485 public datasets visible when not logged in

backend/app/deps/authorization_deps.py

@@ -5,14 +5,41 @@
 from app.keycloak_auth import get_current_username
 from app.models.authorization import RoleType, AuthorizationDB
 from app.models.datasets import DatasetDB, DatasetStatus
-from app.models.files import FileDB
-from app.models.groups import GroupDB
+from app.models.files import FileOut, FileDB, FileStatus
+from app.models.groups import GroupOut, GroupDB
 from app.models.metadata import MetadataDB
 from app.models.pyobjectid import PyObjectId
 from app.routers.authentication import get_admin
 from app.routers.authentication import get_admin_mode
 
 
+async def check_public_access(
+    resource_id: str,
+    resource_type: str,
+    role: RoleType,
+    current_user=Depends(get_current_username),
+) -> bool:
+    has_public_access = False
+    if role == RoleType.VIEWER:
+        if resource_type == "dataset":
+            if (
+                dataset := await DatasetDB.get(PydanticObjectId(resource_id))
+            ) is not None:
+                if (
+                    dataset.status == DatasetStatus.PUBLIC.name
+                    or dataset.status == DatasetStatus.AUTHENTICATED.name
+                ):
+                    has_public_access = True
+        elif resource_type == "file":
+            if (file := await FileDB.get(PydanticObjectId(resource_id))) is not None:
+                if (
+                    file.status == FileStatus.PUBLIC.name
+                    or file.status == FileStatus.AUTHENTICATED.name
+                ):
+                    has_public_access = True
+    return has_public_access
+
+
 async def get_role(
     dataset_id: str,
     current_user=Depends(get_current_username),
@@ -31,6 +58,11 @@ async def get_role(
             AuthorizationDB.user_ids == current_user,
         ),
     )
+    public_access = await check_public_access(
+        dataset_id, "dataset", RoleType.VIEWER, current_user
+    )
+    if authorization is None and public_access:
+        return RoleType.VIEWER
     return authorization.role
 
 
@@ -55,15 +87,11 @@ async def get_role_by_file(
             if (
                 dataset := await DatasetDB.get(PydanticObjectId(file.dataset_id))
             ) is not None:
-                if dataset.status == DatasetStatus.AUTHENTICATED.name:
-                    auth_dict = {
-                        "creator": dataset.author.email,
-                        "dataset_id": file.dataset_id,
-                        "user_ids": [current_user],
-                        "role": RoleType.VIEWER,
-                    }
-                    authenticated_auth = AuthorizationDB(**auth_dict)
-                    return authenticated_auth
+                if (
+                    dataset.status == DatasetStatus.AUTHENTICATED.name
+                    or dataset.status == DatasetStatus.PUBLIC.name
+                ):
+                    return RoleType.VIEWER
                 else:
                     raise HTTPException(
                         status_code=403,
@@ -199,6 +227,7 @@ async def __call__(
             ) is not None:
                 if (
                     current_dataset.status == DatasetStatus.AUTHENTICATED.name
+                    or current_dataset.status == DatasetStatus.PUBLIC.name
                     and self.role == "viewer"
                 ):
                     return True
@@ -249,7 +278,15 @@ async def __call__(
                     detail=f"User `{current_user} does not have `{self.role}` permission on file {file_id}",
                 )
             else:
-                raise HTTPException(status_code=404, detail=f"File {file_id} not found")
+                if (
+                    file.status == FileStatus.PUBLIC.name
+                    or file.status == FileStatus.AUTHENTICATED.name
+                ) and self.role == RoleType.VIEWER:
+                    return True
+                else:
+                    raise HTTPException(
+                        status_code=404, detail=f"File {file_id} not found"
+                    )
 
 
 class MetadataAuthorization:

backend/app/main.py

@@ -30,22 +30,27 @@
 from app.models.users import UserDB, UserAPIKeyDB, ListenerAPIKeyDB
 from app.models.visualization_config import VisualizationConfigDB
 from app.models.visualization_data import VisualizationDataDB
-from app.routers import folders, groups, status
+from app.routers import folders, groups, public_folders, status
 from app.routers import (
     users,
     authorization,
     metadata,
+    public_metadata,
     files,
+    public_files,
     metadata_files,
     datasets,
+    public_datasets,
     metadata_datasets,
     authentication,
     keycloak,
     elasticsearch,
+    public_elasticsearch,
     listeners,
     feeds,
     jobs,
     visualization,
+    public_visualization,
     thumbnails,
 )
 
@@ -113,12 +118,22 @@
     tags=["metadata"],
     dependencies=[Depends(get_current_username)],
 )
+api_router.include_router(
+    public_metadata.router,
+    prefix="/public_metadata",
+    tags=["public_metadata"],
+)
 api_router.include_router(
     files.router,
     prefix="/files",
     tags=["files"],
     dependencies=[Depends(get_current_username)],
 )
+api_router.include_router(
+    public_files.router,
+    prefix="/public_files",
+    tags=["public_files"],
+)
 api_router.include_router(
     metadata_files.router,
     prefix="/files",
@@ -132,14 +147,27 @@
     dependencies=[Depends(get_current_username)],
 )
 api_router.include_router(
-    metadata_datasets.router, prefix="/datasets", tags=["metadata"]
+    public_datasets.router,
+    prefix="/public_datasets",
+    tags=["public_datasets"],
+)
+api_router.include_router(
+    metadata_datasets.router,
+    prefix="/datasets",
+    tags=["metadata"],
+    dependencies=[Depends(get_current_username)],
 )
 api_router.include_router(
     folders.router,
     prefix="/folders",
     tags=["folders"],
     dependencies=[Depends(get_current_username)],
 )
+api_router.include_router(
+    public_folders.router,
+    prefix="/public_folders",
+    tags=["public_folders"],
+)
 api_router.include_router(
     listeners.router,
     prefix="/listeners",
@@ -164,6 +192,11 @@
     tags=["elasticsearch"],
     dependencies=[Depends(get_current_username)],
 )
+api_router.include_router(
+    public_elasticsearch.router,
+    prefix="/public_elasticsearch",
+    tags=["public_elasticsearch"],
+)
 api_router.include_router(
     feeds.router,
     prefix="/feeds",
@@ -182,6 +215,11 @@
     tags=["visualizations"],
     dependencies=[Depends(get_current_username)],
 )
+api_router.include_router(
+    public_visualization.router,
+    prefix="/public_visualizations",
+    tags=["public_visualizations"],
+)
 api_router.include_router(
     thumbnails.router,
     prefix="/thumbnails",

backend/app/models/datasets.py

@@ -27,6 +27,7 @@ class DatasetStatus(AutoName):
 class DatasetBase(BaseModel):
     name: str = "N/A"
     description: Optional[str] = None
+    status: str = DatasetStatus.PRIVATE.name
 
 
 class DatasetIn(DatasetBase):
@@ -65,7 +66,7 @@ class DatasetDBViewList(View, DatasetBase):
     modified: datetime = Field(default_factory=datetime.utcnow)
     auth: List[AuthorizationDB]
     thumbnail_id: Optional[PydanticObjectId] = None
-    status: Optional[str]
+    status: str = DatasetStatus.PRIVATE.name
 
     class Settings:
         source = DatasetDB

backend/app/models/files.py

@@ -1,7 +1,7 @@
 from datetime import datetime
 from enum import Enum
 from typing import Optional, List
-
+from enum import Enum, auto
 from beanie import Document, View, PydanticObjectId
 from pydantic import Field, BaseModel
 
@@ -10,6 +10,19 @@
 from app.models.users import UserOut
 
 
+class AutoName(Enum):
+    def _generate_next_value_(name, start, count, last_values):
+        return name
+
+
+class FileStatus(AutoName):
+    PRIVATE = auto()
+    PUBLIC = auto()
+    AUTHENTICATED = auto()
+    DEFAULT = auto()
+    TRIAL = auto()
+
+
 class StorageType(str, Enum):
     """Depending on the StorageType,the file may need different properties such as local path or URL.
     Also, some StorageTypes do not support versioning or anonymous sharing."""
@@ -47,6 +60,7 @@ class Settings:
 
 class FileBase(BaseModel):
     name: str = "N/A"
+    status: str = FileStatus.PRIVATE.name
 
 
 class FileIn(FileBase):

backend/app/models/search.py

@@ -46,3 +46,4 @@ class ElasticsearchEntry(BaseModel):
     bytes: Optional[int]
     # metadata fields
     metadata: Optional[List[dict]] = []
+    status: Optional[str]

backend/app/routers/authorization.py

@@ -1,3 +1,5 @@
+import datetime
+
 from beanie import PydanticObjectId
 from beanie.operators import Or, In
 from bson import ObjectId
@@ -92,7 +94,10 @@ async def get_dataset_role(
         if (
             current_dataset := await DatasetDB.get(PydanticObjectId(dataset_id))
         ) is not None:
-            if current_dataset.status == DatasetStatus.AUTHENTICATED.name:
+            if (
+                current_dataset.status == DatasetStatus.AUTHENTICATED.name
+                or current_dataset.status == DatasetStatus.PUBLIC.name
+            ):
                 public_authorization_in = {
                     "dataset_id": PydanticObjectId(dataset_id),
                     "role": RoleType.VIEWER,