Skip to content

migrate permissions to Cedar during application bootstrap #1653

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Artuomka merged 1 commit into from
Mar 9, 2026
Merged

migrate permissions to Cedar during application bootstrap #1653

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion backend/src/entities/cedar-authorization/scripts/migrate-permissions-to-cedar.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ export async function migratePermissionsToCedar(dataSource: DataSource): Promise
.leftJoinAndSelect('group.connection', 'connection')
.leftJoinAndSelect('group.permissions', 'permission')
.where('connection.id = :connectionId', { connectionId: connection.id })
.andWhere('(group.cedarPolicy IS NULL OR group.cedarPolicy = :empty)', { empty: '' })
.getMany();
Comment on lines 20 to 24
Copy link

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Now that this script runs during normal bootstrap, the migration approach can become a startup bottleneck: it loads groups per connection and then persists each group one-by-one. Consider reducing round-trips (e.g., query all groups needing migration in one pass, batch updates, and prefer update on cedarPolicy rather than save on fully loaded entities) to keep startup time predictable for large datasets.

Copilot uses AI. Check for mistakes.

for (const group of groups) {
Expand Down Expand Up @@ -61,5 +62,5 @@ export async function migratePermissionsToCedar(dataSource: DataSource): Promise
}
}

console.log(`Migrated Cedar policies for ${migratedCount} groups`);
console.log(`Migrated Cedar policies for ${migratedCount} groups (skipped groups with existing policies)`);
Copy link

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This migration now runs as part of API startup, so logging via console.log will bypass the configured Winston/Nest logger (and any structured logging / log routing). Prefer using the existing application logger (e.g., Nest Logger or WinstonLogger) so the message is consistent with the rest of the service logs.

Copilot uses AI. Check for mistakes.
}
5 changes: 5 additions & 0 deletions backend/src/main.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,9 @@ import bodyParser from 'body-parser';
import { ValidationError } from 'class-validator';
import cookieParser from 'cookie-parser';
import helmet from 'helmet';
import { DataSource } from 'typeorm';
import { ApplicationModule } from './app.module.js';
import { migratePermissionsToCedar } from './entities/cedar-authorization/scripts/migrate-permissions-to-cedar.js';
import { WinstonLogger } from './entities/logging/winston-logger.js';
import { AllExceptionsFilter } from './exceptions/all-exceptions.filter.js';
import { ValidationException } from './exceptions/custom-exceptions/validation-exception.js';
Expand Down Expand Up @@ -82,6 +84,9 @@ async function bootstrap() {
}),
);

const dataSource = app.get(DataSource);
await migratePermissionsToCedar(dataSource);
Copy link

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Running a full permissions→Cedar migration as part of every application bootstrap can significantly delay startup and can prevent the API from coming up if the DB is temporarily unavailable or the migration errors. Consider gating this behind an explicit env flag (and/or CEDAR_AUTHORIZATION_ENABLED), and/or taking a DB advisory lock / single-run mechanism so multiple instances don’t race and repeat the work on deploy; alternatively run it as a separate one-off job and only log/report failures without crashing the server (depending on desired fail-fast behavior).

Suggested change
await migratePermissionsToCedar(dataSource);
if (process.env.CEDAR_MIGRATION_ON_BOOT !== 'false') {
await migratePermissionsToCedar(dataSource);
}

Copilot uses AI. Check for mistakes.

await app.listen(3000);
} catch (e) {
console.error(`Failed to initialize, due to ${e}`);
Expand Down
Loading