Skip to content

Commit 7f7ceb4

Browse files
rbereckarberecka
committed
TF-5568 Add support for team project customizable permissions.
1 parent 9478787 commit 7f7ceb4

4 files changed

+341
-5
lines changed

‎CHANGELOG.md

+2
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@
55
## Enhancements
66
* Added BETA support for including `projects` relationship and `projects-count` attribute to policy_set on create by @hs26gill [#737](https://github.com/hashicorp/go-tfe/pull/737)
77
* Added BETA method `AddProjects` and `RemoveProjects` for attaching/detaching policy set to projects by @Netra2104 [#735](https://github.com/hashicorp/go-tfe/pull/735)
8+
* Added BETA support for adding and updating custom permissions to `TeamProjectAccesses`. A `TeamProjectAccessType` of `"custom"` can set various permissions applied at
9+
the project level to the project itself (`ProjectAccessOptions`) and all of the workspaces in a project (`WorkspaceAccessOptions`).[#745](https://github.com/hashicorp/go-tfe/pull/745)
810

911
# v1.30.0
1012

‎team_project_access.go

+102-4
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ const (
4747
TeamProjectAccessMaintain TeamProjectAccessType = "maintain"
4848
TeamProjectAccessWrite TeamProjectAccessType = "write"
4949
TeamProjectAccessRead TeamProjectAccessType = "read"
50+
TeamProjectAccessCustom TeamProjectAccessType = "custom"
5051
)
5152

5253
// TeamProjectAccessList represents a list of team project accesses
@@ -57,14 +58,105 @@ type TeamProjectAccessList struct {
5758

5859
// TeamProjectAccess represents a project access for a team
5960
type TeamProjectAccess struct {
60-
ID string `jsonapi:"primary,team-projects"`
61-
Access TeamProjectAccessType `jsonapi:"attr,access"`
61+
ID string `jsonapi:"primary,team-projects"`
62+
Access TeamProjectAccessType `jsonapi:"attr,access"`
63+
ProjectAccess *ProjectAccessPermissions `jsonapi:"attr,project-access"`
64+
WorkspaceAccess *WorkspaceAccessPermissions `jsonapi:"attr,workspace-access"`
6265

6366
// Relations
6467
Team *Team `jsonapi:"relation,team"`
6568
Project *Project `jsonapi:"relation,project"`
6669
}
6770

71+
// ProjectPermissions represents the team's permissions on its project
72+
type ProjectAccessPermissions struct {
73+
ProjectSettingsPermission ProjectSettingsPermissionType `jsonapi:"attr,settings"`
74+
ProjectTeamsPermission ProjectTeamsPermissionType `jsonapi:"attr,teams"`
75+
}
76+
77+
type WorkspaceAccessPermissions struct {
78+
WorkspaceRunsPermission WorkspaceRunsPermissionType `jsonapi:"attr,runs"`
79+
WorkspaceSentinelMocksPermission WorkspaceSentinelMocksPermissionType `jsonapi:"attr,sentinel-mocks"`
80+
WorkspaceStateVersionsPermission WorkspaceStateVersionsPermissionType `jsonapi:"attr,state-versions"`
81+
WorkspaceVariablesPermission WorkspaceVariablesPermissionType `jsonapi:"attr,variables"`
82+
WorkspaceCreatePermission bool `jsonapi:"attr,create"`
83+
WorkspaceLockingPermission bool `jsonapi:"attr,locking"`
84+
WorkspaceMovePermission bool `jsonapi:"attr,move"`
85+
WorkspaceDeletePermission bool `jsonapi:"attr,delete"`
86+
WorkspaceRunTasksPermission bool `jsonapi:"attr,run-tasks"`
87+
}
88+
89+
// ProjectSettingsPermissionType represents the permissiontype to a project's settings
90+
type ProjectSettingsPermissionType string
91+
92+
const (
93+
ProjectSettingsPermissionRead ProjectSettingsPermissionType = "read"
94+
ProjectSettingsPermissionUpdate ProjectSettingsPermissionType = "update"
95+
ProjectSettingsPermissionDelete ProjectSettingsPermissionType = "delete"
96+
)
97+
98+
// ProjectTeamsPermissionType represents the permissiontype to a project's teams
99+
type ProjectTeamsPermissionType string
100+
101+
const (
102+
ProjectTeamsPermissionNone ProjectTeamsPermissionType = "none"
103+
ProjectTeamsPermissionRead ProjectTeamsPermissionType = "read"
104+
ProjectTeamsPermissionManage ProjectTeamsPermissionType = "manage"
105+
)
106+
107+
// WorkspaceRunsPermissionType represents the permissiontype to project workspaces' runs
108+
type WorkspaceRunsPermissionType string
109+
110+
const (
111+
WorkspaceRunsPermissionRead WorkspaceRunsPermissionType = "read"
112+
WorkspaceRunsPermissionPlan WorkspaceRunsPermissionType = "plan"
113+
WorkspaceRunsPermissionApply WorkspaceRunsPermissionType = "apply"
114+
)
115+
116+
// WorkspaceSentinelMocksPermissionType represents the permissiontype to project workspaces' sentinel-mocks
117+
type WorkspaceSentinelMocksPermissionType string
118+
119+
const (
120+
WorkspaceSentinelMocksPermissionNone WorkspaceSentinelMocksPermissionType = "none"
121+
WorkspaceSentinelMocksPermissionRead WorkspaceSentinelMocksPermissionType = "read"
122+
)
123+
124+
// WorkspaceStateVersionsPermissionType represents the permissiontype to project workspaces' state-versions
125+
type WorkspaceStateVersionsPermissionType string
126+
127+
const (
128+
WorkspaceStateVersionsPermissionNone WorkspaceStateVersionsPermissionType = "none"
129+
WorkspaceStateVersionsPermissionReadOutputs WorkspaceStateVersionsPermissionType = "read-outputs"
130+
WorkspaceStateVersionsPermissionRead WorkspaceStateVersionsPermissionType = "read"
131+
WorkspaceStateVersionsPermissionWrite WorkspaceStateVersionsPermissionType = "write"
132+
)
133+
134+
// WorkspaceVariablesPermissionType represents the permissiontype to project workspaces' variables
135+
type WorkspaceVariablesPermissionType string
136+
137+
const (
138+
WorkspaceVariablesPermissionNone WorkspaceVariablesPermissionType = "none"
139+
WorkspaceVariablesPermissionRead WorkspaceVariablesPermissionType = "read"
140+
WorkspaceVariablesPermissionWrite WorkspaceVariablesPermissionType = "write"
141+
)
142+
143+
type ProjectAccessPermissionsOptions struct {
144+
Settings *ProjectSettingsPermissionType `json:"settings,omitempty"`
145+
Teams *ProjectTeamsPermissionType `json:"teams,omitempty"`
146+
}
147+
148+
type WorkspaceAccessPermissionsOptions struct {
149+
Runs *WorkspaceRunsPermissionType `json:"runs,omitempty"`
150+
SentinelMocks *WorkspaceSentinelMocksPermissionType `json:"sentinel-mocks,omitempty"`
151+
StateVersions *WorkspaceStateVersionsPermissionType `json:"state-versions,omitempty"`
152+
Variables *WorkspaceVariablesPermissionType `json:"variables,omitempty"`
153+
Create bool `json:"create,omitempty"`
154+
Locking bool `json:"locking,omitempty"`
155+
Move bool `json:"move,omitempty"`
156+
Delete bool `json:"delete,omitempty"`
157+
RunTasks bool `json:"run-tasks,omitempty"`
158+
}
159+
68160
// TeamProjectAccessListOptions represents the options for listing team project accesses
69161
type TeamProjectAccessListOptions struct {
70162
ListOptions
@@ -80,6 +172,9 @@ type TeamProjectAccessAddOptions struct {
80172
Type string `jsonapi:"primary,team-projects"`
81173
// The type of access to grant.
82174
Access TeamProjectAccessType `jsonapi:"attr,access"`
175+
// The levels that project and workspace permissions grant
176+
ProjectAccess *ProjectAccessPermissionsOptions `jsonapi:"attr,project-access,omitempty"`
177+
WorkspaceAccess *WorkspaceAccessPermissionsOptions `jsonapi:"attr,workspace-access,omitempty"`
83178

84179
// The team to add to the project
85180
Team *Team `jsonapi:"relation,team"`
@@ -95,7 +190,9 @@ type TeamProjectAccessUpdateOptions struct {
95190
// https://jsonapi.org/format/#crud-creating
96191
Type string `jsonapi:"primary,team-projects"`
97192
// The type of access to grant.
98-
Access *TeamProjectAccessType `jsonapi:"attr,access,omitempty"`
193+
Access *TeamProjectAccessType `jsonapi:"attr,access,omitempty"`
194+
ProjectAccess *ProjectAccessPermissionsOptions `jsonapi:"attr,project-access,omitempty"`
195+
WorkspaceAccess *WorkspaceAccessPermissionsOptions `jsonapi:"attr,workspace-access,omitempty"`
99196
}
100197

101198
// List all team accesses for a given project.
@@ -229,7 +326,8 @@ func validateTeamProjectAccessType(t TeamProjectAccessType) error {
229326
case TeamProjectAccessAdmin,
230327
TeamProjectAccessMaintain,
231328
TeamProjectAccessWrite,
232-
TeamProjectAccessRead:
329+
TeamProjectAccessRead,
330+
TeamProjectAccessCustom:
233331
// do nothing
234332
default:
235333
return ErrInvalidTeamProjectAccessType

‎team_project_access_integration_test.go

+207-1
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,10 @@ package tfe
55

66
import (
77
"context"
8-
"github.com/stretchr/testify/assert"
98
"testing"
109

10+
"github.com/stretchr/testify/assert"
11+
1112
"github.com/stretchr/testify/require"
1213
)
1314

@@ -164,6 +165,102 @@ func TestTeamProjectAccessesAdd(t *testing.T) {
164165
}
165166
})
166167

