-
Notifications
You must be signed in to change notification settings - Fork 3.1k
feat(roles): add roles feature to DataHub #5767
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat(roles): add roles feature to DataHub #5767
Conversation
2cf3ade
to
8eadb61
Compare
8eadb61
to
be65768
Compare
Unit Test Results (metadata ingestion) 7 files ±0 7 suites ±0 55m 42s ⏱️ + 2m 2s For more details on these failures, see this check. Results for commit 78a0d27. ± Comparison against base commit 134ca67. ♻️ This comment has been updated with latest results. |
datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/GmsGraphQLEngine.java
Outdated
Show resolved
Hide resolved
datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/GmsGraphQLEngine.java
Outdated
Show resolved
Hide resolved
...c/main/java/com/linkedin/datahub/graphql/resolvers/role/BatchAssignRoleToActorsResolver.java
Outdated
Show resolved
Hide resolved
...c/main/java/com/linkedin/datahub/graphql/resolvers/role/BatchAssignRoleToActorsResolver.java
Outdated
Show resolved
Hide resolved
...c/main/java/com/linkedin/datahub/graphql/resolvers/role/BatchAssignRoleToActorsResolver.java
Outdated
Show resolved
Hide resolved
...c/main/java/com/linkedin/datahub/graphql/resolvers/role/BatchAssignRoleToActorsResolver.java
Outdated
Show resolved
Hide resolved
...-core/src/main/java/com/linkedin/datahub/graphql/types/common/mappers/UrnToEntityMapper.java
Show resolved
Hide resolved
|
||
assertTrue(_resolver.get(_dataFetchingEnvironment).join()); | ||
// Both actors exist and should be assigned to the role | ||
verify(_entityClient, times(2)).ingestProposal(any(), any()); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Minor: can we do better than "any()" comparisons here?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Added checks for authentication, the proposal might be a bit harder...
const displayName = entityRegistry.getDisplayName(EntityType.CorpUser, user); | ||
const isNativeUser: boolean = user.isNativeUser as boolean; | ||
const shouldShowPasswordReset: boolean = canManageUserCredentials && isNativeUser; | ||
const userRelationships = user.relationships?.relationships; | ||
const userRole = userRelationships && userRelationships.length > 0 && (userRelationships[0]?.entity as DataHubRole); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm slightly confused by this - why are we finding the userRole inside userRelationships?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
oh are you saying we should just resolve the role on the graphql side and not in relationships? this is the same pattern as groups. This implementation also might be confusing since right now we're enforcing the invariant of a single role but it could be a list in the future
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yeah I feel that since we have RoleMembership we should have a roleMembershiip field on the user in the long run
datahub-web-react/src/app/identity/user/ViewAssignRoleModal.tsx
Outdated
Show resolved
Hide resolved
datahub-web-react/src/app/permissions/policy/ManagePolicies.tsx
Outdated
Show resolved
Hide resolved
metadata-service/auth-impl/src/main/java/com/datahub/authorization/PolicyEngine.java
Outdated
Show resolved
Hide resolved
metadata-service/auth-impl/src/main/java/com/datahub/authorization/PolicyEngine.java
Outdated
Show resolved
Hide resolved
metadata-service/auth-impl/src/test/java/com/datahub/authorization/PolicyEngineTest.java
Show resolved
Hide resolved
metadata-service/factories/src/main/java/com/linkedin/metadata/boot/steps/IngestRolesStep.java
Outdated
Show resolved
Hide resolved
metadata-service/factories/src/main/java/com/linkedin/metadata/boot/steps/IngestRolesStep.java
Outdated
Show resolved
Hide resolved
be65768
to
0d1e8fa
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Just a few things remaining..
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks Aditya!
Screenshots
New Permissions Screen with Roles

Batch Assigning a Role

Popup when Viewing a Role

Popup when Viewing a Policy

User List

User List when Assigning a Role

User Profile with Role Indicated

Checklist