Framework for User Permissions & Roles #693

mohamedelabbas1996 · 2025-01-24T19:48:36Z

Summary

This PR introduces fine-grained object-level permissions for the Project model and related entities using Django Guardian. It establishes a roles and permissions framework, including Project Manager, Basic Member, and Identifier roles, with appropriate permissions for each.

List of Changes

Implemented object-level permissions for Project and related entities.
Added role-based access control (Project Manager, Basic Member, Identifier).
Auto-assign Project Manager role to the project owner.
Auto-assign Basic Member role to project members.
project_id query parameter made optional for all project related entities views.

Related Issues

Closes #703 #219

Detailed Description

This PR implements a fine-grained permissions framework for the Project model and its related entities:
Job, Deployment, SourceImageCollection, S3StorageSource, Site, Device, Identification. This ensures that access is properly restricted and prevents unauthorized modifications to project-related entities.

Roles and Permissions:

Project Manager: Full permissions on the project and its entities. Auto-assigned to the project owner upon creation.
Basic Member: Can access private project data and star captures. Auto-assigned to project members.
Identifier: Can create, update, and delete Identifications created by the user.

Deployment Notes

Requires database migrations to support role assignments.
Ensure Django Guardian is properly installed and configured.
Run manage.py assign_roles --source "Identifiers CSV file URL " to reset permissions and assign roles for existing project owners and members and assign identifier, project manager roles to users based on a CSV file.
Post an update on multiple channels (Slack and perhaps over email). Also confirm which projects users should be apart of.

Checklist

I have tested these changes appropriately.
I have added and/or modified relevant tests.
I updated relevant documentation or comments.
I have verified that this PR follows the project's coding standards.
Any dependent changes have already been merged to main.
Merge in main branch & fix conflicts
Test with db snapshot (michael), real projects

Follow-up PRs:

Read-permissions (filter list views by current user)
Support for many to many relationship to projects

netlify · 2025-01-24T19:48:54Z

✅ Deploy Preview for ami-dev canceled.

Name	Link
🔨 Latest commit	`0d67332`
🔍 Latest deploy log	https://app.netlify.com/sites/ami-dev/deploys/67c0d7e664be8100080b1ae8

…ted or updated

mohamedelabbas1996 · 2025-01-27T05:58:59Z

mihow · 2025-01-27T15:25:22Z

This looks really promising, great work @mohamedelabbas1996. I will review asap!

…ssions - Added ProjectMixin to require for all project-related entities - Ensured project_id is extracted only from URLs matching /projects/<id>/, otherwise falls back to query params - Implemented permission inheritance from the associated project object - Exposed user_permissions field in responses to reflect entity permissions

mohamedelabbas1996 · 2025-01-31T23:46:11Z

@mihow currently setting require_project to False to stay compatible with the frontend, but we can easily change it when we need

mihow · 2025-02-04T22:49:33Z

ami/base/models.py

    created_at = models.DateTimeField(auto_now_add=True)
    updated_at = models.DateTimeField(auto_now=True)

+    def get_project(self):


Follow up proposal for objects that are shared between multiple projects (have a many2many): check for many2many, if instance belongs to multiple projects, they must be a superuser or permission denied. If a single project, then return that project as usual.

known many2many

Pipeline Processing Service Taxa TaxaList

mihow · 2025-02-04T22:52:14Z

ami/jobs/views.py

 from ami.main.api.views import DefaultViewSet
 from ami.utils.fields import url_boolean_param
-from ami.utils.requests import get_active_project, project_id_doc_param
+from ami.utils.requests import project_id_doc_param


Can the decorator be moved to the mixin?

I tried moving it to the mixin but it did not work, it seems that it should be used with a Viewset class

mihow · 2025-02-04T23:01:44Z

ami/main/api/views.py

        """
        Set the user to the current user.
        """
+        # Get an instance for the model without saving


Is there a pre-save method? or a way to make this reusable in the DefaultViewSet?

moved it to the DefaultViewset

mihow · 2025-02-04T23:41:59Z

ami/users/roles.py

+            assign_perm(perm, user, project)
+
+    @classmethod
+    def un_assign_user(cls, user, project):


mihow · 2025-02-04T23:55:00Z

From our call, the two most important roles to start with are:

Project manager (can edit project and all related objects under project, start any type of job, etc)
Identifier (can suggest IDs / Agree with IDs for any project they are an identifier for)

Identifier role

Create identification
Delete identification created by current active user (self)

Project manager role

Any write or destructive action on child object of project
Fine-grained permissions can come for later

mihow · 2025-02-24T18:22:44Z

Discussion for next iteration after UI is ready:

Associate the Project with Groups in a more direct way (Add custom Group model with a project field, or a Many2Many field on the Project model to permission_groups)

mihow · 2025-02-24T18:29:35Z

ami/users/roles.py

+    @classmethod
+    def assign_user(cls, user, project):
+        # Get or create the Group
+        group_name = f"{project.pk}_{project.name}_{cls.__name__}"


one proposal:

class Project permission_groups = manytomany(Group, through=ProjectRoleGroup) class ProjectRoleGroup project_id group_id role_slug project_role_group = ProjectRoleGroup.objects.get(project=1, role_slug="dfds", group_id=2)

mihow · 2025-02-24T18:30:27Z

ami/users/roles.py

+
+    @classmethod
+    def assign_user(cls, user, project):
+        # Get or create the Group


Add a @todo comment about making this a formal relationship between groups, roles & project

mihow · 2025-02-24T20:32:54Z

ami/main/signals.py

+    logger.info(f"Project name: {instance.name}")
+
+    for group in groups:
+        logger.info(f"Old permissions group name: {group.name}")


Will you remove this log statement and instead add the old group name to this log statement later on? Then it will only be logged if its actually being modified:

logger.info(f"Changing permission group name from {group.name} to: {new_group_name}")

annavik · 2025-02-25T11:17:22Z

Testing Feb 25th

Summary

I have tested for 6 different permission scenarios. For the testing, I have assigned myself different roles from admin and then interacted with the app in different ways.

Works really well now, great work! Just had some minor questions.

Questions

When I'm added as member to a project, I still can't see it under "My projects" (I also have to update the project itself from admin). Just want to clarify if this is the plan?
Should basic members no longer have access to edit project details?
Project managers cannot update, but delete, starred collection. Should deleting this collection be possible?

Test results

Not logged in
Works well!

Basic member
Works well, just a minor question.

Identifier
Works well!

Project manager
Works well, just a minor question.

Staff
Works well!

Superadmin
Works well!

…/antenna into feat/user-permissions

mohamedelabbas1996 · 2025-02-25T22:28:00Z

Testing Feb 25th

Summary

I have tested for 6 different permission scenarios. For the testing, I have assigned myself different roles from admin and then interacted with the app in different ways.

Works really well now, great work! Just had some minor questions.

Questions
* When I'm added as member to a project, I still can't see it under "My projects" (I also have to update the project itself from admin). Just want to clarify if this is the plan?

* Should basic members no longer have access to edit project details?

* Project managers cannot update, but delete, starred collection. Should deleting this collection be possible?
Test results

Not logged in Works well!

Basic member Works well, just a minor question.

Identifier Works well!

Project manager Works well, just a minor question.

Staff Works well!

Superadmin Works well!

Thanks so much for doing another round of tests!

Yes, currently, a user needs to be explicitly added as a member from the project page in the admin dashboard to see the project under "My Projects." This is the expected behavior for now, but we can discuss adding users automatically based on their assigned roles in a follow-up PR if that makes more sense.
Yes, we have restricted Basic Members from editing project details. It makes more sense for this action to be reserved for Project Managers, who have more control over project settings.
I agree that deleting a starred collection should be reconsidered. Maybe we could make the starred collection a user-specific entity within a project so that each user has their own starred images collection instead of modifying a shared one? I think this could give users more control over their starred captures.

mohamedelabbas1996 · 2025-02-26T14:53:35Z

When I'm added as member to a project, I still can't see it under "My projects" (I also have to update the project itself from admin). Just want to clarify if this is the plan?

Now a project appears in the "My Projects" tab if the user assigned to a role in the given project.

mihow · 2025-02-27T20:48:48Z

ami/users/signals.py

+    try:
+        with transaction.atomic():  # Ensure DB consistency
+            for group in Group.objects.filter(pk__in=pk_set):
+                parts = group.name.split("_")  # Expected format: {project_id}_{project_name}_{Role}


Will you keep track of any function that is using the group name to relate to projects? So we can refactor at the same time

…rojects and roles, pending future refactor to formal relationships

…ermissions

mihow · 2025-03-06T18:10:48Z

Follow-up notes:

How to let anyone create a project (model level permission?)
Do we need project owners?
Who can delete a project? Who can delete identifications and images, etc?
Consider adding a ProjectAdmin
Project<->Group<->Role relationship (see test branch)
Handle occurrences not related to any project.

