How restrict the workers download?

[azadehashouri]

Actions before raising this issue

• I searched the existing issues and did not find anything similar.
• I read/searched the docs

Is your feature request related to a problem? Please describe.

Hello,

I want to restrict the download option for worker users, I mean I want my worker members aren't allowed to export jobs, tasks, projects and generally data.

I edited cvat/cvat/apps/engine/rules/jobs.rego file in this way and commented the codes related to export annotation and dataset:

allow if {
    input.scope in {
        utils.VIEW,
#        utils.EXPORT_DATASET, utils.EXPORT_ANNOTATIONS,
        utils.VIEW_ANNOTATIONS, utils.VIEW_DATA, utils.VIEW_METADATA
    }
    utils.is_sandbox
    is_job_staff
}

allow if {
    input.scope in {
        utils.VIEW,
#        utils.EXPORT_DATASET, utils.EXPORT_ANNOTATIONS, 
        utils.VIEW_ANNOTATIONS, utils.VIEW_DATA, utils.VIEW_METADATA
    }
    input.auth.organization.id == input.resource.organization.id
    organizations.has_perm(organizations.WORKER)
    is_job_staff
}

after that I run these commands to rebuild cvat_server:

sudo docker compose -f docker-compose.yml -f docker-compose.dev.yml down

sudo docker compose -f docker-compose.yml -f docker-compose.dev.yml up -d --build --force-recreate cvat_server

But unfortunately, it doesn't work and my worker members can still export and download data.

Please help me to solve this problem to protect my data.

Describe the solution you'd like

No response

Describe alternatives you've considered

No response

Additional context

No response

[bsekachev]

Try to rebuild and restart all services, not just cvat_server. As it only returns a bundle with rules, hovewer cvat_opa is responsible for authorization.

[azadehashouri]

I solve this by comment utils.EXPORT_DATASET, utils.EXPORT_ANNOTATIONS in tasks.rego file and rebuild cvat_server and run all required containers again.

Thanks for your reply.

@bsekachev