Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

refact: update token factory #13596

Merged
merged 2 commits into from
Jul 5, 2022
Merged

refact: update token factory #13596

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
efe62f3
refact: update rulesJSON in token factory to reflect schema update
ChaiWithJai Jul 5, 2022
dd6f9bd
refact: update capability names (#13597)
ChaiWithJai Jul 5, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions ui/app/abilities/variable.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,9 +28,9 @@ export default class Variable extends AbstractAbility {
@or(
'bypassAuthorization',
'selfTokenIsManagement',
'policiesSupportVariableCreation'
'policiesSupportVariableWriting'
)
canCreate;
canWrite;

@computed('rulesForNamespace.@each.capabilities')
get policiesSupportVariableView() {
Expand All @@ -40,12 +40,12 @@ export default class Variable extends AbstractAbility {
}

@computed('rulesForNamespace.@each.capabilities', 'path')
get policiesSupportVariableCreation() {
get policiesSupportVariableWriting() {
const matchingPath = this._nearestMatchingPath(this.path);
return this.rulesForNamespace.some((rules) => {
const keyName = `SecureVariables.Path "${matchingPath}".Capabilities`;
const capabilities = get(rules, keyName) || [];
return capabilities.includes('create');
return capabilities.includes('write');
});
}

Expand Down
2 changes: 1 addition & 1 deletion ui/app/templates/variables/index.hbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@
</div>
<div class="toolbar-item is-right-aligned is-mobile-full-width">
<div class="button-bar">
{{#if (can "create variable" path="*")}}
{{#if (can "write variable" path="*")}}
<LinkTo
@route="variables.new"
class="button is-primary"
Expand Down
2 changes: 1 addition & 1 deletion ui/app/templates/variables/path.hbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
<div class="toolbar">
<div class="toolbar-item is-right-aligned is-mobile-full-width">
<div class="button-bar">
{{#if (can "create variable" path=this.model.absolutePath)}}
{{#if (can "write variable" path=this.model.absolutePath)}}
<LinkTo
@route="variables.new"
@query={{hash path=(concat this.model.absolutePath "/")}}
Expand Down
2 changes: 1 addition & 1 deletion ui/app/templates/variables/variable/index.hbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@
</div>
<div>
{{#unless this.isDeleting}}
{{#if (can "create variable" path=this.model.absolutePath)}}
{{#if (can "write variable" path=this.model.absolutePath)}}
<div class="two-step-button">
<LinkTo
data-test-edit-button
Expand Down
33 changes: 26 additions & 7 deletions ui/mirage/factories/token.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,8 +38,19 @@ namespace "default" {
policy = "read"
capabilities = ["list-jobs", "alloc-exec", "read-logs"]
secure_variables {
# full access to secrets in all project paths
path "blue/*" {
capabilities = ["write", "read", "destroy", "list"]
}

# full access to secrets in all project paths
path "*" {
capabilities = ["list"]
capabilities = ["write", "read", "destroy", "list"]
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thought: maybe we should leave the * capabilities for our demo token to just read and list? That way testers can experience what a limited experience looks like (and anything under project/* could be used to demonstrate higher-capability stuff like editing)

}

# read/list access within a "system" path belonging to administrators
path "system/*" {
capabilities = ["read", "list"]
}
}
}
Expand All @@ -55,12 +66,20 @@ node {
Name: 'default',
Capabilities: ['list-jobs', 'alloc-exec', 'read-logs'],
SecureVariables: {
'Path "*"': {
Capabilities: ['list', 'create'],
},
'Path "blue/berkshire"': {
Capabilities: ['list', 'create', 'edit', 'delete'],
},
Paths: [
{
Capabilities: ['write', 'read', 'destroy', 'list'],
PathSpec: 'blue/*',
},
{
Capabilities: ['write', 'read', 'destroy', 'list'],
PathSpec: '*',
},
{
Capabilities: ['read', 'list'],
PathSpec: 'system/*',
},
],
},
},
],
Expand Down
36 changes: 18 additions & 18 deletions ui/tests/unit/abilities/variable-test.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,7 +109,7 @@ module('Unit | Ability | variable', function (hooks) {

