Skip to content

ROX-11101: Remove deprecated resources from UI #3098

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rhybrillou merged 5 commits into from
Sep 23, 2022
Merged

ROX-11101: Remove deprecated resources from UI #3098

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
76ea8e3
ROX-11101: Remove deprecated resources from UI
rhybrillou Sep 15, 2022
d919c24
style fixes and second pass
rhybrillou Sep 16, 2022
be67d8a
UI Build fixes
rhybrillou Sep 21, 2022
4afec50
Change aggregated permission access computation method to most restri…
rhybrillou Sep 21, 2022
9311186
Restore permissions replaced by Administration and Compliance as thes…
rhybrillou Sep 21, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 4 additions & 6 deletions ui/apps/platform/cypress/fixtures/auth/adminUserStatus.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,18 +5,16 @@
"permissions": {
"name": "Admin",
"resourceToAccess": {
"AuthProvider": "READ_WRITE_ACCESS",
"Cluster": "READ_WRITE_ACCESS",
"User": "READ_WRITE_ACCESS"
"Access": "READ_WRITE_ACCESS",
"Cluster": "READ_WRITE_ACCESS"
}
},
"roles": [
{
"name": "Admin",
"resourceToAccess": {
"AuthProvider": "READ_WRITE_ACCESS",
"Cluster": "READ_WRITE_ACCESS",
"User": "READ_WRITE_ACCESS"
"Access": "READ_WRITE_ACCESS",
"Cluster": "READ_WRITE_ACCESS"
}
}
],
Expand Down
10 changes: 4 additions & 6 deletions ui/apps/platform/cypress/fixtures/auth/basicAuthAdminStatus.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,18 +12,16 @@
"permissions": {
"name": "Admin",
"resourceToAccess": {
"AuthProvider": "READ_WRITE_ACCESS",
"Cluster": "READ_WRITE_ACCESS",
"User": "READ_WRITE_ACCESS"
"Access": "READ_WRITE_ACCESS",
"Cluster": "READ_WRITE_ACCESS"
}
},
"roles": [
{
"name": "Admin",
"resourceToAccess": {
"AuthProvider": "READ_WRITE_ACCESS",
"Cluster": "READ_WRITE_ACCESS",
"User": "READ_WRITE_ACCESS"
"Access": "READ_WRITE_ACCESS",
"Cluster": "READ_WRITE_ACCESS"
}
}
],
Expand Down
6 changes: 3 additions & 3 deletions ui/apps/platform/cypress/fixtures/auth/multiRolesUserStatus.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,22 +12,22 @@
"permissions": {
"name": "Admin",
"resourceToAccess": {
"User": "READ_WRITE_ACCESS"
"Access": "READ_WRITE_ACCESS"
}
},
"roles": [
{
"name": "Admin",
"accessScopeId": "io.stackrox.authz.accessscope.unrestricted",
"resourceToAccess": {
"User": "READ_WRITE_ACCESS"
"Access": "READ_WRITE_ACCESS"
}
},
{
"name": "Analyst",
"accessScopeId": "io.stackrox.authz.accessscope.unrestricted",
"resourceToAccess": {
"User": "READ_ACCESS"
"Access": "READ_ACCESS"
}
},
{
Expand Down
17 changes: 1 addition & 16 deletions ui/apps/platform/cypress/fixtures/auth/mypermissionsMinimalAccess.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,30 +26,15 @@
"VulnerabilityReports": "NO_ACCESS",
"WatchedImage": "READ_ACCESS",
"AllComments": "NO_ACCESS",
"APIToken": "NO_ACCESS",
"AuthProvider": "NO_ACCESS",
"BackupPlugins": "NO_ACCESS",
"ComplianceRuns": "NO_ACCESS",
"ComplianceRunSchedule": "NO_ACCESS",
"Config": "READ_ACCESS",
"DebugLogs": "NO_ACCESS",
"Group": "NO_ACCESS",
"ImageComponent": "NO_ACCESS",
"ImageIntegration": "NO_ACCESS",
"Indicator": "NO_ACCESS",
"Licenses": "NO_ACCESS",
"NetworkBaseline": "NO_ACCESS",
"NetworkGraphConfig": "NO_ACCESS",
"Notifier": "NO_ACCESS",
"ProbeUpload": "NO_ACCESS",
"ProcessWhitelist": "NO_ACCESS",
"Risk": "NO_ACCESS",
"Role": "NO_ACCESS",
"ScannerBundle": "NO_ACCESS",
"ScannerDefinitions": "NO_ACCESS",
"SensorUpgradeConfig": "NO_ACCESS",
"ServiceIdentity": "NO_ACCESS",
"SignatureIntegration": "NO_ACCESS",
"User": "NO_ACCESS"
"ServiceIdentity": "NO_ACCESS"
}
}
17 changes: 1 addition & 16 deletions ui/apps/platform/cypress/fixtures/auth/mypermissionsNoAccess.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,30 +26,15 @@
"VulnerabilityReports": "NO_ACCESS",
"WatchedImage": "NO_ACCESS",
"AllComments": "NO_ACCESS",
"APIToken": "NO_ACCESS",
"AuthProvider": "NO_ACCESS",
"BackupPlugins": "NO_ACCESS",
"ComplianceRuns": "NO_ACCESS",
"ComplianceRunSchedule": "NO_ACCESS",
"Config": "NO_ACCESS",
"DebugLogs": "NO_ACCESS",
"Group": "NO_ACCESS",
"ImageComponent": "NO_ACCESS",
"ImageIntegration": "NO_ACCESS",
"Indicator": "NO_ACCESS",
"Licenses": "NO_ACCESS",
"NetworkBaseline": "NO_ACCESS",
"NetworkGraphConfig": "NO_ACCESS",
"Notifier": "NO_ACCESS",
"ProbeUpload": "NO_ACCESS",
"ProcessWhitelist": "NO_ACCESS",
"Risk": "NO_ACCESS",
"Role": "NO_ACCESS",
"ScannerBundle": "NO_ACCESS",
"ScannerDefinitions": "NO_ACCESS",
"SensorUpgradeConfig": "NO_ACCESS",
"ServiceIdentity": "NO_ACCESS",
"SignatureIntegration": "NO_ACCESS",
"User": "NO_ACCESS"
"ServiceIdentity": "NO_ACCESS"
}
}
12 changes: 6 additions & 6 deletions ui/apps/platform/cypress/integration/userinfo.test.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,8 +113,8 @@ describe('User Info', () => {
cy.get(`${userPageSelectors.userRoleNames}:contains("Analyst")`).click();