mihow · 2025-03-06T18:11:20Z

@mihow write announcement message about the new roles & project assignements

Django guardian setup

a0ed1f3

mohamedelabbas1996 added 4 commits January 27, 2025 00:16

feat: added object level permissions for Project

bbd7faa

feat: added object level permissions management to the admin page

bcb2eeb

feat: added signals to auto-assign permissions when a project is crea…

aab6000

…ted or updated

Added tests for user permissions

8bb1ac3

mohamedelabbas1996 marked this pull request as ready for review January 27, 2025 06:00

mohamedelabbas1996 changed the title ~~[Draft] User Permissions~~ User Permissions Jan 27, 2025

cleanup: removed logs

38addf3

mihow mentioned this pull request Jan 27, 2025

Add Delete permissions #424

Closed

mohamedelabbas1996 added 2 commits February 4, 2025 11:43

feat: added roles

3e4f1d8

feat: added custom permission checks

ac83301

f-PLT assigned mohamedelabbas1996 Feb 4, 2025

f-PLT requested a review from mihow February 4, 2025 18:02

cleanup: refactored ObjectPermissions to ProjectCRUDPermissions

080315b

mihow reviewed Feb 4, 2025

View reviewed changes

mihow changed the title ~~User Permissions~~ Framework for User Permissions & Roles Feb 5, 2025

mohamedelabbas1996 added 5 commits February 6, 2025 00:41

fix: made project_id param optional

82f49fc

feat: added project entities CRUD permissions

31ff972

Added tests for basic member and identifier roles

1338032

cleanup: squashed migrations

a2a4b67

fix: added CanDeleteIdentification permission to Identifier role

04e58ed

mohamedelabbas1996 added 4 commits February 24, 2025 12:46

fix: removed project update permission from basic member role

73abb4b

fix: removed project update permission from basic member role

6412eba

fix: removed project update permission from basic member role

ff17595

fix: removed project update permission from basic member role

bceab0a

mihow reviewed Feb 24, 2025

View reviewed changes

mohamedelabbas1996 added 3 commits February 25, 2025 14:37

Merge branch 'main' into feat/user-permissions

3b7579b

cleanup: merged assign_roles & assign_identifiers management commands

1d75e9d

Merge branch 'feat/user-permissions' of https://github.com/RolnickLab…

44ce97a

…/antenna into feat/user-permissions

annavik mentioned this pull request Feb 26, 2025

Update UI for identifications and show multiple suggestions per classification #741

Merged

fix: show projects in My projetcs based on roles assigned to user

02d9795

mohamedelabbas1996 added 2 commits February 26, 2025 10:36

fix: show projects in My projetcs based on roles assigned to user

e1c3e17

fix: Add user to project members when they got assigned a role

b1ba917

mihow reviewed Feb 27, 2025

View reviewed changes

mihow and others added 5 commits February 27, 2025 13:01

chore: standardize the generation of the permission group name

963a33b

chore: Added TODOs for tracking permission group names used to link p…

0d67332

…rojects and roles, pending future refactor to formal relationships

Merge branch 'main' of github.com:RolnickLab/antenna into feat/user-p…

57e8911

…ermissions

chore: add type annotation

c7ae632

feat: reduce logs & make log level configurable locally

0a83d4e

mihow approved these changes Mar 6, 2025

View reviewed changes

mihow merged commit 727ed26 into main Mar 6, 2025
2 checks passed

mihow deleted the feat/user-permissions branch March 6, 2025 17:46

mihow mentioned this pull request Aug 20, 2025

Add documentation for managing permissions & roles RolnickLab/antenna-docs#8

Open

Framework for User Permissions & Roles #693

Framework for User Permissions & Roles #693

Uh oh!

Conversation

mohamedelabbas1996 commented Jan 24, 2025 • edited by mihow Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

List of Changes

Related Issues

Detailed Description

Deployment Notes

Checklist

Uh oh!

netlify bot commented Jan 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for ami-dev canceled.

Uh oh!

mohamedelabbas1996 commented Jan 27, 2025

Uh oh!

mihow commented Jan 27, 2025

Uh oh!

mohamedelabbas1996 commented Jan 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mihow Feb 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mihow Feb 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mihow commented Feb 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mihow commented Feb 24, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

annavik commented Feb 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Testing Feb 25th

Summary

Questions

Test results

Uh oh!

mohamedelabbas1996 commented Feb 25, 2025

Testing Feb 25th

Summary

Questions

Test results

Uh oh!

mohamedelabbas1996 commented Feb 26, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mihow commented Mar 6, 2025 • edited by mohamedelabbas1996 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mihow commented Mar 6, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

mohamedelabbas1996 commented Jan 24, 2025 •

edited by mihow

Loading

netlify bot commented Jan 24, 2025 •

edited

Loading

mohamedelabbas1996 commented Jan 31, 2025 •

edited

Loading

mihow Feb 4, 2025 •

edited

Loading

mihow Feb 4, 2025 •

edited

Loading

mihow commented Feb 4, 2025 •

edited

Loading

annavik commented Feb 25, 2025 •

edited

Loading

mihow commented Mar 6, 2025 •

edited by mohamedelabbas1996

Loading