8000 fix(api): don't change workflow permission for as-code (#6090) · ovh/cds@b9151b4 · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content
8000

Commit b9151b4

Browse files
fsaminfsamin
authored
fix(api): don't change workflow permission for as-code (#6090)
1 parent 67f9425 commit b9151b4

File tree

8 files changed

+395
-15
lines changed

8 files changed

+395
-15
lines changed

‎engine/api/ascode.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,10 @@ func (api *API) postPerformImportAsCodeHandler() service.Handler {
130130
key := vars[permProjectKey]
131131
uuid := vars["uuid"]
132132

133+
if isService(ctx) {
134+
return sdk.ErrForbidden
135+
}
136+
133137
if uuid == "" {
134138
return sdk.NewErrorFrom(sdk.ErrWrongRequest, "invalid given operation uuid")
135139
}

‎engine/api/workflow/dao.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -352,7 +352,7 @@ func Insert(ctx context.Context, db gorpmapper.SqlExecutorWithTx, store cache.St
352352
return sdk.WrapError(err, "Unable to update workflow")
353353
}
354354
} else {
355-
log.Debug(ctx, "postWorkflowHandler> inherit permissions from project")
355+
log.Debug(ctx, "inherit permissions from project")
356356
for _, gp := range proj.ProjectGroups {
357357
if err := group.AddWorkflowGroup(ctx, db, w, gp); err != nil {
358358
return sdk.WrapError(err, "Cannot add group %s", gp.Group.Name)

‎engine/api/workflow/repository.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -125,7 +125,7 @@ func extractWorkflow(ctx context.Context, db *gorp.DbMap, store cache.Store, p *
125125
if err != nil {
126126
return nil, allMsgs, err
127127
}
128-
msgPush, workflowPushed, _, secrets, err := Push(ctx, db, store, p, data, opt, consumer, decryptFunc)
128+
msgPush, workflowPushed, _, secrets, err := Push(ctx, db, store, p, data, opt, &consumer, decryptFunc)
129129
// Filter workflow push message if generated from template
130130
for i := range msgPush {
131131
if wti != nil && msgPush[i].ID == sdk.MsgWorkflowDeprecatedVersion.ID {

‎engine/api/workflow/workflow_importer.go

Lines changed: 27 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ import (
1818
)
1919

2020
//Import is able to create a new workflow and all its components
21-
func Import(ctx context.Context, db gorpmapper.SqlExecutorWithTx, store cache.Store, proj sdk.Project, oldW, w *sdk.Workflow, u sdk.Identifiable, force bool, msgChan chan<- sdk.Message) error {
21+
func Import(ctx context.Context, db gorpmapper.SqlExecutorWithTx, store cache.Store, proj sdk.Project, oldW, w *sdk.Workflow, u sdk.Identifiable, opts ImportOptions, msgChan chan<- sdk.Message) error {
2222
ctx, end := telemetry.Span(ctx, "workflow.Import")
2323
defer end()
2424

@@ -29,6 +29,30 @@ func Import(ctx context.Context, db gorpmapper.SqlExecutorWithTx, store cache.St
2929
w.WorkflowData.Node.Context = &sdk.NodeContext{}
3030
}
3131

32+
// If the import is not done by a direct user (ie. from a hook or if the content is coming from a repository)
33+
// We don't take permission in account and we only keep permission of the oldWorkflow or projet permission
34+
if opts.HookUUID != "" || opts.RepositoryName != "" {
35+
log.Info(ctx, "Import is perform from 'as-code', we don't take groups in account (hookUUID=%q, repository=%q)", opts.HookUUID, opts.RepositoryName)
36+
// reset permissions at the workflow level
37+
w.Groups = nil
38+
if oldW != nil {
39+
w.Groups = oldW.Groups
40+
}
41+
// reset permissions at the node level
42+
w.VisitNode(func(n *sdk.Node, w *sdk.Workflow) {
43+
n.Groups = nil
44+
if oldW != nil {
45+
oldN := oldW.WorkflowData.NodeByName(n.Name)
46+
if oldN != nil {
47+
n.Groups = oldN.Groups
48+
}
49+
}
50+
})
51+
} else {
52+
// The import is triggered by a user, we have to check the groups
53+
// FIXME: call the same function than the handlers
54+
}
55+
3256
// create the workflow if not exists
3357
if oldW == nil {
3458
if err := Insert(ctx, db, store, proj, w); err != nil {
@@ -44,11 +68,11 @@ func Import(ctx context.Context, db gorpmapper.SqlExecutorWithTx, store cache.St
4468
w.Icon = oldW.Icon
4569
}
4670

47-
if !force {
71+
if !opts.Force {
4872
return sdk.NewErrorFrom(sdk.ErrAlreadyExist, "workflow exists")
4973
}
5074

51-
if force && oldW != nil && oldW.FromRepository != "" && w.FromRepository == "" {
75+
if opts.Force && oldW != nil && oldW.FromRepository != "" && w.FromRepository == "" {
5276
if err := detachResourceFromRepository(db, proj.ID, oldW, msgChan); err != nil {
5377
return err
5478
}

‎engine/api/workflow/workflow_importer_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -483,7 +483,7 @@ func TestImport(t *testing.T) {
483483
}
484484
}
485485

486-
if err := workflow.Import(context.TODO(), db, cache, *proj, wf, tt.args.w, u, tt.args.force, nil); err != nil {
486+
if err := workflow.Import(context.TODO(), db, cache, *proj, wf, tt.args.w, u, workflow.ImportOptions{Force: tt.args.force}, nil); err != nil {
487487
if !tt.wantErr {
488488
t.Errorf("Import() error = %v, wantErr %v", err, tt.wantErr)
489489
} else {

‎engine/api/workflow/workflow_parser.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -204,7 +204,7 @@ func ParseAndImport(ctx context.Context, db gorpmapper.SqlExecutorWithTx, store
204204
}
205205
}(&msgList)
206206

207-
globalError := Import(ctx, db, store, proj, oldW, w, u, opts.Force, msgChan)
207+
globalError := Import(ctx, db, store, proj, oldW, w, u, opts, msgChan)
208208
close(msgChan)
209209
done.Wait()
210210

0 commit comments

Comments
 (0)
0