Skip to content

Commit 48d94f2

Browse files
vikramdevtronvikramdevtron
authored
FIX: Hotfixes epic bugathon 01 ISSUE: user auth issues (#484)
* rbac object team name to lower case fix * rbac object team name to lower case fix
1 parent 9d7c4fb commit 48d94f2

File tree

3 files changed

+23
-21
lines changed

3 files changed

+23
-21
lines changed

‎api/restHandler/NotificationRestHandler.go‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ import (
3838
"io/ioutil"
3939
"net/http"
4040
"strconv"
41+
"strings"
4142
)
4243

4344
type NotificationRestHandler interface {
@@ -178,7 +179,7 @@ func (impl NotificationRestHandlerImpl) buildRbacObjectsForNotificationSettings(
178179
}
179180
for _, t := range teams {
180181
for _, a := range apps {
181-
teamRbac = append(teamRbac, fmt.Sprintf("%s/%s", t.Name, a.Name))
182+
teamRbac = append(teamRbac, fmt.Sprintf("%s/%s", strings.ToLower(t.Name), strings.ToLower(a.Name)))
182183
appsMap[a.Id] = a.Name
183184
}
184185
}
@@ -198,7 +199,7 @@ func (impl NotificationRestHandlerImpl) buildRbacObjectsForNotificationSettings(
198199
for _, t := range teams {
199200
for _, a := range apps {
200201
if t.Id == a.TeamId {
201-
teamRbac = append(teamRbac, fmt.Sprintf("%s/%s", t.Name, a.Name))
202+
teamRbac = append(teamRbac, fmt.Sprintf("%s/%s", strings.ToLower(t.Name), strings.ToLower(a.Name)))
202203
}
203204
}
204205
}
@@ -208,23 +209,23 @@ func (impl NotificationRestHandlerImpl) buildRbacObjectsForNotificationSettings(
208209
}
209210
for _, t := range teams {
210211
teamsMap[t.Id] = t.Name
211-
teamRbac = append(teamRbac, fmt.Sprintf("%s/*", t.Name))
212+
teamRbac = append(teamRbac, fmt.Sprintf("%s/*", strings.ToLower(t.Name)))
212213
}
213214
}
214215
if len(envIds) > 0 && len(appIds) == 0 {
215216
envs, err := impl.environmentService.FindByIds(envIds)
216217
if err != nil {
217218
}
218219
for _, e := range envs {
219-
envRbac = append(envRbac, fmt.Sprintf("%s/*", e.Environment))
220+
envRbac = append(envRbac, fmt.Sprintf("%s/*", strings.ToLower(e.Environment)))
220221
}
221222
} else if len(envIds) > 0 && len(appIds) > 0 {
222223
envs, err := impl.environmentService.FindByIds(envIds)
223224
if err != nil {
224225
}
225226
for _, e := range envs {
226227
for _, aId := range appIds {
227-
envRbac = append(envRbac, fmt.Sprintf("%s/%s", e.Environment, appsMap[*aId]))
228+
envRbac = append(envRbac, fmt.Sprintf("%s/%s", strings.ToLower(e.Environment), appsMap[*aId]))
228229
}
229230
}
230231
}
@@ -457,7 +458,7 @@ func (impl NotificationRestHandlerImpl) SaveNotificationChannelConfig(w http.Res
457458
return
458459
}
459460
for _, item := range teams {
460-
if ok := impl.enforcer.Enforce(token, rbac.ResourceApplications, rbac.ActionCreate, fmt.Sprintf("%s/*", item.Name)); !ok {
461+
if ok := impl.enforcer.Enforce(token, rbac.ResourceApplications, rbac.ActionCreate, fmt.Sprintf("%s/*", strings.ToLower(item.Name))); !ok {
461462
writeJsonResp(w, err, "Unauthorized User", http.StatusForbidden)
462463
return
463464
}
@@ -541,7 +542,7 @@ func (impl NotificationRestHandlerImpl) FindAllNotificationConfig(w http.Respons
541542
return
542543
}
543544
for _, item := range teams {
544-
if ok := impl.enforcer.Enforce(token, rbac.ResourceApplications, rbac.ActionGet, fmt.Sprintf("%s/*", item.Name)); !ok {
545+
if ok := impl.enforcer.Enforce(token, rbac.ResourceApplications, rbac.ActionGet, fmt.Sprintf("%s/*", strings.ToLower(item.Name))); !ok {
545546
pass = false
546547
break
547548
}
@@ -683,7 +684,7 @@ func (impl NotificationRestHandlerImpl) FindAllNotificationConfigAutocomplete(w
683684
writeJsonResp(w, err, nil, http.StatusBadRequest)
684685
return
685686
}
686-
if ok := impl.enforcer.Enforce(token, rbac.ResourceApplications, rbac.ActionGet, fmt.Sprintf("%s/*", team.Name)); ok {
687+
if ok := impl.enforcer.Enforce(token, rbac.ResourceApplications, rbac.ActionGet, fmt.Sprintf("%s/*", strings.ToLower(team.Name))); ok {
687688
channelsResponse = append(channelsResponse, item)
688689
}
689690
}

‎api/restHandler/UserRestHandler.go‎

Lines changed: 13 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ import (
3232
"gopkg.in/go-playground/validator.v9"
3333
"net/http"
3434
"strconv"
35+
"strings"
3536
)
3637

3738
type UserRestHandler interface {
@@ -97,7 +98,7 @@ func (handler UserRestHandlerImpl) CreateUser(w http.ResponseWriter, r *http.Req
9798
if userInfo.RoleFilters != nil && len(userInfo.RoleFilters) > 0 {
9899
for _, filter := range userInfo.RoleFilters {
99100
if len(filter.Team) > 0 {
100-
if ok := handler.enforcer.Enforce(token, rbac.ResourceUser, rbac.ActionCreate, filter.Team); !ok {
101+
if ok := handler.enforcer.Enforce(token, rbac.ResourceUser, rbac.ActionCreate, strings.ToLower(filter.Team)); !ok {
101102
response.WriteResponse(http.StatusForbidden, "FORBIDDEN", w, errors.New("unauthorized"))
102103
return
103104
}
@@ -122,7 +123,7 @@ func (handler UserRestHandlerImpl) CreateUser(w http.ResponseWriter, r *http.Req
122123
if groupRoles != nil && len(groupRoles) > 0 {
123124
for _, groupRole := range groupRoles {
124125
if len(groupRole.Team) > 0 {
125-
if ok := handler.enforcer.Enforce(token, rbac.ResourceUser, rbac.ActionCreate, groupRole.Team); !ok {
126+
if ok := handler.enforcer.Enforce(token, rbac.ResourceUser, rbac.ActionCreate, strings.ToLower(groupRole.Team)); !ok {
126127
response.WriteResponse(http.StatusForbidden, "FORBIDDEN", w, errors.New("unauthorized"))
127128
return
128129
}
@@ -182,7 +183,7 @@ func (handler UserRestHandlerImpl) UpdateUser(w http.ResponseWriter, r *http.Req
182183
if userInfo.RoleFilters != nil && len(userInfo.RoleFilters) > 0 {
183184
for _, filter := range userInfo.RoleFilters {
184185
if len(filter.Team) > 0 {
185-
if ok := handler.enforcer.Enforce(token, rbac.ResourceUser, rbac.ActionUpdate, filter.Team); !ok {
186+
if ok := handler.enforcer.Enforce(token, rbac.ResourceUser, rbac.ActionUpdate, strings.ToLower(filter.Team)); !ok {
186187
response.WriteResponse(http.StatusForbidden, "FORBIDDEN", w, errors.New("unauthorized"))
187188
return
188189
}
@@ -207,7 +208,7 @@ func (handler UserRestHandlerImpl) UpdateUser(w http.ResponseWriter, r *http.Req
207208
if groupRoles != nil && len(groupRoles) > 0 {
208209
for _, groupRole := range groupRoles {
209210
if len(groupRole.Team) > 0 {
210-
if ok := handler.enforcer.Enforce(token, rbac.ResourceUser, rbac.ActionUpdate, groupRole.Team); !ok {
211+
if ok := handler.enforcer.Enforce(token, rbac.ResourceUser, rbac.ActionUpdate, strings.ToLower(groupRole.Team)); !ok {
211212
response.WriteResponse(http.StatusForbidden, "FORBIDDEN", w, errors.New("unauthorized"))
212213
return
213214
}
@@ -277,7 +278,7 @@ func (handler UserRestHandlerImpl) GetById(w http.ResponseWriter, r *http.Reques
277278
authPass := false
278279
for _, filter := range res.RoleFilters {
279280
if len(filter.Team) > 0 {
280-
if ok := handler.enforcer.Enforce(token, rbac.ResourceUser, rbac.ActionGet, filter.Team); ok {
281+
if ok := handler.enforcer.Enforce(token, rbac.ResourceUser, rbac.ActionGet, strings.ToLower(filter.Team)); ok {
281282
authPass = true
282283
}
283284
}
@@ -338,7 +339,7 @@ func (handler UserRestHandlerImpl) GetUsersByFilter(w http.ResponseWriter, r *ht
338339
pass := true
339340
for _, filter := range item.RoleFilters {
340341
if len(filter.Team) > 0 {
341-
if ok := handler.enforcer.Enforce(token, rbac.ResourceUser, rbac.ActionGet, filter.Team); !ok {
342+
if ok := handler.enforcer.Enforce(token, rbac.ResourceUser, rbac.ActionGet, strings.ToLower(filter.Team)); !ok {
342343
pass = false
343344
}
344345
}
@@ -370,7 +371,7 @@ func (handler UserRestHandlerImpl) GetUserByEmail(w http.ResponseWriter, r *http
370371
if res.RoleFilters != nil && len(res.RoleFilters) > 0 {
371372
for _, filter := range res.RoleFilters {
372373
if len(filter.Team) > 0 {
373-
if ok := handler.enforcer.Enforce(token, rbac.ResourceUser, rbac.ActionGet, filter.Team); !ok {
374+
if ok := handler.enforcer.Enforce(token, rbac.ResourceUser, rbac.ActionGet, strings.ToLower(filter.Team)); !ok {
374375
response.WriteResponse(http.StatusForbidden, "FORBIDDEN", w, errors.New("unauthorized"))
375376
return
376377
}
@@ -408,7 +409,7 @@ func (handler UserRestHandlerImpl) DeleteUser(w http.ResponseWriter, r *http.Req
408409
if user.RoleFilters != nil && len(user.RoleFilters) > 0 {
409410
for _, filter := range user.RoleFilters {
410411
if len(filter.Team) > 0 {
411-
if ok := handler.enforcer.Enforce(token, rbac.ResourceUser, rbac.ActionDelete, filter.Team); !ok {
412+
if ok := handler.enforcer.Enforce(token, rbac.ResourceUser, rbac.ActionDelete, strings.ToLower(filter.Team)); !ok {
412413
response.WriteResponse(http.StatusForbidden, "FORBIDDEN", w, errors.New("unauthorized"))
413414
return
414415
}
@@ -454,7 +455,7 @@ func (handler UserRestHandlerImpl) FetchRoleGroupById(w http.ResponseWriter, r *
454455
if res.RoleFilters != nil && len(res.RoleFilters) > 0 {
455456
for _, filter := range res.RoleFilters {
456457
if len(filter.Team) > 0 {
457-
if ok := handler.enforcer.Enforce(token, rbac.ResourceUser, rbac.ActionGet, filter.Team); !ok {
458+
if ok := handler.enforcer.Enforce(token, rbac.ResourceUser, rbac.ActionGet, strings.ToLower(filter.Team)); !ok {
458459
response.WriteResponse(http.StatusForbidden, "FORBIDDEN", w, errors.New("unauthorized"))
459460
return
460461
}
@@ -488,7 +489,7 @@ func (handler UserRestHandlerImpl) CreateRoleGroup(w http.ResponseWriter, r *htt
488489
if request.RoleFilters != nil && len(request.RoleFilters) > 0 {
489490
for _, filter := range request.RoleFilters {
490491
if len(filter.Team) > 0 {
491-
if ok := handler.enforcer.Enforce(token, rbac.ResourceUser, rbac.ActionCreate, filter.Team); !ok {
492+
if ok := handler.enforcer.Enforce(token, rbac.ResourceUser, rbac.ActionCreate, strings.ToLower(filter.Team)); !ok {
492493
response.WriteResponse(http.StatusForbidden, "FORBIDDEN", w, errors.New("unauthorized"))
493494
return
494495
}
@@ -543,7 +544,7 @@ func (handler UserRestHandlerImpl) UpdateRoleGroup(w http.ResponseWriter, r *htt
543544
if request.RoleFilters != nil && len(request.RoleFilters) > 0 {
544545
for _, filter := range request.RoleFilters {
545546
if len(filter.Team) > 0 {
546-
if ok := handler.enforcer.Enforce(token, rbac.ResourceUser, rbac.ActionUpdate, filter.Team); !ok {
547+
if ok := handler.enforcer.Enforce(token, rbac.ResourceUser, rbac.ActionUpdate, strings.ToLower(filter.Team)); !ok {
547548
response.WriteResponse(http.StatusForbidden, "FORBIDDEN", w, errors.New("unauthorized"))
548549
return
549550
}
@@ -633,7 +634,7 @@ func (handler UserRestHandlerImpl) DeleteRoleGroup(w http.ResponseWriter, r *htt
633634
if userGroup.RoleFilters != nil && len(userGroup.RoleFilters) > 0 {
634635
for _, filter := range userGroup.RoleFilters {
635636
if len(filter.Team) > 0 {
636-
if ok := handler.enforcer.Enforce(token, rbac.ResourceUser, rbac.ActionDelete, filter.Team); !ok {
637+
if ok := handler.enforcer.Enforce(token, rbac.ResourceUser, rbac.ActionDelete, strings.ToLower(filter.Team)); !ok {
637638
response.WriteResponse(http.StatusForbidden, "FORBIDDEN", w, errors.New("unauthorized"))
638639
return
639640
}

‎pkg/user/RoleGroupService.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -418,7 +418,7 @@ func (impl RoleGroupServiceImpl) FetchRoleGroupsById(id int32) (*bean.RoleGroup,
418418
for _, role := range roles {
419419
key := ""
420420
if len(role.Team) > 0 && len(role.Environment) > 0 {
421-
key = fmt.Sprintf("%s_%s", role.Team, role.Action)
421+
key = fmt.Sprintf("%s_%s", role.Team, role.Environment)
422422
} else if len(role.Entity) > 0 {
423423
key = fmt.Sprintf("%s_%s", role.Entity, role.Action)
424424
}

0 commit comments

Comments
 (0)