feat: Implement write access sharing

src/main/java/com/epam/aidial/core/controller/AccessControlBaseController.java

@@ -2,18 +2,22 @@
 
 import com.epam.aidial.core.Proxy;
 import com.epam.aidial.core.ProxyContext;
+import com.epam.aidial.core.data.ResourceAccessType;
 import com.epam.aidial.core.security.AccessService;
 import com.epam.aidial.core.storage.ResourceDescription;
 import com.epam.aidial.core.util.HttpStatus;
 import io.vertx.core.Future;
 import lombok.AllArgsConstructor;
 
+import java.util.List;
+import java.util.Set;
+
 @AllArgsConstructor
 public abstract class AccessControlBaseController {
 
     final Proxy proxy;
     final ProxyContext context;
-    final boolean isWriteAccess;
+    final ResourceAccessType accessType;
 
     public Future<?> handle(String resourceUrl) {
         ResourceDescription resource;
@@ -29,7 +33,7 @@ public Future<?> handle(String resourceUrl) {
         return proxy.getVertx()
                 .executeBlocking(() -> {
                     AccessService service = proxy.getAccessService();
-                    return isWriteAccess ? service.hasWriteAccess(resource, context) : service.hasReadAccess(resource, context);
+                    return !service.lookupPermissions(resource, context, Set.of(accessType)).isEmpty();
                 }, false)
                 .map(hasAccess -> {
                     if (hasAccess) {

src/main/java/com/epam/aidial/core/controller/DeleteFileController.java

@@ -2,6 +2,7 @@
 
 import com.epam.aidial.core.Proxy;
 import com.epam.aidial.core.ProxyContext;
+import com.epam.aidial.core.data.ResourceAccessType;
 import com.epam.aidial.core.data.ResourceLink;
 import com.epam.aidial.core.data.ResourceLinkCollection;
 import com.epam.aidial.core.service.InvitationService;
@@ -24,7 +25,7 @@ public class DeleteFileController extends AccessControlBaseController {
     private final LockService lockService;
 
     public DeleteFileController(Proxy proxy, ProxyContext context) {
-        super(proxy, context, true);
+        super(proxy, context, ResourceAccessType.WRITE);
         this.shareService = proxy.getShareService();
         this.invitationService = proxy.getInvitationService();
         this.lockService = proxy.getLockService();
@@ -47,7 +48,7 @@ protected Future<?> handle(ResourceDescription resource) {
                 resourceLinks.add(new ResourceLink(resource.getUrl()));
                 return lockService.underBucketLock(bucketLocation, () -> {
                     invitationService.cleanUpResourceLinks(bucketName, bucketLocation, resourceLinks);
-                    shareService.revokeSharedAccess(bucketName, bucketLocation, new ResourceLinkCollection(resourceLinks));
+                    shareService.revokeSharedAccess(bucketName, bucketLocation, resourceLinks);
                     storage.delete(absoluteFilePath);
                     return null;
                 });

src/main/java/com/epam/aidial/core/controller/DownloadFileController.java

@@ -2,6 +2,7 @@
 
 import com.epam.aidial.core.Proxy;
 import com.epam.aidial.core.ProxyContext;
+import com.epam.aidial.core.data.ResourceAccessType;
 import com.epam.aidial.core.storage.InputStreamReader;
 import com.epam.aidial.core.storage.ResourceDescription;
 import com.epam.aidial.core.util.HttpStatus;
@@ -20,7 +21,7 @@
 public class DownloadFileController extends AccessControlBaseController {
 
     public DownloadFileController(Proxy proxy, ProxyContext context) {
-        super(proxy, context, false);
+        super(proxy, context, ResourceAccessType.READ);
     }
 
     @Override

src/main/java/com/epam/aidial/core/controller/FileMetadataController.java

@@ -3,6 +3,9 @@
 import com.epam.aidial.core.Proxy;
 import com.epam.aidial.core.ProxyContext;
 import com.epam.aidial.core.data.MetadataBase;
+import com.epam.aidial.core.data.ResourceAccessType;
+import com.epam.aidial.core.security.AccessService;
+import com.epam.aidial.core.service.PermissionsFetcher;
 import com.epam.aidial.core.storage.BlobStorage;
 import com.epam.aidial.core.storage.ResourceDescription;
 import com.epam.aidial.core.util.HttpStatus;
@@ -12,9 +15,11 @@
 
