RBAC implementation for key value pair

shivani-orch commented 2 years ago

Implemented RBAC functionality and unit tests for key-value pairs for existing and new permission types. Previously, RBAC feature for key value pairs are not yet implemented.

Existing permission types - KEY_VALUE_VIEW, KEY_VALUE_SET, KEY_VALUE_DELETE
New permission types - KEY_VALUE_LIST, KEY_VALUE_ALL

RBAC is enabled in the st2.conf file. Access to a key value pair is checked in the KeyValuePair API controller.

SET and DELETE permissions will automatically grant LIST and VIEW permissions.
By default, user has access to his/her own user scoped KVPs without requiring specific permission grant.
A non-admin user can be explicitly granted permission to one or more system scoped KVPs.
A non-admin user cannot access another user's KVPs.
By default, admin and system_admin has ALL access to system scoped KVPs.
Admin has full access to another user's KVPs (behavior in current version).

This change requires KeyValuePair API changes at https://github.com/StackStorm/st2/pull/5354.

shivani-orch commented 2 years ago

We couldn't resolve why circleci checks have failed. Following is the error - . virtualenv/bin/activate; flake8 --config=lint-configs/python/.flake8 st2rbac_backend/ tests/ /bin/sh: 85: virtualenv/bin/activate: /tmp/st2/st2api: Permission denied

m4dcoder commented 2 years ago

Please make sure CIs are green before asking for reviews.

m4dcoder commented 2 years ago

@ashwini-orchestral The CIs are failing with the following. If you click on "Details" above next to the failed job, do you see the details?

. virtualenv/bin/activate; pylint -j 1 -E --rcfile=./lint-configs/python/.pylintrc --load-plugins=pylint_plugins.api_models --load-plugins=pylint_plugins.db_models st2rbac_backend/
************* Module st2rbac_backend.resolvers
st2rbac_backend/resolvers.py:726:35: E1101: Class 'PermissionType' has no 'KEY_VALUE_LIST' member (no-member)
make: *** [Makefile:115: .pylint] Error 2

ankita-orchestral commented 2 years ago

@m4dcoder - We have refactored the unit test cases as per your comment. Please review and let us know your feedback.

amanda11 commented 2 years ago

LGTM - with an imminent release of 3.6 do we need to make sure that this only goes in with the paired ST2 pair?

StackStorm / st2-rbac-backend

RBAC implementation for key value pair #55