Skip to content

Commit a454c3c

Browse files
jamsman94Min Min
jamsman94
and
Min Min
authored
Cherrypick #2936 #2957 (#2958)
* fix panic bug & minor permission problem Signed-off-by: Min Min <[email protected]> * users api debug and edge case fix Signed-off-by: Min Min <[email protected]> --------- Signed-off-by: Min Min <[email protected]> Co-authored-by: Min Min <[email protected]>
1 parent a30a6d6 commit a454c3c

File tree

17 files changed

+48
-72
lines changed

17 files changed

+48
-72
lines changed

‎pkg/microservice/aslan/core/build/handler/build.go‎

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -81,9 +81,7 @@ func ListBuildModules(c *gin.Context) {
8181

8282
if ctx.Resources.IsSystemAdmin {
8383
permitted = true
84-
}
85-
86-
if projectAuthInfo, ok := ctx.Resources.ProjectAuthInfo[projectKey]; ok {
84+
} else if projectAuthInfo, ok := ctx.Resources.ProjectAuthInfo[projectKey]; ok {
8785
// first check if the user is projectAdmin
8886
if projectAuthInfo.IsProjectAdmin {
8987
permitted = true
@@ -130,14 +128,10 @@ func ListBuildModulesByServiceModule(c *gin.Context) {
130128

131129
if ctx.Resources.IsSystemAdmin {
132130
permitted = true
133-
}
134-
135-
if ctx.Resources.SystemActions.Template.Create ||
131+
} else if ctx.Resources.SystemActions.Template.Create ||
136132
ctx.Resources.SystemActions.Template.Edit {
137133
permitted = true
138-
}
139-
140-
if projectAuthInfo, ok := ctx.Resources.ProjectAuthInfo[projectKey]; ok {
134+
} else if projectAuthInfo, ok := ctx.Resources.ProjectAuthInfo[projectKey]; ok {
141135
// first check if the user is projectAdmin
142136
if projectAuthInfo.IsProjectAdmin {
143137
permitted = true

‎pkg/microservice/aslan/core/build/handler/target.go‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -46,9 +46,7 @@ func ListDeployTarget(c *gin.Context) {
4646

4747
if ctx.Resources.IsSystemAdmin {
4848
permitted = true
49-
}
50-
51-
if projectAuthInfo, ok := ctx.Resources.ProjectAuthInfo[projectKey]; ok {
49+
} else if projectAuthInfo, ok := ctx.Resources.ProjectAuthInfo[projectKey]; ok {
5250
// first check if the user is projectAdmin
5351
if projectAuthInfo.IsProjectAdmin {
5452
permitted = true
@@ -94,9 +92,7 @@ func ListBuildModulesForProduct(c *gin.Context) {
9492

9593
if ctx.Resources.IsSystemAdmin {
9694
permitted = true
97-
}
98-
99-
if projectedAuthInfo, ok := ctx.Resources.ProjectAuthInfo[projectKey]; ok {
95+
} else if projectedAuthInfo, ok := ctx.Resources.ProjectAuthInfo[projectKey]; ok {
10096
if projectedAuthInfo.IsProjectAdmin {
10197
permitted = true
10298
}

‎pkg/microservice/aslan/core/environment/handler/configmap.go‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -93,8 +93,11 @@ func ListProductionConfigMaps(c *gin.Context) {
9393
}
9494
if !ctx.Resources.ProjectAuthInfo[projectKey].IsProjectAdmin &&
9595
!ctx.Resources.ProjectAuthInfo[projectKey].ProductionEnv.View {
96-
ctx.UnAuthorized = true
97-
return
96+
permitted, err := internalhandler.GetCollaborationModePermission(ctx.UserID, projectKey, types.ResourceTypeEnvironment, envName, types.ProductionEnvActionView)
97+
if err != nil || !permitted {
98+
ctx.UnAuthorized = true
99+
return
100+
}
98101
}
99102
}
100103

