Skip to content

Commit 68b456a

Browse files
MarcusGoldschmidtbtipling
MarcusGoldschmidt
authored and
btipling
committed
fix revoke for database roles
1 parent 32bf30e commit 68b456a

File tree

3 files changed

+113
-75
lines changed

3 files changed

+113
-75
lines changed

‎pkg/connector/database_role.go‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -233,6 +233,95 @@ func (d *databaseRolePrincipalSyncer) Grants(
233233
return ret, npt, nil, nil
234234
}
235235

236+
func (d *databaseRolePrincipalSyncer) Grant(ctx context.Context, resource *v2.Resource, entitlement *v2.Entitlement) ([]*v2.Grant, annotations.Annotations, error) {
237+
var err error
238+
239+
l := ctxzap.Extract(ctx)
240+
241+
if resource.Id.ResourceType != resourceTypeUser.Id {
242+
return nil, nil, fmt.Errorf("resource type %s is not supported for granting", resource.Id.ResourceType)
243+
}
244+
245+
// database-role:baton_test:6:member
246+
splitId := strings.Split(entitlement.Id, ":")
247+
if len(splitId) != 4 {
248+
return nil, nil, fmt.Errorf("unexpected entitlement id: %s", entitlement.Id)
249+
}
250+
251+
dbName := splitId[1]
252+
roleId := splitId[2]
253+
254+
var role *mssqldb.RoleModel
255+
256+
role, err = d.client.GetDatabaseRole(ctx, dbName, roleId)
257+
if err != nil {
258+
return nil, nil, err
259+
}
260+
261+
dbUser, err := d.client.GetUserFromDb(ctx, dbName, resource.Id.Resource)
262+
if err != nil {
263+
return nil, nil, err
264+
}
265+
266+
if dbUser == nil {
267+
l.Info("user not found in database, creating user for principal", zap.String("user", resource.Id.Resource))
268+
269+
user, err := d.client.GetUserPrincipal(ctx, resource.Id.Resource)
270+
if err != nil {
271+
return nil, nil, err
272+
}
273+
274+
err = d.client.CreateDatabaseUserForPrincipal(ctx, dbName, user.Name)
275+
if err != nil {
276+
return nil, nil, err
277+
}
278+
}
279+
280+
err = d.client.AddUserToDatabaseRole(ctx, role.Name, dbName, resource.Id.Resource)
281+
if err != nil {
282+
return nil, nil, err
283+
}
284+
285+
grants := []*v2.Grant{
286+
grTypes.NewGrant(resource, "member", &v2.ResourceId{
287+
Resource: resource.Id.Resource,
288+
ResourceType: resourceTypeUser.Id,
289+
}),
290+
}
291+
292+
return grants, nil, nil
293+
}
294+
295+
func (d *databaseRolePrincipalSyncer) Revoke(ctx context.Context, grant *v2.Grant) (annotations.Annotations, error) {
296+
userId := grant.Principal.Id.Resource
297+
298+
user, err := d.client.GetUserPrincipal(ctx, userId)
299+
if err != nil {
300+
return nil, err
301+
}
302+
303+
// database-role:baton_test:6:member
304+
splitId := strings.Split(grant.Entitlement.Id, ":")
305+
if len(splitId) != 4 {
306+
return nil, fmt.Errorf("unexpected entitlement id: %s", grant.Entitlement.Id)
307+
}
308+
309+
dbName := splitId[1]
310+
roleId := splitId[2]
311+
312+
role, err := d.client.GetDatabaseRole(ctx, dbName, roleId)
313+
if err != nil {
314+
return nil, err
315+
}
316+
317+
err = d.client.RevokeUserToDatabaseRole(ctx, role.Name, dbName, user.Name)
318+
if err != nil {
319+
return nil, err
320+
}
321+
322+
return nil, err
323+
}
324+
236325
func newDatabaseRolePrincipalSyncer(ctx context.Context, c *mssqldb.Client) *databaseRolePrincipalSyncer {
237326
return &databaseRolePrincipalSyncer{
238327
resourceType: resourceTypeDatabaseRole,

