Skip to content

Commit 393884c

Browse files
jiparisjiparis
authored
fix(rbac): inherit group roles in referrer and casredirect services (#2242)
Signed-off-by: Jose I. Paris <[email protected]>
1 parent 176b703 commit 393884c

File tree

9 files changed

+36
-50
lines changed

9 files changed

+36
-50
lines changed

‎app/controlplane/cmd/wire_gen.go‎

Lines changed: 3 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎app/controlplane/pkg/biz/casmapping.go‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -52,14 +52,13 @@ type CASMappingRepo interface {
5252
}
5353

5454
type CASMappingUseCase struct {
55-
repo CASMappingRepo
56-
membershipRepo MembershipRepo
57-
projectsRepo ProjectsRepo
58-
logger *log.Helper
55+
repo CASMappingRepo
56+
membershipUC *MembershipUseCase
57+
logger *log.Helper
5958
}
6059

61-
func NewCASMappingUseCase(repo CASMappingRepo, mRepo MembershipRepo, pRepo ProjectsRepo, logger log.Logger) *CASMappingUseCase {
62-
return &CASMappingUseCase{repo, mRepo, pRepo, servicelogger.ScopedHelper(logger, "cas-mapping-usecase")}
60+
func NewCASMappingUseCase(repo CASMappingRepo, membershipUC *MembershipUseCase, logger log.Logger) *CASMappingUseCase {
61+
return &CASMappingUseCase{repo, membershipUC, servicelogger.ScopedHelper(logger, "cas-mapping-usecase")}
6362
}
6463

6564
type CASMappingCreateOpts struct {
@@ -99,7 +98,7 @@ func (uc *CASMappingUseCase) FindCASMappingForDownloadByUser(ctx context.Context
9998
return nil, NewErrInvalidUUID(err)
10099
}
101100

102-
userOrgs, projectIDs, err := getOrgsAndRBACInfoForUser(ctx, userUUID, uc.membershipRepo, uc.projectsRepo)
101+
userOrgs, projectIDs, err := uc.membershipUC.GetOrgsAndRBACInfoForUser(ctx, userUUID)
103102
if err != nil {
104103
return nil, err
105104
}

‎app/controlplane/pkg/biz/casmapping_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -162,7 +162,7 @@ type casMappingSuite struct {
162162

163163
func (s *casMappingSuite) SetupTest() {
164164
s.repo = repoM.NewCASMappingRepo(s.T())
165-
s.useCase = biz.NewCASMappingUseCase(s.repo, nil, nil, nil)
165+
s.useCase = biz.NewCASMappingUseCase(s.repo, nil, nil)
166166
}
167167

168168
func TestCASMapping(t *testing.T) {

‎app/controlplane/pkg/biz/membership.go‎

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -361,9 +361,9 @@ func (uc *MembershipUseCase) SetProjectOwner(ctx context.Context, orgID, project
361361
return nil
362362
}
363363

364-
func getOrgsAndRBACInfoForUser(ctx context.Context, userID uuid.UUID, mRepo MembershipRepo, pRepo ProjectsRepo) ([]uuid.UUID, map[uuid.UUID][]uuid.UUID, error) {
364+
func (uc *MembershipUseCase) GetOrgsAndRBACInfoForUser(ctx context.Context, userID uuid.UUID) ([]uuid.UUID, map[uuid.UUID][]uuid.UUID, error) {
365365
// Load ALL memberships for the given user
366-
memberships, err := mRepo.ListAllByUser(ctx, userID)
366+
memberships, err := uc.ListAllMembershipsForUser(ctx, userID)
367367
if err != nil {
368368
return nil, nil, fmt.Errorf("failed to list memberships: %w", err)
369369
}
@@ -376,13 +376,9 @@ func getOrgsAndRBACInfoForUser(ctx context.Context, userID uuid.UUID, mRepo Memb
376376
userOrgs = append(userOrgs, m.ResourceID)
377377
// If the role in the org is member, we must enable RBAC for projects.
378378
if m.Role == authz.RoleOrgMember {
379-
// get list of projects in org, and match it with the memberships to build a filter
380-
orgProjects, err := getProjectsWithMembership(ctx, pRepo, m.ResourceID, memberships)
381-
if err != nil {
382-
return nil, nil, err
383-
}
379+
// get the list of projects in org, and match it with the memberships to build a filter.
384380
// note that appending an empty slice to a nil slice doesn't change it (it's still nil)
385-
projectIDs[m.ResourceID] = orgProjects
381+
projectIDs[m.ResourceID] = getProjectsWithMembershipInOrg(m.ResourceID, memberships)
386382
}
387383
}
388384
}

‎app/controlplane/pkg/biz/project.go‎

Lines changed: 5 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@ package biz
1818
import (
1919
"context"
2020
"fmt"
21-
"slices"
2221
"time"
2322

2423
"github.com/chainloop-dev/chainloop/app/controlplane/pkg/auditor/events"
@@ -649,21 +648,15 @@ func (uc *ProjectUseCase) verifyRequesterHasPermissions(ctx context.Context, org
649648
}
650649

