public/mailtrain
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Computation of permissions seems to somehow work.

Browse source
This commit is contained in:
Tomas Bures 2017-07-25 02:14:17 +03:00
parent e7bdfb7745
commit 5df444f641
12 changed files with 286 additions and 133 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
client/src/lib/page.js
View file

@ -210,7 +210,8 @@ class SectionContent extends Component {
errorHandler(error) {
if (error instanceof interoperableErrors.NotLoggedInError) {
this.ensureAuthenticated();
/* FIXME, once we turn Mailtrain to single-page application, this should become navigateTo */
window.location = '/account/login?next=' + encodeURIComponent(this.props.root);
} else if (error.response && error.response.data && error.response.data.message) {
console.error(error);
this.navigateToWithFlashMessage(this.props.root, 'danger', error.response.data.message);

4
client/src/namespaces/List.js
View file

@ -20,6 +20,10 @@ export default class List extends Component {
{
label: 'Edit',
link: '/namespaces/edit/' + key
},
{
label: 'Share',
link: '/namespaces/share/' + key
}
];

6
client/src/namespaces/root.js
View file

@ -8,6 +8,7 @@ import i18n from '../lib/i18n';
import { Section } from '../lib/page';
import CUD from './CUD';
import List from './List';
import Share from '../shares/Share';
const getStructure = t => ({
'': {
@ -27,6 +28,11 @@ const getStructure = t => ({
create : {
title: t('Create Namespace'),
render: props => (<CUD {...props} />)
},
share: {
title: t('Share Namespace'),
params: [':id'],
render: props => (<Share title={entity => t('Share Namespace "{{name}}"', {name: entity.name})} getUrl={id => `/rest/namespaces/${id}`} entityTypeId="namespace" {...props} />)
}
}
}

4
client/src/reports/List.js
View file

@ -88,6 +88,10 @@ export default class List extends Component {
{
label: <span className="glyphicon glyphicon-wrench" aria-hidden="true" title="Edit"></span>,
link: `/reports/edit/${id}`
},
{
label: <span className="glyphicon glyphicon-share" aria-hidden="true" title="Share"></span>,
link: `/reports/share/${id}`
}
]
};

5
client/src/reports/root.js
View file

@ -47,6 +47,11 @@ const getStructure = t => {
params: [':id' ],
render: props => (<ReportsOutput {...props} />)
},
share: {
title: t('Share Report'),
params: [':id'],
render: props => (<Share title={entity => t('Share Report "{{name}}"', {name: entity.name})} getUrl={id => `/rest/reports/${id}`} entityTypeId="report" {...props} />)
},
'templates': {
title: t('Templates'),
link: '/reports/templates',

33
config/default.toml
View file

@ -193,16 +193,23 @@ name="Master"
description="All permissions"
permissions=["view", "edit", "delete"]
#[roles.list.master]
#name="Master"
#description="All permissions"
#permissions=["view"]
#
#[roles.namespace.master]
#name="Master"
#description="All permissions"
#permissions=["view", "edit", "create", "delete", "create list"]
#
#[roles.namespace.master.childperms]
#list=["view"]
#namespace=["view", "edit", "create", "delete", "create list"]
[roles.report.master]
name="Master"
description="All permissions"
permissions=["view", "edit", "delete"]
[roles.list.master]
name="Master"
description="All permissions"
permissions=["view"]
[roles.namespace.master]
name="Master"
description="All permissions"
permissions=["view", "edit", "create", "delete", "create list"]
[roles.namespace.master.childperms]
reportTemplate=["view", "edit", "delete"]
report=["view", "edit", "delete"]
list=["view"]
namespace=["view", "edit", "create", "delete", "create list"]

6
models/namespaces.js
View file

@ -4,6 +4,7 @@ const knex = require('../lib/knex');
const hasher = require('node-object-hash')();
const { enforce, filterObject } = require('../lib/helpers');
const interoperableErrors = require('../shared/interoperable-errors');
const shares = require('./shares');
const allowedKeys = new Set(['name', 'description', 'namespace']);
@ -34,6 +35,9 @@ async function create(entity) {
}
}
// We don't have to rebuild all entity types, because no entity can be a child of the namespace at this moment.
await shares.rebuildPermissions(tx, { entityTypeId: 'namespace', entityId: id });
return id;
});
}
@ -66,6 +70,8 @@ async function updateWithConsistencyCheck(entity) {
}
await tx('namespaces').where('id', entity.id).update(filterObject(entity, allowedKeys));
await shares.rebuildPermissions(tx);
});
}

