Skip to content

Commit b2ecd49

Browse files
gmazoyergmazoyer
authored
IFC-1827 Add global permission to update display label and HFID (#7382)
1 parent 5915930 commit b2ecd49

File tree

6 files changed

+53
-24
lines changed

6 files changed

+53
-24
lines changed

‎backend/infrahub/core/constants/__init__.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,7 @@ class GlobalPermissions(InfrahubStringEnum):
9999
MANAGE_PERMISSIONS = "manage_permissions"
100100
MANAGE_REPOSITORIES = "manage_repositories"
101101
OVERRIDE_CONTEXT = "override_context"
102+
UPDATE_OBJECT_HFID_DISPLAY_LABEL = "update_object_hfid_display_label"
102103

103104

104105
class PermissionAction(InfrahubStringEnum):

‎backend/infrahub/graphql/mutations/display_label.py‎

Lines changed: 17 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
from graphene import Boolean, InputObjectType, Mutation, String
66

77
from infrahub.core.account import ObjectPermission
8-
from infrahub.core.constants import PermissionAction, PermissionDecision
8+
from infrahub.core.constants import GlobalPermissions, PermissionAction, PermissionDecision
99
from infrahub.core.manager import NodeManager
1010
from infrahub.core.registry import registry
1111
from infrahub.database import retry_db_transaction
@@ -15,6 +15,7 @@
1515
from infrahub.graphql.context import apply_external_context
1616
from infrahub.graphql.types.context import ContextInput
1717
from infrahub.log import get_log_data
18+
from infrahub.permissions import define_global_permission_from_branch
1819
from infrahub.worker import WORKER_IDENTITY
1920

2021
if TYPE_CHECKING:
@@ -52,15 +53,21 @@ async def mutate(
5253
if not node_schema.display_label:
5354
raise ValidationError(input_value=f"{node_schema.kind}.display_label has not been defined for this kind.")
5455

55-
graphql_context.active_permissions.raise_for_permission(
56-
permission=ObjectPermission(
57-
namespace=node_schema.namespace,
58-
name=node_schema.name,
59-
action=PermissionAction.UPDATE.value,
60-
decision=PermissionDecision.ALLOW_DEFAULT.value
61-
if graphql_context.branch.name == registry.default_branch
62-
else PermissionDecision.ALLOW_OTHER.value,
63-
)
56+
graphql_context.active_permissions.raise_for_permissions(
57+
permissions=[
58+
define_global_permission_from_branch(
59+
permission=GlobalPermissions.UPDATE_OBJECT_HFID_DISPLAY_LABEL,
60+
branch_name=graphql_context.branch.name,
61+
),
62+
ObjectPermission(
63+
namespace=node_schema.namespace,
64+
name=node_schema.name,
65+
action=PermissionAction.UPDATE.value,
66+
decision=PermissionDecision.ALLOW_DEFAULT.value
67+
if graphql_context.branch.name == registry.default_branch
68+
else PermissionDecision.ALLOW_OTHER.value,
69+
),
70+
]
6471
)
6572
await apply_external_context(graphql_context=graphql_context, context_input=context)
6673

‎backend/infrahub/graphql/mutations/hfid.py‎

Lines changed: 17 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
from graphene import Boolean, InputObjectType, List, Mutation, NonNull, String
66

77
from infrahub.core.account import ObjectPermission
8-
from infrahub.core.constants import PermissionAction, PermissionDecision
8+
from infrahub.core.constants import GlobalPermissions, PermissionAction, PermissionDecision
99
from infrahub.core.manager import NodeManager
1010
from infrahub.core.registry import registry
1111
from infrahub.database import retry_db_transaction
@@ -15,6 +15,7 @@
1515
from infrahub.graphql.context import apply_external_context
1616
from infrahub.graphql.types.context import ContextInput
1717
from infrahub.log import get_log_data
18+
from infrahub.permissions import define_global_permission_from_branch
1819
from infrahub.worker import WORKER_IDENTITY
1920

2021
if TYPE_CHECKING:
@@ -61,15 +62,21 @@ async def mutate(
6162
input_value=f"{node_schema.kind}.human_friendly_id requires {len(node_schema.human_friendly_id)} parts data has {len(updated_hfid)}"
6263
)
6364

64-
graphql_context.active_permissions.raise_for_permission(
65-
permission=ObjectPermission(
66-
namespace=node_schema.namespace,
67-
name=node_schema.name,
68-
action=PermissionAction.UPDATE.value,
69-
decision=PermissionDecision.ALLOW_DEFAULT.value
70-
if graphql_context.branch.name == registry.default_branch
71-
else PermissionDecision.ALLOW_OTHER.value,
72-
)
65+
graphql_context.active_permissions.raise_for_permissions(
66+
permissions=[
67+
define_global_permission_from_branch(
68+
permission=GlobalPermissions.UPDATE_OBJECT_HFID_DISPLAY_LABEL,
69+
branch_name=graphql_context.branch.name,
70+
),
71+
ObjectPermission(
72+
namespace=node_schema.namespace,
73+
name=node_schema.name,
74+
action=PermissionAction.UPDATE.value,
75+
decision=PermissionDecision.ALLOW_DEFAULT.value
76+
if graphql_context.branch.name == registry.default_branch
77+
else PermissionDecision.ALLOW_OTHER.value,
78+
),
79+
]
7380
)
7481
await apply_external_context(graphql_context=graphql_context, context_input=context)
7582

‎backend/infrahub/permissions/constants.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ class BranchRelativePermissionDecision(StrEnum):
3030
GlobalPermissions.MANAGE_ACCOUNTS.value: "You are not allowed to manage user accounts, groups or roles",
3131
GlobalPermissions.MANAGE_PERMISSIONS.value: "You are not allowed to manage permissions",
3232
GlobalPermissions.MANAGE_REPOSITORIES.value: "You are not allowed to manage repositories",
33+
GlobalPermissions.UPDATE_OBJECT_HFID_DISPLAY_LABEL.value: "You are not allowed to update human friendly IDs and display labels ad hoc",
3334
}
3435

3536
GLOBAL_PERMISSION_DESCRIPTION = {
@@ -42,4 +43,5 @@ class BranchRelativePermissionDecision(StrEnum):
4243
GlobalPermissions.MANAGE_PERMISSIONS: "Allow a user to manage permissions",
4344
GlobalPermissions.MANAGE_REPOSITORIES: "Allow a user to manage repositories",
4445
GlobalPermissions.SUPER_ADMIN: "Allow a user to do anything",
46+
GlobalPermissions.UPDATE_OBJECT_HFID_DISPLAY_LABEL: "Allow a user to update objects' display labels and human friendly IDs ad hoc",
4547
}

‎backend/tests/unit/graphql/mutations/test_display_label.py‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,9 @@
33
from typing import TYPE_CHECKING, Any
44
from uuid import uuid4
55

6-
from infrahub.core.account import ObjectPermission
6+
from infrahub.core.account import GlobalPermission, ObjectPermission
77
from infrahub.core.branch.models import Branch
8-
from infrahub.core.constants import PermissionAction, PermissionDecision
8+
from infrahub.core.constants import GlobalPermissions, PermissionAction, PermissionDecision
99
from infrahub.core.node import Node
1010
from infrahub.core.registry import registry
1111
from infrahub.core.schema import SchemaRoot
@@ -88,6 +88,12 @@ async def test_update_display_label_update(
8888
await define_permissions(
8989
account=first_account,
9090
db=db,
91+
global_permissions=[
92+
GlobalPermission(
93+
action=GlobalPermissions.UPDATE_OBJECT_HFID_DISPLAY_LABEL.value,
94+
decision=PermissionDecision.ALLOW_ALL.value,
95+
)
96+
],
9197
object_permissions=[
9298
ObjectPermission(
9399
namespace=TSHIRT.namespace,

‎backend/tests/unit/graphql/mutations/test_hfid.py‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,9 @@
33
from typing import TYPE_CHECKING
44
from uuid import uuid4
55

6-
from infrahub.core.account import ObjectPermission
6+
from infrahub.core.account import GlobalPermission, ObjectPermission
77
from infrahub.core.branch.models import Branch
8-
from infrahub.core.constants import PermissionAction, PermissionDecision
8+
from infrahub.core.constants import GlobalPermissions, PermissionAction, PermissionDecision
99
from infrahub.core.node import Node
1010
from infrahub.core.registry import registry
1111
from infrahub.core.schema import SchemaRoot
@@ -71,6 +71,12 @@ async def test_update_hfid_update(
7171
await define_permissions(
7272
account=first_account,
7373
db=db,
74+
global_permissions=[
75+
GlobalPermission(
76+
action=GlobalPermissions.UPDATE_OBJECT_HFID_DISPLAY_LABEL.value,
77+
decision=PermissionDecision.ALLOW_ALL.value,
78+
)
79+
],
7480
object_permissions=[
7581
ObjectPermission(
7682
namespace=TSHIRT.namespace,

0 commit comments

Comments
 (0)