mirror of
https://github.com/SigNoz/signoz.git
synced 2026-08-06 05:00:42 +01:00
9bfa6e6d59
* feat(authz): store role transaction groups as document of record Persist a role's transaction groups as JSON on the role row so the role details page is reconstructed deterministically from SQL instead of being rebuilt from OpenFGA tuples (which will soon carry opaque hashed telemetry selectors): - authtypes: TransactionGroups gains Value/Scan (validated via NewTransactionGroups) and MarshalJSON (nil renders as []); NewRole takes transactionGroups; NewManagedRoles fills managed docs from the registry; RoleWithTransactionGroups removed - Role carries the wire field and the AuthZ interface, handler, and OpenAPI responses use *Role; GettableRole (without transactionGroups) is the list response - sqlmigration 099: add role.transaction_groups, backfill custom roles from their permission tuples (dual dialect) and managed roles from the registry - sqlmigration 059: pin insert columns so the live Role model addition does not break fresh installs (059 runs before 099) - ee provider: writes persist the doc alongside FGA tuples (FGA first, SQL second, as before); GetWithTransactionGroups reads the doc; the per-type ReadTuples fan-out (readAllTuplesForRole) is removed - audit middleware: log and skip resolved resources carrying a resolution error - frontend: regenerated OpenAPI spec and API types; role list consumers retyped to GettableRole; role GET keeps transactionGroups * fix(authz): reconcile role tuples from openfga state, decouple migration 059 - Update and Delete derive their diff/deletion base from the tuples openfga actually holds for the role (readAllTuplesForRole) instead of the stored JSON record, so every mutation sweeps drift and residue; the record stays a display-only artifact written after the tuple write - ReadTuples restored on the AuthZ interface with plain passthroughs in both providers and the ee server - TransactionGroups.Value marshals unconditionally (nil renders as [] via MarshalJSON) instead of returning a nil driver.Value - migration 059 uses a migration-local role struct and constructor so live Role model changes cannot alter its insert; migration 099 drops the manual column-exists guard (AddColumn emits IF NOT EXISTS) * refactor(authz): split role into domain Role and StorableRole Replace the Scan/Value/MarshalJSON codecs on TransactionGroups with the storable pattern: StorableRole is the bun model carrying transaction groups as raw JSON text, Role is the pure domain/wire type, and NewStorableRoleFromRole/NewRoleFromStorableRole convert at the store boundary (nil groups persist as [], reads parse through the validating constructor). RoleStore and sqlauthzstore speak StorableRole; both providers convert; handlers and the wire contract are unchanged. * revert(authz): restore TransactionGroups codecs over the storable split Role is a bun relation target (UserRole.Role, ServiceAccountRole.Role), so splitting it into StorableRole/Role cascaded: relations must point at the bun model, which broke the user-roles join and leaked the storable shape into user and service account responses. Keep the single Role model with Scan/Value/MarshalJSON on TransactionGroups; the storable split fits leaf models only. This reverts commit 73aa7d32b1 and keeps transaction_test.go deleted. * refactor(authz): use bun models in migration 099, wire oss role get - migration 099 follows the migration-local row struct pattern: bun NewSelect/NewUpdate for the role table reads and backfill writes; the openfga store and tuple lookups stay raw like 081/083 - oss provider Get reads the role from the store instead of returning unsupported * refactor(authz): org-scoped backfill in migration 099, empty groups on null scan - migration 099 iterates organizations: per org it backfills custom roles from their permission tuples (readRoleTuples helper) and managed roles from the registry (JSON precomputed per role name) - TransactionGroups scans SQL NULL as an empty slice so the api always renders transactionGroups as []; nullzero keeps writing NULL for nil * fix(authz): pass unique constraints to add column in migration 099