diff --git a/pkg/envoy/store/compose_record_marshal.go b/pkg/envoy/store/compose_record_marshal.go index c5b1ad6a2..633c06753 100644 --- a/pkg/envoy/store/compose_record_marshal.go +++ b/pkg/envoy/store/compose_record_marshal.go @@ -221,9 +221,6 @@ func (n *composeRecord) Encode(ctx context.Context, pl *payload) (err error) { rm := n.recMap im := n.res.IDMap - createAcChecked := false - updateAcChecked := false - getKey := func(i int, k string) string { if k == "" { return strconv.FormatInt(int64(i), 10) @@ -424,7 +421,7 @@ func (n *composeRecord) Encode(ctx context.Context, pl *payload) (err error) { rve *composeTypes.RecordValueErrorSet canAccessField = func(f *composeTypes.ModuleField) bool { - return pl.composeAccessControl.CanUpdateRecordValue(ctx, f) + return true } ) @@ -436,7 +433,7 @@ func (n *composeRecord) Encode(ctx context.Context, pl *payload) (err error) { return mod.Fields.HasName(v.Name), nil }) - rve = service.RecordValueUpdateOpCheck(ctx, pl.composeAccessControl, mod, rec.Values) + rve = service.RecordValueUpdateOpCheck(ctx, nil, mod, rec.Values) if !rve.IsValid() { return rve } @@ -446,22 +443,6 @@ func (n *composeRecord) Encode(ctx context.Context, pl *payload) (err error) { return rve } - // AC - // - // AC needs to happen down here, because we are either creating or updating - // records and we don't know that for sure in the Prepare method. - if !exists && !createAcChecked { - createAcChecked = true - if !pl.composeAccessControl.CanCreateRecordOnModule(ctx, mod) { - return fmt.Errorf("not allowed to create records for module %d", mod.ID) - } - } else if exists && !updateAcChecked { - updateAcChecked = true - if !pl.composeAccessControl.CanUpdateRecord(ctx, rec) { - return fmt.Errorf("not allowed to update record") - } - } - // Create a new record if !exists { err = store.CreateComposeRecord(ctx, pl.s, mod, rec) diff --git a/pkg/envoy/store/encoder.go b/pkg/envoy/store/encoder.go index fe0835c4a..d54d8f581 100644 --- a/pkg/envoy/store/encoder.go +++ b/pkg/envoy/store/encoder.go @@ -5,7 +5,6 @@ import ( "errors" "fmt" - "github.com/cortezaproject/corteza-server/compose/service" "github.com/cortezaproject/corteza-server/compose/types" "github.com/cortezaproject/corteza-server/pkg/auth" "github.com/cortezaproject/corteza-server/pkg/envoy" @@ -67,9 +66,7 @@ type ( s store.Storer state *envoy.ResourceState - composeAccessControl composeAccessController - systemAC accessControlRBACServicer - invokerID uint64 + invokerID uint64 } // resourceState allows each conforming struct to be initialized and encoded @@ -189,10 +186,9 @@ func (se *storeEncoder) Encode(ctx context.Context, p envoy.Provider) error { func (se *storeEncoder) makePayload(ctx context.Context, s store.Storer, ers *envoy.ResourceState) *payload { return &payload{ - s: s, - state: ers, - composeAccessControl: service.AccessControl(), - invokerID: auth.GetIdentityFromContext(ctx).Identity(), + s: s, + state: ers, + invokerID: auth.GetIdentityFromContext(ctx).Identity(), } } diff --git a/tests/compose/record_test.go b/tests/compose/record_test.go index f83632567..aa9c7bf14 100644 --- a/tests/compose/record_test.go +++ b/tests/compose/record_test.go @@ -872,75 +872,77 @@ func TestRecordImportRun_sessionNotFound(t *testing.T) { End() } -func TestRecordImportRunForbidden(t *testing.T) { - h := newHelper(t) - h.clearRecords() - helpers.DenyMe(h, types.ModuleRbacResource(0, 0), "record.create") +// @todo revert whe we add import RBAC operations +// func TestRecordImportRunForbidden(t *testing.T) { +// h := newHelper(t) +// h.clearRecords() +// helpers.DenyMe(h, types.ModuleRbacResource(0, 0), "record.create") - module := h.repoMakeRecordModuleWithFields("record import run module") - tests := []struct { - Name string - Content string - }{ - { - Name: "f1.csv", - Content: "fname,femail\nv1,v2\n", - }, - } +// module := h.repoMakeRecordModuleWithFields("record import run module") +// tests := []struct { +// Name string +// Content string +// }{ +// { +// Name: "f1.csv", +// Content: "fname,femail\nv1,v2\n", +// }, +// } - for _, test := range tests { - t.Run(test.Name, func(t *testing.T) { - url := fmt.Sprintf("/namespace/%d/module/%d/record/import", module.NamespaceID, module.ID) - rsp := &rImportSession{} - api := h.apiInit() +// for _, test := range tests { +// t.Run(test.Name, func(t *testing.T) { +// url := fmt.Sprintf("/namespace/%d/module/%d/record/import", module.NamespaceID, module.ID) +// rsp := &rImportSession{} +// api := h.apiInit() - r := h.apiInitRecordImport(api, url, test.Name, []byte(test.Content)).End() - r.JSON(rsp) +// r := h.apiInitRecordImport(api, url, test.Name, []byte(test.Content)).End() +// r.JSON(rsp) - h.apiRunRecordImport(api, fmt.Sprintf("%s/%s", url, rsp.Response.SessionID), `{"fields":{"fname":"name","femail":"email"},"onError":"fail"}`). - Assert(helpers.AssertErrorP("not allowed to create records for module")). - End() - }) - } -} +// h.apiRunRecordImport(api, fmt.Sprintf("%s/%s", url, rsp.Response.SessionID), `{"fields":{"fname":"name","femail":"email"},"onError":"fail"}`). +// Assert(helpers.AssertErrorP("not allowed to create records for module")). +// End() +// }) +// } +// } -func TestRecordImportRunForbidden_field(t *testing.T) { - h := newHelper(t) - h.clearRecords() - helpers.AllowMe(h, types.ModuleRbacResource(0, 0), "record.create") - helpers.AllowMe(h, types.ModuleFieldRbacResource(0, 0, 0), "record.value.update") +// @todo revert whe we add import RBAC operations +// func TestRecordImportRunForbidden_field(t *testing.T) { +// h := newHelper(t) +// h.clearRecords() +// helpers.AllowMe(h, types.ModuleRbacResource(0, 0), "record.create") +// helpers.AllowMe(h, types.ModuleFieldRbacResource(0, 0, 0), "record.value.update") - module := h.repoMakeRecordModuleWithFields("record import run module") +// module := h.repoMakeRecordModuleWithFields("record import run module") - f := module.Fields.FindByName("name") - helpers.DenyMe(h, f.RbacResource(), "record.value.update") +// f := module.Fields.FindByName("name") +// helpers.DenyMe(h, f.RbacResource(), "record.value.update") - tests := []struct { - Name string - Content string - }{ - { - Name: "f1.csv", - Content: "fname,femail\nv1,v2\n", - }, - } +// tests := []struct { +// Name string +// Content string +// }{ +// { +// Name: "f1.csv", +// Content: "fname,femail\nv1,v2\n", +// }, +// } - for _, test := range tests { - t.Run(test.Name, func(t *testing.T) { - h.t = t - url := fmt.Sprintf("/namespace/%d/module/%d/record/import", module.NamespaceID, module.ID) - rsp := &rImportSession{} - api := h.apiInit() +// for _, test := range tests { +// t.Run(test.Name, func(t *testing.T) { +// h.t = t +// url := fmt.Sprintf("/namespace/%d/module/%d/record/import", module.NamespaceID, module.ID) +// rsp := &rImportSession{} +// api := h.apiInit() - r := h.apiInitRecordImport(api, url, test.Name, []byte(test.Content)).End() - r.JSON(rsp) +// r := h.apiInitRecordImport(api, url, test.Name, []byte(test.Content)).End() +// r.JSON(rsp) - h.apiRunRecordImport(api, fmt.Sprintf("%s/%s", url, rsp.Response.SessionID), `{"fields":{"fname":"name","femail":"email"},"onError":"fail"}`). - Assert(helpers.AssertErrorP("1 issue(s) found")). - End() - }) - } -} +// h.apiRunRecordImport(api, fmt.Sprintf("%s/%s", url, rsp.Response.SessionID), `{"fields":{"fname":"name","femail":"email"},"onError":"fail"}`). +// Assert(helpers.AssertErrorP("1 issue(s) found")). +// End() +// }) +// } +// } func TestRecordImportRunFieldError_missing(t *testing.T) { h := newHelper(t)