auth: allow external accounts to login and restrict upload

Author: zubeydecivelek

cds/config.py

@@ -1168,7 +1168,9 @@ def _parse_env_bool(var_name, default=None):
     "https://auth.cern.ch/auth/realms/cern/protocol/openid-connect/userinfo",
 )
 
-OAUTHCLIENT_CERN_OPENID_ALLOWED_ROLES = ["cern-user"]
+OAUTHCLIENT_CERN_OPENID_ALLOWED_ROLES = ["cern-user", "user"]
+
+UPLOAD_ALLOWED_ROLES = ["cern-user"]
 
 OAUTHCLIENT_CERN_OPENID_REFRESH_TIMEDELTA = timedelta(minutes=-5)
 """Default interval for refreshing CERN extra data (e.g. groups).

cds/modules/deposit/views.py

@@ -25,6 +25,7 @@
 """CDS interface."""
 
 
+from cds.modules.ldap.decorators import cern_user_required
 from flask import (
     Blueprint,
     abort,
@@ -118,6 +119,7 @@ def to_links_js(pid, deposit=None, dep_type=None):
 
 @blueprint.route("/deposit/reportnumbers/new", methods=["GET", "POST"])
 @login_required
+@cern_user_required()
 def reserve_report_number():
     """Form to reserver a new report number."""
     if not has_read_record_eos_path_permission(current_user, None):
@@ -156,6 +158,7 @@ def reserve_report_number():
     "/deposit/reportnumbers/assign/<string:depid>", methods=["GET", "POST"]
 )
 @login_required
+@cern_user_required()
 def assign_report_number(depid):
     """Form to reserver a new report number."""
     if not has_read_record_eos_path_permission(current_user, None):

cds/modules/invenio_deposit/utils.py

@@ -28,6 +28,7 @@
 from flask import request
 from invenio_oauth2server import require_api_auth, require_oauth_scopes
 
+from cds.modules.ldap.decorators import cern_user_required
 from .scopes import write_scope
 
 
@@ -84,6 +85,7 @@ def check_oauth2_scope(can_method, *myscopes):
 
     def check(record, *args, **kwargs):
         @require_api_auth()
+        @cern_user_required()
         @require_oauth_scopes(*myscopes)
         def can(self):
             return can_method(record)

cds/modules/invenio_deposit/views/ui.py

@@ -27,6 +27,7 @@
 
 from copy import deepcopy
 
+from cds.modules.ldap.decorators import cern_user_required
 from flask import Blueprint, current_app, render_template, request
 from flask_login import login_required
 from invenio_pidstore.errors import PIDDeletedError
@@ -73,12 +74,14 @@ def tombstone_errorhandler(error):
 
     @blueprint.route("/deposit")
     @login_required
+    @cern_user_required()
     def index():
         """List user deposits."""
         return render_template(current_app.config["DEPOSIT_UI_INDEX_TEMPLATE"])
 
     @blueprint.route("/deposit/new")
     @login_required
+    @cern_user_required()
     def new():
         """Create new deposit."""
         deposit_type = request.values.get("type")

cds/modules/ldap/decorators.py

@@ -22,7 +22,7 @@
 from functools import wraps
 
 from flask_login import current_user
-from flask_restful import abort
+from flask import abort, current_app
 
 
 def needs_authentication(func):
@@ -33,3 +33,31 @@ def decorated_api_view(*args, **kwargs):
             abort(401)
         return func(*args, **kwargs)
     return decorated_api_view
+
+
+def cern_user_required():
+    """Restrict access based on roles from RemoteAccount.extra_data["roles"]."""
+    def decorator(f):
+        @wraps(f)
+        def decorated_function(*args, **kwargs):
+            if not current_user.is_authenticated:
+                abort(401)  # Unauthorized (not logged in)
+
+            allowed_roles = current_app.config.get("UPLOAD_ALLOWED_ROLES", [])
+
+            # Collect roles from all RemoteAccounts
+            remote_account_roles = []
+            for ra in getattr(current_user, "remote_accounts", []):
+                if not ra.extra_data:
+                    continue
+                roles = ra.extra_data.get("roles", [])
+                if isinstance(roles, list):
+                    remote_account_roles.extend(roles)
+
+            # If user has at least one allowed role → grant access
+            if not any(role in allowed_roles for role in remote_account_roles):
+                abort(403)  # Forbidden
+
+            return f(*args, **kwargs)
+        return decorated_function
+    return decorator

cds/modules/oauthclient/cern_openid.py

@@ -85,8 +85,10 @@ def find_remote_by_client_id(client_id):
 
 def fetch_extra_data(resource):
     """Return a dict with extra data retrieved from CERN OAuth."""
-    person_id = resource.get("cern_person_id")
-    return dict(person_id=person_id, groups=resource["groups"])
+    data = {"groups": resource.get("groups", [])}
+    if resource.get("cern_person_id"):
+        data["person_id"] = resource["cern_person_id"]
+    return data
 
 
 def account_roles_and_extra_data(account, resource, refresh_timedelta=None):
@@ -178,10 +180,19 @@ def _account_info(remote, resp):
             resp,
         )
 
-    email = resource["email"]
-    external_id = str(resource["cern_uid"])
-    nice = resource["preferred_username"]
-    name = resource["name"]
+    email = resource.get("email")
+    if not email:
+        raise OAuthCERNRejectedAccountError("No email in userinfo", remote, resp)
+
+    external_id = str(resource.get("cern_uid") or resource.get("sub"))
+    if not external_id:
+        raise OAuthCERNRejectedAccountError("No external_id in userinfo", remote, resp)
+
+    raw_username = resource.get("preferred_username") or email
+    if "@" in raw_username:
+        raw_username = raw_username.split("@")[0]
+    nice = raw_username
+    name = resource.get("name") or nice
 
     return dict(
         user=dict(email=email.lower(), profile=dict(username=nice, full_name=name)),
@@ -231,7 +242,7 @@ def account_setup(remote, token, resp):
     resource = get_resource(remote, resp)
 
     with db.session.begin_nested():
-        external_id = resource.get("cern_uid")
+        external_id = resource.get("cern_uid") or resource.get("sub")
 
         # Set CERN person ID in extra_data.
         token.remote_account.extra_data = {"external_id": external_id}