PR(AAC): Gate Schema Add

Author: shahzadlone

acp/types/types.go

@@ -88,6 +88,7 @@ const (
 	AdminAACStatusPerm
 	AdminAACRelationAddPerm
 	AdminAACRelationDeletePerm
+	AdminSchemaAddPerm
 )
 
 // List of all valid resource interface permissions for admin access control, the order of
@@ -108,6 +109,7 @@ var RequiredResourcePermissionsForAdmin = []string{
 	"aac-status",
 	"aac-relation-add",
 	"aac-relation-delete",
+	"schema-add",
 }
 
 const InternalAdminACPObjectToGate = "NodeObject"
@@ -152,6 +154,8 @@ resources:
         expr: owner + admin
       aac-relation-delete:
         expr: owner + admin
+      schema-add:
+        expr: owner + admin
 
     relations:
       owner:

internal/db/store.go

@@ -17,6 +17,7 @@ import (
 
 	"github.com/sourcenetwork/immutable"
 
+	acpTypes "github.com/sourcenetwork/defradb/acp/types"
 	"github.com/sourcenetwork/defradb/client"
 )
 
@@ -142,6 +143,11 @@ func (db *DB) AddSchema(ctx context.Context, schemaString string) ([]client.Coll
 	ctx, span := tracer.Start(ctx)
 	defer span.End()
 
+	err := db.checkAdminAccess(ctx, acpTypes.AdminSchemaAddPerm)
+	if err != nil {
+		return nil, err
+	}
+
 	ctx, txn, err := ensureContextTxn(ctx, db, false)
 	if err != nil {
 		return nil, err