-
Notifications
You must be signed in to change notification settings - Fork 3
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Upgrade Editorial permissions library to latest version
This upgrades the Media Atom Maker to use the latest version of the client for the Guardian's Editorial Permissions service - we need the latest version of the client to support the upgrade to Scala 2.13 in #1140 * Before: https://github.com/guardian/editorial-permissions-client/tree/v0.8 - supporting Scala 2.11 & 2.12 * After: https://github.com/guardian/permissions/tree/v2.15/client - supporting Scala 2.12 & 2.13 As you can see, the permissions client has moved repositories, to the main `permissions` repo - this happened in July 2018 with PR guardian/permissions#103. This PR is also important because it removed use of `Future` from the permissions client API - as Michael Barton explained, permission lookups should be mostly instantaneous because they now come from an in-memory cache. The removal of `Future` means that this commit, upgrading permissions in Media Atom Maker, needs to remove several for-comprehensions/map-statements. The diff on these can look quite big, but they look much smaller if whitespace changes are ignored. # Permission to change Privacy Status of a Media Atom * #789 * #791
- Loading branch information
Showing
7 changed files
with
103 additions
and
146 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,64 +1,49 @@ | ||
| package com.gu.media | ||
|
|
||
| import com.amazonaws.auth.AWSCredentialsProvider | ||
| import com.gu.editorial.permissions.client._ | ||
| import com.gu.permissions._ | ||
| import ai.x.play.json.Jsonx | ||
| import com.gu.media.Permissions.setVideosOnAllChannelsPublic | ||
| import play.api.libs.json.Format | ||
| import com.gu.pandomainauth.model.{User => PandaUser} | ||
| import scala.concurrent.Future | ||
| import com.gu.permissions.PermissionDefinition | ||
|
|
||
|
|
||
| case class Permissions( | ||
| deleteAtom: Boolean, | ||
| addSelfHostedAsset: Boolean, | ||
| setVideosOnAllChannelsPublic: Boolean, | ||
| pinboard: Boolean | ||
| deleteAtom: Boolean = false, | ||
| addSelfHostedAsset: Boolean = false, | ||
| setVideosOnAllChannelsPublic: Boolean = false, | ||
| pinboard: Boolean = false | ||
| ) | ||
| object Permissions { | ||
| implicit val format: Format[Permissions] = Jsonx.formatCaseClass[Permissions] | ||
|
|
||
| val app = "atom-maker" | ||
| val deleteAtom = Permission("delete_atom", app, defaultVal = PermissionDenied) | ||
| val addSelfHostedAsset = Permission("add_self_hosted_asset", app, defaultVal = PermissionDenied) | ||
| val setVideosOnAllChannelsPublic = Permission("set_videos_on_all_channels_public", app, defaultVal = PermissionDenied) | ||
| val pinboard = Permission("pinboard", "pinboard", defaultVal = PermissionDenied) | ||
| val deleteAtom = PermissionDefinition("delete_atom", app) | ||
| val addSelfHostedAsset = PermissionDefinition("add_self_hosted_asset", app) | ||
| val setVideosOnAllChannelsPublic = PermissionDefinition("set_videos_on_all_channels_public", app) | ||
| val pinboard = PermissionDefinition("pinboard", "pinboard") | ||
| } | ||
|
|
||
| class MediaAtomMakerPermissionsProvider(stage: String, credsProvider: AWSCredentialsProvider) extends PermissionsProvider { | ||
| class MediaAtomMakerPermissionsProvider(stage: String, region: String, credsProvider: AWSCredentialsProvider) { | ||
| import Permissions._ | ||
|
|
||
| implicit def config = PermissionsConfig( | ||
| app = "media-atom-maker", | ||
| all = Seq(deleteAtom, addSelfHostedAsset, setVideosOnAllChannelsPublic, pinboard), | ||
| s3BucketPrefix = if(stage == "PROD") "PROD" else "CODE", | ||
| awsCredentials = credsProvider | ||
| ) | ||
| private val permissions: PermissionsProvider = PermissionsProvider(PermissionsConfig(stage, region, credsProvider)) | ||
|
|
||
| def getAll(user: PandaUser): Future[Permissions] = for { | ||
| deleteAtom <- hasPermission(deleteAtom, user) | ||
| selfHostedMediaAtom <- hasPermission(addSelfHostedAsset, user) | ||
| publicStatusPermissions <- hasPermission(setVideosOnAllChannelsPublic, user) | ||
| pinboard <- hasPermission(pinboard, user) | ||
| } yield Permissions(deleteAtom, selfHostedMediaAtom, publicStatusPermissions, pinboard) | ||
| def getAll(user: PandaUser): Permissions = Permissions( | ||
| deleteAtom = hasPermission(deleteAtom, user), | ||
| addSelfHostedAsset = hasPermission(addSelfHostedAsset, user), | ||
| setVideosOnAllChannelsPublic = hasPermission(setVideosOnAllChannelsPublic, user), | ||
| pinboard = hasPermission(pinboard, user) | ||
| ) | ||
|
|
||
| def getStatusPermissions(user: PandaUser): Future[Permissions] = for { | ||
| publicStatus <- hasPermission(setVideosOnAllChannelsPublic, user) | ||
| } yield { | ||
| Permissions(deleteAtom = false, addSelfHostedAsset = false, publicStatus, pinboard = false) | ||
| } | ||
| def getStatusPermissions(user: PandaUser): Permissions = | ||
| Permissions(setVideosOnAllChannelsPublic = hasPermission(setVideosOnAllChannelsPublic, user)) | ||
|
|
||
| private def hasPermission(permission: Permission, user: PandaUser): Future[Boolean] = { | ||
| user.email match { | ||
| // TODO be better | ||
| // HACK: HMAC authenticated users are a `PandaUser` without an email | ||
| case "" if user.firstName == "media-atom-scheduler-lambda" => { | ||
| Future.successful(true) | ||
| } | ||
| case _ => { | ||
| get(permission)(PermissionsUser(user.email)).map { | ||
| case PermissionGranted => true | ||
| case _ => false | ||
| } | ||
| } | ||
| } | ||
| def hasPermission(permission: PermissionDefinition, user: PandaUser): Boolean = user.email match { | ||
| // TODO be better | ||
| // HACK: HMAC authenticated users are a `PandaUser` without an email | ||
| case "" if user.firstName == "media-atom-scheduler-lambda" => true | ||
| case _ => permissions.hasPermission(permission, user.email) | ||
| } | ||
| } |