PR(MAIN): Gate & Test - Set Active Schema Version

Author: shahzadlone

acp/types/types.go

@@ -90,6 +90,7 @@ const (
 	AdminAACRelationDeletePerm
 	AdminSchemaGetPerm
 	AdminSchemaGetByVersionPerm
+	AdminSchemaSetActiveVersionPerm
 	AdminSchemaAddPerm
 	AdminSchemaPatchPerm
 	AdminPatchCollectionPerm
@@ -115,6 +116,7 @@ var RequiredResourcePermissionsForAdmin = []string{
 	"aac-relation-delete",
 	"schema-get",
 	"schema-get-by-version",
+	"schema-set-active-version",
 	"schema-add",
 	"schema-patch",
 	"patch-collection",
@@ -165,6 +167,8 @@ resources:
       schema-get:
         expr: owner + admin
       schema-get-by-version:
+        expr: owner + admin
+	  schema-set-active-version:
         expr: owner + admin
       schema-add:
         expr: owner + admin

internal/db/store.go

@@ -244,6 +244,11 @@ func (db *DB) SetActiveSchemaVersion(ctx context.Context, schemaVersionID string
 	ctx, span := tracer.Start(ctx)
 	defer span.End()
 
+	err := db.checkAdminAccess(ctx, acpTypes.AdminSchemaSetActiveVersionPerm)
+	if err != nil {
+		return err
+	}
+
 	ctx, txn, err := ensureContextTxn(ctx, db, false)
 	if err != nil {
 		return err

tests/integration/acp/aac/schema_set_active_version_test.go

@@ -0,0 +1,70 @@
+// Copyright 2025 Democratized Data Foundation
+//
+// Use of this software is governed by the Business Source License
+// included in the file licenses/BSL.txt.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0, included in the file
+// licenses/APL.txt.
+
+package test_acp_aac
+
+import (
+	"testing"
+
+	testUtils "github.com/sourcenetwork/defradb/tests/integration"
+	"github.com/sourcenetwork/immutable"
+)
+
+func TestAAC_GatesSchemaSetActiveVersion_AllowIfAuthorizedElseError(t *testing.T) {
+	test := testUtils.TestCase{
+		Description: "admin acp correctly gates set active schema version operation, allow if authorized, otherwise error",
+		Actions: []any{
+			// Setup that we can do before aac is enabled.
+			testUtils.SchemaUpdate{
+				Schema: `
+					type Users {
+						name: String
+					}
+				`,
+			},
+			testUtils.SchemaPatch{
+				Patch: `
+					[
+						{ "op": "add", "path": "/Users/Fields/-", "value": {"Name": "email", "Kind": 11} }
+					]
+				`,
+				SetAsDefaultVersion: immutable.Some(false),
+			},
+
+			// Starting with ACC, so only authorized user(s) can perform operations.
+			testUtils.Close{},
+			testUtils.Start{
+				Identity:  testUtils.ClientIdentity(1),
+				EnableAAC: true,
+			},
+
+			// We haven't authorized non-identities. So, this should error.
+			testUtils.SetActiveSchemaVersion{
+				SchemaVersionID: "bafkreidt4i22v4bzga3aezlcxsrfbvuhzcbqo5bnfe2x2dgkpz3eds2afe",
+				ExpectedError:   "not authorized to perform operation",
+			},
+
+			// Wrong user/identity will also not be authorized.
+			testUtils.SetActiveSchemaVersion{
+				Identity:        testUtils.ClientIdentity(2),
+				SchemaVersionID: "bafkreidt4i22v4bzga3aezlcxsrfbvuhzcbqo5bnfe2x2dgkpz3eds2afe",
+				ExpectedError:   "not authorized to perform operation",
+			},
+
+			// This should work as the identity is authorized.
+			testUtils.SetActiveSchemaVersion{
+				Identity:        testUtils.ClientIdentity(1),
+				SchemaVersionID: "bafkreidt4i22v4bzga3aezlcxsrfbvuhzcbqo5bnfe2x2dgkpz3eds2afe",
+			},
+		},
+	}
+
+	testUtils.ExecuteTestCase(t, test)
+}

tests/integration/test_case.go

@@ -333,8 +333,14 @@ type SetActiveSchemaVersion struct {
 	// If a value is not provided the default will be set on all nodes.
 	NodeID immutable.Option[int]
 
+	// The identity of this request. Optional.
+	//
+	// If admin acp is enabled, identity will be used to check if this operation can be performed.
+	Identity immutable.Option[Identity]
+
 	SchemaVersionID string
-	ExpectedError   string
+
+	ExpectedError string
 }
 
 // CreateView is an action that will create a new View.

tests/integration/utils.go

@@ -1213,9 +1213,12 @@ func setActiveSchemaVersion(
 	s *state,
 	action SetActiveSchemaVersion,
 ) {
-	_, nodes := getNodesWithIDs(action.NodeID, s.nodes)
-	for _, node := range nodes {
+	nodeIDs, nodes := getNodesWithIDs(action.NodeID, s.nodes)
+	for index, node := range nodes {
+		nodeID := nodeIDs[index]
+		s.ctx = getContextWithIdentity(s.ctx, s, action.Identity, nodeID)
 		err := node.SetActiveSchemaVersion(s.ctx, action.SchemaVersionID)
+		resetStateContext(s)
 		expectedErrorRaised := AssertError(s.t, s.testCase.Description, err, action.ExpectedError)
 
 		assertExpectedErrorRaised(s.t, s.testCase.Description, action.ExpectedError, expectedErrorRaised)