Support passing force_readonly_datasets to config generator to force …

…generating read-only dataset permissions

src/config_generator/config_generator.py

@@ -126,12 +126,13 @@ class ConfigGenerator():
     from a tenantConfig.json and QWC ConfigDB.
     """
 
-    def __init__(self, config, logger, config_file_dir, use_cached_project_metadata):
+    def __init__(self, config, logger, config_file_dir, use_cached_project_metadata, force_readonly_datasets):
         """Constructor
 
         :param obj config: ConfigGenerator config
         :param Logger logger: Logger
         :param bool use_cached_project_metadata: Whether to use cached project metadata if available
+        :param bool force_readonly_datasets: Whether to force all datasets readonly
         :param str cache_dir: Project metadata cache directory
         """
         self.logger = Logger(logger)
@@ -336,7 +337,7 @@ def __init__(self, config, logger, config_file_dir, use_cached_project_metadata)
             'data': DataServiceConfig(
                 generator_config, self.theme_reader, self.config_models,
                 self.schema_urls.get('data'), self.service_config('data'),
-                self.logger
+                self.logger, force_readonly_datasets
             ),
             'ext': ExtServiceConfig(
                 self.config_models, self.schema_urls.get('ext'),

src/config_generator/data_service_config.py

@@ -13,7 +13,8 @@ class DataServiceConfig(ServiceConfig):
     """
 
     def __init__(self, generator_config, themes_reader,
-                 config_models, schema_url, service_config, logger):
+                 config_models, schema_url, service_config, logger,
+                 force_readonly_datasets):
         """Constructor
 
         :param obj generator_config: ConfigGenerator config
@@ -22,6 +23,7 @@ def __init__(self, generator_config, themes_reader,
         :param str schema_url: JSON schema URL for service config
         :param obj service_config: Additional service config
         :param Logger logger: Logger
+        :param bool force_readonly_datasets: Whether to force read-only datasets
         """
         super().__init__('data', schema_url, service_config, logger)
 
@@ -30,6 +32,7 @@ def __init__(self, generator_config, themes_reader,
 
         self.generator_config = generator_config
         self.themes_reader = themes_reader
+        self.force_readonly_datasets = force_readonly_datasets
 
     def config(self):
         """Return service config.
@@ -284,7 +287,7 @@ def _dataset_permissions(self, role, session):
             dataset = permission.resource.name
             if dataset not in examined_datasets[map_name]:
                 # check permission with highest priority
-                if permission.write:
+                if permission.write and not self.force_readonly_datasets:
                     # mark as writable
                     role_writeable_datasets[map_name].add(dataset)
                 examined_datasets[map_name].add(dataset)

src/server.py

@@ -15,7 +15,7 @@
 ).rstrip('/') + '/'
 
 
-def config_generator(tenant, use_cached_project_metadata):
+def config_generator(tenant, use_cached_project_metadata, force_readonly_datasets=False):
     """Create a ConfigGenerator instance.
 
     :param str tenant: Tenant ID
@@ -40,7 +40,7 @@ def config_generator(tenant, use_cached_project_metadata):
         raise Exception(msg)
 
     # create ConfigGenerator
-    return ConfigGenerator(config, app.logger, config_file_dir, use_cached_project_metadata)
+    return ConfigGenerator(config, app.logger, config_file_dir, use_cached_project_metadata, force_readonly_datasets)
 
 
 # routes
@@ -52,7 +52,8 @@ def generate_configs():
         # create ConfigGenerator
         tenant = request.args.get("tenant")
         use_cached_project_metadata = str(request.args.get("use_cached_project_metadata", "")).lower() in ["1","true"]
-        generator = config_generator(tenant, use_cached_project_metadata)
+        force_readonly_datasets = str(request.args.get("force_readonly_datasets", "")).lower() in ["1","true"]
+        generator = config_generator(tenant, use_cached_project_metadata, force_readonly_datasets)
         generator.write_configs()
         generator.write_permissions()
         generator.cleanup_temp_dir()