add rbac to dos

Author: bwalsh

indexd/dos/blueprint.py

@@ -1,5 +1,9 @@
+import sys
+import traceback
+
 import flask
 
+from indexd.auth import AuthzError
 from indexd.blueprint import dist_get_record
 
 from indexd.errors import AuthError
@@ -15,12 +19,32 @@
 blueprint.dist = []
 
 
+@blueprint.errorhandler(Exception)
+def handle_uncaught_exception(err):
+    print(f"Uncaught Exception: {err}", file=sys.stderr)
+    traceback.print_exc(file=sys.stderr)
+    return flask.jsonify(error=f"Internal server error"), 500
+
+
+@blueprint.errorhandler(AuthzError)
+def handle_authz_error(err):
+    ret = {"msg": str(err), "status_code": 401}
+    return flask.jsonify(ret), 401
+
+
+@blueprint.errorhandler(AuthError)
+def handle_requester_auth_error(err):
+    ret = {"msg": str(err), "status_code": 403}
+    return flask.jsonify(ret), 403
+
+
 @blueprint.route("/ga4gh/dos/v1/dataobjects/<path:record>", methods=["GET"])
 def get_dos_record(record):
     """
     Returns a record from the local ids, alias, or global resolvers.
     Returns DOS Schema
     """
+
     try:
         ret = blueprint.index_driver.get(record)
         # record may be a baseID or a DID / GUID. If record is a baseID, ret["did"] is the latest GUID for that record.
@@ -157,3 +181,6 @@ def get_config(setup_state):
     blueprint.alias_driver = alias_config["driver"]
     if "DIST" in setup_state.app.config:
         blueprint.dist = setup_state.app.config["DIST"]
+    blueprint.rbac = False
+    if "RBAC" in setup_state.app.config:
+        blueprint.rbac = setup_state.app.config["RBAC"]

indexd/index/drivers/alchemy.py

@@ -1225,7 +1225,9 @@ def get(self, did, expand=True):
                     # overwrite the "no bundle found" message
                     raise NoRecordFound("no record found")
 
-            return record.to_document_dict()
+            document_dict = record.to_document_dict()
+            _enforce_record_authz(document_dict)
+            return document_dict
 
     def get_with_nonstrict_prefix(self, did, expand=True):
         """

tests/test_client.py

@@ -2640,13 +2640,17 @@ def test_bad_hashes(client, user, typ, h, combined_default_and_single_table_sett
         assert "does not match" in json_resp["error"]
 
 
-def test_dos_get(client, user, combined_default_and_single_table_settings):
+def test_dos_get(client, user, combined_default_and_single_table_settings, is_rbac_configured):
     data = get_doc(has_urls_metadata=True, has_metadata=True, has_baseid=True)
 
     res_1 = client.post("/index/", json=data, headers=user)
     assert res_1.status_code == 200
     rec_1 = res_1.json
-    res_2 = client.get("/ga4gh/dos/v1/dataobjects/" + rec_1["did"])
+    if is_rbac_configured:
+        res_2 = client.get("/ga4gh/dos/v1/dataobjects/" + rec_1["did"])
+        assert res_2.status_code == 403 # No authz in request
+
+    res_2 = client.get("/ga4gh/dos/v1/dataobjects/" + rec_1["did"], headers=user)
     assert res_2.status_code == 200
     rec_2 = res_2.json
     assert rec_2["data_object"]["id"] == rec_1["did"]
@@ -2662,8 +2666,13 @@ def test_dos_get(client, user, combined_default_and_single_table_settings):
         rec_2["data_object"]["urls"][0]["system_metadata"]["project_id"]
         == "bpa-UChicago"
     )
-    res_3 = client.get("/ga4gh/dos/v1/dataobjects/" + rec_1["baseid"])
+    if is_rbac_configured:
+        res_3 = client.get("/ga4gh/dos/v1/dataobjects/" + rec_1["baseid"])
+        assert res_3.status_code == 403
+
+    res_3 = client.get("/ga4gh/dos/v1/dataobjects/" + rec_1["baseid"], headers=user)
     assert res_3.status_code == 200
+
     rec_3 = res_3.json
     assert rec_3["data_object"]["id"] == rec_1["did"]
 
@@ -2675,15 +2684,20 @@ def test_get_dos_record_error(client, user, combined_default_and_single_table_se
     assert res.status_code == 404
 
 
-def test_dos_list(client, user, combined_default_and_single_table_settings):
+def test_dos_list(client, user, combined_default_and_single_table_settings, is_rbac_configured):
     data = get_doc(has_urls_metadata=True, has_metadata=True, has_baseid=True)
 
     res_1 = client.post("/index/", json=data, headers=user)
     assert res_1.status_code == 200
     rec_1 = res_1.json
 
-    res_2 = client.get("/ga4gh/dos/v1/dataobjects?page_size=100")
+    if is_rbac_configured:
+        res_2 = client.get("/ga4gh/dos/v1/dataobjects?page_size=100")
+        assert res_2.status_code == 403
+
+    res_2 = client.get("/ga4gh/dos/v1/dataobjects?page_size=100", headers=user)
     assert res_2.status_code == 200
+
     rec_2 = res_2.json
     assert len(rec_2["data_objects"]) == 1
     assert rec_2["data_objects"][0]["id"] == rec_1["did"]

tests/test_rbac.py

@@ -277,6 +277,19 @@ def test_multiple_endpoints(client, user, mock_arborist_requests, is_rbac_config
     data_2 = client.get(f"/ga4gh/drs/v1/objects/{res2_did}", headers=user)
     assert data_2.status_code == 401, f"Expected status code 401, got {data_2.status_code}"
 
+    print(f"DEBUG >>>>>> User should not have access to /ga4gh/dos/v1/dataobjects", file=sys.stderr)
+    data_2 = client.get(f"/ga4gh/dos/v1/dataobjects", headers=user)
+    assert data_2.status_code == 200, f"Expected status code 200, got {data_2.status_code}"
+    data_all_list = data_2.json
+    assert 'data_objects' in data_all_list, data_all_list
+    assert len(data_all_list[
+                   "data_objects"]) == 0, f"Should have access to 0 records, got {len(data_all_list['data_objects'])} records: {data_all_list}"
+
+    print(f"DEBUG >>>>>> User should not have access to /ga4gh/dos/v1/dataobjects/{res2_did}", file=sys.stderr)
+    data_2 = client.get(f"/ga4gh/dos/v1/dataobjects/{res2_did}", headers=user)
+    assert data_2.status_code == 401, f"Expected status code 401, got {data_2.status_code}"
+
+
     # user has no access to anything
     mock_arborist_requests(
         resource_method_to_authorized={
@@ -293,3 +306,13 @@ def test_multiple_endpoints(client, user, mock_arborist_requests, is_rbac_config
     print("DEBUG >>>>>> User missing", file=sys.stderr)
     data_all_by_md = client.get("/ga4gh/drs/v1/objects")
     assert data_all_by_md.status_code == 403, f"Expected status code 403, got {data_all_by_md.status_code}"
+
+
+def test_indexclient(client, user, mock_arborist_requests, is_rbac_configured):
+    """
+    Test multiple endpoints, ensure rbac.
+    """
+    if not is_rbac_configured:
+        pytest.skip("RBAC is not configured, skipping test.")
+
+    # TODO