{% block js %}
-
+
{% endblock %}
diff --git a/megaqc/user/models.py b/megaqc/user/models.py
index 5ce64fcc..489353ca 100644
--- a/megaqc/user/models.py
+++ b/megaqc/user/models.py
@@ -7,6 +7,7 @@
import sys
from builtins import str
+from flask import current_app
from flask_login import UserMixin
from passlib.hash import argon2
from passlib.utils import getrandstr, rng
@@ -21,6 +22,10 @@
Integer,
Table,
UnicodeText,
+ event,
+ func,
+ select,
+ update,
)
from sqlalchemy.ext.declarative import declarative_base
from sqlalchemy.ext.hybrid import hybrid_method, hybrid_property
@@ -29,20 +34,8 @@
from megaqc.database import CRUDMixin
from megaqc.extensions import db
-if sys.version_info.major == 2:
- letters = string.letters
- digits = string.digits
-elif sys.version_info.major == 3:
- letters = string.ascii_letters
- digits = string.digits
-else:
- raise (
- Exception(
- "Unsupport python version: v{}.{}".format(
- sys.version_info.major, sys.version_info.minor
- )
- )
- )
+letters = string.ascii_letters
+digits = string.digits
class Role(db.Model, CRUDMixin):
@@ -94,6 +87,11 @@ def __init__(self, password=None, **kwargs):
Create instance.
"""
db.Model.__init__(self, **kwargs)
+
+ # Config adjusts the default active status
+ if "active" not in kwargs:
+ self.active = not current_app.config["USER_REGISTRATION_APPROVAL"]
+
self.salt = getrandstr(rng, digits + letters, 80)
self.api_token = getrandstr(rng, digits + letters, 80)
if password:
@@ -101,8 +99,21 @@ def __init__(self, password=None, **kwargs):
else:
self.password = None
- if self.user_id == 1:
+ def enforce_admin(self):
+ """
+ Enforce that the first user is an active admin.
+
+ This is included as a method that isn't automatically called,
+ because there are cases where we don't want this behaviour to
+ happen, such as during testing.
+ """
+ if db.session.query(User).count() == 0:
self.is_admin = True
+ self.active = True
+
+ # users = User.__table__
+ # if target.user_id == 1:
+ # connection.execute(users.update().where(users.c.user_id == 1).values(is_admin=True, active=True))
@hybrid_property
def full_name(self):
@@ -140,3 +151,11 @@ def __repr__(self):
Represent instance as a unique string.
"""
return "".format(username=self.username)
+
+
+# @event.listens_for(User, 'after_insert')
+# def receive_after_insert(mapper, connection, target):
+# # Here we enforce the business rule that the first user should be an active admin
+# users = User.__table__
+# if target.user_id == 1:
+# connection.execute(users.update().where(users.c.user_id == 1).values(is_admin=True, active=True))
diff --git a/setup.py b/setup.py
index 41b16a8e..b2f18637 100644
--- a/setup.py
+++ b/setup.py
@@ -12,7 +12,7 @@
setup(
name="megaqc",
- version="0.2.0",
+ version="0.3.0",
author="Phil Ewels",
author_email="phil.ewels@scilifelab.se",
description="Collect and visualise data across multiple MultiQC runs",
diff --git a/tests/api/conftest.py b/tests/api/conftest.py
index a0d3f017..714278b5 100644
--- a/tests/api/conftest.py
+++ b/tests/api/conftest.py
@@ -1,12 +1,14 @@
import pytest
from flask import request
+from flask.testing import FlaskClient
from tests import factories
-@pytest.yield_fixture("function")
+@pytest.fixture("function")
def client(app):
with app.test_client() as c:
+ c: FlaskClient
yield c
@@ -24,9 +26,3 @@ def admin_token(db):
db.session.add(user)
db.session.commit()
return user.api_token
-
-
-@pytest.fixture()
-def session(db):
- sess = db.session
- return sess
diff --git a/tests/api/test_api.py b/tests/api/test_api.py
index 7f461a21..d50f6de9 100644
--- a/tests/api/test_api.py
+++ b/tests/api/test_api.py
@@ -5,162 +5,23 @@
import pytest
from flask import url_for
from marshmallow import EXCLUDE
-from sqlalchemy import inspect
-from sqlalchemy.orm import RelationshipProperty
-from tests import factories
-
-
-def unset_dump_only(schema):
- """
- Unset the "dump_only" property for every field in this schema.
