Skip to content

Commit 83ac0ac

Browse files
dnys1dnys1
committed
feat(cloud_hub): Add organizations service
- Implements `celest.cloud.v1alpha1.Organizations` - Adds tables for organizations and projects - Updates database for Cloud Auth changes - Adds tests for OrganizationsService
1 parent 548ae1e commit 83ac0ac

40 files changed

+8668
-460
lines changed

‎apps/cli/lib/src/commands/init_command.dart‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -97,9 +97,9 @@ final class InitCommand extends CelestCommand with Configure, ProjectCreator {
9797
stdout.writeln();
9898
cliLogger.success('🚀 To start a local development server, run:');
9999
cliLogger
100-
..write(Platform.lineTerminator)
101-
..write(' $command${Platform.lineTerminator}')
102-
..write(Platform.lineTerminator);
100+
..info(Platform.lineTerminator)
101+
..info(' $command${Platform.lineTerminator}')
102+
..info(Platform.lineTerminator);
103103

104104
return 0;
105105
}

‎services/celest_cloud_hub/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ FROM scratch
5656
COPY --from=build /runtime/ /
5757
COPY --from=build /app/cloud_hub /app/cloud_hub
5858
COPY --from=build /app/libsqlite3.so /app/libsqlite3.so
59-
COPY --from=build /usr/local/bin/flyctl /usr/local/bin/fly
59+
COPY --from=build /usr/local/bin/flyctl /usr/local/bin/flyctl
6060

6161
ENV PORT=8080
6262
EXPOSE $PORT

‎services/celest_cloud_hub/analysis_options.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,4 @@ analyzer:
55
avoid_print: ignore
66
implementation_imports: ignore
77
exclude:
8-
- lib/src/proto
8+
- lib/src/proto/**

‎services/celest_cloud_hub/bin/cloud_hub.dart‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ import 'package:celest_cloud_hub/src/gateway/gateway.dart';
1717
import 'package:celest_cloud_hub/src/project.dart';
1818
import 'package:celest_cloud_hub/src/services/health_service.dart';
1919
import 'package:celest_cloud_hub/src/services/operations_service.dart';
20+
import 'package:celest_cloud_hub/src/services/organizations_service.dart';
2021
import 'package:celest_cloud_hub/src/services/project_environments_service.dart';
2122
import 'package:celest_core/_internal.dart';
2223
import 'package:grpc/grpc.dart' as grpc;
@@ -63,9 +64,10 @@ Future<void> main() async {
6364

6465
final server = grpc.Server.create(
6566
services: [
66-
ProjectEnvironmentsService(),
67-
OperationsService(db, authorizer),
6867
HealthService(),
68+
OperationsService(db, authorizer),
69+
OrganizationsService(db, authorizer),
70+
ProjectEnvironmentsService(db, authorizer),
6971
],
7072
interceptors: [
7173
(call, method) async {

‎services/celest_cloud_hub/build.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ targets:
1111
enabled: true
1212
generate_for:
1313
- lib/src/database/**
14+
- lib/src/model/**
1415
options: &options
1516
sql:
1617
dialect: sqlite
@@ -23,5 +24,6 @@ targets:
2324
enabled: true
2425
generate_for:
2526
- lib/src/database/**
27+
- lib/src/model/**
2628
# We use yaml anchors to give the two builders the same options
2729
options: *options

‎services/celest_cloud_hub/launch.sh‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#!/usr/bin/env bash
2+
3+
# This script launches the Celest Cloud Hub to Fly.io
4+
#
5+
# Usage:
6+
# ./deploy.sh
7+
8+
fly launch \
9+
--yaml \
10+
--name cloud-hub \
11+
--org celest-809 \
12+
--image celestdev/cloud-hub:latest \
13+
--env "CLOUD_HUB_DATABASE_HOST=file::memory:" \
14+
--region lax \
15+
--regions lax,ord \
16+
--vm-size performance-8x

