♻️ webserver: fixes mypy issues in security plugin (#4183)

packages/pytest-simcore/src/pytest_simcore/helpers/utils_webserver_unit_with_db.py

@@ -1,9 +1,9 @@
-from typing import NamedTuple, Union
+from typing import NamedTuple
 from unittest import mock
 
 from aiohttp import web
 from servicelib.aiohttp.web_exceptions_extension import HTTPLocked
-from simcore_service_webserver.security_roles import UserRole
+from simcore_postgres_database.models.users import UserRole
 
 
 class ExpectedResponse(NamedTuple):
@@ -14,35 +14,34 @@ class ExpectedResponse(NamedTuple):
     will have no access, therefore ExpectedResponse.ok = HTTPUnauthorized
     """
 
-    ok: Union[type[web.HTTPUnauthorized], type[web.HTTPForbidden], type[web.HTTPOk]]
-    created: Union[
-        type[web.HTTPUnauthorized], type[web.HTTPForbidden], type[web.HTTPCreated]
-    ]
-    no_content: Union[
-        type[web.HTTPUnauthorized], type[web.HTTPForbidden], type[web.HTTPNoContent]
-    ]
-    not_found: Union[
-        type[web.HTTPUnauthorized], type[web.HTTPForbidden], type[web.HTTPNotFound]
-    ]
-    forbidden: Union[
-        type[web.HTTPUnauthorized],
-        type[web.HTTPForbidden],
-    ]
-    locked: Union[type[web.HTTPUnauthorized], type[web.HTTPForbidden], type[HTTPLocked]]
-    accepted: Union[
-        type[web.HTTPUnauthorized], type[web.HTTPForbidden], type[web.HTTPAccepted]
-    ]
-    unprocessable: Union[
-        type[web.HTTPUnauthorized],
-        type[web.HTTPForbidden],
-        type[web.HTTPUnprocessableEntity],
-    ]
-    not_acceptable: Union[
-        type[web.HTTPUnauthorized], type[web.HTTPForbidden], type[web.HTTPNotAcceptable]
-    ]
-    conflict: Union[
-        type[web.HTTPUnauthorized], type[web.HTTPForbidden], type[web.HTTPConflict]
-    ]
+    ok: type[web.HTTPUnauthorized] | type[web.HTTPForbidden] | type[web.HTTPOk]
+    created: (
+        type[web.HTTPUnauthorized] | type[web.HTTPForbidden] | type[web.HTTPCreated]
+    )
+    no_content: (
+        type[web.HTTPUnauthorized] | type[web.HTTPForbidden] | type[web.HTTPNoContent]
+    )
+    not_found: (
+        type[web.HTTPUnauthorized] | type[web.HTTPForbidden] | type[web.HTTPNotFound]
+    )
+    forbidden: (type[web.HTTPUnauthorized] | type[web.HTTPForbidden])
+    locked: type[web.HTTPUnauthorized] | type[web.HTTPForbidden] | type[HTTPLocked]
+    accepted: (
+        type[web.HTTPUnauthorized] | type[web.HTTPForbidden] | type[web.HTTPAccepted]
+    )
+    unprocessable: (
+        type[web.HTTPUnauthorized]
+        | type[web.HTTPForbidden]
+        | type[web.HTTPUnprocessableEntity]
+    )
+    not_acceptable: (
+        type[web.HTTPUnauthorized]
+        | type[web.HTTPForbidden]
+        | type[web.HTTPNotAcceptable]
+    )
+    conflict: (
+        type[web.HTTPUnauthorized] | type[web.HTTPForbidden] | type[web.HTTPConflict]
+    )
 
     def __str__(self) -> str:
         # pylint: disable=no-member

services/web/server/src/simcore_service_webserver/application.py

@@ -35,7 +35,7 @@
 from .resource_manager.plugin import setup_resource_manager
 from .rest import setup_rest
 from .scicrunch.plugin import setup_scicrunch
-from .security import setup_security
+from .security.plugin import setup_security
 from .session import setup_session
 from .socketio.plugin import setup_socketio
 from .statics.plugin import setup_statics

services/web/server/src/simcore_service_webserver/catalog_handlers.py

@@ -30,7 +30,7 @@
 )
 from .catalog_units import can_connect
 from .login.decorators import login_required
-from .security_decorators import permission_required
+from .security.decorators import permission_required
 
 logger = logging.getLogger(__name__)
 

services/web/server/src/simcore_service_webserver/catalog_handlers_reverse_proxy.py

@@ -9,7 +9,7 @@
 from .catalog_client import to_backend_service
 from .catalog_settings import get_plugin_settings
 from .login.decorators import RQT_USERID_KEY, login_required
-from .security_decorators import permission_required
+from .security.decorators import permission_required
 
 logger = logging.getLogger(__name__)
 

services/web/server/src/simcore_service_webserver/clusters/handlers.py

@@ -23,7 +23,7 @@
 )
 from ..director_v2_models import ClusterCreate, ClusterPatch, ClusterPing
 from ..login.decorators import login_required
-from ..security_decorators import permission_required
+from ..security.decorators import permission_required
 
 logger = logging.getLogger(__name__)
 

services/web/server/src/simcore_service_webserver/diagnostics/_handlers.py

@@ -14,8 +14,9 @@
 from .. import catalog_client, db, director_v2_api, storage_api
 from .._meta import API_VERSION, APP_NAME, api_version_prefix
 from ..login.decorators import login_required
-from ..security_decorators import permission_required
+from ..security.decorators import permission_required
 from ..utils import get_task_info, get_tracemalloc_info
+from ..utils_aiohttp import envelope_json_response
 
 _logger = logging.getLogger(__name__)
 
@@ -40,7 +41,7 @@ async def get_app_diagnostics(request: web.Request):
         top = int(request.query["top_tracemalloc"])
         data.update(top_tracemalloc=get_tracemalloc_info(top))
 
-    return data
+    return envelope_json_response(data)
 
 
 @routes.get(f"/{api_version_prefix}/status", name="get_app_status")
@@ -60,7 +61,7 @@ def _get_client_session_info():
         client: ClientSession = get_client_session(request.app)
         info: dict[str, Any] = {"instance": str(client)}
 
-        if not client.closed:
+        if not client.closed and client.connector:
             info.update(
                 {
                     "limit": client.connector.limit,
@@ -115,7 +116,7 @@ async def _check_catalog():
         reraise=False,
     )
 
-    return check.dict(exclude_unset=True)
+    return envelope_json_response(check.dict(exclude_unset=True))
 
 
 @routes.get(f"/{api_version_prefix}/status/{{service_name}}", name="get_service_status")
@@ -126,6 +127,7 @@ async def get_service_status(request: web.Request):
 
     if service_name == "storage":
         with suppress(ClientError):
-            return await storage_api.get_app_status(request.app)
+            status = await storage_api.get_app_status(request.app)
+            return envelope_json_response(status)
 
     raise web.HTTPNotFound()

services/web/server/src/simcore_service_webserver/director_v2_handlers.py

@@ -19,7 +19,7 @@
 from .director_v2_core_computations import ComputationsApi
 from .director_v2_exceptions import DirectorServiceError
 from .login.decorators import login_required
-from .security_decorators import permission_required
+from .security.decorators import permission_required
 from .version_control.db import CommitID
 
 log = logging.getLogger(__name__)

services/web/server/src/simcore_service_webserver/email_handlers.py

@@ -14,7 +14,7 @@
 )
 from .login.decorators import login_required
 from .products.plugin import Product, get_current_product, get_product_template_path
-from .security_decorators import permission_required
+from .security.decorators import permission_required
 from .utils import get_traceback_string
 from .utils_aiohttp import envelope_json_response
 

services/web/server/src/simcore_service_webserver/exporter/request_handlers.py

@@ -1,7 +1,7 @@
 import logging
 from contextlib import AsyncExitStack
 from tempfile import TemporaryDirectory
-from typing import Any, Callable, Coroutine, Optional
+from typing import Any, Callable, Coroutine
 