168+
t.Run("with valid options for all custom TeamProject permissions", func(t *testing.T) {
169+
skipUnlessBeta(t)
170+
options := TeamProjectAccessAddOptions{
171+
Access: *ProjectAccess(TeamProjectAccessCustom),
172+
Team: tmTest,
173+
Project: pTest,
174+
ProjectAccess: &ProjectAccessPermissionsOptions{
175+
Settings: ProjectSettingsPermission(ProjectSettingsPermissionUpdate),
176+
Teams: ProjectTeamsPermission(ProjectTeamsPermissionManage),
177+
},
178+
WorkspaceAccess: &WorkspaceAccessPermissionsOptions{
179+
Runs: WorkspaceRunsPermission(WorkspaceRunsPermissionApply),
180+
SentinelMocks: WorkspaceSentinelMocksPermission(WorkspaceSentinelMocksPermissionRead),
181+
StateVersions: WorkspaceStateVersionsPermission(WorkspaceStateVersionsPermissionWrite),
182+
Variables: WorkspaceVariablesPermission(WorkspaceVariablesPermissionWrite),
183+
Create: true,
184+
Locking: true,
185+
Move: true,
186+
Delete: false,
187+
RunTasks: false,
188+
},
189+
}
190+
191+
tpa, err := client.TeamProjectAccess.Add(ctx, options)
192+
defer func() {
193+
err := client.TeamProjectAccess.Remove(ctx, tpa.ID)
194+
if err != nil {
195+
t.Logf("error removing team access (%s): %s", tpa.ID, err)
196+
}
197+
}()
198+
199+
require.NoError(t, err)
200+
201+
// Get a refreshed view from the API.
202+
refreshed, err := client.TeamProjectAccess.Read(ctx, tpa.ID)
203+
require.NoError(t, err)
204+
205+
for _, item := range []*TeamProjectAccess{
206+
tpa,
207+
refreshed,
208+
} {
209+
assert.NotEmpty(t, item.ID)
210+
assert.Equal(t, options.Access, item.Access)
211+
assert.Equal(t, *options.ProjectAccess.Settings, item.ProjectAccess.ProjectSettingsPermission)
212+
assert.Equal(t, *options.ProjectAccess.Teams, item.ProjectAccess.ProjectTeamsPermission)
213+
assert.Equal(t, *options.WorkspaceAccess.Runs, item.WorkspaceAccess.WorkspaceRunsPermission)
214+
assert.Equal(t, *options.WorkspaceAccess.SentinelMocks, item.WorkspaceAccess.WorkspaceSentinelMocksPermission)
215+
assert.Equal(t, *options.WorkspaceAccess.StateVersions, item.WorkspaceAccess.WorkspaceStateVersionsPermission)
216+
assert.Equal(t, *options.WorkspaceAccess.Variables, item.WorkspaceAccess.WorkspaceVariablesPermission)
217+
assert.Equal(t, item.WorkspaceAccess.WorkspaceCreatePermission, true)
218+
assert.Equal(t, item.WorkspaceAccess.WorkspaceLockingPermission, true)
219+
assert.Equal(t, item.WorkspaceAccess.WorkspaceMovePermission, true)
220+
assert.Equal(t, item.WorkspaceAccess.WorkspaceDeletePermission, false)
221+
assert.Equal(t, item.WorkspaceAccess.WorkspaceRunTasksPermission, false)
222+
}
223+
})
224+
225+
t.Run("with valid options for some custom TeamProject permissions", func(t *testing.T) {
226+
skipUnlessBeta(t)
227+
options := TeamProjectAccessAddOptions{
228+
Access: *ProjectAccess(TeamProjectAccessCustom),
229+
Team: tmTest,
230+
Project: pTest,
231+
ProjectAccess: &ProjectAccessPermissionsOptions{
232+
Settings: ProjectSettingsPermission(ProjectSettingsPermissionUpdate),
233+
},
234+
WorkspaceAccess: &WorkspaceAccessPermissionsOptions{
235+
Runs: WorkspaceRunsPermission(WorkspaceRunsPermissionApply),
236+
},
237+
}
238+
239+
tpa, err := client.TeamProjectAccess.Add(ctx, options)
240+
defer func() {
241+
err := client.TeamProjectAccess.Remove(ctx, tpa.ID)
242+
if err != nil {
243+
t.Logf("error removing team access (%s): %s", tpa.ID, err)
244+
}
245+
}()
246+
247+
require.NoError(t, err)
248+
249+
// Get a refreshed view from the API.
250+
refreshed, err := client.TeamProjectAccess.Read(ctx, tpa.ID)
251+
require.NoError(t, err)
252+
253+
for _, item := range []*TeamProjectAccess{
254+
tpa,
255+
refreshed,
256+
} {
257+
assert.NotEmpty(t, item.ID)
258+
assert.Equal(t, options.Access, item.Access)
259+
assert.Equal(t, *options.ProjectAccess.Settings, item.ProjectAccess.ProjectSettingsPermission)
260+
assert.Equal(t, *options.WorkspaceAccess.Runs, item.WorkspaceAccess.WorkspaceRunsPermission)
261+
}
262+
})
263+
167264
t.Run("when the team already has access to the project", func(t *testing.T) {
168265
_, tpaTestCleanup := createTeamProjectAccess(t, client, tmTest, pTest, nil)
169266
defer tpaTestCleanup()
@@ -205,6 +302,20 @@ func TestTeamProjectAccessesAdd(t *testing.T) {
205302
assert.Equal(t, err, ErrRequiredProject)
206303
})
207304

305+
t.Run("when invalid custom project permission is provided in options", func(t *testing.T) {
306+
skipUnlessBeta(t)
307+
tpa, err := client.TeamProjectAccess.Add(ctx, TeamProjectAccessAddOptions{
308+
Access: *ProjectAccess(TeamProjectAccessCustom),
309+
Team: tmTest,
310+
Project: pTest,
311+
ProjectAccess: &ProjectAccessPermissionsOptions{
312+
Teams: ProjectTeamsPermission(badIdentifier),
313+
},
314+
})
315+
assert.Nil(t, tpa)
316+
assert.Error(t, err)
317+
})
318+
208319
t.Run("when invalid access is provided in options", func(t *testing.T) {
209320
tpa, err := client.TeamProjectAccess.Add(ctx, TeamProjectAccessAddOptions{
210321
Access: badIdentifier,
@@ -242,6 +353,101 @@ func TestTeamProjectAccessesUpdate(t *testing.T) {
242353

243354
assert.Equal(t, tpa.Access, TeamProjectAccessRead)
244355
})
356+
357+
t.Run("with valid custom permissions attributes for all permissions", func(t *testing.T) {
358+
skipUnlessBeta(t)
359+
options := TeamProjectAccessUpdateOptions{
360+
Access: ProjectAccess(TeamProjectAccessCustom),
361+
ProjectAccess: &ProjectAccessPermissionsOptions{
362+
Settings: ProjectSettingsPermission(ProjectSettingsPermissionUpdate),
363+
Teams: ProjectTeamsPermission(ProjectTeamsPermissionManage),
364+
},
365+
WorkspaceAccess: &WorkspaceAccessPermissionsOptions{
366+
Runs: WorkspaceRunsPermission(WorkspaceRunsPermissionPlan),
367+
SentinelMocks: WorkspaceSentinelMocksPermission(WorkspaceSentinelMocksPermissionNone),
368+
StateVersions: WorkspaceStateVersionsPermission(WorkspaceStateVersionsPermissionReadOutputs),
369+
Variables: WorkspaceVariablesPermission(WorkspaceVariablesPermissionRead),
370+
Create: false,
371+
Locking: false,
372+
Move: false,
373+
Delete: true,
374+
RunTasks: true,
375+
},
376+
}
377+
378+
tpa, err := client.TeamProjectAccess.Update(ctx, tpaTest.ID, options)
379+
require.NoError(t, err)
380+
381+
assert.Equal(t, tpa.Access, TeamProjectAccessCustom)
382+
assert.Equal(t, *options.ProjectAccess.Teams, tpa.ProjectAccess.ProjectTeamsPermission)
383+
assert.Equal(t, *options.ProjectAccess.Settings, tpa.ProjectAccess.ProjectSettingsPermission)
384+
assert.Equal(t, *options.WorkspaceAccess.Runs, tpa.WorkspaceAccess.WorkspaceRunsPermission)
385+
assert.Equal(t, *options.WorkspaceAccess.SentinelMocks, tpa.WorkspaceAccess.WorkspaceSentinelMocksPermission)
386+
assert.Equal(t, *options.WorkspaceAccess.StateVersions, tpa.WorkspaceAccess.WorkspaceStateVersionsPermission)
387+
assert.Equal(t, *options.WorkspaceAccess.Variables, tpa.WorkspaceAccess.WorkspaceVariablesPermission)
388+
assert.Equal(t, false, tpa.WorkspaceAccess.WorkspaceCreatePermission)
389+
assert.Equal(t, false, tpa.WorkspaceAccess.WorkspaceLockingPermission)
390+
assert.Equal(t, false, tpa.WorkspaceAccess.WorkspaceMovePermission)
391+
assert.Equal(t, true, tpa.WorkspaceAccess.WorkspaceDeletePermission)
392+
assert.Equal(t, true, tpa.WorkspaceAccess.WorkspaceRunTasksPermission)
393+
})
394+
395+
t.Run("with valid custom permissions attributes for some permissions", func(t *testing.T) {
396+
//create tpaCustomTest to verify unupdated attributes stay the same for custom permissions
397+
// because going from admin to read to custom changes the values of all custom permissions
398+
tm2Test, tm2TestCleanup := createTeam(t, client, orgTest)
399+
defer tm2TestCleanup()
400+
401+
// tpaCustomTest, tpaTestCustomCleanup := createTeamProjectAccess(t, client, tm2Test, pTest, orgTest)
402+
// defer tpaTestCustomCleanup()
403+
TpaOptions := TeamProjectAccessAddOptions{
404+
Access: *ProjectAccess(TeamProjectAccessCustom),
405+
Team: tm2Test,
406+
Project: pTest,
407+
}
408+
409+
tpaCustomTest, err := client.TeamProjectAccess.Add(ctx, TpaOptions)
410+
require.NoError(t, err)
411+
412+
skipUnlessBeta(t)
413+
options := TeamProjectAccessUpdateOptions{
414+
Access: ProjectAccess(TeamProjectAccessCustom),
415+
ProjectAccess: &ProjectAccessPermissionsOptions{
416+
Teams: ProjectTeamsPermission(ProjectTeamsPermissionManage),
417+
},
418+
WorkspaceAccess: &WorkspaceAccessPermissionsOptions{
419+
Create: false,
420+
},
421+
}
422+
423+
tpa, err := client.TeamProjectAccess.Update(ctx, tpaCustomTest.ID, options)
424+
require.NoError(t, err)
425+
426+
assert.Equal(t, *options.ProjectAccess.Teams, tpa.ProjectAccess.ProjectTeamsPermission)
427+
assert.Equal(t, false, tpa.WorkspaceAccess.WorkspaceCreatePermission)
428+
// assert that other attributes remain the same
429+
assert.Equal(t, tpaCustomTest.ProjectAccess.ProjectSettingsPermission, tpa.ProjectAccess.ProjectSettingsPermission)
430+
assert.Equal(t, tpaCustomTest.WorkspaceAccess.WorkspaceLockingPermission, tpa.WorkspaceAccess.WorkspaceLockingPermission)
431+
assert.Equal(t, tpaCustomTest.WorkspaceAccess.WorkspaceMovePermission, tpa.WorkspaceAccess.WorkspaceMovePermission)
432+
assert.Equal(t, tpaCustomTest.WorkspaceAccess.WorkspaceDeletePermission, tpa.WorkspaceAccess.WorkspaceDeletePermission)
433+
assert.Equal(t, tpaCustomTest.WorkspaceAccess.WorkspaceRunsPermission, tpa.WorkspaceAccess.WorkspaceRunsPermission)
434+
assert.Equal(t, tpaCustomTest.WorkspaceAccess.WorkspaceSentinelMocksPermission, tpa.WorkspaceAccess.WorkspaceSentinelMocksPermission)
435+
assert.Equal(t, tpaCustomTest.WorkspaceAccess.WorkspaceStateVersionsPermission, tpa.WorkspaceAccess.WorkspaceStateVersionsPermission)
436+
})
437+
t.Run("with invalid custom permissions attributes", func(t *testing.T) {
438+
skipUnlessBeta(t)
439+
options := TeamProjectAccessUpdateOptions{
440+
Access: ProjectAccess(TeamProjectAccessCustom),
441+
ProjectAccess: &ProjectAccessPermissionsOptions{
442+
Teams: ProjectTeamsPermission(badIdentifier),
443+
},
444+
}
445+
446+
tpa, err := client.TeamProjectAccess.Update(ctx, tpaTest.ID, options)
447+
448+
assert.Nil(t, tpa)
449+
assert.Error(t, err)
450+
})
245451
}
246452

247453
func TestTeamProjectAccessesRemove(t *testing.T) {

0 commit comments

Comments
 (0)