added RocketAdmin::ActionEvent permissions#1795
Merged
Merged
Conversation
|
Caution Review failedPull request was closed or merged during review 📝 WalkthroughWalkthroughThis PR introduces Cedar authorization support for custom action event trigger permissions. It adds a new ChangesCustom Action Event Trigger Permissions
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ESLint
ESLint skipped: no ESLint configuration detected in root package.json. To enable, add Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
There was a problem hiding this comment.
Pull request overview
This pull request introduces a dedicated Cedar permission for triggering custom action events (ActionEvent), wires it into the action activation endpoint via a new guard, and updates permission modeling/policy generation/parsing accordingly so triggering can be granted independently of table visibility/read permissions.
Changes:
- Add
ActionEventas a Cedar resource type withactionEvent:triggerauthorization, including policy generation/parsing and entity construction. - Protect
POST /event/actions/activate/:eventId/:connectionIdwith a newActionEventTriggerGuardand remove the previous “must be able to read table” check from the activation use case. - Extend permission DTOs/interfaces to support
triggerCustomActionand per-event trigger grants, and update e2e tests to reflect the new permission shape and guard behavior.
Reviewed changes
Copilot reviewed 54 out of 54 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| backend/test/ava-tests/saas-tests/table-redis-e2e.test.ts | Update expected table permission key count to include new permission flag. |
| backend/test/ava-tests/saas-tests/table-redis-agent-e2e.test.ts | Update expected table permission key count to include new permission flag. |
| backend/test/ava-tests/saas-tests/table-postgres-schema-e2e.test.ts | Update expected table permission key count to include new permission flag. |
| backend/test/ava-tests/saas-tests/table-postgres-encrypted-e2e.test.ts | Update expected table permission key count to include new permission flag. |
| backend/test/ava-tests/saas-tests/table-postgres-e2e.test.ts | Update expected table permission key count to include new permission flag. |
| backend/test/ava-tests/saas-tests/table-postgres-agent-e2e.test.ts | Update expected table permission key count to include new permission flag. |
| backend/test/ava-tests/saas-tests/table-oracledb-schema-e2e.test.ts | Update expected table permission key count to include new permission flag. |
| backend/test/ava-tests/saas-tests/table-oracledb-e2e.test.ts | Update expected table permission key count to include new permission flag. |
| backend/test/ava-tests/saas-tests/table-oracle-agent-e2e.test.ts | Update expected table permission key count to include new permission flag. |
| backend/test/ava-tests/saas-tests/table-mysql-e2e.test.ts | Update expected table permission key count to include new permission flag. |
| backend/test/ava-tests/saas-tests/table-mysql-agent-e2e.test.ts | Update expected table permission key count to include new permission flag. |
| backend/test/ava-tests/saas-tests/table-mssql-schema-e2e.test.ts | Update expected table permission key count to include new permission flag. |
| backend/test/ava-tests/saas-tests/table-mssql-e2e.test.ts | Update expected table permission key count to include new permission flag. |
| backend/test/ava-tests/saas-tests/table-mssql-agent-e2e.test.ts | Update expected table permission key count to include new permission flag. |
| backend/test/ava-tests/saas-tests/table-mongodb-e2e.test.ts | Update expected table permission key count to include new permission flag. |
| backend/test/ava-tests/saas-tests/table-mongodb-agent-e2e.test.ts | Update expected table permission key count to include new permission flag. |
| backend/test/ava-tests/saas-tests/table-ibmdb2-e2e.test.ts | Update expected table permission key count to include new permission flag. |
| backend/test/ava-tests/saas-tests/table-ibmdb2-agent-e2e.test.ts | Update expected table permission key count to include new permission flag. |
| backend/test/ava-tests/saas-tests/table-elasticsearch-e2e.test.ts | Update expected table permission key count to include new permission flag. |
| backend/test/ava-tests/saas-tests/table-dynamodb-e2e.test.ts | Update expected table permission key count to include new permission flag. |
| backend/test/ava-tests/saas-tests/table-clickhouse-e2e.test.ts | Update expected table permission key count to include new permission flag. |
| backend/test/ava-tests/saas-tests/table-clickhouse-agent-e2e.test.ts | Update expected table permission key count to include new permission flag. |
| backend/test/ava-tests/saas-tests/table-cassandra.e2e.test.ts | Update expected table permission key count to include new permission flag. |
| backend/test/ava-tests/saas-tests/table-cassandra-agent.e2e.test.ts | Update expected table permission key count to include new permission flag. |
| backend/test/ava-tests/saas-tests/connection-properties-e2e.test.ts | Update expected permissions key count in connection properties response. |
| backend/test/ava-tests/saas-tests/api-key-e2e.test.ts | Update expected permissions key count when using API key flows. |
| backend/test/ava-tests/saas-tests/action-rules-e2e.test.ts | Add new e2e coverage for ActionEvent trigger authorization (owner, table-level, per-event grants, negative cases). |
| backend/test/ava-tests/non-saas-tests/non-saas-table-redis-e2e.test.ts | Update expected table permission key count to include new permission flag. |
| backend/test/ava-tests/non-saas-tests/non-saas-table-postgres-schema-e2e.test.ts | Update expected table permission key count to include new permission flag. |
| backend/test/ava-tests/non-saas-tests/non-saas-table-postgres-encrypted-e2e.test.ts | Update expected table permission key count to include new permission flag. |
| backend/test/ava-tests/non-saas-tests/non-saas-table-oracledb-schema-e2e.test.ts | Update expected table permission key count to include new permission flag. |
| backend/test/ava-tests/non-saas-tests/non-saas-table-oracledb-e2e.test.ts | Update expected table permission key count to include new permission flag. |
| backend/test/ava-tests/non-saas-tests/non-saas-table-mysql-e2e.test.ts | Update expected table permission key count to include new permission flag. |
| backend/test/ava-tests/non-saas-tests/non-saas-table-mssql-schema-e2e.test.ts | Update expected table permission key count to include new permission flag. |
| backend/test/ava-tests/non-saas-tests/non-saas-table-mssql-e2e.test.ts | Update expected table permission key count to include new permission flag. |
| backend/test/ava-tests/non-saas-tests/non-saas-table-mongodb-e2e.test.ts | Update expected table permission key count to include new permission flag. |
| backend/test/ava-tests/non-saas-tests/non-saas-table-ibmdb2-e2e.test.ts | Update expected table permission key count to include new permission flag. |
| backend/test/ava-tests/non-saas-tests/non-saas-table-cassandra.e2e.test.ts | Update expected table permission key count to include new permission flag. |
| backend/src/guards/action-event-trigger.guard.ts | New guard: resolves ActionEvent in-connection and enforces Cedar actionEvent:trigger. |
| backend/src/entities/table-actions/table-action-rules-module/use-cases/activate-actions-in-rule.use.case.ts | Remove table-read permission gate (authorization moved to trigger-specific guard). |
| backend/src/entities/table-actions/table-action-rules-module/action-rules.controller.ts | Apply ActionEventTriggerGuard to action activation endpoint. |
| backend/src/entities/table-actions/table-action-events-module/repository/action-events-custom-repository.interface.ts | Add repository contract for finding an event by id within a connection. |
| backend/src/entities/table-actions/table-action-events-module/repository/action-events-custom-repository.extension.ts | Implement findEventByIdInConnection query used by the new guard. |
| backend/src/entities/permission/use-cases/create-or-update-permissions.use.case.ts | Ensure actionEvents permissions are persisted into the policy generation input. |
| backend/src/entities/permission/permission.interface.ts | Extend permission model with triggerCustomAction and per-event actionEvents grants. |
| backend/src/entities/permission/application/data-structures/create-permissions.ds.ts | Add DTO validation/schema for triggerCustomAction and actionEvents permissions. |
| backend/src/entities/cedar-authorization/cedar-schema.ts | Add Cedar ActionEvent entity type and actionEvent:trigger action. |
| backend/src/entities/cedar-authorization/cedar-schema.json | Keep JSON Cedar schema in sync with TS schema for ActionEvent. |
| backend/src/entities/cedar-authorization/cedar-policy-parser.ts | Parse actionEvent:trigger permits into classical permissions (table-level and per-event). |
| backend/src/entities/cedar-authorization/cedar-policy-generator.ts | Generate Cedar permits for table-level and per-event action event triggering. |
| backend/src/entities/cedar-authorization/cedar-permissions.service.ts | Compute triggerCustomAction in returned table permissions and add action-event trigger checks. |
| backend/src/entities/cedar-authorization/cedar-entity-builder.ts | Build ActionEvent Cedar entities parented by table to support resource in Table policies. |
| backend/src/entities/cedar-authorization/cedar-authorization.service.ts | Extend validation to support ActionEvent resource evaluation. |
| backend/src/entities/cedar-authorization/cedar-action-map.ts | Add ActionEventTrigger action, ActionEvent resource type, and probe constant. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+1435
to
+1437
| const owner = await registerUserAndReturnUserInfo(app); | ||
| const invitee = await inviteUserInCompanyAndAcceptInvitation(owner.token, 'USER', app, undefined); | ||
|
|
Comment on lines
+1506
to
+1507
| if (status > 201) { | ||
| throw new Error(`Expected 2xx, got ${status}`); |
Comment on lines
+1485
to
+1492
| const groupId = JSON.parse(createGroupResult.text).id; | ||
|
|
||
| await request(app.getHttpServer()) | ||
| .put('/group/user') | ||
| .set('Cookie', owner.token) | ||
| .send({ groupId, email: invitee.email }) | ||
| .set('Content-Type', 'application/json') | ||
| .set('Accept', 'application/json'); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
New Features
Tests