refactor(api): require permission key in create and update requests

cmd/seed.go

@@ -11,6 +11,7 @@ import (
 	"connectrpc.com/connect"
 	"github.com/MakeNowJust/heredoc"
 	"github.com/raystack/frontier/config"
+	"github.com/raystack/frontier/internal/bootstrap/schema"
 	frontierv1beta1 "github.com/raystack/frontier/proto/v1beta1"
 	frontierv1beta1connect "github.com/raystack/frontier/proto/v1beta1/frontierv1beta1connect"
 	"github.com/raystack/salt/cli/printer"
@@ -112,10 +113,10 @@ func createCustomRolesAndPermissions(ctx context.Context, client frontierv1beta1
 	}
 
 	str := "created custom permissions : "
-	//nolint:staticcheck
 	for _, v := range permissionBodies {
-		str = fmt.Sprintf("%s %s:%s", str, v.GetNamespace(), v.GetName())
-		resourceNamespaces = append(resourceNamespaces, v.GetNamespace())
+		permNamespace, permName := schema.PermissionNamespaceAndNameFromKey(v.GetKey())
+		str = fmt.Sprintf("%s %s:%s", str, permNamespace, permName)
+		resourceNamespaces = append(resourceNamespaces, permNamespace)
 	}
 	fmt.Println(str)
 

cmd/seed/permissions.json

@@ -1,50 +1,42 @@
 [
   {
-    "name": "create",
+    "key": "compute.order.create",
     "title": "Create Order",
-    "namespace": "compute/order",
     "metadata": {}
   },
   {
-    "name": "get",
+    "key": "compute.order.get",
     "title": "Read Order",
-    "namespace": "compute/order",
     "metadata": {}
   },
   {
-    "name": "update",
+    "key": "compute.order.update",
     "title": "Update Order",
-    "namespace": "compute/order",
     "metadata": {}
   },
   {
-    "name": "delete",
+    "key": "compute.order.delete",
     "title": "Delete Order",
-    "namespace": "compute/order",
     "metadata": {}
   },
   {
-    "name": "list",
+    "key": "compute.order.list",
     "title": "List Orders",
-    "namespace": "compute/order",
     "metadata": {}
   },
   {
-    "name": "get",
+    "key": "database.order.get",
     "title": "List Database Order",
-    "namespace": "database/order",
-    "metadata":{}
+    "metadata": {}
   },
   {
-    "name": "update",
+    "key": "database.order.update",
     "title": "Update Database Order",
-    "namespace": "database/order",
-    "metadata":{}
+    "metadata": {}
   },
   {
-    "name": "delete",
+    "key": "database.order.delete",
     "title": "Delete Database Order",
-    "namespace": "database/order",
-    "metadata":{}
+    "metadata": {}
   }
 ]

internal/api/v1beta1connect/errors.go

@@ -56,6 +56,7 @@ var (
 	ErrAlreadyApplied              = errors.New("credits already applied")
 	ErrInvalidRoleID               = errors.New("role id is invalid")
 	ErrNamespaceSplitNotation      = errors.New("subject/object should be provided as 'namespace:uuid'")
+	ErrPermissionKeyNotation       = errors.New("permission key should be provided as 'service.resource.verb'")
 	ErrPolicyNotFound              = errors.New("policy doesn't exist")
 	ErrProjectNotFound             = errors.New("project doesn't exist")
 	ErrGroupNotFound               = errors.New("group doesn't exist")

internal/api/v1beta1connect/permission.go

@@ -23,18 +23,14 @@ func (h *ConnectHandler) CreatePermission(ctx context.Context, request *connect.
 	var permissionSlugs []string
 	for _, permBody := range request.Msg.GetBodies() {
 		permNamespace, permName := schema.PermissionNamespaceAndNameFromKey(permBody.GetKey())
-		if permNamespace == "" || permName == "" {
-			permNamespace, permName = permBody.GetNamespace(), permBody.GetName() //nolint:staticcheck
-		}
 		if permName == "" || permNamespace == "" {
-			return nil, connect.NewError(connect.CodeInvalidArgument, ErrBadRequest)
+			return nil, connect.NewError(connect.CodeInvalidArgument, ErrPermissionKeyNotation)
 		}
 		if !schema.IsValidPermissionName(permName) {
 			return nil, connect.NewError(connect.CodeInvalidArgument, errors.New("permission name cannot contain special characters"))
 		}
-
-		if permNamespace == schema.DefaultNamespace {
-			return nil, connect.NewError(connect.CodeInvalidArgument, errors.New("permission namespace cannot be "+schema.DefaultNamespace))
+		if !schema.IsValidPermissionNamespace(permNamespace) {
+			return nil, connect.NewError(connect.CodeInvalidArgument, ErrPermissionKeyNotation)
 		}
 		permissionSlugs = append(permissionSlugs, schema.FQPermissionNameFromNamespace(permNamespace, permName))
 
@@ -125,7 +121,13 @@ func (h *ConnectHandler) UpdatePermission(ctx context.Context, request *connect.
 
 	permNamespace, permName := schema.PermissionNamespaceAndNameFromKey(request.Msg.GetBody().GetKey())
 	if permNamespace == "" || permName == "" {
-		permNamespace, permName = request.Msg.GetBody().GetNamespace(), request.Msg.GetBody().GetName() //nolint:staticcheck
+		return nil, connect.NewError(connect.CodeInvalidArgument, ErrPermissionKeyNotation)
+	}
+	if !schema.IsValidPermissionName(permName) {
+		return nil, connect.NewError(connect.CodeInvalidArgument, errors.New("permission name cannot contain special characters"))
+	}
+	if !schema.IsValidPermissionNamespace(permNamespace) {
+		return nil, connect.NewError(connect.CodeInvalidArgument, ErrPermissionKeyNotation)
 	}
 	updatedPermission, err := h.permissionService.Update(ctx, permission.Permission{
 		ID:          request.Msg.GetId(),