Repository: topoteretes/cognee
File: cognee/api/v1/permissions/routers/get_permissions_router.py (Python)

Code before:
        """
        send_telemetry(
            "Permissions API Endpoint Invoked",
            user.id,
            additional_properties={
                "endpoint": f"POST /v1/permissions/users/{str(user_id)}/tenants",
                "user_id": str(user_id),
                "tenant_id": str(tenant_id),
                "cognee_version": cognee_version,
            },
        )

        from cognee.modules.users.tenants.methods import add_user_to_tenant

        await add_user_to_tenant(user_id=user_id, tenant_id=tenant_id, owner_id=user.id)

        return JSONResponse(status_code=200, content={"message": "User added to tenant"})

    @permissions_router.delete("/tenants/{tenant_id}/users/{user_id}")
    async def remove_user_from_tenant_endpoint(
        tenant_id: UUID, user_id: UUID, user: User = Depends(get_authenticated_user)
    ):
        """
        Remove a user from a tenant.

        Only the tenant owner can remove users from their tenant. The tenant owner
        cannot be removed from their own tenant. This removes the user from all
        roles in the tenant and revokes their permissions on datasets belonging to
        the tenant. Data owned by the removed user (e.g. datasets they created)
        remains in the tenant.

        ## Path Parameters
        - **tenant_id** (UUID): The UUID of the tenant
        - **user_id** (UUID): The UUID of the user to remove from the tenant

        ## Response
        Returns a success message indicating the user was removed from the tenant.

        ## Error Codes
        - **400 Bad Request**: Attempt to remove the tenant owner from their own tenant
        - **403 Forbidden**: Requester is not the tenant owner
        - **404 Not Found**: Tenant not found, user not found, or user not in tenant
        - **500 Internal Server Error**: Error removing user from tenant
        """
        send_telemetry(
            "Permissions API Endpoint Invoked",
            user.id,
            additional_properties={
                "endpoint": f"DELETE /v1/permissions/tenants/{str(tenant_id)}/users/{str(user_id)}",
                "tenant_id": str(tenant_id),
                "user_id": str(user_id),

Review comment (security):
Would be great to update Docstring to mention that other users that have has_user_management_permission (Like users who belong to the Admin role)

Can also handle the operations added in endpoints from this PR.

Code after:
        """
        Add a user to a tenant.

        This endpoint assigns a user to a specific tenant, allowing them to access
        resources and data associated with that tenant. The authenticated user must
        be the owner of the tenant or have appropriate administrative permissions.

        ## Path Parameters
        - **user_id** (UUID): The UUID of the user to add to the tenant

        ## Request Parameters
        - **tenant_id** (UUID): The UUID of the tenant to assign the user to

        ## Response
        Returns a success message indicating the user was added to the tenant.

        ## Error Codes
        - **400 Bad Request**: Invalid user or tenant ID
        - **403 Forbidden**: User doesn't have permission to assign tenants
        - **404 Not Found**: User or tenant doesn't exist
        - **500 Internal Server Error**: Error adding user to tenant
        """
        send_telemetry(
            "Permissions API Endpoint Invoked",
            user.id,
            additional_properties={
                "endpoint": f"POST /v1/permissions/users/{str(user_id)}/tenants",
                "user_id": str(user_id),
                "tenant_id": str(tenant_id),
                "cognee_version": cognee_version,
            },
        )

        from cognee.modules.users.tenants.methods import add_user_to_tenant

        await add_user_to_tenant(user_id=user_id, tenant_id=tenant_id, owner_id=user.id)

        return JSONResponse(status_code=200, content={"message": "User added to tenant"})

    @permissions_router.delete("/tenants/{tenant_id}/users/{user_id}")
    async def remove_user_from_tenant_endpoint(
        tenant_id: UUID, user_id: UUID, user: User = Depends(get_authenticated_user)
    ):
        """
        Remove a user from a tenant.

        The tenant owner or any user with ``has_user_management_permission`` in the
        tenant (e.g. users in the Admin role) can remove users from the tenant. The
        tenant owner cannot be removed from their own tenant. This removes the user
        from all roles in the tenant and revokes their permissions on datasets
        belonging to the tenant. Data owned by the removed user (e.g. datasets they