docker/quay
1
0
Fork 0
mirror of https://github.com/quay/quay.git synced 2025-11-17 23:02:34 +03:00
Code Activity

api: adding permissions for global readonly superuser (PROJQUAY-7177) (#2993)

Browse Source 
The global readonly superuser is missing read only permissions on certain GET api's. This adds those permissions.
This commit is contained in:
Brandon Caton
2024-07-09 13:17:26 -04:00
committed by GitHub
parent 13f6cd590c
commit cad8326d4a
17 changed files with 431 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
endpoints/api/robot.py
View File

@@ -12,6 +12,7 @@ from auth.permissions import (
from data.model import InvalidRobotException
from endpoints.api import (
ApiResource,
allow_if_global_readonly_superuser,
allow_if_superuser,
log_action,
max_json_size,
@@ -186,7 +187,7 @@ class OrgRobotList(ApiResource):
List the organization's robots.
"""
permission = OrganizationMemberPermission(orgname)
if permission.can() or allow_if_superuser():
if permission.can() or allow_if_superuser() or allow_if_global_readonly_superuser():
include_token = AdministerOrganizationPermission(orgname).can() and parsed_args.get(
"token", True
)
@@ -225,7 +226,7 @@ class OrgRobot(ApiResource):
Returns the organization's robot with the specified name.
"""
permission = AdministerOrganizationPermission(orgname)
if permission.can() or allow_if_superuser():
if permission.can() or allow_if_superuser() or allow_if_global_readonly_superuser():
robot = model.get_org_robot(robot_shortname, orgname)
return robot.to_dict(include_metadata=True, include_token=True)
@@ -324,7 +325,7 @@ class OrgRobotPermissions(ApiResource):
Returns the list of repository permissions for the org's robot.
"""
permission = AdministerOrganizationPermission(orgname)
if permission.can() or allow_if_superuser():
if permission.can() or allow_if_superuser() or allow_if_global_readonly_superuser():
robot = model.get_org_robot(robot_shortname, orgname)
permissions = model.list_robot_permissions(robot.name)