From c99e876705d631c4ecd0269eb960e25a82c2332a Mon Sep 17 00:00:00 2001
From: Abin Simon <mail@meain.io>
Date: Fri, 12 Aug 2022 15:54:39 +0530
Subject: [PATCH] Fix issue with initialization

---
 CHANGELOG.md             |  4 +++-
 pkg/service/const.go     |  1 +
 pkg/service/role.go      | 10 ++++++----
 pkg/service/role_test.go | 34 ++++++++++++++++++++++++++++++++++
 4 files changed, 44 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d9d49d8..5fbbab3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,11 +3,13 @@
 All notable changes to this project will be documented in this file.
 
 ## Unreleased
+## Fixed
+- Fixed init failing with db validation error from [meain](https://github.com/meain)
 
 ## [0.1.1] - 2022-08-09
 
 ### Fixed
- - Fix to validate bare minimum role permissions for custom roles from [niravparikh05](https://github.com/niravparikh05)
+- Fix to validate bare minimum role permissions for custom roles from [niravparikh05](https://github.com/niravparikh05)
 
 ## [0.1.0] - 2022-06-22
 ### Added
diff --git a/pkg/service/const.go b/pkg/service/const.go
index 75ca0b2..38cc9fd 100644
--- a/pkg/service/const.go
+++ b/pkg/service/const.go
@@ -12,4 +12,5 @@ const (
 	namespaceW     = "kubectl.namespace.write"
 	partnerR       = "partner.read"
 	organizationR  = "organization.read"
+	opsAll         = "ops_star.all"
 )
diff --git a/pkg/service/role.go b/pkg/service/role.go
index 4257489..80283d0 100644
--- a/pkg/service/role.go
+++ b/pkg/service/role.go
@@ -147,8 +147,9 @@ func (s *roleService) Create(ctx context.Context, role *rolev3.Role) (*rolev3.Ro
 
 	//validate basic mandatory permissions that should be part of all custom roles
 	if len(role.Spec.Rolepermissions) > 0 &&
-		!(utils.Contains(role.Spec.Rolepermissions, partnerR) &&
-			utils.Contains(role.Spec.Rolepermissions, organizationR)) {
+		!utils.Contains(role.Spec.Rolepermissions, opsAll) &&
+		(!utils.Contains(role.Spec.Rolepermissions, partnerR) ||
+			!utils.Contains(role.Spec.Rolepermissions, organizationR)) {
 		return nil, fmt.Errorf("invalid role permissions, '%v', '%v' should be present ", partnerR, organizationR)
 	}
 
@@ -272,8 +273,9 @@ func (s *roleService) Update(ctx context.Context, role *rolev3.Role) (*rolev3.Ro
 	}
 
 	//validate basic mandatory permissions that should be part of all custom roles
-	if !(utils.Contains(role.Spec.Rolepermissions, partnerR) &&
-		utils.Contains(role.Spec.Rolepermissions, organizationR)) {
+	if !utils.Contains(role.Spec.Rolepermissions, opsAll) &&
+		(!utils.Contains(role.Spec.Rolepermissions, partnerR) ||
+			!utils.Contains(role.Spec.Rolepermissions, organizationR)) {
 		return nil, fmt.Errorf("invalid role permissions, '%v', '%v' should be present ", partnerR, organizationR)
 	}
 
diff --git a/pkg/service/role_test.go b/pkg/service/role_test.go
index b5342f1..0d83253 100644
--- a/pkg/service/role_test.go
+++ b/pkg/service/role_test.go
@@ -139,6 +139,40 @@ func TestCreateRoleBuiltinOverride(t *testing.T) {
 	performRoleBasicChecks(t, role, ruuid)
 }
 
+func TestCreateRoleWithOpsAllPermission(t *testing.T) {
+	db, mock := getDB(t)
+	defer db.Close()
+
+	mazc := mockAuthzClient{}
+	rs := NewRoleService(db, &mazc, getLogger())
+
+	ruuid := uuid.New().String()
+
+	puuid, ouuid := addParterOrgFetchExpectation(mock)
+	mock.ExpectQuery(`SELECT "resourcerole"."id" FROM "authsrv_resourcerole" AS "resourcerole" WHERE .organization_id = '` + ouuid + `'. AND .partner_id = '` + puuid + `'. AND .name = 'role-` + ruuid + `'.`).
+		WillReturnError(fmt.Errorf("no data available"))
+
+	mock.ExpectBegin()
+	mock.ExpectQuery(`INSERT INTO "authsrv_resourcerole"`).
+		WithArgs().WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow(ruuid))
+	mock.ExpectQuery(`SELECT "resourcepermission"."id" FROM "authsrv_resourcepermission" AS "resourcepermission" WHERE .name = 'ops_star.all'.`).
+		WithArgs().WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow(uuid.New().String()))
+	mock.ExpectQuery(`INSERT INTO "authsrv_resourcerolepermission"`).
+		WithArgs().WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow(uuid.New().String()))
+	mock.ExpectCommit()
+
+	role := &rolev3.Role{
+		Metadata: &v3.Metadata{Partner: "partner-" + puuid, Organization: "org-" + ouuid, Name: "role-" + ruuid},
+		Spec:     &rolev3.RoleSpec{IsGlobal: true, Scope: "system", Rolepermissions: []string{"ops_star.all"}},
+	}
+	role, err := rs.Create(context.Background(), role)
+	if err != nil {
+		t.Fatal("could not create group:", err)
+	}
+	performRoleBasicChecks(t, role, ruuid)
+
+}
+
 func TestCreateRoleWithPermissions(t *testing.T) {
 	db, mock := getDB(t)
 	defer db.Close()