* feat(rbac): drop dataset_permissions + access_requests + users.role + is_public; v19 migration
BREAKING. Sjednocení datové RBAC vrstvy do per-group resource_grants modelu.
Před PR byla legacy data RBAC vrstva (dataset_permissions + is_public bypass)
de-facto neaktivní — is_public neměl API/UI/CLI surface, default true znamenal
že can_access_table vždycky bypassl. Dnes každý non-admin přístup vyžaduje
explicitní resource_grants(group, "table", id) řádek.
Schema v18 → v19 (src/db.py:_v18_to_v19_finalize):
- DROP TABLE dataset_permissions, access_requests
- DROP COLUMN users.role (NULL artifact since v13)
- DROP COLUMN table_registry.is_public
- Drops přes table-rebuild idiom (rename → create new → INSERT … SELECT
→ drop old) kvůli DuckDB ALTER DROP COLUMN limitacím na tabulkách
s historic FK constraints. INSERT picks intersection sloupců, takže
test fixtures s minimal pre-v19 schemou migrate cleanly.
Runtime:
- src/rbac.py:can_access_table → deleguje na app.auth.access.can_access
- DatasetPermissionRepository, AccessRequestRepository smazány
- AGNES_ENABLE_TABLE_GRANTS env-gate v app/resource_types.py odstraněn
(TABLE je unconditionally enabled)
API drop:
- app/api/permissions.py, app/api/access_requests.py celé soubory
- /admin/permissions web route + admin_permissions.html
- "Request Access" modal v catalog.html + locked-row UI
- ~10 if user.get("role") != "admin" checků nahrazeno (admin shortcut
je uvnitř can_access_table)
- /api/settings: drop permissions field z GET; PUT /api/settings/dataset
gate přepnut na can_access(user_id, "table", dataset, conn)
Auth:
- app/auth/jwt.py:create_access_token: drop role parametr (claim zmizí
z nově vydávaných JWT; staré tokeny zůstávají valid, claim ignored)
- app/api/users.py: drop role z CreateUserRequest / UpdateUserRequest
(admin promotion = explicit add to Admin group via memberships API)
- src/repositories/users.py: drop role z create() / update()
CLI:
- da admin set-role smazán → hard-fail s replacement command
- da admin add-user --role flag pryč
- da auth import-token --role flag pryč
- da auth whoami: drop "Role:" výpis
- cli/config.py:save_token: role parametr now optional, no longer written
(back-compat se starými token.json soubory zachována — pole se ignoruje)
Tests:
- DELETE: test_permissions.py, test_permissions_api.py, test_access_requests_api.py
- REWRITE: test_access_control.py (resource_grants flow), test_rbac.py
(can_access_table over resource_grants), test_journey_rbac.py
(drop access-request flow), test_resource_types.py (drop env-gate
tests, drop is_public from helpers), test_v2_*.py (drop role-based
user dicts in favor of id-based + Admin group membership),
test_settings_api.py (no permissions field, can_access gate)
- TRIVIAL: ~30 souborů — drop role="admin" arg z UserRepository.create
a 3rd positional role z create_access_token
- NEW: test_v18_to_v19 migration test (test_db.py),
test_can_access_table_no_implicit_public (test_rbac.py),
test_admin_set_role_returns_hardfail (test_cli_admin.py)
- OpenAPI snapshot regenerated
Docs:
- CHANGELOG: BREAKING entry pod [Unreleased]
- CLAUDE.md: schema v18 → v19
- docs/architecture.md: schema table + RBAC sekce přepsána
- docs/auth-google-oauth.md: admin promotion přes da admin break-glass
- cli/skills/security.md: kompletně přepsáno na group-based model
- docs/TODO-rbac-data-enforcement.md: smazáno (TODO splněn)
Test results: 2363 passed, 19 failed. Zbývající failures jsou pre-existing
Windows-specific issues (fcntl, charset) nesouvisející s tímto PR —
ověřeno git stash pop.
Plan: ~/.claude/plans/floofy-coalescing-parnas.md
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(release): cut 0.27.0
---------
Co-authored-by: Minas Arustamyan <arustamyan.minas@gmail.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: ZdenekSrotyr <zdenek.srotyr@keboola.com>
114 lines
4.6 KiB
Python
114 lines
4.6 KiB
Python
"""Tests for /api/sync/manifest — query_mode and source_type per table.
|
|
|
|
These tests target the `_build_manifest_for_user` helper directly so they can
|
|
exercise the query_mode/source_type joining logic without going through the
|
|
HTTP layer. The CLI (Task 7) relies on these fields to skip remote-mode
|
|
tables during download.
|
|
"""
|
|
|
|
import importlib
|
|
|
|
|
|
def _reload_db_module(monkeypatch, tmp_path):
|
|
"""Point DATA_DIR at tmp_path and reload db module so paths take effect."""
|
|
monkeypatch.setenv("DATA_DIR", str(tmp_path))
|
|
(tmp_path / "state").mkdir(exist_ok=True)
|
|
import src.db as db_module
|
|
importlib.reload(db_module)
|
|
return db_module
|
|
|
|
|
|
def _ensure_admin1(conn):
|
|
"""Seed an admin user with id='admin1' + Admin group membership so
|
|
{"id": "admin1", ...} dicts pass the can_access admin shortcut."""
|
|
from src.db import SYSTEM_ADMIN_GROUP
|
|
from src.repositories.users import UserRepository
|
|
from src.repositories.user_group_members import UserGroupMembersRepository
|
|
if UserRepository(conn).get_by_id("admin1") is None:
|
|
UserRepository(conn).create(id="admin1", email="admin1@test.com", name="Admin")
|
|
admin_gid = conn.execute(
|
|
"SELECT id FROM user_groups WHERE name = ?", [SYSTEM_ADMIN_GROUP]
|
|
).fetchone()
|
|
if admin_gid:
|
|
UserGroupMembersRepository(conn).add_member(
|
|
"admin1", admin_gid[0], source="system_seed",
|
|
)
|
|
|
|
|
|
def test_manifest_includes_query_mode_for_local_table(tmp_path, monkeypatch):
|
|
"""Local-mode table must surface query_mode='local' in manifest."""
|
|
db_module = _reload_db_module(monkeypatch, tmp_path)
|
|
|
|
from src.repositories.sync_state import SyncStateRepository
|
|
from src.repositories.table_registry import TableRegistryRepository
|
|
from app.api.sync import _build_manifest_for_user
|
|
|
|
conn = db_module.get_system_db()
|
|
try:
|
|
_ensure_admin1(conn)
|
|
TableRegistryRepository(conn).register(
|
|
id="orders", name="orders", source_type="keboola",
|
|
bucket="sales", source_table="orders", query_mode="local",
|
|
)
|
|
SyncStateRepository(conn).update_sync(
|
|
table_id="orders", rows=10, file_size_bytes=1024, hash="abc",
|
|
)
|
|
admin = {"id": "admin1", "email": "a@x.com"}
|
|
manifest = _build_manifest_for_user(conn, admin)
|
|
assert manifest["tables"]["orders"]["query_mode"] == "local"
|
|
assert manifest["tables"]["orders"]["source_type"] == "keboola"
|
|
assert manifest["tables"]["orders"]["hash"] == "abc"
|
|
assert manifest["tables"]["orders"]["rows"] == 10
|
|
assert manifest["tables"]["orders"]["size_bytes"] == 1024
|
|
finally:
|
|
conn.close()
|
|
|
|
|
|
def test_manifest_includes_query_mode_for_remote_table(tmp_path, monkeypatch):
|
|
"""Remote-mode table (BQ) must surface query_mode='remote' in manifest."""
|
|
db_module = _reload_db_module(monkeypatch, tmp_path)
|
|
|
|
from src.repositories.sync_state import SyncStateRepository
|
|
from src.repositories.table_registry import TableRegistryRepository
|
|
from app.api.sync import _build_manifest_for_user
|
|
|
|
conn = db_module.get_system_db()
|
|
try:
|
|
_ensure_admin1(conn)
|
|
TableRegistryRepository(conn).register(
|
|
id="bq_view", name="bq_view", source_type="bigquery",
|
|
bucket="ds", source_table="bq_view", query_mode="remote",
|
|
)
|
|
SyncStateRepository(conn).update_sync(
|
|
table_id="bq_view", rows=0, file_size_bytes=0, hash="",
|
|
)
|
|
admin = {"id": "admin1", "email": "a@x.com"}
|
|
manifest = _build_manifest_for_user(conn, admin)
|
|
assert manifest["tables"]["bq_view"]["query_mode"] == "remote"
|
|
assert manifest["tables"]["bq_view"]["source_type"] == "bigquery"
|
|
finally:
|
|
conn.close()
|
|
|
|
|
|
def test_manifest_defaults_query_mode_local_for_unregistered_state(tmp_path, monkeypatch):
|
|
"""Sync state without a corresponding registry row must default query_mode='local'.
|
|
|
|
Defensive: if registry lookup misses (deleted entry, race), don't break the manifest.
|
|
"""
|
|
db_module = _reload_db_module(monkeypatch, tmp_path)
|
|
|
|
from src.repositories.sync_state import SyncStateRepository
|
|
from app.api.sync import _build_manifest_for_user
|
|
|
|
conn = db_module.get_system_db()
|
|
try:
|
|
_ensure_admin1(conn)
|
|
SyncStateRepository(conn).update_sync(
|
|
table_id="orphan", rows=0, file_size_bytes=0, hash="",
|
|
)
|
|
admin = {"id": "admin1", "email": "a@x.com"}
|
|
manifest = _build_manifest_for_user(conn, admin)
|
|
assert manifest["tables"]["orphan"]["query_mode"] == "local"
|
|
assert manifest["tables"]["orphan"]["source_type"] == ""
|
|
finally:
|
|
conn.close()
|