// check that read is allowed and write is forbidden
cy.get(userPageSelectors.permissionsTable.allowedIcon('User', 'read'));
cy.get(userPageSelectors.permissionsTable.forbiddenIcon('User', 'write'));
cy.get(userPageSelectors.permissionsTable.allowedIcon('Access', 'read'));
cy.get(userPageSelectors.permissionsTable.forbiddenIcon('Access', 'write'));
});

it('should properly highlight current nav item', () => {
Expand Down Expand Up @@ -149,10 +149,10 @@ describe('User Info', () => {
cy.get(userPageSelectors.userName).should('contain.text', 'admin');
cy.get(userPageSelectors.authProviderName).should('contain.text', 'Basic');

cy.get(userPageSelectors.permissionsTable.permissionColumn('User', 'read'))
cy.get(userPageSelectors.permissionsTable.permissionColumn('Access', 'read'))
.should('contain.text', 'Admin')
.should('not.contain.text', 'Analyst');
cy.get(userPageSelectors.permissionsTable.permissionColumn('User', 'write'))
cy.get(userPageSelectors.permissionsTable.permissionColumn('Access', 'write'))
.should('contain.text', 'Admin')
.should('not.contain.text', 'Analyst');
});
Expand All @@ -165,10 +165,10 @@ describe('User Info', () => {
cy.get(userPageSelectors.userName).should('contain.text', 'ai');
cy.get(userPageSelectors.authProviderName).should('contain.text', 'My OIDC Provider');

cy.get(userPageSelectors.permissionsTable.permissionColumn('User', 'read'))
cy.get(userPageSelectors.permissionsTable.permissionColumn('Access', 'read'))
.should('contain.text', 'Admin')
.should('contain.text', 'Analyst');
cy.get(userPageSelectors.permissionsTable.permissionColumn('User', 'write'))
cy.get(userPageSelectors.permissionsTable.permissionColumn('Access', 'write'))
.should('contain.text', 'Admin')
.should('not.contain.text', 'Analyst');
});
Expand Down
2 changes: 1 addition & 1 deletion ui/apps/platform/src/Containers/AccessControl/AccessControl.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ function AccessControl(): ReactElement {
// TODO is read access required for all routes in improved Access Control?
// TODO Is write access required anywhere in classic Access Control?
const { hasReadAccess } = usePermissions();
const hasReadAccessForAuthProvider = hasReadAccess('AuthProvider');
const hasReadAccessForAuthProvider = hasReadAccess('Access');

return (
<>
Expand Down
2 changes: 1 addition & 1 deletion ui/apps/platform/src/Containers/AccessControl/AuthProviders/AuthProviders.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,7 +81,7 @@ function AuthProviders(): ReactElement {
userRolePermissions,
availableProviderTypes,
} = useSelector(authProviderState);
const hasWriteAccess = getHasReadWritePermission('AuthProvider', userRolePermissions);
const hasWriteAccess = getHasReadWritePermission('Access', userRolePermissions);

const authProvidersWithRules = mergeGroupsWithAuthProviders(authProviders, groups);

