cherry pick #4982 to release 5.0.0 (cli)

pkg/microservice/aslan/core/environment/handler/openapi.go

@@ -1150,28 +1150,70 @@ func OpenAPIDeleteEnv(c *gin.Context) {
 }
 
 func OpenAPIGetEnvDetail(c *gin.Context) {
-	ctx := internalhandler.NewContext(c)
+	ctx, err := internalhandler.NewContextWithAuthorization(c)
 	defer func() { internalhandler.JSONResponse(c, ctx) }()
 
+	if err != nil {
+		ctx.RespErr = fmt.Errorf("authorization Info Generation failed: err %s", err)
+		ctx.UnAuthorized = true
+		return
+	}
+
 	projectName, envName, err := generalOpenAPIRequestValidate(c)
 	if err != nil {
 		ctx.RespErr = e.ErrInvalidParam.AddErr(err)
 		return
 	}
 
+	if !ctx.Resources.IsSystemAdmin {
+		projectInfo, ok := ctx.Resources.ProjectAuthInfo[projectName]
+		if !ok {
+			ctx.UnAuthorized = true
+			return
+		}
+		if !projectInfo.IsProjectAdmin && !projectInfo.Env.View {
+			permitted, err := internalhandler.GetCollaborationModePermission(ctx.UserID, projectName, types.ResourceTypeEnvironment, envName, types.EnvActionView)
+			if err != nil || !permitted {
+				ctx.UnAuthorized = true
+				return
+			}
+		}
+	}
+
 	ctx.Resp, ctx.RespErr = service.GetEnvDetail(projectName, envName, false, ctx.Logger)
 }
 
 func OpenAPIGetProductionEnvDetail(c *gin.Context) {
-	ctx := internalhandler.NewContext(c)
+	ctx, err := internalhandler.NewContextWithAuthorization(c)
 	defer func() { internalhandler.JSONResponse(c, ctx) }()
 
+	if err != nil {
+		ctx.RespErr = fmt.Errorf("authorization Info Generation failed: err %s", err)
+		ctx.UnAuthorized = true
+		return
+	}
+
 	projectName, envName, err := generalOpenAPIRequestValidate(c)
 	if err != nil {
 		ctx.RespErr = e.ErrInvalidParam.AddErr(err)
 		return
 	}
 
+	if !ctx.Resources.IsSystemAdmin {
+		projectInfo, ok := ctx.Resources.ProjectAuthInfo[projectName]
+		if !ok {
+			ctx.UnAuthorized = true
+			return
+		}
+		if !projectInfo.IsProjectAdmin && !projectInfo.ProductionEnv.View {
+			permitted, err := internalhandler.GetCollaborationModePermission(ctx.UserID, projectName, types.ResourceTypeEnvironment, envName, types.ProductionEnvActionView)
+			if err != nil || !permitted {
+				ctx.UnAuthorized = true
+				return
+			}
+		}
+	}
+
 	err = commonutil.CheckZadigProfessionalLicense()
 	if err != nil {
 		ctx.RespErr = err
@@ -1534,7 +1576,7 @@ func OpenAPIListEnvs(c *gin.Context) {
 	}
 
 	if !hasPermission {
-		ctx.Resp = []*service.OpenAPIListEnvBrief{}
+		ctx.UnAuthorized = true
 		return
 	}
 
@@ -1572,13 +1614,13 @@ func OpenAPIListProductionEnvs(c *gin.Context) {
 	}
 
 	permittedEnv, _ := internalhandler.ListCollaborationEnvironmentsPermission(ctx.UserID, projectKey)
-	if permittedEnv != nil && len(permittedEnv.ReadEnvList) > 0 {
+	if !hasPermission && permittedEnv != nil && len(permittedEnv.ReadEnvList) > 0 {
 		hasPermission = true
 		envFilter = permittedEnv.ReadEnvList
 	}
 
 	if !hasPermission {
-		ctx.Resp = []*service.OpenAPIListEnvBrief{}
+		ctx.UnAuthorized = true
 		return
 	}
 

pkg/microservice/aslan/core/environment/service/openapi.go

@@ -17,9 +17,11 @@ limitations under the License.
 package service
 
 import (
+	"errors"
 	"fmt"
 	"strings"
 
