Workspace access check removed (#33)

* Workspace access check removed

* List workspaces with user access rights

* Fix e2e tests

auth/auth.go

@@ -70,19 +70,24 @@ const (
 	Volumes Subject = "volumes"
 )
 
-func (ra RoleAuthorizer) GetWorkspacePermissions(wsp string, usr user.User) (bool, bool, error) {
-	wss, err := ra.Workspaces.ListWorkspaces(context.TODO(), usr)
-	if err != nil {
-		return false, false, errors.Wrap(err, "could not get workspace permissions")
-	}
+type AccessLevel struct {
+	User  bool
+	Admin bool
+}
+
+func (ra RoleAuthorizer) GetWorkspacePermissions(wsp string, usr user.User) (AccessLevel, error) {
+	wss := ra.Workspaces.ListWorkspaces()
 
 	for _, ws := range wss {
+		var al AccessLevel
 		if ws.Name == wsp {
-			return ws.UserHasAccess(usr), ws.UserHasAdminAccess(usr), nil
+			al.User = ws.UserHasAccess(usr)
+			al.Admin = ws.UserHasAdminAccess(usr)
+			return al, nil
 		}
 	}
 
-	return false, false, nil
+	return AccessLevel{}, nil
 }
 
 func (ra RoleAuthorizer) GetSecretPermissions(usr user.User, data any) (map[Action]bool, error) {
@@ -93,16 +98,16 @@ func (ra RoleAuthorizer) GetSecretPermissions(usr user.User, data any) (map[Acti
 		return map[Action]bool{}, errors.Errorf("could not decode the workspace variable")
 	}
 
-	userAccess, adminAccess, err := ra.GetWorkspacePermissions(workspace, usr)
+	al, err := ra.GetWorkspacePermissions(workspace, usr)
 	if err != nil {
 		return map[Action]bool{}, errors.Wrap(err, "could not get secret permissions")
 	}
 
 	// this is where access levels map to actions.
-	p[Read] = userAccess || adminAccess
-	p[List] = userAccess || adminAccess
-	p[Write] = adminAccess
-	p[Delete] = adminAccess
+	p[Read] = al.User || al.Admin
+	p[List] = al.User || al.Admin
+	p[Write] = al.Admin
+	p[Delete] = al.Admin
 
 	return p, nil
 }
@@ -115,16 +120,16 @@ func (ra RoleAuthorizer) GetVolumePermissions(usr user.User, data any) (map[Acti
 		return map[Action]bool{}, errors.Errorf("could not decode the workspace variable")
 	}
 
-	userAccess, adminAccess, err := ra.GetWorkspacePermissions(workspace, usr)
+	al, err := ra.GetWorkspacePermissions(workspace, usr)
 	if err != nil {
 		return map[Action]bool{}, errors.Wrap(err, "could not get secret permissions")
 	}
 
 	// this is where access levels map to actions.
-	p[Read] = userAccess || adminAccess
-	p[List] = userAccess || adminAccess
-	p[Write] = adminAccess
-	p[Delete] = adminAccess
+	p[Read] = al.User || al.Admin
+	p[List] = al.Admin || al.User
+	p[Write] = al.Admin
+	p[Delete] = al.Admin
 
 	return p, nil
 }

e2etest/e2e_test.go

@@ -46,32 +46,33 @@ var mockUser fuser.User = fuser.MockUser{
 	Uid:   "0",
 	Name:  "Auth Disabled",
 	Email: "auth@disabled",
-	Roles: []fuser.Role{"tester", "dummy"},
+	Roles: []fuser.Role{"tester", "dummy", "sandbox-developer"},
 }
 
-var testWorkspace string = `
----
-# Namespace 'sandbox-project-a'
-apiVersion: v1
-kind: Namespace
-metadata:
-  labels:
-    app.kubernetes.io/part-of: "flowify"
-  name: "test"
-
----
-# Developer workspace environment
-apiVersion: v1
-kind: ConfigMap
-metadata:
-    labels:
-        app.kubernetes.io/component: "workspace-config"
-        app.kubernetes.io/part-of: "flowify"
-    name: "test"
-    namespace: "test"
-data:
-    roles: "[[\"tester\"]]"
-`
+// TODO: not in use, add clean workspace for e2e tests in k8s
+// var testWorkspace string = `
+// ---
+// # Namespace 'sandbox-project-a'
+// apiVersion: v1
+// kind: Namespace
+// metadata:
+//   labels:
+//     app.kubernetes.io/part-of: "flowify"
+//   name: "test"
+
+// ---
+// # Developer workspace environment
+// apiVersion: v1
+// kind: ConfigMap
+// metadata:
+//     labels:
+//         app.kubernetes.io/component: "workspace-config"
+//         app.kubernetes.io/part-of: "flowify"
+//     name: "test"
+//     namespace: "test"
+// data:
+//     roles: "[[\"tester\"]]"
+// `
 
