CDD-3173: add the base code for the DB permission filtering of privat…

common/auth/cognito_jwt/backend.py

@@ -37,7 +37,11 @@ class JSONWebTokenAuthentication(BaseAuthentication):
     """
 
     def authenticate(self, request):
-        """Entrypoint for Django Rest Framework"""
+        """
+        The JWT token has arrived at an API endpoint and the journey starts here.
+        Entrypoint for the Django Rest Framework.
+        """
+
         jwt_token = self.get_jwt_token(request)
         if jwt_token is None:
             return None
@@ -46,7 +50,8 @@ def authenticate(self, request):
         try:
             token_validator = self.get_token_validator(request)
             jwt_payload = token_validator.validate(jwt_token)
-        except TokenError:
+        except TokenError as error:
+            logger.warning("JWT validation failed: %s", error)
             raise exceptions.AuthenticationFailed from None
 
         custom_user_manager = self.get_custom_user_manager()

common/auth/cognito_jwt/user_manager.py

@@ -1,8 +1,14 @@
 import logging
+from typing import TYPE_CHECKING
 
 from django.contrib.auth import get_user_model
 from django.contrib.auth.models import BaseUserManager
 
+from metrics.utils.permission_hierarchy import convert_permission_set_into_hierarchy
+
+if TYPE_CHECKING:  # just for IDE checks
+    from rest_framework.request import Request
+
 logger = logging.getLogger(__name__)
 
 
@@ -14,9 +20,23 @@ def get_or_create_for_cognito(jwt_payload):
         We don't need to store or retrieve any info, we use what's in the JWT,
         so this speeds up the request by removing the need for any DB access
         """
+
         try:
             username = jwt_payload["entraObjectId"]
-            permission_sets = jwt_payload["permissionSets"]
+            raw_permission_sets = jwt_payload["permissionSets"]
+
+            # Manual testing (just for now)
+            # username = "678a605b-16f3-4342-9f02-db74613701ac"
+            # raw_permission_sets = {
+            #     "permission_sets": [
+            #         {
+            #             "theme": {"id": "100", "name": "immunisation"},
+            #             "sub_theme": {"id": "200", "name": "childhood-vaccines"},
+            #             "topic": {"id": "-1", "name": "* (All)"},
+            #         }
+            #     ],
+            #     "summary": {"has_global_access": False},
+            # }
         except KeyError:
             logger.debug(
                 "Error getting entraObjectId and/or permissionSets field(s)"
@@ -25,7 +45,50 @@ def get_or_create_for_cognito(jwt_payload):
             )
             return None
 
+        permission_sets = convert_permission_set_into_hierarchy(raw_permission_sets)
+        permission_count = len(permission_sets.get("permission_set_hierarchy", []))
+        has_global_access = bool(permission_sets.get("has_global_access", False))
+
+        logger.info(
+            "JWT token for user '%s' with permissions: permission_count=%d, has_global_access=%s",
+            username, permission_count, has_global_access,
+        )
+
         user_class = get_user_model()
         user = user_class(username=username)
         user.permission_sets = permission_sets
+
         return user
+
+
+def extract_jwt_permissions(*, request: "Request | None") -> dict:
+    """
+    Extract the normalized JWT permissions dict from an authenticated request.
+
+    Reads `request.user.permission_sets`, which is set by CognitoManager
+    during JWT authentication. Lives here because it is the counterpart to
+    the code above that "writes" user.permission_sets.
+
+    @param {Request | None} request, eg:
+        <rest_framework.request.Request: POST '/api/charts/v3'>
+
+    @return {dict}, eg:
+        {
+            "permission_set_hierarchy": [
+                {"theme": {"id": "100", "name": "immunisation"}, ...}
+            ],
+            "has_global_access": False
+        }
+    """
+    if request is None:
+        return {}
+
+    user = getattr(request, "user", None)
+    if user is None:
+        return {}
+
+    permission_sets = getattr(user, "permission_sets", {})
+    if not permission_sets:
+        return {}
+
+    return permission_sets

metrics/api/views/charts/single_category_charts.py

@@ -4,11 +4,13 @@
 from django.http import FileResponse
 from drf_spectacular.utils import OpenApiExample, extend_schema
 from rest_framework import permissions
+from rest_framework.authentication import SessionAuthentication
 from rest_framework.response import Response
 from rest_framework.views import APIView
 
 import config
 from caching.private_api.decorators import cache_response
+from common.auth.cognito_jwt import JSONWebTokenAuthentication
 from metrics.api.decorators.auth import require_authorisation
 from metrics.api.enums import AppMode
 from metrics.api.serializers import ChartsSerializer
@@ -218,6 +220,7 @@ def post(cls, request, *args, **kwargs):
 
 
 class EncodedChartsView(APIView):
+    authentication_classes = [SessionAuthentication, JSONWebTokenAuthentication]
     permission_classes = []
 
