"""Logic for permission related to analytics.""" from ddtrace import tracer from analytics.connectors import redis from analytics.constants import cache as cache_constants from analytics.constants.access import ACCESS_ANALYTICS from analytics.logic.parallel import parallel from analytics.services import ows_account, ows_users from analytics.utils.cache import create_access_key @tracer.wrap(name="has_analytics") def has_analytics( account_type, account_id, user_id, profile_type=None, profile_id=None ): """ Verify that user has an access to Analytics tab in Workstation. Check feature control on account level, and on user level. Also check for the feature flag. Return True if Analytics is enabled, otherwise render an access error. """ if profile_type and profile_id: return True redis_key = create_access_key(account_type, account_id, user_id, ACCESS_ANALYTICS) result = redis.client.get(redis_key) if result and result == b"True": return True if result and result == b"False": return False if account_type == ows_account.account_constants.SUBACCOUNT_TYPE: vendor_id = ows_account.get_vendor_id(account_id).message else: vendor_id = account_id requests = { "is_enabled_for_vendor": { "func": ows_account.vendor_has_access, "args": (vendor_id,), "kwargs": {}, }, "is_enabled_for_user": { "func": ows_users.user_has_access, "args": (account_id, account_type, user_id), "kwargs": {}, }, } result = parallel(requests).message if result.get("error"): raise Exception(result.get("error")) if not result.get("is_enabled_for_vendor") or not result.get("is_enabled_for_user"): redis.client.set(redis_key, b"False", ex=cache_constants.ACCESS_CACHE_TTL) return False # TODO: check if we can reset key on update of art_relations # TODO: check if we can pre-warm the cache redis.client.set(redis_key, b"True", ex=cache_constants.ACCESS_CACHE_TTL) return True