Cu 86c0bkuxc add a mechanism to migrate users from the old roles to new rbac roles

src/model/index.js

@@ -20,3 +20,4 @@ export * from './users'
 export * from './visualizer'
 export * from './metrics'
 export * from './passport'
+export * from './role'

src/model/role.js

@@ -137,7 +137,7 @@ const RoleSchema = new Schema({
 export const RoleModelAPI = connectionAPI.model('Role', RoleSchema)
 export const RoleModel = connectionDefault.model('Role', RoleSchema)
 
-const roles = {
+export const roles = {
   admin: {
     name: 'admin',
     permissions: {

src/upgradeDB.js

@@ -9,6 +9,7 @@
 import {UserModel} from './model/users'
 import {VisualizerModel} from './model/visualizer'
 import {PassportModel} from './model/passport'
+import {RoleModel, roles} from './model/role'
 
 function dedupName(name, names, num) {
   let newName
@@ -295,6 +296,46 @@
   }
 })
 
+upgradeFuncs.push({
+  description: 'Create default roles with permissions and update user groups',
+  func() {
+    return new Promise(async (resolve, reject) => {
+      try {
+        // Create default roles with permissions
+        for (const [roleName, roleData] of Object.entries(roles)) {
+          await RoleModel.findOneAndUpdate(
+            { name: roleName },
+            roleData,
+            { upsert: true, new: true }
+          );
+          logger.info(`Role ${roleName} created or updated`);
+        }
+
+        const users = await UserModel.find();
+
+        const userPromises = users.map(async (user) => {
+          let newGroup = 'manager';
+          if ((user.groups && user.groups.includes('admin')) || user.superUser) {
+            newGroup = 'admin';
+          }
+          // Update user's groups
+          user.groups = [newGroup];
+
+          return user.save();
+        });
+
+        await Promise.all(userPromises);
+
+        logger.info('Successfully updated user groups based on new role model');
+        resolve();
+      } catch (err) {
+        logger.error(`Error updating user groups: ${err}`);
+        reject(err);
+      }
+    });
+  }
+});
+
 if (process.env.NODE_ENV === 'test') {
   exports.upgradeFuncs = upgradeFuncs
   exports.dedupName = dedupName

test/unit/upgradeDBTest.js

@@ -13,7 +13,8 @@ import {
   KeystoreModel,
   PassportModel,
   UserModel,
-  VisualizerModel
+  VisualizerModel,
+  RoleModel
 } from '../../src/model'
 
 describe('Upgrade DB Tests', () => {
@@ -546,4 +547,155 @@ describe('Upgrade DB Tests', () => {
       passports.length.should.eql(2)
     })
   })
+
+  describe(`updateFunction4 - Create default roles with permissions and update user groups`, () => {
+    const upgradeFunc = originalUpgradeFuncs[4].func
+
+    beforeEach(async () => {
+      await RoleModel.deleteMany({})
+      await UserModel.deleteMany({})
+    })
+
+    afterEach(async () => {
+      await RoleModel.deleteMany({})
+      await UserModel.deleteMany({})
+    })
+
+    it('should create default roles if they do not exist', async () => {
+      await upgradeFunc()
+
+      const roles = await RoleModel.find()
+      roles.length.should.be.exactly(3)
+
+      const roleNames = roles.map(r => r.name)
+      roleNames.should.containEql('manager')
+      roleNames.should.containEql('admin')
+      roleNames.should.containEql('operator')
+    })
+
+    it('should not create duplicate roles if they already exist', async () => {
+      await new RoleModel({name: 'admin', permissions: {}}).save()
+
+      await upgradeFunc()
+
+      const roles = await RoleModel.find()
+      roles.length.should.be.exactly(3)
+
+      const adminRoles = roles.filter(r => r.name === 'admin')
+      adminRoles.length.should.be.exactly(1)
+    })
+
+    it('should set correct permissions for each role', async () => {
+      await upgradeFunc()
+
+      const managerRole = await RoleModel.findOne({name: 'manager'})
+      const adminRole = await RoleModel.findOne({name: 'admin'})
+      const operatorRole = await RoleModel.findOne({name: 'operator'})
+
+      // Helper function to check permissions
+      const checkPermissions = (role, expectedPermissions) => {
+        console.log(`Checking permissions for role: ${role.name}`)
+        Object.entries(expectedPermissions).forEach(([key, value]) => {
+          should(role.permissions[key]).equal(value)
+        })
+      }
+
+      // Admin role permissions
+      checkPermissions(adminRole, {
+        'channel-view-all': true,
+        'channel-manage-all': true,
+        'client-view-all': true,
+        'client-manage-all': true,
+        'transaction-view-all': true,
+        'transaction-view-body-all': true,
+        'transaction-rerun-all': true,
+        'user-view': true,
+        'user-manage': true,
+        'visualizer-manage': true,
+        'visualizer-view': true
+        // Add other admin permissions as needed
+      })
+
+      // Manager role permissions
+      checkPermissions(managerRole, {
+        'channel-view-all': true,
+        'channel-manage-all': true,
+        'client-view-all': true,
+        'client-manage-all': true,
+        'transaction-view-all': true,
+        'transaction-view-body-all': true,
+        'transaction-rerun-all': true,
+        'user-view': true,
+        'visualizer-manage': true,
+        'visualizer-view': true
+        // Add other manager permissions as needed
+      })
+
+      // Operator role permissions
+      checkPermissions(operatorRole, {
+        'channel-view-all': true,
+        'transaction-view-all': true,
+        'transaction-view-body-all': true,
+        'transaction-rerun-all': true
+        // Add other operator permissions as needed
+      })
+
+      // Check that operator doesn't have certain permissions
+      should(operatorRole.permissions['user-manage']).be.false()
+      should(operatorRole.permissions['client-manage-all']).be.false()
+    })
+
+    it('should update user groups to admin for superUsers', async () => {
+      const superUser = new UserModel({
+        email: '[email protected]',
+        groups: ['admin'],
+        firstname: 'Super',
+        surname: 'User'
+      })
+      await superUser.save()
+
+      await upgradeFunc()
+
+      const updatedUser = await UserModel.findOne({email: '[email protected]'})
+      updatedUser.groups.should.eql(['admin'])
+    })
+
+    it('should handle mixed user types correctly', async () => {
+      const users = [
+        new UserModel({
+          email: '[email protected]',
+          groups: ['user'],
+          firstname: 'Regular',
+          surname: 'User'
+        }),
+        new UserModel({
+          email: '[email protected]',
+          groups: ['user', 'admin'],
+          firstname: 'Admin',
+          surname: 'User'
+        }),
+        new UserModel({
+          email: '[email protected]',
+          groups: ['admin'],
+          firstname: 'Super',
+          surname: 'User'
+        }),
+        new UserModel({
+          email: '[email protected]',
+          groups: ['operator'],
+          firstname: 'Another',
+          surname: 'User'
+        })
+      ]
+      await Promise.all(users.map(user => user.save()))
+
+      await upgradeFunc()
+
+      const updatedUsers = await UserModel.find().sort('email')
+      updatedUsers[0].groups.should.eql(['admin']) // [email protected]
+      updatedUsers[1].groups.should.eql(['manager']) // [email protected]
+      updatedUsers[2].groups.should.eql(['manager']) // [email protected]
+      updatedUsers[3].groups.should.eql(['admin']) // [email protected]
+    })
+  })
 })