Service Accounts pt1

README.md

@@ -85,8 +85,6 @@ The following endpoints are injected by the `inject_endpoints` macro:
 | GET | /.well-known/jwks.json | Retrieve JWKS for verifying access tokens |
 | GET | /self | View information about the calling user |
 | GET | /api-user/{identifier} | View information about a specific user |
-| POST | /api-user | Create a new user |
-| POST | /api-user/{identifier} | Update information on an existing user |
 | GET | /api-user/{identifier}/token | View all API tokens for an existing user |
 | POST | /api-user/{identifier}/token | Create a new API token for an existing user |
 | GET | /api-user/{identifier}/token/{token_identifier} | View an existing API token |
@@ -97,7 +95,8 @@ The following endpoints are injected by the `inject_endpoints` macro:
 | POST | /api-user-provider/{identifier}/link-token | TBD |
 | GET | /group | View all groups |
 | POST | /group | Create a new group |
-| PUT | /group/{group_id} | Update an existing group |
+| POST | /group/{group_id}/permission | Add a single permission to an existing group |
+| DELETE | /group/{group_id}/permission | Remove a single permission from an existing group |
 | DELETE | /group/{group_id} | Delete an existing group |
 | GET | /mapper | View all mappers |
 | POST | /mapper | Create a new mapper |

v-api-permission-derive/src/lib.rs

@@ -953,6 +953,8 @@ fn permission_storage_trait_tokens(
 ) -> proc_macro2::TokenStream {
     let contract_tokens = permission_storage_contract_tokens(permission_type, contract_settings);
     let expand_tokens = permission_storage_expand_tokens(permission_type, expand_settings.clone());
+    let expand_value_tokens =
+        permission_storage_expand_value_tokens(permission_type, &expand_settings);
     let implies_tokens = permission_storage_implies_tokens(
         permission_type,
         implies_settings,
@@ -964,11 +966,49 @@ fn permission_storage_trait_tokens(
         impl v_model::permissions::PermissionStorage for #permission_type {
             #contract_tokens
             #expand_tokens
+            #expand_value_tokens
             #implies_tokens
         }
     }
 }
 
+/// Generates `expand_value`, which splits a permission that carries a set of values into one
+/// permission per value.
+///
+/// Only iter expansions without an external source qualify. These are permissions who hold all of
+/// the direct values required for expansion. Expansions that depend on an external source are left
+/// alone.
+fn permission_storage_expand_value_tokens(
+    permission_type: &Ident,
+    expand_settings: &[(Variant, ExpandSettings)],
+) -> proc_macro2::TokenStream {
+    let branches = expand_settings
+        .iter()
+        .filter(|(_, setting)| matches!(setting.kind, ExpandKind::Iter) && setting.source.is_none())
+        .map(|(variant, setting)| {
+            let set_ident = &variant.ident;
+            let value_ident = &setting.variant;
+            quote! {
+                #permission_type::#set_ident(values) => Some(
+                    values
+                        .iter()
+                        .map(|value| #permission_type::#value_ident(value.clone()))
+                        .collect()
+                ),
+            }
+        })
+        .collect::<Vec<_>>();
+
+    quote! {
+        fn expand_value(&self) -> Option<Vec<Self>> {
+            match self {
+                #(#branches)*
+                _ => None,
+            }
+        }
+    }
+}
+
 fn permission_storage_contract_tokens(
     permission_type: &Ident,
     contract_settings: Vec<(Variant, ContractSettings)>,

v-api-permission-derive/tests/derive.rs

@@ -603,6 +603,7 @@ fn joined_actor(
         created_at: Utc::now(),
         updated_at: Utc::now(),
         deleted_at: None,
+        generation: 0,
     }
 }