Skip to content

Commit e0b33d3

Browse files
pascal-fischerpascal-fischer
authored
[management] permissions manager use crud operations (#3690)
1 parent c38e07d commit e0b33d3

36 files changed

+185
-163
lines changed

‎management/server/account.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -283,7 +283,7 @@ func (am *DefaultAccountManager) UpdateAccountSettings(ctx context.Context, acco
283283
return nil, err
284284
}
285285

286-
allowed, err := am.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.Settings, operations.Write)
286+
allowed, err := am.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.Settings, operations.Update)
287287
if err != nil {
288288
return nil, fmt.Errorf("failed to validate user permissions: %w", err)
289289
}
@@ -533,7 +533,7 @@ func (am *DefaultAccountManager) DeleteAccount(ctx context.Context, accountID, u
533533
return err
534534
}
535535

536-
allowed, err := am.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.Accounts, operations.Write)
536+
allowed, err := am.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.Accounts, operations.Delete)
537537
if err != nil {
538538
return fmt.Errorf("failed to validate user permissions: %w", err)
539539
}

‎management/server/account/manager.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -59,15 +59,15 @@ type Manager interface {
5959
GetGroup(ctx context.Context, accountId, groupID, userID string) (*types.Group, error)
6060
GetAllGroups(ctx context.Context, accountID, userID string) ([]*types.Group, error)
6161
GetGroupByName(ctx context.Context, groupName, accountID string) (*types.Group, error)
62-
SaveGroup(ctx context.Context, accountID, userID string, group *types.Group) error
63-
SaveGroups(ctx context.Context, accountID, userID string, newGroups []*types.Group) error
62+
SaveGroup(ctx context.Context, accountID, userID string, group *types.Group, create bool) error
63+
SaveGroups(ctx context.Context, accountID, userID string, newGroups []*types.Group, create bool) error
6464
DeleteGroup(ctx context.Context, accountId, userId, groupID string) error
6565
DeleteGroups(ctx context.Context, accountId, userId string, groupIDs []string) error
6666
GroupAddPeer(ctx context.Context, accountId, groupID, peerID string) error
6767
GroupDeletePeer(ctx context.Context, accountId, groupID, peerID string) error
6868
GetPeerGroups(ctx context.Context, accountID, peerID string) ([]*types.Group, error)
6969
GetPolicy(ctx context.Context, accountID, policyID, userID string) (*types.Policy, error)
70-
SavePolicy(ctx context.Context, accountID, userID string, policy *types.Policy) (*types.Policy, error)
70+
SavePolicy(ctx context.Context, accountID, userID string, policy *types.Policy, create bool) (*types.Policy, error)
7171
DeletePolicy(ctx context.Context, accountID, policyID, userID string) error
7272
ListPolicies(ctx context.Context, accountID, userID string) ([]*types.Policy, error)
7373
GetRoute(ctx context.Context, accountID string, routeID route.ID, userID string) (*route.Route, error)
@@ -93,7 +93,7 @@ type Manager interface {
9393
HasConnectedChannel(peerID string) bool
9494
GetExternalCacheManager() ExternalCacheManager
9595
GetPostureChecks(ctx context.Context, accountID, postureChecksID, userID string) (*posture.Checks, error)
96-
SavePostureChecks(ctx context.Context, accountID, userID string, postureChecks *posture.Checks) (*posture.Checks, error)
96+
SavePostureChecks(ctx context.Context, accountID, userID string, postureChecks *posture.Checks, create bool) (*posture.Checks, error)
9797
DeletePostureChecks(ctx context.Context, accountID, postureChecksID, userID string) error
9898
ListPostureChecks(ctx context.Context, accountID, userID string) ([]*posture.Checks, error)
9999
GetIdpManager() idp.Manager

