PR(MAIN): Gate & Test - Schema Patch

Author: shahzadlone

acp/types/types.go

@@ -89,6 +89,7 @@ const (
 	AdminAACRelationAddPerm
 	AdminAACRelationDeletePerm
 	AdminSchemaAddPerm
+	AdminSchemaPatchPerm
 )
 
 // List of all valid resource interface permissions for admin access control, the order of
@@ -110,6 +111,7 @@ var RequiredResourcePermissionsForAdmin = []string{
 	"aac-relation-add",
 	"aac-relation-delete",
 	"schema-add",
+	"schema-patch",
 }
 
 const InternalAdminACPObjectToGate = "NodeObject"
@@ -156,6 +158,8 @@ resources:
         expr: owner + admin
       schema-add:
         expr: owner + admin
+      schema-patch:
+        expr: owner + admin
 
     relations:
       owner:

internal/db/store.go

@@ -185,6 +185,11 @@ func (db *DB) PatchSchema(
 	ctx, span := tracer.Start(ctx)
 	defer span.End()
 
+	err := db.checkAdminAccess(ctx, acpTypes.AdminSchemaPatchPerm)
+	if err != nil {
+		return err
+	}
+
 	ctx, txn, err := ensureContextTxn(ctx, db, false)
 	if err != nil {
 		return err

tests/integration/acp/aac/schema_patch_test.go

@@ -0,0 +1,75 @@
+// Copyright 2025 Democratized Data Foundation
+//
+// Use of this software is governed by the Business Source License
+// included in the file licenses/BSL.txt.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0, included in the file
+// licenses/APL.txt.
+
+package test_acp_aac
+
+import (
+	"testing"
+
+	testUtils "github.com/sourcenetwork/defradb/tests/integration"
+	"github.com/sourcenetwork/immutable"
+)
+
+func TestAAC_GatesSchemaPatch_AllowIfAuthorizedElseError(t *testing.T) {
+	test := testUtils.TestCase{
+		Description: "admin acp correctly gates schema patch operation, allow if authorized, otherwise error",
+		Actions: []any{
+			// Setup that we can do before aac is enabled.
+			testUtils.SchemaUpdate{
+				Schema: `
+					type Users {}
+				`,
+			},
+
+			// Starting with ACC, so only authorized user(s) can perform operations.
+			testUtils.Close{},
+			testUtils.Start{
+				Identity:  testUtils.ClientIdentity(1),
+				EnableAAC: true,
+			},
+
+			// We haven't authorized non-identities. So, this should error.
+			testUtils.SchemaPatch{
+				Patch: `
+					[
+						{ "op": "add", "path": "/Users/Fields/-", "value": {"Name": "name", "Kind": "String"} }
+					]
+				`,
+				SetAsDefaultVersion: immutable.Some(false),
+				ExpectedError:       "not authorized to perform operation",
+			},
+
+			// Wrong user/identity will also not be authorized.
+			testUtils.SchemaPatch{
+				Identity: testUtils.ClientIdentity(2),
+				Patch: `
+					[
+						{ "op": "add", "path": "/Users/Fields/-", "value": {"Name": "name", "Kind": "String"} }
+					]
+				`,
+				SetAsDefaultVersion: immutable.Some(false),
+				ExpectedError:       "not authorized to perform operation",
+			},
+
+			// This should work as the identity is authorized.
+			testUtils.SchemaPatch{
+				Identity: testUtils.ClientIdentity(1),
+				Patch: `
+					[
+						{ "op": "add", "path": "/Users/Fields/-", "value": {"Name": "name", "Kind": "String"} }
+					]
+				`,
+				SetAsDefaultVersion: immutable.Some(false),
+			},
+		},
+	}
+
+	testUtils.ExecuteTestCase(t, test)
+}

tests/integration/test_case.go

@@ -234,6 +234,11 @@ type SchemaPatch struct {
 	// If a value is not provided the patch will be applied to all nodes.
 	NodeID immutable.Option[int]
 
+	// The identity of this request. Optional.
+	//
+	// If admin acp is enabled, identity will be used to check if this operation can be performed.
+	Identity immutable.Option[Identity]
+
 	Patch string
 
 	// If SetAsDefaultVersion has a value, and that value is false then the schema version

tests/integration/utils.go

@@ -1110,16 +1110,19 @@ func patchSchema(
 	s *state,
 	action SchemaPatch,
 ) {
-	_, nodes := getNodesWithIDs(action.NodeID, s.nodes)
-	for _, node := range nodes {
+	nodeIDs, nodes := getNodesWithIDs(action.NodeID, s.nodes)
+	for index, node := range nodes {
+		nodeID := nodeIDs[index]
 		var setAsDefaultVersion bool
 		if action.SetAsDefaultVersion.HasValue() {
 			setAsDefaultVersion = action.SetAsDefaultVersion.Value()
 		} else {
 			setAsDefaultVersion = true
 		}
 
+		s.ctx = getContextWithIdentity(s.ctx, s, action.Identity, nodeID)
 		err := node.PatchSchema(s.ctx, action.Patch, action.Lens, setAsDefaultVersion)
+		resetStateContext(s)
 		expectedErrorRaised := AssertError(s.t, s.testCase.Description, err, action.ExpectedError)
 
 		assertExpectedErrorRaised(s.t, s.testCase.Description, action.ExpectedError, expectedErrorRaised)