Fixes #22349: Update user plugin to manage update custom roles #536

fanf · 2023-02-08T11:16:39Z

https://issues.rudder.io/issues/22349

There is a lot of things to change in the way that plugin works, but in that PR I limited to what is the minimum to make it compatible with Rudder 7.3 changes + an auto-backup of rudder-user.xml file in case of problem - because we didn't have anything for that, and it would make rudder broken.

So, the changes related to API changes in core are:

reflect name changes from rudder (RudderRoles)
update function from Box to ZIO (reflecting changes in backend + general direction of where we are going)

Other changes that were needed:

add a backup/rollback logic if something goes badly when writting the new rudder-users.xml file. At least, let the user know that he is not hopeless.
remove useless duplicate call to reload after each changes. The reload is done in back-end (no the responsibility of UI). I changed to call to getUserList to force refresh UI, which seemed to be the wanted logic, but even that should be removed: the API return of POST should send the wanted updated model, and UI just handle that, which will remove more useless roundtrip to backend.

What is not done but need to be done to have a "user management plugin with custom roles":

bare minimum: rework the role coverture logic to keep custom role. If the user is defined with some role, the plugin MUST NOT change them, it's only when the role are defined from authz from the UI
API need to be changed to use ZIO and our API tooling, which implies also changing JSON serialisation
add the possibility to define custom role if the extended authz plugin is there
a correct handling of errors from the UI side. We just get a blanck screen with a "error happened" notification, without any way for the user to know what to do. At least say "try to reload", or better handle the error correctly to let the user know things went wrongly, but we did what was needed which is XXX.

VinceMacBuche · 2023-02-08T11:38:57Z

user-management/src/main/scala/com/normation/plugins/usermanagement/UserManagementService.scala

+      file       <- getUserFilePath
+      parsedFile <- IOResult.attempt(ConstructingParser.fromFile(file.toJava, preserveWS = true))
+      userXML    <- IOResult.attempt(parsedFile.document().children)
+      toUpdate    = (userXML \\ "authentication").head


I don't think this is needed

fanf · 2023-02-09T12:26:16Z

user-management/src/main/elm/sources/UserManagement.elm

@@ -105,23 +105,23 @@ update msg model =
        AddUser result ->
             case result of
                 Ok username ->
-                     (model, postReloadConf model )
+                     (model, getUsersConf model )


we don't need to ask for a reload, it's the role of the backend to ensure backend logic. In fact, the the API return value should be enough to update the UI as wanted.

fanf · 2023-02-09T12:26:46Z

user-management/src/main/scala/com/normation/plugins/usermanagement/DataTypes.scala

@@ -56,15 +58,15 @@ object UserManagementLogger extends Logger {

 object Serialisation {

-  implicit class AuthConfigSer(auth: UserDetailList) {
+  implicit class AuthConfigSer(auth: ValidatedUserList) {


changes in rudder core

fanf · 2023-02-09T12:27:08Z

user-management/src/main/scala/com/normation/plugins/usermanagement/DataTypes.scala

    def toJson: JValue = {
      val encoder: String = PassEncoderToString(auth)
      val authBackendsProvider = RudderConfig.authenticationProviders.getConfiguredProviders().map(_.name).toSet

      val jUser            = auth.users.map {
        case (_, u) =>
          val (rs, custom) = {
-            UserManagementService.computeRoleCoverage(Role.values, u.authz.authorizationTypes).getOrElse(Set.empty).partition {
+            UserManagementService.computeRoleCoverage(RudderRoles.getAllRoles.runNow.values.toSet, u.authz.authorizationTypes).getOrElse(Set.empty).partition {


need to ask for all roles including custom roles now

fanf · 2023-02-09T12:28:10Z

user-management/src/main/scala/com/normation/plugins/usermanagement/UserManagementService.scala

-    def compareRights(r: Role): Option[Role] = {
-      if (r.name == "no_rights") {
+    def compareRights(r: Role, as: Set[AuthorizationType]): Option[Role] = {
+      if (r == Role.NoRights) {


we have type, use them. We should not revert to string comparison appart for very good cases (check at system boudaries: parsing, serialisation, etc)

fanf · 2023-02-09T12:28:47Z

user-management/src/main/scala/com/normation/plugins/usermanagement/UserManagementService.scala

      None
+    } else if (authzs.contains(AuthorizationType.AnyRights)) {


missing that case, which is now necessary given changes in rudder core

Fixes #22349: Update user plugin to manage update custom roles

fanf · 2023-02-09T12:30:50Z

PR updated with a new commit

fanf · 2023-02-09T12:33:59Z

user-management/src/main/scala/com/normation/plugins/usermanagement/UserManagementService.scala

-    val resources: Either[UserConfigFileError, UserFile] = UserFileProcessing.getUserResourceFile()
-    resources match {
-      case Left(err) =>
-        Left(err)


when you see that you write case Left(err) => Left(err), you want to just map

fanf · 2023-02-09T12:35:48Z

user-management/src/main/scala/com/normation/plugins/usermanagement/UserManagementService.scala

-          case cr if cr == roleAuthzNames => Some(r)
-          case cr if cr.nonEmpty          =>
-            val test = cr.flatMap(RoleToRights.parseAuthz)
-            if (test.isEmpty) {


test can't be empty, there is a check on that in the pattern match (not exactly, but there is no need to parse either, we just have to avoid to map(_.id) and remains with the types)

fanf · 2023-02-09T12:36:46Z

user-management/src/main/scala/com/normation/plugins/usermanagement/UserManagementService.scala

        }
      }
    }

-    if (authzs.isEmpty || roles.isEmpty || authzs.exists(_.id == "no_rights")) {
+    if (authzs.isEmpty || roles.isEmpty || authzs.contains(AuthorizationType.NoRights)) {


keep the types! More info, more efficient, avoid useless parse/serialise roundtrip with errors to manage

…m roles Fixes #22349: Update user plugin to manage update custom roles

fanf · 2023-02-09T12:38:22Z

PR updated with a new commit

fanf · 2023-02-09T12:39:44Z

user-management/src/test/scala/com/normation/plugins/usermanagement/RoleComputationTest.scala

-      }
+      computeRoleCoverage(Set(Role.User), Set(AuthorizationType.Compliance.Read)) must beEqualTo(
+        Some(Set(Role.forAuthz(AuthorizationType.Compliance.Read)))
+      )


Test need to be kept as small as possible, else the intent is lost. There is a lot of builtin comparators, use them

Fixes #22349: Update user plugin to manage update custom roles

0dc52e5

fanf requested a review from VinceMacBuche February 8, 2023 11:17

VinceMacBuche reviewed Feb 8, 2023

View reviewed changes

Fixes #22349: Update user plugin to manage update custom roles

e825c05

fanf commented Feb 9, 2023

View reviewed changes

fixup! Fixes #22349: Update user plugin to manage update custom roles

d7bc804

Fixes #22349: Update user plugin to manage update custom roles

fanf commented Feb 9, 2023

View reviewed changes

fixup! fixup! Fixes #22349: Update user plugin to manage update custo…

b079d95

…m roles Fixes #22349: Update user plugin to manage update custom roles

fanf commented Feb 9, 2023

View reviewed changes

VinceMacBuche approved these changes Feb 9, 2023

View reviewed changes

VinceMacBuche changed the base branch from 7.3-next to branches/rudder/7.3 February 9, 2023 16:16

VinceMacBuche merged commit ba35788 into Normation:branches/rudder/7.3 Feb 9, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fixes #22349: Update user plugin to manage update custom roles #536

Fixes #22349: Update user plugin to manage update custom roles #536

fanf commented Feb 8, 2023 •

edited

Loading

VinceMacBuche Feb 8, 2023

fanf Feb 9, 2023

fanf Feb 9, 2023

fanf Feb 9, 2023

fanf Feb 9, 2023

fanf Feb 9, 2023

fanf Feb 9, 2023

fanf commented Feb 9, 2023

fanf Feb 9, 2023

fanf Feb 9, 2023

fanf Feb 9, 2023

fanf commented Feb 9, 2023

fanf Feb 9, 2023

		None
		} else if (authzs.contains(AuthorizationType.AnyRights)) {

Fixes #22349: Update user plugin to manage update custom roles #536

Fixes #22349: Update user plugin to manage update custom roles #536

Conversation

fanf commented Feb 8, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

fanf commented Feb 9, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

fanf commented Feb 9, 2023

Choose a reason for hiding this comment

fanf commented Feb 8, 2023 •

edited

Loading