diff --git a/CHANGELOG.md b/CHANGELOG.md index 53688b3..2f10125 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,10 @@ All notable changes to this project will be documented in this file. ## Unreleased +## Fixed + +- Fixed creating project scoped role failed from cli [niravparikh05](https://github.com/niravparikh05) + ## [0.1.5] - 2022-10-10 ## Fixed diff --git a/internal/dao/role.go b/internal/dao/role.go index ed528f3..1579bcc 100644 --- a/internal/dao/role.go +++ b/internal/dao/role.go @@ -38,3 +38,16 @@ func GetRolePermissionsByScope(ctx context.Context, db bun.IDB, scope string) ([ } return r, nil } + +func GetRolePermissionsByNames(ctx context.Context, db bun.IDB, permissions ...string) ([]models.ResourcePermission, error) { + var r = []models.ResourcePermission{} + err := db.NewSelect().Table("authsrv_resourcepermission"). + ColumnExpr("authsrv_resourcepermission.name as name, authsrv_resourcepermission.description as description, authsrv_resourcepermission.scope as scope"). + Where("name IN (?)", bun.In(permissions)). + Where("authsrv_resourcepermission.trash = ?", false). + Scan(ctx, &r) + if err != nil { + return nil, err + } + return r, nil +} diff --git a/pkg/service/audit_utils.go b/pkg/service/audit_utils.go index 5d21d81..019b11c 100644 --- a/pkg/service/audit_utils.go +++ b/pkg/service/audit_utils.go @@ -444,7 +444,7 @@ func RevokeKubeconfigAuditEvent(ctx context.Context, al *zap.Logger, user string } } -func CreateClusterAuditEvent(ctx context.Context, al *zap.Logger, action string, name string, id uuid.UUID) { +func CreateClusterAuditEvent(ctx context.Context, al *zap.Logger, action string, name string, id uuid.UUID, project string) { sd, ok := GetSessionDataFromContext(ctx) if !ok { _log.Warn("unable to create audit event: could not fetch info from context") @@ -457,7 +457,7 @@ func CreateClusterAuditEvent(ctx context.Context, al *zap.Logger, action string, "cluster_name": name, }, } - if err := audit.CreateV1Event(al, sd, detail, fmt.Sprintf("cluster.%s.success", action), ""); err != nil { + if err := audit.CreateV1Event(al, sd, detail, fmt.Sprintf("cluster.%s.success", action), project); err != nil { _log.Warn("unable to create audit event", err) } } diff --git a/pkg/service/cluster.go b/pkg/service/cluster.go index 87a1cb1..2c1c6cc 100644 --- a/pkg/service/cluster.go +++ b/pkg/service/cluster.go @@ -299,7 +299,7 @@ func (s *clusterService) Create(ctx context.Context, cluster *infrav3.Cluster) ( h.OnChange(ev) } - CreateClusterAuditEvent(ctx, s.al, AuditActionCreate, clusterResp.GetMetadata().GetName(), edb.ID) + CreateClusterAuditEvent(ctx, s.al, AuditActionCreate, clusterResp.GetMetadata().GetName(), edb.ID, cluster.Metadata.Project) return clusterResp, nil } @@ -598,13 +598,14 @@ func (s *clusterService) Update(ctx context.Context, cluster *infrav3.Cluster) ( h.OnChange(ev) }*/ - CreateClusterAuditEvent(ctx, s.al, AuditActionUpdate, cluster.GetMetadata().GetName(), cdb.ID) + CreateClusterAuditEvent(ctx, s.al, AuditActionUpdate, cluster.GetMetadata().GetName(), cdb.ID, cluster.Metadata.Project) return cluster, nil } func (s *clusterService) Delete(ctx context.Context, cluster *infrav3.Cluster) error { + projectName := cluster.Metadata.Project cluster, err := s.Get(ctx, func(qo *commonv3.QueryOptions) { qo.Name = cluster.Metadata.Name qo.Project = cluster.Metadata.Project @@ -646,7 +647,7 @@ func (s *clusterService) Delete(ctx context.Context, cluster *infrav3.Cluster) e id, err := uuid.Parse(clusterId) if err == nil { - CreateClusterAuditEvent(ctx, s.al, AuditActionDelete, cluster.GetMetadata().GetName(), id) + CreateClusterAuditEvent(ctx, s.al, AuditActionDelete, cluster.GetMetadata().GetName(), id, projectName) } return nil diff --git a/pkg/service/rolepermission.go b/pkg/service/rolepermission.go index d471d05..74fb55d 100644 --- a/pkg/service/rolepermission.go +++ b/pkg/service/rolepermission.go @@ -92,6 +92,13 @@ func (s *rolepermissionService) List(ctx context.Context, opts ...query.Option) } rles = append(rles, rps...) } + // add partner and organization read roles as it is organization scoped yet required by all + rps, err := dao.GetRolePermissionsByNames(ctx, s.db, partnerR, organizationR) + if err != nil { + return rolepermissionList, err + } + rles = append(rles, rps...) + for _, rle := range rles { entry := &rolev3.RolePermission{} entry = s.toV3Rolepermission(entry, &rle) diff --git a/pkg/service/rolepermission_test.go b/pkg/service/rolepermission_test.go index d99d473..2b5900a 100644 --- a/pkg/service/rolepermission_test.go +++ b/pkg/service/rolepermission_test.go @@ -76,6 +76,10 @@ func TestRolePermissionListWithSelectors(t *testing.T) { WithArgs().WillReturnRows(sqlmock.NewRows([]string{"id", "name"}). AddRow(ruuid2, "role-"+ruuid2)) + mock.ExpectQuery(`SELECT authsrv_resourcepermission.name as name, authsrv_resourcepermission.description as description, authsrv_resourcepermission.scope as scope FROM "authsrv_resourcepermission" WHERE \(name IN \('partner.read', 'organization.read'\)\) AND \(authsrv_resourcepermission.trash = FALSE\)`). + WithArgs().WillReturnRows(sqlmock.NewRows([]string{"id", "name"}). + AddRow(ruuid2, "role-"+ruuid2).AddRow(ruuid1, "role-"+ruuid1)) + req := &commonv3.QueryOptions{ Partner: "partner-" + puuid, Organization: "org-" + ouuid, @@ -85,7 +89,7 @@ func TestRolePermissionListWithSelectors(t *testing.T) { if err != nil { t.Fatal("could not list rolepermissions:", err) } - if rolelist.Metadata.Count != 2 { + if rolelist.Metadata.Count != 4 { t.Errorf("incorrect number of rolepermissions returned, expected 2; got %v", rolelist.Metadata.Count) } if rolelist.Items[0].Metadata.Name != "role-"+ruuid1 || rolelist.Items[1].Metadata.Name != "role-"+ruuid2 {