Skip to content
Merged
Show file tree
Hide file tree
Changes from 124 commits
Commits
Show all changes
128 commits
Select commit Hold shift + click to select a range
0e70015
jobs rbac create update user and role group flow
Shivam-nagar23 Nov 3, 2023
9637113
Merge branch 'main' into feat-rbac-in-jobs
Shivam-nagar23 Nov 3, 2023
f095760
sql-scripts
Shivam-nagar23 Nov 3, 2023
d2f06c2
capacity update
Shivam-nagar23 Nov 3, 2023
7ecd961
logs wip
Shivam-nagar23 Nov 3, 2023
2afe2ad
Merge branch 'main' into feat-rbac-in-jobs
Shivam-nagar23 Nov 5, 2023
b9dce06
Merge branch 'main' into feat-rbac-in-jobs
Shivam-nagar23 Nov 7, 2023
d3c82bd
script number change
Shivam-nagar23 Nov 7, 2023
aa182c6
fetch all workflows
Shivam-nagar23 Nov 8, 2023
83677f1
Merge branch 'main' into feat-rbac-in-jobs
Shivam-nagar23 Nov 8, 2023
90404a2
rbac in apis
Shivam-nagar23 Nov 9, 2023
2edc613
workflow-api-change
Shivam-nagar23 Nov 10, 2023
36ff101
Merge branch 'main' into feat-rbac-in-jobs
Shivam-nagar23 Nov 10, 2023
7e22a34
Merge branch 'testing-jobs-rbac' into feat-rbac-in-jobs
Shivam-nagar23 Nov 10, 2023
019010d
casbin-script
Shivam-nagar23 Nov 10, 2023
8d2ea1b
rbac-enforcement
Shivam-nagar23 Nov 10, 2023
c22d007
appids null
Shivam-nagar23 Nov 10, 2023
92a6977
workflow app ids len
Shivam-nagar23 Nov 10, 2023
c373c96
rbac enforcement
Shivam-nagar23 Nov 10, 2023
01d77b8
script number chnage
Shivam-nagar23 Nov 10, 2023
973cdba
appnames fetch
Shivam-nagar23 Nov 10, 2023
256331d
fetch workflow api change
Shivam-nagar23 Nov 10, 2023
8cd19b9
workflow response
Shivam-nagar23 Nov 10, 2023
1fae481
Merge branch 'testing-jobs-rbac' into feat-rbac-in-jobs
Shivam-nagar23 Nov 10, 2023
6fd44e9
app-workflow check
Shivam-nagar23 Nov 12, 2023
426365a
job env change
Shivam-nagar23 Nov 12, 2023
ff7a29c
job actual name
Shivam-nagar23 Nov 12, 2023
9a2c8ce
job actual name
Shivam-nagar23 Nov 12, 2023
4d733d8
get api changes
Shivam-nagar23 Nov 15, 2023
189e987
Merge branch 'testing-jobs-rbac' into feat-rbac-in-jobs
Shivam-nagar23 Nov 15, 2023
92206c6
Merge branch 'main' into feat-rbac-in-jobs
Shivam-nagar23 Nov 15, 2023
788072c
Merge branch 'main' into feat-rbac-in-jobs
Shivam-nagar23 Nov 15, 2023
a71a5b0
number change
Shivam-nagar23 Nov 15, 2023
592cfcf
env rbac
Shivam-nagar23 Nov 16, 2023
a1c7c7f
fetch jobs
Shivam-nagar23 Nov 16, 2023
800466c
fetch jobs
Shivam-nagar23 Nov 16, 2023
6fccd95
workflow get
Shivam-nagar23 Nov 16, 2023
1dd7a5e
workflow status
Shivam-nagar23 Nov 16, 2023
6823412
ci-pipeline get
Shivam-nagar23 Nov 17, 2023
1b47695
min other env
Shivam-nagar23 Nov 17, 2023
f6d8ccc
app stage status
Shivam-nagar23 Nov 17, 2023
660642b
material get
Shivam-nagar23 Nov 17, 2023
25b85bb
logs get
Shivam-nagar23 Nov 17, 2023
476ed91
get env for job
Shivam-nagar23 Nov 17, 2023
fd49dc2
pipeline get
Shivam-nagar23 Nov 17, 2023
2c47da9
app get
Shivam-nagar23 Nov 17, 2023
1940f8b
global plugins
Shivam-nagar23 Nov 17, 2023
481a679
git material
Shivam-nagar23 Nov 17, 2023
c241767
cm cs get
Shivam-nagar23 Nov 17, 2023
1db1798
global variable
Shivam-nagar23 Nov 17, 2023
e6118bd
get suggest
Shivam-nagar23 Nov 17, 2023
c088032
update app
Shivam-nagar23 Nov 17, 2023
aa2ad72
job-clone
Shivam-nagar23 Nov 17, 2023
743106d
workflow delete handling
Shivam-nagar23 Nov 17, 2023
4b6381f
omit empty
Shivam-nagar23 Nov 17, 2023
13f44d1
entity
Shivam-nagar23 Nov 17, 2023
47ce0e7
workflow empty
Shivam-nagar23 Nov 17, 2023
e854c49
review comments
Shivam-nagar23 Nov 19, 2023
91adfe2
review comments
Shivam-nagar23 Nov 19, 2023
6797749
rbac
Shivam-nagar23 Nov 19, 2023
6b8c2dd
comments-remove
Shivam-nagar23 Nov 20, 2023
c2fe525
saving role in lower
Shivam-nagar23 Nov 20, 2023
304900c
script number change
Shivam-nagar23 Nov 20, 2023
b219714
Merge branch 'main' into feat-rbac-in-jobs
Shivam-nagar23 Nov 20, 2023
ed88602
all jobs handling
Shivam-nagar23 Nov 21, 2023
a8b37ad
workflow by app name
Shivam-nagar23 Nov 21, 2023
ce293f8
Revert "workflow by app name"
Shivam-nagar23 Nov 21, 2023
3f7c992
merge main
Shivam-nagar23 Nov 22, 2023
2ec2881
job create
Shivam-nagar23 Nov 22, 2023
c66557d
rbac
Shivam-nagar23 Nov 22, 2023
14f32b2
cm-checks
Shivam-nagar23 Nov 22, 2023
e388bbf
removing logs
Shivam-nagar23 Nov 22, 2023
d92d292
cm-edit rbac
Shivam-nagar23 Nov 23, 2023
ecdc66f
Merge branch 'main' into feat-rbac-in-jobs
Shivam-nagar23 Nov 23, 2023
8cf9273
empty handling
Shivam-nagar23 Nov 23, 2023
16707d6
Merge branch 'main' into feat-rbac-in-jobs
Shivam-nagar23 Nov 23, 2023
3292ef0
script
Shivam-nagar23 Nov 23, 2023
dd8ed25
comments
Shivam-nagar23 Nov 24, 2023
ec4b42c
error code
Shivam-nagar23 Nov 24, 2023
6377d3f
validations and handling
Shivam-nagar23 Nov 24, 2023
7a7770f
cancel workflow
Shivam-nagar23 Nov 24, 2023
4341c2f
error checks
Shivam-nagar23 Nov 24, 2023
70dab16
rbac
Shivam-nagar23 Nov 24, 2023
61e53d7
Merge branch 'main' into feat-rbac-in-jobs
Shivam-nagar23 Nov 24, 2023
0ef23e2
script number chnage
Shivam-nagar23 Nov 24, 2023
7a14d95
workflow error
Shivam-nagar23 Nov 24, 2023
3e95532
removed un necessary strings.ToLower func
Shivam-nagar23 Nov 27, 2023
9cb3956
refactoring
Shivam-nagar23 Nov 27, 2023
fd8e67a
re arranging constants
Shivam-nagar23 Nov 27, 2023
2ecea42
removed placeholders unnecesssary
Shivam-nagar23 Nov 27, 2023
9ed210d
refactoring
Shivam-nagar23 Nov 27, 2023
28b3b0a
removed comments
Shivam-nagar23 Nov 27, 2023
4e02287
Merge branch 'main' into feat-rbac-in-jobs
Shivam-nagar23 Nov 28, 2023
9ffcc05
refactoring get role by filter method
Shivam-nagar23 Nov 28, 2023
24678ec
Merge branch 'main' into feat-rbac-in-jobs
Shivam-nagar23 Nov 28, 2023
851b258
review comments
Shivam-nagar23 Nov 29, 2023
c88f18b
Merge branch 'main' into feat-rbac-in-jobs
Shivam-nagar23 Nov 29, 2023
a038e64
Merge branch 'main' into chore-enhancements-in-rbac
Shivam-nagar23 Nov 29, 2023
0161f93
Merge branch 'feat-rbac-in-jobs' into chore-enhancements-in-rbac
Shivam-nagar23 Nov 29, 2023
fd49161
bulk operations
Shivam-nagar23 Nov 30, 2023
5ddae6c
refresh rbac
Shivam-nagar23 Nov 30, 2023
b8c295b
wire-gen
Shivam-nagar23 Nov 30, 2023
6b7702f
Merge branch 'main' into feat-rbac-in-jobs
Shivam-nagar23 Nov 30, 2023
b088dbe
Merge branch 'feat-rbac-in-jobs' into chore-enhancements-in-rbac
Shivam-nagar23 Nov 30, 2023
2e4de0b
checks
Shivam-nagar23 Nov 30, 2023
c91c18d
merge main
Shivam-nagar23 Nov 30, 2023
50458ec
app type
Shivam-nagar23 Nov 30, 2023
c334df8
Merge branch 'main' into feat-rbac-in-jobs
Shivam-nagar23 Nov 30, 2023
00cf520
main-merge
Shivam-nagar23 Nov 30, 2023
d2a5f87
Merge branch 'feat-rbac-in-jobs' into chore-enhancements-in-rbac
Shivam-nagar23 Nov 30, 2023
3a655d3
message
Shivam-nagar23 Nov 30, 2023
185137b
Merge branch 'main' into feat-rbac-in-jobs
Shivam-nagar23 Dec 1, 2023
8f6b0ac
bulk delete from casbin
Shivam-nagar23 Dec 1, 2023
3fed9aa
Merge branch 'feat-rbac-in-jobs' into chore-enhancements-in-rbac
Shivam-nagar23 Dec 1, 2023
cf0f264
review comments
Shivam-nagar23 Dec 4, 2023
ab24e25
main-merge
Shivam-nagar23 Dec 6, 2023
6d6d3c1
main
Shivam-nagar23 Dec 6, 2023
3a8b433
refactor get rolegroup metadata
Shivam-nagar23 Dec 6, 2023
8110bfe
Merge branch 'main' into chore-enhancements-in-rbac
Shivam-nagar23 Dec 7, 2023
641b1fe
rbac resource
Shivam-nagar23 Dec 7, 2023
9a93682
Merge branch 'main' into chore-enhancements-in-rbac
Shivam-nagar23 Dec 8, 2023
048b052
removing address of address
Shivam-nagar23 Dec 8, 2023
84b48ad
Merge branch 'main' into chore-enhancements-in-rbac
Shivam-nagar23 Dec 8, 2023
56b54ba
Merge branch 'main' into chore-enhancements-in-rbac
Shivam-nagar23 Dec 11, 2023
9264832
review comments
Shivam-nagar23 Dec 11, 2023
97289dc
review comments
Shivam-nagar23 Dec 11, 2023
f7d1e6f
refactoring
Shivam-nagar23 Dec 11, 2023
2068079
Merge branch 'main' into chore-enhancements-in-rbac
Shivam-nagar23 Dec 13, 2023
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 3 additions & 4 deletions api/apiToken/ApiTokenRestHandler.go
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,6 @@ import (
"gopkg.in/go-playground/validator.v9"
"net/http"
"strconv"
"strings"
)

