Admin seq-ui

Makefile

@@ -138,6 +138,10 @@ mock:
 		-destination=internal/pkg/service/massexport/mock/service.go \
 		github.com/ozontech/seq-ui/internal/pkg/service/massexport \
 		Service
+	PATH="$(LOCAL_BIN):$(PATH)" mockgen \
+		-destination=internal/pkg/service/admin/mock/service.go \
+		github.com/ozontech/seq-ui/internal/pkg/service/admin \
+		Service
 
 .PHONY: protoc
 protoc:

api/admin/v1/admin.proto

@@ -0,0 +1,85 @@
+syntax = "proto3";
+
+package admin.v1;
+
+option go_package = "github.com/ozontech/seq-ui/pkg/admin/v1;admin";
+
+service AdminService {
+  rpc CreateRole(CreateRoleRequest) returns (CreateRoleResponse);
+
+  rpc AddUsersToRole(AddUsersToRoleRequest) returns (AddUsersToRoleResponse);
+
+  rpc GetRoles(GetRolesRequest) returns (GetRolesResponse);
+
+  rpc GetRole(GetRoleRequest) returns (GetRoleResponse);
+
+  rpc UpdateRole(UpdateRoleRequest) returns (UpdateRoleResponse);
+
+  rpc DeleteRole(DeleteRoleRequest) returns (DeleteRoleResponse);
+
+  rpc DeleteUsersFromRole(DeleteUsersFromRoleRequest) returns (DeleteUsersFromRoleResponse);
+}
+
+message PermissionGroup {
+  string group = 1;
+  repeated string permissions = 2;
+}
+
+message Role {
+  int32 id = 1;
+  string name = 2;
+  repeated PermissionGroup permissions = 3;
+}
+
+message CreateRoleRequest {
+  string name = 1;
+  repeated PermissionGroup permissions = 2;
+}
+
+message CreateRoleResponse {
+  int32 role_id = 1;
+}
+
+message AddUsersToRoleRequest {
+  int32 role_id = 1;
+  repeated string usernames = 2;
+}
+
+message AddUsersToRoleResponse {}
+
+message GetRolesRequest {}
+
+message GetRolesResponse {
+  repeated Role roles = 1;
+  repeated PermissionGroup available_permissions = 2;
+}
+
+message GetRoleRequest {
+  int32 id = 1;
+}
+
+message GetRoleResponse {
+  repeated string usernames = 1;
+}
+
+message UpdateRoleRequest {
+  int32 id = 1;
+  optional string name = 2;
+  repeated PermissionGroup permissions = 3;
+}
+
+message UpdateRoleResponse {}
+
+message DeleteRoleRequest {
+  int32 id = 1;
+  optional int32 replacement_role_id = 2;
+}
+
+message DeleteRoleResponse {}
+
+message DeleteUsersFromRoleRequest {
+  int32 role_id = 1;
+  repeated string usernames = 2;
+}
+
+message DeleteUsersFromRoleResponse {}

api/userprofile/v1/userprofile.proto

@@ -26,6 +26,7 @@ message GetUserProfileResponse {
   string timezone = 1;
   string onboarding_version = 2;
   LogColumns log_columns = 3;
+  optional int32 role_id = 4;
 }
 
 message UpdateUserProfileRequest {

cmd/seq-ui/main.go

@@ -18,6 +18,7 @@ import (
 	"go.uber.org/zap"
 
 	"github.com/ozontech/seq-ui/internal/api"
+	admin_v1 "github.com/ozontech/seq-ui/internal/api/admin/v1"
 	dashboards_v1 "github.com/ozontech/seq-ui/internal/api/dashboards/v1"
 	errorgroups_v1 "github.com/ozontech/seq-ui/internal/api/errorgroups/v1"
 	massexport_v1 "github.com/ozontech/seq-ui/internal/api/massexport/v1"
@@ -29,6 +30,7 @@ import (
 	"github.com/ozontech/seq-ui/internal/pkg/client/seqdb"
 	"github.com/ozontech/seq-ui/internal/pkg/repository"
 	repositorych "github.com/ozontech/seq-ui/internal/pkg/repository_ch"
+	"github.com/ozontech/seq-ui/internal/pkg/service/admin"
 	asyncsearches "github.com/ozontech/seq-ui/internal/pkg/service/async_searches"
 	"github.com/ozontech/seq-ui/internal/pkg/service/dashboards"
 	"github.com/ozontech/seq-ui/internal/pkg/service/errorgroups"
@@ -152,6 +154,7 @@ func initApp(ctx context.Context, cfg config.Config) *api.Registrar {
 	}
 
 	var (
+		adminV1              *admin_v1.Admin
 		asyncSearchesService asyncsearches.Service
 		userProfileV1        *userprofile_v1.UserProfile
 		dashboardsV1         *dashboards_v1.Dashboards
@@ -166,6 +169,11 @@ func initApp(ctx context.Context, cfg config.Config) *api.Registrar {
 		dashboardsV1 = dashboards_v1.New(dashboardsSvc)
 
 		asyncSearchesService = asyncsearches.New(ctx, repo, defaultClient, cfg.Handlers.AsyncSearch)
+
+		if cfg.Handlers.Admin != nil {
+			adminSvc := admin.New(repo, redisCache, cfg.Handlers.Admin)
+			adminV1 = admin_v1.New(adminSvc)
+		}
 	}
 
 	seqApiV1 := seqapi_v1.New(cfg.Handlers.SeqAPI, seqDBClients, inmemWithRedisCache, redisCache, asyncSearchesService)
@@ -184,7 +192,7 @@ func initApp(ctx context.Context, cfg config.Config) *api.Registrar {
 		errorGroupsV1 = errorgroups_v1.New(svc)
 	}
 
-	return api.NewRegistrar(seqApiV1, userProfileV1, dashboardsV1, massExportV1, errorGroupsV1)
+	return api.NewRegistrar(adminV1, seqApiV1, userProfileV1, dashboardsV1, massExportV1, errorGroupsV1)
 }
 
 func initSeqDBClients(ctx context.Context, cfg config.Config) (map[string]seqdb.Client, error) {
@@ -202,9 +210,7 @@ func initSeqDBClients(ctx context.Context, cfg config.Config) (map[string]seqdb.
 
 func createSeqBDClient(ctx context.Context, cfg config.SeqDBClient, seqAPI config.SeqAPI) (seqdb.Client, error) {
 	clientMaxRecvMsgSize := cfg.AvgDocSize * 1024 * int(seqAPI.MaxSearchLimit)
-	if clientMaxRecvMsgSize < defaultClientMaxRecvMsgSize {
-		clientMaxRecvMsgSize = defaultClientMaxRecvMsgSize
-	}
+	clientMaxRecvMsgSize = max(clientMaxRecvMsgSize, defaultClientMaxRecvMsgSize)
 
 	clientParams := seqdb.ClientParams{
 		Addrs:               cfg.Addrs,

docs/en/02-configuration.md

@@ -505,6 +505,7 @@ handlers:
   error_groups:
   mass_export:
   async_search:
+  admin:
 ```
 
 ### SeqAPI
@@ -831,6 +832,22 @@ Configuration for async search request.
 
   Maximum length of `request.query` in async searches list responses. Requests exceeding the limit will be truncated to it
 
+### Admin
+
+**`admin`** *`Admin`* *`optional`*
+
+Configuration for `/admin` API.
+
+`Admin` fields:
+
++ **`super_users`** *`[]string`* *`required`*
+
+  List of users with full access to admin features.
+
++ **`cache_ttl`** *`string`* *`default="5m"`*
+
+  Cache TTL for roles and user permissions. If not set or set to zero, then it will be reset to `default`.
+
 ## Tracing
 
 The tracing configuration is set through environment variables.

docs/ru/02-configuration.md

@@ -505,6 +505,7 @@ handlers:
   error_groups:
   mass_export:
   async_search:
+  admin:
 ```
 
 ### SeqAPI
@@ -513,7 +514,7 @@ handlers:
 
 Конфигурация `/seqapi` API.
 
-`SeqAPI` fields:
+Поля `SeqAPI`:
 
 + **`max_search_limit`** *`int`* *`default=0`*
 
@@ -831,6 +832,22 @@ handlers:
 
   Максимальная длина `request.query` в ответе списка отложенных запросов. Запросы, превышающие лимит, будут обрезаны до этого значения.
 
+### Admin
+
+**`admin`** *`Admin`* *`optional`*
+
+Конфигурация `/admin` API.
+
+Поля `Admin`:
+
++ **`super_users`** *`[]string`* *`required`*
+
+  Список пользователей с полным доступом к административным функциям.
+
++ **`cache_ttl`** *`string`* *`default="5m"`*
+
+  TTL кэширования ролей и прав пользователей. Если установлено нулевое или отрицательное значение, то оно будет сброшено на `default`.
+
 ## Tracing
 
 Конфигурация трейсинга задается переменными окружения.

internal/api/admin/v1/admin.go

@@ -0,0 +1,29 @@
+package admin_v1
+
+import (
+	"github.com/go-chi/chi/v5"
+
+	grpc_api "github.com/ozontech/seq-ui/internal/api/admin/v1/grpc"
+	http_api "github.com/ozontech/seq-ui/internal/api/admin/v1/http"
+	"github.com/ozontech/seq-ui/internal/pkg/service/admin"
+)
+
+type Admin struct {
+	grpcAPI *grpc_api.API
+	httpAPI *http_api.API
+}
+
+func New(svc admin.Service) *Admin {
+	return &Admin{
+		grpcAPI: grpc_api.New(svc),
+		httpAPI: http_api.New(svc),
+	}
+}
+
+func (a *Admin) GRPCServer() *grpc_api.API {
+	return a.grpcAPI
+}
+
+func (a *Admin) HTTPRouter() chi.Router {
+	return a.httpAPI.Router()
+}

internal/api/admin/v1/grpc/api.go

@@ -0,0 +1,32 @@
+package grpc
+
+import (
+	"github.com/ozontech/seq-ui/internal/app/types"
+	admin "github.com/ozontech/seq-ui/internal/pkg/service/admin"
+	api "github.com/ozontech/seq-ui/pkg/admin/v1"
+)
+
+type API struct {
+	api.UnimplementedAdminServiceServer
+
+	service              admin.Service
+	availablePermissions []*api.PermissionGroup
+}
+
+func New(svc admin.Service) *API {
+	return &API{
+		service:              svc,
+		availablePermissions: availablePermissionsToProto(svc.GetAvailablePermissions()),
+	}
+}
+
+func availablePermissionsToProto(source []types.PermissionGroup) []*api.PermissionGroup {
+	availablePermissions := make([]*api.PermissionGroup, 0, len(source))
+	for _, s := range source {
+		availablePermissions = append(availablePermissions, &api.PermissionGroup{
+			Group:       s.Group,
+			Permissions: s.Permissions,
+		})
+	}
+	return availablePermissions
+}