Refactor permissions functions (#2477)

* Refactor permissions functions Now that space supporter implementation is complete we can collapse a bunch of functions in permissions.rb and finalize naming conventions that we're mostly happy with. * include space supporter in ALL_PERMISSIONS * removed space supporter specific mentions in permissions.rb address #2468 Co-authored-by: Mona Mohebbi <[email protected]> Co-authored-by: Merric de Launey <[email protected]> Co-authored-by: Matthew Kocher <[email protected]>
cloudfoundry · Aug 23, 2021 · 14ce39e · 14ce39e
1 parent eda36ff
commit 14ce39e
Show file tree

Hide file tree

Showing 70 changed files with 496 additions and 533 deletions.
diff --git a/app/controllers/v3/app_features_controller.rb b/app/controllers/v3/app_features_controller.rb
@@ -17,7 +17,7 @@ class AppFeaturesController < ApplicationController
 
   def index
     app, space, org = AppFetcher.new.fetch(hashed_params[:app_guid])
-    app_not_found! unless app && permission_queryer.untrusted_can_read_from_space?(space.guid, org.guid)
+    app_not_found! unless app && permission_queryer.can_read_from_space?(space.guid, org.guid)
     resources = presented_app_features(app)
 
     render status: :ok, json: {
@@ -28,7 +28,7 @@ def index
 
   def show
     app, space, org = AppFetcher.new.fetch(hashed_params[:app_guid])
-    app_not_found! unless app && permission_queryer.untrusted_can_read_from_space?(space.guid, org.guid)
+    app_not_found! unless app && permission_queryer.can_read_from_space?(space.guid, org.guid)
     resource_not_found!(:feature) unless APP_FEATURES.include?(hashed_params[:name])
 
     render status: :ok, json: feature_presenter_for(hashed_params[:name], app)
@@ -37,12 +37,12 @@ def show
   def update
     app, space, org = AppFetcher.new.fetch(hashed_params[:app_guid])
 
-    app_not_found! unless app && permission_queryer.untrusted_can_read_from_space?(space.guid, org.guid)
+    app_not_found! unless app && permission_queryer.can_read_from_space?(space.guid, org.guid)
 
     name = hashed_params[:name]
     resource_not_found!(:feature) unless APP_FEATURES.include?(name)
     if UNTRUSTED_APP_FEATURES.include?(name)
-      unauthorized! unless permission_queryer.untrusted_can_write_to_space?(space.guid)
+      unauthorized! unless permission_queryer.can_manage_apps_in_space?(space.guid)
     else
       unauthorized! unless permission_queryer.can_write_to_space?(space.guid)
     end
@@ -57,7 +57,7 @@ def update
   def ssh_enabled
     app, space, org = AppFetcher.new.fetch(hashed_params[:guid])
 
-    app_not_found! unless app && permission_queryer.untrusted_can_read_from_space?(space.guid, org.guid)
+    app_not_found! unless app && permission_queryer.can_read_from_space?(space.guid, org.guid)
 
     render status: :ok, json: Presenters::V3::AppSshStatusPresenter.new(app, Config.config.get(:allow_app_ssh_access))
   end

diff --git a/app/controllers/v3/app_manifests_controller.rb b/app/controllers/v3/app_manifests_controller.rb
@@ -8,7 +8,7 @@ class AppManifestsController < ApplicationController
   def show
     app, space, org = AppFetcher.new.fetch(hashed_params[:guid])
 
-    app_not_found! unless app && permission_queryer.untrusted_can_read_from_space?(space.guid, org.guid)
+    app_not_found! unless app && permission_queryer.can_read_from_space?(space.guid, org.guid)
     unauthorized! unless permission_queryer.can_read_secrets_in_space?(space.guid, org.guid)
 
     manifest_presenter = Presenters::V3::AppManifestPresenter.new(app, app.service_bindings, app.routes)

diff --git a/app/controllers/v3/app_revisions_controller.rb b/app/controllers/v3/app_revisions_controller.rb
@@ -14,7 +14,7 @@ def index
     invalid_param!(message.errors.full_messages) unless message.valid?
 
     app, space, org = AppFetcher.new.fetch(hashed_params[:guid])
-    app_not_found! unless app && permission_queryer.untrusted_can_read_from_space?(space.guid, org.guid)
+    app_not_found! unless app && permission_queryer.can_read_from_space?(space.guid, org.guid)
 
     dataset = AppRevisionsListFetcher.fetch(app, message)
 
@@ -31,7 +31,7 @@ def deployed
     invalid_param!(message.errors.full_messages) unless message.valid?
 
     app, space, org = AppFetcher.new.fetch(hashed_params[:guid])
-    app_not_found! unless app && permission_queryer.untrusted_can_read_from_space?(space.guid, org.guid)
+    app_not_found! unless app && permission_queryer.can_read_from_space?(space.guid, org.guid)
 
     dataset = AppRevisionsListFetcher.fetch_deployed(app)
 

diff --git a/app/controllers/v3/apps_controller.rb b/app/controllers/v3/apps_controller.rb
@@ -41,7 +41,7 @@ def index
     dataset = if permission_queryer.can_read_globally?
                 AppListFetcher.fetch_all(message, eager_loaded_associations: Presenters::V3::AppPresenter.associated_resources)
               else
-                AppListFetcher.fetch(message, permission_queryer.readable_supporter_space_guids,
+                AppListFetcher.fetch(message, permission_queryer.readable_space_guids,
 eager_loaded_associations: Presenters::V3::AppPresenter.associated_resources)
               end
 
@@ -69,7 +69,7 @@ def show
 
     app, space, org = AppFetcher.new.fetch(hashed_params[:guid])
 
-    app_not_found! unless app && permission_queryer.untrusted_can_read_from_space?(space.guid, org.guid)
+    app_not_found! unless app && permission_queryer.can_read_from_space?(space.guid, org.guid)
 
     decorators = []
     decorators << IncludeSpaceDecorator if IncludeSpaceDecorator.match?(message.include)
@@ -87,7 +87,7 @@ def create
     unprocessable!(message.errors.full_messages) unless message.valid?
 
     space = Space.where(guid: message.space_guid).first
-    unprocessable_space! unless space && permission_queryer.untrusted_can_read_from_space?(space.guid, space.organization_guid)
+    unprocessable_space! unless space && permission_queryer.can_read_from_space?(space.guid, space.organization_guid)
     unauthorized! unless permission_queryer.can_write_to_space?(space.guid)
     # TODO: only fail if also not `kpack` app lifecycle
     if message.lifecycle_type == VCAP::CloudController::PackageModel::DOCKER_TYPE
@@ -117,7 +117,7 @@ def update
 
     app, space, org = AppFetcher.new.fetch(hashed_params[:guid])
 
-    app_not_found! unless app && permission_queryer.untrusted_can_read_from_space?(space.guid, org.guid)
+    app_not_found! unless app && permission_queryer.can_read_from_space?(space.guid, org.guid)
     unauthorized! unless permission_queryer.can_write_to_space?(space.guid)
 
     lifecycle = AppLifecycleProvider.provide_for_update(message, app)
@@ -142,7 +142,7 @@ def update
   def destroy
     app, space, org = AppDeleteFetcher.new.fetch(hashed_params[:guid])
 
-    app_not_found! unless app && permission_queryer.untrusted_can_read_from_space?(space.guid, org.guid)
+    app_not_found! unless app && permission_queryer.can_read_from_space?(space.guid, org.guid)
     unauthorized! unless permission_queryer.can_write_to_space?(space.guid)
 
     delete_action = AppDelete.new(user_audit_info)
@@ -157,9 +157,9 @@ def destroy
 
   def start
     app, space, org = AppFetcher.new.fetch(hashed_params[:guid])
-    app_not_found! unless app && permission_queryer.untrusted_can_read_from_space?(space.guid, org.guid)
+    app_not_found! unless app && permission_queryer.can_read_from_space?(space.guid, org.guid)
     unprocessable_lacking_droplet! unless app.droplet
-    unauthorized! unless permission_queryer.untrusted_can_write_to_space?(space.guid)
+    unauthorized! unless permission_queryer.can_manage_apps_in_space?(space.guid)
 
     if app.lifecycle_type == DockerLifecycleDataModel::LIFECYCLE_TYPE
       FeatureFlag.raise_unless_enabled!(:diego_docker)
@@ -180,8 +180,8 @@ def start
 
   def stop
     app, space, org = AppFetcher.new.fetch(hashed_params[:guid])
-    app_not_found! unless app && permission_queryer.untrusted_can_read_from_space?(space.guid, org.guid)
-    unauthorized! unless permission_queryer.untrusted_can_write_to_space?(space.guid)
+    app_not_found! unless app && permission_queryer.can_read_from_space?(space.guid, org.guid)
+    unauthorized! unless permission_queryer.can_manage_apps_in_space?(space.guid)
 
     AppStop.stop(app: app, user_audit_info: user_audit_info)
     TelemetryLogger.v3_emit(
@@ -199,9 +199,9 @@ def stop
 
   def restart
     app, space, org = AppFetcher.new.fetch(hashed_params[:guid])
-    app_not_found! unless app && permission_queryer.untrusted_can_read_from_space?(space.guid, org.guid)
+    app_not_found! unless app && permission_queryer.can_read_from_space?(space.guid, org.guid)
     unprocessable_lacking_droplet! unless app.droplet
-    unauthorized! unless permission_queryer.untrusted_can_write_to_space?(space.guid)
+    unauthorized! unless permission_queryer.can_manage_apps_in_space?(space.guid)
 
     if app.lifecycle_type == DockerLifecycleDataModel::LIFECYCLE_TYPE
       FeatureFlag.raise_unless_enabled!(:diego_docker)
@@ -228,7 +228,7 @@ def builds
     invalid_param!(message.errors.full_messages) unless message.valid?
 
     app, space, org = AppFetcher.new.fetch(hashed_params[:guid])
-    app_not_found! unless app && permission_queryer.untrusted_can_read_from_space?(space.guid, org.guid)
+    app_not_found! unless app && permission_queryer.can_read_from_space?(space.guid, org.guid)
 
     dataset = AppBuildsListFetcher.fetch_all(app.guid, message)
     render status: :ok, json: Presenters::V3::PaginatedListPresenter.new(
@@ -244,7 +244,7 @@ def show_env
 
     FeatureFlag.raise_unless_enabled!(:env_var_visibility)
 
-    app_not_found! unless app && permission_queryer.untrusted_can_read_from_space?(space.guid, org.guid)
+    app_not_found! unless app && permission_queryer.can_read_from_space?(space.guid, org.guid)
     unauthorized! unless permission_queryer.can_read_app_environment_variables?(space.guid, org.guid)
     show_secrets = permission_queryer.can_read_system_environment_variables?(space.guid, org.guid)
 
@@ -260,7 +260,7 @@ def show_environment_variables
 
     app, space, org = AppFetcher.new.fetch(hashed_params[:guid])
 
-    app_not_found! unless app && permission_queryer.untrusted_can_read_from_space?(space.guid, org.guid)
+    app_not_found! unless app && permission_queryer.can_read_from_space?(space.guid, org.guid)
     unauthorized! unless permission_queryer.can_read_app_environment_variables?(space.guid, org.guid)
 
     FeatureFlag.raise_unless_enabled!(:space_developer_env_var_visibility)
@@ -273,8 +273,8 @@ def show_environment_variables
   def update_environment_variables
     app, space, org = AppFetcher.new.fetch(hashed_params[:guid])
 
-    app_not_found! unless app && permission_queryer.untrusted_can_read_from_space?(space.guid, org.guid)
-    unauthorized! unless permission_queryer.untrusted_can_write_to_space?(space.guid)
+    app_not_found! unless app && permission_queryer.can_read_from_space?(space.guid, org.guid)
+    unauthorized! unless permission_queryer.can_manage_apps_in_space?(space.guid)
 
     message = UpdateEnvironmentVariablesMessage.new(hashed_params[:body])
     unprocessable!(message.errors.full_messages) unless message.valid?
@@ -290,8 +290,8 @@ def assign_current_droplet
     cannot_remove_droplet! if hashed_params[:body].key?('data') && droplet_guid.nil?
     app, space, org, droplet = AssignCurrentDropletFetcher.new.fetch(app_guid, droplet_guid)
 
-    app_not_found! unless app && permission_queryer.untrusted_can_read_from_space?(space.guid, org.guid)
-    unauthorized! unless permission_queryer.untrusted_can_write_to_space?(space.guid)
+    app_not_found! unless app && permission_queryer.can_read_from_space?(space.guid, org.guid)
+    unauthorized! unless permission_queryer.can_manage_apps_in_space?(space.guid)
     deployment_in_progress! if app.deploying?
 
     AppAssignDroplet.new(user_audit_info).assign(app, droplet)
@@ -309,7 +309,7 @@ def assign_current_droplet
 
   def current_droplet_relationship
     app, space, org = AppFetcher.new.fetch(hashed_params[:guid])
-    app_not_found! unless app && permission_queryer.untrusted_can_read_from_space?(space.guid, org.guid)
+    app_not_found! unless app && permission_queryer.can_read_from_space?(space.guid, org.guid)
     droplet = DropletModel.where(guid: app.droplet_guid).eager(:space, space: :organization).first
 
     droplet_not_found! unless droplet
@@ -324,7 +324,7 @@ def current_droplet_relationship
 
   def current_droplet
     app, space, org = AppFetcher.new.fetch(hashed_params[:guid])
-    app_not_found! unless app && permission_queryer.untrusted_can_read_from_space?(space.guid, org.guid)
+    app_not_found! unless app && permission_queryer.can_read_from_space?(space.guid, org.guid)
     droplet = DropletModel.where(guid: app.droplet_guid).eager(:space, space: :organization).first
 
     droplet_not_found! unless droplet
@@ -334,7 +334,7 @@ def current_droplet
   def show_permissions
     app, space, org = AppFetcher.new.fetch(hashed_params[:guid])
 
-    app_not_found! unless app && permission_queryer.untrusted_can_read_from_space?(space.guid, org.guid)
+    app_not_found! unless app && permission_queryer.can_read_from_space?(space.guid, org.guid)
 
     render status: :ok, json: {
       read_basic_data: true,

diff --git a/app/controllers/v3/builds_controller.rb b/app/controllers/v3/builds_controller.rb
@@ -14,7 +14,7 @@ def index
     dataset = if permission_queryer.can_read_globally?
                 BuildListFetcher.fetch_all(message, eager_loaded_associations: Presenters::V3::BuildPresenter.associated_resources)
               else
-                BuildListFetcher.fetch_for_spaces(message, space_guids: permission_queryer.readable_supporter_space_guids,
+                BuildListFetcher.fetch_for_spaces(message, space_guids: permission_queryer.readable_space_guids,
                   eager_loaded_associations: Presenters::V3::BuildPresenter.associated_resources)
               end
 
@@ -33,7 +33,7 @@ def create
     package = PackageModel.where(guid: message.package_guid).
               eager(:app, :space, space: :organization, app: :buildpack_lifecycle_data).first
     unprocessable_package! unless package &&
-      permission_queryer.untrusted_can_write_to_space?(package.space.guid)
+      permission_queryer.can_manage_apps_in_space?(package.space.guid)
 
     FeatureFlag.raise_unless_enabled!(:diego_docker) if package.type == PackageModel::DOCKER_TYPE
 
@@ -92,15 +92,15 @@ def update
   def show
     build = BuildModel.find(guid: hashed_params[:guid])
 
-    build_not_found! unless build && permission_queryer.untrusted_can_read_from_space?(build.app.space.guid, build.app.space.organization.guid)
+    build_not_found! unless build && permission_queryer.can_read_from_space?(build.app.space.guid, build.app.space.organization.guid)
 
     render status: :ok, json: Presenters::V3::BuildPresenter.new(build)
   end
 
   private
 
   def can_read_build?(space)
-    permission_queryer.can_update_build_state? || permission_queryer.untrusted_can_read_from_space?(space.guid, space.organization.guid)
+    permission_queryer.can_update_build_state? || permission_queryer.can_read_from_space?(space.guid, space.organization.guid)
   end
 
   def create_valid_update_message

diff --git a/app/controllers/v3/deployments_controller.rb b/app/controllers/v3/deployments_controller.rb
@@ -15,7 +15,7 @@ def index
     dataset = if permission_queryer.can_read_globally?
                 DeploymentListFetcher.fetch_all(message)
               else
-                DeploymentListFetcher.fetch_for_spaces(message, space_guids: permission_queryer.readable_supporter_space_guids)
+                DeploymentListFetcher.fetch_for_spaces(message, space_guids: permission_queryer.readable_space_guids)
               end
 
     render status: :ok, json: Presenters::V3::PaginatedListPresenter.new(
@@ -33,7 +33,7 @@ def create
     unprocessable!(message.errors.full_messages) unless message.valid?
 
     app = AppModel.find(guid: message.app_guid)
-    unprocessable!('Unable to use app. Ensure that the app exists and you have access to it.') unless app && permission_queryer.untrusted_can_write_to_space?(app.space.guid)
+    unprocessable!('Unable to use app. Ensure that the app exists and you have access to it.') unless app && permission_queryer.can_manage_apps_in_space?(app.space.guid)
     unprocessable!('Cannot create deployment from a revision for an app without revisions enabled') if message.revision_guid && !app.revisions_enabled
 
     begin
@@ -58,7 +58,7 @@ def create
   def update
     deployment = DeploymentModel.find(guid: hashed_params[:guid])
     resource_not_found!(:deployment) unless deployment &&
-      permission_queryer.untrusted_can_read_from_space?(deployment.app.space.guid, deployment.app.space.organization.guid)
+      permission_queryer.can_read_from_space?(deployment.app.space.guid, deployment.app.space.organization.guid)
     unauthorized! unless permission_queryer.can_write_to_space?(deployment.app.space.guid)
 
     message = VCAP::CloudController::DeploymentUpdateMessage.new(hashed_params[:body])
@@ -73,15 +73,15 @@ def show
     deployment = DeploymentModel.find(guid: hashed_params[:guid])
 
     resource_not_found!(:deployment) unless deployment &&
-      permission_queryer.untrusted_can_read_from_space?(deployment.app.space.guid, deployment.app.space.organization.guid)
+      permission_queryer.can_read_from_space?(deployment.app.space.guid, deployment.app.space.organization.guid)
 
     render status: :ok, json: Presenters::V3::DeploymentPresenter.new(deployment)
   end
 
   def cancel
     deployment = DeploymentModel.find(guid: hashed_params[:guid])
 
-    resource_not_found!(:deployment) unless deployment && permission_queryer.untrusted_can_write_to_space?(deployment.app.space_guid)
+    resource_not_found!(:deployment) unless deployment && permission_queryer.can_manage_apps_in_space?(deployment.app.space_guid)
 
     begin
       DeploymentCancel.cancel(deployment: deployment, user_audit_info: user_audit_info)