‎management/server/account_test.go‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1115,7 +1115,7 @@ func TestAccountManager_NetworkUpdates_SaveGroup(t *testing.T) {
11151115
Name: "GroupA",
11161116
Peers: []string{},
11171117
}
1118-
if err := manager.SaveGroup(context.Background(), account.Id, userID, &group); err != nil {
1118+
if err := manager.SaveGroup(context.Background(), account.Id, userID, &group, true); err != nil {
11191119
t.Errorf("save group: %v", err)
11201120
return
11211121
}
@@ -1131,7 +1131,7 @@ func TestAccountManager_NetworkUpdates_SaveGroup(t *testing.T) {
11311131
Action: types.PolicyTrafficActionAccept,
11321132
},
11331133
},
1134-
})
1134+
}, true)
11351135
require.NoError(t, err)
11361136

11371137
updMsg := manager.peersUpdateManager.CreateChannel(context.Background(), peer1.ID)
@@ -1150,7 +1150,7 @@ func TestAccountManager_NetworkUpdates_SaveGroup(t *testing.T) {
11501150
}()
11511151

11521152
group.Peers = []string{peer1.ID, peer2.ID, peer3.ID}
1153-
if err := manager.SaveGroup(context.Background(), account.Id, userID, &group); err != nil {
1153+
if err := manager.SaveGroup(context.Background(), account.Id, userID, &group, true); err != nil {
11541154
t.Errorf("save group: %v", err)
11551155
return
11561156
}
@@ -1192,7 +1192,7 @@ func TestAccountManager_NetworkUpdates_SavePolicy(t *testing.T) {
11921192
Name: "GroupA",
11931193
Peers: []string{peer1.ID, peer2.ID},
11941194
}
1195-
if err := manager.SaveGroup(context.Background(), account.Id, userID, &group); err != nil {
1195+
if err := manager.SaveGroup(context.Background(), account.Id, userID, &group, true); err != nil {
11961196
t.Errorf("save group: %v", err)
11971197
return
11981198
}
@@ -1223,7 +1223,7 @@ func TestAccountManager_NetworkUpdates_SavePolicy(t *testing.T) {
12231223
Action: types.PolicyTrafficActionAccept,
12241224
},
12251225
},
1226-
})
1226+
}, true)
12271227
if err != nil {
12281228
t.Errorf("delete default rule: %v", err)
12291229
return
@@ -1240,7 +1240,7 @@ func TestAccountManager_NetworkUpdates_DeletePeer(t *testing.T) {
12401240
Name: "GroupA",
12411241
Peers: []string{peer1.ID, peer3.ID},
12421242
}
1243-
if err := manager.SaveGroup(context.Background(), account.Id, userID, &group); err != nil {
1243+
if err := manager.SaveGroup(context.Background(), account.Id, userID, &group, true); err != nil {
12441244
t.Errorf("save group: %v", err)
12451245
return
12461246
}
@@ -1256,7 +1256,7 @@ func TestAccountManager_NetworkUpdates_DeletePeer(t *testing.T) {
12561256
Action: types.PolicyTrafficActionAccept,
12571257
},
12581258
},
1259-
})
1259+
}, true)
12601260
if err != nil {
12611261
t.Errorf("save policy: %v", err)
12621262
return
@@ -1295,7 +1295,7 @@ func TestAccountManager_NetworkUpdates_DeleteGroup(t *testing.T) {
12951295
ID: "groupA",
12961296
Name: "GroupA",
12971297
Peers: []string{peer1.ID, peer2.ID, peer3.ID},
1298-
})
1298+
}, true)
12991299

13001300
require.NoError(t, err, "failed to save group")
13011301

@@ -1315,7 +1315,7 @@ func TestAccountManager_NetworkUpdates_DeleteGroup(t *testing.T) {
13151315
Action: types.PolicyTrafficActionAccept,
13161316
},
13171317
},
1318-
})
1318+
}, true)
13191319
if err != nil {
13201320
t.Errorf("save policy: %v", err)
13211321
return

‎management/server/dns.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ func (am *DefaultAccountManager) SaveDNSSettings(ctx context.Context, accountID
8181
return status.Errorf(status.InvalidArgument, "the dns settings provided are nil")
8282
}
8383

84-
allowed, err := am.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.Dns, operations.Write)
84+
allowed, err := am.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.Dns, operations.Update)
8585
if err != nil {
8686
return status.NewPermissionValidationError(err)
8787
}

‎management/server/dns_test.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -504,7 +504,7 @@ func TestDNSAccountPeersUpdate(t *testing.T) {
504504
Name: "GroupB",
505505
Peers: []string{},
506506
},
507-
})
507+
}, true)
508508
assert.NoError(t, err)
509509

510510
updMsg := manager.peersUpdateManager.CreateChannel(context.Background(), peer1.ID)
@@ -564,7 +564,7 @@ func TestDNSAccountPeersUpdate(t *testing.T) {
564564
ID: "groupA",
565565
Name: "GroupA",
566566
Peers: []string{peer1.ID, peer2.ID, peer3.ID},
567-
})
567+
}, true)
568568
assert.NoError(t, err)
569569

570570
done := make(chan struct{})

‎management/server/group.go‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -66,17 +66,21 @@ func (am *DefaultAccountManager) GetGroupByName(ctx context.Context, groupName,
6666
}
6767

6868
// SaveGroup object of the peers
69-
func (am *DefaultAccountManager) SaveGroup(ctx context.Context, accountID, userID string, newGroup *types.Group) error {
69+
func (am *DefaultAccountManager) SaveGroup(ctx context.Context, accountID, userID string, newGroup *types.Group, create bool) error {
7070
unlock := am.Store.AcquireWriteLockByUID(ctx, accountID)
7171
defer unlock()
72-
return am.SaveGroups(ctx, accountID, userID, []*types.Group{newGroup})
72+
return am.SaveGroups(ctx, accountID, userID, []*types.Group{newGroup}, create)
7373
}
7474

7575
// SaveGroups adds new groups to the account.
7676
// Note: This function does not acquire the global lock.
7777
// It is the caller's responsibility to ensure proper locking is in place before invoking this method.
78-
func (am *DefaultAccountManager) SaveGroups(ctx context.Context, accountID, userID string, groups []*types.Group) error {
79-
allowed, err := am.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.Groups, operations.Write)
78+
func (am *DefaultAccountManager) SaveGroups(ctx context.Context, accountID, userID string, groups []*types.Group, create bool) error {
79+
operation := operations.Create
80+
if !create {
81+
operation = operations.Update
82+
}
83+
allowed, err := am.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.Groups, operation)
8084
if err != nil {
8185
return status.NewPermissionValidationError(err)
8286
}
@@ -203,7 +207,7 @@ func (am *DefaultAccountManager) DeleteGroup(ctx context.Context, accountID, use
203207
// If an error occurs while deleting a group, the function skips it and continues deleting other groups.
204208
// Errors are collected and returned at the end.
205209
func (am *DefaultAccountManager) DeleteGroups(ctx context.Context, accountID, userID string, groupIDs []string) error {
206-
allowed, err := am.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.Groups, operations.Write)
210+
allowed, err := am.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.Groups, operations.Delete)
207211
if err != nil {
208212
return status.NewPermissionValidationError(err)
209213
}

‎management/server/group_test.go‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -40,23 +40,23 @@ func TestDefaultAccountManager_CreateGroup(t *testing.T) {
4040
}
4141
for _, group := range account.Groups {
4242
group.Issued = types.GroupIssuedIntegration
43-
err = am.SaveGroup(context.Background(), account.Id, groupAdminUserID, group)
43+
err = am.SaveGroup(context.Background(), account.Id, groupAdminUserID, group, true)
4444
if err != nil {
4545
t.Errorf("should allow to create %s groups", types.GroupIssuedIntegration)
4646
}
4747
}
4848

4949
for _, group := range account.Groups {
5050
group.Issued = types.GroupIssuedJWT
51-
err = am.SaveGroup(context.Background(), account.Id, groupAdminUserID, group)
51+
err = am.SaveGroup(context.Background(), account.Id, groupAdminUserID, group, true)
5252
if err != nil {
5353
t.Errorf("should allow to create %s groups", types.GroupIssuedJWT)
5454
}
5555
}
5656
for _, group := range account.Groups {
5757
group.Issued = types.GroupIssuedAPI
5858
group.ID = ""
59-
err = am.SaveGroup(context.Background(), account.Id, groupAdminUserID, group)
59+
err = am.SaveGroup(context.Background(), account.Id, groupAdminUserID, group, true)
6060
if err == nil {
6161
t.Errorf("should not create api group with the same name, %s", group.Name)
6262
}
@@ -162,7 +162,7 @@ func TestDefaultAccountManager_DeleteGroups(t *testing.T) {
162162
}
163163
}
164164

165-
err = manager.SaveGroups(context.Background(), account.Id, groupAdminUserID, groups)
165+
err = manager.SaveGroups(context.Background(), account.Id, groupAdminUserID, groups, true)
166166
assert.NoError(t, err, "Failed to save test groups")
167167

168168
testCases := []struct {
@@ -382,13 +382,13 @@ func initTestGroupAccount(am *DefaultAccountManager) (*DefaultAccountManager, *t
382382
return nil, nil, err
383383
}
384384

385-
_ = am.SaveGroup(context.Background(), accountID, groupAdminUserID, groupForRoute)
386-
_ = am.SaveGroup(context.Background(), accountID, groupAdminUserID, groupForRoute2)
387-
_ = am.SaveGroup(context.Background(), accountID, groupAdminUserID, groupForNameServerGroups)
388-
_ = am.SaveGroup(context.Background(), accountID, groupAdminUserID, groupForPolicies)
389-
_ = am.SaveGroup(context.Background(), accountID, groupAdminUserID, groupForSetupKeys)
390-
_ = am.SaveGroup(context.Background(), accountID, groupAdminUserID, groupForUsers)
391-
_ = am.SaveGroup(context.Background(), accountID, groupAdminUserID, groupForIntegration)
385+
_ = am.SaveGroup(context.Background(), accountID, groupAdminUserID, groupForRoute, true)
386+
_ = am.SaveGroup(context.Background(), accountID, groupAdminUserID, groupForRoute2, true)
387+
_ = am.SaveGroup(context.Background(), accountID, groupAdminUserID, groupForNameServerGroups, true)
388+
_ = am.SaveGroup(context.Background(), accountID, groupAdminUserID, groupForPolicies, true)
389+
_ = am.SaveGroup(context.Background(), accountID, groupAdminUserID, groupForSetupKeys, true)
390+
_ = am.SaveGroup(context.Background(), accountID, groupAdminUserID, groupForUsers, true)
391+
_ = am.SaveGroup(context.Background(), accountID, groupAdminUserID, groupForIntegration, true)
392392

393393
acc, err := am.Store.GetAccount(context.Background(), account.Id)
394394
if err != nil {
@@ -426,7 +426,7 @@ func TestGroupAccountPeersUpdate(t *testing.T) {
426426
Name: "GroupE",
427427
Peers: []string{peer2.ID},
428428
},
429-
})
429+
}, true)
430430
assert.NoError(t, err)
431431

432432
updMsg := manager.peersUpdateManager.CreateChannel(context.Background(), peer1.ID)
@@ -446,7 +446,7 @@ func TestGroupAccountPeersUpdate(t *testing.T) {
446446
ID: "groupB",
447447
Name: "GroupB",
448448
Peers: []string{peer1.ID, peer2.ID},
449-
})
449+
}, true)
450450
assert.NoError(t, err)
451451

452452
select {
@@ -524,7 +524,7 @@ func TestGroupAccountPeersUpdate(t *testing.T) {
524524
Action: types.PolicyTrafficActionAccept,
525525
},
526526
},
527-
})
527+
}, true)
528528
assert.NoError(t, err)
529529

