src/main/resources/db/changelog/050-rbac-base.sql

@@ -440,27 +440,9 @@ select uuid
     where p.objectUuid = forObjectUuid
       and p.op in ('*', forOp)
 $$;
+
 --//
 
-
--- ============================================================================
---changeset rbac-base-duplicate-role-grant-exception:1 endDelimiter:--//
--- ----------------------------------------------------------------------------
-
-create or replace procedure raiseDuplicateRoleGrantException(subRoleId uuid, superRoleId uuid)
-    language plpgsql as $$
-declare
-    subRoleIdName text;
-    superRoleIdName text;
-begin
-    select roleIdName from rbacRole_ev where uuid=subRoleId into subRoleIdName;
-    select roleIdName from rbacRole_ev where uuid=superRoleId into superRoleIdName;
-    raise exception '[400] Duplicate role grant detected: role % (%) already granted to % (%)', subRoleId, subRoleIdName, superRoleId, superRoleIdName;
-end;
-$$;
---//
-
-
 -- ============================================================================
 --changeset rbac-base-GRANTS:1 endDelimiter:--//
 -- ----------------------------------------------------------------------------
@@ -593,7 +575,7 @@ begin
     perform assertReferenceType('subRoleId (descendant)', subRoleId, 'RbacRole');
 
     if isGranted(subRoleId, superRoleId) then
-        call raiseDuplicateRoleGrantException(subRoleId, superRoleId);
+        raise exception '[400] Cyclic role grant detected between % and %', subRoleId, superRoleId;
     end if;
 
     insert
@@ -616,7 +598,7 @@ begin
     perform assertReferenceType('subRoleId (descendant)', subRoleId, 'RbacRole');
 
     if isGranted(subRoleId, superRoleId) then
-        call raiseDuplicateRoleGrantException(subRoleId, superRoleId);
+        raise exception '[400] Cyclic role grant detected between % and %', subRoleId, superRoleId;
     end if;
 
     insert
@@ -639,7 +621,7 @@ begin
     perform assertReferenceType('subRoleId (descendant)', subRoleId, 'RbacRole');
 
     if isGranted(subRoleId, superRoleId) then
-        call raiseDuplicateRoleGrantException(subRoleId, superRoleId);
+        raise exception '[400] Cyclic role grant detected between % and %', subRoleId, superRoleId;
     end if;
 
     insert

src/main/resources/db/changelog/223-hs-office-relationship-rbac.md

@@ -10,62 +10,183 @@ subgraph global
     role:global.admin[global.admin]    
 end
 
-subgraph anchorPerson
+subgraph hsOfficeContact
     direction TB
-    style anchorPerson fill:#eee
+    style hsOfficeContact fill:#eee
     
-    role:anchorPerson.owner[anchorPerson.owner]    
+    role:hsOfficeContact.admin[contact.admin]    
-    --> role:anchorPerson.admin[anchorPerson.admin]    
+    --> role:hsOfficeContact.tenant[contact.tenant]    
-    --> role:anchorPerson.referrer[anchorPerson.referrer]    
+    --> role:hsOfficeContact.guest[contact.guest]    
 end
 
-subgraph holderPerson
+subgraph hsOfficePerson
     direction TB
-    style holderPerson fill:#eee
+    style hsOfficePerson fill:#eee
     
-    role:holderPerson.owner[holderPerson.owner]
+    role:hsOfficePerson.admin[person.admin]    
-    --> role:holderPerson.admin[holderPerson.admin]
+    --> role:hsOfficePerson.tenant[person.tenant]    
-    --> role:holderPerson.referrer[holderPerson.referrer]
+    --> role:hsOfficePerson.guest[person.guest]    
 end
 
-subgraph contact
+subgraph hsOfficeRelationship
-    direction TB
-    style contact fill:#eee
 
-    role:contact.owner[contact.admin]
+    role:hsOfficePerson#relAnchor.admin[person#anchor.admin]
-    --> role:contact.admin[contact.admin]
+    --- role:hsOfficePerson.admin
-    --> role:contact.referrer[contact.referrer]
-end
        
