Skip to content

Commit 3d41b12

Browse files
snehith57624snehith57624
authored
Task/access control (#1758)
* updating rbac checks * Update RBAC checks * Adding CD pipeline check * Adding RBAC for trigger * updating as per PR comments * adding logs * merge conflicts * update rbac checks * update rbac checks * update rbac checks * update rbac checks * changes as per PR comments * changes as per PR comments * changes as per PR comments * update as per PR comments * update as per PR comments
1 parent d85f633 commit 3d41b12

File tree

6 files changed

+128
-1
lines changed

6 files changed

+128
-1
lines changed

‎api/restHandler/app/BuildPipelineRestHandler.go‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -172,6 +172,26 @@ func (handler PipelineConfigRestHandlerImpl) PatchCiPipelines(w http.ResponseWri
172172
common.WriteJsonResp(w, fmt.Errorf("unauthorized user"), "Unauthorized User", http.StatusForbidden)
173173
return
174174
}
175+
176+
pipelineData, err := handler.pipelineRepository.FindActiveByAppIdAndPipelineId(patchRequest.AppId, patchRequest.CiPipeline.Id)
177+
if err != nil {
178+
common.WriteJsonResp(w, err, nil, http.StatusInternalServerError)
179+
return
180+
}
181+
var environmentIds []int
182+
for _, pipeline := range pipelineData {
183+
environmentIds = append(environmentIds, pipeline.EnvironmentId)
184+
}
185+
if handler.appWorkflowService.CheckCdPipelineByCiPipelineId(patchRequest.CiPipeline.Id) {
186+
for _, envId := range environmentIds {
187+
envObject := handler.enforcerUtil.GetEnvRBACNameByCiPipelineIdAndEnvId(patchRequest.CiPipeline.Id, envId)
188+
if ok := handler.enforcer.Enforce(token, casbin.ResourceEnvironment, casbin.ActionUpdate, envObject); !ok {
189+
common.WriteJsonResp(w, fmt.Errorf("unauthorized user"), "Unauthorized User", http.StatusForbidden)
190+
return
191+
}
192+
}
193+
}
194+
175195
createResp, err := handler.pipelineBuilder.PatchCiPipeline(&patchRequest)
176196
if err != nil {
177197
handler.Logger.Errorw("service err, PatchCiPipelines", "err", err, "PatchCiPipelines", patchRequest)
@@ -659,7 +679,9 @@ func (handler PipelineConfigRestHandlerImpl) GetCIPipelineById(w http.ResponseWr
659679
common.WriteJsonResp(w, err, nil, http.StatusBadRequest)
660680
return
661681
}
682+
662683
handler.Logger.Infow("request payload, GetCIPipelineById", "err", err, "appId", appId, "pipelineId", pipelineId)
684+
663685
app, err := handler.pipelineBuilder.GetApp(appId)
664686
if err != nil {
665687
handler.Logger.Infow("service error, GetCIPipelineById", "err", err, "appId", appId, "pipelineId", pipelineId)
@@ -671,6 +693,26 @@ func (handler PipelineConfigRestHandlerImpl) GetCIPipelineById(w http.ResponseWr
671693
common.WriteJsonResp(w, fmt.Errorf("unauthorized user"), "Unauthorized User", http.StatusForbidden)
672694
return
673695
}
696+
697+
pipelineData, err := handler.pipelineRepository.FindActiveByAppIdAndPipelineId(appId, pipelineId)
698+
if err != nil {
699+
common.WriteJsonResp(w, err, nil, http.StatusInternalServerError)
700+
return
701+
}
702+
var environmentIds []int
703+
for _, pipeline := range pipelineData {
704+
environmentIds = append(environmentIds, pipeline.EnvironmentId)
705+
}
706+
if handler.appWorkflowService.CheckCdPipelineByCiPipelineId(pipelineId) {
707+
for _, envId := range environmentIds {
708+
envObject := handler.enforcerUtil.GetEnvRBACNameByCiPipelineIdAndEnvId(pipelineId, envId)
709+
if ok := handler.enforcer.Enforce(token, casbin.ResourceEnvironment, casbin.ActionUpdate, envObject); !ok {
710+
common.WriteJsonResp(w, fmt.Errorf("unauthorized user"), "Unauthorized User", http.StatusForbidden)
711+
return
712+
}
713+
}
714+
}
715+
674716
ciPipeline, err := handler.pipelineBuilder.GetCiPipelineById(pipelineId)
675717
if err != nil {
676718
handler.Logger.Infow("service error, GetCIPipelineById", "err", err, "appId", appId, "pipelineId", pipelineId)
@@ -898,6 +940,27 @@ func (handler PipelineConfigRestHandlerImpl) CancelWorkflow(w http.ResponseWrite
898940
common.WriteJsonResp(w, err, "Unauthorized User", http.StatusForbidden)
899941
return
900942
}
943+
if handler.appWorkflowService.CheckCdPipelineByCiPipelineId(pipelineId) {
944+
pipelineData, err := handler.pipelineRepository.FindActiveByAppIdAndPipelineId(ciPipeline.AppId, pipelineId)
945+
if err != nil {
946+
common.WriteJsonResp(w, err, nil, http.StatusInternalServerError)
947+
return
948+
}
949+
var environmentIds []int
950+
for _, pipeline := range pipelineData {
951+
environmentIds = append(environmentIds, pipeline.EnvironmentId)
952+
}
953+
if handler.appWorkflowService.CheckCdPipelineByCiPipelineId(pipelineId) {
954+
for _, envId := range environmentIds {
955+
envObject := handler.enforcerUtil.GetEnvRBACNameByCiPipelineIdAndEnvId(pipelineId, envId)
956+
if ok := handler.enforcer.Enforce(token, casbin.ResourceEnvironment, casbin.ActionUpdate, envObject); !ok {
957+
common.WriteJsonResp(w, fmt.Errorf("unauthorized user"), "Unauthorized User", http.StatusForbidden)
958+
return
959+
}
960+
}
961+
}
962+
}
963+
901964
//RBAC
902965

