Skip to content

Commit b06c8ac

Browse files
ggreerggreer
authored
Merge pull request #19 from ConductorOne/ggreer/fix-azure-databricks-groups
Generate grant expansion entitlement IDs without using resource cache.
2 parents cd2f8f7 + d0a13e7 commit b06c8ac

File tree

9 files changed

+92
-126
lines changed

9 files changed

+92
-126
lines changed

‎.golangci.yml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -50,9 +50,6 @@ linters-settings:
5050
tenv:
5151
all: true
5252

53-
varcheck:
54-
exported-fields: false # this appears to improperly detect exported variables as unused when they are used from a package with the same name
55-
5653

5754
linters:
5855
disable-all: true

‎pkg/connector/account.go‎

Lines changed: 9 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -35,9 +35,8 @@ const (
3535
)
3636

3737
type accountBuilder struct {
38-
client *databricks.Client
39-
resourceType *v2.ResourceType
40-
resourceCache *ResourceCache
38+
client *databricks.Client
39+
resourceType *v2.ResourceType
4140
}
4241

4342
func (a *accountBuilder) ResourceType(ctx context.Context) *v2.ResourceType {
@@ -133,12 +132,12 @@ func (a *accountBuilder) Grants(ctx context.Context, resource *v2.Resource, pTok
133132

134133
var annotations []protoreflect.ProtoMessage
135134
if resourceId.ResourceType == groupResourceType.Id {
136-
memberResource, annotation, err := a.resourceCache.ExpandGrantForGroup(ctx, "", resourceId.Resource)
135+
rid, expandAnnotation, err := groupGrantExpansion(ctx, resourceId.Resource, resource.ParentResourceId)
137136
if err != nil {
138-
return nil, "", nil, fmt.Errorf("databricks-connector: failed to expand grant for group %s: %w", resourceId.Resource, err)
137+
return rv, "", nil, err
139138
}
140-
annotations = append(annotations, annotation)
141-
resourceId = memberResource.Id
139+
resourceId = rid
140+
annotations = append(annotations, expandAnnotation)
142141
}
143142

144143
rv = append(rv, grant.NewGrant(resource, MarketplaceAdminRole, resourceId, grant.WithAnnotation(annotations...)))
@@ -282,10 +281,9 @@ func (a *accountBuilder) Revoke(ctx context.Context, grant *v2.Grant) (annotatio
282281
return nil, nil
283282
}
284283

285-
func newAccountBuilder(client *databricks.Client, resourceCache *ResourceCache) *accountBuilder {
284+
func newAccountBuilder(client *databricks.Client) *accountBuilder {
286285
return &accountBuilder{
287-
client: client,
288-
resourceType: accountResourceType,
289-
resourceCache: resourceCache,
286+
client: client,
287+
resourceType: accountResourceType,
290288
}
291289
}

‎pkg/connector/connector.go‎

Lines changed: 10 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -12,20 +12,19 @@ import (
1212
)
1313

1414
type Databricks struct {
15-
client *databricks.Client
16-
workspaces []string
17-
resourceCache *ResourceCache
15+
client *databricks.Client
16+
workspaces []string
1817
}
1918

2019
// ResourceSyncers returns a ResourceSyncer for each resource type that should be synced from the upstream service.
2120
func (d *Databricks) ResourceSyncers(ctx context.Context) []connectorbuilder.ResourceSyncer {
2221
return []connectorbuilder.ResourceSyncer{
23-
newAccountBuilder(d.client, d.resourceCache),
24-
newGroupBuilder(d.client, d.resourceCache),
25-
newServicePrincipalBuilder(d.client, d.resourceCache),
26-
newUserBuilder(d.client, d.resourceCache),
27-
newWorkspaceBuilder(d.client, d.resourceCache, d.workspaces),
28-
newRoleBuilder(d.client, d.resourceCache),
22+
newAccountBuilder(d.client),
23+
newGroupBuilder(d.client),
24+
newServicePrincipalBuilder(d.client),
25+
newUserBuilder(d.client),
26+
newWorkspaceBuilder(d.client, d.workspaces),
27+
newRoleBuilder(d.client),
2928
}
3029
}
3130

@@ -117,8 +116,7 @@ func New(
117116
}
118117

119118
return &Databricks{
120-
client: client,
121-
workspaces: workspaces,
122-
resourceCache: NewResourceCache(client),
119+
client: client,
120+
workspaces: workspaces,
123121
}, nil
124122
}

‎pkg/connector/groups.go‎

Lines changed: 23 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -21,16 +21,23 @@ import (
2121
const groupMemberEntitlement = "member"
2222

