ReleaseTrain Role Based Access Control

services/cd-service/pkg/repository/transformer.go

@@ -984,6 +984,7 @@ func (c *DeployApplicationVersion) Transform(ctx context.Context, state *State)
 }
 
 type ReleaseTrain struct {
+	Authentication
 	Target string
 	Team   string
 }
@@ -1055,6 +1056,11 @@ func (c *ReleaseTrain) Transform(ctx context.Context, state *State) (string, err
 		if envConfig.Upstream == nil {
 			return fmt.Sprintf("Environment %q does not have upstream configured - exiting.", envName), nil
 		}
+		err := state.checkUserPermissions(ctx, envName, "*", auth.PermissionDeployReleaseTrain, c.RBACConfig)
+		if err != nil {
+			return "", err
+		}
+
 		var upstreamLatest = envConfig.Upstream.Latest
 		var upstreamEnvName = envConfig.Upstream.Environment
 
@@ -1136,10 +1142,11 @@ func (c *ReleaseTrain) Transform(ctx context.Context, state *State) (string, err
 			}
 
 			d := &DeployApplicationVersion{
-				Environment:   envName, // here we deploy to the next env
-				Application:   appName,
-				Version:       versionToDeploy,
-				LockBehaviour: api.LockBehavior_Record,
+				Environment:    envName, // here we deploy to the next env
+				Application:    appName,
+				Version:        versionToDeploy,
+				LockBehaviour:  api.LockBehavior_Record,
+				Authentication: c.Authentication,
 			}
 			transform, err := d.Transform(ctx, state)
 			if err != nil {

services/cd-service/pkg/repository/transformer_test.go

@@ -793,6 +793,34 @@ func TestRbacTransformerTest(t *testing.T) {
 		Transformers  []Transformer
 		ExpectedError string
 	}{
+		{
+			Name: "able to create release train with permissions policy",
+			Transformers: ReleaseTrainTestSetup(&ReleaseTrain{
+				Target: envProduction,
+				Authentication: Authentication{RBACConfig: auth.RBACConfig{DexEnabled: true, Policy: map[string]*auth.Permission{
+					"developer,DeployReleaseTrain,production:production,*,allow": {Role: "developer"},
+					"developer,DeployRelease,production:*,test,allow":            {Role: "developer"},
+				}}},
+			}),
+		},
+		{
+			Name: "unable to create release train without permissions policy: Missing DeployRelease permission",
+			Transformers: ReleaseTrainTestSetup(&ReleaseTrain{
+				Target: envProduction,
+				Authentication: Authentication{RBACConfig: auth.RBACConfig{DexEnabled: true, Policy: map[string]*auth.Permission{
+					"developer,DeployReleaseTrain,production:production,*,allow": {Role: "developer"},
+				}}},
+			}),
+			ExpectedError: "rpc error: code = Internal desc = internal error",
+		},
+		{
+			Name: "unable to create release train without permissions policy: Missing ReleaseTrain permission",
+			Transformers: ReleaseTrainTestSetup(&ReleaseTrain{
+				Target:         envProduction,
+				Authentication: Authentication{RBACConfig: auth.RBACConfig{DexEnabled: true, Policy: map[string]*auth.Permission{}}},
+			}),
+			ExpectedError: "user does not have permissions for: developer,DeployReleaseTrain,production:production,*,allow",
+		},
 		{
 			Name: "able to create application version with permissions policy",
 			Transformers: []Transformer{
@@ -1157,6 +1185,56 @@ func TestRbacTransformerTest(t *testing.T) {
 	}
 }
 
+// Helper method to setup release train unit tests.
+func ReleaseTrainTestSetup(releaseTrainTransformer Transformer) []Transformer {
+	return append([]Transformer{
+		&CreateEnvironment{
+			Environment: envProduction,
+			Config: config.EnvironmentConfig{
+				Upstream: &config.EnvironmentConfigUpstream{
+					Environment: envAcceptance, // train drives from acceptance to production
+				},
+			},
+		},
+		&CreateEnvironment{
+			Environment: envAcceptance,
+			Config: config.EnvironmentConfig{
+				Upstream: &config.EnvironmentConfigUpstream{
+					Latest: true,
+				},
+			},
+		},
+		&CreateApplicationVersion{
+			Application: "test",
+			Manifests: map[string]string{
+				envProduction: "productionmanifest",
+				envAcceptance: "acceptancenmanifest",
+			},
+		},
+		&DeployApplicationVersion{
+			Environment: envProduction,
+			Application: "test",
+			Version:     1,
+		},
+		&CreateApplicationVersion{
+			Application: "test",
+			Manifests: map[string]string{
+				envProduction: "productionmanifest",
+				envAcceptance: "acceptancenmanifest",
+			},
+		},
+		&DeployApplicationVersion{
+			Environment: envAcceptance,
+			Application: "test",
+			Version:     1,
+		},
+		&DeployApplicationVersion{
+			Environment: envAcceptance,
+			Application: "test",
+			Version:     2,
+		}}, releaseTrainTransformer)
+}
+
 func TestTransformer(t *testing.T) {
 	c1 := config.EnvironmentConfig{Upstream: &config.EnvironmentConfigUpstream{Latest: true}}
 

services/cd-service/pkg/service/batch.go

@@ -190,8 +190,9 @@ func (d *BatchServer) processAction(
 			return nil, nil, status.Error(codes.InvalidArgument, "invalid Team name")
 		}
 		return &repository.ReleaseTrain{
-				Target: in.Target,
-				Team:   in.Team,
+				Target:         in.Target,
+				Team:           in.Team,
+				Authentication: repository.Authentication{RBACConfig: d.RBACConfig},
 			}, &api.BatchResult{
 				Result: &api.BatchResult_ReleaseTrain{
 					ReleaseTrain: &api.ReleaseTrainResponse{Target: in.Target, Team: in.Team},