7
models/report-templates.js
View file

@ -6,6 +6,7 @@ const { enforce, filterObject } = require('../lib/helpers');
const dtHelpers = require('../lib/dt-helpers');
const interoperableErrors = require('../shared/interoperable-errors');
const namespaceHelpers = require('../lib/namespace-helpers');
const shares = require('./shares');
const allowedKeys = new Set(['name', 'description', 'mime_type', 'user_fields', 'js', 'hbs', 'namespace']);
@ -33,7 +34,11 @@ async function listDTAjax(params) {
async function create(entity) {
await knex.transaction(async tx => {
await namespaceHelpers.validateEntity(tx, entity);
const id = await tx('report_templates').insert(filterObject(entity, allowedKeys));
await shares.rebuildPermissions(tx, { entityTypeId: 'reportTemplate', entityId: id });
return id;
});
}
@ -53,6 +58,8 @@ async function updateWithConsistencyCheck(entity) {
await namespaceHelpers.validateEntity(tx, entity);
await tx('report_templates').where('id', entity.id).update(filterObject(entity, allowedKeys));
await shares.rebuildPermissions(tx, { entityTypeId: 'reportTemplate', entityId: entity.id });
});
}

5
models/reports.js
View file

@ -7,6 +7,7 @@ const dtHelpers = require('../lib/dt-helpers');
const interoperableErrors = require('../shared/interoperable-errors');
const fields = require('./fields');
const namespaceHelpers = require('../lib/namespace-helpers');
const shares = require('./shares');
const ReportState = require('../shared/reports').ReportState;
@ -56,6 +57,8 @@ async function create(entity) {
entity.params = JSON.stringify(entity.params);
id = await tx('reports').insert(filterObject(entity, allowedKeys));
await shares.rebuildPermissions(tx, { entityTypeId: 'report', entityId: id });
});
const reportProcessor = require('../lib/report-processor');
@ -89,6 +92,8 @@ async function updateWithConsistencyCheck(entity) {
filteredUpdates.state = ReportState.SCHEDULED;
await tx('reports').where('id', entity.id).update(filteredUpdates);
await shares.rebuildPermissions(tx, { entityTypeId: 'report', entityId: entity.id });
});
// This require is here to avoid cyclic dependency

