feat: access manager

Wire.go

@@ -73,6 +73,7 @@ import (
 	"github.com/devtron-labs/devtron/api/sse"
 	"github.com/devtron-labs/devtron/api/team"
 	"github.com/devtron-labs/devtron/api/terminal"
+	"github.com/devtron-labs/devtron/api/userResource"
 	util5 "github.com/devtron-labs/devtron/api/util"
 	webhookHelm "github.com/devtron-labs/devtron/api/webhook/helm"
 	"github.com/devtron-labs/devtron/cel"
@@ -169,6 +170,7 @@ import (
 	workflow3 "github.com/devtron-labs/devtron/pkg/workflow"
 	"github.com/devtron-labs/devtron/pkg/workflow/dag"
 	util2 "github.com/devtron-labs/devtron/util"
+	"github.com/devtron-labs/devtron/util/commonEnforcementFunctionsUtil"
 	cron2 "github.com/devtron-labs/devtron/util/cron"
 	"github.com/devtron-labs/devtron/util/rbac"
 	"github.com/google/wire"
@@ -212,6 +214,7 @@ func InitializeApp() (*App, error) {
 		workflow3.WorkflowWireSet,
 		imageTagging.WireSet,
 		devtronResource.DevtronResourceWireSet,
+		userResource.UserResourceWireSet,
 		policyGovernance.PolicyGovernanceWireSet,
 		resourceScan.ScanningResultWireSet,
 
@@ -495,6 +498,9 @@ func InitializeApp() (*App, error) {
 		rbac.NewEnforcerUtilImpl,
 		wire.Bind(new(rbac.EnforcerUtil), new(*rbac.EnforcerUtilImpl)),
 
+		commonEnforcementFunctionsUtil.NewCommonEnforcementUtilImpl,
+		wire.Bind(new(commonEnforcementFunctionsUtil.CommonEnforcementUtil), new(*commonEnforcementFunctionsUtil.CommonEnforcementUtilImpl)),
+
 		chartConfig.NewPipelineConfigRepository,
 		wire.Bind(new(chartConfig.PipelineConfigRepository), new(*chartConfig.PipelineConfigRepositoryImpl)),
 

api/cluster/EnvironmentRestHandler.go

@@ -23,6 +23,7 @@ import (
 	request "github.com/devtron-labs/devtron/pkg/cluster/environment"
 	bean2 "github.com/devtron-labs/devtron/pkg/cluster/environment/bean"
 	"github.com/devtron-labs/devtron/pkg/cluster/environment/read"
+	"github.com/devtron-labs/devtron/util/commonEnforcementFunctionsUtil"
 	"net/http"
 	"strconv"
 	"strings"
@@ -72,14 +73,16 @@ type EnvironmentRestHandlerImpl struct {
 	deleteService                     delete2.DeleteService
 	k8sUtil                           *k8s2.K8sServiceImpl
 	cfg                               *bean.Config
+	rbacEnforcementUtil               commonEnforcementFunctionsUtil.CommonEnforcementUtil
 }
 
 type ClusterReachableResponse struct {
 	ClusterReachable bool   `json:"clusterReachable"`
 	ClusterName      string `json:"clusterName"`
 }
 
-func NewEnvironmentRestHandlerImpl(svc request.EnvironmentService, environmentReadService read.EnvironmentReadService, logger *zap.SugaredLogger, userService user.UserService, validator *validator.Validate, enforcer casbin.Enforcer, deleteService delete2.DeleteService, k8sUtil *k8s2.K8sServiceImpl, k8sCommonService k8s.K8sCommonService) *EnvironmentRestHandlerImpl {
+func NewEnvironmentRestHandlerImpl(svc request.EnvironmentService, environmentReadService read.EnvironmentReadService, logger *zap.SugaredLogger, userService user.UserService, validator *validator.Validate, enforcer casbin.Enforcer, deleteService delete2.DeleteService, k8sUtil *k8s2.K8sServiceImpl, k8sCommonService k8s.K8sCommonService,
+	rbacEnforcementUtil commonEnforcementFunctionsUtil.CommonEnforcementUtil) *EnvironmentRestHandlerImpl {
 	cfg := &bean.Config{}
 	err := env.Parse(cfg)
 	if err != nil {
@@ -98,6 +101,7 @@ func NewEnvironmentRestHandlerImpl(svc request.EnvironmentService, environmentRe
 		cfg:                               cfg,
 		k8sUtil:                           k8sUtil,
 		k8sCommonService:                  k8sCommonService,
+		rbacEnforcementUtil:               rbacEnforcementUtil,
 	}
 }
 