‎pkg/connector/server_role.go‎

Lines changed: 11 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -198,8 +198,6 @@ func (d *serverRolePrincipalSyncer) Grants(ctx context.Context, resource *v2.Res
198198
func (d *serverRolePrincipalSyncer) Grant(ctx context.Context, resource *v2.Resource, entitlement *v2.Entitlement) ([]*v2.Grant, annotations.Annotations, error) {
199199
var err error
200200

201-
l := ctxzap.Extract(ctx)
202-
203201
if resource.Id.ResourceType != resourceTypeUser.Id {
204202
return nil, nil, fmt.Errorf("resource type %s is not supported for granting", resource.Id.ResourceType)
205203
}
@@ -210,58 +208,18 @@ func (d *serverRolePrincipalSyncer) Grant(ctx context.Context, resource *v2.Reso
210208
return nil, nil, fmt.Errorf("unexpected entitlement id: %s", entitlement.Id)
211209
}
212210

213-
dbName := splitId[1]
214211
roleId := splitId[2]
215212

216213
var role *mssqldb.RoleModel
217214

218-
switch entitlement.Resource.Id.ResourceType {
219-
case resourceTypeServerRole.Id:
220-
role, err = d.client.GetServerRole(ctx, roleId)
221-
if err != nil {
222-
return nil, nil, err
223-
}
224-
case resourceTypeDatabaseRole.Id:
225-
role, err = d.client.GetDatabaseRole(ctx, dbName, roleId)
226-
if err != nil {
227-
return nil, nil, err
228-
}
229-
default:
230-
return nil, nil, fmt.Errorf("unexpected resource type: %s", entitlement.Resource.Id.ResourceType)
231-
}
232-
233-
dbUser, err := d.client.GetUserFromDb(ctx, dbName, resource.Id.Resource)
215+
role, err = d.client.GetServerRole(ctx, roleId)
234216
if err != nil {
235217
return nil, nil, err
236218
}
237219

238-
if dbUser == nil {
239-
l.Info("user not found in database, creating user for principal", zap.String("user", resource.Id.Resource))
240-
241-
user, err := d.client.GetUserPrincipal(ctx, resource.Id.Resource)
242-
if err != nil {
243-
return nil, nil, err
244-
}
245-
246-
err = d.client.CreateDatabaseUserForPrincipal(ctx, dbName, user.Name)
247-
if err != nil {
248-
return nil, nil, err
249-
}
250-
}
251-
252-
switch entitlement.Resource.Id.ResourceType {
253-
case resourceTypeServerRole.Id:
254-
err = d.client.AddUserToServerRole(ctx, role.Name, resource.Id.Resource)
255-
if err != nil {
256-
return nil, nil, err
257-
}
258-
case resourceTypeDatabaseRole.Id:
259-
err = d.client.AddUserToDatabaseRole(ctx, role.Name, dbName, resource.Id.Resource)
260-
if err != nil {
261-
return nil, nil, err
262-
}
263-
default:
264-
return nil, nil, fmt.Errorf("unexpected resource type: %s", entitlement.Resource.Id.ResourceType)
220+
err = d.client.AddUserToServerRole(ctx, role.Name, resource.Id.Resource)
221+
if err != nil {
222+
return nil, nil, err
265223
}
266224

267225
grants := []*v2.Grant{
@@ -288,32 +246,16 @@ func (d *serverRolePrincipalSyncer) Revoke(ctx context.Context, grant *v2.Grant)
288246
return nil, fmt.Errorf("unexpected entitlement id: %s", grant.Entitlement.Id)
289247
}
290248

291-
dbName := splitId[1]
292249
roleId := splitId[2]
293250

294-
switch grant.Entitlement.Resource.Id.ResourceType {
295-
case resourceTypeServerRole.Id:
296-
role, err := d.client.GetServerRole(ctx, roleId)
297-
if err != nil {
298-
return nil, err
299-
}
300-
301-
err = d.client.RevokeUserToServerRole(ctx, role.Name, user.Name)
302-
if err != nil {
303-
return nil, err
304-
}
305-
case resourceTypeDatabaseRole.Id:
306-
role, err := d.client.GetDatabaseRole(ctx, dbName, roleId)
307-
if err != nil {
308-
return nil, err
309-
}
251+
role, err := d.client.GetServerRole(ctx, roleId)
252+
if err != nil {
253+
return nil, err
254+
}
310255