Expand Down
21 changes: 0 additions & 21 deletions ui/apps/platform/src/Containers/AccessControl/PermissionSets/ResourceDescription.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,14 +8,9 @@ const resourceDescriptions: Record<ResourceName, string> = {
Access: 'Read: View configuration for authentication and authorization, such as authentication services, roles, groups, and users. Write: Modify configuration for authentication and authorization.',
Administration:
'Read: View platform configuration (e.g., network graph, sensor, debugging configs). Write: Modify platform configuration, delete comments from other users.',
APIToken: 'Read: View API tokens. Write: Add or revoke API tokens.',
Alert: 'Read: View policy violations. Write: Resolve or edit policy violations.',
AllComments:
'Read: N/A Write: Delete comments from other users. All users can edit and delete their own comments by default. To add and remove comments or tags, you need a role with write access for the resource you are modifying.',
AuthProvider:
'Read: View configuration for authentication services. Write: Modify configuration for authentication services.',
BackupPlugins:
'Read: View backup integrations and configurations. Write: Modify backup integrations and configurations.',
CVE: 'Internal use only',
Cluster: 'Read: View secured clusters. Write: Add, modify, or delete secured clusters.',
Compliance:
Expand All @@ -31,12 +26,7 @@ const resourceDescriptions: Record<ResourceName, string> = {
DeploymentExtension:
'Read: View network and process baseline extensions, risk score of deployments. Write: Modify the process and network baseline extensions of deployments.',
Detection: 'Read: Check build-time policies against images or deployment YAMLs. Write: N/A',
Group: 'Read: View the RBAC rules that match user metadata to the system roles. Write: Add, modify, or delete RBAC rules.',
Image: 'Read: View images, their components, and their vulnerabilities. Write: N/A',
ImageComponent: 'Internal use only',
ImageIntegration:
'Read: List image registry integrations. Write: Add, edit, or delete image registry integrations.',
Indicator: 'Read: View process activity in deployments. Write: N/A',
Integration:
'Read: View integrations and their configuration. This includes backup, registry, image signature and notification systems, API tokens. Write: Add, modify, delete integrations and their configuration, API tokens.',
K8sRole:
Expand All @@ -45,25 +35,17 @@ const resourceDescriptions: Record<ResourceName, string> = {
'Read: View role bindings for Kubernetes role-based access control in secured clusters. Write: N/A',
K8sSubject:
'Read: View users and groups for Kubernetes role-based access control in secured clusters. Write: N/A',
Licenses: 'Read: View the status of the license. Write: Upload a new license key.',
Namespace: 'Read: View Kubernetes namespaces in secured clusters. Write: N/A',
NetworkBaseline: 'Read: View network baseline results. Write: Modify network baselines.',
NetworkGraph:
'Read: View active and allowed network connections in secured clusters. Write: N/A',
NetworkGraphConfig:
'Read: View network graph configuration. Write: Modify network graph configuration.',
NetworkPolicy:
'Read: View network policies in secured clusters and simulate changes. Write: Apply network policy changes in secured clusters.',
Node: 'Read: View Kubernetes nodes in secured clusters. Write: N/A',
Notifier:
'Read: View integrations for notification systems like email, Jira, or webhooks. Write: Add, modify, or delete integrations for notification systems.',
Policy: 'Read: View system policies. Write: Add, modify, or delete system policies.',
ProbeUpload:
'Read: Read manifests for the uploaded probe files. Write: Upload support packages to Central.',
ProcessWhitelist:
'Read: View process baselines. Write: Add or remove processes from baselines.',
Risk: 'Read: View Risk results. Write: N/A',
Role: 'Read: View roles and permission sets. Write: Add, modify, or delete roles and permission sets.',
ScannerBundle: 'Read: Download the scanner bundle. Write: N/A',
ScannerDefinitions:
'Read: List image scanner integrations. Write: Add, modify, or delete image scanner integrations.',
Expand All @@ -73,9 +55,6 @@ const resourceDescriptions: Record<ResourceName, string> = {
ServiceAccount: 'Read: List Kubernetes service accounts in secured clusters. Write: N/A',
ServiceIdentity:
'Read: View metadata about service-to-service authentication. Write: Revoke or reissue service-to-service authentication credentials.',
SignatureIntegration:
'Read: View signature integrations and configurations. Write: Add, modify, or delete signature integrations and configurations.',
User: 'Read: View information about the users who have accessed the user interface or APIs, including the metadata from the authentication providers. Write: N/A',
VulnerabilityManagementApprovals:
'Read: View all pending deferral or false positive requests for vulnerabilities. Write: Approve or deny any pending deferral or false positive requests and move any previously approved requests back to observed.',
VulnerabilityManagementRequests:
Expand Down
15 changes: 3 additions & 12 deletions ui/apps/platform/src/Containers/Integrations/hooks/useIntegrationPermissions.test.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,10 +14,7 @@ const initialStoreWrite = {
roles: {
userRolePermissions: {
resourceToAccess: {
APIToken: 'READ_WRITE_ACCESS',
BackupPlugins: 'READ_WRITE_ACCESS',
ImageIntegration: 'READ_WRITE_ACCESS',
Notifier: 'READ_WRITE_ACCESS',
Integration: 'READ_WRITE_ACCESS',
},
},
},
Expand All @@ -28,10 +25,7 @@ const initialStoreRead = {
roles: {
userRolePermissions: {
resourceToAccess: {
APIToken: 'READ_ACCESS',
BackupPlugins: 'READ_ACCESS',
ImageIntegration: 'READ_ACCESS',
Notifier: 'READ_ACCESS',
Integration: 'READ_ACCESS',
},
},
},
Expand All @@ -42,10 +36,7 @@ const initialStoreNone = {
roles: {
userRolePermissions: {
resourceToAccess: {
APIToken: 'NO_ACCESS',
BackupPlugins: 'NO_ACCESS',
ImageIntegration: 'NO_ACCESS',
Notifier: 'NO_ACCESS',
Integration: 'NO_ACCESS',
},
},
},
Expand Down
20 changes: 10 additions & 10 deletions ui/apps/platform/src/Containers/Integrations/hooks/useIntegrationPermissions.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,24 +19,24 @@ const useIntegrationPermissions = (): UseIntegrationPermissionsResponse => {

