fix(rbac): use team ids to get namespace access [r8s-154] (#209)

portainer · Dec 5, 2024 · 5d4d388 · 5d4d388
1 parent 473084e
commit 5d4d388
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 3 deletions.
diff --git a/api/http/handler/kubernetes/handler.go b/api/http/handler/kubernetes/handler.go
@@ -206,7 +206,17 @@ func (handler *Handler) kubeClientMiddleware(next http.Handler) http.Handler {
 				return
 			}
 
-			nonAdminNamespaces, err = pcli.GetNonAdminNamespaces(int(user.ID), endpoint.Kubernetes.Configuration.RestrictDefaultNamespace)
+			teamMemberships, err := handler.DataStore.TeamMembership().TeamMembershipsByUserID(user.ID)
+			if err != nil {
+				httperror.WriteError(w, http.StatusInternalServerError, "an error occurred during the KubeClientMiddleware operation, unable to get team memberships for user: ", err)
+				return
+			}
+			teamIDs := []int{}
+			for _, membership := range teamMemberships {
+				teamIDs = append(teamIDs, int(membership.TeamID))
+			}
+
+			nonAdminNamespaces, err = pcli.GetNonAdminNamespaces(int(user.ID), teamIDs, endpoint.Kubernetes.Configuration.RestrictDefaultNamespace)
 			if err != nil {
 				httperror.WriteError(w, http.StatusInternalServerError, "an error occurred during the KubeClientMiddleware operation, unable to retrieve non-admin namespaces. Error: ", err)
 				return

diff --git a/api/kubernetes/cli/access.go b/api/kubernetes/cli/access.go
@@ -124,7 +124,7 @@ func (kcl *KubeClient) UpdateNamespaceAccessPolicies(accessPolicies map[string]p
 }
 
 // GetNonAdminNamespaces retrieves namespaces for a non-admin user, excluding the default namespace if restricted.
-func (kcl *KubeClient) GetNonAdminNamespaces(userID int, isRestrictDefaultNamespace bool) ([]string, error) {
+func (kcl *KubeClient) GetNonAdminNamespaces(userID int, teamIDs []int, isRestrictDefaultNamespace bool) ([]string, error) {
 	accessPolicies, err := kcl.GetNamespaceAccessPolicies()
 	if err != nil {
 		return nil, fmt.Errorf("an error occurred during the getNonAdminNamespaces operation, unable to get namespace access policies via portainer-config. check if portainer-config configMap exists in the Kubernetes cluster: %w", err)
@@ -136,7 +136,7 @@ func (kcl *KubeClient) GetNonAdminNamespaces(userID int, isRestrictDefaultNamesp
 	}
 
 	for namespace, accessPolicy := range accessPolicies {
-		if hasUserAccessToNamespace(userID, nil, accessPolicy) {
+		if hasUserAccessToNamespace(userID, teamIDs, accessPolicy) {
 			nonAdminNamespaces = append(nonAdminNamespaces, namespace)
 		}
 	}