Skip to content

Commit 85d9f0a

Browse files
krtkvrmkrtkvrm
authored
feat: add db migration for resource id (#97)
* feat: add db migration for resource id * feat: use id for resource throughout * fix: add error handling
1 parent 6265f2b commit 85d9f0a

23 files changed

+835
-762
lines changed

‎api/handler/v1beta1/resource.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -181,7 +181,8 @@ func transformResourceToPB(from model.Resource) (shieldv1beta1.Resource, error)
181181
}
182182

183183
return shieldv1beta1.Resource{
184-
Id: from.Id,
184+
Id: from.Idxa,
185+
Urn: from.Urn,
185186
Name: from.Name,
186187
Namespace: &namespace,
187188
Organization: &org,

‎buf.gen.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
#!/usr/bin/env -S buf generate buf.build/odpf/proton:50f3663dc011ea70cf65886bfebd28774ceb740a --path odpf/shield --template
1+
#!/usr/bin/env -S buf generate buf.build/odpf/proton:6e1e1020ca1ea2cd440d5e1417470af31c91c76a --path odpf/shield --template
22
---
33
version: "v1"
44
plugins:

‎cmd/serve.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,7 @@ func serve(logger log.Logger, appConfig *config.Shield) error {
9494
Store: serviceStore,
9595
IdentityProxyHeader: appConfig.App.IdentityProxyHeader,
9696
ResourcesRepository: resourceConfig,
97-
})
97+
}, serviceStore)
9898

9999
cleanUpFunc, cleanUpProxies, err = startProxy(logger, appConfig, ctx, deps, cleanUpFunc, cleanUpProxies, AuthzCheckService)
100100
if err != nil {
@@ -315,7 +315,7 @@ func apiDependencies(ctx context.Context, db *sql.SQL, appConfig *config.Shield,
315315
ActionService: schemaService,
316316
NamespaceService: schemaService,
317317
IdentityProxyHeader: appConfig.App.IdentityProxyHeader,
318-
PermissionCheckService: permission.NewCheckService(permissions),
318+
PermissionCheckService: permission.NewCheckService(permissions, serviceStore),
319319
},
320320
}
321321
return dependencies, nil

‎hook/authz/authz.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -179,7 +179,7 @@ func (a Authz) ServeHook(res *http.Response, err error) (*http.Response, error)
179179
a.log.Error(err.Error())
180180
return a.escape.ServeHook(res, fmt.Errorf(err.Error()))
181181
}
182-
a.log.Info(fmt.Sprintf("Resource %s created", newResource.Id))
182+
a.log.Info(fmt.Sprintf("Resource %s created with ID %s", newResource.Urn, newResource.Idxa))
183183
}
184184

185185
return a.next.ServeHook(res, nil)

‎internal/group/groups.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ func (s Service) AddUsersToGroup(ctx context.Context, groupId string, userIds []
9595
}
9696

9797
isAuthorized, err := s.Permissions.CheckPermission(ctx, currentUser, model.Resource{
98-
Id: groupId,
98+
Idxa: groupId,
9999
Namespace: definition.TeamNamespace,
100100
},
101101
definition.ManageTeamAction,
@@ -137,7 +137,7 @@ func (s Service) RemoveUserFromGroup(ctx context.Context, groupId string, userId
137137
}
138138

139139
isAuthorized, err := s.Permissions.CheckPermission(ctx, currentUser, model.Resource{
140-
Id: groupId,
140+
Idxa: groupId,
141141
Namespace: definition.TeamNamespace,
142142
},
143143
definition.ManageTeamAction,
@@ -194,7 +194,7 @@ func (s Service) AddAdminsToGroup(ctx context.Context, groupId string, userIds [
194194
}
195195

196196
isAuthorized, err := s.Permissions.CheckPermission(ctx, currentUser, model.Resource{
197-
Id: groupId,
197+
Idxa: groupId,
198198
Namespace: definition.TeamNamespace,
199199
},
200200
definition.ManageTeamAction,
@@ -241,7 +241,7 @@ func (s Service) RemoveAdminFromGroup(ctx context.Context, groupId string, userI
241241
}
242242

243243
isAuthorized, err := s.Permissions.CheckPermission(ctx, currentUser, model.Resource{
244-
Id: groupId,
244+
Idxa: groupId,
245245
Namespace: definition.TeamNamespace,
246246
},
247247
definition.ManageTeamAction,

‎internal/org/org.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ func (s Service) AddAdmin(ctx context.Context, id string, userIds []string) ([]m
8282
}
8383

8484
isAuthorized, err := s.Permissions.CheckPermission(ctx, currentUser, model.Resource{
85-
Id: id,
85+
Idxa: id,
8686
Namespace: definition.OrgNamespace,
8787
},
8888
definition.ManageOrganizationAction,
@@ -128,7 +128,7 @@ func (s Service) RemoveAdmin(ctx context.Context, id string, userId string) ([]m
128128
}
129129

130130
isAuthorized, err := s.Permissions.CheckPermission(ctx, currentUser, model.Resource{
131-
Id: id,
131+
Idxa: id,
132132
Namespace: definition.OrgNamespace,
133133
},
134134
definition.ManageOrganizationAction,

