feature/worker/permission syncer: perforce: sync HOST field using IP addresses#64010
Conversation
778f853 to
e0b1725
Compare
115ddad to
4ddb9ff
Compare
There was a problem hiding this comment.
This is the main test to pay attention to, as it tests ingesting non-wildcard IP addresses.
There was a problem hiding this comment.
Note that this test sets the IgnoreRulesWithHost to false - as we'll obviously skip over all of these rules if it was set to true.
Note that this is a larger point 1) IgnoreRulesWithHost must be false in order to enforce IP permissions 2) If IgnoreRulesWithHost was ever set to true in the past, we need to dump the existing sub_repo_permissions table since the existing set of saved rules might not be complete
Here is a linear issue about this:
https://linear.app/sourcegraph/issue/SRC-516/truncate-sub-repository-permissions-table-when-toggling
4ddb9ff to
9610c24
Compare
There was a problem hiding this comment.
This means dropping all subrepo perms after an upgrade, regardless of if the IP restrictions mode is on?
There was a problem hiding this comment.
9610c24 to
86e4045
Compare
…n fall back to original paths if ips not added yet (#64086) Closes https://linear.app/sourcegraph/issue/SRC-453/modify-the-perforce-authorization-provider-to-support-ip-aware-sub This PR builds on https://github.com/sourcegraph/sourcegraph/pull/64010, and enhances the re-insertion logic. Before, we'd fail the sync operation outright if we tried to re-insert existing permissions that hadn't been converted from the path only form to the (ip, path) tuple. Now, when trying to reinsert the existing permissions: - if it has already been converted (`(path, ip)`) -> we save it back in the database using the UpsertWithUP() method - if it hasn't been converted (`path` only) -> we save it back in the databse using the existing old plain Upsert method I accomplish this by using a small interface that encpasulates the data and the insertion logic to use: ```go type subRepoPermissionsUpserter interface { // UpsertWithSpec inserts or updates the sub-repository permissions with the data // stored in the upserter. UpsertWithSpec(ctx context.Context, store database.SubRepoPermsStore, userID int32, spec api.ExternalRepoSpec) error } type ipBasedPermissions struct { perms *authz.SubRepoPermissionsWithIPs } func (u *ipBasedPermissions) UpsertWithSpec(ctx context.Context, store database.SubRepoPermsStore, userID int32, spec api.ExternalRepoSpec) error { return store.UpsertWithSpecWithIPs(ctx, userID, spec, *u.perms) } type pathBasedPermissions struct { perms *authz.SubRepoPermissions } func (u *pathBasedPermissions) UpsertWithSpec(ctx context.Context, store database.SubRepoPermsStore, userID int32, spec api.ExternalRepoSpec) error { return store.UpsertWithSpec(ctx, userID, spec, *u.perms) } var ( _ subRepoPermissionsUpserter = &ipBasedPermissions{} _ subRepoPermissionsUpserter = &pathBasedPermissions{} ) ``` Now, any code that deals with inserting sub repo permissions now can deal with a `[]subRepoPermissionsUpserter` without having to care about the exact semantics to use. Our re-insertion logic is also now more robust. ## Test plan New unit tests ## Changelog <!-- OPTIONAL; info at https://www.notion.so/sourcegraph/Writing-a-changelog-entry-dd997f411d524caabf0d8d38a24a878c -->

The perforce permission syncer has been adapted to now read and save the HOST field from the perforce protections table, which contains the IP address(es) that the path rule that it applies to. It uses the updated sub_repository_rules store methods introduced in https://github.com/sourcegraph/sourcegraph/pull/63811/.
Notes
Test plan
The existing unit tests have been adapted to use the new authz.SubRepoPermissionsWithIP structs (I use wildcard IP addresses).
The big new test to pay attention to is TestScanIPPermissions (and the associated
sample-protects-ip.txtfile).Changelog