Introduce arborist RBAC

.python-version

@@ -0,0 +1 @@
+3.12

docs/local_dev_environment.md

@@ -35,9 +35,11 @@ python3 -m venv py38-venv
 You can install Poetry.  Make sure the virtual environment is activated.
 
 ```console
+# Note: this method is deprecated, returns a 404.
 curl -sSL https://raw.githubusercontent.com/python-poetry/poetry/master/get-poetry.py | python
 source $HOME/.poetry/env
 ```
+See [poetry docs](https://python-poetry.org/docs/#installing-with-pipx)
 
 You can install python dependencies using Poetry:
 
@@ -72,7 +74,22 @@ sudo pg_ctlcluster 12 main start
 If you're on mac, you can install postgres using brew:
 
 ```console
-brew install postgres
+brew install postgresql
+```
+Start the PostgreSQL service: Use Homebrew to start the PostgreSQL service:
+
+```console
+# start
+brew services start postgresql
+
+# verify
+brew services list
+
+# connect
+psql postgres
+
+# stop 
+brew services stop postgresql
 ```
 
 You may also need to create a user.

indexd/alias/blueprint.py

@@ -1,4 +1,7 @@
 import re
+import sys
+import traceback
+
 import flask
 import jsonschema
 
@@ -159,11 +162,15 @@ def handle_multiple_records_error(err):
 
 @blueprint.errorhandler(UserError)
 def handle_user_error(err):
+    print(f"Uncaught Exception: {err}", file=sys.stderr)
+    traceback.print_exc(file=sys.stderr)
     return flask.jsonify(error=str(err)), 400
 
 
 @blueprint.errorhandler(AuthError)
 def handle_auth_error(err):
+    print(f"AuthError: {err}", file=sys.stderr)
+    traceback.print_exc(file=sys.stderr)
     return flask.jsonify(error=str(err)), 403
 
 
@@ -172,6 +179,13 @@ def handle_revision_mismatch(err):
     return flask.jsonify(error=str(err)), 409
 
 
+@blueprint.errorhandler(Exception)
+def handle_uncaught_exception(err):
+    print(f"Uncaught Exception: {err}", file=sys.stderr)
+    traceback.print_exc(file=sys.stderr)
+    return flask.jsonify(error=f"Internal server error {type(err)} {err}"), 500
+
+
 @blueprint.record
 def get_config(setup_state):
     config = setup_state.app.config["ALIAS"]

indexd/auth/__init__.py

@@ -1,9 +1,11 @@
+import sys
 from functools import wraps
 
 from flask import current_app
 from flask import request
 
-from .errors import AuthError
+from .errors import AuthError, AuthzError
+from ..errors import UserError
 
 
 def authorize(*p):
@@ -20,8 +22,8 @@ def authorize(*p):
 
         @wraps(f)
         def check_auth(*args, **kwargs):
-            if not request.authorization:
-                raise AuthError("Username / password required.")
+            if not request.authorization.parameters.get("username"):
+                raise AuthError(f"Basic auth Username / password required. {request.authorization}")
             current_app.auth.auth(
                 request.authorization.parameters.get("username"),
                 request.authorization.parameters.get("password"),
@@ -31,13 +33,20 @@ def check_auth(*args, **kwargs):
 
         return check_auth
     else:
-        method, resources = p
+        method, resources_ = p
         if request.authorization and request.authorization.type == "basic":
             current_app.auth.auth(
                 request.authorization.parameters.get("username"),
                 request.authorization.parameters.get("password"),
             )
         else:
-            if not isinstance(resources, list):
-                raise UserError(f"'authz' must be a list, received '{resources}'.")
-            current_app.auth.authz(method, list(set(resources)))
+            if not isinstance(resources_, list):
+                raise UserError(f"'authz' must be a list, received '{resources_}'.")
+            return current_app.auth.authz(method, list(set(resources_)))
+
+
+def resources():
+    """
+    Returns a list of resources the user has access to. Uses Arborist if available.
+    """
+    return current_app.auth.resources()

