Skip to content

Commit 25902f0

Browse files
shahzadloneshahzadlone
committed
PR(MAIN): Gate & Test - Collection Doc Operations
1 parent 4d2835d commit 25902f0

14 files changed

Lines changed: 913 additions & 0 deletions

‎acp/types/types.go‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,9 @@ const (
9797
NodeIndexListPerm
9898
NodeIndexCreatePerm
9999
NodeIndexDropPerm
100+
NodeDocReadPerm
101+
NodeDocUpdatePerm
102+
NodeDocDeletePerm
100103
NodeGetIdentityPerm
101104
NodeVerifySignaturePerm
102105
)
@@ -128,6 +131,9 @@ var RequiredResourcePermissionsForNode = []string{
128131
"index-list",
129132
"index-create",
130133
"index-drop",
134+
"doc-read",
135+
"doc-update",
136+
"doc-delete",
131137
"node-get-identity",
132138
"verify-signature",
133139
}
@@ -192,6 +198,12 @@ resources:
192198
expr: owner + admin
193199
index-drop:
194200
expr: owner + admin
201+
doc-read:
202+
expr: owner + admin
203+
doc-update:
204+
expr: owner + admin
205+
doc-delete:
206+
expr: owner + admin
195207
node-get-identity:
196208
expr: owner + admin
197209
verify-signature:

‎internal/db/collection.go‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -253,6 +253,10 @@ func (c *collection) GetAllDocIDs(
253253
ctx, span := tracer.Start(ctx)
254254
defer span.End()
255255

256+
if err := c.db.checkNodeAccess(ctx, acpTypes.NodeDocReadPerm); err != nil {
257+
return nil, err
258+
}
259+
256260
ctx, _, err := ensureContextTxn(ctx, c.db, true)
257261
if err != nil {
258262
return nil, err
@@ -388,6 +392,10 @@ func (c *collection) Create(
388392
ctx, span := tracer.Start(ctx)
389393
defer span.End()
390394

395+
if err := c.db.checkNodeAccess(ctx, acpTypes.NodeDocUpdatePerm); err != nil {
396+
return err
397+
}
398+
391399
ctx, txn, err := ensureContextTxn(ctx, c.db, false)
392400
if err != nil {
393401
return err
@@ -412,6 +420,10 @@ func (c *collection) CreateMany(
412420
ctx, span := tracer.Start(ctx)
413421
defer span.End()
414422

423+
if err := c.db.checkNodeAccess(ctx, acpTypes.NodeDocUpdatePerm); err != nil {
424+
return err
425+
}
426+
415427
ctx, txn, err := ensureContextTxn(ctx, c.db, false)
416428
if err != nil {
417429
return err
@@ -532,6 +544,10 @@ func (c *collection) Update(
532544
ctx, span := tracer.Start(ctx)
533545
defer span.End()
534546

547+
if err := c.db.checkNodeAccess(ctx, acpTypes.NodeDocUpdatePerm); err != nil {
548+
return err
549+
}
550+
535551
ctx, txn, err := ensureContextTxn(ctx, c.db, false)
536552
if err != nil {
537553
return err
@@ -606,6 +622,10 @@ func (c *collection) Save(
606622
ctx, span := tracer.Start(ctx)
607623
defer span.End()
608624

625+
if err := c.db.checkNodeAccess(ctx, acpTypes.NodeDocUpdatePerm); err != nil {
626+
return err
627+
}
628+
609629
ctx, txn, err := ensureContextTxn(ctx, c.db, false)
610630
if err != nil {
611631
return err
@@ -951,6 +971,10 @@ func (c *collection) Delete(
951971
ctx, span := tracer.Start(ctx)
952972
defer span.End()
953973

974+
if err := c.db.checkNodeAccess(ctx, acpTypes.NodeDocDeletePerm); err != nil {
975+
return false, err
976+
}
977+
954978
ctx, txn, err := ensureContextTxn(ctx, c.db, false)
955979
if err != nil {
956980
return false, err
@@ -982,6 +1006,10 @@ func (c *collection) Exists(
9821006
ctx, span := tracer.Start(ctx)
9831007
defer span.End()
9841008

1009+
if err := c.db.checkNodeAccess(ctx, acpTypes.NodeDocReadPerm); err != nil {
1010+
return false, err
1011+
}
1012+
9851013
ctx, txn, err := ensureContextTxn(ctx, c.db, false)
9861014
if err != nil {
9871015
return false, err

‎internal/db/collection_delete.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,10 @@ func (c *collection) DeleteWithFilter(
3333
ctx, span := tracer.Start(ctx)
3434
defer span.End()
3535

36+
if err := c.db.checkNodeAccess(ctx, acpTypes.NodeDocDeletePerm); err != nil {
37+
return nil, err
38+
}
39+
3640
ctx, txn, err := ensureContextTxn(ctx, c.db, false)
3741
if err != nil {
3842
return nil, err

‎internal/db/collection_get.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ import (
1616
"github.com/sourcenetwork/immutable"
1717

1818
"github.com/sourcenetwork/defradb/acp/identity"
19+
acpTypes "github.com/sourcenetwork/defradb/acp/types"
1920
"github.com/sourcenetwork/defradb/client"
2021
"github.com/sourcenetwork/defradb/internal/datastore"
2122
"github.com/sourcenetwork/defradb/internal/db/fetcher"
@@ -31,6 +32,10 @@ func (c *collection) Get(
3132
ctx, span := tracer.Start(ctx)
3233
defer span.End()
3334

35+
if err := c.db.checkNodeAccess(ctx, acpTypes.NodeDocReadPerm); err != nil {
36+
return nil, err
37+
}
38+
3439
// create txn
3540
ctx, txn, err := ensureContextTxn(ctx, c.db, true)
3641
if err != nil {

‎internal/db/collection_update.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ import (
1717
"github.com/valyala/fastjson"
1818

1919
"github.com/sourcenetwork/defradb/acp/identity"
20+
acpTypes "github.com/sourcenetwork/defradb/acp/types"
2021
"github.com/sourcenetwork/defradb/client"
2122
"github.com/sourcenetwork/defradb/client/request"
2223
"github.com/sourcenetwork/defradb/internal/planner"
@@ -33,6 +34,10 @@ func (c *collection) UpdateWithFilter(
3334
ctx, span := tracer.Start(ctx)
3435
defer span.End()
3536

37+
if err := c.db.checkNodeAccess(ctx, acpTypes.NodeDocUpdatePerm); err != nil {
38+
return nil, err
39+
}
40+
3641
ctx, txn, err := ensureContextTxn(ctx, c.db, false)
3742
if err != nil {
3843
return nil, err

‎tests/integration/acp/nac/doc_create_test.go‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
// Copyright 2025 Democratized Data Foundation
2+
//
3+
// Use of this software is governed by the Business Source License
4+
// included in the file licenses/BSL.txt.
5+
//
6+
// As of the Change Date specified in that file, in accordance with
7+
// the Business Source License, use of this software will be governed
8+
// by the Apache License, Version 2.0, included in the file
9+
// licenses/APL.txt.
10+
11+
package test_acp_aac
12+
13+
import (
14+
"testing"
15+
16+
testUtils "github.com/sourcenetwork/defradb/tests/integration"
17+
)
18+
19+
func TestAAC_GatesDocCreate_AllowIfAuthorizedElseError(t *testing.T) {
20+
test := testUtils.TestCase{
21+
Description: "admin acp correctly gates doc create operation, allow if authorized, otherwise error",
22+
Actions: []any{
23+
// Starting with ACC, so only authorized user(s) can perform operations from here on out.
24+
testUtils.Close{},
25+
testUtils.Start{
26+
Identity: testUtils.ClientIdentity(1),
27+
EnableNAC: true,
28+
},
29+
// Note: Doing setup steps after starting with aac enabled, otherwise the in-memory tests
30+
// will loose setup state when the restart happens (i.e. the restart that started aac).
31+
testUtils.SchemaUpdate{
32+
Identity: testUtils.ClientIdentity(1),
33+
Schema: `type User { name: String }`,
34+
},
35+
// Note: Setup is now done, the test code that follows is what we want to assert.
36+
37+
// We haven't authorized non-identities. So, this should error.
38+
testUtils.CreateDoc{
39+
Identity: testUtils.NoIdentity(),
40+
CollectionID: 0,
41+
Doc: `{ "name": "Shahzad" }`,
42+
ExpectedError: "not authorized to perform operation",
43+
},
44+
testUtils.Request{ // Should not be created
45+
Identity: testUtils.ClientIdentity(1),
46+
Request: `query{ User { name } }`,
47+
Results: map[string]any{"User": []map[string]any{}},
48+
},
49+
50+
// Wrong user/identity will also not be authorized.
51+
testUtils.CreateDoc{
52+
Identity: testUtils.ClientIdentity(2),
53+
CollectionID: 0,
54+
Doc: `{ "name": "Shahzad" }`,
55+
ExpectedError: "not authorized to perform operation",
56+
},
57+
testUtils.Request{ // Should not be created
58+
Identity: testUtils.ClientIdentity(1),
59+
Request: `query{ User { name } }`,
60+
Results: map[string]any{"User": []map[string]any{}},
61+
},
62+
63+
// This should work as the identity is authorized.
64+
testUtils.CreateDoc{
65+
Identity: testUtils.ClientIdentity(1),
66+
CollectionID: 0,
67+
Doc: `{ "name": "Shahzad" }`,
68+
},
69+
testUtils.Request{ // Should now be created
70+
Identity: testUtils.ClientIdentity(1),
71+
Request: `query{ User { name } }`,
72+
Results: map[string]any{
73+
"User": []map[string]any{{"name": "Shahzad"}},
74+
},
75+
},
76+
},
77+
}
78+
79+
testUtils.ExecuteTestCase(t, test)
80+
}

‎tests/integration/acp/nac/doc_delete_test.go‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
// Copyright 2025 Democratized Data Foundation
2+
//
3+
// Use of this software is governed by the Business Source License
4+
// included in the file licenses/BSL.txt.
5+
//
6+
// As of the Change Date specified in that file, in accordance with
7+
// the Business Source License, use of this software will be governed
8+
// by the Apache License, Version 2.0, included in the file
9+
// licenses/APL.txt.
10+
11+
package test_acp_aac
12+
13+
import (
14+
"testing"
15+
16+
testUtils "github.com/sourcenetwork/defradb/tests/integration"
17+
)
18+
19+
func TestAAC_GatesDocDelete_AllowIfAuthorizedElseError(t *testing.T) {
20+
test := testUtils.TestCase{
21+
Description: "admin acp correctly gates doc delete operation, allow if authorized, otherwise error",
22+
Actions: []any{
23+
// Starting with ACC, so only authorized user(s) can perform operations from here on out.
24+
testUtils.Close{},
25+
testUtils.Start{
26+
Identity: testUtils.ClientIdentity(1),
27+
EnableNAC: true,
28+
},
29+
// Note: Doing setup steps after starting with aac enabled, otherwise the in-memory tests
30+
// will loose setup state when the restart happens (i.e. the restart that started aac).
31+
testUtils.SchemaUpdate{
32+
Identity: testUtils.ClientIdentity(1),
33+
Schema: `
34+
type User {
35+
name: String
36+
age: Int
37+
}`,
38+
},
39+
testUtils.CreateDoc{
40+
Identity: testUtils.ClientIdentity(1),
41+
CollectionID: 0,
42+
Doc: `{
43+
"name": "Shahzad",
44+
"age": 48
45+
}`,
46+
},
47+
// Note: Setup is now done, the test code that follows is what we want to assert.
48+
49+
// We haven't authorized non-identities. So, this should error.
50+
testUtils.DeleteDoc{
51+
Identity: testUtils.NoIdentity(),
52+
CollectionID: 0,
53+
DocID: 0,
54+
ExpectedError: "not authorized to perform operation",
55+
},
56+
testUtils.Request{ // Should not be deleted.
57+
Identity: testUtils.ClientIdentity(1),
58+
Request: `query{ User { name } }`,
59+
Results: map[string]any{
60+
"User": []map[string]any{{"name": "Shahzad"}},
61+
},
62+
},
63+
64+
// Wrong user/identity will also not be authorized.
65+
testUtils.DeleteDoc{
66+
Identity: testUtils.ClientIdentity(2),
67+
CollectionID: 0,
68+
DocID: 0,
69+
ExpectedError: "not authorized to perform operation",
70+
},
71+
testUtils.Request{ // Should not be deleted
72+
Identity: testUtils.ClientIdentity(1),
73+
Request: `query{ User { name } }`,
74+
Results: map[string]any{
75+
"User": []map[string]any{{"name": "Shahzad"}},
76+
},
77+
},
78+
79+
// This should work as the identity is authorized.
80+
testUtils.DeleteDoc{
81+
Identity: testUtils.ClientIdentity(1),
82+
CollectionID: 0,
83+
DocID: 0,
84+
},
85+
testUtils.Request{ // Should now be deleted
86+
Identity: testUtils.ClientIdentity(1),
87+
Request: `query{ User { name } }`,
88+
Results: map[string]any{
89+
"User": []map[string]any{},
90+
},
91+
},
92+
},
93+
}
94+
95+
testUtils.ExecuteTestCase(t, test)
96+
}

‎tests/integration/acp/nac/doc_read_test.go‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
// Copyright 2025 Democratized Data Foundation
2+
//
3+
// Use of this software is governed by the Business Source License
4+
// included in the file licenses/BSL.txt.
5+
//
6+
// As of the Change Date specified in that file, in accordance with
7+
// the Business Source License, use of this software will be governed
8+
// by the Apache License, Version 2.0, included in the file
9+
// licenses/APL.txt.
10+
11+
package test_acp_aac
12+
13+
import (
14+
"testing"
15+
16+
testUtils "github.com/sourcenetwork/defradb/tests/integration"
17+
)
18+
19+
func TestAAC_GatesDocRead_AllowIfAuthorizedElseError(t *testing.T) {
20+
test := testUtils.TestCase{
21+
Description: "admin acp correctly gates doc read operation, allow if authorized, otherwise error",
22+
Actions: []any{
23+
// Starting with ACC, so only authorized user(s) can perform operations from here on out.
24+
testUtils.Close{},
25+
testUtils.Start{
26+
Identity: testUtils.ClientIdentity(1),
27+
EnableNAC: true,
28+
},
29+
// Note: Doing setup steps after starting with aac enabled, otherwise the in-memory tests
30+
// will loose setup state when the restart happens (i.e. the restart that started aac).
31+
testUtils.SchemaUpdate{
32+
Identity: testUtils.ClientIdentity(1),
33+
Schema: `type User { name: String }`,
34+
},
35+
testUtils.CreateDoc{
36+
Identity: testUtils.ClientIdentity(1),
37+
CollectionID: 0,
38+
Doc: `{ "name": "Shahzad" }`,
39+
},
40+
// Note: Setup is now done, the test code that follows is what we want to assert.
41+
42+
// This should work as the identity is authorized.
43+
testUtils.Request{
44+
Identity: testUtils.ClientIdentity(1),
45+
Request: `query{ User { name } }`,
46+
Results: map[string]any{
47+
"User": []map[string]any{{"name": "Shahzad"}},
48+
},
49+
},
50+
},
51+
}
52+
53+
testUtils.ExecuteTestCase(t, test)
54+
}

0 commit comments

Comments
 (0)