return {
authProviders: {
write: getHasReadWritePermission('APIToken', userRolePermissions),
read: getHasReadPermission('APIToken', userRolePermissions),
write: getHasReadWritePermission('Integration', userRolePermissions),
read: getHasReadPermission('Integration', userRolePermissions),
},
notifiers: {
write: getHasReadWritePermission('Notifier', userRolePermissions),
read: getHasReadPermission('Notifier', userRolePermissions),
write: getHasReadWritePermission('Integration', userRolePermissions),
read: getHasReadPermission('Integration', userRolePermissions),
},
imageIntegrations: {
write: getHasReadWritePermission('ImageIntegration', userRolePermissions),
read: getHasReadPermission('ImageIntegration', userRolePermissions),
write: getHasReadWritePermission('Integration', userRolePermissions),
read: getHasReadPermission('Integration', userRolePermissions),
},
backups: {
write: getHasReadWritePermission('BackupPlugins', userRolePermissions),
read: getHasReadPermission('BackupPlugins', userRolePermissions),
write: getHasReadWritePermission('Integration', userRolePermissions),
read: getHasReadPermission('Integration', userRolePermissions),
},
signatureIntegrations: {
write: getHasReadWritePermission('SignatureIntegration', userRolePermissions),
read: getHasReadPermission('SignatureIntegration', userRolePermissions),
write: getHasReadWritePermission('Integration', userRolePermissions),
read: getHasReadPermission('Integration', userRolePermissions),
},
};
};
Expand Down
4 changes: 2 additions & 2 deletions ui/apps/platform/src/Containers/VulnMgmt/Reports/Detail/VulnMgmtReportDetail.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,8 +51,8 @@ function VulnMgmtReportDetail({ report }: VulnMgmtReportDetailProps): ReactEleme

const { hasReadWriteAccess } = usePermissions();
const hasVulnReportWriteAccess = hasReadWriteAccess('VulnerabilityReports');
const hasAccessScopeWriteAccess = hasReadWriteAccess('AuthProvider');
const hasNotifierIntegrationWriteAccess = hasReadWriteAccess('Notifier');
const hasAccessScopeWriteAccess = hasReadWriteAccess('Access');
const hasNotifierIntegrationWriteAccess = hasReadWriteAccess('Integration');
const canWriteReports =
hasVulnReportWriteAccess && hasAccessScopeWriteAccess && hasNotifierIntegrationWriteAccess;

Expand Down
4 changes: 2 additions & 2 deletions ui/apps/platform/src/Containers/VulnMgmt/Reports/VulnMgmtReportForm.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,10 +104,10 @@ function VulnMgmtReportForm({
const [message, setMessage] = useState<FormResponseMessage>(null);

const { hasReadWriteAccess, hasReadAccess } = usePermissions();
const hasRoleWriteAccess = hasReadWriteAccess('Role');
const hasRoleWriteAccess = hasReadWriteAccess('Access');
const hasClusterReadAccess = hasReadAccess('Cluster');
const hasNamespaceReadAccess = hasReadAccess('Namespace');
const hasNotifierWriteAccess = hasReadWriteAccess('Notifier');
const hasNotifierWriteAccess = hasReadWriteAccess('Integration');

const canWriteScopes = hasRoleWriteAccess && hasClusterReadAccess && hasNamespaceReadAccess;

Expand Down
4 changes: 2 additions & 2 deletions ui/apps/platform/src/Containers/VulnMgmt/Reports/VulnMgmtReportTablePage.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,8 +45,8 @@ function ReportTablePage({ query }: ReportTablePageProps): ReactElement {
const { hasReadWriteAccess, hasReadAccess } = usePermissions();
const hasVulnReportWriteAccess = hasReadWriteAccess('VulnerabilityReports');
const hasImageReadAccess = hasReadAccess('Image');
const hasAccessScopeReadAccess = hasReadAccess('Role');
const hasNotifierIntegrationReadAccess = hasReadAccess('Notifier');
const hasAccessScopeReadAccess = hasReadAccess('Access');
const hasNotifierIntegrationReadAccess = hasReadAccess('Integration');
const canWriteReports =
hasVulnReportWriteAccess &&
hasImageReadAccess &&
Expand Down
4 changes: 2 additions & 2 deletions ui/apps/platform/src/Containers/VulnMgmt/Reports/VulnMgmtReportTablePanel.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,8 +83,8 @@ function ReportingTablePanel({

const { hasReadWriteAccess } = usePermissions();
const hasVulnReportWriteAccess = hasReadWriteAccess('VulnerabilityReports');
const hasAccessScopeWriteAccess = hasReadWriteAccess('AuthProvider');
const hasNotifierIntegrationWriteAccess = hasReadWriteAccess('Notifier');
const hasAccessScopeWriteAccess = hasReadWriteAccess('Access');
const hasNotifierIntegrationWriteAccess = hasReadWriteAccess('Integration');
const canWriteReports =
hasVulnReportWriteAccess && hasAccessScopeWriteAccess && hasNotifierIntegrationWriteAccess;

Expand Down
Loading