Permissions/rows

.github/workflows/main_ci.yml

@@ -124,6 +124,6 @@ jobs:
           path: artifacts
 
       - name: Publish Unit Test Results
-        uses: EnricoMi/publish-unit-test-result-action@v1
+        uses: EnricoMi/publish-unit-test-result-action@v2
         with:
           files: artifacts/test-results/**/*.xml

.gitignore

@@ -1,5 +1,6 @@
 # Tableaux specific
 conf.json
+conf-*.jsonc
 conf-*.json
 !conf-example.json
 !conf-test-example.json
@@ -12,6 +13,7 @@ classes/
 bin/
 out/
 **.DS_Store
+role-*.jsonc
 role-*.json
 !role-permissions-example.json
 !role-permissions-test.json

role-permissions-test.json

@@ -227,6 +227,19 @@
       ]
     }
   ],
+  "view-test-row-permissions": [
+    {
+      "type": "grant",
+      "action": [
+        "viewRow"
+      ],
+      "condition": {
+        "row": {
+          "permissions": "onlyGroupA|perm_1|perm_2|perm_3"
+        }
+      }
+    }
+  ],
   // Developer test role to be able to pass all integration tests
   "dev": [
     {

src/main/resources/schema/schema_v34.sql

@@ -0,0 +1,13 @@
+CREATE OR REPLACE FUNCTION update_user_tables(tableid BIGINT)
+RETURNS TEXT AS $$
+BEGIN
+
+EXECUTE 'ALTER TABLE public.user_table_' || tableid || ' ADD COLUMN row_permissions jsonb DEFAULT NULL;';
+RETURN 'user_table_' || tableid :: TEXT;
+END
+$$ LANGUAGE plpgsql;
+
+SELECT update_user_tables(table_id)
+FROM system_table;
+
+DROP FUNCTION update_user_tables( BIGINT );

src/main/resources/swagger.json

@@ -1298,6 +1298,13 @@
                   "items": {
                     "$ref": "#/definitions/Shared Request: Row"
                   }
+                },
+                "rowPermissions": {
+                  "type": "array",
+                  "description": "Array of row permissions",
+                  "items": {
+                    "type": "string"
+                  }
                 }
               },
               "example": {
@@ -1314,6 +1321,10 @@
                       }
                     ]
                   }
+                ],
+                "rowPermissions": [
+                  "onlyUserGroupA",
+                  "onlyUserGroupB"
                 ]
               }
             }
@@ -1479,7 +1490,20 @@
         "operationId": "update-row-annotations",
         "parameters": [
           {
-            "$ref": "#/parameters/langtags"
+            "name": "row annotation",
+            "in": "body",
+            "required": false,
+            "schema": {
+              "type": "object",
+              "properties": {
+                "final": {
+                  "type": "boolean"
+                }
+              },
+              "example": {
+                "final": true
+              }
+            }
           }
         ],
         "responses": {
@@ -1764,6 +1788,74 @@
           }
         }
       }
+    },
+    "/tables/{tableId}/rows/{rowId}/permissions": {
+      "parameters": [
+        {
+          "$ref": "#/parameters/tableId"
+        },
+        {
+          "$ref": "#/parameters/rowId"
+        }
+      ],
+      "patch": {
+        "summary": "Add permissions to this row.",
+        "description": "Add permissions to this row.",
+        "tags": [
+          "permission"
+        ],
+        "operationId": "add-row-permissions",
+        "parameters": [
+          {
+            "$ref": "#/parameters/rowPermissionBody"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/responses/ok-empty-body"
+          },
+          "404": {
+            "$ref": "#/responses/not-found-in-database"
+          }
+        }
+      },
+      "delete": {
+        "summary": "Delete all permissions of this row.",
+        "description": "Delete permissions of this row.",
+        "tags": [
+          "permission"
+        ],
+        "operationId": "delete-row-permissions",
+        "responses": {
+          "200": {
+            "$ref": "#/responses/ok-empty-body"
+          },
+          "404": {
+            "$ref": "#/responses/not-found-in-database"
+          }
+        }
+      },
+      "put": {
+        "summary": "Replace permissions of this row.",
+        "description": "Replace current permissions of this row. This overwrites all permissions of this row with the new provided permission array.",
+        "tags": [
+          "permission"
+        ],
+        "operationId": "replace-row-permissions",
+        "parameters": [
+          {
+            "$ref": "#/parameters/rowPermissionBody"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/responses/ok-empty-body"
+          },
+          "404": {
+            "$ref": "#/responses/not-found-in-database"
+          }
+        }
+      }
     }
   },
   "definitions": {
@@ -2221,7 +2313,8 @@
             "row_created",
             "row_deleted",
             "annotation_added",
-            "annotation_removed"
+            "annotation_removed",
+            "row_permissions_changed"
           ]
         },
         "historyType": {
@@ -2232,7 +2325,8 @@
             "cell",
             "comment",
             "cell_flag",
-            "row_flag"
+            "row_flag",
+            "row_permissions"
           ]
         },
         "languageType": {
@@ -2280,7 +2374,8 @@
             "datetime",
             "concat",
             "currency",
-            "group"
+            "group",
+            "permissions"
           ]
         }
       }
@@ -3615,6 +3710,11 @@
           "formatPattern": "city {{1}} has {{2}} inhabitants"
         }
       ]
+    },
+    "RowPermission": {
+      "description": "A row annotation",
+      "type": "string",
+      "example": "onlyUserGroupA"
     }
   },
   "parameters": {
@@ -3765,6 +3865,22 @@
       "type": "integer",
       "format": "int64",
       "required": false
+    },
+    "rowPermissionBody": {
+      "name": "value",
+      "description": "An array of row permission to add, remove or replace.",
+      "in": "body",
+      "required": true,
+      "schema": {
+        "type": "array",
+        "items": {
+          "type": "string"
+        },
+        "example": [
+          "onlyUserGroupA",
+          "onlyUserGroupB"
+        ]
+      }
     }
   },
   "responses": {

