Add "create dataset privileged" groups and review dataset authorization (#818)

* Enhanced authorization for all services
* Fixed failing API tests due to authorization modification.

---------


Co-authored-by: Jay Quan <[email protected]>
Co-authored-by: Martin Trajanovski <[email protected]>
Co-authored-by: Björn Pedersen <[email protected]>
Co-authored-by: Martin <[email protected]>

Author: 4 people

.github/workflows/auto-merge-dependabot.yaml

@@ -40,7 +40,7 @@ jobs:
           GITHUB_TOKEN: ${{secrets.PR_APPROVE_TOKEN}}
 
       ## NOTE: Requirements for merge has to be configured in the Branch protection rule page.
-      ## To do so, go to repository > Settings > Branches > Edit
+      ## To do so, go to repository > Settings > Branches > Edit.
       - name: Enable auto-merge for Dependabot PRs
         if: ${{ contains(github.event.pull_request.title, 'bump')}}
         run: gh pr merge --auto --merge "$PR_URL"

.github/workflows/test.yml

@@ -146,11 +146,13 @@ jobs:
           DOI_PREFIX: DOI.SAMPLE.PREFIX
           METADATA_KEYS_RETURN_LIMIT: 100
           METADATA_PARENT_INSTANCES_RETURN_LIMIT: 100
-          ADMIN_GROUPS: admin,ingestor,archivemanager
-          CREATE_DATASET_GROUPS: group1,group2,group3
+          ADMIN_GROUPS: admin,ingestor
           DELETE_GROUPS: archivemanager
+          CREATE_DATASET_GROUPS: group1,group2,group3
+          CREATE_DATASET_WITH_PID_GROUPS: "group2"
           ACCESS_GROUPS_STATIC_VALUES: "ess"
-          CREATE_DATASET_WITH_PID_GROUPS: "group2,group3"
+          PROPOSAL_GROUPS: "proposalingestor"
+          SAMPLE_GROUPS: ""
           DATASET_CREATION_VALIDATION_ENABLED: true
           DATASET_CREATION_VALIDATION_REGEX: "^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-4[0-9A-Fa-f]{3}-[89ABab][0-9A-Fa-f]{3}-[0-9A-Fa-f]{12}$"
           ES_HOST: https://localhost:9200
@@ -168,63 +170,6 @@ jobs:
         # Start mongo container and app before running api tests
         run: |
           cp CI/ESS/docker-compose.api.yaml docker-compose.yaml
+          cp functionalAccounts.json.test functionalAccounts.json
           docker-compose up --build -d
           npm run test:api
-
-  e2e_tests:
-    name: E2E Tests
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-
-      - name: Configure sysctl limits for elastic search
-        run: |
-          sudo swapoff -a
-          sudo sysctl -w vm.swappiness=1
-          sudo sysctl -w fs.file-max=262144
-          sudo sysctl -w vm.max_map_count=262144
-
-      - name: Run stack in docker-compose
-        run: |
-          cp CI/E2E/docker-compose.yaml docker-compose.yaml
-          docker-compose pull
-          docker-compose build --no-cache
-          docker-compose up &
-
-      - name: Checkout frontend repo
-        uses: actions/checkout@v4
-        with:
-          repository: scicatproject/frontend
-          path: frontend
-          fetch-depth: 1
-
-      - name: Wait for Backend
-        run: |
-          npm install -g wait-on && \
-          wait-on http://localhost:3000/api/v3/health --timeout 200000
-
-      - name: Run Cypress tests
-        uses: cypress-io/github-action@v6
-        with:
-          working-directory: frontend
-          config-file: CI/ESS/e2e/cypress.github.ts
-          install-command: npm install --omit peer
-          browser: chrome
-
-      - uses: actions/upload-artifact@v3
-        if: failure()
-        with:
-          name: cypress-screenshots
-          path: frontend/cypress/screenshots/
-
-      - uses: actions/upload-artifact@v3
-        if: failure()
-        with:
-          name: cypress-videos
-          path: frontend/cypress/videos/

functionalAccounts.json.example renamed to functionalAccounts.json.minimal.example

@@ -0,0 +1,72 @@
+[
+  {
+      "username": "admin",
+      "email": "[email protected]",
+      "password": "am2jf70TPNZsSan",
+      "role": "admin",
+      "global": true
+    },
+    {
+      "username": "ingestor",
+      "email": "[email protected]",
+      "password": "aman",
+      "role": "ingestor",
+      "global": false
+    },
+    {
+      "username": "archiveManager",
+      "email": "[email protected]",
+      "password": "aman",
+      "role": "archivemanager",
+      "global": false
+    },
+    {
+      "username": "proposalIngestor",
+      "email": "[email protected]",
+      "password": "aman",
+      "role": "proposalingestor",
+      "global": false
+    },
+    {
+      "username": "user1",
+      "email": "[email protected]",
+      "password": "a609316768619f154ef58db4d847b75e",
+      "role": "group1",
+      "global": false
+    },
+    {
+      "username": "user2",
+      "email": "[email protected]",
+      "password": "f522d1d715970073a6413474ca0e0f63",
+      "role": "group2",
+      "global": false
+    },
+    {
+      "username": "user3",
+      "email": "[email protected]",
+      "password": "70dc489e8ee823ae815e18d664424df2",
+      "role": "group3",
+      "global": false
+    },
+    {
+      "username": "user4",
+      "email": "[email protected]",
+      "password": "0014890e7020f515b92b767227ef2dfa",
+      "role": "group4",
+      "global": false
+    },
+    {
+      "username": "user5.1",
+      "email": "[email protected]",
+      "password": "359a5fda99bfe5dbc42ee9b3ede77fb7",
+      "role": "group5",
+      "global": false
+    },
+    {
+      "username": "user5.2",
+      "email": "[email protected]",
+      "password": "f3ebd2e4def95db59ef95ee32ef45242",
+      "role": "group5",
+      "global": false
+    }
+]

functionalAccounts.json.test

@@ -27,7 +27,7 @@
     "test:api": "npm run test:api:jest --maxWorkers=50% && concurrently -k -s first \"wait-on http://localhost:3000/explorer/ && npm run test:api:mocha\" \"npm run start\"",
     "test:api:jest": "jest --config ./test/config/jest-e2e.json --maxWorkers=50%",
     "test:api:mocha": "mocha --config ./test/config/.mocharc.json",
-    "prepare:local": "docker-compose -f CI/E2E/docker-compose-local.yaml --env-file CI/E2E/.env.elastic-search up  -d && cp functionalAccounts.json.example functionalAccounts.json"
+    "prepare:local": "docker-compose -f CI/E2E/docker-compose-local.yaml --env-file CI/E2E/.env.elastic-search up  -d && cp functionalAccounts.json.test functionalAccounts.json"
   },
   "dependencies": {
     "@casl/ability": "^6.3.2",

package.json

@@ -11,10 +11,10 @@ export class AccessGroupFromStaticValuesService extends AccessGroupService {
   }
 
   async getAccessGroups(): Promise<string[]> {
-    Logger.log(
-      "Static access group getAccessGroups : " +
-        this.staticAccessGroups.join(","),
-    );
+    // Logger.log(
+    //   "Static access group getAccessGroups : " +
+    //     this.staticAccessGroups.join(","),
+    // );
     return this.staticAccessGroups;
   }
 }

src/auth/access-group-provider/access-group-from-static-values.service.ts

@@ -1,4 +1,4 @@
-import { Injectable, Logger } from "@nestjs/common";
+import { HttpException, HttpStatus, Injectable, Logger } from "@nestjs/common";
 import { ConfigService } from "@nestjs/config";
 import { JwtService } from "@nestjs/jwt";
 import { compare } from "bcrypt";
@@ -77,6 +77,9 @@ export class AuthService {
 
   async additionalLogoutTasks(req: Request, logoutURL: string) {
     const user = req.user as Omit<User, "password">;
+    if (!user) {
+      throw new HttpException(`Not logged in`, HttpStatus.UNAUTHORIZED);
+    }
     if (user?.authStrategy === "oidc") {
       const oidcConfig = this.configService.get<OidcConfig>("oidc");
       const autoLogout: boolean = parseBoolean(oidcConfig?.autoLogout || true);

src/auth/auth.service.ts

@@ -29,17 +29,18 @@ export class JwtAuthGuard extends AuthGuard("jwt") {
     info: unknown,
     context: ExecutionContext,
   ) {
-    const allowAny = this.reflector.get<string[]>(
-      "allow-any",
-      context.getHandler(),
-    );
+    // const allowAny = this.reflector.get<string[]>(
+    //   "allow-any",
+    //   context.getHandler(),
+    // );
 
     if (user) {
       return user;
     }
-    if (allowAny) {
-      return null;
-    }
-    throw new UnauthorizedException();
+    // if (allowAny) {
+    //   return null;
+    // }
+    // throw new UnauthorizedException();
+    return null;
   }
 }