sartography
/
spiff-arena
mirror of https://github.com/sartography/spiff-arena.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

created new users for keycloak and fixed some permissions for core user w/ burnettk cullerton

This commit is contained in:
jasquat 2022-11-22 13:01:08 -05:00
parent b25d620777
commit e5e6226bb9
15 changed files with 2986 additions and 3251 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5874
spiffworkflow-backend/bin/spiffworkflow-realm.json
View File

File diff suppressed because it is too large Load Diff

3
spiffworkflow-backend/src/spiffworkflow_backend/api.yml
View File

@ -686,7 +686,7 @@ paths:
schema:
$ref: "#/components/schemas/Workflow"
/process-instances/{process_instance_id}/run:
/process-instances/{modified_process_model_identifier}/{process_instance_id}/run:
parameters:
- name: process_instance_id
in: path
@ -700,7 +700,6 @@ paths:
description: Defaults to true, can be set to false if you are just looking at the workflow not completeing it.
schema:
type: boolean
# process_instance_run
post:
operationId: spiffworkflow_backend.routes.process_api_blueprint.process_instance_run
summary: Run a process instance

149
spiffworkflow-backend/src/spiffworkflow_backend/config/permissions/development.yml
View File

@ -14,14 +14,28 @@ groups:
jarrad,
elizabeth,
jon,
natalia,
harmeet,
sasha,
manuchehr,
natalia,
]
Finance Team:
users: [finance_user1, jason]
users:
[
jakub,
alex,
dan,
mike,
jason,
amir,
jarrad,
elizabeth,
jon,
natalia,
sasha,
fin,
]
Project Lead:
users:
@ -36,60 +50,109 @@ groups:
jon,
natalia,
manuchehr,
lead,
]
hr:
users: [manuchehr]
permissions:
tasks-crud:
groups: [everybody]
users: []
allowed_permissions: [create, read, update, delete]
uri: /v1.0/tasks/*
process-model-read-all:
groups: [everybody]
users: []
allowed_permissions: [read]
uri: /v1.0/process-models/*
process-group-read-all:
groups: [everybody]
users: []
allowed_permissions: [read]
uri: /v1.0/process-groups/*
process-instance-list:
groups: [everybody]
users: []
allowed_permissions: [read]
uri: /v1.0/process-instances
process-instance-report-list:
groups: [everybody]
users: []
allowed_permissions: [read]
uri: /v1.0/process-instances/reports
admin:
groups: [admin]
users: []
allowed_permissions: [create, read, update, delete, list, instantiate]
uri: /*
tasks-crud:
groups: [everybody]
users: []
allowed_permissions: [create, read, update, delete]
uri: /v1.0/tasks/*
process-model-read-all:
groups: [everybody]
users: []
allowed_permissions: [read]
uri: /v1.0/process-models/*
process-group-read-all:
groups: [everybody]
users: []
allowed_permissions: [read]
uri: /v1.0/process-groups/*
process-instance-list:
groups: [everybody]
users: []
allowed_permissions: [read]
uri: /v1.0/process-instances
# TODO: all uris should really have the same structure
finance-admin-group:
groups: ["Finance Team"]
users: []
allowed_permissions: [create, read, update, delete]
uri: /v1.0/process-groups/finance/*
finance-admin-model:
groups: ["Finance Team"]
users: []
allowed_permissions: [create, read, update, delete]
uri: /v1.0/process-models/finance/*
read-all:
groups: [admin, "Project Lead"]
groups: ["Finance Team", "Project Lead", hr, admin]
users: []
allowed_permissions: [read]
uri: /*
invoice-approval-tasks-read:
manage-procurement-admin:
groups: ["Project Lead"]
users: []
allowed_permissions: [create, read, update, delete]
uri: /v1.0/process-groups/manage-procurement:*
manage-procurement-admin-slash:
groups: ["Project Lead"]
users: []
allowed_permissions: [create, read, update, delete]
uri: /v1.0/process-groups/manage-procurement/*
manage-procurement-admin-models:
groups: ["Project Lead"]
users: []
allowed_permissions: [create, read, update, delete]
uri: /v1.0/process-models/manage-procurement:*
manage-procurement-admin-models-slash:
groups: ["Project Lead"]
users: []
allowed_permissions: [create, read, update, delete]
uri: /v1.0/process-models/manage-procurement/*
manage-procurement-admin-instances:
groups: ["Project Lead"]
users: []
allowed_permissions: [create, read, update, delete]
uri: /v1.0/process-instances/manage-procurement:*
manage-procurement-admin-instances-slash:
groups: ["Project Lead"]
users: []
allowed_permissions: [create, read, update, delete]
uri: /v1.0/process-instances/manage-procurement/*
finance-admin:
groups: ["Finance Team"]
users: []
allowed_permissions: [read]
uri: /v1.0/process-instances/category_number_one:lanes/*
allowed_permissions: [create, read, update, delete]
uri: /v1.0/process-groups/manage-procurement:procurement:vendor-invoice-management:*
finance-admin-slash:
groups: ["Finance Team"]
users: []
allowed_permissions: [create, read, update, delete]
uri: /v1.0/process-groups/manage-procurement:procurement:vendor-invoice-management/*
finance-admin-models:
groups: ["Finance Team"]
users: []
allowed_permissions: [create, read, update, delete]
uri: /v1.0/process-models/manage-procurement:procurement:vendor-invoice-management:*
finance-admin-models-slash:
groups: ["Finance Team"]
users: []
allowed_permissions: [create, read, update, delete]
uri: /v1.0/process-models/manage-procurement:procurement:vendor-invoice-management/*
finance-admin-instances:
groups: ["Finance Team"]
users: []
allowed_permissions: [create, read, update, delete]
uri: /v1.0/process-instances/manage-procurement:procurement:vendor-invoice-management:*
finance-admin-instances-slash:
groups: ["Finance Team"]
users: []
allowed_permissions: [create, read, update, delete]
uri: /v1.0/process-instances/manage-procurement:procurement:vendor-invoice-management/*