200
models/shares.js
View file

@ -7,11 +7,21 @@ const dtHelpers = require('../lib/dt-helpers');
const interoperableErrors = require('../shared/interoperable-errors');
const entityTypes = {
reportTemplate: {
entitiesTable: 'report_templates',
sharesTable: 'shares_report_template',
permissionsTable: 'permissions_report_template'
}
namespace: {
entitiesTable: 'namespaces',
sharesTable: 'shares_namespace',
permissionsTable: 'permissions_namespace'
},
report: {
entitiesTable: 'reports',
sharesTable: 'shares_report',
permissionsTable: 'permissions_report'
},
reportTemplate: {
entitiesTable: 'report_templates',
sharesTable: 'shares_report_template',
permissionsTable: 'permissions_report_template'
}
};
function getEntityType(entityTypeId) {
@ -26,14 +36,14 @@ function getEntityType(entityTypeId) {
async function listDTAjax(entityTypeId, entityId, params) {
const entityType = getEntityType(entityTypeId);
return await dtHelpers.ajaxList(params, tx => tx(entityType.sharesTable).innerJoin('users', entityType.sharesTable + '.user', 'users.id'), [entityType.sharesTable + '.id', 'users.username', 'users.name', entityType.sharesTable + '.role', 'users.id']);
return await dtHelpers.ajaxList(params, tx => tx(entityType.sharesTable).innerJoin('users', entityType.sharesTable + '.user', 'users.id').where(`${entityType.sharesTable}.entity`, entityId), [entityType.sharesTable + '.id', 'users.username', 'users.name', entityType.sharesTable + '.role', 'users.id']);
}
async function listUnassignedUsersDTAjax(entityTypeId, entityId, params) {
const entityType = getEntityType(entityTypeId);
return await dtHelpers.ajaxList(
params,
tx => tx('users').whereNotExists(function() { return this.select('*').from(entityType.sharesTable).whereRaw(`users.id = ${entityType.sharesTable}.user`); }),
tx => tx('users').whereNotExists(function() { return this.select('*').from(entityType.sharesTable).whereRaw(`users.id = ${entityType.sharesTable}.user`).andWhere(`${entityType.sharesTable}.entity`, entityId); }),
['users.id', 'users.username', 'users.name']);
}
@ -61,29 +71,175 @@ async function assign(entityTypeId, entityId, userId, role) {
}
await tx(entityType.permissionsTable).where({user: userId, entity: entityId}).del();
if (role) {
const permissions = config.roles[entityTypeId][role].permissions;
const data = permissions.map(operation => ({user: userId, entity: entityId, operation}));
await tx(entityType.permissionsTable).insert(data);
if (entityTypeId === 'namespace') {
await rebuildPermissions(tx, {userId});
} else if (role) {
await rebuildPermissions(tx, { entityTypeId, entityId, userId });
}
});
}
async function rebuildPermissions() {
await knex.transaction(async tx => {
for (const entityTypeId in entityTypes) {
const entityType = entityTypes[entityTypeId];
async function rebuildPermissions(tx, restriction) {
restriction = restriction || {};
await tx(entityType.permissionsTable).del();
let restrictedEntityTypes;
if (restriction.entityTypeId) {
restrictedEntityTypes = {
[restriction.entityTypeId]: entityTypes[restriction.entityTypeId]
};
} else {
restrictedEntityTypes = entityTypes;
}
const shares = await tx(entityType.sharesTable).select(['entity', 'user', 'role']);
for (const share in shares) {
const permissions = config.roles[entityTypeId][share.role].permissions;
const data = permissions.map(operation => ({user: share.user, entity: share.entity, operation}));
await tx(entityType.permissionsTable).insert(data);
const namespaces = await tx('namespaces').select(['id', 'namespace']);
// nsMap is a map of namespaces - each of the following shape:
// .id - id of the namespace
// .namespace - id of the parent or null if no parent
// .userPermissions - Map userId -> [entityTypeId] -> array of permissions
// .transitiveUserPermissions - the same as above, but taking into account transitive permission obtained from namespace parents
const nsMap = new Map();
for (const namespace of namespaces) {
namespace.userPermissions = new Map();
nsMap.set(namespace.id, namespace);
}
// This populates .userPermissions
const nsSharesQuery = tx(entityTypes.namespace.sharesTable).select(['entity', 'user', 'role']);
if (restriction.userId) {
nsSharesQuery.andWhere('user', restriction.userId);
}
const nsShares = await nsSharesQuery;
for (const nsShare of nsShares) {
const ns = nsMap.get(nsShare.entity);
const userPerms = {};
ns.userPermissions.set(nsShare.user, userPerms);
for (const entityTypeId in restrictedEntityTypes) {
if (config.roles.namespace[nsShare.role] &&
config.roles.namespace[nsShare.role].childperms &&
config.roles.namespace[nsShare.role].childperms[entityTypeId]) {
userPerms[entityTypeId] = new Set(config.roles.namespace[nsShare.role].childperms[entityTypeId]);
} else {
userPerms[entityTypeId] = new Set();
}
}
});
}
// This computes .transitiveUserPermissions
for (const ns of nsMap.values()) {
ns.transitiveUserPermissions = new Map();
for (const userPermsPair of ns.userPermissions) {
const userPerms = {};
ns.transitiveUserPermissions.set(userPermsPair[0], userPerms);
for (const entityTypeId in restrictedEntityTypes) {
userPerms[entityTypeId] = new Set(userPermsPair[1][entityTypeId]);
}
}
let parentId = ns.namespace;
while (parentId) {
const parent = nsMap.get(parentId);
for (const userPermsPair of parent.userPermissions) {
const user = userPermsPair[0];
if (ns.transitiveUserPermissions.has(user)) {
const userPerms = ns.transitiveUserPermissions.get(user);
for (const entityTypeId in restrictedEntityTypes) {
for (const perm of userPermsPair[1][entityTypeId]) {
userPerms[entityTypeId].add(perm);
}
}
} else {
const userPerms = {}
ns.transitiveUserPermissions.set(user, userPerms);
for (const entityTypeId in restrictedEntityTypes) {
userPerms[entityTypeId] = new Set(userPermsPair[1][entityTypeId]);
}
}
}
parentId = parent.namespace;
}
}
// This reads direct shares from DB, joins it with the permissions from namespaces and stores the permissions into DB
for (const entityTypeId in restrictedEntityTypes) {
const entityType = restrictedEntityTypes[entityTypeId];
const expungeQuery = tx(entityType.permissionsTable).del();
if (restriction.entityId) {
expungeQuery.andWhere('entity', restriction.entityId);
}
if (restriction.userId) {
expungeQuery.andWhere('user', restriction.userId);
}
await expungeQuery;
const entitiesQuery = tx(entityType.entitiesTable).select(['id', 'namespace']);
if (restriction.entityId) {
entitiesQuery.andWhere('id', restriction.entityId);
}
const entities = await entitiesQuery;
for (const entity of entities) {
const permsPerUser = new Map();
if (entity.namespace) { // The root namespace has not parent namespace, thus the test
const transitiveUserPermissions = nsMap.get(entity.namespace).transitiveUserPermissions;
for (const transitivePermsPair of transitiveUserPermissions.entries()) {
permsPerUser.set(transitivePermsPair[0], [...transitivePermsPair[1][entityTypeId]]);
}
}
const directSharesQuery = tx(entityType.sharesTable).select(['user', 'role']).where('entity', entity.id);
if (restriction.userId) {
directSharesQuery.andWhere('user', restriction.userId);
}
const directShares = await directSharesQuery;
for (const share of directShares) {
let userPerms;
if (permsPerUser.has(share.user)) {
userPerms = permsPerUser.get(share.user);
} else {
userPerms = new Set();
permsPerUser.set(share.user, userPerms);
}
if (config.roles[entityTypeId][share.role] &&
config.roles[entityTypeId][share.role].permissions) {
for (const perm of config.roles[entityTypeId][share.role].permissions) {
userPerms.add(perm);
}
}
}
for (const userPermsPair of permsPerUser.entries()) {
const data = [];
for (const operation of userPermsPair[1]) {
data.push({user: userPermsPair[0], entity: entity.id, operation});
}
if (data.length > 0) {
await tx(entityType.permissionsTable).insert(data);
}
}
}
}
}
module.exports = {

