<commit_before>package server

import (
	"fmt"

	"github.com/pachyderm/pachyderm/v2/src/auth"
)

var roles = make(map[string]*auth.Role)

func registerRole(r *auth.Role) *auth.Role {
	roles[r.Name] = r
	return r
}

func getRole(name string) (*auth.Role, error) {
	r, ok := roles[name]
	if !ok {
		return nil, fmt.Errorf("unknown role %q", name)
	}
	return r, nil
}

func init() {
	// repoReader has the ability to view files, commits, branches
	// and create pipelines that read from a repo.
	repoReaderRole := registerRole(&auth.Role{
		Name:          auth.RepoReaderRole,
		ResourceTypes: []auth.ResourceType{auth.ResourceType_CLUSTER, auth.ResourceType_REPO},
		Permissions: []auth.Permission{
			auth.Permission_REPO_READ,
			auth.Permission_REPO_INSPECT_COMMIT,
			auth.Permission_REPO_LIST_COMMIT,
			auth.Permission_REPO_LIST_BRANCH,
			auth.Permission_REPO_LIST_FILE,
			auth.Permission_REPO_INSPECT_FILE,
			auth.Permission_REPO_ADD_PIPELINE_READER,
			auth.Permission_REPO_REMOVE_PIPELINE_READER,
			auth.Permission_PIPELINE_LIST_JOB,
		},
	})

	// repoWriter has the ability to create and delete commits,
	// write files to a repo and create pipelines that write to a repo,
	// plus all the permissions of repoReader.
	repoWriterRole := registerRole(&auth.Role{
		Name:          auth.RepoWriterRole,
		ResourceTypes: []auth.ResourceType{auth.ResourceType_CLUSTER, auth.ResourceType_REPO},
		Permissions: combinePermissions(repoReaderRole.Permissions, []auth.Permission{
			auth.Permission_REPO_WRITE,
			auth.Permission_REPO_DELETE_COMMIT,
			auth.Permission_REPO_CREATE_BRANCH,
			auth.Permission_REPO_DELETE_BRANCH,
			auth.Permission_REPO_ADD_PIPELINE_WRITER,
		}),
	})

	// repoOwner has the ability to modify the role bindings for
	// a repo and delete it, plus all the permissions of repoWriter.
	repoOwnerRole := registerRole(&auth.Role{
		Name:          auth.RepoOwnerRole,
		ResourceTypes: []auth.ResourceType{auth.ResourceType_CLUSTER, auth.ResourceType_REPO},
		Permissions: combinePermissions(repoWriterRole.Permissions, []auth.Permission{
			auth.Permission_REPO_MODIFY_BINDINGS,
			auth.Permission_REPO_DELETE,
		}),
	})

	// oidcAppAdmin has the ability to create, update and
	// delete OIDC apps.
	oidcAppAdminRole := registerRole(&auth.Role{
		Name:          auth.OIDCAppAdminRole,
		ResourceTypes: []auth.ResourceType{auth.ResourceType_CLUSTER},
		Permissions: []auth.Permission{
			auth.Permission_CLUSTER_IDENTITY_DELETE_OIDC_CLIENT,
			auth.Permission_CLUSTER_IDENTITY_CREATE_OIDC_CLIENT,
			auth.Permission_CLUSTER_IDENTITY_UPDATE_OIDC_CLIENT,
			auth.Permission_CLUSTER_IDENTITY_LIST_OIDC_CLIENTS,
			auth.Permission_CLUSTER_IDENTITY_GET_OIDC_CLIENT,
		},
	})

	// idpAdmin has the ability to create, update and delete
	// identity providers.
	idpAdminRole := registerRole(&auth.Role{
		Name:          auth.IDPAdminRole,
		ResourceTypes: []auth.ResourceType{auth.ResourceType_CLUSTER},
		Permissions: []auth.Permission{
			auth.Permission_CLUSTER_IDENTITY_CREATE_IDP,
			auth.Permission_CLUSTER_IDENTITY_UPDATE_IDP,
			auth.Permission_CLUSTER_IDENTITY_LIST_IDPS,
			auth.Permission_CLUSTER_IDENTITY_GET_IDP,
			auth.Permission_CLUSTER_IDENTITY_DELETE_IDP,
		},
	})

	// identityAdmin has the ability to modify the identity
	// server configuration
	identityAdminRole := registerRole(&auth.Role{
		Name:          auth.IdentityAdminRole,
		ResourceTypes: []auth.ResourceType{auth.ResourceType_CLUSTER},
		Permissions: []auth.Permission{
			auth.Permission_CLUSTER_IDENTITY_SET_CONFIG,
			auth.Permission_CLUSTER_IDENTITY_GET_CONFIG,
		},
	})

	// debugger has the ability to produce debug dumps
	debuggerRole := registerRole(&auth.Role{
		Name:          auth.DebuggerRole,
		ResourceTypes: []auth.ResourceType{auth.ResourceType_CLUSTER},
		Permissions: []auth.Permission{
			auth.Permission_CLUSTER_DEBUG_DUMP,
		},
	})

	// robotUser has the ability to create tokens for any robot user
	robotUserRole := registerRole(&auth.Role{
		Name:          auth.RobotUserRole,
		ResourceTypes: []auth.ResourceType{auth.ResourceType_CLUSTER},<commit_msg>roles: add GET_PACHD_LOGS to debugger, as the debug dump returns logs anyway<commit_after>package server

import (
	"fmt"

