forked from janus-idp/backstage-plugins
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix(rbac): rework condition policies to bound them to RBAC roles (jan…
…us-idp#1330) * fix(rbac)!: rework condition policies to bound them to RBAC roles Signed-off-by: Oleksandr Andriienko <[email protected]>
- Loading branch information
1 parent
c8c2b13
commit 55c00b2
Showing
17 changed files
with
2,533 additions
and
457 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
19 changes: 19 additions & 0 deletions
19
plugins/rbac-backend/migrations/20240308134410_migrations.js
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| /** | ||
| * @param { import("knex").Knex } knex | ||
| * @returns { Promise<void> } | ||
| */ | ||
| exports.up = async function up(knex) { | ||
| const policyConditionsExist = await knex.schema.hasTable('policy-conditions'); | ||
|
|
||
| if (policyConditionsExist) { | ||
| // We drop policy condition table, because we decided to rework this feature | ||
| // and bound policy condition to the role | ||
| await knex.schema.dropTable('policy-conditions'); | ||
| } | ||
| }; | ||
|
|
||
| /** | ||
| * @param { import("knex").Knex } knex | ||
| * @returns { Promise<void> } | ||
| */ | ||
| exports.down = async function down(_knex) {}; |
33 changes: 33 additions & 0 deletions
33
plugins/rbac-backend/migrations/20240308134941_migrations.js
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,33 @@ | ||
| /** | ||
| * up - runs migration. | ||
| * | ||
| * @param { import("knex").Knex } knex | ||
| * @returns { Promise<void> } | ||
| */ | ||
| exports.up = async function up(knex) { | ||
| await knex.schema.createTable('role-condition-policies', table => { | ||
| table.increments('id').primary(); | ||
| table.string('roleEntityRef'); | ||
| table.string('result'); | ||
| table.string('pluginId'); | ||
| table.string('resourceType'); | ||
| table.string('permissions'); | ||
| // Conditions is potentially long json. | ||
| // In the future maybe we can use `json` or `jsonb` type instead of `text`: | ||
| // table.json('conditions') or table.jsonb('conditions'). | ||
| // But let's start with text type. | ||
| // Data type "text" can be unlimited by size for Postgres. | ||
| // Also postgres has a lot of build in features for this data type. | ||
| table.text('conditionsJson'); | ||
| }); | ||
| }; | ||
|
|
||
| /** | ||
| * down - reverts(undo) migration. | ||
| * | ||
| * @param { import("knex").Knex } knex | ||
| * @returns { Promise<void> } | ||
| */ | ||
| exports.down = async function down(knex) { | ||
| await knex.schema.dropTable('policy-conditions'); | ||
| }; |
Oops, something went wrong.