cisagov / crossfeed

External monitoring for organization assets
https://docs.crossfeed.cyber.dhs.gov
Creative Commons Zero v1.0 Universal
364 stars 54 forks source link

Add Permission Checking for React Routes #2493

Closed nickviola closed 7 months ago

nickviola commented 7 months ago

🗣 Description

closes #2472 and addresses the issue that allows users with incorrect permission types to view pages outside of the intended permission level. Modified the route definitions to accept an array of allowed permission levels. Any user that doesn't have the set permissions, will be logged out and redirected to the login page.

💭 Motivation and context

Addressing security concerns on frontend application routes.

🧪 Testing

Attempt to access any of the frontend routes listed below with and without a user with the below "userType" values ("standard", "globalView", "globalAdmin", or "regionalAdmin") and confirm that the user can either access the page or is logged out and redirected to the login screen as expected. The userType and permission "globalAdmin" has access to all existing routes and is assumed in the" permissions" props without specific assignment in the RouteGuard components.

The current requested permission assignments reflect the following:

image

Example of a local test would be the following process:

  1. Checkout this branch locally in Crossfeed project.
  2. Pull/Rebuild the project.
  3. Verify that the test user is assigned a "userType" of either "regionalAdmin" or "globalAdmin" (Matches permission image reference).
  4. Login to Crossfeed with the test user.
  5. Attempt to access the Region Admin Dashboord page at https://localhost/region-admin-dasboard
  6. . Confirm that the user can access the page if the logged in user HAS a "userType" of either "regionalAdmin" or "globalAdmin".
  7. Confirm that the user is logged out and redirected to login screen if user DOES NOT HAVE a "userType" of either "regionalAdmin" or "globalAdmin".

✅ Pre-approval checklist

nickviola commented 7 months ago

This seems to be working for me using the testing steps above. It would be helpful to have more eyes on this if anyone is able to pull, rebuild, and confirm as well.