fix(rbac): conditional access form validation

[ciiay]

RHIDP-2345

Screen recording

rhidp_2345.mov

[sonarcloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.6% Duplication on New Code

See analysis details on SonarCloud

[divyanshiGupta]

@ciiay this actually depends on the plugin devs/maintainer as what condition rules they add to their plugins resource-types.

[ciiay]

Will remove the comment.

[divyanshiGupta]

So if a minItems attribute is available in the paramsSchema of the array param then an empty array will return a validation error. But when the array param for example kinds is just listed as required this will not return any error as we are returning [] and its an acceptable value.

[ciiay]

If it returns an empty array, the item account will be 0 which doesn't meet the minItem: 1 requirement and it throws an error.

[divyanshiGupta]

@AndrienkoAleksandr I am able to add below condition on catalog-entity :

        {
            "rule": "IS_ENTITY_KIND",
            "resourceType": "catalog-entity",
            "params": {
                "kinds": []
            }
         }

On applying above the corresponding role members cannot access any type of catalog-entity kinds. Does this look correct to you?

[AndrienkoAleksandr]

We can deny such conditions with help of validator in the frame of the https://issues.redhat.com/browse/RHIDP-2157 . But maybe it can be feature...

[divyanshiGupta]

But here https://docs.google.com/document/d/1XMEmSlwVog1cOD0X5ADwg53Vnm8PL-HH_8LZriUM7vs/edit?disco=AAABNnL7BR8 kinds is just required which mean kinds cannot be undefined but it can be [] as it doesnt have minItems: 1 to restrict an empty array. So can this might be what plugin condition rules author expects or its a backend bug?

[divyanshiGupta]

@AndrienkoAleksandr ^^

[AndrienkoAleksandr]

So can this might be what plugin condition rules author expects or its a backend bug?

I believe we are not responsible for such arrays. The plugin author designs and controls this aspect.

[divyanshiGupta]

@ciiay PR looks good from UI side as we are checking if minItems is present in param schema then array field uses it to validate the input. But if schema just says that an array is required in which case [] this is also a valid value and plugin maintainers might have intentionally left out minItems restriction. In UI we can only work with what is provided to us in the schema.

I am able to add below condition on catalog-entity :

    {
        "rule": "IS_ENTITY_KIND",
        "resourceType": "catalog-entity",
        "params": {
            "kinds": []
        }
     }

On applying above the corresponding role members cannot access any type of catalog-entity kinds. Does this look correct to you?

@AndrienkoAleksandr If you think above is a backend bug, please log a bug for it.

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: divyanshiGupta

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [divyanshiGupta]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment