Use role-based permissions for source-postgres #11938

radostyle · 2022-04-12T18:21:25Z

Modify permissions query to add recursive lookup of role-based
permissions. This solves problems users are having with not being able
to list tables for postgres souces.

Fixes #10649

What

This solves problems users are having with not being able to list tables using the source-postgres connector.
The current implementation requires tables to be granted individually to a user.
Using roles is often a better way to manage permissions in postgres and should be supported.
This patch adds support for determining the tables a user has access to based on his role.

How

The accessible table are currently determined using a postgres query over the roles tables. This patch adds one more UNION condition to the existing query with a recursive role based query so that the roles work as expected by users.

🚨 User Impact 🚨

When the user has created a postgres source and any target. The user then goes to create the connection. When listing the tables to sync under the Replication tab.

Pre-merge Checklist

Expand the relevant checklist and delete the others.

New Connector

Community member or Airbyter

Airbyter

If this is a community PR, the Airbyte engineer reviewing this PR is responsible for the below items.

Create a non-forked branch based on this PR and test the below items on it
Build is successful
If new credentials are required for use in CI, add them to GSM. Instructions.
/test connector=connectors/<name> command is passing
New Connector version released on Dockerhub by running the /publish command described here
After the connector is published, connector added to connector index as described here
Seed specs have been re-generated by building the platform and committing the changes to the seed spec files, as described here

Updating a connector

Community member or Airbyter

Grant edit access to maintainers (instructions)
Secrets in the connector's spec are annotated with airbyte_secret
Unit & integration tests added and passing. Community members, please provide proof of success locally e.g: screenshot or copy-paste unit, integration, and acceptance test output. To run acceptance tests for a Python connector, follow instructions in the README. For java connectors run ./gradlew :airbyte-integrations:connectors:<name>:integrationTest.
Code reviews completed
Documentation updated
- Connector's README.md
- Connector's bootstrap.md. See description and examples
- Changelog updated in docs/integrations/<source or destination>/<name>.md including changelog. See changelog example
PR name follows PR naming conventions

Airbyter

If this is a community PR, the Airbyte engineer reviewing this PR is responsible for the below items.

Create a non-forked branch based on this PR and test the below items on it
Build is successful
If new credentials are required for use in CI, add them to GSM. Instructions.
/test connector=connectors/<name> command is passing
New Connector version released on Dockerhub and connector version bumped by running the /publish command described here

Connector Generator

Issue acceptance criteria met
PR name follows PR naming conventions
If adding a new generator, add it to the list of scaffold modules being tested
The generator test modules (all connectors with -scaffold in their name) have been updated with the latest scaffold by running ./gradlew :airbyte-integrations:connector-templates:generator:testScaffoldTemplates then checking in your changes
Documentation which references the generator is updated as needed

Tests

Unit

Put your unit tests output here.

Integration

Put your integration tests output here.

Acceptance

Put your acceptance tests output here.

CLAassistant · 2022-04-12T18:24:04Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

marcosmarxm · 2022-04-13T17:55:23Z

Thanks for the contribution @radostyle, can you sign the CLA?

marcosmarxm · 2022-04-19T18:39:48Z

Waiting user to sign the CLA. @radostyle ping

Modify permissions query to add recursive lookup of role-based permissions. This solves problems users are having with not being able to list tables for postgres souces

radostyle · 2022-04-20T16:49:59Z

I just signed it, but it is not showing signed on the ticket.

…

On Tue, Apr 19, 2022, 1:40 PM Marcos Marx ***@***.***> wrote: Waiting user to sign the CLA. @radostyle <https://github.com/radostyle> ping — Reply to this email directly, view it on GitHub <#11938 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AABFCZIJYMB6VIW54LSNEELVF34X7ANCNFSM5TIEVMTQ> . You are receiving this because you were mentioned.Message ID: ***@***.***>

radostyle · 2022-04-22T22:28:49Z

There was an issue with the email used for the commit, but I fixed it. It is showing signed now.

tuliren

Thank you for the contribution!

Would you mind adding some unit tests? One example is testUserDoesntHasPrivilegesToSelectTable in PostgresSourceTest.java. Ideally the tests should verify that:

When the user has SELECT privilege on a table, getPrivilegesTableForCurrentUser will include that that table in the returned result.
When the user has no SELECT privilege on a table, that table won't be included in the return result.

It's also fine though if you don't have bandwidth to work on the unit test.

radostyle · 2022-05-03T21:11:12Z

I included a unit test that tests the discovery logic. testUserDoesntHasPrivilegesToSelectTable seems to test that you can get the changes when you've already configured the table.

tuliren

Confirmed that this PR fixed the bug. Thanks a lot!

I will merge and publish a new version in a separate PR.

tuliren · 2022-05-08T04:09:49Z

/test connector=connectors/source-postgres

🕑 connectors/source-postgres https://github.com/airbytehq/airbyte/actions/runs/2288477548
✅ connectors/source-postgres https://github.com/airbytehq/airbyte/actions/runs/2288477548
No Python unittests run

tuliren · 2022-05-08T04:09:56Z

/test connector=connectors/source-postgres-strict-encrypt

🕑 connectors/source-postgres-strict-encrypt https://github.com/airbytehq/airbyte/actions/runs/2288477890
✅ connectors/source-postgres-strict-encrypt https://github.com/airbytehq/airbyte/actions/runs/2288477890
No Python unittests run

* Use role-based permissions for source-postgres Modify permissions query to add recursive lookup of role-based permissions. This solves problems users are having with not being able to list tables for postgres souces * Add unit test of discovery logic

github-actions bot added the area/connectors Connector related issues label Apr 12, 2022

octavia-squidington-iii added the community label Apr 12, 2022

marcosmarxm added the blocked label Apr 19, 2022

marcosmarxm self-assigned this Apr 19, 2022

Use role-based permissions for source-postgres

07ecef9

Modify permissions query to add recursive lookup of role-based permissions. This solves problems users are having with not being able to list tables for postgres souces

radostyle force-pushed the rolebased branch from 1fdcf50 to 07ecef9 Compare April 22, 2022 22:27

marcosmarxm requested a review from tuliren April 26, 2022 02:01

tuliren reviewed Apr 26, 2022

View reviewed changes

marcosmarxm assigned tuliren Apr 26, 2022

marcosmarxm removed the blocked label Apr 26, 2022

Add unit test of discovery logic

881bf1d

marcosmarxm requested a review from tuliren May 4, 2022 01:18

tuliren linked an issue May 8, 2022 that may be closed by this pull request

Failure to discover streams from Postgres source #12635

Closed

tuliren approved these changes May 8, 2022

View reviewed changes

tuliren merged commit c96f32f into airbytehq:master May 8, 2022

tuliren mentioned this pull request May 8, 2022

🎉 Source postgres: publish fix of missing streams #12689

Merged

octavia-squidington-iii mentioned this pull request May 9, 2022

Bump Airbyte version from 0.37.0-alpha to 0.37.1-alpha #12703

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Use role-based permissions for source-postgres #11938

Use role-based permissions for source-postgres #11938

radostyle commented Apr 12, 2022 •

edited

Loading

CLAassistant commented Apr 12, 2022 •

edited

Loading

marcosmarxm commented Apr 13, 2022

marcosmarxm commented Apr 19, 2022

radostyle commented Apr 20, 2022 via email

radostyle commented Apr 22, 2022

tuliren left a comment

radostyle commented May 3, 2022

tuliren left a comment

tuliren commented May 8, 2022 •

edited by github-actions bot

Loading

tuliren commented May 8, 2022 •

edited by github-actions bot

Loading

Use role-based permissions for source-postgres #11938

Use role-based permissions for source-postgres #11938

Conversation

radostyle commented Apr 12, 2022 • edited Loading

What

How

Recommended reading order

🚨 User Impact 🚨

Pre-merge Checklist

Community member or Airbyter

Airbyter

Community member or Airbyter

Airbyter

Tests

CLAassistant commented Apr 12, 2022 • edited Loading

marcosmarxm commented Apr 13, 2022

marcosmarxm commented Apr 19, 2022

radostyle commented Apr 20, 2022 via email

radostyle commented Apr 22, 2022

tuliren left a comment

Choose a reason for hiding this comment

radostyle commented May 3, 2022

tuliren left a comment

Choose a reason for hiding this comment

tuliren commented May 8, 2022 • edited by github-actions bot Loading

tuliren commented May 8, 2022 • edited by github-actions bot Loading

radostyle commented Apr 12, 2022 •

edited

Loading

CLAassistant commented Apr 12, 2022 •

edited

Loading

tuliren commented May 8, 2022 •

edited by github-actions bot

Loading

tuliren commented May 8, 2022 •

edited by github-actions bot

Loading