feat(GDB-11339): Manage the graphql roles #1809
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
teodossidossev
force-pushed
the
GDB-11339-manage-graphql-roles
branch
from
1be22e0 to
65e6cac
Compare
| @@ -88,8 +88,7 @@ angular.module('graphdb.framework.core.services.jwtauth', [ | |||
| * @param {boolean} justLoggedIn Indicates that the user just logged in. | |||
| */ | |||
| this.getAuthenticatedUserFromBackend = function(noFreeAccessFallback, justLoggedIn) { | |||
| SecurityRestService.getAuthenticatedUser(). | |||
| success(function(data, status, headers) { | |||
| SecurityService.getAuthenticatedUser().then(function(data) { | |||
There was a problem hiding this comment.
Beware of these changes. There were few places where the success/error handlers were left intentionally due to sertain reasons that I can't recall at the moment but if possible, I'd prefer if we don't switch them here, now
teodossidossev
force-pushed
the
GDB-11339-manage-graphql-roles
branch
from
0b068ce to
e33ee91
Compare
teodossidossev
force-pushed
the
GDB-11339-manage-graphql-roles
branch
2 times, most recently
from
ad53e4f to
72d129d
Compare
teodossidossev
force-pushed
the
GDB-11339-manage-graphql-roles
branch
from
e23c8fc to
87c30d1
Compare
…e usage - Enhanced the SecurityService that delegates calls to SecurityRestService. - Updated controllers (security/controllers.js) to use SecurityService instead of directly calling SecurityRestService. - Modified jwt-auth.service.js to also rely on the new SecurityService. - Ensured all methods for managing users, roles, and security configs are now available from SecurityService.
… with BE User model changes The backend model has changed—most notably in the format of grantedAuthorities (e.g. "READ_REPO_XXX:GRAPHQL")—but we want to preserve the existing UI logic without requiring major changes in the UI layer. To achieve this, we introduced a mapping layer that transforms the new backend model into the UI model. This mapping: - Splits new grantedAuthorities values into their parts (e.g., "READ_REPO_XXX") and adds corresponding UI-specific authorities (e.g., "GRAPHQL_XXX") - Provides bidirectional conversion via toUserModelMapper (BE → UI) and fromUserModelMapper (UI → BE) - Utilizes a generic mapping utility (mapObject) to apply transformation rules across object properties Additionally, we updated our controllers and services to use modern promise handling (.then/.catch) instead of the deprecated .success/.error methods. These changes ensure that the UI continues to work as before while adding new features and aligning with the changes in the BE model.
…ombined GraphQL authority exists and add GraphQL support
- Updated the UI-to-BE mapping logic in user-mapper.js (mapAuthoritiesToBackend) to:
- Remove legacy authorities when a combined GraphQL authority is present:
- If both READ_REPO_XXX and GRAPHQL_XXX exist, output only "READ_REPO_XXX:GRAPHQL" (dropping the standalone READ_REPO_XXX).
- If both WRITE_REPO_XXX and GRAPHQL_XXX exist, output only "WRITE_REPO_XXX:GRAPHQL" (dropping both standalone READ_REPO_XXX and WRITE_REPO_XXX).
- Correctly handle wildcard (*) cases.
- Introduced a helper (getRepoFromAuthority) to extract repository IDs and prefixes from authority strings.
- Updated constants and adjusted usage in controllers, templates, and authorities-util to support the new GraphQL-specific authorities.
- Modified locale files to include tooltips for GraphQL rights.
- Fixed jwt-auth.service to properly map principal details from the updated response
- Repositories Service:
* Updated `getReadableRepositories()` to accept an optional `graphql` parameter
and delegate to `$jwtAuth.canReadRepo(repo, graphql)`.
- JWT Auth Service:
* Changed `canReadRepo()` and `canWriteRepo()` to accept `graphql = false`
and adjust logic within `checkRights()` to skip or include entries ending with `:GRAPHQL`.
* Ensured that Admin users or wildcard roles properly override new GraphQL checks.
- Authorities Util:
* Consolidated logic for `READ`, `WRITE`, and `GRAPHQL` prefixes in a single block.
* Updated the `getRepoFromAuthority()` function to handle `GRAPHQL_PREFIX`.
* Adjusted parse logic to set `.read`, `.write`, or `.graphql` on a per-repo basis.
- User Mappers & Map-Object:
* Enhanced `mapObject()` to allow optional `newKey` renaming and `removeOldKey`.
* Renamed the user’s `grantedAuthorities` field to `grantedAuthoritiesUiModel` when mapping back from BE data.
- Cypress:
* Added methods for toggling read, write, and GraphQL checkboxes on a per-repo or wildcard basis.
* Enhanced test coverage in `user-and-access.spec.js` to handle combinations of read/write/GraphQL.
* Introduced `editUserAuths()` for editing existing permissions, and improved `assertUserAuths()` negative checks.
teodossidossev
force-pushed
the
GDB-11339-manage-graphql-roles
branch
from
87c30d1 to
9c7e799
Compare
|
| * The full response is mapped to convert its data property to a UI model. | ||
| * | ||
| * @param {string} username The username of the user. | ||
| * @return {Promise<Object>} A promise that resolves to the full response with a mapped user model. |
There was a problem hiding this comment.
Actually, the return is a Promise. Could you please check all methods and update the return type and parameters, where it's known? Since you're already in the code, this would be really helpful.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
WHAT:
WHY:
HOW:
Testing
Screenshots
Checklist