-subgraph relationship
+   role:hsOfficeRelationship.owner[relationship.owner]
-
+   %% permissions
-    role:relationship.owner[relationship.owner]
+       role:hsOfficeRelationship.owner --> perm:hsOfficeRelationship.*{{relationship.*}}
-    %% permissions
+   %% incoming
-        role:relationship.owner --> perm:relationship.*{{relationship.*}}
+       role:global.admin ---> role:hsOfficeRelationship.owner
-    %% incoming
+       role:hsOfficePersonAdmin#relAnchor.admin
-        role:global.admin ---> role:relationship.owner
-       
-    role:relationship.admin[relationship.admin]
-    %% permissions
-        role:relationship.admin --> perm:relationship.edit{{relationship.edit}}
-    %% incoming
-        role:relationship.owner --> role:relationship.admin
-        role:anchorPerson.admin --> role:relationship.admin
-        
-    role:relationship.agent[relationship.agent]
-    %% incoming
-        role:relationship.admin --> role:relationship.agent
-        role:holderPerson.admin --> role:relationship.agent
-        role:contact.admin --> role:relationship.agent
-
-    role:relationship.tenant[relationship.tenant]
-    %% permissions
-        role:relationship.tenant --> perm:relationship.view{{relationship.view}}
-    %% incoming
-        role:relationship.agent --> role:relationship.tenant
-    %% outgoing
-        role:relationship.tenant --> role:anchorPerson.referrer
-        role:relationship.tenant --> role:holderPerson.referrer
-        role:relationship.tenant --> role:contact.referrer
 end
 ```
+
+    if TG_OP = 'INSERT' then
+
+        -- the owner role with full access for admins of the relAnchor global admins
+        ownerRole = createRole(
+                hsOfficeRelationshipOwner(NEW),
+                grantingPermissions(forObjectUuid => NEW.uuid, permitOps => array ['*']),
+                beneathRoles(array[
+                    globalAdmin(),
+                    hsOfficePersonAdmin(newRelAnchor)])
+            );
+
+        -- the admin role with full access for the owner
+        adminRole = createRole(
+                hsOfficeRelationshipAdmin(NEW),
+                grantingPermissions(forObjectUuid => NEW.uuid, permitOps => array ['edit']),
+                beneathRole(ownerRole)
+            );
+
+        -- the tenant role for those related users who can view the data
+        perform createRole(
+                hsOfficeRelationshipTenant,
+                grantingPermissions(forObjectUuid => NEW.uuid, permitOps => array ['view']),
+                beneathRoles(array[
+                    hsOfficePersonAdmin(newRelAnchor),
+                    hsOfficePersonAdmin(newRelHolder),
+                    hsOfficeContactAdmin(newContact)]),
+                withSubRoles(array[
+                    hsOfficePersonTenant(newRelAnchor),
+                    hsOfficePersonTenant(newRelHolder),
+                    hsOfficeContactTenant(newContact)])
+            );
+
+        -- anchor and holder admin roles need each others tenant role
+        -- to be able to see the joined relationship
+        call grantRoleToRole(hsOfficePersonTenant(newRelAnchor), hsOfficePersonAdmin(newRelHolder));
+        call grantRoleToRole(hsOfficePersonTenant(newRelHolder), hsOfficePersonAdmin(newRelAnchor));
+        call grantRoleToRoleIfNotNull(hsOfficePersonTenant(newRelHolder), hsOfficeContactAdmin(newContact));
+
+    elsif TG_OP = 'UPDATE' then
+
+        if OLD.contactUuid <> NEW.contactUuid then
+            -- nothing but the contact can be updated,
+            -- in other cases, a new relationship needs to be created and the old updated
+
+            select * from hs_office_contact as c where c.uuid = OLD.contactUuid into oldContact;
+
+            call revokeRoleFromRole( hsOfficeRelationshipTenant, hsOfficeContactAdmin(oldContact) );
+            call grantRoleToRole( hsOfficeRelationshipTenant, hsOfficeContactAdmin(newContact) );
+
+            call revokeRoleFromRole( hsOfficeContactTenant(oldContact), hsOfficeRelationshipTenant );
+            call grantRoleToRole( hsOfficeContactTenant(newContact), hsOfficeRelationshipTenant );
+        end if;
+    else
+        raise exception 'invalid usage of TRIGGER';
+    end if;
+
+    return NEW;
+end; $$;
+
+/*
