feat(auth) - New privilege for Associate entities for entities tags and glossary terms

datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/resolvers/mutate/AddTagResolver.java

@@ -38,6 +38,10 @@ public CompletableFuture<Boolean> get(DataFetchingEnvironment environment) throw
           "Unauthorized to perform this action. Please contact your DataHub administrator.");
     }
 
+    if (!LabelUtils.isAuthorizedToAssociateTag(environment.getContext(), tagUrn)) {
+      throw new AuthorizationException("Only users granted permission to this tag can assign or remove it");
+    }
+
     return GraphQLConcurrencyUtils.supplyAsync(
         () -> {
           LabelUtils.validateResourceAndLabel(

datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/resolvers/mutate/AddTagsResolver.java

@@ -43,6 +43,12 @@ public CompletableFuture<Boolean> get(DataFetchingEnvironment environment) throw
                 "Unauthorized to perform this action. Please contact your DataHub administrator.");
           }
 
+          tagUrns.forEach((tagUrn) -> {
+            if (!LabelUtils.isAuthorizedToAssociateTag(environment.getContext(), tagUrn)) {
+              throw new AuthorizationException("Only users granted permission to this tag can assign or remove it");
+            }
+          });
+
           LabelUtils.validateResourceAndLabel(
               context.getOperationContext(),
               tagUrns,

datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/resolvers/mutate/BatchAddTagsResolver.java

@@ -45,7 +45,7 @@ public CompletableFuture<Boolean> get(DataFetchingEnvironment environment) throw
         () -> {
 
           // First, validate the batch
-          validateTags(context.getOperationContext(), tagUrns);
+          validateTags(context, tagUrns);
 
           if (resources.size() == 1 && resources.get(0).getSubResource() != null) {
             return handleAddTagsToSingleSchemaField(context, resources, tagUrns);
@@ -127,9 +127,13 @@ private Boolean attemptBatchAddTagsWithSiblings(
     }
   }
 
-  private void validateTags(@Nonnull OperationContext opContext, List<Urn> tagUrns) {
+  private void validateTags(@Nonnull QueryContext context, List<Urn> tagUrns) {
     for (Urn tagUrn : tagUrns) {
-      LabelUtils.validateLabel(opContext, tagUrn, Constants.TAG_ENTITY_NAME, _entityService);
+      LabelUtils.validateLabel(context.getOperationContext(), tagUrn, Constants.TAG_ENTITY_NAME, _entityService);
+
+      if (!LabelUtils.isAuthorizedToAssociateTag(context, tagUrn)) {
+        throw new AuthorizationException("Only users granted permission to this tag can assign or remove it");
+      }
     }
   }
 

datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/resolvers/mutate/BatchRemoveTagsResolver.java

@@ -39,6 +39,9 @@ public CompletableFuture<Boolean> get(DataFetchingEnvironment environment) throw
     return GraphQLConcurrencyUtils.supplyAsync(
         () -> {
 
+          // First, validate the tag urns
+          validateTags(tagUrns, context);
+
           // First, validate the batch
           validateInputResources(context.getOperationContext(), resources, context);
 
@@ -57,6 +60,14 @@ public CompletableFuture<Boolean> get(DataFetchingEnvironment environment) throw
         "get");
   }
 
+  private void validateTags(List<Urn> tagUrns, QueryContext context) {
+    for (Urn tagUrn : tagUrns) {
+      if (!LabelUtils.isAuthorizedToAssociateTag(context, tagUrn)) {
+        throw new AuthorizationException("Only users granted permission to this tag can assign or remove it");
+      }
+    }
+  }
+
   private void validateInputResources(
       @Nonnull OperationContext opContext, List<ResourceRefInput> resources, QueryContext context) {
     for (ResourceRefInput resource : resources) {

datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/resolvers/mutate/RemoveTagResolver.java

@@ -36,6 +36,9 @@ public CompletableFuture<Boolean> get(DataFetchingEnvironment environment) throw
       throw new AuthorizationException(
           "Unauthorized to perform this action. Please contact your DataHub administrator.");
     }
+    if (!LabelUtils.isAuthorizedToAssociateTag(environment.getContext(), tagUrn)) {
+      throw new AuthorizationException("Only users granted permission to this tag can assign or remove it");
+    }
 
     return GraphQLConcurrencyUtils.supplyAsync(
         () -> {

datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/resolvers/mutate/util/LabelUtils.java

@@ -258,6 +258,21 @@ public static boolean isAuthorizedToUpdateTags(
         orPrivilegeGroups);
   }
 
+  public static boolean isAuthorizedToAssociateTag(@Nonnull QueryContext context, Urn targetUrn) {
+
+    // Decide whether the current principal should be allowed to associate the tag
+    final DisjunctivePrivilegeGroup orPrivilegeGroups = new DisjunctivePrivilegeGroup(ImmutableList.of(
+        new ConjunctivePrivilegeGroup(ImmutableList.of(PoliciesConfig.ASSOCIATE_TAGS_PRIVILEGE.getType()))
+    ));
+
+    return AuthorizationUtils.isAuthorized(
+        context.getAuthorizer(),
+        context.getActorUrn(),
+        targetUrn.getEntityType(),
+        targetUrn.toString(),
+        orPrivilegeGroups);
+  }
+
   public static boolean isAuthorizedToUpdateTerms(
       @Nonnull QueryContext context, Urn targetUrn, String subResource) {
 

datahub-graphql-core/src/main/resources/entity.graphql

@@ -9143,6 +9143,10 @@ enum PolicyMatchCondition {
   Whether the field matches the value
   """
   EQUALS
+  """
+  Whether the field does not the value
+  """
+  NOT_EQUALS
 }
 
 """

datahub-web-react/src/app/entity/shared/utils.ts

@@ -97,6 +97,12 @@ function getGraphqlErrorCode(e) {
 
 export const handleBatchError = (urns, e, defaultMessage) => {
     if (urns.length > 1 && getGraphqlErrorCode(e) === 403) {
+        if (e.message === 'Only users granted permission to this tag can assign or remove it') {
+            return {
+                content: `${e.message}. The bulk edit being performed will not be saved.`,
+                duration: 3,
+            };
+        }
         return {
             content:
                 'Your bulk edit selection included entities that you are unauthorized to update. The bulk edit being performed will not be saved.',

datahub-web-react/src/app/permissions/policy/PolicyDetailsModal.tsx

@@ -3,9 +3,14 @@ import { Link } from 'react-router-dom';
 import { Button, Divider, Modal, Tag, Typography } from 'antd';
 import styled from 'styled-components';
 import { useEntityRegistry } from '../../useEntityRegistry';
-import { Maybe, Policy, PolicyState, PolicyType } from '../../../types.generated';
+import { Maybe, Policy, PolicyMatchCondition, PolicyState, PolicyType } from '../../../types.generated';
 import { useAppConfig } from '../../useAppConfig';
-import { convertLegacyResourceFilter, getFieldValues, mapResourceTypeToDisplayName } from './policyUtils';
+import {
+    convertLegacyResourceFilter,
+    getFieldCondition,
+    getFieldValues,
+    mapResourceTypeToDisplayName,
+} from './policyUtils';
 import AvatarsGroup from '../AvatarsGroup';
 
 type PrivilegeOptionType = {
@@ -67,9 +72,11 @@ export default function PolicyDetailsModal({ policy, visible, onClose, privilege
     const isMetadataPolicy = policy?.type === PolicyType.Metadata;
 
     const resources = convertLegacyResourceFilter(policy?.resources);
+
     const resourceTypes = getFieldValues(resources?.filter, 'TYPE') || [];
     const dataPlatformInstances = getFieldValues(resources?.filter, 'DATA_PLATFORM_INSTANCE') || [];
     const resourceEntities = getFieldValues(resources?.filter, 'URN') || [];
+    const policyMatchCondition = getFieldCondition(resources?.filter, 'URN');
     const domains = getFieldValues(resources?.filter, 'DOMAIN') || [];
 
     const {
@@ -158,6 +165,13 @@ export default function PolicyDetailsModal({ policy, visible, onClose, privilege
                                     );
                                 })) || <PoliciesTag>All</PoliciesTag>}
                         </div>
+                        <div>
+                            <Typography.Title level={5}>Asset Condition</Typography.Title>
+                            <ThinDivider />
+                            <PoliciesTag>
+                                {policyMatchCondition === PolicyMatchCondition.NotEquals ? 'Excludes' : 'Includes'}
+                            </PoliciesTag>
+                        </div>
                         <div>
                             <Typography.Title level={5}>Assets</Typography.Title>
                             <ThinDivider />

