use of bio.terra.workspace.model.ResourceList in project terra-workspace-manager by DataBiosphere.
the class ControlledApplicationSharedGcsBucketLifecycle method doUserJourney.
@Override
public void doUserJourney(TestUserSpecification unused, WorkspaceApi workspaceApi) throws Exception {
ApiClient ownerApiClient = ClientTestUtils.getClientForTestUser(owner, server);
ApiClient wsmappApiClient = ClientTestUtils.getClientForTestUser(wsmapp, server);
WorkspaceApplicationApi ownerWsmAppApi = new WorkspaceApplicationApi(ownerApiClient);
ControlledGcpResourceApi wsmappResourceApi = new ControlledGcpResourceApi(wsmappApiClient);
// Owner adds a reader and a writer to the workspace
workspaceApi.grantRole(new GrantRoleRequestBody().memberEmail(reader.userEmail), getWorkspaceId(), IamRole.READER);
logger.info("Added {} as a reader to workspace {}", reader.userEmail, getWorkspaceId());
workspaceApi.grantRole(new GrantRoleRequestBody().memberEmail(writer.userEmail), getWorkspaceId(), IamRole.WRITER);
logger.info("Added {} as a writer to workspace {}", writer.userEmail, getWorkspaceId());
// Create the cloud context
String projectId = CloudContextMaker.createGcpCloudContext(getWorkspaceId(), workspaceApi);
assertNotNull(projectId);
logger.info("Created project {}", projectId);
// Create the bucket - should fail because application is not enabled
String bucketResourceName = RandomStringUtils.random(6, true, false);
ApiException createBucketFails = assertThrows(ApiException.class, () -> GcsBucketUtils.makeControlledGcsBucketAppShared(wsmappResourceApi, getWorkspaceId(), bucketResourceName, CloningInstructionsEnum.NOTHING));
// TODO: [PF-1208] this should be FORBIDDEN (403), but we are throwing the wrong thing
assertEquals(HttpStatusCodes.STATUS_CODE_UNAUTHORIZED, createBucketFails.getCode());
logger.info("Failed to create bucket, as expected");
// Enable the application in the workspace
WorkspaceApplicationDescription applicationDescription = ownerWsmAppApi.enableWorkspaceApplication(getWorkspaceId(), TEST_WSM_APP);
assertThat(applicationDescription.getApplicationState(), equalTo(ApplicationState.OPERATING));
logger.info("Enabled application in the workspace");
// Validate that it is enabled
WorkspaceApplicationDescription retrievedDescription = ownerWsmAppApi.getWorkspaceApplication(getWorkspaceId(), TEST_WSM_APP);
assertThat(applicationDescription, equalTo(retrievedDescription));
assertThat(applicationDescription.getWorkspaceApplicationState(), equalTo(WorkspaceApplicationState.ENABLED));
// Create the bucket - should work this time
CreatedControlledGcpGcsBucket createdBucket = GcsBucketUtils.makeControlledGcsBucketAppShared(wsmappResourceApi, getWorkspaceId(), bucketResourceName, CloningInstructionsEnum.NOTHING);
bucketName = createdBucket.getGcpBucket().getAttributes().getBucketName();
assertNotNull(bucketName);
logger.info("Created bucket {}", bucketName);
// Try to disable; should error because you cannot disable an app if it owns resources
// in the workspace.
ApiException disableAppFails = assertThrows(ApiException.class, () -> ownerWsmAppApi.disableWorkspaceApplication(getWorkspaceId(), TEST_WSM_APP));
assertEquals(HttpStatusCodes.STATUS_CODE_BAD_REQUEST, disableAppFails.getCode());
logger.info("Failed to disable app, as expected");
try (GcsBucketAccessTester tester = new GcsBucketAccessTester(wsmapp, bucketName, projectId)) {
tester.checkAccess(wsmapp, ControlledResourceIamRole.EDITOR);
tester.checkAccess(owner, ControlledResourceIamRole.WRITER);
tester.checkAccess(writer, ControlledResourceIamRole.WRITER);
tester.checkAccess(reader, ControlledResourceIamRole.READER);
}
// The reader should be able to enumerate the bucket.
ResourceApi readerResourceApi = ClientTestUtils.getResourceClient(reader, server);
ResourceList bucketList = readerResourceApi.enumerateResources(getWorkspaceId(), 0, 5, ResourceType.GCS_BUCKET, StewardshipType.CONTROLLED);
assertEquals(1, bucketList.getResources().size());
MultiResourcesUtils.assertResourceType(ResourceType.GCS_BUCKET, bucketList);
// Owner cannot delete the bucket through WSM
ControlledGcpResourceApi ownerResourceApi = new ControlledGcpResourceApi(ownerApiClient);
ApiException cannotDelete = assertThrows(ApiException.class, () -> GcsBucketUtils.deleteControlledGcsBucket(createdBucket.getResourceId(), getWorkspaceId(), ownerResourceApi));
// TODO: [PF-1208] this should be FORBIDDEN (403), but we are throwing the wrong thing
assertEquals(HttpStatusCodes.STATUS_CODE_UNAUTHORIZED, cannotDelete.getCode());
logger.info("Owner delete failed as expected");
// Application can delete the bucket through WSM
GcsBucketUtils.deleteControlledGcsBucket(createdBucket.getResourceId(), getWorkspaceId(), wsmappResourceApi);
logger.info("Application delete succeeded");
}
use of bio.terra.workspace.model.ResourceList in project terra-workspace-manager by DataBiosphere.
the class PrivateControlledGcsBucketLifecycle method doUserJourney.
@Override
public void doUserJourney(TestUserSpecification testUser, WorkspaceApi workspaceApi) throws Exception {
String projectId = CloudContextMaker.createGcpCloudContext(getWorkspaceId(), workspaceApi);
ControlledGcpResourceApi workspaceOwnerResourceApi = ClientTestUtils.getControlledGcpResourceClient(testUser, server);
ControlledGcpResourceApi privateUserResourceApi = ClientTestUtils.getControlledGcpResourceClient(privateResourceUser, server);
workspaceApi.grantRole(new GrantRoleRequestBody().memberEmail(workspaceReader.userEmail), getWorkspaceId(), IamRole.READER);
logger.info("Added {} as a reader to workspace {}", workspaceReader.userEmail, getWorkspaceId());
workspaceApi.grantRole(new GrantRoleRequestBody().memberEmail(privateResourceUser.userEmail), getWorkspaceId(), IamRole.WRITER);
logger.info("Added {} as a writer to workspace {}", privateResourceUser.userEmail, getWorkspaceId());
// Create a private bucket, which privateResourceUser assigns to themselves.
// Cloud IAM permissions may take several minutes to sync, so we retry this operation until
// it succeeds.
CreatedControlledGcpGcsBucket bucket = ClientTestUtils.getWithRetryOnException(() -> createPrivateBucket(privateUserResourceApi));
UUID resourceId = bucket.getResourceId();
// Retrieve the bucket resource from WSM
logger.info("Retrieving bucket resource id {}", resourceId.toString());
GcpGcsBucketResource gotBucket = privateUserResourceApi.getBucket(getWorkspaceId(), resourceId);
String bucketName = gotBucket.getAttributes().getBucketName();
assertEquals(bucket.getGcpBucket().getAttributes().getBucketName(), bucketName);
// Assert the bucket is assigned to privateResourceUser, even though resource user was
// not specified
assertEquals(privateResourceUser.userEmail, gotBucket.getMetadata().getControlledResourceMetadata().getPrivateResourceUser().getUserName());
try (GcsBucketAccessTester tester = new GcsBucketAccessTester(privateResourceUser, bucketName, projectId)) {
tester.checkAccessWait(privateResourceUser, ControlledResourceIamRole.EDITOR);
// workspace owner can do nothing
tester.checkAccess(testUser, null);
tester.checkAccess(workspaceReader, null);
}
// Any workspace user should be able to enumerate all buckets, even though they can't access
// their contents.
