update query pkg to support role-binding V2, add v2 APIs

Signed-off-by: Bailin He <[email protected]>

Makefile

@@ -52,12 +52,12 @@ ci: | golint test coverage  ## Setup dev database and run tests.
 .PHONY: test
 test:  ## Runs unit tests.
 	@echo Running unit tests...
-	@go test -v -timeout 30s -cover -short -tags testtools ./...
+	@go test -v -timeout 60s -cover -short -tags testtools ./...
 
 .PHONY: coverage
 coverage:  ## Generates a test coverage report.
 	@echo Generating coverage report...
-	@go test -timeout 30s -tags testtools ./... -coverprofile=coverage.out -covermode=atomic
+	@go test -timeout 60s -tags testtools ./... -coverprofile=coverage.out -covermode=atomic
 	@go tool cover -func=coverage.out
 	@go tool cover -html=coverage.out
 

cmd/createrole.go

@@ -15,24 +15,24 @@ import (
 	"go.infratographer.com/permissions-api/internal/query"
 	"go.infratographer.com/permissions-api/internal/spicedbx"
 	"go.infratographer.com/permissions-api/internal/storage"
+	"go.infratographer.com/permissions-api/internal/types"
 )
 
 const (
 	createRoleFlagSubject  = "subject"
 	createRoleFlagResource = "resource"
 	createRoleFlagActions  = "actions"
 	createRoleFlagName     = "name"
+	createRoleFlagIsV2     = "v2"
 )
 
-var (
-	createRoleCmd = &cobra.Command{
-		Use:   "create-role",
-		Short: "create role in SpiceDB directly",
-		Run: func(cmd *cobra.Command, args []string) {
-			createRole(cmd.Context(), globalCfg)
-		},
-	}
-)
+var createRoleCmd = &cobra.Command{
+	Use:   "create-role",
+	Short: "create role in SpiceDB directly",
+	Run: func(cmd *cobra.Command, _ []string) {
+		createRole(cmd.Context(), globalCfg)
+	},
+}
 
 func init() {
 	rootCmd.AddCommand(createRoleCmd)
@@ -42,20 +42,23 @@ func init() {
 	flags.StringSlice(createRoleFlagActions, []string{}, "actions to assign to created role")
 	flags.String(createRoleFlagResource, "", "resource to bind to created role")
 	flags.String(createRoleFlagName, "", "name of role to create")
+	flags.Bool(createRoleFlagIsV2, false, "create a v2 role")
 
 	v := viper.GetViper()
 
 	viperx.MustBindFlag(v, createRoleFlagSubject, flags.Lookup(createRoleFlagSubject))
 	viperx.MustBindFlag(v, createRoleFlagActions, flags.Lookup(createRoleFlagActions))
 	viperx.MustBindFlag(v, createRoleFlagResource, flags.Lookup(createRoleFlagResource))
 	viperx.MustBindFlag(v, createRoleFlagName, flags.Lookup(createRoleFlagName))
+	viperx.MustBindFlag(v, createRoleFlagIsV2, flags.Lookup(createRoleFlagIsV2))
 }
 
 func createRole(ctx context.Context, cfg *config.AppConfig) {
 	subjectIDStr := viper.GetString(createRoleFlagSubject)
 	actions := viper.GetStringSlice(createRoleFlagActions)
 	resourceIDStr := viper.GetString(createRoleFlagResource)
 	name := viper.GetString(createRoleFlagName)
+	v2 := viper.GetBool(createRoleFlagIsV2)
 
 	if subjectIDStr == "" || len(actions) == 0 || resourceIDStr == "" || name == "" {
 		logger.Fatal("invalid config")
@@ -125,14 +128,35 @@ func createRole(ctx context.Context, cfg *config.AppConfig) {
 		logger.Fatalw("error creating subject resource", "error", err)
 	}
 
-	role, err := engine.CreateRole(ctx, subjectResource, resource, name, actions)
-	if err != nil {
-		logger.Fatalw("error creating role", "error", err)
-	}
+	if v2 {
+		role, err := engine.CreateRoleV2(ctx, subjectResource, resource, name, actions)
+		if err != nil {
+			logger.Fatalw("error creating role", "error", err)
+		}
 
-	if err = engine.AssignSubjectRole(ctx, subjectResource, role); err != nil {
-		logger.Fatalw("error creating role", "error", err)
-	}
+		rbsubj := []types.RoleBindingSubject{{SubjectResource: subjectResource}}
+
+		roleres, err := engine.NewResourceFromID(role.ID)
+		if err != nil {
+			logger.Fatalw("error creating role resource", "error", err)
+		}
 
-	logger.Infow("role successfully created", "role_id", role.ID)
+		rb, err := engine.CreateRoleBinding(ctx, resource, roleres, rbsubj)
+		if err != nil {
+			logger.Fatalw("error creating role binding", "error", err)
+		}
+
+		logger.Infof("created role %s[%s] and role-binding %s", role.Name, role.ID, rb.ID)
+	} else {
+		role, err := engine.CreateRole(ctx, subjectResource, resource, name, actions)
+		if err != nil {
+			logger.Fatalw("error creating role", "error", err)
+		}
+
+		if err = engine.AssignSubjectRole(ctx, subjectResource, role); err != nil {
+			logger.Fatalw("error creating role", "error", err)
+		}
+
+		logger.Infow("role successfully created", "role_id", role.ID)
+	}
 }

cmd/server.go

@@ -21,9 +21,7 @@ import (
 	"go.infratographer.com/permissions-api/internal/storage"
 )
 
-var (
-	apiDefaultListen = "0.0.0.0:7602"
-)
+var apiDefaultListen = "0.0.0.0:7602"
 
 var serverCmd = &cobra.Command{
 	Use:   "server",
@@ -89,7 +87,7 @@ func serve(ctx context.Context, cfg *config.AppConfig) {
 		logger.Fatalw("invalid spicedb policy", "error", err)
 	}
 
-	engine, err := query.NewEngine("infratographer", spiceClient, kv, store, query.WithPolicy(policy))
+	engine, err := query.NewEngine("infratographer", spiceClient, kv, store, query.WithPolicy(policy), query.WithLogger(logger))
 	if err != nil {
 		logger.Fatalw("error creating engine", "error", err)
 	}

internal/api/response.go

@@ -2,6 +2,15 @@ package api
 
 import (
 	"errors"
+	"fmt"
+	"net/http"
+
+	"github.com/labstack/echo/v4"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"go.infratographer.com/permissions-api/internal/query"
+	"go.infratographer.com/permissions-api/internal/storage"
 )
 
 // ErrorResponse represents the data that the server will return on any given call
@@ -20,3 +29,27 @@ var (
 	// ErrResourceAlreadyExists is returned when the resource already exists
 	ErrResourceAlreadyExists = errors.New("resource already exists")
 )
+
+func (r *Router) errorResponse(basemsg string, err error) *echo.HTTPError {
+	msg := fmt.Sprintf("%s: %s", basemsg, err.Error())
+	httpstatus := http.StatusInternalServerError
+
+	switch {
+	case
+		errors.Is(err, storage.ErrRoleNameTaken),
+		errors.Is(err, query.ErrInvalidType),
+		errors.Is(err, query.ErrInvalidArgument),
+		status.Code(err) == codes.InvalidArgument,
+		status.Code(err) == codes.FailedPrecondition:
+		httpstatus = http.StatusBadRequest
+	case
+		errors.Is(err, storage.ErrNoRoleFound),
+		errors.Is(err, query.ErrRoleNotFound),
+		errors.Is(err, query.ErrRoleBindingNotFound):
+		httpstatus = http.StatusNotFound
+	default:
+		msg = basemsg
+	}
+
+	return echo.NewHTTPError(httpstatus, msg).SetInternal(err)
+}