903966
resp, err := handler.ciHandler.CancelBuild(workflowId)

‎api/restHandler/app/DeploymentPipelineRestHandler.go‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1472,6 +1472,19 @@ func (handler PipelineConfigRestHandlerImpl) GetCdPipelineById(w http.ResponseWr
14721472
common.WriteJsonResp(w, fmt.Errorf("unauthorized user"), "Unauthorized User", http.StatusForbidden)
14731473
return
14741474
}
1475+
1476+
envId, err := handler.pipelineBuilder.GetEnvironmentByCdPipelineId(pipelineId)
1477+
if err != nil {
1478+
common.WriteJsonResp(w, err, nil, http.StatusBadRequest)
1479+
return
1480+
}
1481+
1482+
envObject := handler.enforcerUtil.GetEnvRBACNameByCdPipelineIdAndEnvId(pipelineId, envId)
1483+
if ok := handler.enforcer.Enforce(token, casbin.ResourceEnvironment, casbin.ActionUpdate, envObject); !ok {
1484+
common.WriteJsonResp(w, fmt.Errorf("unauthorized user"), "Unauthorized User", http.StatusForbidden)
1485+
return
1486+
}
1487+
14751488
ciConf, err := handler.pipelineBuilder.GetCdPipelineById(pipelineId)
14761489
if err != nil {
14771490
handler.Logger.Errorw("service err, GetCdPipelineById", "err", err, "appId", appId, "pipelineId", pipelineId)

‎internal/sql/repository/pipelineConfig/PipelineRepository.go‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,7 @@ type PipelineRepository interface {
8989
FindActiveByEnvId(envId int) (pipelines []*Pipeline, err error)
9090
FindAllPipelinesByChartsOverrideAndAppIdAndChartId(chartOverridden bool, appId int, chartId int) (pipelines []*Pipeline, err error)
9191
Exists() (exist bool, err error)
92+
FindActiveByAppIdAndPipelineId(appId int, pipelineId int) ([]*Pipeline, error)
9293
UpdateCdPipeline(pipeline *Pipeline) error
9394
}
9495

@@ -371,6 +372,17 @@ func (impl PipelineRepositoryImpl) Exists() (exist bool, err error) {
371372
exist, err = impl.dbConnection.Model(&pipelines).Exists()
372373
return exist, err
373374
}
375+
376+
func (impl PipelineRepositoryImpl) FindActiveByAppIdAndPipelineId(appId int, pipelineId int) ([]*Pipeline, error) {
377+
var pipelines []*Pipeline
378+
err := impl.dbConnection.Model(&pipelines).
379+
Where("app_id = ?", appId).
380+
Where("ci_pipeline_id = ?", pipelineId).
381+
Where("deleted = ?", false).
382+
Select()
383+
return pipelines, err
384+
}
385+
374386
func (impl PipelineRepositoryImpl) UpdateCdPipeline(pipeline *Pipeline) error {
375387
err := impl.dbConnection.Update(pipeline)
376388
return err

‎pkg/appWorkflow/AppWorkflowService.go‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ type AppWorkflowService interface {
3838
SaveAppWorkflowMapping(wf AppWorkflowMappingDto) (AppWorkflowMappingDto, error)
3939
FindAppWorkflowMapping(workflowId int) ([]AppWorkflowMappingDto, error)
4040
FindAppWorkflowMappingByComponent(id int, compType string) ([]*appWorkflow.AppWorkflowMapping, error)
41+
CheckCdPipelineByCiPipelineId(id int) bool
4142
FindAppWorkflowByName(name string, appId int) (AppWorkflowDto, error)
4243
}
4344

@@ -285,3 +286,12 @@ func (impl AppWorkflowServiceImpl) FindAppWorkflowByName(name string, appId int)
285286
}
286287
return *appWorkflowDto, err
287288
}
289+
290+
func (impl AppWorkflowServiceImpl) CheckCdPipelineByCiPipelineId(id int) bool {
291+
appWorkflowMapping, err := impl.appWorkflowRepository.FindWFCDMappingByCIPipelineId(id)
292+
293+
if err == nil && appWorkflowMapping != nil {
294+
return true
295+
}
296+
return false
297+
}

‎pkg/pipeline/PipelineBuilder.go‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,7 @@ type PipelineBuilder interface {
101101

102102
GetMaterialsForAppId(appId int) []*bean.GitMaterial
103103
FindAllMatchesByAppName(appName string) ([]*AppBean, error)
104+
GetEnvironmentByCdPipelineId(pipelineId int) (int, error)
104105
}
105106

106107
type PipelineBuilderImpl struct {
@@ -2019,6 +2020,15 @@ type PipelineStrategy struct {
20192020
Default bool `json:"default"`
20202021
}
20212022

2023+
func (impl PipelineBuilderImpl) GetEnvironmentByCdPipelineId(pipelineId int) (int, error) {
2024+
dbPipeline, err := impl.pipelineRepository.FindById(pipelineId)
2025+
if err != nil || dbPipeline == nil {
2026+
impl.logger.Errorw("error in fetching pipeline", "err", err)
2027+
return 0, err
2028+
}
2029+
return dbPipeline.EnvironmentId, err
2030+
}
2031+
20222032
func (impl PipelineBuilderImpl) GetCdPipelineById(pipelineId int) (cdPipeline *bean.CDPipelineConfigObject, err error) {
20232033
dbPipeline, err := impl.pipelineRepository.FindById(pipelineId)
20242034
if err != nil && errors.IsNotFound(err) {

‎util/rbac/EnforcerUtil.go‎

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ type EnforcerUtil interface {
4545
GetHelmObject(appId int, envId int) string
4646
GetHelmObjectByAppNameAndEnvId(appName string, envId int) string
4747
GetHelmObjectByProjectIdAndEnvId(teamId int, envId int) string
48+
GetEnvRBACNameByCdPipelineIdAndEnvId(cdPipelineId int, envId int) string
4849
}
4950
type EnforcerUtilImpl struct {
5051
logger *zap.SugaredLogger
@@ -206,6 +207,24 @@ func (impl EnforcerUtilImpl) GetEnvRBACNameByCiPipelineIdAndEnvId(ciPipelineId i
206207
return fmt.Sprintf("%s/%s", strings.ToLower(env.EnvironmentIdentifier), strings.ToLower(appName))
207208
}
208209

210+
func (impl EnforcerUtilImpl) GetEnvRBACNameByCdPipelineIdAndEnvId(cdPipelineId int, envId int) string {
211+
pipeline, err := impl.pipelineRepository.FindById(cdPipelineId)
212+
if err != nil {
213+
impl.logger.Error(err)
214+
return fmt.Sprintf("%s/%s", "", "")
215+
}
216+
application, err := impl.appRepo.FindById(pipeline.AppId)
217+
if err != nil {
218+
return fmt.Sprintf("%s/%s", "", "")
219+
}
220+
appName := application.AppName
221+
env, err := impl.environmentRepository.FindById(envId)
222+
if err != nil {
223+
return fmt.Sprintf("%s/%s", "", strings.ToLower(appName))
224+
}
225+
return fmt.Sprintf("%s/%s", strings.ToLower(env.EnvironmentIdentifier), strings.ToLower(appName))
226+
}
227+
209228
func (impl EnforcerUtilImpl) GetTeamRbacObjectByCiPipelineId(ciPipelineId int) string {
210229
ciPipeline, err := impl.ciPipelineRepository.FindById(ciPipelineId)
211230
if err != nil {
@@ -315,4 +334,4 @@ func (impl EnforcerUtilImpl) GetHelmObjectByProjectIdAndEnvId(teamId int, envId
315334
environmentIdentifier = fmt.Sprintf("%s__%s", env.Cluster.ClusterName, env.EnvironmentIdentifier)
316335
}*/
317336
return fmt.Sprintf("%s/%s/%s", strings.ToLower(team.Name), environmentIdentifier, "*")
318-
}
337+
}

0 commit comments

Comments
 (0)