-
Notifications
You must be signed in to change notification settings - Fork 3
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Upgrade Editorial permissions library to latest version
This upgrades the Media Atom Maker to use the latest version of the client for the Guardian's Editorial Permissions service - we need the latest version of the client to support the upgrade to Scala 2.13 in #1140 * Before: https://github.com/guardian/editorial-permissions-client/tree/v0.8 - supporting Scala 2.11 & 2.12 * After: https://github.com/guardian/permissions/tree/v2.15/client - supporting Scala 2.12 & 2.13 As you can see, the permissions client has moved repositories, to the main `permissions` repo - this happened in July 2018 with PR guardian/permissions#103. This PR is also important because it removed use of `Future` from the permissions client API - as Michael Barton explained, permission lookups should be mostly instantaneous because they now come from an in-memory cache. The removal of `Future` means that this commit, upgrading permissions in Media Atom Maker, needs to remove several for-comprehensions/map-statements. The diff on these can look quite big, but they look smaller if whitespace changes are ignored. I have taken the opportunity to do small refactors to improve code clarity and remove repetition. # Permission to modify Privacy Status of a published Media Atom In particular, the code around modifying Privacy Status of a Media Atom _had_ to be changed because it involved removing `Future`, but I also included refactoring to make the code clearer. When reviewing this, you may want to look at the original PRs that introduced this logic: * #607 - introduced the concept of each of our YouTube channels having a different set of available PrivacyStatus (Private, Unlisted, Public) values. * #694 - you can always upload as Public unless the channel is in the youtube.channels.unlisted config, in which case you need permission. This means we can give general users the ability to upload as Public on the culture channel and grant specific people access to make a public video on the main channel. * #789 - public video should *stay* public when a metadata change is made by someone who does not have permission to *make* a video public on that channel. * #791 - code shouldn't fail if the atom has not been published yet!
- Loading branch information
Showing
7 changed files
with
103 additions
and
146 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,64 +1,49 @@ | ||
| package com.gu.media | ||
|
|
||
| import com.amazonaws.auth.AWSCredentialsProvider | ||
| import com.gu.editorial.permissions.client._ | ||
| import com.gu.permissions._ | ||
| import ai.x.play.json.Jsonx | ||
| import com.gu.media.Permissions.setVideosOnAllChannelsPublic | ||
| import play.api.libs.json.Format | ||
| import com.gu.pandomainauth.model.{User => PandaUser} | ||
| import scala.concurrent.Future | ||
| import com.gu.permissions.PermissionDefinition | ||
|
|
||
|
|
||
| case class Permissions( | ||
| deleteAtom: Boolean, | ||
| addSelfHostedAsset: Boolean, | ||
| setVideosOnAllChannelsPublic: Boolean, | ||
| pinboard: Boolean | ||
| deleteAtom: Boolean = false, | ||
| addSelfHostedAsset: Boolean = false, | ||
| setVideosOnAllChannelsPublic: Boolean = false, | ||
| pinboard: Boolean = false | ||
| ) | ||
| object Permissions { | ||
| implicit val format: Format[Permissions] = Jsonx.formatCaseClass[Permissions] | ||
|
|
||
| val app = "atom-maker" | ||
| val deleteAtom = Permission("delete_atom", app, defaultVal = PermissionDenied) | ||
| val addSelfHostedAsset = Permission("add_self_hosted_asset", app, defaultVal = PermissionDenied) | ||
| val setVideosOnAllChannelsPublic = Permission("set_videos_on_all_channels_public", app, defaultVal = PermissionDenied) | ||
| val pinboard = Permission("pinboard", "pinboard", defaultVal = PermissionDenied) | ||
| val deleteAtom = PermissionDefinition("delete_atom", app) | ||
| val addSelfHostedAsset = PermissionDefinition("add_self_hosted_asset", app) | ||
| val setVideosOnAllChannelsPublic = PermissionDefinition("set_videos_on_all_channels_public", app) | ||
| val pinboard = PermissionDefinition("pinboard", "pinboard") | ||
| } | ||
|
|
||
| class MediaAtomMakerPermissionsProvider(stage: String, credsProvider: AWSCredentialsProvider) extends PermissionsProvider { | ||
| class MediaAtomMakerPermissionsProvider(stage: String, region: String, credsProvider: AWSCredentialsProvider) { | ||
| import Permissions._ | ||
|
|
||
| implicit def config = PermissionsConfig( | ||
| app = "media-atom-maker", | ||
| all = Seq(deleteAtom, addSelfHostedAsset, setVideosOnAllChannelsPublic, pinboard), | ||
| s3BucketPrefix = if(stage == "PROD") "PROD" else "CODE", | ||
| awsCredentials = credsProvider | ||
| ) | ||
| private val permissions: PermissionsProvider = PermissionsProvider(PermissionsConfig(stage, region, credsProvider)) | ||
|
|
||
| def getAll(user: PandaUser): Future[Permissions] = for { | ||
| deleteAtom <- hasPermission(deleteAtom, user) | ||
| selfHostedMediaAtom <- hasPermission(addSelfHostedAsset, user) | ||
| publicStatusPermissions <- hasPermission(setVideosOnAllChannelsPublic, user) | ||
| pinboard <- hasPermission(pinboard, user) | ||
| } yield Permissions(deleteAtom, selfHostedMediaAtom, publicStatusPermissions, pinboard) | ||
| def getAll(user: PandaUser): Permissions = Permissions( | ||
| deleteAtom = hasPermission(deleteAtom, user), | ||
| addSelfHostedAsset = hasPermission(addSelfHostedAsset, user), | ||
| setVideosOnAllChannelsPublic = hasPermission(setVideosOnAllChannelsPublic, user), | ||
| pinboard = hasPermission(pinboard, user) | ||
| ) | ||
|
|
||
| def getStatusPermissions(user: PandaUser): Future[Permissions] = for { | ||
| publicStatus <- hasPermission(setVideosOnAllChannelsPublic, user) | ||
| } yield { | ||
| Permissions(deleteAtom = false, addSelfHostedAsset = false, publicStatus, pinboard = false) | ||
| } | ||
| def getStatusPermissions(user: PandaUser): Permissions = | ||
| Permissions(setVideosOnAllChannelsPublic = hasPermission(setVideosOnAllChannelsPublic, user)) | ||
|
|
||
| private def hasPermission(permission: Permission, user: PandaUser): Future[Boolean] = { | ||
| user.email match { | ||
| // TODO be better | ||
| // HACK: HMAC authenticated users are a `PandaUser` without an email | ||
| case "" if user.firstName == "media-atom-scheduler-lambda" => { | ||
| Future.successful(true) | ||
| } | ||
| case _ => { | ||
| get(permission)(PermissionsUser(user.email)).map { | ||
| case PermissionGranted => true | ||
| case _ => false | ||
| } | ||
| } | ||
| } | ||
| def hasPermission(permission: PermissionDefinition, user: PandaUser): Boolean = user.email match { | ||
| // TODO be better | ||
| // HACK: HMAC authenticated users are a `PandaUser` without an email | ||
| case "" if user.firstName == "media-atom-scheduler-lambda" => true | ||
| case _ => permissions.hasPermission(permission, user.email) | ||
| } | ||
| } |