Deprecate User Scopes

CHANGELOG.md

@@ -19,6 +19,7 @@ The types of changes are:
 
 ### Changed
 * Improved standard layout for large width screens and polished misc. pages [#2869](https://github.com/ethyca/fides/pull/2869)
+* Deprecated adding scopes to users directly; you can only add roles. [#2848](https://github.com/ethyca/fides/pull/2848/files)
 
 ## [2.9.1](https://github.com/ethyca/fides/compare/2.9.0...2.9.1)
 

docs/fides/docs/development/postman/Fides.postman_collection.json

@@ -1,6 +1,6 @@
 {
 	"info": {
-		"_postman_id": "03d28ae1-a240-42f8-839e-92a4d43132ed",
+		"_postman_id": "71013d58-9646-47e3-b47a-f354d33ad35a",
 		"name": "Fides",
 		"schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
 	},
@@ -72,7 +72,7 @@
 						"header": [],
 						"body": {
 							"mode": "raw",
-							"raw": "[\n    \"client:create\",\n    \"client:update\",\n    \"client:read\",\n    \"client:delete\",\n    \"config:read\",\n    \"connection_type:read\",\n    \"connection:read\",\n    \"connection:create_or_update\",\n    \"connection:delete\",\n    \"connection:instantiate\",\n    \"consent:read\",\n    \"dataset:create_or_update\",\n    \"dataset:delete\",\n    \"dataset:read\",\n    \"encryption:exec\",\n    \"messaging:create_or_update\",\n    \"messaging:read\",\n    \"messaging:delete\",\n    \"policy:create_or_update\",\n    \"policy:read\",\n    \"policy:delete\",\n    \"privacy-request:read\",\n    \"privacy-request:delete\",\n    \"privacy-request-notifications:create_or_update\",\n    \"privacy-request-notifications:read\",\n    \"rule:create_or_update\",\n    \"rule:read\",\n    \"rule:delete\",\n    \"scope:read\",\n    \"storage:create_or_update\",\n    \"storage:delete\",\n    \"storage:read\",\n    \"privacy-request:resume\",\n    \"webhook:create_or_update\",\n    \"webhook:read\",\n    \"webhook:delete\",\n    \"saas_config:create_or_update\",\n    \"saas_config:read\",\n    \"saas_config:delete\",\n    \"privacy-request:review\",\n    \"user:create\",\n    \"user:delete\"\n]",
+							"raw": "[\n    \"client:create\",\n    \"client:update\",\n    \"client:read\",\n    \"client:delete\",\n    \"config:read\",\n    \"connection_type:read\",\n    \"connection:read\",\n    \"connection:create_or_update\",\n    \"connection:delete\",\n    \"connection:instantiate\",\n    \"consent:read\",\n    \"dataset:create_or_update\",\n    \"dataset:delete\",\n    \"dataset:read\",\n    \"encryption:exec\",\n    \"messaging:create_or_update\",\n    \"messaging:read\",\n    \"messaging:delete\",\n    \"policy:create_or_update\",\n    \"policy:read\",\n    \"policy:delete\",\n    \"privacy-request:read\",\n    \"privacy-request:delete\",\n    \"privacy-request-notifications:create_or_update\",\n    \"privacy-request-notifications:read\",\n    \"rule:create_or_update\",\n    \"rule:read\",\n    \"rule:delete\",\n    \"scope:read\",\n    \"storage:create_or_update\",\n    \"storage:delete\",\n    \"storage:read\",\n    \"system_manager:delete\",\n    \"system_manager:update\",\n    \"system_manager:read\",\n    \"privacy-request:resume\",\n    \"webhook:create_or_update\",\n    \"webhook:read\",\n    \"webhook:delete\",\n    \"saas_config:create_or_update\",\n    \"saas_config:read\",\n    \"saas_config:delete\",\n    \"privacy-request:review\",\n    \"user:create\",\n    \"user:delete\",\n    \"user-permission:create\",\n    \"user-permission:update\"\n]",
 							"options": {
 								"raw": {
 									"language": "json"
@@ -4840,6 +4840,280 @@
 					}
 				}
 			]
+		},
+		{
+			"name": "Roles",
+			"item": [
+				{
+					"name": "Add role (Create User Permissions - Usually you'll use Update Permissions instead)",
+					"request": {
+						"auth": {
+							"type": "bearer",
+							"bearer": [
+								{
+									"key": "token",
+									"value": "{{client_token}}",
+									"type": "string"
+								}
+							]
+						},
+						"method": "POST",
+						"header": [],
+						"body": {
+							"mode": "raw",
+							"raw": "{\"roles\": [\"viewer\"]}",
+							"options": {
+								"raw": {
+									"language": "json"
+								}
+							}
+						},
+						"url": {
+							"raw": "{{host}}/user/{{user_id}}/permission",
+							"host": [
+								"{{host}}"
+							],
+							"path": [
+								"user",
+								"{{user_id}}",
+								"permission"
+							]
+						}
+					},
+					"response": []
+				},
+				{
+					"name": "Update role (Update User Permissions)",
+					"request": {
+						"auth": {
+							"type": "bearer",
+							"bearer": [
+								{
+									"key": "token",
+									"value": "{{client_token}}",
+									"type": "string"
+								}
+							]
+						},
+						"method": "PUT",
+						"header": [],
+						"body": {
+							"mode": "raw",
+							"raw": "[\"demo_analytics_system\", \"demo_marketing_system\"]",
+							"options": {
+								"raw": {
+									"language": "json"
+								}
+							}
+						},
+						"url": {
+							"raw": "{{host}}/user/{{user_id}}/system-manager",
+							"host": [
+								"{{host}}"
+							],
+							"path": [
+								"user",
+								"{{user_id}}",
+								"system-manager"
+							]
+						}
+					},
+					"response": []
+				},
+				{
+					"name": "Get Allowed Roles",
+					"request": {
+						"auth": {
+							"type": "bearer",
+							"bearer": [
+								{
+									"key": "token",
+									"value": "{{client_token}}",
+									"type": "string"
+								}
+							]
+						},
+						"method": "GET",
+						"header": [],
+						"url": {
+							"raw": "{{host}}/oauth/role",
+							"host": [
+								"{{host}}"
+							],
+							"path": [
+								"oauth",
+								"role"
+							]
+						}
+					},
+					"response": []
+				}
+			]
+		},
+		{
+			"name": "System Managers",
+			"item": [
+				{
+					"name": "Update Managed Systems",
+					"request": {
+						"auth": {
+							"type": "bearer",
+							"bearer": [
+								{
+									"key": "token",
+									"value": "{{client_token}}",
+									"type": "string"
+								}
+							]
+						},
+						"method": "PUT",
+						"header": [],
+						"body": {
+							"mode": "raw",
+							"raw": "[\"demo_analytics_system\", \"demo_marketing_system\"]",
+							"options": {
+								"raw": {
+									"language": "json"
+								}
+							}
+						},
+						"url": {
+							"raw": "{{host}}/user/{{user_id}}/system-manager",
+							"host": [
+								"{{host}}"
+							],
+							"path": [
+								"user",
+								"{{user_id}}",
+								"system-manager"
+							]
+						}
+					},
+					"response": []
+				},
+				{
+					"name": "Get Systems Managed By User",
+					"protocolProfileBehavior": {
+						"disableBodyPruning": true
+					},
+					"request": {
+						"auth": {
+							"type": "bearer",
+							"bearer": [
+								{
+									"key": "token",
+									"value": "{{client_token}}",
+									"type": "string"
+								}
+							]
+						},
+						"method": "GET",
+						"header": [],
+						"body": {
+							"mode": "raw",
+							"raw": "",
+							"options": {
+								"raw": {
+									"language": "json"
+								}
+							}
+						},
+						"url": {
+							"raw": "{{host}}/user/{{user_id}}/system-manager",
+							"host": [
+								"{{host}}"
+							],
+							"path": [
+								"user",
+								"{{user_id}}",
+								"system-manager"
+							]
+						}
+					},
+					"response": []
+				},
+				{
+					"name": "Get Single System Managed By User",
+					"protocolProfileBehavior": {
+						"disableBodyPruning": true
+					},
+					"request": {
+						"auth": {
+							"type": "bearer",
+							"bearer": [
+								{
+									"key": "token",
+									"value": "{{client_token}}",
+									"type": "string"
+								}
+							]
+						},
+						"method": "GET",
+						"header": [],
+						"body": {
+							"mode": "raw",
+							"raw": "",
+							"options": {
+								"raw": {
+									"language": "json"
+								}
+							}
+						},
+						"url": {
+							"raw": "{{host}}/user/{{user_id}}/system-manager/demo_marketing_system",
+							"host": [
+								"{{host}}"
+							],
+							"path": [
+								"user",
+								"{{user_id}}",
+								"system-manager",
+								"demo_marketing_system"
+							]
+						}
+					},
+					"response": []
+				},
+				{
+					"name": "Remove User as System Manager",
+					"request": {
+						"auth": {
+							"type": "bearer",
+							"bearer": [
+								{
+									"key": "token",
+									"value": "{{client_token}}",
+									"type": "string"
+								}
+							]
+						},
+						"method": "DELETE",
+						"header": [],
+						"body": {
+							"mode": "raw",
+							"raw": "",
+							"options": {
+								"raw": {
+									"language": "json"
+								}
+							}
+						},
+						"url": {
+							"raw": "{{host}}/user/{{user_id}}/system-manager/demo_marketing_system",
+							"host": [
+								"{{host}}"
+							],
+							"path": [
+								"user",
+								"{{user_id}}",
+								"system-manager",
+								"demo_marketing_system"
+							]
+						}
+					},
+					"response": []
+				}
+			]
 		}
 	],
 	"event": [

src/fides/api/ctl/database/seed.py

@@ -11,18 +11,14 @@
 from fides.api.ctl.database.session import sync_session
 from fides.api.ctl.sql_models import sql_model_map  # type: ignore[attr-defined]
 from fides.api.ctl.utils.errors import AlreadyExistsError, QueryError
-from fides.api.ops.api.v1.scope_registry import (
-    PRIVACY_REQUEST_CREATE,
-    PRIVACY_REQUEST_READ,
-    PRIVACY_REQUEST_TRANSFER,
-)
 from fides.api.ops.models.policy import ActionType, DrpAction, Policy, Rule, RuleTarget
 from fides.core.config import CONFIG
 from fides.lib.db.base_class import FidesBase
 from fides.lib.exceptions import KeyOrNameAlreadyExists
 from fides.lib.models.client import ClientDetail
 from fides.lib.models.fides_user import FidesUser
 from fides.lib.models.fides_user_permissions import FidesUserPermissions
+from fides.lib.oauth.roles import OWNER
 from fides.lib.utils.text import to_snake_case
 
 from .crud import create_resource, list_resource
@@ -89,14 +85,7 @@ def create_or_update_parent_user() -> None:
         )
         FidesUserPermissions.create(
             db=db_session,
-            data={
-                "user_id": user.id,
-                "scopes": [
-                    PRIVACY_REQUEST_CREATE,
-                    PRIVACY_REQUEST_READ,
-                    PRIVACY_REQUEST_TRANSFER,
-                ],
-            },
+            data={"user_id": user.id, "roles": [OWNER]},
         )
 
 

src/fides/api/ctl/migrations/versions/643249f65453_case_insensitive_usernames_delete_.py

@@ -9,9 +9,6 @@
 from sqlalchemy.orm.session import Session
 from sqlalchemy.sql import text
 
-from fides.lib.models.fides_user import FidesUser
-from fides.lib.models.fides_user_permissions import FidesUserPermissions
-
 # revision identifiers, used by Alembic.
 revision = "643249f65453"
 down_revision = "5d62bab40b71"

src/fides/api/ctl/migrations/versions/a0f219697fa0_remove_user_scopes.py

@@ -0,0 +1,46 @@
+"""remove user scopes
+
+Revision ID: a0f219697fa0
+Revises: 54102bba36de
+Create Date: 2023-03-15 22:25:09.654149
+
+"""
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy import text
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision = "a0f219697fa0"
+down_revision = "54102bba36de"
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    op.drop_column("fidesuserpermissions", "scopes")
+    """One last time - remove scopes from user clients"""
+    bind = op.get_bind()
+    bind.execute(
+        text(
+            """
+                UPDATE client 
+                SET scopes = '{}'
+                FROM fidesuserpermissions
+                WHERE fidesuserpermissions.user_id = client.user_id;
+            """
+        )
+    )
+
+
+def downgrade():
+    op.add_column(
+        "fidesuserpermissions",
+        sa.Column(
+            "scopes",
+            postgresql.ARRAY(sa.VARCHAR()),
+            server_default=sa.text("'{}'::character varying[]"),
+            autoincrement=False,
+            nullable=True,
+        ),
+    )