Enforcing Organization and Role API Permissions

.vscode/settings.json

@@ -25,19 +25,27 @@
   },
   "cSpell.words": [
     "bbox",
+    "bgscheduler",
     "BOOTSTRAPSERVERS",
     "Bsms",
     "cdot",
     "cimms",
+    "cloudsql",
     "collstats",
+    "commsignia",
     "conflictmonitor",
     "conflictvisualizer",
+    "creds",
     "customdb",
     "cviz",
     "cvmanager",
     "CVPEP",
+    "dateutil",
     "dont",
+    "drivername",
     "formik",
+    "fromaddr",
+    "Fwding",
     "geojsonconverter",
     "hamcrest",
     "healthcheck",
@@ -46,33 +54,58 @@
     "INITDB",
     "inprog",
     "JDBC",
+    "jsonify",
+    "Kapsch",
     "keyfile",
     "ksession",
     "LOGLEVEL",
     "luxon",
+    "mailhost",
     "MESSAGETYPE",
     "millis",
     "mongosh",
+    "msgfwd",
     "multidict",
     "Multivalued",
+    "NTCIP",
     "OIDC",
     "OIDCID",
     "pgdb",
+    "PGSQL",
     "postgis",
+    "pythjon",
     "pytz",
+    "querycounts",
+    "querydb",
+    "querymsgfwd",
     "reduxjs",
+    "rsudsrcfwd",
+    "rsufwdsnmpset",
+    "rsufwdsnmpwalk",
+    "rsuinfo",
     "rsus",
+    "rwdata",
+    "rxtxfwd",
     "SASL",
+    "secretmanager",
     "SNMP",
+    "snmpfilter",
     "Snmpset",
     "Snmpwalk",
     "sqlalchemy",
+    "stfq",
     "subquery",
     "svcs",
     "TABLENAME",
+    "toaddrs",
+    "upgrader",
     "usdotjpoode",
+    "userauth",
     "utctimestamp",
+    "writedb",
     "wydot",
+    "Xmit",
+    "yunex",
     "Zabbix"
   ],
   "java.configuration.updateBuildConfiguration": "automatic"

resources/sql_scripts/CVManager_CreateTables.sql

@@ -543,4 +543,24 @@ CREATE TABLE IF NOT EXISTS public.max_retry_limit_reached_instances
       REFERENCES public.firmware_images (firmware_id) MATCH SIMPLE
       ON UPDATE NO ACTION
       ON DELETE NO ACTION
-);
+);
+
+
+
+-- Indexes
+CREATE INDEX idx_organizations_name ON public.organizations (name);
+
+-- RSUs
+CREATE INDEX idx_rsu_organization ON public.rsu_organization (organization_id, rsu_id);
+CREATE INDEX idx_rsus_ipv4_address ON public.rsus (ipv4_address);
+CREATE INDEX idx_rsus_ipv4_rsu_id ON public.rsus (ipv4_address, rsu_id);
+
+-- Intersections
+CREATE INDEX idx_intersections_intersection_number ON public.intersections (intersection_number);
+CREATE INDEX idx_intersection_id ON public.intersections (intersection_id);
+CREATE INDEX idx_intersection_organization ON public.intersection_organization (organization_id, intersection_id);
+
+-- Users
+CREATE INDEX idx_users_email ON public.users (email);
+CREATE INDEX idx_users_user_id ON public.users (user_id);
+CREATE INDEX idx_user_organization ON public.user_organization (user_id, organization_id);

sample_no_cm.env

@@ -192,7 +192,7 @@ STALE_PERIOD=24
 
 # OBU OTA Server Addon:
 
-# Routeable host name for the server
+# Routable host name for the server
 OBU_OTA_SERVER_HOST = "localhost"
 
 # For users using GCP cloud storage
@@ -211,7 +211,7 @@ NGINX_ENCRYPTION="plain"
 SERVER_CERT_FILE="ota_server.crt"
 SERVER_KEY_FILE="ota_server.key"
 
-# Max number of succesfull firmware upgrades to keep in the database per device SN
+# Max number of successful firmware upgrades to keep in the database per device SN
 MAX_COUNT = 10
 
 # ---------------------------------------------------------------------

services/.gitignore

@@ -0,0 +1,4 @@
+site-packages
+Scripts
+pyvenv.cfg
+.idea

services/addons/tests/firmware_manager/upgrade_runner/test_upgrade_runner.py

@@ -4,9 +4,8 @@
 from werkzeug.exceptions import BadRequest
 import addons.tests.firmware_manager.upgrade_runner.test_upgrade_runner_values as fmv
 
-# start_upgrade_task tests
-
 
+# start_upgrade_task tests
 @patch("addons.images.firmware_manager.upgrade_runner.upgrade_runner.Popen")
 def test_start_upgrade_task_success(mock_popen):
     with upgrade_runner.app.app_context():
@@ -51,8 +50,6 @@ def test_start_upgrade_task_fail(mock_popen):
 
 
 # run_firmware_upgrade tests
-
-
 @patch(
     "addons.images.firmware_manager.upgrade_runner.upgrade_runner.start_upgrade_task",
     MagicMock(),
@@ -98,8 +95,6 @@ def test_run_firmware_upgrade_success(mock_logging, mock_start_upgrade_task):
 
 
 # Other tests
-
-
 @patch("addons.images.firmware_manager.upgrade_runner.upgrade_runner.serve")
 def test_serve_rest_api(mock_serve):
     upgrade_runner.serve_rest_api()

services/addons/tests/firmware_manager/upgrade_scheduler/test_upgrade_scheduler.py

@@ -42,8 +42,6 @@ def test_get_rsu_upgrade_data_one(mock_querydb):
 
 
 # start_tasks_from_queue tests
-
-
 @patch.dict("os.environ", {"UPGRADE_RUNNER_ENDPOINT": "http://test-endpoint"})
 @patch(
     "addons.images.firmware_manager.upgrade_scheduler.upgrade_scheduler.active_upgrades",
@@ -246,8 +244,6 @@ def test_start_tasks_from_queue_post_fail(mock_post, mock_logging):
 
 
 # init_firmware_upgrade tests
-
-
 @patch(
     "addons.images.firmware_manager.upgrade_scheduler.upgrade_scheduler.active_upgrades",
     {},
@@ -464,8 +460,6 @@ def test_init_firmware_upgrade_success(
 
 
 # firmware_upgrade_completed tests
-
-
 @patch("addons.images.firmware_manager.upgrade_scheduler.upgrade_scheduler.logging")
 @patch(
     "addons.images.firmware_manager.upgrade_scheduler.upgrade_scheduler.active_upgrades",
@@ -809,8 +803,6 @@ def test_firmware_upgrade_completed_success_status_exception(
 
 
 # list_active_upgrades tests
-
-
 @patch("addons.images.firmware_manager.upgrade_scheduler.upgrade_scheduler.logging")
 @patch(
     "addons.images.firmware_manager.upgrade_scheduler.upgrade_scheduler.active_upgrades",
@@ -853,8 +845,6 @@ def test_list_active_upgrades(mock_logging):
 
 
 # check_for_upgrades tests
-
-
 @patch.dict("os.environ", {"UPGRADE_RUNNER_ENDPOINT": "http://test-endpoint"})
 @patch(
     "addons.images.firmware_manager.upgrade_scheduler.upgrade_scheduler.was_latest_ping_successful_for_rsu"
@@ -953,8 +943,6 @@ def test_check_for_upgrades(
 
 
 # Other tests
-
-
 @patch(
     "addons.images.firmware_manager.upgrade_scheduler.upgrade_scheduler.pgquery.query_db"
 )

services/addons/tests/iss_health_check/test_iss_token.py

@@ -6,9 +6,8 @@
 
 from addons.images.iss_health_check import iss_token
 
-# --------------------- Storage Type tests ---------------------
-
 
+# --------------------- Storage Type tests ---------------------
 @patch.dict(
     os.environ,
     {
@@ -71,8 +70,6 @@ def test_get_storage_type_unset():
 
 
 # --------------------- end of Storage Type tests ---------------------
-
-
 # --------------------- GCP tests ---------------------
 @patch(
     "addons.images.iss_health_check.iss_token.secretmanager.SecretManagerServiceClient"
@@ -305,8 +302,6 @@ def test_get_token_secret_exists(
 
 
 # --------------------- Postgres tests ---------------------
-
-
 @patch(
     "addons.images.iss_health_check.iss_token.pgquery",
 )

services/addons/tests/obu_ota_server/test_obu_ota_server.py

@@ -1,7 +1,7 @@
 import pytest
 import tempfile
 import os
-from httpx import AsyncClient, BasicAuth
+from httpx import ASGITransport, AsyncClient, BasicAuth
 from fastapi import HTTPException, Request
 from unittest.mock import patch, MagicMock
 from datetime import datetime
@@ -201,7 +201,9 @@ async def test_read_file_no_end_range():
 @patch.dict("os.environ", {"OTA_USERNAME": "username", "OTA_PASSWORD": "password"})
 @pytest.mark.anyio
 async def test_read_root():
-    async with AsyncClient(app=app, base_url="http://test") as ac:
+    async with AsyncClient(
+        transport=ASGITransport(app=app), base_url="http://test"
+    ) as ac:
         response = await ac.get("/")
     assert response.status_code == 200
     assert response.json() == {"message": "obu ota server healthcheck", "root_path": ""}
@@ -217,7 +219,9 @@ async def test_get_manifest(mock_commsignia_manifest, mock_get_firmware_list):
         "/firmwares/test2.tar.sig",
     ]
     mock_commsignia_manifest.return_value = {"json": "data"}
-    async with AsyncClient(app=app, base_url="http://test") as ac:
+    async with AsyncClient(
+        transport=ASGITransport(app=app), base_url="http://test"
+    ) as ac:
         response = await ac.get(
             "/firmwares/commsignia", auth=BasicAuth("username", "password")
         )
@@ -234,7 +238,9 @@ async def test_get_fw(mock_read_file, mock_parse_range_header, mock_get_firmware
     mock_get_firmware.return_value = True
     mock_parse_range_header.return_value = 0, 100
     mock_read_file.return_value = b"Test data", 100, 100
-    async with AsyncClient(app=app, base_url="http://test") as ac:
+    async with AsyncClient(
+        transport=ASGITransport(app=app), base_url="http://test"
+    ) as ac:
         response = await ac.get(
             "/firmwares/commsignia/test_firmware_id",
             auth=BasicAuth("username", "password"),
@@ -334,7 +340,9 @@ async def test_get_manifest(mock_commsignia_manifest, mock_get_firmware_list):
         "/firmwares/test2.tar.sig",
     ]
     mock_commsignia_manifest.return_value = {"json": "data"}
-    async with AsyncClient(app=app, base_url="http://test") as ac:
+    async with AsyncClient(
+        transport=ASGITransport(app=app), base_url="http://test"
+    ) as ac:
         response = await ac.get(
             "/firmwares/commsignia", auth=BasicAuth("username", "password")
         )
@@ -358,7 +366,9 @@ async def test_fqdn_response_plain(mock_commsignia_manifest, mock_get_firmware_l
     expected_hostname = "http://localhost"
     mock_commsignia_manifest.return_value = {"json": "data"}
 
-    async with AsyncClient(app=app, base_url="http://test") as ac:
+    async with AsyncClient(
+        transport=ASGITransport(app=app), base_url="http://test"
+    ) as ac:
         response = await ac.get(
             "/firmwares/commsignia", auth=BasicAuth("username", "password")
         )
@@ -383,7 +393,9 @@ async def test_fqdn_response_ssl(mock_commsignia_manifest, mock_get_firmware_lis
     expected_hostname = "https://localhost"
     mock_commsignia_manifest.return_value = {"json": "data"}
 
-    async with AsyncClient(app=app, base_url="http://test") as ac:
+    async with AsyncClient(
+        transport=ASGITransport(app=app), base_url="http://test"
+    ) as ac:
         response = await ac.get(
             "/firmwares/commsignia", auth=BasicAuth("username", "password")
         )

services/api/requirements.txt

@@ -7,10 +7,9 @@ requests==2.31.0
 sqlalchemy==2.0.21
 pg8000==1.30.2
 DateTime==5.2
-google-cloud-bigquery==3.14.1
 python-dateutil==2.8.2
 pytz==2023.3.post1
 Werkzeug==3.0.0
-python-keycloak==2.16.2
+python-keycloak==3.12.0
 pymongo==4.5.0
 fabric==3.2.2