Fix issue with initialization

CHANGELOG.md

@@ -3,11 +3,13 @@
 All notable changes to this project will be documented in this file.
 
 ## Unreleased
+## Fixed
+- Fixed init failing with db validation error from [meain](https://github.com/meain)
 
 ## [0.1.1] - 2022-08-09
 
 ### Fixed
- - Fix to validate bare minimum role permissions for custom roles from [niravparikh05](https://github.com/niravparikh05)
+- Fix to validate bare minimum role permissions for custom roles from [niravparikh05](https://github.com/niravparikh05)
 
 ## [0.1.0] - 2022-06-22
 ### Added

pkg/service/const.go

@@ -12,4 +12,5 @@ const (
 	namespaceW     = "kubectl.namespace.write"
 	partnerR       = "partner.read"
 	organizationR  = "organization.read"
+	opsAll         = "ops_star.all"
 )

pkg/service/role.go

@@ -147,8 +147,9 @@ func (s *roleService) Create(ctx context.Context, role *rolev3.Role) (*rolev3.Ro
 
 	//validate basic mandatory permissions that should be part of all custom roles
 	if len(role.Spec.Rolepermissions) > 0 &&
-		!(utils.Contains(role.Spec.Rolepermissions, partnerR) &&
-			utils.Contains(role.Spec.Rolepermissions, organizationR)) {
+		!utils.Contains(role.Spec.Rolepermissions, opsAll) &&
+		(!utils.Contains(role.Spec.Rolepermissions, partnerR) ||
+			!utils.Contains(role.Spec.Rolepermissions, organizationR)) {
 		return nil, fmt.Errorf("invalid role permissions, '%v', '%v' should be present ", partnerR, organizationR)
 	}
 
@@ -272,8 +273,9 @@ func (s *roleService) Update(ctx context.Context, role *rolev3.Role) (*rolev3.Ro
 	}
 
 	//validate basic mandatory permissions that should be part of all custom roles
-	if !(utils.Contains(role.Spec.Rolepermissions, partnerR) &&
-		utils.Contains(role.Spec.Rolepermissions, organizationR)) {
+	if !utils.Contains(role.Spec.Rolepermissions, opsAll) &&
+		(!utils.Contains(role.Spec.Rolepermissions, partnerR) ||
+			!utils.Contains(role.Spec.Rolepermissions, organizationR)) {
 		return nil, fmt.Errorf("invalid role permissions, '%v', '%v' should be present ", partnerR, organizationR)
 	}
 

pkg/service/role_test.go

@@ -139,6 +139,40 @@ func TestCreateRoleBuiltinOverride(t *testing.T) {
 	performRoleBasicChecks(t, role, ruuid)
 }
 
+func TestCreateRoleWithOpsAllPermission(t *testing.T) {
+	db, mock := getDB(t)
+	defer db.Close()
+
+	mazc := mockAuthzClient{}
+	rs := NewRoleService(db, &mazc, getLogger())
+
+	ruuid := uuid.New().String()
+
+	puuid, ouuid := addParterOrgFetchExpectation(mock)
+	mock.ExpectQuery(`SELECT "resourcerole"."id" FROM "authsrv_resourcerole" AS "resourcerole" WHERE .organization_id = '` + ouuid + `'. AND .partner_id = '` + puuid + `'. AND .name = 'role-` + ruuid + `'.`).
+		WillReturnError(fmt.Errorf("no data available"))
+
+	mock.ExpectBegin()
+	mock.ExpectQuery(`INSERT INTO "authsrv_resourcerole"`).
+		WithArgs().WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow(ruuid))
+	mock.ExpectQuery(`SELECT "resourcepermission"."id" FROM "authsrv_resourcepermission" AS "resourcepermission" WHERE .name = 'ops_star.all'.`).
+		WithArgs().WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow(uuid.New().String()))
+	mock.ExpectQuery(`INSERT INTO "authsrv_resourcerolepermission"`).
+		WithArgs().WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow(uuid.New().String()))
+	mock.ExpectCommit()
+
+	role := &rolev3.Role{
+		Metadata: &v3.Metadata{Partner: "partner-" + puuid, Organization: "org-" + ouuid, Name: "role-" + ruuid},
+		Spec:     &rolev3.RoleSpec{IsGlobal: true, Scope: "system", Rolepermissions: []string{"ops_star.all"}},
+	}
+	role, err := rs.Create(context.Background(), role)
+	if err != nil {
+		t.Fatal("could not create group:", err)
+	}
+	performRoleBasicChecks(t, role, ruuid)
+
+}
+
 func TestCreateRoleWithPermissions(t *testing.T) {
 	db, mock := getDB(t)
 	defer db.Close()