[Fixes #7718] Permissions assignments on Remote Services

geonode/base/populate_test_data.py

@@ -33,7 +33,6 @@
 from django.contrib.auth.models import Permission, Group
 from django.core.serializers import serialize
 from django.contrib.auth import get_user_model
-from django.contrib.contenttypes.models import ContentType
 from django.core.files.uploadedfile import SimpleUploadedFile
 
 from geonode import geoserver  # noqa
@@ -156,12 +155,7 @@ def create_models(type=None, integration=False):
         map_data, user_data, people_data, layer_data, document_data = create_fixtures()
         anonymous_group, created = Group.objects.get_or_create(name='anonymous')
         cont_group, created = Group.objects.get_or_create(name='contributors')
-        ctype = ContentType.objects.get_for_model(cont_group)
-        perm, created = Permission.objects.get_or_create(
-            codename='base_addresourcebase',
-            name='Can add resources',
-            content_type=ctype
-        )
+        perm = Permission.objects.get(codename='add_resourcebase')
         cont_group.permissions.add(perm)
         logger.debug("[SetUp] Get or create user admin")
         u, created = get_user_model().objects.get_or_create(username='admin')

geonode/people/migrations/0033_set_contributors_permissions.py

@@ -0,0 +1,33 @@
+# Assign the contributors group to users according to #7364
+
+from django.contrib.auth.models import Group, Permission
+from geonode.base.models import ResourceBase
+from django.contrib.contenttypes.models import ContentType
+from django.db import migrations
+from django.db.migrations.operations import RunPython
+
+
+def assign_permissions_to_contributors(apps, schema_editor):
+    contributors = Group.objects.filter(name='contributors')
+    if contributors.exists():
+        contr_obj = contributors.first()
+        perm = Permission.objects.get(codename='add_resourcebase')
+        contr_obj.permissions.add(perm)
+        perm_exists = contr_obj.permissions.filter(codename='base_addresourcebase')
+        if perm_exists.exists():
+            contr_obj.permissions.remove(perm_exists.first())
+        contr_obj.save()
+    perm_to_remove = Permission.objects.filter(codename='base_addresourcebase')
+    if perm_to_remove.exists():
+        perm_to_remove.delete()
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('people', '0032_set_contributors_group'),
+    ]
+
+    operations = [
+        RunPython(assign_permissions_to_contributors)
+    ]

geonode/security/models.py

@@ -46,6 +46,7 @@
     ADMIN_PERMISSIONS,
     LAYER_ADMIN_PERMISSIONS,
     VIEW_PERMISSIONS,
+    SERVICE_PERMISSIONS
 )
 
 from .utils import (
@@ -432,7 +433,7 @@ def get_user_perms(self, user):
 
         config = Configuration.load()
         ctype = ContentType.objects.get_for_model(self)
-        PERMISSIONS_TO_FETCH = VIEW_PERMISSIONS + ADMIN_PERMISSIONS + LAYER_ADMIN_PERMISSIONS
+        PERMISSIONS_TO_FETCH = VIEW_PERMISSIONS + ADMIN_PERMISSIONS + LAYER_ADMIN_PERMISSIONS + SERVICE_PERMISSIONS
 
         resource_perms = Permission.objects.filter(
             codename__in=PERMISSIONS_TO_FETCH,

geonode/security/permissions.py

@@ -1,6 +1,6 @@
 # Permissions mapping
 PERMISSIONS = {
-    'base_addresourcebase': 'add_resource',
+    'add_resourcebase': 'add_resource',
 }
 
 # The following permissions will be filtered out when READ_ONLY mode is active
@@ -26,3 +26,8 @@
     'change_layer_data',
     'change_layer_style'
 ]
+
+SERVICE_PERMISSIONS = [
+    "change_resourcebase_metadata",
+    "add_resourcebase_from_service"
+]

geonode/security/utils.py

@@ -113,10 +113,10 @@ def get_users_with_perms(obj):
     """
     Override of the Guardian get_users_with_perms
     """
-    from .permissions import (VIEW_PERMISSIONS, ADMIN_PERMISSIONS, LAYER_ADMIN_PERMISSIONS)
+    from .permissions import (VIEW_PERMISSIONS, ADMIN_PERMISSIONS, LAYER_ADMIN_PERMISSIONS, SERVICE_PERMISSIONS)
     ctype = ContentType.objects.get_for_model(obj)
     permissions = {}
-    PERMISSIONS_TO_FETCH = VIEW_PERMISSIONS + ADMIN_PERMISSIONS + LAYER_ADMIN_PERMISSIONS
+    PERMISSIONS_TO_FETCH = VIEW_PERMISSIONS + ADMIN_PERMISSIONS + LAYER_ADMIN_PERMISSIONS + SERVICE_PERMISSIONS
 
     for perm in Permission.objects.filter(codename__in=PERMISSIONS_TO_FETCH, content_type_id=ctype.id):
         permissions[perm.id] = perm.codename
@@ -562,8 +562,6 @@ def sync_geofence_with_guardian(layer, perms, user=None, group=None, group_perms
     _group, _user, _disable_cache, users_geolimits, groups_geolimits, anonymous_geolimits = get_user_geolimits(layer, user, group, gf_services)
 
     if _disable_cache:
-        filters = None
-        formats = None
         # Re-order dictionary
         # - if geo-limits have been defined for this user/group, the "*" rule must be the first one
         gf_services_limits_first = {"*": gf_services.pop('*')}
@@ -659,7 +657,7 @@ def _get_gf_services(layer, perms):
 
 def set_owner_permissions(resource, members=None):
     """assign all admin permissions to the owner"""
-    from .permissions import (VIEW_PERMISSIONS, ADMIN_PERMISSIONS, LAYER_ADMIN_PERMISSIONS)
+    from .permissions import (VIEW_PERMISSIONS, ADMIN_PERMISSIONS, LAYER_ADMIN_PERMISSIONS, SERVICE_PERMISSIONS)
     if resource.polymorphic_ctype:
         # Owner & Manager Admin Perms
         admin_perms = VIEW_PERMISSIONS + ADMIN_PERMISSIONS
@@ -680,6 +678,13 @@ def set_owner_permissions(resource, members=None):
                     for user in members:
                         assign_perm(perm, user, resource.layer)
 
+        if resource.polymorphic_ctype.name == 'service':
+            for perm in SERVICE_PERMISSIONS:
+                assign_perm(perm, resource.owner, resource.service)
+                if members:
+                    for user in members:
+                        assign_perm(perm, user, resource.service)
+
 
 def remove_object_permissions(instance):
     """Remove object permissions on given resource.

geonode/services/migrations/0044_auto_20210628_0955.py

@@ -0,0 +1,17 @@
+# Generated by Django 2.2.20 on 2021-06-28 09:55
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('services', '0043_auto_20210519_1308'),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name='service',
+            options={'permissions': (('add_resourcebase_from_service', 'Can add resources to Service'),)},
+        ),
+    ]

geonode/services/migrations/0045_auto_20210629_1355.py

@@ -0,0 +1,17 @@
+# Generated by Django 2.2.20 on 2021-06-29 13:55
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('services', '0044_auto_20210628_0955'),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name='service',
+            options={'permissions': (('add_resourcebase_from_service', 'Can add resources to Service'), ('change_resourcebase_metadata', 'Can change resources metadata'))},
+        ),
+    ]

geonode/services/models.py

@@ -181,6 +181,14 @@ def probe_service(self):
         except Exception:
             return 404
 
+    class Meta:
+        # custom permissions,
+        # change and delete are standard in django-guardian
+        permissions = (
+            ('add_resourcebase_from_service', 'Can add resources to Service'),
+            ('change_resourcebase_metadata', 'Can change resources metadata'),
+        )
+
 
 class ServiceProfileRole(models.Model):
 

geonode/services/templates/services/service_detail.html

@@ -104,22 +104,22 @@ <h3>{% trans "Service Resources" %} <span class="badge">{{ total_resources }}</s
 {% endblock %}
 {% block sidebar %}
 