2323
type groupBuilder struct {
24-
client *databricks.Client
25-
resourceType *v2.ResourceType
26-
resourceCache *ResourceCache
24+
client *databricks.Client
25+
resourceType *v2.ResourceType
2726
}
2827

2928
func (g *groupBuilder) ResourceType(ctx context.Context) *v2.ResourceType {
3029
return groupResourceType
3130
}
3231

33-
func groupResource(_ context.Context, group *databricks.Group, parent *v2.ResourceId) (*v2.Resource, error) {
32+
func groupResourceId(_ context.Context, groupId string, parentResourceId *v2.ResourceId) string {
33+
if parentResourceId == nil {
34+
return strings.Join([]string{groupResourceType.Id, groupId}, "/")
35+
}
36+
37+
return strings.Join([]string{parentResourceId.ResourceType, parentResourceId.Resource, groupResourceType.Id, groupId}, "/")
38+
}
39+
40+
func groupResource(ctx context.Context, group *databricks.Group, parent *v2.ResourceId) (*v2.Resource, error) {
3441
members := make([]string, len(group.Members))
3542

3643
for i, member := range group.Members {
@@ -54,11 +61,10 @@ func groupResource(_ context.Context, group *databricks.Group, parent *v2.Resour
5461
}
5562

5663
var options []rs.ResourceOption
57-
groupId := strings.Join([]string{groupResourceType.Id, group.ID}, "/")
5864
if parent != nil {
59-
groupId = strings.Join([]string{parent.ResourceType, parent.Resource, groupResourceType.Id, group.ID}, "/")
6065
options = append(options, rs.WithParentResourceID(parent))
6166
}
67+
groupId := groupResourceId(ctx, group.ID, parent)
6268

6369
resource, err := rs.NewGroupResource(
6470
group.DisplayName,
@@ -110,7 +116,6 @@ func (g *groupBuilder) List(ctx context.Context, parentResourceID *v2.ResourceId
110116
if err != nil {
111117
return nil, "", nil, err
112118
}
113-
g.resourceCache.Set(group.ID, gr)
114119

115120
rv = append(rv, gr)
116121
}
@@ -210,12 +215,12 @@ func (g *groupBuilder) Grants(ctx context.Context, resource *v2.Resource, pToken
210215
case "Users":
211216
resourceId = &v2.ResourceId{ResourceType: userResourceType.Id, Resource: memberID}
212217
case "Groups":
213-
memberResource, annotation, err := g.resourceCache.ExpandGrantForGroup(ctx, workspaceId, memberID)
218+
rid, expandAnnotation, err := groupGrantExpansion(ctx, memberID, parentId)
214219
if err != nil {
215-
return nil, "", nil, fmt.Errorf("databricks-connector: failed to expand grant for group %s: %w", memberID, err)
220+
return rv, "", nil, err
216221
}
217-
anns = append(anns, annotation)
218-
resourceId = memberResource.Id
222+
resourceId = rid
223+
anns = append(anns, expandAnnotation)
219224
case "ServicePrincipals":
220225
resourceId = &v2.ResourceId{ResourceType: servicePrincipalResourceType.Id, Resource: memberID}
221226
default:
@@ -240,12 +245,12 @@ func (g *groupBuilder) Grants(ctx context.Context, resource *v2.Resource, pToken
240245
}
241246
var annotations []protoreflect.ProtoMessage
242247
if resourceId.ResourceType == groupResourceType.Id {
243-
memberResource, annotation, err := g.resourceCache.ExpandGrantForGroup(ctx, workspaceId, resourceId.Resource)
248+
rid, expandAnnotation, err := groupGrantExpansion(ctx, resourceId.Resource, resource.ParentResourceId)
244249
if err != nil {
245-
return nil, "", nil, fmt.Errorf("databricks-connector: failed to expand grant for group %s: %w", resourceId.Resource, err)
250+
return rv, "", nil, err
246251
}
247-
annotations = append(annotations, annotation)
248-
resourceId = memberResource.Id
252+
resourceId = rid
253+
annotations = append(annotations, expandAnnotation)
249254
}
250255

251256
rv = append(rv, grant.NewGrant(resource, ruleSet.Role, resourceId, grant.WithAnnotation(annotations...)))
@@ -471,10 +476,9 @@ func (g *groupBuilder) Revoke(ctx context.Context, grant *v2.Grant) (annotations
471476
return nil, nil
472477
}
473478