datahub-web-react/src/app/permissions/policy/PolicyPrivilegeForm.tsx

@@ -1,6 +1,6 @@
 import React, { useEffect, useMemo, useRef, useState } from 'react';
 import { Link } from 'react-router-dom';
-import { Form, Select, Tag, Tooltip, Typography, Tag as CustomTag } from 'antd';
+import { Form, Select, Tag, Tooltip, Typography, Tag as CustomTag, Checkbox } from 'antd';
 import styled from 'styled-components/macro';
 
 import { useEntityRegistry } from '../../useEntityRegistry';
@@ -9,13 +9,14 @@ import {
     useGetSearchResultsForMultipleLazyQuery,
     useGetSearchResultsLazyQuery,
 } from '../../../graphql/search.generated';
-import { ResourceFilter, PolicyType, EntityType, Domain, Entity } from '../../../types.generated';
+import { ResourceFilter, PolicyType, EntityType, Domain, Entity, PolicyMatchCondition } from '../../../types.generated';
 import {
     convertLegacyResourceFilter,
     createCriterionValue,
     createCriterionValueWithEntity,
     EMPTY_POLICY,
     getFieldValues,
+    getFieldCondition,
     getFieldValuesOfTags,
     mapResourceTypeToDisplayName,
     mapResourceTypeToEntityType,
@@ -105,6 +106,8 @@ export default function PolicyPrivilegeForm({
     const resourceTypes = getFieldValues(resources.filter, 'TYPE') || [];
     const resourceEntities = getFieldValues(resources.filter, 'URN') || [];
 
+    const matchConditionInitial = getFieldCondition(resources.filter, 'RESOURCE_URN');
+    const [matchCondition, setMatchCondition] = useState(matchConditionInitial);
     const getDisplayName = (entity) => {
         if (!entity) {
             return null;
@@ -180,7 +183,7 @@ export default function PolicyPrivilegeForm({
         };
         setResources({
             ...resources,
-            filter: setFieldValues(filter, 'TYPE', [...resourceTypes, createCriterionValue(selectedResourceType)]),
+            filter: setFieldValues(filter, 'TYPE', [...resourceTypes, createCriterionValue(selectedResourceType)], PolicyMatchCondition.Equals),
         });
     };
 
@@ -194,6 +197,7 @@ export default function PolicyPrivilegeForm({
                 filter,
                 'TYPE',
                 resourceTypes?.filter((criterionValue) => criterionValue.value !== deselectedResourceType),
+                PolicyMatchCondition.Equals,
             ),
         });
     };
@@ -211,7 +215,9 @@ export default function PolicyPrivilegeForm({
                     resource,
                     getEntityFromSearchResults(resourceSearchResults, resource) || null,
                 ),
-            ]),
+            ],
+            matchCondition,
+           ),
         });
     };
 
@@ -226,20 +232,40 @@ export default function PolicyPrivilegeForm({
                 filter,
                 'URN',
                 resourceEntities?.filter((criterionValue) => criterionValue.value !== resource),
+                matchCondition,
             ),
         });
     };
 
+    const updateMatchConditionInResources = (excludeResource) => {
+        const filter = resources.filter || {
+            criteria: [],
+        };
+        setResources({
+            ...resources,
+            filter: setFieldValues(
+                filter,
+                'RESOURCE_URN',
+                resourceEntities,
+                excludeResource ? PolicyMatchCondition.NotEquals : PolicyMatchCondition.Equals,
+            ),
+        });
+    };
     // When a domain is selected, add its urn to the list of domains
     const onSelectDomain = (domainUrn, domainObj?: Domain) => {
         const filter = resources.filter || {
             criteria: [],
         };
         const domainEntity = domainObj || getEntityFromSearchResults(domainSearchResults, domainUrn);
-        const updatedFilter = setFieldValues(filter, 'DOMAIN', [
+        const updatedFilter = setFieldValues(
+          filter,
+          'DOMAIN',
+          [
             ...domains,
             createCriterionValueWithEntity(domainUrn, domainEntity || null),
-        ]);
+          ],
+          PolicyMatchCondition.Equals,
+        );
         setResources({
             ...resources,
             filter: updatedFilter,
@@ -262,6 +288,7 @@ export default function PolicyPrivilegeForm({
                 filter,
                 'DOMAIN',
                 domains?.filter((criterionValue) => criterionValue.value !== domain),
+                PolicyMatchCondition.Equals,
             ),
         });
     };
@@ -321,6 +348,23 @@ export default function PolicyPrivilegeForm({
             : displayStr;
     };
 