‎services/celest_cloud_hub/lib/src/auth/cloud.operations.cedar‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
@id("cloud.operations.viewer")
2+
permit (
3+
principal,
4+
action in Celest::Action::"view",
5+
resource is Celest::Operation
6+
)
7+
when
8+
{
9+
if
10+
principal is Celest::Organization::Member ||
11+
principal is Celest::Project::Member
12+
then
13+
resource in principal.parent &&
14+
principal.role in Celest::Role::"viewer"
15+
else
16+
if
17+
principal is Celest::User ||
18+
principal is Celest::ServiceAccount
19+
then
20+
resource in principal
21+
else
22+
false
23+
};
24+
25+
// @id("cloud.operations.editor")
26+
// permit (
27+
// principal,
28+
// action in Celest::Action::"edit",
29+
// resource is Celest::Operation
30+
// )
31+
// when
32+
// {
33+
// if
34+
// principal is Celest::Organization::Member ||
35+
// principal is Celest::Project::Member
36+
// then
37+
// resource in principal.parent &&
38+
// principal.role in Celest::Role::"editor"
39+
// else
40+
// if
41+
// principal is Celest::User ||
42+
// principal is Celest::ServiceAccount
43+
// then
44+
// resource in principal
45+
// else
46+
// false
47+
// };
48+
49+
// @id("cloud.operations.admin")
50+
// permit (
51+
// principal,
52+
// action in Celest::Action::"admin",
53+
// resource is Celest::Operation
54+
// )
55+
// when
56+
// {
57+
// if
58+
// principal is Celest::Organization::Member ||
59+
// principal is Celest::Project::Member
60+
// then
61+
// resource in principal.parent &&
62+
// principal.role in Celest::Role::"admin"
63+
// else
64+
// if
65+
// principal is Celest::User ||
66+
// principal is Celest::ServiceAccount
67+
// then
68+
// resource in principal
69+
// else
70+
// false
71+
// };

‎services/celest_cloud_hub/lib/src/auth/cloud.organizations.cedar‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
// Users can view organizations they are viewers of.
2+
@id("cloud.organizations.viewer")
3+
permit (
4+
principal is Celest::Organization::Member,
5+
action in Celest::Action::"view",
6+
resource is Celest::Organization
7+
)
8+
when
9+
{ resource in principal.parent && principal.role in Celest::Role::"viewer" };
10+
11+
// Users can edit organizations they are editors of.
12+
@id("cloud.organizations.editor")
13+
permit (
14+
principal is Celest::Organization::Member,
15+
action in Celest::Action::"edit",
16+
resource is Celest::Organization
17+
)
18+
when
19+
{ resource in principal.parent && principal.role in Celest::Role::"editor" };
20+
21+
// Users can do anything but delete organizations they are admins of.
22+
@id("cloud.organizations.admin")
23+
permit (
24+
principal is Celest::Organization::Member,
25+
action in Celest::Action::"admin",
26+
resource is Celest::Organization
27+
)
28+
when
29+
{ resource in principal.parent && principal.role in Celest::Role::"admin" };
30+
31+
// Users can do anything to organizations they are owners of.
32+
@id("cloud.organizations.owner")
33+
permit (
34+
principal is Celest::Organization::Member,
35+
action in Celest::Action::"owner",
36+
resource is Celest::Organization
37+
)
38+
when
39+
{ resource in principal.parent && principal.role in Celest::Role::"owner" };
40+
41+
// Any registered user can create an organization.
42+
// TODO: They shouldn't be able to create a resource anywhere, only in the root.
43+
@id("cloud.organizations.creator")
44+
permit (
45+
principal is Celest::User,
46+
action == Celest::Action::"create",
47+
resource is Celest::Organization
48+
);

‎services/celest_cloud_hub/lib/src/auth/cloud.projects.cedar‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
// Users can view projects they are viewers of.
2+
@id("cloud.projects.viewer")
3+
permit (
4+
principal is Celest::Project::Member,
5+
action in Celest::Action::"view",
6+
resource is Celest::Project
7+
)
8+
when
9+
{ resource in principal.parent && principal.role == Celest::Role::"viewer" };
10+
11+
// Users can edit projects they are editors of.
12+
@id("cloud.projects.editor")
13+
permit (
14+
principal is Celest::Project::Member,
15+
action in Celest::Action::"edit",
16+
resource is Celest::Project
17+
)
18+
when
19+
{ resource in principal.parent && principal.role == Celest::Role::"editor" };
20+
21+
// Users can do anything but delete projects they are admins of.
22+
@id("cloud.projects.admin")
23+
permit (
24+
principal is Celest::Project::Member,
25+
action in Celest::Action::"admin",
26+
resource is Celest::Project
27+
)
28+
when
29+
{ resource in principal.parent && principal.role == Celest::Role::"admin" };
30+
31+
// Users can do anything to projects they are owners of.
32+
@id("cloud.projects.owner")
33+
permit (
34+
principal is Celest::Project::Member,
35+
action in Celest::Action::"owner",
36+
resource is Celest::Project
37+
)
38+
when
39+
{ resource in principal.parent && principal.role == Celest::Role::"owner" };
40+
41+
// Users can create projects in organizations they have admin access to.
42+
@id("cloud.projects.creator")
43+
permit (
44+
principal is Celest::Organization::Member,
45+
action == Celest::Action::"create",
46+
resource is Celest::Project
47+
)
48+
when
49+
{
50+
resource in principal.parent &&
51+
principal.role in Celest::Role::"admin"
52+
};

‎services/celest_cloud_hub/lib/src/auth/cloud.projects.environments.cedar‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
// Users can view project environmentss they are viewers of.
2+
@id("cloud.projects.environments.viewer")
3+
permit (
4+
principal is Celest::Project::Member,
5+
action in Celest::Action::"view",
6+
resource is Celest::Project::Environment
7+
)
8+
when
9+
{
10+
resource in principal.parent &&
11+
principal.role == Celest::Role::"viewer"
12+
};
13+
14+
// Users can edit project environments they are editors of.
15+
@id("cloud.projects.environments.editor")
16+
permit (
17+
principal is Celest::Project::Member,
18+
action in Celest::Action::"edit",
19+
resource is Celest::Project::Environment
20+
)
21+
when
22+
{
23+
resource in principal.parent &&
24+
principal.role == Celest::Role::"editor"
25+
};
26+
27+
// Users can do anything but delete project environments they are admins of.
28+
@id("cloud.projects.environments.admin")
29+
permit (
30+
principal is Celest::Project::Member,
31+
action in Celest::Action::"admin",
32+
resource is Celest::Project::Environment
33+
)
34+
when
35+
{
36+
resource in principal.parent &&
37+
principal.role == Celest::Role::"admin"
38+
};
39+
40+
// Users can do anything to environments they are owners of.
41+
@id("cloud.projects.environments.owner")
42+
permit (
43+
principal is Celest::Project::Member,
44+
action in Celest::Action::"owner",
45+
resource is Celest::Project::Environment
46+
)
47+
when
48+
{
49+
resource in principal.parent &&
50+
principal.role == Celest::Role::"owner"
51+
};
52+
53+
// Users can create environments in projects they have admin access to.
54+
@id("cloud.projects.environments.creator")
55+
permit (
56+
principal is Celest::Project::Member,
57+
action == Celest::Action::"create",
58+
resource is Celest::Project::Environment
59+
)
60+
when
61+
{
62+
resource in principal.parent &&
63+
principal.role in Celest::Role::"admin"
64+
};
65+
66+
// Members can deploy environments in projects they have deploy or admin access to.
67+
@id("cloud.projects.environments.deployer")
68+
permit (
69+
principal is Celest::Project::Member,
70+
action == Celest::Project::Environment::Action::"deploy",
71+
resource is Celest::Project::Environment
72+
)
73+
when
74+
{
75+
resource in principal.parent &&
76+
principal.role in Celest::Role::"admin"
77+
};

0 commit comments

Comments
 (0)