Repository: topoteretes/cognee
File: examples/python/permissions_example.py (Python)

Code before:
    tenant_id = await create_tenant("CogneeLab", user_2.id)

    print("\nUser 2 is creating Reasercher role")
    role_id = await create_role(role_name="Reasercher", owner_id=user_2.id)

    print("\nCreating user_3: user_3@example.com")
    user_3 = await create_user("user_3@example.com", "example")

    # To add a user to a role he must be part of the same tenant/organization
    print("\nOperation started as user_2 to add user_3 to CogneeLab tenant/organization")
    await add_user_to_tenant(user_id=user_3.id, tenant_id=tenant_id, owner_id=user_2.id)

    print("\nOperation started as user_2 to add user_3 to Reasercher role")
    await add_user_to_role(user_id=user_3.id, role_id=role_id, owner_id=user_2.id)

    print(
        "\nOperation started as user_2 to give read permission to Reasercher role for the dataset owned by user_2"
    )
    await authorized_give_permission_on_datasets(
        role_id,
        [quantum_dataset_id],
        "read",
        user_2.id,
    )

    # Now user_3 can read from quantum dataset as part of the Reasercher role after proper permissions have been assigned by the Quantum dataset owner.
    print("\nSearch result as  on the dataset owned by user_2:")
    search_results = await cognee.search(
        query_type=SearchType.GRAPH_COMPLETION,
        query_text="What is in the document?",
        user=user_1,
        dataset_ids=[quantum_dataset_id],
    )
    for result in search_results:
        print(f"{result}\n")

    # Note: All of these function calls and permission system is available through our backend endpoints as well


if __name__ == "__main__":
    import asyncio

    logger = setup_logging(log_level=CRITICAL)
    asyncio.run(main())


Review comment (security):
```suggestion
    # Now user_3 can read from QUANTUM dataset as part of the Researcher role after proper permissions have been assigned by the QUANTUM dataset owner, user_2.
```

Code after:
    tenant_id = await create_tenant("CogneeLab", user_2.id)

    print("\nUser 2 is creating Researcher role")
    role_id = await create_role(role_name="Researcher", owner_id=user_2.id)

    print("\nCreating user_3: user_3@example.com")
    user_3 = await create_user("user_3@example.com", "example")

    # To add a user to a role he must be part of the same tenant/organization
    print("\nOperation started as user_2 to add user_3 to CogneeLab tenant/organization")
    await add_user_to_tenant(user_id=user_3.id, tenant_id=tenant_id, owner_id=user_2.id)

    print(
        "\nOperation started by user_2, as tenant owner, to add user_3 to Researcher role inside the tenant/organization"
    )
    await add_user_to_role(user_id=user_3.id, role_id=role_id, owner_id=user_2.id)

    print(
        "\nOperation started as user_2 to give read permission to Researcher role for the dataset owned by user_2"
    )
    await authorized_give_permission_on_datasets(
        role_id,
        [quantum_dataset_id],
        "read",
        user_2.id,
    )

    # Now user_3 can read from QUANTUM dataset as part of the Researcher role after proper permissions have been assigned by the QUANTUM dataset owner, user_2.
    print("\nSearch result as user_3 on the dataset owned by user_2:")
    search_results = await cognee.search(
        query_type=SearchType.GRAPH_COMPLETION,
        query_text="What is in the document?",
        user=user_1,
        dataset_ids=[quantum_dataset_id],
    )
    for result in search_results:
        print(f"{result}\n")

    # Note: All of these function calls and permission system is available through our backend endpoints as well


if __name__ == "__main__":
    import asyncio

    logger = setup_logging(log_level=CRITICAL)
    asyncio.run(main())