Skip to content

Commit 12f4424

Browse files
bcmmbagabcmmbaga
authored
[management] Refactor group to use store methods (#2867)
* Refactor setup key handling to use store methods Signed-off-by: bcmmbaga <[email protected]> * add lock to get account groups Signed-off-by: bcmmbaga <[email protected]> * add check for regular user Signed-off-by: bcmmbaga <[email protected]> * get only required groups for auto-group validation Signed-off-by: bcmmbaga <[email protected]> * add account lock and return auto groups map on validation Signed-off-by: bcmmbaga <[email protected]> * refactor account peers update Signed-off-by: bcmmbaga <[email protected]> * Refactor groups to use store methods Signed-off-by: bcmmbaga <[email protected]> * refactor GetGroupByID and add NewGroupNotFoundError Signed-off-by: bcmmbaga <[email protected]> * fix tests Signed-off-by: bcmmbaga <[email protected]> * Add AddPeer and RemovePeer methods to Group struct Signed-off-by: bcmmbaga <[email protected]> * Preserve store engine in SqlStore transactions Signed-off-by: bcmmbaga <[email protected]> * Run groups ops in transaction Signed-off-by: bcmmbaga <[email protected]> * fix missing group removed from setup key activity Signed-off-by: bcmmbaga <[email protected]> * fix merge Signed-off-by: bcmmbaga <[email protected]> * fix merge Signed-off-by: bcmmbaga <[email protected]> * fix sonar Signed-off-by: bcmmbaga <[email protected]> * Change setup key log level to debug for missing group Signed-off-by: bcmmbaga <[email protected]> * Retrieve modified peers once for group events Signed-off-by: bcmmbaga <[email protected]> * Add tests Signed-off-by: bcmmbaga <[email protected]> * Add account locking and merge group deletion methods Signed-off-by: bcmmbaga <[email protected]> * Fix tests Signed-off-by: bcmmbaga <[email protected]> --------- Signed-off-by: bcmmbaga <[email protected]>
1 parent d9b691b commit 12f4424

22 files changed

+866
-323
lines changed

‎management/server/account.go

Lines changed: 14 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,6 @@ type AccountManager interface {
110110
SaveGroups(ctx context.Context, accountID, userID string, newGroups []*nbgroup.Group) error
111111
DeleteGroup(ctx context.Context, accountId, userId, groupID string) error
112112
DeleteGroups(ctx context.Context, accountId, userId string, groupIDs []string) error
113-
ListGroups(ctx context.Context, accountId string) ([]*nbgroup.Group, error)
114113
GroupAddPeer(ctx context.Context, accountId, groupID, peerID string) error
115114
GroupDeletePeer(ctx context.Context, accountId, groupID, peerID string) error
116115
GetPolicy(ctx context.Context, accountID, policyID, userID string) (*Policy, error)
@@ -1435,7 +1434,7 @@ func isNil(i idp.Manager) bool {
14351434
// addAccountIDToIDPAppMeta update user's app metadata in idp manager
14361435
func (am *DefaultAccountManager) addAccountIDToIDPAppMeta(ctx context.Context, userID string, accountID string) error {
14371436
if !isNil(am.idpManager) {
1438-
accountUsers, err := am.Store.GetAccountUsers(ctx, accountID)
1437+
accountUsers, err := am.Store.GetAccountUsers(ctx, LockingStrengthShare, accountID)
14391438
if err != nil {
14401439
return err
14411440
}
@@ -2083,7 +2082,7 @@ func (am *DefaultAccountManager) syncJWTGroups(ctx context.Context, accountID st
20832082
return fmt.Errorf("error saving groups: %w", err)
20842083
}
20852084

2086-
if err = transaction.IncrementNetworkSerial(ctx, accountID); err != nil {
2085+
if err = transaction.IncrementNetworkSerial(ctx, LockingStrengthUpdate, accountID); err != nil {
20872086
return fmt.Errorf("error incrementing network serial: %w", err)
20882087
}
20892088
}
@@ -2101,7 +2100,7 @@ func (am *DefaultAccountManager) syncJWTGroups(ctx context.Context, accountID st
21012100
}
21022101

21032102
for _, g := range addNewGroups {
2104-
group, err := am.Store.GetGroupByID(ctx, LockingStrengthShare, g, accountID)
2103+
group, err := am.Store.GetGroupByID(ctx, LockingStrengthShare, accountID, g)
21052104
if err != nil {
21062105
log.WithContext(ctx).Debugf("group %s not found while saving user activity event of account %s", g, accountID)
21072106
} else {
@@ -2114,7 +2113,7 @@ func (am *DefaultAccountManager) syncJWTGroups(ctx context.Context, accountID st
21142113
}
21152114

21162115
for _, g := range removeOldGroups {
2117-
group, err := am.Store.GetGroupByID(ctx, LockingStrengthShare, g, accountID)
2116+
group, err := am.Store.GetGroupByID(ctx, LockingStrengthShare, accountID, g)
21182117
if err != nil {
21192118
log.WithContext(ctx).Debugf("group %s not found while saving user activity event of account %s", g, accountID)
21202119
} else {
@@ -2127,14 +2126,19 @@ func (am *DefaultAccountManager) syncJWTGroups(ctx context.Context, accountID st
21272126
}
21282127

21292128
if settings.GroupsPropagationEnabled {
2130-
account, err := am.requestBuffer.GetAccountWithBackpressure(ctx, accountID)
2129+
removedGroupAffectsPeers, err := areGroupChangesAffectPeers(ctx, am.Store, accountID, removeOldGroups)
21312130
if err != nil {
2132-
return status.NewGetAccountError(err)
2131+
return err
21332132
}
21342133

2135-
if areGroupChangesAffectPeers(account, addNewGroups) || areGroupChangesAffectPeers(account, removeOldGroups) {
2134+
newGroupsAffectsPeers, err := areGroupChangesAffectPeers(ctx, am.Store, accountID, addNewGroups)
2135+
if err != nil {
2136+
return err
2137+
}
2138+
2139+
if removedGroupAffectsPeers || newGroupsAffectsPeers {
21362140
log.WithContext(ctx).Tracef("user %s: JWT group membership changed, updating account peers", claims.UserId)
2137-
am.updateAccountPeers(ctx, account)
2141+
am.updateAccountPeers(ctx, accountID)
21382142
}
21392143
}
21402144

@@ -2401,12 +2405,7 @@ func (am *DefaultAccountManager) CheckUserAccessByJWTGroups(ctx context.Context,
24012405

24022406
func (am *DefaultAccountManager) onPeersInvalidated(ctx context.Context, accountID string) {
24032407
log.WithContext(ctx).Debugf("validated peers has been invalidated for account %s", accountID)
2404-
updatedAccount, err := am.Store.GetAccount(ctx, accountID)
2405-
if err != nil {
2406-
log.WithContext(ctx).Errorf("failed to get account %s: %v", accountID, err)
2407-
return
2408-
}
2409-
am.updateAccountPeers(ctx, updatedAccount)
2408+
am.updateAccountPeers(ctx, accountID)
24102409
}
24112410

24122411
func (am *DefaultAccountManager) FindExistingPostureCheck(accountID string, checks *posture.ChecksDefinition) (*posture.Checks, error) {

‎management/server/account_test.go

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1413,11 +1413,13 @@ func TestAccountManager_NetworkUpdates_DeleteGroup(t *testing.T) {
14131413
updMsg := manager.peersUpdateManager.CreateChannel(context.Background(), peer1.ID)
14141414
defer manager.peersUpdateManager.CloseChannel(context.Background(), peer1.ID)
14151415

1416-
group := group.Group{
1416+
err := manager.SaveGroup(context.Background(), account.Id, userID, &group.Group{
14171417
ID: "groupA",
14181418
Name: "GroupA",
14191419
Peers: []string{peer1.ID, peer2.ID, peer3.ID},
1420-
}
1420+
})
1421+
1422+
require.NoError(t, err, "failed to save group")
14211423

14221424
policy := Policy{
14231425
Enabled: true,
@@ -1460,7 +1462,7 @@ func TestAccountManager_NetworkUpdates_DeleteGroup(t *testing.T) {
14601462
return
14611463
}
14621464

1463-
if err := manager.DeleteGroup(context.Background(), account.Id, "", group.ID); err != nil {
1465+
if err := manager.DeleteGroup(context.Background(), account.Id, userID, "groupA"); err != nil {
14641466
t.Errorf("delete group: %v", err)
14651467
return
14661468
}
@@ -2714,7 +2716,7 @@ func TestAccount_SetJWTGroups(t *testing.T) {
27142716
assert.NoError(t, err, "unable to get user")
27152717
assert.Len(t, user.AutoGroups, 0)
27162718

2717-
group1, err := manager.Store.GetGroupByID(context.Background(), LockingStrengthShare, "group1", "accountID")
2719+
group1, err := manager.Store.GetGroupByID(context.Background(), LockingStrengthShare, "accountID", "group1")
27182720
assert.NoError(t, err, "unable to get group")
27192721
assert.Equal(t, group1.Issued, group.GroupIssuedAPI, "group should be api issued")
27202722
})
@@ -2734,7 +2736,7 @@ func TestAccount_SetJWTGroups(t *testing.T) {
27342736
assert.NoError(t, err, "unable to get user")
27352737
assert.Len(t, user.AutoGroups, 1)
27362738

2737-
group1, err := manager.Store.GetGroupByID(context.Background(), LockingStrengthShare, "group1", "accountID")
2739+
group1, err := manager.Store.GetGroupByID(context.Background(), LockingStrengthShare, "accountID", "group1")
27382740
assert.NoError(t, err, "unable to get group")
27392741
assert.Equal(t, group1.Issued, group.GroupIssuedAPI, "group should be api issued")
27402742
})

‎management/server/dns.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -146,7 +146,7 @@ func (am *DefaultAccountManager) SaveDNSSettings(ctx context.Context, accountID
146146
}
147147

148148
if anyGroupHasPeers(account, addedGroups) || anyGroupHasPeers(account, removedGroups) {
149-
am.updateAccountPeers(ctx, account)
149+
am.updateAccountPeers(ctx, accountID)
150150
}
151151

152152
return nil

0 commit comments

Comments
 (0)