                 )
         return dataset
 
     @staticmethod
     def transfer_stewardship_to_new_stewards(session, dataset, new_stewards):
         env = Environment.get_environment_by_uri(session, dataset.environmentUri)
-        if dataset.stewards != env.SamlGroupName:
+        if dataset.stewards != dataset.SamlAdminGroupName:
             ResourcePolicy.delete_resource_policy(
                 session=session,
                 group=dataset.stewards,
@@ -393,7 +411,7 @@ def transfer_stewardship_to_new_stewards(session, dataset, new_stewards):
 
         dataset_tables = [t.tableUri for t in Dataset.get_dataset_tables(session, dataset.datasetUri)]
         for tableUri in dataset_tables:
-            if dataset.stewards != env.SamlGroupName:
+            if dataset.stewards != dataset.SamlAdminGroupName:
                 ResourcePolicy.delete_resource_policy(
                     session=session,
                     group=dataset.stewards,
@@ -421,11 +439,12 @@ def transfer_stewardship_to_new_stewards(session, dataset, new_stewards):
                     resource_uri=share.shareUri,
                     resource_type=models.ShareObject.__name__,
                 )
-                ResourcePolicy.delete_resource_policy(
-                    session=session,
-                    group=dataset.stewards,
-                    resource_uri=share.shareUri,
-                )
+                if dataset.stewards != dataset.SamlAdminGroupName:
+                    ResourcePolicy.delete_resource_policy(
+                        session=session,
+                        group=dataset.stewards,
+                        resource_uri=share.shareUri,
+                    )
         return dataset
 
     @staticmethod

backend/dataall/db/api/share_object.py

@@ -343,6 +343,7 @@ def create_share_object(
         groupUri = data['groupUri']
         itemUri = data.get('itemUri')
         itemType = data.get('itemType')
+        requestPurpose = data.get('requestPurpose')
 
         dataset: models.Dataset = data.get(
             'dataset', api.Dataset.get_dataset_by_uri(session, datasetUri)
@@ -411,6 +412,7 @@ def create_share_object(
                 principalType=principalType,
                 principalIAMRoleName=principalIAMRoleName,
                 status=ShareObjectStatus.Draft.value,
+                requestPurpose=requestPurpose
             )
             session.add(share)
             session.commit()
@@ -470,39 +472,32 @@ def create_share_object(
 
         # Attaching REQUESTER permissions to:
         # requester group (groupUri)
-        # dataset.SamlAdminGroupName
-        # environment.SamlGroupName
+        # environment.SamlGroupName (if not dataset admins)
         ResourcePolicy.attach_resource_policy(
             session=session,
             group=groupUri,
             permissions=permissions.SHARE_OBJECT_REQUESTER,
             resource_uri=share.shareUri,
             resource_type=models.ShareObject.__name__,
         )
+
+        # Attaching APPROVER permissions to:
+        # dataset.stewards (includes the dataset Admins)
         ResourcePolicy.attach_resource_policy(
             session=session,
             group=dataset.SamlAdminGroupName,
-            permissions=permissions.SHARE_OBJECT_REQUESTER,
+            permissions=permissions.SHARE_OBJECT_APPROVER,
             resource_uri=share.shareUri,
             resource_type=models.ShareObject.__name__,
         )
-        if dataset.SamlAdminGroupName != environment.SamlGroupName:
+        if dataset.stewards != dataset.SamlAdminGroupName:
             ResourcePolicy.attach_resource_policy(
                 session=session,
-                group=environment.SamlGroupName,
-                permissions=permissions.SHARE_OBJECT_REQUESTER,
+                group=dataset.stewards,
+                permissions=permissions.SHARE_OBJECT_APPROVER,
                 resource_uri=share.shareUri,
                 resource_type=models.ShareObject.__name__,
             )
-        # Attaching REQUESTER permissions to:
-        # dataset.stewards (includes the dataset Admins)
-        ResourcePolicy.attach_resource_policy(
-            session=session,
-            group=dataset.stewards,
-            permissions=permissions.SHARE_OBJECT_APPROVER,
-            resource_uri=share.shareUri,
-            resource_type=models.ShareObject.__name__,
-        )
         return share
 
     @staticmethod
@@ -607,9 +602,42 @@ def approve_share_object(
                 resource_type=models.DatasetTable.__name__,
             )
 
+        share.rejectPurpose = ""
+        session.commit()
+
         api.Notification.notify_share_object_approval(session, username, dataset, share)
         return share
 
+    @staticmethod
+    @has_resource_perm(permissions.SUBMIT_SHARE_OBJECT)
+    def update_share_request_purpose(
+        session,
+        username: str,
+        groups: [str],
+        uri: str,
+        data: dict = None,
+        check_perm: bool = False,
+    ) -> models.ShareObject:
+        share = ShareObject.get_share_by_uri(session, uri)
+        share.requestPurpose = data.get("requestPurpose")
+        session.commit()
+        return True
+
+    @staticmethod
+    @has_resource_perm(permissions.REJECT_SHARE_OBJECT)
+    def update_share_reject_purpose(
+        session,
+        username: str,
+        groups: [str],
+        uri: str,
+        data: dict = None,
+        check_perm: bool = False,
+    ) -> models.ShareObject:
+        share = ShareObject.get_share_by_uri(session, uri)
+        share.rejectPurpose = data.get("rejectPurpose")
+        session.commit()
+        return True
+
     @staticmethod
     @has_resource_perm(permissions.REJECT_SHARE_OBJECT)
     def reject_share_object(
@@ -624,7 +652,6 @@ def reject_share_object(
         share = ShareObject.get_share_by_uri(session, uri)
         dataset = api.Dataset.get_dataset_by_uri(session, share.datasetUri)
         share_items_states = ShareObject.get_share_items_states(session, uri)
-
         Share_SM = ShareObjectSM(share.status)
         new_share_state = Share_SM.run_transition(ShareObjectActions.Reject.value)
 
@@ -640,6 +667,11 @@ def reject_share_object(
             group=share.groupUri,
             resource_uri=dataset.datasetUri,
         )
+
+        # Update Reject Purpose
+        share.rejectPurpose = data.get("rejectPurpose")
+        session.commit()
+
         api.Notification.notify_share_object_rejection(session, username, dataset, share)
         return share
 
@@ -1031,6 +1063,7 @@ def list_user_received_share_requests(
                         f'{{{username}}}'
                     ),
                     models.Dataset.stewards.in_(groups),
+                    models.Dataset.SamlAdminGroupName.in_(groups),
                 )
             )
         )

backend/dataall/db/models/ShareObject.py

@@ -33,5 +33,7 @@ class ShareObject(Base):
     updated = Column(DateTime, onupdate=datetime.now)
     deleted = Column(DateTime)
     confirmed = Column(Boolean, default=False)
+    requestPurpose = Column(String, nullable=True)
+    rejectPurpose = Column(String, nullable=True)
     userRoleForShareObject = query_expression()
     existingSharedItems = query_expression()

backend/dataall/db/permissions.py

@@ -172,7 +172,6 @@
 SHARE_OBJECT_APPROVER = [
     ADD_ITEM,
     REMOVE_ITEM,
-    SUBMIT_SHARE_OBJECT,
     APPROVE_SHARE_OBJECT,
     REJECT_SHARE_OBJECT,
     DELETE_SHARE_OBJECT,