infrahub-server 1.4.0b1__tar.gz → 1.4.1__tar.gz

{infrahub_server-1.4.0b1 → infrahub_server-1.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: infrahub-server
-Version: 1.4.0b1
+Version: 1.4.1
 Summary: Infrahub is taking a new approach to Infrastructure Management by providing a new generation of datastore to organize and control all the data that defines how an infrastructure should run.
 License: Apache-2.0
 Author: OpsMill
@@ -23,7 +23,7 @@ Requires-Dist: copier (>=9.8.0,<10.0.0)
 Requires-Dist: dulwich (>=0.22.7,<0.23.0)
 Requires-Dist: email-validator (>=2.1,<2.2)
 Requires-Dist: fast-depends (>=2.4.12,<3.0.0)
-Requires-Dist: fastapi (>=0.115,<0.116)
+Requires-Dist: fastapi (==0.116.1)
 Requires-Dist: fastapi-storages (>=0.3,<0.4)
 Requires-Dist: gitpython (>=3,<4)
 Requires-Dist: graphene (>=3.4,<3.5)
@@ -40,8 +40,8 @@ Requires-Dist: opentelemetry-exporter-otlp-proto-grpc (==1.28.1)
 Requires-Dist: opentelemetry-exporter-otlp-proto-http (==1.28.1)
 Requires-Dist: opentelemetry-instrumentation-aio-pika (==0.49b1)
 Requires-Dist: opentelemetry-instrumentation-fastapi (==0.49b1)
-Requires-Dist: prefect (==3.4.11)
-Requires-Dist: prefect-redis (==0.2.3)
+Requires-Dist: prefect (==3.4.13)
+Requires-Dist: prefect-redis (==0.2.4)
 Requires-Dist: pyarrow (>=14,<15)
 Requires-Dist: pydantic (>=2.10,<2.11)
 Requires-Dist: pydantic-settings (>=2.8,<2.9)

{infrahub_server-1.4.0b1 → infrahub_server-1.4.1}/backend/infrahub/api/schema.py

@@ -36,6 +36,7 @@ from infrahub.events import EventMeta
 from infrahub.events.schema_action import SchemaUpdatedEvent
 from infrahub.exceptions import MigrationError
 from infrahub.log import get_log_data, get_logger
+from infrahub.permissions import define_global_permission_from_branch
 from infrahub.types import ATTRIBUTE_PYTHON_TYPES
 from infrahub.worker import WORKER_IDENTITY
 from infrahub.workflows.catalogue import SCHEMA_APPLY_MIGRATION, SCHEMA_VALIDATE_MIGRATION
@@ -287,13 +288,8 @@ async def load_schema(
     context: InfrahubContext = Depends(get_context),
 ) -> SchemaUpdate:
     permission_manager.raise_for_permission(
-        permission=GlobalPermission(
-            action=GlobalPermissions.MANAGE_SCHEMA.value,
-            decision=(
-                PermissionDecision.ALLOW_DEFAULT
-                if branch.name in (GLOBAL_BRANCH_NAME, registry.default_branch)
-                else PermissionDecision.ALLOW_OTHER
-            ).value,
+        permission=define_global_permission_from_branch(
+            permission=GlobalPermissions.MANAGE_SCHEMA, branch_name=branch.name
         )
     )
 

{infrahub_server-1.4.0b1 → infrahub_server-1.4.1}/backend/infrahub/cli/db.py

@@ -53,6 +53,7 @@ from infrahub.database.neo4j import IndexManagerNeo4j
 from infrahub.log import get_logger
 
 from .constants import ERROR_BADGE, FAILED_BADGE, SUCCESS_BADGE
+from .db_commands.check_inheritance import check_inheritance
 from .patch import patch_app
 
 
@@ -175,6 +176,30 @@ async def migrate_cmd(
     await dbdriver.close()
 