- """
- for field in schema.declared_fields.values():
- field.dump_only = False
- schema._init_fields()
-
-
-def dump_only_fields(schema):
- """
- Returns a list of field names for the dump_only fields.
- """
- return [key for key, field in schema._declared_fields.items() if field.dump_only]
-
-
-def object_as_dict(obj, relationships=False):
- """
- Converts an SQLAlchemy instance to a dictionary.
-
- :param relationships: If true, also include relationships in the output dict
- """
- properties = inspect(obj).mapper.all_orm_descriptors
-
- if not relationships:
- properties = {
- key: value
- for key, value in properties.items()
- if not hasattr(value, "prop")
- or not isinstance(value.prop, RelationshipProperty)
- }
-
- return {key: getattr(obj, key) for key, value in properties.items()}
-
-
-def resource_from_endpoint(app, endpoint):
- """
- Given a string endpoint, e.g. "rest_api.upload", returns the Resource
- object for that URL.
- """
- return app.view_functions[endpoint].view_class
-
-
-all_factories = factories.BaseFactory.__subclasses__()
-
-
-def find_factory(model):
- """
- Returns a factory that will build an instance of the provided model.
- """
- for factory in all_factories:
- if factory._meta.model == model:
- return factory
-
-
-def relationship_fields(model):
- """
- Returns a list of keys that each correspond to a relationship on this
- model.
- """
- return [rel.key for rel in inspect(model).relationships.values()]
-
-
-def instance_pk(instance):
- """
- Returns a tuple of (column_name, column_value) for the first primary key on
- this instance.
- """
- column_name = inspect(instance.__class__).primary_key[0].name
- return column_name, getattr(instance, column_name)
-
-
-def find_matching_resource(data, instance, model):
- """
- Given an array of dictionaries, checks if at least one of the dictionaries
- matches the provided instance.
-
- :param data: A list of dictionaries
- :param instance: An SQLAlchemy model instance
- :param model: An SQLAlchemy model (subclass of declarative_base())
- """
- for result in data:
- if is_matching_resource(result, instance, model):
- return True
- return False
-
-
-def is_matching_resource(result, instance, model):
- """
- Given a single dictionary, checks if it matches the provided SQLAlchemy
- model instance.
-
- :param result: Instance dictionary
- :param instance: An SQLAlchemy model instance
- :param model: An SQLAlchemy model (subclass of declarative_base())
- """
- # Remove relationships because we can't validate them easily
- for field in relationship_fields(model):
- if field in result:
- del result[field]
-
- if result.items() <= object_as_dict(instance).items():
- return True
-
- return False
-
-
-def clone_model(instance):
- """
- Clones an SQLAlchemy instance.
- """
- # Copy the attributes as a dictionary
- dict = object_as_dict(instance, relationships=True)
- # Find the primary key and remove the ID
- column_name = inspect(instance.__class__).primary_key[0].name
- del dict[column_name]
- # Create a new instance using this data
- new_instance = instance.__class__(**dict)
- return new_instance
-
-
-def factory_clone(instance, factory):
- """
- Generate a new object using the factory, except that relationships are
- copied from the provided instance, ensuring that no new objects are
- created.
- """
- rels = {
- key: getattr(instance, key) for key in relationship_fields(instance.__class__)
- }
- return factory(**rels)
+from .utils import (
+ dump_only_fields,
+ factory_clone,
+ find_factory,
+ find_matching_resource,
+ instance_pk,
+ is_matching_resource,
+ list_resource_endpoints,
+ resource_from_endpoint,
+ single_resource_endpoints,
+ unset_dump_only,
+ url_for,
+)
-@pytest.mark.parametrize(
- "endpoint",
- [
- "rest_api.uploadlist",
- "rest_api.sampledatalist",
- "rest_api.reportlist",
- "rest_api.reportmetalist",
- "rest_api.samplelist",
- "rest_api.metatypelist",
- "rest_api.datatypelist",
- "rest_api.userlist",
- "rest_api.filterlist",
- "rest_api.filtergrouplist",
- "rest_api.favouriteplotlist",
- "rest_api.dashboardlist",
- ],
-)
+@pytest.mark.parametrize("endpoint", list_resource_endpoints)
def test_get_many_resources(endpoint, session, client, admin_token, app):
"""
GET /resource.