type ApiTokenRestHandler interface {
Expand Down Expand Up @@ -213,7 +212,7 @@ func (impl ApiTokenRestHandlerImpl) DeleteApiToken(w http.ResponseWriter, r *htt
}

func (handler ApiTokenRestHandlerImpl) checkManagerAuth(resource, token, object string) bool {
if ok := handler.enforcer.Enforce(token, resource, casbin.ActionUpdate, strings.ToLower(object)); !ok {
if ok := handler.enforcer.Enforce(token, resource, casbin.ActionUpdate, object); !ok {
return false
}
return true
Expand Down Expand Up @@ -243,10 +242,10 @@ func (impl ApiTokenRestHandlerImpl) GetAllApiTokensForWebhook(w http.ResponseWri
}

func (handler ApiTokenRestHandlerImpl) CheckAuthorizationForWebhook(token string, projectObject string, envObject string) bool {
if ok := handler.enforcer.Enforce(token, casbin.ResourceApplications, casbin.ActionTrigger, strings.ToLower(projectObject)); !ok {
if ok := handler.enforcer.Enforce(token, casbin.ResourceApplications, casbin.ActionTrigger, projectObject); !ok {
return false
}
if ok := handler.enforcer.Enforce(token, casbin.ResourceEnvironment, casbin.ActionTrigger, strings.ToLower(envObject)); !ok {
if ok := handler.enforcer.Enforce(token, casbin.ResourceEnvironment, casbin.ActionTrigger, envObject); !ok {
return false
}
return true
Expand Down
2 changes: 1 addition & 1 deletion api/appStore/InstalledAppRestHandler.go
Original file line number Diff line number Diff line change
Expand Up @@ -434,7 +434,7 @@ func (impl *InstalledAppRestHandlerImpl) DefaultComponentInstallation(w http.Res
}

// RBAC enforcer applying
if ok := impl.enforcer.Enforce(token, casbin.ResourceCluster, casbin.ActionUpdate, strings.ToLower(cluster.ClusterName)); !ok {
if ok := impl.enforcer.Enforce(token, casbin.ResourceCluster, casbin.ActionUpdate, cluster.ClusterName); !ok {
common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
return
}
Expand Down
13 changes: 6 additions & 7 deletions api/cluster/ClusterRestHandler.go
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,6 @@ import (
"github.com/devtron-labs/devtron/pkg/genericNotes/repository"
"net/http"
"strconv"
"strings"
"time"

"github.com/devtron-labs/devtron/api/restHandler/common"
Expand Down Expand Up @@ -316,7 +315,7 @@ func (impl ClusterRestHandlerImpl) FindAll(w http.ResponseWriter, r *http.Reques
// RBAC enforcer applying
var result []*cluster.ClusterBean
for _, item := range clusterList {
if ok := impl.enforcer.Enforce(token, casbin.ResourceCluster, casbin.ActionGet, strings.ToLower(item.ClusterName)); ok {
if ok := impl.enforcer.Enforce(token, casbin.ResourceCluster, casbin.ActionGet, item.ClusterName); ok {
result = append(result, item)
}
}
Expand All @@ -343,7 +342,7 @@ func (impl ClusterRestHandlerImpl) FindById(w http.ResponseWriter, r *http.Reque

// RBAC enforcer applying
token := r.Header.Get("token")
if ok := impl.enforcer.Enforce(token, casbin.ResourceCluster, casbin.ActionGet, strings.ToLower(bean.ClusterName)); !ok {
if ok := impl.enforcer.Enforce(token, casbin.ResourceCluster, casbin.ActionGet, bean.ClusterName); !ok {
common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
return
}
Expand Down Expand Up @@ -418,7 +417,7 @@ func (impl ClusterRestHandlerImpl) Update(w http.ResponseWriter, r *http.Request
}

// RBAC enforcer applying
if ok := impl.enforcer.Enforce(token, casbin.ResourceCluster, casbin.ActionUpdate, strings.ToLower(bean.ClusterName)); !ok {
if ok := impl.enforcer.Enforce(token, casbin.ResourceCluster, casbin.ActionUpdate, bean.ClusterName); !ok {
common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
return
}
Expand Down Expand Up @@ -479,7 +478,7 @@ func (impl ClusterRestHandlerImpl) UpdateClusterDescription(w http.ResponseWrite
return
}
// RBAC enforcer applying
if ok := impl.enforcer.Enforce(token, casbin.ResourceCluster, casbin.ActionUpdate, strings.ToLower(clusterDescription.ClusterName)); !ok {
if ok := impl.enforcer.Enforce(token, casbin.ResourceCluster, casbin.ActionUpdate, clusterDescription.ClusterName); !ok {
common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
return
}
Expand Down Expand Up @@ -523,7 +522,7 @@ func (impl ClusterRestHandlerImpl) UpdateClusterNote(w http.ResponseWriter, r *h
return
}
// RBAC enforcer applying
if ok := impl.enforcer.Enforce(token, casbin.ResourceCluster, casbin.ActionUpdate, strings.ToLower(clusterDescription.ClusterName)); !ok {
if ok := impl.enforcer.Enforce(token, casbin.ResourceCluster, casbin.ActionUpdate, clusterDescription.ClusterName); !ok {
common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
return
}
Expand Down Expand Up @@ -628,7 +627,7 @@ func (impl ClusterRestHandlerImpl) GetAllClusterNamespaces(w http.ResponseWriter

// RBAC enforcer applying
for clusterName, _ := range clusterNamespaces {
if ok := impl.enforcer.Enforce(token, casbin.ResourceCluster, casbin.ActionGet, strings.ToLower(clusterName)); !ok {
if ok := impl.enforcer.Enforce(token, casbin.ResourceCluster, casbin.ActionGet, clusterName); !ok {
delete(clusterNamespaces, clusterName)
}
}
Expand Down
12 changes: 6 additions & 6 deletions api/cluster/EnvironmentRestHandler.go
Original file line number Diff line number Diff line change
Expand Up @@ -148,7 +148,7 @@ func (impl EnvironmentRestHandlerImpl) Get(w http.ResponseWriter, r *http.Reques

// RBAC enforcer applying
token := r.Header.Get("token")
if ok := impl.enforcer.Enforce(token, casbin.ResourceGlobalEnvironment, casbin.ActionGet, strings.ToLower(bean.EnvironmentIdentifier)); !ok {
if ok := impl.enforcer.Enforce(token, casbin.ResourceGlobalEnvironment, casbin.ActionGet, bean.EnvironmentIdentifier); !ok {
common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
return
}
Expand Down Expand Up @@ -222,7 +222,7 @@ func (impl EnvironmentRestHandlerImpl) GetAllActive(w http.ResponseWriter, r *ht
token := r.Header.Get("token")
for _, item := range bean {
// RBAC enforcer applying
if ok := impl.enforcer.Enforce(token, casbin.ResourceGlobalEnvironment, casbin.ActionGet, strings.ToLower(item.EnvironmentIdentifier)); ok {
if ok := impl.enforcer.Enforce(token, casbin.ResourceGlobalEnvironment, casbin.ActionGet, item.EnvironmentIdentifier); ok {
result = append(result, item)
}
//RBAC enforcer Ends
Expand Down Expand Up @@ -261,7 +261,7 @@ func (impl EnvironmentRestHandlerImpl) Update(w http.ResponseWriter, r *http.Req
common.WriteJsonResp(w, err, nil, http.StatusBadRequest)
return
}
if ok := impl.enforcer.Enforce(token, casbin.ResourceGlobalEnvironment, casbin.ActionUpdate, strings.ToLower(modifiedEnvironment.EnvironmentIdentifier)); !ok {
if ok := impl.enforcer.Enforce(token, casbin.ResourceGlobalEnvironment, casbin.ActionUpdate, modifiedEnvironment.EnvironmentIdentifier); !ok {
common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
return
}
Expand Down Expand Up @@ -292,7 +292,7 @@ func (impl EnvironmentRestHandlerImpl) FindById(w http.ResponseWriter, r *http.R

// RBAC enforcer applying
token := r.Header.Get("token")
if ok := impl.enforcer.Enforce(token, casbin.ResourceGlobalEnvironment, casbin.ActionGet, strings.ToLower(bean.EnvironmentIdentifier)); !ok {
if ok := impl.enforcer.Enforce(token, casbin.ResourceGlobalEnvironment, casbin.ActionGet, bean.EnvironmentIdentifier); !ok {
common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
return
}
Expand Down Expand Up @@ -396,7 +396,7 @@ func (handler EnvironmentRestHandlerImpl) CheckAuthorizationByEmailInBatchForGlo
}

func (handler EnvironmentRestHandlerImpl) CheckAuthorizationForGlobalEnvironment(token string, object string) bool {
if ok := handler.enforcer.Enforce(token, casbin.ResourceGlobalEnvironment, casbin.ActionGet, strings.ToLower(object)); !ok {
if ok := handler.enforcer.Enforce(token, casbin.ResourceGlobalEnvironment, casbin.ActionGet, object); !ok {
return false
}
return true
Expand Down Expand Up @@ -506,7 +506,7 @@ func (impl EnvironmentRestHandlerImpl) GetEnvironmentConnection(w http.ResponseW
}
// RBAC enforcer applying
token := r.Header.Get("token")
if ok := impl.enforcer.Enforce(token, casbin.ResourceGlobalEnvironment, casbin.ActionGet, strings.ToLower(bean.EnvironmentIdentifier)); !ok {
if ok := impl.enforcer.Enforce(token, casbin.ResourceGlobalEnvironment, casbin.ActionGet, bean.EnvironmentIdentifier); !ok {
common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
return
}
Expand Down
2 changes: 1 addition & 1 deletion api/helm-app/HelmAppRestHandler.go
Original file line number Diff line number Diff line change
Expand Up @@ -376,7 +376,7 @@ func (handler *HelmAppRestHandlerImpl) TemplateChart(w http.ResponseWriter, r *h
}

func (handler *HelmAppRestHandlerImpl) checkHelmAuth(token string, object string) bool {
if ok := handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionGet, strings.ToLower(object)); !ok {
if ok := handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionGet, object); !ok {
return false
}
return true
Expand Down
2 changes: 1 addition & 1 deletion api/k8s/application/k8sApplicationRestHandler.go
Original file line number Diff line number Diff line change
Expand Up @@ -868,7 +868,7 @@ func (handler *K8sApplicationRestHandlerImpl) getRbacCallbackForResource(token s

func (handler *K8sApplicationRestHandlerImpl) verifyRbacForResource(token string, clusterName string, resourceIdentifier util3.ResourceIdentifier, casbinAction string) bool {
resourceName, objectName := handler.enforcerUtil.GetRBACNameForClusterEntity(clusterName, resourceIdentifier)
return handler.enforcer.Enforce(token, strings.ToLower(resourceName), casbinAction, strings.ToLower(objectName))
return handler.enforcer.Enforce(token, strings.ToLower(resourceName), casbinAction, objectName)
}

func (handler *K8sApplicationRestHandlerImpl) verifyRbacForCluster(token string, clusterName string, request k8s.ResourceRequestBean, casbinAction string) bool {
Expand Down
4 changes: 2 additions & 2 deletions api/restHandler/BulkUpdateRestHandler.go
Original file line number Diff line number Diff line change
Expand Up @@ -398,10 +398,10 @@ func (handler BulkUpdateRestHandlerImpl) BulkBuildTrigger(w http.ResponseWriter,
}

