Merge pull request #12734 from influxdata/scope-labels

Scope labels to organizations

authorizer/label.go

@@ -21,16 +21,8 @@ func NewLabelService(s influxdb.LabelService) *LabelService {
 	}
 }
 
-func newLabelPermission(a influxdb.Action, id influxdb.ID) (*influxdb.Permission, error) {
+func newLabelPermission(a influxdb.Action, orgID, id influxdb.ID) (*influxdb.Permission, error) {
-	p := &influxdb.Permission{
+	return influxdb.NewPermissionAtID(id, a, influxdb.LabelsResourceType, orgID)
-		Action: a,
-		Resource: influxdb.Resource{
-			Type: influxdb.LabelsResourceType,
-			ID:   &id,
-		},
-	}
-
-	return p, p.Valid()
 }
 
 func newResourcePermission(a influxdb.Action, id influxdb.ID, resourceType influxdb.ResourceType) (*influxdb.Permission, error) {
@@ -62,8 +54,8 @@ func authorizeLabelMappingAction(ctx context.Context, action influxdb.Action, id
 	return nil
 }
 
-func authorizeReadLabel(ctx context.Context, id influxdb.ID) error {
+func authorizeReadLabel(ctx context.Context, orgID, id influxdb.ID) error {
-	p, err := newLabelPermission(influxdb.ReadAction, id)
+	p, err := newLabelPermission(influxdb.ReadAction, orgID, id)
 	if err != nil {
 		return err
 	}
@@ -75,8 +67,8 @@ func authorizeReadLabel(ctx context.Context, id influxdb.ID) error {
 	return nil
 }
 
-func authorizeWriteLabel(ctx context.Context, id influxdb.ID) error {
+func authorizeWriteLabel(ctx context.Context, orgID, id influxdb.ID) error {
-	p, err := newLabelPermission(influxdb.WriteAction, id)
+	p, err := newLabelPermission(influxdb.WriteAction, orgID, id)
 	if err != nil {
 		return err
 	}
@@ -90,12 +82,12 @@ func authorizeWriteLabel(ctx context.Context, id influxdb.ID) error {
 
 // FindLabelByID checks to see if the authorizer on context has read access to the label id provided.
 func (s *LabelService) FindLabelByID(ctx context.Context, id influxdb.ID) (*influxdb.Label, error) {
-	if err := authorizeReadLabel(ctx, id); err != nil {
+	l, err := s.s.FindLabelByID(ctx, id)
+	if err != nil {
 		return nil, err
 	}
 
-	l, err := s.s.FindLabelByID(ctx, id)
+	if err := authorizeReadLabel(ctx, l.OrganizationID, id); err != nil {
-	if err != nil {
 		return nil, err
 	}
 
@@ -115,7 +107,7 @@ func (s *LabelService) FindLabels(ctx context.Context, filter influxdb.LabelFilt
 	// https://github.com/golang/go/wiki/SliceTricks#filtering-without-allocating
 	labels := ls[:0]
 	for _, l := range ls {
-		err := authorizeReadLabel(ctx, l.ID)
+		err := authorizeReadLabel(ctx, l.OrganizationID, l.ID)
 		if err != nil && influxdb.ErrorCode(err) != influxdb.EUnauthorized {
 			return nil, err
 		}
@@ -144,7 +136,7 @@ func (s *LabelService) FindResourceLabels(ctx context.Context, filter influxdb.L
 
 	labels := ls[:0]
 	for _, l := range ls {
-		err := authorizeReadLabel(ctx, l.ID)
+		err := authorizeReadLabel(ctx, l.OrganizationID, l.ID)
 		if err != nil && influxdb.ErrorCode(err) != influxdb.EUnauthorized {
 			return nil, err
 		}
@@ -159,14 +151,9 @@ func (s *LabelService) FindResourceLabels(ctx context.Context, filter influxdb.L
 	return labels, nil
 }
 
-// CreateLabel checks to see if the authorizer on context has write access to the global labels resource.
+// CreateLabel checks to see if the authorizer on context has read access to the new label's org.
 func (s *LabelService) CreateLabel(ctx context.Context, l *influxdb.Label) error {
-	p, err := influxdb.NewGlobalPermission(influxdb.WriteAction, influxdb.LabelsResourceType)
+	if err := authorizeReadOrg(ctx, l.OrganizationID); err != nil {
-	if err != nil {
-		return err
-	}
-
-	if err := IsAllowed(ctx, *p); err != nil {
 		return err
 	}
 
@@ -175,7 +162,12 @@ func (s *LabelService) CreateLabel(ctx context.Context, l *influxdb.Label) error
 
 // CreateLabelMapping checks to see if the authorizer on context has write access to the label and the resource contained by the label mapping in creation.
 func (s *LabelService) CreateLabelMapping(ctx context.Context, m *influxdb.LabelMapping) error {
-	if err := authorizeWriteLabel(ctx, m.LabelID); err != nil {
+	l, err := s.s.FindLabelByID(ctx, m.LabelID)
+	if err != nil {
+		return err
+	}
+
+	if err := authorizeWriteLabel(ctx, l.OrganizationID, m.LabelID); err != nil {
 		return err
 	}
 
@@ -188,12 +180,12 @@ func (s *LabelService) CreateLabelMapping(ctx context.Context, m *influxdb.Label
 
 // UpdateLabel checks to see if the authorizer on context has write access to the label provided.
 func (s *LabelService) UpdateLabel(ctx context.Context, id influxdb.ID, upd influxdb.LabelUpdate) (*influxdb.Label, error) {
-	_, err := s.s.FindLabelByID(ctx, id)
+	l, err := s.s.FindLabelByID(ctx, id)
 	if err != nil {
 		return nil, err
 	}
 
-	if err := authorizeWriteLabel(ctx, id); err != nil {
+	if err := authorizeWriteLabel(ctx, l.OrganizationID, id); err != nil {
 		return nil, err
 	}
 
@@ -202,12 +194,12 @@ func (s *LabelService) UpdateLabel(ctx context.Context, id influxdb.ID, upd infl
 
 // DeleteLabel checks to see if the authorizer on context has write access to the label provided.
 func (s *LabelService) DeleteLabel(ctx context.Context, id influxdb.ID) error {
-	_, err := s.s.FindLabelByID(ctx, id)
+	l, err := s.s.FindLabelByID(ctx, id)
 	if err != nil {
 		return err
 	}
 
-	if err := authorizeWriteLabel(ctx, id); err != nil {
+	if err := authorizeWriteLabel(ctx, l.OrganizationID, id); err != nil {
 		return err
 	}
 
@@ -216,12 +208,12 @@ func (s *LabelService) DeleteLabel(ctx context.Context, id influxdb.ID) error {
 
 // DeleteLabelMapping checks to see if the authorizer on context has write access to the label and the resource of the label mapping to delete.
 func (s *LabelService) DeleteLabelMapping(ctx context.Context, m *influxdb.LabelMapping) error {
-	_, err := s.s.FindLabelByID(ctx, m.LabelID)
+	l, err := s.s.FindLabelByID(ctx, m.LabelID)
 	if err != nil {
 		return err
 	}
 
-	if err := authorizeWriteLabel(ctx, m.LabelID); err != nil {
+	if err := authorizeWriteLabel(ctx, l.OrganizationID, m.LabelID); err != nil {
 		return err
 	}
 

authorizer/label_test.go

@@ -14,6 +14,10 @@ import (
 	influxdbtesting "github.com/influxdata/influxdb/testing"
 )
 
+const (
+	orgOneID = "020f755c3c083000"
+)
+
 var labelCmpOptions = cmp.Options{
 	cmp.Comparer(func(x, y []byte) bool {
 		return bytes.Equal(x, y)
@@ -52,6 +56,7 @@ func TestLabelService_FindLabelByID(t *testing.T) {
 					FindLabelByIDFn: func(ctx context.Context, id influxdb.ID) (*influxdb.Label, error) {
 						return &influxdb.Label{
 							ID:             id,
+							OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 						}, nil
 					},
 				},
@@ -77,6 +82,7 @@ func TestLabelService_FindLabelByID(t *testing.T) {
 					FindLabelByIDFn: func(ctx context.Context, id influxdb.ID) (*influxdb.Label, error) {
 						return &influxdb.Label{
 							ID:             id,
+							OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 						}, nil
 					},
 				},
@@ -93,7 +99,7 @@ func TestLabelService_FindLabelByID(t *testing.T) {
 			},
 			wants: wants{
 				err: &influxdb.Error{
-					Msg:  "read:labels/0000000000000001 is unauthorized",
+					Msg:  "read:orgs/020f755c3c083000/labels/0000000000000001 is unauthorized",
 					Code: influxdb.EUnauthorized,
 				},
 			},
@@ -139,12 +145,15 @@ func TestLabelService_FindLabels(t *testing.T) {
 						return []*influxdb.Label{
 							{
 								ID:             1,
+								OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 							},
 							{
 								ID:             2,
+								OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 							},
 							{
 								ID:             3,
+								OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 							},
 						}, nil
 					},
@@ -162,12 +171,15 @@ func TestLabelService_FindLabels(t *testing.T) {
 				labels: []*influxdb.Label{
 					{
 						ID:             1,
+						OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 					},
 					{
 						ID:             2,
+						OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 					},
 					{
 						ID:             3,
+						OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 					},
 				},
 			},
@@ -180,12 +192,15 @@ func TestLabelService_FindLabels(t *testing.T) {
 						return []*influxdb.Label{
 							{
 								ID:             1,
+								OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 							},
 							{
 								ID:             2,
+								OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 							},
 							{
 								ID:             3,
+								OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 							},
 						}, nil
 					},
@@ -204,6 +219,7 @@ func TestLabelService_FindLabels(t *testing.T) {
 				labels: []*influxdb.Label{
 					{
 						ID:             1,
+						OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 					},
 				},
 			},
@@ -216,12 +232,15 @@ func TestLabelService_FindLabels(t *testing.T) {
 						return []*influxdb.Label{
 							{
 								ID:             1,
+								OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 							},
 							{
 								ID:             2,
+								OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 							},
 							{
 								ID:             3,
+								OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 							},
 						}, nil
 					},
@@ -284,11 +303,13 @@ func TestLabelService_UpdateLabel(t *testing.T) {
 					FindLabelByIDFn: func(ctc context.Context, id influxdb.ID) (*influxdb.Label, error) {
 						return &influxdb.Label{
 							ID:             1,
+							OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 						}, nil
 					},
 					UpdateLabelFn: func(ctx context.Context, id influxdb.ID, upd influxdb.LabelUpdate) (*influxdb.Label, error) {
 						return &influxdb.Label{
 							ID:             1,
+							OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 						}, nil
 					},
 				},
@@ -316,11 +337,13 @@ func TestLabelService_UpdateLabel(t *testing.T) {
 					FindLabelByIDFn: func(ctc context.Context, id influxdb.ID) (*influxdb.Label, error) {
 						return &influxdb.Label{
 							ID:             1,
+							OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 						}, nil
 					},
 					UpdateLabelFn: func(ctx context.Context, id influxdb.ID, upd influxdb.LabelUpdate) (*influxdb.Label, error) {
 						return &influxdb.Label{
 							ID:             1,
+							OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 						}, nil
 					},
 				},
@@ -339,7 +362,7 @@ func TestLabelService_UpdateLabel(t *testing.T) {
 			},
 			wants: wants{
 				err: &influxdb.Error{
-					Msg:  "write:labels/0000000000000001 is unauthorized",
+					Msg:  "write:orgs/020f755c3c083000/labels/0000000000000001 is unauthorized",
 					Code: influxdb.EUnauthorized,
 				},
 			},
@@ -384,6 +407,7 @@ func TestLabelService_DeleteLabel(t *testing.T) {
 					FindLabelByIDFn: func(ctc context.Context, id influxdb.ID) (*influxdb.Label, error) {
 						return &influxdb.Label{
 							ID:             1,
+							OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 						}, nil
 					},
 					DeleteLabelFn: func(ctx context.Context, id influxdb.ID) error {
@@ -399,6 +423,7 @@ func TestLabelService_DeleteLabel(t *testing.T) {
 						Resource: influxdb.Resource{
 							Type:  influxdb.LabelsResourceType,
 							ID:    influxdbtesting.IDPtr(1),
+							OrgID: influxdbtesting.IDPtr(influxdbtesting.MustIDBase16(orgOneID)),
 						},
 					},
 				},
@@ -414,6 +439,7 @@ func TestLabelService_DeleteLabel(t *testing.T) {
 					FindLabelByIDFn: func(ctc context.Context, id influxdb.ID) (*influxdb.Label, error) {
 						return &influxdb.Label{
 							ID:             1,
+							OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 						}, nil
 					},
 					DeleteLabelFn: func(ctx context.Context, id influxdb.ID) error {
@@ -429,13 +455,14 @@ func TestLabelService_DeleteLabel(t *testing.T) {
 						Resource: influxdb.Resource{
 							Type:  influxdb.LabelsResourceType,
 							ID:    influxdbtesting.IDPtr(1),
+							OrgID: influxdbtesting.IDPtr(influxdbtesting.MustIDBase16(orgOneID)),
 						},
 					},
 				},
 			},
 			wants: wants{
 				err: &influxdb.Error{
-					Msg:  "write:labels/0000000000000001 is unauthorized",
+					Msg:  "write:orgs/020f755c3c083000/labels/0000000000000001 is unauthorized",
 					Code: influxdb.EUnauthorized,
 				},
 			},
@@ -483,9 +510,10 @@ func TestLabelService_CreateLabel(t *testing.T) {
 			},
 			args: args{
 				permission: influxdb.Permission{
-					Action: "write",
+					Action: "read",
 					Resource: influxdb.Resource{
-						Type: influxdb.LabelsResourceType,
+						ID:   influxdbtesting.IDPtr(influxdbtesting.MustIDBase16(orgOneID)),
+						Type: influxdb.OrgsResourceType,
 					},
 				},
 			},
@@ -512,7 +540,7 @@ func TestLabelService_CreateLabel(t *testing.T) {
 			},
 			wants: wants{
 				err: &influxdb.Error{
-					Msg:  "write:labels is unauthorized",
+					Msg:  "read:orgs/020f755c3c083000 is unauthorized",
 					Code: influxdb.EUnauthorized,
 				},
 			},
@@ -526,7 +554,7 @@ func TestLabelService_CreateLabel(t *testing.T) {
 			ctx := context.Background()
 			ctx = influxdbcontext.SetAuthorizer(ctx, &Authorizer{[]influxdb.Permission{tt.args.permission}})
 
-			err := s.CreateLabel(ctx, &influxdb.Label{Name: "name"})
+			err := s.CreateLabel(ctx, &influxdb.Label{Name: "name", OrganizationID: influxdbtesting.MustIDBase16(orgOneID)})
 			influxdbtesting.ErrorsEqual(t, err, tt.wants.err)
 		})
 	}
@@ -558,12 +586,15 @@ func TestLabelService_FindResourceLabels(t *testing.T) {
 						return []*influxdb.Label{
 							{
 								ID:             1,
+								OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 							},
 							{
 								ID:             2,
+								OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 							},
 							{
 								ID:             3,
+								OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 							},
 						}, nil
 					},
@@ -595,12 +626,15 @@ func TestLabelService_FindResourceLabels(t *testing.T) {
 				labels: []*influxdb.Label{
 					{
 						ID:             1,
+						OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 					},
 					{
 						ID:             2,
+						OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 					},
 					{
 						ID:             3,
+						OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 					},
 				},
 			},
@@ -613,12 +647,15 @@ func TestLabelService_FindResourceLabels(t *testing.T) {
 						return []*influxdb.Label{
 							{
 								ID:             1,
+								OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 							},
 							{
 								ID:             2,
+								OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 							},
 							{
 								ID:             3,
+								OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 							},
 						}, nil
 					},
@@ -651,6 +688,7 @@ func TestLabelService_FindResourceLabels(t *testing.T) {
 				labels: []*influxdb.Label{
 					{
 						ID:             3,
+						OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 					},
 				},
 			},
@@ -663,12 +701,15 @@ func TestLabelService_FindResourceLabels(t *testing.T) {
 						return []*influxdb.Label{
 							{
 								ID:             1,
+								OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 							},
 							{
 								ID:             2,
+								OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 							},
 							{
 								ID:             3,
+								OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 							},
 						}, nil
 					},
@@ -701,12 +742,15 @@ func TestLabelService_FindResourceLabels(t *testing.T) {
 						return []*influxdb.Label{
 							{
 								ID:             1,
+								OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 							},
 							{
 								ID:             2,
+								OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 							},
 							{
 								ID:             3,
+								OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 							},
 						}, nil
 					},
@@ -774,6 +818,12 @@ func TestLabelService_CreateLabelMapping(t *testing.T) {
 			name: "authorized to create label mapping",
 			fields: fields{
 				LabelService: &mock.LabelService{
+					FindLabelByIDFn: func(ctx context.Context, id influxdb.ID) (*influxdb.Label, error) {
+						return &influxdb.Label{
+							ID:             1,
+							OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
+						}, nil
+					},
 					CreateLabelMappingFn: func(ctx context.Context, lm *influxdb.LabelMapping) error {
 						return nil
 					},
@@ -809,6 +859,12 @@ func TestLabelService_CreateLabelMapping(t *testing.T) {
 			name: "unauthorized to create label mapping for resources on which the user does not have write access",
 			fields: fields{
 				LabelService: &mock.LabelService{
+					FindLabelByIDFn: func(ctx context.Context, id influxdb.ID) (*influxdb.Label, error) {
+						return &influxdb.Label{
+							ID:             1,
+							OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
+						}, nil
+					},
 					CreateLabelMappingFn: func(ctx context.Context, lm *influxdb.LabelMapping) error {
 						return nil
 					},
@@ -840,6 +896,12 @@ func TestLabelService_CreateLabelMapping(t *testing.T) {
 			name: "unauthorized to create label mapping",
 			fields: fields{
 				LabelService: &mock.LabelService{
+					FindLabelByIDFn: func(ctx context.Context, id influxdb.ID) (*influxdb.Label, error) {
+						return &influxdb.Label{
+							ID:             1,
+							OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
+						}, nil
+					},
 					CreateLabelMappingFn: func(ctx context.Context, lm *influxdb.LabelMapping) error {
 						return nil
 					},
@@ -862,7 +924,7 @@ func TestLabelService_CreateLabelMapping(t *testing.T) {
 			},
 			wants: wants{
 				err: &influxdb.Error{
-					Msg:  "write:labels/0000000000000001 is unauthorized",
+					Msg:  "write:orgs/020f755c3c083000/labels/0000000000000001 is unauthorized",
 					Code: influxdb.EUnauthorized,
 				},
 			},
@@ -907,6 +969,7 @@ func TestLabelService_DeleteLabelMapping(t *testing.T) {
 					FindLabelByIDFn: func(ctc context.Context, id influxdb.ID) (*influxdb.Label, error) {
 						return &influxdb.Label{
 							ID:             1,
+							OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 						}, nil
 					},
 					DeleteLabelMappingFn: func(ctx context.Context, m *influxdb.LabelMapping) error {
@@ -947,6 +1010,7 @@ func TestLabelService_DeleteLabelMapping(t *testing.T) {
 					FindLabelByIDFn: func(ctc context.Context, id influxdb.ID) (*influxdb.Label, error) {
 						return &influxdb.Label{
 							ID:             1,
+							OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 						}, nil
 					},
 					DeleteLabelMappingFn: func(ctx context.Context, m *influxdb.LabelMapping) error {
@@ -983,6 +1047,7 @@ func TestLabelService_DeleteLabelMapping(t *testing.T) {
 					FindLabelByIDFn: func(ctc context.Context, id influxdb.ID) (*influxdb.Label, error) {
 						return &influxdb.Label{
 							ID:             1,
+							OrganizationID: influxdbtesting.MustIDBase16(orgOneID),
 						}, nil
 					},
 					DeleteLabelMappingFn: func(ctx context.Context, m *influxdb.LabelMapping) error {
@@ -1007,7 +1072,7 @@ func TestLabelService_DeleteLabelMapping(t *testing.T) {
 			},
 			wants: wants{
 				err: &influxdb.Error{
-					Msg:  "write:labels/0000000000000001 is unauthorized",
+					Msg:  "write:orgs/020f755c3c083000/labels/0000000000000001 is unauthorized",
 					Code: influxdb.EUnauthorized,
 				},
 			},

http/label_service.go

@@ -78,9 +78,16 @@ func (b postLabelRequest) Validate() error {
 			Msg:  "label requires a name",
 		}
 	}
+	if !b.Label.OrganizationID.Valid() {
+		return &platform.Error{
+			Code: platform.EInvalid,
+			Msg:  "label requires a valid orgID",
+		}
+	}
 	return nil
 }
 
+// TODO(jm): ensure that the specified org actually exists
 func decodePostLabelRequest(ctx context.Context, r *http.Request) (*postLabelRequest, error) {
 	l := &platform.Label{}
 	if err := json.NewDecoder(r.Body).Decode(l); err != nil {

http/label_test.go

@@ -283,6 +283,7 @@ func TestService_handlePostLabel(t *testing.T) {
 			args: args{
 				label: &platform.Label{
 					Name:           "mylabel",
+					OrganizationID: platformtesting.MustIDBase16("020f755c3c082008"),
 				},
 			},
 			wants: wants{
@@ -295,7 +296,8 @@ func TestService_handlePostLabel(t *testing.T) {
   },
   "label": {
     "id": "020f755c3c082000",
-    "name": "mylabel"
+    "name": "mylabel",
+		"orgID": "020f755c3c082008"
   }
 }
 `,

http/swagger.yml

@@ -1638,7 +1638,7 @@ paths:
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/Label"
+                $ref: "#/components/schemas/LabelCreateRequest"
       responses:
         '201':
           description: Added label
@@ -7538,6 +7538,22 @@ components:
         id:
           readOnly: true
           type: string
+        orgID:
+          readOnly: true
+          type: string
+        name:
+          type: string
+        properties:
+          type: object
+          additionalProperties:
+            type: string
+          description: Key/Value pairs associated with this label. Keys can be removed by sending an update with an empty value.
+          example: {"color": "ffb3b3", "description": "this is a description"}
+    LabelCreateRequest:
+      type: object
+      properties:
+        orgID:
+          type: string
         name:
           type: string
         properties:

kv/label.go

@@ -6,6 +6,7 @@ import (
 	"encoding/json"
 
 	"github.com/influxdata/influxdb"
+	"github.com/influxdata/influxdb/kit/tracing"
 )
 
 var (
@@ -248,7 +249,15 @@ func (s *Service) CreateLabel(ctx context.Context, l *influxdb.Label) error {
 	err := s.kv.Update(ctx, func(tx Tx) error {
 		l.ID = s.IDGenerator.ID()
 
-		return s.putLabel(ctx, tx, l)
+		if err := s.putLabel(ctx, tx, l); err != nil {
+			return err
+		}
+
+		if err := s.createLabelUserResourceMappings(ctx, tx, l); err != nil {
+			return err
+		}
+
+		return nil
 	})
 
 	if err != nil {
@@ -271,6 +280,36 @@ func (s *Service) PutLabel(ctx context.Context, l *influxdb.Label) error {
 	})
 }
 
+func (s *Service) createLabelUserResourceMappings(ctx context.Context, tx Tx, l *influxdb.Label) error {
+	span, ctx := tracing.StartSpanFromContext(ctx)
+	defer span.Finish()
+
+	ms, err := s.findUserResourceMappings(ctx, tx, influxdb.UserResourceMappingFilter{
+		ResourceType: influxdb.OrgsResourceType,
+		ResourceID:   l.OrganizationID,
+	})
+	if err != nil {
+		return &influxdb.Error{
+			Err: err,
+		}
+	}
+
+	for _, m := range ms {
+		if err := s.createUserResourceMapping(ctx, tx, &influxdb.UserResourceMapping{
+			ResourceType: influxdb.LabelsResourceType,
+			ResourceID:   l.ID,
+			UserID:       m.UserID,
+			UserType:     m.UserType,
+		}); err != nil {
+			return &influxdb.Error{
+				Err: err,
+			}
+		}
+	}
+
+	return nil
+}
+
 func labelMappingKey(m *influxdb.LabelMapping) ([]byte, error) {
 	lid, err := m.LabelID.Encode()
 	if err != nil {
@@ -475,5 +514,18 @@ func (s *Service) deleteLabel(ctx context.Context, tx Tx, id influxdb.ID) error
 		return err
 	}
 
-	return b.Delete(encodedID)
+	if err := b.Delete(encodedID); err != nil {
+		return &influxdb.Error{
+			Err: err,
+		}
+	}
+
+	if err := s.deleteUserResourceMappings(ctx, tx, influxdb.UserResourceMappingFilter{
+		ResourceID:   id,
+		ResourceType: influxdb.LabelsResourceType,
+	}); err != nil {
+		return err
+	}
+
+	return nil
 }

label.go

@@ -48,6 +48,7 @@ type LabelService interface {
 // Label is a tag set on a resource, typically used for filtering on a UI.
 type Label struct {
 	ID             ID                `json:"id,omitempty"`
+	OrganizationID ID                `json:"orgID,omitempty"`
 	Name           string            `json:"name"`
 	Properties     map[string]string `json:"properties,omitempty"`
 }
@@ -61,6 +62,13 @@ func (l *Label) Validate() error {
 		}
 	}
 
+	if !l.OrganizationID.Valid() {
+		return &Error{
+			Code: EInvalid,
+			Msg:  "organization ID is required",
+		}
+	}
+
 	return nil
 }
 
@@ -106,6 +114,7 @@ type LabelUpdate struct {
 // LabelFilter represents a set of filters that restrict the returned results.
 type LabelFilter struct {
 	Name  string
+	OrgID *ID
 }
 
 // LabelMappingFilter represents a set of filters that restrict the returned results.

label_test.go

@@ -3,13 +3,19 @@ package influxdb_test
 import (
 	"testing"
 
+	"github.com/influxdata/influxdb"
 	platform "github.com/influxdata/influxdb"
+	influxtest "github.com/influxdata/influxdb/testing"
+)
+
+const (
+	orgOneID = "020f755c3c083000"
 )
 
 func TestLabelValidate(t *testing.T) {
 	type fields struct {
-		ResourceID platform.ID
 		Name  string
+		OrgID influxdb.ID
 	}
 	tests := []struct {
 		name    string
@@ -20,11 +26,21 @@ func TestLabelValidate(t *testing.T) {
 			name: "valid label",
 			fields: fields{
 				Name:  "iot",
+				OrgID: influxtest.MustIDBase16(orgOneID),
 			},
 		},
 		{
 			name: "label requires a name",
-			fields:  fields{},
+			fields: fields{
+				OrgID: influxtest.MustIDBase16(orgOneID),
+			},
+			wantErr: true,
+		},
+		{
+			name: "label requires an organization ID",
+			fields: fields{
+				Name: "iot",
+			},
 			wantErr: true,
 		},
 	}
@@ -32,6 +48,7 @@ func TestLabelValidate(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			m := platform.Label{
 				Name:           tt.fields.Name,
+				OrganizationID: tt.fields.OrgID,
 			}
 			if err := m.Validate(); (err != nil) != tt.wantErr {
 				t.Errorf("Label.Validate() error = %v, wantErr %v", err, tt.wantErr)

testing/label_service.go

@@ -346,6 +346,7 @@ func UpdateLabel(
 				Labels: []*influxdb.Label{
 					{
 						ID:             MustIDBase16(labelOneID),
+						OrganizationID: MustIDBase16(orgOneID),
 						Name:           "Tag1",
 					},
 				},
@@ -360,6 +361,7 @@ func UpdateLabel(
 				labels: []*influxdb.Label{
 					{
 						ID:             MustIDBase16(labelOneID),
+						OrganizationID: MustIDBase16(orgOneID),
 						Name:           "NotTag1",
 					},
 				},
@@ -371,6 +373,7 @@ func UpdateLabel(
 				Labels: []*influxdb.Label{
 					{
 						ID:             MustIDBase16(labelOneID),
+						OrganizationID: MustIDBase16(orgOneID),
 						Name:           "Tag1",
 					},
 				},
@@ -387,6 +390,7 @@ func UpdateLabel(
 				labels: []*influxdb.Label{
 					{
 						ID:             MustIDBase16(labelOneID),
+						OrganizationID: MustIDBase16(orgOneID),
 						Name:           "Tag1",
 						Properties: map[string]string{
 							"color": "fff000",
@@ -401,6 +405,7 @@ func UpdateLabel(
 				Labels: []*influxdb.Label{
 					{
 						ID:             MustIDBase16(labelOneID),
+						OrganizationID: MustIDBase16(orgOneID),
 						Name:           "Tag1",
 						Properties: map[string]string{
 							"color":       "fff000",
@@ -421,6 +426,7 @@ func UpdateLabel(
 				labels: []*influxdb.Label{
 					{
 						ID:             MustIDBase16(labelOneID),
+						OrganizationID: MustIDBase16(orgOneID),
 						Name:           "Tag1",
 						Properties: map[string]string{
 							"color":       "abc123",
@@ -436,6 +442,7 @@ func UpdateLabel(
 				Labels: []*influxdb.Label{
 					{
 						ID:             MustIDBase16(labelOneID),
+						OrganizationID: MustIDBase16(orgOneID),
 						Name:           "Tag1",
 						Properties: map[string]string{
 							"color":       "fff000",
@@ -456,6 +463,7 @@ func UpdateLabel(
 				labels: []*influxdb.Label{
 					{
 						ID:             MustIDBase16(labelOneID),
+						OrganizationID: MustIDBase16(orgOneID),
 						Name:           "Tag1",
 						Properties: map[string]string{
 							"color": "fff000",
@@ -531,10 +539,12 @@ func DeleteLabel(
 				Labels: []*influxdb.Label{
 					{
 						ID:             MustIDBase16(labelOneID),
+						OrganizationID: MustIDBase16(orgOneID),
 						Name:           "Tag1",
 					},
 					{
 						ID:             MustIDBase16(labelTwoID),
+						OrganizationID: MustIDBase16(orgOneID),
 						Name:           "Tag2",
 					},
 				},
@@ -546,6 +556,7 @@ func DeleteLabel(
 				labels: []*influxdb.Label{
 					{
 						ID:             MustIDBase16(labelTwoID),
+						OrganizationID: MustIDBase16(orgOneID),
 						Name:           "Tag2",
 					},
 				},
@@ -557,6 +568,7 @@ func DeleteLabel(
 				Labels: []*influxdb.Label{
 					{
 						ID:             MustIDBase16(labelOneID),
+						OrganizationID: MustIDBase16(orgOneID),
 						Name:           "Tag1",
 					},
 				},
@@ -568,6 +580,7 @@ func DeleteLabel(
 				labels: []*influxdb.Label{
 					{
 						ID:             MustIDBase16(labelOneID),
+						OrganizationID: MustIDBase16(orgOneID),
 						Name:           "Tag1",
 					},
 				},