-
Notifications
You must be signed in to change notification settings - Fork 8
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Tuple queries with UUID #1335
Tuple queries with UUID #1335
Conversation
- allow resolving tags without hitting the db if a UUID is specified
d2f3ad6
to
5002ccc
Compare
if tag.Relation.String() != "" { | ||
res += "#" + tag.Relation.String() | ||
} | ||
return res |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
user-id#? What is this doing? I forget id vs tag.Relation.String
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It's converting from the OpenFGA tag to a string. Lower down you'll see we had this logic duplicated for each resource type so I just captured it here.
// [8] - A single ".", ignored | ||
// [9] - Application offer name | ||
// [10] - Relation specifier (i.e., #member) | ||
// [2] - trailer (i.e. resource identifier) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We give example #member below, an identifier example would be good - like controller/model? I think that's this right?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Not sure I follow, regarding usersets or the #<field>
notation, we only have #member currently.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
lgtm, still bit lost on some bits but I trust it's ok
// [9] - Application offer name | ||
// [10] - Relation specifier (i.e., #member) | ||
// [2] - trailer (i.e. resource identifier) | ||
// [3] - Relation specifier (i.e., #member) | ||
// A complete matcher example would look like so with square-brackets denoting groups and paranthsis denoting index: |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Parenthesis? Spelling error here aha
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
* tweak how tags are resolved - allow resolving tags without hitting the db if a UUID is specified * simplify matcher and tests * fix tests - Additionally cleaned up duplicated logic in ToJAASTag() * improve error message
Description
This PR does two things,
The first change was necessary when working on the Juju Terraform Provider because as part of testing that access has been removed, we have a test function that checks that tearing down the plan, a user has no access to a resource. But currently in JIMM if that resource doesn't exist the request will fail. But if the user is querying with a UUID there is no need to make a call to the database.
The second change was motivated by the idea that we were accepting a user input, decomposing that input into multiple components like "model name", "model owner", etc. Then recombining those fields. Instead, just pass the user input after extracting the relevant bits. This also simplifies our
jujuURIMatcher
regex. The tests were also simplified.Partially addresses CSS-6347
Engineering checklist
Check only items that apply
Notes for code reviewers
I suggest reviewing this PR by each commit individually to see the changes more clearly.