From b7495cbc7043a1876d2ede709de985da81dc4f0c Mon Sep 17 00:00:00 2001 From: Roberto Jimenez Sanchez Date: Wed, 17 Dec 2025 17:39:09 +0100 Subject: [PATCH] provisioning: allow any authenticated user for settings/stats endpoints These are read-only endpoints needed by the frontend: - settings: returns available repository types and configuration for the wizard - stats: returns resource counts Authentication is verified before reaching authorization, so any user who reaches these endpoints is already authenticated. Requiring specific org roles failed for AccessPolicy tokens which don't carry traditional roles. --- pkg/registry/apis/provisioning/register.go | 21 +++++++++------------ 1 file changed, 9 insertions(+), 12 deletions(-) diff --git a/pkg/registry/apis/provisioning/register.go b/pkg/registry/apis/provisioning/register.go index cf30a55e0af..bf6a0ee7175 100644 --- a/pkg/registry/apis/provisioning/register.go +++ b/pkg/registry/apis/provisioning/register.go @@ -425,21 +425,18 @@ func (b *APIBuilder) authorizeRepositorySubresource(a authorizer.Attributes, id } // authorizeStats handles authorization for stats resource. -func (b *APIBuilder) authorizeStats(id identity.Requester) (authorizer.Decision, string, error) { - // This can leak information one shouldn't necessarily have access to. - if id.GetOrgRole().Includes(identity.RoleAdmin) { - return authorizer.DecisionAllow, "", nil - } - return authorizer.DecisionDeny, "admin role is required", nil +func (b *APIBuilder) authorizeStats(_ identity.Requester) (authorizer.Decision, string, error) { + // Stats is a read-only endpoint that returns resource counts. + // Any authenticated user can access it - authentication is verified before this point. + return authorizer.DecisionAllow, "", nil } // authorizeSettings handles authorization for settings resource. -func (b *APIBuilder) authorizeSettings(id identity.Requester) (authorizer.Decision, string, error) { - // This is strictly a read operation. It is handy on the frontend for viewers. - if id.GetOrgRole().Includes(identity.RoleViewer) { - return authorizer.DecisionAllow, "", nil - } - return authorizer.DecisionDeny, "viewer role is required", nil +func (b *APIBuilder) authorizeSettings(_ identity.Requester) (authorizer.Decision, string, error) { + // Settings is a read-only endpoint that returns available repository types and configuration. + // Any authenticated user can access it - authentication is verified before this point. + // The frontend needs this to display the provisioning wizard. + return authorizer.DecisionAllow, "", nil } // authorizeJobs handles authorization for job resources.