@platform-mesh/portal-server-lib 0.9.95 → 0.9.97

package/src/portal-options/services/permissions/adapters/authz-webhook.service.ts

@@ -0,0 +1,238 @@
+import { HttpService } from '@nestjs/axios';
+import { Injectable, Logger } from '@nestjs/common';
+import { randomUUID } from 'crypto';
+import { firstValueFrom } from 'rxjs';
+import { buildWorkspacePath } from '../../../utils/build-workspace-path.util.js';
+import { AuthorizationRequest, IAuthzService, Permission, SubjectAccessReview } from '../models/permissions.model.js';
+
+// Server default for the cluster-path extra key (flag --webhook-cluster-path-key,
+// see rebac-authz-webhook pkg/config/config.go).
+const CLUSTER_PATH_KEY = 'authorization.kubernetes.io/cluster-path';
+
+interface BatchAuthzResult {
+  id: string;
+  allowed: boolean;
+}
+
+@Injectable()
+export class AuthzWebhookService implements IAuthzService {
+  private readonly logger = new Logger(AuthzWebhookService.name);
+  private readonly webhookUrl: string | undefined;
+
+  constructor(private readonly httpService: HttpService) {
+    this.webhookUrl = process.env['OPENMFP_PORTAL_CONTEXT_AUTHZ_WEBHOOK_URL'];
+    if (!this.webhookUrl) {
+      this.logger.warn(
+        'OPENMFP_PORTAL_CONTEXT_AUTHZ_WEBHOOK_URL not set — permissions checks are disabled (fail-open)',
+      );
+    }
+  }
+
+  // Tier 1: batch check for all resource types at startup
+  async checkActionsForResource(
+    req: AuthorizationRequest,
+  ): Promise<Permission[] | undefined> {
+    if (!this.webhookUrl) {
+      return undefined;
+    }
+
+    const user = this.extractUserEmail(req.token);
+    const clusterPath = buildWorkspacePath([req.organization, req.accountPath]);
+
+    const items: SubjectAccessReview[] = [];
+    const correlationMap = new Map<string, { resource: string; verb: string }>();
+
+    for (const check of req.checks) {
+      for (const verb of check.actions) {
+        const id = randomUUID();
+        correlationMap.set(id, { resource: check.resource, verb });
+        items.push({
+          apiVersion: 'authorization.k8s.io/v1',
+          kind: 'SubjectAccessReview',
+          metadata: { name: id },
+          spec: {
+            user,
+            extra: { [CLUSTER_PATH_KEY]: [clusterPath] },
+            resourceAttributes: {
+              verb,
+              group: check.group,
+              resource: check.resource.toLowerCase(),
+            },
+          },
+        });
+      }
+    }
+
+    if (!items.length) {
+      return undefined;
+    }
+
+    const results = await this.sendBatch(items);
+    if (!results) {
+      return undefined;
+    }
+
+    const permissions = this.mapToPermissions(results, correlationMap);
+    this.logger.log(
+      `permissions resolved for "${user}" "${clusterPath}": ${JSON.stringify(permissions)}`,
+    );
+    return permissions;
+  }
+
+  // Tier 2: check specific verbs on concrete resource instances
+  async checkActionsForInstance(
+    req: AuthorizationRequest,
+  ): Promise<Permission[] | undefined> {
+    if (!this.webhookUrl) {
+      return undefined;
+    }
+
+    const user = this.extractUserEmail(req.token);
+    const clusterPath = buildWorkspacePath([req.organization, req.accountPath]);
+
+    const items: SubjectAccessReview[] = [];
+    const correlationMap = new Map<
+      string,
+      { resource: string; namespace?: string; name?: string; verb: string }
+    >();
+
+    for (const check of req.checks) {
+      for (const verb of check.actions) {
+        const id = randomUUID();
+        correlationMap.set(id, {
+          resource: check.resource,
+          ...(check.namespace ? { namespace: check.namespace } : {}),
+          ...(check.name ? { name: check.name } : {}),
+          verb,
+        });
+        items.push({
+          apiVersion: 'authorization.k8s.io/v1',
+          kind: 'SubjectAccessReview',
+          metadata: { name: id },
+          spec: {
+            user,
+            extra: { [CLUSTER_PATH_KEY]: [clusterPath] },
+            resourceAttributes: {
+              verb,
+              group: check.group,
+              resource: check.resource.toLowerCase(),
+              // Namespaced when a namespace is present; cluster-scoped otherwise.
+              namespace: check.namespace,
+              name: check.name,
+            },
+          },
+        });
+      }
+    }
+
+    if (!items.length) {
+      return undefined;
+    }
+
+    const results = await this.sendBatch(items);
+    if (!results) {
+      return undefined;
+    }
+
+    return this.mapToInstancePermissions(results, correlationMap);
+  }
+
+  private extractUserEmail(token: string): string {
+    try {
+      const payload = JSON.parse(
+        Buffer.from(token.split('.')[1], 'base64url').toString(),
+      );
+      return payload.email ?? '';
+    } catch {
+      return '';
+    }
+  }
+
+  private async sendBatch(
+    items: SubjectAccessReview[],
+  ): Promise<Record<string, boolean> | undefined> {
+    try {
+      const response = await firstValueFrom(
+        this.httpService.post<BatchAuthzResult[]>(
+          `${this.webhookUrl}/batch-authz `,
+          items,
+          {
+            headers: { 'Content-Type': 'application/json' },
+          },
+        ),
+      );
+
+      const results = Array.isArray(response.data) ? response.data : [];
+      return results.reduce<Record<string, boolean>>((acc, result) => {
+        acc[result.id] = result.allowed;
+        return acc;
+      }, {});
+    } catch (err) {
+      this.logger.error('authz-webhook batch-authz failed — failing open', err);
+      return undefined;
+    }
+  }
+
+  private mapToPermissions(
+    results: Record<string, boolean>,
+    correlationMap: Map<string, { resource: string; verb: string }>,
+  ): Permission[] {
+    const permissionsMap = new Map<string, string[]>();
+
+    for (const [id, allowed] of Object.entries(results)) {
+      if (!allowed) {
+        continue;
+      }
+
+      const entry = correlationMap.get(id);
+      if (!entry) {
+        continue;
+      }
+
+      const actions = permissionsMap.get(entry.resource) ?? [];
+      actions.push(entry.verb);
+      permissionsMap.set(entry.resource, actions);
+    }
+
+    return Array.from(permissionsMap.entries()).map(([resource, actions]) => ({
+      resource,
+      actions,
+    }));
+  }
+
+  private mapToInstancePermissions(
+    results: Record<string, boolean>,
+    correlationMap: Map<
+      string,
+      { resource: string; namespace?: string; name?: string; verb: string }
+    >,
+  ): Permission[] {
+    const permissionsMap = new Map<
+      string,
+      { resource: string; namespace?: string; name?: string; actions: string[] }
+    >();
+
+    for (const [id, allowed] of Object.entries(results)) {
+      if (!allowed) {
+        continue;
+      }
+
+      const entry = correlationMap.get(id);
+      if (!entry) {
+        continue;
+      }
+
+      const key = `${entry.resource}|${entry.namespace ?? ''}|${entry.name ?? ''}`;
+      const permission = permissionsMap.get(key) ?? {
+        resource: entry.resource,
+        ...(entry.namespace ? { namespace: entry.namespace } : {}),
+        ...(entry.name ? { name: entry.name } : {}),
+        actions: [],
+      };
+      permission.actions.push(entry.verb);
+      permissionsMap.set(key, permission);
+    }
+
+    return Array.from(permissionsMap.values());
+  }
+}

package/src/portal-options/services/permissions/models/permissions.model.ts

@@ -0,0 +1,56 @@
+export interface PermissionsDefinition {
+  group: string;
+  resource: string;
+  entityActions: string[];
+  resourceActions: string[];
+  entityContextKey: string;
+}
+
+export interface AuthorizationRequest {
+  token: string;
+  organization: string;
+  accountPath: string;
+  checks: {
+    resource: string;
+    group: string;
+    namespace?: string | null;
+    name?: string;
+    actions: string[];
+  }[];
+}
+
+export interface Permission {
+  resource: string;
+  namespace?: string;
+  name?: string;
+  actions: string[];
+}
+
+export interface AuthorizationResponse {
+  accountPath: string;
+  permissions: Permission[];
+}
+
+export interface SubjectAccessReview {
+  apiVersion?: string;
+  kind?: string;
+  metadata: { name: string };
+  spec: {
+    user: string;
+    extra: Record<string, string[]>; // cluster path lives under the cluster-path key
+    resourceAttributes: {
+      verb: string;
+      group: string;
+      resource: string; // plural resource name, lowercase
+      namespace?: string | null;
+      name?: string | null;
+    };
+  };
+}
+
+export interface IAuthzService {
+  checkActionsForResource(req: AuthorizationRequest): Promise<Permission[] | undefined>;
+  checkActionsForInstance(
+    req: AuthorizationRequest,
+  ): Promise<Permission[] | undefined>;
+}

package/src/portal-options/services/permissions/permissions-proxy.service.spec.ts

@@ -0,0 +1,232 @@
+import { ContentConfiguration } from '@openmfp/portal-server-lib';
+import { mock } from 'jest-mock-extended';
+import { AuthzWebhookService } from './adapters/authz-webhook.service.js';
+import {
+  AuthorizationRequest,
+  Permission,
+  PermissionsDefinition,
+} from './models/permissions.model.js';
+import { PermissionsProxyService } from './permissions-proxy.service.js';
+
+function makeCC(
+  nodes: ContentConfiguration['luigiConfigFragment']['data']['nodes'] = [],
+): ContentConfiguration {
+  return {
+    name: 'test',
+    creationTimestamp: '',
+    luigiConfigFragment: { data: { nodes } },
+  };
+}
+
+function makePd(
+  overrides: Partial<PermissionsDefinition> = {},
+): PermissionsDefinition {
+  return {
+    group: 'core.platform-mesh.io',
+    resource: 'Accounts',
+    entityActions: ['get', 'delete'],
+    resourceActions: ['create', 'list'],
+    entityContextKey: 'entityName',
+    ...overrides,
+  };
+}
+
+function makeNode(rd: Record<string, unknown>) {
+  return { context: { resourceDefinition: rd } };
+}
+
+const CC_WITH_CHECK = makeCC([
+  makeNode({ entity: 'Account', permissionsDefinition: makePd() }),
+]);
+
+const CC_WITHOUT_PD = makeCC([makeNode({ entity: 'NoCheck' })]);
+
+const PERMISSIONS: Permission[] = [
+  { resource: 'Accounts', actions: ['create', 'list'] },
+];
+
+function makeAuthzRequest(
+  overrides: Partial<AuthorizationRequest> = {},
+): AuthorizationRequest {
+  return {
+    token: 'my-token',
+    organization: 'my-org',
+    accountPath: 'sub-path',
+    checks: [
+      {
+        resource: 'HttpBins',
+        group: 'example.com',
+        namespace: 'default',
+        name: 'my-bin',
+        actions: ['get', 'list'],
+      },
+    ],
+    ...overrides,
+  };
+}
+
+describe('PermissionsProxyService', () => {
+  let authzWebhook: jest.Mocked<AuthzWebhookService>;
+  let svc: PermissionsProxyService;
+
+  beforeEach(() => {
+    authzWebhook = mock<AuthzWebhookService>();
+    svc = new PermissionsProxyService(authzWebhook);
+  });
+
+  describe('resolvePermissions', () => {
+    it('returns undefined when no resource definitions have a permissionsDefinition', async () => {
+      const result = await svc.resolvePermissions('tok', 'org', '', [
+        CC_WITHOUT_PD,
+      ]);
+      expect(result).toBeUndefined();
+      expect(authzWebhook.checkActionsForResource).not.toHaveBeenCalled();
+    });
+
+    it('returns undefined when content configurations are empty', async () => {
+      const result = await svc.resolvePermissions('tok', 'org', '', []);
+      expect(result).toBeUndefined();
+    });
+
+    it('returns undefined when permissionsDefinition has empty resourceActions', async () => {
+      const cc = makeCC([
+        makeNode({
+          entity: 'Account',
+          permissionsDefinition: makePd({ resourceActions: [] }),
+        }),
+      ]);
+
+      const result = await svc.resolvePermissions('tok', 'org', '', [cc]);
+
+      expect(result).toBeUndefined();
+      expect(authzWebhook.checkActionsForResource).not.toHaveBeenCalled();
+    });
+
+    it('delegates to authzWebhook.checkActionsForResource with a check built from permissionsDefinition', async () => {
+      authzWebhook.checkActionsForResource.mockResolvedValue(PERMISSIONS);
+
+      const result = await svc.resolvePermissions(
+        'my-token',
+        'my-org',
+        'sub-path',
+        [CC_WITH_CHECK],
+      );
+
+      expect(result).toEqual(PERMISSIONS);
+      expect(authzWebhook.checkActionsForResource).toHaveBeenCalledWith({
+        token: 'my-token',
+        organization: 'my-org',
+        accountPath: 'sub-path',
+        checks: [
+          {
+            resource: 'Accounts',
+            group: 'core.platform-mesh.io',
+            actions: ['create', 'list'],
+          },
+        ],
+      });
+    });
+
+    it('passes token, organization, accountPath to webhook', async () => {
+      authzWebhook.checkActionsForResource.mockResolvedValue([]);
+
+      await svc.resolvePermissions('my-token', 'my-org', 'sub', [
+        CC_WITH_CHECK,
+      ]);
+
+      const req = authzWebhook.checkActionsForResource.mock.calls[0][0];
+      expect(req.token).toBe('my-token');
+      expect(req.organization).toBe('my-org');
+      expect(req.accountPath).toBe('sub');
+    });
+
+    it('returns undefined when webhook returns undefined', async () => {
+      authzWebhook.checkActionsForResource.mockResolvedValue(undefined);
+
+      const result = await svc.resolvePermissions('tok', 'org', '', [
+        CC_WITH_CHECK,
+      ]);
+
+      expect(result).toBeUndefined();
+    });
+
+    it('filters out resource definitions whose permissionsDefinition has no resourceActions', async () => {
+      authzWebhook.checkActionsForResource.mockResolvedValue([]);
+      const mixed = makeCC([
+        makeNode({
+          entity: 'NoActions',
+          permissionsDefinition: makePd({
+            resource: 'NoActions',
+            resourceActions: [],
+          }),
+        }),
+        makeNode({
+          entity: 'WithCheck',
+          permissionsDefinition: makePd({
+            resource: 'WithChecks',
+            resourceActions: ['get'],
+          }),
+        }),
+      ]);
+
+      await svc.resolvePermissions('tok', 'org', '', [mixed]);
+
+      const req = authzWebhook.checkActionsForResource.mock.calls[0][0];
+      expect(req.checks).toHaveLength(1);
+      expect(req.checks[0].resource).toBe('WithChecks');
+      expect(req.checks[0].actions).toEqual(['get']);
+    });
+  });
+
+  describe('checkResourceInstance', () => {
+    it('delegates AuthorizationRequest directly to authzWebhook.checkActionsForInstance', async () => {
+      const mockResponse: Permission[] = [
+        {
+          resource: 'HttpBins',
+          namespace: 'default',
+          name: 'my-bin',
+          actions: ['get'],
+        },
+      ];
+      authzWebhook.checkActionsForInstance.mockResolvedValue(mockResponse);
+
+      const req = makeAuthzRequest();
+      const result = await svc.checkResourceInstance(req);
+
+      expect(result).toEqual(mockResponse);
+      expect(authzWebhook.checkActionsForInstance).toHaveBeenCalledWith(req);
+    });
+
+    it('returns undefined when webhook returns undefined', async () => {
+      authzWebhook.checkActionsForInstance.mockResolvedValue(undefined);
+
+      const result = await svc.checkResourceInstance(makeAuthzRequest());
+
+      expect(result).toBeUndefined();
+    });
+
+    it('returns empty array when webhook returns empty array', async () => {
+      authzWebhook.checkActionsForInstance.mockResolvedValue([]);
+
+      const result = await svc.checkResourceInstance(makeAuthzRequest());
+
+      expect(result).toEqual([]);
+    });
+
+    it('returns Permission[] when webhook returns results', async () => {
+      const permissions: Permission[] = [
+        {
+          resource: 'HttpBins',
+          namespace: 'default',
+          name: 'my-bin',
+          actions: ['get', 'list'],
+        },
+      ];
+      authzWebhook.checkActionsForInstance.mockResolvedValue(permissions);
+
+      const result = await svc.checkResourceInstance(makeAuthzRequest());
+
+      expect(result).toEqual(permissions);
+    });
+  });
+});

