Develop roles refactor

server/mergin/app.py

@@ -180,7 +180,6 @@ def create_app(public_keys: List[str] = None) -> Flask:
         arguments={"title": "Mergin"},
         options={"swagger_ui": Configuration.SWAGGER_UI},
         validate_responses=True,
-        pythonic_params=True,
     )
     app.add_api(
         "sync/private_api.yaml",

server/mergin/auth/api.yaml

@@ -10,6 +10,8 @@ tags:
     description: Mergin user
   - name: admin
     description: For mergin admin
+  - name: public
+    description: Public API
 paths:
   /app/auth/user/search:
     get:
@@ -642,6 +644,57 @@ paths:
           $ref: "#/components/responses/UnauthorizedError"
         "403":
           $ref: "#/components/responses/Forbidden"
+  /v2/users:
+    post:
+      tags:
+        - user
+        - public
+      summary: Create user
+      operationId: create_user
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - email
+                - password
+                - workspace_id
+                - role
+              properties:
+                email:
+                  type: string
+                  format: email
+                  example: john.doe@example.com
+                username:
+                  type: string
+                  example: john.doe
+                password:
+                  type: string
+                  format: password
+                  example: topsecret
+                workspace_id:
+                  type: integer
+                  example: 1
+                role:
+                  $ref: "#/components/schemas/WorkspaceRole"
+                notify_user:
+                  type: boolean
+      responses:
+        "201":
+          description: User info
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/UserInfo"
+        "401":
+          $ref: "#/components/responses/UnauthorizedError"
+        "404":
+          $ref: "#/components/responses/NotFoundResp"
+        "422":
+          $ref: "#/components/responses/UnprocessableEntity"
+      x-openapi-router-controller: mergin.auth.controller
 components:
   responses:
     UnauthorizedError:

server/mergin/auth/app.py

@@ -12,7 +12,6 @@
 from .commands import add_commands
 from .config import Configuration
 from .models import User, UserProfile
-from ..app import db
 
 # signal for other versions to listen to
 user_account_closed = signal("user_account_closed")
@@ -97,24 +96,22 @@ def confirm_token(token, expiration=3600 * 24 * 3):
     return email
 
 
-def send_confirmation_email(app, user, url, template, header):
+def send_confirmation_email(app, user, url, template, header, **kwargs):
+    """
+    Send confirmation email from selected template with customizable email subject and confirmation URL.
+    Optional kwargs are passed to render_template method if needed for particular template.
+    """
     from ..celery import send_email_async
 
     token = generate_confirmation_token(app, user.email)
     confirm_url = f"{url}/{token}"
-    html = render_template(template, subject=header, confirm_url=confirm_url, user=user)
+    html = render_template(
+        template, subject=header, confirm_url=confirm_url, user=user, **kwargs
+    )
     email_data = {
         "subject": header,
         "html": html,
         "recipients": [user.email],
         "sender": app.config["MAIL_DEFAULT_SENDER"],
     }
     send_email_async.delay(**email_data)
-
-
-def do_register_user(username, email, password):
-    user = User(username.strip(), email.strip(), password, False)
-    user.profile = UserProfile()
-    db.session.add(user)
-    db.session.commit()
-    return user

server/mergin/auth/controller.py

@@ -15,7 +15,6 @@
 from .app import (
     auth_required,
     authenticate,
-    do_register_user,
     send_confirmation_email,
     confirm_token,
     generate_confirmation_token,
@@ -92,7 +91,7 @@ def get_user_public(username=None):  # noqa: E501
         "storage": user_workspace.storage if user_workspace else 104857600,
         "storage_limit": user_workspace.storage if user_workspace else 104857600,
         "organisations": {
-            ws.name: ws.get_user_role(current_user) for ws in all_workspaces
+            ws.name: ws.get_user_role(current_user).value for ws in all_workspaces
         },
     }
     return user_info, 200
@@ -374,7 +373,7 @@ def register_user():  # pylint: disable=W0613,W0612
 
     form = UserRegistrationForm()
     if form.validate():
-        user = do_register_user(form.username.data, form.email.data, form.password.data)
+        user = User.create(form.username.data, form.email.data, form.password.data)
         user_created.send(user, source="admin")
         token = generate_confirmation_token(current_app, user.email)
         confirm_url = f"confirm-email/{token}"
@@ -486,7 +485,7 @@ def get_user_info():
     user_info = UserInfoSchema().dump(current_user)
     workspaces = current_app.ws_handler.list_user_workspaces(current_user.username)
     user_info["workspaces"] = [
-        {"id": ws.id, "name": ws.name, "role": ws.get_user_role(current_user)}
+        {"id": ws.id, "name": ws.name, "role": ws.get_user_role(current_user).value}
         for ws in workspaces
     ]
     preferred_workspace = current_app.ws_handler.get_preferred(current_user)
@@ -501,6 +500,48 @@ def get_user_info():
     return user_info, 200
 
 
+@auth_required
+def create_user():
+    """Create new user"""
+    workspace = current_app.ws_handler.get(request.json.get("workspace_id"))
+    if not (workspace and workspace.can_add_users(current_user)):
+        abort(403)
+
+    username = request.json.get(
+        "username", User.generate_username(request.json["email"])
+    )
+    form = UserRegistrationForm()
+    form.confirm.data = form.password.data
+    form.username.data = username
+    if not form.validate():
+        return jsonify(form.errors), 400
+
+    user = User.create(
+        form.username.data,
+        form.email.data,
+        form.password.data,
+        request.json.get("notify_user", False),
+    )
+    user_created.send(
+        user,
+        source="api",
+        workspace_id=request.json["workspace_id"],
+        workspace_role=request.json["role"],
+    )
+
+    if user.profile.receive_notifications:
+        send_confirmation_email(
+            current_app,
+            user,
+            "confirm-email",
+            "email/user_created.html",
+            "Invitation to Mergin Maps",
+            password=form.password.data,
+        )
+
+    return jsonify(UserInfoSchema().dump(user)), 201
+
+
 @auth_required(permissions=["admin"])
 def get_server_usage():
     data = {

server/mergin/auth/models.py

@@ -7,9 +7,10 @@
 from typing import List, Optional
 import bcrypt
 from flask import current_app, request
-from sqlalchemy import or_, func
+from sqlalchemy import or_, func, text
 
 from ..app import db
+from ..sync.models import ProjectUser
 from ..sync.utils import get_user_agent, get_ip, get_device_id
 
 
@@ -149,24 +150,10 @@ def inactivate(self) -> None:
         """Inactivate user account and remove explicitly shared projects as well clean references to created projects.
         User is then safe to be removed.
         """
-        from ..sync.models import Project, ProjectAccess, AccessRequest, RequestStatus
+        from ..sync.models import AccessRequest, RequestStatus
 
-        shared_projects = Project.query.filter(
-            or_(
-                Project.access.has(ProjectAccess.owners.contains([self.id])),
-                Project.access.has(ProjectAccess.writers.contains([self.id])),
-                Project.access.has(ProjectAccess.editors.contains([self.id])),
-                Project.access.has(ProjectAccess.readers.contains([self.id])),
-            )
-        ).all()
-
-        for p in shared_projects:
-            for key in ("owners", "writers", "editors", "readers"):
-                value = set(getattr(p.access, key))
-                if self.id in value:
-                    value.remove(self.id)
-                setattr(p.access, key, list(value))
-            db.session.add(p)
+        # remove explicit permissions
+        ProjectUser.query.filter(ProjectUser.user_id == self.id).delete()
 
         # decline all access requests
         for req in (
@@ -192,6 +179,51 @@ def anonymize(self):
         self.profile.last_name = None
         db.session.commit()
 
+    @classmethod
+    def get_by_login(cls, login: str) -> Optional[User]:
+        """Find user by its login which can be either username or email"""
+        login = login.strip().lower()
+        return cls.query.filter(
+            or_(
+                func.lower(User.email) == login,
+                func.lower(User.username) == login,
+            )
+        ).first()
+
+    @classmethod
+    def generate_username(cls, email: str) -> Optional[str]:
+        """Autogenerate username from email"""
+        if not "@" in email:
+            return
+        username = email.split("@")[0].strip().lower()
+        # check if we already do not have existing usernames
+        suffix = db.session.execute(
+            text(
+                """
+                SELECT
+                    replace(username, :username, '0')::int AS suffix
+                FROM "user"
+                WHERE
+                    username = :username OR
+                    username SIMILAR TO :username'\d+'
+                ORDER BY replace(username, :username, '0')::int DESC
+                LIMIT 1;
+                """
+            ),
+            {"username": username},
+        ).scalar()
+        return username if suffix is None else username + str(int(suffix) + 1)
+
+    @classmethod
+    def create(
+        cls, username: str, email: str, password: str, notifications: bool = True
+    ) -> User:
+        user = cls(username.strip(), email.strip(), password, False)
+        user.profile = UserProfile(receive_notifications=notifications)
+        db.session.add(user)
+        db.session.commit()
+        return user
+
 
 class UserProfile(db.Model):
     user_id = db.Column(

server/mergin/auth/schemas.py

@@ -32,17 +32,16 @@ def get_disk_usage(self, obj):
 
     def _has_project(self, obj):
         # DEPRECATED functionality - kept for the backward-compatibility
-        from ..sync.models import Project, ProjectAccess
+        from ..sync.models import ProjectUser, Project
 
         ws = current_app.ws_handler.get_by_name(obj.user.username)
         if ws:
             projects_count = (
-                Project.query.filter(Project.creator_id == obj.user.id)
+                Project.query.join(ProjectUser)
+                .filter(Project.creator_id == obj.user.id)
                 .filter(Project.removed_at.is_(None))
-                .filter_by(workspace_id=ws.id)
-                .filter(
-                    Project.access.has(ProjectAccess.readers.contains([obj.user.id]))
-                )
+                .filter(Project.workspace_id == ws.id)
+                .filter(ProjectUser.user_id == obj.user.id)
                 .count()
             )
             return projects_count > 0

server/mergin/auth/tasks.py

@@ -6,7 +6,7 @@
 from sqlalchemy.sql.operators import isnot
 
 from ..celery import celery
-from .app import db
+from ..app import db
 from .models import User
 from .config import Configuration
 

server/mergin/sync/commands.py

@@ -11,7 +11,7 @@
 
 from .files import UploadChanges
 from ..app import db
-from .models import Project, ProjectAccess, ProjectVersion
+from .models import Project, ProjectVersion
 from .utils import split_project_path
 from ..auth.models import User
 
@@ -52,7 +52,6 @@ def create(name, namespace, username):  # pylint: disable=W0612
         p = Project(**project_params)
         p.updated = datetime.utcnow()
         db.session.add(p)
-        p.access = ProjectAccess(p, public=False)
         changes = UploadChanges(added=[], updated=[], removed=[])
         pv = ProjectVersion(p, 0, user.id, changes, "127.0.0.1")
         pv.project = p

server/mergin/sync/interfaces.py

@@ -3,6 +3,7 @@
 # SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-MerginMaps-Commercial
 
 from abc import ABC, abstractmethod
+from enum import Enum
 
 
 class AbstractWorkspace:
@@ -74,6 +75,16 @@ def project_count(self):
         """Return number of workspace projects"""
         pass
 
+    @abstractmethod
+    def members(self):
+        """Return workspace members"""
+        pass
+
+    @abstractmethod
+    def can_add_users(self, user):
+        """Check if user can add another user to workspace"""
+        pass
+
 
 class WorkspaceHandler(ABC):
     """
@@ -169,3 +180,21 @@ def get_push_permission(self, changes: dict):
         Return project permission for user to push data to project
         """
         pass
+
+
+class WorkspaceRole(Enum):
+    GUEST = "guest"
+    READER = "reader"
+    EDITOR = "editor"
+    WRITER = "writer"
+    ADMIN = "admin"
+    OWNER = "owner"
+
+    @classmethod
+    def values(cls):
+        return [member.value for member in cls.__members__.values()]
+
+    def __ge__(self, other):
+        """Compare roles"""
+        members = list(WorkspaceRole.__members__)
+        return members.index(self.name) >= members.index(other.name)