ResourceApi readerApi = ClientTestUtils.getResourceClient(workspaceReader, server);
ResourceList bucketList = readerApi.enumerateResources(getWorkspaceId(), 0, 5, ResourceType.GCS_BUCKET, StewardshipType.CONTROLLED);
assertEquals(1, bucketList.getResources().size());
MultiResourcesUtils.assertResourceType(ResourceType.GCS_BUCKET, bucketList);
// Workspace owner has DELETER role and can delete the bucket through WSM
var ownerDeleteResult = deleteBucket(workspaceOwnerResourceApi, resourceId);
ClientTestUtils.assertJobSuccess("owner delete bucket", ownerDeleteResult.getJobReport(), ownerDeleteResult.getErrorReport());
// verify the bucket was deleted from WSM metadata
ApiException bucketIsMissing = assertThrows(ApiException.class, () -> workspaceOwnerResourceApi.getBucket(getWorkspaceId(), resourceId), "Incorrectly found a deleted bucket!");
assertEquals(HttpStatusCodes.STATUS_CODE_NOT_FOUND, bucketIsMissing.getCode());
// also verify it was deleted from GCP
Storage ownerStorageClient = ClientTestUtils.getGcpStorageClient(testUser, projectId);
Bucket maybeBucket = ownerStorageClient.get(bucketName);
assertNull(maybeBucket);
// TODO: PF-1218 - change these to negative tests - should error - when
// the ticket is complete. These exercise two create cases with currently
// valid combinations of private user.
PrivateResourceIamRoles roles = new PrivateResourceIamRoles();
roles.add(ControlledResourceIamRole.READER);
// Supply all private user parameters
PrivateResourceUser privateUserFull = new PrivateResourceUser().userName(privateResourceUser.userEmail).privateResourceIamRoles(roles);
CreatedControlledGcpGcsBucket userFullBucket = GcsBucketUtils.makeControlledGcsBucket(privateUserResourceApi, getWorkspaceId(), RESOURCE_PREFIX + UUID.randomUUID().toString(), /*bucketName=*/
null, AccessScope.PRIVATE_ACCESS, ManagedBy.USER, CloningInstructionsEnum.NOTHING, privateUserFull);
assertNotNull(userFullBucket.getGcpBucket().getAttributes().getBucketName());
deleteBucket(workspaceOwnerResourceApi, userFullBucket.getResourceId());
// Supply just the roles, but no email
PrivateResourceUser privateUserNoEmail = new PrivateResourceUser().userName(null).privateResourceIamRoles(roles);
CreatedControlledGcpGcsBucket userNoEmailBucket = GcsBucketUtils.makeControlledGcsBucket(privateUserResourceApi, getWorkspaceId(), RESOURCE_PREFIX + UUID.randomUUID().toString(), /*bucketName=*/
null, AccessScope.PRIVATE_ACCESS, ManagedBy.USER, CloningInstructionsEnum.NOTHING, privateUserNoEmail);
assertNotNull(userNoEmailBucket.getGcpBucket().getAttributes().getBucketName());
deleteBucket(workspaceOwnerResourceApi, userNoEmailBucket.getResourceId());
String uniqueBucketName = String.format("terra_%s_bucket", UUID.randomUUID().toString().replace("-", "_"));
CreatedControlledGcpGcsBucket bucketWithBucketNameSpecified = GcsBucketUtils.makeControlledGcsBucket(privateUserResourceApi, getWorkspaceId(), RESOURCE_PREFIX + UUID.randomUUID().toString(), /*bucketName=*/
uniqueBucketName, AccessScope.PRIVATE_ACCESS, ManagedBy.USER, CloningInstructionsEnum.NOTHING, privateUserFull);
assertEquals(uniqueBucketName, bucketWithBucketNameSpecified.getGcpBucket().getAttributes().getBucketName());
deleteBucket(workspaceOwnerResourceApi, bucketWithBucketNameSpecified.getResourceId());
}
use of bio.terra.workspace.model.ResourceList in project terra-workspace-manager by DataBiosphere.
the class ReferencedDataRepoSnapshotLifecycle method doUserJourney.