this.owner.register('service:token', mockToken);

assert.notOk(this.ability.canCreate);
assert.notOk(this.ability.canWrite);
});

test('it permits creating variables when token type is management', function (assert) {
Expand All @@ -120,7 +120,7 @@ module('Unit | Ability | variable', function (hooks) {

this.owner.register('service:token', mockToken);

assert.ok(this.ability.canCreate);
assert.ok(this.ability.canWrite);
});

test('it permits creating variables when acl is disabled', function (assert) {
Expand All @@ -131,10 +131,10 @@ module('Unit | Ability | variable', function (hooks) {

this.owner.register('service:token', mockToken);

assert.ok(this.ability.canCreate);
assert.ok(this.ability.canWrite);
});

test('it permits creating variables when token has SecureVariables with create capabilities in its rules', function (assert) {
test('it permits creating variables when token has SecureVariables with write capabilities in its rules', function (assert) {
const mockToken = Service.extend({
aclEnabled: true,
selfToken: { type: 'client' },
Expand All @@ -147,7 +147,7 @@ module('Unit | Ability | variable', function (hooks) {
Capabilities: [],
SecureVariables: {
'Path "*"': {
Capabilities: ['create'],
Capabilities: ['write'],
},
},
},
Expand All @@ -159,7 +159,7 @@ module('Unit | Ability | variable', function (hooks) {

this.owner.register('service:token', mockToken);

assert.ok(this.ability.canCreate);
assert.ok(this.ability.canWrite);
});

test('it handles namespace matching', function (assert) {
Expand All @@ -184,7 +184,7 @@ module('Unit | Ability | variable', function (hooks) {
Capabilities: [],
SecureVariables: {
'Path "foo/bar"': {
Capabilities: ['create'],
Capabilities: ['write'],
},
},
},
Expand All @@ -198,7 +198,7 @@ module('Unit | Ability | variable', function (hooks) {
this.ability.path = 'foo/bar';
this.ability.namespace = 'pablo';

assert.ok(this.ability.canCreate);
assert.ok(this.ability.canWrite);
});
});

Expand All @@ -216,7 +216,7 @@ module('Unit | Ability | variable', function (hooks) {
Capabilities: [],
SecureVariables: {
'Path "foo"': {
Capabilities: ['create'],
Capabilities: ['write'],
},
},
},
Expand Down Expand Up @@ -251,10 +251,10 @@ module('Unit | Ability | variable', function (hooks) {
Capabilities: [],
SecureVariables: {
'Path "foo/*"': {
Capabilities: ['create'],
Capabilities: ['write'],
},
'Path "foo/bar/*"': {
Capabilities: ['create'],
Capabilities: ['write'],
},
},
},
Expand Down Expand Up @@ -289,7 +289,7 @@ module('Unit | Ability | variable', function (hooks) {
Capabilities: [],
SecureVariables: {
'Path "foo/*"': {
Capabilities: ['create'],
Capabilities: ['write'],
},
},
},
Expand Down Expand Up @@ -324,10 +324,10 @@ module('Unit | Ability | variable', function (hooks) {
Capabilities: [],
SecureVariables: {
'Path "*/bar"': {
Capabilities: ['create'],
Capabilities: ['write'],
},
'Path "*/bar/baz"': {
Capabilities: ['create'],
Capabilities: ['write'],
},
},
},
Expand Down Expand Up @@ -362,10 +362,10 @@ module('Unit | Ability | variable', function (hooks) {
Capabilities: [],
SecureVariables: {
'Path "*/bar"': {
Capabilities: ['create'],
Capabilities: ['write'],
},
'Path "foo/*"': {
Capabilities: ['create'],
Capabilities: ['write'],
},
},
},
Expand Down Expand Up @@ -400,10 +400,10 @@ module('Unit | Ability | variable', function (hooks) {
Capabilities: [],
SecureVariables: {
'Path "*"': {
Capabilities: ['create'],
Capabilities: ['write'],
},
'Path "foo"': {
Capabilities: ['create'],
Capabilities: ['write'],
},
},
},
Expand Down