Merge pull request #3777 from camptocamp/renovate/master-own-packages

Update dependency c2casgiutils to v0.14.0 (master)

Author: sbrunner

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ## 2.0.0
 
+- Add a read-only mode to the admin interface: the configured `authentication.github_access_type` grants read-write access, while users with only a `pull` access on the configured `authentication.github_repository` can see the status and jobs but cannot start, cancel or retry generations.
 - Surface generation errors in the admin interface by writing error messages to the job output before exiting, so they are captured in `job.message` and displayed in the admin UI.
 - Fix unclosed aiohttp connector and client session warnings by properly closing Azure blob storage clients and aiohttp sessions in `URLTileStore` and `AzureStorageBlobTileStore`.
 - Close stale tile store instances in `Server.get_store()` and `MultiTileStore._get_store()` when the cached store is invalidated by a configuration file change.

poetry.lock

@@ -23,7 +23,7 @@ version = "0.0.0"
 [tool.poetry.dependencies]
 # Minimal version should also be set in the jsonschema-gentypes.yaml file
 python = ">=3.12,<3.15"
-c2casgiutils = { version = "0.13.4", extras = ["all"] }
+c2casgiutils = { version = "0.14.0", extras = ["all"] }
 fastapi = {extras = ["standard"], version = "0.141.1"}
 python-dateutil = "2.9.0.post0"
 tilecloud = { version = "1.13.5", extras = ["azure", "aws", "redis", "wsgi"] }

pyproject.toml

@@ -34,7 +34,7 @@
 - <a id="properties/logging"></a>**`logging`**: Refer to *[#/definitions/logging](#definitions/logging)*.
 - <a id="properties/authentication"></a>**`authentication`** *(object)*: The authentication configuration. Cannot contain additional properties.
   - <a id="properties/authentication/properties/github_repository"></a>**`github_repository`** *(string)*: The GitHub repository name, on witch one we will check the access rights.
-  - <a id="properties/authentication/properties/github_access_type"></a>**`github_access_type`** *(string)*: The kind of rights the user should have on the repository. Must be one of: "push", "pull", or "admin". Default: `"pull"`.
+  - <a id="properties/authentication/properties/github_access_type"></a>**`github_access_type`** *(string)*: The kind of rights the user should have on the repository to have read-write access to the admin interface. Must be one of: "push", "pull", or "admin". Default: `"pull"`.
 ## Definitions
 
 - <a id="definitions/headers"></a>**`headers`** *(object)*: The headers that we send to the WMS backend. Can contain additional properties.

tilecloud_chain/CONFIG.md

@@ -938,6 +938,13 @@ Admin and test pages
 On the URL `<base URL>/admin/` you can see the status of the generation, a tool to generate the tiles, and a link
 to a test page.
 
+The access to the admin page is controlled by the ``authentication`` configuration section:
+
+- The users with a ``github_access_type`` access on the configured ``github_repository`` have the read-write
+  access: they can also launch a generation, and cancel or retry a job.
+- The users with only a ``pull`` access on the repository have a read-only access: they can see the status and
+  the jobs, but cannot launch a generation, nor cancel or retry a job.
+
 Beware, the test page assumes we have configured only one grid.
 
 The test page stores its current state in the URL query string, so you can share or reload the same view:

tilecloud_chain/USAGE.rst

@@ -127,7 +127,7 @@ class Authentication(TypedDict, total=False):
     r"""
     GitHub access.
 
-    The kind of rights the user should have on the repository
+    The kind of rights the user should have on the repository to have read-write access to the admin interface.
 
     default: pull
     """
@@ -957,7 +957,7 @@ class Generation(TypedDict, total=False):
 r"""
 GitHub access.
 
