diff --git a/.gitignore b/.gitignore index 37478aa6dc0..b67c082e312 100644 --- a/.gitignore +++ b/.gitignore @@ -8,6 +8,9 @@ make/dev/adminserver/harbor_adminserver make/dev/core/harbor_core make/dev/jobservice/harbor_jobservice make/photon/*/binary/ +make/photon/core/harbor_core +make/photon/jobservice/harbor_jobservice +make/photon/registryctl/harbor_registryctl make/photon/prepare/versions src/adminserver/adminserver @@ -15,6 +18,11 @@ src/core/core src/jobservice/jobservice src/common/dao/dao.test *.pyc + +# local build/install artifacts (never commit) +build-portal.sh +install.log +install*.log jobservice/test src/portal/coverage/ diff --git a/api/v2.0/swagger.yaml b/api/v2.0/swagger.yaml index 0489f222fab..c3eed524b4d 100644 --- a/api/v2.0/swagger.yaml +++ b/api/v2.0/swagger.yaml @@ -526,6 +526,34 @@ paths: $ref: '#/responses/404' '500': $ref: '#/responses/500' + '/projects/{project_name_or_id}/permissions/effective': + get: + summary: Get the current user's effective permissions for a project + description: Returns the subset of project-level permissions that the calling user actually holds. Used to restrict robot account permission selection to the user's own access level. + tags: + - project + operationId: getEffectivePermissions + parameters: + - $ref: '#/parameters/requestId' + - $ref: '#/parameters/isResourceName' + - $ref: '#/parameters/projectNameOrId' + responses: + '200': + description: The effective permissions of the current user in the project. + schema: + type: array + items: + $ref: '#/definitions/Permission' + '400': + $ref: '#/responses/400' + '401': + $ref: '#/responses/401' + '403': + $ref: '#/responses/403' + '404': + $ref: '#/responses/404' + '500': + $ref: '#/responses/500' '/projects/{project_name_or_id}/members': get: summary: Get all project member information @@ -3347,6 +3375,79 @@ paths: $ref: '#/responses/404' '500': $ref: '#/responses/500' + /roles: + get: + summary: Get roles + description: List the roles with the specified level and permissions. + tags: + - role + operationId: ListRole + parameters: + - $ref: '#/parameters/requestId' + - $ref: '#/parameters/query' + - $ref: '#/parameters/sort' + - $ref: '#/parameters/page' + - $ref: '#/parameters/pageSize' + responses: + '200': + description: Success + headers: + X-Total-Count: + description: The total count of roles + type: integer + Link: + description: Link refers to the previous page and next page + type: string + schema: + type: array + items: + $ref: '#/definitions/Role' + '400': + $ref: '#/responses/400' + '404': + $ref: '#/responses/404' + '500': + $ref: '#/responses/500' + post: + summary: Create a role + description: Create a role + tags: + - role + operationId: CreateRole + parameters: + - $ref: '#/parameters/requestId' + - name: role + in: body + description: The JSON object of a role. + required: true + schema: + $ref: '#/definitions/RoleCreate' + responses: + '201': + description: Created + headers: + X-Request-Id: + description: The ID of the corresponding request for the response + type: string + Location: + description: The location of the resource + type: string + schema: + $ref: '#/definitions/RoleCreated' + '400': + $ref: '#/responses/400' + '401': + $ref: '#/responses/401' + '403': + $ref: '#/responses/403' + '404': + $ref: '#/responses/404' + '500': + $ref: '#/responses/500' + + + + '/quotas': get: summary: List quotas @@ -3560,6 +3661,82 @@ paths: $ref: '#/responses/404' '500': $ref: '#/responses/500' + /roles/{role_id}: + get: + summary: Get a role + description: This endpoint returns specific role information by role ID. + tags: + - role + operationId: GetRoleByID + parameters: + - $ref: '#/parameters/requestId' + - $ref: '#/parameters/roleId' + responses: + '200': + description: Return matched role information. + schema: + $ref: '#/definitions/Role' + '401': + $ref: '#/responses/401' + '403': + $ref: '#/responses/403' + '404': + $ref: '#/responses/404' + '500': + $ref: '#/responses/500' + put: + summary: Update a role account + description: This endpoint updates specific role information by role ID. + tags: + - role + operationId: UpdateRole + parameters: + - $ref: '#/parameters/requestId' + - $ref: '#/parameters/roleId' + - name: role + in: body + description: The JSON object of a role. + required: true + schema: + $ref: '#/definitions/Role' + responses: + '200': + $ref: '#/responses/200' + '400': + $ref: '#/responses/400' + '401': + $ref: '#/responses/401' + '403': + $ref: '#/responses/403' + '404': + $ref: '#/responses/404' + '409': + $ref: '#/responses/409' + '500': + $ref: '#/responses/500' + delete: + summary: Delete a role account + description: This endpoint deletes specific role information by role ID. + tags: + - role + operationId: DeleteRole + parameters: + - $ref: '#/parameters/requestId' + - $ref: '#/parameters/roleId' + responses: + '200': + $ref: '#/responses/200' + '400': + $ref: '#/responses/400' + '401': + $ref: '#/responses/401' + '403': + $ref: '#/responses/403' + '404': + $ref: '#/responses/404' + '500': + $ref: '#/responses/500' + /replication/policies: get: summary: List replication policies @@ -6523,6 +6700,12 @@ parameters: description: Robot ID required: true type: integer + roleId: + name: role_id + in: path + description: Role ID + required: true + type: integer gcId: name: gc_id in: path @@ -8135,6 +8318,101 @@ definitions: type: array items: $ref: '#/definitions/Access' + Role: + type: object + properties: + id: + type: integer + format: int64 + description: The ID of the role + name: + type: string + description: The name of the role + role_mask: + type: integer + description: The mask of the role, not used + role_code: + type: string + description: The code of the role, not used + permissions: + type: array + items: + $ref: '#/definitions/RolePermission' + is_builtin: + type: boolean + description: Whether this is a built-in role that cannot be modified or deleted + description: + type: string + description: Human-readable description of the role + modified: + type: boolean + description: Whether the role has been modified since creation + created_by: + type: string + description: Username of the admin who created the role + created_at: + type: string + format: date-time + description: When the role was created + modified_by: + type: string + description: Username of the admin who last modified the role + modified_at: + type: string + format: date-time + description: When the role was last modified + RoleCreate: + type: object + description: The request for role creation. + properties: + name: + type: string + description: The name of the role + role_mask: + type: integer + description: The mask of the role, not used + role_code: + type: string + description: The code of the role, not used + description: + type: string + description: Human-readable description of the role + permissions: + type: array + items: + $ref: '#/definitions/RolePermission' + RoleCreated: + type: object + description: The response for role creation. + properties: + id: + type: integer + format: int64 + description: The ID of the role + name: + type: string + description: The name of the role + secret: + type: string + description: The secret of the role + creation_time: + type: string + format: date-time + description: The creation time of the role. + RolePermission: + type: object + properties: + kind: + type: string + description: The kind of the permission + namespace: + type: string + description: The namespace of the permission + access: + type: array + items: + $ref: '#/definitions/Access' + Access: type: object properties: @@ -8147,6 +8425,7 @@ definitions: effect: type: string description: The effect of the access + RobotCreateV1: type: object properties: @@ -9862,6 +10141,12 @@ definitions: description: The project level permissions items: $ref: '#/definitions/Permission' + role: + type: array + description: The role project level permissions + items: + $ref: '#/definitions/Permission' + OIDCCliSecretReq: type: object properties: diff --git a/make/migrations/postgresql/0190_2.16.0_schema.up.sql b/make/migrations/postgresql/0190_2.16.0_schema.up.sql index a9e4d8dbfe7..f7d36c83d52 100644 --- a/make/migrations/postgresql/0190_2.16.0_schema.up.sql +++ b/make/migrations/postgresql/0190_2.16.0_schema.up.sql @@ -8,3 +8,390 @@ This keeps access_key consistent with access_secret, which is already varchar(40 See: https://github.com/goharbor/harbor/issues/23303 */ ALTER TABLE registry ALTER COLUMN access_key TYPE varchar(4096); + +ALTER TABLE role ADD COLUMN IF NOT EXISTS is_builtin BOOLEAN NOT NULL DEFAULT FALSE; +ALTER TABLE role ADD COLUMN IF NOT EXISTS description TEXT; +ALTER TABLE role ADD COLUMN IF NOT EXISTS modified BOOLEAN NOT NULL DEFAULT FALSE; +ALTER TABLE role ADD COLUMN IF NOT EXISTS created_by VARCHAR(255); +ALTER TABLE role ADD COLUMN IF NOT EXISTS created_at TIMESTAMP WITH TIME ZONE; +ALTER TABLE role ADD COLUMN IF NOT EXISTS modified_by VARCHAR(255); +ALTER TABLE role ADD COLUMN IF NOT EXISTS modified_at TIMESTAMP WITH TIME ZONE; + +-- Widen the role name to match the API/UI contract (was varchar(20)) and enforce +-- name uniqueness so custom roles cannot collide. +ALTER TABLE role ALTER COLUMN name TYPE varchar(255); +CREATE UNIQUE INDEX IF NOT EXISTS uq_role_name ON role (name); + +-- Mark all roles seeded by migrations as built-in (immutable) +UPDATE role SET is_builtin = TRUE +WHERE name IN ('projectAdmin', 'developer', 'guest', 'maintainer', 'limitedGuest'); + +-- Seed permissions for built-in roles into permission_policy + role_permission. +-- These were previously hardcoded in Go (rolePoliciesMap); storing them in DB lets +-- the anti-escalation check compare any role's permissions against the caller's. +DO $$ +DECLARE + ResourceSelf VARCHAR(50) := ''; + ResourceMember VARCHAR(50) := 'member'; + ResourceMetadata VARCHAR(50) := 'metadata'; + ResourceLog VARCHAR(50) := 'log'; + ResourceLabel VARCHAR(50) := 'label'; + ResourceQuota VARCHAR(50) := 'quota'; + ResourceRepository VARCHAR(50) := 'repository'; + ResourceTagRetention VARCHAR(50) := 'tag-retention'; + ResourceImmutableTag VARCHAR(50) := 'immutable-tag'; + ResourceConfiguration VARCHAR(50) := 'configuration'; + ResourceRobot VARCHAR(50) := 'robot'; + ResourceNotificationPolicy VARCHAR(50) := 'notification-policy'; + ResourceScan VARCHAR(50) := 'scan'; + ResourceSBOM VARCHAR(50) := 'sbom'; + ResourceScanner VARCHAR(50) := 'scanner'; + ResourceArtifact VARCHAR(50) := 'artifact'; + ResourceArtifactAddition VARCHAR(50) := 'artifact-addition'; + ResourceTag VARCHAR(50) := 'tag'; + ResourceAccessory VARCHAR(50) := 'accessory'; + ResourceArtifactLabel VARCHAR(50) := 'artifact-label'; + ResourcePreatPolicy VARCHAR(50) := 'preheat-policy'; + ResourceExportCVE VARCHAR(50) := 'export-cve'; + + ActionCreate VARCHAR(50) := 'create'; + ActionRead VARCHAR(50) := 'read'; + ActionUpdate VARCHAR(50) := 'update'; + ActionDelete VARCHAR(50) := 'delete'; + ActionList VARCHAR(50) := 'list'; + ActionPull VARCHAR(50) := 'pull'; + ActionPush VARCHAR(50) := 'push'; + ActionOperate VARCHAR(50) := 'operate'; + ActionStop VARCHAR(50) := 'stop'; + + PROJECT_ADMIN VARCHAR(50) := 'projectAdmin'; + MAINTAINER VARCHAR(50) := 'maintainer'; + DEVELOPER VARCHAR(50) := 'developer'; + GUEST VARCHAR(50) := 'guest'; + LIMITED_GUEST VARCHAR(50) := 'limitedGuest'; + + +BEGIN + + -- Temporary table + + CREATE TEMPORARY TABLE "#perms" (resource VARCHAR(50), action VARCHAR(50), role_name VARCHAR(50)); + INSERT INTO "#perms" (resource, action, role_name) VALUES + (ResourceSelf, ActionRead, PROJECT_ADMIN), + (ResourceSelf, ActionUpdate, PROJECT_ADMIN), + (ResourceSelf, ActionDelete, PROJECT_ADMIN), + + (ResourceMember, ActionCreate, PROJECT_ADMIN), + (ResourceMember, ActionRead, PROJECT_ADMIN), + (ResourceMember, ActionUpdate, PROJECT_ADMIN), + (ResourceMember, ActionDelete, PROJECT_ADMIN), + (ResourceMember, ActionList, PROJECT_ADMIN), + + (ResourceMetadata, ActionCreate, PROJECT_ADMIN), + (ResourceMetadata, ActionRead, PROJECT_ADMIN), + (ResourceMetadata, ActionUpdate, PROJECT_ADMIN), + (ResourceMetadata, ActionDelete, PROJECT_ADMIN), + (ResourceMetadata, ActionList, PROJECT_ADMIN), + + (ResourceLog, ActionList, PROJECT_ADMIN), + + (ResourceLabel, ActionCreate, PROJECT_ADMIN), + (ResourceLabel, ActionRead, PROJECT_ADMIN), + (ResourceLabel, ActionUpdate, PROJECT_ADMIN), + (ResourceLabel, ActionDelete, PROJECT_ADMIN), + (ResourceLabel, ActionList, PROJECT_ADMIN), + + (ResourceQuota, ActionRead, PROJECT_ADMIN), + + (ResourceRepository, ActionCreate, PROJECT_ADMIN), + (ResourceRepository, ActionRead, PROJECT_ADMIN), + (ResourceRepository, ActionUpdate, PROJECT_ADMIN), + (ResourceRepository, ActionDelete, PROJECT_ADMIN), + (ResourceRepository, ActionList, PROJECT_ADMIN), + (ResourceRepository, ActionPull, PROJECT_ADMIN), + (ResourceRepository, ActionPush, PROJECT_ADMIN), + + (ResourceTagRetention, ActionCreate, PROJECT_ADMIN), + (ResourceTagRetention, ActionRead, PROJECT_ADMIN), + (ResourceTagRetention, ActionUpdate, PROJECT_ADMIN), + (ResourceTagRetention, ActionDelete, PROJECT_ADMIN), + (ResourceTagRetention, ActionList, PROJECT_ADMIN), + (ResourceTagRetention, ActionOperate, PROJECT_ADMIN), + + (ResourceImmutableTag, ActionCreate, PROJECT_ADMIN), + (ResourceImmutableTag, ActionUpdate, PROJECT_ADMIN), + (ResourceImmutableTag, ActionDelete, PROJECT_ADMIN), + (ResourceImmutableTag, ActionList, PROJECT_ADMIN), + + (ResourceConfiguration, ActionRead, PROJECT_ADMIN), + (ResourceConfiguration, ActionUpdate, PROJECT_ADMIN), + + (ResourceRobot, ActionCreate, PROJECT_ADMIN), + (ResourceRobot, ActionRead, PROJECT_ADMIN), + (ResourceRobot, ActionUpdate, PROJECT_ADMIN), + (ResourceRobot, ActionDelete, PROJECT_ADMIN), + (ResourceRobot, ActionList, PROJECT_ADMIN), + + (ResourceNotificationPolicy, ActionCreate, PROJECT_ADMIN), + (ResourceNotificationPolicy, ActionUpdate, PROJECT_ADMIN), + (ResourceNotificationPolicy, ActionDelete, PROJECT_ADMIN), + (ResourceNotificationPolicy, ActionList, PROJECT_ADMIN), + (ResourceNotificationPolicy, ActionRead, PROJECT_ADMIN), + + (ResourceScan, ActionCreate, PROJECT_ADMIN), + (ResourceScan, ActionRead, PROJECT_ADMIN), + (ResourceScan, ActionStop, PROJECT_ADMIN), + (ResourceSBOM, ActionCreate, PROJECT_ADMIN), + (ResourceSBOM, ActionStop, PROJECT_ADMIN), + (ResourceSBOM, ActionRead, PROJECT_ADMIN), + + (ResourceScanner, ActionRead, PROJECT_ADMIN), + (ResourceScanner, ActionCreate, PROJECT_ADMIN), + + (ResourceArtifact, ActionCreate, PROJECT_ADMIN), + (ResourceArtifact, ActionRead, PROJECT_ADMIN), + (ResourceArtifact, ActionDelete, PROJECT_ADMIN), + (ResourceArtifact, ActionList, PROJECT_ADMIN), + (ResourceArtifactAddition, ActionRead, PROJECT_ADMIN), + + (ResourceTag, ActionList, PROJECT_ADMIN), + (ResourceTag, ActionCreate, PROJECT_ADMIN), + (ResourceTag, ActionDelete, PROJECT_ADMIN), + + (ResourceAccessory, ActionList, PROJECT_ADMIN), + + (ResourceArtifactLabel, ActionCreate, PROJECT_ADMIN), + (ResourceArtifactLabel, ActionDelete, PROJECT_ADMIN), + + (ResourcePreatPolicy, ActionCreate, PROJECT_ADMIN), + (ResourcePreatPolicy, ActionRead, PROJECT_ADMIN), + (ResourcePreatPolicy, ActionUpdate, PROJECT_ADMIN), + (ResourcePreatPolicy, ActionDelete, PROJECT_ADMIN), + (ResourcePreatPolicy, ActionList, PROJECT_ADMIN), + + (ResourceExportCVE, ActionCreate, PROJECT_ADMIN), + (ResourceExportCVE, ActionRead, PROJECT_ADMIN), + (ResourceExportCVE, ActionList, PROJECT_ADMIN), + + (ResourceSelf, ActionRead, MAINTAINER), + + (ResourceMember, ActionRead, MAINTAINER), + (ResourceMember, ActionList, MAINTAINER), + + (ResourceMetadata, ActionRead, MAINTAINER), + + (ResourceQuota, ActionRead, MAINTAINER), + + (ResourceLabel, ActionCreate, MAINTAINER), + (ResourceLabel, ActionRead, MAINTAINER), + (ResourceLabel, ActionUpdate, MAINTAINER), + (ResourceLabel, ActionDelete, MAINTAINER), + (ResourceLabel, ActionList, MAINTAINER), + + (ResourceRepository, ActionCreate, MAINTAINER), + (ResourceRepository, ActionRead, MAINTAINER), + (ResourceRepository, ActionUpdate, MAINTAINER), + (ResourceRepository, ActionDelete, MAINTAINER), + (ResourceRepository, ActionList, MAINTAINER), + (ResourceRepository, ActionPush, MAINTAINER), + (ResourceRepository, ActionPull, MAINTAINER), + + (ResourceTagRetention, ActionCreate, MAINTAINER), + (ResourceTagRetention, ActionRead, MAINTAINER), + (ResourceTagRetention, ActionUpdate, MAINTAINER), + (ResourceTagRetention, ActionDelete, MAINTAINER), + (ResourceTagRetention, ActionList, MAINTAINER), + (ResourceTagRetention, ActionOperate, MAINTAINER), + + (ResourceAccessory, ActionList, MAINTAINER), + + (ResourceImmutableTag, ActionCreate, MAINTAINER), + (ResourceImmutableTag, ActionUpdate, MAINTAINER), + (ResourceImmutableTag, ActionDelete, MAINTAINER), + (ResourceImmutableTag, ActionList, MAINTAINER), + + (ResourceConfiguration, ActionRead, MAINTAINER), + + (ResourceRobot, ActionRead, MAINTAINER), + (ResourceRobot, ActionList, MAINTAINER), + + (ResourceNotificationPolicy, ActionRead, MAINTAINER), + (ResourceNotificationPolicy, ActionList, MAINTAINER), + + (ResourceScan, ActionCreate, MAINTAINER), + (ResourceScan, ActionRead, MAINTAINER), + (ResourceScan, ActionStop, MAINTAINER), + (ResourceSBOM, ActionCreate, MAINTAINER), + (ResourceSBOM, ActionStop, MAINTAINER), + (ResourceSBOM, ActionRead, MAINTAINER), + + (ResourceScanner, ActionRead, MAINTAINER), + + (ResourceArtifact, ActionCreate, MAINTAINER), + (ResourceArtifact, ActionRead, MAINTAINER), + (ResourceArtifact, ActionDelete, MAINTAINER), + (ResourceArtifact, ActionList, MAINTAINER), + (ResourceArtifactAddition, ActionRead, MAINTAINER), + + (ResourceTag, ActionList, MAINTAINER), + (ResourceTag, ActionCreate, MAINTAINER), + (ResourceTag, ActionDelete, MAINTAINER), + + (ResourceArtifactLabel, ActionCreate, MAINTAINER), + (ResourceArtifactLabel, ActionDelete, MAINTAINER), + + (ResourceExportCVE, ActionCreate, MAINTAINER), + (ResourceExportCVE, ActionRead, MAINTAINER), + (ResourceExportCVE, ActionList, MAINTAINER), + + (ResourceSelf, ActionRead, DEVELOPER), + + (ResourceMember, ActionRead, DEVELOPER), + (ResourceMember, ActionList, DEVELOPER), + + (ResourceLabel, ActionRead, DEVELOPER), + (ResourceLabel, ActionList, DEVELOPER), + + (ResourceQuota, ActionRead, DEVELOPER), + + (ResourceRepository, ActionCreate, DEVELOPER), + (ResourceRepository, ActionRead, DEVELOPER), + (ResourceRepository, ActionUpdate, DEVELOPER), + (ResourceRepository, ActionList, DEVELOPER), + (ResourceRepository, ActionPush, DEVELOPER), + (ResourceRepository, ActionPull, DEVELOPER), + + (ResourceTagRetention, ActionCreate, DEVELOPER), + (ResourceTagRetention, ActionRead, DEVELOPER), + (ResourceTagRetention, ActionUpdate, DEVELOPER), + (ResourceTagRetention, ActionDelete, DEVELOPER), + (ResourceTagRetention, ActionList, DEVELOPER), + (ResourceTagRetention, ActionOperate, DEVELOPER), + + (ResourceConfiguration, ActionRead, DEVELOPER), + + (ResourceRobot, ActionRead, DEVELOPER), + (ResourceRobot, ActionList, DEVELOPER), + + (ResourceScan, ActionRead, DEVELOPER), + (ResourceSBOM, ActionRead, DEVELOPER), + + (ResourceScanner, ActionRead, DEVELOPER), + + (ResourceArtifact, ActionCreate, DEVELOPER), + (ResourceArtifact, ActionRead, DEVELOPER), + (ResourceArtifact, ActionList, DEVELOPER), + (ResourceArtifactAddition, ActionRead, DEVELOPER), + + (ResourceTag, ActionList, DEVELOPER), + (ResourceTag, ActionCreate, DEVELOPER), + + (ResourceAccessory, ActionList, DEVELOPER), + + (ResourceArtifactLabel, ActionCreate, DEVELOPER), + (ResourceArtifactLabel, ActionDelete, DEVELOPER), + + (ResourceExportCVE, ActionCreate, DEVELOPER), + (ResourceExportCVE, ActionRead, DEVELOPER), + (ResourceExportCVE, ActionList, DEVELOPER), + + (ResourceSelf, ActionRead, GUEST), + + (ResourceMember, ActionRead, GUEST), + (ResourceMember, ActionList, GUEST), + + (ResourceLabel, ActionRead, GUEST), + (ResourceLabel, ActionList, GUEST), + + (ResourceQuota, ActionRead, GUEST), + + (ResourceRepository, ActionRead, GUEST), + (ResourceRepository, ActionList, GUEST), + (ResourceRepository, ActionPull, GUEST), + + (ResourceConfiguration, ActionRead, GUEST), + + (ResourceRobot, ActionRead, GUEST), + (ResourceRobot, ActionList, GUEST), + + (ResourceScan, ActionRead, GUEST), + (ResourceSBOM, ActionRead, GUEST), + + (ResourceScanner, ActionRead, GUEST), + + (ResourceTag, ActionList, GUEST), + (ResourceAccessory, ActionList, GUEST), + + (ResourceArtifact, ActionRead, GUEST), + (ResourceArtifact, ActionList, GUEST), + (ResourceArtifactAddition, ActionRead, GUEST), + + (ResourceSelf, ActionRead, LIMITED_GUEST), + + (ResourceQuota, ActionRead, LIMITED_GUEST), + + (ResourceRepository, ActionList, LIMITED_GUEST), + (ResourceRepository, ActionRead, LIMITED_GUEST), + (ResourceRepository, ActionPull, LIMITED_GUEST), + + (ResourceConfiguration, ActionRead, LIMITED_GUEST), + + (ResourceScan, ActionRead, LIMITED_GUEST), + (ResourceSBOM, ActionRead, LIMITED_GUEST), + + (ResourceScanner, ActionRead, LIMITED_GUEST), + + (ResourceTag, ActionList, LIMITED_GUEST), + (ResourceAccessory, ActionList, LIMITED_GUEST), + + (ResourceArtifact, ActionRead, LIMITED_GUEST), + (ResourceArtifact, ActionList, LIMITED_GUEST), + (ResourceArtifactAddition, ActionRead, LIMITED_GUEST); + + + DECLARE + Cur_1 CURSOR FOR SELECT resource, action, role_name FROM "#perms"; + tmp_role_id INT; + tmp_policy_id INT; + tmp_permission_id INT; + + BEGIN + FOR r IN Cur_1 LOOP + + SELECT role_id into tmp_role_id FROM role WHERE name = r.role_name; + + IF EXISTS( + SELECT * FROM permission_policy + WHERE scope = 'project-role' and resource = r.resource and action = r.action) THEN + + BEGIN + SELECT id into tmp_policy_id FROM permission_policy + WHERE scope = 'project-role' and resource = r.resource and action = r.action; + END; + + ELSE + BEGIN + INSERT INTO permission_policy ( scope, resource, action, creation_time ) VALUES + ('project-role', r.resource, r.action, NOW()) RETURNING id INTO tmp_policy_id; + END; + + END IF; + + + IF NOT EXISTS( + SELECT * FROM role_permission + WHERE role_type = 'project-role' and role_id = tmp_role_id and permission_policy_id = tmp_policy_id) THEN + + BEGIN + INSERT INTO role_permission (role_type, role_id, permission_policy_id, creation_time) VALUES + ('project-role', tmp_role_id, tmp_policy_id, NOW()) RETURNING id INTO tmp_permission_id; + END; + + END IF; + + END LOOP; + + + END; + +END $$; diff --git a/src/common/models/base.go b/src/common/models/base.go index 94a8f57ac80..a4f60936bb7 100644 --- a/src/common/models/base.go +++ b/src/common/models/base.go @@ -20,7 +20,6 @@ import ( func init() { orm.RegisterModel( - new(Role), new(OIDCUser), ) } diff --git a/src/common/models/role.go b/src/common/models/role.go deleted file mode 100644 index 1452d390a50..00000000000 --- a/src/common/models/role.go +++ /dev/null @@ -1,23 +0,0 @@ -// Copyright Project Harbor Authors -// -// Licensed under the Apache License, Version 2.0 (the "License"); -// you may not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, software -// distributed under the License is distributed on an "AS IS" BASIS, -// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -// See the License for the specific language governing permissions and -// limitations under the License. - -package models - -// Role holds the details of a role. -type Role struct { - RoleID int `orm:"pk;auto;column(role_id)" json:"role_id"` - RoleCode string `orm:"column(role_code)" json:"role_code"` - Name string `orm:"column(name)" json:"role_name"` - RoleMask int `orm:"column(role_mask)" json:"role_mask"` -} diff --git a/src/common/rbac/const.go b/src/common/rbac/const.go index f23189db970..2b0e19dd162 100644 --- a/src/common/rbac/const.go +++ b/src/common/rbac/const.go @@ -88,6 +88,7 @@ type scope string const ( ScopeSystem = scope("System") ScopeProject = scope("Project") + ScopeRole = scope("Role") ) // RobotPermissionProvider defines the permission provider for robot account @@ -157,6 +158,10 @@ func (n *NolimitProvider) GetPermissions(s scope) []*types.Policy { &types.Policy{Resource: ResourceMember, Action: ActionList}, &types.Policy{Resource: ResourceMember, Action: ActionDelete}) } + if s == ScopeRole { + return n.BaseProvider.GetPermissions(ScopeRole) + } + return []*types.Policy{} } @@ -311,5 +316,102 @@ var ( {Resource: ResourceQuota, Action: ActionRead}, }, + ScopeRole: { + {Resource: ResourceSelf, Action: ActionRead}, + {Resource: ResourceSelf, Action: ActionUpdate}, + {Resource: ResourceSelf, Action: ActionDelete}, + + {Resource: ResourceMember, Action: ActionCreate}, + {Resource: ResourceMember, Action: ActionRead}, + {Resource: ResourceMember, Action: ActionUpdate}, + {Resource: ResourceMember, Action: ActionDelete}, + {Resource: ResourceMember, Action: ActionList}, + + {Resource: ResourceMetadata, Action: ActionCreate}, + {Resource: ResourceMetadata, Action: ActionRead}, + {Resource: ResourceMetadata, Action: ActionUpdate}, + {Resource: ResourceMetadata, Action: ActionDelete}, + {Resource: ResourceMetadata, Action: ActionList}, + + {Resource: ResourceLog, Action: ActionList}, + + {Resource: ResourceLabel, Action: ActionCreate}, + {Resource: ResourceLabel, Action: ActionRead}, + {Resource: ResourceLabel, Action: ActionUpdate}, + {Resource: ResourceLabel, Action: ActionDelete}, + {Resource: ResourceLabel, Action: ActionList}, + + {Resource: ResourceQuota, Action: ActionRead}, + + {Resource: ResourceRepository, Action: ActionCreate}, + {Resource: ResourceRepository, Action: ActionRead}, + {Resource: ResourceRepository, Action: ActionUpdate}, + {Resource: ResourceRepository, Action: ActionDelete}, + {Resource: ResourceRepository, Action: ActionList}, + {Resource: ResourceRepository, Action: ActionPull}, + {Resource: ResourceRepository, Action: ActionPush}, + + {Resource: ResourceTagRetention, Action: ActionCreate}, + {Resource: ResourceTagRetention, Action: ActionRead}, + {Resource: ResourceTagRetention, Action: ActionUpdate}, + {Resource: ResourceTagRetention, Action: ActionDelete}, + {Resource: ResourceTagRetention, Action: ActionList}, + {Resource: ResourceTagRetention, Action: ActionOperate}, + + {Resource: ResourceImmutableTag, Action: ActionCreate}, + {Resource: ResourceImmutableTag, Action: ActionUpdate}, + {Resource: ResourceImmutableTag, Action: ActionDelete}, + {Resource: ResourceImmutableTag, Action: ActionList}, + + {Resource: ResourceConfiguration, Action: ActionRead}, + {Resource: ResourceConfiguration, Action: ActionUpdate}, + + {Resource: ResourceRobot, Action: ActionCreate}, + {Resource: ResourceRobot, Action: ActionRead}, + {Resource: ResourceRobot, Action: ActionUpdate}, + {Resource: ResourceRobot, Action: ActionDelete}, + {Resource: ResourceRobot, Action: ActionList}, + + {Resource: ResourceNotificationPolicy, Action: ActionCreate}, + {Resource: ResourceNotificationPolicy, Action: ActionUpdate}, + {Resource: ResourceNotificationPolicy, Action: ActionDelete}, + {Resource: ResourceNotificationPolicy, Action: ActionList}, + {Resource: ResourceNotificationPolicy, Action: ActionRead}, + + {Resource: ResourceScan, Action: ActionCreate}, + {Resource: ResourceScan, Action: ActionRead}, + {Resource: ResourceScan, Action: ActionStop}, + {Resource: ResourceSBOM, Action: ActionCreate}, + {Resource: ResourceSBOM, Action: ActionStop}, + {Resource: ResourceSBOM, Action: ActionRead}, + + {Resource: ResourceScanner, Action: ActionRead}, + {Resource: ResourceScanner, Action: ActionCreate}, + + {Resource: ResourceArtifact, Action: ActionCreate}, + {Resource: ResourceArtifact, Action: ActionRead}, + {Resource: ResourceArtifact, Action: ActionDelete}, + {Resource: ResourceArtifact, Action: ActionList}, + {Resource: ResourceArtifactAddition, Action: ActionRead}, + + {Resource: ResourceTag, Action: ActionList}, + {Resource: ResourceTag, Action: ActionCreate}, + {Resource: ResourceTag, Action: ActionDelete}, + + {Resource: ResourceAccessory, Action: ActionList}, + + {Resource: ResourceArtifactLabel, Action: ActionCreate}, + {Resource: ResourceArtifactLabel, Action: ActionDelete}, + + {Resource: ResourcePreatPolicy, Action: ActionCreate}, + {Resource: ResourcePreatPolicy, Action: ActionRead}, + {Resource: ResourcePreatPolicy, Action: ActionUpdate}, + {Resource: ResourcePreatPolicy, Action: ActionDelete}, + {Resource: ResourcePreatPolicy, Action: ActionList}, + + {Resource: ResourceExportCVE, Action: ActionCreate}, + {Resource: ResourceExportCVE, Action: ActionRead}, + {Resource: ResourceExportCVE, Action: ActionList}, + }, } ) diff --git a/src/common/rbac/project/evaluator.go b/src/common/rbac/project/evaluator.go index 38f5753c048..b07ff0d6ede 100644 --- a/src/common/rbac/project/evaluator.go +++ b/src/common/rbac/project/evaluator.go @@ -19,6 +19,7 @@ import ( "github.com/goharbor/harbor/src/common/models" "github.com/goharbor/harbor/src/controller/project" + "github.com/goharbor/harbor/src/controller/role" "github.com/goharbor/harbor/src/lib/log" "github.com/goharbor/harbor/src/pkg/permission/evaluator" "github.com/goharbor/harbor/src/pkg/permission/evaluator/namespace" @@ -31,22 +32,28 @@ import ( type RBACUserBuilder func(context.Context, *proModels.Project) types.RBACUser // NewBuilderForUser create a builder for the local user -func NewBuilderForUser(user *models.User, ctl project.Controller) RBACUserBuilder { +func NewBuilderForUser(user *models.User, ctl project.Controller, ctlR role.Controller) RBACUserBuilder { return func(ctx context.Context, p *proModels.Project) types.RBACUser { if user == nil { - // anonymous access - return &rbacUser{ - project: p, - username: "anonymous", - } + return &rbacUser{project: p, username: "anonymous"} } - roles, err := ctl.ListRoles(ctx, p.ProjectID, user) + roleIDs, err := ctl.ListRoles(ctx, p.ProjectID, user) if err != nil { log.Errorf("failed to list roles: %v", err) return nil } + var roles []*role.Role + for _, roleID := range roleIDs { + r, err := ctlR.Get(ctx, int64(roleID), &role.Option{WithPermission: true}) + if err != nil { + log.Errorf("failed to get role %d: %v", roleID, err) + return nil + } + roles = append(roles, r) + } + return &rbacUser{ project: p, username: user.Username, @@ -76,9 +83,7 @@ func NewEvaluator(ctl project.Controller, builders ...RBACUserBuilder) evaluator return namespace.New(NamespaceKind, func(ctx context.Context, ns types.Namespace) evaluator.Evaluator { p, err := ctl.Get(ctx, ns.Identity().(int64), project.Metadata(true)) if err != nil { - if err != nil { - log.Warningf("Failed to get info of project %d for permission evaluator, error: %v", ns.Identity(), err) - } + log.Warningf("Failed to get info of project %d for permission evaluator, error: %v", ns.Identity(), err) return nil } diff --git a/src/common/rbac/project/evaluator_test.go b/src/common/rbac/project/evaluator_test.go index ff2e147f983..ac7af651d69 100644 --- a/src/common/rbac/project/evaluator_test.go +++ b/src/common/rbac/project/evaluator_test.go @@ -19,103 +19,139 @@ import ( "testing" "github.com/stretchr/testify/assert" + testifymock "github.com/stretchr/testify/mock" "github.com/goharbor/harbor/src/common" "github.com/goharbor/harbor/src/common/models" "github.com/goharbor/harbor/src/common/rbac" + roleCtl "github.com/goharbor/harbor/src/controller/role" + "github.com/goharbor/harbor/src/lib/q" + "github.com/goharbor/harbor/src/pkg/permission/types" proModels "github.com/goharbor/harbor/src/pkg/project/models" - projecttesting "github.com/goharbor/harbor/src/testing/controller/project" "github.com/goharbor/harbor/src/testing/mock" + mocksProject "github.com/goharbor/harbor/src/testing/controller/project" ) +// stubRoleCtl implements roleCtl.Controller for tests. +// Only Get() needs real behaviour; all other methods are no-ops. +type stubRoleCtl struct { + testifymock.Mock +} + +func (s *stubRoleCtl) Get(ctx context.Context, id int64, option *roleCtl.Option) (*roleCtl.Role, error) { + args := s.Called(ctx, id, option) + r, _ := args.Get(0).(*roleCtl.Role) + return r, args.Error(1) +} +func (s *stubRoleCtl) Create(ctx context.Context, r *roleCtl.Role) (int64, error) { return 0, nil } +func (s *stubRoleCtl) Delete(ctx context.Context, id int64, opt ...*roleCtl.Option) error { + return nil +} +func (s *stubRoleCtl) Update(ctx context.Context, r *roleCtl.Role, opt *roleCtl.Option) error { + return nil +} +func (s *stubRoleCtl) List(ctx context.Context, query *q.Query, opt *roleCtl.Option) ([]*roleCtl.Role, error) { + return nil, nil +} +func (s *stubRoleCtl) Count(ctx context.Context, query *q.Query) (int64, error) { return 0, nil } + var ( public = &proModels.Project{ ProjectID: 1, Name: "public_project", OwnerID: 1, - Metadata: map[string]string{ - "public": "true", - }, + Metadata: map[string]string{"public": "true"}, } - private = &proModels.Project{ ProjectID: 2, Name: "private_project", OwnerID: 1, - Metadata: map[string]string{ - "public": "false", - }, + Metadata: map[string]string{"public": "false"}, } ) -func TestAnonymousAccess(t *testing.T) { - assert := assert.New(t) - - { - // anonymous to access public project - ctl := &projecttesting.Controller{} - mock.OnAnything(ctl, "Get").Return(public, nil) - - resource := NewNamespace(public.ProjectID).Resource(rbac.ResourceRepository) - - evaluator := NewEvaluator(ctl, NewBuilderForUser(nil, ctl)) - assert.True(evaluator.HasPermission(context.TODO(), resource, rbac.ActionPull)) +// builtinRole returns a *roleCtl.Role with the permissions for a built-in role ID, +// sourced from the same static map used by the upstream. +func builtinRole(roleID int) *roleCtl.Role { + nameMap := map[int]string{ + common.RoleProjectAdmin: "projectAdmin", + common.RoleMaintainer: "maintainer", + common.RoleDeveloper: "developer", + common.RoleGuest: "guest", + common.RoleLimitedGuest: "limitedGuest", } - - { - // anonymous to access private project - ctl := &projecttesting.Controller{} - mock.OnAnything(ctl, "Get").Return(private, nil) - - resource := NewNamespace(private.ProjectID).Resource(rbac.ResourceRepository) - - evaluator := NewEvaluator(ctl, NewBuilderForUser(nil, ctl)) - assert.False(evaluator.HasPermission(context.TODO(), resource, rbac.ActionPull)) + policies := rolePoliciesMap[nameMap[roleID]] + access := make([]*types.Policy, len(policies)) + copy(access, policies) + return &roleCtl.Role{ + Permissions: []*roleCtl.Permission{{ + Kind: roleCtl.LEVELROLE, + Namespace: "*", + Access: access, + }}, } } +func TestAnonymousAccess(t *testing.T) { + // anonymous can pull from a public project + ctl := &mocksProject.Controller{} + ctl_r := &stubRoleCtl{} + mock.OnAnything(ctl, "Get").Return(public, nil) + resource := NewNamespace(public.ProjectID).Resource(rbac.ResourceRepository) + assert.True(t, + NewEvaluator(ctl, NewBuilderForUser(nil, ctl, ctl_r)).HasPermission(context.TODO(), resource, rbac.ActionPull)) + + // anonymous cannot pull from a private project + ctl2 := &mocksProject.Controller{} + ctl_r2 := &stubRoleCtl{} + mock.OnAnything(ctl2, "Get").Return(private, nil) + resource2 := NewNamespace(private.ProjectID).Resource(rbac.ResourceRepository) + assert.False(t, + NewEvaluator(ctl2, NewBuilderForUser(nil, ctl2, ctl_r2)).HasPermission(context.TODO(), resource2, rbac.ActionPull)) +} + func TestProjectRoleAccess(t *testing.T) { - assert := assert.New(t) + user := &models.User{UserID: 1, Username: "username"} + // projectAdmin can push { - ctl := &projecttesting.Controller{} + ctl := &mocksProject.Controller{} + ctl_r := &stubRoleCtl{} mock.OnAnything(ctl, "Get").Return(public, nil) mock.OnAnything(ctl, "ListRoles").Return([]int{common.RoleProjectAdmin}, nil) + ctl_r.On("Get", testifymock.Anything, int64(common.RoleProjectAdmin), testifymock.Anything). + Return(builtinRole(common.RoleProjectAdmin), nil) - user := &models.User{ - UserID: 1, - Username: "username", - } - evaluator := NewEvaluator(ctl, NewBuilderForUser(user, ctl)) + evaluator := NewEvaluator(ctl, NewBuilderForUser(user, ctl, ctl_r)) resource := NewNamespace(public.ProjectID).Resource(rbac.ResourceRepository) - assert.True(evaluator.HasPermission(context.TODO(), resource, rbac.ActionPush)) + assert.True(t, evaluator.HasPermission(context.TODO(), resource, rbac.ActionPush)) } + // guest cannot push { - ctl := &projecttesting.Controller{} + ctl := &mocksProject.Controller{} + ctl_r := &stubRoleCtl{} mock.OnAnything(ctl, "Get").Return(public, nil) mock.OnAnything(ctl, "ListRoles").Return([]int{common.RoleGuest}, nil) + ctl_r.On("Get", testifymock.Anything, int64(common.RoleGuest), testifymock.Anything). + Return(builtinRole(common.RoleGuest), nil) - user := &models.User{ - UserID: 1, - Username: "username", - } - evaluator := NewEvaluator(ctl, NewBuilderForUser(user, ctl)) + evaluator := NewEvaluator(ctl, NewBuilderForUser(user, ctl, ctl_r)) resource := NewNamespace(public.ProjectID).Resource(rbac.ResourceRepository) - assert.False(evaluator.HasPermission(context.TODO(), resource, rbac.ActionPush)) + assert.False(t, evaluator.HasPermission(context.TODO(), resource, rbac.ActionPush)) } } func BenchmarkProjectEvaluator(b *testing.B) { - ctl := &projecttesting.Controller{} + user := &models.User{UserID: 1, Username: "username"} + ctl := &mocksProject.Controller{} + ctl_r := &stubRoleCtl{} mock.OnAnything(ctl, "Get").Return(public, nil) mock.OnAnything(ctl, "ListRoles").Return([]int{common.RoleProjectAdmin}, nil) + ctl_r.On("Get", testifymock.Anything, int64(common.RoleProjectAdmin), testifymock.Anything). + Return(builtinRole(common.RoleProjectAdmin), nil) - user := &models.User{ - UserID: 1, - Username: "username", - } - evaluator := NewEvaluator(ctl, NewBuilderForUser(user, ctl)) + evaluator := NewEvaluator(ctl, NewBuilderForUser(user, ctl, ctl_r)) resource := NewNamespace(public.ProjectID).Resource(rbac.ResourceRepository) b.ResetTimer() @@ -125,15 +161,15 @@ func BenchmarkProjectEvaluator(b *testing.B) { } func BenchmarkProjectEvaluatorParallel(b *testing.B) { - ctl := &projecttesting.Controller{} + user := &models.User{UserID: 1, Username: "username"} + ctl := &mocksProject.Controller{} + ctl_r := &stubRoleCtl{} mock.OnAnything(ctl, "Get").Return(public, nil) mock.OnAnything(ctl, "ListRoles").Return([]int{common.RoleProjectAdmin}, nil) + ctl_r.On("Get", testifymock.Anything, int64(common.RoleProjectAdmin), testifymock.Anything). + Return(builtinRole(common.RoleProjectAdmin), nil) - user := &models.User{ - UserID: 1, - Username: "username", - } - evaluator := NewEvaluator(ctl, NewBuilderForUser(user, ctl)) + evaluator := NewEvaluator(ctl, NewBuilderForUser(user, ctl, ctl_r)) resource := NewNamespace(public.ProjectID).Resource(rbac.ResourceRepository) b.RunParallel(func(pb *testing.PB) { diff --git a/src/common/rbac/project/rbac_role.go b/src/common/rbac/project/rbac_role.go index c40ba4ce709..143ec3008c6 100644 --- a/src/common/rbac/project/rbac_role.go +++ b/src/common/rbac/project/rbac_role.go @@ -15,336 +15,33 @@ package project import ( - "github.com/goharbor/harbor/src/common" - "github.com/goharbor/harbor/src/common/rbac" + "github.com/goharbor/harbor/src/controller/role" "github.com/goharbor/harbor/src/pkg/permission/types" ) -var ( - rolePoliciesMap = map[string][]*types.Policy{ - "projectAdmin": { - {Resource: rbac.ResourceSelf, Action: rbac.ActionRead}, - {Resource: rbac.ResourceSelf, Action: rbac.ActionUpdate}, - {Resource: rbac.ResourceSelf, Action: rbac.ActionDelete}, - - {Resource: rbac.ResourceMember, Action: rbac.ActionCreate}, - {Resource: rbac.ResourceMember, Action: rbac.ActionRead}, - {Resource: rbac.ResourceMember, Action: rbac.ActionUpdate}, - {Resource: rbac.ResourceMember, Action: rbac.ActionDelete}, - {Resource: rbac.ResourceMember, Action: rbac.ActionList}, - - {Resource: rbac.ResourceMetadata, Action: rbac.ActionCreate}, - {Resource: rbac.ResourceMetadata, Action: rbac.ActionRead}, - {Resource: rbac.ResourceMetadata, Action: rbac.ActionUpdate}, - {Resource: rbac.ResourceMetadata, Action: rbac.ActionDelete}, - - {Resource: rbac.ResourceLog, Action: rbac.ActionList}, - - {Resource: rbac.ResourceLabel, Action: rbac.ActionCreate}, - {Resource: rbac.ResourceLabel, Action: rbac.ActionRead}, - {Resource: rbac.ResourceLabel, Action: rbac.ActionUpdate}, - {Resource: rbac.ResourceLabel, Action: rbac.ActionDelete}, - {Resource: rbac.ResourceLabel, Action: rbac.ActionList}, - - {Resource: rbac.ResourceQuota, Action: rbac.ActionRead}, - - {Resource: rbac.ResourceRepository, Action: rbac.ActionCreate}, - {Resource: rbac.ResourceRepository, Action: rbac.ActionRead}, - {Resource: rbac.ResourceRepository, Action: rbac.ActionUpdate}, - {Resource: rbac.ResourceRepository, Action: rbac.ActionDelete}, - {Resource: rbac.ResourceRepository, Action: rbac.ActionList}, - {Resource: rbac.ResourceRepository, Action: rbac.ActionPull}, - {Resource: rbac.ResourceRepository, Action: rbac.ActionPush}, - - {Resource: rbac.ResourceTagRetention, Action: rbac.ActionCreate}, - {Resource: rbac.ResourceTagRetention, Action: rbac.ActionRead}, - {Resource: rbac.ResourceTagRetention, Action: rbac.ActionUpdate}, - {Resource: rbac.ResourceTagRetention, Action: rbac.ActionDelete}, - {Resource: rbac.ResourceTagRetention, Action: rbac.ActionList}, - {Resource: rbac.ResourceTagRetention, Action: rbac.ActionOperate}, - - {Resource: rbac.ResourceImmutableTag, Action: rbac.ActionCreate}, - {Resource: rbac.ResourceImmutableTag, Action: rbac.ActionUpdate}, - {Resource: rbac.ResourceImmutableTag, Action: rbac.ActionDelete}, - {Resource: rbac.ResourceImmutableTag, Action: rbac.ActionList}, - - {Resource: rbac.ResourceConfiguration, Action: rbac.ActionRead}, - {Resource: rbac.ResourceConfiguration, Action: rbac.ActionUpdate}, - - {Resource: rbac.ResourceRobot, Action: rbac.ActionCreate}, - {Resource: rbac.ResourceRobot, Action: rbac.ActionRead}, - {Resource: rbac.ResourceRobot, Action: rbac.ActionUpdate}, - {Resource: rbac.ResourceRobot, Action: rbac.ActionDelete}, - {Resource: rbac.ResourceRobot, Action: rbac.ActionList}, - - {Resource: rbac.ResourceNotificationPolicy, Action: rbac.ActionCreate}, - {Resource: rbac.ResourceNotificationPolicy, Action: rbac.ActionUpdate}, - {Resource: rbac.ResourceNotificationPolicy, Action: rbac.ActionDelete}, - {Resource: rbac.ResourceNotificationPolicy, Action: rbac.ActionList}, - {Resource: rbac.ResourceNotificationPolicy, Action: rbac.ActionRead}, - - {Resource: rbac.ResourceScan, Action: rbac.ActionCreate}, - {Resource: rbac.ResourceScan, Action: rbac.ActionRead}, - {Resource: rbac.ResourceScan, Action: rbac.ActionStop}, - {Resource: rbac.ResourceSBOM, Action: rbac.ActionCreate}, - {Resource: rbac.ResourceSBOM, Action: rbac.ActionStop}, - {Resource: rbac.ResourceSBOM, Action: rbac.ActionRead}, - - {Resource: rbac.ResourceScanner, Action: rbac.ActionRead}, - {Resource: rbac.ResourceScanner, Action: rbac.ActionCreate}, - - {Resource: rbac.ResourceArtifact, Action: rbac.ActionCreate}, - {Resource: rbac.ResourceArtifact, Action: rbac.ActionRead}, - {Resource: rbac.ResourceArtifact, Action: rbac.ActionDelete}, - {Resource: rbac.ResourceArtifact, Action: rbac.ActionList}, - {Resource: rbac.ResourceArtifactAddition, Action: rbac.ActionRead}, - - {Resource: rbac.ResourceTag, Action: rbac.ActionList}, - {Resource: rbac.ResourceTag, Action: rbac.ActionCreate}, - {Resource: rbac.ResourceTag, Action: rbac.ActionDelete}, - - {Resource: rbac.ResourceAccessory, Action: rbac.ActionList}, - - {Resource: rbac.ResourceArtifactLabel, Action: rbac.ActionCreate}, - {Resource: rbac.ResourceArtifactLabel, Action: rbac.ActionDelete}, - - {Resource: rbac.ResourcePreatPolicy, Action: rbac.ActionCreate}, - {Resource: rbac.ResourcePreatPolicy, Action: rbac.ActionRead}, - {Resource: rbac.ResourcePreatPolicy, Action: rbac.ActionUpdate}, - {Resource: rbac.ResourcePreatPolicy, Action: rbac.ActionDelete}, - {Resource: rbac.ResourcePreatPolicy, Action: rbac.ActionList}, - - {Resource: rbac.ResourceExportCVE, Action: rbac.ActionCreate}, - {Resource: rbac.ResourceExportCVE, Action: rbac.ActionRead}, - {Resource: rbac.ResourceExportCVE, Action: rbac.ActionList}, - }, - - "maintainer": { - {Resource: rbac.ResourceSelf, Action: rbac.ActionRead}, - - {Resource: rbac.ResourceMember, Action: rbac.ActionRead}, - {Resource: rbac.ResourceMember, Action: rbac.ActionList}, - - {Resource: rbac.ResourceMetadata, Action: rbac.ActionRead}, - - {Resource: rbac.ResourceQuota, Action: rbac.ActionRead}, - - {Resource: rbac.ResourceLabel, Action: rbac.ActionCreate}, - {Resource: rbac.ResourceLabel, Action: rbac.ActionRead}, - {Resource: rbac.ResourceLabel, Action: rbac.ActionUpdate}, - {Resource: rbac.ResourceLabel, Action: rbac.ActionDelete}, - {Resource: rbac.ResourceLabel, Action: rbac.ActionList}, - - {Resource: rbac.ResourceRepository, Action: rbac.ActionCreate}, - {Resource: rbac.ResourceRepository, Action: rbac.ActionRead}, - {Resource: rbac.ResourceRepository, Action: rbac.ActionUpdate}, - {Resource: rbac.ResourceRepository, Action: rbac.ActionDelete}, - {Resource: rbac.ResourceRepository, Action: rbac.ActionList}, - {Resource: rbac.ResourceRepository, Action: rbac.ActionPush}, - {Resource: rbac.ResourceRepository, Action: rbac.ActionPull}, - - {Resource: rbac.ResourceTagRetention, Action: rbac.ActionCreate}, - {Resource: rbac.ResourceTagRetention, Action: rbac.ActionRead}, - {Resource: rbac.ResourceTagRetention, Action: rbac.ActionUpdate}, - {Resource: rbac.ResourceTagRetention, Action: rbac.ActionDelete}, - {Resource: rbac.ResourceTagRetention, Action: rbac.ActionList}, - {Resource: rbac.ResourceTagRetention, Action: rbac.ActionOperate}, - - {Resource: rbac.ResourceAccessory, Action: rbac.ActionList}, - - {Resource: rbac.ResourceImmutableTag, Action: rbac.ActionCreate}, - {Resource: rbac.ResourceImmutableTag, Action: rbac.ActionUpdate}, - {Resource: rbac.ResourceImmutableTag, Action: rbac.ActionDelete}, - {Resource: rbac.ResourceImmutableTag, Action: rbac.ActionList}, - - {Resource: rbac.ResourceConfiguration, Action: rbac.ActionRead}, - - {Resource: rbac.ResourceRobot, Action: rbac.ActionRead}, - {Resource: rbac.ResourceRobot, Action: rbac.ActionList}, - - {Resource: rbac.ResourceNotificationPolicy, Action: rbac.ActionRead}, - {Resource: rbac.ResourceNotificationPolicy, Action: rbac.ActionList}, - - {Resource: rbac.ResourceScan, Action: rbac.ActionCreate}, - {Resource: rbac.ResourceScan, Action: rbac.ActionRead}, - {Resource: rbac.ResourceScan, Action: rbac.ActionStop}, - {Resource: rbac.ResourceSBOM, Action: rbac.ActionCreate}, - {Resource: rbac.ResourceSBOM, Action: rbac.ActionStop}, - {Resource: rbac.ResourceSBOM, Action: rbac.ActionRead}, - - {Resource: rbac.ResourceScanner, Action: rbac.ActionRead}, - - {Resource: rbac.ResourceArtifact, Action: rbac.ActionCreate}, - {Resource: rbac.ResourceArtifact, Action: rbac.ActionRead}, - {Resource: rbac.ResourceArtifact, Action: rbac.ActionDelete}, - {Resource: rbac.ResourceArtifact, Action: rbac.ActionList}, - {Resource: rbac.ResourceArtifactAddition, Action: rbac.ActionRead}, - - {Resource: rbac.ResourceTag, Action: rbac.ActionList}, - {Resource: rbac.ResourceTag, Action: rbac.ActionCreate}, - {Resource: rbac.ResourceTag, Action: rbac.ActionDelete}, - - {Resource: rbac.ResourceArtifactLabel, Action: rbac.ActionCreate}, - {Resource: rbac.ResourceArtifactLabel, Action: rbac.ActionDelete}, - - {Resource: rbac.ResourceExportCVE, Action: rbac.ActionCreate}, - {Resource: rbac.ResourceExportCVE, Action: rbac.ActionRead}, - {Resource: rbac.ResourceExportCVE, Action: rbac.ActionList}, - }, - - "developer": { - {Resource: rbac.ResourceSelf, Action: rbac.ActionRead}, - - {Resource: rbac.ResourceMember, Action: rbac.ActionRead}, - {Resource: rbac.ResourceMember, Action: rbac.ActionList}, - - {Resource: rbac.ResourceLabel, Action: rbac.ActionRead}, - {Resource: rbac.ResourceLabel, Action: rbac.ActionList}, - - {Resource: rbac.ResourceQuota, Action: rbac.ActionRead}, - - {Resource: rbac.ResourceRepository, Action: rbac.ActionCreate}, - {Resource: rbac.ResourceRepository, Action: rbac.ActionRead}, - {Resource: rbac.ResourceRepository, Action: rbac.ActionUpdate}, - {Resource: rbac.ResourceRepository, Action: rbac.ActionList}, - {Resource: rbac.ResourceRepository, Action: rbac.ActionPush}, - {Resource: rbac.ResourceRepository, Action: rbac.ActionPull}, - - {Resource: rbac.ResourceTagRetention, Action: rbac.ActionCreate}, - {Resource: rbac.ResourceTagRetention, Action: rbac.ActionRead}, - {Resource: rbac.ResourceTagRetention, Action: rbac.ActionUpdate}, - {Resource: rbac.ResourceTagRetention, Action: rbac.ActionDelete}, - {Resource: rbac.ResourceTagRetention, Action: rbac.ActionList}, - {Resource: rbac.ResourceTagRetention, Action: rbac.ActionOperate}, - - {Resource: rbac.ResourceConfiguration, Action: rbac.ActionRead}, - - {Resource: rbac.ResourceRobot, Action: rbac.ActionRead}, - {Resource: rbac.ResourceRobot, Action: rbac.ActionList}, - - {Resource: rbac.ResourceScan, Action: rbac.ActionRead}, - {Resource: rbac.ResourceSBOM, Action: rbac.ActionRead}, - - {Resource: rbac.ResourceScanner, Action: rbac.ActionRead}, - - {Resource: rbac.ResourceArtifact, Action: rbac.ActionCreate}, - {Resource: rbac.ResourceArtifact, Action: rbac.ActionRead}, - {Resource: rbac.ResourceArtifact, Action: rbac.ActionList}, - {Resource: rbac.ResourceArtifactAddition, Action: rbac.ActionRead}, - - {Resource: rbac.ResourceTag, Action: rbac.ActionList}, - {Resource: rbac.ResourceTag, Action: rbac.ActionCreate}, - - {Resource: rbac.ResourceAccessory, Action: rbac.ActionList}, - - {Resource: rbac.ResourceArtifactLabel, Action: rbac.ActionCreate}, - {Resource: rbac.ResourceArtifactLabel, Action: rbac.ActionDelete}, - - {Resource: rbac.ResourceExportCVE, Action: rbac.ActionCreate}, - {Resource: rbac.ResourceExportCVE, Action: rbac.ActionRead}, - {Resource: rbac.ResourceExportCVE, Action: rbac.ActionList}, - }, - - "guest": { - {Resource: rbac.ResourceSelf, Action: rbac.ActionRead}, - - {Resource: rbac.ResourceMember, Action: rbac.ActionRead}, - {Resource: rbac.ResourceMember, Action: rbac.ActionList}, - - {Resource: rbac.ResourceLabel, Action: rbac.ActionRead}, - {Resource: rbac.ResourceLabel, Action: rbac.ActionList}, - - {Resource: rbac.ResourceQuota, Action: rbac.ActionRead}, - - {Resource: rbac.ResourceRepository, Action: rbac.ActionRead}, - {Resource: rbac.ResourceRepository, Action: rbac.ActionList}, - {Resource: rbac.ResourceRepository, Action: rbac.ActionPull}, - - {Resource: rbac.ResourceConfiguration, Action: rbac.ActionRead}, - - {Resource: rbac.ResourceRobot, Action: rbac.ActionRead}, - {Resource: rbac.ResourceRobot, Action: rbac.ActionList}, - - {Resource: rbac.ResourceScan, Action: rbac.ActionRead}, - {Resource: rbac.ResourceSBOM, Action: rbac.ActionRead}, - - {Resource: rbac.ResourceScanner, Action: rbac.ActionRead}, - - {Resource: rbac.ResourceTag, Action: rbac.ActionList}, - {Resource: rbac.ResourceAccessory, Action: rbac.ActionList}, - - {Resource: rbac.ResourceArtifact, Action: rbac.ActionRead}, - {Resource: rbac.ResourceArtifact, Action: rbac.ActionList}, - {Resource: rbac.ResourceArtifactAddition, Action: rbac.ActionRead}, - }, - - "limitedGuest": { - {Resource: rbac.ResourceSelf, Action: rbac.ActionRead}, - - {Resource: rbac.ResourceQuota, Action: rbac.ActionRead}, - - {Resource: rbac.ResourceRepository, Action: rbac.ActionList}, - {Resource: rbac.ResourceRepository, Action: rbac.ActionRead}, - {Resource: rbac.ResourceRepository, Action: rbac.ActionPull}, - - {Resource: rbac.ResourceConfiguration, Action: rbac.ActionRead}, - - {Resource: rbac.ResourceScan, Action: rbac.ActionRead}, - {Resource: rbac.ResourceSBOM, Action: rbac.ActionRead}, - - {Resource: rbac.ResourceScanner, Action: rbac.ActionRead}, - - {Resource: rbac.ResourceTag, Action: rbac.ActionList}, - {Resource: rbac.ResourceAccessory, Action: rbac.ActionList}, - - {Resource: rbac.ResourceArtifact, Action: rbac.ActionRead}, - {Resource: rbac.ResourceArtifact, Action: rbac.ActionList}, - {Resource: rbac.ResourceArtifactAddition, Action: rbac.ActionRead}, - }, - } -) - // projectRBACRole implement the RBACRole interface type projectRBACRole struct { projectID int64 - roleID int + role *role.Role } -// GetRoleName returns role name for the visitor role func (role *projectRBACRole) GetRoleName() string { - switch role.roleID { - case common.RoleProjectAdmin: - return "projectAdmin" - case common.RoleMaintainer: - return "maintainer" - case common.RoleDeveloper: - return "developer" - case common.RoleGuest: - return "guest" - case common.RoleLimitedGuest: - return "limitedGuest" - default: - return "" - } + return role.role.Name } // GetPolicies returns policies for the visitor role func (role *projectRBACRole) GetPolicies() []*types.Policy { policies := []*types.Policy{} - - roleName := role.GetRoleName() - if roleName == "" { - return policies - } - namespace := NewNamespace(role.projectID) - for _, policy := range rolePoliciesMap[roleName] { - policies = append(policies, &types.Policy{ - Resource: namespace.Resource(policy.Resource), - Action: policy.Action, - Effect: policy.Effect, - }) - } + for _, permission := range role.role.Permissions { + for _, policy := range permission.Access { + policies = append(policies, &types.Policy{ + Resource: namespace.Resource(policy.Resource), + Action: policy.Action, + Effect: policy.Effect, + }) + } + } return policies } diff --git a/src/common/rbac/project/rbac_user.go b/src/common/rbac/project/rbac_user.go index 6a716de78bf..dda546ebfbb 100644 --- a/src/common/rbac/project/rbac_user.go +++ b/src/common/rbac/project/rbac_user.go @@ -15,6 +15,7 @@ package project import ( + "github.com/goharbor/harbor/src/controller/role" "github.com/goharbor/harbor/src/pkg/permission/types" "github.com/goharbor/harbor/src/pkg/project/models" ) @@ -22,7 +23,7 @@ import ( type rbacUser struct { project *models.Project username string - projectRoles []int + projectRoles []*role.Role policies []*types.Policy } @@ -43,10 +44,11 @@ func (pru *rbacUser) GetPolicies() []*types.Policy { } // GetRoles returns roles of the visitor + func (pru *rbacUser) GetRoles() []types.RBACRole { roles := []types.RBACRole{} - for _, roleID := range pru.projectRoles { - roles = append(roles, &projectRBACRole{projectID: pru.project.ProjectID, roleID: roleID}) + for _, role := range pru.projectRoles { + roles = append(roles, &projectRBACRole{projectID: pru.project.ProjectID, role: role}) } return roles diff --git a/src/common/rbac/project/rbac_util.go b/src/common/rbac/project/rbac_util.go index d93e44d32bd..de65f060bc6 100644 --- a/src/common/rbac/project/rbac_util.go +++ b/src/common/rbac/project/rbac_util.go @@ -41,6 +41,289 @@ var ( {Resource: rbac.ResourceAccessory, Action: rbac.ActionList}, } + rolePoliciesMap = map[string][]*types.Policy{ + "projectAdmin": { + {Resource: rbac.ResourceSelf, Action: rbac.ActionRead}, + {Resource: rbac.ResourceSelf, Action: rbac.ActionUpdate}, + {Resource: rbac.ResourceSelf, Action: rbac.ActionDelete}, + + {Resource: rbac.ResourceMember, Action: rbac.ActionCreate}, + {Resource: rbac.ResourceMember, Action: rbac.ActionRead}, + {Resource: rbac.ResourceMember, Action: rbac.ActionUpdate}, + {Resource: rbac.ResourceMember, Action: rbac.ActionDelete}, + {Resource: rbac.ResourceMember, Action: rbac.ActionList}, + + {Resource: rbac.ResourceMetadata, Action: rbac.ActionCreate}, + {Resource: rbac.ResourceMetadata, Action: rbac.ActionRead}, + {Resource: rbac.ResourceMetadata, Action: rbac.ActionUpdate}, + {Resource: rbac.ResourceMetadata, Action: rbac.ActionDelete}, + {Resource: rbac.ResourceMetadata, Action: rbac.ActionList}, + + {Resource: rbac.ResourceLog, Action: rbac.ActionList}, + + {Resource: rbac.ResourceLabel, Action: rbac.ActionCreate}, + {Resource: rbac.ResourceLabel, Action: rbac.ActionRead}, + {Resource: rbac.ResourceLabel, Action: rbac.ActionUpdate}, + {Resource: rbac.ResourceLabel, Action: rbac.ActionDelete}, + {Resource: rbac.ResourceLabel, Action: rbac.ActionList}, + + {Resource: rbac.ResourceQuota, Action: rbac.ActionRead}, + + {Resource: rbac.ResourceRepository, Action: rbac.ActionCreate}, + {Resource: rbac.ResourceRepository, Action: rbac.ActionRead}, + {Resource: rbac.ResourceRepository, Action: rbac.ActionUpdate}, + {Resource: rbac.ResourceRepository, Action: rbac.ActionDelete}, + {Resource: rbac.ResourceRepository, Action: rbac.ActionList}, + {Resource: rbac.ResourceRepository, Action: rbac.ActionPull}, + {Resource: rbac.ResourceRepository, Action: rbac.ActionPush}, + + {Resource: rbac.ResourceTagRetention, Action: rbac.ActionCreate}, + {Resource: rbac.ResourceTagRetention, Action: rbac.ActionRead}, + {Resource: rbac.ResourceTagRetention, Action: rbac.ActionUpdate}, + {Resource: rbac.ResourceTagRetention, Action: rbac.ActionDelete}, + {Resource: rbac.ResourceTagRetention, Action: rbac.ActionList}, + {Resource: rbac.ResourceTagRetention, Action: rbac.ActionOperate}, + + {Resource: rbac.ResourceImmutableTag, Action: rbac.ActionCreate}, + {Resource: rbac.ResourceImmutableTag, Action: rbac.ActionUpdate}, + {Resource: rbac.ResourceImmutableTag, Action: rbac.ActionDelete}, + {Resource: rbac.ResourceImmutableTag, Action: rbac.ActionList}, + + {Resource: rbac.ResourceConfiguration, Action: rbac.ActionRead}, + {Resource: rbac.ResourceConfiguration, Action: rbac.ActionUpdate}, + + {Resource: rbac.ResourceRobot, Action: rbac.ActionCreate}, + {Resource: rbac.ResourceRobot, Action: rbac.ActionRead}, + {Resource: rbac.ResourceRobot, Action: rbac.ActionUpdate}, + {Resource: rbac.ResourceRobot, Action: rbac.ActionDelete}, + {Resource: rbac.ResourceRobot, Action: rbac.ActionList}, + + {Resource: rbac.ResourceNotificationPolicy, Action: rbac.ActionCreate}, + {Resource: rbac.ResourceNotificationPolicy, Action: rbac.ActionUpdate}, + {Resource: rbac.ResourceNotificationPolicy, Action: rbac.ActionDelete}, + {Resource: rbac.ResourceNotificationPolicy, Action: rbac.ActionList}, + {Resource: rbac.ResourceNotificationPolicy, Action: rbac.ActionRead}, + + {Resource: rbac.ResourceScan, Action: rbac.ActionCreate}, + {Resource: rbac.ResourceScan, Action: rbac.ActionRead}, + {Resource: rbac.ResourceScan, Action: rbac.ActionStop}, + {Resource: rbac.ResourceSBOM, Action: rbac.ActionCreate}, + {Resource: rbac.ResourceSBOM, Action: rbac.ActionStop}, + {Resource: rbac.ResourceSBOM, Action: rbac.ActionRead}, + + {Resource: rbac.ResourceScanner, Action: rbac.ActionRead}, + {Resource: rbac.ResourceScanner, Action: rbac.ActionCreate}, + + {Resource: rbac.ResourceArtifact, Action: rbac.ActionCreate}, + {Resource: rbac.ResourceArtifact, Action: rbac.ActionRead}, + {Resource: rbac.ResourceArtifact, Action: rbac.ActionDelete}, + {Resource: rbac.ResourceArtifact, Action: rbac.ActionList}, + {Resource: rbac.ResourceArtifactAddition, Action: rbac.ActionRead}, + + {Resource: rbac.ResourceTag, Action: rbac.ActionList}, + {Resource: rbac.ResourceTag, Action: rbac.ActionCreate}, + {Resource: rbac.ResourceTag, Action: rbac.ActionDelete}, + + {Resource: rbac.ResourceAccessory, Action: rbac.ActionList}, + + {Resource: rbac.ResourceArtifactLabel, Action: rbac.ActionCreate}, + {Resource: rbac.ResourceArtifactLabel, Action: rbac.ActionDelete}, + + {Resource: rbac.ResourcePreatPolicy, Action: rbac.ActionCreate}, + {Resource: rbac.ResourcePreatPolicy, Action: rbac.ActionRead}, + {Resource: rbac.ResourcePreatPolicy, Action: rbac.ActionUpdate}, + {Resource: rbac.ResourcePreatPolicy, Action: rbac.ActionDelete}, + {Resource: rbac.ResourcePreatPolicy, Action: rbac.ActionList}, + + {Resource: rbac.ResourceExportCVE, Action: rbac.ActionCreate}, + {Resource: rbac.ResourceExportCVE, Action: rbac.ActionRead}, + {Resource: rbac.ResourceExportCVE, Action: rbac.ActionList}, + }, + + "maintainer": { + {Resource: rbac.ResourceSelf, Action: rbac.ActionRead}, + + {Resource: rbac.ResourceMember, Action: rbac.ActionRead}, + {Resource: rbac.ResourceMember, Action: rbac.ActionList}, + + {Resource: rbac.ResourceMetadata, Action: rbac.ActionRead}, + + {Resource: rbac.ResourceQuota, Action: rbac.ActionRead}, + + {Resource: rbac.ResourceLabel, Action: rbac.ActionCreate}, + {Resource: rbac.ResourceLabel, Action: rbac.ActionRead}, + {Resource: rbac.ResourceLabel, Action: rbac.ActionUpdate}, + {Resource: rbac.ResourceLabel, Action: rbac.ActionDelete}, + {Resource: rbac.ResourceLabel, Action: rbac.ActionList}, + + {Resource: rbac.ResourceRepository, Action: rbac.ActionCreate}, + {Resource: rbac.ResourceRepository, Action: rbac.ActionRead}, + {Resource: rbac.ResourceRepository, Action: rbac.ActionUpdate}, + {Resource: rbac.ResourceRepository, Action: rbac.ActionDelete}, + {Resource: rbac.ResourceRepository, Action: rbac.ActionList}, + {Resource: rbac.ResourceRepository, Action: rbac.ActionPush}, + {Resource: rbac.ResourceRepository, Action: rbac.ActionPull}, + + {Resource: rbac.ResourceTagRetention, Action: rbac.ActionCreate}, + {Resource: rbac.ResourceTagRetention, Action: rbac.ActionRead}, + {Resource: rbac.ResourceTagRetention, Action: rbac.ActionUpdate}, + {Resource: rbac.ResourceTagRetention, Action: rbac.ActionDelete}, + {Resource: rbac.ResourceTagRetention, Action: rbac.ActionList}, + {Resource: rbac.ResourceTagRetention, Action: rbac.ActionOperate}, + + {Resource: rbac.ResourceAccessory, Action: rbac.ActionList}, + + {Resource: rbac.ResourceImmutableTag, Action: rbac.ActionCreate}, + {Resource: rbac.ResourceImmutableTag, Action: rbac.ActionUpdate}, + {Resource: rbac.ResourceImmutableTag, Action: rbac.ActionDelete}, + {Resource: rbac.ResourceImmutableTag, Action: rbac.ActionList}, + + {Resource: rbac.ResourceConfiguration, Action: rbac.ActionRead}, + + {Resource: rbac.ResourceRobot, Action: rbac.ActionRead}, + {Resource: rbac.ResourceRobot, Action: rbac.ActionList}, + + {Resource: rbac.ResourceNotificationPolicy, Action: rbac.ActionRead}, + {Resource: rbac.ResourceNotificationPolicy, Action: rbac.ActionList}, + + {Resource: rbac.ResourceScan, Action: rbac.ActionCreate}, + {Resource: rbac.ResourceScan, Action: rbac.ActionRead}, + {Resource: rbac.ResourceScan, Action: rbac.ActionStop}, + {Resource: rbac.ResourceSBOM, Action: rbac.ActionCreate}, + {Resource: rbac.ResourceSBOM, Action: rbac.ActionStop}, + {Resource: rbac.ResourceSBOM, Action: rbac.ActionRead}, + + {Resource: rbac.ResourceScanner, Action: rbac.ActionRead}, + + {Resource: rbac.ResourceArtifact, Action: rbac.ActionCreate}, + {Resource: rbac.ResourceArtifact, Action: rbac.ActionRead}, + {Resource: rbac.ResourceArtifact, Action: rbac.ActionDelete}, + {Resource: rbac.ResourceArtifact, Action: rbac.ActionList}, + {Resource: rbac.ResourceArtifactAddition, Action: rbac.ActionRead}, + + {Resource: rbac.ResourceTag, Action: rbac.ActionList}, + {Resource: rbac.ResourceTag, Action: rbac.ActionCreate}, + {Resource: rbac.ResourceTag, Action: rbac.ActionDelete}, + + {Resource: rbac.ResourceArtifactLabel, Action: rbac.ActionCreate}, + {Resource: rbac.ResourceArtifactLabel, Action: rbac.ActionDelete}, + + {Resource: rbac.ResourceExportCVE, Action: rbac.ActionCreate}, + {Resource: rbac.ResourceExportCVE, Action: rbac.ActionRead}, + {Resource: rbac.ResourceExportCVE, Action: rbac.ActionList}, + }, + + "developer": { + {Resource: rbac.ResourceSelf, Action: rbac.ActionRead}, + + {Resource: rbac.ResourceMember, Action: rbac.ActionRead}, + {Resource: rbac.ResourceMember, Action: rbac.ActionList}, + + {Resource: rbac.ResourceLabel, Action: rbac.ActionRead}, + {Resource: rbac.ResourceLabel, Action: rbac.ActionList}, + + {Resource: rbac.ResourceQuota, Action: rbac.ActionRead}, + + {Resource: rbac.ResourceRepository, Action: rbac.ActionCreate}, + {Resource: rbac.ResourceRepository, Action: rbac.ActionRead}, + {Resource: rbac.ResourceRepository, Action: rbac.ActionUpdate}, + {Resource: rbac.ResourceRepository, Action: rbac.ActionList}, + {Resource: rbac.ResourceRepository, Action: rbac.ActionPush}, + {Resource: rbac.ResourceRepository, Action: rbac.ActionPull}, + + {Resource: rbac.ResourceTagRetention, Action: rbac.ActionCreate}, + {Resource: rbac.ResourceTagRetention, Action: rbac.ActionRead}, + {Resource: rbac.ResourceTagRetention, Action: rbac.ActionUpdate}, + {Resource: rbac.ResourceTagRetention, Action: rbac.ActionDelete}, + {Resource: rbac.ResourceTagRetention, Action: rbac.ActionList}, + {Resource: rbac.ResourceTagRetention, Action: rbac.ActionOperate}, + + {Resource: rbac.ResourceConfiguration, Action: rbac.ActionRead}, + + {Resource: rbac.ResourceRobot, Action: rbac.ActionRead}, + {Resource: rbac.ResourceRobot, Action: rbac.ActionList}, + + {Resource: rbac.ResourceScan, Action: rbac.ActionRead}, + {Resource: rbac.ResourceSBOM, Action: rbac.ActionRead}, + + {Resource: rbac.ResourceScanner, Action: rbac.ActionRead}, + + {Resource: rbac.ResourceArtifact, Action: rbac.ActionCreate}, + {Resource: rbac.ResourceArtifact, Action: rbac.ActionRead}, + {Resource: rbac.ResourceArtifact, Action: rbac.ActionList}, + {Resource: rbac.ResourceArtifactAddition, Action: rbac.ActionRead}, + + {Resource: rbac.ResourceTag, Action: rbac.ActionList}, + {Resource: rbac.ResourceTag, Action: rbac.ActionCreate}, + + {Resource: rbac.ResourceAccessory, Action: rbac.ActionList}, + + {Resource: rbac.ResourceArtifactLabel, Action: rbac.ActionCreate}, + {Resource: rbac.ResourceArtifactLabel, Action: rbac.ActionDelete}, + + {Resource: rbac.ResourceExportCVE, Action: rbac.ActionCreate}, + {Resource: rbac.ResourceExportCVE, Action: rbac.ActionRead}, + {Resource: rbac.ResourceExportCVE, Action: rbac.ActionList}, + }, + + "guest": { + {Resource: rbac.ResourceSelf, Action: rbac.ActionRead}, + + {Resource: rbac.ResourceMember, Action: rbac.ActionRead}, + {Resource: rbac.ResourceMember, Action: rbac.ActionList}, + + {Resource: rbac.ResourceLabel, Action: rbac.ActionRead}, + {Resource: rbac.ResourceLabel, Action: rbac.ActionList}, + + {Resource: rbac.ResourceQuota, Action: rbac.ActionRead}, + + {Resource: rbac.ResourceRepository, Action: rbac.ActionRead}, + {Resource: rbac.ResourceRepository, Action: rbac.ActionList}, + {Resource: rbac.ResourceRepository, Action: rbac.ActionPull}, + + {Resource: rbac.ResourceConfiguration, Action: rbac.ActionRead}, + + {Resource: rbac.ResourceRobot, Action: rbac.ActionRead}, + {Resource: rbac.ResourceRobot, Action: rbac.ActionList}, + + {Resource: rbac.ResourceScan, Action: rbac.ActionRead}, + {Resource: rbac.ResourceSBOM, Action: rbac.ActionRead}, + + {Resource: rbac.ResourceScanner, Action: rbac.ActionRead}, + + {Resource: rbac.ResourceTag, Action: rbac.ActionList}, + {Resource: rbac.ResourceAccessory, Action: rbac.ActionList}, + + {Resource: rbac.ResourceArtifact, Action: rbac.ActionRead}, + {Resource: rbac.ResourceArtifact, Action: rbac.ActionList}, + {Resource: rbac.ResourceArtifactAddition, Action: rbac.ActionRead}, + }, + + "limitedGuest": { + {Resource: rbac.ResourceSelf, Action: rbac.ActionRead}, + + {Resource: rbac.ResourceQuota, Action: rbac.ActionRead}, + + {Resource: rbac.ResourceRepository, Action: rbac.ActionList}, + {Resource: rbac.ResourceRepository, Action: rbac.ActionRead}, + {Resource: rbac.ResourceRepository, Action: rbac.ActionPull}, + + {Resource: rbac.ResourceConfiguration, Action: rbac.ActionRead}, + + {Resource: rbac.ResourceScan, Action: rbac.ActionRead}, + {Resource: rbac.ResourceSBOM, Action: rbac.ActionRead}, + + {Resource: rbac.ResourceScanner, Action: rbac.ActionRead}, + + {Resource: rbac.ResourceTag, Action: rbac.ActionList}, + {Resource: rbac.ResourceAccessory, Action: rbac.ActionList}, + + {Resource: rbac.ResourceArtifact, Action: rbac.ActionRead}, + {Resource: rbac.ResourceArtifact, Action: rbac.ActionList}, + {Resource: rbac.ResourceArtifactAddition, Action: rbac.ActionRead}, + }, + } + // sub policies for the projects subPoliciesForProject = computeSubPoliciesForProject() ) @@ -61,6 +344,7 @@ func getPoliciesForPublicProject(projectID int64) []*types.Policy { } // GetPoliciesOfProject returns all policies for projectNamespace of the project + func GetPoliciesOfProject(projectID int64) []*types.Policy { policies := []*types.Policy{} @@ -72,14 +356,15 @@ func GetPoliciesOfProject(projectID int64) []*types.Policy { Effect: policy.Effect, }) } - return policies } +/* This just fetches all the possible policies that can apply to a project */ func computeSubPoliciesForProject() []*types.Policy { var results []*types.Policy mp := map[string]bool{} + for _, policies := range rolePoliciesMap { for _, policy := range policies { if !mp[policy.String()] { diff --git a/src/common/security/local/context.go b/src/common/security/local/context.go index 1ca6e2ef320..2922d5af81d 100644 --- a/src/common/security/local/context.go +++ b/src/common/security/local/context.go @@ -21,6 +21,7 @@ import ( "github.com/goharbor/harbor/src/common/models" rbac_project "github.com/goharbor/harbor/src/common/rbac/project" "github.com/goharbor/harbor/src/controller/project" + "github.com/goharbor/harbor/src/controller/role" "github.com/goharbor/harbor/src/pkg/permission/evaluator" "github.com/goharbor/harbor/src/pkg/permission/evaluator/admin" "github.com/goharbor/harbor/src/pkg/permission/types" @@ -33,6 +34,7 @@ const ContextName = "local" type SecurityContext struct { user *models.User ctl project.Controller + ctlR role.Controller evaluator evaluator.Evaluator once sync.Once } @@ -42,6 +44,7 @@ func NewSecurityContext(user *models.User) *SecurityContext { return &SecurityContext{ user: user, ctl: project.Ctl, + ctlR: role.Ctl, } } @@ -91,7 +94,7 @@ func (s *SecurityContext) Can(ctx context.Context, action types.Action, resource evaluators = evaluators.Add(admin.New(s.GetUsername())) } - evaluators = evaluators.Add(rbac_project.NewEvaluator(s.ctl, rbac_project.NewBuilderForUser(s.user, s.ctl))) + evaluators = evaluators.Add(rbac_project.NewEvaluator(s.ctl, rbac_project.NewBuilderForUser(s.user, s.ctl, s.ctlR))) s.evaluator = evaluators }) diff --git a/src/controller/event/handler/init.go b/src/controller/event/handler/init.go index ecfc527cc35..88a33d4a2df 100644 --- a/src/controller/event/handler/init.go +++ b/src/controller/event/handler/init.go @@ -67,6 +67,9 @@ func init() { _ = notifier.Subscribe(event.TopicDeleteTag, &auditlog.Handler{}) _ = notifier.Subscribe(event.TopicCreateRobot, &auditlog.Handler{}) _ = notifier.Subscribe(event.TopicDeleteRobot, &auditlog.Handler{}) + _ = notifier.Subscribe(event.TopicCreateRole, &auditlog.Handler{}) + _ = notifier.Subscribe(event.TopicDeleteRole, &auditlog.Handler{}) + _ = notifier.Subscribe(event.TopicUpdateRole, &auditlog.Handler{}) _ = notifier.Subscribe(event.TopicCommonEvent, &auditlog.Handler{}) // internal diff --git a/src/controller/event/metadata/role.go b/src/controller/event/metadata/role.go new file mode 100644 index 00000000000..063e6911eb9 --- /dev/null +++ b/src/controller/event/metadata/role.go @@ -0,0 +1,96 @@ +// Copyright Project Harbor Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package metadata + +import ( + "context" + "time" + + "github.com/goharbor/harbor/src/common/security" + event2 "github.com/goharbor/harbor/src/controller/event" + "github.com/goharbor/harbor/src/pkg/notifier/event" + "github.com/goharbor/harbor/src/pkg/role/model" +) + +// CreateRoleEventMetadata is the metadata from which the create role event can be resolved +type CreateRoleEventMetadata struct { + Ctx context.Context + Role *model.Role +} + +// Resolve to the event from the metadata +func (c *CreateRoleEventMetadata) Resolve(event *event.Event) error { + data := &event2.CreateRoleEvent{ + EventType: event2.TopicCreateRole, + Role: c.Role, + OccurAt: time.Now(), + } + cx, exist := security.FromContext(c.Ctx) + if exist { + data.Operator = cx.GetUsername() + } + event.Topic = event2.TopicCreateRole + event.Data = data + return nil +} + +// UpdateRoleEventMetadata is the metadata from which the update role event can be resolved +type UpdateRoleEventMetadata struct { + Ctx context.Context + Role *model.Role +} + +// Resolve to the event from the metadata +func (u *UpdateRoleEventMetadata) Resolve(event *event.Event) error { + data := &event2.UpdateRoleEvent{ + EventType: event2.TopicUpdateRole, + Role: u.Role, + OccurAt: time.Now(), + } + cx, exist := security.FromContext(u.Ctx) + if exist { + data.Operator = cx.GetUsername() + } + event.Topic = event2.TopicUpdateRole + event.Data = data + return nil +} + +// DeleteRoleEventMetadata is the metadata from which the delete role event can be resolved +type DeleteRoleEventMetadata struct { + Ctx context.Context + Role *model.Role + Operator string +} + +// Resolve to the event from the metadata +func (d *DeleteRoleEventMetadata) Resolve(event *event.Event) error { + data := &event2.DeleteRoleEvent{ + EventType: event2.TopicDeleteRole, + Role: d.Role, + OccurAt: time.Now(), + } + if d.Operator != "" { + data.Operator = d.Operator + } else { + cx, exist := security.FromContext(d.Ctx) + if exist { + data.Operator = cx.GetUsername() + } + } + event.Topic = event2.TopicDeleteRole + event.Data = data + return nil +} diff --git a/src/controller/event/topic.go b/src/controller/event/topic.go index a9e6c56a492..71580699dd9 100644 --- a/src/controller/event/topic.go +++ b/src/controller/event/topic.go @@ -24,6 +24,7 @@ import ( "github.com/goharbor/harbor/src/pkg/auditext/model" proModels "github.com/goharbor/harbor/src/pkg/project/models" robotModel "github.com/goharbor/harbor/src/pkg/robot/model" + roleModel "github.com/goharbor/harbor/src/pkg/role/model" v1 "github.com/goharbor/harbor/src/pkg/scan/rest/v1" ) @@ -50,11 +51,15 @@ const ( TopicTagRetention = "TAG_RETENTION" TopicCreateRobot = "CREATE_ROBOT" TopicDeleteRobot = "DELETE_ROBOT" + TopicCreateRole = "CREATE_ROLE" + TopicDeleteRole = "DELETE_ROLE" + TopicUpdateRole = "UPDATE_ROLE" TopicCommonEvent = "COMMON_API" ResourceTypeProject = "project" ResourceTypeArtifact = "artifact" ResourceTypeRepository = "repository" ResourceTypeRobot = "robot" + ResourceTypeRole = "role" ResourceTypeTag = "tag" ) @@ -451,3 +456,82 @@ func (c *DeleteRobotEvent) String() string { return fmt.Sprintf("Name-%s Operator-%s OccurAt-%s", c.Robot.Name, c.Operator, c.OccurAt.Format("2006-01-02 15:04:05")) } + +// CreateRobotEvent is the creating robot event +type CreateRoleEvent struct { + EventType string + Role *roleModel.Role + Operator string + OccurAt time.Time +} + +// ResolveToAuditLog ... +func (c *CreateRoleEvent) ResolveToAuditLog() (*model.AuditLogExt, error) { + auditLog := &model.AuditLogExt{ + OpTime: c.OccurAt, + Operation: rbac.ActionCreate.String(), + Username: c.Operator, + ResourceType: ResourceTypeRole, + IsSuccessful: true, + OperationDescription: fmt.Sprintf("create role: %s", c.Role.Name), + Resource: c.Role.Name} + return auditLog, nil +} + +func (c *CreateRoleEvent) String() string { + return fmt.Sprintf("Name-%s Operator-%s OccurAt-%s", + c.Role.Name, c.Operator, c.OccurAt.Format("2006-01-02 15:04:05")) +} + +// DeleteRobotEvent is the deleting robot event +type DeleteRoleEvent struct { + EventType string + Role *roleModel.Role + Operator string + OccurAt time.Time +} + +// ResolveToAuditLog ... +func (c *DeleteRoleEvent) ResolveToAuditLog() (*model.AuditLogExt, error) { + auditLog := &model.AuditLogExt{ + OpTime: c.OccurAt, + Operation: rbac.ActionDelete.String(), + Username: c.Operator, + ResourceType: ResourceTypeRole, + IsSuccessful: true, + OperationDescription: fmt.Sprintf("delete role: %s", c.Role.Name), + Resource: c.Role.Name} + return auditLog, nil +} + +func (c *DeleteRoleEvent) String() string { + return fmt.Sprintf("Name-%s Operator-%s OccurAt-%s", + c.Role.Name, c.Operator, c.OccurAt.Format("2006-01-02 15:04:05")) +} + +// UpdateRoleEvent is the updating role event +type UpdateRoleEvent struct { + EventType string + Role *roleModel.Role + Operator string + OccurAt time.Time +} + +// ResolveToAuditLog ... +func (u *UpdateRoleEvent) ResolveToAuditLog() (*model.AuditLogExt, error) { + auditLog := &model.AuditLogExt{ + OpTime: u.OccurAt, + Operation: rbac.ActionUpdate.String(), + Username: u.Operator, + ResourceType: ResourceTypeRole, + IsSuccessful: true, + OperationDescription: fmt.Sprintf("update role: %s", u.Role.Name), + Resource: u.Role.Name, + } + return auditLog, nil +} + +func (u *UpdateRoleEvent) String() string { + return fmt.Sprintf("Name-%s Operator-%s OccurAt-%s", + u.Role.Name, u.Operator, u.OccurAt.Format("2006-01-02 15:04:05")) +} diff --git a/src/controller/member/controller.go b/src/controller/member/controller.go index bf632100938..3a6a383c8d8 100644 --- a/src/controller/member/controller.go +++ b/src/controller/member/controller.go @@ -235,7 +235,8 @@ func isValidRole(role int) bool { common.RoleLimitedGuest: return true default: - return false + // Custom role IDs are assigned sequentially above the built-in range + return role > common.RoleLimitedGuest } } diff --git a/src/controller/role/cache.go b/src/controller/role/cache.go new file mode 100644 index 00000000000..ad3ee6cf5bd --- /dev/null +++ b/src/controller/role/cache.go @@ -0,0 +1,311 @@ +// Copyright Project Harbor Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package role + +import ( + "context" + "errors" + "fmt" + "os" + "strconv" + "sync" + "time" + + "github.com/goharbor/harbor/src/lib/cache" + "github.com/goharbor/harbor/src/lib/log" + "github.com/goharbor/harbor/src/lib/orm" + "github.com/goharbor/harbor/src/lib/q" +) + +const ( + // defaultL1MemoryTTL is how long an entry in the process-local (L1) cache is + // trusted before it is re-validated against L2/DB. It is the dominant control + // on freshness: a change made on another node is picked up within this window + // (the shared L2 entry is deleted on write, so the next L1 refresh re-reads it). + defaultL1MemoryTTL = time.Second + // defaultL2RedisTTL is the disabled sentinel: Redis (L2) is OFF by default. + // RBAC is a per-request hot path, so we keep Redis off it unless an operator + // explicitly opts in via ROLE_CACHE_L2_REDIS_TTL — avoiding a new Redis + // availability/latency dependency on authz (see goharbor/harbor#23335, where a + // per-request Redis cache path exhausted the DB pool and hung core). L1's + // in-memory TTL bounds staleness without Redis. When enabled, 30m is the + // suggested value; it then doubles as the backstop for out-of-band DB changes + // (e.g. a direct SQL UPDATE to role_permission that bypasses the controller). + defaultL2RedisTTL = time.Duration(-1) + + // Env vars (see envDuration for the accepted format and the <=0 "disable" rule). + envL1MemoryTTL = "ROLE_CACHE_L1_MEMORY_TTL" + envL2RedisTTL = "ROLE_CACHE_L2_REDIS_TTL" +) + +// errRoleNotFound signals that the inner controller has no such role. It is used +// only to keep a missing role out of the cache (FetchOrSave must not persist a nil +// value); callers translate it back to the (nil, nil) not-found contract. +var errRoleNotFound = errors.New("role not found") + +// l1Entry is the process-local (L1) cache value: the role and the absolute +// instant after which it must be re-validated against L2/DB. +type l1Entry struct { + role *Role + expiresAt time.Time +} + +// cachingController decorates a role Controller with a two-level, staleness-bounded +// permission cache: +// +// L1 (memory, fresh within l1MemoryTTL) -> L2 (Redis, TTL l2RedisTTL) -> inner (DB) +// +// It implements Controller and embeds the inner controller, so Count/List pass +// straight through; only Get (with permissions) is served from the cache, and +// Create/Update/Delete invalidate it after the inner write succeeds. Either layer +// is disabled by setting its TTL <= 0 (env value -1); with both disabled every +// read goes straight to the inner controller. +type cachingController struct { + Controller // embedded inner (DB) controller — provides Count/List pass-through + + local sync.Map // id -> *l1Entry + l1MemoryTTL time.Duration // <=0 => L1 disabled + l2RedisTTL time.Duration // <=0 => Redis (L2) disabled + + // redisCache is the injected L2 backend; tests set a fake here. Nil in prod, + // where redis() uses the shared cache.Default(). + redisCache cache.Cache + + warmOnce sync.Once +} + +// newCachingController wraps inner with a cache configured from the environment +// (read once at process start, consistent with the rest of Harbor's env config). +func newCachingController(inner Controller) *cachingController { + return newCachingControllerWith( + inner, + envDuration(envL1MemoryTTL, defaultL1MemoryTTL), + envDuration(envL2RedisTTL, defaultL2RedisTTL), + ) +} + +// newCachingControllerWith wraps inner with explicit timings, so tests can +// exercise the layers without depending on import-time environment. +func newCachingControllerWith(inner Controller, l1MemoryTTL, l2RedisTTL time.Duration) *cachingController { + return &cachingController{ + Controller: inner, + l1MemoryTTL: l1MemoryTTL, + l2RedisTTL: l2RedisTTL, + } +} + +// envDuration reads name as an integer number of seconds, or a Go duration +// string (e.g. "30m"). A value <= 0 means "disabled" and is returned as -1. +// On a parse error the default is used. This mirrors the convention already used +// by the Redis cache options parser (src/lib/cache/redis/util.go). +func envDuration(name string, def time.Duration) time.Duration { + v := os.Getenv(name) + if v == "" { + return def + } + if i, err := strconv.Atoi(v); err == nil { + if i <= 0 { + return -1 // disabled + } + return time.Duration(i) * time.Second + } + if d, err := time.ParseDuration(v); err == nil { + if d <= 0 { + return -1 // disabled + } + return d + } + log.Errorf("failed to parse %s=%q, using default value %s", name, v, def) + return def +} + +func (c *cachingController) l1Enabled() bool { return c.l1MemoryTTL > 0 } +func (c *cachingController) l2Enabled() bool { return c.l2RedisTTL > 0 } + +// redis returns the L2 backend, or nil when L2 is disabled: the injected +// redisCache if set (tests), else the shared cache.Default(). The default is +// resolved lazily (not stored at construction) because role.Ctl is built at +// import time, before cache.Initialize runs at startup. +func (c *cachingController) redis() cache.Cache { + if !c.l2Enabled() { + return nil + } + if c.redisCache != nil { + return c.redisCache + } + return cache.Default() +} + +func roleCacheKey(id int64) string { + return fmt.Sprintf("role:%d", id) +} + +// Get serves a populated role from L1 -> L2 -> inner (DB). Reads without +// permissions are not cacheable and go straight to the inner controller. +func (c *cachingController) Get(ctx context.Context, id int64, option *Option) (*Role, error) { + if option == nil || !option.WithPermission { + return c.Controller.Get(ctx, id, option) + } + c.maybeWarm() + + // L1: process-local, valid only within its TTL window. + if c.l1Enabled() { + if v, ok := c.local.Load(id); ok { + if e := v.(*l1Entry); time.Now().Before(e.expiresAt) { + // return a copy so callers cannot mutate the cached role + return e.role.clone(), nil + } + } + } + + // build reads the source of truth (DB). A missing role is reported as + // errRoleNotFound so it is never written to the cache. + build := func() (*Role, error) { + r, err := c.Controller.Get(ctx, id, option) + if err != nil { + return nil, err + } + if r == nil { + return nil, errRoleNotFound + } + return r, nil + } + + // L2: Redis. FetchOrSave coalesces concurrent L1 misses for the same key + // (singleflight => a single DB build) and populates Redis with a + // non-cancelable context (l2RedisTTL). It runs only after an L1 miss, so the + // per-request hot path stays L1-only. On any L2/Redis error we fall through + // to a direct DB read, so a Redis hiccup never fails an authz check. + if rc := c.redis(); rc != nil { + var r Role + err := cache.FetchOrSave(ctx, rc, roleCacheKey(id), &r, func() (any, error) { + v, err := build() + if err != nil { + return nil, err + } + return v, nil + }, c.l2RedisTTL) + switch { + case errors.Is(err, errRoleNotFound): + return nil, nil + case err == nil: + c.storeL1(id, &r) // promote to L1 + return (&r).clone(), nil + default: + log.Warningf("role cache L2 path failed for id %d, falling back to DB: %v", id, err) + } + } + + // L2 disabled (or L2 errored above): read the DB directly and populate L1. + r, err := build() + if errors.Is(err, errRoleNotFound) { + return nil, nil + } + if err != nil { + return nil, err + } + c.storeL1(id, r) + return r.clone(), nil +} + +// Create delegates to the inner controller, then invalidates the cache. +func (c *cachingController) Create(ctx context.Context, r *Role) (int64, error) { + id, err := c.Controller.Create(ctx, r) + if err != nil { + return 0, err + } + c.invalidate(ctx, id) + return id, nil +} + +// Update delegates to the inner controller, then invalidates the cache. +func (c *cachingController) Update(ctx context.Context, r *Role, option *Option) error { + if err := c.Controller.Update(ctx, r, option); err != nil { + return err + } + // A successful inner Update guarantees a non-nil role with a valid ID (the + // inner controller rejects a nil role). Guard defensively, but log rather than + // silently skip: a missed invalidation would serve stale permissions. + if r == nil { + log.Warningf("role cache: Update succeeded with a nil role; cannot invalidate, permissions may be stale") + return nil + } + c.invalidate(ctx, r.ID) + return nil +} + +// Delete delegates to the inner controller, then invalidates the cache. +func (c *cachingController) Delete(ctx context.Context, id int64, option ...*Option) error { + if err := c.Controller.Delete(ctx, id, option...); err != nil { + return err + } + c.invalidate(ctx, id) + return nil +} + +// invalidate drops the changed role from both layers so the next reader re-reads +// the DB. Other nodes refresh within l1MemoryTTL. +func (c *cachingController) invalidate(ctx context.Context, id int64) { + if rc := c.redis(); rc != nil { + _ = rc.Delete(ctx, roleCacheKey(id)) + } + c.local.Delete(id) +} + +// storeL1 caches a role in the process-local L1 with an absolute expiry. No-op +// when L1 is disabled. +func (c *cachingController) storeL1(id int64, r *Role) { + if !c.l1Enabled() || r == nil { + return + } + c.local.Store(id, &l1Entry{role: r, expiresAt: time.Now().Add(c.l1MemoryTTL)}) +} + +// maybeWarm fires the background warm once, if there is a cache layer to warm into. +func (c *cachingController) maybeWarm() { + if !c.l1Enabled() && !c.l2Enabled() { + return + } + c.warmOnce.Do(func() { + go func() { + defer func() { + if rec := recover(); rec != nil { + log.Warningf("role permission cache warm aborted: %v", rec) + } + }() + c.warm(orm.Context()) + }() + }) +} + +// warm loads all roles with their permissions (via the inner controller) into the +// enabled cache layers. +func (c *cachingController) warm(ctx context.Context) { + roles, err := c.Controller.List(ctx, &q.Query{PageSize: -1}, &Option{WithPermission: true}) + if err != nil { + log.Warningf("failed to warm role permission cache: %v", err) + return + } + for _, r := range roles { + if r == nil { + continue + } + if rc := c.redis(); rc != nil { + _ = rc.Save(ctx, roleCacheKey(r.ID), r, c.l2RedisTTL) + } + c.storeL1(r.ID, r) + } + log.Debugf("role permission cache warmed with %d roles", len(roles)) +} diff --git a/src/controller/role/cache_test.go b/src/controller/role/cache_test.go new file mode 100644 index 00000000000..1f411c30e93 --- /dev/null +++ b/src/controller/role/cache_test.go @@ -0,0 +1,307 @@ +// Copyright Project Harbor Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package role + +import ( + "context" + "errors" + "sync/atomic" + "testing" + "time" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + + "github.com/goharbor/harbor/src/lib/cache" + _ "github.com/goharbor/harbor/src/lib/cache/memory" // register the in-memory provider + "github.com/goharbor/harbor/src/lib/q" + "github.com/goharbor/harbor/src/pkg/role/model" +) + +// stubController is a hand-rolled inner Controller for decorator tests; it counts +// calls and returns a canned role. (No generated mock exists for this interface — +// the file under src/testing/controller/role is a mislabeled project mock — and a +// local stub keeps the test in package role so it can assert cache internals.) +type stubController struct { + getCalls int32 + createCalls int32 + updateCalls int32 + deleteCalls int32 + returnNil bool // when true, Get reports the role as not found (nil, nil) +} + +func (s *stubController) Get(_ context.Context, id int64, _ *Option) (*Role, error) { + atomic.AddInt32(&s.getCalls, 1) + if s.returnNil { + return nil, nil + } + return &Role{Role: model.Role{ID: id, Name: "r"}}, nil +} +func (s *stubController) Count(context.Context, *q.Query) (int64, error) { return 0, nil } +func (s *stubController) Create(context.Context, *Role) (int64, error) { + atomic.AddInt32(&s.createCalls, 1) + return 1, nil +} +func (s *stubController) Delete(context.Context, int64, ...*Option) error { + atomic.AddInt32(&s.deleteCalls, 1) + return nil +} +func (s *stubController) Update(context.Context, *Role, *Option) error { + atomic.AddInt32(&s.updateCalls, 1) + return nil +} +func (s *stubController) List(context.Context, *q.Query, *Option) ([]*Role, error) { + return nil, nil // warm sees no roles +} + +func (s *stubController) gets() int32 { return atomic.LoadInt32(&s.getCalls) } + +func withPermission() *Option { return &Option{WithPermission: true} } + +func newMemoryCache(t *testing.T) cache.Cache { + t.Helper() + c, err := cache.New(cache.Memory) + require.NoError(t, err) + return c +} + +// L1 hit within the window does not delegate to the inner controller again. +func TestCacheL1Hit(t *testing.T) { + inner := &stubController{} + c := newCachingControllerWith(inner, time.Minute, -1) // L1 on, Redis off + ctx := context.Background() + + _, err := c.Get(ctx, 1, withPermission()) + require.NoError(t, err) + _, err = c.Get(ctx, 1, withPermission()) + require.NoError(t, err) + + assert.Equal(t, int32(1), inner.gets(), "second read should be served from L1") +} + +// Once the L1 entry's window passes, the next read re-delegates to the inner. +func TestCacheL1Expiry(t *testing.T) { + inner := &stubController{} + c := newCachingControllerWith(inner, 20*time.Millisecond, -1) // L1 on (short), Redis off + ctx := context.Background() + + _, err := c.Get(ctx, 1, withPermission()) + require.NoError(t, err) + time.Sleep(40 * time.Millisecond) + _, err = c.Get(ctx, 1, withPermission()) + require.NoError(t, err) + + assert.Equal(t, int32(2), inner.gets(), "read after L1 expiry should re-delegate") +} + +// An L2 (Redis) hit serves the value and promotes it to L1 without delegating. +func TestCacheL2HitPromotes(t *testing.T) { + inner := &stubController{} + c := newCachingControllerWith(inner, time.Minute, time.Minute) + c.redisCache = newMemoryCache(t) + ctx := context.Background() + + // First read populates L2 + L1. + _, err := c.Get(ctx, 1, withPermission()) + require.NoError(t, err) + require.Equal(t, int32(1), inner.gets()) + + // Drop the L1 entry so the next read must consult L2. + c.local.Delete(int64(1)) + + _, err = c.Get(ctx, 1, withPermission()) + require.NoError(t, err) + assert.Equal(t, int32(1), inner.gets(), "L2 hit should avoid delegating") + + _, ok := c.local.Load(int64(1)) + assert.True(t, ok, "L2 hit should promote back into L1") +} + +// Reads without permissions are never cached — they always delegate. +func TestCacheGetWithoutPermissionBypasses(t *testing.T) { + inner := &stubController{} + c := newCachingControllerWith(inner, time.Minute, time.Minute) + c.redisCache = newMemoryCache(t) + ctx := context.Background() + + _, err := c.Get(ctx, 1, nil) + require.NoError(t, err) + _, err = c.Get(ctx, 1, &Option{WithPermission: false}) + require.NoError(t, err) + + assert.Equal(t, int32(2), inner.gets(), "non-permission reads should always delegate") + _, ok := c.local.Load(int64(1)) + assert.False(t, ok, "non-permission reads should not populate L1") +} + +// Update/Delete/Create invalidate so the next read re-delegates. +func TestCacheWritesInvalidate(t *testing.T) { + for _, tc := range []struct { + name string + write func(c *cachingController, ctx context.Context) error + }{ + {"update", func(c *cachingController, ctx context.Context) error { + return c.Update(ctx, &Role{Role: model.Role{ID: 1}}, withPermission()) + }}, + {"delete", func(c *cachingController, ctx context.Context) error { + return c.Delete(ctx, 1) + }}, + } { + t.Run(tc.name, func(t *testing.T) { + inner := &stubController{} + c := newCachingControllerWith(inner, time.Minute, time.Minute) + c.redisCache = newMemoryCache(t) + ctx := context.Background() + + _, err := c.Get(ctx, 1, withPermission()) // cache it + require.NoError(t, err) + require.Equal(t, int32(1), inner.gets()) + + require.NoError(t, tc.write(c, ctx)) + _, ok := c.local.Load(int64(1)) + require.False(t, ok, "write should drop the L1 entry") + + _, err = c.Get(ctx, 1, withPermission()) + require.NoError(t, err) + assert.Equal(t, int32(2), inner.gets(), "read after a write should re-delegate") + }) + } +} + +// L1 disabled (ttl <= 0): every read consults L2; the inner runs only on the L2 miss. +func TestCacheL1Disabled(t *testing.T) { + inner := &stubController{} + c := newCachingControllerWith(inner, -1, time.Minute) // L1 off, Redis on + c.redisCache = newMemoryCache(t) + ctx := context.Background() + + _, err := c.Get(ctx, 1, withPermission()) + require.NoError(t, err) + _, err = c.Get(ctx, 1, withPermission()) + require.NoError(t, err) + + assert.Equal(t, int32(1), inner.gets(), "second read should hit L2, not delegate") + _, ok := c.local.Load(int64(1)) + assert.False(t, ok, "nothing should be stored in L1 when it is disabled") +} + +// Redis disabled (ttl <= 0): reads go L1 -> inner and nothing is written to Redis. +func TestCacheRedisDisabled(t *testing.T) { + inner := &stubController{} + c := newCachingControllerWith(inner, time.Minute, -1) // L1 on, Redis off + mc := newMemoryCache(t) + c.redisCache = mc // present but must be ignored because L2 is disabled + ctx := context.Background() + + _, err := c.Get(ctx, 1, withPermission()) + require.NoError(t, err) + _, err = c.Get(ctx, 1, withPermission()) + require.NoError(t, err) + + assert.Equal(t, int32(1), inner.gets(), "second read should hit L1") + assert.False(t, mc.Contains(ctx, roleCacheKey(1)), "nothing should be written to Redis when L2 is disabled") +} + +// Both layers disabled (-1, -1): full bypass — every read delegates to the inner. +func TestCacheBothDisabled(t *testing.T) { + inner := &stubController{} + c := newCachingControllerWith(inner, -1, -1) + c.redisCache = newMemoryCache(t) // present but must be ignored (L2 disabled) + ctx := context.Background() + + for i := 0; i < 3; i++ { + _, err := c.Get(ctx, 1, withPermission()) + require.NoError(t, err) + } + + assert.Equal(t, int32(3), inner.gets(), "with both layers off every read should delegate") + _, ok := c.local.Load(int64(1)) + assert.False(t, ok, "with L1 off nothing should be populated in L1") + assert.False(t, c.redisCache.Contains(ctx, roleCacheKey(1)), "with L2 off nothing should be written to Redis") +} + +// erroringCache is a cache.Cache whose read/write operations all fail, used to +// simulate an unavailable Redis (errors are not cache.ErrNotFound). +type erroringCache struct{ err error } + +func (e *erroringCache) Contains(context.Context, string) bool { return false } +func (e *erroringCache) Delete(context.Context, string) error { return e.err } +func (e *erroringCache) Fetch(context.Context, string, any) error { return e.err } +func (e *erroringCache) Ping(context.Context) error { return e.err } +func (e *erroringCache) Save(context.Context, string, any, ...time.Duration) error { + return e.err +} +func (e *erroringCache) Scan(context.Context, string) (cache.Iterator, error) { + return nil, e.err +} + +// A missing role (inner returns nil, nil) must not be cached in either tier, and +// the read returns nil without error. +func TestCacheRoleNotFoundNotCached(t *testing.T) { + inner := &stubController{returnNil: true} + c := newCachingControllerWith(inner, time.Minute, time.Minute) // L1 + L2 on + c.redisCache = newMemoryCache(t) + ctx := context.Background() + + r, err := c.Get(ctx, 1, withPermission()) + require.NoError(t, err) + assert.Nil(t, r, "a missing role should return nil") + + _, ok := c.local.Load(int64(1)) + assert.False(t, ok, "a missing role must not be cached in L1") + assert.False(t, c.redisCache.Contains(ctx, roleCacheKey(1)), "a missing role must not be cached in L2") +} + +// When Redis (L2) errors, the read falls back to the inner (DB) and still serves +// the role and populates L1 — a Redis hiccup must never fail an authz check. +func TestCacheRedisErrorFallsBackToDB(t *testing.T) { + inner := &stubController{} + c := newCachingControllerWith(inner, time.Minute, time.Minute) // L1 + L2 on + c.redisCache = &erroringCache{err: errors.New("redis down")} + ctx := context.Background() + + r, err := c.Get(ctx, 1, withPermission()) + require.NoError(t, err, "a Redis error must not fail the read") + require.NotNil(t, r) + assert.Equal(t, int32(1), inner.gets(), "should fall back to the inner (DB) when Redis errors") + + _, ok := c.local.Load(int64(1)) + assert.True(t, ok, "the fallback result should still populate L1") +} + +// envDuration parses seconds, duration strings, and the <=0 disable sentinel. +func TestEnvDuration(t *testing.T) { + const name = "ROLE_CACHE_TEST_DURATION" + + t.Run("unset uses default", func(t *testing.T) { + assert.Equal(t, 5*time.Second, envDuration(name, 5*time.Second)) + }) + t.Run("integer seconds", func(t *testing.T) { + t.Setenv(name, "30") + assert.Equal(t, 30*time.Second, envDuration(name, time.Second)) + }) + t.Run("duration string", func(t *testing.T) { + t.Setenv(name, "30m") + assert.Equal(t, 30*time.Minute, envDuration(name, time.Second)) + }) + t.Run("negative disables", func(t *testing.T) { + t.Setenv(name, "-1") + assert.Equal(t, time.Duration(-1), envDuration(name, time.Second)) + }) + t.Run("invalid uses default", func(t *testing.T) { + t.Setenv(name, "not-a-duration") + assert.Equal(t, 7*time.Second, envDuration(name, 7*time.Second)) + }) +} diff --git a/src/controller/role/controller.go b/src/controller/role/controller.go new file mode 100644 index 00000000000..2f698746f36 --- /dev/null +++ b/src/controller/role/controller.go @@ -0,0 +1,321 @@ +// Copyright Project Harbor Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package role + +import ( + "context" + + "github.com/goharbor/harbor/src/common/security" + "github.com/goharbor/harbor/src/controller/event/metadata" + "github.com/goharbor/harbor/src/lib/errors" + "github.com/goharbor/harbor/src/lib/log" + "github.com/goharbor/harbor/src/lib/q" + "github.com/goharbor/harbor/src/pkg" + "github.com/goharbor/harbor/src/pkg/member" + "github.com/goharbor/harbor/src/pkg/notification" + "github.com/goharbor/harbor/src/pkg/permission/types" + "github.com/goharbor/harbor/src/pkg/project" + "github.com/goharbor/harbor/src/pkg/rbac" + rbac_model "github.com/goharbor/harbor/src/pkg/rbac/model" + role "github.com/goharbor/harbor/src/pkg/role" + "github.com/goharbor/harbor/src/pkg/role/model" +) + +var ( + // Ctl is a global variable for the default role account controller implementation + Ctl = NewController() +) + +// Controller to handle the requests related with role +type Controller interface { + // Get ... + Get(ctx context.Context, id int64, option *Option) (*Role, error) + + // Count returns the total count of roles according to the query + Count(ctx context.Context, query *q.Query) (total int64, err error) + + // Create ... + Create(ctx context.Context, r *Role) (int64, error) + + // Delete ... + Delete(ctx context.Context, id int64, option ...*Option) error + + // Update ... + Update(ctx context.Context, r *Role, option *Option) error + + // List ... + List(ctx context.Context, query *q.Query, option *Option) ([]*Role, error) +} + +// controller is the DB-backed implementation of Controller. It is cache-agnostic; +// the permission cache is layered on top by cachingController (see cache.go). +type controller struct { + roleMgr role.Manager + proMgr project.Manager + rbacMgr rbac.Manager + memberMgr member.Manager +} + +// NewController returns the default role controller: the DB-backed controller +// decorated with the two-level permission cache. +func NewController() Controller { + return newCachingController(newDBController()) +} + +// newDBController returns the bare DB-backed controller, without caching. +func newDBController() *controller { + return &controller{ + roleMgr: role.Mgr, + proMgr: pkg.ProjectMgr, + rbacMgr: rbac.Mgr, + memberMgr: member.Mgr, + } +} + +// Get reads a role (optionally with permissions) straight from the DB. +func (d *controller) Get(ctx context.Context, id int64, option *Option) (*Role, error) { + r, err := d.roleMgr.Get(ctx, id) + if err != nil { + return nil, err + } + return d.populate(ctx, r, option) +} + +// Count ... +func (d *controller) Count(ctx context.Context, query *q.Query) (int64, error) { + return d.roleMgr.Count(ctx, query) +} + +// Create ... +func (d *controller) Create(ctx context.Context, r *Role) (int64, error) { + name := r.Name + + rCreate := &model.Role{ + Name: name, + RoleMask: r.RoleMask, + RoleCode: r.RoleCode, + Description: r.Description, + CreatedBy: r.CreatedBy, + } + roleID, err := d.roleMgr.Create(ctx, rCreate) + if err != nil { + return 0, err + } + r.ID = roleID + if err := d.createPermission(ctx, r); err != nil { + return 0, err + } + // fire event + notification.AddEvent(ctx, &metadata.CreateRoleEventMetadata{ + Ctx: ctx, + Role: rCreate, + }) + return roleID, nil +} + +// Delete ... +func (d *controller) Delete(ctx context.Context, id int64, option ...*Option) error { + rDelete, err := d.roleMgr.Get(ctx, id) + if err != nil { + return err + } + if rDelete.IsBuiltin { + return errors.ForbiddenError(nil).WithMessagef("cannot delete built-in role %d", id) + } + // A role assigned to project members cannot be deleted: project_member.role + // has no FK, so deleting would orphan those memberships. + assigned, err := d.memberMgr.GetTotalOfProjectMembersByRole(ctx, int(id)) + if err != nil { + return err + } + if assigned > 0 { + return errors.PreconditionFailedError(nil).WithMessagef("cannot delete role %d: it is still assigned to %d project member(s)", id, assigned) + } + if err := d.roleMgr.Delete(ctx, id); err != nil { + return err + } + if err := d.rbacMgr.DeletePermissionsByRole(ctx, ROLETYPE, id); err != nil { + return err + } + // fire event + deleteMetadata := &metadata.DeleteRoleEventMetadata{ + Ctx: ctx, + Role: rDelete, + } + if len(option) != 0 && option[0].Operator != "" { + deleteMetadata.Operator = option[0].Operator + } + notification.AddEvent(ctx, deleteMetadata) + return nil +} + +// Update ... +func (d *controller) Update(ctx context.Context, r *Role, option *Option) error { + if r == nil { + return errors.New("cannot update a nil role").WithCode(errors.BadRequestCode) + } + existing, err := d.roleMgr.Get(ctx, r.ID) + if err != nil { + return err + } + if existing.IsBuiltin { + return errors.ForbiddenError(nil).WithMessagef("cannot modify built-in role %d", r.ID) + } + // update role record fields, including the modification audit columns + modifiedBy := "" + if sc, ok := security.FromContext(ctx); ok { + modifiedBy = sc.GetUsername() + } + if err := d.roleMgr.Update(ctx, &model.Role{ + ID: r.ID, + Description: r.Description, + Modified: true, + ModifiedBy: modifiedBy, + }, "description", "modified", "modified_by", "modified_at"); err != nil { + return err + } + // update the permission + if option != nil && option.WithPermission { + if err := d.rbacMgr.DeletePermissionsByRole(ctx, ROLETYPE, r.ID); err != nil && !errors.IsNotFoundErr(err) { + return err + } + if err := d.createPermission(ctx, r); err != nil { + return err + } + } + // fire event + notification.AddEvent(ctx, &metadata.UpdateRoleEventMetadata{ + Ctx: ctx, + Role: existing, + }) + return nil +} + +// List ... +func (d *controller) List(ctx context.Context, query *q.Query, option *Option) ([]*Role, error) { + role, err := d.roleMgr.List(ctx, query) + if err != nil { + return nil, err + } + var roles []*Role + for _, r := range role { + rb, err := d.populate(ctx, r, option) + if err != nil { + return nil, err + } + roles = append(roles, rb) + } + return roles, nil +} + +func (d *controller) createPermission(ctx context.Context, r *Role) error { + if r == nil { + return nil + } + + for _, per := range r.Permissions { + policy := &rbac_model.PermissionPolicy{} + policy.Scope = "/project/*" + + for _, access := range per.Access { + policy.Resource = access.Resource.String() + policy.Action = access.Action.String() + policy.Effect = access.Effect.String() + + policyID, err := d.rbacMgr.CreateRbacPolicy(ctx, policy) + if err != nil { + return err + } + + _, err = d.rbacMgr.CreatePermission(ctx, &rbac_model.RolePermission{ + RoleType: ROLETYPE, + RoleID: r.ID, + PermissionPolicyID: policyID, + }) + if err != nil { + return err + } + } + } + return nil +} + +func (d *controller) populate(ctx context.Context, r *model.Role, option *Option) (*Role, error) { + if r == nil { + return nil, nil + } + role := &Role{ + Role: *r, + } + role.setLevel() + role.setEditable() + role.Name = r.Name + if option != nil && option.WithPermission { + if err := d.populatePermissions(ctx, role); err != nil { + return nil, err + } + } + return role, nil +} + +func (d *controller) populatePermissions(ctx context.Context, r *Role) error { + if r == nil { + return nil + } + rolePermissions, err := d.rbacMgr.GetPermissionsByRole(ctx, ROLETYPE, r.ID) + + if err != nil { + log.Errorf("failed to get permissions of role %d: %v", r.ID, err) + return err + } + if len(rolePermissions) == 0 { + return nil + } + + // scope: accesses + accessMap := make(map[string][]*types.Policy) + + // group by scope + for _, rp := range rolePermissions { + _, exist := accessMap[rp.Scope] + if !exist { + accessMap[rp.Scope] = []*types.Policy{{ + Resource: types.Resource(rp.Resource), + Action: types.Action(rp.Action), + Effect: types.Effect(rp.Effect), + }} + } else { + accesses := accessMap[rp.Scope] + accesses = append(accesses, &types.Policy{ + Resource: types.Resource(rp.Resource), + Action: types.Action(rp.Action), + Effect: types.Effect(rp.Effect), + }) + accessMap[rp.Scope] = accesses + } + } + + var permissions []*Permission + for scope, accesses := range accessMap { + p := &Permission{} + p.Scope = scope + p.Kind = LEVELROLE + p.Namespace = "*" + p.Access = accesses + permissions = append(permissions, p) + } + r.Permissions = permissions + return nil +} diff --git a/src/controller/role/controller_test.go b/src/controller/role/controller_test.go new file mode 100644 index 00000000000..9d2462f34e9 --- /dev/null +++ b/src/controller/role/controller_test.go @@ -0,0 +1,151 @@ +package role + +import ( + "context" + "testing" + + "github.com/stretchr/testify/suite" + + "github.com/goharbor/harbor/src/lib/errors" + "github.com/goharbor/harbor/src/pkg/permission/types" + "github.com/goharbor/harbor/src/pkg/role/model" + "github.com/goharbor/harbor/src/testing/mock" + testmember "github.com/goharbor/harbor/src/testing/pkg/member" + testproject "github.com/goharbor/harbor/src/testing/pkg/project" + testrbac "github.com/goharbor/harbor/src/testing/pkg/rbac" + testrole "github.com/goharbor/harbor/src/testing/pkg/role" +) + +type ControllerTestSuite struct { + suite.Suite + roleMgr *testrole.Manager + rbacMgr *testrbac.Manager + proMgr *testproject.Manager + memberMgr *testmember.Manager + c controller +} + +func (suite *ControllerTestSuite) SetupTest() { + suite.roleMgr = &testrole.Manager{} + suite.rbacMgr = &testrbac.Manager{} + suite.proMgr = &testproject.Manager{} + suite.memberMgr = &testmember.Manager{} + suite.c = controller{ + roleMgr: suite.roleMgr, + rbacMgr: suite.rbacMgr, + proMgr: suite.proMgr, + memberMgr: suite.memberMgr, + } +} + +func (suite *ControllerTestSuite) TestDeleteBuiltinRole() { + suite.roleMgr.On("Get", mock.Anything, int64(1)).Return(&model.Role{ + ID: 1, + Name: "projectAdmin", + IsBuiltin: true, + }, nil) + + err := suite.c.Delete(context.TODO(), int64(1)) + suite.Require().NotNil(err) + suite.True(errors.IsErr(err, errors.ForbiddenCode)) + suite.roleMgr.AssertNotCalled(suite.T(), "Delete", mock.Anything, mock.Anything) +} + +func (suite *ControllerTestSuite) TestDeleteCustomRole() { + suite.roleMgr.On("Get", mock.Anything, int64(2)).Return(&model.Role{ + ID: 2, + Name: "myCustomRole", + IsBuiltin: false, + }, nil) + suite.memberMgr.On("GetTotalOfProjectMembersByRole", mock.Anything, 2).Return(0, nil) + suite.roleMgr.On("Delete", mock.Anything, int64(2)).Return(nil) + suite.rbacMgr.On("DeletePermissionsByRole", mock.Anything, ROLETYPE, int64(2)).Return(nil) + + err := suite.c.Delete(context.TODO(), int64(2)) + suite.Nil(err) +} + +// A role still assigned to project members cannot be deleted (avoids orphaning +// project_member rows, which have no FK to role). +func (suite *ControllerTestSuite) TestDeleteAssignedRoleRejected() { + suite.roleMgr.On("Get", mock.Anything, int64(3)).Return(&model.Role{ + ID: 3, + Name: "assignedRole", + IsBuiltin: false, + }, nil) + suite.memberMgr.On("GetTotalOfProjectMembersByRole", mock.Anything, 3).Return(2, nil) + + err := suite.c.Delete(context.TODO(), int64(3)) + suite.Require().NotNil(err) + suite.True(errors.IsErr(err, errors.PreconditionCode)) + suite.roleMgr.AssertNotCalled(suite.T(), "Delete", mock.Anything, mock.Anything) +} + +func (suite *ControllerTestSuite) TestUpdateNilRole() { + err := suite.c.Update(context.TODO(), nil, nil) + suite.Require().NotNil(err) + suite.True(errors.IsErr(err, errors.BadRequestCode)) +} + +func (suite *ControllerTestSuite) TestUpdateBuiltinRole() { + suite.roleMgr.On("Get", mock.Anything, int64(1)).Return(&model.Role{ + ID: 1, + Name: "projectAdmin", + IsBuiltin: true, + }, nil) + + err := suite.c.Update(context.TODO(), &Role{ + Role: model.Role{ID: 1, Name: "projectAdmin"}, + }, &Option{WithPermission: true}) + suite.Require().NotNil(err) + suite.True(errors.IsErr(err, errors.ForbiddenCode)) + suite.rbacMgr.AssertNotCalled(suite.T(), "DeletePermissionsByRole", mock.Anything, mock.Anything, mock.Anything) +} + +func (suite *ControllerTestSuite) TestUpdateCustomRole() { + suite.roleMgr.On("Get", mock.Anything, int64(2)).Return(&model.Role{ + ID: 2, + Name: "myCustomRole", + IsBuiltin: false, + }, nil) + // Update now persists description + the modification audit columns + suite.roleMgr.On("Update", mock.Anything, mock.Anything, mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return(nil) + suite.rbacMgr.On("DeletePermissionsByRole", mock.Anything, ROLETYPE, int64(2)).Return(nil) + suite.rbacMgr.On("CreateRbacPolicy", mock.Anything, mock.Anything).Return(int64(1), nil) + suite.rbacMgr.On("CreatePermission", mock.Anything, mock.Anything).Return(int64(1), nil) + + err := suite.c.Update(context.TODO(), &Role{ + Role: model.Role{ID: 2, Name: "myCustomRole"}, + Permissions: []*Permission{ + { + Access: []*types.Policy{ + {Resource: "repository", Action: "pull"}, + }, + }, + }, + }, &Option{WithPermission: true}) + suite.Nil(err) +} + +func (suite *ControllerTestSuite) TestCreateCustomRole() { + suite.roleMgr.On("Create", mock.Anything, mock.Anything).Return(int64(7), nil) + suite.rbacMgr.On("CreateRbacPolicy", mock.Anything, mock.Anything).Return(int64(1), nil) + suite.rbacMgr.On("CreatePermission", mock.Anything, mock.Anything).Return(int64(1), nil) + + id, err := suite.c.Create(context.TODO(), &Role{ + Role: model.Role{Name: "myCustomRole"}, + Permissions: []*Permission{ + { + Access: []*types.Policy{ + {Resource: "repository", Action: "pull"}, + }, + }, + }, + }) + suite.Nil(err) + suite.Equal(int64(7), id) +} + +func TestControllerTestSuite(t *testing.T) { + suite.Run(t, &ControllerTestSuite{}) +} diff --git a/src/controller/role/model.go b/src/controller/role/model.go new file mode 100644 index 00000000000..34ca11fe51a --- /dev/null +++ b/src/controller/role/model.go @@ -0,0 +1,94 @@ +// Copyright Project Harbor Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package role + +import ( + "github.com/goharbor/harbor/src/pkg/permission/types" + "github.com/goharbor/harbor/src/pkg/role/model" +) + +const ( + LEVELROLE = "project-role" + + // SCOPEALLPROJECT ... + SCOPEALLPROJECT = "/project/*" + + // ROLETYPE ... + ROLETYPE = "project-role" +) + +// Role ... +type Role struct { + model.Role + Level string + Editable bool `json:"editable"` + Permissions []*Permission `json:"permissions"` +} + +// IsSysLevel, true is a system level robot, others are project level. + +// setLevel = project-role +func (r *Role) setLevel() { + r.Level = LEVELROLE +} + +// setEditable, no secret and no permissions should be a old format robot, and it's not editable. +func (r *Role) setEditable() { + r.Editable = true +} + +// clone returns a deep copy of the role. The cache serves roles from a shared, +// process-local store; returning a copy prevents request code (e.g. an update +// handler) from mutating cached authorization state. +func (r *Role) clone() *Role { + if r == nil { + return nil + } + cp := *r // copy scalar fields (embedded model.Role, Level, Editable) + if r.Permissions != nil { + cp.Permissions = make([]*Permission, len(r.Permissions)) + for i, p := range r.Permissions { + if p == nil { + continue + } + pc := *p + if p.Access != nil { + pc.Access = make([]*types.Policy, len(p.Access)) + for j, a := range p.Access { + if a != nil { + ac := *a + pc.Access[j] = &ac + } + } + } + cp.Permissions[i] = &pc + } + } + return &cp +} + +// Permission ... +type Permission struct { + Kind string `json:"kind"` + Namespace string `json:"namespace"` + Access []*types.Policy `json:"access"` + Scope string `json:"-"` +} + +// Option ... +type Option struct { + WithPermission bool + Operator string +} diff --git a/src/controller/role/model_test.go b/src/controller/role/model_test.go new file mode 100644 index 00000000000..d33463f23ab --- /dev/null +++ b/src/controller/role/model_test.go @@ -0,0 +1,30 @@ +package role + +import ( + "testing" + + "github.com/stretchr/testify/suite" + + "github.com/goharbor/harbor/src/pkg/role/model" +) + +type ModelTestSuite struct { + suite.Suite +} + +func (suite *ModelTestSuite) TestSetLevel() { + r := &Role{Role: model.Role{ID: 1, Name: "myCustomRole"}} + r.setLevel() + suite.Equal(LEVELROLE, r.Level) +} + +func (suite *ModelTestSuite) TestSetEditable() { + r := &Role{Role: model.Role{ID: 1, Name: "myCustomRole"}} + suite.False(r.Editable) + r.setEditable() + suite.True(r.Editable) +} + +func TestModelTestSuite(t *testing.T) { + suite.Run(t, &ModelTestSuite{}) +} diff --git a/src/pkg/member/dao/dao.go b/src/pkg/member/dao/dao.go index 22655d1083e..94329dc41d3 100644 --- a/src/pkg/member/dao/dao.go +++ b/src/pkg/member/dao/dao.go @@ -36,6 +36,8 @@ type DAO interface { GetProjectMember(ctx context.Context, queryMember models.Member, query *q.Query) ([]*models.Member, error) // GetTotalOfProjectMembers returns total of project members GetTotalOfProjectMembers(ctx context.Context, projectID int64, query *q.Query, roles ...int) (int, error) + // GetTotalOfProjectMembersByRole returns the total number of project members (across all projects) assigned the given role + GetTotalOfProjectMembersByRole(ctx context.Context, roleID int) (int, error) // AddProjectMember inserts a record to table project_member AddProjectMember(ctx context.Context, member models.Member) (int, error) // UpdateProjectMemberRole updates the record in table project_member, only role can be changed @@ -138,6 +140,18 @@ func (d *dao) GetTotalOfProjectMembers(ctx context.Context, projectID int64, _ * return count, err } +func (d *dao) GetTotalOfProjectMembersByRole(ctx context.Context, roleID int) (int, error) { + var count int + o, err := orm.FromContext(ctx) + if err != nil { + return 0, err + } + if err := o.Raw("SELECT COUNT(1) FROM project_member WHERE role = ?", roleID).QueryRow(&count); err != nil { + return 0, err + } + return count, nil +} + func (d *dao) AddProjectMember(ctx context.Context, member models.Member) (int, error) { log.Debugf("Adding project member %+v", member) o, err := orm.FromContext(ctx) diff --git a/src/pkg/member/manager.go b/src/pkg/member/manager.go index 6fe8ebb0131..cbe39977034 100644 --- a/src/pkg/member/manager.go +++ b/src/pkg/member/manager.go @@ -48,6 +48,8 @@ type Manager interface { DeleteMemberByProjectID(ctx context.Context, projectID int64) error // GetTotalOfProjectMembers get the total amount of project members GetTotalOfProjectMembers(ctx context.Context, projectID int64, query *q.Query, roles ...int) (int, error) + // GetTotalOfProjectMembersByRole returns the number of project members (across all projects) assigned the given role + GetTotalOfProjectMembersByRole(ctx context.Context, roleID int) (int, error) // ListRoles list project roles ListRoles(ctx context.Context, user *models.User, projectID int64) ([]int, error) } @@ -88,6 +90,10 @@ func (m *manager) GetTotalOfProjectMembers(ctx context.Context, projectID int64, return m.dao.GetTotalOfProjectMembers(ctx, projectID, query, roles...) } +func (m *manager) GetTotalOfProjectMembersByRole(ctx context.Context, roleID int) (int, error) { + return m.dao.GetTotalOfProjectMembersByRole(ctx, roleID) +} + func (m *manager) ListRoles(ctx context.Context, user *models.User, projectID int64) ([]int, error) { return m.dao.ListRoles(ctx, user, projectID) } diff --git a/src/pkg/role/dao/dao.go b/src/pkg/role/dao/dao.go new file mode 100644 index 00000000000..d4280ea76a5 --- /dev/null +++ b/src/pkg/role/dao/dao.go @@ -0,0 +1,131 @@ +// Copyright Project Harbor Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package dao + +import ( + "context" + + "github.com/goharbor/harbor/src/lib/errors" + "github.com/goharbor/harbor/src/lib/orm" + "github.com/goharbor/harbor/src/lib/q" + "github.com/goharbor/harbor/src/pkg/role/model" +) + +// DAO defines the interface to access the role data model +type DAO interface { + // Create ... + Create(ctx context.Context, r *model.Role) (int64, error) + + // Update ... + Update(ctx context.Context, r *model.Role, props ...string) error + + // Get ... + Get(ctx context.Context, id int64) (*model.Role, error) + + // Count returns the total count of roles according to the query + Count(ctx context.Context, query *q.Query) (total int64, err error) + + // List ... + List(ctx context.Context, query *q.Query) ([]*model.Role, error) + + // Delete ... + Delete(ctx context.Context, id int64) error +} + +// New creates a default implementation for Dao +func New() DAO { + return &dao{} +} + +type dao struct{} + +func (d *dao) Create(ctx context.Context, r *model.Role) (int64, error) { + ormer, err := orm.FromContext(ctx) + if err != nil { + return 0, err + } + id, err := ormer.Insert(r) + if err != nil { + return 0, orm.WrapConflictError(err, "role %s already exists", r.Name) + } + return id, err +} + +func (d *dao) Update(ctx context.Context, r *model.Role, props ...string) error { + ormer, err := orm.FromContext(ctx) + if err != nil { + return err + } + n, err := ormer.Update(r, props...) + if err != nil { + return err + } + if n == 0 { + return errors.NotFoundError(nil).WithMessagef("role %d not found", r.ID) + } + return nil +} + +func (d *dao) Get(ctx context.Context, id int64) (*model.Role, error) { + r := &model.Role{ + ID: id, + } + ormer, err := orm.FromContext(ctx) + if err != nil { + return nil, err + } + if err := ormer.Read(r); err != nil { + return nil, orm.WrapNotFoundError(err, "role %d not found", id) + } + return r, nil +} + +func (d *dao) Count(ctx context.Context, query *q.Query) (int64, error) { + qs, err := orm.QuerySetterForCount(ctx, &model.Role{}, query) + if err != nil { + return 0, err + } + return qs.Count() +} + +func (d *dao) Delete(ctx context.Context, id int64) error { + ormer, err := orm.FromContext(ctx) + if err != nil { + return err + } + n, err := ormer.Delete(&model.Role{ + ID: id, + }) + if err != nil { + return err + } + if n == 0 { + return errors.NotFoundError(nil).WithMessagef("role %d not found", id) + } + return nil +} + +func (d *dao) List(ctx context.Context, query *q.Query) ([]*model.Role, error) { + roles := []*model.Role{} + + qs, err := orm.QuerySetter(ctx, &model.Role{}, query) + if err != nil { + return nil, err + } + if _, err = qs.All(&roles); err != nil { + return nil, err + } + return roles, nil +} diff --git a/src/pkg/role/dao/dao_test.go b/src/pkg/role/dao/dao_test.go new file mode 100644 index 00000000000..7a7d3d52c17 --- /dev/null +++ b/src/pkg/role/dao/dao_test.go @@ -0,0 +1,133 @@ +package dao + +import ( + "testing" + + "github.com/stretchr/testify/suite" + + "github.com/goharbor/harbor/src/lib/errors" + "github.com/goharbor/harbor/src/lib/orm" + "github.com/goharbor/harbor/src/lib/q" + "github.com/goharbor/harbor/src/pkg/role/model" + htesting "github.com/goharbor/harbor/src/testing" +) + +type DaoTestSuite struct { + htesting.Suite + dao DAO + + roleID1 int64 + roleID2 int64 + roleID3 int64 + roleID4 int64 +} + +func (suite *DaoTestSuite) SetupSuite() { + suite.Suite.SetupSuite() + suite.dao = New() + suite.Suite.ClearTables = []string{"role"} + suite.roles() +} + +func (suite *DaoTestSuite) roles() { + var err error + suite.roleID1, err = suite.dao.Create(orm.Context(), &model.Role{ + Name: "test1", + }) + suite.Nil(err) + + suite.roleID2, err = suite.dao.Create(orm.Context(), &model.Role{ + Name: "test2", + }) + suite.Nil(err) + + suite.roleID3, err = suite.dao.Create(orm.Context(), &model.Role{ + Name: "test3", + }) + suite.Nil(err) + + suite.roleID4, err = suite.dao.Create(orm.Context(), &model.Role{ + Name: "test4", + }) + suite.Nil(err) +} + +func (suite *DaoTestSuite) TestCreate() { + r := &model.Role{ + Name: "test1", + } + _, err := suite.dao.Create(orm.Context(), r) + suite.NotNil(err) + suite.True(errors.IsErr(err, errors.ConflictCode)) +} + +func (suite *DaoTestSuite) TestDelete() { + err := suite.dao.Delete(orm.Context(), 1234) + suite.Require().NotNil(err) + suite.True(errors.IsErr(err, errors.NotFoundCode)) + + err = suite.dao.Delete(orm.Context(), suite.roleID2) + suite.Nil(err) +} + +func (suite *DaoTestSuite) TestList() { + roles, err := suite.dao.List(orm.Context(), &q.Query{ + Keywords: map[string]any{ + "name": "test3", + }, + }) + suite.Require().Nil(err) + suite.Equal(suite.roleID3, roles[0].ID) + + r := &model.Role{ + Name: "testvisible", + } + _, err = suite.dao.Create(orm.Context(), r) + suite.Nil(err) + roles, err = suite.dao.List(orm.Context(), &q.Query{ + Keywords: map[string]any{ + "name": "testvisible", + }, + }) + suite.Equal(len(roles), 0) +} + +func (suite *DaoTestSuite) TestGet() { + _, err := suite.dao.Get(orm.Context(), 1234) + suite.Require().NotNil(err) + suite.True(errors.IsErr(err, errors.NotFoundCode)) + + r, err := suite.dao.Get(orm.Context(), suite.roleID3) + suite.Nil(err) + suite.Equal("test3", r.Name) +} + +func (suite *DaoTestSuite) TestCount() { + // nil query + total, err := suite.dao.Count(orm.Context(), nil) + suite.Nil(err) + suite.True(total > 0) + + // query by name + total, err = suite.dao.Count(orm.Context(), &q.Query{ + Keywords: map[string]any{ + "name": "test3", + }, + }) + suite.Nil(err) + suite.Equal(int64(1), total) +} + +func (suite *DaoTestSuite) TestUpdate() { + r := &model.Role{ + ID: suite.roleID3, + } + + err := suite.dao.Update(orm.Context(), r) + suite.Nil(err) + +} + +func TestDaoTestSuite(t *testing.T) { + suite.Run(t, &DaoTestSuite{}) +} diff --git a/src/pkg/role/manager.go b/src/pkg/role/manager.go new file mode 100644 index 00000000000..dd5973760a9 --- /dev/null +++ b/src/pkg/role/manager.go @@ -0,0 +1,92 @@ +// Copyright Project Harbor Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package role + +import ( + "context" + + "github.com/goharbor/harbor/src/lib/q" + "github.com/goharbor/harbor/src/pkg/role/dao" + "github.com/goharbor/harbor/src/pkg/role/model" +) + +var ( + // Mgr is a global variable for the default role manager implementation + Mgr = NewManager() +) + +// Manager ... +type Manager interface { + // Get ... + Get(ctx context.Context, id int64) (*model.Role, error) + + // Count returns the total count of robots according to the query + Count(ctx context.Context, query *q.Query) (total int64, err error) + + // Create ... + Create(ctx context.Context, m *model.Role) (int64, error) + + // Delete ... + Delete(ctx context.Context, id int64) error + + // Update ... + Update(ctx context.Context, m *model.Role, props ...string) error + + // List ... + List(ctx context.Context, query *q.Query) ([]*model.Role, error) +} + +var _ Manager = &manager{} + +type manager struct { + dao dao.DAO +} + +// NewManager return a new instance of defaultRoleManager +func NewManager() Manager { + return &manager{ + dao: dao.New(), + } +} + +// Get ... +func (m *manager) Get(ctx context.Context, id int64) (*model.Role, error) { + return m.dao.Get(ctx, id) +} + +// Count ... +func (m *manager) Count(ctx context.Context, query *q.Query) (total int64, err error) { + return m.dao.Count(ctx, query) +} + +// Create ... +func (m *manager) Create(ctx context.Context, r *model.Role) (int64, error) { + return m.dao.Create(ctx, r) +} + +// Delete ... +func (m *manager) Delete(ctx context.Context, id int64) error { + return m.dao.Delete(ctx, id) +} + +// Update ... +func (m *manager) Update(ctx context.Context, r *model.Role, props ...string) error { + return m.dao.Update(ctx, r, props...) +} + +// List ... +func (m *manager) List(ctx context.Context, query *q.Query) ([]*model.Role, error) { + return m.dao.List(ctx, query) +} diff --git a/src/pkg/role/manager_test.go b/src/pkg/role/manager_test.go new file mode 100644 index 00000000000..ed77ad6591e --- /dev/null +++ b/src/pkg/role/manager_test.go @@ -0,0 +1,71 @@ +package role + +import ( + "context" + "testing" + + "github.com/stretchr/testify/suite" + + "github.com/goharbor/harbor/src/pkg/role/model" + "github.com/goharbor/harbor/src/testing/mock" + "github.com/goharbor/harbor/src/testing/pkg/role/dao" +) + +type managerTestSuite struct { + suite.Suite + mgr *manager + dao *dao.DAO +} + +func (m *managerTestSuite) SetupTest() { + m.dao = &dao.DAO{} + m.mgr = &manager{ + dao: m.dao, + } +} + +func (m *managerTestSuite) TestCreate() { + m.dao.On("Create", mock.Anything, mock.Anything).Return(int64(1), nil) + _, err := m.mgr.Create(context.Background(), &model.Role{}) + m.Nil(err) + m.dao.AssertExpectations(m.T()) +} + +func (m *managerTestSuite) TestCount() { + m.dao.On("Count", mock.Anything, mock.Anything).Return(int64(1), nil) + n, err := m.mgr.Count(context.Background(), nil) + m.Nil(err) + m.Equal(int64(1), n) + m.dao.AssertExpectations(m.T()) +} + +func (m *managerTestSuite) TestDelete() { + m.dao.On("Delete", mock.Anything, mock.Anything).Return(nil) + err := m.mgr.Delete(context.Background(), 1) + m.Nil(err) + m.dao.AssertExpectations(m.T()) +} + +func (m *managerTestSuite) TestUpdate() { + m.dao.On("Update", mock.Anything, mock.Anything).Return(nil) + err := m.mgr.Update(context.Background(), &model.Role{}) + m.Nil(err) + m.dao.AssertExpectations(m.T()) +} + +func (m *managerTestSuite) TestList() { + m.dao.On("List", mock.Anything, mock.Anything).Return([]*model.Role{ + { + ID: 1, + Name: "role", + }, + }, nil) + rpers, err := m.mgr.List(context.Background(), nil) + m.Nil(err) + m.Equal(1, len(rpers)) + m.dao.AssertExpectations(m.T()) +} + +func TestManager(t *testing.T) { + suite.Run(t, &managerTestSuite{}) +} diff --git a/src/pkg/role/model/model.go b/src/pkg/role/model/model.go new file mode 100644 index 00000000000..72ccc020a0d --- /dev/null +++ b/src/pkg/role/model/model.go @@ -0,0 +1,67 @@ +// Copyright Project Harbor Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package model + +import ( + "encoding/json" + "time" + + "github.com/beego/beego/v2/client/orm" + + "github.com/goharbor/harbor/src/lib/errors" +) + +func init() { + orm.RegisterModel(&Role{}) +} + +// Role holds the details of a role. +type Role struct { + ID int64 `orm:"pk;auto;column(role_id)" json:"id"` + Name string `orm:"column(name)" json:"name" sort:"default"` + RoleMask int64 `orm:"column(role_mask)" json:"role_mask"` + RoleCode string `orm:"column(role_code)" json:"role_code"` + IsBuiltin bool `orm:"column(is_builtin)" json:"is_builtin"` + Description string `orm:"column(description)" json:"description"` + Modified bool `orm:"column(modified)" json:"modified"` + CreatedBy string `orm:"column(created_by)" json:"created_by"` + CreatedAt time.Time `orm:"column(created_at);auto_now_add;type(datetime)" json:"created_at"` + ModifiedBy string `orm:"column(modified_by)" json:"modified_by"` + ModifiedAt time.Time `orm:"column(modified_at);auto_now;type(datetime)" json:"modified_at"` +} + +// TableName ... +func (r *Role) TableName() string { + return "role" +} + +// FromJSON parses role from json data +func (r *Role) FromJSON(jsonData string) error { + if len(jsonData) == 0 { + return errors.New("empty json data to parse") + } + + return json.Unmarshal([]byte(jsonData), r) +} + +// ToJSON marshals role to JSON data +func (r *Role) ToJSON() (string, error) { + data, err := json.Marshal(r) + if err != nil { + return "", err + } + + return string(data), nil +} diff --git a/src/portal/src/app/base/base.module.ts b/src/portal/src/app/base/base.module.ts index 6beb77fe643..16695f66a5e 100644 --- a/src/portal/src/app/base/base.module.ts +++ b/src/portal/src/app/base/base.module.ts @@ -51,6 +51,14 @@ const routes: Routes = [ m => m.UserModule ), }, + { + path: 'roles', + canActivate: [SystemAdminGuard], + loadChildren: () => + import('./left-side-nav/roles/roles.module').then( + m => m.RolesModule + ), + }, { path: 'robot-accounts', canActivate: [SystemAdminGuard], diff --git a/src/portal/src/app/base/harbor-shell/harbor-shell.component.html b/src/portal/src/app/base/harbor-shell/harbor-shell.component.html index 14987f75e43..99ee5e64b46 100644 --- a/src/portal/src/app/base/harbor-shell/harbor-shell.component.html +++ b/src/portal/src/app/base/harbor-shell/harbor-shell.component.html @@ -52,6 +52,15 @@ clrVerticalNavIcon> {{ 'SIDE_NAV.SYSTEM_MGMT.USER' | translate }} + + + {{ 'ROLE.ROLE_NAV' | translate }} + {{ roleInfo[p.current_user_role_id] ? (roleInfo[p.current_user_role_id] | translate) - : '-' + : p.current_user_role_ids }} {{ projectTypeMap[p.registry_id ? 1 : 0] | translate diff --git a/src/portal/src/app/base/left-side-nav/roles/add-role/add-role.component.html b/src/portal/src/app/base/left-side-nav/roles/add-role/add-role.component.html new file mode 100644 index 00000000000..d833c5ada5e --- /dev/null +++ b/src/portal/src/app/base/left-side-nav/roles/add-role/add-role.component.html @@ -0,0 +1,147 @@ + + +

+ {{ + (isEditMode ? 'ROLE.EDIT_ROLE' : 'ROLE.CREATE_ROLE') | translate + }} +

+

+ {{ + (isEditMode + ? 'ROLE.EDIT_ROLE_SUMMARY' + : 'ROLE.CREATEROLE_SUMMARY' + ) | translate + }} +

+ + {{ + 'BUTTON.CANCEL' | translate + }} + {{ + 'ROLE.BACK' | translate + }} + {{ + 'ROLE.NEXT' | translate + }} + {{ + 'ROLE.FINISH' | translate + }} + + + + {{ + 'ROLE.BASIC_INFO' | translate + }} +
+
+ +
+ +
+
+ + + +
+ + + {{ 'ROLE.ACCOUNT_EXISTING' | translate }} + + + {{ 'ROLE.NAME_TOOLTIP' | translate }} + + +
+
+ + +
+ +
+
+ +
+
+
+
+
+ + + + + {{ + 'ROLE.SELECT_PERMISSIONS' | translate + }} + +
+
+ + +
+
+ + diff --git a/src/portal/src/app/base/left-side-nav/roles/add-role/add-role.component.scss b/src/portal/src/app/base/left-side-nav/roles/add-role/add-role.component.scss new file mode 100644 index 00000000000..4d0cb69f733 --- /dev/null +++ b/src/portal/src/app/base/left-side-nav/roles/add-role/add-role.component.scss @@ -0,0 +1,64 @@ +.padding-left-0 { + padding-left: 0; +} + +.no-margin { + margin: 0; +} + +.permission{ + padding-top: 0.1rem; + color: #000; +} + +.padding-left-120{ + padding-left: 126px; +} + +.w-90{ + width: 90%; +} + +.date { + margin-top: -0.9rem; +} + +.input-width-date { + width: 265px; +} + +.flex { + display: flex; + align-items: center; + justify-content: space-between; +} + +.input-width { + width: 16rem; +} + +.description-input { + width: 16rem; + resize: vertical; +} + +.expiration { + margin-left: 1rem; +} + +/* stylelint-disable */ +.showWarning { + color: #b3a000; +} + +.icon { + margin-top: 3px; +} + +.align-center { + align-items: center; +} + +:host::ng-deep.modal-dialog { + width: 46.2rem; +} diff --git a/src/portal/src/app/base/left-side-nav/roles/add-role/add-role.component.spec.ts b/src/portal/src/app/base/left-side-nav/roles/add-role/add-role.component.spec.ts new file mode 100644 index 00000000000..6729bcbe21b --- /dev/null +++ b/src/portal/src/app/base/left-side-nav/roles/add-role/add-role.component.spec.ts @@ -0,0 +1,61 @@ +// Copyright Project Harbor Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +import { ComponentFixture, TestBed } from '@angular/core/testing'; +import { AddRoleComponent } from './add-role.component'; +import { of } from 'rxjs'; +import { MessageHandlerService } from '../../../../shared/services/message-handler.service'; +import { delay } from 'rxjs/operators'; +import { RoleService } from '../../../../../../ng-swagger-gen/services/role.service'; +import { OperationService } from '../../../../shared/components/operation/operation.service'; +import { NO_ERRORS_SCHEMA } from '@angular/core'; +import { SharedTestingModule } from '../../../../shared/shared.module'; + +describe('AddRoleComponent', () => { + let component: AddRoleComponent; + let fixture: ComponentFixture; + const fakedRoleService = { + ListRole() { + return of([]).pipe(delay(0)); + }, + }; + const fakedMessageHandlerService = { + showSuccess() {}, + error() {}, + }; + beforeEach(async () => { + await TestBed.configureTestingModule({ + declarations: [AddRoleComponent], + imports: [SharedTestingModule], + providers: [ + OperationService, + { provide: RoleService, useValue: fakedRoleService }, + { + provide: MessageHandlerService, + useValue: fakedMessageHandlerService, + }, + ], + schemas: [NO_ERRORS_SCHEMA], + }).compileComponents(); + }); + + beforeEach(() => { + fixture = TestBed.createComponent(AddRoleComponent); + component = fixture.componentInstance; + fixture.detectChanges(); + }); + + it('should create', () => { + expect(component).toBeTruthy(); + }); +}); diff --git a/src/portal/src/app/base/left-side-nav/roles/add-role/add-role.component.ts b/src/portal/src/app/base/left-side-nav/roles/add-role/add-role.component.ts new file mode 100644 index 00000000000..ea30818ca05 --- /dev/null +++ b/src/portal/src/app/base/left-side-nav/roles/add-role/add-role.component.ts @@ -0,0 +1,280 @@ +// Copyright Project Harbor Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +import { + Component, + OnInit, + Input, + OnDestroy, + Output, + EventEmitter, + ViewChild, +} from '@angular/core'; +import { + debounceTime, + distinctUntilChanged, + filter, + finalize, + map, + switchMap, +} from 'rxjs/operators'; +import { MessageHandlerService } from '../../../../shared/services/message-handler.service'; +import { + NEW_EMPTY_ROLE, + onlyHasPushPermission, + PermissionsKinds, +} from '../roles-util'; +import { Role } from '../../../../../../ng-swagger-gen/models/role'; +import { NgForm } from '@angular/forms'; +import { ClrLoadingState, ClrWizard } from '@clr/angular'; +import { Subject, Subscription } from 'rxjs'; +import { RoleService } from '../../../../../../ng-swagger-gen/services/role.service'; +import { OperationService } from '../../../../shared/components/operation/operation.service'; +import { clone, isSameArrayValue } from '../../../../shared/units/utils'; +import { + operateChanges, + OperateInfo, + OperationState, +} from '../../../../shared/components/operation/operate'; +import { InlineAlertComponent } from '../../../../shared/components/inline-alert/inline-alert.component'; +import { errorHandler } from '../../../../shared/units/shared.utils'; +import { PermissionSelectPanelModes } from '../../../../shared/components/role-permissions-panel/role-permissions-panel.component'; +import { Permissions } from '../../../../../../ng-swagger-gen/models/permissions'; + +@Component({ + standalone: false, + selector: 'add-role', + templateUrl: './add-role.component.html', + styleUrls: ['./add-role.component.scss'], +}) +export class AddRoleComponent implements OnInit, OnDestroy { + @Input() projectId: number; + @Input() projectName: string; + isEditMode: boolean = false; + originalRoleForEdit: Role; + @Output() + addSuccess: EventEmitter = new EventEmitter(); + addRoleOpened: boolean = false; + role: Role = clone(NEW_EMPTY_ROLE); + isNameExisting: boolean = false; + loading: boolean = false; + checkNameOnGoing: boolean = false; + @ViewChild(InlineAlertComponent) + inlineAlertComponent: InlineAlertComponent; + @ViewChild('roleBasicForm', { static: true }) roleBasicForm: NgForm; + saveBtnState: ClrLoadingState = ClrLoadingState.DEFAULT; + private _nameSubject: Subject = new Subject(); + private _nameSubscription: Subscription; + + @Input() + roleMetadata: Permissions; + + @ViewChild('wizard') wizard: ClrWizard; + + constructor( + private roleService: RoleService, + private msgHandler: MessageHandlerService, + private operationService: OperationService + ) {} + + ngOnInit(): void { + this.subscribeName(); + } + + ngOnDestroy() { + if (this._nameSubscription) { + this._nameSubscription.unsubscribe(); + this._nameSubscription = null; + } + } + + subscribeName() { + if (!this._nameSubscription) { + this._nameSubscription = this._nameSubject + .pipe( + distinctUntilChanged(), + filter(name => { + if ( + this.isEditMode && + this.originalRoleForEdit && + this.originalRoleForEdit.name === name + ) { + return false; + } + return name?.length > 0; + }), + map(name => { + this.checkNameOnGoing = !!name; + return name; + }), + debounceTime(500), + switchMap(name => { + this.isNameExisting = false; + this.checkNameOnGoing = true; + return this.roleService + .ListRole({ + q: encodeURIComponent( + `Level=${PermissionsKinds.ROLE},ProjectID=${this.projectId},name=${name}` + ), + }) + .pipe( + finalize(() => (this.checkNameOnGoing = false)) + ); + }) + ) + .subscribe(res => { + if (res && res.length > 0) { + this.isNameExisting = true; + } + }); + } + } + + inputName() { + this._nameSubject.next(this.role.name); + } + + cancel() { + this.wizard.reset(); + this.reset(); + this.addRoleOpened = false; + } + + reset() { + this.open(false); + this.role = clone(NEW_EMPTY_ROLE); + } + + resetForEdit(role: Role) { + if (role.is_builtin) { + return; + } + this.open(true); + this.originalRoleForEdit = clone(role); + this.role = clone(role); + this.roleBasicForm.reset({ + name: this.role.name, + description: this.role.description, + }); + } + + open(isEditMode: boolean) { + this.isEditMode = isEditMode; + this.addRoleOpened = true; + this.isNameExisting = false; + this._nameSubject.next(''); + } + + disabled(): boolean { + if (!this.isEditMode) { + return !this.canAdd(); + } + return !this.canEdit(); + } + + canAdd(): boolean { + return ( + this.role?.permissions[0]?.access?.length > 0 && + !this.roleBasicForm.invalid + ); + } + + canEdit(): boolean { + if (!this.canAdd()) { + return false; + } + const permissionsChanged = !isSameArrayValue( + this.role.permissions[0].access, + this.originalRoleForEdit.permissions[0].access + ); + const descriptionChanged = + this.role.description !== this.originalRoleForEdit.description; + return permissionsChanged || descriptionChanged; + } + + save() { + const role: Role = clone(this.role); + role.permissions[0].kind = PermissionsKinds.ROLE; + role.permissions[0].namespace = this.projectName; + if (onlyHasPushPermission(role.permissions[0].access)) { + this.inlineAlertComponent.showInlineError( + 'ROLE.PUSH_PERMISSION_TOOLTIP' + ); + return; + } + this.saveBtnState = ClrLoadingState.LOADING; + if (this.isEditMode) { + const opeMessage = new OperateInfo(); + opeMessage.name = 'ROLE.UPDATE_ROLE'; + opeMessage.data.id = role.id; + opeMessage.state = OperationState.progressing; + opeMessage.data.name = role.name; + this.operationService.publishInfo(opeMessage); + this.roleService + .UpdateRole({ + roleId: this.originalRoleForEdit.id, + role, + }) + .subscribe( + () => { + this.saveBtnState = ClrLoadingState.SUCCESS; + this.addSuccess.emit(null); + this.cancel(); + operateChanges(opeMessage, OperationState.success); + this.msgHandler.showSuccess( + 'ROLE.UPDATE_ROLE_SUCCESSFULLY' + ); + }, + error => { + this.saveBtnState = ClrLoadingState.ERROR; + operateChanges( + opeMessage, + OperationState.failure, + errorHandler(error) + ); + this.inlineAlertComponent.showInlineError(error); + } + ); + } else { + const opeMessage = new OperateInfo(); + opeMessage.name = 'ROLE.ADD_ROLE'; + opeMessage.data.id = role.id; + opeMessage.state = OperationState.progressing; + opeMessage.data.name = `${this.projectName}+${role.name}`; + this.operationService.publishInfo(opeMessage); + this.roleService.CreateRole({ role }).subscribe( + res => { + this.saveBtnState = ClrLoadingState.SUCCESS; + this.addSuccess.emit(res); + this.cancel(); + operateChanges(opeMessage, OperationState.success); + }, + error => { + this.saveBtnState = ClrLoadingState.ERROR; + this.inlineAlertComponent.showInlineError(error); + operateChanges( + opeMessage, + OperationState.failure, + errorHandler(error) + ); + } + ); + } + } + + clrWizardPageOnLoad() { + this.inlineAlertComponent.close(); + } + + protected readonly PermissionSelectPanelModes = PermissionSelectPanelModes; +} diff --git a/src/portal/src/app/base/left-side-nav/roles/roles-util.ts b/src/portal/src/app/base/left-side-nav/roles/roles-util.ts new file mode 100644 index 00000000000..9cef8af76a7 --- /dev/null +++ b/src/portal/src/app/base/left-side-nav/roles/roles-util.ts @@ -0,0 +1,239 @@ +// Copyright Project Harbor Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +import { forkJoin, Observable, of } from 'rxjs'; +import { map, switchMap } from 'rxjs/operators'; +import { Role } from '../../../../../ng-swagger-gen/models/role'; +import { Access } from '../../../../../ng-swagger-gen/models/access'; +import { RolePermission } from '../../../../../ng-swagger-gen/models/role-permission'; +import { Permission } from '../../../../../ng-swagger-gen/models/permission'; +import { RoleService } from '../../../../../ng-swagger-gen/services/role.service'; + +const ROLE_PAGE_SIZE: number = 100; + +// loadAllRoles fetches every page of roles so callers are not limited to the +// first page. Once an installation has more than ROLE_PAGE_SIZE roles, a single +// page would silently hide the rest from selection/assignability. +export function loadAllRoles(roleService: RoleService): Observable { + return roleService + .ListRoleResponse({ page: 1, pageSize: ROLE_PAGE_SIZE }) + .pipe( + switchMap(resp => { + const first: Role[] = resp.body ?? []; + const total: number = Number.parseInt( + resp.headers.get('x-total-count') ?? '0', + 10 + ); + if (!total || total <= ROLE_PAGE_SIZE) { + return of(first); + } + const lastPage: number = Math.ceil(total / ROLE_PAGE_SIZE); + const rest: Observable[] = []; + for (let page = 2; page <= lastPage; page++) { + rest.push( + roleService.ListRole({ page, pageSize: ROLE_PAGE_SIZE }) + ); + } + return forkJoin(rest).pipe( + map(pages => + pages.reduce((acc, cur) => acc.concat(cur ?? []), first) + ) + ); + }) + ); +} + +export interface FrontRole extends Role { + permissionScope?: { + coverAll?: boolean; + access?: Array; + }; +} + +export interface FrontAccess extends Access { + checked?: boolean; +} + +export enum PermissionsKinds { + ROLE = 'project-role', +} + +export enum Resource { + REPO = 'repository', + ARTIFACT = 'artifact', +} + +export enum Action { + PUSH = 'push', + PULL = 'pull', + READ = 'read', + CREATE = 'create', + LIST = 'list', + STOP = 'stop', + DELETE = 'delete', +} + +export const NAMESPACE_ALL_PROJECTS: string = '*'; + +export const NAMESPACE_SYSTEM: string = '/'; + +export const ACTION_RESOURCE_I18N_MAP = { + push: 'ROLE.PUSH', + pull: 'ROLE.PULL', + read: 'ROLE.READ', + create: 'ROLE.CREATE', + delete: 'ROLE.DELETE', + scan: 'ROLE.SCAN', + stop: 'ROLE.STOP', + list: 'ROLE.LIST', + update: 'ROLE.UPDATE', + 'audit-log': 'ROLE.AUDIT_LOG', + 'preheat-instance': 'ROLE.PREHEAT_INSTANCE', + '': 'ROLE.PROJECT', + project: 'ROLE.PROJECT', + 'replication-policy': 'ROLE.REPLICATION_POLICY', + replication: 'ROLE.REPLICATION', + 'replication-adapter': 'ROLE.REPLICATION_ADAPTER', + registry: 'ROLE.REGISTRY', + 'scan-all': 'ROLE.SCAN_ALL', + 'system-volumes': 'ROLE.SYSTEM_VOLUMES', + 'garbage-collection': 'ROLE.GARBAGE_COLLECTION', + 'purge-audit': 'ROLE.PURGE_AUDIT', + 'jobservice-monitor': 'ROLE.JOBSERVICE_MONITOR', + 'tag-retention': 'ROLE.TAG_RETENTION', + scanner: 'ROLE.SCANNER', + label: 'ROLE.LABEL', + 'export-cve': 'ROLE.EXPORT_CVE', + 'security-hub': 'ROLE.SECURITY_HUB', + catalog: 'ROLE.CATALOG', + metadata: 'ROLE.METADATA', + repository: 'ROLE.REPOSITORY', + artifact: 'ROLE.ARTIFACT', + tag: 'ROLE.TAG', + accessory: 'ROLE.ACCESSORY', + 'artifact-addition': 'ROLE.ARTIFACT_ADDITION', + 'artifact-label': 'ROLE.ARTIFACT_LABEL', + 'preheat-policy': 'ROLE.PREHEAT_POLICY', + 'immutable-tag': 'ROLE.IMMUTABLE_TAG', + log: 'ROLE.LOG', + 'notification-policy': 'ROLE.NOTIFICATION_POLICY', + quota: 'ROLE.QUOTA', + sbom: 'ROLE.SBOM', + role: 'ROLE.ROLE', + user: 'ROLE.USER', + 'user-group': 'ROLE.GROUP', + 'ldap-user': 'ROLE.LDAPUSER', + member: 'ROLE.MEMBER', +}; + +export function convertKey(key: string) { + return ACTION_RESOURCE_I18N_MAP[key] ? ACTION_RESOURCE_I18N_MAP[key] : key; +} + +export enum ExpirationType { + DEFAULT = 'default', + DAYS = 'days', + NEVER = 'never', +} + +export function onlyHasPushPermission(access: Access[]): boolean { + if (access && access.length) { + let hasPushPermission: boolean = false; + let hasPullPermission: boolean = false; + access.forEach(item => { + if ( + item.action === Action.PUSH && + item.resource === Resource.REPO + ) { + hasPushPermission = true; + } + if ( + item.action === Action.PULL && + item.resource === Resource.REPO + ) { + hasPullPermission = true; + } + }); + if (hasPushPermission && !hasPullPermission) { + return true; + } + } + return false; +} + +export function isCandidate( + candidatePermissions: Permission[], + permission: Access +): boolean { + if (candidatePermissions?.length) { + for (let i = 0; i < candidatePermissions.length; i++) { + if ( + (candidatePermissions[i].resource ?? '') === + (permission.resource ?? '') && + candidatePermissions[i].action === permission.action + ) { + return true; + } + } + } + return false; +} + +export function hasPermission( + permissions: Access[], + permission: Access +): boolean { + if (permissions?.length) { + for (let i = 0; i < permissions.length; i++) { + if ( + (permissions[i].resource ?? '') === + (permission.resource ?? '') && + permissions[i].action === permission.action + ) { + return true; + } + } + } + return false; +} + +export const NEW_EMPTY_ROLE: Role = { + permissions: [ + { + access: [], + }, + ], +}; + +export function getRoleAccess(r: Role): Access[] { + let systemPermissions: RolePermission[] = []; + systemPermissions = r.permissions; + /* if (r?.permissions?.length) { + systemPermissions = r.permissions.filter( + item => item.kind === PermissionsKinds.ROLE + ); + } +*/ + if (systemPermissions?.length) { + const map = {}; + systemPermissions.forEach(p => { + if (p?.access?.length) { + p.access.forEach(item => { + map[`${item.resource}@${item.action}`] = item; + }); + } + }); + return Object.values(map); + } + return []; +} diff --git a/src/portal/src/app/base/left-side-nav/roles/roles.component.html b/src/portal/src/app/base/left-side-nav/roles/roles.component.html new file mode 100644 index 00000000000..89faf6db4bc --- /dev/null +++ b/src/portal/src/app/base/left-side-nav/roles/roles.component.html @@ -0,0 +1,175 @@ +

{{ 'ROLE.ROLE_NAV' | translate }}

+
+
+
+
+
+ + + + +
+
+
+
+ + + + {{ 'MEMBER.ACTION' | translate + }} + + +
+ + + + + + {{ + 'ROLE.NAME' | translate + }} + {{ 'ROLE.BUILTIN' | translate }} + {{ 'ROLE.DESCRIPTION' | translate }} + {{ + 'ROLE.PERMISSIONS' | translate + }} + {{ 'ROLE.CREATED_BY' | translate }} + {{ 'ROLE.CREATED_AT' | translate }} + {{ 'ROLE.MODIFIED_AT' | translate }} + {{ + 'SYSTEM_ROBOT.NOT_FOUND' | translate + }} + @for (r of roles; track r) { + + {{ getRoleName(r) }} + + + + {{ r.description || '–' }} + + + + {{ 'SCHEDULE.NONE' | translate }} + + + + + + + {{ r.created_by || '–' }} + {{ + r.created_at + ? (r.created_at | harborDatetime : 'short') + : '–' + }} + + {{ + r.modified_at + ? (r.modified_at | harborDatetime : 'short') + : '–' + }} + {{ 'ROLE.MODIFIED' | translate }} + + + } + + + {{ + 'PAGINATION.PAGE_SIZE' | translate + }} + {{ pagination.firstItem + 1 }} + - + {{ pagination.lastItem + 1 }} + {{ 'ROLE.OF' | translate }} + + {{ total }} {{ 'ROLE.ITEMS' | translate }} + + + +
+
+ + + + diff --git a/src/portal/src/app/base/left-side-nav/roles/roles.component.scss b/src/portal/src/app/base/left-side-nav/roles/roles.component.scss new file mode 100644 index 00000000000..925deb14746 --- /dev/null +++ b/src/portal/src/app/base/left-side-nav/roles/roles.component.scss @@ -0,0 +1,48 @@ +.role-space { + margin-top: 28px; + position: relative; + + clr-icon.red-position { + margin-left: 2px; + } + /* stylelint-disable */ + .rightPos { + position: absolute; + z-index: 100; + right: 35px; + margin-top: 4px; + + .option-left { + padding-left: 16px; + position: relative; + top: 10px; + } + + .option-right { + padding-right: 16px; + + .refresh-btn { + cursor: pointer; + } + } + } +} + +.all-projects { + display: flex; + align-items: center; + height: 16px; +} + + +.icon { + margin-top: 3px; +} + +.projects-col { + min-width: 14rem !important; +} + +.permission-col { + min-width: 8rem !important; +} diff --git a/src/portal/src/app/base/left-side-nav/roles/roles.component.spec.ts b/src/portal/src/app/base/left-side-nav/roles/roles.component.spec.ts new file mode 100644 index 00000000000..11ad674e494 --- /dev/null +++ b/src/portal/src/app/base/left-side-nav/roles/roles.component.spec.ts @@ -0,0 +1,177 @@ +// Copyright Project Harbor Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +import { ComponentFixture, TestBed } from '@angular/core/testing'; +import { NO_ERRORS_SCHEMA } from '@angular/core'; +import { RolesComponent } from './roles.component'; +import { RoleService } from '../../../../../ng-swagger-gen/services/role.service'; +import { HttpHeaders, HttpResponse } from '@angular/common/http'; +import { of, Subscription } from 'rxjs'; +import { delay } from 'rxjs/operators'; +import { Role } from '../../../../../ng-swagger-gen/models/role'; +import { MessageHandlerService } from '../../../shared/services/message-handler.service'; +import { OperationService } from '../../../shared/components/operation/operation.service'; +import { ConfirmationDialogService } from '../../global-confirmation-dialog/confirmation-dialog.service'; +import { TranslateModule, TranslateService } from '@ngx-translate/core'; +import { CommonModule } from '@angular/common'; +import { ClarityModule } from '@clr/angular'; +import { HttpClientTestingModule } from '@angular/common/http/testing'; +import { RouterTestingModule } from '@angular/router/testing'; +import { BrowserAnimationsModule } from '@angular/platform-browser/animations'; +import { SysteminfoService } from '../../../../../ng-swagger-gen/services/systeminfo.service'; +import { PermissionsService } from '../../../../../ng-swagger-gen/services/permissions.service'; + +const builtinRole: Role = { + id: 1, + name: 'projectAdmin', + is_builtin: true, + permissions: [], +}; + +const customRole: Role = { + id: 10, + name: 'myCustomRole', + is_builtin: false, + permissions: [], +}; + +const fakedRoleService = { + ListRoleResponse() { + const res: HttpResponse> = new HttpResponse>({ + headers: new HttpHeaders({ 'x-total-count': '2' }), + body: [builtinRole, customRole], + }); + return of(res).pipe(delay(0)); + }, +}; + +const fakedMessageHandlerService = { showSuccess() {}, error() {} }; +const fakedSystemInfoService = { getSystemInfo: () => of({}) }; +const fakedPermissionsService = { getPermissions: () => of({}) }; + +describe('RolesComponent', () => { + let component: RolesComponent; + let fixture: ComponentFixture; + + beforeEach(async () => { + await TestBed.configureTestingModule({ + imports: [ + TranslateModule.forRoot(), + CommonModule, + ClarityModule, + HttpClientTestingModule, + RouterTestingModule, + BrowserAnimationsModule, + ], + declarations: [RolesComponent], + providers: [ + TranslateService, + ConfirmationDialogService, + OperationService, + { + provide: MessageHandlerService, + useValue: fakedMessageHandlerService, + }, + { provide: RoleService, useValue: fakedRoleService }, + { + provide: SysteminfoService, + useValue: fakedSystemInfoService, + }, + { + provide: PermissionsService, + useValue: fakedPermissionsService, + }, + ], + schemas: [NO_ERRORS_SCHEMA], + }).compileComponents(); + }); + + beforeEach(() => { + fixture = TestBed.createComponent(RolesComponent); + component = fixture.componentInstance; + component.searchSub = new Subscription(); + fixture.detectChanges(); + }); + + it('should create', () => { + expect(component).toBeTruthy(); + }); + + describe('isBuiltinSelected', () => { + it('returns false when nothing is selected', () => { + component.selectedRows = []; + expect(component.isBuiltinSelected()).toBeFalse(); + }); + + it('returns false when only custom roles are selected', () => { + component.selectedRows = [customRole]; + expect(component.isBuiltinSelected()).toBeFalse(); + }); + + it('returns true when a built-in role is selected', () => { + component.selectedRows = [builtinRole]; + expect(component.isBuiltinSelected()).toBeTrue(); + }); + + it('returns true when a mix of built-in and custom roles is selected', () => { + component.selectedRows = [builtinRole, customRole]; + expect(component.isBuiltinSelected()).toBeTrue(); + }); + }); + + describe('action button disabled state', () => { + it('edit button is disabled when a built-in role is selected', async () => { + fixture.autoDetectChanges(); + await fixture.whenStable(); + component.selectedRows = [builtinRole]; + fixture.detectChanges(); + const editBtn: HTMLButtonElement = fixture.nativeElement + .querySelector('#system-robot-edit') + ?.closest('button'); + expect(editBtn?.disabled).toBeTrue(); + }); + + it('edit button is enabled when a custom role is selected', async () => { + fixture.autoDetectChanges(); + await fixture.whenStable(); + component.selectedRows = [customRole]; + fixture.detectChanges(); + const editBtn: HTMLButtonElement = fixture.nativeElement + .querySelector('#system-robot-edit') + ?.closest('button'); + expect(editBtn?.disabled).toBeFalse(); + }); + + it('delete button is disabled when a built-in role is selected', async () => { + fixture.autoDetectChanges(); + await fixture.whenStable(); + component.selectedRows = [builtinRole]; + fixture.detectChanges(); + const deleteBtn: HTMLButtonElement = fixture.nativeElement + .querySelector('#system-robot-delete') + ?.closest('button'); + expect(deleteBtn?.disabled).toBeTrue(); + }); + + it('delete button is disabled when a mix of built-in and custom roles is selected', async () => { + fixture.autoDetectChanges(); + await fixture.whenStable(); + component.selectedRows = [builtinRole, customRole]; + fixture.detectChanges(); + const deleteBtn: HTMLButtonElement = fixture.nativeElement + .querySelector('#system-robot-delete') + ?.closest('button'); + expect(deleteBtn?.disabled).toBeTrue(); + }); + }); +}); diff --git a/src/portal/src/app/base/left-side-nav/roles/roles.component.ts b/src/portal/src/app/base/left-side-nav/roles/roles.component.ts new file mode 100644 index 00000000000..6f9aa16daf8 --- /dev/null +++ b/src/portal/src/app/base/left-side-nav/roles/roles.component.ts @@ -0,0 +1,342 @@ +// Copyright Project Harbor Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +import { Component, OnDestroy, OnInit, ViewChild } from '@angular/core'; + +import { ViewTokenComponent } from '../../../shared/components/view-token/view-token.component'; +import { RoleService } from '../../../../../ng-swagger-gen/services/role.service'; +import { Role } from '../../../../../ng-swagger-gen/models/role'; +import { + clone, + getPageSizeFromLocalStorage, + getSortingString, + PageSizeMapKeys, + setPageSizeToLocalStorage, +} from '../../../shared/units/utils'; +import { ClrDatagridStateInterface, ClrLoadingState } from '@clr/angular'; +import { + catchError, + debounceTime, + distinctUntilChanged, + finalize, + map, + switchMap, +} from 'rxjs/operators'; +import { MessageHandlerService } from '../../../shared/services/message-handler.service'; +import { + FrontRole, + getRoleAccess, + NAMESPACE_ALL_PROJECTS, + NEW_EMPTY_ROLE, + PermissionsKinds, +} from './roles-util'; +import { forkJoin, Observable, of, Subscription } from 'rxjs'; +import { FilterComponent } from '../../../shared/components/filter/filter.component'; +import { HttpErrorResponse } from '@angular/common/http'; +import { + operateChanges, + OperateInfo, + OperationState, +} from '../../../shared/components/operation/operate'; +import { OperationService } from '../../../shared/components/operation/operation.service'; +import { DomSanitizer } from '@angular/platform-browser'; +import { TranslateService } from '@ngx-translate/core'; +import { ConfirmationDialogService } from '../../global-confirmation-dialog/confirmation-dialog.service'; +import { + ConfirmationButtons, + ConfirmationState, + ConfirmationTargets, + PAGE_SIZE_OPTIONS, +} from '../../../shared/entities/shared.const'; +import { errorHandler } from '../../../shared/units/shared.utils'; +import { ConfirmationMessage } from '../../global-confirmation-dialog/confirmation-message'; +import { RolePermission } from '../../../../../ng-swagger-gen/models/role-permission'; +import { SysteminfoService } from '../../../../../ng-swagger-gen/services/systeminfo.service'; +import { Access } from '../../../../../ng-swagger-gen/models/access'; +import { PermissionSelectPanelModes } from '../../../shared/components/role-permissions-panel/role-permissions-panel.component'; +import { PermissionsService } from '../../../../../ng-swagger-gen/services/permissions.service'; +import { Permissions } from '../../../../../ng-swagger-gen/models/permissions'; +import { AddRoleComponent } from './add-role/add-role.component'; + +@Component({ + standalone: false, + selector: 'roles', + templateUrl: './roles.component.html', + styleUrls: ['./roles.component.scss'], +}) +export class RolesComponent implements OnInit, OnDestroy { + clrPageSizeOptions: number[] = PAGE_SIZE_OPTIONS; + pageSize: number = getPageSizeFromLocalStorage( + PageSizeMapKeys.SYSTEM_ROBOT_COMPONENT + ); + currentPage: number = 1; + total: number = 0; + roles: FrontRole[] = []; + selectedRows: FrontRole[] = []; + loading: boolean = true; + loadingData: boolean = false; + addBtnState: ClrLoadingState = ClrLoadingState.DEFAULT; + @ViewChild(AddRoleComponent) + newRoleComponent: AddRoleComponent; + @ViewChild(FilterComponent, { static: true }) + filterComponent: FilterComponent; + searchSub: Subscription; + searchKey: string; + subscription: Subscription; + deltaTime: number; // the different between server time and local time + + roleMetadata: Permissions; + loadingMetadata: boolean = false; + constructor( + private roleService: RoleService, + private msgHandler: MessageHandlerService, + private operateDialogService: ConfirmationDialogService, + private operationService: OperationService, + private sanitizer: DomSanitizer, + private translate: TranslateService, + private systemInfoService: SysteminfoService, + private permissionService: PermissionsService + ) {} + ngOnInit() { + this.getRolePermissions(); + this.getCurrenTime(); + if (!this.searchSub) { + this.searchSub = this.filterComponent.filterTerms + .pipe( + debounceTime(500), + distinctUntilChanged(), + switchMap(roleSearchName => { + this.currentPage = 1; + this.selectedRows = []; + const queryParam: RoleService.ListRoleParams = { + page: this.currentPage, + pageSize: this.pageSize, + }; + this.searchKey = roleSearchName; + if (this.searchKey) { + queryParam.q = encodeURIComponent( + `name=~${this.searchKey}` + ); + } + this.loading = true; + return this.roleService + .ListRoleResponse(queryParam) + .pipe( + finalize(() => { + this.loading = false; + }) + ); + }) + ) + .subscribe( + response => { + this.total = Number.parseInt( + response.headers.get('x-total-count'), + 10 + ); + this.roles = response.body as Role[]; + }, + error => { + this.msgHandler.handleError(error); + } + ); + } + if (!this.subscription) { + this.subscription = + this.operateDialogService.confirmationConfirm$.subscribe( + message => { + if ( + message && + message.state === ConfirmationState.CONFIRMED && + message.source === ConfirmationTargets.ROLE + ) { + this.deleteRoles(message.data); + } + } + ); + } + } + + ngOnDestroy() { + if (this.searchSub) { + this.searchSub.unsubscribe(); + this.searchSub = null; + } + if (this.subscription) { + this.subscription.unsubscribe(); + this.subscription = null; + } + } + + getRolePermissions() { + this.loadingData = true; + this.permissionService + .getPermissions() + .pipe(finalize(() => (this.loadingData = false))) + .subscribe(res => { + this.roleMetadata = res; + }); + } + + getCurrenTime() { + this.systemInfoService.getSystemInfo().subscribe(res => { + if (res?.current_time) { + this.deltaTime = + new Date().getTime() - + new Date(res?.current_time).getTime(); + } + }); + } + + clrLoad(state?: ClrDatagridStateInterface) { + if (state && state.page && state.page.size) { + this.pageSize = state.page.size; + setPageSizeToLocalStorage( + PageSizeMapKeys.SYSTEM_ROBOT_COMPONENT, + this.pageSize + ); + } + this.selectedRows = []; + const queryParam: RoleService.ListRoleParams = { + page: this.currentPage, + pageSize: this.pageSize, + sort: getSortingString(state), + }; + if (this.searchKey) { + queryParam.q = encodeURIComponent(`name=~${this.searchKey}`); + } + this.loading = true; + this.roleService + .ListRoleResponse(queryParam) + .pipe(finalize(() => (this.loading = false))) + .subscribe( + response => { + this.total = Number.parseInt( + response.headers.get('x-total-count'), + 10 + ); + this.roles = response.body as Role[]; + }, + err => { + this.msgHandler.error(err); + } + ); + } + openNewRoleModal(isEditMode: boolean) { + if (isEditMode) { + this.newRoleComponent.resetForEdit(clone(this.selectedRows[0])); + } else { + this.newRoleComponent.reset(); + } + } + + getProjects(r: Role): RolePermission[] { + const arr = []; + if (r && r.permissions && r.permissions.length) { + for (let i = 0; i < r.permissions.length; i++) { + if (r.permissions[i].kind === PermissionsKinds.ROLE) { + arr.push(r.permissions[i]); + } + } + } + return arr; + } + + refresh() { + this.currentPage = 1; + this.selectedRows = []; + this.clrLoad(); + } + deleteRoles(roles: Role[]) { + let observableLists: Observable[] = []; + if (roles && roles.length) { + roles.forEach(item => { + observableLists.push(this.deleteRole(item)); + }); + forkJoin(...observableLists).subscribe(resArr => { + let error; + if (resArr && resArr.length) { + resArr.forEach(item => { + if (item instanceof HttpErrorResponse) { + error = errorHandler(item); + } + }); + } + if (error) { + this.msgHandler.handleError(error); + } else { + this.msgHandler.showSuccess('ROLE.DELETE_ROLE_SUCCESS'); + } + this.refresh(); + }); + } + } + deleteRole(role: Role): Observable { + let operMessage = new OperateInfo(); + operMessage.name = 'ROLE.DELETE_ROLE'; + operMessage.data.id = role.id; + operMessage.state = OperationState.progressing; + operMessage.data.name = role.name; + this.operationService.publishInfo(operMessage); + return this.roleService.DeleteRole({ roleId: role.id }).pipe( + map(() => { + operateChanges(operMessage, OperationState.success); + }), + catchError(error => { + const message = errorHandler(error); + operateChanges(operMessage, OperationState.failure, message); + return of(error); + }) + ); + } + openDeleteRolesDialog() { + const roleNames = this.selectedRows.map(role => role.name).join(','); + const deletionMessage = new ConfirmationMessage( + 'ROLE.DELETION_TITLE', + 'ROLE.DELETION_SUMMARY', + roleNames, + this.selectedRows, + ConfirmationTargets.ROLE, + ConfirmationButtons.DELETE_CANCEL + ); + this.operateDialogService.openComfirmDialog(deletionMessage); + } + + addSuccess(role: Role) { + if (role) { + this.translate.get('ROLE.CREATED_SUCCESS', { param: role.name }); + // export to token file + const downLoadUrl = `data:text/json;charset=utf-8, ${encodeURIComponent( + JSON.stringify(role) + )}`; + } + this.refresh(); + } + + isBuiltinSelected(): boolean { + return this.selectedRows.some(r => r.is_builtin); + } + + getRoleName(r: Role): string { + const key = `ROLE.ROLE_NAMES.${r.name}`; + const translated = this.translate.instant(key); + return translated === key ? r.name : translated; + } + + getRoleAccess(r: Role): Access[] { + return getRoleAccess(r); + } + + protected readonly NEW_EMPTY_ROLE = NEW_EMPTY_ROLE; + protected readonly PermissionSelectPanelModes = PermissionSelectPanelModes; +} diff --git a/src/portal/src/app/base/left-side-nav/roles/roles.module.ts b/src/portal/src/app/base/left-side-nav/roles/roles.module.ts new file mode 100644 index 00000000000..0a90dc2614b --- /dev/null +++ b/src/portal/src/app/base/left-side-nav/roles/roles.module.ts @@ -0,0 +1,36 @@ +// Copyright Project Harbor Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +import { NgModule } from '@angular/core'; +import { RolesComponent } from './roles.component'; +import { SharedModule } from '../../../shared/shared.module'; +import { RouterModule, Routes } from '@angular/router'; +import { AddRoleComponent } from './add-role/add-role.component'; +import { RolePermissionsPanelComponent } from '../../../shared/components/role-permissions-panel/role-permissions-panel.component'; + +const routes: Routes = [ + { + path: '', + component: RolesComponent, + }, +]; + +@NgModule({ + declarations: [ + RolesComponent, + AddRoleComponent, + RolePermissionsPanelComponent, + ], + imports: [SharedModule, RouterModule.forChild(routes)], +}) +export class RolesModule {} diff --git a/src/portal/src/app/base/left-side-nav/system-robot-accounts/system-robot-accounts.component.ts b/src/portal/src/app/base/left-side-nav/system-robot-accounts/system-robot-accounts.component.ts index 6b646a869ba..ef0ad4be7ca 100644 --- a/src/portal/src/app/base/left-side-nav/system-robot-accounts/system-robot-accounts.component.ts +++ b/src/portal/src/app/base/left-side-nav/system-robot-accounts/system-robot-accounts.component.ts @@ -178,6 +178,7 @@ export class SystemRobotAccountsComponent implements OnInit, OnDestroy { ); } } + ngOnDestroy() { if (this.searchSub) { this.searchSub.unsubscribe(); diff --git a/src/portal/src/app/base/left-side-nav/system-robot-accounts/system-robot-util.ts b/src/portal/src/app/base/left-side-nav/system-robot-accounts/system-robot-util.ts index dd58a2b130d..d119f50cdba 100644 --- a/src/portal/src/app/base/left-side-nav/system-robot-accounts/system-robot-util.ts +++ b/src/portal/src/app/base/left-side-nav/system-robot-accounts/system-robot-util.ts @@ -63,6 +63,7 @@ export const ACTION_RESOURCE_I18N_MAP = { update: 'ROBOT_ACCOUNT.UPDATE', 'audit-log': 'ROBOT_ACCOUNT.AUDIT_LOG', 'preheat-instance': 'ROBOT_ACCOUNT.PREHEAT_INSTANCE', + '': 'ROBOT_ACCOUNT.PROJECT', project: 'ROBOT_ACCOUNT.PROJECT', 'replication-policy': 'ROBOT_ACCOUNT.REPLICATION_POLICY', replication: 'ROBOT_ACCOUNT.REPLICATION', @@ -147,7 +148,8 @@ export function isCandidate( if (candidatePermissions?.length) { for (let i = 0; i < candidatePermissions.length; i++) { if ( - candidatePermissions[i].resource === permission.resource && + (candidatePermissions[i].resource ?? '') === + (permission.resource ?? '') && candidatePermissions[i].action === permission.action ) { return true; @@ -164,7 +166,8 @@ export function hasPermission( if (permissions?.length) { for (let i = 0; i < permissions.length; i++) { if ( - permissions[i].resource === permission.resource && + (permissions[i].resource ?? '') === + (permission.resource ?? '') && permissions[i].action === permission.action ) { return true; diff --git a/src/portal/src/app/base/project/member/add-group/add-group.component.html b/src/portal/src/app/base/project/member/add-group/add-group.component.html index 0e8f08eb0e4..4eb36497bab 100644 --- a/src/portal/src/app/base/project/member/add-group/add-group.component.html +++ b/src/portal/src/app/base/project/member/add-group/add-group.component.html @@ -62,22 +62,38 @@

{{ 'GROUP.NEW_MEMBER' | translate }}

+
- @for (projectRoot of projectRoots; track projectRoot) { - - - - - } +
+ @for (r of roles; track r.id) { + + + + + } +
diff --git a/src/portal/src/app/base/project/member/add-group/add-group.component.scss b/src/portal/src/app/base/project/member/add-group/add-group.component.scss index fe23b549855..17faae93c2b 100644 --- a/src/portal/src/app/base/project/member/add-group/add-group.component.scss +++ b/src/portal/src/app/base/project/member/add-group/add-group.component.scss @@ -27,3 +27,16 @@ background-image: linear-gradient(180deg,#f5f5f5 0,#e8e8e8); background-repeat: repeat-x; } + +.role-radio-list { + max-height: 200px; + overflow-y: auto; + padding-right: 4px; +} + +.role-builtin-badge { + font-size: 10px; + padding: 1px 4px; + margin-left: 4px; + vertical-align: middle; +} diff --git a/src/portal/src/app/base/project/member/add-group/add-group.component.ts b/src/portal/src/app/base/project/member/add-group/add-group.component.ts index afe21b30172..7d161d53e22 100644 --- a/src/portal/src/app/base/project/member/add-group/add-group.component.ts +++ b/src/portal/src/app/base/project/member/add-group/add-group.component.ts @@ -23,11 +23,7 @@ import { } from '@angular/core'; import { NgForm } from '@angular/forms'; import { AppConfigService } from '../../../../services/app-config.service'; -import { ProjectRootInterface } from '../../../../shared/services'; -import { - GroupType, - PROJECT_ROOTS, -} from '../../../../shared/entities/shared.const'; +import { GroupType } from '../../../../shared/entities/shared.const'; import { InlineAlertComponent } from '../../../../shared/components/inline-alert/inline-alert.component'; import { UsergroupService } from '../../../../../../ng-swagger-gen/services/usergroup.service'; import { of, Subject, Subscription } from 'rxjs'; @@ -35,6 +31,9 @@ import { UserGroup } from 'ng-swagger-gen/models/user-group'; import { ClrLoadingState } from '@clr/angular'; import { MemberService } from 'ng-swagger-gen/services/member.service'; import { MessageHandlerService } from '../../../../shared/services/message-handler.service'; +import { RoleService } from '../../../../../../ng-swagger-gen/services/role.service'; +import { loadAllRoles } from '../../../left-side-nav/roles/roles-util'; +import { Role } from '../../../../../../ng-swagger-gen/models/role'; @Component({ selector: 'add-group', @@ -43,7 +42,7 @@ import { MessageHandlerService } from '../../../../shared/services/message-handl standalone: false, }) export class AddGroupComponent implements OnInit, OnDestroy { - projectRoots: ProjectRootInterface[] = PROJECT_ROOTS; + //projectRoots: ProjectRootInterface[] = PROJECT_ROOTS; memberGroup: UserGroup = { group_name: '', }; @@ -59,6 +58,7 @@ export class AddGroupComponent implements OnInit, OnDestroy { inlineAlert: InlineAlertComponent; @Input() projectId: number; + @Input() assignableRoleIds: Set | null = null; @Output() added = new EventEmitter(); checkOnGoing: boolean = false; @@ -72,13 +72,23 @@ export class AddGroupComponent implements OnInit, OnDestroy { groupTooltip: string = 'MEMBER.GROUP_NAME_REQUIRED'; isNameChecked: boolean = false; // this is only for LDAP mode constructor( + private roleService: RoleService, private memberService: MemberService, private appConfigService: AppConfigService, private messageHandlerService: MessageHandlerService, private userGroupService: UsergroupService ) {} + roles: Role[]; + roleSub: Subscription; + ngOnInit(): void { + this.roleSub = loadAllRoles(this.roleService).subscribe(res => { + if (res) { + this.roles = res; + } + }); + if (!this.groupCheckerSub) { this.groupCheckerSub = this.groupChecker .pipe( @@ -171,6 +181,10 @@ export class AddGroupComponent implements OnInit, OnDestroy { this.groupSearcherSub.unsubscribe(); this.groupSearcherSub = null; } + if (this.roleSub) { + this.roleSub.unsubscribe(); + this.roleSub = null; + } } createGroupAsMember() { @@ -217,9 +231,11 @@ export class AddGroupComponent implements OnInit, OnDestroy { } openAddGroupModal(): void { + const firstAssignable = this.roles?.find(r => this.isRoleAssignable(r)); this.currentForm.reset({ - member_role: 1, + member_role: firstAssignable?.id ?? 1, }); + this.roleId = firstAssignable?.id ?? 1; this.addGroupOpened = true; this.inlineAlert.close(); this.memberGroup = { @@ -243,6 +259,27 @@ export class AddGroupComponent implements OnInit, OnDestroy { ); } + isRoleAssignable(role: Role): boolean { + return ( + this.assignableRoleIds === null || + this.assignableRoleIds.has(role.id) + ); + } + + getRoleDisplayName(role: Role): string { + if (!role.is_builtin) { + return role.name; + } + const keys: Record = { + projectAdmin: 'MEMBER.PROJECT_ADMIN', + maintainer: 'MEMBER.PROJECT_MAINTAINER', + developer: 'MEMBER.DEVELOPER', + guest: 'MEMBER.GUEST', + limitedGuest: 'MEMBER.LIMITED_GUEST', + }; + return keys[role.name] ?? role.name; + } + selectGroup(groupName) { if (this.appConfigService.isLdapMode()) { this.isNameChecked = true; diff --git a/src/portal/src/app/base/project/member/add-member/add-member.component.html b/src/portal/src/app/base/project/member/add-member/add-member.component.html index b6e5395fbb1..dc9dff42adc 100644 --- a/src/portal/src/app/base/project/member/add-member/add-member.component.html +++ b/src/portal/src/app/base/project/member/add-member/add-member.component.html @@ -62,66 +62,37 @@

{{ 'MEMBER.NEW_MEMBER' | translate }}

'MEMBER.ROLE' | translate }}
- - - - - - - - - - - - - - - - - - - - +
+
+ + + + +
+
diff --git a/src/portal/src/app/base/project/member/add-member/add-member.component.scss b/src/portal/src/app/base/project/member/add-member/add-member.component.scss index 0b7fd909c7e..8e8cced70df 100644 --- a/src/portal/src/app/base/project/member/add-member/add-member.component.scss +++ b/src/portal/src/app/base/project/member/add-member/add-member.component.scss @@ -32,4 +32,17 @@ overflow: visible; } +.role-radio-list { + max-height: 200px; + overflow-y: auto; + padding-right: 4px; +} + +.role-builtin-badge { + font-size: 10px; + padding: 1px 4px; + margin-left: 4px; + vertical-align: middle; +} + diff --git a/src/portal/src/app/base/project/member/add-member/add-member.component.ts b/src/portal/src/app/base/project/member/add-member/add-member.component.ts index 33cd2021a8b..d3c7e1b7c11 100644 --- a/src/portal/src/app/base/project/member/add-member/add-member.component.ts +++ b/src/portal/src/app/base/project/member/add-member/add-member.component.ts @@ -32,6 +32,9 @@ import { MemberService } from 'ng-swagger-gen/services/member.service'; import { UserService } from 'ng-swagger-gen/services/user.service'; import { UserResp } from '../../../../../../ng-swagger-gen/models/user-resp'; import { UserEntity } from '../../../../../../ng-swagger-gen/models/user-entity'; +import { RoleService } from '../../../../../../ng-swagger-gen/services/role.service'; +import { loadAllRoles } from '../../../left-side-nav/roles/roles-util'; +import { Role } from '../../../../../../ng-swagger-gen/models/role'; @Component({ selector: 'add-member', @@ -49,6 +52,7 @@ export class AddMemberComponent implements OnInit, OnDestroy { @ViewChild(InlineAlertComponent) inlineAlert: InlineAlertComponent; @Input() projectId: number; + @Input() assignableRoleIds: Set | null = null; @Output() added = new EventEmitter(); isMemberNameValid: boolean = true; memberTooltip: string = 'MEMBER.USERNAME_IS_REQUIRED'; @@ -56,12 +60,16 @@ export class AddMemberComponent implements OnInit, OnDestroy { searcher: Subject = new Subject(); nameCheckerSub: Subscription; searcherSub: Subscription; + roleSub: Subscription; checkOnGoing: boolean = false; searchedUserLists: UserResp[] = []; btnStatus: ClrLoadingState = ClrLoadingState.DEFAULT; roleId: number = 1; // default value is 1(project admin) + roles: Role[]; + constructor( + private roleService: RoleService, private memberService: MemberService, private userService: UserService, private messageHandlerService: MessageHandlerService, @@ -69,6 +77,12 @@ export class AddMemberComponent implements OnInit, OnDestroy { ) {} ngOnInit(): void { + this.roleSub = loadAllRoles(this.roleService).subscribe(res => { + if (res) { + this.roles = res; + } + }); + let resolverData = this.route.snapshot.parent.parent.data; let hasProjectAdminRole: boolean; if (resolverData) { @@ -149,6 +163,10 @@ export class AddMemberComponent implements OnInit, OnDestroy { this.searcherSub.unsubscribe(); this.searcherSub = null; } + if (this.roleSub) { + this.roleSub.unsubscribe(); + this.roleSub = null; + } } onSubmit(): void { @@ -194,9 +212,11 @@ export class AddMemberComponent implements OnInit, OnDestroy { this.searchedUserLists = []; } openAddMemberModal(): void { + const firstAssignable = this.roles?.find(r => this.isRoleAssignable(r)); this.currentForm.reset({ - member_role: 1, + member_role: firstAssignable?.id ?? 1, }); + this.roleId = firstAssignable?.id ?? 1; this.inlineAlert.close(); this.member = {}; this.addMemberOpened = true; @@ -226,4 +246,25 @@ export class AddMemberComponent implements OnInit, OnDestroy { !this.checkOnGoing ); } + + isRoleAssignable(role: Role): boolean { + return ( + this.assignableRoleIds === null || + this.assignableRoleIds.has(role.id) + ); + } + + getRoleDisplayName(role: Role): string { + if (!role.is_builtin) { + return role.name; + } + const keys: Record = { + projectAdmin: 'MEMBER.PROJECT_ADMIN', + maintainer: 'MEMBER.PROJECT_MAINTAINER', + developer: 'MEMBER.DEVELOPER', + guest: 'MEMBER.GUEST', + limitedGuest: 'MEMBER.LIMITED_GUEST', + }; + return keys[role.name] ?? role.name; + } } diff --git a/src/portal/src/app/base/project/member/member.component.html b/src/portal/src/app/base/project/member/member.component.html index 9a29fe28cb0..ad7ec0eb5e3 100644 --- a/src/portal/src/app/base/project/member/member.component.html +++ b/src/portal/src/app/base/project/member/member.component.html @@ -53,56 +53,42 @@ - - - - - +
+ +
+ +
+ + + + + + + + + + + + + + +
+ {{ 'AUDIT_LOG.RESOURCE' | translate }} + + {{ convertKey(item) | translate }} +
+ {{ convertKey(resource) | translate }} + + +
+ + + + + +
+ +
+ + + + + + + + + + + + + +
+ {{ 'AUDIT_LOG.RESOURCE' | translate }} + + {{ convertKey(item) | translate }} +
{{ convertKey(resource) | translate }} + +
+ diff --git a/src/portal/src/app/shared/components/role-permissions-panel/role-permissions-panel.component.scss b/src/portal/src/app/shared/components/role-permissions-panel/role-permissions-panel.component.scss new file mode 100644 index 00000000000..c0486014d4a --- /dev/null +++ b/src/portal/src/app/shared/components/role-permissions-panel/role-permissions-panel.component.scss @@ -0,0 +1,20 @@ +.td { + height: 24px; + line-height: 24px; + padding-top: 0 !important; + padding-bottom: 0 !important; +} + +.dropdown-menu { + max-width: unset; +} + +:host::ng-deep.trigger clr-icon { + padding: 0; + position: unset !important; +} + +.select-all-for-dropdown { + margin-bottom: 0.25rem; + width: fit-content; +} diff --git a/src/portal/src/app/shared/components/role-permissions-panel/role-permissions-panel.component.spec.ts b/src/portal/src/app/shared/components/role-permissions-panel/role-permissions-panel.component.spec.ts new file mode 100644 index 00000000000..dd2ea04d855 --- /dev/null +++ b/src/portal/src/app/shared/components/role-permissions-panel/role-permissions-panel.component.spec.ts @@ -0,0 +1,84 @@ +// Copyright Project Harbor Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +import { ComponentFixture, TestBed } from '@angular/core/testing'; +import { Component, ViewChild } from '@angular/core'; +import { SharedTestingModule } from '../../shared.module'; +import { + PermissionSelectPanelModes, + RolePermissionsPanelComponent, +} from './role-permissions-panel.component'; + +describe('RolePermissionsPanelComponent', () => { + let component: TestHostComponent; + let fixture: ComponentFixture; + beforeEach(async () => { + await TestBed.configureTestingModule({ + imports: [SharedTestingModule], + declarations: [TestHostComponent, RolePermissionsPanelComponent], + }).compileComponents(); + }); + + beforeEach(() => { + fixture = TestBed.createComponent(TestHostComponent); + component = fixture.componentInstance; + fixture.detectChanges(); + }); + + it('should create', () => { + expect(component).toBeTruthy(); + }); + + it('should render right mode', async () => { + component.rolePermissionsPanelComponent.modalOpen = true; + fixture.detectChanges(); + await fixture.whenStable(); + const table = fixture.nativeElement.querySelector('table'); + expect(table).toBeTruthy(); + component.mode = PermissionSelectPanelModes.DROPDOWN; + fixture.detectChanges(); + await fixture.whenStable(); + const clrDropdown = fixture.nativeElement.querySelector('clr-dropdown'); + expect(clrDropdown).toBeTruthy(); + component.mode = PermissionSelectPanelModes.MODAL; + fixture.detectChanges(); + await fixture.whenStable(); + const modal = fixture.nativeElement.querySelector('clr-modal'); + expect(modal).toBeTruthy(); + }); +}); + +// mock a TestHostComponent for RolePermissionsPanelComponent +@Component({ + template: ` + + +
modal
+ + + + +
dropDown
+ + + + + + `, +}) +class TestHostComponent { + @ViewChild(RolePermissionsPanelComponent) + rolePermissionsPanelComponent: RolePermissionsPanelComponent; + mode = PermissionSelectPanelModes.NORMAL; + protected readonly PermissionSelectPanelModes = PermissionSelectPanelModes; +} diff --git a/src/portal/src/app/shared/components/role-permissions-panel/role-permissions-panel.component.ts b/src/portal/src/app/shared/components/role-permissions-panel/role-permissions-panel.component.ts new file mode 100644 index 00000000000..dc495b27aae --- /dev/null +++ b/src/portal/src/app/shared/components/role-permissions-panel/role-permissions-panel.component.ts @@ -0,0 +1,176 @@ +// Copyright Project Harbor Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +import { + AfterViewInit, + Component, + DoCheck, + ElementRef, + EventEmitter, + Input, + OnChanges, + OnInit, + Output, + SimpleChanges, + ViewChild, +} from '@angular/core'; +import { + convertKey, + hasPermission, + isCandidate, +} from '../../../base/left-side-nav/roles/roles-util'; +import { Access } from '../../../../../ng-swagger-gen/models/access'; +import { Permission } from '../../../../../ng-swagger-gen/models/permission'; + +@Component({ + standalone: false, + selector: 'role-permissions-panel', + templateUrl: './role-permissions-panel.component.html', + styleUrls: ['./role-permissions-panel.component.scss'], +}) +export class RolePermissionsPanelComponent implements OnChanges, DoCheck { + modalOpen: boolean = false; + + @Input() + mode: PermissionSelectPanelModes = PermissionSelectPanelModes.NORMAL; + + @Input() + dropdownPosition: string = 'bottom-left'; + + @Input() + usedInDatagrid: boolean = false; + + @Input() + candidatePermissions: Permission[] = []; + + candidateActions: string[] = []; + candidateResources: string[] = []; + + @Input() + permissionsModel!: Access[]; + @Output() + permissionsModelChange = new EventEmitter(); + + @ViewChild('dropdownMenu') + dropdownMenu: any; + + @ViewChild('dropdown') + dropdown: ElementRef; + + // to avoid ng check error, getTransform() should always return 'unset' before dropdownMenu appears + dropdownMenuAppeared: boolean = false; + getTransform(): string { + if ( + this.dropdownMenuAppeared && + this.dropdownMenu?.el && + this.dropdown + ) { + const width = this.dropdownMenu.el.nativeElement.offsetWidth; + const height = this.dropdownMenu.el.nativeElement.offsetHeight; + const bcr = this.dropdown.nativeElement.getBoundingClientRect(); + return `translateX(${bcr.x - width}px) translateY(${ + bcr.y - height / 2 + }px)`; + } + return 'unset'; + } + + ngOnChanges(changes: SimpleChanges) { + if (changes && changes['candidatePermissions']) { + this.initCandidates(); + } + } + ngDoCheck() { + this.dropdownMenuAppeared = !!this.dropdownMenu; + } + + initCandidates() { + this.candidateActions = []; + this.candidateResources = []; + this.candidatePermissions?.forEach(item => { + const resource = item?.resource ?? ''; + if (this.candidateResources.indexOf(resource) === -1) { + this.candidateResources.push(resource); + } + if (this.candidateActions.indexOf(item?.action) === -1) { + this.candidateActions.push(item?.action); + } + }); + this.candidateActions.sort(); + this.candidateResources.sort(); + } + + isCandidate(resource: string, action: string): boolean { + return isCandidate(this.candidatePermissions, { resource, action }); + } + + getCheckBoxValue(resource: string, action: string): boolean { + return hasPermission(this.permissionsModel, { resource, action }); + } + + setCheckBoxValue(resource: string, action: string, value: boolean) { + if (value) { + if (!this.permissionsModel) { + this.permissionsModel = []; + } + this.permissionsModel.push({ resource, action }); + } else { + this.permissionsModel = this.permissionsModel.filter(item => { + return item.resource !== resource || item.action !== action; + }); + } + this.permissionsModelChange.emit(this.permissionsModel); + } + + isAllSelected(): boolean { + let flag: boolean = true; + this.candidateActions.forEach(action => { + this.candidateResources.forEach(resource => { + if ( + this.isCandidate(resource, action) && + !hasPermission(this.permissionsModel, { resource, action }) + ) { + flag = false; + } + }); + }); + return flag; + } + + selectAllOrUnselectAll() { + if (this.isAllSelected()) { + this.permissionsModel = []; + } else { + this.permissionsModel = []; + this.candidateActions.forEach(action => { + this.candidateResources.forEach(resource => { + if (this.isCandidate(resource, action)) { + this.permissionsModel.push({ resource, action }); + } + }); + }); + } + this.permissionsModelChange.emit(this.permissionsModel); + } + + convertKey(key: string): string { + return convertKey(key); + } + protected readonly PermissionSelectPanelModes = PermissionSelectPanelModes; +} + +export enum PermissionSelectPanelModes { + DROPDOWN, + MODAL, + NORMAL, +} diff --git a/src/portal/src/app/shared/entities/shared.const.ts b/src/portal/src/app/shared/entities/shared.const.ts index 43c51ecd964..ea20b3e9e17 100644 --- a/src/portal/src/app/shared/entities/shared.const.ts +++ b/src/portal/src/app/shared/entities/shared.const.ts @@ -43,6 +43,7 @@ export const enum ConfirmationTargets { PROJECT_MEMBER, USER, ROBOT_ACCOUNT, + ROLE, POLICY, TOGGLE_CONFIRM, TARGET, @@ -55,6 +56,7 @@ export const enum ConfirmationTargets { SCANNER, REPLICATION, ROBOT_ACCOUNT_ENABLE_OR_DISABLE, + ROLE_ENABLE_OR_DISABLE, INSTANCE, P2P_PROVIDER, P2P_PROVIDER_STOP, diff --git a/src/portal/src/i18n/lang/de-de-lang.json b/src/portal/src/i18n/lang/de-de-lang.json index 46be1aa8d1c..b4054973d7b 100644 --- a/src/portal/src/i18n/lang/de-de-lang.json +++ b/src/portal/src/i18n/lang/de-de-lang.json @@ -284,6 +284,7 @@ "CONTENT_TRUST_POLICY": "Erlaube ausschließlich verifizierte Images." }, "MEMBER": { + "BUILT_IN": "Integriert", "NEW_MEMBER": "Neues Mitglied", "MEMBER": "Mitglied", "NAME": "Name", @@ -400,6 +401,87 @@ "GROUP": "User Group", "MEMBER": "Project Member" }, + "ROLE": { + "CREATE": "Erstellen", + "LIST": "Auflisten", + "READ": "Lesen", + "STOP": "Stop", + "CREATE_ROLE": "Rolle erstellen", + "CREATEROLE_SUMMARY": "Definieren Sie einen Namen und eine optionale Beschreibung für die neue Rolle. Die Berechtigungen wählen Sie im nächsten Schritt aus.", + "EDIT_ROLE": "Rolle bearbeiten", + "EDIT_ROLE_SUMMARY": "Aktualisieren Sie die Beschreibung oder die Berechtigungen dieser Rolle. Der Rollenname kann nicht geändert werden.", + "DELETE_ROLE_SUCCESS": "Rolle(n) erfolgreich gelöscht", + "ROLE": "Rolle", + "BUILTIN": "Integriert", + "MODIFIED": "Geändert", + "DESCRIPTION_PLACEHOLDER": "Geben Sie eine Beschreibung für diese Rolle ein", + "CREATED_BY": "Erstellt von", + "CREATED_AT": "Erstellt", + "MODIFIED_AT": "Zuletzt geändert", + "ROLE_NAMES": {"projectAdmin": "Project Admin", "developer": "Developer", "guest": "Guest", "master": "Maintainer", "limitedGuest": "Limited Guest"}, + "ROLE_NAV": "Benutzer Rollen", + "NAME": "Name", + "PERMISSIONS": "Berechtigungen", + "NEW_ROLE": "NEUE ROLLE", + "DESCRIPTION": "Beschreibung", + "ITEMS": "Einträge", + "OF": "von", + "DELETE": "Löschen", + "PUSH": "Push", + "PULL": "Pull", + "ACCOUNT_EXISTING": "Robot-Zugang existiert bereits.", + "CREATED_SUCCESS": "'{{param}}' erfolgreich erstellt.", + "DELETION_TITLE": "Entfernen von Rollen bestätigen", + "DELETION_SUMMARY": "Möchten Sie die Rolle(n) {{param}} löschen?", + "UPDATE": "Update", + "AUDIT_LOG": "Audit Log", + "PREHEAT_INSTANCE": "Preheat Instance", + "PROJECT": "Project", + "REPLICATION_POLICY": "Replication Policy", + "REPLICATION": "Replication", + "REPLICATION_ADAPTER": "Replication Adapter", + "REGISTRY": "Registry", + "SCAN_ALL": "Scan All", + "SYSTEM_VOLUMES": "System Volumes", + "GARBAGE_COLLECTION": "Garbage Collection", + "PURGE_AUDIT": "Purge Audit", + "JOBSERVICE_MONITOR": "Job Service Monitor", + "TAG_RETENTION": "Tag Retention", + "SCANNER": "Scanner", + "LABEL": "Label", + "EXPORT_CVE": "Export CVE", + "SECURITY_HUB": "Security Hub", + "CATALOG": "Catalog", + "METADATA": "Project Metadata", + "REPOSITORY": "Repository", + "ARTIFACT": "Artifact", + "SCAN": "Scan", + "SBOM": "SBOM", + "TAG": "Tag", + "ACCESSORY": "Accessory", + "ARTIFACT_ADDITION": "Artifact Addition", + "ARTIFACT_LABEL": "Artifact Label", + "PREHEAT_POLICY": "Preheat Policy", + "IMMUTABLE_TAG": "Immutable Tag", + "LOG": "Log", + "NOTIFICATION_POLICY": "Notification Policy", + "QUOTA": "Quota", + "BACK": "Back", + "NEXT": "Next", + "FINISH": "Finish", + "BASIC_INFO": "Basic Information", + "SELECT_PERMISSIONS": "Select Permissions", + "USER": "User", + "LDAPUSER": "LDAP User", + "GROUP": "User Group", + "MEMBER": "Project Member", + "ADD_ROLE": "Rolle hinzufügen", + "DELETE_ROLE": "Rolle löschen", + "UPDATE_ROLE": "Rolle aktualisieren", + "UPDATE_ROLE_SUCCESSFULLY": "Rolle erfolgreich aktualisiert", + "NAME_TOOLTIP": "Der Rollenname darf das Zeichen '+' nicht enthalten.", + "PUSH_PERMISSION_TOOLTIP": "Die Push-Berechtigung erfordert die Pull-Berechtigung. Bitte wählen Sie auch Pull aus." + }, "WEBHOOK": { "ENABLED_BUTTON": "AKTIVIEREN", "DISABLED_BUTTON": "DEAKTIVIEREN", diff --git a/src/portal/src/i18n/lang/en-us-lang.json b/src/portal/src/i18n/lang/en-us-lang.json index c00972dfb96..0f3ff098dbf 100644 --- a/src/portal/src/i18n/lang/en-us-lang.json +++ b/src/portal/src/i18n/lang/en-us-lang.json @@ -321,7 +321,8 @@ "REMOVE": "Remove", "GROUP_NAME_REQUIRED": "Group name is required", "NON_EXISTENT_GROUP": "Group name does not exists", - "GROUP_ALREADY_ADDED": "Group name has been already added to this project" + "GROUP_ALREADY_ADDED": "Group name has been already added to this project", + "BUILT_IN": "Built-in" }, "ROBOT_ACCOUNT": { "NAME": "Name", @@ -400,6 +401,88 @@ "GROUP": "User Group", "MEMBER": "Project Member" }, + "ROLE": { + "CREATE": "Create", + "LIST": "List", + "READ": "Read", + "STOP": "Stop", + "ROLE_NAV": "User Roles", + "NAME": "Name", + "PERMISSIONS": "Permissions", + "NEW_ROLE": "NEW ROLE", + "DESCRIPTION": "Description", + "ITEMS": "items", + "OF": "of", + "DELETE": "Delete", + "PUSH": "Push", + "PULL": "Pull", + "CREATE_ROLE": "Create Role", + "CREATEROLE_SUMMARY": "Define a name and optional description for the new role. You will select its permissions in the next step.", + "EDIT_ROLE": "Edit Role", + "EDIT_ROLE_SUMMARY": "Update the description or permissions of this role. The role name cannot be changed.", + "DELETE_ROLE_SUCCESS": "Deleted role(s) successfully", + "ACCOUNT_EXISTING": "Role already exists.", + "CREATED_SUCCESS": "Created '{{param}}' successfully.", + "DELETION_TITLE": "Confirm removal of roles", + "DELETION_SUMMARY": "Do you want to delete the role(s) {{param}}?", + "UPDATE": "Update", + "AUDIT_LOG": "Audit Log", + "PREHEAT_INSTANCE": "Preheat Instance", + "PROJECT": "Project", + "REPLICATION_POLICY": "Replication Policy", + "REPLICATION": "Replication", + "REPLICATION_ADAPTER": "Replication Adapter", + "REGISTRY": "Registry", + "SCAN_ALL": "Scan All", + "SYSTEM_VOLUMES": "System Volumes", + "GARBAGE_COLLECTION": "Garbage Collection", + "PURGE_AUDIT": "Purge Audit", + "JOBSERVICE_MONITOR": "Job Service Monitor", + "TAG_RETENTION": "Tag Retention", + "SCANNER": "Scanner", + "LABEL": "Label", + "EXPORT_CVE": "Export CVE", + "SECURITY_HUB": "Security Hub", + "CATALOG": "Catalog", + "METADATA": "Project Metadata", + "REPOSITORY": "Repository", + "ARTIFACT": "Artifact", + "SCAN": "Scan", + "SBOM": "SBOM", + "TAG": "Tag", + "ACCESSORY": "Accessory", + "ARTIFACT_ADDITION": "Artifact Addition", + "ARTIFACT_LABEL": "Artifact Label", + "PREHEAT_POLICY": "Preheat Policy", + "IMMUTABLE_TAG": "Immutable Tag", + "LOG": "Log", + "NOTIFICATION_POLICY": "Notification Policy", + "QUOTA": "Quota", + "BACK": "Back", + "NEXT": "Next", + "FINISH": "Finish", + "BASIC_INFO": "Basic Information", + "SELECT_PERMISSIONS": "Select Permissions", + "ROLE": "Role", + "USER": "User", + "LDAPUSER": "LDAP User", + "GROUP": "User Group", + "MEMBER": "Project Member", + "BUILTIN": "Built-in", + "MODIFIED": "Modified", + "DESCRIPTION_PLACEHOLDER": "Enter a description for this role", + "CREATED_BY": "Created By", + "CREATED_AT": "Created", + "MODIFIED_AT": "Last Modified", + "ROLE_NAMES": {"projectAdmin": "Project Admin", "developer": "Developer", "guest": "Guest", "master": "Maintainer", "limitedGuest": "Limited Guest"}, + "ADD_ROLE": "Add Role", + "DELETE_ROLE": "Delete Role", + "UPDATE_ROLE": "Update Role", + "UPDATE_ROLE_SUCCESSFULLY": "Update role successfully", + "NAME_TOOLTIP": "The role name cannot contain the '+' character.", + "PUSH_PERMISSION_TOOLTIP": "The push permission requires the pull permission. Please also select pull." + }, + "WEBHOOK": { "ENABLED_BUTTON": "ENABLE", "DISABLED_BUTTON": "DEACTIVATE", diff --git a/src/portal/src/i18n/lang/es-es-lang.json b/src/portal/src/i18n/lang/es-es-lang.json index d9a70df6f74..f7b0bdfcc54 100644 --- a/src/portal/src/i18n/lang/es-es-lang.json +++ b/src/portal/src/i18n/lang/es-es-lang.json @@ -285,6 +285,7 @@ "CONTENT_TRUST_POLICY": "Solo permita la implementación de imágenes verificadas." }, "MEMBER": { + "BUILT_IN": "Integrado", "NEW_MEMBER": "Nuevo miembro", "MEMBER": "Miembro", "NAME": "Nombre", @@ -401,6 +402,88 @@ "GROUP": "Usuario Grupo", "MEMBER": "Miembro Proyecto" }, + "ROLE": { + "CREATE": "Crear", + "LIST": "Lista", + "READ": "Leer", + "STOP": "Stop", + "CREATE_ROLE": "Crear rol", + "CREATEROLE_SUMMARY": "Defina un nombre y una descripción opcional para el nuevo rol. Seleccionará sus permisos en el siguiente paso.", + "EDIT_ROLE": "Editar rol", + "EDIT_ROLE_SUMMARY": "Actualice la descripción o los permisos de este rol. El nombre del rol no se puede cambiar.", + "DELETE_ROLE_SUCCESS": "Rol(es) eliminado(s) correctamente", + "BUILTIN": "Integrado", + "MODIFIED": "Modificado", + "DESCRIPTION_PLACEHOLDER": "Introduzca una descripción para este rol", + "CREATED_BY": "Creado por", + "CREATED_AT": "Creado", + "MODIFIED_AT": "Última modificación", + "ROLE_NAMES": {"projectAdmin": "Project Admin", "developer": "Developer", "guest": "Guest", "master": "Maintainer", "limitedGuest": "Limited Guest"}, + "ROLE_NAV": "Roles utilisador", + "NAME": "Nombre", + "PERMISSIONS": "Permisos", + "NEW_ROLE": "NUEVO ROL", + "DESCRIPTION": "Descripción", + "ITEMS": "items", + "OF": "de", + "DELETE": "Borrar", + "PUSH": "Push", + "PULL": "Pull", + "ACCOUNT_EXISTING": "La Cuenta Robot ya existe.", + "CREATED_SUCCESS": "Se creó '{{param}}' exitosamente.", + "DELETION_TITLE": "Confirmar eliminación de roles", + "DELETION_SUMMARY": "¿Desea eliminar el/los rol(es) {{param}}?", + "UPDATE": "Actualizar", + "AUDIT_LOG": " Log de Auditoría", + "PREHEAT_INSTANCE": "Instancia de Preheat", + "PROJECT": "Projecto", + "REPLICATION_POLICY": "Política de Replicación", + "REPLICATION": "Replicación", + "REPLICATION_ADAPTER": "Adaptador de Replicación", + "REGISTRY": "Registro", + "SCAN_ALL": "Escanear Todos", + "SYSTEM_VOLUMES": "Volúmenes de Sistema", + "GARBAGE_COLLECTION": "Garbage Collection", + "PURGE_AUDIT": "Purgar Auditoria", + "JOBSERVICE_MONITOR": "Job Service Monitor", + "TAG_RETENTION": "Tag de Retención", + "SCANNER": "Escaner", + "LABEL": "Etiqueta", + "EXPORT_CVE": "Exportar CVE", + "SECURITY_HUB": "Hub de Seguridad", + "CATALOG": "Catálogo", + "METADATA": "Metadata Proyecto", + "REPOSITORY": "Repositorio", + "ARTIFACT": "Artefacto", + "SCAN": "Escaner", + "SBOM": "SBOM", + "TAG": "Tag", + "ACCESSORY": "Accesorio", + "ARTIFACT_ADDITION": "Adición de Artefacto", + "ARTIFACT_LABEL": "Etiqueta de Artifacto", + "PREHEAT_POLICY": "Política de Preheat", + "IMMUTABLE_TAG": "Tag Inmutable", + "LOG": "Log", + "NOTIFICATION_POLICY": "Política de Notificación", + "QUOTA": "Cuota", + "BACK": "Regresar", + "NEXT": "Siguiente", + "FINISH": "Finalizar", + "BASIC_INFO": "Información Básica", + "SELECT_PERMISSIONS": "Seleccionar Permisos", + "ROLE": "Rol", + "USER": "Usuario", + "LDAPUSER": "Usuario LDAP", + "GROUP": "Usuario Grupo", + "MEMBER": "Miembro Proyecto", + "ADD_ROLE": "Añadir rol", + "DELETE_ROLE": "Eliminar rol", + "UPDATE_ROLE": "Actualizar rol", + "UPDATE_ROLE_SUCCESSFULLY": "Rol actualizado correctamente", + "NAME_TOOLTIP": "El nombre del rol no puede contener el carácter '+'.", + "PUSH_PERMISSION_TOOLTIP": "El permiso push requiere el permiso pull. Seleccione también pull." + }, + "WEBHOOK": { "ENABLED_BUTTON": "ACTIVAR", "DISABLED_BUTTON": "DESACTIVAR", diff --git a/src/portal/src/i18n/lang/fr-fr-lang.json b/src/portal/src/i18n/lang/fr-fr-lang.json index 0be997c9cef..ecb04d58ddb 100644 --- a/src/portal/src/i18n/lang/fr-fr-lang.json +++ b/src/portal/src/i18n/lang/fr-fr-lang.json @@ -285,6 +285,7 @@ "CONTENT_TRUST_POLICY": "Autoriser uniquement le déploiement d'images vérifiées." }, "MEMBER": { + "BUILT_IN": "Intégré", "NEW_MEMBER": "Nouveau membre", "MEMBER": "Membre", "NAME": "Nom", @@ -401,6 +402,87 @@ "GROUP": "Groupe d'utilisateurs", "MEMBER": "Membre de projet" }, + "ROLE": { + "CREATE": "Créer", + "LIST": "Lister", + "READ": "Lire", + "STOP": "Stop", + "CREATE_ROLE": "Créer un rôle", + "CREATEROLE_SUMMARY": "Définissez un nom et une description facultative pour le nouveau rôle. Vous sélectionnerez ses permissions à l'étape suivante.", + "EDIT_ROLE": "Modifier le rôle", + "EDIT_ROLE_SUMMARY": "Mettez à jour la description ou les permissions de ce rôle. Le nom du rôle ne peut pas être modifié.", + "DELETE_ROLE_SUCCESS": "Rôle(s) supprimé(s) avec succès", + "BUILTIN": "Intégré", + "MODIFIED": "Modifié", + "DESCRIPTION_PLACEHOLDER": "Saisissez une description pour ce rôle", + "CREATED_BY": "Créé par", + "CREATED_AT": "Créé", + "MODIFIED_AT": "Dernière modification", + "ROLE_NAMES": {"projectAdmin": "Project Admin", "developer": "Developer", "guest": "Guest", "master": "Maintainer", "limitedGuest": "Limited Guest"}, + "ROLE_NAV": "Rôle utilisateur", + "NAME": "Nom", + "PERMISSIONS": "Permissions", + "NEW_ROLE": "Nouvelle role", + "DESCRIPTION": "Description", + "ITEMS": "entrées", + "OF": "sur", + "DELETE": "Supprimer", + "PUSH": "Push", + "PULL": "Pull", + "ACCOUNT_EXISTING": "Le compte robot existe déjà.", + "CREATED_SUCCESS": "Création de '{{param}}' effectuée.", + "DELETION_TITLE": "Confirmer la suppression des rôles", + "DELETION_SUMMARY": "Voulez-vous supprimer le(s) rôle(s) {{param}} ?", + "UPDATE": "Mettre à jour", + "AUDIT_LOG": "Log d'audit", + "PREHEAT_INSTANCE": "Préchauffer l'instance", + "PROJECT": "Projet", + "REPLICATION_POLICY": "Politique de réplication", + "REPLICATION": "Réplication", + "REPLICATION_ADAPTER": "Adaptateur de réplication", + "REGISTRY": "Registre", + "SCAN_ALL": "Scanner tout", + "SYSTEM_VOLUMES": "Volumes système", + "GARBAGE_COLLECTION": "Purge", + "PURGE_AUDIT": "Purger l'audit", + "JOBSERVICE_MONITOR": "Job Service Monitor", + "TAG_RETENTION": "Rétention des tags", + "SCANNER": "Scanner", + "LABEL": "Label", + "EXPORT_CVE": "Exporter les CVE", + "SECURITY_HUB": "Centre de sécurité", + "CATALOG": "Catalogue", + "METADATA": "Métadonnées du projet", + "REPOSITORY": "Dépôt", + "ARTIFACT": "Artefact", + "SCAN": "Scan", + "SBOM": "SBOM", + "TAG": "Tag", + "ACCESSORY": "Accessoire", + "ARTIFACT_ADDITION": "Artefact Addition", + "ARTIFACT_LABEL": "Label d'artefact", + "PREHEAT_POLICY": "Politique de préchauffage", + "IMMUTABLE_TAG": "Tag immutable", + "LOG": "Log", + "NOTIFICATION_POLICY": "Politique de notification", + "QUOTA": "Quota", + "BACK": "Retour", + "NEXT": "Suivant", + "FINISH": "Finir", + "BASIC_INFO": "Informations de base", + "SELECT_PERMISSIONS": "Selectionner les permissions", + "ROLE": "Role", + "USER": "Utilisateur", + "LDAPUSER": "Utilisateur LDAP", + "GROUP": "Groupe d'utilisateurs", + "MEMBER": "Membre de projet", + "ADD_ROLE": "Ajouter un rôle", + "DELETE_ROLE": "Supprimer le rôle", + "UPDATE_ROLE": "Mettre à jour le rôle", + "UPDATE_ROLE_SUCCESSFULLY": "Rôle mis à jour avec succès", + "NAME_TOOLTIP": "Le nom du rôle ne peut pas contenir le caractère '+'.", + "PUSH_PERMISSION_TOOLTIP": "La permission push nécessite la permission pull. Veuillez également sélectionner pull." + }, "WEBHOOK": { "ENABLED_BUTTON": "Activer", "DISABLED_BUTTON": "Désactiver", diff --git a/src/portal/src/i18n/lang/ko-kr-lang.json b/src/portal/src/i18n/lang/ko-kr-lang.json index 77eacc7dcd5..f636a291a6b 100644 --- a/src/portal/src/i18n/lang/ko-kr-lang.json +++ b/src/portal/src/i18n/lang/ko-kr-lang.json @@ -1,4 +1,85 @@ { + "ROLE": { + "CREATE": "생성", + "LIST": "리스트", + "READ": "읽기", + "STOP": "중지", + "ROLE_NAV": "사용자 역할", + "NAME": "이름", + "PERMISSIONS": "권한", + "NEW_ROLE": "새 역할", + "DESCRIPTION": "설명", + "ITEMS": "아이템", + "OF": "of", + "DELETE": "삭제", + "PUSH": "푸시", + "PULL": "풀(Pull)", + "CREATE_ROLE": "역할 생성", + "CREATEROLE_SUMMARY": "새 역할의 이름과 선택적 설명을 정의하세요. 권한은 다음 단계에서 선택합니다.", + "EDIT_ROLE": "역할 편집", + "EDIT_ROLE_SUMMARY": "이 역할의 설명 또는 권한을 업데이트하세요. 역할 이름은 변경할 수 없습니다.", + "DELETE_ROLE_SUCCESS": "역할이 성공적으로 삭제되었습니다", + "ACCOUNT_EXISTING": "역할이 이미 존재합니다.", + "CREATED_SUCCESS": "'{{param}}'성공적으로 생성됐습니다.", + "DELETION_TITLE": "역할 삭제 확인", + "DELETION_SUMMARY": "역할 {{param}}을(를) 삭제하시겠습니까?", + "UPDATE": "업데이트", + "AUDIT_LOG": "감사 로그", + "PREHEAT_INSTANCE": "인스턴스 예열", + "PROJECT": "프로젝트", + "REPLICATION_POLICY": "복제 정책", + "REPLICATION": "복제", + "REPLICATION_ADAPTER": "복제 어댑터", + "REGISTRY": "레지스트리", + "SCAN_ALL": "모두 스캔", + "SYSTEM_VOLUMES": "시스템 볼륨", + "GARBAGE_COLLECTION": "가비지 컬렉션", + "PURGE_AUDIT": "퍼지 감사", + "JOBSERVICE_MONITOR": "작업 서비스 모니터링", + "TAG_RETENTION": "태그 유지", + "SCANNER": "스캐너", + "LABEL": "라벨", + "EXPORT_CVE": "CVE 내보내기", + "SECURITY_HUB": "보안 허브", + "CATALOG": "카탈로그", + "METADATA": "프로젝트 메타데이터", + "REPOSITORY": "저장소", + "ARTIFACT": "아티팩트", + "SCAN": "스캔", + "SBOM": "SBOM", + "TAG": "태그", + "ACCESSORY": "액세서리", + "ARTIFACT_ADDITION": "아티팩트 추가", + "ARTIFACT_LABEL": "아티팩트 라벨", + "PREHEAT_POLICY": "예열 정책", + "IMMUTABLE_TAG": "Immutable Tag", + "LOG": "로그", + "NOTIFICATION_POLICY": "알림 정책", + "QUOTA": "할당량", + "BACK": "뒤로", + "NEXT": "다음", + "FINISH": "마지막", + "BASIC_INFO": "기본 정보", + "SELECT_PERMISSIONS": "권한 선택", + "ROLE": "역할", + "USER": "사용자", + "LDAPUSER": "LDAP User", + "GROUP": "User Group", + "MEMBER": "Project Member", + "BUILTIN": "내장", + "MODIFIED": "수정됨", + "DESCRIPTION_PLACEHOLDER": "이 역할에 대한 설명을 입력하세요", + "CREATED_BY": "작성자", + "CREATED_AT": "생성 됨", + "MODIFIED_AT": "마지막 수정", + "ROLE_NAMES": {"projectAdmin": "Project Admin", "developer": "Developer", "guest": "Guest", "master": "Maintainer", "limitedGuest": "Limited Guest"}, + "ADD_ROLE": "역할 추가", + "DELETE_ROLE": "역할 삭제", + "UPDATE_ROLE": "역할 업데이트", + "UPDATE_ROLE_SUCCESSFULLY": "역할이 성공적으로 업데이트되었습니다", + "NAME_TOOLTIP": "역할 이름에는 '+' 문자를 사용할 수 없습니다.", + "PUSH_PERMISSION_TOOLTIP": "push 권한에는 pull 권한이 필요합니다. pull도 함께 선택하세요." + }, "APP_TITLE": { "VMW_HARBOR": "Harbor", "HARBOR": "Harbor", @@ -284,6 +365,7 @@ "SBOM": "SBOM 생성" }, "MEMBER": { + "BUILT_IN": "내장", "NEW_MEMBER": "새 구성원", "MEMBER": "구성원", "NAME": "이름", @@ -400,6 +482,83 @@ "GROUP": "User Group", "MEMBER": "Project Member" }, + "ROBOT_ACCOUNT": { + "NAME": "이름", + "PERMISSIONS": "권한", + "TOKEN": "시크릿", + "NEW_ROLE": "새 로봇 계정", + "ENABLED_STATE": "활성화된 상태", + "NUMBER_REQUIRED": "필드는 필수이며 0이 아닌 정수여야 합니다.", + "DESCRIPTION": "설명", + "CREATION": "생성 시간", + "TOKEN_EXPIRATION": "로봇 토큰 만료(일)", + "ACTION": "동작", + "EDIT": "편집", + "ITEMS": "아이템", + "OF": "of", + "DELETE": "삭제", + "PUSH": "푸시", + "PULL": "풀(Pull)", + "FILTER_PLACEHOLDER": "로봇 계정 필터", + "ACCOUNT_EXISTING": "로봇 계정이 이미 존재합니다.", + "ALERT_TEXT": "이 시크릿을 복사할 수 있는 유일한 기회입니다.다음 기회는 없습니다.", + "CREATED_SUCCESS": "'{{param}}'성공적으로 생성됐습니다.", + "COPY_SUCCESS": "'{{param}}'의 시크릿을 성공적으로 복사했습니다", + "DELETION_TITLE": "로봇 계정 제거 확인", + "DELETION_SUMMARY": "로봇 계정{{param}}을 정말 삭제하시겠습니까?", + "EXPORT_TO_FILE": "파일로 내보내기", + "EXPIRES_AT": "~에 만료", + "INVALID_VALUE": "만료 시간 값이 잘못되었습니다", + "NEVER_EXPIRED": "만료되지 않음", + "NAME_PREFIX": "로봇 이름 접두어", + "NAME_PREFIX_REQUIRED": "로봇 이름 접두어는 필수항목입니다", + "UPDATE": "업데이트", + "AUDIT_LOG": "감사 로그", + "PREHEAT_INSTANCE": "인스턴스 예열", + "PROJECT": "프로젝트", + "REPLICATION_POLICY": "복제 정책", + "REPLICATION": "복제", + "REPLICATION_ADAPTER": "복제 어댑터", + "REGISTRY": "레지스트리", + "SCAN_ALL": "모두 스캔", + "SYSTEM_VOLUMES": "시스템 볼륨", + "GARBAGE_COLLECTION": "가비지 컬렉션", + "PURGE_AUDIT": "퍼지 감사", + "JOBSERVICE_MONITOR": "작업 서비스 모니터링", + "TAG_RETENTION": "태그 유지", + "SCANNER": "스캐너", + "LABEL": "라벨", + "EXPORT_CVE": "CVE 내보내기", + "SECURITY_HUB": "보안 허브", + "CATALOG": "카탈로그", + "METADATA": "프로젝트 메타데이터", + "REPOSITORY": "저장소", + "ARTIFACT": "아티팩트", + "SCAN": "스캔", + "SBOM": "SBOM", + "TAG": "태그", + "ACCESSORY": "액세서리", + "ARTIFACT_ADDITION": "아티팩트 추가", + "ARTIFACT_LABEL": "아티팩트 라벨", + "PREHEAT_POLICY": "예열 정책", + "IMMUTABLE_TAG": "Immutable Tag", + "LOG": "로그", + "NOTIFICATION_POLICY": "알림 정책", + "QUOTA": "할당량", + "BACK": "뒤로", + "NEXT": "다음", + "FINISH": "마지막", + "BASIC_INFO": "기본 정보", + "SELECT_PERMISSIONS": "권한 선택", + "SELECT_SYSTEM_PERMISSIONS": "시스템 권한 선택", + "SELECT_PROJECT_PERMISSIONS": "프로젝트 권한 선택", + "SYSTEM_PERMISSIONS": "시스템 권한", + "ROLE": "Role", + "USER": "User", + "LDAPUSER": "LDAP User", + "GROUP": "User Group", + "MEMBER": "Project Member" + }, "WEBHOOK": { "ENABLED_BUTTON": "활성", "DISABLED_BUTTON": "비활성", diff --git a/src/portal/src/i18n/lang/pt-br-lang.json b/src/portal/src/i18n/lang/pt-br-lang.json index 53e0390faf3..c34ab8b481a 100644 --- a/src/portal/src/i18n/lang/pt-br-lang.json +++ b/src/portal/src/i18n/lang/pt-br-lang.json @@ -284,6 +284,7 @@ "CONTENT_TRUST_POLICY": "Permitir implantação apenas de imagens verificadas." }, "MEMBER": { + "BUILT_IN": "Integrado", "NEW_MEMBER": "Novo membro", "MEMBER": "Membro", "NAME": "Nome", @@ -400,6 +401,87 @@ "GROUP": "User Group", "MEMBER": "Project Member" }, + "ROLE": { + "CREATE": "Criar", + "LIST": "Listar", + "READ": "Ler", + "STOP": "Parar", + "CREATE_ROLE": "Criar função", + "CREATEROLE_SUMMARY": "Defina um nome e uma descrição opcional para a nova função. Você selecionará suas permissões na próxima etapa.", + "EDIT_ROLE": "Editar função", + "EDIT_ROLE_SUMMARY": "Atualize a descrição ou as permissões desta função. O nome da função não pode ser alterado.", + "DELETE_ROLE_SUCCESS": "Função(ões) excluída(s) com sucesso", + "BUILTIN": "Integrado", + "MODIFIED": "Modificado", + "DESCRIPTION_PLACEHOLDER": "Insira uma descrição para esta função", + "CREATED_BY": "Criado por", + "CREATED_AT": "Criado", + "MODIFIED_AT": "Última modificação", + "ROLE_NAMES": {"projectAdmin": "Project Admin", "developer": "Developer", "guest": "Guest", "master": "Maintainer", "limitedGuest": "Limited Guest"}, + "ROLE_NAV": "Funções do Usuário", + "NAME": "Nome", + "PERMISSIONS": "Permissões", + "NEW_ROLE": "Nova conta de automação", + "DESCRIPTION": "Descrição", + "ITEMS": "itens", + "OF": "de", + "DELETE": "Remover", + "PUSH": "Push", + "PULL": "Pull", + "ACCOUNT_EXISTING": "Conta de automação já existe.", + "CREATED_SUCCESS": "'{{param}}' criado com sucesso.", + "DELETION_TITLE": "Confirmar remoção de funções", + "DELETION_SUMMARY": "Deseja excluir a(s) função(ões) {{param}}?", + "UPDATE": "Update", + "AUDIT_LOG": "Audit Log", + "PREHEAT_INSTANCE": "Preheat Instance", + "PROJECT": "Project", + "REPLICATION_POLICY": "Replication Policy", + "REPLICATION": "Replication", + "REPLICATION_ADAPTER": "Replication Adapter", + "REGISTRY": "Registry", + "SCAN_ALL": "Scan All", + "SYSTEM_VOLUMES": "System Volumes", + "GARBAGE_COLLECTION": "Garbage Collection", + "PURGE_AUDIT": "Purge Audit", + "JOBSERVICE_MONITOR": "Job Service Monitor", + "TAG_RETENTION": "Tag Retention", + "SCANNER": "Scanner", + "LABEL": "Label", + "EXPORT_CVE": "Export CVE", + "SECURITY_HUB": "Security Hub", + "CATALOG": "Catalog", + "METADATA": "Project Metadata", + "REPOSITORY": "Repository", + "ARTIFACT": "Artifact", + "SCAN": "Scan", + "SBOM": "SBOM", + "TAG": "Tag", + "ACCESSORY": "Accessory", + "ARTIFACT_ADDITION": "Artifact Addition", + "ARTIFACT_LABEL": "Artifact Label", + "PREHEAT_POLICY": "Preheat Policy", + "IMMUTABLE_TAG": "Immutable Tag", + "LOG": "Log", + "NOTIFICATION_POLICY": "Notification Policy", + "QUOTA": "Quota", + "BACK": "Back", + "NEXT": "Next", + "FINISH": "Finish", + "BASIC_INFO": "Basic Information", + "SELECT_PERMISSIONS": "Select Permissions", + "ROLE": "ROLE", + "USER": "User", + "LDAPUSER": "LDAP User", + "GROUP": "User Group", + "MEMBER": "Project Member", + "ADD_ROLE": "Adicionar função", + "DELETE_ROLE": "Excluir função", + "UPDATE_ROLE": "Atualizar função", + "UPDATE_ROLE_SUCCESSFULLY": "Função atualizada com sucesso", + "NAME_TOOLTIP": "O nome da função não pode conter o caractere '+'.", + "PUSH_PERMISSION_TOOLTIP": "A permissão push requer a permissão pull. Selecione também pull." + }, "GROUP": { "GROUP": "Grupo", "IMPORT_LDAP_GROUP": "Importar grupo do LDAP", diff --git a/src/portal/src/i18n/lang/ru-ru-lang.json b/src/portal/src/i18n/lang/ru-ru-lang.json index d79bbb887c7..fcf7a3025ab 100644 --- a/src/portal/src/i18n/lang/ru-ru-lang.json +++ b/src/portal/src/i18n/lang/ru-ru-lang.json @@ -1,4 +1,85 @@ { + "ROLE": { + "CREATE": "Создать", + "LIST": "Лист", + "READ": "Чтение", + "STOP": "Стоп", + "ROLE_NAV": "Роли пользователей", + "NAME": "Логин", + "PERMISSIONS": "Разрешения", + "NEW_ROLE": "НОВАЯ РОЛЬ", + "DESCRIPTION": "Описание", + "ITEMS": "элементов", + "OF": "из", + "DELETE": "Удалить", + "PUSH": "Отправить", + "PULL": "Извлечь", + "CREATE_ROLE": "Создать роль", + "CREATEROLE_SUMMARY": "Задайте имя и необязательное описание для новой роли. Разрешения вы выберете на следующем шаге.", + "EDIT_ROLE": "Редактировать роль", + "EDIT_ROLE_SUMMARY": "Обновите описание или разрешения этой роли. Имя роли изменить нельзя.", + "DELETE_ROLE_SUCCESS": "Роль(и) успешно удалена(ы)", + "ACCOUNT_EXISTING": "Роль уже существует.", + "CREATED_SUCCESS": "Успешно создан '{{param}}'.", + "DELETION_TITLE": "Подтвердите удаление ролей", + "DELETION_SUMMARY": "Вы действительно хотите удалить роль(и) {{param}}?", + "UPDATE": "Обновить", + "AUDIT_LOG": "Журнал аудита", + "PREHEAT_INSTANCE": "Разогрев Экземпляра", + "PROJECT": "Проект", + "REPLICATION_POLICY": "Политика репликации", + "REPLICATION": "Репликация", + "REPLICATION_ADAPTER": "Адаптер репликации", + "REGISTRY": "Реестр", + "SCAN_ALL": "Сканировать все", + "SYSTEM_VOLUMES": "Системные тома", + "GARBAGE_COLLECTION": "Сборка мусора", + "PURGE_AUDIT": "Очистка Аудита", + "JOBSERVICE_MONITOR": "Мониторинг заданий", + "TAG_RETENTION": "Сохранение тегов", + "SCANNER": "Сканер", + "LABEL": "Метка", + "EXPORT_CVE": "Экспорт CVE", + "SECURITY_HUB": "Центр безопасности", + "CATALOG": "Каталог", + "METADATA": "Метаданные проекта", + "REPOSITORY": "Репозиторий", + "ARTIFACT": "Артефакт", + "SCAN": "Сканировать", + "SBOM": "SBOM", + "TAG": "Тэг", + "ACCESSORY": "Дополнение", + "ARTIFACT_ADDITION": "Дополнения артефакта", + "ARTIFACT_LABEL": "Метки артефакта", + "PREHEAT_POLICY": "Политика Разогрева", + "IMMUTABLE_TAG": "Неизменяемые теги", + "LOG": "Лог", + "NOTIFICATION_POLICY": "Политика уведомлений", + "QUOTA": "Квота", + "BACK": "Назад", + "NEXT": "Вперед", + "FINISH": "Готово", + "BASIC_INFO": "Основная информация", + "SELECT_PERMISSIONS": "Выберите разрешения", + "ROLE": "Роль", + "USER": "Пользователь", + "LDAPUSER": "LDAP Пользователь", + "GROUP": "Группа пользователей", + "MEMBER": "Участник проекта", + "BUILTIN": "Встроенная", + "MODIFIED": "Изменено", + "DESCRIPTION_PLACEHOLDER": "Введите описание для этой роли", + "CREATED_BY": "Кем создано", + "CREATED_AT": "Создан", + "MODIFIED_AT": "Последнее изменение", + "ROLE_NAMES": {"projectAdmin": "Project Admin", "developer": "Developer", "guest": "Guest", "master": "Maintainer", "limitedGuest": "Limited Guest"}, + "ADD_ROLE": "Добавить роль", + "DELETE_ROLE": "Удалить роль", + "UPDATE_ROLE": "Обновить роль", + "UPDATE_ROLE_SUCCESSFULLY": "Роль успешно обновлена", + "NAME_TOOLTIP": "Имя роли не может содержать символ '+'.", + "PUSH_PERMISSION_TOOLTIP": "Разрешение push требует разрешения pull. Пожалуйста, также выберите pull." + }, "APP_TITLE": { "VMW_HARBOR": "Harbor", "HARBOR": "Harbor", @@ -547,6 +628,46 @@ "NAME_PREFIX": "Префикс имени робота", "NAME_PREFIX_REQUIRED": "Префикс имени робота обязателен" }, + "ROBOT_ACCOUNT": { + "NAME": "Имя", + "PERMISSIONS": "Разрешения", + "TOKEN": "Секрет", + "NEW_ROLE": "НОВЫЙ АККАУНТ РОБОТА", + "ENABLED_STATE": "Состояние включения", + "NUMBER_REQUIRED": "Поле обязательно и должно быть целым числом, отличным от 0.", + "DESCRIPTION": "Описание", + "CREATETION": "Время создания", + "EXPIRATION": "Срок действия", + "TOKEN_EXPIRATION": "Срок действия токена робота (Дни)", + "ACTION": "Действие", + "EDIT": "Редактировать", + "ITEMS": "элементы", + "OF": "из", + "DISABLE_ACCOUNT": "Деактивировать аккаунт", + "ENABLE_ACCOUNT": "Включить аккаунт", + "DELETE": "Удалить", + "CREAT_ROLE": "Создать аккаунт робота", + "PERMISSIONS_ARTIFACT": "Артефакт", + "PERMISSIONS_HELMCHART": "Диаграмма Helm (Chart Museum)", + "PUSH": "Отправить", + "PULL": "Загрузить", + "FILTER_PLACEHOLDER": "Фильтровать аккаунты роботов", + "ROLE_NAME": "Не может содержать специальные символы(~#$%) и максимальная длина должна быть 255 символов.", + "ACCOUNT_EXISTING": "Аккаунт робота уже существует.", + "ALERT_TEXT": "Это единственный раз, когда вы можете скопировать этот секрет. У вас не будет другого шанса", + "CREATED_SUCCESS": "Успешно создан '{{param}}'.", + "COPY_SUCCESS": "Секрет успешно скопирован для '{{param}}'", + "DELETION_TITLE": "Подтвердите удаление аккаунтов роботов", + "DELETION_SUMMARY": "Вы хотите удалить аккаунты роботов {{param}}?", + "PULL_IS_MUST": "Разрешение на загрузку проверяется по умолчанию и не может быть изменено.", + "EXPORT_TO_FILE": "экспортировать в файл", + "EXPIRES_AT": "Истекает", + "EXPIRATION_TOOLTIP": "Если не установлено, будет использоваться время истечения системной конфигурации", + "INVALID_VALUE": "Значение срока действия недействительно", + "NEVER_EXPIRED": "Никогда не истекает", + "NAME_PREFIX": "Префикс имени робота", + "NAME_PREFIX_REQUIRED": "Префикс имени робота обязателен" + }, "WEBHOOK": { "EDIT_BUTTON": "РЕДАКТИРОВАТЬ", "ENABLED_BUTTON": "ВКЛЮЧИТЬ", @@ -1523,6 +1644,7 @@ "CONTENT_TRUST_POLICY": "Разрешать развертывание только проверенных образов." }, "MEMBER": { + "BUILT_IN": "Встроенная", "NEW_MEMBER": "Новый участник", "MEMBER": "Участник", "NAME": "Имя", diff --git a/src/portal/src/i18n/lang/tr-tr-lang.json b/src/portal/src/i18n/lang/tr-tr-lang.json index faabc8af622..3044e90a8ce 100644 --- a/src/portal/src/i18n/lang/tr-tr-lang.json +++ b/src/portal/src/i18n/lang/tr-tr-lang.json @@ -285,6 +285,7 @@ "CONTENT_TRUST_POLICY": "Yalnızca doğrulanmış imajların yüklenilmesine izin verin." }, "MEMBER": { + "BUILT_IN": "Yerleşik", "NEW_MEMBER": "Yeni Üye", "MEMBER": "Üye", "NAME": "İsim", @@ -401,6 +402,87 @@ "GROUP": "User Group", "MEMBER": "Project Member" }, + "ROLE": { + "CREATE": "Oluştur", + "LIST": "List", + "READ": "Read", + "STOP": "Dur", + "CREATE_ROLE": "Rol Oluştur", + "CREATEROLE_SUMMARY": "Yeni rol için bir ad ve isteğe bağlı bir açıklama tanımlayın. İzinlerini bir sonraki adımda seçeceksiniz.", + "EDIT_ROLE": "Rolü Düzenle", + "EDIT_ROLE_SUMMARY": "Bu rolün açıklamasını veya izinlerini güncelleyin. Rol adı değiştirilemez.", + "DELETE_ROLE_SUCCESS": "Rol(ler) başarıyla silindi", + "BUILTIN": "Yerleşik", + "MODIFIED": "Değiştirildi", + "DESCRIPTION_PLACEHOLDER": "Bu rol için bir açıklama girin", + "CREATED_BY": "Oluşturan", + "CREATED_AT": "Yaratıldı", + "MODIFIED_AT": "Son Değiştirilme", + "ROLE_NAMES": {"projectAdmin": "Project Admin", "developer": "Developer", "guest": "Guest", "master": "Maintainer", "limitedGuest": "Limited Guest"}, + "ROLE_NAV": "Kullanıcı Rolleri", + "NAME": "İsim", + "PERMISSIONS": "İzinler", + "NEW_ROLE": "YENİ ROBOT HESABI", + "DESCRIPTION": "Açıklama", + "ITEMS": "parça", + "OF": "of", + "DELETE": "Sil", + "PUSH": "Yükle", + "PULL": "Çek", + "ACCOUNT_EXISTING": "Robot Hesabı zaten var.", + "CREATED_SUCCESS": "Başarıyla '{{param}}' oluşturuldu.", + "DELETION_TITLE": "Rollerin kaldırılmasını onayla", + "DELETION_SUMMARY": "{{param}} rol(ler)ini silmek istiyor musunuz?", + "UPDATE": "Update", + "AUDIT_LOG": "Audit Log", + "PREHEAT_INSTANCE": "Preheat Instance", + "PROJECT": "Project", + "REPLICATION_POLICY": "Replication Policy", + "REPLICATION": "Replication", + "REPLICATION_ADAPTER": "Replication Adapter", + "REGISTRY": "Registry", + "SCAN_ALL": "Scan All", + "SYSTEM_VOLUMES": "System Volumes", + "GARBAGE_COLLECTION": "Garbage Collection", + "PURGE_AUDIT": "Purge Audit", + "JOBSERVICE_MONITOR": "Job Service Monitor", + "TAG_RETENTION": "Tag Retention", + "SCANNER": "Scanner", + "LABEL": "Label", + "EXPORT_CVE": "Export CVE", + "SECURITY_HUB": "Security Hub", + "CATALOG": "Catalog", + "METADATA": "Project Metadata", + "REPOSITORY": "Repository", + "ARTIFACT": "Artifact", + "SCAN": "Scan", + "SBOM": "SBOM", + "TAG": "Tag", + "ACCESSORY": "Accessory", + "ARTIFACT_ADDITION": "Artifact Addition", + "ARTIFACT_LABEL": "Artifact Label", + "PREHEAT_POLICY": "Preheat Policy", + "IMMUTABLE_TAG": "Immutable Tag", + "LOG": "Log", + "NOTIFICATION_POLICY": "Notification Policy", + "QUOTA": "Quota", + "BACK": "Back", + "NEXT": "Next", + "FINISH": "Finish", + "BASIC_INFO": "Basic Information", + "SELECT_PERMISSIONS": "Select Permissions", + "ROLE": "Robot Account", + "USER": "User", + "LDAPUSER": "LDAP User", + "GROUP": "User Group", + "MEMBER": "Project Member", + "ADD_ROLE": "Rol Ekle", + "DELETE_ROLE": "Rolü Sil", + "UPDATE_ROLE": "Rolü Güncelle", + "UPDATE_ROLE_SUCCESSFULLY": "Rol başarıyla güncellendi", + "NAME_TOOLTIP": "Rol adı '+' karakterini içeremez.", + "PUSH_PERMISSION_TOOLTIP": "Push izni pull iznini gerektirir. Lütfen pull iznini de seçin." + }, "WEBHOOK": { "ENABLED_BUTTON": "AKTİF ET", "DISABLED_BUTTON": "DEVRE DIŞI BIRAK", diff --git a/src/portal/src/i18n/lang/zh-cn-lang.json b/src/portal/src/i18n/lang/zh-cn-lang.json index b4ea326545a..896b23f8ade 100644 --- a/src/portal/src/i18n/lang/zh-cn-lang.json +++ b/src/portal/src/i18n/lang/zh-cn-lang.json @@ -284,6 +284,7 @@ "CONTENT_TRUST_POLICY": "仅允许部署经过验证的镜像。" }, "MEMBER": { + "BUILT_IN": "内置", "NEW_MEMBER": "新建成员", "MEMBER": "成员", "NAME": "名称", @@ -400,6 +401,87 @@ "GROUP": "用户组", "MEMBER": "项目成员" }, + "ROLE": { + "CREATE": "Create", + "LIST": "查询", + "READ": "读取", + "STOP": "停止任务", + "CREATE_ROLE": "创建角色", + "CREATEROLE_SUMMARY": "为新角色定义名称和可选描述。您将在下一步选择其权限。", + "EDIT_ROLE": "编辑角色", + "EDIT_ROLE_SUMMARY": "更新此角色的描述或权限。角色名称无法更改。", + "DELETE_ROLE_SUCCESS": "成功删除角色", + "QUOTA": "配额", + "BUILTIN": "内置", + "MODIFIED": "已修改", + "DESCRIPTION_PLACEHOLDER": "输入此角色的描述", + "CREATED_BY": "创建者", + "CREATED_AT": "创建时间", + "MODIFIED_AT": "最后修改", + "ROLE_NAMES": {"projectAdmin": "Project Admin", "developer": "Developer", "guest": "Guest", "master": "Maintainer", "limitedGuest": "Limited Guest"}, + "ROLE_NAV": "用户角色", + "NAME": "名称", + "PERMISSIONS": "权限", + "NEW_ROLE": "添加机器人账户", + "DESCRIPTION": "描述", + "OF": "共计", + "ITEMS": "条记录", + "DELETE": "删除", + "PUSH": "推送", + "PULL": "拉取", + "ACCOUNT_EXISTING": "机器人账户已经存在。", + "CREATED_SUCCESS": "创建账户 '{{param}}' 成功。", + "DELETION_TITLE": "确认删除角色", + "DELETION_SUMMARY": "您要删除角色 {{param}} 吗？", + "UPDATE": "更新", + "AUDIT_LOG": "审核日志", + "PREHEAT_INSTANCE": "预热实例", + "PROJECT": "项目", + "REPLICATION_POLICY": "镜像复制策略", + "REPLICATION": "镜像复制", + "REPLICATION_ADAPTER": "镜像复制适配器", + "REGISTRY": "镜像库", + "SCAN_ALL": "扫描全部", + "SYSTEM_VOLUMES": "系统卷", + "GARBAGE_COLLECTION": "垃圾回收", + "PURGE_AUDIT": "日志清除", + "JOBSERVICE_MONITOR": "任务监视器", + "TAG_RETENTION": "Tag 保留", + "SCANNER": "扫描器", + "LABEL": "标签", + "EXPORT_CVE": "导出 CVE", + "SECURITY_HUB": "安全中心", + "CATALOG": "镜像目录", + "METADATA": "项目元数据", + "REPOSITORY": "仓库", + "ARTIFACT": "Artifact", + "SCAN": "扫描", + "SBOM": "软件物料清单", + "TAG": "Tag", + "ACCESSORY": "附件", + "ARTIFACT_ADDITION": "Artifact 额外信息", + "ARTIFACT_LABEL": "Artifact 标签", + "PREHEAT_POLICY": "预热策略", + "IMMUTABLE_TAG": "不可变 Tag", + "LOG": "日志", + "NOTIFICATION_POLICY": "Webhook 策略", + "BACK": "上一步", + "NEXT": "下一步", + "FINISH": "完成", + "BASIC_INFO": "基本信息", + "SELECT_PERMISSIONS": "选择权限", + "ROLE": "机器人账户", + "USER": "用户", + "LDAPUSER": "LDAP 用户", + "GROUP": "用户组", + "MEMBER": "项目成员", + "ADD_ROLE": "添加角色", + "DELETE_ROLE": "删除角色", + "UPDATE_ROLE": "更新角色", + "UPDATE_ROLE_SUCCESSFULLY": "成功更新角色", + "NAME_TOOLTIP": "角色名称不能包含 '+' 字符。", + "PUSH_PERMISSION_TOOLTIP": "推送权限需要拉取权限。请同时选择拉取。" + }, "WEBHOOK": { "ENABLED_BUTTON": "启用", "DISABLED_BUTTON": "停用", diff --git a/src/portal/src/i18n/lang/zh-tw-lang.json b/src/portal/src/i18n/lang/zh-tw-lang.json index 1fc90f05a11..bee77e17133 100644 --- a/src/portal/src/i18n/lang/zh-tw-lang.json +++ b/src/portal/src/i18n/lang/zh-tw-lang.json @@ -284,6 +284,7 @@ "CONTENT_TRUST_POLICY": "只允許部署已驗證的映像檔。" }, "MEMBER": { + "BUILT_IN": "內建", "NEW_MEMBER": "新增成員", "MEMBER": "成員", "NAME": "名稱", @@ -400,6 +401,87 @@ "GROUP": "使用者群組", "MEMBER": "專案成員" }, + "ROLE": { + "CREATE": "建立", + "LIST": "清單", + "READ": "讀取", + "STOP": "停止", + "CREATE_ROLE": "建立角色", + "CREATEROLE_SUMMARY": "為新角色定義名稱和選填描述。您將在下一步選擇其權限。", + "EDIT_ROLE": "編輯角色", + "EDIT_ROLE_SUMMARY": "更新此角色的描述或權限。角色名稱無法變更。", + "DELETE_ROLE_SUCCESS": "成功刪除角色", + "BUILTIN": "內建", + "MODIFIED": "已修改", + "DESCRIPTION_PLACEHOLDER": "輸入此角色的描述", + "CREATED_BY": "建立者", + "CREATED_AT": "建立時間", + "MODIFIED_AT": "最後修改", + "ROLE_NAMES": {"projectAdmin": "Project Admin", "developer": "Developer", "guest": "Guest", "master": "Maintainer", "limitedGuest": "Limited Guest"}, + "ROLE_NAV": "使用者角色", + "NAME": "名稱", + "PERMISSIONS": "權限", + "NEW_ROLE": "新增機器人帳號", + "DESCRIPTION": "描述", + "ITEMS": "筆", + "OF": "共計", + "DELETE": "刪除", + "PUSH": "推送", + "PULL": "拉取", + "ACCOUNT_EXISTING": "機器人帳號已存在。", + "CREATED_SUCCESS": "已成功建立 '{{param}}'。", + "DELETION_TITLE": "確認刪除角色", + "DELETION_SUMMARY": "您要刪除角色 {{param}} 嗎？", + "UPDATE": "Update", + "AUDIT_LOG": "Audit Log", + "PREHEAT_INSTANCE": "Preheat Instance", + "PROJECT": "Project", + "REPLICATION_POLICY": "Replication Policy", + "REPLICATION": "Replication", + "REPLICATION_ADAPTER": "Replication Adapter", + "REGISTRY": "Registry", + "SCAN_ALL": "全部掃描", + "SYSTEM_VOLUMES": "系統磁碟區", + "GARBAGE_COLLECTION": "垃圾回收", + "PURGE_AUDIT": "清除稽核記錄", + "JOBSERVICE_MONITOR": "工作服務監控器", + "TAG_RETENTION": "標籤保留", + "SCANNER": "掃描器", + "LABEL": "標籤", + "EXPORT_CVE": "匯出 CVE", + "SECURITY_HUB": "安全中樞", + "CATALOG": "目錄", + "METADATA": "專案中繼資料", + "REPOSITORY": "儲存庫", + "ARTIFACT": "Artifact", + "SCAN": "掃描", + "SBOM": "SBOM", + "TAG": "標籤", + "ACCESSORY": "附件", + "ARTIFACT_ADDITION": "Artifact 附加項目", + "ARTIFACT_LABEL": "Artifact 標籤", + "PREHEAT_POLICY": "預熱原則", + "IMMUTABLE_TAG": "不可變標籤", + "LOG": "日誌", + "NOTIFICATION_POLICY": "通知原則", + "QUOTA": "配額", + "BACK": "上一步", + "NEXT": "下一步", + "FINISH": "完成", + "BASIC_INFO": "基本資訊", + "SELECT_PERMISSIONS": "選取權限", + "ROLE": "機器人帳號", + "USER": "使用者", + "LDAPUSER": "LDAP 使用者", + "GROUP": "使用者群組", + "MEMBER": "專案成員", + "ADD_ROLE": "新增角色", + "DELETE_ROLE": "刪除角色", + "UPDATE_ROLE": "更新角色", + "UPDATE_ROLE_SUCCESSFULLY": "成功更新角色", + "NAME_TOOLTIP": "角色名稱不能包含 '+' 字元。", + "PUSH_PERMISSION_TOOLTIP": "推送權限需要拉取權限。請同時選擇拉取。" + }, "WEBHOOK": { "ENABLED_BUTTON": "啟用", "DISABLED_BUTTON": "停用", diff --git a/src/server/v2.0/handler/handler.go b/src/server/v2.0/handler/handler.go index 10a22bb6c52..7bd567f982e 100644 --- a/src/server/v2.0/handler/handler.go +++ b/src/server/v2.0/handler/handler.go @@ -44,6 +44,7 @@ func New() http.Handler { PreheatAPI: newPreheatAPI(), IconAPI: newIconAPI(), RobotAPI: newRobotAPI(), + RoleAPI: newRoleAPI(), ReplicationAPI: newReplicationAPI(), RegistryAPI: newRegistryAPI(), SysteminfoAPI: newSystemInfoAPI(), diff --git a/src/server/v2.0/handler/member.go b/src/server/v2.0/handler/member.go index 2243cca82f6..7f39425dcdf 100644 --- a/src/server/v2.0/handler/member.go +++ b/src/server/v2.0/handler/member.go @@ -23,6 +23,7 @@ import ( "github.com/goharbor/harbor/src/common/rbac" "github.com/goharbor/harbor/src/controller/member" + roleCtl "github.com/goharbor/harbor/src/controller/role" "github.com/goharbor/harbor/src/lib" "github.com/goharbor/harbor/src/lib/errors" memberModels "github.com/goharbor/harbor/src/pkg/member/models" @@ -32,11 +33,15 @@ import ( type memberAPI struct { BaseAPI - ctl member.Controller + ctl member.Controller + roleCtl roleCtl.Controller } func newMemberAPI() *memberAPI { - return &memberAPI{ctl: member.NewController()} + return &memberAPI{ + ctl: member.NewController(), + roleCtl: roleCtl.Ctl, + } } func (m *memberAPI) CreateProjectMember(ctx context.Context, params operation.CreateProjectMemberParams) middleware.Responder { @@ -47,6 +52,9 @@ func (m *memberAPI) CreateProjectMember(ctx context.Context, params operation.Cr if params.ProjectMember == nil { return m.SendError(ctx, errors.BadRequestError(nil).WithMessage("the project member should provide")) } + if err := m.checkNoEscalation(ctx, projectNameOrID, params.ProjectMember.RoleID); err != nil { + return m.SendError(ctx, err) + } req, err := toMemberReq(params.ProjectMember) if err != nil { return m.SendError(ctx, err) @@ -164,6 +172,9 @@ func (m *memberAPI) UpdateProjectMember(ctx context.Context, params operation.Up if params.Mid == 0 { return m.SendError(ctx, errors.BadRequestError(nil).WithMessage("member id can not be empty")) } + if err := m.checkNoEscalation(ctx, projectNameOrID, params.Role.RoleID); err != nil { + return m.SendError(ctx, err) + } err := m.ctl.UpdateRole(ctx, projectNameOrID, int(params.Mid), int(params.Role.RoleID)) if err != nil { @@ -171,3 +182,24 @@ func (m *memberAPI) UpdateProjectMember(ctx context.Context, params operation.Up } return operation.NewUpdateProjectMemberOK() } + +// checkNoEscalation rejects role assignments where the target role has permissions the caller lacks. +func (m *memberAPI) checkNoEscalation(ctx context.Context, projectNameOrID any, roleID int64) error { + r, err := m.roleCtl.Get(ctx, roleID, &roleCtl.Option{WithPermission: true}) + if err != nil { + return err + } + for _, perm := range r.Permissions { + for _, acc := range perm.Access { + has, err := m.HasProjectPermission(ctx, projectNameOrID, acc.Action, acc.Resource) + if err != nil { + return err + } + if !has { + return errors.ForbiddenError(nil).WithMessagef( + "escalation not allowed: you lack %s:%s", acc.Resource, acc.Action) + } + } + } + return nil +} diff --git a/src/server/v2.0/handler/member_test.go b/src/server/v2.0/handler/member_test.go new file mode 100644 index 00000000000..32b30c67eb4 --- /dev/null +++ b/src/server/v2.0/handler/member_test.go @@ -0,0 +1,324 @@ +// Copyright Project Harbor Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package handler + +import ( + "context" + "fmt" + "net/http" + "net/http/httptest" + "testing" + + "github.com/go-openapi/runtime" + "github.com/stretchr/testify/assert" + testifymock "github.com/stretchr/testify/mock" + + "github.com/goharbor/harbor/src/common/rbac" + rbacProject "github.com/goharbor/harbor/src/common/rbac/project" + "github.com/goharbor/harbor/src/common/security" + roleCtl "github.com/goharbor/harbor/src/controller/role" + "github.com/goharbor/harbor/src/lib/errors" + "github.com/goharbor/harbor/src/lib/q" + "github.com/goharbor/harbor/src/pkg/permission/types" + "github.com/goharbor/harbor/src/server/v2.0/models" + memberop "github.com/goharbor/harbor/src/server/v2.0/restapi/operations/member" + securityMock "github.com/goharbor/harbor/src/testing/common/security" +) + +// --------------------------------------------------------------------------- +// Inline mock for roleCtl.Controller +// Only Get needs real behaviour; the rest are no-ops for these tests. +// --------------------------------------------------------------------------- + +type stubRoleCtl struct { + testifymock.Mock +} + +func (s *stubRoleCtl) Get(ctx context.Context, id int64, option *roleCtl.Option) (*roleCtl.Role, error) { + args := s.Called(ctx, id, option) + r, _ := args.Get(0).(*roleCtl.Role) + return r, args.Error(1) +} + +func (s *stubRoleCtl) Create(ctx context.Context, r *roleCtl.Role) (int64, error) { return 0, nil } +func (s *stubRoleCtl) Delete(ctx context.Context, id int64, option ...*roleCtl.Option) error { + return nil +} +func (s *stubRoleCtl) Update(ctx context.Context, r *roleCtl.Role, option *roleCtl.Option) error { + return nil +} +func (s *stubRoleCtl) List(ctx context.Context, query *q.Query, option *roleCtl.Option) ([]*roleCtl.Role, error) { + return nil, nil +} +func (s *stubRoleCtl) Count(ctx context.Context, query *q.Query) (int64, error) { return 0, nil } + +// --------------------------------------------------------------------------- +// Helpers +// --------------------------------------------------------------------------- + +const testProjectID int64 = 42 + +// policyAccess builds a single-permission role for test fixtures. +func policyAccess(resource rbac.Resource, action rbac.Action) []*types.Policy { + return []*types.Policy{{Resource: resource, Action: action}} +} + +// projectResource returns the full RBAC resource string for a project subresource, +// matching what HasProjectPermission builds internally. +func projectResource(subresource rbac.Resource) rbac.Resource { + return rbacProject.NewNamespace(testProjectID).Resource(subresource) +} + +// newCtxWithSecurity injects sc into a background context, mirroring what the +// handler middleware does at request time. +func newCtxWithSecurity(sc security.Context) context.Context { + return security.NewContext(context.Background(), sc) +} + +// newAPI returns a memberAPI wired to the given role controller stub. +func newAPI(rc *stubRoleCtl) *memberAPI { + return &memberAPI{roleCtl: rc} +} + +// --------------------------------------------------------------------------- +// Tests for checkNoEscalation +// --------------------------------------------------------------------------- + +func TestCheckNoEscalation_RoleWithNoPermissions(t *testing.T) { + sc := &securityMock.Context{} + sc.On("IsSysAdmin").Return(false) + // Can() should never be called — role has zero permissions + + rc := &stubRoleCtl{} + rc.On("Get", testifymock.Anything, int64(10), testifymock.Anything). + Return(&roleCtl.Role{}, nil) + + err := newAPI(rc).checkNoEscalation(newCtxWithSecurity(sc), testProjectID, 10) + assert.NoError(t, err) + sc.AssertNotCalled(t, "Can") +} + +func TestCheckNoEscalation_CallerHasAllPermissions(t *testing.T) { + sc := &securityMock.Context{} + sc.On("IsSysAdmin").Return(false) + // Caller holds repository:pull + sc.On("Can", testifymock.Anything, + rbac.ActionPull, projectResource(rbac.ResourceRepository)). + Return(true) + + rc := &stubRoleCtl{} + rc.On("Get", testifymock.Anything, int64(20), testifymock.Anything). + Return(&roleCtl.Role{ + Permissions: []*roleCtl.Permission{{ + Access: policyAccess(rbac.ResourceRepository, rbac.ActionPull), + }}, + }, nil) + + err := newAPI(rc).checkNoEscalation(newCtxWithSecurity(sc), testProjectID, 20) + assert.NoError(t, err) +} + +func TestCheckNoEscalation_CallerLacksPermission(t *testing.T) { + sc := &securityMock.Context{} + sc.On("IsSysAdmin").Return(false) + // Caller does NOT hold member:create + sc.On("Can", testifymock.Anything, + rbac.ActionCreate, projectResource(rbac.ResourceMember)). + Return(false) + + rc := &stubRoleCtl{} + rc.On("Get", testifymock.Anything, int64(30), testifymock.Anything). + Return(&roleCtl.Role{ + Permissions: []*roleCtl.Permission{{ + Access: policyAccess(rbac.ResourceMember, rbac.ActionCreate), + }}, + }, nil) + + err := newAPI(rc).checkNoEscalation(newCtxWithSecurity(sc), testProjectID, 30) + assert.Error(t, err) + assert.Equal(t, errors.ForbiddenCode, errors.ErrCode(err), "expected ForbiddenError, got: %v", err) +} + +func TestCheckNoEscalation_FirstPermissionPassesSecondFails(t *testing.T) { + sc := &securityMock.Context{} + sc.On("IsSysAdmin").Return(false) + sc.On("Can", testifymock.Anything, + rbac.ActionPull, projectResource(rbac.ResourceRepository)). + Return(true) + sc.On("Can", testifymock.Anything, + rbac.ActionCreate, projectResource(rbac.ResourceMember)). + Return(false) + + rc := &stubRoleCtl{} + rc.On("Get", testifymock.Anything, int64(40), testifymock.Anything). + Return(&roleCtl.Role{ + Permissions: []*roleCtl.Permission{{ + Access: []*types.Policy{ + {Resource: rbac.ResourceRepository, Action: rbac.ActionPull}, + {Resource: rbac.ResourceMember, Action: rbac.ActionCreate}, + }, + }}, + }, nil) + + err := newAPI(rc).checkNoEscalation(newCtxWithSecurity(sc), testProjectID, 40) + assert.Error(t, err) + assert.Equal(t, errors.ForbiddenCode, errors.ErrCode(err)) +} + +func TestCheckNoEscalation_RoleCtlGetError(t *testing.T) { + sc := &securityMock.Context{} + sc.On("IsSysAdmin").Return(false) + + rc := &stubRoleCtl{} + rc.On("Get", testifymock.Anything, int64(50), testifymock.Anything). + Return(nil, fmt.Errorf("db error")) + + err := newAPI(rc).checkNoEscalation(newCtxWithSecurity(sc), testProjectID, 50) + assert.Error(t, err) + assert.Contains(t, err.Error(), "db error") +} + +func TestCheckNoEscalation_MultiplePermissionSetsAllowed(t *testing.T) { + sc := &securityMock.Context{} + sc.On("IsSysAdmin").Return(false) + sc.On("Can", testifymock.Anything, + rbac.ActionPull, projectResource(rbac.ResourceRepository)).Return(true) + sc.On("Can", testifymock.Anything, + rbac.ActionPush, projectResource(rbac.ResourceRepository)).Return(true) + sc.On("Can", testifymock.Anything, + rbac.ActionRead, projectResource(rbac.ResourceArtifact)).Return(true) + + rc := &stubRoleCtl{} + rc.On("Get", testifymock.Anything, int64(60), testifymock.Anything). + Return(&roleCtl.Role{ + Permissions: []*roleCtl.Permission{ + {Access: policyAccess(rbac.ResourceRepository, rbac.ActionPull)}, + {Access: policyAccess(rbac.ResourceRepository, rbac.ActionPush)}, + {Access: policyAccess(rbac.ResourceArtifact, rbac.ActionRead)}, + }, + }, nil) + + err := newAPI(rc).checkNoEscalation(newCtxWithSecurity(sc), testProjectID, 60) + assert.NoError(t, err) +} + +func TestCheckNoEscalation_ProjectNameInsteadOfID(t *testing.T) { + // Passing a project name string follows a code path that looks up the project + // from DB (not available in unit tests), so we only verify that numeric IDs work. + // This test documents the expected behavior for coverage completeness. + sc := &securityMock.Context{} + sc.On("IsSysAdmin").Return(false) + + rc := &stubRoleCtl{} + rc.On("Get", testifymock.Anything, int64(70), testifymock.Anything). + Return(&roleCtl.Role{}, nil) + + // numeric int64 → no DB lookup → should work cleanly + err := newAPI(rc).checkNoEscalation(newCtxWithSecurity(sc), testProjectID, 70) + assert.NoError(t, err) +} + +// --------------------------------------------------------------------------- +// Handler-level escalation gate on the MODIFY path (UpdateProjectMember) +// --------------------------------------------------------------------------- + +// TestUpdateProjectMember_EscalationBlocked proves that modifying a member's +// role is subject to the anti-escalation check: a caller who may update members +// but does NOT hold a permission granted by the target role is rejected with 403, +// and the member controller's UpdateRole is never reached. This guards against a +// regression that drops checkNoEscalation from the update (modification) path. +func TestUpdateProjectMember_EscalationBlocked(t *testing.T) { + sc := &securityMock.Context{} + sc.On("IsSysAdmin").Return(false) + sc.On("IsAuthenticated").Return(true) + // caller may update members (passes RequireProjectAccess)... + sc.On("Can", testifymock.Anything, + rbac.ActionUpdate, projectResource(rbac.ResourceMember)).Return(true) + // ...but does NOT hold member:create, which the target role grants + sc.On("Can", testifymock.Anything, + rbac.ActionCreate, projectResource(rbac.ResourceMember)).Return(false) + + rc := &stubRoleCtl{} + rc.On("Get", testifymock.Anything, int64(30), testifymock.Anything). + Return(&roleCtl.Role{ + Permissions: []*roleCtl.Permission{{ + Access: policyAccess(rbac.ResourceMember, rbac.ActionCreate), + }}, + }, nil) + + xFalse := false + params := memberop.UpdateProjectMemberParams{ + ProjectNameOrID: fmt.Sprintf("%d", testProjectID), + XIsResourceName: &xFalse, + Mid: 7, + Role: &models.RoleRequest{RoleID: 30}, + } + + // ctl (member controller) is intentionally nil: the escalation check must + // reject before UpdateRole is reached, so it is never dereferenced. + resp := newAPI(rc).UpdateProjectMember(newCtxWithSecurity(sc), params) + + rr := httptest.NewRecorder() + resp.WriteResponse(rr, runtime.JSONProducer()) + assert.Equal(t, http.StatusForbidden, rr.Code) + // reached checkNoEscalation (fetched the target role) before rejecting + rc.AssertCalled(t, "Get", testifymock.Anything, int64(30), testifymock.Anything) +} + +// TestCreateProjectMember_EscalationBlocked proves the same anti-escalation guard +// applies on the ASSIGN path: a caller allowed to create members but lacking a +// permission the target role grants is rejected with 403, before the member +// controller's Create is reached. +func TestCreateProjectMember_EscalationBlocked(t *testing.T) { + sc := &securityMock.Context{} + sc.On("IsSysAdmin").Return(false) + sc.On("IsAuthenticated").Return(true) + // caller may create members (passes RequireProjectAccess)... + sc.On("Can", testifymock.Anything, + rbac.ActionCreate, projectResource(rbac.ResourceMember)).Return(true) + // ...but does NOT hold repository:push, which the target role grants + sc.On("Can", testifymock.Anything, + rbac.ActionPush, projectResource(rbac.ResourceRepository)).Return(false) + + rc := &stubRoleCtl{} + rc.On("Get", testifymock.Anything, int64(30), testifymock.Anything). + Return(&roleCtl.Role{ + Permissions: []*roleCtl.Permission{{ + Access: policyAccess(rbac.ResourceRepository, rbac.ActionPush), + }}, + }, nil) + + xFalse := false + params := memberop.CreateProjectMemberParams{ + ProjectNameOrID: fmt.Sprintf("%d", testProjectID), + XIsResourceName: &xFalse, + ProjectMember: &models.ProjectMember{RoleID: 30}, + } + + // ctl (member controller) is intentionally nil: the escalation check must + // reject before Create is reached, so it is never dereferenced. + resp := newAPI(rc).CreateProjectMember(newCtxWithSecurity(sc), params) + + rr := httptest.NewRecorder() + resp.WriteResponse(rr, runtime.JSONProducer()) + assert.Equal(t, http.StatusForbidden, rr.Code) + rc.AssertCalled(t, "Get", testifymock.Anything, int64(30), testifymock.Anything) +} + +// --------------------------------------------------------------------------- +// Compile-time interface check — fails the build if stubRoleCtl drifts. +// --------------------------------------------------------------------------- + +var _ roleCtl.Controller = (*stubRoleCtl)(nil) diff --git a/src/server/v2.0/handler/model/role.go b/src/server/v2.0/handler/model/role.go new file mode 100644 index 00000000000..8357e0b0505 --- /dev/null +++ b/src/server/v2.0/handler/model/role.go @@ -0,0 +1,63 @@ +// Copyright Project Harbor Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package model + +import ( + "github.com/go-openapi/strfmt" + + "github.com/goharbor/harbor/src/controller/role" + "github.com/goharbor/harbor/src/lib" + "github.com/goharbor/harbor/src/lib/log" + "github.com/goharbor/harbor/src/server/v2.0/models" +) + +// Robot ... +type Role struct { + *role.Role +} + +// ToSwagger ... +func (r *Role) ToSwagger() *models.Role { + perms := []*models.RolePermission{} + for _, p := range r.Permissions { + temp := &models.RolePermission{} + if err := lib.JSONCopy(temp, p); err != nil { + log.Warningf("failed to do JSONCopy on RolePermission, error: %v", err) + } + perms = append(perms, temp) + } + + return &models.Role{ + ID: r.ID, + Name: r.Name, + RoleMask: r.RoleMask, + RoleCode: r.RoleCode, + Permissions: perms, + IsBuiltin: r.IsBuiltin, + Description: r.Description, + Modified: r.Modified, + CreatedBy: r.CreatedBy, + CreatedAt: strfmt.DateTime(r.CreatedAt), + ModifiedBy: r.ModifiedBy, + ModifiedAt: strfmt.DateTime(r.ModifiedAt), + } +} + +// NewRole ... +func NewRole(r *role.Role) *Role { + return &Role{ + Role: r, + } +} diff --git a/src/server/v2.0/handler/permissions.go b/src/server/v2.0/handler/permissions.go index 192e88a2758..1799fb19cfd 100644 --- a/src/server/v2.0/handler/permissions.go +++ b/src/server/v2.0/handler/permissions.go @@ -21,8 +21,6 @@ import ( "github.com/goharbor/harbor/src/common/rbac" "github.com/goharbor/harbor/src/common/security" - "github.com/goharbor/harbor/src/common/security/local" - "github.com/goharbor/harbor/src/controller/member" "github.com/goharbor/harbor/src/controller/user" "github.com/goharbor/harbor/src/lib/errors" "github.com/goharbor/harbor/src/pkg/permission/types" @@ -33,16 +31,19 @@ import ( type permissionsAPI struct { BaseAPI uc user.Controller - mc member.Controller } func newPermissionsAPIAPI() *permissionsAPI { return &permissionsAPI{ uc: user.Ctl, - mc: member.NewController(), } } +// GetPermissions returns the available permission catalog. +// Accessible to all authenticated users — the catalog is read-only metadata +// (action names such as repository:pull) used by project-level UI components +// (robot accounts, webhooks, role management). System-level permissions are +// only included in the response for system admins. func (p *permissionsAPI) GetPermissions(ctx context.Context, _ permissions.GetPermissionsParams) middleware.Responder { secCtx, ok := security.FromContext(ctx) if !ok { @@ -52,37 +53,20 @@ func (p *permissionsAPI) GetPermissions(ctx context.Context, _ permissions.GetPe return p.SendError(ctx, errors.UnauthorizedError(nil).WithMessage(secCtx.GetUsername())) } - var isSystemAdmin bool - var isProjectAdmin bool - - if secCtx.IsSysAdmin() { - isSystemAdmin = true - } else { - if sc, ok := secCtx.(*local.SecurityContext); ok { - user := sc.User() - var err error - isProjectAdmin, err = p.mc.IsProjectAdmin(ctx, *user) - if err != nil { - return p.SendError(ctx, err) - } - } - } - if !isSystemAdmin && !isProjectAdmin { - return p.SendError(ctx, errors.ForbiddenError(errors.New("only admins(system and project) can access permissions"))) - } + isSystemAdmin := secCtx.IsSysAdmin() provider := rbac.GetPermissionProvider() sysPermissions := make([]*types.Policy, 0) proPermissions := provider.GetPermissions(rbac.ScopeProject) if isSystemAdmin { - // project admin cannot see the system level permissions sysPermissions = provider.GetPermissions(rbac.ScopeSystem) } + rolePermissions := provider.GetPermissions(rbac.ScopeRole) - return permissions.NewGetPermissionsOK().WithPayload(p.convertPermissions(sysPermissions, proPermissions)) + return permissions.NewGetPermissionsOK().WithPayload(p.convertPermissions(sysPermissions, proPermissions, rolePermissions)) } -func (p *permissionsAPI) convertPermissions(system, project []*types.Policy) *models.Permissions { +func (p *permissionsAPI) convertPermissions(system, project, role []*types.Policy) *models.Permissions { res := &models.Permissions{} if len(system) > 0 { var sysPermission []*models.Permission @@ -106,5 +90,16 @@ func (p *permissionsAPI) convertPermissions(system, project []*types.Policy) *mo res.Project = proPermission } + if len(role) > 0 { + var rolePermission []*models.Permission + for _, item := range role { + rolePermission = append(rolePermission, &models.Permission{ + Resource: item.Resource.String(), + Action: item.Action.String(), + }) + } + res.Role = rolePermission + } + return res } diff --git a/src/server/v2.0/handler/project.go b/src/server/v2.0/handler/project.go index de75072b8c7..c8d08813273 100644 --- a/src/server/v2.0/handler/project.go +++ b/src/server/v2.0/handler/project.go @@ -983,3 +983,33 @@ func (a *projectAPI) GetLogExts(ctx context.Context, params operation.GetLogExts WithLink(a.Links(ctx, params.HTTPRequest.URL, total, query.PageNumber, query.PageSize).String()). WithPayload(convertToModelAuditLogExt(logs)) } + +// GetEffectivePermissions returns the subset of ScopeProject permissions the calling user actually holds. +func (a *projectAPI) GetEffectivePermissions(ctx context.Context, params operation.GetEffectivePermissionsParams) middleware.Responder { + projectNameOrID := parseProjectNameOrID(params.ProjectNameOrID, params.XIsResourceName) + + // Resolve the project once (by its numeric ID) rather than resolving the name + // on every candidate permission, and fail the request on lookup/check errors. + pro, err := a.projectCtl.Get(ctx, projectNameOrID) + if err != nil { + return a.SendError(ctx, err) + } + + candidates := rbac.GetPermissionProvider().GetPermissions(rbac.ScopeProject) + + var effective []*models.Permission + for _, p := range candidates { + resource := mapRobotToHumanResource(p.Resource) + has, err := a.HasProjectPermission(ctx, pro.ProjectID, p.Action, resource) + if err != nil { + return a.SendError(ctx, err) + } + if has { + effective = append(effective, &models.Permission{ + Resource: p.Resource.String(), + Action: p.Action.String(), + }) + } + } + return operation.NewGetEffectivePermissionsOK().WithPayload(effective) +} diff --git a/src/server/v2.0/handler/robot.go b/src/server/v2.0/handler/robot.go index a49d52cc7b4..31f0b1e4aa1 100644 --- a/src/server/v2.0/handler/robot.go +++ b/src/server/v2.0/handler/robot.go @@ -84,6 +84,9 @@ func (rAPI *robotAPI) CreateRobot(ctx context.Context, params operation.CreateRo switch s := sc.(type) { case *local.SecurityContext: creatorRef = int64(s.User().UserID) + if err := rAPI.validateNoEscalation(ctx, params.Robot.Permissions); err != nil { + return rAPI.SendError(ctx, err) + } case *robotSc.SecurityContext: if s.User() == nil { return rAPI.SendError(ctx, errors.New(nil).WithMessage("invalid security context: empty robot account")) @@ -391,6 +394,16 @@ func (rAPI *robotAPI) updateV2Robot(ctx context.Context, params operation.Update return errors.BadRequestError(nil).WithMessage("cannot update the level or name of robot") } + sc, err := rAPI.GetSecurityContext(ctx) + if err != nil { + return err + } + if _, ok := sc.(*local.SecurityContext); ok { + if err := rAPI.validateNoEscalation(ctx, params.Robot.Permissions); err != nil { + return err + } + } + if r.Duration != *params.Robot.Duration { r.Duration = *params.Robot.Duration if *params.Robot.Duration == -1 { @@ -443,6 +456,37 @@ func containsAccess(policies []*types.Policy, item *models.Access) bool { return false } +// robotToHumanResourceMap maps ScopeProject resource names to their ScopeRole equivalents. +// Needed because robots use "project" for the project entity while human roles use "" (ResourceSelf). +var robotToHumanResourceMap = map[rbac.Resource]rbac.Resource{ + rbac.ResourceProject: rbac.ResourceSelf, +} + +func mapRobotToHumanResource(r rbac.Resource) rbac.Resource { + if mapped, ok := robotToHumanResourceMap[r]; ok { + return mapped + } + return r +} + +// validateNoEscalation ensures that a human user cannot grant a robot more permissions than they hold. +func (rAPI *robotAPI) validateNoEscalation(ctx context.Context, permissions []*models.RobotPermission) error { + for _, perm := range permissions { + for _, acc := range perm.Access { + resource := mapRobotToHumanResource(rbac.Resource(acc.Resource)) + has, err := rAPI.HasProjectPermission(ctx, perm.Namespace, rbac.Action(acc.Action), resource) + if err != nil { + return err + } + if !has { + return errors.ForbiddenError(nil).WithMessagef( + "permission escalation not allowed: you do not have %s:%s", acc.Resource, acc.Action) + } + } + } + return nil +} + // isValidPermissionScope checks if permission slice A is a subset of permission slice B func isValidPermissionScope(creating []*models.RobotPermission, creator []*robot.Permission) bool { creatorMap := make(map[string]*robot.Permission) diff --git a/src/server/v2.0/handler/robot_test.go b/src/server/v2.0/handler/robot_test.go index fdcf326e473..d9724dfa492 100644 --- a/src/server/v2.0/handler/robot_test.go +++ b/src/server/v2.0/handler/robot_test.go @@ -5,11 +5,17 @@ import ( "testing" "github.com/stretchr/testify/assert" + testifymock "github.com/stretchr/testify/mock" "github.com/goharbor/harbor/src/common/rbac" + rbacProject "github.com/goharbor/harbor/src/common/rbac/project" "github.com/goharbor/harbor/src/controller/robot" + "github.com/goharbor/harbor/src/lib/errors" "github.com/goharbor/harbor/src/pkg/permission/types" + projectModels "github.com/goharbor/harbor/src/pkg/project/models" "github.com/goharbor/harbor/src/server/v2.0/models" + "github.com/goharbor/harbor/src/testing/mock" + securityMock "github.com/goharbor/harbor/src/testing/common/security" ) func TestValidLevel(t *testing.T) { @@ -480,3 +486,77 @@ func TestValidPermissionScope(t *testing.T) { }) } } + +// --------------------------------------------------------------------------- +// mapRobotToHumanResource +// --------------------------------------------------------------------------- + +func TestMapRobotToHumanResource_ProjectMapsToSelf(t *testing.T) { + assert.Equal(t, rbac.ResourceSelf, mapRobotToHumanResource(rbac.ResourceProject)) +} + +func TestMapRobotToHumanResource_RepositoryPassthrough(t *testing.T) { + assert.Equal(t, rbac.ResourceRepository, mapRobotToHumanResource(rbac.ResourceRepository)) +} + +func TestMapRobotToHumanResource_UnknownPassthrough(t *testing.T) { + unknown := rbac.Resource("unknown") + assert.Equal(t, unknown, mapRobotToHumanResource(unknown)) +} + +// --------------------------------------------------------------------------- +// validateNoEscalation +// --------------------------------------------------------------------------- + +func robotPerm(ns, resource, action string) []*models.RobotPermission { + return []*models.RobotPermission{{ + Namespace: ns, + Access: []*models.Access{{Resource: resource, Action: action}}, + }} +} + +// stubProject stubs projectCtlMock.GetByName to return a project with the given ID. +// perm.Namespace is always a string so HasProjectPermission always calls GetByName. +func stubProject(projectID int64) { + mock.OnAnything(projectCtlMock, "GetByName"). + Return(&projectModels.Project{ProjectID: projectID}, nil).Once() +} + +func TestValidateNoEscalation_CallerHasPermission(t *testing.T) { + stubProject(1) + sc := &securityMock.Context{} + sc.On("Can", testifymock.Anything, rbac.ActionPull, + rbacProject.NewNamespace(1).Resource(rbac.ResourceRepository)).Return(true) + + err := (&robotAPI{}).validateNoEscalation(newCtxWithSecurity(sc), robotPerm("testproject", "repository", "pull")) + assert.NoError(t, err) +} + +func TestValidateNoEscalation_CallerLacksPermission(t *testing.T) { + stubProject(1) + sc := &securityMock.Context{} + sc.On("Can", testifymock.Anything, rbac.ActionPush, + rbacProject.NewNamespace(1).Resource(rbac.ResourceRepository)).Return(false) + + err := (&robotAPI{}).validateNoEscalation(newCtxWithSecurity(sc), robotPerm("testproject", "repository", "push")) + assert.Error(t, err) + assert.Equal(t, errors.ForbiddenCode, errors.ErrCode(err)) +} + +func TestValidateNoEscalation_EmptyPermissions(t *testing.T) { + sc := &securityMock.Context{} + err := (&robotAPI{}).validateNoEscalation(newCtxWithSecurity(sc), nil) + assert.NoError(t, err) + sc.AssertNotCalled(t, "Can") +} + +func TestValidateNoEscalation_ProjectResourceMappedToSelf(t *testing.T) { + stubProject(1) + sc := &securityMock.Context{} + // "project" maps to ResourceSelf ("") via mapRobotToHumanResource. + sc.On("Can", testifymock.Anything, rbac.ActionRead, + rbacProject.NewNamespace(1).Resource(rbac.ResourceSelf)).Return(true) + + err := (&robotAPI{}).validateNoEscalation(newCtxWithSecurity(sc), robotPerm("testproject", "project", "read")) + assert.NoError(t, err) +} diff --git a/src/server/v2.0/handler/role.go b/src/server/v2.0/handler/role.go new file mode 100644 index 00000000000..6abaf79bb9e --- /dev/null +++ b/src/server/v2.0/handler/role.go @@ -0,0 +1,336 @@ +// Copyright Project Harbor Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package handler + +import ( + "context" + "fmt" + "strings" + + "github.com/go-openapi/runtime/middleware" + + "github.com/goharbor/harbor/src/common/rbac" + "github.com/goharbor/harbor/src/common/security/local" + "github.com/goharbor/harbor/src/controller/role" + "github.com/goharbor/harbor/src/lib" + "github.com/goharbor/harbor/src/lib/errors" + "github.com/goharbor/harbor/src/lib/log" + "github.com/goharbor/harbor/src/pkg/permission/types" + pkg "github.com/goharbor/harbor/src/pkg/role/model" + "github.com/goharbor/harbor/src/server/v2.0/handler/model" + "github.com/goharbor/harbor/src/server/v2.0/models" + operation "github.com/goharbor/harbor/src/server/v2.0/restapi/operations/role" +) + +func newRoleAPI() *roleAPI { + return &roleAPI{ + roleCtl: role.Ctl, + } +} + +type roleAPI struct { + BaseAPI + roleCtl role.Controller +} + +func (rAPI *roleAPI) CreateRole(ctx context.Context, params operation.CreateRoleParams) middleware.Responder { + if err := rAPI.checkSysAdmin(ctx); err != nil { + return rAPI.SendError(ctx, err) + } + + if err := validateRoleName(params.Role.Name); err != nil { + return rAPI.SendError(ctx, err) + } + + if err := rAPI.validate(params.Role.Permissions); err != nil { + return rAPI.SendError(ctx, err) + } + + sc, err := rAPI.GetSecurityContext(ctx) + if err != nil { + return rAPI.SendError(ctx, err) + } + + r := &role.Role{ + Role: pkg.Role{ + Name: params.Role.Name, + RoleMask: params.Role.RoleMask, + RoleCode: params.Role.RoleCode, + }, + } + + switch s := sc.(type) { + case *local.SecurityContext: + if s.User() == nil { + return rAPI.SendError(ctx, errors.New(nil).WithMessage("invalid security context: empty role account")) + } + r.CreatedBy = s.User().Username + default: + return rAPI.SendError(ctx, errors.New(nil).WithMessage("invalid security context")) + } + r.Description = params.Role.Description + + if err := lib.JSONCopy(&r.Permissions, params.Role.Permissions); err != nil { + log.Warningf("failed to call JSONCopy on role permission when CreateRole, error: %v", err) + } + + rid, err := rAPI.roleCtl.Create(ctx, r) + if err != nil { + return rAPI.SendError(ctx, err) + } + + created, err := rAPI.roleCtl.Get(ctx, rid, nil) + if err != nil { + return rAPI.SendError(ctx, err) + } + + location := fmt.Sprintf("%s/%d", strings.TrimSuffix(params.HTTPRequest.URL.Path, "/"), created.ID) + return operation.NewCreateRoleCreated().WithLocation(location).WithPayload(&models.RoleCreated{ + ID: created.ID, + Name: created.Name, + }) +} + +func (rAPI *roleAPI) DeleteRole(ctx context.Context, params operation.DeleteRoleParams) middleware.Responder { + if err := rAPI.checkSysAdmin(ctx); err != nil { + return rAPI.SendError(ctx, err) + } + + r, err := rAPI.roleCtl.Get(ctx, params.RoleID, nil) + if err != nil { + return rAPI.SendError(ctx, err) + } + + if err := rAPI.roleCtl.Delete(ctx, params.RoleID); err != nil { + // for the version 1 role account, has to ignore the no permission error. + if !r.Editable && errors.IsNotFoundErr(err) { + return operation.NewDeleteRoleOK() + } + return rAPI.SendError(ctx, err) + } + return operation.NewDeleteRoleOK() +} + +func (rAPI *roleAPI) ListRole(ctx context.Context, params operation.ListRoleParams) middleware.Responder { + if err := rAPI.RequireAuthenticated(ctx); err != nil { + return rAPI.SendError(ctx, err) + } + + query, err := rAPI.BuildQuery(ctx, params.Q, params.Sort, params.Page, params.PageSize) + if err != nil { + return rAPI.SendError(ctx, err) + } + + query.Keywords["Visible"] = true + + total, err := rAPI.roleCtl.Count(ctx, query) + if err != nil { + return rAPI.SendError(ctx, err) + } + + roles, err := rAPI.roleCtl.List(ctx, query, &role.Option{ + WithPermission: true, + }) + if err != nil { + return rAPI.SendError(ctx, err) + } + + var results []*models.Role + for _, r := range roles { + results = append(results, model.NewRole(r).ToSwagger()) + } + + return operation.NewListRoleOK(). + WithXTotalCount(total). + WithLink(rAPI.Links(ctx, params.HTTPRequest.URL, total, query.PageNumber, query.PageSize).String()). + WithPayload(results) +} + +func (rAPI *roleAPI) GetRoleByID(ctx context.Context, params operation.GetRoleByIDParams) middleware.Responder { + if err := rAPI.RequireAuthenticated(ctx); err != nil { + return rAPI.SendError(ctx, err) + } + + r, err := rAPI.roleCtl.Get(ctx, params.RoleID, &role.Option{ + WithPermission: true, + }) + if err != nil { + return rAPI.SendError(ctx, err) + } + + return operation.NewGetRoleByIDOK().WithPayload(model.NewRole(r).ToSwagger()) +} + +// checkSysAdmin returns UnauthorizedError for unauthenticated callers and +// ForbiddenError for callers who are not sysadmins. +func (rAPI *roleAPI) checkSysAdmin(ctx context.Context) error { + sc, err := rAPI.GetSecurityContext(ctx) + if err != nil { + return err + } + if !sc.IsAuthenticated() { + return errors.UnauthorizedError(nil) + } + if !sc.IsSysAdmin() { + return errors.ForbiddenError(nil).WithMessage("only sysadmins can manage roles") + } + return nil +} + +func (rAPI *roleAPI) UpdateRole(ctx context.Context, params operation.UpdateRoleParams) middleware.Responder { + var err error + if err := rAPI.checkSysAdmin(ctx); err != nil { + return rAPI.SendError(ctx, err) + } + r, err := rAPI.roleCtl.Get(ctx, params.RoleID, &role.Option{ + WithPermission: true, + }) + if err != nil { + return rAPI.SendError(ctx, err) + } + + if !r.Editable { + err = errors.DeniedError(nil).WithMessage("editing of legacy role is not allowed") + } else { + err = rAPI.updateV2Role(ctx, params, r) + } + if err != nil { + return rAPI.SendError(ctx, err) + } + + return operation.NewUpdateRoleOK() +} + +// validate checks that every requested permission is a project-role-scoped +// access drawn from the role permission catalog (rbac.ScopeRole). Role creation +// and update are restricted to system admins (see checkSysAdmin), so there is no +// privilege escalation to guard against here: a sysadmin already holds every +// permission, and non-admins never reach this path +// (see TestCreateRole_NonSysAdminForbidden). Escalation is enforced separately on +// the paths where non-admin callers assign permissions (validateNoEscalation). +func (rAPI *roleAPI) validate(permissions []*models.RolePermission) error { + if len(permissions) == 0 { + return errors.New(nil).WithMessage("bad request empty permission").WithCode(errors.BadRequestCode) + } + + for _, perm := range permissions { + if len(perm.Access) == 0 { + return errors.New(nil).WithMessage("bad request empty access").WithCode(errors.BadRequestCode) + } + } + + provider := rbac.GetPermissionProvider() + // to validate the access scope + for _, perm := range permissions { + if perm.Kind == role.LEVELROLE { + polices := provider.GetPermissions(rbac.ScopeRole) + + for _, acc := range perm.Access { + if !containsAccess(polices, acc) { + return errors.New(nil).WithMessagef("bad request permission: %s:%s", acc.Resource, acc.Action).WithCode(errors.BadRequestCode) + } + } + } else { + return errors.New(nil).WithMessagef("bad request permission level: %s", perm.Kind).WithCode(errors.BadRequestCode) + } + } + + return nil +} + +func (rAPI *roleAPI) updateV2Role(ctx context.Context, params operation.UpdateRoleParams, r *role.Role) error { + if err := rAPI.validate(params.Role.Permissions); err != nil { + return err + } + + if len(params.Role.Permissions) != 0 { + if err := lib.JSONCopy(&r.Permissions, params.Role.Permissions); err != nil { + log.Warningf("failed to call JSONCopy on role permission when updateV2Role, error: %v", err) + } + } + r.Description = params.Role.Description + + if err := rAPI.roleCtl.Update(ctx, r, &role.Option{ + WithPermission: true, + }); err != nil { + return err + } + return nil +} + +// validateName validates the role name, especially '+' cannot be a valid character +// validateRoleName enforces the server-side role name contract: non-empty, at +// most 255 characters (matching the role.name column and the UI), and free of the +// '+' reserved character. +func validateRoleName(name string) error { + if name == "" { + return errors.New(nil).WithMessage("role name cannot be empty").WithCode(errors.BadRequestCode) + } + if len(name) > 255 { + return errors.New(nil).WithMessage("role name cannot exceed 255 characters").WithCode(errors.BadRequestCode) + } + if strings.Contains(name, "+") { + return errors.New(nil).WithMessage("role name cannot contain the '+' character").WithCode(errors.BadRequestCode) + } + return nil +} + +func containsRoleAccess(policies []*types.Policy, item *models.Access) bool { + for _, po := range policies { + if po.Resource.String() == item.Resource && po.Action.String() == item.Action { + return true + } + } + return false +} + +// isValidPermissionScope checks if permission slice A is a subset of permission slice B +func isValidRolePermissionScope(creating []*models.RolePermission, creator []*role.Permission) bool { + creatorMap := make(map[string]*role.Permission) + for _, creatorPerm := range creator { + key := fmt.Sprintf("%s:%s", creatorPerm.Kind, creatorPerm.Namespace) + creatorMap[key] = creatorPerm + } + + hasLessThanOrEqualAccess := func(creating []*models.Access, creator []*types.Policy) bool { + creatorMap := make(map[string]*types.Policy) + for _, creatorP := range creator { + key := fmt.Sprintf("%s:%s:%s", creatorP.Resource, creatorP.Action, creatorP.Effect) + creatorMap[key] = creatorP + } + for _, creatingP := range creating { + key := fmt.Sprintf("%s:%s:%s", creatingP.Resource, creatingP.Action, creatingP.Effect) + if _, found := creatorMap[key]; !found { + return false + } + } + return true + } + + for _, pCreating := range creating { + key := fmt.Sprintf("%s:%s", pCreating.Kind, pCreating.Namespace) + creatorPerm, found := creatorMap[key] + if !found { + allProjects := fmt.Sprintf("%s:*", pCreating.Kind) + if creatorPerm, found = creatorMap[allProjects]; !found { + return false + } + } + if !hasLessThanOrEqualAccess(pCreating.Access, creatorPerm.Access) { + return false + } + } + return true +} diff --git a/src/server/v2.0/handler/role_test.go b/src/server/v2.0/handler/role_test.go new file mode 100644 index 00000000000..f782c0c7b46 --- /dev/null +++ b/src/server/v2.0/handler/role_test.go @@ -0,0 +1,276 @@ +// Copyright Project Harbor Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package handler + +import ( + "net/http" + "net/http/httptest" + "testing" + + "github.com/go-openapi/runtime" + "github.com/stretchr/testify/assert" + testifymock "github.com/stretchr/testify/mock" + + roleCtl "github.com/goharbor/harbor/src/controller/role" + "github.com/goharbor/harbor/src/lib/errors" + "github.com/goharbor/harbor/src/pkg/permission/types" + "github.com/goharbor/harbor/src/server/v2.0/models" + operation "github.com/goharbor/harbor/src/server/v2.0/restapi/operations/role" + securityMock "github.com/goharbor/harbor/src/testing/common/security" +) + +// --------------------------------------------------------------------------- +// checkSysAdmin +// --------------------------------------------------------------------------- + +func TestCheckSysAdmin_SysAdmin(t *testing.T) { + sc := &securityMock.Context{} + sc.On("IsAuthenticated").Return(true) + sc.On("IsSysAdmin").Return(true) + + err := (&roleAPI{}).checkSysAdmin(newCtxWithSecurity(sc)) + assert.NoError(t, err) +} + +func TestCheckSysAdmin_NonSysAdminForbidden(t *testing.T) { + sc := &securityMock.Context{} + sc.On("IsAuthenticated").Return(true) + sc.On("IsSysAdmin").Return(false) + + err := (&roleAPI{}).checkSysAdmin(newCtxWithSecurity(sc)) + assert.Error(t, err) + assert.Equal(t, errors.ForbiddenCode, errors.ErrCode(err)) +} + +func TestCheckSysAdmin_UnauthenticatedUnauthorized(t *testing.T) { + sc := &securityMock.Context{} + sc.On("IsAuthenticated").Return(false) + + err := (&roleAPI{}).checkSysAdmin(newCtxWithSecurity(sc)) + assert.Error(t, err) + assert.Equal(t, errors.UnAuthorizedCode, errors.ErrCode(err)) +} + +// --------------------------------------------------------------------------- +// CreateRole authorization gate (escalation prevention) +// --------------------------------------------------------------------------- + +// TestCreateRole_NonSysAdminForbidden proves that role definition is restricted +// to system admins: a non-sysadmin attempting to create a role with broad +// permissions is rejected at the checkSysAdmin gate before any role is created, +// so there is no privilege-escalation path through this handler. roleCtl is +// intentionally nil — the request must never reach it. +func TestCreateRole_NonSysAdminForbidden(t *testing.T) { + sc := &securityMock.Context{} + sc.On("IsAuthenticated").Return(true) + sc.On("IsSysAdmin").Return(false) + + api := &roleAPI{} + params := operation.CreateRoleParams{ + Role: &models.RoleCreate{ + Name: "escalated-role", + Permissions: []*models.RolePermission{ + { + Kind: roleCtl.LEVELROLE, + Namespace: "*", + Access: []*models.Access{ + {Resource: "repository", Action: "push"}, + }, + }, + }, + }, + } + + resp := api.CreateRole(newCtxWithSecurity(sc), params) + + rr := httptest.NewRecorder() + resp.WriteResponse(rr, runtime.JSONProducer()) + assert.Equal(t, http.StatusForbidden, rr.Code) +} + +// --------------------------------------------------------------------------- +// Delete / Update role handlers (auth gate + wiring) +// --------------------------------------------------------------------------- + +// A sysadmin can delete a custom role: the handler fetches it and returns 200. +func TestDeleteRole_Success(t *testing.T) { + sc := &securityMock.Context{} + sc.On("IsAuthenticated").Return(true) + sc.On("IsSysAdmin").Return(true) + + rc := &stubRoleCtl{} + rc.On("Get", testifymock.Anything, int64(5), testifymock.Anything). + Return(&roleCtl.Role{Editable: true}, nil) + + resp := (&roleAPI{roleCtl: rc}).DeleteRole(newCtxWithSecurity(sc), operation.DeleteRoleParams{RoleID: 5}) + + rr := httptest.NewRecorder() + resp.WriteResponse(rr, runtime.JSONProducer()) + assert.Equal(t, http.StatusOK, rr.Code) + rc.AssertCalled(t, "Get", testifymock.Anything, int64(5), testifymock.Anything) +} + +// A non-sysadmin cannot update a role — rejected at the gate before roleCtl is used. +func TestUpdateRole_NonSysAdminForbidden(t *testing.T) { + sc := &securityMock.Context{} + sc.On("IsAuthenticated").Return(true) + sc.On("IsSysAdmin").Return(false) + + resp := (&roleAPI{}).UpdateRole(newCtxWithSecurity(sc), operation.UpdateRoleParams{RoleID: 5}) + + rr := httptest.NewRecorder() + resp.WriteResponse(rr, runtime.JSONProducer()) + assert.Equal(t, http.StatusForbidden, rr.Code) +} + +// Updating a legacy/built-in (non-editable) role is denied even for a sysadmin. +func TestUpdateRole_LegacyRoleDenied(t *testing.T) { + sc := &securityMock.Context{} + sc.On("IsAuthenticated").Return(true) + sc.On("IsSysAdmin").Return(true) + + rc := &stubRoleCtl{} + rc.On("Get", testifymock.Anything, int64(1), testifymock.Anything). + Return(&roleCtl.Role{Editable: false}, nil) // built-in / legacy: immutable + + resp := (&roleAPI{roleCtl: rc}).UpdateRole(newCtxWithSecurity(sc), operation.UpdateRoleParams{RoleID: 1}) + + rr := httptest.NewRecorder() + resp.WriteResponse(rr, runtime.JSONProducer()) + assert.NotEqual(t, http.StatusOK, rr.Code, "updating an immutable role must be rejected") +} + +// --------------------------------------------------------------------------- +// validate +// --------------------------------------------------------------------------- + +func TestValidate_EmptyPermissions(t *testing.T) { + err := (&roleAPI{}).validate(nil) + assert.Error(t, err) + assert.Equal(t, errors.BadRequestCode, errors.ErrCode(err)) +} + +func TestValidate_EmptyAccess(t *testing.T) { + err := (&roleAPI{}).validate([]*models.RolePermission{ + {Kind: roleCtl.LEVELROLE, Access: []*models.Access{}}, + }) + assert.Error(t, err) + assert.Equal(t, errors.BadRequestCode, errors.ErrCode(err)) +} + +func TestValidate_WrongKind(t *testing.T) { + err := (&roleAPI{}).validate([]*models.RolePermission{ + {Kind: "system", Access: []*models.Access{{Resource: "member", Action: "create"}}}, + }) + assert.Error(t, err) + assert.Equal(t, errors.BadRequestCode, errors.ErrCode(err)) +} + +func TestValidate_UnknownResourceAction(t *testing.T) { + err := (&roleAPI{}).validate([]*models.RolePermission{ + {Kind: roleCtl.LEVELROLE, Access: []*models.Access{{Resource: "notaresource", Action: "notanaction"}}}, + }) + assert.Error(t, err) + assert.Equal(t, errors.BadRequestCode, errors.ErrCode(err)) +} + +func TestValidate_ValidPermission(t *testing.T) { + // "member:create" is a known ScopeRole permission (src/common/rbac/const.go) + err := (&roleAPI{}).validate([]*models.RolePermission{ + {Kind: roleCtl.LEVELROLE, Access: []*models.Access{{Resource: "member", Action: "create"}}}, + }) + assert.NoError(t, err) +} + +// --------------------------------------------------------------------------- +// containsRoleAccess +// --------------------------------------------------------------------------- + +func TestContainsRoleAccess_Present(t *testing.T) { + policies := []*types.Policy{ + {Resource: "member", Action: "create"}, + {Resource: "member", Action: "delete"}, + } + assert.True(t, containsRoleAccess(policies, &models.Access{Resource: "member", Action: "create"})) +} + +func TestContainsRoleAccess_Absent(t *testing.T) { + policies := []*types.Policy{ + {Resource: "member", Action: "create"}, + } + assert.False(t, containsRoleAccess(policies, &models.Access{Resource: "member", Action: "delete"})) +} + +func TestContainsRoleAccess_EmptyPolicies(t *testing.T) { + assert.False(t, containsRoleAccess(nil, &models.Access{Resource: "member", Action: "create"})) +} + +// --------------------------------------------------------------------------- +// isValidRolePermissionScope +// --------------------------------------------------------------------------- + +func rolePermissions(kind, ns string, accesses ...[2]string) []*models.RolePermission { + var access []*models.Access + for _, a := range accesses { + access = append(access, &models.Access{Resource: a[0], Action: a[1]}) + } + return []*models.RolePermission{{Kind: kind, Namespace: ns, Access: access}} +} + +func creatorPerms(kind, ns string, accesses ...[2]string) []*roleCtl.Permission { + var policies []*types.Policy + for _, a := range accesses { + policies = append(policies, &types.Policy{Resource: types.Resource(a[0]), Action: types.Action(a[1])}) + } + return []*roleCtl.Permission{{Kind: kind, Namespace: ns, Access: policies}} +} + +func TestIsValidRolePermissionScope_Subset(t *testing.T) { + creating := rolePermissions(roleCtl.LEVELROLE, "*", [2]string{"repository", "pull"}) + creator := creatorPerms(roleCtl.LEVELROLE, "*", [2]string{"repository", "pull"}, [2]string{"repository", "push"}) + assert.True(t, isValidRolePermissionScope(creating, creator)) +} + +func TestIsValidRolePermissionScope_Equal(t *testing.T) { + creating := rolePermissions(roleCtl.LEVELROLE, "*", [2]string{"repository", "pull"}, [2]string{"repository", "push"}) + creator := creatorPerms(roleCtl.LEVELROLE, "*", [2]string{"repository", "pull"}, [2]string{"repository", "push"}) + assert.True(t, isValidRolePermissionScope(creating, creator)) +} + +func TestIsValidRolePermissionScope_ExcessPerm(t *testing.T) { + creating := rolePermissions(roleCtl.LEVELROLE, "*", [2]string{"repository", "pull"}, [2]string{"repository", "push"}) + creator := creatorPerms(roleCtl.LEVELROLE, "*", [2]string{"repository", "pull"}) + assert.False(t, isValidRolePermissionScope(creating, creator)) +} + +func TestIsValidRolePermissionScope_EmptyCreating(t *testing.T) { + creator := creatorPerms(roleCtl.LEVELROLE, "*", [2]string{"repository", "pull"}) + assert.True(t, isValidRolePermissionScope(nil, creator)) +} + +func TestIsValidRolePermissionScope_ScopeNotInCreator(t *testing.T) { + creating := rolePermissions(roleCtl.LEVELROLE, "myns", [2]string{"repository", "pull"}) + creator := creatorPerms(roleCtl.LEVELROLE, "otherns", [2]string{"repository", "pull"}) + assert.False(t, isValidRolePermissionScope(creating, creator)) +} + +func TestIsValidRolePermissionScope_WildcardNamespaceMatches(t *testing.T) { + creating := rolePermissions(roleCtl.LEVELROLE, "specific", [2]string{"repository", "pull"}) + creator := creatorPerms(roleCtl.LEVELROLE, "*", [2]string{"repository", "pull"}) + assert.True(t, isValidRolePermissionScope(creating, creator)) +} + +// compile-time check: securityMock import used +var _ = testifymock.Anything diff --git a/src/testing/pkg/member/fake_member_manager.go b/src/testing/pkg/member/fake_member_manager.go index ff8fed8af1d..2f105d9a201 100644 --- a/src/testing/pkg/member/fake_member_manager.go +++ b/src/testing/pkg/member/fake_member_manager.go @@ -162,6 +162,34 @@ func (_m *Manager) GetTotalOfProjectMembers(ctx context.Context, projectID int64 return r0, r1 } +// GetTotalOfProjectMembersByRole provides a mock function with given fields: ctx, roleID +func (_m *Manager) GetTotalOfProjectMembersByRole(ctx context.Context, roleID int) (int, error) { + ret := _m.Called(ctx, roleID) + + if len(ret) == 0 { + panic("no return value specified for GetTotalOfProjectMembersByRole") + } + + var r0 int + var r1 error + if rf, ok := ret.Get(0).(func(context.Context, int) (int, error)); ok { + return rf(ctx, roleID) + } + if rf, ok := ret.Get(0).(func(context.Context, int) int); ok { + r0 = rf(ctx, roleID) + } else { + r0 = ret.Get(0).(int) + } + + if rf, ok := ret.Get(1).(func(context.Context, int) error); ok { + r1 = rf(ctx, roleID) + } else { + r1 = ret.Error(1) + } + + return r0, r1 +} + // List provides a mock function with given fields: ctx, queryMember, query func (_m *Manager) List(ctx context.Context, queryMember models.Member, query *q.Query) ([]*models.Member, error) { ret := _m.Called(ctx, queryMember, query) diff --git a/src/testing/pkg/role/dao/dao.go b/src/testing/pkg/role/dao/dao.go new file mode 100644 index 00000000000..a5f8e5f225e --- /dev/null +++ b/src/testing/pkg/role/dao/dao.go @@ -0,0 +1,191 @@ +// Code generated by mockery v2.53.3. DO NOT EDIT. + +package dao + +import ( + context "context" + + mock "github.com/stretchr/testify/mock" + + model "github.com/goharbor/harbor/src/pkg/role/model" + + q "github.com/goharbor/harbor/src/lib/q" +) + +// DAO is an autogenerated mock type for the DAO type +type DAO struct { + mock.Mock +} + +// Count provides a mock function with given fields: ctx, query +func (_m *DAO) Count(ctx context.Context, query *q.Query) (int64, error) { + ret := _m.Called(ctx, query) + + if len(ret) == 0 { + panic("no return value specified for Count") + } + + var r0 int64 + var r1 error + if rf, ok := ret.Get(0).(func(context.Context, *q.Query) (int64, error)); ok { + return rf(ctx, query) + } + if rf, ok := ret.Get(0).(func(context.Context, *q.Query) int64); ok { + r0 = rf(ctx, query) + } else { + r0 = ret.Get(0).(int64) + } + + if rf, ok := ret.Get(1).(func(context.Context, *q.Query) error); ok { + r1 = rf(ctx, query) + } else { + r1 = ret.Error(1) + } + + return r0, r1 +} + +// Create provides a mock function with given fields: ctx, r +func (_m *DAO) Create(ctx context.Context, r *model.Role) (int64, error) { + ret := _m.Called(ctx, r) + + if len(ret) == 0 { + panic("no return value specified for Create") + } + + var r0 int64 + var r1 error + if rf, ok := ret.Get(0).(func(context.Context, *model.Role) (int64, error)); ok { + return rf(ctx, r) + } + if rf, ok := ret.Get(0).(func(context.Context, *model.Role) int64); ok { + r0 = rf(ctx, r) + } else { + r0 = ret.Get(0).(int64) + } + + if rf, ok := ret.Get(1).(func(context.Context, *model.Role) error); ok { + r1 = rf(ctx, r) + } else { + r1 = ret.Error(1) + } + + return r0, r1 +} + +// Delete provides a mock function with given fields: ctx, id +func (_m *DAO) Delete(ctx context.Context, id int64) error { + ret := _m.Called(ctx, id) + + if len(ret) == 0 { + panic("no return value specified for Delete") + } + + var r0 error + if rf, ok := ret.Get(0).(func(context.Context, int64) error); ok { + r0 = rf(ctx, id) + } else { + r0 = ret.Error(0) + } + + return r0 +} + +// Get provides a mock function with given fields: ctx, id +func (_m *DAO) Get(ctx context.Context, id int64) (*model.Role, error) { + ret := _m.Called(ctx, id) + + if len(ret) == 0 { + panic("no return value specified for Get") + } + + var r0 *model.Role + var r1 error + if rf, ok := ret.Get(0).(func(context.Context, int64) (*model.Role, error)); ok { + return rf(ctx, id) + } + if rf, ok := ret.Get(0).(func(context.Context, int64) *model.Role); ok { + r0 = rf(ctx, id) + } else { + if ret.Get(0) != nil { + r0 = ret.Get(0).(*model.Role) + } + } + + if rf, ok := ret.Get(1).(func(context.Context, int64) error); ok { + r1 = rf(ctx, id) + } else { + r1 = ret.Error(1) + } + + return r0, r1 +} + +// List provides a mock function with given fields: ctx, query +func (_m *DAO) List(ctx context.Context, query *q.Query) ([]*model.Role, error) { + ret := _m.Called(ctx, query) + + if len(ret) == 0 { + panic("no return value specified for List") + } + + var r0 []*model.Role + var r1 error + if rf, ok := ret.Get(0).(func(context.Context, *q.Query) ([]*model.Role, error)); ok { + return rf(ctx, query) + } + if rf, ok := ret.Get(0).(func(context.Context, *q.Query) []*model.Role); ok { + r0 = rf(ctx, query) + } else { + if ret.Get(0) != nil { + r0 = ret.Get(0).([]*model.Role) + } + } + + if rf, ok := ret.Get(1).(func(context.Context, *q.Query) error); ok { + r1 = rf(ctx, query) + } else { + r1 = ret.Error(1) + } + + return r0, r1 +} + +// Update provides a mock function with given fields: ctx, r, props +func (_m *DAO) Update(ctx context.Context, r *model.Role, props ...string) error { + _va := make([]interface{}, len(props)) + for _i := range props { + _va[_i] = props[_i] + } + var _ca []interface{} + _ca = append(_ca, ctx, r) + _ca = append(_ca, _va...) + ret := _m.Called(_ca...) + + if len(ret) == 0 { + panic("no return value specified for Update") + } + + var r0 error + if rf, ok := ret.Get(0).(func(context.Context, *model.Role, ...string) error); ok { + r0 = rf(ctx, r, props...) + } else { + r0 = ret.Error(0) + } + + return r0 +} + +// NewDAO creates a new instance of DAO. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations. +// The first argument is typically a *testing.T value. +func NewDAO(t interface { + mock.TestingT + Cleanup(func()) +}) *DAO { + mock := &DAO{} + mock.Mock.Test(t) + + t.Cleanup(func() { mock.AssertExpectations(t) }) + + return mock +} diff --git a/src/testing/pkg/role/manager.go b/src/testing/pkg/role/manager.go new file mode 100644 index 00000000000..fc5c92d6d59 --- /dev/null +++ b/src/testing/pkg/role/manager.go @@ -0,0 +1,208 @@ +// Code generated by mockery v2.53.3. DO NOT EDIT. + +package role + +import ( + context "context" + + model "github.com/goharbor/harbor/src/pkg/role/model" + mock "github.com/stretchr/testify/mock" + + q "github.com/goharbor/harbor/src/lib/q" +) + +// Manager is an autogenerated mock type for the Manager type +type Manager struct { + mock.Mock +} + +// Count provides a mock function with given fields: ctx, query +func (_m *Manager) Count(ctx context.Context, query *q.Query) (int64, error) { + ret := _m.Called(ctx, query) + + if len(ret) == 0 { + panic("no return value specified for Count") + } + + var r0 int64 + var r1 error + if rf, ok := ret.Get(0).(func(context.Context, *q.Query) (int64, error)); ok { + return rf(ctx, query) + } + if rf, ok := ret.Get(0).(func(context.Context, *q.Query) int64); ok { + r0 = rf(ctx, query) + } else { + r0 = ret.Get(0).(int64) + } + + if rf, ok := ret.Get(1).(func(context.Context, *q.Query) error); ok { + r1 = rf(ctx, query) + } else { + r1 = ret.Error(1) + } + + return r0, r1 +} + +// Create provides a mock function with given fields: ctx, m +func (_m *Manager) Create(ctx context.Context, m *model.Role) (int64, error) { + ret := _m.Called(ctx, m) + + if len(ret) == 0 { + panic("no return value specified for Create") + } + + var r0 int64 + var r1 error + if rf, ok := ret.Get(0).(func(context.Context, *model.Role) (int64, error)); ok { + return rf(ctx, m) + } + if rf, ok := ret.Get(0).(func(context.Context, *model.Role) int64); ok { + r0 = rf(ctx, m) + } else { + r0 = ret.Get(0).(int64) + } + + if rf, ok := ret.Get(1).(func(context.Context, *model.Role) error); ok { + r1 = rf(ctx, m) + } else { + r1 = ret.Error(1) + } + + return r0, r1 +} + +// Delete provides a mock function with given fields: ctx, id +func (_m *Manager) Delete(ctx context.Context, id int64) error { + ret := _m.Called(ctx, id) + + if len(ret) == 0 { + panic("no return value specified for Delete") + } + + var r0 error + if rf, ok := ret.Get(0).(func(context.Context, int64) error); ok { + r0 = rf(ctx, id) + } else { + r0 = ret.Error(0) + } + + return r0 +} + +// DeleteByProjectID provides a mock function with given fields: ctx, projectID +func (_m *Manager) DeleteByProjectID(ctx context.Context, projectID int64) error { + ret := _m.Called(ctx, projectID) + + if len(ret) == 0 { + panic("no return value specified for DeleteByProjectID") + } + + var r0 error + if rf, ok := ret.Get(0).(func(context.Context, int64) error); ok { + r0 = rf(ctx, projectID) + } else { + r0 = ret.Error(0) + } + + return r0 +} + +// Get provides a mock function with given fields: ctx, id +func (_m *Manager) Get(ctx context.Context, id int64) (*model.Role, error) { + ret := _m.Called(ctx, id) + + if len(ret) == 0 { + panic("no return value specified for Get") + } + + var r0 *model.Role + var r1 error + if rf, ok := ret.Get(0).(func(context.Context, int64) (*model.Role, error)); ok { + return rf(ctx, id) + } + if rf, ok := ret.Get(0).(func(context.Context, int64) *model.Role); ok { + r0 = rf(ctx, id) + } else { + if ret.Get(0) != nil { + r0 = ret.Get(0).(*model.Role) + } + } + + if rf, ok := ret.Get(1).(func(context.Context, int64) error); ok { + r1 = rf(ctx, id) + } else { + r1 = ret.Error(1) + } + + return r0, r1 +} + +// List provides a mock function with given fields: ctx, query +func (_m *Manager) List(ctx context.Context, query *q.Query) ([]*model.Role, error) { + ret := _m.Called(ctx, query) + + if len(ret) == 0 { + panic("no return value specified for List") + } + + var r0 []*model.Role + var r1 error + if rf, ok := ret.Get(0).(func(context.Context, *q.Query) ([]*model.Role, error)); ok { + return rf(ctx, query) + } + if rf, ok := ret.Get(0).(func(context.Context, *q.Query) []*model.Role); ok { + r0 = rf(ctx, query) + } else { + if ret.Get(0) != nil { + r0 = ret.Get(0).([]*model.Role) + } + } + + if rf, ok := ret.Get(1).(func(context.Context, *q.Query) error); ok { + r1 = rf(ctx, query) + } else { + r1 = ret.Error(1) + } + + return r0, r1 +} + +// Update provides a mock function with given fields: ctx, m, props +func (_m *Manager) Update(ctx context.Context, m *model.Role, props ...string) error { + _va := make([]interface{}, len(props)) + for _i := range props { + _va[_i] = props[_i] + } + var _ca []interface{} + _ca = append(_ca, ctx, m) + _ca = append(_ca, _va...) + ret := _m.Called(_ca...) + + if len(ret) == 0 { + panic("no return value specified for Update") + } + + var r0 error + if rf, ok := ret.Get(0).(func(context.Context, *model.Role, ...string) error); ok { + r0 = rf(ctx, m, props...) + } else { + r0 = ret.Error(0) + } + + return r0 +} + +// NewManager creates a new instance of Manager. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations. +// The first argument is typically a *testing.T value. +func NewManager(t interface { + mock.TestingT + Cleanup(func()) +}) *Manager { + mock := &Manager{} + mock.Mock.Test(t) + + t.Cleanup(func() { mock.AssertExpectations(t) }) + + return mock +} diff --git a/tests/apitests/python/library/base.py b/tests/apitests/python/library/base.py index 11e90a05d01..7a6522d4446 100644 --- a/tests/apitests/python/library/base.py +++ b/tests/apitests/python/library/base.py @@ -61,6 +61,7 @@ def _create_client(server, credential, debug, api_type): "replication": v2_swagger_client.ReplicationApi(v2_swagger_client.ApiClient(cfg)), "registry": v2_swagger_client.RegistryApi(v2_swagger_client.ApiClient(cfg)), "robot": v2_swagger_client.RobotApi(v2_swagger_client.ApiClient(cfg)), + "role": v2_swagger_client.RoleApi(v2_swagger_client.ApiClient(cfg)), "gc": v2_swagger_client.GcApi(v2_swagger_client.ApiClient(cfg)), "retention": v2_swagger_client.RetentionApi(v2_swagger_client.ApiClient(cfg)), "immutable": v2_swagger_client.ImmutableApi(v2_swagger_client.ApiClient(cfg)), diff --git a/tests/integration/.gitignore b/tests/integration/.gitignore new file mode 100644 index 00000000000..558af38b0fd --- /dev/null +++ b/tests/integration/.gitignore @@ -0,0 +1,6 @@ +# local Python virtualenvs used to run the integration tests +test-harbor-role/ +venv/ +.venv/ +__pycache__/ +*.pyc diff --git a/tests/integration/test_custom_roles.py b/tests/integration/test_custom_roles.py new file mode 100644 index 00000000000..bd374bd08ac --- /dev/null +++ b/tests/integration/test_custom_roles.py @@ -0,0 +1,653 @@ +#!/usr/bin/env python3 +""" +Harbor Custom Roles - Automated Test Suite + +Sections: + 1. Role CRUD — create, update, delete; built-in immutability + 2. DB seeding — built-in roles have permissions via ListRole + 3. Member anti-escalation — POST/PUT /projects/{id}/members blocked when caller lacks perms + 4. Group anti-escalation — same check via group payload (LDAP/OIDC/HTTP modes) + 5. Sysadmin bypass — admin can assign any role + 6. Role display flags — is_builtin=true present on all built-in roles + 7. Edge cases — zero-permission custom role, empty roles list fallback + 8. Robot anti-escalation — POST/PUT /robots blocked when caller lacks requested perms + +Usage: + python3 test_custom_roles.py --url https://harbor.example.com \ + --user admin --password YourPassword + +Exit code 0 = all tests passed, 1 = one or more tests failed. +""" + +import argparse +import sys +import requests +import urllib3 + +urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) + +# --------------------------------------------------------------------------- +# Output helpers +# --------------------------------------------------------------------------- + +GREEN = '\033[92m' +RED = '\033[91m' +YELLOW = '\033[93m' +BOLD = '\033[1m' +RESET = '\033[0m' + +_passed = 0 +_failed = 0 +_skipped = 0 + + +def ok(msg): + global _passed + _passed += 1 + print(f" {GREEN}PASS{RESET} {msg}") + + +def fail(msg, detail=None): + global _failed + _failed += 1 + print(f" {RED}FAIL{RESET} {msg}") + if detail: + print(f" {RED}{detail}{RESET}") + + +def skip(msg): + global _skipped + _skipped += 1 + print(f" {YELLOW}SKIP{RESET} {msg}") + + +def section(title): + print(f"\n{BOLD}{'─' * 60}{RESET}") + print(f"{BOLD} {title}{RESET}") + print(f"{BOLD}{'─' * 60}{RESET}") + + +def assert_status(label, resp, expected): + if isinstance(expected, int): + expected = [expected] + if resp.status_code in expected: + ok(f"{label} → {resp.status_code}") + return True + else: + fail(f"{label} → expected {expected}, got {resp.status_code}", resp.text[:200]) + return False + + +# --------------------------------------------------------------------------- +# Minimal Harbor API client +# --------------------------------------------------------------------------- + +class Harbor: + def __init__(self, base_url, username, password, verify_ssl=False): + self.base = base_url.rstrip('/') + '/api/v2.0' + self.s = requests.Session() + self.s.verify = verify_ssl + self.s.auth = (username, password) + self.s.headers.update({'Content-Type': 'application/json'}) + + def get(self, path, **kw): return self.s.get(self.base + path, **kw) + def post(self, path, **kw): return self.s.post(self.base + path, **kw) + def put(self, path, **kw): return self.s.put(self.base + path, **kw) + def delete(self, path, **kw): return self.s.delete(self.base + path, **kw) + + def as_user(self, username, password): + return Harbor(self.base.replace('/api/v2.0', ''), username, password, self.s.verify) + + +# --------------------------------------------------------------------------- +# Permission fixtures +# --------------------------------------------------------------------------- + +PULL_ONLY_PERMS = [ + {"resource": "repository", "action": "pull"}, + {"resource": "repository", "action": "list"}, + {"resource": "repository", "action": "read"}, + {"resource": "artifact", "action": "read"}, + {"resource": "artifact", "action": "list"}, + {"resource": "artifact-addition", "action": "read"}, + {"resource": "tag", "action": "list"}, + {"resource": "accessory", "action": "list"}, +] + +PULL_ONLY_PERMS_V2 = PULL_ONLY_PERMS + [ + {"resource": "artifact", "action": "delete"}, +] + +def _role_body(name, access_list, description=""): + return { + "name": name, + "description": description, + "permissions": [{"kind": "project", "namespace": "*", "access": access_list}], + } + + +# --------------------------------------------------------------------------- +# Cleanup +# --------------------------------------------------------------------------- + +def cleanup(admin, state): + pid = state.get('project_id') + if pid: + for mid in state.get('member_ids', []): + admin.delete(f"/projects/{pid}/members/{mid}") + admin.delete(f"/projects/{pid}") + for uid in state.get('user_ids', []): + admin.delete(f"/users/{uid}") + for rid in state.get('custom_role_ids', []): + admin.delete(f"/roles/{rid}") + + +# --------------------------------------------------------------------------- +# Helper: find a role by name in a list +# --------------------------------------------------------------------------- + +def _find(roles, name): + return next((r for r in roles if r['name'] == name), None) + + +def _role_id_from_response(resp, admin, name): + """Extract role id from Location header or by re-listing.""" + loc = resp.headers.get('Location', '') + if loc: + try: + return int(loc.rstrip('/').split('/')[-1]) + except ValueError: + pass + body = resp.json() if resp.content else {} + if body.get('id'): + return body['id'] + # fall back: list and search by name + r = admin.get("/roles", params={"page": 1, "page_size": 100}) + return (_find(r.json(), name) or {}).get('id') + + +# --------------------------------------------------------------------------- +# Test runner +# --------------------------------------------------------------------------- + +def run(admin_url, admin_user, admin_pass): + admin = Harbor(admin_url, admin_user, admin_pass) + state = { + 'project_id': None, + 'user_ids': [], + 'member_ids': [], + 'custom_role_ids': [], + 'builtin': {}, # name → id + } + BUILTIN_NAMES = {'projectAdmin', 'maintainer', 'developer', 'guest', 'limitedGuest'} + + # ── 0. SETUP ──────────────────────────────────────────────────────────── + section("0. Setup") + + # Verify connectivity + r = admin.get("/systeminfo") + if r.status_code != 200: + fail("Cannot reach Harbor API — aborting", r.text[:200]) + return False + + # Collect built-in role IDs + r = admin.get("/roles", params={"page": 1, "page_size": 100}) + if not assert_status("GET /roles", r, 200): + return False + for role in r.json(): + if role['name'] in BUILTIN_NAMES: + state['builtin'][role['name']] = role['id'] + if len(state['builtin']) == 5: + ok(f"All 5 built-in roles found: {state['builtin']}") + else: + fail(f"Expected 5 built-in roles, got {len(state['builtin'])}: {list(state['builtin'])}") + + # Create test project + r = admin.post("/projects", json={"project_name": "cr-test", "metadata": {"public": "false"}}) + if r.status_code in (200, 201): + r2 = admin.get("/projects/cr-test") + state['project_id'] = r2.json()['id'] + ok(f"Created project 'cr-test' (id={state['project_id']})") + else: + fail("Could not create project", r.text[:200]) + return False + + # Create 3 test users: maintainer_user, guest_user, custom_user + users_created = [] + for uname in ["cr-maintainer", "cr-guest", "cr-custom"]: + r = admin.post("/users", json={ + "username": uname, "password": "Test1@3456", + "email": f"{uname}@cr-test.local", "realname": uname, + }) + if r.status_code in (200, 201): + r2 = admin.get("/users/search", params={"username": uname}) + uid = r2.json()[0]['user_id'] + state['user_ids'].append(uid) + users_created.append((uname, uid)) + ok(f"Created user '{uname}' (id={uid})") + else: + fail(f"Could not create user '{uname}'", r.text[:200]) + + if len(users_created) < 3: + skip("Not all test users created — some member tests will be skipped") + + # ── 1. ROLE CRUD ──────────────────────────────────────────────────────── + section("1. Role Management") + + # 1.1 Create custom role + r = admin.post("/roles", json=_role_body("cr-pull-only", PULL_ONLY_PERMS, "pull-only test role")) + if assert_status("POST /roles (create 'cr-pull-only')", r, [200, 201]): + rid = _role_id_from_response(r, admin, "cr-pull-only") + state['custom_role_ids'].append(rid) + ok(f" id={rid}") + + # Verify is_builtin = false + r2 = admin.get(f"/roles/{rid}") + if r2.status_code == 200 and r2.json().get('is_builtin') == False: + ok("Custom role has is_builtin=false") + else: + fail("Custom role should have is_builtin=false", r2.text[:200]) + + # 1.2 Edit custom role + r3 = admin.put(f"/roles/{rid}", json=_role_body("cr-pull-only", PULL_ONLY_PERMS_V2)) + assert_status(f"PUT /roles/{rid} (update permissions)", r3, [200, 204]) + + # Verify update reflected in GET + r4 = admin.get(f"/roles/{rid}") + if r4.status_code == 200: + access = [a for p in r4.json().get('permissions', []) for a in p.get('access', [])] + names = {f"{a['resource']}:{a['action']}" for a in access} + if "artifact:delete" in names: + ok("Updated permission (artifact:delete) visible in GET /roles/{id}") + else: + fail("Updated permission not reflected", str(names)) + else: + skip("Skipping edit/delete tests — role creation failed") + + # 1.3 Delete a throwaway custom role (no members) + r = admin.post("/roles", json=_role_body("cr-throwaway", [])) + if r.status_code in (200, 201): + tid = _role_id_from_response(r, admin, "cr-throwaway") + r2 = admin.delete(f"/roles/{tid}") + assert_status(f"DELETE /roles/{tid} (throwaway role)", r2, [200, 204]) + else: + skip("Could not create throwaway role for delete test") + + # 1.4 Built-in roles are immutable + for name, rid in state['builtin'].items(): + r = admin.delete(f"/roles/{rid}") + if r.status_code in (400, 403): + ok(f"DELETE built-in '{name}' → {r.status_code} (blocked)") + else: + fail(f"DELETE built-in '{name}' should be blocked, got {r.status_code}") + + r = admin.put(f"/roles/{rid}", json=_role_body(name, [])) + if r.status_code in (400, 403): + ok(f"PUT built-in '{name}' → {r.status_code} (blocked)") + else: + fail(f"PUT built-in '{name}' should be blocked, got {r.status_code}") + + # ── 2. DB SEEDING — permissions returned by ListRole ──────────────────── + section("2. Built-in Role Permission Seeding") + + r = admin.get("/roles", params={"page": 1, "page_size": 100}) + all_roles = r.json() + for role in all_roles: + if role['name'] not in BUILTIN_NAMES: + continue + count = sum(len(p.get('access', [])) for p in role.get('permissions', [])) + if count > 0: + ok(f"Built-in '{role['name']}' → {count} permission entries in DB") + else: + fail(f"Built-in '{role['name']}' has 0 permissions — migration 0190 seeding failed?") + + # ── 3. MEMBER ADDITION — anti-escalation ──────────────────────────────── + section("3. Member Addition — Anti-Escalation") + + pid = state['project_id'] + B = state['builtin'] + + if len(users_created) < 3: + skip("Skipping all member tests (test users missing)") + else: + maintainer_name, maintainer_uid = users_created[0] + guest_name, guest_uid = users_created[1] + custom_name, custom_uid = users_created[2] + custom_role_id = state['custom_role_ids'][0] if state['custom_role_ids'] else None + + # Add cr-maintainer as maintainer (as admin) + r = admin.post(f"/projects/{pid}/members", json={ + "role_id": B['maintainer'], + "member_user": {"user_id": maintainer_uid}, + }) + if assert_status(f"Admin adds '{maintainer_name}' as maintainer", r, [200, 201]): + state['member_ids'].append(r.headers.get('Location', '').rstrip('/').split('/')[-1]) + + # ── 3a. Maintainer tries to add projectAdmin (escalation) ───────── + m_client = Harbor(admin_url, maintainer_name, "Test1@3456") + + r = m_client.post(f"/projects/{pid}/members", json={ + "role_id": B['projectAdmin'], + "member_user": {"user_id": guest_uid}, + }) + assert_status("Maintainer→projectAdmin (escalation) blocked", r, 403) + + # ── 3b. Maintainer tries to add guest (valid) ───────────────────── + r = m_client.post(f"/projects/{pid}/members", json={ + "role_id": B['guest'], + "member_user": {"user_id": guest_uid}, + }) + if assert_status("Maintainer→guest (valid assignment)", r, [200, 201]): + guest_mid = r.headers.get('Location', '').rstrip('/').split('/')[-1] + state['member_ids'].append(guest_mid) + + # ── 3c. Maintainer tries to change guest→projectAdmin via PUT ── + r2 = m_client.put(f"/projects/{pid}/members/{guest_mid}", json={ + "role_id": B['projectAdmin'], + }) + assert_status("Maintainer→PUT projectAdmin (escalation) blocked", r2, 403) + + # ── 3d. Maintainer changes guest→developer (valid PUT) ───────── + r3 = m_client.put(f"/projects/{pid}/members/{guest_mid}", json={ + "role_id": B['developer'], + }) + assert_status("Maintainer→PUT developer (valid)", r3, [200, 204]) + + # ── 3e. Admin adds cr-custom with custom pull-only role ─────────── + if custom_role_id: + r = admin.post(f"/projects/{pid}/members", json={ + "role_id": custom_role_id, + "member_user": {"user_id": custom_uid}, + }) + if assert_status(f"Admin assigns custom role to '{custom_name}'", r, [200, 201]): + state['member_ids'].append(r.headers.get('Location', '').rstrip('/').split('/')[-1]) + + # Pull-only user tries to add guest (escalation — guest has more perms) + c_client = Harbor(admin_url, custom_name, "Test1@3456") + r2 = c_client.post(f"/projects/{pid}/members", json={ + "role_id": B['guest'], + "member_user": {"username": admin_user}, + }) + assert_status("Custom(pull-only)→guest (escalation) blocked", r2, 403) + + # Pull-only user tries to add someone with same custom role (valid) + # Create a 4th user for this + r3 = admin.post("/users", json={ + "username": "cr-extra", "password": "Test1@3456", + "email": "cr-extra@cr-test.local", "realname": "cr-extra", + }) + if r3.status_code in (200, 201): + r4 = admin.get("/users/search", params={"username": "cr-extra"}) + extra_uid = r4.json()[0]['user_id'] + state['user_ids'].append(extra_uid) + r5 = c_client.post(f"/projects/{pid}/members", json={ + "role_id": custom_role_id, + "member_user": {"user_id": extra_uid}, + }) + assert_status("Custom(pull-only)→same custom role (valid)", r5, [200, 201]) + if r5.status_code in (200, 201): + state['member_ids'].append( + r5.headers.get('Location', '').rstrip('/').split('/')[-1]) + + # ── 4. +GROUP MODAL — API equivalent ──────────────────────────────────── + section("4. Group Role Assignment — Anti-Escalation") + + # Harbor only supports groups when LDAP/OIDC is configured. + # We test the API directly with a user_group payload in HTTP-auth mode + # (if group type is not supported the endpoint returns 400/422, not 403 — + # so we only run this check when we can confirm group support). + r = admin.get("/systeminfo") + auth_mode = r.json().get('auth_mode', 'db_auth') if r.status_code == 200 else 'db_auth' + if auth_mode in ('ldap_auth', 'http_auth', 'oidc_auth'): + if len(users_created) >= 1: + m_client = Harbor(admin_url, users_created[0][0], "Test1@3456") + r = m_client.post(f"/projects/{pid}/members", json={ + "role_id": B.get('projectAdmin'), + "member_group": {"group_name": "test-group", "group_type": 1}, + }) + assert_status("Maintainer→group as projectAdmin (escalation) blocked", r, 403) + else: + skip(f"Auth mode is '{auth_mode}' — group escalation test skipped (no group support)") + + # ── 5. SYSADMIN BYPASS ─────────────────────────────────────────────────── + section("5. Sysadmin Bypass") + + if pid and len(users_created) >= 1: + _, target_uid = users_created[0] + r = admin.put(f"/projects/{pid}/members/{state['member_ids'][0]}", json={ + "role_id": B['projectAdmin'], + }) + # Admin setting someone to projectAdmin must always succeed (200 or 204) + assert_status("Sysadmin can assign projectAdmin (no restriction)", r, [200, 204]) + + # ── 6. ROLE DISPLAY — translation key check ────────────────────────────── + section("6. Role Display Keys") + + EXPECTED_KEYS = { + 'projectAdmin': 'MEMBER.PROJECT_ADMIN', + 'maintainer': 'MEMBER.PROJECT_MAINTAINER', + 'developer': 'MEMBER.DEVELOPER', + 'guest': 'MEMBER.GUEST', + 'limitedGuest': 'MEMBER.LIMITED_GUEST', + } + r = admin.get("/roles", params={"page": 1, "page_size": 100}) + for role in r.json(): + if role['name'] in EXPECTED_KEYS: + if role.get('is_builtin'): + ok(f"Built-in role '{role['name']}' has is_builtin=true (badge will render)") + else: + fail(f"Built-in role '{role['name']}' missing is_builtin=true flag") + + # ── 7. EDGE CASES ──────────────────────────────────────────────────────── + section("7. Edge Cases") + + # Custom role with zero permissions — anyone can assign it (subset of anything) + r = admin.post("/roles", json=_role_body("cr-empty", [])) + if r.status_code in (200, 201): + empty_rid = _role_id_from_response(r, admin, "cr-empty") + state['custom_role_ids'].append(empty_rid) + if len(users_created) >= 1: + m_client = Harbor(admin_url, users_created[0][0], "Test1@3456") + r2 = m_client.post(f"/projects/{pid}/members", json={ + "role_id": empty_rid, + "member_user": {"user_id": users_created[1][1] if len(users_created) > 1 else users_created[0][1]}, + }) + # maintainer has all superset permissions over empty role — should succeed + if r2.status_code in (200, 201): + ok("Maintainer can assign zero-permission role (subset of everything)") + state['member_ids'].append(r2.headers.get('Location', '').rstrip('/').split('/')[-1]) + elif r2.status_code == 409: + ok("Zero-permission role assignment: member already exists (409 — acceptable)") + else: + fail(f"Maintainer should be able to assign empty role, got {r2.status_code}", r2.text[:200]) + else: + skip("Could not create zero-permission role for edge case test") + + # ── 8. ROBOT ANTI-ESCALATION ───────────────────────────────────────────── + section("8. Robot Anti-Escalation") + + # validateNoEscalation fires when a human (local) user calls POST/PUT /robots. + # It checks each requested robot permission against the caller's own project perms. + # + # Important: only users with robot:create can create robots at all. + # Built-in roles with robot:create: projectAdmin only. + # Maintainer has robot:read + robot:list but NOT robot:create. + # + # To test anti-escalation we create a custom role that has robot:create + + # repository:pull/push but deliberately omits member:create. A user with + # that role can create robots scoped to pull/push but not to member:create. + + project_name = "cr-test" + + def robot_body(name, access_list): + return { + "name": name, + "description": "test robot", + "duration": -1, + "level": "project", + "permissions": [{"kind": "project", "namespace": project_name, "access": access_list}], + } + + robot_ids = [] + + if not pid: + skip("Skipping robot tests (project missing)") + else: + # ── 8a. Sysadmin creates robot with any perms (no restriction) ──── + r = admin.post("/robots", json=robot_body("cr-robot-admin", [ + {"resource": "repository", "action": "pull"}, + {"resource": "repository", "action": "push"}, + {"resource": "member", "action": "create"}, + ])) + if assert_status("Sysadmin creates robot with member:create → 201", r, [200, 201]): + rid = r.json().get('id') + if rid: + robot_ids.append(rid) + + # ── 8b. Create a "robot-manager" custom role ────────────────────── + # Has robot:create/read/update/delete/list + repository:pull/push + # but deliberately omits member:* and configuration:* permissions. + robot_mgr_perms = [ + {"resource": "robot", "action": "create"}, + {"resource": "robot", "action": "read"}, + {"resource": "robot", "action": "update"}, + {"resource": "robot", "action": "delete"}, + {"resource": "robot", "action": "list"}, + {"resource": "repository", "action": "pull"}, + {"resource": "repository", "action": "push"}, + {"resource": "repository", "action": "list"}, + {"resource": "repository", "action": "read"}, + {"resource": "artifact", "action": "read"}, + {"resource": "artifact", "action": "list"}, + {"resource": "tag", "action": "list"}, + ] + r = admin.post("/roles", json=_role_body("cr-robot-mgr", robot_mgr_perms)) + robot_mgr_role_id = None + if r.status_code in (200, 201): + robot_mgr_role_id = _role_id_from_response(r, admin, "cr-robot-mgr") + state['custom_role_ids'].append(robot_mgr_role_id) + ok(f"Created 'cr-robot-mgr' custom role (id={robot_mgr_role_id})") + else: + fail("Could not create robot-manager custom role", r.text[:200]) + + # Create a user and assign robot-manager role + robot_mgr_uid = None + robot_mgr_name = "cr-robotmgr" + r = admin.post("/users", json={ + "username": robot_mgr_name, "password": "Test1@3456", + "email": f"{robot_mgr_name}@cr-test.local", "realname": robot_mgr_name, + }) + if r.status_code in (200, 201): + r2 = admin.get("/users/search", params={"username": robot_mgr_name}) + robot_mgr_uid = r2.json()[0]['user_id'] + state['user_ids'].append(robot_mgr_uid) + ok(f"Created user '{robot_mgr_name}' (id={robot_mgr_uid})") + else: + fail(f"Could not create user '{robot_mgr_name}'", r.text[:200]) + + if robot_mgr_role_id and robot_mgr_uid: + r = admin.post(f"/projects/{pid}/members", json={ + "role_id": robot_mgr_role_id, + "member_user": {"user_id": robot_mgr_uid}, + }) + if assert_status(f"Assign '{robot_mgr_name}' robot-manager role", r, [200, 201]): + state['member_ids'].append(r.headers.get('Location', '').rstrip('/').split('/')[-1]) + + rm_client = Harbor(admin_url, robot_mgr_name, "Test1@3456") + + # ── 8c. robot-manager creates robot within their permissions ────── + r = rm_client.post("/robots", json=robot_body("cr-robot-rm-valid", [ + {"resource": "repository", "action": "pull"}, + {"resource": "repository", "action": "push"}, + ])) + valid_robot_id = None + if assert_status("robot-manager creates robot with pull+push → 201", r, [200, 201]): + valid_robot_id = r.json().get('id') + if valid_robot_id: + robot_ids.append(valid_robot_id) + + # ── 8d. robot-manager tries robot with member:create (escalation) ─ + r = rm_client.post("/robots", json=robot_body("cr-robot-rm-escalate", [ + {"resource": "repository", "action": "pull"}, + {"resource": "member", "action": "create"}, + ])) + assert_status("robot-manager creates robot with member:create → 403 (escalation)", r, 403) + + # ── 8e. robot-manager updates existing robot to add member:delete ─ + if valid_robot_id: + r = rm_client.put(f"/robots/{valid_robot_id}", json=robot_body("cr-robot-rm-valid", [ + {"resource": "repository", "action": "pull"}, + {"resource": "repository", "action": "push"}, + {"resource": "member", "action": "delete"}, + ])) + assert_status("robot-manager updates robot to add member:delete → 403 (escalation)", r, 403) + + # Valid update — stays within role's permissions + r = rm_client.put(f"/robots/{valid_robot_id}", json=robot_body("cr-robot-rm-valid", [ + {"resource": "repository", "action": "pull"}, + ])) + assert_status("robot-manager updates robot to pull-only → 200 (valid)", r, [200, 204]) + + # ── 8f. robot-manager creates robot with zero permissions ───────── + r = rm_client.post("/robots", json=robot_body("cr-robot-rm-empty", [])) + if assert_status("robot-manager creates robot with no permissions → 201", r, [200, 201]): + rid = r.json().get('id') + if rid: + robot_ids.append(rid) + + # ── 8g. Confirm maintainer cannot create robots at all ──────────── + # (not an anti-escalation case — maintainer simply lacks robot:create) + if len(users_created) >= 1: + m_client = Harbor(admin_url, users_created[0][0], "Test1@3456") + r = m_client.post("/robots", json=robot_body("cr-robot-m-attempt", [ + {"resource": "repository", "action": "pull"}, + ])) + if r.status_code in (403, 401): + ok(f"Maintainer cannot create robots (lacks robot:create) → {r.status_code}") + else: + fail(f"Expected 403/401 for maintainer robot creation, got {r.status_code}", r.text[:200]) + + # Cleanup robots + for rid in robot_ids: + admin.delete(f"/robots/{rid}") + if robot_ids: + ok(f"Cleaned up {len(robot_ids)} test robot(s)") + + # ── CLEANUP ────────────────────────────────────────────────────────────── + section("Cleanup") + cleanup(admin, state) + ok("All test artifacts removed") + + # ── SUMMARY ────────────────────────────────────────────────────────────── + print(f"\n{'═' * 60}") + print(f" {BOLD}Results:{RESET} " + f"{GREEN}{_passed} passed{RESET} " + f"{RED}{_failed} failed{RESET} " + f"{YELLOW}{_skipped} skipped{RESET}") + print(f"{'═' * 60}\n") + return _failed == 0 + + +# --------------------------------------------------------------------------- +# Entry point +# --------------------------------------------------------------------------- + +def main(): + parser = argparse.ArgumentParser( + description="Harbor Custom Roles — Automated Test Suite", + formatter_class=argparse.RawDescriptionHelpFormatter, + epilog=__doc__, + ) + parser.add_argument("--url", required=True, help="Harbor base URL, e.g. https://harbor.example.com") + parser.add_argument("--user", required=True, help="Admin username") + parser.add_argument("--password", required=True, help="Admin password") + parser.add_argument("--verify-ssl", action="store_true", default=False, + help="Verify TLS certificate (default: skip verification)") + args = parser.parse_args() + + success = run(args.url, args.user, args.password) + sys.exit(0 if success else 1) + + +if __name__ == "__main__": + main()