Add support for groups (#1778)

* Add support for groups

* Add missing output types

* Fix port for group test

* Fix concurrent integration tests

* Correct path

* Add groups to own user

* Escape group names

* Also escape user_ids

* Fix integration test

* Update CI image

* Remove unnecessary inheritance of `_Groups` on `_BaseExecutor`

---------

Co-authored-by: Tommy Smith <tommy@weaviate.io>

Author: dirkkul

.github/workflows/main.yaml

@@ -25,7 +25,7 @@ env:
   WEAVIATE_129: 1.29.9
   WEAVIATE_130: 1.30.12
   WEAVIATE_131: 1.31.5
-  WEAVIATE_132: 1.32.4-cdf9a3b
+  WEAVIATE_132: 1.32.5
 
 jobs:
   lint-and-format:

integration/test_groups.py

@@ -0,0 +1,87 @@
+import pytest
+
+from integration.conftest import ClientFactory
+from weaviate.auth import Auth
+from weaviate.rbac.models import GroupTypes, Role
+
+RBAC_PORTS = (8092, 50063)
+RBAC_AUTH_CREDS = Auth.api_key("admin-key")
+
+
+def test_assign_and_get_group_roles_oidc(client_factory: ClientFactory) -> None:
+    with client_factory(ports=RBAC_PORTS, auth_credentials=RBAC_AUTH_CREDS) as client:
+        if client._connection._weaviate_version.is_lower_than(1, 32, 0):
+            pytest.skip("This test requires Weaviate 1.32.0 or higher")
+
+        roles_to_assign = ["viewer", "admin"]
+        group_id = "/assign-group"
+        client.groups.oidc.revoke_roles(group_id=group_id, role_names=roles_to_assign)
+
+        roles_base = client.groups.oidc.get_assigned_roles(
+            group_id=group_id,
+        )
+        assert len(roles_base) == 0
+
+        client.groups.oidc.assign_roles(group_id=group_id, role_names=roles_to_assign)
+
+        roles = client.groups.oidc.get_assigned_roles(group_id=group_id, include_permissions=True)
+        assert len(roles) == 2
+        for role_name in roles_to_assign:
+            assert role_name in roles
+            assert isinstance(roles[role_name], Role)
+
+        client.groups.oidc.revoke_roles(group_id=group_id, role_names=roles_to_assign)
+
+        roles_base = client.groups.oidc.get_assigned_roles(
+            group_id=group_id,
+        )
+        assert len(roles_base) == 0
+
+
+def test_known_groups(client_factory: ClientFactory) -> None:
+    with client_factory(ports=RBAC_PORTS, auth_credentials=RBAC_AUTH_CREDS) as client:
+        if client._connection._weaviate_version.is_lower_than(1, 32, 0):
+            pytest.skip("This test requires Weaviate 1.32.0 or higher")
+
+        group1 = "/known-group1"
+        group2 = "/known-group2"
+        client.groups.oidc.assign_roles(group_id=group1, role_names="viewer")
+        client.groups.oidc.assign_roles(group_id=group2, role_names="viewer")
+
+        groups = client.groups.oidc.get_known_group_names()
+        assert len(groups) >= 2  # other tests may add groups
+        assert group1 in groups
+        assert group2 in groups
+
+        client.groups.oidc.revoke_roles(group_id=group1, role_names="viewer")
+        client.groups.oidc.revoke_roles(group_id=group2, role_names="viewer")
+
+        groups = client.groups.oidc.get_known_group_names()
+        assert len(groups) >= 0  # other tests may add groups
+        assert group1 not in groups
+        assert group2 not in groups
+
+
+def test_get_group_assignments(client_factory: ClientFactory) -> None:
+    with client_factory(ports=RBAC_PORTS, auth_credentials=RBAC_AUTH_CREDS) as client:
+        if client._connection._weaviate_version.is_lower_than(1, 32, 0):
+            pytest.skip("This test requires Weaviate 1.32.0 or higher")
+
+        role_name = "test_group_assignments_role"
+        client.roles.delete(role_name=role_name)
+        client.roles.create(role_name=role_name, permissions=[])
+
+        group_assignments = client.roles.get_group_assignments(role_name=role_name)
+        assert len(group_assignments) == 0
+
+        client.groups.oidc.assign_roles(group_id="custom-group", role_names=role_name)
+        client.groups.oidc.assign_roles(group_id="custom-group2", role_names=role_name)
+
+        group_assignments = client.roles.get_group_assignments(role_name=role_name)
+        assert len(group_assignments) == 2
+        for group in group_assignments:
+            assert group.group_id in ["custom-group", "custom-group2"]
+            assert group.group_type == GroupTypes.OIDC
+
+        client.groups.oidc.revoke_roles(group_id="custom-group", role_names=role_name)
+        client.groups.oidc.revoke_roles(group_id="custom-group2", role_names=role_name)

integration/test_rbac.py

@@ -12,6 +12,7 @@
     ClusterPermissionOutput,
     CollectionsPermissionOutput,
     DataPermissionOutput,
+    GroupsPermissionOutput,
     NodesPermissionOutput,
     Role,
     ReplicatePermissionOutput,
@@ -45,6 +46,7 @@
                 nodes_permissions=[],
                 tenants_permissions=[],
                 replicate_permissions=[],
+                groups_permissions=[],
             ),
             None,
         ),
@@ -62,6 +64,7 @@
                 nodes_permissions=[],
                 tenants_permissions=[],
                 replicate_permissions=[],
+                groups_permissions=[],
             ),
             None,
         ),
@@ -83,6 +86,7 @@
                 nodes_permissions=[],
                 tenants_permissions=[],
                 replicate_permissions=[],
+                groups_permissions=[],
             ),
             None,
         ),
@@ -102,6 +106,7 @@
                 nodes_permissions=[],
                 tenants_permissions=[],
                 replicate_permissions=[],
+                groups_permissions=[],
             ),
             None,
         ),
@@ -134,6 +139,7 @@
                 nodes_permissions=[],
                 tenants_permissions=[],
                 replicate_permissions=[],
+                groups_permissions=[],
             ),
             None,
         ),
@@ -155,6 +161,7 @@
                 ],
                 tenants_permissions=[],
                 replicate_permissions=[],
+                groups_permissions=[],
             ),
             None,
         ),
@@ -176,6 +183,7 @@
                 ],
                 tenants_permissions=[],
                 replicate_permissions=[],
+                groups_permissions=[],
             ),
             None,
         ),
@@ -197,6 +205,7 @@
                 nodes_permissions=[],
                 tenants_permissions=[],
                 replicate_permissions=[],
+                groups_permissions=[],
             ),
             None,
         ),
@@ -220,6 +229,7 @@
                     )
                 ],
                 replicate_permissions=[],
+                groups_permissions=[],
             ),
             None,
         ),
@@ -260,6 +270,7 @@
                     ),
                 ],
                 replicate_permissions=[],
+                groups_permissions=[],
             ),
             None,
         ),
@@ -281,6 +292,7 @@
                 nodes_permissions=[],
                 tenants_permissions=[],
                 replicate_permissions=[],
+                groups_permissions=[],
             ),
             None,
         ),
@@ -321,6 +333,7 @@
                         actions={Actions.Replicate.READ, Actions.Replicate.UPDATE},
                     ),
                 ],
+                groups_permissions=[],
             ),
             32,
         ),
@@ -344,6 +357,7 @@
                 nodes_permissions=[],
                 tenants_permissions=[],
                 replicate_permissions=[],
+                groups_permissions=[],
             ),
             32,  # Minimum version for alias permissions
         ),
@@ -367,9 +381,34 @@
                 nodes_permissions=[],
                 tenants_permissions=[],
                 replicate_permissions=[],
+                groups_permissions=[],
             ),
             32,  # Minimum version for alias permissions
         ),
+        (
+            Permissions.Groups.oidc(group="MyGroup", read=True),
+            Role(
+                name="GroupRole",
+                alias_permissions=[],
+                cluster_permissions=[],
+                users_permissions=[],
+                collections_permissions=[],
+                roles_permissions=[],
+                data_permissions=[],
+                backups_permissions=[],
+                nodes_permissions=[],
+                tenants_permissions=[],
+                replicate_permissions=[],
+                groups_permissions=[
+                    GroupsPermissionOutput(
+                        group="MyGroup",
+                        group_type="oidc",
+                        actions={Actions.Groups.READ},
+                    )
+                ],
+            ),
+            32,  # Minimum version for group permissions
+        ),
     ],
 )
 def test_create_role(

integration/test_users.py

@@ -87,9 +87,10 @@ def test_create_user_and_get(client_factory: ClientFactory) -> None:
         ) as client2:
             user = client2.users.get_my_user()
             assert user.user_id == randomUserName
-        user = client.users.db.get(user_id=randomUserName)
-        assert user.user_id == randomUserName
-        assert user.user_type == UserTypes.DB_DYNAMIC
+        dynamicUser = client.users.db.get(user_id=randomUserName)
+        assert dynamicUser is not None
+        assert dynamicUser.user_id == randomUserName
+        assert dynamicUser.user_type == UserTypes.DB_DYNAMIC
         assert client.users.db.delete(user_id=randomUserName)
 
 

weaviate/client.py

@@ -20,6 +20,7 @@
 from .connect.v4 import ConnectionAsync, ConnectionSync
 from .debug import _Debug, _DebugAsync
 from .embedded import EmbeddedOptions
+from .groups import _Groups, _GroupsAsync
 from .rbac import _Roles, _RolesAsync
 from .types import NUMBER
 from .users import _Users, _UsersAsync
@@ -78,6 +79,7 @@ def __init__(
         self.cluster = _ClusterAsync(self._connection)
         self.collections = _CollectionsAsync(self._connection)
         self.debug = _DebugAsync(self._connection)
+        self.groups = _GroupsAsync(self._connection)
         self.roles = _RolesAsync(self._connection)
         self.users = _UsersAsync(self._connection)
 
@@ -148,6 +150,7 @@ def __init__(
         self.cluster = _Cluster(self._connection)
         self.collections = collections
         self.debug = _Debug(self._connection)
+        self.groups = _Groups(self._connection)
         self.roles = _Roles(self._connection)
         self.users = _Users(self._connection)
 

weaviate/client.pyi

@@ -11,6 +11,8 @@ from weaviate.collections.classes.internal import _RawGQLReturn
 from weaviate.collections.collections.async_ import _CollectionsAsync
 from weaviate.collections.collections.sync import _Collections
 from weaviate.connect.v4 import ConnectionAsync, ConnectionSync
+from weaviate.groups.async_ import _GroupsAsync
+from weaviate.groups.sync import _Groups
 from weaviate.users.async_ import _UsersAsync
 from weaviate.users.sync import _Users
 
@@ -30,6 +32,7 @@ class WeaviateAsyncClient(_WeaviateClientExecutor[ConnectionAsync]):
     collections: _CollectionsAsync
     cluster: _ClusterAsync
     debug: _DebugAsync
+    groups: _GroupsAsync
     roles: _RolesAsync
     users: _UsersAsync
 
@@ -52,6 +55,7 @@ class WeaviateClient(_WeaviateClientExecutor[ConnectionSync]):
     collections: _Collections
     cluster: _Cluster
     debug: _Debug
+    groups: _Groups
     roles: _Roles
     users: _Users
 

weaviate/groups/__init__.py

@@ -0,0 +1,4 @@
+from .async_ import _GroupsAsync
+from .sync import _Groups
+
+__all__ = ["_Groups", "_GroupsAsync"]

weaviate/groups/async_.py

@@ -0,0 +1,14 @@
+from weaviate.connect import executor
+from weaviate.connect.v4 import ConnectionAsync
+from weaviate.groups.base import _GroupsOIDCExecutor
+
+
+@executor.wrap("async")
+class _GroupsAsync:
+    def __init__(self, connection: ConnectionAsync):
+        self.oidc = _GroupsOIDCAsync(connection)
+
+
+@executor.wrap("sync")
+class _GroupsOIDCAsync(_GroupsOIDCExecutor[ConnectionAsync]):
+    pass

weaviate/groups/async_.pyi

@@ -0,0 +1,27 @@
+from typing import Dict, List, Literal, Union, overload
+
+from weaviate.connect.v4 import ConnectionAsync
+from weaviate.groups.base import _GroupsOIDCExecutor
+from weaviate.rbac.models import Role, RoleBase
+
+class _GroupsOIDCAsync(_GroupsOIDCExecutor[ConnectionAsync]):
+    @overload
+    async def get_assigned_roles(
+        self, *, group_id: str, include_permissions: Literal[False] = False
+    ) -> Dict[str, RoleBase]: ...
+    @overload
+    async def get_assigned_roles(
+        self, *, group_id: str, include_permissions: Literal[True]
+    ) -> Dict[str, Role]: ...
+    @overload
+    async def get_assigned_roles(
+        self, *, group_id: str, include_permissions: bool = False
+    ) -> Union[Dict[str, Role], Dict[str, RoleBase]]: ...
+    async def assign_roles(self, *, group_id: str, role_names: Union[str, List[str]]) -> None: ...
+    async def revoke_roles(self, *, group_id: str, role_names: Union[str, List[str]]) -> None: ...
+    async def get_known_group_names(self) -> List[str]: ...
+
+class _GroupsAsync:
+    def __init__(self, connection: ConnectionAsync): ...
+    @property
+    def oidc(self) -> _GroupsOIDCAsync: ...