Skip to content

Commit 6742250

Browse files
bsod90bsod90
committed
WIP: new style access policy framework for Cube
1 parent f40062b commit 6742250

File tree

8 files changed

+374
-18
lines changed

8 files changed

+374
-18
lines changed

‎packages/cubejs-api-gateway/src/gateway.ts‎

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -234,7 +234,7 @@ class ApiGateway {
234234
const { query, variables } = req.body;
235235
const compilerApi = await this.getCompilerApi(req.context);
236236

237-
const metaConfig = await compilerApi.metaConfig({
237+
const metaConfig = await compilerApi.metaConfig(req.context, {
238238
requestId: req.context.requestId,
239239
});
240240

@@ -267,7 +267,7 @@ class ApiGateway {
267267
const compilerApi = await this.getCompilerApi(req.context);
268268
let schema = compilerApi.getGraphQLSchema();
269269
if (!schema) {
270-
let metaConfig = await compilerApi.metaConfig({
270+
let metaConfig = await compilerApi.metaConfig(req.context, {
271271
requestId: req.context.requestId,
272272
});
273273
metaConfig = this.filterVisibleItemsInMeta(req.context, metaConfig);
@@ -526,6 +526,7 @@ class ApiGateway {
526526
private filterVisibleItemsInMeta(context: RequestContext, cubes: any[]) {
527527
const isDevMode = getEnv('devMode');
528528
function visibilityFilter(item) {
529+
console.log('visibilityFilter', item, isDevMode, context.signedWithPlaygroundAuthSecret, item.isVisible);
529530
return isDevMode || context.signedWithPlaygroundAuthSecret || item.isVisible;
530531
}
531532

@@ -551,7 +552,7 @@ class ApiGateway {
551552
try {
552553
await this.assertApiScope('meta', context.securityContext);
553554
const compilerApi = await this.getCompilerApi(context);
554-
const metaConfig = await compilerApi.metaConfig({
555+
const metaConfig = await compilerApi.metaConfig(context, {
555556
requestId: context.requestId,
556557
includeCompilerId: includeCompilerId || onlyCompilerId
557558
});
@@ -587,7 +588,7 @@ class ApiGateway {
587588
try {
588589
await this.assertApiScope('meta', context.securityContext);
589590
const compilerApi = await this.getCompilerApi(context);
590-
const metaConfigExtended = await compilerApi.metaConfigExtended({
591+
const metaConfigExtended = await compilerApi.metaConfigExtended(context, {
591592
requestId: context.requestId,
592593
});
593594
const { metaConfig, cubeDefinitions } = metaConfigExtended;
@@ -1010,7 +1011,7 @@ class ApiGateway {
10101011
} else {
10111012
const metaCacheKey = JSON.stringify(ctx);
10121013
if (!metaCache.has(metaCacheKey)) {
1013-
metaCache.set(metaCacheKey, await compiler.metaConfigExtended(ctx));
1014+
metaCache.set(metaCacheKey, await compiler.metaConfigExtended(context, ctx));
10141015
}
10151016

10161017
// checking and fetching result status
@@ -1195,8 +1196,14 @@ class ApiGateway {
11951196
}
11961197

11971198
const normalizedQuery = normalizeQuery(currentQuery, persistent);
1198-
let rewrittenQuery = await this.queryRewrite(
1199+
// First apply cube/view level security policies
1200+
let rewrittenQuery = (await this.compilerApi(context)).applyRowLevelSecurity(
11991201
normalizedQuery,
1202+
context
1203+
);
1204+
// Then apply user-supplied queryRewrite
1205+
rewrittenQuery = await this.queryRewrite(
1206+
rewrittenQuery,
12001207
context,
12011208
);
12021209

@@ -1693,7 +1700,7 @@ class ApiGateway {
16931700
await this.getNormalizedQueries(query, context);
16941701

16951702
let metaConfigResult = await (await this
1696-
.getCompilerApi(context)).metaConfig({
1703+
.getCompilerApi(context)).metaConfig(request.context, {
16971704
requestId: context.requestId
16981705
});
16991706

@@ -1803,7 +1810,7 @@ class ApiGateway {
18031810
await this.getNormalizedQueries(query, context, request.streaming, request.memberExpressions);
18041811

18051812
const compilerApi = await this.getCompilerApi(context);
1806-
let metaConfigResult = await compilerApi.metaConfig({
1813+
let metaConfigResult = await compilerApi.metaConfig(request.context, {
18071814
requestId: context.requestId
18081815
});
18091816

‎packages/cubejs-schema-compiler/src/compiler/CubeSymbols.js‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ import { BaseQuery } from '../adapter';
1010
const FunctionRegex = /function\s+\w+\(([A-Za-z0-9_,]*)|\(([\s\S]*?)\)\s*=>|\(?(\w+)\)?\s*=>/;
1111
const CONTEXT_SYMBOLS = {
1212
SECURITY_CONTEXT: 'securityContext',
13+
security_context: 'securityContext',
1314
FILTER_PARAMS: 'filterParams',
1415
FILTER_GROUP: 'filterGroup',
1516
SQL_UTILS: 'sqlUtils'
@@ -139,6 +140,7 @@ export class CubeSymbols {
139140
this.camelCaseTypes(cube.dimensions);
140141
this.camelCaseTypes(cube.segments);
141142
this.camelCaseTypes(cube.preAggregations);
143+
this.camelCaseTypes(cube.accessPolicy);
142144

143145
if (cube.preAggregations) {
144146
this.transformPreAggregations(cube.preAggregations);
@@ -148,6 +150,10 @@ export class CubeSymbols {
148150
this.prepareIncludes(cube, errorReporter, splitViews);
149151
}
150152

153+
if (cube.accessPolicy) {
154+
this.prepareAccessPolicy(cube, errorReporter);
155+
}
156+
151157
return Object.assign(
152158
{ cubeName: () => cube.name, cubeObj: () => cube },
153159
cube.measures || {},
@@ -213,6 +219,59 @@ export class CubeSymbols {
213219
}
214220
}
215221

222+
/**
223+
* @protected
224+
*/
225+
allMembersOrList(cube, specifier) {
226+
const types = ['measures', 'dimensions'];
227+
if (specifier === '*') {
228+
const allMembers = R.unnest(types.map(type => Object.keys(cube[type] || {})));
229+
console.log('allMembers', allMembers);
230+
return allMembers;
231+
} else {
232+
return specifier || [];
233+
}
234+
}
235+
236+
/**
237+
* @protected
238+
*/
239+
prepareAccessPolicy(cube, errorReporter) {
240+
for (const policy of cube.accessPolicy) {
241+
for (const filter of policy?.rowLevel?.filters || []) {
242+
filter.memberReference = this.evaluateReferences(cube, filter.member);
243+
if (filter.memberReference.indexOf('.') !== -1) {
244+
errorReporter.error(
245+
`Paths aren't allowed in security policy filters but '${filter.memberReference}' provided as member for ${cube.name}`
246+
);
247+
}
248+
filter.memberReference = this.pathFromArray([cube.name, filter.memberReference]);
249+
}
250+
251+
if (policy.memberLevel) {
252+
const memberMapper = (member) => {
253+
if (member.indexOf('.') !== -1) {
254+
errorReporter.error(
255+
`Paths aren't allowed in memberLevel policy but '${member}' provided as a member for ${cube.name}`
256+
);
257+
}
258+
return this.pathFromArray([cube.name, member]);
259+
};
260+
261+
const evaluatedIncludes = this.evaluateReferences(cube, policy.memberLevel.includes);
262+
const evaluatedExcludes = this.evaluateReferences(cube, policy.memberLevel.excludes);
263+
264+
// TODO(maxim): Should includes be '*' by default or must it be explicitly defined?
265+
if (!evaluatedIncludes) {
266+
errorReporter.error(`${cube.name} memberLevel.includes must be defined or set to "*"`);
267+
}
268+
269+
policy.memberLevel.includesMembers = this.allMembersOrList(cube, evaluatedIncludes).map(memberMapper);
270+
policy.memberLevel.excludesMembers = this.allMembersOrList(cube, evaluatedExcludes).map(memberMapper);
271+
}
272+
}
273+
}
274+
216275
/**
217276
* @protected
218277
*/
@@ -406,6 +465,27 @@ export class CubeSymbols {
406465
});
407466
}
408467

468+
// Used to evaluate access policies to allow referencing security_context at query time
469+
evaluateContextFunction(cube, contextFn, context = {}) {
470+
const cubeEvaluator = this;
471+
472+
const res = cubeEvaluator.resolveSymbolsCall(contextFn, (name) => {
473+
const resolvedSymbol = this.resolveSymbol(cube, name);
474+
if (resolvedSymbol) {
475+
return resolvedSymbol;
476+
}
477+
throw new UserError(
478+
`Cube references are not allowed when evaluating RLS conditions or filters. Found: ${name} in ${cube.name}`
479+
);
480+
}, {
481+
contextSymbols: {
482+
securityContext: context.securityContext,
483+
}
484+
});
485+
486+
return res;
487+
}
488+
409489
evaluateReferences(cube, referencesFn, options = {}) {
410490
const cubeEvaluator = this;
411491

@@ -458,6 +538,10 @@ export class CubeSymbols {
458538
res = res.fn.apply(null, res.memberNames.map((id) => nameResolver(id.trim())));
459539
}
460540
return res;
541+
} catch (e) {
542+
// TODO(maxim): should we keep this log?
543+
console.log('Error while resolving Cube symbols: ', e);
544+
console.error(e);
461545
} finally {
462546
this.resolveSymbolsCallContext = oldContext;
463547
}

‎packages/cubejs-schema-compiler/src/compiler/CubeToMetaTransformer.js‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,7 @@ export class CubeToMetaTransformer {
105105
})),
106106
R.toPairs
107107
)(cube.segments || {}),
108+
accessPolicy: cube.accessPolicy || [],
108109
hierarchies: cube.hierarchies || []
109110
},
110111
};

‎packages/cubejs-schema-compiler/src/compiler/CubeValidator.ts‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -615,6 +615,61 @@ const SegmentsSchema = Joi.object().pattern(identifierRegex, Joi.object().keys({
615615
public: Joi.boolean().strict(),
616616
}));
617617

618+
const PolicyFilterSchema = Joi.object().keys({
619+
member: Joi.func().required(),
620+
memberReference: Joi.string().required(),
621+
operator: Joi.any().valid(
622+
'equals',
623+
'notEquals',
624+
'contains',
625+
'notContains',
626+
'startsWith',
627+
'notStartsWith',
628+
'endsWith',
629+
'notEndsWith',
630+
'gt',
631+
'gte',
632+
'lt',
633+
'lte',
634+
'inDateRange',
635+
'notInDateRange',
636+
'beforeDate',
637+
'beforeOrOnDate',
638+
'afterDate',
639+
'afterOrOnDate',
640+
).required(),
641+
values: Joi.func().required(),
642+
});
643+
644+
const MemberLevelPolicySchema = Joi.object().keys({
645+
excludes: Joi.func(),
646+
includes: Joi.func(),
647+
includesMembers: Joi.array().items(Joi.string().required()),
648+
excludesMembers: Joi.array().items(Joi.string().required()),
649+
});
650+
651+
const RowLevelPolicySchema = Joi.object().keys({
652+
653+
filters: Joi.array().items(Joi.alternatives().try(
654+
Joi.object().keys({
655+
or: Joi.array().items(PolicyFilterSchema).required(),
656+
and: Joi.array().items(PolicyFilterSchema).required(),
657+
}),
658+
PolicyFilterSchema,
659+
)).required(),
660+
});
661+
662+
// TODO(maxim): follow the "ATTENTION" thing below
663+
const RolePolicySchema = Joi.object().keys({
664+
role: Joi.string().required(),
665+
memberLevel: MemberLevelPolicySchema,
666+
rowLevel: RowLevelPolicySchema,
667+
conditions: Joi.array().items(Joi.object().keys({
668+
if: Joi.func().required(),
669+
})),
670+
// evaluatedConditions: Joi.array().items(Joi.boolean()),
671+
});
672+
618673
/* *****************************
619674
* ATTENTION:
620675
* In case of adding/removing/changing any Joi.func() field that needs to be transpiled,
@@ -692,6 +747,7 @@ const baseSchema = {
692747
title: Joi.string(),
693748
levels: Joi.func()
694749
})),
750+
accessPolicy: Joi.array().items(RolePolicySchema),
695751
};
696752

697753
const cubeSchema = inherit(baseSchema, {

‎packages/cubejs-schema-compiler/src/compiler/transpilers/CubePropContextTranspiler.ts‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,10 @@ export const transpiledFieldsPatterns: Array<RegExp> = [
2525
/^excludes$/,
2626
/^hierarchies\.[0-9]+\.levels$/,
2727
/^cubes\.[0-9]+\.(joinPath|join_path)$/,
28+
/^accessPolicy|access_policy\.[0-9]+\.rowLevel|row_level\.filters\.[0-9]+\.member$/,
29+
/^accessPolicy|access_policy\.[0-9]+\.rowLevel|row_level\.filters\.[0-9]+\.values$/,
30+
/^accessPolicy|access_policy\.[0-9]+\.conditions.[0-9]+\.if$/,
31+
/^accessPolicy|access_policy\.[0-9]+\.memberLevel|member_level\.includes|excludes$/,
2832
];
2933

3034
export const transpiledFields: Set<String> = new Set<String>();

‎packages/cubejs-schema-compiler/test/unit/cube-validator.test.ts‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -979,5 +979,41 @@ describe('Cube Validation', () => {
979979
expect(validationResult.error).toBeFalsy();
980980
}
981981
});
982+
983+
it('cube defined with accessPolicy', async () => {
984+
const cubeValidator = new CubeValidator(new CubeSymbols());
985+
const cube = {
986+
name: 'name',
987+
sqlTable: () => 'public.Users',
988+
fileName: 'fileName',
989+
accessPolicy: [
990+
{
991+
role: 'admin',
992+
conditions: [
993+
{
994+
if: () => true,
995+
}
996+
],
997+
rowLevel: {
998+
filters: [
999+
{
1000+
member: () => 'id',
1001+
memberReference: 'name.id',
1002+
operator: 'equals',
1003+
values: () => [1, 2, 3]
1004+
}
1005+
]
1006+
},
1007+
memberLevel: {
1008+
includes: () => '*',
1009+
excludes: () => ['name', 'email']
1010+
},
1011+
}
1012+
],
1013+
};
1014+
1015+
const validationResult = cubeValidator.validate(cube, new ConsoleErrorReporter());
1016+
expect(validationResult.error).toBeFalsy();
1017+
});
9821018
});
9831019
});

0 commit comments

Comments
 (0)