77
spiffworkflow-backend/src/spiffworkflow_backend/config/permissions/terraform_deployed_environment.yml
View File

@ -34,6 +34,7 @@ groups:
jon,
natalia,
sasha,
fin,
]
Project Lead:
@ -49,6 +50,7 @@ groups:
jon,
natalia,
manuchehr,
lead,
]
hr:
@ -67,21 +69,70 @@ permissions:
allowed_permissions: [create, read, update, delete, list, instantiate]
uri: /*
# TODO: all uris should really have the same structure
finance-admin-group:
groups: ["Finance Team"]
users: []
allowed_permissions: [create, read, update, delete]
uri: /v1.0/process-groups/finance/*
finance-admin:
groups: ["Finance Team"]
users: []
allowed_permissions: [create, read, update, delete]
uri: /v1.0/process-groups/finance/*
read-all:
groups: ["Finance Team", "Project Lead", hr, admin]
users: []
allowed_permissions: [read]
uri: /*
manage-procurement-admin:
groups: ["Project Lead"]
users: []
allowed_permissions: [create, read, update, delete]
uri: /v1.0/process-groups/manage-procurement:*
manage-procurement-admin-slash:
groups: ["Project Lead"]
users: []
allowed_permissions: [create, read, update, delete]
uri: /v1.0/process-groups/manage-procurement/*
manage-procurement-admin-models:
groups: ["Project Lead"]
users: []
allowed_permissions: [create, read, update, delete]
uri: /v1.0/process-models/manage-procurement:*
manage-procurement-admin-models-slash:
groups: ["Project Lead"]
users: []
allowed_permissions: [create, read, update, delete]
uri: /v1.0/process-models/manage-procurement/*
manage-procurement-admin-instances:
groups: ["Project Lead"]
users: []
allowed_permissions: [create, read, update, delete]
uri: /v1.0/process-instances/manage-procurement:*
manage-procurement-admin-instances-slash:
groups: ["Project Lead"]
users: []
allowed_permissions: [create, read, update, delete]
uri: /v1.0/process-instances/manage-procurement/*
finance-admin:
groups: ["Finance Team"]
users: []
allowed_permissions: [create, read, update, delete]
uri: /v1.0/process-groups/manage-procurement:procurement:vendor-invoice-management:*
finance-admin-slash:
groups: ["Finance Team"]
users: []
allowed_permissions: [create, read, update, delete]
uri: /v1.0/process-groups/manage-procurement:procurement:vendor-invoice-management/*
finance-admin-models:
groups: ["Finance Team"]
users: []
allowed_permissions: [create, read, update, delete]
uri: /v1.0/process-models/manage-procurement:procurement:vendor-invoice-management:*
finance-admin-models-slash:
groups: ["Finance Team"]
users: []
allowed_permissions: [create, read, update, delete]
uri: /v1.0/process-models/manage-procurement:procurement:vendor-invoice-management/*
finance-admin-instances:
groups: ["Finance Team"]
users: []
allowed_permissions: [create, read, update, delete]
uri: /v1.0/process-instances/manage-procurement:procurement:vendor-invoice-management:*
finance-admin-instances-slash:
groups: ["Finance Team"]
users: []
allowed_permissions: [create, read, update, delete]
uri: /v1.0/process-instances/manage-procurement:procurement:vendor-invoice-management/*