	"github.com/pachyderm/pachyderm/v2/src/auth"
)

var roles = make(map[string]*auth.Role)

func registerRole(r *auth.Role) *auth.Role {
	roles[r.Name] = r
	return r
}

func getRole(name string) (*auth.Role, error) {
	r, ok := roles[name]
	if !ok {
		return nil, fmt.Errorf("unknown role %q", name)
	}
	return r, nil
}

func init() {
	// repoReader has the ability to view files, commits, branches
	// and create pipelines that read from a repo.
	repoReaderRole := registerRole(&auth.Role{
		Name:          auth.RepoReaderRole,
		ResourceTypes: []auth.ResourceType{auth.ResourceType_CLUSTER, auth.ResourceType_REPO},
		Permissions: []auth.Permission{
			auth.Permission_REPO_READ,
			auth.Permission_REPO_INSPECT_COMMIT,
			auth.Permission_REPO_LIST_COMMIT,
			auth.Permission_REPO_LIST_BRANCH,
			auth.Permission_REPO_LIST_FILE,
			auth.Permission_REPO_INSPECT_FILE,
			auth.Permission_REPO_ADD_PIPELINE_READER,
			auth.Permission_REPO_REMOVE_PIPELINE_READER,
			auth.Permission_PIPELINE_LIST_JOB,
		},
	})

	// repoWriter has the ability to create and delete commits,
	// write files to a repo and create pipelines that write to a repo,
	// plus all the permissions of repoReader.
	repoWriterRole := registerRole(&auth.Role{
		Name:          auth.RepoWriterRole,
		ResourceTypes: []auth.ResourceType{auth.ResourceType_CLUSTER, auth.ResourceType_REPO},
		Permissions: combinePermissions(repoReaderRole.Permissions, []auth.Permission{
			auth.Permission_REPO_WRITE,
			auth.Permission_REPO_DELETE_COMMIT,
			auth.Permission_REPO_CREATE_BRANCH,
			auth.Permission_REPO_DELETE_BRANCH,
			auth.Permission_REPO_ADD_PIPELINE_WRITER,
		}),
	})

	// repoOwner has the ability to modify the role bindings for
	// a repo and delete it, plus all the permissions of repoWriter.
	repoOwnerRole := registerRole(&auth.Role{
		Name:          auth.RepoOwnerRole,
		ResourceTypes: []auth.ResourceType{auth.ResourceType_CLUSTER, auth.ResourceType_REPO},
		Permissions: combinePermissions(repoWriterRole.Permissions, []auth.Permission{
			auth.Permission_REPO_MODIFY_BINDINGS,
			auth.Permission_REPO_DELETE,
		}),
	})

	// oidcAppAdmin has the ability to create, update and
	// delete OIDC apps.
	oidcAppAdminRole := registerRole(&auth.Role{
		Name:          auth.OIDCAppAdminRole,
		ResourceTypes: []auth.ResourceType{auth.ResourceType_CLUSTER},
		Permissions: []auth.Permission{
			auth.Permission_CLUSTER_IDENTITY_DELETE_OIDC_CLIENT,
			auth.Permission_CLUSTER_IDENTITY_CREATE_OIDC_CLIENT,
			auth.Permission_CLUSTER_IDENTITY_UPDATE_OIDC_CLIENT,
			auth.Permission_CLUSTER_IDENTITY_LIST_OIDC_CLIENTS,
			auth.Permission_CLUSTER_IDENTITY_GET_OIDC_CLIENT,
		},
	})

	// idpAdmin has the ability to create, update and delete
	// identity providers.
	idpAdminRole := registerRole(&auth.Role{
		Name:          auth.IDPAdminRole,
		ResourceTypes: []auth.ResourceType{auth.ResourceType_CLUSTER},
		Permissions: []auth.Permission{
			auth.Permission_CLUSTER_IDENTITY_CREATE_IDP,
			auth.Permission_CLUSTER_IDENTITY_UPDATE_IDP,
			auth.Permission_CLUSTER_IDENTITY_LIST_IDPS,
			auth.Permission_CLUSTER_IDENTITY_GET_IDP,
			auth.Permission_CLUSTER_IDENTITY_DELETE_IDP,
		},
	})

	// identityAdmin has the ability to modify the identity
	// server configuration
	identityAdminRole := registerRole(&auth.Role{
		Name:          auth.IdentityAdminRole,
		ResourceTypes: []auth.ResourceType{auth.ResourceType_CLUSTER},
		Permissions: []auth.Permission{
			auth.Permission_CLUSTER_IDENTITY_SET_CONFIG,
			auth.Permission_CLUSTER_IDENTITY_GET_CONFIG,
		},
	})

	// debugger has the ability to produce debug dumps
	debuggerRole := registerRole(&auth.Role{
		Name:          auth.DebuggerRole,
		ResourceTypes: []auth.ResourceType{auth.ResourceType_CLUSTER},
		Permissions: []auth.Permission{
			auth.Permission_CLUSTER_DEBUG_DUMP,
			auth.Permission_CLUSTER_GET_PACHD_LOGS,
		},
	})

	// robotUser has the ability to create tokens for any robot user
	robotUserRole := registerRole(&auth.Role{
		Name:          auth.RobotUserRole,
		ResourceTypes: []auth.ResourceType{auth.ResourceType_CLUSTER},
{'fraction_non_alphanumeric': 0.09156976744186046, 'fraction_numerical': 0.00024224806201550387, 'mean_word_length': 4.910522548317824, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3080558', 'n_tokens_mistral': 2926, 'n_tokens_neox': 2751, 'n_words': 511}