Skip to content

Commit 86887a5

Browse files
authored
Merge pull request #56 from sbliven/jobconfig
feat: document jobconfig file
2 parents fba9b30 + cee0ae6 commit 86887a5

File tree

16 files changed

+1366
-459
lines changed

16 files changed

+1366
-459
lines changed

.gitignore

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,3 +17,7 @@ docs
1717
*.pdf
1818
.idea
1919
cat
20+
21+
# Website output
22+
_site
23+
.jekyll-cache

Development/v4.x/Data_Model.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ The data model and its API endpoints are described [here](https://scicatproject.
7474

7575
### Job
7676

77-
When a user wants to archive, retrieve or publish a dataset, SciCat must interact with the facility's storage and archiving system. This is done by creating a `Job` to track the interaction. The exact actions taken for each Job are often customized for each facility. A common action would be to forward the new Job entry to a Message Broker, e.g. RabbitMQ, from where it can be picked up by any program willing to react to this Job. For example, at PSI the RabbitMQ queue is emptied by a Node-RED process, which reads the Job information from the RabbitMQ queue. Alternatively, you can use other messaging solutions, such as Apache Kafka. In this way the (site specific) logic to handle the Jobs is kept outside the core of the SciCat system, giving a greater degree of flexibility. The external systems should ideally respond with status updates to the Job model, when there job is finished. As the job progresses, the system can make PUT/PATCH API calls back that update the `Job Status Message` and, when necessary, also the individual status of the involved datasets by updating the DatasetLifecycle information.
77+
When a user wants to archive, retrieve or publish a dataset, SciCat must interact with the facility's storage and archiving system. This is done by creating a `Job` to track the interaction. The exact actions taken for each Job are often customized for each facility. A common action would be to forward the new Job entry to a Message Broker, e.g. RabbitMQ, from where it can be picked up by any program willing to react to this Job. For example, at PSI the RabbitMQ queue is emptied by a Node-RED process, which reads the Job information from the RabbitMQ queue. Alternatively, you can use other messaging solutions, such as Apache Kafka. In this way the (site specific) logic to handle the Jobs is kept outside the core of the SciCat system, giving a greater degree of flexibility. The external systems should ideally respond with updates to the Job model, when the job is finished. As the job progresses, the system can make PUT/PATCH API calls back that update the `Job Status` etc and, when necessary, also the individual status of the involved datasets by updating the DatasetLifecycle information.
7878

7979
The data model and its API endpoints are described [here](https://scicatproject.github.io/api/#operation/Job.create).
8080

Development/v4.x/backend/authorization/authorization_jobs.md

Lines changed: 34 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,24 @@
11
# Jobs Authorization
22
## CASL ability actions
3-
This is the list of the permissions methods available for Jobs and all their endpoints.
4-
The authorization for jobs is consistently different from all the other endpoints
3+
This is the list of the permission methods available for Jobs and all their endpoints.
4+
The authorization for jobs is consistently different from all the other endpoints.
5+
Users in `ADMIN_GROUPS` have elevated access and are allowed to do any operation listed bellow.
56

67
### Endpoint Authorization
78
- JobCreate
89
- JobRead
9-
- JobStatusUpdate
10+
- JobUpdate
1011
- JobDelete
1112

1213
### (Data) Instance Authorization
13-
- JobCreateConfiguration (The jobs create section of the configuration dictats if the user can create the job)
14-
- JobCreateOwner (Users with this privileges can create jobs only for themselves)
15-
- JobCreateAny (Users with this privileges can create jobs for any of the users that are defined in the create section of the job configuration)
14+
- JobCreateConfiguration (The job's create section of the configuration dictates if the user can create the job)
15+
- JobCreateOwner (Users with this privilege can create jobs only for themselves)
16+
- JobCreateAny (Users with this privilege can create jobs for any of the users that are defined in the create section of the job configuration)
1617
- JobReadAccess
1718
- JobReadAny
18-
- JobStatusUpdateConfiguration (The jobs update section in configuration dictates if the user can update the status of the job)
19-
- JobStatusUpdateOwner (Users with this privileges can update the status of jobs belonging to themselves)
20-
- JobStatusUpdateAny (Users with this privileges can update the status of any job)
21-
- JobDeleteAny
19+
- JobUpdateConfiguration (The job's update section in configuration dictates if the user can update the job)
20+
- JobUpdateOwner (Users with this privilege can update jobs belonging to themselves)
21+
- JobUpdateAny (Users with this privilege can update any job)
2222

2323
#### Priority
2424
```mermaid
@@ -27,53 +27,53 @@ graph LR;
2727
JobCreateConfiguration-->JobCreateAny;
2828
JobRead-->JobReadAccess;
2929
JobReadAccess-->JobReadAny;
30-
JobStatusUpdate-->JobStatusUpdateConfiguration;
31-
JobStatusUpdateConfiguration-->JobStatusUpdateAny;
32-
JobDelete-->JobDeleteAny;
30+
JobUpdate-->JobUpdateConfiguration;
31+
JobUpdateConfiguration-->JobUpdateAny;
32+
JobDelete;
3333
```
3434

3535
#### Authorization table
36-
| HTTP method | Endpoint | Endpoint Authentication | Anonymous | Authenticated | Create Jobs Groups | Update Jobs Groups | Admin Groups | Delete Groups | Notes |
37-
| -------- | ------- | ------- | ------- | ------- | ------- | ------- | ------- | ------- | ------- |
38-
| POST | Jobs | _JobCreate_ | _JobCreateConfiguration_ | _JobCreateConfiguration_ | Any<br>_JobsCreateOwner_ | __no__ | Any<br>_JobsCreateAny_ | __no__ | |
39-
| GET | Jobs | _JobReadMany_ | __no__ | Has Access<br>_JobReadAccess_ | Has Access<br>_JobReadAccess_ | __no__ | Any<br>_JobReadAny_ | __no__ | |
40-
| GET | Jobs/_jid_ | _JobReadOne_ | __no__ | Has Access<br>_JobReadAccess_ | Has Access<br>_JobReadAccess_ | __no__ | Any<br>_JobReadAny_ | __no__ | |
41-
| POST | Jobs/statusUpdate | _JobStatusUpdate_ | __no__ | _JobStatusUpdateConfiguration_ | __no__ | Owner<br>_JobStatusUpdateOwner_ | Any<br>_JobStatusUpdateAny_ | __no__ | |
42-
| DELETE | Jobs/_jid_ | _JobDelete_ | __no__ | __no__ | __no__ | __no__ | __no__ | _JobDeleteAny_ | |
36+
| HTTP method | Endpoint | Endpoint Authentication | Anonymous | Authenticated | Create Jobs Groups | Update Jobs Groups | Admin Groups | Delete Groups |
37+
| -------- | ------- | ------- | ------- | ------- | ------- | ------- | ------- | ------- |
38+
| POST | Jobs | _JobCreate_ | _JobCreateConfiguration_ | _JobCreateConfiguration_ | Any<br>_JobsCreateOwner_ | __no__ | Any<br>_JobsCreateAny_ | __no__ |
39+
| GET | Jobs | _JobReadMany_ | __no__ | Has Access<br>_JobReadAccess_ | Has Access<br>_JobReadAccess_ | __no__ | Any<br>_JobReadAny_ | __no__ |
40+
| GET | Jobs/_jid_ | _JobReadOne_ | __no__ | Has Access<br>_JobReadAccess_ | Has Access<br>_JobReadAccess_ | __no__ | Any<br>_JobReadAny_ | __no__ |
41+
| PATCH | Jobs/_jid_ | _JobUpdate_ | __no__ | _JobUpdateConfiguration_ | __no__ | Owner<br>_JobUpdateOwner_ | Any<br>_JobUpdateAny_ | __no__ |
42+
| DELETE | Jobs/_jid_ | _JobDelete_ | __no__ | __no__ | __no__ | __no__ | __no__ | __no__ |
4343

4444
#### Job Create Authorization Table
4545
The _JobCreateConfiguration_ authorization permissions are configured directly in the __*create*__ section of the job configuration.
46-
Any positive match will results in the user acquiring _JobCreate_ endpoint authorization which apply to the jobs endpoint POST:Jobs
46+
Any positive match will result in the user acquiring _JobCreate_ endpoint authorization, which applies to the jobs endpoint `POST:Jobs`
4747

4848
| Job Create Authorization | Endpoint Authentication Translation | Endpoint Authentication Description | Instance Authentication Translation | Instance Authentication Description |
4949
| --- | --- | --- | --- | --- |
5050
| _#all_ | _#all_ | any user can access this endpoint, both anonymous and authenticated | _#all_ | Any user can create this instance of the job |
51-
| _#datasetPublic_ | _#all_ | any user can access this endpoint, both anonymous and and authenticated | _#datasetPublic_ | the job instance will be created only if all the datasets listed are __public__ |
52-
| _#authenticated_ | _#user_ | any valid users can access the endpoint, independently from their groups | _#user_ | any valid users can cretae this instance of the job |
51+
| _#datasetPublic_ | _#all_ | any user can access this endpoint, both anonymous and authenticated | _#datasetPublic_ | the job instance will be created only if all the datasets listed are __public__ |
52+
| _#authenticated_ | _#user_ | any valid users can access the endpoint, independently from their groups | _#user_ | any valid users can create this instance of the job |
5353
| _#datasetAccess_ | _#user_ | any valid user can access this endpoint, independently from their groups | _#datasetAccess_ | the job instance will be created only if the user has access to all the datasets listed |
54-
| _#datasetOwner_ | _#user_ | any valid user can access this endpoint, independently from their groups | _#datasetOwner_ | the job instance will be created only if the user is part of all the datasets owner group |
54+
| _#datasetOwner_ | _#user_ | any valid user can access this endpoint, independently from their groups | _#datasetOwner_ | the job instance will be created only if the user is part of all the datasets' owner group |
5555
| __*@GROUP*__ | __*GROUP*__ | only users that belongs to the specified group can access the endpoint | __*GROUP*__ | the job instance will be created only if the user belongs to the group specified |
5656
| __*USER*__ | __*USER*__ | only the specified user can access the endpoint | __*USER*__ | the job instance can be created only by the user indicated |
5757

58-
__IMPORTANT__: use option _#all_ carefully, as it allows anybody to create a new job. It is mostly use for debuging and testing
58+
__IMPORTANT__: use option _#all_ carefully, as it allows anybody to create a new job. It is mostly used for debuging and testing.
5959

60-
#### Job Status Update Authorization Table
61-
The _JobStatusUpdateConfiguration_ authorization permissions are configured directly in the __*update*__ section of the job configuration.
62-
Any positive match will results in the user acquiring _JobStatusUpdate_ endpoint authorization apply to the jobs endpoint POST:Jobs/statusUpdate
60+
#### Job Update Authorization Table
61+
The _JobUpdateConfiguration_ authorization permissions are configured directly in the __*update*__ section of the job configuration.
62+
Any positive match will result in the user acquiring _JobUpdate_ endpoint authorization, which applies to the jobs endpoint `PATCH:Jobs/id`
6363

64-
| Job Status Update Authorization | Endpoint Authentication Translation | Endpoint Authentication Description | Instance Authentication Translation | Instance Authentication Description |
64+
| Job Update Authorization | Endpoint Authentication Translation | Endpoint Authentication Description | Instance Authentication Translation | Instance Authentication Description |
6565
| --- | --- | --- | --- | --- |
66-
| _#all_ | _#all_ | any user can access this endpoint, both anonymous and authenticated | _#all_ | Any user can update the status of this job instance |
66+
| _#all_ | _#all_ | any user can access this endpoint, both anonymous and authenticated | _#all_ | Any user can update this job instance |
6767
| _#jobOwnerUser_ | _#user_ | authenticated user can access the endpoint | _#jobOwnerUser_ | only the user that is listed in field _ownerUser_ can perform the update |
6868
| _#jobOwnerGroup_ | _#user_ | authenticated user can access the endpoint | _#jobOwnerGroup_ | any user that belongs to the group listed in field _ownerGroup_ can perform the update |
69-
| __*@GROUP*__ | __*GROUP*__ | only users that belongs to the specified group can access the endpoint | __*GROUP*__ | the job status can be updated only by users who belong to the group specified |
70-
| __*USER*__ | __*USER*__ | only the specified user can access the endpoint | __*USER*__ | the job status can be updated only by the user indicated |
69+
| __*@GROUP*__ | __*GROUP*__ | only users that belong to the specified group can access the endpoint | __*GROUP*__ | the job can be updated only by users who belong to the group specified |
70+
| __*USER*__ | __*USER*__ | only the specified user can access the endpoint | __*USER*__ | the job can be updated only by the user indicated |
7171

72-
__IMPORTANT__: use option _#all_ carefully, as it allows anybody to update the status of the job. It is mostly use for debuging and testing
72+
__IMPORTANT__: use option _#all_ carefully, as it allows anybody to update the job. It is mostly used for debuging and testing.
7373

7474
#### Job Authorization priority
7575
The endpoint authorization is the most permissive authorization across all the jobs defined.
76-
The priority between job create and status update authorization is as follow:
76+
The priority between job create and update authorization is as follows:
7777

7878
```mermaid
7979
graph LR;

0 commit comments

Comments
 (0)