MF-1506 - Group-based Access Control #1716

dborovcanin · 2023-02-03T10:14:32Z

What does this do?

This pull request moves Groups to domain services and introduces group-based policies for access control.

Which issue(s) does this PR fix/relate to?

This pull request resolves #1506.
Also resolves #1813.

List any changes that modify/break current functionality.

There are both changes in the architecture and on the code level.
Things and Users, while being different services, are somewhat unified to the Clients codebase.
For more info, see the linked issue.

Have you included tests for your changes?

Yes.

Did you document any new/modified functionality?

Yes.

Notes

The goal is that this pull request is merged for release 0.13.0, so we can provide potential fixes and updates and test it in real-world cases before Mainflux 1.0 release. Since this one introduces architectural changes, we're planning to add migration scripts.

codecov-commenter · 2023-02-08T09:12:32Z

Codecov Report

Merging #1716 (d8279c6) into master (3d0d6e2) will decrease coverage by 4.47%.
The diff coverage is 57.23%.

@@            Coverage Diff             @@
##           master    #1716      +/-   ##
==========================================
- Coverage   70.05%   65.58%   -4.47%     
==========================================
  Files         151      116      -35     
  Lines       11880     9452    -2428     
==========================================
- Hits         8322     6199    -2123     
+ Misses       2885     2595     -290     
+ Partials      673      658      -15

Impacted Files	Coverage Δ
bootstrap/redis/producer/streams.go	`56.89% <ø> (-31.06%)`	⬇️
bootstrap/service.go	`80.45% <ø> (-2.66%)`	⬇️
bootstrap/state.go	`100.00% <ø> (ø)`
certs/certs.go	`83.33% <ø> (ø)`
certs/postgres/certs.go	`0.00% <ø> (ø)`
certs/postgres/init.go	`100.00% <ø> (ø)`
certs/service.go	`83.13% <ø> (ø)`
consumers/notifiers/api/transport.go	`91.01% <ø> (ø)`
consumers/notifiers/postgres/database.go	`74.19% <ø> (+24.19%)`	⬆️
consumers/notifiers/service.go	`60.00% <ø> (ø)`
... and 11 more

... and 74 files with indirect coverage changes

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

dborovcanin · 2023-03-29T08:41:37Z

cmd/bootstrap/main.go

 	"golang.org/x/sync/errgroup"
+
+	r "github.com/go-redis/redis/v8"


Use redis, it's short enough.

dborovcanin · 2023-03-29T08:43:27Z

cmd/bootstrap/main.go

+	r "github.com/go-redis/redis/v8"
+	"github.com/jmoiron/sqlx"
+	"github.com/mainflux/mainflux/bootstrap"
+	api "github.com/mainflux/mainflux/bootstrap/api"


No need for import alias since package name is already api.

dborovcanin · 2023-03-29T08:50:06Z

things/policies/thingsauth.proto

+    rpc Identify(Key) returns (ClientID) {}
+}
+
+message TAuthorizeReq {


No need for T prefix.

drasko

LGTM

drasko

LGTM

Signed-off-by: dusanb94 <dusan.borovcanin@mainflux.com> Signed-off-by: rodneyosodo <blackd0t@protonmail.com> Signed-off-by: dusanb94 <dusan.borovcanin@mainflux.com>

* Remove Policy Action Ranks Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Fix Rebase Issues Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Fix CI Test Errors Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Adding Check on Subject For Clients Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Remove Check Client Exists Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Check When Sharing Clients Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Only Add User to Group When Sharing Things Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Remove clientType Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Minor Fix on ShareClient and Fix Tests Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Fix Policies Tests Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Clean Up Things Authorization Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Fix Tests on RetrieveAll Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Test ShareThing Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Fix Merge Conflicts Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Remove Adding Policies. Only Use Ownership Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Check If Subject is same as Object Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Move Back To Union As Sometimes Policy is Empty and Fails to Evaluate on Ownership Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Fix Entity Type For Failing Tests Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Fix BUG in policy evaluation Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Fix Tests Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Add Comments Regarding checkAdmin Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Fix Tests On Rebase Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Combine Authorize For Things and Users Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Fix Tests On Rebase Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Error on Things SVC `unsupported protocol scheme` Signed-off-by: rodneyosodo <blackd0t@protonmail.com> --------- Signed-off-by: rodneyosodo <blackd0t@protonmail.com> Signed-off-by: dusanb94 <dusan.borovcanin@mainflux.com>

Signed-off-by: rodneyosodo <blackd0t@protonmail.com> Signed-off-by: dusanb94 <dusan.borovcanin@mainflux.com>

Signed-off-by: dusanb94 <dusan.borovcanin@mainflux.com>

* Add More Functions to SDK Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Add Examples to GoDoc Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Update Unassign Interface Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Pass Subject as ID and Not Token on List Channels By Thing Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Fix Bootstrap Errors For Element Check Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Add empty line Before Return Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Reorder URLS in things mux Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Fix Listing Things Policies Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Fix Share Thing Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Add Examples to CLI Docs Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Fix Update Identity To Update Another User Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Fix Identify an Update Policies on Things Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Fix Update Things Policies Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Fix GoDocs on Disconnect Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Fix Tests Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Change Authorize To Use AccessRequest Signed-off-by: rodneyosodo <blackd0t@protonmail.com> --------- Signed-off-by: rodneyosodo <blackd0t@protonmail.com> Signed-off-by: dusanb94 <dusan.borovcanin@mainflux.com>

Signed-off-by: rodneyosodo <blackd0t@protonmail.com> Signed-off-by: dusanb94 <dusan.borovcanin@mainflux.com>

* Add Things Tests Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Add Channel Tests Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Add Certs Tests Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Add Consumer Tests Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Enrich Group Tests Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Add Tests For Health Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Add Tests For Tokens Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Rename SDK for Tests Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Add Policies Tests Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Fix Linter Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Fix Tests Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Make Variable Defination Inline Signed-off-by: rodneyosodo <blackd0t@protonmail.com> --------- Signed-off-by: rodneyosodo <blackd0t@protonmail.com> Signed-off-by: dusanb94 <dusan.borovcanin@mainflux.com>

* Make Cache Key Duration Configurable Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Rename ENV Var Signed-off-by: rodneyosodo <blackd0t@protonmail.com> --------- Signed-off-by: rodneyosodo <blackd0t@protonmail.com> Signed-off-by: dusanb94 <dusan.borovcanin@mainflux.com>

* Add GoDocs Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Add Missing GoDoc Files Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Enable godot Signed-off-by: rodneyosodo <blackd0t@protonmail.com> * Add License Information Signed-off-by: rodneyosodo <blackd0t@protonmail.com> --------- Signed-off-by: rodneyosodo <blackd0t@protonmail.com> Signed-off-by: dusanb94 <dusan.borovcanin@mainflux.com>

* Move Things and Users to Clients Signed-off-by: dusanb94 <dusan.borovcanin@mainflux.com> Signed-off-by: rodneyosodo <blackd0t@protonmail.com> Signed-off-by: SammyOina <sammyoina@gmail.com> * collect and send data package Signed-off-by: SammyOina <sammyoina@gmail.com> * create telemetry migrations Signed-off-by: SammyOina <sammyoina@gmail.com> * add telemetry endpoints Signed-off-by: SammyOina <sammyoina@gmail.com> * add transport Signed-off-by: SammyOina <sammyoina@gmail.com> * create service Signed-off-by: SammyOina <sammyoina@gmail.com> * remove homing server Signed-off-by: SammyOina <sammyoina@gmail.com> * add call home to adapters Signed-off-by: SammyOina <sammyoina@gmail.com> * add last seen Signed-off-by: SammyOina <sammyoina@gmail.com> * rename logger Signed-off-by: SammyOina <sammyoina@gmail.com> * remove homing client Signed-off-by: SammyOina <sammyoina@gmail.com> * use unmerged repo Signed-off-by: SammyOina <sammyoina@gmail.com> * use renamed module Signed-off-by: SammyOina <sammyoina@gmail.com> * update call home version Signed-off-by: SammyOina <sammyoina@gmail.com> * edit documentation Signed-off-by: SammyOina <sammyoina@gmail.com> * align table Signed-off-by: SammyOina <sammyoina@gmail.com> * use alias for call home client Signed-off-by: SammyOina <sammyoina@gmail.com> * update callhome Signed-off-by: SammyOina <sammyoina@gmail.com> * update call home pkg Signed-off-by: SammyOina <sammyoina@gmail.com> * update call home Signed-off-by: SammyOina <sammyoina@gmail.com> * fix modules Signed-off-by: SammyOina <sammyoina@gmail.com> * use mf build version Signed-off-by: SammyOina <sammyoina@gmail.com> * use mf build version Signed-off-by: SammyOina <sammyoina@gmail.com> * restore default Signed-off-by: SammyOina <sammyoina@gmail.com> * add call home for users and things Signed-off-by: SammyOina <sammyoina@gmail.com> * enable opting on call home Signed-off-by: SammyOina <sammyoina@gmail.com> * remove full stops Signed-off-by: SammyOina <sammyoina@gmail.com> * update callhome client Signed-off-by: SammyOina <sammyoina@gmail.com> * add call home to all services Signed-off-by: SammyOina <sammyoina@gmail.com> * fix build Signed-off-by: SammyOina <sammyoina@gmail.com> * restore sdk tests Signed-off-by: SammyOina <sammyoina@gmail.com> * remove unnecessary changes Signed-off-by: SammyOina <sammyoina@gmail.com> * restore health_test.go Signed-off-by: SammyOina <sammyoina@gmail.com> --------- Signed-off-by: dusanb94 <dusan.borovcanin@mainflux.com> Signed-off-by: rodneyosodo <blackd0t@protonmail.com> Signed-off-by: SammyOina <sammyoina@gmail.com> Co-authored-by: b1ackd0t <blackd0t@protonmail.com> Signed-off-by: dusanb94 <dusan.borovcanin@mainflux.com>

dborovcanin force-pushed the clients branch 2 times, most recently from 3197255 to b6dfee6 Compare February 8, 2023 09:00

dborovcanin force-pushed the clients branch 8 times, most recently from 794709f to 142c3e5 Compare February 23, 2023 07:03

dborovcanin force-pushed the clients branch from 58c3c38 to 8299809 Compare March 20, 2023 11:08

github-actions bot added the codeball:needs-careful-review label Mar 20, 2023

dborovcanin marked this pull request as ready for review March 22, 2023 11:41

dborovcanin requested a review from a team as a code owner March 22, 2023 11:41

dborovcanin force-pushed the clients branch 2 times, most recently from 12a7bd7 to 235a29e Compare March 28, 2023 15:16

dborovcanin requested review from arvindh123 and drasko March 28, 2023 20:43

dborovcanin commented Mar 29, 2023

View reviewed changes

dborovcanin force-pushed the clients branch 4 times, most recently from 4ffe0ef to 3b32dc0 Compare April 3, 2023 11:14

dborovcanin force-pushed the clients branch 5 times, most recently from 46e2e51 to 4a76df6 Compare April 17, 2023 11:55

dborovcanin force-pushed the clients branch from 7ef66d3 to cf1af11 Compare April 28, 2023 07:18

dborovcanin dismissed drasko’s stale review via 714ee57 May 31, 2023 07:47

dborovcanin force-pushed the clients branch 3 times, most recently from 926557e to 4f375d2 Compare May 31, 2023 14:19

dborovcanin mentioned this pull request Jun 2, 2023

NOISSUE - Add instance ID #1776

Merged

drasko previously approved these changes Jun 6, 2023

View reviewed changes

dborovcanin force-pushed the clients branch from 0d9a073 to 0e75bd5 Compare June 6, 2023 11:42

dborovcanin removed the codeball:needs-careful-review label Jun 6, 2023

dborovcanin dismissed drasko’s stale review via 6e49df6 June 6, 2023 13:27

dborovcanin mentioned this pull request Jun 8, 2023

Migrate from OpenTracing to OpenTelemetry #1813

Closed

dborovcanin force-pushed the clients branch 2 times, most recently from a57bc7d to 241a61d Compare June 13, 2023 20:52

drasko approved these changes Jun 14, 2023

View reviewed changes

rodneyosodo and others added 12 commits June 14, 2023 12:07

Move Things and Users to Clients

03f9d53

Signed-off-by: dusanb94 <dusan.borovcanin@mainflux.com> Signed-off-by: rodneyosodo <blackd0t@protonmail.com> Signed-off-by: dusanb94 <dusan.borovcanin@mainflux.com>

Fix Bug on Things Authorization Cache (#1810)

69965de

Signed-off-by: rodneyosodo <blackd0t@protonmail.com> Signed-off-by: dusanb94 <dusan.borovcanin@mainflux.com>

Use Password instead of username in MQTT handler

acc7b2f

Signed-off-by: dusanb94 <dusan.borovcanin@mainflux.com>

Simplify MQTT authorization

14750fd

Signed-off-by: dusanb94 <dusan.borovcanin@mainflux.com>

Fix MQTT tests

4119dc7

Signed-off-by: dusanb94 <dusan.borovcanin@mainflux.com>

For Evaluate Policy Use AccessRequest (#1814)

354a909

Signed-off-by: rodneyosodo <blackd0t@protonmail.com> Signed-off-by: dusanb94 <dusan.borovcanin@mainflux.com>

dborovcanin force-pushed the clients branch from c60dc4b to d8279c6 Compare June 14, 2023 10:07

drasko merged commit 55e09c1 into master Jun 14, 2023

dborovcanin mentioned this pull request Jun 15, 2023

NOISSUE - Activate Standalone Mode For Things #1785

Closed

dborovcanin mentioned this pull request Aug 8, 2023

Enable policy filtering by subject type #1883

Closed

dborovcanin deleted the clients branch June 19, 2024 11:40

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

MF-1506 - Group-based Access Control #1716

MF-1506 - Group-based Access Control #1716

dborovcanin commented Feb 3, 2023 •

edited

Loading

codecov-commenter commented Feb 8, 2023 •

edited by codecov bot

Loading

dborovcanin Mar 29, 2023

dborovcanin Mar 29, 2023

dborovcanin Mar 29, 2023

drasko left a comment

drasko left a comment

		"golang.org/x/sync/errgroup"

		r "github.com/go-redis/redis/v8"

MF-1506 - Group-based Access Control #1716

MF-1506 - Group-based Access Control #1716

Conversation

dborovcanin commented Feb 3, 2023 • edited Loading

What does this do?

Which issue(s) does this PR fix/relate to?

List any changes that modify/break current functionality.

Have you included tests for your changes?

Did you document any new/modified functionality?

Notes

codecov-commenter commented Feb 8, 2023 • edited by codecov bot Loading

Codecov Report

dborovcanin Mar 29, 2023

Choose a reason for hiding this comment

dborovcanin Mar 29, 2023

Choose a reason for hiding this comment

dborovcanin Mar 29, 2023

Choose a reason for hiding this comment

drasko left a comment

Choose a reason for hiding this comment

drasko left a comment

Choose a reason for hiding this comment

dborovcanin commented Feb 3, 2023 •

edited

Loading

codecov-commenter commented Feb 8, 2023 •

edited by codecov bot

Loading