Skip to content

Commit ee81817

Browse files
bsod90bsod90
committed
WIP: new style access policy framework for Cube
1 parent 8fa0d53 commit ee81817

File tree

13 files changed

+501
-22
lines changed

13 files changed

+501
-22
lines changed

‎.gitignore‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,4 +23,4 @@ testings/
2323
rust/cubesql/profile.json
2424
.cubestore
2525
.env
26-
26+
.vimspector.json

‎packages/cubejs-api-gateway/src/gateway.ts‎

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -234,7 +234,7 @@ class ApiGateway {
234234
const { query, variables } = req.body;
235235
const compilerApi = await this.getCompilerApi(req.context);
236236

237-
const metaConfig = await compilerApi.metaConfig({
237+
const metaConfig = await compilerApi.metaConfig(req.context, {
238238
requestId: req.context.requestId,
239239
});
240240

@@ -267,7 +267,7 @@ class ApiGateway {
267267
const compilerApi = await this.getCompilerApi(req.context);
268268
let schema = compilerApi.getGraphQLSchema();
269269
if (!schema) {
270-
let metaConfig = await compilerApi.metaConfig({
270+
let metaConfig = await compilerApi.metaConfig(req.context, {
271271
requestId: req.context.requestId,
272272
});
273273
metaConfig = this.filterVisibleItemsInMeta(req.context, metaConfig);
@@ -526,6 +526,7 @@ class ApiGateway {
526526
private filterVisibleItemsInMeta(context: RequestContext, cubes: any[]) {
527527
const isDevMode = getEnv('devMode');
528528
function visibilityFilter(item) {
529+
console.log('visibilityFilter', item, isDevMode, context.signedWithPlaygroundAuthSecret, item.isVisible);
529530
return isDevMode || context.signedWithPlaygroundAuthSecret || item.isVisible;
530531
}
531532

@@ -551,7 +552,7 @@ class ApiGateway {
551552
try {
552553
await this.assertApiScope('meta', context.securityContext);
553554
const compilerApi = await this.getCompilerApi(context);
554-
const metaConfig = await compilerApi.metaConfig({
555+
const metaConfig = await compilerApi.metaConfig(context, {
555556
requestId: context.requestId,
556557
includeCompilerId: includeCompilerId || onlyCompilerId
557558
});
@@ -587,7 +588,7 @@ class ApiGateway {
587588
try {
588589
await this.assertApiScope('meta', context.securityContext);
589590
const compilerApi = await this.getCompilerApi(context);
590-
const metaConfigExtended = await compilerApi.metaConfigExtended({
591+
const metaConfigExtended = await compilerApi.metaConfigExtended(context, {
591592
requestId: context.requestId,
592593
});
593594
const { metaConfig, cubeDefinitions } = metaConfigExtended;
@@ -1010,7 +1011,7 @@ class ApiGateway {
10101011
} else {
10111012
const metaCacheKey = JSON.stringify(ctx);
10121013
if (!metaCache.has(metaCacheKey)) {
1013-
metaCache.set(metaCacheKey, await compiler.metaConfigExtended(ctx));
1014+
metaCache.set(metaCacheKey, await compiler.metaConfigExtended(context, ctx));
10141015
}
10151016

10161017
// checking and fetching result status
@@ -1195,8 +1196,14 @@ class ApiGateway {
11951196
}
11961197

11971198
const normalizedQuery = normalizeQuery(currentQuery, persistent);
1198-
let rewrittenQuery = await this.queryRewrite(
1199+
// First apply cube/view level security policies
1200+
let rewrittenQuery = (await this.compilerApi(context)).applyRowLevelSecurity(
11991201
normalizedQuery,
1202+
context
1203+
);
1204+
// Then apply user-supplied queryRewrite
1205+
rewrittenQuery = await this.queryRewrite(
1206+
rewrittenQuery,
12001207
context,
12011208
);
12021209

@@ -1693,7 +1700,7 @@ class ApiGateway {
16931700
await this.getNormalizedQueries(query, context);
16941701

