Skip to content

Commit d67ae5a

Browse files
Shivam-nagar23Shivam-nagar23
authored
chore: enhancements in User Service and User common service (#4293)
* jobs rbac create update user and role group flow * sql-scripts * capacity update * logs wip * script number change * fetch all workflows * rbac in apis * workflow-api-change * casbin-script * rbac-enforcement * appids null * workflow app ids len * rbac enforcement * script number chnage * appnames fetch * workflow response * app-workflow check * job env change * job actual name * job actual name * get api changes * number change * env rbac * fetch jobs * fetch jobs * workflow get * workflow status * ci-pipeline get * min other env * app stage status * material get * logs get * get env for job * pipeline get * app get * global plugins * git material * cm cs get * global variable * get suggest * update app * job-clone * workflow delete handling * omit empty * entity * workflow empty * review comments * review comments * rbac * comments-remove * saving role in lower * script number change * all jobs handling * workflow by app name * Revert "workflow by app name" This reverts commit a8b37ad. * job create * rbac * cm-checks * removing logs * cm-edit rbac * empty handling * script * comments * error code * validations and handling * cancel workflow * error checks * rbac * script number chnage * workflow error * removed un necessary strings.ToLower func * refactoring * re arranging constants * removed placeholders unnecesssary * refactoring * removed comments * refactoring get role by filter method * review comments * bulk operations * refresh rbac * wire-gen * checks * merge main * app type * message * bulk delete from casbin * review comments * main * refactor get rolegroup metadata * rbac resource * removing address of address * review comments * review comments * refactoring
1 parent 5eba1fc commit d67ae5a

32 files changed

+470
-533
lines changed

‎api/apiToken/ApiTokenRestHandler.go‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,6 @@ import (
3030
"gopkg.in/go-playground/validator.v9"
3131
"net/http"
3232
"strconv"
33-
"strings"
3433
)
3534

3635
type ApiTokenRestHandler interface {
@@ -213,7 +212,7 @@ func (impl ApiTokenRestHandlerImpl) DeleteApiToken(w http.ResponseWriter, r *htt
213212
}
214213

215214
func (handler ApiTokenRestHandlerImpl) checkManagerAuth(resource, token, object string) bool {
216-
if ok := handler.enforcer.Enforce(token, resource, casbin.ActionUpdate, strings.ToLower(object)); !ok {
215+
if ok := handler.enforcer.Enforce(token, resource, casbin.ActionUpdate, object); !ok {
217216
return false
218217
}
219218
return true
@@ -243,10 +242,10 @@ func (impl ApiTokenRestHandlerImpl) GetAllApiTokensForWebhook(w http.ResponseWri
243242
}
244243

245244
func (handler ApiTokenRestHandlerImpl) CheckAuthorizationForWebhook(token string, projectObject string, envObject string) bool {
246-
if ok := handler.enforcer.Enforce(token, casbin.ResourceApplications, casbin.ActionTrigger, strings.ToLower(projectObject)); !ok {
245+
if ok := handler.enforcer.Enforce(token, casbin.ResourceApplications, casbin.ActionTrigger, projectObject); !ok {
247246
return false
248247
}
249-
if ok := handler.enforcer.Enforce(token, casbin.ResourceEnvironment, casbin.ActionTrigger, strings.ToLower(envObject)); !ok {
248+
if ok := handler.enforcer.Enforce(token, casbin.ResourceEnvironment, casbin.ActionTrigger, envObject); !ok {
250249
return false
251250
}
252251
return true

‎api/appStore/InstalledAppRestHandler.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -432,7 +432,7 @@ func (impl *InstalledAppRestHandlerImpl) DefaultComponentInstallation(w http.Res
432432
}
433433

434434
// RBAC enforcer applying
435-
if ok := impl.enforcer.Enforce(token, casbin.ResourceCluster, casbin.ActionUpdate, strings.ToLower(cluster.ClusterName)); !ok {
435+
if ok := impl.enforcer.Enforce(token, casbin.ResourceCluster, casbin.ActionUpdate, cluster.ClusterName); !ok {
436436
common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
437437
return
438438
}

‎api/cluster/ClusterRestHandler.go‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,6 @@ import (
2525
"github.com/devtron-labs/devtron/pkg/genericNotes/repository"
2626
"net/http"
2727
"strconv"
28-
"strings"
2928
"time"
3029