‎pkg/microservice/aslan/core/environment/handler/environment.go‎

Lines changed: 9 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -95,12 +95,12 @@ func ListProducts(c *gin.Context) {
9595
projectInfo.Env.View {
9696
hasPermission = true
9797
}
98-
} else {
99-
permittedEnv, _ := internalhandler.ListCollaborationEnvironmentsPermission(ctx.UserID, projectName)
100-
if permittedEnv != nil && len(permittedEnv.ReadEnvList) > 0 {
101-
hasPermission = true
102-
envFilter = permittedEnv.ReadEnvList
103-
}
98+
}
99+
100+
permittedEnv, _ := internalhandler.ListCollaborationEnvironmentsPermission(ctx.UserID, projectName)
101+
if !hasPermission && permittedEnv != nil && len(permittedEnv.ReadEnvList) > 0 {
102+
hasPermission = true
103+
envFilter = permittedEnv.ReadEnvList
104104
}
105105

106106
if !hasPermission {
@@ -1511,9 +1511,7 @@ func updateMultiK8sEnv(c *gin.Context, request *service.UpdateEnvRequest, produc
15111511

15121512
if ctx.Resources.IsSystemAdmin {
15131513
permitted = true
1514-
}
1515-
1516-
if projectAuthInfo, ok := ctx.Resources.ProjectAuthInfo[request.ProjectName]; ok {
1514+
} else if projectAuthInfo, ok := ctx.Resources.ProjectAuthInfo[request.ProjectName]; ok {
15171515
if projectAuthInfo.IsProjectAdmin {
15181516
permitted = true
15191517
}
@@ -1567,9 +1565,7 @@ func updateMultiHelmEnv(c *gin.Context, request *service.UpdateEnvRequest, produ
15671565

15681566
if ctx.Resources.IsSystemAdmin {
15691567
permitted = true
1570-
}
1571-
1572-
if projectAuthInfo, ok := ctx.Resources.ProjectAuthInfo[request.ProjectName]; ok {
1568+
} else if projectAuthInfo, ok := ctx.Resources.ProjectAuthInfo[request.ProjectName]; ok {
15731569
if projectAuthInfo.IsProjectAdmin {
15741570
permitted = true
15751571
}
@@ -1625,9 +1621,7 @@ func updateMultiHelmChartEnv(c *gin.Context, request *service.UpdateEnvRequest,
16251621

16261622
if ctx.Resources.IsSystemAdmin {
16271623
permitted = true
1628-
}
1629-
1630-
if projectAuthInfo, ok := ctx.Resources.ProjectAuthInfo[request.ProjectName]; ok {
1624+
} else if projectAuthInfo, ok := ctx.Resources.ProjectAuthInfo[request.ProjectName]; ok {
16311625
if projectAuthInfo.IsProjectAdmin {
16321626
permitted = true
16331627
}

‎pkg/microservice/aslan/core/environment/handler/image.go‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -120,9 +120,7 @@ func UpdateDeploymentContainerImage(c *gin.Context) {
120120
permitted := false
121121
if ctx.Resources.IsSystemAdmin {
122122
permitted = true
123-
}
124-
125-
if projectAuthInfo, ok := ctx.Resources.ProjectAuthInfo[args.ProductName]; ok {
123+
} else if projectAuthInfo, ok := ctx.Resources.ProjectAuthInfo[args.ProductName]; ok {
126124
if projectAuthInfo.IsProjectAdmin {
127125
permitted = true
128126
}
@@ -189,9 +187,7 @@ func UpdateProductionDeploymentContainerImage(c *gin.Context) {
189187
permitted := false
190188
if ctx.Resources.IsSystemAdmin {
191189
permitted = true
192-
}
193-
194-
if projectAuthInfo, ok := ctx.Resources.ProjectAuthInfo[args.ProductName]; ok {
190+
} else if projectAuthInfo, ok := ctx.Resources.ProjectAuthInfo[args.ProductName]; ok {
195191
if projectAuthInfo.IsProjectAdmin {
196192
permitted = true
197193
}

‎pkg/microservice/aslan/core/environment/handler/ingress.go‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -89,8 +89,11 @@ func ListProductionIngresses(c *gin.Context) {
8989
}
9090
if !ctx.Resources.ProjectAuthInfo[projectKey].IsProjectAdmin &&
9191
!ctx.Resources.ProjectAuthInfo[projectKey].ProductionEnv.View {
92-
ctx.UnAuthorized = true
93-
return
92+
permitted, err := internalhandler.GetCollaborationModePermission(ctx.UserID, projectKey, types.ResourceTypeEnvironment, envName, types.ProductionEnvActionView)
93+
if err != nil || !permitted {
94+
ctx.UnAuthorized = true
95+
return
96+
}
9497
}
9598
}
9699

‎pkg/microservice/aslan/core/environment/handler/pvc.go‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -89,8 +89,11 @@ func ListProductionPvcs(c *gin.Context) {
8989
}
9090
if !ctx.Resources.ProjectAuthInfo[projectKey].IsProjectAdmin &&
9191
!ctx.Resources.ProjectAuthInfo[projectKey].ProductionEnv.View {
92-
ctx.UnAuthorized = true
93-
return
92+
permitted, err := internalhandler.GetCollaborationModePermission(ctx.UserID, projectKey, types.ResourceTypeEnvironment, envName, types.EnvActionView)
93+
if err != nil || !permitted {
94+
ctx.UnAuthorized = true
95+
return
96+
}
9497
}
9598
}
9699

‎pkg/microservice/aslan/core/environment/handler/renderset.go‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -337,9 +337,7 @@ func GetGlobalVariables(c *gin.Context) {
337337

338338
if ctx.Resources.IsSystemAdmin {
339339
permitted = true
340-
}
341-
342-
if projectedAuthInfo, ok := ctx.Resources.ProjectAuthInfo[projectKey]; ok {
340+
} else if projectedAuthInfo, ok := ctx.Resources.ProjectAuthInfo[projectKey]; ok {
343341
if projectedAuthInfo.IsProjectAdmin {
344342
permitted = true
345343
}

‎pkg/microservice/aslan/core/environment/handler/secret.go‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -89,8 +89,11 @@ func ListProductionSecrets(c *gin.Context) {
8989
}
9090
if !ctx.Resources.ProjectAuthInfo[projectKey].IsProjectAdmin &&
9191
!ctx.Resources.ProjectAuthInfo[projectKey].ProductionEnv.View {
92-
ctx.UnAuthorized = true
93-
return
92+
permitted, err := internalhandler.GetCollaborationModePermission(ctx.UserID, projectKey, types.ResourceTypeEnvironment, envName, types.ProductionEnvActionView)
93+
if err != nil || !permitted {
94+
ctx.UnAuthorized = true
95+
return
96+
}
9497
}
9598
}
9699

‎pkg/microservice/aslan/core/environment/handler/service.go‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -59,9 +59,7 @@ func ListSvcsInEnv(c *gin.Context) {
5959

6060
if ctx.Resources.IsSystemAdmin {
6161
permitted = true
62-
}
63-
64-
if projectedAuthInfo, ok := ctx.Resources.ProjectAuthInfo[projectKey]; ok {
62+
} else if projectedAuthInfo, ok := ctx.Resources.ProjectAuthInfo[projectKey]; ok {
6563
if projectedAuthInfo.IsProjectAdmin {
6664
permitted = true
6765
}
@@ -160,9 +158,7 @@ func GetProductionService(c *gin.Context) {
160158

161159
if ctx.Resources.IsSystemAdmin {
162160
permitted = true
163-
}
164-
165-
if projectedAuthInfo, ok := ctx.Resources.ProjectAuthInfo[projectKey]; ok {
161+
} else if projectedAuthInfo, ok := ctx.Resources.ProjectAuthInfo[projectKey]; ok {
166162
if projectedAuthInfo.IsProjectAdmin {
167163
permitted = true
168164
}

0 commit comments

Comments
 (0)