gooddata-pipelines 1.49.0__tar.gz → 1.49.1.dev2__tar.gz

{gooddata_pipelines-1.49.0 → gooddata_pipelines-1.49.1.dev2}/PKG-INFO

@@ -1,23 +1,18 @@
 Metadata-Version: 2.4
 Name: gooddata-pipelines
-Version: 1.49.0
+Version: 1.49.1.dev2
+Summary: GoodData Cloud lifecycle automation pipelines
 Author-email: GoodData <support@gooddata.com>
 License: MIT
 License-File: LICENSE.txt
 Requires-Python: >=3.10
 Requires-Dist: boto3-stubs<2.0.0,>=1.39.3
 Requires-Dist: boto3<2.0.0,>=1.39.3
-Requires-Dist: gooddata-sdk~=1.49.0
+Requires-Dist: gooddata-sdk~=1.49.1.dev2
 Requires-Dist: pydantic<3.0.0,>=2.11.3
 Requires-Dist: requests<3.0.0,>=2.32.3
 Requires-Dist: types-pyyaml<7.0.0,>=6.0.12.20250326
 Requires-Dist: types-requests<3.0.0,>=2.32.0
-Provides-Extra: dev
-Requires-Dist: moto<6.0.0,>=5.1.6; extra == 'dev'
-Requires-Dist: mypy<2.0.0,>=1.16.0; extra == 'dev'
-Requires-Dist: pytest-mock<4.0.0,>=3.14.0; extra == 'dev'
-Requires-Dist: pytest<9.0.0,>=8.3.5; extra == 'dev'
-Requires-Dist: ruff<0.12.0,>=0.11.2; extra == 'dev'
 Description-Content-Type: text/markdown
 
 # GoodData Pipelines

{gooddata_pipelines-1.49.0 → gooddata_pipelines-1.49.1.dev2}/gooddata_pipelines/backup_and_restore/backup_manager.py

@@ -55,7 +55,7 @@ class BackupManager:
 
         self.config = config
 
-        self.storage = self.get_storage(self.config)
+        self.storage = self._get_storage(self.config)
         self.org_id = self._api.get_organization_id()
 
         self.loader = BackupInputProcessor(self._api, self.config.api_page_size)
@@ -67,7 +67,7 @@ class BackupManager:
         host: str,
         token: str,
     ) -> "BackupManager":
-        """Creates a backup worker instance using provided host and token."""
+        """Creates a backup worker instance using the provided host and token."""
         return cls(host=host, token=token, config=config)
 
     @classmethod
@@ -81,7 +81,8 @@ class BackupManager:
         content = profile_content(profile, profiles_path)
         return cls(**content, config=config)
 
-    def get_storage(self, conf: BackupRestoreConfig) -> BackupStorage:
+    @staticmethod
+    def _get_storage(conf: BackupRestoreConfig) -> BackupStorage:
         """Returns the storage class based on the storage type."""
         if conf.storage_type == StorageType.S3:
             return S3Storage(conf)
@@ -100,7 +101,7 @@ class BackupManager:
         else:
             raise RuntimeError(f"{response.status_code}: {response.text}")
 
-    def store_user_data_filters(
+    def _store_user_data_filters(
         self,
         user_data_filters: dict,
         export_path: Path,
@@ -128,20 +129,20 @@ class BackupManager:
                 "user_data_filters",
                 filter["id"] + ".yaml",
             )
-            self.write_to_yaml(udf_file_path, filter)
+            self._write_to_yaml(udf_file_path, filter)
 
     @staticmethod
-    def move_folder(source: Path, destination: Path) -> None:
+    def _move_folder(source: Path, destination: Path) -> None:
         """Moves the source folder to the destination."""
         shutil.move(source, destination)
 
     @staticmethod
-    def write_to_yaml(path: str, source: Any) -> None:
+    def _write_to_yaml(path: str, source: Any) -> None:
         """Writes the source to a YAML file."""
         with open(path, "w") as outfile:
             yaml.dump(source, outfile)
 
-    def get_automations_from_api(self, workspace_id: str) -> Any:
+    def _get_automations_from_api(self, workspace_id: str) -> Any:
         """Returns automations for the workspace as JSON."""
         response: requests.Response = self._api.get_automations(workspace_id)
         if response.ok:
@@ -152,10 +153,10 @@ class BackupManager:
                 + f"{response.status_code}: {response.text}"
             )
 
-    def store_automations(self, export_path: Path, workspace_id: str) -> None:
+    def _store_automations(self, export_path: Path, workspace_id: str) -> None:
         """Stores the automations in the specified export path."""
         # Get the automations from the API
-        automations: Any = self.get_automations_from_api(workspace_id)
+        automations: Any = self._get_automations_from_api(workspace_id)
 
         automations_folder_path: Path = Path(
             export_path,
@@ -184,8 +185,8 @@ class BackupManager:
         # Get the filter views YAML files from the API
         self._api.store_declarative_filter_views(workspace_id, export_path)
 
-        # Move filter views to the subfolder containing analytics model
-        self.move_folder(
+        # Move filter views to the subfolder containing the analytics model
+        self._move_folder(
             Path(export_path, "gooddata_layouts", self.org_id, "filter_views"),
             Path(
                 export_path,
@@ -197,7 +198,7 @@ class BackupManager:
             ),
         )
 
-    def get_workspace_export(
+    def _get_workspace_export(
         self,
         local_target_path: str,
         workspaces_to_export: list[str],
@@ -232,9 +233,9 @@ class BackupManager:
                 # be more transparent/readable and possibly safer for threading
                 self._api.store_declarative_workspace(workspace_id, export_path)
                 self.store_declarative_filter_views(export_path, workspace_id)
-                self.store_automations(export_path, workspace_id)
+                self._store_automations(export_path, workspace_id)
 
-                self.store_user_data_filters(
+                self._store_user_data_filters(
                     user_data_filters, export_path, workspace_id
                 )
                 self.logger.info(f"Stored export for {workspace_id}")
@@ -250,7 +251,7 @@ class BackupManager:
                 + "is correct and that the workspaces exist."
             )
 
-    def archive_gooddata_layouts_to_zip(self, folder: str) -> None:
+    def _archive_gooddata_layouts_to_zip(self, folder: str) -> None:
         """Archives the gooddata_layouts directory to a zip file."""
         try:
             target_subdir = ""
@@ -271,11 +272,12 @@ class BackupManager:
             self.logger.error(f"Error archiving {folder} to zip: {e}")
             raise
 
-    def split_to_batches(
-        self, workspaces_to_export: list[str], batch_size: int
+    @staticmethod
+    def _split_to_batches(
+        workspaces_to_export: list[str], batch_size: int
     ) -> list[BackupBatch]:
-        """Splits the list of workspaces to into batches of the specified size.
-        The batch is respresented as a list of workspace IDs.
+        """Splits the list of workspaces into batches of the specified size.
+        The batch is represented as a list of workspace IDs.
         Returns a list of batches (i.e. list of lists of IDs)
         """
         list_of_batches = []
@@ -286,7 +288,7 @@ class BackupManager:
 
         return list_of_batches
 
-    def process_batch(
+    def _process_batch(
         self,
         batch: BackupBatch,
         stop_event: threading.Event,
@@ -298,14 +300,14 @@ class BackupManager:
         The base wait time is defined by BackupSettings.RETRY_DELAY.
         """
         if stop_event.is_set():
-            # If the stop_event flag is set, return. This will terminate the thread.
+            # If the stop_event flag is set, return. This will terminate the thread
             return
 
         try:
             with tempfile.TemporaryDirectory() as tmpdir:
-                self.get_workspace_export(tmpdir, batch.list_of_ids)
+                self._get_workspace_export(tmpdir, batch.list_of_ids)
 
-                self.archive_gooddata_layouts_to_zip(
+                self._archive_gooddata_layouts_to_zip(
                     str(Path(tmpdir, self.org_id))
                 )
 
@@ -316,7 +318,7 @@ class BackupManager:
                 return
 
             elif retry_count < BackupSettings.MAX_RETRIES:
-                # Retry with exponential backoff until MAX_RETRIES.
+                # Retry with exponential backoff until MAX_RETRIES
                 next_retry = retry_count + 1
                 wait_time = BackupSettings.RETRY_DELAY**next_retry
                 self.logger.info(
@@ -326,13 +328,13 @@ class BackupManager:
                 )
 
                 time.sleep(wait_time)
-                self.process_batch(batch, stop_event, next_retry)
+                self._process_batch(batch, stop_event, next_retry)
             else:
-                # If the batch fails after MAX_RETRIES, raise the error.
+                # If the batch fails after MAX_RETRIES, raise the error
                 self.logger.error(f"Batch failed: {e.__class__.__name__}: {e}")
                 raise
 
-    def process_batches_in_parallel(
+    def _process_batches_in_parallel(
         self,
         batches: list[BackupBatch],
     ) -> None:
@@ -345,14 +347,14 @@ class BackupManager:
         stop_event = threading.Event()
 
         with ThreadPoolExecutor(
-            max_workers=BackupSettings.MAX_WORKERS
+            max_workers=self.config.max_workers
         ) as executor:
             # Set the futures tasks.
             futures = []
             for batch in batches:
                 futures.append(
                     executor.submit(
-                        self.process_batch,
+                        self._process_batch,
                         batch,
                         stop_event,
                     )
@@ -363,10 +365,10 @@ class BackupManager:
                 try:
                     future.result()
                 except Exception:
-                    # On failure, set the flag to True - signal running processes to stop.
+                    # On failure, set the flag to True - signal running processes to stop
                     stop_event.set()
 
-                    # Cancel unstarted threads.
+                    # Cancel unstarted threads
                     for f in futures:
                         if not f.done():
                             f.cancel()
@@ -383,10 +385,10 @@ class BackupManager:
         workspace in storage specified in the configuration.
 
         Args:
-            path_to_csv (str): Path to a CSV file containing a list of workspace IDs.
+            path_to_csv (str): Path to a CSV file containing a list of workspace IDs
             workspace_ids (list[str]): List of workspace IDs
         """
-        self.backup(InputType.LIST_OF_WORKSPACES, path_to_csv, workspace_ids)
+        self._backup(InputType.LIST_OF_WORKSPACES, path_to_csv, workspace_ids)
 
     def backup_hierarchies(
         self, path_to_csv: str | None, workspace_ids: list[str] | None
@@ -394,16 +396,16 @@ class BackupManager:
         """Runs the backup process for a list of hierarchies.
 
         Will take the list of workspace IDs or read the list of workspace IDs
-        from a CSV file and create backup for each those workspaces' hierarchies
+        from a CSV file and create backup for each of those workspaces' hierarchies
         in storage specified in the configuration.
         Workspace hierarchy means the workspace itself and all its direct and
         indirect children.
 
         Args:
-            path_to_csv (str): Path to a CSV file containing a list of workspace IDs.
+            path_to_csv (str): Path to a CSV file containing a list of workspace IDs
             workspace_ids (list[str]): List of workspace IDs
         """
-        self.backup(InputType.HIERARCHY, path_to_csv, workspace_ids)
+        self._backup(InputType.HIERARCHY, path_to_csv, workspace_ids)
 
     def backup_entire_organization(self) -> None:
         """Runs the backup process for the entire organization.
@@ -411,22 +413,22 @@ class BackupManager:
         Will create backup for all workspaces in the organization in storage
         specified in the configuration.
         """
-        self.backup(InputType.ORGANIZATION)
+        self._backup(InputType.ORGANIZATION)
 
-    def backup(
+    def _backup(
         self,
         input_type: InputType,
         path_to_csv: str | None = None,
         workspace_ids: list[str] | None = None,
     ) -> None:
-        """Runs the backup process with selected input type."""
+        """Runs the backup process with the selected input type."""
         try:
             workspaces_to_export: list[str] = self.loader.get_ids_to_backup(
                 input_type,
                 path_to_csv,
                 workspace_ids,
             )
-            batches = self.split_to_batches(
+            batches = self._split_to_batches(
                 workspaces_to_export, self.config.batch_size
             )
 
@@ -434,7 +436,7 @@ class BackupManager:
                 f"Exporting {len(workspaces_to_export)} workspaces in {len(batches)} batches."
             )
 
-            self.process_batches_in_parallel(batches)
+            self._process_batches_in_parallel(batches)
 
             self.logger.info("Backup completed")
         except Exception as e:

{gooddata_pipelines-1.49.0 → gooddata_pipelines-1.49.1.dev2}/gooddata_pipelines/backup_and_restore/constants.py

@@ -1,3 +1,4 @@
+# (C) 2025 GoodData Corporation
 import datetime
 from dataclasses import dataclass
 
@@ -22,7 +23,7 @@ class DirNames:
 
 @dataclass(frozen=True)
 class ConcurrencyDefaults:
-    MAX_WORKERS = 2
+    MAX_WORKERS = 1
     DEFAULT_BATCH_SIZE = 100
 
