guardian
guardian copied to clipboard
Custom group naming convention for metabase provider
for this PR: https://github.com/odpf/guardian/pull/162
Describe the bug custom groups created by guardian in metabase are added as resources
Context
- existing metabase provider supports
collectionanddatabaseresource access - (in metabase)
database,table, andcollectionaccess are granted to groups, and a group has many users - while in guardian, a user access is pointing to a resource directly.
- so to accommodate that, we make the metabase provider create a group that is specific for accessing a resource with a specific role, in other words, this group will always have access to one resource with one role.
- see below diagram for illustration
- we're currently introducing 2 new resources in guardian which are
table(child resource underdatabase) andgroup -
tableresource is fine, but forgroup, we don't want to include those custom groups as resources in guardian
Expected behavior custom groups shouldn't be added as resources in guardian
Proposed Solution
- have a naming convention for the group name e.g. add prefix
_guardian_<group_name> - when fetching group resources from metabase, exclude any groups that have prefix
_guardian_
https://github.com/odpf/guardian/pull/162/commits/5d01b7c9ae0ef8ddc64a5745f81a208b0b4be9cf
@rahmatrhd added _guardian_ as a prefix to groups created by Guardian, also check on _guardian_ while adding group as resources into Guardian.