 from aiofiles.tempfile import TemporaryDirectory as AioTemporaryDirectory
 from aiohttp import web
@@ -12,7 +12,7 @@
 from ..login.decorators import RQT_USERID_KEY, login_required
 from ..projects.project_lock import lock_project
 from ..projects.projects_api import retrieve_and_notify_project_locked_state
-from ..security_decorators import permission_required
+from ..security.decorators import permission_required
 from ..users_api import get_user_name
 from .exceptions import ExporterException
 from .export_import import study_duplicate, study_export, study_import
@@ -42,7 +42,7 @@ async def export_project(request: web.Request):
     user_id = request[RQT_USERID_KEY]
     project_uuid = request.match_info.get("project_id")
     assert project_uuid  # nosec
-    delete_tmp_dir: Optional[Callable[[], Coroutine[Any, Any, None]]] = None
+    delete_tmp_dir: Callable[[], Coroutine[Any, Any, None]] | None = None
     try:
         async with AsyncExitStack() as tmp_dir_stack, lock_project(
             request.app,

services/web/server/src/simcore_service_webserver/garbage_collector_tasks_users.py

@@ -17,7 +17,7 @@
 
 from ._constants import APP_DB_ENGINE_KEY
 from .login.utils import notify_user_logout
-from .security_api import clean_auth_policy_cache
+from .security.api import clean_auth_policy_cache
 from .users_db import update_expired_users
 
 logger = logging.getLogger(__name__)

services/web/server/src/simcore_service_webserver/groups_handlers.py

@@ -22,7 +22,7 @@
 from .scicrunch.errors import ScicrunchError
 from .scicrunch.models import ResearchResource, ResourceHit
 from .scicrunch.service_client import InvalidRRID, SciCrunch
-from .security_decorators import permission_required
+from .security.decorators import permission_required
 from .users_exceptions import UserNotFoundError
 
 logger = logging.getLogger(__name__)

services/web/server/src/simcore_service_webserver/login/_security.py

@@ -7,7 +7,7 @@
 from aiohttp import web
 from servicelib.logging_utils import get_log_record_extra, log_context
 
-from ..security_api import remember
+from ..security.api import remember
 from ._constants import MSG_LOGGED_IN
 from .utils import flash_response
 

services/web/server/src/simcore_service_webserver/login/api_keys_handlers.py

@@ -18,7 +18,7 @@
 from simcore_postgres_database.errors import DatabaseError
 from sqlalchemy.sql import func
 
-from ..security_api import check_permission
+from ..security.api import check_permission
 from .decorators import login_required
 from .utils import get_random_string
 

services/web/server/src/simcore_service_webserver/login/handlers_auth.py

@@ -14,7 +14,7 @@
 
 from .._meta import API_VTAG
 from ..products.plugin import Product, get_current_product
-from ..security_api import check_password, forget
+from ..security.api import check_password, forget
 from ..session_access import on_success_grant_session_access_to, session_access_required
 from ..utils_aiohttp import NextPage
 from ._2fa import (

services/web/server/src/simcore_service_webserver/login/handlers_change.py

@@ -10,7 +10,7 @@
 
 from .._meta import API_VTAG
 from ..products.plugin import Product, get_current_product
-from ..security_api import check_password, encrypt_password
+from ..security.api import check_password, encrypt_password
 from ..utils import HOUR
 from ..utils_rate_limiting import global_rate_limit_route
 from ._confirmation import is_confirmation_allowed, make_confirmation_link

services/web/server/src/simcore_service_webserver/login/handlers_confirmation.py

@@ -14,7 +14,7 @@
 from yarl import URL
 
 from ..products.plugin import Product, get_current_product
-from ..security_api import encrypt_password
+from ..security.api import encrypt_password
 from ..session_access import session_access_required
 from ..utils import MINUTE
 from ..utils_aiohttp import create_redirect_response

services/web/server/src/simcore_service_webserver/login/handlers_registration.py

@@ -14,7 +14,7 @@
 from ..groups_api import auto_add_user_to_groups, auto_add_user_to_product_group
 from ..invitations import is_service_invitation_code
 from ..products.plugin import Product, get_current_product
-from ..security_api import encrypt_password
+from ..security.api import encrypt_password
 from ..session_access import on_success_grant_session_access_to, session_access_required
 from ..utils import MINUTE
 from ..utils_aiohttp import NextPage, envelope_json_response

services/web/server/src/simcore_service_webserver/meta_modeling/_rest_handlers.py

