feat(rbac): improve conditional policy validation

[PatAKnight]

Description

Adds some more validation to conditional policies. This validation ensures that conditional policies do not have criteria defined in parallel. Example can be found below. Also includes a new test for nested conditions. Updates documentation about nested conditions with a not about the lack of support for parallel condition criteria.

Fixes

• Fixes: RHIDP-2157

Special notes to the reviewer

Example of a condition in parallel:

{
  "anyOf": [
    {
      "rule": "IS_ENTITY_OWNER",
      "resourceType": "catalog-entity",
      "params": {
        "claims": ["group:default/team-a"]
      }
    },
    {
      "rule": "IS_ENTITY_KIND",
      "resourceType": "catalog-entity",
      "params": {
        "kinds": ["Group"]
      }
    }
  ],
  "not": {
    "rule": "IS_ENTITY_KIND",
    "resourceType": "catalog-entity",
    "params": { "kinds": ["Api"] }
  }
}

Example of a nested condition:

{
  "anyOf": [
    {
      "rule": "IS_ENTITY_OWNER",
      "resourceType": "catalog-entity",
      "params": {"claims": ["group:default/team-a"]}
    },
    {
      "rule": "IS_ENTITY_KIND",
      "resourceType": "catalog-entity",
      "params": {"kinds": ["Group"]}
    },
    {
      "not": {
        "rule": "IS_ENTITY_KIND",
        "resourceType": "catalog-entity",
        "params": { "kinds": ["Api"] }
      }
    }
  ],
}

Some curl commands to see the following error and to see a successful conditional policy (remember to get your token for the commands):

Error: "RBAC plugin does not support parallel conditions, consider reworking request to include nested condition criteria. Conditional criteria causing the error allOf,not.

Failing curl command:

curl -X POST "http://localhost:7007/api/permission/roles/conditions" -d '{"result":"CONDITIONAL","roleEntityRef": "role:default/developer","pluginId":"catalog","resourceType":"catalog-entity","permissionMapping": ["read","update","delete"],"conditions": {"rule": "IS_ENTITY_OWNER",
"resourceType": "catalog-entity","params": {"claims": ["user:default/dev1"]},"allOf": [{"rule": "IS_ENTITY_OWNER","resourceType": "catalog-entity","params": {"claims": ["user:default/<YOUR_USER>"]}},{"rule": "HAS_LABEL","resourceType": "catalog-entity","params": {"label": "test"}}],"not":{"rule":"IS_ENTITY_KIND","resourceType":"catalog-entity","params":{"kinds":["Api"]}}}}' -H "Content-Type: application/json" -H "Authorization: Bearer $token" -v

Successful curl command:

curl -X POST "http://localhost:7007/api/permission/roles/conditions" -d '{"result":"CONDITIONAL","roleEntityRef": "role:default/developer","pluginId":"catalog","resourceType":"catalog-entity","permissionMapping": ["read","update","delete"],"conditions": {"anyOf": [{"allOf": [{"rule": "IS_ENTITY_OWNER","resourceType": "catalog-entity","params": {"claims": ["user:default/<YOUR_USER>"]}},{"rule": "HAS_LABEL","resourceType": "catalog-entity","params": {"label": "test"}}]},{"not":{"rule":"IS_ENTITY_KIND","resourceType":"catalog-entity","params":{"kinds":["Api"]}}}]}}' -H "Content-Type: application/json" -H "Authorization: Bearer $token" -v

Edit

I have also fixed a bug that originally prevented us from being able to declare conditional permission policies with the permission policy action of use. This would have affected the scaffolder-action example that I included in the documentation.

To test:

1. Add the quay actions plugin module
2. Import in the example location in the plugin's directory
3. Use the following curl command

curl -X POST "http://localhost:7007/api/permission/roles/conditions" -d '{"result":"CONDITIONAL","roleEntityRef": "role:default/developer","pluginId":"scaffolder","resourceType":"scaffolder-action","permissionMapping": ["use"],"conditions": {"not": {"rule": "HAS_ACTION_ID","resourceType": "scaffolder-action","params": {"actionId": "quay:create-repository"}}}}' -H "Content-Type: application/json" -H "Authorization: Bearer $token" -v

4. Attempt to use the quay actions scaffolder template

[sonarcloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.5% Duplication on New Code

See analysis details on SonarCloud

[AndrienkoAleksandr]

Looks good. LGTM. Thank you, Patrick!

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: AndrienkoAleksandr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [AndrienkoAleksandr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment