Skip to content

Select single permissions level per principal - #3904

Merged
denik merged 19 commits into
mainfrom
denik/permissions-testserver
Nov 12, 2025
Merged

Select single permissions level per principal#3904
denik merged 19 commits into
mainfrom
denik/permissions-testserver

Conversation

@denik

@denikdenik commented Nov 11, 2025•
edited
Loading

Copy link
Copy Markdown
Contributor

Changes

When multiple permissions are present, select one per principal (highest of all available),

Why

Backend only stores one permission level per principal, whatever is latest in the request. So if users define multiple levels for the same principal, arbitrary level is going to be send to the backend, just whatever happens to be last in request. In some case, terraform will reject multiple levels and error.

Why we select max level: The intent is usually to have some default permissions applied broadly (e.g., CAN_VIEW) and then grant higher permission (e.g. CAN_MANAGE) to selected principal, in which case principal has both CAN_VIEW and CAN_MANAGE which is the same as just CAN_MANAGE.

Should fix#3864

Tests

New acceptance test.
Fix testserver to match real backend as tested by #3900

@eng-dev-ecosystem-bot

eng-dev-ecosystem-bot commented Nov 11, 2025•
edited
Loading

Copy link
Copy Markdown
Collaborator

Run: 19303253543

Env🔄​flaky💚​RECOVERED🙈​SKIP✅​pass🙈​skipTime
💚​aws linux1135960515:14
💚​aws windows1136060415:56
💚​aws-ucws linux1149449620:02
💚​aws-ucws windows1149549520:03
💚​azure linux1135960420:03
💚​azure windows1136060319:27
💚​azure-ucws linux1149049518:57
💚​azure-ucws windows1149149418:32
🔄​gcp linux2135460719:20
🔄​gcp windows111134560617:07
14 failing tests:
Test Nameaws linuxaws windowsaws-ucws linuxaws-ucws windowsazure linuxazure windowsazure-ucws linuxazure-ucws windowsgcp linuxgcp windows
TestAccept💚​R💚​R💚​R💚​R💚​R💚​R💚​R💚​R🔄​f💚​R
TestAccept/bundle/deployment/bind/dashboard✅​p✅​p✅​p✅​p✅​p✅​p✅​p✅​p🔄​f✅​p
TestAccept/bundle/deployment/bind/job/job-spark-python-task✅​p✅​p✅​p✅​p✅​p✅​p✅​p✅​p✅​p🔄​f
TestAccept/bundle/generate/auto-bind✅​p✅​p✅​p✅​p✅​p✅​p✅​p✅​p✅​p🔄​f
TestAccept/bundle/run/app-with-job🙈​S🙈​S🙈​S🙈​S🙈​S🙈​S🙈​S🙈​S🙈​S🙈​S
TestAccept/bundle/templates/default-python/combinations/classic✅​p✅​p✅​p✅​p✅​p✅​p✅​p✅​p✅​p🔄​f
TestAccept/bundle/templates/default-python/combinations/classic/DATABRICKS_BUNDLE_ENGINE=terraform/DLT=no/NBOOK=no/PY=no✅​p✅​p✅​p✅​p✅​p✅​p✅​p✅​p✅​p🔄​f
TestGenerateFromExistingPipelineAndDeploy✅​p✅​p✅​p✅​p✅​p✅​p✅​p✅​p✅​p🔄​f
TestFsCpFileToDirFileNotOverwritten✅​p✅​p✅​p✅​p✅​p✅​p✅​p✅​p✅​p🔄​f
TestFsCpFileToDirFileNotOverwritten/local_to_dbfs✅​p✅​p✅​p✅​p✅​p✅​p✅​p✅​p✅​p🔄​f
TestFsCpFileToDirWithOverwriteFlag/dbfs_to_dbfs✅​p✅​p✅​p✅​p✅​p✅​p✅​p✅​p✅​p🔄​f
TestFsCpFileToDirWithOverwriteFlag/dbfs_to_local✅​p✅​p✅​p✅​p✅​p✅​p✅​p✅​p✅​p🔄​f
TestFsCpFileToFileFileNotOverwritten✅​p✅​p✅​p✅​p✅​p✅​p✅​p✅​p✅​p🔄​f
TestFsCpFileToFileFileNotOverwritten/dbfs_to_dbfs✅​p✅​p✅​p✅​p✅​p✅​p✅​p✅​p✅​p🔄​f
Top 33 slowest tests (at least 2 minutes):
durationenvtestname
7:30gcp linuxTestAccept/bundle/resources/clusters/deploy/data_security_mode/DATABRICKS_BUNDLE_ENGINE=direct
7:04azure windowsTestAccept/bundle/resources/clusters/deploy/data_security_mode/DATABRICKS_BUNDLE_ENGINE=direct
6:30aws-ucws linuxTestAccept/bundle/resources/clusters/deploy/update-after-create/DATABRICKS_BUNDLE_ENGINE=direct
6:12aws-ucws linuxTestAccept/bundle/resources/clusters/deploy/update-after-create/DATABRICKS_BUNDLE_ENGINE=terraform
6:04gcp windowsTestAccept/bundle/resources/clusters/deploy/data_security_mode/DATABRICKS_BUNDLE_ENGINE=direct
6:02azure windowsTestAccept/bundle/resources/clusters/deploy/update-after-create/DATABRICKS_BUNDLE_ENGINE=direct
5:53aws windowsTestAccept/bundle/resources/clusters/deploy/update-after-create/DATABRICKS_BUNDLE_ENGINE=terraform
5:51aws-ucws windowsTestAccept/bundle/resources/clusters/deploy/data_security_mode/DATABRICKS_BUNDLE_ENGINE=direct
5:49azure windowsTestAccept/bundle/resources/clusters/deploy/update-after-create/DATABRICKS_BUNDLE_ENGINE=terraform
5:48aws-ucws linuxTestAccept/bundle/resources/clusters/deploy/data_security_mode/DATABRICKS_BUNDLE_ENGINE=direct
5:47aws-ucws windowsTestAccept/bundle/resources/clusters/deploy/update-after-create/DATABRICKS_BUNDLE_ENGINE=terraform
5:41azure linuxTestAccept/bundle/resources/clusters/deploy/update-after-create/DATABRICKS_BUNDLE_ENGINE=terraform
5:39aws windowsTestAccept/bundle/resources/clusters/deploy/update-after-create/DATABRICKS_BUNDLE_ENGINE=direct
5:34gcp windowsTestAccept/bundle/resources/clusters/deploy/update-after-create/DATABRICKS_BUNDLE_ENGINE=terraform
5:31gcp windowsTestAccept/bundle/resources/clusters/deploy/update-after-create/DATABRICKS_BUNDLE_ENGINE=direct
5:26gcp linuxTestAccept/bundle/resources/clusters/deploy/update-after-create/DATABRICKS_BUNDLE_ENGINE=terraform
5:20gcp linuxTestAccept/bundle/resources/clusters/deploy/update-after-create/DATABRICKS_BUNDLE_ENGINE=direct
5:14azure linuxTestAccept/bundle/resources/clusters/deploy/data_security_mode/DATABRICKS_BUNDLE_ENGINE=direct
5:13aws windowsTestAccept/bundle/resources/clusters/deploy/data_security_mode/DATABRICKS_BUNDLE_ENGINE=direct
5:00aws windowsTestSecretsPutSecretStringValue
4:55aws-ucws windowsTestAccept/bundle/resources/clusters/deploy/update-after-create/DATABRICKS_BUNDLE_ENGINE=direct
4:35azure-ucws windowsTestAccept/bundle/resources/clusters/deploy/data_security_mode/DATABRICKS_BUNDLE_ENGINE=direct
4:30azure linuxTestAccept/bundle/resources/clusters/deploy/update-after-create/DATABRICKS_BUNDLE_ENGINE=direct
4:13azure-ucws linuxTestAccept/bundle/resources/clusters/deploy/update-after-create/DATABRICKS_BUNDLE_ENGINE=direct
4:04azure-ucws windowsTestAccept/bundle/resources/clusters/deploy/update-after-create/DATABRICKS_BUNDLE_ENGINE=direct
3:41azure-ucws windowsTestAccept/bundle/resources/clusters/deploy/update-after-create/DATABRICKS_BUNDLE_ENGINE=terraform
3:39azure-ucws linuxTestAccept/bundle/resources/clusters/deploy/data_security_mode/DATABRICKS_BUNDLE_ENGINE=direct
3:22azure-ucws linuxTestAccept/bundle/resources/synced_database_tables/basic
3:07aws linuxTestSecretsPutSecretStringValue
2:54azure-ucws windowsTestAccept/bundle/resources/synced_database_tables/basic
2:40aws linuxTestAccept/bundle/resources/clusters/deploy/update-after-create/DATABRICKS_BUNDLE_ENGINE=direct
2:27azure-ucws linuxTestAccept/bundle/resources/clusters/deploy/update-after-create/DATABRICKS_BUNDLE_ENGINE=terraform
2:22aws linuxTestAccept/bundle/resources/clusters/deploy/update-after-create/DATABRICKS_BUNDLE_ENGINE=terraform

@denikdenik changed the title Update permissions testserver to better match real backendSelect single permissions level per principalNov 11, 2025
@denik
denik changed the base branch from main to denik/permissions-collapseNovember 11, 2025 14:25
@denik
denik marked this pull request as ready for review November 11, 2025 14:25
Base automatically changed from denik/permissions-collapse to mainNovember 11, 2025 15:08
@denik
denikforce-pushed the denik/permissions-testserver branch from d4db81f to 4409c34CompareNovember 11, 2025 15:12
pietern
pietern reviewed Nov 11, 2025
View reviewed changes
Comment threadbundle/config/mutator/resourcemutator/fix_permissions.go
Comment threadbundle/config/mutator/resourcemutator/fix_permissions.go
Comment threadbundle/config/mutator/resourcemutator/fix_permissions.go
@denik
denik requested a review from pieternNovember 11, 2025 16:20
@denik
denikforce-pushed the denik/permissions-testserver branch from b23087e to aec1336CompareNovember 12, 2025 11:57
@denik
denikforce-pushed the denik/permissions-testserver branch from aec1336 to 8d976c9CompareNovember 12, 2025 12:17
@denikdenik mentioned this pull request Nov 12, 2025
Merged
@denik
denikforce-pushed the denik/permissions-testserver branch from 735bcf4 to 90356daCompareNovember 12, 2025 14:43
@denik
denik enabled auto-merge November 12, 2025 14:56
andrewnester
andrewnester approved these changes Nov 12, 2025
View reviewed changes
Comment threadbundle/config/mutator/resourcemutator/fix_permissions.go
@denik
denik added this pull request to the merge queueNov 12, 2025
Merged via the queue into main with commit 60246c7Nov 12, 2025
13 checks passed
@denik
denik deleted the denik/permissions-testserver branch November 12, 2025 16:36
denik added a commit that referenced this pull request Nov 13, 2025
@denik
add changelog entry for#3904
40ba4c8
denik added a commit that referenced this pull request Nov 13, 2025
@denik
Add changelog entry for#3904(#3910)
3b55b21
deco-sdk-taggingBot added a commit that referenced this pull request Nov 13, 2025
@deco-sdk-tagging
[Release] Release v0.277.0
3560784
## Release v0.277.0
### Bundles
* Add `default-minimal` template for users who want a clean slate without sample code ([#3885](#3885))
* Add validation that served_models and served_entities are not used at the same time. Add client side translation logic. ([#3880](#3880))
* Filter out provided permissions, to select a single permissions level per principal (([#3904](#3904))).
@denikdenik mentioned this pull request Nov 13, 2025
Closed
@github-actionsgithub-actionsBot mentioned this pull request Jan 3, 2026
Closed
denik added a commit that referenced this pull request May 20, 2026
@denik
Update testserver jobs to add server-side fields like real backend (#…
a6fbcac
…3909)
## Why
Makes it easier to write local+cloud tests. Extracted from
#3904
denik added a commit that referenced this pull request May 20, 2026
@denik
Select single permissions level per principal (#3904)
83e07a0
## Changes
When multiple permissions are present, select one per principal (highest
of all available),
## Why
Backend only stores one permission level per principal, whatever is
latest in the request. So if users define multiple levels for the same
principal, arbitrary level is going to be send to the backend, just
whatever happens to be last in request. In some case, terraform will
reject multiple levels and error.
Why we select max level: The intent is usually to have some default
permissions applied broadly (e.g., CAN_VIEW) and then grant higher
permission (e.g. CAN_MANAGE) to selected principal, in which case
principal has both CAN_VIEW and CAN_MANAGE which is the same as just
CAN_MANAGE.
Should fix#3864
## Tests
New acceptance test.
Fix testserver to match real backend as tested by
#3900
denik added a commit that referenced this pull request May 20, 2026
@denik
Add changelog entry for#3904(#3910)
e4798ee
denik pushed a commit that referenced this pull request May 20, 2026
@deco-sdk-tagging
[Release] Release v0.277.0
accb737
## Release v0.277.0
### Bundles
* Add `default-minimal` template for users who want a clean slate without sample code ([#3885](#3885))
* Add validation that served_models and served_entities are not used at the same time. Add client side translation logic. ([#3880](#3880))
* Filter out provided permissions, to select a single permissions level per principal (([#3904](#3904))).
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@andrewnesterandrewnesterandrewnester approved these changes
@pieternpieternpietern approved these changes
@anton-107anton-107Awaiting requested review from anton-107
@shreyas-goenkashreyas-goenkaAwaiting requested review from shreyas-goenka

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

v0.275.0 is Flagging "CAN_MANAGE_RUN" as an invalid job permission

4 participants

@denik@eng-dev-ecosystem-bot@pietern@andrewnester