IAM: Open Policy Agent integration (#3788)

Co-authored-by: Boris Sekachev <[email protected]>
Co-authored-by: Dmitry Kruchinin <[email protected]>

.github/workflows/main.yml

@@ -16,6 +16,9 @@ jobs:
       runs-on: ubuntu-latest
       steps:
       - uses: actions/checkout@v2
+      - uses: actions/setup-python@v2
+        with:
+          python-version: '3.8'
       - name: Getting SHA from the default branch
         id: get-sha
         run: |
@@ -63,6 +66,22 @@ jobs:
           cache-from: type=local,src=/tmp/cvat_cache_server
           tags: openvino/cvat_server:latest
           load: true
+      - name: Running OPA tests
+        run: |
+          curl -L -o opa https://openpolicyagent.org/downloads/v0.34.2/opa_linux_amd64_static
+          chmod +x ./opa
+          ./opa test cvat/apps/iam/rules
+      - name: Running REST API tests
+        env:
+          API_ABOUT_PAGE: "localhost:8080/api/v1/server/about"
+        run: |
+          docker-compose -f docker-compose.yml -f docker-compose.dev.yml -f components/serverless/docker-compose.serverless.yml up -d
+          /bin/bash -c 'while [[ "$(curl -s -o /dev/null -w ''%{http_code}'' ${API_ABOUT_PAGE})" != "401" ]]; do sleep 5; done'
+          cat tests/rest_api/assets/cvat_db.sql | docker exec -i cvat_db psql -q -U root -d cvat
+          cat tests/rest_api/assets/cvat_data.tar.bz2 | docker run --rm -i --volumes-from cvat ubuntu tar -xj --strip 3 -C /home/django/data
+          pip3 install --user -r tests/rest_api/requirements.txt
+          pytest tests/rest_api/
+          docker-compose -f docker-compose.yml -f docker-compose.dev.yml -f components/serverless/docker-compose.serverless.yml down -v
       - name: Running unit tests
         env:
           HOST_COVERAGE_DATA_DIR: ${{ github.workspace }}

.gitignore

@@ -19,6 +19,7 @@ __pycache__
 *.pyc
 ._*
 .coverage
+.husky/
 
 # Ignore npm logs file
 npm-debug.log*

.vscode/launch.json

@@ -45,7 +45,7 @@
             "python": "${command:python.interpreterPath}",
             "program": "${workspaceRoot}/manage.py",
             "env": {
-                "CVAT_SERVERLESS":  "1"
+                "CVAT_SERVERLESS": "1"
             },
             "args": [
                 "runserver",
@@ -62,10 +62,10 @@
             "type": "pwa-chrome",
             "request": "launch",
             "url": "http://localhost:7000/",
-            "disableNetworkCache":true,
+            "disableNetworkCache": true,
             "trace": true,
             "showAsyncStacks": true,
-            "pathMapping":{
+            "pathMapping": {
                 "/static/engine/": "${workspaceFolder}/cvat/apps/engine/static/engine/",
                 "/static/dashboard/": "${workspaceFolder}/cvat/apps/dashboard/static/dashboard/",
             }
@@ -111,7 +111,7 @@
             "request": "launch",
             "justMyCode": false,
             "stopOnEntry": false,
-            "python":"${command:python.interpreterPath}",
+            "python": "${command:python.interpreterPath}",
             "program": "${workspaceRoot}/manage.py",
             "args": [
                 "rqworker",
@@ -195,8 +195,8 @@
             "name": "jest debug",
             "program": "${workspaceFolder}/node_modules/.bin/jest",
             "args": [
-              "--config",
-              "${workspaceFolder}/cvat-core/jest.config.js"
+                "--config",
+                "${workspaceFolder}/cvat-core/jest.config.js"
             ],
             "console": "integratedTerminal",
             "internalConsoleOptions": "neverOpen",
@@ -215,4 +215,4 @@
             ]
         }
     ]
-}
+}

CHANGELOG.md

@@ -21,18 +21,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Data sorting option (<https://github.com/openvinotoolkit/cvat/pull/3937>)
 - Options to change font size & position of text labels on the canvas (<https://github.com/openvinotoolkit/cvat/pull/3972>)
 - Add "tag" return type for automatic annotation in Nuclio (<https://github.com/openvinotoolkit/cvat/pull/3896>)
+- Advanced identity access management system, using open policy agent (<https://github.com/openvinotoolkit/cvat/pull/3788>)
+- Organizations to create "shared space" for different groups of users (<https://github.com/openvinotoolkit/cvat/pull/3788>)
 - Dataset importing to a project (<https://github.com/openvinotoolkit/cvat/pull/3790>)
 - User is able to customize information that text labels show (<https://github.com/openvinotoolkit/cvat/pull/4029>)
 - Support for uploading manifest with any name (<https://github.com/openvinotoolkit/cvat/pull/4041>)
 
 ### Changed
-- TDB
+- Users don't have access to a task object anymore if they are assigneed only on some jobs of the task (<https://github.com/openvinotoolkit/cvat/pull/3788>)
+- Different resources (tasks, projects) are not visible anymore for all CVAT instance users by default (<https://github.com/openvinotoolkit/cvat/pull/3788>)
 
 ### Deprecated
-- TDB
+- Job field "status" is not used in UI anymore, but it has not been removed from the database yet (<https://github.com/openvinotoolkit/cvat/pull/3788>)
 
 ### Removed
-- TDB
+- Review rating, reviewer field from the job instance (use assignee field together with stage field instead) (<https://github.com/openvinotoolkit/cvat/pull/3788>)
 