16951702
let metaConfigResult = await (await this
1696-
.getCompilerApi(context)).metaConfig({
1703+
.getCompilerApi(context)).metaConfig(request.context, {
16971704
requestId: context.requestId
16981705
});
16991706

@@ -1803,7 +1810,7 @@ class ApiGateway {
18031810
await this.getNormalizedQueries(query, context, request.streaming, request.memberExpressions);
18041811

18051812
const compilerApi = await this.getCompilerApi(context);
1806-
let metaConfigResult = await compilerApi.metaConfig({
1813+
let metaConfigResult = await compilerApi.metaConfig(request.context, {
18071814
requestId: context.requestId
18081815
});
18091816

‎packages/cubejs-schema-compiler/src/compiler/CubeEvaluator.ts‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,9 +112,51 @@ export class CubeEvaluator extends CubeSymbols {
112112

113113
this.prepareHierarchies(cube);
114114

115+
this.prepareAccessPolicy(cube, errorReporter);
116+
115117
return cube;
116118
}
117119

120+
private allMembersOrList(cube: any, specifier: string | string[]): string[] {
121+
const types = ['measures', 'dimensions'];
122+
if (specifier === '*') {
123+
const allMembers = R.unnest(types.map(type => Object.keys(cube[type] || {})));
124+
return allMembers;
125+
} else {
126+
return specifier as string[] || [];
127+
}
128+
}
129+
130+
private prepareAccessPolicy(cube: any, errorReporter: ErrorReporter) {
131+
if (!cube.accessPolicy) {
132+
return;
133+
}
134+
const memberMapper = (memberType: string) => (member: string) => {
135+
if (member.indexOf('.') !== -1) {
136+
const cubeName = member.split('.')[0];
137+
if (cubeName !== cube.name) {
138+
errorReporter.error(
139+
`Paths aren't allowed in the accessPolicy policy but '${member}' provided as ${memberType} for ${cube.name}`
140+
);
141+
}
142+
return member;
143+
}
144+
return this.pathFromArray([cube.name, member]);
145+
};
146+
147+
for (const policy of cube.accessPolicy) {
148+
for (const filter of policy?.rowLevel?.filters || []) {
149+
filter.memberReference = this.evaluateReferences(cube.name, filter.member);
150+
filter.memberReference = memberMapper('a filter member reference')(filter.memberReference);
151+
}
152+
153+
if (policy.memberLevel) {
154+
policy.memberLevel.includesMembers = this.allMembersOrList(cube, policy.memberLevel.includes).map(memberMapper('an includes member'));
155+
policy.memberLevel.excludesMembers = this.allMembersOrList(cube, policy.memberLevel.excludes || []).map(memberMapper('an excludes member'));
156+
}
157+
}
158+
}
159+
118160
private prepareHierarchies(cube: any) {
119161
if (Array.isArray(cube.hierarchies)) {
120162
cube.hierarchies = cube.hierarchies.map(hierarchy => ({

‎packages/cubejs-schema-compiler/src/compiler/CubeSymbols.js‎

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ import { BaseQuery } from '../adapter';
1010
const FunctionRegex = /function\s+\w+\(([A-Za-z0-9_,]*)|\(([\s\S]*?)\)\s*=>|\(?(\w+)\)?\s*=>/;
1111
const CONTEXT_SYMBOLS = {
1212
SECURITY_CONTEXT: 'securityContext',
13+
security_context: 'securityContext',
1314
FILTER_PARAMS: 'filterParams',
1415
FILTER_GROUP: 'filterGroup',
1516
SQL_UTILS: 'sqlUtils'
@@ -139,6 +140,7 @@ export class CubeSymbols {
139140
this.camelCaseTypes(cube.dimensions);
140141
this.camelCaseTypes(cube.segments);
141142
this.camelCaseTypes(cube.preAggregations);
143+
this.camelCaseTypes(cube.accessPolicy);
142144

