Skip to content

Add AllowStrayAsViewer option #2370

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pipecd-bot merged 7 commits into from
Aug 19, 2021
Merged

Add AllowStrayAsViewer option #2370

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
59af629
Add viewerRoleAsDefault option
khanhtc1202 Aug 19, 2021
3717639
Fix test
khanhtc1202 Aug 19, 2021
5de58ea
Update pkg/model/project.proto
khanhtc1202 Aug 19, 2021
0691f3a
Change flag
khanhtc1202 Aug 19, 2021
20759f8
Update pkg/oauth/github/github.go
khanhtc1202 Aug 19, 2021
b9eb3fe
Rename form field
khanhtc1202 Aug 19, 2021
ed384c3
Merge branch 'add-viewer-as-default' of github.com:pipe-cd/pipe into …
khanhtc1202 Aug 19, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 7 additions & 3 deletions pkg/app/ops/handler/handler.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -164,9 +164,10 @@ func (h *Handler) handleAddProject(w http.ResponseWriter, r *http.Request) {
}

var (
id = r.FormValue("ID")
description = r.FormValue("Description")
sharedSSOName = r.FormValue("SharedSSO")
id = r.FormValue("ID")
description = r.FormValue("Description")
sharedSSOName = r.FormValue("SharedSSO")
viewerRoleAsDefault = r.FormValue("ViewerRoleAsDefault") == "true"
)
if id == "" {
http.Error(w, "invalid id", http.StatusBadRequest)
Expand All @@ -191,6 +192,9 @@ func (h *Handler) handleAddProject(w http.ResponseWriter, r *http.Request) {
Id: id,
Desc: description,
SharedSsoName: sharedSSOName,
Rbac: &model.ProjectRBACConfig{
ViewerRoleAsDefault: viewerRoleAsDefault,
},
}
username = model.GenerateRandomString(10)
password = model.GenerateRandomString(30)
Expand Down
2 changes: 2 additions & 0 deletions pkg/app/ops/handler/templates/AddProject
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,8 @@ label {
<input type="text" name="Description"><br><br>
<label>Shared SSO</label>
<input type="text" name="SharedSSO"><br><br>
<input type="checkbox" id="auto-assign" name="ViewerRoleAsDefault">
<label for="auto-assign">Auto assign viewer role</label><br><br>
Copy link
Member

@nghialv nghialv Aug 19, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fix the name and label around this part.

<input type="submit">
</form>

Expand Down
2 changes: 2 additions & 0 deletions pkg/app/web/src/__fixtures__/dummy-project.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ export const dummyProject: Project.AsObject = {
admin: "admin-team",
editor: "editor-team",
viewer: "viewer-team",
viewerRoleAsDefault: false,
},
staticAdmin: {
username: "static-admin-user",
Expand All @@ -43,6 +44,7 @@ export function createProjectFromObject(o: Project.AsObject): Project {
rbac.setAdmin(o.rbac.admin);
rbac.setEditor(o.rbac.editor);
rbac.setViewer(o.rbac.viewer);
rbac.setViewerRoleAsDefault(o.rbac.viewerRoleAsDefault);
project.setRbac(rbac);
}
if (o.staticAdmin) {
Expand Down
2 changes: 2 additions & 0 deletions pkg/model/project.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,4 +94,6 @@ message ProjectRBACConfig {
string admin = 1 [(validate.rules).string.min_len = 1];
string editor = 2;
string viewer = 3;

bool viewer_role_as_default = 10;
}
19 changes: 15 additions & 4 deletions pkg/oauth/github/github.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,8 @@ type OAuthClient struct {
adminTeam string
editorTeam string
viewerTeam string

viewerRoleAsDefault bool
}

// NewOAuthClient creates a new oauth client for GitHub.
Expand All @@ -44,10 +46,11 @@ func NewOAuthClient(ctx context.Context,
projectID, code string,
) (*OAuthClient, error) {
c := &OAuthClient{
projectID: projectID,
adminTeam: rbac.Admin,
editorTeam: rbac.Editor,
viewerTeam: rbac.Viewer,
projectID: projectID,
adminTeam: rbac.Admin,
editorTeam: rbac.Editor,
viewerTeam: rbac.Viewer,
viewerRoleAsDefault: rbac.ViewerRoleAsDefault,
}
cfg := oauth2.Config{
ClientID: sso.ClientId,
Expand Down Expand Up @@ -151,6 +154,14 @@ func (c *OAuthClient) decideRole(user string, teams []*github.Team) (role model.
return
}

// In case the current user does not belong to any registered
// teams, if ViewerRoleAsDefault option is set, assign Viewer role
// as user's role.
if c.viewerRoleAsDefault {
role = model.Role_VIEWER
return
}

err = fmt.Errorf("user (%s) not found in any of the %d project teams", user, len(teams))
return
}
46 changes: 40 additions & 6 deletions pkg/oauth/github/github_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,13 +29,19 @@ func TestDecideRole(t *testing.T) {
cases := []struct {
name string
username string
oc *OAuthClient
teams []*github.Team
role model.Role_ProjectRole
wantErr bool
}{
{
name: "nothing",
username: "foo",
oc: &OAuthClient{
adminTeam: "org/team-admin",
editorTeam: "org/team-editor",
viewerTeam: "org/team-viewer",
},
teams: []*github.Team{
{
Organization: &github.Organization{Login: stringPointer("org")},
Expand All @@ -44,9 +50,32 @@ func TestDecideRole(t *testing.T) {
},
wantErr: true,
},
{
name: "viewer as default",
username: "foo",
oc: &OAuthClient{
adminTeam: "org/team-admin",
editorTeam: "org/team-editor",
viewerTeam: "org/team-viewer",
viewerRoleAsDefault: true,
},
teams: []*github.Team{
{
Organization: &github.Organization{Login: stringPointer("org")},
Slug: stringPointer("team1"),
},
},
role: model.Role_VIEWER,
wantErr: false,
},
{
name: "admin",
username: "foo",
oc: &OAuthClient{
adminTeam: "org/team-admin",
editorTeam: "org/team-editor",
viewerTeam: "org/team-viewer",
},
teams: []*github.Team{
{
Organization: &github.Organization{Login: stringPointer("org")},
Expand All @@ -66,6 +95,11 @@ func TestDecideRole(t *testing.T) {
{
name: "editor",
username: "foo",
oc: &OAuthClient{
adminTeam: "org/team-admin",
editorTeam: "org/team-editor",
viewerTeam: "org/team-viewer",
},
teams: []*github.Team{
{
Organization: &github.Organization{Login: stringPointer("org")},
Expand All @@ -85,6 +119,11 @@ func TestDecideRole(t *testing.T) {
{
name: "viewer",
username: "foo",
oc: &OAuthClient{
adminTeam: "org/team-admin",
editorTeam: "org/team-editor",
viewerTeam: "org/team-viewer",
},
teams: []*github.Team{
{
Organization: &github.Organization{Login: stringPointer("org")},
Expand All @@ -103,14 +142,9 @@ func TestDecideRole(t *testing.T) {
},
}

oc := &OAuthClient{
adminTeam: "org/team-admin",
editorTeam: "org/team-editor",
viewerTeam: "org/team-viewer",
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
role, err := oc.decideRole(tc.username, tc.teams)
role, err := tc.oc.decideRole(tc.username, tc.teams)
assert.Equal(t, tc.wantErr, err != nil)
if err == nil {
assert.Equal(t, tc.role, role)
Expand Down