Merge pull request #1355 from Giskard-AI/GSK-1623-secure-readonly-demo-space

[GSK-1623] Secure Giskard readonly demo space at Hugging Face Spaces

Author: kevinmessiaen

backend/src/main/java/ai/giskard/config/ApplicationProperties.java

@@ -36,6 +36,8 @@ public class ApplicationProperties {
     private long tokenValidityInSecondsForRememberMe = 2592000; // 30 days;
     private CorsConfiguration cors = new CorsConfiguration();
 
+    private String defaultApiKey;
+    private String hfDemoSpaceUnlockToken;
     private String mixpanelProjectKey;
 }
 

backend/src/main/java/ai/giskard/config/SecurityConfiguration.java

@@ -37,6 +37,8 @@ public class SecurityConfiguration {
     private final ApiKeyService apiKeyService;
 
 
+    public static final String GISKARD_API_ENDPOINTS = "/api/**";
+
     @Bean
     public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
         http
@@ -75,7 +77,7 @@ public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
                     antMatcher("/management/**")
                 ).hasAuthority(AuthoritiesConstants.ADMIN)
                 .requestMatchers(antMatcher("/public-api/**")).hasAuthority(AuthoritiesConstants.API)
-                .requestMatchers(antMatcher("/api/**")).authenticated()
+                .requestMatchers(antMatcher(GISKARD_API_ENDPOINTS)).authenticated()
             )
             .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
             .apply(securityConfigurerAdapter());

backend/src/main/java/ai/giskard/domain/ApiKey.java

@@ -1,15 +1,19 @@
 package ai.giskard.domain;
 
+import ai.giskard.security.GalleryDatabaseOperationListener;
 import jakarta.persistence.*;
 import lombok.Getter;
 import lombok.NoArgsConstructor;
+import lombok.Setter;
 import org.apache.commons.lang3.RandomStringUtils;
 
 import java.util.UUID;
 
 @Entity(name = "api_keys")
 @Getter
+@Setter
 @NoArgsConstructor
+@EntityListeners(GalleryDatabaseOperationListener.class)
 public class ApiKey extends AbstractAuditingEntity {
 
     public static final String PREFIX = "gsk-";

backend/src/main/java/ai/giskard/domain/Project.java

@@ -3,6 +3,7 @@
 import ai.giskard.domain.ml.Dataset;
 import ai.giskard.domain.ml.ProjectModel;
 import ai.giskard.domain.ml.TestSuite;
+import ai.giskard.security.GalleryDatabaseOperationListener;
 import com.fasterxml.jackson.annotation.JsonIdentityInfo;
 import com.fasterxml.jackson.annotation.JsonIgnore;
 import com.fasterxml.jackson.annotation.JsonProperty;
@@ -22,7 +23,7 @@
 
 @Entity(name = "projects")
 @NoArgsConstructor
-@EntityListeners(AuditingEntityListener.class)
+@EntityListeners({AuditingEntityListener.class, GalleryDatabaseOperationListener.class})
 @JsonIdentityInfo(generator = ObjectIdGenerators.PropertyGenerator.class, property = "key")
 public class Project extends AbstractAuditingEntity {
     @Serial

backend/src/main/java/ai/giskard/domain/Role.java

@@ -1,7 +1,9 @@
 package ai.giskard.domain;
 
+import ai.giskard.security.GalleryDatabaseOperationListener;
 import jakarta.persistence.Column;
 import jakarta.persistence.Entity;
+import jakarta.persistence.EntityListeners;
 import jakarta.persistence.Table;
 import jakarta.validation.constraints.NotNull;
 import jakarta.validation.constraints.Size;
@@ -12,6 +14,7 @@
  */
 @Entity
 @Table(name = "role")
+@EntityListeners(GalleryDatabaseOperationListener.class)
 public class Role extends BaseEntity {
     @lombok.Setter
     @lombok.Getter

backend/src/main/java/ai/giskard/domain/User.java

@@ -1,6 +1,7 @@
 package ai.giskard.domain;
 
