WIP - PR(AAC) messy implementation

Author: shahzadlone

acp/types/types.go

@@ -10,7 +10,11 @@
 
 package acp_types
 
-import "github.com/sourcenetwork/acp_core/pkg/types"
+import (
+	"strings"
+
+	"github.com/sourcenetwork/acp_core/pkg/types"
+)
 
 // RequiredRegistererRelationName is the required relation name that any registerer will have,
 // as the registerer is guaranteed to be the owner.
@@ -74,9 +78,14 @@ const (
 	AdminDACEnablePerm
 	AdminDACDisablePerm
 	AdminDACPurgePerm
-	AdminAACEnablePerm
+	AdminDACStatusPerm
+	AdminDACRelationAddPerm
+	AdminDACRelationDeletePerm
+	AdminDACPolicyAddPerm
+	AdminAACReEnablePerm
 	AdminAACDisablePerm
 	AdminAACPurgePerm
+	AdminAACStatusPerm
 	AdminAACRelationAddPerm
 	AdminAACRelationDeletePerm
 )
@@ -89,9 +98,14 @@ var RequiredResourcePermissionsForAdmin = []string{
 	"dac-enable",
 	"dac-disable",
 	"dac-purge",
-	"aac-enable",
+	"dac-status",
+	"dac-relation-add",
+	"dac-relation-delete",
+	"dac-policy-add",
+	"aac-re-enable",
 	"aac-disable",
 	"aac-purge",
+	"aac-status",
 	"aac-relation-add",
 	"aac-relation-delete",
 }
@@ -111,29 +125,39 @@ resources:
   node:
     permissions:
       dac-bypass:
-        expr: owner + super-admin
+        expr: owner + admin
       dac-enable:
-        expr: owner + super-admin
+        expr: owner + admin
       dac-disable:
-        expr: owner + super-admin
+        expr: owner + admin
       dac-purge:
-        expr: owner + super-admin
-      aac-enable:
-        expr: owner + super-admin
+        expr: owner + admin
+      dac-status:
+        expr: owner + admin
+      dac-relation-add:
+        expr: owner + admin
+      dac-relation-delete:
+        expr: owner + admin
+      dac-policy-add:
+        expr: owner + admin
+      aac-re-enable:
+        expr: owner + admin
       aac-disable:
-        expr: owner + super-admin
+        expr: owner + admin
       aac-purge:
-        expr: owner + super-admin
+        expr: owner + admin
+      aac-status:
+        expr: owner + admin
       aac-relation-add:
-        expr: owner + super-admin
+        expr: owner + admin
       aac-relation-delete:
-        expr: owner + super-admin
+        expr: owner + admin
 
     relations:
       owner:
         types:
           - actor
-      super-admin:
+      admin:
         types:
           - actor
 `
@@ -142,6 +166,14 @@ func (resourcePermission AdminResourcePermission) String() string {
 	return RequiredResourcePermissionsForAdmin[resourcePermission]
 }
 
+func (resourcePermission AdminResourcePermission) IsForAACOperation() bool {
+	permission := resourcePermission.String()
+	if len(permission) >= 3 && strings.EqualFold(permission[:3], "aac") {
+		return true
+	}
+	return false
+}
+
 // RegistrationResult is an enum type which indicates the result of a RegisterObject call to SourceHub / ACP Core
 type RegistrationResult int32
 

cli/acp.go

@@ -17,8 +17,8 @@ import (
 func MakeACPCommand() *cobra.Command {
 	var cmd = &cobra.Command{
 		Use:   "acp",
-		Short: "Interact with the access control system of a DefraDB node",
-		Long: `Interact with the access control system of a DefraDB node
+		Short: "Interact with the access control system(s) of a DefraDB node",
+		Long: `Interact with the access control system(s) of a DefraDB node
 
 Learn more about the DefraDB [ACP System](/acp/README.md)
 

cli/acp_aac.go

@@ -0,0 +1,40 @@
+// Copyright 2025 Democratized Data Foundation
+//
+// Use of this software is governed by the Business Source License
+// included in the file licenses/BSL.txt.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0, included in the file
+// licenses/APL.txt.
+
+package cli
+
+import (
+	"github.com/spf13/cobra"
+)
+
+func MakeAdminACPCommand() *cobra.Command {
+	var cmd = &cobra.Command{
+		Use:   "aac",
+		Short: "Interact with the admin access control system of a DefraDB node",
+		Long: `Interact with the admin access control system of a DefraDB node
+Note:
+- Clean state means, if the access control was never configured, or the entire state was purged.
+- The check the admin acp status use the 'client acp aac status' command
+- To re-enable temporarily disabled admin acp, use the 'client acp aac re-enable' command.
+- To temporarily disabled admin acp, use the 'client acp aac disable' command.
+- To start admin acp for the first time, use the start command with '--acp-enable true'.
+- Specifying an identity is a MUST, when starting first time (from a clean state).
+- To give admin access to other users use the 'client acp aac relationship add' command.
+- To revoke admin access from other users use the 'client acp aac relationship delete' command.
+- To reset/purge acp state into a clean state, use the 'client acp aac purge' command.
+- Purge command(s) require the user to be in dev-mode (Warning: all state will be lost).
+
+Learn more about the DefraDB [ACP System](/acp/README.md)
+
+		`,
+	}
+
+	return cmd
+}

cli/acp_aac_disable.go

@@ -0,0 +1,48 @@
+// Copyright 2025 Democratized Data Foundation
+//
+// Use of this software is governed by the Business Source License
+// included in the file licenses/BSL.txt.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0, included in the file
+// licenses/APL.txt.
+
+package cli
+
+import (
+	"github.com/spf13/cobra"
+
+	"github.com/sourcenetwork/defradb/client"
+)
+
+func MakeAdminACPDisableCommand() *cobra.Command {
+	var cmd = &cobra.Command{
+		Use:   "disable [-i --identity]",
+		Short: "Disable the admin access control",
+		Long: `Disable the admin access control
+
+Example:
+  defradb client acp aac disable -i 028d53f37a19afb9a0dbc5b4be30c65731479ee8cfa0c9bc8f8bf198cc3c075f
+
+Note:
+- This command will disable an admin acp system that is currently enabled.
+- If admin acp is already disabled, then it will return an error.
+- If admin acp is in a clean/non-configured state, then it will return an error.
+
+For quick help: 'defradb client acp aac --help'
+
+Learn more about the DefraDB [ACP System](/acp/README.md)
+
+`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			db := mustGetContextDB(cmd)
+			if err := db.DisableAdminACP(cmd.Context()); err != nil {
+				return err
+			}
+
+			return writeJSON(cmd, client.SuccessResponse{Success: true})
+		},
+	}
+	return cmd
+}

cli/acp_aac_re-enable.go

@@ -0,0 +1,48 @@
+// Copyright 2025 Democratized Data Foundation
+//
+// Use of this software is governed by the Business Source License
+// included in the file licenses/BSL.txt.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0, included in the file
+// licenses/APL.txt.
+
+package cli
+
+import (
+	"github.com/spf13/cobra"
+
+	"github.com/sourcenetwork/defradb/client"
+)
+
+func MakeAdminACPReEnableCommand() *cobra.Command {
+	var cmd = &cobra.Command{
+		Use:   "re-enable [-i --identity]",
+		Short: "Re-enable the admin access control",
+		Long: `Re-enable the admin access control
+
+Example:
+  defradb client acp aac re-enable -i 028d53f37a19afb9a0dbc5b4be30c65731479ee8cfa0c9bc8f8bf198cc3c075f
+
+Note:
+- This command will re-enable an already configured admin acp system that is temporarily disabled.
+- If admin acp is already enabled, then it will return an error.
+- If admin acp is in a clean/non-configured state, then it will return an error.
+
+For quick help: 'defradb client acp aac --help'
+
+Learn more about the DefraDB [ACP System](/acp/README.md)
+
+`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			db := mustGetContextDB(cmd)
+			if err := db.ReEnableAdminACP(cmd.Context()); err != nil {
+				return err
+			}
+
+			return writeJSON(cmd, client.SuccessResponse{Success: true})
+		},
+	}
+	return cmd
+}

