Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

RBAC should validate the service name for content_type #579

Open
AlanCoding opened this issue Aug 21, 2024 · 0 comments
Open

RBAC should validate the service name for content_type #579

AlanCoding opened this issue Aug 21, 2024 · 0 comments
Labels
app:rbac bug Something isn't working

Comments

@AlanCoding
Copy link
Member

The /role_definitions/ list accepts content_type as one of the fields in the format of "aap.organization". The intent is that the first prefix is the service name, for a cluster of multiple services stitched together by the JWT and resource_registry communication.

While that's the intent, the code just ignored it, test case:

def test_service_name_is_validated(admin_api_client):
    url = get_relative_url('roledefinition-list')
    response = admin_api_client.post(
        url,
        data={
            'name': 'Random custom role',
            'content_type': 'justsomerandomstuff.organization',
            'permissions': ['aap.view_organization', 'local.change_organization'],
        },
    )
    assert response.status_code == 400, response.data
    assert 'service name not valid for model organization' in str(response.data)

This fails with a 201 response_code.

We already had a requirement that the model name is unique within the permission registry. This is intended to change later, to be unique within the registry for a particular service... specifically to support awx.credential and eda.credential, which is a legitimate problem.

However, since we don't have any non-synced services now, model name is safely unique by itself right now, so writing the serializers, I just stopped where I was. This is a TODO for later, as we develop a permissions-provider functionality.

@AlanCoding AlanCoding added bug Something isn't working app:rbac labels Aug 21, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
app:rbac bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant