Ability to incrementally add permissions

[deontologician]

Right now, if you're using stuff like auto-create-collection and auto-create-indexes and want to add permissions, it's very inconvenient. hz set-schema will refuse to update permissions until you specify all auto created collections and indexes in the schema.toml file.

We should have a --merge option on the set-schema command that only adds things from the schema file that aren't present, but doesn't remove things or balk if they don't completely match

ping @Tryneus

[ericb]

I think this would be necessary for production mode as well.

For example, let's say you find and bug with your current permissions (perhaps a user can inadvertently read another users data), you would want to be able to update the permissions dynamically, without removing any collection data.

[deontologician]

Good point, I changed the name of the issue

[danielmewes]

There already is a --merge option to hz set-schema. It's called --update:
--update [yes|no] Only add new items and update existing, no removal..

The "update existing" part of this is based on the group+name pair of a security rule that is specified in the TOML file (i.e. an existing rule is replaced if the user group and rule name match a new rule).

Seems like we'll need to add some additional documentation on hz set-schema as well.

[danielmewes]

...also I vaguely remember that we talked about set-schema suggesting the use of --update in the error message that it provides when applying a schema would delete data. Presumably that's not currently the case?

[deontologician]

Doh. That's embarassing, I guess I should have looked at the command directly

[danielmewes]

Oh I might have confused that with suggesting the use of --force in the error message. I think we should add a mention of --update as well. How about:

These collections would be removed along with their data:
...
Run with "--force" to continue and remove these collections, or use "--update" to skip removing existing collections while still applying new and changed collections, indexes and rules.