Class: Entitlements::Backend::GitHubTeam::Service

Inherits:
Service::GitHub show all
Includes:
Contracts::Builtin, Contracts::Core
Defined in:
lib/entitlements/backend/github_team/service.rb

Defined Under Namespace

Classes: TeamNotFound

Constant Summary collapse

C = 
::Contracts

Constants inherited from Service::GitHub

Service::GitHub::MAX_GRAPHQL_RESULTS, Service::GitHub::MAX_GRAPHQL_RETRIES, Service::GitHub::WAIT_BETWEEN_GRAPHQL_RETRIES

Instance Attribute Summary

Attributes inherited from Service::GitHub

#addr, #org, #ou, #token

Instance Method Summary collapse

Methods inherited from Service::GitHub

#enterprise?, #identifier, #invalidate_org_members_predictive_cache, #org_members, #org_members_from_predictive_cache?, #pending_members

Constructor Details

#initialize(addr: nil, org:, token:, ou:) ⇒ Service

Returns a new instance of Service.



32
33
34
35
36
37
 
# File 'lib/entitlements/backend/github_team/service.rb', line 32

def initialize(addr: nil, org:, token:, ou:)
  super
  Entitlements.cache[:github_team_members] ||= {}
  Entitlements.cache[:github_team_members][org] ||= {}
  @team_cache = Entitlements.cache[:github_team_members][org]
end

Instance Method Details

#create_team(entitlement_group:) ⇒ Object 



217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
 
# File 'lib/entitlements/backend/github_team/service.rb', line 217

def create_team(entitlement_group:)
  begin
    team_name = entitlement_group.cn.downcase
    team_options = { name: team_name, repo_names: [], privacy: "closed" }

    begin
      entitlement_metadata = entitlement_group.metadata
      unless entitlement_metadata["parent_team_name"].nil?
        parent_team_data = graphql_team_data(entitlement_metadata["parent_team_name"])
        team_options[:parent_team_id] = parent_team_data[:team_id]
        Entitlements.logger.debug "create_team(team=#{team_name}) Parent team #{entitlement_metadata["parent_team_name"]} with id #{parent_team_data[:team_id]} found"
      end
    rescue Entitlements::Models::Group::NoMetadata
      Entitlements.logger.debug "create_team(team=#{team_name}) No metadata found"
    end

    Entitlements.logger.debug "create_team(team=#{team_name})"
    octokit.create_team(org, team_options)
    true
  rescue Octokit::UnprocessableEntity => e
    Entitlements.logger.debug "create_team(team=#{team_name}) ERROR - #{e.message}"
    false
  end
end

#from_predictive_cache?(entitlement_group) ⇒ Boolean

Returns:



132
133
134
135
136
 
# File 'lib/entitlements/backend/github_team/service.rb', line 132

def from_predictive_cache?(entitlement_group)
  team_identifier = entitlement_group.cn.downcase
  read_team(entitlement_group) unless @team_cache[team_identifier]
  (@team_cache[team_identifier] && @team_cache[team_identifier][:cache]) ? true : false
end

#invalidate_predictive_cache(entitlement_group) ⇒ Object 



145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
 
# File 'lib/entitlements/backend/github_team/service.rb', line 145

def invalidate_predictive_cache(entitlement_group)
  # If the entry was not from the predictive cache in the first place, just return.
  # This really should not get called if that's the case, but regardless, we don't
  # want to pointlessly hit the API twice.
  return unless from_predictive_cache?(entitlement_group)

  # The entry did come from the predictive cache. Clear out all of the local caches
  # in this object and re-read the data from the API.
  team_identifier = entitlement_group.cn.downcase
  dn = "cn=#{team_identifier},#{ou}"
  Entitlements.logger.debug "Invalidating cache entry for #{dn}"
  Entitlements::Data::Groups::Cached.invalidate(dn)
  @team_cache.delete(team_identifier)
  read_team(entitlement_group)
  nil
end

#read_team(entitlement_group) ⇒ Object 



46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
 
# File 'lib/entitlements/backend/github_team/service.rb', line 46

def read_team(entitlement_group)
  team_identifier = entitlement_group.cn.downcase
  @team_cache[team_identifier] ||= begin
    dn = "cn=#{team_identifier},#{ou}"
    begin
      entitlement_metadata = entitlement_group.metadata
    rescue Entitlements::Models::Group::NoMetadata
      entitlement_metadata = nil
    end

    if (cached_members = Entitlements::Data::Groups::Cached.members(dn))
      Entitlements.logger.debug "Loading GitHub team #{identifier}:#{org}/#{team_identifier} from cache"

      cached_metadata = Entitlements::Data::Groups::Cached.metadata(dn)
      # If both the cached and entitlement metadata are nil, our team metadata is nil
      # If one of the cached or entitlement metadata is nil, we use the other populated metadata hash as-is
      # If both cached and entitlement metadata exist, we combine the two hashes with the cached metadata taking precedence
      #
      # The reason we do this is because an entitlement file should be 1:1 to a GitHub Team. However,
      # entitlements files allow for metadata tags and the GitHub.com Team does not have a place to store those.
      # Therefore, we must combine any existing entitlement metadata entries into the Team metadata hash
      if cached_metadata.nil?
        team_metadata = entitlement_metadata
      elsif entitlement_metadata.nil?
        team_metadata = cached_metadata
      else
        # Always merge the current state metadata (cached or API call) into the entitlement metadata, so that the current state takes precedent
        team_metadata = entitlement_metadata.merge(cached_metadata)
      end

      team = Entitlements::Backend::GitHubTeam::Models::Team.new(
        team_id: -1,
        team_name: team_identifier,
        members: cached_members,
        ou: ou,
        metadata: team_metadata
      )

      { cache: true, value: team }
    else
      Entitlements.logger.debug "Loading GitHub team #{identifier}:#{org}/#{team_identifier}"

      begin
        teamdata = graphql_team_data(team_identifier)
        # The entitlement metadata may have GitHub.com Team metadata which it wants to set, so we must
        # overwrite that metadata with what we get from the API
        if teamdata[:parent_team_name].nil?
          team_metadata = entitlement_metadata
        else
          parent_team_metadata = {
            "parent_team_name" => teamdata[:parent_team_name]
          }
          if entitlement_metadata.nil?
            team_metadata = parent_team_metadata
          else
            # Always merge the current state metadata (cached or API call) into the entitlement metadata, so that the current state takes precedent
            team_metadata = entitlement_metadata.merge(parent_team_metadata)
          end
        end

        team = Entitlements::Backend::GitHubTeam::Models::Team.new(
          team_id: teamdata[:team_id],
          team_name: team_identifier,
          members: Set.new(teamdata[:members]),
          ou: ou,
          metadata: team_metadata
        )
      rescue TeamNotFound
        Entitlements.logger.warn "Team #{team_identifier} does not exist in this GitHub.com organization"
        return nil
      end

      { cache: false, value: team }
    end
  end

  @team_cache[team_identifier][:value]
end

#sync_team(desired_state, current_state) ⇒ Object 



168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
 
# File 'lib/entitlements/backend/github_team/service.rb', line 168

def sync_team(desired_state, current_state)
  begin
    desired_metadata = desired_state.metadata
  rescue Entitlements::Models::Group::NoMetadata
    desired_metadata = {}
  end

  begin
    current_metadata = current_state.metadata
  rescue Entitlements::Models::Group::NoMetadata, NoMethodError
    current_metadata = {}
  end

  changed_parent_team = false
  unless desired_metadata["parent_team_name"] == current_metadata["parent_team_name"]
    # TODO: I'm hard-coding a block for deletes, for now. I'm doing that by making sure we dont set the desired parent_team_id to nil for teams where it is already set
    # :nocov:
    if desired_metadata["parent_team_name"].nil?
      Entitlements.logger.debug "sync_team(team=#{current_state.team_name}): IGNORING GitHub Parent Team DELETE"
    else
    # :nocov:
      Entitlements.logger.debug "sync_team(#{current_state.team_name}=#{current_state.team_id}): Parent team change found - From #{current_metadata["parent_team_name"] || "No Parent Team"} to #{desired_metadata["parent_team_name"]}"
      desired_parent_team_id = team_by_name(org_name: org, team_name: desired_metadata["parent_team_name"])[:id]
      unless desired_parent_team_id.nil?
        # TODO: I'm hard-coding a block for deletes, for now. I'm doing that by making sure we dont set the desired parent_team_id to nil for teams where it is already set
        update_team(team: current_state, metadata: { parent_team_id: desired_parent_team_id })
      end
      changed_parent_team = true
    end
  end

  added_members = desired_state.member_strings.map { |u| u.downcase } - current_state.member_strings.map { |u| u.downcase }
  removed_members = current_state.member_strings.map { |u| u.downcase } - desired_state.member_strings.map { |u| u.downcase }

  added_members.select! { |username| add_user_to_team(user: username, team: current_state) }
  removed_members.select! { |username| remove_user_from_team(user: username, team: current_state) }

  Entitlements.logger.debug "sync_team(#{current_state.team_name}=#{current_state.team_id}): Added #{added_members.count}, removed #{removed_members.count}"
  added_members.any? || removed_members.any? || changed_parent_team
end

#team_by_name(org_name:, team_name:) ⇒ Object 



272
273
274
 
# File 'lib/entitlements/backend/github_team/service.rb', line 272

def team_by_name(org_name:, team_name:)
  octokit.team_by_name(org_name, team_name)
end

#update_team(team:, metadata: {}) ⇒ Object 



251
252
253
254
255
256
257
258
259
260
261
 
# File 'lib/entitlements/backend/github_team/service.rb', line 251

def update_team(team:, metadata: {})
  begin
    Entitlements.logger.debug "update_team(team=#{team.team_name})"
    options = { name: team.team_name, repo_names: [], privacy: "closed", parent_team_id: metadata[:parent_team_id] }
    octokit.update_team(team.team_id, options)
    true
  rescue Octokit::UnprocessableEntity => e
    Entitlements.logger.debug "update_team(team=#{team.team_name}) ERROR - #{e.message}"
    false
  end
end