     @classmethod

metrics/data/managers/core_models/headline.py

@@ -15,6 +15,9 @@
 from metrics.api.permissions.fluent_permissions import (
     validate_permissions_for_non_public,
 )
+from metrics.utils.permissions import (
+    check_any_permissions_allow_access,
+)
 
 
 class CoreHeadlineQuerySet(models.QuerySet):
@@ -320,21 +323,22 @@
         return CoreHeadlineQuerySet(model=self.model, using=self.db)
 
     def query_for_data(
         self,
         *,
         topic: str,
         metric: str,
         fields_to_export: list[str],
         geography: str = "England",
         geography_type: str = "Nation",
         geography_code: str = "",
         stratum: str = "",
         sex: str = "",
         age: str = "",
         theme: str = "",
         sub_theme: str = "",
         rbac_permissions: Iterable["RBACPermission"] | None = None,
+        jwt_permissions: dict | None = None,
         **kwargs,
     ):
         """Filters for a N-item list of dicts by the given params if `fields_to_export` is used.
 
@@ -373,6 +377,10 @@
             rbac_permissions: The RBAC permissions available
                 to the given request. This dictates whether the given
                 request is permitted access to non-public data or not.
+                The new JWT-based authorization below takes precedence
+                over RBAC permissions, which is not in use anymore.
+            jwt_permissions: The JWT permissions extracted from the Cognito token.
+                Contains 'permission_set_hierarchy' (list) and 'has_global_access' (bool).
 
         Returns:
            Queryset of (x_axis, y_axis) where x_axis represents the variable on the x_axis
@@ -382,16 +390,38 @@
            Examples:
                <CoreHeadlineQuerySet [{'age__name': '01-04', 'metric_value': Decimal('534.0000')}]>
         """
+
         rbac_permissions = rbac_permissions or []
-        has_access_to_non_public_data: bool = validate_permissions_for_non_public(
-            theme=theme,
-            sub_theme=sub_theme,
-            topic=topic,
-            metric=metric,
-            geography=geography,
-            geography_type=geography_type,
-            rbac_permissions=rbac_permissions,
-        )
+
+        has_access_to_non_public_data: bool
+
+        if jwt_permissions:
+            # Check JWT permissions first (new authorization takes precedence)
+            has_global_access = jwt_permissions.get("has_global_access", False)
+
+            if has_global_access:
+                has_access_to_non_public_data = True
+            else:
+                has_access_to_non_public_data = check_any_permissions_allow_access(
+                    jwt_permissions=jwt_permissions,
+                    theme=theme,
+                    sub_theme=sub_theme,
+                    topic=topic,
+                    metric=metric,
+                    geography_type=geography_type,
+                    geography=geography,
+                )
+        else:
+            # Legacy RBAC permissions (not in use) (to be removed in a future release)
+            has_access_to_non_public_data = validate_permissions_for_non_public(
+                theme=theme,
+                sub_theme=sub_theme,
+                topic=topic,
+                metric=metric,
+                geography=geography,
+                geography_type=geography_type,
+                rbac_permissions=rbac_permissions,
+            )
 
         if has_access_to_non_public_data:
             queryset = self.get_queryset().get_all_headlines_released_from_embargo(

metrics/data/managers/core_models/time_series.py

@@ -18,6 +18,9 @@
     validate_permissions_for_non_public,
 )
 from metrics.data.models import RBACPermission
+from metrics.utils.permissions import (
+    check_any_permissions_allow_access,
+)
 
 ALLOWABLE_METRIC_VALUE_RANGE_TYPE = tuple[str | float | int, str | float | int]
 
@@ -533,6 +536,7 @@ def query_for_data(
         sub_theme: str = "",
         metric_value_ranges: list[str | float | int] | None = None,
         rbac_permissions: Iterable[RBACPermission] | None = None,
+        jwt_permissions: dict | None = None,
     ) -> CoreTimeSeriesQuerySet:
         """Filters for a 2-item object by the given params. Slices all values older than the `date_from`.
 