+	"go.mongodb.org/mongo-driver/mongo"
 	"go.uber.org/zap"
 	"gorm.io/gorm/utils"
 
@@ -44,6 +46,9 @@ func GetEnvDetail(projectName, envName string, production bool, logger *zap.Suga
 	})
 	if err != nil {
 		logger.Errorf("failed to find project:%s env:%s", projectName, envName)
+		if errors.Is(err, mongo.ErrNoDocuments) {
+			return nil, e.NewWithDesc(e.ErrNotFound, fmt.Sprintf("%s: %s", e.EnvNotFoundErrMsg, envName))
+		}
 		return nil, err
 	}
 

pkg/microservice/aslan/core/system/handler/openapi.go

@@ -87,9 +87,23 @@ func OpenAPICreateRegistry(c *gin.Context) {
 }
 
 func OpenAPIListRegistry(c *gin.Context) {
-	ctx := internalhandler.NewContext(c)
+	ctx, err := internalhandler.NewContextWithAuthorization(c)
 	defer func() { internalhandler.JSONResponse(c, ctx) }()
 
+	if err != nil {
+		ctx.RespErr = fmt.Errorf("authorization Info Generation failed: err %s", err)
+		ctx.UnAuthorized = true
+		return
+	}
+
+	// authorization checks
+	if !ctx.Resources.IsSystemAdmin {
+		if !ctx.Resources.SystemActions.RegistryManagement.View {
+			ctx.UnAuthorized = true
+			return
+		}
+	}
+
 	registry, err := service.ListRegistries(ctx.Logger)
 	if err != nil {
 		ctx.RespErr = err
@@ -110,6 +124,55 @@ func OpenAPIListRegistry(c *gin.Context) {
 	ctx.Resp = resp
 }
 
+func OpenAPIListProjectRegistry(c *gin.Context) {
+	ctx, err := internalhandler.NewContextWithAuthorization(c)
+	defer func() { internalhandler.JSONResponse(c, ctx) }()
+
+	if err != nil {
+		ctx.RespErr = fmt.Errorf("authorization Info Generation failed: err %s", err)
+		ctx.UnAuthorized = true
+		return
+	}
+
+	projectKey := c.Query("projectKey")
+	if projectKey == "" {
+		ctx.RespErr = e.ErrInvalidParam.AddDesc("projectKey is empty")
+		return
+	}
+
+	// authorization checks
+	if !ctx.Resources.IsSystemAdmin {
+		if _, ok := ctx.Resources.ProjectAuthInfo[projectKey]; !ok {
+			// collaboration mode users have no entry in ProjectAuthInfo, they are granted
+			// access to the project by the workflows shared with them.
+			permitted, err := internalhandler.CheckPermissionGivenByCollaborationMode(ctx.UserID, projectKey, types.ResourceTypeWorkflow, types.WorkflowActionRun)
+			if err != nil || !permitted {
+				ctx.UnAuthorized = true
+				return
+			}
+		}
+	}
+
+	registry, err := service.ListRegistriesByProject(projectKey, ctx.Logger)
+	if err != nil {
+		ctx.RespErr = err
+		return
+	}
+
+	resp := make([]*service.OpenAPIRegistry, 0)
+	for _, reg := range registry {
+		resp = append(resp, &service.OpenAPIRegistry{
+			ID:        reg.ID.Hex(),
+			Address:   reg.RegAddr,
+			Provider:  config.RegistryProvider(reg.RegProvider),
+			Region:    reg.Region,
+			IsDefault: reg.IsDefault,
+			Namespace: reg.Namespace,
+		})
+	}
+	ctx.Resp = resp
+}
+
 func OpenAPIGetRegistry(c *gin.Context) {
 	ctx, err := internalhandler.NewContextWithAuthorization(c)
 	defer func() { internalhandler.JSONResponse(c, ctx) }()

pkg/microservice/aslan/core/system/handler/router.go

@@ -636,6 +636,7 @@ func (*OpenAPIRouter) Inject(router *gin.RouterGroup) {
 	{
 		reg.POST("", OpenAPICreateRegistry)
 		reg.GET("", OpenAPIListRegistry)
+		reg.GET("/project", OpenAPIListProjectRegistry)
 		reg.GET("/:id", OpenAPIGetRegistry)
 		reg.PUT("/:id", OpenAPIUpdateRegistry)
 	}