From 7df8a779bdd8ef0e63db235e26e29885fb3e33a0 Mon Sep 17 00:00:00 2001 From: amandazhu Date: Mon, 6 Jul 2026 14:04:47 +1000 Subject: [PATCH 1/4] fix: unlink SBP service admin role from bundle group (stale grouprolelink) --- ...3c_unlink_sbp_service_admin_from_bundle.py | 59 +++++++++++++++++++ 1 file changed, 59 insertions(+) create mode 100644 migrations/versions/b7d4e2f19a3c_unlink_sbp_service_admin_from_bundle.py diff --git a/migrations/versions/b7d4e2f19a3c_unlink_sbp_service_admin_from_bundle.py b/migrations/versions/b7d4e2f19a3c_unlink_sbp_service_admin_from_bundle.py new file mode 100644 index 00000000..8cb77797 --- /dev/null +++ b/migrations/versions/b7d4e2f19a3c_unlink_sbp_service_admin_from_bundle.py @@ -0,0 +1,59 @@ +"""unlink_sbp_service_admin_from_bundle_group + +Remove the stale admin-role link between the SBP service admin role +(``biocommons/role/sbp/admin``) and the SBP bundle group +(``biocommons/group/sbp_workflow_execution``). + +That link was created by the earlier combined "SBP admin" behavior +(``PLATFORM_BUNDLE_GROUP_MAP``), where a single role granted admin over both the +SBP platform and the SBP bundle group. Now that the roles are split, the service +admin role must gate the platform only; the bundle is gated by the separate +``biocommons/role/sbp_workflow_execution/admin`` role. ``link_admin_roles`` is +append-only (it never removes links), so this pre-existing row has to be deleted +by a data migration -- otherwise ``/me/groups/admin-roles`` keeps returning the +bundle for service admins and the portal classifies them as biocommons admins. + +Revision ID: b7d4e2f19a3c +Revises: 4000ecb2796d +Create Date: 2026-07-06 00:00:00.000000 + +""" +from typing import Sequence, Union + +from alembic import op +import sqlalchemy as sa + + +# revision identifiers, used by Alembic. +revision: str = 'b7d4e2f19a3c' +down_revision: Union[str, None] = '4000ecb2796d' +branch_labels: Union[str, Sequence[str], None] = None +depends_on: Union[str, Sequence[str], None] = None + +SBP_BUNDLE_GROUP_ID = "biocommons/group/sbp_workflow_execution" +SBP_SERVICE_ADMIN_ROLE = "biocommons/role/sbp/admin" + + +def upgrade() -> None: + # Hard delete (matches the 4000ecb2796d cleanup precedent). Idempotent: does + # nothing on environments that never ran the combined-admin code. Raw SQL is + # not subject to the ORM soft-delete filter, so the role is matched by name + # even if the Auth0Role row is itself soft-deleted. + bind = op.get_bind() + bind.execute( + sa.text( + """ + DELETE FROM grouprolelink + WHERE group_id = :group_id + AND role_id IN ( + SELECT id FROM auth0role WHERE name = :role_name + ) + """ + ), + {"group_id": SBP_BUNDLE_GROUP_ID, "role_name": SBP_SERVICE_ADMIN_ROLE}, + ) + + +def downgrade() -> None: + # No-op: re-creating the link would reintroduce the combined-admin behavior. + pass From b22a70f7e20ceecdfc647c4287d6827120df0a4b Mon Sep 17 00:00:00 2001 From: amandazhu Date: Mon, 6 Jul 2026 14:12:26 +1000 Subject: [PATCH 2/4] fix: use migration from script --- ... 37a648289324_unlink_sbp_service_admin_from_bundle.py} | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) rename migrations/versions/{b7d4e2f19a3c_unlink_sbp_service_admin_from_bundle.py => 37a648289324_unlink_sbp_service_admin_from_bundle.py} (93%) diff --git a/migrations/versions/b7d4e2f19a3c_unlink_sbp_service_admin_from_bundle.py b/migrations/versions/37a648289324_unlink_sbp_service_admin_from_bundle.py similarity index 93% rename from migrations/versions/b7d4e2f19a3c_unlink_sbp_service_admin_from_bundle.py rename to migrations/versions/37a648289324_unlink_sbp_service_admin_from_bundle.py index 8cb77797..15eb5ebd 100644 --- a/migrations/versions/b7d4e2f19a3c_unlink_sbp_service_admin_from_bundle.py +++ b/migrations/versions/37a648289324_unlink_sbp_service_admin_from_bundle.py @@ -1,4 +1,4 @@ -"""unlink_sbp_service_admin_from_bundle_group +"""unlink_sbp_service_admin_from_bundle Remove the stale admin-role link between the SBP service admin role (``biocommons/role/sbp/admin``) and the SBP bundle group @@ -13,9 +13,9 @@ by a data migration -- otherwise ``/me/groups/admin-roles`` keeps returning the bundle for service admins and the portal classifies them as biocommons admins. -Revision ID: b7d4e2f19a3c +Revision ID: 37a648289324 Revises: 4000ecb2796d -Create Date: 2026-07-06 00:00:00.000000 +Create Date: 2026-07-06 14:10:56.063620 """ from typing import Sequence, Union @@ -25,7 +25,7 @@ # revision identifiers, used by Alembic. -revision: str = 'b7d4e2f19a3c' +revision: str = '37a648289324' down_revision: Union[str, None] = '4000ecb2796d' branch_labels: Union[str, Sequence[str], None] = None depends_on: Union[str, Sequence[str], None] = None From 4707a5d9f1e391d46e8c1ba90bfa61ad80421dc1 Mon Sep 17 00:00:00 2001 From: amandazhu Date: Mon, 6 Jul 2026 14:14:18 +1000 Subject: [PATCH 3/4] docs: remove blab blab --- ...48289324_unlink_sbp_service_admin_from_bundle.py | 13 ------------- 1 file changed, 13 deletions(-) diff --git a/migrations/versions/37a648289324_unlink_sbp_service_admin_from_bundle.py b/migrations/versions/37a648289324_unlink_sbp_service_admin_from_bundle.py index 15eb5ebd..4f84e41c 100644 --- a/migrations/versions/37a648289324_unlink_sbp_service_admin_from_bundle.py +++ b/migrations/versions/37a648289324_unlink_sbp_service_admin_from_bundle.py @@ -1,18 +1,5 @@ """unlink_sbp_service_admin_from_bundle -Remove the stale admin-role link between the SBP service admin role -(``biocommons/role/sbp/admin``) and the SBP bundle group -(``biocommons/group/sbp_workflow_execution``). - -That link was created by the earlier combined "SBP admin" behavior -(``PLATFORM_BUNDLE_GROUP_MAP``), where a single role granted admin over both the -SBP platform and the SBP bundle group. Now that the roles are split, the service -admin role must gate the platform only; the bundle is gated by the separate -``biocommons/role/sbp_workflow_execution/admin`` role. ``link_admin_roles`` is -append-only (it never removes links), so this pre-existing row has to be deleted -by a data migration -- otherwise ``/me/groups/admin-roles`` keeps returning the -bundle for service admins and the portal classifies them as biocommons admins. - Revision ID: 37a648289324 Revises: 4000ecb2796d Create Date: 2026-07-06 14:10:56.063620 From 1d180b7636f6f7347c0abdc5a3d384540bb8015d Mon Sep 17 00:00:00 2001 From: amandazhu Date: Mon, 6 Jul 2026 14:17:53 +1000 Subject: [PATCH 4/4] fix: proper machine generated migration for once --- ...bb_unlink_sbp_service_admin_from_bundle.py | 31 +++++++++++++ ...24_unlink_sbp_service_admin_from_bundle.py | 46 ------------------- 2 files changed, 31 insertions(+), 46 deletions(-) create mode 100644 migrations/versions/0d2a0acf71bb_unlink_sbp_service_admin_from_bundle.py delete mode 100644 migrations/versions/37a648289324_unlink_sbp_service_admin_from_bundle.py diff --git a/migrations/versions/0d2a0acf71bb_unlink_sbp_service_admin_from_bundle.py b/migrations/versions/0d2a0acf71bb_unlink_sbp_service_admin_from_bundle.py new file mode 100644 index 00000000..0ba6fb5a --- /dev/null +++ b/migrations/versions/0d2a0acf71bb_unlink_sbp_service_admin_from_bundle.py @@ -0,0 +1,31 @@ +"""unlink_sbp_service_admin_from_bundle + +Revision ID: 0d2a0acf71bb +Revises: 37a648289324 +Create Date: 2026-07-06 14:17:16.280278 + +""" +from typing import Sequence, Union + +from alembic import op +import sqlalchemy as sa +import sqlmodel + + +# revision identifiers, used by Alembic. +revision: str = '0d2a0acf71bb' +down_revision: Union[str, None] = '37a648289324' +branch_labels: Union[str, Sequence[str], None] = None +depends_on: Union[str, Sequence[str], None] = None + + +def upgrade() -> None: + # ### commands auto generated by Alembic - please adjust! ### + pass + # ### end Alembic commands ### + + +def downgrade() -> None: + # ### commands auto generated by Alembic - please adjust! ### + pass + # ### end Alembic commands ### diff --git a/migrations/versions/37a648289324_unlink_sbp_service_admin_from_bundle.py b/migrations/versions/37a648289324_unlink_sbp_service_admin_from_bundle.py deleted file mode 100644 index 4f84e41c..00000000 --- a/migrations/versions/37a648289324_unlink_sbp_service_admin_from_bundle.py +++ /dev/null @@ -1,46 +0,0 @@ -"""unlink_sbp_service_admin_from_bundle - -Revision ID: 37a648289324 -Revises: 4000ecb2796d -Create Date: 2026-07-06 14:10:56.063620 - -""" -from typing import Sequence, Union - -from alembic import op -import sqlalchemy as sa - - -# revision identifiers, used by Alembic. -revision: str = '37a648289324' -down_revision: Union[str, None] = '4000ecb2796d' -branch_labels: Union[str, Sequence[str], None] = None -depends_on: Union[str, Sequence[str], None] = None - -SBP_BUNDLE_GROUP_ID = "biocommons/group/sbp_workflow_execution" -SBP_SERVICE_ADMIN_ROLE = "biocommons/role/sbp/admin" - - -def upgrade() -> None: - # Hard delete (matches the 4000ecb2796d cleanup precedent). Idempotent: does - # nothing on environments that never ran the combined-admin code. Raw SQL is - # not subject to the ORM soft-delete filter, so the role is matched by name - # even if the Auth0Role row is itself soft-deleted. - bind = op.get_bind() - bind.execute( - sa.text( - """ - DELETE FROM grouprolelink - WHERE group_id = :group_id - AND role_id IN ( - SELECT id FROM auth0role WHERE name = :role_name - ) - """ - ), - {"group_id": SBP_BUNDLE_GROUP_ID, "role_name": SBP_SERVICE_ADMIN_ROLE}, - ) - - -def downgrade() -> None: - # No-op: re-creating the link would reintroduce the combined-admin behavior. - pass