From 669bbca346b0464390d1a20c740850902b8a5606 Mon Sep 17 00:00:00 2001 From: Roberto Jimenez Sanchez Date: Thu, 18 Dec 2025 10:28:01 +0100 Subject: [PATCH] fix: remove unused authorization helper functions Remove allowForAdminsOrAccessPolicy and allowForViewersOrAccessPolicy as they are no longer used after refactoring to use authorizeRoleBasedResource. --- pkg/registry/apis/provisioning/register.go | 16 ---------------- 1 file changed, 16 deletions(-) diff --git a/pkg/registry/apis/provisioning/register.go b/pkg/registry/apis/provisioning/register.go index 2bf939c3773..e116dfcd8cf 100644 --- a/pkg/registry/apis/provisioning/register.go +++ b/pkg/registry/apis/provisioning/register.go @@ -502,22 +502,6 @@ func toAuthorizerDecision(err error) (authorizer.Decision, string, error) { return authorizer.DecisionAllow, "", nil } -// allowForAdminsOrAccessPolicy is used for resources without fine-grained permissions. -func allowForAdminsOrAccessPolicy(id identity.Requester) (authorizer.Decision, string, error) { - if authlib.IsIdentityType(id.GetIdentityType(), authlib.TypeAccessPolicy) || id.GetOrgRole().Includes(identity.RoleAdmin) { - return authorizer.DecisionAllow, "", nil - } - return authorizer.DecisionDeny, "admin role is required", nil -} - -// allowForViewersOrAccessPolicy allows any authenticated user with at least viewer role. -func allowForViewersOrAccessPolicy(id identity.Requester) (authorizer.Decision, string, error) { - if authlib.IsIdentityType(id.GetIdentityType(), authlib.TypeAccessPolicy) || id.GetOrgRole().Includes(identity.RoleViewer) { - return authorizer.DecisionAllow, "", nil - } - return authorizer.DecisionDeny, "viewer role is required", nil -} - // isRoleBasedResource returns true for resources that use role-based authorization // instead of fine-grained permissions. These resources bypass the access checker. func isRoleBasedResource(resource string) bool {