Cu 86c0bkuxc add a mechanism to migrate users from the old roles to new rbac roles

src/model/index.js

@@ -20,3 +20,4 @@ export * from './users'
 export * from './visualizer'
 export * from './metrics'
 export * from './passport'
+export * from './role'

src/model/role.js

@@ -137,7 +137,7 @@ const RoleSchema = new Schema({
 export const RoleModelAPI = connectionAPI.model('Role', RoleSchema)
 export const RoleModel = connectionDefault.model('Role', RoleSchema)
 
-const roles = {
+export const roles = {
   admin: {
     name: 'admin',
     permissions: {

src/upgradeDB.js

@@ -9,6 +9,8 @@
 import {UserModel} from './model/users'
 import {VisualizerModel} from './model/visualizer'
 import {PassportModel} from './model/passport'
+import {RoleModel, roles} from './model/role'
+import {ChannelModel} from './model/channels'
 
 function dedupName(name, names, num) {
   let newName
@@ -295,6 +297,59 @@
   }
 })
 
+upgradeFuncs.push({
+  description: 'Create default roles with permissions and update user groups',
+  func: async () => {
+    try {
+      const channels = await ChannelModel.find()
+      const existingRoles = JSON.parse(JSON.stringify(roles)) // Deep clone the roles object
+
+      const updateRolePermissions = (role, permissionType, channelName) => {
+        if (!existingRoles[role]) {
+          existingRoles[role] = { permissions: {} }
+        }
+        if (!existingRoles[role].permissions[permissionType]) {
+          existingRoles[role].permissions[permissionType] = []
+        }
+        existingRoles[role].permissions[permissionType].push(channelName)
+        existingRoles[role].permissions['channel-view-specified'] = existingRoles[role].permissions['channel-view-specified'] || []
+        existingRoles[role].permissions['channel-view-specified'].push(channelName)
+        existingRoles[role].permissions['client-view-all'] = true
+      }
+
+      channels.forEach(channel => {
+        if (Array.isArray(channel.allow)) {
+          const aclTypes = [
+            { acl: channel.txViewAcl, permissionType: 'transaction-view-specified' },
+            { acl: channel.txRerunAcl, permissionType: 'transaction-rerun-specified' },
+            { acl: channel.txViewFullAcl, permissionType: 'transaction-view-body-specified' }
+          ]
+
+          aclTypes.forEach(({ acl, permissionType }) => {
+            if (acl && acl.length > 0) {
+              acl.forEach(role => updateRolePermissions(role, permissionType, channel.name))
+            }
+          })
+        }
+      })
+
+      // Create or update roles
+      await Promise.all(Object.entries(existingRoles).map(([roleName, roleData]) =>
+        RoleModel.findOneAndUpdate(
+          { name: roleName },
+          { name: roleName, permissions: roleData.permissions },
+          { upsert: true, new: true }
+        )
+      ))
+
+      logger.info('Successfully updated roles')
+    } catch (err) {
+      logger.error(`Error updating roles: ${err}`)
+      throw err
+    }
+  }
+})
+
 if (process.env.NODE_ENV === 'test') {
   exports.upgradeFuncs = upgradeFuncs
   exports.dedupName = dedupName
@@ -306,7 +361,6 @@
       (await DbVersionModel.findOne()) ||
       new DbVersionModel({version: 0, lastUpdated: new Date()})
     const upgradeFuncsToRun = upgradeFuncs.slice(dbVer.version)
-
     for (const upgradeFunc of upgradeFuncsToRun) {
       await upgradeFunc.func()
       dbVer.version++

test/unit/upgradeDBTest.js

@@ -13,9 +13,11 @@ import {
   KeystoreModel,
   PassportModel,
   UserModel,
-  VisualizerModel
+  VisualizerModel,
+  RoleModel,
+  ChannelModel,
+  roles
 } from '../../src/model'
-
 describe('Upgrade DB Tests', () => {
   const originalUpgradeFuncs = [...upgradeDB.upgradeFuncs]
   upgradeDB.upgradeFuncs.length = 0
@@ -546,4 +548,94 @@ describe('Upgrade DB Tests', () => {
       passports.length.should.eql(2)
     })
   })
+
+  describe(`updateFunction4 - Create default roles with permissions`, () => {
+    const upgradeFunc = originalUpgradeFuncs[4].func
+
+    beforeEach(async () => {
+      await RoleModel.deleteMany({})
+      await ChannelModel.deleteMany({})
+    })
+
+    afterEach(async () => {
+      await RoleModel.deleteMany({})
+      await ChannelModel.deleteMany({})
+    })
+
+    it('should create default roles if they do not exist', async () => {
+      await upgradeFunc()
+
+      const existingRoles = await RoleModel.find()
+      existingRoles.length.should.be.exactly(Object.keys(roles).length)
+
+      const roleNames = existingRoles.map(r => r.name)
+      Object.keys(roles).forEach(roleName => {
+        roleNames.should.containEql(roleName)
+      })
+    })
+
+    it('should not create duplicate roles if they already exist', async () => {
+      await new RoleModel({name: 'admin', permissions: {}}).save()
+
+      await upgradeFunc()
+
+      const existingRoles = await RoleModel.find()
+      existingRoles.length.should.be.exactly(Object.keys(roles).length)
+
+      const adminRoles = existingRoles.filter(r => r.name === 'admin')
+      adminRoles.length.should.be.exactly(1)
+    })
+
+    it('should set correct permissions for each role', async () => {
+      // Create test channels
+      const channel1 = await new ChannelModel({
+        name: 'Channel 1',
+        urlPattern: '/channel1',
+        allow: ['admin', 'manager'],
+        txViewAcl: ['admin'],
+        txRerunAcl: ['admin'],
+        txViewFullAcl: ['admin']
+      }).save()
+
+      const channel2 = await new ChannelModel({
+        name: 'Channel 2',
+        urlPattern: '/channel2',
+        allow: ['admin', 'manager', 'operator'],
+        txViewAcl: ['admin', 'manager', 'operator'],
+        txRerunAcl: ['admin'],
+        txViewFullAcl: ['admin']
+      }).save()
+
+      await upgradeFunc()
+
+      const createdRoles = await RoleModel.find()
+
+      for (const role of createdRoles) {
+        should.exist(role)
+
+        // Check default permissions
+        if (roles[role.name]) {
+          Object.entries(roles[role.name].permissions).forEach(([key, value]) => {
+            should(role.permissions[key]).eql(value)
+          })
+        }
+
+        // Check channel-specific permissions
+        if (role.name === 'admin') {
+          role.permissions['transaction-view-specified'].should.containEql('Channel 1')
+          role.permissions['transaction-view-specified'].should.containEql('Channel 2')
+          role.permissions['transaction-rerun-specified'].should.containEql('Channel 1')
+          role.permissions['transaction-rerun-specified'].should.containEql('Channel 2')
+          role.permissions['transaction-view-body-specified'].should.containEql('Channel 1')
+          role.permissions['transaction-view-body-specified'].should.containEql('Channel 2')
+        } else if (role.name === 'manager') {
+          role.permissions['transaction-view-specified'].should.not.containEql('Channel 1')
+          role.permissions['transaction-view-specified'].should.containEql('Channel 2')
+        } else if (role.name === 'operator') {
+          role.permissions['transaction-view-specified'].should.not.containEql('Channel 1')
+          role.permissions['transaction-view-specified'].should.containEql('Channel 2')
+        }
+      }
+    })
+  })
 })