Skip to content
This repository was archived by the owner on Sep 30, 2024. It is now read-only.

feature/worker/permission syncer: perforce: sync HOST field using IP addresses#64010

Merged
ggilmore merged 1 commit into
mainfrom
graphite-ggilmorewip_sync_p4_ip
Jul 30, 2024
Merged

feature/worker/permission syncer: perforce: sync HOST field using IP addresses#64010
ggilmore merged 1 commit into
mainfrom
graphite-ggilmorewip_sync_p4_ip

Conversation

@ggilmore

@ggilmore ggilmore commented Jul 23, 2024

Copy link
Copy Markdown
Contributor

The perforce permission syncer has been adapted to now read and save the HOST field from the perforce protections table, which contains the IP address(es) that the path rule that it applies to. It uses the updated sub_repository_rules store methods introduced in https://github.com/sourcegraph/sourcegraph/pull/63811/.

Notes

  • There is some existing logic in the permissions syncer that attempts to re-insert the existing sub_repo_permissions if we encounter a temporary (timeout, etc.) error when syncing. However, there is an edge case: what do we do if the existing permissions don't have an IP address associated with them yet (they were inserted before the updated permission syncer ran)? For simplicity, in this PR I leaned towawrds correctness - I fail the operation outright (I'd rather temporarirly lock someone out rather than accidentally leak information). I implemented a more robust straetgy for this in https://github.com/sourcegraph/sourcegraph/pull/64086.

Test plan

  • The existing unit tests have been adapted to use the new authz.SubRepoPermissionsWithIP structs (I use wildcard IP addresses).

  • The big new test to pay attention to is TestScanIPPermissions (and the associated sample-protects-ip.txt file).

Changelog

  • The perforce permissions syncer has been updated to save the IP address associated with each sub_repository_permissions rule.

@cla-bot cla-bot Bot added the cla-signed label Jul 23, 2024
@github-actions github-actions Bot added team/product-platform team/source Tickets under the purview of Source - the one Source to graph it all labels Jul 23, 2024

ggilmore commented Jul 23, 2024

Copy link
Copy Markdown
Contributor Author

@ggilmore ggilmore force-pushed the graphite-ggilmorewip_sync_p4_ip branch 4 times, most recently from 778f853 to e0b1725 Compare July 25, 2024 17:10
@ggilmore ggilmore force-pushed the graphite-ggilmorewip_sync_p4_ip branch 3 times, most recently from 115ddad to 4ddb9ff Compare July 26, 2024 09:48
@ggilmore ggilmore changed the title wip sync p4 ip feature/worker/ Jul 28, 2024
@ggilmore ggilmore changed the title feature/worker/ feature/worker/permission syncer: perforce sync HOST field using IP addresses Jul 28, 2024
@ggilmore ggilmore changed the title feature/worker/permission syncer: perforce sync HOST field using IP addresses feature/worker/permission syncer: perforce: sync HOST field using IP addresses Jul 28, 2024

@ggilmore ggilmore Jul 28, 2024

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is the main test to pay attention to, as it tests ingesting non-wildcard IP addresses.

@ggilmore ggilmore Jul 28, 2024

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note that this test sets the IgnoreRulesWithHost to false - as we'll obviously skip over all of these rules if it was set to true.

Note that this is a larger point 1) IgnoreRulesWithHost must be false in order to enforce IP permissions 2) If IgnoreRulesWithHost was ever set to true in the past, we need to dump the existing sub_repo_permissions table since the existing set of saved rules might not be complete

Here is a linear issue about this:

https://linear.app/sourcegraph/issue/SRC-516/truncate-sub-repository-permissions-table-when-toggling

@ggilmore ggilmore marked this pull request as ready for review July 29, 2024 08:39
@ggilmore ggilmore requested a review from a team July 29, 2024 08:39
Comment thread cmd/worker/internal/authz/perms_syncer.go Outdated

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This means dropping all subrepo perms after an upgrade, regardless of if the IP restrictions mode is on?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ggilmore ggilmore force-pushed the graphite-ggilmorewip_sync_p4_ip branch from 9610c24 to 86e4045 Compare July 29, 2024 22:11

ggilmore commented Jul 30, 2024

Copy link
Copy Markdown
Contributor Author

Merge activity

  • Jul 30, 10:40 AM EDT: @ggilmore started a stack merge that includes this pull request via Graphite.
  • Jul 30, 10:41 AM EDT: @ggilmore merged this pull request with Graphite.

@ggilmore ggilmore merged commit 70b31c9 into main Jul 30, 2024
@ggilmore ggilmore deleted the graphite-ggilmorewip_sync_p4_ip branch July 30, 2024 14:41
ggilmore referenced this pull request Jul 30, 2024
…n fall back to original paths if ips not added yet (#64086)

Closes https://linear.app/sourcegraph/issue/SRC-453/modify-the-perforce-authorization-provider-to-support-ip-aware-sub

This PR builds on https://github.com/sourcegraph/sourcegraph/pull/64010, and enhances the re-insertion logic.

Before, we'd fail the sync operation outright if we tried to re-insert existing permissions that hadn't been converted from the path only form to the (ip, path) tuple.

Now, when trying to reinsert the existing permissions:

- if it has already been converted (`(path, ip)`) -> we save it back in the database using the UpsertWithUP() method
- if it hasn't been converted (`path` only) -> we save it back in the databse using the existing old plain Upsert method

I accomplish this by using a small interface that encpasulates the data and the insertion logic to use:

```go
type subRepoPermissionsUpserter interface {
	// UpsertWithSpec inserts or updates the sub-repository permissions with the data
	// stored in the upserter.
	UpsertWithSpec(ctx context.Context, store database.SubRepoPermsStore, userID int32, spec api.ExternalRepoSpec) error
}

type ipBasedPermissions struct {
	perms *authz.SubRepoPermissionsWithIPs
}

func (u *ipBasedPermissions) UpsertWithSpec(ctx context.Context, store database.SubRepoPermsStore, userID int32, spec api.ExternalRepoSpec) error {
	return store.UpsertWithSpecWithIPs(ctx, userID, spec, *u.perms)
}

type pathBasedPermissions struct {
	perms *authz.SubRepoPermissions
}

func (u *pathBasedPermissions) UpsertWithSpec(ctx context.Context, store database.SubRepoPermsStore, userID int32, spec api.ExternalRepoSpec) error {
	return store.UpsertWithSpec(ctx, userID, spec, *u.perms)
}

var (
	_ subRepoPermissionsUpserter = &ipBasedPermissions{}
	_ subRepoPermissionsUpserter = &pathBasedPermissions{}
)
```

Now, any code that deals with inserting sub repo permissions now can deal with a `[]subRepoPermissionsUpserter` without having to care about the exact semantics to use. Our re-insertion logic is also now more robust. 

## Test plan

New unit tests

## Changelog

<!-- OPTIONAL; info at https://www.notion.so/sourcegraph/Writing-a-changelog-entry-dd997f411d524caabf0d8d38a24a878c -->
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

cla-signed team/product-platform team/source Tickets under the purview of Source - the one Source to graph it all

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants