Examples with GrantRoleRequestBody bio.terra.workspace.model.GrantRoleRequestBody used on opensource projects

Example 6 with GrantRoleRequestBody

use of bio.terra.workspace.model.GrantRoleRequestBody in project terra-workspace-manager by DataBiosphere.

the class GetRoles method doSetup.

@Override
public void doSetup(List<TestUserSpecification> testUsers, WorkspaceApi workspaceApi) throws Exception {
    super.doSetup(testUsers, workspaceApi);
    for (TestUserSpecification testUser : testUsers) {
        logger.info("Granting role {} for user {} on workspace id {}", IAM_ROLE.toString(), testUser.userEmail, getWorkspaceId().toString());
        final var body = new GrantRoleRequestBody().memberEmail(testUser.userEmail);
        // grant the role
        workspaceApi.grantRole(body, getWorkspaceId(), IAM_ROLE);
    }
}

Example 7 with GrantRoleRequestBody

use of bio.terra.workspace.model.GrantRoleRequestBody in project terra-workspace-manager by DataBiosphere.

the class ReferencedBigQueryResourceLifecycle method doUserJourney.

@Override
protected void doUserJourney(TestUserSpecification testUser, WorkspaceApi workspaceApi) throws Exception {
    ReferencedGcpResourceApi referencedGcpResourceApi = ClientTestUtils.getReferencedGcpResourceClient(testUser, server);
    // Grant secondary users READER permission in the workspace.
    workspaceApi.grantRole(new GrantRoleRequestBody().memberEmail(partialAccessUser.userEmail), getWorkspaceId(), IamRole.READER);
    workspaceApi.grantRole(new GrantRoleRequestBody().memberEmail(noAccessUser.userEmail), getWorkspaceId(), IamRole.READER);
    // Create the references
    GcpBigQueryDatasetResource referencedDataset = BqDatasetUtils.makeBigQueryDatasetReference(referencedBqDatasetAttributes, referencedGcpResourceApi, getWorkspaceId(), MultiResourcesUtils.makeName(), CloningInstructionsEnum.REFERENCE);
    bqDatasetResourceId = referencedDataset.getMetadata().getResourceId();
    GcpBigQueryDataTableResource referencedDataTable = BqDatasetUtils.makeBigQueryDataTableReference(referencedBqTableAttributes, referencedGcpResourceApi, getWorkspaceId(), MultiResourcesUtils.makeName(), CloningInstructionsEnum.REFERENCE);
    bqDataTableResourceId = referencedDataTable.getMetadata().getResourceId();
    // Get references
    testGetReferences(referencedDataset, referencedDataTable, referencedGcpResourceApi);
    // Clone references
    testCloneReferences(referencedDataset, referencedDataTable, referencedGcpResourceApi, workspaceApi);
    // Validate reference access
    testValidateReferences(testUser);
    // Update the references
    testUpdateReferences(referencedDataset, referencedDataTable, referencedGcpResourceApi);
    // Delete the references
    referencedGcpResourceApi.deleteBigQueryDatasetReference(getWorkspaceId(), bqDatasetResourceId);
    referencedGcpResourceApi.deleteBigQueryDataTableReference(getWorkspaceId(), bqDataTableResourceId);
    // Enumerating all resources with no filters should be empty
    ResourceApi resourceApi = ClientTestUtils.getResourceClient(testUser, server);
    ResourceList enumerateResult = resourceApi.enumerateResources(getWorkspaceId(), 0, 100, null, null);
    assertTrue(enumerateResult.getResources().isEmpty());
}

Example 8 with GrantRoleRequestBody

use of bio.terra.workspace.model.GrantRoleRequestBody in project terra-workspace-manager by DataBiosphere.

the class RemoveUser method doSetup.

@Override
protected void doSetup(List<TestUserSpecification> testUsers, WorkspaceApi ownerWorkspaceApi) throws Exception {
    super.doSetup(testUsers, ownerWorkspaceApi);
    assertThat("There must be at least three test users defined for this test.", testUsers != null && testUsers.size() > 2);
    TestUserSpecification workspaceOwner = testUsers.get(0);
    this.privateResourceUser = testUsers.get(1);
    this.sharedResourceUser = testUsers.get(2);
    assertNotEquals(privateResourceUser.userEmail, sharedResourceUser.userEmail, "The two test users are distinct");
    // Add one user as a reader, and one as both a reader and writer.
    ownerWorkspaceApi.grantRole(new GrantRoleRequestBody().memberEmail(privateResourceUser.userEmail), getWorkspaceId(), IamRole.READER);
    ownerWorkspaceApi.grantRole(new GrantRoleRequestBody().memberEmail(privateResourceUser.userEmail), getWorkspaceId(), IamRole.WRITER);
    ownerWorkspaceApi.grantRole(new GrantRoleRequestBody().memberEmail(sharedResourceUser.userEmail), getWorkspaceId(), IamRole.WRITER);
    // Create a GCP cloud context.
    projectId = CloudContextMaker.createGcpCloudContext(getWorkspaceId(), ownerWorkspaceApi);
    // Create a shared GCS bucket with one object inside.
    ControlledGcpResourceApi ownerResourceApi = ClientTestUtils.getControlledGcpResourceClient(workspaceOwner, server);
    String sharedBucketName = BUCKET_PREFIX + UUID.randomUUID();
    sharedBucket = makeControlledGcsBucketUserShared(ownerResourceApi, getWorkspaceId(), sharedBucketName, CloningInstructionsEnum.NOTHING);
    GcsBucketUtils.addFileToBucket(sharedBucket, workspaceOwner, projectId);
    // Create a private GCS bucket for privateResourceUser with one object inside.
    String privateBucketName = BUCKET_PREFIX + UUID.randomUUID();
    ControlledGcpResourceApi privateUserResourceApi = ClientTestUtils.getControlledGcpResourceClient(privateResourceUser, server);
    privateBucket = makeControlledGcsBucketUserPrivate(privateUserResourceApi, getWorkspaceId(), privateBucketName, CloningInstructionsEnum.NOTHING);
    GcsBucketUtils.addFileToBucket(privateBucket, privateResourceUser, projectId);
    // Create a private BQ dataset for privateResourceUser and populate it.
    String datasetResourceName = RandomStringUtils.randomAlphabetic(8).toLowerCase();
    privateDataset = BqDatasetUtils.makeControlledBigQueryDatasetUserPrivate(privateUserResourceApi, getWorkspaceId(), datasetResourceName, null, CloningInstructionsEnum.NOTHING);
    BqDatasetUtils.populateBigQueryDataset(privateDataset, privateResourceUser, projectId);
    // Create a private notebook for privateResourceUser.
    String notebookInstanceId = RandomStringUtils.randomAlphabetic(8).toLowerCase();
    privateNotebook = NotebookUtils.makeControlledNotebookUserPrivate(getWorkspaceId(), notebookInstanceId, /*location=*/
    null, privateUserResourceApi);
}

Example 9 with GrantRoleRequestBody

use of bio.terra.workspace.model.GrantRoleRequestBody in project terra-workspace-manager by DataBiosphere.

the class PrivateControlledAiNotebookInstanceLifecycle method doUserJourney.

@Override
@SuppressFBWarnings(value = "DLS_DEAD_LOCAL_STORE")
protected void doUserJourney(TestUserSpecification testUser, WorkspaceApi workspaceApi) throws Exception {
    CloudContextMaker.createGcpCloudContext(getWorkspaceId(), workspaceApi);
    workspaceApi.grantRole(new GrantRoleRequestBody().memberEmail(resourceUser.userEmail), getWorkspaceId(), IamRole.WRITER);
    workspaceApi.grantRole(new GrantRoleRequestBody().memberEmail(otherWorkspaceUser.userEmail), getWorkspaceId(), IamRole.WRITER);
    ControlledGcpResourceApi resourceUserApi = ClientTestUtils.getControlledGcpResourceClient(resourceUser, server);
    CreatedControlledGcpAiNotebookInstanceResult creationResult = NotebookUtils.makeControlledNotebookUserPrivate(getWorkspaceId(), instanceId, /*location=*/
    null, resourceUserApi);
    UUID resourceId = creationResult.getAiNotebookInstance().getMetadata().getResourceId();
    GcpAiNotebookInstanceResource resource = resourceUserApi.getAiNotebookInstance(getWorkspaceId(), resourceId);
    assertEquals(instanceId, resource.getAttributes().getInstanceId(), "Notebook instance id is correct in GET response from WSM");
    assertEquals(instanceId, creationResult.getAiNotebookInstance().getAttributes().getInstanceId(), "Notebook instance id is correct in create response from WSM");
    assertEquals(resourceUser.userEmail, resource.getMetadata().getControlledResourceMetadata().getPrivateResourceUser().getUserName(), "User is the private user of the notebook");
    assertEquals("us-central1-a", resource.getAttributes().getLocation(), "The notebook uses the default location because location is not specified.");
    createAControlledAiNotebookInstanceWithoutSpecifiedInstanceId_validInstanceIdIsGenerated(resourceUserApi);
    createAControlledAiNotebookInstanceWithoutSpecifiedInstanceId_specifyLocation(resourceUserApi);
    String instanceName = String.format("projects/%s/locations/%s/instances/%s", resource.getAttributes().getProjectId(), resource.getAttributes().getLocation(), resource.getAttributes().getInstanceId());
    AIPlatformNotebooks userNotebooks = ClientTestUtils.getAIPlatformNotebooksClient(resourceUser);
    assertTrue(NotebookUtils.userHasProxyAccess(creationResult, resourceUser, resource.getAttributes().getProjectId()), "Private resource user has access to their notebook");
    assertFalse(NotebookUtils.userHasProxyAccess(creationResult, otherWorkspaceUser, resource.getAttributes().getProjectId()), "Other workspace user does not have access to a private notebook");
    // The user should be able to stop their notebook.
    userNotebooks.projects().locations().instances().stop(instanceName, new StopInstanceRequest());
    // The user should not be able to directly delete their notebook.
    GoogleJsonResponseException directDeleteForbidden = assertThrows(GoogleJsonResponseException.class, () -> userNotebooks.projects().locations().instances().delete(instanceName).execute());
    assertEquals(HttpStatus.SC_FORBIDDEN, directDeleteForbidden.getStatusCode(), "User may not delete notebook directly on GCP");
    // Any workspace user should be able to enumerate all created notebooks, even though they can't
    // read or write them.
    ResourceApi otherUserApi = ClientTestUtils.getResourceClient(otherWorkspaceUser, server);
    ResourceList notebookList = otherUserApi.enumerateResources(getWorkspaceId(), 0, 5, ResourceType.AI_NOTEBOOK, StewardshipType.CONTROLLED);
    assertEquals(3, notebookList.getResources().size());
    MultiResourcesUtils.assertResourceType(ResourceType.AI_NOTEBOOK, notebookList);
    // Delete the AI Notebook through WSM.
    DeleteControlledGcpAiNotebookInstanceResult deleteResult = resourceUserApi.deleteAiNotebookInstance(new DeleteControlledGcpAiNotebookInstanceRequest().jobControl(new JobControl().id(UUID.randomUUID().toString())), getWorkspaceId(), resourceId);
    String deleteJobId = deleteResult.getJobReport().getId();
    deleteResult = ClientTestUtils.pollWhileRunning(deleteResult, () -> resourceUserApi.getDeleteAiNotebookInstanceResult(getWorkspaceId(), deleteJobId), DeleteControlledGcpAiNotebookInstanceResult::getJobReport, Duration.ofSeconds(10));
    ClientTestUtils.assertJobSuccess("delete ai notebook", deleteResult.getJobReport(), deleteResult.getErrorReport());
    // Verify the notebook was deleted from WSM metadata.
    ApiException notebookIsMissing = assertThrows(ApiException.class, () -> resourceUserApi.getAiNotebookInstance(getWorkspaceId(), resourceId), "Notebook is deleted from WSM");
    assertEquals(HttpStatus.SC_NOT_FOUND, notebookIsMissing.getCode(), "Error from WSM is 404");
    // Verify the notebook was deleted from GCP.
    GoogleJsonResponseException notebookNotFound = assertThrows(GoogleJsonResponseException.class, () -> userNotebooks.projects().locations().instances().get(instanceName).execute(), "Notebook is deleted from GCP");
    // GCP may respond with either 403 or 404 depending on how quickly this is called after deleting
    // the notebook. Either response is valid in this case.
    assertThat("Error from GCP is 403 or 404", notebookNotFound.getStatusCode(), anyOf(equalTo(HttpStatus.SC_NOT_FOUND), equalTo(HttpStatus.SC_FORBIDDEN)));
}