@Override
protected void doUserJourney(TestUserSpecification testUser, WorkspaceApi workspaceApi) throws Exception {
ReferencedGcpResourceApi referencedGcpResourceApi = ClientTestUtils.getReferencedGcpResourceClient(testUser, server);
// Add the "partial access" user as a workspace reader. This does not give them access to any
// underlying referenced resources.
workspaceApi.grantRole(new GrantRoleRequestBody().memberEmail(partialAccessUser.userEmail), getWorkspaceId(), IamRole.READER);
// Create the reference
DataRepoSnapshotResource snapshotResource = DataRepoUtils.makeDataRepoSnapshotReference(referencedGcpResourceApi, getWorkspaceId(), MultiResourcesUtils.makeName(), snapshotId, tdrInstance);
snapshotResourceId = snapshotResource.getMetadata().getResourceId();
// Get the reference
ResourceApi resourceApi = ClientTestUtils.getResourceClient(testUser, server);
testGetReference(snapshotResource, referencedGcpResourceApi, resourceApi);
// Create a second workspace to clone the reference into, owned by the same user
testCloneReference(snapshotResource, referencedGcpResourceApi, workspaceApi);
// Validate snapshot access
testValidateReference(testUser);
// Update reference
testUpdateReference(referencedGcpResourceApi);
// Delete the reference
referencedGcpResourceApi.deleteDataRepoSnapshotReference(getWorkspaceId(), snapshotResourceId);
// Enumerating all resources with no filters should be empty
ResourceList enumerateResult = resourceApi.enumerateResources(getWorkspaceId(), 0, 100, null, null);
assertTrue(enumerateResult.getResources().isEmpty());
}
use of bio.terra.workspace.model.ResourceList in project terra-workspace-manager by DataBiosphere.
the class ReferencedDataRepoSnapshotLifecycle method testGetReference.
private void testGetReference(DataRepoSnapshotResource snapshotResource, ReferencedGcpResourceApi referencedGcpResourceApi, ResourceApi resourceApi) throws Exception {
// Read the reference
DataRepoSnapshotResource fetchedSnapshot = referencedGcpResourceApi.getDataRepoSnapshotReference(getWorkspaceId(), snapshotResourceId);
assertEquals(snapshotResource, fetchedSnapshot);
// Enumerate the reference
ResourceList referenceList = resourceApi.enumerateResources(getWorkspaceId(), 0, 5, /*referenceType=*/
null, /*stewardShipType=*/
null);
assertEquals(1, referenceList.getResources().size());
assertEquals(StewardshipType.REFERENCED, referenceList.getResources().get(0).getMetadata().getStewardshipType());
assertEquals(ResourceType.DATA_REPO_SNAPSHOT, referenceList.getResources().get(0).getMetadata().getResourceType());
}
use of bio.terra.workspace.model.ResourceList in project terra-workspace-manager by DataBiosphere.
the class ReferencedGitRepoLifecycle method testGetReference.
private void testGetReference(GitRepoResource gitResource, ReferencedGcpResourceApi referencedGcpResourceApi, ResourceApi resourceApi) throws Exception {
GitRepoResource fetchedGitResource = referencedGcpResourceApi.getGitRepoReference(getWorkspaceId(), gitResourceId);
assertEquals(gitResource, fetchedGitResource);
// Enumerate the reference
ResourceList referenceList = resourceApi.enumerateResources(getWorkspaceId(), 0, 5, /*referenceType=*/
null, /*stewardShipType=*/
null);
assertEquals(1, referenceList.getResources().size());
assertEquals(StewardshipType.REFERENCED, referenceList.getResources().get(0).getMetadata().getStewardshipType());
assertEquals(ResourceType.GIT_REPO, referenceList.getResources().get(0).getMetadata().getResourceType());
}
Aggregations