-The kind of rights the user should have on the repository
+The kind of rights the user should have on the repository to have read-write access to the admin interface.
 
 default: pull
 """

tilecloud_chain/configuration.py

@@ -1707,7 +1707,7 @@
         },
         "github_access_type": {
           "title": "GitHub access",
-          "description": "The kind of rights the user should have on the repository",
+          "description": "The kind of rights the user should have on the repository to have read-write access to the admin interface.",
           "type": "string",
           "default": "pull",
           "enum": ["push", "pull", "admin"]

tilecloud_chain/schema.json

@@ -89,13 +89,22 @@ <h4 class="alert-heading">Use of deprecated attributes</h4>
       {% endfor %}
     </div>
     {% endif %}
+    {% if read_only %}
+    <div class="alert alert-info" role="alert">
+      <p class="mb-1">
+        You have read-only access: you can see the status and the jobs, but you cannot start, cancel or
+        retry a generation.
+      </p>
+    </div>
+    {% endif %}
     <span></span>
     {% if has_access %}
     <!---->
     {% if job_status is none %}
     <h2>Status</h2>
     <p>{{ '<br />'.join(status) | safe }}</p>
     {% endif %}
+    {% if not read_only %}
     <h2>Launch generation</h2>
     <div class="dropdown">
       <button
@@ -157,6 +166,7 @@ <h2>Launch generation</h2>
       {% endif %}
     </form>
     {% endif %}
+    {% endif %}
     <!---->
     {% if jobs_status is none %}
     <span id="result"></span>
@@ -200,13 +210,13 @@ <h2 class="accordion-header">
             <pre>{{ job.message.strip() | safe | escape }}</pre>
             {% endif %}
             <!---->
-            {% if job.status == 'started' %}
+            {% if not read_only and job.status == 'started' %}
             <p>
               <button type="button" class="btn btn-outline-primary cancel" data-job-id="{{ job.id }}">
                 Cancel the tiles generation
               </button>
             </p>
-            {% elif job.status == 'error' and errors %}
+            {% elif not read_only and job.status == 'error' and errors %}
             <p>
               <button type="button" class="btn btn-outline-primary retry" data-job-id="{{ job.id }}">
                 Retry to generate the tiles in error

tilecloud_chain/templates/admin_index.html

@@ -1,8 +1,10 @@
 # Copyright (c) 2026 by Camptocamp
+from types import SimpleNamespace
 from typing import IO, Any
-from unittest.mock import Mock
+from unittest.mock import AsyncMock, Mock
 
 import pytest
+from c2casgiutils.config import GitHubAccessType
 
 from tilecloud_chain import DatedConfig
 from tilecloud_chain.views import admin
@@ -124,3 +126,85 @@ async def test_validate_config_file_skips_non_wms_layers(monkeypatch: pytest.Mon
 