Example 10 with GrantRoleRequestBody

use of bio.terra.workspace.model.GrantRoleRequestBody in project terra-workspace-manager by DataBiosphere.

the class ReferencedGcsResourceLifecycle method doUserJourney.

@Override
protected void doUserJourney(TestUserSpecification testUser, WorkspaceApi workspaceApi) throws Exception {
    ReferencedGcpResourceApi referencedGcpResourceApi = ClientTestUtils.getReferencedGcpResourceClient(testUser, server);
    // Grant secondary users READER permission in the workspace.
    workspaceApi.grantRole(new GrantRoleRequestBody().memberEmail(partialAccessUser.userEmail), getWorkspaceId(), IamRole.READER);
    workspaceApi.grantRole(new GrantRoleRequestBody().memberEmail(noAccessUser.userEmail), getWorkspaceId(), IamRole.READER);
    // Create the references
    GcpGcsBucketResource referencedBucket = GcsBucketUtils.makeGcsBucketReference(gcsUniformAccessBucketAttributes, referencedGcpResourceApi, getWorkspaceId(), MultiResourcesUtils.makeName(), CloningInstructionsEnum.REFERENCE);
    bucketResourceId = referencedBucket.getMetadata().getResourceId();
    GcpGcsBucketResource fineGrainedBucket = GcsBucketUtils.makeGcsBucketReference(gcsFineGrainedAccessBucketAttributes, referencedGcpResourceApi, getWorkspaceId(), MultiResourcesUtils.makeName(), CloningInstructionsEnum.REFERENCE);
    fineGrainedBucketResourceId = fineGrainedBucket.getMetadata().getResourceId();
    GcpGcsObjectResource referencedGcsFile = GcsBucketObjectUtils.makeGcsObjectReference(gcsFileAttributes, referencedGcpResourceApi, getWorkspaceId(), MultiResourcesUtils.makeName(), CloningInstructionsEnum.REFERENCE);
    fileResourceId = referencedGcsFile.getMetadata().getResourceId();
    GcpGcsObjectResource referencedGcsFolder = GcsBucketObjectUtils.makeGcsObjectReference(gcsFolderAttributes, referencedGcpResourceApi, getWorkspaceId(), MultiResourcesUtils.makeName(), CloningInstructionsEnum.REFERENCE);
    folderResourceId = referencedGcsFolder.getMetadata().getResourceId();
    // Get the references
    testGetReferences(referencedBucket, fineGrainedBucket, referencedGcsFile, referencedGcsFolder, referencedGcpResourceApi);
    // Create a second workspace to clone references into, owned by the same user
    testCloneReference(referencedBucket, fineGrainedBucket, referencedGcsFile, referencedGcsFolder, referencedGcpResourceApi, workspaceApi);
    // Validate reference access
    testValidateReference(testUser);
    // Update the references
    testUpdateReferences(fineGrainedBucket, referencedGcpResourceApi);
    // Delete the references
    referencedGcpResourceApi.deleteBucketReference(getWorkspaceId(), bucketResourceId);
    referencedGcpResourceApi.deleteBucketReference(getWorkspaceId(), fineGrainedBucketResourceId);
    referencedGcpResourceApi.deleteGcsObjectReference(getWorkspaceId(), fileResourceId);
    referencedGcpResourceApi.deleteGcsObjectReference(getWorkspaceId(), folderResourceId);
    // Enumerating all resources with no filters should be empty
    ResourceApi resourceApi = ClientTestUtils.getResourceClient(testUser, server);
    ResourceList enumerateResult = resourceApi.enumerateResources(getWorkspaceId(), 0, 100, null, null);
    assertTrue(enumerateResult.getResources().isEmpty());
}