 import ai.giskard.config.Constants;
+import ai.giskard.security.GalleryDatabaseOperationListener;
 import com.fasterxml.jackson.annotation.JsonIdentityInfo;
 import com.fasterxml.jackson.annotation.JsonIgnore;
 import com.fasterxml.jackson.annotation.ObjectIdGenerators;
@@ -29,6 +30,7 @@
 @Setter
 @NotNull
 @JsonIdentityInfo(generator = ObjectIdGenerators.PropertyGenerator.class, property = "login")
+@EntityListeners(GalleryDatabaseOperationListener.class)
 public class User extends AbstractAuditingEntity {
     @Serial
     private static final long serialVersionUID = 0L;

backend/src/main/java/ai/giskard/domain/ml/ProjectModel.java

@@ -2,6 +2,7 @@
 
 import ai.giskard.domain.AbstractAuditingEntity;
 import ai.giskard.domain.Project;
+import ai.giskard.security.GalleryDatabaseOperationListener;
 import ai.giskard.utils.SimpleJSONStringAttributeConverter;
 import com.fasterxml.jackson.annotation.JsonBackReference;
 import lombok.AllArgsConstructor;
@@ -20,6 +21,7 @@
 @Setter
 @NoArgsConstructor
 @AllArgsConstructor
+@EntityListeners(GalleryDatabaseOperationListener.class)
 public class ProjectModel extends AbstractAuditingEntity {
     @Serial
     private static final long serialVersionUID = 0L;

backend/src/main/java/ai/giskard/security/AuthoritiesConstants.java

@@ -23,8 +23,6 @@ public final class AuthoritiesConstants {
         ADMIN, "Admin"
     );
 
-    public static final String[] AUTHORITIES = AUTHORITY_NAMES.keySet().toArray(new String[0]);
-
     private AuthoritiesConstants() {
     }
 }

backend/src/main/java/ai/giskard/security/GalleryDatabaseOperationListener.java

@@ -0,0 +1,21 @@
+package ai.giskard.security;
+
+import ai.giskard.service.GeneralSettingsService;
+import ai.giskard.service.InitService;
+import ai.giskard.web.rest.errors.GalleryDemoSpaceException;
+import jakarta.persistence.PrePersist;
+import jakarta.persistence.PreRemove;
+import jakarta.persistence.PreUpdate;
+import org.springframework.beans.factory.annotation.Configurable;
+
+@Configurable
+public class GalleryDatabaseOperationListener {
+    @PrePersist
+    @PreUpdate
+    @PreRemove
+    void beforeEntityModification(Object entity) {
+        if (GeneralSettingsService.IS_RUNNING_IN_DEMO_HF_SPACES && !InitService.isUnlocked()) {
+            throw new GalleryDemoSpaceException("This is a read-only Giskard Gallery instance. You cannot modify entities " + entity.getClass().getName());
+        }
+    }
+}

backend/src/main/java/ai/giskard/service/AnalyticsCollectorService.java

@@ -56,8 +56,8 @@ public void doTrack(String eventName, JSONObject props) {
             serverProps.put("Giskard Version", buildVersion);
             serverProps.put("Giskard Plan", licenseService.getCurrentLicense().getPlanCode());
             serverProps.put("Giskard LicenseID", licenseService.getCurrentLicense().getId());
-            serverProps.put("Is HuggingFace", GeneralSettingsService.isRunningInHFSpaces);
-            serverProps.put("HuggingFace Space ID", GeneralSettingsService.hfSpaceId);
+            serverProps.put("Is HuggingFace", GeneralSettingsService.IS_RUNNING_IN_HFSPACES);
+            serverProps.put("HuggingFace Space ID", GeneralSettingsService.HF_SPACE_ID);
             messageBuilder.set(settingsService.getSettings().getInstanceId(), serverProps);
         } catch (NoSuchElementException e) {
             // Do not track when we failed to initialize the server properties