From 2db2769476c6be052082428d769149e73997db1e Mon Sep 17 00:00:00 2001 From: Roberto Jimenez Sanchez Date: Wed, 17 Dec 2025 18:20:59 +0100 Subject: [PATCH] provisioning: move refs to admin-only refs subresource now requires admin role (or AccessPolicy). Updated documentation comments to reflect current permissions. --- pkg/registry/apis/provisioning/register.go | 31 +++++++++++----------- 1 file changed, 15 insertions(+), 16 deletions(-) diff --git a/pkg/registry/apis/provisioning/register.go b/pkg/registry/apis/provisioning/register.go index 720334581c6..d22ad443dca 100644 --- a/pkg/registry/apis/provisioning/register.go +++ b/pkg/registry/apis/provisioning/register.go @@ -343,17 +343,18 @@ func (b *APIBuilder) GetAuthorizer() authorizer.Authorizer { } // authorizeResource handles authorization for different resources. -// Different routes may need different permissions. -// * Reading and modifying a repository's configuration requires administrator privileges. -// * Reading a repository's limited configuration (/stats & /settings) requires viewer privileges. -// * Reading a repository's files requires viewer privileges. -// * Reading a repository's refs requires viewer privileges. -// * Editing a repository's files requires editor privileges. -// * Syncing a repository requires editor privileges. -// * Exporting a repository requires administrator privileges. -// * Migrating a repository requires administrator privileges. -// * Testing a repository configuration requires administrator privileges. -// * Viewing a repository's history requires editor privileges. +// Different routes may need different permissions: +// +// Admin-only: +// - Repository CRUD, test, files, refs +// - Stats, settings, jobs, historic jobs +// - Connection CRUD +// +// Editor: +// - Repository subresources: jobs, resources, sync, history +// +// Viewer: +// - Repository/connection status (GET only) func (b *APIBuilder) authorizeResource(ctx context.Context, a authorizer.Attributes, id identity.Requester) (authorizer.Decision, string, error) { switch a.GetResource() { case provisioning.RepositoryResourceInfo.GetName(): @@ -372,17 +373,15 @@ func (b *APIBuilder) authorizeResource(ctx context.Context, a authorizer.Attribu func (b *APIBuilder) authorizeRepositorySubresource(a authorizer.Attributes, id identity.Requester) (authorizer.Decision, string, error) { // TODO: Support more fine-grained permissions than the basic roles. Especially on Enterprise. switch a.GetSubresource() { - // Admin-only: repository CRUD, testing, and file listing - case "", "test", "files": + // Admin-only: repository CRUD, testing, file listing, refs + case "", "test", "files", "refs": return allowForAdminsOrAccessPolicy(id) // Editor: job creation, sync operations, resource listing, history case "jobs", "resources", "sync", "history": return allowForEditorsOrAccessPolicy(id) - // Viewer: read-only operations (refs, status GET) - case "refs": - return allowForViewersOrAccessPolicy(id) + // Viewer: status GET only case "status": if a.GetVerb() == apiutils.VerbGet { return allowForViewersOrAccessPolicy(id)