@@ -258,20 +119,7 @@ def test_get_many_resources_associated(
# assert dummy_instance not in data
-@pytest.mark.parametrize(
- "endpoint",
- [
- "rest_api.upload",
- "rest_api.sampledata",
- "rest_api.report",
- "rest_api.sample",
- "rest_api.datatype",
- "rest_api.user",
- "rest_api.filter",
- "rest_api.favouriteplot",
- "rest_api.dashboard",
- ],
-)
+@pytest.mark.parametrize("endpoint", single_resource_endpoints)
def test_get_single_resource(endpoint, session, client, admin_token, app):
"""
GET /resource/1.
diff --git a/tests/api/test_permissions.py b/tests/api/test_permissions.py
new file mode 100644
index 00000000..1040d379
--- /dev/null
+++ b/tests/api/test_permissions.py
@@ -0,0 +1,147 @@
+import pytest
+from flask import Flask
+from marshmallow import EXCLUDE
+
+from megaqc.rest_api.schemas import UserSchema
+from megaqc.user.models import User
+from tests.factories import UserFactory
+
+from .utils import (
+ dump_only_fields,
+ find_factory,
+ instance_pk,
+ list_resource_endpoints,
+ resource_from_endpoint,
+ single_resource_endpoints,
+ url_for,
+)
+
+
+def raise_response(resp: Flask.response_class):
+ if not str(resp.status_code).startswith("2"):
+ raise Exception(
+ "Request failed with status {} and body {}".format(
+ resp.status_code, resp.data
+ )
+ )
+
+
+@pytest.mark.parametrize(
+ "endpoint", set(single_resource_endpoints) - {"rest_api.report"}
+)
+@pytest.mark.parametrize(
+ "method,success",
+ [
+ ["GET", True],
+ ["PATCH", False],
+ ["DELETE", False],
+ ],
+)
+def test_single_resource_permissions(
+ endpoint, method, success, token, admin_token, session, client, app
+):
+ """
+ Test that each endpoint can only be accessed by the appropriate permission
+ level.
+ """
+ resource = resource_from_endpoint(app, endpoint)
+ model = resource.data_layer["model"]
+ factory = find_factory(model)
+
+ # Construct an instance of the model
+ instance = factory()
+ session.commit()
+
+ # Do the request
+ pk = instance_pk(instance)[1]
+ url = url_for(endpoint, id=pk)
+
+ # Check the request had the expected status, given that we're acting as a regular user
+ rv = client.open(
+ url,
+ method=method,
+ headers={"access_token": token, "Content-Type": "application/json"},
+ )
+ # Since we only care about access, we don't check if the request succeeded or not, just if it didn't 403
+ assert (rv.status_code != 403) == success
+
+ # Check the request worked, given that we're now an admin
+ rv = client.open(
+ url,
+ method=method,
+ headers={"access_token": admin_token, "Content-Type": "application/json"},
+ )
+ assert rv.status_code != 403
+
+
+@pytest.mark.parametrize(
+ # These two have unusual permissions
+ "endpoint",
+ set(list_resource_endpoints) - {"rest_api.uploadlist", "rest_api.userlist"},
+)
+@pytest.mark.parametrize(
+ "method,success",
+ [
+ ["GET", True],
+ ["POST", False],
+ ],
+)
+def test_many_resources_permissions(
+ endpoint, method, success, session, client, admin_token, token
+):
+ """
+ Test that each endpoint can only be accessed by the appropriate permission
+ level.
+ """
+ # Do the request
+ url = url_for(endpoint)
+
+ # Check the request had the expected status, given that we're acting as a regular user
+ rv = client.open(
+ url,
+ method=method,
+ headers={"access_token": token, "Content-Type": "application/json"},
+ )
+ # Since we only care about access, we don't check if the request succeeded or not, just if it didn't 403
+ assert (rv.status_code != 403) == success
+
+ # Check the request worked, given that we're now an admin
+ rv = client.open(
+ url,
+ method=method,
+ headers={"access_token": admin_token, "Content-Type": "application/json"},
+ )
+ assert rv.status_code != 403
+
+
+@pytest.mark.parametrize("strict", [True, False])
+def test_active_inactive(session, strict, app, client):
+ """
+ The first user to register should be an activated admin, and subsequent
+ users should be inactive and regular users.