func (handler BulkUpdateRestHandlerImpl) checkAuthForBulkActions(token string, appObject string, envObject string) bool {
if ok := handler.enforcer.Enforce(token, casbin.ResourceApplications, casbin.ActionUpdate, strings.ToLower(appObject)); !ok {
if ok := handler.enforcer.Enforce(token, casbin.ResourceApplications, casbin.ActionUpdate, appObject); !ok {
return false
}
if ok := handler.enforcer.Enforce(token, casbin.ResourceEnvironment, casbin.ActionUpdate, strings.ToLower(envObject)); !ok {
if ok := handler.enforcer.Enforce(token, casbin.ResourceEnvironment, casbin.ActionUpdate, envObject); !ok {
return false
}
return true
Expand Down
2 changes: 1 addition & 1 deletion api/restHandler/CoreAppRestHandler.go
Original file line number Diff line number Diff line change
Expand Up @@ -292,7 +292,7 @@ func (handler CoreAppRestHandlerImpl) CreateApp(w http.ResponseWriter, r *http.R
return
}
// with admin roles, you have to access for all the apps of the project to create new app. (admin or manager with specific app permission can't create app.)
if ok := handler.enforcer.Enforce(token, casbin.ResourceApplications, casbin.ActionCreate, fmt.Sprintf("%s/%s", strings.ToLower(team.Name), "*")); !ok {
if ok := handler.enforcer.Enforce(token, casbin.ResourceApplications, casbin.ActionCreate, fmt.Sprintf("%s/%s", team.Name, "*")); !ok {
common.WriteJsonResp(w, err, "Unauthorized User", http.StatusForbidden)
return
}
Expand Down
3 changes: 1 addition & 2 deletions api/restHandler/DeploymentGroupRestHandler.go
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,6 @@ import (
"gopkg.in/go-playground/validator.v9"
"net/http"
"strconv"
"strings"
)

type DeploymentGroupRestHandler interface {
Expand Down Expand Up @@ -175,7 +174,7 @@ func (impl *DeploymentGroupRestHandlerImpl) FetchEnvApplicationsForDG(w http.Res
finalResp := make([]*deploymentGroup.EnvironmentAppListForDG, 0)
for _, item := range result {
// RBAC enforcer applying
if ok := impl.enforcer.Enforce(token, casbin.ResourceGlobalEnvironment, casbin.ActionGet, strings.ToLower(item.EnvironmentIdentifier)); ok {
if ok := impl.enforcer.Enforce(token, casbin.ResourceGlobalEnvironment, casbin.ActionGet, item.EnvironmentIdentifier); ok {
passCount := 0
for _, app := range item.Apps {
resourceName := impl.enforcerUtil.GetAppRBACNameByAppId(app.Id)
Expand Down
16 changes: 8 additions & 8 deletions api/restHandler/DockerRegRestHandler.go
Original file line number Diff line number Diff line change
Expand Up @@ -324,7 +324,7 @@ func (impl DockerRegRestHandlerImpl) GetDockerArtifactStore(w http.ResponseWrite
token := r.Header.Get("token")
var result []types.DockerArtifactStoreBean
for _, item := range res {
if ok := impl.enforcer.Enforce(token, casbin.ResourceDocker, casbin.ActionGet, strings.ToLower(item.Id)); ok {
if ok := impl.enforcer.Enforce(token, casbin.ResourceDocker, casbin.ActionGet, item.Id); ok {
result = append(result, item)
}
}
Expand All @@ -345,7 +345,7 @@ func (impl DockerRegRestHandlerImpl) FetchAllDockerAccounts(w http.ResponseWrite
token := r.Header.Get("token")
var result []types.DockerArtifactStoreBean
for _, item := range res {
if ok := impl.enforcer.Enforce(token, casbin.ResourceDocker, casbin.ActionGet, strings.ToLower(item.Id)); ok {
if ok := impl.enforcer.Enforce(token, casbin.ResourceDocker, casbin.ActionGet, item.Id); ok {
item.DisabledFields = make([]types.DisabledFields, 0)
if !item.IsPublic {
if isEditable := impl.deleteService.CanDeleteChartRegistryPullConfig(item.Id); !(isEditable || item.IsPublic) {
Expand All @@ -371,7 +371,7 @@ func (impl DockerRegRestHandlerExtendedImpl) FetchAllDockerAccounts(w http.Respo
token := r.Header.Get("token")
var result []types.DockerArtifactStoreBean
for _, item := range res {
if ok := impl.enforcer.Enforce(token, casbin.ResourceDocker, casbin.ActionGet, strings.ToLower(item.Id)); ok {
if ok := impl.enforcer.Enforce(token, casbin.ResourceDocker, casbin.ActionGet, item.Id); ok {
item.DisabledFields = make([]types.DisabledFields, 0)
if !item.IsPublic {
if isContainerEditable := impl.deleteServiceFullMode.CanDeleteContainerRegistryConfig(item.Id); !(isContainerEditable || item.IsPublic) {
Expand Down Expand Up @@ -406,7 +406,7 @@ func (impl DockerRegRestHandlerImpl) FetchOneDockerAccounts(w http.ResponseWrite

