Remove image perms on job deletion

Author: jmsmkn

app/grandchallenge/algorithms/signals.py

@@ -1,4 +1,4 @@
-from django.db.models.signals import m2m_changed
+from django.db.models.signals import m2m_changed, pre_delete
 from django.dispatch import receiver
 from guardian.shortcuts import assign_perm, remove_perm
 
@@ -59,6 +59,17 @@ def update_input_image_permissions(
     )
 
 
+def _get_image_civs(*, jobs):
+    queryset = ComponentInterfaceValue.objects.filter(
+        image__isnull=False
+    ).select_related("image")
+
+    input_civs = queryset.filter(algorithms_jobs_as_input__in=jobs)
+    output_civs = queryset.filter(algorithms_jobs_as_output__in=jobs)
+
+    return {*input_civs, *output_civs}
+
+
 def _update_image_permissions(
     *, jobs, component_interface_values, exclude_jobs: bool
 ):
@@ -96,17 +107,23 @@ def update_group_permissions(
         for group in groups:
             operation("view_job", group, job)
 
-    queryset = ComponentInterfaceValue.objects.filter(
-        image__isnull=False
-    ).select_related("image")
+    component_interface_values = _get_image_civs(jobs=jobs)
+
+    _update_image_permissions(
+        jobs=jobs,
+        component_interface_values=component_interface_values,
+        exclude_jobs=action == "pre_clear",
+    )
 
-    input_civs = queryset.filter(algorithms_jobs_as_input__in=jobs)
-    output_civs = queryset.filter(algorithms_jobs_as_output__in=jobs)
 
-    component_interface_values = {*input_civs, *output_civs}
+@receiver(pre_delete, sender=Job)
+def update_permissions_on_job_deletion(*_, instance: Job, signal, **__):
+    jobs = [instance]
+
+    component_interface_values = _get_image_civs(jobs=jobs)
 
     _update_image_permissions(
         jobs=jobs,
         component_interface_values=component_interface_values,
-        exclude_jobs=action == "pre_clear",
+        exclude_jobs=signal == pre_delete,
     )

app/tests/algorithms_tests/test_signals.py

@@ -1,9 +1,11 @@
 import pytest
+from django.contrib.auth.models import Group
 from guardian.shortcuts import get_perms
 
 from tests.algorithms_tests.factories import AlgorithmJobFactory
 from tests.algorithms_tests.utils import TwoAlgorithms
 from tests.components_tests.factories import ComponentInterfaceValueFactory
+from tests.evaluation_tests.test_permissions import get_groups_with_set_perms
 from tests.factories import GroupFactory, ImageFactory, UserFactory
 from tests.utils import get_view_for_user
 
@@ -287,3 +289,24 @@ def test_group_clearing(self, reverse):
             assert "view_job" not in get_perms(group, job)
             assert "view_image" not in get_perms(group, civ_in.image)
             assert "view_image" not in get_perms(group, civ_out.image)
+
+
+@pytest.mark.django_db
+def test_permissions_removed_on_job_deletion(settings):
+    job = AlgorithmJobFactory(time_limit=60, public=True)
+    image = ImageFactory()
+
+    job.inputs.add(ComponentInterfaceValueFactory(image=image))
+
+    reg_and_anon = Group.objects.get(
+        name=settings.REGISTERED_AND_ANON_USERS_GROUP_NAME
+    )
+
+    assert get_groups_with_set_perms(image) == {
+        reg_and_anon: {"view_image"},
+        job.viewers: {"view_image"},
+    }
+
+    job.delete()
+
+    assert get_groups_with_set_perms(image) == {}