feat(acl) exposing an API to access ACL groups globally #2371

subnetmarco · 2017-04-11T00:10:48Z

Full changelog

Exposing the /acls endpoint to globally access ACL groups

Issues resolved

TODO: requires documentation

p0pr0ck5 · 2017-04-17T18:23:50Z

kong/plugins/acl/api.lua

+        id = self.params.id,
+        consumer_id = self.params.consumer_id,
+      }
+      self.params.group_or_id = nil


slightly confused, where is group_or_id populated?

good catch - it's a leftover from a first implementation when I had :group_or_id in the URL.

p0pr0ck5 · 2017-04-17T18:25:33Z

spec/03-plugins/19-acl/01-api_spec.lua

+            }
+          })
+          local body = assert.res_status(400, res)
+          assert.equal([[{"consumer_id":"consumer_id is required","group":"group is required"}]], body)


it might make more sense to test table equality directly, by decoding body, rather than a string representation of the JSON? table keys are not encoded deterministically (in our environment, to my knowledge), so this test can fail at random.

@p0pr0ck5 in the past tests we have been comparing the string directly. Maybe @thibaultcha has an opinion on this?

p0pr0ck5 · 2017-04-17T18:26:02Z

spec/03-plugins/19-acl/01-api_spec.lua

+            }
+          })
+          local body = assert.res_status(400, res)
+          assert.equal([[{"consumer_id":"consumer_id is required","group":"group is required"}]], body)


p0pr0ck5 · 2017-04-17T18:26:44Z

spec/03-plugins/19-acl/01-api_spec.lua

+              }
+            })
+            local body = assert.res_status(400, res)
+            assert.equal([[{"group":"group is required"}]], body)


p0pr0ck5 · 2017-04-17T18:54:41Z

kong/plugins/acl/api.lua

+      local acls, err = dao_factory.acls:find_all(filter_keys)
+      if err then
+        return helpers.yield_error(err)
+      elseif next(acls) == nil then


should this be elseif #acls == 0, to match existing style, and as a more performant/idiomatic approach?

thibaultcha · 2017-04-17T20:19:29Z

Yes, better to decode too I think, since those tests have indeed proven themselves to occasionally fail on different platforms due to the behavior @p0pr0ck5 described

subnetmarco · 2017-04-18T01:03:09Z

The last commit addresses the review.

thibaultcha · 2017-04-18T01:08:32Z

Would have been better to amend previous commits to keep the history clean. Will fixup during merge

subnetmarco · 2017-04-18T02:30:50Z

I kept the history in the PR so that reviews can be tracked, but the idea is to squash and merge once everything is ready.

p0pr0ck5 · 2017-04-18T20:27:16Z

spec/03-plugins/19-acl/01-api_spec.lua

@@ -51,7 +51,9 @@ describe("Plugin: acl (API)", function()
            }
          })
          local body = assert.res_status(400, res)
-          assert.equal([[{"group":"group is required"}]], body)
+          assert.are.same({


these JSON encoding changes are being handled in #2402; it's not necessary here i dont think, and it's also out of scope for this commit

p0pr0ck5

Should we also implement an endpoint /acls/:consumer_id that shows all the groups a user is associated with?

p0pr0ck5 · 2017-05-01T18:35:28Z

kong/plugins/acl/api.lua

+    before = function(self, dao_factory, helpers)
+      local filter_keys = {
+        id = self.params.id,
+        consumer_id = self.params.consumer_id,


Since id is the PK on acls, searching by consumer_id seems unnecessary?

p0pr0ck5 · 2017-05-01T18:44:05Z

spec/03-plugins/19-acl/01-api_spec.lua

+      end)
+    end)
+
+    describe("GET", function()


This test nesting feels really awkward. We have

/acls GET

and then

/acls GET /acls/:id GET
/acls GET /acls/:id PATCH
/acls GET /acls/:id DELETE

Can we (should we?) clean this up?

p0pr0ck5 · 2017-05-01T18:44:14Z

spec/03-plugins/19-acl/01-api_spec.lua

+      end)
+
+      describe("GET", function()
+        it("retrieves ACL group by id", function()


It would be good to expand this test to see the route in question filter out some unrelated entries (e.g. add some ACL entries that are not associated with this consumer)

p0pr0ck5 · 2017-05-01T18:53:11Z

CHANGELOG.md

@@ -46,6 +46,9 @@
  - file-log: New `config.reopen` property to close and reopen the log file on
    every request, in otder to effectively rotate the logs.
    [#2348](https://github.com/Mashape/kong/pull/2348)
+  - acl: a new `/acls` endpoint has been exposed in the Admin API to globally 


i think this isnt going to make it into 0.10.2, so this will need to be moved elsewhere?

p0pr0ck5 · 2017-05-01T18:56:58Z

spec/03-plugins/19-acl/01-api_spec.lua

+            ["Content-Type"] = "application/json"
+          }
+        })
+        local body = cjson.decode(assert.res_status(201, res))


in some cases this is wrapping cjson.decode around res_status, and in other cases the decoding is being done as part of the body check assertion (as in the next test below). can we keep this behavior consistent?

p0pr0ck5 · 2017-06-30T05:21:39Z

@thefosk any update?

hbagdi · 2017-10-19T03:03:07Z

@thefosk any update?
@thibaultcha this is similar to #2955 we're working on.

hbagdi · 2017-11-08T03:17:50Z

@thefosk @thibaultcha @p0pr0ck5
I'm working on an enhanced version of this PR.

I feel having an endpoint GET /aclgroups to return all the group names would be pretty helpful.
And then the above endpoint will instead be GET /aclgroups/:groupname/consumers.

The problem I'm facing, it seems there is no straightforward way of doing:

select distinct group from acls;

Is there away around of doing this, or we will need to update the core DB logic? I could take a stab at it if there is another use case for such a query.

IMHO, this would be pretty useful for admin purposes.

thibaultcha · 2017-11-27T19:09:22Z

#3039 has just been merged and includes such an /acls endpoint for browsing the ACLs, with plans to add additional sugar endpoints around ACLs and Consumers in the future. We wil be releasing it in 0.11.2 later this week.

Closing this then!

* `/acls/` to paginate through all acls for all consumers * `/acls/:acl_id/consumer` to retrieve the Consumer associated with an acl From #3039 Fix #2188 Supersedes #2371 Signed-off-by: Thibault Charbonnier <thibaultcha@me.com>

feat(acl) exposing an API to access ACL groups globally

d56aee9

thibaultcha added the pr/status/please review label Apr 15, 2017

p0pr0ck5 reviewed Apr 17, 2017

View reviewed changes

p0pr0ck5 added pr/changes requested Changes were requested to this PR by a maintainer. Please address them and ping back once done. and removed pr/status/please review labels Apr 17, 2017

subnetmarco added 2 commits April 17, 2017 18:00

test(acl) checking decoded table instead of string

8dc2a96

refactor(acl) using length in DAO response check

aefbaf8

subnetmarco added pr/status/please review and removed pr/changes requested Changes were requested to this PR by a maintainer. Please address them and ping back once done. labels Apr 18, 2017

p0pr0ck5 reviewed Apr 18, 2017

View reviewed changes

subnetmarco added 3 commits April 26, 2017 15:35

Merge branch 'master' into feat/acls-api

2dfbbd9

changelog

be8d1c5

Merge branch 'master' into feat/acls-api

93a1553

p0pr0ck5 reviewed May 1, 2017

View reviewed changes

p0pr0ck5 added pr/changes requested Changes were requested to this PR by a maintainer. Please address them and ping back once done. and removed pr/status/please review labels May 1, 2017

Merge branch 'master' into feat/acls-api

7d2b7cc

hbagdi mentioned this pull request Oct 31, 2017

feat(basic-auth) add endpoint to list all basic-auths #2998

Merged

thibaultcha mentioned this pull request Nov 1, 2017

feat(key-auth) add endpoint to list all key-auths #2955

Closed

hbagdi mentioned this pull request Nov 18, 2017

feat(acls) add admin endpoints to interact with acls #3039

Closed

thibaultcha closed this Nov 27, 2017

thibaultcha deleted the feat/acls-api branch November 27, 2017 19:09

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(acl) exposing an API to access ACL groups globally #2371

feat(acl) exposing an API to access ACL groups globally #2371

subnetmarco commented Apr 11, 2017 •

edited

p0pr0ck5 Apr 17, 2017

subnetmarco Apr 17, 2017

p0pr0ck5 Apr 17, 2017

subnetmarco Apr 17, 2017

p0pr0ck5 Apr 17, 2017

p0pr0ck5 Apr 17, 2017

p0pr0ck5 Apr 17, 2017

thibaultcha commented Apr 17, 2017

subnetmarco commented Apr 18, 2017

thibaultcha commented Apr 18, 2017

subnetmarco commented Apr 18, 2017

p0pr0ck5 Apr 18, 2017

p0pr0ck5 left a comment

p0pr0ck5 May 1, 2017

p0pr0ck5 May 1, 2017

p0pr0ck5 May 1, 2017

p0pr0ck5 May 1, 2017

p0pr0ck5 May 1, 2017

p0pr0ck5 commented Jun 30, 2017

hbagdi commented Oct 19, 2017

hbagdi commented Nov 8, 2017 •

edited

thibaultcha commented Nov 27, 2017

feat(acl) exposing an API to access ACL groups globally #2371

feat(acl) exposing an API to access ACL groups globally #2371

Conversation

subnetmarco commented Apr 11, 2017 • edited

Full changelog

Issues resolved

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

thibaultcha commented Apr 17, 2017

subnetmarco commented Apr 18, 2017

thibaultcha commented Apr 18, 2017

subnetmarco commented Apr 18, 2017

Choose a reason for hiding this comment

p0pr0ck5 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

p0pr0ck5 commented Jun 30, 2017

hbagdi commented Oct 19, 2017

hbagdi commented Nov 8, 2017 • edited

thibaultcha commented Nov 27, 2017

subnetmarco commented Apr 11, 2017 •

edited

hbagdi commented Nov 8, 2017 •

edited