-
     {% get_obj_perms request.user for service as "resource_perms" %}
 
-    {% comment %}{% if "change_service" in resource_perms or "remove_service" in resource_perms or "change_service_permissions" in resource_perms %}{% endcomment %}
+    {% if "add_resourcebase_from_service" in resource_perms or "change_resourcebase_metadata" in resource_perms or "change_service_permissions" in resource_perms %}
     <ul class="list-group">
         <li class="list-group-item"><h3>{% trans "Manage" %}</h3></li>
-
-        {% comment %}{% if "change_service" in resource_perms %}{% endcomment %}
+        {% if "change_resourcebase_metadata" in resource_perms %}
             <li class="list-group-item"><a class="btn btn-default btn-md btn-block" href="{% url "edit_service" service.id %}">{% trans "Edit Service Metadata" %}</a></li>
+        {% endif %}
+        {% if "add_resourcebase_from_service" in resource_perms %}
             <li class="list-group-item"><a id="harvestResources" class="btn btn-default btn-md btn-block" href="{% url "harvest_resources" service.id %}">{% trans "Import Service Resources" %}</a></li>
-        {% comment %}{% endif %}{% endcomment %}
-        {% comment %}{% if "remove_service" or "delete_service" in resource_perms %}{% endcomment %}
+        {% endif %}
+        {% if "remove_service" in permissions_list or "delete_service" in permissions_list or 'delete_resourcebase' in permissions_list %}
             <li class="list-group-item"><a class="btn btn-default btn-md btn-block" href="{% url "remove_service" service.id %}">{% trans "Remove Service" %}</a></li>
-        {% comment %}{% endif %}{% endcomment %}
+        {% endif %}
       </ul>
-    {% comment %}{% endif %}{% endcomment %}
+    {% endif %}
 {% endblock %}
 {% block extra_script %}
     {{ block.super }}

geonode/services/templates/services/service_list.html

@@ -5,7 +5,7 @@
 
 {% block body_outer %}
 <div class="page-header">
-  {% if user.is_authenticated and not READ_ONLY_MODE %}
+  {% if user.is_authenticated and not READ_ONLY_MODE and can_add_resources %}
     <a href="{% url "register_service" %}" class="btn btn-primary pull-right">{% trans "Add Remote Service" %}</a>
   {% endif %}
   <h2>{% trans "Remote Services" %}</h2>

geonode/services/templates/services/service_resources_harvest.html

@@ -75,7 +75,9 @@ <h3>{% trans "Import resources" %}
                                 <button id="btnClearFilter" type="button" class="btn btn-default">{% trans "Clear Filter" %}</button>
                                 <a class="btn btn-default"
                                    href="{% url "service_detail" service.id %}">{% trans "Back to service details" %}</a>
+                                {% if "add_resourcebase_from_service" in resource_perms or 'add_resourcebase_from_service' in permissions_list %}
                                 <input type="submit" class="btn btn-primary" value="{% trans "Import Resources" %}"/>
+                                {% endif %}
                             </div>
                         </div>
                     </form>

geonode/services/tests.py

@@ -18,6 +18,7 @@
 #
 #########################################################################
 import logging
+from geonode.services.enumerations import WMS, INDEXED
 from django.contrib.staticfiles.testing import StaticLiveServerTestCase
 from django.test import Client
 from selenium import webdriver
@@ -882,3 +883,29 @@ def test_harvest_resources(self):
                 self.selenium.find_element_by_id('btn-id-filter').click()
                 # self.selenium.find_element_by_id('option_atlantis:tiger_roads_tiger_roads').click()
                 # self.selenium.find_element_by_tag_name('form').submit()
+
+
+class TestServiceViews(GeoNodeBaseTestSupport):
+    def setUp(self):
+        self.user = 'admin'
+        self.passwd = 'admin'
+        self.admin = get_user_model().objects.get(username='admin')
+        self.sut, _ = Service.objects.get_or_create(
+            type=WMS,
+            name='Bogus',
+            title='Pocus',
+            owner=self.admin,
+            method=INDEXED,
+            metadata_only=True,
+            base_url='http://bogus.pocus.com/ows')
+        self.sut.clear_dirty_state()
+
+    def test_user_admin_can_access_to_page(self):
+        self.client.login(username='admin', password='admin')
+        response = self.client.get(reverse('services'))
+        self.assertEqual(response.status_code, 200)
+
+    def test_invalid_user_cannot_access_to_page(self):
+        self.client.login(username='bobby', password='bobby')
+        response = self.client.get(reverse('services'))
+        self.assertEqual(response.status_code, 302)