Uploaded image for project: 'Project Quay'
  1. Project Quay
  2. PROJQUAY-7157

getOrganizationPrototypePermissions API with super user token doesn't work when enable FEATURE_SUPERUSERS_FULL_ACCESS

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Normal Normal
    • quay-v3.11.2
    • quay-v3.11.0
    • quay

      Description of problem:

      When enable FEATURE_SUPERUSERS_FULL_ACCESS, getOrganizationPrototypePermissions API with super user token doesn't work against default permission created by normal user. 

      Version-Release number of selected component (if applicable):

      quay-operator-bundle-container-v3.11.1-18)
------------------------------ 
registry.redhat.io/quay/quay-operator-rhel8@sha256:a3a2171448b30385700e6f64633016abfb5dc331849a91cdc354405a32eb444c
------------------------------
registry.redhat.io/quay/quay-rhel8@sha256:bca647c67c7ece7fb427498db44af850ca05b4cba2f55b78d90fb9d7059883e7

      How reproducible:

      1. enable FEATURE_SUPERUSERS_FULL_ACCESS in quay config.yaml

      FEATURE_SUPERUSERS_FULL_ACCESS: true 
SUPER_USERS:
  - whuquay

      2. Create a normal user "user1" , "user2"  and a super user "whuquay".

      3. log in quay by normal user "user1" and create a organization "user1_org"

      4. create a team 'user1_team' and a robot account 'user1_robot'

      5 create a default permission  by normal user1

      $ curl -k -X POST -H 'Accept: application/json' -H 'Content-Type: application/json' -H "Authorization: Bearer pt6TaFkCp0oxKWvVMuIl5hhezFetGVgFF57zf3WU"  --data '{"delegate":{"name":"user1_team","kind":"team","is_org_member": true},"role":"read","activating_user":{"name":"user1_org+user1_robot","kind":"user","is_robot":true,"is_org_member":true}}' https://quayregistry-quay-quay-enterprise.apps.whu415aw12.qe.devcluster.openshift.com/api/v1/organization/user1_org/prototypes
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   716  100   530  100   186    306    107  0:00:01  0:00:01 --:--:--   413
{
  "activating_user": {
    "name": "user1_org+user1_robot",
    "is_robot": true,
    "kind": "user",
    "is_org_member": true,
    "avatar": {
      "name": "user1_org+user1_robot",
      "hash": "33d7ac6acad38699949e2be1a660db8e544eb38b09a8719f9c0d3125a7d6e4cf",
      "color": "#9edae5",
      "kind": "robot"
    }
  },
  "delegate": {
    "name": "user1_team",
    "kind": "team",
    "avatar": {
      "name": "user1_team",
      "hash": "573545c1eceaf01f637d3e0fe05eb38ee91861600fff9a8c3cbf5568a76f7868",
      "color": "#9c9ede",
      "kind": "team"
    }
  },
  "role": "read",
  "id": "88f31ad8-85a6-4538-9436-221d7ef936fa"
}

      6. call getOrganizationPrototypePermissions API with super user token against default permission created in above step.

      Actual results:

      Super user can't list default permissions created by normal user by calling API "GET /api/v1/organization/{orgname}/prototypes" when enable FEATURE_SUPERUSERS_FULL_ACCESS

      =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=
-> super user token : Uh7HKz1jKpzpkXqHb6eZncTwXDiuz18EkzZ8o0BC
-> normal user token: pt6TaFkCp0oxKWvVMuIl5hhezFetGVgFF57zf3WU
->
-> 
=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=  

------------------------------
$ curl -k -X GET -H "Content-Type: application/json" -H "Authorization: Bearer Uh7HKz1jKpzpkXqHb6eZncTwXDiuz18EkzZ8o0BC" https://quayregistry-quay-quay-enterprise.apps.whu415aw14.qe.devcluster.openshift.com/api/v1/organization/user1_org/prototypes
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   271  100   271    0     0    178      0  0:00:01  0:00:01 --:--:--   178
{
  "detail": "Unauthorized",
  "error_message": "Unauthorized",
  "error_type": "insufficient_scope",
  "title": "insufficient_scope",
  "type": "https://quayregistry-quay-quay-enterprise.apps.whu415aw14.qe.devcluster.openshift.com/api/v1/error/insufficient_scope",
  "status": 403
}

      Expected results

      Super user can list default permissions created by normal user by calling API "GET /api/v1/organization/{orgname}/prototypes"  when enable FEATURE_SUPERUSERS_FULL_ACCESS

      Additional Information:

      Normal user "user1" can list default permissions by calling API "GET /api/v1/organization/{orgname}/prototypes" successfully.

