feat: RBAC support for external argo/flux apps (#7014)

* chore: create a makefile to setup and clean resources for development

* feat: add flag for frontend to show argo/flux tabs

- add migration files
- append flags in the /orchestrator/user/check/roles API to show/hide argo/flux tabs

* feat: changes for dropdown API in user permissions page

* fix: missing dependencies in constructor method

* fix: improper filtering logic

- earlier filter was only applied with the cluster ID
- add changes to filter based on cluster ID's and namespaces

* fix: prevent connecting to kubelink for failed clusters

* wip: policy enforcements

* wip: policy enforcements

* chore: remove test folder

* fix: code review fixes

* fix: code review fixes

* fix: code review fixes

* chore: rename migration scripts to maintain sync with enterprise

* chore: change migration script number

* fix: roles missing while fetching user roles

* fix: deleted roles being listed

* fix: deleted roles being listed

* fix: review fixes

Author: vivekanandan-devtron

api/argoApplication/ArgoApplicationRestHandler.go

@@ -21,8 +21,10 @@ import (
 	"errors"
 	"github.com/devtron-labs/devtron/api/restHandler/common"
 	"github.com/devtron-labs/devtron/pkg/argoApplication"
+	"github.com/devtron-labs/devtron/pkg/argoApplication/bean"
 	"github.com/devtron-labs/devtron/pkg/argoApplication/read"
 	"github.com/devtron-labs/devtron/pkg/auth/authorisation/casbin"
+	"github.com/devtron-labs/devtron/util/rbac"
 	"go.uber.org/zap"
 	"net/http"
 	"strconv"
@@ -39,26 +41,24 @@ type ArgoApplicationRestHandlerImpl struct {
 	readService            read.ArgoApplicationReadService
 	logger                 *zap.SugaredLogger
 	enforcer               casbin.Enforcer
+	enforcerUtilGitOps     rbac.EnforcerUtilGitOps
 }
 
 func NewArgoApplicationRestHandlerImpl(argoApplicationService argoApplication.ArgoApplicationService,
-	readService read.ArgoApplicationReadService, logger *zap.SugaredLogger, enforcer casbin.Enforcer) *ArgoApplicationRestHandlerImpl {
+	readService read.ArgoApplicationReadService, logger *zap.SugaredLogger, enforcer casbin.Enforcer,
+	enforcerUtilGitOps rbac.EnforcerUtilGitOps) *ArgoApplicationRestHandlerImpl {
 	return &ArgoApplicationRestHandlerImpl{
 		argoApplicationService: argoApplicationService,
 		readService:            readService,
 		logger:                 logger,
 		enforcer:               enforcer,
+		enforcerUtilGitOps:     enforcerUtilGitOps,
 	}
 
 }
 
 func (handler *ArgoApplicationRestHandlerImpl) ListApplications(w http.ResponseWriter, r *http.Request) {
-	// handle super-admin RBAC
 	token := r.Header.Get("token")
-	if ok := handler.enforcer.Enforce(token, casbin.ResourceGlobal, casbin.ActionGet, "*"); !ok {
-		common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
-		return
-	}
 	v := r.URL.Query()
 	clusterIdString := v.Get("clusterIds")
 	var clusterIds []int
@@ -80,16 +80,34 @@ func (handler *ArgoApplicationRestHandlerImpl) ListApplications(w http.ResponseW
 		common.WriteJsonResp(w, err, nil, http.StatusInternalServerError)
 		return
 	}
-	common.WriteJsonResp(w, nil, resp, http.StatusOK)
+	// RBAC enforcer applying: filter the listing to the applications the caller may see.
+	// Batched rather than a per-app Enforce loop; an app whose object cannot be built is dropped.
+	objects := make([]string, 0, len(resp))
+	objectByApp := make(map[*bean.ArgoApplicationListDto]string, len(resp))
+	for _, app := range resp {
+		object := handler.enforcerUtilGitOps.GetExternalGitOpsAppObjectByClusterName(app.ClusterName, app.Namespace, app.Name)
+		if len(object) == 0 {
+			continue
+		}
+		objectByApp[app] = object
+		objects = append(objects, object)
+	}
+	authorisedObjects := make(map[string]bool)
+	if len(objects) > 0 {
+		authorisedObjects = handler.enforcer.EnforceInBatch(token, casbin.ResourceArgoApp, casbin.ActionGet, objects)
+	}
+	authorisedApps := make([]*bean.ArgoApplicationListDto, 0, len(resp))
+	for _, app := range resp {
+		if object, ok := objectByApp[app]; ok && authorisedObjects[strings.ToLower(object)] {
+			authorisedApps = append(authorisedApps, app)
+		}
+	}
+	//RBAC enforcer Ends
+	common.WriteJsonResp(w, nil, authorisedApps, http.StatusOK)
 }
 
 func (handler *ArgoApplicationRestHandlerImpl) GetApplicationDetail(w http.ResponseWriter, r *http.Request) {
-	// handle super-admin RBAC
 	token := r.Header.Get("token")
-	if ok := handler.enforcer.Enforce(token, casbin.ResourceGlobal, casbin.ActionGet, "*"); !ok {
-		common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
-		return
-	}
 	ctx := r.Context()
 	ctx = context.WithValue(ctx, "token", token)
 
@@ -108,6 +126,14 @@ func (handler *ArgoApplicationRestHandlerImpl) GetApplicationDetail(w http.Respo
 			return
 		}
 	}
+	// RBAC enforcer applying
+	object := handler.enforcerUtilGitOps.GetExternalGitOpsAppObject(clusterId, namespace, resourceName)
+	if len(object) == 0 || !handler.enforcer.Enforce(token, casbin.ResourceArgoApp, casbin.ActionGet, object) {
+		common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
+		return
+	}
+	//RBAC enforcer Ends
+
 	resp, err := handler.readService.GetAppDetailEA(ctx, resourceName, namespace, clusterId)
 	if err != nil {
 		handler.logger.Errorw("error in getting argo application app detail", "err", err, "resourceName", resourceName, "clusterId", clusterId)

api/auth/user/UserRestHandler.go

@@ -19,13 +19,14 @@ package user
 import (
 	"encoding/json"
 	"errors"
+	"net/http"
+	"strconv"
+	"strings"
+
 	util2 "github.com/devtron-labs/devtron/api/auth/user/util"
 	"github.com/devtron-labs/devtron/pkg/auth/user/helper"
 	"github.com/devtron-labs/devtron/util/commonEnforcementFunctionsUtil"
 	"github.com/gorilla/schema"
-	"net/http"
-	"strconv"
-	"strings"
 
 	"github.com/devtron-labs/devtron/api/restHandler/common"
 	"github.com/devtron-labs/devtron/internal/util"
@@ -38,6 +39,16 @@ import (
 	"gopkg.in/go-playground/validator.v9"
 )
 
+const (
+	resultKeyArgoAppAccess = "hasArgoAppAccess"
+	resultKeyFluxAppAccess = "hasFluxAppAccess"
+)
+
+var gitOpsAccessResultKeyByResource = map[string]string{
+	casbin.ResourceArgoApp: resultKeyArgoAppAccess,
+	casbin.ResourceFluxApp: resultKeyFluxAppAccess,
+}
+
 type UserRestHandler interface {
 	CreateUser(w http.ResponseWriter, r *http.Request)
 	UpdateUser(w http.ResponseWriter, r *http.Request)
@@ -795,9 +806,25 @@ func (handler UserRestHandlerImpl) CheckUserRoles(w http.ResponseWriter, r *http
 	result := make(map[string]interface{})
 	result["roles"] = roles
 	result["superAdmin"] = false
+	result[resultKeyArgoAppAccess] = false
+	result[resultKeyFluxAppAccess] = false
 	for _, item := range roles {
 		if item == bean2.SUPERADMIN {
 			result["superAdmin"] = true
+			result[resultKeyArgoAppAccess] = true
+			result[resultKeyFluxAppAccess] = true
+			continue
+		}
+
+		roleFragments := strings.Split(item, "_")
+		resourceActionFragment := strings.Split(roleFragments[0], ":")
+
+		if len(resourceActionFragment) < 2 {
+			continue
+		}
+
+		if resultKey, ok := gitOpsAccessResultKeyByResource[resourceActionFragment[0]]; ok {
+			result[resultKey] = true
 		}
 	}
 	common.WriteJsonResp(w, err, result, http.StatusOK)

api/fluxApplication/FluxApplicationRestHandler.go

@@ -5,6 +5,7 @@ import (
 	"github.com/devtron-labs/devtron/api/restHandler/common"
 	"github.com/devtron-labs/devtron/pkg/auth/authorisation/casbin"
 	clientErrors "github.com/devtron-labs/devtron/pkg/errors"
+	"github.com/devtron-labs/devtron/util/rbac"
 	"github.com/devtron-labs/devtron/pkg/fluxApplication"
 	"github.com/gorilla/mux"
 	"go.uber.org/zap"
@@ -20,26 +21,34 @@ type FluxApplicationRestHandlerImpl struct {
 	fluxApplicationService fluxApplication.FluxApplicationService
 	logger                 *zap.SugaredLogger
 	enforcer               casbin.Enforcer
+	enforcerUtilGitOps     rbac.EnforcerUtilGitOps
 }
 
 func NewFluxApplicationRestHandlerImpl(fluxApplicationService fluxApplication.FluxApplicationService,
-	logger *zap.SugaredLogger, enforcer casbin.Enforcer) *FluxApplicationRestHandlerImpl {
+	logger *zap.SugaredLogger, enforcer casbin.Enforcer,
+	enforcerUtilGitOps rbac.EnforcerUtilGitOps) *FluxApplicationRestHandlerImpl {
 	return &FluxApplicationRestHandlerImpl{
 		fluxApplicationService: fluxApplicationService,
 		logger:                 logger,
 		enforcer:               enforcer,
+		enforcerUtilGitOps:     enforcerUtilGitOps,
 	}
 
 }
 
+// checkFluxAppAuth builds the RBAC object from the app identity and enforces on it. Passed into
+// the service because the app list is streamed and cannot be filtered after the fact.
+func (handler *FluxApplicationRestHandlerImpl) checkFluxAppAuth(token string, clusterName string, namespace string, appName string) bool {
+	object := handler.enforcerUtilGitOps.GetExternalGitOpsAppObjectByClusterName(clusterName, namespace, appName)
+	if len(object) == 0 {
+		return false
+	}
+	return handler.enforcer.Enforce(token, casbin.ResourceFluxApp, casbin.ActionGet, object)
+}
+
 func (handler *FluxApplicationRestHandlerImpl) ListFluxApplications(w http.ResponseWriter, r *http.Request) {
 
-	//handle super-admin RBAC
 	token := r.Header.Get("token")
-	if ok := handler.enforcer.Enforce(token, casbin.ResourceGlobal, casbin.ActionGet, "*"); !ok {
-		common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
-		return
-	}
 	v := r.URL.Query()
 	clusterIdString := v.Get("clusterIds")
 	var clusterIds []int
@@ -59,7 +68,7 @@ func (handler *FluxApplicationRestHandlerImpl) ListFluxApplications(w http.Respo
 		return
 	}
 	handler.logger.Debugw("extracted ClusterIds successfully ", "clusterIds", clusterIds)
-	handler.fluxApplicationService.ListFluxApplications(r.Context(), clusterIds, noStream, w)
+	handler.fluxApplicationService.ListFluxApplications(r.Context(), clusterIds, noStream, w, token, handler.checkFluxAppAuth)
 }
 
 func (handler *FluxApplicationRestHandlerImpl) GetApplicationDetail(w http.ResponseWriter, r *http.Request) {
@@ -76,12 +85,14 @@ func (handler *FluxApplicationRestHandlerImpl) GetApplicationDetail(w http.Respo
 		return
 	}
 
-	// handle super-admin RBAC
+	// RBAC enforcer applying
 	token := r.Header.Get("token")
-	if ok := handler.enforcer.Enforce(token, casbin.ResourceGlobal, casbin.ActionGet, "*"); !ok {
+	object := handler.enforcerUtilGitOps.GetExternalGitOpsAppObject(appIdentifier.ClusterId, appIdentifier.Namespace, appIdentifier.Name)
+	if len(object) == 0 || !handler.enforcer.Enforce(token, casbin.ResourceFluxApp, casbin.ActionGet, object) {
 		common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
 		return
 	}
+	//RBAC enforcer Ends
 
 	res, err := handler.fluxApplicationService.GetFluxAppDetail(r.Context(), appIdentifier)
 	if err != nil {

api/helm-app/wire_helmApp.go

@@ -41,4 +41,7 @@ var HelmAppWireSet = wire.NewSet(
 	gRPC.GetConfig,
 	rbac.NewEnforcerUtilHelmImpl,
 	wire.Bind(new(rbac.EnforcerUtilHelm), new(*rbac.EnforcerUtilHelmImpl)),
+
+	rbac.NewEnforcerUtilGitOpsImpl,
+	wire.Bind(new(rbac.EnforcerUtilGitOps), new(*rbac.EnforcerUtilGitOpsImpl)),
 )