tenant-permission tests

backend/dataall/modules/mlstudio/services/mlstudio_service.py

@@ -40,8 +40,8 @@
 class SagemakerStudioCreationRequest:
     """A request dataclass for ml studio user profile creation. Adds default values for missed parameters"""
 
-    label: str
-    SamlAdminGroupName: str
+    label: str = None
+    SamlAdminGroupName: str = None
     environment: Dict = field(default_factory=dict)
     description: str = 'No description provided'
     tags: List[str] = field(default_factory=list)

backend/dataall/modules/notebooks/services/notebook_service.py

@@ -42,10 +42,10 @@
 class NotebookCreationRequest:
     """A request dataclass for notebook creation. Adds default values for missed parameters"""
 
-    label: str
-    VpcId: str
-    SubnetId: str
-    SamlAdminGroupName: str
+    label: str = None
+    VpcId: str = None
+    SubnetId: str = None
+    SamlAdminGroupName: str = None
     environment: Dict = field(default_factory=dict)
     description: str = 'No description provided'
     VolumeSizeInGB: int = 32

backend/dataall/modules/worksheets/api/resolvers.py

@@ -11,8 +11,6 @@ def create_worksheet(context: Context, source, input: dict = None):
         raise exceptions.RequiredParameter(input)
     if not input.get('SamlAdminGroupName'):
         raise exceptions.RequiredParameter('groupUri')
-    if input.get('SamlAdminGroupName') not in context.groups:
-        raise exceptions.InvalidInput('groupUri', input.get('SamlAdminGroupName'), " a user's groups")
     if not input.get('label'):
         raise exceptions.RequiredParameter('label')
 

backend/dataall/modules/worksheets/services/worksheet_service.py

@@ -36,6 +36,10 @@ def _get_worksheet_by_uri(session, uri: str) -> Worksheet:
     @TenantPolicyService.has_tenant_permission(MANAGE_WORKSHEETS)
     def create_worksheet(data=None) -> Worksheet:
         context = get_context()
+        if data['SamlAdminGroupName'] not in context.groups:
+            raise exceptions.UnauthorizedOperation(
+                'CREATE_WORKSHEET', f"user {context.username} does not belong to group {data['SamlAdminGroupName']}"
+            )
         with context.db_engine.scoped_session() as session:
             worksheet = Worksheet(
                 owner=context.username,

tests/conftest.py

@@ -93,18 +93,24 @@ def user3():
     yield User('david')
 
 
-def _create_group(db, tenant, name, user):
+@pytest.fixture(scope='module', autouse=True)
+def userNoTenantPermissions():
+    yield User('noPermissionsUser')
+
+
+def _create_group(db, tenant, name, user, attach_permissions=True):
     with db.scoped_session() as session:
         group = Group(name=name, label=name, owner=user.username)
         session.add(group)
         session.commit()
 
-        TenantPolicyService.attach_group_tenant_policy(
-            session=session,
-            group=name,
-            permissions=TENANT_ALL,
-            tenant_name=tenant.name,
-        )
+        if attach_permissions:
+            TenantPolicyService.attach_group_tenant_policy(
+                session=session,
+                group=name,
+                permissions=TENANT_ALL,
+                tenant_name=tenant.name,
+            )
         return group
 
 
@@ -133,6 +139,11 @@ def not_in_org_group(db, tenant, user):
     yield _create_group(db, tenant, 'NotInOrgGroup', user)
 
 
+@pytest.fixture(scope='module')
+def groupNoTenantPermissions(db, tenant, userNoTenantPermissions):
+    yield _create_group(db, tenant, 'groupNoTenantPermissions', userNoTenantPermissions, attach_permissions=False)
+
+
 @pytest.fixture(scope='module', autouse=True)
 def tenant(db, permissions):
     with db.scoped_session() as session:

tests/test_tenant_unauthorized.py

@@ -0,0 +1,155 @@
+from unittest.mock import MagicMock
+import pytest
+from assertpy import assert_that
+from dataall.base.api import bootstrap
+from dataall.base.loader import load_modules, ImportMode
+from dataall.base.context import RequestContext
+from dataall.base.db.exceptions import TenantUnauthorized
+import inspect
+
+
+load_modules(modes={ImportMode.API})
+
+NO_CHECK_PERMS = [
+    'Mutation.updateGroupTenantPermissions',
+    'Mutation.updateSSMParameter',
+    'Mutation.createNetwork',
+    'Mutation.deleteNetwork',
+    'Mutation.updateStack',
+    'Mutation.updateKeyValueTags',
+    'Mutation.createMetadataForm',
+    'Mutation.createMetadataFormVersion',
+    'Mutation.createAttachedMetadataForm',
+    'Mutation.deleteMetadataForm',
+    'Mutation.deleteMetadataFormVersion',
+    'Mutation.deleteAttachedMetadataForm',
+    'Mutation.createMetadataFormFields',
+    'Mutation.deleteMetadataFormField',
+    'Mutation.batchMetadataFormFieldUpdates',
+    'Mutation.startMaintenanceWindow',
+    'Mutation.stopMaintenanceWindow',
+    'Mutation.markNotificationAsRead',
+    'Mutation.deleteNotification',
+    'Mutation.postFeedMessage',
+    'Mutation.createGlossary',
+    'Mutation.updateGlossary',
+    'Mutation.deleteGlossary',
+    'Mutation.createCategory',
+    'Mutation.updateCategory',
+    'Mutation.deleteCategory',
+    'Mutation.createTerm',
+    'Mutation.updateTerm',
+    'Mutation.deleteTerm',
+    'Mutation.approveTermAssociation',
+    'Mutation.dismissTermAssociation',
+    'Mutation.startReindexCatalog',
+    'Mutation.createShareObject',
+    'Mutation.deleteShareObject',
+    'Mutation.cancelShareExtension',
+    'Mutation.addSharedItem',
+    'Mutation.removeSharedItem',
+    'Mutation.submitShareObject',
+    'Mutation.submitShareExtension',
+    'Mutation.approveShareObject',
+    'Mutation.approveShareExtension',
+    'Mutation.rejectShareObject',
+    'Mutation.revokeItemsShareObject',
+    'Mutation.verifyItemsShareObject',
+    'Mutation.reApplyItemsShareObject',
+    'Mutation.updateShareRejectReason',
+    'Mutation.updateShareExpirationPeriod',
+    'Mutation.updateShareExtensionReason',
+    'Mutation.updateShareRequestReason',
+    'Mutation.updateShareItemFilters',
+    'Mutation.removeShareItemFilter',
+    'Mutation.upVote',
+]
+
+CHECK_PERMS = [
+    'Mutation.createOrganization',
+    'Mutation.updateOrganization',
+    'Mutation.archiveOrganization',
+    'Mutation.inviteGroupToOrganization',
+    'Mutation.updateOrganizationGroup',
+    'Mutation.removeGroupFromOrganization',
+    'Mutation.createEnvironment',
+    'Mutation.updateEnvironment',
+    'Mutation.inviteGroupOnEnvironment',
+    'Mutation.addConsumptionRoleToEnvironment',
+    'Mutation.updateGroupEnvironmentPermissions',
+    'Mutation.removeGroupFromEnvironment',
+    'Mutation.removeConsumptionRoleFromEnvironment',
+    'Mutation.deleteEnvironment',
+    'Mutation.enableDataSubscriptions',
+    'Mutation.DisableDataSubscriptions',
+    'Mutation.updateConsumptionRole',
+    'Mutation.createSagemakerStudioUser',
+    'Mutation.deleteSagemakerStudioUser',
+    'Mutation.createSagemakerNotebook',
+    'Mutation.startSagemakerNotebook',
+    'Mutation.stopSagemakerNotebook',
+    'Mutation.deleteSagemakerNotebook',
+    # 'Mutation.syncDatasetTableColumns',
+    # 'Mutation.updateDatasetTableColumn',
+    # 'Mutation.startDatasetProfilingRun',
+    # 'Mutation.createDatasetStorageLocation',
+    # 'Mutation.updateDatasetStorageLocation',
+    # 'Mutation.deleteDatasetStorageLocation',
+    # 'Mutation.createDataset',
+    # 'Mutation.updateDataset',
+    # 'Mutation.generateDatasetAccessToken',
+    # 'Mutation.deleteDataset',
+    # 'Mutation.importDataset',
+    # 'Mutation.startGlueCrawler',
+    # 'Mutation.updateDatasetTable',
+    # 'Mutation.deleteDatasetTable',
+    # 'Mutation.syncTables',
+    # 'Mutation.createTableDataFilter',
+    # 'Mutation.deleteTableDataFilter',
+    # 'Mutation.createRedshiftConnection',
+    # 'Mutation.deleteRedshiftConnection',
+    # 'Mutation.addConnectionGroupPermission',
+    # 'Mutation.deleteConnectionGroupPermission',
+    # 'Mutation.importRedshiftDataset',
+    # 'Mutation.updateRedshiftDataset',
+    # 'Mutation.deleteRedshiftDataset',
+    # 'Mutation.addRedshiftDatasetTables',
+    # 'Mutation.deleteRedshiftDatasetTable',
+    # 'Mutation.updateRedshiftDatasetTable',
+    'Mutation.importDashboard',
+    'Mutation.updateDashboard',
+    'Mutation.deleteDashboard',
+    'Mutation.requestDashboardShare',
+    'Mutation.approveDashboardShare',
+    'Mutation.rejectDashboardShare',
+    # 'Mutation.createQuicksightDataSourceSet',
+    # 'Mutation.verifyDatasetShareObjects',
+    # 'Mutation.reApplyShareObjectItemsOnDataset',
+    'Mutation.createWorksheet',
+    'Mutation.updateWorksheet',
+    'Mutation.deleteWorksheet',
+]
+
+ALL_RESOLVERS = {
+    f'{_type.name}.{field.name}': field.resolver
+    for _type in bootstrap().types
+    for field in _type.fields
+    if field.resolver
+}
+
+
+@pytest.mark.parametrize('name,field_resolver', [(name, ALL_RESOLVERS.get(name, None)) for name in CHECK_PERMS])
+def test_unauthorized_tenant_permissions(
+    name, field_resolver, mocker, db, userNoTenantPermissions, groupNoTenantPermissions
+):
+    assert_that(field_resolver).is_not_none()
+    mock_local = MagicMock()
+    mock_local.context = RequestContext(
+        db, userNoTenantPermissions.username, [groupNoTenantPermissions.groupUri], userNoTenantPermissions
+    )
+    with mocker.patch('dataall.base.context._request_storage', mock_local):
+        print(inspect.signature(field_resolver).parameters.keys())
+        iargs = {arg: MagicMock() for arg in inspect.signature(field_resolver).parameters.keys()}
+        assert_that(field_resolver).raises(TenantUnauthorized).when_called_with(**iargs).contains(
+            'UnauthorizedOperation'
+        )