474-
func newGroupBuilder(client *databricks.Client, resourceCache *ResourceCache) *groupBuilder {
479+
func newGroupBuilder(client *databricks.Client) *groupBuilder {
475480
return &groupBuilder{
476-
client: client,
477-
resourceType: groupResourceType,
478-
resourceCache: resourceCache,
481+
client: client,
482+
resourceType: groupResourceType,
479483
}
480484
}

‎pkg/connector/helpers.go‎

Lines changed: 7 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -35,43 +35,15 @@ func parseResourceId(resourceId string) (*v2.ResourceId, *v2.ResourceId, error)
3535
return nil, nil, fmt.Errorf("invalid resource ID: %s", resourceId)
3636
}
3737

38-
type ResourceCache struct {
39-
// Map of API IDs to resources
40-
resources map[string]*v2.Resource
41-
client *databricks.Client
42-
}
43-
44-
func (c *ResourceCache) Get(resourceId string) *v2.Resource {
45-
return c.resources[resourceId]
46-
}
47-
48-
func (c *ResourceCache) Set(resourceId string, resource *v2.Resource) {
49-
c.resources[resourceId] = resource
50-
}
51-
52-
func NewResourceCache(client *databricks.Client) *ResourceCache {
53-
return &ResourceCache{
54-
resources: make(map[string]*v2.Resource),
55-
client: client,
56-
}
57-
}
58-
59-
func (c *ResourceCache) ExpandGrantForGroup(ctx context.Context, workspaceId, groupId string) (*v2.Resource, *v2.GrantExpandable, error) {
60-
memberResource := c.Get(groupId)
61-
if memberResource == nil {
62-
group, _, err := c.client.GetGroup(context.Background(), workspaceId, groupId)
63-
if err != nil {
64-
return nil, nil, fmt.Errorf("databricks-connector: failed to get group %s: %w", groupId, err)
65-
}
66-
memberResource, err = groupResource(ctx, group, nil)
67-
if err != nil {
68-
return nil, nil, fmt.Errorf("databricks-connector: failed to get group %s: %w", groupId, err)
69-
}
70-
c.Set(groupId, memberResource)
38+
func groupGrantExpansion(ctx context.Context, groupId string, parentResource *v2.ResourceId) (*v2.ResourceId, *v2.GrantExpandable, error) {
39+
groupResourceStr := groupResourceId(ctx, groupId, parentResource)
40+
resourceId, err := rs.NewResourceID(groupResourceType, groupResourceStr)
41+
if err != nil {
42+
return nil, nil, err
7143
}
7244

73-
return memberResource, &v2.GrantExpandable{
74-
EntitlementIds: []string{fmt.Sprintf("group:%s:%s", memberResource.Id.Resource, groupMemberEntitlement)},
45+
return resourceId, &v2.GrantExpandable{
46+
EntitlementIds: []string{fmt.Sprintf("group:%s:%s", groupResourceStr, groupMemberEntitlement)},
7547
}, nil
7648
}
7749

‎pkg/connector/roles.go‎

Lines changed: 14 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -33,9 +33,8 @@ var entitlements = []string{
3333
}
3434

3535
type roleBuilder struct {
36-
client *databricks.Client
37-
resourceType *v2.ResourceType
38-
resourceCache *ResourceCache
36+
client *databricks.Client
37+
resourceType *v2.ResourceType
3938
}
4039

4140
func (r *roleBuilder) ResourceType(ctx context.Context) *v2.ResourceType {
@@ -233,11 +232,17 @@ func (r *roleBuilder) Grants(ctx context.Context, resource *v2.Resource, pToken
233232
}
234233

235234
if (!isWorkspaceRole && g.HaveRole(roleName)) || (isWorkspaceRole && g.HaveEntitlement(roleName)) {
236-
memberResource, annotation, err := r.resourceCache.ExpandGrantForGroup(ctx, workspaceId, g.ID)
235+
accountId := r.client.GetAccountId()
236+
accountResourceId, err := rs.NewResourceID(accountResourceType, accountId)
237237
if err != nil {
238-
return nil, "", nil, fmt.Errorf("databricks-connector: failed to expand grant for group %s: %w", g.ID, err)
238+
return rv, "", nil, err
239239
}
240-
rv = append(rv, grant.NewGrant(resource, RoleMemberEntitlement, memberResource.Id, grant.WithAnnotation(annotation)))
240+
resourceId, expandAnnotation, err := groupGrantExpansion(ctx, g.ID, accountResourceId)
241+
if err != nil {
242+
return rv, "", nil, err
243+
}
244+
245+
rv = append(rv, grant.NewGrant(resource, RoleMemberEntitlement, resourceId, grant.WithAnnotation(expandAnnotation)))
241246
}
242247
}
243248

@@ -454,10 +459,9 @@ func (r *roleBuilder) Revoke(ctx context.Context, grant *v2.Grant) (annotations.
454459
return nil, nil
455460
}
456461

457-
func newRoleBuilder(client *databricks.Client, resourceCache *ResourceCache) *roleBuilder {
462+
func newRoleBuilder(client *databricks.Client) *roleBuilder {
458463
return &roleBuilder{
459-
client: client,
460-
resourceType: roleResourceType,
461-
resourceCache: resourceCache,
464+
client: client,
465+
resourceType: roleResourceType,
462466
}
463467
}

‎pkg/connector/service-principals.go‎

Lines changed: 11 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,8 @@ import (
1818
)
1919

2020
type servicePrincipalBuilder struct {
21-
client *databricks.Client
22-
resourceType *v2.ResourceType
23-
resourceCache *ResourceCache
21+
client *databricks.Client
22+
resourceType *v2.ResourceType
2423
}
2524

2625
func (s *servicePrincipalBuilder) ResourceType(ctx context.Context) *v2.ResourceType {
@@ -57,7 +56,6 @@ func (s *servicePrincipalBuilder) servicePrincipalResource(ctx context.Context,
5756
return nil, err
5857
}
5958

60-
s.resourceCache.Set(servicePrincipal.ID, resource)
6159
return resource, nil
6260
}
6361

@@ -190,12 +188,14 @@ func (s *servicePrincipalBuilder) Grants(ctx context.Context, resource *v2.Resou
190188

191189
var annotations []protoreflect.ProtoMessage
192190
if resourceId.ResourceType == groupResourceType.Id {
193-
memberResource, annotation, err := s.resourceCache.ExpandGrantForGroup(ctx, workspaceId, resourceId.Resource)
191+
groupResourceStr := groupResourceId(ctx, resourceId.Resource, resource.ParentResourceId)
192+
annotations = append(annotations, &v2.GrantExpandable{
193+
EntitlementIds: []string{fmt.Sprintf("group:%s:%s", groupResourceStr, groupMemberEntitlement)},
194+
})
195+
resourceId, err = rs.NewResourceID(groupResourceType, groupResourceStr)
194196
if err != nil {
195-
return nil, "", nil, fmt.Errorf("databricks-connector: failed to expand grant for group %s: %w", resourceId.Resource, err)
197+
return rv, "", nil, err
196198
}
197-
annotations = append(annotations, annotation)
198-
resourceId = memberResource.Id
199199
}
200200

201201
rv = append(rv, grant.NewGrant(resource, ruleSet.Role, resourceId, grant.WithAnnotation(annotations...)))
@@ -376,10 +376,9 @@ func (s *servicePrincipalBuilder) Revoke(ctx context.Context, grant *v2.Grant) (
376376
return nil, nil
377377
}
378378

379-
func newServicePrincipalBuilder(client *databricks.Client, resourceCache *ResourceCache) *servicePrincipalBuilder {
379+
func newServicePrincipalBuilder(client *databricks.Client) *servicePrincipalBuilder {
380380
return &servicePrincipalBuilder{
381-
client: client,
382-
resourceType: servicePrincipalResourceType,
383-
resourceCache: resourceCache,
381+
client: client,
382+
resourceType: servicePrincipalResourceType,
384383
}
385384
}

‎pkg/connector/users.go‎

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,8 @@ import (
1212
)
1313

1414
type userBuilder struct {
15-
client *databricks.Client
16-
resourceType *v2.ResourceType
17-
resourceCache *ResourceCache
15+
client *databricks.Client
16+
resourceType *v2.ResourceType
1817
}
1918

2019
func (u *userBuilder) ResourceType(ctx context.Context) *v2.ResourceType {
@@ -78,8 +77,6 @@ func (u *userBuilder) userResource(ctx context.Context, user *databricks.User, p
7877
return nil, err
7978
}
8079

81-
u.resourceCache.Set(user.ID, resource)
82-
8380
return resource, nil
8481
}
8582

@@ -159,10 +156,9 @@ func (u *userBuilder) Grants(
159156
return nil, "", nil, nil
160157
}
161158

162-
func newUserBuilder(client *databricks.Client, resourceCache *ResourceCache) *userBuilder {
159+
func newUserBuilder(client *databricks.Client) *userBuilder {
163160
return &userBuilder{
164-
client: client,
165-
resourceType: userResourceType,
166-
resourceCache: resourceCache,
161+
client: client,
162+
resourceType: userResourceType,
167163
}
168164
}

0 commit comments

Comments
 (0)