src/main/scala/com/campudus/tableaux/controller/SystemController.scala

@@ -185,7 +185,8 @@ class SystemController(
       columnIds = columns.map(_.id)
       rowsWithColumnIdAndValue = rows.map(columnIds.zip(_))
 
-      _ <- tableauxModel.createRows(table, rowsWithColumnIdAndValue)
+      // don't pass row permissions here, because method is only used for demo data
+      _ <- tableauxModel.createRows(table, rowsWithColumnIdAndValue, None)
     } yield table
   }
 

src/main/scala/com/campudus/tableaux/controller/TableauxController.scala

@@ -13,6 +13,7 @@ import com.campudus.tableaux.router.auth.permission._
 
 import io.vertx.scala.ext.web.RoutingContext
 import org.vertx.scala.core.json.Json
+import org.vertx.scala.core.json.JsonArray
 
 import scala.concurrent.Future
 import scala.util.Try
@@ -243,7 +244,11 @@ class TableauxController(
     }
   }
 
-  def createRow(tableId: TableId, values: Option[Seq[Seq[(ColumnId, _)]]])(
+  def createRow(
+      tableId: TableId,
+      values: Option[Seq[Seq[(ColumnId, _)]]],
+      rowPermissionsOpt: Option[Seq[String]] = None
+  )(
       implicit user: TableauxUser
   ): Future[DomainObject] = {
     checkArguments(greaterZero(tableId))
@@ -255,10 +260,10 @@ class TableauxController(
         case Some(seq) =>
           checkArguments(nonEmpty(seq, "rows"))
           logger.info(s"createRows ${table.id} $values")
-          repository.createRows(table, seq)
+          repository.createRows(table, seq, rowPermissionsOpt)
         case None =>
           logger.info(s"createRow ${table.id}")
-          repository.createRow(table)
+          repository.createRow(table, rowPermissionsOpt)
       }
     } yield row
   }
@@ -531,7 +536,8 @@ class TableauxController(
         }
       table <- repository.createTable(tableName, hidden = false)
       columnIds <- repository.createColumns(table, columns).map(_.map(_.id))
-      _ <- repository.createRows(table, rows.map(columnIds.zip(_)))
+      // TODO: pass row permissions to createRows
+      _ <- repository.createRows(table, rows.map(columnIds.zip(_)), None)
       completeTable <- retrieveCompleteTable(table.id)
     } yield completeTable
   }
@@ -594,4 +600,40 @@ class TableauxController(
       historySequence <- repository.retrieveTableHistory(table, langtagOpt, typeOpt)
     } yield SeqHistory(historySequence)
   }
+
+  def addRowPermissions(tableId: TableId, rowId: RowId, rowPermissions: Seq[String])(
+      implicit user: TableauxUser
+  ): Future[EmptyObject] = {
+    checkArguments(greaterZero(tableId), greaterZero(rowId))
+    logger.info(s"addRowPermissions $tableId $rowId $rowPermissions")
+
+    for {
+      table <- repository.retrieveTable(tableId)
+      _ <- repository.addRowPermissions(table, rowId, rowPermissions)
+    } yield EmptyObject()
+  }
+
+  def deleteRowPermissions(tableId: TableId, rowId: RowId)(
+      implicit user: TableauxUser
+  ): Future[EmptyObject] = {
+    checkArguments(greaterZero(tableId), greaterZero(rowId))
+    logger.info(s"removeRowPermissions $tableId $rowId")
+
+    for {
+      table <- repository.retrieveTable(tableId)
+      _ <- repository.deleteRowPermissions(table, rowId)
+    } yield EmptyObject()
+  }
+
+  def replaceRowPermissions(tableId: TableId, rowId: RowId, rowPermissions: Seq[String])(
+      implicit user: TableauxUser
+  ): Future[EmptyObject] = {
+    checkArguments(greaterZero(tableId), greaterZero(rowId))
+    logger.info(s"replaceRowPermissions $tableId $rowId $rowPermissions")
+
+    for {
+      table <- repository.retrieveTable(tableId)
+      _ <- repository.replaceRowPermissions(table, rowId, rowPermissions)
+    } yield EmptyObject()
+  }
 }