Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix user resource #19366

Merged
merged 2 commits into from
Sep 18, 2023
Merged

fix user resource #19366

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ea95439
fix user resource
wy65701436 Sep 14, 2023
0bb0fe3
Merge branch 'main' into rb-fixes
wy65701436 Sep 18, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 6 additions & 9 deletions src/server/v2.0/handler/user.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,6 @@
"github.com/goharbor/harbor/src/common"
commonmodels "github.com/goharbor/harbor/src/common/models"
"github.com/goharbor/harbor/src/common/rbac"
"github.com/goharbor/harbor/src/common/rbac/system"
"github.com/goharbor/harbor/src/common/security"
"github.com/goharbor/harbor/src/common/security/local"
"github.com/goharbor/harbor/src/common/utils"
Expand All @@ -44,8 +43,6 @@
operation "github.com/goharbor/harbor/src/server/v2.0/restapi/operations/user"
)

var userResource = system.NewNamespace().Resource(rbac.ResourceUser)

type usersAPI struct {
BaseAPI
ctl user.Controller
Expand Down Expand Up @@ -108,7 +105,7 @@
}

func (u *usersAPI) ListUsers(ctx context.Context, params operation.ListUsersParams) middleware.Responder {
if err := u.RequireSystemAccess(ctx, rbac.ActionList, userResource); err != nil {
if err := u.RequireSystemAccess(ctx, rbac.ActionList, rbac.ResourceUser); err != nil {

Check warning on line 108 in src/server/v2.0/handler/user.go

View check run for this annotation

Codecov / codecov/patch

src/server/v2.0/handler/user.go#L108 

Added line #L108 was not covered by tests
return u.SendError(ctx, err)
}
query, err := u.BuildQuery(ctx, params.Q, params.Sort, params.Page, params.PageSize)
Expand Down Expand Up @@ -365,7 +362,7 @@
if !ok || !sctx.IsAuthenticated() {
return errors.UnauthorizedError(nil)
}
if !matchUserID(sctx, id) && !sctx.Can(ctx, rbac.ActionUpdate, userResource) {
if !matchUserID(sctx, id) && !sctx.Can(ctx, rbac.ActionUpdate, rbac.ResourceUser) {

Check warning on line 365 in src/server/v2.0/handler/user.go

View check run for this annotation

Codecov / codecov/patch

src/server/v2.0/handler/user.go#L365 

Added line #L365 was not covered by tests
return errors.ForbiddenError(nil).WithMessage("Not authorized to update the CLI secret for user: %d", id)
}
return nil
Expand Down Expand Up @@ -400,7 +397,7 @@
if !ok || !sctx.IsAuthenticated() {
return errors.UnauthorizedError(nil)
}
if !matchUserID(sctx, id) && !sctx.Can(ctx, rbac.ActionRead, userResource) {
if !matchUserID(sctx, id) && !sctx.Can(ctx, rbac.ActionRead, rbac.ResourceUser) {

Check warning on line 400 in src/server/v2.0/handler/user.go

View check run for this annotation

Codecov / codecov/patch

src/server/v2.0/handler/user.go#L400 

Added line #L400 was not covered by tests
return errors.ForbiddenError(nil).WithMessage("Not authorized to read user: %d", id)
}
return nil
Expand All @@ -411,7 +408,7 @@
if !ok || !sctx.IsAuthenticated() {
return errors.UnauthorizedError(nil)
}
if !sctx.Can(ctx, rbac.ActionDelete, userResource) {
if !sctx.Can(ctx, rbac.ActionDelete, rbac.ResourceUser) {

Check warning on line 411 in src/server/v2.0/handler/user.go

View check run for this annotation

Codecov / codecov/patch

src/server/v2.0/handler/user.go#L411 

Added line #L411 was not covered by tests
return errors.ForbiddenError(nil).WithMessage("Not authorized to delete users")
}
if matchUserID(sctx, id) || id == 1 {
Expand Down Expand Up @@ -439,10 +436,10 @@
sctx, _ := security.FromContext(ctx)
if authMode == common.DBAuth {
// In db auth, admin can update anyone's info, and regular user can update his own
return sctx.Can(ctx, rbac.ActionUpdate, userResource) || matchUserID(sctx, id)
return sctx.Can(ctx, rbac.ActionUpdate, rbac.ResourceUser) || matchUserID(sctx, id)
}
// In none db auth, only the local admin's password can be updated.
return id == 1 && sctx.Can(ctx, rbac.ActionUpdate, userResource)
return id == 1 && sctx.Can(ctx, rbac.ActionUpdate, rbac.ResourceUser)

Check warning on line 442 in src/server/v2.0/handler/user.go

View check run for this annotation

Codecov / codecov/patch

src/server/v2.0/handler/user.go#L442 

Added line #L442 was not covered by tests
}

func matchUserID(sctx security.Context, id int) bool {
Expand Down
Loading