devtron-labs
diff --git a/‎Dockerfile‎
Lines changed: 1 addition & 0 deletions b/‎Dockerfile‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎DockerfileEA‎
Lines changed: 1 addition & 0 deletions b/‎DockerfileEA‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎api/appStore/deployment/CommonDeploymentRestHandler.go‎
Lines changed: 2 additions & 3 deletions b/‎api/appStore/deployment/CommonDeploymentRestHandler.go‎
Lines changed: 2 additions & 3 deletions
diff --git a/‎api/auth/user/UserRestHandler.go‎
Lines changed: 60 additions & 47 deletions b/‎api/auth/user/UserRestHandler.go‎
Lines changed: 60 additions & 47 deletions
diff --git a/‎api/helm-app/HelmAppRestHandler.go‎
Lines changed: 1 addition & 1 deletion b/‎api/helm-app/HelmAppRestHandler.go‎
Lines changed: 1 addition & 1 deletion
@@ -6,6 +6,7 @@ RUN apt install git gcc musl-dev make -y
 RUN go install github.com/google/wire/cmd/wire@latest
 WORKDIR /go/src/github.com/devtron-labs/devtron
 ADD . /go/src/github.com/devtron-labs/devtron/
+ADD ./vendor/github.com/Microsoft/ /go/src/github.com/devtron-labs/devtron/vendor/github.com/microsoft/
 RUN GOOS=linux make build-all
 
 # uncomment this post build arg
 
@@ -6,6 +6,7 @@ RUN apt install git gcc musl-dev make -y
 RUN go install github.com/google/wire/cmd/wire@latest
 WORKDIR /go/src/github.com/devtron-labs/devtron
 ADD . /go/src/github.com/devtron-labs/devtron/
+ADD ./vendor/github.com/Microsoft/ /go/src/github.com/devtron-labs/devtron/vendor/github.com/microsoft/
 RUN GOOS=linux make build-all
 
 FROM ubuntu:22.04@sha256:1b8d8ff4777f36f19bfe73ee4df61e3a0b789caeff29caa019539ec7c9a57f95 as  devtron-ea
 
@@ -92,8 +92,7 @@ func (handler *CommonDeploymentRestHandlerImpl) getAppOfferingMode(installedAppI
 			err = &util.ApiError{HttpStatusCode: http.StatusBadRequest, UserMessage: "invalid app id"}
 			return appOfferingMode, installedAppDto, err
 		}
-		uniqueAppName := appIdentifier.GetUniqueAppNameIdentifier()
-		installedAppDto, err = handler.installedAppService.GetInstalledAppByClusterNamespaceAndName(appIdentifier.ClusterId, appIdentifier.Namespace, uniqueAppName)
+		installedAppDto, err = handler.installedAppService.GetInstalledAppByClusterNamespaceAndName(appIdentifier)
 		if err != nil {
 			err = &util.ApiError{HttpStatusCode: http.StatusBadRequest, UserMessage: "unable to find app in database"}
 			return appOfferingMode, installedAppDto, err
@@ -171,7 +170,7 @@ func (handler *CommonDeploymentRestHandlerImpl) GetDeploymentHistory(w http.Resp
 	}
 	//rbac block ends here
 
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	ctx, cancel := context.WithTimeout(r.Context(), 30*time.Second)
 	defer cancel()
 	res, err := handler.appStoreDeploymentService.GetDeploymentHistory(ctx, installedAppDto)
 	if err != nil {
 
@@ -142,7 +142,7 @@ func (handler UserRestHandlerImpl) CreateUser(w http.ResponseWriter, r *http.Req
 	//RBAC enforcer Ends
 	//In create req, we also check if any email exists already. If yes, then in that case we go on and merge existing roles and groups with the ones in request
 	//but rbac is only checked on create request roles and groups as existing roles and groups are assumed to be checked when created/updated before
-	res, err := handler.userService.CreateUser(&userInfo)
+	res, err := handler.userService.CreateUser(&userInfo, token, handler.CheckManagerAuth)
 	if err != nil {
 		handler.logger.Errorw("service err, CreateUser", "err", err, "payload", userInfo)
 		if _, ok := err.(*util.ApiError); ok {
@@ -192,7 +192,7 @@ func (handler UserRestHandlerImpl) UpdateUser(w http.ResponseWriter, r *http.Req
 		return
 	}
 
-	res, err := handler.userService.UpdateUser(&userInfo, token, handler.checkRBACForUserUpdate)
+	res, err := handler.userService.UpdateUser(&userInfo, token, handler.checkRBACForUserUpdate, handler.CheckManagerAuth)
 	if err != nil {
 		handler.logger.Errorw("service err, UpdateUser", "err", err, "payload", userInfo)
 		common.WriteJsonResp(w, err, "", http.StatusInternalServerError)
@@ -243,18 +243,9 @@ func (handler UserRestHandlerImpl) GetById(w http.ResponseWriter, r *http.Reques
 	// RBAC enforcer applying
 	filteredRoleFilter := make([]bean.RoleFilter, 0)
 	if res.RoleFilters != nil && len(res.RoleFilters) > 0 {
+		isUserSuperAdmin := handler.enforcer.Enforce(token, casbin.ResourceGlobal, casbin.ActionGet, "*")
 		for _, filter := range res.RoleFilters {
-			authPass := true
-			if len(filter.Team) > 0 {
-				if ok := handler.enforcer.Enforce(token, casbin.ResourceUser, casbin.ActionGet, filter.Team); !ok {
-					authPass = false
-				}
-			}
-			if filter.Entity == bean.CLUSTER_ENTITIY {
-				if ok := handler.userCommonService.CheckRbacForClusterEntity(filter.Cluster, filter.Namespace, filter.Group, filter.Kind, filter.Resource, token, handler.CheckManagerAuth); !ok {
-					authPass = false
-				}
-			}
+			authPass := handler.checkRbacForFilter(token, filter, isUserSuperAdmin)
 			if authPass {
 				filteredRoleFilter = append(filteredRoleFilter, filter)
 			}
@@ -316,7 +307,7 @@ func (handler UserRestHandlerImpl) GetAllV2(w http.ResponseWriter, r *http.Reque
 						break
 					}
 				}
-				if filter.Entity == bean.CLUSTER_ENTITIY {
+				if filter.Entity == bean2.CLUSTER_ENTITIY {
 					if ok := handler.userCommonService.CheckRbacForClusterEntity(filter.Cluster, filter.Namespace, filter.Group, filter.Kind, filter.Resource, token, handler.CheckManagerAuth); ok {
 						isAuthorised = true
 						break
@@ -387,7 +378,7 @@ func (handler UserRestHandlerImpl) GetAll(w http.ResponseWriter, r *http.Request
 						break
 					}
 				}
-				if filter.Entity == bean.CLUSTER_ENTITIY {
+				if filter.Entity == bean2.CLUSTER_ENTITIY {
 					if ok := handler.userCommonService.CheckRbacForClusterEntity(filter.Cluster, filter.Namespace, filter.Group, filter.Kind, filter.Resource, token, handler.CheckManagerAuth); ok {
 						isAuthorised = true
 						break
@@ -464,7 +455,7 @@ func (handler UserRestHandlerImpl) DeleteUser(w http.ResponseWriter, r *http.Req
 	}
 	if user.RoleFilters != nil && len(user.RoleFilters) > 0 {
 		for _, filter := range user.RoleFilters {
-			if filter.AccessType == bean.APP_ACCESS_TYPE_HELM && !isActionUserSuperAdmin {
+			if filter.AccessType == bean2.APP_ACCESS_TYPE_HELM && !isActionUserSuperAdmin {
 				common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
 				return
 			}
@@ -474,7 +465,7 @@ func (handler UserRestHandlerImpl) DeleteUser(w http.ResponseWriter, r *http.Req
 					return
 				}
 			}
-			if filter.Entity == bean.CLUSTER_ENTITIY {
+			if filter.Entity == bean2.CLUSTER_ENTITIY {
 				if ok := handler.userCommonService.CheckRbacForClusterEntity(filter.Cluster, filter.Namespace, filter.Group, filter.Kind, filter.Resource, token, handler.CheckManagerAuth); !ok {
 					common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
 					return
@@ -578,18 +569,9 @@ func (handler UserRestHandlerImpl) FetchRoleGroupById(w http.ResponseWriter, r *
 	token := r.Header.Get("token")
 	filteredRoleFilter := make([]bean.RoleFilter, 0)
 	if res.RoleFilters != nil && len(res.RoleFilters) > 0 {
+		isUserSuperAdmin := handler.enforcer.Enforce(token, casbin.ResourceGlobal, casbin.ActionGet, "*")
 		for _, filter := range res.RoleFilters {
-			authPass := true
-			if len(filter.Team) > 0 {
-				if ok := handler.enforcer.Enforce(token, casbin.ResourceUser, casbin.ActionGet, filter.Team); !ok {
-					authPass = false
-				}
-			}
-			if filter.Entity == bean.CLUSTER_ENTITIY {
-				if isValidAuth := handler.userCommonService.CheckRbacForClusterEntity(filter.Cluster, filter.Namespace, filter.Group, filter.Kind, filter.Resource, token, handler.CheckManagerAuth); !isValidAuth {
-					authPass = false
-				}
-			}
+			authPass := handler.checkRbacForFilter(token, filter, isUserSuperAdmin)
 			if authPass {
 				filteredRoleFilter = append(filteredRoleFilter, filter)
 			}
@@ -610,6 +592,35 @@ func (handler UserRestHandlerImpl) FetchRoleGroupById(w http.ResponseWriter, r *
 	common.WriteJsonResp(w, err, res, http.StatusOK)
 }
 
+func (handler UserRestHandlerImpl) checkRbacForFilter(token string, filter bean.RoleFilter, isUserSuperAdmin bool) bool {
+	isAuthorised := true
+	switch {
+	case isUserSuperAdmin:
+		isAuthorised = true
+	case filter.AccessType == bean2.APP_ACCESS_TYPE_HELM || filter.Entity == bean2.EntityJobs:
+		if ok := handler.enforcer.Enforce(token, casbin.ResourceGlobal, casbin.ActionGet, "*"); !ok {
+			isAuthorised = false
+		}
+
+	case len(filter.Team) > 0:
+		// this is case of devtron app
+		if ok := handler.enforcer.Enforce(token, casbin.ResourceUser, casbin.ActionGet, filter.Team); !ok {
+			isAuthorised = false
+		}
+
+	case filter.Entity == bean.CLUSTER_ENTITIY:
+		isValidAuth := handler.userCommonService.CheckRbacForClusterEntity(filter.Cluster, filter.Namespace, filter.Group, filter.Kind, filter.Resource, token, handler.CheckManagerAuth)
+		if !isValidAuth {
+			isAuthorised = false
+		}
+	case filter.Entity == bean.CHART_GROUP_ENTITY:
+		isAuthorised = true
+	default:
+		isAuthorised = false
+	}
+	return isAuthorised
+}
+
 func (handler UserRestHandlerImpl) CreateRoleGroup(w http.ResponseWriter, r *http.Request) {
 	decoder := json.NewDecoder(r.Body)
 	userId, err := handler.userService.GetLoggedInUser(r)
@@ -698,7 +709,7 @@ func (handler UserRestHandlerImpl) UpdateRoleGroup(w http.ResponseWriter, r *htt
 		return
 	}
 
-	res, err := handler.roleGroupService.UpdateRoleGroup(&request, token, handler.checkRBACForRoleGroupUpdate)
+	res, err := handler.roleGroupService.UpdateRoleGroup(&request, token, handler.checkRBACForRoleGroupUpdate, handler.CheckManagerAuth)
 	if err != nil {
 		handler.logger.Errorw("service err, UpdateRoleGroup", "err", err, "payload", request)
 		common.WriteJsonResp(w, err, "", http.StatusInternalServerError)
@@ -749,7 +760,7 @@ func (handler UserRestHandlerImpl) FetchRoleGroupsV2(w http.ResponseWriter, r *h
 						break
 					}
 				}
-				if filter.Entity == bean.CLUSTER_ENTITIY {
+				if filter.Entity == bean2.CLUSTER_ENTITIY {
 					if isValidAuth := handler.userCommonService.CheckRbacForClusterEntity(filter.Cluster, filter.Namespace, filter.Group, filter.Kind, filter.Resource, token, handler.CheckManagerAuth); isValidAuth {
 						isAuthorised = true
 						break
@@ -820,7 +831,7 @@ func (handler UserRestHandlerImpl) FetchRoleGroups(w http.ResponseWriter, r *htt
 						break
 					}
 				}
-				if filter.Entity == bean.CLUSTER_ENTITIY {
+				if filter.Entity == bean2.CLUSTER_ENTITIY {
 					if isValidAuth := handler.userCommonService.CheckRbacForClusterEntity(filter.Cluster, filter.Namespace, filter.Group, filter.Kind, filter.Resource, token, handler.CheckManagerAuth); isValidAuth {
 						isAuthorised = true
 						break
@@ -908,7 +919,7 @@ func (handler UserRestHandlerImpl) DeleteRoleGroup(w http.ResponseWriter, r *htt
 		return
 	}
 	token := r.Header.Get("token")
-	isAuthorised, err := handler.checkRBACForRoleGroupDelete(token, userGroup.RoleFilters)
+	isAuthorised, err := handler.checkRBACForRoleGroupDelete(token, userGroup)
 	if err != nil {
 		common.WriteJsonResp(w, err, "", http.StatusInternalServerError)
 		return
@@ -1038,7 +1049,7 @@ func (handler UserRestHandlerImpl) SyncOrchestratorToCasbin(w http.ResponseWrite
 		common.WriteJsonResp(w, err, "Unauthorized User", http.StatusUnauthorized)
 		return
 	}
-	userEmailId, err := handler.userService.GetEmailById(userId)
+	userEmailId, err := handler.userService.GetActiveEmailById(userId)
 	if err != nil {
 		handler.logger.Errorw("service err, SyncOrchestratorToCasbin", "err", err, "userId", userId)
 		common.WriteJsonResp(w, err, nil, http.StatusInternalServerError)
@@ -1138,7 +1149,7 @@ func (handler UserRestHandlerImpl) checkRBACForUserCreate(token string, requestS
 					isAuthorised = false
 				}
 				if !isAuthorised {
-					break
+					return false, nil
 				}
 			}
 		}
@@ -1167,7 +1178,7 @@ func (handler UserRestHandlerImpl) checkRBACForUserCreate(token string, requestS
 						isAuthorised = false
 					}
 					if !isAuthorised {
-						break
+						return false, nil
 					}
 				}
 			} else {
@@ -1206,7 +1217,7 @@ func (handler UserRestHandlerImpl) checkRBACForUserUpdate(token string, userInfo
 					isAuthorised = false
 				}
 				if !isAuthorised {
-					break
+					return false, nil
 				}
 			}
 		}
@@ -1225,7 +1236,7 @@ func (handler UserRestHandlerImpl) checkRBACForUserUpdate(token string, userInfo
 					isAuthorised = false
 				}
 				if !isAuthorised {
-					break
+					return false, nil
 				}
 			}
 		}
@@ -1252,7 +1263,7 @@ func (handler UserRestHandlerImpl) checkRBACForUserUpdate(token string, userInfo
 						isAuthorised = false
 					}
 					if !isAuthorised {
-						break
+						return false, nil
 					}
 				}
 			} else {
@@ -1263,11 +1274,10 @@ func (handler UserRestHandlerImpl) checkRBACForUserUpdate(token string, userInfo
 	return isAuthorised, nil
 }
 
-func (handler UserRestHandlerImpl) checkRBACForRoleGroupUpdate(token string, groupInfo *bean.RoleGroup,
-	eliminatedRoleFilters []*repository.RoleModel) (isAuthorised bool, err error) {
+func (handler UserRestHandlerImpl) checkRBACForRoleGroupUpdate(token string, groupInfo *bean.RoleGroup, eliminatedRoleFilters []*repository.RoleModel, isRoleGroupAlreadySuperAdmin bool) (isAuthorised bool, err error) {
 	isActionUserSuperAdmin := handler.enforcer.Enforce(token, casbin.ResourceGlobal, casbin.ActionGet, "*")
 	requestSuperAdmin := groupInfo.SuperAdmin
-	if requestSuperAdmin && !isActionUserSuperAdmin {
+	if (requestSuperAdmin || isRoleGroupAlreadySuperAdmin) && !isActionUserSuperAdmin {
 		//if user is going to be provided with super-admin access or already a super-admin then the action user should be a super-admin
 		return false, nil
 	}
@@ -1290,7 +1300,7 @@ func (handler UserRestHandlerImpl) checkRBACForRoleGroupUpdate(token string, gro
 					isAuthorised = false
 				}
 				if !isAuthorised {
-					break
+					return false, nil
 				}
 			}
 		}
@@ -1309,20 +1319,23 @@ func (handler UserRestHandlerImpl) checkRBACForRoleGroupUpdate(token string, gro
 					isAuthorised = false
 				}
 				if !isAuthorised {
-					break
+					return false, nil
 				}
 			}
 		}
 	}
 	return isAuthorised, nil
 }
 
-func (handler UserRestHandlerImpl) checkRBACForRoleGroupDelete(token string, groupRoles []bean.RoleFilter) (isAuthorised bool, err error) {
+func (handler UserRestHandlerImpl) checkRBACForRoleGroupDelete(token string, userGroup *bean.RoleGroup) (isAuthorised bool, err error) {
 	isActionUserSuperAdmin := handler.enforcer.Enforce(token, casbin.ResourceGlobal, casbin.ActionGet, "*")
+	if userGroup.SuperAdmin && !isActionUserSuperAdmin {
+		return false, nil
+	}
 	isAuthorised = isActionUserSuperAdmin
 	if !isAuthorised {
-		if groupRoles != nil && len(groupRoles) > 0 { //auth check inside roleFilters
-			for _, filter := range groupRoles {
+		if userGroup.RoleFilters != nil && len(userGroup.RoleFilters) > 0 { //auth check inside roleFilters
+			for _, filter := range userGroup.RoleFilters {
 				switch {
 				case filter.Action == bean.ACTION_SUPERADMIN:
 					isAuthorised = isActionUserSuperAdmin
@@ -1338,7 +1351,7 @@ func (handler UserRestHandlerImpl) checkRBACForRoleGroupDelete(token string, gro
 					isAuthorised = false
 				}
 				if !isAuthorised {
-					break
+					return false, nil
 				}
 			}
 		}
 
@@ -159,7 +159,7 @@ func (handler *HelmAppRestHandlerImpl) GetApplicationDetail(w http.ResponseWrite
 		return
 	}
 
-	installedApp, err := handler.installedAppService.GetInstalledAppByClusterNamespaceAndName(appIdentifier.ClusterId, appIdentifier.Namespace, appIdentifier.ReleaseName)
+	installedApp, err := handler.installedAppService.GetInstalledAppByClusterNamespaceAndName(appIdentifier)
 	if err != nil {
 		common.WriteJsonResp(w, err, nil, http.StatusInternalServerError)
 		return
Original file line number	Diff line number	Diff line change
`@@ -142,7 +142,7 @@ func (handler UserRestHandlerImpl) CreateUser(w http.ResponseWriter, r *http.Req`
`142`	`142`	`//RBAC enforcer Ends`
`143`	`143`	`//In create req, we also check if any email exists already. If yes, then in that case we go on and merge existing roles and groups with the ones in request`
`144`	`144`	`//but rbac is only checked on create request roles and groups as existing roles and groups are assumed to be checked when created/updated before`
`145`		`- res, err := handler.userService.CreateUser(&userInfo)`
	`145`	`+ res, err := handler.userService.CreateUser(&userInfo, token, handler.CheckManagerAuth)`
`146`	`146`	`if err != nil {`
`147`	`147`	`handler.logger.Errorw("service err, CreateUser", "err", err, "payload", userInfo)`
`148`	`148`	`if _, ok := err.(*util.ApiError); ok {`
`@@ -192,7 +192,7 @@ func (handler UserRestHandlerImpl) UpdateUser(w http.ResponseWriter, r *http.Req`
`192`	`192`	`return`
`193`	`193`	`}`
`194`	`194`
`195`		`- res, err := handler.userService.UpdateUser(&userInfo, token, handler.checkRBACForUserUpdate)`
	`195`	`+ res, err := handler.userService.UpdateUser(&userInfo, token, handler.checkRBACForUserUpdate, handler.CheckManagerAuth)`
`196`	`196`	`if err != nil {`
`197`	`197`	`handler.logger.Errorw("service err, UpdateUser", "err", err, "payload", userInfo)`
`198`	`198`	`common.WriteJsonResp(w, err, "", http.StatusInternalServerError)`
`@@ -243,18 +243,9 @@ func (handler UserRestHandlerImpl) GetById(w http.ResponseWriter, r *http.Reques`
`243`	`243`	`// RBAC enforcer applying`
`244`	`244`	`filteredRoleFilter := make([]bean.RoleFilter, 0)`
`245`	`245`	`if res.RoleFilters != nil && len(res.RoleFilters) > 0 {`
	`246`	`+ isUserSuperAdmin := handler.enforcer.Enforce(token, casbin.ResourceGlobal, casbin.ActionGet, "*")`
`246`	`247`	`for _, filter := range res.RoleFilters {`
`247`		`- authPass := true`
`248`		`- if len(filter.Team) > 0 {`
`249`		`- if ok := handler.enforcer.Enforce(token, casbin.ResourceUser, casbin.ActionGet, filter.Team); !ok {`
`250`		`- authPass = false`
`251`		`- }`
`252`		`- }`
`253`		`- if filter.Entity == bean.CLUSTER_ENTITIY {`
`254`		`- if ok := handler.userCommonService.CheckRbacForClusterEntity(filter.Cluster, filter.Namespace, filter.Group, filter.Kind, filter.Resource, token, handler.CheckManagerAuth); !ok {`
`255`		`- authPass = false`
`256`		`- }`
`257`		`- }`
	`248`	`+ authPass := handler.checkRbacForFilter(token, filter, isUserSuperAdmin)`
`258`	`249`	`if authPass {`
`259`	`250`	`filteredRoleFilter = append(filteredRoleFilter, filter)`
`260`	`251`	`}`
`@@ -316,7 +307,7 @@ func (handler UserRestHandlerImpl) GetAllV2(w http.ResponseWriter, r *http.Reque`
`316`	`307`	`break`
`317`	`308`	`}`
`318`	`309`	`}`
`319`		`- if filter.Entity == bean.CLUSTER_ENTITIY {`
	`310`	`+ if filter.Entity == bean2.CLUSTER_ENTITIY {`
`320`	`311`	`if ok := handler.userCommonService.CheckRbacForClusterEntity(filter.Cluster, filter.Namespace, filter.Group, filter.Kind, filter.Resource, token, handler.CheckManagerAuth); ok {`
`321`	`312`	`isAuthorised = true`
`322`	`313`	`break`
`@@ -387,7 +378,7 @@ func (handler UserRestHandlerImpl) GetAll(w http.ResponseWriter, r *http.Request`
`387`	`378`	`break`
`388`	`379`	`}`
`389`	`380`	`}`
`390`		`- if filter.Entity == bean.CLUSTER_ENTITIY {`
	`381`	`+ if filter.Entity == bean2.CLUSTER_ENTITIY {`
`391`	`382`	`if ok := handler.userCommonService.CheckRbacForClusterEntity(filter.Cluster, filter.Namespace, filter.Group, filter.Kind, filter.Resource, token, handler.CheckManagerAuth); ok {`
`392`	`383`	`isAuthorised = true`
`393`	`384`	`break`
`@@ -464,7 +455,7 @@ func (handler UserRestHandlerImpl) DeleteUser(w http.ResponseWriter, r *http.Req`
`464`	`455`	`}`
`465`	`456`	`if user.RoleFilters != nil && len(user.RoleFilters) > 0 {`
`466`	`457`	`for _, filter := range user.RoleFilters {`
`467`		`- if filter.AccessType == bean.APP_ACCESS_TYPE_HELM && !isActionUserSuperAdmin {`
	`458`	`+ if filter.AccessType == bean2.APP_ACCESS_TYPE_HELM && !isActionUserSuperAdmin {`
`468`	`459`	`common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)`
`469`	`460`	`return`
`470`	`461`	`}`
`@@ -474,7 +465,7 @@ func (handler UserRestHandlerImpl) DeleteUser(w http.ResponseWriter, r *http.Req`
`474`	`465`	`return`
`475`	`466`	`}`
`476`	`467`	`}`
`477`		`- if filter.Entity == bean.CLUSTER_ENTITIY {`
	`468`	`+ if filter.Entity == bean2.CLUSTER_ENTITIY {`
`478`	`469`	`if ok := handler.userCommonService.CheckRbacForClusterEntity(filter.Cluster, filter.Namespace, filter.Group, filter.Kind, filter.Resource, token, handler.CheckManagerAuth); !ok {`
`479`	`470`	`common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)`
`480`	`471`	`return`
`@@ -578,18 +569,9 @@ func (handler UserRestHandlerImpl) FetchRoleGroupById(w http.ResponseWriter, r *`
`578`	`569`	`token := r.Header.Get("token")`
`579`	`570`	`filteredRoleFilter := make([]bean.RoleFilter, 0)`
`580`	`571`	`if res.RoleFilters != nil && len(res.RoleFilters) > 0 {`
	`572`	`+ isUserSuperAdmin := handler.enforcer.Enforce(token, casbin.ResourceGlobal, casbin.ActionGet, "*")`
`581`	`573`	`for _, filter := range res.RoleFilters {`
`582`		`- authPass := true`
`583`		`- if len(filter.Team) > 0 {`
`584`		`- if ok := handler.enforcer.Enforce(token, casbin.ResourceUser, casbin.ActionGet, filter.Team); !ok {`
`585`		`- authPass = false`
`586`		`- }`
`587`		`- }`
`588`		`- if filter.Entity == bean.CLUSTER_ENTITIY {`
`589`		`- if isValidAuth := handler.userCommonService.CheckRbacForClusterEntity(filter.Cluster, filter.Namespace, filter.Group, filter.Kind, filter.Resource, token, handler.CheckManagerAuth); !isValidAuth {`
`590`		`- authPass = false`
`591`		`- }`
`592`		`- }`
	`574`	`+ authPass := handler.checkRbacForFilter(token, filter, isUserSuperAdmin)`
`593`	`575`	`if authPass {`
`594`	`576`	`filteredRoleFilter = append(filteredRoleFilter, filter)`
`595`	`577`	`}`
`@@ -610,6 +592,35 @@ func (handler UserRestHandlerImpl) FetchRoleGroupById(w http.ResponseWriter, r *`
`610`	`592`	`common.WriteJsonResp(w, err, res, http.StatusOK)`
`611`	`593`	`}`
`612`	`594`
	`595`	`+func (handler UserRestHandlerImpl) checkRbacForFilter(token string, filter bean.RoleFilter, isUserSuperAdmin bool) bool {`
	`596`	`+ isAuthorised := true`
	`597`	`+ switch {`
	`598`	`+ case isUserSuperAdmin:`
	`599`	`+ isAuthorised = true`
	`600`	`+ case filter.AccessType == bean2.APP_ACCESS_TYPE_HELM \|\| filter.Entity == bean2.EntityJobs:`
	`601`	`+ if ok := handler.enforcer.Enforce(token, casbin.ResourceGlobal, casbin.ActionGet, "*"); !ok {`
	`602`	`+ isAuthorised = false`
	`603`	`+ }`
	`604`	`+`
	`605`	`+ case len(filter.Team) > 0:`
	`606`	`+ // this is case of devtron app`
	`607`	`+ if ok := handler.enforcer.Enforce(token, casbin.ResourceUser, casbin.ActionGet, filter.Team); !ok {`
	`608`	`+ isAuthorised = false`
	`609`	`+ }`
	`610`	`+`
	`611`	`+ case filter.Entity == bean.CLUSTER_ENTITIY:`
	`612`	`+ isValidAuth := handler.userCommonService.CheckRbacForClusterEntity(filter.Cluster, filter.Namespace, filter.Group, filter.Kind, filter.Resource, token, handler.CheckManagerAuth)`
	`613`	`+ if !isValidAuth {`
	`614`	`+ isAuthorised = false`
	`615`	`+ }`
	`616`	`+ case filter.Entity == bean.CHART_GROUP_ENTITY:`
	`617`	`+ isAuthorised = true`
	`618`	`+ default:`
	`619`	`+ isAuthorised = false`
	`620`	`+ }`
	`621`	`+ return isAuthorised`
	`622`	`+}`
	`623`	`+`
`613`	`624`	`func (handler UserRestHandlerImpl) CreateRoleGroup(w http.ResponseWriter, r *http.Request) {`
`614`	`625`	`decoder := json.NewDecoder(r.Body)`
`615`	`626`	`userId, err := handler.userService.GetLoggedInUser(r)`
`@@ -698,7 +709,7 @@ func (handler UserRestHandlerImpl) UpdateRoleGroup(w http.ResponseWriter, r *htt`
`698`	`709`	`return`
`699`	`710`	`}`
`700`	`711`
`701`		`- res, err := handler.roleGroupService.UpdateRoleGroup(&request, token, handler.checkRBACForRoleGroupUpdate)`
	`712`	`+ res, err := handler.roleGroupService.UpdateRoleGroup(&request, token, handler.checkRBACForRoleGroupUpdate, handler.CheckManagerAuth)`
`702`	`713`	`if err != nil {`
`703`	`714`	`handler.logger.Errorw("service err, UpdateRoleGroup", "err", err, "payload", request)`
`704`	`715`	`common.WriteJsonResp(w, err, "", http.StatusInternalServerError)`
`@@ -749,7 +760,7 @@ func (handler UserRestHandlerImpl) FetchRoleGroupsV2(w http.ResponseWriter, r *h`
`749`	`760`	`break`
`750`	`761`	`}`
`751`	`762`	`}`
`752`		`- if filter.Entity == bean.CLUSTER_ENTITIY {`
	`763`	`+ if filter.Entity == bean2.CLUSTER_ENTITIY {`
`753`	`764`	`if isValidAuth := handler.userCommonService.CheckRbacForClusterEntity(filter.Cluster, filter.Namespace, filter.Group, filter.Kind, filter.Resource, token, handler.CheckManagerAuth); isValidAuth {`
`754`	`765`	`isAuthorised = true`
`755`	`766`	`break`
`@@ -820,7 +831,7 @@ func (handler UserRestHandlerImpl) FetchRoleGroups(w http.ResponseWriter, r *htt`
`820`	`831`	`break`
`821`	`832`	`}`
`822`	`833`	`}`
`823`		`- if filter.Entity == bean.CLUSTER_ENTITIY {`
	`834`	`+ if filter.Entity == bean2.CLUSTER_ENTITIY {`
`824`	`835`	`if isValidAuth := handler.userCommonService.CheckRbacForClusterEntity(filter.Cluster, filter.Namespace, filter.Group, filter.Kind, filter.Resource, token, handler.CheckManagerAuth); isValidAuth {`
`825`	`836`	`isAuthorised = true`
`826`	`837`	`break`
`@@ -908,7 +919,7 @@ func (handler UserRestHandlerImpl) DeleteRoleGroup(w http.ResponseWriter, r *htt`
`908`	`919`	`return`
`909`	`920`	`}`
`910`	`921`	`token := r.Header.Get("token")`
`911`		`- isAuthorised, err := handler.checkRBACForRoleGroupDelete(token, userGroup.RoleFilters)`
	`922`	`+ isAuthorised, err := handler.checkRBACForRoleGroupDelete(token, userGroup)`
`912`	`923`	`if err != nil {`
`913`	`924`	`common.WriteJsonResp(w, err, "", http.StatusInternalServerError)`
`914`	`925`	`return`
`@@ -1038,7 +1049,7 @@ func (handler UserRestHandlerImpl) SyncOrchestratorToCasbin(w http.ResponseWrite`
`1038`	`1049`	`common.WriteJsonResp(w, err, "Unauthorized User", http.StatusUnauthorized)`
`1039`	`1050`	`return`
`1040`	`1051`	`}`
`1041`		`- userEmailId, err := handler.userService.GetEmailById(userId)`
	`1052`	`+ userEmailId, err := handler.userService.GetActiveEmailById(userId)`
`1042`	`1053`	`if err != nil {`
`1043`	`1054`	`handler.logger.Errorw("service err, SyncOrchestratorToCasbin", "err", err, "userId", userId)`
`1044`	`1055`	`common.WriteJsonResp(w, err, nil, http.StatusInternalServerError)`
`@@ -1138,7 +1149,7 @@ func (handler UserRestHandlerImpl) checkRBACForUserCreate(token string, requestS`
`1138`	`1149`	`isAuthorised = false`
`1139`	`1150`	`}`
`1140`	`1151`	`if !isAuthorised {`
`1141`		`- break`
	`1152`	`+ return false, nil`
`1142`	`1153`	`}`
`1143`	`1154`	`}`
`1144`	`1155`	`}`
`@@ -1167,7 +1178,7 @@ func (handler UserRestHandlerImpl) checkRBACForUserCreate(token string, requestS`
`1167`	`1178`	`isAuthorised = false`
`1168`	`1179`	`}`
`1169`	`1180`	`if !isAuthorised {`
`1170`		`- break`
	`1181`	`+ return false, nil`
`1171`	`1182`	`}`
`1172`	`1183`	`}`
`1173`	`1184`	`} else {`
`@@ -1206,7 +1217,7 @@ func (handler UserRestHandlerImpl) checkRBACForUserUpdate(token string, userInfo`
`1206`	`1217`	`isAuthorised = false`
`1207`	`1218`	`}`
`1208`	`1219`	`if !isAuthorised {`
`1209`		`- break`
	`1220`	`+ return false, nil`
`1210`	`1221`	`}`
`1211`	`1222`	`}`
`1212`	`1223`	`}`
`@@ -1225,7 +1236,7 @@ func (handler UserRestHandlerImpl) checkRBACForUserUpdate(token string, userInfo`
`1225`	`1236`	`isAuthorised = false`
`1226`	`1237`	`}`
`1227`	`1238`	`if !isAuthorised {`
`1228`		`- break`
	`1239`	`+ return false, nil`
`1229`	`1240`	`}`
`1230`	`1241`	`}`
`1231`	`1242`	`}`
`@@ -1252,7 +1263,7 @@ func (handler UserRestHandlerImpl) checkRBACForUserUpdate(token string, userInfo`
`1252`	`1263`	`isAuthorised = false`
`1253`	`1264`	`}`
`1254`	`1265`	`if !isAuthorised {`
`1255`		`- break`
	`1266`	`+ return false, nil`
`1256`	`1267`	`}`
`1257`	`1268`	`}`
`1258`	`1269`	`} else {`
`@@ -1263,11 +1274,10 @@ func (handler UserRestHandlerImpl) checkRBACForUserUpdate(token string, userInfo`
`1263`	`1274`	`return isAuthorised, nil`
`1264`	`1275`	`}`
`1265`	`1276`
`1266`		`-func (handler UserRestHandlerImpl) checkRBACForRoleGroupUpdate(token string, groupInfo *bean.RoleGroup,`
`1267`		`- eliminatedRoleFilters []*repository.RoleModel) (isAuthorised bool, err error) {`
	`1277`	`+func (handler UserRestHandlerImpl) checkRBACForRoleGroupUpdate(token string, groupInfo bean.RoleGroup, eliminatedRoleFilters []repository.RoleModel, isRoleGroupAlreadySuperAdmin bool) (isAuthorised bool, err error) {`
`1268`	`1278`	`isActionUserSuperAdmin := handler.enforcer.Enforce(token, casbin.ResourceGlobal, casbin.ActionGet, "*")`
`1269`	`1279`	`requestSuperAdmin := groupInfo.SuperAdmin`
`1270`		`- if requestSuperAdmin && !isActionUserSuperAdmin {`
	`1280`	`+ if (requestSuperAdmin \|\| isRoleGroupAlreadySuperAdmin) && !isActionUserSuperAdmin {`
`1271`	`1281`	`//if user is going to be provided with super-admin access or already a super-admin then the action user should be a super-admin`
`1272`	`1282`	`return false, nil`
`1273`	`1283`	`}`
`@@ -1290,7 +1300,7 @@ func (handler UserRestHandlerImpl) checkRBACForRoleGroupUpdate(token string, gro`
`1290`	`1300`	`isAuthorised = false`
`1291`	`1301`	`}`
`1292`	`1302`	`if !isAuthorised {`
`1293`		`- break`
	`1303`	`+ return false, nil`
`1294`	`1304`	`}`
`1295`	`1305`	`}`
`1296`	`1306`	`}`
`@@ -1309,20 +1319,23 @@ func (handler UserRestHandlerImpl) checkRBACForRoleGroupUpdate(token string, gro`
`1309`	`1319`	`isAuthorised = false`
`1310`	`1320`	`}`
`1311`	`1321`	`if !isAuthorised {`
`1312`		`- break`
	`1322`	`+ return false, nil`
`1313`	`1323`	`}`
`1314`	`1324`	`}`
`1315`	`1325`	`}`
`1316`	`1326`	`}`
`1317`	`1327`	`return isAuthorised, nil`
`1318`	`1328`	`}`
`1319`	`1329`
`1320`		`-func (handler UserRestHandlerImpl) checkRBACForRoleGroupDelete(token string, groupRoles []bean.RoleFilter) (isAuthorised bool, err error) {`
	`1330`	`+func (handler UserRestHandlerImpl) checkRBACForRoleGroupDelete(token string, userGroup *bean.RoleGroup) (isAuthorised bool, err error) {`
`1321`	`1331`	`isActionUserSuperAdmin := handler.enforcer.Enforce(token, casbin.ResourceGlobal, casbin.ActionGet, "*")`
	`1332`	`+ if userGroup.SuperAdmin && !isActionUserSuperAdmin {`
	`1333`	`+ return false, nil`
	`1334`	`+ }`
`1322`	`1335`	`isAuthorised = isActionUserSuperAdmin`
`1323`	`1336`	`if !isAuthorised {`
`1324`		`- if groupRoles != nil && len(groupRoles) > 0 { //auth check inside roleFilters`
`1325`		`- for _, filter := range groupRoles {`
	`1337`	`+ if userGroup.RoleFilters != nil && len(userGroup.RoleFilters) > 0 { //auth check inside roleFilters`
	`1338`	`+ for _, filter := range userGroup.RoleFilters {`
`1326`	`1339`	`switch {`
`1327`	`1340`	`case filter.Action == bean.ACTION_SUPERADMIN:`
`1328`	`1341`	`isAuthorised = isActionUserSuperAdmin`
`@@ -1338,7 +1351,7 @@ func (handler UserRestHandlerImpl) checkRBACForRoleGroupDelete(token string, gro`
`1338`	`1351`	`isAuthorised = false`
`1339`	`1352`	`}`
`1340`	`1353`	`if !isAuthorised {`
`1341`		`- break`
	`1354`	`+ return false, nil`
`1342`	`1355`	`}`
`1343`	`1356`	`}`
`1344`	`1357`	`}`
Original file line number	Diff line number	Diff line change
`@@ -159,7 +159,7 @@ func (handler *HelmAppRestHandlerImpl) GetApplicationDetail(w http.ResponseWrite`
`159`	`159`	`return`
`160`	`160`	`}`
`161`	`161`
`162`		`- installedApp, err := handler.installedAppService.GetInstalledAppByClusterNamespaceAndName(appIdentifier.ClusterId, appIdentifier.Namespace, appIdentifier.ReleaseName)`
	`162`	`+ installedApp, err := handler.installedAppService.GetInstalledAppByClusterNamespaceAndName(appIdentifier)`
`163`	`163`	`if err != nil {`
`164`	`164`	`common.WriteJsonResp(w, err, nil, http.StatusInternalServerError)`
`165`	`165`	`return`