lib_FullSyncGrp

Library to define users, groups, roles, and permissions (RBAC) for fullsync replication filtering

For more technical informations : documentation

• Installation
• Sequences
  • EffectivePermissionsOfUser
  • GetGroupAttributes
  • GetPermissionAttributes
  • GetRoleAttributes
  • Groups
  • GroupsOf
  • GroupsOfRole
  • NonRegressionPrimitives
  • Permissions
  • PermissionsOfRole
  • RemoveGroup
  • RemovePermissionAttributes
  • RemovePermissionFromRole
  • RemoveRoleFromGroup
  • RemoveUserFromGroup
  • RemoveUserInGroupBulkV2
  • Roles
  • RolesOfGroup
  • RolesOfPermission
  • SeedRbacDemoData
  • SetGroupAttributes
  • SetPermissionAttributes
  • SetPermissionInRole
  • SetRoleAttributes
  • SetRoleInGroup
  • SetUserInGroup
  • SetUserInGroupBulk
  • SetUserInGroupBulkV2
  • UpdateGroup
  • Users
  • UsersOf

Installation

1. In your Convertigo Studio use File->Import->Convertigo->Convertigo Project and hit the Next button

2. In the dialog Project remote URL field, paste the text below:

   Usage	Click the copy button
   To contribute	lib_FullSyncGrp=https://github.com/convertigo/c8oprj-lib-fullsync-grp.git:branch=8.0.0
   To simply use	lib_FullSyncGrp=https://github.com/convertigo/c8oprj-lib-fullsync-grp/archive/8.0.0.zip

3. Click the Finish button. This will automatically import the lib_FullSyncGrp project

Sequences

EffectivePermissionsOfUser

list effective permissions of the current authenticated user through groups and roles

GetGroupAttributes

Get attributes for a group. Parameter: group is the group name. The sequence reads the deterministic attribute document sha256("groupAttributes:" + group), whose type is c8oGroupAttributes. The response is the FullSync document returned by GetDocument and contains couchdb_output.attributes as the JSON object previously written by SetGroupAttributes.

variables

name	comment
group	Group name whose attributes document is read. The read document id is sha256("groupAttributes:" + group).

GetPermissionAttributes

Get attributes for a permission. Parameter: permission is the canonical permission string. The sequence reads the deterministic attribute document sha256("permissionAttributes:" + permission), whose type is c8oPermissionAttributes. The response is the FullSync document returned by GetDocument and contains couchdb_output.attributes as the JSON object previously written by SetPermissionAttributes.

variables

name	comment
permission	Canonical permission string whose attributes document is read. The read document id is sha256("permissionAttributes:" + permission).

GetRoleAttributes

Get attributes for a role. Parameter: role is the role name. The sequence reads the deterministic attribute document sha256("roleAttributes:" + role), whose type is c8oRoleAttributes. The response is the FullSync document returned by GetDocument and contains couchdb_output.attributes as the JSON object previously written by SetRoleAttributes.

variables

name	comment
role	Role name whose attributes document is read. The read document id is sha256("roleAttributes:" + role).

Groups

list all groups

GroupsOf

list groups of a user

variables

name	comment
user	User identifier used as the lookup key. The sequence returns every group containing this user.

GroupsOfRole

list groups of a role

variables

name	comment
role	Role name used as the lookup key. It is normalized to lowercase before listing groups attached to this role.

NonRegressionPrimitives

Non-regression sequence covering FullSync group and RBAC primitives with isolated nr_* data

Permissions

list all permissions

PermissionsOfRole

list permissions of a role

variables

name	comment
role	Role name used as the lookup key. It is normalized to lowercase before listing permissions attached to this role.

RemoveGroup

Remove a group by deleting all user-group links for this group, and also deleting the attached GroupAttributes document if it exists. The group attributes document id is sha256("groupAttributes:" + group).

variables

name	comment
group	Group name to remove. RemoveGroup deletes all user-group links for this group and also deletes the attached GroupAttributes document if it exists.

RemovePermissionAttributes

Remove attributes for a permission without removing any role-permission link. Parameter: permission is the canonical permission string. The sequence deletes the deterministic attribute document sha256("permissionAttributes:" + permission), whose type is c8oPermissionAttributes. This primitive is intentionally separate from RemovePermissionFromRole because a permission can be attached to several roles.

variables

name	comment
permission	Canonical permission string whose attributes document must be removed. This does not remove role-permission links.

RemovePermissionFromRole

remove a permission from a role

variables

name	comment
action	Permission action to remove. It is normalized to lowercase and combined with element and scope as element.action:scope.
element	Permission resource element to remove. It is normalized to lowercase and combined with action and scope as element.action:scope.
role	Role name from which the permission is removed. The role is normalized to lowercase before the role-permission link id is computed.
scope	Permission scope to remove. It is normalized to lowercase and combined with element and action as element.action:scope.

RemoveRoleFromGroup

remove a role from a group

variables

name	comment
group	Group name from which the role is removed. The group-role document id is sha256(group + ":" + normalized role).
role	Role name to remove from the group. The role is normalized to lowercase before the group-role link id is computed.

RemoveUserFromGroup

remove a user from a group

variables

name	comment
group	Group name from which the user membership is removed. The membership document id is sha256(user + ":" + group).
user	User identifier to remove from the group. The membership document id is sha256(user + ":" + group).

RemoveUserInGroupBulkV2

Bulk remove of 1,n users to 1,n groups

variables

name	comment
groups	Array groups -- should be stringified from front-end
users	Array users -- should be stringified from front-end

Roles

list all roles

RolesOfGroup

list roles of a group

variables

name	comment
group	Group name used as the lookup key. The sequence returns every role attached to this group.

RolesOfPermission

list roles of a permission

variables

name	comment
permission	Canonical permission string used as the lookup key, in the form element.action:scope. The sequence returns every role containing this permission.

SeedRbacDemoData

seed a complex RBAC demo dataset

SetGroupAttributes

Set or merge attributes for a group. Parameters: group is the group name; attributes is a JSON object encoded as a string, for example {"label":"Managers","level":"2"}; mergePolicy is optional and is forwarded to the FullSync PostDocument p_merge parameter. By default, the new attributes object is merged with the existing attributes object: existing keys are kept, provided keys are added or replaced. Use mergePolicy to control special merge behavior on paths, for example {"attributes.label":"delete"} removes the label key, {"attributes.tags":"append"} appends to an array, and {"attributes.profile":"override"} replaces the nested object instead of deep-merging it. The document id is deterministic: sha256("groupAttributes:" + group). Stored document type is c8oGroupAttributes.

variables

name	comment
attributes	JSON object encoded as a string. Provided keys are merged into the existing attributes object, for example {"label":"Managers","level":"2"}.
group	Group name owning the attributes document. The stored document id is sha256("groupAttributes:" + group).
mergePolicy	Optional FullSync PostDocument p_merge JSON string. It controls special merge behavior by path, for example {"attributes.label":"delete"}, {"attributes.tags":"append"}, or {"attributes.profile":"override"}.

SetPermissionAttributes

Set or merge attributes for a permission. Parameters: permission is the canonical permission string, for example resource.action:scope; attributes is a JSON object encoded as a string, for example {"label":"Can read all records","risk":"low"}; mergePolicy is optional and is forwarded to the FullSync PostDocument p_merge parameter. By default, the new attributes object is merged with the existing attributes object: existing keys are kept, provided keys are added or replaced. Use mergePolicy to control special merge behavior on paths, for example {"attributes.label":"delete"} removes the label key, {"attributes.tags":"append"} appends to an array, and {"attributes.profile":"override"} replaces the nested object instead of deep-merging it. The document id is deterministic: sha256("permissionAttributes:" + permission). Stored document type is c8oPermissionAttributes.

variables

name	comment
attributes	JSON object encoded as a string. Provided keys are merged into the existing attributes object, for example {"label":"Can read all records","risk":"low"}.
mergePolicy	Optional FullSync PostDocument p_merge JSON string. It controls special merge behavior by path, for example {"attributes.label":"delete"}, {"attributes.tags":"append"}, or {"attributes.profile":"override"}.
permission	Canonical permission string owning the attributes document, for example resource.action:scope. The stored document id is sha256("permissionAttributes:" + permission).

SetPermissionInRole

add a permission to a role

variables

name	comment
action	Permission action. It is normalized to lowercase and combined with element and scope as element.action:scope.
element	Permission resource element. It is normalized to lowercase and combined with action and scope as element.action:scope.
role	Role name receiving the permission. The role is normalized to lowercase before the role-permission link is stored.
scope	Permission scope. It is normalized to lowercase and combined with element and action as element.action:scope.

SetRoleAttributes

Set or merge attributes for a role. Parameters: role is the role name; attributes is a JSON object encoded as a string, for example {"label":"Reader","priority":"10"}; mergePolicy is optional and is forwarded to the FullSync PostDocument p_merge parameter. By default, the new attributes object is merged with the existing attributes object: existing keys are kept, provided keys are added or replaced. Use mergePolicy to control special merge behavior on paths, for example {"attributes.label":"delete"} removes the label key, {"attributes.tags":"append"} appends to an array, and {"attributes.profile":"override"} replaces the nested object instead of deep-merging it. The document id is deterministic: sha256("roleAttributes:" + role). Stored document type is c8oRoleAttributes.

variables

name	comment
attributes	JSON object encoded as a string. Provided keys are merged into the existing attributes object, for example {"label":"Reader","priority":"10"}.
mergePolicy	Optional FullSync PostDocument p_merge JSON string. It controls special merge behavior by path, for example {"attributes.label":"delete"}, {"attributes.tags":"append"}, or {"attributes.profile":"override"}.
role	Role name owning the attributes document. The stored document id is sha256("roleAttributes:" + role).

SetRoleInGroup

add a role to a group

variables

name	comment
group	Group name receiving the role. The group-role document id is sha256(group + ":" + normalized role).
role	Role name to add to the group. The role is normalized to lowercase before the group-role link is stored.

SetUserInGroup

add a user to a group

variables

name	comment
group	Group name receiving the user membership. The membership document id is sha256(user + ":" + group).
user	User identifier to add to the group. The membership document id is sha256(user + ":" + group).

SetUserInGroupBulk

add a user to a group

variables

name	comment
bulkOBj

SetUserInGroupBulkV2

Bulk add of 1,n users to 1,n groups

variables

name	comment
groups	Array groups -- should be stringified from front-end
users	Array users -- should be stringified from front-end

UpdateGroup

variables

name	comment
new_group_name	Target group name that receives the users previously attached to old_group_name.
old_group_name	Existing group name to replace. UpdateGroup moves its users to new_group_name, removes the old group links, and removes the old GroupAttributes document through RemoveGroup.

Users

list all users

UsersOf

list users of a group

variables

name	comment
group	Group name used as the lookup key. The sequence returns every user attached to this group.