Make event ACL editable via Tobira

backend/src/api/model/acl.rs

@@ -1,5 +1,6 @@
-use juniper::GraphQLObject;
+use juniper::{GraphQLInputObject, GraphQLObject};
 use postgres_types::BorrowToSql;
+use serde::Serialize;
 
 use crate::{api::{util::TranslatedString, Context, err::ApiResult}, db::util::select};
 
@@ -94,3 +95,10 @@ where
         }
     }).await.map_err(Into::into)
 }
+
+#[derive(Debug, GraphQLInputObject, Serialize)]
+pub(crate) struct AclInput {
+    pub allow: bool,
+    pub action: String,
+    pub role: String,
+}

backend/src/api/model/event.rs

@@ -19,6 +19,8 @@ use crate::{
     prelude::*,
 };
 
+use self::{acl::AclInput, err::ApiError};
+
 use super::playlist::VideoListEntry;
 
 
@@ -212,6 +214,11 @@ impl AuthorizedEvent {
         &self.tobira_deletion_timestamp
     }
 
+     /// Whether the event has active workflows.
+     async fn has_active_workflows(&self, context: &Context) -> ApiResult<bool> {
+        Self::has_active_workflows(&self, context).await
+    }
+
     async fn series(&self, context: &Context) -> ApiResult<Option<Series>> {
         if let Some(series) = self.series {
             Ok(Series::load_by_key(series, context).await?)
@@ -337,21 +344,37 @@ impl AuthorizedEvent {
             .pipe(Ok)
     }
 
-    pub(crate) async fn delete(id: Id, context: &Context) -> ApiResult<RemovedEvent> {
+    async fn load_for_api(
+        id: Id,
+        context: &Context,
+        not_found_error: ApiError,
+        not_authorized_error: ApiError,
+    ) -> ApiResult<AuthorizedEvent> {
         let event = Self::load_by_id(id, context)
-            .await? 
-            .ok_or_else(|| err::invalid_input!(
-                key = "event.delete.not-found",
-                "event not found",
-            ))?
+            .await?
+            .ok_or_else(|| not_found_error)?
             .into_result()?;
 
         if !context.auth.overlaps_roles(&event.write_roles) {
-            return Err(err::not_authorized!(
+            return Err(not_authorized_error);
+        }
+
+        Ok(event)
+    }
+
+    pub(crate) async fn delete(id: Id, context: &Context) -> ApiResult<RemovedEvent> {
+        let event = Self::load_for_api(
+            id,
+            context,
+            err::invalid_input!(
+                key = "event.delete.not-found",
+                "event not found"
+            ),
+            err::not_authorized!(
                 key = "event.delete.not-allowed",
                 "you are not allowed to delete this event",
-            ));
-        }
+            )
+        ).await?;
 
         let response = context
             .oc_client
@@ -381,6 +404,120 @@ impl AuthorizedEvent {
         }
     }
 
+    async fn has_active_workflows(&self, context: &Context) -> ApiResult<bool> {
+        if !context.auth.overlaps_roles(&self.write_roles) {
+            return Err(err::not_authorized!(
+                key = "event.workflow.not-allowed",
+                "you are not allowed to inquire about this event's workflow activity",
+            ));
+        }
+
+        let response = context
+            .oc_client
+            .has_active_workflows(&self.opencast_id)
+            .await
+            .map_err(|e| {
+                error!("Failed to get workflow activity: {}", e);
+                err::opencast_unavailable!("Failed to communicate with Opencast")
+            })?;
+
+        Ok(response)
+    }
+
+    pub(crate) async fn update_acl(id: Id, acl: Vec<AclInput>, context: &Context) -> ApiResult<AuthorizedEvent> {
+        let event = Self::load_for_api(
+            id,
+            context,
+            err::invalid_input!(
+                key = "event.acl.not-found",
+                "event not found",
+            ),
+            err::not_authorized!(
+                key = "event.acl.not-allowed",
+                "you are not allowed to update this event's acl",
+            )
+        ).await?;
+
+        if Self::has_active_workflows(&event, context).await? {
+            return Err(err::not_authorized!(
+                key = "event.workflow.active",
+                "acl change blocked by another workflow",
+            ));
+        }
+
+        let response = context
+            .oc_client
+            .update_event_acl(&event.opencast_id, &acl)
+            .await
+            .map_err(|e| {
+                error!("Failed to send acl update request: {}", e);
+                err::opencast_unavailable!("Failed to communicate with Opencast")
+            })?;
+
+        if response.status() == StatusCode::NO_CONTENT {
+            // 204: The access control list for the specified event is updated.
+            let roles_for_action = |target_action: &str| -> Vec<String> {
+                acl.iter()
+                    .filter(|entry| entry.allow && entry.action == target_action)
+                    .map(|entry| entry.role.clone())
+                    .collect()
+            };
+            let read_roles = roles_for_action("read");
+            let write_roles = roles_for_action("write");
+            info!(event_id = %id, "Requested acl update of event");
+
+            // Todo: also update preview roles
+            context.db.execute("\
+                update all_events \
+                set read_roles = $2, write_roles = $3 \
+                where id = $1 \
+            ", &[&event.key, &read_roles, &write_roles]).await?;
+
+            Self::start_workflow(&event.opencast_id, "republish-metadata", &context).await?;
+            Ok(event)
+        } else {
+            warn!(
+                event_id = %id,
+                "Failed to update event acl, OC returned status: {}",
+                response.status(),
+            );
+            Err(err::opencast_unavailable!("Opencast API error: {}", response.status()))
+        }
+    }
+
+    /// Starts a workflow on the event.
+    async fn start_workflow(oc_id: &String, workflow_id: &str, context: &Context) -> ApiResult<StatusCode> {
+        let response = context
+            .oc_client
+            .start_workflow(&oc_id, "republish-metadata")
+            .await
+            .map_err(|e| {
+                error!("Failed sending request to start workflow: {}", e);
+                err::opencast_unavailable!("Failed to communicate with Opencast")
+            })?;
+
+        if response.status() == StatusCode::CREATED {
+            // 201: A new workflow is created.
+            info!(workflow = %workflow_id, "Requested creation of workflow");
+            Ok(response.status())
+        } else if response.status() == StatusCode::NOT_FOUND {
+            // 404: The specified workflow instance does not exist.
+            warn!(
+                workflow = %workflow_id,
+                "{}: The specified workflow instance does not exist.",
+                response.status(),
+            );
+            Err(err::opencast_unavailable!("Opencast API error: {}", response.status()))
+        } else {
+            warn!(
+                workflow = %workflow_id,
+                "Failed to create workflow, OC returned status: {}",
+                response.status(),
+            );
+            Err(err::opencast_unavailable!("Opencast API error: {}", response.status()))
+        }
+    }
+
     pub(crate) async fn load_writable_for_user(
         context: &Context,
         order: EventSortOrder,

backend/src/api/model/realm/mod.rs

@@ -381,7 +381,7 @@ impl Realm {
         self.owner_display_name.as_deref()
     }
 
-    /// Returns the acl of this realm, combining moderator and admin roles and assigns 
+    /// Returns the acl of this realm, combining moderator and admin roles and assigns
     /// the respective actions that are necessary for UI purposes.
     async fn own_acl(&self, context: &Context) -> ApiResult<Acl> {
         let raw_roles_sql = "

backend/src/api/model/series.rs

@@ -182,7 +182,7 @@ impl Series {
 
             return Ok(RemoveMountedSeriesOutcome::RemovedRealm(removed_realm));
         }
-        
+
         if old_realm.name_from_block.map(Id::block) == Some(blocks[0].id()) {
             // The realm has its name derived from the series block that is being removed - so the name
             // shouldn't be used anymore. Ideally this would restore the previous title,

backend/src/api/mutation.rs

@@ -6,6 +6,7 @@ use super::{
     err::ApiResult,
     id::Id,
     model::{
+        acl::AclInput,
         series::{Series, NewSeries},
         realm::{
             ChildIndex,
@@ -58,7 +59,7 @@ impl Mutation {
     /// Deletes the given event. Meaning: a deletion request is sent to Opencast, the event
     /// is marked as "deletion pending" in Tobira, and fully removed once Opencast
     /// finished deleting the event.
-    /// 
+    ///
     /// Returns the deletion timestamp in case of success and errors otherwise.
     /// Note that "success" in this case only means the request was successfully sent
     /// and accepted, not that the deletion itself succeeded, which is instead checked
@@ -67,6 +68,15 @@ impl Mutation {
         AuthorizedEvent::delete(id, context).await
     }
 
+    /// Updates the acl of a given event by sending a PUT request to Opencast. If the request is
+    /// successful (as indicated by the response code 204), the updated acl is already stored in Tobira
+    /// without waiting for an upcoming sync - however this means it might get overwritten again if
+    /// the update in Opencast failed for some reason.
+    /// This solution should be improved in the future.
+    async fn update_event_acl(id: Id, acl: Vec<AclInput>, context: &Context) -> ApiResult<AuthorizedEvent> {
+        AuthorizedEvent::update_acl(id, acl, context).await
+    }
+
     /// Sets the order of all children of a specific realm.
     ///
     /// `childIndices` must contain at least one element, i.e. do not call this

backend/src/config/general.rs

@@ -12,7 +12,7 @@ pub(crate) struct GeneralConfig {
 
     /// Public URL to Tobira (without path).
     /// Used for RSS feeds, as those require specifying absolute URLs to resources.
-    /// 
+    ///
     /// Example: "https://tobira.my-uni.edu".
     pub(crate) tobira_url: HttpHost,
 
@@ -22,12 +22,12 @@ pub(crate) struct GeneralConfig {
     /// These can be specified in multiple languages.
     /// Consent is prompted upon first use and only if this is configured. It is
     /// re-prompted when any of these values change.
-    /// 
+    ///
     /// We recommend not to configure this unless absolutely necessary,
     /// in order to not degrade the user experience needlessly.
-    /// 
+    ///
     /// Example:
-    /// 
+    ///
     /// ```
     /// initial_consent.title.en = "Terms & Conditions"
     /// initial_consent.button.en = "Agree"
@@ -49,7 +49,7 @@ pub(crate) struct GeneralConfig {
     /// add custom ones. Note that these two default links are special and can
     /// be specified with only the shown string. To add custom ones, you need
     /// to define a label and a link. The link is either the same for every language
-    /// or can be specified for each language in the same manner as the label. 
+    /// or can be specified for each language in the same manner as the label.
     /// Example:
     ///
     /// ```
@@ -110,6 +110,18 @@ pub(crate) struct GeneralConfig {
     /// (partial) name.
     #[config(default = false)]
     pub users_searchable: bool,
+
+    /// This allows users to edit the ACL of events they have write access for.
+    /// Doing so will update these in Opencast and start the `republish-metadata`
+    /// workflow to propagate the changes to other publications as well.
+    /// Instead of waiting for the workflow however, Tobira will also immediately
+    /// store the updated ACL in its database.
+    ///
+    /// Note that this might lead to situations where the event ACL in Tobira is different
+    /// from that in other publications, mainly if the afore mentioned workflow fails
+    /// or takes an unusually long time to complete.
+    #[config(default = true)]
+    pub allow_acl_edit: bool,
 }
 
 const INTERNAL_RESERVED_PATHS: &[&str] = &["favicon.ico", "robots.txt", ".well-known"];

backend/src/http/assets.rs

@@ -278,6 +278,7 @@ fn frontend_config(config: &Config) -> serde_json::Value {
         "initialConsent": config.general.initial_consent,
         "showDownloadButton": config.general.show_download_button,
         "usersSearchable": config.general.users_searchable,
+        "allowAclEdit": config.general.allow_acl_edit,
         "footerLinks": config.general.footer_links,
         "metadataLabels": config.general.metadata,
         "paellaPluginConfig": config.player.paella_plugin_config,

backend/src/sync/client.rs

@@ -14,6 +14,7 @@ use serde::Deserialize;
 use tap::TapFallible;
 
 use crate::{
+    api::model::acl::AclInput,
     config::{Config, HttpHost},
     prelude::*,
     sync::harvest::HarvestResponse,
@@ -140,7 +141,7 @@ impl OcClient {
     }
 
     pub async fn delete_event(&self, oc_id: &String) -> Result<Response<Incoming>> {
-        let pq = format!("/api/events/{}", oc_id);
+        let pq = format!("/api/events/{oc_id}");
         let req = self.authed_req_builder(&self.external_api_node, &pq)
             .method(http::Method::DELETE)
             .body(RequestBody::empty())
@@ -149,6 +150,48 @@ impl OcClient {
         self.http_client.request(req).await.map_err(Into::into)
     }
 
+    pub async fn update_event_acl(&self, oc_id: &String, acl: &Vec<AclInput>) -> Result<Response<Incoming>> {
+        let pq = format!("/api/events/{oc_id}/acl");
+        let req = self.authed_req_builder(&self.external_api_node, &pq)
+            .method(http::Method::PUT)
+            .header(http::header::CONTENT_TYPE, "application/x-www-form-urlencoded")
+            .body(
+                format!("acl={}", serde_json::to_string(&acl).expect("Failed to serialize")).into()
+            )
+            .expect("failed to build request");
+
+        self.http_client.request(req).await.map_err(Into::into)
+    }
+
+    pub async fn start_workflow(&self, oc_id: &String, workflow_id: &str) -> Result<Response<Incoming>> {
+        let params = format!("\
+            event_identifier={oc_id}\
+            &workflow_definition_identifier={workflow_id}\
+        ");
+        let req = self.authed_req_builder(&self.external_api_node, "/api/workflows")
+            .method(http::Method::POST)
+            .header(http::header::CONTENT_TYPE, "application/x-www-form-urlencoded")
+            .body(params.into())
+            .expect("failed to build request");
+
+        self.http_client.request(req).await.map_err(Into::into)
+    }
+
+    pub async fn has_active_workflows(&self, oc_id: &String) -> Result<bool> {
+        let pq = format!("/workflow/mediaPackage/{oc_id}/hasActiveWorkflows");
+        let req = self.authed_req_builder(&self.external_api_node, &pq)
+            .header(http::header::CONTENT_TYPE, "application/x-www-form-urlencoded")
+            .body(RequestBody::empty())
+            .expect("failed to build request");
+        let uri = req.uri().clone();
+        let response = self.http_client.request(req)
+            .await
+            .with_context(|| format!("HTTP request failed (uri: '{uri}')"))?;
+
+        let (out, _) = self.deserialize_response(response, &uri).await?;
+        Ok(out)
+    }
+
     fn build_authed_req(&self, node: &HttpHost, path_and_query: &str) -> (Uri, Request<RequestBody>) {
         let req = self.authed_req_builder(node, path_and_query)
             .body(RequestBody::empty())