mirror of
https://github.com/paralus/paralus.git
synced 2026-08-24 15:47:19 +00:00
Initialize script to create org, partner and roles
We should probably have the role creation moved into adminsrv, but since we are only creating new orgs like this as of now let us continue with this.
This commit is contained in:
Abin Simon
@@ -40,7 +40,7 @@ func addResourcePermissions(dao pg.EntityDAO, basePath string) error {
|
||||
}
|
||||
}
|
||||
|
||||
fmt.Println("Adding", len(items), "resouces permissions")
|
||||
fmt.Println("Adding", len(items), "resource permissions")
|
||||
_, err = dao.Create(context.Background(), &items)
|
||||
return err
|
||||
}
|
||||
|
||||
@@ -1,125 +0,0 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"database/sql"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io/ioutil"
|
||||
"log"
|
||||
"os"
|
||||
"path"
|
||||
|
||||
"github.com/RafaySystems/rcloud-base/internal/models"
|
||||
"github.com/RafaySystems/rcloud-base/internal/persistence/provider/pg"
|
||||
"github.com/google/uuid"
|
||||
"github.com/uptrace/bun"
|
||||
"github.com/uptrace/bun/dialect/pgdialect"
|
||||
"github.com/uptrace/bun/driver/pgdriver"
|
||||
)
|
||||
|
||||
func addRole(dao pg.EntityDAO, name string, scope string, orgId uuid.UUID, partnerId uuid.UUID, permissions []string) error {
|
||||
entity, err := dao.GetM(context.Background(), map[string]interface{}{"name": name, "scope": scope, "organization_id": orgId, "partner_id": partnerId}, &models.Role{})
|
||||
if err != nil && err.Error() != "sql: no rows in result set" {
|
||||
return err
|
||||
}
|
||||
|
||||
role := models.Role{
|
||||
Name: name,
|
||||
OrganizationId: orgId,
|
||||
PartnerId: partnerId,
|
||||
Scope: scope,
|
||||
}
|
||||
if r, ok := entity.(*models.Role); ok {
|
||||
// I could technically do an update, but just to make it simpler
|
||||
fmt.Printf("%v alrady exists, deleting and adding again\n", name)
|
||||
err := dao.DeleteX(context.Background(), "resource_role_id", r.ID, &models.ResourceRolePermission{})
|
||||
if err != nil {
|
||||
log.Fatalf("unable to delete permissions for '%v'", name)
|
||||
}
|
||||
|
||||
err = dao.Delete(context.Background(), r.ID, &models.Role{})
|
||||
if err != nil {
|
||||
log.Fatalf("unable to delete '%v'", name)
|
||||
}
|
||||
}
|
||||
|
||||
createdRole, err := dao.Create(context.Background(), &role)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if r, ok := createdRole.(*models.Role); ok {
|
||||
for _, p := range permissions {
|
||||
entity, err := dao.GetByName(context.Background(), p, &models.ResourcePermission{})
|
||||
if err != nil {
|
||||
log.Fatalf("unable to get rolepermission '%v'", p)
|
||||
}
|
||||
|
||||
if rlp, ok := entity.(*models.ResourcePermission); ok {
|
||||
rolepermissionmapping := models.ResourceRolePermission{
|
||||
ResourceRoleId: r.ID,
|
||||
ResourcePermissionId: rlp.ID,
|
||||
}
|
||||
_, err := dao.Create(context.Background(), &rolepermissionmapping)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
} else {
|
||||
log.Fatalf("unable to get rolepermission '%v'", p)
|
||||
}
|
||||
}
|
||||
} else {
|
||||
return fmt.Errorf("unable to create role")
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func main() {
|
||||
dsn := "postgres://admindbuser:admindbpassword@localhost:5432/admindb?sslmode=disable"
|
||||
sqldb := sql.OpenDB(pgdriver.NewConnector(pgdriver.WithDSN(dsn)))
|
||||
db := bun.NewDB(sqldb, pgdialect.New())
|
||||
|
||||
// db.AddQueryHook(bundebug.NewQueryHook(
|
||||
// bundebug.WithVerbose(true),
|
||||
// bundebug.FromEnv("BUNDEBUG"),
|
||||
// ))
|
||||
dao := pg.NewEntityDAO(db)
|
||||
|
||||
if len(os.Args) != 3 {
|
||||
// this step happens after org creation and so we will have org and partner id
|
||||
log.Fatal("Usage: ", os.Args[0], " <organizatin_id> ", " <partner_id>")
|
||||
}
|
||||
|
||||
content, err := ioutil.ReadFile(path.Join("scripts", "resourceroles", "data.json"))
|
||||
if err != nil {
|
||||
log.Fatal(err)
|
||||
}
|
||||
|
||||
orgId, err := uuid.Parse(os.Args[1])
|
||||
if err != nil {
|
||||
log.Fatal(err)
|
||||
}
|
||||
partnerId, err := uuid.Parse(os.Args[2])
|
||||
if err != nil {
|
||||
log.Fatal(err)
|
||||
}
|
||||
|
||||
var data map[string]map[string][]string
|
||||
err = json.Unmarshal(content, &data)
|
||||
if err != nil {
|
||||
log.Fatal(err)
|
||||
}
|
||||
|
||||
for scope := range data {
|
||||
for name := range data[scope] {
|
||||
perms := data[scope][name]
|
||||
fmt.Println(scope, name, len(perms))
|
||||
err := addRole(dao, name, scope, orgId, partnerId, perms)
|
||||
if err != nil {
|
||||
log.Fatal(err)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,101 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"database/sql"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io/ioutil"
|
||||
"log"
|
||||
"os"
|
||||
"path"
|
||||
|
||||
"github.com/RafaySystems/rcloud-base/pkg/enforcer"
|
||||
"github.com/RafaySystems/rcloud-base/pkg/service"
|
||||
commonv3 "github.com/RafaySystems/rcloud-base/proto/types/commonpb/v3"
|
||||
rolev3 "github.com/RafaySystems/rcloud-base/proto/types/rolepb/v3"
|
||||
systemv3 "github.com/RafaySystems/rcloud-base/proto/types/systempb/v3"
|
||||
"github.com/uptrace/bun"
|
||||
"github.com/uptrace/bun/dialect/pgdialect"
|
||||
"github.com/uptrace/bun/driver/pgdriver"
|
||||
"gorm.io/driver/postgres"
|
||||
"gorm.io/gorm"
|
||||
)
|
||||
|
||||
// This script will be run in an init container after we crate all the
|
||||
// permissions. It will take care of the initialization, namely:
|
||||
// - creating partner
|
||||
// - creating org
|
||||
// - creating roles in org
|
||||
//
|
||||
// We make use of service instead of just insserting to db as that way
|
||||
// all the dependent items will be taken care of automatically.
|
||||
|
||||
func main() {
|
||||
if len(os.Args) != 3 {
|
||||
// this step happens after org creation and so we will have org and partner id
|
||||
log.Fatal("Usage: ", os.Args[0], " <organizatin_id> ", " <partner_id>")
|
||||
}
|
||||
|
||||
org := os.Args[1]
|
||||
partner := os.Args[2]
|
||||
|
||||
content, err := ioutil.ReadFile(path.Join("scripts", "resourceroles", "data.json"))
|
||||
if err != nil {
|
||||
log.Fatal("unable to read file: ", err)
|
||||
}
|
||||
|
||||
var data map[string]map[string][]string
|
||||
err = json.Unmarshal(content, &data)
|
||||
if err != nil {
|
||||
log.Fatal("unable to parse data file", err)
|
||||
}
|
||||
|
||||
dsn := "postgres://admindbuser:admindbpassword@localhost:5432/admindb?sslmode=disable"
|
||||
sqldb := sql.OpenDB(pgdriver.NewConnector(pgdriver.WithDSN(dsn)))
|
||||
db := bun.NewDB(sqldb, pgdialect.New())
|
||||
|
||||
// authz services
|
||||
gormDb, err := gorm.Open(postgres.Open(dsn), &gorm.Config{})
|
||||
if err != nil {
|
||||
log.Fatal("unable to create db connection", "error", err)
|
||||
}
|
||||
enforcer, err := enforcer.NewCasbinEnforcer(gormDb).Init()
|
||||
if err != nil {
|
||||
log.Fatal("unable to init enforcer", "error", err)
|
||||
}
|
||||
as := service.NewAuthzService(gormDb, enforcer)
|
||||
|
||||
ps := service.NewPartnerService(db)
|
||||
os := service.NewOrganizationService(db)
|
||||
rs := service.NewRoleService(db, as)
|
||||
|
||||
_, err = ps.Create(context.Background(), &systemv3.Partner{
|
||||
Metadata: &commonv3.Metadata{Name: partner, Description: "..."},
|
||||
Spec: &systemv3.PartnerSpec{Host: ""},
|
||||
})
|
||||
if err != nil {
|
||||
log.Fatal("unable to create partner", err)
|
||||
}
|
||||
_, err = os.Create(context.Background(), &systemv3.Organization{
|
||||
Metadata: &commonv3.Metadata{Name: org, Partner: partner, Description: "..."},
|
||||
Spec: &systemv3.OrganizationSpec{Active: true},
|
||||
})
|
||||
if err != nil {
|
||||
log.Fatal("unable to create organization", err)
|
||||
}
|
||||
|
||||
for scope := range data {
|
||||
for name := range data[scope] {
|
||||
perms := data[scope][name]
|
||||
fmt.Println(scope, name, len(perms))
|
||||
_, err := rs.Create(context.Background(), &rolev3.Role{
|
||||
Metadata: &commonv3.Metadata{Name: name, Partner: partner, Organization: org, Description: "..."},
|
||||
Spec: &rolev3.RoleSpec{IsGlobal: true, Scope: "cluster", Rolepermissions: perms}, // TODO: look into scope
|
||||
})
|
||||
if err != nil {
|
||||
log.Fatal(err)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user