143145
if (cube.preAggregations) {
144146
this.transformPreAggregations(cube.preAggregations);
@@ -406,6 +408,27 @@ export class CubeSymbols {
406408
});
407409
}
408410

411+
// Used to evaluate access policies to allow referencing security_context at query time
412+
evaluateContextFunction(cube, contextFn, context = {}) {
413+
const cubeEvaluator = this;
414+
415+
const res = cubeEvaluator.resolveSymbolsCall(contextFn, (name) => {
416+
const resolvedSymbol = this.resolveSymbol(cube, name);
417+
if (resolvedSymbol) {
418+
return resolvedSymbol;
419+
}
420+
throw new UserError(
421+
`Cube references are not allowed when evaluating RLS conditions or filters. Found: ${name} in ${cube.name}`
422+
);
423+
}, {
424+
contextSymbols: {
425+
securityContext: context.securityContext,
426+
}
427+
});
428+
429+
return res;
430+
}
431+
409432
evaluateReferences(cube, referencesFn, options = {}) {
410433
const cubeEvaluator = this;
411434

@@ -437,7 +460,7 @@ export class CubeSymbols {
437460
collectJoinHints: options.collectJoinHints,
438461
});
439462
if (!Array.isArray(arrayOrSingle)) {
440-
return arrayOrSingle.toString();
463+
return arrayOrSingle && arrayOrSingle.toString();
441464
}
442465

443466
const references = arrayOrSingle.map(p => p.toString());
@@ -458,6 +481,10 @@ export class CubeSymbols {
458481
res = res.fn.apply(null, res.memberNames.map((id) => nameResolver(id.trim())));
459482
}
460483
return res;
484+
} catch (e) {
485+
// TODO(maxim): should we keep this log?
486+
console.log('Error while resolving Cube symbols: ', e);
487+
console.error(e);
461488
} finally {
462489
this.resolveSymbolsCallContext = oldContext;
463490
}

‎packages/cubejs-schema-compiler/src/compiler/CubeToMetaTransformer.js‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,7 @@ export class CubeToMetaTransformer {
105105
})),
106106
R.toPairs
107107
)(cube.segments || {}),
108+
accessPolicy: cube.accessPolicy || [],
108109
hierarchies: cube.hierarchies || []
109110
},
110111
};

‎packages/cubejs-schema-compiler/src/compiler/CubeValidator.ts‎

Lines changed: 64 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,8 @@ export const nonStringFields = new Set([
2525
'external',
2626
'useOriginalSqlPreAggregations',
2727
'readOnly',
28-
'prefix'
28+
'prefix',
29+
'if',
2930
]);
3031

3132
const identifierRegex = /^[_a-zA-Z][_a-zA-Z0-9]*$/;
@@ -615,6 +616,67 @@ const SegmentsSchema = Joi.object().pattern(identifierRegex, Joi.object().keys({
615616
public: Joi.boolean().strict(),
616617
}));
617618

