Merge pull request #279 from OpsMx/OP-16464-pipeline-rbac-v4.0

OP-18094: integrate pipeline trigger to verify fiat permissions
spinnaker · Nov 1, 2022 · 6e27f32 · 6e27f32
2 parents 082222d + ac43a20
commit 6e27f32
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 2 deletions.
diff --git a/build.gradle b/build.gradle
@@ -17,6 +17,9 @@ allprojects {
     if ([korkVersion, fiatVersion].find { it.endsWith('-SNAPSHOT') }) {
       repositories {
         mavenLocal()
+        maven{
+          url "https://nexus.opsmx.net/repository/maven-snapshots/"
+        }
       }
     }
 

diff --git a/gate-web/src/main/groovy/com/netflix/spinnaker/gate/controllers/PipelineController.groovy b/gate-web/src/main/groovy/com/netflix/spinnaker/gate/controllers/PipelineController.groovy
@@ -250,7 +250,7 @@ class PipelineController {
   }
 
   @ApiOperation(value = "Trigger a pipeline execution", response = Map.class)
-  @PreAuthorize("hasPermission(#application, 'APPLICATION', 'EXECUTE')")
+  @PreAuthorize("hasPermission(#application, 'APPLICATION', 'EXECUTE') && hasPermission(#pipelineNameOrId, 'PIPELINE', 'EXECUTE')")
   @PostMapping("/v2/{application}/{pipelineNameOrId:.+}")
   HttpEntity invokePipelineConfigViaEcho(@PathVariable("application") String application,
                                          @PathVariable("pipelineNameOrId") String pipelineNameOrId,

diff --git a/gradle.properties b/gradle.properties
@@ -1,5 +1,5 @@
 enablePublishing=false
-fiatVersion=1.31.2
+fiatVersion=OP-16464-1.31.2-SNAPSHOT
 includeProviders=basic,iap,ldap,oauth2,saml,x509
 korkVersion=7.139.0
 kotlinVersion=1.4.0