1
spiffworkflow-backend/src/spiffworkflow_backend/routes/process_api_blueprint.py
View File

@ -494,6 +494,7 @@ def process_instance_create(modified_process_model_id: str) -> flask.wrappers.Re
def process_instance_run(
modified_process_model_identifier: str,
process_instance_id: int,
do_engine_steps: bool = True,
) -> flask.wrappers.Response:

2
spiffworkflow-backend/src/spiffworkflow_backend/services/data_setup_service.py
View File

@ -26,7 +26,7 @@ class DataSetupService:
current_app.logger.debug("DataSetupService.save_all_process_models() start")
failing_process_models = []
process_models = ProcessModelService().get_process_models()
process_models = ProcessModelService().get_process_models(recursive=True)
SpecFileService.clear_caches()
for process_model in process_models:
current_app.logger.debug(f"Process Model: {process_model.display_name}")

13
spiffworkflow-backend/tests/spiffworkflow_backend/helpers/base_test.py
View File

@ -347,3 +347,16 @@ class BaseTest:
target_uri=target_uri,
)
assert has_permission is expected_result
def modify_process_identifier_for_path_param(self, identifier: str) -> str:
"""Identifier."""
if "\\" in identifier:
raise Exception(f"Found backslash in identifier: {identifier}")
return identifier.replace("/", ":")
def un_modify_modified_process_identifier_for_path_param(
self, modified_identifier: str
) -> str:
"""Un_modify_modified_process_model_id."""
return modified_identifier.replace(":", "/")

2
spiffworkflow-backend/tests/spiffworkflow_backend/integration/test_logging_service.py
View File

@ -51,7 +51,7 @@ class TestLoggingService(BaseTest):
assert response.json is not None
process_instance_id = response.json["id"]
response = client.post(
f"/v1.0/process-instances/{process_instance_id}/run",
f"/v1.0/process-instances/{self.modify_process_identifier_for_path_param(process_model_identifier)}/{process_instance_id}/run",
headers=headers,
)
assert response.status_code == 200

2
spiffworkflow-backend/tests/spiffworkflow_backend/integration/test_nested_groups.py
View File

@ -46,7 +46,7 @@ class TestNestedGroups(BaseTest):
process_instance_id = response.json["id"]
client.post(
f"/v1.0/process-instances/{process_instance_id}/run",
f"/v1.0/process-instances/{self.modify_process_identifier_for_path_param(process_model_identifier)}/{process_instance_id}/run",
headers=self.logged_in_headers(with_super_admin_user),
)
process_instance = ProcessInstanceService().get_process_instance(

28
spiffworkflow-backend/tests/spiffworkflow_backend/integration/test_process_api.py
View File

@ -1069,7 +1069,7 @@ class TestProcessApi(BaseTest):
assert response.json is not None
process_instance_id = response.json["id"]
response = client.post(
f"/v1.0/process-instances/{process_instance_id}/run",
f"/v1.0/process-instances/{self.modify_process_identifier_for_path_param(process_model_identifier)}/{process_instance_id}/run",
headers=self.logged_in_headers(with_super_admin_user),
)
@ -1101,7 +1101,9 @@ class TestProcessApi(BaseTest):
process_group_id=process_group_id,
process_model_id=process_model_id,
)
modified_process_model_identifier = process_model_identifier.replace("/", ":")
modified_process_model_identifier = (
self.modify_process_identifier_for_path_param(process_model_identifier)
)
headers = self.logged_in_headers(with_super_admin_user)
create_response = self.create_process_instance_from_process_model_id(
client, process_model_identifier, headers
@ -1109,7 +1111,7 @@ class TestProcessApi(BaseTest):
assert create_response.json is not None
process_instance_id = create_response.json["id"]
client.post(
f"/v1.0/process-instances/{process_instance_id}/run",
f"/v1.0/process-instances/{modified_process_model_identifier}/{process_instance_id}/run",
headers=self.logged_in_headers(with_super_admin_user),
)
show_response = client.get(
@ -1212,7 +1214,7 @@ class TestProcessApi(BaseTest):
process_instance_id = response.json["id"]
response = client.post(
f"/v1.0/process-instances/{process_instance_id}/run",
f"/v1.0/process-instances/{self.modify_process_identifier_for_path_param(process_model_identifier)}/{process_instance_id}/run",
headers=self.logged_in_headers(with_super_admin_user),
)
@ -1272,7 +1274,7 @@ class TestProcessApi(BaseTest):
process_instance_id = response.json["id"]
response = client.post(
f"/v1.0/process-instances/{process_instance_id}/run",
f"/v1.0/process-instances/{self.modify_process_identifier_for_path_param(process_model_identifier)}/{process_instance_id}/run",
headers=self.logged_in_headers(with_super_admin_user),
)
assert response.status_code == 200
@ -1320,7 +1322,7 @@ class TestProcessApi(BaseTest):
process_instance_id = response.json["id"]
response = client.post(
f"/v1.0/process-instances/{process_instance_id}/run",
f"/v1.0/process-instances/{self.modify_process_identifier_for_path_param(process_model_identifier)}/{process_instance_id}/run",
headers=self.logged_in_headers(with_super_admin_user),
)
assert response.json is not None
@ -1359,7 +1361,7 @@ class TestProcessApi(BaseTest):
process_instance_id = response.json["id"]
response = client.post(
f"/v1.0/process-instances/{process_instance_id}/run",
f"/v1.0/process-instances/{self.modify_process_identifier_for_path_param(process_model_identifier)}/{process_instance_id}/run",
headers=self.logged_in_headers(with_super_admin_user),
)
@ -1818,7 +1820,7 @@ class TestProcessApi(BaseTest):
assert process.status == "not_started"
response = client.post(
f"/v1.0/process-instances/{process_instance_id}/run",
f"/v1.0/process-instances/{self.modify_process_identifier_for_path_param(process_model_identifier)}/{process_instance_id}/run",
headers=self.logged_in_headers(with_super_admin_user),
)
assert response.status_code == 400
@ -1879,7 +1881,7 @@ class TestProcessApi(BaseTest):
assert process.status == "not_started"
response = client.post(
f"/v1.0/process-instances/{process_instance_id}/run",
f"/v1.0/process-instances/{self.modify_process_identifier_for_path_param(process_model_identifier)}/{process_instance_id}/run",
headers=self.logged_in_headers(with_super_admin_user),
)
assert response.status_code == 400
@ -1929,7 +1931,7 @@ class TestProcessApi(BaseTest):
with mail.record_messages() as outbox:
response = client.post(
f"/v1.0/process-instances/{process_instance_id}/run",
f"/v1.0/process-instances/{self.modify_process_identifier_for_path_param(process_model_identifier)}/{process_instance_id}/run",
headers=self.logged_in_headers(with_super_admin_user),
)
assert response.status_code == 400
@ -2114,7 +2116,7 @@ class TestProcessApi(BaseTest):
assert response.json is not None
process_instance_id = response.json["id"]
response = client.post(
f"/v1.0/process-instances/{process_instance_id}/run",
f"/v1.0/process-instances/{self.modify_process_identifier_for_path_param(process_model_identifier)}/{process_instance_id}/run",
headers=self.logged_in_headers(initiator_user),
)
assert response.status_code == 200
@ -2319,7 +2321,7 @@ class TestProcessApi(BaseTest):
process_instance_id = response.json["id"]
client.post(
f"/v1.0/process-instances/{process_instance_id}/run",
f"/v1.0/process-instances/{self.modify_process_identifier_for_path_param(process_model_identifier)}/{process_instance_id}/run",
headers=self.logged_in_headers(with_super_admin_user),
)
@ -2339,7 +2341,7 @@ class TestProcessApi(BaseTest):
# TODO: Why can I run a suspended process instance?
response = client.post(
f"/v1.0/process-instances/{process_instance_id}/run",
f"/v1.0/process-instances/{self.modify_process_identifier_for_path_param(process_model_identifier)}/{process_instance_id}/run",
headers=self.logged_in_headers(with_super_admin_user),
)

2
spiffworkflow-frontend/src/components/ProcessInstanceRun.tsx
View File

@ -39,7 +39,7 @@ export default function ProcessInstanceRun({
const processModelRun = (processInstance: any) => {
setErrorMessage(null);
HttpService.makeCallToBackend({
path: `/process-instances/${processInstance.id}/run`,
path: `/process-instances/${modifiedProcessModelId}/${processInstance.id}/run`,
successCallback: onProcessInstanceRun,
failureCallback: setErrorMessage,
httpMethod: 'POST',

6
spiffworkflow-frontend/src/hooks/PermissionService.tsx
View File

@ -1,7 +1,7 @@
// We may need to update usage of Ability when we update.
// They say they are going to rename PureAbility to Ability and remove the old class.
import { AbilityBuilder, Ability } from '@casl/ability';
import { useContext, useEffect } from 'react';
import { useContext, useEffect, useState } from 'react';
import { AbilityContext } from '../contexts/Can';
import { PermissionCheckResponseBody, PermissionsToCheck } from '../interfaces';
import HttpService from '../services/HttpService';
@ -10,6 +10,7 @@ export const usePermissionFetcher = (
permissionsToCheck: PermissionsToCheck
) => {
const ability = useContext(AbilityContext);
const [permissionsLoaded, setPermissionsLoaded] = useState<boolean>(false);
useEffect(() => {
const processPermissionResult = (result: PermissionCheckResponseBody) => {
@ -34,6 +35,7 @@ export const usePermissionFetcher = (
}
});
ability.update(rules);
setPermissionsLoaded(true);
};
HttpService.makeCallToBackend({
@ -44,5 +46,5 @@ export const usePermissionFetcher = (
});
});
return { ability };
return { ability, permissionsLoaded };
};

30
spiffworkflow-frontend/src/hooks/UriListForPermissions.tsx
View File

@ -1,20 +1,24 @@
import { useMemo } from 'react';
import { useParams } from 'react-router-dom';
export const useUriListForPermissions = () => {
const params = useParams();
const targetUris = {
authenticationListPath: `/v1.0/authentications`,
messageInstanceListPath: '/v1.0/messages',
processGroupListPath: '/v1.0/process-groups',
processGroupShowPath: `/v1.0/process-groups/${params.process_group_id}`,
processInstanceActionPath: `/v1.0/process-models/${params.process_model_id}/process-instances`,
processInstanceListPath: '/v1.0/process-instances',
processModelCreatePath: `/v1.0/process-models/${params.process_group_id}`,
processModelFileCreatePath: `/v1.0/process-models/${params.process_model_id}/files`,
processModelFileShowPath: `/v1.0/process-models/${params.process_model_id}/files/${params.file_name}`,
processModelShowPath: `/v1.0/process-models/${params.process_model_id}`,
secretListPath: `/v1.0/secrets`,
};
const targetUris = useMemo(() => {
return {
authenticationListPath: `/v1.0/authentications`,
messageInstanceListPath: '/v1.0/messages',
processGroupListPath: '/v1.0/process-groups',
processGroupShowPath: `/v1.0/process-groups/${params.process_group_id}`,
processInstanceActionPath: `/v1.0/process-models/${params.process_model_id}/process-instances`,
processInstanceListPath: '/v1.0/process-instances',
processInstanceTaskListPath: `/v1.0/process-instances/${params.process_model_id}/${params.process_instance_id}/tasks`,
processModelCreatePath: `/v1.0/process-models/${params.process_group_id}`,
processModelFileCreatePath: `/v1.0/process-models/${params.process_model_id}/files`,
processModelFileShowPath: `/v1.0/process-models/${params.process_model_id}/files/${params.file_name}`,
processModelShowPath: `/v1.0/process-models/${params.process_model_id}`,
secretListPath: `/v1.0/secrets`,
};
}, [params]);
return { targetUris };
};

