Skip to content

Commit 22de442

Browse files
wphyojplwphyojpl
authored
Merge 9089b93 into 27406e3 
2 parents 27406e3 + 9089b93 commit 22de442

34 files changed

+1184
-34
lines changed

‎cumulus_lambda_functions/cumulus_collections_dapa/cumulus_collections_dapa.py

Lines changed: 27 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,25 +2,32 @@
22
import os
33

44
from cumulus_lambda_functions.cumulus_wrapper.query_collections import CollectionsQuery
5+
from cumulus_lambda_functions.lib.authorization.uds_authorizer_abstract import UDSAuthorizorAbstract
6+
from cumulus_lambda_functions.lib.authorization.uds_authorizer_factory import UDSAuthorizerFactory
57
from cumulus_lambda_functions.lib.lambda_logger_generator import LambdaLoggerGenerator
8+
from cumulus_lambda_functions.lib.uds_db.db_constants import DBConstants
9+
from cumulus_lambda_functions.lib.uds_db.uds_collections import UdsCollections
610
from cumulus_lambda_functions.lib.utils.lambda_api_gateway_utils import LambdaApiGatewayUtils
711

812
LOGGER = LambdaLoggerGenerator.get_logger(__name__, LambdaLoggerGenerator.get_level_from_env())
913

1014

1115
class CumulusCollectionsDapa:
16+
RESOURCE = 'COLLECTIONS'
17+
ACTION = 'READ'
18+
1219
def __init__(self, event):
1320
LOGGER.info(f'event: {event}')
21+
required_env = ['CUMULUS_BASE', 'CUMULUS_LAMBDA_PREFIX', 'COGNITO_UESR_POOL_ID', 'ES_URL']
22+
if not all([k in os.environ for k in required_env]):
23+
raise EnvironmentError(f'one or more missing env: {required_env}')
24+
1425
self.__event = event
1526
self.__jwt_token = 'NA'
1627
self.__limit = 10
1728
self.__offset = 0
1829
self.__assign_values()
1930
self.__page_number = (self.__offset // self.__limit) + 1
20-
if 'CUMULUS_BASE' not in os.environ:
21-
raise EnvironmentError('missing key: CUMULUS_BASE')
22-
if 'CUMULUS_LAMBDA_PREFIX' not in os.environ:
23-
raise EnvironmentError('missing key: CUMULUS_LAMBDA_PREFIX')
2431

2532
self.__cumulus_base = os.getenv('CUMULUS_BASE')
2633
self.__cumulus_lambda_prefix = os.getenv('CUMULUS_LAMBDA_PREFIX')
@@ -29,6 +36,14 @@ def __init__(self, event):
2936
self.__cumulus.with_limit(self.__limit)
3037
self.__cumulus.with_page_number(self.__page_number)
3138
self.__get_collection_id()
39+
self.__lambda_utils = LambdaApiGatewayUtils(self.__event, self.__limit)
40+
self.__authorizer: UDSAuthorizorAbstract = UDSAuthorizerFactory().\
41+
get_instance(UDSAuthorizerFactory.cognito,
42+
user_pool_id=os.environ.get('COGNITO_UESR_POOL_ID'),
43+
es_url=os.getenv('ES_URL'),
44+
es_port=int(os.getenv('ES_PORT', '443'))
45+
)
46+
self.__uds_collections = UdsCollections(os.getenv('ES_URL'), int(os.getenv('ES_PORT', '443')))
3247

3348
def __get_collection_id(self):
3449
if 'pathParameters' not in self.__event:
@@ -62,14 +77,21 @@ def __get_size(self):
6277

6378
def __get_pagination_urls(self):
6479
try:
65-
pagination_links = LambdaApiGatewayUtils(self.__event, self.__limit).generate_pagination_links()
80+
pagination_links = self.__lambda_utils.generate_pagination_links()
6681
except Exception as e:
6782
LOGGER.exception(f'error while generating pagination links')
6883
return [{'message': f'error while generating pagination links: {str(e)}'}]
6984
return pagination_links
7085

7186
def start(self):
7287
try:
88+
ldap_groups = self.__lambda_utils.get_authorization_info()['ldap_groups']
89+
90+
collection_regexes = self.__authorizer.get_authorized_collections(DBConstants.read, ldap_groups)
91+
authorized_collections = self.__uds_collections.get_collections(collection_regexes)
92+
authorized_collection_ids = [k[DBConstants.collection_id] for k in authorized_collections]
93+
# NOTE: 2022-11-21: only pass collections. not versions
94+
self.__cumulus.with_collections(authorized_collection_ids)
7395
cumulus_result = self.__cumulus.query_direct_to_private_api(self.__cumulus_lambda_prefix)
7496
if 'server_error' in cumulus_result:
7597
return {

‎cumulus_lambda_functions/cumulus_collections_dapa/cumulus_create_collection_dapa.py

Lines changed: 53 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,15 +5,20 @@
55

66
from cumulus_lambda_functions.cumulus_stac.collection_transformer import CollectionTransformer
77
from cumulus_lambda_functions.cumulus_wrapper.query_collections import CollectionsQuery
8+
from cumulus_lambda_functions.lib.authorization.uds_authorizer_abstract import UDSAuthorizorAbstract
9+
from cumulus_lambda_functions.lib.authorization.uds_authorizer_factory import UDSAuthorizerFactory
810
from cumulus_lambda_functions.lib.aws.aws_lambda import AwsLambda
911
from cumulus_lambda_functions.lib.lambda_logger_generator import LambdaLoggerGenerator
12+
from cumulus_lambda_functions.lib.uds_db.db_constants import DBConstants
13+
from cumulus_lambda_functions.lib.uds_db.uds_collections import UdsCollections
14+
from cumulus_lambda_functions.lib.utils.lambda_api_gateway_utils import LambdaApiGatewayUtils
1015

1116
LOGGER = LambdaLoggerGenerator.get_logger(__name__, LambdaLoggerGenerator.get_level_from_env())
1217

1318

1419
class CumulusCreateCollectionDapa:
1520
def __init__(self, event):
16-
required_env = ['CUMULUS_LAMBDA_PREFIX', 'CUMULUS_WORKFLOW_SQS_URL']
21+
required_env = ['CUMULUS_LAMBDA_PREFIX', 'CUMULUS_WORKFLOW_SQS_URL', 'COGNITO_UESR_POOL_ID', 'ES_URL']
1722
if not all([k in os.environ for k in required_env]):
1823
raise EnvironmentError(f'one or more missing env: {required_env}')
1924
self.__event = event
@@ -23,7 +28,16 @@ def __init__(self, event):
2328
self.__ingest_sqs_url = os.getenv('CUMULUS_WORKFLOW_SQS_URL')
2429
self.__workflow_name = os.getenv('CUMULUS_WORKFLOW_NAME', 'CatalogGranule')
2530
self.__provider_id = os.getenv('UNITY_DEFAULT_PROVIDER', '')
31+
self.__es_url = os.getenv('ES_URL')
32+
self.__es_port = int(os.getenv('ES_PORT', '443'))
2633
self.__collection_creation_lambda_name = os.environ.get('COLLECTION_CREATION_LAMBDA_NAME', '').strip()
34+
self.__lambda_utils = LambdaApiGatewayUtils(self.__event, 10)
35+
self.__authorizer: UDSAuthorizorAbstract = UDSAuthorizerFactory()\
36+
.get_instance(UDSAuthorizerFactory.cognito,
37+
user_pool_id=os.getenv('COGNITO_UESR_POOL_ID'),
38+
es_url=self.__es_url,
39+
es_port=self.__es_port
40+
)
2741

2842
def execute_creation(self):
2943
try:
@@ -39,6 +53,26 @@ def execute_creation(self):
3953
'message': creation_result
4054
})
4155
}
56+
uds_collection = UdsCollections(self.__es_url, self.__es_port)
57+
try:
58+
time_range = collection_transformer.get_collection_time_range()
59+
uds_collection.add_collection(
60+
collection_id=collection_transformer.get_collection_id(),
61+
start_time=time_range[0], # TODO convert to timestamp
62+
end_time=time_range[1], # TODO convert to timestamp
63+
bbox=collection_transformer.get_collection_bbox(),
64+
granules_count=0,
65+
)
66+
except Exception as e:
67+
LOGGER.exception(f'failed to add collection to Elasticsearch')
68+
delete_collection_result = self.__cumulus_collection_query.delete_collection(self.__cumulus_lambda_prefix, cumulus_collection_doc['name'], cumulus_collection_doc['version'])
69+
return {
70+
'statusCode': 500,
71+
'body': json.dumps({
72+
'message': f'unable to add collection to Elasticsearch: {str(e)}',
73+
'details': f'collection deletion result: {delete_collection_result}'
74+
})
75+
}
4276
LOGGER.debug(f'__provider_id: {self.__provider_id}')
4377
rule_creation_result = self.__cumulus_collection_query.create_sqs_rules(
4478
cumulus_collection_doc,
@@ -50,6 +84,7 @@ def execute_creation(self):
5084
if 'status' not in rule_creation_result:
5185
LOGGER.error(f'status not in rule_creation_result. deleting collection: {rule_creation_result}')
5286
delete_collection_result = self.__cumulus_collection_query.delete_collection(self.__cumulus_lambda_prefix, cumulus_collection_doc['name'], cumulus_collection_doc['version'])
87+
uds_collection.delete_collection(collection_transformer.get_collection_id())
5388
return {
5489
'statusCode': 500,
5590
'body': json.dumps({
@@ -79,14 +114,30 @@ def start(self):
79114
raise ValueError(f'missing body in {self.__event}')
80115
self.__request_body = json.loads(self.__event['body'])
81116
LOGGER.debug(f'request body: {self.__request_body}')
82-
validation_result = pystac.Collection.from_dict(self.__request_body).validate()
117+
stac_collection = pystac.Collection.from_dict(self.__request_body)
118+
validation_result = stac_collection.validate()
83119
if not isinstance(validation_result, list):
84120
LOGGER.error(f'request body is not valid STAC collection: {validation_result}')
85121
return {
86122
'statusCode': 500,
87123
'body': json.dumps({'message': f'request body is not valid STAC Collection schema. check details',
88124
'details': validation_result})
89125
}
126+
127+
auth_info = self.__lambda_utils.get_authorization_info()
128+
collection_id = stac_collection.id
129+
collection_identifier = UdsCollections.decode_identifier(collection_id)
130+
LOGGER.debug(f'query for user: {auth_info["username"]}')
131+
if not self.__authorizer.is_authorized_for_collection(DBConstants.create, collection_id, auth_info['ldap_groups'],
132+
collection_identifier.tenant,
133+
collection_identifier.venue):
134+
LOGGER.debug(f'user: {auth_info["username"]} is not authorized for {collection_id}')
135+
return {
136+
'statusCode': 403,
137+
'body': json.dumps({
138+
'message': 'not authorized to create an action'
139+
})
140+
}
90141
if self.__collection_creation_lambda_name != '':
91142
response = AwsLambda().invoke_function(
92143
function_name=self.__collection_creation_lambda_name,

‎cumulus_lambda_functions/cumulus_granules_dapa/cumulus_granules_dapa.py

Lines changed: 43 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,11 @@
22
import os
33

44
from cumulus_lambda_functions.cumulus_wrapper.query_granules import GranulesQuery
5+
from cumulus_lambda_functions.lib.authorization.uds_authorizer_abstract import UDSAuthorizorAbstract
6+
from cumulus_lambda_functions.lib.authorization.uds_authorizer_factory import UDSAuthorizerFactory
57
from cumulus_lambda_functions.lib.lambda_logger_generator import LambdaLoggerGenerator
8+
from cumulus_lambda_functions.lib.uds_db.db_constants import DBConstants
9+
from cumulus_lambda_functions.lib.uds_db.uds_collections import UdsCollections
610
from cumulus_lambda_functions.lib.utils.lambda_api_gateway_utils import LambdaApiGatewayUtils
711

812
LOGGER = LambdaLoggerGenerator.get_logger(__name__, LambdaLoggerGenerator.get_level_from_env())
@@ -20,17 +24,18 @@ def __init__(self, event):
2024
:param event:
2125
"""
2226
LOGGER.info(f'event: {event}')
27+
required_env = ['CUMULUS_BASE', 'CUMULUS_LAMBDA_PREFIX', 'COGNITO_UESR_POOL_ID', 'ES_URL']
28+
if not all([k in os.environ for k in required_env]):
29+
raise EnvironmentError(f'one or more missing env: {required_env}')
30+
31+
2332
self.__event = event
2433
self.__jwt_token = ''
2534
self.__datetime = None
2635
self.__limit = 10
2736
self.__offset = 0
2837
self.__assign_values()
2938
self.__page_number = (self.__offset // self.__limit) + 1
30-
if 'CUMULUS_BASE' not in os.environ:
31-
raise EnvironmentError('missing key: CUMULUS_BASE')
32-
if 'CUMULUS_LAMBDA_PREFIX' not in os.environ:
33-
raise EnvironmentError('missing key: CUMULUS_LAMBDA_PREFIX')
3439

3540
self.__cumulus_base = os.getenv('CUMULUS_BASE')
3641
self.__cumulus_lambda_prefix = os.getenv('CUMULUS_LAMBDA_PREFIX')
@@ -39,19 +44,26 @@ def __init__(self, event):
3944
self.__cumulus.with_limit(self.__limit)
4045
self.__cumulus.with_page_number(self.__page_number)
4146
self.__get_time_range()
42-
self.__get_collection_id()
47+
self.__collection_id = self.__get_collection_id()
48+
self.__cumulus.with_collection_id(self.__collection_id)
49+
self.__lambda_utils = LambdaApiGatewayUtils(self.__event, self.__limit)
50+
self.__authorizer: UDSAuthorizorAbstract = UDSAuthorizerFactory()\
51+
.get_instance(UDSAuthorizerFactory.cognito,
52+
user_pool_id=os.environ.get('COGNITO_UESR_POOL_ID'),
53+
es_url=os.getenv('ES_URL'),
54+
es_port=int(os.getenv('ES_PORT', '443'))
55+
)
4356

4457
def __get_collection_id(self):
4558
if 'pathParameters' not in self.__event:
46-
return self
59+
return ''
4760
path_param_dict = self.__event['pathParameters']
4861
if 'collectionId' not in path_param_dict:
49-
return self
62+
return ''
5063
collection_id = path_param_dict['collectionId']
5164
if collection_id == '*':
52-
return self
53-
self.__cumulus.with_collection_id(path_param_dict['collectionId'])
54-
return self
65+
return ''
66+
return path_param_dict['collectionId']
5567

5668
def __get_time_range(self):
5769
if self.__datetime is None:
@@ -98,14 +110,34 @@ def __get_size(self):
98110

99111
def __get_pagination_urls(self):
100112
try:
101-
pagination_links = LambdaApiGatewayUtils(self.__event, self.__limit).generate_pagination_links()
113+
pagination_links = self.__lambda_utils.generate_pagination_links()
102114
except Exception as e:
103115
LOGGER.exception(f'error while generating pagination links')
104116
return [{'message': f'error while generating pagination links: {str(e)}'}]
105117
return pagination_links
106118

107119
def start(self):
108120
try:
121+
if self.__collection_id == '':
122+
return {
123+
'statusCode': 500,
124+
'body': json.dumps({'message': 'unknown collection_id. require 1 collection id. '})
125+
}
126+
auth_info = self.__lambda_utils.get_authorization_info()
127+
collection_identifier = UdsCollections.decode_identifier(self.__collection_id)
128+
if not self.__authorizer.is_authorized_for_collection(DBConstants.create, self.__collection_id, auth_info['ldap_groups'],
129+
collection_identifier.tenant,
130+
collection_identifier.venue):
131+
LOGGER.debug(f'user: {auth_info["username"]} is not authorized for {self.__collection_id}')
132+
return {
133+
'statusCode': 403,
134+
'body': json.dumps({
135+
'message': 'not authorized to create an action'
136+
})
137+
}
138+
139+
# TODO. cannot accept multiple collection_id. need single collection_id
140+
# get project and project_venue from collection_id and compare against authorization table
109141
cumulus_result = self.__cumulus.query_direct_to_private_api(self.__cumulus_lambda_prefix)
110142
if 'server_error' in cumulus_result:
111143
return {

‎cumulus_lambda_functions/cumulus_granules_dapa_ingest_cnm/cumulus_granules_dapa_ingest_cnm.py

Lines changed: 34 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,15 @@
22
import os
33

44
from cumulus_lambda_functions.cumulus_wrapper.query_granules import GranulesQuery
5+
from cumulus_lambda_functions.lib.authorization.uds_authorizer_abstract import UDSAuthorizorAbstract
6+
from cumulus_lambda_functions.lib.authorization.uds_authorizer_factory import UDSAuthorizerFactory
57
from cumulus_lambda_functions.lib.aws.aws_sns import AwsSns
68
from cumulus_lambda_functions.lib.json_validator import JsonValidator
79
from cumulus_lambda_functions.lib.lambda_logger_generator import LambdaLoggerGenerator
810
from cumulus_lambda_functions.lib.time_utils import TimeUtils
11+
from cumulus_lambda_functions.lib.uds_db.db_constants import DBConstants
12+
from cumulus_lambda_functions.lib.uds_db.uds_collections import UdsCollections
13+
from cumulus_lambda_functions.lib.utils.lambda_api_gateway_utils import LambdaApiGatewayUtils
914

1015
LOGGER = LambdaLoggerGenerator.get_logger(__name__, LambdaLoggerGenerator.get_level_from_env())
1116

@@ -46,11 +51,19 @@ def __init__(self, event):
4651
:param event:
4752
"""
4853
LOGGER.debug(f'event: {event}')
49-
if 'SNS_TOPIC_ARN' not in os.environ:
50-
raise EnvironmentError('missing key: SNS_TOPIC_ARN')
54+
required_env = ['SNS_TOPIC_ARN', 'COGNITO_UESR_POOL_ID', 'ES_URL']
55+
if not all([k in os.environ for k in required_env]):
56+
raise EnvironmentError(f'one or more missing env: {required_env}')
5157
self.__event = event
5258
self.__request_body = {}
5359
self.__sns_topic_arn = os.getenv('SNS_TOPIC_ARN')
60+
self.__lambda_utils = LambdaApiGatewayUtils(self.__event, 10)
61+
self.__authorizer: UDSAuthorizorAbstract = UDSAuthorizerFactory()\
62+
.get_instance(UDSAuthorizerFactory.cognito,
63+
user_pool_id=os.getenv('COGNITO_UESR_POOL_ID'),
64+
es_url=os.getenv('ES_URL'),
65+
es_port=int(os.getenv('ES_PORT', '443'))
66+
)
5467

5568
def __get_json_request_body(self):
5669
if 'body' not in self.__event:
@@ -156,6 +169,25 @@ def start(self):
156169
:return:
157170
"""
158171
self.__get_json_request_body()
172+
collection_ids = list(set([k['collection'] for k in self.__request_body['features']]))
173+
if len(collection_ids) != 1:
174+
return {
175+
'statusCode': 500,
176+
'body': json.dumps({'message': f'does not allow multiple collections in a single request', 'details': collection_ids})
177+
}
178+
auth_info = self.__lambda_utils.get_authorization_info()
179+
collection_id = collection_ids[0]
180+
collection_identifier = UdsCollections.decode_identifier(collection_id)
181+
if not self.__authorizer.is_authorized_for_collection(DBConstants.create, collection_id, auth_info['ldap_groups'],
182+
collection_identifier.tenant,
183+
collection_identifier.venue):
184+
LOGGER.debug(f'user: {auth_info["username"]} is not authorized for {collection_id}')
185+
return {
186+
'statusCode': 403,
187+
'body': json.dumps({
188+
'message': 'not authorized to create an action'
189+
})
190+
}
159191
error_list = []
160192
for each_granule in self.__request_body['features']:
161193
LOGGER.debug(f'executing: {each_granule}')

0 commit comments

Comments
 (0)