@@ -318,29 +322,7 @@ func (impl EnvironmentRestHandlerImpl) GetEnvironmentListForAutocomplete(w http.
 	var grantedEnvironment = environments
 	start = time.Now()
 	if !impl.cfg.IgnoreAuthCheck {
-		grantedEnvironment = make([]bean2.EnvironmentBean, 0)
-		// RBAC enforcer applying
-		var envIdentifierList []string
-		for _, item := range environments {
-			envIdentifierList = append(envIdentifierList, strings.ToLower(item.EnvironmentIdentifier))
-		}
-
-		result := impl.enforcer.EnforceInBatch(token, casbin.ResourceGlobalEnvironment, casbin.ActionGet, envIdentifierList)
-		for _, item := range environments {
-
-			var hasAccess bool
-			EnvironmentIdentifier := item.ClusterName + "__" + item.Namespace
-			if item.EnvironmentIdentifier != EnvironmentIdentifier {
-				// fix for futuristic case
-				hasAccess = result[strings.ToLower(EnvironmentIdentifier)] || result[strings.ToLower(item.EnvironmentIdentifier)]
-			} else {
-				hasAccess = result[strings.ToLower(item.EnvironmentIdentifier)]
-			}
-			if hasAccess {
-				grantedEnvironment = append(grantedEnvironment, item)
-			}
-		}
-		//RBAC enforcer Ends
+		grantedEnvironment = impl.rbacEnforcementUtil.CheckAuthorisationForEnvAutocomplete(token, environments)
 	}
 	elapsedTime := time.Since(start)
 	impl.logger.Infow("Env elapsed Time for enforcer", "dbElapsedTime", dbElapsedTime, "elapsedTime",
@@ -358,7 +340,7 @@ func (impl EnvironmentRestHandlerImpl) GetCombinedEnvironmentListForDropDown(w h
 	token := r.Header.Get("token")
 	isActionUserSuperAdmin := impl.enforcer.Enforce(token, casbin.ResourceGlobal, casbin.ActionGet, "*")
 
-	clusters, err := impl.environmentClusterMappingsService.GetCombinedEnvironmentListForDropDown(token, isActionUserSuperAdmin, impl.CheckAuthorizationByEmailInBatchForGlobalEnvironment)
+	clusters, err := impl.environmentClusterMappingsService.GetCombinedEnvironmentListForDropDown(token, isActionUserSuperAdmin, impl.rbacEnforcementUtil.CheckAuthorizationByEmailInBatchForGlobalEnvironment)
 	if err != nil {
 		impl.logger.Errorw("service err, GetCombinedEnvironmentListForDropDown", "err", err)
 		common.WriteJsonResp(w, err, nil, http.StatusInternalServerError)
@@ -370,21 +352,6 @@ func (impl EnvironmentRestHandlerImpl) GetCombinedEnvironmentListForDropDown(w h
 	common.WriteJsonResp(w, err, clusters, http.StatusOK)
 }
 
-func (handler EnvironmentRestHandlerImpl) CheckAuthorizationByEmailInBatchForGlobalEnvironment(token string, object []string) map[string]bool {
-	var objectResult map[string]bool
-	if len(object) > 0 {
-		objectResult = handler.enforcer.EnforceInBatch(token, casbin.ResourceGlobalEnvironment, casbin.ActionGet, object)
-	}
-	return objectResult
-}
-
-func (handler EnvironmentRestHandlerImpl) CheckAuthorizationForGlobalEnvironment(token string, object string) bool {
-	if ok := handler.enforcer.Enforce(token, casbin.ResourceGlobalEnvironment, casbin.ActionGet, object); !ok {
-		return false
-	}
-	return true
-}
-
 func (impl EnvironmentRestHandlerImpl) DeleteEnvironment(w http.ResponseWriter, r *http.Request) {
 	decoder := json.NewDecoder(r.Body)
 	userId, err := impl.userService.GetLoggedInUser(r)
@@ -446,7 +413,7 @@ func (impl EnvironmentRestHandlerImpl) GetCombinedEnvironmentListForDropDownByCl
 		}
 	}
 	token := r.Header.Get("token")
-	clusters, err := impl.environmentClusterMappingsService.GetCombinedEnvironmentListForDropDownByClusterIds(token, clusterIds, impl.CheckAuthorizationForGlobalEnvironment)
+	clusters, err := impl.environmentClusterMappingsService.GetCombinedEnvironmentListForDropDownByClusterIds(token, clusterIds, impl.rbacEnforcementUtil.CheckAuthorizationForGlobalEnvironment)
 	if err != nil {
 		impl.logger.Errorw("service err, GetCombinedEnvironmentListForDropDown", "err", err)
 		common.WriteJsonResp(w, err, nil, http.StatusInternalServerError)

api/restHandler/app/appInfo/AppInfoRestHandler.go

@@ -19,6 +19,7 @@ package appInfo
 import (
 	"encoding/json"
 	client "github.com/devtron-labs/devtron/api/helm-app/service"
+	"github.com/devtron-labs/devtron/util/commonEnforcementFunctionsUtil"
 	"net/http"
 	"strconv"
 	"strings"
@@ -48,31 +49,34 @@ type AppInfoRestHandler interface {
 }
 
 type AppInfoRestHandlerImpl struct {
-	logger             *zap.SugaredLogger
-	appService         app.AppCrudOperationService
-	userAuthService    user.UserService
-	validator          *validator.Validate
-	enforcerUtil       rbac.EnforcerUtil
-	enforcer           casbin.Enforcer
-	helmAppService     client.HelmAppService
-	enforcerUtilHelm   rbac.EnforcerUtilHelm
-	genericNoteService genericNotes.GenericNoteService
+	logger              *zap.SugaredLogger
+	appService          app.AppCrudOperationService
+	userAuthService     user.UserService
+	validator           *validator.Validate
+	enforcerUtil        rbac.EnforcerUtil
+	enforcer            casbin.Enforcer
+	helmAppService      client.HelmAppService
+	enforcerUtilHelm    rbac.EnforcerUtilHelm
+	genericNoteService  genericNotes.GenericNoteService
+	rbacEnforcementUtil commonEnforcementFunctionsUtil.CommonEnforcementUtil
 }
 
 func NewAppInfoRestHandlerImpl(logger *zap.SugaredLogger, appService app.AppCrudOperationService,
 	userAuthService user.UserService, validator *validator.Validate, enforcerUtil rbac.EnforcerUtil,
 	enforcer casbin.Enforcer, helmAppService client.HelmAppService, enforcerUtilHelm rbac.EnforcerUtilHelm,
-	genericNoteService genericNotes.GenericNoteService) *AppInfoRestHandlerImpl {
+	genericNoteService genericNotes.GenericNoteService,
+	rbacEnforcementUtil commonEnforcementFunctionsUtil.CommonEnforcementUtil) *AppInfoRestHandlerImpl {
 	handler := &AppInfoRestHandlerImpl{
-		logger:             logger,
-		appService:         appService,
-		userAuthService:    userAuthService,
-		validator:          validator,
-		enforcerUtil:       enforcerUtil,
-		enforcer:           enforcer,
-		helmAppService:     helmAppService,
-		enforcerUtilHelm:   enforcerUtilHelm,
-		genericNoteService: genericNoteService,
+		logger:              logger,
+		appService:          appService,
+		userAuthService:     userAuthService,
+		validator:           validator,
+		enforcerUtil:        enforcerUtil,
+		enforcer:            enforcer,
+		helmAppService:      helmAppService,
+		enforcerUtilHelm:    enforcerUtilHelm,
+		genericNoteService:  genericNoteService,
+		rbacEnforcementUtil: rbacEnforcementUtil,
 	}
 	return handler
 }
@@ -299,7 +303,6 @@ func (handler AppInfoRestHandlerImpl) GetAppListByTeamIds(w http.ResponseWriter,
 		return
 	}
 	token := r.Header.Get("token")
-	isActionUserSuperAdmin := handler.enforcer.Enforce(token, casbin.ResourceGlobal, casbin.ActionGet, "*")
 
 	appType := v.Get("appType")
 	handler.logger.Infow("request payload, GetAppListByTeamIds", "payload", params)
@@ -321,23 +324,7 @@ func (handler AppInfoRestHandlerImpl) GetAppListByTeamIds(w http.ResponseWriter,
 	}
 
 	// RBAC
-	for _, project := range projectWiseApps {
-		var accessedApps []*app.AppBean
-		for _, app := range project.AppList {
-			if isActionUserSuperAdmin {
-				accessedApps = append(accessedApps, app)
-				continue
-			}
-			object := handler.enforcerUtil.GetAppRBACNameByAppAndProjectName(project.ProjectName, app.Name)
-			if ok := handler.enforcer.Enforce(token, casbin.ResourceApplications, casbin.ActionGet, object); ok {
-				accessedApps = append(accessedApps, app)
-			}
-		}
-		if len(accessedApps) == 0 {
-			accessedApps = make([]*app.AppBean, 0)
-		}
-		project.AppList = accessedApps
-	}
+	projectWiseApps = handler.rbacEnforcementUtil.CheckAuthorisationOnApp(token, projectWiseApps)
 	// RBAC
 	common.WriteJsonResp(w, err, projectWiseApps, http.StatusOK)
 }

api/router/router.go

@@ -44,6 +44,7 @@ import (
 	"github.com/devtron-labs/devtron/api/server"
 	"github.com/devtron-labs/devtron/api/team"
 	terminal2 "github.com/devtron-labs/devtron/api/terminal"
+	"github.com/devtron-labs/devtron/api/userResource"
 	webhookHelm "github.com/devtron-labs/devtron/api/webhook/helm"
 	"github.com/devtron-labs/devtron/client/cron"
 	"github.com/devtron-labs/devtron/client/dashboard"
@@ -122,6 +123,7 @@ type MuxRouter struct {
 	fluxApplicationRouter              fluxApplication2.FluxApplicationRouter
 	devtronResourceRouter              devtronResource.DevtronResourceRouter
 	scanningResultRouter               resourceScan.ScanningResultRouter
+	userResourceRouter                 userResource.Router
 }
 
 func NewMuxRouter(logger *zap.SugaredLogger,
@@ -156,6 +158,7 @@ func NewMuxRouter(logger *zap.SugaredLogger,
 	devtronResourceRouter devtronResource.DevtronResourceRouter,
 	fluxApplicationRouter fluxApplication2.FluxApplicationRouter,
 	scanningResultRouter resourceScan.ScanningResultRouter,
+	userResourceRouter userResource.Router,
 ) *MuxRouter {
 	r := &MuxRouter{
 		Router:                             mux.NewRouter(),
@@ -222,6 +225,7 @@ func NewMuxRouter(logger *zap.SugaredLogger,
 		devtronResourceRouter:              devtronResourceRouter,
 		fluxApplicationRouter:              fluxApplicationRouter,
 		scanningResultRouter:               scanningResultRouter,
+		userResourceRouter:                 userResourceRouter,
 	}
 	return r
 }
@@ -428,6 +432,9 @@ func (r MuxRouter) Init() {
 	devtronResourceRouter := r.Router.PathPrefix("/orchestrator/resource").Subrouter()
 	r.devtronResourceRouter.InitDevtronResourceRouter(devtronResourceRouter)
 
+	userResourcesRouter := r.Router.PathPrefix("/orchestrator/user/resource").Subrouter()
+	r.userResourceRouter.InitUserResourceRouter(userResourcesRouter)
+
 	infraConfigRouter := r.Router.PathPrefix("/orchestrator/infra-config").Subrouter()
 	r.infraConfigRouter.InitInfraConfigRouter(infraConfigRouter)
 

api/userResource/UserResourceRestHandler.go

@@ -0,0 +1,73 @@
+package userResource
+
+import (
+	"encoding/json"
+	"github.com/devtron-labs/devtron/api/restHandler/common"
+	"github.com/devtron-labs/devtron/api/userResource/adapter"
+	apiBean "github.com/devtron-labs/devtron/api/userResource/bean"
+	"github.com/devtron-labs/devtron/pkg/auth/user"
+	"github.com/devtron-labs/devtron/pkg/userResource"
+	"github.com/gorilla/mux"
+	"go.uber.org/zap"
+	"net/http"
+)
+
+type RestHandler interface {
+	GetResourceOptions(w http.ResponseWriter, r *http.Request)
+}
+type RestHandlerImpl struct {
+	logger              *zap.SugaredLogger
+	userService         user.UserService
+	userResourceService userResource.UserResourceService
+}
+
+func NewUserResourceRestHandler(logger *zap.SugaredLogger,
+	userService user.UserService,
+	userResourceService userResource.UserResourceService) *RestHandlerImpl {
+	return &RestHandlerImpl{
+		logger:              logger,
+		userService:         userService,
+		userResourceService: userResourceService,
+	}
+}
+
+func (handler *RestHandlerImpl) GetResourceOptions(w http.ResponseWriter, r *http.Request) {
+	userId, err := handler.userService.GetLoggedInUser(r)
+	if userId == 0 || err != nil {
+		common.WriteJsonResp(w, err, "Unauthorized User", http.StatusUnauthorized)
+		return
+	}
+
+	pathParams, caughtError := decodePathParams(w, r)
+	if caughtError {
+		return
+	}
+	decoder := json.NewDecoder(r.Body)
+	var reqBean apiBean.ResourceOptionsReqDto
+	err = decoder.Decode(&reqBean)
+	if err != nil {
+		handler.logger.Errorw("error in decoding request body", "err", err, "requestBody", r.Body)
+		common.WriteJsonResp(w, err, nil, http.StatusBadRequest)
+		return
+	}
+	token := r.Header.Get("token")
+	// rbac enforcement is managed at service level based on entity and kind
+	data, err := handler.userResourceService.GetResourceOptions(r.Context(), token, &reqBean, pathParams)
+	if err != nil {
+		handler.logger.Errorw("service error, GetResourceOptions", "err", err)
+		common.WriteJsonResp(w, err, nil, http.StatusInternalServerError)
+		return
+	}
+
+	common.WriteJsonResp(w, err, data, http.StatusOK)
+	return
+
+}
+
+func decodePathParams(w http.ResponseWriter, r *http.Request) (pathParams *apiBean.PathParams, caughtError bool) {
+	vars := mux.Vars(r)
+	kindVar := vars[apiBean.PathParamKind]
+	versionVar := vars[apiBean.PathParamVersion]
+	pathParams = adapter.BuildPathParams(kindVar, versionVar)
+	return pathParams, caughtError
+}

api/userResource/UserResourceRouter.go

@@ -0,0 +1,23 @@
+package userResource
+
+import "github.com/gorilla/mux"
+
+type Router interface {
+	InitUserResourceRouter(userResourceRouter *mux.Router)
+}
+
+type RouterImpl struct {
+	restHandler RestHandler
+}
+
+func NewUserResourceRouterImpl(restHandler RestHandler) *RouterImpl {
+	return &RouterImpl{
+		restHandler: restHandler,
+	}
+}
+
+func (router *RouterImpl) InitUserResourceRouter(userResourceRouter *mux.Router) {
+	userResourceRouter.Path("/options/{kind:[a-zA-Z0-9/-]+}/{version:[a-zA-Z0-9]+}").
+		HandlerFunc(router.restHandler.GetResourceOptions).Methods("POST")
+
+}

api/userResource/adapter/adapter.go

@@ -0,0 +1,12 @@
+package adapter
+
+import (
+	"github.com/devtron-labs/devtron/api/userResource/bean"
+)
+
+func BuildPathParams(kind, version string) *bean.PathParams {
+	return &bean.PathParams{
+		Kind:    kind,
+		Version: version,
+	}
+}