Skip to content

Add canI checks to editors #956

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Nov 30, 2016
Merged

Add canI checks to editors #956

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 10 additions & 2 deletions app/scripts/controllers/addConfigVolume.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ angular.module('openshiftConsole')
$scope,
$window,
APIService,
AuthorizationService,
BreadcrumbsService,
DataService,
Navigate,
Expand Down Expand Up @@ -95,6 +96,12 @@ angular.module('openshiftConsole')
.then(_.spread(function(project, context) {
$scope.project = project;

if (!AuthorizationService.canI(resourceGroupVersion, 'update', $routeParams.project)) {
Navigate.toErrorPage('You do not have authority to update ' +
humanizeKind($routeParams.kind) + ' ' + $routeParams.name + '.', 'access_denied');
return;
}

var orderByDisplayName = $filter('orderByDisplayName');
var getErrorDetails = $filter('getErrorDetails');
var generateName = $filter('generateName');
Expand Down Expand Up @@ -125,17 +132,18 @@ angular.module('openshiftConsole')
DataService.list("configmaps", context, null, { errorNotification: false }).then(function(configMapData) {
$scope.configMaps = orderByDisplayName(configMapData.by("metadata.name"));
}, function(e) {
if (e.status === 403) {
if (e.code === 403) {
$scope.configMaps = [];
return;
}

displayError('Could not load config maps', getErrorDetails(e));
});

DataService.list("secrets", context, null, { errorNotification: false }).then(function(secretData) {
$scope.secrets = orderByDisplayName(secretData.by("metadata.name"));
}, function(e) {
if (e.status === 403) {
if (e.code === 403) {
$scope.secrets = [];
return;
}
Expand Down
28 changes: 18 additions & 10 deletions app/scripts/controllers/attachPVC.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,16 +8,18 @@
* Controller of the openshiftConsole
*/
angular.module('openshiftConsole')
.controller('AttachPVCController', function($filter,
$routeParams,
$scope,
$window,
APIService,
BreadcrumbsService,
DataService,
Navigate,
ProjectsService,
StorageService) {
.controller('AttachPVCController',
function($filter,
$routeParams,
$scope,
$window,
APIService,
AuthorizationService,
BreadcrumbsService,
DataService,
Navigate,
ProjectsService,
StorageService) {
if (!$routeParams.kind || !$routeParams.name) {
Navigate.toErrorPage("Kind or name parameter missing.");
return;
Expand Down Expand Up @@ -73,6 +75,12 @@ angular.module('openshiftConsole')
// Update project breadcrumb with display name.
$scope.breadcrumbs[0].title = $filter('displayName')(project);

if (!AuthorizationService.canI(resourceGroupVersion, 'update', $routeParams.project)) {
Navigate.toErrorPage('You do not have authority to update ' +
$filter('humanizeKind')($routeParams.kind) + ' ' + $routeParams.name + '.', 'access_denied');
return;
}

var orderByDisplayName = $filter('orderByDisplayName');
var getErrorDetails = $filter('getErrorDetails');
var generateName = $filter('generateName');
Expand Down
6 changes: 6 additions & 0 deletions app/scripts/controllers/createConfigMap.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ angular.module('openshiftConsole')
$routeParams,
$scope,
$window,
AuthorizationService,
DataService,
Navigate,
ProjectsService) {
Expand Down Expand Up @@ -41,6 +42,11 @@ angular.module('openshiftConsole')
// Update project breadcrumb with display name.
$scope.breadcrumbs[0].title = $filter('displayName')(project);

if (!AuthorizationService.canI('configmaps', 'create', $routeParams.project)) {
Navigate.toErrorPage('You do not have authority to create config maps in project ' + $routeParams.project + '.', 'access_denied');
return;
}

$scope.configMap = {
apiVersion: 'v1',
kind: 'ConfigMap',
Expand Down
17 changes: 16 additions & 1 deletion app/scripts/controllers/createPersistentVolumeClaim.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,17 @@
* Controller of the openshiftConsole
*/
angular.module('openshiftConsole')
.controller('CreatePersistentVolumeClaimController', function ($filter, $routeParams, $scope, $window, ApplicationGenerator, DataService, Navigate, ProjectsService,keyValueEditorUtils) {
.controller('CreatePersistentVolumeClaimController',
function($filter,
$routeParams,
$scope,
$window,
ApplicationGenerator,
AuthorizationService,
DataService,
Navigate,
ProjectsService,
keyValueEditorUtils) {
$scope.alerts = {};
$scope.projectName = $routeParams.project;
$scope.accessModes="ReadWriteOnce";
Expand All @@ -35,6 +45,11 @@ angular.module('openshiftConsole')
// Update project breadcrumb with display name.
$scope.breadcrumbs[0].title = $filter('displayName')(project);

if (!AuthorizationService.canI('persistentvolumeclaims', 'create', $routeParams.project)) {
Navigate.toErrorPage('You do not have authority to create persistent volume claims in project ' + $routeParams.project + '.', 'access_denied');
return;
}

$scope.createPersistentVolumeClaim = function() {
if ($scope.createPersistentVolumeClaimForm.$valid) {
$scope.disableInputs = true;
Expand Down
16 changes: 15 additions & 1 deletion app/scripts/controllers/createRoute.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,16 @@
* Controller of the openshiftConsole
*/
angular.module('openshiftConsole')
.controller('CreateRouteController', function ($filter, $routeParams, $scope, $window, ApplicationGenerator, DataService, Navigate, ProjectsService) {
.controller('CreateRouteController',
function($filter,
$routeParams,
$scope,
$window,
ApplicationGenerator,
AuthorizationService,
DataService,
Navigate,
ProjectsService) {
$scope.alerts = {};
$scope.renderOptions = {
hideFilterWidget: true
Expand Down Expand Up @@ -42,6 +51,11 @@ angular.module('openshiftConsole')
// Update project breadcrumb with display name.
$scope.breadcrumbs[0].title = $filter('displayName')(project);

if (!AuthorizationService.canI('routes', 'create', $routeParams.project)) {
Navigate.toErrorPage('You do not have authority to create routes in project ' + $routeParams.project + '.', 'access_denied');
return;
}

var labels = {},
orderByDisplayName = $filter('orderByDisplayName');

Expand Down
18 changes: 17 additions & 1 deletion app/scripts/controllers/createSecret.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,18 @@
* Controller of the openshiftConsole
*/
angular.module('openshiftConsole')
.controller('CreateSecretController', function ($filter, $location, $routeParams, $scope, $window, AlertMessageService, ApplicationGenerator, DataService, Navigate, ProjectsService) {
.controller('CreateSecretController',
function($filter,
$location,
$routeParams,
$scope,
$window,
AlertMessageService,
ApplicationGenerator,
AuthorizationService,
DataService,
Navigate,
ProjectsService) {
$scope.alerts = {};
$scope.projectName = $routeParams.project;

Expand Down Expand Up @@ -42,6 +53,11 @@ angular.module('openshiftConsole')
$scope.context = context;
$scope.breadcrumbs[0].title = $filter('displayName')(project);

if (!AuthorizationService.canI('secrets', 'create', $routeParams.project)) {
Navigate.toErrorPage('You do not have authority to create secrets in project ' + $routeParams.project + '.', 'access_denied');
return;
}

$scope.postCreateAction = function(newSecret, creationAlerts) {
_.each(creationAlerts, function(alert) {
AlertMessageService.addAlert(alert);
Expand Down
7 changes: 7 additions & 0 deletions app/scripts/controllers/edit/autoscaler.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ angular.module('openshiftConsole')
$routeParams,
$window,
APIService,
AuthorizationService,
BreadcrumbsService,
DataService,
HPAService,
Expand Down Expand Up @@ -79,6 +80,12 @@ angular.module('openshiftConsole')
// Update project breadcrumb with display name.
$scope.project = project;

var verb = $routeParams.kind === 'HorizontalPodAutoscaler' ? 'update' : 'create';
if (!AuthorizationService.canI({ resource: 'horizontalpodautoscalers', group: 'extensions' }, verb, $routeParams.project)) {
Navigate.toErrorPage('You do not have authority to ' + verb + ' horizontal pod autoscalers in project ' + $routeParams.project + '.', 'access_denied');
return;
}

var createHPA = function() {
$scope.disableInputs = true;
var hpa = {
Expand Down
21 changes: 20 additions & 1 deletion app/scripts/controllers/edit/buildConfig.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,20 @@
* Controller of the openshiftConsole
*/
angular.module('openshiftConsole')
.controller('EditBuildConfigController', function ($scope, $routeParams, DataService, SecretsService, ProjectsService, $filter, ApplicationGenerator, Navigate, $location, AlertMessageService, SOURCE_URL_PATTERN, keyValueEditorUtils) {
.controller('EditBuildConfigController',
function($scope,
$filter,
$location,
$routeParams,
AlertMessageService,
ApplicationGenerator,
AuthorizationService,
DataService,
Navigate,
ProjectsService,
SOURCE_URL_PATTERN,
SecretsService,
keyValueEditorUtils) {

$scope.projectName = $routeParams.project;
$scope.buildConfig = null;
Expand Down Expand Up @@ -120,6 +133,12 @@ angular.module('openshiftConsole')
// Update project breadcrumb with display name.
$scope.breadcrumbs[0].title = $filter('displayName')(project);

if (!AuthorizationService.canI('buildconfigs', 'update', $routeParams.project)) {
Navigate.toErrorPage('You do not have authority to update build config ' +
$routeParams.buildconfig + '.', 'access_denied');
return;
}

DataService.get("buildconfigs", $routeParams.buildconfig, context).then(
// success
function(buildConfig) {
Expand Down
23 changes: 22 additions & 1 deletion app/scripts/controllers/edit/deploymentConfig.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,21 @@
* Controller of the openshiftConsole
*/
angular.module('openshiftConsole')
.controller('EditDeploymentConfigController', function ($scope, $routeParams, $uibModal, DataService, BreadcrumbsService, SecretsService, ProjectsService, $filter, Navigate, $location, AlertMessageService, SOURCE_URL_PATTERN, keyValueEditorUtils) {
.controller('EditDeploymentConfigController',
function($scope,
$filter,
$location,
$routeParams,
$uibModal,
AlertMessageService,
AuthorizationService,
BreadcrumbsService,
DataService,
Navigate,
ProjectsService,
SecretsService,
SOURCE_URL_PATTERN,
keyValueEditorUtils) {
$scope.projectName = $routeParams.project;
$scope.deploymentConfig = null;
$scope.alerts = {};
Expand Down Expand Up @@ -55,6 +69,13 @@ angular.module('openshiftConsole')
.then(_.spread(function(project, context) {
$scope.project = project;
$scope.context = context;

if (!AuthorizationService.canI('deploymentconfigs', 'update', $routeParams.project)) {
Navigate.toErrorPage('You do not have authority to update deployment config ' +
$routeParams.deploymentconfig + '.', 'access_denied');
return;
}

DataService.get("deploymentconfigs", $routeParams.deploymentconfig, context).then(
// success
function(deploymentConfig) {
Expand Down
7 changes: 7 additions & 0 deletions app/scripts/controllers/edit/healthChecks.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ angular.module('openshiftConsole')
$routeParams,
$scope,
AlertMessageService,
AuthorizationService,
BreadcrumbsService,
APIService,
DataService,
Expand Down Expand Up @@ -72,6 +73,12 @@ angular.module('openshiftConsole')
resource: APIService.kindToResource($routeParams.kind),
group: $routeParams.group
};

if (!AuthorizationService.canI(resourceGroupVersion, 'update', $routeParams.project)) {
Navigate.toErrorPage('You do not have authority to update ' + displayName + '.', 'access_denied');
return;
}

DataService.get(resourceGroupVersion, $scope.name, context).then(
function(result) {
// Modify a copy of the resource.
Expand Down
25 changes: 16 additions & 9 deletions app/scripts/controllers/edit/route.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,15 +8,17 @@
* Controller of the openshiftConsole
*/
angular.module('openshiftConsole')
.controller('EditRouteController', function ($filter,
$location,
$routeParams,
$scope,
AlertMessageService,
DataService,
Navigate,
ProjectsService,
RoutesService) {
.controller('EditRouteController',
function($filter,
$location,
$routeParams,
$scope,
AlertMessageService,
AuthorizationService,
DataService,
Navigate,
ProjectsService,
RoutesService) {
$scope.alerts = {};
$scope.renderOptions = {
hideFilterWidget: true
Expand Down Expand Up @@ -46,6 +48,11 @@ angular.module('openshiftConsole')
// Update project breadcrumb with display name.
$scope.breadcrumbs[0].title = $filter('displayName')(project);

if (!AuthorizationService.canI('routes', 'update', $routeParams.project)) {
Navigate.toErrorPage('You do not have authority to update route ' + $routeParams.routeName + '.', 'access_denied');
return;
}

var orderByDisplayName = $filter('orderByDisplayName');

var route;
Expand Down
7 changes: 7 additions & 0 deletions app/scripts/controllers/edit/yaml.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ angular.module('openshiftConsole')
$window,
AlertMessageService,
APIService,
AuthorizationService,
BreadcrumbsService,
DataService,
Navigate,
Expand Down Expand Up @@ -70,6 +71,12 @@ angular.module('openshiftConsole')
group: $routeParams.group
};

if (!AuthorizationService.canI(resourceGroupVersion, 'update', $routeParams.project)) {
Navigate.toErrorPage('You do not have authority to update ' +
humanizeKind($routeParams.kind) + ' ' + $routeParams.name + '.', 'access_denied');
return;
}

DataService.get(resourceGroupVersion, $scope.name, context).then(
function(result) {
// Modify a copy of the resource.
Expand Down
Loading