mirror of
https://github.com/bitwarden/server.git
synced 2025-07-01 16:12:49 -05:00
[AC-1682] Update FC data migration scripts to clear AccessAll flags and set all Managers to Users
This commit is contained in:
@ -1,10 +1,10 @@
|
||||
-- Create a temporary table to store the groups with AccessAll = 1
|
||||
-- Step 1: Create a temporary table to store the Groups with AccessAll = 1
|
||||
SELECT [Id] AS [GroupId], [OrganizationId]
|
||||
INTO #TempGroup
|
||||
FROM [dbo].[Group]
|
||||
WHERE [AccessAll] = 1;
|
||||
|
||||
-- Update existing rows in [dbo].[CollectionGroup]
|
||||
-- Step 2: Update existing rows in [dbo].[CollectionGroup]
|
||||
UPDATE CG
|
||||
SET
|
||||
CG.[ReadOnly] = 0,
|
||||
@ -15,7 +15,7 @@ INNER JOIN [dbo].[Collection] C ON CG.[CollectionId] = C.[Id]
|
||||
INNER JOIN #TempGroup TG ON CG.[GroupId] = TG.[GroupId]
|
||||
WHERE C.[OrganizationId] = TG.[OrganizationId];
|
||||
|
||||
-- Insert new rows into [dbo].[CollectionGroup]
|
||||
-- Step 3: Insert new rows into [dbo].[CollectionGroup]
|
||||
INSERT INTO [dbo].[CollectionGroup] ([CollectionId], [GroupId], [ReadOnly], [HidePasswords], [Manage])
|
||||
SELECT C.[Id], TG.[GroupId], 0, 0, 0
|
||||
FROM [dbo].[Collection] C
|
||||
@ -23,5 +23,11 @@ FROM [dbo].[Collection] C
|
||||
LEFT JOIN [dbo].[CollectionGroup] CG ON CG.[CollectionId] = C.[Id] AND CG.[GroupId] = TG.[GroupId]
|
||||
WHERE CG.[CollectionId] IS NULL;
|
||||
|
||||
-- Drop the temporary table
|
||||
-- Step 4: Update [dbo].[Group] to clear AccessAll flag
|
||||
UPDATE G
|
||||
SET [AccessAll] = 0
|
||||
FROM [dbo].[Group] G
|
||||
INNER JOIN #TempGroup TG ON G.[Id] = TG.[GroupId]
|
||||
|
||||
-- Step 5: Drop the temporary table
|
||||
DROP TABLE #TempGroup;
|
||||
|
@ -1,17 +1,10 @@
|
||||
-- Step 1: Insert into a temporary table with an additional column for batch processing, update 50 k at a time
|
||||
SELECT [Id] AS [OrganizationUserId], [OrganizationId], CAST(ROW_NUMBER() OVER(ORDER BY [Id]) / 50000 AS INT) AS Batch
|
||||
-- Step 1: Create a temporary table to store the OrganizationUsers with AccessAll = 1
|
||||
SELECT [Id] AS [OrganizationUserId], [OrganizationId]
|
||||
INTO #TempOrgUser
|
||||
FROM [dbo].[OrganizationUser]
|
||||
WHERE [AccessAll] = 1;
|
||||
|
||||
-- Step 2: Get the maximum batch number
|
||||
DECLARE @MaxBatch INT = (SELECT MAX(Batch) FROM #TempOrgUser);
|
||||
DECLARE @CurrentBatch INT = 0;
|
||||
|
||||
-- Step 3: Process each batch
|
||||
WHILE @CurrentBatch <= @MaxBatch
|
||||
BEGIN
|
||||
-- Update existing rows in [dbo].[CollectionUser]
|
||||
-- Step 2: Update existing rows in [dbo].[CollectionUser]
|
||||
UPDATE target
|
||||
SET
|
||||
target.[ReadOnly] = 0,
|
||||
@ -21,25 +14,27 @@ BEGIN
|
||||
INNER JOIN (
|
||||
SELECT C.[Id] AS [CollectionId], T.[OrganizationUserId]
|
||||
FROM [dbo].[Collection] C
|
||||
INNER JOIN #TempOrgUser T ON C.[OrganizationId] = T.[OrganizationId] AND T.Batch = @CurrentBatch
|
||||
INNER JOIN #TempOrgUser T ON C.[OrganizationId] = T.[OrganizationId]
|
||||
) AS source
|
||||
ON target.[CollectionId] = source.[CollectionId] AND target.[OrganizationUserId] = source.[OrganizationUserId];
|
||||
|
||||
-- Insert new rows into [dbo].[CollectionUser]
|
||||
-- Step 3: Insert new rows into [dbo].[CollectionUser]
|
||||
INSERT INTO [dbo].[CollectionUser] ([CollectionId], [OrganizationUserId], [ReadOnly], [HidePasswords], [Manage])
|
||||
SELECT source.[CollectionId], source.[OrganizationUserId], 0, 0, 0
|
||||
FROM (
|
||||
SELECT C.[Id] AS [CollectionId], T.[OrganizationUserId]
|
||||
FROM [dbo].[Collection] C
|
||||
INNER JOIN #TempOrgUser T ON C.[OrganizationId] = T.[OrganizationId] AND T.Batch = @CurrentBatch
|
||||
INNER JOIN #TempOrgUser T ON C.[OrganizationId] = T.[OrganizationId]
|
||||
) AS source
|
||||
LEFT JOIN [dbo].[CollectionUser] AS target
|
||||
ON target.[CollectionId] = source.[CollectionId] AND target.[OrganizationUserId] = source.[OrganizationUserId]
|
||||
WHERE target.[CollectionId] IS NULL;
|
||||
|
||||
-- Move to the next batch
|
||||
SET @CurrentBatch = @CurrentBatch + 1;
|
||||
END;
|
||||
-- Step 4: Update [dbo].[OrganizationUser] to clear AccessAll flag
|
||||
UPDATE OU
|
||||
SET [AccessAll] = 0
|
||||
FROM [dbo].[OrganizationUser] OU
|
||||
INNER JOIN #TempOrgUser T ON OU.[Id] = T.[OrganizationUserId]
|
||||
|
||||
-- Step 4: Drop the temporary table
|
||||
-- Step 5: Drop the temporary table
|
||||
DROP TABLE #TempOrgUser;
|
||||
|
@ -1,4 +1,4 @@
|
||||
-- Update [dbo].[CollectionUser] with [Manage] = 1 for all users with Manager role or 'EditAssignedCollections' permission
|
||||
-- Step 1: Update [dbo].[CollectionUser] with [Manage] = 1 for all users with Manager role or 'EditAssignedCollections' permission
|
||||
UPDATE cu
|
||||
SET cu.[ReadOnly] = 0,
|
||||
cu.[HidePasswords] = 0,
|
||||
@ -9,7 +9,7 @@ INNER JOIN [dbo].[OrganizationUser] ou
|
||||
WHERE (ou.[Type] = 3 OR (ou.[Permissions] IS NOT NULL AND
|
||||
ISJSON(ou.[Permissions]) > 0 AND JSON_VALUE(ou.[Permissions], '$.editAssignedCollections') = 'true'))
|
||||
|
||||
-- Insert rows to [dbo].[CollectionUser] for Managers and users with 'EditAssignedCollections' permission assigned to groups with collection access
|
||||
-- Step 2: Insert rows to [dbo].[CollectionUser] for Managers and users with 'EditAssignedCollections' permission assigned to groups with collection access
|
||||
INSERT INTO [dbo].[CollectionUser] ([CollectionId], [OrganizationUserId], [ReadOnly], [HidePasswords], [Manage])
|
||||
SELECT cg.[CollectionId], ou.[Id], 0, 0, 1
|
||||
FROM [dbo].[CollectionGroup] cg
|
||||
@ -23,3 +23,11 @@ WHERE (ou.[Type] = 3 OR
|
||||
SELECT 1 FROM [dbo].[CollectionUser] cu
|
||||
WHERE cu.[CollectionId] = cg.[CollectionId] AND cu.[OrganizationUserId] = ou.[Id]
|
||||
)
|
||||
|
||||
-- Step 3: Set all Managers to Users
|
||||
UPDATE [dbo].[OrganizationUser]
|
||||
SET [Type] = 2 -- User
|
||||
WHERE [OrganizationId] = @OrganizationId
|
||||
AND [Type] = 3; -- Manager
|
||||
|
||||
-- TODO: clear custom permissions JSON? Probably should, but not actually used by any code once we enable FC
|
||||
|
Reference in New Issue
Block a user