Skip to content

Commit 200711f

Browse files
iamayushmiamayushm
committed
correcting rbac call for futuristic case
1 parent 6c405f2 commit 200711f

File tree

7 files changed

+106
-55
lines changed

7 files changed

+106
-55
lines changed

‎api/appStore/deployment/AppStoreDeploymentRestHandler.go‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -215,7 +215,7 @@ func (handler AppStoreDeploymentRestHandlerImpl) GetInstalledAppsByAppStoreId(w
215215
var rbacObject string
216216
var rbacObject2 string
217217
if util2.IsHelmApp(app.AppOfferingMode) {
218-
rbacObject = handler.enforcerUtilHelm.GetHelmObject(app.ClusterId, app.Namespace, app.AppName)
218+
rbacObject, rbacObject2 = handler.enforcerUtilHelm.GetHelmObject(app.ClusterId, app.Namespace, app.AppName)
219219
} else {
220220
rbacObject, rbacObject2 = handler.enforcerUtil.GetHelmObjectByAppNameAndEnvId(app.AppName, app.EnvironmentId)
221221
}
@@ -276,7 +276,7 @@ func (handler AppStoreDeploymentRestHandlerImpl) DeleteInstalledApp(w http.Respo
276276
var rbacObject string
277277
var rbacObject2 string
278278
if util2.IsHelmApp(installedApp.AppOfferingMode) {
279-
rbacObject = handler.enforcerUtilHelm.GetHelmObject(installedApp.ClusterId, installedApp.Namespace, installedApp.AppName)
279+
rbacObject, rbacObject2 = handler.enforcerUtilHelm.GetHelmObject(installedApp.ClusterId, installedApp.Namespace, installedApp.AppName)
280280
} else {
281281
rbacObject, rbacObject2 = handler.enforcerUtil.GetHelmObjectByAppNameAndEnvId(installedApp.AppName, installedApp.EnvironmentId)
282282
}
@@ -409,7 +409,7 @@ func (handler AppStoreDeploymentRestHandlerImpl) UpdateInstalledApp(w http.Respo
409409
var rbacObject string
410410
var rbacObject2 string
411411
if util2.IsHelmApp(installedApp.AppOfferingMode) {
412-
rbacObject = handler.enforcerUtilHelm.GetHelmObject(installedApp.ClusterId, installedApp.Namespace, installedApp.AppName)
412+
rbacObject, rbacObject2 = handler.enforcerUtilHelm.GetHelmObject(installedApp.ClusterId, installedApp.Namespace, installedApp.AppName)
413413
} else {
414414
rbacObject, rbacObject2 = handler.enforcerUtil.GetHelmObject(installedApp.AppId, installedApp.EnvironmentId)
415415
}
@@ -491,7 +491,7 @@ func (handler AppStoreDeploymentRestHandlerImpl) GetInstalledAppVersion(w http.R
491491
var rbacObject string
492492
var rbacObject2 string
493493
if util2.IsHelmApp(dto.AppOfferingMode) {
494-
rbacObject = handler.enforcerUtilHelm.GetHelmObject(dto.ClusterId, dto.Namespace, dto.AppName)
494+
rbacObject, rbacObject2 = handler.enforcerUtilHelm.GetHelmObject(dto.ClusterId, dto.Namespace, dto.AppName)
495495
} else {
496496
rbacObject, rbacObject2 = handler.enforcerUtil.GetHelmObjectByAppNameAndEnvId(dto.AppName, dto.EnvironmentId)
497497
}
@@ -543,9 +543,9 @@ func (handler AppStoreDeploymentRestHandlerImpl) UpdateProjectHelmApp(w http.Res
543543

544544
// this rbac object checks that whether user have permission to change current project.
545545

546-
rbacObjectForCurrentProject := handler.enforcerUtilHelm.GetHelmObject(appIdentifier.ClusterId, appIdentifier.Namespace, appIdentifier.ReleaseName)
546+
rbacObjectForCurrentProject, rbacObjectForCurrentProject2 := handler.enforcerUtilHelm.GetHelmObject(appIdentifier.ClusterId, appIdentifier.Namespace, appIdentifier.ReleaseName)
547547

548-
ok := handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionUpdate, rbacObjectForCurrentProject)
548+
ok := handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionUpdate, rbacObjectForCurrentProject) || handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionUpdate, rbacObjectForCurrentProject2)
549549

550550
if !ok {
551551
common.WriteJsonResp(w, fmt.Errorf("unauthorized user"), nil, http.StatusForbidden)
@@ -569,9 +569,9 @@ func (handler AppStoreDeploymentRestHandlerImpl) UpdateProjectHelmApp(w http.Res
569569
common.WriteJsonResp(w, fmt.Errorf("Unable to fetch installed app version details"), nil, http.StatusBadRequest)
570570
}
571571

572-
rbacObjectCurrentForCurrentProject := handler.enforcerUtilHelm.GetHelmObject(installedApp.ClusterId, installedApp.Namespace, installedApp.AppName)
572+
rbacObjectCurrentForCurrentProject, rbacObjectCurrentForCurrentProject2 := handler.enforcerUtilHelm.GetHelmObject(installedApp.ClusterId, installedApp.Namespace, installedApp.AppName)
573573

574-
ok := handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionUpdate, rbacObjectCurrentForCurrentProject)
574+
ok := handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionUpdate, rbacObjectCurrentForCurrentProject) || handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionUpdate, rbacObjectCurrentForCurrentProject2)
575575

576576
if !ok {
577577
common.WriteJsonResp(w, fmt.Errorf("unauthorized user"), nil, http.StatusForbidden)

‎api/appStore/deployment/CommonDeploymentRestHandler.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -147,7 +147,7 @@ func (handler *CommonDeploymentRestHandlerImpl) GetDeploymentHistory(w http.Resp
147147
var rbacObject2 string
148148
token := r.Header.Get("token")
149149
if util2.IsHelmApp(appOfferingMode) {
150-
rbacObject = handler.enforcerUtilHelm.GetHelmObject(installedAppDto.ClusterId, installedAppDto.Namespace, installedAppDto.AppName)
150+
rbacObject, rbacObject2 = handler.enforcerUtilHelm.GetHelmObject(installedAppDto.ClusterId, installedAppDto.Namespace, installedAppDto.AppName)
151151
} else {
152152
rbacObject, rbacObject2 = handler.enforcerUtil.GetHelmObjectByAppNameAndEnvId(installedAppDto.AppName, installedAppDto.EnvironmentId)
153153
}
@@ -201,7 +201,7 @@ func (handler *CommonDeploymentRestHandlerImpl) GetDeploymentHistoryValues(w htt
201201
var rbacObject2 string
202202
token := r.Header.Get("token")
203203
if util2.IsHelmApp(appOfferingMode) {
204-
rbacObject = handler.enforcerUtilHelm.GetHelmObject(installedAppDto.ClusterId, installedAppDto.Namespace, installedAppDto.AppName)
204+
rbacObject, rbacObject2 = handler.enforcerUtilHelm.GetHelmObject(installedAppDto.ClusterId, installedAppDto.Namespace, installedAppDto.AppName)
205205
} else {
206206
rbacObject, rbacObject2 = handler.enforcerUtil.GetHelmObjectByAppNameAndEnvId(installedAppDto.AppName, installedAppDto.EnvironmentId)
207207
}
@@ -269,7 +269,7 @@ func (handler *CommonDeploymentRestHandlerImpl) RollbackApplication(w http.Respo
269269
var rbacObject2 string
270270
token := r.Header.Get("token")
271271
if util2.IsHelmApp(appOfferingMode) {
272-
rbacObject = handler.enforcerUtilHelm.GetHelmObject(installedAppDto.ClusterId, installedAppDto.Namespace, installedAppDto.AppName)
272+
rbacObject, rbacObject2 = handler.enforcerUtilHelm.GetHelmObject(installedAppDto.ClusterId, installedAppDto.Namespace, installedAppDto.AppName)
273273
} else {
274274
rbacObject, rbacObject2 = handler.enforcerUtil.GetHelmObjectByAppNameAndEnvId(installedAppDto.AppName, installedAppDto.EnvironmentId)
275275
}

‎api/helm-app/HelmAppRestHandler.go‎

Lines changed: 18 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -100,9 +100,12 @@ func (handler *HelmAppRestHandlerImpl) GetApplicationDetail(w http.ResponseWrite
100100
return
101101
}
102102
// RBAC enforcer applying
103-
rbacObject := handler.enforcerUtil.GetHelmObject(appIdentifier.ClusterId, appIdentifier.Namespace, appIdentifier.ReleaseName)
103+
rbacObject, rbacObject2 := handler.enforcerUtil.GetHelmObject(appIdentifier.ClusterId, appIdentifier.Namespace, appIdentifier.ReleaseName)
104104
token := r.Header.Get("token")
105-
if ok := handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionGet, rbacObject); !ok {
105+
106+
ok := handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionGet, rbacObject) || handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionGet, rbacObject2)
107+
108+
if !ok {
106109
common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
107110
return
108111
}
@@ -142,9 +145,10 @@ func (handler *HelmAppRestHandlerImpl) Hibernate(w http.ResponseWriter, r *http.
142145
}
143146

144147
// RBAC enforcer applying
145-
rbacObject := handler.enforcerUtil.GetHelmObject(appIdentifier.ClusterId, appIdentifier.Namespace, appIdentifier.ReleaseName)
148+
rbacObject, rbacObject2 := handler.enforcerUtil.GetHelmObject(appIdentifier.ClusterId, appIdentifier.Namespace, appIdentifier.ReleaseName)
146149
token := r.Header.Get("token")
147-
if ok := handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionUpdate, rbacObject); !ok {
150+
ok := handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionUpdate, rbacObject) || handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionUpdate, rbacObject2)
151+
if !ok {
148152
common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
149153
return
150154
}
@@ -171,9 +175,12 @@ func (handler *HelmAppRestHandlerImpl) UnHibernate(w http.ResponseWriter, r *htt
171175
return
172176
}
173177
// RBAC enforcer applying
174-
rbacObject := handler.enforcerUtil.GetHelmObject(appIdentifier.ClusterId, appIdentifier.Namespace, appIdentifier.ReleaseName)
178+
rbacObject, rbacObject2 := handler.enforcerUtil.GetHelmObject(appIdentifier.ClusterId, appIdentifier.Namespace, appIdentifier.ReleaseName)
175179
token := r.Header.Get("token")
176-
if ok := handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionUpdate, rbacObject); !ok {
180+
181+
ok := handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionUpdate, rbacObject) || handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionUpdate, rbacObject2)
182+
183+
if !ok {
177184
common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
178185
return
179186
}
@@ -195,9 +202,12 @@ func (handler *HelmAppRestHandlerImpl) GetReleaseInfo(w http.ResponseWriter, r *
195202
return
196203
}
197204
// RBAC enforcer applying
198-
rbacObject := handler.enforcerUtil.GetHelmObject(appIdentifier.ClusterId, appIdentifier.Namespace, appIdentifier.ReleaseName)
205+
rbacObject, rbacObject2 := handler.enforcerUtil.GetHelmObject(appIdentifier.ClusterId, appIdentifier.Namespace, appIdentifier.ReleaseName)
199206
token := r.Header.Get("token")
200-
if ok := handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionGet, rbacObject); !ok {
207+
208+
ok := handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionGet, rbacObject) || handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionGet, rbacObject2)
209+
210+
if !ok {
201211
common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
202212
return
203213
}

‎api/helm-app/HelmAppService.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -754,8 +754,8 @@ func (impl *HelmAppServiceImpl) appListRespProtoTransformer(deployedApps *Deploy
754754
ClusterId: &deployedapp.EnvironmentDetail.ClusterId,
755755
},
756756
}
757-
rbacObject := impl.enforcerUtil.GetHelmObject(int(deployedapp.EnvironmentDetail.ClusterId), deployedapp.EnvironmentDetail.Namespace, deployedapp.AppName)
758-
isValidAuth := helmAuth(token, rbacObject)
757+
rbacObject, rbacObject2 := impl.enforcerUtil.GetHelmObject(int(deployedapp.EnvironmentDetail.ClusterId), deployedapp.EnvironmentDetail.Namespace, deployedapp.AppName)
758+
isValidAuth := helmAuth(token, rbacObject) || helmAuth(token, rbacObject2)
759759
if isValidAuth {
760760
HelmApps = append(HelmApps, helmApp)
761761
}

‎api/restHandler/AppRestHandler.go‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -151,9 +151,10 @@ func (handler AppRestHandlerImpl) GetHelmAppMetaInfo(w http.ResponseWriter, r *h
151151
return
152152
}
153153

154-
object := handler.enforcerUtilHelm.GetHelmObject(appIdDecoded.ClusterId, appIdDecoded.Namespace, appIdDecoded.ReleaseName)
154+
object, object2 := handler.enforcerUtilHelm.GetHelmObject(appIdDecoded.ClusterId, appIdDecoded.Namespace, appIdDecoded.ReleaseName)
155155

156-
if ok := handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionGet, object); !ok {
156+
ok := handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionGet, object) || handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionGet, object2)
157+
if !ok {
157158
common.WriteJsonResp(w, err, "Unauthorized User", http.StatusForbidden)
158159
return
159160
}
@@ -162,8 +163,17 @@ func (handler AppRestHandlerImpl) GetHelmAppMetaInfo(w http.ResponseWriter, r *h
162163

163164
appId, err := strconv.Atoi(appIdReq)
164165

165-
object := handler.enforcerUtilHelm.GetAppRBACNameByInstalledAppId(appId)
166-
if ok := handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionGet, object); !ok {
166+
var ok bool
167+
168+
object, object2 := handler.enforcerUtilHelm.GetAppRBACNameByInstalledAppId(appId)
169+
170+
if object2 == "" {
171+
ok = handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionGet, object)
172+
} else {
173+
ok = handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionGet, object) || handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionGet, object2)
174+
}
175+
176+
if !ok {
167177
common.WriteJsonResp(w, err, "Unauthorized User", http.StatusForbidden)
168178
return
169179
}

‎util/k8s/k8sApplicationRestHandler.go‎

Lines changed: 34 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -91,9 +91,10 @@ func (handler *K8sApplicationRestHandlerImpl) GetResource(w http.ResponseWriter,
9191
}
9292

9393
// RBAC enforcer applying
94-
rbacObject := handler.enforcerUtil.GetHelmObject(request.AppIdentifier.ClusterId, request.AppIdentifier.Namespace, request.AppIdentifier.ReleaseName)
94+
rbacObject, rbacObject2 := handler.enforcerUtil.GetHelmObject(request.AppIdentifier.ClusterId, request.AppIdentifier.Namespace, request.AppIdentifier.ReleaseName)
9595
token := r.Header.Get("token")
96-
if ok := handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionGet, rbacObject); !ok {
96+
ok := handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionGet, rbacObject) || handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionGet, rbacObject2)
97+
if !ok {
9798
common.WriteJsonResp(w, errors2.New("unauthorized"), nil, http.StatusForbidden)
9899
return
99100
}
@@ -134,9 +135,12 @@ func (handler *K8sApplicationRestHandlerImpl) GetHostUrlsByBatch(w http.Response
134135
return
135136
}
136137
// RBAC enforcer applying
137-
rbacObject := handler.enforcerUtil.GetHelmObject(appIdentifier.ClusterId, appIdentifier.Namespace, appIdentifier.ReleaseName)
138+
rbacObject, rbacObject2 := handler.enforcerUtil.GetHelmObject(appIdentifier.ClusterId, appIdentifier.Namespace, appIdentifier.ReleaseName)
138139
token := r.Header.Get("token")
139-
if ok := handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionGet, rbacObject); !ok {
140+
141+
ok := handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionGet, rbacObject) || handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionGet, rbacObject2)
142+
143+
if !ok {
140144
common.WriteJsonResp(w, fmt.Errorf("unauthorized"), nil, http.StatusForbidden)
141145
return
142146
}
@@ -195,9 +199,10 @@ func (handler *K8sApplicationRestHandlerImpl) CreateResource(w http.ResponseWrit
195199
//setting appIdentifier value in request
196200
request.AppIdentifier = appIdentifier
197201
// RBAC enforcer applying
198-
rbacObject := handler.enforcerUtil.GetHelmObject(request.AppIdentifier.ClusterId, request.AppIdentifier.Namespace, request.AppIdentifier.ReleaseName)
202+
rbacObject, rbacObject2 := handler.enforcerUtil.GetHelmObject(request.AppIdentifier.ClusterId, request.AppIdentifier.Namespace, request.AppIdentifier.ReleaseName)
199203
token := r.Header.Get("token")
200-
if ok := handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionUpdate, rbacObject); !ok {
204+
ok := handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionUpdate, rbacObject) || handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionUpdate, rbacObject2)
205+
if !ok {
201206
common.WriteJsonResp(w, errors2.New("unauthorized"), nil, http.StatusForbidden)
202207
return
203208
}
@@ -235,9 +240,10 @@ func (handler *K8sApplicationRestHandlerImpl) UpdateResource(w http.ResponseWrit
235240
return
236241
}
237242
// RBAC enforcer applying
238-
rbacObject := handler.enforcerUtil.GetHelmObject(request.AppIdentifier.ClusterId, request.AppIdentifier.Namespace, request.AppIdentifier.ReleaseName)
243+
rbacObject, rbacObject2 := handler.enforcerUtil.GetHelmObject(request.AppIdentifier.ClusterId, request.AppIdentifier.Namespace, request.AppIdentifier.ReleaseName)
239244
token := r.Header.Get("token")
240-
if ok := handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionUpdate, rbacObject); !ok {
245+
ok := handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionUpdate, rbacObject) || handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionUpdate, rbacObject2)
246+
if !ok {
241247
common.WriteJsonResp(w, errors2.New("unauthorized"), nil, http.StatusForbidden)
242248
return
243249
}
@@ -275,9 +281,12 @@ func (handler *K8sApplicationRestHandlerImpl) DeleteResource(w http.ResponseWrit
275281
return
276282
}
277283
// RBAC enforcer applying
278-
rbacObject := handler.enforcerUtil.GetHelmObject(request.AppIdentifier.ClusterId, request.AppIdentifier.Namespace, request.AppIdentifier.ReleaseName)
284+
rbacObject, rbacObject2 := handler.enforcerUtil.GetHelmObject(request.AppIdentifier.ClusterId, request.AppIdentifier.Namespace, request.AppIdentifier.ReleaseName)
279285
token := r.Header.Get("token")
280-
if ok := handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionDelete, rbacObject); !ok {
286+
287+
ok := handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionDelete, rbacObject) || handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionDelete, rbacObject2)
288+
289+
if !ok {
281290
common.WriteJsonResp(w, errors2.New("unauthorized"), nil, http.StatusForbidden)
282291
return
283292
}
@@ -315,9 +324,12 @@ func (handler *K8sApplicationRestHandlerImpl) ListEvents(w http.ResponseWriter,
315324
return
316325
}
317326
// RBAC enforcer applying
318-
rbacObject := handler.enforcerUtil.GetHelmObject(request.AppIdentifier.ClusterId, request.AppIdentifier.Namespace, request.AppIdentifier.ReleaseName)
327+
rbacObject, rbacObject2 := handler.enforcerUtil.GetHelmObject(request.AppIdentifier.ClusterId, request.AppIdentifier.Namespace, request.AppIdentifier.ReleaseName)
319328
token := r.Header.Get("token")
320-
if ok := handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionGet, rbacObject); !ok {
329+
330+
ok := handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionGet, rbacObject) || handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionGet, rbacObject2)
331+
332+
if !ok {
321333
common.WriteJsonResp(w, errors2.New("unauthorized"), nil, http.StatusForbidden)
322334
return
323335
}
@@ -379,9 +391,12 @@ func (handler *K8sApplicationRestHandlerImpl) GetPodLogs(w http.ResponseWriter,
379391
return
380392
}
381393
// RBAC enforcer applying
382-
rbacObject := handler.enforcerUtil.GetHelmObject(request.AppIdentifier.ClusterId, request.AppIdentifier.Namespace, request.AppIdentifier.ReleaseName)
394+
rbacObject, rbacObject2 := handler.enforcerUtil.GetHelmObject(request.AppIdentifier.ClusterId, request.AppIdentifier.Namespace, request.AppIdentifier.ReleaseName)
383395
token := r.Header.Get("token")
384-
if ok := handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionGet, rbacObject); !ok {
396+
397+
ok := handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionGet, rbacObject) || handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionGet, rbacObject2)
398+
399+
if !ok {
385400
common.WriteJsonResp(w, errors2.New("unauthorized"), nil, http.StatusForbidden)
386401
return
387402
}
@@ -422,9 +437,12 @@ func (handler *K8sApplicationRestHandlerImpl) GetTerminalSession(w http.Response
422437
request.ClusterId = app.ClusterId
423438

424439
// RBAC enforcer applying
425-
rbacObject := handler.enforcerUtil.GetHelmObject(app.ClusterId, app.Namespace, app.ReleaseName)
440+
rbacObject, rbacObject2 := handler.enforcerUtil.GetHelmObject(app.ClusterId, app.Namespace, app.ReleaseName)
426441
token := r.Header.Get("token")
427-
if ok := handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionGet, rbacObject); !ok {
442+
443+
ok := handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionGet, rbacObject) || handler.enforcer.Enforce(token, casbin.ResourceHelmApp, casbin.ActionGet, rbacObject2)
444+
445+
if !ok {
428446
common.WriteJsonResp(w, errors2.New("unauthorized"), nil, http.StatusForbidden)
429447
return
430448
}

0 commit comments

Comments
 (0)