Skip to content

Commit e75314d

Browse files
Ashish-devtronAshish-devtron
committed
main merge
2 parents ddc541a + 59f89d6 commit e75314d

File tree

82 files changed

+3728
-996
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

82 files changed

+3728
-996
lines changed

‎Wire.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -228,6 +228,8 @@ func InitializeApp() (*App, error) {
228228

229229
pipeline.NewPipelineBuilderImpl,
230230
wire.Bind(new(pipeline.PipelineBuilder), new(*pipeline.PipelineBuilderImpl)),
231+
pipeline.NewBuildPipelineSwitchServiceImpl,
232+
wire.Bind(new(pipeline.BuildPipelineSwitchService), new(*pipeline.BuildPipelineSwitchServiceImpl)),
231233
pipeline.NewCiPipelineConfigServiceImpl,
232234
wire.Bind(new(pipeline.CiPipelineConfigService), new(*pipeline.CiPipelineConfigServiceImpl)),
233235
pipeline.NewCiMaterialConfigServiceImpl,

‎api/bean/AppView.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,7 @@ type GenericNoteResponseBean struct {
6969
type JobContainer struct {
7070
JobId int `json:"jobId"`
7171
JobName string `json:"jobName""`
72+
JobActualName string `json:"appName""`
7273
Description GenericNoteResponseBean `json:"description"`
7374
JobCiPipelines []JobCIPipeline `json:"ciPipelines"'`
7475
}
@@ -87,6 +88,7 @@ type JobCIPipeline struct {
8788
type JobListingContainer struct {
8889
JobId int `sql:"job_id" json:"jobId"`
8990
JobName string `sql:"job_name" json:"jobName"`
91+
JobActualName string `sql:"app_name" json:"appName"`
9092
Description string `sql:"description" json:"description"`
9193
CiPipelineID int `sql:"ci_pipeline_id" json:"ciPipelineID"`
9294
CiPipelineName string `sql:"ci_pipeline_name" json:"ciPipelineName"`
@@ -161,6 +163,7 @@ type DeploymentDetailContainer struct {
161163
Deprecated bool `json:"deprecated"`
162164
K8sVersion string `json:"k8sVersion"`
163165
CiArtifactId int `json:"ciArtifactId"`
166+
ParentArtifactId int `json:"parentArtifactId"`
164167
ClusterId int `json:"clusterId"`
165168
DeploymentAppType string `json:"deploymentAppType"`
166169
CiPipelineId int `json:"-"`

‎api/bean/UserRequest.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,7 @@ type RoleFilter struct {
6666
Group string `json:"group"`
6767
Kind string `json:"kind"`
6868
Resource string `json:"resource"`
69+
Workflow string `json:"workflow"`
6970
}
7071

7172
type Role struct {

‎api/k8s/application/k8sApplicationRestHandler.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -201,6 +201,14 @@ func (handler *K8sApplicationRestHandlerImpl) GetResource(w http.ResponseWriter,
201201
common.WriteJsonResp(w, err, resource, http.StatusInternalServerError)
202202
return
203203
}
204+
if resource != nil {
205+
err = resource.SetRunningEphemeralContainers()
206+
if err != nil {
207+
handler.logger.Errorw("error in setting running ephemeral containers and setting them in resource response", "err", err)
208+
common.WriteJsonResp(w, err, resource, http.StatusInternalServerError)
209+
return
210+
}
211+
}
204212

205213
canUpdate := false
206214
// Obfuscate secret if user does not have edit access

‎api/restHandler/AppListingRestHandler.go

Lines changed: 55 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,10 @@ import (
2626
"github.com/caarlos0/env/v6"
2727
k8sCommonBean "github.com/devtron-labs/common-lib/utils/k8s/commonBean"
2828
"github.com/devtron-labs/common-lib/utils/k8s/health"
29+
k8sObjectUtils "github.com/devtron-labs/common-lib/utils/k8sObjectsUtil"
2930
"github.com/devtron-labs/devtron/api/bean"
3031
client "github.com/devtron-labs/devtron/api/helm-app"
31-
bean2 "github.com/devtron-labs/devtron/api/restHandler/bean"
32+
3233
"github.com/devtron-labs/devtron/api/restHandler/common"
3334
"github.com/devtron-labs/devtron/client/argocdServer/application"
3435
"github.com/devtron-labs/devtron/client/cron"
@@ -212,14 +213,45 @@ func (handler AppListingRestHandlerImpl) FetchJobs(w http.ResponseWriter, r *htt
212213
common.WriteJsonResp(w, err, "Unauthorized User", http.StatusUnauthorized)
213214
return
214215
}
216+
user, err := handler.userService.GetById(userId)
217+
if userId == 0 || err != nil {
218+
common.WriteJsonResp(w, err, "Unauthorized User", http.StatusUnauthorized)
219+
return
220+
}
215221
isSuperAdmin, err := handler.userService.IsSuperAdmin(int(userId))
216-
if !isSuperAdmin || err != nil {
217-
if err != nil {
218-
handler.logger.Errorw("request err, CheckSuperAdmin", "err", isSuperAdmin, "isSuperAdmin", isSuperAdmin)
219-
}
222+
if err != nil {
223+
handler.logger.Errorw("request err, CheckSuperAdmin", "err", isSuperAdmin, "isSuperAdmin", isSuperAdmin)
220224
common.WriteJsonResp(w, err, "Unauthorized User", http.StatusForbidden)
221225
return
222226
}
227+
var validAppIds []int
228+
//for non super admin users
229+
if !isSuperAdmin {
230+
userEmailId := strings.ToLower(user.EmailId)
231+
rbacObjectsForAllAppsMap := handler.enforcerUtil.GetRbacObjectsForAllApps(helper.Job)
232+
rbacObjectToAppIdMap := make(map[string]int)
233+
rbacObjects := make([]string, len(rbacObjectsForAllAppsMap))
234+
itr := 0
235+
for appId, object := range rbacObjectsForAllAppsMap {
236+
rbacObjects[itr] = object
237+
rbacObjectToAppIdMap[object] = appId
238+
itr++
239+
}
240+
241+
result := handler.enforcer.EnforceByEmailInBatch(userEmailId, casbin.ResourceJobs, casbin.ActionGet, rbacObjects)
242+
//O(n) loop, n = len(rbacObjectsForAllAppsMap)
243+
for object, ok := range result {
244+
if ok {
245+
validAppIds = append(validAppIds, rbacObjectToAppIdMap[object])
246+
}
247+
}
248+
249+
if len(validAppIds) == 0 {
250+
handler.logger.Infow("user doesn't have access to any app", "userId", userId)
251+
common.WriteJsonResp(w, err, bean.JobContainerResponse{}, http.StatusOK)
252+
return
253+
}
254+
}
223255
var fetchJobListingRequest app.FetchAppListingRequest
224256
decoder := json.NewDecoder(r.Body)
225257
err = decoder.Decode(&fetchJobListingRequest)
@@ -228,6 +260,10 @@ func (handler AppListingRestHandlerImpl) FetchJobs(w http.ResponseWriter, r *htt
228260
common.WriteJsonResp(w, err, nil, http.StatusBadRequest)
229261
return
230262
}
263+
264+
// fetching only those jobs whose access user has by setting valid app Ids.
265+
fetchJobListingRequest.AppIds = validAppIds
266+
231267
jobs, err := handler.appListingService.FetchJobs(fetchJobListingRequest)
232268
if err != nil {
233269
handler.logger.Errorw("service err, FetchJobs", "err", err, "payload", fetchJobListingRequest)
@@ -259,21 +295,21 @@ func (handler AppListingRestHandlerImpl) FetchJobOverviewCiPipelines(w http.Resp
259295
common.WriteJsonResp(w, err, "Unauthorized User", http.StatusUnauthorized)
260296
return
261297
}
262-
isSuperAdmin, err := handler.userService.IsSuperAdmin(int(userId))
263-
if !isSuperAdmin || err != nil {
264-
if err != nil {
265-
handler.logger.Errorw("request err, CheckSuperAdmin", "err", isSuperAdmin, "isSuperAdmin", isSuperAdmin)
266-
}
267-
common.WriteJsonResp(w, err, "Unauthorized User", http.StatusForbidden)
268-
return
269-
}
270298
vars := mux.Vars(r)
271299
jobId, err := strconv.Atoi(vars["jobId"])
272300
if err != nil {
273301
handler.logger.Errorw("request err, GetAppMetaInfo", "err", err, "jobId", jobId)
274302
common.WriteJsonResp(w, err, nil, http.StatusBadRequest)
275303
return
276304
}
305+
//RBAC
306+
token := r.Header.Get("token")
307+
object := handler.enforcerUtil.GetAppRBACNameByAppId(jobId)
308+
if ok := handler.enforcer.Enforce(token, casbin.ResourceJobs, casbin.ActionGet, object); !ok {
309+
common.WriteJsonResp(w, err, "Unauthorized User", http.StatusForbidden)
310+
return
311+
}
312+
//RBAC ENDS
277313
job, err := handler.pipeline.GetApp(jobId)
278314
if err != nil || job == nil || job.AppType != helper.Job {
279315
handler.logger.Errorw("Job with the given Id does not exist", "err", err, "jobId", jobId)
@@ -718,7 +754,7 @@ func (handler AppListingRestHandlerImpl) FetchAppsByEnvironmentV2(w http.Respons
718754
//for non super admin users
719755
if !isActionUserSuperAdmin {
720756
userEmailId := strings.ToLower(user.EmailId)
721-
rbacObjectsForAllAppsMap := handler.enforcerUtil.GetRbacObjectsForAllApps()
757+
rbacObjectsForAllAppsMap := handler.enforcerUtil.GetRbacObjectsForAllApps(helper.CustomApp)
722758
rbacObjectToAppIdMap := make(map[string]int)
723759
rbacObjects := make([]string, len(rbacObjectsForAllAppsMap))
724760
itr := 0
@@ -1212,7 +1248,8 @@ func (handler AppListingRestHandlerImpl) FetchAppStageStatus(w http.ResponseWrit
12121248

12131249
// RBAC enforcer applying
12141250
object := handler.enforcerUtil.GetAppRBACName(app.AppName)
1215-
if ok := handler.enforcer.Enforce(token, casbin.ResourceApplications, casbin.ActionGet, object); !ok {
1251+
ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionGet)
1252+
if !ok {
12161253
common.WriteJsonResp(w, fmt.Errorf("unauthorized user"), "Unauthorized User", http.StatusForbidden)
12171254
return
12181255
}
@@ -1285,7 +1322,8 @@ func (handler AppListingRestHandlerImpl) FetchMinDetailOtherEnvironment(w http.R
12851322

12861323
// RBAC enforcer applying
12871324
object := handler.enforcerUtil.GetAppRBACName(app.AppName)
1288-
if ok := handler.enforcer.Enforce(token, casbin.ResourceApplications, casbin.ActionGet, object); !ok {
1325+
ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionGet)
1326+
if !ok {
12891327
common.WriteJsonResp(w, err, "unauthorized user", http.StatusForbidden)
12901328
return
12911329
}
@@ -1542,7 +1580,7 @@ func (handler AppListingRestHandlerImpl) fetchResourceTree(w http.ResponseWriter
15421580
handler.logger.Errorw("error in getting pods by label", "err", err, "clusterId", cdPipeline.Environment.ClusterId, "namespace", cdPipeline.Environment.Namespace, "label", label)
15431581
return resourceTree, err
15441582
}
1545-
ephemeralContainersMap := bean2.ExtractEphemeralContainers(pods)
1583+
ephemeralContainersMap := k8sObjectUtils.ExtractEphemeralContainers(pods)
15461584
for _, metaData := range resp.PodMetadata {
15471585
metaData.EphemeralContainers = ephemeralContainersMap[metaData.Name]
15481586
}

‎api/restHandler/AppRestHandler.go

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ import (
2121
"encoding/json"
2222
client "github.com/devtron-labs/devtron/api/helm-app"
2323
"github.com/devtron-labs/devtron/api/restHandler/common"
24+
"github.com/devtron-labs/devtron/internal/sql/repository/helper"
2425
"github.com/devtron-labs/devtron/pkg/app"
2526
"github.com/devtron-labs/devtron/pkg/bean"
2627
"github.com/devtron-labs/devtron/pkg/genericNotes"
@@ -90,7 +91,7 @@ func (handler AppRestHandlerImpl) GetAllLabels(w http.ResponseWriter, r *http.Re
9091
common.WriteJsonResp(w, err, nil, http.StatusInternalServerError)
9192
return
9293
}
93-
objects := handler.enforcerUtil.GetRbacObjectsForAllApps()
94+
objects := handler.enforcerUtil.GetRbacObjectsForAllApps(helper.CustomApp)
9495
for _, label := range labels {
9596
object := objects[label.AppId]
9697
if ok := handler.enforcer.Enforce(token, casbin.ResourceApplications, casbin.ActionGet, object); ok {
@@ -117,7 +118,8 @@ func (handler AppRestHandlerImpl) GetAppMetaInfo(w http.ResponseWriter, r *http.
117118
//rback implementation starts here
118119
token := r.Header.Get("token")
119120
object := handler.enforcerUtil.GetAppRBACNameByAppId(appId)
120-
if ok := handler.enforcer.Enforce(token, casbin.ResourceApplications, casbin.ActionGet, object); !ok {
121+
ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionGet)
122+
if !ok {
121123
common.WriteJsonResp(w, err, "Unauthorized User", http.StatusForbidden)
122124
return
123125
}
@@ -207,14 +209,16 @@ func (handler AppRestHandlerImpl) UpdateApp(w http.ResponseWriter, r *http.Reque
207209

208210
// check for existing project/app permission
209211
object := handler.enforcerUtil.GetAppRBACNameByAppId(request.Id)
210-
if ok := handler.enforcer.Enforce(token, casbin.ResourceApplications, casbin.ActionUpdate, object); !ok {
212+
ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionUpdate)
213+
if !ok {
211214
common.WriteJsonResp(w, err, "Unauthorized User", http.StatusForbidden)
212215
return
213216
}
214217

215218
// check for request project/app permission
216219
object = handler.enforcerUtil.GetAppRBACNameByTeamIdAndAppId(request.TeamId, request.Id)
217-
if ok := handler.enforcer.Enforce(token, casbin.ResourceApplications, casbin.ActionUpdate, object); !ok {
220+
ok = handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionUpdate)
221+
if !ok {
218222
common.WriteJsonResp(w, err, "Unauthorized User", http.StatusForbidden)
219223
return
220224
}
@@ -372,7 +376,8 @@ func (handler AppRestHandlerImpl) UpdateAppNote(w http.ResponseWriter, r *http.R
372376

373377
// check for existing project/app permission
374378
object := handler.enforcerUtil.GetAppRBACNameByAppId(bean.Identifier)
375-
if ok := handler.enforcer.Enforce(token, casbin.ResourceApplications, casbin.ActionUpdate, object); !ok {
379+
ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionUpdate)
380+
if !ok {
376381
common.WriteJsonResp(w, err, "Unauthorized User", http.StatusForbidden)
377382
return
378383
}

0 commit comments

Comments
 (0)