Skip to content

Commit 5836fce

Browse files
waleedlatif1waleedlatif1
authored
feat(search): manage source permissions through a shared API and CLI (#9845)
* feat(search): manage source permissions through a shared API and CLI * chore(search): document the shared permission grant format
1 parent ba644c0 commit 5836fce

25 files changed

Lines changed: 525 additions & 427 deletions

File tree

‎apps/docs/content/docs/cli/organizations.mdx‎

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -229,14 +229,14 @@ sim organizations members remove <userId> [options]
229229

230230
API request and response schemas: [removeOrganizationMember](/api-reference/organizations/removeOrganizationMember).
231231

232-
## GitLab Search permissions
232+
## Search source permissions
233233

234-
### Get GitLab search permission revision
234+
### Get search source permission revision
235235

236236
OAuth login or personal API key required.
237237

238238
```bash
239-
sim organizations gitlab-permissions get <sourceId> [options]
239+
sim organizations search sources permissions get <sourceId> [options]
240240
```
241241

242242
**Arguments**
@@ -245,7 +245,7 @@ sim organizations gitlab-permissions get <sourceId> [options]
245245

246246
| Argument | Required | Description |
247247
| --- | --- | --- |
248-
| `sourceId` | Yes | Identifier of the configured GitLab Search source. |
248+
| `sourceId` | Yes | Identifier of the configured Search source. |
249249

250250
</CommandTable>
251251

@@ -259,16 +259,16 @@ sim organizations gitlab-permissions get <sourceId> [options]
259259

260260
</CommandTable>
261261

262-
API request and response schemas: [getGitLabSearchPermissions](/api-reference/organizations/getGitLabSearchPermissions).
262+
API request and response schemas: [getSearchSourcePermissions](/api-reference/organizations/getSearchSourcePermissions).
263263

264-
### Replace GitLab search permission CSVs
264+
### Replace search source permissions
265265

266266
OAuth login or personal API key required.
267267

268-
This replaces both GitLab permission files. Readers omitted from the new grants lose access.
268+
This replaces the source’s permission grants. Readers omitted from the new grants lose access.
269269

270270
```bash
271-
sim organizations gitlab-permissions replace <sourceId> [options]
271+
sim organizations search sources permissions replace <sourceId> [options]
272272
```
273273

274274
**Arguments**
@@ -277,7 +277,7 @@ sim organizations gitlab-permissions replace <sourceId> [options]
277277

278278
| Argument | Required | Description |
279279
| --- | --- | --- |
280-
| `sourceId` | Yes | Identifier of the configured GitLab Search source. |
280+
| `sourceId` | Yes | Identifier of the configured Search source. |
281281

282282
</CommandTable>
283283

@@ -288,14 +288,13 @@ sim organizations gitlab-permissions replace <sourceId> [options]
288288
| Option | Required | Description |
289289
| --- | --- | --- |
290290
| `--organization <value>` | Yes | Organization identifier. |
291-
| `--expected-revision <value>` | Yes | Current permission revision obtained before generating this snapshot. |
292-
| `--user-mapping <json\|@file>` | Yes | GitLab user IDs and their verified Sim email addresses. (JSON, or @path / @- to read a file or stdin). |
293-
| `--project-permissions <json\|@file>` | Yes | GitLab project paths and the IDs of users granted access. (JSON, or @path / @- to read a file or stdin). |
291+
| `--expected-revision <value>` | Yes | Permission revision read before exporting the grants. |
292+
| `--permissions <json\|@file>` | Yes | Complete permission grants in the source provider’s format. (JSON, or @path / @- to read a file or stdin). |
294293
| `-y, --yes` | Yes | Confirm this operation. |
295294

296295
</CommandTable>
297296

298-
API request and response schemas: [replaceGitLabSearchPermissions](/api-reference/organizations/replaceGitLabSearchPermissions).
297+
API request and response schemas: [replaceSearchSourcePermissions](/api-reference/organizations/replaceSearchSourcePermissions).
299298

300299
## Invitations
301300

‎apps/docs/content/docs/cli/reference.mdx‎

Lines changed: 65 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -4288,72 +4288,6 @@ sim organizations sso policy update [options]
42884288

42894289
API request and response schemas: [updateSsoPolicy](/api-reference/organizations/updateSsoPolicy).
42904290

4291-
### sim organizations gitlab-permissions get
4292-
4293-
Get GitLab search permission revision (OAuth login or personal API key required)
4294-
4295-
```bash
4296-
sim organizations gitlab-permissions get <sourceId> [options]
4297-
```
4298-
4299-
**Arguments**
4300-
4301-
<CommandTable>
4302-
4303-
| Argument | Required | Description |
4304-
| --- | --- | --- |
4305-
| `sourceId` | Yes | Identifier of the configured GitLab Search source. |
4306-
4307-
</CommandTable>
4308-
4309-
**Options**
4310-
4311-
<CommandTable>
4312-
4313-
| Option | Required | Description |
4314-
| --- | --- | --- |
4315-
| `--organization <value>` | Yes | Organization identifier. |
4316-
4317-
</CommandTable>
4318-
4319-
API request and response schemas: [getGitLabSearchPermissions](/api-reference/organizations/getGitLabSearchPermissions).
4320-
4321-
### sim organizations gitlab-permissions replace
4322-
4323-
Replace GitLab search permission CSVs (OAuth login or personal API key required)
4324-
4325-
This replaces both GitLab permission files. Readers omitted from the new grants lose access.
4326-
4327-
```bash
4328-
sim organizations gitlab-permissions replace <sourceId> [options]
4329-
```
4330-
4331-
**Arguments**
4332-
4333-
<CommandTable>
4334-
4335-
| Argument | Required | Description |
4336-
| --- | --- | --- |
4337-
| `sourceId` | Yes | Identifier of the configured GitLab Search source. |
4338-
4339-
</CommandTable>
4340-
4341-
**Options**
4342-
4343-
<CommandTable>
4344-
4345-
| Option | Required | Description |
4346-
| --- | --- | --- |
4347-
| `--organization <value>` | Yes | Organization identifier. |
4348-
| `--expected-revision <value>` | Yes | Current permission revision obtained before generating this snapshot. |
4349-
| `--user-mapping <json\|@file>` | Yes | GitLab user IDs and their verified Sim email addresses. (JSON, or @path / @- to read a file or stdin). |
4350-
| `--project-permissions <json\|@file>` | Yes | GitLab project paths and the IDs of users granted access. (JSON, or @path / @- to read a file or stdin). |
4351-
| `-y, --yes` | Yes | Confirm this operation. |
4352-
4353-
</CommandTable>
4354-
4355-
API request and response schemas: [replaceGitLabSearchPermissions](/api-reference/organizations/replaceGitLabSearchPermissions).
4356-
43574291
### sim organizations get
43584292

43594293
Get organization (OAuth login or personal API key required)
@@ -4602,6 +4536,71 @@ sim organizations usage events [options]
46024536

46034537
API request and response schemas: [listOrganizationUsageEvents](/api-reference/organizations/listOrganizationUsageEvents).
46044538

4539+
### sim organizations search sources permissions get
4540+
4541+
Get search source permission revision (OAuth login or personal API key required)
4542+
4543+
```bash
4544+
sim organizations search sources permissions get <sourceId> [options]
4545+
```
4546+
4547+
**Arguments**
4548+
4549+
<CommandTable>
4550+
4551+
| Argument | Required | Description |
4552+
| --- | --- | --- |
4553+
| `sourceId` | Yes | Identifier of the configured Search source. |
4554+
4555+
</CommandTable>
4556+
4557+
**Options**
4558+
4559+
<CommandTable>
4560+
4561+
| Option | Required | Description |
4562+
| --- | --- | --- |
4563+
| `--organization <value>` | Yes | Organization identifier. |
4564+
4565+
</CommandTable>
4566+
4567+
API request and response schemas: [getSearchSourcePermissions](/api-reference/organizations/getSearchSourcePermissions).
4568+
4569+
### sim organizations search sources permissions replace
4570+
4571+
Replace search source permissions (OAuth login or personal API key required)
4572+
4573+
This replaces the source’s permission grants. Readers omitted from the new grants lose access.
4574+
4575+
```bash
4576+
sim organizations search sources permissions replace <sourceId> [options]
4577+
```
4578+
4579+
**Arguments**
4580+
4581+
<CommandTable>
4582+
4583+
| Argument | Required | Description |
4584+
| --- | --- | --- |
4585+
| `sourceId` | Yes | Identifier of the configured Search source. |
4586+
4587+
</CommandTable>
4588+
4589+
**Options**
4590+
4591+
<CommandTable>
4592+
4593+
| Option | Required | Description |
4594+
| --- | --- | --- |
4595+
| `--organization <value>` | Yes | Organization identifier. |
4596+
| `--expected-revision <value>` | Yes | Permission revision read before exporting the grants. |
4597+
| `--permissions <json\|@file>` | Yes | Complete permission grants in the source provider’s format. (JSON, or @path / @- to read a file or stdin). |
4598+
| `-y, --yes` | Yes | Confirm this operation. |
4599+
4600+
</CommandTable>
4601+
4602+
API request and response schemas: [replaceSearchSourcePermissions](/api-reference/organizations/replaceSearchSourcePermissions).
4603+
46054604
### sim organizations list
46064605

46074606
List organizations (OAuth login or personal API key required)

‎apps/docs/content/docs/search/gitlab.mdx‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ To rotate the PAT, supply its replacement in source settings. A blank token reta
8989

9090
### Automate updates with GitLab CI
9191

92-
After an admin configures a source in **Non-admin token** mode, a job can [read its revision](/api-reference/organizations/getGitLabSearchPermissions) and [replace both CSVs](/api-reference/organizations/replaceGitLabSearchPermissions). Copy `SIM_ORG_ID` and `SIM_SOURCE_ID` from the source settings URL: `/o/<organizationId>/settings/integrations/sources/<sourceId>`. Set `SIM_BASE_URL` to your Sim origin (for hosted Sim, `https://www.sim.ai`).
92+
After an admin configures a source in **Non-admin token** mode, a job can [read its revision](/api-reference/organizations/getSearchSourcePermissions) and [replace both CSVs](/api-reference/organizations/replaceSearchSourcePermissions). Copy `SIM_ORG_ID` and `SIM_SOURCE_ID` from the source settings URL: `/o/<organizationId>/settings/integrations/sources/<sourceId>`. Set `SIM_BASE_URL` to your Sim origin (for hosted Sim, `https://www.sim.ai`).
9393

9494
Store an organization admin's [personal Sim API key](/api-reference/authentication) as a [masked, protected GitLab CI variable](https://docs.gitlab.com/ci/variables/) named `SIM_API_KEY`. A personal key inherits its owner's access. This endpoint can only read the revision or replace both CSVs; it cannot change the GitLab PAT, host, or project.
9595

@@ -106,15 +106,16 @@ sync_gitlab_permissions:
106106
script:
107107
- |
108108
set -eu
109-
url="${SIM_BASE_URL%/}/api/v2/organizations/$SIM_ORG_ID/search/sources/$SIM_SOURCE_ID/gitlab-permissions"
109+
url="${SIM_BASE_URL%/}/api/v2/organizations/$SIM_ORG_ID/search/sources/$SIM_SOURCE_ID/permissions"
110110
auth="X-API-Key: $SIM_API_KEY"
111111
current=$(curl --fail --silent --show-error -H "$auth" "$url")
112112
revision=$(printf '%s' "$current" | jq -er '.data.revision')
113113
./ci/export-gitlab-permissions
114114
jq -n --argjson rev "$revision" \
115115
--rawfile users users.csv --rawfile grants project-permissions.csv \
116-
'{expectedRevision: $rev, userMapping: {filename: "users.csv", content: $users},
117-
projectPermissions: {filename: "project-permissions.csv", content: $grants}}' > update.json
116+
'{expectedRevision: $rev, permissions: {provider: "gitlab",
117+
userMapping: {filename: "users.csv", content: $users},
118+
projectPermissions: {filename: "project-permissions.csv", content: $grants}}}' > update.json
118119
curl --fail --silent --show-error --request PUT -H "$auth" \
119120
-H 'Content-Type: application/json' --data-binary @update.json "$url"
120121
```

0 commit comments

Comments
 (0)