From 7d33356776441ccab6c0f3dbaceb8f51f3e83573 Mon Sep 17 00:00:00 2001 From: Dmitri Dolguikh Date: Mon, 3 Aug 2026 13:47:14 +0200 Subject: [PATCH] support for group to user ids Signed-off-by: Dmitri Dolguikh --- .../internals/network_map_db/db_store.go | 2 +- .../network_map_db/pgsql/allowed_user_ids.go | 43 +++++++++++++------ .../network_map_db/pgsql/group_test.go | 5 ++- .../network_map_db/pgsql/network_map_data.go | 3 +- 4 files changed, 35 insertions(+), 18 deletions(-) diff --git a/management/internals/network_map_db/db_store.go b/management/internals/network_map_db/db_store.go index a9325ee06..03add8dc3 100644 --- a/management/internals/network_map_db/db_store.go +++ b/management/internals/network_map_db/db_store.go @@ -33,7 +33,7 @@ type NetworkMapDBStore interface { GetAccountSettings(ctx context.Context, accountId string) (nmdata.AccountSettingsInfo, error) GetPostureChecks(ctx context.Context, accountId string) ([]nmdata.PostureChecks, error) GetNetworkMapData(ctx context.Context, accountId string) (*networkmap.NetworkMapData, error) - GetAllowedUserIds(ctx context.Context, accountId string) (map[string]struct{}, error) + GetAllowedUsers(ctx context.Context, accountId string) (map[string]struct{}, map[string][]string, error) } type NetworkMapDBStoreImpl struct { diff --git a/management/internals/network_map_db/pgsql/allowed_user_ids.go b/management/internals/network_map_db/pgsql/allowed_user_ids.go index 3a4dcf408..7f6d2ec9f 100644 --- a/management/internals/network_map_db/pgsql/allowed_user_ids.go +++ b/management/internals/network_map_db/pgsql/allowed_user_ids.go @@ -2,41 +2,56 @@ package networkmap_pgsql import ( "context" + "encoding/json" "github.com/jackc/pgx/v5" ) const ( GetAllowedUserIdsQuery = ` - select id + select id, auto_groups from users where account_id=$1 and not blocked and not is_service_user ` ) -func (pg *PgStore) GetAllowedUserIds(ctx context.Context, accountId string) (map[string]struct{}, error) { +func (pg *PgStore) GetAllowedUsers(ctx context.Context, accountId string) (map[string]struct{}, map[string][]string, error) { c, err := pg.Pool.Acquire(ctx) if err != nil { - return nil, err + return nil, nil, err } - return GetGetAllowedUserIdsViaPgxConnection(ctx, c.Conn(), accountId) + return GetAllowedUsersViaPgxConnection(ctx, c.Conn(), accountId) } -func GetGetAllowedUserIdsViaPgxConnection(ctx context.Context, con *pgx.Conn, accountId string) (map[string]struct{}, error) { +func GetAllowedUsersViaPgxConnection(ctx context.Context, con *pgx.Conn, accountId string) (map[string]struct{}, map[string][]string, error) { rows, err := con.Query(ctx, GetAllowedUserIdsQuery, accountId) if err != nil { - return nil, err + return nil, nil, err } - toret := make(map[string]struct{}) - var id string - _, err = pgx.ForEachRow(rows, []any{&id}, func() error { - toret[id] = struct{}{} - return nil - }) + users, err := pgx.CollectRows(rows, pgx.RowToStructByName[user]) if err != nil { - return nil, err + return nil, nil, err } - return toret, nil + userIdIdx := make(map[string]struct{}) + groupIdToUserIds := make(map[string][]string) + for _, user := range users { + userIdIdx[user.ID] = struct{}{} + + var groupIds []string + if err := json.Unmarshal(user.AutoGroups, &groupIds); err != nil { + return nil, nil, err + } + for _, groupId := range groupIds { + groupIdToUserIds[groupId] = append(groupIdToUserIds[groupId], user.ID) + } + } + + return userIdIdx, groupIdToUserIds, nil +} + +type user struct { + ID string + AutoGroups json.RawMessage } diff --git a/management/internals/network_map_db/pgsql/group_test.go b/management/internals/network_map_db/pgsql/group_test.go index 2d0a08f85..43fa3ffe1 100644 --- a/management/internals/network_map_db/pgsql/group_test.go +++ b/management/internals/network_map_db/pgsql/group_test.go @@ -262,7 +262,8 @@ func TestGetGetAllowedUserIds(t *testing.T) { // err = loadSQL(ctx, s.pool, initDb) //assert.NoError(t, err) - ids, err := s.GetAllowedUserIds(ctx, "cus73sbl0ubs73cfoo90") //"ckd7ee2fic3c73dtendg") + userIds, groupToUserIds, err := s.GetAllowedUsers(ctx, "cus73sbl0ubs73cfoo90") //"ckd7ee2fic3c73dtendg") assert.NoError(t, err) - assert.NotEmpty(t, ids) + assert.NotEmpty(t, userIds) + assert.NotEmpty(t, groupToUserIds) } diff --git a/management/internals/network_map_db/pgsql/network_map_data.go b/management/internals/network_map_db/pgsql/network_map_data.go index e94df8108..631e607b0 100644 --- a/management/internals/network_map_db/pgsql/network_map_data.go +++ b/management/internals/network_map_db/pgsql/network_map_data.go @@ -62,7 +62,7 @@ func (pg *PgStore) GetNetworkMapData(ctx context.Context, accountId string) (*ne if err != nil { return rollbackAndReturnError(ctx, tx, err) } - allowedUserIds, err := GetGetAllowedUserIdsViaPgxConnection(ctx, tx.Conn(), accountId) + allowedUserIds, groupsToUserIds, err := GetAllowedUsersViaPgxConnection(ctx, tx.Conn(), accountId) if err != nil { return rollbackAndReturnError(ctx, tx, err) } @@ -109,6 +109,7 @@ func (pg *PgStore) GetNetworkMapData(ctx context.Context, accountId string) (*ne NetworkResources: toSliceOfPtrs(networkResources), PostureChecks: toMap(postureChecks, func(pc nmdata.PostureChecks) string { return pc.ID }), AllowedUserIDs: allowedUserIds, + GroupIDToUserIDs: groupsToUserIds, NetworkXIDToPublicID: networkXIDToPublicID, // TODO (dmitri) maybe we can switch to public ids everywhere? }