package/src/portal-options/services/permissions/permissions-proxy.service.ts

@@ -0,0 +1,58 @@
+import { Injectable } from '@nestjs/common';
+import { ContentConfiguration } from '@openmfp/portal-server-lib';
+import { extractResourceDefinitions } from '../../utils/extract-resource-definitions.util.js';
+import { AuthzWebhookService } from './adapters/authz-webhook.service.js';
+import {
+  AuthorizationRequest,
+  Permission,
+  PermissionsDefinition,
+} from './models/permissions.model.js';
+
+@Injectable()
+export class PermissionsProxyService {
+  constructor(private readonly authzWebhook: AuthzWebhookService) {}
+
+  // Tier 1 — called by KubernetesServiceProvidersService / ContentConfigurationServiceProvidersService
+  async resolvePermissions(
+    token: string,
+    organization: string,
+    accountPath: string,
+    contentConfigurations: ContentConfiguration[],
+  ): Promise<Permission[] | undefined> {
+    const resourceDefinitions = extractResourceDefinitions(
+      contentConfigurations,
+    );
+
+    const checks = resourceDefinitions
+      .map((rd) => rd.permissionsDefinition)
+      .filter(
+        (pd): pd is PermissionsDefinition =>
+          !!pd && pd.resourceActions.length > 0,
+      )
+      .map((pd) => ({
+        resource: pd.resource,
+        group: pd.group,
+        actions: pd.resourceActions,
+      }));
+
+    if (!checks.length) {
+      return undefined;
+    }
+
+    const req: AuthorizationRequest = {
+      token,
+      organization,
+      accountPath,
+      checks,
+    };
+
+    return this.authzWebhook.checkActionsForResource(req);
+  }
+
+  // Tier 2 — called by PermissionsController
+  async checkResourceInstance(
+    req: AuthorizationRequest,
+  ): Promise<Permission[] | undefined> {
+    return this.authzWebhook.checkActionsForInstance(req);
+  }
+}