Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(acl): allow access to all the predicates using wildcard #7991

Merged
merged 2 commits into from
Aug 19, 2021

Conversation

NamanJain8
Copy link
Contributor

@NamanJain8 NamanJain8 commented Aug 18, 2021

There are usecases that need read/write/modify permissions over all the predicates of the namespace. It is quite tedious to manage the permissions every time a new predicate is created.
This PR adds a feature to allow a group, access to all the predicates in the namespace using wildcard dgraph.all.

This example provides to dev group, read+write access to all the predicates

mutation {
  updateGroup(
    input: {
      filter: { name: { eq: "dev" } }
      set: { rules: [{ predicate: "dgraph.all", permission: 6 }] }
    }
  ) {
    group {
      name
      rules {
        permission
        predicate
      }
    }
  }
}

NOTE: The permission to a predicate for a group (say dev) is a union of permissions from dgraph.all and the permissions to specific predicate (say name). So suppose dgraph.all is given READ permission, while predicate name is given WRITE permission. Then the group will have both READ and WRITE permission.


This change is Reviewable

@NamanJain8 NamanJain8 merged commit 3504044 into master Aug 19, 2021
@NamanJain8 NamanJain8 deleted the naman/acl_all_preds branch August 19, 2021 10:25
NamanJain8 added a commit that referenced this pull request Aug 19, 2021
There are usecases that need read/write/modify permissions over all the predicates of the namespace. It is quite tedious to manage the permissions every time a new predicate is created.
This PR adds a feature to allow a group, access to all the predicates in the namespace using wildcard dgraph.all.

This example provides to dev group, read+write access to all the predicates

mutation {
  updateGroup(
    input: {
      filter: { name: { eq: "dev" } }
      set: { rules: [{ predicate: "dgraph.all", permission: 6 }] }
    }
  ) {
    group {
      name
      rules {
        permission
        predicate
      }
    }
  }
}

NOTE: The permission to a predicate for a group (say dev) is a union of permissions from dgraph.all and the permissions to specific predicate (say name). So suppose dgraph.all is given READ permission, while predicate name is given WRITE permission. Then the group will have both READ and WRITE permission.
(cherry picked from commit 3504044)
NamanJain8 added a commit that referenced this pull request Aug 19, 2021
There are usecases that need read/write/modify permissions over all the predicates of the namespace. It is quite tedious to manage the permissions every time a new predicate is created.
This PR adds a feature to allow a group, access to all the predicates in the namespace using wildcard dgraph.all.

This example provides to dev group, read+write access to all the predicates

mutation {
  updateGroup(
    input: {
      filter: { name: { eq: "dev" } }
      set: { rules: [{ predicate: "dgraph.all", permission: 6 }] }
    }
  ) {
    group {
      name
      rules {
        permission
        predicate
      }
    }
  }
}

NOTE: The permission to a predicate for a group (say dev) is a union of permissions from dgraph.all and the permissions to specific predicate (say name). So suppose dgraph.all is given READ permission, while predicate name is given WRITE permission. Then the group will have both READ and WRITE permission.
(cherry picked from commit 3504044)
NamanJain8 added a commit that referenced this pull request Aug 19, 2021
…7993)

* feat(acl): allow access to all the predicates using wildcard (#7991)

There are usecases that need read/write/modify permissions over all the predicates of the namespace. It is quite tedious to manage the permissions every time a new predicate is created.
This PR adds a feature to allow a group, access to all the predicates in the namespace using wildcard dgraph.all.

This example provides to dev group, read+write access to all the predicates

mutation {
  updateGroup(
    input: {
      filter: { name: { eq: "dev" } }
      set: { rules: [{ predicate: "dgraph.all", permission: 6 }] }
    }
  ) {
    group {
      name
      rules {
        permission
        predicate
      }
    }
  }
}

NOTE: The permission to a predicate for a group (say dev) is a union of permissions from dgraph.all and the permissions to specific predicate (say name). So suppose dgraph.all is given READ permission, while predicate name is given WRITE permission. Then the group will have both READ and WRITE permission.
(cherry picked from commit 3504044)

* fix(acl): subscribe for the correct predicates (#7992)

We were subscribing to the wrong predicates. Hence the ACL cache was not getting updated.

(cherry picked from commit 1b75c01)
NamanJain8 added a commit that referenced this pull request Aug 19, 2021
…7994)

* fix(acl): subscribe for the correct predicates (#7992)

We were subscribing to the wrong predicates. Hence the ACL cache was not getting updated.

(cherry picked from commit 1b75c01)

* feat(acl): allow access to all the predicates using wildcard (#7991)

There are usecases that need read/write/modify permissions over all the predicates of the namespace. It is quite tedious to manage the permissions every time a new predicate is created.
This PR adds a feature to allow a group, access to all the predicates in the namespace using wildcard dgraph.all.

This example provides to dev group, read+write access to all the predicates

mutation {
  updateGroup(
    input: {
      filter: { name: { eq: "dev" } }
      set: { rules: [{ predicate: "dgraph.all", permission: 6 }] }
    }
  ) {
    group {
      name
      rules {
        permission
        predicate
      }
    }
  }
}

NOTE: The permission to a predicate for a group (say dev) is a union of permissions from dgraph.all and the permissions to specific predicate (say name). So suppose dgraph.all is given READ permission, while predicate name is given WRITE permission. Then the group will have both READ and WRITE permission.
(cherry picked from commit 3504044)
rarvikar added a commit to dgraph-io/dgraph-docs that referenced this pull request Sep 27, 2021
…ing access for all predicates (#264)

* Modify ACL and Multi-tenancy docs to include info about managing access to all predicates as per [PR #7991](hypermodeinc/dgraph#7991)

* Add changes to ACL page as per review
MichelDiz pushed a commit to dgraph-io/dgraph-docs that referenced this pull request Dec 15, 2022
…ing access for all predicates (#264)

* Modify ACL and Multi-tenancy docs to include info about managing access to all predicates as per [PR #7991](hypermodeinc/dgraph#7991)

* Add changes to ACL page as per review
rderbier added a commit to dgraph-io/dgraph-docs that referenced this pull request Apr 20, 2023
#370)

…ing access for all predicates (#264)

* Modify ACL and Multi-tenancy docs to include info about managing
access to all predicates as per [PR
#7991](hypermodeinc/dgraph#7991)

* Add changes to ACL page as per review

Co-authored-by: Rahul Arvikar <[email protected]>
Co-authored-by: rderbier <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

2 participants