 
+@app.command(name="check-inheritance")
+async def check_inheritance_cmd(
+    ctx: typer.Context,
+    fix: bool = typer.Option(False, help="Fix the inheritance of any invalid nodes."),
+    config_file: str = typer.Argument("infrahub.toml", envvar="INFRAHUB_CONFIG"),
+) -> None:
+    """Check the database for any vertices with incorrect inheritance"""
+    logging.getLogger("infrahub").setLevel(logging.WARNING)
+    logging.getLogger("neo4j").setLevel(logging.ERROR)
+    logging.getLogger("prefect").setLevel(logging.ERROR)
+
+    config.load_and_exit(config_file_name=config_file)
+
+    context: CliContext = ctx.obj
+    dbdriver = await context.init_db(retry=1)
+    await initialize_registry(db=dbdriver)
+
+    success = await check_inheritance(db=dbdriver, fix=fix)
+    if not success:
+        raise typer.Exit(code=1)
+
+    await dbdriver.close()
+
+
 @app.command(name="update-core-schema")
 async def update_core_schema_cmd(
     ctx: typer.Context,

infrahub_server-1.4.1/backend/infrahub/cli/db_commands/check_inheritance.py

@@ -0,0 +1,284 @@
+from __future__ import annotations
+
+from collections import defaultdict
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, Any
+
+from rich import print as rprint
+from rich.console import Console
+from rich.table import Table
+
+from infrahub.core import registry
+from infrahub.core.branch.models import Branch
+from infrahub.core.constants import InfrahubKind
+from infrahub.core.migrations.query.node_duplicate import NodeDuplicateQuery, SchemaNodeInfo
+from infrahub.core.query import Query, QueryType
+from infrahub.core.schema import SchemaRoot, internal_schema
+from infrahub.core.schema.manager import SchemaManager
+from infrahub.log import get_logger
+
+from ..constants import FAILED_BADGE, SUCCESS_BADGE
+
+if TYPE_CHECKING:
+    from infrahub.core.schema.node_schema import NodeSchema
+    from infrahub.database import InfrahubDatabase
+
+log = get_logger()
+
+
+class GetSchemaWithUpdatedInheritance(Query):
+    """
+    Get the name, namespace, and branch of any SchemaNodes with _updated_ inheritance
+    This query will only return schemas that have had `inherit_from` updated after they were created
+    """
+
+    name = "get_schema_with_updated_inheritance"
+    type = QueryType.READ
+    insert_return = False
+
+    async def query_init(self, db: InfrahubDatabase, **kwargs: dict[str, Any]) -> None:  # noqa: ARG002
+        query = """
+// find inherit_from attributes that have been updated
+MATCH p = (schema_node:SchemaNode)-[has_attr_e:HAS_ATTRIBUTE {status: "active"}]->(a:Attribute {name: "inherit_from"})
+WHERE has_attr_e.to IS NULL
+CALL (a) {
+  // only get branches on which the value was updated, we can ignore the initial create
+  MATCH (a)-[e:HAS_VALUE]->(:AttributeValue)
+  ORDER BY e.from ASC
+  // tail leaves out the earliest one, which is the initial create
+  RETURN tail(collect(e.branch)) AS branches
+}
+WITH schema_node, a, branches
+WHERE size(branches) > 0
+UNWIND branches AS branch
+WITH DISTINCT schema_node, a, branch
+
+//get branch details
+CALL (branch) {
+  MATCH (b:Branch {name: branch})
+  RETURN b.branched_from AS branched_from, b.hierarchy_level AS branch_level
+}
+
+// get the namespace for the schema
+CALL (schema_node, a, branch, branched_from, branch_level) {
+  MATCH (schema_node)-[e1:HAS_ATTRIBUTE]-(:Attribute {name: "namespace"})-[e2:HAS_VALUE]->(av)
+  WHERE (
+    e1.branch = branch OR
+    (e1.branch_level < branch_level AND e1.from <= branched_from)
+  ) AND e1.to IS NULL
+  AND e1.status = "active"
+  AND (
+    e2.branch = branch OR
+    (e2.branch_level < branch_level AND e2.from <= branched_from)
+  ) AND e2.to IS NULL
+  AND e2.status = "active"
+  ORDER BY e2.branch_level DESC, e1.branch_level DESC, e2.from DESC, e1.from DESC
+  RETURN av.value AS namespace
+  LIMIT 1
+}
+
+// get the name for the schema
+CALL (schema_node, a, branch, branched_from, branch_level) {
+  MATCH (schema_node)-[e1:HAS_ATTRIBUTE]-(:Attribute {name: "name"})-[e2:HAS_VALUE]->(av)
+  WHERE (
+    e1.branch = branch OR
+    (e1.branch_level < branch_level AND e1.from <= branched_from)
+  ) AND e1.to IS NULL
+  AND e1.status = "active"
+  AND (
+    e2.branch = branch OR
+    (e2.branch_level < branch_level AND e2.from <= branched_from)
+  ) AND e2.to IS NULL
+  AND e2.status = "active"
+  ORDER BY e2.branch_level DESC, e1.branch_level DESC, e2.from DESC, e1.from DESC
+  RETURN av.value AS name
+  LIMIT 1
+}
+RETURN name, namespace, branch
+"""
+        self.return_labels = ["name", "namespace", "branch"]
+        self.add_to_query(query)
+
+    def get_updated_inheritance_kinds_by_branch(self) -> dict[str, list[str]]:
+        kinds_by_branch: dict[str, list[str]] = defaultdict(list)
+        for result in self.results:
+            name = result.get_as_type(label="name", return_type=str)
+            namespace = result.get_as_type(label="namespace", return_type=str)
+            branch = result.get_as_type(label="branch", return_type=str)
+            kinds_by_branch[branch].append(f"{namespace}{name}")
+        return kinds_by_branch
+
+
+@dataclass
+class KindLabelCount:
+    kind: str
+    labels: frozenset[str]
+    num_nodes: int
+
+
+@dataclass
+class KindLabelCountCorrected(KindLabelCount):
+    node_schema: NodeSchema
+
+
+class GetAllKindsAndLabels(Query):
+    """
+    Get the kind, labels, and number of nodes for the given kinds and branch
+    """
+
+    name = "get_all_kinds_and_labels"
+    type = QueryType.READ
+    insert_return = False
+
+    def __init__(self, kinds: list[str] | None = None, **kwargs: Any) -> None:
+        super().__init__(**kwargs)
+        self.kinds = kinds
+
+    async def query_init(self, db: InfrahubDatabase, **kwargs: dict[str, Any]) -> None:  # noqa: ARG002
+        self.params["branch_name"] = self.branch.name
+        self.params["branched_from"] = self.branch.get_branched_from()
+        self.params["branch_level"] = self.branch.hierarchy_level
+        kinds_str = "Node"
+        if self.kinds:
+            kinds_str = "|".join(self.kinds)
+        query = """
+MATCH (n:%(kinds_str)s)-[r:IS_PART_OF]->(:Root)
+WHERE (
+    r.branch = $branch_name OR
+    (r.branch_level < $branch_level AND r.from <= $branched_from)
+)
+AND r.to IS NULL
+AND r.status = "active"
+RETURN DISTINCT n.kind AS kind, labels(n) AS labels, count(*) AS num_nodes
+ORDER BY kind ASC
+        """ % {"kinds_str": kinds_str}
+        self.return_labels = ["kind", "labels", "num_nodes"]
+        self.add_to_query(query)
+
+    def get_kind_label_counts(self) -> list[KindLabelCount]:
+        kind_label_counts: list[KindLabelCount] = []
+        for result in self.results:
+            kind = result.get_as_type(label="kind", return_type=str)
+            num_nodes = result.get_as_type(label="num_nodes", return_type=int)
+            labels: list[str] = result.get_as_type(label="labels", return_type=list)
+            # we can ignore the Node label and the label that matches the kind
+            cleaned_labels = frozenset(str(lbl) for lbl in labels if lbl not in ["Node", "CoreNode", kind])
+            kind_label_counts.append(KindLabelCount(kind=kind, labels=cleaned_labels, num_nodes=num_nodes))
+        return kind_label_counts
+
+
+def display_kind_label_counts(kind_label_counts_by_branch: dict[str, list[KindLabelCountCorrected]]) -> None:
+    console = Console()
+
+    table = Table(title="Incorrect Inheritance Nodes")
+
+    table.add_column("Branch")
+    table.add_column("Kind")
+    table.add_column("Incorrect Labels")
+    table.add_column("Num Nodes")
+
+    for branch_name, kind_label_counts in kind_label_counts_by_branch.items():
+        for kind_label_count in kind_label_counts:
+            table.add_row(
+                branch_name, kind_label_count.kind, str(list(kind_label_count.labels)), str(kind_label_count.num_nodes)
+            )
+
+    console.print(table)
+
+
+async def check_inheritance(db: InfrahubDatabase, fix: bool = False) -> bool:
+    """
+    Run migrations to update the inheritance of any nodes with incorrect inheritance from a failed migration
+    1. Identifies node schemas that have had their inheritance updated after they were created
+        a. includes the kind and branch of the inheritance update
+    2. Checks nodes of the given kinds on the given branch to verify their inheritance is correct
+    3. Displays counts of any kinds with incorrect inheritance on the given branch
+    4. If fix is True, runs migrations to update the inheritance of any nodes with incorrect inheritance
+        on the correct branch
+    """
+
+    updated_inheritance_query = await GetSchemaWithUpdatedInheritance.init(db=db)
+    await updated_inheritance_query.execute(db=db)
+    updated_inheritance_kinds_by_branch = updated_inheritance_query.get_updated_inheritance_kinds_by_branch()
+
+    if not updated_inheritance_kinds_by_branch:
+        rprint(f"{SUCCESS_BADGE} No schemas have had their inheritance updated")
+        return True
+
+    schema_manager = SchemaManager()
+    registry.schema = schema_manager
+    schema = SchemaRoot(**internal_schema)
+    schema_manager.register_schema(schema=schema)
+    branches_by_name = {b.name: b for b in await Branch.get_list(db=db)}
+
+    kind_label_counts_by_branch: dict[str, list[KindLabelCountCorrected]] = defaultdict(list)
+    for branch_name, kinds in updated_inheritance_kinds_by_branch.items():
+        rprint(f"Checking branch: {branch_name}", end="...")
+        branch = branches_by_name[branch_name]
+        schema_branch = await schema_manager.load_schema_from_db(db=db, branch=branch)
+        kind_label_query = await GetAllKindsAndLabels.init(db=db, branch=branch, kinds=kinds)
+        await kind_label_query.execute(db=db)
+        kind_label_counts = kind_label_query.get_kind_label_counts()
+
+        for kind_label_count in kind_label_counts:
+            node_schema = schema_branch.get_node(name=kind_label_count.kind, duplicate=False)
+            correct_labels = frozenset(node_schema.inherit_from)
+            if kind_label_count.labels == correct_labels:
+                continue
+
+            kind_label_counts_by_branch[branch_name].append(
+                KindLabelCountCorrected(
+                    kind=kind_label_count.kind,
+                    labels=kind_label_count.labels,
+                    num_nodes=kind_label_count.num_nodes,
+                    node_schema=node_schema,
+                )
+            )
+        rprint("done")
+
+    if not kind_label_counts_by_branch:
+        rprint(f"{SUCCESS_BADGE} All nodes have the correct inheritance")
+        return True
+
+    display_kind_label_counts(kind_label_counts_by_branch)
+
+    if not fix:
+        rprint(f"{FAILED_BADGE} Use the --fix flag to fix the inheritance of any invalid nodes")
+        return False
+
+    for branch_name, kind_label_counts_corrected in kind_label_counts_by_branch.items():
+        for kind_label_count in kind_label_counts_corrected:
+            rprint(f"Fixing kind {kind_label_count.kind} on branch {branch_name}", end="...")
+            node_schema = kind_label_count.node_schema
+            migration_query = await NodeDuplicateQuery.init(
+                db=db,
+                branch=branches_by_name[branch_name],
+                previous_node=SchemaNodeInfo(
+                    name=node_schema.name,
+                    namespace=node_schema.namespace,
+                    branch_support=node_schema.branch.value,
+                    labels=list(kind_label_count.labels) + [kind_label_count.kind, InfrahubKind.NODE],
+                    kind=kind_label_count.kind,
+                ),
+                new_node=SchemaNodeInfo(
+                    name=node_schema.name,
+                    namespace=node_schema.namespace,
+                    branch_support=node_schema.branch.value,
+                    labels=list(node_schema.inherit_from) + [kind_label_count.kind, InfrahubKind.NODE],
+                    kind=kind_label_count.kind,
+                ),
+            )
+            await migration_query.execute(db=db)
+            rprint("done")
+
+    rprint(f"{SUCCESS_BADGE} All nodes have the correct inheritance")
+
+    if registry.default_branch in kind_label_counts_by_branch:
+        kinds = [kind_label_count.kind for kind_label_count in kind_label_counts_by_branch[registry.default_branch]]
+        rprint(
+            "[bold cyan]Note that migrations were run on the default branch for the following schema kinds: "
+            f"{', '.join(kinds)}. You should rebase any branches that include/will include changes using "
+            "the migrated schemas[/bold cyan]"
+        )
+
+    return True

{infrahub_server-1.4.0b1 → infrahub_server-1.4.1}/backend/infrahub/cli/upgrade.py

@@ -14,6 +14,7 @@ from infrahub import config
 from infrahub.core.initialization import create_anonymous_role, create_default_account_groups, initialize_registry
 from infrahub.core.manager import NodeManager
 from infrahub.core.protocols import CoreAccount, CoreObjectPermission
+from infrahub.dependencies.registry import build_component_registry
 from infrahub.menu.menu import default_menu
 from infrahub.menu.models import MenuDict
 from infrahub.menu.repository import MenuRepository
@@ -54,6 +55,8 @@ async def upgrade_cmd(
 
     await initialize_registry(db=dbdriver)
 
+    build_component_registry()
+
     # NOTE add step to validate if the database and the task manager are reachable
 
     # -------------------------------------------

{infrahub_server-1.4.0b1 → infrahub_server-1.4.1}/backend/infrahub/config.py

@@ -328,6 +328,8 @@ class DevelopmentSettings(BaseSettings):
 
 
 class BrokerSettings(BaseSettings):
+    """Configuration settings for the message bus."""
+
     model_config = SettingsConfigDict(env_prefix="INFRAHUB_BROKER_")
     enable: bool = True
     tls_enabled: bool = Field(default=False, description="Indicates if TLS is enabled for the connection")
@@ -441,9 +443,7 @@ class GitSettings(BaseSettings):
 
 
 class HTTPSettings(BaseSettings):
-    """The HTTP settings control how Infrahub interacts with external HTTP servers
-
-    This can be things like webhooks and OAuth2 providers"""
+    """The HTTP settings control how Infrahub interacts with external HTTP servers. This can be things like webhooks and OAuth2 providers."""
 
     model_config = SettingsConfigDict(env_prefix="INFRAHUB_HTTP_")
     timeout: int = Field(default=10, description="Default connection timeout in seconds")
@@ -667,7 +667,7 @@ class SecuritySettings(BaseSettings):
     oidc_providers: list[OIDCProvider] = Field(default_factory=list, description="The selected OIDC providers")
     oidc_provider_settings: SecurityOIDCProviderSettings = Field(default_factory=SecurityOIDCProviderSettings)
     restrict_untrusted_jinja2_filters: bool = Field(
-        default=True, description="Indicates if untrusted Jinja2 filters should be disallowd for computed attributes"
+        default=True, description="Indicates if untrusted Jinja2 filters should be disallowed for computed attributes"
     )
     _oauth2_settings: dict[str, SecurityOAuth2Settings] = PrivateAttr(default_factory=dict)
     _oidc_settings: dict[str, SecurityOIDCSettings] = PrivateAttr(default_factory=dict)

{infrahub_server-1.4.0b1 → infrahub_server-1.4.1}/backend/infrahub/core/attribute.py

@@ -680,6 +680,12 @@ class String(BaseAttribute):
     type = str
     value: str
 
+    @classmethod
+    def validate_content(cls, value: Any, name: str, schema: AttributeSchema) -> None:
+        if value is not None and not is_large_attribute_type(schema.kind):
+            validate_string_length(value=str(value))
+        super().validate_content(value=value, name=name, schema=schema)
+
 
 class StringOptional(String):
     value: str | None

{infrahub_server-1.4.0b1 → infrahub_server-1.4.1}/backend/infrahub/core/constants/__init__.py

@@ -66,6 +66,7 @@ class EventType(InfrahubStringEnum):
     PROPOSED_CHANGE_APPROVED = f"{EVENT_NAMESPACE}.proposed_change.approved"
     PROPOSED_CHANGE_REJECTED = f"{EVENT_NAMESPACE}.proposed_change.rejected"
     PROPOSED_CHANGE_APPROVAL_REVOKED = f"{EVENT_NAMESPACE}.proposed_change.approval_revoked"
+    PROPOSED_CHANGE_APPROVALS_REVOKED = f"{EVENT_NAMESPACE}.proposed_change.approvals_revoked"
     PROPOSED_CHANGE_REJECTION_REVOKED = f"{EVENT_NAMESPACE}.proposed_change.rejection_revoked"
     PROPOSED_CHANGE_THREAD_CREATED = f"{EVENT_NAMESPACE}.proposed_change_thread.created"
     PROPOSED_CHANGE_THREAD_UPDATED = f"{EVENT_NAMESPACE}.proposed_change_thread.updated"

{infrahub_server-1.4.0b1 → infrahub_server-1.4.1}/backend/infrahub/core/diff/model/path.py

@@ -22,8 +22,6 @@ if TYPE_CHECKING:
     from neo4j.graph import Relationship as Neo4jRelationship
     from whenever import TimeDelta
 
-    from infrahub.graphql.initialization import GraphqlContext
-
 
 @dataclass
 class TimeRange:
@@ -314,12 +312,6 @@ class EnrichedDiffRelationship(BaseSummary):
         )
 
 
-@dataclass
-class ParentNodeInfo:
-    node: EnrichedDiffNode
-    relationship_name: str = "undefined"
-
-
 @dataclass
 class EnrichedDiffNode(BaseSummary):
     identifier: NodeIdentifier
@@ -364,37 +356,6 @@ class EnrichedDiffNode(BaseSummary):
             rel.clear_conflicts()
         self.conflict = None
 
-    def get_parent_info(self, graphql_context: GraphqlContext | None = None) -> ParentNodeInfo | None:
-        for r in self.relationships:
-            for n in r.nodes:
-                relationship_name: str = "undefined"
-
-                if not graphql_context:
-                    return ParentNodeInfo(node=n, relationship_name=relationship_name)
-
-                node_schema = graphql_context.db.schema.get(name=self.kind)
-                rel_schema = node_schema.get_relationship(name=r.name)
-
-                parent_schema = graphql_context.db.schema.get(name=n.kind)
-                rels_parent = parent_schema.get_relationships_by_identifier(id=rel_schema.get_identifier())
-
-                if rels_parent and len(rels_parent) == 1:
-                    relationship_name = rels_parent[0].name
-                elif rels_parent and len(rels_parent) > 1:
-                    for rel_parent in rels_parent:
-                        if (
-                            rel_schema.direction == RelationshipDirection.INBOUND
-                            and rel_parent.direction == RelationshipDirection.OUTBOUND
-                        ) or (
-                            rel_schema.direction == RelationshipDirection.OUTBOUND
-                            and rel_parent.direction == RelationshipDirection.INBOUND
-                        ):
-                            relationship_name = rel_parent.name
-                            break
-
-                return ParentNodeInfo(node=n, relationship_name=relationship_name)
-        return None
-
     def get_all_child_nodes(self) -> set[EnrichedDiffNode]:
         all_children = set()
         for r in self.relationships:

infrahub_server-1.4.1/backend/infrahub/core/graph/__init__.py

@@ -0,0 +1 @@
+GRAPH_VERSION = 37

{infrahub_server-1.4.0b1 → infrahub_server-1.4.1}/backend/infrahub/core/initialization.py

@@ -37,7 +37,7 @@ from infrahub.exceptions import DatabaseError
 from infrahub.graphql.manager import GraphQLSchemaManager
 from infrahub.log import get_logger
 from infrahub.menu.utils import create_default_menu
-from infrahub.permissions import PermissionBackend
+from infrahub.permissions import PermissionBackend, get_or_create_global_permission
 from infrahub.storage import InfrahubObjectStorage
 
 if TYPE_CHECKING:
@@ -371,20 +371,13 @@ async def create_default_role(db: InfrahubDatabase) -> CoreAccountRole:
     await proposed_change_permission.save(db=db)
 
     # Other permissions, created to keep references of them from the start
-    for permission_action, permission_description in (
-        (GlobalPermissions.EDIT_DEFAULT_BRANCH, "Allow a user to change data in the default branch"),
-        (GlobalPermissions.MANAGE_ACCOUNTS, "Allow a user to manage accounts, account roles and account groups"),
-        (GlobalPermissions.MANAGE_PERMISSIONS, "Allow a user to manage permissions"),
-        (GlobalPermissions.MERGE_BRANCH, "Allow a user to merge branches"),
+    for permission_action in (
+        GlobalPermissions.EDIT_DEFAULT_BRANCH,
+        GlobalPermissions.MANAGE_ACCOUNTS,
+        GlobalPermissions.MANAGE_PERMISSIONS,
+        GlobalPermissions.MERGE_BRANCH,
     ):
-        permission = await Node.init(db=db, schema=InfrahubKind.GLOBALPERMISSION)
-        await permission.new(
-            db=db,
-            action=permission_action.value,
-            decision=PermissionDecision.ALLOW_ALL.value,
-            description=permission_description,
-        )
-        await permission.save(db=db)
+        await get_or_create_global_permission(db=db, permission=permission_action)
 
     view_permission = await Node.init(db=db, schema=InfrahubKind.OBJECTPERMISSION)
     await view_permission.new(
@@ -428,18 +421,31 @@ async def create_default_role(db: InfrahubDatabase) -> CoreAccountRole:
 
 
 async def create_proposed_change_reviewer_role(db: InfrahubDatabase) -> CoreAccountRole:
-    reviewer_permission = await Node.init(db=db, schema=InfrahubKind.GLOBALPERMISSION)
-    await reviewer_permission.new(
+    edit_default_branch_permission = await get_or_create_global_permission(
+        db=db, permission=GlobalPermissions.EDIT_DEFAULT_BRANCH
+    )
+    reviewer_permission = await get_or_create_global_permission(
+        db=db, permission=GlobalPermissions.REVIEW_PROPOSED_CHANGE
+    )
+
+    proposed_change_update_permission = await Node.init(db=db, schema=InfrahubKind.OBJECTPERMISSION)
+    await proposed_change_update_permission.new(
         db=db,
-        action=GlobalPermissions.REVIEW_PROPOSED_CHANGE.value,
+        name="ProposedChange",
+        namespace="Core",
+        action=PermissionAction.UPDATE.value,
         decision=PermissionDecision.ALLOW_ALL.value,
-        description="Allow a user to approve or revoke proposed changes",
+        description="Allow a user to update proposed changes",
     )
-    await reviewer_permission.save(db=db)
+    await proposed_change_update_permission.save(db=db)
 
     role_name = "Proposed Change Reviewer"
     role = await Node.init(db=db, schema=CoreAccountRole)
-    await role.new(db=db, name=role_name, permissions=[reviewer_permission])
+    await role.new(
+        db=db,
+        name=role_name,
+        permissions=[edit_default_branch_permission, reviewer_permission, proposed_change_update_permission],
+    )
     await role.save(db=db)
     log.info(f"Created account role: {role_name}")
 
@@ -497,7 +503,6 @@ async def create_default_account_groups(
 
     default_role = await create_default_role(db=db)
     proposed_change_reviewer_role = await create_proposed_change_reviewer_role(db=db)
-
     await create_accounts_group(
         db=db, name="Infrahub Users", roles=[default_role, proposed_change_reviewer_role], accounts=accounts or []
     )

{infrahub_server-1.4.0b1 → infrahub_server-1.4.1}/backend/infrahub/core/manager.py

@@ -400,7 +400,7 @@ class NodeManager:
 
         results = []
         for peer in peers_info:
-            result = await Relationship(schema=schema, branch=branch, at=at, node_id=peer.source_id).load(
+            result = Relationship(schema=schema, branch=branch, at=at, node_id=peer.source_id).load(
                 db=db,
                 id=peer.rel_node_id,
                 db_id=peer.rel_node_db_id,
@@ -408,7 +408,7 @@ class NodeManager:
                 data=peer,
             )
             if fetch_peers:
-                await result.set_peer(value=peer_nodes[peer.peer_id])
+                result.set_peer(value=peer_nodes[peer.peer_id])
             results.append(result)
 
         return results

{infrahub_server-1.4.0b1 → infrahub_server-1.4.1}/backend/infrahub/core/migrations/__init__.py

@@ -1,3 +1,4 @@
+from .schema.attribute_kind_update import AttributeKindUpdateMigration
 from .schema.attribute_name_update import AttributeNameUpdateMigration
 from .schema.node_attribute_add import NodeAttributeAddMigration
 from .schema.node_attribute_remove import NodeAttributeRemoveMigration
@@ -17,6 +18,7 @@ MIGRATION_MAP: dict[str, type[SchemaMigration] | None] = {
     "node.relationship.remove": PlaceholderDummyMigration,
     "attribute.name.update": AttributeNameUpdateMigration,
     "attribute.branch.update": None,
+    "attribute.kind.update": AttributeKindUpdateMigration,
     "relationship.branch.update": None,
     "relationship.direction.update": None,
     "relationship.identifier.update": PlaceholderDummyMigration,

{infrahub_server-1.4.0b1 → infrahub_server-1.4.1}/backend/infrahub/core/migrations/graph/__init__.py

@@ -36,8 +36,9 @@ from .m031_check_number_attributes import Migration031
 from .m032_cleanup_orphaned_branch_relationships import Migration032
 from .m033_deduplicate_relationship_vertices import Migration033
 from .m034_find_orphaned_schema_fields import Migration034
-from .m035_drop_attr_value_index import Migration035
-from .m036_index_attr_vals import Migration036
+from .m035_orphan_relationships import Migration035
+from .m036_drop_attr_value_index import Migration036
+from .m037_index_attr_vals import Migration037
 
 if TYPE_CHECKING:
     from infrahub.core.root import Root
@@ -81,6 +82,7 @@ MIGRATIONS: list[type[GraphMigration | InternalSchemaMigration | ArbitraryMigrat
     Migration034,
     Migration035,
     Migration036,
+    Migration037,
 ]
 
 

{infrahub_server-1.4.0b1 → infrahub_server-1.4.1}/backend/infrahub/core/migrations/graph/m033_deduplicate_relationship_vertices.py

@@ -89,7 +89,7 @@ class Migration033(GraphMigration):
     """
 
     name: str = "033_deduplicate_relationship_vertices"
-    minimum_version: int = 31
+    minimum_version: int = 32
     queries: Sequence[type[Query]] = [DeduplicateRelationshipVerticesQuery]
 
     async def validate_migration(self, db: InfrahubDatabase) -> MigrationResult:  # noqa: ARG002