cli/acp_aac_status.go

@@ -0,0 +1,46 @@
+// Copyright 2025 Democratized Data Foundation
+//
+// Use of this software is governed by the Business Source License
+// included in the file licenses/BSL.txt.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0, included in the file
+// licenses/APL.txt.
+
+package cli
+
+import (
+	"github.com/spf13/cobra"
+)
+
+func MakeAdminACPStatusCommand() *cobra.Command {
+	var cmd = &cobra.Command{
+		Use:   "status [-i --identity]",
+		Short: "Check the admin access control status",
+		Long: `Check the admin access control status
+
+Example:
+  defradb client acp aac status -i 028d53f37a19afb9a0dbc5b4be30c65731479ee8cfa0c9bc8f8bf198cc3c075f
+
+Note:
+- If Admin ACP is in clean state (not configured) the status has [IsConfigured] == false.
+- If Admin ACP is temporarily disabled, then [IsConfigured] == true and [IsEnabled] == false.
+- If Admin ACP is enabled then [IsEnabled] == true.
+
+For quick help: 'defradb client acp aac --help'
+
+Learn more about the DefraDB [ACP System](/acp/README.md)
+
+`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			db := mustGetContextDB(cmd)
+			status, err := db.AdminACPStatus(cmd.Context())
+			if err != nil {
+				return err
+			}
+			return writeJSON(cmd, status)
+		},
+	}
+	return cmd
+}

cli/cli.go

@@ -61,6 +61,13 @@ func NewDefraCommand() *cobra.Command {
 		MakeSchemaDescribeCommand(),
 	)
 
+	aac := MakeAdminACPCommand()
+	aac.AddCommand(
+		MakeAdminACPReEnableCommand(),
+		MakeAdminACPDisableCommand(),
+		MakeAdminACPStatusCommand(),
+	)
+
 	acp_dac_policy := MakeDocumentACPPolicyCommand()
 	acp_dac_policy.AddCommand(
 		MakeDocumentACPPolicyAddCommand(),
@@ -80,6 +87,7 @@ func NewDefraCommand() *cobra.Command {
 
 	acp := MakeACPCommand()
 	acp.AddCommand(
+		aac,
 		dac,
 	)
 

cli/config.go

@@ -67,6 +67,7 @@ var configFlags = map[string]string{
 	"keyring-backend":            "keyring.backend",
 	"keyring-path":               "keyring.path",
 	"no-keyring":                 "keyring.disabled",
+	"aac-enable":                 "acp.aac.enable",
 	"dac-type":                   "acp.dac.type",
 	"source-hub-address":         "acp.dac.sourceHub.address",
 	"development":                "development",
@@ -104,6 +105,7 @@ var configDefaults = map[string]any{
 	"telemetry.disabled":                false,
 	"datastore.nosigning":               false,
 	"datastore.defaultkeytype":          "secp256k1",
+	"acp.aac.enable":                    false,
 	"acp.dac.type":                      "none",
 	"replicator.retryintervals":         []int{30, 60, 120, 240, 480, 960, 1920},
 }

cli/server_dump.go

@@ -37,7 +37,13 @@ func MakeServerDumpCmd() *cobra.Command {
 			if err != nil {
 				return err
 			}
-			db, err := db.NewDB(cmd.Context(), rootstore, dac.NoDocumentACP, nil)
+			db, err := db.NewDB(
+				cmd.Context(),
+				rootstore,
+				db.NewCleanAdminInfo(),
+				dac.NoDocumentACP,
+				nil,
+			)
 			if err != nil {
 				return errors.Wrap("failed to initialize database", err)
 			}