+ """
+ app.config["USER_REGISTRATION_APPROVAL"] = strict
+
+ # Non-admins aren't allowed to specify these fields
+ dump_only = dump_only_fields(UserSchema) + ["admin", "active", "salt", "api_token"]
+ req_schema = UserSchema(many=False, use_links=False, exclude=dump_only)
+ res_schema = UserSchema(many=False, unknown=EXCLUDE)
+ url = url_for("rest_api.userlist")
+ first = UserFactory.build()
+ second = UserFactory.build()
+
+ # The first created user should be an active admin
+ first_res: Flask.response_class = client.post(path=url, json=req_schema.dump(first))
+ raise_response(first_res)
+ first_model: dict = res_schema.load(first_res.json)
+ assert first_model["active"]
+ assert first_model["is_admin"]
+
+ # The second and subsequent users should be active only if it's not in strict mode
+ second_res: Flask.response_class = client.post(
+ path=url, json=req_schema.dump(second)
+ )
+ raise_response(second_res)
+ second_model: dict = res_schema.load(second_res.json)
+ assert second_model["active"] != strict
+ assert not second_model["is_admin"]
diff --git a/tests/api/utils.py b/tests/api/utils.py
new file mode 100644
index 00000000..6e0fb74c
--- /dev/null
+++ b/tests/api/utils.py
@@ -0,0 +1,167 @@
+import pytest
+from flask import url_for
+from marshmallow import EXCLUDE
+from sqlalchemy import inspect
+from sqlalchemy.orm import RelationshipProperty
+
+from tests import factories
+
+single_resource_endpoints = [
+ "rest_api.upload",
+ "rest_api.sampledata",
+ "rest_api.report",
+ "rest_api.sample",
+ "rest_api.datatype",
+ "rest_api.user",
+ "rest_api.filter",
+ "rest_api.favouriteplot",
+ "rest_api.dashboard",
+]
+
+list_resource_endpoints = [
+ "rest_api.uploadlist",
+ "rest_api.sampledatalist",
+ "rest_api.reportlist",
+ "rest_api.reportmetalist",
+ "rest_api.samplelist",
+ "rest_api.metatypelist",
+ "rest_api.datatypelist",
+ "rest_api.userlist",
+ "rest_api.filterlist",
+ "rest_api.filtergrouplist",
+ "rest_api.favouriteplotlist",
+ "rest_api.dashboardlist",
+]
+
+
+def unset_dump_only(schema):
+ """
+ Unset the "dump_only" property for every field in this schema.
+ """
+ for field in schema.declared_fields.values():
+ field.dump_only = False
+ schema._init_fields()
+
+
+def dump_only_fields(schema):
+ """
+ Returns a list of field names for the dump_only fields.
+ """
+ return [key for key, field in schema._declared_fields.items() if field.dump_only]
+
+
+def object_as_dict(obj, relationships=False):
+ """
+ Converts an SQLAlchemy instance to a dictionary.
+
+ :param relationships: If true, also include relationships in the output dict
+ """
+ properties = inspect(obj).mapper.all_orm_descriptors
+
+ if not relationships:
+ properties = {
+ key: value
+ for key, value in properties.items()
+ if not hasattr(value, "prop")
+ or not isinstance(value.prop, RelationshipProperty)
+ }
+
+ return {key: getattr(obj, key) for key, value in properties.items()}
+
+
+def resource_from_endpoint(app, endpoint):
+ """
+ Given a string endpoint, e.g. "rest_api.upload", returns the Resource
+ object for that URL.
+ """
+ return app.view_functions[endpoint].view_class
+
+
+all_factories = factories.BaseFactory.__subclasses__()
+
+
+def find_factory(model):
+ """
+ Returns a factory that will build an instance of the provided model.
+ """
+ for factory in all_factories:
+ if factory._meta.model == model:
+ return factory
+
+
+def relationship_fields(model):
+ """
+ Returns a list of keys that each correspond to a relationship on this
+ model.
+ """
+ return [rel.key for rel in inspect(model).relationships.values()]
+
+
+def instance_pk(instance):
+ """
+ Returns a tuple of (column_name, column_value) for the first primary key on
+ this instance.
+ """
+ column_name = inspect(instance.__class__).primary_key[0].name
+ return column_name, getattr(instance, column_name)
+
+
+def find_matching_resource(data, instance, model):
+ """
+ Given an array of dictionaries, checks if at least one of the dictionaries
+ matches the provided instance.
