Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Added necessary rbacs for invite_users and get_project_members API #4697

Merged
merged 7 commits into from
Jun 24, 2024
Merged

Added necessary rbacs for invite_users and get_project_members API #4697

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
8d3a16b
Added necessary rbacs for invite_users and get_project_members API
Saranya-jena Jun 10, 2024
4811d8f
fixed imports
Saranya-jena Jun 10, 2024
fa79de4
fixed UTs
Saranya-jena Jun 10, 2024
31a4d27
fixed imports
Saranya-jena Jun 10, 2024
ee00989
fixed UTs
Saranya-jena Jun 10, 2024
571708b
resolved review comments
Saranya-jena Jun 21, 2024
0ef7a0b
Merge branch 'master' into rbac-sec-fixes
Saranya-jena Jun 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 11 additions & 1 deletion chaoscenter/authentication/api/handlers/rest/project_handler.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,10 +84,11 @@ func GetUserWithProject(service services.ApplicationService) gin.HandlerFunc {
func GetProject(service services.ApplicationService) gin.HandlerFunc {
return func(c *gin.Context) {
projectID := c.Param("project_id")
userRole := c.MustGet("role").(string)

err := validations.RbacValidator(c.MustGet("uid").(string), projectID,
validations.MutationRbacRules["getProject"], string(entities.AcceptedInvitation), service)
if err != nil {
if err != nil && entities.Role(userRole) != entities.RoleAdmin {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You can add the admin check before doing RbacValidator check. If role is admin, then you dont need teh RbacValidator

log.Warn(err)
c.JSON(utils.ErrorStatusCodes[utils.ErrUnauthorized],
presenter.CreateErrorResponse(utils.ErrUnauthorized))
Expand Down Expand Up @@ -186,6 +187,15 @@ func GetActiveProjectMembers(service services.ApplicationService) gin.HandlerFun
return func(c *gin.Context) {
projectID := c.Param("project_id")
state := c.Param("state")
err := validations.RbacValidator(c.MustGet("uid").(string), projectID,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you please add one more check here, if the user has admin role, then user can view the information.

validations.MutationRbacRules["getProject"], string(entities.AcceptedInvitation), service)
if err != nil {
log.Warn(err)
c.JSON(utils.ErrorStatusCodes[utils.ErrUnauthorized],
presenter.CreateErrorResponse(utils.ErrUnauthorized))
return
}

members, err := service.GetProjectMembers(projectID, state)
if err != nil {
c.JSON(utils.ErrorStatusCodes[utils.ErrServerError], presenter.CreateErrorResponse(utils.ErrServerError))
Expand Down
4 changes: 3 additions & 1 deletion chaoscenter/authentication/api/handlers/rest/project_handler_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -140,10 +140,11 @@ func TestGetProjectsByUserID(t *testing.T) {
func TestGetProject(t *testing.T) {
gin.SetMode(gin.TestMode)
t.Run("unauthorized request to Project", func(t *testing.T) {
projectID := "testUserID"
projectID := "testProjectID"
w := httptest.NewRecorder()
ctx := GetTestGinContext(w)
ctx.Set("uid", projectID)
ctx.Set("role", string(entities.RoleUser))
service := new(mocks.MockedApplicationService)
project := &entities.Project{
ID: "testProjectID",
Expand All @@ -166,6 +167,7 @@ func TestGetProject(t *testing.T) {
w := httptest.NewRecorder()
ctx := GetTestGinContext(w)
ctx.Set("uid", projectID)
ctx.Set("role", string(entities.RoleAdmin))
service := new(mocks.MockedApplicationService)
project := &entities.Project{
ID: "testProjectID",
Expand Down
11 changes: 11 additions & 0 deletions chaoscenter/authentication/api/handlers/rest/user_handlers.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@ import (
"net/http"
"time"

"github.com/litmuschaos/litmus/chaoscenter/authentication/pkg/validations"

"github.com/litmuschaos/litmus/chaoscenter/authentication/api/presenter"
"github.com/litmuschaos/litmus/chaoscenter/authentication/pkg/entities"
"github.com/litmuschaos/litmus/chaoscenter/authentication/pkg/services"
Expand Down Expand Up @@ -219,6 +221,15 @@ func InviteUsers(service services.ApplicationService) gin.HandlerFunc {
c.JSON(utils.ErrorStatusCodes[utils.ErrInvalidRequest], presenter.CreateErrorResponse(utils.ErrInvalidRequest))
return
}
err := validations.RbacValidator(c.MustGet("uid").(string), projectID,
validations.MutationRbacRules["sendInvitation"], string(entities.AcceptedInvitation), service)
if err != nil {
log.Warn(err)
c.JSON(utils.ErrorStatusCodes[utils.ErrUnauthorized],
presenter.CreateErrorResponse(utils.ErrUnauthorized))
return
}

projectMembers, err := service.GetProjectMembers(projectID, "all")

var uids []string
Expand Down
54 changes: 53 additions & 1 deletion chaoscenter/authentication/api/handlers/rest/user_handlers_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,8 @@ import (
"strings"
"testing"

"go.mongodb.org/mongo-driver/bson/primitive"

"github.com/gin-gonic/gin"
"github.com/litmuschaos/litmus/chaoscenter/authentication/api/handlers/rest"
"github.com/litmuschaos/litmus/chaoscenter/authentication/api/mocks"
Expand Down Expand Up @@ -271,12 +273,62 @@ func TestInviteUsers(t *testing.T) {
t.Run(tt.name, func(t *testing.T) {
w := httptest.NewRecorder()
c, _ := gin.CreateTestContext(w)
c.Set("uid", tt.projectID)
c.Params = gin.Params{
{"project_id", tt.projectID},
}

user := &entities.User{
ID: "testUserID",
Name: "Test User",
}
project := &entities.Project{
ID: "testProjectID",
Name: "Test Project",
}
projects := []*entities.Project{
{
ID: "testProjectID",
Name: "Test Project",
},
}
expectedFilter := primitive.D{
primitive.E{
Key: "_id",
Value: tt.projectID,
},
primitive.E{
Key: "members",
Value: primitive.D{
primitive.E{
Key: "$elemMatch",
Value: primitive.D{
primitive.E{
Key: "user_id",
Value: tt.projectID,
},
primitive.E{
Key: "role",
Value: primitive.D{
primitive.E{
Key: "$in",
Value: []string{"Owner"},
},
},
},
primitive.E{
Key: "invitation",
Value: "Accepted",
},
},
},
},
},
}
tt.given()

service.On("GetProjectByProjectID", "").Return(project, nil)
service.On("GetUser", tt.projectID).Return(user, nil)
service.On("GetProjects", expectedFilter).Return(projects, nil)
rest.InviteUsers(service)(c)

assert.Equal(t, tt.expectedCode, w.Code)
Expand Down
1 change: 0 additions & 1 deletion chaoscenter/graphql/server/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,6 @@ require (
github.com/litmuschaos/chaos-operator v0.0.0-20240601063404-e96a7ee7f1f7
github.com/litmuschaos/chaos-scheduler v0.0.0-20220714173615-d7513d616a71
github.com/mrz1836/go-sanitize v1.3.2
github.com/openshift/origin v0.0.0-20160503220234-8f127d736703
github.com/pkg/errors v0.9.1
github.com/sirupsen/logrus v1.9.3
github.com/stretchr/testify v1.9.0
Expand Down
1 change: 0 additions & 1 deletion chaoscenter/graphql/server/go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -944,7 +944,6 @@ github.com/opencontainers/selinux v1.3.1-0.20190929122143-5215b1806f52/go.mod h1
github.com/openebs/maya v1.12.1/go.mod h1:E9CmKbURtsthTyASz0piTxljLmGxjbaJ3aFhtWEko2Y=
github.com/openshift/api v0.0.0-20190924102528-32369d4db2ad/go.mod h1:dh9o4Fs58gpFXGSYfnVxGR9PnV53I8TW84pQaJDdGiY=
github.com/openshift/client-go v0.0.0-20190923180330-3b6373338c9b/go.mod h1:6rzn+JTr7+WYS2E1TExP4gByoABxMznR6y2SnUIkmxk=
github.com/openshift/origin v0.0.0-20160503220234-8f127d736703 h1:KLVRXtjLhZHVtrcdnuefaI2Bf182EEiTfEVDHokoyng=
github.com/openshift/origin v0.0.0-20160503220234-8f127d736703/go.mod h1:0Rox5r9C8aQn6j1oAOQ0c1uC86mYbUFObzjBRvUKHII=
github.com/openshift/prom-label-proxy v0.1.1-0.20191016113035-b8153a7f39f1/go.mod h1:p5MuxzsYP1JPsNGwtjtcgRHHlGziCJJfztff91nNixw=
github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
Expand Down
3 changes: 1 addition & 2 deletions chaoscenter/graphql/server/server.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,6 @@ import (
"github.com/litmuschaos/litmus/chaoscenter/graphql/server/pkg/database/mongodb"
dbSchemaChaosHub "github.com/litmuschaos/litmus/chaoscenter/graphql/server/pkg/database/mongodb/chaos_hub"
"github.com/litmuschaos/litmus/chaoscenter/graphql/server/pkg/projects"
"github.com/openshift/origin/Godeps/_workspace/src/github.com/Sirupsen/logrus"

"context"
"fmt"
Expand Down Expand Up @@ -121,7 +120,7 @@ func main() {

enableIntrospection, err := strconv.ParseBool(utils.Config.EnableGQLIntrospection)
if err != nil {
logrus.Errorf("unable to parse boolean value %v", err)
log.Errorf("unable to parse boolean value %v", err)
} else if err == nil && enableIntrospection == true {
srv.Use(extension.Introspection{})
}
Expand Down
Loading