feat: add authoritative resource to manage grants for an object (#173)

observeinc · Dec 5, 2024 · d23ae96 · d23ae96
1 parent 526a97b
commit d23ae96
Show file tree

Hide file tree

Showing 12 changed files with 1,015 additions and 86 deletions.
diff --git a/client/api.go b/client/api.go
@@ -1308,6 +1308,20 @@ func (c *Client) DeleteRbacStatement(ctx context.Context, id string) error {
 	return c.Meta.DeleteRbacStatement(ctx, id)
 }
 
+// MutateRbacStatements
+func (c *Client) MutateRbacStatements(ctx context.Context, toCreate []meta.RbacStatementInput, toUpdate []meta.UpdateRbacStatementInput, toDelete []string) (*meta.MutateRbacStatementsResponse, error) {
+	if !c.Flags[flagObs2110] {
+		c.obs2110.Lock()
+		defer c.obs2110.Unlock()
+	}
+	return c.Meta.MutateRbacStatements(ctx, toCreate, toUpdate, toDelete)
+}
+
+// GetRbacResourceStatements gets all statements for the given objects
+func (c *Client) GetRbacResourceStatements(ctx context.Context, ids []string) ([]meta.RbacStatement, error) {
+	return c.Meta.GetRbacResourceStatements(ctx, ids)
+}
+
 // GetRbacStatement by ID
 func (c *Client) GetRbacStatement(ctx context.Context, id string) (*meta.RbacStatement, error) {
 	return c.Meta.GetRbacStatement(ctx, id)

diff --git a/client/internal/meta/operation/rbac_statement.graphql b/client/internal/meta/operation/rbac_statement.graphql
@@ -19,6 +19,16 @@ fragment RbacStatement on RbacStatement {
         version
 }
 
+fragment MutateRbacStatementsResponse on MutateRbacStatementsResponse {
+    createdStatements {
+        ...RbacStatement
+    }
+    updatedStatements {
+        ...RbacStatement
+    }
+    deletedStatements
+}
+
 mutation createRbacStatement($config: RbacStatementInput!) {
     # @genqlient(flatten: true)
     rbacStatement: createRbacStatement(input: $config) {
@@ -46,3 +56,17 @@ mutation deleteRbacStatement($id: ORN!) {
         ...ResultStatus
     }
 }
+
+mutation mutateRbacStatements($toCreate: [RbacStatementInput!], $toUpdate:[UpdateRbacStatementInput!], $toDelete: [ORN!]) {
+    # @genqlient(flatten: true)
+    mutateRbacStatements: mutateRbacStatements(toCreate: $toCreate, toUpdate: $toUpdate, toDelete: $toDelete) {
+        ...MutateRbacStatementsResponse
+    }
+}
+
+query getRbacResourceStatements($ids: [ObjectId!]!) {
+    # @genqlient(flatten: true)
+    rbacResourceStatements: rbacResourceStatements(ids: $ids) {
+        ...RbacStatement
+    }
+}