feat: Migrate roles and permissions to MetaDB #7877
Conversation
dstala
added
the
📞 Status: Need Internal Discussion
|
@o1lab P.S. The test failures seem unrelated to my changes, am I missing something? Maybe the tests are flaky? |
WalkthroughWalkthroughThe overall change introduces a more granular and flexible role-based permission system. It involves updating user and authentication models to include role permissions, enhancing the backend to handle permission checks more effectively, and migrating the database schema to support roles and permissions management. This change allows for a dynamic assignment of permissions to roles, improving the system's security and customizability. Changes
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (invoked as PR comments)
Additionally, you can add CodeRabbit Configration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review Status
Actionable comments generated: 3
Configuration used: CodeRabbit UI
Files ignored due to path filters (2)
packages/nc-lib-gui/package-lock.jsonis excluded by:!**/*.jsonpackages/nocodb/src/schema/swagger.jsonis excluded by:!**/*.json
Files selected for processing (10)
- packages/nc-gui/composables/useRoles/index.ts (7 hunks)
- packages/nc-gui/lib/types.ts (1 hunks)
- packages/nocodb-sdk/src/lib/Api.ts (1 hunks)
- packages/nocodb/src/controllers/auth/auth.controller.ts (1 hunks)
- packages/nocodb/src/meta/migrations/XcMigrationSourcev2.ts (3 hunks)
- packages/nocodb/src/meta/migrations/v2/nc_043_roles_permissions.ts (1 hunks)
- packages/nocodb/src/middlewares/extract-ids/extract-ids.middleware.ts (4 hunks)
- packages/nocodb/src/services/users/users.service.ts (1 hunks)
- packages/nocodb/src/utils/acl.ts (2 hunks)
- packages/nocodb/src/utils/globals.ts (1 hunks)
Additional comments: 14
packages/nc-gui/composables/useRoles/index.ts (2)
- 6-16: The changes to the
hasPermissionfunction, including the addition of therolePermissionparameter and the updated logic for checking permissions, are correctly implemented and enhance the flexibility of permission checking.- 106-112: > 📝 NOTE
This review was outside the diff hunks and was mapped to the diff hunk with the greatest overlap. Original lines [91-129]
The inclusion of
role_permissionsin the user object and the updated logic for checking permissions based on roles are correctly implemented. These changes enhance the system's ability to manage and check permissions in a centralized manner.Consider caching or optimizing the fetching of role permissions to improve performance, especially if there are many roles or if the permissions data is large.
packages/nc-gui/lib/types.ts (1)
- 16-16: The addition of the
role_permissionsfield to theUserinterface is correctly implemented and necessary for storing the permissions associated with each role a user has.packages/nocodb/src/utils/globals.ts (1)
- 49-51: The addition of the
ROLES,PERMISSIONS, andROLES_PERMISSIONSenum values to theMetaTableenum is correctly implemented and aligns with the migration towards a more dynamic and customizable access control mechanism.packages/nocodb/src/meta/migrations/v2/nc_043_roles_permissions.ts (1)
- 20-178: The migration script
nc_043_roles_permissions.tsis well-structured and correctly implements the creation of theROLES,PERMISSIONS, andROLES_PERMISSIONStables, along with the initial population of these tables with roles and permissions. The script follows best practices for database migrations and correctly handles different scopes and types for permissions, including special handling for thesuperrole.packages/nocodb/src/controllers/auth/auth.controller.ts (1)
- 126-131: The enhancements to the
AuthController, specifically the logic to retrieve role permissions for all roles associated with a user and include these permissions in the returned user object, are correctly implemented. These changes provide a clearer view of the user's capabilities and access rights within the system.packages/nocodb/src/meta/migrations/XcMigrationSourcev2.ts (1)
- 32-32: The addition of the
nc_043_roles_permissionsmigration to theXcMigrationSourcev2class is correctly implemented, ensuring that the new migration script is integrated into the system's migration process.packages/nocodb/src/middlewares/extract-ids/extract-ids.middleware.ts (5)
- 27-28: The addition of imports for
NocoandMetaTableis noted. Ensure that these modules are used appropriately within the file and that their functionalities align with the intended changes in the middleware.- 41-47: > 📝 NOTE
This review was outside the diff hunks and was mapped to the diff hunk with the greatest overlap. Original lines [44-54]
The modification in
getRolesLabelsto utilize theallRolesparameter for role mapping introduces a more dynamic way of handling roles. This change aligns with the PR's objective of enhancing role and permission management. However, consider adding error handling for cases whereallRoles.find((item) => item.name === role)returnsundefined, which would lead toundefinedbeing included in the returned array.- .map((role) => allRoles.find((item) => item.name === role)?.label); + .map((role) => allRoles.find((item) => item.name === role)?.label).filter(label => label !== undefined);
- 261-263: Retrieving
allRolesusingNoco.ncMeta.knex(MetaTable.ROLES).select('name', 'label')is a critical change that supports the dynamic checking of roles against permissions. Ensure that this query is optimized for performance, especially ifAclMiddlewareis used frequently. Consider caching the roles if they don't change often to reduce database load.- 273-287: The retrieval and usage of
rolePermissionsto check if the user has the specific permission required for the action is a significant enhancement. This aligns with the PR's objective of centralizing and streamlining permission checks. Ensure that the permissions are correctly defined in the database and that the query efficiently retrieves the necessary information without causing performance issues.- 289-294: The final check for
isAllowedand the subsequent error handling if the user is not allowed is crucial for enforcing permissions. The usage ofgetRolesLabelsto provide a detailed error message is a good practice. Ensure that the error messages are clear and informative to aid in debugging and user understanding.packages/nocodb/src/utils/acl.ts (2)
- 14-14: Exporting
permissionScopesis a necessary change to make these scopes accessible outside the module, which aligns with the PR's objectives of enhancing role and permission management. Ensure that the permissions defined within are accurate and comprehensive.- 435-514: The addition of
notAssignedPermissionsBEto define permissions for superadmins that are not assigned to any roles is a significant enhancement. This allows for a more granular control of permissions, especially for superadmins. Ensure that all permissions listed are necessary and correctly categorized underorgandbasescopes.
There was a problem hiding this comment.
Review Status
Actionable comments generated: 0
Configuration used: CodeRabbit UI
Files ignored due to path filters (2)
packages/nc-lib-gui/package-lock.jsonis excluded by:!**/*.jsonpackages/nocodb/src/schema/swagger.jsonis excluded by:!**/*.json
Files selected for processing (10)
- packages/nc-gui/composables/useRoles/index.ts (7 hunks)
- packages/nc-gui/lib/types.ts (1 hunks)
- packages/nocodb-sdk/src/lib/Api.ts (1 hunks)
- packages/nocodb/src/controllers/auth/auth.controller.ts (1 hunks)
- packages/nocodb/src/meta/migrations/XcMigrationSourcev2.ts (3 hunks)
- packages/nocodb/src/meta/migrations/v2/nc_043_roles_permissions.ts (1 hunks)
- packages/nocodb/src/middlewares/extract-ids/extract-ids.middleware.ts (4 hunks)
- packages/nocodb/src/services/users/users.service.ts (1 hunks)
- packages/nocodb/src/utils/acl.ts (2 hunks)
- packages/nocodb/src/utils/globals.ts (1 hunks)
Files skipped from review as they are similar to previous changes (10)
- packages/nc-gui/composables/useRoles/index.ts
- packages/nc-gui/lib/types.ts
- packages/nocodb-sdk/src/lib/Api.ts
- packages/nocodb/src/controllers/auth/auth.controller.ts
- packages/nocodb/src/meta/migrations/XcMigrationSourcev2.ts
- packages/nocodb/src/meta/migrations/v2/nc_043_roles_permissions.ts
- packages/nocodb/src/middlewares/extract-ids/extract-ids.middleware.ts
- packages/nocodb/src/services/users/users.service.ts
- packages/nocodb/src/utils/acl.ts
- packages/nocodb/src/utils/globals.ts
Change Summary
isUIAllowedon frontend checking existing permissions in user.This is the first step to adding “Custom roles” functionality.
My plan is create page “Role management” in settings where user can see all roles in MetaDB and also create their own role from scratch or create own role based on an already existing one.
Next step I want to add page where user can manage permission for every role: add or remove some permissions from different roles.
This functionality is important for us and as far as we see for many other people too (#2712). We are open to your reviews, and proposals. We are ready to work on it.
Change type
Test/ Verification
I tested on Postgres and SQLite.
Additional information / screenshots (optional)
Anything for maintainers to be made aware of
Summary by CodeRabbit
role_permissions, allowing for more precise permission checks throughout the application.