‎internal/permission/check.go‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,15 @@ import (
99

1010
type CheckService struct {
1111
PermissionsService Permissions
12+
ResourceStore ResourceStore
1213
}
1314

14-
func NewCheckService(permissionService Permissions) CheckService {
15-
return CheckService{PermissionsService: permissionService}
15+
type ResourceStore interface {
16+
GetResourceByURN(ctx context.Context, urn string) (model.Resource, error)
17+
}
18+
19+
func NewCheckService(permissionService Permissions, resourceStore ResourceStore) CheckService {
20+
return CheckService{PermissionsService: permissionService, ResourceStore: resourceStore}
1621
}
1722

1823
func (c CheckService) CheckAuthz(ctx context.Context, resource model.Resource, action model.Action) (bool, error) {
@@ -21,6 +26,11 @@ func (c CheckService) CheckAuthz(ctx context.Context, resource model.Resource, a
2126
return false, err
2227
}
2328

24-
resource.Id = utils.CreateResourceId(resource)
25-
return c.PermissionsService.CheckPermission(ctx, user, resource, action)
29+
resource.Urn = utils.CreateResourceURN(resource)
30+
fetchedResource, err := c.ResourceStore.GetResourceByURN(ctx, resource.Urn)
31+
if err != nil {
32+
return false, err
33+
}
34+
35+
return c.PermissionsService.CheckPermission(ctx, user, fetchedResource, action)
2636
}

‎internal/permission/relation.go‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -222,7 +222,7 @@ func (s Service) AddProjectToResource(ctx context.Context, project model.Project
222222

223223
rel := model.Relation{
224224
ObjectNamespace: resourceNS,
225-
ObjectId: resource.Id,
225+
ObjectId: resource.Idxa,
226226
SubjectId: project.Id,
227227
SubjectNamespace: definition.ProjectNamespace,
228228
Role: model.Role{
@@ -241,7 +241,7 @@ func (s Service) AddOrgToResource(ctx context.Context, org model.Organization, r
241241

242242
rel := model.Relation{
243243
ObjectNamespace: resourceNS,
244-
ObjectId: resource.Id,
244+
ObjectId: resource.Idxa,
245245
SubjectId: org.Id,
246246
SubjectNamespace: definition.OrgNamespace,
247247
Role: model.Role{
@@ -260,7 +260,7 @@ func (s Service) AddTeamToResource(ctx context.Context, team model.Group, resour
260260

261261
rel := model.Relation{
262262
ObjectNamespace: resourceNS,
263-
ObjectId: resource.Id,
263+
ObjectId: resource.Idxa,
264264
SubjectId: team.Id,
265265
SubjectNamespace: definition.TeamNamespace,
266266
Role: model.Role{
@@ -279,7 +279,7 @@ func (s Service) CheckPermission(ctx context.Context, user model.User, resource
279279

280280
rel := model.Relation{
281281
ObjectNamespace: resourceNS,
282-
ObjectId: resource.Id,
282+
ObjectId: resource.Idxa,
283283
SubjectId: user.Id,
284284
SubjectNamespace: definition.UserNamespace,
285285
}
@@ -307,7 +307,7 @@ func (s Service) AddOwnerToResource(ctx context.Context, user model.User, resour
307307

308308
rel := model.Relation{
309309
ObjectNamespace: resourceNS,
310-
ObjectId: resource.Id,
310+
ObjectId: resource.Idxa,
311311
SubjectId: user.Id,
312312
SubjectNamespace: definition.UserNamespace,
313313
Role: role,

‎internal/project/project.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@ func (s Service) AddAdmin(ctx context.Context, id string, userIds []string) ([]m
9090
}
9191

9292
isAuthorized, err := s.Permissions.CheckPermission(ctx, currentUser, model.Resource{
93-
Id: id,
93+
Idxa: id,
9494
Namespace: definition.ProjectNamespace,
9595
},
9696
definition.ManageProjectAction,
@@ -136,7 +136,7 @@ func (s Service) RemoveAdmin(ctx context.Context, id string, userId string) ([]m
136136
}
137137

138138
isAuthorized, err := s.Permissions.CheckPermission(ctx, currentUser, model.Resource{
139-
Id: id,
139+
Idxa: id,
140140
Namespace: definition.ProjectNamespace,
141141
},
142142
definition.ManageProjectAction,

‎internal/resource/resource.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ func (s Service) Get(ctx context.Context, id string) (model.Resource, error) {
3131
}
3232

3333
func (s Service) Create(ctx context.Context, resource model.Resource) (model.Resource, error) {
34-
id := utils.CreateResourceId(resource)
34+
urn := utils.CreateResourceURN(resource)
3535

3636
user, err := s.Permissions.FetchCurrentUser(ctx)
3737

@@ -46,7 +46,7 @@ func (s Service) Create(ctx context.Context, resource model.Resource) (model.Res
4646
}
4747

4848
newResource, err := s.Store.CreateResource(ctx, model.Resource{
49-
Id: id,
49+
Urn: urn,
5050
Name: resource.Name,
5151
OrganizationId: resource.OrganizationId,
5252
ProjectId: resource.ProjectId,

0 commit comments

Comments
 (0)