diff --git a/api/bean/AutocompleteConfig.go b/api/bean/AutocompleteConfig.go new file mode 100644 index 0000000000..8678b6abf2 --- /dev/null +++ b/api/bean/AutocompleteConfig.go @@ -0,0 +1,5 @@ +package bean + +type Config struct { + IgnoreAuthCheck bool `env:"IGNORE_AUTOCOMPLETE_AUTH_CHECK" envDefault:"false"` +} diff --git a/api/cluster/EnvironmentRestHandler.go b/api/cluster/EnvironmentRestHandler.go index 3ce6bbbe87..dc06935036 100644 --- a/api/cluster/EnvironmentRestHandler.go +++ b/api/cluster/EnvironmentRestHandler.go @@ -19,6 +19,8 @@ package cluster import ( "encoding/json" + "github.com/caarlos0/env/v6" + "github.com/devtron-labs/devtron/api/bean" "net/http" "regexp" "strconv" @@ -58,12 +60,20 @@ type EnvironmentRestHandlerImpl struct { validator *validator.Validate enforcer casbin.Enforcer deleteService delete2.DeleteService + cfg *bean.Config } func NewEnvironmentRestHandlerImpl(svc request.EnvironmentService, logger *zap.SugaredLogger, userService user.UserService, validator *validator.Validate, enforcer casbin.Enforcer, deleteService delete2.DeleteService, ) *EnvironmentRestHandlerImpl { + cfg := &bean.Config{} + err := env.Parse(cfg) + if err != nil { + logger.Errorw("error occurred while parsing config ", "err", err) + cfg.IgnoreAuthCheck = false + } + logger.Infow("evironment rest handler initialized", "ignoreAuthCheckValue", cfg.IgnoreAuthCheck) return &EnvironmentRestHandlerImpl{ environmentClusterMappingsService: svc, logger: logger, @@ -71,6 +81,7 @@ func NewEnvironmentRestHandlerImpl(svc request.EnvironmentService, logger *zap.S validator: validator, enforcer: enforcer, deleteService: deleteService, + cfg: cfg, } } @@ -275,29 +286,29 @@ func (impl EnvironmentRestHandlerImpl) GetEnvironmentListForAutocomplete(w http. dbElapsedTime := time.Since(start) token := r.Header.Get("token") - emailId, _ := impl.userService.GetEmailFromToken(token) - // RBAC enforcer applying - var grantedEnvironment []request.EnvironmentBean + var grantedEnvironment = environments start = time.Now() - var envIdentifierList []string - for _, item := range environments { - envIdentifierList = append(envIdentifierList, strings.ToLower(item.EnvironmentIdentifier)) - } - - result := impl.enforcer.EnforceByEmailInBatch(emailId, casbin.ResourceGlobalEnvironment, casbin.ActionGet, envIdentifierList) + if !impl.cfg.IgnoreAuthCheck { + grantedEnvironment = make([]request.EnvironmentBean, 0) + emailId, _ := impl.userService.GetEmailFromToken(token) + // RBAC enforcer applying + var envIdentifierList []string + for _, item := range environments { + envIdentifierList = append(envIdentifierList, strings.ToLower(item.EnvironmentIdentifier)) + } - for _, item := range environments { - if hasAccess := result[strings.ToLower(item.EnvironmentIdentifier)]; hasAccess { - grantedEnvironment = append(grantedEnvironment, item) + result := impl.enforcer.EnforceByEmailInBatch(emailId, casbin.ResourceGlobalEnvironment, casbin.ActionGet, envIdentifierList) + for _, item := range environments { + if hasAccess := result[strings.ToLower(item.EnvironmentIdentifier)]; hasAccess { + grantedEnvironment = append(grantedEnvironment, item) + } } + //RBAC enforcer Ends } elapsedTime := time.Since(start) impl.logger.Infow("Env elapsed Time for