Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: adding new "team_settings" table to Hasura #3289

Merged
merged 11 commits into from
Jun 20, 2024
116 changes: 116 additions & 0 deletions hasura.planx.uk/metadata/tables.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -1649,6 +1649,122 @@
- role: platformAdmin
permission:
filter: {}
- table:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Generally, it's worth adopting a principle of least-privileged access to any tables. It's always worth being overly-conservative with permissions initially, and then granting access when we hit a requirement to access them.

What I think this means for this PR is that -

  • The public role does not need access to GovNotify fields (email_reply_to_id, help_email, help_opening_hours, help_phone) as these are read by the backend when posting out emails. If this assumption is wrong, we can grant access when we hit features that require them.

  • teamEditors can only update their own team_settings - they cannot update the team_settings of a team which they aren't a member of. Hasura has a neat way of handling this - take a look at how this is handled in team_themes where the same restriction applies. Hasura has good docs on this here, which are useful for context. Happy to talk this through if helpful, just let me know 👍

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This type of thing? @DafyddLlyr

hasura snippet showing row permissions

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yep, that's the one! Looks correct to me - you can check that the filter matches team_themes (and I think there may be even a way of copying directly).

name: team_settings
schema: public
object_relationships:
- name: team
using:
foreign_key_constraint_on: team_id
select_permissions:
- role: api
permission:
columns:
- has_planning_data
- id
- team_id
- boundary_json
- boundary_url
- email_reply_to_id
- external_planning_site_name
- external_planning_site_url
- help_email
- help_opening_hours
- help_phone
- homepage
- reference_code
filter: {}
comment: ""
- role: platformAdmin
permission:
columns:
- has_planning_data
- id
- team_id
- boundary_json
- boundary_url
- email_reply_to_id
- external_planning_site_name
- external_planning_site_url
- help_email
- help_opening_hours
- help_phone
- homepage
- reference_code
filter: {}
comment: ""
- role: public
permission:
columns:
- boundary_json
- boundary_url
- external_planning_site_name
- external_planning_site_url
- has_planning_data
- homepage
- id
- reference_code
- team_id
filter: {}
comment: ""
- role: teamEditor
permission:
columns:
- has_planning_data
- id
- team_id
- boundary_json
- boundary_url
- email_reply_to_id
- external_planning_site_name
- external_planning_site_url
- help_email
- help_opening_hours
- help_phone
- homepage
- reference_code
filter: {}
comment: ""
update_permissions:
- role: platformAdmin
permission:
columns:
- boundary_url
- email_reply_to_id
- external_planning_site_name
- external_planning_site_url
- has_planning_data
- help_email
- help_opening_hours
- help_phone
- homepage
- reference_code
filter: {}
check: null
comment: ""
- role: teamEditor
permission:
columns:
- boundary_url
- email_reply_to_id
- external_planning_site_name
- external_planning_site_url
- has_planning_data
- help_email
- help_opening_hours
- help_phone
- homepage
- reference_code
filter:
team:
members:
_and:
- user_id:
_eq: x-hasura-user-id
- role:
_eq: teamEditor
Comment on lines +1758 to +1765
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

check: null
comment: ""
- table:
name: team_themes
schema: public
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
DROP TABLE "public"."team_settings";
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
CREATE TABLE "public"."team_settings" ("id" serial NOT NULL,
"team_id" integer NOT NULL,
"reference_code" text,
"homepage" text,
"help_email" text NOT NULL DEFAULT '[email protected]',
"help_phone" text NOT NULL DEFAULT '(01234) 567890',
"help_opening_hours" text NOT NULL DEFAULT 'Monday - Friday, 9am - 5pm',
"email_reply_to_id" text NOT NULL DEFAULT '727d48fa-cb8a-42f9-b8b2-55032f3bb451',
"has_planning_data" boolean NOT NULL DEFAULT False,
"external_planning_site_url" text DEFAULT 'https://www.planningportal.co.uk/',
"external_planning_site_name" text DEFAULT 'Planning Portal',
"boundary_url" text,
"boundary_json" jsonb NOT NULL DEFAULT '{"type": "Feature", "geometry": {"type": "Polygon", "coordinates": [[[1.9134116, 49.528423], [1.9134116, 61.331151], [1.9134116, 61.331151], [-10.76418, 61.331151], [-10.76418, 49.528423]]]}, "properties": {}}'::jsonb,
PRIMARY KEY ("id") ,
FOREIGN KEY ("team_id") REFERENCES "public"."teams"("id") ON UPDATE cascade ON DELETE cascade,
UNIQUE ("id"), UNIQUE ("team_id"), UNIQUE ("reference_code"));
COMMENT ON TABLE "public"."team_settings" IS E'Global settings for boundary and contact details';

comment on column "public"."team_settings"."reference_code" is E'Team name in three letter short form';
comment on column "public"."team_settings"."team_id" is E'Linked ID to Teams table';
comment on column "public"."team_settings"."help_phone" is E'For use in gov notify emails';
comment on column "public"."team_settings"."help_email" is E'For use in gov notify emails';
comment on column "public"."team_settings"."help_opening_hours" is E'For use in gov notify emails';
comment on column "public"."team_settings"."email_reply_to_id" is E'Generate by gov notify and relates to the "reply to" address in notifications';
comment on column "public"."team_settings"."boundary_url" is E'User entered boundary linked to https://www.planning.data.gov.uk/';
comment on column "public"."team_settings"."boundary_json" is E'Long form boundary geojson - used to compute boundary_bbox';
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
TRUNCATE TABLE "public"."team_settings";
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
INSERT INTO team_settings (team_id, reference_code, homepage, help_email, help_phone,help_opening_hours ,email_reply_to_id,has_planning_data , external_planning_site_url,external_planning_site_name,boundary_url,boundary_json)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks good and correct to me 👍 Will double check when Pizza is up and test sync script locally also.

SELECT
id as team_id,
reference_code,
settings ->> 'homepage' as homepage,
COALESCE(notify_personalisation ->> 'helpEmail', '[email protected]') as help_email,
COALESCE(notify_personalisation ->> 'helpPhone', '(01234) 567890') as help_phone,
COALESCE(notify_personalisation ->> 'helpOpeningHours', 'Monday - Friday, 9am - 5pm') as help_opening_hours,
COALESCE(notify_personalisation ->> 'emailReplyToId', '727d48fa-cb8a-42f9-b8b2-55032f3bb451') as email_reply_to_id,
CAST(COALESCE(settings ->> 'hasPlanningData', 'false' ) as boolean) as has_planning_data,
COALESCE(settings #>> '{externalPlanningSite,url}', 'https://www.planningportal.co.uk/' ) as external_planning_site_url,
COALESCE(settings #>> '{externalPlanningSite,name}', 'Planning Portal') as external_planning_site_name,
settings ->> 'boundary' as boundary_url,
boundary as boundary_json
FROM teams;
Loading