619+
const PolicyFilterSchema = Joi.object().keys({
620+
member: Joi.func().required(),
621+
memberReference: Joi.string(),
622+
operator: Joi.any().valid(
623+
'equals',
624+
'notEquals',
625+
'contains',
626+
'notContains',
627+
'startsWith',
628+
'notStartsWith',
629+
'endsWith',
630+
'notEndsWith',
631+
'gt',
632+
'gte',
633+
'lt',
634+
'lte',
635+
'inDateRange',
636+
'notInDateRange',
637+
'beforeDate',
638+
'beforeOrOnDate',
639+
'afterDate',
640+
'afterOrOnDate',
641+
).required(),
642+
values: Joi.func().required(),
643+
});
644+
645+
const MemberLevelPolicySchema = Joi.object().keys({
646+
// TODO(maxim): these should be .func()? Should they even allow references?
647+
includes: Joi.alternatives([
648+
Joi.string().valid('*'),
649+
Joi.array().items(Joi.string().required())
650+
]).required(),
651+
excludes: Joi.alternatives([
652+
Joi.array().items(Joi.string().required())
653+
]),
654+
includesMembers: Joi.array().items(Joi.string().required()),
655+
excludesMembers: Joi.array().items(Joi.string().required()),
656+
});
657+
658+
const RowLevelPolicySchema = Joi.object().keys({
659+
660+
filters: Joi.array().items(Joi.alternatives().try(
661+
Joi.object().keys({
662+
or: Joi.array().items(PolicyFilterSchema).required(),
663+
and: Joi.array().items(PolicyFilterSchema).required(),
664+
}),
665+
PolicyFilterSchema,
666+
)).required(),
667+
});
668+
669+
// TODO(maxim): follow the "ATTENTION" thing below
670+
const RolePolicySchema = Joi.object().keys({
671+
role: Joi.string().required(),
672+
memberLevel: MemberLevelPolicySchema,
673+
rowLevel: RowLevelPolicySchema,
674+
conditions: Joi.array().items(Joi.object().keys({
675+
if: Joi.func().required(),
676+
})),
677+
// evaluatedConditions: Joi.array().items(Joi.boolean()),
678+
});
679+
618680
/* *****************************
619681
* ATTENTION:
620682
* In case of adding/removing/changing any Joi.func() field that needs to be transpiled,
@@ -692,6 +754,7 @@ const baseSchema = {
692754
title: Joi.string(),
693755
levels: Joi.func()
694756
})),
757+
accessPolicy: Joi.array().items(RolePolicySchema),
695758
};
696759

697760
const cubeSchema = inherit(baseSchema, {

‎packages/cubejs-schema-compiler/src/compiler/transpilers/CubePropContextTranspiler.ts‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,10 @@ export const transpiledFieldsPatterns: Array<RegExp> = [
2525
/^excludes$/,
2626
/^hierarchies\.[0-9]+\.levels$/,
2727
/^cubes\.[0-9]+\.(joinPath|join_path)$/,
28+
/^(accessPolicy|access_policy)\.[0-9]+\.(rowLevel|row_level)\.filters\.[0-9]+\.member$/,
29+
/^(accessPolicy|access_policy)\.[0-9]+\.(rowLevel|row_level)\.filters\.[0-9]+\.values$/,
30+
/^(accessPolicy|access_policy)\.[0-9]+\.conditions.[0-9]+\.if$/,
31+
// /^(accessPolicy|access_policy)\.[0-9]+\.(memberLevel|member_level)\.(includes|excludes)$/,
2832
];
2933

3034
export const transpiledFields: Set<String> = new Set<String>();

‎packages/cubejs-schema-compiler/src/compiler/utils.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,7 @@ export function camelizeCube(cube: any): unknown {
4848
camelizeObjectPart(cube.dimensions, false);
4949
camelizeObjectPart(cube.preAggregations, false);
5050
camelizeObjectPart(cube.cubes, false);
51+
camelizeObjectPart(cube.accessPolicy, false);
5152

5253
return cube;
5354
}

‎packages/cubejs-schema-compiler/test/unit/schema.test.ts‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
import { prepareCompiler } from './PrepareCompiler';
2-
import { createCubeSchema, createCubeSchemaWithCustomGranularities } from './utils';
2+
import { createCubeSchema, createCubeSchemaWithCustomGranularities, createCubeSchemaWithAccessPolicy } from './utils';
33

44
describe('Schema Testing', () => {
55
const schemaCompile = async () => {
@@ -367,4 +367,15 @@ describe('Schema Testing', () => {
367367
CubeD: { relationship: 'belongsTo' }
368368
});
369369
});
370+
371+
it('valid schema with accessPolicy', async () => {
372+
const { compiler, metaTransformer } = prepareCompiler([
373+
createCubeSchemaWithAccessPolicy('ProtectedCube'),
374+
]);
375+
await compiler.compile();
376+
compiler.throwIfAnyErrors();
377+
378+
// TODO(maxim): this should be further validated
379+
expect(metaTransformer.cubes[0].config.accessPolicy).toBeDefined();
380+
});
370381
});

0 commit comments

Comments
 (0)