+    An AFTER INSERT TRIGGER which creates the role structure for a new customer.
+ */
+create trigger createRbacRolesForHsOfficeRelationship_Trigger
+    after insert
+    on hs_office_relationship
+    for each row
+execute procedure hsOfficeRelationshipRbacRolesTrigger();
+
+/*
+    An AFTER UPDATE TRIGGER which updates the role structure of a customer.
+ */
+create trigger updateRbacRolesForHsOfficeRelationship_Trigger
+    after update
+    on hs_office_relationship
+    for each row
+execute procedure hsOfficeRelationshipRbacRolesTrigger();
+--//
+
+
+-- ============================================================================
+--changeset hs-office-relationship-rbac-IDENTITY-VIEW:1 endDelimiter:--//
+-- ----------------------------------------------------------------------------
+call generateRbacIdentityView('hs_office_relationship', $idName$
+    (select idName from hs_office_person_iv p where p.uuid = target.relAnchorUuid)
+    || '-with-' || target.relType || '-' ||
+    (select idName from hs_office_person_iv p where p.uuid = target.relHolderUuid)
+    $idName$);
+--//
+
+
+-- ============================================================================
+--changeset hs-office-relationship-rbac-RESTRICTED-VIEW:1 endDelimiter:--//
+-- ----------------------------------------------------------------------------
+call generateRbacRestrictedView('hs_office_relationship',
+    '(select idName from hs_office_person_iv p where p.uuid = target.relHolderUuid)',
+    $updates$
+        contactUuid = new.contactUuid
+    $updates$);
+--//
+
+-- TODO: exception if one tries to amend any other column
+
+
+-- ============================================================================
+--changeset hs-office-relationship-rbac-NEW-RELATHIONSHIP:1 endDelimiter:--//
+-- ----------------------------------------------------------------------------
+/*
+    Creates a global permission for new-relationship and assigns it to the hostsharing admins role.
+ */
+do language plpgsql $$
+    declare
+        addCustomerPermissions uuid[];
+        globalObjectUuid       uuid;
+        globalAdminRoleUuid    uuid ;
+    begin
+        call defineContext('granting global new-relationship permission to global admin role', null, null, null);
+
+        globalAdminRoleUuid := findRoleId(globalAdmin());
+        globalObjectUuid := (select uuid from global);
+        addCustomerPermissions := createPermissions(globalObjectUuid, array ['new-relationship']);
+        call grantPermissionsToRole(globalAdminRoleUuid, addCustomerPermissions);
+    end;
+$$;
+
+/**
+    Used by the trigger to prevent the add-customer to current user respectively assumed roles.
+ */
+create or replace function addHsOfficeRelationshipNotAllowedForCurrentSubjects()
+    returns trigger
+    language PLPGSQL
+as $$
+begin
+    raise exception '[403] new-relationship not permitted for %',
+        array_to_string(currentSubjects(), ';', 'null');
+end; $$;
+
+/**
+    Checks if the user or assumed roles are allowed to create a new customer.
+ */
+create trigger hs_office_relationship_insert_trigger
+    before insert
+    on hs_office_relationship
+    for each row
+    -- TODO.spec: who is allowed to create new relationships
+    when ( not hasAssumedRole() )
+execute procedure addHsOfficeRelationshipNotAllowedForCurrentSubjects();
+--//
+

src/main/resources/db/changelog/223-hs-office-relationship-rbac.sql

@@ -27,72 +27,72 @@ create or replace function hsOfficeRelationshipRbacRolesTrigger()
     language plpgsql
     strict as $$
 declare
-    newAnchorPerson                hs_office_person;
+    hsOfficeRelationshipTenant  RbacRoleDescriptor;
-    newHolderPerson                hs_office_person;
+    newRelAnchor                hs_office_person;
+    newRelHolder                hs_office_person;
     oldContact                  hs_office_contact;
     newContact                  hs_office_contact;
 begin
 
-    select * from hs_office_person as p where p.uuid = NEW.relAnchorUuid into newAnchorPerson;
+    hsOfficeRelationshipTenant := hsOfficeRelationshipTenant(NEW);
-    select * from hs_office_person as p where p.uuid = NEW.relHolderUuid into newHolderPerson;
+
+    select * from hs_office_person as p where p.uuid = NEW.relAnchorUuid into newRelAnchor;
+    select * from hs_office_person as p where p.uuid = NEW.relHolderUuid into newRelHolder;
     select * from hs_office_contact as c where c.uuid = NEW.contactUuid into newContact;
 
     if TG_OP = 'INSERT' then
 
-        -- cannot be generated using `tools/generate` because there are multiple grants to the same entity type
+
 
         perform createRoleWithGrants(
                 hsOfficeRelationshipOwner(NEW),
                 permissions => array['*'],
                 incomingSuperRoles => array[
-                    globalAdmin()
+                    globalAdmin(),
-                    ]
+                    hsOfficePersonAdmin(newRelAnchor)]
-                );
+            );
 
         perform createRoleWithGrants(
                 hsOfficeRelationshipAdmin(NEW),
                 permissions => array['edit'],
-                incomingSuperRoles => array[
+                incomingSuperRoles => array[hsOfficeRelationshipOwner(NEW)]
-                    hsOfficeRelationshipOwner(NEW),
+            );
-                    hsOfficePersonAdmin(newAnchorPerson)
-                    ]
-                );
 
+        -- the tenant role for those related users who can view the data
         perform createRoleWithGrants(
-                hsOfficeRelationshipAgent(NEW),
+                hsOfficeRelationshipTenant,
-                incomingSuperRoles => array[
-                    hsOfficeRelationshipAdmin(NEW),
-                    hsOfficePersonAdmin(newHolderPerson),
-                    hsOfficeContactAdmin(newContact)
-                    ]
-                );
-
-        perform createRoleWithGrants(
-                hsOfficeRelationshipTenant(NEW),
                 permissions => array['view'],
                 incomingSuperRoles => array[
-                    hsOfficeRelationshipAdmin(NEW)
+                    hsOfficeRelationshipAdmin(NEW),
-                    ],
+                    hsOfficePersonAdmin(newRelAnchor),
+                    hsOfficePersonAdmin(newRelHolder),
+                    hsOfficeContactAdmin(newContact)],
                 outgoingSubRoles => array[
---                     hsOfficePersonAdmin(newAnchorPerson),
+                    hsOfficePersonTenant(newRelAnchor),
---                     hsOfficePersonAdmin(newHolderPerson),
+                    hsOfficePersonTenant(newRelHolder),
-                    hsOfficeContactAdmin(newContact)
+                    hsOfficeContactTenant(newContact)]
-                    ]
+            );
-                );
+
+        -- anchor and holder admin roles need each others tenant role
+        -- to be able to see the joined relationship
+        -- TODO: this can probably be avoided through agent+guest roles
+        call grantRoleToRole(hsOfficePersonTenant(newRelAnchor), hsOfficePersonAdmin(newRelHolder));
+        call grantRoleToRole(hsOfficePersonTenant(newRelHolder), hsOfficePersonAdmin(newRelAnchor));
+        call grantRoleToRoleIfNotNull(hsOfficePersonTenant(newRelHolder), hsOfficeContactAdmin(newContact));
 
     elsif TG_OP = 'UPDATE' then
 
         if OLD.contactUuid <> NEW.contactUuid then
-            -- only the contact can be updated,
+            -- nothing but the contact can be updated,
             -- in other cases, a new relationship needs to be created and the old updated
 
             select * from hs_office_contact as c where c.uuid = OLD.contactUuid into oldContact;
 
-            call revokeRoleFromRole( hsOfficeRelationshipTenant(NEW), hsOfficeContactAdmin(oldContact) );
+            call revokeRoleFromRole( hsOfficeRelationshipTenant, hsOfficeContactAdmin(oldContact) );
-            call grantRoleToRole( hsOfficeRelationshipTenant(NEW), hsOfficeContactAdmin(newContact) );
+            call grantRoleToRole( hsOfficeRelationshipTenant, hsOfficeContactAdmin(newContact) );
 
-            call revokeRoleFromRole( hsOfficeContactTenant(oldContact), hsOfficeRelationshipAgent(NEW) );
+            call revokeRoleFromRole( hsOfficeContactTenant(oldContact), hsOfficeRelationshipTenant );
-            call grantRoleToRole( hsOfficeContactTenant(newContact), hsOfficeRelationshipAgent(NEW) );
+            call grantRoleToRole( hsOfficeContactTenant(newContact), hsOfficeRelationshipTenant );
         end if;
     else
         raise exception 'invalid usage of TRIGGER';