42
spiffworkflow-frontend/src/routes/ProcessInstanceShow.tsx
View File

@ -43,6 +43,7 @@ export default function ProcessInstanceShow() {
const [processInstance, setProcessInstance] = useState(null);
const [tasks, setTasks] = useState<Array<object> | null>(null);
const [tasksCallHadError, setTasksCallHadError] = useState<boolean>(false);
const [taskToDisplay, setTaskToDisplay] = useState<object | null>(null);
const [taskDataToDisplay, setTaskDataToDisplay] = useState<string>('');
const [editingTaskData, setEditingTaskData] = useState<boolean>(false);
@ -57,8 +58,11 @@ export default function ProcessInstanceShow() {
const { targetUris } = useUriListForPermissions();
const permissionRequestData: PermissionsToCheck = {
[targetUris.messageInstanceListPath]: ['GET'],
[targetUris.processInstanceTaskListPath]: ['GET'],
};
const { ability } = usePermissionFetcher(permissionRequestData);
const { ability, permissionsLoaded } = usePermissionFetcher(
permissionRequestData
);
const navigateToProcessInstances = (_result: any) => {
navigate(
@ -67,21 +71,29 @@ export default function ProcessInstanceShow() {
};
useEffect(() => {
HttpService.makeCallToBackend({
path: `/process-models/${modifiedProcessModelId}/process-instances/${params.process_instance_id}`,
successCallback: setProcessInstance,
});
if (typeof params.spiff_step === 'undefined')
if (permissionsLoaded) {
const processTaskFailure = () => {
setTasksCallHadError(true);
};
HttpService.makeCallToBackend({
path: `/process-instances/${modifiedProcessModelId}/${params.process_instance_id}/tasks?all_tasks=true`,
successCallback: setTasks,
path: `/process-models/${modifiedProcessModelId}/process-instances/${params.process_instance_id}`,
successCallback: setProcessInstance,
});
else
HttpService.makeCallToBackend({
path: `/process-instances/${modifiedProcessModelId}/${params.process_instance_id}/tasks?all_tasks=true&spiff_step=${params.spiff_step}`,
successCallback: setTasks,
});
}, [params, modifiedProcessModelId]);
let taskParams = '?all_tasks=true';
if (typeof params.spiff_step !== 'undefined') {
taskParams = `${taskParams}&spiff_step=${params.spiff_step}`;
}
if (ability.can('GET', targetUris.processInstanceTaskListPath)) {
HttpService.makeCallToBackend({
path: `/process-instances/${modifiedProcessModelId}/${params.process_instance_id}/tasks${taskParams}`,
successCallback: setTasks,
failureCallback: processTaskFailure,
});
} else {
setTasksCallHadError(true);
}
}
}, [params, modifiedProcessModelId, permissionsLoaded, ability, targetUris]);
const deleteProcessInstance = () => {
HttpService.makeCallToBackend({
@ -550,7 +562,7 @@ export default function ProcessInstanceShow() {
return elements;
};
if (processInstance && tasks) {
if (processInstance && (tasks || tasksCallHadError)) {
const processInstanceToUse = processInstance as any;
const taskIds = getTaskIds();
const processModelId = unModifyProcessIdentifierForPathParam(

6
spiffworkflow-frontend/src/routes/ProcessModelShow.tsx
View File

@ -118,7 +118,9 @@ export default function ProcessModelShow() {
[targetUris.processInstanceActionPath]: ['POST'],
[targetUris.processModelFileCreatePath]: ['POST', 'GET', 'DELETE'],
};
const { ability } = usePermissionFetcher(permissionRequestData);
const { ability, permissionsLoaded } = usePermissionFetcher(
permissionRequestData
);
const modifiedProcessModelId = modifyProcessIdentifierForPathParam(
`${params.process_model_id}`
@ -325,7 +327,7 @@ export default function ProcessModelShow() {
};
const processModelFileList = () => {
if (!processModel) {
if (!processModel || !permissionsLoaded) {
return null;
}
let constructedTag;