      =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=
-> super user token : Uh7HKz1jKpzpkXqHb6eZncTwXDiuz18EkzZ8o0BC
-> normal user token: pt6TaFkCp0oxKWvVMuIl5hhezFetGVgFF57zf3WU
->
-> list team users by normal user
=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*= 

$ curl -k -X GET -H "Content-Type: application/json" -H "Authorization: Bearer pt6TaFkCp0oxKWvVMuIl5hhezFetGVgFF57zf3WU"  https://quayregistry-quay-quay-enterprise.apps.whu415aw14.qe.devcluster.openshift.com/api/v1/organization/user1_org/prototypes |jq .
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   548  100   548    0     0    575      0 --:--:-- --:--:-- --:--:--   575
{
  "prototypes": [
    {
      "activating_user": {
        "name": "user1_org+user1_robot",
        "is_robot": true,
        "kind": "user",
        "is_org_member": true,
        "avatar": {
          "name": "user1_org+user1_robot",
          "hash": "a39b271255ec8cbc41e9635b62060ea42f752cc3f803367aab74bb0b128520db",
          "color": "#ffbb78",
          "kind": "robot"
        }
      },
      "delegate": {
        "name": "user1_team",
        "kind": "team",
        "avatar": {
          "name": "user1_team",
          "hash": "573545c1eceaf01f637d3e0fe05eb38ee91861600fff9a8c3cbf5568a76f7868",
          "color": "#9c9ede",
          "kind": "team"
        }
      },
      "role": "read",
      "id": "3d7cbd7c-65f8-40bc-8c4e-fd6697f3ab00"
    }
  ]
}

       

      Super user can't list default permissions created by itself by API "GET /api/v1/organization/{orgname}/prototypes" either when enable FEATURE_SUPERUSERS_FULL_ACCESS 

       

      =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=
-> super user token : Uh7HKz1jKpzpkXqHb6eZncTwXDiuz18EkzZ8o0BC
-> normal user token: pt6TaFkCp0oxKWvVMuIl5hhezFetGVgFF57zf3WU
->
-> create new organization default permission by super user
=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=

------------------------------
$ curl -k -X POST -H 'Accept: application/json' -H 'Content-Type: application/json' -H "Authorization: Bearer Uh7HKz1jKpzpkXqHb6eZncTwXDiuz18EkzZ8o0BC"  --data '{"delegate":{"name":"user1_team","kind":"team","is_org_member": true},"role":"read","activating_user":{"name":"user2","kind":"user","is_robot":false, "is_org_member":true}}' https://quayregistry-quay-quay-enterprise.apps.whu415aw14.qe.devcluster.openshift.com/api/v1/organization/user1_org/prototypes
100   671  100   499  100   172    490    169  0:00:01  0:00:01 --:--:--   659
{
  "activating_user": {
    "name": "user2",
    "is_robot": false,
    "kind": "user",
    "is_org_member": false,
    "avatar": {
      "name": "user2",
      "hash": "0f6e39ad0c7e038ad8dfcc3459ac26a01191d8230505198cbfb623874254310f",
      "color": "#c7c7c7",
      "kind": "user"
    }
  },
  "delegate": {
    "name": "user1_team",
    "kind": "team",
    "avatar": {
      "name": "user1_team",
      "hash": "573545c1eceaf01f637d3e0fe05eb38ee91861600fff9a8c3cbf5568a76f7868",
      "color": "#9c9ede",
      "kind": "team"
    }
  },
  "role": "read",
  "id": "5a62c710-885a-438f-ac25-ef8f44ccd190"
}  

------------------------------
$ curl -k -X GET -H "Content-Type: application/json" -H "Authorization: Bearer Uh7HKz1jKpzpkXqHb6eZncTwXDiuz18EkzZ8o0BC" https://quayregistry-quay-quay-enterprise.apps.whu415aw14.qe.devcluster.openshift.com/api/v1/organization/user1_org/prototypes
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   271  100   271    0     0    178      0  0:00:01  0:00:01 --:--:--   178
{
  "detail": "Unauthorized",
  "error_message": "Unauthorized",
  "error_type": "insufficient_scope",
  "title": "insufficient_scope",
  "type": "https://quayregistry-quay-quay-enterprise.apps.whu415aw14.qe.devcluster.openshift.com/api/v1/error/insufficient_scope",
  "status": 403
}

       

       

       

              bcaton@redhat.com Brandon Caton
              rhwhu Weihua Hu
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: