infrahub-server 1.3.6__tar.gz → 1.3.7__tar.gz

{infrahub_server-1.3.6 → infrahub_server-1.3.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: infrahub-server
-Version: 1.3.6
+Version: 1.3.7
 Summary: Infrahub is taking a new approach to Infrastructure Management by providing a new generation of datastore to organize and control all the data that defines how an infrastructure should run.
 License: Apache-2.0
 Author: OpsMill

{infrahub_server-1.3.6 → infrahub_server-1.3.7}/backend/infrahub/api/schema.py

@@ -36,6 +36,7 @@ from infrahub.events import EventMeta
 from infrahub.events.schema_action import SchemaUpdatedEvent
 from infrahub.exceptions import MigrationError
 from infrahub.log import get_log_data, get_logger
+from infrahub.permissions import define_global_permission_from_branch
 from infrahub.types import ATTRIBUTE_PYTHON_TYPES
 from infrahub.worker import WORKER_IDENTITY
 from infrahub.workflows.catalogue import SCHEMA_APPLY_MIGRATION, SCHEMA_VALIDATE_MIGRATION
@@ -287,13 +288,8 @@ async def load_schema(
     context: InfrahubContext = Depends(get_context),
 ) -> SchemaUpdate:
     permission_manager.raise_for_permission(
-        permission=GlobalPermission(
-            action=GlobalPermissions.MANAGE_SCHEMA.value,
-            decision=(
-                PermissionDecision.ALLOW_DEFAULT
-                if branch.name in (GLOBAL_BRANCH_NAME, registry.default_branch)
-                else PermissionDecision.ALLOW_OTHER
-            ).value,
+        permission=define_global_permission_from_branch(
+            permission=GlobalPermissions.MANAGE_SCHEMA, branch_name=branch.name
         )
     )
 

infrahub_server-1.3.7/backend/infrahub/core/graph/__init__.py

@@ -0,0 +1 @@
+GRAPH_VERSION = 35

{infrahub_server-1.3.6 → infrahub_server-1.3.7}/backend/infrahub/core/migrations/graph/__init__.py

@@ -36,6 +36,7 @@ from .m031_check_number_attributes import Migration031
 from .m032_cleanup_orphaned_branch_relationships import Migration032
 from .m033_deduplicate_relationship_vertices import Migration033
 from .m034_find_orphaned_schema_fields import Migration034
+from .m035_orphan_relationships import Migration035
 
 if TYPE_CHECKING:
     from infrahub.core.root import Root
@@ -77,6 +78,7 @@ MIGRATIONS: list[type[GraphMigration | InternalSchemaMigration | ArbitraryMigrat
     Migration032,
     Migration033,
     Migration034,
+    Migration035,
 ]
 
 

{infrahub_server-1.3.6 → infrahub_server-1.3.7}/backend/infrahub/core/migrations/graph/m033_deduplicate_relationship_vertices.py

@@ -89,7 +89,7 @@ class Migration033(GraphMigration):
     """
 
     name: str = "033_deduplicate_relationship_vertices"
-    minimum_version: int = 31
+    minimum_version: int = 32
     queries: Sequence[type[Query]] = [DeduplicateRelationshipVerticesQuery]
 
     async def validate_migration(self, db: InfrahubDatabase) -> MigrationResult:  # noqa: ARG002

infrahub_server-1.3.7/backend/infrahub/core/migrations/graph/m035_orphan_relationships.py