 

{gooddata_pipelines-1.49.0 → gooddata_pipelines-1.49.1.dev2}/gooddata_pipelines/backup_and_restore/models/storage.py

@@ -21,10 +21,40 @@ class S3StorageConfig(BaseModel):
 
     backup_path: str
     bucket: str
-    profile: str = "default"
+    profile: Optional[str] = None
     aws_access_key_id: Optional[str] = None
     aws_secret_access_key: Optional[str] = None
-    aws_default_region: Optional[str] = None
+    aws_default_region: Optional[str] = "us-east-1"
+
+    @classmethod
+    def from_iam_role(cls, backup_path: str, bucket: str) -> "S3StorageConfig":
+        """Use default IAM role or environment credentials."""
+        return cls(backup_path=backup_path, bucket=bucket)
+
+    @classmethod
+    def from_aws_credentials(
+        cls,
+        backup_path: str,
+        bucket: str,
+        aws_access_key_id: str,
+        aws_secret_access_key: str,
+        aws_default_region: str,
+    ) -> "S3StorageConfig":
+        """Use explicit AWS access keys and region."""
+        return cls(
+            backup_path=backup_path,
+            bucket=bucket,
+            aws_access_key_id=aws_access_key_id,
+            aws_secret_access_key=aws_secret_access_key,
+            aws_default_region=aws_default_region,
+        )
+
+    @classmethod
+    def from_aws_profile(
+        cls, backup_path: str, bucket: str, profile: str
+    ) -> "S3StorageConfig":
+        """Use a named AWS CLI profile."""
+        return cls(backup_path=backup_path, bucket=bucket, profile=profile)
 
 
 class LocalStorageConfig(BaseModel):
@@ -53,6 +83,14 @@ class BackupRestoreConfig(BaseModel):
             description="Batch size must be greater than 0",
         ),
     ] = Field(default=BackupSettings.DEFAULT_BATCH_SIZE)
+    max_workers: Annotated[
+        int,
+        Field(
+            gt=0,
+            lt=3,
+            description="Max workers must be greater than 0 and less than 3",
+        ),
+    ] = Field(default=BackupSettings.MAX_WORKERS)
 
     @classmethod
     def from_yaml(cls, conf_path: str) -> "BackupRestoreConfig":

{gooddata_pipelines-1.49.0 → gooddata_pipelines-1.49.1.dev2}/gooddata_pipelines/backup_and_restore/storage/s3_storage.py

@@ -22,6 +22,7 @@ class S3Storage(BackupStorage):
 
         self._config = conf.storage
         self._session = self._create_boto_session(self._config)
+        self._client = self._session.client("s3")
         self._resource = self._session.resource("s3")
         self._bucket = self._resource.Bucket(self._config.bucket)  # type: ignore [missing library stubs]
         suffix = "/" if not self._config.backup_path.endswith("/") else ""
@@ -43,32 +44,40 @@ class S3Storage(BackupStorage):
                 )
             except Exception:
                 self.logger.warning(
-                    "Failed to create boto3 session with supplied credentials. Falling back to profile..."
+                    "Failed to create boto3 session with supplied credentials."
+                )
+
+        if config.profile:
+            try:
+                return boto3.Session(profile_name=config.profile)
+            except Exception:
+                self.logger.warning(
+                    f"AWS profile [{config.profile}] not found."
                 )
 
         try:
-            return boto3.Session(profile_name=config.profile)
+            return boto3.Session()
         except Exception:
-            self.logger.warning(
-                'AWS profile "[default]" not found. Trying other fallback methods...'
+            self.logger.error(
+                "Failed to create boto3 session with default IAM role or environment credentials."
+            )
+            raise RuntimeError(
+                "Unable to create AWS session. Please check your AWS credentials, profile, or IAM role configuration."
             )
-
-        return boto3.Session()
 
     def _verify_connection(self) -> None:
         """
         Pings the S3 bucket to verify that the connection is working.
         """
         try:
-            # TODO: install boto3 s3 stubs
-            self._resource.meta.client.head_bucket(Bucket=self._config.bucket)
+            self._client.head_bucket(Bucket=self._config.bucket)
         except Exception as e:
             raise RuntimeError(
                 f"Failed to connect to S3 bucket {self._config.bucket}: {e}"
             )
 
     def export(self, folder: str, org_id: str) -> None:
-        """Uploads the content of the folder to S3 as backup."""
+        """Uploads the content of the folder to S3 as a backup."""
         storage_path = f"{self._config.bucket}/{self._backup_path}"
         self.logger.info(f"Uploading {org_id} to {storage_path}")
         folder = f"{folder}/{org_id}"
@@ -77,10 +86,12 @@ class S3Storage(BackupStorage):
             export_path = (
                 f"{self._backup_path}{org_id}/{full_path[len(folder) + 1 :]}/"
             )
-            self._bucket.put_object(Key=export_path)
+            self._client.put_object(Bucket=self._config.bucket, Key=export_path)
 
             for file in files:
                 full_path = os.path.join(subdir, file)
                 with open(full_path, "rb") as data:
                     export_path = f"{self._backup_path}{org_id}/{full_path[len(folder) + 1 :]}"
-                    self._bucket.put_object(Key=export_path, Body=data)
+                    self._client.put_object(
+                        Bucket=self._config.bucket, Key=export_path, Body=data
+                    )

{gooddata_pipelines-1.49.0 → gooddata_pipelines-1.49.1.dev2}/gooddata_pipelines/provisioning/entities/users/models/permissions.py

@@ -1,103 +1,101 @@
 # (C) 2025 GoodData Corporation
-from dataclasses import dataclass
+from abc import abstractmethod
 from enum import Enum
-from typing import Any, Iterator, TypeAlias
+from typing import Any, Iterator, TypeAlias, TypeVar
 
+import attrs
 from gooddata_sdk.catalog.identifier import CatalogAssigneeIdentifier
 from gooddata_sdk.catalog.permission.declarative_model.permission import (
     CatalogDeclarativeSingleWorkspacePermission,
     CatalogDeclarativeWorkspacePermissions,
 )
+from pydantic import BaseModel
 
 from gooddata_pipelines.provisioning.utils.exceptions import BaseUserException
 
-# TODO: refactor the full load and incremental load models to reuse as much as possible
-# TODO: use pydantic models instead of dataclasses?
-# TODO: make the validation logic more readable (as in PermissionIncrementalLoad)
-
 TargetsPermissionDict: TypeAlias = dict[str, dict[str, bool]]
+ConstructorType = TypeVar("ConstructorType", bound="ConstructorMixin")
 
 
-class PermissionType(Enum):
+class PermissionType(str, Enum):
+    # NOTE: Start using StrEnum with Python 3.11
     user = "user"
     user_group = "userGroup"
 
 
-@dataclass(frozen=True)
-class PermissionIncrementalLoad:
-    permission: str
-    workspace_id: str
-    id: str
-    type: PermissionType
-    is_active: bool
+class ConstructorMixin:
+    @staticmethod
+    def _get_id_and_type(
+        permission: dict[str, Any],
+    ) -> tuple[str, PermissionType]:
+        user_id: str | None = permission.get("user_id")
+        user_group_id: str | None = permission.get("ug_id")
+        if user_id and user_group_id:
+            raise ValueError("Only one of user_id or ug_id must be present")
+        elif user_id:
+            return user_id, PermissionType.user
+        elif user_group_id:
+            return user_group_id, PermissionType.user_group
+        else:
+            raise ValueError("Either user_id or ug_id must be present")
 
     @classmethod
     def from_list_of_dicts(
-        cls, data: list[dict[str, Any]]
-    ) -> list["PermissionIncrementalLoad"]:
-        """Creates a list of User objects from list of dicts."""
-        id: str
+        cls: type[ConstructorType], data: list[dict[str, Any]]
+    ) -> list[ConstructorType]:
+        """Creates a list of instances from list of dicts."""
+        # NOTE: We can use typing.Self for the return type in Python 3.11
         permissions = []
         for permission in data:
-            user_id: str | None = permission.get("user_id")
-            user_group_id: str | None = permission.get("ug_id")
-
-            if user_id is not None:
-                target_type = PermissionType.user
-                id = user_id
-            elif user_group_id is not None:
-                target_type = PermissionType.user_group
-                id = user_group_id
-
-            permissions.append(
-                PermissionIncrementalLoad(
-                    permission=permission["ws_permissions"],
-                    workspace_id=permission["ws_id"],
-                    id=id,
-                    type=target_type,
-                    is_active=str(permission["is_active"]).lower() == "true",
-                )
-            )
+            permissions.append(cls.from_dict(permission))
         return permissions
 
+    @classmethod
+    @abstractmethod
+    def from_dict(cls, data: dict[str, Any]) -> Any:
+        """Construction form a dictionary to be implemented by subclasses."""
+        pass
+
 
-@dataclass(frozen=True)
-class PermissionFullLoad:
+class PermissionIncrementalLoad(BaseModel, ConstructorMixin):
     permission: str
     workspace_id: str
-    id: str
-    type: PermissionType
+    id_: str
+    type_: PermissionType
+    is_active: bool
 
     @classmethod
-    def from_list_of_dicts(
-        cls, data: list[dict[str, Any]]
-    ) -> list["PermissionFullLoad"]:
-        """Creates a list of User objects from list of dicts."""
-        permissions = []
-        for permission in data:
-            id = (
-                permission["user_id"]
-                if permission["user_id"]
-                else permission["ug_id"]
-            )
+    def from_dict(cls, data: dict[str, Any]) -> "PermissionIncrementalLoad":
+        """Returns an instance of PermissionIncrementalLoad from a dictionary."""
+        id_, target_type = cls._get_id_and_type(data)
+        return cls(
+            permission=data["ws_permissions"],
+            workspace_id=data["ws_id"],
+            id_=id_,
+            type_=target_type,
+            is_active=data["is_active"],
+        )
 
-            if permission["user_id"]:
-                target_type = PermissionType.user
-            else:
-                target_type = PermissionType.user_group
-
-            permissions.append(
-                PermissionFullLoad(
-                    permission=permission["ws_permissions"],
-                    workspace_id=permission["ws_id"],
-                    id=id,
-                    type=target_type,
-                )
-            )
-        return permissions
 
+class PermissionFullLoad(BaseModel, ConstructorMixin):
+    permission: str
+    workspace_id: str
+    id_: str
+    type_: PermissionType
+
+    @classmethod
+    def from_dict(cls, data: dict[str, Any]) -> "PermissionFullLoad":
+        """Returns an instance of PermissionFullLoad from a dictionary."""
+        id_, target_type = cls._get_id_and_type(data)
+        return cls(
+            permission=data["ws_permissions"],
+            workspace_id=data["ws_id"],
+            id_=id_,
+            type_=target_type,
+        )
 
-@dataclass
+
+@attrs.define
 class PermissionDeclaration:
     users: TargetsPermissionDict
     user_groups: TargetsPermissionDict
@@ -192,7 +190,9 @@ class PermissionDeclaration:
             permissions=permission_declarations
         )
 
-    def add_permission(self, permission: PermissionIncrementalLoad) -> None:
+    def add_incremental_permission(
+        self, permission: PermissionIncrementalLoad
+    ) -> None:
         """
         Adds WSPermission object into respective field within the instance.
         Handles duplicate permissions and different combinations of input
@@ -200,15 +200,15 @@ class PermissionDeclaration:
         """
         target_dict = (
             self.users
-            if permission.type == PermissionType.user
+            if permission.type_ == PermissionType.user
             else self.user_groups
         )
 
-        if permission.id not in target_dict:
-            target_dict[permission.id] = {}
+        if permission.id_ not in target_dict:
+            target_dict[permission.id_] = {}
 
         is_active = permission.is_active
-        target_permissions = target_dict[permission.id]
+        target_permissions = target_dict[permission.id_]
         permission_value = permission.permission
 
         if permission_value not in target_permissions:
@@ -225,6 +225,27 @@ class PermissionDeclaration:
             )
             target_permissions[permission_value] = is_active
 
+    def add_full_load_permission(self, permission: PermissionFullLoad) -> None:
+        """
+        Adds WSPermission object into respective field within the instance.
+        Handles duplicate permissions and different combinations of input
+        and upstream is_active permission states.
+        """
+        target_dict = (
+            self.users
+            if permission.type_ == PermissionType.user
+            else self.user_groups
+        )
+
+        if permission.id_ not in target_dict:
+            target_dict[permission.id_] = {}
+
+        target_permissions = target_dict[permission.id_]
+        permission_value = permission.permission
+
+        if permission_value not in target_permissions:
+            target_permissions[permission_value] = True
+
     def upsert(self, other: "PermissionDeclaration") -> None:
         """
         Modifies the owner object by merging with the other.