Add possibility to put the system in read-only mode

In order to reduce risk of losing newly ingested data on some occasions (e.g. VM migrations, immediately before maintenance, ...) we want to put the system into read-only mode occasionally.

This MR introduces the config item CONFIG_TUW_READ_ONLY_MODE=True, which triggers the system to prohibit write operations for any users in most services.

invenio_config_tuw/permissions/generators.py

@@ -5,12 +5,30 @@
 # Invenio-Config-TUW is free software; you can redistribute it and/or modify
 # it under the terms of the MIT License; see LICENSE file for more details.
 
+from flask import current_app
 from flask_login import current_user
 from flask_principal import RoleNeed, UserNeed
+from invenio_access.permissions import any_user
 from invenio_rdm_records.services.generators import SecretLinks
 from invenio_records_permissions.generators import Generator
 
 
+class DisableIf(Generator):
+    """Denies ALL users including super users, if a condition is met."""
+
+    def __init__(self, check=lambda: True):
+        """Constructor."""
+        super().__init__()
+        self.check = check
+
+    def excludes(self, **kwargs):
+        """Preventing Needs."""
+        if self.check():
+            return [any_user]
+        else:
+            return []
+
+
 class TrustedUsers(Generator):
     """Allows users with the "trusted-user" role."""
 
@@ -61,6 +79,11 @@ class RecordOwnersWithRole(Generator):
         return []
 
 
+def DisableIfReadOnly():
+    """Disable permissions for everybody if the repository is set as read only."""
+    return DisableIf(lambda: current_app.config.get("CONFIG_TUW_READ_ONLY_MODE", False))
+
+
 def TrustedRecordOwners(exclude=False):
     """Allows record owners with the "trusted-user" role."""
     return RecordOwnersWithRole("trusted-user", exclude=exclude)