Add protoc-gen-auth plugin to generate the service.pb.auth.go automatically

[knanao]

What this PR does / why we need it:

How to generate auth file

Please add the method option in your proto file like this.

service WebService {
    // Piped
    rpc RegisterPiped(RegisterPipedRequest) returns (RegisterPipedResponse) {
        option (model.role).project_role = ADMIN;
    }
    rpc UpdatePiped(UpdatePipedRequest) returns (UpdatePipedResponse) {
        option (model.role).project_role = EDITOR;
    }
    rpc RecreatePipedKey(RecreatePipedKeyRequest) returns (RecreatePipedKeyResponse) {
        option (model.role).project_role = VIEWER;
   }
   ...
}

Run make gen/code

You can generate the.pb.auth.go file through the make command.

// Copyright 2022 The PipeCD Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

// Code generated by protoc-gen-auth. DO NOT EDIT.
// source: pkg/app/server/service/webservice/service.proto

package webservice

import (
	"github.com/pipe-cd/pipecd/pkg/model"
	"github.com/pipe-cd/pipecd/pkg/rpc/rpcauth"
)

type authorizer struct{}

// NewRBACAuthorizer returns an RBACAuthorizer object for checking requested method based on RBAC.
func NewRBACAuthorizer() rpcauth.RBACAuthorizer {
	return &authorizer{}
}

func isAdmin(r model.Role) bool {
	return r.ProjectRole == model.Role_ADMIN
}

func isEditor(r model.Role) bool {
	return r.ProjectRole == model.Role_EDITOR
}

func isViewer(r model.Role) bool {
	return r.ProjectRole == model.Role_VIEWER
}

// Authorize checks whether a role is enough for given gRPC method or not.
func (a *authorizer) Authorize(method string, r model.Role) bool {
	switch method {
	case "/grpc.service.webservice.WebService/RegisterPiped":
		return isAdmin(r)
	case "/grpc.service.webservice.WebService/UpdatePiped":
		return isAdmin(r)
	case "/grpc.service.webservice.WebService/RecreatePipedKey":
		return isAdmin(r)
	case "/grpc.service.webservice.WebService/DeleteOldPipedKeys":
		return isAdmin(r)
         ...
	case "/grpc.service.webservice.WebService/AddApplication":
		return isAdmin(r) || isEditor(r)
	case "/grpc.service.webservice.WebService/UpdateApplication":
		return isAdmin(r) || isEditor(r)
	case "/grpc.service.webservice.WebService/EnableApplication":
		return isAdmin(r) || isEditor(r)
	case "/grpc.service.webservice.WebService/DisableApplication":
		return isAdmin(r) || isEditor(r)
	case "/grpc.service.webservice.WebService/DeleteApplication":
		return isAdmin(r) || isEditor(r)
         ...
	case "/grpc.service.webservice.WebService/ListPipeds":
		return isAdmin(r) || isEditor(r) || isViewer(r)
	case "/grpc.service.webservice.WebService/GetPiped":
		return isAdmin(r) || isEditor(r) || isViewer(r)
	case "/grpc.service.webservice.WebService/ListApplications":
		return isAdmin(r) || isEditor(r) || isViewer(r)
         ...
	}
	return false
}

Which issue(s) this PR fixes:

Fixes #

Does this PR introduce a user-facing change?:

NONE

[nghialv]

I think we should not include the plugin binary to this GitHub repository.
tool/codegen/protoc-gen-auth/protoc-gen-auth

Instead of that, it should be built by using a multi-stage Dockerfile like this one:
https://github.com/pipe-cd/pipecd/blob/master/tool/static/Dockerfile#L1

[knanao]

@nghialv
Right.
But if we do so, we need to build protoc-gen-auth every time before running make gen/code in the workflow. don't you?
Or is there another better way?

[nghialv]

No, I meant building it once when making the container image.
When running that make gen/code the pre-built container image will be downloaded to run. No need to rebuild.

[pipecd-bot]

A Kapetanios build has just been triggered to run docker operations for the following 1 directory.
Their results will be reported back after the build is completed.

1. tool/codegen

[pipecd-bot]

The Kapetanios build to run docker operations for the following 1 directory has been completed.

1. tool/codegen - success

An image named codegen:0.7.0-ba4eb5f was procuded for reviewing and testing.
By merging this PR, an image named codegen:0.7.0 will be pushed to the container registry.

There is no test to run inside this directory.

WARNING: Currently existing container image codegen:0.7.0 will be overridden after merging because this PR did not change the image version.

[knanao]

Let me update tool/codegen version in another PR to avoid including generated file in this PR.

[pipecd-bot]

A Kapetanios build has just been triggered to run docker operations for the following 1 directory.
Their results will be reported back after the build is completed.

1. tool/codegen

[pipecd-bot]

The Kapetanios build to run docker operations for the following 1 directory has been completed.

1. tool/codegen - success

An image named codegen:0.8.0-a65ddc3 was procuded for reviewing and testing.
By merging this PR, an image named codegen:0.8.0 will be pushed to the container registry.

There is no test to run inside this directory.

[pipecd-bot]

A Kapetanios build has just been triggered to run docker operations for the following 1 directory.
Their results will be reported back after the build is completed.

1. tool/codegen

[pipecd-bot]

The following ISSUES will be created once got merged. If you want me to skip creating the issue, you can use /todo skip command.

Details

---

1. This way can not parse the first value of enum for some reasons hence

pipecd/tool/codegen/protoc-gen-auth/main.go

Lines 107 to 110 in 722b591

	// FIXME: This way can not parse the first value of enum for some reasons hence
	// set VIEWER for default value.
	method.Role = "VIEWER"
	if v.String() != "" {

This was created by todo plugin since "FIXME:" was found in 722b591 when #3623 was merged. cc: @knanao.

[pipecd-bot]

The Kapetanios build to run docker operations for the following 1 directory has been completed.

1. tool/codegen - success

An image named codegen:0.8.0-722b591 was procuded for reviewing and testing.
By merging this PR, an image named codegen:0.8.0 will be pushed to the container registry.

There is no test to run inside this directory.

[nghialv]

Great job!

[khanhtc1202]

Cool 🙌