3130
"github.com/devtron-labs/devtron/api/restHandler/common"
@@ -316,7 +315,7 @@ func (impl ClusterRestHandlerImpl) FindAll(w http.ResponseWriter, r *http.Reques
316315
// RBAC enforcer applying
317316
var result []*cluster.ClusterBean
318317
for _, item := range clusterList {
319-
if ok := impl.enforcer.Enforce(token, casbin.ResourceCluster, casbin.ActionGet, strings.ToLower(item.ClusterName)); ok {
318+
if ok := impl.enforcer.Enforce(token, casbin.ResourceCluster, casbin.ActionGet, item.ClusterName); ok {
320319
result = append(result, item)
321320
}
322321
}
@@ -343,7 +342,7 @@ func (impl ClusterRestHandlerImpl) FindById(w http.ResponseWriter, r *http.Reque
343342

344343
// RBAC enforcer applying
345344
token := r.Header.Get("token")
346-
if ok := impl.enforcer.Enforce(token, casbin.ResourceCluster, casbin.ActionGet, strings.ToLower(bean.ClusterName)); !ok {
345+
if ok := impl.enforcer.Enforce(token, casbin.ResourceCluster, casbin.ActionGet, bean.ClusterName); !ok {
347346
common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
348347
return
349348
}
@@ -418,7 +417,7 @@ func (impl ClusterRestHandlerImpl) Update(w http.ResponseWriter, r *http.Request
418417
}
419418

420419
// RBAC enforcer applying
421-
if ok := impl.enforcer.Enforce(token, casbin.ResourceCluster, casbin.ActionUpdate, strings.ToLower(bean.ClusterName)); !ok {
420+
if ok := impl.enforcer.Enforce(token, casbin.ResourceCluster, casbin.ActionUpdate, bean.ClusterName); !ok {
422421
common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
423422
return
424423
}
@@ -479,7 +478,7 @@ func (impl ClusterRestHandlerImpl) UpdateClusterDescription(w http.ResponseWrite
479478
return
480479
}
481480
// RBAC enforcer applying
482-
if ok := impl.enforcer.Enforce(token, casbin.ResourceCluster, casbin.ActionUpdate, strings.ToLower(clusterDescription.ClusterName)); !ok {
481+
if ok := impl.enforcer.Enforce(token, casbin.ResourceCluster, casbin.ActionUpdate, clusterDescription.ClusterName); !ok {
483482
common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
484483
return
485484
}
@@ -523,7 +522,7 @@ func (impl ClusterRestHandlerImpl) UpdateClusterNote(w http.ResponseWriter, r *h
523522
return
524523
}
525524
// RBAC enforcer applying
526-
if ok := impl.enforcer.Enforce(token, casbin.ResourceCluster, casbin.ActionUpdate, strings.ToLower(clusterDescription.ClusterName)); !ok {
525+
if ok := impl.enforcer.Enforce(token, casbin.ResourceCluster, casbin.ActionUpdate, clusterDescription.ClusterName); !ok {
527526
common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
528527
return
529528
}
@@ -628,7 +627,7 @@ func (impl ClusterRestHandlerImpl) GetAllClusterNamespaces(w http.ResponseWriter
628627

629628
// RBAC enforcer applying
630629
for clusterName, _ := range clusterNamespaces {
631-
if ok := impl.enforcer.Enforce(token, casbin.ResourceCluster, casbin.ActionGet, strings.ToLower(clusterName)); !ok {
630+
if ok := impl.enforcer.Enforce(token, casbin.ResourceCluster, casbin.ActionGet, clusterName); !ok {
632631
delete(clusterNamespaces, clusterName)
633632
}
634633
}

‎api/cluster/EnvironmentRestHandler.go‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -148,7 +148,7 @@ func (impl EnvironmentRestHandlerImpl) Get(w http.ResponseWriter, r *http.Reques
148148

