Skip to content

Dimension for project-specific role #795

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
hmacr wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Dimension for project-specific role #795

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a074126
Project-specific roles
hmacr Jan 20, 2026
71c0b9c
Merge branch 'main' into ser-541-tag-4.5.2
hmacr Jan 25, 2026
c11cdc3
fix UT
hmacr Jan 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 9 additions & 8 deletions src/Database/Validator/Roles.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -237,8 +237,9 @@ protected function isValidRole(
string $identifier,
string $dimension
): bool {
$key = new Key();
$label = new Label();
$identifierValidator = new Key();
$labelValidator = new Label();
$dimensionValidator = new Key(maxLength: 60);

$config = self::CONFIG[$role] ?? null;

Expand All @@ -265,11 +266,11 @@ protected function isValidRole(

// Allowed and has an invalid identifier
if ($allowed && !empty($identifier)) {
if ($role === self::ROLE_LABEL && !$label->isValid($identifier)) {
$this->message = 'Role "' . $role . '"' . ' identifier value is invalid: ' . $label->getDescription();
if ($role === self::ROLE_LABEL && !$labelValidator->isValid($identifier)) {
$this->message = 'Role "' . $role . '"' . ' identifier value is invalid: ' . $labelValidator->getDescription();
return false;
} elseif ($role !== self::ROLE_LABEL && !$key->isValid($identifier)) {
$this->message = 'Role "' . $role . '"' . ' identifier value is invalid: ' . $key->getDescription();
} elseif ($role !== self::ROLE_LABEL && !$identifierValidator->isValid($identifier)) {
$this->message = 'Role "' . $role . '"' . ' identifier value is invalid: ' . $identifierValidator->getDescription();
return false;
}
}
Expand Down Expand Up @@ -300,8 +301,8 @@ protected function isValidRole(
return false;
}
// Allowed and dimension is not a valid key
if (!$key->isValid($dimension)) {
$this->message = 'Role "' . $role . '"' . ' dimension value is invalid: ' . $key->getDescription();
if (!$dimensionValidator->isValid($dimension)) {
$this->message = 'Role "' . $role . '"' . ' dimension value is invalid: ' . $dimensionValidator->getDescription();
return false;
}
}
Expand Down
22 changes: 22 additions & 0 deletions tests/unit/RoleTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,16 @@ public function testOutputFromString(): void
$this->assertEquals('123', $role->getIdentifier());
$this->assertEquals('456', $role->getDimension());

$role = Role::parse('team:123/project-456-owner');
$this->assertEquals('team', $role->getRole());
$this->assertEquals('123', $role->getIdentifier());
$this->assertEquals('project-456-owner', $role->getDimension());

$role = Role::parse('team:123/project-456');
$this->assertEquals('team', $role->getRole());
$this->assertEquals('123', $role->getIdentifier());
$this->assertEquals('project-456', $role->getDimension());

$role = Role::parse('user:123/verified');
$this->assertEquals('user', $role->getRole());
$this->assertEquals('123', $role->getIdentifier());
Expand Down Expand Up @@ -76,6 +86,12 @@ public function testInputFromParameters(): void
$role = new Role('team', '123', '456');
$this->assertEquals('team:123/456', $role->toString());

$role = new Role('team', '123', 'project-456-owner');
$this->assertEquals('team:123/project-456-owner', $role->toString());

$role = new Role('team', '123', 'project-456');
$this->assertEquals('team:123/project-456', $role->toString());

$role = new Role('label', 'vip');
$this->assertEquals('label:vip', $role->toString());
}
Expand All @@ -100,6 +116,12 @@ public function testInputFromRoles(): void
$role = Role::team(ID::custom('123'), '456');
$this->assertEquals('team:123/456', $role->toString());

$role = Role::team(ID::custom('123'), 'project-456-owner');
$this->assertEquals('team:123/project-456-owner', $role->toString());

$role = Role::team(ID::custom('123'), 'project-456');
$this->assertEquals('team:123/project-456', $role->toString());

$role = Role::label('vip');
$this->assertEquals('label:vip', $role->toString());
}
Expand Down
2 changes: 1 addition & 1 deletion tests/unit/Validator/PermissionsTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -290,7 +290,7 @@ public function testInvalidPermissions(): void
$this->assertFalse($object->isValid([Permission::read(Role::team(ID::custom('ab&cd3'), 'efgh'))]));
$this->assertEquals('Role "team" identifier value is invalid: Parameter must contain at most 36 chars. Valid chars are a-z, A-Z, 0-9, period, hyphen, and underscore. Can\'t start with a special char', $object->getDescription());
$this->assertFalse($object->isValid([Permission::read(Role::team(ID::custom('abcd'), 'ef*gh'))]));
$this->assertEquals('Role "team" dimension value is invalid: Parameter must contain at most 36 chars. Valid chars are a-z, A-Z, 0-9, period, hyphen, and underscore. Can\'t start with a special char', $object->getDescription());
$this->assertEquals('Role "team" dimension value is invalid: Parameter must contain at most 60 chars. Valid chars are a-z, A-Z, 0-9, period, hyphen, and underscore. Can\'t start with a special char', $object->getDescription());

// Permission-list length must be valid
$object = new Permissions(100);
Expand Down
7 changes: 7 additions & 0 deletions tests/unit/Validator/RolesTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
namespace Tests\Unit\Validator;

use PHPUnit\Framework\TestCase;
use Utopia\Database\Helpers\ID;
use Utopia\Database\Helpers\Role;
use Utopia\Database\Validator\Roles;

Expand All @@ -23,6 +24,12 @@ public function testValidRole(): void
{
$object = new Roles();
$this->assertTrue($object->isValid([Role::users()->toString()]));
$this->assertTrue($object->isValid([Role::users(Roles::DIMENSION_VERIFIED)->toString()]));
$this->assertTrue($object->isValid([Role::users(Roles::DIMENSION_UNVERIFIED)->toString()]));
$this->assertTrue($object->isValid([Role::team(ID::custom('696f34ea003d48edab8e'))->toString()]));
$this->assertTrue($object->isValid([Role::team(ID::custom('696f34ea003d48edab8e'), 'project-696f34ea003d48edab8e-owner')->toString()]));
$this->assertTrue($object->isValid([Role::team(ID::custom('696f34ea003d48edab8e'), 'project-696f34ea003d48edab8e')->toString()]));
$this->assertTrue($object->isValid([Role::label('vip')->toString()]));
}

public function testNotAnArray(): void
Expand Down
Loading