311-
err = d.client.RevokeUserToDatabaseRole(ctx, role.Name, dbName, user.Name)
312-
if err != nil {
313-
return nil, err
314-
}
315-
default:
316-
return nil, fmt.Errorf("unexpected resource type: %s", grant.Entitlement.Resource.Id.ResourceType)
256+
err = d.client.RevokeUserToServerRole(ctx, role.Name, user.Name)
257+
if err != nil {
258+
return nil, err
317259
}
318260

319261
return nil, err

‎pkg/mssqldb/roles.go‎

Lines changed: 13 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -286,7 +286,7 @@ WHERE type = 'R' AND principal_id = @p1
286286
return nil, err
287287
}
288288

289-
return nil, err
289+
return &roleModel, err
290290
}
291291

292292
func (c *Client) GetDatabaseRole(ctx context.Context, dbName string, id string) (*RoleModel, error) {
@@ -321,7 +321,7 @@ WHERE type = 'R' AND principal_id = @p1
321321
return nil, err
322322
}
323323

324-
return nil, err
324+
return &roleModel, err
325325
}
326326

327327
func (c *Client) AddUserToServerRole(ctx context.Context, role string, user string) error {
@@ -349,7 +349,7 @@ func (c *Client) AddUserToDatabaseRole(ctx context.Context, role string, db stri
349349
return fmt.Errorf("invalid characters in role or user")
350350
}
351351

352-
query := fmt.Sprintf(`ALTER ROLE [%s] ADD MEMBER [%s];`, role, user)
352+
query := fmt.Sprintf(`USE [%s]; ALTER ROLE [%s] ADD MEMBER [%s];`, db, role, user)
353353
_, err := c.db.ExecContext(ctx, query)
354354
if err != nil {
355355
return err
@@ -360,14 +360,16 @@ func (c *Client) AddUserToDatabaseRole(ctx context.Context, role string, db stri
360360

361361
func (c *Client) RevokeUserToServerRole(ctx context.Context, role string, user string) error {
362362
l := ctxzap.Extract(ctx)
363-
l.Debug("adding user to database role", zap.String("role", role), zap.String("user", user))
363+
l.Debug("revoking user to database role", zap.String("role", role), zap.String("user", user))
364364

365365
if strings.ContainsAny(role, "[]\"';") || strings.ContainsAny(user, "[]\"';") {
366366
return fmt.Errorf("invalid characters in role or user")
367367
}
368368

369369
query := fmt.Sprintf(`ALTER SERVER ROLE [%s] DROP MEMBER [%s];`, role, user)
370370

371+
l.Debug("RevokeUserToServerRole", zap.String("sql query", query))
372+
371373
_, err := c.db.ExecContext(ctx, query)
372374
if err != nil {
373375
return err
@@ -377,13 +379,18 @@ func (c *Client) RevokeUserToServerRole(ctx context.Context, role string, user s
377379

378380
func (c *Client) RevokeUserToDatabaseRole(ctx context.Context, role string, db string, user string) error {
379381
l := ctxzap.Extract(ctx)
380-
l.Debug("adding user to database role", zap.String("role", role), zap.String("user", user), zap.String("db", db))
382+
l.Debug("revoking user to database role", zap.String("role", role), zap.String("user", user), zap.String("db", db))
381383

382384
if strings.ContainsAny(role, "[]\"';") || strings.ContainsAny(user, "[]\"';") || strings.ContainsAny(db, "[]\"';") {
383385
return fmt.Errorf("invalid characters in role or user")
384386
}
385387

386-
query := fmt.Sprintf(`ALTER ROLE [%s] DROP MEMBER [%s];`, role, user)
388+
query := fmt.Sprintf(`
389+
USE [%s];
390+
ALTER ROLE [%s] DROP MEMBER [%s];`, db, role, user)
391+
392+
l.Debug("RevokeUserToDatabaseRole", zap.String("sql query", query))
393+
387394
_, err := c.db.ExecContext(ctx, query)
388395
if err != nil {
389396
return err

0 commit comments

Comments
 (0)