Allow task auth on RetrieveSecret and UpdateWorkerActivity

arkindex/ponos/api.py

@@ -26,7 +26,7 @@ from arkindex.ponos.models import Agent, Artifact, Farm, Secret, State, Task, Wo
 from arkindex.ponos.permissions import (
     IsAgent,
     IsAgentOrArtifactAdmin,
-    IsAgentOrInternal,
+    IsAgentOrTask,
     IsAgentOrTaskAdmin,
     IsAssignedAgentOrReadOnly,
 )
@@ -411,10 +411,12 @@ class TaskUpdate(UpdateAPIView):
 )
 class SecretDetails(RetrieveAPIView):
     """
-    Retrieve a Ponos secret content as cleartext
+    Retrieve a Ponos secret content as cleartext.
+
+    Requires authentication as an internal user, a Ponos agent or a Ponos task.
     """
 
-    permission_classes = (IsAgentOrInternal, )
+    permission_classes = (IsAgentOrTask, )
     serializer_class = ClearTextSecretSerializer
 
     def get_object(self):

arkindex/ponos/permissions.py

@@ -5,19 +5,28 @@ from arkindex.project.mixins import CorpusACLMixin
 from arkindex.project.permissions import IsAuthenticated, require_internal
 
 
-def require_agent(request, view):
+def require_agent_or_admin(request, view):
     return getattr(request.user, 'is_admin', False) or getattr(request.user, 'is_agent', False)
 
 
-def require_agent_or_internal(request, view):
-    return require_internal(request, view) or getattr(request.user, 'is_agent', False)
+def require_task(request, view):
+    # For backwards compatibility, internal users are considered to be authenticated as a Ponos task.
+    # TODO: Remove the internal check once APIs should be restricted to the new authentication
+    return isinstance(request.auth, Task) or require_internal(request, view)
+
+
+def require_agent_or_task(request, view):
+    return (
+        getattr(request.user, 'is_agent', False)
+        or require_task(request, view)
+    )
 
 
 class IsAgent(IsAuthenticated):
     """
     Only allow Ponos agents and admins.
     """
-    checks = IsAuthenticated.checks + (require_agent, )
+    checks = IsAuthenticated.checks + (require_agent_or_admin, )
 
 
 class IsAgentOrReadOnly(IsAgent):
@@ -59,7 +68,7 @@ class IsAgentOrTaskAdmin(CorpusACLMixin, IsAuthenticated):
         self.request = request
 
         return (
-            require_agent(request, view)
+            require_agent_or_admin(request, view)
             or require_internal(request, view)
             or (
                 task.workflow.process is not None
@@ -79,8 +88,12 @@ class IsAgentOrArtifactAdmin(IsAgentOrTaskAdmin):
         return super().has_object_permission(request, view, artifact.task)
 
 
-class IsAgentOrInternal(IsAuthenticated):
+class IsTask(IsAuthenticated):
+    checks = (require_task, )
+
+
+class IsAgentOrTask(IsAuthenticated):
     """
-    Allow access to agents or internal users, and not admins.
+    Allow access to Ponos agents or tasks.
     """
-    checks = (require_agent_or_internal, )
+    checks = (require_agent_or_task, )

arkindex/process/api.py

@@ -39,6 +39,7 @@ from rest_framework.views import APIView
 
 from arkindex.documents.models import Corpus, Element
 from arkindex.ponos.models import STATES_ORDERING, State
+from arkindex.ponos.permissions import IsTask
 from arkindex.process.models import (
     ActivityState,
     DataFile,
@@ -100,7 +101,7 @@ from arkindex.project.mixins import (
     WorkerACLMixin,
 )
 from arkindex.project.pagination import CustomCursorPagination
-from arkindex.project.permissions import IsInternal, IsVerified, IsVerifiedOrReadOnly
+from arkindex.project.permissions import IsVerified, IsVerifiedOrReadOnly
 from arkindex.project.tools import PercentileCont, RTrimChr
 from arkindex.project.triggers import process_delete
 from arkindex.training.models import ModelVersionState
@@ -1475,10 +1476,10 @@ class ListProcessElements(CorpusACLMixin, ListAPIView):
 
 class UpdateWorkerActivity(GenericAPIView):
     """
-    Makes a worker (internal user) able to update its activity on an element
+    Allow a Ponos task or an internal user to update an element's state
     Only allow defined evolutions of the element's state
     """
-    permission_classes = (IsInternal, )
+    permission_classes = (IsTask, )
     serializer_class = WorkerActivitySerializer
     queryset = WorkerActivity.objects.none()
 
@@ -1511,7 +1512,7 @@ class UpdateWorkerActivity(GenericAPIView):
         operation_id='UpdateWorkerActivity',
         description=(
             'Updates the activity of a worker version on an element.\n\n'
-            'The user must be **internal** to perform this request.\n\n'
+            'The user must be **internal** or a Ponos task to perform this request.\n\n'
             'A **HTTP_409_CONFLICT** is returned in case the body is valid but the update failed.'
         ),
     )