rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update RBAC on console

Browse Source 
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
This commit is contained in:
Bryan Frimin
2025-12-23 09:04:26 +01:00
parent 72831d4c2b
commit e9ac50d91c
26 changed files with 2123 additions and 1444 deletions
Download Patch File Download Diff File Expand all files Collapse all files

359
pkg/coredata/api_key_membership.go
View File

@@ -1,359 +0,0 @@
// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package coredata
import (
"context"
"fmt"
"maps"
"time"
"github.com/jackc/pgx/v5"
"go.gearno.de/kit/pg"
"go.probo.inc/probo/pkg/gid"
)
type (
PersonalAPIKeyMembership struct {
ID gid.GID `db:"id"`
PersonalAPIKeyID gid.GID `db:"personal_api_key_id"`
MembershipID gid.GID `db:"membership_id"`
Role APIRole `db:"role"`
OrganizationID gid.GID `db:"organization_id"`
OrganizationName string `db:"organization_name"`
CreatedAt time.Time `db:"created_at"`
UpdatedAt time.Time `db:"updated_at"`
}
PersonalAPIKeyMemberships []*PersonalAPIKeyMembership
)
func (a *PersonalAPIKeyMembership) Insert(
ctx context.Context,
conn pg.Conn,
scope Scoper,
) error {
q := `
INSERT INTO
iam_personal_api_key_memberships (id, tenant_id, personal_api_key_id, membership_id, role, organization_id, created_at, updated_at)
VALUES (
@id,
@tenant_id,
@personal_api_key_id,
@membership_id,
@role,
@organization_id,
@created_at,
@updated_at
)
`
args := pgx.StrictNamedArgs{
"id": a.ID,
"tenant_id": scope.GetTenantID(),
"personal_api_key_id": a.PersonalAPIKeyID,
"membership_id": a.MembershipID,
"role": a.Role,
"organization_id": a.OrganizationID,
"created_at": a.CreatedAt,
"updated_at": a.UpdatedAt,
}
_, err := conn.Exec(ctx, q, args)
if err != nil {
return fmt.Errorf("cannot insert personal api key membership: %w", err)
}
return nil
}
func (a *PersonalAPIKeyMemberships) LoadByPersonalAPIKeyID(
ctx context.Context,
conn pg.Conn,
scope Scoper,
personalAPIKeyID gid.GID,
) error {
q := `
SELECT
akm.id,
akm.personal_api_key_id,
akm.membership_id,
akm.role,
akm.created_at,
akm.updated_at,
m.organization_id,
o.name as organization_name
FROM
iam_personal_api_key_memberships akm
JOIN
iam_memberships m ON akm.membership_id = m.id
JOIN
organizations o ON m.organization_id = o.id
WHERE
akm.personal_api_key_id = @personal_api_key_id
AND m.%s
ORDER BY akm.created_at DESC
`
q = fmt.Sprintf(q, scope.SQLFragment())
args := pgx.StrictNamedArgs{
"personal_api_key_id": personalAPIKeyID,
}
maps.Copy(args, scope.SQLArguments())
rows, err := conn.Query(ctx, q, args)
if err != nil {
return fmt.Errorf("cannot query personal api key memberships: %w", err)
}
memberships, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[PersonalAPIKeyMembership])
if err != nil {
return fmt.Errorf("cannot collect personal api key memberships: %w", err)
}
*a = memberships
return nil
}
// LoadRoleByAPIKeyAndEntityID loads an API key's role by querying any entity to extract its organization_id
func (a *PersonalAPIKeyMembership) LoadRoleByAPIKeyAndEntityID(
ctx context.Context,
conn pg.Conn,
scope Scoper,
apiKeyID gid.GID,
entityID gid.GID,
) error {
entityType := entityID.EntityType()
// For organization, the entity ID is the organization ID
if entityType == OrganizationEntityType {
return a.LoadByAPIKeyIDAndOrganizationID(ctx, conn, scope, apiKeyID, entityID)
}
tableName, ok := EntityTable(entityType)
if !ok {
return fmt.Errorf("unsupported entity type for API key role lookup: %d", entityType)
}
query := fmt.Sprintf(`
SELECT
akm.id,
akm.personal_api_key_id,
akm.membership_id,
akm.role,
akm.created_at,
akm.updated_at
FROM
iam_personal_api_key_memberships akm
INNER JOIN iam_memberships m ON m.id = akm.membership_id
INNER JOIN %s e ON e.id = @entity_id
WHERE
%s
AND akm.personal_api_key_id = @api_key_id
AND m.organization_id = e.organization_id
LIMIT 1;
`, tableName, scope.SQLFragment())
args := pgx.NamedArgs{
"api_key_id": apiKeyID,
"entity_id": entityID,
}
maps.Copy(args, scope.SQLArguments())
rows, err := conn.Query(ctx, query, args)
if err != nil {
return fmt.Errorf("cannot query API key membership by entity: %w", err)
}
defer rows.Close()
if !rows.Next() {
return fmt.Errorf("API key membership not found for key %s and entity %s", apiKeyID, entityID)
}
var membership PersonalAPIKeyMembership
err = rows.Scan(
&membership.ID,
&membership.PersonalAPIKeyID,
&membership.MembershipID,
&membership.Role,
&membership.CreatedAt,
&membership.UpdatedAt,
)
if err != nil {
return fmt.Errorf("cannot scan API key membership: %w", err)
}
*a = membership
return nil
}
func (a *PersonalAPIKeyMembership) LoadByAPIKeyIDAndOrganizationID(
ctx context.Context,
conn pg.Conn,
scope Scoper,
apiKeyID gid.GID,
organizationID gid.GID,
) error {
q := `
SELECT
akm.id,
akm.personal_api_key_id,
akm.membership_id,
akm.role,
akm.created_at,
akm.updated_at,
m.organization_id,
o.name as organization_name
FROM
iam_personal_api_key_memberships akm
JOIN
iam_memberships m ON akm.membership_id = m.id
JOIN
organizations o ON m.organization_id = o.id
WHERE
akm.personal_api_key_id = @api_key_id
AND m.organization_id = @organization_id
AND m.%s
`
q = fmt.Sprintf(q, scope.SQLFragment())
args := pgx.StrictNamedArgs{
"api_key_id": apiKeyID,
"organization_id": organizationID,
}
maps.Copy(args, scope.SQLArguments())
rows, err := conn.Query(ctx, q, args)
if err != nil {
return fmt.Errorf("cannot query personal api key membership: %w", err)
}
membership, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[PersonalAPIKeyMembership])
if err != nil {
if err == pgx.ErrNoRows {
return fmt.Errorf("API key does not have access to organization")
}
return fmt.Errorf("cannot collect personal api key membership: %w", err)
}
*a = membership
return nil
}
func (a *PersonalAPIKeyMembership) Delete(
ctx context.Context,
conn pg.Conn,
scope Scoper,
) error {
q := `
DELETE FROM
iam_personal_api_key_memberships
WHERE
id = @id
AND %s
`
q = fmt.Sprintf(q, scope.SQLFragment())
args := pgx.StrictNamedArgs{
"id": a.ID,
}
maps.Copy(args, scope.SQLArguments())
_, err := conn.Exec(ctx, q, args)
if err != nil {
return fmt.Errorf("cannot delete personal api key membership: %w", err)
}
return nil
}
func (a *PersonalAPIKeyMemberships) LoadByMembershipID(
ctx context.Context,
conn pg.Conn,
scope Scoper,
membershipID gid.GID,
) error {
q := `
SELECT
akm.id,
akm.personal_api_key_id,
akm.membership_id,
akm.role,
akm.created_at,
akm.updated_at,
m.organization_id,
o.name as organization_name
FROM
iam_personal_api_key_memberships akm
JOIN
iam_memberships m ON akm.membership_id = m.id
JOIN
organizations o ON m.organization_id = o.id
WHERE
akm.membership_id = @membership_id
AND m.%s
ORDER BY akm.created_at DESC
`
q = fmt.Sprintf(q, scope.SQLFragment())
args := pgx.StrictNamedArgs{
"membership_id": membershipID,
}
maps.Copy(args, scope.SQLArguments())
rows, err := conn.Query(ctx, q, args)
if err != nil {
return fmt.Errorf("cannot query personal api key memberships by membership id: %w", err)
}
memberships, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[PersonalAPIKeyMembership])
if err != nil {
return fmt.Errorf("cannot collect personal api key memberships: %w", err)
}
*a = memberships
return nil
}
func DeleteAllPersonalAPIKeyMembershipsByPersonalAPIKeyID(
ctx context.Context,
conn pg.Conn,
personalAPIKeyID gid.GID,
) error {
q := `
DELETE FROM
iam_personal_api_key_memberships
WHERE
personal_api_key_id = @personal_api_key_id
`
args := pgx.StrictNamedArgs{
"personal_api_key_id": personalAPIKeyID,
}
_, err := conn.Exec(ctx, q, args)
if err != nil {
return fmt.Errorf("cannot delete personal api key memberships: %w", err)
}
return nil
}

54
pkg/coredata/api_role.go
View File

@@ -1,54 +0,0 @@
// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package coredata
import (
"database/sql/driver"
"fmt"
)
type APIRole string
const (
APIRoleFull APIRole = "FULL"
)
func (r APIRole) String() string {
return string(r)
}
func (r *APIRole) Scan(value any) error {
var s string
switch v := value.(type) {
case string:
s = v
case []byte:
s = string(v)
default:
return fmt.Errorf("unsupported type for APIRole: %T", value)
}
switch s {
case "FULL":
*r = APIRoleFull
default:
return fmt.Errorf("invalid APIRole value: %q", s)
}
return nil
}
func (r APIRole) Value() (driver.Value, error) {
return r.String(), nil
}

6
pkg/coredata/entity_type_reg.go
View File

@@ -65,7 +65,7 @@ const (
TrustCenterFileEntityType uint16 = 41
SAMLConfigurationEntityType uint16 = 42
PersonalAPIKeyEntityType uint16 = 43
PersonalAPIKeyMembershipEntityType uint16 = 44
_ uint16 = 44 // PersonalAPIKeyMembershipEntityType - removed
MeetingEntityType uint16 = 45
DataProtectionImpactAssessmentEntityType uint16 = 46
TransferImpactAssessmentEntityType uint16 = 47
@@ -257,10 +257,6 @@ var entityRegistry = map[uint16]EntityInfo{
Model: "PersonalAPIKey",
Table: "iam_personal_api_keys",
},
PersonalAPIKeyMembershipEntityType: {
Model: "PersonalAPIKeyMembership",
Table: "iam_personal_api_key_memberships",
},
MeetingEntityType: {
Model: "Meeting",
Table: "meetings",

3
pkg/coredata/migrations/20251222T150000Z.sql Normal file
View File

@@ -0,0 +1,3 @@
DELETE FROM iam_personal_api_key_memberships;
DROP TABLE iam_personal_api_key_memberships;