PR(MAIN): Gate & Test - Patch Collection

Author: shahzadlone

acp/types/types.go

@@ -90,6 +90,7 @@ const (
 	AdminAACRelationDeletePerm
 	AdminSchemaAddPerm
 	AdminSchemaPatchPerm
+	AdminPatchCollectionPerm
 )
 
 // List of all valid resource interface permissions for admin access control, the order of
@@ -112,6 +113,7 @@ var RequiredResourcePermissionsForAdmin = []string{
 	"aac-relation-delete",
 	"schema-add",
 	"schema-patch",
+	"patch-collection",
 }
 
 const InternalAdminACPObjectToGate = "NodeObject"
@@ -160,6 +162,8 @@ resources:
         expr: owner + admin
       schema-patch:
         expr: owner + admin
+      patch-collection:
+        expr: owner + admin
 
     relations:
       owner:

internal/db/store.go

@@ -211,6 +211,11 @@ func (db *DB) PatchCollection(
 	ctx, span := tracer.Start(ctx)
 	defer span.End()
 
+	err := db.checkAdminAccess(ctx, acpTypes.AdminPatchCollectionPerm)
+	if err != nil {
+		return err
+	}
+
 	ctx, txn, err := ensureContextTxn(ctx, db, false)
 	if err != nil {
 		return err

tests/integration/acp/aac/patch_collection_test.go

@@ -0,0 +1,92 @@
+// Copyright 2025 Democratized Data Foundation
+//
+// Use of this software is governed by the Business Source License
+// included in the file licenses/BSL.txt.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0, included in the file
+// licenses/APL.txt.
+
+package test_acp_aac
+
+import (
+	"testing"
+
+	testUtils "github.com/sourcenetwork/defradb/tests/integration"
+	"github.com/sourcenetwork/immutable"
+)
+
+func TestAAC_GatesPatchCollection_AllowIfAuthorizedElseError(t *testing.T) {
+	test := testUtils.TestCase{
+		Description: "admin acp correctly gates patch collection operation, allow if authorized, otherwise error",
+		Actions: []any{
+			// Setup that we can do before aac is enabled.
+			testUtils.SchemaUpdate{
+				Schema: `
+					type Users {}
+				`,
+			},
+			testUtils.SchemaPatch{
+				Patch: `
+					[
+						{ "op": "add", "path": "/Users/Fields/-", "value": {"Name": "name", "Kind": "String"} }
+					]
+				`,
+				SetAsDefaultVersion: immutable.Some(false),
+			},
+
+			// Starting with ACC, so only authorized user(s) can perform operations.
+			testUtils.Close{},
+			testUtils.Start{
+				Identity:  testUtils.ClientIdentity(1),
+				EnableAAC: true,
+			},
+
+			// We haven't authorized non-identities. So, this should error.
+			testUtils.PatchCollection{
+				Patch: `
+					[
+						{
+							"op": "copy",
+							"from": "/bafkreia2jn5ecrhtvy4fravk6pm3wqiny46m7mqymvjkgat7xiqupgqoai/Name",
+							"path": "/bafkreialnju2rez4t3quvpobf3463eai3lo64vdrdhdmunz7yy7sv3f5ce/Name"
+						}
+					]
+				`,
+				ExpectedError: "not authorized to perform operation",
+			},
+
+			// Wrong user/identity will also not be authorized.
+			testUtils.PatchCollection{
+				Identity: testUtils.ClientIdentity(2),
+				Patch: `
+					[
+						{
+							"op": "copy",
+							"from": "/bafkreia2jn5ecrhtvy4fravk6pm3wqiny46m7mqymvjkgat7xiqupgqoai/Name",
+							"path": "/bafkreialnju2rez4t3quvpobf3463eai3lo64vdrdhdmunz7yy7sv3f5ce/Name"
+						}
+					]
+				`,
+				ExpectedError: "not authorized to perform operation",
+			},
+
+			// This should work as the identity is authorized.
+			testUtils.PatchCollection{
+				Identity: testUtils.ClientIdentity(1),
+				Patch: `
+					[
+						{
+							"op": "copy",
+							"from": "/bafkreia2jn5ecrhtvy4fravk6pm3wqiny46m7mqymvjkgat7xiqupgqoai/Name",
+							"path": "/bafkreialnju2rez4t3quvpobf3463eai3lo64vdrdhdmunz7yy7sv3f5ce/Name"
+						}
+					]
+				`,
+			},
+		},
+	}
+
+	testUtils.ExecuteTestCase(t, test)
+}

tests/integration/test_case.go

@@ -256,6 +256,11 @@ type PatchCollection struct {
 	// If a value is not provided the patch will be applied to all nodes.
 	NodeID immutable.Option[int]
 
+	// The identity of this request. Optional.
+	//
+	// If admin acp is enabled, identity will be used to check if this operation can be performed.
+	Identity immutable.Option[Identity]
+
 	// The Patch to apply to the collection version.
 	Patch string
 

tests/integration/utils.go

@@ -1136,9 +1136,12 @@ func patchCollection(
 	s *state,
 	action PatchCollection,
 ) {
-	_, nodes := getNodesWithIDs(action.NodeID, s.nodes)
-	for _, node := range nodes {
+	nodeIDs, nodes := getNodesWithIDs(action.NodeID, s.nodes)
+	for index, node := range nodes {
+		nodeID := nodeIDs[index]
+		s.ctx = getContextWithIdentity(s.ctx, s, action.Identity, nodeID)
 		err := node.PatchCollection(s.ctx, action.Patch)
+		resetStateContext(s)
 		expectedErrorRaised := AssertError(s.t, s.testCase.Description, err, action.ExpectedError)
 
 		assertExpectedErrorRaised(s.t, s.testCase.Description, action.ExpectedError, expectedErrorRaised)