Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ui: Ensure we check intention service prefix permissions for per service #11409

Merged
merged 4 commits into from
Nov 4, 2021
Merged

ui: Ensure we check intention service prefix permissions for per service #11409

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f626042
ui: Ensure we check intention service prefix permissions for per serv…
johncowen Oct 25, 2021
57e0c63
Changelog
Oct 25, 2021
5659091
Lint
Oct 25, 2021
ee266c7
We reversed the conditional here between 1.10 and 1.11
Oct 25, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .changelog/11409.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
```release-note:bug
ui: Ensure we check intention permissions for specific services when deciding
whether to show action buttons for per service intention actions
```
11 changes: 10 additions & 1 deletion ui/packages/consul-ui/app/abilities/service-instance.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,14 @@
import BaseAbility from './base';
import BaseAbility, { ACCESS_READ, ACCESS_WRITE } from './base';

export default class ServiceInstanceAbility extends BaseAbility {
resource = 'service';
generateForSegment(segment) {
// When we ask for service-instances its almost like a request for a single service
// When we do that we also want to know if we can read/write intentions for services
// so here we add intentions read/write for the specific segment/service prefix
return super.generateForSegment(...arguments).concat([
this.permissions.generate('intention', ACCESS_READ, segment),
this.permissions.generate('intention', ACCESS_WRITE, segment),
]);
}
}
28 changes: 28 additions & 0 deletions ui/packages/consul-ui/app/abilities/service.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,4 +6,32 @@ export default class ServiceAbility extends BaseAbility {
get isLinkable() {
return this.item.InstanceCount > 0;
}

get canReadIntention() {
if (typeof this.item === 'undefined' || typeof this.item.Resources === 'undefined') {
return false;
}
const found = this.item.Resources.find(
item => item.Resource === 'intention' && item.Access === 'read' && item.Allow === true
);
return typeof found !== 'undefined';
}

get canWriteIntention() {
if (typeof this.item === 'undefined' || typeof this.item.Resources === 'undefined') {
return false;
}
const found = this.item.Resources.find(
item => item.Resource === 'intention' && item.Access === 'write' && item.Allow === true
);
return typeof found !== 'undefined';
}

get canCreateIntention() {
return this.canWriteIntention;
}

get canUpdateIntention() {
return this.canWriteIntention;
}
}
2 changes: 1 addition & 1 deletion ui/packages/consul-ui/app/components/consul/intention/form/index.hbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ as |api|>

<BlockSlot @name="form">
{{#let api.data as |item|}}
{{#if (can 'write intention' item=item)}}
{{#if (not readonly)}}

{{#let (changeset-get item 'Action') as |newAction|}}
<ModalDialog
Expand Down
4 changes: 4 additions & 0 deletions ui/packages/consul-ui/app/components/topology-metrics/down-lines/index.hbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,12 +82,14 @@
</svg>
{{/if}}

{{#let (not (can 'update intention for service' item=@service.Service)) as |disabled|}}
{{#each @items as |item|}}
{{#if (or (not item.Intention.Allowed) item.Intention.HasPermissions)}}
<TopologyMetrics::Popover
@type={{if item.Intention.HasPermissions 'l7' 'deny'}}
@position={{find-by 'id' (concat this.guid item.Namespace item.Name) this.iconPositions}}
@item={{item}}
@disabled={{disabled}}
@oncreate={{action @oncreate item @service}}
/>
{{else if (and item.Intention.Allowed (not item.TransparentProxy) (eq item.Source 'specific-intention'))}}
Expand All @@ -96,8 +98,10 @@
@service={{@service}}
@position={{find-by 'id' (concat this.guid item.Namespace item.Name) this.iconPositions}}
@item={{item}}
@disabled={{disabled}}
@oncreate={{action @oncreate item @service}}
/>
{{/if}}
{{/each}}
{{/let}}

272 changes: 143 additions & 129 deletions ui/packages/consul-ui/app/components/topology-metrics/popover/index.hbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,133 +2,147 @@
class="topology-metrics-popover {{@type}}"
...attributes
>

{{#if (eq @type 'deny')}}
<InformedAction
class="dangerous"
{{did-insert (set this 'popover')}}
>
<:header>
<h3>
{{t "components.consul.topology-metrics.popover.deny.header"}}
</h3>
</:header>
<:body>
<p>
{{#if @item.Intention.HasExact}}
{{t "components.consul.topology-metrics.popover.deny.body.isExact"}}
{{else}}
{{t "components.consul.topology-metrics.popover.deny.body.notExact"}}
{{/if}}
</p>
</:body>
<:actions as |Actions|>
<Actions.Action class="action">
<button
{{on "click" @oncreate}}
data-test-confirm
type="button"
>
{{#if @item.Intention.HasExact}}
{{t "components.consul.topology-metrics.popover.deny.action.isExact"}}
{{else}}
{{t "components.consul.topology-metrics.popover.deny.action.notExact"}}
{{/if}}
</button>
</Actions.Action>
<Actions.Action>
<button
{{on 'click' (fn (optional this.popoverController.hide))}}
class="cancel"
type="button"
>
Cancel
</button>
</Actions.Action>
</:actions>
</InformedAction>
{{else if (eq @type 'not-defined')}}
<InformedAction
class="warning documentation"
{{did-insert (set this 'popover')}}
>
<:header>
<h3>
{{t "components.consul.topology-metrics.popover.not-defined.header"}}
</h3>
</:header>
<:body>
<p>
{{t "components.consul.topology-metrics.popover.not-defined.body" downstream=@item.Name upstream=@service.Name }}
</p>
</:body>
<:actions as |Actions|>
<Actions.Action class="action">
<a href="{{env 'CONSUL_DOCS_URL'}}/connect/registration/service-registration#upstreams" rel="noopener noreferrer" target="_blank">
{{t "components.consul.topology-metrics.popover.not-defined.action"}}
</a>
</Actions.Action>
<Actions.Action>
<button
{{on 'click' (fn (optional this.popoverController.hide))}}
class="cancel"
type="button"
>
Close
</button>
</Actions.Action>
</:actions>
</InformedAction>
{{else}}
<InformedAction
class="info"
{{did-insert (set this 'popover')}}
>
<:header>
<h3>
{{t "components.consul.topology-metrics.popover.l7.header"}}
</h3>
</:header>
<:body>
<p>
{{t "components.consul.topology-metrics.popover.l7.body"}}
</p>
</:body>
<:actions as |Actions|>
<Actions.Action class="action">
<a href={{href-to 'dc.services.show.intentions.edit' (concat @item.Intention.ID)}}>
{{t "components.consul.topology-metrics.popover.l7.action"}}
</a>
</Actions.Action>
<Actions.Action>
<button
{{on 'click' (fn (optional this.popoverController.hide))}}
class="cancel"
type="button"
>
Close
</button>
</Actions.Action>
</:actions>
</InformedAction>
{{/if}}
<button
{{with-overlay
this.popover
options=(hash
theme="square-tail"
placement="bottom-start"
)
returns=(set this 'popoverController')
}}
{{on 'click' (fn (optional this.popoverController.show))}}
{{disabled (cannot 'update intention' item=item.Intention)}}
type="button"
style={{{concat 'top:' @position.y 'px;left:' @position.x 'px;'}}}
aria-label={{if (eq @type 'deny') 'Add intention' 'View intention'}}
data-test-action
>
</button>
{{#let
(concat 'top:' @position.y 'px;left:' @position.x 'px;')
(if (eq @type 'deny') 'Add intention' 'View intention')
as |style label|}}
{{#if (not @disabled)}}
{{#if (eq @type 'deny')}}
<InformedAction
class="dangerous"
{{did-insert (set this 'popover')}}
>
<:header>
<h3>
{{t "components.consul.topology-metrics.popover.deny.header"}}
</h3>
</:header>
<:body>
<p>
{{#if @item.Intention.HasExact}}
{{t "components.consul.topology-metrics.popover.deny.body.isExact"}}
{{else}}
{{t "components.consul.topology-metrics.popover.deny.body.notExact"}}
{{/if}}
</p>
</:body>
<:actions as |Actions|>
<Actions.Action class="action">
<button
{{on "click" @oncreate}}
data-test-confirm
type="button"
>
{{#if @item.Intention.HasExact}}
{{t "components.consul.topology-metrics.popover.deny.action.isExact"}}
{{else}}
{{t "components.consul.topology-metrics.popover.deny.action.notExact"}}
{{/if}}
</button>
</Actions.Action>
<Actions.Action>
<button
{{on 'click' (fn (optional this.popoverController.hide))}}
class="cancel"
type="button"
>
Cancel
</button>
</Actions.Action>
</:actions>
</InformedAction>
{{else if (eq @type 'not-defined')}}
<InformedAction
class="warning documentation"
{{did-insert (set this 'popover')}}
>
<:header>
<h3>
{{t "components.consul.topology-metrics.popover.not-defined.header"}}
</h3>
</:header>
<:body>
<p>
{{t "components.consul.topology-metrics.popover.not-defined.body" downstream=@item.Name upstream=@service.Name }}
</p>
</:body>
<:actions as |Actions|>
<Actions.Action class="action">
<a href="{{env 'CONSUL_DOCS_URL'}}/connect/registration/service-registration#upstreams" rel="noopener noreferrer" target="_blank">
{{t "components.consul.topology-metrics.popover.not-defined.action"}}
</a>
</Actions.Action>
<Actions.Action>
<button
{{on 'click' (fn (optional this.popoverController.hide))}}
class="cancel"
type="button"
>
Close
</button>
</Actions.Action>
</:actions>
</InformedAction>
{{else}}
<InformedAction
class="info"
{{did-insert (set this 'popover')}}
>
<:header>
<h3>
{{t "components.consul.topology-metrics.popover.l7.header"}}
</h3>
</:header>
<:body>
<p>
{{t "components.consul.topology-metrics.popover.l7.body"}}
</p>
</:body>
<:actions as |Actions|>
<Actions.Action class="action">
<a href={{href-to 'dc.services.show.intentions.edit' (concat @item.Intention.ID)}}>
{{t "components.consul.topology-metrics.popover.l7.action"}}
</a>
</Actions.Action>
<Actions.Action>
<button
{{on 'click' (fn (optional this.popoverController.hide))}}
class="cancel"
type="button"
>
Close
</button>
</Actions.Action>
</:actions>
</InformedAction>
{{/if}}
{{! TODO: Once we can conditionally add a modifier these two buttons }}
{{! should be replaced with a conditional modifer instead }}
<button
{{with-overlay
this.popover
options=(hash
theme="square-tail"
placement="bottom-start"
)
returns=(set this 'popoverController')
}}
{{on 'click' (fn (optional this.popoverController.show))}}
type="button"
style={{{style}}}
aria-label={{label}}
data-test-action
>
</button>
{{else}}
<button
{{disabled true}}
type="button"
style={{{style}}}
aria-label={{label}}
data-test-action
>
</button>
{{/if}}
{{/let}}
</div>


2 changes: 1 addition & 1 deletion ui/packages/consul-ui/app/components/topology-metrics/up-lines/index.hbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,13 +82,13 @@
{{/each}}
</svg>
{{/if}}

{{#each @items as |item|}}
{{#if (or (not item.Intention.Allowed) item.Intention.HasPermissions)}}
<TopologyMetrics::Popover
@type={{if item.Intention.HasPermissions 'l7' 'deny'}}
@position={{find-by 'id' (concat this.guid item.Namespace item.Name) this.iconPositions}}
@item={{item}}
@disabled={{false}}
@oncreate={{action @oncreate @service item}}
/>
{{/if}}
Expand Down
5 changes: 4 additions & 1 deletion ui/packages/consul-ui/app/services/repository.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,9 +79,12 @@ export default class RepositoryService extends Service {
throw e;
}
}
const item = await cb();
const item = await cb(params.resources);
// add the `Resource` information to the record/model so we can inspect
// them in other places like templates etc
// TODO: We mostly use this to authorize single items but we do
// occasionally get an array back here e.g. service-instances, so we
// should make this fact more obvious
if (get(item, 'Resources')) {
set(item, 'Resources', params.resources);
}
Expand Down
Loading