 @Slf4j
 public class FileMetadataController extends AccessControlBaseController {
+    private final AccessService accessService;
 
     public FileMetadataController(Proxy proxy, ProxyContext context) {
-        super(proxy, context, false);
+        super(proxy, context, ResourceAccessType.READ);
+        accessService = proxy.getAccessService();
     }
 
     private String getContentType() {
@@ -33,9 +38,10 @@ protected Future<?> handle(ResourceDescription resource) {
         if (limit < 0 || limit > 1000) {
             return context.respond(HttpStatus.BAD_REQUEST, "Limit is out of allowed range: [0, 1000]");
         }
+        PermissionsFetcher permissionsFetcher = PermissionsFetcher.of(context, accessService);
         return proxy.getVertx().executeBlocking(() -> {
             try {
-                MetadataBase metadata = storage.listMetadata(resource, token, limit, recursive);
+                MetadataBase metadata = storage.listMetadata(resource, permissionsFetcher, token, limit, recursive);
                 if (metadata != null) {
                     proxy.getAccessService().filterForbidden(context, resource, metadata);
                     context.respond(HttpStatus.OK, getContentType(), metadata);

src/main/java/com/epam/aidial/core/controller/PublicationController.java

@@ -13,6 +13,7 @@
 import com.epam.aidial.core.security.EncryptionService;
 import com.epam.aidial.core.service.LockService;
 import com.epam.aidial.core.service.PermissionDeniedException;
+import com.epam.aidial.core.service.PermissionsFetcher;
 import com.epam.aidial.core.service.PublicationService;
 import com.epam.aidial.core.service.ResourceNotFoundException;
 import com.epam.aidial.core.service.RuleService;
@@ -161,7 +162,9 @@ public Future<?> listPublishedResources() {
                     ListPublishedResourcesRequest request = ProxyUtil.convertToObject(body, ListPublishedResourcesRequest.class);
                     String bucketLocation = BlobStorageUtil.buildInitiatorBucket(context);
                     String bucket = encryptService.encrypt(bucketLocation);
-                    return vertx.executeBlocking(() -> publicationService.listPublishedResources(request, bucket, bucketLocation), false);
+                    PermissionsFetcher permissionsFetcher = PermissionsFetcher.of(context, accessService);
+                    return vertx.executeBlocking(() -> publicationService.listPublishedResources(
+                            request, permissionsFetcher, bucket, bucketLocation), false);
                 })
                 .onSuccess(metadata -> context.respond(HttpStatus.OK, metadata))
                 .onFailure(error -> respondError("Can't list published resources", error));

src/main/java/com/epam/aidial/core/controller/ResourceController.java

@@ -5,11 +5,13 @@
 import com.epam.aidial.core.data.Conversation;
 import com.epam.aidial.core.data.MetadataBase;
 import com.epam.aidial.core.data.Prompt;
+import com.epam.aidial.core.data.ResourceAccessType;
 import com.epam.aidial.core.data.ResourceLink;
-import com.epam.aidial.core.data.ResourceLinkCollection;
 import com.epam.aidial.core.data.ResourceType;
+import com.epam.aidial.core.security.AccessService;
 import com.epam.aidial.core.service.InvitationService;
 import com.epam.aidial.core.service.LockService;
+import com.epam.aidial.core.service.PermissionsFetcher;
 import com.epam.aidial.core.service.ResourceService;
 import com.epam.aidial.core.service.ShareService;
 import com.epam.aidial.core.storage.ResourceDescription;
@@ -36,13 +38,19 @@ public class ResourceController extends AccessControlBaseController {
     private final LockService lockService;
     private final InvitationService invitationService;
     private final boolean metadata;
+    private final AccessService accessService;
 
     public ResourceController(Proxy proxy, ProxyContext context, boolean metadata) {
-        // PUT and DELETE require full access, GET - not
-        super(proxy, context, !HttpMethod.GET.equals(context.getRequest().method()));
+        // PUT and DELETE require write access, GET - read
+        super(
+                proxy,
+                context,
+                HttpMethod.GET.equals(context.getRequest().method())
+                        ? ResourceAccessType.READ : ResourceAccessType.WRITE);
         this.vertx = proxy.getVertx();
         this.service = proxy.getResourceService();
         this.shareService = proxy.getShareService();
+        this.accessService = proxy.getAccessService();
         this.lockService = proxy.getLockService();
         this.invitationService = proxy.getInvitationService();
         this.metadata = metadata;
@@ -88,7 +96,9 @@ private Future<?> getMetadata(ResourceDescription descriptor) {
             return context.respond(HttpStatus.BAD_REQUEST, "Bad query parameters. Limit must be in [0, 1000] range. Recursive must be true/false");
         }
 
-        return vertx.executeBlocking(() -> service.getMetadata(descriptor, token, limit, recursive), false)
+        PermissionsFetcher permissionsFetcher = PermissionsFetcher.of(context, accessService);
+        return vertx.executeBlocking(() -> service.getMetadata(
+                descriptor, permissionsFetcher, token, limit, recursive), false)
                 .onSuccess(result -> {
                     if (result == null) {
                         context.respond(HttpStatus.NOT_FOUND, "Not found: " + descriptor.getUrl());
@@ -194,8 +204,7 @@ private Future<?> deleteResource(ResourceDescription descriptor) {
                     String bucketLocation = descriptor.getBucketLocation();
                     return lockService.underBucketLock(bucketLocation, () -> {
                         invitationService.cleanUpResourceLinks(bucketName, bucketLocation, resourceLinks);
-                        shareService.revokeSharedAccess(bucketName, bucketLocation,
-                                new ResourceLinkCollection(resourceLinks));
+                        shareService.revokeSharedAccess(bucketName, bucketLocation, resourceLinks);
                         return service.deleteResource(descriptor);
                     });
                 }, false)

src/main/java/com/epam/aidial/core/controller/ShareController.java

@@ -5,6 +5,7 @@
 import com.epam.aidial.core.data.CopySharedAccessRequest;
 import com.epam.aidial.core.data.ListSharedResourcesRequest;
 import com.epam.aidial.core.data.ResourceLinkCollection;
+import com.epam.aidial.core.data.RevokeResourcesRequest;
 import com.epam.aidial.core.data.ShareResourcesRequest;
 import com.epam.aidial.core.security.EncryptionService;
 import com.epam.aidial.core.service.InvitationService;
@@ -35,8 +36,6 @@ public class ShareController {
     private final EncryptionService encryptionService;
     private final LockService lockService;
     private final InvitationService invitationService;
-    private final ResourceService resourceService;
-    private final BlobStorage storage;
 
     public ShareController(Proxy proxy, ProxyContext context) {
         this.proxy = proxy;
@@ -45,8 +44,6 @@ public ShareController(Proxy proxy, ProxyContext context) {
         this.encryptionService = proxy.getEncryptionService();
         this.lockService = proxy.getLockService();
         this.invitationService = proxy.getInvitationService();
-        this.resourceService = proxy.getResourceService();
-        this.storage = proxy.getStorage();
     }
 
     public Future<?> handle(Operation operation) {
@@ -133,13 +130,13 @@ public Future<?> revokeSharedResources() {
         return context.getRequest()
                 .body()
                 .compose(buffer -> {
-                    ResourceLinkCollection request = getResourceLinkCollection(buffer, Operation.REVOKE);
+                    RevokeResourcesRequest request = getRevokeResourcesRequest(buffer, Operation.REVOKE);
                     String bucketLocation = BlobStorageUtil.buildInitiatorBucket(context);
                     String bucket = encryptionService.encrypt(bucketLocation);
                     return proxy.getVertx()
                             .executeBlocking(() -> lockService.underBucketLock(bucketLocation, () -> {
                                 invitationService.cleanUpResourceLinks(bucket, bucketLocation, request.getResources());
-                                shareService.revokeSharedAccess(bucket, bucketLocation, request);
+                                shareService.revokeSharedAccess(bucket, bucketLocation, request.getResources());
                                 return null;
                             }), false);
                 })
@@ -210,8 +207,14 @@ private ResourceLinkCollection getResourceLinkCollection(Buffer buffer, Operatio
         }
     }
 
-    private boolean hasResource(ResourceDescription resource) {
-        return ResourceUtil.hasResource(resource, resourceService, storage);
+    private RevokeResourcesRequest getRevokeResourcesRequest(Buffer buffer, Operation operation) {
+        try {
+            String body = buffer.toString(StandardCharsets.UTF_8);
+            return ProxyUtil.convertToObject(body, RevokeResourcesRequest.class);
+        } catch (Exception e) {
+            log.error("Invalid request body provided", e);
+            throw new HttpException(HttpStatus.BAD_REQUEST, "Can't %s shared resources. Incorrect body".formatted(operation));
+        }
     }
 
     public enum Operation {

src/main/java/com/epam/aidial/core/controller/UploadFileController.java

@@ -2,6 +2,7 @@
 
 import com.epam.aidial.core.Proxy;
 import com.epam.aidial.core.ProxyContext;
+import com.epam.aidial.core.data.ResourceAccessType;
 import com.epam.aidial.core.storage.BlobWriteStream;
 import com.epam.aidial.core.storage.ResourceDescription;
 import com.epam.aidial.core.util.HttpStatus;
@@ -16,7 +17,7 @@
 public class UploadFileController extends AccessControlBaseController {
 
     public UploadFileController(Proxy proxy, ProxyContext context) {
-        super(proxy, context, true);
+        super(proxy, context, ResourceAccessType.WRITE);
     }
 
