feat: public authorization

docs/migrating_to_19.md

@@ -1,3 +1,47 @@
 # Migrating to Bento v19
 
-TODO
+## Bento public authorization
+
+Starting with v19, Bento can be configured to only show the data catalogue to authorized users.
+
+Follow the steps in this section to make the data catalogue of an instance private.
+
+First turn on the feature flag in your `local.env`:
+
+```bash
+# local.env
+BENTO_KATSU_PROJECTS_LIST_AUTHZ=true
+```
+
+Then, you must create authorization grants that give the `view:project` permission to the users.
+This can be done in the "access management" section of the private portal, or directly in the `authz` service using 
+its CLI:
+
+```bash
+# In bento dir
+./bentoctl.bash shell authz
+
+# In authz shell
+# Create grant for users
+bento_authz create grant \
+  '{"iss": "<ISSUER_HERE>", "sub": <USER_UUID_HERE>}' \
+  '{"everything": true}' \
+  'view:project'
+```
+
+Keep in mind that the `view:project` permission needs to be given to the users of the private portal as well, since 
+Katsu performs the authorization checks for all its clients.
+Otherwise, private portal users will not be able to use the data manager.
+
+If a user only has the `view:project` permission, they will be able to see the data catalogue, but they need additional 
+read permissions to use the search and beacon sections:
+
+```bash
+# In authz shell
+bento_authz create grant \
+  '{"iss": "<ISSUER_HERE>", "sub": <USER_UUID_HERE>}' \
+  '{"everything": true}' \
+  'query:project_level_boolean' 'query:project_level_counts' 'query:data'
+```
+
+For users that will only interact with bento-public, the permissions can be bundled in a single grant.

etc/bento.env

@@ -80,7 +80,7 @@ BENTO_AUTH_DB_NETWORK="${BENTOV2_PREFIX}-auth-db-net"
 
 # - Authz service
 BENTO_AUTHZ_IMAGE=ghcr.io/bento-platform/bento_authorization_service
-BENTO_AUTHZ_VERSION=0.10.3
+BENTO_AUTHZ_VERSION=pr-60
 BENTO_AUTHZ_VERSION_DEV=${BENTO_AUTHZ_VERSION}-dev
 BENTO_AUTHZ_CONTAINER_NAME=${BENTOV2_PREFIX}-authz
 BENTO_AUTHZ_NETWORK=${BENTOV2_PREFIX}-authz-net
@@ -100,7 +100,7 @@ BENTO_AUTHZ_DB_MEM_LIM=1G
 # Web
 BENTO_WEB_CUSTOM_HEADER=
 BENTOV2_WEB_IMAGE=ghcr.io/bento-platform/bento_web
-BENTOV2_WEB_VERSION=edge
+BENTOV2_WEB_VERSION=pr-483
 BENTOV2_WEB_VERSION_DEV=${BENTOV2_WEB_VERSION}-dev
 BENTOV2_WEB_CONTAINER_NAME=${BENTOV2_PREFIX}-web
 BENTO_WEB_NETWORK=${BENTOV2_PREFIX}-web-net
@@ -278,7 +278,7 @@ BENTOV2_KATSU_DB_CPUS=4
 
 # Katsu
 BENTOV2_KATSU_IMAGE=ghcr.io/bento-platform/katsu
-BENTOV2_KATSU_VERSION=edge
+BENTOV2_KATSU_VERSION=pr-573
 BENTOV2_KATSU_VERSION_DEV=${BENTOV2_KATSU_VERSION}-dev
 BENTOV2_KATSU_CONTAINER_NAME=${BENTOV2_PREFIX}-katsu
 BENTO_KATSU_NETWORK=${BENTOV2_PREFIX}-katsu-net
@@ -295,6 +295,9 @@ BENTOV2_KATSU_PROD_WES_VOL_TMP_DIR=${BENTOV2_WES_VOL_TMP_DIR}
 BENTOV2_KATSU_MEM_LIM=4G
 BENTOV2_KATSU_CPUS=4
 
+BENTO_KATSU_PROJECTS_LIST_AUTHZ="false"
+BENTO_KATSU_DATASETS_LIST_AUTHZ="false"
+
 # sub path where Katsu can be reached from Bento portal. Used by Django for building
 # urls in templates.
 CHORD_METADATA_SUB_PATH=/api/metadata
@@ -387,7 +390,7 @@ BENTOV2_GOHAN_PRIVATE_AUTHZ_URL=http://${BENTOV2_GOHAN_AUTHZ_OPA_CONTAINER_NAME}
 # Bento-Public
 
 BENTO_PUBLIC_IMAGE=ghcr.io/bento-platform/bento_public
-BENTO_PUBLIC_VERSION=edge
+BENTO_PUBLIC_VERSION=pr-263
 BENTO_PUBLIC_VERSION_DEV=${BENTO_PUBLIC_VERSION}-dev
 BENTO_PUBLIC_CONTAINER_NAME=${BENTOV2_PREFIX}-public
 BENTO_PUBLIC_NETWORK=${BENTOV2_PREFIX}-public-net
@@ -407,7 +410,7 @@ BENTO_PUBLIC_PORTAL_URL=${BENTOV2_PORTAL_PUBLIC_URL}
 BENTO_BEACON_CONTAINER_NAME=${BENTOV2_PREFIX}-beacon
 BENTO_BEACON_NETWORK=${BENTOV2_PREFIX}-beacon-net
 BENTO_BEACON_IMAGE=ghcr.io/bento-platform/bento_beacon
-BENTO_BEACON_VERSION=0.19.0
+BENTO_BEACON_VERSION=pr-127
 BENTO_BEACON_VERSION_DEV=${BENTO_BEACON_VERSION}-dev
 BENTO_BEACON_INTERNAL_PORT=${BENTO_STD_SERVICE_INTERNAL_PORT}
 BENTO_BEACON_EXTERNAL_PORT=5000

lib/katsu/docker-compose.katsu.yaml

@@ -32,6 +32,8 @@ services:
         # Authz
       - BENTO_AUTHZ_ENABLED=True
       - BENTO_AUTHZ_SERVICE_URL
+      - KATSU_PROJECTS_LIST_AUTHZ=${BENTO_KATSU_PROJECTS_LIST_AUTHZ}
+      - KATSU_DATASETS_LIST_AUTHZ=${BENTO_KATSU_DATASETS_LIST_AUTHZ}
       - CORS_ORIGINS=${BENTO_CORS_ORIGINS}
     # configs:
     #   - source: chord-metadata-settings