651650
// getProjectsWithMembership returns the list of project IDs in the org for which the user has a membership
652-
func getProjectsWithMembership(ctx context.Context, projectsRepo ProjectsRepo, orgID uuid.UUID, memberships []*Membership) ([]uuid.UUID, error) {
651+
func getProjectsWithMembershipInOrg(orgID uuid.UUID, memberships []*Membership) []uuid.UUID {
653652
ids := make([]uuid.UUID, 0)
654-
projects, err := projectsRepo.ListProjectsByOrgID(ctx, orgID)
655-
if err != nil {
656-
return nil, fmt.Errorf("listing projects: %w", err)
657-
}
658-
for _, p := range projects {
659-
if slices.ContainsFunc(memberships, func(m *Membership) bool {
660-
return m.ResourceType == authz.ResourceTypeProject && m.ResourceID == p.ID
661-
}) {
662-
ids = append(ids, p.ID)
653+
for _, m := range memberships {
654+
if m.ResourceType == authz.ResourceTypeProject && m.OrganizationID == orgID {
655+
ids = append(ids, m.ResourceID)
663656
}
664657
}
665658

666-
return ids, nil
659+
return ids
667660
}
668661

669662
// UpdateMemberRole updates the role of a user or group in a project.

‎app/controlplane/pkg/biz/referrer.go‎

Lines changed: 12 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -35,15 +35,14 @@ import (
3535
)
3636

3737
type ReferrerUseCase struct {
38-
repo ReferrerRepo
39-
membershipRepo MembershipRepo
40-
workflowRepo WorkflowRepo
41-
projectsRepo ProjectsRepo
42-
logger *log.Helper
43-
indexConfig *conf.ReferrerSharedIndex
38+
repo ReferrerRepo
39+
membershipUseCase *MembershipUseCase
40+
workflowRepo WorkflowRepo
41+
logger *log.Helper
42+
indexConfig *conf.ReferrerSharedIndex
4443
}
4544

46-
func NewReferrerUseCase(repo ReferrerRepo, wfRepo WorkflowRepo, mRepo MembershipRepo, projectsRepo ProjectsRepo, indexCfg *conf.ReferrerSharedIndex, l log.Logger) (*ReferrerUseCase, error) {
45+
func NewReferrerUseCase(repo ReferrerRepo, wfRepo WorkflowRepo, membershipUseCase *MembershipUseCase, indexCfg *conf.ReferrerSharedIndex, l log.Logger) (*ReferrerUseCase, error) {
4746
if l == nil {
4847
l = log.NewStdLogger(io.Discard)
4948
}
@@ -60,12 +59,11 @@ func NewReferrerUseCase(repo ReferrerRepo, wfRepo WorkflowRepo, mRepo Membership
6059
}
6160

6261
return &ReferrerUseCase{
63-
repo: repo,
64-
membershipRepo: mRepo,
65-
indexConfig: indexCfg,
66-
workflowRepo: wfRepo,
67-
projectsRepo: projectsRepo,
68-
logger: logger,
62+
repo: repo,
63+
membershipUseCase: membershipUseCase,
64+
indexConfig: indexCfg,
65+
workflowRepo: wfRepo,
66+
logger: logger,
6967
}, nil
7068
}
7169

@@ -172,7 +170,7 @@ func (s *ReferrerUseCase) GetFromRootUser(ctx context.Context, digest, rootKind,
172170
return nil, NewErrInvalidUUID(err)
173171
}
174172

175-
userOrgs, projectIDs, err := getOrgsAndRBACInfoForUser(ctx, userUUID, s.membershipRepo, s.projectsRepo)
173+
userOrgs, projectIDs, err := s.membershipUseCase.GetOrgsAndRBACInfoForUser(ctx, userUUID)
176174
if err != nil {
177175
return nil, err
178176
}

‎app/controlplane/pkg/biz/referrer_integration_test.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,7 @@ func (s *referrerIntegrationTestSuite) TestGetFromRootInPublicSharedIndex() {
8787
})
8888

8989
s.T().Run("it should appear if we whitelist org2", func(t *testing.T) {
90-
uc, err := biz.NewReferrerUseCase(s.Repos.Referrer, s.Repos.Workflow, s.Repos.Membership, nil,
90+
uc, err := biz.NewReferrerUseCase(s.Repos.Referrer, s.Repos.Workflow, s.Membership,
9191
&conf.ReferrerSharedIndex{
9292
Enabled: true,
9393
AllowedOrgs: []string{s.org2.ID},
@@ -463,7 +463,7 @@ func (s *referrerIntegrationTestSuite) SetupTest() {
463463
_, err = s.Membership.Create(ctx, s.org2.ID, s.user2.ID, biz.WithCurrentMembership())
464464
require.NoError(s.T(), err)
465465

466-
s.sharedEnabledUC, err = biz.NewReferrerUseCase(s.Repos.Referrer, s.Repos.Workflow, s.Repos.Membership, nil,
466+
s.sharedEnabledUC, err = biz.NewReferrerUseCase(s.Repos.Referrer, s.Repos.Workflow, s.Membership,
467467
&conf.ReferrerSharedIndex{
468468
Enabled: true,
469469
AllowedOrgs: []string{s.org1.ID},

‎app/controlplane/pkg/biz/referrer_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ func (s *referrerTestSuite) TestInitialization() {
7070

7171
for _, tc := range testCases {
7272
s.T().Run(tc.name, func(t *testing.T) {
73-
_, err := NewReferrerUseCase(nil, nil, nil, nil, tc.conf, nil)
73+
_, err := NewReferrerUseCase(nil, nil, nil, tc.conf, nil)
7474
if tc.wantErrMsg != "" {
7575
assert.EqualError(t, err, tc.wantErrMsg)
7676
} else {

‎app/controlplane/pkg/biz/testhelpers/wire_gen.go‎

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)