 var configString = []byte(`
 db:
@@ -380,7 +381,7 @@ func (s *e2eTestSuite) Test_Roundtrip_Workflow() {
 
 	resp, err := requestor(server_addr+"/api/v1/workflows/", http.MethodPost, wfReq)
 	s.NoError(err)
-	require.Equal(s.T(), http.StatusCreated, resp.StatusCode)
+	require.Equal(s.T(), http.StatusCreated, resp.StatusCode, BodyStringer{resp.Body})
 
 	var wfResp models.Workflow
 	err = marshalResponse(ResponseBodyBytes(resp), &wfResp)
@@ -445,7 +446,7 @@ func (s *e2eTestSuite) Test_Roundtrip_Job() {
 	resp2, err := requestor(fmt.Sprintf(server_addr+"/api/v1/jobs/%s", wfResp.Metadata.Uid.String()), http.MethodGet, wfReq)
 	s.NoError(err)
 
-	var wfResp2 models.Workflow
+	var wfResp2 models.Job
 	err = marshalResponse(ResponseBodyBytes(resp2), &wfResp2)
 	s.NoError(err)
 	s.Equal(wfResp, wfResp2, "expect roundtrip equality")

e2etest/workspace_test.go

@@ -15,7 +15,7 @@ func (s *e2eTestSuite) Test_Workspaces() {
 	require.Equal(s.T(), http.StatusOK, resp.StatusCode, BodyStringer{resp.Body})
 
 	type WorkspaceList struct {
-		Items []workspace.Workspace `json:"items"`
+		Items []workspace.WorkspaceGetRequest `json:"items"`
 	}
 	var list WorkspaceList
 	err = marshalResponse(ResponseBodyBytes(resp), &list)

models/examples/minimal-any-workflow.json

@@ -9,5 +9,5 @@
       "type": "any"
     }
   },
-  "workspace": "test"
+  "workspace": "sandbox-project-a"
 }

models/spec/workspace.schema.json

@@ -5,32 +5,21 @@
       "description": "The name of the workspace",
       "type": "string"
     },
-    "hasAccess": {
-      "description": "Is access granted?",
-      "type": "boolean"
+    "description": {
+      "description": "The description of the workspace",
+      "type": "string"
     },
-    "missingRoles": {
-      "description": "The roles a user needs in order to get access.",
+    "roles": {
+      "description": "The access roles user has for the workspace (user or admin).",
       "type": "array",
       "minItems": 0,
       "uniqueItems": true,
       "items": {
-        "schema": {
-          "type": "object",
-          "properties": {
-            "name": {
-              "description": "The name of the missing role",
-              "type": "string"
-            },
-            "description": {
-              "description": "The description of the missing role",
-              "type": "string"
-            }
-          }
-        } 
+        "type": "string",
+        "pattern": "^(user|admin)$"
       }
     }
   },
   "additionalProperties": false,
-  "required": ["name", "hasAccess", "missingRoles"]
+  "required": ["name", "description", "roles"]
 }

pkg/workspace/workspace.go

@@ -1,7 +1,6 @@
 package workspace
 
 import (
-	"context"
 	"encoding/json"
 	"strings"
 	"sync"
@@ -36,14 +35,11 @@ type Workspace struct {
 
 	// the list of required roles for access
 	Roles [][]userpkg.Role `json:"roles,omitempty"`
-
-	HasAccess    bool            `json:"hasAccess"`
-	MissingRoles [][]MissingRole `json:"missingRoles,omitempty"`
 }
 
 type WorkspaceClient interface {
 	// list the workspaces visible to a specific user
-	ListWorkspaces(ctx context.Context, user userpkg.User) ([]Workspace, error)
+	ListWorkspaces() []Workspace
 	GetNamespace() string
 }
 
@@ -122,17 +118,6 @@ type MissingRole struct {
 	Description string       `json:"description"`
 }
 
-// queries the access list for a matching access and returns true if found, else false
-func HasAccess(ws []Workspace, ns string) bool {
-	for _, w := range ws {
-		if w.Name == ns && w.HasAccess {
-			return true
-		}
-	}
-
-	return false
-}
-
 func listWorkspaceConfigMaps(namespace string, cmInformer v1.ConfigMapInformer) ([]Workspace, error) {
 	// the lister finds all configmaps in the given namespace with the 'workspace-config' label
 
@@ -271,34 +256,12 @@ func getAccessTokens(cm *core.ConfigMap) ([][]userpkg.Role, error) {
 	}
 }
 
-func (wimpl *workspaceImpl) ListWorkspaces(ctx context.Context, user userpkg.User) ([]Workspace, error) {
-	// make a copy of the workspaces
-	// append only those that have read rights or are not hidden
-	aws := make([]Workspace, 0, len(wimpl.ws))
-	for _, w := range wimpl.ws {
-		aw := w
-		// set hasaccess for this particular user
-		aw.HasAccess = w.UserHasAccess(user)
-		if aw.HasAccess || !aw.HideForUnauthorized {
-
-			if !aw.HasAccess {
-				// append the missing roles
-				missingRoles := [][]MissingRole{}
-				for _, group := range aw.Roles {
-					missing := []MissingRole{}
-					for _, r := range group {
-						if !userpkg.UserHasRole(user, r) {
-							missing = append(missing, MissingRole{Name: r, Description: wimpl.roleDescriptions[string(r)]})
-						}
-					}
-					missingRoles = append(missingRoles, missing)
-				}
-				aw.MissingRoles = missingRoles
-			}
-			aws = append(aws, aw)
-		}
-	}
+func (wimpl *workspaceImpl) ListWorkspaces() []Workspace {
+	return wimpl.ws
+}
 
-	// return authorized list
-	return aws, nil
+type WorkspaceGetRequest struct {
+	Name        string   `json:"name"`
+	Description string   `json:"description"`
+	Roles       []string `json:"roles"`
 }

pkg/workspace/workspace_test.go

@@ -5,9 +5,7 @@ import (
 	"encoding/json"
 	"testing"
 
-	"github.com/equinor/flowify-workflows-server/auth"
 	"github.com/equinor/flowify-workflows-server/pkg/workspace"
-	"github.com/equinor/flowify-workflows-server/user"
 	"github.com/stretchr/testify/require"
 	core "k8s.io/api/core/v1"
 	"k8s.io/client-go/kubernetes/fake"
@@ -117,32 +115,12 @@ func getClient() workspace.WorkspaceClient {
 
 func Test_WorkspaceClientListWorkspaces(t *testing.T) {
 	client := getClient()
-	ws, err := client.ListWorkspaces(ctx, auth.AzureTokenUser{Roles: []user.Role{"token1", "token4", "token3", "token2"}})
-	require.NoError(t, err)
+	ws := client.ListWorkspaces()
 
 	// Should return both workspaces
 	require.Len(t, ws, 2)
-
-	ws, err = client.ListWorkspaces(ctx, auth.AzureTokenUser{Roles: []user.Role{"token1", "token2"}})
-	require.NoError(t, err)
-
-	// Should return one workspace with no access
-	require.Len(t, ws, 1)
-	require.Equal(t, "workspace-xyz", ws[0].Name)
-	require.Equal(t, false, ws[0].HasAccess)
-	require.Len(t, ws[0].MissingRoles, 1)
-	require.Equal(t, user.Role("token4"), ws[0].MissingRoles[0][0].Name)
-	require.Equal(t, "Only given to the bravest", ws[0].MissingRoles[0][0].Description)
-
-	ws, err = client.ListWorkspaces(ctx, auth.AzureTokenUser{Roles: []user.Role{"token1", "token4"}})
-	require.NoError(t, err)
-
-	// Should return one workspace that can be accessed
-	require.Len(t, ws, 2)
-
 	for _, w := range ws {
 		require.Contains(t, []string{"workspace-xyz", "workspace-abc"}, w.Name)
-		require.Equal(t, true, w.HasAccess)
 	}
 }
 
@@ -154,16 +132,11 @@ func Test_WorkspaceNoRoleConfigMap(t *testing.T) {
 
 	client := workspace.NewWorkspaceClient(fake.NewSimpleClientset(&cm1, &cm2), namespace)
 
-	ws, err := client.ListWorkspaces(ctx, auth.AzureTokenUser{Roles: []user.Role{"token1", "token2"}})
-	require.NoError(t, err)
+	ws := client.ListWorkspaces()
 
-	// Should return one workspace with no access
-	require.Len(t, ws, 1)
-	require.Equal(t, "workspace-xyz", ws[0].Name)
-	require.Equal(t, false, ws[0].HasAccess)
-	require.Len(t, ws[0].MissingRoles, 1)
-	require.Equal(t, user.Role("token4"), ws[0].MissingRoles[0][0].Name)
-	require.Len(t, ws[0].MissingRoles[0][0].Description, 0, "no descriptions for any roles")
-
-	require.Nil(t, err)
+	// Should return both workspaces
+	require.Len(t, ws, 2)
+	for _, w := range ws {
+		require.Contains(t, []string{"workspace-xyz", "workspace-abc"}, w.Name)
+	}
 }

rest/components.go

@@ -356,8 +356,9 @@ func InitializeMetadata(ctx context.Context, meta *models.Metadata) error {
 	id := models.NewComponentReference()
 	meta.Uid = id
 	TouchMetadata(ctx, meta)
+	err := meta.Version.InitializeNew()
 
-	return nil
+	return err
 }
 
 func TouchMetadata(ctx context.Context, meta *models.Metadata) {