Read-restricted ATLAS users cannot create estimations

[Jack-42]

When working with the latest version of ATLAS (v2.15.0) and WebAPI (v2.15.1) I've found that users with the "read restricted Atlas Users" role cannot create estimations - if they click on "New Population Level Estimation Analysis" they are told they do not have access to this feature:

Is there a way to modify the permissions of "read restricted Atlas Users" such that users with this role can 1) create estimations, while also 2) not being able to access/modify estimations from other users' (i.e., the same behavior seen with cohort definitions and other artifacts)? I have been trying to experiment with custom roles but haven't found a solution that meets both requirements 1) and 2).

The closest I've been able to get is adding these permissions to "read restricted Atlas Users", but it has the downside of letting these users access all estimations:

{
  "role": "additional estimation permissions for read restricted Atlas Users",
  "users": [],
  "permissions": [
    { "id": "estimation:*:get" },
    { "id": "estimation:*:copy:get" },
    { "id": "estimation:*:download:get" },
    { "id": "estimation:*:export:get" },
    { "id": "estimation:*:generation:get" }
  ]
}

[chrisknoll]

Hi there.

@rkboyce was the brain-child of the 'read-restricted' role in Atlas, but it does logically follow that if you're read-restricted in something you're being restricted to read-only functions and creating an estimation is not a read action.

Putting that aside, tho, if you want to give users rights to creating estimation, the permission is the "post' permission (in HTTP verb semantics). Here's the list of estimation-reated permissions that you get by default (ignoring which roles get these permissions):

606	"estimation:post"	"Create Estimation"
607	"estimation:get"	"Get Estimation list"
608	"estimation:*:get"	"Get Estimation instance"
609	"estimation:*:copy:get"	"Copy Estimation instance"
610	"estimation:*:download:get"	"Download Estimation package"
611	"estimation:*:export:get"	"Export Estimation"
635	"estimation:*:generation:*:post"	"Execute Estimation Generation Job"
636	"estimation:*:generation:get"	"View Estimation Generations"
637	"estimation:generation:*:result:get"	"View Estimation Generation Results"
642	"estimation:import:post"	"Import PLE analyses"
660	"estimation:*:put"	"Edit any Estimation analysis"
661	"estimation:*:delete"	"Delete any Estimation analysis"
1041	"estimation:*:exists:get"	"Check name uniqueness of estimation"
1059	"estimation:check:post"	"Run diagnostics for estimation"

Please ignore the first column of IDs, that's just the autonubmers from my env.

So, if you want to give permission to someone to create estimations, you want to grant 606: "estimation:post". As a person creates estimations, they should get a series of permissions assigned to their user-role that will let them have read/write access to the new estimation (in the from "estimation:{newId}:get", "estimation:{newID}:delete") etc.

Here's the list of permissions that they will get based on a permission template (from this source code):

    private static Map<String, String> writePermissions = new HashMap<String, String>() {{
        put("estimation:%s:put", "Edit Estimation with ID=%s");
        put("estimation:%s:delete", "Delete Estimation with ID=%s");
    }};

    private static Map<String, String> readPermissions = new HashMap<String, String>() {{ 
	put("estimation:%s:get", "Get Estimation instance");
	put("estimation:%s:generation:get", "View Estimation Generations");
	put("estimation:%s:copy:get", "Copy Estimation instance");
	put("estimation:%s:download:get", "Download Estimation package");
	put("estimation:%s:export:get", "Export Estimation");
	put("estimation:%s:generation:get", "View Estimation Generations");
	put("comparativecohortanalysis:%s:get","Get estimation");
      }
      };

So, don't add permissiosn to the user with all those * permissiosn, you are correct that will let them see anything. Instead, just grant the create permission to the read-only role, and they will be able to create, and then any new creations will have the above set of permissions assigned only to that user.

Note, part of the rework for Atlas 3.0/WebAPI 3.0 will be to re-vamp the permission structure to make it much easier to understand and manage. Stay tuned for that.

[Jack-42]

Hello @chrisknoll

Thanks for your reply. I maybe misunderstood the 'read restricted' role. My understanding was that this role was intended to restrict which artifacts users had access to, rather than restricting them to having access to read-only functions (based on https://github.com/OHDSI/WebAPI/wiki/Read-restricted-Configuration). It's a bit confusing to me that these "read restricted Atlas Users" can by default create and run generation for some artifacts (such as cohort definitions) but not others (such as estimations). I'm glad to hear that Atlas 3.0/WebAPI 3.0 will be re-vamping the permissions structure.