api: create new endpoint for access/users

invenio_rdm_records/ext.py

@@ -26,6 +26,8 @@
     RDMCommunityRecordsResource,
     RDMCommunityRecordsResourceConfig,
     RDMDraftFilesResourceConfig,
+    RDMGrantsAccessResource,
+    RDMGrantUserAccessResourceConfig,
     RDMParentGrantsResource,
     RDMParentGrantsResourceConfig,
     RDMParentRecordLinksResource,
@@ -223,6 +225,11 @@ def init_resource(self, app):
             config=RDMParentGrantsResourceConfig.build(app),
         )
 
+        self.grant_user_access_resource = RDMGrantsAccessResource(
+            service=self.records_service,
+            config=RDMGrantUserAccessResourceConfig.build(app),
+        )
+
         # Record's communities
         self.record_communities_resource = RDMRecordCommunitiesResource(
             service=self.record_communities_service,

invenio_rdm_records/resources/__init__.py

@@ -12,6 +12,7 @@
     IIIFResourceConfig,
     RDMCommunityRecordsResourceConfig,
     RDMDraftFilesResourceConfig,
+    RDMGrantUserAccessResourceConfig,
     RDMParentGrantsResourceConfig,
     RDMParentRecordLinksResourceConfig,
     RDMRecordCommunitiesResourceConfig,
@@ -22,6 +23,7 @@
 from .resources import (
     IIIFResource,
     RDMCommunityRecordsResource,
+    RDMGrantsAccessResource,
     RDMParentGrantsResource,
     RDMParentRecordLinksResource,
     RDMRecordRequestsResource,
@@ -35,7 +37,9 @@
     "RDMCommunityRecordsResourceConfig",
     "RDMDraftFilesResourceConfig",
     "RDMParentGrantsResource",
+    "RDMGrantsAccessResource",
     "RDMParentGrantsResourceConfig",
+    "RDMGrantUserAccessResourceConfig",
     "RDMParentRecordLinksResource",
     "RDMParentRecordLinksResourceConfig",
     "RDMRecordCommunitiesResourceConfig",

invenio_rdm_records/resources/config.py

@@ -9,6 +9,7 @@
 # it under the terms of the MIT License; see LICENSE file for more details.
 
 """Resources configuration."""
+from copy import deepcopy
 
 import marshmallow as ma
 from citeproc_styles import StyleNotFoundError
@@ -34,6 +35,7 @@
 
 from ..services.errors import (
     AccessRequestExistsError,
+    GrantExistsError,
     InvalidAccessRestrictions,
     RecordDeletedException,
     ReviewExistsError,
@@ -339,29 +341,35 @@ class RDMDraftMediaFilesResourceConfig(FileResourceConfig, ConfiguratorMixin):
 #
 # Parent Record Links
 #
-record_links_error_handlers = RecordResourceConfig.error_handlers.copy()
-
-
-record_links_error_handlers.update(
-    {
-        LookupError: create_error_handler(
-            HTTPJSONException(
-                code=404,
-                description="No secret link found with the given ID.",
-            )
-        ),
-    }
-)
-
-grants_error_handlers = RecordResourceConfig.error_handlers.copy()
+record_links_error_handlers = {
+    **deepcopy(RecordResourceConfig.error_handlers),
+    LookupError: create_error_handler(
+        HTTPJSONException(
+            code=404,
+            description="No secret link found with the given ID.",
+        )
+    ),
+}
 
-grants_error_handlers.update(
-    {
-        LookupError: create_error_handler(
-            HTTPJSONException(code=404, description="No grant found with the given ID.")
+grants_error_handlers = {
+    **deepcopy(RecordResourceConfig.error_handlers),
+    LookupError: create_error_handler(
+        HTTPJSONException(code=404, description="No grant found with the given ID.")
+    ),
+    GrantExistsError: create_error_handler(
+        lambda e: HTTPJSONException(
+            code=400,
+            description=e.description,
         )
-    }
-)
+    ),
+}
+
+user_access_error_handlers = {
+    **deepcopy(RecordResourceConfig.error_handlers),
+    LookupError: create_error_handler(
+        HTTPJSONException(code=404, description="No grant found by given user id.")
+    ),
+}
 
