Add namespaces permissions commands

pkg/ctl/namespace/errors_ns.go

@@ -24,6 +24,11 @@ var ArgError = pulsar.Output{
 	Out:  "[✖]  only one argument is allowed to be used as a name",
 }
 
+var AuthNotEnable = pulsar.Output{
+	Desc: "the authorization is not enabled",
+	Out:  "[✖]  code: 501 reason: Authorization is not enabled",
+}
+
 var NsNotExistError = pulsar.Output{
 	Desc: "the specified namespace name does not exist",
 	Out:  "[✖]  code: 404 reason: Namespace does not exist",

pkg/ctl/namespace/grant_permission.go

@@ -0,0 +1,116 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package namespace
+
+import (
+	"github.com/streamnative/pulsarctl/pkg/cmdutils"
+	"github.com/streamnative/pulsarctl/pkg/pulsar"
+
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+)
+
+func GrantPermissionsCmd(vc *cmdutils.VerbCmd) {
+	var desc pulsar.LongDescription
+	desc.CommandUsedFor = "This command is used for granting permissions to a client role to access a namespace."
+	desc.CommandPermission = "This command requires tenant admin permissions."
+
+	var examples []pulsar.Example
+	grant := pulsar.Example{
+		Desc:    "Grant permission (action) to the client role (role-name) to access the namespace (namespace-name)",
+		Command: "pulsarctl namespaces grant-permission --role (role-name) --actions (action) (namespace-name)",
+	}
+
+	grantActions := pulsar.Example{
+		Desc: "Grant permissions (actions) to the client role (role-name) to access the namespace (namespace-name)",
+		Command: "pulsarctl namespaces grant-permission --role (role-name) --actions (action-1) --actions (action-2) " +
+			"(namespace-name)",
+	}
+	examples = append(examples, grant, grantActions)
+	desc.CommandExamples = examples
+
+	var out []pulsar.Output
+	successOut := pulsar.Output{
+		Desc: "normal output",
+		Out: "Grant permissions (actions) to the client role (role-name) to access the namespace (namespace-name)" +
+			" successfully",
+	}
+	out = append(out, successOut, ArgError, AuthNotEnable)
+	out = append(out, NsErrors...)
+	desc.CommandOutput = out
+
+	vc.SetDescription(
+		"grant-permission",
+		"Grant permissions to a client role to access a namespace",
+		desc.ToString(),
+		desc.ExampleToString())
+
+	var role string
+	var actions []string
+
+	vc.SetRunFuncWithNameArg(func() error {
+		return doGrantPermissions(vc, role, actions)
+	})
+
+	vc.FlagSetGroup.InFlagSet("Grant Permissions", func(set *pflag.FlagSet) {
+		set.StringVar(&role, "role", "",
+			"Client role to which grant permissions")
+		set.StringSliceVar(&actions, "actions", []string{},
+			"Actions to be granted (produce,consume,functions)")
+		cobra.MarkFlagRequired(set, "role")
+		cobra.MarkFlagRequired(set, "actions")
+	})
+}
+
+func doGrantPermissions(vc *cmdutils.VerbCmd, role string, actions []string) error {
+	// for testing
+	if vc.NameError != nil {
+		return vc.NameError
+	}
+
+	ns, err := pulsar.GetNamespaceName(vc.NameArg)
+	if err != nil {
+		return err
+	}
+
+	a, err := parseActions(actions)
+	if err != nil {
+		return err
+	}
+
+	admin := cmdutils.NewPulsarClient()
+	err = admin.Namespaces().GrantNamespacePermission(*ns, role, a)
+	if err == nil {
+		vc.Command.Printf("Grant permissions %+v to the client role %s to access the"+
+			" namespace %s successfully\n", a, role, ns.String())
+	}
+
+	return err
+}
+
+func parseActions(actions []string) ([]pulsar.AuthAction, error) {
+	r := make([]pulsar.AuthAction, 0)
+	for _, v := range actions {
+		a, err := pulsar.ParseAuthAction(v)
+		if err != nil {
+			return nil, err
+		}
+		r = append(r, a)
+	}
+	return r, nil
+}

pkg/ctl/namespace/grant_permission_test.go

@@ -0,0 +1,58 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package namespace
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGrantPermissionsCmd(t *testing.T) {
+	ns := "public/test-grant-permissions-ns"
+
+	args := []string{"create", ns}
+	_, execErr, _, _ := TestNamespaceCommands(createNs, args)
+	assert.Nil(t, execErr)
+
+	args = []string{"grant-permission", "--role", "test-permissions",
+		"--actions", "produce", "--actions", "consume", "--actions", "functions", ns}
+	_, execErr, _, _ = TestNamespaceCommands(GrantPermissionsCmd, args)
+	assert.NotNil(t, execErr)
+	assert.Equal(t, "code: 501 reason: Authorization is not enabled", execErr.Error())
+}
+
+func TestGrantPermissionsArgsError(t *testing.T) {
+	ns := "public/grant-permissions-tests"
+
+	args := []string{"grant-permission", ns}
+	_, _, _, err := TestNamespaceCommands(GrantPermissionsCmd, args)
+	assert.NotNil(t, err)
+	assert.Equal(t, "required flag(s) \"actions\", \"role\" not set", err.Error())
+
+	args = []string{"grant-permission", "--role", "test-role", "--actions", "consume"}
+	_, _, nameErr, _ := TestNamespaceCommands(GrantPermissionsCmd, args)
+	assert.NotNil(t, nameErr)
+	assert.Equal(t, "only one argument is allowed to be used as a name", nameErr.Error())
+
+	args = []string{"grant-permission", "--role", "test-role", "--actions", "fail", ns}
+	_, execErr, _, _ := TestNamespaceCommands(GrantPermissionsCmd, args)
+	assert.NotNil(t, execErr)
+	assert.Equal(t, "The auth action only can be specified as 'produce', "+
+		"'consume', or 'functions'. Invalid auth action 'fail'", execErr.Error())
+}

pkg/ctl/namespace/grant_subscription_permission.go

@@ -0,0 +1,102 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package namespace
+
+import (
+	"github.com/streamnative/pulsarctl/pkg/cmdutils"
+	"github.com/streamnative/pulsarctl/pkg/pulsar"
+
+	"github.com/pkg/errors"
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+)
+
+func GrantSubPermissionsCmd(vc *cmdutils.VerbCmd) {
+	var desc pulsar.LongDescription
+	desc.CommandUsedFor = "This command is used for granting client roles to access a subscription of a namespace."
+	desc.CommandPermission = "This command requires super-user permissions."
+
+	var examples []pulsar.Example
+	grant := pulsar.Example{
+		Desc: "Grant the client roles (roles-name) to access the subscription (subscription-name) of the " +
+			"namespace (namespace-name)",
+		Command: "pulsarctl namespaces grant-subscription-permission --role (role1-name) --role (role2-name) " +
+			"(namespace-name) (subscription-name)",
+	}
+	examples = append(examples, grant)
+	desc.CommandExamples = examples
+
+	var out []pulsar.Output
+	successOut := pulsar.Output{
+		Desc: "normal output",
+		Out: "Grant the client role <role-name> to access the subscription <subscription-name> of the " +
+			"namespace <namespace-name> successfully",
+	}
+
+	argsError := pulsar.Output{
+		Desc: "the namespace name is not specified or the subscription name is not specified",
+		Out:  "[✖]  need to specified namespace name and subscription name",
+	}
+	out = append(out, successOut, argsError)
+	out = append(out, NsErrors...)
+	desc.CommandOutput = out
+
+	vc.SetDescription(
+		"grant-subscription-permission",
+		"Grant a client role to access a subscription of a namespace",
+		desc.ToString(),
+		desc.ExampleToString())
+
+	var role []string
+
+	vc.SetRunFuncWithMultiNameArgs(func() error {
+		return doGrantSubscriptionPermissions(vc, role)
+	}, func(args []string) error {
+		if len(args) != 2 {
+			return errors.New("need to specified namespace name and subscription name")
+		}
+		return nil
+	})
+
+	vc.FlagSetGroup.InFlagSet("Grant Subscription Permissions", func(set *pflag.FlagSet) {
+		set.StringSliceVar(&role, "role", nil,
+			"Client role to which grant permissions")
+		cobra.MarkFlagRequired(set, "role")
+	})
+}
+
+func doGrantSubscriptionPermissions(vc *cmdutils.VerbCmd, role []string) error {
+	// for testing
+	if vc.NameError != nil {
+		return vc.NameError
+	}
+
+	ns, err := pulsar.GetNamespaceName(vc.NameArgs[0])
+	if err != nil {
+		return err
+	}
+
+	admin := cmdutils.NewPulsarClient()
+	err = admin.Namespaces().GrantSubPermission(*ns, vc.NameArgs[1], role)
+	if err == nil {
+		vc.Command.Printf("Grant the client role %+v to access the subscription %s of "+
+			"the namespace %s successfully\n", role, vc.NameArgs[1], ns.String())
+	}
+
+	return err
+}

pkg/ctl/namespace/grant_subscription_permission_test.go

@@ -0,0 +1,56 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package namespace
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGrantSubPermissionsCmd(t *testing.T) {
+	ns := "public/test-grant-sub-permissions-ns"
+
+	args := []string{"create", ns}
+	_, execErr, _, _ := TestNamespaceCommands(createNs, args)
+	assert.Nil(t, execErr)
+
+	args = []string{"grant-subscription-permission", "--role", "test-permissions", ns, "test-grant-sub"}
+	_, execErr, _, _ = TestNamespaceCommands(GrantSubPermissionsCmd, args)
+	assert.NotNil(t, execErr)
+	assert.Equal(t, "code: 501 reason: Authorization is not enabled", execErr.Error())
+}
+
+func TestGrantSubPermissionsArgsError(t *testing.T) {
+	ns := "public/grant-sub-permissions-args-tests"
+
+	args := []string{"grant-subscription-permission", ns}
+	_, _, _, err := TestNamespaceCommands(GrantSubPermissionsCmd, args)
+	assert.NotNil(t, err)
+	assert.Equal(t, "required flag(s) \"role\" not set", err.Error())
+
+	args = []string{"grant-subscription-permission", "--role", "test-role"}
+	_, _, nameErr, _ := TestNamespaceCommands(GrantSubPermissionsCmd, args)
+	assert.NotNil(t, nameErr)
+	assert.Equal(t, "need to specified namespace name and subscription name", nameErr.Error())
+
+	args = []string{"grant-subscription-permission", "--role", "test-role", ns}
+	_, execErr, _, _ := TestNamespaceCommands(GrantSubPermissionsCmd, args)
+	assert.NotNil(t, execErr)
+	assert.Equal(t, "need to specified namespace name and subscription name", execErr.Error())
+}

pkg/ctl/namespace/namespace.go

@@ -54,6 +54,11 @@ func Command(flagGrouping *cmdutils.FlagGrouping) *cobra.Command {
 	cmdutils.AddVerbCmd(flagGrouping, resourceCmd, getReplicationClusters)
 	cmdutils.AddVerbCmd(flagGrouping, resourceCmd, unload)
 	cmdutils.AddVerbCmd(flagGrouping, resourceCmd, splitBundle)
+	cmdutils.AddVerbCmd(flagGrouping, resourceCmd, GetPermissionsCmd)
+	cmdutils.AddVerbCmd(flagGrouping, resourceCmd, GrantPermissionsCmd)
+	cmdutils.AddVerbCmd(flagGrouping, resourceCmd, RevokePermissionsCmd)
+	cmdutils.AddVerbCmd(flagGrouping, resourceCmd, GrantSubPermissionsCmd)
+	cmdutils.AddVerbCmd(flagGrouping, resourceCmd, RevokeSubPermissionsCmd)
 	cmdutils.AddVerbCmd(flagGrouping, resourceCmd, ClearBacklogCmd)
 	cmdutils.AddVerbCmd(flagGrouping, resourceCmd, GetDispatchRateCmd)
 	cmdutils.AddVerbCmd(flagGrouping, resourceCmd, SetDispatchRateCmd)