From 67cdf2109650cecc95eb3aa6666ae97bb7ab9cda Mon Sep 17 00:00:00 2001 From: Roberto Jimenez Sanchez Date: Thu, 18 Dec 2025 09:59:41 +0100 Subject: [PATCH] fix: make settings/stats authorization work in MT mode Update authorizeRoleBasedResource to check authlib.AuthInfoFrom(ctx) for AccessPolicy identity type in addition to identity.GetRequester(ctx). This ensures AccessPolicy identities are recognized in MT mode where identity.GetRequester may not set the identity type correctly. --- pkg/registry/apis/provisioning/register.go | 26 +++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-) diff --git a/pkg/registry/apis/provisioning/register.go b/pkg/registry/apis/provisioning/register.go index 4ed4594d391..2bf939c3773 100644 --- a/pkg/registry/apis/provisioning/register.go +++ b/pkg/registry/apis/provisioning/register.go @@ -318,7 +318,7 @@ func (b *APIBuilder) GetAuthorizer() authorizer.Authorizer { if err != nil { return authorizer.DecisionDeny, "failed to find requester", err } - return authorizeRoleBasedResource(a.GetResource(), id) + return authorizeRoleBasedResource(ctx, a.GetResource(), id) } return b.authorizeResource(ctx, a) @@ -377,7 +377,7 @@ func (b *APIBuilder) authorizeResource(ctx context.Context, a authorizer.Attribu if err != nil { return authorizer.DecisionDeny, "failed to find requester", err } - return authorizeRoleBasedResource(a.GetResource(), id) + return authorizeRoleBasedResource(ctx, a.GetResource(), id) default: return b.authorizeDefault(ctx) } @@ -527,12 +527,28 @@ func isRoleBasedResource(resource string) bool { // authorizeRoleBasedResource handles authorization for resources without fine-grained permissions. // - settings: viewer role (read-only, needed by multiple UI pages) // - stats: admin role -func authorizeRoleBasedResource(resource string, id identity.Requester) (authorizer.Decision, string, error) { +// Also checks authlib.AuthInfoFrom(ctx) for AccessPolicy identity type in MT mode. +func authorizeRoleBasedResource(ctx context.Context, resource string, id identity.Requester) (authorizer.Decision, string, error) { + // Check AccessPolicy identity type from both sources (ST and MT modes) + isAccessPolicy := authlib.IsIdentityType(id.GetIdentityType(), authlib.TypeAccessPolicy) + if !isAccessPolicy { + // Also check authlib.AuthInfoFrom for MT mode + if authInfo, ok := authlib.AuthInfoFrom(ctx); ok { + isAccessPolicy = authlib.IsIdentityType(authInfo.GetIdentityType(), authlib.TypeAccessPolicy) + } + } + switch resource { case "settings": - return allowForViewersOrAccessPolicy(id) + if isAccessPolicy || id.GetOrgRole().Includes(identity.RoleViewer) { + return authorizer.DecisionAllow, "", nil + } + return authorizer.DecisionDeny, "viewer role is required", nil case "stats": - return allowForAdminsOrAccessPolicy(id) + if isAccessPolicy || id.GetOrgRole().Includes(identity.RoleAdmin) { + return authorizer.DecisionAllow, "", nil + } + return authorizer.DecisionDeny, "admin role is required", nil default: return authorizer.DecisionDeny, "unknown role-based resource", nil }