feat(rbac): allow role inheritance and additional roles (#2281)

Signed-off-by: Jose I. Paris <[email protected]>

Author: jiparis

app/controlplane/pkg/authz/authz.go

@@ -90,6 +90,11 @@ const (
 
 	// RoleGroupMaintainer is a role that can manage groups in an organization.
 	RoleGroupMaintainer Role = "role:group:maintainer"
+
+	// Product roles
+
+	RoleProductViewer Role = "role:product:viewer"
+	RoleProductAdmin  Role = "role:product:admin"
 )
 
 // ManagedResources are the resources that are managed by Chainloop, considered during permissions sync
@@ -443,6 +448,8 @@ func (Role) Values() (roles []string) {
 		RoleProjectAdmin,
 		RoleProjectViewer,
 		RoleGroupMaintainer,
+		RoleProductAdmin,
+		RoleProductViewer,
 	} {
 		roles = append(roles, string(s))
 	}

app/controlplane/pkg/authz/membership.go

@@ -27,6 +27,7 @@ const (
 
 	ResourceTypeOrganization ResourceType = "organization"
 	ResourceTypeProject      ResourceType = "project"
+	ResourceTypeProduct      ResourceType = "product"
 	ResourceTypeGroup        ResourceType = "group"
 )
 
@@ -46,6 +47,7 @@ func (ResourceType) Values() (values []string) {
 		string(ResourceTypeOrganization),
 		string(ResourceTypeProject),
 		string(ResourceTypeGroup),
+		string(ResourceTypeProduct),
 	)
 
 	return

app/controlplane/pkg/biz/membership.go

@@ -40,6 +40,7 @@ type Membership struct {
 	MemberID       uuid.UUID
 	ResourceType   authz.ResourceType
 	ResourceID     uuid.UUID
+	ParentID       *uuid.UUID
 }
 
 // ListByOrgOpts are the options to filter memberships of an organization
@@ -74,7 +75,7 @@ type MembershipRepo interface {
 	// ListGroupMembershipsByUser returns all memberships of the users inherited from groups
 	ListGroupMembershipsByUser(ctx context.Context, userID uuid.UUID) ([]*Membership, error)
 	ListAllByResource(ctx context.Context, rt authz.ResourceType, id uuid.UUID) ([]*Membership, error)
-	AddResourceRole(ctx context.Context, orgID uuid.UUID, resourceType authz.ResourceType, resID uuid.UUID, mType authz.MembershipType, memberID uuid.UUID, role authz.Role) error
+	AddResourceRole(ctx context.Context, orgID uuid.UUID, resourceType authz.ResourceType, resID uuid.UUID, mType authz.MembershipType, memberID uuid.UUID, role authz.Role, parentID *uuid.UUID) error
 }
 
 type MembershipsRBAC interface {
@@ -409,7 +410,7 @@ func (uc *MembershipUseCase) SetProjectOwner(ctx context.Context, orgID, project
 		}
 	}
 
-	if err = uc.repo.AddResourceRole(ctx, orgID, authz.ResourceTypeProject, projectID, authz.MembershipTypeUser, userID, authz.RoleProjectAdmin); err != nil {
+	if err = uc.repo.AddResourceRole(ctx, orgID, authz.ResourceTypeProject, projectID, authz.MembershipTypeUser, userID, authz.RoleProjectAdmin, nil); err != nil {
 		return fmt.Errorf("failed to set project owner: %w", err)
 	}