149149
// RBAC enforcer applying
150150
token := r.Header.Get("token")
151-
if ok := impl.enforcer.Enforce(token, casbin.ResourceGlobalEnvironment, casbin.ActionGet, strings.ToLower(bean.EnvironmentIdentifier)); !ok {
151+
if ok := impl.enforcer.Enforce(token, casbin.ResourceGlobalEnvironment, casbin.ActionGet, bean.EnvironmentIdentifier); !ok {
152152
common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
153153
return
154154
}
@@ -222,7 +222,7 @@ func (impl EnvironmentRestHandlerImpl) GetAllActive(w http.ResponseWriter, r *ht
222222
token := r.Header.Get("token")
223223
for _, item := range bean {
224224
// RBAC enforcer applying
225-
if ok := impl.enforcer.Enforce(token, casbin.ResourceGlobalEnvironment, casbin.ActionGet, strings.ToLower(item.EnvironmentIdentifier)); ok {
225+
if ok := impl.enforcer.Enforce(token, casbin.ResourceGlobalEnvironment, casbin.ActionGet, item.EnvironmentIdentifier); ok {
226226
result = append(result, item)
227227
}
228228
//RBAC enforcer Ends
@@ -261,7 +261,7 @@ func (impl EnvironmentRestHandlerImpl) Update(w http.ResponseWriter, r *http.Req
261261
common.WriteJsonResp(w, err, nil, http.StatusBadRequest)
262262
return
263263
}
264-
if ok := impl.enforcer.Enforce(token, casbin.ResourceGlobalEnvironment, casbin.ActionUpdate, strings.ToLower(modifiedEnvironment.EnvironmentIdentifier)); !ok {
264+
if ok := impl.enforcer.Enforce(token, casbin.ResourceGlobalEnvironment, casbin.ActionUpdate, modifiedEnvironment.EnvironmentIdentifier); !ok {
265265
common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
266266
return
267267
}
@@ -292,7 +292,7 @@ func (impl EnvironmentRestHandlerImpl) FindById(w http.ResponseWriter, r *http.R
292292

293293
// RBAC enforcer applying
294294
token := r.Header.Get("token")
295-
if ok := impl.enforcer.Enforce(token, casbin.ResourceGlobalEnvironment, casbin.ActionGet, strings.ToLower(bean.EnvironmentIdentifier)); !ok {
295+
if ok := impl.enforcer.Enforce(token, casbin.ResourceGlobalEnvironment, casbin.ActionGet, bean.EnvironmentIdentifier); !ok {
296296
common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
297297
return
298298
}
@@ -396,7 +396,7 @@ func (handler EnvironmentRestHandlerImpl) CheckAuthorizationByEmailInBatchForGlo
396396
}
397397

398398
func (handler EnvironmentRestHandlerImpl) CheckAuthorizationForGlobalEnvironment(token string, object string) bool {
399-
if ok := handler.enforcer.Enforce(token, casbin.ResourceGlobalEnvironment, casbin.ActionGet, strings.ToLower(object)); !ok {
399+
if ok := handler.enforcer.Enforce(token, casbin.ResourceGlobalEnvironment, casbin.ActionGet, object); !ok {
400400
return false
401401
}
402402
return true
@@ -506,7 +506,7 @@ func (impl EnvironmentRestHandlerImpl) GetEnvironmentConnection(w http.ResponseW
506506
}
507507
// RBAC enforcer applying
508508
token := r.Header.Get("token")
509-
if ok := impl.enforcer.Enforce(token, casbin.ResourceGlobalEnvironment, casbin.ActionGet, strings.ToLower(bean.EnvironmentIdentifier)); !ok {
509+
if ok := impl.enforcer.Enforce(token, casbin.ResourceGlobalEnvironment, casbin.ActionGet, bean.EnvironmentIdentifier); !ok {
510510
common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
511511
return
512512
}

‎api/helm-app/HelmAppRestHandler.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -385,7 +385,7 @@ func (handler *HelmAppRestHandlerImpl) TemplateChart(w http.ResponseWriter, r *h
385385
}
386386

387387
func (handler *HelmAppRestHandlerImpl) checkHelmAuth(token string, object string) bool {
388-
if ok := handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionGet, strings.ToLower(object)); !ok {
388+
if ok := handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionGet, object); !ok {
389389
return false
390390
}
391391
return true

‎api/k8s/application/k8sApplicationRestHandler.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -868,7 +868,7 @@ func (handler *K8sApplicationRestHandlerImpl) getRbacCallbackForResource(token s
868868

869869
func (handler *K8sApplicationRestHandlerImpl) verifyRbacForResource(token string, clusterName string, resourceIdentifier util3.ResourceIdentifier, casbinAction string) bool {
870870
resourceName, objectName := handler.enforcerUtil.GetRBACNameForClusterEntity(clusterName, resourceIdentifier)
871-
return handler.enforcer.Enforce(token, strings.ToLower(resourceName), casbinAction, strings.ToLower(objectName))
871+
return handler.enforcer.Enforce(token, strings.ToLower(resourceName), casbinAction, objectName)
872872
}
873873

874874
func (handler *K8sApplicationRestHandlerImpl) verifyRbacForCluster(token string, clusterName string, request k8s.ResourceRequestBean, casbinAction string) bool {

‎api/restHandler/BulkUpdateRestHandler.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -398,10 +398,10 @@ func (handler BulkUpdateRestHandlerImpl) BulkBuildTrigger(w http.ResponseWriter,
398398
}
399399

400400
func (handler BulkUpdateRestHandlerImpl) checkAuthForBulkActions(token string, appObject string, envObject string) bool {
401-
if ok := handler.enforcer.Enforce(token, casbin.ResourceApplications, casbin.ActionUpdate, strings.ToLower(appObject)); !ok {
401+
if ok := handler.enforcer.Enforce(token, casbin.ResourceApplications, casbin.ActionUpdate, appObject); !ok {
402402
return false
403403
}
404-
if ok := handler.enforcer.Enforce(token, casbin.ResourceEnvironment, casbin.ActionUpdate, strings.ToLower(envObject)); !ok {
404+
if ok := handler.enforcer.Enforce(token, casbin.ResourceEnvironment, casbin.ActionUpdate, envObject); !ok {
405405
return false
406406
}
407407
return true

‎api/restHandler/CoreAppRestHandler.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -292,7 +292,7 @@ func (handler CoreAppRestHandlerImpl) CreateApp(w http.ResponseWriter, r *http.R
292292
return
293293
}
294294
// with admin roles, you have to access for all the apps of the project to create new app. (admin or manager with specific app permission can't create app.)
295-
if ok := handler.enforcer.Enforce(token, casbin.ResourceApplications, casbin.ActionCreate, fmt.Sprintf("%s/%s", strings.ToLower(team.Name), "*")); !ok {
295+
if ok := handler.enforcer.Enforce(token, casbin.ResourceApplications, casbin.ActionCreate, fmt.Sprintf("%s/%s", team.Name, "*")); !ok {
296296
common.WriteJsonResp(w, err, "Unauthorized User", http.StatusForbidden)
297297
return
298298
}

‎api/restHandler/DeploymentGroupRestHandler.go‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,6 @@ import (
3131
"gopkg.in/go-playground/validator.v9"
3232
"net/http"
3333
"strconv"
34-
"strings"
3534
)
3635

3736
type DeploymentGroupRestHandler interface {
@@ -175,7 +174,7 @@ func (impl *DeploymentGroupRestHandlerImpl) FetchEnvApplicationsForDG(w http.Res
175174
finalResp := make([]*deploymentGroup.EnvironmentAppListForDG, 0)
176175
for _, item := range result {
177176
// RBAC enforcer applying
178-
if ok := impl.enforcer.Enforce(token, casbin.ResourceGlobalEnvironment, casbin.ActionGet, strings.ToLower(item.EnvironmentIdentifier)); ok {
177+
if ok := impl.enforcer.Enforce(token, casbin.ResourceGlobalEnvironment, casbin.ActionGet, item.EnvironmentIdentifier); ok {
179178
passCount := 0
180179
for _, app := range item.Apps {
181180
resourceName := impl.enforcerUtil.GetAppRBACNameByAppId(app.Id)

‎api/restHandler/DockerRegRestHandler.go‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -360,7 +360,7 @@ func (impl DockerRegRestHandlerImpl) GetDockerArtifactStore(w http.ResponseWrite
360360
token := r.Header.Get("token")
361361
var result []types.DockerArtifactStoreBean
362362
for _, item := range res {
363-
if ok := impl.enforcer.Enforce(token, casbin.ResourceDocker, casbin.ActionGet, strings.ToLower(item.Id)); ok {
363+
if ok := impl.enforcer.Enforce(token, casbin.ResourceDocker, casbin.ActionGet, item.Id); ok {
364364
result = append(result, item)
365365
}
366366
}
@@ -381,7 +381,7 @@ func (impl DockerRegRestHandlerImpl) FetchAllDockerAccounts(w http.ResponseWrite
381381
token := r.Header.Get("token")
382382
var result []types.DockerArtifactStoreBean
383383
for _, item := range res {
384-
if ok := impl.enforcer.Enforce(token, casbin.ResourceDocker, casbin.ActionGet, strings.ToLower(item.Id)); ok {
384+
if ok := impl.enforcer.Enforce(token, casbin.ResourceDocker, casbin.ActionGet, item.Id); ok {
385385
item.DisabledFields = make([]types.DisabledFields, 0)
386386
if !item.IsPublic {
387387
if isEditable := impl.deleteService.CanDeleteChartRegistryPullConfig(item.Id); !(isEditable || item.IsPublic) {
@@ -407,7 +407,7 @@ func (impl DockerRegRestHandlerExtendedImpl) FetchAllDockerAccounts(w http.Respo
407407
token := r.Header.Get("token")
408408
var result []types.DockerArtifactStoreBean
409409
for _, item := range res {
410-
if ok := impl.enforcer.Enforce(token, casbin.ResourceDocker, casbin.ActionGet, strings.ToLower(item.Id)); ok {
410+
if ok := impl.enforcer.Enforce(token, casbin.ResourceDocker, casbin.ActionGet, item.Id); ok {
411411
item.DisabledFields = make([]types.DisabledFields, 0)
412412
if !item.IsPublic {
413413
if isContainerEditable := impl.deleteServiceFullMode.CanDeleteContainerRegistryConfig(item.Id); !(isContainerEditable || item.IsPublic) {
@@ -442,7 +442,7 @@ func (impl DockerRegRestHandlerImpl) FetchOneDockerAccounts(w http.ResponseWrite
442442

443443
// RBAC enforcer applying
444444
token := r.Header.Get("token")
445-
if ok := impl.enforcer.Enforce(token, casbin.ResourceDocker, casbin.ActionGet, strings.ToLower(res.Id)); !ok {
445+
if ok := impl.enforcer.Enforce(token, casbin.ResourceDocker, casbin.ActionGet, res.Id); !ok {
446446
common.WriteJsonResp(w, err, "Unauthorized User", http.StatusForbidden)
447447
return
448448
}
@@ -472,7 +472,7 @@ func (impl DockerRegRestHandlerExtendedImpl) FetchOneDockerAccounts(w http.Respo
472472

473473
// RBAC enforcer applying
474474
token := r.Header.Get("token")
475-
if ok := impl.enforcer.Enforce(token, casbin.ResourceDocker, casbin.ActionGet, strings.ToLower(res.Id)); !ok {
475+
if ok := impl.enforcer.Enforce(token, casbin.ResourceDocker, casbin.ActionGet, res.Id); !ok {
476476
common.WriteJsonResp(w, err, "Unauthorized User", http.StatusForbidden)
477477
return
478478
}
@@ -514,7 +514,7 @@ func (impl DockerRegRestHandlerImpl) UpdateDockerRegistryConfig(w http.ResponseW
514514

515515
// RBAC enforcer applying
516516
token := r.Header.Get("token")
517-
if ok := impl.enforcer.Enforce(token, casbin.ResourceDocker, casbin.ActionUpdate, strings.ToLower(bean.Id)); !ok {
517+
if ok := impl.enforcer.Enforce(token, casbin.ResourceDocker, casbin.ActionUpdate, bean.Id); !ok {
518518
common.WriteJsonResp(w, err, "Unauthorized User", http.StatusForbidden)
519519
return
520520
}
@@ -615,7 +615,7 @@ func (impl DockerRegRestHandlerImpl) DeleteDockerRegistryConfig(w http.ResponseW
615615

616616
// RBAC enforcer applying
617617
token := r.Header.Get("token")
618-
if ok := impl.enforcer.Enforce(token, casbin.ResourceDocker, casbin.ActionCreate, strings.ToLower(bean.Id)); !ok {
618+
if ok := impl.enforcer.Enforce(token, casbin.ResourceDocker, casbin.ActionCreate, bean.Id); !ok {
619619
common.WriteJsonResp(w, err, "Unauthorized User", http.StatusForbidden)
620620
return
621621
}
@@ -654,7 +654,7 @@ func (impl DockerRegRestHandlerExtendedImpl) DeleteDockerRegistryConfig(w http.R
654654

655655
// RBAC enforcer applying
656656
token := r.Header.Get("token")
657-
if ok := impl.enforcer.Enforce(token, casbin.ResourceDocker, casbin.ActionCreate, strings.ToLower(bean.Id)); !ok {
657+
if ok := impl.enforcer.Enforce(token, casbin.ResourceDocker, casbin.ActionCreate, bean.Id); !ok {
658658
common.WriteJsonResp(w, err, "Unauthorized User", http.StatusForbidden)
659659
return
660660
}

0 commit comments

Comments
 (0)