62336bfd32
* fix(rbac): stack-gate analyst table access via data_packages exclusively
Previously analysts could see a table in ``agnes catalog`` /
``/api/sync/manifest`` either by:
1. being in a group with ``resource_grants(group, 'table', id)``, or
2. being in a group with ``resource_grants(group, 'data_package', …)``
for a package containing the table.
Path 1 leaked: admins who minted a per-table grant without ever
wrapping the table in a data_package still shipped the table to
analysts — directly contradicting the unified-stack mental model
("the stack is the unit of access"). User report:
"i když to admin nedal do data package tak to by default uživatelé
dostali to by se nemělo stát".
New policy: analyst visibility is strictly stack-gated. A table is
visible iff at least one data_package containing it is in the
analyst's stack (required ∪ subscribed). Admin god-mode and the three
internal data-source tables (agnes_sessions / _telemetry / _audit
with row-level RBAC) keep their existing carve-outs.
Touched surfaces:
* ``src/rbac.can_access_table`` + ``get_accessible_tables`` —
routed through ``StackResolver.stack(user, DATA_PACKAGE)`` +
``data_package_tables`` join instead of ``resource_grants(table)``.
* ``app/api/sync._build_direct_tables_section`` — always returns
``[]`` (key kept for older CLI destructuring); per-table grants
no longer manifest.
* Standardised 403 detail across ``/api/data/*``, ``/api/query``,
``/api/v2/sample``, ``/api/v2/scan``, ``/api/v2/schema``:
``Table 'X' is not in your stack. Ask an admin to add it to a
Data Package you have access to (Required or in your stack),
then run `agnes pull` to refresh.`` Single source of truth lives
in ``src.rbac.table_not_in_stack_message`` so the wording stays
consistent across CLI surfaces.
UX side: ``/catalog/t/<id>`` (table detail page) dropped the four
editorial sections (Sample questions, What's inside, Things to know,
Pairs well with) per user feedback — the page's job is now
"what is this table, where do I find it" (hero + parent packages).
Tests:
* ``tests/conftest.grant_table_via_package`` / ``revoke_table_via_package``
— shared helpers that wrap a table in an auto-named data_package +
grant the package required to a custom group. Replaces the legacy
per-test ``_grant_table_to_analyst`` table-grant pattern.
* All 17 previously-failing legacy tests (test_access_control,
test_journey_rbac, test_audit_gap_*, test_rbac, …) migrated to use
the new helper; logic stays the same.
* ``tests/fixtures/analyst_bootstrap._grant_table_access`` updated
to wrap via data_package so the ``test_pat`` fixture's "two table
grants" semantics still ship parquets through ``agnes init``.
* New ``tests/test_table_not_in_stack_message.py`` locks in the
standardised 403 detail across the data + check-access endpoints.
5204 tests passing (added 1).
* fix(catalog): first-demo UX feedback — required-first grouping + longer card description
Two minor polish items from the 2026-05-19 stakeholder demo:
1. Required packages cluster at the top of the Browse grid instead of
being interleaved by ``created_at``. Sort key
``(requirement != 'required', name)`` runs before the adapter
call in both /catalog (data_packages) and /corporate-memory
(memory_domains) so the required block is visible without
scrolling. Regression test pins the order via
``data-id="…"`` position in rendered HTML.
2. ``.stack-card__desc`` line clamp bumped 2 → 4 lines. Two-line clamp
trailed almost every admin-authored description off in "…" before
the second clause, forcing a click-through to read it. The detail
page (/catalog/p/<slug>) keeps the unclamped body for longer
content.
* release: 0.55.3 — stack-gated analyst RBAC (BREAKING) + first-demo UX polish + #345 A/B/C/D + #347 UI consistency
77 lines
2.6 KiB
Python
77 lines
2.6 KiB
Python
"""GET /api/data/{table_id}/download must write to audit_log."""
|
|
from src.db import get_system_db
|
|
|
|
|
|
def _grant_table(conn, user_id: str, table_id: str) -> str:
|
|
"""Stack-gated RBAC: wrap table in auto data_package + grant package."""
|
|
from tests.conftest import grant_table_via_package
|
|
from src.repositories.user_groups import UserGroupsRepository
|
|
from src.repositories.resource_grants import ResourceGrantsRepository
|
|
pkg_id = grant_table_via_package(
|
|
conn, table_id, user_id, group_name=f"dl-{user_id}",
|
|
)
|
|
grp = UserGroupsRepository(conn).get_by_name(f"dl-{user_id}")
|
|
existing = next(
|
|
g for g in ResourceGrantsRepository(conn)
|
|
.list_for_groups([grp["id"]], "data_package")
|
|
if g["resource_id"] == pkg_id
|
|
)
|
|
return existing["id"]
|
|
|
|
|
|
def _setup(seeded_app, mock_extract_factory, table_name="dl_test_tbl"):
|
|
"""Register table + create extract on disk + grant analyst access."""
|
|
c = seeded_app["client"]
|
|
admin_hdrs = {"Authorization": f"Bearer {seeded_app['admin_token']}"}
|
|
|
|
resp = c.post(
|
|
"/api/admin/register-table",
|
|
json={"name": table_name, "source_type": "keboola", "query_mode": "local"},
|
|
headers=admin_hdrs,
|
|
)
|
|
assert resp.status_code == 201
|
|
|
|
mock_extract_factory(
|
|
"keboola",
|
|
[{"name": table_name, "data": [{"a": "1", "b": "2"}]}],
|
|
)
|
|
|
|
conn = get_system_db()
|
|
try:
|
|
_grant_table(conn, "analyst1", table_name)
|
|
finally:
|
|
conn.close()
|
|
|
|
|
|
def test_data_download_writes_audit_log(seeded_app, analyst_user, mock_extract_factory):
|
|
"""Successful parquet download must write exactly one audit_log row."""
|
|
table_name = "dl_test_tbl"
|
|
_setup(seeded_app, mock_extract_factory, table_name)
|
|
|
|
c = seeded_app["client"]
|
|
conn = get_system_db()
|
|
before = conn.execute(
|
|
"SELECT COUNT(*) FROM audit_log WHERE action='data.download'"
|
|
).fetchone()[0]
|
|
conn.close()
|
|
|
|
resp = c.get(f"/api/data/{table_name}/download", headers=analyst_user)
|
|
assert resp.status_code == 200
|
|
|
|
conn = get_system_db()
|
|
after = conn.execute(
|
|
"SELECT COUNT(*) FROM audit_log WHERE action='data.download'"
|
|
).fetchone()[0]
|
|
row = conn.execute(
|
|
"SELECT user_id, action, resource, result, client_kind "
|
|
"FROM audit_log WHERE action='data.download' ORDER BY timestamp DESC LIMIT 1"
|
|
).fetchone()
|
|
conn.close()
|
|
|
|
assert after == before + 1
|
|
assert row[0] == "analyst1"
|
|
assert row[1] == "data.download"
|
|
assert "dl_test_tbl" in row[2]
|
|
assert row[3] == "success"
|
|
# Session JWT → 'web'; PAT → 'cli'. analyst_user fixture uses a session token.
|
|
assert row[4] == "web"
|