From 46bb9bd613ec48a4b3d1e59eb4e5de3dd7d03962 Mon Sep 17 00:00:00 2001
From: Wroud <wrouds@gmail.com>
Date: Thu, 13 Aug 2020 18:52:26 +0300
Subject: [PATCH] feat(core): connections access managment

CB-232
---
 .../packages/core-authentication/.gitignore   | 21 ++++
 .../packages/core-authentication/package.json | 24 +++++
 .../src/AuthInfoService.ts                    |  0
 .../src/AuthProviderService.ts                |  0
 .../src/AuthProvidersResource.ts              |  0
 .../src}/RolesManagerService.ts               |  0
 .../src}/RolesResource.ts                     |  0
 .../src}/UsersResource.ts                     |  8 +-
 .../packages/core-authentication/src/index.ts |  6 ++
 .../core-authentication/tsconfig.json         | 10 ++
 webapp/packages/core-bootstrap/package.json   |  1 +
 .../packages/core-bootstrap/src/manifest.ts   |  9 ++
 webapp/packages/core-connections/package.json |  2 +
 .../ConnectionsTable/ConnectionEdit.tsx       | 18 ++++
 .../ConnectionEditController.ts               | 58 ++++++++++-
 .../ConnectionsTable/GrantedSubjects.tsx      | 97 +++++++++++++++++++
 .../src/Administration/ConnectionsResource.ts | 15 +++
 .../core-connections/src/locales/en.ts        |  3 +
 .../core-connections/src/locales/ru.ts        |  3 +
 .../administration/getConnectionAccess.gql    |  7 ++
 .../administration/setConnectionAccess.gql    |  3 +
 webapp/packages/core-sdk/src/sdk.ts           | 33 +++++++
 .../plugin-authentication/package.json        |  1 +
 .../Users/UsersAdministrationController.ts    |  3 +-
 .../Users/UsersAdministrationService.ts       |  2 +-
 .../Administration/Users/UsersTable/User.tsx  |  2 +-
 .../Users/UsersTable/UserEdit.tsx             |  2 +-
 .../Users/UsersTable/UserEditController.ts    |  4 +-
 .../src/AuthMenuService.ts                    |  2 +-
 .../src/AuthenticationService.ts              |  2 +-
 .../src/Dialog/AuthDialogController.ts        |  4 +-
 .../AuthProviderForm/AuthProviderForm.tsx     |  2 +-
 .../plugin-authentication/src/UserInfo.tsx    |  3 +-
 .../plugin-authentication/src/index.ts        |  3 -
 .../plugin-authentication/src/manifest.ts     | 12 ---
 35 files changed, 326 insertions(+), 34 deletions(-)
 create mode 100644 webapp/packages/core-authentication/.gitignore
 create mode 100644 webapp/packages/core-authentication/package.json
 rename webapp/packages/{plugin-authentication => core-authentication}/src/AuthInfoService.ts (100%)
 rename webapp/packages/{plugin-authentication => core-authentication}/src/AuthProviderService.ts (100%)
 rename webapp/packages/{plugin-authentication => core-authentication}/src/AuthProvidersResource.ts (100%)
 rename webapp/packages/{plugin-authentication/src/Administration => core-authentication/src}/RolesManagerService.ts (100%)
 rename webapp/packages/{plugin-authentication/src/Administration => core-authentication/src}/RolesResource.ts (100%)
 rename webapp/packages/{plugin-authentication/src/Administration => core-authentication/src}/UsersResource.ts (96%)
 create mode 100644 webapp/packages/core-authentication/src/index.ts
 create mode 100644 webapp/packages/core-authentication/tsconfig.json
 create mode 100644 webapp/packages/core-connections/src/Administration/Connections/ConnectionsTable/GrantedSubjects.tsx
 create mode 100644 webapp/packages/core-sdk/src/queries/connections/administration/getConnectionAccess.gql
 create mode 100644 webapp/packages/core-sdk/src/queries/connections/administration/setConnectionAccess.gql

diff --git a/webapp/packages/core-authentication/.gitignore b/webapp/packages/core-authentication/.gitignore
new file mode 100644
index 0000000000..99902db863
--- /dev/null
+++ b/webapp/packages/core-authentication/.gitignore
@@ -0,0 +1,21 @@
+# See https://help.github.com/articles/ignoring-files/ for more about ignoring files.
+
+# dependencies
+/node_modules
+/.pnp
+.pnp.js
+
+# testing
+/coverage
+
+# production
+/lib
+
+# misc
+.DS_Store
+.env*
+
+# debug
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
diff --git a/webapp/packages/core-authentication/package.json b/webapp/packages/core-authentication/package.json
new file mode 100644
index 0000000000..8c5350318e
--- /dev/null
+++ b/webapp/packages/core-authentication/package.json
@@ -0,0 +1,24 @@
+{
+  "name": "@cloudbeaver/core-authentication",
+  "sideEffects": false,
+  "version": "0.1.0",
+  "description": "",
+  "license": "Apache-2.0",
+  "main": "lib/index.js",
+  "module": "lib/index.js",
+  "scripts": {
+    "prebuild": "rimraf lib/*",
+    "build": "webpack --config ../../configs/webpack.plugin.config",
+    "postbuild": "tsc",
+    "lint": "eslint ./src/ --ext .ts,.tsx",
+    "lint-fix": "eslint ./src/ --ext .ts,.tsx --fix"
+  },
+  "peerDependencies": {
+    "@cloudbeaver/core-di": "^0.1.0",
+    "@cloudbeaver/core-events": "^0.1.0",
+    "@cloudbeaver/core-root": "^0.1.0",
+    "@cloudbeaver/core-sdk": "^0.1.0",
+    "@cloudbeaver/core-utils": "^0.1.0",
+    "mobx": "^5.x.x"
+  }
+}
\ No newline at end of file
diff --git a/webapp/packages/plugin-authentication/src/AuthInfoService.ts b/webapp/packages/core-authentication/src/AuthInfoService.ts
similarity index 100%
rename from webapp/packages/plugin-authentication/src/AuthInfoService.ts
rename to webapp/packages/core-authentication/src/AuthInfoService.ts
diff --git a/webapp/packages/plugin-authentication/src/AuthProviderService.ts b/webapp/packages/core-authentication/src/AuthProviderService.ts
similarity index 100%
rename from webapp/packages/plugin-authentication/src/AuthProviderService.ts
rename to webapp/packages/core-authentication/src/AuthProviderService.ts
diff --git a/webapp/packages/plugin-authentication/src/AuthProvidersResource.ts b/webapp/packages/core-authentication/src/AuthProvidersResource.ts
similarity index 100%
rename from webapp/packages/plugin-authentication/src/AuthProvidersResource.ts
rename to webapp/packages/core-authentication/src/AuthProvidersResource.ts
diff --git a/webapp/packages/plugin-authentication/src/Administration/RolesManagerService.ts b/webapp/packages/core-authentication/src/RolesManagerService.ts
similarity index 100%
rename from webapp/packages/plugin-authentication/src/Administration/RolesManagerService.ts
rename to webapp/packages/core-authentication/src/RolesManagerService.ts
diff --git a/webapp/packages/plugin-authentication/src/Administration/RolesResource.ts b/webapp/packages/core-authentication/src/RolesResource.ts
similarity index 100%
rename from webapp/packages/plugin-authentication/src/Administration/RolesResource.ts
rename to webapp/packages/core-authentication/src/RolesResource.ts
diff --git a/webapp/packages/plugin-authentication/src/Administration/UsersResource.ts b/webapp/packages/core-authentication/src/UsersResource.ts
similarity index 96%
rename from webapp/packages/plugin-authentication/src/Administration/UsersResource.ts
rename to webapp/packages/core-authentication/src/UsersResource.ts
index b0426d6c6f..050b73b360 100644
--- a/webapp/packages/plugin-authentication/src/Administration/UsersResource.ts
+++ b/webapp/packages/core-authentication/src/UsersResource.ts
@@ -17,8 +17,8 @@ import {
 } from '@cloudbeaver/core-sdk';
 import { MetadataMap, uuid } from '@cloudbeaver/core-utils';
 
-import { AuthInfoService } from '../AuthInfoService';
-import { AuthProviderService } from '../AuthProviderService';
+import { AuthInfoService } from './AuthInfoService';
+import { AuthProviderService } from './AuthProviderService';
 
 const NEW_USER_SYMBOL = Symbol('new-user');
 
@@ -76,6 +76,10 @@ export class UsersResource extends CachedMapResource<string, AdminUserInfo> {
   }
 
   async loadConnections(userId: string): Promise<AdminConnectionGrantInfo[]> {
+    if (this.isNew(userId)) {
+      return [];
+    }
+
     const { grantedConnections } = await this.graphQLService.gql.getUserGrantedConnections({ userId });
 
     return grantedConnections;
diff --git a/webapp/packages/core-authentication/src/index.ts b/webapp/packages/core-authentication/src/index.ts
new file mode 100644
index 0000000000..a5234cb6b3
--- /dev/null
+++ b/webapp/packages/core-authentication/src/index.ts
@@ -0,0 +1,6 @@
+export * from './AuthInfoService';
+export * from './AuthProviderService';
+export * from './AuthProvidersResource';
+export * from './RolesManagerService';
+export * from './RolesResource';
+export * from './UsersResource';
diff --git a/webapp/packages/core-authentication/tsconfig.json b/webapp/packages/core-authentication/tsconfig.json
new file mode 100644
index 0000000000..b0b5e9edfa
--- /dev/null
+++ b/webapp/packages/core-authentication/tsconfig.json
@@ -0,0 +1,10 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": {
+    "outDir": "lib"
+  },
+  "exclude": [
+    "node_modules"
+  ],
+  "include": ["src/**/*"]
+}
diff --git a/webapp/packages/core-bootstrap/package.json b/webapp/packages/core-bootstrap/package.json
index 9464583915..0ba9946b99 100644
--- a/webapp/packages/core-bootstrap/package.json
+++ b/webapp/packages/core-bootstrap/package.json
@@ -16,6 +16,7 @@
   "dependencies": {
     "@cloudbeaver/core-administration": "^0.1.0",
     "@cloudbeaver/core-app": "^0.1.0",
+    "@cloudbeaver/core-authentication": "^0.1.0",
     "@cloudbeaver/core-blocks": "^0.1.0",
     "@cloudbeaver/core-connections": "^0.1.0",
     "@cloudbeaver/core-di": "^0.1.0",
diff --git a/webapp/packages/core-bootstrap/src/manifest.ts b/webapp/packages/core-bootstrap/src/manifest.ts
index 99929c8294..fb93fe6ae2 100644
--- a/webapp/packages/core-bootstrap/src/manifest.ts
+++ b/webapp/packages/core-bootstrap/src/manifest.ts
@@ -21,6 +21,9 @@ import {
   SettingsMenuService, LogViewerService, LogViewerMenuService, TopNavService,
   AppScreenService, CoreSettingsService, AdministrationTopAppBarBootstrapService
 } from '@cloudbeaver/core-app';
+import {
+  AuthInfoService, AuthProviderService, AuthProvidersResource, RolesManagerService, RolesResource, UsersResource
+} from '@cloudbeaver/core-authentication';
 import {
   ConnectionsManagerService,
   ConnectionInfoResource,
@@ -71,6 +74,12 @@ export const coreManifest: PluginManifest = {
     ProductSettingsService,
     ProductManagerService,
     PluginManagerService,
+    AuthInfoService,
+    AuthProviderService,
+    AuthProvidersResource,
+    RolesManagerService,
+    RolesResource,
+    UsersResource,
     ServerSettingsService,
     ServerConfigResource,
     PermissionsResource,
diff --git a/webapp/packages/core-connections/package.json b/webapp/packages/core-connections/package.json
index 99a88947fa..19a865c328 100644
--- a/webapp/packages/core-connections/package.json
+++ b/webapp/packages/core-connections/package.json
@@ -14,6 +14,8 @@
     "lint-fix": "eslint ./src/ --ext .ts,.tsx --fix"
   },
   "peerDependencies": {
+    "@cloudbeaver/core-administration": "^0.1.0",
+    "@cloudbeaver/core-authentication": "^0.1.0",
     "@cloudbeaver/core-di": "^0.1.0",
     "@cloudbeaver/core-plugin": "^0.1.0",
     "@cloudbeaver/core-localization": "^0.1.0",
diff --git a/webapp/packages/core-connections/src/Administration/Connections/ConnectionsTable/ConnectionEdit.tsx b/webapp/packages/core-connections/src/Administration/Connections/ConnectionsTable/ConnectionEdit.tsx
index ecc04c9736..e711d3a610 100644
--- a/webapp/packages/core-connections/src/Administration/Connections/ConnectionsTable/ConnectionEdit.tsx
+++ b/webapp/packages/core-connections/src/Administration/Connections/ConnectionsTable/ConnectionEdit.tsx
@@ -24,6 +24,7 @@ import { ConnectionsResource } from '../../ConnectionsResource';
 import { ConnectionEditController } from './ConnectionEditController';
 import { ConnectionForm } from './ConnectionForm/ConnectionForm';
 import { DriverProperties } from './DriverProperties/DriverProperties';
+import { GrantedSubjects } from './GrantedSubjects';
 
 const styles = composes(
   css`
@@ -42,6 +43,10 @@ const styles = composes(
     SubmittingForm {
       composes: theme-background-secondary from global;
     }
+
+    GrantedSubjects {
+      composes: theme-background-surface from global;
+    }
   `,
   css`
     custom-connection {
@@ -143,6 +148,9 @@ export const ConnectionEdit = observer(function ConnectionEdit({
         <Tab tabId='driver_properties' onOpen={() => setLoadProperties(true)} disabled={!controller.driver} >
           <TabTitle>{translate('customConnection_properties')}</TabTitle>
         </Tab>
+        <Tab tabId='access' onOpen={controller.loadAccessSubjects} disabled={!controller.driver} >
+          <TabTitle>{translate('connections_connection_edit_access')}</TabTitle>
+        </Tab>
         <fill as="div" />
         <Button
           type="button"
@@ -177,6 +185,16 @@ export const ConnectionEdit = observer(function ConnectionEdit({
                 />
               </TabPanel>
             )}
+            <TabPanel tabId='access'>
+              <GrantedSubjects
+                grantedSubjects={controller.grantedSubjects}
+                users={controller.users}
+                roles={controller.roles}
+                selectedSubjects={controller.selectedSubjects}
+                disabled={controller.isLoading}
+                onChange={controller.handleAccessChange}
+              />
+            </TabPanel>
           </SubmittingForm>
         )
       }
diff --git a/webapp/packages/core-connections/src/Administration/Connections/ConnectionsTable/ConnectionEditController.ts b/webapp/packages/core-connections/src/Administration/Connections/ConnectionsTable/ConnectionEditController.ts
index 15aa831ad3..d37ded8cf2 100644
--- a/webapp/packages/core-connections/src/Administration/Connections/ConnectionsTable/ConnectionEditController.ts
+++ b/webapp/packages/core-connections/src/Administration/Connections/ConnectionsTable/ConnectionEditController.ts
@@ -8,6 +8,7 @@
 
 import { observable, action, computed } from 'mobx';
 
+import { UsersResource, RolesResource } from '@cloudbeaver/core-authentication';
 import {
   injectable, IInitializableController, IDestructibleController, Bootstrap
 } from '@cloudbeaver/core-di';
@@ -15,7 +16,7 @@ import { CommonDialogService } from '@cloudbeaver/core-dialogs';
 import { NotificationService } from '@cloudbeaver/core-events';
 import { ErrorDetailsDialog } from '@cloudbeaver/core-notifications';
 import {
-  ConnectionConfig, GQLErrorCatcher, DatabaseAuthModel, ConnectionInfo
+  ConnectionConfig, GQLErrorCatcher, DatabaseAuthModel, ConnectionInfo, AdminConnectionGrantInfo
 } from '@cloudbeaver/core-sdk';
 
 import { DatabaseAuthModelsResource } from '../../../DatabaseAuthModelsResource';
@@ -30,6 +31,7 @@ export enum ConnectionType {
 @injectable()
 export class ConnectionEditController
 implements IInitializableController, IDestructibleController {
+  @observable grantedSubjects: AdminConnectionGrantInfo[] = [];
   @observable connectionType = ConnectionType.Attributes
   @observable isLoading = true;
   @observable isSaving = false;
@@ -47,6 +49,14 @@ implements IInitializableController, IDestructibleController {
     credentials: {},
   };
 
+  @computed get users() {
+    return Array.from(this.usersResource.data.values());
+  }
+
+  @computed get roles() {
+    return Array.from(this.rolesResource.data.values());
+  }
+
   @computed get isDisabled() {
     return this.isLoading || this.isSaving;
   }
@@ -60,7 +70,11 @@ implements IInitializableController, IDestructibleController {
   }
 
   connectionId!: string;
+
+  readonly selectedSubjects = observable<string, boolean>(new Map())
   readonly error = new GQLErrorCatcher();
+  private accessChanged = false;
+  private accessLoaded = false;
   private isDistructed = false;
   private connectionInfo!: ConnectionInfo;
 
@@ -69,6 +83,8 @@ implements IInitializableController, IDestructibleController {
     private notificationService: NotificationService,
     private commonDialogService: CommonDialogService,
     private dbAuthModelsResource: DatabaseAuthModelsResource,
+    private usersResource: UsersResource,
+    private rolesResource: RolesResource,
     private dbDriverResource: DBDriverResource,
   ) { }
 
@@ -108,10 +124,12 @@ implements IInitializableController, IDestructibleController {
     try {
       if (this.isNew) {
         const connection = await this.connectionsResource.create(this.getConnectionConfig(), this.connectionId);
+        await this.saveSubjectPermissions(connection.id);
 
         this.notificationService.logInfo({ title: `Connection ${connection.name} created` });
       } else {
         const connection = await this.connectionsResource.update(this.connectionId, this.getConnectionConfig());
+        await this.saveSubjectPermissions(connection.id);
 
         this.notificationService.logInfo({ title: `Connection ${connection.name} updated` });
       }
@@ -128,6 +146,43 @@ implements IInitializableController, IDestructibleController {
     }
   }
 
+  handleAccessChange = () => this.accessChanged = true;
+
+  loadAccessSubjects = async () => {
+    if (this.accessLoaded || this.isLoading) {
+      return;
+    }
+
+    this.isLoading = true;
+    try {
+      await this.usersResource.loadAll();
+      await this.rolesResource.loadAll();
+
+      this.grantedSubjects = await this.connectionsResource.loadAccessSubjects(this.connectionId);
+
+      for (const subject of this.grantedSubjects) {
+        this.selectedSubjects.set(subject.subjectId, true);
+      }
+      this.accessLoaded = true;
+    } catch (exception) {
+      this.notificationService.logException(exception, 'connections_connection_edit_access_load_failed');
+    }
+    this.isLoading = false;
+  }
+
+  private getGrantedSubjects() {
+    return Array.from(this.selectedSubjects.keys())
+      .filter(connectionId => this.selectedSubjects.get(connectionId));
+  }
+
+  private async saveSubjectPermissions(connectionId: string) {
+    if (!this.accessChanged) {
+      return;
+    }
+    await this.connectionsResource.setAccessSubjects(connectionId, this.getGrantedSubjects());
+    this.accessChanged = false;
+  }
+
   private getConnectionConfig(): ConnectionConfig {
     const config: ConnectionConfig = {};
     config.name = this.config.name;
@@ -161,6 +216,7 @@ implements IInitializableController, IDestructibleController {
   @action
   private setDefaults() {
     this.onChange('name', this.connectionInfo?.name || (this.driver ? `${this.driver?.name} (custom)` : ''));
+    this.onChange('description', this.connectionInfo?.description || '');
     this.onChange('template', this.connectionInfo?.template);
     this.onChange('driverId', this.connectionInfo?.driverId || this.driver?.id || '');
     this.onChange('host', this.connectionInfo?.host || '');
diff --git a/webapp/packages/core-connections/src/Administration/Connections/ConnectionsTable/GrantedSubjects.tsx b/webapp/packages/core-connections/src/Administration/Connections/ConnectionsTable/GrantedSubjects.tsx
new file mode 100644
index 0000000000..dec5c5dc45
--- /dev/null
+++ b/webapp/packages/core-connections/src/Administration/Connections/ConnectionsTable/GrantedSubjects.tsx
@@ -0,0 +1,97 @@
+/*
+ * cloudbeaver - Cloud Database Manager
+ * Copyright (C) 2020 DBeaver Corp and others
+ *
+ * Licensed under the Apache License, Version 2.0.
+ * you may not use this file except in compliance with the License.
+ */
+
+import { observer } from 'mobx-react';
+import { useCallback } from 'react';
+import styled, { css } from 'reshadow';
+
+import {
+  Table, TableHeader, TableColumnHeader, TableBody, TableItem, TableColumnValue, TableItemSelect
+} from '@cloudbeaver/core-blocks';
+import { useTranslate } from '@cloudbeaver/core-localization';
+import {
+  AdminSubjectType, AdminConnectionGrantInfo, AdminUserInfo, AdminRoleInfo
+} from '@cloudbeaver/core-sdk';
+import { useStyles } from '@cloudbeaver/core-theming';
+
+const styles = css`
+  TableColumnHeader {
+    border-top: solid 1px;
+  }
+  center {
+    margin: auto;
+  }
+`;
+
+type Props = {
+  grantedSubjects: AdminConnectionGrantInfo[];
+  users: AdminUserInfo[];
+  roles: AdminRoleInfo[];
+  selectedSubjects: Map<string, boolean>;
+  disabled: boolean;
+  onChange?: () => void;
+  className?: string;
+}
+
+export const GrantedSubjects = observer(function GrantedSubjects({
+  grantedSubjects,
+  users,
+  roles,
+  selectedSubjects,
+  disabled,
+  onChange,
+  className,
+}: Props) {
+  const translate = useTranslate();
+  const getSubjectPermission = useCallback((subjectId: string) => grantedSubjects
+      ?.find(subjectPermission => subjectPermission.subjectId === subjectId), [grantedSubjects]);
+
+  if (users.length === 0 && roles.length) {
+    return styled(useStyles(styles))(
+      <center as='div'>{translate('authentication_administration_user_connections_empty')}</center>
+    );
+  }
+
+  return styled(useStyles(styles))(
+    <Table selectedItems={selectedSubjects} onSelect={onChange} className={className}>
+      <TableHeader>
+        <TableColumnHeader min/>
+        <TableColumnHeader>{translate('connections_connection_name')}</TableColumnHeader>
+        <TableColumnHeader>{translate('connections_connection_edit_access_role')}</TableColumnHeader>
+        <TableColumnHeader></TableColumnHeader>
+      </TableHeader>
+      <TableBody>
+        {roles.map(role => (
+          <TableItem key={role.roleId} item={role.roleId}>
+            <TableColumnValue centerContent flex>
+              <TableItemSelect disabled={disabled}/>
+            </TableColumnValue>
+            <TableColumnValue>{role.roleName}</TableColumnValue>
+            <TableColumnValue></TableColumnValue>
+            <TableColumnValue></TableColumnValue>
+          </TableItem>
+        ))}
+        {users.map((user) => {
+          const connectionPermission = getSubjectPermission(user.userId);
+          const isRoleProvided = connectionPermission?.subjectType === AdminSubjectType.Role;
+
+          return (
+            <TableItem key={user.userId} item={user.userId}>
+              <TableColumnValue centerContent flex>
+                <TableItemSelect disabled={disabled || isRoleProvided}/>
+              </TableColumnValue>
+              <TableColumnValue>{user.userId}</TableColumnValue>
+              <TableColumnValue>{isRoleProvided && user.grantedRoles.join(',')}</TableColumnValue>
+              <TableColumnValue></TableColumnValue>
+            </TableItem>
+          );
+        })}
+      </TableBody>
+    </Table>
+  );
+});
diff --git a/webapp/packages/core-connections/src/Administration/ConnectionsResource.ts b/webapp/packages/core-connections/src/Administration/ConnectionsResource.ts
index 8fced80cdc..e425abf31b 100644
--- a/webapp/packages/core-connections/src/Administration/ConnectionsResource.ts
+++ b/webapp/packages/core-connections/src/Administration/ConnectionsResource.ts
@@ -14,6 +14,7 @@ import {
   CachedMapResource,
   ResourceKey,
   isResourceKeyList,
+  AdminConnectionGrantInfo,
 } from '@cloudbeaver/core-sdk';
 import { uuid, MetadataMap } from '@cloudbeaver/core-utils';
 
