Skip to content

Commit 1ed99a0

Browse files
committed
Should allow non-admins to view any analytics other than dashboard analytics
* This commit would allow non-admins to view all analytics except for the analytics targeted for the 'Analytics Dashboard', this includes even the drilldown charts.
1 parent 6d1f086 commit 1ed99a0

File tree

2 files changed

+16
-9
lines changed

2 files changed

+16
-9
lines changed

spark/spark-spa/src/main/java/com/thoughtworks/go/spark/spa/AnalyticsDelegate.java

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -125,23 +125,19 @@ private void checkPermissions(Request request, Response response) {
125125

126126
if (isPipelineRequest(request)) {
127127
authenticationHelper.checkPipelineViewPermissionsAnd403(request, response);
128-
} else if (isAgentRequest(request) || isVSMRequest(request)) {
129-
authenticationHelper.checkUserAnd403(request, response);
130-
} else {
128+
} else if (isDashboardRequest(request)) {
131129
authenticationHelper.checkAdminUserAnd403(request, response);
130+
} else {
131+
authenticationHelper.checkUserAnd403(request, response);
132132
}
133133
}
134134

135135
private boolean isPipelineRequest(Request request) {
136136
return "pipeline".equals(request.params(":type"));
137137
}
138138

139-
private boolean isAgentRequest(Request request) {
140-
return "agent".equals(request.params(":type"));
141-
}
142-
143-
private boolean isVSMRequest(Request request) {
144-
return "vsm".equalsIgnoreCase(request.params(":type"));
139+
private boolean isDashboardRequest(Request request) {
140+
return "dashboard".equalsIgnoreCase(request.params(":type"));
145141
}
146142

147143
private boolean isAnalyticsEnabledOnlyForAdmins() {

spark/spark-spa/src/test/groovy/com/thoughtworks/go/spark/spa/AnalyticsDelegateTest.groovy

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -200,6 +200,17 @@ class AnalyticsDelegateTest implements ControllerTrait<AnalyticsDelegate>, Secur
200200
assertRequestAllowed()
201201
}
202202

203+
@Test
204+
void "should allow all users to view drilldown analytics"() {
205+
when(systemEnvironment.enableAnalyticsOnlyForAdmins()).thenReturn(false)
206+
207+
enableSecurity()
208+
loginAsUser()
209+
210+
get(controller.controllerPath("plugin/drilldown/metric"))
211+
assertRequestAllowed()
212+
}
213+
203214
@Test
204215
void "should return 404 when pipeline does not exist"() {
205216
when(pipelineConfigService.pipelineConfigNamed(getPipelineName())).thenReturn(null)

0 commit comments

Comments
 (0)