enforcer", "dbElapsedTime", dbElapsedTime, "elapsedTime", elapsedTime, "token", token, "envSize", len(grantedEnvironment)) - //RBAC enforcer Ends - if len(grantedEnvironment) == 0 { - grantedEnvironment = make([]request.EnvironmentBean, 0) - } + common.WriteJsonResp(w, err, grantedEnvironment, http.StatusOK) } diff --git a/api/team/TeamRestHandler.go b/api/team/TeamRestHandler.go index a3f2550ccd..2fedfac7f3 100644 --- a/api/team/TeamRestHandler.go +++ b/api/team/TeamRestHandler.go @@ -20,6 +20,8 @@ package team import ( "encoding/json" "fmt" + "github.com/caarlos0/env/v6" + "github.com/devtron-labs/devtron/api/bean" "github.com/devtron-labs/devtron/api/restHandler/common" delete2 "github.com/devtron-labs/devtron/pkg/delete" "github.com/devtron-labs/devtron/pkg/team" @@ -54,6 +56,7 @@ type TeamRestHandlerImpl struct { enforcer casbin.Enforcer userAuthService user.UserAuthService deleteService delete2.DeleteService + cfg *bean.Config } func NewTeamRestHandlerImpl(logger *zap.SugaredLogger, @@ -63,6 +66,14 @@ func NewTeamRestHandlerImpl(logger *zap.SugaredLogger, validator *validator.Validate, userAuthService user.UserAuthService, deleteService delete2.DeleteService, ) *TeamRestHandlerImpl { + cfg := &bean.Config{} + err := env.Parse(cfg) + if err != nil { + logger.Errorw("error occurred while parsing config ", "err", err) + cfg.IgnoreAuthCheck = false + } + + logger.Infow("team rest handler initialized", "ignoreAuthCheckValue", cfg.IgnoreAuthCheck) return &TeamRestHandlerImpl{ logger: logger, teamService: teamService, @@ -71,6 +82,7 @@ func NewTeamRestHandlerImpl(logger *zap.SugaredLogger, enforcer: enforcer, userAuthService: userAuthService, deleteService: deleteService, + cfg: cfg, } } @@ -246,28 +258,28 @@ func (impl TeamRestHandlerImpl) FetchForAutocomplete(w http.ResponseWriter, r *h } dbElapsedTime := time.Since(start) token := r.Header.Get("token") - emailId, _ := impl.userService.GetEmailFromToken(token) + var grantedTeams = teams start = time.Now() - // RBAC enforcer applying - var teamNameList []string - for _, item := range teams { - teamNameList = append(teamNameList, strings.ToLower(item.Name)) - } + if !impl.cfg.IgnoreAuthCheck { + grantedTeams = make([]team.TeamRequest, 0) + emailId, _ := impl.userService.GetEmailFromToken(token) + // RBAC enforcer applying + var teamNameList []string + for _, item := range teams { + teamNameList = append(teamNameList, strings.ToLower(item.Name)) + } - result := impl.enforcer.EnforceByEmailInBatch(emailId, casbin.ResourceTeam, casbin.ActionGet, teamNameList) + result := impl.enforcer.EnforceByEmailInBatch(emailId, casbin.ResourceTeam, casbin.ActionGet, teamNameList) - var grantedTeams []team.TeamRequest - for _, item := range teams { - if hasAccess := result[strings.ToLower(item.Name)]; hasAccess { - grantedTeams = append(grantedTeams, item) + for _, item := range teams { + if hasAccess := result[strings.ToLower(item.Name)]; hasAccess { + grantedTeams = append(grantedTeams, item) + } } } impl.logger.Infow("Team elapsed Time for enforcer", "dbElapsedTime", dbElapsedTime, "elapsedTime", time.Since(start), "token", token, "envSize", len(grantedTeams)) //RBAC enforcer Ends - if len(grantedTeams) == 0 { - grantedTeams = make([]team.TeamRequest, 0) - } common.WriteJsonResp(w, err, grantedTeams, http.StatusOK) }