     @Override

src/main/java/com/epam/aidial/core/data/FileMetadata.java

@@ -5,21 +5,31 @@
 import lombok.NoArgsConstructor;
 import lombok.Setter;
 
+import java.util.Set;
+
 @Getter
 @Setter
 @NoArgsConstructor
 public class FileMetadata extends ResourceItemMetadata {
     long contentLength;
     String contentType;
 
-    public FileMetadata(String bucket, String name, String path, String url, long contentLength, String contentType) {
-        super(ResourceType.FILE, bucket, name, path, url);
+    public FileMetadata(
+            String bucket,
+            String name,
+            String path,
+            String url,
+            long contentLength,
+            String contentType,
+            Set<ResourceAccessType> permissions) {
+        super(ResourceType.FILE, bucket, name, path, url, permissions);
         this.contentLength = contentLength;
         this.contentType = contentType;
     }
 
-    public FileMetadata(ResourceDescription resource, long contentLength, String contentType) {
-        super(resource);
+    public FileMetadata(
+            ResourceDescription resource, long contentLength, String contentType, Set<ResourceAccessType> permissions) {
+        super(resource, permissions);
         this.contentLength = contentLength;
         this.contentType = contentType;
     }

src/main/java/com/epam/aidial/core/data/Invitation.java

@@ -11,7 +11,7 @@
 @NoArgsConstructor
 public class Invitation {
     String id;
-    Set<ResourceLink> resources;
+    Set<SharedResource> resources;
     long createdAt;
     long expireAt;
 }

src/main/java/com/epam/aidial/core/data/MetadataBase.java

@@ -1,9 +1,12 @@
 package com.epam.aidial.core.data;
 
+import com.fasterxml.jackson.annotation.JsonInclude;
 import lombok.AllArgsConstructor;
 import lombok.Data;
 import lombok.NoArgsConstructor;
 
+import java.util.Set;
+
 @AllArgsConstructor
 @Data
 @NoArgsConstructor
@@ -16,4 +19,6 @@ public abstract class MetadataBase {
     private String url;
     private NodeType nodeType;
     private ResourceType resourceType;
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    private Set<ResourceAccessType> permissions;
 }

src/main/java/com/epam/aidial/core/data/ResourceAccessType.java

@@ -0,0 +1,6 @@
+package com.epam.aidial.core.data;
+
+public enum ResourceAccessType {
+    READ,
+    WRITE
+}

src/main/java/com/epam/aidial/core/data/ResourceFolderMetadata.java

@@ -8,6 +8,7 @@
 import lombok.experimental.Accessors;
 
 import java.util.List;
+import java.util.Set;
 
 @Getter
 @Setter
@@ -19,21 +20,45 @@ public class ResourceFolderMetadata extends MetadataBase {
     @JsonInclude(JsonInclude.Include.NON_NULL)
     private String nextToken;
 
-    public ResourceFolderMetadata(ResourceType type, String bucket, String name, String path, String url, List<MetadataBase> items) {
-        super(name, path, bucket, url, NodeType.FOLDER, type);
+    public ResourceFolderMetadata(
+            ResourceType type,
+            String bucket,
+            String name,
+            String path,
+            String url,
+            Set<ResourceAccessType> permissions,
+            List<MetadataBase> items) {
+        super(name, path, bucket, url, NodeType.FOLDER, type, permissions);
         this.items = items;
     }
 
-    public ResourceFolderMetadata(ResourceType type, String bucket, String name, String path, String url) {
-        this(type, bucket, name, path, url, null);
+    public ResourceFolderMetadata(
+            ResourceType type,
+            String bucket,
+            String name,
+            String path,
+            String url,
+            Set<ResourceAccessType> permissions) {
+        this(type, bucket, name, path, url, permissions, null);
     }
 
-    public ResourceFolderMetadata(ResourceDescription resource) {
-        this(resource, null, null);
+    public ResourceFolderMetadata(ResourceDescription resource, Set<ResourceAccessType> permissions) {
+        this(resource, permissions, null, null);
     }
 
-    public ResourceFolderMetadata(ResourceDescription resource, List<MetadataBase> items, String nextToken) {
-        this(resource.getType(), resource.getBucketName(), resource.getName(), resource.getParentPath(), resource.getUrl(), items);
+    public ResourceFolderMetadata(
+            ResourceDescription resource,
+            Set<ResourceAccessType> permissions,
+            List<MetadataBase> items,
+            String nextToken) {
+        this(
+                resource.getType(),
+                resource.getBucketName(),
+                resource.getName(),
+                resource.getParentPath(),
+                resource.getUrl(),
+                permissions,
+                items);
         this.nextToken = nextToken;
     }
 }