[usage] add optional UserID to filter usage (#18449)

Author: svenefftinge

components/gitpod-db/go/usage.go

@@ -93,7 +93,7 @@ type WorkspaceInstanceUsageData struct {
 }
 
 type CreditNoteMetaData struct {
-	UserId string `json:userId`
+	UserID string `json:"userId"`
 }
 
 type FindUsageResult struct {
@@ -141,6 +141,7 @@ func FindAllDraftUsage(ctx context.Context, conn *gorm.DB) ([]Usage, error) {
 
 type FindUsageParams struct {
 	AttributionId AttributionID
+	UserID        uuid.UUID
 	From, To      time.Time
 	ExcludeDrafts bool
 	Order         Order
@@ -152,8 +153,11 @@ func FindUsage(ctx context.Context, conn *gorm.DB, params *FindUsageParams) ([]U
 	var usageRecordsBatch []Usage
 
 	db := conn.WithContext(ctx).
-		Where("attributionId = ?", params.AttributionId).
-		Where("effectiveTime >= ? AND effectiveTime < ?", TimeToISO8601(params.From), TimeToISO8601(params.To)).
+		Where("attributionId = ?", params.AttributionId)
+	if params.UserID != uuid.Nil {
+		db = db.Where("metadata->>'$.userId' = ?", params.UserID.String())
+	}
+	db = db.Where("effectiveTime >= ? AND effectiveTime < ?", TimeToISO8601(params.From), TimeToISO8601(params.To)).
 		Where("kind = ?", WorkspaceInstanceUsageKind)
 	if params.ExcludeDrafts {
 		db = db.Where("draft = ?", false)
@@ -179,6 +183,7 @@ func FindUsage(ctx context.Context, conn *gorm.DB, params *FindUsageParams) ([]U
 
 type GetUsageSummaryParams struct {
 	AttributionId AttributionID
+	UserID        uuid.UUID
 	From, To      time.Time
 	ExcludeDrafts bool
 }
@@ -192,8 +197,11 @@ func GetUsageSummary(ctx context.Context, conn *gorm.DB, params GetUsageSummaryP
 	db := conn.WithContext(ctx)
 	query1 := db.Table((&Usage{}).TableName()).
 		Select("sum(creditCents) as CreditCentsUsed, count(*) as NumberOfRecords").
-		Where("attributionId = ?", params.AttributionId).
-		Where("effectiveTime >= ? AND effectiveTime < ?", TimeToISO8601(params.From), TimeToISO8601(params.To)).
+		Where("attributionId = ?", params.AttributionId)
+	if params.UserID != uuid.Nil {
+		query1 = query1.Where("metadata->>'$.userId' = ?", params.UserID.String())
+	}
+	query1 = query1.Where("effectiveTime >= ? AND effectiveTime < ?", TimeToISO8601(params.From), TimeToISO8601(params.To)).
 		Where("kind = ?", WorkspaceInstanceUsageKind)
 	if params.ExcludeDrafts {
 		query1 = query1.Where("draft = ?", false)

components/gitpod-db/go/usage_test.go

@@ -54,6 +54,60 @@ func TestFindUsageInRange(t *testing.T) {
 	require.Equal(t, []db.Usage{entryInside}, listResult)
 }
 
+func TestFindUsageInRangeByUser(t *testing.T) {
+	conn := dbtest.ConnectForTests(t)
+
+	start := time.Date(2022, 7, 1, 0, 0, 0, 0, time.UTC)
+	end := time.Date(2022, 8, 1, 0, 0, 0, 0, time.UTC)
+	userID := uuid.New()
+
+	attributionID := db.NewTeamAttributionID(uuid.New().String())
+
+	entryBefore := dbtest.NewUsage(t, withUserId(userID, db.Usage{
+		AttributionID: attributionID,
+		EffectiveTime: db.NewVarCharTime(start.Add(-1 * 23 * time.Hour)),
+		Draft:         true,
+	}))
+
+	entryInside := dbtest.NewUsage(t, withUserId(userID, db.Usage{
+		AttributionID: attributionID,
+		EffectiveTime: db.NewVarCharTime(start.Add(2 * time.Minute)),
+	}))
+
+	entryInsideOtherUser := dbtest.NewUsage(t, withUserId(uuid.New(), db.Usage{
+		AttributionID: attributionID,
+		EffectiveTime: db.NewVarCharTime(start.Add(2 * time.Minute)),
+	}))
+
+	entryAfter := dbtest.NewUsage(t, withUserId(userID, db.Usage{
+		AttributionID: attributionID,
+		EffectiveTime: db.NewVarCharTime(end.Add(2 * time.Hour)),
+	}))
+
+	usageEntries := []db.Usage{entryBefore, entryInside, entryInsideOtherUser, entryAfter}
+	dbtest.CreateUsageRecords(t, conn, usageEntries...)
+	listResult, err := db.FindUsage(context.Background(), conn, &db.FindUsageParams{
+		AttributionId: attributionID,
+		UserID:        userID,
+		From:          start,
+		To:            end,
+	})
+	require.NoError(t, err)
+
+	require.Equal(t, 1, len(listResult))
+	require.Equal(t, entryInside.ID, listResult[0].ID)
+
+	summary, err := db.GetUsageSummary(context.Background(), conn, db.GetUsageSummaryParams{
+		AttributionId: attributionID,
+		UserID:        userID,
+		From:          start,
+		To:            end,
+	})
+	require.NoError(t, err)
+	require.Equal(t, entryInside.CreditCents, summary.CreditCentsUsed)
+
+}
+
 func TestGetUsageSummary(t *testing.T) {
 	conn := dbtest.ConnectForTests(t)
 
@@ -335,6 +389,13 @@ func TestListBalance(t *testing.T) {
 	})
 }
 
+func withUserId(id uuid.UUID, usage db.Usage) db.Usage {
+	usage.SetCreditNoteMetaData(db.CreditNoteMetaData{
+		UserID: id.String(),
+	})
+	return usage
+}
+
 func TestGetBalance(t *testing.T) {
 	teamAttributionID := db.NewTeamAttributionID(uuid.New().String())
 	teamAttributionID2 := db.NewTeamAttributionID(uuid.New().String())

components/gitpod-protocol/src/usage.ts

@@ -6,9 +6,10 @@
 
 import { WorkspaceType } from "./protocol";
 
-// types below are copied over from components/usage-api/typescript/src/usage/v1/usage_pb.d.ts
+// types below are manually kept in sycn with components/usage-api/typescript/src/usage/v1/usage_pb.d.ts
 export interface ListUsageRequest {
     attributionId: string;
+    userId?: string;
     from?: number;
     to?: number;
     order: Ordering;

components/server/src/orgs/usage-service.ts

@@ -70,10 +70,26 @@ export class UsageService {
             });
         }
         const orgId = attributionId.teamId;
-        await this.authorizer.checkPermissionOnOrganization(userId, "read_billing", orgId);
+        // check if the user has access to why they requested
+        let requestedUserId = req.userId;
+        if (requestedUserId !== userId) {
+            try {
+                // asking for everybody's usage
+                await this.authorizer.checkPermissionOnOrganization(userId, "read_billing", orgId);
+            } catch (err) {
+                if (ApplicationError.hasErrorCode(err) && err.code === ErrorCodes.PERMISSION_DENIED) {
+                    // downgrade to user's usage only
+                    requestedUserId = userId;
+                } else {
+                    throw err;
+                }
+            }
+        }
+        await this.authorizer.checkPermissionOnOrganization(userId, "read_info", orgId);
 
         const response = await this.usageService.listUsage({
             attributionId: AttributionId.render(attributionId),
+            userId: requestedUserId,
             from: from ? new Date(from) : undefined,
             to: to ? new Date(to) : undefined,
             order: ListUsageRequest_Ordering.ORDERING_DESCENDING,

components/server/src/workspace/gitpod-server-impl.ts

@@ -4124,7 +4124,20 @@ export class GitpodServerImpl implements GitpodServerWithTracing, Disposable {
             });
         }
         const user = await this.checkAndBlockUser("listUsage");
-        await this.guardCostCenterAccess(ctx, attributionId, "get", "not_implemented");
+
+        // we are adding this check here inline because we are moving to the new fine-grained permissions model but are not quite ready yet.
+        const members = await this.teamDB.findMembersByTeam(attributionId.teamId);
+        const member = members.find((m) => m.userId === user.id);
+        if (!member) {
+            throw new ApplicationError(ErrorCodes.NOT_FOUND, "Organization not found.");
+        }
+        const isMemberUsageEnabled = await getExperimentsClientForBackend().getValueAsync("member_usage", false, {
+            user: user,
+            teamId: attributionId.teamId,
+        });
+        if (isMemberUsageEnabled && member.role !== "owner") {
+            req.userId = user.id;
+        }
         return this.usageService.listUsage(user.id, req);
     }