@@ -0,0 +1,43 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any, Sequence
+
+from infrahub.core.migrations.shared import GraphMigration, MigrationResult
+
+from ...query import Query, QueryType
+
+if TYPE_CHECKING:
+    from infrahub.database import InfrahubDatabase
+
+
+class CleanupOrphanedRelationshipsQuery(Query):
+    name = "cleanup_orphaned_relationships"
+    type = QueryType.WRITE
+    insert_return = False
+
+    async def query_init(self, db: InfrahubDatabase, **kwargs: dict[str, Any]) -> None:  # noqa: ARG002
+        query = """
+MATCH (rel:Relationship)-[:IS_RELATED]-(peer:Node)
+WITH DISTINCT rel, peer.uuid AS p_uuid
+WITH rel, count(*) AS num_peers
+WHERE num_peers < 2
+DETACH DELETE rel
+        """
+        self.add_to_query(query)
+
+
+class Migration035(GraphMigration):
+    """
+    Remove Relationship vertices that only have a single peer
+    """
+
+    name: str = "035_clean_up_orphaned_relationships"
+    minimum_version: int = 34
+    queries: Sequence[type[Query]] = [CleanupOrphanedRelationshipsQuery]
+
+    async def validate_migration(self, db: InfrahubDatabase) -> MigrationResult:  # noqa: ARG002
+        return MigrationResult()
+
+    async def execute(self, db: InfrahubDatabase) -> MigrationResult:
+        # overrides parent class to skip transaction in case there are a lot of relationships to delete
+        return await self.do_execute(db=db)

{infrahub_server-1.3.6 → infrahub_server-1.3.7}/backend/infrahub/core/node/resource_manager/ip_address_pool.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 import ipaddress
 from typing import TYPE_CHECKING, Any
 
+from infrahub import lock
 from infrahub.core import registry
 from infrahub.core.ipam.reconciler import IpamReconciler
 from infrahub.core.query.ipam import get_ip_addresses
@@ -33,54 +34,55 @@ class CoreIPAddressPool(Node):
         prefixlen: int | None = None,
         at: Timestamp | None = None,
     ) -> Node:
-        # Check if there is already a resource allocated with this identifier
-        # if not, pull all existing prefixes and allocated the next available
-
-        if identifier:
-            query_get = await IPAddressPoolGetReserved.init(db=db, pool_id=self.id, identifier=identifier)
-            await query_get.execute(db=db)
-            result = query_get.get_result()
-
-            if result:
-                address = result.get_node("address")
-                # TODO add support for branch, if the node is reserved with this id in another branch we should return an error
-                node = await registry.manager.get_one(db=db, id=address.get("uuid"), branch=branch)
-
-                if node:
-                    return node
-
-        data = data or {}
-
-        address_type = address_type or data.get("address_type") or self.default_address_type.value  # type: ignore[attr-defined]
-        if not address_type:
-            raise ValueError(
-                f"IPAddressPool: {self.name.value} | "  # type: ignore[attr-defined]
-                "An address_type or a default_value type must be provided to allocate a new IP address"
-            )
-
-        ip_namespace = await self.ip_namespace.get_peer(db=db)  # type: ignore[attr-defined]
-
-        prefixlen = prefixlen or data.get("prefixlen") or self.default_prefix_length.value  # type: ignore[attr-defined]
-
-        next_address = await self.get_next(db=db, prefixlen=prefixlen)
-
-        target_schema = registry.get_node_schema(name=address_type, branch=branch)
