Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

WIP/RFR: Add grant expansion support. #9

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

WIP/RFR: Add grant expansion support. #9

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4941a81
Add grant expansion support.
morgabra Sep 13, 2023
1c0915f
Bump sdk to v0.1.6
jirwin Oct 3, 2023
ee2112e
Add support for expanding roles assigned to groups
jirwin Oct 3, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ module github.com/conductorone/baton-demo
go 1.20

require (
github.com/conductorone/baton-sdk v0.1.5
github.com/conductorone/baton-sdk v0.1.6
github.com/grpc-ecosystem/go-grpc-middleware v1.3.0
go.uber.org/zap v1.24.0
)
Expand Down
4 changes: 2 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,8 +89,8 @@ github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDk
github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
github.com/conductorone/baton-sdk v0.1.5 h1:53fmUiolrAWhRVXBwVAK42uRQiwZU0bVtAziS/HEkbk=
github.com/conductorone/baton-sdk v0.1.5/go.mod h1:lU1sLusR2oqts/k5BvYhoNKQ4Nl9qG8slJD/YEcKt9E=
github.com/conductorone/baton-sdk v0.1.6 h1:xGjVs5qrkEuhbEyi78Xv2d4fe4G8xECWuM5kQgadTcM=
github.com/conductorone/baton-sdk v0.1.6/go.mod h1:lU1sLusR2oqts/k5BvYhoNKQ4Nl9qG8slJD/YEcKt9E=
github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
Expand Down
14 changes: 12 additions & 2 deletions pkg/client/data.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,8 +46,9 @@ func generateDB() *database {
"2IC0Wo34fcTerFEgWmyffXmfrW8", // Carol
},
Members: []string{
"2IC0Wn5oRQqVVn3COFl1O1zSzV6", // Alice
"2IC0WoNfqUPT7mgO4FOaViIxBrR", // Bob
"2IC0Wn5oRQqVVn3COFl1O1zSzV6", // Alice
"2IC0WoNfqUPT7mgO4FOaViIxBrR", // Bob
"group:2VJleiE6zMPoTHbKDjLC1zJkUir", // Expanded Engineers Group
},
},
{
Expand All @@ -60,6 +61,15 @@ func generateDB() *database {
"2IC0Wn7DaxV1xqDpdg7jJRiPtCp", // Dan
},
},
{
Id: "2VJleiE6zMPoTHbKDjLC1zJkUir",
Name: "Expanded Engineers",
Admins: []string{},
Members: []string{
"2IC0WoaHVvl2GIQppXQH0flK1yJ", // Frank
"2IC0Wn7DaxV1xqDpdg7jJRiPtCp", // Dan
},
},
}

db.Roles = []*Role{
Expand Down
45 changes: 38 additions & 7 deletions pkg/connector/groups.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,14 +3,16 @@
import (
"context"
"fmt"
"strings"

"github.com/conductorone/baton-demo/pkg/client"
v2 "github.com/conductorone/baton-sdk/pb/c1/connector/v2"
"github.com/conductorone/baton-sdk/pkg/annotations"
"github.com/conductorone/baton-sdk/pkg/pagination"
sdkEntitlement "github.com/conductorone/baton-sdk/pkg/types/entitlement"
sdkGrant "github.com/conductorone/baton-sdk/pkg/types/grant"
sdkResource "github.com/conductorone/baton-sdk/pkg/types/resource"

"github.com/conductorone/baton-demo/pkg/client"
)

var (
Expand Down Expand Up @@ -56,15 +58,21 @@
return ret, "", nil, nil
}

// Entitlements returns a membership and admin entitlement.
func (o *groupBuilder) Entitlements(ctx context.Context, resource *v2.Resource, _ *pagination.Token) ([]*v2.Entitlement, string, annotations.Annotations, error) {
func (o *groupBuilder) entitlements(ctx context.Context, resource *v2.Resource) (*v2.Entitlement, *v2.Entitlement) {
// This entitlement represents being a member of the group, and it can be granted to Users.
member := sdkEntitlement.NewAssignmentEntitlement(resource, groupMemberEntitlement, sdkEntitlement.WithGrantableTo(userResourceType))
member.Description = fmt.Sprintf("Is a member of the %s group", resource.DisplayName)

admin := sdkEntitlement.NewPermissionEntitlement(resource, groupAdminEntitlement, sdkEntitlement.WithGrantableTo(userResourceType))
admin.Description = fmt.Sprintf("Is an admin of the %s group", resource.DisplayName)

return member, admin
}

// Entitlements returns a membership and admin entitlement.
func (o *groupBuilder) Entitlements(ctx context.Context, resource *v2.Resource, _ *pagination.Token) ([]*v2.Entitlement, string, annotations.Annotations, error) {
// This entitlement represents being a member of the group, and it can be granted to Users.
member, admin := o.entitlements(ctx, resource)
return []*v2.Entitlement{member, admin}, "", nil, nil
}

Expand All @@ -89,12 +97,35 @@
}

for _, memberID := range grp.Members {
pID, err := sdkResource.NewResourceID(userResourceType, memberID)
if err != nil {
return nil, "", nil, err
var pID *v2.ResourceId
if strings.HasPrefix(memberID, "group:") {
memberID = strings.TrimPrefix(memberID, "group:")
pID, err = sdkResource.NewResourceID(groupResourceType, memberID)
if err != nil {
return nil, "", nil, err
}

g := sdkGrant.NewGrant(resource, groupMemberEntitlement, pID)

// FIXME(morgabra): Make a helper/refactor this:
member, admin := o.entitlements(ctx, &v2.Resource{Id: &v2.ResourceId{
ResourceType: groupResourceType.Id,
Resource: memberID,
}})
annos := annotations.Annotations(g.Annotations)
annos.Append(&v2.GrantExpandable{
EntitlementIds: []string{member.Id, admin.Id},
})
g.Annotations = annos
ret = append(ret, g)
} else {
pID, err = sdkResource.NewResourceID(userResourceType, memberID)
if err != nil {
return nil, "", nil, err
}
ret = append(ret, sdkGrant.NewGrant(resource, groupMemberEntitlement, pID))
}

Check failure on line 128 in pkg/connector/groups.go

View workflow job for this annotation

GitHub Actions / go-lint 

unnecessary trailing newline (whitespace)
ret = append(ret, sdkGrant.NewGrant(resource, groupMemberEntitlement, pID))
}

return ret, "", nil, nil
Expand Down
8 changes: 7 additions & 1 deletion pkg/connector/projects.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,14 +3,16 @@ package connector
import (
"context"
"fmt"
"strings"

"github.com/conductorone/baton-demo/pkg/client"
v2 "github.com/conductorone/baton-sdk/pb/c1/connector/v2"
"github.com/conductorone/baton-sdk/pkg/annotations"
"github.com/conductorone/baton-sdk/pkg/pagination"
sdkEntitlement "github.com/conductorone/baton-sdk/pkg/types/entitlement"
sdkGrant "github.com/conductorone/baton-sdk/pkg/types/grant"
sdkResource "github.com/conductorone/baton-sdk/pkg/types/resource"

"github.com/conductorone/baton-demo/pkg/client"
)

var (
Expand Down Expand Up @@ -94,6 +96,10 @@ func (o *projectBuilder) Grants(ctx context.Context, resource *v2.Resource, pTok
}

for _, userID := range append(grp.Admins, grp.Members...) {
// FIXME(morgabra): What should we do here?
if strings.HasPrefix(userID, "group:") {
continue
}
pID, err := sdkResource.NewResourceID(userResourceType, userID)
if err != nil {
return nil, "", nil, err
Expand Down
25 changes: 9 additions & 16 deletions pkg/connector/roles.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,13 +4,14 @@ import (
"context"
"fmt"

"github.com/conductorone/baton-demo/pkg/client"
v2 "github.com/conductorone/baton-sdk/pb/c1/connector/v2"
"github.com/conductorone/baton-sdk/pkg/annotations"
"github.com/conductorone/baton-sdk/pkg/pagination"
sdkEntitlement "github.com/conductorone/baton-sdk/pkg/types/entitlement"
sdkGrant "github.com/conductorone/baton-sdk/pkg/types/grant"
sdkResource "github.com/conductorone/baton-sdk/pkg/types/resource"

"github.com/conductorone/baton-demo/pkg/client"
)

var (
Expand Down Expand Up @@ -81,23 +82,15 @@ func (o *roleBuilder) Grants(ctx context.Context, resource *v2.Resource, pToken
return nil, "", nil, err
}

ret = append(ret, sdkGrant.NewGrant(resource, roleAssignmentEntitlement, pID))

// Look up group and iterate its members
grp, err := o.client.GetGroup(ctx, grpID)
if err != nil {
return nil, "", nil, err
expandAnno := &v2.GrantExpandable{
EntitlementIds: []string{
fmt.Sprintf("group:%s:member", grpID),
fmt.Sprintf("group:%s:admin", grpID),
},
Shallow: true,
}

// Grant all admins and members the assignment entitlement
for _, userID := range append(grp.Admins, grp.Members...) {
pID, err := sdkResource.NewResourceID(userResourceType, userID)
if err != nil {
return nil, "", nil, err
}

ret = append(ret, sdkGrant.NewGrant(resource, roleAssignmentEntitlement, pID))
}
ret = append(ret, sdkGrant.NewGrant(resource, roleAssignmentEntitlement, pID, sdkGrant.WithAnnotation(expandAnno)))
}

return ret, "", nil, nil
Expand Down
102 changes: 93 additions & 9 deletions vendor/github.com/conductorone/baton-sdk/pb/c1/connector/v2/annotation_grant.pb.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
Loading