Space supporter process write permissions (#2359)

* space application supporter can access specific "process" GET endpoints. - add some information about redacted info in the docs * Space supporter can update processes #2211 Co-authored-by: Weyman Fung <weymanf@vmware.com> Co-authored-by: Merric de Launey <mdelauney@pivotal.io> Co-authored-by: Galen Hammond <galenh@vmware.com> Co-authored-by: Belinda Liu <bliu@pivotal.io> Co-authored-by: Mona Mohebbi <mmohebbi@pivotal.io>
cloudfoundry · Jul 1, 2021 · 301aeaf · 301aeaf
1 parent c70f8ec
commit 301aeaf
Show file tree

Hide file tree

Showing 10 changed files with 280 additions and 162 deletions.
diff --git a/app/controllers/v3/processes_controller.rb b/app/controllers/v3/processes_controller.rb
@@ -26,14 +26,14 @@ def index
 
     if app_nested?
       app, dataset = ProcessListFetcher.fetch_for_app(message, eager_loaded_associations: Presenters::V3::ProcessPresenter.associated_resources)
-      app_not_found! unless app && permission_queryer.can_read_from_space?(app.space.guid, app.organization.guid)
+      app_not_found! unless app && permission_queryer.untrusted_can_read_from_space?(app.space.guid, app.organization.guid)
     else
       dataset = if permission_queryer.can_read_globally?
                   ProcessListFetcher.fetch_all(message, eager_loaded_associations: Presenters::V3::ProcessPresenter.associated_resources)
                 else
                   ProcessListFetcher.fetch_for_spaces(
                     message,
-                    space_guids: permission_queryer.readable_space_guids,
+                    space_guids: permission_queryer.readable_application_supporter_space_guids,
                     eager_loaded_associations: Presenters::V3::ProcessPresenter.associated_resources
                   )
                 end
@@ -109,16 +109,16 @@ def stats
   def find_process_and_space
     if app_nested?
       @process, app, @space, org = ProcessFetcher.fetch_for_app_by_type(app_guid: hashed_params[:app_guid], process_type: hashed_params[:type])
-      app_not_found! unless app && permission_queryer.can_read_from_space?(@space.guid, org.guid)
+      app_not_found! unless app && permission_queryer.untrusted_can_read_from_space?(@space.guid, org.guid)
       process_not_found! unless @process
     else
       @process, @space, org = ProcessFetcher.fetch(process_guid: hashed_params[:process_guid])
-      process_not_found! unless @process && permission_queryer.can_read_from_space?(@space.guid, org.guid)
+      process_not_found! unless @process && permission_queryer.untrusted_can_read_from_space?(@space.guid, org.guid)
     end
   end
 
   def ensure_can_write
-    unauthorized! unless permission_queryer.can_write_to_space?(@space.guid)
+    unauthorized! unless permission_queryer.untrusted_can_write_to_space?(@space.guid)
   end
 
   def process_not_found!

diff --git a/docs/v3/source/includes/resources/processes/_get.md.erb b/docs/v3/source/includes/resources/processes/_get.md.erb
@@ -26,12 +26,13 @@ Content-Type: application/json
 `GET /v3/apps/:guid/processes/:type`
 
 #### Permitted roles
- |
+Role | Notes |
 --- | ---
 Admin |
 Admin Read-Only |
-Global Auditor |
-Org Manager |
-Space Auditor |
+Global Auditor | Some fields are redacted
+Org Manager | Some fields are redacted
+Space Application Supporter | Some fields are redacted. Experimental |
+Space Auditor | Some fields are redacted
 Space Developer |
-Space Manager |
+Space Manager | Some fields are redacted
diff --git a/docs/v3/source/includes/resources/processes/_list_for_app.md.erb b/docs/v3/source/includes/resources/processes/_list_for_app.md.erb
@@ -40,7 +40,7 @@ Name | Type | Description
 **updated_ats** (*experimental*)| _[timestamp](#timestamps)_ | Timestamp to filter by. When filtering on equality, several comma-delimited timestamps may be passed. Also supports filtering with [relational operators](#relational-operators-experimental)
 
 #### Permitted roles
- |
+Roles | Notes |
 --- | ---
 Admin |
 Admin Read-Only |
@@ -49,3 +49,4 @@ Org Manager |
 Space Auditor |
 Space Developer |
 Space Manager |
+Space Supporter |
diff --git a/docs/v3/source/includes/resources/processes/_scale.md.erb b/docs/v3/source/includes/resources/processes/_scale.md.erb
@@ -44,3 +44,4 @@ Name | Type | Description
 --- | ---
 Admin |
 Space Developer |
+Space Supporter |
diff --git a/docs/v3/source/includes/resources/processes/_stats.md.erb b/docs/v3/source/includes/resources/processes/_stats.md.erb
@@ -26,12 +26,13 @@ Content-Type: application/json
 `GET /v3/apps/:guid/processes/:type/stats`
 
 #### Permitted roles
- |
+Role | Notes |
 --- | ---
 Admin |
 Admin Read-Only |
-Global Auditor |
-Org Manager |
-Space Auditor |
+Global Auditor | Some fields are redacted
+Org Manager | Some fields are redacted
+Space Application Supporter | Some fields are redacted. Experimental |
+Space Auditor | Some fields are redacted
 Space Developer |
-Space Manager |
+Space Manager | Some fields are redacted
diff --git a/docs/v3/source/includes/resources/processes/_terminate_instance.md b/docs/v3/source/includes/resources/processes/_terminate_instance.md
@@ -31,3 +31,4 @@ This allows a user to stop a single misbehaving instance of a process.
 --- | ---
 Admin |
 Space Developer |
+Space Supporter |
diff --git a/docs/v3/source/includes/resources/processes/_update.md.erb b/docs/v3/source/includes/resources/processes/_update.md.erb
@@ -50,3 +50,4 @@ Name | Type | Description
 --- | ---
 Admin |
 Space Developer |
+Space Supporter |