Skip to content

Commit f88c542

Browse files
Shivam-nagar23Shivam-nagar23
authored
fix: User api version for old apis (#4685)
* api versioning * path * v2 assign * fetch role group * emailId---> email_id * todo * specs change
1 parent 8de40d0 commit f88c542

File tree

8 files changed

+297
-13
lines changed

8 files changed

+297
-13
lines changed

‎api/auth/user/UserRestHandler.go

Lines changed: 182 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,11 +45,15 @@ type UserRestHandler interface {
4545
UpdateUser(w http.ResponseWriter, r *http.Request)
4646
GetById(w http.ResponseWriter, r *http.Request)
4747
GetAll(w http.ResponseWriter, r *http.Request)
48+
GetAllV2(w http.ResponseWriter, r *http.Request)
4849
DeleteUser(w http.ResponseWriter, r *http.Request)
50+
GetAllDetailedUsers(w http.ResponseWriter, r *http.Request)
4951
FetchRoleGroupById(w http.ResponseWriter, r *http.Request)
5052
CreateRoleGroup(w http.ResponseWriter, r *http.Request)
5153
UpdateRoleGroup(w http.ResponseWriter, r *http.Request)
5254
FetchRoleGroups(w http.ResponseWriter, r *http.Request)
55+
FetchRoleGroupsV2(w http.ResponseWriter, r *http.Request)
56+
FetchDetailedRoleGroups(w http.ResponseWriter, r *http.Request)
5357
FetchRoleGroupsByName(w http.ResponseWriter, r *http.Request)
5458
DeleteRoleGroup(w http.ResponseWriter, r *http.Request)
5559
CheckUserRoles(w http.ResponseWriter, r *http.Request)
@@ -301,7 +305,7 @@ func (handler UserRestHandlerImpl) GetById(w http.ResponseWriter, r *http.Reques
301305
common.WriteJsonResp(w, err, res, http.StatusOK)
302306
}
303307

304-
func (handler UserRestHandlerImpl) GetAll(w http.ResponseWriter, r *http.Request) {
308+
func (handler UserRestHandlerImpl) GetAllV2(w http.ResponseWriter, r *http.Request) {
305309
var decoder = schema.NewDecoder()
306310
userId, err := handler.userService.GetLoggedInUser(r)
307311
if userId == 0 || err != nil {
@@ -372,7 +376,95 @@ func (handler UserRestHandlerImpl) GetAll(w http.ResponseWriter, r *http.Request
372376

373377
common.WriteJsonResp(w, err, res, http.StatusOK)
374378
}
379+
func (handler UserRestHandlerImpl) GetAll(w http.ResponseWriter, r *http.Request) {
380+
userId, err := handler.userService.GetLoggedInUser(r)
381+
if userId == 0 || err != nil {
382+
common.WriteJsonResp(w, err, "Unauthorized User", http.StatusUnauthorized)
383+
return
384+
}
375385

386+
// RBAC enforcer applying
387+
token := r.Header.Get("token")
388+
//checking superAdmin access
389+
isAuthorised := handler.enforcer.Enforce(token, casbin.ResourceGlobal, casbin.ActionGet, "*")
390+
if !isAuthorised {
391+
user, err := handler.userService.GetById(userId)
392+
if err != nil {
393+
handler.logger.Errorw("error in getting user by id", "err", err)
394+
common.WriteJsonResp(w, err, "", http.StatusInternalServerError)
395+
return
396+
}
397+
var roleFilters []bean.RoleFilter
398+
if len(user.Groups) > 0 {
399+
groupRoleFilters, err := handler.userService.GetRoleFiltersByGroupNames(user.Groups)
400+
if err != nil {
401+
handler.logger.Errorw("Error in getting role filters by group names", "err", err, "groupNames", user.Groups)
402+
common.WriteJsonResp(w, err, "", http.StatusInternalServerError)
403+
return
404+
}
405+
if len(groupRoleFilters) > 0 {
406+
roleFilters = append(roleFilters, groupRoleFilters...)
407+
}
408+
}
409+
if user.RoleFilters != nil && len(user.RoleFilters) > 0 {
410+
roleFilters = append(roleFilters, user.RoleFilters...)
411+
}
412+
if len(roleFilters) > 0 {
413+
for _, filter := range roleFilters {
414+
if len(filter.Team) > 0 {
415+
if ok := handler.enforcer.Enforce(token, casbin.ResourceUser, casbin.ActionGet, filter.Team); ok {
416+
isAuthorised = true
417+
break
418+
}
419+
}
420+
if filter.Entity == bean.CLUSTER_ENTITIY {
421+
if ok := handler.userCommonService.CheckRbacForClusterEntity(filter.Cluster, filter.Namespace, filter.Group, filter.Kind, filter.Resource, token, handler.CheckManagerAuth); ok {
422+
isAuthorised = true
423+
break
424+
}
425+
}
426+
}
427+
}
428+
}
429+
if !isAuthorised {
430+
common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
431+
return
432+
}
433+
res, err := handler.userService.GetAll()
434+
if err != nil {
435+
handler.logger.Errorw("service err, GetAll", "err", err)
436+
common.WriteJsonResp(w, err, "Failed to Get", http.StatusInternalServerError)
437+
return
438+
}
439+
440+
common.WriteJsonResp(w, err, res, http.StatusOK)
441+
}
442+
443+
func (handler UserRestHandlerImpl) GetAllDetailedUsers(w http.ResponseWriter, r *http.Request) {
444+
userId, err := handler.userService.GetLoggedInUser(r)
445+
if userId == 0 || err != nil {
446+
common.WriteJsonResp(w, err, "Unauthorized User", http.StatusUnauthorized)
447+
return
448+
}
449+
450+
token := r.Header.Get("token")
451+
isActionUserSuperAdmin := false
452+
if ok := handler.enforcer.Enforce(token, casbin.ResourceGlobal, casbin.ActionGet, "*"); ok {
453+
isActionUserSuperAdmin = true
454+
}
455+
if !isActionUserSuperAdmin {
456+
common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
457+
return
458+
}
459+
res, err := handler.userService.GetAllDetailedUsers()
460+
if err != nil {
461+
handler.logger.Errorw("service err, GetAllDetailedUsers", "err", err)
462+
common.WriteJsonResp(w, err, "Failed to Get", http.StatusInternalServerError)
463+
return
464+
}
465+
466+
common.WriteJsonResp(w, err, res, http.StatusOK)
467+
}
376468
func (handler UserRestHandlerImpl) DeleteUser(w http.ResponseWriter, r *http.Request) {
377469
userId, err := handler.userService.GetLoggedInUser(r)
378470
if userId == 0 || err != nil {
@@ -621,7 +713,7 @@ func (handler UserRestHandlerImpl) UpdateRoleGroup(w http.ResponseWriter, r *htt
621713
common.WriteJsonResp(w, err, res, http.StatusOK)
622714
}
623715

624-
func (handler UserRestHandlerImpl) FetchRoleGroups(w http.ResponseWriter, r *http.Request) {
716+
func (handler UserRestHandlerImpl) FetchRoleGroupsV2(w http.ResponseWriter, r *http.Request) {
625717
var decoder = schema.NewDecoder()
626718
userId, err := handler.userService.GetLoggedInUser(r)
627719
if userId == 0 || err != nil {
@@ -693,6 +785,94 @@ func (handler UserRestHandlerImpl) FetchRoleGroups(w http.ResponseWriter, r *htt
693785
common.WriteJsonResp(w, err, res, http.StatusOK)
694786
}
695787

788+
func (handler UserRestHandlerImpl) FetchRoleGroups(w http.ResponseWriter, r *http.Request) {
789+
userId, err := handler.userService.GetLoggedInUser(r)
790+
if userId == 0 || err != nil {
791+
common.WriteJsonResp(w, err, "Unauthorized User", http.StatusUnauthorized)
792+
return
793+
}
794+
// RBAC enforcer applying
795+
token := r.Header.Get("token")
796+
//checking superAdmin access
797+
isAuthorised := handler.enforcer.Enforce(token, casbin.ResourceGlobal, casbin.ActionGet, "*")
798+
if !isAuthorised {
799+
user, err := handler.userService.GetById(userId)
800+
if err != nil {
801+
handler.logger.Errorw("error in getting user by id", "err", err)
802+
common.WriteJsonResp(w, err, "", http.StatusInternalServerError)
803+
return
804+
}
805+
var roleFilters []bean.RoleFilter
806+
if len(user.Groups) > 0 {
807+
groupRoleFilters, err := handler.userService.GetRoleFiltersByGroupNames(user.Groups)
808+
if err != nil {
809+
handler.logger.Errorw("Error in getting role filters by group names", "err", err, "groupNames", user.Groups)
810+
common.WriteJsonResp(w, err, "", http.StatusInternalServerError)
811+
return
812+
}
813+
if len(groupRoleFilters) > 0 {
814+
roleFilters = append(roleFilters, groupRoleFilters...)
815+
}
816+
}
817+
if user.RoleFilters != nil && len(user.RoleFilters) > 0 {
818+
roleFilters = append(roleFilters, user.RoleFilters...)
819+
}
820+
if len(roleFilters) > 0 {
821+
for _, filter := range roleFilters {
822+
if len(filter.Team) > 0 {
823+
if ok := handler.enforcer.Enforce(token, casbin.ResourceUser, casbin.ActionGet, filter.Team); ok {
824+
isAuthorised = true
825+
break
826+
}
827+
}
828+
if filter.Entity == bean.CLUSTER_ENTITIY {
829+
if isValidAuth := handler.userCommonService.CheckRbacForClusterEntity(filter.Cluster, filter.Namespace, filter.Group, filter.Kind, filter.Resource, token, handler.CheckManagerAuth); isValidAuth {
830+
isAuthorised = true
831+
break
832+
}
833+
}
834+
835+
}
836+
}
837+
}
838+
if !isAuthorised {
839+
common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
840+
return
841+
}
842+
res, err := handler.roleGroupService.FetchRoleGroups()
843+
if err != nil {
844+
handler.logger.Errorw("service err, FetchRoleGroups", "err", err)
845+
common.WriteJsonResp(w, err, "", http.StatusInternalServerError)
846+
return
847+
}
848+
common.WriteJsonResp(w, err, res, http.StatusOK)
849+
}
850+
851+
func (handler UserRestHandlerImpl) FetchDetailedRoleGroups(w http.ResponseWriter, r *http.Request) {
852+
userId, err := handler.userService.GetLoggedInUser(r)
853+
if userId == 0 || err != nil {
854+
common.WriteJsonResp(w, err, "Unauthorized User", http.StatusUnauthorized)
855+
return
856+
}
857+
token := r.Header.Get("token")
858+
isActionUserSuperAdmin := false
859+
if ok := handler.enforcer.Enforce(token, casbin.ResourceGlobal, casbin.ActionGet, "*"); ok {
860+
isActionUserSuperAdmin = true
861+
}
862+
if !isActionUserSuperAdmin {
863+
common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
864+
return
865+
}
866+
867+
res, err := handler.roleGroupService.FetchDetailedRoleGroups()
868+
if err != nil {
869+
handler.logger.Errorw("service err, FetchRoleGroups", "err", err)
870+
common.WriteJsonResp(w, err, "", http.StatusInternalServerError)
871+
return
872+
}
873+
common.WriteJsonResp(w, err, res, http.StatusOK)
874+
}
875+
696876
func (handler UserRestHandlerImpl) FetchRoleGroupsByName(w http.ResponseWriter, r *http.Request) {
697877
userId, err := handler.userService.GetLoggedInUser(r)
698878
if userId == 0 || err != nil {

‎api/auth/user/UserRouter.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,8 @@ func NewUserRouterImpl(userRestHandler UserRestHandler) *UserRouterImpl {
3838

3939
func (router UserRouterImpl) InitUserRouter(userAuthRouter *mux.Router) {
4040
//User management
41+
userAuthRouter.Path("/v2").
42+
HandlerFunc(router.userRestHandler.GetAllV2).Methods("GET")
4143
userAuthRouter.Path("/{id}").
4244
HandlerFunc(router.userRestHandler.GetById).Methods("GET")
4345
userAuthRouter.Path("").
@@ -48,7 +50,11 @@ func (router UserRouterImpl) InitUserRouter(userAuthRouter *mux.Router) {
4850
HandlerFunc(router.userRestHandler.UpdateUser).Methods("PUT")
4951
userAuthRouter.Path("/{id}").
5052
HandlerFunc(router.userRestHandler.DeleteUser).Methods("DELETE")
53+
userAuthRouter.Path("/detail/get").
54+
HandlerFunc(router.userRestHandler.GetAllDetailedUsers).Methods("GET")
5155

56+
userAuthRouter.Path("/role/group/v2").
57+
HandlerFunc(router.userRestHandler.FetchRoleGroupsV2).Methods("GET")
5258
userAuthRouter.Path("/role/group/{id}").
5359
HandlerFunc(router.userRestHandler.FetchRoleGroupById).Methods("GET")
5460
userAuthRouter.Path("/role/group").
@@ -57,6 +63,8 @@ func (router UserRouterImpl) InitUserRouter(userAuthRouter *mux.Router) {
5763
HandlerFunc(router.userRestHandler.UpdateRoleGroup).Methods("PUT")
5864
userAuthRouter.Path("/role/group").
5965
HandlerFunc(router.userRestHandler.FetchRoleGroups).Methods("GET")
66+
userAuthRouter.Path("/role/group/detailed/get").
67+
HandlerFunc(router.userRestHandler.FetchDetailedRoleGroups).Methods("GET")
6068
userAuthRouter.Path("/role/group/search").
6169
Queries("name", "{name}").
6270
HandlerFunc(router.userRestHandler.FetchRoleGroupsByName).Methods("GET")

‎api/bean/UserRequest.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ type UserRole struct {
3131

3232
type UserInfo struct {
3333
Id int32 `json:"id" validate:"number,not-system-admin-userid"`
34-
EmailId string `json:"emailId" validate:"required,not-system-admin-user"`
34+
EmailId string `json:"email_id" validate:"required,not-system-admin-user"` // TODO : have to migrate json key to emailId and also handle backward compatibility
3535
Roles []string `json:"roles,omitempty"`
3636
AccessToken string `json:"access_token,omitempty"`
3737
RoleFilters []RoleFilter `json:"roleFilters"`

‎pkg/auth/user/RoleGroupService.go

Lines changed: 30 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -39,8 +39,10 @@ import (
3939
type RoleGroupService interface {
4040
CreateRoleGroup(request *bean.RoleGroup) (*bean.RoleGroup, error)
4141
UpdateRoleGroup(request *bean.RoleGroup, token string, managerAuth func(resource, token string, object string) bool) (*bean.RoleGroup, error)
42+
FetchDetailedRoleGroups() ([]*bean.RoleGroup, error)
4243
FetchRoleGroupsById(id int32) (*bean.RoleGroup, error)
43-
FetchRoleGroups() (*bean.RoleGroupListingResponse, error)
44+
FetchRoleGroups() ([]*bean.RoleGroup, error)
45+
FetchRoleGroupsV2() (*bean.RoleGroupListingResponse, error)
4446
FetchRoleGroupsWithFilters(request *bean.FetchListingRequest) (*bean.RoleGroupListingResponse, error)
4547
FetchRoleGroupsByName(name string) ([]*bean.RoleGroup, error)
4648
DeleteRoleGroup(model *bean.RoleGroup) (bool, error)
@@ -590,7 +592,7 @@ func (impl RoleGroupServiceImpl) getRoleGroupMetadata(roleGroup *repository.Role
590592
return roleFilters, isSuperAdmin
591593
}
592594

593-
func (impl RoleGroupServiceImpl) fetchDetailedRoleGroups() ([]*bean.RoleGroup, error) {
595+
func (impl RoleGroupServiceImpl) FetchDetailedRoleGroups() ([]*bean.RoleGroup, error) {
594596
roleGroups, err := impl.roleGroupRepository.GetAllRoleGroup()
595597
if err != nil {
596598
impl.logger.Errorw("error while fetching user from db", "error", err)
@@ -623,8 +625,31 @@ func (impl RoleGroupServiceImpl) fetchDetailedRoleGroups() ([]*bean.RoleGroup, e
623625
return list, nil
624626
}
625627

626-
func (impl RoleGroupServiceImpl) FetchRoleGroups() (*bean.RoleGroupListingResponse, error) {
627-
list, err := impl.fetchDetailedRoleGroups()
628+
func (impl RoleGroupServiceImpl) FetchRoleGroups() ([]*bean.RoleGroup, error) {
629+
roleGroup, err := impl.roleGroupRepository.GetAllRoleGroup()
630+
if err != nil {
631+
impl.logger.Errorw("error while fetching user from db", "error", err)
632+
return nil, err
633+
}
634+
var list []*bean.RoleGroup
635+
for _, item := range roleGroup {
636+
bean := &bean.RoleGroup{
637+
Id: item.Id,
638+
Name: item.Name,
639+
Description: item.Description,
640+
RoleFilters: make([]bean.RoleFilter, 0),
641+
}
642+
list = append(list, bean)
643+
}
644+
645+
if len(list) == 0 {
646+
list = make([]*bean.RoleGroup, 0)
647+
}
648+
return list, nil
649+
}
650+
651+
func (impl RoleGroupServiceImpl) FetchRoleGroupsV2() (*bean.RoleGroupListingResponse, error) {
652+
list, err := impl.FetchDetailedRoleGroups()
628653
if err != nil {
629654
impl.logger.Errorw("error in FetchDetailedRoleGroups", "err", err)
630655
return nil, err
@@ -641,7 +666,7 @@ func (impl RoleGroupServiceImpl) FetchRoleGroupsWithFilters(request *bean.FetchL
641666
// default values will be used if not provided
642667
impl.userCommonService.SetDefaultValuesIfNotPresent(request, true)
643668
if request.ShowAll {
644-
return impl.FetchRoleGroups()
669+
return impl.FetchRoleGroupsV2()
645670
}
646671

647672
// setting count check to true for getting only count

‎pkg/auth/user/UserService.go

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,7 @@ type UserService interface {
5555
GetById(id int32) (*bean.UserInfo, error)
5656
GetAll() ([]bean.UserInfo, error)
5757
GetAllWithFilters(request *bean.FetchListingRequest) (*bean.UserListingResponse, error)
58+
GetAllDetailedUsers() ([]bean.UserInfo, error)
5859
GetEmailFromToken(token string) (string, error)
5960
GetEmailById(userId int32) (string, error)
6061
GetLoggedInUser(r *http.Request) (int32, error)
@@ -1056,6 +1057,37 @@ func (impl *UserServiceImpl) getAllDetailedUsers() ([]bean.UserInfo, error) {
10561057
return response, nil
10571058
}
10581059

1060+
func (impl *UserServiceImpl) GetAllDetailedUsers() ([]bean.UserInfo, error) {
1061+
models, err := impl.userRepository.GetAllExcludingApiTokenUser()
1062+
if err != nil {
1063+
impl.logger.Errorw("error while fetching user from db", "error", err)
1064+
return nil, err
1065+
}
1066+
var response []bean.UserInfo
1067+
for _, model := range models {
1068+
isSuperAdmin, roleFilters, filterGroups := impl.getUserMetadata(&model)
1069+
for index, roleFilter := range roleFilters {
1070+
if roleFilter.Entity == "" {
1071+
roleFilters[index].Entity = bean2.ENTITY_APPS
1072+
}
1073+
if roleFilter.Entity == bean2.ENTITY_APPS && roleFilter.AccessType == "" {
1074+
roleFilters[index].AccessType = bean2.DEVTRON_APP
1075+
}
1076+
}
1077+
response = append(response, bean.UserInfo{
1078+
Id: model.Id,
1079+
EmailId: model.EmailId,
1080+
RoleFilters: roleFilters,
1081+
Groups: filterGroups,
1082+
SuperAdmin: isSuperAdmin,
1083+
})
1084+
}
1085+
if len(response) == 0 {
1086+
response = make([]bean.UserInfo, 0)
1087+
}
1088+
return response, nil
1089+
}
1090+
10591091
func (impl *UserServiceImpl) UserExists(emailId string) bool {
10601092
model, err := impl.userRepository.FetchActiveUserByEmail(emailId)
10611093
if err != nil {

0 commit comments

Comments
 (0)