fix(policies): more assertions, add missing policy for editor role (#13644)

Author: anshbansal

.github/scripts/check_policies.py

@@ -17,6 +17,8 @@
 root_user_all_privileges = set()
 admin_role_platform_privileges = set()
 admin_role_all_privileges = set()
+reader_role_all_privileges = set()
+editor_role_all_privileges = set()
 for policy in all_policies:
     urn = policy["urn"]
     if urn == "urn:li:dataHubPolicy:0":
@@ -33,6 +35,10 @@
         editor_platform_policy_privileges = policy["info"]["privileges"]
     elif urn == "urn:li:dataHubPolicy:7":
         all_user_platform_policy_privileges = policy["info"]["privileges"]
+    elif urn.startswith("urn:li:dataHubPolicy:reader-"):
+        reader_role_all_privileges.update(set(policy["info"]["privileges"]))
+    elif urn.startswith("urn:li:dataHubPolicy:editor-"):
+        editor_role_all_privileges.update(set(policy["info"]["privileges"]))
     try:
         doc_type = policy["info"]["type"]
         privileges = policy["info"]["privileges"]
@@ -61,20 +67,40 @@
 """
 )
 
+# Root user has all privileges
 diff_policies = set(platform_privileges).difference(
     set(root_user_platform_policy_privileges)
 )
 assert len(diff_policies) == 0, f"Missing privileges for root user are {diff_policies}"
 
-diff_root_user_admin_role = set(
-    root_user_platform_policy_privileges
-).difference(set(admin_role_platform_privileges))
-assert len(diff_root_user_admin_role) == 0, f"Missing privileges for admin role are {diff_root_user_admin_role}"
+# admin role and root user have same platform privileges
+diff_root_missing_from_admin = set(root_user_platform_policy_privileges).difference(set(admin_role_platform_privileges))
+diff_admin_missing_from_root = set(admin_role_platform_privileges).difference(set(root_user_platform_policy_privileges))
 
-diff_root_user_admin_role_all = set(
-    root_user_all_privileges
-).difference(set(admin_role_all_privileges))
-assert len(diff_root_user_admin_role_all) == 0, f"Missing privileges for admin role are {diff_root_user_admin_role_all}"
+assert len(diff_root_missing_from_admin) == 0, f"Admin role missing: {diff_root_missing_from_admin}"
+assert len(diff_admin_missing_from_root) == 0, f"Root user missing: {diff_admin_missing_from_root}"
+
+# admin role and root user have same privileges
+diff_root_missing_from_admin_all = set(root_user_all_privileges).difference(set(admin_role_all_privileges))
+diff_admin_missing_from_root_all = set(admin_role_all_privileges).difference(set(root_user_all_privileges))
+## Admin user has EDIT_ENTITY privilege which is super privilege for editing entities
+diff_admin_missing_from_root_all_new = set()
+for privilege in diff_admin_missing_from_root_all:
+    if privilege.startswith("EDIT_"):
+        continue
+    diff_admin_missing_from_root_all_new.add(privilege)
+diff_admin_missing_from_root_all = diff_admin_missing_from_root_all_new
+
+assert len(diff_root_missing_from_admin_all) == 0, f"Admin role missing: {diff_root_missing_from_admin_all}"
+assert len(diff_admin_missing_from_root_all) == 0, f"Root user missing: {diff_admin_missing_from_root_all}"
+
+# Editor role has all privielges of Reader
+diff_reader_missing_from_editor = set(reader_role_all_privileges).difference(set(editor_role_all_privileges))
+assert len(diff_reader_missing_from_editor) == 0, f"Editor role missing: {diff_reader_missing_from_editor}"
+
+# Admin role has all privileges of editor
+diff_editor_missing_from_admin = set(editor_role_all_privileges).difference(set(admin_role_all_privileges))
+assert len(diff_editor_missing_from_admin) == 0, f"Admin role missing: {diff_editor_missing_from_admin}"
 
 # All users privileges checks
 assert "MANAGE_POLICIES" not in all_user_platform_policy_privileges

metadata-service/war/src/main/resources/boot/policies.json

@@ -337,7 +337,8 @@
         "PRODUCE_PLATFORM_EVENT_PRIVILEGE",
         "MANAGE_DATA_PRODUCTS",
         "ES_EXPLAIN_QUERY_PRIVILEGE",
-        "EDIT_ENTITY_PROPERTIES"
+        "EDIT_ENTITY_PROPERTIES",
+        "VIEW_STRUCTURED_PROPERTIES_PAGE"
       ],
       "displayName": "Editors - Metadata Policy",
       "description": "Editors have all metadata privileges.",