@@ -15,7 +15,7 @@
 
 from .._meta import api_version_prefix as VTAG
 from ..login.decorators import login_required
-from ..security_decorators import permission_required
+from ..security.decorators import permission_required
 from ..utils_aiohttp import create_url_for_function, envelope_json_response
 from ..version_control.models import CheckpointID, CommitID, TagProxy
 from ..version_control.vc_tags import parse_workcopy_project_tag_name

services/web/server/src/simcore_service_webserver/projects/projects_access.py

@@ -1,7 +1,7 @@
 import jsondiff
 from aiohttp import web
 
-from ..security_api import UserRole, get_access_model
+from ..security.api import UserRole, get_access_model
 from .projects_db import ProjectDBAPI
 
 

services/web/server/src/simcore_service_webserver/projects/projects_handlers.py

@@ -30,7 +30,7 @@
 from ..director_v2_exceptions import DirectorServiceError
 from ..login.decorators import login_required
 from ..products.plugin import Product, get_current_product
-from ..security_decorators import permission_required
+from ..security.decorators import permission_required
 from . import projects_api
 from .projects_exceptions import (
     ProjectInvalidRightsError,

services/web/server/src/simcore_service_webserver/projects/projects_handlers_crud.py

@@ -37,8 +37,8 @@
 from .._meta import api_version_prefix as VTAG
 from ..login.decorators import RQT_USERID_KEY, login_required
 from ..resource_manager.websocket_manager import PROJECT_ID_KEY, managed_resource
-from ..security_api import check_permission
-from ..security_decorators import permission_required
+from ..security.api import check_permission
+from ..security.decorators import permission_required
 from ..users_api import get_user_name
 from . import _create_utils, projects_api
 from ._rest_schemas import (

services/web/server/src/simcore_service_webserver/projects/projects_nodes_handlers.py

@@ -31,7 +31,7 @@
 from ..director_v2_exceptions import DirectorServiceError
 from ..login.decorators import login_required
 from ..projects.projects_db import ProjectDBAPI
-from ..security_decorators import permission_required
+from ..security.decorators import permission_required
 from ..users_api import get_user_role
 from . import projects_api
 from .projects_exceptions import (

services/web/server/src/simcore_service_webserver/projects/projects_ports_handlers.py

@@ -22,7 +22,7 @@
 
 from .._meta import api_version_prefix as VTAG
 from ..login.decorators import login_required
-from ..security_decorators import permission_required
+from ..security.decorators import permission_required
 from . import _ports_utils, projects_api
 from .project_models import ProjectDict
 from .projects_db import ProjectDBAPI

services/web/server/src/simcore_service_webserver/projects/projects_tags_handlers.py

@@ -8,7 +8,7 @@
 
 from .._meta import api_version_prefix as VTAG
 from ..login.decorators import RQT_USERID_KEY, login_required
-from ..security_decorators import permission_required
+from ..security.decorators import permission_required
 from .projects_db import APP_PROJECT_DBAPI, ProjectDBAPI
 
 log = logging.getLogger(__name__)

services/web/server/src/simcore_service_webserver/rest.py

@@ -22,7 +22,7 @@
 from .rest_healthcheck import HealthCheck
 from .rest_settings import RestSettings, get_plugin_settings
 from .rest_utils import get_openapi_specs_path, load_openapi_specs
-from .security import setup_security
+from .security.plugin import setup_security
 
 log = logging.getLogger(__name__)