indexd/auth/driver.py

@@ -43,3 +43,11 @@ def delete(self, username):
         Raises AuthError if user doesn't exist.
         """
         raise NotImplementedError("TODO")
+
+    @abc.abstractmethod
+    def resources(self):
+        """
+        Returns a list of resources the user has access to. Uses Arborist if available.
+        Raises AuthError if the user doesn't exist.
+        """
+        raise NotImplementedError("TODO")

indexd/auth/drivers/alchemy.py

@@ -1,4 +1,5 @@
 import hashlib
+import sys
 
 from contextlib import contextmanager
 
@@ -133,18 +134,25 @@ def authz(self, method, resource):
         try:
             # A successful call from arborist returns a bool, else returns ArboristError
             try:
+                token = get_jwt_token()
+                if not token:
+                    raise AuthzError("No JWT token found for authorization check")
                 authorized = self.arborist.auth_request(
-                    get_jwt_token(), "indexd", method, resource
+                    token, "indexd", method, resource
                 )
             except Exception as e:
                 logger.error(
                     f"Request to Arborist failed; now checking admin access. Details:\n{e}"
                 )
                 authorized = False
+
             if not authorized:
+                token = get_jwt_token()
+                if not token:
+                    raise AuthError("No JWT token found for authorization check")
                 # admins can perform all operations
                 is_admin = self.arborist.auth_request(
-                    get_jwt_token(), "indexd", method, ["/services/indexd/admin"]
+                    token, "indexd", method, ["/services/indexd/admin"]
                 )
                 if not is_admin and not resource:
                     # if `authz` is empty (no `resource`), admin == access to
@@ -157,7 +165,33 @@ def authz(self, method, resource):
                             "The indexd admin '/programs' logic is deprecated. Please update your policy to '/services/indexd/admin'"
                         )
                 if not is_admin:
-                    raise AuthError("Permission denied.")
+                    raise AuthError("Permission denied. (not is_admin)")
+        except AuthError as err:
+            logger.error(err)
+            raise err
+        except AuthzError as err:
+            logger.error(err)
+            raise err
         except Exception as err:
             logger.error(err)
             raise AuthzError(err)
+
+    def resources(self):
+        """
+        Returns a list of resources for the given user.
+        """
+        if not self.arborist:
+            raise AuthError(
+                "Arborist is not configured; cannot perform authorization check"
+            )
+        token = get_jwt_token()
+        try:
+            _ = self.arborist.auth_mapping(
+                jwt=token
+            )
+            return _
+        except Exception as err:
+            raise AuthError(
+                "Failed to get resources from Arborist. Please check your Arborist configuration."
+            )
+

indexd/blueprint.py

@@ -1,10 +1,13 @@
+import sys
+
 import flask
 
 from indexclient.client import IndexClient
 from doiclient.client import DOIClient
 from dosclient.client import DOSClient
 from hsclient.client import HSClient
 
+from indexd.auth import AuthzError
 from indexd.utils import hint_match
 
 from indexd.errors import AuthError
@@ -20,6 +23,15 @@
 blueprint.dist = []
 
 
+@blueprint.errorhandler(Exception)
+def handle_uncaught_exception(err):
+    import traceback
+    import sys
+    print("Uncaught Exception:", file=sys.stderr)
+    traceback.print_exc(file=sys.stderr)
+    return flask.jsonify(error="Internal server error"), 500
+
+
 @blueprint.route("/alias/<path:alias>", methods=["GET"])
 def get_alias(alias):
     """
@@ -60,7 +72,6 @@ def get_record(record):
                 if not blueprint.dist or "no_dist" in flask.request.args:
                     raise
                 ret = dist_get_record(record)
-
     return flask.jsonify(ret), 200
 
 
@@ -111,6 +122,11 @@ def handle_auth_error(err):
     return flask.jsonify(error=str(err)), 403
 
