Skip to content

Commit

Permalink
docs: update to SQL Editor user
Browse files Browse the repository at this point in the history
  • Loading branch information
tianzhou committed Dec 24, 2024
1 parent 59c86f0 commit 1165683
Show file tree
Hide file tree
Showing 10 changed files with 20 additions and 20 deletions.
14 changes: 7 additions & 7 deletions content/docs/concepts/roles-and-permissions.md
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ Users can also be granted `Workspace Admin`, `Workspace DBA`. These 2 roles shou

**Project Roles**

- Built-in roles: `Project Owner`, `Project Developer`, `Project Releaser`, `Project Querier`, `Project Exporter`, `Project Viewer`.
- Built-in roles: `Project Owner`, `Project Developer`, `Project Releaser`, `SQL Editor User` (previously called `Project Querier`), `Project Exporter`, `Project Viewer`.
- [Custom roles](/docs/administration/custom-roles/).

In addition to the inherent `Workspace Member` role, most users will be granted project roles. These roles
Expand Down Expand Up @@ -89,7 +89,7 @@ By default, the first registered user is granted the `Admin` role, all following
Any user can create project. By default, the project creator is granted the `Project Owner` role.
`Workspace DBA` and `Workspace Admin` assume the `Project Owner` role for all projects.

| Project Permission | Project Querier | Project Exporter | Project Developer | Project Owner | Workspace DBA | Workspace Admin |
| Project Permission | SQL Editor User | Project Exporter | Project Developer | Project Owner | Workspace DBA | Workspace Admin |
| ---------------------------- | --------------- | ---------------- | ----------------- | ------------- | ------------- | --------------- |
| Sync sheet from VCS | | | ✔️ | ✔️ | ✔️ | ✔️ |
| Change project role | | | | ✔️ | ✔️ | ✔️ |
Expand All @@ -101,7 +101,7 @@ Any user can create project. By default, the project creator is granted the `Pro

Bytebase does not define database specific roles. Whether a user can perform certain action to the database is based on the user's Workspace role and the role of the project owning the database.

| Database Permission | Project Querier | Project Exporter | Project Developer | Project Owner | Workspace DBA | Workspace Admin |
| Database Permission | SQL Editor User | Project Exporter | Project Developer | Project Owner | Workspace DBA | Workspace Admin |
| ------------------- | --------------- | ---------------- | ----------------- | ------------- | ------------- | --------------- |
| Query | ✔️ | | | ✔️ | ✔️ | ✔️ |
| Export | | ✔️ | | ✔️ | ✔️ | ✔️ |
Expand All @@ -120,7 +120,7 @@ User can save sheets from [SQL Editor](/docs/sql-editor/overview). A sheet alway

### Private Sheet

| Permission | Creator | Project Querier | Project Exporter | Project Developer | Project Owner | Workspace DBA | Workspace Admin |
| Permission | Creator | SQL Editor User | Project Exporter | Project Developer | Project Owner | Workspace DBA | Workspace Admin |
| ---------- | ------- | --------------- | ---------------- | ----------------- | ------------- | ------------- | --------------- |
| Star | ✔️ | | | | | | |
| Read | ✔️ | | | | | | |
Expand All @@ -129,7 +129,7 @@ User can save sheets from [SQL Editor](/docs/sql-editor/overview). A sheet alway

### Project Sheet

| Permission | Creator | Project Querier | Project Exporter | Project Developer | Project Owner | Workspace DBA | Workspace Admin |
| Permission | Creator | SQL Editor User | Project Exporter | Project Developer | Project Owner | Workspace DBA | Workspace Admin |
| ---------- | ------- | --------------- | ---------------- | ----------------- | ------------- | ------------- | --------------- |
| Star | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
| Read | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
Expand All @@ -138,7 +138,7 @@ User can save sheets from [SQL Editor](/docs/sql-editor/overview). A sheet alway

### Public Sheet

| Permission | Creator | Project Querier | Project Exporter | Project Developer | Project Owner | Others |
| Permission | Creator | SQL Editor User | Project Exporter | Project Developer | Project Owner | Others |
| ---------- | ------- | --------------- | ---------------- | ----------------- | ------------- | ------ |
| Star | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
| Read | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
Expand All @@ -147,7 +147,7 @@ User can save sheets from [SQL Editor](/docs/sql-editor/overview). A sheet alway

## Issue permissions

| Issue Permission | Assignee | Creator | Project Querier | Project Exporter | Project Developer | Project Owner | Workspace DBA | Workspace Admin |
| Issue Permission | Assignee | Creator | SQL Editor User | Project Exporter | Project Developer | Project Owner | Workspace DBA | Workspace Admin |
| ------------------------- | -------- | ------- | --------------- | ---------------- | ----------------- | ------------- | ------------- | --------------- |
| Create issue | N/A | N/A | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
| Re-assign issue | ✔️ | ✔️ | | | | | ✔️ | ✔️ |
Expand Down
2 changes: 1 addition & 1 deletion content/docs/security/database-permission/overview.md
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ Database permission controls individual users' or groups' actions within the dat
| Workspace DBA |||||||
| Project Owner |||||| |
| Project Developer | | | | \* | \* | |
| Project Querier ||| ||| |
| SQL Editor User ||| ||| |
| Project Exporter | | || | | |
| Project Releaser | | | | | | |
| Project Viewer | | | | | | |
Expand Down
14 changes: 7 additions & 7 deletions content/docs/security/database-permission/query.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,37 +4,37 @@ title: Data Query

Bytebase users query data from [SQL Editor](/docs/sql-editor/run-queries/). Bytebase can enforce query access control for a particular user at the database, schema or table level.

## Assign Project Querier Role
## Assign SQL Editor User Role

`Workspace Admin`, `Workspace DBA` or `Project Owner` can manually grant `Project Querier` role to users/groups.
`Workspace Admin`, `Workspace DBA` or `Project Owner` can manually grant `SQL Editor User` role to users/groups.

### Assign at Project level

**Select Project** and go to **Manage > Members**. Then **Grant Access**.

![project-members-grant](/content/docs/security/database-permission/query/project-members-grant.webp)

Select Users or Groups, assign `Project Querier` role, choose the database object, Expiration and click **Confirm**.
Select Users or Groups, assign `SQL Editor User` role, choose the database object, Expiration and click **Confirm**.

You can choose the entire database, a particular schema, or a particular table.

![project-members-querier](/content/docs/security/database-permission/query/project-members-querier.webp)

### Assign at Workspace level

`Workspace Admin` can assign `Project Querier` role at the workspace level. This will grant query permission to _all databases_ within _all projects_.
`Workspace Admin` can assign `SQL Editor User` role at the workspace level. This will grant query permission to _all databases_ within _all projects_.

From the workspace page, go to **IAM & Admin > Members**, **Grant Access** to Select users/groups and assign `Project Querier` to them.
From the workspace page, go to **IAM & Admin > Members**, **Grant Access** to Select users/groups and assign `SQL Editor User` to them.

![assign-workspace](/content/docs/security/database-permission/query/assign-workspace.webp)

## Request Project Querier Role
## Request SQL Editor User Role

<PricingPlanBlock feature_name='QUERY_EXPORT_APPROVAL_WORKFLOW' />

<TutorialBlock url="/docs/tutorials/just-in-time-part1/" title="Just-in-Time Database Access" />

Users can also apply for `Project Querier` role by submitting an issue. Approval flow matches the `Request Querier Role` in [custom approval](/docs/administration/custom-approval/) if configured.
Users can also apply for `SQL Editor User` role by submitting an issue. Approval flow matches the `Request Querier Role` in [custom approval](/docs/administration/custom-approval/) if configured.

### Request at Project level

Expand Down
6 changes: 3 additions & 3 deletions content/docs/tutorials/api-user-database-permission.md
Original file line number Diff line number Diff line change
Expand Up @@ -118,18 +118,18 @@ Let's dig into the code:

```json
{
"role": "roles/projectQuerier",
"role": "roles/sqlEditorUser",
"members": ["user:[email protected]", "user:[email protected]"],
"condition": {
"expression": "(resource.database in [\"instances/test-sample-instance/databases/hr_test\"])",
"title": "project querier hr_prod",
"title": "SQL Editor User hr_prod",
"description": "",
"location": ""
}
}
```

This grants the `projectQuerier` role only for the `hr_test` database in `test-sample-instance`.
This grants the `SQL Editor User` role only for the `hr_test` database in `test-sample-instance`.

1. When processing IAM policies, handle [CEL (Common Expression Language)](https://cel.dev/) format conditions carefully. In this demo, we parse these conditions using a custom `parseCelExpression` function:

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@ Log in as `Developer`, and you can see `Sample Project`. Enter **SQL Editor** on

### Admin grants data query access directly

1. Log in as `Admin`, and go to `Sample Project`. Click **Members** and then **Grant Access**. Choose `Developer` and assign the role `Project Querier`, `All` for **Databases**. Click **Confirm**.
1. Log in as `Admin`, and go to `Sample Project`. Click **Members** and then **Grant Access**. Choose `Developer` and assign the role `SQL Editor User`, `All` for **Databases**. Click **Confirm**.

1. Log in as `Developer`, and go to SQL Editor. You can see all databases under `Test` and `Prod` environment. Select `hr_prod`, input `SELECT * FROM employee;` and run, you can see the result. Change `employee` to any other tables and run, you can see data as well.

Expand Down
2 changes: 1 addition & 1 deletion content/docs/tutorials/how-to-manage-roles.md
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ A typical requirement is to create a `Manager` role in Bytebase who can only rol

- **Project Owner**: All permissions within the project
- **Project Developer**: All viewer permissions, plus permissions for requesting database changes.
- **Project Querier**: Permissions for querying database data.
- **SQL Editor User**: Permissions for querying database data.
- **Project Exporter**: Permissions for exporting database data.
- **Project Releaser**: All viewer permissions, plus permission for reviewing database change requests for release purposes.
- **Project Viewer**: Read-only permissions for viewing basic project information, accessing databases, and initiating privilege requests.
Expand Down
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.

0 comments on commit 1165683

Please sign in to comment.