Skip to content

Commit d1dfc2f

Browse files
ajtmccartyajtmccarty
authored
support deletes in AccountPermissionQuery (#4563)
1 parent 21fd78d commit d1dfc2f

File tree

2 files changed

+89
-17
lines changed

2 files changed

+89
-17
lines changed

‎backend/infrahub/core/account.py‎

Lines changed: 86 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -145,24 +145,93 @@ async def query_init(self, db: InfrahubDatabase, **kwargs: Any) -> None:
145145
WITH account, r1 as r
146146
WHERE r.status = "active"
147147
WITH account
148-
MATCH group_path = (account)-[]->(:Relationship {name: "group_member"})
149-
<-[]-(:%(account_group_node)s)
150-
-[]->(:Relationship {name: "role__accountgroups"})
151-
<-[]-(:%(account_role_node)s)
152-
-[]->(:Relationship {name: "role__permissions"})
153-
<-[]-(object_permission:%(object_permission_node)s)
154-
-[:HAS_ATTRIBUTE]->(:Attribute {name: "branch"})
155-
-[:HAS_VALUE]->(object_permission_branch:AttributeValue)
148+
CALL {
149+
WITH account
150+
MATCH (account)-[r1:IS_RELATED]->(:Relationship {name: "group_member"})<-[r2:IS_RELATED]-(account_group:%(account_group_node)s)
151+
WHERE all(r IN [r1, r2] WHERE (%(branch_filter)s))
152+
WITH account_group, r1, r2, (r1.status = "active" AND r2.status = "active") AS is_active
153+
ORDER BY account_group.uuid, r2.branch_level DESC, r2.from DESC, r1.branch_level DESC, r1.from DESC
154+
WITH account_group, head(collect(is_active)) as latest_is_active
155+
WHERE latest_is_active = TRUE
156+
RETURN account_group
157+
}
158+
WITH account_group
159+
160+
CALL {
161+
WITH account_group
162+
MATCH (account_group)-[r1:IS_RELATED]->(:Relationship {name: "role__accountgroups"})<-[r2:IS_RELATED]-(account_role:%(account_role_node)s)
163+
WHERE all(r IN [r1, r2] WHERE (%(branch_filter)s))
164+
WITH account_role, r1, r2, (r1.status = "active" AND r2.status = "active") AS is_active
165+
ORDER BY account_role.uuid, r2.branch_level DESC, r2.from DESC, r1.branch_level DESC, r1.from DESC
166+
WITH account_role, head(collect(is_active)) as latest_is_active
167+
WHERE latest_is_active = TRUE
168+
RETURN account_role
169+
}
170+
WITH account_role
171+
172+
CALL {
173+
WITH account_role
174+
MATCH (account_role)-[r1:IS_RELATED]->(:Relationship {name: "role__permissions"})<-[r2:IS_RELATED]-(object_permission:%(object_permission_node)s)
175+
WHERE all(r IN [r1, r2] WHERE (%(branch_filter)s))
176+
WITH object_permission, r1, r2, (r1.status = "active" AND r2.status = "active") AS is_active
177+
ORDER BY object_permission.uuid, r2.branch_level DESC, r2.from DESC, r1.branch_level DESC, r1.from DESC
178+
WITH object_permission, head(collect(is_active)) as latest_is_active
179+
WHERE latest_is_active = TRUE
180+
RETURN object_permission
181+
}
182+
WITH object_permission
183+
CALL {
184+
WITH object_permission
185+
MATCH (object_permission)-[r1:HAS_ATTRIBUTE]->(:Attribute {name: "branch"})-[r2:HAS_VALUE]->(object_permission_branch:AttributeValue)
186+
WHERE all(r IN [r1, r2] WHERE (%(branch_filter)s))
187+
WITH object_permission_branch, r1, r2, (r1.status = "active" AND r2.status = "active") AS is_active
188+
ORDER BY object_permission_branch.uuid, r2.branch_level DESC, r2.from DESC, r1.branch_level DESC, r1.from DESC
189+
WITH object_permission_branch, head(collect(is_active)) as latest_is_active
190+
WHERE latest_is_active = TRUE
191+
RETURN object_permission_branch
192+
}
156193
WITH object_permission, object_permission_branch
157-
WHERE all(r IN relationships(group_path) WHERE (%(branch_filter)s) AND r.status = "active")
158-
MATCH namespace_path = (object_permission)-[:HAS_ATTRIBUTE]->(:Attribute {name: "namespace"})-[:HAS_VALUE]->(object_permission_namespace:AttributeValue)
159-
WHERE all(r IN relationships(namespace_path) WHERE (%(branch_filter)s) AND r.status = "active")
160-
MATCH name_path = (object_permission)-[:HAS_ATTRIBUTE]->(:Attribute {name: "name"})-[:HAS_VALUE]->(object_permission_name:AttributeValue)
161-
WHERE all(r IN relationships(name_path) WHERE (%(branch_filter)s) AND r.status = "active")
162-
MATCH action_path = (object_permission)-[:HAS_ATTRIBUTE]->(:Attribute {name: "action"})-[:HAS_VALUE]->(object_permission_action:AttributeValue)
163-
WHERE all(r IN relationships(action_path) WHERE (%(branch_filter)s) AND r.status = "active")
164-
MATCH decision_path = (object_permission)-[:HAS_ATTRIBUTE]->(:Attribute {name: "decision"})-[:HAS_VALUE]->(object_permission_decision:AttributeValue)
165-
WHERE all(r IN relationships(decision_path) WHERE (%(branch_filter)s) AND r.status = "active")
194+
195+
CALL {
196+
WITH object_permission
197+
MATCH (object_permission)-[r1:HAS_ATTRIBUTE]->(:Attribute {name: "namespace"})-[r2:HAS_VALUE]->(object_permission_namespace:AttributeValue)
198+
WHERE all(r IN [r1, r2] WHERE (%(branch_filter)s))
199+
RETURN object_permission_namespace, (r1.status = "active" AND r2.status = "active") AS is_active
200+
ORDER BY r2.branch_level DESC, r2.from DESC, r1.branch_level DESC, r1.from DESC
201+
LIMIT 1
202+
}
203+
WITH object_permission, object_permission_branch, object_permission_namespace, is_active AS opn_is_active
204+
WHERE opn_is_active = TRUE
205+
CALL {
206+
WITH object_permission
207+
MATCH (object_permission)-[r1:HAS_ATTRIBUTE]->(:Attribute {name: "name"})-[r2:HAS_VALUE]->(object_permission_name:AttributeValue)
208+
WHERE all(r IN [r1, r2] WHERE (%(branch_filter)s))
209+
RETURN object_permission_name, (r1.status = "active" AND r2.status = "active") AS is_active
210+
ORDER BY r2.branch_level DESC, r2.from DESC, r1.branch_level DESC, r1.from DESC
211+
LIMIT 1
212+
}
213+
WITH object_permission, object_permission_branch, object_permission_namespace, object_permission_name, is_active AS opn_is_active
214+
WHERE opn_is_active = TRUE
215+
CALL {
216+
WITH object_permission
217+
MATCH (object_permission)-[r1:HAS_ATTRIBUTE]->(:Attribute {name: "action"})-[r2:HAS_VALUE]->(object_permission_action:AttributeValue)
218+
WHERE all(r IN [r1, r2] WHERE (%(branch_filter)s))
219+
RETURN object_permission_action, (r1.status = "active" AND r2.status = "active") AS is_active
220+
ORDER BY r2.branch_level DESC, r2.from DESC, r1.branch_level DESC, r1.from DESC
221+
LIMIT 1
222+
}
223+
WITH object_permission, object_permission_branch, object_permission_namespace, object_permission_name, object_permission_action, is_active AS opa_is_active
224+
WHERE opa_is_active = TRUE
225+
CALL {
226+
WITH object_permission
227+
MATCH (object_permission)-[r1:HAS_ATTRIBUTE]->(:Attribute {name: "decision"})-[r2:HAS_VALUE]->(object_permission_decision:AttributeValue)
228+
WHERE all(r IN [r1, r2] WHERE (%(branch_filter)s))
229+
RETURN object_permission_decision, (r1.status = "active" AND r2.status = "active") AS is_active
230+
ORDER BY r2.branch_level DESC, r2.from DESC, r1.branch_level DESC, r1.from DESC
231+
LIMIT 1
232+
}
233+
WITH object_permission, object_permission_branch, object_permission_namespace, object_permission_name, object_permission_action, object_permission_decision, is_active AS opd_is_active
234+
WHERE opd_is_active = TRUE
166235
""" % {
167236
"branch_filter": branch_filter,
168237
"account_group_node": InfrahubKind.ACCOUNTGROUP,

‎backend/tests/unit/graphql/test_core_account.py‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,14 @@
33
from graphql import graphql
44

55
from infrahub.auth import AccountSession, AuthType
6+
from infrahub.core import registry
67
from infrahub.core.account import GlobalPermission, ObjectPermission
78
from infrahub.core.branch import Branch
89
from infrahub.core.constants import AccountRole, GlobalPermissions, PermissionAction, PermissionDecision
910
from infrahub.core.manager import NodeManager
1011
from infrahub.database import InfrahubDatabase
1112
from infrahub.graphql.initialization import prepare_graphql_params
13+
from infrahub.permissions.local_backend import LocalPermissionBackend
1214

1315

1416
@pytest.mark.parametrize("role", [e.value for e in AccountRole])
@@ -51,6 +53,7 @@ async def test_everyone_can_update_password(db: InfrahubDatabase, default_branch
5153
async def test_permissions(
5254
db: InfrahubDatabase, default_branch: Branch, authentication_base, session_admin, first_account
5355
):
56+
registry.permission_backends = [LocalPermissionBackend()]
5457
query = """
5558
query {
5659
InfrahubPermissions {

0 commit comments

Comments
 (0)