DHFPROD-7473: Ensure data-hub-job-internal role can update jobs

Author: ryanjdew

marklogic-data-hub-spark-connector/src/test/java/com/marklogic/hub/spark/sql/sources/v2/writer/WriteJobsDataTest.java

@@ -6,6 +6,9 @@
 import com.marklogic.hub.spark.sql.sources.v2.AbstractSparkConnectorTest;
 import org.junit.jupiter.api.Test;
 
+import java.util.Iterator;
+import java.util.concurrent.atomic.AtomicInteger;
+
 import static org.junit.jupiter.api.Assertions.*;
 
 public class WriteJobsDataTest extends AbstractSparkConnectorTest {
@@ -40,7 +43,13 @@ void ingestDocsWithJobDoc() {
         assertEquals(DocumentMetadataHandle.Capability.READ, perms.get("data-hub-job-reader").iterator().next());
         assertEquals(DocumentMetadataHandle.Capability.UPDATE, perms.get("flow-developer-role").iterator().next());
         assertEquals(DocumentMetadataHandle.Capability.UPDATE, perms.get("flow-operator-role").iterator().next());
-        assertEquals(DocumentMetadataHandle.Capability.UPDATE, perms.get("data-hub-job-internal").iterator().next());
+        Iterator<?> internalPermissions = perms.get("data-hub-job-internal").iterator();
+        AtomicInteger internalPermissionsCount = new AtomicInteger();
+        internalPermissions.forEachRemaining((internalPermission) -> {
+            assertTrue(DocumentMetadataHandle.Capability.UPDATE.equals(internalPermission) || DocumentMetadataHandle.Capability.READ.equals(internalPermission));
+            internalPermissionsCount.getAndIncrement();
+        });
+        assertEquals(2, internalPermissionsCount.get());
 
         dataSourceWriter.commit(null);
 

marklogic-data-hub/src/main/resources/ml-modules/root/data-hub/5/impl/jobs.sjs

@@ -67,7 +67,13 @@ function saveNewJob(job) {
 
   function buildJobPermissions() {
     let permissionsString = config.JOBPERMISSIONS;
-    let permissions = xdmp.defaultPermissions().concat([xdmp.permission(config.FLOWDEVELOPERROLE, 'update'), xdmp.permission(config.FLOWOPERATORROLE, 'update')]);
+    let permissions = xdmp.defaultPermissions().concat([
+      xdmp.permission(config.FLOWDEVELOPERROLE, "update"),
+      xdmp.permission(config.FLOWOPERATORROLE, "update"),
+      xdmp.permission("data-hub-job-internal", "update"),
+      xdmp.permission("data-hub-job-internal", "read"),
+      xdmp.permission("data-hub-job-reader", "read")
+    ]);
     if (permissionsString != null && permissionsString.indexOf("mlJobPermissions") < 0) {
       let tokens = permissionsString.split(",");
       for (let i = 0; i < tokens.length; i += 2) {

marklogic-data-hub/src/test/ml-modules/root/test/suites/data-hub/5/builtins/steps/mapping/validate-entity/rejectFromFlow.sjs

@@ -42,7 +42,7 @@ if (lib.canTestJsonSchemaValidation()) {
   // Per DHFPROD-3108, verifying that the new data-hub-job-reader/data-hub-job-internal permissions are set as well
   let jobReaderPerm = batchData.perms.find(perm => xdmp.roleName(perm.roleId) == "data-hub-job-reader");
   assertions.push(test.assertEqual("read", jobReaderPerm.capability));
-  let jobInternalPerm = batchData.perms.find(perm => xdmp.roleName(perm.roleId) == "data-hub-job-internal");
+  let jobInternalPerm = batchData.perms.find(perm => xdmp.roleName(perm.roleId) == "data-hub-job-internal" && perm.capability == "update");
   assertions.push(test.assertEqual("update", jobInternalPerm.capability));
 
   assertions;