Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Restrict resource templates to specific roles #2623

Merged
merged 23 commits into from
Sep 22, 2022
Merged

Restrict resource templates to specific roles #2623

merged 23 commits into from
Sep 22, 2022

Conversation

tanya-borisova
Copy link
Contributor

@tanya-borisova tanya-borisova commented Sep 20, 2022 •
edited
Loading

Resolves #2600

What is being addressed

Add ability to restrict certain user resource templates to be used by certain roles.
This is primarily needed for Airlock Reviews, where the Reviewer should not be able to use user resource templates intended for Researchers. However, it might be used in the future for other resource templates.

How is this addressed

  • Add authorizedRoles field to resource template
  • In POST requests for all types of resources, check if the authenticated user has at least one role in the authorizedRoles (if authorizedRoles is not empty, otherwise all roles will be assumed authorized)
  • in GET requests to list shared service templates and workspace templates, add a parameter authorized_only (defaulting to False). If true, only return list of templates that the authenticated user is authorized to use. Intended to be used from the UI to reduce a chance a user tries to create a resource they aren't authorized to (and getting an error)
  • Added new GET requests to list workspace service templates and user resource templates on Workspace router, which automatically only returns the templates that the user is allowed to see

Note that the template.authorizedRoles are only checked on creation of the resource. This is intentional although may appear somewhat inconsistent

@tanya-borisova tanya-borisova linked an issue Sep 20, 2022 that may be closed by this pull request
Add ability to restrict resource templates to specific roles #2600
Closed
1 task
@tanya-borisova tanya-borisova changed the title Tborisova/2600 add ability to restrict resource templates to specific roles Restrict resource templates to specific roles Sep 20, 2022
@tanya-borisova
Add changelog item for this PR
220c894
@tanya-borisova
Merge branch 'tborisova/2600-add-ability-to-restrict-resource-templat…
a6ad1f9 
…es-to-specific-roles' of github.com:microsoft/AzureTRE into tborisova/2600-add-ability-to-restrict-resource-templates-to-specific-roles
@github-actions
Copy link

github-actions bot commented Sep 20, 2022 •
edited
Loading

Unit Test Results

510 tests   510 ✔️  12s ⏱️
    1 suites      0 💤
    1 files        0 ❌

Results for commit 825c076.

♻️ This comment has been updated with latest results.

@tanya-borisova
Copy link
Contributor Author

/test

@github-actions
Copy link

🤖 pr-bot 🤖

🏃 Running tests: https://github.com/microsoft/AzureTRE/actions/runs/3093679398 (with refid dd6692a5)

(in response to this comment from @tanya-borisova)

@tanya-borisova
Copy link
Contributor Author

/test-destroy-env

@github-actions
Copy link

Destroying branch test environment (RG: rg-tre1b5504b3)... (run: https://github.com/microsoft/AzureTRE/actions/runs/3095882735)

@github-actions
Copy link

Branch test environment destroy complete (RG: rg-tre1b5504b3)

@github-actions
Copy link

Destroying PR test environment (RG: rg-tredd6692a5)... (run: https://github.com/microsoft/AzureTRE/actions/runs/3095882735)

@tanya-borisova
fixes; make sure authorizedRoles is optional
db0bc6a
@tanya-borisova
Merge branch 'tborisova/2600-add-ability-to-restrict-resource-templat…
743a025 
…es-to-specific-roles' of github.com:microsoft/AzureTRE into tborisova/2600-add-ability-to-restrict-resource-templates-to-specific-roles
@tanya-borisova
Copy link
Contributor Author

/test

@github-actions
Copy link

🤖 pr-bot 🤖

🏃 Running tests: https://github.com/microsoft/AzureTRE/actions/runs/3095968260 (with refid dd6692a5)

(in response to this comment from @tanya-borisova)

@github-actions
Copy link

PR test environment destroy complete (RG: rg-tredd6692a5)

@tanya-borisova tanya-borisova marked this pull request as ready for review September 21, 2022 08:02
@tanya-borisova
Copy link
Contributor Author

/test-destroy-env

@github-actions
Copy link

Branch test environment destroy complete (RG: rg-tre1b5504b3)

@github-actions
Copy link

PR test environment destroy complete (RG: rg-tredd6692a5)

@tanya-borisova
Copy link
Contributor Author

/test

@github-actions
Copy link

🤖 pr-bot 🤖

🏃 Running tests: https://github.com/microsoft/AzureTRE/actions/runs/3098525208 (with refid dd6692a5)

(in response to this comment from @tanya-borisova)

@tanya-borisova
Copy link
Contributor Author

/test-destroy-env

@github-actions
Copy link

Destroying branch test environment (RG: rg-tre1b5504b3)... (run: https://github.com/microsoft/AzureTRE/actions/runs/3100304315)

@github-actions
Copy link

Branch test environment destroy complete (RG: rg-tre1b5504b3)

@github-actions
Copy link

Destroying PR test environment (RG: rg-tredd6692a5)... (run: https://github.com/microsoft/AzureTRE/actions/runs/3100304315)

@github-actions
Copy link

PR test environment destroy complete (RG: rg-tredd6692a5)

@tanya-borisova
Copy link
Contributor Author

/test

@github-actions
Copy link

🤖 pr-bot 🤖

🏃 Running tests: https://github.com/microsoft/AzureTRE/actions/runs/3100722085 (with refid dd6692a5)

(in response to this comment from @tanya-borisova)

@tanya-borisova tanya-borisova marked this pull request as draft September 22, 2022 09:20
@tanya-borisova
Copy link
Contributor Author

Moved it back to draft temporarily as @damoodamoo pointed out that there's a problem: the GET methods for templates are on the root router so we won't get workspace-level roles there.
I'm going to mitigate this by having a separate GET method on the workspace router that will be used from the UI with an intention to display to user only the templates that they can deploy

@tanya-borisova
Add GET endpoints for workspace service templates and user resource t…
9be5d1d 
…emplates on workspace level
@tanya-borisova
Merge branch 'tborisova/2600-add-ability-to-restrict-resource-templat…
65539fe 
…es-to-specific-roles' of github.com:microsoft/AzureTRE into tborisova/2600-add-ability-to-restrict-resource-templates-to-specific-roles
@tanya-borisova
Merge branch 'main' into tborisova/2600-add-ability-to-restrict-resou…
bde5917 
…rce-templates-to-specific-roles
@tanya-borisova tanya-borisova marked this pull request as ready for review September 22, 2022 14:06
@tanya-borisova
Copy link
Contributor Author

/test

@github-actions
Copy link

🤖 pr-bot 🤖

🏃 Running tests: https://github.com/microsoft/AzureTRE/actions/runs/3106126999 (with refid dd6692a5)

(in response to this comment from @tanya-borisova)

@tanya-borisova
fix tests
738ffa0
@tanya-borisova
Merge branch 'main' into tborisova/2600-add-ability-to-restrict-resou…
5005fe0 
…rce-templates-to-specific-roles
@tanya-borisova
Merge branch 'tborisova/2600-add-ability-to-restrict-resource-templat…
825c076 
…es-to-specific-roles' of github.com:microsoft/AzureTRE into tborisova/2600-add-ability-to-restrict-resource-templates-to-specific-roles
@tanya-borisova
Copy link
Contributor Author

/test

@github-actions
Copy link

🤖 pr-bot 🤖

🏃 Running tests: https://github.com/microsoft/AzureTRE/actions/runs/3106591276 (with refid dd6692a5)

(in response to this comment from @tanya-borisova)

@tanya-borisova tanya-borisova merged commit 6ae8b5e into main Sep 22, 2022
@tanya-borisova tanya-borisova deleted the tborisova/2600-add-ability-to-restrict-resource-templates-to-specific-roles branch September 22, 2022 15:24
This was referenced Sep 23, 2022
Closed
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@damoodamoo damoodamoo damoodamoo approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Add ability to restrict resource templates to specific roles
2 participants
@tanya-borisova @damoodamoo