 ### Fixed
 - Fixed Interaction handler keyboard handlers (<https://github.com/openvinotoolkit/cvat/pull/3881>)
@@ -55,6 +58,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - interactor: add HRNet interactive segmentation serverless function (<https://github.com/openvinotoolkit/cvat/pull/3740>)
 - Added GPU implementation for SiamMask, reworked tracking approach (<https://github.com/openvinotoolkit/cvat/pull/3571>)
 - Progress bar for manifest creating (<https://github.com/openvinotoolkit/cvat/pull/3712>)
+- IAM: Open Policy Agent integration (<https://github.com/openvinotoolkit/cvat/pull/3788>)
 - Add a tutorial on attaching cloud storage AWS-S3 (<https://github.com/openvinotoolkit/cvat/pull/3745>)
   and Azure Blob Container (<https://github.com/openvinotoolkit/cvat/pull/3778>)
 - The feature to remove annotations in a specified range of frames (<https://github.com/openvinotoolkit/cvat/pull/3617>)
@@ -63,6 +67,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 
 - UI tracking has been reworked (<https://github.com/openvinotoolkit/cvat/pull/3571>)
+- Updated Django till 3.2.7 (automatic AppConfig discovery)
 - Manifest generation: Reduce creating time (<https://github.com/openvinotoolkit/cvat/pull/3712>)
 - Migration from NPM 6 to NPM 7 (<https://github.com/openvinotoolkit/cvat/pull/3773>)
 - Update Datumaro dependency to 0.2.0 (<https://github.com/openvinotoolkit/cvat/pull/3813>)

Dockerfile

@@ -152,7 +152,6 @@ USER ${USER}
 WORKDIR ${HOME}
 
 RUN mkdir data share media keys logs /tmp/supervisord
-RUN python3 manage.py collectstatic
 
 EXPOSE 8080
 ENTRYPOINT ["/usr/bin/supervisord"]

components/analytics/docker-compose.analytics.yml

@@ -79,7 +79,6 @@ services:
       DJANGO_LOG_VIEWER_HOST: kibana
       DJANGO_LOG_VIEWER_PORT: 5601
       CVAT_ANALYTICS: 1
-      no_proxy: kibana,logstash,nuclio,${no_proxy}
 
 volumes:
   cvat_events:

components/serverless/docker-compose.serverless.yml

@@ -21,7 +21,6 @@ services:
   cvat:
     environment:
       CVAT_SERVERLESS: 1
-      no_proxy: kibana,logstash,nuclio,${no_proxy}
 
 volumes:
   cvat_events:

cvat-canvas/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cvat-canvas",
-  "version": "2.11.0",
+  "version": "2.11.1",
   "description": "Part of Computer Vision Annotation Tool which presents its canvas library",
   "main": "src/canvas.ts",
   "scripts": {

cvat-canvas/src/typescript/cuboid.ts

@@ -10,30 +10,28 @@ export enum Orientation {
     RIGHT = 'right',
 }
 
-function line(p1: Point, p2: Point): number[] {
-    const a = p1.y - p2.y;
-    const b = p2.x - p1.x;
-    const c = b * p1.y + a * p1.x;
-    return [a, b, c];
-}
-
 export function intersection(p1: Point, p2: Point, p3: Point, p4: Point): Point | null {
-    const L1 = line(p1, p2);
-    const L2 = line(p3, p4);
-
-    const D = L1[0] * L2[1] - L1[1] * L2[0];
-    const Dx = L1[2] * L2[1] - L1[1] * L2[2];
-    const Dy = L1[0] * L2[2] - L1[2] * L2[0];
-
-    let x = null;
-    let y = null;
-    if (Math.abs(D) > Number.EPSILON) {
-        x = Dx / D;
-        y = Dy / D;
-        return { x, y };
+    // Check if none of the lines are of length 0
+    const { x: x1, y: y1 } = p1;
+    const { x: x2, y: y2 } = p2;
+    const { x: x3, y: y3 } = p3;
+    const { x: x4, y: y4 } = p4;
+
+    if ((x1 === x2 && y1 === y2) || (x3 === x4 && y3 === y4)) {
+        return null;
+    }
+
+    const denominator = ((y4 - y3) * (x2 - x1) - (x4 - x3) * (y2 - y1));
+
+    // Lines are parallel
+    if (Math.abs(denominator) < Number.EPSILON) {
+        return null;
     }
 
-    return null;
+    const ua = ((x4 - x3) * (y1 - y3) - (y4 - y3) * (x1 - x3)) / denominator;
+
+    // Return a object with the x and y coordinates of the intersection
+    return { x: x1 + ua * (x2 - x1), y: y1 + ua * (y2 - y1) };
 }
 
 export class Equation {

cvat-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cvat-core",
-  "version": "3.23.0",
+  "version": "4.0.0",
   "description": "Part of Computer Vision Tool which presents an interface for client-side integration",
   "main": "babel.config.js",
   "scripts": {

cvat-core/src/annotations.js

@@ -276,7 +276,7 @@
         if (instance instanceof Task) {
             result = await serverProxy.tasks.exportDataset(instance.id, format, name, saveImages);
         } else if (instance instanceof Job) {
-            result = await serverProxy.tasks.exportDataset(instance.task.id, format, name, saveImages);
+            result = await serverProxy.tasks.exportDataset(instance.taskId, format, name, saveImages);
         } else {
             result = await serverProxy.projects.exportDataset(instance.id, format, name, saveImages);
         }