530530
// Saving a group linked to policy should update account peers and send peer update
@@ -539,7 +539,7 @@ func TestGroupAccountPeersUpdate(t *testing.T) {
539539
ID: "groupA",
540540
Name: "GroupA",
541541
Peers: []string{peer1.ID, peer2.ID},
542-
})
542+
}, true)
543543
assert.NoError(t, err)
544544

545545
select {
@@ -608,7 +608,7 @@ func TestGroupAccountPeersUpdate(t *testing.T) {
608608
ID: "groupC",
609609
Name: "GroupC",
610610
Peers: []string{peer1.ID, peer3.ID},
611-
})
611+
}, true)
612612
assert.NoError(t, err)
613613

614614
select {
@@ -649,7 +649,7 @@ func TestGroupAccountPeersUpdate(t *testing.T) {
649649
ID: "groupA",
650650
Name: "GroupA",
651651
Peers: []string{peer1.ID, peer2.ID, peer3.ID},
652-
})
652+
}, true)
653653
assert.NoError(t, err)
654654

655655
select {
@@ -676,7 +676,7 @@ func TestGroupAccountPeersUpdate(t *testing.T) {
676676
ID: "groupD",
677677
Name: "GroupD",
678678
Peers: []string{peer1.ID},
679-
})
679+
}, true)
680680
assert.NoError(t, err)
681681

682682
select {
@@ -723,7 +723,7 @@ func TestGroupAccountPeersUpdate(t *testing.T) {
723723
ID: "groupE",
724724
Name: "GroupE",
725725
Peers: []string{peer2.ID, peer3.ID},
726-
})
726+
}, true)
727727
assert.NoError(t, err)
728728

729729
select {

‎management/server/groups/manager.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ func (m *managerImpl) GetAllGroupsMap(ctx context.Context, accountID, userID str
7272
}
7373

7474
func (m *managerImpl) AddResourceToGroup(ctx context.Context, accountID, userID, groupID string, resource *types.Resource) error {
75-
ok, err := m.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.Groups, operations.Write)
75+
ok, err := m.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.Groups, operations.Update)
7676
if err != nil {
7777
return err
7878
}

‎management/server/http/handlers/groups/groups_handler.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -143,7 +143,7 @@ func (h *handler) updateGroup(w http.ResponseWriter, r *http.Request) {
143143
IntegrationReference: existingGroup.IntegrationReference,
144144
}
145145

146-
if err := h.accountManager.SaveGroup(r.Context(), accountID, userID, &group); err != nil {
146+
if err := h.accountManager.SaveGroup(r.Context(), accountID, userID, &group, false); err != nil {
147147
log.WithContext(r.Context()).Errorf("failed updating group %s under account %s %v", groupID, accountID, err)
148148
util.WriteError(r.Context(), err, w)
149149
return
@@ -203,7 +203,7 @@ func (h *handler) createGroup(w http.ResponseWriter, r *http.Request) {
203203
Issued: types.GroupIssuedAPI,
204204
}
205205

206-
err = h.accountManager.SaveGroup(r.Context(), accountID, userID, &group)
206+
err = h.accountManager.SaveGroup(r.Context(), accountID, userID, &group, true)
207207
if err != nil {
208208
util.WriteError(r.Context(), err, w)
209209
return

‎management/server/http/handlers/groups/groups_handler_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ var TestPeers = map[string]*nbpeer.Peer{
3535
func initGroupTestData(initGroups ...*types.Group) *handler {
3636
return &handler{
3737
accountManager: &mock_server.MockAccountManager{
38-
SaveGroupFunc: func(_ context.Context, accountID, userID string, group *types.Group) error {
38+
SaveGroupFunc: func(_ context.Context, accountID, userID string, group *types.Group, create bool) error {
3939
if !strings.HasPrefix(group.ID, "id-") {
4040
group.ID = "id-was-set"
4141
}

0 commit comments

Comments
 (0)