forked from airbytehq/airbyte-platform
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Cloud's listWorkspacesByUser and listUsersByWorkspace leverage Organi…
…zation-level permissions (#9322)
- Loading branch information
Showing
7 changed files
with
309 additions
and
97 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
91 changes: 91 additions & 0 deletions
91
...-persistence/src/main/java/io/airbyte/config/persistence/PermissionPersistenceHelper.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,91 @@ | ||
| /* | ||
| * Copyright (c) 2023 Airbyte, Inc., all rights reserved. | ||
| */ | ||
|
|
||
| package io.airbyte.config.persistence; | ||
|
|
||
| import io.airbyte.config.Permission.PermissionType; | ||
| import io.airbyte.config.helpers.PermissionHelper; | ||
|
|
||
| public class PermissionPersistenceHelper { | ||
|
|
||
| /** | ||
| * Get an array of the Jooq enum values for the permission types that grant the target permission | ||
| * type. Used for `ANY(?)` clauses in SQL queries. | ||
| */ | ||
| public static io.airbyte.db.instance.configs.jooq.generated.enums.PermissionType[] getGrantingPermissionTypeArray(final PermissionType targetPermissionType) { | ||
| return PermissionHelper.getPermissionTypesThatGrantTargetPermission(targetPermissionType) | ||
| .stream() | ||
| .map(PermissionPersistenceHelper::convertConfigPermissionTypeToJooqPermissionType) | ||
| .toList() | ||
| .toArray(new io.airbyte.db.instance.configs.jooq.generated.enums.PermissionType[0]); | ||
| } | ||
|
|
||
| private static io.airbyte.db.instance.configs.jooq.generated.enums.PermissionType convertConfigPermissionTypeToJooqPermissionType(final PermissionType permissionType) { | ||
| // workspace owner is deprecated and doesn't exist in OSS jooq. it is equivalent to workspace admin. | ||
| if (permissionType.equals(PermissionType.WORKSPACE_OWNER)) { | ||
| return io.airbyte.db.instance.configs.jooq.generated.enums.PermissionType.workspace_admin; | ||
| } | ||
|
|
||
| return io.airbyte.db.instance.configs.jooq.generated.enums.PermissionType.valueOf(permissionType.value()); | ||
| } | ||
|
|
||
| /** | ||
| * This query lists all active workspaces that a particular user has the indicated permissions for. | ||
| * The query is parameterized by a user id, a permission type array, and a keyword search string. | ||
| * <p> | ||
| * Note: The permission type array should include the valid set of permission types that can be used | ||
| * to infer workspace access. | ||
| * <p> | ||
| * For instance, if the passed-in permission type array contains `organization_admin` and | ||
| * `workspace_admin`, then the query will return all workspaces that belong to an organization that | ||
| * the user has `organization_admin` permissions for, as well as all workspaces that the user has | ||
| * `workspace_admin` permissions for. | ||
| */ | ||
| public final static String LIST_ACTIVE_WORKSPACES_BY_USER_ID_AND_PERMISSION_TYPES_QUERY = | ||
| "WITH " | ||
| + " userOrgs AS (" | ||
| + " SELECT organization_id FROM permission WHERE user_id = {0} AND permission_type = ANY({1}::permission_type[])" | ||
| + " )," | ||
| + " userWorkspaces AS (" | ||
| + " SELECT workspace.id AS workspace_id FROM userOrgs JOIN workspace" | ||
| + " ON workspace.organization_id = userOrgs.organization_id" | ||
| + " UNION" | ||
| + " SELECT workspace_id FROM permission WHERE user_id = {0} AND permission_type = ANY({1}::permission_type[])" | ||
| + " )" | ||
| + " SELECT * from workspace" | ||
| + " WHERE workspace.id IN (SELECT workspace_id from userWorkspaces)" | ||
| + " AND name ILIKE {2}" | ||
| + " AND tombstone = false" | ||
| + " ORDER BY name ASC"; | ||
|
|
||
| /** | ||
| * This query lists all users that can access the particular workspace through possession of the | ||
| * indicated permissions. The query is parameterized by a workspace id and a permission type array. | ||
| * <p> | ||
| * Note: The permission type array should include the valid set of permission types that can be used | ||
| * to infer workspace access. | ||
| * <p> | ||
| * For instance, if the passed-in permission type array contains `organization_admin` and | ||
| * `workspace_admin`, then the query will return all users that can access the indicated workspace | ||
| * through possession of either of those two permission_types. | ||
| */ | ||
| public final static String LIST_USERS_BY_WORKSPACE_ID_AND_PERMISSION_TYPES_QUERY = | ||
| "WITH " | ||
| + " orgWorkspaces AS (" | ||
| + " SELECT organization_id FROM workspace WHERE workspace.id = {0}" | ||
| + " )," | ||
| + " usersInOrgWithPerm AS (" | ||
| + " SELECT permission.user_id FROM permission" | ||
| + " JOIN orgWorkspaces ON permission.organization_id = orgWorkspaces.organization_id" | ||
| + " WHERE permission_type = ANY({1}::permission_type[])" | ||
| + " )," | ||
| + " usersInWorkspaceWithPerm AS (" | ||
| + " SELECT user_id FROM permission WHERE workspace_id = {0} " | ||
| + " AND permission_type = ANY({1}::permission_type[])" | ||
| + " )" | ||
| + " SELECT * from \"user\"" | ||
| + " WHERE \"user\".id IN (SELECT user_id FROM usersInOrgWithPerm UNION SELECT user_id FROM usersInWorkspaceWithPerm)" | ||
| + " ORDER BY name ASC"; | ||
|
|
||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.