@@ -579,11 +583,14 @@ def query_for_data(
                 i.e. to filter for all record with values
                 between 0 -> 80 AND 90 -> 100,
                 this can be provided as `[(0, 80), (90, 100)]`.
-            rbac_permissions: The RBAC permissions available
-                to the given request. This dictates whether the given
-                request is permitted access to non-public data or not.
-
-        Notes:
+             rbac_permissions: The RBAC permissions available
+                 to the given request. This dictates whether the given
+                 request is permitted access to non-public data or not.
+             jwt_permissions: JWT permissions dict extracted from Cognito token.
+                 Contains 'has_global_access' (bool) and 'permission_set_hierarchy' (list).
+                 Used for new JWT-based authorization (takes precedence over RBAC permissions).
+
+         Notes:
             If we have the following input `queryset`:
                 ----------------------------------------
                 | 2023-01-01 | 2023-01-02 | 2023-01-03 |
@@ -611,16 +618,38 @@ def query_for_data(
                     ]>`
 
         """
+
         rbac_permissions: Iterable[RBACPermission] = rbac_permissions or []
-        has_access_to_non_public_data: bool = validate_permissions_for_non_public(
-            theme=theme,
-            sub_theme=sub_theme,
-            topic=topic,
-            metric=metric,
-            geography_type=geography_type,
-            geography=geography,
-            rbac_permissions=rbac_permissions,
-        )
+
+        has_access_to_non_public_data: bool
+
+        if jwt_permissions:
+            # Check JWT permissions first (new authorization takes precedence)
+            has_global_access = jwt_permissions.get("has_global_access", False)
+
+            if has_global_access:
+                has_access_to_non_public_data = True
+            else:
+                has_access_to_non_public_data = check_any_permissions_allow_access(
+                    jwt_permissions=jwt_permissions,
+                    theme=theme,
+                    sub_theme=sub_theme,
+                    topic=topic,
+                    metric=metric,
+                    geography_type=geography_type,
+                    geography=geography,
+                )
+        else:
+            # Legacy RBAC permissions (not in use) (to be removed in a future release)
+            has_access_to_non_public_data = validate_permissions_for_non_public(
+                theme=theme,
+                sub_theme=sub_theme,
+                topic=topic,
+                metric=metric,
+                geography_type=geography_type,
+                geography=geography,
+                rbac_permissions=rbac_permissions,
+            )
 
         return self.get_queryset().query_for_data(
             fields_to_export=fields_to_export,

metrics/interfaces/plots/access.py

@@ -7,6 +7,7 @@
 from django.db.models import Manager, QuerySet
 from pydantic import BaseModel
 
+from common.auth.cognito_jwt.user_manager import extract_jwt_permissions
 from metrics.api.settings import auth
 from metrics.data.models.core_models import CoreTimeSeries, Topic
 from metrics.domain.common.utils import ChartAxisFields
@@ -162,7 +163,9 @@ def get_queryset_from_core_model_manager(
             plot_params["fields_to_export"].append("lower_confidence")
 
         return self.core_model_manager.query_for_data(
-            **plot_params, rbac_permissions=self.chart_request_params.rbac_permissions
+            **plot_params,
+            rbac_permissions=self.chart_request_params.rbac_permissions,  # legacy permissions to be removed
+            jwt_permissions=extract_jwt_permissions(request=self.chart_request_params.request),  # new permissions
         )
 
     def build_plot_data_from_parameters_with_complete_queryset(

metrics/utils/permission_hierarchy.py

@@ -21,6 +21,54 @@
 )
 
 
+def convert_permission_set_into_hierarchy(raw_permission_sets: dict) -> dict:
+    """
+    Convert a "permission_set" back into a "permission_set_hierarchy" again
+    (the NormalizedPermission class does it the other way round)
+
+    @param {dict} raw_permission_sets, eg:
+        {
+            "permission_sets": [
+                {
+                    "theme": {"id": "100", "name": "immunisation"},
+                    "sub_theme": {"id": "200", "name": "childhood-vaccines"},
+                    "topic": {"id": "215", "name": "MMR1"},
+                }
+            ],
+            "summary": {
+                "has_global_access": False
+            },
+        }
+
+    @return {dict}, eg:
+        {
+            "permission_set_hierarchy": [
+                {
+                    "theme": {"id": "100", "name": "immunisation"},
+                    "sub_theme": {"id": "200", "name": "childhood-vaccines"},
+                    "topic": {"id": "215", "name": "MMR1"},
+                }
+            ],
+            "has_global_access": False,
+        }
+    """
+
+    permission_set_hierarchy = raw_permission_sets.get("permission_set_hierarchy")
+    if permission_set_hierarchy is None:
+        permission_set_hierarchy = raw_permission_sets.get("permission_sets", [])
+
+    has_global_access = raw_permission_sets.get("has_global_access")
+    if has_global_access is None:
+        has_global_access = raw_permission_sets.get("summary", {}).get(
+            "has_global_access", False
+        )
+
+    return {
+        "permission_set_hierarchy": permission_set_hierarchy,
+        "has_global_access": bool(has_global_access),
+    }
+
+
 @dataclass
 class NormalizedPermission:
     """