+
+ :param data: A list of dictionaries
+ :param instance: An SQLAlchemy model instance
+ :param model: An SQLAlchemy model (subclass of declarative_base())
+ """
+ for result in data:
+ if is_matching_resource(result, instance, model):
+ return True
+ return False
+
+
+def is_matching_resource(result, instance, model):
+ """
+ Given a single dictionary, checks if it matches the provided SQLAlchemy
+ model instance.
+
+ :param result: Instance dictionary
+ :param instance: An SQLAlchemy model instance
+ :param model: An SQLAlchemy model (subclass of declarative_base())
+ """
+ # Remove relationships because we can't validate them easily
+ for field in relationship_fields(model):
+ if field in result:
+ del result[field]
+
+ if result.items() <= object_as_dict(instance).items():
+ return True
+
+ return False
+
+
+def clone_model(instance):
+ """
+ Clones an SQLAlchemy instance.
+ """
+ # Copy the attributes as a dictionary
+ dict = object_as_dict(instance, relationships=True)
+ # Find the primary key and remove the ID
+ column_name = inspect(instance.__class__).primary_key[0].name
+ del dict[column_name]
+ # Create a new instance using this data
+ new_instance = instance.__class__(**dict)
+ return new_instance
+
+
+def factory_clone(instance, factory):
+ """
+ Generate a new object using the factory, except that relationships are
+ copied from the provided instance, ensuring that no new objects are
+ created.
+ """
+ rels = {
+ key: getattr(instance, key) for key in relationship_fields(instance.__class__)
+ }
+ return factory(**rels)
diff --git a/tests/conftest.py b/tests/conftest.py
index 5722a18f..f55ac46b 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -6,6 +6,7 @@
from pathlib import Path
import pytest
+from sqlalchemy.orm.session import Session
from webtest import TestApp
from megaqc.app import create_app
@@ -16,14 +17,14 @@
from .factories import UserFactory
-@pytest.yield_fixture(scope="function")
+@pytest.fixture(scope="function")
def multiqc_data():
here = Path(__file__).parent
with (here / "multiqc_data.json").open() as fp:
return fp.read()
-@pytest.yield_fixture(scope="function")
+@pytest.fixture(scope="function")
def app():
"""
An application for the tests.
@@ -47,7 +48,7 @@ def testapp(app):
return TestApp(app)
-@pytest.yield_fixture(scope="function")
+@pytest.fixture(scope="function")
def db(app):
"""
A database for the tests.
@@ -71,3 +72,9 @@ def user(db):
user = UserFactory(password="myprecious")
db.session.commit()
return user
+
+
+@pytest.fixture()
+def session(db):
+ sess: Session = db.session
+ return sess
diff --git a/tests/test_docker.py b/tests/test_docker.py
index 6c43a1a1..c40483a9 100644
--- a/tests/test_docker.py
+++ b/tests/test_docker.py
@@ -7,9 +7,12 @@
def raise_response(resp):
+ """
+ :param resp: Requests response object
+ """
if not str(resp.status_code).startswith("2"):
raise Exception(
- "Request failed with status {} and body{}".format(
+ "Request failed with status {} and body {}".format(
resp.status_code, resp.text
)
)
@@ -19,7 +22,9 @@ def raise_response(resp):
def compose_stack():
deploy = (Path(__file__).parent.parent / "deployment").resolve()
# Start the stack, and wait for it to start up
- subprocess.run(["docker-compose", "up", "-d"], cwd=deploy, check=True)
+ subprocess.run(
+ ["docker-compose", "up", "--build", "--detach"], cwd=deploy, check=True
+ )
time.sleep(15)
yield
# When we're done, stop the stack and cleanup the volumes
@@ -32,11 +37,6 @@ def test_docker():
def test_compose(multiqc_data, compose_stack):
- # Initially we should have no reports
- result = requests.get(url="http://localhost/rest_api/v1/uploads")
- raise_response(result)
- assert len(result.json()["data"]) == 0
-
# Create a user
user = requests.post(
"http://localhost/rest_api/v1/users",
@@ -66,6 +66,8 @@ def test_compose(multiqc_data, compose_stack):
report.raise_for_status()
# Finally, we should have 1 report
- result = requests.get(url="http://localhost/rest_api/v1/uploads")
+ result = requests.get(
+ url="http://localhost/rest_api/v1/uploads", headers={"access_token": token}
+ )
raise_response(result)
assert len(result.json()["data"]) == 1