61
setup/knex/migrations/20170507083345_create_namespaces.js
View file

@ -1,58 +1,33 @@
exports.up = function(knex, Promise) {
return knex.schema.createTable('namespaces', table => {
const entityTypesAddNamespace = ['list', 'report', 'report_template', 'user'];
let schema = knex.schema;
schema = schema.createTable('namespaces', table => {
table.increments('id').primary();
table.string('name');
table.text('description');
table.integer('namespace').unsigned().references('namespaces.id').onDelete('CASCADE');
})
.then(() => knex('namespaces').insert({
id: 1,
name: 'Global',
description: 'Global namespace'
}))
}));
.then(() => knex.schema.table('users', table => {
table.integer('namespace').unsigned().notNullable();
}))
.then(() => knex('users').update({
namespace: 1
}))
.then(() => knex.schema.table('users', table => {
table.foreign('namespace').references('namespaces.id').onDelete('CASCADE');
}))
for (const entityType of entityTypesAddNamespace) {
schema = schema
.then(() => knex.schema.table(`${entityType}s`, table => {
table.integer('namespace').unsigned().notNullable();
}))
.then(() => knex(`${entityType}s`).update({
namespace: 1
}))
.then(() => knex.schema.table(`${entityType}s`, table => {
table.foreign('namespace').references('namespaces.id').onDelete('CASCADE');
}));
}
.then(() => knex.schema.table('lists', table => {
table.integer('namespace').unsigned().notNullable();
}))
.then(() => knex('lists').update({
namespace: 1
}))
.then(() => knex.schema.table('lists', table => {
table.foreign('namespace').references('namespaces.id').onDelete('CASCADE');
}))
.then(() => knex.schema.table('report_templates', table => {
table.integer('namespace').unsigned().notNullable();
}))
.then(() => knex('report_templates').update({
namespace: 1
}))
.then(() => knex.schema.table('report_templates', table => {
table.foreign('namespace').references('namespaces.id').onDelete('CASCADE');
}))
.then(() => knex.schema.table('reports', table => {
table.integer('namespace').unsigned().notNullable();
}))
.then(() => knex('reports').update({
namespace: 1
}))
.then(() => knex.schema.table('reports', table => {
table.foreign('namespace').references('namespaces.id').onDelete('CASCADE');
}))
;
return schema;
};
exports.down = function(knex, Promise) {

85
setup/knex/migrations/20170507084114_create_permissions.js
View file

@ -1,67 +1,44 @@
const config = require('../config');
const shareableEntityTypes = ['list', 'report', 'report_template', 'namespace'];
exports.up = function(knex, Promise) {
return knex.schema.createTable('shares_list', table => {
table.increments('id').primary();
table.integer('entity').unsigned().notNullable().references('lists.id').onDelete('CASCADE');
table.integer('user').unsigned().notNullable().references('users.id').onDelete('CASCADE');
table.string('role', 64).notNullable();
table.unique(['entity', 'user']);
})
let schema = knex.schema;
.createTable('permissions_list', table => {
table.increments('id').primary();
table.integer('entity').unsigned().notNullable().references('lists.id').onDelete('CASCADE');
table.integer('user').unsigned().notNullable().references('users.id').onDelete('CASCADE');
table.string('operation', 64).notNullable();
table.unique(['entity', 'user', 'operation']);
})
for (const entityType of shareableEntityTypes) {
schema = schema
.createTable(`shares_${entityType}`, table => {
table.increments('id').primary();
table.integer('entity').unsigned().notNullable().references(`${entityType}s.id`).onDelete('CASCADE');
table.integer('user').unsigned().notNullable().references('users.id').onDelete('CASCADE');
table.string('role', 64).notNullable();
table.unique(['entity', 'user']);
})
.createTable(`permissions_${entityType}`, table => {
table.increments('id').primary();
table.integer('entity').unsigned().notNullable().references(`${entityType}s.id`).onDelete('CASCADE');
table.integer('user').unsigned().notNullable().references('users.id').onDelete('CASCADE');
table.string('operation', 64).notNullable();
table.unique(['entity', 'user', 'operation']);
});
}
.createTable('shares_report_template', table => {
table.increments('id').primary();
table.integer('entity').unsigned().notNullable().references('report_templates.id').onDelete('CASCADE');
table.integer('user').unsigned().notNullable().references('users.id').onDelete('CASCADE');
table.string('role', 64).notNullable();
table.unique(['entity', 'user']);
})
.createTable('permissions_report_template', table => {
table.increments('id').primary();
table.integer('entity').unsigned().notNullable().references('report_templates.id').onDelete('CASCADE');
table.integer('user').unsigned().notNullable().references('users.id').onDelete('CASCADE');
table.string('operation', 64).notNullable();
table.unique(['entity', 'user', 'operation']);
})
.createTable('shares_namespace', table => {
table.increments('id').primary();
table.integer('entity').unsigned().notNullable().references('namespaces.id').onDelete('CASCADE');
table.integer('user').unsigned().notNullable().references('users.id').onDelete('CASCADE');
table.string('role', 64).notNullable();
table.unique(['entity', 'user']);
})
.createTable('permissions_namespace', table => {
table.increments('id').primary();
table.integer('entity').unsigned().notNullable().references('namespaces.id').onDelete('CASCADE');
table.integer('user').unsigned().notNullable().references('users.id').onDelete('CASCADE');
table.string('operation', 64).notNullable();
table.unique(['entity', 'user', 'operation']);
})
.then(() => knex('shares_namespace').insert({
schema = schema.then(() => knex('shares_namespace').insert({
id: 1,
entity: 1,
user: 1,
role: 'master'
}))
}));
;
return schema;
};
exports.down = function(knex, Promise) {
return knex.schema.dropTable('shares_namespace')
.dropTable('shares_list')
.dropTable('permissions_namespace')
.dropTable('permissions_list');
let schema = knex.schema;
for (const entityType of shareableEntityTypes) {
schema = schema
.dropTable(`shares_${entityType}`)
.dropTable(`permissions_${entityType}`);
}
return schema;
};