// RBAC enforcer applying
token := r.Header.Get("token")
if ok := impl.enforcer.Enforce(token, casbin.ResourceDocker, casbin.ActionGet, strings.ToLower(res.Id)); !ok {
if ok := impl.enforcer.Enforce(token, casbin.ResourceDocker, casbin.ActionGet, res.Id); !ok {
common.WriteJsonResp(w, err, "Unauthorized User", http.StatusForbidden)
return
}
Expand Down Expand Up @@ -436,7 +436,7 @@ func (impl DockerRegRestHandlerExtendedImpl) FetchOneDockerAccounts(w http.Respo

// RBAC enforcer applying
token := r.Header.Get("token")
if ok := impl.enforcer.Enforce(token, casbin.ResourceDocker, casbin.ActionGet, strings.ToLower(res.Id)); !ok {
if ok := impl.enforcer.Enforce(token, casbin.ResourceDocker, casbin.ActionGet, res.Id); !ok {
common.WriteJsonResp(w, err, "Unauthorized User", http.StatusForbidden)
return
}
Expand Down Expand Up @@ -477,7 +477,7 @@ func (impl DockerRegRestHandlerImpl) UpdateDockerRegistryConfig(w http.ResponseW

// RBAC enforcer applying
token := r.Header.Get("token")
if ok := impl.enforcer.Enforce(token, casbin.ResourceDocker, casbin.ActionUpdate, strings.ToLower(bean.Id)); !ok {
if ok := impl.enforcer.Enforce(token, casbin.ResourceDocker, casbin.ActionUpdate, bean.Id); !ok {
common.WriteJsonResp(w, err, "Unauthorized User", http.StatusForbidden)
return
}
Expand Down Expand Up @@ -578,7 +578,7 @@ func (impl DockerRegRestHandlerImpl) DeleteDockerRegistryConfig(w http.ResponseW

// RBAC enforcer applying
token := r.Header.Get("token")
if ok := impl.enforcer.Enforce(token, casbin.ResourceDocker, casbin.ActionCreate, strings.ToLower(bean.Id)); !ok {
if ok := impl.enforcer.Enforce(token, casbin.ResourceDocker, casbin.ActionCreate, bean.Id); !ok {
common.WriteJsonResp(w, err, "Unauthorized User", http.StatusForbidden)
return
}
Expand Down Expand Up @@ -617,7 +617,7 @@ func (impl DockerRegRestHandlerExtendedImpl) DeleteDockerRegistryConfig(w http.R

// RBAC enforcer applying
token := r.Header.Get("token")
if ok := impl.enforcer.Enforce(token, casbin.ResourceDocker, casbin.ActionCreate, strings.ToLower(bean.Id)); !ok {
if ok := impl.enforcer.Enforce(token, casbin.ResourceDocker, casbin.ActionCreate, bean.Id); !ok {
common.WriteJsonResp(w, err, "Unauthorized User", http.StatusForbidden)
return
}
Expand Down
5 changes: 2 additions & 3 deletions api/restHandler/ExternalCiRestHandler.go
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,6 @@ import (
"gopkg.in/go-playground/validator.v9"
"net/http"
"strconv"
"strings"
)

type ExternalCiRestHandler interface {
Expand Down Expand Up @@ -110,10 +109,10 @@ func (impl ExternalCiRestHandlerImpl) HandleExternalCiWebhook(w http.ResponseWri
}

func (impl ExternalCiRestHandlerImpl) checkExternalCiDeploymentAuth(email string, projectObject string, envObject string) bool {
if ok := impl.enforcer.EnforceByEmail(strings.ToLower(email), casbin.ResourceApplications, casbin.ActionTrigger, strings.ToLower(projectObject)); !ok {
if ok := impl.enforcer.EnforceByEmail(email, casbin.ResourceApplications, casbin.ActionTrigger, projectObject); !ok {
return false
}
if ok := impl.enforcer.EnforceByEmail(strings.ToLower(email), casbin.ResourceEnvironment, casbin.ActionTrigger, strings.ToLower(envObject)); !ok {
if ok := impl.enforcer.EnforceByEmail(email, casbin.ResourceEnvironment, casbin.ActionTrigger, envObject); !ok {
return false
}
return true
Expand Down
5 changes: 2 additions & 3 deletions api/restHandler/GitHostRestHandler.go
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,6 @@ import (
"gopkg.in/go-playground/validator.v9"
"net/http"
"strconv"
"strings"
)

type GitHostRestHandler interface {
Expand Down Expand Up @@ -87,7 +86,7 @@ func (impl GitHostRestHandlerImpl) GetGitHosts(w http.ResponseWriter, r *http.Re
token := r.Header.Get("token")
result := make([]types.GitHostRequest, 0)
for _, item := range res {
if ok := impl.enforcer.Enforce(token, casbin.ResourceGit, casbin.ActionGet, strings.ToLower(item.Name)); ok {
if ok := impl.enforcer.Enforce(token, casbin.ResourceGit, casbin.ActionGet, item.Name); ok {
result = append(result, item)
}
}
Expand Down Expand Up @@ -156,7 +155,7 @@ func (impl GitHostRestHandlerImpl) CreateGitHost(w http.ResponseWriter, r *http.

// RBAC enforcer applying
token := r.Header.Get("token")
if ok := impl.enforcer.Enforce(token, casbin.ResourceGit, casbin.ActionCreate, strings.ToLower(bean.Name)); !ok {
if ok := impl.enforcer.Enforce(token, casbin.ResourceGit, casbin.ActionCreate, bean.Name); !ok {
common.WriteJsonResp(w, err, "Unauthorized User", http.StatusForbidden)
return
}
Expand Down
11 changes: 5 additions & 6 deletions api/restHandler/GitProviderRestHandler.go
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,6 @@ import (
"go.uber.org/zap"
"gopkg.in/go-playground/validator.v9"
"net/http"
"strings"
)

const GIT_ACCOUNT_DELETE_SUCCESS_RESP = "Git account deleted successfully."
Expand Down Expand Up @@ -100,7 +99,7 @@ func (impl GitProviderRestHandlerImpl) SaveGitRepoConfig(w http.ResponseWriter,

// RBAC enforcer applying
token := r.Header.Get("token")
if ok := impl.enforcer.Enforce(token, casbin.ResourceGit, casbin.ActionCreate, strings.ToLower(bean.Name)); !ok {
if ok := impl.enforcer.Enforce(token, casbin.ResourceGit, casbin.ActionCreate, bean.Name); !ok {
common.WriteJsonResp(w, err, "Unauthorized User", http.StatusForbidden)
return
}
Expand Down Expand Up @@ -138,7 +137,7 @@ func (impl GitProviderRestHandlerImpl) FetchAllGitProviders(w http.ResponseWrite
token := r.Header.Get("token")
result := make([]types.GitRegistry, 0)
for _, item := range res {
if ok := impl.enforcer.Enforce(token, casbin.ResourceGit, casbin.ActionGet, strings.ToLower(item.Name)); ok {
if ok := impl.enforcer.Enforce(token, casbin.ResourceGit, casbin.ActionGet, item.Name); ok {
result = append(result, item)
}
}
Expand All @@ -159,7 +158,7 @@ func (impl GitProviderRestHandlerImpl) FetchOneGitProviders(w http.ResponseWrite

// RBAC enforcer applying
token := r.Header.Get("token")
if ok := impl.enforcer.Enforce(token, casbin.ResourceGit, casbin.ActionGet, strings.ToLower(res.Name)); !ok {
if ok := impl.enforcer.Enforce(token, casbin.ResourceGit, casbin.ActionGet, res.Name); !ok {
common.WriteJsonResp(w, err, "Unauthorized User", http.StatusForbidden)
return
}
Expand Down Expand Up @@ -192,7 +191,7 @@ func (impl GitProviderRestHandlerImpl) UpdateGitRepoConfig(w http.ResponseWriter
}
// RBAC enforcer applying
token := r.Header.Get("token")
if ok := impl.enforcer.Enforce(token, casbin.ResourceGit, casbin.ActionUpdate, strings.ToLower(bean.Name)); !ok {
if ok := impl.enforcer.Enforce(token, casbin.ResourceGit, casbin.ActionUpdate, bean.Name); !ok {
common.WriteJsonResp(w, err, "Unauthorized User", http.StatusForbidden)
return
}
Expand Down Expand Up @@ -231,7 +230,7 @@ func (impl GitProviderRestHandlerImpl) DeleteGitRepoConfig(w http.ResponseWriter
}
// RBAC enforcer applying
token := r.Header.Get("token")
if ok := impl.enforcer.Enforce(token, casbin.ResourceGit, casbin.ActionCreate, strings.ToLower(bean.Name)); !ok {
if ok := impl.enforcer.Enforce(token, casbin.ResourceGit, casbin.ActionCreate, bean.Name); !ok {
common.WriteJsonResp(w, err, "Unauthorized User", http.StatusForbidden)
return
}
Expand Down
Loading