Fetch roles and permit at login and do entity permission to permit mapping on frontend #1020

sjd78 · 2019-05-18T00:17:52Z

Resolves: #1066

Part 1

At login, fetch all roles and permits available to the user. By fetching all of the roles and permits available to a user at login time, the set of permits based on an entity's permission set can be calculated on the front end without having to fetch the permits directly.

We can't fetch the set of permits directly when requesting an entity since the permits are on the 3rd tier down from the entity and the REST 'follow' parameter doesn't traverse that far down. See BZ1639784

Now, we can fetch an entities permissions and cross reference each permission's role with the one in the redux store and build a permit list from there without having to go back to the API.

Part 2

Refactor user permission / permit / 'canUser*' calculations. Each entity's permits can be checked without an additional REST call since they're already loaded in redux state.

Note: This is currently only applied to redux data fetched during
login. VM and Disk fetches will need to be updated in a similar
fashion in future.

The authorization (permit/canUser*) refactoring has been applied to:

Clusters
Templates
Vnic Profiles
Data Centers
Storage Domains

Summary of changes:

Refactor the redux read-only fetches to base-data.js
User permits are calculated from entity permissions + user groups
(fetched at login) + roles (fetched at login). Entity permissions
map through the user and groups to roles and permits. A user's
authorization to access or perform a function is based on their
net permits.

sjd78 · 2019-05-18T00:30:28Z

@bond95, @michalskrivanek, @sgratch - I think this technique may be a viable way to reduce the number of REST calls we need to make. Currently, for every entity we want to check permits, the permissions (with roles and permits followed) are fetched directly. With this PR, I'm prefetch all the roles and each entity can just add a follows=permissions, cross reference in the fetch saga and be done.

Any thoughts on why this wouldn't be a valid way to go?

michalskrivanek · 2019-05-20T06:58:02Z

it would certainly help a lot!

sjd78 · 2019-06-06T13:47:42Z

@bond95 - What do you think about this approach instead of the extra calls that are currently being doing (like in #1019)?

bond95

Only one nit-pick

src/sagas/templates.js

Removed Api.templateToInternal since it is no longer used.

src/actions/roles.js

src/ovirtapi/transform.js

src/sagas/storageDomains.js

src/sagas/utils.js

Addressed review comments.

sjd78 · 2019-07-08T18:46:09Z

What kind of difference does this change make? Hitting the brq-dev engine, I have the following numbers from initial app request to the APP_CONFIGURED action:

Code Base	XHR Req Count	XHR Size	Load time
master	46	99.7 KB	16.4s
this pr	24 (~48% reduction)	44.1 KB (~56% reduction)	11.3s (~31% reduction)

The request count and size different is due to not requesting each entities's permits explicitly. The number will vary depending on how many things each user has access to in their environment. Given that caveat, for admin @ brq-dev, it is a 48% request count reduction, 56% request size reduction and 69% of the original time taken. Decent changes!

src/sagas/storageDomains.js

Broke up fetchIsoFiles into small functions.

bond95

LGTM

sjd78 · 2019-09-07T02:48:47Z

(rebased)

sjd78 · 2019-09-23T15:33:15Z

(rebased)

sjd78 · 2019-11-19T18:45:43Z

(rebased)

pnovotny · 2020-01-06T15:45:53Z

ci build please

sjd78 · 2020-03-01T19:36:34Z

Rebased and is working again on top of current master.
(@sgratch)

sjd78 · 2020-03-01T19:42:44Z

@sgratch, @michalskrivanek - CI is failing here because nodejs-modules isn't build correctly for el7 and fc30 on a my pre-seed patch https://gerrit.ovirt.org/#/c/107309/. Once nodejs-modules actually can run a clean re-merge, CI will work again.

sjd78 · 2020-03-03T18:22:32Z

ci test please

By fetching all of the roles, with permits, that are available to a user at login time, the set of permits available to the user based on their permission set can be calculated on the front end without having to fetch the permits directly. We can't fetch the set of permits directly when requesting an entity since the permits are on the 3rd tier down from the entity and the REST 'follow' parameter doesn't traverse that far down. [1] Now, we can fetch an entities permissions and cross reference each permission's role with the one in the redux store and build a permit list from there without having to go back to the API. [1] - https://bugzilla.redhat.com/show_bug.cgi?id=1639784

Note: This is currently only applied to redux data fetched during login. VM and Disk fetches will need to be updated in a similar fashion in future. The authorization (permit/canUser*) refactoring has been applied to: - Clusters - Templates - Vnic Profiles - Data Centers - Storage Domains Summary of changes: - Refactor the redux read-only fetches to `base-data.js` - User permits are calculated from entity permissions + user groups (fetched at login) + roles (fetched at login). Entity permissions map through the user and groups to roles and permits. A user's authorization to access or perform a function is based on their net permits. - API calls updated as necessary to fetch "follow=permissions" - Remove unused permit fetching code

- Refactored login and template handling - Removed template sagas, reducers and constants no longer needed - Permission to permit mapping function now takes the entity itself so if permissions are missing, sagas will not fail. No permissions == no permits.

pnovotny · 2020-03-10T14:31:37Z

ci build please

pnovotny · 2020-03-17T23:40:14Z

LGTM

sjd78 requested review from bond95, sgratch and michalskrivanek May 18, 2019 00:26

sjd78 marked this pull request as ready for review May 18, 2019 00:30

bond95 previously requested changes Jun 13, 2019

View reviewed changes

src/sagas/templates.js Outdated Show resolved Hide resolved

sjd78 force-pushed the roles-and-templates branch 2 times, most recently from 2c7a8a9 to 28ff261 Compare June 19, 2019 23:35

sjd78 requested a review from bond95 June 19, 2019 23:36

sjd78 mentioned this pull request Jun 20, 2019

Create VM Wizard #987

Merged

sjd78 force-pushed the roles-and-templates branch 4 times, most recently from a8f7612 to b3967b6 Compare June 28, 2019 23:46

sjd78 changed the title ~~Fetch roles and permit at login to allow entity permission to permit mapping on frontend, apply to templates~~ Fetch roles and permit at login and do entity permission to permit mapping on frontend Jun 28, 2019

sjd78 force-pushed the roles-and-templates branch from b3967b6 to 83d7a42 Compare July 2, 2019 14:56

bond95 previously requested changes Jul 3, 2019

View reviewed changes

sjd78 force-pushed the roles-and-templates branch from 83d7a42 to d559b7b Compare July 8, 2019 18:30

sjd78 requested a review from bond95 July 9, 2019 18:04

bond95 previously requested changes Jul 18, 2019

View reviewed changes

src/sagas/storageDomains.js Outdated Show resolved Hide resolved

src/sagas/storageDomains.js Outdated Show resolved Hide resolved

sjd78 requested a review from bond95 July 18, 2019 23:49

sjd78 force-pushed the roles-and-templates branch from ddaf297 to 587731f Compare July 19, 2019 00:05

bond95 approved these changes Jul 23, 2019

View reviewed changes

sjd78 mentioned this pull request Jul 23, 2019

[RFE] Perform permission to permit mapping on front end #1066

Closed

sjd78 added the Status: ON_QA status ON_QA (currently being tested) label Jul 25, 2019

sjd78 force-pushed the roles-and-templates branch 2 times, most recently from 9eb319f to 40fcc20 Compare August 2, 2019 14:21

sjd78 force-pushed the roles-and-templates branch from 40fcc20 to 29b7074 Compare August 5, 2019 19:21

sjd78 added this to the 1.6.0 (ovirt 4.4) milestone Aug 6, 2019

sjd78 force-pushed the roles-and-templates branch 2 times, most recently from 90b55b8 to 6300095 Compare August 29, 2019 04:32

sjd78 force-pushed the roles-and-templates branch from 6300095 to dfd9108 Compare September 7, 2019 02:40

sjd78 force-pushed the roles-and-templates branch from dfd9108 to 938641d Compare September 10, 2019 13:31

sjd78 force-pushed the roles-and-templates branch from 938641d to aacafac Compare September 23, 2019 15:33

sjd78 force-pushed the roles-and-templates branch from aacafac to b4ab474 Compare November 19, 2019 18:43

sjd78 force-pushed the roles-and-templates branch from b4ab474 to cdf3ccb Compare December 2, 2019 21:42

sjd78 force-pushed the roles-and-templates branch from cdf3ccb to 9803720 Compare March 1, 2020 19:31

sjd78 added 4 commits March 6, 2020 18:29

Break up fetchIsoFiles into smaller documented functions

7feed6e

Changes for rebase to master

96baff0

- Refactored login and template handling - Removed template sagas, reducers and constants no longer needed - Permission to permit mapping function now takes the entity itself so if permissions are missing, sagas will not fail. No permissions == no permits.

sjd78 force-pushed the roles-and-templates branch from 9803720 to 96baff0 Compare March 6, 2020 23:29

sjd78 merged commit bcb6072 into oVirt:master Mar 18, 2020

sjd78 mentioned this pull request Mar 23, 2020

Fix Pool handling and refactor VM loading #1174

Merged

sjd78 deleted the roles-and-templates branch May 5, 2020 13:24

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fetch roles and permit at login and do entity permission to permit mapping on frontend #1020

Fetch roles and permit at login and do entity permission to permit mapping on frontend #1020

sjd78 commented May 18, 2019 •

edited

sjd78 commented May 18, 2019

michalskrivanek commented May 20, 2019

sjd78 commented Jun 6, 2019

bond95 left a comment

sjd78 commented Jul 8, 2019 •

edited

bond95 left a comment

sjd78 commented Sep 7, 2019

sjd78 commented Sep 23, 2019

sjd78 commented Nov 19, 2019

pnovotny commented Jan 6, 2020

sjd78 commented Mar 1, 2020

sjd78 commented Mar 1, 2020

sjd78 commented Mar 3, 2020

pnovotny commented Mar 10, 2020

pnovotny commented Mar 17, 2020

Fetch roles and permit at login and do entity permission to permit mapping on frontend #1020

Fetch roles and permit at login and do entity permission to permit mapping on frontend #1020

Conversation

sjd78 commented May 18, 2019 • edited

Part 1

Part 2

sjd78 commented May 18, 2019

michalskrivanek commented May 20, 2019

sjd78 commented Jun 6, 2019

bond95 left a comment

Choose a reason for hiding this comment

sjd78 commented Jul 8, 2019 • edited

bond95 left a comment

Choose a reason for hiding this comment

sjd78 commented Sep 7, 2019

sjd78 commented Sep 23, 2019

sjd78 commented Nov 19, 2019

pnovotny commented Jan 6, 2020

sjd78 commented Mar 1, 2020

sjd78 commented Mar 1, 2020

sjd78 commented Mar 3, 2020

pnovotny commented Mar 10, 2020

pnovotny commented Mar 17, 2020

sjd78 commented May 18, 2019 •

edited

sjd78 commented Jul 8, 2019 •

edited