feat(api-gateway)!: Move '/v1/sql' to new sql API Scope

Author: KSDaemon

packages/cubejs-api-gateway/src/gateway.ts

@@ -153,7 +153,7 @@ class ApiGateway {
   public readonly contextToApiScopesFn: ContextToApiScopesFn;
 
   public readonly contextToApiScopesDefFn: ContextToApiScopesFn =
-    async () => ['graphql', 'meta', 'data'];
+    async () => ['graphql', 'meta', 'data', 'sql'];
 
   protected readonly requestLoggerMiddleware: RequestLoggerMiddlewareFn;
 
@@ -1309,7 +1309,7 @@ class ApiGateway {
     res,
   }: {query: string, disablePostProcessing: boolean} & BaseRequest) {
     try {
-      await this.assertApiScope('data', context.securityContext);
+      await this.assertApiScope('sql', context.securityContext);
 
       const result = await this.sqlServer.sql4sql(query, disablePostProcessing, context.securityContext);
       res({ sql: result });
@@ -1337,7 +1337,7 @@ class ApiGateway {
     const requestStarted = new Date();
 
     try {
-      await this.assertApiScope('data', context.securityContext);
+      await this.assertApiScope('sql', context.securityContext);
 
       const [queryType, normalizedQueries] =
         await this.getNormalizedQueries(query, context, disableLimitEnforcing, memberExpressions);
@@ -2413,7 +2413,7 @@ class ApiGateway {
           );
         } else {
           scopes.forEach((p) => {
-            if (['graphql', 'meta', 'data', 'jobs'].indexOf(p) === -1) {
+            if (['graphql', 'meta', 'data', 'sql', 'jobs'].indexOf(p) === -1) {
               throw new Error(
                 `A user-defined contextToApiScopes function returns a wrong scope: ${p}`
               );

packages/cubejs-api-gateway/src/types/strings.ts

@@ -107,6 +107,7 @@ type ApiScopes =
   'graphql' |
   'meta' |
   'data' |
+  'sql' |
   'jobs';
 
 export {

packages/cubejs-api-gateway/test/permissions.test.ts

@@ -62,6 +62,13 @@ describe('Gateway Api Scopes', () => {
     expect(res.body && res.body.error)
       .toStrictEqual('API scope is missing: data');
 
+    res = await request(app)
+      .get('/cubejs-api/v1/sql')
+      .set('Authorization', AUTH_TOKEN)
+      .expect(403);
+    expect(res.body && res.body.error)
+      .toStrictEqual('API scope is missing: sql');
+
     res = await request(app)
       .post('/cubejs-api/v1/pre-aggregations/jobs')
       .set('Authorization', AUTH_TOKEN)
@@ -175,39 +182,47 @@ describe('Gateway Api Scopes', () => {
     expect(res3.body && res3.body.error)
       .toStrictEqual('API scope is missing: data');
 
-    const res4 = await request(app)
-      .get('/cubejs-api/v1/sql')
+    const res6 = await request(app)
+      .get('/cubejs-api/v1/dry-run')
       .set('Authorization', AUTH_TOKEN)
       .expect(403);
 
-    expect(res4.body && res4.body.error)
+    expect(res6.body && res6.body.error)
       .toStrictEqual('API scope is missing: data');
 
-    const res5 = await request(app)
-      .post('/cubejs-api/v1/sql')
+    const res7 = await request(app)
+      .post('/cubejs-api/v1/dry-run')
       .set('Content-type', 'application/json')
       .set('Authorization', AUTH_TOKEN)
       .expect(403);
 
-    expect(res5.body && res5.body.error)
+    expect(res7.body && res7.body.error)
       .toStrictEqual('API scope is missing: data');
 
-    const res6 = await request(app)
-      .get('/cubejs-api/v1/dry-run')
+    apiGateway.release();
+  });
+
+  test('Sql declined', async () => {
+    const { app, apiGateway } = createApiGateway({
+      contextToApiScopes: async () => ['graphql', 'meta', 'jobs', 'data'],
+    });
+
+    const res1 = await request(app)
+      .get('/cubejs-api/v1/sql')
       .set('Authorization', AUTH_TOKEN)
       .expect(403);
 
-    expect(res6.body && res6.body.error)
-      .toStrictEqual('API scope is missing: data');
+    expect(res1.body && res1.body.error)
+      .toStrictEqual('API scope is missing: sql');
 
-    const res7 = await request(app)
-      .post('/cubejs-api/v1/dry-run')
+    const res2 = await request(app)
+      .post('/cubejs-api/v1/sql')
       .set('Content-type', 'application/json')
       .set('Authorization', AUTH_TOKEN)
       .expect(403);
 
-    expect(res7.body && res7.body.error)
-      .toStrictEqual('API scope is missing: data');
+    expect(res2.body && res2.body.error)
+      .toStrictEqual('API scope is missing: sql');
 
     apiGateway.release();
   });