-        node = await Node.init(db=db, schema=target_schema, branch=branch, at=at)
-        try:
-            await node.new(db=db, address=str(next_address), ip_namespace=ip_namespace, **data)
-        except ValidationError as exc:
-            raise ValueError(f"IPAddressPool: {self.name.value} | {exc!s}") from exc  # type: ignore[attr-defined]
-        await node.save(db=db, at=at)
-        reconciler = IpamReconciler(db=db, branch=branch)
-        await reconciler.reconcile(ip_value=next_address, namespace=ip_namespace.id, node_uuid=node.get_id())
-
-        if identifier:
-            query_set = await IPAddressPoolSetReserved.init(
-                db=db, pool_id=self.id, identifier=identifier, address_id=node.id, at=at
-            )
-            await query_set.execute(db=db)
-
-        return node
+        async with lock.registry.get(name=self.get_id(), namespace="resource_pool"):
+            # Check if there is already a resource allocated with this identifier
+            # if not, pull all existing prefixes and allocated the next available
+
+            if identifier:
+                query_get = await IPAddressPoolGetReserved.init(db=db, pool_id=self.id, identifier=identifier)
+                await query_get.execute(db=db)
+                result = query_get.get_result()
+
+                if result:
+                    address = result.get_node("address")
+                    # TODO add support for branch, if the node is reserved with this id in another branch we should return an error
+                    node = await registry.manager.get_one(db=db, id=address.get("uuid"), branch=branch)
+
+                    if node:
+                        return node
+
+            data = data or {}
+
+            address_type = address_type or data.get("address_type") or self.default_address_type.value  # type: ignore[attr-defined]
+            if not address_type:
+                raise ValueError(
+                    f"IPAddressPool: {self.name.value} | "  # type: ignore[attr-defined]
+                    "An address_type or a default_value type must be provided to allocate a new IP address"
+                )
+
+            ip_namespace = await self.ip_namespace.get_peer(db=db)  # type: ignore[attr-defined]
+
+            prefixlen = prefixlen or data.get("prefixlen") or self.default_prefix_length.value  # type: ignore[attr-defined]
+
+            next_address = await self.get_next(db=db, prefixlen=prefixlen)
+
+            target_schema = registry.get_node_schema(name=address_type, branch=branch)
+            node = await Node.init(db=db, schema=target_schema, branch=branch, at=at)
+            try:
+                await node.new(db=db, address=str(next_address), ip_namespace=ip_namespace, **data)
+            except ValidationError as exc:
+                raise ValueError(f"IPAddressPool: {self.name.value} | {exc!s}") from exc  # type: ignore[attr-defined]
+            await node.save(db=db, at=at)
+            reconciler = IpamReconciler(db=db, branch=branch)
+            await reconciler.reconcile(ip_value=next_address, namespace=ip_namespace.id, node_uuid=node.get_id())
+
+            if identifier:
+                query_set = await IPAddressPoolSetReserved.init(
+                    db=db, pool_id=self.id, identifier=identifier, address_id=node.id, at=at
+                )
+                await query_set.execute(db=db)
+
+            return node
 
