Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Metadata Form Versioning #1621

Open
SofiaSazonova opened this issue Oct 8, 2024 · 5 comments
Open

Metadata Form Versioning #1621

SofiaSazonova opened this issue Oct 8, 2024 · 5 comments
Assignees

Comments

@SofiaSazonova
Copy link
Contributor

The target features are: Make MFs editable.
But what to do with already attached forms?
Solution: enable versioning of Metadata Forms.

MF DB

  1. Attached MF should be connected with version, not the MF directly
  2. If there are attached entities and user edits the parent MF, new version is created
  3. Entity owners are notified about new version of MF
  4. When no attached MF left for the older version, it's automatically deleted.
@SofiaSazonova
Copy link
Contributor Author

SofiaSazonova commented Oct 8, 2024

How to edit MF:
edit MF

@SofiaSazonova
Copy link
Contributor Author

SofiaSazonova commented Oct 8, 2024

Attach MF: Only latest version is available

Edit attached entity:

  1. New version if opened for editing, the fields are pre-filled basing on field name, so user can adjust
  2. Old attached MF is deleted
  3. New created

Delete attached MF: When no attached MF left for the older version, it's automatically deleted.

Delete parent MF: all versions and attached MFs are deleted in cascade. A pop up with confirmation needed in the UI

@noah-paige
Copy link
Contributor

Some Comments/Qs:

  • (1) What action publishes a new metadata form/ what properties of the form are editable?
    • If a metadata form is edited for a new description will this publish a new version? Is description editable? Is it only for edits to the form fields?
  • (2) Confirming my understanding - When a new form version is created this will
    • New record in metadata_from_version
    • New record(s) in metadata_from_field (there will be no overlap / re-use of form field records between different form versions right?)
  • (3) I see both metadata_form_field and attached_metadata_form tables have both metadataFormUri and metadataFormVersionUri in their data model... is this just for easy look up? The one of significance would the the metadataFormVersionUri one right?
  • (4) Will enforcement rules be with respect to each version of the metadata form? I think the above makes sense for a change in form fields after the form is in use - but have we thought about a change in enforcement rules after a form is in use?
  • (5) Could version be a version Number that is a composite key along with metadataFormUri for readability - and then we can expose version # on the attached form for transparency / better UX
  • (6) On the point of 'When no attached MF left for the older version, it's automatically deleted.' - I think it may be easiest to have users manually delete version of forms and have an upper limit of 10 or so versions (this is similar to how IAM Policy Versions work) rather than some scheduled backend running task to garbage collect
  • (7) On editing of attached form what do you mean on 'New version if opened for editing, the fields are pre-filled basing on field name, so user can adjust'?

@SofiaSazonova
Copy link
Contributor Author

(1) Right now the versioning is only about the fields. Visibility is not editable, description is editable without additional problems
(2) No overlaps, fields are duplicated, even if there were no changes in them particulary
(3) Yes, only for look up, I'm still not sure, if I would need both.
(4) Idea was: enforcement is defined for each version, not MF in general
(5) Yes, also thought about it after I finished the writing)) Much better than version URI
(6) No scheduled task needed. Just when the attached MF deleted, we check if there any left
(7) E.g. there were "Field 1" and "Field 2", after editing it became 'Field 1' and 'Test'. When user wants to update the form, in UI the value of v1.Field1 goes to v2. Field2, but v2.Test becomes empty, so user have to fill it

@github-project-automation github-project-automation bot moved this to Nominated in v2.7.0 Oct 10, 2024
SofiaSazonova added a commit that referenced this issue Oct 14, 2024
### Feature or Bugfix
<!-- please choose -->
- Feature


### Detail
- new db model
- migration:
  -- create default version one
  -- backfill existing MF fields and attached MFs
- when MF is created, service automatically create version 1
- fields and attached metadata forms automatically use the latest
version (for now version === 1)

### Relates
- #1621

### Security
Please answer the questions below briefly where applicable, or write
`N/A`. Based on
[OWASP 10](https://owasp.org/Top10/en/).

- Does this PR introduce or modify any input fields or queries - this
includes
fetching data from storage outside the application (e.g. a database, an
S3 bucket)?
  - Is the input sanitized?
- What precautions are you taking before deserializing the data you
consume?
  - Is injection prevented by parametrizing queries?
  - Have you ensured no `eval` or similar functions are used?
- Does this PR introduce any functionality or component that requires
authorization?
- How have you ensured it respects the existing AuthN/AuthZ mechanisms?
  - Are you logging failed auth attempts?
- Are you using or adding any cryptographic features?
  - Do you use a standard proven implementations?
  - Are the used keys controlled by the customer? Where are they stored?
- Are you introducing any new policies/roles/users?
  - Have you used the least-privilege principle? How?


By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache 2.0 license.

---------

Co-authored-by: Sofia Sazonova <[email protected]>
SofiaSazonova added a commit that referenced this issue Oct 16, 2024
### Feature or Bugfix
<!-- please choose -->
- Feature


### Detail
- Metadata Form View -> Fileds. User can create/view/edit/delete
versions
- No restrictions on editing yet
- If version deleted, all attached entities deleted
- User can't delete the only version (backend and frontend restrictions)
- When user attach a form to an entity, we use only the last version
- Metadata Form View -> Preview. Can view different versions

### Relates
- #1621

### Security
Please answer the questions below briefly where applicable, or write
`N/A`. Based on
[OWASP 10](https://owasp.org/Top10/en/).

- Does this PR introduce or modify any input fields or queries - this
includes
fetching data from storage outside the application (e.g. a database, an
S3 bucket)?
  - Is the input sanitized?
- What precautions are you taking before deserializing the data you
consume?
  - Is injection prevented by parametrizing queries?
  - Have you ensured no `eval` or similar functions are used?
- Does this PR introduce any functionality or component that requires
authorization?
- How have you ensured it respects the existing AuthN/AuthZ mechanisms?
  - Are you logging failed auth attempts?
- Are you using or adding any cryptographic features?
  - Do you use a standard proven implementations?
  - Are the used keys controlled by the customer? Where are they stored?
- Are you introducing any new policies/roles/users?
  - Have you used the least-privilege principle? How?


By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache 2.0 license.

---------

Co-authored-by: Sofia Sazonova <[email protected]>
@SofiaSazonova
Copy link
Contributor Author

SofiaSazonova commented Oct 17, 2024

After PR-3 what is still ToDo:

  • Default version != latest version. Flag or smth? Do we need it?
  • Flag to mark, if we need to delete older versions, when no more attached entities left
  • Show all attached entities to MF
  • Show on 'Metadata Tab' if new version is available

noah-paige pushed a commit that referenced this issue Oct 28, 2024
### Feature or Bugfix
<!-- please choose -->
- Feature


### Detail

View:
- [ ] Display version on "attached form" card
- [ ] Display version in attached form list
- [ ] Show number of entities attached (MF -> Fields)
- [ ] Delete confirmation PopUp
- [ ] Enforcement tab temporary hidden

Edit:

- [ ] No editing if there are attached entities
- [ ] Editing of attached MF
- [ ] If new version is available, editing of MF automatically shows new
version

Other:
- [ ] Notifications for entity owners, if new version of MF is released

Left ToDo:
#1621 (comment)

### Relates
- #1621 

### Security
Please answer the questions below briefly where applicable, or write
`N/A`. Based on
[OWASP 10](https://owasp.org/Top10/en/).

- Does this PR introduce or modify any input fields or queries - this
includes
fetching data from storage outside the application (e.g. a database, an
S3 bucket)?
  - Is the input sanitized?
- What precautions are you taking before deserializing the data you
consume?
  - Is injection prevented by parametrizing queries?
  - Have you ensured no `eval` or similar functions are used?
- Does this PR introduce any functionality or component that requires
authorization?
- How have you ensured it respects the existing AuthN/AuthZ mechanisms?
  - Are you logging failed auth attempts?
- Are you using or adding any cryptographic features?
  - Do you use a standard proven implementations?
  - Are the used keys controlled by the customer? Where are they stored?
- Are you introducing any new policies/roles/users?
  - Have you used the least-privilege principle? How?


By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache 2.0 license.

---------

Co-authored-by: Sofia Sazonova <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: In progress
Development

No branches or pull requests

2 participants