@@ -97,6 +98,20 @@ export class ConnectionsResource extends CachedMapResource<string, ConnectionInf
     this.itemDeleteSubject.next(key);
   }
 
+  async loadAccessSubjects(connectionId: string): Promise<AdminConnectionGrantInfo[]> {
+    if (this.isNew(connectionId)) {
+      return [];
+    }
+
+    const { subjects } = await this.graphQLService.gql.getConnectionAccess({ connectionId });
+
+    return subjects;
+  }
+
+  async setAccessSubjects(connectionId: string, subjects: string[]) {
+    await this.graphQLService.gql.setConnectionAccess({ connectionId, subjects });
+  }
+
   protected async loader(key: ResourceKey<string>): Promise<Map<string, ConnectionInfo>> {
     const { connections } = await this.graphQLService.gql.getConnections();
     this.data.clear();
diff --git a/webapp/packages/core-connections/src/locales/en.ts b/webapp/packages/core-connections/src/locales/en.ts
index 4b89a3dd94..e6a378f0b6 100644
--- a/webapp/packages/core-connections/src/locales/en.ts
+++ b/webapp/packages/core-connections/src/locales/en.ts
@@ -1,6 +1,9 @@
 export default [
   ['connections_administration_item', 'Connection Management'],
   ['connections_connection_edit_authentication', 'Authentication'],
+  ['connections_connection_edit_access', 'Access'],
+  ['connections_connection_edit_access_load_failed', 'Connection access loading failed'],
+  ['connections_connection_edit_access_role', 'Role'],
   ['connections_connection_name', 'Name'],
   ['connections_connection_description', 'Description'],
   ['connections_connection_driver', 'Driver'],
diff --git a/webapp/packages/core-connections/src/locales/ru.ts b/webapp/packages/core-connections/src/locales/ru.ts
index ca37ff0bfa..6c3b6c271c 100644
--- a/webapp/packages/core-connections/src/locales/ru.ts
+++ b/webapp/packages/core-connections/src/locales/ru.ts
@@ -1,6 +1,9 @@
 export default [
   ['connections_administration_item', 'Управление подключениями'],
   ['connections_connection_edit_authentication', 'Авторизация'],
+  ['connections_connection_edit_access', 'Доступ'],
+  ['connections_connection_edit_access_load_failed', 'Не удалось загрузить информацию доступа'],
+  ['connections_connection_edit_access_role', 'Роль'],
   ['connections_connection_name', 'Название'],
   ['connections_connection_description', 'Описапние'],
   ['connections_connection_driver', 'Driver'],
diff --git a/webapp/packages/core-sdk/src/queries/connections/administration/getConnectionAccess.gql b/webapp/packages/core-sdk/src/queries/connections/administration/getConnectionAccess.gql
new file mode 100644
index 0000000000..725e1e418d
--- /dev/null
+++ b/webapp/packages/core-sdk/src/queries/connections/administration/getConnectionAccess.gql
@@ -0,0 +1,7 @@
+query getConnectionAccess($connectionId: ID) {
+  subjects: getConnectionSubjectAccess(connectionId: $connectionId) {
+    connectionId
+    subjectId
+    subjectType
+  } 
+}
\ No newline at end of file
diff --git a/webapp/packages/core-sdk/src/queries/connections/administration/setConnectionAccess.gql b/webapp/packages/core-sdk/src/queries/connections/administration/setConnectionAccess.gql
new file mode 100644
index 0000000000..ee46d403f5
--- /dev/null
+++ b/webapp/packages/core-sdk/src/queries/connections/administration/setConnectionAccess.gql
@@ -0,0 +1,3 @@
+query setConnectionAccess($connectionId: ID!, $subjects: [ID!]!) {
+  setConnectionSubjectAccess(connectionId: $connectionId, subjects: $subjects)
+}
\ No newline at end of file
diff --git a/webapp/packages/core-sdk/src/sdk.ts b/webapp/packages/core-sdk/src/sdk.ts
index 8b73a7546a..d3005f4567 100644
--- a/webapp/packages/core-sdk/src/sdk.ts
+++ b/webapp/packages/core-sdk/src/sdk.ts
@@ -900,10 +900,23 @@ export type DeleteConnectionConfigurationQueryVariables = Exact<{
 
 export type DeleteConnectionConfigurationQuery = Pick<Query, 'deleteConnectionConfiguration'>;
 
+export type GetConnectionAccessQueryVariables = Exact<{
+  connectionId?: Maybe<Scalars['ID']>;
+}>;
+
+export type GetConnectionAccessQuery = { subjects: Array<Pick<AdminConnectionGrantInfo, 'connectionId' | 'subjectId' | 'subjectType'>> };
+
 export type GetConnectionsQueryVariables = Exact<{ [key: string]: never }>;
 
 export type GetConnectionsQuery = { connections: Array<Pick<ConnectionInfo, 'id' | 'name' | 'description' | 'driverId' | 'template' | 'connected' | 'readOnly' | 'host' | 'port' | 'databaseName' | 'url' | 'properties' | 'features' | 'authNeeded' | 'authModel'>> };
 
+export type SetConnectionAccessQueryVariables = Exact<{
+  connectionId: Scalars['ID'];
+  subjects: Array<Scalars['ID']>;
+}>;
+
+export type SetConnectionAccessQuery = Pick<Query, 'setConnectionSubjectAccess'>;
+
 export type UpdateConnectionConfigurationQueryVariables = Exact<{
   id: Scalars['ID'];
   config: ConnectionConfig;
@@ -1414,6 +1427,15 @@ export const DeleteConnectionConfigurationDocument = `
   deleteConnectionConfiguration(id: $id)
 }
     `;
+export const GetConnectionAccessDocument = `
+    query getConnectionAccess($connectionId: ID) {
+  subjects: getConnectionSubjectAccess(connectionId: $connectionId) {
+    connectionId
+    subjectId
+    subjectType
+  }
+}
+    `;
 export const GetConnectionsDocument = `
     query getConnections {
   connections: allConnections {
@@ -1435,6 +1457,11 @@ export const GetConnectionsDocument = `
   }
 }
     `;
+export const SetConnectionAccessDocument = `
+    query setConnectionAccess($connectionId: ID!, $subjects: [ID!]!) {
+  setConnectionSubjectAccess(connectionId: $connectionId, subjects: $subjects)
+}
+    `;
 export const UpdateConnectionConfigurationDocument = `
     query updateConnectionConfiguration($id: ID!, $config: ConnectionConfig!) {
   connection: updateConnectionConfiguration(id: $id, config: $config) {
@@ -2138,9 +2165,15 @@ export function getSdk(client: GraphQLClient, withWrapper: SdkFunctionWrapper =
     deleteConnectionConfiguration(variables: DeleteConnectionConfigurationQueryVariables): Promise<DeleteConnectionConfigurationQuery> {
       return withWrapper(() => client.request<DeleteConnectionConfigurationQuery>(DeleteConnectionConfigurationDocument, variables));
     },
+    getConnectionAccess(variables?: GetConnectionAccessQueryVariables): Promise<GetConnectionAccessQuery> {
+      return withWrapper(() => client.request<GetConnectionAccessQuery>(GetConnectionAccessDocument, variables));
+    },
     getConnections(variables?: GetConnectionsQueryVariables): Promise<GetConnectionsQuery> {
       return withWrapper(() => client.request<GetConnectionsQuery>(GetConnectionsDocument, variables));
     },
+    setConnectionAccess(variables: SetConnectionAccessQueryVariables): Promise<SetConnectionAccessQuery> {
+      return withWrapper(() => client.request<SetConnectionAccessQuery>(SetConnectionAccessDocument, variables));
+    },
     updateConnectionConfiguration(variables: UpdateConnectionConfigurationQueryVariables): Promise<UpdateConnectionConfigurationQuery> {
       return withWrapper(() => client.request<UpdateConnectionConfigurationQuery>(UpdateConnectionConfigurationDocument, variables));
     },
diff --git a/webapp/packages/plugin-authentication/package.json b/webapp/packages/plugin-authentication/package.json
index 2dd0e1747f..69d54179c8 100644
--- a/webapp/packages/plugin-authentication/package.json
+++ b/webapp/packages/plugin-authentication/package.json
@@ -15,6 +15,7 @@
   },
   "peerDependencies": {
     "@cloudbeaver/core-administration": "^0.1.0",
+    "@cloudbeaver/core-authentication": "^0.1.0",
     "@cloudbeaver/core-app": "^0.1.0",
     "@cloudbeaver/core-blocks": "^0.1.0",
     "@cloudbeaver/core-di": "^0.1.0",
diff --git a/webapp/packages/plugin-authentication/src/Administration/Users/UsersAdministrationController.ts b/webapp/packages/plugin-authentication/src/Administration/Users/UsersAdministrationController.ts
index 3233dc1778..8cdb831030 100644
--- a/webapp/packages/plugin-authentication/src/Administration/Users/UsersAdministrationController.ts
+++ b/webapp/packages/plugin-authentication/src/Administration/Users/UsersAdministrationController.ts
@@ -8,14 +8,13 @@
 
 import { observable } from 'mobx';
 
+import { UsersResource } from '@cloudbeaver/core-authentication';
 import { injectable } from '@cloudbeaver/core-di';
 import { CommonDialogService, ConfirmationDialog } from '@cloudbeaver/core-dialogs';
 import { NotificationService } from '@cloudbeaver/core-events';
 import { ErrorDetailsDialog } from '@cloudbeaver/core-notifications';
 import { GQLErrorCatcher, resourceKeyList } from '@cloudbeaver/core-sdk';
 
-import { UsersResource } from '../UsersResource';
-
 @injectable()
 export class UsersAdministrationController {
   @observable isDeleting = false;
diff --git a/webapp/packages/plugin-authentication/src/Administration/Users/UsersAdministrationService.ts b/webapp/packages/plugin-authentication/src/Administration/Users/UsersAdministrationService.ts
index e4ecf41274..2e7a467e72 100644
--- a/webapp/packages/plugin-authentication/src/Administration/Users/UsersAdministrationService.ts
+++ b/webapp/packages/plugin-authentication/src/Administration/Users/UsersAdministrationService.ts
@@ -7,10 +7,10 @@
  */
 
 import { AdministrationItemService, AdministrationScreenService } from '@cloudbeaver/core-administration';
+import { UsersResource } from '@cloudbeaver/core-authentication';
 import { injectable, Bootstrap } from '@cloudbeaver/core-di';
 import { NotificationService } from '@cloudbeaver/core-events';
 
-import { UsersResource } from '../UsersResource';
 import { UsersAdministration } from './UsersAdministration';
 import { UsersDrawerItem } from './UsersDrawerItem';
 
diff --git a/webapp/packages/plugin-authentication/src/Administration/Users/UsersTable/User.tsx b/webapp/packages/plugin-authentication/src/Administration/Users/UsersTable/User.tsx
index 9fe4370537..624b647c39 100644
--- a/webapp/packages/plugin-authentication/src/Administration/Users/UsersTable/User.tsx
+++ b/webapp/packages/plugin-authentication/src/Administration/Users/UsersTable/User.tsx
@@ -9,6 +9,7 @@
 import { observer } from 'mobx-react';
 import styled, { css, use } from 'reshadow';
 
+import { UsersResource } from '@cloudbeaver/core-authentication';
 import {
   TableItem, TableColumnValue, TableItemSelect, TableItemExpand
 } from '@cloudbeaver/core-blocks';
@@ -16,7 +17,6 @@ import { useService } from '@cloudbeaver/core-di';
 import { AdminUserInfo } from '@cloudbeaver/core-sdk';
 import { useStyles, composes } from '@cloudbeaver/core-theming';
 
-import { UsersResource } from '../../UsersResource';
 import { UserEdit } from './UserEdit';
 
 const styles = composes(
diff --git a/webapp/packages/plugin-authentication/src/Administration/Users/UsersTable/UserEdit.tsx b/webapp/packages/plugin-authentication/src/Administration/Users/UsersTable/UserEdit.tsx
index 405c666dd7..c024f4f833 100644
--- a/webapp/packages/plugin-authentication/src/Administration/Users/UsersTable/UserEdit.tsx
+++ b/webapp/packages/plugin-authentication/src/Administration/Users/UsersTable/UserEdit.tsx
@@ -10,6 +10,7 @@ import { observer } from 'mobx-react';
 import { useContext, useCallback } from 'react';
 import styled, { css, use } from 'reshadow';
 
+import { UsersResource } from '@cloudbeaver/core-authentication';
 import {
   TabsState, TabList, Tab,
   TabTitle, Loader, SubmittingForm, TabPanel,
@@ -24,7 +25,6 @@ import { useService, useController } from '@cloudbeaver/core-di';
 import { useTranslate } from '@cloudbeaver/core-localization';
 import { useStyles, composes } from '@cloudbeaver/core-theming';
 
-import { UsersResource } from '../../UsersResource';
 import { GrantedConnections } from './GrantedConnections';
 import { UserEditController } from './UserEditController';
 
diff --git a/webapp/packages/plugin-authentication/src/Administration/Users/UsersTable/UserEditController.ts b/webapp/packages/plugin-authentication/src/Administration/Users/UsersTable/UserEditController.ts
index cdd21111fc..144db5a1ce 100644
--- a/webapp/packages/plugin-authentication/src/Administration/Users/UsersTable/UserEditController.ts
+++ b/webapp/packages/plugin-authentication/src/Administration/Users/UsersTable/UserEditController.ts
@@ -8,6 +8,7 @@
 
 import { observable, computed } from 'mobx';
 
+import { RolesManagerService, UsersResource } from '@cloudbeaver/core-authentication';
 import { ConnectionsResource, DBDriverResource } from '@cloudbeaver/core-connections';
 import { injectable, IInitializableController, IDestructibleController } from '@cloudbeaver/core-di';
 import { CommonDialogService } from '@cloudbeaver/core-dialogs';
@@ -15,9 +16,6 @@ import { NotificationService } from '@cloudbeaver/core-events';
 import { ErrorDetailsDialog } from '@cloudbeaver/core-notifications';
 import { GQLErrorCatcher, AdminUserInfo, AdminConnectionGrantInfo } from '@cloudbeaver/core-sdk';
 
-import { RolesManagerService } from '../../RolesManagerService';
-import { UsersResource } from '../../UsersResource';
-
 @injectable()
 export class UserEditController implements IInitializableController, IDestructibleController {
   readonly selectedConnections = observable<string, boolean>(new Map())
diff --git a/webapp/packages/plugin-authentication/src/AuthMenuService.ts b/webapp/packages/plugin-authentication/src/AuthMenuService.ts
index 88752ba5e1..c956f4e70c 100644
--- a/webapp/packages/plugin-authentication/src/AuthMenuService.ts
+++ b/webapp/packages/plugin-authentication/src/AuthMenuService.ts
@@ -8,12 +8,12 @@
 
 import { AdministrationTopAppBarService } from '@cloudbeaver/core-administration';
 import { SettingsMenuService, TopNavService } from '@cloudbeaver/core-app';
+import { AuthInfoService } from '@cloudbeaver/core-authentication';
 import { injectable } from '@cloudbeaver/core-di';
 import { NotificationService } from '@cloudbeaver/core-events';
 import { ServerService } from '@cloudbeaver/core-root';
 
 import { AuthenticationService } from './AuthenticationService';
-import { AuthInfoService } from './AuthInfoService';
 import { AuthDialogService } from './Dialog/AuthDialogService';
 import { UserInfo } from './UserInfo';
 
diff --git a/webapp/packages/plugin-authentication/src/AuthenticationService.ts b/webapp/packages/plugin-authentication/src/AuthenticationService.ts
index 9805d8616e..8f9a25b4a3 100644
--- a/webapp/packages/plugin-authentication/src/AuthenticationService.ts
+++ b/webapp/packages/plugin-authentication/src/AuthenticationService.ts
@@ -6,10 +6,10 @@
  * you may not use this file except in compliance with the License.
  */
 
+import { AuthInfoService } from '@cloudbeaver/core-authentication';
 import { injectable } from '@cloudbeaver/core-di';
 import { ServerService } from '@cloudbeaver/core-root';
 
-import { AuthInfoService } from './AuthInfoService';
 import { AuthDialogService } from './Dialog/AuthDialogService';
 
 @injectable()
diff --git a/webapp/packages/plugin-authentication/src/Dialog/AuthDialogController.ts b/webapp/packages/plugin-authentication/src/Dialog/AuthDialogController.ts
index 3665946bad..56d0bd3daf 100644
--- a/webapp/packages/plugin-authentication/src/Dialog/AuthDialogController.ts
+++ b/webapp/packages/plugin-authentication/src/Dialog/AuthDialogController.ts
@@ -8,15 +8,13 @@
 
 import { observable, computed } from 'mobx';
 
+import { AuthInfoService, AuthProvidersResource, AuthProvider } from '@cloudbeaver/core-authentication';
 import { injectable, IInitializableController, IDestructibleController } from '@cloudbeaver/core-di';
 import { CommonDialogService } from '@cloudbeaver/core-dialogs';
 import { NotificationService } from '@cloudbeaver/core-events';
 import { ErrorDetailsDialog } from '@cloudbeaver/core-notifications';
 import { GQLErrorCatcher } from '@cloudbeaver/core-sdk';
 
-import { AuthInfoService } from '../AuthInfoService';
-import { AuthProvidersResource, AuthProvider } from '../AuthProvidersResource';
-
 @injectable()
 export class AuthDialogController implements IInitializableController, IDestructibleController {
   @observable provider: AuthProvider | null = null
diff --git a/webapp/packages/plugin-authentication/src/Dialog/AuthProviderForm/AuthProviderForm.tsx b/webapp/packages/plugin-authentication/src/Dialog/AuthProviderForm/AuthProviderForm.tsx
index 0fbefd9c72..06974d6617 100644
--- a/webapp/packages/plugin-authentication/src/Dialog/AuthProviderForm/AuthProviderForm.tsx
+++ b/webapp/packages/plugin-authentication/src/Dialog/AuthProviderForm/AuthProviderForm.tsx
@@ -10,10 +10,10 @@ import { observer } from 'mobx-react';
 import { useCallback } from 'react';
 import styled from 'reshadow';
 
+import { AuthProvider } from '@cloudbeaver/core-authentication';
 import { InputField, useFocus } from '@cloudbeaver/core-blocks';
 import { useStyles } from '@cloudbeaver/core-theming';
 
-import { AuthProvider } from '../../AuthProvidersResource';
 import { formStyles } from './formStyles';
 
 type Props = {
diff --git a/webapp/packages/plugin-authentication/src/UserInfo.tsx b/webapp/packages/plugin-authentication/src/UserInfo.tsx
index 8efbf6383e..01b4df42dc 100644
--- a/webapp/packages/plugin-authentication/src/UserInfo.tsx
+++ b/webapp/packages/plugin-authentication/src/UserInfo.tsx
@@ -9,12 +9,11 @@
 import { observer } from 'mobx-react';
 import styled, { css } from 'reshadow';
 
+import { AuthInfoService } from '@cloudbeaver/core-authentication';
 import { IconOrImage } from '@cloudbeaver/core-blocks';
 import { useService } from '@cloudbeaver/core-di';
 import { composes, useStyles } from '@cloudbeaver/core-theming';
 
-import { AuthInfoService } from './AuthInfoService';
-
 const styles = composes(
   css`
     user {
diff --git a/webapp/packages/plugin-authentication/src/index.ts b/webapp/packages/plugin-authentication/src/index.ts
index 935afac647..7af0d5bcc7 100644
--- a/webapp/packages/plugin-authentication/src/index.ts
+++ b/webapp/packages/plugin-authentication/src/index.ts
@@ -3,7 +3,4 @@ import { manifest } from './manifest';
 export default manifest;
 
 export * from './AuthenticationService';
-export * from './AuthInfoService';
-export * from './AuthProviderService';
-export * from './AuthProvidersResource';
 export * from './Dialog/AuthDialogService';
diff --git a/webapp/packages/plugin-authentication/src/manifest.ts b/webapp/packages/plugin-authentication/src/manifest.ts
index 50476e9bea..506a94a8f8 100644
--- a/webapp/packages/plugin-authentication/src/manifest.ts
+++ b/webapp/packages/plugin-authentication/src/manifest.ts
@@ -8,16 +8,10 @@
 
 import { IServiceInjector, PluginManifest } from '@cloudbeaver/core-di';
 
-import { RolesManagerService } from './Administration/RolesManagerService';
-import { RolesResource } from './Administration/RolesResource';
 import { UsersAdministrationService } from './Administration/Users/UsersAdministrationService';
-import { UsersResource } from './Administration/UsersResource';
 import { AuthenticationLocaleService } from './AuthenticationLocaleService';
 import { AuthenticationService } from './AuthenticationService';
-import { AuthInfoService } from './AuthInfoService';
 import { AuthMenuService } from './AuthMenuService';
-import { AuthProviderService } from './AuthProviderService';
-import { AuthProvidersResource } from './AuthProvidersResource';
 import { Bootstrap } from './Bootstrap';
 import { AuthDialogService } from './Dialog/AuthDialogService';
 
@@ -28,16 +22,10 @@ export const manifest: PluginManifest = {
 
   providers: [
     AuthenticationService,
-    AuthInfoService,
-    AuthProviderService,
-    AuthProvidersResource,
     AuthDialogService,
     AuthMenuService,
     UsersAdministrationService,
-    RolesManagerService,
     AuthenticationLocaleService,
-    RolesResource,
-    UsersResource,
   ],
 
   async initialize(services: IServiceInjector) {