+    const getResourceText = (policyMatch) => {
+        if (policyMatch === PolicyMatchCondition.Equals) {
+            return (
+                <Typography.Paragraph>
+                    Search for specific resources the policy should apply to. If <b>none</b> is selected, policy is
+                    applied to <b>all</b> resources of the given type.
+                </Typography.Paragraph>
+            );
+        }
+        return (
+            <Typography.Paragraph>
+                Search for specific resource(s) the policy exclusion should apply to. If <b>none</b> is selected, policy
+                is applied to <b>all</b> resources of the given type.
+            </Typography.Paragraph>
+        );
+    };
+
     function handleCLickOutside() {
         // delay closing the domain navigator so we don't get a UI "flash" between showing search results and navigator
         setTimeout(() => setIsFocusedOnInput(false), 0);
@@ -488,39 +532,57 @@ export default function PolicyPrivilegeForm({
                 </Form.Item>
             )}
             {showResourceFilterInput && (
-                <Form.Item label={<Typography.Text strong>Resource</Typography.Text>}>
-                    <Typography.Paragraph>
-                        Search for specific resources the policy should apply to. If <b>none</b> is selected, policy is
-                        applied to <b>all</b> resources of the given type.
-                    </Typography.Paragraph>
-                    <Select
-                        notFoundContent="No search results found"
-                        value={resourceSelectValue}
-                        mode="multiple"
-                        filterOption={false}
-                        placeholder="Apply to ALL resources by default. Select specific resources to apply to."
-                        onSelect={onSelectResource}
-                        onDeselect={onDeselectResource}
-                        onSearch={handleResourceSearch}
-                        tagRender={(tagProps) => (
-                            <Tag closable={tagProps.closable} onClose={tagProps.onClose}>
-                                <Tooltip title={tagProps.value.toString()}>
-                                    {displayStringWithMaxLength(
-                                        resourceUrnToDisplayName[tagProps.value.toString()] ||
-                                            tagProps.value.toString(),
-                                        75,
-                                    )}
-                                </Tooltip>
-                            </Tag>
-                        )}
-                    >
-                        {resourceSearchResults?.map((result) => (
-                            <Select.Option key={result.entity.urn} value={result.entity.urn}>
-                                {renderSearchResult(result)}
-                            </Select.Option>
-                        ))}
-                    </Select>
-                </Form.Item>
+                <>
+                    <Form.Item label={<Typography.Text strong>Resource Condition</Typography.Text>}>
+                        <Typography.Paragraph>
+                            Selecting the checkbox below will exclude selected resource from the policy. If not
+                            selected, resources selected will be included in the policy.
+                        </Typography.Paragraph>
+                        <Checkbox
+                            checked={matchCondition === PolicyMatchCondition.NotEquals}
+                            onChange={(value) => {
+                                setMatchCondition(
+                                    value?.target?.checked
+                                        ? PolicyMatchCondition.NotEquals
+                                        : PolicyMatchCondition.Equals,
+                                );
+                                updateMatchConditionInResources(value?.target?.checked);
+                            }}
+                        >
+                            Exclude Resources
+                        </Checkbox>
+                    </Form.Item>
+                    <Form.Item label={<Typography.Text strong>Resource</Typography.Text>}>
+                        {getResourceText(matchCondition)}
+                        <Select
+                            notFoundContent="No search results found"
+                            value={resourceSelectValue}
+                            mode="multiple"
+                            filterOption={false}
+                            placeholder="Apply to ALL resources by default. Select specific resources to apply to."
+                            onSelect={onSelectResource}
+                            onDeselect={onDeselectResource}
+                            onSearch={handleResourceSearch}
+                            tagRender={(tagProps) => (
+                                <Tag closable={tagProps.closable} onClose={tagProps.onClose}>
+                                    <Tooltip title={tagProps.value.toString()}>
+                                        {displayStringWithMaxLength(
+                                            resourceUrnToDisplayName[tagProps.value.toString()] ||
+                                                tagProps.value.toString(),
+                                            75,
+                                        )}
+                                    </Tooltip>
+                                </Tag>
+                            )}
+                        >
+                            {resourceSearchResults?.map((result) => (
+                               <Select.Option key={result.entity.urn} value={result.entity.urn}>
+                                 {renderSearchResult(result)}
+                               </Select.Option>
+                            ))}
+                        </Select>
+                    </Form.Item>
+                </>
             )}
             {showResourceFilterInput && (
                 <Form.Item label={<Typography.Text strong>Select Tags</Typography.Text>}>