 
+@blueprint.errorhandler(AuthzError)
+def handle_authz_error(err):
+    return flask.jsonify(error=str(err)), 401
+
+
 @blueprint.errorhandler(AliasNoRecordFound)
 def handle_no_record_error(err):
     return flask.jsonify(error=str(err)), 404
@@ -129,3 +145,6 @@ def get_config(setup_state):
     blueprint.alias_driver = alias_config["driver"]
     if "DIST" in setup_state.app.config:
         blueprint.dist = setup_state.app.config["DIST"]
+    blueprint.rbac = False
+    if "RBAC" in setup_state.app.config:
+        blueprint.rbac = setup_state.app.config["RBAC"]

indexd/default_settings.py

@@ -83,6 +83,8 @@
     },
 }
 
+CONFIG["RBAC"] = False  # RBAC is not enabled by default
+
 AUTH = SQLAlchemyAuthDriver(
     "postgresql://postgres:postgres@localhost:5432/indexd_tests"  # pragma: allowlist secret
 )

indexd/dos/blueprint.py

@@ -1,5 +1,9 @@
+import sys
+import traceback
+
 import flask
 
+from indexd.auth import AuthzError
 from indexd.blueprint import dist_get_record
 
 from indexd.errors import AuthError
@@ -15,12 +19,32 @@
 blueprint.dist = []
 
 
+@blueprint.errorhandler(Exception)
+def handle_uncaught_exception(err):
+    print(f"Uncaught Exception: {err}", file=sys.stderr)
+    traceback.print_exc(file=sys.stderr)
+    return flask.jsonify(error=f"Internal server error"), 500
+
+
+@blueprint.errorhandler(AuthzError)
+def handle_authz_error(err):
+    ret = {"msg": str(err), "status_code": 401}
+    return flask.jsonify(ret), 401
+
+
+@blueprint.errorhandler(AuthError)
+def handle_requester_auth_error(err):
+    ret = {"msg": str(err), "status_code": 403}
+    return flask.jsonify(ret), 403
+
+
 @blueprint.route("/ga4gh/dos/v1/dataobjects/<path:record>", methods=["GET"])
 def get_dos_record(record):
     """
     Returns a record from the local ids, alias, or global resolvers.
     Returns DOS Schema
     """
+
     try:
         ret = blueprint.index_driver.get(record)
         # record may be a baseID or a DID / GUID. If record is a baseID, ret["did"] is the latest GUID for that record.
@@ -157,3 +181,6 @@ def get_config(setup_state):
     blueprint.alias_driver = alias_config["driver"]
     if "DIST" in setup_state.app.config:
         blueprint.dist = setup_state.app.config["DIST"]
+    blueprint.rbac = False
+    if "RBAC" in setup_state.app.config:
+        blueprint.rbac = setup_state.app.config["RBAC"]

indexd/drs/blueprint.py

@@ -1,12 +1,15 @@
 import os
 import re
+import sys
+
 import flask
 import json
 from indexd.errors import AuthError, AuthzError
 from indexd.errors import UserError
 from indexd.index.errors import NoRecordFound as IndexNoRecordFound
 from indexd.errors import IndexdUnexpectedError
 from indexd.utils import reverse_url
+import traceback
 
 blueprint = flask.Blueprint("drs", __name__)
 
@@ -369,6 +372,13 @@ def handle_unexpected_error(err):
     return flask.jsonify(ret), err.code
 
 
+@blueprint.errorhandler(Exception)
+def handle_uncaught_exception(err):
+    print(f"Uncaught Exception: {err}", file=sys.stderr)
+    traceback.print_exc(file=sys.stderr)
+    return flask.jsonify(error=f"Internal server error"), 500
+
+
 @blueprint.record
 def get_config(setup_state):
     index_config = setup_state.app.config["INDEX"]
@@ -379,3 +389,6 @@ def get_config(setup_state):
 def get_config(setup_state):
     if "DRS_SERVICE_INFO" in setup_state.app.config:
         blueprint.service_info = setup_state.app.config["DRS_SERVICE_INFO"]
+    blueprint.rbac = False
+    if "RBAC" in setup_state.app.config:
+        blueprint.rbac = setup_state.app.config["RBAC"]