Add finer permission requirements for managing webhooks (#25463)

This commit is contained in:
Claire 2023-06-22 14:52:25 +02:00 committed by GitHub
parent 63d15d5330
commit 602c458ab6
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
7 changed files with 52 additions and 7 deletions

View file

@ -28,6 +28,7 @@ module Admin
authorize :webhook, :create? authorize :webhook, :create?
@webhook = Webhook.new(resource_params) @webhook = Webhook.new(resource_params)
@webhook.current_account = current_account
if @webhook.save if @webhook.save
redirect_to admin_webhook_path(@webhook) redirect_to admin_webhook_path(@webhook)
@ -39,6 +40,8 @@ module Admin
def update def update
authorize @webhook, :update? authorize @webhook, :update?
@webhook.current_account = current_account
if @webhook.update(resource_params) if @webhook.update(resource_params)
redirect_to admin_webhook_path(@webhook) redirect_to admin_webhook_path(@webhook)
else else

View file

@ -24,6 +24,8 @@ class Webhook < ApplicationRecord
status.updated status.updated
).freeze ).freeze
attr_writer :current_account
scope :enabled, -> { where(enabled: true) } scope :enabled, -> { where(enabled: true) }
validates :url, presence: true, url: true validates :url, presence: true, url: true
@ -31,6 +33,7 @@ class Webhook < ApplicationRecord
validates :events, presence: true validates :events, presence: true
validate :validate_events validate :validate_events
validate :validate_permissions
validate :validate_template validate :validate_template
before_validation :strip_events before_validation :strip_events
@ -48,12 +51,31 @@ class Webhook < ApplicationRecord
update!(enabled: false) update!(enabled: false)
end end
def required_permissions
events.map { |event| Webhook.permission_for_event(event) }
end
def self.permission_for_event(event)
case event
when 'account.approved', 'account.created', 'account.updated'
:manage_users
when 'report.created'
:manage_reports
when 'status.created', 'status.updated'
:view_devops
end
end
private private
def validate_events def validate_events
errors.add(:events, :invalid) if events.any? { |e| EVENTS.exclude?(e) } errors.add(:events, :invalid) if events.any? { |e| EVENTS.exclude?(e) }
end end
def validate_permissions
errors.add(:events, :invalid_permissions) if defined?(@current_account) && required_permissions.any? { |permission| !@current_account.user_role.can?(permission) }
end
def validate_template def validate_template
return if template.blank? return if template.blank?

View file

@ -14,7 +14,7 @@ class WebhookPolicy < ApplicationPolicy
end end
def update? def update?
role.can?(:manage_webhooks) role.can?(:manage_webhooks) && record.required_permissions.all? { |permission| role.can?(permission) }
end end
def enable? def enable?
@ -30,6 +30,6 @@ class WebhookPolicy < ApplicationPolicy
end end
def destroy? def destroy?
role.can?(:manage_webhooks) role.can?(:manage_webhooks) && record.required_permissions.all? { |permission| role.can?(permission) }
end end
end end

View file

@ -5,7 +5,7 @@
= f.input :url, wrapper: :with_block_label, input_html: { placeholder: 'https://' } = f.input :url, wrapper: :with_block_label, input_html: { placeholder: 'https://' }
.fields-group .fields-group
= f.input :events, collection: Webhook::EVENTS, wrapper: :with_block_label, include_blank: false, as: :check_boxes, collection_wrapper_tag: 'ul', item_wrapper_tag: 'li' = f.input :events, collection: Webhook::EVENTS, wrapper: :with_block_label, include_blank: false, as: :check_boxes, collection_wrapper_tag: 'ul', item_wrapper_tag: 'li', disabled: Webhook::EVENTS.filter { |event| !current_user.role.can?(Webhook.permission_for_event(event)) }
.fields-group .fields-group
= f.input :template, wrapper: :with_block_label, input_html: { placeholder: '{ "content": "Hello {{object.username}}" }' } = f.input :template, wrapper: :with_block_label, input_html: { placeholder: '{ "content": "Hello {{object.username}}" }' }

View file

@ -53,3 +53,7 @@ en:
position: position:
elevated: cannot be higher than your current role elevated: cannot be higher than your current role
own_role: cannot be changed with your current role own_role: cannot be changed with your current role
webhook:
attributes:
events:
invalid_permissions: cannot include events you don't have the rights to

View file

@ -48,7 +48,7 @@ describe Admin::WebhooksController do
end end
context 'with an existing record' do context 'with an existing record' do
let!(:webhook) { Fabricate :webhook } let!(:webhook) { Fabricate(:webhook, events: ['account.created', 'report.created']) }
describe 'GET #show' do describe 'GET #show' do
it 'returns http success and renders view' do it 'returns http success and renders view' do

View file

@ -8,16 +8,32 @@ describe WebhookPolicy do
let(:admin) { Fabricate(:user, role: UserRole.find_by(name: 'Admin')).account } let(:admin) { Fabricate(:user, role: UserRole.find_by(name: 'Admin')).account }
let(:john) { Fabricate(:account) } let(:john) { Fabricate(:account) }
permissions :index?, :create?, :show?, :update?, :enable?, :disable?, :rotate_secret?, :destroy? do permissions :index?, :create? do
context 'with an admin' do context 'with an admin' do
it 'permits' do it 'permits' do
expect(policy).to permit(admin, Tag) expect(policy).to permit(admin, Webhook)
end end
end end
context 'with a non-admin' do context 'with a non-admin' do
it 'denies' do it 'denies' do
expect(policy).to_not permit(john, Tag) expect(policy).to_not permit(john, Webhook)
end
end
end
permissions :show?, :update?, :enable?, :disable?, :rotate_secret?, :destroy? do
let(:webhook) { Fabricate(:webhook, events: ['account.created', 'report.created']) }
context 'with an admin' do
it 'permits' do
expect(policy).to permit(admin, webhook)
end
end
context 'with a non-admin' do
it 'denies' do
expect(policy).to_not permit(john, webhook)
end end
end end
end end