Cu 86c0bkuxc add a mechanism to migrate users from the old roles to new rbac roles

src/model/index.js

@@ -20,3 +20,4 @@ export * from './users'
 export * from './visualizer'
 export * from './metrics'
 export * from './passport'
+export * from './role'

src/model/role.js

@@ -137,7 +137,7 @@ const RoleSchema = new Schema({
 export const RoleModelAPI = connectionAPI.model('Role', RoleSchema)
 export const RoleModel = connectionDefault.model('Role', RoleSchema)
 
-const roles = {
+export const roles = {
   admin: {
     name: 'admin',
     permissions: {

src/upgradeDB.js

@@ -9,6 +9,8 @@ import {KeystoreModel} from './model/keystore'
 import {UserModel} from './model/users'
 import {VisualizerModel} from './model/visualizer'
 import {PassportModel} from './model/passport'
+import {RoleModel, roles} from './model/role'
+import {ChannelModel} from './model/channels'
 
 function dedupName(name, names, num) {
   let newName
@@ -295,6 +297,88 @@ upgradeFuncs.push({
   }
 })
 
+upgradeFuncs.push({
+  description: 'Create default roles with permissions and update user groups',
+  func() {
+    return new Promise(async (resolve, reject) => {
+      try {
+        // Fetch channels and get the role names with their associated channels
+        const channels = await ChannelModel.find()
+        const existingRoles = JSON.parse(JSON.stringify(roles)) // Deep clone the roles object
+
+        channels.forEach(channel => {
+          if (Array.isArray(channel.allow)) {
+            if (channel.txViewAcl && channel.txViewAcl.length > 0) {
+              channel.txViewAcl.forEach(role => {
+                if (!existingRoles[role]) {
+                  existingRoles[role] = { permissions: {} }
+                }
+                if (!existingRoles[role].permissions['transaction-view-specified']) {
+                  existingRoles[role].permissions['transaction-view-specified'] = []
+                }
+                existingRoles[role].permissions['transaction-view-specified'].push(channel.name)
+                if (!existingRoles[role].permissions['channel-view-specified']) {
+                  existingRoles[role].permissions['channel-view-specified'] = []
+                }
+                existingRoles[role].permissions['channel-view-specified'].push(channel.name)
+                existingRoles[role].permissions['client-view-all'] = true
+              })
+            }
+            if (channel.txRerunAcl && channel.txRerunAcl.length > 0) {
+              channel.txRerunAcl.forEach(role => {
+                if (!existingRoles[role]) {
+                  existingRoles[role] = { permissions: {} }
+                }
+                if (!existingRoles[role].permissions['transaction-rerun-specified']) {
+                  existingRoles[role].permissions['transaction-rerun-specified'] = []
+                }
+                existingRoles[role].permissions['transaction-rerun-specified'].push(channel.name)
+                if (!existingRoles[role].permissions['channel-view-specified']) {
+                  existingRoles[role].permissions['channel-view-specified'] = []
+                }
+                existingRoles[role].permissions['channel-view-specified'].push(channel.name)
+                existingRoles[role].permissions['client-view-all'] = true
+              })
+            }
+            if (channel.txViewFullAcl && channel.txViewFullAcl.length > 0) {
+              channel.txViewFullAcl.forEach(role => {
+                if (!existingRoles[role]) {
+                  existingRoles[role] = { permissions: {} }
+                }
+                if (!existingRoles[role].permissions['transaction-view-body-specified']) {
+                  existingRoles[role].permissions['transaction-view-body-specified'] = []
+                }
+                existingRoles[role].permissions['transaction-view-body-specified'].push(channel.name)
+                if (!existingRoles[role].permissions['channel-view-specified']) {
+                  existingRoles[role].permissions['channel-view-specified'] = []
+                }
+                existingRoles[role].permissions['channel-view-specified'].push(channel.name)
+                existingRoles[role].permissions['client-view-all'] = true
+              })
+            }
+          }
+        })
+
+        // Create or update roles
+        for (const [roleName, roleData] of Object.entries(existingRoles)) {
+          await RoleModel.findOneAndUpdate(
+            { name: roleName },
+            { name: roleName, permissions: roleData.permissions },
+            { upsert: true, new: true }
+          )
+          logger.info(`Role ${roleName} created or updated with permissions`)
+        }
+
+        logger.info('Successfully updated roles')
+        resolve()
+      } catch (err) {
+        logger.error(`Error updating roles: ${err}`)
+        reject(err)
+      }
+    })
+  }
+})
+
 if (process.env.NODE_ENV === 'test') {
   exports.upgradeFuncs = upgradeFuncs
   exports.dedupName = dedupName
@@ -305,8 +389,7 @@ async function upgradeDbInternal() {
     const dbVer =
       (await DbVersionModel.findOne()) ||
       new DbVersionModel({version: 0, lastUpdated: new Date()})
-    const upgradeFuncsToRun = upgradeFuncs.slice(dbVer.version)
-
+      const upgradeFuncsToRun = upgradeFuncs.slice(dbVer.version)
     for (const upgradeFunc of upgradeFuncsToRun) {
       await upgradeFunc.func()
       dbVer.version++