 
 #
@@ -401,8 +409,8 @@ class RDMParentGrantsResourceConfig(RecordResourceConfig, ConfiguratorMixin):
     url_prefix = "/records/<pid_value>/access"
 
     routes = {
-        "list": "/users",
-        "item": "/users/<grant_id>",
+        "list": "/grants",
+        "item": "/grants/<grant_id>",
     }
 
     links_config = {}
@@ -423,6 +431,37 @@ class RDMParentGrantsResourceConfig(RecordResourceConfig, ConfiguratorMixin):
     error_handlers = grants_error_handlers
 
 
+class RDMGrantUserAccessResourceConfig(RecordResourceConfig, ConfiguratorMixin):
+    """Record grants user access resource configuration."""
+
+    blueprint_name = "record_user_access"
+
+    url_prefix = "/records/<pid_value>/access"
+
+    routes = {
+        "item": "/users/<subject_id>",
+        "list": "/users",
+    }
+
+    links_config = {}
+
+    request_view_args = {
+        "pid_value": ma.fields.Str(),
+        "subject_id": ma.fields.Str(),  # user id
+    }
+
+    grant_subject_type = "user"
+
+    response_handlers = {
+        "application/vnd.inveniordm.v1+json": RecordResourceConfig.response_handlers[
+            "application/json"
+        ],
+        **deepcopy(RecordResourceConfig.response_handlers),
+    }
+
+    error_handlers = user_access_error_handlers
+
+
 #
 # Community's records
 #

invenio_rdm_records/resources/resources.py

@@ -658,6 +658,80 @@ def search(self):
         return items.to_dict(), 200
 
 
+class RDMGrantsAccessResource(RecordResource):
+    """Users and groups grant access resource."""
+
+    def create_url_rules(self):
+        """Create the URL rules for the record resource."""
+
+        def p(route_name):
+            """Prefix a route with the URL prefix."""
+            return f"{self.config.url_prefix}{self.config.routes[route_name]}"
+
+        return [
+            route("GET", p("item"), self.read),
+            route("DELETE", p("item"), self.delete),
+            route("GET", p("list"), self.search),
+            route("PATCH", p("item"), self.partial_update),
+        ]
+
+    @request_extra_args
+    @request_view_args
+    @response_handler()
+    def read(self):
+        """Read an access grant for a record by subject."""
+        item = self.service.access.read_grant_by_subject(
+            identity=g.identity,
+            id_=resource_requestctx.view_args["pid_value"],
+            subject_id=resource_requestctx.view_args["subject_id"],
+            subject_type=self.config.grant_subject_type,
+            expand=resource_requestctx.args.get("expand", False),
+        )
+
+        return item.to_dict(), 200
+
+    @request_view_args
+    def delete(self):
+        """Delete an access grant for a record by subject."""
+        self.service.access.delete_grant_by_subject(
+            identity=g.identity,
+            id_=resource_requestctx.view_args["pid_value"],
+            subject_id=resource_requestctx.view_args["subject_id"],
+            subject_type=self.config.grant_subject_type,
+        )
+        return "", 204
+
+    @request_extra_args
+    @request_search_args
+    @request_view_args
+    @response_handler(many=True)
+    def search(self):
+        """List access grants for a record by subject type."""
+        items = self.service.access.read_all_grants_by_subject(
+            identity=g.identity,
+            id_=resource_requestctx.view_args["pid_value"],
+            subject_type=self.config.grant_subject_type,
+            expand=resource_requestctx.args.get("expand", False),
+        )
+        return items.to_dict(), 200
+
+    @request_extra_args
+    @request_view_args
+    @request_data
+    @response_handler()
+    def partial_update(self):
+        """Patch access grant for a record by subject."""
+        item = self.service.access.update_grant_by_subject(
+            identity=g.identity,
+            id_=resource_requestctx.view_args["pid_value"],
+            subject_id=resource_requestctx.view_args["subject_id"],
+            subject_type=self.config.grant_subject_type,
+            data=resource_requestctx.data,
+            expand=resource_requestctx.args.get("expand", False),
+        )
+        return item.to_dict(), 200
+
+
 #
 # Community's records
 #