     async def get_next(self, db: InfrahubDatabase, prefixlen: int | None = None) -> IPAddressType:
         resources = await self.resources.get_peers(db=db)  # type: ignore[attr-defined]

infrahub_server-1.3.7/backend/infrahub/core/node/resource_manager/ip_prefix_pool.py

@@ -0,0 +1,124 @@
+from __future__ import annotations
+
+import ipaddress
+from typing import TYPE_CHECKING, Any
+
+from netaddr import IPSet
+
+from infrahub import lock
+from infrahub.core import registry
+from infrahub.core.ipam.reconciler import IpamReconciler
+from infrahub.core.query.ipam import get_subnets
+from infrahub.core.query.resource_manager import (
+    PrefixPoolGetReserved,
+    PrefixPoolSetReserved,
+)
+from infrahub.exceptions import ValidationError
+from infrahub.pools.prefix import get_next_available_prefix
+
+from .. import Node
+
+if TYPE_CHECKING:
+    from infrahub.core.branch import Branch
+    from infrahub.core.ipam.constants import IPNetworkType
+    from infrahub.core.timestamp import Timestamp
+    from infrahub.database import InfrahubDatabase
+
+
+class CoreIPPrefixPool(Node):
+    async def get_resource(
+        self,
+        db: InfrahubDatabase,
+        branch: Branch,
+        identifier: str | None = None,
+        data: dict[str, Any] | None = None,
+        prefixlen: int | None = None,
+        member_type: str | None = None,
+        prefix_type: str | None = None,
+        at: Timestamp | None = None,
+    ) -> Node:
+        async with lock.registry.get(name=self.get_id(), namespace="resource_pool"):
+            # Check if there is already a resource allocated with this identifier
+            # if not, pull all existing prefixes and allocated the next available
+            if identifier:
+                query_get = await PrefixPoolGetReserved.init(db=db, pool_id=self.id, identifier=identifier)
+                await query_get.execute(db=db)
+                result = query_get.get_result()
+                if result:
+                    prefix = result.get_node("prefix")
+                    # TODO add support for branch, if the node is reserved with this id in another branch we should return an error
+                    node = await registry.manager.get_one(db=db, id=prefix.get("uuid"), branch=branch)
+                    if node:
+                        return node
+
+            ip_namespace = await self.ip_namespace.get_peer(db=db)  # type: ignore[attr-defined]
+
+            data = data or {}
+
+            prefixlen = prefixlen or data.get("prefixlen", None) or self.default_prefix_length.value  # type: ignore[attr-defined]
+            if not prefixlen:
+                raise ValueError(
+                    f"IPPrefixPool: {self.name.value} | "  # type: ignore[attr-defined]
+                    "A prefixlen or a default_value must be provided to allocate a new prefix"
+                )
+
+            next_prefix = await self.get_next(db=db, prefixlen=prefixlen)
+
+            prefix_type = prefix_type or data.get("prefix_type", None) or self.default_prefix_type.value  # type: ignore[attr-defined]
+            if not prefix_type:
+                raise ValueError(
+                    f"IPPrefixPool: {self.name.value} | "  # type: ignore[attr-defined]
+                    "A prefix_type or a default_value type must be provided to allocate a new prefix"
+                )
+
+            member_type = member_type or data.get("member_type", None) or self.default_member_type.value.value  # type: ignore[attr-defined]
+            data["member_type"] = member_type
+
+            target_schema = registry.get_node_schema(name=prefix_type, branch=branch)
+            node = await Node.init(db=db, schema=target_schema, branch=branch, at=at)
+            try:
+                await node.new(db=db, prefix=str(next_prefix), ip_namespace=ip_namespace, **data)
+            except ValidationError as exc:
+                raise ValueError(f"IPPrefixPool: {self.name.value} | {exc!s}") from exc  # type: ignore[attr-defined]
+            await node.save(db=db, at=at)
+            reconciler = IpamReconciler(db=db, branch=branch)
+            await reconciler.reconcile(ip_value=next_prefix, namespace=ip_namespace.id, node_uuid=node.get_id())
+
+            if identifier:
+                query_set = await PrefixPoolSetReserved.init(
+                    db=db, pool_id=self.id, identifier=identifier, prefix_id=node.id, at=at
+                )
+                await query_set.execute(db=db)
+
+            return node
+
+    async def get_next(self, db: InfrahubDatabase, prefixlen: int) -> IPNetworkType:
+        resources = await self.resources.get_peers(db=db)  # type: ignore[attr-defined]
+        ip_namespace = await self.ip_namespace.get_peer(db=db)  # type: ignore[attr-defined]
+
+        try:
+            weighted_resources = sorted(resources.values(), key=lambda r: r.allocation_weight.value or 0, reverse=True)
+        except AttributeError:
+            weighted_resources = list(resources.values())
+
+        for resource in weighted_resources:
+            subnets = await get_subnets(
+                db=db,
+                ip_prefix=ipaddress.ip_network(resource.prefix.value),  # type: ignore[attr-defined]
+                namespace=ip_namespace,
+                branch=self._branch,
+                branch_agnostic=True,
+            )
+
+            pool = IPSet([resource.prefix.value])
+            for subnet in subnets:
+                pool.remove(addr=str(subnet.prefix))
+
+            try:
+                prefix_ver = ipaddress.ip_network(resource.prefix.value).version
+                next_available = get_next_available_prefix(pool=pool, prefix_length=prefixlen, prefix_ver=prefix_ver)
+                return next_available
+            except ValueError:
+                continue
+
+        raise IndexError("No more resources available")

{infrahub_server-1.3.6 → infrahub_server-1.3.7}/backend/infrahub/core/node/resource_manager/number_pool.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 from typing import TYPE_CHECKING
 
+from infrahub import lock
 from infrahub.core import registry
 from infrahub.core.query.resource_manager import NumberPoolGetReserved, NumberPoolGetUsed, NumberPoolSetReserved
 from infrahub.core.schema.attribute_parameters import NumberAttributeParameters
@@ -62,24 +63,25 @@ class CoreNumberPool(Node):
         identifier: str | None = None,
         at: Timestamp | None = None,
     ) -> int:
-        # NOTE: ideally we should use the HFID as the identifier (if available)
-        # one of the challenge with using the HFID is that it might change over time
-        # so we need to ensure that the identifier is stable, or we need to handle the case where the identifier changes
-        identifier = identifier or node.get_id()
-
-        # Check if there is already a resource allocated with this identifier
-        # if not, pull all existing number and allocate the next available
-        # TODO add support for branch, if the node is reserved with this id in another branch we should return an error
-        query_get = await NumberPoolGetReserved.init(db=db, branch=branch, pool_id=self.id, identifier=identifier)
-        await query_get.execute(db=db)
-        reservation = query_get.get_reservation()
-        if reservation is not None:
-            return reservation
-
-        # If we have not returned a value we need to find one if avaiable
-        number = await self.get_next(db=db, branch=branch, attribute=attribute)
-        await self.reserve(db=db, number=number, identifier=identifier, at=at)
-        return number
+        async with lock.registry.get(name=self.get_id(), namespace="resource_pool"):
+            # NOTE: ideally we should use the HFID as the identifier (if available)
+            # one of the challenge with using the HFID is that it might change over time
+            # so we need to ensure that the identifier is stable, or we need to handle the case where the identifier changes
+            identifier = identifier or node.get_id()
+
+            # Check if there is already a resource allocated with this identifier
+            # if not, pull all existing number and allocate the next available
+            # TODO add support for branch, if the node is reserved with this id in another branch we should return an error
+            query_get = await NumberPoolGetReserved.init(db=db, branch=branch, pool_id=self.id, identifier=identifier)
+            await query_get.execute(db=db)
+            reservation = query_get.get_reservation()
+            if reservation is not None:
+                return reservation
+
+            # If we have not returned a value we need to find one if avaiable
+            number = await self.get_next(db=db, branch=branch, attribute=attribute)
+            await self.reserve(db=db, number=number, identifier=identifier, at=at)
+            return number
 
     async def get_next(self, db: InfrahubDatabase, branch: Branch, attribute: AttributeSchema) -> int:
         taken = await self.get_used(db=db, branch=branch)

{infrahub_server-1.3.6 → infrahub_server-1.3.7}/backend/infrahub/core/query/branch.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 from typing import TYPE_CHECKING, Any
 
 from infrahub import config
+from infrahub.core.constants import GLOBAL_BRANCH_NAME
 from infrahub.core.query import Query, QueryType
 
 if TYPE_CHECKING:
@@ -21,33 +22,49 @@ class DeleteBranchRelationshipsQuery(Query):
 
     async def query_init(self, db: InfrahubDatabase, **kwargs: Any) -> None:  # noqa: ARG002
         query = """
-// delete all relationships on this branch
-MATCH (s)-[r1]-(d)
-WHERE r1.branch = $branch_name
-CALL (r1) {
-  DELETE r1
+// --------------
+// for every Node created on this branch (it's about to be deleted), find any agnostic relationships
+// connected to the Node and delete them
+// --------------
+OPTIONAL MATCH (:Root)<-[e:IS_PART_OF {status: "active"}]-(n:Node)
+WHERE e.branch = $branch_name
+CALL (n) {
+    OPTIONAL MATCH (n)-[:IS_RELATED {branch: $global_branch_name}]-(rel:Relationship)
+    DETACH DELETE rel
 } IN TRANSACTIONS
 
-// check for any orphaned Node vertices and delete them
-WITH collect(DISTINCT s.uuid) + collect(DISTINCT d.uuid) AS nodes_uuids
-MATCH (s2:Node)-[r2]-(d2)
-WHERE NOT exists((s2)-[:IS_PART_OF]-(:Root))
-AND s2.uuid IN nodes_uuids
-CALL (r2) {
-  DELETE r2
+// reduce the results to a single row
+WITH 1 AS one
+LIMIT 1
+
+// --------------
+// for every edge on this branch, delete it
+// --------------
+MATCH (s)-[r]->(d)
+WHERE r.branch = $branch_name
+CALL (r) {
+    DELETE r
 } IN TRANSACTIONS
 
-// reduce results to a single row
-WITH 1 AS one LIMIT 1
-
-// find any orphaned vertices and delete them
-MATCH (n)
-WHERE NOT exists((n)--())
-CALL (n) {
-  DELETE n
+// --------------
+// get the database IDs of every vertex linked to a deleted edge
+// --------------
+WITH DISTINCT elementId(s) AS s_id, elementId(d) AS d_id
+WITH collect(s_id) + collect(d_id) AS vertex_ids
+UNWIND vertex_ids AS vertex_id
+
+// --------------
+// delete any vertices that are now orphaned
+// --------------
+CALL (vertex_id) {
+    MATCH (n)
+    WHERE elementId(n) = vertex_id
+    AND NOT exists((n)--())
+    DELETE n
 } IN TRANSACTIONS
         """
         self.params["branch_name"] = self.branch_name
+        self.params["global_branch_name"] = GLOBAL_BRANCH_NAME
         self.add_to_query(query)
 
 

{infrahub_server-1.3.6 → infrahub_server-1.3.7}/backend/infrahub/core/query/node.py

@@ -157,19 +157,21 @@ class NodeCreateAllQuery(NodeQuery):
         relationships: list[RelationshipCreateData] = []
         for rel_name in self.node._relationships:
             rel_manager: RelationshipManager = getattr(self.node, rel_name)
-            # Fetch all relationship peers through a single database call for performances.
-            peers = await rel_manager.get_peers(db=db, branch_agnostic=self.branch_agnostic)
+            if rel_manager.schema.cardinality == "many":
+                # Fetch all relationship peers through a single database call for performances.
+                peers = await rel_manager.get_peers(db=db, branch_agnostic=self.branch_agnostic)
 
             for rel in rel_manager._relationships:
-                try:
-                    rel.set_peer(value=peers[rel.get_peer_id()])
-                except KeyError:
-                    pass
-                except ValueError:
-                    # Relationship has not been initialized yet, it means the peer does not exist in db yet
-                    # typically because it will be allocated from a ressource pool. In that case, the peer
-                    # will be fetched using `rel.resolve` later.
-                    pass
+                if rel_manager.schema.cardinality == "many":
+                    try:
+                        rel.set_peer(value=peers[rel.get_peer_id()])
+                    except KeyError:
+                        pass
+                    except ValueError:
+                        # Relationship has not been initialized yet, it means the peer does not exist in db yet
+                        # typically because it will be allocated from a ressource pool. In that case, the peer
+                        # will be fetched using `rel.resolve` later.
+                        pass
 
                 rel_create_data = await rel.get_create_data(db=db, at=at)
                 if rel_create_data.peer_branch_level > deepest_branch_level or (

{infrahub_server-1.3.6 → infrahub_server-1.3.7}/backend/infrahub/graphql/context.py

@@ -5,7 +5,7 @@ from typing import TYPE_CHECKING
 from infrahub.core.constants import GlobalPermissions, InfrahubKind
 from infrahub.core.manager import NodeManager
 from infrahub.exceptions import NodeNotFoundError, ValidationError
-from infrahub.permissions.globals import define_global_permission_from_branch
+from infrahub.permissions import define_global_permission_from_branch
 
 if TYPE_CHECKING:
     from .initialization import GraphqlContext

{infrahub_server-1.3.6 → infrahub_server-1.3.7}/backend/infrahub/graphql/mutations/schema.py

@@ -6,7 +6,7 @@ from graphene import Boolean, Field, InputObjectType, Mutation, String
 
 from infrahub import lock
 from infrahub.core import registry
-from infrahub.core.constants import RESTRICTED_NAMESPACES
+from infrahub.core.constants import RESTRICTED_NAMESPACES, GlobalPermissions
 from infrahub.core.manager import NodeManager
 from infrahub.core.schema import DropdownChoice, GenericSchema, NodeSchema
 from infrahub.database import InfrahubDatabase, retry_db_transaction
@@ -16,6 +16,7 @@ from infrahub.exceptions import ValidationError
 from infrahub.graphql.context import apply_external_context
 from infrahub.graphql.types.context import ContextInput
 from infrahub.log import get_log_data, get_logger
+from infrahub.permissions import define_global_permission_from_branch
 from infrahub.worker import WORKER_IDENTITY
 
 from ..types import DropdownFields
@@ -32,6 +33,14 @@ if TYPE_CHECKING:
 log = get_logger()
 
 
+def _validate_schema_permission(graphql_context: GraphqlContext) -> None:
+    graphql_context.active_permissions.raise_for_permission(
+        permission=define_global_permission_from_branch(
+            permission=GlobalPermissions.MANAGE_SCHEMA, branch_name=graphql_context.branch.name
+        )
+    )
+
+
 class SchemaEnumInput(InputObjectType):
     kind = String(required=True)
     attribute = String(required=True)
@@ -69,6 +78,7 @@ class SchemaDropdownAdd(Mutation):
     ) -> Self:
         graphql_context: GraphqlContext = info.context
 
+        _validate_schema_permission(graphql_context=graphql_context)
         await apply_external_context(graphql_context=graphql_context, context_input=context)
 
         kind = graphql_context.db.schema.get(name=str(data.kind), branch=graphql_context.branch.name)
@@ -130,6 +140,7 @@ class SchemaDropdownRemove(Mutation):
     ) -> dict[str, bool]:
         graphql_context: GraphqlContext = info.context
 
+        _validate_schema_permission(graphql_context=graphql_context)
         kind = graphql_context.db.schema.get(name=str(data.kind), branch=graphql_context.branch.name)
         await apply_external_context(graphql_context=graphql_context, context_input=context)
 
@@ -185,6 +196,7 @@ class SchemaEnumAdd(Mutation):
     ) -> dict[str, bool]:
         graphql_context: GraphqlContext = info.context
 
+        _validate_schema_permission(graphql_context=graphql_context)
         kind = graphql_context.db.schema.get(name=str(data.kind), branch=graphql_context.branch.name)
         await apply_external_context(graphql_context=graphql_context, context_input=context)
 
@@ -230,6 +242,7 @@ class SchemaEnumRemove(Mutation):
     ) -> dict[str, bool]:
         graphql_context: GraphqlContext = info.context
 
+        _validate_schema_permission(graphql_context=graphql_context)
         kind = graphql_context.db.schema.get(name=str(data.kind), branch=graphql_context.branch.name)
         await apply_external_context(graphql_context=graphql_context, context_input=context)
 

{infrahub_server-1.3.6 → infrahub_server-1.3.7}/backend/infrahub/graphql/schema.py

@@ -21,21 +21,10 @@ from .mutations.diff import DiffUpdateMutation
 from .mutations.diff_conflict import ResolveDiffConflict
 from .mutations.generator import GeneratorDefinitionRequestRun
 from .mutations.proposed_change import ProposedChangeMerge, ProposedChangeRequestRunCheck
-from .mutations.relationship import (
-    RelationshipAdd,
-    RelationshipRemove,
-)
-from .mutations.repository import (
-    ProcessRepository,
-    ValidateRepositoryConnectivity,
-)
+from .mutations.relationship import RelationshipAdd, RelationshipRemove
+from .mutations.repository import ProcessRepository, ValidateRepositoryConnectivity
 from .mutations.resource_manager import IPAddressPoolGetResource, IPPrefixPoolGetResource
-from .mutations.schema import (
-    SchemaDropdownAdd,
-    SchemaDropdownRemove,
-    SchemaEnumAdd,
-    SchemaEnumRemove,
-)
+from .mutations.schema import SchemaDropdownAdd, SchemaDropdownRemove, SchemaEnumAdd, SchemaEnumRemove
 from .queries import (
     AccountPermissions,
     AccountToken,

{infrahub_server-1.3.6 → infrahub_server-1.3.7}/backend/infrahub/permissions/__init__.py

@@ -1,4 +1,5 @@
 from infrahub.permissions.backend import PermissionBackend
+from infrahub.permissions.globals import define_global_permission_from_branch
 from infrahub.permissions.local_backend import LocalPermissionBackend
 from infrahub.permissions.manager import PermissionManager
 from infrahub.permissions.report import report_schema_permissions
@@ -9,6 +10,7 @@ __all__ = [
     "LocalPermissionBackend",
     "PermissionBackend",
     "PermissionManager",
+    "define_global_permission_from_branch",
     "get_global_permission_for_kind",
     "report_schema_permissions",
 ]

{infrahub_server-1.3.6 → infrahub_server-1.3.7}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "infrahub-server"
-version = "1.3.6"
+version = "1.3.7"
 description = "Infrahub is taking a new approach to Infrastructure Management by providing a new generation of datastore to organize and control all the data that defines how an infrastructure should run."
 authors = ["OpsMill <info@opsmill.com>"]
 readme = "README.md"