feat: change permission or DescribeCluster to Read

jiaxuyang · Jun 3, 2024 · a93871a · a93871a
1 parent e03809a
commit a93871a
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 1 deletion.
diff --git a/service/frontend/templates/accesscontrolled.tmpl b/service/frontend/templates/accesscontrolled.tmpl
@@ -42,6 +42,9 @@ import (
 {{$permissionMap = set $permissionMap "RefreshWorkflowTasks" "PermissionWrite"}}
 {{$permissionMap = set $permissionMap "UpdateDomain" "PermissionAdmin"}}
 
+{{$adminPermissionMap := dict }}
+{{$adminPermissionMap = set $adminPermissionMap "DescribeCluster" "PermissionRead"}}
+
 {{$nonDomainAuthAPIs := list "RegisterDomain" "DescribeDomain" "UpdateDomain" "DeprecateDomain" "ListDomains" "GetSearchAttributes" "GetClusterInfo" "RecordActivityTaskHeartbeat" "RespondActivityTaskCanceled" "RespondActivityTaskCompleted" "RespondActivityTaskFailed" "RespondDecisionTaskCompleted" "RespondDecisionTaskFailed" "RespondQueryTaskCompleted"}}
 {{$taskListAuthAPIs := list "PollForActivityTask" "PollForDecisionTask"}}
 {{$workflowTypeAuthAPIs := list "SignalWithStartWorkflowExecution" "StartWorkflowExecution"}}
@@ -92,7 +95,11 @@ func (a *{{$decorator}}) {{$method.Declaration}} {
 	attr := &authorization.Attributes{
 		APIName: "{{$method.Name}}",
 		{{- if eq $interfaceType "admin.Handler"}}
+		{{- if hasKey $adminPermissionMap $method.Name}}
+		Permission: authorization.{{get $adminPermissionMap $method.Name}},
+		{{- else}}
 		Permission:  authorization.PermissionAdmin,
+		{{- end}}
 		{{- else if hasKey $permissionMap $method.Name}}
 		Permission: authorization.{{get $permissionMap $method.Name}},
 		{{- end}}

diff --git a/service/frontend/wrappers/accesscontrolled/admin_generated.go b/service/frontend/wrappers/accesscontrolled/admin_generated.go