test/unit/upgradeDBTest.js

@@ -13,9 +13,11 @@ import {
   KeystoreModel,
   PassportModel,
   UserModel,
-  VisualizerModel
+  VisualizerModel,
+  RoleModel,
+  ChannelModel,
+  roles
 } from '../../src/model'
-
 describe('Upgrade DB Tests', () => {
   const originalUpgradeFuncs = [...upgradeDB.upgradeFuncs]
   upgradeDB.upgradeFuncs.length = 0
@@ -546,4 +548,94 @@ describe('Upgrade DB Tests', () => {
       passports.length.should.eql(2)
     })
   })
+
+  describe(`updateFunction4 - Create default roles with permissions`, () => {
+    const upgradeFunc = originalUpgradeFuncs[4].func
+
+    beforeEach(async () => {
+      await RoleModel.deleteMany({})
+      await ChannelModel.deleteMany({})
+    })
+
+    afterEach(async () => {
+      await RoleModel.deleteMany({})
+      await ChannelModel.deleteMany({})
+    })
+
+    it('should create default roles if they do not exist', async () => {
+      await upgradeFunc()
+
+      const existingRoles = await RoleModel.find()
+      existingRoles.length.should.be.exactly(Object.keys(roles).length)
+
+      const roleNames = existingRoles.map(r => r.name)
+      Object.keys(roles).forEach(roleName => {
+        roleNames.should.containEql(roleName)
+      })
+    })
+
+    it('should not create duplicate roles if they already exist', async () => {
+      await new RoleModel({name: 'admin', permissions: {}}).save()
+
+      await upgradeFunc()
+
+      const roles = await RoleModel.find()
+      roles.length.should.be.exactly(Object.keys(roles).length)
+
+      const adminRoles = roles.filter(r => r.name === 'admin')
+      adminRoles.length.should.be.exactly(1)
+    })
+
+    it('should set correct permissions for each role', async () => {
+      // Create test channels
+      const channel1 = await new ChannelModel({
+        name: 'Channel 1',
+        urlPattern: '/channel1',
+        allow: ['admin', 'manager'],
+        txViewAcl: ['admin'],
+        txRerunAcl: ['admin'],
+        txViewFullAcl: ['admin']
+      }).save()
+
+      const channel2 = await new ChannelModel({
+        name: 'Channel 2',
+        urlPattern: '/channel2',
+        allow: ['admin', 'manager', 'operator'],
+        txViewAcl: ['admin', 'manager', 'operator'],
+        txRerunAcl: ['admin'],
+        txViewFullAcl: ['admin']
+      }).save()
+
+      await upgradeFunc()
+
+      const createdRoles = await RoleModel.find()
+
+      for (const role of createdRoles) {
+        should.exist(role)
+
+        // Check default permissions
+        if (roles[role.name]) {
+          Object.entries(roles[role.name].permissions).forEach(([key, value]) => {
+            should(role.permissions[key]).eql(value)
+          })
+        }
+
+        // Check channel-specific permissions
+        if (role.name === 'admin') {
+          role.permissions['transaction-view-specified'].should.containEql('Channel 1')
+          role.permissions['transaction-view-specified'].should.containEql('Channel 2')
+          role.permissions['transaction-rerun-specified'].should.containEql('Channel 1')
+          role.permissions['transaction-rerun-specified'].should.containEql('Channel 2')
+          role.permissions['transaction-view-body-specified'].should.containEql('Channel 1')
+          role.permissions['transaction-view-body-specified'].should.containEql('Channel 2')
+        } else if (role.name === 'manager') {
+          role.permissions['transaction-view-specified'].should.not.containEql('Channel 1')
+          role.permissions['transaction-view-specified'].should.containEql('Channel 2')
+        } else if (role.name === 'operator') {
+          role.permissions['transaction-view-specified'].should.not.containEql('Channel 1')
+          role.permissions['transaction-view-specified'].should.containEql('Channel 2')
+        }
+      }
+    })
+  })
 })