     assert structure_errors == []
     assert deprecation_warnings == []
+
+
+def _patch_access(
+    monkeypatch: pytest.MonkeyPatch,
+    *,
+    username: str | None = None,
+    admin_access: bool = False,
+    check_results: list[bool] | None = None,
+) -> AsyncMock:
+    monkeypatch.setattr(
+        admin.c2c_config,
+        "settings",
+        SimpleNamespace(auth=SimpleNamespace(test=SimpleNamespace(username=username))),
+    )
+    monkeypatch.setattr(admin.auth, "check_admin_access", AsyncMock(return_value=admin_access))
+    check_mock = AsyncMock(side_effect=check_results or [])
+    monkeypatch.setattr(admin.auth, "check_access_config", check_mock)
+    return check_mock
+
+
+@pytest.mark.asyncio
+async def test_access_level_test_user(monkeypatch: pytest.MonkeyPatch) -> None:
+    check = _patch_access(monkeypatch, username="tester")
+    config = DatedConfig(config={}, mtime=0.0, file=Mock())
+
+    assert await admin._get_access_level(config, Mock()) is admin.AccessLevel.READ_WRITE
+    check.assert_not_awaited()
+
+
+@pytest.mark.asyncio
+async def test_access_level_admin(monkeypatch: pytest.MonkeyPatch) -> None:
+    check = _patch_access(monkeypatch, admin_access=True)
+    config = DatedConfig(config={}, mtime=0.0, file=Mock())
+
+    assert await admin._get_access_level(config, Mock()) is admin.AccessLevel.READ_WRITE
+    check.assert_not_awaited()
+
+
+@pytest.mark.asyncio
+async def test_access_level_read_write(monkeypatch: pytest.MonkeyPatch) -> None:
+    check = _patch_access(monkeypatch, check_results=[True])
+    config = DatedConfig(
+        config={"authentication": {"github_repository": "org/repo", "github_access_type": "push"}},
+        mtime=0.0,
+        file=Mock(),
+    )
+
+    assert await admin._get_access_level(config, Mock()) is admin.AccessLevel.READ_WRITE
+    assert check.await_count == 1
+    auth_config = check.await_args_list[0].args[1]
+    assert auth_config.github_repository == "org/repo"
+    assert auth_config.github_access_type_read_write is GitHubAccessType.PUSH
+    assert auth_config.github_access_type_read_only is None
+
+
+@pytest.mark.asyncio
+async def test_access_level_read_only_fallback(monkeypatch: pytest.MonkeyPatch) -> None:
+    check = _patch_access(monkeypatch, check_results=[False, True])
+    config = DatedConfig(
+        config={"authentication": {"github_repository": "org/repo", "github_access_type": "push"}},
+        mtime=0.0,
+        file=Mock(),
+    )
+
+    assert await admin._get_access_level(config, Mock()) is admin.AccessLevel.READ_ONLY
+    assert check.await_count == 2
+    read_only_config = check.await_args_list[1].args[1]
+    assert read_only_config.github_access_type_read_only is GitHubAccessType.PULL
+    assert read_only_config.github_access_type_read_write is None
+
+
+@pytest.mark.asyncio
+async def test_access_level_no_access(monkeypatch: pytest.MonkeyPatch) -> None:
+    check = _patch_access(monkeypatch, check_results=[False, False])
+    config = DatedConfig(
+        config={"authentication": {"github_repository": "org/repo", "github_access_type": "push"}},
+        mtime=0.0,
+        file=Mock(),
+    )
+
+    assert await admin._get_access_level(config, Mock()) is admin.AccessLevel.NO_ACCESS
+    assert check.await_count == 2

tilecloud_chain/tests/test_admin.py

@@ -36,6 +36,7 @@
 import shlex
 import urllib.parse
 from collections.abc import Awaitable, Callable
+from enum import StrEnum
 from typing import IO, Annotated, Any, cast
 
 import jsonschema_validator
@@ -95,35 +96,59 @@ async def _get_postgresql_store() -> tilecloud_chain.store.postgresql.Postgresql
     return _postgresql_store
 
 
-async def _get_access(
+class AccessLevel(StrEnum):
+    """Level of access of a user to the admin interface."""
+
+    NO_ACCESS = "no_access"
+    READ_ONLY = "read_only"
+    READ_WRITE = "read_write"
+
+
+async def _get_access_level(
     config: Annotated[tilecloud_chain.DatedConfig, Depends(server.get_host_config)],
     auth_info: Annotated[auth.AuthInfo, Depends(auth.get_auth)],
-) -> bool:
-    """Check if the user has access to admin functions."""
+) -> AccessLevel:
+    """Get the level of access of the user to the admin interface."""
 
     if c2c_config.settings.auth.test.username:
-        return True
+        return AccessLevel.READ_WRITE
 
     if await auth.check_admin_access(auth_info):
-        return True
+        return AccessLevel.READ_WRITE
 
     auth_config = config.config.get("authentication", {})
-    return await auth.check_access_config(
+    github_repository = auth_config.get("github_repository", "")
+    github_access_type = c2c_config.GitHubAccessType(auth_config.get("github_access_type", "pull"))
+
+    if await auth.check_access_config(
         auth_info,
         auth.AuthConfig(
-            github_repository=auth_config.get("github_repository", ""),
-            github_access_type=auth_config.get("github_access_type", ""),
+            github_repository=github_repository,
+            github_access_type_read_write=github_access_type,
         ),
-    )
+    ):
+        return AccessLevel.READ_WRITE
 
+    # A "pull" access grants read-only access.
+    if await auth.check_access_config(
+        auth_info,
+        auth.AuthConfig(
+            github_repository=github_repository,
+            github_access_type_read_only=c2c_config.GitHubAccessType.PULL,
+        ),
+    ):
+        return AccessLevel.READ_ONLY
 
-async def _check_access(
-    has_access: Annotated[dict[str, Any], Depends(_get_access)],
+    return AccessLevel.NO_ACCESS
+
+
+async def _check_read_write_access(
+    access_level: Annotated[AccessLevel, Depends(_get_access_level)],
 ) -> None:
-    """Check if the user has access to admin functions."""
+    """Check that the user has read-write access to admin functions."""
 
-    if not has_access:
-        raise HTTPException(status_code=403, detail="Access forbidden")
+    if access_level is not AccessLevel.READ_WRITE:
+        raise HTTPException(status_code=403, detail="Write access forbidden")
 
 
 # Pydantic models for request/response
@@ -207,7 +232,7 @@ async def admin_index(
     config: Annotated[tilecloud_chain.DatedConfig, Depends(server.get_host_config)],
     gene: Annotated[TileGeneration, Depends(_get_tilegeneration)],
     auth_info: Annotated[auth.AuthInfo, Depends(auth.get_auth)],
-    has_access: Annotated[bool, Depends(_get_access)],
+    access_level: Annotated[AccessLevel, Depends(_get_access_level)],
     auth_type: Annotated[auth.AuthenticationType, Depends(auth.auth_type)],
     secret: Annotated[str | None, Query(..., description="Secret key for authentication")] = None,
 ) -> HTMLResponse:
@@ -218,6 +243,9 @@ async def admin_index(
     jobs_status = None
     queue_store = main_config.config.get("queue_store", configuration.QUEUE_STORE_DEFAULT)
 
+    has_access = access_level is not AccessLevel.NO_ACCESS
+    read_only = access_level is AccessLevel.READ_ONLY
+
     structure_errors: list[str] = []
     deprecation_warnings: list[str] = []
     if config.file and has_access:
@@ -236,6 +264,7 @@ async def admin_index(
         "request": request,
         "nonce": nonce,
         "has_access": has_access,
+        "read_only": read_only,
         "auth_info": auth_info,
         "auth_type": auth_type,
         "secret": secret,
@@ -259,7 +288,7 @@ async def admin_run(
     request: Request,
     command: Annotated[str, Form(...)],
     gene: Annotated[TileGeneration, Depends(_get_tilegeneration)],
-    _: Annotated[None, Depends(_check_access)],
+    _: Annotated[None, Depends(_check_read_write_access)],
 ) -> CommandResponse:
     """Run the command given by the user."""
     commands = shlex.split(command)
@@ -366,7 +395,7 @@ async def admin_create_job(
         tilecloud_chain.store.postgresql.PostgresqlTileStore,
         Depends(_get_postgresql_store),
     ],
-    _: Annotated[None, Depends(_check_access)],
+    _: Annotated[None, Depends(_check_read_write_access)],
 ) -> JobResponse:
     """Create a job."""
     try:
@@ -391,7 +420,7 @@ async def admin_cancel_job(
         tilecloud_chain.store.postgresql.PostgresqlTileStore,
         Depends(_get_postgresql_store),
     ],
-    _: Annotated[None, Depends(_check_access)],
+    _: Annotated[None, Depends(_check_read_write_access)],
 ) -> JobResponse:
     """Cancel a job."""
     try:
@@ -416,7 +445,7 @@ async def admin_retry_job(
         tilecloud_chain.store.postgresql.PostgresqlTileStore,
         Depends(_get_postgresql_store),
     ],
-    _: Annotated[None, Depends(_check_access)],
+    _: Annotated[None, Depends(_check_read_write_access)],
 ) -> JobResponse:
     """Retry a job."""
     try: